Executable and Linkable Format

ELF
Filename extension none, .axf, .bin, .elf, .o, .prx, .puff and .so
Magic number 0x7F 'E' 'L' 'F'
Developed by Unix System Laboratories[1]:3
Type of format Binary, executable, object, shared libraries, core dump
Container for Many executable binary formats
An ELF file has two views: the program header shows the segments used at run-time, whereas the section header lists the set of sections of the binary.

In computing, the Executable and Linkable Format (ELF, formerly called Extensible Linking Format) is a common standard file format for executables, object code, shared libraries, and core dumps. First published in the System V Release 4 (SVR4) Application Binary Interface (ABI) specification,[2] and later in the Tool Interface Standard,[1] it was quickly accepted among different vendors of Unix systems. In 1999 it was chosen as the standard binary file format for Unix and Unix-like systems on x86 by the 86open project.

ELF is flexible and extensible by design, and it is not bound to any particular processor or architecture. This has allowed it to be adopted by many different operating systems on many different platforms.

File layout

Each ELF file is made up of one ELF header, followed by file data. The file data can include:

The segments contain information that is necessary for runtime execution of the file, while sections contain important data for linking and relocation. Any byte in the entire file can be owned by at most one section, and there can be orphan bytes which are not owned by any section.

00000000 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 |.ELF............|

00000010 02 00 3e 00 01 00 00 00 c5 48 40 00 00 00 00 00 |..>......H@.....|

Example hexdump of ELF file header[3]

File header

The ELF header defines whether 32- or 64-bit addresses are to be used. The header itself contains three fields that are affected by this setting and offset other fields that follow them. The 64-bit header is 64 bytes long.

ELF header[4]
Offset Size (Bytes) Field Purpose
32-bit 64-bit 32-bit 64-bit
0x00 4 e_ident[EI_MAG0] through e_ident[EI_MAG3] 0x7F followed by ELF(45 4c 46) in ASCII; these four bytes constitute the magic number.
0x04 1 e_ident[EI_CLASS] This byte is set to either 1 or 2 to signify 32- or 64-bit format, respectively.
0x05 1 e_ident[EI_DATA] This byte is set to either 1 or 2 to signify little or big endianness, respectively. This affects interpretation of multi-byte fields starting with offset 0x10.
0x06 1 e_ident[EI_VERSION] Set to 1 for the original version of ELF.
0x07 1 e_ident[EI_OSABI] Identifies the target operating system ABI.
ValueABI
0x00System V
0x01HP-UX
0x02NetBSD
0x03Linux
0x06Solaris
0x07AIX
0x08IRIX
0x09FreeBSD
0x0COpenBSD
0x0DOpenVMS
0x0ENSK operating system
0x0FAROS
0x10Fenix OS
0x11CloudABI

It is often set to 0 regardless of the target platform.

0x08 1 e_ident[EI_ABIVERSION] Further specifies the ABI version. Its interpretation depends on the target ABI. Linux kernel (after at least 2.6) has no definition of it.[5] In that case, offset and size of EI_PAD are 8.
0x09 7 e_ident[EI_PAD] currently unused
0x10 2 e_type 1, 2, 3, 4 specify whether the object is relocatable, executable, shared, or core, respectively.
0x12 2 e_machine Specifies target instruction set architecture. Some examples are:
ValueISA
0x00 No specific instruction set
0x02SPARC
0x03x86
0x08MIPS
0x14PowerPC
0x28ARM
0x2ASuperH
0x32IA-64
0x3Ex86-64
0xB7AArch64
0x14 4 e_version Set to 1 for the original version of ELF.
0x18 4 8 e_entry This is the memory address of the entry point from where the process starts executing. This field is either 32 or 64 bits long depending on the format defined earlier.
0x1C 0x20 4 8 e_phoff Points to the start of the program header table. It usually follows the file header immediately, making the offset 0x34 or 0x40 for 32- and 64-bit ELF executables, respectively.
0x20 0x28 4 8 e_shoff Points to the start of the section header table.
0x24 0x30 4 e_flags Interpretation of this field depends on the target architecture.
0x28 0x34 2 e_ehsize Contains the size of this header, normally 64 bytes for 64-bit and 52 for 32-bit format.
0x2A 0x36 2 e_phentsize Contains the size of a program header table entry.
0x2C 0x38 2 e_phnum Contains the number of entries in the program header table.
0x2E 0x3A 2 e_shentsize Contains the size of a section header table entry.
0x30 0x3C 2 e_shnum Contains the number of entries in the section header table.
0x32 0x3E 2 e_shstrndx Contains index of the section header table entry that contains the section names.

Program Header

The program header table tells the system how to create a process image. It is found at file offset e_phoff, and consists of e_phnum entries, each with size e_phentsize. For 32-bit ELF, each entry is structured as:

Program header (32-bit)[6]
OffsetSize (Bytes)FieldPurpose
0x004p_typeIdentifies the type of the segment.
ValueName
0x00000000PT_NULL
0x00000001PT_LOAD
0x00000002PT_DYNAMIC
0x00000003PT_INTERP
0x00000004PT_NOTE
0x00000005PT_SHLIB
0x00000006PT_PHDR
0x60000000PT_LOOS
0x6FFFFFFFPT_HIOS
0x70000000PT_LOPROC
0x7FFFFFFFPT_HIPROC

PT_LOOS to PT_HIOS (PT_LOPROC to PT_HIPROC) is an inclusive reserved ranges for operating system (processor) specific semantics.

0x044p_offsetOffset of the segment in the file image.
0x084p_vaddrVirtual address of the segment in memory.
0x0C4p_paddrOn systems where physical address is relevant, reserved for segment's physical address.
0x104p_fileszSize in bytes of the segment in the file image. May be 0.
0x144p_memszSize in bytes of the segment in memory. May be 0.
0x184p_flagsSegment-dependent flags.
0x1C4p_align0 and 1 specifies no alignment. Otherwise should be a positive, integral power of 2, with p_vaddr equating p_offset modulus p_align.

Section Header

Offset Size (Bytes) Field Name Purpose
0x00 4 Name An offset to a string in the .shstrtab section that represents the name of this section
0x04 4 Type Identifies the type of this header.

Some common examples include:

Value Name
0x00000000 NULL
0x00000001 PROGBITS
0x00000002 SYMTAB
0x00000003 STRTAB
0x08 4 Flags
0x0C 4 Address Virtual address of the section in memory, for sections that are loaded.
0x10 4 Offset Offset of the section in the file image.
0x14 4 Size Size in bytes of the section in the file image. May be 0.
0x18 - 0x28 Various other info found in the readelf command such as "ES", "Lk", "Inf" and "Al"

Tools

Applications

The ELF format has replaced older executable formats in various environments. It has replaced a.out and COFF formats in Unix-like operating systems:

ELF has also seen some adoption in non-Unix operating systems, such as:

Some game consoles also use ELF:

Other operating systems running on PowerPC using ELF:

Some operating systems for mobile phones and mobile devices use ELF:

Some phones can run ELF files through the use of a patch that adds assembly code to the main firmware, which is a feature known as ELFPack in the underground modding culture. The ELF file format is also used with the Atmel AVR (8-bit), AVR32[13] and with Texas Instruments MSP430 microcontroller architectures. Some implementations of Open Firmware can also load ELF files, most notably Apple's implementation used in almost all PowerPC machines the company produced.

Specifications

The Linux Standard Base (LSB) supplements some of the above specifications for architectures in which it is specified.[14] For example, that is the case for the System V ABI, AMD64 Supplement.[15][16]

86open

86open was a project to form consensus on a common binary file format for Unix and Unix-like operating systems on the common PC compatible x86 architecture, in order to encourage software developers to port to the architecture.[17] The initial idea was to standardize on a small subset of Spec 1170, a predecessor of the Single UNIX Specification, and the GNU C Library (glibc) to enable unmodified binaries to run on the x86 UNIX-like operating systems. The project was originally designated "Spec 150".

The format eventually chosen was ELF, specifically the Linux implementation of ELF, after it had turned out to be a de facto standard supported by all involved vendors and operating systems.

The group started email discussions in 1997 and first met together at the Santa Cruz Operation offices on August 22, 1997.

The steering committee was Marc Ewing, Dion Johnson, Evan Leibovitch, Bruce Perens, Andrew Roach, Bryan Sparks and Linus Torvalds. Other people on the project were Keith Bostic, Chuck Cranor, Michael Davidson, Chris G. Demetriou, Ulrich Drepper, Don Dugger, Steve Ginzburg, Jon "maddog" Hall, Ron Holt, Jordan Hubbard, Dave Jensen, Kean Johnston, Andrew Josey, Robert Lipe, Bela Lubkin, Tim Marsland, Greg Page, Ronald Joe Record, Tim Ruckle, Joel Silverstein, Chia-pi Tien and Erik Troan. Operating systems and companies represented were BeOS, BSDI, FreeBSD, Intel, Linux, NetBSD, SCO and SunSoft, Inc..

The project progressed and in mid-1998, SCO began developing lxrun, an open-source compatibility layer capable of running Linux binaries on OpenServer, UnixWare, and Solaris. SCO announced official support of lxrun at LinuxWorld in March 1999. Sun Microsystems began officially supporting lxrun for Solaris in early 1999,[18] and has since moved to integrated support of the Linux binary format via Solaris Containers for Linux Applications.

With the BSDs having long supported Linux binaries (through a compatibility layer) and the main x86 Unix vendors having added support for the format, the project decided that Linux ELF was the format chosen by the industry and "declare[d] itself dissolved" on July 25, 1999.[19]

FatELF: Universal Binaries for Linux

FatELF is an ELF binary-format extension which adds Fat binary capabilities.[20] It is aimed for Linux and other Unix-like operating systems. Additionally to the CPU architecture abstraction (byte order, word size, CPU instruction set etc.), there is the potential advantage of software-platform abstraction e.g. binaries which support multiple kernel ABI versions.

A proof-of-concept Ubuntu 9.04 image (VM image of Ubuntu 9.04 with Fat Binary support) and development tools are available. As of 2014, support for FatELF is not integrated in the Linux kernel mainline.[21][22][23]

See also

References

  1. 1 2 Tool Interface Standard (TIS) Executable and Linking Format (ELF) Specification Version 1.2 (May 1995)
  2. ↑ System V Application Binary Interface Edition 4.1 (1997-03-18)
  3. ↑ http://pygments.org/docs/lexers/#lexers-for-hexadecimal-dumps
  4. ↑ "ELF Header". Sco.com. July 2000. Retrieved 2014-02-07.
  5. ↑ "LXR linux/include/linux/elf.h". linux.no. Retrieved 27 April 2015.
  6. ↑ "Program Header". Sco.com. July 2000. Retrieved 2016-01-13.
  7. ↑ "elfutils". fedorahosted.org. Retrieved 27 April 2015.
  8. ↑ "MinixReleases - Minix Wiki". Wiki.minix3.org. Retrieved 2014-01-19.
  9. ↑ "GCCSDK - RISC OS". Riscos.info. 2012-04-22. Retrieved 2014-01-19.
  10. ↑ "Announcing Windows 10 Insider Preview Build 14316". Windows Experience Blog. Retrieved 2016-04-10.
  11. ↑ PlayStation Portable use encrypted & relocated ELF : PSP
  12. ↑ Symbian OS executable file format
  13. ↑ "Chapter 4: Object Files", System V Application Binary Interface, 2009-10-26, e_machine
  14. ↑ "LSB Referenced Specifications". linuxfoundation.org. Retrieved 27 April 2015.
  15. ↑ "Executable and Linking Format (ELF)". linuxfoundation.org. Retrieved 27 April 2015.
  16. ↑ "Introduction". linuxfoundation.org. Retrieved 27 April 2015.
  17. ↑ Leibovitch, Evan (1997-12-23). "86Open Frequently-Asked Questions". Archived from the original on 2007-03-11. Retrieved 2007-06-06.
  18. ↑ Record, Ronald (1998-05-21). "Bulletin on status of 86open at SCO". Retrieved 2008-05-06.
  19. ↑ Leibovitch, Evan (1999-07-25). "The86open Project - FINAL UPDATE". Archived from the original on 2007-02-27. Retrieved 2007-05-06.
  20. ↑ Gordon, Ryan. "fatelf-specification v1". icculus.org. Retrieved 2010-07-25.
  21. ↑ Gordon, Ryan. "FatELF: Turns out I liked the uncertainty better.". icculus.org. Retrieved 2010-07-13.
  22. ↑ Holwerda, Thom (2009-11-03). "Ryan Gordon Halts FatELF Project". osnews.com. Retrieved 2010-07-05.
  23. ↑ Brockmeier, Joe (June 23, 2010). "SELF: Anatomy of an (alleged) failure". Linux Weekly News. Retrieved 2011-02-06.

Further reading

External links

This article is issued from Wikipedia - version of the Thursday, April 28, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.