Linux find exe file

How to find executable filetypes?

I want to find file types that are executable from the kernel’s point of view. As far as I know all the executable files on Linux are ELF files. Thus I tried the following: find * | file | grep ELF However that doesn’t work; does anybody have other ideas?

Just a small side node, with binfmt_misc you can run arbitrary files like classes, exes etc. en.wikipedia.org/wiki/Binfmt_misc

@UlrichDangel: +1 for mentioning binfmt_misc . Binary formats are as flexible as filesystems on Linux. By all means, find ELFs, but (a) you’re not finding all executable files, (b) the ELFs you find aren’t necessarily executable in practice. For instance, a SPARC64 ELF won’t run on an x86.

Nobody expects you to be an expert when asking, but for question, to be useful for others, it should be selfcontained, and give all needed information. The reader shouldn’t be forced to read all the spread comments. Users search for questions by keywords, phrases and decide to read it by the headline. If you don’t work on your question to improve it, it is useless for others and should receive even more downvotes. If it is clarified in the question, what you’re really looking for — mainly in the headline — it can be upvoted. A downvote is however locked until the question is edited.

9 Answers 9

Later edit: only this one does what jan needs: thank you huygens;

find . -exec file <> \; | grep -i elf

I think your first command doesn’t work. It is searching for files with a name like «*elf *» (without taking into account the case). You want to grep the output just likeyou did in the second proposal.

@huygens I tested it before I posted and it works. touch elf 1elf 1ELF2 elf2 ; my command will find all the elf related files;

@huygens I tested it before I posted and it works. touch elf 1elf 1ELF2 elf2 ; my command will find all the elf related files (just like the grep); you got that error because you have copy pasted it (i think) and it has a blank space not needed, in the » » . but if I write «asteriskELFasterisk» in , the html eats my asterisks.

This will find files that contain «elf» in their file name. I found that grepping for » elf » was good enough for my application, but in the most general case a file named «this is not elf .txt» would give a false positive.

Alternate solution not using file and readelf , for those on limited (e.g. embedded) systems:

find $WHERE -type f -exec hexdump -n 4 -e '4/1 "%2x" " <>\n"' <> \; | grep ^7f454c46 

Basically, we output first four bytes with hexdump and use them as a signature. We can then grep all the files of type ELF using its signature 7f454c46 .

Or, since 7f is the delete character, and 45 , 4c , 46 bytes are E , L , F characters respectively, we could also use:

find $WHERE -type f -exec hexdump -n 4 -e '4/1 "%1_u" " <>\n"' <> \; | grep ^delELF 

Also, you can use head instead of hexdump in this case:

find $WHERE -type f -exec head -c 4 <> \; -exec echo " <>" \; | grep ^.ELF 

The grep command could use the —text flag. Without it, some file headers have characters that will put grep into binary mode—which will suppress all further matches with the grep: (standard input): binary file matches message.

Like others, I want to answer too. My answer is based on using the find utility too, but I have an idea, which is differ against other answers. It grounded on that fact, that the -exec can be used as the search criteria too. Now, having this thing in mind, we can refactor all of the previous proposals to this one:

find /path -type f -exec sh -c "file <> | grep -Pi ': elf (32|64)-bit' > /dev/null" \; -print 

I.e. we have moved the grep into the -exec .

What does this give to us, you may ask? We can use the flexibility of the -print and others of the find utility. For example, we can format an output on our taste, or use the -print0 and redirect an output to some script etc.

Take a look on -executable flag of find .

That’s not quite what I want, I don’t want files that are tagged as executable files but I want to find ELF files, files that are recognized as executable by the kernel.

The flag executable match permissions (so directories too), see the man page: Matches files which are executable and directories which are searchable (in a file name resolution sense).

@Huygens: So directories are files (everything is a file on Unix), but to exclude them, just use find -type f -executable .

@Ian: But Shellscripts are executable by the kernel. Executable flag + appropriate shebang means executable file. Or flag + binary-elf, or flag + a.out, or flag + binfmt-patch.

@Huygens: No, you can execute shell scripts with exec-calls, see: en.wikipedia.org/wiki/Shebang_%28Unix%29 . If there is a shebang, only the rest of the script is executed by the interpreter. Since 1980.

I would look for regular files first as binary executable are belonging to that type of files.

Then I would request for each regular file the mime type and if it matches application/x-executable then it is a binary executable files (that should match Linux executable files, Windows one for instance match application/x-dosexec).

find . -type f -print0 | xargs -0 -n 10 file -i | grep "application/x-executable" 

Trying this command I found a discrepency with find . -type f -print0 | xargs -0 -n 10 file | grep -w ELF . It seems that the command file is buggy and detects ELF executable as ELF shared object. So even though the command is theoricaly correct, in practice it is incomplete.

So we have to look for ELF executables and shared objects but exclude all files with a name of *.so and .so.

find . -type f ! \( -name "*.so.*" -o -name "*.so" \) -print0 | xargs -0 -n 10 file -i | egrep "application\/x-sharedlib|application\/x-executable" 

It is not probably perfect, but that’s the pretty close.

Источник

Find executable files recursively

I have got the directory called Test and a few directories inside it. Both Test and the directories inside it have executable files. I’d like to print them with ls . I’d use this command.

ls -l `find Test/ -perm /u=x,g=x,o=x -type f` 

find Test/ -executable -type f -exec ls -l <> \; 

try find . -exec -ls -l <> \+ instead of \; — doing that will cause only one ls command to be generated with multiple filename args, similar to how xargs works. read the find man page and search for -exec for details.

4 Answers 4

Not really, you can integrate the ls command with find,

find Test/ -type f -perm /u=x,g=x,o=x -exec ls -l <> \;

Actually -executable is not an equivalent of -perm /u=x,g=x,o=x . You might have files that is executable only by the group or others, which will not be displayed.

So, depends on your purpose, if you want files executable only by you, that’s okay to use -executable .

There is no need to use -exec , as find comes with a -ls flag.

$ find Test/ -perm /u=x,g=x,o=x -type f -ls 

-ls True; list current file in ls -dils format on standard output. The block counts are of 1K blocks, unless the environment variable POSIXLY_CORRECT is set, in which case 512-byte blocks are used. See the UNUSUAL FILENAMES section for information about how unusual characters in filenames are handled.

Источник

How to find all binary executables recursively within a directory?

all executable files are listed (excluding directories), and including executable script file (like script.sh, etc). What I want to do is list only binary executable files.

4 Answers 4

You might try the file utility. According to the manpage:

The magic tests are used to check for files with data in particular fixed formats. The canonical example of this is a binary executable (compiled program) a.out file, whose format is defined in , and possibly in the standard include directory.

You might have to play around with the regular expression but something like:

$ find -type f -executable -exec file -i '<>' \; | grep 'x-executable; charset=binary' 

file has lots of options, so you might want to take a closer look at the man page. I used the first option I found that seemed to output easily-to-grep output.

I’d say use find -type f -executable -exec sh -c «file -i ‘<>‘ | grep -q ‘x-executable; charset=binary'» \; -print . It will only give you files (and thus can be passed to the next command he wants to run)

serverfault.com/a/584595/211551 solution finds files that are NOT marked executable but are executable.

On OS X, you can install GNU find with brew install findutils or sudo port install findutils and then you can run an invocation like this to a similar effect: gfind . -type f -executable -exec file ‘<>‘ \; | grep -i execut

Here’s a way to exclude scripts, i.e., files whose first two characters are #! :

find -type f -executable -exec sh -c 'test "$(head -c 2 "$1")" != "#!"' sh <> \; -print 

For some kinds of files, it’s not clear whether you want them classified as scripts or binary, for example bytecode files. Depending on how things are set up, these may or may not start with #! . If these matter to you, you’ll have to make the inner shell script more complex. For example, here’s how you might include ELF binaries and Mono executables and Objective Caml bytecode programs but not other kinds of executables like shell scripts or perl scripts or JVM bytecode programs:

find -type f -executable -exec sh -c ' case "$(head -n 1 "$1")" in ?ELF*) exit 0;; MZ*) exit 0;; #!*/ocamlrun*) exit 0;; esac exit 1 ' sh <> \; -print 

Источник

Use “which” in Linux to find the Location of an Exetable

Linux comes with the which command to locate a given executable. Executables are commands you type into your terminal, like git , node , touch , or vim .

Sometimes, you want to find the location of an executable on your filesystem. That’s where the which command comes handy. Read on to find out how to use which !

Ubuntu/Debian Series Overview

1. Fix “sudo command not found”
2. Install a Specific Version with apt-get on Ubuntu/Debian
3. Fix Ubuntu/Debian apt-get “KEYEXPIRED: The following signatures were invalid”
4. How to Test a Cron Job
5. How to Unzip Into a Folder
6. How to Show Your Elasticsearch Version on Ubuntu/Debian
7. Use “which” in Linux to find the Location of an Exetable
8. Sort “ls” by Last Changed Date
9. How to Shutdown a Machine

Locate an Executable in Linux With which

Using which parses the PATH environment variable to find all locations to search for a program.

How to use the which command

The which command has the following syntax:

For example, you may locate the git program like this:

You can also locate more than one program in a single call by adding all programs separated by a space:

$ which git node vim /usr/bin/git /usr/local/bin/node /usr/bin/vim 

Using Options

The which command supports two options:

-a List all instances of executables found (instead of just the first one of each). -s No output, just return 0 if all of the executables are found, or 1 if some were not found. 

If a command is present in multiple locations, you can find all occurrences using the -a option.

Using -s changes the output of which when programs are not found. Let’s say you don’t have MongoDB installed. Trying to locate the mongod executable results in different outputs depending on whether you append the -s option:

$ which mongod # no output at all # and with the “-s” option $ which mongod mongod not found 

The -s option allows you to retrieve expressive results. This is helpful when you as a human runs the command. In shell scripts, you may want to check for empty outputs to determine whether an executable is missing.

Get Notified on New Future Studio
Content and Platform Updates

Get your weekly push notification about new and trending
Future Studio content and recent platform enhancements

Источник