windows 查找使用的编程语言

声明:本页面是StackOverFlow热门问题的中英对照翻译,遵循CC BY-SA 4.0协议,如果您需要使用它,必须同样遵循CC BY-SA许可,注明原文地址和作者信息,同时你必须将它归于原作者(不是我):StackOverFlow 原文地址: http://stackoverflow.com/questions/371460/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me): StackOverFlow

提示:将鼠标放在中文语句上可以显示对应的英文。显示中英文
时间:2020-09-09 05:52:27  来源:igfitidea点击:

Find Programming Language Used

windowscomputer-forensics

提问by veagles

Whats the easiest way to find out what programming language an application was written in? I would like to know if its vb or c++ or delphi or .net etc from the program exe file.

找出应用程序使用哪种编程语言编写的最简单方法是什么?我想从程序exe文件中知道它的vb或c++或delphi或.net等。

采纳答案by John T

Try PEiD

试试PEiD

of course if they used a packer, some unpacking will need to be done first :)

当然,如果他们使用打包机,则需要先进行一些拆包 :)

回答by Ed Guiness

Start it up and check what run-time DLLs it uses with Process Explorer.

启动它并检查它与 Process Explorer 一起使用的运行时 DLL。

If that doesn't make it immediately obvious, search the web for references to those DLLs.

如果这并不明显,请在网络上搜索对这些 DLL 的引用。

Most disassemblers (including Olly I think) can easily show you the text contained in an EXE or DLL, and that can also sometimes give a clue. Delphi types are often prefixed with T as in TMyClass.

大多数反汇编程序(我认为包括 Olly)可以轻松地向您显示 EXE 或 DLL 中包含的文本,并且有时也可以提供线索。Delphi 类型通常以 T 为前缀,就像在 TMyClass 中一样。

If it's a small executable with no DLL references and no text you might be SOL. At that point you'd need to look for idioms of particular compilers, and it would be mostly guesswork.

如果它是一个没有 DLL 引用且没有文本的小型可执行文件,那么您可能是 SOL。那时你需要寻找特定编译器的习惯用法,这主要是猜测。

回答by Blue Toque

There is an art to detecting what language a program was written in. It is possible but there are no hard and fast rules. It takes a lot of experience (and it also leads to the question "Why would you want to..." but here are a few ideas on how to go about it.

检测程序是用什么语言编写的,这是一门艺术。这是可能的,但没有硬性规定。这需要大量的经验(这也导致了“你为什么想要......”的问题,但这里有一些关于如何去做的想法。

What you're looking for is a "signature". The signature could be a certain string that is included by the compiler, a reference to an API that is quite common in the programming tool being used, or even a style of programing that is common to the tools being used, visible in the strings contained in the application.

您正在寻找的是“签名”。签名可以是编译器包含的某个字符串,对正在使用的编程工具中很常见的 API 的引用,或者甚至是正在使用的工具中常见的一种编程风格,在包含的字符串中可见在应用程序中。

In addition, there are styles to how an application is deployed: various configuration files found in the deployment directory, dlls and assemblies and even images, directories or icons.

此外,应用程序的部署方式有多种样式:部署目录中的各种配置文件、dll 和程序集,甚至图像、目录或图标。

Java applications wrapped in a self-launching executable will contain references to java libs, and will likely have certain libraries or files included in the same directory that indicate that it's java.

包装在自启动可执行文件中的 Java 应用程序将包含对 java 库的引用,并且可能在同一目录中包含某些库或文件,表明它是 java.util.Date 。

As indicated in other answers a managed assembly will show certain signs as well: you can open it in Reflector etc. While it is correct that c# and VB are "interchangable" once compiled, it is not true that they are identical. If you use Reflectorto disassemble VB code you will quite often see that the assembly references the Microsoft.VisualBasic.dll assembly. You'll be able to tell the difference between Monoapplications because they will most likely contain references to the mono assemblies.

正如其他答案中所指出的,托管程序集也会显示某些标志:您可以在 Reflector 等中打开它。虽然 c# 和 VB 在编译后是“可互换的”是正确的,但它们并不相同。如果您使用Reflector反汇编 VB 代码,您会经常看到该程序集引用了 Microsoft.VisualBasic.dll 程序集。您将能够分辨Mono应用程序之间的区别,因为它们很可能包含对Mono程序集的引用。

Many compilers assemble and link code in certain ways, and leave footprints behind. For example, examining a window executable using "strings: tab in Process Explorer, you'll see a lot of strings. Using these you may be able to determine programming styles, methods called, error or trace methods withint the exe.

许多编译器以某种方式组装和链接代码,并留下足迹。例如,使用Process Explorer 中的“strings: tab”检查窗口可执行文件,您会看到很多字符串。使用这些字符串,您可以确定 exe 内的编程风格、调用的方法、错误或跟踪方法。

An example is that compilers use different mechanisms for localization: Microsoft stores localized strings in XML files or resource files. Other compilers will use a different tactic.

一个例子是编译器使用不同的本地化机制:微软将本地化的字符串存储在 XML 文件或资源文件中。其他编译器将使用不同的策略。

Another example is c++ name mangling. The CodeWarriorcompiler uses a different algorithm to mangle the names of the member variables and functions of a call than Visual Studio.

另一个例子是 c++ name mangling。该CodeWarrior的编译器使用不同的算法来裂伤比Visual Studio中调用的成员变量和函数的名称。

I suppose you could write a book on the subject of accurately determining the lineage of any executable. This subject would probably be called "programming archeology".

我想你可以写一本关于准确确定任何可执行文件的谱系的书。这个主题可能会被称为“编程考古学”。

回答by Paul Dixon

You could try using Dependsto see what runtime dependancies it has, which might give some clues.

您可以尝试使用Depends来查看它具有哪些运行时依赖项,这可能会提供一些线索。

回答by HS.

The easiest way is to ask the developer of the program. It does not require any knowledge and utility programs.

最简单的方法是询问程序的开发人员。它不需要任何知识和实用程序。

回答by jgottula

Compiled languages (by this I mean no scripting languages, or Java, .NET, etc.) are compiled into CPU assembly instructions, which is essentially a one-way conversion. It is not usually possible to determine which language a program was written in. However, using a dependency walker, you could potentially determine which runtime library the program was loading (if any) and therefore determine which language it used (e.g. MS Visual C++ 9 uses msvcr90.dll).

编译语言(我的意思是没有脚本语言,或 Java、.NET 等)被编译成 CPU 汇编指令,这本质上是一种单向转换。通常无法确定程序是用哪种语言编写的。 但是,使用依赖项遍历器,您可以潜在地确定程序正在加载哪个运行时库(如果有),从而确定它使用的是哪种语言(例如 MS Visual C++ 9使用 msvcr90.dll)。

回答by Arsen Mkrtchyan

you can check is that a .net assembly or not by trying to open with ildasm.exe tool

您可以通过尝试使用 ildasm.exe 工具打开来检查是否是 .net 程序集

回答by Uli Gerhardt

  • Determine Delphi Application
  • Use eda_preview270.exe (from here) or some other spy tool and check the window class names. If they read like TButton or TfrmBlubb, it's a VCL app. If there is an "Afx" in them, it's probably MFC.
  • 确定 Delphi 应用程序
  • 使用 eda_preview270.exe(来自此处)或其他一些间谍工具并检查窗口类名称。如果他们读起来像 TButton 或 TfrmBlubb,那就是 VCL 应用程序。如果其中有“Afx”,则可能是 MFC。

回答by i_am_jorf

In general, you can't.

一般来说,你不能。

If you can load it into Reflector, you know it is a managed assembly.

如果您可以将其加载到Reflector 中,您就知道它是一个托管程序集。

回答by Chad Okere

That's a good question. There isn't any general way to tell, but I bet most compilers and libraries leave a mark in the resulting EXE file. If you wanted to spend a lot of time on it, you could gather a bunch of EXEs written in known languages and scan for common strings. I would image you'd find some.

这是个好问题。没有任何通用的方法可以判断,但我敢打赌大多数编译器和库都会在生成的 EXE 文件中留下标记。如果你想花很多时间在上面,你可以收集一堆用已知语言编写的 EXE 并扫描常见的字符串。我想你会找到一些。

Dependancy Walker, which someone else mentioned would be a good way to look for telltale dependencies, like versions of MSVCRT, etc

Dependancy Walker,其他人提到的这将是寻找明显依赖项的好方法,例如 MSVCRT 的版本等