1//===- llvm/BinaryFormat/Magic.cpp - File magic identification --*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8
9#include "llvm/BinaryFormat/Magic.h"
10#include "llvm/ADT/StringRef.h"
11#include "llvm/ADT/Twine.h"
12#include "llvm/BinaryFormat/COFF.h"
13#include "llvm/BinaryFormat/ELF.h"
14#include "llvm/BinaryFormat/MachO.h"
15#include "llvm/Support/Endian.h"
16#include "llvm/Support/FileSystem.h"
17#include "llvm/Support/MemoryBuffer.h"
18
19#if !defined(_MSC_VER) && !defined(__MINGW32__)
20#include <unistd.h>
21#else
22#include <io.h>
23#endif
24
25using namespace llvm;
26using namespace llvm::support::endian;
27using namespace llvm::sys::fs;
28
29template <size_t N>
30static bool startswith(StringRef Magic, const char (&S)[N]) {
31  return Magic.startswith(StringRef(S, N - 1));
32}
33
34/// Identify the magic in magic.
35file_magic llvm::identify_magic(StringRef Magic) {
36  if (Magic.size() < 4)
37    return file_magic::unknown;
38  switch ((unsigned char)Magic[0]) {
39  case 0x00: {
40    // COFF bigobj, CL.exe's LTO object file, or short import library file
41    if (startswith(Magic, "\0\0\xFF\xFF")) {
42      size_t MinSize =
43          offsetof(COFF::BigObjHeader, UUID) + sizeof(COFF::BigObjMagic);
44      if (Magic.size() < MinSize)
45        return file_magic::coff_import_library;
46
47      const char *Start = Magic.data() + offsetof(COFF::BigObjHeader, UUID);
48      if (memcmp(Start, COFF::BigObjMagic, sizeof(COFF::BigObjMagic)) == 0)
49        return file_magic::coff_object;
50      if (memcmp(Start, COFF::ClGlObjMagic, sizeof(COFF::BigObjMagic)) == 0)
51        return file_magic::coff_cl_gl_object;
52      return file_magic::coff_import_library;
53    }
54    // Windows resource file
55    if (Magic.size() >= sizeof(COFF::WinResMagic) &&
56        memcmp(Magic.data(), COFF::WinResMagic, sizeof(COFF::WinResMagic)) == 0)
57      return file_magic::windows_resource;
58    // 0x0000 = COFF unknown machine type
59    if (Magic[1] == 0)
60      return file_magic::coff_object;
61    if (startswith(Magic, "\0asm"))
62      return file_magic::wasm_object;
63    break;
64  }
65
66  case 0x01:
67    // XCOFF format
68    if (startswith(Magic, "\x01\xDF"))
69      return file_magic::xcoff_object_32;
70    if (startswith(Magic, "\x01\xF7"))
71      return file_magic::xcoff_object_64;
72    break;
73
74  case 0xDE: // 0x0B17C0DE = BC wraper
75    if (startswith(Magic, "\xDE\xC0\x17\x0B"))
76      return file_magic::bitcode;
77    break;
78  case 'B':
79    if (startswith(Magic, "BC\xC0\xDE"))
80      return file_magic::bitcode;
81    break;
82  case '!':
83    if (startswith(Magic, "!<arch>\n") || startswith(Magic, "!<thin>\n"))
84      return file_magic::archive;
85    break;
86
87  case '\177':
88    if (startswith(Magic, "\177ELF") && Magic.size() >= 18) {
89      bool Data2MSB = Magic[5] == 2;
90      unsigned high = Data2MSB ? 16 : 17;
91      unsigned low = Data2MSB ? 17 : 16;
92      if (Magic[high] == 0) {
93        switch (Magic[low]) {
94        default:
95          return file_magic::elf;
96        case 1:
97          return file_magic::elf_relocatable;
98        case 2:
99          return file_magic::elf_executable;
100        case 3:
101          return file_magic::elf_shared_object;
102        case 4:
103          return file_magic::elf_core;
104        }
105      }
106      // It's still some type of ELF file.
107      return file_magic::elf;
108    }
109    break;
110
111  case 0xCA:
112    if (startswith(Magic, "\xCA\xFE\xBA\xBE") ||
113        startswith(Magic, "\xCA\xFE\xBA\xBF")) {
114      // This is complicated by an overlap with Java class files.
115      // See the Mach-O section in /usr/share/file/magic for details.
116      if (Magic.size() >= 8 && Magic[7] < 43)
117        return file_magic::macho_universal_binary;
118    }
119    break;
120
121  // The two magic numbers for mach-o are:
122  // 0xfeedface - 32-bit mach-o
123  // 0xfeedfacf - 64-bit mach-o
124  case 0xFE:
125  case 0xCE:
126  case 0xCF: {
127    uint16_t type = 0;
128    if (startswith(Magic, "\xFE\xED\xFA\xCE") ||
129        startswith(Magic, "\xFE\xED\xFA\xCF")) {
130      /* Native endian */
131      size_t MinSize;
132      if (Magic[3] == char(0xCE))
133        MinSize = sizeof(MachO::mach_header);
134      else
135        MinSize = sizeof(MachO::mach_header_64);
136      if (Magic.size() >= MinSize)
137        type = Magic[12] << 24 | Magic[13] << 12 | Magic[14] << 8 | Magic[15];
138    } else if (startswith(Magic, "\xCE\xFA\xED\xFE") ||
139               startswith(Magic, "\xCF\xFA\xED\xFE")) {
140      /* Reverse endian */
141      size_t MinSize;
142      if (Magic[0] == char(0xCE))
143        MinSize = sizeof(MachO::mach_header);
144      else
145        MinSize = sizeof(MachO::mach_header_64);
146      if (Magic.size() >= MinSize)
147        type = Magic[15] << 24 | Magic[14] << 12 | Magic[13] << 8 | Magic[12];
148    }
149    switch (type) {
150    default:
151      break;
152    case 1:
153      return file_magic::macho_object;
154    case 2:
155      return file_magic::macho_executable;
156    case 3:
157      return file_magic::macho_fixed_virtual_memory_shared_lib;
158    case 4:
159      return file_magic::macho_core;
160    case 5:
161      return file_magic::macho_preload_executable;
162    case 6:
163      return file_magic::macho_dynamically_linked_shared_lib;
164    case 7:
165      return file_magic::macho_dynamic_linker;
166    case 8:
167      return file_magic::macho_bundle;
168    case 9:
169      return file_magic::macho_dynamically_linked_shared_lib_stub;
170    case 10:
171      return file_magic::macho_dsym_companion;
172    case 11:
173      return file_magic::macho_kext_bundle;
174    }
175    break;
176  }
177  case 0xF0: // PowerPC Windows
178  case 0x83: // Alpha 32-bit
179  case 0x84: // Alpha 64-bit
180  case 0x66: // MPS R4000 Windows
181  case 0x50: // mc68K
182  case 0x4c: // 80386 Windows
183  case 0xc4: // ARMNT Windows
184    if (Magic[1] == 0x01)
185      return file_magic::coff_object;
186    LLVM_FALLTHROUGH;
187
188  case 0x90: // PA-RISC Windows
189  case 0x68: // mc68K Windows
190    if (Magic[1] == 0x02)
191      return file_magic::coff_object;
192    break;
193
194  case 'M': // Possible MS-DOS stub on Windows PE file, MSF/PDB file or a
195            // Minidump file.
196    if (startswith(Magic, "MZ") && Magic.size() >= 0x3c + 4) {
197      uint32_t off = read32le(Magic.data() + 0x3c);
198      // PE/COFF file, either EXE or DLL.
199      if (Magic.substr(off).startswith(
200              StringRef(COFF::PEMagic, sizeof(COFF::PEMagic))))
201        return file_magic::pecoff_executable;
202    }
203    if (Magic.startswith("Microsoft C/C++ MSF 7.00\r\n"))
204      return file_magic::pdb;
205    if (startswith(Magic, "MDMP"))
206      return file_magic::minidump;
207    break;
208
209  case 0x64: // x86-64 or ARM64 Windows.
210    if (Magic[1] == char(0x86) || Magic[1] == char(0xaa))
211      return file_magic::coff_object;
212    break;
213
214  case 0x2d: // YAML '-'
215    if (startswith(Magic, "--- !tapi") || startswith(Magic, "---\narchs:"))
216      return file_magic::tapi_file;
217    break;
218
219  default:
220    break;
221  }
222  return file_magic::unknown;
223}
224
225std::error_code llvm::identify_magic(const Twine &Path, file_magic &Result) {
226  auto FileOrError = MemoryBuffer::getFile(Path, -1LL, false);
227  if (!FileOrError)
228    return FileOrError.getError();
229
230  std::unique_ptr<MemoryBuffer> FileBuffer = std::move(*FileOrError);
231  Result = identify_magic(FileBuffer->getBuffer());
232
233  return std::error_code();
234}
235