ReactOS: Why Trojans Run on the Windows Alternative but Microsoft Word Doesn’t

Stand — don’t fall!

You’ve probably heard a lot about this open-source project. It’s been in development since the ’90s and has been getting a lot of publicity, especially recently. You could catch talks about it at Google Summer of Code, German hackathons, and even government-level presentations in Russia. ReactOS is developed under the GPL/BSD/X11 licenses and is available in multiple languages, including Russian.

The ReactOS project fit neatly into Russia’s import substitution program. On April 1, 2015, Russia’s Ministry of Communications awarded the proposal “Creating an open-source operating system based on ReactOS for PCs, laptops, and other mobile devices” second place in the “Client and server operating systems” category. So why haven’t we all switched to this free Windows alternative yet?

To answer this, we ran our own tests with ReactOS. We tried installing it on two laptops: one very old and one not so old. It didn’t work out of the gate… and not later either. In both cases the installer glitched right at the start, leaving us staring at a black (well, dark gray) screen. Meanwhile, these same laptops have previously installed all sorts of OSes without a hitch, including FreeDOS, Windows XP/7, Knoppix, and Kali Linux. Booting from a DVD-R and a USB stick works fine on them — they use old-school BIOS (not UEFI).

We probably could have coaxed ReactOS onto our well-worn laptops, but the duct-tape-and-incantations phase didn’t last—and neither did our patience. No average user is going to put up with that for long.

You can find YouTube videos showing ReactOS booting on fairly recent Dell laptops. But the very fact someone made a video about it suggests it wasn’t straightforward. If the author filmed it, there was probably a lot of manual tinkering and workaround rituals beforehand. ReactOS doesn’t install on much “out of the box”—and there isn’t even a box, just nightly builds on the project’s website.

So we ran the rest of the tests in a VM. That’s how most ReactOS fans have been doing it for years: the free Windows clone runs inside proprietary, actual Windows.

ReactOS is advertised as supporting a wide range of file systems: Ext2/3/4, Btrfs, ReiserFS, UFS, NTFS. Sounds like you’ve got plenty of options! In practice, though, the system partition can only be formatted as FAT—and that’s just the tip of the iceberg.

And the kicker is that ReactOS has no tools to check and repair logical errors in the file system. In short, there’s no CHKDSK. So there’s simply nothing to fix FAT with.

So the recovery menu ends up being basically useless. Whether you choose debug or EMS, once ReactOS goes sideways you’ll just get a blue or black screen—depending on your luck. We hit that within half an hour.

Reactor Reboot

Another serious problem in ReactOS is the memory manager. It’s stuck in the past: it keeps reaching for addresses from old tables, bringing back memories of early XP days. Remember those endless “The memory could not be read” pop-ups? In ReactOS they show up regularly, along with all sorts of software exceptions.

In the end, after yet another error, the system hard-freezes, and on reboot you’re greeted with a blue screen.

The only way to get ReactOS back up is to restore a previous state from an image. Fortunately, VirtualBox creates snapshots quickly.

The next hurdle—assuming you make it that far—is device drivers.

To hell with the sound card! We can live without a webcam, touchpad, and advanced keyboard features, too. But where’s the Internet? We had to try a bunch of network adapters (both physical and emulated) before ReactOS would work with any of them. The only one that worked was an ancient 10 Mbps card.

ReactOS couldn’t see the wireless adapters at all. When we attached the driver disk, every menu option was there except “Install.” That entry simply vanished because the installer couldn’t pass the OS compatibility check. Sure, there are, shall we say, proctological workarounds: rip out the driver files, copy them into the right directories by hand… you can even hack the registry manually. But then what was the point of inventing Plug and Play decades ago?

Apps and Games

If you’ve somehow managed to install ReactOS—and even the network drivers—then once you’re online you’ll have access to a pretty decent software installation manager. However, it’s best to start with the libraries rather than the applications.

At first the catalog seems comprehensive and convenient, but only until you realize it’s the entire list of officially supported applications for ReactOS—and even then, not all of them actually install. Some links point to outdated URLs, so the download never starts.

You might remember how we tried in vain to open the Xakep.ru website in KolibriOS. It didn’t support HTTPS, so all our efforts were futile. ReactOS doesn’t have these issues. You can install Firefox and browse the web pretty much normally.

ReactOS developers and enthusiasts suggest using it as a replacement for Windows XP on PCs that are basically just typewriters. In practice, the average secretary probably won’t notice the switch. Word barely works for her as it is, but the Klondike solitaire port in ReactOS is solid.

The package manager even has a shareware version of Diablo II, and it does launch—but it probably shouldn’t. With 8-bit graphics and software rendering it’s technically playable, in the same way you can technically drink juice while bungee-jumping upside down off a bridge—but in practice, who would want to?

Sure, that’s also a VM limitation. On real hardware, ReactOS does detect the GPU (sometimes). It even has drivers for the RIVA TNT2 and the GeForce 4. Remember that one?

There are ways to do GPU passthrough to a VM, but they’re experimental and better suited to testers than gamers. Still, you can give it a try.

Mission: Impossible — Installing Word on ReactOS

If ReactOS is meant to be useful on machines used as glorified typewriters, it needs at least one app you can actually write in. Preferably not just Notepad, but a full-fledged word processor. We tried installing various office suites in turn, starting with Office 97, which still runs on Windows 95 and NT 4.0.

Unfortunately, Microsoft Office 97 won’t install because ReactOS lacks NTVDM (the NT Virtual DOS Machine), which provides DOS support on NT-based systems.

Microsoft Office 2000 won’t install because it requires the Windows Installer subsystem.

Microsoft Office 2003 hangs during installation — it can’t register the libraries.

Microsoft Office 2010 fails to install because ReactOS lacks the SQL Setup Enumeration APIs.

WPS Office 10 installed and launched, but didn’t display any apps. When started manually, the Writer editor can’t create a new document—neither a blank one nor from a template. It just hangs.

In the ReactOS App Manager, the LibreOffice install link doesn’t work. I had to download LibreOffice 4.3 from the official site. It installed! It takes a very long time to launch (about a minute on a Core i7-4770K). But when typing, the text cursor isn’t visible and lines overlap each other (rendering is broken).

OpenOffice installed as well, but it has the same issue.

Well, it looks like the only thing left is to install DOSBox and Word 5.5.

The (In)Security of ReactOS

ReactOS enthusiasts often tout it as a more secure take on Windows, citing its open-source code and the absence of malware. But openness is a necessary, not sufficient, condition for security, and the lack of viruses is only a temporary state.

Today, ReactOS already contains over 9 million lines of code and is growing by nearly a million lines a year. How long would it take just to read it all, let alone analyze it? Auditing even a simple program—say, up to 5,000 lines—takes months and costs a significant amount. Here, auditors would face an impossible task. A code audit would take years and be pointless, because developers would keep changing the code the whole time. Otherwise, the project would stall again.

As for viruses, Windows malware already runs on ReactOS today—with mixed results. We tried infecting ReactOS with various strains, and it turned out to be quite susceptible. Some infections proved outright fatal, taking the system down completely.

WannaCry launches successfully and drops temporary files—an encryption key, a wallet address, and ransom payment instructions in multiple languages. However, no encryption occurs because ReactOS lacks the necessary components.

Other ransomware Trojans behave similarly: they add registry entries, set themselves to run at startup, and drop additional files—but they don’t actually encrypt the user’s data.

Other strains of malware often exit with an error.

After a series of these errors, ReactOS crashes with a blue screen (BSOD).

Modern antivirus software won’t run on ReactOS. Kaspersky Free freezes at the very first step of installation. Dr.Web immediately crashes ReactOS into a BSOD—faster than any trojan. Sure, in that state it’s not exactly threatened by malware, but you can’t get any work done either. Even after a reboot (see FAT and the lack of chkdsk).

Raising funds to put an alpha‑stage OS on steroids

Any project needs funding to grow. If you rely on sheer enthusiasm, contributors will churn. One student will write a few lines, then another will try to make sense of someone else’s code until they give up too. That’s largely what’s happening with ReactOS. It’s still very rough around the edges—so much so that it’s obvious at a glance. Some buttons are just placeholders for future features, with no functionality wired up.

The developers have launched multiple fundraising initiatives, but none have really taken off. For example, in 2014 they ran a crowdfunding campaign on Indiegogo that flopped: they needed $50,000 but raised only half. Today, the project website asks supporters to set a monthly (or at least one-time) donation amount in euros. So few people respond that only 5% of the target has been funded so far (and it was the same a month ago).

All this points to a lack of real interest in the operating system, despite each new release racking up millions of downloads. Personally, I see the reasons for this as follows.

• ReactOS has become a never-ending project—a perpetual alpha that hasn’t reached beta in over two decades. That does serious damage to the project’s reputation.
• ReactOS suffers from unclear positioning. Who is this operating system actually for?
• There are legal complications around the use of key components in ReactOS.
• ReactOS’s development pace is not just slow—it’s unpredictable. You can wait if you know how long; the uncertainty is what kills it.
• Shipping a release and maintaining it require bringing on qualified developers on a permanent basis. That takes not just a lot of money but stable financial backing—something ReactOS has never secured.

For a while it seemed like everything was over: the Russian foundation was shut down, and the German one had suspended its operations. Today, ReactOS Deutschland is active, and the Russian “ReactOS Foundation” is undergoing restructuring and actively maintains a blog on Habr.

Will Achilles Catch the Tortoise?

Positioning is the foundation of any business strategy, and here there’s none. The clearest answer to the question “Why, and for whom, is ReactOS being built?” comes from Alex Ionescu, one of the lead kernel developers of this operating system.

In his talk, he explains that ReactOS is unlikely to interest the mass market (surprise!), but it could be quite appealing to certain groups of people:

• students who want hands-on experience developing system components. He himself joined ReactOS for that reason: he needed to do a student project in an open-source project, and all the Linux ones were too heavy to pick up on short notice;
• owners of point-of-sale (POS) terminals and small businesses that rely on a very limited set of legacy applications. It doesn’t make sense for them to move to Windows 10 or pay for Windows Embedded licenses if a cheaper equivalent becomes available.

Right, nobody’s saying ReactOS has to be free forever. Paid Linux editions have existed for ages, and the ReactOS team also wants to eventually recoup development costs with a similar model: a free home edition and a paid commercial one. The catch is that the paid “penguins” come with serious support, while the ReactOS camp hasn’t been able to offer anything on that level for nearly three decades.

Why am I talking about more than twenty years if ReactOS officially dates back to 1998, and its current incarnation only to 2004? Because the earlier project was called FreeWin. It was launched in 1996 as an attempt to build an open-source “Windows 95” with a team of geeky developers. They spent two years just figuring out the basic strategy, and then the project fizzled out before it really got started. All that energy turned into noise.

Only in July 1998 did Jeff Knox propose ditching the Windows 95 base in favor of NT 4.0 and giving the project a new name—ReactOS. By 2004 it had become clear that this, too, was already outdated, and the target needed to be Windows Server 2003 or Windows XP 64-bit (i.e., NT 5.2). That’s the compatibility goal ReactOS has been pursuing ever since.

Microsoft operating systems become obsolete faster than the ReactOS team can build a partial reimplementation as an open-source project. Talking in late 2017 about trying to recreate the functionality of Windows Server 2003 and 64-bit XP is, at the very least, odd.

As Alex Ionescu said in a 2013 talk: “Today I’d pick Windows 7 as the base.” People are still debating that, but while the discussion drags on, Microsoft has already retired it.

Even today there are plenty of artificial hurdles to running pre–Windows 10 releases on modern hardware. Intel’s 200‑series chipsets, AMD Ryzen processors, and all Intel CPUs newer than Skylake don’t have fully functional drivers for older versions of Windows. Officially they’re supported only on Windows 10; unofficially you can make them run even on XP, but only at a bare‑bones, instruction‑set level. Integrated graphics and other useful features simply won’t work on legacy Windows.

Thus, many of the initiatives the ReactOS community still treats as forward-looking have already become outdated. Worse, the basics remain unresolved. For example, USB 2.0 device support is still an issue. A flash drive, printer, scanner, webcam, or 3G modem—getting any of these to work with ReactOS is a minor miracle, and every time it happens someone records a demo video.

Shark‑ and piranha‑infested legal waters

You always have to factor in legal risks when you’re trying to clone someone else’s product. Even if you claim the resemblance is only skin-deep and all the code is written from scratch, that’s a weak argument in court. Microsoft has a massive legal department that’s constantly hunting for alleged infringers and filing lawsuits faster than developers write code. That operation brings in revenue comparable to Windows sales. It’s naïve to think that if ReactOS achieves even modest commercial success, Microsoft’s lawyers will send congratulatory postcards instead of lawsuits.

The developers claim ReactOS is built from publicly available information. Unfortunately, you can’t get a detailed understanding of how the NT 5.2 kernel works from public sources alone—you’d first have to make them public, for example by using IDA Pro and SoftICE, or through leaked source code. Back in 2006, former ReactOS developer Hartmut Birr stated that, despite the “from scratch” narrative, reverse engineering was most likely used. After that came a lengthy “purge of non-free code,” with access to files suspended—but who verified how effective that witch hunt really was?

According to the official list of People of ReactOS, there are currently 25 people working on the project, including the project coordinator Aleksey Bragin (aka Fireball). Over the lifetime of the project, more than 200 people have contributed. At any given time, anywhere from two to 35 people of varying skill levels have been active. The majority are students — they’re the ones willing to put in the hours for little or no pay.

The reason is simple: trying to build a Windows clone from scratch helps students understand the original much better. For example, after several years working on ReactOS, Alex Ionescu co-authored the Windows Internals series, which became bestsellers. He even taught classes on the Microsoft campus—all while working at Apple and continuing to contribute to ReactOS as a long-time hobby.

Over time, ReactOS might become an alternative for POS terminal manufacturers. Today they have to buy a Windows license for every device, even though these terminals usually handle very simple tasks (like selling tickets), so most of the features they’re paying for in Windows go unused. The catch is that you can buy a Windows XP license on eBay for literally a few dollars—semi-legally resold by OEM vendors and repair shops—and the original OS provides a known level of stability. Not a high one, but still higher than ReactOS.

Bottom line

Please don’t take my grumbling too seriously. I understand how hard it is to build a binary-compatible clone of a closed-source OS. I just don’t see why. It’s strange to watch two hundred talented people try to do this for twenty years and fall further behind the state of the art with each passing year.

Had ReactOS been framed from the start as a research project for students or a training ground for developers, most concerns would have evaporated. Instead, it’s presented as a free Windows alternative, money is being raised for its development, and it’s being pushed as a homegrown product under the banner of import substitution.

I’d like to believe the criticism will do some good, and that the effort the ReactOS team is currently pouring into PR will be redirected to actual development. Maybe even in my lifetime they’ll properly finish the Monstera memory manager, build a user-friendly bootloader, add drivers, and allow installing ReactOS on a journaling file system. Right now ReactOS is busy flexing its muscles, when what it really needs is a skeleton.