Executable and Linkable Format

In computing, the Executable and Linkable Format (ELF, formerly named Extensible Linking Format), is a common standard file format for executable files, object code, shared libraries, and core dumps. First published in the specification for the application binary interface (ABI) of the Unix operating system version named System V Release 4 (SVR4),[2] and later in the Tool Interface Standard,[1] it was quickly accepted among different vendors of Unix systems. In 1999, it was chosen as the standard binary file format for Unix and Unix-like systems on x86 processors by the 86open project.

ELF
Filename extension
none, .axf, .bin, .elf, .o, .prx, .puff, .ko, .mod and .so
Magic number0x7F 'E' 'L' 'F'
Developed byUnix System Laboratories[1]:3
Type of formatBinary, executable, object, shared library, core dump
Container forMany executable binary formats
An ELF file has two views: the program header shows the segments used at run time, whereas the section header lists the set of sections of the binary.

By design, the ELF format is flexible, extensible, and cross-platform. For instance it supports different endiannesses and address sizes so it does not exclude any particular central processing unit (CPU) or instruction set architecture. This has allowed it to be adopted by many different operating systems on many different hardware platforms.

File layout

Each ELF file is made up of one ELF header, followed by file data. The data can include:

  • Program header table, describing zero or more memory segments
  • Section header table, describing zero or more sections
  • Data referred to by entries in the program header table or section header table
Structure of an ELF file with key entries highlighted

The segments contain information that is needed for run time execution of the file, while sections contain important data for linking and relocation. Any byte in the entire file can be owned by one section at most, and orphan bytes can occur which are unowned by any section.

00000000 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 |.ELF............|

00000010 02 00 3e 00 01 00 00 00 c5 48 40 00 00 00 00 00 |..>......H@.....|

Example hexdump of ELF file header[3]

File header

The ELF header defines whether to use 32-bit or 64-bit addresses. The header contains three fields that are affected by this setting and offset other fields that follow them. The ELF header is 52 or 64 bytes long for 32-bit and 64-bit binaries respectively.

ELF header[4]
OffsetSize (bytes)FieldPurpose
32-bit64-bit32-bit64-bit
0x004e_ident[EI_MAG0] through e_ident[EI_MAG3] 0x7F followed by ELF(45 4c 46) in ASCII; these four bytes constitute the magic number.
0x041e_ident[EI_CLASS] This byte is set to either 1 or 2 to signify 32- or 64-bit format, respectively.
0x051e_ident[EI_DATA] This byte is set to either 1 or 2 to signify little or big endianness, respectively. This affects interpretation of multi-byte fields starting with offset 0x10.
0x061e_ident[EI_VERSION] Set to 1 for the original and current version of ELF.
0x071e_ident[EI_OSABI] Identifies the target operating system ABI.
ValueABI
0x00System V
0x01HP-UX
0x02NetBSD
0x03Linux
0x04GNU Hurd
0x06Solaris
0x07AIX
0x08IRIX
0x09FreeBSD
0x0ATru64
0x0BNovell Modesto
0x0COpenBSD
0x0DOpenVMS
0x0ENonStop Kernel
0x0FAROS
0x10Fenix OS
0x11CloudABI
0x12Stratus Technologies OpenVOS

It is often set to 0 regardless of the target platform.

0x081e_ident[EI_ABIVERSION] Further specifies the ABI version. Its interpretation depends on the target ABI. Linux kernel (after at least 2.6) has no definition of it,[5] so it is ignored for statically-linked executables. In that case, offset and size of EI_PAD are 8.

glibc 2.12+ in case e_ident[EI_OSABI] == 3 treats this field as ABI version of the dynamic linker:[6] it defines a list of dynamic linker's features,[7] treats e_ident[EI_ABIVERSION] as a feature level requested by the shared object (executable or dynamic library) and refuses to load it if an unknown feature is requested, i.e. e_ident[EI_ABIVERSION] is greater than the largest known feature.[8]

0x097e_ident[EI_PAD] currently unused, should be filled with zeros.
0x102e_type Identifies object file type.
ValueType
0x00ET_NONE
0x01ET_REL
0x02ET_EXEC
0x03ET_DYN
0x04ET_CORE
0xFE00ET_LOOS
0xFEFFET_HIOS
0xFF00ET_LOPROC
0xFFFFET_HIPROC
0x122e_machine Specifies target instruction set architecture. Some examples are:
ValueISA
0x00No specific instruction set
0x01AT&T WE 32100
0x02SPARC
0x03x86
0x04Motorola 68000 (M68k)
0x05Motorola 88000 (M88k)
0x06Intel MCU
0x07Intel 80860
0x08MIPS
0x09IBM_System/370
0x0AMIPS RS3000 Little-endian
0x0B - 0x0DReserved for future use
0x0EHewlett-Packard PA-RISC
0x0FReserved for future use
0x13Intel 80960
0x14PowerPC
0x15PowerPC (64-bit)
0x16 S390, including S390x
0x28ARM (up to ARMv7/Aarch32)
0x2ASuperH
0x32IA-64
0x3Eamd64
0x8CTMS320C6000 Family
0xB7ARM 64-bits (ARMv8/Aarch64)
0xF3RISC-V
0x101 WDC 65C816
0x144e_version Set to 1 for the original version of ELF.
0x1848e_entry This is the memory address of the entry point from where the process starts executing. This field is either 32 or 64 bits long depending on the format defined earlier.
0x1C0x2048e_phoff Points to the start of the program header table. It usually follows the file header immediately, making the offset 0x34 or 0x40 for 32- and 64-bit ELF executables, respectively.
0x200x2848e_shoff Points to the start of the section header table.
0x240x304e_flags Interpretation of this field depends on the target architecture.
0x280x342e_ehsize Contains the size of this header, normally 64 Bytes for 64-bit and 52 Bytes for 32-bit format.
0x2A0x362e_phentsize Contains the size of a program header table entry.
0x2C0x382e_phnum Contains the number of entries in the program header table.
0x2E0x3A2e_shentsize Contains the size of a section header table entry.
0x300x3C2e_shnum Contains the number of entries in the section header table.
0x320x3E2e_shstrndx Contains index of the section header table entry that contains the section names.
0x34 0x40 End of ELF Header (size)

Program header

The program header table tells the system how to create a process image. It is found at file offset e_phoff, and consists of e_phnum entries, each with size e_phentsize. The layout is slightly different in 32-bit ELF vs 64-bit ELF, because the p_flags are in a different structure location for alignment reasons. Each entry is structured as:

Program header[9]
OffsetSize (bytes)FieldPurpose
32-bit64-bit32-bit64-bit
0x004p_typeIdentifies the type of the segment.
ValueNameMeaning
0x00000000PT_NULL Program header table entry unused
0x00000001PT_LOAD Loadable segment
0x00000002PT_DYNAMIC Dynamic linking information
0x00000003PT_INTERP Interpreter information
0x00000004PT_NOTE Auxiliary information
0x00000005PT_SHLIB reserved
0x00000006PT_PHDR segment containing program header table itself
0x00000007PT_TLS Thread-Local Storage template
0x60000000PT_LOOS see below
0x6FFFFFFFPT_HIOS
0x70000000PT_LOPROC
0x7FFFFFFFPT_HIPROC

PT_LOOS to PT_HIOS (PT_LOPROC to PT_HIPROC) is an inclusive reserved ranges for operating system (processor) specific semantics.

0x044p_flagsSegment-dependent flags (position for 64-bit structure).
0x040x0848p_offsetOffset of the segment in the file image.
0x080x1048p_vaddrVirtual address of the segment in memory.
0x0C0x1848p_paddrOn systems where physical address is relevant, reserved for segment's physical address.
0x100x2048p_fileszSize in bytes of the segment in the file image. May be 0.
0x140x2848p_memszSize in bytes of the segment in memory. May be 0.
0x184p_flagsSegment-dependent flags (position for 32-bit structure).
0x1C0x3048p_align0 and 1 specify no alignment. Otherwise should be a positive, integral power of 2, with p_vaddr equating p_offset modulus p_align.
0x20 0x38 End of Program Header (size)

Section header
Offset Size (bytes) Field Purpose
32-bit 64-bit 32-bit 64-bit
0x00 4 sh_name An offset to a string in the .shstrtab section that represents the name of this section.
0x04 4 sh_type Identifies the type of this header.
Value Name Meaning
0x0 SHT_NULL Section header table entry unused
0x1 SHT_PROGBITS Program data
0x2 SHT_SYMTAB Symbol table
0x3 SHT_STRTAB String table
0x4 SHT_RELA Relocation entries with addends
0x5 SHT_HASH Symbol hash table
0x6 SHT_DYNAMIC Dynamic linking information
0x7 SHT_NOTE Notes
0x8 SHT_NOBITS Program space with no data (bss)
0x9 SHT_REL Relocation entries, no addends
0x0A SHT_SHLIB Reserved
0x0B SHT_DYNSYM Dynamic linker symbol table
0x0E SHT_INIT_ARRAY Array of constructors
0x0F SHT_FINI_ARRAY Array of destructors
0x10 SHT_PREINIT_ARRAY Array of pre-constructors
0x11 SHT_GROUP Section group
0x12 SHT_SYMTAB_SHNDX Extended section indices
0x13 SHT_NUM Number of defined types.
0x60000000 SHT_LOOS Start OS-specific.
... ... ...
0x08 4 8 sh_flags Identifies the attributes of the section.
Value Name Meaning
0x1 SHF_WRITE Writable
0x2 SHF_ALLOC Occupies memory during execution
0x4 SHF_EXECINSTR Executable
0x10 SHF_MERGE Might be merged
0x20 SHF_STRINGS Contains null-terminated strings
0x40 SHF_INFO_LINK 'sh_info' contains SHT index
0x80 SHF_LINK_ORDER Preserve order after combining
0x100 SHF_OS_NONCONFORMING Non-standard OS specific handling required
0x200 SHF_GROUP Section is member of a group
0x400 SHF_TLS Section hold thread-local data
0x0ff00000 SHF_MASKOS OS-specific
0xf0000000 SHF_MASKPROC Processor-specific
0x4000000 SHF_ORDERED Special ordering requirement (Solaris)
0x8000000 SHF_EXCLUDE Section is excluded unless referenced or allocated (Solaris)
0x0C 0x10 4 8 sh_addr Virtual address of the section in memory, for sections that are loaded.
0x10 0x18 4 8 sh_offset Offset of the section in the file image.
0x14 0x20 4 8 sh_size Size in bytes of the section in the file image. May be 0.
0x18 0x28 4 sh_link Contains the section index of an associated section. This field is used for several purposes, depending on the type of section.
0x1C 0x2C 4 sh_info Contains extra information about the section. This field is used for several purposes, depending on the type of section.
0x20 0x30 4 8 sh_addralign Contains the required alignment of the section. This field must be a power of two.
0x24 0x38 4 8 sh_entsize Contains the size, in bytes, of each entry, for sections that contain fixed-size entries. Otherwise, this field contains zero.
0x28 0x40 End of Section Header (size)

Tools
Main article: GNU Binutils
  • readelf is a Unix binary utility that displays information about one or more ELF files. A free software implementation is provided by GNU Binutils.
  • elfutils provides alternative tools to GNU Binutils purely for Linux.[10]
  • elfdump is a command for viewing ELF information in an ELF file, available under Solaris and FreeBSD.
  • objdump provides a wide range of information about ELF files and other object formats. objdump uses the Binary File Descriptor library as a back-end to structure the ELF data.
  • The Unix file utility can display some information about ELF files, including the instruction set architecture for which the code in a relocatable, executable, or shared object file is intended, or on which an ELF core dump was produced.

Applications

Unix-like systems

The ELF format has replaced older executable formats in various environments. It has replaced a.out and COFF formats in Unix-like operating systems:

Non-Unix adoption

ELF has also seen some adoption in non-Unix operating systems, such as:

Game consoles

Some game consoles also use ELF:

PowerPC

Other (operating) systems running on PowerPC that use ELF:

Mobile phones

Some operating systems for mobile phones and mobile devices use ELF:

Some phones can run ELF files through the use of a patch that adds assembly code to the main firmware, which is a feature known as ELFPack in the underground modding culture. The ELF file format is also used with the Atmel AVR (8-bit), AVR32[21] and with Texas Instruments MSP430 microcontroller architectures. Some implementations of Open Firmware can also load ELF files, most notably Apple's implementation used in almost all PowerPC machines the company produced.

Specifications

The Linux Standard Base (LSB) supplements some of the above specifications for architectures in which it is specified.[22] For example, that is the case for the System V ABI, AMD64 Supplement.[23][24]

86open

86open was a project to form consensus on a common binary file format for Unix and Unix-like operating systems on the common PC compatible x86 architecture, to encourage software developers to port to the architecture.[25] The initial idea was to standardize on a small subset of Spec 1170, a predecessor of the Single UNIX Specification, and the GNU C Library (glibc) to enable unmodified binaries to run on the x86 Unix-like operating systems. The project was originally designated "Spec 150".

The format eventually chosen was ELF, specifically the Linux implementation of ELF, after it had turned out to be a de facto standard supported by all involved vendors and operating systems.

The group began email discussions in 1997 and first met together at the Santa Cruz Operation offices on August 22, 1997.

The steering committee was Marc Ewing, Dion Johnson, Evan Leibovitch, Bruce Perens, Andrew Roach, Bryan Wayne Sparks and Linus Torvalds. Other people on the project were Keith Bostic, Chuck Cranor, Michael Davidson, Chris G. Demetriou, Ulrich Drepper, Don Dugger, Steve Ginzburg, Jon "maddog" Hall, Ron Holt, Jordan Hubbard, Dave Jensen, Kean Johnston, Andrew Josey, Robert Lipe, Bela Lubkin, Tim Marsland, Greg Page, Ronald Joe Record, Tim Ruckle, Joel Silverstein, Chia-pi Tien, and Erik Troan. Operating systems and companies represented were BeOS, BSDI, FreeBSD, Intel, Linux, NetBSD, SCO and SunSoft.

The project progressed and in mid-1998, SCO began developing lxrun, an open-source compatibility layer able to run Linux binaries on OpenServer, UnixWare, and Solaris. SCO announced official support of lxrun at LinuxWorld in March 1999. Sun Microsystems began officially supporting lxrun for Solaris in early 1999,[26] and later moved to integrated support of the Linux binary format via Solaris Containers for Linux Applications.

With the BSDs having long supported Linux binaries (through a compatibility layer) and the main x86 Unix vendors having added support for the format, the project decided that Linux ELF was the format chosen by the industry and "declare[d] itself dissolved" on July 25, 1999.[27]

FatELF: universal binaries for Linux

FatELF is an ELF binary-format extension that adds fat binary capabilities.[28] It is aimed for Linux and other Unix-like operating systems. Additionally to the CPU architecture abstraction (byte order, word size, CPU instruction set etc.), there is the potential advantage of software-platform abstraction e.g., binaries which support multiple kernel ABI versions. As of 25 April 2020, FatELF has not been integrated into the mainline Linux Kernel.[29][30][31]

See also

References
  1. Tool Interface Standard (TIS) Executable and Linking Format (ELF) Specification Version 1.2 (May 1995)
  2. System V Application Binary Interface Edition 4.1 (1997-03-18)
  3. "Available lexers — Pygments". pygments.org.
  4. "ELF Header". Sco.com. July 2000. Retrieved 2014-02-07.
  5. "LXR linux/include/linux/elf.h". linux.no. Retrieved 27 April 2015.
  6. "glibc 2.12 announce".
  7. "sourceware.org Git - glibc.git/blob - libc-abis".
  8. "sourceware.org Git - glibc.git/blob - sysdeps/gnu/ldsodefs.h".
  9. "Program Header". Sco.com. July 2000. Retrieved 2017-04-05.
  10. "elfutils". sourceware.org. Retrieved 30 April 2017.
  11. "Binary Formats".
  12. "MinixReleases – Minix Wiki". Wiki.minix3.org. Archived from the original on 2013-03-30. Retrieved 2014-01-19.
  13. https://vmssoftware.com/pdfs/State_of_Port_20160906.pdf
  14. "GCCSDK – RISC OS". Riscos.info. 2012-04-22. Retrieved 2014-01-19.
  15. "Announcing Windows 10 Insider Preview Build 14316". Windows Experience Blog. 2016-04-06. Retrieved 2016-04-10.
  16. Foley, Mary Jo. "Under the hood of Microsoft's Windows Subsystem for Linux | ZDNet". ZDNet. Retrieved 2016-08-19.
  17. "Guardian Programmer's Guide" (PDF). Hewlett Packard Enterprise. Archived from the original (PDF) on 2018-05-30. Retrieved 2018-05-30. p. 44 archived from the original on 2018-5-30
  18. PlayStation Portable use encrypted & relocated ELF : PSP
  19. Symbian OS executable file format
  20. Rosen, Kenneth; Host, Douglas; Klee, Rachel; Rosinski, Richard (2007). UNIX: The Complete Reference (2 ed.). McGraw Hill Professional. p. 707. ISBN 9780071706988. Retrieved 2017-06-08. Dynamically linked libraries are also called shared objects (.so).
  21. "Chapter 4: Object Files", System V Application Binary Interface, 2009-10-26, e_machine
  22. "LSB Referenced Specifications". linuxfoundation.org. Retrieved 27 April 2015.
  23. "Executable and Linking Format (ELF)". linuxfoundation.org. Retrieved 27 April 2015.
  24. "Introduction". linuxfoundation.org. Retrieved 27 April 2015.
  25. Leibovitch, Evan (1997-12-23). "86Open Frequently-Asked Questions". Archived from the original on 2007-03-11. Retrieved 2007-06-06.
  26. Record, Ronald (1998-05-21). "Bulletin on status of 86open at SCO". Archived from the original on 2008-12-08. Retrieved 2008-05-06.
  27. Leibovitch, Evan (1999-07-25). "The86open Project – Final Update". Archived from the original on 2007-02-27. Retrieved 2007-05-06.
  28. Gordon, Ryan. "fatelf-specification v1". icculus.org. Retrieved 2010-07-25.
  29. Gordon, Ryan. "FatELF: Turns out I liked the uncertainty better". icculus.org. Retrieved 2010-07-13.
  30. Holwerda, Thom (2009-11-03). "Ryan Gordon Halts FatELF Project". osnews.com. Retrieved 2010-07-05.
  31. Brockmeier, Joe (June 23, 2010). "SELF: Anatomy of an (alleged) failure". Linux Weekly News. Retrieved 2011-02-06.

Further reading
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.