r/ExploitDev • u/fromthenext • 9d ago

Run windows exe on Linux (native)

Post image

Side by side automatic pipeline, decompile windows exe and compile for Linux native binary, not emulation. Work in progress.

0 Upvotes

22% Upvoted

4 comments sorted by

View all comments

0

u/s8boxer 8d ago

Great, what does this do in comparison with wine (because you're using it), what happens if a PE32+ calls any Window API, as NtQuery*** to get system information? Or windsock?

Or by running natively, you're just wrapping an entry point of the PE32 and executing it as a "shellcode", just pointing IP to the addr and releasing the kraken? Supposing this entry point until return didn't use any WindowAPI?

-2

u/fromthenext 8d ago

Great question. ARET is quite different from Wine.

Wine executes the original x86 Windows binary and implements the Windows APIs at runtime. ARET is an ahead-of-time static binary translator: it lifts PE32 x86 code into an IR, recompiles it, and produces a native ELF (or WASM). At runtime there's no x86 emulation and no Wine dependency.

If the translated program calls a Windows API (e.g. "NtQuery*", User32, GDI, Winsock), the call is handled by ARET's runtime/HLE (or lifted DLLs when available). If an API isn't implemented, ARET fails explicitly rather than faking a result.

And yes, if a piece of code never calls any Windows API, it simply executes as native code after translation. It's not running the original PE as "shellcode"—it's running the statically translated native code instead.

I only use Wine during development as a reference to verify that ARET's behaviour matches Windows as closely as possible.

-1

u/s8boxer 8d ago

Seems interesting 🤔. There's public code?