Is there a tool to scan for code / functions that can account for different compilers?

Question

I have a library DLL and a program that uses the library (statically; the DLL is separate).

My goal is to find a bunch of the functions from the library in the program, but unfortunately, it looks like they were compiled with a different compiler / very different options, making hex scans unsuccessful. Those that I have found via strings / order are different in that the program has a push/pop ebp shell, often uses different registers, and sometimes uses different opcodes, but they accomplish the same thing in the end.

Are there any tools / techniques that could assist me with finding some of the other functions? In the DLL, of course, the functions are, for the most part, right next to each other, but in the program they are mixed, making it hard to find any functions that don't contain strings.

Answer 1

There are several tools that achieve this.

IDA

First, IDA has mechanisms to identify compiler (and compiler properties). That's not a main feature but might provide what you are looking for. Options -> Compiler... will open a dialog allowing you to manually set compiler related properties as well as use preconfigured defaults for certain widely used compilers.

If IDA identified the compiler being used, those values will be populated accordingly when the dialog is opened.

Here's a screenshot:

PEiD

PEiD is one of the most widely known and used packer detection tools. It has multiple plugins and additional downloadable signatures. One of the features it (as many packer detectors) has is compiler identification.

Detect It Easy

Detect It Easy (AKA DiE) is another very advanced packer detection with very good compiler detection signatures and algorithms. While PEiD felt a bit abandoned, DiE still gets developer attention.

Language 2000

Unlike other tools mentioned here, Language 2000 is an old (but functional) tool built specifically for compiler detection. I've never used it but it is supposed to be good.

Other packer detectors

Most packer detection tools have at least some kind of compiler detection capabilities, so I'm also including a list of packer detection tools.

Answer 2

I think Sibyl could help you.

It is a function divination tool. The idea is to identify the side effects of functions. That way, identification is independent of the used implementation.