1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
#------------------------------------------------------------------------------
# $File: elf,v 1.59 2013/03/21 17:50:02 christos Exp $
# elf: file(1) magic for ELF executables
#
# We have to check the byte order flag to see what byte order all the
# other stuff in the header is in.
#
# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
#
# Created by: unknown
# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com>
# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support)
# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support)
# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium)
# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures)
0 name elf-le
>16 leshort 0 no file type,
!:mime application/octet-stream
>16 leshort 1 relocatable,
!:mime application/x-object
>16 leshort 2 executable,
!:mime application/x-executable
>16 leshort 3 shared object,
!:mime application/x-sharedlib
>16 leshort 4 core file
!:mime application/x-coredump
# Core file detection is not reliable.
#>>>(0x38+0xcc) string >\0 of '%s'
#>>>(0x38+0x10) lelong >0 (signal %d),
>16 leshort &0xff00 processor-specific,
>18 leshort 0 no machine,
>18 leshort 1 AT&T WE32100
>18 leshort 2 SPARC
>18 leshort 3 Intel 80386,
>18 leshort 4 Motorola
>>4 byte 1
>>>36 lelong &0x01000000 68000 - invalid byte order,
>>>36 lelong &0x00810000 CPU32 - invalid byte order,
>>>36 lelong 0 68020 - invalid byte order,
>18 leshort 5 Motorola 88000 - invalid byte order,
>18 leshort 6 Intel 80486,
>18 leshort 7 Intel 80860,
# The official e_machine number for MIPS is now #8, regardless of endianness.
# The second number (#10) will be deprecated later. For now, we still
# say something if #10 is encountered, but only gory details for #8.
>18 leshort 8 MIPS,
>>4 byte 1
>>>36 lelong &0x20 N32
>18 leshort 10 MIPS,
>>4 byte 1
>>>36 lelong &0x20 N32
>18 leshort 8
# only for 32-bit
>>4 byte 1
>>>36 lelong&0xf0000000 0x00000000 MIPS-I
>>>36 lelong&0xf0000000 0x10000000 MIPS-II
>>>36 lelong&0xf0000000 0x20000000 MIPS-III
>>>36 lelong&0xf0000000 0x30000000 MIPS-IV
>>>36 lelong&0xf0000000 0x40000000 MIPS-V
>>>36 lelong&0xf0000000 0x50000000 MIPS32
>>>36 lelong&0xf0000000 0x60000000 MIPS64
>>>36 lelong&0xf0000000 0x70000000 MIPS32 rel2
>>>36 lelong&0xf0000000 0x80000000 MIPS64 rel2
# only for 64-bit
>>4 byte 2
>>>48 lelong&0xf0000000 0x00000000 MIPS-I
>>>48 lelong&0xf0000000 0x10000000 MIPS-II
>>>48 lelong&0xf0000000 0x20000000 MIPS-III
>>>48 lelong&0xf0000000 0x30000000 MIPS-IV
>>>48 lelong&0xf0000000 0x40000000 MIPS-V
>>>48 lelong&0xf0000000 0x50000000 MIPS32
>>>48 lelong&0xf0000000 0x60000000 MIPS64
>>>48 lelong&0xf0000000 0x70000000 MIPS32 rel2
>>>48 lelong&0xf0000000 0x80000000 MIPS64 rel2
>18 leshort 9 Amdahl - invalid byte order,
>18 leshort 10 MIPS (deprecated),
>18 leshort 11 RS6000 - invalid byte order,
>18 leshort 15 PA-RISC - invalid byte order,
# only for 32-bit
>>4 byte 1
>>>38 leshort 0x0214 2.0
>>>36 leshort &0x0008 (LP64)
# only for 64-bit
>>4 byte 2
>>>50 leshort 0x0214 2.0
>>>48 leshort &0x0008 (LP64)
>18 leshort 16 nCUBE,
>18 leshort 17 Fujitsu VPP500,
>18 leshort 18 SPARC32PLUS,
# only for 32-bit
>>4 byte 1
>>>36 lelong&0xffff00 0x000100 V8+ Required,
>>>36 lelong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required,
>>>36 lelong&0xffff00 0x000400 HaL R1 Extensions Required,
>>>36 lelong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required,
>18 leshort 20 PowerPC or cisco 4500,
>18 leshort 21 64-bit PowerPC or cisco 7500,
>18 leshort 22 IBM S/390,
>18 leshort 23 Cell SPU,
>18 leshort 24 cisco SVIP,
>18 leshort 25 cisco 7200,
>18 leshort 36 NEC V800 or cisco 12000,
>18 leshort 37 Fujitsu FR20,
>18 leshort 38 TRW RH-32,
>18 leshort 39 Motorola RCE,
>18 leshort 40 ARM,
>>4 byte 1
>>>36 lelong&0xff000000 0x04000000 EABI4
>>>36 lelong&0xff000000 0x05000000 EABI5
>18 leshort 41 Alpha,
>18 leshort 0xa390 IBM S/390 (obsolete),
>18 leshort 42 Renesas SH,
>18 leshort 43 SPARC V9,
>>4 byte 2
>>>48 lelong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required,
>>>48 lelong&0xffff00 0x000400 HaL R1 Extensions Required,
>>>48 lelong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required,
>>>48 lelong&0x3 0 total store ordering,
>>>48 lelong&0x3 1 partial store ordering,
>>>48 lelong&0x3 2 relaxed memory ordering,
>18 leshort 44 Siemens Tricore Embedded Processor,
>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
>18 leshort 46 Renesas H8/300,
>18 leshort 47 Renesas H8/300H,
>18 leshort 48 Renesas H8S,
>18 leshort 49 Renesas H8/500,
>18 leshort 50 IA-64,
>18 leshort 51 Stanford MIPS-X,
>18 leshort 52 Motorola Coldfire,
>18 leshort 53 Motorola M68HC12,
>18 leshort 54 Fujitsu MMA,
>18 leshort 55 Siemens PCP,
>18 leshort 56 Sony nCPU,
>18 leshort 57 Denso NDR1,
>18 leshort 58 Start*Core,
>18 leshort 59 Toyota ME16,
>18 leshort 60 ST100,
>18 leshort 61 Tinyj emb.,
>18 leshort 62 x86-64,
>18 leshort 63 Sony DSP,
>18 leshort 66 FX66,
>18 leshort 67 ST9+ 8/16 bit,
>18 leshort 68 ST7 8 bit,
>18 leshort 69 MC68HC16,
>18 leshort 70 MC68HC11,
>18 leshort 71 MC68HC08,
>18 leshort 72 MC68HC05,
>18 leshort 73 SGI SVx or Cray NV1,
>18 leshort 74 ST19 8 bit,
>18 leshort 75 Digital VAX,
>18 leshort 76 Axis cris,
>18 leshort 77 Infineon 32-bit embedded,
>18 leshort 78 Element 14 64-bit DSP,
>18 leshort 79 LSI Logic 16-bit DSP,
>18 leshort 80 MMIX,
>18 leshort 81 Harvard machine-independent,
>18 leshort 82 SiTera Prism,
>18 leshort 83 Atmel AVR 8-bit,
>18 leshort 84 Fujitsu FR30,
>18 leshort 85 Mitsubishi D10V,
>18 leshort 86 Mitsubishi D30V,
>18 leshort 87 NEC v850,
>18 leshort 88 Renesas M32R,
>18 leshort 89 Matsushita MN10300,
>18 leshort 90 Matsushita MN10200,
>18 leshort 91 picoJava,
>18 leshort 92 OpenRISC,
>18 leshort 93 ARC Cores Tangent-A5,
>18 leshort 94 Tensilica Xtensa,
>18 leshort 97 NatSemi 32k,
>18 leshort 106 Analog Devices Blackfin,
>18 leshort 113 Altera Nios II,
>18 leshort 174 META,
>18 leshort 183 ARM aarch64,
>18 leshort 187 Tilera TILE64,
>18 leshort 188 Tilera TILEPro,
>18 leshort 191 Tilera TILE-Gx,
>18 leshort 0x3426 OpenRISC (obsolete),
>18 leshort 0x8472 OpenRISC (obsolete),
>18 leshort 0x9026 Alpha (unofficial),
>20 lelong 0 invalid version
>20 lelong 1 version 1
0 string \177ELF ELF
!:strength *2
>4 byte 0 invalid class
>4 byte 1 32-bit
>4 byte 2 64-bit
>5 byte 0 invalid byte order
>5 byte 1 LSB
>>0 use elf-le
>5 byte 2 MSB
>>0 use \^elf-le
# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
# like proper ELF, but extracting the string had bad results.
>4 byte <0x80
>>8 string >\0 (%s)
>8 string \0
>>7 byte 0 (SYSV)
>>7 byte 1 (HP-UX)
>>7 byte 2 (NetBSD)
>>7 byte 3 (GNU/Linux)
>>7 byte 4 (GNU/Hurd)
>>7 byte 5 (86Open)
>>7 byte 6 (Solaris)
>>7 byte 7 (Monterey)
>>7 byte 8 (IRIX)
>>7 byte 9 (FreeBSD)
>>7 byte 10 (Tru64)
>>7 byte 11 (Novell Modesto)
>>7 byte 12 (OpenBSD)
>8 string \2
>>7 byte 13 (OpenVMS)
>>7 byte 97 (ARM)
>>7 byte 255 (embedded)