Tag Info

Hot answers tagged

16

There isn't a universal way, but you can make an educated guess by looking for things only done by one compiler. GCC is the easiest; it writes a .comment section that contains the GCC version string (the same string you get if you run gcc --version). I don't know if there's a way to display it with readelf, but with objdump it's: objdump -s --section ...


16

glibc has a configure option called --enable-kernel that lets you specify the minimum supported kernel version. When object files are linked with that glibc build, the linker adds a SHT_NOTE section to the resulting executable named .note.ABI-tag that includes that minimum kernel version. The exact format is defined in the LSB, and file knows to look for ...


8

If you want to limit yourself to ELF detection, you can read the ELF header of /proc/$PID/exe yourself. It's quite trivial: if the 5th byte in the file is 1, it's a 32-bit binary. If it's 2, it's 64-bit. For added sanity checking: If the first 5 bytes are 0x7f, "ELF", 1: it's a 32 bit ELF binary. If the first 5 bytes are 0x7f, "ELF", 2: it's a 64 bit ELF ...


7

The following is a really good reference: http://www.ibm.com/developerworks/linux/library/l-dynamic-libraries/. It contains a bibliography at the end of a variety of different references at different levels. If you want to know every gory detail you can go straight to the source: http://www.akkadia.org/drepper/dsohowto.pdf. (Ulrich Drepper wrote the Linux ...


6

You could check for references to function mcount (or possibly _mcount or __mcount according to Implementation of Profiling). This function is necessary for profiling to work, and should be absent for non-profiled binaries. Something like: $ readelf -s someprog | egrep "\s(_+)?mcount\b" && echo "Profiling is on for someprog" The above works on a ...


6

A user generally encounters three types of ELF files—.o files, regular executables, and shared libraries. While all of these files serve different purposes, their internal structure files are quite similar. One universal concept among all different ELF file types (and also a.out and many other executable file formats) is the notion of a section. A section ...


6

I think that /bin/true has to be the oldest working .. Well, can you call a zero-byte file a binary? touch /tmp/old_true chmod 755 /tmp/old_true /tmp/old_true echo $?


5

Well of course it won't, because you won't have a C library anymore. All prelink does is to try and calculate an optimal load address for each library so that no program will have overlapping libraries, then update the libraries so that they default to loading at that address. Then when a program is run the libraries it uses are unlikely to need to be ...


5

No, it doesn't. It appears to mean that the version of libz you linked against when you compiled your program was built with different tools than the version on the madriva system you're using. The mandriva copy is missing symbol version info which was present in the copy of the libz library your program originally linked against. This has to do with ...


4

You can try using the strings command. It will create a lot of text output; by checking it you might guess the compiler. pubuntu@pubuntu:~$ strings -a a.out |grep -i gcc GCC: (Ubuntu 4.4.3-4ubuntu5) 4.4.3 Here I know it's compiled with gcc but you can always redirect strings output to a file and examine it. There is one very good utility called peid ...


4

This doesn't exactly answer your question, but... First of all, ELF is the specification use by Linux for executable files (programs), shared libraries, and also object files which are the intermediate files found when compiling software. Object files end in .o, shared libraries end with .so followed by zero or more digits separated by periods, and ...


4

Look in /proc/$pid/maps. The address ranges are over 32-bit addresses (8 hexadecimal digits) or 64-bit addresses (16 hexadecimal digits). This works for any kind of executable, no matter what format. You can only get information about processes running as the same user (unless you're root). if ! [ -e /proc/$pid/maps ]; then echo No such process elif grep ...


4

Like in the standard od command or hd, it means all the elided lines are the same as the preceding line. You can pass -v to make it display those lines anyway. From hexdump(1): The -v option causes hexdump to display all input data. Without the -v option, any number of groups of output lines, which would be identical to the immediately preceding group ...


3

Later edit: only this one does what jan needs: thank you huygens; find . -exec file {} \; | grep -i elf


3

ELF is a format and used by many programs of diff architecture. So all diff type of binary program use ELF only and CPU detect the processor/Architecture of the compiled program via e_machine field in ELF format. In ELF file format, different type of architectures have diff flags/value [e_machine field in the header ] to indicate the type.


3

There are few differences between ELF executables on different platforms. “UNIX - System V” is the common ground; System V is where the ELF format came from. The corresponding numerical value is 0. This value indicates that the executable doesn't use any OS-specific extension. Debian GNU/Linux, at least, configures GCC/binutils to generate executables with ...


3

I admit that the following isn't a great answer, but I believe the 0x8048000 value is enshrined in the ELF Specification. See figures A.4, A.5 and A.6 in that doc. The System V ABI Intel 386 Architecture Supplement also standardizes on 0x8048000. See page 3-22, Figue 3-25. 0x804800 is prescribed as the low text segment address/high stack address. And ...


3

That error, "no version information available", means that the version of libz that you linked against when you compiled the library is newer than the version on the mandrivia system you're using.


3

How about: readelf -p .comment a.out


3

Initial research At first sight it would appear that the answer would be "no" the specification for ELF only allows the following sections. C32/kernel/bin/.process.o architecture: i386, flags 0x00000011: HAS_RELOC, HAS_SYMS start address 0x00000000 Sections: Idx Name Size VMA LMA File off Algn 0 .text 00000333 ...


3

The problem is /bin/ls don't just need the shared libraries, which you provided. It also needs the program that loads them; the linux loader. To solve your problem you can copy the loader from your system (usually /lib/ld-linux.so.2) to the location of your chroot (/mnt/foo/lib/ld-linux.so.2).


2

You can also use this clever script that counts the numbers of various CPU instructions used by the binary. It is based on parsing objdump output. Beware that it can take quite a long time to finish if you use it on a big binary.


2

Type ldd ./trid both on the openSuse and Ubuntu system. I suspect you'll find that the latter is missing a library file.


2

The a.out file is still leftover from when compilers were using the a.out format. If you check the file with file a.out you will see it is actually in ELF format. To specify the name of the output file, use cc -o exec_name code.c.


2

You cannot. A program in binary form can only be executed in a machine with a compatible ISA (Instruction Set Architecture, see Wikipedia article). Intel maintains backward ISA compatibility in each processor generation as a newer ISA is always a superset of older ISA, and a program created for i386 will run on Pentium. However this is not the case between ...


2

What is allowed as section and section names depend on the file format. For ELF, the definition of the format define a bunch of them and their purpose and then says: Section names with a dot (.) prefix are reserved for the system, although applications may use these sections if their existing meanings are satisfactory. Applications may use names without ...


1

When you run prelink on an ELF binary it will only inspect the binary itself and its dependencies (as referenced in the ELF .dynamic and .dynstr sections). You should be able to use: prelink --libs-only libone.so libtwo.so [...] If one library is dependent on another you may need to specify these together on the same command line (i.e. if they are not in ...


1

The flags in the output are BFD - Binary File Descriptors. They're part of the binutils package, you can read what the flags mean if you look in the bfd header file /usr/include/bfd.h for their meaning or here. The reference to the "flags" 0x00000112 is what's called a flag field. It's binary and each bit represents a particular feature, a one means the ...


1

Take a look on -executable flag of find.


1

I would look for regular files first as binary executable are belonging to that type of files. Then I would request for each regular file the mime type and if it matches application/x-executable then it is a binary executable files (that should match Linux executable files, Windows one for instance match application/x-dosexec). find . -type f -print0 | ...



Only top voted, non community-wiki answers of a minimum length are eligible