How to understand if exe/dll is written in C++/.Net/Java or in any other language. I tried to use Dependency walker but not able to get required information.
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
(reposting my SO answer to a similar question)
In many cases it is possible to identify the compiler used to compile the code, and from that, the original language.
Most language implementations include some kind of runtime library to implement various high-level operations of the language. For example, C has the CRT which implements file I/O operations (
IDA implements this approach in the FLIRT technology. By using the signatures, IDA is able to determine most of the major compilers for DOS and Windows. It's somewhat more difficult on Linux because there's no single provider of compiler binaries for it, so signatures would have to be made for every distro.
However, even without resorting to the runtime library code, it may be possible to identify the compiler used. Many compilers use very distinct idioms to represent various operations. For example, I was able to guess that the compiler used for the Duqu virus was Visual C++, which was later confirmed.
Marco Pontello's TrID software can usually identify what was used to compile a file.
Java bytecode files can be identified by their magic number:
However, @hexafraction warns in a comment: "Java classfiles would not have their magic number or file extension visible when packed into a .exe PE, except if they were unpacked (assuming that they're just packed in the first place, and not recompiled to machine code)"
You can detect a .net assembly by looking at the PE headers. Read the CLR spec and the PE/COFFEE spec for details.
Java uses it's own class file format. I'm not too familiar with it, but it should be possible to positively id a class file.
Native language development is mostly about heuristics. Things like calling conventions, prologues, epilogues, etc. A recursive descent disassembled, plus an idiom recognizer can likely id the source compiler. GCC and class generate very distinctive code, for example.
protectionid (pid.gamecopyworld.com) reports the compiler info (turn it on in the configuration)
to do it, its a multitide of things
checking for byte patterns
checking imports (mscoree.dll, msvcr*.dll and so on)
checking entrypoint code
checking mz stub
checking linker version
and a few other things
Scanning -> C:\ProtectionID.source\problematic.files\solved\detected\Agile.NET 220.127.116.11.AgileNETUnpackMe\AgileUnpackMe.exe
File Type : 32-Bit Exe (Subsystem : Win GUI / 2), Size : 7680 (01E00h) Byte(s)
[File Heuristics] -> Flag : 00000100000001001101000000110000 (0x0404D030)
[Entrypoint Section Entropy] : 5.25 (section #0) ".text " | Size : 0x1288 (4744) byte(s)
[DllCharacteristics] -> Flag : (0x8540) -> ASLR | DEP | NOSEH | TSA
[ImpHash] -> f34d5f2d4577ed6d9ceec516c1f5a744
[SectionCount] 3 (0x3) | ImageSize 0x8000 (32768) byte(s)
[VersionInfo] Product Name : AgileUnpackMe
[VersionInfo] Product Version : 1.0.4999.25574
[VersionInfo] File Description : AgileUnpackMe
[VersionInfo] File Version : 1.0.4999.25574
[VersionInfo] Original FileName : AgileUnpackMe.exe
[VersionInfo] Internal Name : AgileUnpackMe.exe
[VersionInfo] Legal Copyrights : Copyright 2013
[Debug Info] (record 1 of 1) (file offset 0x1414)
Characteristics : 0x0 | TimeDateStamp : 0x522C69AD | MajorVer : 0 / MinorVer : 0 -> (0.0)
Type : 2 (0x2) -> CodeView | Size : 0x57 (87)
AddressOfRawData : 0x3230 | PointerToRawData : 0x1430
CvSig : 0x53445352 | SigGuid A75CE0F5-0D67-4FC4-A2C612B95C81F742
Age : 0x6 | Pdb : c:\AgileUnpackMe\AgileUnpackMe\obj\x86\Debug\AgileUnpackMe.pdb
[!] AgileDotNet detected
[CompilerDetect] -> .NET
[.] .Net Info -> v 2.5 | x86 managed (/platform:x86) | Flags : 0x00000003 -> COMIMAGE_FLAGS_ILONLY | COMIMAGE_FLAGS_32BITREQUIRED |
[.] Entrypoint (Token) : 0x06000006
[.] MetaData RVA : 0x00002184 | Size : 0x00000C0C (3084)
[.] MetaData->Version 1.1 -> v2.0.50727
[.] Flags : 0x0 | Streams : 0x5 (5)
protected by AsheeshR Jan 11 '14 at 6:03
Thank you for your interest in this question.
Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).
Would you like to answer one of these unanswered questions instead?