git Service of IN-Ulm e.V. Explore Help
Sign In
cbiedl
/
file
1
0
Fork 0
Files Pull Requests 0 Wiki
Tree: 62701ad432
Branches Tags
file
/
magic
/
Magdir
/
elf

elf 7.8 KB
History Raw

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224 
  1. 

  2. #------------------------------------------------------------------------------
    3. 

  3. # elf:  file(1) magic for ELF executables
    4. 

  4. #
    5. 

  5. # We have to check the byte order flag to see what byte order all the
    6. 

  6. # other stuff in the header is in.
    7. 

  7. #
    8. 

  8. # What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
    9. 

  9. #
    10. 

  10. # updated by Daniel Quinlan (quinlan@yggdrasil.com)
    11. 

  11. 0	string		\177ELF		ELF
    12. 

  12. >4	byte		0		invalid class
    13. 

  13. >4	byte		1		32-bit
    14. 

  14. >4	byte		2		64-bit
    15. 

  15. >5	byte		0		invalid byte order
    16. 

  16. >5	byte		1		LSB
    17. 

  17. >>16	leshort		0		no file type,
    18. 

  18. >>16	leshort		1		relocatable,
    19. 

  19. >>16	leshort		2		executable,
    20. 

  20. >>16	leshort		3		shared object,
    21. 

  21. # Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
    22. 

  22. # corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
    23. 

  23. >>16	leshort		4		core file
    24. 

  24. # Core file detection is not reliable.
    25. 

  25. #>>>(0x38+0xcc) string	>\0		of '%s'
    26. 

  26. #>>>(0x38+0x10) lelong	>0		(signal %d),
    27. 

  27. >>16	leshort		&0xff00		processor-specific,
    28. 

  28. >>18	leshort		0		no machine,
    29. 

  29. >>18	leshort		1		AT&T WE32100 - invalid byte order,
    30. 

  30. >>18	leshort		2		SPARC - invalid byte order,
    31. 

  31. >>18	leshort		3		Intel 80386,
    32. 

  32. >>18	leshort		4		Motorola
    33. 

  33. >>>36	lelong		&0x01000000	68000 - invalid byte order,
    34. 

  34. >>>36	lelong		&0x00810000	CPU32 - invalid byte order,
    35. 

  35. >>>36	lelong		0		68020 - invalid byte order,
    36. 

  36. >>18	leshort		5		Motorola 88000 - invalid byte order,
    37. 

  37. >>18	leshort		6		Intel 80486,
    38. 

  38. >>18	leshort		7		Intel 80860,
    39. 

  39. # The official e_machine number for MIPS is now #8, regardless of endianness.
    40. 

  40. # The second number (#10) will be deprecated later. For now, we still
    41. 

  41. # say something if #10 is encountered, but only gory details for #8.
    42. 

  42. >>18	leshort		8		MIPS,
    43. 

  43. >>>36	lelong		&0x20		N32
    44. 

  44. >>18	leshort		10		MIPS,
    45. 

  45. >>>36	lelong		&0x20		N32
    46. 

  46. >>18	leshort		8
    47. 

  47. # only for 32-bit
    48. 

  48. >>>4	byte		1
    49. 

  49. >>>>36  lelong&0xf0000000	0x00000000	MIPS-I
    50. 

  50. >>>>36  lelong&0xf0000000	0x10000000	MIPS-II
    51. 

  51. >>>>36  lelong&0xf0000000	0x20000000	MIPS-III
    52. 

  52. >>>>36  lelong&0xf0000000	0x30000000	MIPS-IV
    53. 

  53. >>>>36  lelong&0xf0000000	0x40000000	MIPS-V
    54. 

  54. >>>>36  lelong&0xf0000000	0x5fffffff	MIPS32
    55. 

  55. >>>>36  lelong&0xf0000000	0x70000000	MIPS64
    56. 

  56. >>>>36  lelong&0xf0000000	0x80000000	MIPS32 rel2
    57. 

  57. >>>>36  lelong&0xf0000000	0x90000000	MIPS64 rel2
    58. 

  58. # only for 64-bit
    59. 

  59. >>>4	byte		2
    60. 

  60. >>>>48  lelong&0xf0000000	0x00000000	MIPS-I
    61. 

  61. >>>>48  lelong&0xf0000000	0x10000000	MIPS-II
    62. 

  62. >>>>48  lelong&0xf0000000	0x20000000	MIPS-III
    63. 

  63. >>>>48  lelong&0xf0000000	0x30000000	MIPS-IV
    64. 

  64. >>>>48  lelong&0xf0000000	0x40000000	MIPS-V
    65. 

  65. >>>>48  lelong&0xf0000000	0x60000000	MIPS32
    66. 

  66. >>>>48  lelong&0xf0000000	0x70000000	MIPS64 
    67. 

  67. >>>>48  lelong&0xf0000000	0x80000000	MIPS32 rel2
    68. 

  68. >>>>48  lelong&0xf0000000	0x90000000	MIPS64 rel2
    69. 

  69. >>18	leshort		9		Amdahl - invalid byte order,
    70. 

  70. >>18	leshort		10		MIPS (deprecated),
    71. 

  71. >>18	leshort		11		RS6000 - invalid byte order,
    72. 

  72. >>18	leshort		15		PA-RISC - invalid byte order,
    73. 

  73. >>>50	leshort		0x0214		2.0
    74. 

  74. >>>48	leshort		&0x0008		(LP64),
    75. 

  75. >>18	leshort		16		nCUBE,
    76. 

  76. >>18	leshort		17		Fujitsu VPP500,
    77. 

  77. >>18	leshort		18		SPARC32PLUS,
    78. 

  78. >>18	leshort		20		PowerPC,
    79. 

  79. >>18	leshort		22		IBM S/390,
    80. 

  80. >>18	leshort		36		NEC V800,
    81. 

  81. >>18	leshort		37		Fujitsu FR20,
    82. 

  82. >>18	leshort		38		TRW RH-32,
    83. 

  83. >>18	leshort		39		Motorola RCE,
    84. 

  84. >>18	leshort		40		ARM,
    85. 

  85. >>18	leshort		41		Alpha,
    86. 

  86. >>18	leshort		0xa390		IBM S/390 (obsolete),
    87. 

  87. >>18	leshort		42		Renesas SH,
    88. 

  88. >>18	leshort		43		SPARC V9 - invalid byte order,
    89. 

  89. >>18	leshort		44		Siemens Tricore Embedded Processor,
    90. 

  90. >>18	leshort		45		Argonaut RISC Core, Argonaut Technologies Inc.,
    91. 

  91. >>18	leshort		46		Renesas H8/300,
    92. 

  92. >>18	leshort		47		Renesas H8/300H,
    93. 

  93. >>18	leshort		48		Renesas H8S,
    94. 

  94. >>18	leshort		49		Renesas H8/500,
    95. 

  95. >>18	leshort		50		IA-64,
    96. 

  96. >>18	leshort		51		Stanford MIPS-X,
    97. 

  97. >>18	leshort		52		Motorola Coldfire,
    98. 

  98. >>18	leshort		53		Motorola M68HC12,
    99. 

  99. >>18	leshort		62		x86-64,
    100. 

  100. >>18	leshort		75		Digital VAX,
    101. 

  101. >>18	leshort		88		Renesas M32R,
    102. 

  102. >>18	leshort		94		Tensilica Xtensa,
    103. 

  103. >>18	leshort		97		NatSemi 32k,
    104. 

  104. >>18	leshort		0x9026		Alpha (unofficial),
    105. 

  105. >>20	lelong		0		invalid version
    106. 

  106. >>20	lelong		1		version 1
    107. 

  107. >>36	lelong		1		MathCoPro/FPU/MAU Required
    108. 

  108. >5	byte		2		MSB
    109. 

  109. >>16	beshort		0		no file type,
    110. 

  110. >>16	beshort		1		relocatable,
    111. 

  111. >>16	beshort		2		executable,
    112. 

  112. >>16	beshort		3		shared object,
    113. 

  113. >>16	beshort		4		core file,
    114. 

  114. #>>>(0x38+0xcc) string	>\0		of '%s'
    115. 

  115. #>>>(0x38+0x10) belong	>0		(signal %d),
    116. 

  116. >>16	beshort		&0xff00		processor-specific,
    117. 

  117. >>18	beshort		0		no machine,
    118. 

  118. >>18	beshort		1		AT&T WE32100,
    119. 

  119. >>18	beshort		2		SPARC,
    120. 

  120. >>18	beshort		3		Intel 80386 - invalid byte order,
    121. 

  121. >>18	beshort		4		Motorola
    122. 

  122. >>>36	belong		&0x01000000	68000,
    123. 

  123. >>>36	belong		&0x00810000	CPU32,
    124. 

  124. >>>36	belong		0		68020,
    125. 

  125. >>18	beshort		5		Motorola 88000,
    126. 

  126. >>18	beshort		6		Intel 80486 - invalid byte order,
    127. 

  127. >>18	beshort		7		Intel 80860,
    128. 

  128. # only for MIPS - see comment in little-endian section above.
    129. 

  129. >>18	beshort		8		MIPS,
    130. 

  130. >>>36	belong		&0x20		N32
    131. 

  131. >>18	beshort		10		MIPS,
    132. 

  132. >>>36	belong		&0x20		N32
    133. 

  133. >>18	beshort		8
    134. 

  134. # only for 32-bit
    135. 

  135. >>>4	byte		1
    136. 

  136. >>>>36  belong&0xf0000000	0x00000000	MIPS-I
    137. 

  137. >>>>36  belong&0xf0000000	0x10000000	MIPS-II
    138. 

  138. >>>>36  belong&0xf0000000	0x20000000	MIPS-III
    139. 

  139. >>>>36  belong&0xf0000000	0x30000000	MIPS-IV
    140. 

  140. >>>>36  belong&0xf0000000	0x40000000	MIPS-V
    141. 

  141. >>>>36  belong&0xf0000000	0x60000000	MIPS32
    142. 

  142. >>>>36  belong&0xf0000000	0x70000000	MIPS64
    143. 

  143. >>>>36  belong&0xf0000000	0x80000000	MIPS32 rel2
    144. 

  144. >>>>36  belong&0xf0000000	0x90000000	MIPS64 rel2
    145. 

  145. # only for 64-bit
    146. 

  146. >>>4	byte		2
    147. 

  147. >>>>48	belong&0xf0000000	0x00000000	MIPS-I
    148. 

  148. >>>>48	belong&0xf0000000	0x10000000	MIPS-II
    149. 

  149. >>>>48	belong&0xf0000000	0x20000000	MIPS-III
    150. 

  150. >>>>48	belong&0xf0000000	0x30000000	MIPS-IV
    151. 

  151. >>>>48	belong&0xf0000000	0x40000000	MIPS-V
    152. 

  152. >>>>48	belong&0xf0000000	0x60000000	MIPS32
    153. 

  153. >>>>48	belong&0xf0000000	0x70000000	MIPS64 
    154. 

  154. >>>>48	belong&0xf0000000	0x80000000	MIPS32 rel2
    155. 

  155. >>>>48	belong&0xf0000000	0x90000000	MIPS64 rel2
    156. 

  156. >>18	beshort		9		Amdahl,
    157. 

  157. >>18	beshort		10		MIPS (deprecated),
    158. 

  158. >>18	beshort		11		RS6000,
    159. 

  159. >>18	beshort		15		PA-RISC
    160. 

  160. >>>50	beshort		0x0214		2.0
    161. 

  161. >>>48	beshort		&0x0008		(LP64)
    162. 

  162. >>18	beshort		16		nCUBE,
    163. 

  163. >>18	beshort		17		Fujitsu VPP500,
    164. 

  164. >>18	beshort		18		SPARC32PLUS,
    165. 

  165. >>>36	belong&0xffff00	&0x000100	V8+ Required,
    166. 

  166. >>>36	belong&0xffff00	&0x000200	Sun UltraSPARC1 Extensions Required,
    167. 

  167. >>>36	belong&0xffff00	&0x000400	HaL R1 Extensions Required,
    168. 

  168. >>>36	belong&0xffff00	&0x000800	Sun UltraSPARC3 Extensions Required,
    169. 

  169. >>18	beshort		20		PowerPC or cisco 4500,
    170. 

  170. >>18	beshort		21		PowerPC 64-bit or cisco 7500,
    171. 

  171. >>18	beshort		22		IBM S/390,
    172. 

  172. >>18	beshort		24		cisco SVIP,
    173. 

  173. >>18	beshort		25		cisco 7200,
    174. 

  174. >>18	beshort		36		NEC V800 or cisco 12000,
    175. 

  175. >>18	beshort		37		Fujitsu FR20,
    176. 

  176. >>18	beshort		38		TRW RH-32,
    177. 

  177. >>18	beshort		39		Motorola RCE,
    178. 

  178. >>18	beshort		40		ARM,
    179. 

  179. >>18	beshort		41		Alpha,
    180. 

  180. >>18	beshort		42		Renesas SH,
    181. 

  181. >>18	beshort		43		SPARC V9,
    182. 

  182. >>18	beshort		44		Siemens Tricore Embedded Processor,
    183. 

  183. >>18	beshort		45		Argonaut RISC Core, Argonaut Technologies Inc.,
    184. 

  184. >>18	beshort		46		Renesas H8/300,
    185. 

  185. >>18	beshort		47		Renesas H8/300H,
    186. 

  186. >>18	beshort		48		Renesas H8S,
    187. 

  187. >>18	beshort		49		Renesas H8/500,
    188. 

  188. >>18	beshort		50		IA-64,
    189. 

  189. >>18	beshort		51		Stanford MIPS-X,
    190. 

  190. >>18	beshort		52		Motorola Coldfire,
    191. 

  191. >>18	beshort		53		Motorola M68HC12,
    192. 

  192. >>18	beshort		73		Cray NV1,
    193. 

  193. >>18	beshort		75		Digital VAX,
    194. 

  194. >>18	beshort		88		Renesas M32R,
    195. 

  195. >>18	beshort		94		Tensilica Xtensa,
    196. 

  196. >>18	beshort		97		NatSemi 32k,
    197. 

  197. >>18	beshort		0x9026		Alpha (unofficial),
    198. 

  198. >>18	beshort		0xa390		IBM S/390 (obsolete),
    199. 

  199. >>20	belong		0		invalid version
    200. 

  200. >>20	belong		1		version 1
    201. 

  201. >>36	belong		1		MathCoPro/FPU/MAU Required
    202. 

  202. # Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
    203. 

  203. # like proper ELF, but extracting the string had bad results.
    204. 

  204. >4      byte            <0x80
    205. 

  205. >>8	string		>\0		(%s)
    206. 

  206. >8	string		\0
    207. 

  207. >>7	byte		0		(SYSV)
    208. 

  208. >>7	byte		1		(HP-UX)
    209. 

  209. >>7	byte		2		(NetBSD)
    210. 

  210. >>7	byte		3		(GNU/Linux)
    211. 

  211. >>7	byte		4		(GNU/Hurd)
    212. 

  212. >>7	byte		5		(86Open)
    213. 

  213. >>7	byte		6		(Solaris)
    214. 

  214. >>7	byte		7		(Monterey)
    215. 

  215. >>7	byte		8		(IRIX)
    216. 

  216. >>7	byte		9		(FreeBSD)
    217. 

  217. >>7	byte		10		(Tru64)
    218. 

  218. >>7	byte		11		(Novell Modesto)
    219. 

  219. >>7	byte		12		(OpenBSD)
    220. 

  220. # VMS Itanium added by gerardo.cacciari@gmail.com
    221. 

  221. >8      string          \2
    222. 

  222. >>7     byte            13              (OpenVMS)
    223. 

  223. >>7	byte		97		(ARM)
    224. 

  224. >>7	byte		255		(embedded)
    225.