#formats

APE (Actually Portable Executable) and Cosmopolitan Libc

§1 Provenance Cosmopolitan Libc source and docs: https://github.com/jart/cosmopolitan . APE specification: https://github.com/jart/cosmopolitan/blob/master/ape/specification.md . Cosmopolitan project page: https://justine.lol/cosmopolitan/ . llamafile project: https://github.com/mozilla-ai/llamafile . redbean web server: https://redbean.dev/ . Cosmopolitan release notes: https://github.com/jart/cosmopolitan/releases . ape-loader source (the 8 KB loader extracted at runtime on Linux): https://github.com/jart/cosmopolitan/tree/master/ape . The cosmocc toolchain releases: https://cosmo.zip/pub/cosmocc/ . §2 Mechanism / specification APE is a polyglot binary format invented by Justine Tunney. A single file simultaneously parses...

ELF (Executable and Linkable Format)

§1 Provenance System V Application Binary Interface Generic ABI (the gABI): https://www.sco.com/developers/gabi/latest/contents.html . Linux man page elf(5): https://www.man7.org/linux/man-pages/man5/elf.5.html . Original ELF specification (Tool Interface Standard, TIS Committee, 1995): https://refspecs.linuxfoundation.org/elf/elf.pdf . DWARF Debugging Information Format v5: https://dwarfstd.org/doc/DWARF5.pdf . GNU extensions reference: binutils source plus https://sourceware.org/binutils/docs/binutils/ . GNU IFUNC documentation: https://sourceware.org/glibc/wiki/GNU_IFUNC . Go's debug/elf package: https://pkg.go.dev/debug/elf . §2 Mechanism / specification ELF has three flavors of file: relocatable object (.o), executable, and...

WebAssembly Module Binary Format

§1 Provenance WebAssembly Core Specification 3.0, Binary Format chapter: https://webassembly.github.io/spec/core/binary/index.html . Component Model Binary Format: https://github.com/WebAssembly/component-model/blob/main/design/mvp/Binary.md . WAT (text format) reference: https://webassembly.github.io/spec/core/text/index.html . Custom section conventions (name section, source maps): https://github.com/WebAssembly/design/blob/main/BinaryEncoding.md#name-section . WASI Preview 2 worlds and interfaces: https://github.com/WebAssembly/WASI/tree/main/wasip2 . Wabt (WebAssembly Binary Toolkit): https://github.com/WebAssembly/wabt . Binaryen (optimizer and toolkit): https://github.com/WebAssembly/binaryen . §2 Mechanism / specification A Wasm module begins with an 8-byte preamble: magic 0x00 0x61 0x73 0x6D ("\0asm")...

PE/COFF

§1 Provenance Microsoft PE Format reference: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format . The .NET runtime maintains a more thorough PE/COFF spec: https://github.com/dotnet/runtime/blob/main/docs/design/specs/PE-COFF.md . Windows x64 exception handling: https://learn.microsoft.com/en-us/cpp/build/exception-handling-x64 . Windows ARM64 exception handling: https://learn.microsoft.com/en-us/cpp/build/arm64-exception-handling . PDB / CodeView (partial Microsoft docs + the open-source reverse engineering): https://github.com/microsoft/microsoft-pdb . DWARF (used by mingw): https://dwarfstd.org/doc/DWARF5.pdf . Authenticode specification: https://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/Authenticode_PE.docx . Go's debug/pe package: https://pkg.go.dev/debug/pe . §2 Mechanism / specification A PE file starts with an MS-DOS...

Mach-O

§1 Provenance Apple's loader.h header (canonical machine-readable spec): https://github.com/apple-oss-distributions/xnu/blob/main/EXTERNAL_HEADERS/mach-o/loader.h . Apple's Mach-O reference documentation (legacy archive): https://developer.apple.com/library/archive/documentation/DeveloperTools/Conceptual/MachORuntime/ . Apple's TN3127 (Inside Code Signing: Requirements): https://developer.apple.com/documentation/technotes/tn3127-inside-code-signing-requirements . Apple's TN3151 (Choosing a tool chain): https://developer.apple.com/documentation/technotes/ . Go's debug/macho package: https://pkg.go.dev/debug/macho . LLVM lld Mach-O backend source: https://github.com/llvm/llvm-project/tree/main/lld/MachO . Apple's open-source releases: https://opensource.apple.com/ . §2 Mechanism / specification A Mach-O file starts with a mach_header_64 (32 bytes): magic: MH_MAGIC_64 (0xFEEDFACF). cputype, cpusubtype: x86_64...

Object Formats