Detailed explanation of ELF format (I)

ELF Full name “Executable and Linkable Format”, To execute the linkable file format , Current common Linux、 Android Executable file 、 Shared library （.so）、 Target file （ .o） as well as Core file （ spit out the pips ） All in this format .

File layout

common ELF The general structure of the document is as follows ：

common ELF The format is shown in the figure above , On the left is the link view , On the right is the execution view .

Linked view ：

Static linker （ That is, after compilation, participate in the generation of the final ELF Linker of process , Such as ld ） It will be resolved in link view ELF. Generated at compile time .o（ Target file ） And after the link .so （ Shared library ） Can be resolved through link view , Linked views can have no segment tables （ For example, the target file will not have a segment table ）.

Execution view ：

Dynamic linker （ Loader , Such as x86 framework linux Under the /lib/ld-linux.so.2 Or Android /system/linker Are dynamic linkers ） Will perform view parsing ELF And dynamically link , The execution view can have no section table .

The file header

ELF The structure declaration of is located in the system header file elf.h in ,ELF Format is divided into 32 Bit and 64 Bit two , Except that the relocation type is slightly different , Others are roughly the same , To simplify the description , The following description will be omitted 32/64 word .

ELF Header The statement of :

#define EI_NIDENT (16)
typedef struct
{
    unsigned char	e_ident[EI_NIDENT];	/* Magic number and other info */
    Elf_Half		e_type;			/* Object file type */
    Elf_Half		e_machine;		/* Architecture */
    Elf_Word	        e_version;		/* Object file version */
    Elf_Addr		e_entry;		/* Entry point virtual address */
    Elf_Off		e_phoff;		/* Program header table file offset */
    Elf_Off		e_shoff;		/* Section header table file offset */
    Elf_Word	        e_flags;		/* Processor-specific flags */
    Elf_Half		e_ehsize;		/* ELF header size in bytes */
    Elf_Half		e_phentsize;		/* Program header table entry size */
    Elf_Half		e_phnum;		/* Program header table entry count */
    Elf_Half		e_shentsize;		/* Section header table entry size */
    Elf_Half		e_shnum;		/* Section header table entry count */
    Elf_Half		e_shstrndx;		/* Section header string table index */
} Elf_Ehdr;

e_ident

 Contains Maigc Number And other information , common 16 byte .	
0~3： front 4 bytes Magic Number, Fixed for ELFMAG.
4（EI_CLASS）：ELFCLASS32 Representative is 32 position ELF,ELFCLASS64  representative 64 position ELF.
5（EI_DATA）：ELFDATA2LSB It stands for small end ,ELFDATA2MSB On behalf of the big end .
6（EI_VERSION）： Fixed for EV_CURRENT（1）.
7（EI_OSABI）： operating system ABI identification （ Not actually used ）.
8（EI_ABIVERSION）：ABI edition （ actual   not used ）.
9~15： Alignment filling , No practical significance .

e_type

ELF Type of file , The definition is as follows ：
ET_REL		 Relocatable text   Pieces of （ Such as the target file ）
ET_EXEC	         Executable file （ Directly executable files ）
DT_DYN	         Shared target file （ Such as SO library ）
DT_CORE	        Core file （ Nuclear release document ）
 notes ：GCC Use compile options  -pie  The compiled executable actually   It's also DT_DYN type .

e_machine

 Processor architecture type , Common definitions are as follows ：
EM_386		Intel 386 framework （ It's actually 32 Bit x86 framework ）
EM_X86_64	Amd x86-64 framework 
EM_ARM		ARM framework （ Include thumb,thumb2）
EM_AARCH64	ARM64 framework 

e_verison

                  Document version , Current common ELF The document versions are EV_CURRENT（1）.

e_entry

                  Entry virtual address .

e_phoff

                  Segment table file offset .

e_shoff

                  Section table file offset .

e_flags

                  Processor specific flags , It's usually 0.

e_ehsize

                  Elf_Header Size （ byte ）

e_phentsize

                  Segment head （Program Header） Size （ byte ）.

e_phnum

                  The number of segments .

e_shentsize

                  Nodal head （Section Header） Size （ byte ）.

e_shnum

                  The number of words .

e_shstrndx

                 Section index of the section string table .