ELF(5) File Formats Manual ELF(5) (NAME) elf - (ELF) (SYNOPSIS) #include (DESCRIPTION) ELF . (relocatable object files) core (shared objects) . ELF ELF (program header table) (section header table) . ELF . ELF . . C (dynamic sections) (relocation sections) (symbol tables) . (Basic types) N- (N=32,64 ElfN Elf32 Elf64 uintN_t uint32_t uint64_t ): ElfN_Addr Unsigned program address, uintN_t ElfN_Off Unsigned file offset, uintN_t ElfN_Section Unsigned section index, uint16_t ElfN_Versym Unsigned version symbol information, uint16_t Elf_Byte unsigned char ElfN_Half uint16_t ElfN_Sword int32_t ElfN_Word uint32_t ElfN_Sxword int64_t ElfN_Xword uint64_t (: *BSD . Elf64_Half Elf32_Half Elf64Quarter uint16_t . .) <<>> (natural) . (padding) . ELF (Ehdr) ELF Elf32_Ehdr Elf64_Ehdr : #define EI_NIDENT 16 typedef struct { unsigned char e_ident[EI_NIDENT]; uint16_t e_type; uint16_t e_machine; uint32_t e_version; ElfN_Addr e_entry; ElfN_Off e_phoff; ElfN_Off e_shoff; uint32_t e_flags; uint16_t e_ehsize; uint16_t e_phentsize; uint16_t e_phnum; uint16_t e_shentsize; uint16_t e_shnum; uint16_t e_shstrndx; } ElfN_Ehdr; : e_ident . EI_ ELF . : EI_MAG0 (magic number). ELFMAG0 . (0: 0x7f) EI_MAG1 . ELFMAG1 . (1: 'E') EI_MAG2 . ELFMAG2 . (2: 'L') EI_MAG3 . ELFMAG3 . (3: 'F') EI_CLASS : ELFCLASSNONE . ELFCLASS32 - . . ELFCLASS64 - . EI_DATA . : ELFDATANONE . ELFDATA2LSB (little-endian). ELFDATA2MSB (big-endian). EI_VERSION ELF : EV_NONE . EV_CURRENT . EI_OSABI (ABI) . ELF . : ELFOSABI_NONE ELFOSABI_SYSV ELFOSABI_SYSV UNIX System V ELFOSABI_HPUX HP-UX ELFOSABI_NETBSD NetBSD ELFOSABI_LINUX Linux ELFOSABI_SOLARIS Solaris ELFOSABI_IRIX IRIX ELFOSABI_FREEBSD FreeBSD ELFOSABI_TRU64 TRU64 UNIX ELFOSABI_ARM ARM ELFOSABI_STANDALONE ( / embedded) EI_ABIVERSION ABI . ABI . ABI EI_OSABI . 0 . EI_PAD (). . . EI_PAD . EI_NIDENT e_ident. e_type : ET_NONE . ET_REL (relocatable file). ET_EXEC (executable file). ET_DYN (shared object). ET_CORE core. e_machine . : EM_NONE EM_M32 AT&T WE 32100 EM_SPARC Sun Microsystems SPARC EM_386 Intel 80386 EM_68K Motorola 68000 EM_88K Motorola 88000 EM_860 Intel 80860 EM_MIPS MIPS RS3000 ( big-endian) EM_PARISC HP/PA EM_SPARC32PLUS SPARC EM_PPC PowerPC EM_PPC64 PowerPC - EM_S390 IBM S/390 EM_ARM Advanced RISC Machines EM_SH Renesas SuperH EM_SPARCV9 SPARC v9 - EM_IA_64 Intel Itanium EM_X86_64 AMD x86-64 EM_VAX DEC Vax e_version : EV_NONE EV_CURRENT e_entry . . e_phoff . . e_shoff . . e_flags . EF_`machine_flag' . . e_ehsize ELF . e_phentsize . e_phnum . e_phentsize e_phnum . e_phnum . PN_XNUM (0xffff) PN_XNUM (0xffff) sh_info . sh_info . PN_XNUM 0xffff e_phnum . e_shentsize . . e_shnum . e_shentsize e_shnum . e_shnum . SHN_LORESERVE (0xff00) e_shnum sh_size . sh_size . e_shstrndx (index) . SHN_UNDEF . SHN_LORESERVE (0xff00) SHN_XINDEX (0xffff) sh_link . sh_link . (Phdr) (segment) . (section) . . e_phentsize e_phnum ELF . ELF Elf32_Phdr Elf64_Phdr : typedef struct { uint32_t p_type; Elf32_Off p_offset; Elf32_Addr p_vaddr; Elf32_Addr p_paddr; uint32_t p_filesz; uint32_t p_memsz; uint32_t p_flags; uint32_t p_align; } Elf32_Phdr; typedef struct { uint32_t p_type; uint32_t p_flags; Elf64_Off p_offset; Elf64_Addr p_vaddr; Elf64_Addr p_paddr; uint64_t p_filesz; uint64_t p_memsz; uint64_t p_align; } Elf64_Phdr; - - p_flags . p_type . PT_NULL . . PT_LOAD p_filesz p_memsz . . p_memsz p_filesz <<>> 0 . . p_vaddr . PT_DYNAMIC (dynamic linking) . PT_INTERP null . ( ). . . PT_NOTE (ElfN_Nhdr) . PT_SHLIB . ABI . PT_PHDR . . . . PT_LOPROC PT_HIPROC [PT_LOPROC, PT_HIPROC] . PT_GNU_STACK (GNU) p_flags . p_offset . p_vaddr . p_paddr . BSD . p_filesz . . p_memsz . . p_flags : PF_X . PF_W . PF_R . (text segment) PF_X PF_R . (data segment) PF_W PF_R . p_align . p_vaddr p_offset (page size) . . p_align p_vaddr p_offset p_align . (Shdr) . Elf32_Shdr Elf64_Shdr . e_shoff ELF . e_shnum . e_shentsize . . : SHN_LORESERVE SHN_HIRESERVE. ELF e_phnum e_shnum e_shstrndx . : SHN_UNDEF . SHN_LORESERVE . SHN_LOPROC SHN_HIPROC [SHN_LOPROC, SHN_HIPROC] . SHN_ABS . SHN_ABS . SHN_COMMON COMMON C. SHN_HIRESERVE . SHN_LORESERVE SHN_HIRESERVE . . : typedef struct { uint32_t sh_name; uint32_t sh_type; uint32_t sh_flags; Elf32_Addr sh_addr; Elf32_Off sh_offset; uint32_t sh_size; uint32_t sh_link; uint32_t sh_info; uint32_t sh_addralign; uint32_t sh_entsize; } Elf32_Shdr; typedef struct { uint32_t sh_name; uint32_t sh_type; uint64_t sh_flags; Elf64_Addr sh_addr; Elf64_Off sh_offset; uint64_t sh_size; uint32_t sh_link; uint32_t sh_info; uint64_t sh_addralign; uint64_t sh_entsize; } Elf64_Shdr; - - . sh_name . null . sh_type . SHT_NULL . . . SHT_PROGBITS . SHT_SYMTAB . SHT_SYMTAB (link editing) . . SHT_DYNSYM . SHT_STRTAB . . SHT_RELA (explicit addends) Elf32_Rela - . . SHT_HASH () . . . SHT_DYNAMIC . . SHT_NOTE (ElfN_Nhdr) . SHT_NOBITS SHT_PROGBITS . sh_offset . SHT_REL Elf32_Rel - . . SHT_SHLIB . SHT_DYNSYM . SHT_SYMTAB . SHT_LOPROC SHT_HIPROC [SHT_LOPROC, SHT_HIPROC] . SHT_LOUSER . SHT_HIUSER . SHT_LOUSER SHT_HIUSER . sh_flags - . sh_flags <<>> . <<>> . . SHF_WRITE . SHF_ALLOC . . . SHF_EXECINSTR . SHF_MASKPROC . sh_addr . . sh_offset . SHT_NOBITS sh_offset . sh_size . SHT_NOBITS sh_size . SHT_NOBITS . sh_link . sh_info . sh_addralign . doubleword doubleword . sh_addr sh_addralign . . 0 1 . sh_entsize . . . : .bss . . SHT_NOBITS . SHF_ALLOC SHF_WRITE . .comment . SHT_PROGBITS . . .ctors (constructor) ++C . SHT_PROGBITS . SHF_ALLOC SHF_WRITE . .data . SHT_PROGBITS . SHF_ALLOC SHF_WRITE . .data1 . SHT_PROGBITS . SHF_ALLOC SHF_WRITE . .debug (symbolic debugging) . . SHT_PROGBITS . . .dtors (destructor) ++C . SHT_PROGBITS . SHF_ALLOC SHF_WRITE . .dynamic . SHF_ALLOC . SHF_WRITE . SHT_DYNAMIC . . .dynstr . SHT_STRTAB . SHF_ALLOC . .dynsym . SHT_DYNSYM . SHF_ALLOC . .fini . . SHT_PROGBITS . SHF_ALLOC SHF_EXECINSTR . .gnu.version ElfN_Half . SHT_GNU_versym . SHF_ALLOC . .gnu.version_d ElfN_Verdef . SHT_GNU_verdef . SHF_ALLOC . .gnu.version_r ElfN_Verneed . SHT_GNU_versym . SHF_ALLOC . .got (global offset table) . SHT_PROGBITS . . .hash . SHT_HASH . SHF_ALLOC . .init . . SHT_PROGBITS . SHF_ALLOC SHF_EXECINSTR . .interp . SHF_ALLOC . . SHT_PROGBITS . .line . . SHT_PROGBITS . . .note . SHT_NOTE . . .note.ABI-tag ABI ELF . . SHT_NOTE . SHF_ALLOC . .note.gnu.build-id ELF . (build ID) . --build-id (ld (1)) . SHT_NOTE . SHF_ALLOC . .note.GNU-stack . SHT_PROGBITS . SHF_EXECINSTR . . .note.openbsd.ident OpenBSD ELF . .plt (procedure linkage table) . SHT_PROGBITS . . .relNAME . SHF_ALLOC . . <> . .text .rel.text . SHT_REL . .relaNAME . SHF_ALLOC . . <> . .text .rela.text . SHT_RELA . .rodata - . SHT_PROGBITS . SHF_ALLOC . .rodata1 - . SHT_PROGBITS . SHF_ALLOC . .shstrtab . SHT_STRTAB . . .strtab . SHF_ALLOC . . SHT_STRTAB . .symtab . SHF_ALLOC . . SHT_SYMTAB . .text <<>> . SHT_PROGBITS . SHF_ALLOC SHF_EXECINSTR . (String and symbol tables) null . . . null ('\0') . null null . . . typedef struct { uint32_t st_name; Elf32_Addr st_value; uint32_t st_size; unsigned char st_info; unsigned char st_other; uint16_t st_shndx; } Elf32_Sym; typedef struct { uint32_t st_name; unsigned char st_info; unsigned char st_other; uint16_t st_shndx; Elf64_Addr st_value; uint64_t st_size; } Elf64_Sym; - - . st_name . . . st_value . st_size . . st_info (binding) : STT_NOTYPE . STT_OBJECT . STT_FUNC . STT_SECTION . STB_LOCAL . STT_FILE . STB_LOCAL SHN_ABS STB_LOCAL . STT_LOPROC STT_HIPROC [STT_LOPROC, STT_HIPROC] . STB_LOCAL . . STB_GLOBAL . . STB_WEAK (weak) . STB_LOPROC STB_HIPROC [STB_LOPROC, STB_HIPROC] . : ELF32_ST_BIND(info) ELF64_ST_BIND(info) (binding) st_info . ELF32_ST_TYPE(info) ELF64_ST_TYPE(info) (type) st_info . ELF32_ST_INFO(bind, type) ELF64_ST_INFO(bind, type) st_info . st_other (visibility) . STV_DEFAULT . (interposed) . STV_INTERNAL . STV_HIDDEN ( ). STV_PROTECTED . : ELF32_ST_VISIBILITY(other) ELF64_ST_VISIBILITY(other) st_shndx <<>> . . (Rel & Rela) (Relocation) . . . (addend) : typedef struct { Elf32_Addr r_offset; uint32_t r_info; } Elf32_Rel; typedef struct { Elf64_Addr r_offset; uint64_t r_info; } Elf64_Rel; : typedef struct { Elf32_Addr r_offset; uint32_t r_info; int32_t r_addend; } Elf32_Rela; typedef struct { Elf64_Addr r_offset; uint64_t r_info; int64_t r_addend; } Elf64_Rela; r_offset . . . r_info . . ELF[32|64]_R_TYPE ELF[32|64]_R_SYM r_info . r_addend . (Dyn) .dynamic . d_tag d_un . typedef struct { Elf32_Sword d_tag; union { Elf32_Word d_val; Elf32_Addr d_ptr; } d_un; } Elf32_Dyn; extern Elf32_Dyn _DYNAMIC[]; typedef struct { Elf64_Sxword d_tag; union { Elf64_Xword d_val; Elf64_Addr d_ptr; } d_un; } Elf64_Dyn; extern Elf64_Dyn _DYNAMIC[]; d_tag : DT_NULL DT_NEEDED DT_PLTRELSZ PLT DT_PLTGOT PLT / GOT DT_HASH DT_STRTAB DT_SYMTAB DT_RELA Rela DT_RELASZ Rela DT_RELAENT Rela DT_STRSZ DT_SYMENT DT_INIT (initialization function) DT_FINI (termination function) DT_SONAME DT_RPATH DT_SYMBOLIC DT_REL Rel DT_RELSZ Rel DT_RELENT Rel DT_PLTREL PLT (Rela Rel) DT_DEBUG DT_TEXTREL DT_JMPREL PLT DT_BIND_NOW DT_RUNPATH DT_LOPROC DT_HIPROC [DT_LOPROC, DT_HIPROC] d_val . d_ptr . . . _DYNAMIC .dynamic. . (Nhdr) ELF . core (e_type ET_CORE) . (GNU) ELF C . ( struct ). name ( n_namesz ) descriptor ( n_descsz ) . . : void *memory, *name, *desc; Elf64_Nhdr *note, *next_note; /* The buffer is pointing to the start of the section/segment. */ note = memory; /* If the name is defined, it follows the note. */ name = note->n_namesz == 0 ? NULL : memory + sizeof(*note); /* If the descriptor is defined, it follows the name (with alignment). */ desc = note->n_descsz == 0 ? NULL : memory + sizeof(*note) + ALIGN_UP(note->n_namesz, 4); /* The next note follows both (with alignment). */ next_note = memory + sizeof(*note) + ALIGN_UP(note->n_namesz, 4) + ALIGN_UP(note->n_descsz, 4); n_type (namespace) n_namesz . n_namesz ( 0 ) : core ELF. . typedef struct { Elf32_Word n_namesz; Elf32_Word n_descsz; Elf32_Word n_type; } Elf32_Nhdr; typedef struct { Elf64_Word n_namesz; Elf64_Word n_descsz; Elf64_Word n_type; } Elf64_Nhdr; n_namesz name . . null . "GNU" n_namesz 4 . n_descsz (descriptor) . name . n_type name : Core ( e_type = ET_CORE) core. C . ( n_namesz 0 ) . NT_PRSTATUS prstatus NT_FPREGSET fpregset NT_PRPSINFO prpsinfo NT_PRXREG prxregset NT_TASKSTRUCT task NT_PLATFORM sysinfo(SI_PLATFORM) NT_AUXV auxv NT_GWINDOWS gwindows NT_ASRS asrset NT_PSTATUS pstatus NT_PSINFO psinfo NT_PRCRED prcred NT_UTSNAME utsname NT_LWPSTATUS lwpstatus NT_LWPSINFO lwpinfo NT_PRFPXREG fprxregset NT_SIGINFO siginfo_t ( ) NT_FILE NT_PRXFPREG user_fxsr_struct NT_PPC_VMX PowerPC Altivec/VMX NT_PPC_SPE PowerPC SPE/EVR NT_PPC_VSX PowerPC VSX NT_386_TLS i386 TLS ( user_desc) NT_386_IOPERM / x86 (1= ) NT_X86_XSTATE x86 xsave NT_S390_HIGH_GPRS s390 NT_S390_TIMER s390 NT_S390_TODCMP (TOD) s390 NT_S390_TODPREG (TOD) s390 NT_S390_CTRS s390 NT_S390_PREFIX s390 NT_S390_LAST_BREAK (breaking event) s390 NT_S390_SYSTEM_CALL s390 NT_S390_TDB s390 NT_ARM_VFP ARM VFP/NEON NT_ARM_TLS ARM TLS NT_ARM_HW_BREAK ARM NT_ARM_HW_WATCH ARM NT_ARM_SYSTEM_CALL ARM n_name = GNU (GNU). NT_GNU_ABI_TAG (ABI) (OS). desc : [0] (ELF_NOTE_OS_LINUX ELF_NOTE_OS_GNU ) [1] (major) ABI [2] (minor) ABI [3] (subminor) ABI NT_GNU_HWCAP hwcap. desc : [0] [1] hwcap null. : (1U << bit) & bit mask. NT_GNU_BUILD_ID --build-id ld(1) . desc . NT_GNU_GOLD_VERSION desc GNU Gold . / (e_type != ET_CORE) ( n_namesz 0 ) . NT_VERSION . NT_ARCH . (NOTES) ELF System V . ELF . e_phnum e_shnum e_shstrndx . Sun BSD AMD64 << >> . (SEE ALSO) as(1), elfedit(1), gdb(1), ld(1), nm(1), objcopy(1), objdump(1), patchelf(1), readelf(1), size(1), strings(1), strip(1), execve(2), dl_iterate_phdr(3), core(5), ld.so(8) Hewlett-Packard, Elf-64 Object File Format. Santa Cruz Operation, System V Application Binary Interface. UNIX System Laboratories, "Object Files", Executable and Linking Format (ELF). Sun Microsystems, Linker and Libraries Guide. AMD64 ABI Draft, System V Application Binary Interface AMD64 Architecture Processor Supplement. Linux man-pages 6.9.1 2024-06-15 ELF(5)