我正在挖掘两个传统的交叉编译ARM
Linux版本.除了“使用此VM映像构建源”之外没有太多文档.文件命令输出之间的唯一区别是存在“(SYSV)”
- # file Executable
- Executable: ELF 32-bit LSB executable,ARM,version 1 (SYSV) ...
根据字符串中是否存在SYSV,我应该能够假设什么？
解决方法
如果看到(SYSV)字符串,则表示ELF头中的e_ident [EI_OSABI]字段设置为0.从
ELF spec (PDF link)开始：
- Table 5. Operating System and ABI Identifiers,e_ident[EI_OSABI]
- Name Value Meaning
- ELFOSABI_SYSV 0 System V ABI
- ELFOSABI_HPUX 1 HP-UX operating system
- ELFOSABI_STANDALONE 255 Standalone (embedded) application
我的本地计算机的/usr/share / file / magic / elf文件有一个更长的列表：
- # Up to now only 0,1 and 2 are defined; I've seen a file with 0x83,it seemed
- # like proper ELF,but extracting the string had bad results.
- >4 byte <0x80
- >>8 string >\0 (%s)
- >8 string \0
- >>7 byte 0 (SYSV)
- >>7 byte 1 (HP-UX)
- >>7 byte 2 (NetBSD)
- >>7 byte 3 (GNU/Linux)
- >>7 byte 4 (GNU/Hurd)
- >>7 byte 5 (86Open)
- >>7 byte 6 (Solaris)
- >>7 byte 7 (Monterey)
- >>7 byte 8 (IRIX)
- >>7 byte 9 (FreeBSD)
- >>7 byte 10 (Tru64)
- >>7 byte 11 (Novell Modesto)
- >>7 byte 12 (OpenBSD)
- >8 string \2
- >>7 byte 13 (OpenVMS)
- >>7 byte 97 (ARM)
- >>7 byte 255 (embedded)
以下是您参考的ELF标题和偏移量(从this link开始)：
- #define EI_NIDENT 16
- typedef struct {
- unsigned char e_ident[EI_NIDENT];
- Elf32_Half e_type;
- Elf32_Half e_machine;
- Elf32_Word e_version;
- Elf32_Addr e_entry;
- Elf32_Off e_phoff;
- Elf32_Off e_shoff;
- Elf32_Word e_flags;
- Elf32_Half e_ehsize;
- Elf32_Half e_phentsize;
- Elf32_Half e_phnum;
- Elf32_Half e_shentsize;
- Elf32_Half e_shnum;
- Elf32_Half e_shstrndx;
- } Elf32_Ehdr;
- Figure 4-4: e_ident[] Identification Indexes
- Name Value Purpose
- EI_MAG0 0 File identification
- EI_MAG1 1 File identification
- EI_MAG2 2 File identification
- EI_MAG3 3 File identification
- EI_CLASS 4 File class
- EI_DATA 5 Data encoding
- EI_VERSION 6 File version
- EI_OSABI 7 Operating system/ABI identification
- EI_ABIVERSION 8 ABI version
- EI_PAD 9 Start of padding bytes
- EI_NIDENT 16 Size of e_ident[]
