Giter Club home page Giter Club logo

richprint's Introduction

richprint

Print compiler information stored in Rich Header of PE executables.

What is that "Rich Header of PE executables"?

It's a (usually small) section of binary data created by Microsoft linker. The data is located between old MZ header stub (also called DOS stub) and PE header. The data is encoded using a simple key, the only readable part of the whole section being the word "Rich".

The section is ubiquitous: you can find it in almost any type of PE (portable executable) file: .EXE, .DLL. .CPL (control panel applets), etc. Yet, if the file was created by a non-Microsoft linker, it will not have a Rich header.

The official name for this section is not known for sure, most likely it is something similar to "build prodid block".

The unofficial names for this section are "Rich Header" or "Rich Section", for obvious reasons.

The format of Rich Header and the gory details of decoding it can be found in the excellent article by Daniel Pistelli.

So, what does it contain after all?

Short and useless answer: the Rich Header contains the list of all @comp.id's used to create the executable file, together with their counts.

Long and elaborate answer:

  • When you compile a source file with a Microsoft compiler, it puts a special @comp.id record into the resulting object file. This @comp.id can be used to identify the exact version of the compiler (down to the build number). Compilers from different languages have similar, but distinct @comp.id's. This means that by looking at the @comp.id of an object file, you can tell not only the exact version of the compiler, but also whether the source file was a C or a C++ file. Assembler (ml.exe) and cvtres (utility for converting RES files into object files) also have their own @comp.id.
  • When you link a program using Microsoft linker, it puts the list of all @comp.id's into the Rich Header, followed by a count of files. E.g., if your program was built from 10 C++ files and one ASM file, and you used Microsoft Visual Studio 2013 to compile and link it, you are likely to have the following records in your program's Rich Header:
    00e1520d e1 21005 10 [C++] VS2013 build 21005
    00df520d df 21005  1 [ASM] VS2013 build 21005
    00de520d de 21005  1 [LNK] VS2013 build 21005
    
    The order of the records depends on the linker's input, but the @comp.id tells us (and everyone) that you used Microsoft (R) C/C++ Optimizing Compiler Version 18.00.21005.1 from Visual Studio 2013 RTM (i.e., without any updates installed). The last record is usually the linker's own @comp.id, but this is not always so. Also note that every object file counts; this includes run-time library files supplied by your vendor. Also, records that describe symbols imported and exported by DLLs have their distinct @comp.id's.

Sources of information

I gathered some @comp.id's from my own collection of Visual Studio editions.

Some were interpolated using open sources (e.g., an excellent list of Visual Studio versions by @yumetodo. In this list, _MSC_FULL_VER contains the build number, so it is easy to interpolate the @comp.id's when you know the numbering scheme for different tools.

"Interpolated" values are most likely to be correct. I checked some interpolated @comp.id's against real-world values, and they matched. Yet, interpolated values are marked with (*) for - ehm... - completeness?

How can this information be used?

In any way you like. For example, to satisfy your curiosity by inspecting the binaries in your system. Also, Rich Headers can allegedly be used in forensics.

Can I prevent Microsoft tools from emitting this header?

Yes you can. Provide this undocumented option to the linker: /emittoolversioninfo:no.

Thanks to Oliver Schneider for pointing this out.

richprint's People

Contributors

adoxa avatar dishather avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

richprint's Issues

Do you have plans for recording other Microsoft tool IDs in comp_id.txt?

There are other Microsoft tools that leave their fingerprints in the P.E. binary Rich header structure.
For example, CvtCIL, Link time code generator (LTCG), program guided optimization (POGO), etc.

https://github.com/avast/pelib/blob/master/src/pelib/RichHeader.cpp
https://hasherezade.github.io/bearparser/_rich_hdr_wrapper_8cpp_source.html
etc.

It seems that we could all benefit from a unified list instead of multiple incomplete implementations.

Request for Alternative Licensing of comp_id.txt Resources

I've been exploring your project and find the resources it provides to be incredibly valuable for my own software development efforts. However, I have a concern regarding the licensing terms associated with the comp.id resources.

As my software is closed source, I'm unable to comply with the requirements of the GPL license under which the resources are currently distributed. While I fully respect the principles of open source licensing, I require a licensing arrangement that aligns with the proprietary nature of my software.

Would it be possible for you to consider providing the comp.id resources under a license with weaker copyleft provisions or alternative licensing terms that would allow for their use in closed source software? I'm open to discussing any conditions or terms you may have in mind.

Thank you for considering my request. I appreciate your contributions to the open source community and look forward to your response.

Wishing you a blessed Easter!

Best regards,

PAX

Suggestion for finding more Visual Studio build numbers.

Just something worth mentioning

Hi there,

are you aware that a simple /emittoolversioninfo:no passed to the linker will prevent some of this information from being embedded?

License?

Hi. I would like to ask how is this project licensed? More specifically, we would like to use this MIT licensed project but we want to be sure that you are fine with it.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.