1 //===- llvm/BinaryFormat/Magic.cpp - File magic identification --*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8
9 #include "llvm/BinaryFormat/Magic.h"
10 #include "llvm/ADT/StringRef.h"
11 #include "llvm/ADT/Twine.h"
12 #include "llvm/BinaryFormat/COFF.h"
13 #include "llvm/BinaryFormat/MachO.h"
14 #include "llvm/Support/Endian.h"
15 #include "llvm/Support/MemoryBuffer.h"
16
17 #if !defined(_MSC_VER) && !defined(__MINGW32__)
18 #include <unistd.h>
19 #else
20 #include <io.h>
21 #endif
22
23 using namespace llvm;
24 using namespace llvm::support::endian;
25 using namespace llvm::sys::fs;
26
27 template <size_t N>
startswith(StringRef Magic,const char (& S)[N])28 static bool startswith(StringRef Magic, const char (&S)[N]) {
29 return Magic.startswith(StringRef(S, N - 1));
30 }
31
32 /// Identify the magic in magic.
identify_magic(StringRef Magic)33 file_magic llvm::identify_magic(StringRef Magic) {
34 if (Magic.size() < 4)
35 return file_magic::unknown;
36 switch ((unsigned char)Magic[0]) {
37 case 0x00: {
38 // COFF bigobj, CL.exe's LTO object file, or short import library file
39 if (startswith(Magic, "\0\0\xFF\xFF")) {
40 size_t MinSize =
41 offsetof(COFF::BigObjHeader, UUID) + sizeof(COFF::BigObjMagic);
42 if (Magic.size() < MinSize)
43 return file_magic::coff_import_library;
44
45 const char *Start = Magic.data() + offsetof(COFF::BigObjHeader, UUID);
46 if (memcmp(Start, COFF::BigObjMagic, sizeof(COFF::BigObjMagic)) == 0)
47 return file_magic::coff_object;
48 if (memcmp(Start, COFF::ClGlObjMagic, sizeof(COFF::BigObjMagic)) == 0)
49 return file_magic::coff_cl_gl_object;
50 return file_magic::coff_import_library;
51 }
52 // Windows resource file
53 if (Magic.size() >= sizeof(COFF::WinResMagic) &&
54 memcmp(Magic.data(), COFF::WinResMagic, sizeof(COFF::WinResMagic)) == 0)
55 return file_magic::windows_resource;
56 // 0x0000 = COFF unknown machine type
57 if (Magic[1] == 0)
58 return file_magic::coff_object;
59 if (startswith(Magic, "\0asm"))
60 return file_magic::wasm_object;
61 break;
62 }
63
64 case 0x01:
65 // XCOFF format
66 if (startswith(Magic, "\x01\xDF"))
67 return file_magic::xcoff_object_32;
68 if (startswith(Magic, "\x01\xF7"))
69 return file_magic::xcoff_object_64;
70 break;
71
72 case 0x03:
73 if (startswith(Magic, "\x03\xF0\x00"))
74 return file_magic::goff_object;
75 break;
76
77 case 0x10:
78 if (startswith(Magic, "\x10\xFF\x10\xAD"))
79 return file_magic::offload_binary;
80 break;
81
82 case 0xDE: // 0x0B17C0DE = BC wraper
83 if (startswith(Magic, "\xDE\xC0\x17\x0B"))
84 return file_magic::bitcode;
85 break;
86 case 'B':
87 if (startswith(Magic, "BC\xC0\xDE"))
88 return file_magic::bitcode;
89 break;
90 case '!':
91 if (startswith(Magic, "!<arch>\n") || startswith(Magic, "!<thin>\n"))
92 return file_magic::archive;
93 break;
94 case '<':
95 if (startswith(Magic, "<bigaf>\n"))
96 return file_magic::archive;
97 break;
98 case '\177':
99 if (startswith(Magic, "\177ELF") && Magic.size() >= 18) {
100 bool Data2MSB = Magic[5] == 2;
101 unsigned high = Data2MSB ? 16 : 17;
102 unsigned low = Data2MSB ? 17 : 16;
103 if (Magic[high] == 0) {
104 switch (Magic[low]) {
105 default:
106 return file_magic::elf;
107 case 1:
108 return file_magic::elf_relocatable;
109 case 2:
110 return file_magic::elf_executable;
111 case 3:
112 return file_magic::elf_shared_object;
113 case 4:
114 return file_magic::elf_core;
115 }
116 }
117 // It's still some type of ELF file.
118 return file_magic::elf;
119 }
120 break;
121
122 case 0xCA:
123 if (startswith(Magic, "\xCA\xFE\xBA\xBE") ||
124 startswith(Magic, "\xCA\xFE\xBA\xBF")) {
125 // This is complicated by an overlap with Java class files.
126 // See the Mach-O section in /usr/share/file/magic for details.
127 if (Magic.size() >= 8 && Magic[7] < 43)
128 return file_magic::macho_universal_binary;
129 }
130 break;
131
132 // The two magic numbers for mach-o are:
133 // 0xfeedface - 32-bit mach-o
134 // 0xfeedfacf - 64-bit mach-o
135 case 0xFE:
136 case 0xCE:
137 case 0xCF: {
138 uint16_t type = 0;
139 if (startswith(Magic, "\xFE\xED\xFA\xCE") ||
140 startswith(Magic, "\xFE\xED\xFA\xCF")) {
141 /* Native endian */
142 size_t MinSize;
143 if (Magic[3] == char(0xCE))
144 MinSize = sizeof(MachO::mach_header);
145 else
146 MinSize = sizeof(MachO::mach_header_64);
147 if (Magic.size() >= MinSize)
148 type = Magic[12] << 24 | Magic[13] << 12 | Magic[14] << 8 | Magic[15];
149 } else if (startswith(Magic, "\xCE\xFA\xED\xFE") ||
150 startswith(Magic, "\xCF\xFA\xED\xFE")) {
151 /* Reverse endian */
152 size_t MinSize;
153 if (Magic[0] == char(0xCE))
154 MinSize = sizeof(MachO::mach_header);
155 else
156 MinSize = sizeof(MachO::mach_header_64);
157 if (Magic.size() >= MinSize)
158 type = Magic[15] << 24 | Magic[14] << 12 | Magic[13] << 8 | Magic[12];
159 }
160 switch (type) {
161 default:
162 break;
163 case 1:
164 return file_magic::macho_object;
165 case 2:
166 return file_magic::macho_executable;
167 case 3:
168 return file_magic::macho_fixed_virtual_memory_shared_lib;
169 case 4:
170 return file_magic::macho_core;
171 case 5:
172 return file_magic::macho_preload_executable;
173 case 6:
174 return file_magic::macho_dynamically_linked_shared_lib;
175 case 7:
176 return file_magic::macho_dynamic_linker;
177 case 8:
178 return file_magic::macho_bundle;
179 case 9:
180 return file_magic::macho_dynamically_linked_shared_lib_stub;
181 case 10:
182 return file_magic::macho_dsym_companion;
183 case 11:
184 return file_magic::macho_kext_bundle;
185 case 12:
186 return file_magic::macho_file_set;
187 }
188 break;
189 }
190 case 0xF0: // PowerPC Windows
191 case 0x83: // Alpha 32-bit
192 case 0x84: // Alpha 64-bit
193 case 0x66: // MPS R4000 Windows
194 case 0x50: // mc68K
195 if (startswith(Magic, "\x50\xed\x55\xba"))
196 return file_magic::cuda_fatbinary;
197 [[fallthrough]];
198
199 case 0x4c: // 80386 Windows
200 case 0xc4: // ARMNT Windows
201 if (Magic[1] == 0x01)
202 return file_magic::coff_object;
203 [[fallthrough]];
204
205 case 0x90: // PA-RISC Windows
206 case 0x68: // mc68K Windows
207 if (Magic[1] == 0x02)
208 return file_magic::coff_object;
209 break;
210
211 case 'M': // Possible MS-DOS stub on Windows PE file, MSF/PDB file or a
212 // Minidump file.
213 if (startswith(Magic, "MZ") && Magic.size() >= 0x3c + 4) {
214 uint32_t off = read32le(Magic.data() + 0x3c);
215 // PE/COFF file, either EXE or DLL.
216 if (Magic.substr(off).startswith(
217 StringRef(COFF::PEMagic, sizeof(COFF::PEMagic))))
218 return file_magic::pecoff_executable;
219 }
220 if (Magic.startswith("Microsoft C/C++ MSF 7.00\r\n"))
221 return file_magic::pdb;
222 if (startswith(Magic, "MDMP"))
223 return file_magic::minidump;
224 break;
225
226 case 0x64: // x86-64 or ARM64 Windows.
227 if (Magic[1] == char(0x86) || Magic[1] == char(0xaa))
228 return file_magic::coff_object;
229 break;
230
231 case 0x2d: // YAML '-'
232 if (startswith(Magic, "--- !tapi") || startswith(Magic, "---\narchs:"))
233 return file_magic::tapi_file;
234 break;
235
236 case 'D': // DirectX container file - DXBC
237 if (startswith(Magic, "DXBC"))
238 return file_magic::dxcontainer_object;
239 break;
240
241 case 0x41: // ARM64EC windows
242 if (Magic[1] == char(0xA6))
243 return file_magic::coff_object;
244 break;
245
246 default:
247 break;
248 }
249 return file_magic::unknown;
250 }
251
identify_magic(const Twine & Path,file_magic & Result)252 std::error_code llvm::identify_magic(const Twine &Path, file_magic &Result) {
253 auto FileOrError = MemoryBuffer::getFile(Path, /*IsText=*/false,
254 /*RequiresNullTerminator=*/false);
255 if (!FileOrError)
256 return FileOrError.getError();
257
258 std::unique_ptr<MemoryBuffer> FileBuffer = std::move(*FileOrError);
259 Result = identify_magic(FileBuffer->getBuffer());
260
261 return std::error_code();
262 }
263