Entry Point

15 minintermediateModule 2: ELF HeaderContinues from elf-header-fields

Why This Matters

When you run a program, how does the CPU know where to start executing? The answer is the entry point — a virtual address stored in the ELF header. This single field connects the file on disk to the running process.

A Simple Model

The entry point is like a "Start Here" sign. When the kernel loads an ELF file, it maps the segments into memory and then jumps to the address stored in e_entry. For most programs, this points to the C runtime startup code, which eventually calls your main() function.

The Actual Detail

In a 64-bit ELF, e_entry is an 8-byte field at offset 24. It contains a virtual address (not a file offset). For position-independent executables (PIE), this is usually a small offset like 0x1060 or 0x6810. For non-PIE executables, it might be something like 0x401060.

The entry point is set by the linker based on the _start symbol. If no _start is defined, the linker uses address 0, which would crash.

A Real Example

$ readelf -h /bin/ls | grep "Entry point"
  Entry point address:               0x6810

$ gdb -batch -ex "info files" /bin/ls 2>&1 | grep entry
  0x0000000000006810 - 0x0000000000006860 is .init

The entry point 0x6810 falls in the .init section — the initialization code that runs before main().

Try It

$ readelf -h /bin/ls | grep "Entry point"
$ objdump -d /bin/ls | head -20  # See the disassembly at the entry point

Check Your Understanding

What does the entry point address point to?

Apply It

If you change the entry point to an address inside .text but not at _start, what will happen when the kernel jumps to it?

Connect

The ELF header tells us where execution begins. But how does the loader know which parts of the file to map into memory? That's what program headers (next module) describe.

True or False

The entry point address always points directly to the main() function.

True or False

For position-independent executables (PIE), the entry point is typically a small offset like 0x1060 rather than a fixed address like 0x401060.

Apply: Debug Scenario

A developer writes a minimal ELF loader. Their program crashes with SIGSEGV at address 0x0. They check the ELF header and find:

Entry point address: 0x0000000000000000
Type: ET_EXEC (not PIE)
Machine: x86-64

What went wrong, and how would you fix it?

1.The entry point is
2.The fix is to