ELF(5) BSD File Formats Manual ELF(5)NAME
ELF — executable and linking format
SYNOPSIS
#include <elf.h>
DESCRIPTION
Because of the flexible nature of ELF, the structures describing it are
available both as 32bit and 64bit versions. This document uses the 32bit
versions, refer to <elf.h> for the corresponding 64bit versions.
The four main types of an ELF object file are:
executable A file suitable for execution. It contains the information
required for creating a new process image.
relocatable Contains the necessary information to be run through the
link editor ld(1) to create an executable or a shared
library.
shared The shared object contains necessary information which can
be used by either the link editor ld(1) at link time or by
the dynamic loader ld.elf_so(1) at run time.
core A file which describes the virtual address space and regis‐
ter state of a process. Core files are typically used in
conjunction with debuggers such as gdb(1).
ELF files have a dual nature. The toolchain, including tools such as the
as(1) and linker ld(1), treats them as a set of sections described by
their section headers. The system loader treats them as a set of segments
described by the program headers.
The general format of an ELF file is the following: The file starts with
an ELF header. This is followed by a table of program headers (optional
for relocatable and shared files). After this come the sections/segments.
The file ends with a table of section headers (optional for executable
files).
A segment can be considered to consist of several sections. For example,
all executable sections are typically packed into one loadable segment
which is read-only and executable (see p_flags in the program header).
This enables the system to map the entire file with just a few opera‐
tions, one for each loadable segment, instead of doing numerous map oper‐
ations for each section separately.
Each file is described by the ELF header:
typedef struct {
unsigned char e_ident[ELF_NIDENT];
Elf32_Half e_type;
Elf32_Half e_machine;
Elf32_Word e_version;
Elf32_Addr e_entry;
Elf32_Off e_phoff;
Elf32_Off e_shoff;
Elf32_Word e_flags;
Elf32_Half e_ehsize;
Elf32_Half e_phentsize;
Elf32_Half e_phnum;
Elf32_Half e_shentsize;
Elf32_Half e_shnum;
Elf32_Half e_shstrndx;
} Elf32_Ehdr;
e_ident[] The array contains the following information in the indi‐
cated locations:
EI_MAG0 The elements ranging from EI_MAG0 to EI_MAG3
contain the ELF magic number: \0177ELF
EI_CLASS Contains the address size of the binary,
either 32 or 64bit.
EI_DATA byte order
EI_VERSION Contains the ELF header version. This is cur‐
rently always set to 1.
EI_OSABI Contains the operating system ABI identifica‐
tion. Note that even though the definition
ELFOSABI_NETBSD exists, NetBSD uses
ELFOSABI_SYSV here, since the NetBSD ABI does
not deviate from the standard.
EI_ABIVERSION ABI version.
e_type Contains the file type identification. It can be either
ET_REL, ET_EXEC, ET_DYN, or ET_CORE for relocatable, exe‐
cutable, shared, or core, respectively.
e_machine Contains the machine type, e.g. SPARC, Alpha, MIPS, ...
e_entry The program entry point if the file is executable.
e_phoff The position of the program header table in the file or 0 if
it doesn't exist.
e_shoff The position of the section header table in the file or 0 if
it doesn't exist.
e_flags Contains processor-specific flags. For example, the SPARC
port uses this space to specify what kind of memory store
ordering is required.
e_ehsize The size of the ELF header.
e_phentsize The size of an entry in the program header table. All
entries are the same size.
e_phnum The number of entries in the program header table, or 0 if
none exists.
e_shentsize The size of an entry in the section header table. All
entries are the same size.
e_shnum The number of entries in the section header table, or 0 if
none exists.
e_shstrndx Contains the index number of the section which contains the
section name strings.
Each ELF section in turn is described by the section header:
typedef struct {
Elf32_Word sh_name;
Elf32_Word sh_type;
Elf32_Word sh_flags;
Elf32_Addr sh_addr;
Elf32_Off sh_offset;
Elf32_Word sh_size;
Elf32_Word sh_link;
Elf32_Word sh_info;
Elf32_Word sh_addralign;
Elf32_Word sh_entsize;
} Elf32_Shdr;
sh_name Contains an index to the position in the section header
string section where the name of the current section can be
found.
sh_type Contains the section type indicator. The more important
possible values are:
SHT_NULL Section is inactive. The other fields contain
undefined values.
SHT_PROGBITS Section contains program information. It can
be for example code, data, or debugger infor‐
mation.
SHT_SYMTAB Section contains a symbol table. This section
usually contains all the symbols and is
intended for the regular link editor ld(1).
SHT_STRTAB Section contains a string table.
SHT_RELA Section contains relocation information with
an explicit addend.
SHT_HASH Section contains a symbol hash table.
SHT_DYNAMIC Section contains dynamic linking information.
SHT_NOTE Section contains some special information.
The format can be e.g. vendor-specific.
SHT_NOBITS Sections contains information similar to
SHT_PROGBITS, but takes up no space in the
file. This can be used for e.g. bss.
SHT_REL Section contains relocation information with‐
out an explicit addend.
SHT_SHLIB This section type is reserved but has unspec‐
ified semantics.
SHT_DYNSYM Section contains a symbol table. This symbol
table is intended for the dynamic linker, and
is kept as small as possible to conserve
space, since it must be loaded to memory at
run time.
sh_flags Contains the section flags, which can have the following
values or any combination of them:
SHF_WRITE Section is writable after it has been
loaded.
SHF_ALLOC Section will occupy memory at run time.
SHF_EXECINSTR Section contains executable machine instruc‐
tions.
sh_addr Address to where the section will be loaded, or 0 if this
section does not reside in memory at run time.
sh_offset The byte offset from the beginning of the file to the
beginning of this section. If the section is of type
SHT_NOBITS, this field specifies the conceptual placement
in the file.
sh_size The size of the section in the file for all types except
SHT_NOBITS. For that type the value may differ from zero,
but the section will still always take up no space from the
file.
sh_link Contains an index to the section header table. The inter‐
pretation depends on the section type as follows:
SHT_REL
SHT_RELA Section index of the associated symbol table.
SHT_SYMTAB
SHT_DYNSYM Section index of the associated string table.
SHT_HASH Section index of the symbol table to which the
hash table applies.
SHT_DYNAMIC Section index of of the string table by which
entries in this section are used.
sh_info Contains extra information. The interpretation depends on
the type as follows:
SHT_REL
SHT_RELA Section index of the section to which the relo‐
cation information applies.
SHT_SYMTAB
SHT_DYNSYM Contains a value one greater that the last
local symbol table index.
sh_addralign Marks the section alignment requirement. If, for example,
the section contains a doubleword, the entire section must
be doubleword aligned to ensure proper alignment. Only 0
and integral powers of two are allowed. Values 0 and 1
denote that the section has no alignment.
sh_entsize Contains the entry size of an element for sections which
are constructed of a table of fixed-size entries. If the
section does not hold a table of fixed-size entries, this
value is 0.
Every executable object must contain a program header. The program header
contains information necessary in constructing a process image.
typedef struct {
Elf32_Word p_type;
Elf32_Off p_offset;
Elf32_Addr p_vaddr;
Elf32_Addr p_paddr;
Elf32_Word p_filesz;
Elf32_Word p_memsz;
Elf32_Word p_flags;
Elf32_Word p_align;
} Elf32_Phdr;
p_type Contains the segment type indicator. The possible values are:
PT_NULL Segment is inactive. The other fields contain unde‐
fined values.
PT_LOAD Segment is loadable. It is loaded to the address
described by p_vaddr. If p_memsz is greater than
p_filesz, the memory range from (p_vaddr +
p_filesz) to (p_vaddr + p_memsz) is zero-filled
when the segment is loaded. p_filesz can not be
greater than p_memsz. Segments of this type are
sorted in the header table by p_vaddr in ascending
order.
PT_DYNAMIC Segment contains dynamic linking information.
PT_INTERP Segment contains a null-terminated path name to the
interpreter. This segment may be present only once
in a file, and it must appear before any loadable
segments. This field will most likely contain the
ELF dynamic loader: /libexec/ld.elf_so
PT_NOTE Segment contains some special information. Format
can be e.g. vendor-specific.
PT_SHLIB This segment type is reserved but has unspecified
semantics. Programs which contain a segment of this
type do not conform to the ABI, and must indicate
this by setting the appropriate ABI in the ELF
header EI_OSABI field.
PT_PHDR The values in a program header of this type specify
the characteristics of the program header table
itself. For example, the p_vaddr field specifies
the program header table location in memory once
the program is loaded. This field may not occur
more than once, may occur only if the program
header table is part of the file memory image, and
must come before any loadable segments.
p_offset Contains the byte offset from the beginning of the file to the
beginning of this segment.
p_vaddr Contains the virtual memory address to which this segment is
loaded.
p_paddr Contains the physical address to which this segment is loaded.
This value is usually ignored, but may be used while bootstrap‐
ping or in embedded systems.
p_filesz Contains the number of bytes this segment occupies in the file
image.
p_memsz Contains the number of bytes this segment occupies in the mem‐
ory image.
p_flags Contains the segment flags, which specify the permissions for
the segment after it has been loaded. The following values or
any combination of them is acceptable:
PF_R Segment can be read.
PF_W Segment can be written.
PF_X Segment is executable.
p_align Contains the segment alignment. Acceptable values are 0 and 1
for no alignment, and integral powers of two. p_vaddr should
equal p_offset modulo p_align.
SEE ALSOas(1), gdb(1), ld(1), ld.elf_so(1), execve(2), nlist(3), a.out(5),
core(5), link(5), stab(5)HISTORY
The ELF object file format first appeared in AT&T System V UNIX.
BSD November 18, 2006 BSD
