Introduction

The ELF header is a data structure which sits at the beginning of every ELF file and describes its layout. It starts with 16 identification bytes that contain the ELF magic bytes. The following structs are defined in <elf.h>:

#define EI_NIDENT 16

typedef struct {
        unsigned char   e_ident[EI_NIDENT];
        Elf32_Half      e_type;
        Elf32_Half      e_machine;
        Elf32_Word      e_version;
        Elf32_Addr      e_entry;
        Elf32_Off       e_phoff;
        Elf32_Off       e_shoff;
        Elf32_Word      e_flags;
        Elf32_Half      e_ehsize;
        Elf32_Half      e_phentsize;
        Elf32_Half      e_phnum;
        Elf32_Half      e_shentsize;
        Elf32_Half      e_shnum;
        Elf32_Half      e_shstrndx;
} Elf32_Ehdr;

typedef struct {
        unsigned char   e_ident[EI_NIDENT];
        Elf64_Half      e_type;
        Elf64_Half      e_machine;
        Elf64_Word      e_version;
        Elf64_Addr      e_entry;
        Elf64_Off       e_phoff;
        Elf64_Off       e_shoff;
        Elf64_Word      e_flags;
        Elf64_Half      e_ehsize;
        Elf64_Half      e_phentsize;
        Elf64_Half      e_phnum;
        Elf64_Half      e_shentsize;
        Elf64_Half      e_shnum;
        Elf64_Half      e_shstrndx;
} Elf64_Ehdr;

• e_ident - the initial magic bytes which denote an ELF file.
• e_type - the type of the object file.

• e_machine - specifies the required architecture. Values not labeled in the table are reserved for future machine names.

• e_version - specifies the ELF version.

• e_entry - the virtual address of the entry point. If there is no entry point, this member is 0.
• e_phoff - the offset (in bytes) from the beginning of the ELF header for the Program Header Table. If the file does not contain such a table, this member is 0.
• e_shoff - the offset (in bytes) from the beginning of the ELF header for the Section Header Table. If the file does not contain such a table, this member is 0.
• e_flags - processor-specific flags which take values of the form EF_flag_name.
• e_ehsize - the size of the ELF header in bytes.
• e_phentsize - the size of an entry in the Program Header Table. All entries are equally-sized.
• e_phnum - the number of entries in the Program Header Table.
• e_shentsize - the size of an entry in the Section Header Table. All entries are equally-sized.
• e_shnum - the number of entries in the Section Header Table. If the number of sections is greater than or equal to SHN_LORESERVE (0xff00), this member is 0 and the actual number of entries in the Section Header Table is contained in the sh_size field of the first section header (at index 0). Otherwise, the sh_size member of the initial entry contains 0.
• e_shstrndx - the Section Header Table index of the entry which is associated with the section name string table. If there is no such table, this holds SHN_UNDEF. If this index is greater than or equal to SHN_LORESERVE (0xff00), this member contains SHN_XINDEX (0xffff) and the actual index of the section name string table section is stored in the sh_link field of the first section header (at index 0). Otherwise, the sh_link member of the initial entry contains 0.

ELF Identification

Since ELF supports multiple types of processors, data encodings and machines, the first 16 bytes provide information as to how to interpret the file, regardless of the rest of its contents. These are the indices and meaning of each identification byte (e_ident):

The first 4 bytes contain the magic bytes which identify an ELF file and always have the same values:

Next is the EI_CLASS byte which describes the file's class - whether it is a 32-bit or 64-bit file.

EI_DATA specifies the encoding of the data structures in the ELF file.

EI_VERSION contains the ELF header version and must be set to EV_CURRENT.

EI_OSABI specifies OS- or ABI-specific extensions used by the file. Certain fields in other ELF structures contain values with OS- or ABI-specific meaning and their interpretation is determined by this byte. This byte should be set to 0 if no such extensions are used. The meaning of values between 64 and 255 is determined by the e_machine member of the ELF header. Furthermore, ABIs may define their own meanings for this byte, but otherwise, it should be interpreted in the following way:

EI_ABIVERSION identifies the target ABI version and is used to distinguish between incompatible ABI versions. The byte's interpretation depends on the ABI specified by EI_OSABI. If it is unspecified, EI_ABIVERSION should contain 0.

EI_PAD - demarcates the beginning of the unused bytes in e_ident, which are reserved and set to 0. The value of this byte may change as meanings are assigned to these unused bytes.

You can view the ELF header of an ELF binary by using readelf with the -h option: