ELF (Executable and Linkable Format) to perform connection file Format, is a more complex file Format, but its application is extensive, and the other under Linux executables (a.out, cof package), compared to its definition of section and gnu tool chain support for it makes it very flexible, it saved enough relevant information to enable it to support the system on different platforms of cross-compiling and cross links, portability strong. At the same time it support in the execution of dynamically linked Shared libraries,
In this article, you can get a general idea of the ELF file format in the Linux system classification, composition, function, and contains the content, in addition, this paper introduces several kinds of commonly used behind the ELF file manipulation tools, and its use is simple, for example, to facilitate the ELF file has a more intuitive understanding,

Main content (directory) :
[description]
1 the ELF file description
2 the ELF file format
The characteristics of three ELF
[for example]
1 the readelf tool
2 objcopy tool
3 objdump tools
4 nm tool
5 LDD tool

[description]
1 the ELF file description
The ELF (Executable and Linkable Format) to perform connection file Format, Linux, the goal of an SVR4 and Solaris2.0 default file Format, the current standard interface board TIS has placed the ELF into a portable object file formats, running on 32 - bit microcomputer Intel system, can be compatible with a variety of operating systems, analysis the ELF file help in understanding some important system concept, such as program compile and link, loading and running of the program, etc.,
(1) the ELF file type:
Types of ELF file:
Relocatable file: a) the user with other object files to create an executable or a Shared object file, for example, lib *. A file,
B) the executable file: used to generate the process image, in the memory, compiled executable file a.out, for example,
C) Shared object file: and other Shared object files or relocatable file generated with the elf object files or create process image with executable files, for example, lib *. So file,

(2) the ELF file:
The ELF files involved in the program (a program) and execution (run a program), so I can from different angles to view the ELF file format:
A) if used to compile and link (relocatable file), the compiler and linker will describe the elf file as section head table section of a collection of program header table optional,
B) if used to load (executable file), the loader will consider the elf file's program header table describes a collection of segments, one segment may contain multiple section, section head table optional,
C) if it is a Shared file, both contain,

(3) the ELF file of overall:
The elf file header elf file on the general information, including:
System related, type, loading, related links,
System related said: the elf file id of the magic number, as well as the hardware platform and so on related information, increase the portability of the elf file, made it possible to cross compile,
Type related said earlier that type,
Load related: including the program header table information,
Link: section head table information,
Below it has carried on the detailed introduction,

2 the ELF file format
2.1 the ELF file type
The ELF file there are three main types:
(1) the relocatable file: contains the code and data. With other ELF file to build an executable or a Shared file:
(2) the executable file, can be directly executed program:
(3) the Shared object file: including code and data, can be in two places links, first, the connector can be relocatable file and share it with other processing to build another ELF files together; Second, the dynamic linker with an executable files and other Shared file together to create a process image,

2.2 the ELF file organization
ELF file links to participate in the program (a program) and execution (run a program), the compiler and linker as section head table (section header table) description of a collection of section (section), and the loader as the program header table (the program header table) to describe a collection of segments (segment), usually a section can contain more than one section, relocatable file contains a section header table, executable file contains a program header table, both contain Shared file, to this end, the ELF file format provides two at the same time look at the file content, reflects the different behavior of different requirements,
From the perspective of the link, the ELF file from start to finish, may be regarded as composed of the following:
A) the ELF file header
B) the program header table (optional)
C) section 1, section 2,... , n,...
D) section header table
From the perspective of execution, the ELF file from start to finish, may be regarded as composed of the following:
A) the ELF file header
B) the program header table
C) paragraph 1, paragraph 2,... ,
D) section header table (optional)

2.3 the file header (Elf header)
Elf header at the beginning of the program, as a guide table to describe the entire Elf file structure, the information roughly divided into four parts: one is the information system, the second is the target file types, three is to load information, four links to related information,
System relevant information including the elf file number (identification elf file), platform digits, data coding way, the elf's head version, e_machine hardware platform, the target file version e_version processor-specific e_ftags signs: the introduction of the information have also been boosted by the elf file portability, made it possible to cross compile, the value of the target file types with e_type said the relocatable file is 1, the executable file to 2, Shared files for 3; Load information are: e_entry program into the point. Program header table offset e_phoff, the elf e_ehsize head length, a single entry in the program header table e_phentsize, the length of the program header table entries e_phnum; Links to related information: table offset e_shoff head section, section e_shentsize the length of the head of an entry in the table, section head e_shnum table entry number, section head table character index e SHSTMDX, can use the command "readelf - h filename" to view the contents of the file header,
File header data structure is as follows:
Typedef struct elf32_hdr {
Unsigned char e_ident [EI_NIDENT];
Elf32_Half e_type;//the target file type
Elf32_Half e_machine;//hardware platform
Elf32_Word e_version;//the elf's head version
Elf32_Addr e_entry;//program entry point
Elf32_Off e_phoff;//program header table offset
Elf32_Off e_shoff;//section head table offset
Elf32_Word e_flags; Mark/processor-specific
Elf32_Half e_ehsize;//the elf's head length
Elf32_Half e_phentsize;//a in the program header table entry
the length of theElf32_Half e_phnum;//program header table entries as
Elf32_Half e_shentsize;//the length of the section head of an entry in the table
Elf32_Half e_shnum;//section head table entry number
Elf32_Half e_shstrmdx;//section head table character index
} Elf32_Ehdr;

2.4 program header table (the program header table)
Program header table to tell the system how to build a process image. It from the Angle of the load to perform to view the elf file. From the point of view. The elf file is divided into many segments, the code in the elf file, link information and comments are stored in the form of section, every segment in the program header table have a table item description, contains the following attributes: type, period of the resident position relative to the document at the beginning of the shift, in the first byte of memory address, physical address, number of bytes in the file image. Segments of the bytes in memory image, in the memory and file the alignment marks, available "readelf - l filename" to examine the contents of the program header table, the structure of the program header table is as follows:
Typedef struct elf32_phdr {
Elf32_Word p_type;//section type
Elf32_Off p_offset;//section position relative to the file beginning offset
Elf32_Addr p_vaddr;//section of the first byte in memory address
Elf32_Addr p_paddr;//section of the physical address
Elf32_Word p_filesz;//section of the number of bytes in the file image
Elf32_Word p_memsz;//section in the number of bytes of memory image
Elf32_Word p_flags;//paragraph tag
Elf32_Word p_align; ,/to be aligned in memory tag
) Elf32_Phdr;

Section 2.5 header table (section header table)
Section header table describe the procedures section, service for the compiler and linker, it makes the elf file into many sections. Every day holds the data for different purposes. Program header in front of these data may be repeated use, the information required to complete a task is often scattered in different section, due to the use of the different data section, section is divided into different types, each type of section has their own way to organize data, each section in the section head of the table there is a table describing attributes of the section, section properties including section name in the character table of the index, types, properties, virtual address at runtime, the file offset, in bytes, the size of the section of the alignment, can use "readelf - S filename" section to view the contents of the header table, section head table structure is as follows:
Typedef struct {
Elf32_Word sh_name;//section name in character in the table index
E1t32_Word sh_type;//the type of section
Elf32_Word sh_flags;//section attribute
Elf32_Addr sh_addr;//section at runtime virtual address
Elf32_Off sh_offset;//section of the file offset
Elf32_Word sh_size;//the size of the section. In bytes
Elf32_Word sh_link;//links to another section of the index
Elf32 Word sh_info;//the additional information section
Elf32 Word sh_addralign;//section of the alignment
Elf32 Word sh_entsize;//some sections holds a fixed size entry list, as the symbol table
} Elf32_Shdr;

The characteristics of three ELF
3.1 platform
In the ELF file header contains enough information platform, such as data encoding, digit platform, hardware platform e_machine etc., these information platform can be in the build is determined by the compiler, for example, the definition of data structure associated with platform digit in the ELF. H header file. During the compilation of preprocessing determine:
# if the ELF CLASS==ELFCLASS32
Extern Elf32_Dyn_DYNAMIC [];
# define elfhdr elf32_hdr;
# define elf_phdr elf32_phdr;
# define elf_note elf32_note;
# the else
Extern Elf64_Dyn_DYNAMIC [];
# define elfhdr elf64_hdr;
# define elf_phdr elf64_phdr;
nullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnull