Alati za mjeru sličnosti izvršnih programa i obfuskacija izvornog koda

master's thesis

• Title (english): Executable file comparison tools and source code obfuscation
• Author: Filip Jelić
• Mentor: Marin Vuković (mentor)
• Committee member: Marin Vuković (predsjednik povjerenstva)
• Committee member: Miljenko Mikuc (član povjerenstva)
• Committee member: Mario Kušek (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2020-09-18, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

Probijanje licenci softvera otvorenog koda teško je otkriti, jer softver detektor mora obraditi širok izbor vrsta izvršnih datoteka i prevladati obfuskaciju ako se primijeni. Alati za usporedbu izvršnih datoteka ispituju se s obzirom na njihove snage i slabosti u rješavanju obfuskacije. Korištenjem vlastitih i postojećih praktičnih istraživanja, rad predstavlja konačan zaključak o najuspješnijem pristupu usporedbe izvršnih datoteka. Pokazano je da usporedba blokova koda nije najbolji pristup, jer obfuskator može lako podijeliti blokove na mnogo manjih blokova stoga su razmotrene alternativne metode i predloženo je rješenje za praktičnu detekciju plagijata softvera. Najotpornije rješenje je upotreba analize bojanjem za vađenje važnih instrukcija iz izvršnog programa, no taj pristup pati od problema micanja boje koji je praktično pokazan. Konačno, izneseno je teoretsko rješenje micanju boje.

Abstract (english)

Breaking open source software licenses is difficult to detect because a detector software must handle wide variety of executable types and overcome obfuscation if applied. Executable files comparison tools are examined for their strengths and weaknesses when dealing with obfuscation. Using own and existing practical research, the paper presents a definitive conclusion on the most obfuscation resilient executable file comparison approach. It is shown that comparing blocks of code is not the best approach because an obfuscator can easily split the blocks into many smaller blocks. Thus, alternative methods are examined and a solution to making software plagiarism detection practical was proposed. The most obfuscation resilient solution is to use taint analysis to extract important instructions from the executable however that approach suffers from under-tainting issue which was practically demonstrated. Finally, theoretical solution to under-tainting was proposed.

• Keywords: usporedba izvršnih datoteka; otpornost na obfuskaciju; otkrivanje plagijata; otkrivanje kopije koda; obfuskacija izvornog koda; analiza bojanjem
• Keywords (english): executable file comparison; obfuscation resilient; plagiarism detection; code clone detection; source code obfuscation; taint analysis
• Language: english
• URN:NBN: urn:nbn:hr:168:062301
• Study programme: Title: Computing; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2023-01-13 10:06:16