v1.0 · MIT License · native PE32+ executor

winux — Windows PE
executor for Linux.

Native, transparent execution of Windows PE32+ (x86_64) executables on Linux, without Wine, without VMs, without containers.

Quick Start See the architecture Download · Source
$ git clone https://github.com/devfrp/winux.git && cd winux && make && sudo make install
00

Windows binaries, run as Linux processes

winux loads a PE32+ executable straight into a Linux process: sections mapped into memory, imports resolved, TEB/PEB synthesized, then native execution under a seccomp BPF filter. The .exe name shows up in ps/htop, its PE sections are labeled in /proc/pid/maps — no Wine, no VM, no container.

01

Architecture

Full execution pipeline, from PE binary down to the Linux kernel.

PE LoaderPE32+ parsing · mmap section projection · relocations
↓
Win32 Bridgekernel32.dll stubs · ntdll.dll stubs · Handle→fd table · path translation
↓
Memory · Threads · I/OVirtualAlloc/VirtualFree · TEB/PEB + GS segment · I/O redirection to native descriptors
↓
seccomp BPF Filterwhitelist of ~50 syscalls enforced via libseccomp
↓
Linux Kernel ≥ 4.17 (x86_64)execution stays a native process — scheduling, memory and I/O by the kernel
02

Features

Everything you need to run Windows binaries on Linux, with no compromises.

Loading

PE Loader

Parses PE32+ headers, mmap sections at their virtual addresses, and applies relocations with precision.

Imports

Static IAT Resolver

Static import resolution with ~45 kernel32 functions and 17 ntdll stubs — no external dependencies.

Memory

Memory Manager

Implements VirtualAlloc/VirtualFree and heap allocation with a mutex-protected free-list.

Threads

Thread Model

TEB/PEB synthesis, GS segment configuration via arch_prctl, and native thread management.

Interop

Win32 Bridge

Handle-to-fd table, transparent Windows-to-Linux path translation (C:\ → /, separators, etc.).

Security

seccomp BPF Filter

~50 whitelisted syscalls enforced via libseccomp for hardened isolation.

System

System Integration

Process name shows the .exe name in ps/htop. PE sections labeled in /proc/pid/maps.

I/O

I/O Transparency

Seamless input/output redirection between the Windows user space and native Linux descriptors.

03

Quick Start

Install winux in three commands and run your first PE binary.

Install

# Clone the repository
git clone https://github.com/devfrp/winux.git

# Build
cd winux && make

# Install
sudo make install

# Run a Windows binary!
winexec prog.exe

Available Flags

winexec --debug       # Verbose logging
winexec --no-seccomp  # Disable syscall filter
winexec --paths       # Custom path mapping

Dependencies · Debian / Ubuntu

sudo apt install gcc make libseccomp-dev
04

Specifications

A lightweight, high-performance, well-architected codebase.

~5,600
Lines of C11
11+11+3
Components · Headers · Tests
x86_64
Architecture
≥ 4.17
Min. Linux Kernel
MIT
License
~50
Allowed Syscalls
45
kernel32 Functions
17
ntdll Stubs
05

FAQ

Everything you need to know about winux.

Does winux replace Wine?

No. winux is a lightweight executor specialized in PE32+ (x86_64) binaries. It does not implement the full Win32 API like Wine. It is designed for workloads where transparency and lightness take priority over full compatibility.

What types of binaries are supported?

winux supports Windows PE32+ x86_64 executables. 32-bit binaries (PE32) are not currently supported.

Is it safe for production environments?

winux includes a seccomp BPF filter that restricts the executable to ~50 syscalls. However, like any actively developed tool, evaluate the risks for your use case before production deployment.

Why is Linux kernel ≥ 4.17 required?

winux uses the MAP_FIXED_NOREPLACE mmap flag, introduced in Linux kernel 4.17. This ensures safe memory placement without overwriting existing mappings.

Can I disable the seccomp filter?

Yes, use the --no-seccomp flag. This can be useful for debugging, but removes the security layer provided by syscall filtering.