ELF Binary Header Utility

ELF Header Decoder

Decode Executable and Linkable Format headers from raw hexadecimal bytes. Identify ELF32 or ELF64, endianness, ABI, object type, CPU architecture, entry point, program-header table, section-header table and other core ELF metadata.

✓ ELF32 ✓ ELF64 ✓ Little Endian ✓ Big Endian ✓ Architecture ✓ Entry Point

ELF

Executable Header Decoder

● Ready

ELF Header Hex Bytes Paste at least the complete ELF header: 52 bytes for ELF32 or 64 bytes for ELF64. Spaces, commas, colons, hyphens and continuous hexadecimal are accepted.

Input Byte Order Normally leave this set to Normal File Byte Order.

Extra Bytes Allow mode is useful when the beginning of an entire ELF file is pasted.

ELF magic: the first four bytes must normally be 7F 45 4C 46. Byte 4 selects ELF32 or ELF64, byte 5 selects little or big endian, and the rest of the header must be parsed using that class and byte order.

ELF Header Decode Result Decoded

Decoded ELF File —

Magic —

ELF Class —

Endianness —

OS / ABI —

ABI Version —

Object Type —

Machine —

ELF Version —

Entry Point —

Program Header Offset —

Section Header Offset —

Processor Flags —

ELF Header Size —

Program Headers —

Section Headers —

Section Name Table —

e_ident Bytes —

Header Structure —

Calculation Breakdown —

What Is an ELF Header?

ELF stands for Executable and Linkable Format. It is a binary file format commonly used for executables, shared libraries, object files and core files on Linux, Unix-like systems and many embedded platforms.

Every ELF file begins with an ELF header containing information needed to interpret the rest of the file.

ELF Magic Number

The first four bytes identify an ELF file.

ELF Magic:

7F 45 4C 46

45 = ASCII 'E'
4C = ASCII 'L'
46 = ASCII 'F'

If these bytes do not match, the input is normally not a standard ELF header.

ELF32 vs ELF64

The EI_CLASS byte at offset 4 identifies the main ELF class.

EI_CLASS	Meaning
1	ELF32
2	ELF64
0	Invalid / unspecified

ELF32 uses 32-bit address and offset fields in the ELF header, while ELF64 uses 64-bit fields.

ELF Endianness

EI_DATA at offset 5 identifies the byte order used by multi-byte ELF header fields.

EI_DATA = 1
Little-endian

EI_DATA = 2
Big-endian

The decoder automatically switches all 16-bit, 32-bit and 64-bit field reads to the selected byte order.

ELF e_ident Array

The first 16 bytes of an ELF file are called e_ident. They contain magic, class, byte order, ELF identification version, OS ABI and ABI version.

Offset 0–3:
Magic

Offset 4:
EI_CLASS

Offset 5:
EI_DATA

Offset 6:
EI_VERSION

Offset 7:
EI_OSABI

Offset 8:
EI_ABIVERSION

ELF Object Type

The e_type field identifies the basic kind of ELF object.

e_type	Meaning
0	None
1	Relocatable file
2	Executable file
3	Shared object
4	Core file

ELF Machine Architecture

The e_machine field identifies the processor architecture targeted by the ELF file.

e_machine	Architecture
3	Intel 80386
8	MIPS
20	PowerPC
40	ARM
62	AMD x86-64
183	AArch64
243	RISC-V

ELF Entry Point

e_entry contains the virtual address at which execution begins for an executable image when the field is meaningful.

Example:

e_entry =
0x0000000000400000

For relocatable objects or certain other ELF types, the entry-point value may be zero.

Program Header Table Offset

e_phoff gives the file offset of the program-header table. Program headers describe segments used by loaders, including loadable memory regions and dynamic-linking information.

Program Header Table:

File position =
e_phoff

Section Header Table Offset

e_shoff identifies the file offset of the section-header table. Section headers describe sections such as code, data, symbol tables, relocation information and string tables.

Program Header Count

e_phnum normally contains the number of entries in the program-header table, while e_phentsize gives the size of each entry.

Program Header Table Size ≈

e_phnum
×
e_phentsize

Section Header Count

e_shnum normally contains the number of section-header entries. e_shentsize specifies the size of each section-header entry.

Section Header Table Size ≈

e_shnum
×
e_shentsize

ELF also provides extended numbering mechanisms for some special cases, so zero or reserved values can require reading additional section-header information.

Section Header String Table Index

e_shstrndx usually contains the section index of the section-name string table. This table stores the names referenced by section headers.

ELF Processor Flags

e_flags contains processor-specific flags. Its bit meanings depend on e_machine and the applicable processor ABI.

For that reason, this decoder displays the raw e_flags value instead of inventing architecture-specific meanings for unsupported targets.

ELF32 Header Layout

ELF32 Header:

e_ident      16 bytes
e_type        2
e_machine     2
e_version     4
e_entry       4
e_phoff       4
e_shoff       4
e_flags       4
e_ehsize      2
e_phentsize   2
e_phnum       2
e_shentsize   2
e_shnum       2
e_shstrndx    2

Total:
52 bytes

ELF64 Header Layout

ELF64 Header:

e_ident      16 bytes
e_type        2
e_machine     2
e_version     4
e_entry       8
e_phoff       8
e_shoff       8
e_flags       4
e_ehsize      2
e_phentsize   2
e_phnum       2
e_shentsize   2
e_shnum       2
e_shstrndx    2

Total:
64 bytes

ELF Header vs Program Header

The ELF header describes the file as a whole. Program headers describe loadable or runtime-oriented segments.

A file can have an ELF header even when no program-header table is present. Relocatable object files are a common example.

ELF Header vs Section Header

Section headers describe logical file sections used by linkers, debuggers, symbol tools and binary-analysis utilities. Program headers instead describe segments used primarily by runtime loaders.

ELF Header Decoder FAQs

What is the ELF magic number?

The standard ELF magic bytes are 7F 45 4C 46.

How large is an ELF32 header?

A standard ELF32 file header is 52 bytes.

How large is an ELF64 header?

A standard ELF64 file header is 64 bytes.

How do I know whether an ELF file is 32-bit or 64-bit?

Check EI_CLASS at byte offset 4. A value of 1 means ELF32 and 2 means ELF64.

How do I determine ELF endianness?

EI_DATA at byte offset 5 is 1 for little-endian and 2 for big-endian.

What does e_machine 62 mean?

Machine value 62 identifies AMD x86-64.

What does e_machine 183 mean?

Machine value 183 identifies AArch64.

What does e_machine 243 mean?

Machine value 243 identifies RISC-V.

What is e_entry?

e_entry is the executable entry-point virtual address when an entry point is defined for the object.

Can I paste the beginning of a complete ELF file?

Yes. With Allow Bytes After ELF Header selected, the decoder uses the first 52 or 64 bytes according to EI_CLASS and ignores later bytes.

Decode ELF Executable Headers

Inspect raw Linux, embedded and Unix ELF headers from firmware, executables, object files, shared libraries and binary dumps with automatic 32-bit, 64-bit and endian-aware field decoding.