| blob | 3e60090089b460f4b533c3587216751490aeb29b |
1 .\" $OpenBSD: elf.5,v 1.12 2003/10/27 20:23:58 jmc Exp $
2 .\"Copyright (c) 1999 Jeroen Ruigrok van der Werven
3 .\"All rights reserved.
4 .\"
5 .\" %%%LICENSE_START(PERMISSIVE_MISC)
6 .\"Redistribution and use in source and binary forms, with or without
7 .\"modification, are permitted provided that the following conditions
8 .\"are met:
9 .\"1. Redistributions of source code must retain the above copyright
10 .\" notice, this list of conditions and the following disclaimer.
11 .\"2. Redistributions in binary form must reproduce the above copyright
12 .\" notice, this list of conditions and the following disclaimer in the
13 .\" documentation and/or other materials provided with the distribution.
14 .\"
15 .\"THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 .\"ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 .\"IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 .\"ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 .\"FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 .\"DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 .\"OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 .\"HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 .\"LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 .\"OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 .\"SUCH DAMAGE.
26 .\" %%%LICENSE_END
27 .\"
28 .\" $FreeBSD: src/share/man/man5/elf.5,v 1.21 2001/10/01 16:09:23 ru Exp $
29 .\"
30 .\" Slightly adapted - aeb, 2004-01-01
31 .\" 2005-07-15, Mike Frysinger <vapier@gentoo.org>, various fixes
32 .\" 2007-10-11, Mike Frysinger <vapier@gentoo.org>, various fixes
33 .\" 2007-12-08, mtk, Converted from mdoc to man macros
34 .\"
35 .TH ELF 5 2021-03-22 "Linux" "Linux Programmer's Manual"
36 .SH NAME
37 elf \- format of Executable and Linking Format (ELF) files
38 .SH SYNOPSIS
39 .nf
40 .\" .B #include <elf_abi.h>
41 .B #include <elf.h>
42 .fi
43 .SH DESCRIPTION
44 The header file
45 .I <elf.h>
46 defines the format of ELF executable binary files.
47 Amongst these files are
48 normal executable files, relocatable object files, core files, and shared
49 objects.
50 .PP
51 An executable file using the ELF file format consists of an ELF header,
52 followed by a program header table or a section header table, or both.
53 The ELF header is always at offset zero of the file.
54 The program header
55 table and the section header table's offset in the file are defined in the
56 ELF header.
57 The two tables describe the rest of the particularities of
58 the file.
59 .PP
60 .\" Applications which wish to process ELF binary files for their native
61 .\" architecture only should include
62 .\" .I <elf_abi.h>
63 .\" in their source code.
64 .\" These applications should need to refer to
65 .\" all the types and structures by their generic names
66 .\" "Elf_xxx"
67 .\" and to the macros by
68 .\" ELF_xxx".
69 .\" Applications written this way can be compiled on any architecture,
70 .\" regardless of whether the host is 32-bit or 64-bit.
71 .\" .PP
72 .\" Should an application need to process ELF files of an unknown
73 .\" architecture, then the application needs to explicitly use either
74 .\" "Elf32_xxx"
75 .\" or
76 .\" "Elf64_xxx"
77 .\" type and structure names.
78 .\" Likewise, the macros need to be identified by
79 .\" "ELF32_xxx"
80 .\" or
81 .\" "ELF64_xxx".
82 .\" .PP
83 This header file describes the above mentioned headers as C structures
84 and also includes structures for dynamic sections, relocation sections and
85 symbol tables.
86 .\"
87 .SS Basic types
88 The following types are used for N-bit architectures (N=32,64,
89 .I ElfN
90 stands for
91 .I Elf32
92 or
93 .IR Elf64 ,
94 .I uintN_t
95 stands for
96 .I uint32_t
97 or
98 .IR uint64_t ):
99 .PP
100 .in +4n
101 .EX
102 ElfN_Addr Unsigned program address, uintN_t
103 ElfN_Off Unsigned file offset, uintN_t
104 ElfN_Section Unsigned section index, uint16_t
105 ElfN_Versym Unsigned version symbol information, uint16_t
106 Elf_Byte unsigned char
107 ElfN_Half uint16_t
108 ElfN_Sword int32_t
109 ElfN_Word uint32_t
110 ElfN_Sxword int64_t
111 ElfN_Xword uint64_t
112 .\" Elf32_Size Unsigned object size
113 .EE
114 .in
115 .PP
116 (Note: the *BSD terminology is a bit different.
117 There,
118 .I Elf64_Half
119 is
120 twice as large as
121 .IR Elf32_Half ,
122 and
123 .I Elf64Quarter
124 is used for
125 .IR uint16_t .
126 In order to avoid confusion these types are replaced by explicit ones
127 in the below.)
128 .PP
129 All data structures that the file format defines follow the
130 "natural"
131 size and alignment guidelines for the relevant class.
132 If necessary,
133 data structures contain explicit padding to ensure 4-byte alignment
134 for 4-byte objects, to force structure sizes to a multiple of 4, and so on.
135 .\"
136 .SS ELF header (Ehdr)
137 The ELF header is described by the type
138 .I Elf32_Ehdr
139 or
140 .IR Elf64_Ehdr :
141 .PP
142 .in +4n
143 .EX
144 #define EI_NIDENT 16
146 typedef struct {
147 unsigned char e_ident[EI_NIDENT];
148 uint16_t e_type;
149 uint16_t e_machine;
150 uint32_t e_version;
151 ElfN_Addr e_entry;
152 ElfN_Off e_phoff;
153 ElfN_Off e_shoff;
154 uint32_t e_flags;
155 uint16_t e_ehsize;
156 uint16_t e_phentsize;
157 uint16_t e_phnum;
158 uint16_t e_shentsize;
159 uint16_t e_shnum;
160 uint16_t e_shstrndx;
161 } ElfN_Ehdr;
162 .EE
163 .in
164 .PP
165 The fields have the following meanings:
166 .\"
167 .\"
168 .TP
169 .IR e_ident
170 This array of bytes specifies how to interpret the file,
171 independent of the processor or the file's remaining contents.
172 Within this array everything is named by macros, which start with
173 the prefix
174 .BR EI_
175 and may contain values which start with the prefix
176 .BR ELF .
177 The following macros are defined:
178 .RS
179 .TP
180 .BR EI_MAG0
181 The first byte of the magic number.
182 It must be filled with
183 .BR ELFMAG0 .
184 (0: 0x7f)
185 .TP
186 .BR EI_MAG1
187 The second byte of the magic number.
188 It must be filled with
189 .BR ELFMAG1 .
190 (1: \(aqE\(aq)
191 .TP
192 .BR EI_MAG2
193 The third byte of the magic number.
194 It must be filled with
195 .BR ELFMAG2 .
196 (2: \(aqL\(aq)
197 .TP
198 .BR EI_MAG3
199 The fourth byte of the magic number.
200 It must be filled with
201 .BR ELFMAG3 .
202 (3: \(aqF\(aq)
203 .TP
204 .BR EI_CLASS
205 The fifth byte identifies the architecture for this binary:
206 .RS
207 .TP 14
208 .PD 0
209 .BR ELFCLASSNONE
210 This class is invalid.
211 .TP
212 .BR ELFCLASS32
213 This defines the 32-bit architecture.
214 It supports machines with files
215 and virtual address spaces up to 4 Gigabytes.
216 .TP
217 .BR ELFCLASS64
218 This defines the 64-bit architecture.
219 .PD
220 .RE
221 .TP
222 .BR EI_DATA
223 The sixth byte specifies the data encoding of the processor-specific
224 data in the file.
225 Currently, these encodings are supported:
226 .RS 9
227 .TP 14
228 .PD 0
229 .BR ELFDATANONE
230 Unknown data format.
231 .TP
232 .BR ELFDATA2LSB
233 Two's complement, little-endian.
234 .TP
235 .BR ELFDATA2MSB
236 Two's complement, big-endian.
237 .PD
238 .RE
239 .TP
240 .BR EI_VERSION
241 The seventh byte is the version number of the ELF specification:
242 .IP
243 .PD 0
244 .RS
245 .TP 14
246 .BR EV_NONE
247 Invalid version.
248 .TP
249 .BR EV_CURRENT
250 Current version.
251 .PD
252 .RE
253 .\".El
254 .TP
255 .BR EI_OSABI
256 The eighth byte identifies the operating system
257 and ABI to which the object is targeted.
258 Some fields in other ELF structures have flags
259 and values that have platform-specific meanings;
260 the interpretation of those fields is determined by the value of this byte.
261 For example:
262 .RS
263 .TP 21
264 .PD 0
265 .BR ELFOSABI_NONE
266 Same as ELFOSABI_SYSV
267 .\" 0
268 .TP
269 .BR ELFOSABI_SYSV
270 UNIX System V ABI
271 .\" 0
272 .\" synonym: ELFOSABI_NONE
273 .TP
274 .BR ELFOSABI_HPUX
275 HP-UX ABI
276 .\" 1
277 .TP
278 .BR ELFOSABI_NETBSD
279 NetBSD ABI
280 .\" 2
281 .TP
282 .BR ELFOSABI_LINUX
283 Linux ABI
284 .\" 3
285 .\" .TP
286 .\" .BR ELFOSABI_HURD
287 .\" Hurd ABI
288 .\" 4
289 .\" .TP
290 .\" .BR ELFOSABI_86OPEN
291 .\" 86Open Common IA32 ABI
292 .\" 5
293 .TP
294 .BR ELFOSABI_SOLARIS
295 Solaris ABI
296 .\" 6
297 .\" .TP
298 .\" .BR ELFOSABI_MONTEREY
299 .\" Monterey project ABI
300 .\" Now replaced by
301 .\" ELFOSABI_AIX
302 .\" 7
303 .TP
304 .BR ELFOSABI_IRIX
305 IRIX ABI
306 .\" 8
307 .TP
308 .BR ELFOSABI_FREEBSD
309 FreeBSD ABI
310 .\" 9
311 .TP
312 .BR ELFOSABI_TRU64
313 TRU64 UNIX ABI
314 .\" 10
315 .\" ELFOSABI_MODESTO
316 .\" 11
317 .\" ELFOSABI_OPENBSD
318 .\" 12
319 .TP
320 .BR ELFOSABI_ARM
321 ARM architecture ABI
322 .\" 97
323 .TP
324 .BR ELFOSABI_STANDALONE
325 Stand-alone (embedded) ABI
326 .\" 255
327 .PD
328 .RE
329 .TP
330 .BR EI_ABIVERSION
331 The ninth byte identifies the version of the ABI
332 to which the object is targeted.
333 This field is used to distinguish among incompatible versions of an ABI.
334 The interpretation of this version number
335 is dependent on the ABI identified by the
336 .B EI_OSABI
337 field.
338 Applications conforming to this specification use the value 0.
339 .TP
340 .BR EI_PAD
341 Start of padding.
342 These bytes are reserved and set to zero.
343 Programs
344 which read them should ignore them.
345 The value for
346 .B EI_PAD
347 will change in
348 the future if currently unused bytes are given meanings.
349 .\" As reported by Yuri Kozlov and confirmed by Mike Frysinger, EI_BRAND is
350 .\" not in GABI (http://www.sco.com/developers/gabi/latest/ch4.eheader.html)
351 .\" It looks to be a BSDism
352 .\" .TP
353 .\" .BR EI_BRAND
354 .\" Start of architecture identification.
355 .TP
356 .BR EI_NIDENT
357 The size of the
358 .I e_ident
359 array.
360 .RE
361 .TP
362 .IR e_type
363 This member of the structure identifies the object file type:
364 .RS
365 .TP 16
366 .PD 0
367 .BR ET_NONE
368 An unknown type.
369 .TP
370 .BR ET_REL
371 A relocatable file.
372 .TP
373 .BR ET_EXEC
374 An executable file.
375 .TP
376 .BR ET_DYN
377 A shared object.
378 .TP
379 .BR ET_CORE
380 A core file.
381 .PD
382 .RE
383 .TP
384 .IR e_machine
385 This member specifies the required architecture for an individual file.
386 For example:
387 .RS
388 .TP 16
389 .PD 0
390 .BR EM_NONE
391 An unknown machine
392 .\" 0
393 .TP
394 .BR EM_M32
395 AT&T WE 32100
396 .\" 1
397 .TP
398 .BR EM_SPARC
399 Sun Microsystems SPARC
400 .\" 2
401 .TP
402 .BR EM_386
403 Intel 80386
404 .\" 3
405 .TP
406 .BR EM_68K
407 Motorola 68000
408 .\" 4
409 .TP
410 .BR EM_88K
411 Motorola 88000
412 .\" 5
413 .\" .TP
414 .\" .BR EM_486
415 .\" Intel 80486
416 .\" 6
417 .TP
418 .BR EM_860
419 Intel 80860
420 .\" 7
421 .TP
422 .BR EM_MIPS
423 MIPS RS3000 (big-endian only)
424 .\" 8
425 .\" EM_S370
426 .\" 9
427 .\" .TP
428 .\" .BR EM_MIPS_RS4_BE
429 .\" MIPS RS4000 (big-endian only). Deprecated
430 .\" 10
431 .\" EM_MIPS_RS3_LE (MIPS R3000 little-endian)
432 .\" 10
433 .TP
434 .BR EM_PARISC
435 HP/PA
436 .\" 15
437 .TP
438 .BR EM_SPARC32PLUS
439 SPARC with enhanced instruction set
440 .\" 18
441 .TP
442 .BR EM_PPC
443 PowerPC
444 .\" 20
445 .TP
446 .BR EM_PPC64
447 PowerPC 64-bit
448 .\" 21
449 .TP
450 .BR EM_S390
451 IBM S/390
452 .\" 22
453 .TP
454 .BR EM_ARM
455 Advanced RISC Machines
456 .\" 40
457 .TP
458 .BR EM_SH
459 Renesas SuperH
460 .\" 42
461 .TP
462 .BR EM_SPARCV9
463 SPARC v9 64-bit
464 .\" 43
465 .TP
466 .BR EM_IA_64
467 Intel Itanium
468 .\" 50
469 .TP
470 .BR EM_X86_64
471 AMD x86-64
472 .\" 62
473 .TP
474 .BR EM_VAX
475 DEC Vax
476 .\" 75
477 .\" EM_CRIS
478 .\" 76
479 .\" .TP
480 .\" .BR EM_ALPHA
481 .\" Compaq [DEC] Alpha
482 .\" .TP
483 .\" .BR EM_ALPHA_EXP
484 .\" Compaq [DEC] Alpha with enhanced instruction set
485 .PD
486 .RE
487 .TP
488 .IR e_version
489 This member identifies the file version:
490 .RS
491 .TP 16
492 .PD 0
493 .BR EV_NONE
494 Invalid version
495 .TP
496 .BR EV_CURRENT
497 Current version
498 .PD
499 .RE
500 .TP
501 .IR e_entry
502 This member gives the virtual address to which the system first transfers
503 control, thus starting the process.
504 If the file has no associated entry
505 point, this member holds zero.
506 .TP
507 .IR e_phoff
508 This member holds the program header table's file offset in bytes.
509 If
510 the file has no program header table, this member holds zero.
511 .TP
512 .IR e_shoff
513 This member holds the section header table's file offset in bytes.
514 If the
515 file has no section header table, this member holds zero.
516 .TP
517 .IR e_flags
518 This member holds processor-specific flags associated with the file.
519 Flag names take the form EF_`machine_flag'.
520 Currently, no flags have been defined.
521 .TP
522 .IR e_ehsize
523 This member holds the ELF header's size in bytes.
524 .TP
525 .IR e_phentsize
526 This member holds the size in bytes of one entry in the file's
527 program header table; all entries are the same size.
528 .TP
529 .IR e_phnum
530 This member holds the number of entries in the program header
531 table.
532 Thus the product of
533 .IR e_phentsize
534 and
535 .IR e_phnum
536 gives the table's size
537 in bytes.
538 If a file has no program header,
539 .IR e_phnum
540 holds the value zero.
541 .IP
542 If the number of entries in the program header table is
543 larger than or equal to
544 .\" This is a Linux extension, added in Linux 2.6.34.
545 .BR PN_XNUM
546 (0xffff), this member holds
547 .BR PN_XNUM
548 (0xffff) and the real number of entries in the program header table is held
549 in the
550 .IR sh_info
551 member of the initial entry in section header table.
552 Otherwise, the
553 .IR sh_info
554 member of the initial entry contains the value zero.
555 .RS
556 .TP
557 .BR PN_XNUM
558 This is defined as 0xffff, the largest number
559 .IR e_phnum
560 can have, specifying where the actual number of program headers is assigned.
561 .PD
562 .RE
563 .TP
564 .IR e_shentsize
565 This member holds a sections header's size in bytes.
566 A section header is one
567 entry in the section header table; all entries are the same size.
568 .TP
569 .IR e_shnum
570 This member holds the number of entries in the section header table.
571 Thus
572 the product of
573 .IR e_shentsize
574 and
575 .IR e_shnum
576 gives the section header table's size in bytes.
577 If a file has no section
578 header table,
579 .IR e_shnum
580 holds the value of zero.
581 .IP
582 If the number of entries in the section header table is
583 larger than or equal to
584 .BR SHN_LORESERVE
585 (0xff00),
586 .IR e_shnum
587 holds the value zero and the real number of entries in the section header
588 table is held in the
589 .IR sh_size
590 member of the initial entry in section header table.
591 Otherwise, the
592 .IR sh_size
593 member of the initial entry in the section header table holds
594 the value zero.
595 .TP
596 .IR e_shstrndx
597 This member holds the section header table index of the entry associated
598 with the section name string table.
599 If the file has no section name string
600 table, this member holds the value
601 .BR SHN_UNDEF .
602 .IP
603 If the index of section name string table section is
604 larger than or equal to
605 .BR SHN_LORESERVE
606 (0xff00), this member holds
607 .BR SHN_XINDEX
608 (0xffff) and the real index of the section name string table section
609 is held in the
610 .IR sh_link
611 member of the initial entry in section header table.
612 Otherwise, the
613 .IR sh_link
614 member of the initial entry in section header table contains the value zero.
615 .\"
616 .SS Program header (Phdr)
617 An executable or shared object file's program header table is an array of
618 structures, each describing a segment or other information the system needs
619 to prepare the program for execution.
620 An object file
621 .IR segment
622 contains one or more
623 .IR sections .
624 Program headers are meaningful only for executable and shared object files.
625 A file specifies its own program header size with the ELF header's
626 .IR e_phentsize
627 and
628 .IR e_phnum
629 members.
630 The ELF program header is described by the type
631 .I Elf32_Phdr
632 or
633 .I Elf64_Phdr
634 depending on the architecture:
635 .PP
636 .in +4n
637 .EX
638 typedef struct {
639 uint32_t p_type;
640 Elf32_Off p_offset;
641 Elf32_Addr p_vaddr;
642 Elf32_Addr p_paddr;
643 uint32_t p_filesz;
644 uint32_t p_memsz;
645 uint32_t p_flags;
646 uint32_t p_align;
647 } Elf32_Phdr;
648 .EE
649 .in
650 .PP
651 .in +4n
652 .EX
653 typedef struct {
654 uint32_t p_type;
655 uint32_t p_flags;
656 Elf64_Off p_offset;
657 Elf64_Addr p_vaddr;
658 Elf64_Addr p_paddr;
659 uint64_t p_filesz;
660 uint64_t p_memsz;
661 uint64_t p_align;
662 } Elf64_Phdr;
663 .EE
664 .in
665 .PP
666 The main difference between the 32-bit and the 64-bit program header lies
667 in the location of the
668 .IR p_flags
669 member in the total struct.
670 .TP
671 .IR p_type
672 This member of the structure indicates what kind of segment this array
673 element describes or how to interpret the array element's information.
674 .RS 10
675 .TP
676 .BR PT_NULL
677 The array element is unused and the other members' values are undefined.
678 This lets the program header have ignored entries.
679 .TP
680 .BR PT_LOAD
681 The array element specifies a loadable segment, described by
682 .IR p_filesz
683 and
684 .IR p_memsz .
685 The bytes from the file are mapped to the beginning of the memory
686 segment.
687 If the segment's memory size
688 .IR p_memsz
689 is larger than the file size
690 .IR p_filesz ,
691 the
692 "extra"
693 bytes are defined to hold the value 0 and to follow the segment's
694 initialized area.
695 The file size may not be larger than the memory size.
696 Loadable segment entries in the program header table appear in ascending
697 order, sorted on the
698 .IR p_vaddr
699 member.
700 .TP
701 .BR PT_DYNAMIC
702 The array element specifies dynamic linking information.
703 .TP
704 .BR PT_INTERP
705 The array element specifies the location and size of a null-terminated
706 pathname to invoke as an interpreter.
707 This segment type is meaningful
708 only for executable files (though it may occur for shared objects).
709 However it may not occur more than once in a file.
710 If it is present, it must precede any loadable segment entry.
711 .TP
712 .BR PT_NOTE
713 The array element specifies the location of notes (ElfN_Nhdr).
714 .TP
715 .BR PT_SHLIB
716 This segment type is reserved but has unspecified semantics.
717 Programs that
718 contain an array element of this type do not conform to the ABI.
719 .TP
720 .BR PT_PHDR
721 The array element, if present,
722 specifies the location and size of the program header table itself,
723 both in the file and in the memory image of the program.
724 This segment type may not occur more than once in a file.
725 Moreover, it may
726 occur only if the program header table is part of the memory image of the
727 program.
728 If it is present, it must precede any loadable segment entry.
729 .TP
730 .BR PT_LOPROC ", " PT_HIPROC
731 Values in the inclusive range
732 .RB [ PT_LOPROC ", " PT_HIPROC ]
733 are reserved for processor-specific semantics.
734 .TP
735 .BR PT_GNU_STACK
736 GNU extension which is used by the Linux kernel to control the state of the
737 stack via the flags set in the
738 .IR p_flags
739 member.
740 .RE
741 .TP
742 .IR p_offset
743 This member holds the offset from the beginning of the file at which
744 the first byte of the segment resides.
745 .TP
746 .IR p_vaddr
747 This member holds the virtual address at which the first byte of the
748 segment resides in memory.
749 .TP
750 .IR p_paddr
751 On systems for which physical addressing is relevant, this member is
752 reserved for the segment's physical address.
753 Under
754 BSD
755 this member is
756 not used and must be zero.
757 .TP
758 .IR p_filesz
759 This member holds the number of bytes in the file image of the segment.
760 It may be zero.
761 .TP
762 .IR p_memsz
763 This member holds the number of bytes in the memory image of the segment.
764 It may be zero.
765 .TP
766 .IR p_flags
767 This member holds a bit mask of flags relevant to the segment:
768 .RS
769 .TP
770 .PD 0
771 .BR PF_X
772 An executable segment.
773 .TP
774 .BR PF_W
775 A writable segment.
776 .TP
777 .BR PF_R
778 A readable segment.
779 .PD
780 .RE
781 .IP
782 A text segment commonly has the flags
783 .BR PF_X
784 and
785 .BR PF_R .
786 A data segment commonly has
787 .BR PF_W
788 and
789 .BR PF_R .
790 .TP
791 .IR p_align
792 This member holds the value to which the segments are aligned in memory
793 and in the file.
794 Loadable process segments must have congruent values for
795 .IR p_vaddr
796 and
797 .IR p_offset ,
798 modulo the page size.
799 Values of zero and one mean no alignment is required.
800 Otherwise,
801 .IR p_align
802 should be a positive, integral power of two, and
803 .IR p_vaddr
804 should equal
805 .IR p_offset ,
806 modulo
807 .IR p_align .
808 .\"
809 .SS Section header (Shdr)
810 A file's section header table lets one locate all the file's sections.
811 The
812 section header table is an array of
813 .I Elf32_Shdr
814 or
815 .I Elf64_Shdr
816 structures.
817 The
818 ELF header's
819 .IR e_shoff
820 member gives the byte offset from the beginning of the file to the section
821 header table.
822 .IR e_shnum
823 holds the number of entries the section header table contains.
824 .IR e_shentsize
825 holds the size in bytes of each entry.
826 .PP
827 A section header table index is a subscript into this array.
828 Some section
829 header table indices are reserved:
830 the initial entry and the indices between
831 .B SHN_LORESERVE
832 and
833 .BR SHN_HIRESERVE .
834 The initial entry is used in ELF extensions for
835 .IR e_phnum ,
836 .IR e_shnum ,
837 and
838 .IR e_shstrndx ;
839 in other cases, each field in the initial entry is set to zero.
840 An object file does not have sections for
841 these special indices:
842 .TP
843 .BR SHN_UNDEF
844 This value marks an undefined, missing, irrelevant,
845 or otherwise meaningless section reference.
846 .TP
847 .BR SHN_LORESERVE
848 This value specifies the lower bound of the range of reserved indices.
849 .TP
850 .BR SHN_LOPROC ", " SHN_HIPROC
851 Values greater in the inclusive range
852 .RB [ SHN_LOPROC ", " SHN_HIPROC ]
853 are reserved for processor-specific semantics.
854 .TP
855 .BR SHN_ABS
856 This value specifies the absolute value for the corresponding reference.
857 For
858 example, a symbol defined relative to section number
859 .BR SHN_ABS
860 has an absolute value and is not affected by relocation.
861 .TP
862 .BR SHN_COMMON
863 Symbols defined relative to this section are common symbols,
864 such as FORTRAN COMMON or unallocated C external variables.
865 .TP
866 .BR SHN_HIRESERVE
867 This value specifies the upper bound of the range of reserved indices.
868 The
869 system reserves indices between
870 .BR SHN_LORESERVE
871 and
872 .BR SHN_HIRESERVE ,
873 inclusive.
874 The section header table does not contain entries for the
875 reserved indices.
876 .PP
877 The section header has the following structure:
878 .PP
879 .in +4n
880 .EX
881 typedef struct {
882 uint32_t sh_name;
883 uint32_t sh_type;
884 uint32_t sh_flags;
885 Elf32_Addr sh_addr;
886 Elf32_Off sh_offset;
887 uint32_t sh_size;
888 uint32_t sh_link;
889 uint32_t sh_info;
890 uint32_t sh_addralign;
891 uint32_t sh_entsize;
892 } Elf32_Shdr;
893 .EE
894 .in
895 .PP
896 .in +4n
897 .EX
898 typedef struct {
899 uint32_t sh_name;
900 uint32_t sh_type;
901 uint64_t sh_flags;
902 Elf64_Addr sh_addr;
903 Elf64_Off sh_offset;
904 uint64_t sh_size;
905 uint32_t sh_link;
906 uint32_t sh_info;
907 uint64_t sh_addralign;
908 uint64_t sh_entsize;
909 } Elf64_Shdr;
910 .EE
911 .in
912 .PP
913 No real differences exist between the 32-bit and 64-bit section headers.
914 .TP
915 .IR sh_name
916 This member specifies the name of the section.
917 Its value is an index
918 into the section header string table section, giving the location of
919 a null-terminated string.
920 .TP
921 .IR sh_type
922 This member categorizes the section's contents and semantics.
923 .RS
924 .TP
925 .BR SHT_NULL
926 This value marks the section header as inactive.
927 It does not
928 have an associated section.
929 Other members of the section header
930 have undefined values.
931 .TP
932 .BR SHT_PROGBITS
933 This section holds information defined by the program, whose
934 format and meaning are determined solely by the program.
935 .TP
936 .BR SHT_SYMTAB
937 This section holds a symbol table.
938 Typically,
939 .BR SHT_SYMTAB
940 provides symbols for link editing, though it may also be used
941 for dynamic linking.
942 As a complete symbol table, it may contain
943 many symbols unnecessary for dynamic linking.
944 An object file can
945 also contain a
946 .BR SHT_DYNSYM
947 section.
948 .TP
949 .BR SHT_STRTAB
950 This section holds a string table.
951 An object file may have multiple
952 string table sections.
953 .TP
954 .BR SHT_RELA
955 This section holds relocation entries with explicit addends, such
956 as type
957 .IR Elf32_Rela
958 for the 32-bit class of object files.
959 An object may have multiple
960 relocation sections.
961 .TP
962 .BR SHT_HASH
963 This section holds a symbol hash table.
964 An object participating in
965 dynamic linking must contain a symbol hash table.
966 An object file may
967 have only one hash table.
968 .TP
969 .BR SHT_DYNAMIC
970 This section holds information for dynamic linking.
971 An object file may
972 have only one dynamic section.
973 .TP
974 .BR SHT_NOTE
975 This section holds notes (ElfN_Nhdr).
976 .TP
977 .BR SHT_NOBITS
978 A section of this type occupies no space in the file but otherwise
979 resembles
980 .BR SHT_PROGBITS .
981 Although this section contains no bytes, the
982 .IR sh_offset
983 member contains the conceptual file offset.
984 .TP
985 .BR SHT_REL
986 This section holds relocation offsets without explicit addends, such
987 as type
988 .IR Elf32_Rel
989 for the 32-bit class of object files.
990 An object file may have multiple
991 relocation sections.
992 .TP
993 .BR SHT_SHLIB
994 This section is reserved but has unspecified semantics.
995 .TP
996 .BR SHT_DYNSYM
997 This section holds a minimal set of dynamic linking symbols.
998 An
999 object file can also contain a
1000 .BR SHT_SYMTAB
1001 section.
1002 .TP
1003 .BR SHT_LOPROC ", " SHT_HIPROC
1004 Values in the inclusive range
1005 .RB [ SHT_LOPROC ", " SHT_HIPROC ]
1006 are reserved for processor-specific semantics.
1007 .TP
1008 .BR SHT_LOUSER
1009 This value specifies the lower bound of the range of indices reserved for
1010 application programs.
1011 .TP
1012 .BR SHT_HIUSER
1013 This value specifies the upper bound of the range of indices reserved for
1014 application programs.
1015 Section types between
1016 .BR SHT_LOUSER
1017 and
1018 .BR SHT_HIUSER
1019 may be used by the application, without conflicting with current or future
1020 system-defined section types.
1021 .RE
1022 .TP
1023 .IR sh_flags
1024 Sections support one-bit flags that describe miscellaneous attributes.
1025 If a flag bit is set in
1026 .IR sh_flags ,
1027 the attribute is
1028 "on"
1029 for the section.
1030 Otherwise, the attribute is
1031 "off"
1032 or does not apply.
1033 Undefined attributes are set to zero.
1034 .RS
1035 .TP
1036 .BR SHF_WRITE
1037 This section contains data that should be writable during process
1038 execution.
1039 .TP
1040 .BR SHF_ALLOC
1041 This section occupies memory during process execution.
1042 Some control
1043 sections do not reside in the memory image of an object file.
1044 This
1045 attribute is off for those sections.
1046 .TP
1047 .BR SHF_EXECINSTR
1048 This section contains executable machine instructions.
1049 .TP
1050 .BR SHF_MASKPROC
1051 All bits included in this mask are reserved for processor-specific
1052 semantics.
1053 .RE
1054 .TP
1055 .IR sh_addr
1056 If this section appears in the memory image of a process, this member
1057 holds the address at which the section's first byte should reside.
1058 Otherwise, the member contains zero.
1059 .TP
1060 .IR sh_offset
1061 This member's value holds the byte offset from the beginning of the file
1062 to the first byte in the section.
1063 One section type,
1064 .BR SHT_NOBITS ,
1065 occupies no space in the file, and its
1066 .IR sh_offset
1067 member locates the conceptual placement in the file.
1068 .TP
1069 .IR sh_size
1070 This member holds the section's size in bytes.
1071 Unless the section type
1072 is
1073 .BR SHT_NOBITS ,
1074 the section occupies
1075 .IR sh_size
1076 bytes in the file.
1077 A section of type
1078 .BR SHT_NOBITS
1079 may have a nonzero size, but it occupies no space in the file.
1080 .TP
1081 .IR sh_link
1082 This member holds a section header table index link, whose interpretation
1083 depends on the section type.
1084 .TP
1085 .IR sh_info
1086 This member holds extra information, whose interpretation depends on the
1087 section type.
1088 .TP
1089 .IR sh_addralign
1090 Some sections have address alignment constraints.
1091 If a section holds a
1092 doubleword, the system must ensure doubleword alignment for the entire
1093 section.
1094 That is, the value of
1095 .IR sh_addr
1096 must be congruent to zero, modulo the value of
1097 .IR sh_addralign .
1098 Only zero and positive integral powers of two are allowed.
1099 The value 0 or 1 means that the section has no alignment constraints.
1100 .TP
1101 .IR sh_entsize
1102 Some sections hold a table of fixed-sized entries, such as a symbol table.
1103 For such a section, this member gives the size in bytes for each entry.
1104 This member contains zero if the section does not hold a table of
1105 fixed-size entries.
1106 .PP
1107 Various sections hold program and control information:
1108 .TP
1109 .IR .bss
1110 This section holds uninitialized data that contributes to the program's
1111 memory image.
1112 By definition, the system initializes the data with zeros
1113 when the program begins to run.
1114 This section is of type
1115 .BR SHT_NOBITS .
1116 The attribute types are
1117 .BR SHF_ALLOC
1118 and
1119 .BR SHF_WRITE .
1120 .TP
1121 .IR .comment
1122 This section holds version control information.
1123 This section is of type
1124 .BR SHT_PROGBITS .
1125 No attribute types are used.
1126 .TP
1127 .IR .ctors
1128 This section holds initialized pointers to the C++ constructor functions.
1129 This section is of type
1130 .BR SHT_PROGBITS .
1131 The attribute types are
1132 .BR SHF_ALLOC
1133 and
1134 .BR SHF_WRITE .
1135 .TP
1136 .IR .data
1137 This section holds initialized data that contribute to the program's
1138 memory image.
1139 This section is of type
1140 .BR SHT_PROGBITS .
1141 The attribute types are
1142 .BR SHF_ALLOC
1143 and
1144 .BR SHF_WRITE .
1145 .TP
1146 .IR .data1
1147 This section holds initialized data that contribute to the program's
1148 memory image.
1149 This section is of type
1150 .BR SHT_PROGBITS .
1151 The attribute types are
1152 .BR SHF_ALLOC
1153 and
1154 .BR SHF_WRITE .
1155 .TP
1156 .IR .debug
1157 This section holds information for symbolic debugging.
1158 The contents
1159 are unspecified.
1160 This section is of type
1161 .BR SHT_PROGBITS .
1162 No attribute types are used.
1163 .TP
1164 .IR .dtors
1165 This section holds initialized pointers to the C++ destructor functions.
1166 This section is of type
1167 .BR SHT_PROGBITS .
1168 The attribute types are
1169 .BR SHF_ALLOC
1170 and
1171 .BR SHF_WRITE .
1172 .TP
1173 .IR .dynamic
1174 This section holds dynamic linking information.
1175 The section's attributes
1176 will include the
1177 .BR SHF_ALLOC
1178 bit.
1179 Whether the
1180 .BR SHF_WRITE
1181 bit is set is processor-specific.
1182 This section is of type
1183 .BR SHT_DYNAMIC .
1184 See the attributes above.
1185 .TP
1186 .IR .dynstr
1187 This section holds strings needed for dynamic linking, most commonly
1188 the strings that represent the names associated with symbol table entries.
1189 This section is of type
1190 .BR SHT_STRTAB .
1191 The attribute type used is
1192 .BR SHF_ALLOC .
1193 .TP
1194 .IR .dynsym
1195 This section holds the dynamic linking symbol table.
1196 This section is of type
1197 .BR SHT_DYNSYM .
1198 The attribute used is
1199 .BR SHF_ALLOC .
1200 .TP
1201 .IR .fini
1202 This section holds executable instructions that contribute to the process
1203 termination code.
1204 When a program exits normally the system arranges to
1205 execute the code in this section.
1206 This section is of type
1207 .BR SHT_PROGBITS .
1208 The attributes used are
1209 .BR SHF_ALLOC
1210 and
1211 .BR SHF_EXECINSTR .
1212 .TP
1213 .IR .gnu.version
1214 This section holds the version symbol table, an array of
1215 .I ElfN_Half
1216 elements.
1217 This section is of type
1218 .BR SHT_GNU_versym .
1219 The attribute type used is
1220 .BR SHF_ALLOC .
1221 .TP
1222 .IR .gnu.version_d
1223 This section holds the version symbol definitions, a table of
1224 .I ElfN_Verdef
1225 structures.
1226 This section is of type
1227 .BR SHT_GNU_verdef .
1228 The attribute type used is
1229 .BR SHF_ALLOC .
1230 .TP
1231 .IR .gnu.version_r
1232 This section holds the version symbol needed elements, a table of
1233 .I ElfN_Verneed
1234 structures.
1235 This section is of
1236 type
1237 .BR SHT_GNU_versym .
1238 The attribute type used is
1239 .BR SHF_ALLOC .
1240 .TP
1241 .IR .got
1242 This section holds the global offset table.
1243 This section is of type
1244 .BR SHT_PROGBITS .
1245 The attributes are processor-specific.
1246 .TP
1247 .IR .hash
1248 This section holds a symbol hash table.
1249 This section is of type
1250 .BR SHT_HASH .
1251 The attribute used is
1252 .BR SHF_ALLOC .
1253 .TP
1254 .IR .init
1255 This section holds executable instructions that contribute to the process
1256 initialization code.
1257 When a program starts to run the system arranges to execute
1258 the code in this section before calling the main program entry point.
1259 This section is of type
1260 .BR SHT_PROGBITS .
1261 The attributes used are
1262 .BR SHF_ALLOC
1263 and
1264 .BR SHF_EXECINSTR .
1265 .TP
1266 .IR .interp
1267 This section holds the pathname of a program interpreter.
1268 If the file has
1269 a loadable segment that includes the section, the section's attributes will
1270 include the
1271 .BR SHF_ALLOC
1272 bit.
1273 Otherwise, that bit will be off.
1274 This section is of type
1275 .BR SHT_PROGBITS .
1276 .TP
1277 .IR .line
1278 This section holds line number information for symbolic debugging,
1279 which describes the correspondence between the program source and
1280 the machine code.
1281 The contents are unspecified.
1282 This section is of type
1283 .BR SHT_PROGBITS .
1284 No attribute types are used.
1285 .TP
1286 .IR .note
1287 This section holds various notes.
1288 This section is of type
1289 .BR SHT_NOTE .
1290 No attribute types are used.
1291 .TP
1292 .IR .note.ABI\-tag
1293 This section is used to declare the expected run-time ABI of the ELF image.
1294 It may include the operating system name and its run-time versions.
1295 This section is of type
1296 .BR SHT_NOTE .
1297 The only attribute used is
1298 .BR SHF_ALLOC .
1299 .TP
1300 .IR .note.gnu.build\-id
1301 This section is used to hold an ID that uniquely identifies
1302 the contents of the ELF image.
1303 Different files with the same build ID should contain the same executable
1304 content.
1305 See the
1306 .BR \-\-build\-id
1307 option to the GNU linker (\fBld\fR (1)) for more details.
1308 This section is of type
1309 .BR SHT_NOTE .
1310 The only attribute used is
1311 .BR SHF_ALLOC .
1312 .TP
1313 .IR .note.GNU\-stack
1314 This section is used in Linux object files for declaring stack attributes.
1315 This section is of type
1316 .BR SHT_PROGBITS .
1317 The only attribute used is
1318 .BR SHF_EXECINSTR .
1319 This indicates to the GNU linker that the object file requires an
1320 executable stack.
1321 .TP
1322 .IR .note.openbsd.ident
1323 OpenBSD native executables usually contain this section
1324 to identify themselves so the kernel can bypass any compatibility
1325 ELF binary emulation tests when loading the file.
1326 .TP
1327 .IR .plt
1328 This section holds the procedure linkage table.
1329 This section is of type
1330 .BR SHT_PROGBITS .
1331 The attributes are processor-specific.
1332 .TP
1333 .IR .relNAME
1334 This section holds relocation information as described below.
1335 If the file
1336 has a loadable segment that includes relocation, the section's attributes
1337 will include the
1338 .BR SHF_ALLOC
1339 bit.
1340 Otherwise, the bit will be off.
1341 By convention,
1342 "NAME"
1343 is supplied by the section to which the relocations apply.
1344 Thus a relocation
1345 section for
1346 .BR .text
1347 normally would have the name
1348 .BR .rel.text .
1349 This section is of type
1350 .BR SHT_REL .
1351 .TP
1352 .IR .relaNAME
1353 This section holds relocation information as described below.
1354 If the file
1355 has a loadable segment that includes relocation, the section's attributes
1356 will include the
1357 .BR SHF_ALLOC
1358 bit.
1359 Otherwise, the bit will be off.
1360 By convention,
1361 "NAME"
1362 is supplied by the section to which the relocations apply.
1363 Thus a relocation
1364 section for
1365 .BR .text
1366 normally would have the name
1367 .BR .rela.text .
1368 This section is of type
1369 .BR SHT_RELA .
1370 .TP
1371 .IR .rodata
1372 This section holds read-only data that typically contributes to a
1373 nonwritable segment in the process image.
1374 This section is of type
1375 .BR SHT_PROGBITS .
1376 The attribute used is
1377 .BR SHF_ALLOC .
1378 .TP
1379 .IR .rodata1
1380 This section holds read-only data that typically contributes to a
1381 nonwritable segment in the process image.
1382 This section is of type
1383 .BR SHT_PROGBITS .
1384 The attribute used is
1385 .BR SHF_ALLOC .
1386 .TP
1387 .IR .shstrtab
1388 This section holds section names.
1389 This section is of type
1390 .BR SHT_STRTAB .
1391 No attribute types are used.
1392 .TP
1393 .IR .strtab
1394 This section holds strings, most commonly the strings that represent the
1395 names associated with symbol table entries.
1396 If the file has a loadable
1397 segment that includes the symbol string table, the section's attributes
1398 will include the
1399 .BR SHF_ALLOC
1400 bit.
1401 Otherwise, the bit will be off.
1402 This section is of type
1403 .BR SHT_STRTAB .
1404 .TP
1405 .IR .symtab
1406 This section holds a symbol table.
1407 If the file has a loadable segment
1408 that includes the symbol table, the section's attributes will include
1409 the
1410 .BR SHF_ALLOC
1411 bit.
1412 Otherwise, the bit will be off.
1413 This section is of type
1414 .BR SHT_SYMTAB .
1415 .TP
1416 .IR .text
1417 This section holds the
1418 "text",
1419 or executable instructions, of a program.
1420 This section is of type
1421 .BR SHT_PROGBITS .
1422 The attributes used are
1423 .BR SHF_ALLOC
1424 and
1425 .BR SHF_EXECINSTR .
1426 .\"
1427 .SS String and symbol tables
1428 String table sections hold null-terminated character sequences, commonly
1429 called strings.
1430 The object file uses these strings to represent symbol
1431 and section names.
1432 One references a string as an index into the string
1433 table section.
1434 The first byte, which is index zero, is defined to hold
1435 a null byte (\(aq\e0\(aq).
1436 Similarly, a string table's last byte is defined to
1437 hold a null byte, ensuring null termination for all strings.
1438 .PP
1439 An object file's symbol table holds information needed to locate and
1440 relocate a program's symbolic definitions and references.
1441 A symbol table
1442 index is a subscript into this array.
1443 .PP
1444 .in +4n
1445 .EX
1446 typedef struct {
1447 uint32_t st_name;
1448 Elf32_Addr st_value;
1449 uint32_t st_size;
1450 unsigned char st_info;
1451 unsigned char st_other;
1452 uint16_t st_shndx;
1453 } Elf32_Sym;
1454 .EE
1455 .in
1456 .PP
1457 .in +4n
1458 .EX
1459 typedef struct {
1460 uint32_t st_name;
1461 unsigned char st_info;
1462 unsigned char st_other;
1463 uint16_t st_shndx;
1464 Elf64_Addr st_value;
1465 uint64_t st_size;
1466 } Elf64_Sym;
1467 .EE
1468 .in
1469 .PP
1470 The 32-bit and 64-bit versions have the same members, just in a different
1471 order.
1472 .TP
1473 .IR st_name
1474 This member holds an index into the object file's symbol string table,
1475 which holds character representations of the symbol names.
1476 If the value
1477 is nonzero, it represents a string table index that gives the symbol
1478 name.
1479 Otherwise, the symbol has no name.
1480 .TP
1481 .IR st_value
1482 This member gives the value of the associated symbol.
1483 .TP
1484 .IR st_size
1485 Many symbols have associated sizes.
1486 This member holds zero if the symbol
1487 has no size or an unknown size.
1488 .TP
1489 .IR st_info
1490 This member specifies the symbol's type and binding attributes:
1491 .RS
1492 .TP
1493 .BR STT_NOTYPE
1494 The symbol's type is not defined.
1495 .TP
1496 .BR STT_OBJECT
1497 The symbol is associated with a data object.
1498 .TP
1499 .BR STT_FUNC
1500 The symbol is associated with a function or other executable code.
1501 .TP
1502 .BR STT_SECTION
1503 The symbol is associated with a section.
1504 Symbol table entries of
1505 this type exist primarily for relocation and normally have
1506 .BR STB_LOCAL
1507 bindings.
1508 .TP
1509 .BR STT_FILE
1510 By convention, the symbol's name gives the name of the source file
1511 associated with the object file.
1512 A file symbol has
1513 .BR STB_LOCAL
1514 bindings, its section index is
1515 .BR SHN_ABS ,
1516 and it precedes the other
1517 .BR STB_LOCAL
1518 symbols of the file, if it is present.
1519 .TP
1520 .BR STT_LOPROC ", " STT_HIPROC
1521 Values in the inclusive range
1522 .RB [ STT_LOPROC ", " STT_HIPROC ]
1523 are reserved for processor-specific semantics.
1524 .TP
1525 .BR STB_LOCAL
1526 Local symbols are not visible outside the object file containing their
1527 definition.
1528 Local symbols of the same name may exist in multiple files
1529 without interfering with each other.
1530 .TP
1531 .BR STB_GLOBAL
1532 Global symbols are visible to all object files being combined.
1533 One file's
1534 definition of a global symbol will satisfy another file's undefined
1535 reference to the same symbol.
1536 .TP
1537 .BR STB_WEAK
1538 Weak symbols resemble global symbols, but their definitions have lower
1539 precedence.
1540 .TP
1541 .BR STB_LOPROC ", " STB_HIPROC
1542 Values in the inclusive range
1543 .RB [ STB_LOPROC ", " STB_HIPROC ]
1544 are reserved for processor-specific semantics.
1545 .RE
1546 .IP
1547 There are macros for packing and unpacking the binding and type fields:
1548 .RS
1549 .TP
1550 .BR ELF32_ST_BIND( \fIinfo\fP ) ", " ELF64_ST_BIND( \fIinfo\fP )
1551 Extract a binding from an
1552 .I st_info
1553 value.
1554 .TP
1555 .BR ELF32_ST_TYPE( \fIinfo ) ", " ELF64_ST_TYPE( \fIinfo\fP )
1556 Extract a type from an
1557 .I st_info
1558 value.
1559 .TP
1560 .BR ELF32_ST_INFO( \fIbind\fP ", " \fItype\fP ) ", " \
1561 ELF64_ST_INFO( \fIbind\fP ", " \fItype\fP )
1562 Convert a binding and a type into an
1563 .I st_info
1564 value.
1565 .RE
1566 .TP
1567 .IR st_other
1568 This member defines the symbol visibility.
1569 .RS
1570 .TP
1571 .PD 0
1572 .BR STV_DEFAULT
1573 Default symbol visibility rules.
1574 Global and weak symbols are available to other modules;
1575 references in the local module can be interposed
1576 by definitions in other modules.
1577 .TP
1578 .BR STV_INTERNAL
1579 Processor-specific hidden class.
1580 .TP
1581 .BR STV_HIDDEN
1582 Symbol is unavailable to other modules;
1583 references in the local module always resolve to the local symbol
1584 (i.e., the symbol can't be interposed by definitions in other modules).
1585 .TP
1586 .BR STV_PROTECTED
1587 Symbol is available to other modules,
1588 but references in the local module always resolve to the local symbol.
1589 .PD
1590 .PP
1591 There are macros for extracting the visibility type:
1592 .PP
1593 .BR ELF32_ST_VISIBILITY (other)
1594 or
1595 .BR ELF64_ST_VISIBILITY (other)
1596 .RE
1597 .TP
1598 .IR st_shndx
1599 Every symbol table entry is
1600 "defined"
1601 in relation to some section.
1602 This member holds the relevant section
1603 header table index.
1604 .\"
1605 .SS Relocation entries (Rel & Rela)
1606 Relocation is the process of connecting symbolic references with
1607 symbolic definitions.
1608 Relocatable files must have information that
1609 describes how to modify their section contents, thus allowing executable
1610 and shared object files to hold the right information for a process's
1611 program image.
1612 Relocation entries are these data.
1613 .PP
1614 Relocation structures that do not need an addend:
1615 .PP
1616 .in +4n
1617 .EX
1618 typedef struct {
1619 Elf32_Addr r_offset;
1620 uint32_t r_info;
1621 } Elf32_Rel;
1622 .EE
1623 .in
1624 .PP
1625 .in +4n
1626 .EX
1627 typedef struct {
1628 Elf64_Addr r_offset;
1629 uint64_t r_info;
1630 } Elf64_Rel;
1631 .EE
1632 .in
1633 .PP
1634 Relocation structures that need an addend:
1635 .PP
1636 .in +4n
1637 .EX
1638 typedef struct {
1639 Elf32_Addr r_offset;
1640 uint32_t r_info;
1641 int32_t r_addend;
1642 } Elf32_Rela;
1643 .EE
1644 .in
1645 .PP
1646 .in +4n
1647 .EX
1648 typedef struct {
1649 Elf64_Addr r_offset;
1650 uint64_t r_info;
1651 int64_t r_addend;
1652 } Elf64_Rela;
1653 .EE
1654 .in
1655 .TP
1656 .IR r_offset
1657 This member gives the location at which to apply the relocation action.
1658 For a relocatable file, the value is the byte offset from the beginning
1659 of the section to the storage unit affected by the relocation.
1660 For an
1661 executable file or shared object, the value is the virtual address of
1662 the storage unit affected by the relocation.
1663 .TP
1664 .IR r_info
1665 This member gives both the symbol table index with respect to which the
1666 relocation must be made and the type of relocation to apply.
1667 Relocation
1668 types are processor-specific.
1669 When the text refers to a relocation
1670 entry's relocation type or symbol table index, it means the result of
1671 applying
1672 .BR ELF[32|64]_R_TYPE
1673 or
1674 .BR ELF[32|64]_R_SYM ,
1675 respectively, to the entry's
1676 .IR r_info
1677 member.
1678 .TP
1679 .IR r_addend
1680 This member specifies a constant addend used to compute the value to be
1681 stored into the relocatable field.
1682 .\"
1683 .SS Dynamic tags (Dyn)
1684 The
1685 .I .dynamic
1686 section contains a series of structures that hold relevant
1687 dynamic linking information.
1688 The
1689 .I d_tag
1690 member controls the interpretation
1691 of
1692 .IR d_un .
1693 .PP
1694 .in +4n
1695 .EX
1696 typedef struct {
1697 Elf32_Sword d_tag;
1698 union {
1699 Elf32_Word d_val;
1700 Elf32_Addr d_ptr;
1701 } d_un;
1702 } Elf32_Dyn;
1703 extern Elf32_Dyn _DYNAMIC[];
1704 .EE
1705 .in
1706 .PP
1707 .in +4n
1708 .EX
1709 typedef struct {
1710 Elf64_Sxword d_tag;
1711 union {
1712 Elf64_Xword d_val;
1713 Elf64_Addr d_ptr;
1714 } d_un;
1715 } Elf64_Dyn;
1716 extern Elf64_Dyn _DYNAMIC[];
1717 .EE
1718 .in
1719 .TP
1720 .IR d_tag
1721 This member may have any of the following values:
1722 .RS
1723 .TP 12
1724 .BR DT_NULL
1725 Marks end of dynamic section
1726 .TP
1727 .BR DT_NEEDED
1728 String table offset to name of a needed library
1729 .TP
1730 .BR DT_PLTRELSZ
1731 Size in bytes of PLT relocation entries
1732 .TP
1733 .BR DT_PLTGOT
1734 Address of PLT and/or GOT
1735 .TP
1736 .BR DT_HASH
1737 Address of symbol hash table
1738 .TP
1739 .BR DT_STRTAB
1740 Address of string table
1741 .TP
1742 .BR DT_SYMTAB
1743 Address of symbol table
1744 .TP
1745 .BR DT_RELA
1746 Address of Rela relocation table
1747 .TP
1748 .BR DT_RELASZ
1749 Size in bytes of the Rela relocation table
1750 .TP
1751 .BR DT_RELAENT
1752 Size in bytes of a Rela relocation table entry
1753 .TP
1754 .BR DT_STRSZ
1755 Size in bytes of string table
1756 .TP
1757 .BR DT_SYMENT
1758 Size in bytes of a symbol table entry
1759 .TP
1760 .BR DT_INIT
1761 Address of the initialization function
1762 .TP
1763 .BR DT_FINI
1764 Address of the termination function
1765 .TP
1766 .BR DT_SONAME
1767 String table offset to name of shared object
1768 .TP
1769 .BR DT_RPATH
1770 String table offset to library search path (deprecated)
1771 .TP
1772 .BR DT_SYMBOLIC
1773 Alert linker to search this shared object before the executable for symbols
1774 .TP
1775 .BR DT_REL
1776 Address of Rel relocation table
1777 .TP
1778 .BR DT_RELSZ
1779 Size in bytes of Rel relocation table
1780 .TP
1781 .BR DT_RELENT
1782 Size in bytes of a Rel table entry
1783 .TP
1784 .BR DT_PLTREL
1785 Type of relocation entry to which the PLT refers (Rela or Rel)
1786 .TP
1787 .BR DT_DEBUG
1788 Undefined use for debugging
1789 .TP
1790 .BR DT_TEXTREL
1791 Absence of this entry indicates that no relocation entries should
1792 apply to a nonwritable segment
1793 .TP
1794 .BR DT_JMPREL
1795 Address of relocation entries associated solely with the PLT
1796 .TP
1797 .BR DT_BIND_NOW
1798 Instruct dynamic linker to process all relocations before
1799 transferring control to the executable
1800 .TP
1801 .BR DT_RUNPATH
1802 String table offset to library search path
1803 .TP
1804 .BR DT_LOPROC ", " DT_HIPROC
1805 Values in the inclusive range
1806 .RB [ DT_LOPROC ", " DT_HIPROC ]
1807 are reserved for processor-specific semantics
1808 .RE
1809 .TP
1810 .IR d_val
1811 This member represents integer values with various interpretations.
1812 .TP
1813 .IR d_ptr
1814 This member represents program virtual addresses.
1815 When interpreting
1816 these addresses, the actual address should be computed based on the
1817 original file value and memory base address.
1818 Files do not contain
1819 relocation entries to fixup these addresses.
1820 .TP
1821 .I _DYNAMIC
1822 Array containing all the dynamic structures in the
1823 .I .dynamic
1824 section.
1825 This is automatically populated by the linker.
1826 .\" GABI ELF Reference for Note Sections:
1827 .\" http://www.sco.com/developers/gabi/latest/ch5.pheader.html#note_section
1828 .\"
1829 .\" Note that it implies the sizes and alignments of notes depend on the ELF
1830 .\" size (e.g. 32-bit ELFs have three 4-byte words and use 4-byte alignment
1831 .\" while 64-bit ELFs use 8-byte words & alignment), but that is not the case
1832 .\" in the real world. Notes always have three 4-byte words as can be seen
1833 .\" in the source links below (remember that Elf64_Word is a 32-bit quantity).
1834 .\" glibc: https://sourceware.org/git/?p=glibc.git;a=blob;f=elf/elf.h;h=9e59b3275917549af0cebe1f2de9ded3b7b10bf2#l1173
1835 .\" binutils: https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=binutils/readelf.c;h=274ddd17266aef6e4ad1f67af8a13a21500ff2af#l15943
1836 .\" Linux: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/include/uapi/linux/elf.h?h=v4.8#n422
1837 .\" Solaris: https://docs.oracle.com/cd/E23824_01/html/819-0690/chapter6-18048.html
1838 .\" FreeBSD: https://svnweb.freebsd.org/base/head/sys/sys/elf_common.h?revision=303677&view=markup#l33
1839 .\" NetBSD: https://www.netbsd.org/docs/kernel/elf-notes.html
1840 .\" OpenBSD: https://github.com/openbsd/src/blob/master/sys/sys/exec_elf.h#L533
1841 .\"
1842 .SS Notes (Nhdr)
1843 ELF notes allow for appending arbitrary information for the system to use.
1844 They are largely used by core files
1845 .RI ( e_type
1846 of
1847 .BR ET_CORE ),
1848 but many projects define their own set of extensions.
1849 For example,
1850 the GNU tool chain uses ELF notes to pass information from
1851 the linker to the C library.
1852 .PP
1853 Note sections contain a series of notes (see the
1854 .I struct
1855 definitions below).
1856 Each note is followed by the name field (whose length is defined in
1857 \fIn_namesz\fR) and then by the descriptor field (whose length is defined in
1858 \fIn_descsz\fR) and whose starting address has a 4 byte alignment.
1859 Neither field is defined in the note struct due to their arbitrary lengths.
1860 .PP
1861 An example for parsing out two consecutive notes should clarify their layout
1862 in memory:
1863 .PP
1864 .in +4n
1865 .EX
1866 void *memory, *name, *desc;
1867 Elf64_Nhdr *note, *next_note;
1869 /* The buffer is pointing to the start of the section/segment. */
1870 note = memory;
1872 /* If the name is defined, it follows the note. */
1873 name = note\->n_namesz == 0 ? NULL : memory + sizeof(*note);
1875 /* If the descriptor is defined, it follows the name
1876 (with alignment). */
1878 desc = note\->n_descsz == 0 ? NULL :
1879 memory + sizeof(*note) + ALIGN_UP(note\->n_namesz, 4);
1881 /* The next note follows both (with alignment). */
1882 next_note = memory + sizeof(*note) +
1883 ALIGN_UP(note\->n_namesz, 4) +
1884 ALIGN_UP(note\->n_descsz, 4);
1885 .EE
1886 .in
1887 .PP
1888 Keep in mind that the interpretation of
1889 .I n_type
1890 depends on the namespace defined by the
1891 .I n_namesz
1892 field.
1893 If the
1894 .I n_namesz
1895 field is not set (e.g., is 0), then there are two sets of notes:
1896 one for core files and one for all other ELF types.
1897 If the namespace is unknown, then tools will usually fallback to these sets
1898 of notes as well.
1899 .PP
1900 .in +4n
1901 .EX
1902 typedef struct {
1903 Elf32_Word n_namesz;
1904 Elf32_Word n_descsz;
1905 Elf32_Word n_type;
1906 } Elf32_Nhdr;
1907 .EE
1908 .in
1909 .PP
1910 .in +4n
1911 .EX
1912 typedef struct {
1913 Elf64_Word n_namesz;
1914 Elf64_Word n_descsz;
1915 Elf64_Word n_type;
1916 } Elf64_Nhdr;
1917 .EE
1918 .in
1919 .TP
1920 .IR n_namesz
1921 The length of the name field in bytes.
1922 The contents will immediately follow this note in memory.
1923 The name is null terminated.
1924 For example, if the name is "GNU", then
1925 .I n_namesz
1926 will be set to 4.
1927 .TP
1928 .IR n_descsz
1929 The length of the descriptor field in bytes.
1930 The contents will immediately follow the name field in memory.
1931 .TP
1932 .IR n_type
1933 Depending on the value of the name field, this member may have any of the
1934 following values:
1935 .RS
1936 .TP 5
1937 .B Core files (e_type = ET_CORE)
1938 Notes used by all core files.
1939 These are highly operating system or architecture specific and often require
1940 close coordination with kernels, C libraries, and debuggers.
1941 These are used when the namespace is the default (i.e.,
1942 .I n_namesz
1943 will be set to 0), or a fallback when the namespace is unknown.
1944 .RS
1945 .TP 21
1946 .PD 0
1947 .B NT_PRSTATUS
1948 prstatus struct
1949 .TP
1950 .B NT_FPREGSET
1951 fpregset struct
1952 .TP
1953 .B NT_PRPSINFO
1954 prpsinfo struct
1955 .TP
1956 .B NT_PRXREG
1957 prxregset struct
1958 .TP
1959 .B NT_TASKSTRUCT
1960 task structure
1961 .TP
1962 .B NT_PLATFORM
1963 String from sysinfo(SI_PLATFORM)
1964 .TP
1965 .B NT_AUXV
1966 auxv array
1967 .TP
1968 .B NT_GWINDOWS
1969 gwindows struct
1970 .TP
1971 .B NT_ASRS
1972 asrset struct
1973 .TP
1974 .B NT_PSTATUS
1975 pstatus struct
1976 .TP
1977 .B NT_PSINFO
1978 psinfo struct
1979 .TP
1980 .B NT_PRCRED
1981 prcred struct
1982 .TP
1983 .B NT_UTSNAME
1984 utsname struct
1985 .TP
1986 .B NT_LWPSTATUS
1987 lwpstatus struct
1988 .TP
1989 .B NT_LWPSINFO
1990 lwpinfo struct
1991 .TP
1992 .B NT_PRFPXREG
1993 fprxregset struct
1994 .TP
1995 .B NT_SIGINFO
1996 siginfo_t (size might increase over time)
1997 .TP
1998 .B NT_FILE
1999 Contains information about mapped files
2000 .TP
2001 .B NT_PRXFPREG
2002 user_fxsr_struct
2003 .TP
2004 .B NT_PPC_VMX
2005 PowerPC Altivec/VMX registers
2006 .TP
2007 .B NT_PPC_SPE
2008 PowerPC SPE/EVR registers
2009 .TP
2010 .B NT_PPC_VSX
2011 PowerPC VSX registers
2012 .TP
2013 .B NT_386_TLS
2014 i386 TLS slots (struct user_desc)
2015 .TP
2016 .B NT_386_IOPERM
2017 x86 io permission bitmap (1=deny)
2018 .TP
2019 .B NT_X86_XSTATE
2020 x86 extended state using xsave
2021 .TP
2022 .B NT_S390_HIGH_GPRS
2023 s390 upper register halves
2024 .TP
2025 .B NT_S390_TIMER
2026 s390 timer register
2027 .TP
2028 .B NT_S390_TODCMP
2029 s390 time-of-day (TOD) clock comparator register
2030 .TP
2031 .B NT_S390_TODPREG
2032 s390 time-of-day (TOD) programmable register
2033 .TP
2034 .B NT_S390_CTRS
2035 s390 control registers
2036 .TP
2037 .B NT_S390_PREFIX
2038 s390 prefix register
2039 .TP
2040 .B NT_S390_LAST_BREAK
2041 s390 breaking event address
2042 .TP
2043 .B NT_S390_SYSTEM_CALL
2044 s390 system call restart data
2045 .TP
2046 .B NT_S390_TDB
2047 s390 transaction diagnostic block
2048 .TP
2049 .B NT_ARM_VFP
2050 ARM VFP/NEON registers
2051 .TP
2052 .B NT_ARM_TLS
2053 ARM TLS register
2054 .TP
2055 .B NT_ARM_HW_BREAK
2056 ARM hardware breakpoint registers
2057 .TP
2058 .B NT_ARM_HW_WATCH
2059 ARM hardware watchpoint registers
2060 .TP
2061 .B NT_ARM_SYSTEM_CALL
2062 ARM system call number
2063 .PD
2064 .RE
2065 .TP
2066 .B n_name = GNU
2067 Extensions used by the GNU tool chain.
2068 .RS
2069 .TP
2070 .B NT_GNU_ABI_TAG
2071 Operating system (OS) ABI information.
2072 The desc field will be 4 words:
2073 .IP
2074 .PD 0
2075 .RS
2076 .IP \(bu 2
2077 word 0: OS descriptor
2078 (\fBELF_NOTE_OS_LINUX\fR, \fBELF_NOTE_OS_GNU\fR, and so on)`
2079 .IP \(bu
2080 word 1: major version of the ABI
2081 .IP \(bu
2082 word 2: minor version of the ABI
2083 .IP \(bu
2084 word 3: subminor version of the ABI
2085 .RE
2086 .PD
2087 .TP
2088 .B NT_GNU_HWCAP
2089 Synthetic hwcap information.
2090 The desc field begins with two words:
2091 .IP
2092 .PD 0
2093 .RS
2094 .IP \(bu 2
2095 word 0: number of entries
2096 .IP \(bu
2097 word 1: bit mask of enabled entries
2098 .RE
2099 .PD
2100 .IP
2101 Then follow variable-length entries, one byte followed by a null-terminated
2102 hwcap name string.
2103 The byte gives the bit number to test if enabled, (1U << bit) & bit mask.
2104 .TP
2105 .B NT_GNU_BUILD_ID
2106 Unique build ID as generated by the GNU
2107 .BR ld (1)
2108 .BR \-\-build\-id
2109 option.
2110 The desc consists of any nonzero number of bytes.
2111 .TP
2112 .B NT_GNU_GOLD_VERSION
2113 The desc contains the GNU Gold linker version used.
2114 .RE
2115 .TP
2116 .B Default/unknown namespace (e_type != ET_CORE)
2117 These are used when the namespace is the default (i.e.,
2118 .I n_namesz
2119 will be set to 0), or a fallback when the namespace is unknown.
2120 .RS
2121 .TP 12
2122 .PD 0
2123 .B NT_VERSION
2124 A version string of some sort.
2125 .TP
2126 .B NT_ARCH
2127 Architecture information.
2128 .PD
2129 .RE
2130 .RE
2131 .SH NOTES
2132 .\" OpenBSD
2133 .\" ELF support first appeared in
2134 .\" OpenBSD 1.2,
2135 .\" although not all supported platforms use it as the native
2136 .\" binary file format.
2137 ELF first appeared in
2138 System V.
2139 The ELF format is an adopted standard.
2140 .PP
2141 The extensions for
2142 .IR e_phnum ,
2143 .IR e_shnum ,
2144 and
2145 .IR e_shstrndx
2146 respectively are
2147 Linux extensions.
2148 Sun, BSD, and AMD64 also support them; for further information,
2149 look under SEE ALSO.
2150 .\" .SH AUTHORS
2151 .\" The original version of this manual page was written by
2152 .\" .An Jeroen Ruigrok van der Werven
2153 .\" .Aq asmodai@FreeBSD.org
2154 .\" with inspiration from BSDi's
2155 .\" .Bsx
2156 .\" .Nm elf
2157 .\" man page.
2158 .SH SEE ALSO
2159 .BR as (1),
2160 .BR elfedit (1),
2161 .BR gdb (1),
2162 .BR ld (1),
2163 .BR nm (1),
2164 .BR objcopy (1),
2165 .BR objdump (1),
2166 .BR patchelf (1),
2167 .BR readelf (1),
2168 .BR size (1),
2169 .BR strings (1),
2170 .BR strip (1),
2171 .BR execve (2),
2172 .BR dl_iterate_phdr (3),
2173 .BR core (5),
2174 .BR ld.so (8)
2175 .PP
2176 Hewlett-Packard,
2177 .IR "Elf-64 Object File Format" .
2178 .PP
2179 Santa Cruz Operation,
2180 .IR "System V Application Binary Interface" .
2181 .PP
2182 UNIX System Laboratories,
2183 "Object Files",
2184 .IR "Executable and Linking Format (ELF)" .
2185 .PP
2186 Sun Microsystems,
2187 .IR "Linker and Libraries Guide" .
2188 .PP
2189 AMD64 ABI Draft,
2190 .IR "System V Application Binary Interface AMD64 Architecture Processor Supplement" .