I am learning more about binary exploitation on windows. But I saw while revering a binary that you can create static binaries in windows too just like in Linux. It was really ugly. if I would be on Linux, I could just use the file command to know if it is dynamic or static. but now I am in windows and do I have some way to know if the binary is static before reversing it.

  • You can see the imported libraries and functions via dumpbin /imports filename (dumpbin is included e.g. in Visual Studio Community edition). If the imports only contain Windows system DLLs you can consider the executable as static. – Robert Sep 19 '20 at 11:29
  • @luckythandel you need to be more specific. What do you consider statically linked on Windows? Using the terminology in MSVC it would be binaries using only system-DLLs or well-known DLLs (which includes msvcrt.dll, something compatible to the original MSVC6 runtime). The thing is that a purely statically linked binary as mentioned in Igor's answer should not even work, because to the best of my knowledge anything running in the Win32 subsystem depends on initialization done by importing at the very least kernel32.dll. Or do you mean native executables? Then Igor's answer stands. – 0xC0000022L Sep 19 '20 at 20:21

Unlike Linux, syscall numbers can and do change between Windows versions, so any program using raw syscalls would not run properly on a different OS release. The only officially supported API is provided by the system DLLs such as kernel32.dll, user32.dll and so on. So while fully static Windows binaries are possible, they are not practical and so are very rare.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.