[Mono-list] RESULT: 0 from mono, not from mint.

Peter M. Lemmen peter@lemmen.org
Wed, 27 Mar 2002 15:48:24 +0100


I've been trying this out using kernel version 2.4.8 with binfmt_misc loaded as
a module. The kernel documentation reports binfmt_misc as v1.1. I've had mixed

Getting bimfmt_misc to run *.exe using the mono JIT is trivial. Just make sure
the module is loaded and execute the following command (as root) and you're up
and running:

echo ':MonoE:E::exe::/usr/local/bin/mono:' > /proc/sys/fs/binfmt_misc/register

You can remove it again by echo'ing a -1 to /proc/sys/fs/binfmt_misc/MonoE

This works fine as long as the binaries are named *.exe, but it also tries to
execute any other *.exe file, including non-.NET binaries. Ie:

peter@storm:~$ ./hello_world.exe
Hello World!
peter@storm:~$ ./iexplore.exe
Can not open image ./iexplore.exe

You can also easily use magic number detection instead of extensions:

echo ':MonoM:M::MZ\x90\x00\x03\x00::/usr/local/bin/mono:' >

This 'magic number' isn't unique to .NET executables though. I've looked at a
dozen executables in a hex editor and noticed that for (mcs-compiled) .NET
binaries the first 64 bytes are identical and subtly different from non-.NET
binaries. The one byte that was the same for all .NET binaries I looked at and
different in all non-.NET binaries was the byte at offset 60 (0x3F). For the
.NET binaries it was always 0x80, for the others it was always something else.
(0xE8, 0xD0, 0x00, 0x70...) Unfortunately, this probably doesn't mean much,
unless taken along with the initial 'MZ' bytes.

So I've been trying to construct a 'magic number' string that binfmt_misc will
accept that will span all the way to byte 60. Here I've run into the
limitations of binfmt_misc that it will only accept a register string of 255
bytes. Since you have to encode the non-printable characters into hex values,
the resulting string is 265 bytes. I'm falling four (encoded) bytes short. :-(

If anyone knows of a way to shorten the encoding I'd appreciate it, using \x0
instead of \x00 doesn't work, btw. Already tried. Also, trying to cat a binary
file with the whole string already decoded in it to register also doesn't

Here's the magic number string I got to:

\x00\x00\x80::/usr/local/bin/mono:' > /proc/sys/fs/binfmt_misc/register

Have to go to a course now, but I'll work on it some more tomorrow. If I can't
work out this encoding thing tomorrow I'll try writing a wrapper.



> -----Original Message-----
> From: Paolo Molaro [mailto:lupus@ximian.com]
> Sent: Wednesday, March 27, 2002 13:16
> To: Peter M. Lemmen
> Subject: Re: [Mono-list] RESULT: 0 from mono, not from mint.
> On 03/27/02 Peter M. Lemmen wrote:
> > > what interpreter to run on it: unfortunately the number of bytes it uses
> > > is not enough to distinguish a .net program and a msdos/windows program
> > > to be run with wine, so a wrapper needs to be used. Oh, and someone
> > > needs to write it, hint, hint :-)
> > >
> >
> > <Grin>
> > Already looking into it... I don't have any msdos programs on
> there I want to
> > execute using wine, so that shouldn't be problem yet... But I'll
> try to figure
> > something out. :-)
> Thanks :-)
> lupus
> --
> -----------------------------------------------------------------
> lupus@debian.org                                     debian/rules
> lupus@ximian.com                             Monkeys do it better