(blatant plug)
protectionid (pid.gamecopyworld.com) reports the compiler info (turn it on in the configuration)
to do it, its a multitidemultitude of things
checking for byte patterns
checking imports (mscoree.dll, msvcr*.dll and so on)
checking entrypoint code
checking mz stub
checking linker version
and a few other things
example output
Scanning -> C:\ProtectionID.source\problematic.files\solved\detected\Agile.NET 6.2.0.16.AgileNETUnpackMe\AgileUnpackMe.exe
File Type : 32-Bit Exe (Subsystem : Win GUI / 2), Size : 7680 (01E00h) Byte(s)
[File Heuristics] -> Flag : 00000100000001001101000000110000 (0x0404D030)
[Entrypoint Section Entropy] : 5.25 (section #0) ".text " | Size : 0x1288 (4744) byte(s)
[DllCharacteristics] -> Flag : (0x8540) -> ASLR | DEP | NOSEH | TSA
[ImpHash] -> f34d5f2d4577ed6d9ceec516c1f5a744
[SectionCount] 3 (0x3) | ImageSize 0x8000 (32768) byte(s)
[VersionInfo] Product Name : AgileUnpackMe
[VersionInfo] Product Version : 1.0.4999.25574
[VersionInfo] File Description : AgileUnpackMe
[VersionInfo] File Version : 1.0.4999.25574
[VersionInfo] Original FileName : AgileUnpackMe.exe
[VersionInfo] Internal Name : AgileUnpackMe.exe
[VersionInfo] Legal Copyrights : Copyright 2013
[Debug Info] (record 1 of 1) (file offset 0x1414)
Characteristics : 0x0 | TimeDateStamp : 0x522C69AD | MajorVer : 0 / MinorVer : 0 -> (0.0)
Type : 2 (0x2) -> CodeView | Size : 0x57 (87)
AddressOfRawData : 0x3230 | PointerToRawData : 0x1430
CvSig : 0x53445352 | SigGuid A75CE0F5-0D67-4FC4-A2C612B95C81F742
Age : 0x6 | Pdb : c:\AgileUnpackMe\AgileUnpackMe\obj\x86\Debug\AgileUnpackMe.pdb
[!] AgileDotNet detected
[CompilerDetect] -> .NET
[.] .Net Info -> v 2.5 | x86 managed (/platform:x86) | Flags : 0x00000003 -> COMIMAGE_FLAGS_ILONLY | COMIMAGE_FLAGS_32BITREQUIRED |
[.] Entrypoint (Token) : 0x06000006
[.] MetaData RVA : 0x00002184 | Size : 0x00000C0C (3084)
[.] MetaData->Version 1.1 -> v2.0.50727
[.] Flags : 0x0 | Streams : 0x5 (5)
- Scan Took : 0.156 Second(s) [00000009Ch (156) tick(s)] [539 scan(s) done]
