.Dd July 31, 1999 .Dt ELF 5 .Os .Sh NAME .Nm elf .Nd format of Executable and Linking Format (ELF) files .Sh SYNOPSIS .\" .Fd #include .Fd #include .Sh DESCRIPTION The header file .\" .Aq Pa elf_abi.h .Aq Pa elf.h defines the format of ELF executable binary files. Amongst these files are normal executable files, relocatable object files, core files and shared libraries. .Pp An executable file using the ELF file format consists of an ELF header, followed by a program header table or a section header table, or both. The ELF header is always at offset zero of the file. The program header table and the section header table's offset in the file are defined in the ELF header. The two tables describe the rest of the particularities of the file. .Pp .\" Applications which wish to process ELF binary files for their native .\" architecture only should include .\" .Aq Pa elf_abi.h .\" in their source code. .\" These applications should need to refer to .\" all the types and structures by their generic names .\" .Dq Elf_xxx .\" and to the macros by .\" .Dq ELF_xxx . .\" Applications written this way can be compiled on any architecture, .\" regardless of whether the host is 32-bit or 64-bit. .\" .Pp .\" Should an application need to process ELF files of an unknown .\" architecture, then the application needs to explicitly use either .\" .Dq Elf32_xxx .\" or .\" .Dq Elf64_xxx .\" type and structure names. .\" Likewise, the macros need to be identified by .\" .Dq ELF32_xxx .\" or .\" .Dq ELF64_xxx . .\" .Pp This header file describes the above mentioned headers as C structures and also includes structures for dynamic sections, relocation sections and symbol tables. .Pp The following types are used for N-bit architectures (N=32,64, ElfN stands for Elf32 or Elf64, uintN_t stands for uint32_t or uint64_t): .Bd -literal -offset indent ElfN_Addr Unsigned program address, uintN_t ElfN_Off Unsigned file offset, uintN_t ElfN_Section Unsigned section index, uint16_t ElfN_Versym Unsigned version symbol information, uint16_t Elf_Byte unsigned char ElfN_Half uint16_t ElfN_Sword int32_t ElfN_Word uint32_t ElfN_Sxword int64_t ElfN_Xword uint64_t .\" Elf32_Size Unsigned object size .Ed .Pp (Note: The *BSD terminology is a bit different. There Elf64_Half is twice as large as Elf32_Half, and Elf64Quarter is used for uint16_t. In order to avoid confusion these types are replaced by explicit ones in the below.) .Pp All data structures that the file format defines follow the .Dq natural size and alignment guidelines for the relevant class. If necessary, data structures contain explicit padding to ensure 4-byte alignment for 4-byte objects, to force structure sizes to a multiple of 4, etc. .Pp The ELF header is described by the type Elf32_Ehdr or Elf64_Ehdr: .Bd -literal -offset indent #define EI_NIDENT 16 typedef struct { unsigned char e_ident[EI_NIDENT]; uint16_t e_type; uint16_t e_machine; uint32_t e_version; ElfN_Addr e_entry; ElfN_Off e_phoff; ElfN_Off e_shoff; uint32_t e_flags; uint16_t e_ehsize; uint16_t e_phentsize; uint16_t e_phnum; uint16_t e_shentsize; uint16_t e_shnum; uint16_t e_shstrndx; } ElfN_Ehdr; .Ed .Pp The fields have the following meanings: .Pp String table sections hold null-terminated character sequences, commonly called strings. The object file uses these strings to represent symbol and section names. One references a string as an index into the string table section. The first byte, which is index zero, is defined to hold a null character. Similarly, a string table's last byte is defined to hold a null character, ensuring null termination for all strings. .Pp An object file's symbol table holds information needed to locate and relocate a program's symbolic definitions and references. A symbol table index is a subscript into this array. .Bd -literal -offset indent typedef struct { uint32_t st_name; Elf32_Addr st_value; uint32_t st_size; unsigned char st_info; unsigned char st_other; uint16_t st_shndx; } Elf32_Sym; .Ed .Bd -literal -offset indent typedef struct { uint32_t st_name; unsigned char st_info; unsigned char st_other; uint16_t st_shndx; Elf64_Addr st_value; uint64_t st_size; } Elf64_Sym; .Ed .Pp The 32-bit and 64-bit versions have the same members, just in a different order. .Bl -tag -width "st_value" -offset indent .It Dv st_name This member holds an index into the object file's symbol string table, which holds character representations of the symbol names. If the value is non-zero, it represents a string table index that gives the symbol name. Otherwise, the symbol table has no name. .It Dv st_value This member gives the value of the associated symbol. .It Dv st_size Many symbols have associated sizes. This member holds zero if the symbol has no size or an unknown size. .It Dv st_info This member specifies the symbol's type and binding attributes: .El .Pp Relocation is the process of connecting symbolic references with symbolic definitions. Relocatable files must have information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process' program image. Relocation entries are these data. .Pp Relocation structures that do not need an addend: .Bd -literal -offset indent typedef struct { Elf32_Addr r_offset; uint32_t r_info; } Elf32_Rel; .Ed .Bd -literal -offset indent typedef struct { Elf64_Addr r_offset; uint64_t r_info; } Elf64_Rel; .Ed .Pp Relocation structures that need an addend: .Bd -literal -offset indent typedef struct { Elf32_Addr r_offset; uint32_t r_info; int32_t r_addend; } Elf32_Rela; .Ed .Bd -literal -offset indent typedef struct { Elf64_Addr r_offset; uint64_t r_info; int64_t r_addend; } Elf64_Rela; .Ed .Sh SEE ALSO .Xr as 1 , .Xr gdb 1 , .Xr ld 1 , .Xr objdump 1 , .Xr execve 2 , .Xr core 5 .Rs .%A Hewlett-Packard .%B Elf-64 Object File Format .Re .Rs .%A Santa Cruz Operation .%B System V Application Binary Interface .Re .Rs .%A Unix System Laboratories .%T Object Files .%B "Executable and Linking Format (ELF)" .Re .Sh HISTORY .Ox ELF support first appeared in .Ox 1.2 , although not all supported platforms use it as the native binary file format. ELF in itself first appeared in .At V . The ELF format is an adopted standard. .Sh AUTHORS The original version of this manual page was written by .An Jeroen Ruigrok van der Werven .Aq asmodai@FreeBSD.org with inspiration from BSDi's .Bsx .Nm elf manpage.