Article by Ayman Alheraki on January 11 2026 10:37 AM
The Executable and Linkable Format (ELF) is the standard binary format for Unix-like systems including Linux and BSD. Understanding the ELF header is essential for assembler designers targeting these systems, as it defines how the binary is structured and interpreted by the OS loader.
This appendix provides a detailed breakdown of the ELF header fields for the 64-bit x86-64 architecture, describing their purpose, size, and typical values. This knowledge assists in correctly generating ELF executables and object files from assembled machine code.
The ELF header is the initial fixed-size data structure at the start of an ELF file, occupying 64 bytes for ELF64. It contains metadata about the file layout, architecture, and entry points. Its fields are packed and aligned according to the ELF specification.
| Field | Offset (bytes) | Size (bytes) | Description | Typical Values (x86-64) |
|---|---|---|---|---|
e_ident | 0 | 16 | Identification bytes: Magic number, class, data encoding, version, OS ABI, padding | 0x7F 'E' 'L' 'F', Class=2 (64-bit), Data=1 (LE) |
e_type | 16 | 2 | Object file type | 2 = Executable, 1 = Relocatable, 3 = Shared Object |
e_machine | 18 | 2 | Target architecture | 0x3E (62 decimal) = x86-64 |
e_version | 20 | 4 | Object file version | 1 (current) |
e_entry | 24 | 8 | Virtual address to which control is transferred to start execution | Entry point address in memory |
e_phoff | 32 | 8 | Offset in file to the program header table | Byte offset where program headers start |
e_shoff | 40 | 8 | Offset in file to the section header table | Byte offset where section headers start |
e_flags | 48 | 4 | Processor-specific flags | Typically zero for x86-64 |
e_ehsize | 52 | 2 | ELF header size in bytes | 64 (size of ELF64 header) |
e_phentsize | 54 | 2 | Size of one entry in the program header table | 56 bytes (for ELF64) |
e_phnum | 56 | 2 | Number of entries in the program header table | Depends on number of segments |
e_shentsize | 58 | 2 | Size of one entry in the section header table | 64 bytes (for ELF64) |
e_shnum | 60 | 2 | Number of entries in the section header table | Depends on number of sections |
e_shstrndx | 62 | 2 | Section header string table index | Index of section containing section names |
e_ident (16 bytes):
The first four bytes are the ELF magic number: 0x7F, 'E', 'L', 'F'. The following bytes specify the file class (32 or 64-bit), data encoding (little or big endian), ELF version, OS ABI target, and padding bytes reserved for future use.
e_type (2 bytes):
Defines the file type, such as relocatable object file, executable, shared object, or core dump. This affects how the system loader interprets the file.
e_machine (2 bytes):
Specifies the CPU architecture. For x86-64, the value is 0x3E (decimal 62).
e_version (4 bytes):
Version of the ELF specification used; usually set to 1.
e_entry (8 bytes):
The memory address at which execution starts. For executable files, this is the program’s entry point.
e_phoff (8 bytes):
File offset where the program header table begins. This table describes segments for loading into memory.
e_shoff (8 bytes):
File offset where the section header table begins. Sections describe various parts of the file including code, data, symbols, and relocation info.
e_flags (4 bytes):
Architecture-specific flags; for x86-64, typically zero.
e_ehsize (2 bytes):
Size of this ELF header structure itself.
e_phentsize and e_phnum (each 2 bytes):
Define the size and count of entries in the program header table.
e_shentsize and e_shnum (each 2 bytes):
Define the size and count of entries in the section header table.
e_shstrndx (2 bytes):
Index of the section header that contains the section names.
Correct ELF header generation is crucial for producing valid executable and object files.
Misalignment or incorrect offsets can cause loaders to fail to recognize segments or sections, leading to runtime errors.
The entry point (e_entry) must correspond to the program's start label or symbol.
Proper setting of program header and section header offsets ensures that linker and debugger tools can process the file.
The ELF header must adhere to platform ABI standards; deviations can cause incompatibilities.
Modern assemblers generate ELF headers dynamically based on input source, section usage, and linker requirements.
Some fields such as e_flags may be used by specialized processors or OS extensions.
Understanding the ELF header structure allows assembler developers to integrate seamless binary output compatible with Unix-like OS loaders. This appendix serves as a reference for each field, enabling precise control over the executable format during assembler implementation.