Axel Rietschin, an engineer at Microsoft involved in Windows kernel development, the feasibility of developing the ReactOS operating system without borrowing code from Windows. According to him, the developers of ReactOS used code from the Windows Research kernel, the source code of which was licensed for universities. Leaks of this code were published in various places, including GitHub.
Rietschin is confident that it is physically impossible to write the ReactOS kernel from scratch in its current form using only the publicly available documentation. In particular, the names of internal structures and functions in the ReactOS kernel match those in the Windows Research kernel, while these names are not exported during compilation and are not found anywhere except in the original code. The same goes for macro names and parameters, the names of which cannot be accurately reproduced without looking into the original Windows code.
Let us remind you that in 2006, ReactOS included about 100 lines of assembly code obtained as a result of decompiling Windows. After that, development was paused for about a month for potential intersection audits. Since then, ReactOS developers have been particularly careful in reviewing the source code proposed for inclusion in the project.
In conducting reverse engineering to comply with U.S. copyright law, the ReactOS project employs a dual scheme, in which one researcher analyzes the work and documents it, while another developer creates a new implementation for ReactOS based on this documentation. It is possible that leaked source code from Windows was used during the analysis phase, and matching function and structure names were reflected in the documentation being generated, but with the development scheme used in ReactOS, the implementation will be entirely different and created from scratch.
Furthermore, already publications on overlooked builds of the NT and W2K kernels with uncleaned debug information, including data about the names of internal variables. Many names of structures and functions are also provided in the header files included in the SDK/DDK, and the structure of system calls can be determined through the analysis of components such as the COM runtime. Without cleaning symbol tables, hotfix updates are often published with names. Additionally, some Windows programs and drivers utilize undocumented private calls, and many hidden features of Windows emerge during the adaptation of launches in virtualization systems and emulators.
ReactOS developers could use these components during the reverse engineering process.
Source: opennet.ru
