NAME

ELF — executable and linking format

SYNOPSIS

#include <elf.h>

DESCRIPTION

Because of the flexible nature of ELF, the structures describing it are available both as 32bit and 64bit versions. This document uses the 32bit versions, refer to <elf.h> for the corresponding 64bit versions.

The four main types of an ELF object file are:

ELF files have a dual nature. The toolchain, including tools such as the as(1) and linker ld(1), treats them as a set of sections described by their section headers. The system loader treats them as a set of segments described by the program headers.

The general format of an ELF file is the following: The file starts with an ELF header. This is followed by a table of program headers (optional for relocatable and shared files). After this come the sections/segments. The file ends with a table of section headers (optional for executable files).

A segment can be considered to consist of several sections. For example, all executable sections are typically packed into one loadable segment which is read-only and executable (see p_flags in the program header). This enables the system to map the entire file with just a few operations, one for each loadable segment, instead of doing numerous map operations for each section separately.

Each file is described by the ELF header:

typedef struct { 
	unsigned char	e_ident[ELF_NIDENT]; 
	Elf32_Half	e_type; 
	Elf32_Half	e_machine; 
	Elf32_Word	e_version; 
	Elf32_Addr	e_entry; 
	Elf32_Off	e_phoff; 
	Elf32_Off	e_shoff; 
	Elf32_Word	e_flags; 
	Elf32_Half	e_ehsize; 
	Elf32_Half	e_phentsize; 
	Elf32_Half	e_phnum; 
	Elf32_Half	e_shentsize; 
	Elf32_Half	e_shnum; 
	Elf32_Half	e_shstrndx; 
} Elf32_Ehdr;

Each ELF section in turn is described by the section header:

typedef struct { 
	Elf32_Word	sh_name; 
	Elf32_Word	sh_type; 
	Elf32_Word	sh_flags; 
	Elf32_Addr	sh_addr; 
	Elf32_Off	sh_offset; 
	Elf32_Word	sh_size; 
	Elf32_Word	sh_link; 
	Elf32_Word	sh_info; 
	Elf32_Word	sh_addralign; 
	Elf32_Word	sh_entsize; 
} Elf32_Shdr;

sh_name

Contains an index to the position in the section header string section where the name of the current section can be found.

sh_type

Contains the section type indicator. The more important possible values are:

sh_flags

Contains the section flags, which can have the following values or any combination of them:

sh_addr

Address to where the section will be loaded, or 0 if this section does not reside in memory at run time.

sh_offset

The byte offset from the beginning of the file to the beginning of this section. If the section is of type SHT_NOBITS, this field specifies the conceptual placement in the file.

sh_size

The size of the section in the file for all types except SHT_NOBITS. For that type the value may differ from zero, but the section will still always take up no space from the file.

sh_link

Contains an index to the section header table. The interpretation depends on the section type as follows:

sh_info

Contains extra information. The interpretation depends on the type as follows:

sh_addralign

Marks the section alignment requirement. If, for example, the section contains a doubleword, the entire section must be doubleword aligned to ensure proper alignment. Only 0 and integral powers of two are allowed. Values 0 and 1 denote that the section has no alignment.

sh_entsize

Contains the entry size of an element for sections which are constructed of a table of fixed-size entries. If the section does not hold a table of fixed-size entries, this value is 0.

Every executable object must contain a program header. The program header contains information necessary in constructing a process image.

typedef struct { 
	Elf32_Word	p_type; 
	Elf32_Off	p_offset; 
	Elf32_Addr	p_vaddr; 
	Elf32_Addr	p_paddr; 
	Elf32_Word	p_filesz; 
	Elf32_Word	p_memsz; 
	Elf32_Word	p_flags; 
	Elf32_Word	p_align; 
} Elf32_Phdr;

HISTORY

The ELF object file format first appeared in AT&T System V UNIX.

November 18, 2006

NetBSD 6.1

NAME

SYNOPSIS

DESCRIPTION

SEE ALSO

HISTORY