How tools like PEiD find out the compiler and its version.

Question

How tools like PEiD and CFF explorer find out the compiler and its version.

I am analyzing a executable file. Which shows: Borland Delphi 3.0

But the section names .text .rsrc. Which is usually not get generated by Borland Delphi compiler.

I guess the file version info is modified.

But how these tools find out the compiler version ??

Answer 1

The signature database of many Compiler and Packer detectors, and sometimes even their source-code, is freely available and you can actually read the signatures in clear-text.

Genrally, the detector performs very naive checks to detect the compiler/linker/protector/etc which based on a preset mask of bytes. The mask is combined from a sequence of bytes and wildcards that usually represents a magic number, a piece of code or a string that gives information about the file.

To understand it better let's look at different detections to Borland 3.0 by different detectors.

PEiD:

[Borland Delphi v3.0]
signature = 50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3 55 8B EC 33 C0
ep_only = true

In order to detect Borland Delphi v3.0, PEiD is searching for this sequence of bytes in the entry point of the binary. The '??' are wildcards used to ignore the bytes in these locations because they might not be the same in different binaries.

You can find the databse of PEiD here.

CFF Explorer:

<ENTRY>
    <NAME>Borland Delphi v3.0</NAME>
    <COMMENTS />
    <ENTRYPOINT>506A??E8????FFFFBA????????528905????????894204E8????????5A58E8????????C3558BEC33C0</ENTRYPOINT>
    <ENTIREPE />
</ENTRY>

Although the format of the signature might look different then PEiD's, it is actually the same mask as in the previous example.

You can usually find the signatures database of CFF explorer in the following path C:\Users\Public\Documents\Explorer Suite\Signatures\IMAGE_FILE_MACHINE_I386.xml or in /Signatures/IMAGE_FILE_MACHINE_I386.xml although it may be different in your installation. You can also find it online here. Read this PDF for more technical information about the signatures and how the used in CFF Explorer.

Detect It Easy:

Detect It Easy is more complex, rich and accurate detector (in my opinion) which uses "scripts" to detect the type of the program. The detection algorithm of DIE is more complex then the others and doesn't use only byte-mask to detect the Compiler/Linker/Packer/etc.
You can see how DIE detects Borland Delphi in the following signature.

The signature of Borland Delphi is too long so I'll show here another example of a signature, the signature of NTKrnl Protector:

// DIE's signature file

init("protector","NTkrnl Protector");

function detect(bShowType,bShowVersion,bShowOptions)
{
    if(PE.compareEP("68........e8")&&(PE.nLastSection>=1))
    {
        if(PE.getNumberOfImports()==1)
        {
            if(PE.getNumberOfImportThunks(0)==2)
            {
                if((PE.getImportFunctionName(0,0)=="LoadLibraryA")&&(PE.getImportFunctionName(0,1)=="GetProcAddress"))
                {
                    if(PE.isSignatureInSectionPresent(1,"'http://www.ntcore.com  '"))
                    {
                        sVersion="0.1";
                        bDetected=1;
                    }
                    else if(PE.isSignatureInSectionPresent(1,"'http://www.ntkrnl.com'"))
                    {
                        sVersion="0.15";
                        bDetected=1;
                    }
                    /* if(bDetected)
                    {
                        var nFind=PE.findString(PE.section[1].FileOffset,PE.section[1].FileSize,"Version ");
                        if(nFind!=-1)
                        {
                            sVersion=PE.getString(nFind,20);
                            var aVersion=sVersion.match(/Version ?(.*?) /);
                            sVersion=aVersion[1];
                        }
                    } */
                }

            }
        }
    }
    /*if(PE.compareEP("68........e8........c3")&&(PE.compareEP("68########60e8$$$$$$$$5d4555c3")))
    {
        bDetected=1;
    } */

    return result(bShowType,bShowVersion,bShowOptions);
}

You can read more about Detect it Easy in its Github repository.

---

Remember that most of the times the bytes in the binary which represent the type of the file can be replaced without harming the functionality of the program. There are even many programs like GcPH, PseudoSigner and DotFix FakeSigner that try to fool Packer Detectors like the mentioned above. Some of the detectors might actually detect some of these anti-detectors in what seems like cat and mouse game.

Here's an example of how PEiD detects PseudoSigner for Delphi 3.0:

[PseudoSigner 0.1 [Borland Delphi 3.0]
signature = 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true