-1

I have several questions regarding reverse engineering of executable binaries (compiled machine code). Some of my questions are specific, other more open ended. In this thread I will only ask the specific questions. I will be thankful to anyone who helps me out.

1) are the identifiers (procedure names, variable names, object names, etc.) somehow preserved in compiled machine code? If not, would reverse engineered code have identifiers which look something like var001, var002, proc001, proc002, etc? As a side note, I remember reading in an article that some security experts reverse engineered a trojan and found out that it had been written by someone whose language was Mandarin Chinese. Now I am wondering, could it be that the programmer used variable/procedure/object names in Mandarin Chinese and these were preserved in the machine code? Or how else could the researchers tell?

2) are comments totally ignored during the compiling process? Or, again, could some comment text end up in the machine code?

3) when researchers find that a virus contains some signature intentionally left by its creator, do they mean humanly readable plaintext that can be seen with and hex editor? Or what else?

4) what compiled programming languages produce the most obfuscated (i.e. hard to reverse engineer) executables? Even more in detail, how does (Object)Pascal compare to C in this regard?

  • Please ask only one question per post. – Jason Geffner Feb 9 '16 at 21:19
1

While your questions are pretty broad, I'll try my best to answer.

Are the identifiers (procedure names, variable names, object names, etc.) somehow preserved in compiled machine code?

As far as I know this depends on many factors, including the original code language (e.g. C and .NET), compiler settings (include debug information or not), target platform. I would suggest looking into debug symbols, and PDB files.

For example, applications written in .NET framework will contain a lot of meta information all over the place (in the binary, and PDB files, generated XML docs..) by default, and most of the time it is possible to restore the original source code from the binary if it's not obfuscated.

On the other hand, you will have a really hard time doing the same with an application written in C, compiled without debug info, as the meta information is simply not there. For the most part it's only machine code.

If not, would reverse engineered code have identifiers which look something like var001, var002, proc001, proc002, etc?

See the answer above, but generally the compiled binary does not include variable and function names. String values however will be included in the binary, which can be read (if not hidden in some way explicitly by the author).

As a side note, I remember reading in an article that some security experts reverse engineered a trojan and found out that it had been written by someone whose language was Mandarin Chinese. Now I am wondering, could it be that the programmer used variable/procedure/object names in Mandarin Chinese and these were preserved in the machine code? Or how else could the researchers tell?

Without knowing the context of this story, I can only guess that the trojan author left strings in there in Chinese Mandarin. But people who usually write trojans do not want such information included, so it might be left there to mislead the researchers.

are comments totally ignored during the compiling process? Or, again, could some comment text end up in the machine code?

Yes, comments are simply ignored by the compiler, and not included in the compiled binary.

I skipped your other questions as they were too broad to answer, I suggest you to make separate questions with more details.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.