ELF file signature
Magic number at the start of the file · .ELF
The Executable and Linkable Format is the standard for Linux and Unix binaries, shared libraries (.so) and core dumps. Every ELF file starts with 0x7F then the ASCII letters ELF.
What this magic number means
A magic number is a short, fixed run of bytes at a known position that tells a program what a file really is, no matter what the filename says. If a file starts with the bytes 7F 45 4C 46 (the text .ELF), it is a ELF file.
The fifth byte says 32-bit (01) or 64-bit (02) and the sixth says little-endian (01) or big-endian (02), so 7F 45 4C 46 02 01 is a 64-bit little-endian ELF.
Formats that use the 7F 45 4C 46 signature
No single file extension owns this signature exclusively; it belongs to the ELF format itself.
It is also seen in: SO, AXF, core.
How to check a file's signature
You can read the first bytes of any file yourself. The magic bytes are shown in hex, the same way this page lists them.
Linux & macOS
- xxd -l 16 example.bin
- hexdump -C -n 16 example.bin
- file example.bin
Windows (PowerShell)
- Format-Hex -Path example.bin -Count 16
Python
- open("example.bin","rb").read(4).hex()
In your browser
- Drop the file into the WhatFileType identifier, which reads the signature without uploading it.
Frequently asked questions
What is the ELF file signature?
ELF files start with the hex bytes 7F 45 4C 46 (.ELF in ASCII). This magic number identifies the format regardless of the file's name or extension.
How do I check a file's magic number?
Open the file in a hex editor, or run a command such as xxd -l 16 example.bin on Linux or macOS, or Format-Hex -Path example.bin -Count 16 in Windows PowerShell, and read the first bytes.
Can a file fake the ELF signature?
Renaming a file does not change its bytes, so the extension can lie but the signature usually cannot. A genuine ELF file has these exact bytes; a file with the wrong bytes is not really ELF, whatever its name says.