I destroyed two different operating systems at the same holiday

I own laptop, as well as desktop PC. I managed to destroy two of them and get them back working, without reinstall. In laptop's case I didn't even need external USB drive.

But... how I managed to destroy two different operating systems? Is it really that easy to blow your computers up? The problem is that in two cases I don't know what was the real fault.

ntoskrnl.exe and Windows Resource Protection

Casual session at the terminal. Still making fun of Windows permissions. Even as a nt-authority/SYSTEM, you can't delete the Windows kernel. It is protected by WRP, which ensured the only user that can delete this file is TrustedInstaller. So I typed this into the terminal, knowing I'd get a permission error [retyped manually]:

C:\Users\Gorciu>cd Pulpit\pstools
C:\Users\Gorciu\Pulpit\PSTools>psexec64 -s cmd.exe

Sysinternals something something
Mark XXX

Could not install psexec service.
C:\Users\Gorciu\Pulpit\PSTools>sudo psexec64 -s cmd.exe

Sysinternals something something
Mark XXX

Microsoft Windows 10.0.26.19433
(c) 2025 Microsoft Corporation

C:\Windows\System32>whoami
nt-authority/SYSTEM
C:\Windows\System32>del ntoskrnl.exe
C:\Windows\System32>

There was no permission error. I did not get Permission Denied. I deleted the Windows kernel.

What did I actually deleted?

System booting consists of three stages:

I deleted the second stage of booting, making my device unusable after the restart. But I did not restarted...

If you have power all the time and you don't have to reboot, you can live without a kernel

no, you can't

I can. The kernel is already loaded into my RAM. It is runned from random access memory, not from the hard disk. It means that for as long as I could not reboot my OS, everything will be fine. But I was on a holiday. I could not have my laptop powered all the time. I needed to act fast.

I changed the kernel, unknowingly failed and rebooted...

Windows knows that kernel and drivers are important. But it isn't that simple like just typing:

pacman -S linux

You see, in Windows the copy of your OS kernel is stored in Windows Side by Side directory (usually C:\Windows\SxS). You'd naturally assume it contains a copy of C:\Windows or C:\Windows\System32 directories. You're wrong.

It will contain a bunch of catalouges, like amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_1f7e1b8d6aafedc7. And even if you'll find the Windows kernel, you'll probably find at least four of them. Two of them being from two different OS versions and other two of them being in r/ folder. For example, you might find these directories for common-controls:

ChatGPT says r means redirected or resource and that I should use the newest version, not from r/. So i did this. I rebooted.

Preparing automatic repair... Diagnosing your PC... Your PC cannot be repaired... LIES!

It can be. Unknowingly I have created a restore point which saved my life. When I was messing up with the kernel, there was a pending Windows Update. It creates a restore point, even if you have them disabled. I restored my system from this restore point. After half an hour it started working again.

The other case

I started the Arch Linux update. There was an error that went unnoticed to the next update, when I finally realized what caused the error. This time, I screenshotted it.

segfault

I probably had segfault while building the initramfs image.

I clicked "Sleep", but my computer wasn't in bed. It was powered on, but it didn't trasmit any signal to any of my output devices. I rebooted using a physical button and GRUB sayed to me that the kernel is not

The thing I did was... yeah, only one command from live boot:

pacman -S linux

I do think operating systems' kernels are unbreakable

I was able to restore every kernel that I fucked up.

Back to blog