flat assembler
Message board for the users of flat assembler.

Index > Compiler Internals > Signatures

Author
Thread Post new topic Reply to topic
MIHIP



Joined: 14 Feb 2013
Posts: 130
MIHIP 24 Feb 2014, 16:06
Hello! After compiling the program source code on FASM, which he introduces signature (saves) in the file? That is something he himself leaves from? For example, the text "FASM". Well signatures to determine what the program was compiled?
Post 24 Feb 2014, 16:06
View user's profile Send private message Visit poster's website Reply with quote
MIHIP



Joined: 14 Feb 2013
Posts: 130
MIHIP 24 Feb 2014, 16:07
For example, in ever file, compiled by fasm i see the "G‡оR а  ".
Post 24 Feb 2014, 16:07
View user's profile Send private message Visit poster's website Reply with quote
baldr



Joined: 19 Mar 2008
Posts: 1651
baldr 24 Feb 2014, 16:25
MIHIP,

Why are you guessing? 47 87 EE 52 is a timestamp (IMAGE_FILE_HEADER.TimeDateStamp), it's absolutely normal for it to be equal in the several PEs, especially if they're examples and were compiled together.

P.S. There is "Edit" button (unless you're talking to yourself).
Post 24 Feb 2014, 16:25
View user's profile Send private message Reply with quote
JohnFound



Joined: 16 Jun 2003
Posts: 3499
Location: Bulgaria
JohnFound 24 Feb 2014, 16:27
FASM does not put any signatures in the compiled files, other than needed for the target file format.

But, because FASM is multipass assembler, it compiles some instructions in a way other assemblers or HLL compilers can't. But IMO, to identify FASM as a compiler for random binary file is impossible (at least with high reliability).
Post 24 Feb 2014, 16:27
View user's profile Send private message Visit poster's website ICQ Number Reply with quote
Tomasz Grysztar



Joined: 16 Jun 2003
Posts: 8400
Location: Kraków, Poland
Tomasz Grysztar 24 Feb 2014, 16:30
There is no such signature in general, because fasm tries to put into an output file as few things as possible, and so it will not put there anything that is was not told to (or that is not required data for a given format).

However it is sometimes possible to recognize code created with a given assembled by looking at the "footprint" of what instruction encodings it chooses when it has some alternatives to choose from. For example there are two possible encoding of "xor reg,reg" and different assemblers may choose either one.

Other than that, there is one more detail in case of PE output. The PE header contains field called "version of the linker". In case of fasm, it writes its own version there (because it uses no additional linker). AFAIK there are no other linkers with the version numbers in range of the ones used by fasm (but I may be wrong - I do not know all of the linkers out there), so it probably could be used to detect fasm-created PE file.
Post 24 Feb 2014, 16:30
View user's profile Send private message Visit poster's website Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2025, Tomasz Grysztar. Also on GitHub, YouTube.

Website powered by rwasa.