Practical Binary Analysis

2THE ELF FORMAT

Now that you have a high-level idea of what binaries look like and how they work, you’re ready to dive into a real binary format. In this chapter, you’ll investigate the Executable and Linkable Format (ELF), which is the default binary format on Linux-based systems and the one you’ll be working with in this book.

ELF is used for executable files, object files, shared libraries, and core dumps. I’ll focus on ELF executables here, but the same concepts apply to other ELF file types. Because you will deal mostly with 64-bit binaries in this book, I’ll center the discussion around 64-bit ELF files. However, the 32-bit format is similar, differing mainly in the size and order of certain header fields and other data structures. You ...