Do the Windows shared source files compile into the same binaries as the retail version?

Question

Microsoft makes the Windows source code available to certain third party organisations such as the US and foreign governments, universities etc. This is their Shared Source Initiative

Is this a complete set of Windows source files and is it possible to build the whole OS with it? If so, are the resulting binaries the exact same as the official Microsoft binaries at the time?

Of course the reasoning for this question is to know whether there are some 'independent' organisations who could find back doors in the Windows security components.

Say the Russian FSB who is part of the shared source initiative, just receives a bunch of source files claiming to be the 'real thing'. Wouldn't they only be satisfied after being able to build the OS and compare them with retail binaries?

How they would react on any of their discoveries is another question.

And if they need the Microsoft C++ compiler to build the OS, do they get the sources for that as well?

Answer 1

There are varying levels of access, which depend on the particular NDA and whichever agreement is signed. These are my observations made from public discussions.

As far as I know there is no level that allows direct checkout of code for compilation. It's all in a prettified format, similar to how Github et al show code. Someone with access could copy files out no problem, but they can't do a bulk export or checkout.

The majority of Windows is written in C and some newer stuff in C++, with very little written in assembly. Someone could compile the code with standard MS compilers (assuming they got the versions right), but to make the necessary DLLs and EXEs they would need to know how it builds, they would need various MAKE and related files, and those files probably aren't present in the any of the agreements. At the very least they aren't present in the less-privileged agreements (erm. supposedly. NDAs make it impossible to explain in detail what is actually present as those that know can't share or acknowledge they have access. ;) ). In the event someone could build, the results could differ because there may be some post-compilation/pre-packaging processes when shipping.

Where things get interesting though is getting access to compiler symbols for certain Windows components. This allows devs to more easily follow code paths while debugging. Between the symbols and browser access to the source, someone could look for bugs/backdoors/whatever.

However, looking for problems in code like this is more complicated than some may think. There are millions and millions of lines of code in Windows, and the structure of the files may seem precarious if you aren't familiar with it.

EDIT: In theory the code is the same, otherwise it kind of defeats the purpose of sharing the code. It isn't clear how often the code is updated for things like patches though. Whether it's really the same code, well... who knows.