1 //===- llvm/BinaryFormat/Magic.cpp - File magic identification --*- C++ -*-===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 9 #include "llvm/BinaryFormat/Magic.h" 10 11 #include "llvm/BinaryFormat/COFF.h" 12 #include "llvm/BinaryFormat/ELF.h" 13 #include "llvm/BinaryFormat/MachO.h" 14 #include "llvm/Support/Endian.h" 15 #include "llvm/Support/FileSystem.h" 16 #include "llvm/Support/MemoryBuffer.h" 17 18 #if !defined(_MSC_VER) && !defined(__MINGW32__) 19 #include <unistd.h> 20 #else 21 #include <io.h> 22 #endif 23 24 using namespace llvm; 25 using namespace llvm::support::endian; 26 using namespace llvm::sys::fs; 27 28 template <size_t N> 29 static bool startswith(StringRef Magic, const char (&S)[N]) { 30 return Magic.startswith(StringRef(S, N - 1)); 31 } 32 33 /// Identify the magic in magic. 34 file_magic llvm::identify_magic(StringRef Magic) { 35 if (Magic.size() < 4) 36 return file_magic::unknown; 37 switch ((unsigned char)Magic[0]) { 38 case 0x00: { 39 // COFF bigobj, CL.exe's LTO object file, or short import library file 40 if (startswith(Magic, "\0\0\xFF\xFF")) { 41 size_t MinSize = 42 offsetof(COFF::BigObjHeader, UUID) + sizeof(COFF::BigObjMagic); 43 if (Magic.size() < MinSize) 44 return file_magic::coff_import_library; 45 46 const char *Start = Magic.data() + offsetof(COFF::BigObjHeader, UUID); 47 if (memcmp(Start, COFF::BigObjMagic, sizeof(COFF::BigObjMagic)) == 0) 48 return file_magic::coff_object; 49 if (memcmp(Start, COFF::ClGlObjMagic, sizeof(COFF::BigObjMagic)) == 0) 50 return file_magic::coff_cl_gl_object; 51 return file_magic::coff_import_library; 52 } 53 // Windows resource file 54 if (Magic.size() >= sizeof(COFF::WinResMagic) && 55 memcmp(Magic.data(), COFF::WinResMagic, sizeof(COFF::WinResMagic)) == 0) 56 return file_magic::windows_resource; 57 // 0x0000 = COFF unknown machine type 58 if (Magic[1] == 0) 59 return file_magic::coff_object; 60 if (startswith(Magic, "\0asm")) 61 return file_magic::wasm_object; 62 break; 63 } 64 65 case 0x01: 66 // XCOFF format 67 if (startswith(Magic, "\x01\xDF")) 68 return file_magic::xcoff_object_32; 69 if (startswith(Magic, "\x01\xF7")) 70 return file_magic::xcoff_object_64; 71 break; 72 73 case 0xDE: // 0x0B17C0DE = BC wraper 74 if (startswith(Magic, "\xDE\xC0\x17\x0B")) 75 return file_magic::bitcode; 76 break; 77 case 'B': 78 if (startswith(Magic, "BC\xC0\xDE")) 79 return file_magic::bitcode; 80 break; 81 case '!': 82 if (startswith(Magic, "!<arch>\n") || startswith(Magic, "!<thin>\n")) 83 return file_magic::archive; 84 break; 85 86 case '\177': 87 if (startswith(Magic, "\177ELF") && Magic.size() >= 18) { 88 bool Data2MSB = Magic[5] == 2; 89 unsigned high = Data2MSB ? 16 : 17; 90 unsigned low = Data2MSB ? 17 : 16; 91 if (Magic[high] == 0) { 92 switch (Magic[low]) { 93 default: 94 return file_magic::elf; 95 case 1: 96 return file_magic::elf_relocatable; 97 case 2: 98 return file_magic::elf_executable; 99 case 3: 100 return file_magic::elf_shared_object; 101 case 4: 102 return file_magic::elf_core; 103 } 104 } 105 // It's still some type of ELF file. 106 return file_magic::elf; 107 } 108 break; 109 110 case 0xCA: 111 if (startswith(Magic, "\xCA\xFE\xBA\xBE") || 112 startswith(Magic, "\xCA\xFE\xBA\xBF")) { 113 // This is complicated by an overlap with Java class files. 114 // See the Mach-O section in /usr/share/file/magic for details. 115 if (Magic.size() >= 8 && Magic[7] < 43) 116 return file_magic::macho_universal_binary; 117 } 118 break; 119 120 // The two magic numbers for mach-o are: 121 // 0xfeedface - 32-bit mach-o 122 // 0xfeedfacf - 64-bit mach-o 123 case 0xFE: 124 case 0xCE: 125 case 0xCF: { 126 uint16_t type = 0; 127 if (startswith(Magic, "\xFE\xED\xFA\xCE") || 128 startswith(Magic, "\xFE\xED\xFA\xCF")) { 129 /* Native endian */ 130 size_t MinSize; 131 if (Magic[3] == char(0xCE)) 132 MinSize = sizeof(MachO::mach_header); 133 else 134 MinSize = sizeof(MachO::mach_header_64); 135 if (Magic.size() >= MinSize) 136 type = Magic[12] << 24 | Magic[13] << 12 | Magic[14] << 8 | Magic[15]; 137 } else if (startswith(Magic, "\xCE\xFA\xED\xFE") || 138 startswith(Magic, "\xCF\xFA\xED\xFE")) { 139 /* Reverse endian */ 140 size_t MinSize; 141 if (Magic[0] == char(0xCE)) 142 MinSize = sizeof(MachO::mach_header); 143 else 144 MinSize = sizeof(MachO::mach_header_64); 145 if (Magic.size() >= MinSize) 146 type = Magic[15] << 24 | Magic[14] << 12 | Magic[13] << 8 | Magic[12]; 147 } 148 switch (type) { 149 default: 150 break; 151 case 1: 152 return file_magic::macho_object; 153 case 2: 154 return file_magic::macho_executable; 155 case 3: 156 return file_magic::macho_fixed_virtual_memory_shared_lib; 157 case 4: 158 return file_magic::macho_core; 159 case 5: 160 return file_magic::macho_preload_executable; 161 case 6: 162 return file_magic::macho_dynamically_linked_shared_lib; 163 case 7: 164 return file_magic::macho_dynamic_linker; 165 case 8: 166 return file_magic::macho_bundle; 167 case 9: 168 return file_magic::macho_dynamically_linked_shared_lib_stub; 169 case 10: 170 return file_magic::macho_dsym_companion; 171 case 11: 172 return file_magic::macho_kext_bundle; 173 } 174 break; 175 } 176 case 0xF0: // PowerPC Windows 177 case 0x83: // Alpha 32-bit 178 case 0x84: // Alpha 64-bit 179 case 0x66: // MPS R4000 Windows 180 case 0x50: // mc68K 181 case 0x4c: // 80386 Windows 182 case 0xc4: // ARMNT Windows 183 if (Magic[1] == 0x01) 184 return file_magic::coff_object; 185 LLVM_FALLTHROUGH; 186 187 case 0x90: // PA-RISC Windows 188 case 0x68: // mc68K Windows 189 if (Magic[1] == 0x02) 190 return file_magic::coff_object; 191 break; 192 193 case 'M': // Possible MS-DOS stub on Windows PE file, MSF/PDB file or a 194 // Minidump file. 195 if (startswith(Magic, "MZ") && Magic.size() >= 0x3c + 4) { 196 uint32_t off = read32le(Magic.data() + 0x3c); 197 // PE/COFF file, either EXE or DLL. 198 if (Magic.substr(off).startswith( 199 StringRef(COFF::PEMagic, sizeof(COFF::PEMagic)))) 200 return file_magic::pecoff_executable; 201 } 202 if (Magic.startswith("Microsoft C/C++ MSF 7.00\r\n")) 203 return file_magic::pdb; 204 if (startswith(Magic, "MDMP")) 205 return file_magic::minidump; 206 break; 207 208 case 0x64: // x86-64 or ARM64 Windows. 209 if (Magic[1] == char(0x86) || Magic[1] == char(0xaa)) 210 return file_magic::coff_object; 211 break; 212 213 default: 214 break; 215 } 216 return file_magic::unknown; 217 } 218 219 std::error_code llvm::identify_magic(const Twine &Path, file_magic &Result) { 220 auto FileOrError = MemoryBuffer::getFile(Path, -1LL, false); 221 if (!FileOrError) 222 return FileOrError.getError(); 223 224 std::unique_ptr<MemoryBuffer> FileBuffer = std::move(*FileOrError); 225 Result = identify_magic(FileBuffer->getBuffer()); 226 227 return std::error_code(); 228 } 229