Software Watermarking Research Based On PE File

Software watermarking based on PE file format can be broadly divided into two kinds. The first is the use of PE’s redundant space, the second is the use of PE’s special structure. The former has a large information capacity, but the information is too concentrated to sensitize. The latter has a higher concealment, but has the defect of low capacity and tampering attack. Based on the analysis of above two kinds of algorithms, this paper proposes a new software watermarking scheme based on binder technology, combined with the design of a PE analysis software, analyzes the PE file format, especially, put the emphasis on the method to analyze PE’s resource section data, these work provide a theoretical foundation for the design of the new scheme.Software watermarking based on PE file’s resource section is proposed. Firstly, the embedded information is encrypted by MD5algorithm, then will get WM, also, calculate the number of resource section rearrangement. Then divide WM into WM1and WM2according to the resource section can be embedded in. Hide WM1in rearrangement resource section structure, the basic idea as follows. According to the embedded information WM1, rearrange the second, third and fourth layer’s resource data, the rule of each layer node’s arrangement, is just exchanging the first node with any node in the same layer, at the same time, record the fourth layer’s exchanged node. According to the length of WM2, analyze the fifth layer’s specific node redundancy which is specified by the fourth layer’s exchanged node. According to the embedded information WM2, decide whether to adjust the fifth layer’s resource data, and hide the WM2into the redundancy which exists in the fifth layer’s specific resource data.In view of existence defect based on PE file’s resource section, combine binder technology, realize a watermark tamper-proof function, the basic idea as follows. After embedding the watermark, calculate the new PE file resource section’s MD5value, then hide the encryption result into any redundant space exists in file. At the same time, the redundant space’s address information will be hidden in ICON resource data. After that, bind the tamper-proof program with PE file which has been embed in watermark. Experiment shows that the new scheme solves some defects existing in the algorithm. Not only overcomes the defect which embedded information’s low capacity based on resource section format, but also overcomes the defect which the embedded watermark information is susceptible to tamper-proof attack, ensure the integrity of the watermark.