How can I know whether a binary file is an executable or a library?

This is an ELF binary, a binary format used on Unix based systems.

Open the file in a Hex editor. According to Wikipedia At offset 0x10 you should find 2 bytes for the e_type field. You should see a value of 1, 2, 3, or 4.

1 = relocatable
2 = executable
3 = shared
4 = core

You can also look into using readelf to extract this information for you. You should be able to run it in Cygwin (though I haven't tried it personally).

lzam

Posted 2014-09-15T23:58:55.217

Reputation: 1 364

Thanks for your answer. Since we also know it is ELF file, then we can judge the exact type based on value of 0x10. Then what if it is not an ELF file, how to know whether it is a lib file. – hellocoding – 2014-09-16T01:32:26.263

I think you need to identify the binary format (PE, ELF, Mach-o, or something else) before you can identify if it is a library or an executable. I don't know of a single method that will work for all of them. Maybe some high end hex editors can do it, but I don't know of any free tools that can. – lzam – 2014-09-16T01:51:45.407

Why is this tagged c? – lzam – 2014-09-16T01:04:47.843

the binary file is generated from c files – hellocoding – 2014-09-16T01:25:15.867

If you have the source, shouldn't you know what you are building from it? I don't think it will affect the answer, but I'm curious to know the scenario. – lzam – 2014-09-16T01:28:33.280

The bin is from others, all I know is that it is built from c. – hellocoding – 2014-09-16T01:36:06.747

How can I know whether a binary file is an executable or a library?

Answers