Course / 13 Reversing / Lesson 02 of 05

Compiled and interpreted

Estimated time: 16 min reading · 14 min activity

A source file and a runnable program are different artifacts. For a typical C program, a build translates and links source into an executable for a specified environment. Executing that file starts a process. Reading the source alone does not show that a build or run happened.

A Python runtime can read and execute a .py script; implementations may compile it to an internal form along the way. Compiled and interpreted describe parts of an execution approach, rather than two perfectly exclusive kinds of language. This is the recommended first Reversing lesson, before Enough C and assembly, while catalog navigation remains unchanged.

Before you begin

Estimated time
16 min reading, 14 min activity. Setup and optional practice may take longer.
Where you work
Read the supplied C/Python source and clearly labeled conceptual models in any current desktop or mobile browser. No compiler, binary execution, debugger, tracer or Ghidra installation is required. Function-only C sources are not standalone programs.
Without a lab
Trace the source or model on paper and record the condition, chosen branch and evidence limit. No matched lesson ELF, disassembly, debugger session or Ghidra export is supplied. Historical observations retain their separate context. Reading works without JavaScript. Checking requires JavaScript and a secure context; saving also requires usable storage.

After this lesson you can:

  • Name greet.c as source and the planned greet file as the compiler-output role.
  • Say that an x86-64 ELF is for that machine family.
  • Distinguish supplied C/Python source files from the absent planned executable.

01Example

This hypothetical build diagram introduces the roles with labels that are not supplied files. The guided activity uses the separate existing greet sources.

Hypothetical source: badge.c
Hypothetical build instruction: gcc -o badge badge.c
Planned output role: executable named badge
Separate script: badge.py, read by a Python runtime
These are teaching labels, not downloadable artifacts or recorded results.

02Three roles

Follow the build arrow: source is input, the compiler/linker produces an output artifact, and a later run loads that artifact. In gcc -O0 -g -o greet greet.c, gcc is the compiler driver, -O0 requests minimal optimization, -g requests debugging information, -o greet names the output and greet.c is the input. The command shown is an unrun candidate.

ELF means Executable and Linkable Format, used for several kinds of compiled artifacts on Linux. An executable is one possible ELF artifact; an ELF object file is not automatically a runnable program. Architecture identifies the target instruction family, such as x86-64 or ARM. Matching the file format does not guarantee that another machine can run it.

A separately recorded build or run with a different output name or flags cannot supply the missing artifact for this example. The candidate -O0 -g greet and hello executables are absent. No matched disassembly or debugger session is included.

Separate a C source file from the executable a stated build would write, and from a script a runtime reads.Model. A teaching model drawn by hand. It shows the idea, not real tool output.

Read the full explanation below.

Playback is optional. Step through at your own pace.

Supplied teaching sample

Hypothetical source and script

badge.cC source
badge.pyscript

Declared build/runtime roles

gcc -o badge badge.chypothetical build instruction
Python runtime reads badge.pyruntime role

Planned executable role

badgeplanned executableNo executable was created.

badge.c + gcc -o badge badge.c → badgeWould write executable badge

The hypothetical build uses badge.c and plans an executable named badge.

Follow the explanation

  1. The hypothetical build uses badge.c and plans an executable named badge.
  2. The separate badge.py is read by a Python runtime.
Read every state and value

1. The hypothetical build uses badge.c and plans an executable named badge.

Example
Supplied teaching sample
Visible Item
badge.c · badge.py · build · Runtime reads script · badge
Current mappings
build
Annotations
Item: badge; Text: No executable was created.

2. The separate badge.py is read by a Python runtime.

Example
Supplied teaching sample
Visible Item
badge.c · badge.py · build · Runtime reads script · badge
Current mappings
Runtime reads script
Annotations
Item: Runtime reads script; Text: Teaching role only; no run or downloadable artifact.
Source, planned executable and script runtime have different roles; no artifact is created here.
/* Worked C source. Not the question's hello.c. Not compiled. */
int main(void) {
    return 0;
}

Download the worked C source

# Worked Python source. python3 greet.py printed north desk.
print("north desk")

Download the worked Python source

03Classify the hello card

Apply the worked badge diagram to the different supplied greet.c and greet.py sources. Trace greet.c through the candidate build arrow and identify greet.py as separate script source. Then read the hello rows as independent checkpoint evidence. The question asks about an artifact role without claiming that the missing executable was produced.

/* Question fixture. C source for the stated Linux build. Not compiled. */
int main(void) {
    return 0;
}

Download hello.c

# Python source. python3 hello.py printed north desk.
print("north desk")

Download hello.py

Build card for the hello fixtures. Not a compiler log. Not a file(1) capture.

Row H-1. hello.c
Role: C source. This text file exists in the lesson download.
The stated build reads it as input.

Row H-2. hello
Role: ELF executable for a stated Linux x86-64 gcc build.
This file was not produced. There is no hash and no file(1) line.
It is the compiler-output role on this card.

Row H-3. hello.py
Role: Python source. The Python 3.12 tutorial describes an interpreter that reads a script from a file.
This file is not the output of the C build.

Unrun candidate command, owned directory only:
gcc -O0 -g -o hello hello.c

Both hello.c and hello.py are supplied source files. No matched hello ELF is supplied. Do not run the candidate for this lesson. An ARM machine is not assumed to run an x86-64 ELF.

Download the hello build card

  1. For the supplied greet.c source, read the candidate gcc -O0 -g -o greet greet.c instruction from the explanation. Identify its input and planned output name.
  2. Compare the greet.py text with greet.c. Explain why the Python source is not produced by the C command.
  3. Rubric: your note keeps build input, planned product and runtime-read script as separate roles, and labels the planned artifact missing.
  4. Read the hello card for the later question, then stop without compiling or running either source.

04Optional challenge

Write two sentences: what a later reader would need besides hello.c to rebuild the same executable, and why the missing ELF means you cannot check that rebuild yet. About ten minutes.

05Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Build case A: unrun candidateOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

Owned directory inventory: lantern.c and lantern.py only.
Candidate: gcc -O0 -g -o lantern lantern.c
The planned executable role is Linux x86-64 ELF.
No compiler log, executable hash or run exists.
A Python runtime would read lantern.py separately.

06Explain your evidence

Optional written self-check: explain one decision using the supplied case. No tool run is required.

Check your explanation: identify compiler input, proposed output and runtime input; keep file format and machine family separate; label absent build and run evidence explicitly.

07Common mistakes

If hello.py is marked as the C compiler's output, the build arrow was skipped. The C command names hello.c and would write hello.

If row H-2 is described as a captured binary, the card's missing-file line was skipped. The role is named. The bytes are not here.

If an ARM laptop is assumed to run the planned x86-64 ELF, the machine family on the card was skipped. Use the printed card either way.

References