ELF(3) BSD Library Functions Manual ELF(3)
elf -- API for manipulating ELF objects
The library ``libelf'' library provides functions that allow an application to read and
manipulate ELF object files, and to read ar(1) archives. The library allows the manipula-
tion of ELF objects in a byte ordering and word-size independent way, allowing an applica-
tion to read and create ELF objects for 32 and 64 bit architectures and for little- and big-
endian machines. The library is capable of processing ELF objects that use extended section
This manual page serves to provide an overview of the functionality in the ELF library.
Further information may found in the manual pages for individual ELF(3) functions that com-
prise the library.
As described in elf(5), ELF files contain several data structures that are laid out in a
specific way. ELF files begin with an ``Executable Header'', and may contain an optional
``Program Header Table'', and optional data in the form of ELF ``sections''. A ``Section
Header Table'' describes the content of the data in these sections.
ELF objects have an associated ``ELF class'' which denotes the natural machine word size for
the architecture the object is associated with. Objects for 32 bit architectures have an
ELF class of ELFCLASS32. Objects for 64 bit architectures have an ELF class of ELFCLASS64.
ELF objects also have an associated ``endianness'' which denotes the endianness of the
machine architecture associated with the object. This may be ELFDATA2LSB for little-endian
architectures and ELFDATA2MSB for big-endian architectures.
ELF objects are also associated with an API version number. This version number determines
the layout of the individual components of an ELF file and the semantics associated with
Data Representation And Translation
The ELF(3) library distinguishes between ``native'' representations of ELF data structures
and their ``file'' representations.
An application would work with ELF data in its ``native'' representation, i.e., using the
native byteorder and alignment mandated by the processor the application is running on. The
``file'' representation of the same data could use a different byte ordering and follow dif-
ferent constraints on object alignment than these native constraints.
Accordingly, the ELF(3) library offers translation facilities (elf32_xlatetof(3),
elf32_xlatetom(3), elf64_xlatetof(3) and elf64_xlatetom(3)) to and from these representa-
tions and also provides higher-level APIs that retrieve and store data from the ELF object
in a transparent manner.
Library Working Version
Conceptually, there are three version numbers associated with an application using the ELF
library to manipulate ELF objects:
o The ELF version that the application was compiled against. This version deter-
mines the ABI expected by the application.
o The ELF version of the ELF object being manipulated by the application through the
o The ELF version (or set of versions) supported by the ELF library itself.
In order to facilitate working with ELF objects of differing versions, the ELF library
requires the application to call the elf_version() function before invoking many of its
operations, in order to inform the library of the application's desired working version.
In the current implementation, all three versions have to be EV_CURRENT.
The ELF library uses the following prefixes:
elf_* Used for class-independent functions.
elf32_* Used for functions working with 32 bit ELF objects.
elf64_* Used for functions working with 64 bit ELF objects.
Elf_* Used for class-independent data types.
ELF_C_* Used for command values used in a few functions. These symbols are defined as mem-
bers of the Elf_Cmd enumeration.
ELF_E_* Used for error numbers.
ELF_F_* Used for flags.
ELF_K_* These constants define the kind of file associated with an ELF descriptor. See
elf_kind(3). The symbols are defined by the Elf_Kind enumeration.
ELF_T_* These values are defined by the Elf_Type enumeration, and denote the types of ELF
data structures that can be present in an ELF object.
Applications communicate with the library using descriptors. These are:
Elf An Elf descriptor represents an ELF object or an ar(1) archive. It is allocated
using one of the elf_begin() or elf_memory() functions. An Elf descriptor can be
used to read and write data to an ELF file. An Elf descriptor can be associated
with zero or more Elf_Scn section descriptors.
Given an ELF descriptor, the application may retrieve the ELF object's class-
dependent ``Executable Header'' structures using the elf32_getehdr() or
elf64_getehdr() functions. A new Ehdr structure may be allocated using the
elf64_newehdr() or elf64_newehdr() functions.
The ``Program Header Table'' associated with an ELF descriptor may be allocated
using the elf32_getphdr() or elf64_getphdr() functions. A new program header ta-
ble may be allocated or an existing table resized using the elf32_newphdr() or
The Elf structure is opaque and has no members visible to the application.
Elf_Data An Elf_Data data structure describes an individual chunk of a ELF file as repre-
sented in memory. It has the following application visible members:
uint64_t d_align The in-file alignment of the data buffer within its con-
taining ELF section. This value must be a power of two.
uint64_t d_off The offset with the containing section where this descrip-
tors data would be placed. This field will be computed by
the library unless the application requests full control
of the ELF object's layout.
uint64_t d_size The number of bytes of data in this descriptor.
void *d_buf A pointer to data in memory.
Elf_Type d_type The ELF type (see below) of the data in this descriptor.
unsigned int d_version The operating version for the data in this buffer.
Elf_Data descriptors are usually associated with Elf_Scn descriptors. Existing
data descriptors associated with an ELF section may be structures are retrieved
using the elf_getdata() function. The elf_newdata() function may be used to
attach new data descriptors to an ELF section.
Elf_Scn Elf_Scn descriptors represent a section in an ELF object.
They are retrieved using the elf_getscn() function. An application may iterate
through the existing sections of an ELF object using the elf_nextscn() function.
New sections may be allocated using the elf_newscn() function.
The Elf_Scn descriptor is opaque and contains no application modifiable fields.
Supported Elf Types
The following ELF datatypes are supported by the library.
ELF_T_ADDR Machine addresses.
ELF_T_BYTE Byte data. The library will not attempt to translate byte data.
ELF_T_CAP Software and hardware capability records.
ELF_T_DYN Records used in a section of type SHT_DYNAMIC.
ELF_T_EHDR ELF executable header.
ELF_T_HALF 16-bit unsigned words.
ELF_T_LWORD 64 bit unsigned words.
ELF_T_MOVE ELF Move records.
ELF_T_NOTE ELF Note structures.
ELF_T_OFF File offsets.
ELF_T_PHDR ELF program header table entries.
ELF_T_REL ELF relocation entries.
ELF_T_RELA ELF relocation entries with addends.
ELF_T_SHDR ELF section header entries.
ELF_T_SWORD Signed 32-bit words.
ELF_T_SXWORD Signed 64-bit words.
ELF_T_SYMINFO ELF symbol information.
ELF_T_SYM ELF symbol table entries.
ELF_T_VDEF Symbol version definition records.
ELF_T_VNEED Symbol version requirement records.
ELF_T_WORD Unsigned 32-bit words.
ELF_T_XWORD Unsigned 64-bit words.
The symbol ELF_T_NUM denotes the number of Elf types known to the library.
The following table shows the mapping between ELF section types defined in elf(5) and the
types supported by the library.
Section Type Library Type Description
SHT_DYNAMIC ELF_T_DYN '.dynamic' section entries.
SHT_DYNSYM ELF_T_SYM Symbols for dynamic linking.
SHT_FINI_ARRAY ELF_T_ADDR Termination function pointers.
SHT_GROUP ELF_T_WORD Section group marker.
SHT_HASH ELF_T_HASH Symbol hashes.
SHT_INIT_ARRAY ELF_T_ADDR Initialization function pointers.
SHT_NOBITS ELF_T_BYTE Empty sections. See elf(5).
SHT_NOTE ELF_T_NOTE ELF note records.
SHT_PREINIT_ARRAY ELF_T_ADDR Pre-initialization function pointers.
SHT_PROGBITS ELF_T_BYTE Machine code.
SHT_REL ELF_T_REL ELF relocation records.
SHT_RELA ELF_T_RELA Relocation records with addends.
SHT_STRTAB ELF_T_BYTE String tables.
SHT_SYMTAB ELF_T_SYM Symbol tables.
SHT_SYMTAB_SHNDX ELF_T_WORD Used with extended section numbering.
SHT_GNU_verdef ELF_T_VDEF Symbol version definitions.
SHT_GNU_verneed ELF_T_VNEED Symbol versioning requirements.
SHT_GNU_versym ELF_T_HALF Version symbols.
SHT_SUNW_move ELF_T_MOVE ELF move records.
SHT_SUNW_syminfo ELF_T_SYMINFO Additional symbol flags.
This section contains a brief overview of the available functionality in the ELF library.
Each function listed here is described further in its own manual page.
elf_getarsym() Retrieve the archive symbol table.
elf_getarhdr() Retrieve the archive header for an object.
elf_getbase() Retrieve the offset of a member inside an archive.
elf_next() Iterate through an ar(1) archive.
elf_rand() Random access inside an ar(1) archive.
elf_getdata() Retrieve translated data for an ELF section.
elf_getscn() Retrieve the section descriptor for a named section.
elf_ndxscn() Retrieve the index for a section.
elf_newdata() Add a new Elf_Data descriptor to an ELF section.
elf_newscn() Add a new section descriptor to an ELF descriptor.
elf_nextscn() Iterate through the sections in an ELF object.
elf_rawdata() Retrieve untranslated data for an ELF sectino.
elf_rawfile() Return a pointer to the untranslated file contents for an ELF
Retrieve the Executable Header in an ELF object.
Retrieve the Program Header Table in an ELF object.
Retrieve the ELF section header associated with an Elf_Scn
Allocate an Executable Header in an ELF object.
Allocate or resize the Program Header Table in an ELF object.
Translate an ELF data structure from its native representation to
its file representation.
Translate an ELF data structure from its file representation to a
elf_errno() Retrieve the current error.
elf_errmsg() Retrieve a human readable description of the current error.
elf_begin() Opens an ar(1) archive or ELF object given a file descriptor.
elf_end() Close an ELF descriptor and release all its resources.
elf_memory() Opens an ar(1) archive or ELF object present in a memory arena.
elf_version() Sets the operating version.
elf_cntl() Manage the association between and ELF descriptor and its under-
elf_flagdata() Mark an Elf_Data descriptor as dirty.
elf_flagehdr() Mark the ELF Executable Header in an ELF descriptor as dirty.
elf_flagphdr() Mark the ELF Program Header Table in an ELF descriptor as dirty.
elf_flagscn() Mark an Elf_Scn descriptor as dirty.
elf_flagshdr() Mark an ELF Section Header as dirty.
elf_setshstrndx() Set the index of the section name string table for the ELF
elf_update() Recompute ELF object layout and optionally write the modified
object back to the underlying file.
Compute checksum of an ELF object.
elf_getident() Retrieve the identification bytes for an ELF object.
elf_getshnum() Retrieve the number of sections in an ELF object.
elf_getshstrndx() Retrieve the section index of the section name string table in an
elf_hash() Compute the ELF hash value of a string.
elf_kind() Query the kind of object associated with an ELF descriptor.
Return the size of the file representation of an ELF type.
Controlling ELF Object Layout
In the usual mode of operation, library will compute section offsets and alignments based on
the contents of an ELF descriptor's sections without need for further intervention by the
However, if the application wishes to take complete charge of the layout of the ELF file, it
may set the ELF_F_LAYOUT flag on an ELF descriptor using elf_flagelf(3), following which the
library will use the data offsets and alignments specified by the application when laying
out the file. Application control of file layout is described further in the elf_update(3)
Gaps in between sections will be filled with the fill character set by function elf_fill().
In case an error is encountered, these library functions set an internal error number and
signal the presence of the error by returning an special return value. The application can
check the current error number by calling elf_errno(3). A human readable description of the
recorded error is available by calling elf_errmsg(3).
Memory Management Rules
The library keeps track of all Elf_Scn and Elf_Data descriptors associated with an ELF
descriptor and recovers them when the descriptor is closed using elf_end(3). Thus the
application must not call free(3) on data structures allocated by the ELF library.
Conversely the library will not free data that it has not allocated. As an example, an
application may call elf_newdata(3) to allocate a new Elf_Data descriptor and can set the
d_off member of the descriptor to point to a region of memory allocated using malloc(3). It
is the applications responsibility to free this arena, though the library will reclaim the
space used by the Elf_Data descriptor itself.
The original ELF(3) API was developed for Unix System V. This implementation first appeared
in FreeBSD 7.0 and NetBSD 6.0.
The ELF library was written by Joseph Koshy <jkoshy@FreeBSD.org>.
BSD October 21, 2007 BSD