Filename extension none, .o, .so, .elf, .prx, .puff, .bin
Magic number 0x7F 'E' 'L' 'F'
Developed by Unix System Laboratories
Type of format Binary, executable, object, shared libraries, core dump
Container for Many executable binary formats

In computing, the Executable and Linkable Format (ELF, formerly called Extensible Linking Format) is a common standard file format for executables, object code, shared libraries, and core dumps. First published in the System V Application Binary Interface specification,[1] and later in the Tool Interface Standard,[2] it was quickly accepted among different vendors of Unix systems. In 1999 it was chosen as the standard binary file format for Unix and Unix-like systems on x86 by the 86open project.

ELF is flexible and extensible by design, and it is not bound to any particular processor or architecture. This has allowed it to be adopted by many different operating systems on many different platforms.

File layout

Each ELF file is made up of one ELF header, followed by file data. The file data can include:

  • Program header table, describing zero or more segments
  • Section header table, describing zero or more sections
  • Data referred to by entries in the program header table or section header table

The segments contain information that is necessary for runtime execution of the file, while sections contain important data for linking and relocation. Any byte in the entire file can be owned by at most one section, and there can be orphan bytes which are not owned by any section.

File header

The ELF header defines whether 32- or 64-bit addresses are to be used. The header itself contains 3 fields that are affected by this setting and offset other fields that follow them. The 64-bit header is 64 bytes long.

Offset Size (Bytes) Field Purpose
32-bit 64-bit 32-bit 64-bit
00 4 e_ident[EI_MAG0]


The first four bytes are always 0x7F followed by ELF in ASCII and constitute the magic number.
04 1 e_ident[EI_CLASS] This byte is set to either 1 or 2 to signify 32- or 64-bit format, respectively.
05 1 e_ident[EI_DATA] This byte is set to either 1 or 2 to signify little or big endianness, respectively. This affects interpretation of multi-byte fields starting with offset 0x10.
06 1 e_ident[EI_VERSION] Set to 1 for the original version of ELF.
07 1 e_ident[EI_OSABI] Identifies the target operating system ABI.
Value ABI
0x00 System V
0x01 HP-UX
0x02 NetBSD
0x03 Linux
0x06 Solaris
0x07 AIX
0x08 IRIX
0x09 FreeBSD
0x0C OpenBSD

It is often set to 0 regardless of the target platform.

08 1 e_ident[EI_ABIVERSION] Further specifies the ABI version. Its interpretation depends on the target ABI. Linux kernel(After at least 2.6) has no definition of it.[3] In that case, offset and size of EI_PAD are '8'.
09 7 e_ident[EI_PAD] currently unused
10 2 e_type 1, 2, 3, 4 specify whether the object is relocatable, executable, shared, or core, respectively.
12 2 e_machine Specifies target instruction set architecture. Some examples are:
Value ISA
0x02 SPARC
0x03 x86
0x14 PowerPC
0x28 ARM
0x32 IA-64
0x3E x86-64
0xB7 AArch64
14 4 e_version Set to 1 for the original version of ELF.
18 4 8 e_entry This is the memory address of the entry point from where the process starts executing. This field is either 32 or 64 bits long depending on the format defined earlier.
1C 20 4 8 e_phoff Points to the start of the program header table. It usually follows the file header immediately making the offset 0x40 for 64-bit ELF executables.
20 28 4 8 e_shoff Points to the start of the section header table.
24 30 4 e_flags Interpretation of this field depends on the target architecture.
28 34 2 e_ehsize Contains the size of this header, normally 64 bytes for 64-bit and 52 for 32-bit format.
2A 36 2 e_phentsize Contains the size of a program header table entry.
2C 38 2 e_phnum Contains the number of entries in the program header table.
2E 3A 2 e_shentsize Contains the size of a section header table entry.
30 3C 2 e_shnum Contains the number of entries in the section header table.
32 3E 2 e_shstrndx Contains index of the section header table entry that contains the section names.


  • readelf is a Unix binary utility that displays information about one or more ELF files. A free software implementation is provided by GNU Binutils.
  • elfutils provides alternative tools to GNU Binutils purely for Linux.[4]
  • elfdump is a command for viewing ELF information in an ELF file, available under Solaris and FreeBSD.
  • objdump provides a wide range of information about ELF files and other object formats. objdump uses the Binary File Descriptor library as a back-end to structure the ELF data.
  • The Unix file utility can display some information about ELF files, including the instruction set architecture for which the code in a relocatable, executable, or shared object file is intended, or on which an ELF core dump was produced.


The ELF format has replaced older executable formats in various environments. It has replaced a.out and COFF formats in Unix-like operating systems:

ELF has also seen some adoption in non-Unix operating systems, such as:

Some game consoles also use ELF:

Other operating systems running on PowerPC using ELF:

  • AmigaOS 4, the ELF executable has replaced the previous EHF (Extended Hunk Format) which was used on Amigas equipped with PPC processor expansion cards.
  • MorphOS
  • AROS

Some operating systems for mobile phones and mobile devices use ELF:

Some phones can run ELF files through the use of a patch that adds assembly code to the main firmware (known as the ELFPack, in the underground modding culture).

The ELF file format is also used with the Atmel AVR (8-bit), AVR32[9] and with Texas Instruments MSP430 microcontroller architectures.


  • Generic:
    • System V Application Binary Interface Edition 4.1 (1997-03-18)
    • System V ABI Update (October 2009)
    • ELF-64 Object File Format Version 1.5 Draft 2 (May 1998)
  • AMD64:
    • System V ABI, AMD64 Supplement
  • ARM:
    • ELF for the ARM Architecture
  • IA-32:
    • System V ABI, Intel386 Architecture Processor Supplement
  • IA-64:
    • Itanium Software Conventions and Runtime Guide (September 2000)
  • M32R:
    • M32R ELF ABI Supplement Version 1.2 (2004-08-26)
  • MIPS:
    • System V ABI, MIPS RISC Processor Supplement
    • MIPS EABI documentation (2003-06-11)
  • Motorola 6800:
    • Motorola 8 and 16 bit Embedded ABI
  • PA-RISC:
    • ELF Supplement for PA-RISC Version 1.43 (October 6, 1997)
  • PowerPC:
    • System V ABI, PPC Supplement
    • PowerPC Embedded Application Binary Interface 32-Bit Implementation (1995-10-01)
    • 64-bit PowerPC ELF Application Binary Interface Supplement Version 1.9 (2004)
  • SPARC:
    • System V ABI, SPARC Supplement
  • S/390:
    • S/390 32bit ELF ABI Supplement
  • zSeries:
    • zSeries 64bit ELF ABI Supplement
  • Symbian OS 9:
    • E32Image file format on Symbian OS 9


86open was a project to form consensus on a common binary file format for Unix and Unix-like operating systems on the common PC compatible x86 architecture, so as to encourage software developers to port to the architecture.[10] The initial idea was to standardize on a small subset of Spec 1170, a predecessor of the Single UNIX Specification, and the GNU C Library (glibc) to enable unmodified binaries to run on the x86 UNIX-like operating systems. The project was originally referred to as "Spec 150".

The format eventually chosen was ELF, specifically the Linux implementation of ELF, after it had turned out to be a de facto standard supported by all involved vendors and operating systems.

The group started email discussions in 1997 and first met in person at the Santa Cruz Operation offices on 1997-08-22.

The steering committee was Marc Ewing, Dion Johnson, Evan Leibovitch, Bruce Perens, Andrew Roach, Bryan Sparks and Linus Torvalds. Other people on the project were Tim Bird, Keith Bostic, Chuck Cranor, Michael Davidson, Chris G. Demetriou, Ulrich Drepper, Don Dugger, Steve Ginzburg, Jon "maddog" Hall, Ron Holt, Jordan Hubbard, Dave Jensen, Kean Johnston, Andrew Josey, Robert Lipe, Bela Lubkin, Tim Marsland, Greg Page, Ronald Joe Record, Tim Ruckle, Joel Silverstein, Chia-pi Tien and Erik Troan. Operating systems and companies represented were BeOS, BSDI, FreeBSD, Intel, Linux, NetBSD, SCO and SunSoft, Inc..

The project progressed and in mid-1998, SCO began developing lxrun, an open-source compatibility layer capable of running Linux binaries on OpenServer, UnixWare, and Solaris. SCO announced official support of lxrun at LinuxWorld in March 1999. Sun Microsystems began officially supporting lxrun for Solaris in early 1999,[11] and has since moved to integrated support of the Linux binary format via Solaris Containers for Linux Applications.

With the BSDs having long supported Linux binaries (through a compatibility layer) and the main x86 Unix vendors having added support for the format, the project decided that Linux ELF was the format chosen by the industry and "declare[d] itself dissolved" on July 25, 1999.[12]

FatELF: Universal Binaries for Linux

ABIs versions. A proof-of-concept

See also


Further reading

  • An unsung hero: The hardworking ELF by Peter Seebach (2005-12-20)
  • LibElf and GElf — A Library to Manipulate ELF Files by Neelakanth Nadgir (August 2001)
  • The ELF Object File Format by Dissection by Eric Youngdale (1995-05-01)
  • A Whirlwind Tutorial on Creating Really Teensy ELF Executables for Linux by Brian Raiter
  • ELF relocation into non-relocatable objects by Julien Vanegue (2003-08-13)
  • Embedded ELF debugging without ptrace by the ELFsh team (2005-08-01)
  • Study of ELF loading and relocs by Pat Beirne (1999-08-03)

External links

  • FreeBSD Handbook: Binary formats
  • manual page
  • Solaris's Linker and Libraries Guide ©2001 Sun Microsystems
  • The ERESI project : reverse engineering on ELF-based operating systems
  • Linux Today article on 86open July 26, 1999
  • Bruce Perens
  • The SCO Group vs IBM, September 19, 2006
  • Groklaw, August 13, 2006
This article was sourced from Creative Commons Attribution-ShareAlike License; additional terms may apply. World Heritage Encyclopedia content is assembled from numerous content providers, Open Access Publishing, and in compliance with The Fair Access to Science and Technology Research Act (FASTR), Wikimedia Foundation, Inc., Public Library of Science, The Encyclopedia of Life, Open Book Publishers (OBP), PubMed, U.S. National Library of Medicine, National Center for Biotechnology Information, U.S. National Library of Medicine, National Institutes of Health (NIH), U.S. Department of Health & Human Services, and USA.gov, which sources content from all federal, state, local, tribal, and territorial government publication portals (.gov, .mil, .edu). Funding for USA.gov and content contributors is made possible from the U.S. Congress, E-Government Act of 2002.
Crowd sourced content that is contributed to World Heritage Encyclopedia is peer reviewed and edited by our editorial staff to ensure quality scholarly research articles.
By using this site, you agree to the Terms of Use and Privacy Policy. World Heritage Encyclopedia™ is a registered trademark of the World Public Library Association, a non-profit organization.