Technical details

For everyone who wants to know exactly: structure, special features, measurements and tests of NULLos 0.3.4 – with the good numbers and the bad ones.

Where it was measured: Unless stated otherwise, the measurements come from QEMU/TCG on a MacBook Air M5, with x86_64 emulated there. Real hardware is untested.

Structure

Boot chain: UEFI firmware → bootloader nb loads kernel nk and init.img → kernel → ini as the first process → login lgn or desktop ds, on the text console the shell s.
Kernel: a small monolithic kernel with clear inner boundaries – drivers and file systems talk to the rest only through fixed interfaces. The kernel sits in the upper half of the address space and reaches user memory only through its own copy functions. Everything machine-specific lives in a separate layer per CPU.
System calls: 94 named calls (contract “version 17”). Numbers are never reassigned, only added.
Languages: everything C11, only the startup code in assembler. Counted on 31 Oct 2026: about 510,000 lines of C, 77,000 lines of headers and 1,600 lines of assembler – that is 0.3 % of the C code.
Size per part (rough, lines of C and assembler): tools ≈ 461,000, kernel ≈ 35,000, shared libraries ≈ 28,500, compiler ≈ 19,600, C library ≈ 15,800, desktop ≈ 11,800, machine layer ≈ 8,300, bootloader ≈ 1,600.
Kernel building blocks (x86_64): UEFI/GOP, APIC/IOAPIC, HPET, up to 16 CPUs with a scheduler per CPU, ELF loader (fixed and PIE), fork/exec/spawn, signals, pseudo-terminals, VFS with ramfs/devfs/FAT, AHCI/NVMe/virtio-blk, xHCI with keyboard, mouse, USB sticks and USB networking, network cards virtio-net/e1000/e1000e/igb, our own TCP/IP stack (IPv4 and IPv6), sockets, IOMMU (VT-d, AMD-Vi), ACPI with AML, sound via Intel HDA and virtio-sound.
Architectures: builds exist for x86_64 (download), ARM64, RISC-V 64 and RISC-V 32. The download is for x86_64 with UEFI only.
Images 0.3.4: nullos-0.3.4-x86_64.img 81,788,928 bytes, .iso 62,556,160 bytes, 418 programs in /nib. Disk image with GPT and EFI partition (FAT32), the ISO is hybrid.
Tools: 424 entries in the catalog: 311 done, 107 partial, 5 open, 1 skipped.

What's different

An ID card per program: Every tool carries an ID card (“Ausweis”) with its rights, and the kernel enforces it. A program with an invalid ID card does not start. Rights only flow downwards: a program never gets more than its ID card allows, and never more than whoever starts it has. The Flitz browser, for example, may not write files, listen or start processes.
Short commands: the most common ones are a single letter (c copy, m move, l list), the rest two or three. The long name and the Linux name (cp, ls) always work too, so Bash scripts run.
Mirrored system names: names with a Linux model are written backwards: /nib, /cte, /ved, /toob, admin toor, print service dpl. Our own German names and file-format extensions stay.
Network silence by default: Without user action NULLos sends not a single packet – no DHCP, DNS, NTP, mDNS, no update check, no telemetry. The network only comes on with net up or the network switch. The firewall is on by default, incoming is closed.
Login only with a password: There is no default password. You set it at the first start, at least 12 characters with upper and lower case letters, a digit and a special character, enforced by the system.
Demo mode: F2 in the “Passwort festlegen” window sets a random password following these rules, the file “Demo-Zugang” lands on the desktop, the bar shows DEMO. The demo flag can only be set in a virtual machine, and only once until power-off.
Boot check: The bootloader checks the kernel and init.img against the values recorded at build time (SHA-256).
Our own C library: written from scratch. Compared with the macOS libc it is byte for byte identical for printf (5000 random numbers), strtod and strftime in six time zones. No program uses a function of the macOS libc.
Our own C compiler cc: a C11 compiler in C11 with its own assembler and linker, generating code for x86_64, ARM64 and RISC-V 64. It compiles itself, stage 2 and stage 3 are byte-identical, on NULLos in QEMU too. 380 of 402 tools compile with cc and pass their tests (as of 29 Oct).
Our own TLS: TLS 1.3 (client and server) and 1.2 in C11 without any outside library: X25519, ChaCha20-Poly1305, AES-128-GCM, Ed25519, ECDSA P-256, X.509 verification, AES without tables against side channels. SSH client ssh and server ssd with our own cryptography, checked against OpenSSH 10.3.
Flitz browser: our own engine without outside code: HTTP/1.1, HTML following WHATWG, CSS with Flexbox and Grid, images PNG/GIF/JPEG/WebP/SVG and more, our own font reader. The page runs in its own process with a narrow ID card; the desktop only draws the result.
Little outside data, all with origin and licence: the root certificates (117 roots, cross-checked from two sources), the desktop fonts (SIL OFL 1.1, licence texts in the image), CPython as a loadable outside package (not in the image, off by default) and Intel Wi-Fi firmware as an outside package (can be switched off). There are no outside libraries.
Signed releases: The checksums are signed (Ed25519, signify format, our own tool sgn; check with signify -C). The first signed release was 0.3.1.
Release images contain machine code only: no symbols, debug sections, compiler IDs, source paths or test programs. A check stops the build if any of that is in there.
Desktop with behaviour profiles: The behaviour (like macOS, Windows 11, GNOME, KDE, Xfce or i3) is a profile of 56 keys, separate from the look. Drawing and font rasterising are our own.
Everything with IPv6: Every network tool handles IPv4 and IPv6 equally. Without IPv6 none counts as done.

Measurements

What	Value	Where
Boot to the shell (0.3)	about 40 s, observed, not measured exactly	UTM, emulated
Timer during startup	339 ticks in 3498 ms at 100 Hz target – under TCG about 10 % of the target rate	QEMU/TCG
Without `virtio-rng-pci`	the first read of randomness waits about 20 s after start – that's why the device is mandatory in all instructions	QEMU/TCG
Free memory after the system tests	≈ 181 MB of 256 MB, without desktop, no memory leak	QEMU/TCG
Network silence	300 s without interaction: 0 packets from NULLos. Before that the OVMF firmware sends two IPv6 packets, which can be switched off in QEMU	QEMU with capture
Several CPUs	4 CPUs: one computing child 355 ms, four children 461 ms (on one CPU about 1.4 s)	QEMU, raspi4b machine (ARM64), not a real Pi
Cryptography	AES-128-GCM without tables ≈ 26 MB/s (with tables it would be 96 MB/s), ChaCha20 ≈ 930 MB/s – that's why NULLos offers ChaCha20 first	native on the Mac, not in QEMU
Desktop: drawing a full frame	≈ 2 ms at 1280×800, ≈ 3.5 ms at 2560×1600	native on the Mac
Building with ccache	without 92 s, ccache cold 122 s, warm 24 s (49.9 % hits). The results with ccache were not byte-identical to the build without – the `init.img` archive carries timestamps	build on the Mac
Remote computing (RDP/VNC)	not measured	–

Tests

Boot test make check: 16 QEMU runs without a window, commands over the serial console. Among other things it checks the boot check, deliberate kernel panics with readable output, W^X and stack protection, wiping memory at power-off, programs, system calls (94, 81 and 62 cases), four CPUs, IOMMU, booting from GPT/FAT32, tools and shell, the C library, networking (DHCPv4, SLAAC, TCP 1 MB, two NULLos on one wire), keyboard and virtual consoles. Last complete run: 158 ok, 0 FAIL. ARM64: 73 ok, RISC-V 64: 92 ok.
Tools: 416 of 417 have their own test, make test runs them all on the Mac. A sync run builds every tool fresh and writes down the status.
Desktop: 86 cases with 275 state checks, the same moves for every profile.
Fuzzing: 56 targets with libFuzzer and AFL++ under ASan and UBSan, including the browser's HTML, CSS, images and fonts, SSH, TLS, DNS, DHCP and NFS answers, file systems and partitions, the kernel's whole USB stack and the password vault. Every finding gets a permanent test.
Compiler: 15 test files with about 600 checks, ABI test against clang, self-compilation in three stages, assembler output byte for byte against clang.
Release: Every release boots in QEMU in six ways (SATA, NVMe, USB stick, CD, ISO as a stick, ISO as a disk). Checked are checksums, signature, first start with a random password and second login, programs and power-off, plus network silence with a 300 s capture and the image for symbols and paths.
Not tested: real hardware. All drivers are done in QEMU, real devices are still to come. ARM64 and RISC-V 64 only run in QEMU, RISC-V 32 without MMU too, no ESP32-C5 is connected yet. DHCPv6 is unchecked because QEMU has no server.

Deliberate limits

Nothing persists: / lives in RAM. After power-off everything is gone, including the password. A data partition: coming soon
Desktop: a prototype, partly done. The next big release 0.4 only comes when it runs smoothly like a real desktop.
Tools: 107 of 424 are only “partial” so far, mostly hardware info, storage, networking, basic applications and multimedia.
Flitz browser: partial, no JavaScript yet.
Remote computing (access via RDP and VNC): in progress, test successful, coming with one of the next versions.
Wi-Fi sensing: experimental.
No developer kit: There is deliberately no SDK for outside programs, not in the release either.