0

https://linux-audit.com/elf-binaries-on-linux-understanding-and-analysis/ says

The type field tells us what the purpose of the file is. There are a few common file types.

CORE (value 4)
DYN (Shared object file), for libraries (value 3)
EXEC (Executable file), for binaries (value 2)
REL (Relocatable file), before linked into an executable file (value 1)

...

A common misconception is that ELF files are just for binaries or executables. We already have seen they can be used for partial pieces (object code). Another example is shared libraries or even core dumps (those core or a.out files). The ELF specification is also used on Linux for the kernel itself and Linux kernel modules.

What ELF types do kernel itself and kernel modules have?

Could you give some examples of the files of kernel itself and kernel modules, for me to try out with file? I am using Ubuntu 18.04.

Thanks.

2

You can find out yourself:

For modules, by looking under /lib/modules/$(uname -r)/kernel/.../*.ko:

$ file xfs.ko 
xfs.ko: ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), BuildID[sha1]=bcb5e287509cedbb0c5ece383e0b97fb99e4781e, not stripped

$ readelf -h xfs.ko 
ELF Header:
  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF64
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              REL (Relocatable file)
  Machine:                           Advanced Micro Devices X86-64
  Version:                           0x1
  Entry point address:               0x0
  Start of program headers:          0 (bytes into file)
  Start of section headers:          1829088 (bytes into file)
  Flags:                             0x0
  Size of this header:               64 (bytes)
  Size of program headers:           0 (bytes)
  Number of program headers:         0
  Size of section headers:           64 (bytes)
  Number of section headers:         45
  Section header string table index: 44

For the kernel, an easy way is by compiling one and looking at vmlinux:

$ file vmlinux
vmlinux: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=eaf006a7ccfedbc40a6feddb04088bdb2ef0112f, with debug_info, not stripped

$ readelf -h vmlinux
ELF Header:
  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF64
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           Advanced Micro Devices X86-64
  Version:                           0x1
  Entry point address:               0x1000000
  Start of program headers:          64 (bytes into file)
  Start of section headers:          171602920 (bytes into file)
  Flags:                             0x0
  Size of this header:               64 (bytes)
  Size of program headers:           56 (bytes)
  Number of program headers:         5
  Size of section headers:           64 (bytes)
  Number of section headers:         43
  Section header string table index: 42
  • Thanks. Why does a kernel module have relocatable ELF type? What is the difference between REL and DYN types? – Tim Oct 18 '18 at 1:05
  • That will take up some space. In short, binaries (e.g. /bin/bash) and .so libraries (e.g. /lib/i386-linux-gnu/libc.so)- are DYN (dynamically linked). .a libraries (e.g. /usr/lib/*.a) are REL (relocatable). The modules need to be able to be loaded to an address that's not predefined, so they need to be relocatable. – V13 Oct 18 '18 at 1:23
  • Thanks. unix.stackexchange.com/questions/476165/… – Tim Oct 18 '18 at 1:47
1

With most Linux distributions, the kernel is stored in /boot as a compressed bzImage. This can be decompressed using the extract-vmlinux script (provided by the linux-headers package on Ubuntu systems). With Ubuntu 16.04, I can determine the ELF type for the 4.4.0 kernel by running the following commands:

$ sudo /usr/src/linux-headers-4.4.0-127/scripts/extract-vmlinux /boot/vmlinuz-4.4.0-127-generic > /tmp/vmlinux &&
readelf -h /tmp/vmlinux | grep Type

Type:                              EXEC (Executable file)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.