Questions tagged [elf]

ELF stands for Executable and Linkable Format, a file format for files containing machine code. Use this tag for questions about the ELF format itself, or for questions which are specifically about reading/writing ELF files.

The Executable and Linkable Format (ELF) standard describes a layout for files containing executable machine code. The format is non-proprietary, flexible, extensible and machine architecture-independent.

Most modern open-source operating systems (e.g., Linux) use ELF for their native executables. Notable exceptions are Windows (using PE/COFF) and macOS/iOS (using Mach-O).

Questions that should use the tag:

  • Questions about the ELF format itself, e.g. how certain fields should be used or what their intention is.
  • Questions about reading/parsing ELF files, e.g. via the C elf.h standard header or with the readelf program.
  • Question about writing/modifying ELF files, e.g. using tools like objcopy or strip.

Resources:


Related tags:

  • For questions about the readelf program, which is used for parsing and dumping most non-machine code sections of an ELF file.
  • For questions about the objcopy program, which allows changing section contents or adding sections to existing ELF files.
2307 questions
26
votes
4 answers

Library to read ELF file DWARF debug information

Any recommendations for a good cross-platform library for reading ELF file debug information in DWARF format? I'd like to read the DWARF debug info in a Python program.
Craig McQueen
  • 41,871
  • 30
  • 130
  • 181
25
votes
5 answers

How do I find out which functions of a shared object are used by a program or an other library?

How do I find out which functions of a shared object are used by a program or an other library? In this specific case, I would like to see which functions in /lib/libgcc1_s.so.1 are used by an other dynamic library. Since they are dynamically…
lultimouomo
  • 251
  • 1
  • 3
  • 3
25
votes
6 answers

building Linux kernel on Mac OS X

I am doing a project to modify the Linux kernel. I have a desktop Linux machine and I have no problem building kernel on it. However, I am going on a trip and I want to work on my way. I only have a MacBook. When I tried to build the Linux kernel,…
Alfred Zhong
  • 6,773
  • 11
  • 47
  • 59
24
votes
2 answers

Using clang++, -fvisibility=hidden, and typeinfo, and type-erasure

This is a scaled down version of a problem I am facing with clang++ on Mac OS X. This was seriously edited to better reflect the genuine problem (the first attempt to describe the issue was not exhibiting the problem). The failure I have this big…
akim
  • 8,255
  • 3
  • 44
  • 60
24
votes
1 answer

Usage differences between. a.out, .ELF, .EXE, and .COFF

Don't get me wrong by looking at the question title - I know what they are (format for portable executable files). But my interest scope is slightly different MY CONFUSION I am involved in re-hosting/retargeting applications that are originally from…
ha9u63a7
  • 6,233
  • 16
  • 73
  • 108
24
votes
5 answers

How do you get the start and end addresses of a custom ELF section?

I'm working in C on Linux. I've seen the usage of of the gcc __section__ attribute (especially in the Linux kernel) to collect data (usually function pointers) into custom ELF sections. How is the "stuff" that gets put in those custom sections…
mgalgs
  • 15,671
  • 11
  • 61
  • 74
24
votes
4 answers

Does gcc have any options to add version info in ELF binary file?

I mean whether gcc can insert some source code version infor into ELF binary as section or something similar. I do not want to change my source file, but add some info with gcc option in Makefile.
Lane
  • 391
  • 1
  • 2
  • 6
23
votes
1 answer

What are the differences comparing PIE, PIC code and executable on 64-bit x86 platform?

The test is on Ubuntu 12.04 64-bit. x86 architecture. I am confused about the concept Position Independent Executable (PIE) and Position Independent code (PIC), and I guess they are not orthogonal. Here is my quick experiment. gcc -fPIC -pie…
lllllllllllll
  • 8,519
  • 9
  • 45
  • 80
23
votes
5 answers

Adding section to ELF file

I need to be able to add an arbitrary section to an ELF file. I cannot use GPL code in this program, so BFD is out of the question. I can use libelf/gelf to read sections, but the documentation is fairly sparse for these, and I cannot figure out how…
c4757p
  • 1,728
  • 4
  • 18
  • 25
22
votes
3 answers

How to find the main function's entry point of elf executable file without any symbolic information?

I developed a small cpp program on platform of Ubuntu-Linux 11.10. Now I want to reverse engineer it. I am beginner. I use such tools: GDB 7.0, hte editor, hexeditor. For the first time I made it pretty easy. With help of symbolic information I…
Lucky Man
  • 1,488
  • 3
  • 19
  • 41
22
votes
6 answers

How are the different segments like heap, stack, text related to the physical memory?

When a C program is compiled and the object file(ELF) is created. the object file contains different sections such as bss, data, text and other segments. I understood that these sections of the ELF are part of virtual memory address space. Am I…
vijayanand1231
  • 447
  • 1
  • 7
  • 20
22
votes
3 answers

When are GAS ELF the directives .type, .thumb, .size and .section needed?

I'm working on an assembly program for an ARM Cortex-M3 based microcontroller (Thumb 2 instruction set), using GNU as. In some example code I find directives like .size, .section and .type which I understand are ELF directives. As an example: …
user1481860
22
votes
1 answer

How to remove a specific ELF section, without stripping other symbols?

I have an ELF 32-bit x86 file which contains an .eh_frame section, despite my attempts1 to remove it. I'd like to remove the .eh_frame section, without touching any symbols in other sections, including unused ones. strip does not seem to have an…
anol
  • 8,264
  • 3
  • 34
  • 78
22
votes
3 answers

loading ELF file in C in user space

I am trying to load an ELF file compiled with "gcc -m32 test.c -o test.exe" on Linux in a 64 bit x86 environment. I am trying to load that 32bit file (test.exe) inside a user space ELF loader which has the following core logic (32bit ELF). The…
Smokey
  • 281
  • 1
  • 2
  • 6
22
votes
2 answers

load-time ELF relocation

I am writing a simple user-space ELF loader under Linux (why? for 'fun'). My loader at the moment is quite simple and is designed to load only statically-linked ELF files containing position-independent code. Normally, when a program is loaded by…
John Ledbetter
  • 13,557
  • 1
  • 61
  • 80