| 1 | |
| 2 |
|
| 3 | =================================
|
| 4 | Linux-specific ELF idiosyncrasies
|
| 5 | =================================
|
| 6 |
|
| 7 | Definitions
|
| 8 | ===========
|
| 9 |
|
| 10 | "First" program header is the one with the smallest offset in the file:
|
| 11 | e_phoff.
|
| 12 |
|
| 13 | "Last" program header is the one with the biggest offset in the file:
|
| 14 | e_phoff + (e_phnum - 1) * sizeof(Elf_Phdr).
|
| 15 |
|
| 16 | PT_INTERP
|
| 17 | =========
|
| 18 |
|
| 19 | First PT_INTERP program header is used to locate the filename of ELF
|
| 20 | interpreter. Other PT_INTERP headers are ignored (since Linux 2.4.11).
|
| 21 |
|
| 22 | PT_GNU_STACK
|
| 23 | ============
|
| 24 |
|
| 25 | Last PT_GNU_STACK program header defines userspace stack executability
|
| 26 | (since Linux 2.6.6). Other PT_GNU_STACK headers are ignored.
|
| 27 |
|
| 28 | PT_GNU_PROPERTY
|
| 29 | ===============
|
| 30 |
|
| 31 | ELF interpreter's last PT_GNU_PROPERTY program header is used (since
|
| 32 | Linux 5.8). If interpreter doesn't have one, then the last PT_GNU_PROPERTY
|
| 33 | program header of an executable is used. Other PT_GNU_PROPERTY headers
|
| 34 | are ignored.
|