---
name: "elf"
section: "3"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/elf"
---

# elf(3)

API for manipulating ELF objects

## NAME

**elf** – API for manipulating ELF objects

## LIBRARY

library “libelf”

## SYNOPSIS

**#include \<libelf.h\>**

## DESCRIPTION

The library “libelf” provides functions that allow an application to read and manipulate ELF object files, and to read [ar(1)](/ar/1.md) archives. The library allows the manipulation of ELF objects in a byte ordering and word-size independent way, allowing an application to read and create ELF objects for 32 and 64 bit architectures and for little- and big-endian machines. The library is capable of processing ELF objects that use extended section numbering.

This manual page serves to provide an overview of the functionality in the ELF library. Further information may found in the manual pages for individual ELF(3) functions that comprise the library.

### ELF Concepts

As described in [elf(5)](/elf/5.md), ELF files contain several data structures that are laid out in a specific way. ELF files begin with an “Executable Header”, and may contain an optional “Program Header Table”, and optional data in the form of ELF “sections”. A “Section Header Table” describes the content of the data in these sections.

ELF objects have an associated “ELF class” which denotes the natural machine word size for the architecture the object is associated with. Objects for 32 bit architectures have an ELF class of ELFCLASS32. Objects for 64 bit architectures have an ELF class of ELFCLASS64.

ELF objects also have an associated “endianness” which denotes the endianness of the machine architecture associated with the object. This may be ELFDATA2LSB for little-endian architectures and ELFDATA2MSB for big-endian architectures.

ELF objects are also associated with an API version number. This version number determines the layout of the individual components of an ELF file and the semantics associated with these.

### Data Representation And Translation

The ELF(3) library distinguishes between “native” representations of ELF data structures and their “file” representations.

An application would work with ELF data in its “native” representation, i.e., using the native byteorder and alignment mandated by the processor the application is running on. The “file” representation of the same data could use a different byte ordering and follow different constraints on object alignment than these native constraints.

Accordingly, the ELF(3) library offers translation facilities ((elf32\_xlatetof) 3, [elf32\_xlatetom(3)](/elf32_xlatetom/3.md), [elf64\_xlatetof(3)](/elf64_xlatetof/3.md) and [elf64\_xlatetom(3)](/elf64_xlatetom/3.md)) to and from these representations. It also provides higher-level APIs ((gelf\_xlatetof) 3, [gelf\_xlatetom(3)](/gelf_xlatetom/3.md)) that retrieve and store data from the ELF object in a class-agnostic manner.

### Library Working Version

Conceptually, there are three version numbers associated with an application using the ELF library to manipulate ELF objects:

- The ELF version that the application was compiled against. This version determines the ABI expected by the application.

- The ELF version of the ELF object being manipulated by the application through the ELF library.

- The ELF version (or set of versions) supported by the ELF library itself.

In order to facilitate working with ELF objects of differing versions, the ELF library requires the application to call the **elf\_version**() function before invoking many of its operations, in order to inform the library of the application's desired working version.

In the current implementation, all three versions have to be EV\_CURRENT.

### Namespace use

The ELF library uses the following prefixes:

- elf\_

  Used for class-independent functions.

- elf32\_

  Used for functions working with 32 bit ELF objects.

- elf64\_

  Used for functions working with 64 bit ELF objects.

- Elf\_

  Used for class-independent data types.

- ELF\_C\_

  Used for command values used in a few functions. These symbols are defined as members of the *Elf\_Cmd* enumeration.

- ELF\_E\_

  Used for error numbers.

- ELF\_F\_

  Used for flags.

- ELF\_K\_

  These constants define the kind of file associated with an ELF descriptor. See [elf\_kind(3)](/elf_kind/3.md). The symbols are defined by the *Elf\_Kind* enumeration.

- ELF\_T\_

  These values are defined by the *Elf\_Type* enumeration, and denote the types of ELF data structures that can be present in an ELF object.

In addition, the library uses symbols with prefixes \_ELF and \_libelf for its internal use.

### Descriptors

Applications communicate with the library using descriptors. These are:

- *Elf*

  An *Elf* descriptor represents an ELF object or an [ar(1)](/ar/1.md) archive. It is allocated using one of the **elf\_begin**() or **elf\_memory**() functions. An *Elf* descriptor can be used to read and write data to an ELF file. An *Elf* descriptor can be associated with zero or more *Elf\_Scn* section descriptors.

  Given an ELF descriptor, the application may retrieve the ELF object's class-dependent “Executable Header” structures using the **elf32\_getehdr**() or **elf64\_getehdr**() functions. A new Ehdr structure may be allocated using the **elf64\_newehdr**() or **elf64\_newehdr**() functions.

  The “Program Header Table” associated with an ELF descriptor may be allocated using the **elf32\_getphdr**() or **elf64\_getphdr**() functions. A new program header table may be allocated or an existing table resized using the **elf32\_newphdr**() or **elf64\_newphdr**() functions.

  The *Elf* structure is opaque and has no members visible to the application.

- *Elf\_Data*

  An *Elf\_Data* data structure describes an individual chunk of a ELF file as represented in memory. It has the following application-visible members:

  - *uint64\_t d\_align*

    The in-file alignment of the data buffer within its containing ELF section. This value must be non-zero and a power of two.

  - *void \*d\_buf*

    A pointer to data in memory.

  - *uint64\_t d\_off*

    The offset within the containing section where this descriptor's data would be placed. This field will be computed by the library unless the application requests full control of the ELF object's layout.

  - *uint64\_t d\_size*

    The number of bytes of data in this descriptor.

  - *Elf\_Type d\_type*

    The ELF type (see below) of the data in this descriptor.

  - *unsigned int d\_version*

    The operating version for the data in this buffer.

    *Elf\_Data* descriptors are usually used in conjunction with *Elf\_Scn* descriptors.

- *Elf\_Scn*

  *Elf\_Scn* descriptors represent sections in an ELF object. These descriptors are opaque and contain no application modifiable fields.

  The *Elf\_Scn* descriptor for a specific section in an ELF object can be retrieved using the **elf\_getscn**() function. The sections contained in an ELF object can be traversed using the **elf\_nextscn**() function. New sections are allocated using the **elf\_newscn**() function.

  The *Elf\_Data* descriptors associated with a given section can be retrieved using the **elf\_getdata**() function. New data descriptors can be added to a section descriptor using the **elf\_newdata**() function. The untranslated “file” representation of data in a section can be retrieved using the **elf\_rawdata**() function.

### Supported Elf Types

The following ELF datatypes are supported by the library.

- ELF\_T\_ADDR

  Machine addresses.

- ELF\_T\_BYTE

  Byte data. The library will not attempt to translate byte data.

- ELF\_T\_CAP

  Software and hardware capability records.

- ELF\_T\_DYN

  Records used in a section of type SHT\_DYNAMIC.

- ELF\_T\_EHDR

  ELF executable header.

- ELF\_T\_GNUHASH

  GNU-style hash tables.

- ELF\_T\_HALF

  16-bit unsigned words.

- ELF\_T\_LWORD

  64 bit unsigned words.

- ELF\_T\_MOVE

  ELF Move records.

- ELF\_T\_NOTE

  ELF Note structures.

- ELF\_T\_OFF

  File offsets.

- ELF\_T\_PHDR

  ELF program header table entries.

- ELF\_T\_REL

  ELF relocation entries.

- ELF\_T\_RELA

  ELF relocation entries with addends.

- ELF\_T\_SHDR

  ELF section header entries.

- ELF\_T\_SWORD

  Signed 32-bit words.

- ELF\_T\_SXWORD

  Signed 64-bit words.

- ELF\_T\_SYMINFO

  ELF symbol information.

- ELF\_T\_SYM

  ELF symbol table entries.

- ELF\_T\_VDEF

  Symbol version definition records.

- ELF\_T\_VNEED

  Symbol version requirement records.

- ELF\_T\_WORD

  Unsigned 32-bit words.

- ELF\_T\_XWORD

  Unsigned 64-bit words.

The symbol ELF\_T\_NUM denotes the number of Elf types known to the library.

The following table shows the mapping between ELF section types defined in [elf(5)](/elf/5.md) and the types supported by the library.

| | | |
| --- | --- | --- |
| *Section* *Type* | *Library Type* | *Description* |
| SHT\_DYNAMIC | ELF\_T\_DYN |  |
| SHT\_DYNSYM | ELF\_T\_SYM | Symbols for dynamic linking. |
| SHT\_FINI\_ARRAY | ELF\_T\_ADDR | Termination function pointers. |
| SHT\_GNU\_HASH | ELF\_T\_GNUHASH | GNU hash sections. |
| SHT\_GNU\_LIBLIST | ELF\_T\_WORD | List of libraries to be pre-linked. |
| SHT\_GNU\_verdef | ELF\_T\_VDEF | Symbol version definitions. |
| SHT\_GNU\_verneed | ELF\_T\_VNEED | Symbol versioning requirements. |
| SHT\_GNU\_versym | ELF\_T\_HALF | Version symbols. |
| SHT\_GROUP | ELF\_T\_WORD | Section group marker. |
| SHT\_HASH | ELF\_T\_HASH | Symbol hashes. |
| SHT\_INIT\_ARRAY | ELF\_T\_ADDR | Initialization function pointers. |
| SHT\_NOBITS | ELF\_T\_BYTE |  |
| SHT\_NOTE | ELF\_T\_NOTE | ELF note records. |
| SHT\_PREINIT\_ARRAY | ELF\_T\_ADDR | Pre-initialization function pointers. |
| SHT\_PROGBITS | ELF\_T\_BYTE | Machine code. |
| SHT\_REL | ELF\_T\_REL | ELF relocation records. |
| SHT\_RELA | ELF\_T\_RELA | Relocation records with addends. |
| SHT\_STRTAB | ELF\_T\_BYTE | String tables. |
| SHT\_SYMTAB | ELF\_T\_SYM | Symbol tables. |
| SHT\_SYMTAB\_SHNDX | ELF\_T\_WORD | Used with extended section numbering. |
| SHT\_SUNW\_dof | ELF\_T\_BYTE |  |
| SHT\_SUNW\_move | ELF\_T\_MOVE | ELF move records. |
| SHT\_SUNW\_syminfo | ELF\_T\_SYMINFO | Additional symbol flags. |
| SHT\_SUNW\_verdef | ELF\_T\_VDEF |  |
| SHT\_SUNW\_verneed | ELF\_T\_VNEED |  |
| SHT\_SUNW\_versym | ELF\_T\_HALF |  |

Section types in the range \[SHT\_LOOS, SHT\_HIUSER\] are otherwise considered to be of type ELF\_T\_BYTE.

### Functional Grouping

This section contains a brief overview of the available functionality in the ELF library. Each function listed here is described further in its own manual page.

- Archive Access

  - **elf\_getarsym**()

    Retrieve the archive symbol table.

  - **elf\_getarhdr**()

    Retrieve the archive header for an object.

  - **elf\_getbase**()

    Retrieve the offset of a member inside an archive.

  - **elf\_next**()

    Iterate through an [ar(1)](/ar/1.md) archive.

  - **elf\_rand**()

    Random access inside an [ar(1)](/ar/1.md) archive.

- Data Structures

  - **elf\_getdata**()

    Retrieve translated data for an ELF section.

  - **elf\_getscn**()

    Retrieve the section descriptor for a named section.

  - **elf\_ndxscn**()

    Retrieve the index for a section.

  - **elf\_newdata**()

    Add a new *Elf\_Data* descriptor to an ELF section.

  - **elf\_newscn**()

    Add a new section descriptor to an ELF descriptor.

  - **elf\_nextscn**()

    Iterate through the sections in an ELF object.

  - **elf\_rawdata**()

    Retrieve untranslated data for an ELF section.

  - **elf\_rawfile**()

    Return a pointer to the untranslated file contents for an ELF object.

  - **elf32\_getehdr**(*,*, *Fn*, *elf64\_getehdr*)

    Retrieve the Executable Header in an ELF object.

  - **elf32\_getphdr**(*,*, *Fn*, *elf64\_getphdr*)

    Retrieve the Program Header Table in an ELF object.

  - **elf32\_getshdr**(*,*, *Fn*, *elf64\_getshdr*)

    Retrieve the ELF section header associated with an *Elf\_Scn* descriptor.

  - **elf32\_newehdr**(*,*, *Fn*, *elf64\_newehdr*)

    Allocate an Executable Header in an ELF object.

  - **elf32\_newphdr**(*,*, *Fn*, *elf64\_newphdr*)

    Allocate or resize the Program Header Table in an ELF object.

- Data Translation

  - **elf32\_xlatetof**(*,*, *Fn*, *elf64\_xlatetof*)

    Translate an ELF data structure from its native representation to its file representation.

  - **elf32\_xlatetom**(*,*, *Fn*, *elf64\_xlatetom*)

    Translate an ELF data structure from its file representation to a native representation.

- Error Reporting

  - **elf\_errno**()

    Retrieve the current error.

  - **elf\_errmsg**()

    Retrieve a human readable description of the current error.

- Initialization

  - **elf\_begin**()

    Opens an [ar(1)](/ar/1.md) archive or ELF object given a file descriptor.

  - **elf\_end**()

    Close an ELF descriptor and release all its resources.

  - **elf\_memory**()

    Opens an [ar(1)](/ar/1.md) archive or ELF object present in a memory arena.

  - **elf\_version**()

    Sets the operating version.

- IO Control

  - **elf\_cntl**()

    Manage the association between and ELF descriptor and its underlying file.

  - **elf\_flagdata**()

    Mark an *Elf\_Data* descriptor as dirty.

  - **elf\_flagehdr**()

    Mark the ELF Executable Header in an ELF descriptor as dirty.

  - **elf\_flagphdr**()

    Mark the ELF Program Header Table in an ELF descriptor as dirty.

  - **elf\_flagscn**()

    Mark an *Elf\_Scn* descriptor as dirty.

  - **elf\_flagshdr**()

    Mark an ELF Section Header as dirty.

  - **elf\_setshstrndx**()

    Set the index of the section name string table for the ELF object.

  - **elf\_update**()

    Recompute ELF object layout and optionally write the modified object back to the underlying file.

- Queries

  - **elf32\_checksum**(*,*, *Fn*, *elf64\_checkum*)

    Compute checksum of an ELF object.

  - **elf\_getident**()

    Retrieve the identification bytes for an ELF object.

  - **elf\_getphdrnum**()

    Retrieve the number of program headers in an ELF object.

  - **elf\_getshdrnum**()

    Retrieve the number of sections in an ELF object.

  - **elf\_getshdrstrndx**()

    Retrieve the section index of the section name string table in an ELF object.

  - **elf\_hash**()

    Compute the ELF hash value of a string.

  - **elf\_kind**()

    Query the kind of object associated with an ELF descriptor.

  - **elf32\_fsize**(*,*, *Fn*, *elf64\_fsize*)

    Return the size of the file representation of an ELF type.

### Controlling ELF Object Layout

In the usual mode of operation, library will compute section offsets and alignments based on the contents of an ELF descriptor's sections without need for further intervention by the application.

However, if the application wishes to take complete charge of the layout of the ELF file, it may set the ELF\_F\_LAYOUT flag on an ELF descriptor using [elf\_flagelf(3)](/elf_flagelf/3.md), following which the library will use the data offsets and alignments specified by the application when laying out the file. Application control of file layout is described further in the [elf\_update(3)](/elf_update/3.md) manual page.

Gaps in between sections will be filled with the fill character set by function **elf\_fill**().

### Error Handling

In case an error is encountered, these library functions set an internal error number and signal the presence of the error by returning an special return value. The application can check the current error number by calling [elf\_errno(3)](/elf_errno/3.md). A human readable description of the recorded error is available by calling [elf\_errmsg(3)](/elf_errmsg/3.md).

### Memory Management Rules

The library keeps track of all *Elf\_Scn* and *Elf\_Data* descriptors associated with an ELF descriptor and recovers them when the descriptor is closed using [elf\_end(3)](/elf_end/3.md). Thus the application must not call [free(3)](/free/3.md) on data structures allocated by the ELF library.

Conversely the library will not free data that it has not allocated. As an example, an application may call [elf\_newdata(3)](/elf_newdata/3.md) to allocate a new *Elf\_Data* descriptor and can set the *d\_off* member of the descriptor to point to a region of memory allocated using [malloc(3)](/malloc/3.md). It is the applications responsibility to free this arena, though the library will reclaim the space used by the *Elf\_Data* descriptor itself.

## SEE ALSO

[gelf(3)](/gelf/3.md), [ar(5)](/ar/5.md), [elf(5)](/elf/5.md)

## HISTORY

The original **elf** API was developed for AT&T System V UNIX. The current implementation of the API appeared in FreeBSD 7.0.

## AUTHORS

The ELF library was written by Joseph Koshy ⟨*jkoshy@FreeBSD.org*⟩.