linux file命令查看elf檔案資訊__linux

使用file命令查看動態連結程式庫， 得到如下結果：

#/usr/libx32$ file ../lib32/libgomp.so.1.0.0
../lib32/libgomp.so.1.0.0: ELF 32-bit LSB  shared object, Intel 80386, version 1 (SYSV), dynamically linked, BuildID[sha1]=57ec5c404cd4f781ac341332437a6960784e4581, stripped
#:/usr/libx32$ file ../libx32/libgcc_s.so.1
../libx32/libgcc_s.so.1: ELF 32-bit LSB  shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=4713f15844e2b3e13f741bd5acef9aaab24cff03, stripped

其中比較讓我困惑的紅字部分，

ELF 32-bit表示這個elf檔案是elf32的， ELF64-bit表示elf檔案是elf64的

typedef struct elf32_hdr {    unsigned char e_ident[EI_NIDENT];    Elf32_Half e_type;    Elf32_Half e_machine;    Elf32_Word e_version;    Elf32_Addr e_entry; /* Entry point */    Elf32_Off e_phoff;    Elf32_Off e_shoff;    Elf32_Word e_flags;    Elf32_Half e_ehsize;    Elf32_Half e_phentsize;    Elf32_Half e_phnum;    Elf32_Half e_shentsize;    Elf32_Half e_shnum;    Elf32_Half e_shstrndx;} Elf32_Ehdr;typedef struct elf64_hdr {    unsigned char e_ident[16];  /* ELF "magic number" */    Elf64_Half e_type;    Elf64_Half e_machine;    Elf64_Word e_version;    Elf64_Addr e_entry; /* Entry point virtual address */    Elf64_Off e_phoff;  /* Program header table file offset */    Elf64_Off e_shoff;  /* Section header table file offset */    Elf64_Word e_flags;    Elf64_Half e_ehsize;    Elf64_Half e_phentsize;    Elf64_Half e_phnum;    Elf64_Half e_shentsize;    Elf64_Half e_shnum;    Elf64_Half e_shstrndx;} Elf64_Ehdr;

對於elf32和elf64頭，二者的前16位元組是Magic, Magic第五個位元組定義了elf檔案的格式.

Intel 80386和x86-64則定義了目標機器的類型,也就是目標機器的指令集