  The software running in embedded or cyber-physical systems (CPS) is typically
of proprietary nature, so users do not know precisely what the systems they own
are (in)capable of doing. Most malfunctionings of such systems are not intended
by the manufacturer, but some are, which means these cannot be classified as
bugs or security loopholes. The most prominent examples have become public in
the diesel emissions scandal, where millions of cars were found to be equipped
with software violating the law, altogether polluting the environment and
putting human health at risk. The behaviour of the software embedded in these
cars was intended by the manufacturer, but it was not in the interest of
society, a phenomenon that has been called software doping. Doped software is
significantly different from buggy or insecure software and hence it is not
possible to use classical verification and testing techniques to discover and
mitigate software doping.
  The work presented in this paper builds on existing definitions of software
doping and lays the theoretical foundations for conducting software doping
tests, so as to enable attacking evil manufacturers. The complex nature of
software doping makes it very hard to effectuate doping tests in practice. We
explain the biggest challenges and provide efficient solutions to realise
doping tests despite this complexity.
