Microsoft makes the Windows source code available to certain third party organisations such as the US and foreign governments, universities etc. This is their Shared Source Initiative

Is this a complete set of Windows source files and is it possible to build the whole OS with it? If so, are the resulting binaries the exact same as the official Microsoft binaries at the time?

Of course the reasoning for this question is to know whether there are some 'independent' organisations who could find back doors in the Windows security components.

Say the Russian FSB who is part of the shared source initiative, just receives a bunch of source files claiming to be the 'real thing'. Wouldn't they only be satisfied after being able to build the OS and compare them with retail binaries?

How they would react on any of their discoveries is another question.

And if they need the Microsoft C++ compiler to build the OS, do they get the sources for that as well?

1 Answer 1


There are varying levels of access, which depend on the particular NDA and whichever agreement is signed. These are my observations made from public discussions.

As far as I know there is no level that allows direct checkout of code for compilation. It's all in a prettified format, similar to how Github et al show code. Someone with access could copy files out no problem, but they can't do a bulk export or checkout.

The majority of Windows is written in C and some newer stuff in C++, with very little written in assembly. Someone could compile the code with standard MS compilers (assuming they got the versions right), but to make the necessary DLLs and EXEs they would need to know how it builds, they would need various MAKE and related files, and those files probably aren't present in the any of the agreements. At the very least they aren't present in the less-privileged agreements (erm. supposedly. NDAs make it impossible to explain in detail what is actually present as those that know can't share or acknowledge they have access. ;) ). In the event someone could build, the results could differ because there may be some post-compilation/pre-packaging processes when shipping.

Where things get interesting though is getting access to compiler symbols for certain Windows components. This allows devs to more easily follow code paths while debugging. Between the symbols and browser access to the source, someone could look for bugs/backdoors/whatever.

However, looking for problems in code like this is more complicated than some may think. There are millions and millions of lines of code in Windows, and the structure of the files may seem precarious if you aren't familiar with it.

EDIT: In theory the code is the same, otherwise it kind of defeats the purpose of sharing the code. It isn't clear how often the code is updated for things like patches though. Whether it's really the same code, well... who knows.

  • Microsoft has actually moved away from C based on some rumors to a more traditional C++ code. Likewise the amount of assembly is also very limited which is pretty much only use to launch int the boot loader itself.
    – Ramhound
    Commented Sep 10, 2013 at 14:30
  • A lot of the newer runtime components are C++ IIRC, but the core/kernel components are still C. The ratio I was told was around the post-Vista/pre-7 days. You're probably right about assembly though. My numbers are probably off. I'm going to edit it to clarify.
    – Steve
    Commented Sep 10, 2013 at 18:15
  • If the rumors are correct Microsoft has replaced a great deal of those legacy components. They are able to do this because the kernel is actually getting smaller not larger.
    – Ramhound
    Commented Sep 10, 2013 at 18:39
  • One big thing that will not be in ANY code sharing database will be the private keys to sign the files. Most of the "important" DLL's in windows (ntdll.dll, clfs.dll, ect...) are all digitally signed and there is no way to re-create that without the keys from Microsoft. Commented Sep 11, 2013 at 7:27
  • Sure, and that compilers won't necessarily output the same file byte-for-byte between builds. The real question is whether its possible to compare code paths to any reasonable certainty.
    – Steve
    Commented Sep 11, 2013 at 17:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .