ELF – Executable and Linkable Format

Free

Standard file format for executables, object code, and shared libraries

FreeFree tier

Type

Open Source

Visit Website GitHub (40 stars)

About ELF – Executable and Linkable Format

ELF (Executable and Linkable Format) is a common standard file format for executable files, relocatable code (object .o files), shared libraries, and core dumps. It is part of the ABI (Application Binary Interface) specification. By design, ELF is flexible, extensible, cross-platform, and CPU architecture ISA independent. The format supports loading at any memory address, with automatic symbol adjustment. It includes an ELF header (52 or 64 bytes for 32 or 64-bit), a program header table (for executable view) describing memory segments, and a section header table (for linking view) describing sections. Sections hold data like instructions, symbols, and relocation info; segments are mapped into memory. Tools like readelf, objdump, nm, file, elfdump, and elfutils can inspect and manipulate ELF files. The format is widely used in Unix-like systems, including Linux and BSD.

Key Features

Standard file format for executables, relocatable code, shared libraries, and core dumps

Flexible, extensible, cross-platform, CPU architecture ISA independent

Supports dynamic linking and loading at arbitrary memory addresses

Defines ELF header, program header table (executable view), and section header table (linking view)

Magic number 0x7F 'E' 'L' 'F' for identification

Widely supported by tools: readelf, objdump, nm, file, elfdump, elfutils

Pros & Cons

Pros

Cross-platform and CPU independent, making it a universal binary format
Flexible and extensible design accommodating various use cases
Well-documented standard with official ABI specifications
Supports both executable and linking views for efficient processing
Widely adopted with many robust analysis and manipulation tools

Cons

Complex structure requiring understanding of headers, sections, and segments
No fixed ordering of sections/segments (only ELF header at fixed position)
Relies on external dynamic linkers and resolving dependencies at runtime

Best For

Executable file format for Unix-like operating systems (Linux, BSD)Object files (.o) for compiler and linker toolchainsShared libraries (.so) and dynamically loaded librariesCore dumps for debugging and crash analysisEmbedded systems and firmware images (.axf, .bin, .elf)

FAQ

What is ELF?

ELF (Executable and Linkable Format) is a standard file format for executables, object code, shared libraries, and core dumps, widely used in Unix-like systems.

How is an ELF file loaded?

The kernel reads the ELF header, then uses the program header table to map segments into memory. It sets up the process image and transfers control to the entry point, using a dynamic linker if needed.

What is the difference between sections and segments?

Sections exist in object files before linking and hold data like code, symbols, and relocation info. Segments exist after linking in executables and define how memory is mapped at runtime. Linker groups sections into segments.

What tools can inspect ELF files?

Common tools include readelf (GNU binutils), objdump, nm, file, elfdump, and elfutils. They display headers, symbols, sections, and segment information.