Executable and Linkable Format

Filename extensionnone, .axf, .bin, .elf, .o, .prx, .puff, .ko, .mod and .so
Magic number0x7F 'E' 'L' 'F'
Developed byUnix System Laboratories[1]:3
Type of formatBinary, executable, object, shared library, core dump
Container forMany executable binary formats
An ELF file has two views: the program header shows the segments used at run time, whereas the section header lists the set of sections of the binary.

In computing, the Executable and Linkable Format (ELF, formerly named Extensible Linking Format), is a common standard file format for executable files, object code, shared libraries, and core dumps. First published in the specification for the application binary interface (ABI) of the Unix operating system version named System V Release 4 (SVR4),[2] and later in the Tool Interface Standard,[1] it was quickly accepted among different vendors of Unix systems. In 1999, it was chosen as the standard binary file format for Unix and Unix-like systems on x86 processors by the 86open project.

By design, the ELF format is flexible, extensible, and cross-platform. For instance it supports different endiannesses and address sizes so it does not exclude any particular central processing unit (CPU) or instruction set architecture. This has allowed it to be adopted by many different operating systems on many different hardware platforms.

File layout

Each ELF file is made up of one ELF header, followed by file data. The data can include:

  • Program header table, describing zero or more memory segments
  • Section header table, describing zero or more sections
  • Data referred to by entries in the program header table or section header table

The segments contain information that is needed for run time execution of the file, while sections contain important data for linking and relocation. Any byte in the entire file can be owned by one section at most, and orphan bytes can occur which are unowned by any section.

00000000 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 |.ELF............|

00000010 02 00 3e 00 01 00 00 00 c5 48 40 00 00 00 00 00 |..>[email protected]|

Example hexdump of ELF file header[3]

File header

The ELF header defines whether to use 32- or 64-bit addresses. The header contains three fields that are affected by this setting and offset other fields that follow them. The ELF header is 52 or 64 bytes long for 32-bit and 64-bit binaries respectively.

ELF header[4]
Offset Size (bytes) Field Purpose
32-bit 64-bit 32-bit 64-bit
0x00 4 e_ident[EI_MAG0] through e_ident[EI_MAG3] 0x7F followed by ELF(45 4c 46) in ASCII; these four bytes constitute the magic number.
0x04 1 e_ident[EI_CLASS] This byte is set to either 1 or 2 to signify 32- or 64-bit format, respectively.
0x05 1 e_ident[EI_DATA] This byte is set to either 1 or 2 to signify little or big endianness, respectively. This affects interpretation of multi-byte fields starting with offset 0x10.
0x06 1 e_ident[EI_VERSION] Set to 1 for the original version of ELF.
0x07 1 e_ident[EI_OSABI] Identifies the target operating system ABI.
Value ABI
0x00 System V
0x01 HP-UX
0x02 NetBSD
0x03 Linux
0x04 GNU Hurd
0x06 Solaris
0x07 AIX
0x08 IRIX
0x09 FreeBSD
0x0A Tru64
0x0B Novell Modesto
0x0C OpenBSD
0x0D OpenVMS
0x0E NonStop Kernel
0x10 Fenix OS
0x11 CloudABI

It is often set to 0 regardless of the target platform.

0x08 1 e_ident[EI_ABIVERSION] Further specifies the ABI version. Its interpretation depends on the target ABI. Linux kernel (after at least 2.6) has no definition of it.[5] In that case, offset and size of EI_PAD are 8.
0x09 7 e_ident[EI_PAD] currently unused
0x10 2 e_type Identifies object file type.
Value Type
0x00 ET_NONE
0x01 ET_REL
0x02 ET_EXEC
0x03 ET_DYN
0x04 ET_CORE
0xfe00 ET_LOOS
0xfeff ET_HIOS
0xff00 ET_LOPROC
0xffff ET_HIPROC
0x12 2 e_machine Specifies target instruction set architecture. Some examples are:
Value ISA
0x00 No specific instruction set
0x02 SPARC
0x03 x86
0x08 MIPS
0x14 PowerPC
0x16 S390
0x28 ARM
0x2A SuperH
0x32 IA-64
0x3E x86-64
0xB7 AArch64
0x14 4 e_version Set to 1 for the original version of ELF.
0x18 4 8 e_entry This is the memory address of the entry point from where the process starts executing. This field is either 32 or 64 bits long depending on the format defined earlier.
0x1C 0x20 4 8 e_phoff Points to the start of the program header table. It usually follows the file header immediately, making the offset 0x34 or 0x40 for 32- and 64-bit ELF executables, respectively.
0x20 0x28 4 8 e_shoff Points to the start of the section header table.
0x24 0x30 4 e_flags Interpretation of this field depends on the target architecture.
0x28 0x34 2 e_ehsize Contains the size of this header, normally 64 Bytes for 64-bit and 52 Bytes for 32-bit format.
0x2A 0x36 2 e_phentsize Contains the size of a program header table entry.
0x2C 0x38 2 e_phnum Contains the number of entries in the program header table.
0x2E 0x3A 2 e_shentsize Contains the size of a section header table entry.
0x30 0x3C 2 e_shnum Contains the number of entries in the section header table.
0x32 0x3E 2 e_shstrndx Contains index of the section header table entry that contains the section names.

Program header

The program header table tells the system how to create a process image. It is found at file offset e_phoff, and consists of e_phnum entries, each with size e_phentsize. The layout is slightly different in 32-bit ELF vs 64-bit ELF, because the p_flags are in a different structure location for alignment reasons. Each entry is structured as:

Program header[6]
Offset Size (bytes) Field Purpose
32-bit 64-bit 32-bit 64-bit
0x00 4 p_type Identifies the type of the segment.
Value Name
0x00000000 PT_NULL
0x00000001 PT_LOAD
0x00000002 PT_DYNAMIC
0x00000003 PT_INTERP
0x00000004 PT_NOTE
0x00000005 PT_SHLIB
0x00000006 PT_PHDR
0x60000000 PT_LOOS
0x70000000 PT_LOPROC

PT_LOOS to PT_HIOS (PT_LOPROC to PT_HIPROC) is an inclusive reserved ranges for operating system (processor) specific semantics.

0x04 4 p_flags Segment-dependent flags (position for 64-bit structure).
0x04 0x08 4 8 p_offset Offset of the segment in the file image.
0x08 0x10 4 8 p_vaddr Virtual address of the segment in memory.
0x0C 0x18 4 8 p_paddr On systems where physical address is relevant, reserved for segment's physical address.
0x10 0x20 4 8 p_filesz Size in bytes of the segment in the file image. May be 0.
0x14 0x28 4 8 p_memsz Size in bytes of the segment in memory. May be 0.
0x18 4 p_flags Segment-dependent flags (position for 32-bit structure).
0x1C 0x30 4 8 p_align 0 and 1 specify no alignment. Otherwise should be a positive, integral power of 2, with p_vaddr equating p_offset modulus p_align.
0x20 0x38 End of Program Header (size)

Section header

Offset Size (bytes) Field Purpose
32-bit 64-bit 32-bit 64-bit
0x00 4 sh_name An offset to a string in the .shstrtab section that represents the name of this section
0x04 4 sh_type Identifies the type of this header.
Value Name Meaning
0x0 SHT_NULL Section header table entry unused
0x1 SHT_PROGBITS Program data
0x2 SHT_SYMTAB Symbol table
0x3 SHT_STRTAB String table
0x4 SHT_RELA Relocation entries with addends
0x5 SHT_HASH Symbol hash table
0x6 SHT_DYNAMIC Dynamic linking information
0x7 SHT_NOTE Notes
0x8 SHT_NOBITS Program space with no data (bss)
0x9 SHT_REL Relocation entries, no addends
0x0A SHT_SHLIB Reserved
0x0B SHT_DYNSYM Dynamic linker symbol table
0x0E SHT_INIT_ARRAY Array of constructors
0x0F SHT_FINI_ARRAY Array of destructors
0x10 SHT_PREINIT_ARRAY Array of pre-constructors
0x11 SHT_GROUP Section group
0x12 SHT_SYMTAB_SHNDX Extended section indices
0x13 SHT_NUM Number of defined types.
0x60000000 SHT_LOOS Start OS-specific.
... ... ...
0x08 4 8 sh_flags Identifies the attributes of the section.
Value Name Meaning
0x1 SHF_WRITE Writable
0x2 SHF_ALLOC Occupies memory during execution
0x4 SHF_EXECINSTR Executable
0x10 SHF_MERGE Might be merged
0x20 SHF_STRINGS Contains nul-terminated strings
0x40 SHF_INFO_LINK 'sh_info' contains SHT index
0x80 SHF_LINK_ORDER Preserve order after combining
0x100 SHF_OS_NONCONFORMING Non-standard OS specific handling required
0x200 SHF_GROUP Section is member of a group
0x400 SHF_TLS Section hold thread-local data
0x0ff00000 SHF_MASKOS OS-specific
0xf0000000 SHF_MASKPROC Processor-specific
0x4000000 SHF_ORDERED Special ordering requirement (Solaris)
0x8000000 SHF_EXCLUDE Section is excluded unless referenced or allocated (Solaris)
0x0C 0x10 4 8 sh_addr Virtual address of the section in memory, for sections that are loaded.
0x10 0x18 4 8 sh_offset Offset of the section in the file image.
0x14 0x20 4 8 sh_size Size in bytes of the section in the file image. May be 0.
0x18 0x28 4 sh_link Contains the section index of an associated section. This field is used for several purposes, depending on the type of section.
0x1C 0x2C 4 sh_info Contains extra information about the section. This field is used for several purposes, depending on the type of section.
0x20 0x30 4 8 sh_addralign Contains the required alignment of the section. This field must be a power of two.
0x24 0x38 4 8 sh_entsize Contains the size, in bytes, of each entry, for sections that contain fixed-size entries. Otherwise, this field contains zero.
0x28 0x40 End of Section Header (size)
Other Languages