7

I would like to be able to check the format of an object file from within my C code so that I can use different functions for reading the file based on whether it is COFF or ELF format.

Is this possible, and if so, how would I do it?

This is in Linux btw if that makes any difference.

Chris
  • 402
  • 1
  • 5
  • 18
  • 5
    Try libmagic. It's an interface for using the 'magic' library, which the 'file' command also uses. – Marc B Oct 10 '12 at 15:09

3 Answers3

14

Read the first four bytes. If they are equal to \x7fELF, it's an ELF file. Otherwise, you should parse it as COFF and see if it makes sense. (Note that COFF magic is a lot more complicated; I get no less than 42 magic entries in /usr/share/file/magic for it).

nneonneo
  • 171,345
  • 36
  • 312
  • 383
  • 5
    I upvoted however I disagree with `Otherwise it's COFF`. If the ELF magic is not there, it's not an ELF file, but stating that means if's COFF is a little presumptive I think -- what happens when the input file is just not an object at all, for example. – mah Oct 10 '12 at 15:11
  • Of course that would be possible. In this case, he would fall back to COFF reading routines, which would probably fail if it was not COFF. – nneonneo Oct 10 '12 at 15:13
  • (The other problem is that pinning down a good magic number for COFF appears to be significantly harder. Therefore it is easier to check ELF, then assume COFF and let the COFF parser figure it out) – nneonneo Oct 10 '12 at 15:15
  • @nneonneo: using same logic, he can just go ahead with ELF routines, which will fail if it's not an ELF, then fall back to COFF, and then to error... – m0skit0 Oct 10 '12 at 15:19
  • Sure, but you can actually tell trivially if a file is ELF or not. (Of course, the ELF routine still must check the file's sanity). – nneonneo Oct 10 '12 at 15:20
  • Thanks, this seems to be the easiest way to check. The only supported types are ELF and COFF so if some other type of file is used I wouldn't want to read it anyway and returning an error is fine since this happens already for the COFF reader. – Chris Oct 10 '12 at 15:49
5

Try the command file. It tells you the type of a file.

logoff
  • 3,347
  • 5
  • 41
  • 58
  • 6
    While this is a valid way to determine the type of many files, it really does not answer the question (which asks for a way to do it from C... and `popen("file ...")` would be a pretty poor solution). – mah Oct 10 '12 at 15:15
5

Check the magic number. The ELF magic number is 0x7f454C46 (0x7f + "ELF") and COFF's is 0x14c. Take care about this anyway because there are different magic numbers for COFF.

Watch out about endianness when reading these values.

m0skit0
  • 25,268
  • 11
  • 79
  • 127
  • There's something like 40 different magic numbers for all the different COFF formats in existence. Theoretically the OP could just test for the COFF associated with his target architecture, but COFF in general is not as easy to test for. – nneonneo Oct 10 '12 at 15:23
  • I already stated this in my answer. If he wants to be accurate, he has no choice but include all magic numbers. – m0skit0 Oct 10 '12 at 15:25