1.\" $OpenBSD: elf.5,v 1.42 2022/03/31 17:27:22 naddy Exp $ 2.\"Copyright (c) 1999 Jeroen Ruigrok van der Werven 3.\"All rights reserved. 4.\" 5.\"Redistribution and use in source and binary forms, with or without 6.\"modification, are permitted provided that the following conditions 7.\"are met: 8.\"1. Redistributions of source code must retain the above copyright 9.\" notice, this list of conditions and the following disclaimer. 10.\"2. Redistributions in binary form must reproduce the above copyright 11.\" notice, this list of conditions and the following disclaimer in the 12.\" documentation and/or other materials provided with the distribution. 13.\" 14.\"THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15.\"ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16.\"IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17.\"ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18.\"FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19.\"DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20.\"OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21.\"HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22.\"LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23.\"OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24.\"SUCH DAMAGE. 25.\" 26.\" $FreeBSD: src/share/man/man5/elf.5,v 1.21 2001/10/01 16:09:23 ru Exp $ 27.\" 28.Dd $Mdocdate: March 31 2022 $ 29.Dt ELF 5 30.Os 31.Sh NAME 32.Nm elf 33.Nd format of ELF executable binary files 34.Sh SYNOPSIS 35.In elf.h 36.Sh DESCRIPTION 37The header file 38.In elf.h 39defines the format of ELF executable binary files. 40Amongst these files are 41normal executable files, relocatable object files, core files and shared 42libraries. 43.Pp 44An executable file using the ELF file format consists of an ELF header, 45followed by a program header table or a section header table, or both. 46The ELF header is always at offset zero of the file. 47The program header 48table and the section header table's offset in the file are defined in the 49ELF header. 50The two tables describe the rest of the particularities of 51the file. 52.Pp 53Applications which wish to process ELF binary files for their native 54architecture only should include 55.In elf.h 56in their source code. 57These applications should need to refer to 58all the types and structures by their generic names 59.Dq Elf_xxx 60and to the macros by 61.Dq ELF_xxx . 62Applications written this way can be compiled on any architecture, 63regardless of whether the host is 32-bit or 64-bit. 64.Pp 65Should an application need to process ELF files of an unknown 66architecture, then the application needs to explicitly use either 67.Dq Elf32_xxx 68or 69.Dq Elf64_xxx 70type and structure names. 71Likewise, the macros need to be identified by 72.Dq ELF32_xxx 73or 74.Dq ELF64_xxx . 75.Pp 76This header file describes the above mentioned headers as C structures 77and also includes structures for dynamic sections, relocation sections and 78symbol tables. 79.Pp 80The following types are used for 32-bit architectures: 81.Bd -literal -offset indent 82Elf32_Addr Unsigned 32-bit program address 83Elf32_Half Unsigned 16-bit field 84Elf32_Lword Unsigned 64-bit field 85Elf32_Off Unsigned 32-bit file offset 86Elf32_Sword Signed 32-bit field or integer 87Elf32_Word Unsigned 32-bit field or integer 88.Ed 89.Pp 90And the following types are used for 64-bit architectures: 91.Bd -literal -offset indent 92Elf64_Addr Unsigned 64-bit program address 93Elf64_Half Unsigned 16-bit field 94Elf64_Lword Unsigned 64-bit field 95Elf64_Off Unsigned 64-bit file offset 96Elf64_Sword Signed 32-bit field 97Elf64_Sxword Signed 64-bit field or integer 98Elf64_Word Unsigned 32-bit field 99Elf64_Xword Unsigned 64-bit field or integer 100.Ed 101.Pp 102All data structures that the file format defines follow the 103.Dq natural 104size and alignment guidelines for the relevant class. 105If necessary, 106data structures contain explicit padding to ensure 4-byte alignment 107for 4-byte objects, to force structure sizes to a multiple of 4, etc. 108.Pp 109The ELF header is described by the type Elf32_Ehdr or Elf64_Ehdr: 110.Bd -literal -offset indent 111typedef struct { 112 unsigned char e_ident[EI_NIDENT]; 113 Elf32_Half e_type; 114 Elf32_Half e_machine; 115 Elf32_Word e_version; 116 Elf32_Addr e_entry; 117 Elf32_Off e_phoff; 118 Elf32_Off e_shoff; 119 Elf32_Word e_flags; 120 Elf32_Half e_ehsize; 121 Elf32_Half e_phentsize; 122 Elf32_Half e_phnum; 123 Elf32_Half e_shentsize; 124 Elf32_Half e_shnum; 125 Elf32_Half e_shstrndx; 126} Elf32_Ehdr; 127.Ed 128.Bd -literal -offset indent 129typedef struct { 130 unsigned char e_ident[EI_NIDENT]; 131 Elf64_Half e_type; 132 Elf64_Half e_machine; 133 Elf64_Word e_version; 134 Elf64_Addr e_entry; 135 Elf64_Off e_phoff; 136 Elf64_Off e_shoff; 137 Elf64_Word e_flags; 138 Elf64_Half e_ehsize; 139 Elf64_Half e_phentsize; 140 Elf64_Half e_phnum; 141 Elf64_Half e_shentsize; 142 Elf64_Half e_shnum; 143 Elf64_Half e_shstrndx; 144} Elf64_Ehdr; 145.Ed 146.Pp 147The fields have the following meanings: 148.Bl -tag -width "e_phentsize" -offset indent 149.It Dv e_ident 150This array of bytes specifies how to interpret the file, 151independent of the processor or the file's remaining contents. 152Within this array everything is named by macros, which start with 153the prefix 154.Sy EI_ 155and may contain values which start with the prefix 156.Sy ELF . 157The following macros are defined: 158.Bl -tag -width "EI_VERSION" 159.It Dv EI_MAG0 160The first byte of the magic number. 161It must be filled with 162.Dv ELFMAG0 . 163.It Dv EI_MAG1 164The second byte of the magic number. 165It must be filled with 166.Dv ELFMAG1 . 167.It Dv EI_MAG2 168The third byte of the magic number. 169It must be filled with 170.Dv ELFMAG2 . 171.It Dv EI_MAG3 172The fourth byte of the magic number. 173It must be filled with 174.Dv ELFMAG3 . 175.It Dv EI_CLASS 176The fifth byte identifies the architecture for this binary: 177.Pp 178.Bl -tag -width "ELFCLASSNONE" -compact 179.It Dv ELFCLASSNONE 180This class is invalid. 181.It Dv ELFCLASS32 182This defines the 32-bit architecture. 183It supports machines with files 184and virtual address spaces up to 4 Gigabytes. 185.It Dv ELFCLASS64 186This defines the 64-bit architecture. 187.El 188.It Dv EI_DATA 189The sixth byte specifies the data encoding of the processor-specific 190data in the file. 191Currently these encodings are supported: 192.Pp 193.Bl -tag -width "ELFDATA2LSB" -compact 194.It Dv ELFDATANONE 195Unknown data format. 196.It Dv ELFDATA2LSB 197Two's complement, little-endian. 198.It Dv ELFDATA2MSB 199Two's complement, big-endian. 200.El 201.It Dv EI_VERSION 202The version number of the ELF specification: 203.Pp 204.Bl -tag -width "EV_CURRENT" -compact 205.It Dv EV_NONE 206Invalid version. 207.It Dv EV_CURRENT 208Current version. 209.El 210.It Dv EI_OSABI 211This byte identifies the OS- or ABI-specific ELF extensions used by 212this object. 213Some fields in other ELF structures have flags and values that have 214platform specific meanings; the interpretation of those fields is 215determined by the value of this byte. 216The following values are currently defined: 217.Pp 218.Bl -tag -width "ELFOSABI_STANDALONE" -compact 219.It Dv ELFOSABI_SYSV 220UNIX System V ABI. 221.It Dv ELFOSABI_HPUX 222HP-UX operating system ABI. 223.It Dv ELFOSABI_NETBSD 224.Nx 225operating system ABI. 226.It Dv ELFOSABI_LINUX 227GNU/Linux operating system ABI. 228.It Dv ELFOSABI_HURD 229GNU/Hurd operating system ABI. 230.It Dv ELFOSABI_86OPEN 23186Open Common IA32 ABI. 232.It Dv ELFOSABI_SOLARIS 233Solaris operating system ABI. 234.It Dv ELFOSABI_MONTEREY 235Monterey project ABI. 236.It Dv ELFOSABI_IRIX 237IRIX operating system ABI. 238.It Dv ELFOSABI_FREEBSD 239.Fx 240operating system ABI. 241.It Dv ELFOSABI_TRU64 242TRU64 UNIX operating system ABI. 243.It Dv ELFOSABI_MODESTO 244Novell Modesto operating system ABI. 245.It Dv ELFOSABI_OPENBSD 246.Ox 247operating system ABI. 248.It Dv ELFOSABI_ARM 249ARM architecture ABI. 250.It Dv ELFOSABI_STANDALONE 251Stand-alone (embedded) ABI. 252.El 253.It Dv EI_ABIVERSION 254This byte identifies the version of the ABI 255to which the object is targeted. 256This field is used to distinguish among incompatible versions of an ABI. 257The interpretation of this version number 258is dependent on the ABI identified by the EI_OSABI field. 259.It Dv EI_PAD 260Start of padding. 261These bytes are reserved and set to zero. 262Programs which read them should ignore them. 263The value for EI_PAD will change in 264the future if currently unused bytes are given meanings. 265.It Dv EI_NIDENT 266The size of the e_ident array. 267.El 268.It Dv e_type 269This member of the structure identifies the object file type: 270.Pp 271.Bl -tag -width "ET_NONE" -compact 272.It Dv ET_NONE 273An unknown type. 274.It Dv ET_REL 275A relocatable file. 276.It Dv ET_EXEC 277An executable file. 278.It Dv ET_DYN 279A shared object. 280.It Dv ET_CORE 281A core file. 282.El 283.It Dv e_machine 284This member specifies the required architecture for an individual file: 285.Pp 286.Bl -tag -width "EM_MIPS_RS4_BE" -compact 287.It Dv EM_NONE 288An unknown machine. 289.It Dv EM_M32 290AT&T WE 32100. 291.It Dv EM_SPARC 292Sun Microsystems SPARC. 293.It Dv EM_386 294Intel 80386. 295.It Dv EM_68K 296Motorola 68000. 297.It Dv EM_88K 298Motorola 88000. 299.It Dv EM_486 300Intel 80486. 301.It Dv EM_860 302Intel 80860. 303.It Dv EM_MIPS 304MIPS RS3000 (big-endian only). 305.It Dv EM_MIPS_RS4_BE 306MIPS RS4000 (big-endian only). 307.It Dv EM_SPARC64 308SPARC v9 64-bit (unofficial). 309.It Dv EM_PARISC 310HPPA. 311.It Dv EM_SPARC32PLUS 312SPARC with enhanced instruction set. 313.It Dv EM_PPC 314PowerPC. 315.It Dv EM_PPC64 316PowerPC 64-bit. 317.It Dv EM_ARM 318Advanced RISC Machines ARM. 319.It Dv EM_ALPHA 320Compaq [DEC] Alpha. 321.It Dv EM_SH 322Hitachi/Renesas Super-H. 323.It Dv EM_SPARCV9 324SPARC v9 64-bit. 325.It Dv EM_IA_64 326Intel IA-64. 327.It Dv EM_AMD64 328AMD64. 329.It Dv EM_VAX 330DEC Vax. 331.It Dv EM_AARCH64 332ARM 64-bit. 333.It Dv EM_RISCV 334RISC-V. 335.It Dv EM_ALPHA_EXP 336Compaq [DEC] Alpha with enhanced instruction set. 337.El 338.It Dv e_version 339This member identifies the file version: 340.Pp 341.Bl -tag -width "EV_CURRENT" -compact 342.It Dv EV_NONE 343Invalid version. 344.It Dv EV_CURRENT 345Current version. 346.El 347.It Dv e_entry 348This member gives the virtual address to which the system first transfers 349control, thus starting the process. 350If the file has no associated entry 351point, this member holds zero. 352.It Dv e_phoff 353This member holds the program header table's file offset in bytes. 354If 355the file has no program header table, this member holds zero. 356.It Dv e_shoff 357This member holds the section header table's file offset in bytes. 358If the 359file has no section header table, this member holds zero. 360.It Dv e_flags 361This member holds processor-specific flags associated with the file. 362Flag names take the form EF_`machine_flag'. 363Currently no flags have been defined. 364.It Dv e_ehsize 365This member holds the ELF header's size in bytes. 366.It Dv e_phentsize 367This member holds the size in bytes of one entry in the file's program header 368table; all entries are the same size. 369.It Dv e_phnum 370This member holds the number of entries in the program header 371table. 372Thus the product of 373.Sy e_phentsize 374and 375.Sy e_phnum 376gives the table's size 377in bytes. 378If a file has no program header, 379.Sy e_phnum 380holds the value zero. 381.It Dv e_shentsize 382This member holds a sections header's size in bytes. 383A section header is one 384entry in the section header table; all entries are the same size. 385.It Dv e_shnum 386This member holds the number of entries in the section header table. 387Thus 388the product of 389.Sy e_shentsize 390and 391.Sy e_shnum 392gives the section header table's size in bytes. 393If a file has no section 394header table, 395.Sy e_shnum 396holds the value of zero. 397.It Dv e_shstrndx 398This member holds the section header table index of the entry associated 399with the section name string table. 400If the file has no section name string 401table, this member holds the value 402.Dv SHN_UNDEF . 403.El 404.Pp 405An executable or shared object file's program header table is an array of 406structures, each describing a segment or other information the system needs 407to prepare the program for execution. 408An object file 409.Em segment 410contains one or more 411.Em sections . 412Program headers are meaningful only for executable and shared object files. 413A file specifies its own program header size with the ELF header's 414.Sy e_phentsize 415and 416.Sy e_phnum 417members. 418As with the ELF executable header, the program header 419also has different versions depending on the architecture: 420.Bd -literal -offset indent 421typedef struct { 422 Elf32_Word p_type; 423 Elf32_Off p_offset; 424 Elf32_Addr p_vaddr; 425 Elf32_Addr p_paddr; 426 Elf32_Word p_filesz; 427 Elf32_Word p_memsz; 428 Elf32_Word p_flags; 429 Elf32_Word p_align; 430} Elf32_Phdr; 431.Ed 432.Bd -literal -offset indent 433typedef struct { 434 Elf64_Word p_type; 435 Elf64_Word p_flags; 436 Elf64_Off p_offset; 437 Elf64_Addr p_vaddr; 438 Elf64_Addr p_paddr; 439 Elf64_Xword p_filesz; 440 Elf64_Xword p_memsz; 441 Elf64_Xword p_align; 442} Elf64_Phdr; 443.Ed 444.Pp 445The main difference between the 32-bit and the 64-bit program header lies 446only in the location of a 447.Sy p_flags 448member in the total struct. 449.Bl -tag -width "p_offset" -offset indent 450.It Dv p_type 451This member of the Phdr struct tells what kind of segment this array 452element describes or how to interpret the array element's information. 453.Bl -tag -width "PT_DYNAMIC" 454.It Dv PT_NULL 455The array element is unused and the other members' values are undefined. 456This lets the program header have ignored entries. 457.It Dv PT_LOAD 458The array element specifies a loadable segment, described by 459.Sy p_filesz 460and 461.Sy p_memsz . 462The bytes from the file are mapped to the beginning of the memory 463segment. 464If the segment's memory size 465.Pq Sy p_memsz 466is larger than the file size 467.Pq Sy p_filesz , 468the 469.Dq extra 470bytes are defined to hold the value 0 and to follow the segment's 471initialized area. 472The file size may not be larger than the memory size. 473Loadable segment entries in the program header table appear in ascending 474order, sorted on the 475.Sy p_vaddr 476member. 477.It Dv PT_DYNAMIC 478The array element specifies the location and size of the dynamic section, 479both in the file and in the memory image of the program. 480This segment type may not occur more than once in a file and may 481only occur if the dynamic section is part of the memory image of 482the program. 483.It Dv PT_INTERP 484The array element specifies the location and size of a null-terminated 485path name to invoke as an interpreter. 486This segment type is meaningful 487only for executable files (though it may occur for shared objects). 488However it may not occur more than once in a file. 489If it is present, it must precede any loadable segment entry. 490.It Dv PT_NOTE 491The array element specifies the location and size for auxiliary information. 492.It Dv PT_SHLIB 493This segment type is reserved but has unspecified semantics. 494Programs that 495contain an array element of this type do not conform to the ABI. 496.It Dv PT_PHDR 497The array element specifies the location and size of the program 498header table itself, both in the file and in the memory image of the program. 499This segment type may not occur more than once in a file and may 500only occur if the program header table is part of the memory image 501of the program. 502If it is present, it must precede any loadable segment entry. 503.It Dv PT_TLS 504The array element specifies the location and size of the 505thread-local storage for this file. 506Each thread in a process loading this file will have the segment's 507memory size 508.Pq Sy p_memsz 509allocated for it, where the bytes up to the segment's file size 510.Pq Sy p_filesz 511will be initialized with the data in this segment and the remaining 512.Dq extra 513bytes will be set to zero. 514This segment type may not occur more than once in a file and may 515only occur if the thread-local storage is part of the memory image 516of the program. 517.It Dv PT_GNU_EH_FRAME 518The array element specifies the location and size of the GNU exception 519frame header, both in the file and in the memory image of the program. 520This segment type may not occur more than once in a file and may 521only occur if the GNU exception frame header is part of the memory 522image of the program. 523.It Dv PT_GNU_RELRO 524The array element specifies the location and size of a part of the 525memory image of the program that should be made read-only once all 526immediate relocation processing for the file has been performed. 527This segment type may not occur more than once in a file. 528.It Dv PT_OPENBSD_RANDOMIZE 529The array element specifies the location and size of a part of the 530memory image of the program that must be filled with random data 531before any code in the object is executed. 532The memory region specified by a segment of this type may overlap 533the region specified by a 534.Dv PT_GNU_RELRO 535segment, in which case the intersection will be filled with random 536data before being marked read-only. 537This segment type may occur more than once in a file, but a limit 538on the total number of bytes in the segments for an object of no 539less than 65536 bytes may be imposed. 540.It Dv PT_OPENBSD_WXNEEDED 541The array element specifies that a process executing this file may 542need to be able to map or protect memory regions as simultaneously 543executable and writable. 544If the system is unable or unwilling to permit that for this executable 545then it may fail immediately. 546This segment type is meaningful only for executable files and is 547ignored in other objects. 548.It Dv PT_LOOS 549This value up to and including 550.Dv PT_HIOS 551is reserved for operating system-specific semantics. 552.It Dv PT_HIOS 553This value down to and including 554.Dv PT_LOOS 555is reserved for operating system-specific semantics. 556.It Dv PT_LOPROC 557This value up to and including 558.Dv PT_HIPROC 559is reserved for processor-specific semantics. 560.It Dv PT_HIPROC 561This value down to and including 562.Dv PT_LOPROC 563is reserved for processor-specific semantics. 564.El 565.It Dv p_offset 566This member holds the offset from the beginning of the file at which 567the first byte of the segment resides. 568.It Dv p_vaddr 569This member holds the virtual address at which the first byte of the 570segment resides in memory. 571.It Dv p_paddr 572On systems for which physical addressing is relevant, this member is 573reserved for the segment's physical address. 574Under 575.Bx 576this member is 577not used and must be zero. 578.It Dv p_filesz 579This member holds the number of bytes in the file image of the segment. 580It may be zero. 581.It Dv p_memsz 582This member holds the number of bytes in the memory image of the segment. 583It may be zero. 584.It Dv p_flags 585This member holds flags relevant to the segment: 586.Pp 587.Bl -tag -width "PF_X" -compact 588.It Dv PF_X 589An executable segment. 590.It Dv PF_W 591A writable segment. 592.It Dv PF_R 593A readable segment. 594.El 595.Pp 596A text segment commonly has the flags 597.Dv PF_X 598and 599.Dv PF_R . 600A data segment commonly has 601.Dv PF_X , 602.Dv PF_W 603and 604.Dv PF_R . 605.It Dv p_align 606This member holds the value to which the segments are aligned in memory 607and in the file. 608Loadable process segments must have congruent values for 609.Sy p_vaddr 610and 611.Sy p_offset , 612modulo the page size. 613Values of zero and one mean no alignment is required. 614Otherwise, 615.Sy p_align 616should be a positive, integral power of two, and 617.Sy p_vaddr 618should equal 619.Sy p_offset , 620modulo 621.Sy p_align . 622.El 623.Pp 624A file's section header table lets one locate all the file's sections. 625The 626section header table is an array of Elf32_Shdr or Elf64_Shdr structures. 627The 628ELF header's 629.Sy e_shoff 630member gives the byte offset from the beginning of the file to the section 631header table. 632.Sy e_shnum 633holds the number of entries the section header table contains. 634.Sy e_shentsize 635holds the size in bytes of each entry. 636.Pp 637A section header table index is a subscript into this array. 638Some section 639header table indices are reserved. 640An object file does not have sections for 641these special indices: 642.Bl -tag -width "SHN_LORESERVE" 643.It Dv SHN_UNDEF 644This value marks an undefined, missing, irrelevant or otherwise meaningless 645section reference. 646For example, a symbol 647.Dq defined 648relative to section number 649.Dv SHN_UNDEF 650is an undefined symbol. 651.It Dv SHN_LORESERVE 652This value specifies the lower bound of the range of reserved indices. 653.It Dv SHN_LOPROC 654This value up to and including 655.Dv SHN_HIPROC 656is reserved for processor-specific semantics. 657.It Dv SHN_HIPROC 658This value down to and including 659.Dv SHN_LOPROC 660is reserved for processor-specific semantics. 661.It Dv SHN_ABS 662This value specifies the absolute value for the corresponding reference. 663For 664example, a symbol defined relative to section number 665.Dv SHN_ABS 666has an absolute value and is not affected by relocation. 667.It Dv SHN_COMMON 668Symbols defined relative to this section are common symbols, such as FORTRAN 669COMMON or unallocated C external variables. 670.It Dv SHN_HIRESERVE 671This value specifies the upper bound of the range of reserved indices. 672The 673system reserves indices between 674.Dv SHN_LORESERVE 675and 676.Dv SHN_HIRESERVE , 677inclusive. 678The section header table does not contain entries for the 679reserved indices. 680.El 681.Pp 682The section header has the following structure: 683.Bd -literal -offset indent 684typedef struct { 685 Elf32_Word sh_name; 686 Elf32_Word sh_type; 687 Elf32_Word sh_flags; 688 Elf32_Addr sh_addr; 689 Elf32_Off sh_offset; 690 Elf32_Word sh_size; 691 Elf32_Word sh_link; 692 Elf32_Word sh_info; 693 Elf32_Word sh_addralign; 694 Elf32_Word sh_entsize; 695} Elf32_Shdr; 696.Ed 697.Bd -literal -offset indent 698typedef struct { 699 Elf64_Word sh_name; 700 Elf64_Word sh_type; 701 Elf64_Xword sh_flags; 702 Elf64_Addr sh_addr; 703 Elf64_Off sh_offset; 704 Elf64_Xword sh_size; 705 Elf64_Word sh_link; 706 Elf64_Word sh_info; 707 Elf64_Xword sh_addralign; 708 Elf64_Xword sh_entsize; 709} Elf64_Shdr; 710.Ed 711.Bl -tag -width "sh_addralign" 712.It Dv sh_name 713This member specifies the name of the section. 714Its value is an index 715into the section header string table section, giving the location of 716a null-terminated string. 717.It Dv sh_type 718This member categorizes the section's contents and semantics. 719.Bl -tag -width "SHT_PROGBITS" 720.It Dv SHT_NULL 721This value marks the section header as inactive. 722It does not 723have an associated section. 724Other members of the section header 725have undefined values. 726.It Dv SHT_PROGBITS 727This section holds information defined by the program, whose 728format and meaning are determined solely by the program. 729.It Dv SHT_SYMTAB 730This section holds a symbol table. 731Typically, 732.Dv SHT_SYMTAB 733provides symbols for link editing, though it may also be used 734for dynamic linking. 735As a complete symbol table, it may contain 736many symbols unnecessary for dynamic linking. 737An object file can 738also contain a 739.Dv SHT_DYNSYM 740section. 741.It Dv SHT_STRTAB 742This section holds a string table. 743An object file may have multiple 744string table sections. 745.It Dv SHT_RELA 746This section holds relocation entries with explicit addends, such 747as type 748.Sy Elf32_Rela 749for the 32-bit class of object files. 750An object may have multiple 751relocation sections. 752.It Dv SHT_HASH 753This section holds a symbol hash table. 754An object participating in 755dynamic linking must contain a symbol hash table. 756An object file may 757have only one hash table. 758.It Dv SHT_DYNAMIC 759This section holds information for dynamic linking. 760An object file may 761have only one dynamic section. 762.It Dv SHT_NOTE 763This section holds information that marks the file in some way. 764.It Dv SHT_NOBITS 765A section of this type occupies no space in the file but otherwise 766resembles 767.Dv SHT_PROGBITS . 768Although this section contains no bytes, the 769.Sy sh_offset 770member contains the conceptual file offset. 771.It Dv SHT_REL 772This section holds relocation offsets without explicit addends, such 773as type 774.Sy Elf32_Rel 775for the 32-bit class of object files. 776An object file may have multiple 777relocation sections. 778.It Dv SHT_SHLIB 779This section is reserved but has unspecified semantics. 780.It Dv SHT_DYNSYM 781This section holds a minimal set of dynamic linking symbols. 782An 783object file can also contain a 784.Dv SHT_SYMTAB 785section. 786.It Dv SHT_LOPROC 787This value up to and including 788.Dv SHT_HIPROC 789is reserved for processor-specific semantics. 790.It Dv SHT_HIPROC 791This value down to and including 792.Dv SHT_LOPROC 793is reserved for processor-specific semantics. 794.It Dv SHT_LOUSER 795This value specifies the lower bound of the range of indices reserved for 796application programs. 797.It Dv SHT_HIUSER 798This value specifies the upper bound of the range of indices reserved for 799application programs. 800Section types between 801.Dv SHT_LOUSER 802and 803.Dv SHT_HIUSER 804may be used by the application, without conflicting with current or future 805system-defined section types. 806.El 807.It Dv sh_flags 808Sections support one-bit flags that describe miscellaneous attributes. 809If a flag bit is set in 810.Sy sh_flags , 811the attribute is 812.Dq on 813for the section. 814Otherwise, the attribute is 815.Dq off 816or does not apply. 817Undefined attributes are set to zero. 818.Pp 819.Bl -tag -width "SHF_EXECINSTR" -compact 820.It Dv SHF_WRITE 821This section contains data that should be writable during process 822execution. 823.It Dv SHF_ALLOC 824This section occupies memory during process execution. 825Some control 826sections do not reside in the memory image of an object file. 827This 828attribute is off for those sections. 829.It Dv SHF_EXECINSTR 830This section contains executable machine instructions. 831.It Dv SHF_TLS 832This section is for thread-local storage. 833.It Dv SHF_MASKPROC 834All bits included in this mask are reserved for processor-specific 835semantics. 836.El 837.It Dv sh_addr 838If this section appears in the memory image of a process, this member 839holds the address at which the section's first byte should reside. 840Otherwise, the member contains zero. 841.It Dv sh_offset 842This member's value holds the byte offset from the beginning of the file 843to the first byte in the section. 844One section type, 845.Dv SHT_NOBITS , 846occupies no space in the file, and its 847.Sy sh_offset 848member locates the conceptual placement in the file. 849.It Dv sh_size 850This member holds the section's size in bytes. 851Unless the section type 852is 853.Dv SHT_NOBITS , 854the section occupies 855.Sy sh_size 856bytes in the file. 857A section of type 858.Dv SHT_NOBITS 859may have a non-zero size, but it occupies no space in the file. 860.It Dv sh_link 861This member holds a section header table index link, whose interpretation 862depends on the section type. 863.It Dv sh_info 864This member holds extra information, whose interpretation depends on the 865section type. 866.It Dv sh_addralign 867Some sections have address alignment constraints. 868If a section holds a 869doubleword, the system must ensure doubleword alignment for the entire 870section. 871That is, the value of 872.Sy sh_addr 873must be congruent to zero, modulo the value of 874.Sy sh_addralign . 875Only zero and positive integral powers of two are allowed. 876Values of zero 877or one mean the section has no alignment constraints. 878.It Dv sh_entsize 879Some sections hold a table of fixed-sized entries, such as a symbol table. 880For such a section, this member gives the size in bytes for each entry. 881This member contains zero if the section does not hold a table of 882fixed-size entries. 883.El 884.Pp 885Various sections hold program and control information: 886.Bl -tag -width ".shstrtab" 887.It .SUNW_ctf 888This section contains the (un)compressed Compact C-Type Format data 889describing the object's types and symbols. 890This section is of type 891.Dv SHT_PROGBITS . 892.It .bss 893This section holds uninitialized data that contribute to the program's 894memory image. 895By definition, the system initializes the data with zeros 896when the program begins to run. 897This section is of type 898.Dv SHT_NOBITS . 899The attribute types are 900.Dv SHF_ALLOC 901and 902.Dv SHF_WRITE . 903.It .comment 904This section holds version control information. 905This section is of type 906.Dv SHT_PROGBITS . 907No attribute types are used. 908.It .ctors 909This section holds initialized pointers to the C++ constructor functions. 910This section is of type 911.Dv SHT_PROGBITS . 912The attribute types are 913.Dv SHF_ALLOC 914and 915.Dv SHF_WRITE . 916.It .data 917This section holds initialized data that contribute to the program's 918memory image. 919This section is of type 920.Dv SHT_PROGBITS . 921The attribute types are 922.Dv SHF_ALLOC 923and 924.Dv SHF_WRITE . 925.It .data1 926This section holds initialized data that contribute to the program's 927memory image. 928This section is of type 929.Dv SHT_PROGBITS . 930The attribute types are 931.Dv SHF_ALLOC 932and 933.Dv SHF_WRITE . 934.It .debug 935This section holds information for symbolic debugging. 936The contents 937are unspecified. 938This section is of type 939.Dv SHT_PROGBITS . 940No attribute types are used. 941.It .dtors 942This section holds initialized pointers to the C++ destructor functions. 943This section is of type 944.Dv SHT_PROGBITS . 945The attribute types are 946.Dv SHF_ALLOC 947and 948.Dv SHF_WRITE . 949.It .dynamic 950This section holds dynamic linking information. 951The section's attributes 952will include the 953.Dv SHF_ALLOC 954bit. 955Whether the 956.Dv SHF_WRITE 957bit is set is processor-specific. 958This section is of type 959.Dv SHT_DYNAMIC . 960See the attributes above. 961.It .dynstr 962This section holds strings needed for dynamic linking, most commonly 963the strings that represent the names associated with symbol table entries. 964This section is of type 965.Dv SHT_STRTAB . 966The attribute type used is 967.Dv SHF_ALLOC . 968.It .dynsym 969This section holds the dynamic linking symbol table. 970This section is of type 971.Dv SHT_DYNSYM . 972The attribute used is 973.Dv SHF_ALLOC . 974.It .fini 975This section holds executable instructions that contribute to the process 976termination code. 977When a program exits normally, the system arranges to 978execute the code in this section. 979This section is of type 980.Dv SHT_PROGBITS . 981The attributes used are 982.Dv SHF_ALLOC 983and 984.Dv SHF_EXECINSTR . 985.It .got 986This section holds the global offset table. 987This section is of type 988.Dv SHT_PROGBITS . 989The attributes are processor-specific. 990.It .hash 991This section holds a symbol hash table. 992This section is of type 993.Dv SHT_HASH . 994The attribute used is 995.Dv SHF_ALLOC . 996.It .init 997This section holds executable instructions that contribute to the process 998initialization code. 999When a program starts to run, the system arranges to 1000execute the code in this section before calling the main program entry point. 1001This section is of type 1002.Dv SHT_PROGBITS . 1003The attributes used are 1004.Dv SHF_ALLOC 1005and 1006.Dv SHF_EXECINSTR . 1007.It .interp 1008This section holds the pathname of a program interpreter. 1009If the file has 1010a loadable segment that includes the section, the section's attributes will 1011include the 1012.Dv SHF_ALLOC 1013bit. 1014Otherwise, that bit will be off. 1015This section is of type 1016.Dv SHT_PROGBITS . 1017.It .line 1018This section holds line number information for symbolic debugging, which 1019describes the correspondence between the program source and the machine code. 1020The contents are unspecified. 1021This section is of type 1022.Dv SHT_PROGBITS . 1023No attribute types are used. 1024.It .note 1025This section holds information in the 1026note section 1027format described below. 1028This section is of type 1029.Dv SHT_NOTE . 1030No attribute types are used. 1031.Ox 1032native executables contain a 1033.Sy .note.openbsd.ident 1034section to identify themselves. 1035.It .plt 1036This section holds the procedure linkage table. 1037This section is of type 1038.Dv SHT_PROGBITS . 1039The attributes are processor-specific. 1040.It .relNAME 1041This section holds relocation information as described below. 1042If the file 1043has a loadable segment that includes relocation, the section's attributes 1044will include the 1045.Dv SHF_ALLOC 1046bit. 1047Otherwise the bit will be off. 1048By convention, 1049.Dq NAME 1050is supplied by the section to which the relocations apply. 1051Thus a relocation 1052section for 1053.Sy .text 1054normally would have the name 1055.Sy .rel.text . 1056This section is of type 1057.Dv SHT_REL . 1058.It .relaNAME 1059This section holds relocation information as described below. 1060If the file 1061has a loadable segment that includes relocation, the section's attributes 1062will include the 1063.Dv SHF_ALLOC 1064bit. 1065Otherwise the bit will be off. 1066By convention, 1067.Dq NAME 1068is supplied by the section to which the relocations apply. 1069Thus a relocation 1070section for 1071.Sy .text 1072normally would have the name 1073.Sy .rela.text . 1074This section is of type 1075.Dv SHT_RELA . 1076.It .rodata 1077This section holds read-only data that typically contribute to a 1078non-writable segment in the process image. 1079This section is of type 1080.Dv SHT_PROGBITS . 1081The attribute used is 1082.Dv SHF_ALLOC . 1083.It .rodata1 1084This section holds read-only data that typically contribute to a 1085non-writable segment in the process image. 1086This section is of type 1087.Dv SHT_PROGBITS . 1088The attribute used is 1089.Dv SHF_ALLOC . 1090.It .shstrtab 1091This section holds section names. 1092This section is of type 1093.Dv SHT_STRTAB . 1094No attribute types are used. 1095.It .strtab 1096This section holds strings, most commonly the strings that represent the 1097names associated with symbol table entries. 1098If the file has a loadable 1099segment that includes the symbol string table, the section's attributes 1100will include the 1101.Dv SHF_ALLOC 1102bit. 1103Otherwise the bit will be off. 1104This section is of type 1105.Dv SHT_STRTAB . 1106.It .symtab 1107This section holds a symbol table. 1108If the file has a loadable segment 1109that includes the symbol table, the section's attributes will include 1110the 1111.Dv SHF_ALLOC 1112bit. 1113Otherwise the bit will be off. 1114This section is of type 1115.Dv SHT_SYMTAB . 1116.It .tbss 1117This section is the thread-local storage version of 1118.Sy .bss , 1119holding uninitialized data that contribute to the program's memory 1120image on a per-thread basis. 1121By definition, the system allocates and initializes the data with 1122zeros for each thread before it first accesses it. 1123This section is of type 1124.Dv SHT_NOBITS . 1125The attribute types are 1126.Dv SHF_ALLOC , 1127.Dv SHF_WRITE , 1128and 1129.Dv SHF_TLS . 1130.It .tdata 1131This section is the thread-local storage version of 1132.Sy .data , 1133holding initialized data that contribute to the program's memory 1134image on a per-thread basis. 1135The system allocates and initializes the data for each thread before 1136it first accesses it. 1137This section is of type 1138.Dv SHT_PROGBITS . 1139The attribute types are 1140.Dv SHF_ALLOC , 1141.Dv SHF_WRITE , 1142and 1143.Dv SHF_TLS . 1144.It .text 1145This section holds the 1146.Dq text , 1147or executable instructions, of a program. 1148This section is of type 1149.Dv SHT_PROGBITS . 1150The attributes used are 1151.Dv SHF_ALLOC 1152and 1153.Dv SHF_EXECINSTR . 1154.El 1155.Pp 1156String table sections hold null-terminated character sequences, commonly 1157called strings. 1158The object file uses these strings to represent symbol 1159and section names. 1160One references a string as an index into the string 1161table section. 1162The first byte, which is index zero, is defined to hold 1163a null character. 1164Similarly, a string table's last byte is defined to 1165hold a null character, ensuring null termination for all strings. 1166.Pp 1167An object file's symbol table holds information needed to locate and 1168relocate a program's symbolic definitions and references. 1169A symbol table 1170index is a subscript into this array. 1171.Bd -literal -offset indent 1172typedef struct { 1173 Elf32_Word st_name; 1174 Elf32_Addr st_value; 1175 Elf32_Word st_size; 1176 unsigned char st_info; 1177 unsigned char st_other; 1178 Elf32_Half st_shndx; 1179} Elf32_Sym; 1180.Ed 1181.Bd -literal -offset indent 1182typedef struct { 1183 Elf64_Word st_name; 1184 unsigned char st_info; 1185 unsigned char st_other; 1186 Elf64_Half st_shndx; 1187 Elf64_Addr st_value; 1188 Elf64_Xword st_size; 1189} Elf64_Sym; 1190.Ed 1191.Bl -tag -width "st_value" 1192.It Dv st_name 1193This member holds an index into the object file's symbol string table, 1194which holds character representations of the symbol names. 1195If the value 1196is non-zero, it represents a string table index that gives the symbol 1197name. 1198Otherwise, the symbol table has no name. 1199.It Dv st_value 1200This member gives the value of the associated symbol. 1201.It Dv st_size 1202Many symbols have associated sizes. 1203This member holds zero if the symbol 1204has no size or an unknown size. 1205.It Dv st_info 1206This member specifies the symbol's type and binding attributes: 1207.Bl -tag -width "STT_SECTION" 1208.It Dv STT_NOTYPE 1209The symbol's type is not defined. 1210.It Dv STT_OBJECT 1211The symbol is associated with a data object. 1212.It Dv STT_FUNC 1213The symbol is associated with a function or other executable code. 1214.It Dv STT_SECTION 1215The symbol is associated with a section. 1216Symbol table entries of 1217this type exist primarily for relocation and normally have 1218.Dv STB_LOCAL 1219bindings. 1220.It Dv STT_FILE 1221By convention, the symbol's name gives the name of the source file 1222associated with the object file. 1223A file symbol has 1224.Dv STB_LOCAL 1225bindings, its section index is 1226.Dv SHN_ABS , 1227and it precedes the other 1228.Dv STB_LOCAL 1229symbols of the file, if it is present. 1230.It Dv STT_TLS 1231The symbol is associated with an object in thread-local storage. 1232The symbol's value is its offset in the TLS storage for this file. 1233.It Dv STT_LOPROC 1234This value up to and including 1235.Dv STT_HIPROC 1236is reserved for processor-specific semantics. 1237.It Dv STT_HIPROC 1238This value down to and including 1239.Dv STT_LOPROC 1240is reserved for processor-specific semantics. 1241.El 1242.Bl -tag -width "STB_GLOBAL" 1243.It Dv STB_LOCAL 1244Local symbols are not visible outside the object file containing their 1245definition. 1246Local symbols of the same name may exist in multiple files 1247without interfering with each other. 1248.It Dv STB_GLOBAL 1249Global symbols are visible to all object files being combined. 1250One file's 1251definition of a global symbol will satisfy another file's undefined 1252reference to the same symbol. 1253.It Dv STB_WEAK 1254Weak symbols resemble global symbols, but their definitions have lower 1255precedence. 1256.It Dv STB_LOPROC 1257This value up to and including 1258.Dv STB_HIPROC 1259is reserved for processor-specific semantics. 1260.It Dv STB_HIPROC 1261This value down to and including 1262.Dv STB_LOPROC 1263is reserved for processor-specific semantics. 1264.Pp 1265There are macros for packing and unpacking the binding and type fields: 1266.Pp 1267.Bl -tag -width "ELF32_ST_INFO(bind, type)" -compact 1268.It Xo 1269.Fn ELF32_ST_BIND info 1270.Xc 1271or 1272.Fn ELF64_ST_BIND info 1273extract a binding from an st_info value. 1274.It Xo 1275.Fn ELF64_ST_TYPE info 1276.Xc 1277or 1278.Fn ELF32_ST_TYPE info 1279extract a type from an st_info value. 1280.It Xo 1281.Fn ELF32_ST_INFO bind type 1282.Xc 1283or 1284.Fn ELF64_ST_INFO bind type 1285convert a binding and a type into an st_info value. 1286.El 1287.El 1288.It Dv st_other 1289This member currently holds zero and has no defined meaning. 1290.It Dv st_shndx 1291Every symbol table entry is 1292.Dq defined 1293in relation to some section. 1294This member holds the relevant section 1295header table index. 1296.El 1297.Pp 1298Relocation is the process of connecting symbolic references with 1299symbolic definitions. 1300Relocatable files must have information that 1301describes how to modify their section contents, thus allowing executable 1302and shared object files to hold the right information for a process' 1303program image. 1304Relocation entries are these data. 1305.Pp 1306Relocation structures that do not need an addend: 1307.Bd -literal -offset indent 1308typedef struct { 1309 Elf32_Addr r_offset; 1310 Elf32_Word r_info; 1311} Elf32_Rel; 1312.Ed 1313.Bd -literal -offset indent 1314typedef struct { 1315 Elf64_Addr r_offset; 1316 Elf64_Xword r_info; 1317} Elf64_Rel; 1318.Ed 1319.Pp 1320Relocation structures that need an addend: 1321.Bd -literal -offset indent 1322typedef struct { 1323 Elf32_Addr r_offset; 1324 Elf32_Word r_info; 1325 Elf32_Sword r_addend; 1326} Elf32_Rela; 1327.Ed 1328.Bd -literal -offset indent 1329typedef struct { 1330 Elf64_Addr r_offset; 1331 Elf64_Xword r_info; 1332 Elf64_Sxword r_addend; 1333} Elf64_Rela; 1334.Ed 1335.Bl -tag -width "r_offset" 1336.It Dv r_offset 1337This member gives the location at which to apply the relocation action. 1338For a relocatable file, the value is the byte offset from the beginning 1339of the section to the storage unit affected by the relocation. 1340For an 1341executable file or shared object, the value is the virtual address of 1342the storage unit affected by the relocation. 1343.It Dv r_info 1344This member gives both the symbol table index with respect to which the 1345relocation must be made and the type of relocation to apply. 1346Relocation 1347types are processor-specific. 1348When the text refers to a relocation 1349entry's relocation type or symbol table index, it means the result of 1350applying 1351.Dv ELF[32|64]_R_TYPE 1352or 1353.Dv ELF[32|64]_R_SYM , 1354respectively, to the entry's 1355.Sy r_info 1356member. 1357.It Dv r_addend 1358This member specifies a constant addend used to compute the value to be 1359stored into the relocatable field. 1360.El 1361.Pp 1362The note section is used to hold vendor-specific information that 1363may be used to help identify a binary's ABI. 1364It should start with an Elf_Note struct, 1365followed by the section name and the section description. 1366The actual note contents follow thereafter. 1367.Bd -literal -offset indent 1368typedef struct { 1369 Elf32_Word namesz; 1370 Elf32_Word descsz; 1371 Elf32_Word type; 1372} Elf32_Note; 1373 1374typedef struct { 1375 Elf64_Word namesz; 1376 Elf64_Word descsz; 1377 Elf64_Word type; 1378} Elf64_Note; 1379.Ed 1380.Bl -tag -width "r_offset" 1381.It Dv namesz 1382Length of the note name, rounded up to a 4-byte boundary. 1383.It Dv descsz 1384Length of the note description, rounded up to a 4-byte boundary. 1385.It Dv type 1386A vendor-specific note type. 1387.El 1388.Pp 1389The name and description strings follow the note structure. 1390Each string is aligned on a 4-byte boundary. 1391.Sh SEE ALSO 1392.Xr as 1 , 1393.Xr gdb 1 , 1394.Xr ld 1 , 1395.Xr objdump 1 , 1396.Xr execve 2 , 1397.Xr core 5 1398.Rs 1399.%A Hewlett-Packard 1400.%B Elf-64 Object File Format 1401.Re 1402.Rs 1403.%A Santa Cruz Operation 1404.%B System V Application Binary Interface 1405.Re 1406.Rs 1407.%A Unix System Laboratories 1408.%T Object Files 1409.%B "Executable and Linking Format (ELF)" 1410.Re 1411.Sh HISTORY 1412.Ox 1413ELF support first appeared in 1414.Ox 1.2 . 1415Starting with 1416.Ox 5.4 , 1417all supported platforms use it as the native binary file format. 1418ELF in itself first appeared in 1419.At V . 1420The ELF format is an adopted standard. 1421.Sh AUTHORS 1422This manual page was written by 1423.An Jeroen Ruigrok van der Werven Aq Mt asmodai@FreeBSD.org 1424with inspiration from BSDi's 1425.Bsx 1426.Nm elf 1427manpage. 1428