HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
zer0mem0ry
ntoskrnl
HISTORICAL RECORD2019–2021
zer0mem0ry / ntoskrnl · Not publicly available

ntoskrnl

Discover this repository through its Hacker News conversations.

5Distinct people
5Mentions
0Explicit recommenders
REPOSITORY AT A GLANCE

What to know before exploring

What it is

A public description has not been verified.

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by month5 dated mentions

Observed mentions: 2019-07-03 03:17:28 UTC to 2021-09-17 08:52:38 UTC.

01232019-07-01 00:00:00 UTC to 2019-08-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 commentsJul 20192019-08-01 00:00:00 UTC to 2019-09-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-09-01 00:00:00 UTC to 2019-10-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-10-01 00:00:00 UTC to 2019-11-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-11-01 00:00:00 UTC to 2019-12-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-12-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2020-01-01 00:00:00 UTC to 2020-02-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2020-02-01 00:00:00 UTC to 2020-03-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2020-03-01 00:00:00 UTC to 2020-04-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2020-04-01 00:00:00 UTC to 2020-05-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2020-05-01 00:00:00 UTC to 2020-06-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2020-06-01 00:00:00 UTC to 2020-07-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2020-07-01 00:00:00 UTC to 2020-08-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2020-08-01 00:00:00 UTC to 2020-09-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 commentsAug 20202020-09-01 00:00:00 UTC to 2020-10-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2020-10-01 00:00:00 UTC to 2020-11-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2020-11-01 00:00:00 UTC to 2020-12-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2020-12-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2021-01-01 00:00:00 UTC to 2021-02-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2021-02-01 00:00:00 UTC to 2021-03-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2021-03-01 00:00:00 UTC to 2021-04-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2021-04-01 00:00:00 UTC to 2021-05-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2021-05-01 00:00:00 UTC to 2021-06-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2021-06-01 00:00:00 UTC to 2021-07-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2021-07-01 00:00:00 UTC to 2021-08-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2021-08-01 00:00:00 UTC to 2021-09-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2021-09-01 00:00:00 UTC to 2021-10-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsSep 2021

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
Jul 20192019-07-01 00:00:00 UTC2019-08-01 00:00:00 UTC303
Aug 20192019-08-01 00:00:00 UTC2019-09-01 00:00:00 UTC000
Sep 20192019-09-01 00:00:00 UTC2019-10-01 00:00:00 UTC000
Oct 20192019-10-01 00:00:00 UTC2019-11-01 00:00:00 UTC000
Nov 20192019-11-01 00:00:00 UTC2019-12-01 00:00:00 UTC000
Dec 20192019-12-01 00:00:00 UTC2020-01-01 00:00:00 UTC000
Jan 20202020-01-01 00:00:00 UTC2020-02-01 00:00:00 UTC101
Feb 20202020-02-01 00:00:00 UTC2020-03-01 00:00:00 UTC000
Mar 20202020-03-01 00:00:00 UTC2020-04-01 00:00:00 UTC000
Apr 20202020-04-01 00:00:00 UTC2020-05-01 00:00:00 UTC000
May 20202020-05-01 00:00:00 UTC2020-06-01 00:00:00 UTC000
Jun 20202020-06-01 00:00:00 UTC2020-07-01 00:00:00 UTC000
Jul 20202020-07-01 00:00:00 UTC2020-08-01 00:00:00 UTC000
Aug 20202020-08-01 00:00:00 UTC2020-09-01 00:00:00 UTC000
Sep 20202020-09-01 00:00:00 UTC2020-10-01 00:00:00 UTC000
Oct 20202020-10-01 00:00:00 UTC2020-11-01 00:00:00 UTC000
Nov 20202020-11-01 00:00:00 UTC2020-12-01 00:00:00 UTC000
Dec 20202020-12-01 00:00:00 UTC2021-01-01 00:00:00 UTC000
Jan 20212021-01-01 00:00:00 UTC2021-02-01 00:00:00 UTC000
Feb 20212021-02-01 00:00:00 UTC2021-03-01 00:00:00 UTC000
Mar 20212021-03-01 00:00:00 UTC2021-04-01 00:00:00 UTC000
Apr 20212021-04-01 00:00:00 UTC2021-05-01 00:00:00 UTC000
May 20212021-05-01 00:00:00 UTC2021-06-01 00:00:00 UTC000
Jun 20212021-06-01 00:00:00 UTC2021-07-01 00:00:00 UTC000
Jul 20212021-07-01 00:00:00 UTC2021-08-01 00:00:00 UTC000
Aug 20212021-08-01 00:00:00 UTC2021-09-01 00:00:00 UTC000
Sep 20212021-09-01 00:00:00 UTC2021-10-01 00:00:00 UTC101

What Hacker News says

5 sources
This is part of what I read on HN: The first thing we observe is that the directory structure is basically identical. Yes, NT kernel subsystems are identified with short codes like "Ke" or "Ex". It's plausible that someone with a lot of NT knowledge would end up creating top level directories with these exact names, as is true of the WRK. But it seems kind of unlikely: the Wine sources do not show this pattern. If we look at the Kernel Executive (Ke) subtree, we can see that there is a thing called a "Balance Set Manager". Both source trees define it in a file called balmgr.c - not only the location of the file but also the file name is identical. https://github.com/Zer0Mem0ry/ntoskrnl/blob/master/Ke/balmgr... https://github.com/reactos/reactos/blob/master/ntoskrnl/ke/b... It appears from the module description that the "balance set manag
Read the rest
er" is an optimisation of some sort related to reducing memory usage. Is this really something that needs a reimplementation with identical function prototypes? Looking at the code of the identically named KeBalanceSetManager function, we can see that not only is the function prototype identical, but the order in which it does things is also identical. First it changes a thread priority, then it schedules a periodic timer callback. Some of the local variables in these functions have identical names: PeriodTimer, DueTime, WaitObjects. Yes, these are obvious names. It's not a smoking gun. But it's not looking good. Finally we discover that the ReactOS Balance Manager does .... nothing. It enters a loop which starts out by doing a wait for an event (fine, it's inherent to the task), and then switches on the result. But the code in the arms of the switch are commented out (the commented out code does a subset of the stuff in the NT code). The loop does nothing, just sits blocking in a loop forever. Why does this code in ReactOS exist if it does nothing? It's the same story for the other big function in this file, KiScanReadyQueues. The code is virtually identical, line for line, with minor formatting and occasional trivial naming differences. Even the assertions are identical. I'm not alleging anything specific or illegal, just comparing a small part of both codebases. However given what I've just seen, I wouldn't touch ReactOS with a barge pole. The Microsoft guy's complaint is entirely understandable. https://news.ycombinator.com/item?id=20345645
In Windows 11: Just say no
I tried googling for KiInitializeContextThread and there are lot of search results for this name. For example, a presentation in Chinese dated 2005 year described process creating and mentions this function: [1] The sequence of events that happens inside KeInitThread() can be obtained from reverse engineering. If you compare the code of this function in WRK [2] and in Reactos [3] code, you'll see that while they do similar things, the code is not the same. Regarding NpxFrame, I don't know why this name is used in KiExitV86Mode, but if you compare functions KiInitializeContextThread in WRK and in Reactos, you'll see that in WRK the variable is named NpxFrame [4], and in Reactos a similar variable is named FxSaveArea (which matches structure FX_SAVE_AREA). The variable named NpxFrame in Reactos is used in other function, KiExitV86Mode. [1]
Read the rest
In A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”
I took a quick look at the structure of the WRK and ReactOS, as the MS developer suggested. I can see what he means. The first thing we observe is that the directory structure is basically identical. Yes, NT kernel subsystems are identified with short codes like "Ke" or "Ex". It's plausible that someone with a lot of NT knowledge would end up creating top level directories with these exact names, as is true of the WRK. But it seems kind of unlikely: the Wine sources do not show this pattern. If we look at the Kernel Executive (Ke) subtree, we can see that there is a thing called a "Balance Set Manager". Both source trees define it in a file called balmgr.c - not only the location of the file but also the file name is identical. https://github.com/Zer0Mem0ry/ntoskrnl/blob/master/Ke/balmgr... https://github.com/reactos/reactos/blob/master/n
Read the rest
toskrnl/ke/b... It appears from the module description that the "balance set manager" is an optimisation of some sort related to reducing memory usage. Is this really something that needs a reimplementation with identical function prototypes? Looking at the code of the identically named KeBalanceSetManager function, we can see that not only is the function prototype identical, but the order in which it does things is also identical. First it changes a thread priority, then it schedules a periodic timer callback. Some of the local variables in these functions have identical names: PeriodTimer, DueTime, WaitObjects. Yes, these are obvious names. It's not a smoking gun. But it's not looking good. Finally we discover that the ReactOS Balance Manager does .... nothing. It enters a loop which starts out by doing a wait for an event (fine, it's inherent to the task), and then switches on the result. But the code in the arms of the switch are commented out (the commented out code does a subset of the stuff in the NT code). The loop does nothing, just sits blocking in a loop forever. Why does this code in ReactOS exist if it does nothing? It's the same story for the other big function in this file, KiScanReadyQueues. The code is virtually identical, line for line, with minor formatting and occasional trivial naming differences. Even the assertions are identical. I'm not alleging anything specific or illegal, just comparing a small part of both codebases. However given what I've just seen, I wouldn't touch ReactOS with a barge pole. The Microsoft guy's complaint is entirely understandable.
In A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”
I was curious, and since the author of this answer provided links to what they called leaks [1], it's not difficult to download both the leak and ReactOS source [2] and look for similarities. So, out of curiosity, that's what I did. I started poking at some source files at random in ntoskernel, and it only took a minute to get some "hits" from the ReactOS source: $ rg InitializeContextThread ./ntoskrnl/ke/thrdobj.c:872: KiInitializeContextThread(Thread, ./ntoskrnl/ke/powerpc/thrdini.c:53:KiInitializeContextThread(IN PKTHREAD Thread, ./ntoskrnl/ke/i386/thrdini.c:92:KiInitializeContextThread(IN PKTHREAD Thread, ./ntoskrnl/ke/amd64/thrdini.c:36:KiInitializeContextThread(IN PKTHREAD Thread, ./ntoskrnl/ke/arm/thrdini.c:53:KiInitializeContextThread(IN PKTHREAD Thread, ./ntoskrnl/include/internal/ke.h:464:KiIn
Read the rest
itializeContextThread( $ rg NpxFrame ./ntoskrnl/ke/i386/v86vdm.c:473: PFX_SAVE_AREA NpxFrame; ./ntoskrnl/ke/i386/v86vdm.c:480: NpxFrame = &StackFrame->NpxArea; ./ntoskrnl/ke/i386/v86vdm.c:481: ASSERT((ULONG_PTR)NpxFrame % 16 == 0); ./ntoskrnl/ke/i386/v86vdm.c:485: RtlCopyMemory(KiGetThreadNpxArea(Thread), NpxFrame, sizeof(FX_SAVE_AREA)); ./ntoskrnl/ke/i386/v86vdm.c:510: PFX_SAVE_AREA NpxFrame = &StackFrame->NpxArea; ./ntoskrnl/ke/i386/v86vdm.c:512: ASSERT((ULONG_PTR)NpxFrame % 16 == 0); ./ntoskrnl/ke/i386/v86vdm.c:551: RtlCopyMemory(NpxFrame, V86Frame->ThreadStack, sizeof(FX_SAVE_AREA)); Now that said, I have no idea what I'm looking for, or if this is significant. But since we have the source for both, it seems we can do better than speculate w/r/t how much code is similar between them. I know that does not prove copying but I think the author's point can't be blindly dismissed. [1] https://github.com/Zer0Mem0ry/ntoskrnl [2] https://sourceforge.net/projects/reactos/files/ReactOS/
In A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.