Inspect executable binary similarity

Question

I've found a company in China selling a software that is clearly a copy of my own work. For context, this is actually a physical product that comes with a Ubuntu computer and the software pre-installed on it.

I've acquired this product and inspected some of the things. I see all the libraries are identical on their system as on my own. The auxiliary files used by the app are named identically as for my program. The format of these files are identical. And many other things that, in the end, for me, leave no doubt about the infringement.

But when I compared the executable binaries, theirs is double the size in MB. Plus, I don't see any similarities when comparing byte for byte. I try reverse compiling my executable with Ida Pro, and I can do it. All the function and variable names are obfuscated but I can see the assembler code. When I open my executable with Ida, a pop-up appears where I select that it's a "ELF64 for x86-x64 (Executable)".

When I open their executable in IdaPro, I get the same popup, but it doesn't offer me the option of ELF64. Instead, it just offers the option "Binary file".

When I press OK, I get this.

I press Yes, I finally get this.

I press OK, and then I see a hex view of the literal bytes in the executable. And I'm supposed to find the entry point?

I'm not even mad, this is great job. I wish I knew how to protect my code in this way.

1. Is there a way that they could have used my executable and then somehow re-compiled it so that it's different but still be able to execute?
2. How would you go about gathering proofs of infringement from a technical standpoint. That is, I'm not looking for an opinion from a Law expert. Just from a technical standpoint, I see binary similarity as the best form of evidence of infringement.

EDIT: I'm sharing the first segment of my own app vs the copied app.

My app:

7F 45 4C 46 02 01 01 03 00 00 00 00 00 00 00 00
02 00 3E 00 01 00 00 00 90 F7 42 00 00 00 00 00
40 00 00 00 00 00 00 00 D0 14 52 00 00 00 00 00
00 00 00 00 40 00 38 00 0A 00 40 00 21 00 20 00
06 00 00 00 05 00 00 00 40 00 00 00 00 00 00 00
40 00 40 00 00 00 00 00 40 00 40 00 00 00 00 00
30 02 00 00 00 00 00 00 30 02 00 00 00 00 00 00
08 00 00 00 00 00 00 00 03 00 00 00 04 00 00 00
70 02 00 00 00 00 00 00 70 02 40 00 00 00 00 00
70 02 40 00 00 00 00 00 1C 00 00 00 00 00 00 00
1C 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00
01 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00
00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00
A9 82 51 00 00 00 00 00 A9 82 51 00 00 00 00 00
00 00 20 00 00 00 00 00 01 00 00 00 06 00 00 00
B8 89 51 00 00 00 00 00 B8 89 B1 00 00 00 00 00
B8 89 B1 00 00 00 00 00 B4 89 00 00 00 00 00 00
78 6D 01 00 00 00 00 00 00 00 20 00 00 00 00 00
02 00 00 00 06 00 00 00 78 F9 51 00 00 00 00 00
78 F9 B1 00 00 00 00 00 78 F9 B1 00 00 00 00 00
20 05 00 00 00 00 00 00 20 05 00 00 00 00 00 00
08 00 00 00 00 00 00 00 04 00 00 00 04 00 00 00
8C 02 00 00 00 00 00 00 8C 02 40 00 00 00 00 00
8C 02 40 00 00 00 00 00 44 00 00 00 00 00 00 00
44 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00
07 00 00 00 04 00 00 00 B8 89 51 00 00 00 00 00
B8 89 B1 00 00 00 00 00 B8 89 B1 00 00 00 00 00
00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00
08 00 00 00 00 00 00 00 50 E5 74 64 04 00 00 00
30 A9 4C 00 00 00 00 00 30 A9 8C 00 00 00 00 00
30 A9 8C 00 00 00 00 00 1C 77 00 00 00 00 00 00
1C 77 00 00 00 00 00 00 04 00 00 00 00 00 00 00
51 E5 74 64 06 00 00 00 00 00 00 00 00 00 00 00

Infringing app:

2a c5 e6 c6 57 fc ab fe 55 ff aa ff 55 ff aa ff 
57 fd 94 fd 54 fe aa fe 95 c9 e8 3f 55 ff aa ff 
15 bf aa bf 55 ff aa ff fd 83 fb 57 55 ff aa ff 
55 ff aa ff 15 bf 92 bf 5f f5 ea f5 75 df b5 df 
53 f9 aa f9 51 fb aa fb 15 bf aa bf 55 ff aa ff 
15 bf ea bf 55 ff aa ff 15 bf ea bf 55 ff aa ff 
65 cd aa cf 55 ff aa ff 65 cd aa cf 55 ff aa ff 
5d f7 aa f7 55 ff aa ff 56 fc aa fc 51 fb aa fb 
25 8d aa 8f 55 ff aa ff 25 8d ea 8f 55 ff aa ff 
25 8d ea 8f 55 ff aa ff 49 e3 aa e3 55 ff aa ff 
49 e3 aa e3 55 ff aa ff 54 fe aa fe 55 ff aa ff 
54 fe aa fe 50 fa aa fa 55 ff aa ff 55 ff aa ff 
55 ff ea ff 55 ff aa ff 55 ff ea ff 55 ff aa ff 
7c e4 fb d6 55 ff aa ff 7c e4 fb d6 55 ff aa ff 
55 ff 8a ff 55 ff aa ff 54 fe aa fe 53 f9 aa f9 
8d 66 fb 27 55 ff aa ff 8d 66 1b 27 55 ff aa ff 
8d 66 1b 27 55 ff aa ff 29 12 aa 83 55 ff aa ff 
0d cd ab a7 55 ff aa ff 55 ff 8a ff 55 ff aa ff 
57 fd aa fd 53 f9 aa f9 35 24 fb 9f 55 ff aa ff 
35 24 1b 9f 55 ff aa ff 35 24 1b 9f 55 ff aa ff 
a5 0d aa 0f 55 ff aa ff a5 0d aa 0f 55 ff aa ff 
5d f7 aa f7 55 ff aa ff 51 fb aa fb 51 fb aa fb 
d9 71 aa 73 55 ff aa ff d9 71 ea 73 55 ff aa ff 
d9 71 ea 73 55 ff aa ff 11 bb aa bb 55 ff aa ff 
11 bb aa bb 55 ff aa ff 51 fb aa fb 55 ff aa ff 
52 f8 aa f8 51 fb aa fb 8d 66 fb 27 55 ff aa ff 
8d 66 1b 27 55 ff aa ff 8d 66 1b 27 55 ff aa ff 
55 ff aa ff 55 ff aa ff 45 ef aa ef 55 ff aa ff 
5d f7 aa f7 55 ff aa ff 05 4a de cb 51 fb aa fb 
f5 c1 e6 5f 55 ff aa ff f5 c1 26 5f 55 ff aa ff 
f5 c1 26 5f 55 ff aa ff 69 b6 aa c3 55 ff aa ff 
69 b6 aa c3 55 ff aa ff 51 fb aa fb 55 ff aa ff 
04 4b de ca 53 f9 aa f9 55 ff aa ff 55 ff aa ff  

It looks like it's xorred with some pattern but not quite. Also, they might have started with a slightly different version of my code. Depending on the exact build they used.

Answer 1

The file you got is not a binary executable in a common format. IDA Pro can understand ELF and a lot more of executable formats. If its best detection is binary it means the file is not in any of those formats.

There is no point in analyzing this file with IDA until you understand what it is.

Before firing up IDA be sure to understand the format of the file and how it's used:

1. Inspect it with a hex editor and see what's there. See if there are patterns (e.g. lots or repeated byes may mean xor encryption of an ECB mode chiper) or signatures.
2. Use tools like file or binwalk.
3. The bulletproof way to understand the format of that file is to find out who read it. You can use auditd to log access to files.

Once you know more about that file, if it contains code in a non-standard format you can still use IDA to inspect it.

Finding out how to eventually deobfuscate the file should be easy, alternatively, you can dump its decoded version from memory. Keep in mind that ELFs on disk differ from ELFs on memory.

They couldn't recompile your executables since they did not have access to the source code (I suppose). They could have obfuscated them and and wrote a loader.

Once you recover the original executables, you can compare them with bindiff but I suspect that they are likely identical to yours to the point that even their hashes will be the same.

By collecting many pieces of evidence of similarity (same names, same code, same OS, and so on) you can easily mount a case for infringement. If their binaries differ from yours just by a fraction of non-relevant code, then they surely copied them.

P.S. Beware that Linux can be augmented with new executable formats but I doubt this is the case.

Answer 2

I think you're on the right track about the XOR obfuscation: XORing each 4 byte block of the "infringing app" file with hex 55FFAAFF, and then XORing the second and fourth byte of each block with the first byte, yields something that appears to be a valid x86-64 Linux ELF file header and (coincidentally or not) looks very similar (but not identical) to your "my app" file.

However, given the limited data you've provided, I can't rule out the possibility that the similarity between your app and the deobfuscated Chinese app might be simply due to coincidental similarity between any two ELF file headers of the same type. To rule that possibility out, you'd have to either provide us with longer segments of the files, or deobfuscate the full Chinese app file yourself and then disassemble it and compare it with your app.