file/magic/Magdir/elf

#------------------------------------------------------------------------------
# $File: elf,v 1.64 2013/08/04 09:31:47 christos Exp $
# elf:  file(1) magic for ELF executables
#
# We have to check the byte order flag to see what byte order all the
# other stuff in the header is in.
#
# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
#
# Created by: unknown
# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com>
# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support)
# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support)
# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium)
# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures)

0	name		elf-le
>16	leshort		0		no file type,
!:mime	application/octet-stream
>16	leshort		1		relocatable,
!:mime	application/x-object
>16	leshort		2		executable,
!:mime	application/x-executable
>16	leshort		3		shared object,
!:mime	application/x-sharedlib
>16	leshort		4		core file
!:mime	application/x-coredump
# Core file detection is not reliable.
#>>>(0x38+0xcc) string	>\0		of '%s'
#>>>(0x38+0x10) lelong	>0		(signal %d),
>16	leshort		&0xff00		processor-specific,
>18	clear		x
>18	leshort		0		no machine,
>18	leshort		1		AT&T WE32100
>18	leshort		2		SPARC
>18	leshort		3		Intel 80386,
>18	leshort		4		Motorola
>>4	byte		1
>>>36	lelong		&0x01000000	68000,
>>>36	lelong		&0x00810000	CPU32,
>>>36	lelong		0		68020,
>18	leshort		5		Motorola 88000,
>18	leshort		6		Intel 80486,
>18	leshort		7		Intel 80860,
# The official e_machine number for MIPS is now #8, regardless of endianness.
# The second number (#10) will be deprecated later. For now, we still
# say something if #10 is encountered, but only gory details for #8.
>18	leshort		8		MIPS,
>>4	byte		1
>>>36	lelong		&0x20		N32
>18	leshort		10		MIPS,
>>4	byte		1
>>>36	lelong		&0x20		N32
>18	leshort		8
# only for 32-bit
>>4	byte		1
>>>36  lelong&0xf0000000	0x00000000	MIPS-I
>>>36  lelong&0xf0000000	0x10000000	MIPS-II
>>>36  lelong&0xf0000000	0x20000000	MIPS-III
>>>36  lelong&0xf0000000	0x30000000	MIPS-IV
>>>36  lelong&0xf0000000	0x40000000	MIPS-V
>>>36  lelong&0xf0000000	0x50000000	MIPS32
>>>36  lelong&0xf0000000	0x60000000	MIPS64
>>>36  lelong&0xf0000000	0x70000000	MIPS32 rel2
>>>36  lelong&0xf0000000	0x80000000	MIPS64 rel2
# only for 64-bit
>>4	byte		2
>>>48  lelong&0xf0000000	0x00000000	MIPS-I
>>>48  lelong&0xf0000000	0x10000000	MIPS-II
>>>48  lelong&0xf0000000	0x20000000	MIPS-III
>>>48  lelong&0xf0000000	0x30000000	MIPS-IV
>>>48  lelong&0xf0000000	0x40000000	MIPS-V
>>>48  lelong&0xf0000000	0x50000000	MIPS32
>>>48  lelong&0xf0000000	0x60000000	MIPS64
>>>48  lelong&0xf0000000	0x70000000	MIPS32 rel2
>>>48  lelong&0xf0000000	0x80000000	MIPS64 rel2
>18	leshort		9		Amdahl,
>18	leshort		10		MIPS (deprecated),
>18	leshort		11		RS6000,
>18	leshort		15		PA-RISC,
# only for 32-bit
>>4	byte		1
>>>38	leshort		0x0214		2.0
>>>36	leshort		&0x0008		(LP64)
# only for 64-bit
>>4	byte		2
>>>50	leshort		0x0214		2.0
>>>48	leshort		&0x0008		(LP64)
>18	leshort		16		nCUBE,
>18	leshort		17		Fujitsu VPP500,
>18	leshort		18		SPARC32PLUS,
# only for 32-bit
>>4	byte		1
>>>36	lelong&0xffff00	0x000100	V8+ Required,
>>>36	lelong&0xffff00	0x000200	Sun UltraSPARC1 Extensions Required,
>>>36	lelong&0xffff00	0x000400	HaL R1 Extensions Required,
>>>36	lelong&0xffff00	0x000800	Sun UltraSPARC3 Extensions Required,
>18	leshort		20		PowerPC or cisco 4500,
>18	leshort		21		64-bit PowerPC or cisco 7500,
>18	leshort		22		IBM S/390,
>18	leshort		23		Cell SPU,
>18	leshort		24		cisco SVIP,
>18	leshort		25		cisco 7200,
>18	leshort		36		NEC V800 or cisco 12000,
>18	leshort		37		Fujitsu FR20,
>18	leshort		38		TRW RH-32,
>18	leshort		39		Motorola RCE,
>18	leshort		40		ARM,
>>4	byte		1
>>>36	lelong&0xff000000	0x04000000	EABI4
>>>36	lelong&0xff000000	0x05000000	EABI5
>>>36	lelong		&0x00800000	BE8
>>>36	lelong		&0x00400000	LE8
>18	leshort		41		Alpha,
>18	leshort		0xa390		IBM S/390 (obsolete),
>18	leshort		42		Renesas SH,
>18	leshort		43		SPARC V9,
>>4	byte		2
>>>48	lelong&0xffff00	0x000200	Sun UltraSPARC1 Extensions Required,
>>>48	lelong&0xffff00	0x000400	HaL R1 Extensions Required,
>>>48	lelong&0xffff00	0x000800	Sun UltraSPARC3 Extensions Required,
>>>48	lelong&0x3	0		total store ordering,
>>>48	lelong&0x3	1		partial store ordering,
>>>48	lelong&0x3	2		relaxed memory ordering,
>18	leshort		44		Siemens Tricore Embedded Processor,
>18	leshort		45		Argonaut RISC Core, Argonaut Technologies Inc.,
>18	leshort		46		Renesas H8/300,
>18	leshort		47		Renesas H8/300H,
>18	leshort		48		Renesas H8S,
>18	leshort		49		Renesas H8/500,
>18	leshort		50		IA-64,
>18	leshort		51		Stanford MIPS-X,
>18	leshort		52		Motorola Coldfire,
>18	leshort		53		Motorola M68HC12,
>18	leshort		54		Fujitsu MMA,
>18	leshort		55		Siemens PCP,
>18	leshort		56		Sony nCPU,
>18	leshort		57		Denso NDR1,
>18	leshort		58		Start*Core,
>18	leshort		59		Toyota ME16,
>18	leshort		60		ST100,
>18	leshort		61		Tinyj emb.,
>18	leshort		62		x86-64,
>18	leshort		63		Sony DSP,
>18	leshort		66		FX66,
>18	leshort		67		ST9+ 8/16 bit,
>18	leshort		68		ST7 8 bit,
>18	leshort		69		MC68HC16,
>18	leshort		70		MC68HC11,
>18	leshort		71		MC68HC08,
>18	leshort		72		MC68HC05,
>18	leshort		73		SGI SVx or Cray NV1,
>18	leshort		74		ST19 8 bit,
>18	leshort		75		Digital VAX,
>18	leshort		76		Axis cris,
>18	leshort		77		Infineon 32-bit embedded,
>18	leshort		78		Element 14 64-bit DSP,
>18	leshort		79		LSI Logic 16-bit DSP,
>18	leshort		80		MMIX,
>18	leshort		81		Harvard machine-independent,
>18	leshort		82		SiTera Prism,
>18	leshort		83		Atmel AVR 8-bit,
>18	leshort		84		Fujitsu FR30,
>18	leshort		85		Mitsubishi D10V,
>18	leshort		86		Mitsubishi D30V,
>18	leshort		87		NEC v850,
>18	leshort		88		Renesas M32R,
>18	leshort		89		Matsushita MN10300,
>18	leshort		90		Matsushita MN10200,
>18	leshort		91		picoJava,
>18	leshort		92		OpenRISC,
>18	leshort		93		ARC Cores Tangent-A5,
>18	leshort		94		Tensilica Xtensa,
>18	leshort		97		NatSemi 32k,
>18	leshort		106		Analog Devices Blackfin,
>18	leshort		113		Altera Nios II,
>18	beshort		138		LatticeMico32,
>18	leshort		174		META,
>18	leshort		183		ARM aarch64,
>18	leshort		187		Tilera TILE64,
>18	leshort		188		Tilera TILEPro,
>18	leshort		191		Tilera TILE-Gx,
>18	leshort		0x3426		OpenRISC (obsolete),
>18	leshort		0x8472		OpenRISC (obsolete),
>18	leshort		0x9026		Alpha (unofficial),
>18	default		x
>>18	leshort		x		*unknown arch 0x%x*
>20	lelong		0		invalid version
>20	lelong		1		version 1

0	string		\177ELF		ELF
!:strength *2
>4	byte		0		invalid class
>4	byte		1		32-bit
>4	byte		2		64-bit
>5	byte		0		invalid byte order
>5	byte		1		LSB
>>0	use		elf-le
>5	byte		2		MSB
>>0	use		\^elf-le
# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
# like proper ELF, but extracting the string had bad results.
>4      byte            <0x80
>>8	string		>\0		(%s)
>8	string		\0
>>7	byte		0		(SYSV)
>>7	byte		1		(HP-UX)
>>7	byte		2		(NetBSD)
>>7	byte		3		(GNU/Linux)
>>7	byte		4		(GNU/Hurd)
>>7	byte		5		(86Open)
>>7	byte		6		(Solaris)
>>7	byte		7		(Monterey)
>>7	byte		8		(IRIX)
>>7	byte		9		(FreeBSD)
>>7	byte		10		(Tru64)
>>7	byte		11		(Novell Modesto)
>>7	byte		12		(OpenBSD)
>8      string          \2
>>7     byte            13              (OpenVMS)
>>7	byte		97		(ARM)
>>7	byte		255		(embedded)