How can I validate the non-encrypted files from my CTF-archive when using the MATLAB Compiler 4.0 (R14)?

I am using the MATLAB Compiler 4.0 (R14) to build a standalone application, and I have included a JPG-file in my project using the following command:

mcc -m myfile.m -a flag.jpg

After deployment, when the files are extracted from the CTF archive during run-time, I would like my MATLAB file to verify that the non-encrypted files are indeed the original files and have not been tampered with.

Answer 1

[MathWorks Support Team]

The MATLAB Compiler encrypts MATLAB files that are contained in the CTF-archive. Other file types that are added to the CTF-archive using the MCC command's “-a” option are not encrypted.

While the MATLAB Compiler does not provide any specific functions for validating non-MATLAB files added to the CTF archive, one approach to this validation would be to compare the file size and timestamp of CTF files to corresponding values known at development time. For example:

attr = dir('flag.jpg');

if(( strcmp(attr.date,expectedDate)==0) || attr.bytes ~= expectedBytes)

      error('CTF archive has been tampered with!')

end

where "expectedDate" and "expectedBytes" are values that are determined from inspecting the corresponding file at development time.

This approach should be sufficient to prevent against accidental CTF corruption, as well as simple attacks. If additional security is required, an advanced option would be to examine Java security mechanisms and use the MATLAB Java API to use this functionality from MATLAB code.

For information refer to the documentation on the MATLAB Java API. This can be accessed by navigating as follows in the 'Contents' tab of the documentation browser:

Contents -> MATLAB -> User's Guide -> External Interfaces -> Using JAVA libraries from MATLAB