1ELF(5)                        File Formats Manual                       ELF(5)
2
3
4

NAME

6       elf - format of Executable and Linking Format (ELF) files
7

SYNOPSIS

9       #include <elf.h>
10

DESCRIPTION

12       The  header  file  <elf.h>  defines the format of ELF executable binary
13       files.  Amongst these files are normal  executable  files,  relocatable
14       object files, core files, and shared objects.
15
16       An executable file using the ELF file format consists of an ELF header,
17       followed by a program header table or a section header table, or  both.
18       The  ELF  header  is  always  at  offset zero of the file.  The program
19       header table and the section header table's offset in the file are  de‐
20       fined  in the ELF header.  The two tables describe the rest of the par‐
21       ticularities of the file.
22
23       This header file describes the above mentioned headers as C  structures
24       and  also includes structures for dynamic sections, relocation sections
25       and symbol tables.
26
27   Basic types
28       The following types are used for  N-bit  architectures  (N=32,64,  ElfN
29       stands for Elf32 or Elf64, uintN_t stands for uint32_t or uint64_t):
30
31           ElfN_Addr       Unsigned program address, uintN_t
32           ElfN_Off        Unsigned file offset, uintN_t
33           ElfN_Section    Unsigned section index, uint16_t
34           ElfN_Versym     Unsigned version symbol information, uint16_t
35           Elf_Byte        unsigned char
36           ElfN_Half       uint16_t
37           ElfN_Sword      int32_t
38           ElfN_Word       uint32_t
39           ElfN_Sxword     int64_t
40           ElfN_Xword      uint64_t
41
42       (Note:  the  *BSD terminology is a bit different.  There, Elf64_Half is
43       twice as large as Elf32_Half, and Elf64Quarter is  used  for  uint16_t.
44       In  order  to avoid confusion these types are replaced by explicit ones
45       in the below.)
46
47       All data structures that the file format defines follow  the  "natural"
48       size  and  alignment  guidelines for the relevant class.  If necessary,
49       data structures contain explicit padding to ensure 4-byte alignment for
50       4-byte objects, to force structure sizes to a multiple of 4, and so on.
51
52   ELF header (Ehdr)
53       The ELF header is described by the type Elf32_Ehdr or Elf64_Ehdr:
54
55           #define EI_NIDENT 16
56
57           typedef struct {
58               unsigned char e_ident[EI_NIDENT];
59               uint16_t      e_type;
60               uint16_t      e_machine;
61               uint32_t      e_version;
62               ElfN_Addr     e_entry;
63               ElfN_Off      e_phoff;
64               ElfN_Off      e_shoff;
65               uint32_t      e_flags;
66               uint16_t      e_ehsize;
67               uint16_t      e_phentsize;
68               uint16_t      e_phnum;
69               uint16_t      e_shentsize;
70               uint16_t      e_shnum;
71               uint16_t      e_shstrndx;
72           } ElfN_Ehdr;
73
74       The fields have the following meanings:
75
76       e_ident
77              This  array  of bytes specifies how to interpret the file, inde‐
78              pendent of the  processor  or  the  file's  remaining  contents.
79              Within  this  array  everything  is named by macros, which start
80              with the prefix EI_ and may contain values which start with  the
81              prefix ELF.  The following macros are defined:
82
83              EI_MAG0
84                     The  first  byte  of the magic number.  It must be filled
85                     with ELFMAG0.  (0: 0x7f)
86
87              EI_MAG1
88                     The second byte of the magic number.  It must  be  filled
89                     with ELFMAG1.  (1: 'E')
90
91              EI_MAG2
92                     The  third  byte  of the magic number.  It must be filled
93                     with ELFMAG2.  (2: 'L')
94
95              EI_MAG3
96                     The fourth byte of the magic number.  It must  be  filled
97                     with ELFMAG3.  (3: 'F')
98
99              EI_CLASS
100                     The  fifth  byte identifies the architecture for this bi‐
101                     nary:
102
103                     ELFCLASSNONE  This class is invalid.
104                     ELFCLASS32    This defines the 32-bit  architecture.   It
105                                   supports  machines  with  files and virtual
106                                   address spaces up to 4 Gigabytes.
107                     ELFCLASS64    This defines the 64-bit architecture.
108
109              EI_DATA
110                     The sixth byte specifies the data encoding of the proces‐
111                     sor-specific  data  in the file.  Currently, these encod‐
112                     ings are supported:
113
114                       ELFDATANONE   Unknown data format.
115                       ELFDATA2LSB   Two's complement, little-endian.
116                       ELFDATA2MSB   Two's complement, big-endian.
117
118              EI_VERSION
119                     The seventh byte is the version number of the ELF  speci‐
120                     fication:
121
122                     EV_NONE       Invalid version.
123                     EV_CURRENT    Current version.
124
125              EI_OSABI
126                     The  eighth  byte identifies the operating system and ABI
127                     to which the object is targeted.  Some  fields  in  other
128                     ELF  structures have flags and values that have platform-
129                     specific meanings; the interpretation of those fields  is
130                     determined by the value of this byte.  For example:
131
132                     ELFOSABI_NONE        Same as ELFOSABI_SYSV
133                     ELFOSABI_SYSV        UNIX System V ABI
134                     ELFOSABI_HPUX        HP-UX ABI
135                     ELFOSABI_NETBSD      NetBSD ABI
136                     ELFOSABI_LINUX       Linux ABI
137                     ELFOSABI_SOLARIS     Solaris ABI
138                     ELFOSABI_IRIX        IRIX ABI
139                     ELFOSABI_FREEBSD     FreeBSD ABI
140                     ELFOSABI_TRU64       TRU64 UNIX ABI
141                     ELFOSABI_ARM         ARM architecture ABI
142                     ELFOSABI_STANDALONE  Stand-alone (embedded) ABI
143
144              EI_ABIVERSION
145                     The ninth byte identifies the version of the ABI to which
146                     the object is targeted.  This field is  used  to  distin‐
147                     guish  among incompatible versions of an ABI.  The inter‐
148                     pretation of this version number is dependent on the  ABI
149                     identified  by the EI_OSABI field.  Applications conform‐
150                     ing to this specification use the value 0.
151
152              EI_PAD Start of padding.  These bytes are reserved  and  set  to
153                     zero.   Programs which read them should ignore them.  The
154                     value for EI_PAD will change in the future  if  currently
155                     unused bytes are given meanings.
156
157              EI_NIDENT
158                     The size of the e_ident array.
159
160       e_type This member of the structure identifies the object file type:
161
162              ET_NONE         An unknown type.
163              ET_REL          A relocatable file.
164              ET_EXEC         An executable file.
165              ET_DYN          A shared object.
166              ET_CORE         A core file.
167
168       e_machine
169              This  member specifies the required architecture for an individ‐
170              ual file.  For example:
171
172              EM_NONE         An unknown machine
173              EM_M32          AT&T WE 32100
174              EM_SPARC        Sun Microsystems SPARC
175              EM_386          Intel 80386
176              EM_68K          Motorola 68000
177              EM_88K          Motorola 88000
178              EM_860          Intel 80860
179              EM_MIPS         MIPS RS3000 (big-endian only)
180              EM_PARISC       HP/PA
181              EM_SPARC32PLUS  SPARC with enhanced instruction set
182              EM_PPC          PowerPC
183              EM_PPC64        PowerPC 64-bit
184              EM_S390         IBM S/390
185              EM_ARM          Advanced RISC Machines
186              EM_SH           Renesas SuperH
187              EM_SPARCV9      SPARC v9 64-bit
188              EM_IA_64        Intel Itanium
189              EM_X86_64       AMD x86-64
190              EM_VAX          DEC Vax
191
192       e_version
193              This member identifies the file version:
194
195              EV_NONE         Invalid version
196              EV_CURRENT      Current version
197
198       e_entry
199              This member gives the virtual address to which the system  first
200              transfers  control,  thus starting the process.  If the file has
201              no associated entry point, this member holds zero.
202
203       e_phoff
204              This member holds the program  header  table's  file  offset  in
205              bytes.   If  the  file  has no program header table, this member
206              holds zero.
207
208       e_shoff
209              This member holds the section  header  table's  file  offset  in
210              bytes.   If  the  file  has no section header table, this member
211              holds zero.
212
213       e_flags
214              This member holds processor-specific flags associated  with  the
215              file.   Flag  names take the form EF_`machine_flag'.  Currently,
216              no flags have been defined.
217
218       e_ehsize
219              This member holds the ELF header's size in bytes.
220
221       e_phentsize
222              This member holds the size in bytes of one entry in  the  file's
223              program header table; all entries are the same size.
224
225       e_phnum
226              This  member  holds  the number of entries in the program header
227              table.  Thus the product of e_phentsize and  e_phnum  gives  the
228              table's size in bytes.  If a file has no program header, e_phnum
229              holds the value zero.
230
231              If the number of entries in the program header table  is  larger
232              than  or  equal  to  PN_XNUM (0xffff), this member holds PN_XNUM
233              (0xffff) and the real number of entries in  the  program  header
234              table is held in the sh_info member of the initial entry in sec‐
235              tion header table.  Otherwise, the sh_info member of the initial
236              entry contains the value zero.
237
238              PN_XNUM
239                     This is defined as 0xffff, the largest number e_phnum can
240                     have, specifying where the actual number of program head‐
241                     ers is assigned.
242
243       e_shentsize
244              This  member holds a sections header's size in bytes.  A section
245              header is one entry in the section header table; all entries are
246              the same size.
247
248       e_shnum
249              This  member  holds  the number of entries in the section header
250              table.  Thus the product of e_shentsize and  e_shnum  gives  the
251              section  header table's size in bytes.  If a file has no section
252              header table, e_shnum holds the value of zero.
253
254              If the number of entries in the section header table  is  larger
255              than or equal to SHN_LORESERVE (0xff00), e_shnum holds the value
256              zero and the real number of entries in the section header  table
257              is  held  in  the sh_size member of the initial entry in section
258              header table.  Otherwise, the sh_size member of the initial  en‐
259              try in the section header table holds the value zero.
260
261       e_shstrndx
262              This  member  holds  the section header table index of the entry
263              associated with the section name string table.  If the file  has
264              no  section  name  string  table,  this  member  holds the value
265              SHN_UNDEF.
266
267              If the index of section name string table section is larger than
268              or equal to SHN_LORESERVE (0xff00), this member holds SHN_XINDEX
269              (0xffff) and the real index of the  section  name  string  table
270              section  is  held  in the sh_link member of the initial entry in
271              section header table.  Otherwise, the sh_link member of the ini‐
272              tial entry in section header table contains the value zero.
273
274   Program header (Phdr)
275       An  executable or shared object file's program header table is an array
276       of structures, each describing a segment or other information the  sys‐
277       tem needs to prepare the program for execution.  An object file segment
278       contains one or more sections.  Program headers are meaningful only for
279       executable  and  shared object files.  A file specifies its own program
280       header size with the ELF header's e_phentsize and e_phnum members.  The
281       ELF  program  header  is described by the type Elf32_Phdr or Elf64_Phdr
282       depending on the architecture:
283
284           typedef struct {
285               uint32_t   p_type;
286               Elf32_Off  p_offset;
287               Elf32_Addr p_vaddr;
288               Elf32_Addr p_paddr;
289               uint32_t   p_filesz;
290               uint32_t   p_memsz;
291               uint32_t   p_flags;
292               uint32_t   p_align;
293           } Elf32_Phdr;
294
295           typedef struct {
296               uint32_t   p_type;
297               uint32_t   p_flags;
298               Elf64_Off  p_offset;
299               Elf64_Addr p_vaddr;
300               Elf64_Addr p_paddr;
301               uint64_t   p_filesz;
302               uint64_t   p_memsz;
303               uint64_t   p_align;
304           } Elf64_Phdr;
305
306       The main difference between the 32-bit and the  64-bit  program  header
307       lies in the location of the p_flags member in the total struct.
308
309       p_type This member of the structure indicates what kind of segment this
310              array element describes or how to interpret the array  element's
311              information.
312
313                 PT_NULL
314                        The  array  element  is  unused and the other members'
315                        values are undefined.  This lets  the  program  header
316                        have ignored entries.
317
318                 PT_LOAD
319                        The  array  element  specifies a loadable segment, de‐
320                        scribed by p_filesz and p_memsz.  The bytes  from  the
321                        file  are  mapped  to the beginning of the memory seg‐
322                        ment.  If the segment's memory size p_memsz is  larger
323                        than the file size p_filesz, the "extra" bytes are de‐
324                        fined to hold the value 0 and to follow the  segment's
325                        initialized  area.   The  file  size may not be larger
326                        than the memory size.  Loadable segment entries in the
327                        program header table appear in ascending order, sorted
328                        on the p_vaddr member.
329
330                 PT_DYNAMIC
331                        The array element specifies dynamic  linking  informa‐
332                        tion.
333
334                 PT_INTERP
335                        The array element specifies the location and size of a
336                        null-terminated pathname to invoke as an  interpreter.
337                        This  segment  type  is meaningful only for executable
338                        files (though it may occur for shared objects).   How‐
339                        ever it may not occur more than once in a file.  If it
340                        is present, it must precede any loadable  segment  en‐
341                        try.
342
343                 PT_NOTE
344                        The  array  element  specifies  the  location of notes
345                        (ElfN_Nhdr).
346
347                 PT_SHLIB
348                        This segment type is reserved but has unspecified  se‐
349                        mantics.   Programs  that  contain an array element of
350                        this type do not conform to the ABI.
351
352                 PT_PHDR
353                        The array element, if present, specifies the  location
354                        and  size  of the program header table itself, both in
355                        the file and in the memory image of the program.  This
356                        segment  type  may not occur more than once in a file.
357                        Moreover, it may occur only if the program header  ta‐
358                        ble is part of the memory image of the program.  If it
359                        is present, it must precede any loadable  segment  en‐
360                        try.
361
362                 PT_LOPROC, PT_HIPROC
363                        Values  in  the inclusive range [PT_LOPROC, PT_HIPROC]
364                        are reserved for processor-specific semantics.
365
366                 PT_GNU_STACK
367                        GNU extension which is used by  the  Linux  kernel  to
368                        control  the  state  of the stack via the flags set in
369                        the p_flags member.
370
371       p_offset
372              This member holds the offset from the beginning of the  file  at
373              which the first byte of the segment resides.
374
375       p_vaddr
376              This member holds the virtual address at which the first byte of
377              the segment resides in memory.
378
379       p_paddr
380              On systems for which physical addressing is relevant, this  mem‐
381              ber  is  reserved for the segment's physical address.  Under BSD
382              this member is not used and must be zero.
383
384       p_filesz
385              This member holds the number of bytes in the file image  of  the
386              segment.  It may be zero.
387
388       p_memsz
389              This member holds the number of bytes in the memory image of the
390              segment.  It may be zero.
391
392       p_flags
393              This member holds a bit mask of flags relevant to the segment:
394
395              PF_X   An executable segment.
396              PF_W   A writable segment.
397              PF_R   A readable segment.
398
399              A text segment commonly has the flags PF_X and PF_R  .   A  data
400              segment commonly has PF_W and PF_R.
401
402       p_align
403              This member holds the value to which the segments are aligned in
404              memory and in the file.  Loadable  process  segments  must  have
405              congruent values for p_vaddr and p_offset, modulo the page size.
406              Values of zero and one mean no alignment  is  required.   Other‐
407              wise,  p_align  should be a positive, integral power of two, and
408              p_vaddr should equal p_offset, modulo p_align.
409
410   Section header (Shdr)
411       A file's section header table lets one locate all the file's  sections.
412       The section header table is an array of Elf32_Shdr or Elf64_Shdr struc‐
413       tures.  The ELF header's e_shoff member gives the byte offset from  the
414       beginning  of  the file to the section header table.  e_shnum holds the
415       number of entries the section header table contains.  e_shentsize holds
416       the size in bytes of each entry.
417
418       A section header table index is a subscript into this array.  Some sec‐
419       tion header table indices are reserved: the initial entry and  the  in‐
420       dices  between  SHN_LORESERVE  and SHN_HIRESERVE.  The initial entry is
421       used in ELF extensions for e_phnum, e_shnum, and e_shstrndx;  in  other
422       cases,  each field in the initial entry is set to zero.  An object file
423       does not have sections for these special indices:
424
425       SHN_UNDEF
426              This value marks an undefined, missing, irrelevant, or otherwise
427              meaningless section reference.
428
429       SHN_LORESERVE
430              This  value  specifies  the lower bound of the range of reserved
431              indices.
432
433       SHN_LOPROC, SHN_HIPROC
434              Values greater in the inclusive range  [SHN_LOPROC,  SHN_HIPROC]
435              are reserved for processor-specific semantics.
436
437       SHN_ABS
438              This  value  specifies  the absolute value for the corresponding
439              reference.  For example, a symbol defined  relative  to  section
440              number  SHN_ABS has an absolute value and is not affected by re‐
441              location.
442
443       SHN_COMMON
444              Symbols defined relative to this  section  are  common  symbols,
445              such as FORTRAN COMMON or unallocated C external variables.
446
447       SHN_HIRESERVE
448              This  value  specifies  the upper bound of the range of reserved
449              indices.  The system reserves indices between SHN_LORESERVE  and
450              SHN_HIRESERVE,  inclusive.   The  section  header table does not
451              contain entries for the reserved indices.
452
453       The section header has the following structure:
454
455           typedef struct {
456               uint32_t   sh_name;
457               uint32_t   sh_type;
458               uint32_t   sh_flags;
459               Elf32_Addr sh_addr;
460               Elf32_Off  sh_offset;
461               uint32_t   sh_size;
462               uint32_t   sh_link;
463               uint32_t   sh_info;
464               uint32_t   sh_addralign;
465               uint32_t   sh_entsize;
466           } Elf32_Shdr;
467
468           typedef struct {
469               uint32_t   sh_name;
470               uint32_t   sh_type;
471               uint64_t   sh_flags;
472               Elf64_Addr sh_addr;
473               Elf64_Off  sh_offset;
474               uint64_t   sh_size;
475               uint32_t   sh_link;
476               uint32_t   sh_info;
477               uint64_t   sh_addralign;
478               uint64_t   sh_entsize;
479           } Elf64_Shdr;
480
481       No real differences exist between the 32-bit and 64-bit  section  head‐
482       ers.
483
484       sh_name
485              This  member specifies the name of the section.  Its value is an
486              index into the section header string table section,  giving  the
487              location of a null-terminated string.
488
489       sh_type
490              This member categorizes the section's contents and semantics.
491
492              SHT_NULL
493                     This value marks the section header as inactive.  It does
494                     not have an associated section.   Other  members  of  the
495                     section header have undefined values.
496
497              SHT_PROGBITS
498                     This  section  holds  information defined by the program,
499                     whose format and meaning are  determined  solely  by  the
500                     program.
501
502              SHT_SYMTAB
503                     This section holds a symbol table.  Typically, SHT_SYMTAB
504                     provides symbols for link editing, though it may also  be
505                     used for dynamic linking.  As a complete symbol table, it
506                     may contain many symbols unnecessary for dynamic linking.
507                     An object file can also contain a SHT_DYNSYM section.
508
509              SHT_STRTAB
510                     This  section  holds  a string table.  An object file may
511                     have multiple string table sections.
512
513              SHT_RELA
514                     This section holds relocation entries with  explicit  ad‐
515                     dends,  such  as  type Elf32_Rela for the 32-bit class of
516                     object files.  An object  may  have  multiple  relocation
517                     sections.
518
519              SHT_HASH
520                     This  section  holds a symbol hash table.  An object par‐
521                     ticipating in dynamic linking must contain a symbol  hash
522                     table.  An object file may have only one hash table.
523
524              SHT_DYNAMIC
525                     This  section  holds information for dynamic linking.  An
526                     object file may have only one dynamic section.
527
528              SHT_NOTE
529                     This section holds notes (ElfN_Nhdr).
530
531              SHT_NOBITS
532                     A section of this type occupies no space in the file  but
533                     otherwise  resembles SHT_PROGBITS.  Although this section
534                     contains no bytes, the sh_offset member contains the con‐
535                     ceptual file offset.
536
537              SHT_REL
538                     This  section  holds  relocation offsets without explicit
539                     addends, such as type Elf32_Rel for the 32-bit  class  of
540                     object  files.   An object file may have multiple reloca‐
541                     tion sections.
542
543              SHT_SHLIB
544                     This section is reserved but has unspecified semantics.
545
546              SHT_DYNSYM
547                     This section holds a minimal set of dynamic linking  sym‐
548                     bols.   An object file can also contain a SHT_SYMTAB sec‐
549                     tion.
550
551              SHT_LOPROC, SHT_HIPROC
552                     Values in the inclusive  range  [SHT_LOPROC,  SHT_HIPROC]
553                     are reserved for processor-specific semantics.
554
555              SHT_LOUSER
556                     This  value specifies the lower bound of the range of in‐
557                     dices reserved for application programs.
558
559              SHT_HIUSER
560                     This value specifies the upper bound of the range of  in‐
561                     dices  reserved  for application programs.  Section types
562                     between SHT_LOUSER and SHT_HIUSER may be used by the  ap‐
563                     plication,  without  conflicting  with  current or future
564                     system-defined section types.
565
566       sh_flags
567              Sections support one-bit flags that describe  miscellaneous  at‐
568              tributes.   If  a  flag bit is set in sh_flags, the attribute is
569              "on" for the section.  Otherwise, the attribute is "off" or does
570              not apply.  Undefined attributes are set to zero.
571
572              SHF_WRITE
573                     This section contains data that should be writable during
574                     process execution.
575
576              SHF_ALLOC
577                     This section occupies memory  during  process  execution.
578                     Some  control  sections do not reside in the memory image
579                     of an object file.  This attribute is off for those  sec‐
580                     tions.
581
582              SHF_EXECINSTR
583                     This section contains executable machine instructions.
584
585              SHF_MASKPROC
586                     All  bits  included in this mask are reserved for proces‐
587                     sor-specific semantics.
588
589       sh_addr
590              If this section appears in the memory image of a  process,  this
591              member  holds  the  address  at  which  the section's first byte
592              should reside.  Otherwise, the member contains zero.
593
594       sh_offset
595              This member's value holds the byte offset from the beginning  of
596              the  file  to  the first byte in the section.  One section type,
597              SHT_NOBITS, occupies no space in the  file,  and  its  sh_offset
598              member locates the conceptual placement in the file.
599
600       sh_size
601              This  member holds the section's size in bytes.  Unless the sec‐
602              tion type is SHT_NOBITS, the section occupies sh_size  bytes  in
603              the file.  A section of type SHT_NOBITS may have a nonzero size,
604              but it occupies no space in the file.
605
606       sh_link
607              This member holds a section header table index link,  whose  in‐
608              terpretation depends on the section type.
609
610       sh_info
611              This  member  holds  extra information, whose interpretation de‐
612              pends on the section type.
613
614       sh_addralign
615              Some sections have address alignment constraints.  If a  section
616              holds  a doubleword, the system must ensure doubleword alignment
617              for the entire section.  That is, the value of sh_addr  must  be
618              congruent  to zero, modulo the value of sh_addralign.  Only zero
619              and positive integral powers of two are allowed.  The value 0 or
620              1 means that the section has no alignment constraints.
621
622       sh_entsize
623              Some  sections  hold  a  table of fixed-sized entries, such as a
624              symbol table.  For such a section, this member gives the size in
625              bytes  for each entry.  This member contains zero if the section
626              does not hold a table of fixed-size entries.
627
628       Various sections hold program and control information:
629
630       .bss   This section holds uninitialized data that  contributes  to  the
631              program's  memory  image.  By definition, the system initializes
632              the data with zeros when the program begins to run.   This  sec‐
633              tion  is  of type SHT_NOBITS.  The attribute types are SHF_ALLOC
634              and SHF_WRITE.
635
636       .comment
637              This section holds version control information.  This section is
638              of type SHT_PROGBITS.  No attribute types are used.
639
640       .ctors This  section  holds initialized pointers to the C++ constructor
641              functions.  This section is of type SHT_PROGBITS.  The attribute
642              types are SHF_ALLOC and SHF_WRITE.
643
644       .data  This  section holds initialized data that contribute to the pro‐
645              gram's memory image.  This section is of type SHT_PROGBITS.  The
646              attribute types are SHF_ALLOC and SHF_WRITE.
647
648       .data1 This  section holds initialized data that contribute to the pro‐
649              gram's memory image.  This section is of type SHT_PROGBITS.  The
650              attribute types are SHF_ALLOC and SHF_WRITE.
651
652       .debug This section holds information for symbolic debugging.  The con‐
653              tents are unspecified.  This section is  of  type  SHT_PROGBITS.
654              No attribute types are used.
655
656       .dtors This  section  holds  initialized pointers to the C++ destructor
657              functions.  This section is of type SHT_PROGBITS.  The attribute
658              types are SHF_ALLOC and SHF_WRITE.
659
660       .dynamic
661              This  section  holds dynamic linking information.  The section's
662              attributes  will  include  the  SHF_ALLOC  bit.    Whether   the
663              SHF_WRITE  bit is set is processor-specific.  This section is of
664              type SHT_DYNAMIC.  See the attributes above.
665
666       .dynstr
667              This section holds strings needed for dynamic linking, most com‐
668              monly  the strings that represent the names associated with sym‐
669              bol table entries.  This section is of type SHT_STRTAB.  The at‐
670              tribute type used is SHF_ALLOC.
671
672       .dynsym
673              This  section holds the dynamic linking symbol table.  This sec‐
674              tion is of type SHT_DYNSYM.  The attribute used is SHF_ALLOC.
675
676       .fini  This section holds executable instructions  that  contribute  to
677              the process termination code.  When a program exits normally the
678              system arranges to execute the code in this section.  This  sec‐
679              tion is of type SHT_PROGBITS.  The attributes used are SHF_ALLOC
680              and SHF_EXECINSTR.
681
682       .gnu.version
683              This section  holds  the  version  symbol  table,  an  array  of
684              ElfN_Half  elements.   This  section  is of type SHT_GNU_versym.
685              The attribute type used is SHF_ALLOC.
686
687       .gnu.version_d
688              This section holds the version symbol definitions,  a  table  of
689              ElfN_Verdef structures.  This section is of type SHT_GNU_verdef.
690              The attribute type used is SHF_ALLOC.
691
692       .gnu.version_r
693              This section holds the version symbol needed elements,  a  table
694              of   ElfN_Verneed   structures.    This   section   is  of  type
695              SHT_GNU_versym.  The attribute type used is SHF_ALLOC.
696
697       .got   This section holds the global offset table.  This section is  of
698              type SHT_PROGBITS.  The attributes are processor-specific.
699
700       .hash  This section holds a symbol hash table.  This section is of type
701              SHT_HASH.  The attribute used is SHF_ALLOC.
702
703       .init  This section holds executable instructions  that  contribute  to
704              the  process  initialization code.  When a program starts to run
705              the system arranges to execute the code in this  section  before
706              calling  the  main program entry point.  This section is of type
707              SHT_PROGBITS.  The attributes used are SHF_ALLOC and SHF_EXECIN‐
708              STR.
709
710       .interp
711              This  section  holds  the pathname of a program interpreter.  If
712              the file has a loadable segment that includes the  section,  the
713              section's attributes will include the SHF_ALLOC bit.  Otherwise,
714              that bit will be off.  This section is of type SHT_PROGBITS.
715
716       .line  This section holds line number information for  symbolic  debug‐
717              ging,  which  describes  the  correspondence between the program
718              source and the machine  code.   The  contents  are  unspecified.
719              This  section  is  of type SHT_PROGBITS.  No attribute types are
720              used.
721
722       .note  This section holds various  notes.   This  section  is  of  type
723              SHT_NOTE.  No attribute types are used.
724
725       .note.ABI-tag
726              This section is used to declare the expected run-time ABI of the
727              ELF image.  It may include the operating  system  name  and  its
728              run-time  versions.  This section is of type SHT_NOTE.  The only
729              attribute used is SHF_ALLOC.
730
731       .note.gnu.build-id
732              This section is used to hold an ID that uniquely identifies  the
733              contents  of the ELF image.  Different files with the same build
734              ID  should  contain  the  same  executable  content.   See   the
735              --build-id  option  to the GNU linker (ld (1)) for more details.
736              This section is of type SHT_NOTE.  The only  attribute  used  is
737              SHF_ALLOC.
738
739       .note.GNU-stack
740              This  section  is used in Linux object files for declaring stack
741              attributes.  This section is of type SHT_PROGBITS.  The only at‐
742              tribute used is SHF_EXECINSTR.  This indicates to the GNU linker
743              that the object file requires an executable stack.
744
745       .note.openbsd.ident
746              OpenBSD native executables usually contain this section to iden‐
747              tify  themselves  so the kernel can bypass any compatibility ELF
748              binary emulation tests when loading the file.
749
750       .plt   This section holds the procedure linkage table.  This section is
751              of type SHT_PROGBITS.  The attributes are processor-specific.
752
753       .relNAME
754              This  section  holds  relocation information as described below.
755              If the file has a loadable segment that includes relocation, the
756              section's attributes will include the SHF_ALLOC bit.  Otherwise,
757              the bit will be off.  By convention, "NAME" is supplied  by  the
758              section  to which the relocations apply.  Thus a relocation sec‐
759              tion for .text normally would have  the  name  .rel.text.   This
760              section is of type SHT_REL.
761
762       .relaNAME
763              This  section  holds  relocation information as described below.
764              If the file has a loadable segment that includes relocation, the
765              section's attributes will include the SHF_ALLOC bit.  Otherwise,
766              the bit will be off.  By convention, "NAME" is supplied  by  the
767              section  to which the relocations apply.  Thus a relocation sec‐
768              tion for .text normally would have the  name  .rela.text.   This
769              section is of type SHT_RELA.
770
771       .rodata
772              This  section holds read-only data that typically contributes to
773              a nonwritable segment in the process image.  This section is  of
774              type SHT_PROGBITS.  The attribute used is SHF_ALLOC.
775
776       .rodata1
777              This  section holds read-only data that typically contributes to
778              a nonwritable segment in the process image.  This section is  of
779              type SHT_PROGBITS.  The attribute used is SHF_ALLOC.
780
781       .shstrtab
782              This  section  holds  section  names.   This  section is of type
783              SHT_STRTAB.  No attribute types are used.
784
785       .strtab
786              This section holds strings, most commonly the strings that  rep‐
787              resent  the  names associated with symbol table entries.  If the
788              file has a loadable segment that includes the symbol string  ta‐
789              ble,  the  section's  attributes will include the SHF_ALLOC bit.
790              Otherwise, the bit  will  be  off.   This  section  is  of  type
791              SHT_STRTAB.
792
793       .symtab
794              This  section  holds a symbol table.  If the file has a loadable
795              segment that includes the symbol table, the section's attributes
796              will include the SHF_ALLOC bit.  Otherwise, the bit will be off.
797              This section is of type SHT_SYMTAB.
798
799       .text  This section holds the "text", or executable instructions, of  a
800              program.   This section is of type SHT_PROGBITS.  The attributes
801              used are SHF_ALLOC and SHF_EXECINSTR.
802
803   String and symbol tables
804       String table sections hold null-terminated  character  sequences,  com‐
805       monly  called strings.  The object file uses these strings to represent
806       symbol and section names.  One references a string as an index into the
807       string  table section.  The first byte, which is index zero, is defined
808       to hold a null byte ('\0').  Similarly, a string table's last  byte  is
809       defined to hold a null byte, ensuring null termination for all strings.
810
811       An  object  file's  symbol table holds information needed to locate and
812       relocate a program's symbolic definitions and references.  A symbol ta‐
813       ble index is a subscript into this array.
814
815           typedef struct {
816               uint32_t      st_name;
817               Elf32_Addr    st_value;
818               uint32_t      st_size;
819               unsigned char st_info;
820               unsigned char st_other;
821               uint16_t      st_shndx;
822           } Elf32_Sym;
823
824           typedef struct {
825               uint32_t      st_name;
826               unsigned char st_info;
827               unsigned char st_other;
828               uint16_t      st_shndx;
829               Elf64_Addr    st_value;
830               uint64_t      st_size;
831           } Elf64_Sym;
832
833       The 32-bit and 64-bit versions have the same members, just in a differ‐
834       ent order.
835
836       st_name
837              This member holds an index into the object file's symbol  string
838              table,  which  holds  character  representations  of  the symbol
839              names.  If the value is nonzero, it represents  a  string  table
840              index  that gives the symbol name.  Otherwise, the symbol has no
841              name.
842
843       st_value
844              This member gives the value of the associated symbol.
845
846       st_size
847              Many symbols have associated sizes.  This member holds  zero  if
848              the symbol has no size or an unknown size.
849
850       st_info
851              This member specifies the symbol's type and binding attributes:
852
853              STT_NOTYPE
854                     The symbol's type is not defined.
855
856              STT_OBJECT
857                     The symbol is associated with a data object.
858
859              STT_FUNC
860                     The  symbol  is  associated with a function or other exe‐
861                     cutable code.
862
863              STT_SECTION
864                     The symbol is associated with a  section.   Symbol  table
865                     entries  of  this type exist primarily for relocation and
866                     normally have STB_LOCAL bindings.
867
868              STT_FILE
869                     By convention, the symbol's name gives the  name  of  the
870                     source file associated with the object file.  A file sym‐
871                     bol has STB_LOCAL bindings, its section index is SHN_ABS,
872                     and  it precedes the other STB_LOCAL symbols of the file,
873                     if it is present.
874
875              STT_LOPROC, STT_HIPROC
876                     Values in the inclusive  range  [STT_LOPROC,  STT_HIPROC]
877                     are reserved for processor-specific semantics.
878
879              STB_LOCAL
880                     Local  symbols  are  not  visible outside the object file
881                     containing their definition.  Local symbols of  the  same
882                     name may exist in multiple files without interfering with
883                     each other.
884
885              STB_GLOBAL
886                     Global symbols are visible to all object files being com‐
887                     bined.   One  file's  definition  of a global symbol will
888                     satisfy another file's undefined reference  to  the  same
889                     symbol.
890
891              STB_WEAK
892                     Weak  symbols  resemble global symbols, but their defini‐
893                     tions have lower precedence.
894
895              STB_LOPROC, STB_HIPROC
896                     Values in the inclusive  range  [STB_LOPROC,  STB_HIPROC]
897                     are reserved for processor-specific semantics.
898
899              There  are macros for packing and unpacking the binding and type
900              fields:
901
902              ELF32_ST_BIND(info), ELF64_ST_BIND(info)
903                     Extract a binding from an st_info value.
904
905              ELF32_ST_TYPE(info), ELF64_ST_TYPE(info)
906                     Extract a type from an st_info value.
907
908              ELF32_ST_INFO(bind, type), ELF64_ST_INFO(bind, type)
909                     Convert a binding and a type into an st_info value.
910
911       st_other
912              This member defines the symbol visibility.
913
914              STV_DEFAULT
915                     Default symbol visibility rules.  Global and weak symbols
916                     are  available  to other modules; references in the local
917                     module can be interposed by definitions in other modules.
918              STV_INTERNAL
919                     Processor-specific hidden class.
920              STV_HIDDEN
921                     Symbol is unavailable to other modules; references in the
922                     local  module  always  resolve to the local symbol (i.e.,
923                     the symbol can't be interposed by  definitions  in  other
924                     modules).
925              STV_PROTECTED
926                     Symbol  is  available to other modules, but references in
927                     the local module always resolve to the local symbol.
928
929              There are macros for extracting the visibility type:
930
931              ELF32_ST_VISIBILITY(other) or ELF64_ST_VISIBILITY(other)
932
933       st_shndx
934              Every symbol table entry is "defined" in relation to  some  sec‐
935              tion.   This  member holds the relevant section header table in‐
936              dex.
937
938   Relocation entries (Rel & Rela)
939       Relocation is the process of connecting symbolic references  with  sym‐
940       bolic  definitions.   Relocatable  files must have information that de‐
941       scribes how to modify their section contents, thus allowing  executable
942       and  shared  object files to hold the right information for a process's
943       program image.  Relocation entries are these data.
944
945       Relocation structures that do not need an addend:
946
947           typedef struct {
948               Elf32_Addr r_offset;
949               uint32_t   r_info;
950           } Elf32_Rel;
951
952           typedef struct {
953               Elf64_Addr r_offset;
954               uint64_t   r_info;
955           } Elf64_Rel;
956
957       Relocation structures that need an addend:
958
959           typedef struct {
960               Elf32_Addr r_offset;
961               uint32_t   r_info;
962               int32_t    r_addend;
963           } Elf32_Rela;
964
965           typedef struct {
966               Elf64_Addr r_offset;
967               uint64_t   r_info;
968               int64_t    r_addend;
969           } Elf64_Rela;
970
971       r_offset
972              This member gives the location at which to apply the  relocation
973              action.   For  a  relocatable file, the value is the byte offset
974              from the beginning of the section to the storage  unit  affected
975              by the relocation.  For an executable file or shared object, the
976              value is the virtual address of the storage unit affected by the
977              relocation.
978
979       r_info This  member  gives  both the symbol table index with respect to
980              which the relocation must be made and the type of relocation  to
981              apply.   Relocation types are processor-specific.  When the text
982              refers to a relocation entry's relocation type or  symbol  table
983              index,  it  means  the  result  of applying ELF[32|64]_R_TYPE or
984              ELF[32|64]_R_SYM, respectively, to the entry's r_info member.
985
986       r_addend
987              This member specifies a constant  addend  used  to  compute  the
988              value to be stored into the relocatable field.
989
990   Dynamic tags (Dyn)
991       The .dynamic section contains a series of structures that hold relevant
992       dynamic linking information.  The d_tag member controls the interpreta‐
993       tion of d_un.
994
995           typedef struct {
996               Elf32_Sword    d_tag;
997               union {
998                   Elf32_Word d_val;
999                   Elf32_Addr d_ptr;
1000               } d_un;
1001           } Elf32_Dyn;
1002           extern Elf32_Dyn _DYNAMIC[];
1003
1004           typedef struct {
1005               Elf64_Sxword    d_tag;
1006               union {
1007                   Elf64_Xword d_val;
1008                   Elf64_Addr  d_ptr;
1009               } d_un;
1010           } Elf64_Dyn;
1011           extern Elf64_Dyn _DYNAMIC[];
1012
1013       d_tag  This member may have any of the following values:
1014
1015              DT_NULL     Marks end of dynamic section
1016
1017              DT_NEEDED   String table offset to name of a needed library
1018
1019              DT_PLTRELSZ Size in bytes of PLT relocation entries
1020
1021              DT_PLTGOT   Address of PLT and/or GOT
1022
1023              DT_HASH     Address of symbol hash table
1024
1025              DT_STRTAB   Address of string table
1026
1027              DT_SYMTAB   Address of symbol table
1028
1029              DT_RELA     Address of Rela relocation table
1030
1031              DT_RELASZ   Size in bytes of the Rela relocation table
1032
1033              DT_RELAENT  Size in bytes of a Rela relocation table entry
1034
1035              DT_STRSZ    Size in bytes of string table
1036
1037              DT_SYMENT   Size in bytes of a symbol table entry
1038
1039              DT_INIT     Address of the initialization function
1040
1041              DT_FINI     Address of the termination function
1042
1043              DT_SONAME   String table offset to name of shared object
1044
1045              DT_RPATH    String  table  offset to library search path (depre‐
1046                          cated)
1047
1048              DT_SYMBOLIC Alert linker to search this shared object before the
1049                          executable for symbols
1050
1051              DT_REL      Address of Rel relocation table
1052
1053              DT_RELSZ    Size in bytes of Rel relocation table
1054
1055              DT_RELENT   Size in bytes of a Rel table entry
1056
1057              DT_PLTREL   Type  of  relocation  entry  to which the PLT refers
1058                          (Rela or Rel)
1059
1060              DT_DEBUG    Undefined use for debugging
1061
1062              DT_TEXTREL  Absence of this entry indicates that  no  relocation
1063                          entries should apply to a nonwritable segment
1064
1065              DT_JMPREL   Address of relocation entries associated solely with
1066                          the PLT
1067
1068              DT_BIND_NOW Instruct dynamic linker to process  all  relocations
1069                          before transferring control to the executable
1070
1071              DT_RUNPATH  String table offset to library search path
1072
1073              DT_LOPROC, DT_HIPROC
1074                          Values in the inclusive range [DT_LOPROC, DT_HIPROC]
1075                          are reserved for processor-specific semantics
1076
1077       d_val  This member represents integer values with  various  interpreta‐
1078              tions.
1079
1080       d_ptr  This  member  represents program virtual addresses.  When inter‐
1081              preting these addresses, the actual address should  be  computed
1082              based on the original file value and memory base address.  Files
1083              do not contain relocation entries to fixup these addresses.
1084
1085       _DYNAMIC
1086              Array containing all the dynamic structures in the .dynamic sec‐
1087              tion.  This is automatically populated by the linker.
1088
1089   Notes (Nhdr)
1090       ELF  notes  allow for appending arbitrary information for the system to
1091       use.  They are largely used by core files (e_type of ET_CORE), but many
1092       projects define their own set of extensions.  For example, the GNU tool
1093       chain uses ELF notes to pass information from the linker to the  C  li‐
1094       brary.
1095
1096       Note sections contain a series of notes (see the struct definitions be‐
1097       low).  Each note is followed by the name field (whose length is defined
1098       in  n_namesz) and then by the descriptor field (whose length is defined
1099       in n_descsz) and whose starting address has a 4 byte  alignment.   Nei‐
1100       ther  field  is  defined  in  the  note  struct  due to their arbitrary
1101       lengths.
1102
1103       An example for parsing out two consecutive notes should  clarify  their
1104       layout in memory:
1105
1106           void *memory, *name, *desc;
1107           Elf64_Nhdr *note, *next_note;
1108
1109           /* The buffer is pointing to the start of the section/segment. */
1110           note = memory;
1111
1112           /* If the name is defined, it follows the note. */
1113           name = note->n_namesz == 0 ? NULL : memory + sizeof(*note);
1114
1115           /* If the descriptor is defined, it follows the name
1116              (with alignment). */
1117
1118           desc = note->n_descsz == 0 ? NULL :
1119                  memory + sizeof(*note) + ALIGN_UP(note->n_namesz, 4);
1120
1121           /* The next note follows both (with alignment). */
1122           next_note = memory + sizeof(*note) +
1123                                ALIGN_UP(note->n_namesz, 4) +
1124                                ALIGN_UP(note->n_descsz, 4);
1125
1126       Keep in mind that the interpretation of n_type depends on the namespace
1127       defined by the n_namesz field.  If the n_namesz field is not set (e.g.,
1128       is 0), then there are two sets of notes: one for core files and one for
1129       all other ELF types.  If the namespace is unknown, then tools will usu‐
1130       ally fallback to these sets of notes as well.
1131
1132           typedef struct {
1133               Elf32_Word n_namesz;
1134               Elf32_Word n_descsz;
1135               Elf32_Word n_type;
1136           } Elf32_Nhdr;
1137
1138           typedef struct {
1139               Elf64_Word n_namesz;
1140               Elf64_Word n_descsz;
1141               Elf64_Word n_type;
1142           } Elf64_Nhdr;
1143
1144       n_namesz
1145              The  length of the name field in bytes.  The contents will imme‐
1146              diately follow this note in memory.  The  name  is  null  termi‐
1147              nated.  For example, if the name is "GNU", then n_namesz will be
1148              set to 4.
1149
1150       n_descsz
1151              The length of the descriptor field in bytes.  The contents  will
1152              immediately follow the name field in memory.
1153
1154       n_type Depending  on  the value of the name field, this member may have
1155              any of the following values:
1156
1157              Core files (e_type = ET_CORE)
1158                   Notes used by all core files.  These are  highly  operating
1159                   system or architecture specific and often require close co‐
1160                   ordination with kernels, C libraries, and debuggers.  These
1161                   are  used when the namespace is the default (i.e., n_namesz
1162                   will be set to 0), or a fallback when the namespace is  un‐
1163                   known.
1164
1165                   NT_PRSTATUS          prstatus struct
1166                   NT_FPREGSET          fpregset struct
1167                   NT_PRPSINFO          prpsinfo struct
1168                   NT_PRXREG            prxregset struct
1169                   NT_TASKSTRUCT        task structure
1170                   NT_PLATFORM          String from sysinfo(SI_PLATFORM)
1171                   NT_AUXV              auxv array
1172                   NT_GWINDOWS          gwindows struct
1173                   NT_ASRS              asrset struct
1174                   NT_PSTATUS           pstatus struct
1175                   NT_PSINFO            psinfo struct
1176                   NT_PRCRED            prcred struct
1177                   NT_UTSNAME           utsname struct
1178                   NT_LWPSTATUS         lwpstatus struct
1179                   NT_LWPSINFO          lwpinfo struct
1180                   NT_PRFPXREG          fprxregset struct
1181                   NT_SIGINFO           siginfo_t  (size  might  increase over
1182                                        time)
1183                   NT_FILE              Contains  information   about   mapped
1184                                        files
1185                   NT_PRXFPREG          user_fxsr_struct
1186                   NT_PPC_VMX           PowerPC Altivec/VMX registers
1187                   NT_PPC_SPE           PowerPC SPE/EVR registers
1188                   NT_PPC_VSX           PowerPC VSX registers
1189                   NT_386_TLS           i386 TLS slots (struct user_desc)
1190                   NT_386_IOPERM        x86 io permission bitmap (1=deny)
1191                   NT_X86_XSTATE        x86 extended state using xsave
1192                   NT_S390_HIGH_GPRS    s390 upper register halves
1193                   NT_S390_TIMER        s390 timer register
1194                   NT_S390_TODCMP       s390  time-of-day (TOD) clock compara‐
1195                                        tor register
1196                   NT_S390_TODPREG      s390  time-of-day  (TOD)  programmable
1197                                        register
1198                   NT_S390_CTRS         s390 control registers
1199                   NT_S390_PREFIX       s390 prefix register
1200                   NT_S390_LAST_BREAK   s390 breaking event address
1201                   NT_S390_SYSTEM_CALL  s390 system call restart data
1202                   NT_S390_TDB          s390 transaction diagnostic block
1203                   NT_ARM_VFP           ARM VFP/NEON registers
1204                   NT_ARM_TLS           ARM TLS register
1205                   NT_ARM_HW_BREAK      ARM hardware breakpoint registers
1206                   NT_ARM_HW_WATCH      ARM hardware watchpoint registers
1207                   NT_ARM_SYSTEM_CALL   ARM system call number
1208
1209              n_name = GNU
1210                   Extensions used by the GNU tool chain.
1211
1212                   NT_GNU_ABI_TAG
1213                          Operating  system  (OS)  ABI  information.  The desc
1214                          field will be 4 words:
1215
1216                          [0]  OS        descriptor        (ELF_NOTE_OS_LINUX,
1217                               ELF_NOTE_OS_GNU, and so on)`
1218                          [1]  major version of the ABI
1219                          [2]  minor version of the ABI
1220                          [3]  subminor version of the ABI
1221
1222                   NT_GNU_HWCAP
1223                          Synthetic  hwcap information.  The desc field begins
1224                          with two words:
1225
1226                          [0]  number of entries
1227                          [1]  bit mask of enabled entries
1228
1229                          Then follow variable-length entries, one  byte  fol‐
1230                          lowed  by  a null-terminated hwcap name string.  The
1231                          byte gives the bit number to test if enabled, (1U <<
1232                          bit) & bit mask.
1233
1234                   NT_GNU_BUILD_ID
1235                          Unique  build  ID  as  generated  by  the  GNU ld(1)
1236                          --build-id option.  The desc consists of any nonzero
1237                          number of bytes.
1238
1239                   NT_GNU_GOLD_VERSION
1240                          The desc contains the GNU Gold linker version used.
1241
1242              Default/unknown namespace (e_type != ET_CORE)
1243                   These  are  used  when  the namespace is the default (i.e.,
1244                   n_namesz will be set to 0), or a fallback  when  the  name‐
1245                   space is unknown.
1246
1247                   NT_VERSION  A version string of some sort.
1248                   NT_ARCH     Architecture information.
1249

NOTES

1251       ELF first appeared in System V.  The ELF format is an adopted standard.
1252
1253       The  extensions  for  e_phnum, e_shnum, and e_shstrndx respectively are
1254       Linux extensions.  Sun, BSD, and AMD64 also support them;  for  further
1255       information, look under SEE ALSO.
1256

SEE ALSO

1258       as(1),   elfedit(1),  gdb(1),  ld(1),  nm(1),  objcopy(1),  objdump(1),
1259       patchelf(1),  readelf(1),  size(1),  strings(1),  strip(1),  execve(2),
1260       dl_iterate_phdr(3), core(5), ld.so(8)
1261
1262       Hewlett-Packard, Elf-64 Object File Format.
1263
1264       Santa Cruz Operation, System V Application Binary Interface.
1265
1266       UNIX System Laboratories, "Object Files", Executable and Linking Format
1267       (ELF).
1268
1269       Sun Microsystems, Linker and Libraries Guide.
1270
1271       AMD64 ABI Draft, System V Application Binary Interface AMD64  Architec‐
1272       ture Processor Supplement.
1273
1274
1275
1276Linux man-pages 6.05              2023-05-03                            ELF(5)
Impressum