{"record":{"id":"07feef165e958cc3","repo":"gchq/CyberChef","slug":"invalid-elf","errorCode":null,"errorMessage":"Invalid ELF","messagePattern":"Invalid ELF","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/ELFInfo.mjs","lineNumber":117,"sourceCode":"             *\n             * 64-bit:\n             *      e_entry     - 8 Bytes specifying the entry point.\n             *      e_phoff     - 8 Bytes specifying the offset of the Program Header Table.\n             *      e_shoff     - 8 Bytes specifying the offset of the Section Header Table.\n             *\n             * e_flags     - 4 Bytes specifying processor specific flags.\n             * e_ehsize    - 2 Bytes specifying the size of the ELF Header.\n             * e_phentsize - 2 Bytes specifying the size of a Program Header Table Entry.\n             * e_phnum     - 2 Bytes specifying the number of entries in the Program Header Table.\n             * e_shentsize - 2 Bytes specifying the size of a Section Header Table Entry.\n             * e_shnum     - 2 Bytes specifying the number of entries in the Section Header Table.\n             * e_shstrndx  - 2 Bytes specifying the index of the section containing the section names in the Section Header Table.\n             */\n            const ehResult = [];\n\n            const magic = stream.getBytes(4);\n            if (magic.join(\"\") !== [0x7f, 0x45, 0x4c, 0x46].join(\"\"))\n                throw new OperationError(\"Invalid ELF\");\n\n            ehResult.push(\"Magic:\".padEnd(align) + `${Utils.byteArrayToChars(magic)}`);\n\n            format = stream.readInt(1);\n            ehResult.push(\"Format:\".padEnd(align) + `${format === 1 ? \"32-bit\" : \"64-bit\"}`);\n\n            endianness = stream.readInt(1) === 1 ? \"le\" : \"be\";\n            ehResult.push(\"Endianness:\".padEnd(align) + `${endianness === \"le\" ? \"Little\" : \"Big\"}`);\n\n            ehResult.push(\"Version:\".padEnd(align) + `${stream.readInt(1).toString()}`);\n\n            let ABI = \"\";\n            switch (stream.readInt(1)) {\n                case 0x00:\n                    ABI = \"System V\";\n                    break;\n                case 0x01:\n                    ABI = \"HP-UX\";","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/ELFInfo.mjs#L99-L135","documentation":"Thrown in ELFInfo.run when the first 4 bytes (magic = stream.getBytes(4)) do not equal [0x7f, 0x45, 0x4c, 0x46] (the bytes 0x7f 'E' 'L' 'F'). This is the canonical ELF magic check at the very start of header parsing; if it fails no further ELF fields are read. It is a structural guard: anything that is not a valid ELF object/executable/shared library is rejected before the e_ident fields (format, endianness) are parsed.","triggerScenarios":"Input is not an ELF binary: a PE/Mach-O/COFF executable, a raw blob, a text file, or a corrupted/truncated ELF whose first 4 bytes were altered. Also fires if a prior operation disturbed the byte stream.","commonSituations":"Running ELFInfo on a Windows .exe (PE) or macOS Mach-O by mistake; feeding a stripped or header-corrupted binary; a preceding recipe step (e.g. From Hex with wrong settings) shifted the bytes so the magic is offset.","solutions":["Confirm the file is ELF externally with `file <input>` / `readelf -h <input>` before feeding it.","Check upstream operations that may have transformed/offset the bytes (add a Hex dump before ELFInfo to verify the first bytes are 7f 45 4c 46).","For PE or Mach-O, use the appropriate CyberChef operation instead.","Re-extract or re-download the binary if the header is corrupted."],"exampleFix":"// before: wrong-section/offset bytes fed in\nrun(peBytes, []);  // 4d 5a ... -> not ELF\n// after: verify the magic first, then parse\nif (bytes.slice(0,4).join() === [0x7f,0x45,0x4c,0x46].join()) run(bytes, []);","handlingStrategy":"validation","validationCode":"const ELF_MAGIC = [0x7f, 0x45, 0x4c, 0x46];\nfunction isElf(bytes) {\n  return bytes.length >= 4 && bytes.slice(0, 4).every((b, i) => b === ELF_MAGIC[i]);\n}\nif (!isElf(bytes)) throw new Error(\"input is not an ELF binary\");","typeGuard":"const isElf = (b) => b.length >= 4 && b[0] === 0x7f && b[1] === 0x45 && b[2] === 0x4c && b[3] === 0x46;","tryCatchPattern":null,"preventionTips":["Run `file` / `readelf -h` on the input externally before ELFInfo.","Add a Hex dump step before ELFInfo to confirm the first 4 bytes are 7f 45 4c 46.","Use the PE/Mach-O operations for non-ELF executables."],"tags":["binary-parsing","elf","input-validation","operation-error"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}