From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Delivered-To: caml-list@yquem.inria.fr Received: from nez-perce.inria.fr (nez-perce.inria.fr [192.93.2.78]) by yquem.inria.fr (Postfix) with ESMTP id DE305BB81 for ; Thu, 11 Nov 2004 13:42:25 +0100 (CET) Received: from pauillac.inria.fr (pauillac.inria.fr [128.93.11.35]) by nez-perce.inria.fr (8.13.0/8.13.0) with ESMTP id iABCgPuq008803 for ; Thu, 11 Nov 2004 13:42:25 +0100 Received: from nez-perce.inria.fr (nez-perce.inria.fr [192.93.2.78]) by pauillac.inria.fr (8.7.6/8.7.3) with ESMTP id NAA10621 for ; Thu, 11 Nov 2004 13:42:25 +0100 (MET) Received: from mail.barettadeit.com (h213-255-109-130.albacom.net [213.255.109.130] (may be forged)) by nez-perce.inria.fr (8.13.0/8.13.0) with ESMTP id iABCgOO3008800 for ; Thu, 11 Nov 2004 13:42:24 +0100 Received: from [10.0.0.115] (table [10.0.0.115]) by mail.barettadeit.com (Postfix) with ESMTP id 820D5802865F for ; Thu, 11 Nov 2004 13:42:24 +0100 (CET) Message-ID: <41935E30.3020104@yahoo.it> Date: Thu, 11 Nov 2004 13:42:24 +0100 From: Luca Pascali User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3) Gecko/20041007 Debian/1.7.3-5 X-Accept-Language: en MIME-Version: 1.0 To: caml-list@inria.fr Subject: Re: [Caml-list] Native executable symtable References: In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Miltered: at nez-perce with ID 41935E31.000 by Joe's j-chkmail (http://j-chkmail.ensmp.fr)! X-Miltered: at nez-perce with ID 41935E30.000 by Joe's j-chkmail (http://j-chkmail.ensmp.fr)! X-Spam: no; 0.00; caml-list:01 symtable:01 wrote:01 baretta:01 baretta:01 ...:98 ...:98 signatures:01 natively:01 natively:01 supported:01 native:02 hints:03 string:03 module:03 X-Spam-Checker-Version: SpamAssassin 3.0.0 (2004-09-13) on yquem.inria.fr X-Spam-Status: No, score=0.6 required=5.0 tests=FORGED_RCVD_HELO, FROM_ENDS_IN_NUMS autolearn=disabled version=3.0.0 X-Spam-Level: Keith Wansbrough wrote: > [...] > >Make sure there is a value you do know. For example, write a module >containing just a big string. Require that it is always included in >any executable supported by your system. Compute its CRC. Now you >have a starting-point for searching. > > > We can try this way. >>It will be more useful for us to know where to find those values in the >>natively compiled file and if this solution is cross platform or not. >> >> > >No solution will be completely cross-platform; different platforms >have different executable formats. But if you support say ELF and PE >(COFF), you'll cover a lot of platforms... > >--KW 8-) > > > > I knew that. Since some weeks ago I heard about some Dynlinker that works also from natively compiled applications, I thought that someone already hit his/her head onto this wall. I think (and I hope) that the format of the signatures is always the same for all the operating systems. Anyway thanks a lot for all hints. LP -- ********************************************************************* Luca Pascali luca@barettadeit.com asxcaml-guru@barettadeit.com http://www.barettadeit.com/ Baretta DE&IT A division of Baretta SRL tel. 02 370 111 55 fax. 02 370 111 54 Our technology: http://www.asxcaml.org/ http://www.freerp.org/