Font: Spacing: Letters: Width:

File Layout

12 minbeginnerModule 1: FundamentalsContinues from binary-representation

Why This Matters

An ELF file isn't just a random pile of bytes. It has a precise layout that the operating system and tools like readelf expect. Understanding this layout is essential for reading ELF files, debugging binaries, and building tools that work with them.

A Simple Model

Think of an ELF file like a book. It has:

A cover page (ELF header) — tells you what kind of book this is
A table of contents (program header table) — tells the runtime where to find chapters
The actual chapters (segments and sections) — the code and data
A library catalog entry (section header table) — tells tools where to find specific sections

The Actual Detail

An ELF file has four main parts, in this exact order:

Part	Offset	Purpose
ELF Header	0x00	Identifies the file as ELF, states class (32/64), endianness, and points to other tables
Program Header Table	e_phoff	Describes segments for the runtime loader
Sections / Segments	varies	The actual code (.text), data (.data), symbols, relocations, etc.
Section Header Table	e_shoff	Describes sections for tools like readelf, objdump, ld

The ELF header is always at byte 0. The program header table comes right after (or at the offset specified by e_phoff). Sections and segments fill the middle. The section header table is at the end (or at e_shoff).

A Real Example

Here's the layout of a real 64-bit ELF executable (bin/ls):

Offset    Size     What
0x000000  0x40     ELF Header (64 bytes for 64-bit)
0x000040  varies   Program Header Table (3 entries, 56 bytes each)
0x000128  varies   .interp (dynamic linker path)
0x000140  varies   .init, .plt, .text (code)
...       ...      ...more sections...
0x003ff0  varies   Section Header Table

Use readelf -l /bin/ls to see the program headers and their file offsets.

Try It

Run these commands on your system:

$ readelf -h /bin/ls | head -5
  Magic:   7f 45 4c 46 02 01 01 00 ...
  Class:                             ELF64
  Data:                              2's complement, little endian

$ readelf -l /bin/ls | head -10
  Elf file type is DYN (Position-Independent Executable)
  Entry point 0x6810
  There are 9 program headers

Check Your Understanding

Without looking back: what part of an ELF file does the runtime loader use to map segments into memory?

Apply It

Given this information about an ELF file, where does the section header table start?

e_shoff = 0x3ff0
e_shentsize = 64
e_shnum = 27

Connect

You now understand how an ELF file is laid out. The ELF header (next concept) tells us exactly where each part begins and how big it is.

← Swipe to navigate →

Keyboard Shortcuts