A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?” • Hacker News Board

Re: A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”

#271

Post by bb88 » Fri, Jul 05, 2019, 1:54 AM UTC

geofft wrote: post #267

bb88 wrote: post #99

Earlier quoted context omitted.

> If I learn a pop song, and sing it and accompany myself on the piano, and someone else transcribes it, I hate bad analogies. A bad analogy just confuses the issue. There's one and exactly one song called "Billie Jean", which was written, composed, and performed by Michael Jackson. There are however a thousand different works relating the history of Michael Jackson's work with Quincy Jones in producing the song "Bil…

So, if I sing a song with lyrics "Billie Jean is not my lover" with melody re-re-do-la-re-re-do-la, is it a different song because it was recorded by me? It is pretty clear in copyright law that my recording would infringe Michael Jackson's song. What does "a Windows NT kernel" mean? Exposes the same interface? (Does Linux + WINE count?) Operates internally in the same way? Maybe a better example is UNIX. Linux offer…

> So, if I sing a song with lyrics "Billie Jean is not my lover"...

Please stop talking about music, because it just further confuses your thinking about software copyright.

> What does "a Windows NT kernel" mean?

I mean the plain understanding of "Windows NT Kernel". See wikipedia:

https://en.wikipedia.org/wiki/Architecture_of_Windows_NT https://en.wikipedia.org/wiki/Kernel_(operating_system)

Re: A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”

#272

Post by codedokode » Fri, Jul 05, 2019, 2:25 AM UTC

thom_nic wrote: post #15

jchw wrote: post #3

Interesting, but I’d really like it if they actually pointed out some examples. There may in fact be stolen source code or at least it is possible some stolen source code was referenced in ReactOS - there’s virtually no way to prove that it didn’t happen - but one human’s observation could be very flawed and represent a view extrapolated from a small subset of stolen code. How much of the code could they have possibl…

I was curious, and since the author of this answer provided links to what they called leaks [1], it's not difficult to download both the leak and ReactOS source [2] and look for similarities. So, out of curiosity, that's what I did. I started poking at some source files at random in ntoskernel, and it only took a minute to get some "hits" from the ReactOS source: $ rg InitializeContextThread ./ntoskrnl/ke/thrdobj.c:8…

I tried googling for KiInitializeContextThread and there are lot of search results for this name. For example, a presentation in Chinese dated 2005 year described process creating and mentions this function: [1]

The sequence of events that happens inside KeInitThread() can be obtained from reverse engineering. If you compare the code of this function in WRK [2] and in Reactos [3] code, you'll see that while they do similar things, the code is not the same.

Regarding NpxFrame, I don't know why this name is used in KiExitV86Mode, but if you compare functions KiInitializeContextThread in WRK and in Reactos, you'll see that in WRK the variable is named NpxFrame [4], and in Reactos a similar variable is named FxSaveArea (which matches structure FX_SAVE_AREA). The variable named NpxFrame in Reactos is used in other function, KiExitV86Mode.

[1] https://slideplayer.com/slide/6561298/

[2] https://github.com/Zer0Mem0ry/ntoskrnl/blob/master/Ke/thredo...

[3] https://github.com/reactos/reactos/blob/master/ntoskrnl/ke/t...

[4] https://github.com/Zer0Mem0ry/ntoskrnl/blob/a1eded2d8efb0716...

[5] https://github.com/reactos/reactos/blob/893a3c9d030fd8b078cb...

Re: A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”

#273

Post by codedokode » Fri, Jul 05, 2019, 2:29 AM UTC

tjpnz wrote: post #38

Comments like these are eerily similar to what Microsoft had been saying for years about Linux - at best they had been infringing on patents but I seem to also recall accusations of the kernel containing proprietary Windows source code. This is just one individuals opinion but I would be really interested in seeing them provide more specifics - especially given the amount of MS source that has leaked/been open source…

Exactly. The author doesn't give any references, just says "Trust me, it is the same code". Maybe the author doesn't know that there are many resources with reverse-engineered descriptions of undocumented kernel structures and functions, for example [1] [2]

[1] https://www.nirsoft.net/kernel_struct/vista/index.html

[2] http://msdn.mirt.net/

Re: A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”

#274

Post by codedokode » Fri, Jul 05, 2019, 2:33 AM UTC

moring wrote: post #88

> Many internal data structures and internal functions, not exported anywhere and not part of the public symbols I remember reading that even inside Microsoft, internal structures had to remain backwards-compatible because external, "very important" programs relied on them (violating the public API of course). I can't remember the source, unfortunately. Now it would be interesting which aspects can affect compatibili…

"Many internal structures" that Axel believes are private and available only for MS employees, are actually published in the Internet, for example [1] [2]

[1] https://www.nirsoft.net/kernel_struct/vista/index.html

[2] http://msdn.mirt.net/

Re: A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”

#275

Post by codedokode » Fri, Jul 05, 2019, 2:34 AM UTC

pizza234 wrote: post #180

jeditobe wrote: post #148

Hello from ReactOS team! We don't use the leaked code from MS, We don't use Windows Research Kernel, We thank you for the PR campaign you have stared 'pro bono' for our project! ;D

OP wrote "If any of the presumed authors wants to chime in and explain the similitudes, I’m happy to change my mind". Since you're from the team, could you provide some example explanations? Technical arguments are surely significant, rather than a purely rhetoric answer.

Axel didn't provide any examples of allegedly copied code, so what can they explain?

Re: A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”

#276

Post by codedokode » Fri, Jul 05, 2019, 2:38 AM UTC

notus wrote: post #216

jeditobe wrote: post #148

Hello from ReactOS team! We don't use the leaked code from MS, We don't use Windows Research Kernel, We thank you for the PR campaign you have stared 'pro bono' for our project! ;D

You didn't spell started correctly both on here and on quora aka thanks for the low effort canned response. Maybe try addressing their points directly. This is bad PR for you.

What "points"? Axel didn't provide a single example of what could be allegedly copied code.

Re: A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”

#277

Post by codedokode » Fri, Jul 05, 2019, 2:41 AM UTC

Udo wrote: post #190

jeditobe wrote: post #148

Hello from ReactOS team! We don't use the leaked code from MS, We don't use Windows Research Kernel, We thank you for the PR campaign you have stared 'pro bono' for our project! ;D

This is an utterly insufficient answer to the allegation that you copied internal data structures entirely from the NT kernel, including (why?) their names. Brushing this off as a free "PR campaign" only works if those NT programmers simply made everything up. That's possible, because we as the general public have no way of knowing. But it's hard to ignore that there are just two possible scenarios here, nothing in b…

Many "undocumented" Windows kernel structures are actually documented on third-party sites, for example [1] and [2]

[1] https://www.nirsoft.net/kernel_struct/vista/index.html

[2] http://msdn.mirt.net/

They were found, for example, in debugging symbols released by MS. And sadly Axel didn't provide a single example of code that allegedly was copied.

Re: A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”

#278

Post by codedokode » Fri, Jul 05, 2019, 3:02 AM UTC

intea wrote: post #123

Honestly I always thought that that was an open secret of ReactOS. How else are you gonna achieve binary compatibility with a closed source OS. Of course there's symbols but those only get you so far.

The information about many internal "undocumented" structures is actually documented on third-party sites. And if there are structures that are really not documented anywhere then you don't have to reimplement them because no developer is using them and they are not necessary for compatibility.

Re: A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”

#279

Post by codedokode » Fri, Jul 05, 2019, 3:31 AM UTC

repolfx wrote: post #209

I took a quick look at the structure of the WRK and ReactOS, as the MS developer suggested. I can see what he means. The first thing we observe is that the directory structure is basically identical. Yes, NT kernel subsystems are identified with short codes like "Ke" or "Ex". It's plausible that someone with a lot of NT knowledge would end up creating top level directories with these exact names, as is true of the WR…

Just wanted to comment that Googling "KeBalanceSetManager" gives this article [1] among others (the article mentions the leaked source code but it doesn't contain the code itself, just the description). Many internal function names were leaked with debugging symbols, and some people were reverse engineering those functions (for example, people who deal with malware).

The similarity in code can be explained by reverse engineering. For example, constant names in switch are different (TimerExpiration vs STATUS_WAIT_0).

> Why does this code in ReactOS exist if it does nothing?

Maybe because there is software that relies on the existence of this thread?

Regarding assertions and local variable names and same declaration oder, I don't know where they come from. That looks suspicious.

[1] https://github.com/bowlofstew/rootkit.com/blob/master/90210/...

Re: A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”

#280

Post by mikekchar » Fri, Jul 05, 2019, 7:39 AM UTC

simias wrote: post #156

axelriet wrote: post #95

Earlier quoted context omitted.

Microsoft does not release the kernel’s private symbols, trust me on that. But yes there was some leaks in the past, small portions of NT4 and W2K were leaked, I think I link to a Google query pointing to articles discussing the leaks in the Quora reply.

Are you arguing that MS mistakenly releasing a version of Windows with debug symbols didn't happen or that it constitutes a leak and isn't fair game? Because the former is fairly well documented and the latter doesn't seem right in the context of this discussion. If MS themselves messed up and published the symbols through an official channel that's fair game IMO. Although obviously IANAL etc... I'm talking from an e…

Kind of late to the game here, but MS could ship actual source code and copying that code would still be copyright infringement. Reverse engineering for inter-operability is legal in many places, but copying implementations is not. Even having seen the code, you would have to reimplement it in a way that worked equivalently, but was different. The OP is claiming that even things like macros have the same implementation and names (i.e. code that is never exposed publicly in any way). Even if you could deduce this from debug symbols (which would be quite tricky, but probably not impossible), you've got to find another way to do that work.

I don't really subscribe to a belief of absolute morality, but in the context of the discussion, I think that no matter how you got access to that code, if you say that you are reverse engineering it, then copying an implementation is not doing what you are saying you are doing (as well as being copyright infringement).