Glonce

Farid Zakaria turns a SQLite database into a runnable ELF executable

miscThe Glonce editorsSimon Willison🔥56Glonce rating56Impact40Novelty55Relevance70Surprise60Players45Credibility80

In a link-blog post dated 24 August 2026, Simon Willison describes a pattern from Farid Zakaria for turning a SQLite database file into something the Linux kernel can execute directly. The trick repurposes the SQLite file format's 4-byte application ID field, located 68 bytes into the file, setting it to the value SELF, which stands for Structured Executable and Linkable Format. The various components of a standard ELF executable are then broken apart and stored across a number of SQLite tables, following a schema Zakaria published. A self-exec interpreter, written in C and also published by Zakaria, reads that schema back out of the database and extracts and runs the pieces it needs. To make the kernel treat such a file as a program automatically, the approach layers on binfmt_misc, a Linux mechanism that lets the kernel be taught to execute any file matching a given binary pattern whenever it is invoked. Zakaria demonstrated the setup on NixOS. Willison, writing in his own voice, adds a reconstruction of what registering the format would look like on a system without NixOS: writing the string ':self:M:68:SELF::/usr/local/bin/self-exec:' into /proc/sys/fs/binfmt_misc/register, using the application ID's offset and value as the match pattern and pointing the kernel at a self-exec binary. He is explicit that this non-NixOS version is his own guess rather than something Zakaria confirmed or tested. The post does not explain why the pattern was created, what problem it solves, or what its performance, security, or compatibility implications are.

Key facts

  • Farid Zakaria's pattern sets a SQLite database's 4-byte application ID field, 68 bytes into the file, to the value SELF (Structured Executable & Linkable Format).
  • The components of an ELF executable are split apart and stored across multiple SQLite tables using a schema Zakaria defined.
  • A C self-exec interpreter published by Zakaria reads the schema back out of the database and executes the reconstructed binary.
  • Linux's binfmt_misc mechanism can register the SELF pattern so the kernel runs such a file automatically, as Zakaria showed on NixOS.
  • Simon Willison's own registration command for non-NixOS systems is presented as an untested guess, not a confirmed step from Zakaria.

Why it matters

The pattern is a demonstration of how far a container format can be pushed beyond its original purpose: a SQLite file, normally opened by a database library, becomes something the operating system itself will run as a program. It sits squarely in the tradition of Linux polyglot-file tricks that use binfmt_misc to blur the line between data files and executables.

Who it affects

The post is aimed at systems programmers and Linux tinkerers who enjoy this kind of low-level format hacking rather than at any commercial audience. Nothing in the source suggests the technique is intended for production use.

How to use it

Reproducing it requires Zakaria's published schema and his C self-exec interpreter to build and read the SQLite-backed executable, plus a binfmt_misc registration telling the kernel to match files whose byte 68 reads SELF and hand them to the self-exec binary. Zakaria's own walkthrough assumes NixOS; Willison's command for other distributions is his own untested reconstruction of the same registration step.

How solid is it

The description comes from Simon Willison relaying and summarizing Farid Zakaria's own writeup and published code (the schema and the C interpreter), which lends it firsthand grounding. The one part not attributed to Zakaria, the non-NixOS registration command, is flagged by Willison himself as an uncertain guess rather than a tested result.

Risks and caveats

The source gives no discussion of why the pattern was built, what practical problem it addresses, or its performance, security, or compatibility consequences. It also does not say who created binfmt_misc or when, and gives no license or project name beyond the linked schema and C code. Registering an arbitrary binary pattern with binfmt_misc lets the kernel execute matching files automatically, which is worth keeping in mind even though the source itself does not raise the point.