Skip site navigation (1)Skip section navigation (2)

FreeBSD Man Pages

Man Page or Keyword Search:
Man Architecture
Apropos Keyword Search (all sections) Output format
home | help
ELF(3)		       FreeBSD Library Functions Manual			ELF(3)

     elf -- API	for manipulating ELF objects

     ELF Parsing Library (libelf, -lelf)

     #include <libelf.h>

     The ELF Parsing Library (libelf, -lelf) provides functions	that allow an
     application to read and manipulate	ELF object files, and to read ar(1)
     archives.	The library allows the manipulation of ELF objects in a	byte
     ordering and word-size independent	way, allowing an application to	read
     and create	ELF objects for	32 and 64 bit architectures and	for little-
     and big-endian machines.  The library is capable of processing ELF
     objects that use extended section numbering.

     This manual page serves to	provide	an overview of the functionality in
     the ELF library.  Further information may found in	the manual pages for
     individual	ELF(3) functions that comprise the library.

   ELF Concepts
     As	described in elf(5), ELF files contain several data structures that
     are laid out in a specific	way.  ELF files	begin with an ``Executable
     Header'', and may contain an optional ``Program Header Table'', and
     optional data in the form of ELF ``sections''.  A ``Section Header
     Table'' describes the content of the data in these	sections.

     ELF objects have an associated ``ELF class'' which	denotes	the natural
     machine word size for the architecture the	object is associated with.
     Objects for 32 bit	architectures have an ELF class	of ELFCLASS32.
     Objects for 64 bit	architectures have an ELF class	of ELFCLASS64.

     ELF objects also have an associated ``endianness''	which denotes the
     endianness	of the machine architecture associated with the	object.	 This
     may be ELFDATA2LSB	for little-endian architectures	and ELFDATA2MSB	for
     big-endian	architectures.

     ELF objects are also associated with an API version number.  This version
     number determines the layout of the individual components of an ELF file
     and the semantics associated with these.

   Data	Representation And Translation
     The ELF(3)	library	distinguishes between ``native'' representations of
     ELF data structures and their ``file'' representations.

     An	application would work with ELF	data in	its ``native'' representation,
     i.e., using the native byteorder and alignment mandated by	the processor
     the application is	running	on.  The ``file'' representation of the	same
     data could	use a different	byte ordering and follow different constraints
     on	object alignment than these native constraints.

     Accordingly, the ELF(3) library offers translation	facilities
     (elf32_xlatetof(3), elf32_xlatetom(3), elf64_xlatetof(3) and
     elf64_xlatetom(3))	to and from these representations and also provides
     higher-level APIs that retrieve and store data from the ELF object	in a
     transparent manner.

   Library Working Version
     Conceptually, there are three version numbers associated with an applica-
     tion using	the ELF	library	to manipulate ELF objects:
	   +o   The ELF version that the	application was	compiled against.
	       This version determines the ABI expected	by the application.
	   +o   The ELF version of the ELF object being manipulated by the
	       application through the ELF library.
	   +o   The ELF version (or set of versions) supported by the ELF
	       library itself.

     In	order to facilitate working with ELF objects of	differing versions,
     the ELF library requires the application to call the elf_version()	func-
     tion before invoking many of its operations, in order to inform the
     library of	the application's desired working version.

     In	the current implementation, all	three versions have to be EV_CURRENT.

   Namespace use
     The ELF library uses the following	prefixes:

     elf_     Used for class-independent functions.

     elf32_   Used for functions working with 32 bit ELF objects.

     elf64_   Used for functions working with 64 bit ELF objects.

     Elf_     Used for class-independent data types.

     ELF_C_   Used for command values used in a	few functions.	These symbols
	      are defined as members of	the Elf_Cmd enumeration.

     ELF_E_   Used for error numbers.

     ELF_F_   Used for flags.

     ELF_K_   These constants define the kind of file associated with an ELF
	      descriptor.  See elf_kind(3).  The symbols are defined by	the
	      Elf_Kind enumeration.

     ELF_T_   These values are defined by the Elf_Type enumeration, and	denote
	      the types	of ELF data structures that can	be present in an ELF

     In	addition, the library uses symbols with	prefixes _ELF and _libelf for
     its internal use.

     Applications communicate with the library using descriptors.  These are:

     Elf       An Elf descriptor represents an ELF object or an	ar(1) archive.
	       It is allocated using one of the	elf_begin() or elf_memory()
	       functions.  An Elf descriptor can be used to read and write
	       data to an ELF file.  An	Elf descriptor can be associated with
	       zero or more Elf_Scn section descriptors.

	       Given an	ELF descriptor,	the application	may retrieve the ELF
	       object's	class-dependent	``Executable Header'' structures using
	       the elf32_getehdr() or elf64_getehdr() functions.  A new	Ehdr
	       structure may be	allocated using	the elf64_newehdr() or
	       elf64_newehdr() functions.

	       The ``Program Header Table'' associated with an ELF descriptor
	       may be allocated	using the elf32_getphdr() or elf64_getphdr()
	       functions.  A new program header	table may be allocated or an
	       existing	table resized using the	elf32_newphdr()	or
	       elf64_newphdr() functions.

	       The Elf structure is opaque and has no members visible to the

     Elf_Data  An Elf_Data data	structure describes an individual chunk	of a
	       ELF file	as represented in memory.  It has the following	appli-
	       cation-visible members:
	       uint64_t	d_align	       The in-file alignment of	the data
				       buffer within its containing ELF	sec-
				       tion.  This value must be non-zero and
				       a power of two.
	       void *d_buf	       A pointer to data in memory.
	       uint64_t	d_off	       The offset within the containing	sec-
				       tion where this descriptor's data would
				       be placed.  This	field will be computed
				       by the library unless the application
				       requests	full control of	the ELF
				       object's	layout.
	       uint64_t	d_size	       The number of bytes of data in this
	       Elf_Type	d_type	       The ELF type (see below)	of the data in
				       this descriptor.
	       unsigned	int d_version  The operating version for the data in
				       this buffer.

	       Elf_Data	descriptors are	usually	associated with	Elf_Scn
	       descriptors.  Existing data descriptors associated with an ELF
	       section may be structures are retrieved using the elf_getdata()
	       and elf_rawdata() functions.  The elf_newdata() function	may be
	       used to attach new data descriptors to an ELF section.

     Elf_Scn   Elf_Scn descriptors represent a section in an ELF object.

	       They are	retrieved using	the elf_getscn() function.  An appli-
	       cation may iterate through the existing sections	of an ELF
	       object using the	elf_nextscn() function.	 New sections may be
	       allocated using the elf_newscn()	function.

	       The Elf_Scn descriptor is opaque	and contains no	application
	       modifiable fields.

   Supported Elf Types
     The following ELF datatypes are supported by the library.

     ELF_T_ADDR	    Machine addresses.
     ELF_T_BYTE	    Byte data.	The library will not attempt to	translate byte
     ELF_T_CAP	    Software and hardware capability records.
     ELF_T_DYN	    Records used in a section of type SHT_DYNAMIC.
     ELF_T_EHDR	    ELF	executable header.
     ELF_T_GNUHASH  GNU-style hash tables.
     ELF_T_HALF	    16-bit unsigned words.
     ELF_T_LWORD    64 bit unsigned words.
     ELF_T_MOVE	    ELF	Move records.
     ELF_T_NOTE	    ELF	Note structures.
     ELF_T_OFF	    File offsets.
     ELF_T_PHDR	    ELF	program	header table entries.
     ELF_T_REL	    ELF	relocation entries.
     ELF_T_RELA	    ELF	relocation entries with	addends.
     ELF_T_SHDR	    ELF	section	header entries.
     ELF_T_SWORD    Signed 32-bit words.
     ELF_T_SXWORD   Signed 64-bit words.
     ELF_T_SYMINFO  ELF	symbol information.
     ELF_T_SYM	    ELF	symbol table entries.
     ELF_T_VDEF	    Symbol version definition records.
     ELF_T_VNEED    Symbol version requirement records.
     ELF_T_WORD	    Unsigned 32-bit words.
     ELF_T_XWORD    Unsigned 64-bit words.

     The symbol	ELF_T_NUM denotes the number of	Elf types known	to the

     The following table shows the mapping between ELF section types defined
     in	elf(5) and the types supported by the library.

     Section Type	  Library Type	   Description
     SHT_DYNAMIC	  ELF_T_DYN	   `.dynamic' section entries.
     SHT_DYNSYM		  ELF_T_SYM	   Symbols for dynamic linking.
     SHT_FINI_ARRAY	  ELF_T_ADDR	   Termination function	pointers.
     SHT_GNU_HASH	  ELF_T_GNUHASH	   GNU hash sections.
     SHT_GNU_LIBLIST	  ELF_T_WORD	   List	of libraries to	be pre-linked.
     SHT_GNU_verdef	  ELF_T_VDEF	   Symbol version definitions.
     SHT_GNU_verneed	  ELF_T_VNEED	   Symbol versioning requirements.
     SHT_GNU_versym	  ELF_T_HALF	   Version symbols.
     SHT_GROUP		  ELF_T_WORD	   Section group marker.
     SHT_HASH		  ELF_T_HASH	   Symbol hashes.
     SHT_INIT_ARRAY	  ELF_T_ADDR	   Initialization function pointers.
     SHT_NOBITS		  ELF_T_BYTE	   Empty sections.  See	elf(5).
     SHT_NOTE		  ELF_T_NOTE	   ELF note records.
     SHT_PREINIT_ARRAY	  ELF_T_ADDR	   Pre-initialization function
     SHT_PROGBITS	  ELF_T_BYTE	   Machine code.
     SHT_REL		  ELF_T_REL	   ELF relocation records.
     SHT_RELA		  ELF_T_RELA	   Relocation records with addends.
     SHT_STRTAB		  ELF_T_BYTE	   String tables.
     SHT_SYMTAB		  ELF_T_SYM	   Symbol tables.
     SHT_SYMTAB_SHNDX	  ELF_T_WORD	   Used	with extended section
     SHT_SUNW_dof	  ELF_T_BYTE	   Used	by dtrace(1).
     SHT_SUNW_move	  ELF_T_MOVE	   ELF move records.
     SHT_SUNW_syminfo	  ELF_T_SYMINFO	   Additional symbol flags.
     SHT_SUNW_verdef	  ELF_T_VDEF	   Same	as SHT_GNU_verdef.
     SHT_SUNW_verneed	  ELF_T_VNEED	   Same	as SHT_GNU_verneed.
     SHT_SUNW_versym	  ELF_T_HALF	   Same	as SHT_GNU_versym.

     Section types in the range	[SHT_LOOS, SHT_HIUSER] are otherwise consid-
     ered to be	of type	ELF_T_BYTE.

   Functional Grouping
     This section contains a brief overview of the available functionality in
     the ELF library.  Each function listed here is described further in its
     own manual	page.

     Archive Access
	     elf_getarsym()    Retrieve	the archive symbol table.
	     elf_getarhdr()    Retrieve	the archive header for an object.
	     elf_getbase()     Retrieve	the offset of a	member inside an ar-
	     elf_next()	       Iterate through an ar(1)	archive.
	     elf_rand()	       Random access inside an ar(1) archive.

     Data Structures
	     elf_getdata()     Retrieve	translated data	for an ELF section.
	     elf_getscn()      Retrieve	the section descriptor for a named
	     elf_ndxscn()      Retrieve	the index for a	section.
	     elf_newdata()     Add a new Elf_Data descriptor to	an ELF sec-
	     elf_newscn()      Add a new section descriptor to an ELF descrip-
	     elf_nextscn()     Iterate through the sections in an ELF object.
	     elf_rawdata()     Retrieve	untranslated data for an ELF section.
	     elf_rawfile()     Return a	pointer	to the untranslated file con-
			       tents for an ELF	object.
	     elf32_getehdr(), elf64_getehdr()
			       Retrieve	the Executable Header in an ELF
	     elf32_getphdr(), elf64_getphdr()
			       Retrieve	the Program Header Table in an ELF
	     elf32_getshdr(), elf64_getshdr()
			       Retrieve	the ELF	section	header associated with
			       an Elf_Scn descriptor.
	     elf32_newehdr(), elf64_newehdr()
			       Allocate	an Executable Header in	an ELF object.
	     elf32_newphdr(), elf64_newphdr()
			       Allocate	or resize the Program Header Table in
			       an ELF object.

     Data Translation
	     elf32_xlatetof(), elf64_xlatetof()
			       Translate an ELF	data structure from its	native
			       representation to its file representation.
	     elf32_xlatetom(), elf64_xlatetom()
			       Translate an ELF	data structure from its	file
			       representation to a native representation.

     Error Reporting
	     elf_errno()       Retrieve	the current error.
	     elf_errmsg()      Retrieve	a human	readable description of	the
			       current error.

	     elf_begin()       Opens an	ar(1) archive or ELF object given a
			       file descriptor.
	     elf_end()	       Close an	ELF descriptor and release all its
	     elf_memory()      Opens an	ar(1) archive or ELF object present in
			       a memory	arena.
	     elf_version()     Sets the	operating version.

     IO	Control
	     elf_cntl()		Manage the association between and ELF
				descriptor and its underlying file.
	     elf_flagdata()	Mark an	Elf_Data descriptor as dirty.
	     elf_flagehdr()	Mark the ELF Executable	Header in an ELF
				descriptor as dirty.
	     elf_flagphdr()	Mark the ELF Program Header Table in an	ELF
				descriptor as dirty.
	     elf_flagscn()	Mark an	Elf_Scn	descriptor as dirty.
	     elf_flagshdr()	Mark an	ELF Section Header as dirty.
	     elf_setshstrndx()	Set the	index of the section name string table
				for the	ELF object.
	     elf_update()	Recompute ELF object layout and	optionally
				write the modified object back to the underly-
				ing file.

	     elf32_checksum(), elf64_checkum()
				Compute	checksum of an ELF object.
	     elf_getident()	Retrieve the identification bytes for an ELF
	     elf_getshnum()	Retrieve the number of sections	in an ELF
	     elf_getshstrndx()	Retrieve the section index of the section name
				string table in	an ELF object.
	     elf_hash()		Compute	the ELF	hash value of a	string.
	     elf_kind()		Query the kind of object associated with an
				ELF descriptor.
	     elf32_fsize(), elf64_fsize()
				Return the size	of the file representation of
				an ELF type.

   Controlling ELF Object Layout
     In	the usual mode of operation, library will compute section offsets and
     alignments	based on the contents of an ELF	descriptor's sections without
     need for further intervention by the application.

     However, if the application wishes	to take	complete charge	of the layout
     of	the ELF	file, it may set the ELF_F_LAYOUT flag on an ELF descriptor
     using elf_flagelf(3), following which the library will use	the data off-
     sets and alignments specified by the application when laying out the
     file.  Application	control	of file	layout is described further in the
     elf_update(3) manual page.

     Gaps in between sections will be filled with the fill character set by
     function elf_fill().

   Error Handling
     In	case an	error is encountered, these library functions set an internal
     error number and signal the presence of the error by returning an special
     return value.  The	application can	check the current error	number by
     calling elf_errno(3).  A human readable description of the	recorded error
     is	available by calling elf_errmsg(3).

   Memory Management Rules
     The library keeps track of	all Elf_Scn and	Elf_Data descriptors associ-
     ated with an ELF descriptor and recovers them when	the descriptor is
     closed using elf_end(3).  Thus the	application must not call free(3) on
     data structures allocated by the ELF library.

     Conversely	the library will not free data that it has not allocated.  As
     an	example, an application	may call elf_newdata(3)	to allocate a new
     Elf_Data descriptor and can set the d_off member of the descriptor	to
     point to a	region of memory allocated using malloc(3).  It	is the appli-
     cations responsibility to free this arena,	though the library will
     reclaim the space used by the Elf_Data descriptor itself.

     gelf(3), elf(5)

     The original ELF(3) API was developed for Unix System V.  The current
     implementation of the ELF(3) API appeared in FreeBSD 7.0.

     The ELF library was written by Joseph Koshy <>.

FreeBSD	11.0			 July 28, 2014			  FreeBSD 11.0


Want to link to this manual page? Use this URL:

home | help