ELF (Executable and Linkable Format) is the standard file format for executable files, object code, and shared libraries in Linux. An ELF file contains an ELF header, program header table, and section header table. It supports relocatable object files (.o files), shared object files (.so files), and executable files. The file contains various sections like .text, .data, .bss, .rel, .symtab, and .strtab that contain code, initialized data, uninitialized data, relocation information, symbols, and strings respectively.

1. ELF

2. Introduction

ELF stands for executable and linkable file format.

Also called as Extensible Linking Format.

ELF is used as standard file format for object files
on Linux.

ELF supports :
Different processors
Different data encoding
Different classes of machines

3. ELF Object Files

A file that contains compiled code is known as an
object file.

An Object file can be any of the following types
1.Relocatable object file (.o file)
2.Executable object file (a.out file)
3.Shared object file (.so file)

An object file participates from program building to
its execution or we can say from linking to execution
stage.

4. Relocatable file

This type of object file contains data and code that
can be linked together with other relocatable files
to produce an executable binary or a shared object
file.

A relocatable file is same as the .o file produced
when we compile a code in the following way
gcc -Wall -c test.c -o test.o

test.o produced after the operation above would be
a relocatable file.

5. Shared object file

This type of object file is used by the dynamic
linker to combine it with the executable and/or
other shared object files to create a complete
process image.

A shared object file is same as the .so file produced
when the code is compiled with the -fPIC flag in
the following way
gcc -c -Wall -Werror -fPIC shared.c
gcc -shared -o libshared.so shared.o

After the above two commands are done, a shared
object file libshared.so is produced as output.

6. Executable file

This type of object file is a file that is capable of
executing a program when run.

It is output of commands like this
gcc -Wall test.c -o test

So, the output ‘test’ would be an executable which
when run would execute the logic written in test.c
file.

7. ELF object file format
ELF header
Program header table
.text
.data
.rodata
.bss
.sym
.rel.text
.rel.data
.rel.rodata
.line
.debug
.strtab
Section header table

8. File layout

Each ELF file is made up of one ELF header,
followed by file data. The file data can include
1.Program header table, describing zero or more
segments.
2.Section header table, describing zero or more
sections.

The segments contain information that is necessary
for runtime execution of the file.

The sections contain important data for linking and
relocation.

9. Various sections
File header

The ELF header defines whether 32- or 64-bit addresses are to be used.
.text

This section holds executable instructions of a program.

Type: PROGBITS

Flags: ALLOC + EXECINSTR
.data

This section holds initialized data that contributes to the program’s
image.

Type: PROGBITS

Flags: ALLOC + WRITE

10. .rodata

This section holds read-only data.

Type: PROGBITS

Flags: ALLOC
.bss

This section holds uninitialized data that contributed to the
program’s image.

By definition, the system will initialize the data with zero when the
program begins to run.

Type: NOBITS

Flags: ALLOC + WRITE

11. .rel.text, .rel.data, and .rel.rodata

These contain the relocation information for the corresponding text
or data sections.

Type: REL

Flags: ALLOC is turned on if the file has a loadable segment that
includes relocation.
.symtab

This section hold a symbol table.
.strtab

This section holds strings.

12. .init

This section holds executable instructions that contribute to the
process initialization code.

Type: PROGBITS

Flags: ALLOC + EXECINSTR
.fini

This section hold executable instructions that contribute to the
process termination code.

Type: PROGBITS

Flags: ALLOC + EXECINSTR

13. .debug

This section holds symbolic debugging information.

Type: PROGBIT
.line

This section holds line number information for symbolic debugging,
which describes the correspondence between the program source
and the machine code.

Type: PROGBIT
.comment

This section may store extra information.