The issue of a.out magic numbers came up. The a.out header was 16 bytes. The first
two bytes was 0407 in the original code. This was followed by 16 bit quantities for
text, data, and bss sizes. Then the size of the symbol tables. I'm pretty sure
the rest of the fields were blank in V6. Later a start address (previously always
assumed to be zero) was added.
The number 407 was a neat kludge. It was a (relative) branch instruction on the PDP-11.
0400 was the base op code. 7 referred to jumping ahead 7 words which skipped you over
the a.out header (the PC had already been incremented for the branch instruction itself).
This allowed you to make a boot block without having to strip off the header. Boot
blocks were just one 512 byte block loaded from block zero of the disk into low memory.
Later executables used 410 for a write protected text segment and 411 for split-I/D
executables. Later versions added more codes (413 was used in BSD to indicate aligned
pages followed etc... Even later systems coded the hardware type into the magic number
to distinguish between different architectures.
Note that the fact that 410 and 411 were also PDP-11 branch instructions wasn't ever
really used for anything.