Crate oinkie 

Detects software theft by comparing birthmarks extracted from binaries.

The root holds only what every use touches: Program, Oinkie – the threads oinkie computes on, and the comparators that run there – Error and Result. Everything else is reached by the module it belongs to, and by that path alone:

• lift – turning a binary into a lifted program, through a tool;
• extract – extracting a birthmark from a lifted program;
• compare – comparing two birthmarks;
• birthmarks – what a birthmark is, and what it holds.

The terms – birthmark, function, element, similarity – are the ones the glossary defines.

Example

Two lifted programs, compared under one analysis: extract the analysis’s birthmark from each, then compare the birthmarks with its algorithm.

use std::path::Path;

use oinkie::{Oinkie, Program};
use oinkie::birthmarks::AnalysisType;
use oinkie::compare::Aggregator;
use oinkie::extract::Extractor;

let analysis = AnalysisType::try_from("op-set-jaccard")?;
let extractor = Extractor::new(analysis.birthmark().clone());
let a = extractor.extract(&Program::load(Path::new("testdata/lifted/pcodes/hello_clang.json"))?)?;
let b = extractor.extract(&Program::load(Path::new("testdata/lifted/pcodes/udl.json"))?)?;

let comparison = Oinkie::new()?
    .comparator(analysis.algorithm())
    .compare_birthmarks(&a, &b, &Aggregator::Hungarian)?;
let similarity = comparison.similarity();
assert!((0.0..=1.0).contains(&similarity));

Modules

birthmarks

What a birthmark is, and what it holds.

compare

Comparing birthmarks.

extract

Extraction: the birthmark of a lifted program.

lift

Lifting: turning a binary into a Program, with a decompiler doing the reading.

Structs

Oinkie

Where oinkie computes: a pool of threads, and the comparators that run in it.

OinkieBuilder

Chooses how an Oinkie is made; Oinkie::builder gives one.

Program

A lifted program, read from the file an intermediate representation was written to.

Enums

Error

Everything that can go wrong in oinkie.

Type Aliases

Result

What every fallible function in this crate returns.