2

Is it possible to detect whether a given executable is a PIC by looking at the disassembler's output? If not, what are other valid ways to go about this?

  • What's the basis for the question? As is, it is a bit odd, so maybe if you explain your motivation it's possible to give a more helpful answer. If code is PIC, you usually see some typical patterns like call $+, pop to get the current address, or call xxx, pop to push some address on the stack. – Johann Aydinbas May 25 '18 at 6:21
  • @JohannAydinbas I don't really have a reason... I was just trying to understand the differences between ET_DYN and ET_EXEC(compiled with -fPIC) and that made me wonder whether I could detect this kind of thing – Trey May 25 '18 at 6:25
1

Detection by analysing assembly

It will highly depend on the compiler used, but here are some constructions that will differ between position independent and position dependent code:

  • if you spot a jmp to an absolute address, that will mean that it is PDC (only jumps relative to RIP will be used in PIC)
  • when some data is referenced by absolute address, it is PDC
  • as @Johann Aydinbas noticed, when you see patterns like cal $+, pop or call xxx, pop to push some absolute address onto the stack, it will likely be PIC

Detection by opening with debugger

You may also take advantage of the fact, that when you load position independent program and check address of some function, main for example, it will change each time you load it (because of ASLR). The same won't be true for PDC - all addresses will remain the same.

Detection by reading the ELF header

Why making your job hard analysing the executable, while it provides explicitly the information you need. As you noted in the comment, ET_EXEC value of e_type will be present in PDC, while ET_DYN will appear in PIC. And, according to the second answer to this question, this is the information used to determine whether ASLR may be used, in Linux.

Other methods

You may of course use other tools for this purpose, like file or readelf for instance.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.