Computer Systems Security

Magic is an event, that is at first, inexplicable by our practical judgement. However if you try hard, you can make sense of it.

Magic numbers are seemingly random inexplicable numbers that pop up in the code. Some are intentional because they are not supposed to be consumed by users/programmers like ELF magic numbers, but some are unintentional which at least warrant a comment or a macro definition unlike the following :

#define FOUR 4

int add_four(x) {
    x = x + FOUR;
    return x;
}

A binary in C needs to have a specific structure for the OS to parse and convert it into a running process. It needs to know where the code section is, at which address to begin executing, where the libraries are etc. This structure is laid out in ELF which is a common format used today. ELF stands for Executable and Linkable Format.

When you create a simple program [ binary ] in C,

> cat prog.c

int
main(void) {
return 0;
}

> gcc -Wall prog.c -o prog

Now let us check the file format on different systems :

                               MAC OS

> file prog
Mach-O 64-bit executable x86_64

> hexdump prog | head -n 1
0000000 cf fa ed fe 07 00 00 01 03 00 00 00 02 00 00 00

                               LINUX

> file prog
ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=7a3f676e46571ba359547eaa2df2c84178b5d286, not stripped

> hexdump prog | head -n 1
0000000 457f 464c 0102 0001 0000 0000 0000 0000

If you look closely, Mac OS uses the Mach-O format, and Linux uses ELF format. We will be discussing the ELF format ( there are multiple formats out there ).

Let us understand some basics of the ELF format…