Copy Link
Add to Bookmark
Report
Duke's ELF overview v1.0
Duke's ELF overview v1.0:
ELF Header (EHR):
=================
Starting at the first byte of the ELF file.
0x00 - 4 bytes 0x7f,"ELF" (ELF file identifier)
0x04 - 1 byte File Class: 1=32bit, 2=64bit objects
0x05 - 1 byte Data Encoding: 1=ELFDATA2LSB, 2=ELFDATA2MSB
0x06 - 1 byte ELF header version (must be 1)
0x07 - 9 bytes zeroised
0x10 - 2 bytes ELF type: 0=NONE, 1=REL, 2=EXEC, 3=SHARED, 4=CORE
0x12 - 2 bytes Processor: 8=MIPS R3000
0x14 - 4 bytes Version: 1=current
0x18 - 4 bytes Entry point address
0x1C - 4 bytes Start of program headers (offset from file start)
0x20 - 4 bytes Start of section headers (offset from file start)
0x24 - 4 bytes Processor specific flags = 0x20924001 noreorder, mips
0x28 - 2 bytes ELF header size (0x34 = 52 bytes)
0x2A - 2 bytes Program headers entry size
0x2C - 2 bytes Number of program headers
0x3E - 2 bytes Section headers entry size
0x30 - 2 bytes Number of section headers
0x32 - 2 bytes Section header stringtable index
Program Header (PHR):
=====================
Offset located in EHR 0x1C, size specified by EHR 0x2A and the number of PHR's
specified in EHR 0x2C.
0x00 - 4 bytes Segment type:
0=Inactive
1=Load the segment into memory, no. of bytes specified by 0x10 and 0x14
2=Dynamic linking
3=Interpreter. The array element must specify a path name
4=Note. The array element must specify the location and size of aux. info
5=reserved
6=The array element must specify location and size of the program header table.
0x70000000 - 0x7fffffff processor specific semantics
0x04 - 4 bytes Offset from file start to program segment.
0x08 - 4 bytes Virtual address of the segment
0x0C - 4 bytes Physical address of the segment
0x10 - 4 bytes Number of bytes in the file image of the segment
0x14 - 4 bytes Number of bytes in the memory image of the segment
0x18 - 4 bytes Flags for segment
0x1C - 4 bytes Alignment. The address of 0x08 and 0x0C must fit this alignment. 0=no alignment
Section Header (SHR):
=====================
Offset located in EHR 0x20, size specified by EHR 0x30 and number of SHR's specified in EHR 0x32.
0x00 - 4 bytes No. to the index of the Section header stringtable index
0x04 - 4 bytes Type:
0=Inactive
1=PROGBITS
2=SYMTAB symbol table
3=STRTAB string table
4=RELA relocation entries
5=HASH hash table
6=DYNAMIC dynamic linking information
7=NOTE
8=NOBITS
9=REL relocation entries
10=SHLIB
0x70000000=LOPROC processor specifc
0x7fffffff=HIPROC
0x80000000=LOUSER lower bound
0xffffffff=HIUSER upper bound
0x08 - 4 bytes Section Flags: (1 bit, you may combine them like 3 = alloc & write permission)
1=Write section contains data the is be writeable during execution.
2=Alloc section occupies memory during execution
4=Exec section contains executable instructions
0xf0000000=Mask bits processor-specific
0x0C - 4 bytes Section start address
0x10 - 4 bytes Offset from start of file to section
0x14 - 4 bytes Size of section
0x18 - 4 bytes Section header table index link
0x1C - 4 bytes Info
0x20 - 4 bytes Alignment. The adress of 0x0C must fit this alignment. 0=no alignment.
0x24 - 4 bytes Fixed size entries.
