Duke's ELF overview v1.0

@Dreamcast

Published in 

Playstation 2 tutorials

 · 4 years ago

  
Duke's ELF overview v1.0: 

ELF Header (EHR): 
================= 

Starting at the first byte of the ELF file. 

 
0x00 - 4 bytes		0x7f,"ELF"  (ELF file identifier) 
0x04 - 1 byte		File Class: 1=32bit, 2=64bit objects 
0x05 - 1 byte		Data Encoding: 1=ELFDATA2LSB, 2=ELFDATA2MSB 
0x06 - 1 byte		ELF header version (must be 1) 
0x07 - 9 bytes		zeroised 
0x10 - 2 bytes		ELF type: 0=NONE, 1=REL, 2=EXEC, 3=SHARED, 4=CORE 
0x12 - 2 bytes		Processor: 8=MIPS R3000 
0x14 - 4 bytes		Version: 1=current 
0x18 - 4 bytes		Entry point address 
0x1C - 4 bytes		Start of program headers (offset from file start) 
0x20 - 4 bytes		Start of section headers (offset from file start) 
0x24 - 4 bytes		Processor specific flags = 0x20924001 noreorder, mips 
0x28 - 2 bytes		ELF header size (0x34 = 52 bytes) 
0x2A - 2 bytes		Program headers entry size  
0x2C - 2 bytes		Number of program headers 
0x3E - 2 bytes		Section headers entry size 
0x30 - 2 bytes		Number of section headers 
0x32 - 2 bytes		Section header stringtable index	 

Program Header (PHR): 
===================== 

Offset located in EHR 0x1C, size specified by EHR 0x2A and the number of PHR's 
specified in EHR 0x2C. 

0x00 - 4 bytes		Segment type:  
				0=Inactive 
				1=Load the segment into memory, no. of bytes specified by 0x10 and 0x14 
				2=Dynamic linking 
				3=Interpreter. The array element must specify a path name 
				4=Note. The array element must specify the location and size of aux. info 
				5=reserved 
				6=The array element must specify location and size of the program header table. 
				0x70000000 - 0x7fffffff processor specific semantics 
0x04 - 4 bytes		Offset from file start to program segment. 
0x08 - 4 bytes		Virtual address of the segment 
0x0C - 4 bytes		Physical address of the segment 
0x10 - 4 bytes		Number of bytes in the file image of the segment 
0x14 - 4 bytes		Number of bytes in the memory image of the segment 
0x18 - 4 bytes		Flags for segment 
0x1C - 4 bytes		Alignment. The address of 0x08 and 0x0C must fit this alignment. 0=no alignment 

Section Header (SHR): 
===================== 

Offset located in EHR 0x20, size specified by EHR 0x30 and number of SHR's specified in EHR 0x32. 

0x00 - 4 bytes		No. to the index of the Section header stringtable index 
0x04 - 4 bytes		Type: 
				0=Inactive 
				1=PROGBITS 
				2=SYMTAB symbol table 
				3=STRTAB string table 
				4=RELA relocation entries 
				5=HASH hash table 
				6=DYNAMIC dynamic linking information 
				7=NOTE 
				8=NOBITS  
				9=REL relocation entries 
				10=SHLIB 
				0x70000000=LOPROC processor specifc 
				0x7fffffff=HIPROC 
				0x80000000=LOUSER lower bound 
				0xffffffff=HIUSER upper bound 
0x08 - 4 bytes		Section Flags:  (1 bit, you may combine them like 3 = alloc & write permission) 
				1=Write section contains data the is be writeable during execution. 
				2=Alloc section occupies memory during execution 
				4=Exec section contains executable instructions 
				0xf0000000=Mask bits processor-specific 
0x0C - 4 bytes		Section start address 
0x10 - 4 bytes		Offset from start of file to section 
0x14 - 4 bytes		Size of section 
0x18 - 4 bytes		Section header table index link 
0x1C - 4 bytes		Info 
0x20 - 4 bytes		Alignment. The adress of 0x0C must fit this alignment. 0=no alignment. 
0x24 - 4 bytes		Fixed size entries.