Distinguishing the disassembly features of mainstream languages

1. VC6.0 + C + +1.1. Feature Code

Signature = A1 (xx) (53) 56 57 (C4 A8)

1.2. Entry code for the program1.3. The linker field in the PE structure

majorlinkerversion:0x06

minorlinkerversion:0x00-6.00

This is a Win32 console program compiled with vc6.0.

2. VC8.0 + C + +2.1. Signature (where '? ' stands for fuzzy matching)

Signature = E9?? ?? ?? ?? E9?? ?? ?? ?? E9?? ?? ?? ?? E9?? ?? ?? ?? E9?? ?? ?? ?? E9?? ?? ?? ?? E9?? ?? ?? ?? E9?? ?? ?? ?? E9?? ?? ?? ?? E9?? ?? ?? ?? E9?? ?? ?? ?? E9?? ?? ?? ?? E9?? ?? ?? ?? E9?? ?? ?? ?? E9?? ?? ?? ?? E9?? ?? ?? ?? E9?? ?? ?? ??

The feature code that is intercepted in the disassembly code is as follows:

2.2. Entry code for the program2.3. The linker field in the PE structure

majorlinkerversion:0x0a

MINORLINKERVERSION:0X00-10.00

3. Delphi 6.03.1. Entry code for the program3.2. The linker field in the PE structure

majorlinkerversion:0x02

minorlinkerversion:0x19-2.25

4. Win32 compilation4.1. Entry code for the program

1 . Text: 0040108E xx                   Push    0                 ; Lpmodulename 2 . Text: 00401090  - xx xx xx          Pager    Getmodulehandlea

4.2. The linker field in the PE structure

majorlinkerversion:0x05

MINORLINKERVERSION:0X0C-5.12

Distinguishing the disassembly features of mainstream languages