Keyboard Shortcuts
- Ctrl+K
- Open search
- Esc
- Close search / dialog
- ↑
- Back to top
Binary Representation
Why This Matters
ELF files store numbers in specific byte orders (little-endian or big-endian). Understanding how bytes encode numbers is essential for reading ELF headers, addresses, and sizes correctly.
A Simple Model
Think of a number as a stack of digits. In decimal (base-10), each digit position represents a power of 10. In binary (base-2), each bit represents a power of 2.
A single byte can store 0-255. Two bytes can store 0-65535. Four bytes can store 0-4 billion.
The Actual Detail
Computers store numbers in binary. But we read hex dumps in hexadecimal because it maps directly to binary: each hex digit = exactly 4 bits.
| Binary | Hex | Decimal |
|---|---|---|
| 0000 | 0 | 0 |
| 0001 | 1 | 1 |
| 1010 | a | 10 |
| 1111 | f | 15 |
A byte (8 bits) = two hex digits. So 0xff = 11111111 = 255.
A Real Example
The ELF header stores the entry point address as a 4-byte number. Here's a hex dump of that field:
40 00 40 00
In little-endian (x86), this is the number 0x00400040 = 4,194,368 in decimal. That's the memory address where execution begins.
Try It
Convert this binary number to decimal:
00001010
Check Your Understanding
What is the decimal value of the hex byte 0x1a?
Connect
You now understand how bytes encode numbers. Next, we'll see how bytes are organized into the ELF file structure.
Every field in the ELF header — magic number, class, data encoding, type, machine — is just bytes interpreted as numbers.