Executable and Linkable Format

Quality 0.50 · 4 views · Updated 2 months ago

Standard file format for executables, object code, shared libraries, and core dumps

title: "Executable and Linkable Format" type: doc version: 1 created: 2026-02-28 author: "Wikipedia contributors" status: active scope: public tags: ["executable-file-formats"] description: "Standard file format for executables, object code, shared libraries, and core dumps" topic_path: "general/executable-file-formats" source: "https://en.wikipedia.org/wiki/Executable_and_Linkable_Format" license: "CC BY-SA 4.0" wikipedia_page_id: 0 wikipedia_revision_id: 0

::summary Standard file format for executables, object code, shared libraries, and core dumps ::

::data[format=table title="Infobox file format"]

FieldValue
nameExecutable and Linkable Format
extensionnone, , , , , , , , , , and
magic0x7F 'E' 'L' 'F'
developerUnix System Laboratories
typeBinary, executable, object, shared library, core dump
container_forMany executable binary formats
released
latest_release_version4.2
latest_release_date
url
standard
::

| name = Executable and Linkable Format | icon = | extension = none, , , , , , , , , , and | mime = | magic = 0x7F 'E' 'L' 'F' | developer = Unix System Laboratories | type = Binary, executable, object, shared library, core dump | container_for = Many executable binary formats | released = | latest_release_version = 4.2 | latest_release_date = | url = | standard =

::figure[src="https://upload.wikimedia.org/wikipedia/commons/7/77/Elf-layout--en.svg" caption="An ELF file has two views: the program header shows the ''segments'' used at run time, whereas the section header lists the set of ''sections''."] ::

In computing, the Executable and Linkable Format (ELF, formerly named Extensible Linking Format) is a common standard file format for executable files, object code, shared libraries, device drivers, and core dumps. First published in the specification for the application binary interface (ABI) of the Unix operating system version named System V Release 4 (SVR4), and later in the Tool Interface Standard, it was quickly accepted among different vendors of Unix systems. In 1999, it was chosen as the standard binary file format for Unix and Unix-like systems on x86 processors by the 86open project.

By design, the ELF format is flexible, extensible, and cross-platform. For instance, it supports different endiannesses and address sizes so it does not exclude any particular CPU or instruction set architecture. This has allowed it to be adopted by many different operating systems on many different hardware platforms.

File layout

Each ELF file is made up of one ELF header, followed by file data. The data can include:

  • Program header table, describing zero or more memory segments
  • Section header table, describing zero or more sections
  • Data referred to by entries in the program header table or section header table

::figure[src="https://upload.wikimedia.org/wikipedia/commons/e/e4/ELF_Executable_and_Linkable_Format_diagram_by_Ange_Albertini.png" caption="Structure of an ELF file with key entries highlighted"] ::

The segments contain information that is needed for run time execution of the file, while sections contain important data for linking and relocation. Any byte in the entire file can be owned by one section at most, and orphan bytes can occur which are unowned by any section.

ELF header

The ELF header defines whether to use 32-bit or 64-bit addresses. The header contains three fields that are affected by this setting and offset other fields that follow them. The ELF header is 52 or 64 bytes long for 32-bit and 64-bit binaries, respectively.

::data[format=table]

ValueABI
System V
HP-UX
NetBSD
Linux
GNU Hurd
Solaris
AIX (Monterey)
IRIX
FreeBSD
Tru64
Novell Modesto
OpenBSD
OpenVMS
NonStop Kernel
AROS
FenixOS
Nuxi CloudABI
Stratus Technologies OpenVOS
::

|- | colspan="2" | || colspan="2" | 1 || |Further specifies the ABI version. Its interpretation depends on the target ABI. Linux kernel (after at least 2.6) has no definition of it, so it is ignored for statically linked executables. In that case, offset and size of EI_PAD are 8. glibc 2.12+ in case treats this field as ABI version of the dynamic linker: it defines a list of dynamic linker's features, treats as a feature level requested by the shared object (executable or dynamic library) and refuses to load it if an unknown feature is requested, i.e. is greater than the largest known feature. |- | colspan="2" | || colspan="2" | 7 ||

Reserved padding bytes. Currently unused. Should be filled with zeros and ignored when read.
colspan="2"
Identifies object file type.
::data[format=table]
Value
---
::

|- | colspan="2" | || colspan="2" | 2 || |Specifies target instruction set architecture. Some examples are: ::data[format=table]

ValueISA
No specific instruction set
AT&T WE 32100
SPARC
x86
Motorola 68000 (M68k)
Motorola 88000 (M88k)
Intel MCU
Intel 80860
MIPS
IBM System/370
MIPS RS3000 Little-endian
Reserved for future use
Hewlett-Packard PA-RISC
Intel 80960
PowerPC
PowerPC (64-bit)
S390, including S390x
IBM SPU/SPC
Reserved for future use
NEC V800
Fujitsu FR20
TRW RH-32
Motorola RCE
Arm (up to Armv7/AArch32)
Digital Alpha
SuperH
SPARC Version 9
Siemens TriCore embedded processor
Argonaut RISC Core
Hitachi H8/300
Hitachi H8/300H
Hitachi H8S
Hitachi H8/500
IA-64
Stanford MIPS-X
Motorola ColdFire
Motorola M68HC12
Fujitsu MMA Multimedia Accelerator
Siemens PCP
Sony nCPU embedded RISC processor
Denso NDR1 microprocessor
Motorola Star*Core processor
Toyota ME16 processor
STMicroelectronics ST100 processor
Advanced Logic Corp. TinyJ embedded processor family
AMD x86-64
Sony DSP Processor
Digital Equipment Corp. PDP-10
Digital Equipment Corp. PDP-11
Siemens FX66 microcontroller
STMicroelectronics ST9+ 8/16-bit microcontroller
STMicroelectronics ST7 8-bit microcontroller
Motorola MC68HC16 Microcontroller
Motorola MC68HC11 Microcontroller
Motorola MC68HC08 Microcontroller
Motorola MC68HC05 Microcontroller
Silicon Graphics SVx
STMicroelectronics ST19 8-bit microcontroller
Digital VAX
Axis Communications 32-bit embedded processor
Infineon Technologies 32-bit embedded processor
Element 14 64-bit DSP Processor
LSI Logic 16-bit DSP Processor
TMS320C6000 Family
MCST Elbrus e2k
Arm 64-bits (Armv8/AArch64)
Zilog Z80
RISC-V
Berkeley Packet Filter
WDC 65C816
LoongArch
::

|- | colspan="2" | || colspan="2" | 4 ||

Set to 1 for the original version of ELF.
colspan="2"
This is the memory address of the entry point from where the process starts executing. This field is either 32 or 64 bits long, depending on the format defined earlier (byte 0x04). If the file doesn't have an associated entry point, then this holds zero.
-
Points to the start of the program header table. It usually follows the file header immediately following this one, making the offset 0x34 or 0x40 for 32- and 64-bit ELF executables, respectively.
-
Points to the start of the section header table.
-
Interpretation of this field depends on the target architecture.
-
Contains the size of this header, normally 64 Bytes for 64-bit and 52 Bytes for 32-bit format.
-
Contains the size of a program header table entry. As explained below, this will typically be 0x20 (32-bit) or 0x38 (64-bit).
-
Contains the number of entries in the program header table.
-
Contains the size of a section header table entry. As explained below, this will typically be 0x28 (32-bit) or 0x40 (64-bit).
-
Contains the number of entries in the section header table.
-
Contains index of the section header table entry that contains the section names.
-

| | | colspan="3" | |End of ELF Header (size). |}

Example hexdump

::code[lang=hexdump] 00000000 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 |.ELF............| 00000010 02 00 3e 00 01 00 00 00 c5 48 40 00 00 00 00 00 |..>......H@.....| ::

Program header

The program header table tells the system how to create a process image. It is found at file offset , and consists of entries, each with size . The layout is slightly different in 32-bit ELF vs 64-bit ELF, because the are in a different structure location for alignment reasons. Each entry is structured as:

::data[format=table]

ValueNameMeaning
Program header table entry unused.
Loadable segment.
Dynamic linking information.
Interpreter information.
Auxiliary information.
Reserved.
Segment containing program header table itself.
Thread-Local Storage template.
Reserved inclusive range. Operating system specific.
Reserved inclusive range. Processor specific.
::

|- | || || || 4 ||||Segment-dependent flags (position for 64-bit structure). ::data[format=table]

ValueNameMeaning
Executable segment.
Writeable segment.
Readable segment.
::

|- | || || 4 || 8||||Offset of the segment in the file image. |- | || || 4 || 8 ||||Virtual address of the segment in memory. |- | || || 4 || 8 ||||On systems where physical address is relevant, reserved for segment's physical address. |- | || || 4 || 8 ||||Size in bytes of the segment in the file image. May be 0. |- | || || 4 || 8 ||||Size in bytes of the segment in memory. May be 0. |- | || || 4 || ||||Segment-dependent flags (position for 32-bit structure). See above p_flags field for flag definitions. |- | || || 4 || 8 ||||0 and 1 specify no alignment. Otherwise should be a positive, integral power of 2, with equating modulus . |- | | | colspan="3" | |End of Program Header (size). |}

Section header

::data[format=table]

ValueNameMeaning
Section header table entry unused
Program data
Symbol table
String table
Relocation entries with addends
Symbol hash table
Dynamic linking information
Notes
Program space with no data (bss)
Relocation entries, no addends
Reserved
Dynamic linker symbol table
Array of constructors
Array of destructors
Array of pre-constructors
Section group
Extended section indices
Number of defined types.
Start OS-specific.
.........
::

|- | colspan="2" |0x08 |4 |8 | |Identifies the attributes of the section. ::data[format=table]

ValueNameMeaning
Writable
Occupies memory during execution
Executable
Might be merged
Contains null-terminated strings
'sh_info' contains SHT index
Preserve order after combining
Non-standard OS specific handling required
Section is member of a group
Section hold thread-local data
OS-specific
Processor-specific
Special ordering requirement (Solaris)
Section is excluded unless referenced or allocated (Solaris)
::

|- | | |4 |8 |

Virtual address of the section in memory, for sections that are loaded.

| | |4 |8 |

Offset of the section in the file image.

| | |4 |8 |

Size in bytes of the section. May be 0.

| | | colspan="2" |4 |

Contains the section index of an associated section. This field is used for several purposes, depending on the type of section.

| | | colspan="2" |4 |

Contains extra information about the section. This field is used for several purposes, depending on the type of section.

| | |4 |8 |

Contains the required alignment of the section. This field must be a power of two.

| | |4 |8 |

Contains the size, in bytes, of each entry, for sections that contain fixed-size entries. Otherwise, this field contains zero.

| | | colspan="3" | |End of Section Header (size). |}

Tools

Main article: GNU Binutils

  • [readelf](readelf) is a Unix binary utility that displays information about one or more ELF files. A free software implementation is provided by GNU Binutils.
  • elfutils provides alternative tools to GNU Binutils purely for Linux.
  • elfdump is a command for viewing ELF information in an ELF file, available under Solaris and FreeBSD.
  • [objdump](objdump) provides a wide range of information about ELF files and other object formats. objdump uses the Binary File Descriptor library as a back-end to structure the ELF data.
  • The Unix [file](file-command) utility can display some information about ELF files, including the instruction set architecture for which the code in a relocatable, executable, or shared object file is intended, or on which an ELF core dump was produced.

Applications

Unix-like systems

The ELF format has replaced older executable formats in various environments. It has replaced a.out and COFF formats in Unix-like operating systems:

Non-Unix adoption

ELF has also seen some adoption in non-Unix operating systems, such as:

Microsoft Windows also uses the ELF format, but only for its Windows Subsystem for Linux compatibility system.

Game consoles

Some game consoles also use ELF:

  • PlayStation Portable, PlayStation Vita, PlayStation, PlayStation 2, PlayStation 3, PlayStation 4, PlayStation 5
  • GP2X
  • Dreamcast
  • GameCube
  • Nintendo 64
  • Wii
  • Wii U

PowerPC

Other (operating) systems running on PowerPC that use ELF:

  • AmigaOS 4, the ELF executable has replaced the prior Extended Hunk Format (EHF) which was used on Amigas equipped with PPC processor expansion cards.
  • MorphOS
  • AROS
  • Café OS (The operating system run by the Wii U)

Mobile phones

Some operating systems for mobile phones and mobile devices use ELF:

  • Symbian OS v9 uses E32Image format that is based on the ELF file format;
  • Sony Ericsson, for example, the W800i, W610, W300, etc.
  • Siemens, the SGOLD and SGOLD2 platforms: from Siemens C65 to S75 and BenQ-Siemens E71/EL71;
  • Motorola, for example, the E398, SLVR L7, v360, v3i (and all phone LTE2 which has the patch applied).
  • Bada, for example, the Samsung Wave S8500.
  • Nokia phones or tablets running the Maemo or the Meego OS, for example, the Nokia N900.
  • Android uses ELF (shared object | last1 = Rosen | first1 = Kenneth | last2 = Host | first2 = Douglas | last3 = Klee | first3 = Rachel | last4 = Rosinski | first4 = Richard | title = UNIX: The Complete Reference | url = https://books.google.com/books?id=2Et--84HIkwC | edition = 2 | publisher = McGraw Hill Professional | date = 2007 | page = 707 | isbn = 9780071706988 | access-date = 2017-06-08 | quote = Dynamically linked libraries are also called shared objects (.so). ) libraries for the Java Native Interface. With Android Runtime (ART), the default since Android 5.0 "Lollipop", all applications are compiled into native ELF binaries on installation. It's also possible to use native Linux software from package managers like Termux, or compile them from sources via Clang or GCC, that are available in repositories.

np Some phones can run ELF files through the use of a patch that adds assembly code to the main firmware, which is a feature known as ELFPack in the underground modding culture. The ELF file format is also used with the Atmel AVR (8-bit), AVR32 | chapter-url=http://www.sco.com/developers/gabi/2009-10-26/ch4.eheader.html#e_machine | title=System V Application Binary Interface | chapter=Chapter 4: Object Files | at=e_machine | date=2009-10-26 and with Texas Instruments MSP430 microcontroller architectures. Some implementations of Open Firmware can also load ELF files, most notably Apple's implementation used in almost all PowerPC machines the company produced.

Blockchain platforms

  • Solana uses ELF format for its on-chain programs (smart contracts). The platform processes ELF files compiled to BPF (Berkeley Packet Filter) byte-code, which are then deployed as shared objects and executed in Solana's runtime environment. The BPF loader validates and processes these ELF files during program deployment.{{Cite web | url = https://solana.com/docs/core/programs | title = Solana Programs | date = 2024-11-11 | publisher = Solana Foundation | access-date = 2024-11-11 | quote = Solana leverages the LLVM compiler infrastructure to compile programs into Executable and Linkable Format (ELF) files.}}

86open

86open was a project to form consensus on a common binary file format for Unix and Unix-like operating systems on the common PC compatible x86 architecture, to encourage software developers to port to the architecture.{{cite web |url= http://www.telly.org/86open-faq |title= 86Open Frequently-Asked Questions |access-date= 2007-06-06 |last= Leibovitch |first= Evan |date= 1997-12-23 |archive-url= https://web.archive.org/web/20070311032337/http://www.telly.org/86open-faq |archive-date= 2007-03-11}} The initial idea was to standardize on a small subset of Spec 1170, a predecessor of the Single UNIX Specification, and the GNU C Library (glibc) to enable unmodified binaries to run on the x86 Unix-like operating systems. The project was originally designated "Spec 150".

The format eventually chosen was ELF, specifically the Linux implementation of ELF, after it had turned out to be a de facto standard supported by all involved vendors and operating systems.

The group began email discussions in 1997 and first met together at the Santa Cruz Operation offices on August 22, 1997.

The steering committee was Marc Ewing, Dion Johnson, Evan Leibovitch, Bruce Perens, Andrew Roach, Bryan Wayne Sparks and Linus Torvalds. Other people on the project were Keith Bostic, Chuck Cranor, Michael Davidson, Chris G. Demetriou, Ulrich Drepper, Don Dugger, Steve Ginzburg, Jon "maddog" Hall, Ron Holt, Jordan Hubbard, Dave Jensen, Kean Johnston, Andrew Josey, Robert Lipe, Bela Lubkin, Tim Marsland, Greg Page, Ronald Joe Record, Tim Ruckle, Joel Silverstein, Chia-pi Tien, and Erik Troan. Operating systems and companies represented were BeOS, BSDI, FreeBSD, Intel, Linux, NetBSD, SCO and SunSoft.

The project progressed and in mid-1998, SCO began developing lxrun, an open-source compatibility layer able to run Linux binaries on OpenServer, UnixWare, and Solaris. SCO announced official support of lxrun at LinuxWorld in March 1999. Sun Microsystems began officially supporting lxrun for Solaris in early 1999,{{cite web |url = http://www.mavetju.org/mail/view_message.php?list=freebsd-emulation&id=361608 |title = Bulletin on status of 86open at SCO |access-date = 2008-05-06 |last = Record |first = Ronald |date = 1998-05-21 |url-status = dead |archive-url = https://web.archive.org/web/20081208013909/http://www.mavetju.org/mail/view_message.php?list=freebsd-emulation&id=361608 |archive-date = 2008-12-08

With the BSDs having long supported Linux binaries (through a compatibility layer) and the main x86 Unix vendors having added support for the format, the project decided that Linux ELF was the format chosen by the industry and "declare[d] itself dissolved" on July 25, 1999.{{cite web |url= https://www.telly.org/86open/ |title= The86open Project – Final Update |access-date= 2007-05-06 |last= Leibovitch |first= Evan |date= 1999-07-25 |archive-url= https://web.archive.org/web/20070227214032/http://www.telly.org/86open/ |archive-date= 2007-02-27}}

FatELF: universal binaries for Linux

FatELF is an ELF binary-format extension that adds fat binary capabilities. It is aimed for Linux and other Unix-like operating systems. Additionally to the CPU architecture abstraction (byte order, word size, CPU instruction set etc.), there is the potential advantage of software-platform abstraction e.g., binaries which support multiple kernel ABI versions. , FatELF has not been integrated into the mainline Linux kernel.

References

References

  1. [https://gabi.xinuos.com/elf/c-history.html ELF Object File Format: Appendix C: Revision History]
  2. Tool Interface Standard (TIS) ''[https://refspecs.linuxfoundation.org/elf/TIS1.1.pdf Portable Formats Specification] Version 1.1'' (October 1993)
  3. ''[https://www.sco.com/developers/devspecs/gabi41.pdf System V Application Binary Interface]'' Edition 4.1 (1997-03-18)
  4. Tool Interface Standard (TIS) ''[https://refspecs.linuxbase.org/elf/elf.pdf Executable and Linking Format (ELF) Specification] Version 1.2'' (May 1995)
  5. (July 2000). "ELF Header". Sco.com.
  6. "LXR linux/include/linux/elf.h".
  7. "glibc 2.12 announce".
  8. "sourceware.org Git - glibc.git/blob - libc-abis".
  9. "sourceware.org Git - glibc.git/blob - sysdeps/gnu/ldsodefs.h".
  10. "Available lexers — Pygments".
  11. (July 2000). "Program Header". Sco.com.
  12. "elfutils".
  13. "Binary Formats".
  14. "MinixReleases – Minix Wiki". Wiki.minix3.org.
  15. "Archived copy".
  16. (2012-04-22). "GCCSDK – RISC OS". Riscos.info.
  17. (2018-05-30). "Guardian Programmer's Guide". Hewlett Packard Enterprise.
  18. Foley, Mary Jo. "Under the hood of Microsoft's Windows Subsystem for Linux".
  19. PlayStation Portable use encrypted & relocated ELF : PSP
  20. ''[https://web.archive.org/web/20091213034509/http://wiki.forum.nokia.com/index.php/E32Image Symbian OS executable file format]''
  21. Thomas, Romain. "Android formats". Quarks Lab.
  22. Gordon, Ryan. "fatelf-specification v1". icculus.org.
  23. Gordon, Ryan. "FatELF: Turns out I liked the uncertainty better". icculus.org.
  24. Holwerda, Thom. (2009-11-03). "Ryan Gordon Halts FatELF Project". osnews.com.
  25. Brockmeier, Joe. (June 23, 2010). "SELF: Anatomy of an (alleged) failure". Linux Weekly News.
  26. https://archive.today/20200114225034/https://linker.iecc.com/code.html {{Bare URL inline. (August 2025)

::callout[type=info title="Wikipedia Source"] This article was imported from Wikipedia and is available under the Creative Commons Attribution-ShareAlike 4.0 License. Content has been adapted to SurfDoc format. Original contributors can be found on the article history page. ::

executable-file-formats