Wednesday, 27 July 2016

What is the magic number in elf header?

A "magic number" is the constant numbers given in file header to identify the format of the file.

In ELF file format the first four bytes in ELF header is usually refer to as magic number which is constant and the values are: 7f 45 4c 46

If we see the ascii value of 45 4c & 46, it is E, L & F.

Hurray! We got the type of the file as ELF using those numbers.

Now, You will say How did u get that number?

Here's the command, my friend  :

$ readelf -h /bin/ls
ELF Header:
  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
  Class:                                          ELF64
  Data:                                           2's complement, little endian
  Version:                                       1 (current)
  OS/ABI:                                      UNIX - System V
  ABI Version:                               0
  Type:                                            EXEC (Executable file)
  Machine:                                      Advanced Micro Devices X86-64
  Version:                                        0x1
  Entry point address:                     0x4045a4
  Start of program headers:             64 (bytes into file)
  Start of section headers:               104048 (bytes into file)
  Flags:                                            0x0
  Size of this header:                       64 (bytes)
  Size of program headers:              56 (bytes)
  Number of program headers:        9
  Size of section headers:                 64 (bytes)
  Number of section headers:          28
  Section header string table index: 27

The above is showing us the complete header info of ELF file. 

If you want to see the same in octal format, here is the command and  output:

$ od -c -N 16 /bin/ls
0000000 177   E   L   F 002 001 001  \0  \0  \0  \0  \0  \0  \0  \0  \0

So, Magic numbers are few constant number which tells the format of the file.