CONTENTS

SYNOPSIS

DESCRIPTION

An executable file using the ELF file format consists of an ELF header, followed by a program header table or a section header table, or both. The ELF header is always at offset zero of the file. The program header table and the section header table’s offset in the file are defined in the ELF header. The two tables describe the rest of the particularities of the file.

Applications which wish to process ELF binary files for their native architecture only should include
.In elf.h in their source code. These applications should need to refer to all the types and structures by their generic names "Elf_xxx" and to the macros by "ELF_xxx". Applications written this way can be compiled on any architecture, regardless whether the host is 32-bit or 64-bit.

Should an application need to process ELF files of an unknown architecture then the application needs to include both
.In sys/elf32.h and
.In sys/elf64.h instead of
.In elf.h . Furthermore, all types and structures need to be identified by either "Elf32_xxx" or "Elf64_xxx". The macros need to be identified by "ELF32_xxx" or "ELF64_xxx".

Whatever the system’s architecture is, it will always include
.In sys/elf_common.h as well as
.In sys/elf_generic.h .

These header files describe the above mentioned headers as C structures and also include structures for dynamic sections, relocation sections and symbol tables.

The following types are being used for 32-bit architectures:
Elf32_Addr Unsigned program address
Elf32_Half Unsigned halfword field
Elf32_Off Unsigned file offset
Elf32_SwordSigned large integer
Elf32_Word Field or unsigned large integer
Elf32_Size Unsigned object size

For 64-bit architectures we have the following types:
Elf64_Addr Unsigned program address
Elf64_Half Unsigned halfword field
Elf64_Off Unsigned file offset
Elf64_SwordSigned large integer
Elf64_Word Field or unsigned large integer
Elf64_Size Unsigned object size
Elf64_Quarter Unsigned quarterword field

All data structures that the file format defines follow the "natural" size and alignment guidelines for the relevant class. If necessary, data structures contain explicit padding to ensure 4-byte alignment for 4-byte objects, to force structure sizes to a multiple of 4, etc.

The ELF header is described by the type Elf32_Ehdr or Elf64_Ehdr:
typedef struct {
unsigned char e_ident[EI_NIDENT];
Elf32_Half e_type;
Elf32_Half e_machine;
Elf32_Word e_version;
Elf32_Addr e_entry;
Elf32_Off e_phoff;
Elf32_Off e_shoff;
Elf32_Word e_flags;
Elf32_Half e_ehsize;
Elf32_Half e_phentsize;
Elf32_Half e_phnum;
Elf32_Half e_shentsize;
Elf32_Half e_shnum;
Elf32_Half e_shstrndx;
} Elf32_Ehdr;

typedef struct {
unsigned char e_ident[EI_NIDENT];
Elf64_Quarter e_type;
Elf64_Quarter e_machine;
Elf64_Half e_version;
Elf64_Addr e_entry;
Elf64_Off e_phoff;
Elf64_Off e_shoff;
Elf64_Half e_flags;
Elf64_Quarter e_ehsize;
Elf64_Quarter e_phentsize;
Elf64_Quarter e_phnum;
Elf64_Quarter e_shentsize;
Elf64_Quarter e_shnum;
Elf64_Quarter e_shstrndx;
} Elf64_Ehdr;

The fields have the following meanings:

An executable or shared object file’s program header table is an array of structures, each describing a segment or other information the system needs to prepare the program for execution. An object file segment contains one or more sections. Program headers are meaningful only for executable and shared object files. A file specifies its own program header size with the ELF header’s e_phentsize and e_phnum members. As with the Elf executable header, the program header also has different versions depending on the architecture:

typedef struct {
Elf32_Word p_type;
Elf32_Off p_offset;
Elf32_Addr p_vaddr;
Elf32_Addr p_paddr;
Elf32_Size p_filesz;
Elf32_Size p_memsz;
Elf32_Word p_flags;
Elf32_Size p_align;
} Elf32_Phdr;

typedef struct {
Elf64_Half p_type;
Elf64_Half p_flags;
Elf64_Off p_offset;
Elf64_Addr p_vaddr;
Elf64_Addr p_paddr;
Elf64_Size p_filesz;
Elf64_Size p_memsz;
Elf64_Size p_align;
} Elf64_Phdr;

The main difference between the 32-bit and the 64-bit program header lies only in the location of a p_flags member in the total struct.

A text segment commonly has the flags PF_X and PF_R. A data segment commonly has PF_X, PF_W and PF_R.

An file’s section header table lets one locate all the file’s sections. The section header table is an array of Elf32_Shdr or Elf64_Shdr structures. The ELF header’s e_shoff member gives the byte offset from the beginning of the file to the section header table. e_shnum holds the number of entries the section header table contains. e_shentsize holds the size in bytes of each entry.

A section header table index is a subscript into this array. Some section header table indices are reserved. An object file does not have sections for these special indices:

The section header has the following structure:
typedef struct {
Elf32_Word sh_name;
Elf32_Word sh_type;
Elf32_Word sh_flags;
Elf32_Addr sh_addr;
Elf32_Off sh_offset;
Elf32_Size sh_size;
Elf32_Word sh_link;
Elf32_Word sh_info;
Elf32_Size sh_addralign;
Elf32_Size sh_entsize;
} Elf32_Shdr;

typedef struct {
Elf64_Half sh_name;
Elf64_Half sh_type;
Elf64_Size sh_flags;
Elf64_Addr sh_addr;
Elf64_Off sh_offset;
Elf64_Size sh_size;
Elf64_Half sh_link;
Elf64_Half sh_info;
Elf64_Size sh_addralign;
Elf64_Size sh_entsize;
} Elf64_Shdr;

Various sections hold program and control information:

String table sections hold null-terminated character sequences, commonly called strings. The object file uses these strings to represent symbol and section names. One references a string as an index into the string table section. The first byte, which is index zero, is defined to hold a null character. Similarly, a string table’s last byte is defined to hold a null character, ensuring null termination for all strings.

An object file’s symbol table holds information needed to locate and relocate a program’s symbolic definitions and references. A symbol table index is a subscript into this array.

typedef struct {
Elf32_Word st_name;
Elf32_Addr st_value;
Elf32_Size st_size;
unsigned char st_info;
unsigned char st_other;
Elf32_Half st_shndx;
} Elf32_Sym;

typedef struct {
Elf64_Half st_name;
unsigned char st_info;
unsigned char st_other;
Elf64_Quarter st_shndx;
Elf64_Addr st_value;
Elf64_Size st_size;
} Elf64_Sym;

Relocation is the process of connecting symbolic references with symbolic definitions. Relocatable files must have information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’ program image. Relocation entries are these data.

Relocation structures that do not need an addend:

typedef struct {
Elf32_Addr r_offset;
Elf32_Word r_info;
} Elf32_Rel;


typedef struct {
Elf64_Addr r_offset;
Elf64_Size r_info;
} Elf64_Rel;

Relocation structures that need an addend:

typedef struct {
Elf32_Addr r_offset;
Elf32_Word r_info;
Elf32_Swordr_addend;
} Elf32_Rela;


typedef struct {
Elf64_Addr r_offset;
Elf64_Size r_info;
Elf64_Off r_addend;
} Elf64_Rela;

SEE ALSO

HISTORY

AUTHORS