ELF Header

Some control structures within object files can grow because the ELF header contains their actual sizes. If the object file format does change, a program can encounter control structures that are larger or smaller than expected. Programs might therefore ignore extra information. The treatment of missing information depends on context and is specified if and when extensions are defined.

The ELF header has the following structure. See sys/elf.h.

#define EI_NIDENT       16
 
typedef struct {
        unsigned char   e_ident[EI_NIDENT]; 
        Elf32_Half      e_type;
        Elf32_Half      e_machine;
        Elf32_Word      e_version;
        Elf32_Addr      e_entry;
        Elf32_Off       e_phoff;
        Elf32_Off       e_shoff;
        Elf32_Word      e_flags;
        Elf32_Half      e_ehsize;
        Elf32_Half      e_phentsize;
        Elf32_Half      e_phnum;
        Elf32_Half      e_shentsize;
        Elf32_Half      e_shnum;
        Elf32_Half      e_shstrndx;
} Elf32_Ehdr;

typedef struct {
        unsigned char   e_ident[EI_NIDENT]; 
        Elf64_Half      e_type;
        Elf64_Half      e_machine;
        Elf64_Word      e_version;
        Elf64_Addr      e_entry;
        Elf64_Off       e_phoff;
        Elf64_Off       e_shoff;
        Elf64_Word      e_flags;
        Elf64_Half      e_ehsize;
        Elf64_Half      e_phentsize;
        Elf64_Half      e_phnum;
        Elf64_Half      e_shentsize;
        Elf64_Half      e_shnum;
        Elf64_Half      e_shstrndx;
} Elf64_Ehdr;

e_ident

The initial bytes mark the file as an object file. These bytes provide machine-independent data with which to decode and interpret the file's contents. Complete descriptions appear in ELF Identification.

e_type

Identifies the object file type, as listed in the following table.

Name Value Meaning ET_NONE 0 No file type ET_REL 1 Relocatable file ET_EXEC 2 Executable file ET_DYN 3 Shared object file ET_CORE 4 Core file ET_LOSUNW 0xfefe Start operating system specific range ET_SUNW_ANCILLARY 0xfefe Ancillary object file ET_HISUNW 0xfefd End operating system specific range ET_LOPROC 0xff00 Start processor-specific range ET_HIPROC 0xffff End processor-specific range

Although the core file contents are unspecified, type ET_CORE is reserved to mark the file. Values from ET_LOPROC through ET_HIPROC (inclusive) are reserved for processor-specific semantics. Other values are reserved for future use.

e_machine

Specifies the required architecture for an individual file. Relevant architectures are listed in the following table.

Name Value Meaning EM_NONE 0 No machine EM_SPARC 2 SPARC EM_386 3 Intel 80386 EM_SPARC32PLUS 18 Sun SPARC 32+ EM_SPARCV9 43 SPARC V9 EM_AMD64 62 AMD 64

Other values are reserved for future use. Processor-specific ELF names are distinguished by using the machine name. For example, the flags defined for e_flags use the prefix EF_. A flag that is named WIDGET for the EM_XYZ machine would be called EF_XYZ_WIDGET.

e_version

Identifies the object file version, as listed in the following table.

Name Value Meaning EV_NONE 0 Invalid version EV_CURRENT >=1 Current version

The value 1 signifies the original file format. The value of EV_CURRENT changes as necessary to reflect the current version number.

e_entry

The virtual address to which the system first transfers control, thus starting the process. If the file has no associated entry point, this member holds zero.

e_phoff

The program header table's file offset in bytes. If the file has no program header table, this member holds zero.

e_shoff

The section header table's file offset in bytes. If the file has no section header table, this member holds zero.

e_flags

Processor-specific flags associated with the file. Flag names take the form EF_machine_flag. This member is presently zero for x86. The SPARC flags are listed in the following table.

Name Value Meaning EF_SPARC_EXT_MASK 0xffff00 Vendor Extension mask EF_SPARC_32PLUS 0x000100 Generic V8+ features EF_SPARC_SUN_US1 0x000200 Sun UltraSPARC 1 Extensions EF_SPARC_HAL_R1 0x000400 HAL R1 Extensions EF_SPARC_SUN_US3 0x000800 Sun UltraSPARC 3 Extensions EF_SPARCV9_MM 0x3 Mask for Memory Model EF_SPARCV9_TSO 0x0 Total Store Ordering EF_SPARCV9_PSO 0x1 Partial Store Ordering EF_SPARCV9_RMO 0x2 Relaxed Memory Ordering

e_ehsize

The ELF header's size in bytes.

e_phentsize

The size in bytes of one entry in the file's program header table. All entries are the same size.

e_phnum

The number of entries in the program header table. The product of e_phentsize and e_phnum gives the table's size in bytes. If a file has no program header table, e_phnum holds the value zero.

If the number of program headers is greater than or equal to PN_XNUM (0xffff), this member has the value PN_XNUM (0xffff). The actual number of program header table entries is contained in the sh_info field of the section header at index 0. Otherwise, the sh_info member of the initial section header entry contains the value zero. See Table 12-6 and Table 12-7.

e_shentsize

A section header's size in bytes. A section header is one entry in the section header table. All entries are the same size.

e_shnum

The number of entries in the section header table. The product of e_shentsize and e_shnum gives the section header table's size in bytes. If a file has no section header table, e_shnum holds the value zero.

If the number of sections is greater than or equal to SHN_LORESERVE (0xff00), e_shnum has the value zero. The actual number of section header table entries is contained in the sh_size field of the section header at index 0. Otherwise, the sh_size member of the initial section header entry contains the value zero. See Table 12-6 and Table 12-7.

e_shstrndx

The section header table index of the entry that is associated with the section name string table. If the file has no section name string table, this member holds the value SHN_UNDEF.

If the section name string table section index is greater than or equal to SHN_LORESERVE (0xff00), this member has the value SHN_XINDEX (0xffff) and the actual index of the section name string table section is contained in the sh_link field of the section header at index 0. Otherwise, the sh_link member of the initial section header entry contains the value zero. See Table 12-6 and Table 12-7.