I am learning more about binary exploitation on windows. But I saw while revering a binary that you can create static binaries in windows too just like in Linux. It was really ugly. if I would be on Linux, I could just use the file command to know if it is dynamic or static. but now I am in windows and do I have some way to know if the binary is static before reversing it.
1 Answer
Unlike Linux, syscall numbers can and do change between Windows versions, so any program using raw syscalls would not run properly on a different OS release. The only officially supported API is provided by the system DLLs such as kernel32.dll, user32.dll and so on. So while fully static Windows binaries are possible, they are not practical and so are very rare.
answered Sep 19, 2020 at 13:44
dumpbin /imports filename(dumpbin is included e.g. in Visual Studio Community edition). If the imports only contain Windows system DLLs you can consider the executable as static.msvcrt.dll, something compatible to the original MSVC6 runtime). The thing is that a purely statically linked binary as mentioned in Igor's answer should not even work, because to the best of my knowledge anything running in the Win32 subsystem depends on initialization done by importing at the very leastkernel32.dll. Or do you mean native executables? Then Igor's answer stands.