Is it possible to detect whether a given executable is a PIC by looking at the disassembler's output? If not, what are other valid ways to go about this?
Detection by analysing assembly
It will highly depend on the compiler used, but here are some constructions that will differ between position independent and position dependent code:
- if you spot a
jmpto an absolute address, that will mean that it is PDC (only jumps relative to
RIPwill be used in PIC)
- when some data is referenced by absolute address, it is PDC
- as @Johann Aydinbas noticed, when you see patterns like
cal $+, popor
call xxx, popto push some absolute address onto the stack, it will likely be PIC
Detection by opening with debugger
You may also take advantage of the fact, that when you load position independent program and check address of some function,
main for example, it will change each time you load it (because of ASLR). The same won't be true for PDC - all addresses will remain the same.
Detection by reading the ELF header
Why making your job hard analysing the executable, while it provides explicitly the information you need. As you noted in the comment,
ET_EXEC value of
e_type will be present in PDC, while
ET_DYN will appear in PIC. And, according to the second answer to this question, this is the information used to determine whether
ASLR may be used, in
You may of course use other tools for this purpose, like
readelf for instance.