Mirror of forum.nim-lang.org

10186 :: Is there a way to see the NIM version in an NIM executable (binary) ?

• hunterbr (orginal) [2023-05-09T10:57:46+02:00] view original

  Hi, is there a way to see or classify the NIM version in a NIM executable (binary) which was compiled without debugging symbols. With or without stripped linker option.

  e.g. nim c -d:release --opt:size [--passL:-s] .hello_world.nim

  thx, Holger

---

• gabbhack (orginal) [2023-05-09T11:08:03+02:00] view original

  Use magic NimVersion constant.

  echo(NimVersion)
  Run

---

• Yardanico (orginal) [2023-05-09T11:11:25+02:00] view original

  No, there's not. Any reason you'd want that information?

---

• hunterbr (orginal) [2023-05-09T16:29:11+02:00] view original

  I am working on an IDA plugin to help malware researchers to analyze NIM based malware and wondering if there is an easier way than profiling certain features to find the version of a NIM binary.

  @gabbhack nope, that only works at compile time afaik, but pls correct me.

---

• Yardanico (orginal) [2023-05-09T16:30:56+02:00] view original

  Even profiling features isn't correct, maybe you can instead check common stdlib functions that get changed with versions. Also, it's Nim, not "NIM" - the name is not an acronym :)

---

• xigoi (orginal) [2023-05-09T23:11:03+02:00] view original

  The language is Nim, not NIM.

---

• hunterbr (orginal) [2023-05-10T11:11:38+02:00] view original

  thx for pointing that (NIM/Nim) out. Yup, already started that (comparing stdlib functions), was just hoping there might be a hidden version number somewhere, but c est la vie. :)

---

• Araq (orginal) [2023-05-10T11:22:22+02:00] view original

  Shouldn't an analyzer for malware do its job by analyzing the malware for its dangerous features rather than by detecting some arbitrary artifact like which programming language was used to produce the machine code?

---

• nasl (orginal) [2023-05-10T14:52:03+02:00] view original

  On the other hand, if every release had a unique fingerprint malware creators would have to recompile every every new version for their code to stay current.

---

• hunterbr (orginal) [2023-05-12T21:31:01+02:00] view original

  @Araq, finding the version helps for several task in reverse engineering the malware. I ll open a new question for that to make this thread not too long, but for example I am trying to profile stdlib functions, so that the analyst can focus on the code written by the malware author instead of getting lost in stdlib functions.

---