“Borland”, “Inprise”, “Code Gear”, “Embarcadero”, “Delphi”, “C++ Builder”, as well as “Boolean”, “False”, “True”, “System”, “AnsiChar” are keywords that are very familiar to anyone who reverse engineers executables on regular basis. Seeing them is a good indicator that the samples we look at were most likely produced by compilers coming either directly, or through its descendants and spinoffs from Borland.

I want to talk about them, because Borland executables can be a goldmine for forensic investigators.

The part 1 will focus on the infamous number 0x2A425E19 (708992537) a.k.a 1992-06-19 22:22:17 (Friday).

This is a compilation timestamp of many Delphi files and let’s face it – it is just simply annoying.

Lots of people complained about it in the past; it is actually a very well-known bug, have not been addressed for many years, and only (as per the note in the link provided): “In Delphi 7 this structure was filled properly, but in 2006 not.” i.e. Delphi 4 – Delphi 2006 do not set this timestamp correctly.

Now, this is actually an interesting forensic artifact as it tells you the file was compiled most likely with Delphi 4 – Delphi 2006.

There is more to it.

If the compilation stamp is wrong you can still manage to win the game. If the Delphi executable has a resource directory you may retrieve its compilation timestamp. It is stored in an old-school DOS time format (note that non-Delphi files store it as an EPOCH timestamp, as per PE documentation; yes, Delphi executables are weird 🙂 ). And lo and behold, it may be actually a compilation timestamp that indicates when the whole thing was compiled, or at least give you a better estimate!

In any case, it’s better than nothing.

Example for the same file:

PE Comp.:    1992-06-19 22:22:17 2A425E19, 708992537
.rsrc comp.: 2010-12-09 14:25:36 3D897332, 1032418098

PE Compilation timestamp is the buggy 1992-06-19 22:22:17, but the .rsrc directory timestamp is a very reasonable timestamp 2010-12-09 14:25:36.

And yes, there is a script that you can use to do a dirty work for ya (use it for Delphi executables only).

perl pect.pl <filename>

Download pect.pl here.