CODEWITHSUNDEEP
x86armelfabi
user2485710
user2485710

Reputation: 9811

There is a signature for a specific ABI in an ELF or binary file?

I need to identify the ABI used to generate some binaries, programs, dynamic and static libraries .

I would like to ask if there is a property or a tag or a string I can check with some external tool to see which ABI was used to create that binary object . My objects are mostly ELF for x86 and ARM, and I'm including ABIs for debugging purposes too like DWARF ones .

EDIT: something like the magic bytes at the start of a file that are generally used to detect the fileformat of a file .

Upvotes: 3

Views: 2122

Answers (1)

Igor Skochinsky
Igor Skochinsky

Reputation: 25318

There are a several indicators which may be present in the ELF files.

  1. the EI_OSABI field of the ELF header ident
  2. the .note.ABI-tag used to mark e.g. Linux vs. FreeBSD binaries.
  3. FreeBSD uses "branding" signature in the reserved part of the e_indent field (starting from the 8th byte).
  4. For ARM files, you additionally have EABI version/variant info in the e_flags field, and the object files may also have the .ARM.attributes section
  5. .comment section may contain compiler name/version, but it's informational only - it is not used by the OS to identify the ABI, and usually does not mention specific ABI information.
  6. the .note section may contain additional info which could point to the ABI being used.

In most cases, readelf will display the necessary info, though you may need to add some switches (e.g. -A to display the .ARM.attributes section). I don't think there's anything to parse the .note.ABI-tag section so you may have to do it manually.

For more info, see the SysV ABI and ARM EABI docs.

Upvotes: 7

Related Questions