ELF Header
Some control structures within object files can grow because the ELF header contains their actual sizes. If the object file format does change, a program can encounter control structures that are larger or smaller than expected. Programs might therefore ignore extra information. The treatment of missing information depends on context and is specified if and when extensions are defined.
The ELF header has the following structure. See sys/elf.h
.
#define EI_NIDENT 16 typedef struct { unsigned char e_ident[EI_NIDENT]; Elf32_Half e_type; Elf32_Half e_machine; Elf32_Word e_version; Elf32_Addr e_entry; Elf32_Off e_phoff; Elf32_Off e_shoff; Elf32_Word e_flags; Elf32_Half e_ehsize; Elf32_Half e_phentsize; Elf32_Half e_phnum; Elf32_Half e_shentsize; Elf32_Half e_shnum; Elf32_Half e_shstrndx; } Elf32_Ehdr; typedef struct { unsigned char e_ident[EI_NIDENT]; Elf64_Half e_type; Elf64_Half e_machine; Elf64_Word e_version; Elf64_Addr e_entry; Elf64_Off e_phoff; Elf64_Off e_shoff; Elf64_Word e_flags; Elf64_Half e_ehsize; Elf64_Half e_phentsize; Elf64_Half e_phnum; Elf64_Half e_shentsize; Elf64_Half e_shnum; Elf64_Half e_shstrndx; } Elf64_Ehdr;
-
e_ident
-
The initial bytes mark the file as an object file. These bytes provide machine-independent data with which to decode and interpret the file's contents. Complete descriptions appear in ELF Identification.
-
e_type
-
Identifies the object file type, as listed in the following table.
Name Value Meaning ET_NONE
0
No file type
ET_REL
1
Relocatable file
ET_EXEC
2
Executable file
ET_DYN
3
Shared object file
ET_CORE
4
Core file
ET_LOSUNW
0xfefe
Start operating system specific range
ET_SUNW_KZCORE
0xfefd
Kernel zone image file
ET_SUNW_ANCILLARY
0xfefe
Ancillary object file
ET_HISUNW
0xfefd
End operating system specific range
ET_LOPROC
0xff00
Start processor-specific range
ET_HIPROC
0xffff
End processor-specific range
Although the core file contents are unspecified, type
ET_CORE
is reserved to mark the file. Values fromET_LOPROC
throughET_HIPROC
(inclusive) are reserved for processor-specific semantics. Other values are reserved for future use. -
e_machine
-
Specifies the required architecture for an individual file. Relevant architectures are listed in the following table.
Name Value Meaning EM_NONE
0
No machine
EM_SPARC
2
SPARC
EM_386
3
Intel 80386
EM_SPARC32PLUS
18
Sun SPARC 32+
EM_SPARCV9
43
SPARC V9
EM_AMD64
62
AMD 64
Other values are reserved for future use. Processor-specific ELF names are distinguished by using the machine name. For example, the flags defined for
e_flags
use the prefixEF_
. A flag that is namedWIDGET
for theEM_XYZ
machine would be calledEF_XYZ_WIDGET
. -
e_version
-
Identifies the object file version, as listed in the following table.
Name Value Meaning EV_NONE
0
Invalid version
EV_CURRENT
>=1
Current version
The value 1 signifies the original file format. The value of
EV_CURRENT
changes as necessary to reflect the current version number. -
e_entry
-
The virtual address to which the system first transfers control, thus starting the process. If the file has no associated entry point, this member holds zero.
-
e_phoff
-
The program header table's file offset in bytes. If the file has no program header table, this member holds zero.
-
e_shoff
-
The section header table's file offset in bytes. If the file has no section header table, this member holds zero.
-
e_flags
-
Processor-specific flags associated with the file. Flag names take the form
EF_machine
_flag. This member is currently zero for x86. The SPARC flags are listed in the following table.Name Value Meaning EF_SPARC_EXT_MASK
0xffff00
Vendor Extension mask
EF_SPARC_32PLUS
0x000100
Generic V8+ features
EF_SPARC_SUN_US1
0x000200
Sun UltraSPARCâ„¢ 1 Extensions
EF_SPARC_HAL_R1
0x000400
HAL R1 Extensions
EF_SPARC_SUN_US3
0x000800
Sun UltraSPARC 3 Extensions
EF_SPARCV9_MM
0x3
Mask for Memory Model
EF_SPARCV9_TSO
0x0
Total Store Ordering
EF_SPARCV9_PSO
0x1
Partial Store Ordering
EF_SPARCV9_RMO
0x2
Relaxed Memory Ordering
-
e_ehsize
-
The ELF header's size in bytes.
-
e_phentsize
-
The size in bytes of one entry in the file's program header table. All entries are the same size.
-
e_phnum
-
The number of entries in the program header table. The product of
e_phentsize
ande_phnum
gives the table's size in bytes. If a file has no program header table,e_phnum
holds the value zero.If the number of program headers is greater than
65534
, this member has the valuePN_XNUM
(0xffff
). The actual number of program header table entries is contained in thesh_info
field of the section header at index0
. Otherwise, thesh_info
member of the initial section header entry contains the value zero. See Extended Section Header. -
e_shentsize
-
A section header's size in bytes. A section header is one entry in the section header table. All entries are the same size.
-
e_shnum
-
The number of entries in the section header table. The product of
e_shentsize
ande_shnum
gives the section header table's size in bytes. If a file has no section header table,e_shnum
holds the value zero.If the number of sections is greater than
65279
,e_shnum
has the value zero. The actual number of section header table entries is contained in thesh_size
field of the section header at index0
. Otherwise, thesh_size
member of the initial section header entry contains the value zero. See Extended Section Header. -
e_shstrndx
-
The section header table index of the entry that is associated with the section name string table. If the file has no section name string table, this member holds the value
SHN_UNDEF
.If the section name string table section index is greater than
65279
, this member has the valueSHN_XINDEX
(0xffff
) and the actual index of the section name string table section is contained in thesh_link
field of the section header at index0
. Otherwise, thesh_link
member of the initial section header entry contains the value zero. See Extended Section Header.