How to find executable filetypes?

Question

I want to find file types that are executable from the kernel's point of view. As far as I know all the executable files on Linux are ELF files. Thus I tried the following:

find * | file | grep ELF

However that doesn't work; does anybody have other ideas?

Answer 1

Later edit: only this one does what jan needs: thank you huygens;

find . -exec file {} \; | grep -i elf

Answer 2

Alternate solution not using file and readelf, for those on limited (e.g. embedded) systems:

find $WHERE -type f -exec hexdump -n 4 -e '4/1 "%2x" " {}\n"'  {} \; | grep ^7f454c46

Basically, we output first four bytes with hexdump and use them as a signature. We can then grep all the files of type ELF using its signature 7f454c46.

Or, since 7f is the delete character, and 45, 4c, 46 bytes are E, L, F characters respectively, we could also use:

find $WHERE -type f -exec hexdump -n 4 -e '4/1 "%1_u" " {}\n"'  {} \; | grep ^delELF

Also, you can use head instead of hexdump in this case:

find $WHERE -type f -exec head -c 4 {} \; -exec echo " {}" \;  | grep ^.ELF

Answer 3

Like others, I want to answer too. My answer is based on using the find utility too, but I have an idea, which is differ against other answers. It grounded on that fact, that the -exec can be used as the search criteria too. Now, having this thing in mind, we can refactor all of the previous proposals to this one:

find /path -type f -exec sh -c "file {} | grep -Pi ': elf (32|64)-bit' > /dev/null" \; -print

I.e. we have moved the grep into the -exec.

What does this give to us, you may ask? We can use the flexibility of the -print and others of the find utility. For example, we can format an output on our taste, or use the -print0 and redirect an output to some script etc.

Answer 4

Take a look on -executable flag of find.

Answer 5

I would look for regular files first as binary executable are belonging to that type of files.

Then I would request for each regular file the mime type and if it matches application/x-executable then it is a binary executable files (that should match Linux executable files, Windows one for instance match application/x-dosexec).

find . -type f -print0 | xargs -0 -n 10 file -i | grep "application/x-executable"

Trying this command I found a discrepency with find . -type f -print0 | xargs -0 -n 10 file | grep -w ELF. It seems that the command file is buggy and detects ELF executable as ELF shared object. So even though the command is theoricaly correct, in practice it is incomplete.

So we have to look for ELF executables and shared objects but exclude all files with a name of *.so and .so.

find . -type f ! \( -name "*.so.*" -o -name "*.so" \) -print0 | xargs -0 -n 10 file -i | egrep "application\/x-sharedlib|application\/x-executable"

It is not probably perfect, but that's the pretty close.

Answer 6

I think this answers the original question if their intent was to find binary executable files by ensuring each match has an elf header.

It sort of pre-processes files based on type -executable then runs the results through a separate shell that invokes readelf -l which pipes to grep which silently matches on headers that are explicitly executable. Anything that passes this test is passed to printf for the output.

The pwd bit outputs the full path.

find `pwd` -type f -executable -exec sh -c 'readelf -l "$1" 2>/dev/null | grep -qio 'executable' && printf "$1\n"' -- {} \;

Answer 7

Assuming the original question refers to ELF files only (and not any other "executable from the kernel's point of view"), there is a shorter and, most likely, faster alternative to find + file:

$ scanelf -R /SEARCH/PATH
 TYPE   FILE 
ET_DYN /SEARCH/PATH/library.so
ET_EXEC /SEARCH/PATH/app1
ET_EXEC /SEARCH/PATH/app2

It recursively searches for ELF files, prints object file type and filepath for each.

Narrow the search down to only executable ELF files: scanelf -EET_EXEC -R /SEARCH/PATH.

Suppress banner and type, keeping only filepaths: scanelf -EET_EXEC -RBF %F /SEARCH/PATH.

Answer 8

find . -type f -executable -exec sh -c "[[ \"\$(head -c 4 -- \"\${1}\")\" == \$'\\x7FELF' ]]" -- \{\} \; -print

has the advantage that it doesn't "escape find". Instead of the final -print (or after it) you can add other filters or commands while still acting within the find.

The part

-exec sh -c "[[ \"\$(head -c 4 -- \"\${1}\")\" == \$'\\x7FELF' ]]" -- \{\} \;

acts as a filter in the find, discarding files that do not start with the ELF file marker.

I'm not sure if the

-type f -executable

part is truly needed, especially both conditions at once. But I guess in large trees it might be faster to discard the paths first based on the elementary properties, before trying to read them.

In my particular use case (that lead me here) I was trying to capture some basing ELF data of all executables generated by a build. However, the tree contained also other (non-ELF) executable files, like for example shell scripts. That caused readelf to fail and break the find. Adding the filter to discard non-ELF files first resolved the problem. For completeness, my full command was:

find . -type f -executable -exec sh -c "[[ \"\$(head -c 4 -- \"\${1}\")\" == \$'\\x7FELF' ]]" -- \{\} \; -print -exec readelf -d -- \{\} \;

Answer 9

find -type f -exec file {} \; | grep ELF | grep executable | cut -d: -f1