NAME
ELF —
executable and linking
format
SYNOPSIS
#include <elf.h>
DESCRIPTION
Because of the flexible nature of ELF, the structures describing it are
available both as 32bit and 64bit versions. This document uses the 32bit
versions, refer to
<elf.h> for the
corresponding 64bit versions.
The four main types of an ELF object file are:
-
-
- executable
- A file suitable for execution. It contains the information
required for creating a new process image.
-
-
- relocatable
- Contains the necessary information to be run through the
link editor ld(1) to create an
executable or a shared library.
-
-
- shared
- The shared object contains necessary information which can
be used by either the link editor
ld(1) at link time or by the
dynamic loader
ld.elf_so(1) at run
time.
-
-
- core
- A file which describes the virtual address space and
register state of a process. Core files are typically used in conjunction
with debuggers such as
gdb(1).
ELF files have a dual nature. The toolchain, including tools such as the
as(1) and linker
ld(1), treats them as a set of
sections described by their section headers. The system loader treats them as
a set of segments described by the program headers.
The general format of an ELF file is the following: The file starts with an ELF
header. This is followed by a table of program headers (optional for
relocatable and shared files). After this come the sections/segments. The file
ends with a table of section headers (optional for executable files).
A segment can be considered to consist of several sections. For example, all
executable sections are typically packed into one loadable segment which is
read-only and executable (see
p_flags in the program
header). This enables the system to map the entire file with just a few
operations, one for each loadable segment, instead of doing numerous map
operations for each section separately.
Each file is described by the ELF header:
typedef struct {
unsigned char e_ident[ELF_NIDENT];
Elf32_Half e_type;
Elf32_Half e_machine;
Elf32_Word e_version;
Elf32_Addr e_entry;
Elf32_Off e_phoff;
Elf32_Off e_shoff;
Elf32_Word e_flags;
Elf32_Half e_ehsize;
Elf32_Half e_phentsize;
Elf32_Half e_phnum;
Elf32_Half e_shentsize;
Elf32_Half e_shnum;
Elf32_Half e_shstrndx;
} Elf32_Ehdr;
-
-
- e_ident[]
- The array contains the following information in the
indicated locations:
-
-
EI_MAG0
- The elements ranging from
EI_MAG0
to EI_MAG3
contain the ELF magic number: \0177ELF
-
-
EI_CLASS
- Contains the address size of the binary, either 32 or
64bit.
-
-
EI_DATA
- byte order
-
-
EI_VERSION
- Contains the ELF header version. This is currently
always set to 1.
-
-
EI_OSABI
- Contains the operating system ABI identification. Note
that even though the definition
ELFOSABI_NETBSD
exists,
NetBSD uses
ELFOSABI_SYSV
here, since the
NetBSD ABI does not deviate from the
standard.
-
-
EI_ABIVERSION
- ABI version.
-
-
- e_type
- Contains the file type identification. It can be either
ET_REL
, ET_EXEC
,
ET_DYN
, or ET_CORE
for
relocatable, executable, shared, or core, respectively.
-
-
- e_machine
- Contains the machine type, e.g. SPARC, Alpha, MIPS,
...
-
-
- e_entry
- The program entry point if the file is executable.
-
-
- e_phoff
- The position of the program header table in the file or 0
if it doesn't exist.
-
-
- e_shoff
- The position of the section header table in the file or 0
if it doesn't exist.
-
-
- e_flags
- Contains processor-specific flags. For example, the SPARC
port uses this space to specify what kind of memory store ordering is
required.
-
-
- e_ehsize
- The size of the ELF header.
-
-
- e_phentsize
- The size of an entry in the program header table. All
entries are the same size.
-
-
- e_phnum
- The number of entries in the program header table, or 0 if
none exists.
-
-
- e_shentsize
- The size of an entry in the section header table. All
entries are the same size.
-
-
- e_shnum
- The number of entries in the section header table, or 0 if
none exists.
-
-
- e_shstrndx
- Contains the index number of the section which contains the
section name strings.
Each ELF section in turn is described by the section header:
typedef struct {
Elf32_Word sh_name;
Elf32_Word sh_type;
Elf32_Word sh_flags;
Elf32_Addr sh_addr;
Elf32_Off sh_offset;
Elf32_Word sh_size;
Elf32_Word sh_link;
Elf32_Word sh_info;
Elf32_Word sh_addralign;
Elf32_Word sh_entsize;
} Elf32_Shdr;
-
-
- sh_name
- Contains an index to the position in the section header
string section where the name of the current section can be found.
-
-
- sh_type
- Contains the section type indicator. The more important
possible values are:
-
-
SHT_NULL
- Section is inactive. The other fields contain undefined
values.
-
-
SHT_PROGBITS
- Section contains program information. It can be for
example code, data, or debugger information.
-
-
SHT_SYMTAB
- Section contains a symbol table. This section usually
contains all the symbols and is intended for the regular link editor
ld(1).
-
-
SHT_STRTAB
- Section contains a string table.
-
-
SHT_RELA
- Section contains relocation information with an
explicit addend.
-
-
SHT_HASH
- Section contains a symbol hash table.
-
-
SHT_DYNAMIC
- Section contains dynamic linking information.
-
-
SHT_NOTE
- Section contains some special information. The format
can be e.g. vendor-specific.
-
-
SHT_NOBITS
- Sections contains information similar to
SHT_PROGBITS
, but takes up no space in the
file. This can be used for e.g. bss.
-
-
SHT_REL
- Section contains relocation information without an
explicit addend.
-
-
SHT_SHLIB
- This section type is reserved but has unspecified
semantics.
-
-
SHT_DYNSYM
- Section contains a symbol table. This symbol table is
intended for the dynamic linker, and is kept as small as possible to
conserve space, since it must be loaded to memory at run time.
-
-
- sh_flags
- Contains the section flags, which can have the following
values or any combination of them:
-
-
SHF_WRITE
- Section is writable after it has been loaded.
-
-
SHF_ALLOC
- Section will occupy memory at run time.
-
-
SHF_EXECINSTR
- Section contains executable machine instructions.
-
-
- sh_addr
- Address to where the section will be loaded, or 0 if this
section does not reside in memory at run time.
-
-
- sh_offset
- The byte offset from the beginning of the file to the
beginning of this section. If the section is of type
SHT_NOBITS
, this field specifies the conceptual
placement in the file.
-
-
- sh_size
- The size of the section in the file for all types except
SHT_NOBITS
. For that type the value may differ
from zero, but the section will still always take up no space from the
file.
-
-
- sh_link
- Contains an index to the section header table. The
interpretation depends on the section type as follows:
SHT_REL
-
SHT_RELA
- Section index of the associated symbol table.
SHT_SYMTAB
-
SHT_DYNSYM
- Section index of the associated string table.
SHT_HASH
- Section index of the symbol table to which the hash
table applies.
SHT_DYNAMIC
- Section index of of the string table by which entries
in this section are used.
-
-
- sh_info
- Contains extra information. The interpretation depends on
the type as follows:
SHT_REL
-
SHT_RELA
- Section index of the section to which the relocation
information applies.
SHT_SYMTAB
-
SHT_DYNSYM
- Contains a value one greater that the last local symbol
table index.
-
-
- sh_addralign
- Marks the section alignment requirement. If, for example,
the section contains a doubleword, the entire section must be doubleword
aligned to ensure proper alignment. Only 0 and integral powers of two are
allowed. Values 0 and 1 denote that the section has no alignment.
-
-
- sh_entsize
- Contains the entry size of an element for sections which
are constructed of a table of fixed-size entries. If the section does not
hold a table of fixed-size entries, this value is 0.
Every executable object must contain a program header. The program header
contains information necessary in constructing a process image.
typedef struct {
Elf32_Word p_type;
Elf32_Off p_offset;
Elf32_Addr p_vaddr;
Elf32_Addr p_paddr;
Elf32_Word p_filesz;
Elf32_Word p_memsz;
Elf32_Word p_flags;
Elf32_Word p_align;
} Elf32_Phdr;
-
-
- p_type
- Contains the segment type indicator. The possible values
are:
-
-
PT_NULL
- Segment is inactive. The other fields contain undefined
values.
-
-
PT_LOAD
- Segment is loadable. It is loaded to the address
described by p_vaddr. If
p_memsz is greater than
p_filesz, the memory range from
(p_vaddr + p_filesz) to
(p_vaddr + p_memsz) is
zero-filled when the segment is loaded. p_filesz
can not be greater than p_memsz. Segments of
this type are sorted in the header table by
p_vaddr in ascending order.
-
-
PT_DYNAMIC
- Segment contains dynamic linking information.
-
-
PT_INTERP
- Segment contains a null-terminated path name to the
interpreter. This segment may be present only once in a file, and it
must appear before any loadable segments. This field will most likely
contain the ELF dynamic loader:
/libexec/ld.elf_so
-
-
PT_NOTE
- Segment contains some special information. Format can
be e.g. vendor-specific.
-
-
PT_SHLIB
- This segment type is reserved but has unspecified
semantics. Programs which contain a segment of this type do not
conform to the ABI, and must indicate this by setting the appropriate
ABI in the ELF header
EI_OSABI
field.
-
-
PT_PHDR
- The values in a program header of this type specify the
characteristics of the program header table itself. For example, the
p_vaddr field specifies the program header table
location in memory once the program is loaded. This field may not
occur more than once, may occur only if the program header table is
part of the file memory image, and must come before any loadable
segments.
-
-
- p_offset
- Contains the byte offset from the beginning of the file to
the beginning of this segment.
-
-
- p_vaddr
- Contains the virtual memory address to which this segment
is loaded.
-
-
- p_paddr
- Contains the physical address to which this segment is
loaded. This value is usually ignored, but may be used while bootstrapping
or in embedded systems.
-
-
- p_filesz
- Contains the number of bytes this segment occupies in the
file image.
-
-
- p_memsz
- Contains the number of bytes this segment occupies in the
memory image.
-
-
- p_flags
- Contains the segment flags, which specify the permissions
for the segment after it has been loaded. The following values or any
combination of them is acceptable:
-
-
PF_R
- Segment can be read.
-
-
PF_W
- Segment can be written.
-
-
PF_X
- Segment is executable.
-
-
- p_align
- Contains the segment alignment. Acceptable values are 0 and
1 for no alignment, and integral powers of two.
p_vaddr should equal p_offset
modulo p_align.
SEE ALSO
as(1),
gdb(1),
ld(1),
ld.elf_so(1),
execve(2),
nlist(3),
a.out(5),
core(5),
link(5),
stab(5)
HISTORY
The ELF object file format first appeared in
AT&T
System V UNIX.