The simplest way to discover hidden GPL use in programs is to use strings.exe, found at sysinternals. But since the idea is to hide the use, the program is more often than not encrypted or compressed. To compress programs, one common method is to use UPX, found at upx.sourceforce.net. Fortunately, UPX can also decompress what it has compressed. Again, since the idea is to hide what can be discovered by looking at strings (strings are text), the "UPX" markers are often removed, even though doing so is against the UPX license.Find the EXEs or DLLs you want to investigate. This example uses the 32-bit version of BlueIris.exe, from one of its many 4.0.9.x releases.
2015.06.23 22:54 <DIR> sounds 2015.06.23 22:54 <DIR> www 2008.01.26 12:07 135,168 HHNetClient.dll 2013.10.05 02:38 4,449,952 mfc120u.dll 2013.10.05 02:38 970,912 msvcr120.dll 2013.12.04 10:33 506,368 EASendMailObj.dll 2014.04.28 16:32 220,016 ftd2xx.dll 2014.05.21 15:25 143,720 SeaMAX.dll 2014.09.03 14:16 59,776 BlueIrisService.exe 2014.10.31 21:17 608,640 BlueIrisApplePush.exe 2014.12.16 16:36 230,400 libfaad.dll 2014.12.22 13:01 1,410 ReadMe.txt 2015.04.12 21:02 490,336 BlueIrisAdmin.exe 2015.06.21 02:40 4,032,566 BlueIris.chm 2015.06.23 14:36 7,768,416 BlueIris.exe 13 File(s) 19,617,680 bytesThe main program is BlueIris.exe, sized at 7,768,416 bytes. However, this is the UPX-compressed size. How can you tell it's been compressed by UPX? Use a binary editor to look at the first KB of the file:0000 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 MZ.............. : 0040 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 ..............Th 0050 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f is program canno 0060 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 t be run in DOS 0070 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 mode............ 0080 94 db 54 a6 d0 ba 3a f5 d0 ba 3a f5 d0 ba 3a f5 ................ : 0250 55 50 58 30 00 00 00 00 00 b0 5a 01 00 10 00 00 UPX0............ 0260 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 ................ 0270 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 ........UPX1.... : 03d0 00 00 00 00 00 00 00 00 00 00 00 33 2e 39 31 00 ...........3.91. 03e0 55 50 58 21 0d 09 08 09 9d 81 28 4d c1 83 65 9f UPX............. 03f0 9b 1d cd 01 4a 78 72 00 00 78 58 01 16 00 00 c6 ................ 0400 ed ff ff ff 55 89 e5 57 56 53 83 ec 5c 89 cb 8a ................If you don't see UPX that does not mean it was not UPX compressed since it's simple to overwrite the UPX characters with spaces. Often, UPX can still detect that it is a UPX-compressed binary so go ahead and try even if you don't see these markers.First thing, decompress the program using UPX with its -d option switch:
C:\wk>upx.exe -d BlueIris.exe Ultimate Packer for eXecutables Copyright (C) 1996 - 2013 UPX 3.91w Markus Oberhumer, Laszlo Molnar & John Reiser Sep 30th 2013 File size Ratio Format Name -------------------- ------ ----------- ----------- 22579040 <- 7768416 34.41% win32/pe BlueIris.exe Unpacked 1 file.Notice the 7.7 MB file size has ballooned to 22.5 MB. This, the non-compressed program file, is on what strings.exe is to operate. To use strings.exe you can run with only the file to inspect as the input, but that scrolls off the screen very fast. For this program, strings.exe generates 1,103,007 lines of text. Not all lines are true text, but you can presume that there is a LOT of text in this. The text belongs primarily to the GPL libraries being used. Which GPL libraries? A simple way to see only text lines which have the text, GPL, in them, is to use this trick:C:\wk>strings.exe BlueIris.exe | findstr /i GPLto see this: (most of the text generated was removed below - in total about 24 lines, though some lines are very long)libswresample license: GPL version 2 or later libswscale license: GPL version 2 or later libavcodec license: GPL version 2 or later libavformat license: GPL version 2 or later libavutil license: GPL version 2 or laterYou can redirect the output of strings.exe so that it goes to a file, if, for example, you want to see the entire lot of possible strings (a very large file results from this):C:\wk>strings.exe BlueIris.exe > bi_using_gpl.txt (has over 1 million lines of text)You have discovered that this particular program is using GPL code. If you discover such programs, contact their respective companies and demand that they comply with the (L)GPL license. These companies often have draconian DRM in place to force you to comply to their licenses, so why are they free to ignore the GPL?For LGPL use, the first and last requirements listed at https://www.ffmpeg.org/legal.html are:
1. Compile FFmpeg without "--enable-gpl" and without "--enable-nonfree".yet from the strings' output of blueiris.exe (see above) you find:
:
18. Make sure your program is not using any GPL libraries (notably libx264).which makes this GPL use, not LGPL. Numbers 2 through 17 are also violated.--enable-gpl --cpu=i686 --prefix=/c/msys/1.0/ffmpeg/build --enable-libx264