ELF (Executable and Linkable Format) File Format

Overview

The ELF (Executable and Linkable Format) is a standard file format for executables, object code, shared libraries, and core dumps. Originally developed by Unix System Laboratories, ELF is now widely used across Unix-like operating systems including Linux, FreeBSD, and Solaris. It provides a flexible and extensible format for binary files.

Technical Details

File Characteristics

• Extension: Usually no extension (executable files)
• MIME Type: application/x-executable
• Category: Binary
• Format Type: Binary executable format

File Types

• Executable Files: Ready-to-run programs
• Relocatable Files: Object files for linking
• Shared Object Files: Dynamic libraries (.so files)
• Core Dump Files: Process memory snapshots

File Structure

ELF Header

// ELF Header Structure (simplified)
typedef struct {
    unsigned char e_ident[16];    // File identification
    uint16_t      e_type;         // Object file type
    uint16_t      e_machine;      // Architecture
    uint32_t      e_version;      // Object file version
    uintptr_t     e_entry;        // Entry point address
    uintptr_t     e_phoff;        // Program header offset
    uintptr_t     e_shoff;        // Section header offset
    uint32_t      e_flags;        // Processor flags
    uint16_t      e_ehsize;       // ELF header size
    uint16_t      e_phentsize;    // Program header size
    uint16_t      e_phnum;        // Program header count
    uint16_t      e_shentsize;    // Section header size
    uint16_t      e_shnum;        // Section header count
    uint16_t      e_shstrndx;     // String table index
} Elf_Ehdr;

File Organization

ELF File Layout:
├── ELF Header (file metadata)
├── Program Header Table (loading info)
├── Section Header Table (linking info)
└── Sections/Segments:
    ├── .text (executable code)
    ├── .data (initialized data)
    ├── .bss (uninitialized data)
    ├── .rodata (read-only data)
    ├── .symtab (symbol table)
    └── .strtab (string table)

Magic Number

ELF Magic Bytes:
0x7F 'E' 'L' 'F'  # File signature
Class: 32-bit/64-bit
Data: Little/Big endian
Version: Current (1)
OS/ABI: Linux, System V, etc.

Architecture Support

Processor Architectures

Supported Architectures:
- x86 (EM_386): Intel 80386
- x86-64 (EM_X86_64): AMD64/Intel 64
- ARM (EM_ARM): ARM processors
- AArch64 (EM_AARCH64): 64-bit ARM
- RISC-V (EM_RISCV): RISC-V processors
- PowerPC (EM_PPC): PowerPC family
- SPARC (EM_SPARC): SPARC processors
- MIPS (EM_MIPS): MIPS processors

Endianness Support

• Little Endian: x86, x86-64, ARM (common)
• Big Endian: PowerPC, SPARC, MIPS (some variants)
• Bi-endian: ARM, MIPS (configurable)

Sections and Segments

Common Sections

Standard ELF Sections:
.text      # Executable instructions
.data      # Initialized global variables
.bss       # Uninitialized global variables
.rodata    # Read-only data (constants)
.symtab    # Symbol table
.strtab    # String table
.shstrtab  # Section header string table
.rel.text  # Relocation information
.debug_*   # Debugging information

Program Segments

Loadable Segments:
LOAD    # Loadable program segment
DYNAMIC # Dynamic linking information
INTERP  # Program interpreter
NOTE    # Auxiliary information
PHDR    # Program header table
TLS     # Thread-local storage

Compilation and Linking

Building ELF Files

# Compile C source to object file
gcc -c program.c -o program.o

# Link object file to executable
gcc program.o -o program

# Create shared library
gcc -shared -fPIC library.c -o library.so

# Static linking
gcc -static program.c -o program

Cross-Compilation

# Cross-compile for ARM
arm-linux-gnueabihf-gcc program.c -o program-arm

# Cross-compile for 32-bit on 64-bit system
gcc -m32 program.c -o program-32bit

Analysis Tools

Command Line Tools

# Display ELF header information
readelf -h executable

# Show program headers
readelf -l executable

# Display section headers
readelf -S executable

# Show symbol table
readelf -s executable

# Disassemble executable
objdump -d executable

# Show file type
file executable

Detailed Analysis

# ELF file information
$ readelf -h /bin/ls
ELF Header:
  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF64
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           Advanced Micro Devices X86-64
  Version:                           0x1
  Entry point address:               0x404390

Dynamic Linking

Shared Libraries

# List dynamic dependencies
ldd executable

# Show library loading
LD_DEBUG=libs ./executable

# Set library path
export LD_LIBRARY_PATH=/custom/path:$LD_LIBRARY_PATH

Runtime Linker

// Dynamic loading in C
#include <dlfcn.h>

void* handle = dlopen("library.so", RTLD_LAZY);
if (handle) {
    void (*func)() = dlsym(handle, "function_name");
    if (func) {
        func();
    }
    dlclose(handle);
}

Security Features

Position Independent Code

# Generate position-independent executable
gcc -pie -fpie program.c -o program

# Check for PIE
readelf -h program | grep Type

Stack Protection

# Enable stack protection
gcc -fstack-protector-all program.c -o program

# Check for stack canaries
objdump -d program | grep __stack_chk

Security Mitigations

# Check security features
checksec --file=executable

# RELRO (RELocation Read-Only)
gcc -Wl,-z,relro,-z,now program.c -o program

# NX bit (No-eXecute)
gcc -Wl,-z,noexecstack program.c -o program

Debugging Information

Debug Symbols

# Compile with debug information
gcc -g program.c -o program

# Strip debug symbols
strip program

# Separate debug info
objcopy --only-keep-debug program program.debug
objcopy --strip-debug program
objcopy --add-gnu-debuglink=program.debug program

GDB Integration

# Debug with GDB
gdb ./program

# Core dump analysis
gdb ./program core

# Remote debugging
gdb -ex "target remote :1234" ./program

Common Use Cases

System Programming

• Operating System Kernels: Linux kernel modules
• Device Drivers: Hardware interface programs
• System Services: Daemons and background processes
• Command Line Tools: System utilities and applications

Application Development

• Desktop Applications: GUI and console programs
• Server Software: Web servers, databases, services
• Embedded Systems: Firmware and real-time applications
• Scientific Computing: High-performance computing applications

Best Practices

Development

• Use appropriate compiler flags for target architecture
• Include debug information during development
• Strip symbols for production releases
• Enable security features and hardening options

Distribution

• Test on target architectures and operating systems
• Provide static builds for compatibility
• Document library dependencies
• Include checksums for integrity verification

Performance

• Profile applications to identify bottlenecks
• Use link-time optimization (LTO) for release builds
• Consider profile-guided optimization (PGO)
• Minimize dynamic relocations for better startup time

The ELF format provides a robust foundation for executable files across Unix-like systems, supporting modern features like dynamic linking, debugging, and security enhancements while maintaining compatibility across diverse hardware architectures.