In computing, the Executable and Linkable Format ELF , formerly called Extensible Linking Format is a common standard file format for executables, object code, shared libraries, and core dumps. First published in the System V application binary interface Application Binary Interface specification,  and later in the Tool Interface Standard,  it was quickly accepted among different vendors of Unix systems. In it was chosen as the standard binary file format for Unix and Unix-like systems on x86 by the 86open project. Unlike many proprietary executable file formats, ELF is very flexible and extensible, and it is not bound to any particular processor or Instruction set architecture architecture. This has allowed it to be adopted by many different operating systems on many different platforms. The ELF format has replaced older executable formats such as a.
|Published (Last):||25 December 2011|
|PDF File Size:||5.69 Mb|
|ePub File Size:||17.78 Mb|
|Price:||Free* [*Free Regsitration Required]|
Programming starts with having a clever idea, and writing source code in a programming language of your choice, for example C, and saving the source code in a file. With the help of an adequate compiler, for example GCC, your source code is translated into object code, first. Eventually, the linker translates the object code into a binary file that links the object code with the referenced libraries. This file contains the single instructions as machine code that are understood by the CPU, and are executed as soon the compiled program is run.
The binary file mentioned above follows a specific structure, and one of the most common ones is named ELF that abbreviates Executable and Linkable Format. It is widely used for executable files, relocatable object files, shared libraries, and core dumps.
Twenty years ago — in — the 86open project has chosen ELF as the standard binary file format for Unix and Unix-like systems on x86 processors. This fact enormously simplified the agreement on standardization between the different vendors and developers of Unix-based operating systems. The reason behind that decision was the design of ELF — flexibility, extensibility, and cross-platform support for different endian formats and address sizes. For a detailed comparison of executable file formats, have a look here .
Since then, the ELF format is in use by several different operating systems. The specification does not clarify the filename extension for ELF files. In use is a variety of letter combinations, such as. On a Linux terminal, the command man elf gives you a handy summary about the structure of an ELF file:. The file data section can consist of a program header table describing zero or more segments, a section header table describing zero or more sections, that is followed by data referred to by entries from the program header table, and the section header table.
Each segment contains information that is necessary for run-time execution of the file, while sections contain important data for linking and relocation.
Figure 1 illustrates this schematically. The ELF header is 32 bytes long, and identifies the format of the file. It starts with a sequence of four unique bytes that are 0x7F followed by 0x45, 0x4c, and 0x46 which translates into the three letters E, L, and F. Among other values, the header also indicates whether it is an ELF file for 32 or bit format, uses little or big endianness, shows the ELF version as well as for which operating system the file was compiled for in order to interoperate with the right application binary interface ABI and cpu instruction set.
Listing 3 illustrates this for the command touch. The program header shows the segments used at run-time, and tells the system how to create a process image.
The header from Listing 2 shows that the ELF file consists of 9 program headers that have a size of 56 bytes each, and the first header starts at byte Again, the readelf command helps to extract the information from the ELF file. The switch -l short for —program-headers or —segments reveals more details as shown in Listing 4. The third part of the ELF structure is the section header.
It is meant to list the single sections of the binary. The switch -S short for —section-headers or —sections lists the different headers. As for the touch command, there are 27 section headers, and Listing 5 shows the first four of them plus the last one, only. Each line covers the section size, the section type as well as its address and memory offset. The first candidate we will have a look at is the file utility. The second candidate is readelf. It displays detailed information about an ELF file.
The list of switches is comparably long, and covers all the aspects of the ELF format. Using the switch -n short for —notes Listing 7 shows the note sections, only, that exist in the file touch — the ABI version tag, and the build ID bitstring.
As of , there has not been a new release or update since Number three is the package named elfutils  that is purely available for Linux. Last but not least we will mention objdump. This tool is similar to readelf but focuses on object files. It provides a similar range of information about ELF files and other object formats. This set of utilities provides a number of tools that help to validate ELF files. As an example, dumpelf analyzes the ELF file, and returns a C header file containing the details — see Figure 2.
Thanks to a combination of clever design and excellent documentation the ELF format works very well, and is still in use after 20 years. The utilities shown above allow you an insight view into an ELF file, and let you figure out what a program is doing. These are the first steps for analyzing software — happy hacking! The writer would like to thank Axel Beckert for his support regarding the preparation of this article. Co-author of the Debian Package Management Book available from dpmb.
From Source Code To Binary Code Programming starts with having a clever idea, and writing source code in a programming language of your choice, for example C, and saving the source code in a file.
View all posts.
Executable and Linkable Format
Some of the true craftsmanship in the world we take for granted. One of these things is the common tools on Linux, like ps and ls. Even though the commands might be perceived as simple, there is more to it when looking under the hood. A file format that used a lot, yet truly understood by only a few.
Understanding ELF, the Executable and Linkable Format
We execute it on our desired target. If it is an embedded system, we flash it to the target device and run it. In this article we will analyse the compilation process as well as ELF. Compilation stages To understand the stages of compilation, let us write a simple program and compile it. For compilation purposes, we will use the GCC open source compiler.
Executable and Linkable Format (ELF)
In computing , the Executable and Linkable Format ELF , formerly named Extensible Linking Format , is a common standard file format for executable files, object code , shared libraries , and core dumps. First published in the specification for the application binary interface ABI of the Unix operating system version named System V Release 4 SVR4 ,  and later in the Tool Interface Standard,  it was quickly accepted among different vendors of Unix systems. In , it was chosen as the standard binary file format for Unix and Unix-like systems on x86 processors by the 86open project. By design, the ELF format is flexible, extensible, and cross-platform.
Understanding the ELF File Format