13 ELF

Executable and Linking Format (for Linux)

1. readelf reads executable and finds all information
2. Go through all the symbols, see if the calling return address falls between

For both object files, and the resulting executable files

Structure

executable format

• ELF header: first 64 bytes of executable or .o file
  • typedef struct {...}
  • Magic, class, data, version, machine, size, …
  • e_ident: first 4 bytes to identify an ELF file
• Segment header table: (aka array of segment headers)
  • Multiple sections that will be loaded into memory are grouped into segments
  • Runner will look this and load the sections
• .rodata: read only data (E. “string”s)
• .data: initialized global variable
• .bss: zero, or uninitialized global variable
• .symtab, .debug:for linking, not loaded into memory
• Section header table: sections, not segments
  • Linker will look at this to stitch

• Section for linking
  • Some sections not used for execution, E. string section
• Segment for executing