Is it possible to determine if a binary (static or shared and not stripped) is compiled with Linuxthreads or NPTL implementation ?
There are many ways, but I'll cite two. Usually, a binary file, if not stripped, contains symbols (function names, variable names, ...). These symbols are usually used to ease debugging and are stored using a certain format, DWARF for example.
The first method is to disassemble the binary and look for specific threading libraries related symbols. For example :
objdump -D ./YOUR_PROGRAM | grep -i thread
The second one is to hijack the threading library function calls using your own library and LD_PRELOAD. The concept is fairly simple, you write a library (.so) in which you implement the functions which you want to check for, let's say pthread_create or pthread_join, and reimplement it this way :
int pthread_create(pthread_t *thread,
const pthread_attr_t *attr,
void *(*start_routine) (void *),
void *arg)
{
int ret;
static void *(*ext_pthread_create)(pthread *,
const pthread_attr_t *,
void *,
void *);
ext_pthread_create = dlsym("RTLD_NEXT", pthread_create);
ret = ext_pthread_create(thread, attr, start_routine, arg);
printf("pthread_create called !\n");
return ret;
}
All you have to do after compiling and testing your library is call yor program this way :
LD_PRELOAD=hooklib.so ./YOUR_PROGRAM PARAMS
If the function is called, you'll see the printf message on the standard output.
-
If I cannot execute the binary since it is different architecture objdump -D ./YOUR_PROGRAM | grep -i thread is the only way ? What can I expect as output depending on implementation used ? – user3155036 Jun 19 '14 at 4:56
-
Yes, the
objdump
way will work ... but it's not very classy though. One, it necessitates a non stripped binary, and two you need to check for all threading library symbols (Pthread, OpenMP, Boost, ...). I believe the hook mechanism is much classier, but of course it requires a lot more code and the ability to run he binary (which can be done either by using a virtual machine, an emulator, ...). Honestly, most of the ways I have in mind need the binary to be run. The only static approach I can think of now is thegrep
one. – yaspr Jun 19 '14 at 7:07 -
So what strings to look for to find out implementation? I tried one unstripped file and got lots of things with pthread which does not indicate neccesarily anything ? – user3155036 Jun 19 '14 at 7:41
-
Well, you should look for function names that create threads :
pthread_create
&pthread_join
if it's the Pthread library. Ifgrep
finds something, well, you hit the jackpot. If grep outputs nothing, then there's no Pthreads calls. Note : you should research the other threading libraries in case & also test theclone()
syscall. – yaspr Jun 19 '14 at 8:54 -
You might have misunderstood my question maybe. I was not asking to determine if software is written with threading . But determine which thread implementation. Linuxthreads or NPTL which are similar but different things. – user3155036 Jun 20 '14 at 0:25