我正在挖掘两个传统的交叉编译ARM
Linux版本.除了“使用此VM映像构建源”之外没有太多文档.文件命令输出之间的唯一区别是存在“(SYSV)”
# file Executable Executable: ELF 32-bit LSB executable,ARM,version 1 (SYSV) ...
根据字符串中是否存在SYSV,我应该能够假设什么？
解决方法
如果看到(SYSV)字符串,则表示ELF头中的e_ident [EI_OSABI]字段设置为0.从
ELF spec (PDF link)开始：
Table 5. Operating System and ABI Identifiers,e_ident[EI_OSABI] Name Value Meaning ELFOSABI_SYSV 0 System V ABI ELFOSABI_HPUX 1 HP-UX operating system ELFOSABI_STANDALONE 255 Standalone (embedded) application
我的本地计算机的/usr/share / file / magic / elf文件有一个更长的列表：
# Up to now only 0,1 and 2 are defined; I've seen a file with 0x83,it seemed # like proper ELF,but extracting the string had bad results. >4 byte <0x80 >>8 string >\0 (%s) >8 string \0 >>7 byte 0 (SYSV) >>7 byte 1 (HP-UX) >>7 byte 2 (NetBSD) >>7 byte 3 (GNU/Linux) >>7 byte 4 (GNU/Hurd) >>7 byte 5 (86Open) >>7 byte 6 (Solaris) >>7 byte 7 (Monterey) >>7 byte 8 (IRIX) >>7 byte 9 (FreeBSD) >>7 byte 10 (Tru64) >>7 byte 11 (Novell Modesto) >>7 byte 12 (OpenBSD) >8 string \2 >>7 byte 13 (OpenVMS) >>7 byte 97 (ARM) >>7 byte 255 (embedded)
以下是您参考的ELF标题和偏移量(从this link开始)：
#define EI_NIDENT 16
typedef struct {
unsigned char e_ident[EI_NIDENT];
Elf32_Half e_type;
Elf32_Half e_machine;
Elf32_Word e_version;
Elf32_Addr e_entry;
Elf32_Off e_phoff;
Elf32_Off e_shoff;
Elf32_Word e_flags;
Elf32_Half e_ehsize;
Elf32_Half e_phentsize;
Elf32_Half e_phnum;
Elf32_Half e_shentsize;
Elf32_Half e_shnum;
Elf32_Half e_shstrndx;
} Elf32_Ehdr;
Figure 4-4: e_ident[] Identification Indexes
Name Value Purpose
EI_MAG0 0 File identification
EI_MAG1 1 File identification
EI_MAG2 2 File identification
EI_MAG3 3 File identification
EI_CLASS 4 File class
EI_DATA 5 Data encoding
EI_VERSION 6 File version
EI_OSABI 7 Operating system/ABI identification
EI_ABIVERSION 8 ABI version
EI_PAD 9 Start of padding bytes
EI_NIDENT 16 Size of e_ident[]
