I'm digging through two legacy cross-compiled ARM Linux builds. There isn't much documentation other than "use this VM image to build the source" The only difference between the file command output is the presence of "(SYSV)"
# file Executable
Executable: ELF 32-bit LSB executable, ARM, version 1 (SYSV) ...
What should I be able to assume based on the presence or absence of SYSV in the string?
If you see that (SYSV) string, it means the e_ident[EI_OSABI] field in the ELF header is set to 0. From the ELF spec (PDF link):
Table 5. Operating System and ABI Identifiers, e_ident[EI_OSABI]
Name Value Meaning
ELFOSABI_SYSV 0 System V ABI
ELFOSABI_HPUX 1 HP-UX operating system
ELFOSABI_STANDALONE 255 Standalone (embedded) application
My local machine's /usr/share/file/magic/elf file has a longer list:
# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
# like proper ELF, but extracting the string had bad results.
>4 byte <0x80
>>8 string >\0 (%s)
>8 string \0
>>7 byte 0 (SYSV)
>>7 byte 1 (HP-UX)
>>7 byte 2 (NetBSD)
>>7 byte 3 (GNU/Linux)
>>7 byte 4 (GNU/Hurd)
>>7 byte 5 (86Open)
>>7 byte 6 (Solaris)
>>7 byte 7 (Monterey)
>>7 byte 8 (IRIX)
>>7 byte 9 (FreeBSD)
>>7 byte 10 (Tru64)
>>7 byte 11 (Novell Modesto)
>>7 byte 12 (OpenBSD)
>8 string \2
>>7 byte 13 (OpenVMS)
>>7 byte 97 (ARM)
>>7 byte 255 (embedded)
Here are the ELF header and offsets for your reference (from this link):
#define EI_NIDENT 16
typedef struct {
unsigned char e_ident[EI_NIDENT];
Elf32_Half e_type;
Elf32_Half e_machine;
Elf32_Word e_version;
Elf32_Addr e_entry;
Elf32_Off e_phoff;
Elf32_Off e_shoff;
Elf32_Word e_flags;
Elf32_Half e_ehsize;
Elf32_Half e_phentsize;
Elf32_Half e_phnum;
Elf32_Half e_shentsize;
Elf32_Half e_shnum;
Elf32_Half e_shstrndx;
} Elf32_Ehdr;
Figure 4-4: e_ident[] Identification Indexes
Name Value Purpose
EI_MAG0 0 File identification
EI_MAG1 1 File identification
EI_MAG2 2 File identification
EI_MAG3 3 File identification
EI_CLASS 4 File class
EI_DATA 5 Data encoding
EI_VERSION 6 File version
EI_OSABI 7 Operating system/ABI identification
EI_ABIVERSION 8 ABI version
EI_PAD 9 Start of padding bytes
EI_NIDENT 16 Size of e_ident[]