SQLite Database Files as Executable ELF Binaries via binfmt_misc
Simon Willison's link blog reports Farid Zakaria's Linux pattern in which a SQLite database file is made directly executable by writing the four-byte application ID 'SELF' into the SQLite header at offset 68, arranging the ELF executable's components into SQLite tables, and registering a binfmt_misc handler that routes such files to a self-exec interpreter. The post is a brief secondary description and does not include the full schema, interpreter source, or performance analysis.
1 source75% confidence
62Strategic
Strategic score
Evidence strength40
Technical novelty68
Commercial potential35
evaluation
Simon Willison's link blog reports Farid Zakaria's pattern for making a Linux executable that is simultaneously a SQLite database. The technique writes the four-byte application ID in the SQLite file header, 68 bytes into the file, as 'SELF' (Structured Executable & Linkable Format).1
The ELF executable's components are organized into SQLite tables, and a C interpreter called 'self-exec' extracts and executes them. A binfmt_misc registration line tells the kernel to route files whose byte 68 equals 'SELF' to that interpreter, making the database file directly runnable.1
Context
This is not just embedding a payload in a database: the database file itself is the starting point of process execution. Standard execve handling is replaced by a registered binary format, so the pattern is Linux-specific and depends on binfmt_misc being available and configured.1
Assessment
The constraint that moves is the assumption that a SQLite file is inert data: once tagged with 'SELF' and registered, the file can be invoked as a native executable, with database tables supplying the ELF image. The post documents this conceptual shift through a NixOS example and an explicit binfmt_misc command, but leaves the schema and interpreter behavior largely unspecified.1
Caveats
What would change my mind is a primary source: a working repository, the SQLite schema, measured overhead, and confirmation that the file remains a valid queryable database after execution. Without those, the pattern is an interesting proof of concept rather than a mechanically verified technique.1
Your executable is a SQLite database (via) Farid Zakaria describes a neat Linux pattern for creating a SQLite database file that can be directly used as an executable binary.
The trick sets the SQLite file format's 4-byte application ID (68 bytes into the file) to SELF, standing for Structured Executable & Linkable Format. The various components of the ELF executable format are then arranged into a number of different SQLite tables, using this schema.
Their self-exec interpreter (C code here) can then extract and execute the necessary pieces.
You can additionally use a Linux mechanism called binfmt_misc to teach the kernel to execute that any time it encounters an executable matching that binary pattern. Farid uses NixOS here, but without NixOS I think registration looks something like this: