~ ~~ ~ ~~ ELF header ~ ~~ ~ ~~ This is the top-level ELF header, for the entire file. An ELF always ~ ~~ has exactly one of this header, which is always at the start of the file. ~ ~~ : elf-file-header 0x7f pack8 s" ELF" pack-raw-string ~ magic number 2 pack8 ~ 64-bit 1 pack8 ~ little-endian 1 pack8 ~ ELF header format v1 0 pack8 ~ System-V ABI 0 pack64 ~ (padding) 2 pack16 ~ executable 0x3e pack16 ~ Intel x86-64 1 pack32 ~ ELF format version L' start use-label origin + pack64 ~ entry point ~ This includes the origin, intentionally. L' program-header use-label pack64 ~ program header offset ~ We place the program header immediately after the ELF header. This ~ offset is from the start of the file. 0 pack64 ~ section header offset 0 pack32 ~ processor flags 64 pack16 ~ ELF header size 56 pack16 ~ program header entry size 1 pack16 ~ number of program header entries 0 pack16 ~ section header entry size 0 pack16 ~ number of section header entries 0 pack16 ~ section name string table index ; ~ ~~ ~ ~~ Program header ~ ~~ ~ ~~ An ELF program header consists of any number of these entries; they are ~ ~~ always consecutive, but may be anywhere in the file. We always have ~ ~~ exactly one, and it's always right after the ELF file header. ~ ~~ : elf-program-header current-offset L' program-header set-label 1 pack32 ~ "loadable" segment type 0x05 pack32 ~ read+execute permission 0 pack64 ~ offset in file origin pack64 ~ virtual address ~ required, but can be anything, subject to alignment 0 pack64 ~ physical address (ignored) L' total-size use-label pack64 ~ size in file L' total-size use-label pack64 ~ size in memory 0 pack64 ~ segment alignment ~ for relocation, but this doesn't apply to us ;