Bonum Certa Men Certa

[Resurrected] 'We Are Morons': A Quick Look at the Win2k Source

The last copy of this article is in the Wayback Machine (the original was removed not long ago), so it's outside of search engines' reach. We're fixing that today.




Overview


Several days ago, two files containing Microsoft source code began circulating on the Internet. One contains a majority of the NT4 source code: this is not discussed here. The other contains a fraction of the Windows 2000 source code, reportedly about 15% of the total. This includes some networking code including winsock and inet; as well as some shell code. Some other familiar items include the event log, and some of the default screensavers.

The timestamps on the files generally say 25 July 2000. The source is contained in a Zip file of size 213,748,207 bytes, named windows_2000_source_code.zip, which has been widely circulated on P2P networks. Some dummy files of similar size, containing just strings of zeroes, have also circulated.



There has been some speculation that while the bulk of the source is genuine, some of the comments have been tampered with to embarrass Microsoft. This is difficult to disprove, but I find it implausible. The embarrassing comments occur on thousands of lines, in realistic places. Furthermore, if someone had done that, it would have been easy to make the comments far more incriminating.



Embarrassments
In the struggle to meet deadlines, I think pretty much all programmers have put in comments they might later regret, including swearwords and acerbic comments about other code or requirements. Also, any conscientious coder will put in prominent comments warning others about the trickier parts of the code. Comments like "UGLY TERRIBLE HACK" tend to indicate good code rather than bad: in bad code ugly terrible hacks are considered par for the course. It would therefore be both hypocritical and meaningless to go through the comments looking for embarrassments. But also fun, so let's go.



Curse words: there are a dozen or so "fucks" and "shits", and hundreds of "craps". Some dissatisfaction with the compiler is expressed in private\shell\shell32\util.cpp:

// the fucking alpha cpp compiler seems to fuck up the goddam type "LPITEMIDLIST", so to work
// around the fucking peice of shit compiler we pass the last param as an void *instead of a LPITEMIDLIST


Some insight into Microsoft's famous daily build process is given in private\windows\media\avi\verinfo.16\verinfo.h:

* !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
* !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
* !!!!!!!IF YOU CHANGE TABS TO SPACES, YOU WILL BE KILLED!!!!!!!
* !!!!!!!!!!!!!!DOING SO FUCKS THE BUILD PROCESS!!!!!!!!!!!!!!!!
* !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
* !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!


There are also various references to idiots and morons, some external, some within Microsoft. The file private\ntos\rtl\heap.c, which dates from 1989, tells us

// The specific idiot in this case is Office95, which likes
// to free a random pointer when you start Word95 from a desktop
// shortcut.


The file private\ntos\w32\ntuser\kernel\swp.c from 11-Jul-1991 points at

* for idiots like MS-Access 2.0 who SetWindowPos( SWP_BOZO
* and blow away themselves on the shell, then lets
* just ignore their plea to be removed from the tray


Morons also abound, as in this selection

private\genx\shell\inc\prsht.w:
// we are such morons. Wiz97 underwent a redesign between IE4 and IE5



private\shell\ext\ftp\ftpdrop.cpp:
We have to do this only because Exchange is a moron.



private\shell\shdoc401\unicpp\desktop.cpp:
// We are morons. We changed the IDeskTray interface between IE4



private\shell\browseui\itbar.cpp:
// should be fixed in the apps themselves. Morons!



Microsoft programmers also take their duty to warn others seriously. There are over 4,000 references to "hacks", mostly warnings. These include



private\inet\mshtml\src\core\cdbase\baseprop.cxx:
// HACK! HACK! HACK! (MohanB) In order to fix #64710 at this very late



private\inet\mshtml\src\core\cdutil\genutil.cxx:
// HACK HACK HACK. REMOVE THIS ONCE MARLETT IS AROUND



private\inet\mshtml\src\other\moniker\resprot.cxx:
// <HACK>
goto EndHack;
// </HACK>



private\inet\mshtml\src\site\layout\flowlyt.cxx:
// God, I hate this hack ...



private\inet\wininet\urlcache\cachecfg.cxx:
// Dumb hack for back compat. *sigh*

private\inet\wininet\urlcache\filemgr.cxx:
// ACHTUNG!!! this is a special hack for IBM antivirus software



private\ispu\pkitrust\trustui\acuictl.cpp:
// HACK ALERT, believe it or not there is no way to get the height of the current
// HACK ON TOP OF HACK ALERT,



private\ntos\udfs\devctrl.c:
// Add the hack-o-ramma to fix formats.

private\shell\shdoc401\unicpp\sendto.cpp:
// Mondo hackitude-o-rama.

private\ntos\w32\ntcon\server\link.c:
// HUGE, HUGE hack-o-rama to get NTSD started on this process!

private\ntos\w32\ntuser\client\dlgmgr.c:
// HACK OF DEATH:



private\shell\lib\util.cpp:
// TERRIBLE HORRIBLE NO GOOD VERY BAD HACK



private\ntos\w32\ntuser\client\nt6\user.h:
* The magnitude of this hack compares favorably with that of the national debt.



While surprisingly informal, there are limits to how far the programmers go. There are no derogatory references to Microsoft or Windows themselves. Bill Gates is never mentioned. There are no racist or homophobic slurs. I saw only one drug reference.

private\shell\ext\tweakui\genthunk.c:
* CallProc32W is insane. It's a variadic function that uses
* the pascal calling convention. (It probably makes more sense
* when you're stoned.)


Quality
Despite the above, the quality of the code is generally excellent. Modules are small, and procedures generally fit on a single screen. The commenting is very detailed about intentions, but doesn't fall into "add one to i" redundancy.



There is some variety in the commenting style. Sometimes blocks use a // at every line, sometimes the /* */ style. In some modules functions have a history, some do not. Some functions describe their variables in a comment block, some don't. Microsoft appears not to have fallen into the trap of enforcing over-rigid standards or universal use of over-complicated automatic tools. They seem to trust their developers to comment well, and they do.



However, not everything is so rosy. Some of the modules are clearly suffering from the hacks upon hacks mentioned earlier. As someone who struggled immensely trying to get the MSInet control working not long after this code was released, it's a relief to see that the inet code is as bad as I thought.



From the comments, it also appears that most of the uglier hacks are due to compatibility issues: either backward-compatibility, hardware compatibility or issues caused by particular software. Microsoft's vast compatibility strengths have clearly come at a cost, both in developer-sweat and the elegance (and hence stability and maintainability) of the code.



Open Source
It's been widely rumored for a while that Microsoft relies on stolen open source code. The rumor has faced widespread skepticism too. Microsoft has hundreds of millions of lines of code, most of it highly specialized. Hardly any of that could benefit from stealing: it hardly seems worth the legal risk. It's true that early versions of the TCP-IP stack were (legally) taken from BSD: but that was a long time ago, when Microsoft was much smaller.



Searching the code for "linux" and "GPL" finds no references. "BSD" finds only a couple of references to BSD-convention strings. "GNU" finds a lot of references to a GNUmakefile in private\genx\shell, which in turn mentions a "mode for Emacs." This is apparently legitimate: simply using a makefile does not apply the makefile's copyright to the resulting code.



Therefore, a superficial look at the code finds no evidence that Microsoft has violated the GPL or stolen other open source code. Closer examination might turn something up.

Favoritism
It's noticeable that a lot of the "hacks" refer to individual applications. In some cases they are non-Microsoft, such as this case: a Borland compiler came to depend on an existing bug, so their fix worked to preserve some of the bug's behaviour. But just as often these application-specific fixes are for Microsoft's own apps. There seems to be an informal hierarchy when it comes these: Microsoft apps take precedence, then major software companies like IBM and Borland.

It's also interesting to finally see references to the notorious undocumented features, which Microsoft application developers have long been known to use.

private\mvdm\wow32\wcntl32.c:
// These undocumented messages are used by Excel 5.0



private\mvdm\wow32\wgdi31.c:
// InquireVisRgn is an undocumented Win 3.1 API. This code has been
// suggested by ChuckWh. If this does not fix the s 2.0
// problem, then ChuckWh would be providing us with an private entry
// point.



private\mvdm\wow32\wgfont.c:
* This thunk implements the undocumented Win3.0 and Win3.1 API
* GetCurLogFont (GDI.411). Symantec QA4.0 uses it.
* To implement this undocumented API we will use the NT undocumented API



In some cases, the programmers themselves appear to have been frustrated or surprised.

private\ntos\w32\ntuser\kernel\mnpopup.c:
// Set the GlobalPopupMenu variable so that EndMenu works for popupmenus so
// that WinWart II people can continue to abuse undocumented functions.



private\windows\shell\accesory\hypertrm\emu\minitel.c:
// Guess what? Latent background color is always adopted for mosaics.
// This is a major undocumented find...



private\windows\shell\accesory\hypertrm\emu\minitelf.c:
// Ah, the life of the undocumented. The documentation says
// that this guys does not validate, colors, act as a delimiter
// and fills with spaces. Wrong. It does validate the color.
// As such its a delimiter. If...



Conclusions
The security risks from this code appear to be low. Microsoft do appear to be checking for buffer overruns in the obvious places. The amount of networking code here is small enough for Microsoft to easily check for any vulnerabilities that might be revealed: it's the big applications that pose more of a risk. This code is also nearly four years old: any obvious problems should be patched by now.



Microsoft's fears that this code will be pirated by its competitors also seem largely unfounded. With application code this would be a risk, but it's hard to see Microsoft's operating system competitors taking advantage of it. Neither Apple nor Linux are in a much of position to steal code and get away with it, even if it was useful to them.



In short, there is nothing really surprising in this leak. Microsoft does not steal open-source code. Their older code is flaky, their modern code excellent. Their programmers are skilled and enthusiastic. Problems are generally due to a trade-off of current quality against vast hardware, software and backward compatibility.

Recent Techrights' Posts

The Media Helps Microsoft, Amazon and Others (GAFAM and Beyond) Lie About Mass Layoffs Amid Valuation Bubble
The media, instead of saying that there's an "AI bubble" crashing the economy might instead choose the narrative of "jobs replaced by AI"
Bad Tempered? You Might Have Just Given Away That You're Losing the Argument
Brett Wilson LLP is fully aware that it is being investigated
Lies Need to be Corrected
the Court never invited us
 
Go Watch Video About Librephone, Get Microsoft Ads
Very ethical company...
Campaign of Defamation Against the People Who Built NixOS (and Are Now Pushed Out From Their Own Project)
We've already grown familiar with - and resistant to - such tactics
Links 17/10/2025: Nestlé Crisis, Canada Post Versus 'Gig Economy' [sic] and Vista 11 Breaks Itself
Links for the day
Tux Machines Has Helped Separate Opinions/Analysis From News
In September 2023 we decided to split things apart and not repeat links in both sites
Tux Machines Has Improved Navigation of GNU/Linux and BSD News
Some more 'wiring' work
What a World Would Look Like If Everyone Used Free Software Only
Freedom is what matters, not "Open".
Richard Stallman (RMS) is a Target of Defamation Campaigns Because of His Views on Software (But Politics Are the Excuse for Defaming Him)
Here in this site we try to refrain from politics, except in Daily Links
End of Vista 10 and Rise of GNU/Linux as Client Side Operating System
It seems certain GNU/Linux will grow in popularity over time
Taking Stock of a Week's Worth of EPO Leaks
We remain committed to exposing EPO corruption as long as it keeps happening
Mathieu Parreaux claims FINMA knew since day one
Reprinted with permission from Daniel Pocock
Calumny, Libel, Joerg Jaspert & debian-private untouchable cyberbullies
Reprinted with permission from Daniel Pocock
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Thursday, October 16, 2025
IRC logs for Thursday, October 16, 2025
Techrights Turns 19 in 3 Weeks
coverage of suppressed topics and protecting all sources/whistleblowers
International E-Waste Day Same Day as End of Vista 10
message from Akira Urushibata
The EPO's Central Staff Committee Presents Evidence That Staff Compensation Lowered While the Office Increases Income by Illegally Granting Invalid Patents
These people become millionaires by doing illegal things
Second or Third Wave of Microsoft Mass Layoffs in October 2025, This Time Portugal
Those are just the ones we know about, there may be several more
'Help Net Security' (helpnetsecurity.com) May Have Become a Slopfarm as Well
Zeljka Zorz, Editor-in-Chief at Help Net Security, was reported to us
Gemini Links 17/10/2025: Rant About Network Solutions, Strange Anomaly on Lagrange
Links for the day
EPO Staff Representation Lacks Social Dialogue With Relevant Management, Controversial and Sometimes Illegal Policies Implemented Without Necessary Input
"In this open letter, the CSC requests that the President submits an agenda item in the next available General Consultative Committee (GCC) meeting on setting up regular meetings between the CSC and the higher management of DG1."
Links 16/10/2025: Political Leftovers and Gemini Protocol Links
Links for the day
Slopwatch: Guardian Digital (linuxsecurity.com), Slashdot, Google News, and More
Maybe one day, once the bubble pops completely, Google News will just outright delist all slopfarms
Lufthansa Modern Slavery, Joerg Jaspert (ganneff) & Debian NSB Softwareentwicklung charade
Reprinted with permission from Daniel Pocock
Links 16/10/2025: US Starting More Trade Wars With China, CIA War on Venezuela
Links for the day
SUSE Blog is Still LLM Slop, Marketing Manager at SUSE Cannot Write
Would you buy from a company or seek support from a company that cannot even write (or fakes writing)?
Pretend You're Not Dead: Microsoft Spent Almost Two Decades Rebranding Things as "Cloud, Then "AI", Now "XBox" and "Quantum"
"AI" bubble pops, Microsoft harping about "quantum" already
IBM Allegedly Found New Tricks for Silent Layoffs: LPI, Then MIS (Not PIP)
Remember that "Red Hat layoffs" won't be reported after the bluewashing
Links 16/10/2025: Red Lines and Feeding of Microsoft Trolls
Links for the day
MIT as a Propaganda Mill of GAFAM, Paid by GAFAM
"the news" today
Links 16/10/2025: Lies Euphemised as ‘Dueling Versions of Reality’ and Microsoft "Open" "Hey Hi" Resorts to Porn as No Business Model Was Found
Links for the day
The Local Staff Committee Munich (Representation of the EPO's Staff) Explains When Cluster of Pregnancies May Result in Reduced Pay
"...even one week of part-time working is sufficient to reduce the salary you perceive during the entirety of your maternity leave."
Another Black Eye for 'Secure Boot', Microsoft Media Tries to Blame "Linux"
It enables Microsoft to remotely control computers, even computers that don't run Windows and never had any Microsoft software installed
Slopwatch: UbuntuPIT, linuxsecurity.com, and Various Slopfarms in Google News Attacking "Linux"
A new survey of the Web said that the majority of the Web is now slop (that's being said in the news this week)
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Wednesday, October 15, 2025
IRC logs for Wednesday, October 15, 2025
Links 16/10/2025: Increased Use of Social Control Media Surveillance in US, French Rage Over Pensions
Links for the day
Links 15/10/2025: Qantas Airways Loses Control of Sensitive Data and Software Patents Are Being Thrown Out
Links for the day
Vista 10 is 'Dead', Here's Why People Should Move to GNU/Linux (or the BSDs)
Today we try to make an outline of reasons move away from Windows to GNU/Linux
Our Sites Continue to Improve
LLM slop has had no noticeable impact on us
Gemini Links 15/10/2025: Neovim, Helix Compared and Gemlog.blue Now Closed
Links for the day
Links 15/10/2025: Mass Layoffs at Amazon, OneDrive Spyware Revved Up, More 'Gen Z Protests'
Links for the day
The EPO's Staff Engagement Survey 2025 is Already Tainted by Intimidation by EPO Management (Trying to Influence Outcomes by Scaring Genuine, Honest Critics)
"[W]e have received reports that, following the previous survey, teams with negative responses were reproached or questioned about their answers..."
The DDoS Attacks by Microsoft's Scam Altman and Other Slop Charlatans and Frauds is Hurting the FSF, Delinking It From Copyleft Projects
This impacts a lot more than access to the licences
Microsoft Scanning Faces in Photos People Upload to Microsoft (Even Unconsciously), Slashdot Turns Report About It Into "Microsoft Sez" (Says)
Or "let's repeat the lies from a PR person/Microsoft's publicist"
[Teaser] Angel Aledo Lopez the Manipulator (Nepotism, Poll Rigging, and Other EPO Corruption)
We'll discuss this later today or tomorrow, based on internal EPO material
Attacks on Techrights Are Only Making Techrights Bigger and Even More Popular
A week ago they offered to settle with us
Epic Metaphor for End of IBM: "The IBM Demolition is Down to the Last Shards!"
Nothing lasts forever
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, October 14, 2025
IRC logs for Tuesday, October 14, 2025
Proprietary and DRM Prisons Spiralling Down the Sinkhole? Not Just Yet.
Let's hope that more people will flee to GNU/Linux
The European Patent Office (EPO), the Second-Largest Institution in Europe, is Cracking Down on Recreational Activities
Without AMICALE activities, and as staff already says it's pressured to work more for less, how can the EPO recruit bright people?
Transparency: FSFE financial reports exclude speaker fees and expenses
Reprinted with permission from Daniel Pocock