Detect if an ELF binary was built with gprof instrumentation?
You could check for references to function mcount
(or possibly _mcount
or __mcount
according to Implementation of Profiling). This function is necessary for profiling to work, and should be absent for non-profiled binaries.
Something like:
$ readelf -s someprog | egrep "\s(_+)?mcount\b" && echo "Profiling is on for someprog"
The above works on a quick test here.
The regular expression in the answer above doesn't always work...but the general idea of grepping for "mcount" in the output of 'readelf -s [binary]' is correct, I think