Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. Also, we would like to be able to tell what shared libraries it is using on the host system.
What we have done so far: we used
strings2 to look at UNICODE and ASCII strings in the executable. Manual analysis of these strings may provide library versions being used internally some times. As you can imagine, this is an inefficient method and not very reliable. We also looked at 'Dependency Walker' to build a tree of all dependencies. This doesn't allow us to know if outdated libraries are being used internally though. We also read two research papers around the subject:
- An automated classification system based on the strings of trojan and virus families, by Tian, Batten, Islam and Versteeg, MALWARE 2009.
- Automatic Library Version Identification, an Exploration of Techniques, by Thomas Rinsma, 2017.
Question: Is there a better way or an approach to be able to determine if an executable is using outdated libraries internally? For example, looking at strings is one possible way but is there a way to automate this? Because otherwise, looking at 1000s of lines of ASCII and UNICODE strings can get time consuming.