Types of Linux Executables

On any computer system, there are different types of executable files. Linux/Unix system especially support many types of executable files. Even among compiled executables, there are different types; this is not talking about the different programming languages used but the formats of the compilation itself. These different compiled formats are even used in library files (".so" files) and object code (".o" files). There are numerous executable type; only the ones that pertain to Linux will be discussed.

a.out – Assembler output executables come in one of five types listed below. This format is used on old forms of Linux and Unix systems. Newer Linux systems rarely use this format (if ever).

OMAGIC – The plain text and binary data are not separated. For example, using cat to view /bin/bash would reveal weird characters (that would be the binary code displayed in the form of ASCII characters) and some strings. For example, ^@^@/lib64/ld-linux-x86-64.so.2^@^D^@^@^@^P^@^@^@^A^

NOTE: /bin/bash is not an a.out executable; it is an ELF executable. The line above is used to explain what I am saying.

NMAGIC – Similar to OMAGIC but with different arrangements of the text and binary code.

QMAGIC – The header of the file is added to the first memory page of the text to save memory. In computer memory, the smallest unit of memory is a page (the bits and bytes refer to the data itself).

ZMAGIC – This has support for demand paging. The code is arranged in groups so each group fits on a page of memory.

CMAGIC – This executable is designed for core dumps.

Common Object File Format (COFF) – This format was used after a.out but before ELF on Linux/Unix systems. This executable format is still used on many systems including embedded systems and Windows. COFF executables have more sections than a.out and have better debugging features. These executables are not loaded in contiguous blocks.

Extended Common Object File Format (ECOFF) – ECOFF is COFF with extensions.

Executable and Linkable Format (ELF) – The most common and widely used Linux executable format is ELF. Most game systems and Unix systems use ELF executables. These executables begin with a header that look like the below when using the "less" command in a terminal. Notice that the header contains the string "ELF".

NOTE: This may not be the complete header. I only copied a portion of the first line.

^?ELF^B^A^A^@^@^@^@^@^@^@^@^@^B^@>^@^A^@^@^@<DC><D4>A^@^@^@^@^@@^@^@^@^@^@^@^@<C0><9B>^N^@^@

Besides the compiled executables, there are other executables that are not compiled. These text-based executables are called scripts. Scripts are not stand-alone executables like compiled executables. Scripts depend on an interpreter which is an external program. The interpreter is called in the header of a script called a hashpling. For instance, a Python3 script may have the hashpling "/usr/bin/env python3" as its header. When such a script is executed, the interpreter is called to read the script. The interpreter (which is a binary) performs the tasks written in the script. Most scripts have a hashpling in the form "#!/usr/bin/env X" where X is the name of the interpreter. Hashplings can be written like "#!/usr/bin/perl", but if Perl is not installed in that exact location, the scripts will not work. Writing the hashpling the other way permits the system to use the interpreter as long as it is in a location listed in the PATH variable. With shells, the hashplings usually point directly to the executable because shell interpreters should only be installed in /bin/.

Hashplings

• Perl – #!/usr/bin/env perl
• Python - #!/usr/bin/env python
• Python3 - #!/usr/bin/env python3
• Ruby - #!/usr/bin/env ruby
• Shell - #!/bin/sh
• ASH - #!/bin/ash
• BASH - #!/bin/bash
• csh - #!/bin/csh
• Tcsh - #!/bin/tcsh

Further Reading

• Hashplings - https://dcjtech.info/topic/hashplings/