Can we get compiler information from an elf binary?

Question

Is there some chance to know how a binary was built, under Linux? (and or other Unix)

Compiler, version, time, flags etc...

I looked at readelf and couldn't find much, but there might be other ways at analyzing the binary code/section etc...

Anything you know how to extract?

Answer 1

There isn't a universal way, but you can make an educated guess by looking for things only done by one compiler.

GCC is the easiest; it writes a .comment section that contains the GCC version string (the same string you get if you run gcc --version). I don't know if there's a way to display it with readelf, but with objdump it's:

objdump -s --section .comment /path/binary

---

I just realized I ignored the rest of your question. Flags aren't generally saved anywhere; they would be in a comment section most likely, but I've never seen that done. There's a spot in the COFF header for a timestamp, but there's no equivalent in ELF, so I don't think the compile time is available either

Answer 2

You can try using the strings command. It will create a lot of text output; by checking it you might guess the compiler.

pubuntu@pubuntu:~$ strings -a a.out |grep -i gcc
GCC: (Ubuntu 4.4.3-4ubuntu5) 4.4.3

Here I know it's compiled with gcc but you can always redirect strings output to a file and examine it.

There is one very good utility called peid for Windows but I can't find any alternative for it on Linux.

Answer 3

How about:

readelf -p .comment a.out

Answer 4

You can also use this clever script that counts the numbers of various CPU instructions used by the binary. It is based on parsing objdump output. Beware that it can take quite a long time to finish if you use it on a big binary.

Answer 5

There are two methods . Both will give the same result

objdump -s --section .comment binary

Using readelf command, readelf -S binary will display the 40 section headers in the binary . Note the serial number of .comment section header. In my system , it showed as 27 (may be different for your case)

readelf -x 27 binary -> which will display the Hex dump of section '.comment' . In that dump , you can see the compiler used for building the binary.