gchq/CyberChef · error · OperationError

Invalid ELF

Error message

Invalid ELF

What it means

Thrown in ELFInfo.run when the first 4 bytes (magic = stream.getBytes(4)) do not equal [0x7f, 0x45, 0x4c, 0x46] (the bytes 0x7f 'E' 'L' 'F'). This is the canonical ELF magic check at the very start of header parsing; if it fails no further ELF fields are read. It is a structural guard: anything that is not a valid ELF object/executable/shared library is rejected before the e_ident fields (format, endianness) are parsed.

Source

Thrown at src/core/operations/ELFInfo.mjs:117

             *
             * 64-bit:
             *      e_entry     - 8 Bytes specifying the entry point.
             *      e_phoff     - 8 Bytes specifying the offset of the Program Header Table.
             *      e_shoff     - 8 Bytes specifying the offset of the Section Header Table.
             *
             * e_flags     - 4 Bytes specifying processor specific flags.
             * e_ehsize    - 2 Bytes specifying the size of the ELF Header.
             * e_phentsize - 2 Bytes specifying the size of a Program Header Table Entry.
             * e_phnum     - 2 Bytes specifying the number of entries in the Program Header Table.
             * e_shentsize - 2 Bytes specifying the size of a Section Header Table Entry.
             * e_shnum     - 2 Bytes specifying the number of entries in the Section Header Table.
             * e_shstrndx  - 2 Bytes specifying the index of the section containing the section names in the Section Header Table.
             */
            const ehResult = [];

            const magic = stream.getBytes(4);
            if (magic.join("") !== [0x7f, 0x45, 0x4c, 0x46].join(""))
                throw new OperationError("Invalid ELF");

            ehResult.push("Magic:".padEnd(align) + `${Utils.byteArrayToChars(magic)}`);

            format = stream.readInt(1);
            ehResult.push("Format:".padEnd(align) + `${format === 1 ? "32-bit" : "64-bit"}`);

            endianness = stream.readInt(1) === 1 ? "le" : "be";
            ehResult.push("Endianness:".padEnd(align) + `${endianness === "le" ? "Little" : "Big"}`);

            ehResult.push("Version:".padEnd(align) + `${stream.readInt(1).toString()}`);

            let ABI = "";
            switch (stream.readInt(1)) {
                case 0x00:
                    ABI = "System V";
                    break;
                case 0x01:
                    ABI = "HP-UX";

View on GitHub (pinned to 4290ea7539)

Solutions

1. Confirm the file is ELF externally with `file <input>` / `readelf -h <input>` before feeding it.
2. Check upstream operations that may have transformed/offset the bytes (add a Hex dump before ELFInfo to verify the first bytes are 7f 45 4c 46).
3. For PE or Mach-O, use the appropriate CyberChef operation instead.
4. Re-extract or re-download the binary if the header is corrupted.

Example fix

// before: wrong-section/offset bytes fed in
run(peBytes, []);  // 4d 5a ... -> not ELF
// after: verify the magic first, then parse
if (bytes.slice(0,4).join() === [0x7f,0x45,0x4c,0x46].join()) run(bytes, []);

const ELF_MAGIC = [0x7f, 0x45, 0x4c, 0x46];
function isElf(bytes) {
  return bytes.length >= 4 && bytes.slice(0, 4).every((b, i) => b === ELF_MAGIC[i]);
}
if (!isElf(bytes)) throw new Error("input is not an ELF binary");

const isElf = (b) => b.length >= 4 && b[0] === 0x7f && b[1] === 0x45 && b[2] === 0x4c && b[3] === 0x46;

When it happens

Trigger: Input is not an ELF binary: a PE/Mach-O/COFF executable, a raw blob, a text file, or a corrupted/truncated ELF whose first 4 bytes were altered. Also fires if a prior operation disturbed the byte stream.

Common situations: Running ELFInfo on a Windows .exe (PE) or macOS Mach-O by mistake; feeding a stripped or header-corrupted binary; a preceding recipe step (e.g. From Hex with wrong settings) shifted the bytes so the magic is offset.

Related errors

• Incorrect number of samples.
• Incorrect number of samples.
• Invalid file type.
• Invalid file format.
• Invalid file type.

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/07feef165e958cc3. Report an issue: GitHub.