flat assembler
Message board for the users of flat assembler.
![]() |
Author |
|
MIHIP 24 Feb 2014, 16:07
For example, in ever file, compiled by fasm i see the "G‡оR а ".
|
|||
![]() |
|
baldr 24 Feb 2014, 16:25
MIHIP,
Why are you guessing? 47 87 EE 52 is a timestamp (IMAGE_FILE_HEADER.TimeDateStamp), it's absolutely normal for it to be equal in the several PEs, especially if they're examples and were compiled together. P.S. There is "Edit" button (unless you're talking to yourself). |
|||
![]() |
|
JohnFound 24 Feb 2014, 16:27
FASM does not put any signatures in the compiled files, other than needed for the target file format.
But, because FASM is multipass assembler, it compiles some instructions in a way other assemblers or HLL compilers can't. But IMO, to identify FASM as a compiler for random binary file is impossible (at least with high reliability). |
|||
![]() |
|
Tomasz Grysztar 24 Feb 2014, 16:30
There is no such signature in general, because fasm tries to put into an output file as few things as possible, and so it will not put there anything that is was not told to (or that is not required data for a given format).
However it is sometimes possible to recognize code created with a given assembled by looking at the "footprint" of what instruction encodings it chooses when it has some alternatives to choose from. For example there are two possible encoding of "xor reg,reg" and different assemblers may choose either one. Other than that, there is one more detail in case of PE output. The PE header contains field called "version of the linker". In case of fasm, it writes its own version there (because it uses no additional linker). AFAIK there are no other linkers with the version numbers in range of the ones used by fasm (but I may be wrong - I do not know all of the linkers out there), so it probably could be used to detect fasm-created PE file. |
|||
![]() |
|
< Last Thread | Next Thread > |
Forum Rules:
|
Copyright © 1999-2025, Tomasz Grysztar. Also on GitHub, YouTube.
Website powered by rwasa.