4

We have recently in our workplace stumbled upon a really old binary file that originates from unknown old computer. However in order to run this binary we need to get some local resources and hopefully accuire local additional documents regarding that binary. Talking about office masses... Now we already used 'dumpelf' binary to extract any kind of info about it. We assume from that information and together with our programming practice that the binary was compiled for vxworks 5.3.1 OS as a cross compilation from Solaris 2.6 OS and gcc version 2.95 (we are discussing here true legacy!)

I already stated that I strongly believe it isn't possible, but hopefully i'm wrong. If name isn't possible to retrieve, we can use other properties such as an IP address, MAC address of a NIC, usernames, Computer model and etc to narrow our search down.

Thank you for the upcoming efforts

Edit: strings command was already suggested and executed, but gave no indicative outputs.

  • 1
    So, you question is what are the addicional aspects of an ELF that would help you to identify its "dna origins" right? It could be helpfull if you add a more direct/focused question :) – user34720 Jan 13 '16 at 12:11
  • @nwildner prhaps, but I hope someone can enlight me other methods, commands, options to find out this data. I can't think of something outside the ELF format and that's probably the only thing to examine. So answers in this approach are also welcome and appreciated. I still prefer to keep the theme blurred so as other approaches are welcome as well – Aviv Jan 13 '16 at 12:33
  • readelf -a maybe, not sure exactly what it is you're trying to find. as for needed libs, strings <binary-name> | grep "\.so" – moonbutt74 Jan 13 '16 at 14:50
  • Disassembly of the machine code could definitely tell you the target platform (by inferring the ABI, for example) and the compiler used (by looking at how the compiler organized the code, the optimizations it did, etc.) The former is something a competent assembly programmer could do. The latter is a research project if no one else has done it, not leaving this as an answer for this reason. – derobert Jan 13 '16 at 15:45
  • @deroert we have no real difficulty to figure out the compiler or the OS. we know them with really high probablity (although not through this really crazy research you have described 😃). We need to find out on which local computer we have been working on – Aviv Jan 13 '16 at 16:59
3

You should run strings on your program:

strings /path/to/binary

This will print all strings of (by default) 4 or more printable characters in a row to your terminal. A lot of this will be junk, but if the hostname is actually somewhere in the binary, that should tell you.

I agree with you that it is highly unlikely that it will contain things like MAC address or hostname of the compiling host; however, if the binary is unstripped (i.e., contains debugging symbols), it likely will still contain path names to the source that it was compiled from. This may give you some clue as to in which environment it was built in the first place.

  • 1
    I'd recommend usings strings -a /path/to/binary to ensure scanning the entire file. – Andrew Henle Jan 13 '16 at 12:51
  • That should be the default, but yeah, probably not a bad idea. – Wouter Verhelst Jan 13 '16 at 12:56
  • This is a great answer, but it yields nothing we can use to our invastigation... i would +1 if I could... – Aviv Jan 13 '16 at 13:55
  • @Aviv What platform/OS are you doing your investigation on? And strings -a /path/to/binary | grep -i cc returns no strings at all? What's the output from file /path/to/binary? That might reveal if the binary was stripped. – Andrew Henle Jan 13 '16 at 17:13
  • Strings command is working just fine but yields nothing helpful. The OS we are working on is solaris 10. – Aviv Jan 14 '16 at 10:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.