Font: Spacing: Letters: Width:

ELF Header Fields

15 minintermediateModule 2: ELF HeaderContinues from elf-identification

Why This Matters

The ELF header is the first thing any tool reads. It tells the linker where sections are, the loader where program headers are, and the debugger what architecture the code targets. Every field has a specific purpose — and understanding them means you can read any ELF file.

A Simple Model

The ELF header (after the 16-byte e_ident) contains metadata about the file. Think of it as a table of contents:

What type is it? (executable, shared library, relocatable)
What architecture? (x86, ARM, RISC-V)
Where does code start? (entry point address)
Where are the program headers? (for the loader)
Where are the section headers? (for tools)

The Actual Detail

Here are all fields in the 64-bit ELF header (52 bytes after e_ident, total 64 bytes):

Field	Offset	Size	Description
e_ident	0	16	Identification array (previous concept)
e_type	16	2	ET_EXEC (2), ET_DYN (3), ET_REL (1)
e_machine	18	2	Architecture: 0x03=x86, 0x3E=x86-64, 0x28=ARM, 0xF3=RISC-V
e_version	20	4	ELF version (always 1)
e_entry	24	8	Virtual address of entry point
e_phoff	32	8	Program header table offset
e_shoff	40	8	Section header table offset
e_flags	48	4	Processor-specific flags
e_ehsize	52	2	ELF header size (64 for 64-bit)
e_phentsize	54	2	Program header entry size (56 for 64-bit)
e_phnum	56	2	Number of program header entries
e_shentsize	58	2	Section header entry size (64 for 64-bit)
e_shnum	60	2	Number of section header entries
e_shstrndx	62	2	Section name string table index

A Real Example

Here's a real ELF header from a 64-bit Linux binary:

ELF Header:
  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
  Class:                             ELF64
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  Type:                              DYN (Position-Independent Executable)
  Machine:                           Advanced Micro Devices x86-64
  Entry point address:               0x6810
  Start of program headers:          64 (bytes into file)
  Start of section headers:          16400 (bytes into file)
  Flags:                             0x0
  Size of this header:               64 (bytes)
  Size of program header entries:    56 (bytes)
  Number of program headers:         9
  Size of section header entries:    64 (bytes)
  Number of section headers:         27
  Section header string table index: 26

Try It

Use readelf -h on different binaries to compare headers. Try the ls, python3, or any compiled program in bin directories.

Check Your Understanding

What field in the ELF header tells the loader where the program header table begins?

Apply It

If e_phnum = 9 and e_phentsize = 56, how many bytes does the program header table occupy?

9 entries × 56 bytes each = 504 bytes total.

Connect

You now understand every field in the ELF header. The entry point field (next concept) deserves special attention — it's where execution begins.