ELF(5) File Formats Manual ELF(5) elf - (ELF) #include ELF . , , core- . ELF ELF, ( ). ELF . ELF. . C, , . N- (N=32,64; ElfN Elf32 Elf64; uintN_t uint32_t uint64_t): ElfN_Addr , uintN_t ElfN_Off , uintN_t ElfN_Section , uint16_t ElfN_Versym , uint16_t Elf_Byte unsigned char ElfN_Half uint16_t ElfN_Sword int32_t ElfN_Word uint32_t ElfN_Sxword int64_t ElfN_Xword uint64_t (: *BSD . , Elf64_Half -- Elf32_Half, Elf64Quarter -- uint16_t. , .) <<>> . , (padding) 4- 4- , 4- . . ELF (Ehdr) ELF Elf32_Ehdr Elf64_Ehdr: #define EI_NIDENT 16 typedef struct { unsigned char e_ident[EI_NIDENT]; uint16_t e_type; uint16_t e_machine; uint32_t e_version; ElfN_Addr e_entry; ElfN_Off e_phoff; ElfN_Off e_shoff; uint32_t e_flags; uint16_t e_ehsize; uint16_t e_phentsize; uint16_t e_phnum; uint16_t e_shentsize; uint16_t e_shnum; uint16_t e_shstrndx; } ElfN_Ehdr; : e_ident , , . , EI_, , ELF. : EI_MAG0 (magic) . ELFMAG0. (0: 0x7f) EI_MAG1 The second byte of the magic number. It must be filled with ELFMAG1. (1: 'E') EI_MAG2 The third byte of the magic number. It must be filled with ELFMAG2. (2: 'L') EI_MAG3 The fourth byte of the magic number. It must be filled with ELFMAG3. (3: 'F') EI_CLASS : ELFCLASSNONE . ELFCLASS32 32- . 4 . ELFCLASS64 64- . EI_DATA , . : ELFDATANONE . ELFDATA2LSB (little-endian) . ELFDATA2MSB (big-endian) . EI_VERSION ELF: EV_NONE . EV_CURRENT . EI_OSABI (ABI), . ELF , ; . : ELFOSABI_NONE ELFOSABI_SYSV. ELFOSABI_SYSV UNIX System V ABI ELFOSABI_HPUX HP-UX ABI ELFOSABI_NETBSD NetBSD ABI ELFOSABI_LINUX Linux ABI ELFOSABI_SOLARIS Solaris ABI ELFOSABI_IRIX IRIX ABI ELFOSABI_FREEBSD FreeBSD ABI ELFOSABI_TRU64 TRU64 UNIX ABI ELFOSABI_ARM ABI ARM ELFOSABI_STANDALONE () ABI EI_ABIVERSION ABI, . ABI. ABI, EI_OSABI. , , 0. EI_PAD . . , , . EI_PAD , . EI_NIDENT e_ident. e_type : ET_NONE . ET_REL . ET_EXEC . ET_DYN . ET_CORE core. e_machine . : EM_NONE EM_M32 AT&T WE 32100 EM_SPARC Sun Microsystems SPARC EM_386 Intel 80386 EM_68K Motorola 68000 EM_88K Motorola 88000 EM_860 Intel 80860 EM_MIPS MIPS RS3000 ( ) EM_PARISC HP/PA EM_SPARC32PLUS SPARC EM_PPC PowerPC EM_PPC64 PowerPC, 64- EM_S390 IBM S/390. EM_ARM Advanced RISC Machines. EM_SH Renesas SuperH. EM_SPARCV9 SPARC v9, 64- EM_IA_64 Intel Itanium. EM_X86_64 AMD x86-64. EM_VAX DEC Vax e_version : EV_NONE EV_CURRENT e_entry , . , 0. e_phoff . , 0. e_shoff . , 0. e_flags , . : EF__. . e_ehsize ELF . e_phentsize ; . e_phnum . , e_phentsize e_phnum . , e_phnum 0. PN_XNUM (0xffff), PN_XNUM (0xffff) sh_info . sh_info . PN_XNUM 0xffff, , e_phnum, , . e_shentsize ; . e_shnum . , e_shentsize e_shnum . , e_shnum 0. SHN_LORESERVE (0xff00), e_shnum sh_size . sh_size . e_shstrndx , . , SHN_UNDEF. SHN_LORESERVE (0xff00), SHN_XINDEX (0xffff) sh_link . sh_link . (Phdr) , , . . . ELF e_phentsize e_phnum. ELF Elf32_Phdr Elf64_Phdr, : typedef struct { uint32_t p_type; Elf32_Off p_offset; Elf32_Addr p_vaddr; Elf32_Addr p_paddr; uint32_t p_filesz; uint32_t p_memsz; uint32_t p_flags; uint32_t p_align; } Elf32_Phdr; typedef struct { uint32_t p_type; uint32_t p_flags; Elf64_Off p_offset; Elf64_Addr p_vaddr; Elf64_Addr p_paddr; uint64_t p_filesz; uint64_t p_memsz; uint64_t p_align; } Elf64_Phdr; 32- 64- p_flags. p_type , . PT_NULL . . PT_LOAD , p_filesz p_memsz. . p_memsz p_filesz, "" , 0, . . , p_vaddr. PT_DYNAMIC . PT_INTERP ( null) . ( ). , . , . PT_NOTE (ElfN_Nhdr). PT_SHLIB , . , , ABI. PT_PHDR , , , . . , . , . PT_LOPROC PT_HIPROC [PT_LOPROC, PT_HIPROC] ( ) - . PT_GNU_STACK GNU, Linux , p_flags. p_offset , . p_vaddr , . p_paddr , , . BSD . p_filesz . . p_memsz . . p_flags : PF_X . PF_W . PF_R . (text segment) PF_X PF_R. PF_W PF_R. p_align . p_vaddr p_offset . , . p_align , p_vaddr p_offset p_align. (Shdr) . Elf32_Shdr Elf64_Shdr. e_shoff ELF ( ). e_shnum . e_shentsize . . : SHN_LORESERVE SHN_HIRESERVE. ELF e_phnum, e_shnum and e_shstrndx; , . : SHN_UNDEF , , , . SHN_LORESERVE . SHN_LOPROC SHN_HIPROC , [PT_LOPROC, PT_HIPROC] () - . SHN_ABS . , , SHN_ABS, . SHN_COMMON , , , Fortran COMMON C. SHN_HIRESERVE . SHN_LORESERVE SHN_HIRESERVE . . : typedef struct { uint32_t sh_name; uint32_t sh_type; uint32_t sh_flags; Elf32_Addr sh_addr; Elf32_Off sh_offset; uint32_t sh_size; uint32_t sh_link; uint32_t sh_info; uint32_t sh_addralign; uint32_t sh_entsize; } Elf32_Shdr; typedef struct { uint32_t sh_name; uint32_t sh_type; uint64_t sh_flags; Elf64_Addr sh_addr; Elf64_Off sh_offset; uint64_t sh_size; uint32_t sh_link; uint32_t sh_info; uint64_t sh_addralign; uint64_t sh_entsize; } Elf64_Shdr; 32- 64- . sh_name . , , null. sh_type , . SHT_NULL . . . SHT_PROGBITS , ; . SHT_SYMTAB . , SHT_SYMTAB , . , . SHT_DYNSYM. SHT_STRTAB . . SHT_RELA , Elf32_Rela 32- . . SHT_HASH - . , , - . -. SHT_DYNAMIC . . SHT_NOTE (ElfN_Nhdr). SHT_NOBITS , SHT_PROGBITS. , , sh_offset . SHT_REL , Elf32_Rela 32- . . SHT_SHLIB , . SHT_DYNSYM . SHT_SYMTAB. SHT_LOPROC SHT_HIPROC SHT_LOPROC, SHT_HIPROC] () - . SHT_LOUSER , . SHT_HIUSER , . , SHT_LOUSER SHT_HIUSER, , . sh_flags , . sh_flags, "" . "" . . SHF_WRITE , . SHF_ALLOC . . . SHF_EXECINSTR . SHF_MASKPROC - . sh_addr , , . . sh_offset . SHT_NOBITS sh_offset . sh_size . SHT_NOBITS, sh_size . SHT_NOBITS , . sh_link - , . sh_info , . sh_addralign . , . , sh_addr , sh_addralign . . 0 1 , . sh_entsize , , . . , . : .bss , . , . SHT_NOBITS SHF_ALLOC SHF_WRITE. .comment . SHT_PROGBITS . .ctors - C++. SHT_PROGBITS SHF_ALLOC SHF_WRITE. .data , . SHT_PROGBITS SHF_ALLOC SHF_WRITE. .data1 , . SHT_PROGBITS SHF_ALLOC SHF_WRITE. .debug . . SHT_PROGBITS . .dtors - C++. SHT_PROGBITS SHF_ALLOC SHF_WRITE. .dynamic . SHF_ALLOC. SHF_WRITE. SHT_DYNAMIC. .dynstr , ; , , . SHT_STRTAB SHF_ALLOC. .dynsym . SHT_DYNSYM SHF_ALLOC. .fini , . . SHT_PROGBITS SHF_ALLOC SHF_EXECINSTR. .gnu.version , ElfN_Half. SHT_GNU_versym SHF_ALLOC. .gnu.version_d , ElfN_Verdef. SHT_GNU_verdef SHF_ALLOC. .gnu.version_r , ElfN_Verneed. SHT_GNU_versym SHF_ALLOC. .got . SHT_PROGBITS. . .hash - . SHT_HASH SHF_ALLOC. .init , . , . SHT_PROGBITS SHF_ALLOC SHF_EXECINSTR. .interp . , , SHF_ALLOC. . SHT_PROGBITS. .line , . . SHT_PROGBITS . .note . SHT_NOTE. . .note.ABI-tag ELF (run-time) ABI. . SHT_NOTE. SHF_ALLOC. .note.gnu.build-id ID, ELF. ID . --build-id GNU (ld (1)). SHT_NOTE. SHF_ALLOC. .note.GNU-stack Linux . SHT_PROGBITS SHF_EXECINSTR. GNU . .note.openbsd.ident , OpenBSD , ELF . .plt . SHT_PROGBITS. . .rel , . , , SHF_ALLOC. . , <<>> , . .text .rel.text. SHT_REL. .relaNAME , . , , SHF_ALLOC. . , <<>> , . .text .rela.text. SHT_RELA. .rodata , , . SHT_PROGBITS SHF_ALLOC. .rodata1 , , . SHT_PROGBITS SHF_ALLOC. .shstrtab . SHT_STRTAB . .strtab , , . , , SHF_ALLOC. . SHT_STRTAB. .symtab . , , SHF_ALLOC. . SHT_SYMTAB. .text " (text)", . SHT_PROGBITS SHF_ALLOC SHF_EXECINSTR. String table sections hold null-terminated character sequences, commonly called strings. The object file uses these strings to represent symbol and section names. One references a string as an index into the string table section. The first byte, which is index zero, is defined to hold a null byte ('\0'). Similarly, a string table's last byte is defined to hold a null byte, ensuring null termination for all strings. , . . typedef struct { uint32_t st_name; Elf32_Addr st_value; uint32_t st_size; unsigned char st_info; unsigned char st_other; uint16_t st_shndx; } Elf32_Sym; typedef struct { uint32_t st_name; unsigned char st_info; unsigned char st_other; uint16_t st_shndx; Elf64_Addr st_value; uint64_t st_size; } Elf64_Sym; 32- 64- , . st_name , . , , . . st_value . st_size . , . st_info : STT_NOTYPE . STT_OBJECT . STT_FUNC . STT_SECTION . , , STB_LOCAL. STT_FILE , . STB_LOCAL, SHN_ABS, STB_LOCAL , . STT_LOPROC STT_HIPROC [STT_LOPROC, STT_HIPROC] () - . STB_LOCAL , . . STB_GLOBAL . . STB_WEAK (weak symbols) , . STB_LOPROC STB_HIPROC [STB_LOPROC, STB_HIPROC] () - . : ELF32_ST_BIND(info) ELF64_ST_BIND(info) st_info. ELF32_ST_TYPE(info) ELF64_ST_TYPE(info) st_info. ELF32_ST_INFO(bind, type) ELF64_ST_INFO(bind, type) st_info. st_other . STV_DEFAULT . ; . STV_INTERNAL , . STV_HIDDEN ; ( , ). STV_PROTECTED , . : ELF32_ST_VISIBILITY(other) ELF64_ST_VISIBILITY(other) st_shndx <<>> . . (Rel & Rela) -- . , , . . , : typedef struct { Elf32_Addr r_offset; uint32_t r_info; } Elf32_Rel; typedef struct { Elf64_Addr r_offset; uint64_t r_info; } Elf64_Rel; , : typedef struct { Elf32_Addr r_offset; uint32_t r_info; int32_t r_addend; } Elf32_Rela; typedef struct { Elf64_Addr r_offset; uint64_t r_info; int64_t r_addend; } Elf64_Rela; r_offset , . , , , . , . r_info , . . , ELF[32|64]_R_TYPE ELF[32|64]_R_SYM, , r_info. r_addend -, , . (Dyn) .dynamic , . d_tag d_un. typedef struct { Elf32_Sword d_tag; union { Elf32_Word d_val; Elf32_Addr d_ptr; } d_un; } Elf32_Dyn; extern Elf32_Dyn _DYNAMIC[]; typedef struct { Elf64_Sxword d_tag; union { Elf64_Xword d_val; Elf64_Addr d_ptr; } d_un; } Elf64_Dyn; extern Elf64_Dyn _DYNAMIC[]; d_tag : DT_NULL DT_NEEDED DT_PLTRELSZ PLT DT_PLTGOT PLT / GOT DT_HASH - DT_STRTAB DT_SYMTAB DT_RELA Rela DT_RELASZ Rela DT_RELAENT Rela DT_STRSZ DT_SYMENT DT_INIT DT_FINI DT_SONAME DT_RPATH () DT_SYMBOLIC , DT_REL Rel DT_RELSZ Rel DT_RELENT Rel DT_PLTREL , PLT (Rela Rel) DT_DEBUG , DT_TEXTREL , , DT_JMPREL , PLT DT_BIND_NOW , DT_RUNPATH DT_LOPROC DT_HIPROC [DT_LOPROC, DT_HIPROC] () - d_val (integer) . d_ptr . , . . _DYNAMIC , .dynamic. . (Nhdr) ELF . , core (e_type ET_CORE), . , GNU ELF C. ( struct ). ( n_namesz) ( n_descsz) , 4 . - . : void *memory, *name, *desc; Elf64_Nhdr *note, *next_note; /* The buffer is pointing to the start of the section/segment. */ note = memory; /* If the name is defined, it follows the note. */ name = note->n_namesz == 0 ? NULL : memory + sizeof(*note); /* If the descriptor is defined, it follows the name (with alignment). */ desc = note->n_descsz == 0 ? NULL : memory + sizeof(*note) + ALIGN_UP(note->n_namesz, 4); /* The next note follows both (with alignment). */ next_note = memory + sizeof(*note) + ALIGN_UP(note->n_namesz, 4) + ALIGN_UP(note->n_descsz, 4); , n_type , n_namesz field. n_namesz (, 0), : core files ELF. , , , . typedef struct { Elf32_Word n_namesz; Elf32_Word n_descsz; Elf32_Word n_type; } Elf32_Nhdr; typedef struct { Elf64_Word n_namesz; Elf64_Word n_descsz; Elf64_Word n_type; } Elf64_Nhdr; n_namesz . . null. , <>, n_namesz 4. n_descsz . . n_type , : core (e_type = ET_CORE) core. , C . (. ., n_namesz 0) . NT_PRSTATUS prstatus NT_FPREGSET fpregset NT_PRPSINFO prpsinfo NT_PRXREG prxregset NT_TASKSTRUCT NT_PLATFORM sysinfo(SI_PLATFORM) NT_AUXV auxv NT_GWINDOWS gwindows NT_ASRS asrset NT_PSTATUS pstatus NT_PSINFO psinfo NT_PRCRED prcred NT_UTSNAME utsname NT_LWPSTATUS lwpstatus NT_LWPSINFO lwpinfo NT_PRFPXREG fprxregset NT_SIGINFO siginfo_t ( , ) NT_FILE NT_PRXFPREG user_fxsr_struct NT_PPC_VMX PowerPC Altivec/VMX NT_PPC_SPE PowerPC SPE/EVR NT_PPC_VSX PowerPC VSX NT_386_TLS TLS i386 (struct user_desc) NT_386_IOPERM - x86 (1=) NT_X86_XSTATE x86, xsave NT_S390_HIGH_GPRS s390 NT_S390_TIMER s390 NT_S390_TODCMP time-of-day (TOD) s390 NT_S390_TODPREG time-of-day (TOD) s390 NT_S390_CTRS s390 NT_S390_PREFIX s390 NT_S390_LAST_BREAK s390 NT_S390_SYSTEM_CALL s390 NT_S390_TDB s390 NT_ARM_VFP VFP/NEON ARM NT_ARM_TLS TLS ARM NT_ARM_HW_BREAK ARM NT_ARM_HW_WATCH ARM NT_ARM_SYSTEM_CALL ARM n_name = GNU , GNU. NT_GNU_ABI_TAG ABI (OS). 4 : [0] OS descriptor (ELF_NOTE_OS_LINUX, ELF_NOTE_OS_GNU, and so on)` [1] major version of the ABI [2] minor version of the ABI [3] subminor version of the ABI NT_GNU_HWCAP hwcap. 2 : [0] number of entries [1] bit mask of enabled entries hwcap, null. , , (1U << ) & . NT_GNU_BUILD_ID , GNU ld(1), --build-id. . NT_GNU_GOLD_VERSION GNU Gold. / (e_type != ET_CORE) (. ., n_namesz 0) . NT_VERSION NT_ARCH ELF System V. ELF . e_phnum, e_shnum e_shstrndx Linux. Sun, BSD AMD64; " ". . as(1), elfedit(1), gdb(1), ld(1), nm(1), objcopy(1), objdump(1), patchelf(1), readelf(1), size(1), strings(1), strip(1), execve(2), dl_iterate_phdr(3), core(5), ld.so(8) Hewlett-Packard, Elf-64. Santa Cruz Operation, System V. UNIX System Laboratories, << >>, (ELF). Sun Microsystems, (Linker and Libraries Guide). ABI AMD64, System V AMD64 (System V Application Binary Interface AMD64 Architecture Processor Supplement). Azamat Hackimov , Yuri Kozlov ; GNU 3 , . . , , . Linux man-pages 6.06 31 2023 . ELF(5)