| blob | 53ebf3fbc9ec74583ba7b7837dff84c0b3b4a632 |
1 .\" $OpenBSD: elf.5,v 1.12 2003/10/27 20:23:58 jmc Exp $
2 .\"Copyright (c) 1999 Jeroen Ruigrok van der Werven
3 .\"All rights reserved.
4 .\"
5 .\" %%%LICENSE_START(PERMISSIVE_MISC)
6 .\"Redistribution and use in source and binary forms, with or without
7 .\"modification, are permitted provided that the following conditions
8 .\"are met:
9 .\"1. Redistributions of source code must retain the above copyright
10 .\" notice, this list of conditions and the following disclaimer.
11 .\"2. Redistributions in binary form must reproduce the above copyright
12 .\" notice, this list of conditions and the following disclaimer in the
13 .\" documentation and/or other materials provided with the distribution.
14 .\"
15 .\"THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 .\"ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 .\"IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 .\"ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 .\"FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 .\"DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 .\"OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 .\"HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 .\"LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 .\"OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 .\"SUCH DAMAGE.
26 .\" %%%LICENSE_END
27 .\"
28 .\" $FreeBSD: src/share/man/man5/elf.5,v 1.21 2001/10/01 16:09:23 ru Exp $
29 .\"
30 .\" Slightly adapted - aeb, 2004-01-01
31 .\" 2005-07-15, Mike Frysinger <vapier@gentoo.org>, various fixes
32 .\" 2007-10-11, Mike Frysinger <vapier@gentoo.org>, various fixes
33 .\" 2007-12-08, mtk, Converted from mdoc to man macros
34 .\"
35 .TH ELF 5 2017-09-15 "Linux" "Linux Programmer's Manual"
36 .SH NAME
37 elf \- format of Executable and Linking Format (ELF) files
38 .SH SYNOPSIS
39 .nf
40 .\" .B #include <elf_abi.h>
41 .B #include <elf.h>
42 .fi
43 .SH DESCRIPTION
44 The header file
45 .I <elf.h>
46 defines the format of ELF executable binary files.
47 Amongst these files are
48 normal executable files, relocatable object files, core files, and shared
49 objects.
50 .PP
51 An executable file using the ELF file format consists of an ELF header,
52 followed by a program header table or a section header table, or both.
53 The ELF header is always at offset zero of the file.
54 The program header
55 table and the section header table's offset in the file are defined in the
56 ELF header.
57 The two tables describe the rest of the particularities of
58 the file.
59 .PP
60 .\" Applications which wish to process ELF binary files for their native
61 .\" architecture only should include
62 .\" .I <elf_abi.h>
63 .\" in their source code.
64 .\" These applications should need to refer to
65 .\" all the types and structures by their generic names
66 .\" "Elf_xxx"
67 .\" and to the macros by
68 .\" ELF_xxx".
69 .\" Applications written this way can be compiled on any architecture,
70 .\" regardless of whether the host is 32-bit or 64-bit.
71 .\" .PP
72 .\" Should an application need to process ELF files of an unknown
73 .\" architecture, then the application needs to explicitly use either
74 .\" "Elf32_xxx"
75 .\" or
76 .\" "Elf64_xxx"
77 .\" type and structure names.
78 .\" Likewise, the macros need to be identified by
79 .\" "ELF32_xxx"
80 .\" or
81 .\" "ELF64_xxx".
82 .\" .PP
83 This header file describes the above mentioned headers as C structures
84 and also includes structures for dynamic sections, relocation sections and
85 symbol tables.
86 .\"
87 .SS Basic types
88 The following types are used for N-bit architectures (N=32,64,
89 .I ElfN
90 stands for
91 .I Elf32
92 or
93 .IR Elf64 ,
94 .I uintN_t
95 stands for
96 .I uint32_t
97 or
98 .IR uint64_t ):
99 .PP
100 .in +4n
101 .EX
102 ElfN_Addr Unsigned program address, uintN_t
103 ElfN_Off Unsigned file offset, uintN_t
104 ElfN_Section Unsigned section index, uint16_t
105 ElfN_Versym Unsigned version symbol information, uint16_t
106 Elf_Byte unsigned char
107 ElfN_Half uint16_t
108 ElfN_Sword int32_t
109 ElfN_Word uint32_t
110 ElfN_Sxword int64_t
111 ElfN_Xword uint64_t
112 .\" Elf32_Size Unsigned object size
113 .EE
114 .in
115 .PP
116 (Note: the *BSD terminology is a bit different.
117 There,
118 .I Elf64_Half
119 is
120 twice as large as
121 .IR Elf32_Half ,
122 and
123 .I Elf64Quarter
124 is used for
125 .IR uint16_t .
126 In order to avoid confusion these types are replaced by explicit ones
127 in the below.)
128 .PP
129 All data structures that the file format defines follow the
130 "natural"
131 size and alignment guidelines for the relevant class.
132 If necessary,
133 data structures contain explicit padding to ensure 4-byte alignment
134 for 4-byte objects, to force structure sizes to a multiple of 4, and so on.
135 .\"
136 .SS ELF header (Ehdr)
137 The ELF header is described by the type
138 .I Elf32_Ehdr
139 or
140 .IR Elf64_Ehdr :
141 .PP
142 .in +4n
143 .EX
144 #define EI_NIDENT 16
146 typedef struct {
147 unsigned char e_ident[EI_NIDENT];
148 uint16_t e_type;
149 uint16_t e_machine;
150 uint32_t e_version;
151 ElfN_Addr e_entry;
152 ElfN_Off e_phoff;
153 ElfN_Off e_shoff;
154 uint32_t e_flags;
155 uint16_t e_ehsize;
156 uint16_t e_phentsize;
157 uint16_t e_phnum;
158 uint16_t e_shentsize;
159 uint16_t e_shnum;
160 uint16_t e_shstrndx;
161 } ElfN_Ehdr;
162 .EE
163 .in
164 .PP
165 The fields have the following meanings:
166 .\"
167 .nr l1_indent 10
168 .\"
169 .TP \n[l1_indent]
170 .IR e_ident
171 This array of bytes specifies how to interpret the file,
172 independent of the processor or the file's remaining contents.
173 Within this array everything is named by macros, which start with
174 the prefix
175 .BR EI_
176 and may contain values which start with the prefix
177 .BR ELF .
178 The following macros are defined:
179 .RS
180 .TP 9
181 .BR EI_MAG0
182 The first byte of the magic number.
183 It must be filled with
184 .BR ELFMAG0 .
185 (0: 0x7f)
186 .TP
187 .BR EI_MAG1
188 The second byte of the magic number.
189 It must be filled with
190 .BR ELFMAG1 .
191 (1: \(aqE\(aq)
192 .TP
193 .BR EI_MAG2
194 The third byte of the magic number.
195 It must be filled with
196 .BR ELFMAG2 .
197 (2: \(aqL\(aq)
198 .TP
199 .BR EI_MAG3
200 The fourth byte of the magic number.
201 It must be filled with
202 .BR ELFMAG3 .
203 (3: \(aqF\(aq)
204 .TP
205 .BR EI_CLASS
206 The fifth byte identifies the architecture for this binary:
207 .RS
208 .TP 14
209 .PD 0
210 .BR ELFCLASSNONE
211 This class is invalid.
212 .TP
213 .BR ELFCLASS32
214 This defines the 32-bit architecture.
215 It supports machines with files
216 and virtual address spaces up to 4 Gigabytes.
217 .TP
218 .BR ELFCLASS64
219 This defines the 64-bit architecture.
220 .PD
221 .RE
222 .TP
223 .BR EI_DATA
224 The sixth byte specifies the data encoding of the processor-specific
225 data in the file.
226 Currently, these encodings are supported:
227 .RS 9
228 .TP 14
229 .PD 0
230 .BR ELFDATANONE
231 Unknown data format.
232 .TP
233 .BR ELFDATA2LSB
234 Two's complement, little-endian.
235 .TP
236 .BR ELFDATA2MSB
237 Two's complement, big-endian.
238 .PD
239 .RE
240 .TP
241 .BR EI_VERSION
242 The seventh byte is the version number of the ELF specification:
243 .IP
244 .PD 0
245 .RS
246 .TP 14
247 .BR EV_NONE
248 Invalid version.
249 .TP
250 .BR EV_CURRENT
251 Current version.
252 .PD
253 .RE
254 .\".El
255 .TP
256 .BR EI_OSABI
257 The eighth byte identifies the operating system
258 and ABI to which the object is targeted.
259 Some fields in other ELF structures have flags
260 and values that have platform-specific meanings;
261 the interpretation of those fields is determined by the value of this byte.
262 For example:
263 .RS
264 .TP 21
265 .PD 0
266 .BR ELFOSABI_NONE
267 Same as ELFOSABI_SYSV
268 .\" 0
269 .TP
270 .BR ELFOSABI_SYSV
271 UNIX System V ABI
272 .\" 0
273 .\" synonym: ELFOSABI_NONE
274 .TP
275 .BR ELFOSABI_HPUX
276 HP-UX ABI
277 .\" 1
278 .TP
279 .BR ELFOSABI_NETBSD
280 NetBSD ABI
281 .\" 2
282 .TP
283 .BR ELFOSABI_LINUX
284 Linux ABI
285 .\" 3
286 .\" .TP
287 .\" .BR ELFOSABI_HURD
288 .\" Hurd ABI
289 .\" 4
290 .\" .TP
291 .\" .BR ELFOSABI_86OPEN
292 .\" 86Open Common IA32 ABI
293 .\" 5
294 .TP
295 .BR ELFOSABI_SOLARIS
296 Solaris ABI
297 .\" 6
298 .\" .TP
299 .\" .BR ELFOSABI_MONTEREY
300 .\" Monterey project ABI
301 .\" Now replaced by
302 .\" ELFOSABI_AIX
303 .\" 7
304 .TP
305 .BR ELFOSABI_IRIX
306 IRIX ABI
307 .\" 8
308 .TP
309 .BR ELFOSABI_FREEBSD
310 FreeBSD ABI
311 .\" 9
312 .TP
313 .BR ELFOSABI_TRU64
314 TRU64 UNIX ABI
315 .\" 10
316 .\" ELFOSABI_MODESTO
317 .\" 11
318 .\" ELFOSABI_OPENBSD
319 .\" 12
320 .TP
321 .BR ELFOSABI_ARM
322 ARM architecture ABI
323 .\" 97
324 .TP
325 .BR ELFOSABI_STANDALONE
326 Stand-alone (embedded) ABI
327 .\" 255
328 .PD
329 .RE
330 .TP
331 .BR EI_ABIVERSION
332 The ninth byte identifies the version of the ABI
333 to which the object is targeted.
334 This field is used to distinguish among incompatible versions of an ABI.
335 The interpretation of this version number
336 is dependent on the ABI identified by the
337 .B EI_OSABI
338 field.
339 Applications conforming to this specification use the value 0.
340 .TP
341 .BR EI_PAD
342 Start of padding.
343 These bytes are reserved and set to zero.
344 Programs
345 which read them should ignore them.
346 The value for
347 .B EI_PAD
348 will change in
349 the future if currently unused bytes are given meanings.
350 .\" As reported by Yuri Kozlov and confirmed by Mike Frysinger, EI_BRAND is
351 .\" not in GABI (http://www.sco.com/developers/gabi/latest/ch4.eheader.html)
352 .\" It looks to be a BSDism
353 .\" .TP
354 .\" .BR EI_BRAND
355 .\" Start of architecture identification.
356 .TP
357 .BR EI_NIDENT
358 The size of the
359 .I e_ident
360 array.
361 .RE
362 .TP
363 .IR e_type
364 This member of the structure identifies the object file type:
365 .RS
366 .TP 16
367 .PD 0
368 .BR ET_NONE
369 An unknown type.
370 .TP
371 .BR ET_REL
372 A relocatable file.
373 .TP
374 .BR ET_EXEC
375 An executable file.
376 .TP
377 .BR ET_DYN
378 A shared object.
379 .TP
380 .BR ET_CORE
381 A core file.
382 .PD
383 .RE
384 .TP
385 .IR e_machine
386 This member specifies the required architecture for an individual file.
387 For example:
388 .RS \n[l1_indent]
389 .TP 16
390 .PD 0
391 .BR EM_NONE
392 An unknown machine
393 .\" 0
394 .TP
395 .BR EM_M32
396 AT&T WE 32100
397 .\" 1
398 .TP
399 .BR EM_SPARC
400 Sun Microsystems SPARC
401 .\" 2
402 .TP
403 .BR EM_386
404 Intel 80386
405 .\" 3
406 .TP
407 .BR EM_68K
408 Motorola 68000
409 .\" 4
410 .TP
411 .BR EM_88K
412 Motorola 88000
413 .\" 5
414 .\" .TP
415 .\" .BR EM_486
416 .\" Intel 80486
417 .\" 6
418 .TP
419 .BR EM_860
420 Intel 80860
421 .\" 7
422 .TP
423 .BR EM_MIPS
424 MIPS RS3000 (big-endian only)
425 .\" 8
426 .\" EM_S370
427 .\" 9
428 .\" .TP
429 .\" .BR EM_MIPS_RS4_BE
430 .\" MIPS RS4000 (big-endian only). Deprecated
431 .\" 10
432 .\" EM_MIPS_RS3_LE (MIPS R3000 little-endian)
433 .\" 10
434 .TP
435 .BR EM_PARISC
436 HP/PA
437 .\" 15
438 .TP
439 .BR EM_SPARC32PLUS
440 SPARC with enhanced instruction set
441 .\" 18
442 .TP
443 .BR EM_PPC
444 PowerPC
445 .\" 20
446 .TP
447 .BR EM_PPC64
448 PowerPC 64-bit
449 .\" 21
450 .TP
451 .BR EM_S390
452 IBM S/390
453 .\" 22
454 .TP
455 .BR EM_ARM
456 Advanced RISC Machines
457 .\" 40
458 .TP
459 .BR EM_SH
460 Renesas SuperH
461 .\" 42
462 .TP
463 .BR EM_SPARCV9
464 SPARC v9 64-bit
465 .\" 43
466 .TP
467 .BR EM_IA_64
468 Intel Itanium
469 .\" 50
470 .TP
471 .BR EM_X86_64
472 AMD x86-64
473 .\" 62
474 .TP
475 .BR EM_VAX
476 DEC Vax
477 .\" 75
478 .\" EM_CRIS
479 .\" 76
480 .\" .TP
481 .\" .BR EM_ALPHA
482 .\" Compaq [DEC] Alpha
483 .\" .TP
484 .\" .BR EM_ALPHA_EXP
485 .\" Compaq [DEC] Alpha with enhanced instruction set
486 .PD
487 .RE
488 .TP
489 .IR e_version
490 This member identifies the file version:
491 .RS
492 .TP 16
493 .PD 0
494 .BR EV_NONE
495 Invalid version
496 .TP
497 .BR EV_CURRENT
498 Current version
499 .PD
500 .RE
501 .TP
502 .IR e_entry
503 This member gives the virtual address to which the system first transfers
504 control, thus starting the process.
505 If the file has no associated entry
506 point, this member holds zero.
507 .TP
508 .IR e_phoff
509 This member holds the program header table's file offset in bytes.
510 If
511 the file has no program header table, this member holds zero.
512 .TP
513 .IR e_shoff
514 This member holds the section header table's file offset in bytes.
515 If the
516 file has no section header table, this member holds zero.
517 .TP
518 .IR e_flags
519 This member holds processor-specific flags associated with the file.
520 Flag names take the form EF_`machine_flag'.
521 Currently, no flags have been defined.
522 .TP
523 .IR e_ehsize
524 This member holds the ELF header's size in bytes.
525 .TP
526 .IR e_phentsize
527 This member holds the size in bytes of one entry in the file's
528 program header table; all entries are the same size.
529 .TP
530 .IR e_phnum
531 This member holds the number of entries in the program header
532 table.
533 Thus the product of
534 .IR e_phentsize
535 and
536 .IR e_phnum
537 gives the table's size
538 in bytes.
539 If a file has no program header,
540 .IR e_phnum
541 holds the value zero.
542 .IP
543 If the number of entries in the program header table is
544 larger than or equal to
545 .\" This is a Linux extension, added in Linux 2.6.34.
546 .BR PN_XNUM
547 (0xffff), this member holds
548 .BR PN_XNUM
549 (0xffff) and the real number of entries in the program header table is held
550 in the
551 .IR sh_info
552 member of the initial entry in section header table.
553 Otherwise, the
554 .IR sh_info
555 member of the initial entry contains the value zero.
556 .RS \n[l1_indent]
557 .TP 9
558 .BR PN_XNUM
559 This is defined as 0xffff, the largest number
560 .IR e_phnum
561 can have, specifying where the actual number of program headers is assigned.
562 .PD
563 .RE
564 .IP
565 .TP
566 .IR e_shentsize
567 This member holds a sections header's size in bytes.
568 A section header is one
569 entry in the section header table; all entries are the same size.
570 .TP
571 .IR e_shnum
572 This member holds the number of entries in the section header table.
573 Thus
574 the product of
575 .IR e_shentsize
576 and
577 .IR e_shnum
578 gives the section header table's size in bytes.
579 If a file has no section
580 header table,
581 .IR e_shnum
582 holds the value of zero.
583 .IP
584 If the number of entries in the section header table is
585 larger than or equal to
586 .BR SHN_LORESERVE
587 (0xff00),
588 .IR e_shnum
589 holds the value zero and the real number of entries in the section header
590 table is held in the
591 .IR sh_size
592 member of the initial entry in section header table.
593 Otherwise, the
594 .IR sh_size
595 member of the initial entry in the section header table holds
596 the value zero.
597 .TP
598 .IR e_shstrndx
599 This member holds the section header table index of the entry associated
600 with the section name string table.
601 If the file has no section name string
602 table, this member holds the value
603 .BR SHN_UNDEF .
604 .IP
605 If the index of section name string table section is
606 larger than or equal to
607 .BR SHN_LORESERVE
608 (0xff00), this member holds
609 .BR SHN_XINDEX
610 (0xffff) and the real index of the section name string table section
611 is held in the
612 .IR sh_link
613 member of the initial entry in section header table.
614 Otherwise, the
615 .IR sh_link
616 member of the initial entry in section header table contains the value zero.
617 .\"
618 .SS Program header (Phdr)
619 An executable or shared object file's program header table is an array of
620 structures, each describing a segment or other information the system needs
621 to prepare the program for execution.
622 An object file
623 .IR segment
624 contains one or more
625 .IR sections .
626 Program headers are meaningful only for executable and shared object files.
627 A file specifies its own program header size with the ELF header's
628 .IR e_phentsize
629 and
630 .IR e_phnum
631 members.
632 The ELF program header is described by the type
633 .I Elf32_Phdr
634 or
635 .I Elf64_Phdr
636 depending on the architecture:
637 .PP
638 .in +4n
639 .EX
640 typedef struct {
641 uint32_t p_type;
642 Elf32_Off p_offset;
643 Elf32_Addr p_vaddr;
644 Elf32_Addr p_paddr;
645 uint32_t p_filesz;
646 uint32_t p_memsz;
647 uint32_t p_flags;
648 uint32_t p_align;
649 } Elf32_Phdr;
650 .EE
651 .in
652 .PP
653 .in +4n
654 .EX
655 typedef struct {
656 uint32_t p_type;
657 uint32_t p_flags;
658 Elf64_Off p_offset;
659 Elf64_Addr p_vaddr;
660 Elf64_Addr p_paddr;
661 uint64_t p_filesz;
662 uint64_t p_memsz;
663 uint64_t p_align;
664 } Elf64_Phdr;
665 .EE
666 .in
667 .PP
668 The main difference between the 32-bit and the 64-bit program header lies
669 in the location of the
670 .IR p_flags
671 member in the total struct.
672 .TP 10
673 .IR p_type
674 This member of the structure indicates what kind of segment this array
675 element describes or how to interpret the array element's information.
676 .RS 10
677 .TP 12
678 .BR PT_NULL
679 The array element is unused and the other members' values are undefined.
680 This lets the program header have ignored entries.
681 .TP
682 .BR PT_LOAD
683 The array element specifies a loadable segment, described by
684 .IR p_filesz
685 and
686 .IR p_memsz .
687 The bytes from the file are mapped to the beginning of the memory
688 segment.
689 If the segment's memory size
690 .IR p_memsz
691 is larger than the file size
692 .IR p_filesz ,
693 the
694 "extra"
695 bytes are defined to hold the value 0 and to follow the segment's
696 initialized area.
697 The file size may not be larger than the memory size.
698 Loadable segment entries in the program header table appear in ascending
699 order, sorted on the
700 .IR p_vaddr
701 member.
702 .TP
703 .BR PT_DYNAMIC
704 The array element specifies dynamic linking information.
705 .TP
706 .BR PT_INTERP
707 The array element specifies the location and size of a null-terminated
708 pathname to invoke as an interpreter.
709 This segment type is meaningful
710 only for executable files (though it may occur for shared objects).
711 However it may not occur more than once in a file.
712 If it is present, it must precede any loadable segment entry.
713 .TP
714 .BR PT_NOTE
715 The array element specifies the location of notes (ElfN_Nhdr).
716 .TP
717 .BR PT_SHLIB
718 This segment type is reserved but has unspecified semantics.
719 Programs that
720 contain an array element of this type do not conform to the ABI.
721 .TP
722 .BR PT_PHDR
723 The array element, if present,
724 specifies the location and size of the program header table itself,
725 both in the file and in the memory image of the program.
726 This segment type may not occur more than once in a file.
727 Moreover, it may
728 occur only if the program header table is part of the memory image of the
729 program.
730 If it is present, it must precede any loadable segment entry.
731 .TP
732 .BR PT_LOPROC ", " PT_HIPROC
733 Values in the inclusive range
734 .RB [ PT_LOPROC ", " PT_HIPROC ]
735 are reserved for processor-specific semantics.
736 .TP
737 .BR PT_GNU_STACK
738 GNU extension which is used by the Linux kernel to control the state of the
739 stack via the flags set in the
740 .IR p_flags
741 member.
742 .RE
743 .TP
744 .IR p_offset
745 This member holds the offset from the beginning of the file at which
746 the first byte of the segment resides.
747 .TP
748 .IR p_vaddr
749 This member holds the virtual address at which the first byte of the
750 segment resides in memory.
751 .TP
752 .IR p_paddr
753 On systems for which physical addressing is relevant, this member is
754 reserved for the segment's physical address.
755 Under
756 BSD
757 this member is
758 not used and must be zero.
759 .TP
760 .IR p_filesz
761 This member holds the number of bytes in the file image of the segment.
762 It may be zero.
763 .TP
764 .IR p_memsz
765 This member holds the number of bytes in the memory image of the segment.
766 It may be zero.
767 .TP
768 .IR p_flags
769 This member holds a bit mask of flags relevant to the segment:
770 .RS \n[l1_indent]
771 .TP
772 .PD 0
773 .BR PF_X
774 An executable segment.
775 .TP
776 .BR PF_W
777 A writable segment.
778 .TP
779 .BR PF_R
780 A readable segment.
781 .PD
782 .RE
783 .IP
784 A text segment commonly has the flags
785 .BR PF_X
786 and
787 .BR PF_R .
788 A data segment commonly has
789 .BR PF_X ,
790 .BR PF_W ,
791 and
792 .BR PF_R .
793 .TP
794 .IR p_align
795 This member holds the value to which the segments are aligned in memory
796 and in the file.
797 Loadable process segments must have congruent values for
798 .IR p_vaddr
799 and
800 .IR p_offset ,
801 modulo the page size.
802 Values of zero and one mean no alignment is required.
803 Otherwise,
804 .IR p_align
805 should be a positive, integral power of two, and
806 .IR p_vaddr
807 should equal
808 .IR p_offset ,
809 modulo
810 .IR p_align .
811 .\"
812 .SS Section header (Shdr)
813 A file's section header table lets one locate all the file's sections.
814 The
815 section header table is an array of
816 .I Elf32_Shdr
817 or
818 .I Elf64_Shdr
819 structures.
820 The
821 ELF header's
822 .IR e_shoff
823 member gives the byte offset from the beginning of the file to the section
824 header table.
825 .IR e_shnum
826 holds the number of entries the section header table contains.
827 .IR e_shentsize
828 holds the size in bytes of each entry.
829 .PP
830 A section header table index is a subscript into this array.
831 Some section
832 header table indices are reserved:
833 the initial entry and the indices between
834 .B SHN_LORESERVE
835 and
836 .BR SHN_HIRESERVE .
837 The initial entry is used in ELF extensions for
838 .IR e_phnum ,
839 .IR e_shnum
840 and
841 .IR e_strndx ;
842 in other cases, each field in the initial entry is set to zero.
843 An object file does not have sections for
844 these special indices:
845 .TP
846 .BR SHN_UNDEF
847 This value marks an undefined, missing, irrelevant,
848 or otherwise meaningless section reference.
849 .TP
850 .BR SHN_LORESERVE
851 This value specifies the lower bound of the range of reserved indices.
852 .TP
853 .BR SHN_LOPROC ", " SHN_HIPROC
854 Values greater in the inclusive range
855 .RB [ SHN_LOPROC ", " SHN_HIPROC ]
856 are reserved for processor-specific semantics.
857 .TP
858 .BR SHN_ABS
859 This value specifies the absolute value for the corresponding reference.
860 For
861 example, a symbol defined relative to section number
862 .BR SHN_ABS
863 has an absolute value and is not affected by relocation.
864 .TP
865 .BR SHN_COMMON
866 Symbols defined relative to this section are common symbols,
867 such as FORTRAN COMMON or unallocated C external variables.
868 .TP
869 .BR SHN_HIRESERVE
870 This value specifies the upper bound of the range of reserved indices.
871 The
872 system reserves indices between
873 .BR SHN_LORESERVE
874 and
875 .BR SHN_HIRESERVE ,
876 inclusive.
877 The section header table does not contain entries for the
878 reserved indices.
879 .PP
880 The section header has the following structure:
881 .PP
882 .in +4n
883 .EX
884 typedef struct {
885 uint32_t sh_name;
886 uint32_t sh_type;
887 uint32_t sh_flags;
888 Elf32_Addr sh_addr;
889 Elf32_Off sh_offset;
890 uint32_t sh_size;
891 uint32_t sh_link;
892 uint32_t sh_info;
893 uint32_t sh_addralign;
894 uint32_t sh_entsize;
895 } Elf32_Shdr;
896 .EE
897 .in
898 .PP
899 .in +4n
900 .EX
901 typedef struct {
902 uint32_t sh_name;
903 uint32_t sh_type;
904 uint64_t sh_flags;
905 Elf64_Addr sh_addr;
906 Elf64_Off sh_offset;
907 uint64_t sh_size;
908 uint32_t sh_link;
909 uint32_t sh_info;
910 uint64_t sh_addralign;
911 uint64_t sh_entsize;
912 } Elf64_Shdr;
913 .EE
914 .in
915 .PP
916 No real differences exist between the 32-bit and 64-bit section headers.
917 .TP \n[l1_indent]
918 .IR sh_name
919 This member specifies the name of the section.
920 Its value is an index
921 into the section header string table section, giving the location of
922 a null-terminated string.
923 .TP
924 .IR sh_type
925 This member categorizes the section's contents and semantics.
926 .RS \n[l1_indent]
927 .TP 15
928 .BR SHT_NULL
929 This value marks the section header as inactive.
930 It does not
931 have an associated section.
932 Other members of the section header
933 have undefined values.
934 .TP
935 .BR SHT_PROGBITS
936 This section holds information defined by the program, whose
937 format and meaning are determined solely by the program.
938 .TP
939 .BR SHT_SYMTAB
940 This section holds a symbol table.
941 Typically,
942 .BR SHT_SYMTAB
943 provides symbols for link editing, though it may also be used
944 for dynamic linking.
945 As a complete symbol table, it may contain
946 many symbols unnecessary for dynamic linking.
947 An object file can
948 also contain a
949 .BR SHT_DYNSYM
950 section.
951 .TP
952 .BR SHT_STRTAB
953 This section holds a string table.
954 An object file may have multiple
955 string table sections.
956 .TP
957 .BR SHT_RELA
958 This section holds relocation entries with explicit addends, such
959 as type
960 .IR Elf32_Rela
961 for the 32-bit class of object files.
962 An object may have multiple
963 relocation sections.
964 .TP
965 .BR SHT_HASH
966 This section holds a symbol hash table.
967 An object participating in
968 dynamic linking must contain a symbol hash table.
969 An object file may
970 have only one hash table.
971 .TP
972 .BR SHT_DYNAMIC
973 This section holds information for dynamic linking.
974 An object file may
975 have only one dynamic section.
976 .TP
977 .BR SHT_NOTE
978 This section holds notes (ElfN_Nhdr).
979 .TP
980 .BR SHT_NOBITS
981 A section of this type occupies no space in the file but otherwise
982 resembles
983 .BR SHT_PROGBITS .
984 Although this section contains no bytes, the
985 .IR sh_offset
986 member contains the conceptual file offset.
987 .TP
988 .BR SHT_REL
989 This section holds relocation offsets without explicit addends, such
990 as type
991 .IR Elf32_Rel
992 for the 32-bit class of object files.
993 An object file may have multiple
994 relocation sections.
995 .TP
996 .BR SHT_SHLIB
997 This section is reserved but has unspecified semantics.
998 .TP
999 .BR SHT_DYNSYM
1000 This section holds a minimal set of dynamic linking symbols.
1001 An
1002 object file can also contain a
1003 .BR SHT_SYMTAB
1004 section.
1005 .TP
1006 .BR SHT_LOPROC ", " SHT_HIPROC
1007 Values in the inclusive range
1008 .RB [ SHT_LOPROC ", " SHT_HIPROC ]
1009 are reserved for processor-specific semantics.
1010 .TP
1011 .BR SHT_LOUSER
1012 This value specifies the lower bound of the range of indices reserved for
1013 application programs.
1014 .TP
1015 .BR SHT_HIUSER
1016 This value specifies the upper bound of the range of indices reserved for
1017 application programs.
1018 Section types between
1019 .BR SHT_LOUSER
1020 and
1021 .BR SHT_HIUSER
1022 may be used by the application, without conflicting with current or future
1023 system-defined section types.
1024 .RE
1025 .TP
1026 .IR sh_flags
1027 Sections support one-bit flags that describe miscellaneous attributes.
1028 If a flag bit is set in
1029 .IR sh_flags ,
1030 the attribute is
1031 "on"
1032 for the section.
1033 Otherwise, the attribute is
1034 "off"
1035 or does not apply.
1036 Undefined attributes are set to zero.
1037 .RS \n[l1_indent]
1038 .TP 15
1039 .BR SHF_WRITE
1040 This section contains data that should be writable during process
1041 execution.
1042 .TP
1043 .BR SHF_ALLOC
1044 This section occupies memory during process execution.
1045 Some control
1046 sections do not reside in the memory image of an object file.
1047 This
1048 attribute is off for those sections.
1049 .TP
1050 .BR SHF_EXECINSTR
1051 This section contains executable machine instructions.
1052 .TP
1053 .BR SHF_MASKPROC
1054 All bits included in this mask are reserved for processor-specific
1055 semantics.
1056 .RE
1057 .TP
1058 .IR sh_addr
1059 If this section appears in the memory image of a process, this member
1060 holds the address at which the section's first byte should reside.
1061 Otherwise, the member contains zero.
1062 .TP
1063 .IR sh_offset
1064 This member's value holds the byte offset from the beginning of the file
1065 to the first byte in the section.
1066 One section type,
1067 .BR SHT_NOBITS ,
1068 occupies no space in the file, and its
1069 .IR sh_offset
1070 member locates the conceptual placement in the file.
1071 .TP
1072 .IR sh_size
1073 This member holds the section's size in bytes.
1074 Unless the section type
1075 is
1076 .BR SHT_NOBITS ,
1077 the section occupies
1078 .IR sh_size
1079 bytes in the file.
1080 A section of type
1081 .BR SHT_NOBITS
1082 may have a nonzero size, but it occupies no space in the file.
1083 .TP
1084 .IR sh_link
1085 This member holds a section header table index link, whose interpretation
1086 depends on the section type.
1087 .TP
1088 .IR sh_info
1089 This member holds extra information, whose interpretation depends on the
1090 section type.
1091 .TP
1092 .IR sh_addralign
1093 Some sections have address alignment constraints.
1094 If a section holds a
1095 doubleword, the system must ensure doubleword alignment for the entire
1096 section.
1097 That is, the value of
1098 .IR sh_addr
1099 must be congruent to zero, modulo the value of
1100 .IR sh_addralign .
1101 Only zero and positive integral powers of two are allowed.
1102 The value 0 or 1 means that the section has no alignment constraints.
1103 .TP
1104 .IR sh_entsize
1105 Some sections hold a table of fixed-sized entries, such as a symbol table.
1106 For such a section, this member gives the size in bytes for each entry.
1107 This member contains zero if the section does not hold a table of
1108 fixed-size entries.
1109 .PP
1110 Various sections hold program and control information:
1111 .TP \n[l1_indent]
1112 .IR .bss
1113 This section holds uninitialized data that contributes to the program's
1114 memory image.
1115 By definition, the system initializes the data with zeros
1116 when the program begins to run.
1117 This section is of type
1118 .BR SHT_NOBITS .
1119 The attribute types are
1120 .BR SHF_ALLOC
1121 and
1122 .BR SHF_WRITE .
1123 .TP
1124 .IR .comment
1125 This section holds version control information.
1126 This section is of type
1127 .BR SHT_PROGBITS .
1128 No attribute types are used.
1129 .TP
1130 .IR .ctors
1131 This section holds initialized pointers to the C++ constructor functions.
1132 This section is of type
1133 .BR SHT_PROGBITS .
1134 The attribute types are
1135 .BR SHF_ALLOC
1136 and
1137 .BR SHF_WRITE .
1138 .TP
1139 .IR .data
1140 This section holds initialized data that contribute to the program's
1141 memory image.
1142 This section is of type
1143 .BR SHT_PROGBITS .
1144 The attribute types are
1145 .BR SHF_ALLOC
1146 and
1147 .BR SHF_WRITE .
1148 .TP
1149 .IR .data1
1150 This section holds initialized data that contribute to the program's
1151 memory image.
1152 This section is of type
1153 .BR SHT_PROGBITS .
1154 The attribute types are
1155 .BR SHF_ALLOC
1156 and
1157 .BR SHF_WRITE .
1158 .TP
1159 .IR .debug
1160 This section holds information for symbolic debugging.
1161 The contents
1162 are unspecified.
1163 This section is of type
1164 .BR SHT_PROGBITS .
1165 No attribute types are used.
1166 .TP
1167 .IR .dtors
1168 This section holds initialized pointers to the C++ destructor functions.
1169 This section is of type
1170 .BR SHT_PROGBITS .
1171 The attribute types are
1172 .BR SHF_ALLOC
1173 and
1174 .BR SHF_WRITE .
1175 .TP
1176 .IR .dynamic
1177 This section holds dynamic linking information.
1178 The section's attributes
1179 will include the
1180 .BR SHF_ALLOC
1181 bit.
1182 Whether the
1183 .BR SHF_WRITE
1184 bit is set is processor-specific.
1185 This section is of type
1186 .BR SHT_DYNAMIC .
1187 See the attributes above.
1188 .TP
1189 .IR .dynstr
1190 This section holds strings needed for dynamic linking, most commonly
1191 the strings that represent the names associated with symbol table entries.
1192 This section is of type
1193 .BR SHT_STRTAB .
1194 The attribute type used is
1195 .BR SHF_ALLOC .
1196 .TP
1197 .IR .dynsym
1198 This section holds the dynamic linking symbol table.
1199 This section is of type
1200 .BR SHT_DYNSYM .
1201 The attribute used is
1202 .BR SHF_ALLOC .
1203 .TP
1204 .IR .fini
1205 This section holds executable instructions that contribute to the process
1206 termination code.
1207 When a program exits normally the system arranges to
1208 execute the code in this section.
1209 This section is of type
1210 .BR SHT_PROGBITS .
1211 The attributes used are
1212 .BR SHF_ALLOC
1213 and
1214 .BR SHF_EXECINSTR .
1215 .TP
1216 .IR .gnu.version
1217 This section holds the version symbol table, an array of
1218 .I ElfN_Half
1219 elements.
1220 This section is of type
1221 .BR SHT_GNU_versym .
1222 The attribute type used is
1223 .BR SHF_ALLOC .
1224 .TP
1225 .IR .gnu.version_d
1226 This section holds the version symbol definitions, a table of
1227 .I ElfN_Verdef
1228 structures.
1229 This section is of type
1230 .BR SHT_GNU_verdef .
1231 The attribute type used is
1232 .BR SHF_ALLOC .
1233 .TP
1234 .IR .gnu.version_r
1235 This section holds the version symbol needed elements, a table of
1236 .I ElfN_Verneed
1237 structures.
1238 This section is of
1239 type
1240 .BR SHT_GNU_versym .
1241 The attribute type used is
1242 .BR SHF_ALLOC .
1243 .TP
1244 .IR .got
1245 This section holds the global offset table.
1246 This section is of type
1247 .BR SHT_PROGBITS .
1248 The attributes are processor-specific.
1249 .TP
1250 .IR .hash
1251 This section holds a symbol hash table.
1252 This section is of type
1253 .BR SHT_HASH .
1254 The attribute used is
1255 .BR SHF_ALLOC .
1256 .TP
1257 .IR .init
1258 This section holds executable instructions that contribute to the process
1259 initialization code.
1260 When a program starts to run the system arranges to execute
1261 the code in this section before calling the main program entry point.
1262 This section is of type
1263 .BR SHT_PROGBITS .
1264 The attributes used are
1265 .BR SHF_ALLOC
1266 and
1267 .BR SHF_EXECINSTR .
1268 .TP
1269 .IR .interp
1270 This section holds the pathname of a program interpreter.
1271 If the file has
1272 a loadable segment that includes the section, the section's attributes will
1273 include the
1274 .BR SHF_ALLOC
1275 bit.
1276 Otherwise, that bit will be off.
1277 This section is of type
1278 .BR SHT_PROGBITS .
1279 .TP
1280 .IR .line
1281 This section holds line number information for symbolic debugging,
1282 which describes the correspondence between the program source and
1283 the machine code.
1284 The contents are unspecified.
1285 This section is of type
1286 .BR SHT_PROGBITS .
1287 No attribute types are used.
1288 .TP
1289 .IR .note
1290 This section holds various notes.
1291 This section is of type
1292 .BR SHT_NOTE .
1293 No attribute types are used.
1294 .TP
1295 .IR .note.ABI-tag
1296 This section is used to declare the expected runtime ABI of the ELF image.
1297 It may include the operating system name and its runtime versions.
1298 This section is of type
1299 .BR SHT_NOTE .
1300 The only attribute used is
1301 .BR SHF_ALLOC .
1302 .TP
1303 .IR .note.gnu.build-id
1304 This section is used to hold an ID that uniquely identifies
1305 the contents of the ELF image.
1306 Different files with the same build ID should contain the same executable
1307 content.
1308 See the
1309 .BR \-\-build\-id
1310 option to the GNU linker (\fBld\fR (1)) for more details.
1311 This section is of type
1312 .BR SHT_NOTE .
1313 The only attribute used is
1314 .BR SHF_ALLOC .
1315 .TP
1316 .IR .note.GNU-stack
1317 This section is used in Linux object files for declaring stack attributes.
1318 This section is of type
1319 .BR SHT_PROGBITS .
1320 The only attribute used is
1321 .BR SHF_EXECINSTR .
1322 This indicates to the GNU linker that the object file requires an
1323 executable stack.
1324 .TP
1325 .IR .note.openbsd.ident
1326 OpenBSD native executables usually contain this section
1327 to identify themselves so the kernel can bypass any compatibility
1328 ELF binary emulation tests when loading the file.
1329 .TP
1330 .IR .plt
1331 This section holds the procedure linkage table.
1332 This section is of type
1333 .BR SHT_PROGBITS .
1334 The attributes are processor-specific.
1335 .TP
1336 .IR .relNAME
1337 This section holds relocation information as described below.
1338 If the file
1339 has a loadable segment that includes relocation, the section's attributes
1340 will include the
1341 .BR SHF_ALLOC
1342 bit.
1343 Otherwise, the bit will be off.
1344 By convention,
1345 "NAME"
1346 is supplied by the section to which the relocations apply.
1347 Thus a relocation
1348 section for
1349 .BR .text
1350 normally would have the name
1351 .BR .rel.text .
1352 This section is of type
1353 .BR SHT_REL .
1354 .TP
1355 .IR .relaNAME
1356 This section holds relocation information as described below.
1357 If the file
1358 has a loadable segment that includes relocation, the section's attributes
1359 will include the
1360 .BR SHF_ALLOC
1361 bit.
1362 Otherwise, the bit will be off.
1363 By convention,
1364 "NAME"
1365 is supplied by the section to which the relocations apply.
1366 Thus a relocation
1367 section for
1368 .BR .text
1369 normally would have the name
1370 .BR .rela.text .
1371 This section is of type
1372 .BR SHT_RELA .
1373 .TP
1374 .IR .rodata
1375 This section holds read-only data that typically contributes to a
1376 nonwritable segment in the process image.
1377 This section is of type
1378 .BR SHT_PROGBITS .
1379 The attribute used is
1380 .BR SHF_ALLOC .
1381 .TP
1382 .IR .rodata1
1383 This section holds read-only data that typically contributes to a
1384 nonwritable segment in the process image.
1385 This section is of type
1386 .BR SHT_PROGBITS .
1387 The attribute used is
1388 .BR SHF_ALLOC .
1389 .TP
1390 .IR .shstrtab
1391 This section holds section names.
1392 This section is of type
1393 .BR SHT_STRTAB .
1394 No attribute types are used.
1395 .TP
1396 .IR .strtab
1397 This section holds strings, most commonly the strings that represent the
1398 names associated with symbol table entries.
1399 If the file has a loadable
1400 segment that includes the symbol string table, the section's attributes
1401 will include the
1402 .BR SHF_ALLOC
1403 bit.
1404 Otherwise, the bit will be off.
1405 This section is of type
1406 .BR SHT_STRTAB .
1407 .TP
1408 .IR .symtab
1409 This section holds a symbol table.
1410 If the file has a loadable segment
1411 that includes the symbol table, the section's attributes will include
1412 the
1413 .BR SHF_ALLOC
1414 bit.
1415 Otherwise, the bit will be off.
1416 This section is of type
1417 .BR SHT_SYMTAB .
1418 .TP
1419 .IR .text
1420 This section holds the
1421 "text",
1422 or executable instructions, of a program.
1423 This section is of type
1424 .BR SHT_PROGBITS .
1425 The attributes used are
1426 .BR SHF_ALLOC
1427 and
1428 .BR SHF_EXECINSTR .
1429 .\"
1430 .SS String and symbol tables
1431 String table sections hold null-terminated character sequences, commonly
1432 called strings.
1433 The object file uses these strings to represent symbol
1434 and section names.
1435 One references a string as an index into the string
1436 table section.
1437 The first byte, which is index zero, is defined to hold
1438 a null byte (\(aq\\0\(aq).
1439 Similarly, a string table's last byte is defined to
1440 hold a null byte, ensuring null termination for all strings.
1441 .PP
1442 An object file's symbol table holds information needed to locate and
1443 relocate a program's symbolic definitions and references.
1444 A symbol table
1445 index is a subscript into this array.
1446 .PP
1447 .in +4n
1448 .EX
1449 typedef struct {
1450 uint32_t st_name;
1451 Elf32_Addr st_value;
1452 uint32_t st_size;
1453 unsigned char st_info;
1454 unsigned char st_other;
1455 uint16_t st_shndx;
1456 } Elf32_Sym;
1457 .EE
1458 .in
1459 .PP
1460 .in +4n
1461 .EX
1462 typedef struct {
1463 uint32_t st_name;
1464 unsigned char st_info;
1465 unsigned char st_other;
1466 uint16_t st_shndx;
1467 Elf64_Addr st_value;
1468 uint64_t st_size;
1469 } Elf64_Sym;
1470 .EE
1471 .in
1472 .PP
1473 The 32-bit and 64-bit versions have the same members, just in a different
1474 order.
1475 .TP \n[l1_indent]
1476 .IR st_name
1477 This member holds an index into the object file's symbol string table,
1478 which holds character representations of the symbol names.
1479 If the value
1480 is nonzero, it represents a string table index that gives the symbol
1481 name.
1482 Otherwise, the symbol has no name.
1483 .TP
1484 .IR st_value
1485 This member gives the value of the associated symbol.
1486 .TP
1487 .IR st_size
1488 Many symbols have associated sizes.
1489 This member holds zero if the symbol
1490 has no size or an unknown size.
1491 .TP
1492 .IR st_info
1493 This member specifies the symbol's type and binding attributes:
1494 .RS \n[l1_indent]
1495 .TP 12
1496 .BR STT_NOTYPE
1497 The symbol's type is not defined.
1498 .TP
1499 .BR STT_OBJECT
1500 The symbol is associated with a data object.
1501 .TP
1502 .BR STT_FUNC
1503 The symbol is associated with a function or other executable code.
1504 .TP
1505 .BR STT_SECTION
1506 The symbol is associated with a section.
1507 Symbol table entries of
1508 this type exist primarily for relocation and normally have
1509 .BR STB_LOCAL
1510 bindings.
1511 .TP
1512 .BR STT_FILE
1513 By convention, the symbol's name gives the name of the source file
1514 associated with the object file.
1515 A file symbol has
1516 .BR STB_LOCAL
1517 bindings, its section index is
1518 .BR SHN_ABS ,
1519 and it precedes the other
1520 .BR STB_LOCAL
1521 symbols of the file, if it is present.
1522 .TP
1523 .BR STT_LOPROC ", " STT_HIPROC
1524 Values in the inclusive range
1525 .RB [ STT_LOPROC ", " STT_HIPROC ]
1526 are reserved for processor-specific semantics.
1527 .TP
1528 .BR STB_LOCAL
1529 Local symbols are not visible outside the object file containing their
1530 definition.
1531 Local symbols of the same name may exist in multiple files
1532 without interfering with each other.
1533 .TP
1534 .BR STB_GLOBAL
1535 Global symbols are visible to all object files being combined.
1536 One file's
1537 definition of a global symbol will satisfy another file's undefined
1538 reference to the same symbol.
1539 .TP
1540 .BR STB_WEAK
1541 Weak symbols resemble global symbols, but their definitions have lower
1542 precedence.
1543 .TP
1544 .BR STB_LOPROC ", " STB_HIPROC
1545 Values in the inclusive range
1546 .RB [ STB_LOPROC ", " STB_HIPROC ]
1547 are reserved for processor-specific semantics.
1548 .RE
1549 .IP
1550 There are macros for packing and unpacking the binding and type fields:
1551 .RS \n[l1_indent]
1552 .TP
1553 .BR ELF32_ST_BIND( \fIinfo\fP ) ", " ELF64_ST_BIND( \fIinfo\fP )
1554 Extract a binding from an
1555 .I st_info
1556 value.
1557 .TP
1558 .BR ELF32_ST_TYPE( \fIinfo ) ", " ELF64_ST_TYPE( \fIinfo\fP )
1559 Extract a type from an
1560 .I st_info
1561 value.
1562 .TP
1563 .BR ELF32_ST_INFO( \fIbind\fP ", " \fItype\fP ) ", " \
1564 ELF64_ST_INFO( \fIbind\fP ", " \fItype\fP )
1565 Convert a binding and a type into an
1566 .I st_info
1567 value.
1568 .RE
1569 .TP
1570 .IR st_other
1571 This member defines the symbol visibility.
1572 .RS \n[l1_indent]
1573 .TP 16
1574 .PD 0
1575 .BR STV_DEFAULT
1576 Default symbol visibility rules.
1577 Global and weak symbols are available to other modules;
1578 references in the local module can be interposed
1579 by definitions in other modules.
1580 .TP
1581 .BR STV_INTERNAL
1582 Processor-specific hidden class.
1583 .TP
1584 .BR STV_HIDDEN
1585 Symbol is unavailable to other modules;
1586 references in the local module always resolve to the local symbol
1587 (i.e., the symbol can't be interposed by definitions in other modules).
1588 .TP
1589 .BR STV_PROTECTED
1590 Symbol is available to other modules,
1591 but references in the local module always resolve to the local symbol.
1592 .PD
1593 .PP
1594 There are macros for extracting the visibility type:
1595 .PP
1596 .BR ELF32_ST_VISIBILITY (other)
1597 or
1598 .BR ELF64_ST_VISIBILITY (other)
1599 .RE
1600 .TP
1601 .IR st_shndx
1602 Every symbol table entry is
1603 "defined"
1604 in relation to some section.
1605 This member holds the relevant section
1606 header table index.
1607 .\"
1608 .SS Relocation entries (Rel & Rela)
1609 Relocation is the process of connecting symbolic references with
1610 symbolic definitions.
1611 Relocatable files must have information that
1612 describes how to modify their section contents, thus allowing executable
1613 and shared object files to hold the right information for a process's
1614 program image.
1615 Relocation entries are these data.
1616 .PP
1617 Relocation structures that do not need an addend:
1618 .PP
1619 .in +4n
1620 .EX
1621 typedef struct {
1622 Elf32_Addr r_offset;
1623 uint32_t r_info;
1624 } Elf32_Rel;
1625 .EE
1626 .in
1627 .PP
1628 .in +4n
1629 .EX
1630 typedef struct {
1631 Elf64_Addr r_offset;
1632 uint64_t r_info;
1633 } Elf64_Rel;
1634 .EE
1635 .in
1636 .PP
1637 Relocation structures that need an addend:
1638 .PP
1639 .in +4n
1640 .EX
1641 typedef struct {
1642 Elf32_Addr r_offset;
1643 uint32_t r_info;
1644 int32_t r_addend;
1645 } Elf32_Rela;
1646 .EE
1647 .in
1648 .PP
1649 .in +4n
1650 .EX
1651 typedef struct {
1652 Elf64_Addr r_offset;
1653 uint64_t r_info;
1654 int64_t r_addend;
1655 } Elf64_Rela;
1656 .EE
1657 .in
1658 .TP \n[l1_indent]
1659 .IR r_offset
1660 This member gives the location at which to apply the relocation action.
1661 For a relocatable file, the value is the byte offset from the beginning
1662 of the section to the storage unit affected by the relocation.
1663 For an
1664 executable file or shared object, the value is the virtual address of
1665 the storage unit affected by the relocation.
1666 .TP
1667 .IR r_info
1668 This member gives both the symbol table index with respect to which the
1669 relocation must be made and the type of relocation to apply.
1670 Relocation
1671 types are processor-specific.
1672 When the text refers to a relocation
1673 entry's relocation type or symbol table index, it means the result of
1674 applying
1675 .BR ELF[32|64]_R_TYPE
1676 or
1677 .BR ELF[32|64]_R_SYM ,
1678 respectively, to the entry's
1679 .IR r_info
1680 member.
1681 .TP
1682 .IR r_addend
1683 This member specifies a constant addend used to compute the value to be
1684 stored into the relocatable field.
1685 .\"
1686 .SS Dynamic tags (Dyn)
1687 The
1688 .I .dynamic
1689 section contains a series of structures that hold relevant
1690 dynamic linking information.
1691 The
1692 .I d_tag
1693 member controls the interpretation
1694 of
1695 .IR d_un .
1696 .PP
1697 .in +4n
1698 .EX
1699 typedef struct {
1700 Elf32_Sword d_tag;
1701 union {
1702 Elf32_Word d_val;
1703 Elf32_Addr d_ptr;
1704 } d_un;
1705 } Elf32_Dyn;
1706 extern Elf32_Dyn _DYNAMIC[];
1707 .EE
1708 .in
1709 .PP
1710 .in +4n
1711 .EX
1712 typedef struct {
1713 Elf64_Sxword d_tag;
1714 union {
1715 Elf64_Xword d_val;
1716 Elf64_Addr d_ptr;
1717 } d_un;
1718 } Elf64_Dyn;
1719 extern Elf64_Dyn _DYNAMIC[];
1720 .EE
1721 .in
1722 .TP \n[l1_indent]
1723 .IR d_tag
1724 This member may have any of the following values:
1725 .RS \n[l1_indent]
1726 .TP 12
1727 .BR DT_NULL
1728 Marks end of dynamic section
1729 .TP
1730 .BR DT_NEEDED
1731 String table offset to name of a needed library
1732 .TP
1733 .BR DT_PLTRELSZ
1734 Size in bytes of PLT relocation entries
1735 .TP
1736 .BR DT_PLTGOT
1737 Address of PLT and/or GOT
1738 .TP
1739 .BR DT_HASH
1740 Address of symbol hash table
1741 .TP
1742 .BR DT_STRTAB
1743 Address of string table
1744 .TP
1745 .BR DT_SYMTAB
1746 Address of symbol table
1747 .TP
1748 .BR DT_RELA
1749 Address of Rela relocation table
1750 .TP
1751 .BR DT_RELASZ
1752 Size in bytes of the Rela relocation table
1753 .TP
1754 .BR DT_RELAENT
1755 Size in bytes of a Rela relocation table entry
1756 .TP
1757 .BR DT_STRSZ
1758 Size in bytes of string table
1759 .TP
1760 .BR DT_SYMENT
1761 Size in bytes of a symbol table entry
1762 .TP
1763 .BR DT_INIT
1764 Address of the initialization function
1765 .TP
1766 .BR DT_FINI
1767 Address of the termination function
1768 .TP
1769 .BR DT_SONAME
1770 String table offset to name of shared object
1771 .TP
1772 .BR DT_RPATH
1773 String table offset to library search path (deprecated)
1774 .TP
1775 .BR DT_SYMBOLIC
1776 Alert linker to search this shared object before the executable for symbols
1777 .TP
1778 .BR DT_REL
1779 Address of Rel relocation table
1780 .TP
1781 .BR DT_RELSZ
1782 Size in bytes of Rel relocation table
1783 .TP
1784 .BR DT_RELENT
1785 Size in bytes of a Rel table entry
1786 .TP
1787 .BR DT_PLTREL
1788 Type of relocation entry to which the PLT refers (Rela or Rel)
1789 .TP
1790 .BR DT_DEBUG
1791 Undefined use for debugging
1792 .TP
1793 .BR DT_TEXTREL
1794 Absence of this entry indicates that no relocation entries should
1795 apply to a nonwritable segment
1796 .TP
1797 .BR DT_JMPREL
1798 Address of relocation entries associated solely with the PLT
1799 .TP
1800 .BR DT_BIND_NOW
1801 Instruct dynamic linker to process all relocations before
1802 transferring control to the executable
1803 .TP
1804 .BR DT_RUNPATH
1805 String table offset to library search path
1806 .TP
1807 .BR DT_LOPROC ", " DT_HIPROC
1808 Values in the inclusive range
1809 .RB [ DT_LOPROC ", " DT_HIPROC ]
1810 are reserved for processor-specific semantics
1811 .RE
1812 .TP
1813 .IR d_val
1814 This member represents integer values with various interpretations.
1815 .TP
1816 .IR d_ptr
1817 This member represents program virtual addresses.
1818 When interpreting
1819 these addresses, the actual address should be computed based on the
1820 original file value and memory base address.
1821 Files do not contain
1822 relocation entries to fixup these addresses.
1823 .TP
1824 .I _DYNAMIC
1825 Array containing all the dynamic structures in the
1826 .I .dynamic
1827 section.
1828 This is automatically populated by the linker.
1829 .\" GABI ELF Reference for Note Sections:
1830 .\" http://www.sco.com/developers/gabi/latest/ch5.pheader.html#note_section
1831 .\"
1832 .\" Note that it implies the sizes and alignments of notes depend on the ELF
1833 .\" size (e.g. 32-bit ELFs have three 4-byte words and use 4-byte alignment
1834 .\" while 64-bit ELFs use 8-byte words & alignment), but that is not the case
1835 .\" in the real world. Notes always have three 4-byte words as can be seen
1836 .\" in the source links below (remember that Elf64_Word is a 32-bit quantity).
1837 .\" glibc: https://sourceware.org/git/?p=glibc.git;a=blob;f=elf/elf.h;h=9e59b3275917549af0cebe1f2de9ded3b7b10bf2#l1173
1838 .\" binutils: https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=binutils/readelf.c;h=274ddd17266aef6e4ad1f67af8a13a21500ff2af#l15943
1839 .\" Linux: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/include/uapi/linux/elf.h?h=v4.8#n422
1840 .\" Solaris: https://docs.oracle.com/cd/E23824_01/html/819-0690/chapter6-18048.html
1841 .\" FreeBSD: https://svnweb.freebsd.org/base/head/sys/sys/elf_common.h?revision=303677&view=markup#l33
1842 .\" NetBSD: https://www.netbsd.org/docs/kernel/elf-notes.html
1843 .\" OpenBSD: https://github.com/openbsd/src/blob/master/sys/sys/exec_elf.h#L533
1844 .\"
1845 .SS Notes (Nhdr)
1846 ELF notes allow for appending arbitrary information for the system to use.
1847 They are largely used by core files
1848 .RI ( e_type
1849 of
1850 .BR ET_CORE ),
1851 but many projects define their own set of extensions.
1852 For example,
1853 the GNU tool chain uses ELF notes to pass information from
1854 the linker to the C library.
1855 .PP
1856 Note sections contain a series of notes (see the
1857 .I struct
1858 definitions below).
1859 Each note is followed by the name field (whose length is defined in
1860 \fIn_namesz\fR) and then by the descriptor field (whose length is defined in
1861 \fIn_descsz\fR) and whose starting address has a 4 byte alignment.
1862 Neither field is defined in the note struct due to their arbitrary lengths.
1863 .PP
1864 An example for parsing out two consecutive notes should clarify their layout
1865 in memory:
1866 .PP
1867 .in +4n
1868 .EX
1869 void *memory, *name, *desc;
1870 Elf64_Nhdr *note, *next_note;
1872 /* The buffer is pointing to the start of the section/segment */
1873 note = memory;
1875 /* If the name is defined, it follows the note */
1876 name = note->n_namesz == 0 ? NULL : memory + sizeof(*note);
1878 /* If the descriptor is defined, it follows the name
1879 (with alignment) */
1881 desc = note->n_descsz == 0 ? NULL :
1882 memory + sizeof(*note) + ALIGN_UP(note->n_namesz, 4);
1884 /* The next note follows both (with alignment) */
1885 next_note = memory + sizeof(*note) +
1886 ALIGN_UP(note->n_namesz, 4) +
1887 ALIGN_UP(note->n_descsz, 4);
1888 .EE
1889 .in
1890 .PP
1891 Keep in mind that the interpretation of
1892 .I n_type
1893 depends on the namespace defined by the
1894 .I n_namesz
1895 field.
1896 If the
1897 .I n_namesz
1898 field is not set (e.g., is 0), then there are two sets of notes:
1899 one for core files and one for all other ELF types.
1900 If the namespace is unknown, then tools will usually fallback to these sets
1901 of notes as well.
1902 .PP
1903 .in +4n
1904 .EX
1905 typedef struct {
1906 Elf32_Word n_namesz;
1907 Elf32_Word n_descsz;
1908 Elf32_Word n_type;
1909 } Elf32_Nhdr;
1910 .EE
1911 .in
1912 .PP
1913 .in +4n
1914 .EX
1915 typedef struct {
1916 Elf64_Word n_namesz;
1917 Elf64_Word n_descsz;
1918 Elf64_Word n_type;
1919 } Elf64_Nhdr;
1920 .EE
1921 .in
1922 .TP \n[l1_indent]
1923 .IR n_namesz
1924 The length of the name field in bytes.
1925 The contents will immediately follow this note in memory.
1926 The name is null terminated.
1927 For example, if the name is "GNU", then
1928 .I n_namesz
1929 will be set to 4.
1930 .TP
1931 .IR n_descsz
1932 The length of the descriptor field in bytes.
1933 The contents will immediately follow the name field in memory.
1934 .TP
1935 .IR n_type
1936 Depending on the value of the name field, this member may have any of the
1937 following values:
1938 .RS \n[l1_indent]
1939 .TP 5
1940 .B Core files (e_type = ET_CORE)
1941 Notes used by all core files.
1942 These are highly operating system or architecture specific and often require
1943 close coordination with kernels, C libraries, and debuggers.
1944 These are used when the namespace is the default (i.e.,
1945 .I n_namesz
1946 will be set to 0), or a fallback when the namespace is unknown.
1947 .RS
1948 .TP 21
1949 .PD 0
1950 .B NT_PRSTATUS
1951 prstatus struct
1952 .TP
1953 .B NT_FPREGSET
1954 fpregset struct
1955 .TP
1956 .B NT_PRPSINFO
1957 prpsinfo struct
1958 .TP
1959 .B NT_PRXREG
1960 prxregset struct
1961 .TP
1962 .B NT_TASKSTRUCT
1963 task structure
1964 .TP
1965 .B NT_PLATFORM
1966 String from sysinfo(SI_PLATFORM)
1967 .TP
1968 .B NT_AUXV
1969 auxv array
1970 .TP
1971 .B NT_GWINDOWS
1972 gwindows struct
1973 .TP
1974 .B NT_ASRS
1975 asrset struct
1976 .TP
1977 .B NT_PSTATUS
1978 pstatus struct
1979 .TP
1980 .B NT_PSINFO
1981 psinfo struct
1982 .TP
1983 .B NT_PRCRED
1984 prcred struct
1985 .TP
1986 .B NT_UTSNAME
1987 utsname struct
1988 .TP
1989 .B NT_LWPSTATUS
1990 lwpstatus struct
1991 .TP
1992 .B NT_LWPSINFO
1993 lwpinfo struct
1994 .TP
1995 .B NT_PRFPXREG
1996 fprxregset struct
1997 .TP
1998 .B NT_SIGINFO
1999 siginfo_t (size might increase over time)
2000 .TP
2001 .B NT_FILE
2002 Contains information about mapped files
2003 .TP
2004 .B NT_PRXFPREG
2005 user_fxsr_struct
2006 .TP
2007 .B NT_PPC_VMX
2008 PowerPC Altivec/VMX registers
2009 .TP
2010 .B NT_PPC_SPE
2011 PowerPC SPE/EVR registers
2012 .TP
2013 .B NT_PPC_VSX
2014 PowerPC VSX registers
2015 .TP
2016 .B NT_386_TLS
2017 i386 TLS slots (struct user_desc)
2018 .TP
2019 .B NT_386_IOPERM
2020 x86 io permission bitmap (1=deny)
2021 .TP
2022 .B NT_X86_XSTATE
2023 x86 extended state using xsave
2024 .TP
2025 .B NT_S390_HIGH_GPRS
2026 s390 upper register halves
2027 .TP
2028 .B NT_S390_TIMER
2029 s390 timer register
2030 .TP
2031 .B NT_S390_TODCMP
2032 s390 time-of-day (TOD) clock comparator register
2033 .TP
2034 .B NT_S390_TODPREG
2035 s390 time-of-day (TOD) programmable register
2036 .TP
2037 .B NT_S390_CTRS
2038 s390 control registers
2039 .TP
2040 .B NT_S390_PREFIX
2041 s390 prefix register
2042 .TP
2043 .B NT_S390_LAST_BREAK
2044 s390 breaking event address
2045 .TP
2046 .B NT_S390_SYSTEM_CALL
2047 s390 system call restart data
2048 .TP
2049 .B NT_S390_TDB
2050 s390 transaction diagnostic block
2051 .TP
2052 .B NT_ARM_VFP
2053 ARM VFP/NEON registers
2054 .TP
2055 .B NT_ARM_TLS
2056 ARM TLS register
2057 .TP
2058 .B NT_ARM_HW_BREAK
2059 ARM hardware breakpoint registers
2060 .TP
2061 .B NT_ARM_HW_WATCH
2062 ARM hardware watchpoint registers
2063 .TP
2064 .B NT_ARM_SYSTEM_CALL
2065 ARM system call number
2066 .PD
2067 .RE
2068 .TP
2069 .B n_name = GNU
2070 Extensions used by the GNU tool chain.
2071 .RS
2072 .TP
2073 .B NT_GNU_ABI_TAG
2074 Operating system (OS) ABI information.
2075 The desc field will be 4 words:
2076 .IP
2077 .PD 0
2078 .RS
2079 .IP \(bu 2
2080 word 0: OS descriptor
2081 (\fBELF_NOTE_OS_LINUX\fR, \fBELF_NOTE_OS_GNU\fR, and so on)`
2082 .IP \(bu
2083 word 1: major version of the ABI
2084 .IP \(bu
2085 word 2: minor version of the ABI
2086 .IP \(bu
2087 word 3: subminor version of the ABI
2088 .RE
2089 .PD
2090 .TP
2091 .B NT_GNU_HWCAP
2092 Synthetic hwcap information.
2093 The desc field begins with two words:
2094 .IP
2095 .PD 0
2096 .RS
2097 .IP \(bu 2
2098 word 0: number of entries
2099 .IP \(bu
2100 word 1: bit mask of enabled entries
2101 .RE
2102 .PD
2103 .IP
2104 Then follow variable-length entries, one byte followed by a null-terminated
2105 hwcap name string.
2106 The byte gives the bit number to test if enabled, (1U << bit) & bit mask.
2107 .TP
2108 .B NT_GNU_BUILD_ID
2109 Unique build ID as generated by the GNU
2110 .BR ld (1)
2111 .BR \-\-build\-id
2112 option.
2113 The desc consists of any nonzero number of bytes.
2114 .TP
2115 .B NT_GNU_GOLD_VERSION
2116 The desc contains the GNU Gold linker version used.
2117 .RE
2118 .TP
2119 .B Default/unknown namespace (e_type != ET_CORE)
2120 These are used when the namespace is the default (i.e.,
2121 .I n_namesz
2122 will be set to 0), or a fallback when the namespace is unknown.
2123 .RS
2124 .TP 21
2125 .PD 0
2126 .B NT_VERSION
2127 A version string of some sort.
2128 .TP
2129 .B NT_ARCH
2130 Architecture information.
2131 .PD
2132 .RE
2133 .PP
2134 .RE
2135 .SH NOTES
2136 .\" OpenBSD
2137 .\" ELF support first appeared in
2138 .\" OpenBSD 1.2,
2139 .\" although not all supported platforms use it as the native
2140 .\" binary file format.
2141 ELF first appeared in
2142 System V.
2143 The ELF format is an adopted standard.
2144 .PP
2145 The extensions for
2146 .IR e_phnum ,
2147 .IR e_shnum
2148 and
2149 .IR e_strndx
2150 respectively are
2151 Linux extensions.
2152 Sun, BSD and AMD64 also support them; for further information,
2153 look under SEE ALSO.
2154 .\" .SH AUTHORS
2155 .\" The original version of this manual page was written by
2156 .\" .An Jeroen Ruigrok van der Werven
2157 .\" .Aq asmodai@FreeBSD.org
2158 .\" with inspiration from BSDi's
2159 .\" .Bsx
2160 .\" .Nm elf
2161 .\" man page.
2162 .SH SEE ALSO
2163 .BR as (1),
2164 .BR elfedit (1),
2165 .BR gdb (1),
2166 .BR ld (1),
2167 .BR nm (1),
2168 .BR objdump (1),
2169 .BR readelf (1),
2170 .BR size (1),
2171 .BR strings (1),
2172 .BR strip (1),
2173 .BR execve (2),
2174 .BR dl_iterate_phdr (3),
2175 .BR core (5)
2176 .PP
2177 Hewlett-Packard,
2178 .IR "Elf-64 Object File Format" .
2179 .PP
2180 Santa Cruz Operation,
2181 .IR "System V Application Binary Interface" .
2182 .PP
2183 UNIX System Laboratories,
2184 "Object Files",
2185 .IR "Executable and Linking Format (ELF)" .
2186 .PP
2187 Sun Microsystems,
2188 .IR "Linker and Libraries Guide" .
2189 .PP
2190 AMD64 ABI Draft,
2191 .IR "System V Application Binary Interface AMD64 Architecture Processor Supplement" .
2192 .PP