Linux Journal - January 2012

What Is ELF?

ELF stands for Executable and Linkable Format. It is a standard file format for object files, executables, shared libraries and core dumps. It became a standard binary file format for UNIX (and UNIX-like systems) in 1999.

An ELF file begins with an ELF header, which is represented as the following structure:

#define EI_NIDENT 16
typedef struct {
Elf32_Half e_type;

Elf32_Half e_machine;

Elf32_Word e_version;

Elf32_Addr e_entry;

Elf32_Off e_phoff;

Elf32_Off e_shoff;

Elf32_Word e_flags;

Elf32_Half e_ehsize;

Elf32_Half e_phentsize;

Elf32_Half e_phnum;

Elf32_Half e_shentsize;

Elf32_Half e_shnum;

Elf32_Half e_shstrndx;

} Elf32_Ehdr;

Here is the description of some of the basic elements in the structure above:

1) e_ident: ELF has capabilities to
support multiple processors, data
encodings, classes of machines and
so forth. Now, to support all this, the
ELF header includes some initial bytes
that specify how to interpret the file
independent of the file’s contents
and the processor on which the query
is made. The e_ident[] array in the
previous structure corresponds to
these initial bytes. The following is the
breakdown of the e_ident[] array:

Name Value Purpose EI_MAG0 0 File identification EI_MAG1 1 File identification EI_MAG2 2 File identification EI_MAG3 3 File identification EI_CLASS 4 File class EI_DATA 5 Data encoding EI_VERSION 6 File version EI_PAD 7 Start of padding bytes EI_NIDENT 16 Size of e_ident[]