Mauerer runapp05.tex V1 - 09/04/2008 6:13pm Page 1252
Appendix E: The ELF Binary Format
Table E-1: ELF File Types
Value Meaning
ET_REL Relocatable file (object file)
ET_EXEC Executable file
ET_DYN Dynamic library
ET_CORE Core dump
❑ e_machinespecifies the required architecture for the file. Table E-2 lists the various options
available and supported by Linux. Note that every architecture needs to define the function
elf_check_arch, which is used by the generic code to ensure that the ELF file that is loaded
is indeed the right one for the architecture.
❑ e_versionholds version information to distinguish between ELF variants. However, at the
moment only version 1 of the specification is defined. It is represented byEV_CURRENT.
❑ e_entrygives the entry point in virtual memory. This is where execution begins once the pro-
gram has been loaded and mapped into memory.
❑ e_phoffholds the offset at which the program header table is located in the binary file.
❑ e_shoffholds the offset at which the section header table is located.
❑ e_flagscan hold processor-specific flags. Currently, these are not used by the kernel.
❑ e_ehsizespecifies the header size in bytes.
❑ e_phentsizespecifies the size, in bytes, of an entry in the program header table (all entries are
the same size).
❑ e_phnumspecifies the number of entries in the program header table.
❑ e_shentsizespecifies the size, in bytes, of an entry in the section header table (all entries are the
same size).
❑ e_shnumspecifies the number of entries in the section header table.
❑ e_shstrndxholds the index position of the string table containing the section names in the
header table.
A 64-bit data structure is defined in the same way. The only difference is that the corresponding 64-bit
data types are used in place of their 32-bit equivalents, thus making the header a little larger. However,
the first 16 bytes are identical in both variants. Both architecture types are able to recognize ELF files for
machines with different word lengths by reference to these bytes, as shown here:
<elf.h>
typedef struct elf64_hdr {
unsigned char e_ident[16]; /* ELF "magic number" */
Elf64_Half e_type;
Elf64_Half e_machine;
Elf64_Word e_version;
Elf64_Addr e_entry; /* Entry point virtual address */
Elf64_Off e_phoff; /* Program header table file offset */
