Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is there some chance to know how a binary was built, under Linux? (and or other Unix)

Compiler, version, time, flags etc...

I looked at readelf and couldn't find much, but there might be other ways at analyzing the binary code/section etc...

Anything you know how to extract?

share|improve this question

5 Answers 5

There are two methods . Both will give the same result

objdump -s --section .comment path/to/binary

Using readelf command, readelf -S binary will display the 40 section headers in the binary . Note the serial number of .comment section header. In my system , it showed as 27 (may be different for your case)

readelf -x 30 path/to/binary -> which will display the Hex dump of section '.comment' . In that dump , you can see the compiler used for building the binary.

share|improve this answer

You can try using the strings command. It will create a lot of text output; by checking it you might guess the compiler.

pubuntu@pubuntu:~$ strings -a a.out |grep -i gcc
GCC: (Ubuntu 4.4.3-4ubuntu5) 4.4.3

Here I know it's compiled with gcc but you can always redirect strings output to a file and examine it.

There is one very good utility called peid for Windows but I can't find any alternative for it on Linux.

share|improve this answer
    
+1, allows you to see the compilation flags (if gcc) –  Ivan Black Sep 11 at 15:33

You can also use this clever script that counts the numbers of various CPU instructions used by the binary. It is based on parsing objdump output. Beware that it can take quite a long time to finish if you use it on a big binary.

share|improve this answer

How about:

readelf -p .comment a.out
share|improve this answer
1  
How is this different than Michael's objdump? Does it give more information? Available on different platforms? Cleaner output format? –  Caleb Aug 19 '11 at 7:58
    
Cleaner output format. –  marcin Mar 3 '13 at 15:48

There isn't a universal way, but you can make an educated guess by looking for things only done by one compiler.

GCC is the easiest; it writes a .comment section that contains the GCC version string (the same string you get if you run gcc --version). I don't know if there's a way to display it with readelf, but with objdump it's:

objdump -s --section .comment /path/binary

I just realized I ignored the rest of your question. Flags aren't generally saved anywhere; they would be in a comment section most likely, but I've never seen that done. There's a spot in the COFF header for a timestamp, but there's no equivalent in ELF, so I don't think the compile time is available either

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.