edit:
Aaaargh - I just I answered something that wasn't asked for. Stupid me. I should not write answers in the early morning.
I still don't delete it, as it might help to find related information about the content of the fields. So feel free to downvote and/or complain about me not reading thruout.
So this is about the ELF fields e_machine
and e_osabi
, not a.out
Both values are rather random and have been used incosistently when it comes to less than common CPUs/machines/OSes.
e_machine
starts with
EM_NONE 0 No machine
EM_M32 1 AT&T WE 32100
EM_SPARC 2 SPARC
EM_386 3 Intel 80386
EM_68K 4 Motorola 68000
EM_88K 5 Motorola 88000
EM_860 7 Intel 80860
EM_MIPS 8 MIPS RS3000
But be aware, it's realy rather random, as some values have been reused (it's 'only' a 16 bit word) and/or independly assigned - luckyly for more uncommon CPUs.
Similar e_osabi
starts with
ELFOSABI_SYSV 0 System V
ELFOSABI_HPUX 1 HP-UX
ELFOSABI_NETBSD 2 NetBSD
ELFOSABI_LINUX 3 Linux
ELFOSABI_GNUHURD 4 GNU Hurd
ELFOSABI_SOLARIS 6 Solaris
ELFOSABI_AIX 7 AIX
ELFOSABI_IRIX 8 IRIX
When analyzing old ELF binaries it's important to know, that e_osabi
is a later addition. Originally this area was padding (toward the full 16 Bytes). 'clean' old files should read 0 here, no matter what OS was used. Therefore ELFOSABI_SYSV is rather an asumption than a definitive marking.
The Wiki-article about ELF gives already away some common values found today. Linux' Portable Formats Specification lists some values (*1). A much longer and up to date list list can be found at the Binary Analysis Platform Project (*2,3)
*1 - It ofc, includes only values relevant for Linux at that time (1993!)
*2 - Here now many older symbols/values are missing.
*3 - A great source for poking into reverse engineering under Linux.