42

(reposting my SO answer to a similar question) In many cases it is possible to identify the compiler used to compile the code, and from that, the original language. Most language implementations include some kind of runtime library to implement various high-level operations of the language. For example, C has the CRT which implements file I/O operations (...


25

Executable type is indicated by PE header, download documentation. The first word (two bytes) of PE header indicates target machine, here is a list of possible values: 0x0000 - The contents of this field are assumed to be applicable to any machine type 0x01d3 - Matsushita AM33 0x8664 - x64 0x01c0 - ARM little endian 0x01c4 - ARMv7 (or higher) Thumb mode ...


16

.NET could be identified by import which you can see using dependency warker - check if there is an import of mscorlib.dll which is a core lib of .net framework. C++ can be identified by looking at the assembly - it uses this call convention. PEid can show partial info about what compiler and run-time were used. In general it uses list of signature for ...


12

I assume you want to extract a JAR file wrapped inside a .exe generated by launch4j. Launch4j places the jar file in the overlay of the executable, that is after the PE file. To extract it you can search for the string 'PK' from the bottom of the file to find the JAR archive, you should see something like this : Once you found it, remove all the content ...


11

Marco Pontello's TrID software can usually identify what was used to compile a file.


11

Although blabb's answer shows an executable without any imports, I'm assuming OP was asking about a more functional executable, and not as a theoretical exercise of that level. I can think of four types of reasonable, useable executable file types that may not have any imports: An executable that does not require any OS APIs. This is somewhat similar to ...


9

Assume you have some unknown object file. The source code of it was #include <stdio.h> #include <string.h> #define NCHAR 26 void setkey(int i); char *encrypt(char *s); char keybuf[NCHAR]; char codepoint(char c); int main(void) { char *secret; setkey(5); secret=strdup("Hello World"); printf("%s\n", encrypt(secret)); } void ...


9

The signature database of many Compiler and Packer detectors, and sometimes even their source-code, is freely available and you can actually read the signatures in clear-text. Genrally, the detector performs very naive checks to detect the compiler/linker/protector/etc which based on a preset mask of bytes. The mask is combined from a sequence of bytes ...


8

Delphi uses an object-oriented language based on Pascal, it is similar in many ways to reversing C++. Here are some things specific to Delphi that I found important to know when reversing such applications. Libraries and required functions from the RTL (Delphi Run Time Library) are usually statically compiled in the application binary. This results in ...


8

I can think of a couple of ways of doing that Scanning memory from EIP You could easily get the EIP of your own code without calling any APIs. There are a few ways to achieve that using inline assembly, but the most common one is to include the following two instructions: call $+5 pop eax This works because call will push the next address (where pop eax ...


8

There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose. The way Python works is fully documented and open-source. For instance, consider the pyc file format. Much of the code which deals with reading/writing pyc's ...


7

It's easier to check Optional Header magic number. For a valid exe, only two values are possible: 0x10B => PE32 => 32 bit 0x20B => PE32+ => 64 bit


7

The COM Descriptor Data Directory (DD 14) is used to lookup the COR20 structure. This is how you can tell the difference between a managed executable and a native executable. See this question for more information. Also see this introduction to the dotnet file format for an overview.


7

There are many PE/header dumpers out there but as far as I know none is suitable for vetting an image; their goal is usually the extraction and display of information, not validation. The best approach would be to write a small program or script in your favourite Swiss Army Knife language for validating the integrity of your output image, with a focus on ...


7

This is a hex dump of your sample file: 00000000 1F DA 51 A0 19 5A 52 A0 19 DA 52 A0 28 5A 53 A0 ..Q..ZR...R.(ZS. 00000010 28 DA 53 A0 24 5A 54 A0 1A DA 54 A0 2A 5A 55 A0 (.S.$ZT...T.*ZU. 00000020 26 DA 55 A0 26 5A 56 A0 08 DA 56 A0 47 5A 57 A0 &.U.&ZV...V.GZW. 00000030 35 DA 57 A0 32 5A 58 A0 3B DA 58 A0 5.W.2ZX.;.X. As you ...


7

The address of sub_1313cba4 is moved to PC/IP but not directly, as this cannot be done. It is done by pushing the address to the stack and relying on the fact that retn will get what's on the top of the stack and redirect the execution there. Well, it depends on what you mean by damaging the stack. The stack is just a place in memory and the damage can only ...


6

Windows applications (.exe) generally use file format called "Portable Executable" (PE). The "files" that you extracted are actually sections of that PE file (see Common Sections in Peering Inside the PE: A Tour of the Win32 Portable Executable File Format). The code of the application is in the .text section, the .text file that you have actually contains ...


6

libbfd is not a magic wand, it is in fact pretty limited (it's one of the reasons why GDB cannot debug files without a section table). In particular, objcopy won't add PHT entries for you, so you will have to extend or adjust the PHT manually. You can either do it manually with a hex editor or try using a library such as libelf (it gives you necessary ...


6

void main (void) { __asm { retn } } compiled and linked using cl /nologo /W4 /Ox /analyze noimpo.cpp /link /DEBUG:NONE /RELEASE /ENTRY:main /INCREMENTAL:NO /FIXED /SUBSYSTEM:windows /ALIGN:128 /DRIVER will create a working PE file **edit ** // win 7 sp1 32 bit machine and ewdk 1703 cl.exe unsigned long long time = ...


6

Firstly, we need to understand what is RCDATA resource. This is how it described in MSDN: RCDATA defines a raw data resource for an application. Raw data resources permit the inclusion of binary data directly in the executable file. nameID RCDATA [optional-statements] {raw-data ...} raw-data Raw data consisting of one or more integers ...


5

I was really checking on it and it seems there is a really easy way to do this. PROGRAM USED : jd-gui STEPS Extract the exe file using any archive manager (eg:WinRar) Now use this program (jd-gui) to decompile it. You are done and now you have the code in native java form


5

I can only definitely recognize code sections by looking if the IMAGE_SCN_MEM_EXECUTE flag is set, as other sections should not have this flag set. The presence of this flag doesn't "definitely" mean that that section contains code, and the absence of this flag doesn't "definitely" mean that that section doesn't contain code: A PE file can have that ...


5

Principally: Yes. But: it's not practically. You could change the machine-code within the .exe, but that's not really practically if you want to change the interface/presentation. Also you would need to do it at least in assembly language. If you want to improve the software, I think, the best would be to contact the developer and ask if you can help him to ...


5

The standard scheme for 32-bit x86 under Windows is that the compiler/linker inserts virtual addresses right into the code, which are calculated based on the preferred load address of the executable (usually 0x400000 for EXEn, and something like 0x10000000 for DLLs). If the executable can be loaded at its preferred address then everything can remain as is ...


5

Following OP's other questions, assuming Windows OS This can be achieved with many 3rd-party solutions for Windows, choose the one which fits best to your needs: Proxifier Proxifier allows network applications that do not support working through proxy servers to operate through a SOCKS or HTTPS proxy and chains. https://www.proxifier.com/ ...


5

Sections are aligned so the next section doesn't automatically start at the end of the current section. Sections on disk and memory have different alignments. Sections on disk are usually aligned by 512 bytes which is the traditional size of a disk sector (stored in IMAGE_OPTIONAL_HEADER.FileAlignment). In memory, they are usually page aligned (stored in ...


5

While not a definitive way of determining if GCC OR MSVC (Visual Studio) was used, the presence of the Rich header does determine whether Microsoft's link.exe (MS VC Toolset's linker) was used. (Note: Newer Visual Studio also supports building with clang) I get that it's officially undocumented, but it's arguably the most publicly well-known and documented ...


5

If you use Visual C++, you can use the special symbol __ImageBase which points to image base of the current module. For example, here's code from VS2010 CRT source (pesect.c): BOOL __cdecl _IsNonwritableInCurrentImage( PBYTE pTarget ) { PBYTE pImageBase; DWORD_PTR rvaTarget; PIMAGE_SECTION_HEADER pSection; ...


4

This is the Import Address Table, which contains the virtual addresses for the imported functions. Since the DLLs have been loaded at different addresses (7bxxxxxx in one case, 76xxxxxx in the other), the Import Address Table is filled with different DWORD values.


4

It is possible that you are using RTTI. Try compiling your code with option -fno-rtti. Update: It is really RTTI. I don't know how exactly it works, but I succeeded to remove those strings as follows: $ g++ -Xlinker -unexported_symbol -Xlinker "*" -o executable file.cpp $ strip executable (This was found at https://stackoverflow.com/questions/1931626/...


Only top voted, non community-wiki answers of a minimum length are eligible