git Service of IN-Ulm e.V. Explore Help
Sign In
cbiedl
/
file
1
0
Fork 0
Files Pull Requests 0 Wiki
Tree: 927e10538d
Branches Tags
file
/
magic
/
Magdir
/
elf

elf 7.8 KB
History Raw

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222 
  1. 

  2. #------------------------------------------------------------------------------
    3. 

  3. # elf:  file(1) magic for ELF executables
    4. 

  4. #
    5. 

  5. # We have to check the byte order flag to see what byte order all the
    6. 

  6. # other stuff in the header is in.
    7. 

  7. #
    8. 

  8. # What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
    9. 

  9. #
    10. 

  10. # updated by Daniel Quinlan (quinlan@yggdrasil.com)
    11. 

  11. 0	string		\177ELF		ELF
    12. 

  12. >4	byte		0		invalid class
    13. 

  13. >4	byte		1		32-bit
    14. 

  14. # only for MIPS - in the future, the ABI field of e_flags should be used.
    15. 

  15. >>18	leshort		8
    16. 

  16. >>>36	lelong		&0x20		N32
    17. 

  17. >>18	leshort		10
    18. 

  18. >>>36	lelong		&0x20		N32
    19. 

  19. >>18	beshort		8
    20. 

  20. >>>36	belong		&0x20		N32
    21. 

  21. >>18	beshort		10
    22. 

  22. >>>36	belong		&0x20		N32
    23. 

  23. >4	byte		2		64-bit
    24. 

  24. >5	byte		0		invalid byte order
    25. 

  25. >5	byte		1		LSB
    26. 

  26. # The official e_machine number for MIPS is now #8, regardless of endianness.
    27. 

  27. # The second number (#10) will be deprecated later. For now, we still
    28. 

  28. # say something if #10 is encountered, but only gory details for #8.
    29. 

  29. >>18    leshort		8
    30. 

  30. # only for 32-bit
    31. 

  31. >>>4	byte		1
    32. 

  32. >>>>36  lelong&0xf0000000	0x00000000	MIPS-I
    33. 

  33. >>>>36  lelong&0xf0000000	0x10000000	MIPS-II
    34. 

  34. >>>>36  lelong&0xf0000000	0x20000000	MIPS-III
    35. 

  35. >>>>36  lelong&0xf0000000	0x30000000	MIPS-IV
    36. 

  36. >>>>36  lelong&0xf0000000	0x40000000	MIPS-V
    37. 

  37. >>>>36  lelong&0xf0000000	0x60000000	MIPS32
    38. 

  38. >>>>36  lelong&0xf0000000	0x70000000	MIPS64
    39. 

  39. >>>>36  lelong&0xf0000000	0x80000000	MIPS32 rel2
    40. 

  40. >>>>36  lelong&0xf0000000	0x90000000	MIPS64 rel2
    41. 

  41. # only for 64-bit
    42. 

  42. >>>4	byte		2
    43. 

  43. >>>>48  lelong&0xf0000000	0x00000000	MIPS-I
    44. 

  44. >>>>48  lelong&0xf0000000	0x10000000	MIPS-II
    45. 

  45. >>>>48  lelong&0xf0000000	0x20000000	MIPS-III
    46. 

  46. >>>>48  lelong&0xf0000000	0x30000000	MIPS-IV
    47. 

  47. >>>>48  lelong&0xf0000000	0x40000000	MIPS-V
    48. 

  48. >>>>48  lelong&0xf0000000	0x60000000	MIPS32
    49. 

  49. >>>>48  lelong&0xf0000000	0x70000000	MIPS64 
    50. 

  50. >>>>48  lelong&0xf0000000	0x80000000	MIPS32 rel2
    51. 

  51. >>>>48  lelong&0xf0000000	0x90000000	MIPS64 rel2
    52. 

  52. >>16	leshort		0		no file type,
    53. 

  53. >>16	leshort		1		relocatable,
    54. 

  54. >>16	leshort		2		executable,
    55. 

  55. >>16	leshort		3		shared object,
    56. 

  56. # Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
    57. 

  57. # corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
    58. 

  58. >>16	leshort		4		core file
    59. 

  59. # Core file detection is not reliable.
    60. 

  60. #>>>(0x38+0xcc) string	>\0		of '%s'
    61. 

  61. #>>>(0x38+0x10) lelong	>0		(signal %d),
    62. 

  62. >>16	leshort		&0xff00		processor-specific,
    63. 

  63. >>18	leshort		0		no machine,
    64. 

  64. >>18	leshort		1		AT&T WE32100 - invalid byte order,
    65. 

  65. >>18	leshort		2		SPARC - invalid byte order,
    66. 

  66. >>18	leshort		3		Intel 80386,
    67. 

  67. >>18	leshort		4		Motorola
    68. 

  68. >>>36	lelong		&0x01000000	68000 - invalid byte order,
    69. 

  69. >>>36	lelong		&0x00810000	CPU32 - invalid byte order,
    70. 

  70. >>>36	lelong		0		68020 - invalid byte order,
    71. 

  71. >>18	leshort		5		Motorola 88000 - invalid byte order,
    72. 

  72. >>18	leshort		6		Intel 80486,
    73. 

  73. >>18	leshort		7		Intel 80860,
    74. 

  74. >>18	leshort		8		MIPS,
    75. 

  75. >>18	leshort		9		Amdahl - invalid byte order,
    76. 

  76. >>18	leshort		10		MIPS (deprecated),
    77. 

  77. >>18	leshort		11		RS6000 - invalid byte order,
    78. 

  78. >>18	leshort		15		PA-RISC - invalid byte order,
    79. 

  79. >>>50	leshort		0x0214		2.0
    80. 

  80. >>>48	leshort		&0x0008		(LP64),
    81. 

  81. >>18	leshort		16		nCUBE,
    82. 

  82. >>18	leshort		17		Fujitsu VPP500,
    83. 

  83. >>18	leshort		18		SPARC32PLUS,
    84. 

  84. >>18	leshort		20		PowerPC,
    85. 

  85. >>18	leshort		22		IBM S/390,
    86. 

  86. >>18	leshort		36		NEC V800,
    87. 

  87. >>18	leshort		37		Fujitsu FR20,
    88. 

  88. >>18	leshort		38		TRW RH-32,
    89. 

  89. >>18	leshort		39		Motorola RCE,
    90. 

  90. >>18	leshort		40		ARM,
    91. 

  91. >>18	leshort		41		Alpha,
    92. 

  92. >>18	leshort		0xa390		IBM S/390 (obsolete),
    93. 

  93. >>18	leshort		42		Hitachi SH,
    94. 

  94. >>18	leshort		43		SPARC V9 - invalid byte order,
    95. 

  95. >>18	leshort		44		Siemens Tricore Embedded Processor,
    96. 

  96. >>18	leshort		45		Argonaut RISC Core, Argonaut Technologies Inc.,
    97. 

  97. >>18	leshort		46		Hitachi H8/300,
    98. 

  98. >>18	leshort		47		Hitachi H8/300H,
    99. 

  99. >>18	leshort		48		Hitachi H8S,
    100. 

  100. >>18	leshort		49		Hitachi H8/500,
    101. 

  101. >>18	leshort		50		IA-64 (Intel 64 bit architecture)
    102. 

  102. >>18	leshort		51		Stanford MIPS-X,
    103. 

  103. >>18	leshort		52		Motorola Coldfire,
    104. 

  104. >>18	leshort		53		Motorola M68HC12,
    105. 

  105. >>18	leshort		62		AMD x86-64,
    106. 

  106. >>18	leshort		75		Digital VAX,
    107. 

  107. >>18	leshort		88		Renesas M32R,
    108. 

  108. >>18	leshort		97		NatSemi 32k,
    109. 

  109. >>18	leshort		0x9026		Alpha (unofficial),
    110. 

  110. >>20	lelong		0		invalid version
    111. 

  111. >>20	lelong		1		version 1
    112. 

  112. >>36	lelong		1		MathCoPro/FPU/MAU Required
    113. 

  113. >5	byte		2		MSB
    114. 

  114. # only for MIPS - see comment in little-endian section above.
    115. 

  115. >>18    beshort		8
    116. 

  116. # only for 32-bit
    117. 

  117. >>>4	byte		1
    118. 

  118. >>>>36  belong&0xf0000000	0x00000000	MIPS-I
    119. 

  119. >>>>36  belong&0xf0000000	0x10000000	MIPS-II
    120. 

  120. >>>>36  belong&0xf0000000	0x20000000	MIPS-III
    121. 

  121. >>>>36  belong&0xf0000000	0x30000000	MIPS-IV
    122. 

  122. >>>>36  belong&0xf0000000	0x40000000	MIPS-V
    123. 

  123. >>>>36  belong&0xf0000000	0x60000000	MIPS32
    124. 

  124. >>>>36  belong&0xf0000000	0x70000000	MIPS64
    125. 

  125. >>>>36  belong&0xf0000000	0x80000000	MIPS32 rel2
    126. 

  126. >>>>36  belong&0xf0000000	0x90000000	MIPS64 rel2
    127. 

  127. # only for 64-bit
    128. 

  128. >>>4	byte		2
    129. 

  129. >>>>48	belong&0xf0000000	0x00000000	MIPS-I
    130. 

  130. >>>>48	belong&0xf0000000	0x10000000	MIPS-II
    131. 

  131. >>>>48	belong&0xf0000000	0x20000000	MIPS-III
    132. 

  132. >>>>48	belong&0xf0000000	0x30000000	MIPS-IV
    133. 

  133. >>>>48	belong&0xf0000000	0x40000000	MIPS-V
    134. 

  134. >>>>48	belong&0xf0000000	0x60000000	MIPS32
    135. 

  135. >>>>48	belong&0xf0000000	0x70000000	MIPS64 
    136. 

  136. >>>>48	belong&0xf0000000	0x80000000	MIPS32 rel2
    137. 

  137. >>>>48	belong&0xf0000000	0x90000000	MIPS64 rel2
    138. 

  138. >>16	beshort		0		no file type,
    139. 

  139. >>16	beshort		1		relocatable,
    140. 

  140. >>16	beshort		2		executable,
    141. 

  141. >>16	beshort		3		shared object,
    142. 

  142. >>16	beshort		4		core file,
    143. 

  143. #>>>(0x38+0xcc) string	>\0		of '%s'
    144. 

  144. #>>>(0x38+0x10) belong	>0		(signal %d),
    145. 

  145. >>16	beshort		&0xff00		processor-specific,
    146. 

  146. >>18	beshort		0		no machine,
    147. 

  147. >>18	beshort		1		AT&T WE32100,
    148. 

  148. >>18	beshort		2		SPARC,
    149. 

  149. >>18	beshort		3		Intel 80386 - invalid byte order,
    150. 

  150. >>18	beshort		4		Motorola
    151. 

  151. >>>36	belong		&0x01000000	68000,
    152. 

  152. >>>36	belong		&0x00810000	CPU32,
    153. 

  153. >>>36	belong		0		68020,
    154. 

  154. >>18	beshort		5		Motorola 88000,
    155. 

  155. >>18	beshort		6		Intel 80486 - invalid byte order,
    156. 

  156. >>18	beshort		7		Intel 80860,
    157. 

  157. >>18	beshort		8		MIPS,
    158. 

  158. >>18	beshort		9		Amdahl,
    159. 

  159. >>18	beshort		10		MIPS (deprecated),
    160. 

  160. >>18	beshort		11		RS6000,
    161. 

  161. >>18	beshort		15		PA-RISC
    162. 

  162. >>>50	beshort		0x0214		2.0
    163. 

  163. >>>48	beshort		&0x0008		(LP64)
    164. 

  164. >>18	beshort		16		nCUBE,
    165. 

  165. >>18	beshort		17		Fujitsu VPP500,
    166. 

  166. >>18	beshort		18		SPARC32PLUS,
    167. 

  167. >>>36	belong&0xffff00	&0x000100	V8+ Required,
    168. 

  168. >>>36	belong&0xffff00	&0x000200	Sun UltraSPARC1 Extensions Required,
    169. 

  169. >>>36	belong&0xffff00	&0x000400	HaL R1 Extensions Required,
    170. 

  170. >>>36	belong&0xffff00	&0x000800	Sun UltraSPARC3 Extensions Required,
    171. 

  171. >>18	beshort		20		PowerPC or cisco 4500,
    172. 

  172. >>18	beshort		21		cisco 7500,
    173. 

  173. >>18	beshort		22		IBM S/390,
    174. 

  174. >>18	beshort		24		cisco SVIP,
    175. 

  175. >>18	beshort		25		cisco 7200,
    176. 

  176. >>18	beshort		36		NEC V800 or cisco 12000,
    177. 

  177. >>18	beshort		37		Fujitsu FR20,
    178. 

  178. >>18	beshort		38		TRW RH-32,
    179. 

  179. >>18	beshort		39		Motorola RCE,
    180. 

  180. >>18	beshort		40		ARM,
    181. 

  181. >>18	beshort		41		Alpha,
    182. 

  182. >>18	beshort		42		Hitachi SH,
    183. 

  183. >>18	beshort		43		SPARC V9,
    184. 

  184. >>18	beshort		44		Siemens Tricore Embedded Processor,
    185. 

  185. >>18	beshort		45		Argonaut RISC Core, Argonaut Technologies Inc.,
    186. 

  186. >>18	beshort		46		Hitachi H8/300,
    187. 

  187. >>18	beshort		47		Hitachi H8/300H,
    188. 

  188. >>18	beshort		48		Hitachi H8S,
    189. 

  189. >>18	beshort		49		Hitachi H8/500,
    190. 

  190. >>18	beshort		50		Intel Merced Processor,
    191. 

  191. >>18	beshort		51		Stanford MIPS-X,
    192. 

  192. >>18	beshort		52		Motorola Coldfire,
    193. 

  193. >>18	beshort		53		Motorola M68HC12,
    194. 

  194. >>18	beshort		73		Cray NV1,
    195. 

  195. >>18	beshort		75		Digital VAX,
    196. 

  196. >>18	beshort		88		Renesas M32R,
    197. 

  197. >>18	beshort		97		NatSemi 32k,
    198. 

  198. >>18	beshort		0x9026		Alpha (unofficial),
    199. 

  199. >>18	beshort		0xa390		IBM S/390 (obsolete),
    200. 

  200. >>20	belong		0		invalid version
    201. 

  201. >>20	belong		1		version 1
    202. 

  202. >>36	belong		1		MathCoPro/FPU/MAU Required
    203. 

  203. # Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
    204. 

  204. # like proper ELF, but extracting the string had bad results.
    205. 

  205. >4      byte            <0x80
    206. 

  206. >>8	string		>\0		(%s)
    207. 

  207. >8	string		\0
    208. 

  208. >>7	byte		0		(SYSV)
    209. 

  209. >>7	byte		1		(HP-UX)
    210. 

  210. >>7	byte		2		(NetBSD)
    211. 

  211. >>7	byte		3		(GNU/Linux)
    212. 

  212. >>7	byte		4		(GNU/Hurd)
    213. 

  213. >>7	byte		5		(86Open)
    214. 

  214. >>7	byte		6		(Solaris)
    215. 

  215. >>7	byte		7		(Monterey)
    216. 

  216. >>7	byte		8		(IRIX)
    217. 

  217. >>7	byte		9		(FreeBSD)
    218. 

  218. >>7	byte		10		(Tru64)
    219. 

  219. >>7	byte		11		(Novell Modesto)
    220. 

  220. >>7	byte		12		(OpenBSD)
    221. 

  221. >>7	byte		97		(ARM)
    222. 

  222. >>7	byte		255		(embedded)
    223.