Linux Kernel Architecture

Mauerer runapp05.tex V1 - 09/04/2008 6:13pm Page 1243

Appendix E: The ELF Binary Format

fileshows that the compiler has generated two ELF files — an executable file and a relocatable

object file.

wolfgang@meitner>file test

filetest: ELF 32-bit LSB executable, Intel 80386, version 1, dynamically linked

(uses shared libs), not stripped

wolfgang@meitner>file test.o

test.o: ELF 32-bit LSB relocatable, Intel 80386, version 1, not stripped

E.1.1 ELF Header

Ths section usesreadelfto examine the constituent elements of both files.^1 First, consider the ELF

header:

wolfgang@meitner>readelf test

ELF Header:

Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00

Class: ELF32

Data: 2’s complement, little endian

Version: 1 (current)

OS/ABI: UNIX - System V

ABI Version: 0

Type: EXEC (Executable file)

Machine: Intel 80386

Version: 0x1

Entry point address: 0x80482d0

Start of program headers: 52 (bytes into file)

Start of section headers: 10148 (bytes into file)

Flags: 0x0

Size of this header: 52 (bytes)

Size of program headers: 32 (bytes)

Number of program headers: 6

Size of section headers: 40 (bytes)

Number of section headers: 29

Section header string table index: 26

There are four identification bytes at the top of the file. An ASCII code0x7fcharacter is followed by

the ASCII values of the charactersE(0x45),L(0x4c), andF(0x46). This enables all ELF processing

tools to recognize that the file is of the desired format. There is also some information on the specific

architecture — in this case, a Pentium III system that is IA32-compatible. The class information (ELF32)

correctly indicates that this is a 32-bit machine (on Alphas, IA-64, Sparc64, and other 64-bit platforms, the

value in this field would beELF64).

The file type isEXEC, meaning that the file is executable. The version field enables a distinction to be

made between the various revisions of the ELF standard. However, because version 1 is still current,

this feature is not needed at the moment. Also included is information on the size and index positions of

various constituents of the ELF file (discussed in more detail later). Because the size of the sections may

vary from program to program, the corresponding data must be supplied in the header.

(^1) The program has more command-line options than those shown here. They are documented on the manual pagereadelf(1)and
can be displayed usingreadelf-help.