typedef struct {
        unsigned char   e_ident[EI_NIDENT];
        Elf32_Half      e_type;
        Elf32_Half      e_machine;
        Elf32_Word      e_version;
        Elf32_Addr      e_entry;
        Elf32_Off       e_phoff;
        Elf32_Off       e_shoff;
        Elf32_Word      e_flags;
        Elf32_Half      e_ehsize;
        Elf32_Half      e_phentsize;
        Elf32_Half      e_phnum;
        Elf32_Half      e_shentsize;
        Elf32_Half      e_shnum;
        Elf32_Half      e_shstrndx;
} Elf32_Ehdr;

typedef struct {
        unsigned char   e_ident[EI_NIDENT];
        Elf64_Half      e_type;
        Elf64_Half      e_machine;
        Elf64_Word      e_version;
        Elf64_Addr      e_entry;
        Elf64_Off       e_phoff;
        Elf64_Off       e_shoff;
        Elf64_Word      e_flags;
        Elf64_Half      e_ehsize;
        Elf64_Half      e_phentsize;
        Elf64_Half      e_phnum;
        Elf64_Half      e_shentsize;
        Elf64_Half      e_shnum;
        Elf64_Half      e_shstrndx;
} Elf64_Ehdr;

e_ident

• e_type
  • ET_NONE 0 = No file type
  • ET_REL 1 = Relocatable file type
  • ET_EXEC 2 = Executable file
  • ET_DYN 3 = Shared Object file
  • ET_CORE 4 = Core file
• e_version
  • Always 1
• e_entry
  • Entry point address for executables
  • Constructor address for shared libraries
  • otherwise 0
• e_phoff
  • Program headers offset
• e_shoff
  • Section headers offset
• e_flags
  • OS나 그 외의 실행 환경마다 dependent
• e_ehsize
  • Size of this ELF header
• e_phentsize
  • Size per program header
• e_phnum
  • Number of program headers
• e_shentsize
  • Size per section header
• e_shnum
  • Number of section headers
• e_shstrndx
  • Section header string table index