The Executable and Linkable Format

A Complete Technical Reference for Systems Programmers

Introduction

1. The Promise of This Book
2. How This Book Is Organized
3. How to Use This Book
4. Prerequisites
5. Conventions

Chapter 1: Origins and Design

1. The Need for a Unified Format
2. Design Objectives: Portability, Extensibility and Separation of Concerns
3. The SVR4 Project and ELF Standardization
4. ELF in the Modern Ecosystem
5. Terminology and Conventions Used in This Book

Chapter 2: ELF at a Glance

1. The Dual View: Linking Representation and Execution Representation
2. High-Level File Layout
3. ELF File Types
4. Identification: Magic, Class, Data Encoding, Version, OS ABI
5. Word Size, Endianness and Alignment Rules

Chapter 3: The ELF Header

1. e_ident: The Identification Array in Detail
2. 32-bit ELF Header Structure: elf32_hdr Field by Field
3. 64-bit ELF Header Structure: elf64_hdr Field by Field
4. Machine Types: EM_X86_64, EM_AARCH64 and the Complete List
5. Entry Points, Program Header Table and Section Header Table Offsets
6. Flags, Header Sizes and Alignment Constraints

Chapter 4: Sections and the Section Header Table

1. The Section Header Table Structure and Layout
2. sh_name, sh_type and All Defined Section Types
3. Section Flags: SHF_WRITE, SHF_ALLOC, SHF_EXECINSTR and Beyond
4. Address, Offset, Size, Link, Info and Alignment Fields
5. Section Name String Table and the Null Section
6. Special Sections: .text, .data, .bss, .rodata, .symtab, .strtab

Chapter 5: Segments and the Program Header Table

1. The Program Header Table Structure and Layout
2. Segment Types: PT_LOAD, PT_DYNAMIC, PT_INTERP, PT_GNU_STACK and All Others
3. The Segment Type System: Standard and GNU Extensions
4. Memory Mapping Semantics: Offsets, Virtual Addresses, Sizes
5. Segment Permissions: PF_R, PF_W, PF_X and NX Interaction
6. Overlapping Segments and File-to-Memory Mapping

Chapter 6: Symbol Tables

1. Symbol Table Structure: elf64_sym Fields and Semantics
2. Symbol Names and the String Table Relationship
3. Symbol Types: STT_NOTYPE, STT_FUNC, STT_OBJECT and Complete List
4. Symbol Binding: Local, Global, Weak and Their Linking Implications
5. Symbol Visibility: STV_DEFAULT, STV_HIDDEN, STV_PROTECTED, STV_INTERNAL
6. Symbol Table Organization and Index Conventions

Chapter 7: Relocations

1. Why Relocation is Necessary: Positions, Dependencies and Resolving Addresses
2. Relocation Entry Formats: elf64_Rel vs elf64_Rela
3. The r_offset, r_info and r_addend Fields Decoded
4. Relocation Type Encoding and Architecture-Specific Types
5. Relative, Absolute and Copy Relocations: How Each Works
6. The Relocation Application Algorithm

Chapter 8: String Tables and Names

1. String Table Structure: Null-Terminated Concatenation
2. String Indexing: Offset as Identifier
3. Section Header String Table (.shstrtab)
4. Symbol String Tables and Name Resolution
5. Dynamic String Tables and Runtime Name Lookups

Chapter 9: The Dynamic Section and Dynamic Linking

1. Dynamic Section Structure: elf64_Dyn and DT_* Entries
2. DT_NEEDED: Dependency Declaration and Resolution
3. DT_STRTAB, DT_SYMTAB, DT_HASH: The Dynamic Name System
4. DT_RELA, DT_REL: Dynamic Relocation Descriptors
5. DT_RPATH, DT_RUNPATH, DT_ORIGIN: Library Search Paths
6. DT_SONAME, DT_FLAGS, DT_FLAGS_1: Identity and Capabilities

Chapter 10: Hash Tables and Symbol Lookup

1. The System V Hash Table: Structure and Algorithm
2. Hash Function: ELF_GNU_HFST and ELF_HFST
3. The GNU Hash Table (g_HASH): Design and Lookup Algorithm
4. Comparison: System V Hash vs GNU Hash Performance
5. Symbol Lookup Rules: Preemption, Interposition and Binding Priority

Chapter 11: PLT, GOT and Lazy Binding

1. The Global Offset Table: Indirect Addressing for Data and Code
2. The Procedure Linkage Table: Trampolines for Indirect Calls
3. Lazy Binding: How dlopen and Symbol Resolution Work at Runtime
4. Eager Binding: DT_BIND_NOW and DF_1_NOW
5. PLT/GOT Layout: x86-64 Convention and AArch64 Equivalents
6. Symbol Interposition and the PLT

Chapter 12: Position-Independent Code and PIE

1. Position-Independent Code: Concepts and Requirements
2. PIC vs PIE: Shared Objects and Position-Independent Executables
3. Relative Addressing and GOT/PCREL Relocations
4. PIE and ASLR: Security Benefits and Implementation
5. Building PIE: Compiler Flags, Linker Options and Resulting ELF

Chapter 13: Thread-Local Storage

1. TLS Concepts: Thread-Local Data and Storage Models
2. TLS Sections: .tdata, .tbss and the SHF_TLS Flag
3. TLS Relocation Types: R_X86_64_TPOFF32, R_X86_64_GOTTPOFF and Others
4. The Four TLS Access Models: Local-Exec, Initial-Exec, Local-Dynamic, General-Dynamic
5. TLS Descriptor Mechanism
6. Thread Pointer and TLS Base

Chapter 14: Constructors, Destructors and Initialization

1. Preinit Arrays: .preinit_array and DT_PREINIT_ARRAY
2. Init Arrays: .init_array, .fini_array and Their Roles
3. Init and Fini Functions: .init and .fini Sections
4. Initialization Order: Dependencies, Library Initialization Sequence
5. attribute((constructor)) and attribute((destructor))

Chapter 15: Linker Scripts and Custom Sections

1. Linker Script Language: INPUT, SECTIONS, OUTPUT FORMAT
2. Section Assignment and Memory Region Control
3. Custom Sections: Creating and Populating .my_section
4. Linker Script Variables and Symbols
5. Advanced Layouts: Discontiguous Sections, Padding, Alignment
6. Example: Building a Custom Layout with GCC and LD Scripts

Chapter 16: From Source to Binary: The Complete Lifecycle

1. Compilation: From C to Assembly to Object File
2. The Object File: Sections, Symbols and Relocations Generated
3. Static Linking: Merging Objects, Resolving Symbols, Applying Relocations
4. Dynamic Linking: Shared Object References and Unresolved Symbols
5. Build Case Study: From hello.c Through All Stages to a Running Process

Chapter 17: The Dynamic Linker and Loader

1. PT_INTERP and the Dynamic Linker Entry
2. Loading Sequence: Map, Parse, Resolve, Initialize
3. Library Search Path Resolution: LD_LIBRARY_PATH, RPATH, RUNPATH, System Paths
4. Dependency Graph Resolution and Load Order
5. Relocation Application at Load Time
6. Lazy Resolution and PLT Trampolines in Action

Chapter 18: Executing an ELF Binary

1. execve and the Kernel: Parsing ELF in sys_execve
2. Kernel ELF Loading: Mapping Segments into Address Space
3. PT_GNU_STACK and Stack Permissions
4. Auxiliary Vector: AT_ENTRY, AT_PHDR, AT_RANDOM and Others
5. Stack Setup, Environment and argc/argv
6. Transfer of Control to Entry Point and _start

Chapter 19: Notes and Metadata

1. Note Section Structure: n_name, n_descsz, n_desc
2. PT_NOTE Segments and Core Dump Notes
3. GNU Build Attributes: .note.gnu.build-id
4. Build ID: Computing and Using ELF Identity
5. Core Dump Notes: NT_PRSTATUS, NT_PRPSINFO, NT_FILE, NT_SIGINFO
6. Notes in Shared Objects and Executables

Chapter 20: GNU and Linux Extensions

1. GNU Hash Table: DT_GNU_HASH Details
2. RELRO: PT_GNU_RELRO and Partial RELRO vs Full RELRO
3. IFUNC: Indirect Functions
4. Verneed and Verdef: Symbol Versioning
5. Stack Protector and Canary Implementation
6. GNU Property Notes: .note.gnu.property

Chapter 21: Architecture-Specific Details: x86-64

1. x86-64 ELF Conventions: ABI and Calling Convention Impact
2. x86-64 Relocation Types: Complete Reference
3. x86-64 PLT/GOT Layout and Calling Sequences
4. x86-64 TLS: FS Register and Access Models
5. x86-64 e_flags and Machine-Specific Behavior

Chapter 22: Architecture-Specific Details: AArch64

1. AArch64 ELF Conventions: AAPCS64 and Calling Convention Impact
2. AArch64 Relocation Types: Key Types and Semantics
3. AArch64 PLT/GOT Layout and Calling Sequences
4. AArch64 TLS: TPIDR_EL0 and Access Models
5. AArch64 e_flags and Machine-Specific Behavior

Chapter 23: Tools and Practical Analysis

1. readelf: Complete Option Reference and Interpretation
2. objdump: Disassembly, Relocation Listing and Headers
3. nm: Symbol Table Inspection and Symbol Types
4. ldd: Dynamic Dependency Analysis
5. file, hexdump and Strace for Binary Analysis
6. GDB for Runtime ELF Inspection: Breakpoints, Memory Maps and Symbols

Chapter 24: An ELF Parser and Inspector

1. Project Setup and Header Definitions
2. Parsing the ELF Header and Validating the File
3. Parsing Section Headers and Enumerating Sections
4. Parsing Program Headers and Mapping Segments
5. Symbol Table Parsing and Display
6. Relocation Parsing and Decode
7. Dynamic Section Analysis
8. Complete Utility Usage and Example Output

Chapter 25: ELF Security

1. Buffer Overflows and Stack Smashing: ELF Perspective
2. Format String Vulnerabilities and GOT Overwrite
3. Return-Oriented Programming: PLT, Gadgets and RELRO
4. GOT Hijacking and Symbol Interposition Attacks
5. ASLR and PIE: Mitigating Address Revelation
6. NX and W^X: Enforcing Through PT_GNU_STACK and Segment Permissions
7. LD_PRELOAD Attacks and Defense
8. Malformed ELF Exploitation and Parser Robustness

Chapter 26: Advanced Topics

1. Binary Instrumentation: ptrace, LD_PRELOAD and ELF Modification
2. Runtime Patching: Modifying Running ELF Processes
3. Custom ELF Generation: Building ELF in User Space
4. Packing and Unpacking: Obfuscated ELF Binaries
5. Reverse Engineering ELF: Static Analysis Techniques
6. Forensic Analysis: Core Dumps and Memory Images
7. ELF Parsing Edge Cases: Robustness and Security

Conclusion

References