1.\" $OpenBSD: elf.5,v 1.19 2010/07/15 18:15:31 jmc Exp $ 2.\"Copyright (c) 1999 Jeroen Ruigrok van der Werven 3.\"All rights reserved. 4.\" 5.\"Redistribution and use in source and binary forms, with or without 6.\"modification, are permitted provided that the following conditions 7.\"are met: 8.\"1. Redistributions of source code must retain the above copyright 9.\" notice, this list of conditions and the following disclaimer. 10.\"2. Redistributions in binary form must reproduce the above copyright 11.\" notice, this list of conditions and the following disclaimer in the 12.\" documentation and/or other materials provided with the distribution. 13.\" 14.\"THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15.\"ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16.\"IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17.\"ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18.\"FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19.\"DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20.\"OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21.\"HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22.\"LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23.\"OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24.\"SUCH DAMAGE. 25.\" 26.\" $FreeBSD: src/share/man/man5/elf.5,v 1.21 2001/10/01 16:09:23 ru Exp $ 27.\" 28.Dd $Mdocdate: July 15 2010 $ 29.Dt ELF 5 30.Os 31.Sh NAME 32.Nm elf 33.Nd format of ELF executable binary files 34.Sh SYNOPSIS 35.Fd #include <elf_abi.h> 36.Sh DESCRIPTION 37The header file 38.Aq Pa elf_abi.h 39defines the format of ELF executable binary files. 40Amongst these files are 41normal executable files, relocatable object files, core files and shared 42libraries. 43.Pp 44An executable file using the ELF file format consists of an ELF header, 45followed by a program header table or a section header table, or both. 46The ELF header is always at offset zero of the file. 47The program header 48table and the section header table's offset in the file are defined in the 49ELF header. 50The two tables describe the rest of the particularities of 51the file. 52.Pp 53Applications which wish to process ELF binary files for their native 54architecture only should include 55.Aq Pa elf_abi.h 56in their source code. 57These applications should need to refer to 58all the types and structures by their generic names 59.Dq Elf_xxx 60and to the macros by 61.Dq ELF_xxx . 62Applications written this way can be compiled on any architecture, 63regardless of whether the host is 32-bit or 64-bit. 64.Pp 65Should an application need to process ELF files of an unknown 66architecture, then the application needs to explicitly use either 67.Dq Elf32_xxx 68or 69.Dq Elf64_xxx 70type and structure names. 71Likewise, the macros need to be identified by 72.Dq ELF32_xxx 73or 74.Dq ELF64_xxx . 75.Pp 76This header file describes the above mentioned headers as C structures 77and also includes structures for dynamic sections, relocation sections and 78symbol tables. 79.Pp 80The following types are used for 32-bit architectures: 81.Bd -literal -offset indent 82Elf32_Addr Unsigned program address 83Elf32_Off Unsigned file offset 84Elf32_Sword Signed large integer 85Elf32_Word Unsigned large integer 86Elf32_Half Unsigned medium integer 87.Ed 88.Pp 89And the following types are used for 64-bit architectures: 90.Bd -literal -offset indent 91Elf64_Addr Unsigned program address 92Elf64_Off Unsigned file offset 93Elf64_Shalf Signed halfword field 94Elf64_Sword Signed large integer 95Elf64_Word Field or unsigned large integer 96Elf64_Sxword Signed object size or alignment 97Elf64_Xword Unsigned object size or alignment 98Elf64_Half Unsigned halfword field 99Elf64_Quarter Unsigned quarterword field 100.Ed 101.Pp 102All data structures that the file format defines follow the 103.Dq natural 104size and alignment guidelines for the relevant class. 105If necessary, 106data structures contain explicit padding to ensure 4-byte alignment 107for 4-byte objects, to force structure sizes to a multiple of 4, etc. 108.Pp 109The ELF header is described by the type Elf32_Ehdr or Elf64_Ehdr: 110.Bd -literal -offset indent 111typedef struct { 112 unsigned char e_ident[EI_NIDENT]; 113 Elf32_Half e_type; 114 Elf32_Half e_machine; 115 Elf32_Word e_version; 116 Elf32_Addr e_entry; 117 Elf32_Off e_phoff; 118 Elf32_Off e_shoff; 119 Elf32_Word e_flags; 120 Elf32_Half e_ehsize; 121 Elf32_Half e_phentsize; 122 Elf32_Half e_phnum; 123 Elf32_Half e_shentsize; 124 Elf32_Half e_shnum; 125 Elf32_Half e_shstrndx; 126} Elf32_Ehdr; 127.Ed 128.Bd -literal -offset indent 129typedef struct { 130 unsigned char e_ident[EI_NIDENT]; 131 Elf64_Quarter e_type; 132 Elf64_Quarter e_machine; 133 Elf64_Half e_version; 134 Elf64_Addr e_entry; 135 Elf64_Off e_phoff; 136 Elf64_Off e_shoff; 137 Elf64_Half e_flags; 138 Elf64_Quarter e_ehsize; 139 Elf64_Quarter e_phentsize; 140 Elf64_Quarter e_phnum; 141 Elf64_Quarter e_shentsize; 142 Elf64_Quarter e_shnum; 143 Elf64_Quarter e_shstrndx; 144} Elf64_Ehdr; 145.Ed 146.Pp 147The fields have the following meanings: 148.Bl -tag -width "e_phentsize" -offset indent 149.It Dv e_ident 150This array of bytes specifies to interpret the file, 151independent of the processor or the file's remaining contents. 152Within this array everything is named by macros, which start with 153the prefix 154.Sy EI_ 155and may contain values which start with the prefix 156.Sy ELF . 157The following macros are defined: 158.Bl -tag -width "EI_VERSION" 159.It Dv EI_MAG0 160The first byte of the magic number. 161It must be filled with 162.Sy ELFMAG0 . 163.It Dv EI_MAG1 164The second byte of the magic number. 165It must be filled with 166.Sy ELFMAG1 . 167.It Dv EI_MAG2 168The third byte of the magic number. 169It must be filled with 170.Sy ELFMAG2 . 171.It Dv EI_MAG3 172The fourth byte of the magic number. 173It must be filled with 174.Sy ELFMAG3 . 175.It Dv EI_CLASS 176The fifth byte identifies the architecture for this binary: 177.Pp 178.Bl -tag -width "ELFCLASSNONE" -compact 179.It Dv ELFCLASSNONE 180This class is invalid. 181.It Dv ELFCLASS32 182This defines the 32-bit architecture. 183It supports machines with files 184and virtual address spaces up to 4 Gigabytes. 185.It Dv ELFCLASS64 186This defines the 64-bit architecture. 187.El 188.It Dv EI_DATA 189The sixth byte specifies the data encoding of the processor-specific 190data in the file. 191Currently these encodings are supported: 192.Pp 193.Bl -tag -width "ELFDATA2LSB" -compact 194.It Dv ELFDATANONE 195Unknown data format. 196.It Dv ELFDATA2LSB 197Two's complement, little-endian. 198.It Dv ELFDATA2MSB 199Two's complement, big-endian. 200.El 201.It Dv EI_VERSION 202The version number of the ELF specification: 203.Pp 204.Bl -tag -width "EV_CURRENT" -compact 205.It Dv EV_NONE 206Invalid version. 207.It Dv EV_CURRENT 208Current version. 209.El 210.\" .It Dv EI_OSABI 211.\" This byte identifies the operating system 212.\" and ABI to which the object is targeted. 213.\" Some fields in other ELF structures have flags 214.\" and values that have platform specific meanings; 215.\" the interpretation of those fields is determined by the value of this byte. 216.\" The following values are currently defined: 217.\" .Pp 218.\" .Bl -tag -width "ELFOSABI_STANDALONE" -compact 219.\" .It Dv ELFOSABI_SYSV 220.\" UNIX System V ABI. 221.\" .It Dv ELFOSABI_HPUX 222.\" HP-UX operating system ABI. 223.\" .It Dv ELFOSABI_NETBSD 224.\" .Nx 225.\" operating system ABI. 226.\" .It Dv ELFOSABI_LINUX 227.\" GNU/Linux operating system ABI. 228.\" .It Dv ELFOSABI_HURD 229.\" GNU/Hurd operating system ABI. 230.\" .It Dv ELFOSABI_86OPEN 231.\" 86Open Common IA32 ABI. 232.\" .It Dv ELFOSABI_SOLARIS 233.\" Solaris operating system ABI. 234.\" .It Dv ELFOSABI_MONTEREY 235.\" Monterey project ABI. 236.\" .It Dv ELFOSABI_IRIX 237.\" IRIX operating system ABI. 238.\" .It Dv ELFOSABI_FREEBSD 239.\" .Fx 240.\" operating system ABI. 241.\" .It Dv ELFOSABI_TRU64 242.\" TRU64 UNIX operating system ABI. 243.\" .It Dv ELFOSABI_ARM 244.\" ARM architecture ABI. 245.\" .It Dv ELFOSABI_STANDALONE 246.\" Stand-alone (embedded) ABI. 247.\" .El 248.\" .It Dv EI_ABIVERSION 249.\" This byte identifies the version of the ABI 250.\" to which the object is targeted. 251.\" This field is used to distinguish among incompatible versions of an ABI. 252.\" The interpretation of this version number 253.\" is dependent on the ABI identified by the EI_OSABI field. 254.\" Applications conforming to this specification use the value 0. 255.It Dv EI_PAD 256Start of padding. 257These bytes are reserved and set to zero. 258Programs 259which read them should ignore them. 260The value for EI_PAD will change in 261the future if currently unused bytes are given meanings. 262.It Dv EI_BRAND 263Start of architecture identification. 264.It Dv EI_NIDENT 265The size of the e_ident array. 266.El 267.Pp 268.It Dv e_type 269This member of the structure identifies the object file type: 270.Pp 271.Bl -tag -width "ET_NONE" -compact 272.It Dv ET_NONE 273An unknown type. 274.It Dv ET_REL 275A relocatable file. 276.It Dv ET_EXEC 277An executable file. 278.It Dv ET_DYN 279A shared object. 280.It Dv ET_CORE 281A core file. 282.El 283.Pp 284.It Dv e_machine 285This member specifies the required architecture for an individual file: 286.Pp 287.Bl -tag -width "EM_MIPS_RS4_BE" -compact 288.It Dv EM_NONE 289An unknown machine. 290.It Dv EM_M32 291AT&T WE 32100. 292.It Dv EM_SPARC 293Sun Microsystems SPARC. 294.It Dv EM_386 295Intel 80386. 296.It Dv EM_68K 297Motorola 68000. 298.It Dv EM_88K 299Motorola 88000. 300.It Dv EM_486 301Intel 80486. 302.It Dv EM_860 303Intel 80860. 304.It Dv EM_MIPS 305MIPS RS3000 (big-endian only). 306.It Dv EM_MIPS_RS4_BE 307MIPS RS4000 (big-endian only). 308.It Dv EM_SPARC64 309SPARC v9 64-bit (unofficial). 310.It Dv EM_PARISC 311HPPA. 312.It Dv EM_SPARC32PLUS 313SPARC with enhanced instruction set. 314.It Dv EM_PPC 315PowerPC. 316.It Dv EM_ALPHA 317Compaq [DEC] Alpha. 318.It Dv EM_SPARCV9 319SPARC v9 64-bit. 320.It Dv EM_ALPHA_EXP 321Compaq [DEC] Alpha with enhanced instruction set. 322.It Dv EM_VAX 323DEC Vax. 324.El 325.Pp 326.It Dv e_version 327This member identifies the file version: 328.Pp 329.Bl -tag -width "EV_CURRENT" -compact 330.It Dv EV_NONE 331Invalid version. 332.It Dv EV_CURRENT 333Current version. 334.El 335.It Dv e_entry 336This member gives the virtual address to which the system first transfers 337control, thus starting the process. 338If the file has no associated entry 339point, this member holds zero. 340.It Dv e_phoff 341This member holds the program header table's file offset in bytes. 342If 343the file has no program header table, this member holds zero. 344.It Dv e_shoff 345This member holds the section header table's file offset in bytes. 346If the 347file has no section header table this member holds zero. 348.It Dv e_flags 349This member holds processor-specific flags associated with the file. 350Flag names take the form EF_`machine_flag'. 351Currently no flags have been defined. 352.It Dv e_ehsize 353This member holds the ELF header's size in bytes. 354.It Dv e_phentsize 355This member holds the size in bytes of one entry in the file's program header 356table; all entries are the same size. 357.It Dv e_phnum 358This member holds the number of entries in the program header 359table. 360Thus the product of 361.Sy e_phentsize 362and 363.Sy e_phnum 364gives the table's size 365in bytes. 366If a file has no program header, 367.Sy e_phnum 368holds the value zero. 369.It Dv e_shentsize 370This member holds a sections header's size in bytes. 371A section header is one 372entry in the section header table; all entries are the same size. 373.It Dv e_shnum 374This member holds the number of entries in the section header table. 375Thus 376the product of 377.Sy e_shentsize 378and 379.Sy e_shnum 380gives the section header table's size in bytes. 381If a file has no section 382header table, 383.Sy e_shnum 384holds the value of zero. 385.It Dv e_shstrndx 386This member holds the section header table index of the entry associated 387with the section name string table. 388If the file has no section name string 389table, this member holds the value 390.Sy SHN_UNDEF . 391.El 392.Pp 393An executable or shared object file's program header table is an array of 394structures, each describing a segment or other information the system needs 395to prepare the program for execution. 396An object file 397.Em segment 398contains one or more 399.Em sections . 400Program headers are meaningful only for executable and shared object files. 401A file specifies its own program header size with the ELF header's 402.Sy e_phentsize 403and 404.Sy e_phnum 405members. 406As with the ELF executable header, the program header 407also has different versions depending on the architecture: 408.Bd -literal -offset indent 409typedef struct { 410 Elf32_Word p_type; 411 Elf32_Off p_offset; 412 Elf32_Addr p_vaddr; 413 Elf32_Addr p_paddr; 414 Elf32_Word p_filesz; 415 Elf32_Word p_memsz; 416 Elf32_Word p_flags; 417 Elf32_Word p_align; 418} Elf32_Phdr; 419.Ed 420.Bd -literal -offset indent 421typedef struct { 422 Elf64_Half p_type; 423 Elf64_Half p_flags; 424 Elf64_Off p_offset; 425 Elf64_Addr p_vaddr; 426 Elf64_Addr p_paddr; 427 Elf64_Xword p_filesz; 428 Elf64_Xword p_memsz; 429 Elf64_Xword p_align; 430} Elf64_Phdr; 431.Ed 432.Pp 433The main difference between the 32-bit and the 64-bit program header lies 434only in the location of a 435.Sy p_flags 436member in the total struct. 437.Bl -tag -width "p_offset" -offset indent 438.It Dv p_type 439This member of the Phdr struct tells what kind of segment this array 440element describes or how to interpret the array element's information. 441.Bl -tag -width "PT_DYNAMIC" 442.It Dv PT_NULL 443The array element is unused and the other members' values are undefined. 444This lets the program header have ignored entries. 445.It Dv PT_LOAD 446The array element specifies a loadable segment, described by 447.Sy p_filesz 448and 449.Sy p_memsz . 450The bytes from the file are mapped to the beginning of the memory 451segment. 452If the segment's memory size 453.Pq Sy p_memsz 454is larger than the file size 455.Pq Sy p_filesz , 456the 457.Dq extra 458bytes are defined to hold the value 0 and to follow the segment's 459initialized area. 460The file size may not be larger than the memory size. 461Loadable segment entries in the program header table appear in ascending 462order, sorted on the 463.Sy p_vaddr 464member. 465.It Dv PT_DYNAMIC 466The array element specifies dynamic linking information. 467.It Dv PT_INTERP 468The array element specifies the location and size of a null-terminated 469path name to invoke as an interpreter. 470This segment type is meaningful 471only for executable files (though it may occur for shared objects). 472However it may not occur more than once in a file. 473If it is present, it must precede any loadable segment entry. 474.It Dv PT_NOTE 475The array element specifies the location and size for auxiliary information. 476.It Dv PT_SHLIB 477This segment type is reserved but has unspecified semantics. 478Programs that 479contain an array element of this type do not conform to the ABI. 480.It Dv PT_PHDR 481The array element, if present, specifies the location and size of the program 482header table itself, both in the file and in the memory image of the program. 483This segment type may not occur more than once in a file. 484Moreover, it may 485only occur if the program header table is part of the memory image of the 486program. 487If it is present, it must precede any loadable segment entry. 488.It Dv PT_TLS 489The array element, if present, specifies the location and size of the 490thread-local storage for this file. 491Each thread in a process loading this file will have the segment's 492memory size 493.Pq Sy p_memsz 494allocated for it, where the bytes up to the segment's file size 495.Pq Sy p_filesz 496will be initialized with the data in this segment and the remaining 497.Dq extra 498bytes will be set to zero. 499.It Dv PT_LOOS 500This value up to and including 501.Sy PT_HIOS 502is reserverd for operating system-specific semantics. 503.It Dv PT_HIOS 504This value down to and including 505.Sy PT_LOOS 506is reserved for operating system-specific semantics. 507.It Dv PT_LOPROC 508This value up to and including 509.Sy PT_HIPROC 510is reserved for processor-specific semantics. 511.It Dv PT_HIPROC 512This value down to and including 513.Sy PT_LOPROC 514is reserved for processor-specific semantics. 515.El 516.Pp 517.It Dv p_offset 518This member holds the offset from the beginning of the file at which 519the first byte of the segment resides. 520.It Dv p_vaddr 521This member holds the virtual address at which the first byte of the 522segment resides in memory. 523.It Dv p_paddr 524On systems for which physical addressing is relevant, this member is 525reserved for the segment's physical address. 526Under 527.Bx 528this member is 529not used and must be zero. 530.It Dv p_filesz 531This member holds the number of bytes in the file image of the segment. 532It may be zero. 533.It Dv p_memsz 534This member holds the number of bytes in the memory image of the segment. 535It may be zero. 536.It Dv p_flags 537This member holds flags relevant to the segment: 538.Pp 539.Bl -tag -width "PF_X" -compact 540.It Dv PF_X 541An executable segment. 542.It Dv PF_W 543A writable segment. 544.It Dv PF_R 545A readable segment. 546.El 547.Pp 548A text segment commonly has the flags 549.Sy PF_X 550and 551.Sy PF_R . 552A data segment commonly has 553.Sy PF_X , 554.Sy PF_W 555and 556.Sy PF_R . 557.It Dv p_align 558This member holds the value to which the segments are aligned in memory 559and in the file. 560Loadable process segments must have congruent values for 561.Sy p_vaddr 562and 563.Sy p_offset , 564modulo the page size. 565Values of zero and one mean no alignment is required. 566Otherwise, 567.Sy p_align 568should be a positive, integral power of two, and 569.Sy p_vaddr 570should equal 571.Sy p_offset , 572modulo 573.Sy p_align . 574.El 575.Pp 576A file's section header table lets one locate all the file's sections. 577The 578section header table is an array of Elf32_Shdr or Elf64_Shdr structures. 579The 580ELF header's 581.Sy e_shoff 582member gives the byte offset from the beginning of the file to the section 583header table. 584.Sy e_shnum 585holds the number of entries the section header table contains. 586.Sy e_shentsize 587holds the size in bytes of each entry. 588.Pp 589A section header table index is a subscript into this array. 590Some section 591header table indices are reserved. 592An object file does not have sections for 593these special indices: 594.Bl -tag -width "SHN_LORESERVE" 595.It Dv SHN_UNDEF 596This value marks an undefined, missing, irrelevant or otherwise meaningless 597section reference. 598For example, a symbol 599.Dq defined 600relative to section number 601.Sy SHN_UNDEF 602is an undefined symbol. 603.It Dv SHN_LORESERVE 604This value specifies the lower bound of the range of reserved indices. 605.It Dv SHN_LOPROC 606This value up to and including 607.Sy SHN_HIPROC 608is reserved for processor-specific semantics. 609.It Dv SHN_HIPROC 610This value down to and including 611.Sy SHN_LOPROC 612is reserved for processor-specific semantics. 613.It Dv SHN_ABS 614This value specifies the absolute value for the corresponding reference. 615For 616example, a symbol defined relative to section number 617.Sy SHN_ABS 618has an absolute value and is not affected by relocation. 619.It Dv SHN_COMMON 620Symbols defined relative to this section are common symbols, such as FORTRAN 621COMMON or unallocated C external variables. 622.It Dv SHN_HIRESERVE 623This value specifies the upper bound of the range of reserved indices. 624The 625system reserves indices between 626.Sy SHN_LORESERVE 627and 628.Sy SHN_HIRESERVE , 629inclusive. 630The section header table does not contain entries for the 631reserved indices. 632.El 633.Pp 634The section header has the following structure: 635.Bd -literal -offset indent 636typedef struct { 637 Elf32_Word sh_name; 638 Elf32_Word sh_type; 639 Elf32_Word sh_flags; 640 Elf32_Addr sh_addr; 641 Elf32_Off sh_offset; 642 Elf32_Word sh_size; 643 Elf32_Word sh_link; 644 Elf32_Word sh_info; 645 Elf32_Word sh_addralign; 646 Elf32_Word sh_entsize; 647} Elf32_Shdr; 648.Ed 649.Bd -literal -offset indent 650typedef struct { 651 Elf64_Half sh_name; 652 Elf64_Half sh_type; 653 Elf64_Xword sh_flags; 654 Elf64_Addr sh_addr; 655 Elf64_Off sh_offset; 656 Elf64_Xword sh_size; 657 Elf64_Half sh_link; 658 Elf64_Half sh_info; 659 Elf64_Xword sh_addralign; 660 Elf64_Xword sh_entsize; 661} Elf64_Shdr; 662.Ed 663.Bl -tag -width "sh_addralign" 664.It Dv sh_name 665This member specifies the name of the section. 666Its value is an index 667into the section header string table section, giving the location of 668a null-terminated string. 669.It Dv sh_type 670This member categorizes the section's contents and semantics. 671.Bl -tag -width "SHT_PROGBITS" 672.It Dv SHT_NULL 673This value marks the section header as inactive. 674It does not 675have an associated section. 676Other members of the section header 677have undefined values. 678.It Dv SHT_PROGBITS 679This section holds information defined by the program, whose 680format and meaning are determined solely by the program. 681.It Dv SHT_SYMTAB 682This section holds a symbol table. 683Typically, 684.Sy SHT_SYMTAB 685provides symbols for link editing, though it may also be used 686for dynamic linking. 687As a complete symbol table, it may contain 688many symbols unnecessary for dynamic linking. 689An object file can 690also contain a 691.Sy SHT_DYNSYM 692section. 693.It Dv SHT_STRTAB 694This section holds a string table. 695An object file may have multiple 696string table sections. 697.It Dv SHT_RELA 698This section holds relocation entries with explicit addends, such 699as type 700.Sy Elf32_Rela 701for the 32-bit class of object files. 702An object may have multiple 703relocation sections. 704.It Dv SHT_HASH 705This section holds a symbol hash table. 706An object participating in 707dynamic linking must contain a symbol hash table. 708An object file may 709have only one hash table. 710.It Dv SHT_DYNAMIC 711This section holds information for dynamic linking. 712An object file may 713have only one dynamic section. 714.It Dv SHT_NOTE 715This section holds information that marks the file in some way. 716.It Dv SHT_NOBITS 717A section of this type occupies no space in the file but otherwise 718resembles 719.Sy SHT_PROGBITS . 720Although this section contains no bytes, the 721.Sy sh_offset 722member contains the conceptual file offset. 723.It Dv SHT_REL 724This section holds relocation offsets without explicit addends, such 725as type 726.Sy Elf32_Rel 727for the 32-bit class of object files. 728An object file may have multiple 729relocation sections. 730.It Dv SHT_SHLIB 731This section is reserved but has unspecified semantics. 732.It Dv SHT_DYNSYM 733This section holds a minimal set of dynamic linking symbols. 734An 735object file can also contain a 736.Sy SHT_SYMTAB 737section. 738.It Dv SHT_LOPROC 739This value up to and including 740.Sy SHT_HIPROC 741is reserved for processor-specific semantics. 742.It Dv SHT_HIPROC 743This value down to and including 744.Sy SHT_LOPROC 745is reserved for processor-specific semantics. 746.It Dv SHT_LOUSER 747This value specifies the lower bound of the range of indices reserved for 748application programs. 749.It Dv SHT_HIUSER 750This value specifies the upper bound of the range of indices reserved for 751application programs. 752Section types between 753.Sy SHT_LOUSER 754and 755.Sy SHT_HIUSER 756may be used by the application, without conflicting with current or future 757system-defined section types. 758.El 759.Pp 760.It Dv sh_flags 761Sections support one-bit flags that describe miscellaneous attributes. 762If a flag bit is set in 763.Sy sh_flags , 764the attribute is 765.Dq on 766for the section. 767Otherwise, the attribute is 768.Dq off 769or does not apply. 770Undefined attributes are set to zero. 771.Pp 772.Bl -tag -width "SHF_EXECINSTR" -compact 773.It Dv SHF_WRITE 774This section contains data that should be writable during process 775execution. 776.It Dv SHF_ALLOC 777This section occupies memory during process execution. 778Some control 779sections do not reside in the memory image of an object file. 780This 781attribute is off for those sections. 782.It Dv SHF_EXECINSTR 783This section contains executable machine instructions. 784.It Dv SHF_TLS 785This section is for thread-local storage. 786.It Dv SHF_MASKPROC 787All bits included in this mask are reserved for processor-specific 788semantics. 789.El 790.Pp 791.It Dv sh_addr 792If this section appears in the memory image of a process, this member 793holds the address at which the section's first byte should reside. 794Otherwise, the member contains zero. 795.It Dv sh_offset 796This member's value holds the byte offset from the beginning of the file 797to the first byte in the section. 798One section type, 799.Sy SHT_NOBITS , 800occupies no space in the file, and its 801.Sy sh_offset 802member locates the conceptual placement in the file. 803.It Dv sh_size 804This member holds the section's size in bytes. 805Unless the section type 806is 807.Sy SHT_NOBITS , 808the section occupies 809.Sy sh_size 810bytes in the file. 811A section of type 812.Sy SHT_NOBITS 813may have a non-zero size, but it occupies no space in the file. 814.It Dv sh_link 815This member holds a section header table index link, whose interpretation 816depends on the section type. 817.It Dv sh_info 818This member holds extra information, whose interpretation depends on the 819section type. 820.It Dv sh_addralign 821Some sections have address alignment constraints. 822If a section holds a 823doubleword, the system must ensure doubleword alignment for the entire 824section. 825That is, the value of 826.Sy sh_addr 827must be congruent to zero, modulo the value of 828.Sy sh_addralign . 829Only zero and positive integral powers of two are allowed. 830Values of zero 831or one mean the section has no alignment constraints. 832.It Dv sh_entsize 833Some sections hold a table of fixed-sized entries, such as a symbol table. 834For such a section, this member gives the size in bytes for each entry. 835This member contains zero if the section does not hold a table of 836fixed-size entries. 837.El 838.Pp 839Various sections hold program and control information: 840.Bl -tag -width ".shstrtab" 841.It .bss 842This section holds uninitialized data that contribute to the program's 843memory image. 844By definition, the system initializes the data with zeros 845when the program begins to run. 846This section is of type 847.Sy SHT_NOBITS . 848The attribute types are 849.Sy SHF_ALLOC 850and 851.Sy SHF_WRITE . 852.It .comment 853This section holds version control information. 854This section is of type 855.Sy SHT_PROGBITS . 856No attribute types are used. 857.It .ctors 858This section holds initialized pointers to the C++ constructor functions. 859This section is of type 860.Sy SHT_PROGBITS . 861The attribute types are 862.Sy SHF_ALLOC 863and 864.Sy SHF_WRITE . 865.It .data 866This section holds initialized data that contribute to the program's 867memory image. 868This section is of type 869.Sy SHT_PROGBITS . 870The attribute types are 871.Sy SHF_ALLOC 872and 873.Sy SHF_WRITE . 874.It .data1 875This section holds initialized data that contribute to the program's 876memory image. 877This section is of type 878.Sy SHT_PROGBITS . 879The attribute types are 880.Sy SHF_ALLOC 881and 882.Sy SHF_WRITE . 883.It .debug 884This section holds information for symbolic debugging. 885The contents 886are unspecified. 887This section is of type 888.Sy SHT_PROGBITS . 889No attribute types are used. 890.It .dtors 891This section holds initialized pointers to the C++ destructor functions. 892This section is of type 893.Sy SHT_PROGBITS . 894The attribute types are 895.Sy SHF_ALLOC 896and 897.Sy SHF_WRITE . 898.It .dynamic 899This section holds dynamic linking information. 900The section's attributes 901will include the 902.Sy SHF_ALLOC 903bit. 904Whether the 905.Sy SHF_WRITE 906bit is set is processor-specific. 907This section is of type 908.Sy SHT_DYNAMIC . 909See the attributes above. 910.It .dynstr 911This section holds strings needed for dynamic linking, most commonly 912the strings that represent the names associated with symbol table entries. 913This section is of type 914.Sy SHT_STRTAB . 915The attribute type used is 916.Sy SHF_ALLOC . 917.It .dynsym 918This section holds the dynamic linking symbol table. 919This section is of type 920.Sy SHT_DYNSYM . 921The attribute used is 922.Sy SHF_ALLOC . 923.It .fini 924This section holds executable instructions that contribute to the process 925termination code. 926When a program exits normally the system arranges to 927execute the code in this section. 928This section is of type 929.Sy SHT_PROGBITS . 930The attributes used are 931.Sy SHF_ALLOC 932and 933.Sy SHF_EXECINSTR . 934.It .got 935This section holds the global offset table. 936This section is of type 937.Sy SHT_PROGBITS . 938The attributes are processor-specific. 939.It .hash 940This section holds a symbol hash table. 941This section is of type 942.Sy SHT_HASH . 943The attribute used is 944.Sy SHF_ALLOC . 945.It .init 946This section holds executable instructions that contribute to the process 947initialization code. 948When a program starts to run the system arranges to 949execute the code in this section before calling the main program entry point. 950This section is of type 951.Sy SHT_PROGBITS . 952The attributes used are 953.Sy SHF_ALLOC 954and 955.Sy SHF_EXECINSTR . 956.It .interp 957This section holds the pathname of a program interpreter. 958If the file has 959a loadable segment that includes the section, the section's attributes will 960include the 961.Sy SHF_ALLOC 962bit. 963Otherwise, that bit will be off. 964This section is of type 965.Sy SHT_PROGBITS . 966.It .line 967This section holds line number information for symbolic debugging, which 968describes the correspondence between the program source and the machine code. 969The contents are unspecified. 970This section is of type 971.Sy SHT_PROGBITS . 972No attribute types are used. 973.It .note 974This section holds information in the 975note section 976format described below. 977This section is of type 978.Sy SHT_NOTE . 979No attribute types are used. 980.Ox 981native executables usually contain a 982.Sy .note.openbsd.ident 983section to identify themselves, for the kernel to bypass any compatibility 984ELF binary emulation tests when loading the file. 985.It .plt 986This section holds the procedure linkage table. 987This section is of type 988.Sy SHT_PROGBITS . 989The attributes are processor-specific. 990.It .relNAME 991This section holds relocation information as described below. 992If the file 993has a loadable segment that includes relocation, the section's attributes 994will include the 995.Sy SHF_ALLOC 996bit. 997Otherwise the bit will be off. 998By convention, 999.Dq NAME 1000is supplied by the section to which the relocations apply. 1001Thus a relocation 1002section for 1003.Sy .text 1004normally would have the name 1005.Sy .rel.text . 1006This section is of type 1007.Sy SHT_REL . 1008.It .relaNAME 1009This section holds relocation information as described below. 1010If the file 1011has a loadable segment that includes relocation, the section's attributes 1012will include the 1013.Sy SHF_ALLOC 1014bit. 1015Otherwise the bit will be off. 1016By convention, 1017.Dq NAME 1018is supplied by the section to which the relocations apply. 1019Thus a relocation 1020section for 1021.Sy .text 1022normally would have the name 1023.Sy .rela.text . 1024This section is of type 1025.Sy SHT_RELA . 1026.It .rodata 1027This section holds read-only data that typically contribute to a 1028non-writable segment in the process image. 1029This section is of type 1030.Sy SHT_PROGBITS . 1031The attribute used is 1032.Sy SHF_ALLOC . 1033.It .rodata1 1034This section holds read-only data that typically contribute to a 1035non-writable segment in the process image. 1036This section is of type 1037.Sy SHT_PROGBITS . 1038The attribute used is 1039.Sy SHF_ALLOC . 1040.It .shstrtab 1041This section holds section names. 1042This section is of type 1043.Sy SHT_STRTAB . 1044No attribute types are used. 1045.It .strtab 1046This section holds strings, most commonly the strings that represent the 1047names associated with symbol table entries. 1048If the file has a loadable 1049segment that includes the symbol string table, the section's attributes 1050will include the 1051.Sy SHF_ALLOC 1052bit. 1053Otherwise the bit will be off. 1054This section is of type 1055.Sy SHT_STRTAB . 1056.It .symtab 1057This section holds a symbol table. 1058If the file has a loadable segment 1059that includes the symbol table, the section's attributes will include 1060the 1061.Sy SHF_ALLOC 1062bit. 1063Otherwise the bit will be off. 1064This section is of type 1065.Sy SHT_SYMTAB . 1066.It .tbss 1067This section is the thread-local storage version of 1068.Sy .bss , 1069holding uninitialized data that contribute to the program's memory 1070image on a per-thread basis. 1071By definition, the system allocates and initializes the data with 1072zeros for each thread before it first accesses it. 1073This section is of type 1074.Sy SHT_NOBITS . 1075The attribute types are 1076.Sy SHF_ALLOC , 1077.Sy SHF_WRITE , 1078and 1079.Sy SHF_TLS . 1080.It .tdata 1081This section is the thread-local storage version of 1082.Sy .data , 1083holding initialized data that contribute to the program's memory 1084image on a per-thread basis. 1085The system allocates and initializes the data for each thread before 1086it first accesses it. 1087This section is of type 1088.Sy SHT_PROGBITS . 1089The attribute types are 1090.Sy SHF_ALLOC , 1091.Sy SHF_WRITE , 1092and 1093.Sy SHF_TLS . 1094.It .text 1095This section holds the 1096.Dq text , 1097or executable instructions, of a program. 1098This section is of type 1099.Sy SHT_PROGBITS . 1100The attributes used are 1101.Sy SHF_ALLOC 1102and 1103.Sy SHF_EXECINSTR . 1104.El 1105.Pp 1106String table sections hold null-terminated character sequences, commonly 1107called strings. 1108The object file uses these strings to represent symbol 1109and section names. 1110One references a string as an index into the string 1111table section. 1112The first byte, which is index zero, is defined to hold 1113a null character. 1114Similarly, a string table's last byte is defined to 1115hold a null character, ensuring null termination for all strings. 1116.Pp 1117An object file's symbol table holds information needed to locate and 1118relocate a program's symbolic definitions and references. 1119A symbol table 1120index is a subscript into this array. 1121.Bd -literal -offset indent 1122typedef struct { 1123 Elf32_Word st_name; 1124 Elf32_Addr st_value; 1125 Elf32_Word st_size; 1126 unsigned char st_info; 1127 unsigned char st_other; 1128 Elf32_Half st_shndx; 1129} Elf32_Sym; 1130.Ed 1131.Bd -literal -offset indent 1132typedef struct { 1133 Elf64_Half st_name; 1134 Elf_Byte st_info; 1135 Elf_Byte st_other; 1136 Elf64_Quarter st_shndx; 1137 Elf64_Xword st_value; 1138 Elf64_Xword st_size; 1139} Elf64_Sym; 1140.Ed 1141.Bl -tag -width "st_value" 1142.It Dv st_name 1143This member holds an index into the object file's symbol string table, 1144which holds character representations of the symbol names. 1145If the value 1146is non-zero, it represents a string table index that gives the symbol 1147name. 1148Otherwise, the symbol table has no name. 1149.It Dv st_value 1150This member gives the value of the associated symbol. 1151.It Dv st_size 1152Many symbols have associated sizes. 1153This member holds zero if the symbol 1154has no size or an unknown size. 1155.It Dv st_info 1156This member specifies the symbol's type and binding attributes: 1157.Bl -tag -width "STT_SECTION" 1158.It Dv STT_NOTYPE 1159The symbol's type is not defined. 1160.It Dv STT_OBJECT 1161The symbol is associated with a data object. 1162.It Dv STT_FUNC 1163The symbol is associated with a function or other executable code. 1164.It Dv STT_SECTION 1165The symbol is associated with a section. 1166Symbol table entries of 1167this type exist primarily for relocation and normally have 1168.Sy STB_LOCAL 1169bindings. 1170.It Dv STT_FILE 1171By convention, the symbol's name gives the name of the source file 1172associated with the object file. 1173A file symbol has 1174.Sy STB_LOCAL 1175bindings, its section index is 1176.Sy SHN_ABS , 1177and it precedes the other 1178.Sy STB_LOCAL 1179symbols of the file, if it is present. 1180.It Dv STT_TLS 1181The symbol is associated with an object in thread-local storage. 1182The symbol's value is its offset in the TLS storage for this file. 1183.It Dv STT_LOPROC 1184This value up to and including 1185.Sy STT_HIPROC 1186is reserved for processor-specific semantics. 1187.It Dv STT_HIPROC 1188This value down to and including 1189.Sy STT_LOPROC 1190is reserved for processor-specific semantics. 1191.El 1192.Bl -tag -width "STB_GLOBAL" 1193.It Dv STB_LOCAL 1194Local symbols are not visible outside the object file containing their 1195definition. 1196Local symbols of the same name may exist in multiple files 1197without interfering with each other. 1198.It Dv STB_GLOBAL 1199Global symbols are visible to all object files being combined. 1200One file's 1201definition of a global symbol will satisfy another file's undefined 1202reference to the same symbol. 1203.It Dv STB_WEAK 1204Weak symbols resemble global symbols, but their definitions have lower 1205precedence. 1206.It Dv STB_LOPROC 1207This value up to and including 1208.Sy STB_HIPROC 1209is reserved for processor-specific semantics. 1210.It Dv STB_HIPROC 1211This value down to and including 1212.Sy STB_LOPROC 1213is reserved for processor-specific semantics. 1214.Pp 1215There are macros for packing and unpacking the binding and type fields: 1216.Pp 1217.Bl -tag -width "ELF32_ST_INFO(bind, type)" -compact 1218.It Xo 1219.Fn ELF32_ST_BIND info 1220.Xc 1221or 1222.Fn ELF64_ST_BIND info 1223extract a binding from an st_info value. 1224.It Xo 1225.Fn ELF64_ST_TYPE info 1226.Xc 1227or 1228.Fn ELF32_ST_TYPE info 1229extract a type from an st_info value. 1230.It Xo 1231.Fn ELF32_ST_INFO bind type 1232.Xc 1233or 1234.Fn ELF64_ST_INFO bind type 1235convert a binding and a type into an st_info value. 1236.El 1237.El 1238.Pp 1239.It Dv st_other 1240This member currently holds zero and has no defined meaning. 1241.It Dv st_shndx 1242Every symbol table entry is 1243.Dq defined 1244in relation to some section. 1245This member holds the relevant section 1246header table index. 1247.El 1248.Pp 1249Relocation is the process of connecting symbolic references with 1250symbolic definitions. 1251Relocatable files must have information that 1252describes how to modify their section contents, thus allowing executable 1253and shared object files to hold the right information for a process' 1254program image. 1255Relocation entries are these data. 1256.Pp 1257Relocation structures that do not need an addend: 1258.Bd -literal -offset indent 1259typedef struct { 1260 Elf32_Addr r_offset; 1261 Elf32_Word r_info; 1262} Elf32_Rel; 1263.Ed 1264.Bd -literal -offset indent 1265typedef struct { 1266 Elf64_Xword r_offset; 1267 Elf64_Xword r_info; 1268} Elf64_Rel; 1269.Ed 1270.Pp 1271Relocation structures that need an addend: 1272.Bd -literal -offset indent 1273typedef struct { 1274 Elf32_Addr r_offset; 1275 Elf32_Word r_info; 1276 Elf32_Sword r_addend; 1277} Elf32_Rela; 1278.Ed 1279.Bd -literal -offset indent 1280typedef struct { 1281 Elf64_Xword r_offset; 1282 Elf64_Xword r_info; 1283 Elf64_Sxword r_addend; 1284} Elf64_Rela; 1285.Ed 1286.Bl -tag -width "r_offset" 1287.It Dv r_offset 1288This member gives the location at which to apply the relocation action. 1289For a relocatable file, the value is the byte offset from the beginning 1290of the section to the storage unit affected by the relocation. 1291For an 1292executable file or shared object, the value is the virtual address of 1293the storage unit affected by the relocation. 1294.It Dv r_info 1295This member gives both the symbol table index with respect to which the 1296relocation must be made and the type of relocation to apply. 1297Relocation 1298types are processor-specific. 1299When the text refers to a relocation 1300entry's relocation type or symbol table index, it means the result of 1301applying 1302.Sy ELF_[32|64]_R_TYPE 1303or 1304.Sy ELF[32|64]_R_SYM , 1305respectively, to the entry's 1306.Sy r_info 1307member. 1308.It Dv r_addend 1309This member specifies a constant addend used to compute the value to be 1310stored into the relocatable field. 1311.El 1312.Pp 1313The note section is used to hold vendor-specific information that 1314may be used to help identify a binary's ABI. 1315It should start with an Elf_Note struct, 1316followed by the section name and the section description. 1317The actual note contents follow thereafter. 1318.Bd -literal -offset indent 1319typedef struct { 1320Elf32_Word namesz; 1321Elf32_Word descsz; 1322Elf32_Word type; 1323} Elf32_Note; 1324 1325typedef struct { 1326Elf64_Half namesz; 1327Elf64_Half descsz; 1328Elf64_Half type; 1329} Elf64_Note; 1330.Ed 1331.Bl -tag -width "r_offset" 1332.It Dv namesz 1333Length of the note name, rounded up to a 4-byte boundary. 1334.It Dv descsz 1335Length of the note description, rounded up to a 4-byte boundary. 1336.It Dv type 1337A vendor-specific note type. 1338.El 1339.Pp 1340The name and description strings follow the note structure. 1341Each string is aligned on a 4-byte boundary. 1342.Sh SEE ALSO 1343.Xr as 1 , 1344.Xr gdb 1 , 1345.Xr ld 1 , 1346.Xr objdump 1 , 1347.Xr execve 2 , 1348.Xr core 5 1349.Rs 1350.%A Hewlett-Packard 1351.%B Elf-64 Object File Format 1352.Re 1353.Rs 1354.%A Santa Cruz Operation 1355.%B System V Application Binary Interface 1356.Re 1357.Rs 1358.%A Unix System Laboratories 1359.%T Object Files 1360.%B "Executable and Linking Format (ELF)" 1361.Re 1362.Sh HISTORY 1363.Ox 1364ELF support first appeared in 1365.Ox 1.2 , 1366although not all supported platforms use it as the native 1367binary file format. 1368ELF in itself first appeared in 1369.At V . 1370The ELF format is an adopted standard. 1371.Sh AUTHORS 1372This manual page was written by 1373.An Jeroen Ruigrok van der Werven 1374.Aq asmodai@FreeBSD.org 1375with inspiration from BSDi's 1376.Bsx 1377.Nm elf 1378manpage. 1379