git.stella-ops.org/docs/modules/scanner/operations/entrypoint-lang-ccpp.md

Entry-Point Runtime — C / C++

Signals to gather

• Dynamically linked ELF (.dynamic) with GLIBC references (GLIBC, GLIBCXX, libstdc++).
• Presence of /lib64/ld-linux-*.so.* loaders.
• Absence of Go/Rust-specific markers.
• Native supervisor binaries (nginx, envoy, custom C services).
• Config files adjacent to the binary (/etc/app.conf, YAML/INI).

Implementation notes

• Treat this detector as the "native fallback": confirm no higher-priority language matched.
• Collect shared library list to attach as evidence; highlight unusual dependencies.
• Inspect EXPOSE ports and config directories to aid classification.
• Normalise busybox-style symlinks (actual binary often /bin/busybox with applet name).

Evidence & scoring

• Boost for ELF dynamic dependencies and loader presence.
• Add evidence for config files, service managers, or env variables.
• Penalise extremely small binaries without metadata (may be wrappers).

Edge cases

• Static C binaries may look like Go; rely on build ID absence and library fingerprints.
• When binary is part of a supervisor stack (e.g., s6-svscan), delegate classification to Supervisor.
• Windows native services should be handled by PE analysis (entrypoint-runtime-overview.md).