Questions tagged [elf]

ELF stands for Executable and Linkable Format, a file format for files containing machine code. Use this tag for questions about the ELF format itself, or for questions which are specifically about reading/writing ELF files.

The Executable and Linkable Format (ELF) standard describes a layout for files containing executable machine code. The format is non-proprietary, flexible, extensible and machine architecture-independent.

Most modern open-source operating systems (e.g., Linux) use ELF for their native executables. Notable exceptions are Windows (using PE/COFF) and macOS/iOS (using Mach-O).

Questions that should use the tag:

  • Questions about the ELF format itself, e.g. how certain fields should be used or what their intention is.
  • Questions about reading/parsing ELF files, e.g. via the C elf.h standard header or with the readelf program.
  • Question about writing/modifying ELF files, e.g. using tools like objcopy or strip.

Resources:


Related tags:

  • For questions about the readelf program, which is used for parsing and dumping most non-machine code sections of an ELF file.
  • For questions about the objcopy program, which allows changing section contents or adding sections to existing ELF files.
2307 questions
32
votes
4 answers

.bss vs COMMON: what goes where?

From my book: .bss: Uninitialized global C variables COMMON: Uninitalized data objects that are not yet allocated I have to say, I don't quite see a clear distinction. I don't even quite understand what an uninitizalied, non-allocated data…
gone
  • 2,587
  • 6
  • 25
  • 32
32
votes
1 answer

What do the .eh_frame and .eh_frame_hdr sections store, exactly?

I know that, when using languages that support exceptions, such as C++, additional information must be provided to the runtime environment to describe the call frames that must be unwound during the processing of an exception. This information is…
LuisABOL
  • 2,951
  • 4
  • 25
  • 57
31
votes
3 answers

Processing ELF relocations - understanding the relocs, symbols, section data, and how they work together

TL;DR I tried to make this a short question but it's a complicated problem so it ended up being long. If you can answer any part of this or give any suggestions or tips or resources or anything at all, it would be extremely helpful (even if you…
thehelix
  • 578
  • 1
  • 6
  • 10
29
votes
1 answer

readelf -s does not output full variable names

I need to get the global symbols from a compiled c program file. What I use is the linux command readelf -s filePath when I use that command this is what I get: I draw a blue rectangle to show that variable names do not get displayed correctly.…
Tono Nam
  • 34,064
  • 78
  • 298
  • 470
28
votes
2 answers

executing init and fini

I just read about init and fini sections in ELF files and gave it a try: #include int main(){ puts("main"); return 0; } void init(){ puts("init"); } void fini(){ puts("fini"); } If I do gcc -Wl,-init,init -Wl,-fini,fini foo.c and…
michas
  • 25,361
  • 15
  • 76
  • 121
28
votes
7 answers

Any tool/software in windows for viewing ELF file format?

There are lots of PE file browsers. Here is a list of good ones if you are interested: PE File format viewers: PE Explorer http://www.pe-explorer.com/ PE VIew: http://www.magma.ca/~wjr/ PEBrowse Professional…
norris
  • 387
  • 1
  • 4
  • 6
28
votes
1 answer

What is the "__gmon_start__" symbol?

I'm compiling this code with gcc hello.c -o hello -O3: #include int main(void) { printf("Hello world\n"); return 0; } and when I list the relocations I get: test@southpark$ readelf -r hello | grep gmon 080495a4 00000106…
JohnTortugo
  • 6,356
  • 7
  • 36
  • 69
28
votes
1 answer

What is the difference between .got and .got.plt section?

What is the difference between .got and .got.plt section in ELF format?
scdmb
  • 15,091
  • 21
  • 85
  • 128
27
votes
3 answers

Difference in position-independent code: x86 vs x86-64

I was recently building a certain shared library (ELF) targeting x86-64 architecture, like this: g++ -o binary.so -shared --no-undefined ... -lfoo -lbar This failed with the following error: relocation R_X86_64_32 against `a local symbol' can not…
Alex B
  • 82,554
  • 44
  • 203
  • 280
27
votes
2 answers

Difference between Program header and Section Header in ELF

Q1 What is the difference between Program header and Section Header in ELF? Q1.1 What is the difference between segment and a section? I believe pheaders point to sections only. Q2. What is the difference between File Header and Program Header? As…
user435739
27
votes
5 answers

How to list on-the-fly all the functions/symbols available in C code on a Linux architecture?

Assume main.c uses symbols from shared libs and local functions declared in main.c. Is there a nice and elegant way to print a list of all the available function names and symbols at run time? It should be possible since the data is loaded to the…
0x90
  • 39,472
  • 36
  • 165
  • 245
26
votes
4 answers

What is the difference between executable and relocatable in elf format?

What is the difference between executable file in elf format and relocatable file in elf format?
Rimon Fedyuk
  • 471
  • 1
  • 4
  • 8
26
votes
2 answers

Why is the ELF execution entry point virtual address of the form 0x80xxxxx and not zero 0x0?

When executed, program will start running from virtual address 0x80482c0. This address doesn't point to our main() procedure, but to a procedure named _start which is created by the linker. My Google research so far just led me to some (vague)…
Michael L.
  • 263
  • 1
  • 3
  • 5
26
votes
1 answer

Force GNU linker to generate 32 bit ELF executables

Hi I am currently generating x86 assembly for a compiler that I am writing and am having some trouble linking the file on my 64-bit VM (the assembly code is 32 bit). I was able to assemble the object file fine with this command: as --32 mult.S -o…
Hunter McMillen
  • 59,865
  • 24
  • 119
  • 170
26
votes
3 answers

Why is the entry point address in my executable 0x8048330? (0x330 being the offset of .text section)

I wrote a small program to add two integers and on using readelf -a executable_name it showed the entry point address in elf header as: Entry point address: 0x8048330 How does my executable know this address beforehand even before loader loads it…
mezda
  • 3,537
  • 6
  • 30
  • 37