Zakaria turns an ELF binary into a runnable SQLite file

Farid Zakaria built a single file that a SQLite client can open and the Linux kernel can run as a program. They needed no changes to SQLite or the ELF format. The only new piece is a kernel handler they registered themselves. That shows how little Linux checks before it runs a file, as long as some handler claims to know the format.

They set SQLite's 4-byte application ID field, at byte offset 68, to "SELF." Then they decomposed an ELF binary's components into rows across a custom schema inside that same database file, in their writeup.

SQLite reads its own header and ignores whatever else the file holds. A standard ELF loader does the same with its own header. Zakaria's addition is a self-exec interpreter registered with binfmt_misc, the kernel mechanism that hands a file type to a chosen program. When the kernel spots the SELF application ID, it hands the file to that interpreter, which queries the tables, rebuilds the binary, and runs it.

It only runs on a machine that already has the self-exec handler registered. That rules it out as a way to distribute one file that runs anywhere on Linux without setup.