Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ELF files on Linux

linux-audit.com

Post reply on HN
Print view View original

1–10 of 27 posts

Re: ELF files on Linux

#2

Post by vectorEQ »

nice article but wish people would elaborate more on relocations instead of always skipping that. it's a very important part of understanding how ELF works when it's executed.

Re: ELF files on Linux

#3

Post by haberman »

I wrote Bloaty (https://github.com/google/bloaty) which involved writing a totally custom ELF file parser. Here are some epiphanies I had about ELF while writing it.

ELF (and Mach-O, PE, etc) are designed to optimize the creation of a process image. The runtime loader mainly just has to mmap() a bunch of file ranges into memory with various permissions. This is quite different than loading a .jar file, .pyc, etc. which involve building a runtime heap and loading objects into that heap.

ELF has two file-level tables: sections and segments (the latter are also called program headers). Things clicked for me when I realized: sections are for the linker and segments are for the runtime loader. Sections are the atomic unit of data that linkers operate on: the linker will never rearrange data within a section (it may concatenate several input sections into a single output section though). The loader doesn't even look at the section table AFAIK, everything needed to load the binary is put into segments / program headers.

Only some parts of the binary are actually read/loaded when the binary is executed. Debugging info may bloat the binary but it doesn't cost any RAM at runtime because it's never loaded unless you run a debugger. Bloaty makes this clear by showing both VM size and file size: https://github.com/google/bloaty#running-bloaty

Re: ELF files on Linux

#5

Post by monocasa »

haberman wrote: post #3

I wrote Bloaty ( https://github.com/google/bloaty ) which involved writing a totally custom ELF file parser. Here are some epiphanies I had about ELF while writing it. ELF (and Mach-O, PE, etc) are designed to optimize the creation of a process image. The runtime loader mainly just has to mmap() a bunch of file ranges into memory with various permissions. This is quite different than loading a .jar file, .pyc, etc. w…

I just want to say thanks for bloaty. I've used it all the way from 100MB backend server programs, to deeply embedded, bare metal STM32F apps measured in KB.

Re: ELF files on Linux

#6

Post by haberman »

monocasa wrote: post #5
haberman wrote: post #3

I wrote Bloaty ( https://github.com/google/bloaty ) which involved writing a totally custom ELF file parser. Here are some epiphanies I had about ELF while writing it. ELF (and Mach-O, PE, etc) are designed to optimize the creation of a process image. The runtime loader mainly just has to mmap() a bunch of file ranges into memory with various permissions. This is quite different than loading a .jar file, .pyc, etc. w…

I just want to say thanks for bloaty. I've used it all the way from 100MB backend server programs, to deeply embedded, bare metal STM32F apps measured in KB.

That makes me really happy to hear. I'm glad Bloaty is useful for you!

Re: ELF files on Linux

#7

Post by cmrdporcupine »

vectorEQ wrote: post #2

nice article but wish people would elaborate more on relocations instead of always skipping that. it's a very important part of understanding how ELF works when it's executed.

Absolutely, I once wrote an ELF loader for the Atari ST (never finished, but almost), and the documentation on relocation was absolutely arcane.

Re: ELF files on Linux

#9

Post by AceJohnny2 »

haberman wrote: post #3

I wrote Bloaty ( https://github.com/google/bloaty ) which involved writing a totally custom ELF file parser. Here are some epiphanies I had about ELF while writing it. ELF (and Mach-O, PE, etc) are designed to optimize the creation of a process image. The runtime loader mainly just has to mmap() a bunch of file ranges into memory with various permissions. This is quite different than loading a .jar file, .pyc, etc. w…

I've been wondering about qualitative differences between Mach-O and ELF, after hearing a Mach developer trash the ELF format, but I don't know enough about either to comment. Do you have any insight?

Re: ELF files on Linux

#10

Post by monocasa »

AceJohnny2 wrote: post #9
haberman wrote: post #3

I wrote Bloaty ( https://github.com/google/bloaty ) which involved writing a totally custom ELF file parser. Here are some epiphanies I had about ELF while writing it. ELF (and Mach-O, PE, etc) are designed to optimize the creation of a process image. The runtime loader mainly just has to mmap() a bunch of file ranges into memory with various permissions. This is quite different than loading a .jar file, .pyc, etc. w…

I've been wondering about qualitative differences between Mach-O and ELF, after hearing a Mach developer trash the ELF format, but I don't know enough about either to comment. Do you have any insight?

Not haberman, but I've written loaders for both Mach-O and ELF, and really prefer ELF.

ELF is mainly structured like descriptive tables of how the relevant pieces look in memory; Mach-O is more structured like a script of commands that you run to load the binary. There's a couple places where the model breaks down for ELF, DWARF and GNU_STACK both feel more Mach-O, but if you're playing with binaries for non standard uses, ELF just feels a lot cleaner IMO.

I'd love to hear the Mach developer's arguments though.

Post reply on HN