Font: Spacing: Letters: Width:

ELF Identification

15 minintermediateModule 2: ELF HeaderContinues from file-layout

Why This Matters

Before the system can read any ELF file, it needs to answer basic questions: Is this a 32-bit or 64-bit file? Is it little-endian or big-endian? What operating system does it target? The ELF identification array answers all of these questions in the first 16 bytes.

A Simple Model

The first 16 bytes of every ELF file are the e_ident array. Think of it as the file's ID card:

Bytes 0-3: Magic number — 7f 45 4c 46 (spells ".ELF")
Byte 4: Class — 1 = 32-bit, 2 = 64-bit
Byte 5: Data encoding — 1 = little-endian, 2 = big-endian
Byte 6: ELF version — always 1
Byte 7: OS/ABI — 0 = System V, 3 = Linux, 6 = Solaris, etc.

The Actual Detail

Index	Name	Values	Description
0	EI_MAG0	0x7f	Magic number byte 0
1	EI_MAG1	0x45 ('E')	Magic number byte 1
2	EI_MAG2	0x4c ('L')	Magic number byte 2
3	EI_MAG3	0x46 ('F')	Magic number byte 3
4	EI_CLASS	1 or 2	ELFCLASS32 or ELFCLASS64
5	EI_DATA	1 or 2	ELFDATA2LSB (little) or ELFDATA2MSB (big)
6	EI_VERSION	1	ELF version (always 1)
7	EI_OSABI	0-18	Operating system / ABI identifier
8-15	EI_ABIVERSION	varies	ABI version + 7 bytes padding

The gABI specification defines EI_OSABI values: 0=ELFOSABI_NONE (System V), 1=ELFOSABI_HPUX, 3=ELFOSABI_LINUX, 6=ELFOSABI_SOLARIS, 9=ELFOSABI_FREEBSD.

A Real Example

Here's the e_ident of a real 64-bit Linux executable:

00000000: 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
          ^^ ^^ ^^ ^^ ^  ^  ^  ^  ^^^^^^^^^^^^^^^^^^^^^^^
          Magic "ELF"  64 LE v1 Linux  padding (zeroed)

Breaking it down: 7f 45 4c 46 = ELF magic, 02 = 64-bit, 01 = little-endian, 01 = version 1, 00 = Linux ABI.

Try It

Run this to see the ELF identification of any binary:

$ readelf -h /bin/ls | head -8
  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
  Class:                             ELF64
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0

Check Your Understanding

What are the first 4 bytes of every ELF file?

Apply It

A file starts with 7f 45 4c 46 01 02 01 00. What can you tell about it?

Byte 4 = 01 means 32-bit. Byte 5 = 02 means big-endian.

Connect

The ELF identification tells us the file's basic properties. The rest of the ELF header (next concept) tells us about entry points, section locations, and architecture.

← Swipe to navigate →

Keyboard Shortcuts