Is it possible to determine if a binary (static or shared and not stripped) is compiled with Linuxthreads or NPTL implementation ?

  • Sorry for the half published message ... I don't know what happened but the rest of it was cut and I noticed it later ...
    – yaspr
    Jun 18 '14 at 19:43

There are many ways, but I'll cite two. Usually, a binary file, if not stripped, contains symbols (function names, variable names, ...). These symbols are usually used to ease debugging and are stored using a certain format, DWARF for example.

The first method is to disassemble the binary and look for specific threading libraries related symbols. For example :

    objdump -D ./YOUR_PROGRAM | grep -i thread 

The second one is to hijack the threading library function calls using your own library and LD_PRELOAD. The concept is fairly simple, you write a library (.so) in which you implement the functions which you want to check for, let's say pthread_create or pthread_join, and reimplement it this way :

    int pthread_create(pthread_t *thread, 
                       const pthread_attr_t *attr,
                       void *(*start_routine) (void *), 
                       void *arg)
          int ret;
          static void *(*ext_pthread_create)(pthread *, 
                                             const pthread_attr_t *,
                                             void *,
                                             void *);

          ext_pthread_create = dlsym("RTLD_NEXT", pthread_create);
          ret = ext_pthread_create(thread, attr, start_routine, arg);

          printf("pthread_create called !\n");

          return ret;

All you have to do after compiling and testing your library is call yor program this way :


If the function is called, you'll see the printf message on the standard output.

  • If I cannot execute the binary since it is different architecture objdump -D ./YOUR_PROGRAM | grep -i thread is the only way ? What can I expect as output depending on implementation used ? Jun 19 '14 at 4:56
  • Yes, the objdump way will work ... but it's not very classy though. One, it necessitates a non stripped binary, and two you need to check for all threading library symbols (Pthread, OpenMP, Boost, ...). I believe the hook mechanism is much classier, but of course it requires a lot more code and the ability to run he binary (which can be done either by using a virtual machine, an emulator, ...). Honestly, most of the ways I have in mind need the binary to be run. The only static approach I can think of now is the grep one.
    – yaspr
    Jun 19 '14 at 7:07
  • So what strings to look for to find out implementation? I tried one unstripped file and got lots of things with pthread which does not indicate neccesarily anything ? Jun 19 '14 at 7:41
  • Well, you should look for function names that create threads : pthread_create & pthread_join if it's the Pthread library. If grep finds something, well, you hit the jackpot. If grep outputs nothing, then there's no Pthreads calls. Note : you should research the other threading libraries in case & also test the clone() syscall.
    – yaspr
    Jun 19 '14 at 8:54
  • You might have misunderstood my question maybe. I was not asking to determine if software is written with threading . But determine which thread implementation. Linuxthreads or NPTL which are similar but different things. Jun 20 '14 at 0:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.