linux shell 判断ELF文件,linux file命令查看elf文件信息

使用file命令查看动态链接库， 得到如下结果：

#/usr/libx32$ file ../lib32/libgomp.so.1.0.0

../lib32/libgomp.so.1.0.0: ELF 32-bit LSB  shared object, Intel 80386, version 1 (SYSV), dynamically linked, BuildID[sha1]=57ec5c404cd4f781ac341332437a6960784e4581, stripped

#:/usr/libx32$ file ../libx32/libgcc_s.so.1

../libx32/libgcc_s.so.1:ELF 32-bitLSB  shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=4713f15844e2b3e13f741bd5acef9aaab24cff03, stripped

其中比较让我困惑的红字部分，

ELF 32-bit表示这个elf文件是elf32的， ELF64-bit表示elf文件是elf64的

typedef struct elf32_hdr {

unsigned char e_ident[EI_NIDENT];

Elf32_Half e_type;

Elf32_Half e_machine;

Elf32_Word e_version;

Elf32_Addr e_entry; /* Entry point */

Elf32_Off e_phoff;

Elf32_Off e_shoff;

Elf32_Word e_flags;

Elf32_Half e_ehsize;

Elf32_Half e_phentsize;

Elf32_Half e_phnum;

Elf32_Half e_shentsize;

Elf32_Half e_shnum;

Elf32_Half e_shstrndx;

} Elf32_Ehdr;

typedef struct elf64_hdr {

unsigned char e_ident[16]; /* ELF "magic number" */

Elf64_Half e_type;

Elf64_Half e_machine;

Elf64_Word e_version;

Elf64_Addr e_entry; /* Entry point virtual address */

Elf64_Off e_phoff; /* Program header table file offset */

Elf64_Off e_shoff; /* Section header table file offset */

Elf64_Word e_flags;

Elf64_Half e_ehsize;

Elf64_Half e_phentsize;

Elf64_Half e_phnum;

Elf64_Half e_shentsize;

Elf64_Half e_shnum;

Elf64_Half e_shstrndx;

} Elf64_Ehdr;

对于elf32和elf64头，二者的前16字节是Magic, Magic第五个字节定义了elf文件的格式.

Intel 80386和x86-64则定义了目标机器的类型,也就是目标机器的指令集