Compiling Twice with Delphi 6 and getting the same checksum on the binary

Question

For the purposes of binary / source code verification, i'd like to be able to make two compiles on the same computer 2 weeks apart and have the binaries be identical and thus pass some checksum test.

So far I've found that most likely the timestamp will be written by the compiler into the binary. I can work around this by doing the compare on the dumpbin /rawdata results per this msdn article.

http://support.microsoft.com/kb/164151

However the dumpbin results still differ in a about a dozen places and the difference still appears to be some kind of timestamp (changing from A1 73 to C4 76) for example.

I assume this is the timestamp that the delphi compiler is putting into the code/data sections but i can't find where this is happening or how to turn it off. Fiddling with the various compiler/linker options has not changed this behavior.

Any help would be greatly appreciated.

Vastitude

I'm just curios (no offense intended): What is the scenario that you want to verify that the exe checksum did not change between 2 builds? – Undertook

I would get that each ".obj" (or equivalent in Delphi) has a timestamp that is finding its way into your .exe – Lenient

has to do with a code transfer where the counter-party needs to test the binary and subsequently verify that the code corresponds to it. i haven't been able to think up another scheme by which to do this so far. – Vastitude

Answer 1

We researched this question a few years ago, and as I recall the answer was simply that the people at Borland/Codegear/Embarcadero do not subscribe to the notion that the compiler should produce exactly the same output given exactly the same input (given that the current date-time is not acceptable to consider as input).

This is disappointing, but given that Delphi is upmteen major versions old, it probably will not change.

Ideality

Answer 2

Based on your comment in the question, I think you are searching for the answer to this question:

How can I verify that a certain binary is created by a certain set of source files

One way is to have an automated built process that:

1. Inserts a unique verififcation tag in the source code (might be as simple as a GUID string or something else in an include file)
2. Compiles the binaries using that verification tag
3. Packs the resulting binary and source code in a delivery directory tree

You must make sure that your sourcecode actually uses that verification tag (for instance by showing in an about box, or something similar).

I use FinalBuilder to automate build processes like this.

--jeroen

Drying

Answer 3

Unfortunately I haven't heard of any answer to this problem.

It's not just timestamps but there are places where a few bytes of random garbage out of memory ends up in the result.

Edmonds