Question

I am trying to register a specific program to run binaries that contain a magic number by using binfmt_misc on Linux.

This is accomplished by echo’ing a string in the format:

:name:type:offset:magic:mask:interpreter:flags

The Linux kernel documentation provides a few examples of this string at Documentation/binfmt_misc:

:i386:M::\x7fELF\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x03:\xff\xff\xff\xff\xff\xfe\xfe\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfb\xff\xff:/bin/em86:
:i486:M::\x7fELF\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x06:\xff\xff\xff\xff\xff\xfe\xfe\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfb\xff\xff:/bin/em86:
:DEXE:M::\x0eDEX::/usr/bin/dosexec:
:DOSWin:M::MZ::/usr/local/bin/wine:

The magic number that I am interested in is displayed as 01eb in emacs’ hexl-mode:

00000000: 0000 01eb 0000 4d8f 0000 09a0 0000 0314  ......M.........

So far, I have:

:nine:M:$OFFSET:$MAGIC::/home/robb/nine/nine:    

but I am not sure what values I need to replace $OFFSET and $MMAGIC with.

Answer 1

It starts at the 3rd byte in the file. Byte offsets start at zero, so $OFFSET should be 2.

Your 01eb needs to be encoded in hexadecimal, so $MAGIC is \x01\xeb. Your shell may require an extra backslash before every \x in order to escape it.