ELF(5) | File Formats Manual | ELF(5)

# NAME

`ELF` —
executable and linking format

# SYNOPSIS

`#include <elf.h>`

# DESCRIPTION

Because of the flexible nature of ELF, the structures describing it are available both as 32bit and 64bit versions. This document uses the 32bit versions, refer to `<elf.h>` for the corresponding 64bit versions.

The four main types of an ELF object file are:

executable
  A file suitable for execution. It contains the information required for creating a new process image.
relocatable
  Contains the necessary information to be run through the link editor ld(1) to create an executable or a shared library.
shared
  The shared object contains necessary information which can be used by either the link editor ld(1) at link time or by the dynamic loader ld.elf_so(1) at run time.
core
  A file which describes the virtual address space and register state of a process. Core files are typically used in conjunction with debuggers such as gdb(1).

ELF files have a dual nature. The toolchain, including tools such as the as(1) and linker ld(1), treats them as a set of sections described by their section headers. The system loader treats them as a set of segments described by the program headers.

The general format of an ELF file is the following: The file starts with an ELF header. This is followed by a table of program headers (optional for relocatable and shared files). After this come the sections/segments. The file ends with a table of section headers (optional for executable files).

A segment can be considered to consist of several sections. For example, all executable sections are typically packed into one loadable segment which is read-only and executable (see p_flags in the program header). This enables the system to map the entire file with just a few operations, one for each loadable segment, instead of doing numerous map operations for each section separately.

Each file is described by the ELF header:

    typedef struct {
    	unsigned char	e_ident[ELF_NIDENT];
    	Elf32_Half	e_type;
    	Elf32_Half	e_machine;
    	Elf32_Word	e_version;
    	Elf32_Addr	e_entry;
    	Elf32_Off	e_phoff;
    	Elf32_Off	e_shoff;
    	Elf32_Word	e_flags;
    	Elf32_Half	e_ehsize;
    	Elf32_Half	e_phentsize;
    	Elf32_Half	e_phnum;
    	Elf32_Half	e_shentsize;
    	Elf32_Half	e_shnum;
    	Elf32_Half	e_shstrndx;
    } Elf32_Ehdr;

e_ident[]
  The array contains the following information in the indicated locations:
  `EI_MAG0`
    The elements ranging from `EI_MAG0` to `EI_MAG3` contain the ELF magic number: \0177ELF
  `EI_CLASS`
    Contains the address size of the binary, either 32 or 64bit.
  `EI_DATA`
    byte order
  `EI_VERSION`
    Contains the ELF header version. This is currently always set to 1.
  `EI_OSABI`
    Contains the operating system ABI identification. Note that even though the definition `ELFOSABI_NETBSD` exists, NetBSD uses `ELFOSABI_SYSV` here, since the NetBSD ABI does not deviate from the standard.
  `EI_ABIVERSION`
    ABI version.
e_type
  Contains the file type identification. It can be either `ET_REL`, `ET_EXEC`, `ET_DYN`, or `ET_CORE` for relocatable, executable, shared, or core, respectively.
e_machine
  Contains the machine type, e.g. SPARC, Alpha, MIPS, ...
e_entry
  The program entry point if the file is executable.
e_phoff
  The position of the program header table in the file or 0 if it doesn't exist.
e_shoff
  The position of the section header table in the file or 0 if it doesn't exist.
e_flags
  Contains processor-specific flags. For example, the SPARC port uses this space to specify what kind of memory store ordering is required.
e_ehsize
  The size of the ELF header.
e_phentsize
  The size of an entry in the program header table. All entries are the same size.
e_phnum
  The number of entries in the program header table, or 0 if none exists.
e_shentsize
  The size of an entry in the section header table. All entries are the same size.
e_shnum
  The number of entries in the section header table, or 0 if none exists.
e_shstrndx
  Contains the index number of the section which contains the section name strings.

Each ELF section in turn is described by the section header:

    typedef struct {
    	Elf32_Word	sh_name;
    	Elf32_Word	sh_type;
    	Elf32_Word	sh_flags;
    	Elf32_Addr	sh_addr;
    	Elf32_Off	sh_offset;
    	Elf32_Word	sh_size;
    	Elf32_Word	sh_link;
    	Elf32_Word	sh_info;
    	Elf32_Word	sh_addralign;
    	Elf32_Word	sh_entsize;
    } Elf32_Shdr;

sh_name
  Contains an index to the position in the section header string section where the name of the current section can be found.
sh_type
  Contains the section type indicator. The more important possible values are:
  `SHT_NULL`
    Section is inactive. The other fields contain undefined values.
  `SHT_PROGBITS`
    Section contains program information. It can be for example code, data, or debugger information.
  `SHT_SYMTAB`
    Section contains a symbol table. This section usually contains all the symbols and is intended for the regular link editor ld(1).
  `SHT_STRTAB`
    Section contains a string table.
  `SHT_RELA`
    Section contains relocation information with an explicit addend.
  `SHT_HASH`
    Section contains a symbol hash table.
  `SHT_DYNAMIC`
    Section contains dynamic linking information.
  `SHT_NOTE`
    Section contains some special information. The format can be e.g. vendor-specific.
  `SHT_NOBITS`
    Sections contains information similar to `SHT_PROGBITS`, but takes up no space in the file. This can be used for e.g. bss.
  `SHT_REL`
    Section contains relocation information without an explicit addend.
  `SHT_SHLIB`
    This section type is reserved but has unspecified semantics.
  `SHT_DYNSYM`
    Section contains a symbol table. This symbol table is intended for the dynamic linker, and is kept as small as possible to conserve space, since it must be loaded to memory at run time.
sh_flags
  Contains the section flags, which can have the following values or any combination of them:
  `SHF_WRITE`
    Section is writable after it has been loaded.
  `SHF_ALLOC`
    Section will occupy memory at run time.
  `SHF_EXECINSTR`
    Section contains executable machine instructions.
sh_addr
  Address to where the section will be loaded, or 0 if this section does not reside in memory at run time.
sh_offset
  The byte offset from the beginning of the file to the beginning of this section. If the section is of type `SHT_NOBITS`, this field specifies the conceptual placement in the file.
sh_size
  The size of the section in the file for all types except `SHT_NOBITS`. For that type the value may differ from zero, but the section will still always take up no space from the file.
sh_link
  Contains an index to the section header table. The interpretation depends on the section type as follows:

  `SHT_REL`
  `SHT_RELA`
    Section index of the associated symbol table.

  `SHT_SYMTAB`
  `SHT_DYNSYM`
    Section index of the associated string table.

  `SHT_HASH`
    Section index of the symbol table to which the hash table applies.

  `SHT_DYNAMIC`
    Section index of of the string table by which entries in this section are used.
sh_info
  Contains extra information. The interpretation depends on the type as follows:

  `SHT_REL`
  `SHT_RELA`
    Section index of the section to which the relocation information applies.

  `SHT_SYMTAB`
  `SHT_DYNSYM`
    Contains a value one greater that the last local symbol table index.
sh_addralign
  Marks the section alignment requirement. If, for example, the section contains a doubleword, the entire section must be doubleword aligned to ensure proper alignment. Only 0 and integral powers of two are allowed. Values 0 and 1 denote that the section has no alignment.
sh_entsize
  Contains the entry size of an element for sections which are constructed of a table of fixed-size entries. If the section does not hold a table of fixed-size entries, this value is 0.

Every executable object must contain a program header. The program header contains information necessary in constructing a process image.

    typedef struct {
    	Elf32_Word	p_type;
    	Elf32_Off	p_offset;
    	Elf32_Addr	p_vaddr;
    	Elf32_Addr	p_paddr;
    	Elf32_Word	p_filesz;
    	Elf32_Word	p_memsz;
    	Elf32_Word	p_flags;
    	Elf32_Word	p_align;
    } Elf32_Phdr;

p_type
  Contains the segment type indicator. The possible values are:
  `PT_NULL`
    Segment is inactive. The other fields contain undefined values.
  `PT_LOAD`
    Segment is loadable. It is loaded to the address described by p_vaddr. If p_memsz is greater than p_filesz, the memory range from (p_vaddr + p_filesz) to (p_vaddr + p_memsz) is zero-filled when the segment is loaded. p_filesz can not be greater than p_memsz. Segments of this type are sorted in the header table by p_vaddr in ascending order.
  `PT_DYNAMIC`
    Segment contains dynamic linking information.
  `PT_INTERP`
    Segment contains a null-terminated path name to the interpreter. This segment may be present only once in a file, and it must appear before any loadable segments. This field will most likely contain the ELF dynamic loader: /libexec/ld.elf_so
  `PT_NOTE`
    Segment contains some special information. Format can be e.g. vendor-specific.
  `PT_SHLIB`
    This segment type is reserved but has unspecified semantics. Programs which contain a segment of this type do not conform to the ABI, and must indicate this by setting the appropriate ABI in the ELF header `EI_OSABI` field.
  `PT_PHDR`
    The values in a program header of this type specify the characteristics of the program header table itself. For example, the p_vaddr field specifies the program header table location in memory once the program is loaded. This field may not occur more than once, may occur only if the program header table is part of the file memory image, and must come before any loadable segments.
p_offset
  Contains the byte offset from the beginning of the file to the beginning of this segment.
p_vaddr
  Contains the virtual memory address to which this segment is loaded.
p_paddr
  Contains the physical address to which this segment is loaded. This value is usually ignored, but may be used while bootstrapping or in embedded systems.
p_filesz
  Contains the number of bytes this segment occupies in the file image.
p_memsz
  Contains the number of bytes this segment occupies in the memory image.
p_flags
  Contains the segment flags, which specify the permissions for the segment after it has been loaded. The following values or any combination of them is acceptable:
  `PF_R`
    Segment can be read.
  `PF_W`
    Segment can be written.
  `PF_X`
    Segment is executable.
p_align
  Contains the segment alignment. Acceptable values are 0 and 1 for no alignment, and integral powers of two. p_vaddr should equal p_offset modulo p_align.

# SEE ALSO

as(1), gdb(1), ld(1), ld.elf_so(1), execve(2), nlist(3), a.out(5), core(5), link(5), stab(5)

# HISTORY

The ELF object file format first appeared in AT&T System V UNIX.

November 18, 2006 | NetBSD 9.4