ELF file format: ELF header

The ELF header is the only part of an ELF file at a fixed place: offset 0. Everything else is found from it. This page follows the System V ABI’s generic part (the gABI), chapter 4, with the values that GNU/Linux adds from glibc’s elf.h and the Linux elf(5) manual page (see sources).

Data types

Type	32-bit size	64-bit size	Meaning
`Addr`	4	8	Unsigned program address
`Off`	4	8	Unsigned file offset
`Half`	2	2	Unsigned medium integer
`Word`	4	4	Unsigned integer
`Sword`	4	4	Signed integer
`Xword`	—	8	Unsigned long integer
`Sxword`	—	8	Signed long integer
`unsigned char`	1	1	Unsigned small integer

Each type is aligned to its own size, both in memory and from the start of the file, and ELF structures contain no bit fields. Multi-byte values use the byte order given by EI_DATA.

Header fields

Offset 32	Offset 64	Type	Field	Meaning
`0x00`	`0x00`	`unsigned char[16]`	`e_ident`	Identification.
`0x10`	`0x10`	Half	`e_type`	Object file type.
`0x12`	`0x12`	Half	`e_machine`	Architecture.
`0x14`	`0x14`	Word	`e_version`	Object file version: 0 `EV_NONE` (invalid), 1 `EV_CURRENT`.
`0x18`	`0x18`	Addr	`e_entry`	Virtual address where the process starts, or 0.
`0x1C`	`0x20`	Off	`e_phoff`	File offset of the program header table, or 0.
`0x20`	`0x28`	Off	`e_shoff`	File offset of the section header table, or 0.
`0x24`	`0x30`	Word	`e_flags`	Processor-specific flags, named `EF_machine_flag` and defined by each processor supplement.
`0x28`	`0x34`	Half	`e_ehsize`	Size of this header: 52 or 64.
`0x2A`	`0x36`	Half	`e_phentsize`	Size of one program header.
`0x2C`	`0x38`	Half	`e_phnum`	Number of program headers, or 0. Linux: if the number is 0xFFFF or more, this holds `PN_XNUM` (0xFFFF) and the real number is in `sh_info` of section header 0.
`0x2E`	`0x3A`	Half	`e_shentsize`	Size of one section header.
`0x30`	`0x3C`	Half	`e_shnum`	Number of section headers, or 0. If the number is 0xFF00 (`SHN_LORESERVE`) or more, this is 0 and the real number is in `sh_size` of section header 0.
`0x32`	`0x3E`	Half	`e_shstrndx`	Index of the section that holds section names, or `SHN_UNDEF`. If the index is 0xFF00 or more, this is `SHN_XINDEX` (0xFFFF) and the real index is in `sh_link` of section header 0.

The header is 52 bytes (0x34) in 32-bit files and 64 bytes (0x40) in 64-bit ones.

e_ident

Index	Name	Contents
`0`–`3`	`EI_MAG0`–`EI_MAG3`	`7F 45 4C 46`: `0x7F`, `E`, `L`, `F`
`4`	`EI_CLASS`	Class, below
`5`	`EI_DATA`	Data encoding, below
`6`	`EI_VERSION`	`EV_CURRENT` (1)
`7`	`EI_OSABI`	OS or ABI extensions, below
`8`	`EI_ABIVERSION`	Version of that ABI; its meaning depends on `EI_OSABI`; 0 means unspecified
`9`–`15`	`EI_PAD`	Padding: zero, ignored by readers

EI_NIDENT is 16.

EI_CLASS

Value	Name	Meaning
`0`	`ELFCLASSNONE`	Invalid class
`1`	`ELFCLASS32`	32-bit objects
`2`	`ELFCLASS64`	64-bit objects

EI_DATA

Value	Name	Meaning
`0`	`ELFDATANONE`	Invalid encoding
`1`	`ELFDATA2LSB`	Two’s complement, least significant byte first (little-endian)
`2`	`ELFDATA2MSB`	Two’s complement, most significant byte first (big-endian)

EI_OSABI

Value	Name	System
`0`	`ELFOSABI_NONE`	No extensions or unspecified (recommended when none are used)
`1`	`ELFOSABI_HPUX`	Hewlett-Packard HP-UX
`2`	`ELFOSABI_NETBSD`	NetBSD
`3`	`ELFOSABI_GNU` (`ELFOSABI_LINUX`)	GNU (Linux is a historical alias)
`6`	`ELFOSABI_SOLARIS`	Sun Solaris
`7`	`ELFOSABI_AIX`	AIX
`8`	`ELFOSABI_IRIX`	IRIX
`9`	`ELFOSABI_FREEBSD`	FreeBSD
`10`	`ELFOSABI_TRU64`	Compaq TRU64 UNIX
`11`	`ELFOSABI_MODESTO`	Novell Modesto
`12`	`ELFOSABI_OPENBSD`	OpenBSD
`13`	`ELFOSABI_OPENVMS`	OpenVMS
`14`	`ELFOSABI_NSK`	Hewlett-Packard Non-Stop Kernel
`15`	`ELFOSABI_AROS`	Amiga Research OS
`16`	`ELFOSABI_FENIXOS`	FenixOS
`17`	`ELFOSABI_CLOUDABI`	Nuxi CloudABI
`18`	`ELFOSABI_OPENVOS`	Stratus Technologies OpenVOS
`64`–`255`	—	Architecture-specific values
`64`	`ELFOSABI_ARM_AEABI`	ARM EABI (glibc)
`97`	`ELFOSABI_ARM`	ARM architecture ABI (glibc, elf(5))
`255`	`ELFOSABI_STANDALONE`	Stand-alone (embedded) ABI (glibc, elf(5))

e_type

Value	Name	Meaning
`0`	`ET_NONE`	No file type
`1`	`ET_REL`	Relocatable file (object file)
`2`	`ET_EXEC`	Executable file
`3`	`ET_DYN`	Shared object file
`4`	`ET_CORE`	Core file (contents unspecified by the gABI)
`0xFE00`–`0xFEFF`	`ET_LOOS`–`ET_HIOS`	Operating-system-specific
`0xFF00`–`0xFFFF`	`ET_LOPROC`–`ET_HIPROC`	Processor-specific

e_machine

Value	Name	Architecture
0	`EM_NONE`	No machine
1	`EM_M32`	AT&T WE 32100
2	`EM_SPARC`	SPARC
3	`EM_386`	Intel 80386
4	`EM_68K`	Motorola 68000
5	`EM_88K`	Motorola 88000
6	`EM_IAMCU`	Intel MCU
7	`EM_860`	Intel 80860
8	`EM_MIPS`	MIPS I Architecture
9	`EM_S370`	IBM System/370
10	`EM_MIPS_RS3_LE`	MIPS RS3000 little-endian
11–14	—	Reserved
15	`EM_PARISC`	Hewlett-Packard PA-RISC
16	—	Reserved
17	`EM_VPP500`	Fujitsu VPP500
18	`EM_SPARC32PLUS`	Enhanced instruction set SPARC
19	`EM_960`	Intel 80960
20	`EM_PPC`	PowerPC
21	`EM_PPC64`	64-bit PowerPC
22	`EM_S390`	IBM System/390
23	`EM_SPU`	IBM SPU/SPC
24–35	—	Reserved
36	`EM_V800`	NEC V800
37	`EM_FR20`	Fujitsu FR20
38	`EM_RH32`	TRW RH-32
39	`EM_RCE`	Motorola RCE
40	`EM_ARM`	ARM 32-bit (AArch32)
41	`EM_ALPHA`	Digital Alpha
42	`EM_SH`	Hitachi SH
43	`EM_SPARCV9`	SPARC Version 9
44	`EM_TRICORE`	Siemens TriCore
45	`EM_ARC`	Argonaut RISC Core
46	`EM_H8_300`	Hitachi H8/300
47	`EM_H8_300H`	Hitachi H8/300H
48	`EM_H8S`	Hitachi H8S
49	`EM_H8_500`	Hitachi H8/500
50	`EM_IA_64`	Intel IA-64
51	`EM_MIPS_X`	Stanford MIPS-X
52	`EM_COLDFIRE`	Motorola ColdFire
53	`EM_68HC12`	Motorola M68HC12
54	`EM_MMA`	Fujitsu MMA Multimedia Accelerator
55	`EM_PCP`	Siemens PCP
56	`EM_NCPU`	Sony nCPU
57	`EM_NDR1`	Denso NDR1
58	`EM_STARCORE`	Motorola Star*Core
59	`EM_ME16`	Toyota ME16
60	`EM_ST100`	STMicroelectronics ST100
61	`EM_TINYJ`	Advanced Logic Corp. TinyJ
62	`EM_X86_64`	AMD x86-64
63	`EM_PDSP`	Sony DSP Processor
64	`EM_PDP10`	Digital PDP-10
65	`EM_PDP11`	Digital PDP-11
66	`EM_FX66`	Siemens FX66
67	`EM_ST9PLUS`	STMicroelectronics ST9+
68	`EM_ST7`	STMicroelectronics ST7
69	`EM_68HC16`	Motorola MC68HC16
70	`EM_68HC11`	Motorola MC68HC11
71	`EM_68HC08`	Motorola MC68HC08
72	`EM_68HC05`	Motorola MC68HC05
73	`EM_SVX`	Silicon Graphics SVx
74	`EM_ST19`	STMicroelectronics ST19
75	`EM_VAX`	Digital VAX
76	`EM_CRIS`	Axis Communications 32-bit embedded processor
77	`EM_JAVELIN`	Infineon 32-bit embedded processor
78	`EM_FIREPATH`	Element 14 64-bit DSP
79	`EM_ZSP`	LSI Logic 16-bit DSP
80	`EM_MMIX`	Donald Knuth’s educational 64-bit processor
81	`EM_HUANY`	Harvard University machine-independent object files
82	`EM_PRISM`	SiTera Prism
83	`EM_AVR`	Atmel AVR 8-bit
84	`EM_FR30`	Fujitsu FR30
85	`EM_D10V`	Mitsubishi D10V
86	`EM_D30V`	Mitsubishi D30V
87	`EM_V850`	NEC v850
88	`EM_M32R`	Mitsubishi M32R
89	`EM_MN10300`	Matsushita MN10300
90	`EM_MN10200`	Matsushita MN10200
91	`EM_PJ`	picoJava
92	`EM_OPENRISC`	OpenRISC 32-bit
93	`EM_ARC_COMPACT`	ARC International ARCompact (also `EM_ARC_A5`)
94	`EM_XTENSA`	Tensilica Xtensa
95	`EM_VIDEOCORE`	Alphamosaic VideoCore
96	`EM_TMM_GPP`	Thompson Multimedia General Purpose Processor
97	`EM_NS32K`	National Semiconductor 32000
98	`EM_TPC`	Tenor Network TPC
99	`EM_SNP1K`	Trebia SNP 1000
100	`EM_ST200`	STMicroelectronics ST200
101	`EM_IP2K`	Ubicom IP2xxx
102	`EM_MAX`	MAX Processor
103	`EM_CR`	National Semiconductor CompactRISC
104	`EM_F2MC16`	Fujitsu F2MC16
105	`EM_MSP430`	Texas Instruments msp430
106	`EM_BLACKFIN`	Analog Devices Blackfin
107	`EM_SE_C33`	Seiko Epson S1C33
108	`EM_SEP`	Sharp embedded microprocessor
109	`EM_ARCA`	Arca RISC
110	`EM_UNICORE`	PKU-Unity and MPRC of Peking University
111	`EM_EXCESS`	eXcess configurable CPU
112	`EM_DXP`	Icera Deep Execution Processor
113	`EM_ALTERA_NIOS2`	Altera Nios II
114	`EM_CRX`	National Semiconductor CompactRISC CRX
115	`EM_XGATE`	Motorola XGATE
116	`EM_C166`	Infineon C16x/XC16x
117	`EM_M16C`	Renesas M16C
118	`EM_DSPIC30F`	Microchip dsPIC30F
119	`EM_CE`	Freescale Communication Engine RISC
120	`EM_M32C`	Renesas M32C
121–130	—	Reserved
131	`EM_TSK3000`	Altium TSK3000
132	`EM_RS08`	Freescale RS08
133	`EM_SHARC`	Analog Devices SHARC
134	`EM_ECOG2`	Cyan Technology eCOG2
135	`EM_SCORE7`	Sunplus S+core7
136	`EM_DSP24`	New Japan Radio 24-bit DSP
137	`EM_VIDEOCORE3`	Broadcom VideoCore III
138	`EM_LATTICEMICO32`	Lattice FPGA RISC processor
139	`EM_SE_C17`	Seiko Epson C17
140	`EM_TI_C6000`	Texas Instruments TMS320C6000
141	`EM_TI_C2000`	Texas Instruments TMS320C2000
142	`EM_TI_C5500`	Texas Instruments TMS320C55x
143	`EM_TI_ARP32`	Texas Instruments Application Specific RISC Processor
144	`EM_TI_PRU`	Texas Instruments Programmable Realtime Unit
145–159	—	Reserved
160	`EM_MMDSP_PLUS`	STMicroelectronics 64-bit VLIW DSP
161	`EM_CYPRESS_M8C`	Cypress M8C
162	`EM_R32C`	Renesas R32C
163	`EM_TRIMEDIA`	NXP TriMedia
164	`EM_QDSP6`	Qualcomm DSP6
165	`EM_8051`	Intel 8051 and variants
166	`EM_STXP7X`	STMicroelectronics STxP7x
167	`EM_NDS32`	Andes Technology embedded RISC
168	`EM_ECOG1`, `EM_ECOG1X`	Cyan Technology eCOG1X
169	`EM_MAXQ30`	Dallas Semiconductor MAXQ30
170	`EM_XIMO16`	New Japan Radio 16-bit DSP
171	`EM_MANIK`	M2000 Reconfigurable RISC
172	`EM_CRAYNV2`	Cray NV2 vector architecture
173	`EM_RX`	Renesas RX
174	`EM_METAG`	Imagination Technologies META
175	`EM_MCST_ELBRUS`	MCST Elbrus
176	`EM_ECOG16`	Cyan Technology eCOG16
177	`EM_CR16`	National Semiconductor CompactRISC CR16
178	`EM_ETPU`	Freescale Extended Time Processing Unit
179	`EM_SLE9X`	Infineon SLE9X
180	`EM_L10M`	Intel L10M
181	`EM_K10M`	Intel K10M
182	—	Reserved for Intel
183	`EM_AARCH64`	ARM 64-bit (AArch64)
184	—	Reserved for ARM
185	`EM_AVR32`	Atmel 32-bit
186	`EM_STM8`	STMicroelectronics STM8
187	`EM_TILE64`	Tilera TILE64
188	`EM_TILEPRO`	Tilera TILEPro
189	`EM_MICROBLAZE`	Xilinx MicroBlaze
190	`EM_CUDA`	NVIDIA CUDA
191	`EM_TILEGX`	Tilera TILE-Gx
192	`EM_CLOUDSHIELD`	CloudShield
193	`EM_COREA_1ST`	KIPO-KAIST Core-A 1st generation
194	`EM_COREA_2ND`	KIPO-KAIST Core-A 2nd generation
195	`EM_ARC_COMPACT2`	Synopsys ARCompact V2
196	`EM_OPEN8`	Open8 8-bit RISC
197	`EM_RL78`	Renesas RL78
198	`EM_VIDEOCORE5`	Broadcom VideoCore V
199	`EM_78KOR`	Renesas 78KOR
200	`EM_56800EX`	Freescale 56800EX DSC
201	`EM_BA1`	Beyond BA1
202	`EM_BA2`	Beyond BA2
203	`EM_XCORE`	XMOS xCORE
204	`EM_MCHP_PIC`	Microchip 8-bit PIC
205–209	`EM_INTEL205`–`EM_INTEL209`	Reserved by Intel
210	`EM_KM32`	KM211 KM32
211	`EM_KMX32`	KM211 KMX32
212	`EM_KMX16`	KM211 KMX16
213	`EM_KMX8`	KM211 KMX8
214	`EM_KVARC`	KM211 KVARC
215	`EM_CDP`	Paneve CDP
216	`EM_COGE`	Cognitive Smart Memory Processor
217	`EM_COOL`	Bluechip Systems CoolEngine
218	`EM_NORC`	Nanoradio Optimized RISC
219	`EM_CSR_KALIMBA`	CSR Kalimba
220	`EM_Z80`	Zilog Z80
221	`EM_VISIUM`	Controls and Data Services VISIUMcore
222	`EM_FT32`	FTDI FT32
223	`EM_MOXIE`	Moxie
224	`EM_AMDGPU`	AMD GPU
225–242	—	Not assigned in the sources read
243	`EM_RISCV`	RISC-V
247	`EM_BPF`	Linux BPF (glibc)
252	`EM_CSKY`	C-SKY (glibc)
258	`EM_LOONGARCH`	LoongArch (glibc)
0x9026	`EM_ALPHA`	Alpha, a value glibc marks as unofficial

Values 0 to 243 are from the gABI; those marked glibc are the only others glibc’s elf.h defines (it gives EM_NUM as 259). The gABI reserves unlisted values for new machines.

Example

7F 45 4C 46   magic
02            ELFCLASS64
01            ELFDATA2LSB (little-endian)
01            EV_CURRENT
00            ELFOSABI_NONE
00            ABI version
00 × 7        padding
03 00         e_type ET_DYN
3E 00         e_machine 62, EM_X86_64

Sources

System V ABI, generic part, chapter 4: Introduction – data types and alignment
gABI chapter 4: ELF Header – every header field, e_ident, classes, data encodings, OS/ABI values 0–18, e_type, e_machine 0–243, versions, extended counts
glibc elf.h – EM_BPF, EM_CSKY, EM_LOONGARCH, the unofficial EM_ALPHA, ELFOSABI_ARM_AEABI, ELFOSABI_ARM, ELFOSABI_STANDALONE
elf(5) – PN_XNUM

.ELF File Format – ELF header