I.3 The registry

To actually register a new binary type, we have to compose a string like:

:name:type:offset:magic:mask:interpreter:

and echo it to /proc/sys/fs/binfmt_misc/register. We can choose the separator character : depending on our needs and we can omit a field by simply using an empty string; for example if we omit the offset and the mask fields:

:name:type::magic::interpreter:

Fields description follows.

name

It is an identifier string. A new /proc file will be created with this name under /proc/sys/fs/binfmt_misc, and we can use it to query and reset the configuration status.

type

It is the type of file recognition. If set to M activates first bytes recognition (also known as “magic” recognition); if set to E activates file name extension recognition.

offset

It is the zero–based offset of the magic/mask in the file, counted in bytes. It is used only with magic recognition. It defaults to zero.

magic

It is the byte sequence binfmt_misc will look for file recognition.

The magic string may contain hex–encoded characters like \x0a or \xA4. When echoing the record from a shell environment, we will have to quote the backslash: \\x0a.

If we chose filename extension matching, this is the extension to be recognised (without the ., the \x0a specials are not allowed). Extension matching is case sensitive.

mask

It is a bitmask. We can mask out some bits from matching by supplying a string with the same length of magic. The mask is ANDed with the byte sequence from the file. It defaults to 0xff.

interpreter

It is the program that should be invoked with the binary as first argument. We have to specify the full path.

There are some restrictions:

• The whole register string must not exceed 255 characters.
• The magic must reside in the first 128 bytes of the file, i.e. offset+size(magic) has to be less than 128.
• The interpreter string must not exceed 127 characters.