1

I am trying to recreate a binary file from an analysis of "strings" output. I don't recognize which compiler was used for this file. It does not seem to be shc. Does anyone recognize this output pattern from a known compiler?

strings *omitted*
/lib/ld-linux.so.2
libc.so.6
_IO_stdin_used
puts
setreuid
printf
getchar
system
geteuid
strcmp
__libc_start_main
__gmon_start__
GLIBC_2.0
PTRhp
QVh;
secrf
love
UWVS
t$,U
[^_]

I can include the rest of the output. Edit: the scripting language is likely dash

3

Looks like strings from the first few sections of a Linux ELF32 binary created using the GCC toolchain. I can't tell you which version of GCC though.

Your question should include the output of the following commands:

  • file [name of binary]
  • readelf -h [name of binary]
  • readelf -SW [name of binary]
  • objdump -dj .text [name of binary]

strings output on its own is often insufficient for performing compiler toolchain provenance.

You also should include the full output of strings, because sometimes the compiler includes an identifier within the binary:

/lib/ld-linux.so.2
libc.so.6
_IO_stdin_used
printf
__libc_start_main
__gmon_start__
GLIBC_2.0
PTRh
[^_]
;*2$"
GCC: (Ubuntu 4.8.4-2ubuntu1~14.04.4) 4.8.4    <------------------- 
GCC: (Ubuntu 4.8.4-2ubuntu1~14.04.3) 4.8.4
.symtab
.strtab
.shstrtab
.interp
.note.ABI-tag
.note.gnu.build-id
.gnu.hash
.dynsym
.dynstr
.gnu.version
.gnu.version_r
.rel.dyn
.rel.plt
.init
.text
.fini
.rodata
.eh_frame_hdr
.eh_frame
.init_array
.fini_array
.jcr
.dynamic
.got
.got.plt
.data
.bss
.comment
crtstuff.c
__JCR_LIST__
deregister_tm_clones
register_tm_clones
__do_global_dtors_aux
completed.6600
__do_global_dtors_aux_fini_array_entry
frame_dummy
__frame_dummy_init_array_entry
trigger_sigsegv.c
__FRAME_END__
__JCR_END__
__init_array_end
_DYNAMIC
__init_array_start
_GLOBAL_OFFSET_TABLE_
__libc_csu_fini
_ITM_deregisterTMCloneTable
__x86.get_pc_thunk.bx
data_start
printf@@GLIBC_2.0
_edata
_fini
__data_start
__gmon_start__
__dso_handle
_IO_stdin_used
__libc_start_main@@GLIBC_2.0
__libc_csu_init
_end
_start
_fp_hw
__bss_start
main
_Jv_RegisterClasses
__TMC_END__
_ITM_registerTMCloneTable
_init
  • Thanks for the formatting guidance. I found it { strings ./check | grep "GCC" Output: GCC: (Debian 6.3.0-18+deb9u1) 6.3.0 2017051 } – CrippledTable Aug 20 at 6:31
  • @CrippledTable You are welcome – julian Aug 20 at 6:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.