Executable and Linking Format

The Executable and Linking Format ( ELF for short ) describes the standard binary format of executable programs , libraries and memory dumps under many UNIX-like operating systems such as Linux or FreeBSD , which has also been adopted on other systems.

history

The format was originally developed by the Unix System Laboratories and was accepted in 1993 by the Tool Interface Standard Committee as part of the Tool Interface Standard (TIS) as the standard for executable programs. The format was introduced in Linux in 1995 because it was faster and more flexible than the earlier a.out and COFF formats .

Technical characteristics

Special features of this format include dynamic linking and loading, the problem-free control of programs that are already running and the simple option of generating dynamic libraries . In contrast to other proprietary formats , the representation of the control data in an ELF file is always platform-independent . It also offers the possibility to identify object files , to parse them and to interpret them at the same time, ie to execute them.

The ELF format does not offer the possibility of fat binaries ; H. Store code for more than one target platform (such as x86 and ARM) in the same binary file. An ELF extension called FatELF , which retrofits this ability, has not been able to establish itself until today.

The libelf runtime library is a useful helper for handling ELF files, for example reading out information.

construction

An ELF file can consist of up to five parts:

Header information (ELF header)
Program header table
Section header table
the sections (ELF sections)
the segments (ELF segment)

File types

The three main types of ELF files are

executable
relocatable
shared object

All file types contain the code, the data and information about the program, the operating system and the linker that is required at runtime.

Executable

This file type provides the necessary information for the operating system to correctly place a program in the virtual address space of a process .

Relocatable

This file type describes how it must be linked to other object files so that an executable file or a dynamic library can be produced from them.

Shared object

This file type contains information that is important for static and dynamic linking, but is also used for executables with position-independent code .

FatELF: Universal Binaries for Linux

Logo of the Linux Fat Binary implementation FatELF

FatELF is an ELF binary format extension developed by Ryan C. Gordon that adds fat binary capabilities. In addition to different CPU architectures with varying data word sizes (for example 32-bit or 64-bit systems) or byte order , software platform variations can also be supported, such as different OS ABIs (or versions). A sample implementation for Ubuntu 9.04 is available. An integration into the Linux kernel is still pending .

literature

Ryan O'Neill: Learning Linux Binary Analysis. Packt Publishing, Birmingham 2016, ISBN 978-1-78216-710-5 .
Dennis Andriesse: Practical Binary Analysis. No Starch Press, San Francisco 2019, ISBN 978-1-59327-912-7 .

Web links

Individual evidence

↑ ^a ^b Thom Holwerda: Ryan Gordon Halts FatELF Project . osnews.com. November 3, 2009. Retrieved July 5, 2010.
↑ ^a ^b Joe Brockmeier: SELF: Anatomy of an (alleged) failure . Linux Weekly News. June 23, 2010. Retrieved February 6, 2011.
↑ Ryan Gordon: fatelf-specification v1 . icculus.org. Retrieved July 25, 2010.
↑ Ryan Gordon: FatELF: Turns out I liked the uncertainty better. . icculus.org. Retrieved July 13, 2010.

[kernel2-1] Thom Holwerda: Ryan Gordon Halts FatELF Project . osnews.com. November 3, 2009. Retrieved July 5, 2010.

[selfanatomy-2] Joe Brockmeier: SELF: Anatomy of an (alleged) failure . Linux Weekly News. June 23, 2010. Retrieved February 6, 2011.

[fatelfspec-3] Ryan Gordon: fatelf-specification v1 . icculus.org. Retrieved July 25, 2010.

[kernel1-4] Ryan Gordon: FatELF: Turns out I liked the uncertainty better. . icculus.org. Retrieved July 13, 2010.