Short Tutorial: Executable and Linkable Format [Updated 2024]

Executable and Linkable Format (ELF) is a default format on Linux-based systems. It defines the structure of binary files used in Linux, Unix, OpenBSD, etc.

The design of the ELF format prioritizes flexibility, extensibility, and cross-platform compatibility. It supports executables and shared libraries, facilitating code execution and sharing.

Remember one thing, ELF is mainly used for or we can say that common standard for:

• shared libraries
• object files
• core dumps
• executable files

Components of ELF files

Header file <elf.h> defines the format of ELF files.

man elf

Key components of the Executable and Linkable Format (ELF)

ELF is broadly divided into the following components:

ELF Component	Description
executable header	The ELF header contains essential information about the file, such as its type (executable, shared object, etc.), the architecture for which it was compiled, entry point, program and section header offsets, and more.
program headers (optional)	The program header table describes the segments in the file, specifying each segment's size, location in memory, and permissions. The operating system must load the executable into memory properly.
sections	Sections contain specific data types, like code, data, symbols, and relocation information. Examples include the .text section for code and the .data section for initialized data.
section headers (optional)	Section headers provide detailed information about individual sections, including their names, sizes, and offsets. This information aids in linking and loading processes, enabling the correct execution of the program.
segments	Segments group related sections together for loading into memory during program execution. They play a vital role in organizing the data and code in a way that the operating system can efficiently manage.

Tools used to analyze ELF binaries

Tool Name	Description
file	popular Linux utility to know the information about the format of binary Usage: file <bin>
readelf	UNIX utility to identify information of binary Usage: $readelf -a test.o
elfdump	extract information of ELF files
objdump	display information of object files (one or more)
elfutils	collection of binary tools to analyze and manipulate ELF files
readelf	to inspect ELF headers
objcopy	to manipulate file formats
ldd	to list shared library dependencies

Conclusion

ELF is like a special container for computer programs. It holds all the important stuff a program needs to run, like its code and data. This container is flexible and can work on different kinds of computers, making it super useful for running programs on lots of different machines.