I'm not really sure how Windows gets the version of an app that is reported in that way... maybe it's in the registry (possibility for corruption leading to false versions reported), or more likely, a similar method is used, and windows calls the app through a well-defined interface.

Windows grobbles around in the headers of the binary -- the Win32 binary format contains the version fields, so, although the program isn't "run", it is directly consulted.

The ELF format used in Linux may well have similar fields, but they aren't used for executables; running with "--version" is the de facto standard. Library versioning, of course, is done in the filename, i.e. libfoo.so will be a symlink to libfoo.so.2 (major version) which is a symlink to libfoo.so.2.1.5 (full version). These symlinks are maintained by the ldconfig program, which examines the shared-library format headers to discover the "true" version.

Peter