how to determine whether the source code is same between two kernels

how to determine whether the source code is same between two kernels

[wuzhouhui]

Hi,

Suppose I have two kernels, one is A.B.C build by people Tom. And
the other is A.B.C build by Jerry. The source code have been deleted
after kernel is build and installed. Now I want to know whether the
source code of these two kernel is the same (even if they have the same
name). All I have is binaries (e.g. vmlinux, config, *.ko, System.map).
Is it possible?

Thanks
_______________________________________________
Kernelnewbies mailing list
Kernelnewbies@kernelnewbies.org
https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies

Re: how to determine whether the source code is same between two kernels

[Greg KH]

On Wed, May 08, 2019 at 04:52:46PM +0800, wuzhouhui wrote:
> Hi,
> 
> Suppose I have two kernels, one is A.B.C build by people Tom. And
> the other is A.B.C build by Jerry. The source code have been deleted
> after kernel is build and installed. Now I want to know whether the
> source code of these two kernel is the same (even if they have the same
> name). All I have is binaries (e.g. vmlinux, config, *.ko, System.map).
> Is it possible?

Maybe, but not very easily.

Good luck!

_______________________________________________
Kernelnewbies mailing list
Kernelnewbies@kernelnewbies.org
https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies

Re: Re: how to determine whether the source code is same between two kernels

[wuzhouhui]

> -----Original Messages-----
> From: "Greg KH" <greg@kroah.com>
> Sent Time: 2019-05-08 17:25:54 (Wednesday)
> To: wuzhouhui <wuzhouhui14@mails.ucas.ac.cn>
> Cc: kernelnewbies@kernelnewbies.org
> Subject: Re: how to determine whether the source code is same between two kernels
> 
> On Wed, May 08, 2019 at 04:52:46PM +0800, wuzhouhui wrote:
> > Hi,
> > 
> > Suppose I have two kernels, one is A.B.C build by people Tom. And
> > the other is A.B.C build by Jerry. The source code have been deleted
> > after kernel is build and installed. Now I want to know whether the
> > source code of these two kernel is the same (even if they have the same
> > name). All I have is binaries (e.g. vmlinux, config, *.ko, System.map).
                                        ^^^^^^^
                                        vmlinuz, sorry for the typo.
> > Is it possible?

Using word "same" is too strict. At least, I want to know the source code of
two kernels is "equivalent". I already know that the source code is equivalent
if the srcversion of two modules is same (correct me if it is wrong). Does
vmlinuz has srcversion too?

> 
> Maybe, but not very easily.
> 
> Good luck!
_______________________________________________
Kernelnewbies mailing list
Kernelnewbies@kernelnewbies.org
https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies

Re: Re: how to determine whether the source code is same between two kernels

[greg kh]

On Wed, May 08, 2019 at 05:43:02PM +0800, wuzhouhui wrote:
> > -----Original Messages-----
> > From: "Greg KH" <greg@kroah.com>
> > Sent Time: 2019-05-08 17:25:54 (Wednesday)
> > To: wuzhouhui <wuzhouhui14@mails.ucas.ac.cn>
> > Cc: kernelnewbies@kernelnewbies.org
> > Subject: Re: how to determine whether the source code is same between two kernels
> > 
> > On Wed, May 08, 2019 at 04:52:46PM +0800, wuzhouhui wrote:
> > > Hi,
> > > 
> > > Suppose I have two kernels, one is A.B.C build by people Tom. And
> > > the other is A.B.C build by Jerry. The source code have been deleted
> > > after kernel is build and installed. Now I want to know whether the
> > > source code of these two kernel is the same (even if they have the same
> > > name). All I have is binaries (e.g. vmlinux, config, *.ko, System.map).
>                                         ^^^^^^^
>                                         vmlinuz, sorry for the typo.
> > > Is it possible?
> 
> Using word "same" is too strict. At least, I want to know the source code of
> two kernels is "equivalent". I already know that the source code is equivalent
> if the srcversion of two modules is same (correct me if it is wrong). Does
> vmlinuz has srcversion too?

What do you mean by "srcversion"?

The only way you "know" for sure that any two trees is either looking at
the source code, or by generating a binary that is identical from one
tree that you can compare to the other one.

thanks,

greg k-h

_______________________________________________
Kernelnewbies mailing list
Kernelnewbies@kernelnewbies.org
https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies

Re: how to determine whether the source code is same between two kernels

[Valdis Klētnieks]

[-- Attachment #1.1: Type: text/plain, Size: 999 bytes --]

On Wed, 08 May 2019 16:52:46 +0800, wuzhouhui said:
> Suppose I have two kernels, one is A.B.C build by people Tom. And
> the other is A.B.C build by Jerry. The source code have been deleted
> after kernel is build and installed. Now I want to know whether the
> source code of these two kernel is the same (even if they have the same
> name). All I have is binaries (e.g. vmlinux, config, *.ko, System.map).
> Is it possible?

The problem is that I can build my kernel with gcc5 (or even a gcc4.mumble),
and the binaries are going to be different than what the same exact source tree
produces with gcc 9.1.1.

Of course, the *correct* solution is to hold both Tom and Jerry to the
requirements of the GPL, and force them to give you the kernel source trees
that went into those kernels that they distributed, and then compare the trees.

What? You say neither one can actually do so? Then why are you accepting and
using kernels from them, rather than shunning them as the GPL violators they
are?


[-- Attachment #1.2: Type: application/pgp-signature, Size: 832 bytes --]

[-- Attachment #2: Type: text/plain, Size: 170 bytes --]

_______________________________________________
Kernelnewbies mailing list
Kernelnewbies@kernelnewbies.org
https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies

Re: how to determine whether the source code is same between two kernels

[Aruna Hewapathirane]

[-- Attachment #1.1: Type: text/plain, Size: 2291 bytes --]

On Wed, May 8, 2019 at 4:53 AM wuzhouhui <wuzhouhui14@mails.ucas.ac.cn>
wrote:
> Hi,

> Suppose I have two kernels, one is A.B.C build by people Tom. And
> the other is A.B.C build by Jerry. The source code have been deleted
> after kernel is build and installed. Now I want to know whether the
> source code of these two kernel is the same (even if they have the same
> name). All I have is binaries (e.g. vmlinux, config, *.ko, System.map).

> Is it possible?
Within sane defaults yes it is possible. Think of it this way, if the
source code is
the 'same'  we can safely assume that the kernel built by Tom will function
and behave
'exactly' the same as the kernel built by Jerry. Behavior can be traced and
analyzed.

diff, dmesg, lsmod, tree and objdump are your friends :-)

Run diff vmlinuz-Tom vmlinuz-Jerry and see if they differ. Then just  to
make
sure follow below steps:

1 - Boot kernel-Tom and  redirect dmesg output to file(s)
2 - dmesg -k > kernel-Tom.txt
3 - dmesg -u > userspace-Tom.txt
4 - lsmod > modules-Tom.txt
5 - tree / > fs-Tom.txt

Now we have what the kernel prints while booting in kernel-Tom.txt and what
userspace prints
in userspace-Tom.txt and loaded modules in modules-Tom.txt and the folder
structure under root
in fs-Tom.txt.

Now repeat the same process with kernel-Jerry

1 - Boot kernel-Jerry
2 - dmesg -k > kernel-Jerry.txt
3 - dmesg -u > userspace-Jerry.txt
4 - lsmod > modules-Jerry.txt
5 - tree / > fs-Jerry.txt

Then run diff on those files..

1 - diff kernel-Tom.txt kernel-Jerry.txt
2 - diff userspace-Tom userspace-Jerry
3 - diff modules-Tom modules-Jerry
4 - diff fs-Tom fs-Jerry

if you want to dig deeper use objdump -d vmlinuz-Tom then objdump -d
vmlinuz-Jerry
which is really overkill unless there is output from diff that says the
file(s) differ.

If you really really need the source there are decompilers :
IDA <https://www.hex-rays.com/products/ida/>
ghidra <https://ghidra-sre.org/>
snowman <https://derevenets.com/>
hopper <https://www.hopperapp.com/>

Keep in mind what Valdis pointed out that though the source may be exactly
the same,
depending on what compiler flags were used the binaries may differ.

You had asked..
> Is it possible?
Simple answer: In the Linux world the impossible becomes very possible :)

Good luck - Aruna

[-- Attachment #1.2: Type: text/html, Size: 4487 bytes --]

[-- Attachment #2: Type: text/plain, Size: 170 bytes --]

_______________________________________________
Kernelnewbies mailing list
Kernelnewbies@kernelnewbies.org
https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies

Re: how to determine whether the source code is same between two kernels

[Valdis Klētnieks]

[-- Attachment #1.1: Type: text/plain, Size: 738 bytes --]

On Fri, 10 May 2019 22:11:31 -0400, Aruna Hewapathirane said:

> > Suppose I have two kernels, one is A.B.C build by people Tom. And
> > the other is A.B.C build by Jerry. The source code have been deleted

> Run diff vmlinuz-Tom vmlinuz-Jerry and see if they differ. Then just  to

Don't even bother.  If Tom and Jerry both did builds, the binaries *will* differ, because...

% dmesg | grep 'Linux vers'
[    0.000000] Linux version 5.1.0-rc5-next-20190416-dirty (source@turing-police) (gcc version 9.0.1 20190328 (Red Hat 9.0.1-0.12) (GCC)) #664 SMP PREEMPT Wed Apr 17 12:31:51 EDT 2019

There's a datestamp, a build number, and a compiler version in there.

Also, since vmlinuz is a binary file, /bin/cmp is a better choice than diff.

[-- Attachment #1.2: Type: application/pgp-signature, Size: 832 bytes --]

[-- Attachment #2: Type: text/plain, Size: 170 bytes --]

_______________________________________________
Kernelnewbies mailing list
Kernelnewbies@kernelnewbies.org
https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies

Re: how to determine whether the source code is same between two kernels

[Aruna Hewapathirane]

[-- Attachment #1.1: Type: text/plain, Size: 1070 bytes --]

On Fri, May 10, 2019 at 11:58 PM Valdis Klētnieks <valdis.kletnieks@vt.edu>
wrote:

> On Fri, 10 May 2019 22:11:31 -0400, Aruna Hewapathirane said:
>
> > > Suppose I have two kernels, one is A.B.C build by people Tom. And
> > > the other is A.B.C build by Jerry. The source code have been deleted
>
> > Run diff vmlinuz-Tom vmlinuz-Jerry and see if they differ. Then just  to
>
> Don't even bother.  If Tom and Jerry both did builds, the binaries *will*
> differ, because...
>
> % dmesg | grep 'Linux vers'
> [    0.000000] Linux version 5.1.0-rc5-next-20190416-dirty
> (source@turing-police) (gcc version 9.0.1 20190328 (Red Hat 9.0.1-0.12)
> (GCC)) #664 SMP PREEMPT Wed Apr 17 12:31:51 EDT 2019
>

Seriously ? Since when are you working for turing-police ? But yes
agreed...  at least it gives someone a
reasonably sane path to follow... nothing lost in trying right :)


> There's a datestamp, a build number, and a compiler version in there.
>
> Also, since vmlinuz is a binary file, /bin/cmp is a better choice than
> diff.
>
Agreed.

[-- Attachment #1.2: Type: text/html, Size: 1660 bytes --]

[-- Attachment #2: Type: text/plain, Size: 170 bytes --]

_______________________________________________
Kernelnewbies mailing list
Kernelnewbies@kernelnewbies.org
https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies

Re: how to determine whether the source code is same between two kernels

[Valdis Klētnieks]

[-- Attachment #1.1: Type: text/plain, Size: 279 bytes --]

On Sat, 11 May 2019 09:20:22 -0400, Aruna Hewapathirane said:

> Seriously ? Since when are you working for turing-police ?

I'm semi-retired. :)

And there's two other systems in the room called wintermute and neuromancer.
Hopefully you can figure it out from there. :)

[-- Attachment #1.2: Type: application/pgp-signature, Size: 832 bytes --]

[-- Attachment #2: Type: text/plain, Size: 170 bytes --]

_______________________________________________
Kernelnewbies mailing list
Kernelnewbies@kernelnewbies.org
https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies

Re: how to determine whether the source code is same between two kernels

[chiachen]

[-- Attachment #1.1: Type: text/plain, Size: 649 bytes --]

You could use "Beyond Compare" to compare these two bin or source files.

Valdis Klētnieks <valdis.kletnieks@vt.edu> 于2019年5月11日周六 下午9:53写道：

> On Sat, 11 May 2019 09:20:22 -0400, Aruna Hewapathirane said:
>
> > Seriously ? Since when are you working for turing-police ?
>
> I'm semi-retired. :)
>
> And there's two other systems in the room called wintermute and
> neuromancer.
> Hopefully you can figure it out from there. :)
> _______________________________________________
> Kernelnewbies mailing list
> Kernelnewbies@kernelnewbies.org
> https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
>

[-- Attachment #1.2: Type: text/html, Size: 1174 bytes --]

[-- Attachment #2: Type: text/plain, Size: 170 bytes --]

_______________________________________________
Kernelnewbies mailing list
Kernelnewbies@kernelnewbies.org
https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies