ELF (file format)

ELF (file format)
Name	ELF
Extension	.o, .so, .exe
Mime	application/x-elf
Developed	1990s
Owner	Unix vendors, consortia

ELF (file format) ELF is a common executable and object file format used on many Unix-like systems and platforms for storing executables, object code, shared libraries, and core dumps. It provides a flexible, extensible container for binary metadata, symbol tables, relocation records, and program segments used by linkers and loaders across diverse processor architectures and operating systems. ELF has been adopted and adapted by multiple vendors and projects to serve in environments ranging from embedded systems to large-scale servers.

Overview

ELF organizes binary data into sections and segments that describe code and data layout for runtime environments such as Linux, FreeBSD, NetBSD, OpenBSD, and Solaris. It supports multiple instruction set architectures including x86, x86-64, ARM, ARM64, PowerPC, MIPS, SPARC, and RISC-V. Runtime systems like glibc, musl, Gold, and ld‑gold rely on ELF semantics for symbol resolution and dynamic linking. Toolchains developed by organizations such as GNU Project, LLVM Project, Intel, Red Hat, and IBM produce and manipulate ELF objects.

History and Development

ELF emerged in the early 1990s as part of efforts to unify executable formats across vendors and was standardized in specifications maintained by consortia and companies including Unix System Laboratories, The Santa Cruz Operation, Sun Microsystems, and AT&T. Major projects and events influencing ELF adoption include the migration of Linux from a.out, the development of System V Release 4 conventions, and the work of the POSIX community on binary interfaces. Prominent contributors and maintainers across decades include teams at GNU Project, Red Hat, Intel, SUSE, Oracle, and university research groups involved with operating systems courses at MIT, University of California, Berkeley, and Stanford University.

File Format Structure

An ELF binary begins with an ELF header that identifies class (32-bit or 64-bit), endianness, and ABI such as System V or platform-specific ABIs. The header points to program header tables and section header tables; notable section names are .text, .data, .bss, .rodata, .symtab, and .dynsym, which interact with symbol resolution mechanisms used by linkers like GNU ld and LLD. ELF supports relocations including REL and RELA types and dynamic tables like DT_NEEDED entries consumed by runtime linkers such as ld.so and ld-linux.so.2. The format includes a string table and symbol table entries populated by compilers and assemblers produced by GCC, Clang, Intel Compiler and toolchains from vendors like ARM Holdings or NVIDIA.

Object File Types and Use Cases

ELF serves multiple object categories: relocatable object files (.o) created by assemblers like GNU Binutils and compilers such as GCC and Clang; shared objects (.so) used for dynamic linking in projects like Apache HTTP Server, Mozilla Firefox, and OpenSSH; and executable files used by kernels including Linux kernel and microkernels in research from institutions like Carnegie Mellon University. ELF is also used for core dumps consumed by debuggers such as GDB and LLDB and by profiling tools including perf and Valgrind. Embedded vendors like ARM, Texas Instruments, and Microchip Technology leverage ELF for firmware and bootloaders integrated into platforms supported by U-Boot and real-time operating systems like FreeRTOS.

Linking and Loading

Linkers resolve symbols and apply relocations across multiple ELF objects, producing final executables or shared libraries used by dynamic linkers at runtime. Static linking results in monolithic binaries used by distributions like Debian, Fedora, and Alpine Linux in certain deployment models, while dynamic linking with DT_NEEDED allows runtime loaders to fetch dependent shared objects managed by package maintainers at organizations like Canonical and SUSE. Techniques such as position-independent code (PIC) and prelinking have been employed by projects including Mozilla and Google for performance and address space layout; security mitigations like address space layout randomization are implemented in kernels maintained by Red Hat and Debian.

Tooling and Ecosystem

A rich ecosystem of tools manipulates ELF artifacts: assemblers and linkers in GNU Binutils, compiler frontends in GCC and LLVM, debuggers like GDB and LLDB, and binary inspection utilities such as readelf, objdump, file, and strip. Binary analysis and reverse-engineering frameworks including radare2, Ghidra, IDA Pro, and Binary Ninja parse ELF structures, while packaging systems at Debian Project, RPM-based distributions, and Homebrew manage ELF-based binaries. Continuous integration and build systems used by organizations like GitHub, GitLab, Jenkins, and Travis CI integrate ELF toolchains for cross-compilation supported by projects like crosstool-ng and Yocto Project.

Category:Executable file formats