Analysis of ELF magic number in Linux

ELF magic number parsing in Linux: in Linux, we can usually use the readelf command to view ELF File Information. For example, the www.2cto.com ELF file contains 32-bit and 64-bit versions. The structure information of the 32-bit version is as follows: The above structure basically corresponds to the elf information of the output kill0 file, the difference is that e_ident in Elf32_Ehdr corresponds to "Class", "Data", "Version", "OS/ABI", "ABI Version" in readelf output ". The ELF magic number we want to talk about is the number of the draw line in the first figure. The first four bytes are all ELF files must have the same identifier, 0x7F, 0x45, 0x4c, 0x46, respectively. The first byte corresponds to the DEL control character in the ASCII characters, the next three bytes are exactly the elf ascii code. These four bytes are called the magic number of ELF. The first few bytes of almost all executable file formats are magic numbers. This magic number is used to confirm the file type. The operating system will confirm whether the magic number is correct when loading executable files.