Updated: 2022/Sep/29

Please read Privacy Policy. It's for your privacy.

ELF(5)                        File Formats Manual                       ELF(5)

     ELF - executable and linking format

     #include <elf.h>

     Because of the flexible nature of ELF, the structures describing it are
     available both as 32bit and 64bit versions. This document uses the 32bit
     versions, refer to <elf.h> for the corresponding 64bit versions.

     The four main types of an ELF object file are:

     executable   A file suitable for execution. It contains the information
                  required for creating a new process image.

     relocatable  Contains the necessary information to be run through the
                  link editor ld(1) to create an executable or a shared

     shared       The shared object contains necessary information which can
                  be used by either the link editor ld(1) at link time or by
                  the dynamic loader ld.elf_so(1) at run time.

     core         A file which describes the virtual address space and
                  register state of a process.  Core files are typically used
                  in conjunction with debuggers such as gdb(1).

     ELF files have a dual nature. The toolchain, including tools such as the
     as(1) and linker ld(1), treats them as a set of sections described by
     their section headers. The system loader treats them as a set of segments
     described by the program headers.

     The general format of an ELF file is the following: The file starts with
     an ELF header. This is followed by a table of program headers (optional
     for relocatable and shared files). After this come the sections/segments.
     The file ends with a table of section headers (optional for executable

     A segment can be considered to consist of several sections. For example,
     all executable sections are typically packed into one loadable segment
     which is read-only and executable (see p_flags in the program header).
     This enables the system to map the entire file with just a few
     operations, one for each loadable segment, instead of doing numerous map
     operations for each section separately.

     Each file is described by the ELF header:

           typedef struct {
                   unsigned char   e_ident[ELF_NIDENT];
                   Elf32_Half      e_type;
                   Elf32_Half      e_machine;
                   Elf32_Word      e_version;
                   Elf32_Addr      e_entry;
                   Elf32_Off       e_phoff;
                   Elf32_Off       e_shoff;
                   Elf32_Word      e_flags;
                   Elf32_Half      e_ehsize;
                   Elf32_Half      e_phentsize;
                   Elf32_Half      e_phnum;
                   Elf32_Half      e_shentsize;
                   Elf32_Half      e_shnum;
                   Elf32_Half      e_shstrndx;
           } Elf32_Ehdr;

     e_ident[]    The array contains the following information in the
                  indicated locations:

                  EI_MAG0        The elements ranging from EI_MAG0 to EI_MAG3
                                 contain the ELF magic number: \0177ELF

                  EI_CLASS       Contains the address size of the binary,
                                 either 32 or 64bit.

                  EI_DATA        byte order

                  EI_VERSION     Contains the ELF header version. This is
                                 currently always set to 1.

                  EI_OSABI       Contains the operating system ABI
                                 identification. Note that even though the
                                 definition ELFOSABI_NETBSD exists, NetBSD
                                 uses ELFOSABI_SYSV here, since the NetBSD ABI
                                 does not deviate from the standard.

                  EI_ABIVERSION  ABI version.

     e_type       Contains the file type identification. It can be either
                  ET_REL, ET_EXEC, ET_DYN, or ET_CORE for relocatable,
                  executable, shared, or core, respectively.

     e_machine    Contains the machine type, e.g. SPARC, Alpha, MIPS, ...

     e_entry      The program entry point if the file is executable.

     e_phoff      The position of the program header table in the file or 0 if
                  it doesn't exist.

     e_shoff      The position of the section header table in the file or 0 if
                  it doesn't exist.

     e_flags      Contains processor-specific flags. For example, the SPARC
                  port uses this space to specify what kind of memory store
                  ordering is required.

     e_ehsize     The size of the ELF header.

     e_phentsize  The size of an entry in the program header table. All
                  entries are the same size.

     e_phnum      The number of entries in the program header table, or 0 if
                  none exists.

     e_shentsize  The size of an entry in the section header table. All
                  entries are the same size.

     e_shnum      The number of entries in the section header table, or 0 if
                  none exists.

     e_shstrndx   Contains the index number of the section which contains the
                  section name strings.

     Each ELF section in turn is described by the section header:

           typedef struct {
                   Elf32_Word      sh_name;
                   Elf32_Word      sh_type;
                   Elf32_Word      sh_flags;
                   Elf32_Addr      sh_addr;
                   Elf32_Off       sh_offset;
                   Elf32_Word      sh_size;
                   Elf32_Word      sh_link;
                   Elf32_Word      sh_info;
                   Elf32_Word      sh_addralign;
                   Elf32_Word      sh_entsize;
           } Elf32_Shdr;

     sh_name       Contains an index to the position in the section header
                   string section where the name of the current section can be

     sh_type       Contains the section type indicator. The more important
                   possible values are:

                   SHT_NULL      Section is inactive. The other fields contain
                                 undefined values.

                   SHT_PROGBITS  Section contains program information. It can
                                 be for example code, data, or debugger

                   SHT_SYMTAB    Section contains a symbol table. This section
                                 usually contains all the symbols and is
                                 intended for the regular link editor ld(1).

                   SHT_STRTAB    Section contains a string table.

                   SHT_RELA      Section contains relocation information with
                                 an explicit addend.

                   SHT_HASH      Section contains a symbol hash table.

                   SHT_DYNAMIC   Section contains dynamic linking information.

                   SHT_NOTE      Section contains some special information.
                                 The format can be e.g.  vendor-specific.

                   SHT_NOBITS    Sections contains information similar to
                                 SHT_PROGBITS, but takes up no space in the
                                 file. This can be used for e.g. bss.

                   SHT_REL       Section contains relocation information
                                 without an explicit addend.

                   SHT_SHLIB     This section type is reserved but has
                                 unspecified semantics.

                   SHT_DYNSYM    Section contains a symbol table. This symbol
                                 table is intended for the dynamic linker, and
                                 is kept as small as possible to conserve
                                 space, since it must be loaded to memory at
                                 run time.

     sh_flags      Contains the section flags, which can have the following
                   values or any combination of them:

                   SHF_WRITE      Section is writable after it has been

                   SHF_ALLOC      Section will occupy memory at run time.

                   SHF_EXECINSTR  Section contains executable machine

     sh_addr       Address to where the section will be loaded, or 0 if this
                   section does not reside in memory at run time.

     sh_offset     The byte offset from the beginning of the file to the
                   beginning of this section. If the section is of type
                   SHT_NOBITS, this field specifies the conceptual placement
                   in the file.

     sh_size       The size of the section in the file for all types except
                   SHT_NOBITS.  For that type the value may differ from zero,
                   but the section will still always take up no space from the

     sh_link       Contains an index to the section header table. The
                   interpretation depends on the section type as follows:

                   SHT_RELA     Section index of the associated symbol table.

                   SHT_DYNSYM   Section index of the associated string table.

                   SHT_HASH     Section index of the symbol table to which the
                                hash table applies.

                   SHT_DYNAMIC  Section index of of the string table by which
                                entries in this section are used.

     sh_info       Contains extra information. The interpretation depends on
                   the type as follows:

                   SHT_RELA    Section index of the section to which the
                               relocation information applies.

                   SHT_DYNSYM  Contains a value one greater that the last
                               local symbol table index.

     sh_addralign  Marks the section alignment requirement. If, for example,
                   the section contains a doubleword, the entire section must
                   be doubleword aligned to ensure proper alignment. Only 0
                   and integral powers of two are allowed. Values 0 and 1
                   denote that the section has no alignment.

     sh_entsize    Contains the entry size of an element for sections which
                   are constructed of a table of fixed-size entries. If the
                   section does not hold a table of fixed-size entries, this
                   value is 0.

     Every executable object must contain a program header. The program header
     contains information necessary in constructing a process image.

           typedef struct {
                   Elf32_Word      p_type;
                   Elf32_Off       p_offset;
                   Elf32_Addr      p_vaddr;
                   Elf32_Addr      p_paddr;
                   Elf32_Word      p_filesz;
                   Elf32_Word      p_memsz;
                   Elf32_Word      p_flags;
                   Elf32_Word      p_align;
           } Elf32_Phdr;

     p_type    Contains the segment type indicator. The possible values are:

               PT_NULL     Segment is inactive. The other fields contain
                           undefined values.

               PT_LOAD     Segment is loadable. It is loaded to the address
                           described by p_vaddr.  If p_memsz is greater than
                           p_filesz, the memory range from (p_vaddr +
                           p_filesz) to (p_vaddr + p_memsz) is zero-filled
                           when the segment is loaded.  p_filesz can not be
                           greater than p_memsz.  Segments of this type are
                           sorted in the header table by p_vaddr in ascending

               PT_DYNAMIC  Segment contains dynamic linking information.

               PT_INTERP   Segment contains a null-terminated path name to the
                           interpreter. This segment may be present only once
                           in a file, and it must appear before any loadable
                           segments. This field will most likely contain the
                           ELF dynamic loader: /libexec/ld.elf_so

               PT_NOTE     Segment contains some special information. Format
                           can be e.g. vendor-specific.

               PT_SHLIB    This segment type is reserved but has unspecified
                           semantics. Programs which contain a segment of this
                           type do not conform to the ABI, and must indicate
                           this by setting the appropriate ABI in the ELF
                           header EI_OSABI field.

               PT_PHDR     The values in a program header of this type specify
                           the characteristics of the program header table
                           itself. For example, the p_vaddr field specifies
                           the program header table location in memory once
                           the program is loaded. This field may not occur
                           more than once, may occur only if the program
                           header table is part of the file memory image, and
                           must come before any loadable segments.

     p_offset  Contains the byte offset from the beginning of the file to the
               beginning of this segment.

     p_vaddr   Contains the virtual memory address to which this segment is

     p_paddr   Contains the physical address to which this segment is loaded.
               This value is usually ignored, but may be used while
               bootstrapping or in embedded systems.

     p_filesz  Contains the number of bytes this segment occupies in the file

     p_memsz   Contains the number of bytes this segment occupies in the
               memory image.

     p_flags   Contains the segment flags, which specify the permissions for
               the segment after it has been loaded. The following values or
               any combination of them is acceptable:

               PF_R  Segment can be read.

               PF_W  Segment can be written.

               PF_X  Segment is executable.

     p_align   Contains the segment alignment. Acceptable values are 0 and 1
               for no alignment, and integral powers of two.  p_vaddr should
               equal p_offset modulo p_align.

     as(1), gdb(1), ld(1), ld.elf_so(1), execve(2), nlist(3), a.out(5),
     core(5), link(5), stab(5)

     The ELF object file format first appeared in AT&T System V UNIX.

NetBSD 10.99                   November 18, 2006                  NetBSD 10.99