Hot answers tagged

46

“LSB” here stands for “least-significant byte” (first), as opposed to “MSB”, “most-significant byte”. It means that the binary is little-endian. file determines this from the sixth byte of the ELF header.


39

Right from the man page you reference: elf - format of Executable and Linking Format (ELF) files ELF defines the binary format of executable files used by Linux. When you invoke an executable, the OS must know how to load the executable into memory properly, how to resolve dynamic library dependencies and then where to jump into the loaded executable to ...


34

Let's analyse the factors... Analysis: DEPENDENCIES ACCORDING TO PLATFORM: There are some issues that arise in an environment where developers are creating and maintaining several architecture-specific variants of an application: Different source code is required for different variants — Different UNIX-based operating systems may use different functions ...


22

If you want to limit yourself to ELF detection, you can read the ELF header of /proc/$PID/exe yourself. It's quite trivial: if the 5th byte in the file is 1, it's a 32-bit binary. If it's 2, it's 64-bit. For added sanity checking: If the first 5 bytes are 0x7f, "ELF", 1: it's a 32 bit ELF binary. If the first 5 bytes are 0x7f, "ELF", 2: it's a 64 bit ELF ...


17

I don't know if your version of sed will be binary-clean or if will choke on what it thinks are really long lines in its input, but barring those issues, editing the string in-place should work. To see whether it does, compare the old and new versions with cmp -l. It should tell you whether or not the only three differences between the two files are those 3 ...


15

Bash knows nothing about ELF. It simply sees that you asked it to run an external program, so it passes the name you gave it as-is to execve(2). Knowledge of things like executable file formats, shebang lines, and execute permissions lives behind that syscall, in the kernel. (It is the same for other shells, though they may choose to use another function in ...


13

"Magic numbers" is the name given to constant sequences of bytes (usually) at the beginning of files, used to mark those files as being of a particular file format. They serve a similar purpose to file extensions. See the jargon file entry for more information. For example, PNG images always start with the same eight bytes: 137 80 78 71 13 10 26 10 Hence ...


12

The following is a really good reference: http://www.ibm.com/developerworks/linux/library/l-dynamic-libraries/. It contains a bibliography at the end of a variety of different references at different levels. If you want to know every gory detail you can go straight to the source: http://www.akkadia.org/drepper/dsohowto.pdf. (Ulrich Drepper wrote the Linux ...


11

I think that /bin/true has to be the oldest working .. Well, can you call a zero-byte file a binary? touch /tmp/old_true chmod 755 /tmp/old_true /tmp/old_true echo $?


11

Later edit: only this one does what jan needs: thank you huygens; find . -exec file {} \; | grep -i elf


11

When you see a file named .so, it’s not necessarily a shared library. These files are used when linking a program at build-time, not run-time; they are commonly symlinks to the real shared library, but at least on systems using GNU ld they can also be linker scripts, and that’s perfectly OK. If you look on a modern glibc-based system you’ll find that libc.so ...


10

A user generally encounters three types of ELF files—.o files, regular executables, and shared libraries. While all of these files serve different purposes, their internal structure files are quite similar. One universal concept among all different ELF file types (and also a.out and many other executable file formats) is the notion of a section. A section ...


10

There is such a variety of platforms and software environments both *nix and other, that the software may be able to be run on, that allowing you to build an application (or library to use with applications) is the only realistic way to support as many combination of those components as a "good" software item does. Of course, licences such as the GPL ...


10

Android and Linux are two different operating systems. You can't just take an executable from one and run it on the other. The first hurdle is the kernel. Android and Linux are based on the same kernel, but they have a few different features. In particular, Android provides binders, which only exist in the mainstream kernel (the one found in Linux ...


9

Like in the standard od command or hd, it means all the elided lines are the same as the preceding line. You can pass -v to make it display those lines anyway. From hexdump(1): The -v option causes hexdump to display all input data. Without the -v option, any number of groups of output lines, which would be identical to the immediately preceding group of ...


9

First, your question is based on a flawed premise. Programs are distributed in compiled format! The normal way to install software on Ubuntu, like on most other Linux distributions, and more generally on most Unix variants, is to install a package. On Ubuntu, you open the software center or some other package manager and browse the available software. When ...


8

There are few differences between ELF executables on different platforms. “UNIX - System V” is the common ground; System V is where the ELF format came from. The corresponding numerical value is 0. This value indicates that the executable doesn't use any OS-specific extension. Debian GNU/Linux, at least, configures GCC/binutils to generate executables with ...


8

It's not the case for Linux (just checked...), but on other systems (such as BSDs, e.g., OSX) doing this will remove any setuid/setgid permissions as a side-effect. Also (still looking at OSX), the ownership of the file may change (to the user doing the writing). For Linux, I recall that early on, stripping a shared library would prevent linking to it. ...


8

On Linux, there are two implementations of readelf: readelf from GNU binutils eu-readelf from elfutils The tools from elfutils were written to be smaller, faster, and more featureful than those in binutils. You can read more about it here (I, II, III)


6

Look in /proc/$pid/maps. The address ranges are over 32-bit addresses (8 hexadecimal digits) or 64-bit addresses (16 hexadecimal digits). This works for any kind of executable, no matter what format. You can only get information about processes running as the same user (unless you're root). if ! [ -e /proc/$pid/maps ]; then echo No such process elif grep -...


6

The answer is "Other". You can get a glimpse of the memory layout with cat /proc/self/maps. On my 64-bit Arch laptop:: 00400000-0040c000 r-xp 00000000 08:02 1186758 /usr/bin/cat 0060b000-0060c000 r--p 0000b000 08:02 1186758 /usr/bin/cat 0060c000-0060d000 rw-p 0000c000 08:02 1186758 ...


6

I think the best bet is for you to acquire another SGI machine, unfortunately. There are several open source MIPS emulators but their functionality does vary. Available emulators include: GXemul Qemu Update: Newer releases of MAME are now able to run certain releases of IRIX, emulating an Indy. Instructions are available on the IRIX Network Wiki.


6

If it's just between ELF and script, you may not need file at all. With bash: IFS= LC_ALL=C read -rn4 -d '' x < file case $x in ($'\x7fELF') echo ELF;; ("#!"*) echo script;; (*) echo other;; esac (-d '' (to use NUL character as delimiter) is to work around the fact that bash's read otherwise just ignores the NUL bytes in the input). See also: ...


6

Most distributions, including OpenSUSE, strip executables as part of their build scripts. You don't need to strip on the system's executables because it's already been done. There are binaries that must not be stripped. Package maintainers take care to use correct build options to avoid stripping them. This includes binaries that load libraries dynamically ...


5

In your ld.so.preload, you want to specify "$LIB" in your path rather than an explicit "lib" or "lib64". Thus, on a Redhat-style distro, "/usr/alternates/$LIB/libfoo.so" becomes "/usr/alternates/lib/libfoo.so" for a 32-bit process and "/usr/alternates/lib64/libfoo.so" for a 64-bit process. On an Debian-style distro, "/usr/alternates/$LIB/libfoo.so" becomes "/...


5

readelf or objdump both can do this. ELF file compiled by gcc will add .note.ABI-tag and .note.gnu.build-id two sections. both could displayed by objdump -sj .note.ABI-tag ELFFILE objdump -sj .note.gnu-build-id ELFFILE option "s" means display full contents, "j" for indicate section name. This style get hex contents of that sections. readelf -n will ...


5

There are two methods . Both will give the same result objdump -s --section .comment path/to/binary Using readelf command, readelf -S binary will display the 40 section headers in the binary . Note the serial number of .comment section header. In my system , it showed as 27 (may be different for your case) readelf -x 30 path/to/binary -> which ...


5

Linux runs on more than just one particular CPU platform. If you distributed ELF files (or any other kind of raw executable), there'd be a chance that some versions of Linux couldn't run the software. In the spirit of making software as widely available as possible, using the source code is preferred. For example, Linux runs on Sparc, Intel, AMD, ARM, and ...


5

The original reason for distribution as source certainly was platform diversity; the Linux community has continued that methodology both for that and for new, partially political, reasons. Unlike e.g. Windows, Linux has historically never bothered to keep any ABI (application binary interface) stable across long periods of time - keeping the possibility to ...


5

objdump shows the disassembled code because that's its job. It knows the format of the executable file. Executables are not just a straight sequence of instructions: they have structure. Executables typically start with a header containing various metadata and are organized in sections. Dynamically linked executables necessarily contain enough information ...


Only top voted, non community-wiki answers of a minimum length are eligible