Menu
I'm digging through two legacy cross-compiled ARM Linux builds. There isn't much documentation other than "use this VM image to build the source" The only difference between the file command output is the presence of "(SYSV)"
# file Executable
Executable: ELF 32-bit LSB executable, ARM, version 1 (SYSV) ...
What should I be able to assume based on the presence or absence of SYSV in the string?
613
In Linux, everything is considered as a file. In UNIX, seven standard file types are regular, directory, symbolic link, FIFO special, block special, character special, and socket. In Linux/UNIX, we have to deal with different file types to manage them efficiently.
The file command determines the file type of a file. It reports the file type in human readable format (e.g. 'ASCII text') or MIME type (e.g. 'text/plain; charset=us-ascii'). As filenames in UNIX can be entirely independent of file type file can be a useful command to determine how to view or work with a file.
A file is a smallest unit in which the information is stored. Unix file system has several important features. All data in Unix is organized into files. All files are organized into directories. These directories are organized into a tree-like structure called the file system.
If you see that (SYSV) string, it means the e_ident[EI_OSABI] field in the ELF header is set to 0. From the ELF spec (PDF link):
Table 5. Operating System and ABI Identifiers, e_ident[EI_OSABI]
Name Value Meaning
ELFOSABI_SYSV 0 System V ABI
ELFOSABI_HPUX 1 HP-UX operating system
ELFOSABI_STANDALONE 255 Standalone (embedded) application
My local machine's /usr/share/file/magic/elf file has a longer list:
# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
# like proper ELF, but extracting the string had bad results.
>4 byte <0x80
>>8 string >\0 (%s)
>8 string \0
>>7 byte 0 (SYSV)
>>7 byte 1 (HP-UX)
>>7 byte 2 (NetBSD)
>>7 byte 3 (GNU/Linux)
>>7 byte 4 (GNU/Hurd)
>>7 byte 5 (86Open)
>>7 byte 6 (Solaris)
>>7 byte 7 (Monterey)
>>7 byte 8 (IRIX)
>>7 byte 9 (FreeBSD)
>>7 byte 10 (Tru64)
>>7 byte 11 (Novell Modesto)
>>7 byte 12 (OpenBSD)
>8 string \2
>>7 byte 13 (OpenVMS)
>>7 byte 97 (ARM)
>>7 byte 255 (embedded)
Here are the ELF header and offsets for your reference (from this link):
#define EI_NIDENT 16
typedef struct {
unsigned char e_ident[EI_NIDENT];
Elf32_Half e_type;
Elf32_Half e_machine;
Elf32_Word e_version;
Elf32_Addr e_entry;
Elf32_Off e_phoff;
Elf32_Off e_shoff;
Elf32_Word e_flags;
Elf32_Half e_ehsize;
Elf32_Half e_phentsize;
Elf32_Half e_phnum;
Elf32_Half e_shentsize;
Elf32_Half e_shnum;
Elf32_Half e_shstrndx;
} Elf32_Ehdr;
Figure 4-4: e_ident[] Identification Indexes
Name Value Purpose
EI_MAG0 0 File identification
EI_MAG1 1 File identification
EI_MAG2 2 File identification
EI_MAG3 3 File identification
EI_CLASS 4 File class
EI_DATA 5 Data encoding
EI_VERSION 6 File version
EI_OSABI 7 Operating system/ABI identification
EI_ABIVERSION 8 ABI version
EI_PAD 9 Start of padding bytes
EI_NIDENT 16 Size of e_ident[]
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
