Position-independent code dectection

Question

Is it possible to detect whether a given executable is a PIC by looking at the disassembler's output? If not, what are other valid ways to go about this?

Answer 1

Detection by analysing assembly

It will highly depend on the compiler used, but here are some constructions that will differ between position independent and position dependent code:

• if you spot a jmp to an absolute address, that will mean that it is PDC (only jumps relative to RIP will be used in PIC)
• when some data is referenced by absolute address, it is PDC
• as @Johann Aydinbas noticed, when you see patterns like cal $+, pop or call xxx, pop to push some absolute address onto the stack, it will likely be PIC

Detection by opening with debugger

You may also take advantage of the fact, that when you load position independent program and check address of some function, main for example, it will change each time you load it (because of ASLR). The same won't be true for PDC - all addresses will remain the same.

Detection by reading the ELF header

Why making your job hard analysing the executable, while it provides explicitly the information you need. As you noted in the comment, ET_EXEC value of e_type will be present in PDC, while ET_DYN will appear in PIC. And, according to the second answer to this question, this is the information used to determine whether ASLR may be used, in Linux.

Other methods

You may of course use other tools for this purpose, like file or readelf for instance.