7

I have an executable file and I would like to figure out which programming language was the source code written in. The first step would be to use a disassembler.

What should be done after that ?

Also, I read that determining which libraries are used during runtime would be a good indicator of the programming language being used. How should I determine which libraries are used ?

9

Actually I would suggest that you view the executeable with a hex viewer/editor. That way you can see straight away if the compiler embedded any strings as hints. You should also consider that some languages use C as an intermediate language. An example of that would be f2c a Fortran 77 to C compliler. It appears that f2c also links a support library so you would look for that.

As far as determinining which libraries are used on linux you can use the ldd command for dynamic binaries and nm for static ones to dump the symbols. Also there is a related question on SO.

Here is an intersting blog from a fellow RE member about how the binary you have might not even come from a compiler and how to recognise that.

  • 1
    Good answer, you'd be surprised how often this low-tech approach works! That aside, even in the f2c case you can probably see spot patterns used by the converter to represent Fortran concepts or convert from Fortran to C conventions. – Igor Skochinsky Mar 25 '13 at 16:25
9

There are several tools that I have used:

  1. PEiD (PE iDentifier)
  2. I've also followed this guide and converted PEiD signatures to YARA signatures and simply used YARA
  3. TRiD can also provide another way to identify the compiler used

It's also worth mentioning that if you submit a file to Virus Total, they will run TRiD against your binary.

These tools are not always definitive, but they can generally give you the correct compiler (and therefore language) that was used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.