3

I am studying ELF binary anatomy / structure and there are lots and lots of resources out there that describes what the ELF magic is. I understand the 45 4c 46 = ELF signature thing but what no source even touches on is what the 7f in 7f 45 4c 46 is.

I found one source saying it's a "fixed byte", but what does that mean? Is it just some random fixed byte that, if things were a little different, might have been something else?

1
2

This is the first byte of the ELF file.

Linux has a system of "magic numbers" that are use to recognise specific file types. Apart from being helpful for the file utility, they are used by the kernel to recognise executables.

The 'magic' concept has a long history, but there has been little or no correlation on specific values between either manufacturers (such as Sun, Dell, HP etc), or package creators.

Using any initial printable character (such as E) could be plain text. Using 0x80 (octal 0200) and above could mark a UTF-8 multi-byte character. Many of the ASCII control chars would be problematical (NUL, NL, TAB). There is not a great number of options. So the initial 0x7F (DEL) byte is a reasonable choice to prevent any such confusion.

You could look at your local man pages for magic and file.

It is actually no accident that DEL is 0x7F. When data was often held on paper tape, a mis-punch could be obliterated by punching out all the chads (plus the 8th bit, for even parity). Most readers skipped the NUL and DEL characters completely.

6
  • 4
    Service numbers for port numbers are allocated by the IANA, officially; it’s not just a universal agreement — or rather, the universal agreement is that the IANA takes care of this ;-). Also, Unix-like systems don’t have a system of magic numbers; file would be much simpler if they did! (I’m not the downvoter BTW.) – Stephen Kitt Feb 18 at 12:22
  • If you limit the magic value reference to binary executable formats, then it is more accurate. Magic numbers used to identify binaries weren’t magical initially, they were CPU instructions — see What determines which architecture an a.out executable runs on? for details. Note too that the shell itself doesn’t recognise executables; it asks the kernel to run them, and if that fails, checks for shell scripts and runs them directly. – Stephen Kitt Feb 18 at 12:35
  • I was just dragging that out of the Bell System Technical Journal. Nevertheless, SunOS, PERQ, and other early Unix systems used magic numbers for data since the 1980s, although possibly not well-standardised or comprehensive. – Paul_Pedant Feb 18 at 12:43
  • Now you’ve got me intrigued — whereabouts in the BSTJ? – Stephen Kitt Feb 18 at 12:50
  • 2
    Right, file and magic have existed for a long time, but they’re really band-aids, not evidence that there’s a system of magic numbers. Classic Mac OS and PalmOS are examples of operating systems with a system of magic numbers; Unix doesn’t qualify IMO. If you want to search BSTJ, you can do so on the Internet Archive or on IEEE Xplore (if you have access). – Stephen Kitt Feb 18 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.