In computing, the Executable and Linkable FormatTool Interface Standard (TIS) Portable Formats Specification Version 1.1 (October 1993) (ELF, formerly named Extensible Linking Format) is a common standard file format for executable files, object code, shared libraries, device drivers, and core dumps. First published in the specification for the application binary interface (ABI) of the Unix operating system version named System V Release 4 (SVR4),System V Application Binary Interface Edition 4.1 (1997-03-18) and later in the Tool Interface Standard,Tool Interface Standard (TIS) Executable and Linking Format (ELF) Specification Version 1.2 (May 1995) it was quickly accepted among different vendors of Unix systems. In 1999, it was chosen as the standard binary file format for Unix and Unix-like systems on x86 processors by the 86open project.

By design, the ELF format is flexible, extensible, and cross-platform. For instance, it supports different endiannesses and address sizes so it does not exclude any particular CPU or instruction set architecture. This has allowed it to be adopted by many different operating systems on many different hardware platforms.

File layout

Each ELF file is made up of one ELF header, followed by file data. The data can include: Program header table, describing zero or more memory segments Section header table, describing zero or more sections Data referred to by entries in the program header table or section header table

The segments contain information that is needed for run time execution of the file, while sections contain important data for linking and relocation. Any byte in the entire file can be owned by one section at most, and orphan bytes can occur which are unowned by any section.

ELF header

The ELF header defines whether to use 32-bit or 64-bit addresses. The header contains three fields that are affected by this setting and offset other fields that follow them. The ELF header is 52 or 64 bytes long for 32-bit and 64-bit binaries, respectively.

+ ELF header Offset Size (bytes) Field Purpose 4 through 0x7F followed by ELF() in ASCII; these four bytes constitute the magic number. 1 This byte is set to either 1 or 2 to signify 32- or 64-bit format, respectively. 1 This byte is set to either 1 or 2 to signify little or big endianness, respectively. This affects interpretation of multi-byte fields starting with offset 0x10. 1 Set to 1 for the original and current version of ELF. 1 Identifies the target operating system ABI. ValueABI System V HP-UX NetBSD Linux GNU Hurd Solaris AIX (Monterey) IRIX FreeBSD Tru64 Novell Modesto OpenBSD OpenVMS NonStop Kernel AROS FenixOS Nuxi CloudABI Stratus Technologies OpenVOS 1 Further specifies the ABI version. Its interpretation depends on the target ABI. Linux kernel (after at least 2.6) has no definition of it, so it is ignored for statically linked executables. In that case, offset and size of EI_PAD are 8. glibc 2.12+ in case treats this field as ABI version of the dynamic linker: it defines a list of dynamic linker's features, treats as a feature level requested by the shared object (executable or dynamic library) and refuses to load it if an unknown feature is requested, i.e. is greater than the largest known feature. 7 Reserved padding bytes. Currently unused. Should be filled with zeros and ignored when read. 2 Identifies object file type. ValueTypeMeaning ET_NONEUnknown. ET_RELRelocatable file. ET_EXECExecutable file. ET_DYNShared object. ET_CORECore file. ET_LOOS Reserved inclusive range. Operating system specific. ET_HIOS ET_LOPROC Reserved inclusive range. Processor specific. ET_HIPROC 2 Specifies target instruction set architecture. Some examples are: ValueISA No specific instruction set AT&T WE 32100 SPARC x86 Motorola 68000 (M68k) Motorola 88000 (M88k) Intel MCU Intel 80860 MIPS IBM System/370 MIPS RS3000 Little-endian Reserved for future use Hewlett-Packard PA-RISC Intel 80960 PowerPC PowerPC (64-bit) S390, including S390x IBM SPU/SPC Reserved for future use NEC V800 Fujitsu FR20 TRW RH-32 Motorola RCE Arm (up to Armv7/AArch32) Digital Alpha SuperH SPARC Version 9 Siemens TriCore embedded processor Argonaut RISC Core Hitachi H8/300 Hitachi H8/300H Hitachi H8S Hitachi H8/500 IA-64 Stanford MIPS-X Motorola ColdFire Motorola M68HC12 Fujitsu MMA Multimedia Accelerator Siemens PCP Sony nCPU embedded RISC processor Denso NDR1 microprocessor Motorola Star*Core processor Toyota ME16 processor STMicroelectronics ST100 processor Advanced Logic Corp. TinyJ embedded processor family AMD x86-64 Sony DSP Processor Digital Equipment Corp. PDP-10 Digital Equipment Corp. PDP-11 Siemens FX66 microcontroller STMicroelectronics ST9+ 8/16-bit microcontroller STMicroelectronics ST7 8-bit microcontroller Motorola MC68HC16 Microcontroller Motorola MC68HC11 Microcontroller Motorola MC68HC08 Microcontroller Motorola MC68HC05 Microcontroller Silicon Graphics SVx STMicroelectronics ST19 8-bit microcontroller Digital VAX Axis Communications 32-bit embedded processor Infineon Technologies 32-bit embedded processor Element 14 64-bit DSP Processor LSI Logic 16-bit DSP Processor TMS320C6000 Family MCST Elbrus e2k Arm 64-bits (Armv8/AArch64) Zilog Z80 RISC-V Berkeley Packet FilterWDC 65C816LoongArch 4 Set to 1 for the original version of ELF. 4 8 This is the memory address of the entry point from where the process starts executing. This field is either 32 or 64 bits long, depending on the format defined earlier (byte 0x04). If the file doesn't have an associated entry point, then this holds zero. 4 8 Points to the start of the program header table. It usually follows the file header immediately following this one, making the offset 0x34 or 0x40 for 32- and 64-bit ELF executables, respectively. 4 8 Points to the start of the section header table. 4 Interpretation of this field depends on the target architecture. 2 Contains the size of this header, normally 64 Bytes for 64-bit and 52 Bytes for 32-bit format. 2 Contains the size of a program header table entry. As explained below, this will typically be 0x20 (32-bit) or 0x38 (64-bit). 2 Contains the number of entries in the program header table. 2 Contains the size of a section header table entry. As explained below, this will typically be 0x28 (32-bit) or 0x40 (64-bit). 2 Contains the number of entries in the section header table. 2 Contains index of the section header table entry that contains the section names. End of ELF Header (size).

Example hexdump

00000000 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 |.ELF............| 00000010 02 00 3e 00 01 00 00 00 c5 48 40 00 00 00 00 00 |..>......H@.....|

Program header

The program header table tells the system how to create a process image. It is found at file offset , and consists of entries, each with size . The layout is slightly different in 32-bit ELF vs 64-bit ELF, because the are in a different structure location for alignment reasons. Each entry is structured as:

+ Program header Offset Size (bytes) Field Purpose 4 Identifies the type of the segment. ValueNameMeaning Program header table entry unused. Loadable segment. Dynamic linking information. Interpreter information. Auxiliary information. Reserved. Segment containing program header table itself. Thread-Local Storage template. Reserved inclusive range. Operating system specific. Reserved inclusive range. Processor specific. 4 Segment-dependent flags (position for 64-bit structure). ValueNameMeaning Executable segment. Writeable segment. Readable segment. 4 8Offset of the segment in the file image. 4 8 Virtual address of the segment in memory. 4 8 On systems where physical address is relevant, reserved for segment's physical address. 4 8 Size in bytes of the segment in the file image. May be 0. 4 8 Size in bytes of the segment in memory. May be 0. 4 Segment-dependent flags (position for 32-bit structure). See above p_flags field for flag definitions. 4 8 0 and 1 specify no alignment. Otherwise should be a positive, integral power of 2, with equating , modulus . End of Program Header (size).

Section header

OffsetSize (bytes)FieldPurpose32-bit64-bit32-bit64-bit0x004 An offset to a string in the .shstrtab section that represents the name of this section.0x044 Identifies the type of this header. ValueNameMeaning Section header table entry unused Program data Symbol table String table Relocation entries with addends Symbol hash table Dynamic linking information Notes Program space with no data (bss) Relocation entries, no addends Reserved Dynamic linker symbol table Array of constructors Array of destructors Array of pre-constructors Section group Extended section indices Number of defined types. Start OS-specific..........0x0848 Identifies the attributes of the section. ValueNameMeaning Writable Occupies memory during execution Executable Might be merged Contains null-terminated strings 'sh_info' contains SHT index Preserve order after combining Non-standard OS specific handling required Section is member of a group Section hold thread-local data OS-specific Processor-specific Special ordering requirement (Solaris) Section is excluded unless referenced or allocated (Solaris) 48 Virtual address of the section in memory, for sections that are loaded. 48 Offset of the section in the file image. 48 Size in bytes of the section. May be 0. 4 Contains the section index of an associated section. This field is used for several purposes, depending on the type of section. 4 Contains extra information about the section. This field is used for several purposes, depending on the type of section. 48 Contains the required alignment of the section. This field must be a power of two. 48 Contains the size, in bytes, of each entry, for sections that contain fixed-size entries. Otherwise, this field contains zero. End of Section Header (size).

Tools

readelf is a Unix binary utility that displays information about one or more ELF files. A free software implementation is provided by GNU Binutils. elfutils provides alternative tools to GNU Binutils purely for Linux. elfdump is a command for viewing ELF information in an ELF file, available under Solaris and FreeBSD. objdump provides a wide range of information about ELF files and other object formats. objdump uses the Binary File Descriptor library as a back-end to structure the ELF data. The Unix file utility can display some information about ELF files, including the instruction set architecture for which the code in a relocatable, executable, or shared object file is intended, or on which an ELF core dump was produced.

Applications

Unix-like systems

The ELF format has replaced older executable formats in various environments. It has replaced a.out and COFF formats in Unix-like operating systems: Linux Solaris / Illumos IRIX FreeBSD NetBSD OpenBSD Redox DragonFly BSD Syllable HP-UX (except for 32-bit PA-RISC programs which continue to use SOM) QNX Neutrino MINIX

Non-Unix adoption

ELF has also seen some adoption in non-Unix operating systems, such as: OpenVMS, in its Itanium and amd64 versions BeOS Revision 4 and later for x86 based computers (where it replaced the Portable Executable format; the PowerPC version stayed with Preferred Executable Format) Haiku, an open source reimplementation of BeOS RISC OS Stratus VOS, in PA-RISC and x86 versions SkyOS Fuchsia OS Z/TPF HPE NonStop OS p. 44 archived from the original on 2018-5-30 Deos

Microsoft Windows also uses the ELF format, but only for its Windows Subsystem for Linux compatibility system.

Game consoles

Some game consoles also use ELF: PlayStation Portable,PlayStation Portable use encrypted & relocated ELF : PSP PlayStation Vita, PlayStation, PlayStation 2, PlayStation 3, PlayStation 4, PlayStation 5 GP2X Dreamcast GameCube Nintendo 64 Wii Wii U

PowerPC

Other (operating) systems running on PowerPC that use ELF: