ELF Introduction

Segements and Sections

ELF: Extensible and Linkable Format，is a standard format of excutible file.

ELF can be used as a format for excutibles, shared library and object file (and core dump).

Each ELF can contain of zero or more Segments and zero or more Sections. Segments are exclusively used at runtime, while Sections are exclusively used in link time.

Imagine ELF as a flatten memory space, a segment will point to an absolute address in that memory and specify how many bytes are contained in the segment.

Sections work basically the same way, and in most cases in the file with sections and segments, they will even overlap.

Now the main difference between them is that segments also specify where and how they should be loaded into virtual or phsical memory space. In other words, segments tell the OS how to map parts of the ELF file into memory.

A simple statically compiled excutible contains two main segments which were called code segment and data segment.

The data segment contains initialized globals and other initialized data. The code segment contains the excutible code. After code segments loaded into memory, the OS will load the address of the entry-point where binary should starts its execution.

In a dynamically linked binary we have an additional segment in the ELF file which specify which shared library need to be loaded. The OS then goes and loads those shared libraries, which are also ELF files we've mentioned above, and map them just like it did with the excutible. As you can probably imagine the memory map can get quite complex when you have a binary with a lot of shared libraries.