0

I have the following problem: I have an elf file and I want to know whether that elf file can be run as a standalone executable or not. So for shared libraries e.g., .so files, I want to have False as a result and for ready-to-run binaries I want True as an output. I tried to leverage file to achieve this, but apparently the information given is not enough. Consider

file /usr/bin/sudo /usr/bin/sudo: setuid ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=3e4fbfd5a73126630bcc22d5dee68c32e2813566, stripped

where I actually expected the output to be ELF 64-bit LSB executable, like for the gcc compiler:

file /usr/bin/gcc-5 /usr/bin/gcc-5: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=b3417f0bc306e9b0afe35e778b5e4702f2d22b26, stripped

What am I missing here and are there any other ways to achieve my goal?

Sleik
  • 341
  • 4
  • 11
  • *"What am I missing here..."* - As I understand it, ELF executables re-use *"dynamically linked"* to mean ASLR (i.e., a program compiler with `-fPIC` or `-fPIE`). Also see [Readelf reports program is a shared library instead of executable](https://stackoverflow.com/q/30555248/608639). – jww Jul 04 '18 at 02:15

1 Answers1

2

I want to have False as a result and for ready-to-run binaries I want True as an output.

In general, your goal is unachievable: it is possible to build a library that is ready to run (e.g. /lib64/libc.so.6 on Linux) and also to build an executable that will crash on startup despite reporting ELF 64-bit LSB executable.

It is also ill-advised to try to run any binary unless you know where that binary came from and what its intended result of execution is.

What am I missing here

As this answer explains, many recent Linux distributions build PIE executables by default.

are there any other ways to achieve my goal?

See this answer.

Employed Russian
  • 199,314
  • 34
  • 295
  • 362