Editing Executable and Linkable Format (section)

=== ELF header ===

The ELF header defines whether to use [[32-bit computing|32-bit]] or [[64-bit computing|64-bit]] addresses. The header contains three fields that are affected by this setting and offset other fields that follow them. The ELF header is 52 or 64 bytes long for 32-bit and 64-bit binaries, respectively.

{| class="wikitable"
|+ ELF header<ref>{{cite web|url=https://www.sco.com/developers/gabi/2000-07-17/ch4.eheader.html |title=ELF Header |publisher=Sco.com |date=July 2000 |access-date=2014-02-07}}</ref>
|-
! colspan="2" | Offset!! colspan="2" | Size (bytes) !! rowspan="2" | Field !! rowspan="2" | Purpose
|-
! 32-bit !! 64-bit !! 32-bit !! 64-bit
|-
| colspan="2" | {{tt|0x00}} || colspan="2" | 4 || {{mono|e_ident[EI_MAG0]}} through {{mono|e_ident[EI_MAG3]}}
| <code>0x7F</code> followed by <code>ELF</code>({{code|45 4c 46}}) in [[ASCII]]; these four bytes constitute the [[magic number (programming)|magic number]].
|-
| colspan="2" | {{tt|0x04}} || colspan="2" | 1 || {{mono|e_ident[EI_CLASS]}}
|This byte is set to either <code>1</code> or <code>2</code> to signify 32- or 64-bit format, respectively.
|-
| colspan="2" | {{tt|0x05}} || colspan="2" | 1 || {{mono|e_ident[EI_DATA]}}
|This byte is set to either <code>1</code> or <code>2</code> to signify little or big [[endianness]], respectively. This affects interpretation of multi-byte fields starting with offset <code>0x10</code>.
|-
| colspan="2" | {{tt|0x06}} || colspan="2" | 1 || {{mono|e_ident[EI_VERSION]}}
|Set to <code>1</code> for the original and current version of ELF.
|-
| colspan="2" | {{tt|0x07}} || colspan="2" | 1 || {{mono|e_ident[EI_OSABI]}}
|Identifies the target operating system [[application binary interface|ABI]].
{| class="wikitable"
|-
!Value!!ABI
|-
| {{tt|0x00}} ||[[System V]]
|-
| {{tt|0x01}} ||[[HP-UX]]
|-
| {{tt|0x02}} ||[[NetBSD]]
|-
| {{tt|0x03}} ||[[Linux]]
|-
| {{tt|0x04}} ||[[GNU Hurd]]
|-
| {{tt|0x06}} ||[[Solaris (operating system)|Solaris]]
|-
| {{tt|0x07}} ||[[IBM AIX|AIX]] (Monterey)
|-
| {{tt|0x08}} ||[[IRIX]]
|-
| {{tt|0x09}} ||[[FreeBSD]]
|-
| {{tt|0x0A}} ||[[Tru64]]
|-
| {{tt|0x0B}} ||Novell Modesto
|-
| {{tt|0x0C}} ||[[OpenBSD]]
|-
| {{tt|0x0D}} ||[[OpenVMS]]
|-
| {{tt|0x0E}} ||[[NonStop (server computers)|NonStop Kernel]]
|-
| {{tt|0x0F}} ||[[AROS Research Operating System|AROS]]
|-
| {{tt|0x10}} ||FenixOS
|-
| {{tt|0x11}} ||Nuxi [[CloudABI]]
|-
| {{tt|0x12}} ||[[Stratus VOS|Stratus Technologies OpenVOS]]
<!--
Unclear if ever used directly on [[RISC OS]] (it has an RISC OS file type, 0xE1F for ELF, for "elfrun"), seemingly only indirectly used with elf2aif tool (at least most of the time), to target RISC OS's AIF format:
https://heyrick.eu/blog/index.php?diary=20150727

https://www.riscosopen.org/wiki/documentation/show/File%20Types
-->
|}
|-
| colspan="2" | {{tt|0x08}} || colspan="2" | 1 || {{mono|e_ident[EI_ABIVERSION]}}
|Further specifies the ABI version. Its interpretation depends on the target ABI. Linux kernel (after at least 2.6) has no definition of it,<ref>{{cite web|url=http://lxr.linux.no/linux+v2.6.11/include/linux/elf.h#L380|title=LXR linux/include/linux/elf.h|website=linux.no|access-date=27 April 2015}}</ref> so it is ignored for statically linked executables. In that case, offset and size of EI_PAD are <code>8</code>.
glibc 2.12+ in case {{mono|1=e_ident[EI_OSABI] == 3}} treats this field as ABI version of the [[dynamic linker]]:<ref>{{cite web|url=https://sourceware.org/ml/libc-alpha/2010-05/msg00000.html|title=glibc 2.12 announce}}</ref> it defines a list of dynamic linker's features,<ref>{{cite web|url=https://sourceware.org/git/?p=glibc.git;a=blob;f=libc-abis;h=e702f6ae245c1528f5a608df8cfae4f037809de2;hb=HEAD|title=sourceware.org Git - glibc.git/blob - libc-abis}}</ref> treats {{mono|e_ident[EI_ABIVERSION]}} as a feature level requested by the shared object (executable or dynamic library) and refuses to load it if an unknown feature is requested, i.e. {{mono|e_ident[EI_ABIVERSION]}} is greater than the largest known feature.<ref>{{cite web|url=https://sourceware.org/git/?p=glibc.git%3Ba%3Dblob%3Bf%3Dsysdeps%2Fgnu%2Fldsodefs.h%3Bh%3D253b4d934c5ca457ab5580a2a6398205e4f961ba%3Bhb%3DHEAD#l32|title=sourceware.org Git - glibc.git/blob - sysdeps/gnu/ldsodefs.h|access-date=2019-10-28|archive-date=2021-03-07|archive-url=https://web.archive.org/web/20210307223850/https://sourceware.org/git/?p=glibc.git%3Ba%3Dblob%3Bf%3Dsysdeps%2Fgnu%2Fldsodefs.h%3Bh%3D253b4d934c5ca457ab5580a2a6398205e4f961ba%3Bhb%3DHEAD#l32|url-status=dead}}</ref>
|-
| colspan="2" | {{tt|0x09}} || colspan="2" | 7 || {{mono|e_ident[EI_PAD]}}
|Reserved padding bytes. Currently unused. Should be filled with zeros and ignored when read.
|-
| colspan="2" | {{tt|0x10}} || colspan="2" | 2 || {{mono|e_type}}
| Identifies object file type.
{| class="wikitable"
|-
!Value!!Type!!Meaning
|-
| {{tt|0x00}} ||ET_NONE||Unknown.
|-
| {{tt|0x01}} ||ET_REL||Relocatable file.
|-
| {{tt|0x02}} ||ET_EXEC||Executable file.
|-
| {{tt|0x03}} ||ET_DYN||Shared object.
|-
| {{tt|0x04}} ||ET_CORE||Core file.
|-
| {{tt|0xFE00}} ||ET_LOOS|| rowspan="2" | Reserved inclusive range. Operating system specific.
|-
| {{tt|0xFEFF}} ||ET_HIOS
|-
| {{tt|0xFF00}} ||ET_LOPROC|| rowspan="2" | Reserved inclusive range. Processor specific.
|-
| {{tt|0xFFFF}} ||ET_HIPROC
|} 
|-
| colspan="2" | {{tt|0x12}} || colspan="2" | 2 || {{mono|e_machine}}
|Specifies target [[instruction set architecture]]. Some examples are:
{| class="wikitable"
|-
!Value!!ISA
|-
| {{tt|0x00}} || No specific instruction set
|-
| {{tt|0x01}} || [[Bellmac 32|AT&T WE 32100]]
|-
| {{tt|0x02}} ||[[SPARC]]
|-
| {{tt|0x03}} ||[[x86]]
|-
| {{tt|0x04}} ||[[Motorola 68000 series|Motorola 68000 (M68k)]]
|-
| {{tt|0x05}} ||[[Motorola 88000|Motorola 88000 (M88k)]]
|-
| {{tt|0x06}} ||[[List of Intel processors#Microcontrollers|Intel MCU]]
|-
| {{tt|0x07}} ||[[Intel i860|Intel 80860]]
|-
| {{tt|0x08}} ||[[MIPS architecture|MIPS]]
|-
| {{tt|0x09}} ||[[IBM System/370]]
|-
| {{tt|0x0A}} ||[[R3000|MIPS RS3000 Little-endian]]
|-
| {{tt|0x0B – 0x0E}} ||Reserved for future use
|-
| {{tt|0x0F}} ||[[PA-RISC|Hewlett-Packard PA-RISC]]
|-
| {{tt|0x13}} ||[[Intel i960|Intel 80960]]
|-
| {{tt|0x14}} ||[[PowerPC]]
|-
| {{tt|0x15}} ||[[PowerPC]] (64-bit)
|-
| {{tt|0x16}} ||[[Z/Architecture|S390]], including S390x
|-
| {{tt|0x17}} ||IBM SPU/SPC
|-
| {{tt|0x18 – 0x23}} ||Reserved for future use
|-
| {{tt|0x24}} ||[[V850|NEC V800]]
|-
| {{tt|0x25}} ||Fujitsu FR20
|-
| {{tt|0x26}} ||[[RH-32|TRW RH-32]]
|-
| {{tt|0x27}} ||Motorola RCE
|-
| {{tt|0x28}} ||[[ARM architecture family|Arm]] (up to Armv7/AArch32)
|-
| {{tt|0x29}} ||[[Digital Alpha]]
|-
| {{tt|0x2A}} ||[[SuperH]]
|-
| {{tt|0x2B}} ||[[SPARC|SPARC Version 9]]
|-
| {{tt|0x2C}} ||[[Infineon TriCore|Siemens TriCore embedded processor]]
|-
| {{tt|0x2D}} ||[[ARC (processor)|Argonaut RISC Core]]
|-
| {{tt|0x2E}} ||[[H8 Family|Hitachi H8/300]]
|-
| {{tt|0x2F}} ||[[H8 Family|Hitachi H8/300H]]
|-
| {{tt|0x30}} ||[[H8 Family|Hitachi H8S]]
|-
| {{tt|0x31}} ||[[H8 Family|Hitachi H8/500]]
|-
| {{tt|0x32}} ||[[IA-64]]
|-
| {{tt|0x33}} ||[[MIPS-X|Stanford MIPS-X]]
|-
| {{tt|0x34}} ||[[NXP ColdFire|Motorola ColdFire]]
|-
| {{tt|0x35}} ||[[Motorola 68HC12|Motorola M68HC12]]
|-
| {{tt|0x36}} ||Fujitsu MMA Multimedia Accelerator
|-
| {{tt|0x37}} ||Siemens PCP
|-
| {{tt|0x38}} ||[[Cell (microprocessor)|Sony nCPU embedded RISC processor]]
|-
| {{tt|0x39}} ||Denso NDR1 microprocessor
|-
| {{tt|0x3A}} ||Motorola Star*Core processor
|-
| {{tt|0x3B}} ||Toyota ME16 processor
|-
| {{tt|0x3C}} ||STMicroelectronics ST100 processor
|-
| {{tt|0x3D}} ||Advanced Logic Corp. TinyJ embedded processor family
|-
| {{tt|0x3E}} ||[[amd64|AMD x86-64]]
|-
| {{tt|0x3F}} ||Sony DSP Processor
|-
| {{tt|0x40}} ||[[PDP-10|Digital Equipment Corp. PDP-10]]
|-
| {{tt|0x41}} ||[[PDP-11|Digital Equipment Corp. PDP-11]]
|-
| {{tt|0x42}} ||Siemens FX66 microcontroller
|-
| {{tt|0x43}} ||STMicroelectronics ST9+ 8/16 bit microcontroller
|-
| {{tt|0x44}} ||STMicroelectronics ST7 8-bit microcontroller
|-
| {{tt|0x45}} ||[[Motorola 68HC16|Motorola MC68HC16 Microcontroller]]
|-
| {{tt|0x46}} ||[[Motorola 68HC11|Motorola MC68HC11 Microcontroller]]
|-
| {{tt|0x47}} ||[[Motorola 68HC08|Motorola MC68HC08 Microcontroller]]
|-
| {{tt|0x48}} ||[[Motorola 68HC05|Motorola MC68HC05 Microcontroller]]
|-
| {{tt|0x49}} ||Silicon Graphics SVx
|-
| {{tt|0x4A}} ||STMicroelectronics ST19 8-bit microcontroller
|-
| {{tt|0x4B}} ||[[VAX|Digital VAX]]
|-
| {{tt|0x4C}} ||Axis Communications 32-bit embedded processor
|-
| {{tt|0x4D}} ||Infineon Technologies 32-bit embedded processor
|-
| {{tt|0x4E}} ||Element 14 64-bit DSP Processor
|-
| {{tt|0x4F}} ||LSI Logic 16-bit DSP Processor
|-
| {{tt|0x8C}} ||[[Texas Instruments TMS320#C6000 series|TMS320C6000 Family]]
|-
| {{tt|0xAF}} ||[[Elbrus 2000|MCST Elbrus e2k]]
|-
| {{tt|0xB7}} ||[[AArch64|Arm 64-bits]] (Armv8/AArch64)
|-
| {{tt|0xDC}} ||[[Zilog Z80]]
|-
| {{tt|0xF3}} ||[[RISC-V]]
|-
| {{tt|0xF7}} ||[[Berkeley Packet Filter]]
|-
|{{tt|0x101}}
|[[WDC 65C816]]
|-
|{{tt|0x102}}
|LoongArch
|}
|-
| colspan="2" | {{tt|0x14}} || colspan="2" | 4 || {{mono|e_version}}
|Set to <code>1</code> for the original version of ELF.
|-
| colspan="2" | {{tt|0x18}} || 4 || 8 || {{mono|e_entry}}
|This is the memory address of the [[entry point]] from where the process starts executing. This field is either 32 or 64 bits long, depending on the format defined earlier (byte 0x04). If the file doesn't have an associated entry point, then this holds zero.
|-
| {{tt|0x1C}} || {{tt|0x20}} || 4 || 8 || {{mono|e_phoff}}
|Points to the start of the program header table. It usually follows the file header immediately following this one, making the offset <code>0x34</code> or <code>0x40</code> for 32- and 64-bit ELF executables, respectively.
|-
| {{tt|0x20}} || {{tt|0x28}} || 4 || 8 || {{mono|e_shoff}}
|Points to the start of the section header table.
|-
| {{tt|0x24}} || {{tt|0x30}} || colspan="2" | 4 || {{mono|e_flags}}
|Interpretation of this field depends on the target architecture.
|-
| {{tt|0x28}} || {{tt|0x34}} || colspan="2" | 2 || {{mono|e_ehsize}}
|Contains the size of this header, normally 64 Bytes for 64-bit and 52 Bytes for 32-bit format.
|-
| {{tt|0x2A}} || {{tt|0x36}} || colspan="2" | 2 || {{mono|e_phentsize}}
|Contains the size of a program header table entry. As explained below, this will typically be 0x20 (32 bit) or 0x38 (64 bit).
|-
| {{tt|0x2C}} || {{tt|0x38}} || colspan="2" | 2 || {{mono|e_phnum}}
|Contains the number of entries in the program header table.
|-
| {{tt|0x2E}} || {{tt|0x3A}} || colspan="2" | 2 || {{mono|e_shentsize}}
|Contains the size of a section header table entry. As explained below, this will typically be 0x28 (32 bit) or 0x40 (64 bit).
|-
| {{tt|0x30}} || {{tt|0x3C}} || colspan="2" | 2 || {{mono|e_shnum}}
|Contains the number of entries in the section header table.
|-
| {{tt|0x32}} || {{tt|0x3E}} || colspan="2" | 2 || {{mono|e_shstrndx}}
|Contains index of the section header table entry that contains the section names.
|-
| {{tt|0x34}}
| {{tt|0x40}}
| colspan="3" |
|End of ELF Header (size).
|}