36

Compiler The choice of a compiler has minimal effects on the difficulty to reverse engineer your code. The important things to minimize are all related to information leaks from your code. You want to at least disable any runtime type information (RTTI). The leakage of type information and the simplicity of the instruction set of the virtual machine is one ...


29

There is some academic research in this area, the keywords you want are 'toolchain provenance'. There was a pretty good paper by Nate Rosenblum on this topic, it's been a while since I read this paper but you can use many techniques to establish this information. I think some use machine learning and others can use a big pile of heuristics or axioms about ...


15

Again the file(1) utility and libmagic(3), on which it is based, can be your friend: $ file Gwan.class Gwan.class: compiled Java class data, version 50.0 (Java 1.6)


15

The Windows kernel, unlike Linux or OS X, does not use consistent syscall numbering across versions. The numbers can change even after a servicepack release. For example, the NtReadFile syscall was 0x0086 on Windows NT 4 but on Windows 7 it's 0x0111 (see here for the full list). That's why all proper programs use the kernel32.dll (or ntdll.dll) to perform ...


14

Let me start by telling you that what you want would be impossible, because of how well-known DLLs work. You can attempt something similar with tools like PEBundle or dllpackager, but that will usually (I'd say certainly) fail with the well-known DLLs (such as system DLLs as well as even the MSVC runtime DLLs in their different incarnations). See this and ...


10

When looking at Machine code there typically is a "trail" that can be followed unless the produced binary was some how scrubbed. For example I generated a small "hello world" application using GCC on my Linux box with the standard options gcc -Wall hello.c now if you take a tool like hexedit you can see in the machine code there is a section containing build ...


10

It is customary for read-only data of all kinds to be lumped into .rdata. However, that's a matter of expedience, not necessity. Compiler and linker can put any data anywhere they like, as long as it is referenced correctly in the data directory. The first point of call should be Microsoft's PE COFF specification (currently v8.3). Remarks and pointers ...


9

There was a presentation at Recon titled "Packer Genetics: The Selfish Code" that described one approach for this. They used some statistics to extract the most common code sequences from compiled programs and used it to detect the end of unpacking, but the approach can be used easily to identify specific compilers. See from slide 15 here: http://blog....


8

My answer here is specific to common C/C++ compilers, but the principles behind the answer generalize to other scenarios. Compiler differences manifest themselves in many ways, some of them very subtle. If it was strictly a matter of attributes in the executable header, then we could easily imagine rewriting said header. However, each compiler has its own ...


7

I guess the first thing you should do to determine the compiler version unless you literally mean the compiler version instead of linker version, is inspect the "MajorLinkerVersion" and "MinorLinkerVersion" fields of the PE header of the executable, be it EXE, DLL, or SYS. See list below. Major Minor 0x5 0x0 (5.0) Borland C++ / ...


7

Does knowing the compiler used to generate an application help me to more effectively reverse engineer back from the generated object to what the source code might have been, and if it does help, how so? I consider the knowing used compiler as a very important step because of the following reasons: It helps you select the proper tool(s) to analyze the ...


7

You cannot prevent reverse engineering. You can make it more or less harder but you cannot prevent it. No. Update Ok, as the author updated it with a more clearer question... this is what one can do: Strip symbols from the binaries. At the very least. Obfuscate the code. This may help: https://stackoverflow.com/questions/4111808/c-c-compiler-generating-...


7

You may want to read up on assembly before attempting to reverse engineer. esi and edi are pushed on the stack because the compiler thought this routine modifies them. (It is wrong because only edi is used. Still, better safe than sorry.) mov eax,0cccccccch moves the value 0CCCCCCCCh into register eax. Which is actually kind of self-explanatory. That ...


6

Answering my own question so it's not marked as being opened. @DCoder's comment of using isAlign(idaapi.getFlags(ScreenEA())) is correct. .text:0040117B .text:0040117B locret_40117B: ; CODE XREF: sub_401160+Dj .text:0040117B retn .text:0040117B sub_401160 endp .text:0040117B .text:0040117B ; --------------------...


6

The following code compiles just fine for me as a .cpp file in Visual C++: int (__thiscall *off_401F14)(void *, char); // weak int main(int argc, wchar_t* argv[]) { return 0; } Perhaps you placed the function prototype inside of a function by accident or compiled it as C (file extension .c) file?


6

I've arrived at a solution by researching an answer for one of my Keychain subquestions. https://stackoverflow.com/questions/25109994/non-extractable-private-key-in-keychain-on-os-x. According to SecItem.h, this kSecAttrIsExtractable has been introduced with OS X 10.6. http://opensource.apple.com/source/Security/Security-55471.14/libsecurity_keychain/lib/...


5

There are a number of options: C# code can be compiled to native code (like C++ compilation) using Ngen.exe or .NET Native. Although the IL code and metadata might still be required by the runtime. All kinds of information that is contained in an assembly such as type names, variable names, method names, strings, and constants can be obfuscated. This makes ...


5

Trying to provide a more general answer that would hopefully complement this answer linked in the comments. To those who are unsure, the .rodata section in an executable contains all read-only variables and constants with a global scope (i.e. will be defined for the entire duration of the program's execution) although the lines are becoming a little blurry ...


4

To answer your first question: No, I don't think there are any compiler options for popular compilers that allow you to keep it from adding its compiler artifacts. Part of the problem in this is explored by @Syzygy's answer: compilers generate, sometimes, very different instructions. More than this though, knowing the artifacts left behind by different ...


4

Many of the previous answers have noted that this is impossible because the compiler will always leave artifacts behind. I decided to do a little case study using a program on Linux, although the idea is transferable. For example, I created a small "Hello World!" file in C: #include <stdio.h> int main(void) { puts("Hello World!"); return 0; }...


4

Does knowing the compiler used to generate an application help me to more effectively reverse engineer back from the generated object to what the source code might have been, and if it does help, how so? Yes, it should help. Even better: the exact compiler version; the exact command line parameters; the build environment (OS, patch level, ...). The idea ...


4

As for C compiler (gcc), first make sure you do not make a mistake of compiling it with -g option (adds symbols for debugging, basically whole source code). -g Produce debugging information in the operating system's native format Secondly, try with -s option: -s Remove all symbol table and relocation information from the executable. Without ...


4

DCoder already referenced his own answer in a comment. The chunks in the control flow graph are usually referred to as basic blocks or extended basic blocks. The reason why they are being reordered has to with optimizations performed by the compiler. There are several terms for what you are asking about: function chunking basic block reordering partition ...


4

Very often functions like this will be listed within a vtable. This is where, within a language like C++, class objects can inherit functions and variables from other class objects. If class A, the parent class, implements a function getCount, class B can inherit from this class and change the return value of that function. Very often, developers will ...


4

The flags are constants drawn from here: https://github.com/torvalds/linux/blob/master/tools/include/uapi/asm-generic/fcntl.h They can change but very rarely. Applying this we can see that 0x241 == O_WRONLY | O_CREAT | O_TRUNC


3

Soot can give you a Jimple IR of an apk and inject instrumentation into it. It's not dynamic though, although I don't see why it couldn't be used for data dependency analysis. Unless your target app does weird things with reflection or JNI you should still be able to perform the analysis you want. There's a tutorial on using Soot with Dalvik executables ...


3

Normally the linker will leave the functions in their original order. However, techniques like Working-Set Tuning (see also Profile-Guided Optimization) can profile the program to see which parts are called the most often, then re-link it with that information in mind. This will clump the most frequently used code together (not only reordering functions, ...


3

The idea of truly protecting resources is impossible -- every protection you implement can and will be broken. Assume this, and do not put credentials or private data in your resources/code. The idea behind resource encryption/compression is summarized well in this codeproject article, the same ideas apply to .NET. You use some encryption method, add the ...


3

If you just talk about the machine code (or Assembly code), there isn't much information. Most modern compilers will produce similar output or the output won't be enough to see differences. One thing that may give indication is compiler optimization, which I am not experienced with and someone else should chime in. If you do have the entire ELF file though, ...


Only top voted, non community-wiki answers of a minimum length are eligible