ELF(5) File Formats Manual ELF(5) elf - (ELF) #include ELF . , , core- . ELF ELF, ( ). ELF . ELF. . C, , . N- (N=32,64; ElfN Elf32 Elf64; uintN_t uint32_t uint64_t): ElfN_Addr , uintN_t ElfN_Off , uintN_t ElfN_Section , uint16_t ElfN_Versym , uint16_t Elf_Byte unsigned char ElfN_Half uint16_t ElfN_Sword int32_t ElfN_Word uint32_t ElfN_Sxword int64_t ElfN_Xword uint64_t (: *BSD . , Elf64_Half -- Elf32_Half, Elf64Quarter -- uint16_t. , .) <<>> . , (padding) 4- 4- , 4- . . ELF (Ehdr) ELF Elf32_Ehdr Elf64_Ehdr: #define EI_NIDENT 16 typedef struct { unsigned char e_ident[EI_NIDENT]; uint16_t e_type; uint16_t e_machine; uint32_t e_version; ElfN_Addr e_entry; ElfN_Off e_phoff; ElfN_Off e_shoff; uint32_t e_flags; uint16_t e_ehsize; uint16_t e_phentsize; uint16_t e_phnum; uint16_t e_shentsize; uint16_t e_shnum; uint16_t e_shstrndx; } ElfN_Ehdr; : e_ident , , . , EI_, , ELF. : EI_MAG0 (magic) . ELFMAG0. (0: 0x7f) EI_MAG1 The second byte of the magic number. It must be filled with ELFMAG1. (1: 'E') EI_MAG2 The third byte of the magic number. It must be filled with ELFMAG2. (2: 'L') EI_MAG3 The fourth byte of the magic number. It must be filled with ELFMAG3. (3: 'F') EI_CLASS : ELFCLASSNONE . ELFCLASS32 32- . 4 . ELFCLASS64 64- . EI_DATA , . : ELFDATANONE . ELFDATA2LSB (little-endian) . ELFDATA2MSB (big-endian) . EI_VERSION ELF: EV_NONE . EV_CURRENT . EI_OSABI (ABI), . ELF , ; . : ELFOSABI_NONE ELFOSABI_SYSV. ELFOSABI_SYSV UNIX System V ABI ELFOSABI_HPUX HP-UX ABI ELFOSABI_NETBSD NetBSD ABI ELFOSABI_LINUX Linux ABI ELFOSABI_SOLARIS Solaris ABI ELFOSABI_IRIX IRIX ABI ELFOSABI_FREEBSD FreeBSD ABI ELFOSABI_TRU64 TRU64 UNIX ABI ELFOSABI_ARM ABI ARM ELFOSABI_STANDALONE () ABI EI_ABIVERSION ABI, . ABI. ABI, EI_OSABI. , , 0. EI_PAD . . , , . EI_PAD , . EI_NIDENT e_ident. e_type : ET_NONE . ET_REL . ET_EXEC . ET_DYN . ET_CORE core. e_machine . : EM_NONE EM_M32 AT&T WE 32100 EM_SPARC Sun Microsystems SPARC EM_386 Intel 80386 EM_68K Motorola 68000 EM_88K Motorola 88000 EM_860 Intel 80860 EM_MIPS MIPS RS3000 ( ) EM_PARISC HP/PA EM_SPARC32PLUS SPARC EM_PPC PowerPC EM_PPC64 PowerPC, 64- EM_S390 IBM S/390. EM_ARM Advanced RISC Machines. EM_SH Renesas SuperH. EM_SPARCV9 SPARC v9, 64- EM_IA_64 Intel Itanium. EM_X86_64 AMD x86-64. EM_VAX DEC Vax e_version : EV_NONE EV_CURRENT e_entry , . , 0. e_phoff . , 0. e_shoff . , 0. e_flags , . : EF__. . e_ehsize ELF . e_phentsize ; . e_phnum . , e_phentsize e_phnum . , e_phnum 0. PN_XNUM (0xffff), PN_XNUM (0xffff) sh_info . sh_info . PN_XNUM 0xffff, , e_phnum, , . e_shentsize ; . e_shnum . , e_shentsize e_shnum . , e_shnum 0. SHN_LORESERVE (0xff00), e_shnum sh_size . sh_size . e_shstrndx , . , SHN_UNDEF. SHN_LORESERVE (0xff00), SHN_XINDEX (0xffff) sh_link . sh_link . (Phdr) , , . . . ELF e_phentsize e_phnum. ELF Elf32_Phdr Elf64_Phdr, : typedef struct { uint32_t p_type; Elf32_Off p_offset; Elf32_Addr p_vaddr; Elf32_Addr p_paddr; uint32_t p_filesz; uint32_t p_memsz; uint32_t p_flags; uint32_t p_align; } Elf32_Phdr; typedef struct { uint32_t p_type; uint32_t p_flags; Elf64_Off p_offset; Elf64_Addr p_vaddr; Elf64_Addr p_paddr; uint64_t p_filesz; uint64_t p_memsz; uint64_t p_align; } Elf64_Phdr; 32- 64- p_flags. p_type , . PT_NULL . . PT_LOAD , p_filesz p_memsz. . p_memsz p_filesz, "" , 0, . . , p_vaddr. PT_DYNAMIC . PT_INTERP ( null) . ( ). , . , . PT_NOTE (ElfN_Nhdr). PT_SHLIB , . , , ABI. PT_PHDR , , , . . , . , . PT_LOPROC PT_HIPROC [PT_LOPROC, PT_HIPROC] ( ) - . PT_GNU_STACK GNU, Linux , p_flags. p_offset , . p_vaddr , . p_paddr , , . BSD . p_filesz . . p_memsz . . p_flags : PF_X . PF_W . PF_R . A text segment commonly has the flags PF_X and PF_R. A data segment commonly has PF_W and PF_R. p_align . p_vaddr p_offset . , . p_align , p_vaddr p_offset p_align. (Shdr) . Elf32_Shdr Elf64_Shdr. e_shoff ELF ( ). e_shnum . e_shentsize . . : SHN_LORESERVE SHN_HIRESERVE. ELF e_phnum, e_shnum and e_shstrndx; , . : SHN_UNDEF , , , . SHN_LORESERVE . SHN_LOPROC SHN_HIPROC , [PT_LOPROC, PT_HIPROC] () - . SHN_ABS . , , SHN_ABS, . SHN_COMMON , , , Fortran COMMON C. SHN_HIRESERVE . SHN_LORESERVE SHN_HIRESERVE . . : typedef struct { uint32_t sh_name; uint32_t sh_type; uint32_t sh_flags; Elf32_Addr sh_addr; Elf32_Off sh_offset; uint32_t sh_size; uint32_t sh_link; uint32_t sh_info; uint32_t sh_addralign; uint32_t sh_entsize; } Elf32_Shdr; typedef struct { uint32_t sh_name; uint32_t sh_type; uint64_t sh_flags; Elf64_Addr sh_addr; Elf64_Off sh_offset; uint64_t sh_size; uint32_t sh_link; uint32_t sh_info; uint64_t sh_addralign; uint64_t sh_entsize; } Elf64_Shdr; 32- 64- . sh_name . , , null. sh_type , . SHT_NULL . . . SHT_PROGBITS , ; . SHT_SYMTAB This section holds a symbol table. Typically, SHT_SYMTAB provides symbols for link editing, though it may also be used for dynamic linking. As a complete symbol table, it may contain many symbols unnecessary for dynamic linking. An object file can also contain a SHT_DYNSYM section. The index of the associated string table section can be found in the sh_link member. SHT_STRTAB . . SHT_RELA , Elf32_Rela 32- . . SHT_HASH - . , , - . -. SHT_DYNAMIC . . SHT_NOTE (ElfN_Nhdr). SHT_NOBITS , SHT_PROGBITS. , , sh_offset . SHT_REL , Elf32_Rela 32- . . SHT_SHLIB , . SHT_DYNSYM . SHT_SYMTAB. SHT_LOPROC SHT_HIPROC SHT_LOPROC, SHT_HIPROC] () - . SHT_LOUSER , . SHT_HIUSER , . , SHT_LOUSER SHT_HIUSER, , . sh_flags , . sh_flags, "" . "" . . SHF_WRITE , . SHF_ALLOC . . . SHF_EXECINSTR . SHF_MASKPROC - . sh_addr , , . . sh_offset . SHT_NOBITS sh_offset . sh_size . SHT_NOBITS, sh_size . SHT_NOBITS , . sh_link - , . sh_info , . sh_addralign . , . , sh_addr , sh_addralign . . 0 1 , . sh_entsize , , . . , . : .bss , . , . SHT_NOBITS SHF_ALLOC SHF_WRITE. .comment . SHT_PROGBITS . .ctors - C++. SHT_PROGBITS SHF_ALLOC SHF_WRITE. .data , . SHT_PROGBITS SHF_ALLOC SHF_WRITE. .data1 , . SHT_PROGBITS SHF_ALLOC SHF_WRITE. .debug . . SHT_PROGBITS . .dtors - C++. SHT_PROGBITS SHF_ALLOC SHF_WRITE. .dynamic . SHF_ALLOC. SHF_WRITE. SHT_DYNAMIC. .dynstr , ; , , . SHT_STRTAB SHF_ALLOC. .dynsym . SHT_DYNSYM SHF_ALLOC. .fini , . . SHT_PROGBITS SHF_ALLOC SHF_EXECINSTR. .gnu.version , ElfN_Half. SHT_GNU_versym SHF_ALLOC. .gnu.version_d , ElfN_Verdef. SHT_GNU_verdef SHF_ALLOC. .gnu.version_r , ElfN_Verneed. SHT_GNU_versym SHF_ALLOC. .got . SHT_PROGBITS. . .hash - . SHT_HASH SHF_ALLOC. .init , . , . SHT_PROGBITS SHF_ALLOC SHF_EXECINSTR. .interp . , , SHF_ALLOC. . SHT_PROGBITS. .line , . . SHT_PROGBITS . .note . SHT_NOTE. . .note.ABI-tag ELF (run-time) ABI. . SHT_NOTE. SHF_ALLOC. .note.gnu.build-id This section is used to hold an ID that uniquely identifies the contents of the ELF image. Different files with the same build ID should contain the same executable content. See the --build-id option to the GNU linker (ld(1)) for more details. This section is of type SHT_NOTE. The only attribute used is SHF_ALLOC. .note.GNU-stack Linux . SHT_PROGBITS SHF_EXECINSTR. GNU . .note.openbsd.ident , OpenBSD , ELF . .plt . SHT_PROGBITS. . .rel , . , , SHF_ALLOC. . , <<>> , . .text .rel.text. SHT_REL. .relaNAME , . , , SHF_ALLOC. . , <<>> , . .text .rela.text. SHT_RELA. .rodata , , . SHT_PROGBITS SHF_ALLOC. .rodata1 , , . SHT_PROGBITS SHF_ALLOC. .shstrtab . SHT_STRTAB . .strtab , , . , , SHF_ALLOC. . SHT_STRTAB. .symtab . , , SHF_ALLOC. . SHT_SYMTAB. .text " (text)", . SHT_PROGBITS SHF_ALLOC SHF_EXECINSTR. String table sections hold null-terminated character sequences, commonly called strings. The object file uses these strings to represent symbol and section names. One references a string as an index into the string table section. The first byte, which is index zero, is defined to hold a null byte ('\0'). Similarly, a string table's last byte is defined to hold a null byte, ensuring null termination for all strings. , . . typedef struct { uint32_t st_name; Elf32_Addr st_value; uint32_t st_size; unsigned char st_info; unsigned char st_other; uint16_t st_shndx; } Elf32_Sym; typedef struct { uint32_t st_name; unsigned char st_info; unsigned char st_other; uint16_t st_shndx; Elf64_Addr st_value; uint64_t st_size; } Elf64_Sym; 32- 64- , . st_name , . , , . . st_value . st_size . , . st_info : STT_NOTYPE . STT_OBJECT . STT_FUNC . STT_SECTION . , , STB_LOCAL. STT_FILE , . STB_LOCAL, SHN_ABS, STB_LOCAL , . STT_LOPROC STT_HIPROC [STT_LOPROC, STT_HIPROC] () - . STB_LOCAL , . . STB_GLOBAL . . STB_WEAK (weak symbols) , . STB_LOPROC STB_HIPROC [STB_LOPROC, STB_HIPROC] () - . : ELF32_ST_BIND(info) ELF64_ST_BIND(info) st_info. ELF32_ST_TYPE(info) ELF64_ST_TYPE(info) st_info. ELF32_ST_INFO(bind, type) ELF64_ST_INFO(bind, type) st_info. st_other . STV_DEFAULT . ; . STV_INTERNAL , . STV_HIDDEN ; ( , ). STV_PROTECTED , . : ELF32_ST_VISIBILITY(other) ELF64_ST_VISIBILITY(other) st_shndx <<>> . . (Rel & Rela) -- . , , . . , : typedef struct { Elf32_Addr r_offset; uint32_t r_info; } Elf32_Rel; typedef struct { Elf64_Addr r_offset; uint64_t r_info; } Elf64_Rel; , : typedef struct { Elf32_Addr r_offset; uint32_t r_info; int32_t r_addend; } Elf32_Rela; typedef struct { Elf64_Addr r_offset; uint64_t r_info; int64_t r_addend; } Elf64_Rela; r_offset , . , , , . , . r_info , . . , ELF[32|64]_R_TYPE ELF[32|64]_R_SYM, , r_info. r_addend -, , . (Dyn) .dynamic , . d_tag d_un. typedef struct { Elf32_Sword d_tag; union { Elf32_Word d_val; Elf32_Addr d_ptr; } d_un; } Elf32_Dyn; extern Elf32_Dyn _DYNAMIC[]; typedef struct { Elf64_Sxword d_tag; union { Elf64_Xword d_val; Elf64_Addr d_ptr; } d_un; } Elf64_Dyn; extern Elf64_Dyn _DYNAMIC[]; d_tag : DT_NULL DT_NEEDED DT_PLTRELSZ PLT DT_PLTGOT PLT / GOT DT_HASH - DT_STRTAB DT_SYMTAB DT_RELA Rela DT_RELASZ Rela DT_RELAENT Rela DT_STRSZ DT_SYMENT DT_INIT DT_FINI DT_SONAME DT_RPATH String table offset to search path for direct and indirect library dependencies DT_SYMBOLIC , DT_REL Rel DT_RELSZ Rel DT_RELENT Rel DT_PLTREL , PLT (Rela Rel) DT_DEBUG , DT_TEXTREL , , DT_JMPREL , PLT DT_BIND_NOW , DT_RUNPATH String table offset to search path for direct library dependencies DT_LOPROC DT_HIPROC [DT_LOPROC, DT_HIPROC] () - d_val (integer) . d_ptr . , . . _DYNAMIC , .dynamic. . (Nhdr) ELF . , core (e_type ET_CORE), . , GNU ELF C. Note sections contain a series of notes (see the struct definitions below). Each note is followed by the name field (whose length is defined in n_namesz) and then by the descriptor field (whose length is defined in n_descsz) and whose starting address has a 4 byte alignment. Neither field is defined in the note struct due to their arbitrary lengths. : void *memory, *name, *desc; Elf64_Nhdr *note, *next_note; /* The buffer is pointing to the start of the section/segment. */ note = memory; /* If the name is defined, it follows the note. */ name = note->n_namesz == 0 ? NULL : memory + sizeof(*note); /* If the descriptor is defined, it follows the name (with alignment). */ desc = note->n_descsz == 0 ? NULL : memory + sizeof(*note) + ALIGN_UP(note->n_namesz, 4); /* The next note follows both (with alignment). */ next_note = memory + sizeof(*note) + ALIGN_UP(note->n_namesz, 4) + ALIGN_UP(note->n_descsz, 4); , n_type , n_namesz field. n_namesz (, 0), : core files ELF. , , , . typedef struct { Elf32_Word n_namesz; Elf32_Word n_descsz; Elf32_Word n_type; } Elf32_Nhdr; typedef struct { Elf64_Word n_namesz; Elf64_Word n_descsz; Elf64_Word n_type; } Elf64_Nhdr; n_namesz . . null. , <>, n_namesz 4. n_descsz . . n_type , : core (e_type = ET_CORE) core. , C . (. ., n_namesz 0) . NT_PRSTATUS prstatus NT_FPREGSET fpregset NT_PRPSINFO prpsinfo NT_PRXREG prxregset NT_TASKSTRUCT NT_PLATFORM sysinfo(SI_PLATFORM) NT_AUXV auxv NT_GWINDOWS gwindows NT_ASRS asrset NT_PSTATUS pstatus NT_PSINFO psinfo NT_PRCRED prcred NT_UTSNAME utsname NT_LWPSTATUS lwpstatus NT_LWPSINFO lwpinfo NT_PRFPXREG fprxregset NT_SIGINFO siginfo_t ( , ) NT_FILE NT_PRXFPREG user_fxsr_struct NT_PPC_VMX PowerPC Altivec/VMX NT_PPC_SPE PowerPC SPE/EVR NT_PPC_VSX PowerPC VSX NT_386_TLS TLS i386 (struct user_desc) NT_386_IOPERM - x86 (1=) NT_X86_XSTATE x86, xsave NT_S390_HIGH_GPRS s390 NT_S390_TIMER s390 NT_S390_TODCMP time-of-day (TOD) s390 NT_S390_TODPREG time-of-day (TOD) s390 NT_S390_CTRS s390 NT_S390_PREFIX s390 NT_S390_LAST_BREAK s390 NT_S390_SYSTEM_CALL s390 NT_S390_TDB s390 NT_ARM_VFP VFP/NEON ARM NT_ARM_TLS TLS ARM NT_ARM_HW_BREAK ARM NT_ARM_HW_WATCH ARM NT_ARM_SYSTEM_CALL ARM n_name = GNU , GNU. NT_GNU_ABI_TAG ABI (OS). 4 : [0] OS descriptor (ELF_NOTE_OS_LINUX, ELF_NOTE_OS_GNU, and so on) [1] major version of the ABI [2] minor version of the ABI [3] subminor version of the ABI NT_GNU_HWCAP hwcap. 2 : [0] number of entries [1] bit mask of enabled entries hwcap, null. , , (1U << ) & . NT_GNU_BUILD_ID , GNU ld(1), --build-id. . NT_GNU_GOLD_VERSION GNU Gold. / (e_type != ET_CORE) (. ., n_namesz 0) . NT_VERSION NT_ARCH ELF System V. ELF . e_phnum, e_shnum e_shstrndx Linux. Sun, BSD AMD64; " ". as(1), elfedit(1), gdb(1), ld(1), nm(1), objcopy(1), objdump(1), patchelf(1), readelf(1), size(1), strings(1), strip(1), execve(2), dl_iterate_phdr(3), core(5), ld.so(8) Hewlett-Packard, Elf-64. Santa Cruz Operation, System V. UNIX System Laboratories, << >>, (ELF). Sun Microsystems, (Linker and Libraries Guide). ABI AMD64, System V AMD64 (System V Application Binary Interface AMD64 Architecture Processor Supplement). () Azamat Hackimov , Yuri Kozlov , Kirill Rekhov ; GNU (GNU General Public License - GPL, 3 ) , - . - , , () () () <>. Linux 6.15 28 2025 . ELF(5)