ELF

Overview

ELF (Executable and Linkable Format) is the modern object file form used by x86-64 Linux systems.

A segment refers to a contiguous region of related code and/or data in a binary. Segments contain sections. We typically distinguish the following five segments within an object file:

1. Code. Also known as the text segment, contains executable code.
2. Data. Contains initialized global and (possibly local) static variables.
3. BSS. Contains uninitialized static data as well as variables initialized to zero.
4. Heap. Contains dynamically allocated memory.
5. Stack. Contains frames tracking procedure call metadata.

Sections

A typical ELF object file contains the following sections:

.text

The machine code of the compiled program.

.rodata

Read-only data such as the format strings in printf statements and jump tables for switch statements.

.data

Global and static C variables initialized to a non-zero value.

.tdata

Thread-local global and static C variables initialized to a non-zero value.

.bss

Assuming -fno-common, contains global and static C variables, along with any global or static variables initialized to zero.

.tbss

Uninitialized global and static thread-local C variables, along with any global or static thread-local variables initialized to zero.

.init

The .init section contains initialization code. It is a single block of assembly, superseded by the .init_array section.

.init_array

The .init_array section contains an array of pointers to functions that should be invoked on initialization.

.fini

The .fini section contains finalization code. It is a single block of assembly, superseded by the .fini_array section.

.fini_array

The .fini_array section contains an array of pointers to functions that should be invoked on finalization.

.got

The global offset table. Contains 8 byte entries for each global data object.

.plt

The procedure linkage table. Contains 16 byte code entries that perform lazy binding.

.symtab

A symbol table with information about functions and global variables defined and referenced in the program.

.rel.text

A list of locations in the .text section that will need to be modified when the linker combines this object file with others.

.rel.data

A list of locations in the .data section that will need to be modified when the linker combines this object file with others.

.strtab

A string table for the symbol tables in the .symtab section as well as for section names in the section headers. It is a sequence of NUL-terminated character strings.

.interp

Contains the path name of the dynamic linker to be used by the loader. Only exists on partially linked executable object files.