View source for Executable and Linkable Format

{{Short description|Standard file format for executables, object code, shared libraries, and core dumps}}
{{Infobox file format
| name = Executable and Linkable Format
| icon = 
| extension = none, {{Mono|.axf}}, {{Mono|.bin}}, {{Mono|.elf}}, {{Mono|.o}}, {{Mono|.out}}, {{Mono|.prx}}, {{Mono|.puff}}, {{Mono|.ko}}, {{Mono|.mod}}, and {{Mono|.so}}
| mime =
| magic = <code>0x7F 'E' 'L' 'F'</code>
| developer = [[Unix System Laboratories]]<ref name="linuxbase-elf" />{{rp|3}}
| type = [[Binary file|Binary]], [[executable]], [[object code|object]], [[Library (computing)|shared library]], [[core dump]]
| container_for = Many executable binary formats
| released = {{start date and age|1998|05|14|df=yes}}
| latest_release_version = 4.2 <ref>[https://gabi.xinuos.com/elf/c-history.html ELF Object File Format: Appendix C: Revision History]</ref>
| latest_release_date = {{start date and age|2025|df=yes}}
| url = {{URL|github.com/xinuos/gabi}}
| standard = {{URL|gabi.xinuos.com}}
}}

[[File:Elf-layout--en.svg|thumb|upright=1.2|An ELF file has two views: the program header shows the ''segments'' used at run time, whereas the section header lists the set of ''sections''.]]

In [[computing]], the '''Executable and Linkable Format'''<ref name="linuxfoundation-elf">Tool Interface Standard (TIS) ''[https://refspecs.linuxfoundation.org/elf/TIS1.1.pdf Portable Formats Specification] Version 1.1'' (October 1993)</ref> ('''ELF''', formerly named '''Extensible Linking Format''') is a common standard [[file format]] for [[executable]] files, [[object code]], [[Shared library|shared libraries]], [[device driver]]s, and [[core dump]]s. First published in the specification for the [[application binary interface]] (ABI) of the [[Unix]] operating system version named [[System V Release 4]] (SVR4),<ref>''[https://www.sco.com/developers/devspecs/gabi41.pdf System V Application Binary Interface]'' Edition 4.1 (1997-03-18)</ref> and later in the Tool Interface Standard,<ref name="linuxbase-elf">Tool Interface Standard (TIS) ''[https://refspecs.linuxbase.org/elf/elf.pdf Executable and Linking Format (ELF) Specification] Version 1.2'' (May 1995)</ref> it was quickly accepted among different vendors of [[Unix]] systems. In 1999, it was chosen as the standard binary file format for Unix and [[Unix-like]] systems on [[x86]] processors by the [[#86open|86open]] project.

By design, the ELF format is flexible, extensible, and [[cross-platform]]. For instance, it supports different [[endiannesses]] and address sizes so it does not exclude any particular [[central processing unit|CPU]] or [[instruction set architecture]]. This has allowed it to be adopted by many different [[operating system]]s on many different hardware [[Computing platform|platforms]].

== File layout ==

Each ELF file is made up of one ELF header, followed by file data. The data can include:
* Program header table, describing zero or more [[Memory segmentation|memory segments]]
* Section header table, describing zero or more sections
* Data referred to by entries in the program header table or section header table

[[File:ELF Executable and Linkable Format diagram by Ange Albertini.png|thumb|center|upright=2.0|Structure of an ELF file with key entries highlighted]]

The segments contain information that is needed for [[Run time (program lifecycle phase)|run time]] execution of the file, while sections contain important data for linking and relocation. Any [[byte]] in the entire file can be owned by one section at most, and orphan bytes can occur which are unowned by any section.

=== ELF header ===

The ELF header defines whether to use [[32-bit computing|32-bit]] or [[64-bit computing|64-bit]] addresses. The header contains three fields that are affected by this setting and offset other fields that follow them. The ELF header is 52 or 64 bytes long for 32-bit and 64-bit binaries, respectively.

{| class="wikitable"
|+ ELF header<ref>{{cite web|url=https://www.sco.com/developers/gabi/2000-07-17/ch4.eheader.html |title=ELF Header |publisher=Sco.com |date=July 2000 |access-date=2014-02-07}}</ref>
|-
! colspan="2" | Offset!! colspan="2" | Size (bytes) !! rowspan="2" | Field !! rowspan="2" | Purpose
|-
! {{nowrap|32-bit}} !! {{nowrap|64-bit}} !! {{nowrap|32-bit}} !! {{nowrap|64-bit}}
|-
| colspan="2" | {{tt|0x00}} || colspan="2" | 4 || {{mono|e_ident[EI_MAG0]}} through {{mono|e_ident[EI_MAG3]}}
| <code>0x7F</code> followed by <code>ELF</code>({{code|45 4c 46}}) in [[ASCII]]; these four bytes constitute the [[magic number (programming)|magic number]].
|-
| colspan="2" | {{tt|0x04}} || colspan="2" | 1 || {{mono|e_ident[EI_CLASS]}}
|This byte is set to either <code>1</code> or <code>2</code> to signify 32- or 64-bit format, respectively.
|-
| colspan="2" | {{tt|0x05}} || colspan="2" | 1 || {{mono|e_ident[EI_DATA]}}
|This byte is set to either <code>1</code> or <code>2</code> to signify little or big [[endianness]], respectively. This affects interpretation of multi-byte fields starting with offset <code>0x10</code>.
|-
| colspan="2" | {{tt|0x06}} || colspan="2" | 1 || {{mono|e_ident[EI_VERSION]}}
|Set to <code>1</code> for the original and current version of ELF.
|-
| colspan="2" | {{tt|0x07}} || colspan="2" | 1 || {{mono|e_ident[EI_OSABI]}}
|Identifies the target operating system [[application binary interface|ABI]].
{| class="wikitable mw-collapsible mw-collapsed"
|-
!Value!!ABI
|-
| {{tt|0x00}} ||[[System V]]
|-
| {{tt|0x01}} ||[[HP-UX]]
|-
| {{tt|0x02}} ||[[NetBSD]]
|-
| {{tt|0x03}} ||[[Linux]]
|-
| {{tt|0x04}} ||[[GNU Hurd]]
|-
| {{tt|0x06}} ||[[Solaris (operating system)|Solaris]]
|-
| {{tt|0x07}} ||[[IBM AIX|AIX]] (Monterey)
|-
| {{tt|0x08}} ||[[IRIX]]
|-
| {{tt|0x09}} ||[[FreeBSD]]
|-
| {{tt|0x0A}} ||[[Tru64]]
|-
| {{tt|0x0B}} ||Novell Modesto
|-
| {{tt|0x0C}} ||[[OpenBSD]]
|-
| {{tt|0x0D}} ||[[OpenVMS]]
|-
| {{tt|0x0E}} ||[[NonStop (server computers)|NonStop Kernel]]
|-
| {{tt|0x0F}} ||[[AROS Research Operating System|AROS]]
|-
| {{tt|0x10}} ||FenixOS
|-
| {{tt|0x11}} ||Nuxi [[CloudABI]]
|-
| {{tt|0x12}} ||[[Stratus VOS|Stratus Technologies OpenVOS]]
<!--
Unclear if ever used directly on [[RISC OS]] (it has an RISC OS file type, 0xE1F for ELF, for "elfrun"), seemingly only indirectly used with elf2aif tool (at least most of the time), to target RISC OS's AIF format:
https://heyrick.eu/blog/index.php?diary=20150727

https://www.riscosopen.org/wiki/documentation/show/File%20Types
-->
|}
|-
| colspan="2" | {{tt|0x08}} || colspan="2" | 1 || {{mono|e_ident[EI_ABIVERSION]}}
|Further specifies the ABI version. Its interpretation depends on the target ABI. Linux kernel (after at least 2.6) has no definition of it,<ref>{{cite web|url=http://lxr.linux.no/linux+v2.6.11/include/linux/elf.h#L380|title=LXR linux/include/linux/elf.h|website=linux.no|access-date=27 April 2015}}</ref> so it is ignored for statically linked executables. In that case, offset and size of EI_PAD are <code>8</code>.
glibc 2.12+ in case {{mono|1=e_ident[EI_OSABI] == 3}} treats this field as ABI version of the [[dynamic linker]]:<ref>{{cite web|url=https://sourceware.org/ml/libc-alpha/2010-05/msg00000.html|title=glibc 2.12 announce}}</ref> it defines a list of dynamic linker's features,<ref>{{cite web|url=https://sourceware.org/git/?p=glibc.git;a=blob;f=libc-abis;h=e702f6ae245c1528f5a608df8cfae4f037809de2;hb=HEAD|title=sourceware.org Git - glibc.git/blob - libc-abis}}</ref> treats {{mono|e_ident[EI_ABIVERSION]}} as a feature level requested by the shared object (executable or dynamic library) and refuses to load it if an unknown feature is requested, i.e. {{mono|e_ident[EI_ABIVERSION]}} is greater than the largest known feature.<ref>{{cite web|url=https://sourceware.org/git/?p=glibc.git%3Ba%3Dblob%3Bf%3Dsysdeps%2Fgnu%2Fldsodefs.h%3Bh%3D253b4d934c5ca457ab5580a2a6398205e4f961ba%3Bhb%3DHEAD#l32|title=sourceware.org Git - glibc.git/blob - sysdeps/gnu/ldsodefs.h|access-date=2019-10-28|archive-date=2021-03-07|archive-url=https://web.archive.org/web/20210307223850/https://sourceware.org/git/?p=glibc.git%3Ba%3Dblob%3Bf%3Dsysdeps%2Fgnu%2Fldsodefs.h%3Bh%3D253b4d934c5ca457ab5580a2a6398205e4f961ba%3Bhb%3DHEAD#l32|url-status=dead}}</ref>
|-
| colspan="2" | {{tt|0x09}} || colspan="2" | 7 || {{mono|e_ident[EI_PAD]}}
|Reserved padding bytes. Currently unused. Should be filled with zeros and ignored when read.
|-
| colspan="2" | {{tt|0x10}} || colspan="2" | 2 || {{mono|e_type}}
| Identifies object file type.
{| class="wikitable mw-collapsible mw-collapsed"
|-
!Value!!Type!!Meaning
|-
| {{tt|0x00}} ||ET_NONE||Unknown.
|-
| {{tt|0x01}} ||ET_REL||Relocatable file.
|-
| {{tt|0x02}} ||ET_EXEC||Executable file.
|-
| {{tt|0x03}} ||ET_DYN||Shared object.
|-
| {{tt|0x04}} ||ET_CORE||Core file.
|-
| {{tt|0xFE00}} ||ET_LOOS|| rowspan="2" | Reserved inclusive range. Operating system specific.
|-
| {{tt|0xFEFF}} ||ET_HIOS
|-
| {{tt|0xFF00}} ||ET_LOPROC|| rowspan="2" | Reserved inclusive range. Processor specific.
|-
| {{tt|0xFFFF}} ||ET_HIPROC
|} 
|-
| colspan="2" | {{tt|0x12}} || colspan="2" | 2 || {{mono|e_machine}}
|Specifies target [[instruction set architecture]]. Some examples are:
{| class="wikitable mw-collapsible mw-collapsed"
|-
!Value!!ISA
|-
| {{tt|0x00}} || No specific instruction set
|-
| {{tt|0x01}} || [[Bellmac 32|AT&T WE 32100]]
|-
| {{tt|0x02}} ||[[SPARC]]
|-
| {{tt|0x03}} ||[[x86]]
|-
| {{tt|0x04}} ||[[Motorola 68000 series|Motorola 68000 (M68k)]]
|-
| {{tt|0x05}} ||[[Motorola 88000|Motorola 88000 (M88k)]]
|-
| {{tt|0x06}} ||[[List of Intel processors#Microcontrollers|Intel MCU]]
|-
| {{tt|0x07}} ||[[Intel i860|Intel 80860]]
|-
| {{tt|0x08}} ||[[MIPS architecture|MIPS]]
|-
| {{tt|0x09}} ||[[IBM System/370]]
|-
| {{tt|0x0A}} ||[[R3000|MIPS RS3000 Little-endian]]
|-
| {{tt|0x0B – 0x0E}} ||Reserved for future use
|-
| {{tt|0x0F}} ||[[PA-RISC|Hewlett-Packard PA-RISC]]
|-
| {{tt|0x13}} ||[[Intel i960|Intel 80960]]
|-
| {{tt|0x14}} ||[[PowerPC]]
|-
| {{tt|0x15}} ||[[PowerPC]] (64-bit)
|-
| {{tt|0x16}} ||[[Z/Architecture|S390]], including S390x
|-
| {{tt|0x17}} ||IBM SPU/SPC
|-
| {{tt|0x18 – 0x23}} ||Reserved for future use
|-
| {{tt|0x24}} ||[[V850|NEC V800]]
|-
| {{tt|0x25}} ||Fujitsu FR20
|-
| {{tt|0x26}} ||[[RH-32|TRW RH-32]]
|-
| {{tt|0x27}} ||Motorola RCE
|-
| {{tt|0x28}} ||[[ARM architecture family|Arm]] (up to Armv7/AArch32)
|-
| {{tt|0x29}} ||[[Digital Alpha]]
|-
| {{tt|0x2A}} ||[[SuperH]]
|-
| {{tt|0x2B}} ||[[SPARC|SPARC Version 9]]
|-
| {{tt|0x2C}} ||[[Infineon TriCore|Siemens TriCore embedded processor]]
|-
| {{tt|0x2D}} ||[[ARC (processor)|Argonaut RISC Core]]
|-
| {{tt|0x2E}} ||[[H8 Family|Hitachi H8/300]]
|-
| {{tt|0x2F}} ||[[H8 Family|Hitachi H8/300H]]
|-
| {{tt|0x30}} ||[[H8 Family|Hitachi H8S]]
|-
| {{tt|0x31}} ||[[H8 Family|Hitachi H8/500]]
|-
| {{tt|0x32}} ||[[IA-64]]
|-
| {{tt|0x33}} ||[[MIPS-X|Stanford MIPS-X]]
|-
| {{tt|0x34}} ||[[NXP ColdFire|Motorola ColdFire]]
|-
| {{tt|0x35}} ||[[Motorola 68HC12|Motorola M68HC12]]
|-
| {{tt|0x36}} ||Fujitsu MMA Multimedia Accelerator
|-
| {{tt|0x37}} ||Siemens PCP
|-
| {{tt|0x38}} ||[[Cell (microprocessor)|Sony nCPU embedded RISC processor]]
|-
| {{tt|0x39}} ||Denso NDR1 microprocessor
|-
| {{tt|0x3A}} ||Motorola Star*Core processor
|-
| {{tt|0x3B}} ||Toyota ME16 processor
|-
| {{tt|0x3C}} ||STMicroelectronics ST100 processor
|-
| {{tt|0x3D}} ||Advanced Logic Corp. TinyJ embedded processor family
|-
| {{tt|0x3E}} ||[[amd64|AMD x86-64]]
|-
| {{tt|0x3F}} ||Sony DSP Processor
|-
| {{tt|0x40}} ||[[PDP-10|Digital Equipment Corp. PDP-10]]
|-
| {{tt|0x41}} ||[[PDP-11|Digital Equipment Corp. PDP-11]]
|-
| {{tt|0x42}} ||Siemens FX66 microcontroller
|-
| {{tt|0x43}} ||STMicroelectronics ST9+ 8/16-bit microcontroller
|-
| {{tt|0x44}} ||STMicroelectronics ST7 8-bit microcontroller
|-
| {{tt|0x45}} ||[[Motorola 68HC16|Motorola MC68HC16 Microcontroller]]
|-
| {{tt|0x46}} ||[[Motorola 68HC11|Motorola MC68HC11 Microcontroller]]
|-
| {{tt|0x47}} ||[[Motorola 68HC08|Motorola MC68HC08 Microcontroller]]
|-
| {{tt|0x48}} ||[[Motorola 68HC05|Motorola MC68HC05 Microcontroller]]
|-
| {{tt|0x49}} ||Silicon Graphics SVx
|-
| {{tt|0x4A}} ||STMicroelectronics ST19 8-bit microcontroller
|-
| {{tt|0x4B}} ||[[VAX|Digital VAX]]
|-
| {{tt|0x4C}} ||Axis Communications 32-bit embedded processor
|-
| {{tt|0x4D}} ||Infineon Technologies 32-bit embedded processor
|-
| {{tt|0x4E}} ||Element 14 64-bit DSP Processor
|-
| {{tt|0x4F}} ||LSI Logic 16-bit DSP Processor
|-
| {{tt|0x8C}} ||[[Texas Instruments TMS320#C6000 series|TMS320C6000 Family]]
|-
| {{tt|0xAF}} ||[[Elbrus 2000|MCST Elbrus e2k]]
|-
| {{tt|0xB7}} ||[[AArch64|Arm 64-bits]] (Armv8/AArch64)
|-
| {{tt|0xDC}} ||[[Zilog Z80]]
|-
| {{tt|0xF3}} ||[[RISC-V]]
|-
| {{tt|0xF7}} ||[[Berkeley Packet Filter]]
|-
|{{tt|0x101}}
|[[WDC 65C816]]
|-
|{{tt|0x102}}
|LoongArch
|}
|-
| colspan="2" | {{tt|0x14}} || colspan="2" | 4 || {{mono|e_version}}
|Set to <code>1</code> for the original version of ELF.
|-
| colspan="2" | {{tt|0x18}} || 4 || 8 || {{mono|e_entry}}
|This is the memory address of the [[entry point]] from where the process starts executing. This field is either 32 or 64 bits long, depending on the format defined earlier (byte 0x04). If the file doesn't have an associated entry point, then this holds zero.
|-
| {{tt|0x1C}} || {{tt|0x20}} || 4 || 8 || {{mono|e_phoff}}
|Points to the start of the program header table. It usually follows the file header immediately following this one, making the offset <code>0x34</code> or <code>0x40</code> for 32- and 64-bit ELF executables, respectively.
|-
| {{tt|0x20}} || {{tt|0x28}} || 4 || 8 || {{mono|e_shoff}}
|Points to the start of the section header table.
|-
| {{tt|0x24}} || {{tt|0x30}} || colspan="2" | 4 || {{mono|e_flags}}
|Interpretation of this field depends on the target architecture.
|-
| {{tt|0x28}} || {{tt|0x34}} || colspan="2" | 2 || {{mono|e_ehsize}}
|Contains the size of this header, normally 64 Bytes for 64-bit and 52 Bytes for 32-bit format.
|-
| {{tt|0x2A}} || {{tt|0x36}} || colspan="2" | 2 || {{mono|e_phentsize}}
|Contains the size of a program header table entry. As explained below, this will typically be 0x20 (32-bit) or 0x38 (64-bit).
|-
| {{tt|0x2C}} || {{tt|0x38}} || colspan="2" | 2 || {{mono|e_phnum}}
|Contains the number of entries in the program header table.
|-
| {{tt|0x2E}} || {{tt|0x3A}} || colspan="2" | 2 || {{mono|e_shentsize}}
|Contains the size of a section header table entry. As explained below, this will typically be 0x28 (32-bit) or 0x40 (64-bit).
|-
| {{tt|0x30}} || {{tt|0x3C}} || colspan="2" | 2 || {{mono|e_shnum}}
|Contains the number of entries in the section header table.
|-
| {{tt|0x32}} || {{tt|0x3E}} || colspan="2" | 2 || {{mono|e_shstrndx}}
|Contains index of the section header table entry that contains the section names.
|-
| {{tt|0x34}}
| {{tt|0x40}}
| colspan="3" |
|End of ELF Header (size).
|}

=== Example hexdump ===
<syntaxhighlight lang="hexdump">00000000  7f 45 4c 46 02 01 01 00  00 00 00 00 00 00 00 00  |.ELF............|
00000010  02 00 3e 00 01 00 00 00  c5 48 40 00 00 00 00 00  |..>......H@.....|</syntaxhighlight>
<ref>{{Cite web |title=Available lexers — Pygments |url=https://pygments.org/docs/lexers/#lexers-for-hexadecimal-dumps |access-date=2024-12-19 |website=pygments.org}}</ref>

=== Program header ===

The program header table tells the system how to create a process image. It is found at file offset {{mono|e_phoff}}, and consists of {{mono|e_phnum}} entries, each with size {{mono|e_phentsize}}. The layout is slightly different in [[32-bit]] ELF vs [[64-bit]] ELF, because the {{mono|p_flags}} are in a different structure location for alignment reasons. Each entry is structured as:

{| class="wikitable"
|+ Program header<ref>{{cite web|url=http://www.sco.com/developers/gabi/2000-07-17/ch5.pheader.html |title=Program Header |publisher=Sco.com |date=July 2000 |access-date=2017-04-05}}</ref>
|-
! colspan="2" | Offset!! colspan="2" | Size (bytes) !! rowspan="2" | Field !! rowspan="2" | Purpose
|-
! {{nowrap|32-bit}} !! {{nowrap|64-bit}} !! {{nowrap|32-bit}} !! {{nowrap|64-bit}}
|-
| colspan="2" | {{tt|0x00}} || colspan="2" | 4 
||{{mono|p_type}}||Identifies the type of the segment.
{| class="wikitable mw-collapsible mw-collapsed"
|-
!Value!!Name!!Meaning
|-
| {{tt|0x00000000}} ||{{mono|PT_NULL}}
| Program header table entry unused.
|-
| {{tt|0x00000001}} ||{{mono|PT_LOAD}}
| Loadable segment.
|-
| {{tt|0x00000002}} ||{{mono|PT_DYNAMIC}}
| Dynamic linking information.
|-
| {{tt|0x00000003}} ||{{mono|PT_INTERP}}
| Interpreter information.
|-
| {{tt|0x00000004}} ||{{mono|PT_NOTE}}
| Auxiliary information.
|-
| {{tt|0x00000005}} ||{{mono|PT_SHLIB}}
| Reserved.
|-
| {{tt|0x00000006}} ||{{mono|PT_PHDR}}
| Segment containing program header table itself.
|-
| {{tt|0x00000007}} ||{{mono|PT_TLS}}
| Thread-Local Storage template.
|-
| {{tt|0x60000000}} ||{{mono|PT_LOOS}}
| rowspan="2" | Reserved inclusive range. Operating system specific.
|-
| {{tt|0x6FFFFFFF}} ||{{mono|PT_HIOS}}
|-
| {{tt|0x70000000}} ||{{mono|PT_LOPROC}}
| rowspan="2" | Reserved inclusive range. Processor specific.
|-
| {{tt|0x7FFFFFFF}} ||{{mono|PT_HIPROC}}
|}
|-
|  || {{tt|0x04}} || || 4 ||{{mono|p_flags}}||Segment-dependent flags (position for 64-bit structure).
{| class="wikitable mw-collapsible mw-collapsed"
!Value
!Name
!Meaning
|-
| {{tt|0x1}}
|{{mono|PF_X}}
|Executable segment.
|-
| {{tt|0x2}}
|{{mono|PF_W}}
|Writeable segment.
|-
| {{tt|0x4}}
|{{mono|PF_R}}
|Readable segment.
|}
|-
| {{tt|0x04}} || {{tt|0x08}} || 4 || 8||{{mono|p_offset}}||Offset of the segment in the file image.
|-
| {{tt|0x08}} || {{tt|0x10}} || 4 || 8 ||{{mono|p_vaddr}}||Virtual address of the segment in memory.
|-
| {{tt|0x0C}} || {{tt|0x18}} || 4 || 8 ||{{mono|p_paddr}}||On systems where physical address is relevant, reserved for segment's physical address.
|-
| {{tt|0x10}} || {{tt|0x20}} || 4 || 8 ||{{mono|p_filesz}}||Size in bytes of the segment in the file image. May be 0.
|-
| {{tt|0x14}} || {{tt|0x28}} || 4 || 8 ||{{mono|p_memsz}}||Size in bytes of the segment in memory. May be 0.
|-
| {{tt|0x18}} ||  || 4 ||  ||{{mono|p_flags}}||Segment-dependent flags (position for 32-bit structure). See above <code>p_flags</code> field for flag definitions.
|-
| {{tt|0x1C}} || {{tt|0x30}} || 4 || 8 ||{{mono|p_align}}||<code>0</code> and <code>1</code> specify no alignment. Otherwise should be a positive, integral power of 2, with {{mono|p_vaddr}} equating {{mono|p_offset}} modulus {{mono|p_align}}.
|-
| {{tt|0x20}}
| {{tt|0x38}}
| colspan="3" |
|End of Program Header (size).
|}

=== Section header ===

{| class="wikitable"
! colspan="2" |Offset
! colspan="2" |Size (bytes)
! rowspan="2" |Field
! rowspan="2" |Purpose
|-
!32-bit
!64-bit
!32-bit
!64-bit
|-
| colspan="2" |0x00
| colspan="2" |4
| {{tt|sh_name}}
|An offset to a string in the '''.shstrtab''' section that represents the name of this section.
|-
| colspan="2" |0x04
| colspan="2" |4
| {{tt|sh_type}}
|Identifies the type of this header.
{| class="wikitable mw-collapsible mw-collapsed"
!Value
!Name
!Meaning
|-
| {{tt|0x0}}
| {{tt|SHT_NULL}}
|Section header table entry unused
|-
| {{tt|0x1}}
| {{tt|SHT_PROGBITS}}
|Program data
|-
| {{tt|0x2}}
| {{tt|SHT_SYMTAB}}
|Symbol table
|-
| {{tt|0x3}}
| {{tt|SHT_STRTAB}}
|String table
|-
| {{tt|0x4}}
| {{tt|SHT_RELA}}
|Relocation entries with addends
|-
| {{tt|0x5}}
| {{tt|SHT_HASH}}
|Symbol hash table
|-
| {{tt|0x6}}
| {{tt|SHT_DYNAMIC}}
|Dynamic linking information
|-
| {{tt|0x7}}
| {{tt|SHT_NOTE}}
|Notes
|-
| {{tt|0x8}}
| {{tt|SHT_NOBITS}}
|Program space with no data (bss)
|-
| {{tt|0x9}}
| {{tt|SHT_REL}}
|Relocation entries, no addends
|-
| {{tt|0x0A}}
| {{tt|SHT_SHLIB}}
|Reserved
|-
| {{tt|0x0B}}
| {{tt|SHT_DYNSYM}}
|Dynamic linker symbol table
|-
| {{tt|0x0E}}
| {{tt|SHT_INIT_ARRAY}}
|Array of constructors
|-
| {{tt|0x0F}}
| {{tt|SHT_FINI_ARRAY}}
|Array of destructors
|-
| {{tt|0x10}}
| {{tt|SHT_PREINIT_ARRAY}}
|Array of pre-constructors
|-
| {{tt|0x11}}
| {{tt|SHT_GROUP}}
|Section group
|-
| {{tt|0x12}}
| {{tt|SHT_SYMTAB_SHNDX}}
|Extended section indices
|-
| {{tt|0x13}}
| {{tt|SHT_NUM}}
|Number of defined types.
|-
| {{tt|0x60000000}}
| {{tt|SHT_LOOS}}
|Start OS-specific.
|-
|...
|...
|...
|}
|-
| colspan="2" |0x08
|4
|8
| {{tt|sh_flags}}
|Identifies the attributes of the section.
{| class="wikitable mw-collapsible mw-collapsed"
!Value
!Name
!Meaning
|-
| {{tt|0x1}}
| {{tt|SHF_WRITE}}
|Writable
|-
| {{tt|0x2}}
| {{tt|SHF_ALLOC}}
|Occupies memory during execution
|-
| {{tt|0x4}}
| {{tt|SHF_EXECINSTR}}
|Executable
|-
| {{tt|0x10}}
| {{tt|SHF_MERGE}}
|Might be merged
|-
| {{tt|0x20}}
| {{tt|SHF_STRINGS}}
|Contains null-terminated strings
|-
| {{tt|0x40}}
| {{tt|SHF_INFO_LINK}}
|'sh_info' contains SHT index
|-
| {{tt|0x80}}
| {{tt|SHF_LINK_ORDER}}
|Preserve order after combining
|-
| {{tt|0x100}}
| {{tt|SHF_OS_NONCONFORMING}}
|Non-standard OS specific handling required
|-
| {{tt|0x200}}
| {{tt|SHF_GROUP}}
|Section is member of a group
|-
| {{tt|0x400}}
| {{tt|SHF_TLS}}
|Section hold thread-local data
|-
| {{tt|0x0FF00000}}
| {{tt|SHF_MASKOS}}
|OS-specific
|-
| {{tt|0xF0000000}}
| {{tt|SHF_MASKPROC}}
|Processor-specific
|-
| {{tt|0x4000000}}
| {{tt|SHF_ORDERED}}
|Special ordering requirement (Solaris)
|-
| {{tt|0x8000000}}
| {{tt|SHF_EXCLUDE}}
|Section is excluded unless referenced or allocated (Solaris)
|}
|-
| {{tt|0x0C}}
| {{tt|0x10}}
|4
|8
| {{tt|sh_addr}}
|Virtual address of the section in memory, for sections that are loaded.
|-
| {{tt|0x10}}
| {{tt|0x18}}
|4
|8
| {{tt|sh_offset}}
|Offset of the section in the file image.
|-
| {{tt|0x14}}
| {{tt|0x20}}
|4
|8
| {{tt|sh_size}}
|Size in bytes of the section. May be 0.
|-
| {{tt|0x18}}
| {{tt|0x28}}
| colspan="2" |4
| {{tt|sh_link}}
|Contains the section index of an associated section. This field is used for several purposes, depending on the type of section.
|-
| {{tt|0x1C}}
| {{tt|0x2C}}
| colspan="2" |4
| {{tt|sh_info}}
|Contains extra information about the section. This field is used for several purposes, depending on the type of section.
|-
| {{tt|0x20}}
| {{tt|0x30}}
|4
|8
| {{tt|sh_addralign}}
|Contains the required alignment of the section. This field must be a power of two.
|-
| {{tt|0x24}}
| {{tt|0x38}}
|4
|8
| {{tt|sh_entsize}}
|Contains the size, in bytes, of each entry, for sections that contain fixed-size entries. Otherwise, this field contains zero.
|-
| {{tt|0x28}}
| {{tt|0x40}}
| colspan="3" |
|End of Section Header (size).
|}

== Tools ==
{{Main|GNU Binutils}}
* <code>[[readelf]]</code> is a Unix binary utility that displays information about one or more ELF files. A [[free software]] implementation is provided by [[GNU Binutils]].
* <code>elfutils</code> provides alternative tools to [[GNU Binutils]] purely for Linux.<ref>{{cite web|url=https://sourceware.org/elfutils/|title=elfutils|website=sourceware.org|access-date=30 April 2017}}</ref>
* <code>elfdump</code> is a command for viewing ELF information in an ELF file, available under Solaris and [[FreeBSD]].
* <code>[[objdump]]</code> provides a wide range of information about ELF files and other object formats. <code>objdump</code> uses the [[Binary File Descriptor library]] as a back-end to structure the ELF data.
* The Unix <code>[[file (command)|file]]</code> utility can display some information about ELF files, including the [[instruction set architecture]] for which the code in a relocatable, executable, or shared object file is intended, or on which an ELF [[core dump]] was produced.

== Applications ==

=== Unix-like systems ===
{{prose|date=November 2016}}
The ELF format has replaced older executable formats in various environments.
It has replaced [[a.out]] and [[COFF]] formats in [[Unix-like]] operating systems:
* [[Linux]]
* [[Solaris (operating system)|Solaris]] / [[Illumos]]
* [[IRIX]]
* [[FreeBSD]]<ref>{{Cite web | url=https://docs.freebsd.org/doc/4.9-RELEASE/usr/share/doc/handbook/binary-formats.html | title=Binary Formats | access-date=2019-03-31 | archive-date=2019-03-31 | archive-url=https://web.archive.org/web/20190331192807/https://docs.freebsd.org/doc/4.9-RELEASE/usr/share/doc/handbook/binary-formats.html | url-status=dead }}</ref>
* [[NetBSD]]
* [[OpenBSD]]
* [[Redox (operating system)|Redox]]
* [[DragonFly BSD]]
* [[Syllable Desktop (operating system)|Syllable]]
* [[HP-UX]] (except for 32-bit PA-RISC programs which continue to use [[System Object Model (file format)|SOM]])
* [[QNX]] Neutrino
* [[MINIX]]<ref>{{cite web |url=http://wiki.minix3.org/en/MinixReleases |title=MinixReleases – Minix Wiki |publisher=Wiki.minix3.org |access-date=2014-01-19 |url-status=dead |archive-url=https://web.archive.org/web/20130330150621/http://wiki.minix3.org/en/MinixReleases |archive-date=2013-03-30 }}</ref>

=== Non-Unix adoption ===

ELF has also seen some adoption in non-Unix operating systems, such as:
* [[OpenVMS]], in its [[Itanium]] and [[amd64]] versions<ref>{{Cite web |url=https://vmssoftware.com/pdfs/State_of_Port_20160906.pdf |title=Archived copy |access-date=2016-10-19 |archive-date=2020-09-15 |archive-url=https://web.archive.org/web/20200915215111/https://vmssoftware.com/pdfs/State_of_Port_20160906.pdf |url-status=dead }}</ref>
* [[BeOS]] Revision 4 and later for [[x86]] based computers (where it replaced the [[Portable Executable]] format; the [[PowerPC]] version stayed with [[Preferred Executable Format]])
* [[Haiku (operating system)|Haiku]], an open source reimplementation of BeOS
* [[RISC OS]]<ref>{{cite web |url=http://www.riscos.info/index.php/GCCSDK |title=GCCSDK – RISC OS |publisher=Riscos.info |date=2012-04-22 |access-date=2014-01-19 |archive-date=2014-02-19 |archive-url=https://web.archive.org/web/20140219211405/http://www.riscos.info/index.php/GCCSDK |url-status=dead }}</ref>
* [[Stratus VOS]], in PA-RISC and x86 versions
* [[SkyOS]]
* [[Fuchsia OS]]
* [[Z/TPF]]
* [[NonStop (server computers)|HPE NonStop OS]]<ref>{{cite web |url=http://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-c02543407-12.pdf |archive-url=https://web.archive.org/web/20180530042640/http://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-c02543407-12.pdf |url-status=dead |archive-date=2018-05-30 |title=Guardian Programmer's Guide |publisher=Hewlett Packard Enterprise |access-date=2018-05-30 }} p. 44 archived from [http://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-c02543407-12.pdf the original]  on 2018-5-30</ref>
* [[DDC-I|Deos]]

[[Microsoft Windows]] also uses the ELF format, but only for its [[Windows Subsystem for Linux]] compatibility system.<ref>{{Cite web|url=https://www.zdnet.com/article/under-the-hood-of-microsofts-windows-subsystem-for-linux/|title=Under the hood of Microsoft's Windows Subsystem for Linux|last=Foley|first=Mary Jo|website=ZDNet|access-date=2016-08-19}}</ref>

=== Game consoles ===

Some game consoles also use ELF:
* PlayStation Portable,<ref>PlayStation Portable use encrypted & relocated ELF : PSP</ref> PlayStation Vita, PlayStation, PlayStation 2, PlayStation 3, PlayStation 4, PlayStation 5
* GP2X
* Dreamcast
* GameCube
* Nintendo 64
* Wii
* Wii U

=== PowerPC ===

Other (operating) systems running on PowerPC that use ELF:
* AmigaOS 4, the ELF executable has replaced the prior [[Extended Hunk Format]] (EHF) which was used on Amigas equipped with PPC processor expansion cards.
* MorphOS
* AROS
* Café OS (The operating system run by the Wii U)

=== Mobile phones ===

Some operating systems for mobile phones and mobile devices use ELF:
* Symbian OS v9 uses E32Image<ref>''[https://web.archive.org/web/20091213034509/http://wiki.forum.nokia.com/index.php/E32Image Symbian OS executable file format]''</ref> format that is based on the ELF file format;
* Sony Ericsson, for example, the W800i, W610, W300, etc.
* Siemens, the SGOLD and SGOLD2 platforms: from Siemens C65 to S75 and BenQ-Siemens E71/EL71;
* Motorola, for example, the E398, SLVR L7, v360, v3i (and all phone LTE2 which has the patch applied).
* Bada, for example, the Samsung Wave S8500.
* Nokia phones or tablets running the Maemo or the Meego OS, for example, the Nokia N900.
* [[Android (operating system)|Android]] uses ELF {{mono|.so}} (shared object<ref>
{{cite book
| last1 = Rosen
| first1 = Kenneth
| last2 = Host
| first2 = Douglas
| last3 = Klee
| first3 = Rachel
| last4 = Rosinski
| first4 = Richard
| title = UNIX: The Complete Reference
| url = https://books.google.com/books?id=2Et--84HIkwC
| edition = 2
| publisher = McGraw Hill Professional
| date = 2007
| page = 707
| isbn = 9780071706988
| access-date = 2017-06-08
| quote = Dynamically linked libraries are also called shared objects (.so).
}}
</ref>) libraries for the [[Java Native Interface]].{{citation needed|date=February 2023}} With [[Android Runtime]] (ART), the default since Android 5.0 "Lollipop", all applications are compiled into native ELF binaries on installation.<ref>{{cite web |title=Android formats |url=https://lief-project.github.io/doc/latest/tutorials/10_android_formats.html |archive-url=https://archive.today/20230216233708/https://lief-project.github.io/doc/latest/tutorials/10_android_formats.html |access-date=17 Jan 2023 |archive-date=16 February 2023 |work=Quarks Lab |last=Thomas |first=Romain}}</ref> It's also possible to use native Linux software from package managers like Termux, or compile them from sources via Clang or GCC, that are available in repositories.

{{Anchor|np}}
Some phones can run ELF files through the use of a patch that adds assembly code to the main firmware, which is a feature known as ''ELFPack'' in the underground modding culture. The ELF file format is also used with the [[Atmel AVR]] (8-bit), AVR32<ref>
{{citation
| chapter-url=http://www.sco.com/developers/gabi/2009-10-26/ch4.eheader.html#e_machine
| title=System V Application Binary Interface
| chapter=Chapter 4: Object Files
| at=e_machine
| date=2009-10-26
}}
</ref>
and with Texas Instruments MSP430 microcontroller architectures. Some implementations of Open Firmware can also load ELF files, most notably Apple's implementation used in almost all PowerPC machines the company produced.

=== Blockchain platforms ===

* Solana uses ELF format for its on-chain programs (smart contracts). The platform processes ELF files compiled to BPF (Berkeley Packet Filter) byte-code, which are then deployed as shared objects and executed in Solana's runtime environment. The BPF loader validates and processes these ELF files during program deployment.<ref>{{Cite web
	| url = https://solana.com/docs/core/programs
	| title = Solana Programs
	| date = 2024-11-11
	| publisher = Solana Foundation
	| access-date = 2024-11-11
	| quote = Solana leverages the LLVM compiler infrastructure to compile programs into Executable and Linkable Format (ELF) files.}}
</ref>

== 86open ==
'''86open''' was a project to form consensus on a common binary file format for Unix and Unix-like operating systems on the common PC compatible x86 architecture, to encourage software developers to port to the architecture.<ref>{{cite web
 |url= http://www.telly.org/86open-faq
 |title= 86Open Frequently-Asked Questions
 |access-date= 2007-06-06
 |last= Leibovitch
 |first= Evan
 |date= 1997-12-23
|archive-url= https://web.archive.org/web/20070311032337/http://www.telly.org/86open-faq <!-- Bot retrieved archive --> |archive-date= 2007-03-11}}</ref> The initial idea was to standardize on a small subset of Spec 1170, a predecessor of the Single UNIX Specification, and the GNU C Library (glibc) to enable unmodified binaries to run on the x86 Unix-like operating systems. The project was originally designated "Spec 150".

The format eventually chosen was ELF, specifically the Linux implementation of ELF, after it had turned out to be a ''de facto'' standard supported by all involved vendors and operating systems.

The group began email discussions in 1997 and first met together at the Santa Cruz Operation offices on August 22, 1997.

The steering committee was Marc Ewing, Dion Johnson, Evan Leibovitch, [[Bruce Perens]], Andrew Roach, Bryan Wayne Sparks and Linus Torvalds. Other people on the project were Keith Bostic, Chuck Cranor, Michael Davidson,<!--At least three other Michael Davidsons in WP as of 04.2007--> Chris G. Demetriou, Ulrich Drepper, Don Dugger, Steve Ginzburg, Jon "maddog" Hall, Ron Holt, Jordan Hubbard, Dave Jensen, Kean Johnston, Andrew Josey, Robert Lipe, Bela Lubkin, Tim Marsland, Greg Page,<!--Three other people by that name in WP as of 04.2007--> Ronald Joe Record, Tim Ruckle, Joel Silverstein, Chia-pi Tien, and Erik Troan. Operating systems and companies represented were BeOS, BSDI, FreeBSD, [[Intel]], Linux, NetBSD, SCO and SunSoft.

The project progressed and in mid-1998, SCO began developing lxrun, an open-source compatibility layer able to run Linux binaries on OpenServer, UnixWare, and Solaris. SCO announced official support of lxrun at LinuxWorld in March 1999. Sun Microsystems began officially supporting lxrun for Solaris in early 1999,<ref>{{cite web
 |url         = http://www.mavetju.org/mail/view_message.php?list=freebsd-emulation&id=361608
 |title       = Bulletin on status of 86open at SCO
 |access-date = 2008-05-06
 |last        = Record
 |first       = Ronald
 |date        = 1998-05-21
 |url-status     = dead
 |archive-url  = https://web.archive.org/web/20081208013909/http://www.mavetju.org/mail/view_message.php?list=freebsd-emulation&id=361608
 |archive-date = 2008-12-08
}}</ref> and later moved to integrated support of the Linux binary format via Solaris Containers for Linux Applications.

With the BSDs having long supported Linux binaries (through a compatibility layer) and the main x86 Unix vendors having added support for the format, the project decided that Linux ELF was the format chosen by the industry and "declare[d] itself dissolved" on July 25, 1999.<ref>{{cite web
 |url= https://www.telly.org/86open/
 |title= The86open Project – Final Update
 |access-date= 2007-05-06
 |last= Leibovitch
 |first= Evan
 |date= 1999-07-25
|archive-url= https://web.archive.org/web/20070227214032/http://www.telly.org/86open/ <!-- Bot retrieved archive --> |archive-date= 2007-02-27}}</ref>

== FatELF: universal binaries for Linux ==
FatELF is an ELF binary-format extension that adds [[fat binary]] capabilities.<ref name="fatelfspec">{{cite web|publisher=icculus.org| title=fatelf-specification v1| url=http://hg.icculus.org/icculus/fatelf/raw-file/tip/docs/fatelf-specification.txt| access-date=2010-07-25|last=Gordon| first=Ryan}}</ref> It is aimed for Linux and other Unix-like operating systems. Additionally to the CPU architecture abstraction (byte order, word size, [[CPU]] instruction set etc.), there is the potential advantage of software-platform abstraction e.g., binaries which support multiple kernel ABI versions. {{as of|2021}}, FatELF has not been integrated into the mainline Linux kernel.<ref name="kernel1">{{cite web|publisher=icculus.org| title=FatELF: Turns out I liked the uncertainty better| url=https://icculus.org/cgi-bin/finger/finger.pl?user=icculus&date=2009-11-03&time=19-08-04|access-date=2010-07-13|last=Gordon|first=Ryan}}</ref><ref name="kernel2">{{cite web|publisher=osnews.com| title=Ryan Gordon Halts FatELF Project| url=https://www.osnews.com/story/22446/ryan-gordon-halts-fatelf-project|date=2009-11-03|access-date=2010-07-05|last=Holwerda|first=Thom}}</ref><ref name=selfanatomy>{{cite web|url=https://lwn.net/Articles/392862/ |title=SELF: Anatomy of an (alleged) failure|publisher= Linux Weekly News|date= June 23, 2010|first=Joe|last=Brockmeier|access-date=2011-02-06}}</ref>

== See also ==
{{Portal|Computer programming}}
* [[Application binary interface]]
* [[Comparison of executable file formats]]
* [[DWARF]]{{snd}} a format for debugging data
* [[Intel Binary Compatibility Standard]]
* [[Portable Executable]]{{snd}} format used by Windows
* [[vDSO]]{{snd}} virtual DSO
* [[Position-independent code]]

== References ==
{{Reflist|30em}}

== Further reading ==
{{Div col|colwidth=30em}}
* [https://maskray.me/blog/2024-05-26-evolution-of-elf-object-file-format Evolution of the ELF object file format], by Fangrui Song.
* {{cite book |author-last=Levine |author-first=John R. |author-link=John R. Levine |title=Linkers and Loaders |date=2000 |orig-year=October 1999 |edition=1 |publisher=[[Morgan Kaufmann]] |series=The Morgan Kaufmann Series in Software Engineering and Programming |location=San Francisco, USA |isbn=1-55860-496-0 |oclc=42413382 |url=https://www.iecc.com/linker/ |access-date=2020-01-12 |url-status=live |archive-url=https://archive.today/20121205032107/http://www.iecc.com/linker/ |archive-date=2012-12-05}} Code:<ref>https://archive.today/20200114225034/https://linker.iecc.com/code.html {{Bare URL inline|date=August 2025}}</ref>[ftp://ftp.iecc.com/pub/linker/]{{dead link|date=May 2025|bot=medic}}{{cbignore|bot=medic}} Errata: [https://linker.iecc.com/<!-- https://archive.today/20200114224817/https://linker.iecc.com/ 2020-01-14 -->]
* [[Ulrich Drepper]], How To Write Shared Libraries, Version 4.1.2 (2011). Published on the author's web page, https://www.akkadia.org/drepper.
* ''[https://web.archive.org/web/20070224140341/http://www-128.ibm.com/developerworks/power/library/pa-spec12/ An unsung hero: The hardworking ELF]'' by Peter Seebach, December 20, 2005, archived from the original on February 24, 2007
* {{webarchive|url=https://web.archive.org/web/20040225174057/http://developers.sun.com/solaris/articles/elf.html |title=LibElf and GElf – A Library to Manipulate ELf Files |date=February 25, 2004}}
* ''[https://www.linuxjournal.com/article/1059 The ELF Object File Format: Introduction]'', ''[https://www.linuxjournal.com/article/1060 The ELF Object File Format by Dissection]'' by Eric Youngdale (1995-05-01)
* ''[https://www.muppetlabs.com/~breadbox/software/tiny/teensy.html A Whirlwind Tutorial on Creating Really Teensy ELF Executables for Linux]'' by Brian Raiter
* [https://www.phrack.org/issues.html?issue=61&id=8#article ELF relocation into non-relocatable objects] by Julien Vanegue (2003-08-13)
* [https://www.phrack.org/issues.html?issue=63&id=9#article Embedded ELF debugging without ptrace] by the ELFsh team (2005-08-01)
* ''[https://netwinder.osuosl.org/users/p/patb/public_html/elf_relocs.html Study of ELF loading and relocs]'' by Pat Beirne (1999-08-03)
{{div col end}}

== External links ==
{{Div col|colwidth=30em}}
* [https://gabi.xinuos.com ELF Object File Format Specification]
* {{github|xinuos/gabi|ELF Object File Format}}
* [https://www.sco.com/developers/devspecs/ System V Application Binary Interface and Interface Definition]
* [https://web.archive.org/web/20130403001804/http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/binary-formats.html FreeBSD Handbook: Binary formats] (archived version)
* [https://www.freebsd.org/cgi/man.cgi?query=elf&sektion=5 FreeBSD {{mono|elf(5)}} manual page]
* [https://www.netbsd.org/Documentation/elf.html NetBSD ELF FAQ]
* [https://man7.org/linux/man-pages/man5/elf.5.html Linux {{mono|elf(5)}} manual page]
* [https://docs.oracle.com/en/operating-systems/solaris/oracle-solaris/11.4/linkers-libraries/ Oracle Solaris Linker and Libraries Guide]
* [http://www.eresi-project.org/ The ERESI project: reverse engineering on ELF-based operating systems] {{Webarchive|url=https://web.archive.org/web/20210314190846/http://www.eresi-project.org/ |date=2021-03-14 }}
* [https://www.linuxtoday.com/developer/1999072600605PS Linux Today article on 86open] {{Webarchive|url=https://web.archive.org/web/20210308053629/http://www.linuxtoday.com/developer/1999072600605PS |date=2021-03-08 }} July 26, 1999
* [https://lists.debian.org/debian-announce/1997/msg00028.html Announcement of 86open on Debian Announce mailing list] October 10, 1997, [[Bruce Perens]]
* {{usurped|1=[https://web.archive.org/web/20241130193343/https://www.groklaw.net/pdf/IBM-835-Exhibit_184.pdf Declaration of Ulrich Drepper (PDF)]}} in [[The SCO Group]] vs [[IBM]], September 19, 2006
* {{usurped|1=[https://web.archive.org/web/20190201013659/http://www.groklaw.net/articlebasic.php?story=20060813114048520 86open and ELF discussion]}} on [[Groklaw]], August 13, 2006
{{div col end}}

{{Executables}}

[[Category:Executable file formats]]