1
2#------------------------------------------------------------------------------
3# elf: file(1) magic for ELF executables
4#
5# We have to check the byte order flag to see what byte order all the
6# other stuff in the header is in.
7#
8# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
9#
10# updated by Daniel Quinlan (quinlan@yggdrasil.com)
110 string \177ELF ELF
12>4 byte 0 invalid class
13>4 byte 1 32-bit
14# only for MIPS - in the future, the ABI field of e_flags should be used.
15>>18 leshort 8
16>>>36 lelong &0x20 N32
17>>18 leshort 10
18>>>36 lelong &0x20 N32
19>>18 beshort 8
20>>>36 belong &0x20 N32
21>>18 beshort 10
22>>>36 belong &0x20 N32
23>4 byte 2 64-bit
24>5 byte 0 invalid byte order
25>5 byte 1 LSB
26# The official e_machine number for MIPS is now #8, regardless of endianness.
27# The second number (#10) will be deprecated later. For now, we still
28# say something if #10 is encountered, but only gory details for #8.
29>>18 leshort 8
30# only for 32-bit
31>>>4 byte 1
32>>>>36 lelong&0xf0000000 0x00000000 MIPS-I
33>>>>36 lelong&0xf0000000 0x10000000 MIPS-II
34>>>>36 lelong&0xf0000000 0x20000000 MIPS-III
35>>>>36 lelong&0xf0000000 0x30000000 MIPS-IV
36>>>>36 lelong&0xf0000000 0x40000000 MIPS-V
37>>>>36 lelong&0xf0000000 0x60000000 MIPS32
38>>>>36 lelong&0xf0000000 0x70000000 MIPS64
39>>>>36 lelong&0xf0000000 0x80000000 MIPS32 rel2
40>>>>36 lelong&0xf0000000 0x90000000 MIPS64 rel2
41# only for 64-bit
42>>>4 byte 2
43>>>>48 lelong&0xf0000000 0x00000000 MIPS-I
44>>>>48 lelong&0xf0000000 0x10000000 MIPS-II
45>>>>48 lelong&0xf0000000 0x20000000 MIPS-III
46>>>>48 lelong&0xf0000000 0x30000000 MIPS-IV
47>>>>48 lelong&0xf0000000 0x40000000 MIPS-V
48>>>>48 lelong&0xf0000000 0x60000000 MIPS32
49>>>>48 lelong&0xf0000000 0x70000000 MIPS64
50>>>>48 lelong&0xf0000000 0x80000000 MIPS32 rel2
51>>>>48 lelong&0xf0000000 0x90000000 MIPS64 rel2
52>>16 leshort 0 no file type,
53>>16 leshort 1 relocatable,
54>>16 leshort 2 executable,
55>>16 leshort 3 shared object,
56# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
57# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
58>>16 leshort 4 core file
59# Core file detection is not reliable.
60#>>>(0x38+0xcc) string >\0 of '%s'
61#>>>(0x38+0x10) lelong >0 (signal %d),
62>>16 leshort &0xff00 processor-specific,
63>>18 leshort 0 no machine,
64>>18 leshort 1 AT&T WE32100 - invalid byte order,
65>>18 leshort 2 SPARC - invalid byte order,
66>>18 leshort 3 Intel 80386,
67>>18 leshort 4 Motorola
68>>>36 lelong &0x01000000 68000 - invalid byte order,
69>>>36 lelong &0x00810000 CPU32 - invalid byte order,
70>>>36 lelong 0 68020 - invalid byte order,
71>>18 leshort 5 Motorola 88000 - invalid byte order,
72>>18 leshort 6 Intel 80486,
73>>18 leshort 7 Intel 80860,
74>>18 leshort 8 MIPS,
75>>18 leshort 9 Amdahl - invalid byte order,
76>>18 leshort 10 MIPS (deprecated),
77>>18 leshort 11 RS6000 - invalid byte order,
78>>18 leshort 15 PA-RISC - invalid byte order,
79>>>50 leshort 0x0214 2.0
80>>>48 leshort &0x0008 (LP64),
81>>18 leshort 16 nCUBE,
82>>18 leshort 17 Fujitsu VPP500,
83>>18 leshort 18 SPARC32PLUS,
84>>18 leshort 20 PowerPC,
85>>18 leshort 22 IBM S/390,
86>>18 leshort 36 NEC V800,
87>>18 leshort 37 Fujitsu FR20,
88>>18 leshort 38 TRW RH-32,
89>>18 leshort 39 Motorola RCE,
90>>18 leshort 40 ARM,
91>>18 leshort 41 Alpha,
92>>18 leshort 0xa390 IBM S/390 (obsolete),
93>>18 leshort 42 Hitachi SH,
94>>18 leshort 43 SPARC V9 - invalid byte order,
95>>18 leshort 44 Siemens Tricore Embedded Processor,
96>>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
97>>18 leshort 46 Hitachi H8/300,
98>>18 leshort 47 Hitachi H8/300H,
99>>18 leshort 48 Hitachi H8S,
100>>18 leshort 49 Hitachi H8/500,
101>>18 leshort 50 IA-64 (Intel 64 bit architecture)
102>>18 leshort 51 Stanford MIPS-X,
103>>18 leshort 52 Motorola Coldfire,
104>>18 leshort 53 Motorola M68HC12,
105>>18 leshort 62 AMD x86-64,
106>>18 leshort 75 Digital VAX,
| 1
2#------------------------------------------------------------------------------
3# elf: file(1) magic for ELF executables
4#
5# We have to check the byte order flag to see what byte order all the
6# other stuff in the header is in.
7#
8# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
9#
10# updated by Daniel Quinlan (quinlan@yggdrasil.com)
110 string \177ELF ELF
12>4 byte 0 invalid class
13>4 byte 1 32-bit
14# only for MIPS - in the future, the ABI field of e_flags should be used.
15>>18 leshort 8
16>>>36 lelong &0x20 N32
17>>18 leshort 10
18>>>36 lelong &0x20 N32
19>>18 beshort 8
20>>>36 belong &0x20 N32
21>>18 beshort 10
22>>>36 belong &0x20 N32
23>4 byte 2 64-bit
24>5 byte 0 invalid byte order
25>5 byte 1 LSB
26# The official e_machine number for MIPS is now #8, regardless of endianness.
27# The second number (#10) will be deprecated later. For now, we still
28# say something if #10 is encountered, but only gory details for #8.
29>>18 leshort 8
30# only for 32-bit
31>>>4 byte 1
32>>>>36 lelong&0xf0000000 0x00000000 MIPS-I
33>>>>36 lelong&0xf0000000 0x10000000 MIPS-II
34>>>>36 lelong&0xf0000000 0x20000000 MIPS-III
35>>>>36 lelong&0xf0000000 0x30000000 MIPS-IV
36>>>>36 lelong&0xf0000000 0x40000000 MIPS-V
37>>>>36 lelong&0xf0000000 0x60000000 MIPS32
38>>>>36 lelong&0xf0000000 0x70000000 MIPS64
39>>>>36 lelong&0xf0000000 0x80000000 MIPS32 rel2
40>>>>36 lelong&0xf0000000 0x90000000 MIPS64 rel2
41# only for 64-bit
42>>>4 byte 2
43>>>>48 lelong&0xf0000000 0x00000000 MIPS-I
44>>>>48 lelong&0xf0000000 0x10000000 MIPS-II
45>>>>48 lelong&0xf0000000 0x20000000 MIPS-III
46>>>>48 lelong&0xf0000000 0x30000000 MIPS-IV
47>>>>48 lelong&0xf0000000 0x40000000 MIPS-V
48>>>>48 lelong&0xf0000000 0x60000000 MIPS32
49>>>>48 lelong&0xf0000000 0x70000000 MIPS64
50>>>>48 lelong&0xf0000000 0x80000000 MIPS32 rel2
51>>>>48 lelong&0xf0000000 0x90000000 MIPS64 rel2
52>>16 leshort 0 no file type,
53>>16 leshort 1 relocatable,
54>>16 leshort 2 executable,
55>>16 leshort 3 shared object,
56# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
57# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
58>>16 leshort 4 core file
59# Core file detection is not reliable.
60#>>>(0x38+0xcc) string >\0 of '%s'
61#>>>(0x38+0x10) lelong >0 (signal %d),
62>>16 leshort &0xff00 processor-specific,
63>>18 leshort 0 no machine,
64>>18 leshort 1 AT&T WE32100 - invalid byte order,
65>>18 leshort 2 SPARC - invalid byte order,
66>>18 leshort 3 Intel 80386,
67>>18 leshort 4 Motorola
68>>>36 lelong &0x01000000 68000 - invalid byte order,
69>>>36 lelong &0x00810000 CPU32 - invalid byte order,
70>>>36 lelong 0 68020 - invalid byte order,
71>>18 leshort 5 Motorola 88000 - invalid byte order,
72>>18 leshort 6 Intel 80486,
73>>18 leshort 7 Intel 80860,
74>>18 leshort 8 MIPS,
75>>18 leshort 9 Amdahl - invalid byte order,
76>>18 leshort 10 MIPS (deprecated),
77>>18 leshort 11 RS6000 - invalid byte order,
78>>18 leshort 15 PA-RISC - invalid byte order,
79>>>50 leshort 0x0214 2.0
80>>>48 leshort &0x0008 (LP64),
81>>18 leshort 16 nCUBE,
82>>18 leshort 17 Fujitsu VPP500,
83>>18 leshort 18 SPARC32PLUS,
84>>18 leshort 20 PowerPC,
85>>18 leshort 22 IBM S/390,
86>>18 leshort 36 NEC V800,
87>>18 leshort 37 Fujitsu FR20,
88>>18 leshort 38 TRW RH-32,
89>>18 leshort 39 Motorola RCE,
90>>18 leshort 40 ARM,
91>>18 leshort 41 Alpha,
92>>18 leshort 0xa390 IBM S/390 (obsolete),
93>>18 leshort 42 Hitachi SH,
94>>18 leshort 43 SPARC V9 - invalid byte order,
95>>18 leshort 44 Siemens Tricore Embedded Processor,
96>>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
97>>18 leshort 46 Hitachi H8/300,
98>>18 leshort 47 Hitachi H8/300H,
99>>18 leshort 48 Hitachi H8S,
100>>18 leshort 49 Hitachi H8/500,
101>>18 leshort 50 IA-64 (Intel 64 bit architecture)
102>>18 leshort 51 Stanford MIPS-X,
103>>18 leshort 52 Motorola Coldfire,
104>>18 leshort 53 Motorola M68HC12,
105>>18 leshort 62 AMD x86-64,
106>>18 leshort 75 Digital VAX,
|
| 107>>18 leshort 88 Renesas M32R,
|
107>>18 leshort 97 NatSemi 32k,
108>>18 leshort 0x9026 Alpha (unofficial),
109>>20 lelong 0 invalid version
110>>20 lelong 1 version 1
111>>36 lelong 1 MathCoPro/FPU/MAU Required
112>5 byte 2 MSB
113# only for MIPS - see comment in little-endian section above.
114>>18 beshort 8
115# only for 32-bit
116>>>4 byte 1
117>>>>36 belong&0xf0000000 0x00000000 MIPS-I
118>>>>36 belong&0xf0000000 0x10000000 MIPS-II
119>>>>36 belong&0xf0000000 0x20000000 MIPS-III
120>>>>36 belong&0xf0000000 0x30000000 MIPS-IV
121>>>>36 belong&0xf0000000 0x40000000 MIPS-V
122>>>>36 belong&0xf0000000 0x60000000 MIPS32
123>>>>36 belong&0xf0000000 0x70000000 MIPS64
124>>>>36 belong&0xf0000000 0x80000000 MIPS32 rel2
125>>>>36 belong&0xf0000000 0x90000000 MIPS64 rel2
126# only for 64-bit
127>>>4 byte 2
128>>>>48 belong&0xf0000000 0x00000000 MIPS-I
129>>>>48 belong&0xf0000000 0x10000000 MIPS-II
130>>>>48 belong&0xf0000000 0x20000000 MIPS-III
131>>>>48 belong&0xf0000000 0x30000000 MIPS-IV
132>>>>48 belong&0xf0000000 0x40000000 MIPS-V
133>>>>48 belong&0xf0000000 0x60000000 MIPS32
134>>>>48 belong&0xf0000000 0x70000000 MIPS64
135>>>>48 belong&0xf0000000 0x80000000 MIPS32 rel2
136>>>>48 belong&0xf0000000 0x90000000 MIPS64 rel2
137>>16 beshort 0 no file type,
138>>16 beshort 1 relocatable,
139>>16 beshort 2 executable,
140>>16 beshort 3 shared object,
141>>16 beshort 4 core file,
142#>>>(0x38+0xcc) string >\0 of '%s'
143#>>>(0x38+0x10) belong >0 (signal %d),
144>>16 beshort &0xff00 processor-specific,
145>>18 beshort 0 no machine,
146>>18 beshort 1 AT&T WE32100,
147>>18 beshort 2 SPARC,
148>>18 beshort 3 Intel 80386 - invalid byte order,
149>>18 beshort 4 Motorola
150>>>36 belong &0x01000000 68000,
151>>>36 belong &0x00810000 CPU32,
152>>>36 belong 0 68020,
153>>18 beshort 5 Motorola 88000,
154>>18 beshort 6 Intel 80486 - invalid byte order,
155>>18 beshort 7 Intel 80860,
156>>18 beshort 8 MIPS,
157>>18 beshort 9 Amdahl,
158>>18 beshort 10 MIPS (deprecated),
159>>18 beshort 11 RS6000,
160>>18 beshort 15 PA-RISC
161>>>50 beshort 0x0214 2.0
162>>>48 beshort &0x0008 (LP64)
163>>18 beshort 16 nCUBE,
164>>18 beshort 17 Fujitsu VPP500,
165>>18 beshort 18 SPARC32PLUS,
166>>>36 belong&0xffff00 &0x000100 V8+ Required,
167>>>36 belong&0xffff00 &0x000200 Sun UltraSPARC1 Extensions Required,
168>>>36 belong&0xffff00 &0x000400 HaL R1 Extensions Required,
169>>>36 belong&0xffff00 &0x000800 Sun UltraSPARC3 Extensions Required,
170>>18 beshort 20 PowerPC or cisco 4500,
171>>18 beshort 21 cisco 7500,
172>>18 beshort 22 IBM S/390,
173>>18 beshort 24 cisco SVIP,
174>>18 beshort 25 cisco 7200,
175>>18 beshort 36 NEC V800 or cisco 12000,
176>>18 beshort 37 Fujitsu FR20,
177>>18 beshort 38 TRW RH-32,
178>>18 beshort 39 Motorola RCE,
179>>18 beshort 40 ARM,
180>>18 beshort 41 Alpha,
181>>18 beshort 42 Hitachi SH,
182>>18 beshort 43 SPARC V9,
183>>18 beshort 44 Siemens Tricore Embedded Processor,
184>>18 beshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
185>>18 beshort 46 Hitachi H8/300,
186>>18 beshort 47 Hitachi H8/300H,
187>>18 beshort 48 Hitachi H8S,
188>>18 beshort 49 Hitachi H8/500,
189>>18 beshort 50 Intel Merced Processor,
190>>18 beshort 51 Stanford MIPS-X,
191>>18 beshort 52 Motorola Coldfire,
192>>18 beshort 53 Motorola M68HC12,
193>>18 beshort 73 Cray NV1,
194>>18 beshort 75 Digital VAX,
| 108>>18 leshort 97 NatSemi 32k,
109>>18 leshort 0x9026 Alpha (unofficial),
110>>20 lelong 0 invalid version
111>>20 lelong 1 version 1
112>>36 lelong 1 MathCoPro/FPU/MAU Required
113>5 byte 2 MSB
114# only for MIPS - see comment in little-endian section above.
115>>18 beshort 8
116# only for 32-bit
117>>>4 byte 1
118>>>>36 belong&0xf0000000 0x00000000 MIPS-I
119>>>>36 belong&0xf0000000 0x10000000 MIPS-II
120>>>>36 belong&0xf0000000 0x20000000 MIPS-III
121>>>>36 belong&0xf0000000 0x30000000 MIPS-IV
122>>>>36 belong&0xf0000000 0x40000000 MIPS-V
123>>>>36 belong&0xf0000000 0x60000000 MIPS32
124>>>>36 belong&0xf0000000 0x70000000 MIPS64
125>>>>36 belong&0xf0000000 0x80000000 MIPS32 rel2
126>>>>36 belong&0xf0000000 0x90000000 MIPS64 rel2
127# only for 64-bit
128>>>4 byte 2
129>>>>48 belong&0xf0000000 0x00000000 MIPS-I
130>>>>48 belong&0xf0000000 0x10000000 MIPS-II
131>>>>48 belong&0xf0000000 0x20000000 MIPS-III
132>>>>48 belong&0xf0000000 0x30000000 MIPS-IV
133>>>>48 belong&0xf0000000 0x40000000 MIPS-V
134>>>>48 belong&0xf0000000 0x60000000 MIPS32
135>>>>48 belong&0xf0000000 0x70000000 MIPS64
136>>>>48 belong&0xf0000000 0x80000000 MIPS32 rel2
137>>>>48 belong&0xf0000000 0x90000000 MIPS64 rel2
138>>16 beshort 0 no file type,
139>>16 beshort 1 relocatable,
140>>16 beshort 2 executable,
141>>16 beshort 3 shared object,
142>>16 beshort 4 core file,
143#>>>(0x38+0xcc) string >\0 of '%s'
144#>>>(0x38+0x10) belong >0 (signal %d),
145>>16 beshort &0xff00 processor-specific,
146>>18 beshort 0 no machine,
147>>18 beshort 1 AT&T WE32100,
148>>18 beshort 2 SPARC,
149>>18 beshort 3 Intel 80386 - invalid byte order,
150>>18 beshort 4 Motorola
151>>>36 belong &0x01000000 68000,
152>>>36 belong &0x00810000 CPU32,
153>>>36 belong 0 68020,
154>>18 beshort 5 Motorola 88000,
155>>18 beshort 6 Intel 80486 - invalid byte order,
156>>18 beshort 7 Intel 80860,
157>>18 beshort 8 MIPS,
158>>18 beshort 9 Amdahl,
159>>18 beshort 10 MIPS (deprecated),
160>>18 beshort 11 RS6000,
161>>18 beshort 15 PA-RISC
162>>>50 beshort 0x0214 2.0
163>>>48 beshort &0x0008 (LP64)
164>>18 beshort 16 nCUBE,
165>>18 beshort 17 Fujitsu VPP500,
166>>18 beshort 18 SPARC32PLUS,
167>>>36 belong&0xffff00 &0x000100 V8+ Required,
168>>>36 belong&0xffff00 &0x000200 Sun UltraSPARC1 Extensions Required,
169>>>36 belong&0xffff00 &0x000400 HaL R1 Extensions Required,
170>>>36 belong&0xffff00 &0x000800 Sun UltraSPARC3 Extensions Required,
171>>18 beshort 20 PowerPC or cisco 4500,
172>>18 beshort 21 cisco 7500,
173>>18 beshort 22 IBM S/390,
174>>18 beshort 24 cisco SVIP,
175>>18 beshort 25 cisco 7200,
176>>18 beshort 36 NEC V800 or cisco 12000,
177>>18 beshort 37 Fujitsu FR20,
178>>18 beshort 38 TRW RH-32,
179>>18 beshort 39 Motorola RCE,
180>>18 beshort 40 ARM,
181>>18 beshort 41 Alpha,
182>>18 beshort 42 Hitachi SH,
183>>18 beshort 43 SPARC V9,
184>>18 beshort 44 Siemens Tricore Embedded Processor,
185>>18 beshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
186>>18 beshort 46 Hitachi H8/300,
187>>18 beshort 47 Hitachi H8/300H,
188>>18 beshort 48 Hitachi H8S,
189>>18 beshort 49 Hitachi H8/500,
190>>18 beshort 50 Intel Merced Processor,
191>>18 beshort 51 Stanford MIPS-X,
192>>18 beshort 52 Motorola Coldfire,
193>>18 beshort 53 Motorola M68HC12,
194>>18 beshort 73 Cray NV1,
195>>18 beshort 75 Digital VAX,
|
| 196>>18 beshort 88 Renesas M32R,
|
195>>18 beshort 97 NatSemi 32k,
196>>18 beshort 0x9026 Alpha (unofficial),
197>>18 beshort 0xa390 IBM S/390 (obsolete),
198>>20 belong 0 invalid version
199>>20 belong 1 version 1
200>>36 belong 1 MathCoPro/FPU/MAU Required
201# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
202# like proper ELF, but extracting the string had bad results.
203>4 byte <0x80
204>>8 string >\0 (%s)
205>8 string \0
206>>7 byte 0 (SYSV)
207>>7 byte 1 (HP-UX)
208>>7 byte 2 (NetBSD)
209>>7 byte 3 (GNU/Linux)
210>>7 byte 4 (GNU/Hurd)
211>>7 byte 5 (86Open)
212>>7 byte 6 (Solaris)
213>>7 byte 7 (Monterey)
214>>7 byte 8 (IRIX)
215>>7 byte 9 (FreeBSD)
216>>7 byte 10 (Tru64)
217>>7 byte 11 (Novell Modesto)
218>>7 byte 12 (OpenBSD)
219>>7 byte 97 (ARM)
220>>7 byte 255 (embedded)
| 197>>18 beshort 97 NatSemi 32k,
198>>18 beshort 0x9026 Alpha (unofficial),
199>>18 beshort 0xa390 IBM S/390 (obsolete),
200>>20 belong 0 invalid version
201>>20 belong 1 version 1
202>>36 belong 1 MathCoPro/FPU/MAU Required
203# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
204# like proper ELF, but extracting the string had bad results.
205>4 byte <0x80
206>>8 string >\0 (%s)
207>8 string \0
208>>7 byte 0 (SYSV)
209>>7 byte 1 (HP-UX)
210>>7 byte 2 (NetBSD)
211>>7 byte 3 (GNU/Linux)
212>>7 byte 4 (GNU/Hurd)
213>>7 byte 5 (86Open)
214>>7 byte 6 (Solaris)
215>>7 byte 7 (Monterey)
216>>7 byte 8 (IRIX)
217>>7 byte 9 (FreeBSD)
218>>7 byte 10 (Tru64)
219>>7 byte 11 (Novell Modesto)
220>>7 byte 12 (OpenBSD)
221>>7 byte 97 (ARM)
222>>7 byte 255 (embedded)
|