Elf header is described by this particular data type.
Elf 32 header or 64, depending on whether your, uh, binary is 32 bit or 64 bit.
So if you see this elf dot h header file already, define present in your system usr include elf dot
h.
And if you go here, uh, this file defines standard Elf types structures and macros okay.
And you have for 16 bit and 32 bit what is the value of half.
What is the value of word s word x word.
All those are defined here in this particular typedef using typedef and comes the Elf header.
Uh this is the Elf header for 32 bit.
And this is the elf header for 64 bit.
You have the architecture entry point virtual address.
What is the offset of the program header table.
What is the offset of the section header table.
What is the size of the Elf header and what is the size of program header table entry section.
How many you have, program header tables and how many section headers and all.
And then you have something known as section header string table index.
And there is first you have an array which is e ident.
Uh e underscore ident.
Elf identification.
The array size is 16 bytes.
So let's first understand what is E underscore ident.
And here it is already given the uh of what all are present in each byte you have something known as
magic number magic 0123.
So first four hexadecimal parts define that it is an Elf file.
So if you have in the first four bytes elf, then this means uh and you are starting should be seven
f.
This means it is an Elf file.
Okay.
So I have this executable here and I know the commands XXDL4.
And I have this one.
So if you see the first four bytes it starts with the 7F7F.
And then you have 40 54C force uh four six.
I can also display the hex Ascii equivalent, and I will only print the first 16 bytes.
So first one is seven f and followed by 4F4C46, which is elf.
So if you see if you have this first as four bytes as elf.
This means it is an Elf file.
Else if it is, it is not an Elf file.
So what happens if I just change using hex edit?
What I'll do is I'll change this to something different.
I'll say four a and it becomes g l f and I'll save this one.
And I'll now try to see whether it is a Elf file or not.
This is a file user space.
It is not saying it is an Elf file.
It is.
Let's try to see whether it is printing using Elf.
It is saying it's not an Elf file.
It has a wrong magic bytes at the start.
So if you don't have this 7F454346.
This is used to identify that this file is an Elf file.
As we don't have this one, it is failing.
Now I will update again.
I'll say I will give back the correct values.
So I'll say four five and I will save this one.
Now if I say file now it is an Elf file and now it also works.
The elf.
I can print the elf header.
So this is very important.
The magic 757F454C46.
So this is used to identify that this is an Elf file.
This is a magic number after this Elf type.
After this four bytes.
This is a class field.
So this defines whether it is a 32 bit or 64 bit.
If it is having a value of one, uh, it is 32 bit.
If it is having a value of two, it is 64 bit.
So if I compile user space dot c, user space 64, and if I print user says 64, it will after this
four bytes it is having a value two.
This means it is a 64 bit.
It is having a value of one.
It is a 32 bit.
So this is the class elf 32 or elf 64.
And then you have data.
And whether you are using a little endian or big endian, uh, you can find out using data if it is
one.
This means it is a little endian.
If it is two, it means it is a big endian.
And we are on amd64, it will be always little endian.
So one means uh to little endian.
Here also it is little endian.
So class and the data.
And then you have version uh version indicates what version number.
Currently there is only one version type which is the value one.
So only we have only one version.
So it is will be always one.
Either there is no two or only one version we have.
Then you have OS Abi.
Abi defines the calling convention, what registers to use and all it is uh, specified here we are
using a Unix system V if you go here and in this there are lot of ABA versions.
Right.
ABA in.
We are using, uh, Unix system API, which is having a value zero, and there are other APIs for ARM.
It will be 97.
If it is a ARM API, it will be 64.
So because Elf supports multiple processors and multiple architectures, and each processor or architecture
have their own API, we have different values for API.
For x86 we are using Unix system v Abi.
Uh, it is having a value of zero.
Uh, this particular thing.
And it also can also have a API version.
And.
Yeah.
So this is all about, uh, the identification, uh, Ralph identification.
You have a 16 byte, uh, 16 bytes out of the 16 byte.
Not all are used.
Remaining are padded.
So remaining all will be having pads.
So starting from the ninth location, uh, offset, all are padded to the zeros if you see the magic
number as well.
Uh, you will see they have padded all remaining bytes to zero.
Maybe they will be using in future, but now only few are used till here.
ABA version is coming from the first 16 bytes.
This all are defined in the next, uh number of the structure, not in the ident.