ELF and Stuffs

NOTE: WIP

ELF stands for Executable and Linkable file format. It’s a standard file format for executables, object files, shared library files etc. in linux and unix-like systems. So, its important to keep a bit of an idea what the elf file holds.

ELF-file is made up of ELF-Header, followed by file-data.

In the ELF-Header, there are a lot of information that helps determine what type of elf file it is, how the data is formated, and about other parts in the file.

Now, before going into the details of file-data, lets learn two terms:

• Section: It is the smallest contiguous part in the ELF file. It can be relocated and linkers use information of different sections to combine different parts of the program.

• Segments: Segments may contain one or more sections. It contains information about how the program should be loaded and run.

Now, file-data is mostly composed of different Sections, such as: .rodata (read-only data) , .text (asm code) etc. The Section Header Table lists all the sections along with their address, offset, size and other informations.

Then there is Program Header Table. It contains different segments. Segments describe how different sections should be loaded and run the ELF. The linker uses information of the Program Header Table to link files and then make it run-able.

Now, to disect the ELF-file, tools like obj-dump, readelf, xxd can be helpful.

readelf is useful for showing the headers and tables in the elf-file. It cannot show the contents.

To see the contents in each sections, we can use obj-dump.

xxd helps by directly dumping the content of the elf-file in hex-format.

But, if you just want to disect a program, without going through the hassle’s of obj-dump and stuffs, compiler explorer can be used.

About ELF file format:

1. wikipedia
2. Blog by ByteHackr
3. StackOverflow Discussion