Questions tagged [elf]

ELF stands for Executable and Linkable Format, a file format for files containing machine code.

Filter by
Sorted by
Tagged with
53
votes
8answers
67k views

Can we get compiler information from an elf binary?

Is there some chance to know how a binary was built, under Linux? (and or other Unix) Compiler, version, time, flags etc... I looked at readelf and couldn't find much, but there might be other ways ...
34
votes
2answers
4k views

Oldest binary working on Linux?

In a discussion on backwards-compatibility in Linux kernel and GUI ABIs, Alan Cox notes that "my 3.6rc kernel will still run a Rogue binary built in 1992. X is back compatible to apps far older than ...
33
votes
10answers
6k views

Why are programs not distributed in compiled format?

But they give instructions like cd downloaded_program ./configure make install This creates the ELF that is needed, and probably some .so files. Why not put those inside a zip file for download, ...
26
votes
2answers
17k views

What is ELF Magic?

I've seen discussion before about ELF magic, most recently the comments in this Security stack exchange question. I've seen it mentioned before, and I've seen it in my own boot logs.. But I'm not sure ...
24
votes
1answer
12k views

What does “LSB” mean when referring to executable files in the output of /bin/file?

I have found the term "LSB executable" or "LSB shared object" in the output of the file command in Linux. For example: $ file /bin/ls /bin/ls: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), ...
18
votes
1answer
2k views

Why does the file command say that ELF binaries are for Linux 2.6.9?

Whenever I run file on an ELF binary I get this output: [jonescb@localhost ~]$ file a.out a.out: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), for GNU/Linux 2.6.9, dynamically linked (...
14
votes
2answers
12k views

Determine if a specific process is 32- or 64-Bit

Given a 2.6.x or newer Linux kernel and existing userland that is capable of running both ELF32 and ELF64 binaries (i.e. well past How do I know that my CPU supports 64bit operating systems under ...
13
votes
1answer
6k views

Linux, GNU GCC, ld, version scripts and the ELF binary format — How does it work?

I'm trying to learn more about library versioning in Linux and how to put it all to work. Here's the context: -- I have two versions of a dynamic library which expose the same set of interfaces, say ...
11
votes
1answer
6k views

When can I edit strings in an executable binary?

I have an executable binary; let's call it a.out. I can see the binary contains strings $ strings a.out ... /usr/share/foo .... I need to change the string /usr/share/foo to /usr/share/bar. Can I ...
11
votes
3answers
2k views

Detect if an ELF binary was built with gprof instrumentation?

Is it possible to check if given program was compiled with GNU gprof instrumentation, i.e. with '-pg' flag passed to both compiler and linker, without running it to check if it would generate a gmon....
10
votes
1answer
6k views

Which parts of an ELF executable get loaded into memory, and where?

What I already know: An ELF executable has a number of sections, obviously the .text and .data sections get loaded into memory as these are the main parts of the program. But for a program to work, ...
10
votes
1answer
4k views

Why does readelf show “System V” as my OS instead of Linux?

I compiled a small C program (2 lines of codes) with gcc to try to understand ELF file format. Doing a readelf -h on the object file, I have in the header : OS/ABI: UNIX - ...
9
votes
1answer
4k views

Why doesn't `strip` remove section headers from ELF executables?

A minimal ELF executable only requires the ELF header and at least one program header in order to be functional. However, when I run strip on a short executable, it decides not to throw out the ...
8
votes
1answer
18k views

How does bash execute an ELF file?

When I'm on my Linux Box I use bash as a shell. Now I wondered how bash handles the execution of an ELF file, that is when I type ./program and program is an ELF file. I grepped the bash-4.3.tar.gz, ...
8
votes
1answer
1k views

Linker script in .so file? (libc.so) Is that right?

I am currently trying to get python to run on my NAS which is a Zyxel NSA325. I did manage to get python 2.7 and pip running and I was able to successfully install the watchdog module with pip. I ...
8
votes
2answers
787 views

How does the ELF loader determine the initial stack size?

I'm studying the ELF specification (http://www.skyfree.org/linux/references/ELF_Format.pdf), and one point that is not clear to me about the program loading process is how the stack is initialized, ...
7
votes
2answers
5k views

Unix/Linux Loader Process

Can anyone tell me which process of the operating system loads the ELF(Executable and Linking format) file into RAM ?
7
votes
2answers
11k views

Why does LD keep outputting “no version information available”

On every loading of a lib, I get the error: no version information available This lib has been compiled on another PC (ubuntu 10.04) than the one running it (mandriva 2010.2). $ ldd /usr/local/...
7
votes
7answers
23k views

How to find executable filetypes?

I want to find file types that are executable from the kernel's point of view. As far as I know all the executable files on Linux are ELF files. Thus I tried the following: find * | file | grep ELF ...
7
votes
2answers
929 views

Repack the filesystem image from vmlinux.bin (embedded initramfs) without rebuilding?

In How do I extract the filesystem image from vmlinux.bin? and https://wiki.gentoo.org/wiki/Custom_Initramfs#Salvaging methods are presented for getting and unpacking an embedded initramfs/initrd ...
6
votes
3answers
2k views

What harm would there be in running strip on all files?

I'm trying to decrease a Linux image running SuSE, and thought about running strip on all of the system's executables. Even though I may not re-gain much disk space this way, would there be any harm ...
6
votes
1answer
1k views

What does `*` mean using hexdump -C?

I've been doing an exersice in attempt to understanding some of what's going on under the hood of a program. I wrote a small C program, and compiled it on i386 Linux (Ubuntu 12.04) using gcc. I then ...
6
votes
1answer
6k views

Memory layout of dynamic loaded/linked library

when loading a shared library in Linux system, what is the memory layout of the shared library? For instance, the original memory layout is the following: +-----------+ |heap(ori) | +-----------+ |...
5
votes
1answer
2k views

Why can't I execute Android x86 executables on Linux

I am trying to port Android apps to Linux (don't laugh :) and I have come across a problem. When trying to execute an Android executable (app_process) after adding the executable permission with ./...
5
votes
2answers
3k views

What is the difference between “LSB executable” (ET_EXEC) and “LSB shared object” (ET_DYN)?

With two files, one compiled and linked with gcc and the other manually with nasm and ld I get ELF 32-bit LSB shared object ... ELF 32-bit LSB executable ... What's the difference between these two ...
5
votes
1answer
1k views

Rationale for making user space text segment start at 0x8048000

I read somewhere that (at least since Linux v. 2.6) all user-space code is placed at load address 0x8048000 in the virtual memory address space. My own observations confirm this. I have done a cat /...
5
votes
1answer
2k views

Portions of the file Header

I was working through my C programs, I am new to Linux/UNIX development and was having a look around. I created a simple C program of Hello world and was inspecting the compilation process. I tried ...
4
votes
1answer
2k views

What's the difference between readelf and eu-readelf?

You get eu-readelf from: $ sudo apt-get install elfutils I was just wondering why you would use one over the other ?
4
votes
1answer
3k views

When executable files aren't [duplicate]

Possible Duplicate: Can't execute some binaries in chroot environment (zsh: Not found) Today I ran into something that has me stumped. A co-worker is working with a specific pre-compiled ...
4
votes
2answers
675 views

Different formats of object files in Linux

I was wondering what are some formats of object files in Linux? There are two types of object files that I know: executable, which has ELF format object files that are generated by gcc after ...
3
votes
3answers
60 views

Differentiate between ELFves and scripts quickly

How do I use file to differentiate between ELFves and scripts as quickly as possible? I don't need any further details, just ELF, script (/plaintext), or other/error.
3
votes
2answers
1k views

What is the difference between Shared object file and Relocatable file?

https://linux-audit.com/elf-binaries-on-linux-understanding-and-analysis/ says The type field tells us what the purpose of the file is. There are a few common file types. CORE (value 4) DYN (...
3
votes
2answers
21k views

How objdump disassemble elf binary

I have a quick question. I have generated a ELF binary from a c code using following code: gcc -o simple simple.c Then I do objdump for that ELF binary: objdump --disassemble-all simple I have ...
3
votes
1answer
4k views

Reading the program header contents of an ELF file

How is it possible to extract loadable program headers individually from ELF files? By examining a binary using readelf one can get output similar to: $ readelf -l helloworld Elf file type is EXEC (...
3
votes
1answer
5k views

Why does chroot get ENOENT on an existing file?

;TL-DR - Answer: because the dynamic linker ld-linux-x86-64.so.2 was missing. I have mounted a squashfs (shouldn't matter) filesystem -ro,loop at /mnt/foo. It contains among other things the ...
3
votes
1answer
238 views

Are .text sections shared between loaded ELF executables?

If one program, for example grep, is curretly running, and a user executes another instance, do the two instances share the read-only .text sections between them to save memory? Would the sharing of ...
3
votes
0answers
96 views

How does linux decide the load address and entry point when execve an ELF?

When linux execve() an ELF, it will mmap that ELF into the process's memory space and start to run code from the entry point. But how does the kernel decide the load address and entry point of the ELF?...
3
votes
1answer
790 views

How to make my ELF run with both new and old version of glibc?

When I'm compiling my elf, it is "best practice" to make it link against the oldest version of glibc I can, so it will work both on new and old versions of glibc. i.e. if I use realpath, which in ...
2
votes
2answers
619 views

How many sections can I create in object file?

I'm following the course of Baking Pi – Operating Systems Development. In it they created another section .init. So can we create as many sections as we want (not just .data, .bss, .text) and can we ...
2
votes
1answer
353 views

how can I run old programs from a MIPS?

I have an old PC with a program called atomTV, for viewing, and producing movies from molecular trajectory files. I only have a binary, and the platform it ran on was 64-bit MIPS architecture, where I ...
2
votes
2answers
406 views

Different standards of ELF (SysV vs TIS) and Linux?

There are at least two standards of Executable and Linkable Format (ELF), one of them System V Application Binary Interface AMD64 Architecture Processor Supplement (With LP64 and ILP32 Programming ...
2
votes
1answer
828 views

How does prelink work

I was wondering how prelinking works. If I prelink my whole system and than delete glibc, will the system 'get up' after restart?
2
votes
1answer
3k views

Symbol table in the .data section of ELF

I'm trying to understand how does symbol tables relate to the .data section in ELF. First some assumptions that I'm using as ground to start with. A symbol is a human readable (or "as written in ...
2
votes
6answers
1k views

Searching for 32-bit ELF file

I wonder if there is any possibility to find files which are 32-bit ELF objects by using one single command in file system? I'm actually working in fedora 23 64 bit and can't locate any of those files ...
2
votes
1answer
524 views

GNU linker producing useless spacing between sections in ELF file

My intent is to place the text section at a specific location in memory (0x00100000). SECTIONS { . = 0x00100000; .text : { *(.text*) } } Although the linker does do ...
2
votes
1answer
989 views

Executable Format in OS X vs Executable Format in FreeBSD

Mac OS X uses Mach-o executable format and FreeBSD Unix uses ELF executable format. OS X uses FreeBSD Unix, correct me if I'm wrong. Then why does the Executable format in OS X differ from that of ...
2
votes
1answer
535 views

How to compile to a specific executable format?

I'm a bit confused. I just read this: http://www.es.freebsd.org/doc/handbook/binary-formats.html, which basically says that freeBSD uses the elf binary format. But when I compile my code I using cc, I ...
2
votes
2answers
927 views

Extracting the size and origin of all symbols in an ELF

I am trying to estimate the code size of a binary's various components. I have access to the source code and resulting build directory containing all built object files. Of course, I want to include ...
2
votes
1answer
193 views

.elf format internal inspection

I was reading ELF format specification, where was told all this stuff with elf-headers, program header, sections, segments and etc. All this is referenced as structs with all kind of fields and values....
2
votes
1answer
615 views

Using prelink on manually loaded libraries? (like Java native libraries)

As far as I can tell, prelink can only works with dynamic libraries which an executable declares it needs at compile time (the libraries that can be found with ldd). It doesn't seem to include ...