Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages


home | help
ELF(5)			    BSD	File Formats Manual			ELF(5)

     ELF -- executable and linking format

     #include <elf.h>

     Because of	the flexible nature of ELF, the	structures describing it are
     available both as 32bit and 64bit versions. This document uses the	32bit
     versions, refer to	<elf.h>	for the	corresponding 64bit versions.

     The four main types of an ELF object file are:

     executable	  A file suitable for execution. It contains the information
		  required for creating	a new process image.

     relocatable  Contains the necessary information to	be run through the
		  link editor ld(1) to create an executable or a shared	li-

     shared	  The shared object contains necessary information which can
		  be used by either the	link editor ld(1) at link time or by
		  the dynamic loader ld.elf_so(1) at run time.

     core	  A file which describes the virtual address space and regis-
		  ter state of a process.  Core	files are typically used in
		  conjunction with debuggers such as gdb(1).

     ELF files have a dual nature. The toolchain, including tools such as the
     as(1) and linker ld(1), treats them as a set of sections described	by
     their section headers. The	system loader treats them as a set of segments
     described by the program headers.

     The general format	of an ELF file is the following: The file starts with
     an	ELF header. This is followed by	a table	of program headers (optional
     for relocatable and shared	files).	After this come	the sections/segments.
     The file ends with	a table	of section headers (optional for executable

     A segment can be considered to consist of several sections. For example,
     all executable sections are typically packed into one loadable segment
     which is read-only	and executable (see p_flags in the program header).
     This enables the system to	map the	entire file with just a	few opera-
     tions, one	for each loadable segment, instead of doing numerous map oper-
     ations for	each section separately.

     Each file is described by the ELF header:

	   typedef struct {
		   unsigned char   e_ident[ELF_NIDENT];
		   Elf32_Half	   e_type;
		   Elf32_Half	   e_machine;
		   Elf32_Word	   e_version;
		   Elf32_Addr	   e_entry;
		   Elf32_Off	   e_phoff;
		   Elf32_Off	   e_shoff;
		   Elf32_Word	   e_flags;
		   Elf32_Half	   e_ehsize;
		   Elf32_Half	   e_phentsize;
		   Elf32_Half	   e_phnum;
		   Elf32_Half	   e_shentsize;
		   Elf32_Half	   e_shnum;
		   Elf32_Half	   e_shstrndx;
	   } Elf32_Ehdr;

     e_ident[]	  The array contains the following information in the indi-
		  cated	locations:

		  EI_MAG0	 The elements ranging from EI_MAG0 to EI_MAG3
				 contain the ELF magic number: \0177ELF

		  EI_CLASS	 Contains the address size of the binary, ei-
				 ther 32 or 64bit.

		  EI_DATA	 byte order

		  EI_VERSION	 Contains the ELF header version. This is cur-
				 rently	always set to 1.

		  EI_OSABI	 Contains the operating	system ABI identifica-
				 tion. Note that even though the definition
				 ELFOSABI_NETBSD exists, NetBSD	uses
				 ELFOSABI_SYSV here, since the NetBSD ABI does
				 not deviate from the standard.

		  EI_ABIVERSION	 ABI version.

     e_type	  Contains the file type identification. It can	be either
		  ET_REL, ET_EXEC, ET_DYN, or ET_CORE for relocatable, exe-
		  cutable, shared, or core, respectively.

     e_machine	  Contains the machine type, e.g. SPARC, Alpha,	MIPS, ...

     e_entry	  The program entry point if the file is executable.

     e_phoff	  The position of the program header table in the file or 0 if
		  it doesn't exist.

     e_shoff	  The position of the section header table in the file or 0 if
		  it doesn't exist.

     e_flags	  Contains processor-specific flags. For example, the SPARC
		  port uses this space to specify what kind of memory store
		  ordering is required.

     e_ehsize	  The size of the ELF header.

     e_phentsize  The size of an entry in the program header table. All	en-
		  tries	are the	same size.

     e_phnum	  The number of	entries	in the program header table, or	0 if
		  none exists.

     e_shentsize  The size of an entry in the section header table. All	en-
		  tries	are the	same size.

     e_shnum	  The number of	entries	in the section header table, or	0 if
		  none exists.

     e_shstrndx	  Contains the index number of the section which contains the
		  section name strings.

     Each ELF section in turn is described by the section header:

	   typedef struct {
		   Elf32_Word	   sh_name;
		   Elf32_Word	   sh_type;
		   Elf32_Word	   sh_flags;
		   Elf32_Addr	   sh_addr;
		   Elf32_Off	   sh_offset;
		   Elf32_Word	   sh_size;
		   Elf32_Word	   sh_link;
		   Elf32_Word	   sh_info;
		   Elf32_Word	   sh_addralign;
		   Elf32_Word	   sh_entsize;
	   } Elf32_Shdr;

     sh_name	   Contains an index to	the position in	the section header
		   string section where	the name of the	current	section	can be

     sh_type	   Contains the	section	type indicator.	The more important
		   possible values are:

		   SHT_NULL	 Section is inactive. The other	fields contain
				 undefined values.

		   SHT_PROGBITS	 Section contains program information. It can
				 be for	example	code, data, or debugger	infor-

		   SHT_SYMTAB	 Section contains a symbol table. This section
				 usually contains all the symbols and is in-
				 tended	for the	regular	link editor ld(1).

		   SHT_STRTAB	 Section contains a string table.

		   SHT_RELA	 Section contains relocation information with
				 an explicit addend.

		   SHT_HASH	 Section contains a symbol hash	table.

		   SHT_DYNAMIC	 Section contains dynamic linking information.

		   SHT_NOTE	 Section contains some special information.
				 The format can	be e.g.	 vendor-specific.

		   SHT_NOBITS	 Sections contains information similar to
				 SHT_PROGBITS, but takes up no space in	the
				 file. This can	be used	for e.g. bss.

		   SHT_REL	 Section contains relocation information with-
				 out an	explicit addend.

		   SHT_SHLIB	 This section type is reserved but has unspec-
				 ified semantics.

		   SHT_DYNSYM	 Section contains a symbol table. This symbol
				 table is intended for the dynamic linker, and
				 is kept as small as possible to conserve
				 space,	since it must be loaded	to memory at
				 run time.

     sh_flags	   Contains the	section	flags, which can have the following
		   values or any combination of	them:

		   SHF_WRITE	  Section is writable after it has been

		   SHF_ALLOC	  Section will occupy memory at	run time.

		   SHF_EXECINSTR  Section contains executable machine instruc-

     sh_addr	   Address to where the	section	will be	loaded,	or 0 if	this
		   section does	not reside in memory at	run time.

     sh_offset	   The byte offset from	the beginning of the file to the be-
		   ginning of this section. If the section is of type
		   SHT_NOBITS, this field specifies the	conceptual placement
		   in the file.

     sh_size	   The size of the section in the file for all types except
		   SHT_NOBITS.	For that type the value	may differ from	zero,
		   but the section will	still always take up no	space from the

     sh_link	   Contains an index to	the section header table. The inter-
		   pretation depends on	the section type as follows:

		   SHT_RELA	Section	index of the associated	symbol table.

		   SHT_DYNSYM	Section	index of the associated	string table.

		   SHT_HASH	Section	index of the symbol table to which the
				hash table applies.

		   SHT_DYNAMIC	Section	index of of the	string table by	which
				entries	in this	section	are used.

     sh_info	   Contains extra information. The interpretation depends on
		   the type as follows:

		   SHT_RELA    Section index of	the section to which the relo-
			       cation information applies.

		   SHT_DYNSYM  Contains	a value	one greater that the last lo-
			       cal symbol table	index.

     sh_addralign  Marks the section alignment requirement. If,	for example,
		   the section contains	a doubleword, the entire section must
		   be doubleword aligned to ensure proper alignment. Only 0
		   and integral	powers of two are allowed. Values 0 and	1 de-
		   note	that the section has no	alignment.

     sh_entsize	   Contains the	entry size of an element for sections which
		   are constructed of a	table of fixed-size entries. If	the
		   section does	not hold a table of fixed-size entries,	this
		   value is 0.

     Every executable object must contain a program header. The	program	header
     contains information necessary in constructing a process image.

	   typedef struct {
		   Elf32_Word	   p_type;
		   Elf32_Off	   p_offset;
		   Elf32_Addr	   p_vaddr;
		   Elf32_Addr	   p_paddr;
		   Elf32_Word	   p_filesz;
		   Elf32_Word	   p_memsz;
		   Elf32_Word	   p_flags;
		   Elf32_Word	   p_align;
	   } Elf32_Phdr;

     p_type    Contains	the segment type indicator. The	possible values	are:

	       PT_NULL	   Segment is inactive.	The other fields contain unde-
			   fined values.

	       PT_LOAD	   Segment is loadable.	It is loaded to	the address
			   described by	p_vaddr.  If p_memsz is	greater	than
			   p_filesz, the memory	range from (p_vaddr +
			   p_filesz) to	(p_vaddr + p_memsz) is zero-filled
			   when	the segment is loaded.	p_filesz can not be
			   greater than	p_memsz.  Segments of this type	are
			   sorted in the header	table by p_vaddr in ascending

	       PT_DYNAMIC  Segment contains dynamic linking information.

	       PT_INTERP   Segment contains a null-terminated path name	to the
			   interpreter.	This segment may be present only once
			   in a	file, and it must appear before	any loadable
			   segments. This field	will most likely contain the
			   ELF dynamic loader: /libexec/ld.elf_so

	       PT_NOTE	   Segment contains some special information. Format
			   can be e.g. vendor-specific.

	       PT_SHLIB	   This	segment	type is	reserved but has unspecified
			   semantics. Programs which contain a segment of this
			   type	do not conform to the ABI, and must indicate
			   this	by setting the appropriate ABI in the ELF
			   header EI_OSABI field.

	       PT_PHDR	   The values in a program header of this type specify
			   the characteristics of the program header table it-
			   self. For example, the p_vaddr field	specifies the
			   program header table	location in memory once	the
			   program is loaded. This field may not occur more
			   than	once, may occur	only if	the program header ta-
			   ble is part of the file memory image, and must come
			   before any loadable segments.

     p_offset  Contains	the byte offset	from the beginning of the file to the
	       beginning of this segment.

     p_vaddr   Contains	the virtual memory address to which this segment is

     p_paddr   Contains	the physical address to	which this segment is loaded.
	       This value is usually ignored, but may be used while bootstrap-
	       ping or in embedded systems.

     p_filesz  Contains	the number of bytes this segment occupies in the file

     p_memsz   Contains	the number of bytes this segment occupies in the mem-
	       ory image.

     p_flags   Contains	the segment flags, which specify the permissions for
	       the segment after it has	been loaded. The following values or
	       any combination of them is acceptable:

	       PF_R  Segment can be read.

	       PF_W  Segment can be written.

	       PF_X  Segment is	executable.

     p_align   Contains	the segment alignment. Acceptable values are 0 and 1
	       for no alignment, and integral powers of	two.  p_vaddr should
	       equal p_offset modulo p_align.

     as(1), gdb(1), ld(1), ld.elf_so(1), execve(2), nlist(3), a.out(5),
     core(5), link(5), stab(5)

     The ELF object file format	first appeared in AT&T System V	UNIX.

BSD			       November	18, 2006			   BSD


Want to link to this manual page? Use this URL:

home | help