How to detect internal and shared libraries used in an executable file?

Question

Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. Also, we would like to be able to tell what shared libraries it is using on the host system.

What we have done so far: we used strings2 to look at UNICODE and ASCII strings in the executable. Manual analysis of these strings may provide library versions being used internally some times. As you can imagine, this is an inefficient method and not very reliable. We also looked at 'Dependency Walker' to build a tree of all dependencies. This doesn't allow us to know if outdated libraries are being used internally though. We also read two research papers around the subject:

• An automated classification system based on the strings of trojan and virus families, by Tian, Batten, Islam and Versteeg, MALWARE 2009.
• Automatic Library Version Identification, an Exploration of Techniques, by Thomas Rinsma, 2017.

Question: Is there a better way or an approach to be able to determine if an executable is using outdated libraries internally? For example, looking at strings is one possible way but is there a way to automate this? Because otherwise, looking at 1000s of lines of ASCII and UNICODE strings can get time consuming.

Answer 1

I can see two paths for moving forward.

First, following your current approach, you can probably detect version information and library automatically in the strings you find. This is not a bulletproof solution but will save you the time of manually reading thousands of strings.

Go through the task of creating FLIRT, or one of the many function level binary diffing tools out there with different versions of various libraries.