ELF file format

ET_NONE (ELF type none)

• unknown type
• The file is undefined or not yet classified.

ET_REL (ELF type relocatable)

• Relocatable object format
• All or part of the file can still be relocated
• Relocatable objects are the usual home of position-independent code (PIC)
• 아직 실행 파일에 링킹되지 않은 상태
• Compiler .o outputs hold the code and data the linker still needs to assemble into an executable

ET_EXEC (ELF executable)

• Executable program image
• Has a process entry point

ET_DYN (ELF type dynamic)

• Shared object / dynamically linkable library
• Loaded and linked into a process image at runtime

ET_CORE (ELF type core)

• Core dump of a process image
• Typically written on abnormal exit (for example SIGSEGV / segmentation fault)
• GDB can read the core and help reconstruct why the process died

ELF file header

The ELF header starts at file offset 0.

Header contents

1. ELF 형식
2. 아키텍처
3. 엔트리 포인트 주소
4. 섹션 헤더
5. 프로그램 헤더
6. 다른 ELF 헤더의 주소 오프셋
...

Those fields are the primary metadata for the rest of the file.

Linux Programmer's Manual — ELF(5)

#define EI_NIDENT 16
 
           typedef struct {
               unsigned char e_ident[EI_NIDENT];
               uint16_t      e_type;
               uint16_t      e_machine;
               uint32_t      e_version;
               ElfN_Addr     e_entry;
               ElfN_Off      e_phoff;
               ElfN_Off      e_shoff;
               uint32_t      e_flags;
               uint16_t      e_ehsize;
               uint16_t      e_phentsize;
               uint16_t      e_phnum;
               uint16_t      e_shentsize;
               uint16_t      e_shnum;
               uint16_t      e_shstrndx;
           } ElfN_Ehdr;