----------------------------------------------------------------------------

ELF identification

ELF provides an object file framework to support multiple processors,
multiple data encodings, and multiple classes of machines. To support this
object file family, the initial bytes of the file specify how to interpret
the file, independent of the processor on which the inquiry is made and
independent of the file's remaining contents.

The initial bytes of an ELF header (and an object file) correspond to the
e_ident member.

Table 8-2 e_ident[ ] identification indexes

 ------------------------------------------------------
 Name            Value   Purpose
 ------------------------------------------------------
 EI_MAG0         0       File identification
 EI_MAG1         1       File identification
 EI_MAG2         2       File identification
 EI_MAG3         3       File identification
 EI_CLASS        4       File class
 EI_DATA         5       Data encoding
 EI_VERSION      6       File version
 EI_PAD          7       Start of padding bytes
 EI_NIDENT       16      Size of e_ident[]

These indexes access bytes that hold the following values.

EI_MAG0 to EI_MAG3
     A file's first 4 bytes hold a ``magic number'', identifying the file as
     an ELF object file.

      ------------------------------------------------------
      Name            Value   Position
      ------------------------------------------------------
      ELFMAG0         0x7f    e_ident[EI_MAG0]
      ELFMAG1         'E'     e_ident[EI_MAG1]
      ELFMAG2         'L'     e_ident[EI_MAG2]
      ELFMAG3         'F'     e_ident[EI_MAG3]

EI_CLASS
     The next byte, e_ident[EI_CLASS], identifies the file's class, or
     capacity.

      ------------------------------------------------------
      Name            Value   Meaning
      ------------------------------------------------------
      ELFCLASSNONE    0       Invalid class
      ELFCLASS32      1       32-bit objects
      ELFCLASS64      2       64-bit objects

     The file format is designed to be portable among machines of various
     sizes, without imposing the sizes of the largest machine on the
     smallest. Class ELFCLASS32 supports machines with files and virtual
     address spaces up to 4 gigabytes and uses the basic types defined in
     the previous table.

     Class ELFCLASS64 is reserved for 64-bit architectures. Its appearance
     here shows how the object file may change, but the 64-bit format is
     otherwise unspecified. Other classes will be defined as necessary, with
     different basic types and sizes for object file data.

EI_DATA
     Byte e_ident[EI_DATA] specifies the data encoding of the
     processor-specific data in the object file. The following encodings are
     currently defined.

      ------------------------------------------------------
      Name            Value   Meaning
      ------------------------------------------------------
      ELFDATANONE     0       Invalid data encoding
      ELFDATA2LSB     1       See below
      ELFDATA2MSB     2       See below

     Other values are reserved and will be assigned to new encodings as
     necessary.

EI_VERSION
     Byte e_ident[EI_VERSION] specifies the ELF header version number.
     Currently, this value must be EV_CURRENT, for e_version.

EI_PAD
     This value marks the beginning of the unused bytes in e_ident. These
     bytes are reserved and set to zero; programs that read object files
     should ignore them. The value of EI_PAD will change in the future if
     currently unused bytes are given meanings.

A file's data encoding specifies how to interpret the basic objects in a
file. Class ELFCLASS32 files use objects that occupy 1, 2, and 4 bytes.
Under the defined encodings, objects are represented as detailed in Figure
8-2, ``Data encoding ELFDATA2LSB''. Byte numbers appear in the upper left
corners.

Encoding ELFDATA2LSB specifies 2's complement values, with the least
significant byte occupying the lowest address. 

[Image]

Figure 8-2 Data encoding ELFDATA2LSB

Encoding ELFDATA2MSB specifies 2's complement values, with the most
significant byte occupying the lowest address.

[Image]

Figure 8-3 Data encoding ELFDATA2MSB