Function detectArch

src/tools/frida.ts:399–436

* Detect architecture from ELF header (e_machine field at bytes 18-19). * Falls back to filename-based detection if not a valid ELF.

(filePath: string)

 * Falls back to filename-based detection if not a valid ELF.
 */
function detectArch(filePath: string): string | null {
    try {
        const fd = fs.openSync(filePath, "r");
        try {
            const header = Buffer.alloc(20);
            fs.readSync(fd, header, 0, 20, 0);

            // Verify ELF magic: 0x7f 'E' 'L' 'F'
            if (
                header[0] !== 0x7f ||
                header[1] !== 0x45 ||
                header[2] !== 0x4c ||
                header[3] !== 0x46
            ) {
                return detectArchFromFilename(filePath);
            }

            // e_machine at offset 18 (little-endian uint16)
            const eMachine = header.readUInt16LE(18);
            switch (eMachine) {
                case 0x28:
                    return "armeabi-v7a"; // EM_ARM
                case 0xb7:
                    return "arm64-v8a"; // EM_AARCH64
                case 0x03:
                    return "x86"; // EM_386
                case 0x3e:
                    return "x86_64"; // EM_X86_64
                default:
                    return detectArchFromFilename(filePath);
            }
        } finally {
            fs.closeSync(fd);
        }
    } catch {
        return detectArchFromFilename(filePath);
    }
}

/**
 * Fallback: detect architecture from gadget filename.