1 .\" Copyright (c) 1999 Jeroen Ruigrok van der Werven
2 .\" All rights reserved.
4 .\" Redistribution and use in source and binary forms, with or without
5 .\" modification, are permitted provided that the following conditions
7 .\" 1. Redistributions of source code must retain the above copyright
8 .\" notice, this list of conditions and the following disclaimer.
9 .\" 2. Redistributions in binary form must reproduce the above copyright
10 .\" notice, this list of conditions and the following disclaimer in the
11 .\" documentation and/or other materials provided with the distribution.
13 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
14 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
16 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
17 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
18 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
19 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
20 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
21 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
22 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 .Nd format of ELF executable binary files
38 defines the format of ELF executable binary files.
39 Amongst these files are
40 normal executable files, relocatable object files, core files and shared
43 An executable file using the ELF file format consists of an ELF header,
44 followed by a program header table or a section header table, or both.
45 The ELF header is always at offset zero of the file.
47 table and the section header table's offset in the file are defined in the
49 The two tables describe the rest of the particularities of
52 Applications which wish to process ELF binary files for their native
53 architecture only should include
56 These applications should need to refer to
57 all the types and structures by their generic names
61 Applications written this way can be compiled on any architecture,
62 regardless whether the host is 32-bit or 64-bit.
64 Should an application need to process ELF files of an unknown
65 architecture then the application needs to include both
71 Furthermore, all types and structures need to be identified by either
75 The macros need to be identified by
80 Whatever the system's architecture is, it will always include
83 .In sys/elf_generic.h .
85 These header files describe the above mentioned headers as C structures
86 and also include structures for dynamic sections, relocation sections and
89 The following types are being used for 32-bit architectures:
90 .Bd -literal -offset indent
91 Elf32_Addr Unsigned 32-bit program address
92 Elf32_Half Unsigned 16-bit field
93 Elf32_Off Unsigned 32-bit file offset
94 Elf32_Sword Signed 32-bit field or integer
95 Elf32_Word Unsigned 32-bit field or integer
98 For 64-bit architectures we have the following types:
99 .Bd -literal -offset indent
100 Elf64_Addr Unsigned 64-bit program address
101 Elf64_Half Unsigned 16-bit field
102 Elf64_Off Unsigned 64-bit file offset
103 Elf64_Sword Signed 32-bit field
104 Elf64_Word Unsigned 32-bit field
105 Elf64_Sxword Signed 64-bit field or integer
106 Elf64_Xword Unsigned 64-bit field or integer
109 All data structures that the file format defines follow the
111 size and alignment guidelines for the relevant class.
113 data structures contain explicit padding to ensure 4-byte alignment
114 for 4-byte objects, to force structure sizes to a multiple of 4, etc.
116 The ELF header is described by the type Elf32_Ehdr or Elf64_Ehdr:
117 .Bd -literal -offset indent
119 unsigned char e_ident[EI_NIDENT];
121 Elf32_Half e_machine;
122 Elf32_Word e_version;
128 Elf32_Half e_phentsize;
130 Elf32_Half e_shentsize;
132 Elf32_Half e_shstrndx;
136 .Bd -literal -offset indent
138 unsigned char e_ident[EI_NIDENT];
140 Elf64_Half e_machine;
141 Elf64_Word e_version;
147 Elf64_Half e_phentsize;
149 Elf64_Half e_shentsize;
151 Elf64_Half e_shstrndx;
155 The fields have the following meanings:
157 .Bl -tag -width "e_phentsize" -compact -offset indent
159 This array of bytes specifies to interpret the file,
160 independent of the processor or the file's remaining contents.
161 Within this array everything is named by macros, which start with
164 and may contain values which start with the prefix
166 The following macros are defined:
168 .Bl -tag -width "EI_ABIVERSION" -compact
170 The first byte of the magic number.
171 It must be filled with
174 The second byte of the magic number.
175 It must be filled with
178 The third byte of the magic number.
179 It must be filled with
182 The fourth byte of the magic number.
183 It must be filled with
186 The fifth byte identifies the architecture for this binary:
188 .Bl -tag -width "ELFCLASSNONE" -compact
190 This class is invalid.
192 This defines the 32-bit architecture.
193 It supports machines with files
194 and virtual address spaces up to 4 Gigabytes.
196 This defines the 64-bit architecture.
199 The sixth byte specifies the data encoding of the processor-specific
201 Currently these encodings are supported:
203 .Bl -tag -width "ELFDATA2LSB" -compact
207 Two's complement, little-endian.
209 Two's complement, big-endian.
212 The version number of the ELF specification:
214 .Bl -tag -width "EV_CURRENT" -compact
221 This byte identifies the operating system
222 and ABI to which the object is targeted.
223 Some fields in other ELF structures have flags
224 and values that have platform specific meanings;
225 the interpretation of those fields is determined by the value of this byte.
226 The following values are currently defined:
228 .Bl -tag -width "ELFOSABI_STANDALONE" -compact
232 HP-UX operating system ABI.
233 .It Dv ELFOSABI_NETBSD
235 operating system ABI.
236 .It Dv ELFOSABI_LINUX
237 GNU/Linux operating system ABI.
239 GNU/Hurd operating system ABI.
240 .It Dv ELFOSABI_86OPEN
241 86Open Common IA32 ABI.
242 .It Dv ELFOSABI_SOLARIS
243 Solaris operating system ABI.
244 .It Dv ELFOSABI_MONTEREY
245 Monterey project ABI.
247 IRIX operating system ABI.
248 .It Dv ELFOSABI_FREEBSD
250 operating system ABI.
251 .It Dv ELFOSABI_TRU64
252 TRU64 UNIX operating system ABI.
254 ARM architecture ABI.
255 .It Dv ELFOSABI_STANDALONE
256 Standalone (embedded) ABI.
259 This byte identifies the version of the ABI
260 to which the object is targeted.
261 This field is used to distinguish among incompatible versions of an ABI.
262 The interpretation of this version number
263 is dependent on the ABI identified by the EI_OSABI field.
264 Applications conforming to this specification use the value 0.
267 These bytes are reserved and set to zero.
269 which read them should ignore them.
270 The value for EI_PAD will change in
271 the future if currently unused bytes are given meanings.
273 Start of architecture identification.
275 The size of the e_ident array.
279 This member of the structure identifies the object file type:
281 .Bl -tag -width "ET_NONE" -compact
295 This member specifies the required architecture for an individual file:
297 .Bl -tag -width "EM_MIPS_RS4_BE" -compact
303 Sun Microsystems SPARC.
315 MIPS RS3000 (big-endian only).
316 .It Dv EM_MIPS_RS4_BE
317 MIPS RS4000 (big-endian only).
319 SPARC v9 64-bit unofficial.
329 This member identifies the file version:
331 .Bl -tag -width "EV_CURRENT" -compact
338 This member gives the virtual address to which the system first transfers
339 control, thus starting the process.
340 If the file has no associated entry
341 point, this member holds zero.
343 This member holds the program header table's file offset in bytes.
345 the file has no program header table, this member holds zero.
347 This member holds the section header table's file offset in bytes.
349 file has no section header table this member holds zero.
351 This member holds processor-specific flags associated with the file.
353 names take the form EF_`machine_flag'.
354 Currently no flags have been defined.
356 This member holds the ELF header's size in bytes.
358 This member holds the size in bytes of one entry in the file's program header
359 table; all entries are the same size.
361 This member holds the number of entries in the program header
367 gives the table's size
369 If a file has no program header,
371 holds the value zero.
373 This member holds a sections header's size in bytes.
374 A section header is one
375 entry in the section header table; all entries are the same size.
377 This member holds the number of entries in the section header table.
383 gives the section header table's size in bytes.
384 If a file has no section
387 holds the value of zero.
389 This member holds the section header table index of the entry associated
390 with the section name string table.
391 If the file has no section name string
392 table, this member holds the value
396 An executable or shared object file's program header table is an array of
397 structures, each describing a segment or other information the system needs
398 to prepare the program for execution.
403 Program headers are meaningful only for executable and shared object files.
404 A file specifies its own program header size with the ELF header's
409 As with the Elf executable header, the program header
410 also has different versions depending on the architecture:
412 .Bd -literal -offset indent
425 .Bd -literal -offset indent
432 Elf64_Xword p_filesz;
438 The main difference between the 32-bit and the 64-bit program header lies
439 only in the location of a
441 member in the total struct.
443 .Bl -tag -width "p_offset" -compact -offset indent
445 This member of the Phdr struct tells what kind of segment this array
446 element describes or how to interpret the array element's information.
447 .Bl -tag -width "PT_DYNAMIC" -compact
450 The array element is unused and the other members' values are undefined.
451 This lets the program header have ignored entries.
453 The array element specifies a loadable segment, described by
457 The bytes from the file are mapped to the beginning of the memory
459 If the segment's memory size
461 is larger than the file size
465 bytes are defined to hold the value 0 and to follow the segment's
467 The file size may not be larger than the memory size.
468 Loadable segment entries in the program header table appear in ascending
473 The array element specifies dynamic linking information.
475 The array element specifies the location and size of a null-terminated
476 path name to invoke as an interpreter.
477 This segment type is meaningful
478 only for executable files (though it may occur for shared objects).
480 it may not occur more than once in a file.
481 If it is present it must precede
482 any loadable segment entry.
484 The array element specifies the location and size for auxiliary information.
486 This segment type is reserved but has unspecified semantics.
488 contain an array element of this type do not conform to the ABI.
490 The array element, if present, specifies the location and size of the program
491 header table itself, both in the file and in the memory image of the program.
492 This segment type may not occur more than once in a file.
494 only occur if the program header table is part of the memory image of the
496 If it is present it must precede any loadable segment entry.
498 This value up to and including
500 are reserved for processor-specific semantics.
502 This value down to and including
504 are reserved for processor-specific semantics.
508 This member holds the offset from the beginning of the file at which
509 the first byte of the segment resides.
511 This member holds the virtual address at which the first byte of the
512 segment resides in memory.
514 On systems for which physical addressing is relevant, this member is
515 reserved for the segment's physical address.
519 not used and must be zero.
521 This member holds the number of bytes in the file image of the segment.
524 This member holds the number of bytes in the memory image of the segment.
527 This member holds flags relevant to the segment:
529 .Bl -tag -width "PF_X" -compact
531 An executable segment.
538 A text segment commonly has the flags
542 A data segment commonly has
548 This member holds the value to which the segments are aligned in memory
550 Loadable process segments must have congruent values for
554 modulo the page size.
555 Values of zero and one mean no alignment is required.
558 should be a positive, integral power of two, and
566 An file's section header table lets one locate all the file's sections.
568 section header table is an array of Elf32_Shdr or Elf64_Shdr structures.
572 member gives the byte offset from the beginning of the file to the section
575 holds the number of entries the section header table contains.
577 holds the size in bytes of each entry.
579 A section header table index is a subscript into this array.
581 header table indices are reserved.
582 An object file does not have sections for
583 these special indices:
585 .Bl -tag -width "SHN_LORESERVE" -compact
587 This value marks an undefined, missing, irrelevant, or otherwise meaningless
589 For example, a symbol
591 relative to section number
593 is an undefined symbol.
595 This value specifies the lower bound of the range of reserved indices.
597 This value up to and including
599 are reserved for processor-specific semantics.
601 This value down to and including
603 are reserved for processor-specific semantics.
605 This value specifies absolute values for the corresponding reference.
607 example, symbols defined relative to section number
609 have absolute values and are not affected by relocation.
611 Symbols defined relative to this section are common symbols, such as FORTRAN
612 COMMON or unallocated C external variables.
614 This value specifies the upper bound of the range of reserved indices.
616 system reserves indices between
621 The section header table does not contain entries for the
625 The section header has the following structure:
626 .Bd -literal -offset indent
636 Elf32_Word sh_addralign;
637 Elf32_Word sh_entsize;
641 .Bd -literal -offset indent
645 Elf64_Xword sh_flags;
651 Elf64_Xword sh_addralign;
652 Elf64_Xword sh_entsize;
656 .Bl -tag -width "sh_addralign" -compact
658 This member specifies the name of the section.
659 Its value is an index
660 into the section header string table section, giving the location of
661 a null-terminated string.
663 This member categorizes the section's contents and semantics.
665 .Bl -tag -width "SHT_PROGBITS" -compact
667 This value marks the section header as inactive.
669 have an associated section.
670 Other members of the section header
671 have undefined values.
673 The section holds information defined by the program, whose
674 format and meaning are determined solely by the program.
676 This section holds a symbol table.
679 provides symbols for link editing, though it may also be used
681 As a complete symbol table, it may contain
682 many symbols unnecessary for dynamic linking.
688 This section holds a string table.
689 An object file may have multiple
690 string table sections.
692 This section holds relocation entries with explicit addends, such
695 for the 32-bit class of object files.
696 An object may have multiple
699 This section holds a symbol hash table.
700 All object participating in
701 dynamic linking must contain a symbol hash table.
703 have only one hash table.
705 This section holds information for dynamic linking.
707 have only one dynamic section.
709 This section holds information that marks the file in some way.
711 A section of this type occupies no space in the file but otherwise
714 Although this section contains no bytes, the
716 member contains the conceptual file offset.
718 This section holds relocation offsets without explicit addends, such
721 for the 32-bit class of object files.
722 An object file may have multiple
725 This section is reserved but has unspecified semantics.
727 This section holds a minimal set of dynamic linking symbols.
729 object file can also contain a
733 This value up to and including
735 are reserved for processor-specific semantics.
737 This value down to and including
739 are reserved for processor-specific semantics.
741 This value specifies the lower bound of the range of indices reserved for
742 application programs.
744 This value specifies the upper bound of the range of indices reserved for
745 application programs.
746 Section types between
750 may be used by the application, without conflicting with current or future
751 system-defined section types.
755 Sections support one-bit flags that describe miscellaneous attributes.
756 If a flag bit is set in
761 Otherwise, the attribute is
764 Undefined attributes are set to zero.
766 .Bl -tag -width "SHF_EXECINSTR" -compact
768 This section contains data that should be writable during process
771 The section occupies memory during process execution.
773 sections do not reside in the memory image of an object file.
775 attribute is off for those sections.
777 The section contains executable machine instructions.
779 All bits included in this mask are reserved for processor-specific
784 If the section will appear in the memory image of a process, this member
785 holds the address at which the section's first byte should reside.
786 Otherwise, the member contains zero.
788 This member's value holds the byte offset from the beginning of the file
789 to the first byte in the section.
792 occupies no space in the file, and its
794 member locates the conceptual placement in the file.
796 This member holds the section's size in bytes.
797 Unless the section type
805 may have a non-zero size, but it occupies no space in the file.
807 This member holds a section header table index link, whose interpretation
808 depends on the section type.
810 This member holds extra information, whose interpretation depends on the
813 Some sections have address alignment constraints.
815 doubleword, the system must ensure doubleword alignment for the entire
817 That is, the value of
819 must be congruent to zero, modulo the value of
821 Only zero and positive integral powers of two are allowed.
823 or one mean the section has no alignment constraints.
825 Some sections hold a table of fixed-sized entries, such as a symbol table.
826 For such a section, this member gives the size in bytes for each entry.
827 This member contains zero if the section does not hold a table of
831 Various sections hold program and control information:
832 .Bl -tag -width ".shstrtab" -compact
834 (Block Started by Symbol)
835 This section holds uninitialized data that contributes to the program's
837 By definition, the system initializes the data with zeros
838 when the program begins to run.
839 This section is of type
841 The attributes types are
846 This section holds version control information.
847 This section is of type
849 No attribute types are used.
851 This section holds initialized data that contribute to the program's
853 This section is of type
855 The attribute types are
860 This section holds initialized data that contribute to the program's
862 This section is of type
864 The attribute types are
869 This section holds information for symbolic debugging.
872 This section is of type
874 No attribute types are used.
876 This section holds dynamic linking information.
877 The section's attributes
883 bit is set is processor-specific.
884 This section is of type
886 See the attributes above.
888 This section holds strings needed for dynamic linking, most commonly
889 the strings that represent the names associated with symbol table entries.
890 This section is of type
892 The attribute type used is
895 This section holds the dynamic linking symbol table.
896 This section is of type
898 The attribute used is
901 This section holds executable instructions that contribute to the process
903 When a program exits normally the system arranges to
904 execute the code in this section.
905 This section is of type
907 The attributes used are
912 This section holds the global offset table.
913 This section is of type
915 The attributes are processor-specific.
917 This section holds a symbol hash table.
918 This section is of type
920 The attribute used is
923 This section holds executable instructions that contribute to the process
925 When a program starts to run the system arranges to
926 execute the code in this section before calling the main program entry point.
927 This section is of type
929 The attributes used are
934 This section holds the pathname of a program interpreter.
936 a loadable segment that includes the section, the section's attributes will
940 Otherwise, that bit will be off.
941 This section is of type
944 This section holds line number information for symbolic debugging, which
945 describes the correspondence between the program source and the machine code.
946 The contents are unspecified.
947 This section is of type
949 No attribute types are used.
951 This section holds information in the
953 format described below.
954 This section is of type
956 No attribute types are used.
958 This section holds the procedure linkage table.
959 This section is of type
961 The attributes are processor-specific.
963 This section holds relocation information as described below.
965 has a loadable segment that includes relocation, the section's attributes
969 Otherwise the bit will be off.
972 is supplied by the section to which the relocations apply.
976 normally would have the name
978 This section is of type
981 This section holds relocation information as described below.
983 has a loadable segment that includes relocation, the section's attributes
987 Otherwise the bit will be off.
990 is supplied by the section to which the relocations apply.
994 normally would have the name
996 This section is of type
999 This section holds read-only data that typically contributes to a
1000 non-writable segment in the process image.
1001 This section is of type
1003 The attribute used is
1006 This section hold read-only data that typically contributes to a
1007 non-writable segment in the process image.
1008 This section is of type
1010 The attribute used is
1013 This section holds section names.
1014 This section is of type
1016 No attribute types are used.
1018 This section holds strings, most commonly the strings that represent the
1019 names associated with symbol table entries.
1020 If the file has a loadable
1021 segment that includes the symbol string table, the section's attributes
1025 Otherwise the bit will be off.
1026 This section is of type
1029 This section holds a symbol table.
1030 If the file has a loadable segment
1031 that includes the symbol table, the section's attributes will include
1035 Otherwise the bit will be off.
1036 This section is of type
1039 This section holds the
1041 or executable instructions, of a program.
1042 This section is of type
1044 The attributes used are
1049 This section holds information about Java classes that must
1052 This section holds information used for C++ exception-handling.
1055 String table sections hold null-terminated character sequences, commonly
1057 The object file uses these strings to represent symbol
1059 One references a string as an index into the string
1061 The first byte, which is index zero, is defined to hold
1063 Similarly, a string table's last byte is defined to
1064 hold a null character, ensuring null termination for all strings.
1066 An object file's symbol table holds information needed to locate and
1067 relocate a program's symbolic definitions and references.
1069 index is a subscript into this array.
1071 .Bd -literal -offset indent
1074 Elf32_Addr st_value;
1076 unsigned char st_info;
1077 unsigned char st_other;
1078 Elf32_Half st_shndx;
1082 .Bd -literal -offset indent
1085 unsigned char st_info;
1086 unsigned char st_other;
1087 Elf64_Half st_shndx;
1088 Elf64_Addr st_value;
1089 Elf64_Xword st_size;
1093 .Bl -tag -width "st_value" -compact
1095 This member holds an index into the object file's symbol string table,
1096 which holds character representations of the symbol names.
1098 is non-zero, it represents a string table index that gives the symbol
1100 Otherwise, the symbol table has no name.
1102 This member gives the value of the associated symbol.
1104 Many symbols have associated sizes.
1105 This member holds zero if the symbol
1106 has no size or an unknown size.
1108 This member specifies the symbol's type and binding attributes:
1110 .Bl -tag -width "STT_SECTION" -compact
1112 The symbol's type is not defined.
1114 The symbol is associated with a data object.
1116 The symbol is associated with a function or other executable code.
1118 The symbol is associated with a section.
1119 Symbol table entries of
1120 this type exist primarily for relocation and normally have
1124 By convention the symbol's name gives the name of the source file
1125 associated with the object file.
1128 bindings, its section index is
1130 and it precedes the other
1132 symbols of the file, if it is present.
1134 This value up to and including
1136 are reserved for processor-specific semantics.
1138 This value down to and including
1140 are reserved for processor-specific semantics.
1143 .Bl -tag -width "STB_GLOBAL" -compact
1145 Local symbols are not visible outside the object file containing their
1147 Local symbols of the same name may exist in multiple file
1148 without interfering with each other.
1150 Global symbols are visible to all object files being combined.
1152 definition of a global symbol will satisfy another file's undefined
1153 reference to the same symbol.
1155 Weak symbols resemble global symbols, but their definitions have lower
1158 This value up to and including
1160 are reserved for processor-specific semantics.
1162 This value down to and including
1164 are reserved for processor-specific semantics.
1166 There are macros for packing and unpacking the binding and type fields:
1168 .Bl -tag -width "ELF32_ST_INFO(bind, type)" -compact
1170 .Fn ELF32_ST_BIND info
1173 .Fn ELF64_ST_BIND info
1174 extract a binding from an st_info value.
1176 .Fn ELF64_ST_TYPE info
1179 .Fn ELF32_ST_TYPE info
1180 extract a type from an st_info value.
1182 .Fn ELF32_ST_INFO bind type
1185 .Fn ELF64_ST_INFO bind type
1186 convert a binding and a type into an st_info value.
1191 This member currently holds zero and has no defined meaning.
1193 Every symbol table entry is
1195 in relation to some section.
1196 This member holds the relevant section
1200 Relocation is the process of connecting symbolic references with
1201 symbolic definitions.
1202 Relocatable files must have information that
1203 describes how to modify their section contents, thus allowing executable
1204 and shared object files to hold the right information for a process'
1206 Relocation entries are these data.
1208 Relocation structures that do not need an addend:
1210 .Bd -literal -offset indent
1212 Elf32_Addr r_offset;
1216 .Bd -literal -offset indent
1218 Elf64_Addr r_offset;
1223 Relocation structures that need an addend:
1225 .Bd -literal -offset indent
1227 Elf32_Addr r_offset;
1229 Elf32_Sword r_addend;
1232 .Bd -literal -offset indent
1234 Elf64_Addr r_offset;
1236 Elf64_Sxword r_addend;
1240 .Bl -tag -width "r_offset" -compact
1242 This member gives the location at which to apply the relocation action.
1243 For a relocatable file, the value is the byte offset from the beginning
1244 of the section to the storage unit affected by the relocation.
1246 executable file or shared object, the value is the virtual address of
1247 the storage unit affected by the relocation.
1249 This member gives both the symbol table index with respect to which the
1250 relocation must be made and the type of relocation to apply.
1252 types are processor-specific.
1253 When the text refers to a relocation
1254 entry's relocation type or symbol table index, it means the result of
1256 .Sy ELF_[32|64]_R_TYPE
1258 .Sy ELF[32|64]_R_SYM ,
1259 respectively to the entry's
1263 This member specifies a constant addend used to compute the value to be
1264 stored into the relocatable field.
1275 .%B Elf-64 Object File Format
1278 .%A Santa Cruz Operation
1279 .%B System V Application Binary Interface
1282 .%A Unix System Laboratories
1284 .%B "Executable and Linking Format (ELF)"
1287 The ELF header files made their appearance in
1289 ELF in itself first appeared in
1291 The ELF format is an adopted standard.
1293 This manual page was written by
1294 .An Jeroen Ruigrok van der Werven
1295 .Aq asmodai@FreeBSD.org
1296 with inspiration from BSDi's