ELF Crimes: Program Interpreter Fun
7 comments
·December 21, 2025saagarjha
delaminator
It’s a terrible shame Linux is still a 1970s program.
Plan 9’s debugger Acid can attach to a running kernel on a remote machine and debug it.
nytpu
Because attaching a debugger to the Linux Kernel is so convenient and easy :P
But yeah, I was just being lazy and dumb. I solved it within ten minutes of someone saying "why don't you just go through the binfmt_elf code?" A debugger would've probably been more tedious than reading the relevant code directly, but would've been just as effective.
saagarjha
It's not and actually I do find it kind of amusing that Linux is possibly the hardest of the three main OSes to get a debugging set up for, but yeah I've had to do it enough that I don't mind doing and I can probably get it set up in a few minutes. Plus if the bug isn't in some architecture specific or hardware dependent thing there's this Linux compatibility userspace layer I help out on sometimes that is much easier to work with. And if it's that easy, I will generally choose to that instead of having to actually think about what I am doing ;)
tayo42
I think you can do it with qemu and gdb.
Unless the other os and debugger mentioned has an easy way to do it with a machine that's not virtualized?
dzdt
"It just radiates jank" ... that line resonates with me, but is sonehow a bit attractive. Like this is how things might be done in some alternative grittier universe. Like this is how Kaylee would make data formats execute on the Firefly. Its steampunk programming.
photios
OP would probably have a field day with NixOS's patchelf tool:
> But after getting the linked script setup working, even though it seemed like it should've been enough, it absolutely refused to work. It would only give me an opaque exec format error error, no matter how many different shotgun debugging things I tried, I ended up spending something like six hours over the course of two days on it with no real progress.
I think I would have eventually just loaded up a debugger and binary searched the codebase until I found the spot returning the error.