Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP Posting-Version: version B 2.10.2 9/18/84; site ncoast.UUCP Path: utzoo!watmath!clyde!burl!ulysses!allegra!mit-eddie!genrad!decvax!cwruecmp!hal!ncoast!allbery From: allbery@ncoast.UUCP (Brandon Allbery) Newsgroups: net.unix-wizards Subject: Magic Numbers Message-ID: <908@ncoast.UUCP> Date: Wed, 4-Dec-85 21:47:06 EST Article-I.D.: ncoast.908 Posted: Wed Dec 4 21:47:06 1985 Date-Received: Sat, 7-Dec-85 03:15:03 EST References: <124@rexago1.UUCP> <416@ihdev.UUCP> Reply-To: allbery@ncoast.UUCP (Brandon Allbery) Followup-To: net.unix-wizards Distribution: net Organization: Cleveland Public Access UNIX, Cleveland, OH Lines: 57 Expires: Quoted from <416@ihdev.UUCP> ["Re: magic numbers? (teach me, please)"], by pdg@ihdev.UUCP (P. D. Guthrie)... +--------------- | In article <124@rexago1.UUCP> rich@rexago1.UUCP (K. Richard Magill) writes: | > 1) How does the shell (exec?) know whether the command I just typed | > is a shell script or one of several possible types of | > executable? | | The shell doesn't know. The shell merely tells the kernel to exec the | file, after doing a fork. The kernel determines if a file is a binary | executable by the magic number, which is obtained by reading an a.out.h | structure (4.1,4.2) or filehdr.h (sys 5) and comparing it against | hardcoded numbers in the kernel. In 4.1 for instance only 407,413 and | 410 are legal. This also tells the kernel the specific type of | executable, and in some cases can set emulation modes. The kernel also | recognizes | #! /your/shellname | at the beginning of a file and execs off the appropriate shell instead. +--------------- In 4.2, the #! is recognized. In all other Unices, the exec will fail, and the shell will decide that the file must be a shell script; it proceeds to fork off a copy of itself to run the script. (Csh on non-4.2 systems checks for a # as the first character of the file, and forks itself if it sees it; if not, it forks a /bin/sh.) +--------------- | > 2) Presuming the answer to #1 above has something to do with | > magic numbers, who issues them? is there a common | > (definitive) base of them or does each | > manufacturer/environment make up their own set? | | The magic number is issued by the linker/loader. Pretty much the magic | number is decided by the manufacturer, but from what I have seen, is | kept constant over machines. Forgive me if this is wrong, but I do not | have any method of checking, but the magic numbers for say plain | executable 4.x Vax and plain executable SysV.x Vax are the same, but | SysV.x Vax and SysV.x 3B20 are different. Could someone comfirm this? +--------------- Executables using ``standard'' binary formats, i.e. a.out (PDP-11, Z8000) and b.out (MC68000) use the standard magic numbers 0405, 0407, 0410, 0411. Non-standard formats, like Xenix x.out (0x0206) and COFF (flames to /dev/null; most systems are [ab].out) use distinctive magic numbers. There are other magic numbers. Old-style archives (ar) have 0177545 as a magic number; again, the loader knows about this, since a library is an archive. System V archives begin with the magic ``number'' "!\n". Cpio archives also have magic numbers in them, but at the archive-member level. -- Lord Charteris (thurb) ncoast!allbery@Case.CSNet (ncoast!allbery%Case.CSNet@CSNet-Relay.ARPA) ..decvax!cwruecmp!ncoast!allbery (..ncoast!tdi2!root for business) 6615 Center St., Mentor, OH 44060 (I moved) --Phone: +01 216 974 9210 CIS 74106,1032 -- MCI MAIL BALLBERY (WARNING: I am only a part-time denizen...)