Skip to content
Knowledge Base
Executable and Linkable Format (ELF) files

Executable and Linkable Format (ELF) files

The Executable and Linkable Format is the generic file format for executables on Linux systems. Understanding how an ELF file is put together is the foundation for everything else in Linux malware analysis, from spotting a packed binary to following a hooked library call.

This series builds that foundation from the ground up, covering the structures the linker and loader rely on and the ways malware authors abuse them.

  • Sections and Segments - The ELF header, the section header table, the program header table, and how sections map into the segments that get loaded into memory.
  • Symbols - What symbolic information is, the Elfxx_Sym structure, and how the .symtab and .dynsym symbol tables relate to their string tables.
  • Relocations - How symbolic references are connected to their definitions, the two relocation entry structures, and the x86 and x86_64 relocation types.
  • Dynamic Linking - Static versus dynamic linking, what the dynamic linker does at load time, lazy linking through the PLT and GOT, and the LD_PRELOAD feature malware uses to hook functions.