2

Basically I have a set of 32-bit ELF program binaries compiled by either gcc or llvm. They are all stripped before analysis.

My question is that, given a binary, is there any way I can determine whether it is compiled by gcc or llvm? Is there any available tool to do so?

2
  • you may be able to guess based on the way some common constructs are compiled and optimizations that did or didn't happen Jan 19, 2016 at 17:24
  • 1
    I am curious why was this question downvoted?
    – robert
    Jan 20, 2016 at 4:26

1 Answer 1

2

I am no expert in the matter but I would try:

  1. see exported functions names

    if mangling is present you can use it for compiler detection. Just make a list of exported function names and compare to known mangling schemes (for example from the table in linked wiki page)

  2. examine linked DLL's

    you can detect well known RTL's by the filenames.

  3. Also you can try to find language/compiler engine

    each version of each compiler of modern programing languages need to have its engine. It is part of code that is responsible for things like stack, variables, control flow etc and is always the same for each compiled program with the same compiler version.

    So create simple hello world apps in each compiler you can found and extract the engine binary. then simply search unknown binary and test if supported engine is present or not.

The first two bullets are more for PE (not sure if elf has the same info) and there are tools for such inspection (like PE/DLL explorers so for elf there should be something similar).

1
  • I know that Mach-O does have the same info as your first two points, you can see what version of .SO files are being requested, and also analyze name mangling, GCC and Clang for example are very different in their mangling scheme, and both can make Mach-O binaries, thus you can at least know if it is GCC or Clang, even if you can't figure a specific version.
    – speeder
    Jan 20, 2016 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.