CODEWITHSUNDEEP
linuxlinux-security-module
yasirateeq857
yasirateeq857

Reputation: 29

Detection of python ,perl or java in linux system

How can I detect in kernel or user space that this binary is of some interpreter language like python ,Perl or java and not a simple binary like ls ,clear, df, etc.

Upvotes: -1

Views: 75

Answers (3)

Dominique
Dominique

Reputation: 17565

I have just done tests, using the file command:

For a Python file:

Linux Prompt>file "./Program Files/.../test_XOR.py"
./Program Files/.../test_XOR.py: Python script, ASCII text executable, with CRLF, LF line terminators

For a Java file (*.jar library):

Linux Prompt>file "./Program Files/.../fontbox.jar"
./Program Files/.../fontbox.jar: Java archive data (JAR)

For another Java file (*.class file):

Linux Prompt>file "./Program Files/.../JREProperties.class"
./Program Files/.../JREProperties.class: compiled Java class data, version 52.0 (Java 1.8)

For a Perl file:

Linux Prompt>file "./Program Files/.../docx2txt.pl"
./Program Files/Git/usr/bin/docx2txt.pl: Perl script text executable

So, as you see, parsing the result of the file command might be your solution.

Edit after first comment

In my answer, I thought you were talking about files, which are to be launched by Python, Java or Perl, but you seem to be interested by those files themselves.

The only advise I can give you, is to take the checksum of Python, Java or Perl on that machine, and verify this with the checksum of the suspected file, as in this example:

Linux Prompt>cksum $(which perl)
3199833323 3478464 /usr/bin/perl

Linux Prompt>cp /usr/bin/perl /mnt/c/Temp_Folder/Kopietje

Linux Prompt>cksum /mnt/c/Temp_Folder/Kopietje
3199833323 3478464 /mnt/c/Temp_Folder/Kopietje

Upvotes: 0

flomo2023
flomo2023

Reputation: 1

You can use 'strings' to print printable character sequences from the binary. That should give you some good clues as to what language it was written in.

strings mybinaryfile

Upvotes: 0

Brent Thierens
Brent Thierens

Reputation: 451

Try using readelf. I have used that succesfully in the past. It can destinguish between binaries or interpreted files, as well as which platform the binary was compiled for. The --program-headers might be useful.

Upvotes: 0

Related Questions