Detailed parsing of executable file formats for Linux operating systems

Guide:?

An executable file can be a binary file with a different format, or it can be a script for a text. The executable image contains the code and data that the process executes, and it also contains information that the operating system uses to properly load the image into memory and execute it. In Linux, the current "local" (system default) executable file format is elf[15] (executable and linking format) executable link format. Since the previous a.out format was difficult to implement shared libraries and could not be applied to dynamic links, it is now all replaced by the elf. However, Linux still retains a binary handler for a.out, but it usually uses the elf.

Linux loaders typically identify files based on the "Magic Sequence" (a special byte sequence) that is embedded in the executable file, sometimes through some attributes of the file name. For example, a Java compilation handler can guarantee that its filename ends with a. Class, and that the first four bytes of the file are 0xcafebabe, as defined by the Java standard. The following is the binary processor provided by the 2.4 kernel under Intel, which in theory is flexible enough to handle almost all of the target file formats.

(1) a.out (in fs/binfmt_aout.c): This is to support the original style of the Linux binary files. Its existence is mainly to meet the needs of some systems for backward compatibility, but basically a.out has been honorably retired.

(2) ELF (in FS/BINFMT_ELF.C): Linux is currently the default binary file format. This format is widely used in both executables and shared libraries. The latest Linux systems (such as red Hat 9) are typically pre-installed with the ELF binaries interpreter, but in exceptional cases the decision to load the a.out binaries is supported by the system in a modular way. Although Elf is used as a native Linux local format, it also uses the same load handler as other formats.

(3) EM86 (in fs/binfmt_em86.c): Allows you to run Intel's Linux binaries on an alpha machine as if they were alpha local binary files.

(4) Java (in FS/BINFMT_JAVA.C): You can execute java. class files without having to define a Java bytecode interpreter every time. This mechanism is similar to the mechanism used in the script by passing the file name of the. class file as a parameter, and the handler returns an interpreter that executes the integer byte code. From the user's point of view, the Java binaries are handled as local executables.

(5) Misc (in FS/BINFMT_MISC.C): This is the wisest way to use a binary handler, which can identify a variety of binary formats with embedded feature numbers or filename suffixes, but the best feature is that it can be configured at runtime, Instead of being configured only at compile time. Therefore, as long as you follow its rules, you can quickly increase support for new binaries without recompiling the kernel or restarting the machine. The comments in the Linux source program file suggest that it is ultimately used to replace the Java and EM86 binary handlers.

(6) script (in fs/binfmt_script.c): Support for shell scripts, Perl scripts, and so on. Loosely speaking, all the previous two characters are "#!" Executable files are processed by this binary handler.

These binary formats supported by Linux can be built directly into the kernel when the kernel compiles the links, and can be loaded as a module while the kernel is running. The kernel holds a list of supported binary format interpreters that, when trying to execute a file, each binary format is tried in turn until the recognized binary format is identified.
This article turns from
Http://tech.ccidnet.com/art/9513/20071204/1296549_1.html