What is ELF Magic?

Right from the man page you reference:

elf - format of Executable and Linking Format (ELF) files

ELF defines the binary format of executable files used by Linux. When you invoke an executable, the OS must know how to load the executable into memory properly, how to resolve dynamic library dependencies and then where to jump into the loaded executable to start executing it. The ELF format provides this information. ELF magic is used to identify ELF files and is merely the very first few bytes of a file:

% od -c -N 16 /bin/ls
0000000 177   E   L   F 002 001 001  \0  \0  \0  \0  \0  \0  \0  \0  \0
0000020

or

% readelf -h /bin/ls | grep Magic
  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 

These 16 bytes unambiguously identify a file as an ELF executable. Many file formats have "magic" bytes that accomplish the same task -- identifying a type of file.


"Magic numbers" is the name given to constant sequences of bytes (usually) at the beginning of files, used to mark those files as being of a particular file format. They serve a similar purpose to file extensions.

See the jargon file entry for more information.

For example, PNG images always start with the same eight bytes: 137 80 78 71 13 10 26 10

Hence ELF magic numbers are the bytes at the beginning of elf files that identify them as such.

Tags:

Elf