12

我正在挖掘两个遗留的交叉编译的 ARM Linux 版本。除了“使用此 VM 映像构建源代码”之外没有太多文档文件命令输出之间的唯一区别是“(SYSV)”的存在

# file Executable
Executable: ELF 32-bit LSB executable, ARM, version 1 (SYSV) ...

根据字符串中是否存在 SYSV,我应该能够假设什么?

4

1 回答 1

14

如果您看到该(SYSV)字符串,则表示e_ident[EI_OSABI]ELF 标头中的字段设置为 0。来自ELF 规范(PDF 链接)

Table 5. Operating System and ABI Identifiers, e_ident[EI_OSABI]
Name                 Value   Meaning
ELFOSABI_SYSV          0     System V ABI
ELFOSABI_HPUX          1     HP-UX operating system
ELFOSABI_STANDALONE   255    Standalone (embedded) application

我本地机器的/usr/share/file/magic/elf文件有一个更长的列表:

# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
# like proper ELF, but extracting the string had bad results.
>4      byte            <0x80
>>8 string      >\0     (%s)
>8  string      \0
>>7 byte        0       (SYSV)
>>7 byte        1       (HP-UX)
>>7 byte        2       (NetBSD)
>>7 byte        3       (GNU/Linux)
>>7 byte        4       (GNU/Hurd)
>>7 byte        5       (86Open)
>>7 byte        6       (Solaris)
>>7 byte        7       (Monterey)
>>7 byte        8       (IRIX)
>>7 byte        9       (FreeBSD)
>>7 byte        10      (Tru64)
>>7 byte        11      (Novell Modesto)
>>7 byte        12      (OpenBSD)
>8      string          \2
>>7     byte            13              (OpenVMS)
>>7 byte        97      (ARM)
>>7 byte        255     (embedded)

以下是 ELF 标头和偏移量供您参考(来自此链接):

#define EI_NIDENT 16

typedef struct {
        unsigned char   e_ident[EI_NIDENT];
        Elf32_Half      e_type;
        Elf32_Half      e_machine;
        Elf32_Word      e_version;
        Elf32_Addr      e_entry;
        Elf32_Off       e_phoff;
        Elf32_Off       e_shoff;
        Elf32_Word      e_flags;
        Elf32_Half      e_ehsize;
        Elf32_Half      e_phentsize;
        Elf32_Half      e_phnum;
        Elf32_Half      e_shentsize;
        Elf32_Half      e_shnum;
        Elf32_Half      e_shstrndx;
} Elf32_Ehdr;


Figure 4-4: e_ident[] Identification Indexes
Name      Value Purpose
EI_MAG0       0     File identification
EI_MAG1       1     File identification
EI_MAG2       2     File identification
EI_MAG3       3     File identification
EI_CLASS      4     File class
EI_DATA       5     Data encoding
EI_VERSION    6     File version
EI_OSABI      7     Operating system/ABI identification
EI_ABIVERSION 8     ABI version
EI_PAD        9     Start of padding bytes
EI_NIDENT     16    Size of e_ident[]
于 2012-02-27T19:23:51.997 回答