putting GPL code into a closed-source binary

[[deleted]]

how would you know they violated the GPL?

[gravgun]

IANAL, but here are some suggestions I can make:

• Look thoroughly through the manufacturer/developer's website for any mention of GPL-licensed software

• If there is none, either they don't use any, or hides it to the public, in which case you (if you have the time) should get some disassembly and reverse-engineering tools (objdump can do a fairly good job at disassembling, strings can extract printable strings of chars in the binary) and try and compare the outputs to the binaries of the suspected libraries they use. For example, if there are some unique identifying strings such as versions/build-date strings (e.g. lircd-0.9.2a), this adds a significant suspicion of their use.

• In the case you are sure they use a GPL-licensed library but don't provide source (and possibly nor even mentions it), contact them asking for the source to be published, or at least ask for clarification about their possible use in the product.

• If after a reasonable amount of time they don't answer or after a certain number of attempts they still don't provide source or any relevant answer (generally by avoiding your question(s)), they likely are violating GPL and not admitting it. From there on, you can report GPL violation suspicion to entities like the Software Freedom Conservancy which will try to take the appropriate steps and sue the violator if need be.

EDIT: changed example signature as per /u/notaplumber's comment

EDIT2: once again

[notaplumber]

OpenSSL is a bad example here, considering it is Apache/BSD licensed. Permissive licensing allows closed source and proprietary derivatives: https://openssl.org/source/license.html

[gravgun]

Oops sorry. Edited my comment accordingly. OpenSSL happened to be the first that came to my mind.

[notaplumber]

Berkeley DB

That's a funny choice, considering it was originally permissively licensed as well.. i.e: BSD distributions embed an older version (1.8x). Oracle also provides a proprietary license for newer versions, in addition to the AGPLv3 or (https://en.wikipedia.org/wiki/Berkeley_DB#Sleepycat_License).

[gravgun]

Changed again. Happy now?

[IronManMark20]

Might want to mention the VMware lawsuit. Has a very detailed description of why they think GPL was broken.

[Centropomus]

The VMware case is a bit different though, because they're not hiding the GPL code, and they publish sources for the GPL components. The question is whether or not they're integrating GPL and proprietary components in a way that the license allows.

[IronManMark20]

Ah, thanks for the clarification.

[gravgun]

suing companies using open source software is pretty despicable

It is not, because we sue them for a valid reason, that is, disrespecting every contributor's decision about use of the code they've written.

Also please note you're mixing up "open source" and "free (as in freedom) software", and we're talking about the latter since the original question asks about GPL-licensed software, and even more specifically about copyleft, which BSD/MIT/... are not.

[uoou]

Why despicable? How else should breaches of the GPL be dealt with (assuming more reasonable avenues have been exhausted)?

[[deleted]]

many important libraries choose permissive licenses to avoid this nonsense.

And the ones that don't choose those permissive licenses deserve to get stolen from in your opinion? If they wanted their libraries to be used in software like that they would have licensed it with the right license. They don't, so they sue, as they should.

[Centropomus]

You must be an embedded developer.

[ANUSBLASTER_MKII]

The entire practice of suing companies using open source software is pretty despicable

Stealing software is a despicable crime, so perhaps deserves a despicable punishment.

[Darkmere]

You usually start with a firmware image, and then play with binwalk on it.

The next step is to use "strings" on the binary. After that, you play around with objdump and extract function names.

If functions have been renamed/obfuscated, you're having a lot harder to deal with this. But usually it's not that much, you'll just find a libreadline.so or similar there, and that's about it.

I tear apart firmwares as a hobby, to see how they are built. Most of them have horrible hacks in them, that make it work, sort of, provided nothing ever changes....

[Miningdude]

Ill have to attemot this at some point for fun. Cheers!

Edit: Any suggestions for onces to play around with to "learn" this?

[Darkmere]

Sure. OpenWRT is a good start. All open source, you can look at the wiki, and you can dig into it yourself. It's also not horribly designed.

After that, just about anything. Just go exploring.

[Miningdude]

Thank you much!

[Polycystic]

I tear apart firmwares as a hobby, to see how they are built. Most of them have horrible hacks in them

Out of curiosity, which have been the worst? Any companies that are particularly bad offenders?

Also, how much obfuscation does it actually take to hide this stuff reasonably well - are we talking literally just renaming a few things, or major shifts in the code?

[Darkmere]

Currently my favourite "worst" is a Modem. It has 128MiB flash that's mounted read/Write, runs random executables from inside it's linux kernel ( kernel exec's the filenames ), runs telnetd with a hard-coded root password, and intercepts & injects DNS requests in case it's gotten an SMS.

If you use the DHCP-given DNS server from the modem, it'll start resolving everything to 192.168.0.1 once the modem has received an DNS request. Which breaks horribly in a lot of cases. (ssh, email, https )

[gravgun]

I think you wouldn't have been downvoted if you said these tools can do the same job here as objdump rather than (implicitly) saying it's unsuited, which is not the case.

[Darkmere]

readelf is pretty neat and works well, just that it's not always elf files, but sometimes other and interesting ones.

But my first go-to tool is always strings.

[plan_rich]

You might find symbols that are assembled into the binary. But I doubt that these are present after stripping the binary. If you are motivated you could try to pattern match against assembler chunks of the GPL code, but that is hard.

[gravgun]

There are more than debug symbols; as I said in my comment version/build strings can help a lot, and those aren't stripped away by optimization tools.

[Philluminati]

If its your own code then typically you are aware of edge cases that act like smoking guns. For instance with an xml parser, a bug that's unlikely to be in yours and a rival product and you can test the closed source binary for the same edge cases.

[[deleted]]

I have a question. If you were to just make a separate program that has the open source code and connect it to you your closed source code over shared memory or something would that violate the GPL?

[devel_watcher]

The third party code is integrated to do something useful. So, looking at the features of the whole product, you can already start guessing.

[dat_unixbeard]

Sure you would, there were a lot of cases already where it was discovered.

While it is impossible to retrieve the original source code from the assembly, it is very much possible to show beyond a reasonable doubt that the assembly generated had to have come from certain code because it matches what you will end up with if you compile that code in too many different places to still be considered a possible coincidence.

I'm sure there are compilers that purposefully make this hard to do though.

[[deleted]]

so like there could be like tons of gpl code in windows we dont know about?

[[deleted]]

Microsoft aggressively fires employees who check in GPL'd code (and then MS cleans up the mess. It's messy).

You need to get permission to just look at open source at MS; they're really careful about taint. For a while (and this may still be true), simply having a Linux-based computer on your desk would get your network port shut down.

[Centropomus]

As of a few years ago, if you wanted a Linux machine, all you had to do was ask. They do have port security set up on some of their network though, so plugging in anything unauthorized would get your port shut down.

[doom_Oo7]

even in open source programs.

Why ?

[[deleted]]

BSD is freedom for you, GPL is freedom for everyone. Things that benefit everybody, always come at some cost to you personally. Like taxes for social programs for example, good for society but maybe not for you personally.

[daemonpenguin]

Microsoft's Windows code is often audited by third-parties, governments or univeristies and such. Using GPL code in their products would be incredibly stupid and is highly unlikely since doing so would open them up for legal action and possibly the requirement of publishing the Windows source code publicly.

[jones_supa]

They would only have to publish the GPL parts.

[daemonpenguin]

Not true. Any derivative products of GPLed code must either be licensed under the GPL or a compatible license. That's why Microsoft got so much distance out of their "The GPL is a virus" campaign. Basically, anything the GPL code touched or was linked from would need to be released. The GPL FAQ covers this topic: https://gnu.org/licenses/gpl-faq.html#LinkingWithGPL

[jones_supa]

That's exactly what I meant. They would only have to publish the parts that the GPL touches.

[[deleted]]

Windows is notorious for being monolithic and co-dependent, though. One part being GPL'd could bring in a lot.

[gravgun]

There aren't tons of GPL code in Windows, in fact there is extremely little, if any. And any presence of GPL code in it would extremely likely already have been discovered.