I understand that Linux uses shebang line to determine what interpreter to use for scripting languages, but how does it work for binaries?

I mean I can run Linux binaries, and having installed both wine and mono, Windows native and .NET binaries. And for all of them it's just ./binary-name (if not in PATH) to run it.

How does Linux determine that a given binary must be run as a Linux native binary, as a Windows native binary (using wine facilities) or as a Windows .NET binary (using mono facilities)?


In a word: binfmt_misc. It's a Linux-specific, non-portable, facility.

There are a couple of formats that are recognized by the kernel with built-in logic. Namely, these are the ELF format (for normal binaries) and the shebang convention (for scripts). (thanks to zwol for the following part of the answer). In addition, Linux recognizes a couple of esoteric or obsolete or compatibility builtin formats. You probably won't encounter them. They are a.out, "em86", "flat", and "elf_fdpic".

Everything else must be registered through the binfmt_misc system. This system allows you to register with the kernel a simple pattern check based on a magic number, and the corresponding interpreter.

  • 6
    Although the OP asked for Linux explicitly, it could be worth noting that unlike many other solutions that work both on Linux and other Unix-like systems, this one is totally Linux-specific. – cubuspl42 Apr 26 '15 at 18:57
  • 6
    It might not be compiled in, but the Linux source tree still includes intrinsic support for a.out, "em86", "flat", and "elf_fdpic" formats as well as normal ELF. All of those except em86 appear to be native binary executable formats; there isn't enough information for me to figure out when one would use "flat" or "elf_fdpic". em86 appears to be a pre-binfmt_misc mechanism for running a particular x86 emulator, it's probably only still around for backward compatibility. – zwol Apr 26 '15 at 22:14
  • 2
    On Debian Linux (I didn't check RedHat and others) the command to display all current binfmt entries is update-binfmts --display – golem Apr 27 '15 at 16:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.