Is it an ELF file?

Challenge

Recognise an ELF binary from its four magic bytes — step one of any Linux binary forensics.

Task

Implement int is_elf(const unsigned char *b) that returns 1 if the buffer begins with the ELF magic, else 0.

Input

• b: a byte buffer (the start of a file) the grader passes; at least 4 bytes are readable.

Output

Returns int: 1 if b[0..3] are 0x7F, 'E', 'L', 'F'; else 0.

Example

{0x7f,'E','L','F',2}   ->   1
{'M','Z',0,0}          ->   0   (PE, not ELF)

Edge cases

• Only the first four bytes are checked; later bytes are ignored.

Input format

A byte buffer b with at least 4 readable bytes.

Output format

An int: 1 if b[0..3] is the ELF magic 0x7F 'E' 'L' 'F', else 0.

Constraints

Check only the first four bytes.

Starter code

int is_elf(const unsigned char *b) {
    /* TODO */
    return 0;
}