All About ELF format

It is a common standard file format for executable files, relocatable code (object ie .o files), shared libraries, and core dumps. It is a spec of ABI (Application Binary interface). By design it is flexible, extensible, cross-platform, CPU architecture & ISA independent. It can be loaded at any memory address by the kernel and automatically, all symbols used, are adjusted to the offset from that memory address where it was loaded into.

File name extensions : none, .axf, .bin, .elf, .o, .prx, .puff, .ko, .mod and .so

Magic Number : 0x7F ‘E’ ‘L’ ‘F’

Image Source : Wikipedia

  • Program header table : zero or more memory segments. Only appears at executable. It tells how the executable should be put into the process virtual memory (How to create a process image). This is must for process image, executable files and shared objects. For Relocatable object files, this is not needed.

Sections are smallest indivisible units in ELF file that can be processed. (Linking view). Sections hold the bulk of object file information for the linking view. This data includes instructions, data, symbol table, and relocation information.

Segments are smallest individual units that can be mapped to memory by exec or linker. (Executable view)

Section vs Segment : In an object file section exists before linking, while segment exists after linking in executable file. Linker puts one or more sections into a single segment.

Sections and segments have no specified order in ELF. Only the ELF header has a fixed position in the file.

Tools :

  • readelf : gives info about ELF files. (from GNU binutils).
Examples with readelf tool : git clone

Kernel and ELF :

3 important Program header entry -

  • PT_LOAD — areas of the new program’s running memory (code+data section of size of BSS — filled with zero)

Loading ELF :

  1. read elf header (contains info of rest of the file)

Parsing elf executable :

  1. Check buffer size to accommodate elf header and program header.

Relocation :

  1. Check elf header.



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store