Executable and Link Format (ELF)

Executable and Link Format (ELF) is a common standard file format for executables, object code, shared libraries, and core dumps in Unix-like operating systems. It is the standard binary file format used by several different processors, including IBM, AMD, Intel, ARM and MC68K and is used on almost all versions of Unix, including Linux, Solaris, HP-UX, and AIX. ELF was originally developed by Unix System Laboratories in 1993 as part of their implementation of System V Release 4 (SVR ), and is now supported by all major Unix-like operating systems.

ELF is a hierarchical, modular file format and includes core elements like header, program segments, sections, symbol tables, and relocation tables. The header consists of machine-specific fields that give information about how the executable should be loaded and managed. Program segments contain instructions (code) and memory areas to store data. Sections provide more detailed information regarding the file’s contents, including program and data segment relocations and symbol definitions. Symbol tables list all symbols (including global and static variables) within the module, and relocation tables hold details for relocating addresses while loading the file.

ELF provides flexibility for binary compatibly between different processor architectures and offers a good level of protection for code and data against unauthorized modifications. Additionally, the features in ELF make it easier for programs to be shared between different CPU architectures and operating systems. Furthermore, the ELF format also provides features which are important for modern operating systems, such as the ability to resolve external symbols and for code to be shared, preventing the duplication of executable code.

ELF is still widely used, although other object file formats, such as Mach-O, are gaining in popularity. Despite some of the advantages of other file formats, ELF remains the leading standard for executable and shared object file format, with support on Linux, Solaris, and other Unix-like operating systems.