Compiling Twice with Delphi 6 and getting the same

Question

For the purposes of binary / source code verification, i'd like to be able to make two compiles on the same computer 2 weeks apart and have the binaries be identical and thus pass some checksum test.

So far I've found that most likely the timestamp will be written by the compiler into the binary. I can work around this by doing the compare on the dumpbin /rawdata results per this msdn article.

http://support.microsoft.com/kb/164151

However the dumpbin results still differ in a about a dozen places and the difference still appears to be some kind of timestamp (changing from A1 73 to C4 76) for example.

I assume this is the timestamp that the delphi compiler is putting into the code/data sections but i can't find where this is happening or how to turn it off. Fiddling with the various compiler/linker options has not changed this behavior.

Any help would be greatly appreciated.

Answer 1

We researched this question a few years ago, and as I recall the answer was simply that the people at Borland/Codegear/Embarcadero do not subscribe to the notion that the compiler should produce exactly the same output given exactly the same input (given that the current date-time is not acceptable to consider as input).

This is disappointing, but given that Delphi is upmteen major versions old, it probably will not change.

Answer 2

Unfortunately I haven't heard of any answer to this problem.

It's not just timestamps but there are places where a few bytes of random garbage out of memory ends up in the result.

Answer 3

Based on your comment in the question, I think you are searching for the answer to this question:

How can I verify that a certain binary is created by a certain set of source files

One way is to have an automated built process that:

1. Inserts a unique verififcation tag in the source code (might be as simple as a GUID string or something else in an include file)
2. Compiles the binaries using that verification tag
3. Packs the resulting binary and source code in a delivery directory tree

You must make sure that your sourcecode actually uses that verification tag (for instance by showing in an about box, or something similar).

I use FinalBuilder to automate build processes like this.

--jeroen