Re: binfmt_aout: always loaded?

Paul Matthews (paul@matthews.com)
Sun, 9 Jun 1996 10:34:24 -0400

William E. Roadcap writes:
> On Fri, 7 Jun 1996, B. James Phillippe wrote:
>
> > I'm using a.out support compiled as a module and am using kerneld
> > to autoload it (kernel 1.99.14 and modules 1.3.69k).......
> > Now, however, it seems to be always loaded, .......
> > Is there any way I can see which application caused the initial
> > load?
>
> try running: file /sbin/ldconfig /usr/bin/ldd
>
> Assuming those programs are located in those directories on your machine
> this will tell you if they are ELF or AOUT.
>
> The RedHat 2.1 distribution I'm using insisted on making those programs
> a.out. On many systems ldconfig is run by the startup scripts hence the
> aout module gets loaded at startup.

All,

I am not the author of the following script, but it helped me to find
hidden a.out executables on my system. You may want to give it a try:

for i in $(ps -a | sed -e 's/[^:]*:...\([^ ]*\).*/\1/')
do
if S=$(which $i 2>/dev/null)
then
file $S
fi
done

At least, it won't hurt anything. I put it in /usr/local/bin/elf_check

Regards,

Paul Matthews
McLean, VA
e-mail: paul@matthews.com