New ELF specification for public review

[Posted September 3, 2025 by jzb]

Cary Coutant has announced a draft for version 4.3 of the Executable and Linking Format (ELF) object file format. The specification was formerly part of the Unix System V Release 4 (SVR4) gABI document:

The last published gABI documents were the Fourth Edition and a draft of Edition 4.1, both published in March 1997. The ELF portions of the document were updated several times between 1998 and 2015, published online [...]

I've published the last draft from 2015 as Version 4.2, and collected the several changes since then, along with new e_machine values, as Version 4.3.

The source for the draft is on GitHub in reStructuredText format, and Coutant has collected the mailing list discussions for changes in 4.3 as GitHub issues. Thanks to Jose E. Marchesi for the tip.

Evolution of the ELF object file format

Posted Sep 3, 2025 16:15 UTC (Wed) by tux3 (subscriber, #101245) [Link]

The MaskRay blog linked in the thread is full of excellent information, I'll be glad to feed the ever-growing read-later list.
I hadn't heard about those features added in the last decade; their notes give a good history: https://maskray.me/blog/2024-05-26-evolution-of-elf-objec...

notes

Posted Sep 3, 2025 22:35 UTC (Wed) by SLi (subscriber, #53131) [Link] (3 responses)

One thing that feels less than perfect in the current specification is the lack of extension mechanisms. In practice many applications put stuff in the . notes section in ad hoc formats.

Now I can see the dangers of enabling such an extension mechanism and vendors starting to rely on their own possibly undocumented extensions.

Yet at the same time I wonder if this is worse than using the notes section for this...

notes

Posted Sep 4, 2025 0:40 UTC (Thu) by karkhaz (subscriber, #99844) [Link] (2 responses)

Not sure if this is exactly what you mean, but it's possible to create arbitrary sections to put custom data into. The CBMC static analysis suite includes a compiler that compiles C code into a regular executable ELF file, but with an additional .goto-cc section containing the bytecode that CBMC uses to analyze the program for bugs [1]. AIUI the KLEE fuzzing tool uses the same trick to put LLVM bytecode into a section called .llvm_bc. In both cases you end up with a so-called 'hybid binary' that can be executed as usual (or linked if it's a library), but also loaded into an analysis tool, which ignores .text and other sections and just reads and analyzes the bytecode.

[1] https://github.com/diffblue/cbmc/blob/develop/src/goto-cc...

notes

Posted Sep 4, 2025 3:30 UTC (Thu) by SLi (subscriber, #53131) [Link] (1 responses)

Good point. Now I'm confused why some things put machine readable stuff in notes instead.

notes

Posted Sep 4, 2025 5:14 UTC (Thu) by gf2p8affineqb (subscriber, #124723) [Link]

Maybe because readelf knows how to print it?

Copyright notice

Posted Sep 4, 2025 6:08 UTC (Thu) by maskray (subscriber, #112608) [Link] (2 responses)

Cary Coutant, who retired from HP and Google, is maintaining the specification. He is working to [relicense the ELF specification under a more permissive license](https://groups.google.com/g/generic-abi/c/doY6WIIPqhU/m/o...). If this effort is unsuccessful, anyone can take the Tool Interface Standard (TIS) Portable Formats Specification, version 1.2, which is considered to be in the public domain. If anyone knows more about license, please tell me and I will update my notes at https://maskray.me/blog/2024-05-26-evolution-of-elf-objec... :)

The "2023-2025 Xinuos Inc. All rights reserved." notice is controversial as the work it refers to was entirely done by contributors outside that company (Cary, Ali, etc).. The company did not do anything with the maintenance. Cary doesn't work for company (https://groups.google.com/g/generic-abi/c/9OO5vhxb00Y/m/D... )

Copyright notice

Posted Sep 4, 2025 6:46 UTC (Thu) by Wol (subscriber, #4433) [Link] (1 responses)

Isn't Xinuos one of the spin-offs from the SCOG/IBM law-suit saga? Iirc they were spun off out of SCOG when it went bust with all of the alleged IP rights, but without lawsuit rights.

https://en.wikipedia.org/wiki/Xinuos

Cheers,
Wol

Copyright notice

Posted Sep 5, 2025 16:50 UTC (Fri) by Hobart (subscriber, #59974) [Link]

Yeah. And the SCO v IBM litigation is still ongoing in their filings today -

> Xinuos filed a notice of appeal to the U.S. Court of Appeals for the Second Circuit:
> No. 25-1073 (filed Apr. 29, 2025)
> Appeal remains pending as of Sept. 3, 2025.

https://dockets.justia.com/docket/circuit-courts/ca2/25-1073

Universal binaries?

Posted Sep 7, 2025 22:54 UTC (Sun) by ATLief (subscriber, #166135) [Link]

I was really hoping this would standardize the FatELF format or offer something similar to support “universal” (i.e. multiple architecture) binaries. Oh well.