ELF (Executable and Linkable Format) is a file format utilized in Unix/Linux systems. It has a comprehensive and adaptable structure, primarily composed of the following components:
Definition: Positioned at the start of the ELF file, it depicts the fundamental attributes of the entire file. These include the file type, the type of target architecture, version, the virtual address of the program entry point, the offset of the program header table, and the offset of the section header table.
- e_ident: A 16 - byte array for file identification and other basic details. The initial 4 bytes are the magic number "0x7f, 0x45, 0x4c, 0x46". Subsequently, there are the file class (1 for 32 - bit or 2 for 64 - bit), data encoding (1 for little - endian, 2 for big - endian), and the ELF version (usually 1).
- e_type: Identifies the file type. For instance, 1 represents a relocatable file, 2 an executable file, and 3 a shared object file.
- e_machine: Signifies the target architecture type, with distinct values corresponding to different processor architectures.
- e_version: Typically 1, denoting the ELF version.
- e_entry: The virtual address of the program entry point. If there is no entry point, this field is set to 0.
- e_phoff: The offset of the program header table within the file.
- e_shoff: The offset of the section header table within the file.
- e_flags: Processor - related flags.
- e_ehsize: The size of the ELF header in bytes.
- e_phentsize: The size of each entry in the program header table in bytes.
- e_phnum: The number of entries in the program header table.
- e_shentsize: The size of each entry in the section header table in bytes.
- e_shnum: The number of entries in the section header table.
- e_shstrndx: The index of the section header string table in the section table.
Definition: Beginning at a specific offset, it details the information of each section in the ELF file. This includes the name, type, flags, address, size, link, and associated details of the section.
Function: It aids the linker in determining how to combine parts of input object files, as well as how to modify the symbol table and relocation entries to resolve references to undefined symbols.
- .text: The machine code of the compiled program, i.e., the code segment.
- .rodata: Stores read - only data, such as constants and strings.
- .data: Initialized global and static C variables, which is the data segment.
- .bss: Uninitialized global and static C variables. All global or static variables initialized to 0 are also part of this segment.
- .rel.text: The relocation table for the .text segment, which records the address information that requires correction at runtime.
- .symtab: The symbol table, containing function names, variable names, and other information, used for symbol resolution during debugging and linking.
- .strtab: The string table, storing the symbol names and other strings in the .symtab.
Definition: For loadable files (like executables and shared libraries), it is used to describe the program's layout in memory. That is, the information of each segment, including the segment type, offset, virtual address, physical address, size in the file, size in memory, flags, and alignment attributes.
Function: When loading a program, the operating system uses the program header table to decide how to map the segments in the file to memory, and how to set the permissions and alignment of the segments.
- PT_LOAD: Describes a loadable segment, which is typically mapped to memory. For example, the code segment and data segment.
- PT_DYNAMIC: Information necessary for dynamic linking, such as relocation information and the symbol table required for dynamic linking.
- PT_NOTE: Saves additional information related to a specific vendor or system.
- PT_INTERP: Records the location information of the dynamic linker. Essentially, it is a null - terminated string.
- PT_PHDR: Saves the location and size of the program header table itself.
Definition: The actual location where the program's data, code, symbols, and other information are stored. An ELF file can have multiple sections or segments, each with its own specific purpose and attributes.
Difference: A section is a logical division, concentrating on the organization and function of the program. A segment is a physical division, emphasizing the layout and loading of the program in memory. Generally, a segment can contain the content of one or more sections.
- Code Segment (.text): Holds the instructions of the program and is read - only.
- Data Segment (.data): Stores initialized global variables and static variables.
- BSS Segment (.bss): Stores uninitialized global variables and static variables. At the start of program execution, these variables are initialized to 0 or null pointers.
- Read - Only Data Segment (.rodata): Stores read - only data, such as constants and string constants.
