KO
application/octet-stream
Magic Bytes
Offset: 0
7F 45 4C 46
The Kernel Object (KO) is a loadable module format maintained by the Linux kernel community for dynamically extending operating system functionality. These files primarily contain device drivers, filesystem drivers, or system calls that are loaded into the running kernel using utilities like modprobe. Structurally based on the standard Executable and Linkable Format, these modules require root privileges to execute, ensuring that only administrators can modify the kernel runtime environment.
Validation Code
How to validate .ko files in Python
Python
def is_ko(file_path: str) -> bool:
"""Check if file is a valid KO by magic bytes."""
signature = bytes([0x7F, 0x45, 0x4C, 0x46])
with open(file_path, "rb") as f:
return f.read(4) == signatureHow to validate .ko files in Node.js
Node.js
function isKO(buffer: Buffer): boolean {
const signature = Buffer.from([0x7F, 0x45, 0x4C, 0x46]);
return buffer.subarray(0, 4).equals(signature);
}
Go
func IsKO(data []byte) bool {
signature := []byte{0x7F, 0x45, 0x4C, 0x46}
if len(data) < 4 {
return false
}
return bytes.Equal(data[:4], signature)
}API Endpoint
GET
/api/v1/ko
curl https://filesignature.org/api/v1/ko