1

For example, PDF files can contain metadata that was included by the PDF creation/modification software by default, or by the user's own choice. Among other things, the metadata can reveal the PDF creation software used, and the name of the user that created the PDF.

  • When one creates an executable using GCC, does the executable contain any metadata (the compiler used, the compilation date, etc)?
  • How can one deliberately insert metadata into an executable? (for example, the name of the author, the date created, the compiler flags used, the VCS commit hash, etc.)

Note: the metadata I am talking about does not have to "standard" (i.e. like the case of PDF). In one way or another, it just has to be visible to a person inspecting the executable.

Flux
  • 9,805
  • 5
  • 46
  • 92

1 Answers1

1
  • GCC records its version in the .comment section (at least on targets that support it — e.g. ELF ones). You can compile something and check with objdump -s -j .comment a.out.

  • -frecord-gcc-switches (see the manual and this answer)

  • -grecord-gcc-switches

  • Generally when you ask the compiler to emit debug information (the -g* family of options), plenty meta-info might be emitted. I know of DW_AT_producer (info about the compiler/assembler name and version along with command line swithes) and DW_AT_comp_dir (compilation directory) tags.

There's also -fverbose-asm, but that only emits comments in the assembly; they don't make it through even to the object files, let alone executables.

Also keep in mind, that the compiler does not produce executables. It just produces the assembly code (the gcc command is the compiler driver that invokes the compiler proper, then the assembler, then the linker). The linker can decide what to do with .comment sections and such when combining object files into an executable/library. I think, the "normal" behaviour is to catenate them, although discarding them at that stage or later (e.g. with strip) should't surprise anyone.

How can one deliberately insert metadata into an executable?

Usually, SHT_NOTE sections are used for it (if we are speaking ELF). Here concatenation and preservation through to the end are guaranteed, because they are not mere comments; they are used by the toolchain to store some properties of programs (see man elf, grep for 'note').

Another (hacky) way is defining absolute symbols. You can encode information in the symbol's name. This can be done at any stage. E.g. in the source program, or in assembly. Or at link stage with ld --defsym. Or you can modify the resulting executable with objcopy --add-symbol — oh, that works for sections, too (objcopy --add-section).

Vladislav Ivanishin
  • 2,092
  • 16
  • 22