.ELF

Introduction

ELF is the format of programs, shared libraries, object files and core dumps on Linux, the BSDs and most other Unix-like systems, as well as on the PlayStation consoles and in many embedded toolchains. It appeared in Unix System V Release 4 around 1989.

Most ELF programs have no extension at all: /bin/ls is an ELF file. The extensions that do appear are .so for shared libraries, .o for object files, .ko for Linux kernel modules, and .elf or .axf for firmware built by embedded toolchains.

Software

• Linux, the BSDs and other Unix-like systems, which run them
• GNU Binutils, with readelf and objdump (Linux, macOS, Windows)
• LLVM, with llvm-readelf and llvm-objdump (Linux, macOS, Windows)
• GDB (Linux, macOS, Windows)
• Ghidra (Windows, macOS, Linux)
• IDA Pro (Windows, macOS, Linux)
• Binary Ninja (Windows, macOS, Linux)
• radare2 (Windows, macOS, Linux)

Structure

An ELF file starts with the ELF header. Its first 16 bytes, the identification, give the magic 7F 45 4C 46 (\x7FELF), the class (1 for 32-bit, 2 for 64-bit), the byte order (1 for little-endian, 2 for big-endian), the version and the target system’s ABI. Everything after that is read in the class and byte order those bytes give. The rest of the header gives the file type (relocatable object, executable, shared object or core dump), the machine, the entry point and the positions of two tables.

The two tables are two views of the same bytes. The program header table lists segments: what the system loads into memory, and where. The section header table lists sections: .text, .data, the symbol tables, the debug information and so on, which the linker and debuggers use. An object file needs only sections and a program can run with only segments.

See also

Other formats that use the same extension:

• Mach-O executable and library .o