ELF parse error: Invalid Magic Bytes: [4D, 5A, 71, 46]

[franalbani]

Describe the bug

Can't open binaries from cosmo.zip that where compiled with Cosmopolitan libc

To reproduce

$ wget -qO /tmp/true https://cosmo.zip/pub/cosmos/bin/true
$ binsider /tmp/true
ELF parse error: `Invalid Magic Bytes: [4D, 5A, 71, 46]`

Software information

• Operating system: Arch GNU/Linux x86_64 6.10.1-arch1-1
• Rust version: rustc 1.81.0 (eeb90cda1 2024-09-04) (Arch Linux rust 1:1.81.0-1)

[orhun]

Hey, thanks for reporting!

Does the file have a valid ELF format? binsider currently only support ELF.

$ file true

etc/true: DOS/MBR boot sector; partition 1 : ID=0x7f, active, start-CHS (0x0,0,1), end-CHS (0x3ff,255,63), startsector 0, 4294967295 sectors

Compared to:

$ file /usr/bin/ls

/usr/bin/ls: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=7aa8f52223e371fb77314d9a363129574096093b, for GNU/Linux 4.4.0, stripped

[hustcer]

Thanks for the project! will Mach-O 64-bit executable be supported someday?

 ❯ file /opt/homebrew/bin/binsider
/opt/homebrew/bin/binsider: Mach-O 64-bit executable arm64

 ❯ binsider /opt/homebrew/bin/binsider
ELF parse error: `Invalid Magic Bytes: [CF, FA, ED, FE]`

[orhun]

Yup, one day! See #26 :)

[franalbani]

Does the file have a valid ELF format? binsider currently only support ELF.

No, it is a clever trick to "mimic" most executable formats out there. The file utility is just reporting the type of the first found segment but the ELF segment appears after.

It's called Actually Portable Executable

[orhun]

Interesting. I think this should be reported to elf.