Detailed parsing of executable file formats in Linux

An executable file can be a binary file of different formats or a text script. The executable file image contains the code and data for process execution, and the operating system.

An executable file can be a binary file of different formats or a text script. The executable file image contains the code and data executed by the process, as well as the information that the operating system uses to correctly load the image into the memory and execute it.

In Linux, the current "local" (default) Executable file Format is ELF [15] (Executable and Linking Format) Executable link Format. Because the previous a. out format is difficult to implement shared libraries and cannot be applied to dynamic links, all of them have been replaced by ELF. However, Linux retains a binary handler for a. out, but ELF is usually used.

Linux loaders generally recognize files based on the "magic sequence" embedded at the beginning of an executable file (a special byte sequence), and sometimes use some features of file names. For example, a Java compilation handler can ensure that the file name ends with. class, and the first four bytes of the file start are 0 xcafebabe, which is defined by the Java Standard. The following is a binary processing program provided by the 2.4 kernel in the Intel system. Theoretically, Linux is flexible enough to process almost all target file formats.

(1) a. out (in fs/binfmt_aout.c): this is to support the original Linux binary file. It is mainly used to meet the backward compatibility needs of some systems, but basically a. out has been retired.

(2) ELF (in fs/binfmt_elf.c): Currently, it is the default binary file format in Linux. This format is widely used in executable files and shared libraries. In the latest Linux system (such as Red Hat 9), only the ELF binary interpreter is pre-installed, but in special cases, it is necessary to load. out binary file, the system also supports it through modules. Although ELF is used as a common Linux local format, it uses the same loading handler as other formats.

(3) EM86 (in fs/binfmt_em86.c): allows Intel Linux binary files to be run on Alpha machines, as if they are Alpha local binary files.

(4) Java (in fs/binfmt_java.c): You do not have to define the Java bytecode interpreter every time to execute the Java. class file. This mechanism is similar to the mechanism used in the script. by passing the file name of the. class file as a parameter, the handler returns the interpreted program that executes the integer bytecode. From the user's point of view, Java binary files are processed as local executable files.

(5) misc (in fs/binfmt_misc.c): This is the smartest way to use a binary handler, this processing program can identify various binary formats by embedding feature numbers or filename suffixes, but the best feature is that it can be configured at runtime rather than during compilation. Therefore, as long as you follow the rules, you can quickly add support for new binary files without re-compiling the kernel or restarting the machine. We recommend that you replace Java and EM86 binary processors with annotations in Linux source program files.

(6) scripts (in fs/binfmt_script.c): provides support for shell scripts and Perl scripts. Loose, all the first two characters are "#!". All executable files are processed by the binary processing program.

These binary formats supported by Linux can be directly established in the kernel during Kernel Compilation links, or loaded as modules during kernel running. The kernel stores a list of supported binary format interpreters. when trying to execute a file, every binary format will be tried in sequence until the corresponding identifiable binary format is determined.