Please report all spam threads, posts and suspicious members. We receive spam notifications and will take immediate action!
Page 2 of 2 FirstFirst 12
Results 11 to 19 of 19

Thread: Windows NT and 2000 source code stolen




  1. #11
    Join Date
    Feb 2003
    Posts
    346

    Default

    . But as I expected, some of the most popular first-person shooters don't work at all (eg Unreal, CS1.6, America's Army).
    Just so you know, America's Army has a native Linux client, as do most FPS based on the Quake 3 engine, so there's no reason to run it through WINE :thumb:

  2. #12
    Join Date
    Nov 2003
    Location
    Minnesota, United States
    Posts
    4,543

    Default

    Thanks for the help. I might actually end up trying it.:thumb:

  3. #13
    Join Date
    Dec 2002
    Posts
    4,246

    Default

    ut2k3 also comes with linux support out of the box afaik, although i have yet to actually try it
    I've gone too far and need to move on!

  4. #14
    Join Date
    Dec 2002
    Posts
    4,246

    Default

    back to the topic...
    Windows Source Leak Traces Back to Mainsoft

    BetaNews has learned that Thursday's leak of the Windows 2000 source code originated not from Microsoft, but from long-time Redmond partner Mainsoft.

    The leaked code includes 30,915 files and was apparently removed from a Linux computer used by Mainsoft for development purposes. Dated July 25, 2000, the source code represents Windows 2000 Service Pack 1.

    Analysis indicates files within the leaked archive are only a subset of the Windows source code, which was licensed to Mainsoft for use in the company's MainWin product. MainWin utilizes the source to create native Unix versions of Windows applications.

    Mainsoft says it has incorporated millions of lines of untouched Windows code into MainWin.

    Clues to the source code's origin lie in a "core dump" file, which is left by the Linux operating system to record the memory a program is using when it crashes. Further investigation by BetaNews revealed the machine was likely used by Mainsoft's Director of Technology, Eyal Alaluf.

    References to MainWin can also be found throughout the leaked source files, which do not compile into a usable form of Windows.

    Prior to Microsoft's Shared Source Initiative launched in 2001, Mainsoft, which calls itself "the software porting company," was one of only two partners with access to the Windows source code under Microsoft's Windows Interface Source Environment (WISE) program.

    The goal of WISE is to enable developers to write applications using Windows APIs and deploy them on Unix operating systems such as Linux.

    Mainsoft extended its WISE agreement with Microsoft in March 2000 to include access to the Windows 2000 source. Microsoft subsequently employed Mainsoft to port Windows Media Player 6.3 and Internet Explorer to Unix.

    Although the leak poses a serious threat to Microsoft's intellectual property, its limited scope is sure to help the company alleviate fears of potential disaster. Microsoft has opened an investigation with the FBI and says its internal security in Redmond was not affected.

    Because Mainsoft used only select portions of the Windows source for MainWin, Microsoft may find itself more worried about the egg on its face than possible exposure of its flagship operating system; Windows 2000 served as the foundation for Windows XP and Windows Server 2003.

    It is not clear at this point how the three and a half year-old source code escaped Mainsoft.

    Eric Steil and David Worthington contributed to this report.

    - eweek.com
    I've gone too far and need to move on!

  5. #15
    Join Date
    Dec 2002
    Posts
    4,246

    Default

    Mainsoft Responds

    Statement to the Media Regarding Microsoft Source Code Leak
    Mainsoft has been a Microsoft partner since 1994, when we first entered a source code licensing agreement with Microsoft. Mainsoft takes Microsoft’s and all our customers’ security matters seriously, and we recognize the gravity of the situation.

    We will cooperate fully with Microsoft and all authorities in their investigation

    We are unable to issue any further statement or answer questions until we have more information.

    From Mike Gullard, Chairman of the Board, Mainsoft Corporation
    I've gone too far and need to move on!

  6. #16
    Join Date
    Nov 2003
    Location
    Minnesota, United States
    Posts
    4,543

    Default

    Interesting about mainsoft. It used to seem like Microsoft didn't care about Unix-based OS users. :( Overwriting our boot loaders and all...

    But why would they want to put Internet Explorer and Windows Media Player on Unix? The free alternatives are much better anyway, even Minibubba's signature shows that.

    Because Mainsoft used only select portions of the Windows source for MainWin, Microsoft may find itself more worried about the egg on its face than possible exposure of its flagship operating system; Windows 2000 served as the foundation for Windows XP and Windows Server 2003.
    Sounds good.

    Thanks for the info minibubba. Very educational.

  7. #17
    Join Date
    Dec 2002
    Posts
    4,246

    Default

    something to think about:

    Source Code leaks, and programmer culture

    Security Guard: "I nailed this one trying to escape."
    Dilbert: "What? Since when is leaving your cubicle to use the bathroom escaping?"
    Boss: "Since 2:30 this afternoon."
    --- from Dilbert's Episode #2, "The Competition"


    I HAVE TO agree with one of our as always very intelligent readers: the windows source code leak is, in a sense, not a very big deal. Back in 1999, someone, a disgruntled OS/2 programmer is my guess, apparently released the full IBM OS/2 Warp 4.0 kernel source code into the underground. See the post here. Do I know that this actually happened? Yes. Did IBM ever acknowledge this officially? Not to my knowledge.

    So, when I discovered peer-to-peer networks I decided to find the kind of files that were available, and "source code" was one of my first search entries. To my surprise, "MS-DOS source code" and "Windows CE source code" instantly showed up. It is apparently still being offered there (in the case of Windows CE's source code, without signing the Microsoft Shared Source License that Microsoft requests), right along the much-talked Windows 2000 and NT 4.0 code . A lot of the bigger files are fake, we're told.

    The potential for hacks and tweaks is bigger, yes. As is the potential for a legal soap opera from Microsoft. In the end, I think it's a double edged sword. Microsoft might choose to play victim, and on the other hand, they could also use this as yet-another-argument in its Jihad against linux and open source, by claiming that windows source code is "out there for everybody to see" as well. Of course they will kick the teeth of anybody who attempts to use that code without a hefty license, but that's another matter.

    My conclusion.

    Law is one thing. Reality is another. Weren't some countries not supposed to have some nuclear technology, while in reality there was a vast underground Pakistani-led underground network that traded the "secret" technology?. Over the years as a tech advocate, and even before I decided to start writing, I exchanged e-mails with dozens, probably hundreds of programmers who worked at dozens of companies, from small to billion dollar multinationals. Many of them told me they had "backup" copies at home of the projects they were working on for their employers. A few of them even acknowledged having complete snapshots of the whole source code for the commercial products they worked on "so if I move on I can have a look at how I did things back then", was the rationale in many cases.

    This case got lots of publicity because this particular code hit the peer-to-peer networks, but how many other source is "out of the coffers", with the only difference that it went unnoticed?

    The corporate lawyers might enjoy themselves pretending that their "intellectual property" is actually secret and safe. But is it really? And most important, does it make any difference?.

    Where there's a will, there' s a way
    Leaving aside the motivations in this particular case, does anyone think that the guys coding the Windows kernel, the OS/2 kernel, the MacOS internals, or name-your-sofware-product-here haven't taken a snapshot of the code and stored it at home, for their convenience, as memorabilia, or for ego-related reasons?. Despite what contracts and legal departments might think, when the programmers write some code, emotionally, it's THEIR code, not their employer's. So why not "save a copy for posterity" to later be able to take a peek at this "old code" after moving on to other companies and/or projects?

    We are not talking about nuclear facilities like the Los Alamos or the Sandia National Laboratory in Albuquerque, USA, where there are cameras looking over the shoulders of employees to see what they do with every CD and what system they access, and employees can be strip-searched when entering and leaving the building at the minor suspicion of taking "secret" stuff home, but the permissive, laid back atmosphere that the software companies are proud to promote and boast about, when looking for job candidates.

    In a "connected world", the only secure computer is the one not networked, and placed behind locked doors, all other systems are, to a degree, vulnerable if networked. Intrusions, "source code theft", and code leaks by pure chance and careless system administrators are one thing, but we'd have to ask ourselves... wasn't the genie out of the bottle already for the connoisseur and the programmer's "inner circle"?

    How secure is secure?

    Unless companies start militarizing programmer's cubicles "a la Dilbert" and subjecting programmers to nuclear-scientist's type of monitoring, keeping code 100% secret and controlled is going to be a daunting task, if not impossible.

    Leaks like the one affecting the Vole are hence, in a sense, inevitable under the current conditions of lax security and cross-company code sharing. Instead of asking the legal teams for advice and ordering raids on the houses of every current and former programmer working for the corporation, why not get over it, and accept the fact that SERVICE and MAINTENANCE of software programs, not the real code, is the real asset?. The conspiracy theorist in me wonders if maybe Microsoft could use this opportunity as a test, to gauge reactions from the financial/investors community before deciding to publish the source code for real under some restrictive -yet still public- licence?

    -inq
    I've gone too far and need to move on!

  8. #18
    Join Date
    Dec 2002
    Posts
    4,246

    Default

    Microsoft to Hackers: Drop That Code!
    Microsoft Corp. is warning the online community to keep its hands off purloined Windows source code.

    he company on Tuesday confirmed it had sent legal warnings to some persons who it said had downloaded the stolen code from the Internet.

    Source code from Windows NT 4.0 and Windows 2000 was posted on the Internet on Thursday, and Microsoft Corp. said at the time that it had initiated internal and external investigations.

    Redmond, Wash.-based Microsoft declined to specify the contents or the distribution of its warning message. But according to a report filed on Steven Bink's and Ryan Hoffman's Amsterdam-based Bink.nu site, Microsoft warned at least one recipient that he was in violation of copyright laws.

    "The unauthorized copying and distribution of Microsoft's protected source code is a violation of both civil and criminal copyright and trade secret laws," Bink.nu quotes the notice as reading. "If you have downloaded and are making the source code available for downloading by others, you are violating Microsoft's rights, and could be subject to severe civil and criminal penalties."

    The letter then demands that persons in possession of the source code stop sharing the code, destroy copies and inform Microsoft of the origin of the copy.

    Bink said the recipient of the letter had downloaded the leaked code through a peer-to-peer network that had automatically shared his copy. Microsoft traced him through that channel, he said. Microsoft sent the letter to his Internet Service Provider, which then forwarded the e-mail message.

    The legal message continues: "Microsoft takes these issues very seriously, and will pursue legal action against individuals who take part in the proliferation of it source code. We look forward to your prompt cooperation. Should you need to contact me, I can be reached at the address above"

    Microsoft spokesman Tom Pilla confirmed that the company had sent out the cease-and-desist notices since the Windows code began appearing on Thursday, but he declined to provide any further details.

    "We are obviously taking all appropriate legal actions to protect our intellectual property," he said.

    Besides the illegal receipt of copyrighted materials, persons downloading the source code—especially developers—could face other problems,, legal experts said. Individuals examining the Windows code could face charges of trade-secret violations and infringement of software patents.

    -eweek.com
    I've gone too far and need to move on!

  9. #19
    Join Date
    May 2003
    Posts
    92

    Default

    ripped from: http://www.kuro5hin.org/story/2004/2/15/71552/7795

    We Are Morons: a quick look at the Win2k source

    By Selznak
    Mon Feb 16th, 2004 at 07:38:15 AM EST

    A quick, superficial look at the style and content of the leaked Windows 2000 source. I quote from the comments but not the code, so this should be safe for developers to read.

    Overview
    Several days ago, two files containing Microsoft source code began circulating on the Internet. One contains a majority of the NT4 source code: this is not discussed here. The other contains a fraction of the Windows 2000 source code, reportedly about 15% of the total. This includes some networking code including winsock and inet; as well as some shell code. Some other familiar items include the event log, and some of the default screensavers.
    The timestamps on the files generally say 25 July 2000. The source is contained in a Zip file of size 213,748,207 bytes, named windows_2000_source_code.zip, which has been widely circulated on P2P networks. Some dummy files of similar size, containing just strings of zeroes, have also circulated.

    There has been some speculation that while the bulk of the source is genuine, some of the comments have been tampered with to embarrass Microsoft. This is difficult to disprove, but I find it implausible. The embarrassing comments occur on thousands of lines, in realistic places. Furthermore, if someone had done that, it would have been easy to make the comments far more incriminating.

    Embarrassments
    In the struggle to meet deadlines, I think pretty much all programmers have put in comments they might later regret, including swearwords and acerbic comments about other code or requirements. Also, any conscientious coder will put in prominent comments warning others about the trickier parts of the code. Comments like "UGLY TERRIBLE HACK" tend to indicate good code rather than bad: in bad code ugly terrible hacks are considered par for the course. It would therefore be both hypocritical and meaningless to go through the comments looking for embarrassments. But also fun, so let's go.

    Curse words: there are a dozen or so "****s" and "****s", and hundreds of "craps". Some dissatisfaction with the compiler is expressed in private\shell\shell32\util.cpp:

    // the ****ing alpha cpp compiler seems to **** up the goddam type "LPITEMIDLIST", so to work
    // around the ****ing peice of **** compiler we pass the last param as an void *instead of a LPITEMIDLIST

    Some insight into Microsoft's famous daily build process is given in private\windows\media\avi\verinfo.16\verinfo.h:
    * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!
    * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!
    * !!!!!!!IF YOU CHANGE TABS TO SPACES, YOU WILL BE KILLED!!!!!!!
    * !!!!!!!!!!!!!!DOING SO ****S THE BUILD PROCESS!!!!!!!!!!!!!!!!
    * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!
    * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!
    There are also various references to idiots and morons, some external, some within Microsoft. The file private\ntos\rtl\heap.c, which dates from 1989, tells us
    // The specific idiot in this case is Office95, which likes
    // to free a random pointer when you start Word95 from a desktop
    // shortcut.
    The file private\ntos\w32\ntuser\kernel\swp.c from 11-Jul-1991 points at
    * for idiots like MS-Access 2.0 who SetWindowPos( SWP_BOZO
    * and blow away themselves on the shell, then lets
    * just ignore their plea to be removed from the tray

    Morons also abound, as in this selection
    private\genx\shell\inc\prsht.w:
    // we are such morons. Wiz97 underwent a redesign between IE4 and IE5
    private\shell\ext\ftp\ftpdrop.cpp:
    We have to do this only because Exchange is a moron.

    private\shell\shdoc401\unicpp\desktop.cpp:
    // We are morons. We changed the IDeskTray interface between IE4

    private\shell\browseui\itbar.cpp:
    // should be fixed in the apps themselves. Morons!


    Microsoft programmers also take their duty to warn others seriously. There are over 4,000 references to "hacks", mostly warnings. These include
    private\inet\mshtml\src\core\cdbase\baseprop.cxx:
    // HACK! HACK! HACK! (MohanB) In order to fix #64710 at this very late
    private\inet\mshtml\src\core\cdutil\genutil.cxx:
    // HACK HACK HACK. REMOVE THIS ONCE MARLETT IS AROUND

    private\inet\mshtml\src\other\moniker\resprot.cxx:
    // <HACK>
    goto EndHack;
    // </HACK>

    private\inet\mshtml\src\site\layout\flowlyt.cxx:
    // God, I hate this hack ...

    private\inet\wininet\urlcache\cachecfg.cxx:
    // Dumb hack for back compat. *sigh*

    private\inet\wininet\urlcache\filemgr.cxx:
    // ACHTUNG!!! this is a special hack for IBM antivirus software

    private\ispu\pkitrust\trustui\acuictl.cpp:
    // HACK ALERT, believe it or not there is no way to get the height of the current
    // HACK ON TOP OF HACK ALERT,

    private\ntos\udfs\devctrl.c:
    // Add the hack-o-ramma to fix formats.

    private\shell\shdoc401\unicpp\sendto.cpp:
    // Mondo hackitude-o-rama.

    private\ntos\w32\ntcon\server\link.c:
    // HUGE, HUGE hack-o-rama to get NTSD started on this process!

    private\ntos\w32\ntuser\client\dlgmgr.c:
    // HACK OF DEATH:

    private\shell\lib\util.cpp:
    // TERRIBLE HORRIBLE NO GOOD VERY BAD HACK

    private\ntos\w32\ntuser\client\nt6\user.h:
    * The magnitude of this hack compares favorably with that of the national debt.

    While surprisingly informal, there are limits to how far the programmers go. There are no derogatory references to Microsoft or Windows themselves. Bill Gates is never mentioned. There are no racist or homophobic slurs. I saw only one drug reference.
    private\shell\ext\tweakui\genthunk.c:
    * CallProc32W is insane. It's a variadic function that uses
    * the pascal calling convention. (It probably makes more sense
    * when you're stoned.)
    Quality
    Despite the above, the quality of the code is generally excellent. Modules are small, and procedures generally fit on a single screen. The commenting is very detailed about intentions, but doesn't fall into "add one to i" redundancy.
    There is some variety in the commenting style. Sometimes blocks use a // at every line, sometimes the /* */ style. In some modules functions have a history, some do not. Some functions describe their variables in a comment block, some don't. Microsoft appears not to have fallen into the trap of enforcing over-rigid standards or universal use of over-complicated automatic tools. They seem to trust their developers to comment well, and they do.


    However, not everything is so rosy. Some of the modules are clearly suffering from the hacks upon hacks mentioned earlier. As someone who struggled immensely trying to get the MSInet control working not long after this code was released, it's a relief to see that the inet code is as bad as I thought.

    From the comments, it also appears that most of the uglier hacks are due to compatibility issues: either backward-compatibility, hardware compatibility or issues caused by particular software. Microsoft's vast compatibility strengths have clearly come at a cost, both in developer-sweat and the elegance (and hence stability and maintainability) of the code.

    Open Source
    It's been widely rumored for a while that Microsoft relies on stolen open source code. The rumor has faced widespread skepticism too. Microsoft has hundreds of millions of lines of code, most of it highly specialized. Hardly any of that could benefit from stealing: it hardly seems worth the legal risk. It's true that early versions of the TCP-IP stack were (legally) taken from BSD: but that was a long time ago, when Microsoft was much smaller.

    Searching the code for "linux" and "GPL" finds no references. "BSD" finds only a couple of references to BSD-convention strings. "GNU" finds a lot of references to a GNUmakefile in private\genx\shell, which in turn mentions a "mode for Emacs." This is apparently legitimate: simply using a makefile does not apply the makefile's copyright to the resulting code.

    Therefore, a superficial look at the code finds no evidence that Microsoft has violated the GPL or stolen other open source code. Closer examination might turn something up.

    Favoritism
    It's noticeable that a lot of the "hacks" refer to individual applications. In some cases they are non-Microsoft, such as this case: a Borland compiler came to depend on an existing bug, so their fix worked to preserve some of the bug's behaviour. But just as often these application-specific fixes are for Microsoft's own apps. There seems to be an informal hierarchy when it comes these: Microsoft apps take precedence, then major software companies like IBM and Borland.

    It's also interesting to finally see references to the notorious undocumented features, which Microsoft application developers have long been known to use.

    private\mvdm\wow32\wcntl32.c:
    // These undocumented messages are used by Excel 5.0
    private\mvdm\wow32\wgdi31.c:
    // InquireVisRgn is an undocumented Win 3.1 API. This code has been
    // suggested by ChuckWh. If this does not fix the s 2.0
    // problem, then ChuckWh would be providing us with an private entry
    // point.

    private\mvdm\wow32\wgfont.c:
    * This thunk implements the undocumented Win3.0 and Win3.1 API
    * GetCurLogFont (GDI.411). Symantec QA4.0 uses it.
    * To implement this undocumented API we will use the NT undocumented API


    In some cases, the programmers themselves appear to have been frustrated or surprised.
    private\ntos\w32\ntuser\kernel\mnpopup.c:
    // Set the GlobalPopupMenu variable so that EndMenu works for popupmenus so
    // that WinWart II people can continue to abuse undocumented functions.
    private\windows\shell\accesory\hypertrm\emu\minite l.c:
    // Guess what? Latent background color is always adopted for mosaics.
    // This is a major undocumented find...

    private\windows\shell\accesory\hypertrm\emu\minite lf.c:
    // Ah, the life of the undocumented. The documentation says
    // that this guys does not validate, colors, act as a delimiter
    // and fills with spaces. Wrong. It does validate the color.
    // As such its a delimiter. If...

    Conclusions
    The security risks from this code appear to be low. Microsoft do appear to be checking for buffer overruns in the obvious places. The amount of networking code here is small enough for Microsoft to easily check for any vulnerabilities that might be revealed: it's the big applications that pose more of a risk. This code is also nearly four years old: any obvious problems should be patched by now.
    Microsoft's fears that this code will be pirated by its competitors also seem largely unfounded. With application code this would be a risk, but it's hard to see Microsoft's operating system competitors taking advantage of it. Neither Apple nor Linux are in a much of position to steal code and get away with it, even if it was useful to them.

    In short, there is nothing really surprising in this leak. Microsoft does not steal open-source code. Their older code is flaky, their modern code excellent. Their programmers are skilled and enthusiastic. Problems are generally due to a trade-off of current quality against vast hardware, software and backward compatibility.
    386 DX40, 4mb 80ns EDO RAM, .5mb Trident VGA, 120mb 2200rpm JTS HDD, SoundBlaster ISA, Zoltrix 2400bps modem, 2x Creative CDROM (tray loading), Panasonic 3.5" FDD/5.25" FDD, Samsung 14" UVGA Monitor
    -----

    /Z

Page 2 of 2 FirstFirst 12

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •