| Executable and Linkable Format | |
|---|---|
| Filename extension | none,.axf,.bin,.elf,.o,.out,.prx,.puff,.ko,.mod, and.so |
| Magic number | 0x7F 'E' 'L' 'F' |
| Developed by | Unix System Laboratories[1]: 3 |
| Initial release | 14 May 1998; 27 years ago (1998-05-14) |
| Latest release | |
| Type of format | Binary,executable,object,shared library,core dump |
| Container for | Many executable binary formats |

Incomputing, theExecutable and Linkable Format[3] (ELF, formerly namedExtensible Linking Format) is a common standardfile format forexecutable files,object code,shared libraries,device drivers, andcore dumps. First published in the specification for theapplication binary interface (ABI) of theUnix operating system version namedSystem V Release 4 (SVR4),[4] and later in the Tool Interface Standard,[1] it was quickly accepted among different vendors ofUnix systems. In 1999, it was chosen as the standard binary file format for Unix andUnix-like systems onx86 processors by the86open project.
By design, the ELF format is flexible, extensible, andcross-platform. For instance, it supports differentendiannesses and address sizes so it does not exclude any particularCPU orinstruction set architecture. This has allowed it to be adopted by many differentoperating systems on many different hardwareplatforms.
Each ELF file is made up of one ELF header, followed by file data. The data can include:

The segments contain information that is needed forrun time execution of the file, while sections contain important data for linking and relocation. Anybyte in the entire file can be owned by one section at most, and orphan bytes can occur which are unowned by any section.
The ELF header defines whether to use32-bit or64-bit addresses. The header contains three fields that are affected by this setting and offset other fields that follow them. The ELF header is 52 or 64 bytes long for 32-bit and 64-bit binaries, respectively.
| Offset | Size (bytes) | Field | Purpose | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 32-bit | 64-bit | 32-bit | 64-bit | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x00 | 4 | e_ident[EI_MAG0] throughe_ident[EI_MAG3] | 0x7F followed byELF(45 4c 46) inASCII; these four bytes constitute themagic number. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x04 | 1 | e_ident[EI_CLASS] | This byte is set to either1 or2 to signify 32- or 64-bit format, respectively. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x05 | 1 | e_ident[EI_DATA] | This byte is set to either1 or2 to signify little or bigendianness, respectively. This affects interpretation of multi-byte fields starting with offset0x10. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x06 | 1 | e_ident[EI_VERSION] | Set to1 for the original and current version of ELF. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x07 | 1 | e_ident[EI_OSABI] | Identifies the target operating systemABI.
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x08 | 1 | e_ident[EI_ABIVERSION] | Further specifies the ABI version. Its interpretation depends on the target ABI. Linux kernel (after at least 2.6) has no definition of it,[6] so it is ignored for statically linked executables. In that case, offset and size of EI_PAD are8.glibc 2.12+ in casee_ident[EI_OSABI] == 3 treats this field as ABI version of thedynamic linker:[7] it defines a list of dynamic linker's features,[8] treatse_ident[EI_ABIVERSION] as a feature level requested by the shared object (executable or dynamic library) and refuses to load it if an unknown feature is requested, i.e.e_ident[EI_ABIVERSION] is greater than the largest known feature.[9] | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x09 | 7 | e_ident[EI_PAD] | Reserved padding bytes. Currently unused. Should be filled with zeros and ignored when read. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x10 | 2 | e_type | Identifies object file type.
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x12 | 2 | e_machine | Specifies targetinstruction set architecture. Some examples are:
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x14 | 4 | e_version | Set to1 for the original version of ELF. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x18 | 4 | 8 | e_entry | This is the memory address of theentry point from where the process starts executing. This field is either 32 or 64 bits long, depending on the format defined earlier (byte 0x04). If the file doesn't have an associated entry point, then this holds zero. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x1C | 0x20 | 4 | 8 | e_phoff | Points to the start of the program header table. It usually follows the file header immediately following this one, making the offset0x34 or0x40 for 32- and 64-bit ELF executables, respectively. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x20 | 0x28 | 4 | 8 | e_shoff | Points to the start of the section header table. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x24 | 0x30 | 4 | e_flags | Interpretation of this field depends on the target architecture. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x28 | 0x34 | 2 | e_ehsize | Contains the size of this header, normally 64 Bytes for 64-bit and 52 Bytes for 32-bit format. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x2A | 0x36 | 2 | e_phentsize | Contains the size of a program header table entry. As explained below, this will typically be 0x20 (32-bit) or 0x38 (64-bit). | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x2C | 0x38 | 2 | e_phnum | Contains the number of entries in the program header table. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x2E | 0x3A | 2 | e_shentsize | Contains the size of a section header table entry. As explained below, this will typically be 0x28 (32-bit) or 0x40 (64-bit). | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x30 | 0x3C | 2 | e_shnum | Contains the number of entries in the section header table. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x32 | 0x3E | 2 | e_shstrndx | Contains index of the section header table entry that contains the section names. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x34 | 0x40 | End of ELF Header (size). | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
000000007f454c46020101000000000000000000|.ELF............|0000001002003e0001000000c548400000000000|..>......H@.....|
The program header table tells the system how to create a process image. It is found at file offsete_phoff, and consists ofe_phnum entries, each with sizee_phentsize. The layout is slightly different in32-bit ELF vs64-bit ELF, because thep_flags are in a different structure location for alignment reasons. Each entry is structured as:
| Offset | Size (bytes) | Field | Purpose | |||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 32-bit | 64-bit | 32-bit | 64-bit | |||||||||||||||||||||||||||||||||||||||
| 0x00 | 4 | p_type | Identifies the type of the segment.
| |||||||||||||||||||||||||||||||||||||||
| 0x04 | 4 | p_flags | Segment-dependent flags (position for 64-bit structure).
| |||||||||||||||||||||||||||||||||||||||
| 0x04 | 0x08 | 4 | 8 | p_offset | Offset of the segment in the file image. | |||||||||||||||||||||||||||||||||||||
| 0x08 | 0x10 | 4 | 8 | p_vaddr | Virtual address of the segment in memory. | |||||||||||||||||||||||||||||||||||||
| 0x0C | 0x18 | 4 | 8 | p_paddr | On systems where physical address is relevant, reserved for segment's physical address. | |||||||||||||||||||||||||||||||||||||
| 0x10 | 0x20 | 4 | 8 | p_filesz | Size in bytes of the segment in the file image. May be 0. | |||||||||||||||||||||||||||||||||||||
| 0x14 | 0x28 | 4 | 8 | p_memsz | Size in bytes of the segment in memory. May be 0. | |||||||||||||||||||||||||||||||||||||
| 0x18 | 4 | p_flags | Segment-dependent flags (position for 32-bit structure). See abovep_flags field for flag definitions. | |||||||||||||||||||||||||||||||||||||||
| 0x1C | 0x30 | 4 | 8 | p_align | 0 and1 specify no alignment. Otherwise should be a positive, integral power of 2, withp_vaddr equatingp_offset modulusp_align. | |||||||||||||||||||||||||||||||||||||
| 0x20 | 0x38 | End of Program Header (size). | ||||||||||||||||||||||||||||||||||||||||
| Offset | Size (bytes) | Field | Purpose | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 32-bit | 64-bit | 32-bit | 64-bit | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x00 | 4 | sh_name | An offset to a string in the.shstrtab section that represents the name of this section. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x04 | 4 | sh_type | Identifies the type of this header.
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x08 | 4 | 8 | sh_flags | Identifies the attributes of the section.
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x0C | 0x10 | 4 | 8 | sh_addr | Virtual address of the section in memory, for sections that are loaded. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x10 | 0x18 | 4 | 8 | sh_offset | Offset of the section in the file image. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x14 | 0x20 | 4 | 8 | sh_size | Size in bytes of the section. May be 0. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x18 | 0x28 | 4 | sh_link | Contains the section index of an associated section. This field is used for several purposes, depending on the type of section. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x1C | 0x2C | 4 | sh_info | Contains extra information about the section. This field is used for several purposes, depending on the type of section. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x20 | 0x30 | 4 | 8 | sh_addralign | Contains the required alignment of the section. This field must be a power of two. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x24 | 0x38 | 4 | 8 | sh_entsize | Contains the size, in bytes, of each entry, for sections that contain fixed-size entries. Otherwise, this field contains zero. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 0x28 | 0x40 | End of Section Header (size). | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
readelf is a Unix binary utility that displays information about one or more ELF files. Afree software implementation is provided byGNU Binutils.elfutils provides alternative tools toGNU Binutils purely for Linux.[12]elfdump is a command for viewing ELF information in an ELF file, available under Solaris andFreeBSD.objdump provides a wide range of information about ELF files and other object formats.objdump uses theBinary File Descriptor library as a back-end to structure the ELF data.file utility can display some information about ELF files, including theinstruction set architecture for which the code in a relocatable, executable, or shared object file is intended, or on which an ELFcore dump was produced.This articleis inlist format but may read better asprose. You can help byconverting this article, if appropriate.Editing help is available.(November 2016) |
The ELF format has replaced older executable formats in various environments.It has replaceda.out andCOFF formats inUnix-like operating systems:
ELF has also seen some adoption in non-Unix operating systems, such as:
Microsoft Windows also uses the ELF format, but only for itsWindows Subsystem for Linux compatibility system.[18]
Some game consoles also use ELF:
Other (operating) systems running on PowerPC that use ELF:
Some operating systems for mobile phones and mobile devices use ELF:
Some phones can run ELF files through the use of a patch that adds assembly code to the main firmware, which is a feature known asELFPack in the underground modding culture. The ELF file format is also used with theAtmel AVR (8-bit), AVR32[23]and with Texas Instruments MSP430 microcontroller architectures. Some implementations of Open Firmware can also load ELF files, most notably Apple's implementation used in almost all PowerPC machines the company produced.
86open was a project to form consensus on a common binary file format for Unix and Unix-like operating systems on the common PC compatible x86 architecture, to encourage software developers to port to the architecture.[25] The initial idea was to standardize on a small subset of Spec 1170, a predecessor of the Single UNIX Specification, and the GNU C Library (glibc) to enable unmodified binaries to run on the x86 Unix-like operating systems. The project was originally designated "Spec 150".
The format eventually chosen was ELF, specifically the Linux implementation of ELF, after it had turned out to be ade facto standard supported by all involved vendors and operating systems.
The group began email discussions in 1997 and first met together at the Santa Cruz Operation offices on August 22, 1997.
The steering committee was Marc Ewing, Dion Johnson, Evan Leibovitch,Bruce Perens, Andrew Roach, Bryan Wayne Sparks and Linus Torvalds. Other people on the project were Keith Bostic, Chuck Cranor, Michael Davidson, Chris G. Demetriou, Ulrich Drepper, Don Dugger, Steve Ginzburg, Jon "maddog" Hall, Ron Holt, Jordan Hubbard, Dave Jensen, Kean Johnston, Andrew Josey, Robert Lipe, Bela Lubkin, Tim Marsland, Greg Page, Ronald Joe Record, Tim Ruckle, Joel Silverstein, Chia-pi Tien, and Erik Troan. Operating systems and companies represented were BeOS, BSDI, FreeBSD,Intel, Linux, NetBSD, SCO and SunSoft.
The project progressed and in mid-1998, SCO began developing lxrun, an open-source compatibility layer able to run Linux binaries on OpenServer, UnixWare, and Solaris. SCO announced official support of lxrun at LinuxWorld in March 1999. Sun Microsystems began officially supporting lxrun for Solaris in early 1999,[26] and later moved to integrated support of the Linux binary format via Solaris Containers for Linux Applications.
With the BSDs having long supported Linux binaries (through a compatibility layer) and the main x86 Unix vendors having added support for the format, the project decided that Linux ELF was the format chosen by the industry and "declare[d] itself dissolved" on July 25, 1999.[27]
FatELF is an ELF binary-format extension that addsfat binary capabilities.[28] It is aimed for Linux and other Unix-like operating systems. Additionally to the CPU architecture abstraction (byte order, word size,CPU instruction set etc.), there is the potential advantage of software-platform abstraction e.g., binaries which support multiple kernel ABI versions. As of 2021[update], FatELF has not been integrated into the mainline Linux kernel.[29][30][31]
{{cite web}}: CS1 maint: archived copy as title (link)Dynamically linked libraries are also called shared objects (.so).
Solana leverages the LLVM compiler infrastructure to compile programs into Executable and Linkable Format (ELF) files.