3 ms·
Why is ELF a good example? 7F 45 4C 46 - MUST be the very first N bytes in the file -> check - MUST be at least four bytes long, eight is better -> check
by weinzierl 2y ago
Why is ELF a good example?
7F 45 4C 46
- MUST be the very first N bytes in the file -> check
- MUST be at least four bytes long, eight is better -> check, but only four
- MUST include at least one byte with the high bit set -> nope
- MUST include a byte sequence that is invalid UTF-8 -> nope
- SHOULD include a zero byte -> nope
So, just 1.5 out of 5. Not good.
By the way, does anyone know the reason it starts with DEL (7F) specifically?
- 0xFF0123 2y agoIt's (7F) ELF
- indigoabstract 2y agoHmm, I would expect that to be 31F, if it stood for "ELF" in correct Hexspeak.
- rickdeckard 2y agoI think what the author likes is the fact that the first 4 bytes are defined as 0x7F followed by the file extension "ELF" in ASCII, which makes it a quite robust identifier. And to be fair, including the 4 byte following the magic number make the ELF-format qualify at least 3 out of the 4 'MUST' requirements: _ 7F 45 4C 46 - 0x04: Either 01 or 02 (defines 32bit or 64bit) - 0x05: Either 01 or 02 (defines Little Endian or Big Endian) - 0x06: Set to 01 (ELF-version) - 0x07: 00~12 (Target OS ABI) Still not a shiny example though...
- weinzierl 2y agoMaybe, yes. There are certainly worse offenders than ELF, but I still don't see how it satisfies 3 out of the 4 MUSTs. There is no byte with the high bit set and it is a valid ASCII sequence and therefore also valid UTF-8. When it comes to the "eight is better" requirement, at least Linux does not care what comes after the fourth byte for identification purposes, so I think that does not count either.
- deleted 2y ago[deleted]
- layer8 2y agoI agree that it isn’t a particularly good example, especially with reference to the stated rules. Many binary-detection routines will treat DEL as a regular ASCII character.