Question

I’m digging through two legacy cross-compiled ARM Linux builds. There isn’t much documentation other than “use this VM image to build the source” The only difference between the file command output is the presence of “(SYSV)”

# file Executable
Executable: ELF 32-bit LSB executable, ARM, version 1 (SYSV) ...

What should I be able to assume based on the presence or absence of SYSV in the string?

Answer 1

If you see that (SYSV) string, it means the e_ident[EI_OSABI] field in the ELF header is set to 0. From the ELF spec (PDF link):

Table 5. Operating System and ABI Identifiers, e_ident[EI_OSABI]
Name                 Value   Meaning
ELFOSABI_SYSV          0     System V ABI
ELFOSABI_HPUX          1     HP-UX operating system
ELFOSABI_STANDALONE   255    Standalone (embedded) application

My local machine’s /usr/share/file/magic/elf file has a longer list:

# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
# like proper ELF, but extracting the string had bad results.
>4      byte            <0x80
>>8 string      >\0     (%s)
>8  string      \0
>>7 byte        0       (SYSV)
>>7 byte        1       (HP-UX)
>>7 byte        2       (NetBSD)
>>7 byte        3       (GNU/Linux)
>>7 byte        4       (GNU/Hurd)
>>7 byte        5       (86Open)
>>7 byte        6       (Solaris)
>>7 byte        7       (Monterey)
>>7 byte        8       (IRIX)
>>7 byte        9       (FreeBSD)
>>7 byte        10      (Tru64)
>>7 byte        11      (Novell Modesto)
>>7 byte        12      (OpenBSD)
>8      string          \2
>>7     byte            13              (OpenVMS)
>>7 byte        97      (ARM)
>>7 byte        255     (embedded)

Here are the ELF header and offsets for your reference (from this link):

#define EI_NIDENT 16

typedef struct {
        unsigned char   e_ident[EI_NIDENT];
        Elf32_Half      e_type;
        Elf32_Half      e_machine;
        Elf32_Word      e_version;
        Elf32_Addr      e_entry;
        Elf32_Off       e_phoff;
        Elf32_Off       e_shoff;
        Elf32_Word      e_flags;
        Elf32_Half      e_ehsize;
        Elf32_Half      e_phentsize;
        Elf32_Half      e_phnum;
        Elf32_Half      e_shentsize;
        Elf32_Half      e_shnum;
        Elf32_Half      e_shstrndx;
} Elf32_Ehdr;


Figure 4-4: e_ident[] Identification Indexes
Name      Value Purpose
EI_MAG0       0     File identification
EI_MAG1       1     File identification
EI_MAG2       2     File identification
EI_MAG3       3     File identification
EI_CLASS      4     File class
EI_DATA       5     Data encoding
EI_VERSION    6     File version
EI_OSABI      7     Operating system/ABI identification
EI_ABIVERSION 8     ABI version
EI_PAD        9     Start of padding bytes
EI_NIDENT     16    Size of e_ident[]