Tagged
#os-dev
18 posts
What I Actually Learned Building an OS with AI
A capstone reflection on twelve milestones of AI-assisted kernel work — boot to a browsable filesystem — tested in the least forgiving domain I could find, where a wrong line triple-faults instead of throwing a stack trace. What the method was really about, and what held up.
ReadA Remote Pwn Target
Turning the toy kernel into a real remote CTF: a unique flag that lives only in one server's RAM, and the far harder half — building a blast chamber where strangers can detonate exploits at me without taking the house down. The bug was an afternoon; the isolation was the month.
ReadA CTF Against My Own Kernel
I proved my toy filesystem would leak a hidden flag if you handed it a forged disk image — then turned that private, one-shot proof into a browser CTF you can play. Here's the bug, and the delivery engineering it took to let anyone throw the switch.
ReadYou Can Boot It in Your Browser Now
The real 64-bit kernel — not a screenshot, not a screen recording — running live in a tab you can click. What that took, and the two bugs that had been hiding in plain sight until I moved the specimen to a new enclosure.
ReadHello Over a Socket That Isn't
A loopback interface, a socket you can bind and send from, 'hello' delivered by address — and no IP, no protocols, no wire, no peer. On a project whose biggest risk is scope creep, deciding what not to build was the whole milestone.
ReadAttacking the Lies About Disk Layout
A flag hidden in the RAM disk with no name, a crafted directory entry that reads it right out, and the one-field fix that turns 'in the image' into 'in the data.' A bounds check is only as trustworthy as the bound it compares against.
ReadThe confused deputy
I planted a flag on a kernel-only page and wrote a ring-3 program to steal it. The CPU stopped the direct read cold — then my own syscall handed the flag over the moment it dereferenced a caller-chosen pointer. The one door the hardware cannot guard for you.
ReadThe first wall
Ring 3, a syscall gate, and the two bits that turn 'the kernel is the only program' into 'the kernel runs code it doesn't trust.' The first time in this project that the hardware, not my kernel's goodwill, holds code back.
ReadThe whole point, arrived at
Subdirectories, cd/pwd/ls/cat, and the moment the core arc — boot, memory, tasks, shell, files — is complete. Along the way I learned the hard way that a termination proof is not a safety proof: my validator provably terminated and still hid two denial-of-service bugs.
ReadFiles are just convincing lies about disk layout
I built a read-only filesystem for my from-scratch kernel, and the lesson is what a 'file' actually is: a directory table of {name, offset, length} over a flat run of bytes. The hard, security-relevant code isn't the reading — it's the refusing.
ReadIt has a prompt now
My from-scratch kernel runs its first interactive program: a shell, spawned as an ordinary task on the scheduler. The keyboard interrupt shrinks to 'enqueue one byte and return' — and the 'interactive code can't be tested' excuse falls apart.
ReadMultiple things at once, sort of
I gave my from-scratch kernel a timer and its first scheduler. Two tasks take turns on one CPU — first politely, then by force — and the preemption step turned out to be a concurrency trap wearing a simple mechanism's face.
ReadRoom to grow
Milestone 8 of my AI-assisted OS build: the heap allocator. The kernel gains dynamic memory — Vec, Box, and String start working with no operating system underneath.
ReadThe illusion of memory
Milestone 7 of my AI-assisted OS build: paging and virtual memory. The kernel stops using the map the bootloader handed it and starts drawing its own — and survives the CR3 switch on the first try.
ReadIt knows what it has now
Milestone 6 of my AI-assisted OS build: physical memory management. The kernel finally learns how much RAM the machine has, and hands it out one 4 KiB frame at a time.
ReadIt Listens Now
Milestone 5 of my from-scratch Rust kernel: PS/2 keyboard input — the first time the machine reacts to the outside world instead of just talking at it. Remapping the PIC, enabling interrupts for the very first time, and learning why forgetting one EOI makes the keyboard die after exactly one keypress.
ReadTeaching It to Fail Gracefully
Milestone 4 of my from-scratch Rust kernel: the IDT and exception handling — where the machine stops silently rebooting on a mistake and starts telling me what went wrong. The whole thing lives or dies on assembly and Rust agreeing about the shape of the stack.
ReadSetting Up to Build Nothing
I'm building an x86-64 operating system from scratch in Rust, and this is milestone zero: a toolchain and an empty kernel that compiles for a machine that isn't my machine. No boot, no output — just the unglamorous groundwork where most OS projects quietly die.
Read