25

Is there any way to detect (or to hide) the compiler that was used to build an executable file?

Improve this question

7 Answers 7

Reset to default
13

PEiD is pretty good

PEiD detects most common packers, cryptors and compilers for PE files. It can currently detect more than 600 different signatures in PE files.

PEiD is special in some aspects when compared to other identifiers already out there!

  1. It has a superb GUI and the interface is really intuitive and simple.
  2. Detection rates are amongst the best given by any other identifier.
  3. Special scanning modes for advanced detections of modified and unknown files.
  4. Shell integration, Command line support, Always on top and Drag'n'Drop capabilities.
  5. Multiple file and directory scanning with recursion.
  6. Task viewer and controller.
  7. Plugin Interface with plugins like Generic OEP Finder and Krypto ANALyzer.
  8. Extra scanning techniques used for even better detections.
  9. Heuristic Scanning options.
  10. New PE details, Imports, Exports and TLS viewers
  11. New built in quick disassembler.
  12. New built in hex viewer.
  13. External signature interface which can be updated by the user.
Improve this answer
5
  • 4
    "PEiD detects most common [...] compilers for PE files." that's what the readme says - actually it does not tell how to achive that
    – mbx
    Aug 18, 2011 at 0:42
  • @Sathya Note, the included link is now dead.
    – DuckMaestro
    Dec 5, 2012 at 1:06
  • @DuckMaestro updated witi an alternative link
    – Sathyajith Bhat ♦
    Dec 5, 2012 at 2:58
  • If it cannot detect the compiler something like Nothing found [Overlay] * will be shown - which is confusing if you use that tool for the first time.
    – mbx
    Nov 17, 2014 at 13:30
  • 1
    "The site ahead contains harmful programs" - Google Chrome. Here's a better link.
    – Ben N
    Apr 3, 2016 at 15:57
13

Try the *nix utility strings. Using strings -a foo.exe should produce a pile of results. Redirect to a file and examine in your favorite editor. You may see either a line that directly implicates a specific compiler, such as Borland C++ - Copyright 2002 Borland Corporation. You might only be able to find lines that imply a specific compiler was used, such as in an include path or whatever.

Strings is also available for windows as part of cygwin, or as part of the microsoft sysinternals package.

Improve this answer
1
  • It doesn't show me the compiler name only some dll names project
    – Eduardo Xavier
    Mar 25, 2014 at 12:57
5

When this question was asked, PEiD was only a couple of years out of date.

These days, you're probably better off using Detect It Easy: https://github.com/horsicq/DIE-engine/releases or https://horsicq.github.io/#detect-it-easydie

Detect It Easy showing detection of curl.exe compiled with MSVC

Detect It Easy showing detection of ffmpeg.exe compiled with MinGW GCC

Improve this answer
4

(Old but okay..)

Language 2000 : http://farrokhi.net/language

Improve this answer
2

Not free, but IDA Pro has a very nice compiler detection. Not it's main function of course, but a nice extra.

Improve this answer
1

If you can find a way to examine the first dozen or so bytes of the EXE file, in a hex dump with corresponding ASCII characters displayed, they will usually indicate the compiler used.

Improve this answer
2
  • 1
    i was wondering if someone or some software can find if the exe was build with a specific compiler edition (Visual Studio 2010 Professional or Enterprise or Express)
    – Remus Rigo
    Dec 8, 2009 at 22:35
  • This usually isn't true. The first part of a PE file is the DOS stub which is usually a program that prints something like "This program cannot be run in DOS mode."
    – lesderid
    Oct 12, 2011 at 13:11
1

You can use "dependency walker" to check what runtime library it links to. MSVCP100 is Microsoft Visual C++ 2010 x86

Improve this answer
1
  • linking to MSVC runtime doesn't mean that it's been compiled by MSVC
    – phuclv
    Jul 31, 2022 at 3:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .