Has anyone been able to create a hybrid of PE COFF

Question

I mean could a single binary file run in both Win32 and Linux i386 ?

Answer 1

The two formats are sufficiently different that a hybrid is unlikely.

However, Linux supports loading different executable formats by "interpreter". This way compiled .exe files containing CIL (compiled C# or other .NET languages) can be executed directly under Linux, for example.

Answer 2

This is not possible, because the two types have conflicting formats:

• The initial two characters of a PE file must be 'M' 'Z';
• The initial four characters of an ELF file must be '\x7f' 'E' 'L' 'F'.

Clearly, you can't create one file that satisifies both formats.

---

In response to the comment about a polyglot binary valid as both a 16 bit COM file and a Linux ELF file, that's possible (although really a COM file is a DOS program, not Windows - and certainly not Win32).

Here's one I knocked together - compile it with NASM. It works because the first two bytes of an ELF file ('\x7f' 'E') happen to also be valid 8086 machine code (a 45 byte relative jump-if-greater-than instruction). Minimal ELF headers cribbed from Brian Raiter.

BITS 32
ORG 0x08048000

  ehdr:                                                 ; Elf32_Ehdr
                db      0x7F, "ELF", 1, 1, 1, 0         ;   e_ident
        times 8 db      0
                dw      2                               ;   e_type
                dw      3                               ;   e_machine
                dd      1                               ;   e_version
                dd      _start                          ;   e_entry
                dd      phdr - $$                       ;   e_phoff
                dd      0                               ;   e_shoff
                dd      0                               ;   e_flags
                dw      ehdrsize                        ;   e_ehsize
                dw      phdrsize                        ;   e_phentsize
                dw      1                               ;   e_phnum
                dw      0                               ;   e_shentsize
                dw      0                               ;   e_shnum
                dw      0                               ;   e_shstrndx
  ehdrsize      equ     $ - ehdr

times 0x47-($-$$) db    0

; DOS COM File code
BITS 16
    mov dx, msg1 - $$ + 0x100
    mov ah, 0x09
    int 0x21
    mov ah, 0x00
    int 0x21
  msg1:         db      `Hello World (DOS).\r\n$`

BITS 32
  phdr:                                                 ; Elf32_Phdr
                dd      1                               ;   p_type
                dd      0                               ;   p_offset
                dd      $$                              ;   p_vaddr
                dd      $$                              ;   p_paddr
                dd      filesize                        ;   p_filesz
                dd      filesize                        ;   p_memsz
                dd      5                               ;   p_flags
                dd      0x1000                          ;   p_align
  phdrsize      equ     $ - phdr

; Linux ELF code
  _start:
    mov eax, 4      ; SYS_write
    mov ebx, 1      ; stdout
    mov ecx, msg2
    mov edx, msg2_len
    int 0x80
    mov eax, 1      ; SYS_exit
    mov ebx, 0
    int 0x80
  msg2:         db      `Hello World (Linux).\n`
  msg2_len      equ     $ - msg2

  filesize      equ     $ - $$

Answer 3

Sure. Use Java.