ELF(5) File Formats Manual ELF(5) elf - (ELF) #include ELF . (core) . ELF ELF . ELF . ELF. . C . N- (N=32,64 ElfN Elf32 Elf64 uintN_t uint32_t uint64_t): ElfN_Addr uintN_t ElfN_Off uintN_t ElfN_Section uint16_t ElfN_Versym uint16_t Elf_Byte unsigned char ElfN_Half uint16_t ElfN_Sword int32_t ElfN_Word uint32_t ElfN_Sxword int64_t ElfN_Xword uint64_t (: *BSD . Elf64_Half Elf32_Half Elf64Quarter uint16_t. .) "" . 4- 4- 4 . ELF (Ehdr) ELF Elf32_Ehdr Elf64_Ehdr: #define EI_NIDENT 16 typedef struct { unsigned char e_ident[EI_NIDENT]; uint16_t e_type; uint16_t e_machine; uint32_t e_version; ElfN_Addr e_entry; ElfN_Off e_phoff; ElfN_Off e_shoff; uint32_t e_flags; uint16_t e_ehsize; uint16_t e_phentsize; uint16_t e_phnum; uint16_t e_shentsize; uint16_t e_shnum; uint16_t e_shstrndx; } ElfN_Ehdr; : e_ident . EI_ ELF. : EI_MAG0 . ELFMAG0. (0: 0x7f) EI_MAG1 . ELFMAG1. (1: 'E') EI_MAG2 . ELFMAG2. (2: 'L') EI_MAG3 . ELFMAG3. (3: 'F') EI_CLASS : ELFCLASSNONE . ELFCLASS32 32-. 4 . ELFCLASS64 64-. EI_DATA . : ELFDATANONE . ELFDATA2LSB (little-endian). ELFDATA2MSB (big-endian). EI_VERSION ELF: EV_NONE . EV_CURRENT . EI_OSABI (ABI) . ELF . : ELFOSABI_NONE ELFOSABI_SYSV ELFOSABI_SYSV UNIX System V ABI ELFOSABI_HPUX HP-UX ABI ELFOSABI_NETBSD NetBSD ABI ELFOSABI_LINUX ABI ELFOSABI_SOLARIS ABI ELFOSABI_IRIX IRIX ABI ELFOSABI_FREEBSD FreeBSD ABI ELFOSABI_TRU64 TRU64 UNIX ABI ELFOSABI_ARM ABI ELFOSABI_STANDALONE () EI_ABIVERSION (ABI) . ABI. ABI EI_OSABI. 0. EI_PAD . . . EI_PAD . EI_NIDENT e_ident. e_type : ET_NONE . ET_REL . ET_EXEC . ET_DYN . ET_CORE (core). e_machine . : EM_NONE EM_M32 AT&T WE 32100 EM_SPARC Sun Microsystems SPARC EM_386 Intel 80386 EM_68K Motorola 68000 EM_88K Motorola 88000 EM_860 Intel 80860 EM_MIPS MIPS RS3000 ( ) EM_PARISC HP/PA EM_SPARC32PLUS SPARC EM_PPC PowerPC EM_PPC64 PowerPC 64- EM_S390 IBM S/390 EM_ARM Advanced RISC Machines (ARM) EM_SH Renesas SuperH EM_SPARCV9 SPARC v9 64- EM_IA_64 Intel Itanium EM_X86_64 AMD x86-64 EM_VAX DEC Vax e_version : EV_NONE EV_CURRENT e_entry . . e_phoff . . e_shoff . . e_flags . EF_`machine_flag'. . e_ehsize ELF . e_phentsize . e_phnum . e_phentsize e_phnum . e_phnum . PN_XNUM (0xffff) PN_XNUM (0xffff) sh_info . sh_info . PN_XNUM 0xffff e_phnum . e_shentsize . . e_shnum . e_shentsize e_shnum . e_shnum . SHN_LORESERVE (0xff00) e_shnum sh_size . sh_size . e_shstrndx . SHN_UNDEF. SHN_LORESERVE (0xff00) SHN_XINDEX (0xffff) sh_link . sh_link . (Phdr) (segment) . . . e_phentsize e_phnum ELF. ELF Elf32_Phdr Elf64_Phdr : typedef struct { uint32_t p_type; Elf32_Off p_offset; Elf32_Addr p_vaddr; Elf32_Addr p_paddr; uint32_t p_filesz; uint32_t p_memsz; uint32_t p_flags; uint32_t p_align; } Elf32_Phdr; typedef struct { uint32_t p_type; uint32_t p_flags; Elf64_Off p_offset; Elf64_Addr p_vaddr; Elf64_Addr p_paddr; uint64_t p_filesz; uint64_t p_memsz; uint64_t p_align; } Elf64_Phdr; 32- 64- p_flags . p_type . PT_NULL . . PT_LOAD p_filesz p_memsz. . p_memsz p_filesz "" 0 . . p_vaddr. PT_DYNAMIC . PT_INTERP null . ( ). . . PT_NOTE (ElfN_Nhdr). PT_SHLIB . (ABI). PT_PHDR . . . . PT_LOPROC PT_HIPROC [PT_LOPROC PT_HIPROC] . PT_GNU_STACK GNU p_flags. p_offset . p_vaddr . p_paddr . BSD . p_filesz . . p_memsz . . p_flags : PF_X . PF_W . PF_R . PF_X PF_R. PF_W PF_R. p_align . p_vaddr p_offset (modulo) . . p_align p_vaddr p_offset p_align. (Shdr) . Elf32_Shdr Elf64_Shdr. e_shoff ELF . e_shnum . e_shentsize . (subscript) . : SHN_LORESERVE SHN_HIRESERVE. ELF e_phnum e_shnum e_shstrndx . (object file) : SHN_UNDEF . SHN_LORESERVE . SHN_LOPROC SHN_HIPROC [SHN_LOPROC SHN_HIPROC] . SHN_ABS . SHN_ABS . SHN_COMMON FORTRAN COMMON C . SHN_HIRESERVE . SHN_LORESERVE SHN_HIRESERVE . . : typedef struct { uint32_t sh_name; uint32_t sh_type; uint32_t sh_flags; Elf32_Addr sh_addr; Elf32_Off sh_offset; uint32_t sh_size; uint32_t sh_link; uint32_t sh_info; uint32_t sh_addralign; uint32_t sh_entsize; } Elf32_Shdr; typedef struct { uint32_t sh_name; uint32_t sh_type; uint64_t sh_flags; Elf64_Addr sh_addr; Elf64_Off sh_offset; uint64_t sh_size; uint32_t sh_link; uint32_t sh_info; uint64_t sh_addralign; uint64_t sh_entsize; } Elf64_Shdr; 32 64 . sh_name . . sh_type . SHT_NULL . . . SHT_PROGBITS . SHT_SYMTAB . SHT_SYMTAB . . SHT_DYNSYM. sh_link. SHT_STRTAB . . SHT_RELA Elf32_Rela 32 . . SHT_HASH . . . SHT_DYNAMIC . . SHT_NOTE (ElfN_Nhdr). SHT_NOBITS SHT_PROGBITS. sh_offset . SHT_REL Elf32_Rel 32 . . SHT_SHLIB . SHT_DYNSYM . SHT_SYMTAB. SHT_LOPROC SHT_HIPROC [SHT_LOPROC SHT_HIPROC] . SHT_LOUSER . SHT_HIUSER . SHT_LOUSER SHT_HIUSER . sh_flags . sh_flags "on" . "off" . . SHF_WRITE . SHF_ALLOC . . . SHF_EXECINSTR . SHF_MASKPROC . sh_addr . . sh_offset . SHT_NOBITS sh_offset . sh_size . SHT_NOBITS sh_size . SHT_NOBITS . sh_link . sh_info . sh_addralign . (doubleword) . sh_addr sh_addralign. . 0 1 . sh_entsize . . . : .bss . . SHT_NOBITS. SHF_ALLOC SHF_WRITE. .comment . SHT_PROGBITS. . .ctors (constructor functions) ++C. SHT_PROGBITS. SHF_ALLOC SHF_WRITE. .data . SHT_PROGBITS. SHF_ALLOC SHF_WRITE. .data1 . SHT_PROGBITS. SHF_ALLOC SHF_WRITE. .debug . . SHT_PROGBITS. . .dtors (destructor functions) ++C. SHT_PROGBITS. SHF_ALLOC SHF_WRITE. .dynamic . SHF_ALLOC. SHF_WRITE . SHT_DYNAMIC. . .dynstr . SHT_STRTAB. SHF_ALLOC. .dynsym . SHT_DYNSYM. SHF_ALLOC. .fini . . SHT_PROGBITS. SHF_ALLOC SHF_EXECINSTR. .gnu.version ElfN_Half. SHT_GNU_versym. SHF_ALLOC. .gnu.version_d ElfN_Verdef. SHT_GNU_verdef. SHF_ALLOC. .gnu.version_r ElfN_Verneed. SHT_GNU_versym. SHF_ALLOC. .got . SHT_PROGBITS. . .hash . SHT_HASH. SHF_ALLOC. .init . . SHT_PROGBITS. SHF_ALLOC SHF_EXECINSTR. .interp . SHF_ALLOC. . SHT_PROGBITS. .line . . SHT_PROGBITS. . .note . SHT_NOTE. . .note.ABI-tag (ABI) ELF. . SHT_NOTE. SHF_ALLOC. .note.gnu.build-id ELF . . --build-id GNU (ld(1)) . SHT_NOTE. SHF_ALLOC. .note.GNU-stack (stack). SHT_PROGBITS. SHF_EXECINSTR. GNU . .note.openbsd.ident OpenBSD ELF . .plt . SHT_PROGBITS. . .relNAME . SHF_ALLOC. . "NAME" . .text .rel.text. SHT_REL. .relaNAME . SHF_ALLOC. . "NAME" . .text .rela.text. SHT_RELA. .rodata . SHT_PROGBITS. SHF_ALLOC. .rodata1 . SHT_PROGBITS. SHF_ALLOC. .shstrtab . SHT_STRTAB. . .strtab . SHF_ALLOC. . SHT_STRTAB. .symtab . SHF_ALLOC. . SHT_SYMTAB. .text "" . SHT_PROGBITS. SHF_ALLOC SHF_EXECINSTR. . . . ('\0'). . . . typedef struct { uint32_t st_name; Elf32_Addr st_value; uint32_t st_size; unsigned char st_info; unsigned char st_other; uint16_t st_shndx; } Elf32_Sym; typedef struct { uint32_t st_name; unsigned char st_info; unsigned char st_other; uint16_t st_shndx; Elf64_Addr st_value; uint64_t st_size; } Elf64_Sym; 32 64 . st_name . . . st_value . st_size . . st_info : STT_NOTYPE . STT_OBJECT . STT_FUNC . STT_SECTION . STB_LOCAL. STT_FILE . STB_LOCAL SHN_ABS STB_LOCAL . STT_LOPROC STT_HIPROC [STT_LOPROC STT_HIPROC] . STB_LOCAL . . STB_GLOBAL . . STB_WEAK . STB_LOPROC STB_HIPROC [STB_LOPROC STB_HIPROC] . : ELF32_ST_BIND(info) ELF64_ST_BIND(info) st_info. ELF32_ST_TYPE(info) ELF64_ST_TYPE(info) st_info. ELF32_ST_INFO(bind, type) ELF64_ST_INFO(bind, type) st_info. st_other . STV_DEFAULT . . STV_INTERNAL . STV_HIDDEN ( ). STV_PROTECTED . : ELF32_ST_VISIBILITY(other) ELF64_ST_VISIBILITY(other) st_shndx . . (Rel Rela) . . . : typedef struct { Elf32_Addr r_offset; uint32_t r_info; } Elf32_Rel; typedef struct { Elf64_Addr r_offset; uint64_t r_info; } Elf64_Rel; : typedef struct { Elf32_Addr r_offset; uint32_t r_info; int32_t r_addend; } Elf32_Rela; typedef struct { Elf64_Addr r_offset; uint64_t r_info; int64_t r_addend; } Elf64_Rela; r_offset . . . r_info . . ELF[32|64]_R_TYPE ELF[32|64]_R_SYM r_info . r_addend . (Dyn) .dynamic . d_tag d_un. typedef struct { Elf32_Sword d_tag; union { Elf32_Word d_val; Elf32_Addr d_ptr; } d_un; } Elf32_Dyn; extern Elf32_Dyn _DYNAMIC[]; typedef struct { Elf64_Sxword d_tag; union { Elf64_Xword d_val; Elf64_Addr d_ptr; } d_un; } Elf64_Dyn; extern Elf64_Dyn _DYNAMIC[]; d_tag : DT_NULL DT_NEEDED DT_PLTRELSZ PLT DT_PLTGOT PLT / GOT DT_HASH DT_STRTAB DT_SYMTAB DT_RELA Rela DT_RELASZ Rela DT_RELAENT Rela DT_STRSZ DT_SYMENT DT_INIT DT_FINI DT_SONAME DT_RPATH DT_SYMBOLIC DT_REL Rel DT_RELSZ Rel DT_RELENT Rel DT_PLTREL PLT (Rela Rel) DT_DEBUG DT_TEXTREL DT_JMPREL PLT DT_BIND_NOW DT_RUNPATH DT_LOPROC DT_HIPROC [DT_LOPROC DT_HIPROC] d_val . d_ptr . . . _DYNAMIC .dynamic. . (Nhdr) ELF . (e_type ET_CORE) . GNU ELF C. ( struct ). ( n_namesz) ( n_descsz) 4 . . : void *memory, *name, *desc; Elf64_Nhdr *note, *next_note; /* The buffer is pointing to the start of the section/segment. */ note = memory; /* If the name is defined, it follows the note. */ name = note->n_namesz == 0 ? NULL : memory + sizeof(*note); /* If the descriptor is defined, it follows the name (with alignment). */ desc = note->n_descsz == 0 ? NULL : memory + sizeof(*note) + ALIGN_UP(note->n_namesz, 4); /* The next note follows both (with alignment). */ next_note = memory + sizeof(*note) + ALIGN_UP(note->n_namesz, 4) + ALIGN_UP(note->n_descsz, 4); n_type n_namesz. n_namesz ( 0) : ELF . . typedef struct { Elf32_Word n_namesz; Elf32_Word n_descsz; Elf32_Word n_type; } Elf32_Nhdr; typedef struct { Elf64_Word n_namesz; Elf64_Word n_descsz; Elf64_Word n_type; } Elf64_Nhdr; n_namesz . . . "GNU" n_namesz 4. n_descsz . . n_type : Core files (e_type = ET_CORE) . C . ( n_namesz 0) . NT_PRSTATUS prstatus NT_FPREGSET fpregset NT_PRPSINFO prpsinfo NT_PRXREG prxregset NT_TASKSTRUCT task NT_PLATFORM sysinfo(SI_PLATFORM) NT_AUXV auxv NT_GWINDOWS gwindows NT_ASRS asrset NT_PSTATUS pstatus NT_PSINFO psinfo NT_PRCRED prcred NT_UTSNAME utsname NT_LWPSTATUS lwpstatus NT_LWPSINFO lwpinfo NT_PRFPXREG fprxregset NT_SIGINFO siginfo_t ( ) NT_FILE () NT_PRXFPREG user_fxsr_struct NT_PPC_VMX PowerPC Altivec/VMX NT_PPC_SPE PowerPC SPE/EVR NT_PPC_VSX PowerPC VSX NT_386_TLS i386 TLS ( user_desc) NT_386_IOPERM x86 io (1=) NT_X86_XSTATE x86 xsave NT_S390_HIGH_GPRS s390 NT_S390_TIMER s390 NT_S390_TODCMP (TOD) s390 NT_S390_TODPREG (TOD) s390 NT_S390_CTRS s390 NT_S390_PREFIX s390 NT_S390_LAST_BREAK s390 NT_S390_SYSTEM_CALL s390 NT_S390_TDB s390 NT_ARM_VFP ARM VFP/NEON NT_ARM_TLS ARM TLS NT_ARM_HW_BREAK ARM NT_ARM_HW_WATCH ARM NT_ARM_SYSTEM_CALL ARM n_name = GNU GNU. NT_GNU_ABI_TAG ABI (OS). desc 4 : [0] (ELF_NOTE_OS_LINUX ELF_NOTE_OS_GNU ) [1] ABI [2] ABI [3] ABI NT_GNU_HWCAP hwcap . desc : [0] [1] hwcap . (1U << bit) & . NT_GNU_BUILD_ID --build-id GNU ld(1). (desc) . NT_GNU_GOLD_VERSION (desc) GNU Gold . Default/unknown namespace (e_type != ET_CORE) ( n_namesz 0) . NT_VERSION . NT_ARCH . ELF System V. ELF . e_phnum e_shnum e_shstrndx . Sun BSD AMD64 (SEE ALSO). as(1), elfedit(1), gdb(1), ld(1), nm(1), objcopy(1), objdump(1), patchelf(1), readelf(1), size(1), strings(1), strip(1), execve(2), dl_iterate_phdr(3), core(5), ld.so(8) - (Hewlett-Packard) Elf-64 Object File Format. (Santa Cruz Operation) System V Application Binary Interface. (UNIX System Laboratories) "Object Files" Executable and Linking Format (ELF). (Sun Microsystems) Linker and Libraries Guide. AMD64 ABI System V Application Binary Interface AMD64 Architecture Processor Supplement. 3 . . : . 6.18 8 2026 ELF(5)