如果你看到(SYSV)字符串，这意味着在ELF头的e_ident[EI_OSABI]字段设置为0。从ELF spec (PDF link)：

Table 5. Operating System and ABI Identifiers, e_ident[EI_OSABI]

Name Value Meaning

ELFOSABI_SYSV 0 System V ABI

ELFOSABI_HPUX 1 HP-UX operating system

ELFOSABI_STANDALONE 255 Standalone (embedded) application

我的本地机器的/usr/share/file/magic/elf文件具有更长的名单：

# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed

# like proper ELF, but extracting the string had bad results.

>4 byte <0x80

>>8 string >\0 (%s)

>8 string \0

>>7 byte 0 (SYSV)

>>7 byte 1 (HP-UX)

>>7 byte 2 (NetBSD)

>>7 byte 3 (GNU/Linux)

>>7 byte 4 (GNU/Hurd)

>>7 byte 5 (86Open)

>>7 byte 6 (Solaris)

>>7 byte 7 (Monterey)

>>7 byte 8 (IRIX)

>>7 byte 9 (FreeBSD)

>>7 byte 10 (Tru64)

>>7 byte 11 (Novell Modesto)

>>7 byte 12 (OpenBSD)

>8 string \2

>>7 byte 13 (OpenVMS)

>>7 byte 97 (ARM)

>>7 byte 255 (embedded)

下面是ELF头和偏移以供参考(从this link)：

#define EI_NIDENT 16

typedef struct {

unsigned char e_ident[EI_NIDENT];

Elf32_Half e_type;

Elf32_Half e_machine;

Elf32_Word e_version;

Elf32_Addr e_entry;

Elf32_Off e_phoff;

Elf32_Off e_shoff;

Elf32_Word e_flags;

Elf32_Half e_ehsize;

Elf32_Half e_phentsize;

Elf32_Half e_phnum;

Elf32_Half e_shentsize;

Elf32_Half e_shnum;

Elf32_Half e_shstrndx;

} Elf32_Ehdr;

Figure 4-4: e_ident[] Identification Indexes

Name Value Purpose

EI_MAG0 0 File identification

EI_MAG1 1 File identification

EI_MAG2 2 File identification

EI_MAG3 3 File identification

EI_CLASS 4 File class

EI_DATA 5 Data encoding

EI_VERSION 6 File version

EI_OSABI 7 Operating system/ABI identification

EI_ABIVERSION 8 ABI version

EI_PAD 9 Start of padding bytes

EI_NIDENT 16 Size of e_ident[]