Stack Overflow
Stack Overflow

Questions tagged [elf]

ELF stands for Executable and Linkable Format, a file format for files containing machine code. Use this tag for questions about the ELF format itself, or for questions which are specifically about reading/writing ELF files.

The Executable and Linkable Format (ELF) standard describes a layout for files containing executable machine code. The format is non-proprietary, flexible, extensible and machine architecture-independent.

Most modern open-source operating systems (e.g., Linux) use ELF for their native executables. Notable exceptions are Windows (using PE/COFF) and macOS/iOS (using Mach-O).

Questions that should use the tag:

  • Questions about the ELF format itself, e.g. how certain fields should be used or what their intention is.
  • Questions about reading/parsing ELF files, e.g. via the C elf.h standard header or with the readelf program.
  • Question about writing/modifying ELF files, e.g. using tools like objcopy or strip.

Resources:

Related tags:

  • For questions about the readelf program, which is used for parsing and dumping most non-machine code sections of an ELF file.
  • For questions about the objcopy program, which allows changing section contents or adding sections to existing ELF files.
2307 questions
67
votes
1 answer

Why GCC compiled C program needs .eh_frame section?

Test is on 32 bit x86 Linux with gcc 4.6.3 When using gcc to compile a C program and using readelf to check the section info, I can see the .eh_frame section and .eh_frame_hdr sections inside. For example, here is the section info of binary program…
lllllllllllll
  • 8,519
  • 9
  • 45
  • 80
65
votes
4 answers

What are the meanings of the columns of the symbol table displayed by readelf?

Could someone explain the columns shown of the symbol table using readelf?
Swaroop S
  • 691
  • 1
  • 5
  • 7
62
votes
6 answers

What do R_X86_64_32S and R_X86_64_64 relocation mean?

Got the following error when I tried to compile a C application in 64-bit FreeBSD: relocation R_X86_64_32S can not be used when making a shared object; recompile with -fPIC What is R_X86_64_32S relocation and what is R_X86_64_64? I've googled…
Raj
  • 4,342
  • 9
  • 40
  • 45
56
votes
1 answer

readelf vs. objdump: why are both needed

I need to learn about the ELF file layout for a project I am working on and I noticed the existence of these tools. Why do all Linux distributions include both readelf and objdump? Do these tools complement one another? When would i prefer to use…
zr.
  • 7,528
  • 11
  • 50
  • 84
48
votes
2 answers

What does exactly the warning mean about hidden symbol being referenced by DSO?

I have a problem linking some shared library with g++. It gives me a warning like: hidden symbol XXX in YYY is referenced by DSO /usr/lib/... I've read some related questions about particular problems, but I want to understand it in a whole - what…
abyss.7
  • 13,882
  • 11
  • 56
  • 100
46
votes
4 answers

Do .bss section zero initialized variables occupy space in elf file?

If I understand correctly, the .bss section in ELF files is used to allocate space for zero-initialized variables. Our tool chain produces ELF files, hence my question: does the .bss section actually have to contain all those zeroes? It seems such…
Wouter Lievens
  • 4,019
  • 5
  • 41
  • 66
44
votes
5 answers

How to strip executables thoroughly

I'd like to strip as much as I can - on Linux: an ELF. I only want in there the stuff I need to run it. I tried using strip: strip --strip-all elf But it doesn't seem to do a good job: nm still displays lots of stuff, and the binary is still…
peoro
  • 25,562
  • 20
  • 98
  • 150
42
votes
5 answers

How to extract only the raw contents of an ELF section?

I've tried the following, but the resulting file is still an ELF and not purely the section content. $ objcopy --only-section= I just want the contents of the section. Is there any utility that can do this? Any ideas?
mepcotterell
  • 2,670
  • 2
  • 21
  • 28
42
votes
5 answers

How can I get the architecture of a '.a' file?

I have a .a file from which I want to get architecture information. Running file myFile.a results in file.a: current ar archive. How can I get more information on what architecture the file contains?
Mike
  • 23,892
  • 18
  • 70
  • 90
41
votes
2 answers

Why does the PLT exist in addition to the GOT, instead of just using the GOT?

I understand that in a typical ELF binary, functions get called through the Procedure Linkage Table (PLT). The PLT entry for a function usually contains a jump to a Global Offset Table (GOT) entry. This entry will first reference some code to load…
F30
  • 1,036
  • 1
  • 10
  • 21
36
votes
2 answers

Why is address 0x400000 chosen as a start of text segment in x86_64 ABI?

In this document on p. 27 it says that text segment starts at 0x400000. Why was this particular address chosen? Is there any reason for that? The same address is chosen in GNU ld on Linux: $ ld -verbose | grep -i text-segment PROVIDE…
user1042840
  • 1,925
  • 2
  • 16
  • 32
36
votes
1 answer

What functions does gcc add to the linux ELF?

When linking a hello-world-like program in c (or asm) with gcc it will add some stuff into the result executable object file. I know only about runtime dynamic linker and _start entry point but what is the kind of these added…
VP.
  • 15,509
  • 17
  • 91
  • 161
34
votes
1 answer

Why do virtual memory addresses for linux binaries start at 0x8048000?

Disassembling an ELF binary on a Ubuntu x86 system I couldn't help but notice that the code(.text) section starts from the virtual address 0x8048000 and all lower memory addresses seem to be unused. This seems to be rather wasteful and all Google…
aks
  • 24,359
  • 3
  • 32
  • 35
33
votes
1 answer

Meaning of a Common String In Executables?

There appear to be some similar-looking long alphanumeric strings that commonly occur in Mach-O 64 bit executables and ELF 64-bit LSB executables among other symbols that are not alphanumeric: cat /bin/bash | grep -c "AWAVAUATSH" has 181 results,…
seewalker
  • 1,123
  • 10
  • 18
32
votes
5 answers

Is there a downside to using -Bsymbolic-functions?

I recently discovered the linker option "-Bsymbolic-functions" in GNU ld: -Bsymbolic When creating a shared library, bind references to global symbols to the definition within the shared library, if any. Normally, it is possible for a…
Johannes Schaub - litb
  • 496,577
  • 130
  • 894
  • 1,212
1
2
3
…
99 100