If you see the line (SYSV)
, this means that the e_ident[EI_OSABI]
field in the ELF header is 0. From the ELF specification (PDF link) :
Table 5. Operating System and ABI Identifiers, e_ident[EI_OSABI] Name Value Meaning ELFOSABI_SYSV 0 System V ABI ELFOSABI_HPUX 1 HP-UX operating system ELFOSABI_STANDALONE 255 Standalone (embedded) application
My local file /usr/share/file/magic/elf
has a longer list:
Here is the ELF header and offsets for your reference (from this link ):
#define EI_NIDENT 16 typedef struct { unsigned char e_ident[EI_NIDENT]; Elf32_Half e_type; Elf32_Half e_machine; Elf32_Word e_version; Elf32_Addr e_entry; Elf32_Off e_phoff; Elf32_Off e_shoff; Elf32_Word e_flags; Elf32_Half e_ehsize; Elf32_Half e_phentsize; Elf32_Half e_phnum; Elf32_Half e_shentsize; Elf32_Half e_shnum; Elf32_Half e_shstrndx; } Elf32_Ehdr; Figure 4-4: e_ident[] Identification Indexes Name Value Purpose EI_MAG0 0 File identification EI_MAG1 1 File identification EI_MAG2 2 File identification EI_MAG3 3 File identification EI_CLASS 4 File class EI_DATA 5 Data encoding EI_VERSION 6 File version EI_OSABI 7 Operating system/ABI identification EI_ABIVERSION 8 ABI version EI_PAD 9 Start of padding bytes EI_NIDENT 16 Size of e_ident[]
source share