All About ELF format

  • Program header table : zero or more memory segments. Only appears at executable. It tells how the executable should be put into the process virtual memory (How to create a process image). This is must for process image, executable files and shared objects. For Relocatable object files, this is not needed.
  • Section header table : zero or more sections. Tells how or where section should be loaded. Each section entry in table contains section name and section size. Section Header Table must for the files used in link editing.
  • Data : of program header table or section header table.
  • ELF header (52 or 64 byte long for 32 or 64 bit) : defines whether to use 32 or 64 bits.
  • Program header : Tells how to create process image.
  • readelf : gives info about ELF files. (from GNU binutils).
  • elfutils : alternative to binutils.
  • elfdump : dumps ELF information of an ELF file.
  • objdump : gives info of obj files. It uses the Binary File Descriptor library as a back-end to structure the ELF data.
  • file : can display some information about ELF files, including ISA for which the code in a relocatable, executable, or shared object file is intended, or on which an ELF core dump was produced.
  • nm : gives symbol information of an object file.
Examples with readelf tool : git clone
  • PT_LOAD — areas of the new program’s running memory (code+data section of size of BSS — filled with zero)
  • PT_INTERP — run-time linker needed to assemble the complete program.
  • PT_GNU_STACK — indicates whether the program’s stack should be made executable or not.
  1. read elf header (contains info of rest of the file)
  2. find program header which directs to text and data section leading to executable image.
  1. Check buffer size to accommodate elf header and program header.
  2. Check elf magic number.
  3. Check max segment number in program header for validity.
  4. Extract segment and entry.
  5. Fill corresponding structure of program header from extracted data.
  1. Check elf header.
  2. Get load address.
  3. Allocate space form program sections.
  4. Copy from the image in ram to allocated space.
  5. Resolve kernel symbol table of external references.
  6. Go to entry point using entry point in header as base plus offset or do a symbol lookup or just return a success. Hence driver can be loaded later also.




Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

How to Override Methods in C#

104. Maximum Depth of Binary Tree

Full Stack Open Source BI & Data Science Solution for Small and Medium Enterprises

Gameplay Journal # 2

Crust Devlog | June 1st— June 15th, 2022

Terraform Module | S3 bucket with Terraform Module

TechSpeakers Ahoy! : A Berlin Meetup

Schema Comparison in Databricks — Tables, Columns and Data Types

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Carlos Alvarez

Carlos Alvarez

More from Medium

Things people take for granted, most of the time.

Things people take for granted — importance of gratitude

How To Stop Procrastination

10 Quotes to Inspire the Creator in You

Malignant (2021)