how to determine whether the source code is same between two kernels
Hi, Suppose I have two kernels, one is A.B.C build by people Tom. And the other is A.B.C build by Jerry. The source code have been deleted after kernel is build and installed. Now I want to know whether the source code of these two kernel is the same (even if they have the same name). All I have is binaries (e.g. vmlinux, config, *.ko, System.map). Is it possible? Thanks
On Wed, May 08, 2019 at 04:52:46PM +0800, wuzhouhui wrote:
Hi,
Suppose I have two kernels, one is A.B.C build by people Tom. And the other is A.B.C build by Jerry. The source code have been deleted after kernel is build and installed. Now I want to know whether the source code of these two kernel is the same (even if they have the same name). All I have is binaries (e.g. vmlinux, config, *.ko, System.map). Is it possible?
Maybe, but not very easily. Good luck!
-----Original Messages----- From: "Greg KH" <greg@kroah.com> Sent Time: 2019-05-08 17:25:54 (Wednesday) To: wuzhouhui <wuzhouhui14@mails.ucas.ac.cn> Cc: kernelnewbies@kernelnewbies.org Subject: Re: how to determine whether the source code is same between two kernels
On Wed, May 08, 2019 at 04:52:46PM +0800, wuzhouhui wrote:
Hi,
Suppose I have two kernels, one is A.B.C build by people Tom. And the other is A.B.C build by Jerry. The source code have been deleted after kernel is build and installed. Now I want to know whether the source code of these two kernel is the same (even if they have the same name). All I have is binaries (e.g. vmlinux, config, *.ko, System.map). ^^^^^^^ vmlinuz, sorry for the typo. Is it possible?
Using word "same" is too strict. At least, I want to know the source code of two kernels is "equivalent". I already know that the source code is equivalent if the srcversion of two modules is same (correct me if it is wrong). Does vmlinuz has srcversion too?
Maybe, but not very easily.
Good luck!
On Wed, May 08, 2019 at 05:43:02PM +0800, wuzhouhui wrote:
-----Original Messages----- From: "Greg KH" <greg@kroah.com> Sent Time: 2019-05-08 17:25:54 (Wednesday) To: wuzhouhui <wuzhouhui14@mails.ucas.ac.cn> Cc: kernelnewbies@kernelnewbies.org Subject: Re: how to determine whether the source code is same between two kernels
On Wed, May 08, 2019 at 04:52:46PM +0800, wuzhouhui wrote:
Hi,
Suppose I have two kernels, one is A.B.C build by people Tom. And the other is A.B.C build by Jerry. The source code have been deleted after kernel is build and installed. Now I want to know whether the source code of these two kernel is the same (even if they have the same name). All I have is binaries (e.g. vmlinux, config, *.ko, System.map). ^^^^^^^ vmlinuz, sorry for the typo. Is it possible?
Using word "same" is too strict. At least, I want to know the source code of two kernels is "equivalent". I already know that the source code is equivalent if the srcversion of two modules is same (correct me if it is wrong). Does vmlinuz has srcversion too?
What do you mean by "srcversion"? The only way you "know" for sure that any two trees is either looking at the source code, or by generating a binary that is identical from one tree that you can compare to the other one. thanks, greg k-h
On Wed, 08 May 2019 16:52:46 +0800, wuzhouhui said:
Suppose I have two kernels, one is A.B.C build by people Tom. And the other is A.B.C build by Jerry. The source code have been deleted after kernel is build and installed. Now I want to know whether the source code of these two kernel is the same (even if they have the same name). All I have is binaries (e.g. vmlinux, config, *.ko, System.map). Is it possible?
The problem is that I can build my kernel with gcc5 (or even a gcc4.mumble), and the binaries are going to be different than what the same exact source tree produces with gcc 9.1.1. Of course, the *correct* solution is to hold both Tom and Jerry to the requirements of the GPL, and force them to give you the kernel source trees that went into those kernels that they distributed, and then compare the trees. What? You say neither one can actually do so? Then why are you accepting and using kernels from them, rather than shunning them as the GPL violators they are?
On Wed, May 8, 2019 at 4:53 AM wuzhouhui <wuzhouhui14@mails.ucas.ac.cn> wrote:
Hi,
Suppose I have two kernels, one is A.B.C build by people Tom. And the other is A.B.C build by Jerry. The source code have been deleted after kernel is build and installed. Now I want to know whether the source code of these two kernel is the same (even if they have the same name). All I have is binaries (e.g. vmlinux, config, *.ko, System.map).
Is it possible? Within sane defaults yes it is possible. Think of it this way, if the source code is the 'same' we can safely assume that the kernel built by Tom will function and behave 'exactly' the same as the kernel built by Jerry. Behavior can be traced and analyzed.
diff, dmesg, lsmod, tree and objdump are your friends :-) Run diff vmlinuz-Tom vmlinuz-Jerry and see if they differ. Then just to make sure follow below steps: 1 - Boot kernel-Tom and redirect dmesg output to file(s) 2 - dmesg -k > kernel-Tom.txt 3 - dmesg -u > userspace-Tom.txt 4 - lsmod > modules-Tom.txt 5 - tree / > fs-Tom.txt Now we have what the kernel prints while booting in kernel-Tom.txt and what userspace prints in userspace-Tom.txt and loaded modules in modules-Tom.txt and the folder structure under root in fs-Tom.txt. Now repeat the same process with kernel-Jerry 1 - Boot kernel-Jerry 2 - dmesg -k > kernel-Jerry.txt 3 - dmesg -u > userspace-Jerry.txt 4 - lsmod > modules-Jerry.txt 5 - tree / > fs-Jerry.txt Then run diff on those files.. 1 - diff kernel-Tom.txt kernel-Jerry.txt 2 - diff userspace-Tom userspace-Jerry 3 - diff modules-Tom modules-Jerry 4 - diff fs-Tom fs-Jerry if you want to dig deeper use objdump -d vmlinuz-Tom then objdump -d vmlinuz-Jerry which is really overkill unless there is output from diff that says the file(s) differ. If you really really need the source there are decompilers : IDA <https://www.hex-rays.com/products/ida/> ghidra <https://ghidra-sre.org/> snowman <https://derevenets.com/> hopper <https://www.hopperapp.com/> Keep in mind what Valdis pointed out that though the source may be exactly the same, depending on what compiler flags were used the binaries may differ. You had asked..
Is it possible? Simple answer: In the Linux world the impossible becomes very possible :)
Good luck - Aruna
On Fri, 10 May 2019 22:11:31 -0400, Aruna Hewapathirane said:
Suppose I have two kernels, one is A.B.C build by people Tom. And the other is A.B.C build by Jerry. The source code have been deleted
Run diff vmlinuz-Tom vmlinuz-Jerry and see if they differ. Then just to
Don't even bother. If Tom and Jerry both did builds, the binaries *will* differ, because... % dmesg | grep 'Linux vers' [ 0.000000] Linux version 5.1.0-rc5-next-20190416-dirty (source@turing-police) (gcc version 9.0.1 20190328 (Red Hat 9.0.1-0.12) (GCC)) #664 SMP PREEMPT Wed Apr 17 12:31:51 EDT 2019 There's a datestamp, a build number, and a compiler version in there. Also, since vmlinuz is a binary file, /bin/cmp is a better choice than diff.
On Fri, May 10, 2019 at 11:58 PM Valdis Klētnieks <valdis.kletnieks@vt.edu> wrote:
On Fri, 10 May 2019 22:11:31 -0400, Aruna Hewapathirane said:
Suppose I have two kernels, one is A.B.C build by people Tom. And the other is A.B.C build by Jerry. The source code have been deleted
Run diff vmlinuz-Tom vmlinuz-Jerry and see if they differ. Then just to
Don't even bother. If Tom and Jerry both did builds, the binaries *will* differ, because...
% dmesg | grep 'Linux vers' [ 0.000000] Linux version 5.1.0-rc5-next-20190416-dirty (source@turing-police) (gcc version 9.0.1 20190328 (Red Hat 9.0.1-0.12) (GCC)) #664 SMP PREEMPT Wed Apr 17 12:31:51 EDT 2019
Seriously ? Since when are you working for turing-police ? But yes agreed... at least it gives someone a reasonably sane path to follow... nothing lost in trying right :)
There's a datestamp, a build number, and a compiler version in there.
Also, since vmlinuz is a binary file, /bin/cmp is a better choice than diff.
Agreed.
You could use "Beyond Compare" to compare these two bin or source files. Valdis Klētnieks <valdis.kletnieks@vt.edu> 于2019年5月11日周六 下午9:53写道：
On Sat, 11 May 2019 09:20:22 -0400, Aruna Hewapathirane said:
Seriously ? Since when are you working for turing-police ?
I'm semi-retired. :)
And there's two other systems in the room called wintermute and neuromancer. Hopefully you can figure it out from there. :) _______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
participants (6)
-
Aruna Hewapathirane -
chiachen -
Greg KH -
greg kh
-
Valdis Klētnieks -
wuzhouhui