Basically I have a set of 32-bit ELF program binaries compiled by either gcc or llvm. They are all stripped before analysis.
My question is that, given a binary, is there any way I can determine whether it is compiled by gcc or llvm? Is there any available tool to do so?
I am no expert in the matter but I would try:
see exported functions names
if mangling is present you can use it for compiler detection. Just make a list of exported function names and compare to known mangling schemes (for example from the table in linked wiki page)
examine linked DLL's
you can detect well known RTL's by the filenames.
Also you can try to find language/compiler engine
each version of each compiler of modern programing languages need to have its engine. It is part of code that is responsible for things like stack, variables, control flow etc and is always the same for each compiled program with the same compiler version.
So create simple hello world apps in each compiler you can found and extract the engine binary. then simply search unknown binary and test if supported engine is present or not.
The first two bullets are more for PE (not sure if elf has the same info) and there are tools for such inspection (like PE/DLL explorers so for elf there should be something similar).
