So ELF provides us with section headers. Their format looks like this:

Or in code:

namespace Mosa.Runtime.Linker.Elf32.Sections
{
    public class Elf32SectionHeader
    {
        public uint Name;
        public Elf32SectionType Type; // uint enum
        public Elf32SectionAttribute Flags; // uint enum
        public uint Address;
        public uint Offset;
        public uint Size;
        public uint Link;
        public uint Info;
        public uint AddressAlignment;
        public uint EntrySize;
    }
}

As usual, I’ll explain the used variables piece by piece now:

• Name – Each section has a name. Name is used as an index into the section header string table, which is
  just an array of chars. We’ll come to this in a later section.
• Type – Each section has to have a type, telling is whether it’s a code section, data section, etc.
• Flags – Through flags, one can modify the section. For example the Write-flag enables write access to the
  section’s data, and the ExecuteInstructions-Flag, which tells us that the section contains executable code.
• Address – Some sections will be loaded into memory (like e.g. data sections), so Address give the virtual
  address for the section’s data in memory.
• Offset – Gives an offset in bytes from the beginning of the file to the section’s actual data.
• Size -
• Link -
• Info -
• AddressAlignment -
• EntrySize -

namespace Mosa.Runtime.Linker.Elf32
{
    public class Elf32ProgramHeader
    {
        public Elf32ProgramHeaderType Type; // uint enum
        public uint Offset;        
        public uint VirtualAddress;
        public uint PhysicalAddress;
        public uint FileSize;
        public uint MemorySize;
        public Elf32ProgramHeaderFlags Flags; // uint enum
        public uint Alignment;
}

• ProgramHeaderType – Defines the program header’s type
• Offset – Offset inbytes to the segment start
• VirtualAddress -
• PhysicalAddress -
• FileSize – Size of the segment it takes up in the file in bytes.
• MemorySize – Size of the segment it takes up in memory in bytes.
• Flags – Defines some flags that modify the segment, e.g. Execute / Write / Read, etc.
• Alignment – The file alignment.

I haven’t disassembled and understood every little thing about the program header. If you’re missing something here and know about it, please feel free to comment.

But for now, let’s move on to the section header table and the section headers themselves.

In this series of articles I’ll describe the format, occured problems, etc that I had to tackle during development. So let’s get this thing started with the format itself and especially it’s header. In picture 1 below, you can see a rough sketch for the ELF file format. Each ELF file contains a header, program header, a section header table, section headers, sections, and so on.

Picture 1: ELF file format

The first one, the header, gives us general information about the file and it’s internal structure. We need this information first to be able to read out the rest of the file.

Don’t worry. We’ll get to every little component piece by piece. First of all, some code. Code tells more than 1000 lines of preaching

namespace Mosa.Runtime.Linker.Elf32
{
    public class Elf32Header
    {
        public byte[] Ident = new byte[16];
        public Elf32FileType Type;
        public Elf32MachineType Machine;
        public Elf32Version Version;
        public uint EntryAddress;
        public uint ProgramHeaderOffset;
        public uint SectionHeaderOffset;
        public uint Flags;
        public ushort ElfHeaderSize;
        public ushort ProgramHeaderEntrySize;
        public ushort ProgramHeaderNumber;
        public ushort SectionHeaderEntrySize;
        public ushort SectionHeaderNumber;
        public ushort SectionHeaderStringIndex;

        public static readonly byte[] MagicNumber = new byte[4] {
            (byte)0x7F,
            (byte)'E',
            (byte)'L',
            (byte)'F'
        };
}

• Ident – The ident is a 16 byte long value that marks an ELF file and gives first hand information about the binary. It contains 4 initial bytes that contain a “magic number” so that it is recognized as an ELF binary. This magic number is 0x7F + “ELF”.
  
  • 0 – 3: The magic number
  • 4: Ident class
  • 5: Data flags
  • 6: Version
  • 7: Padding size
  • 8-15: Left unused for later versions
• Type – The type is an integral value determining the type of our object file, e.g. if it’s an executable, a library, an object file, etc.
• Machine – This marks what kind of machine our binary is for, e.g. whether it’s for Intel Architectures, MIPS, Sparc, etc.
• Version – To hold track what version of ELF we’re using. At the moment 1 is the only valid version.
• EntryAddress – This is the address where the code segment starts that should be first executed when the binary is invoked.
• ProgramHeaderOffset – Gives the offset in bytes from the beginning of the file to the start of the program header. Zero means that there is none (otherwise it’d file into the ELF header, which is something we don’t want).
• SectionHeaderOffset – Gives the offset in byte from the beginning of the file to the start of the section header. Zero means that there is none (otherwise it’d file into the ELF header, which is something we don’t want).
• Flags -
• ElfHeaderSize – The size of our header. Just sum up all data type sizes contained and end up with 0×34 bytes.
• ProgramHeaderEntrySize – Gives the size in bytes for the program headers. Every program header has to be the same size.
• ProgramHeaderNumber – Gives the amount of program headers available in this binary. Usually 1.
• SectionHeaderEntrySize – Gives the size in bytes for the section headers. Every section header has to be the same size.
• SectionHeaderNumber – Gives the amount of section headers available in this binary.

• SectionHeaderStringIndex - Index into the section header table to the section header that
  contains information about the string table section.

Write the Ident

Writing the Ident is pretty simple and straightforward:

public void CreateIdent(Elf32IdentClass identClass, Elf32IdentData data, byte[] padding)
{
   // Store magic number
    Ident[0] = MagicNumber[0];
    Ident[1] = MagicNumber[1];
    Ident[2] = MagicNumber[2];
    Ident[3] = MagicNumber[3];

    // Store class
    Ident[4] = (byte)identClass;
    // Store data flags
    Ident[5] = (byte)data;
    // Version has to be current, otherwise the file won't load
    Ident[6] = (byte)Elf32Version.Current;
    Version = Elf32Version.Current;

    // Set padding byte to
    Ident[7] = 0x07;

    for (int i = 8; i < 16; ++i)
        Ident[i] = 0x00;
 }