What is the ELF file format?
Files with the .elf extension store binary data structured according to the Executable and Linkable Format standard - the default executable and object format for Linux, most Unix-like systems, and many embedded platforms. The format was introduced with Unix System V Release 4 by Unix System Laboratories and later ratified as a Tool Interface Standard (TIS) portable specification.
ELF files can store the following types of content:
- Executable files for applications and tools, often distributed as a .bin file
- Compiled object files, typically carrying the
.oextension - Shared libraries - files with the .so extension
- Core dumps (memory snapshots produced after a process crash)
The format is built around a well-defined binary structure. Every .elf file begins with the 4-byte magic sequence 7F 45 4C 46 (0x7F followed by the ASCII letters ELF) at offset 0, followed by header fields that identify the target architecture, word size (32-bit or 64-bit), and byte order (little-endian or big-endian). Two optional tables - the program header table and the section header table - then describe how segments should be loaded at runtime and how sections are organised for linking.
Although the ELF standard was developed with Unix systems in mind, it was quickly adopted by other platforms, including game consoles such as the PlayStation 2 and Wii, Android, and many embedded environments. The standard MIME type is application/x-elf. Contents of an .elf file are not human-readable; tools such as readelf and objdump (both part of GNU Binutils) can inspect its headers and disassemble its code without executing it.
Security & safety
RISK: HIGHLike any executable, an ELF can contain malware - Linux/IoT botnets (e.g. Mirai variants) ship as ELF binaries, and an ELF runs with your privileges once executed. Only run ELF files from trusted sources; don't 'chmod +x' and execute random downloads. Inspect unknown ELFs safely with readelf/objdump or scan them on VirusTotal before running. Console homebrew .elf files are lower-risk (they run inside an emulator's sandbox) but still get them from reputable homebrew sources.
Format details
in a nutshellPrograms that open ELF files
Windows3 apps
PCSX2 (PlayStation 2 emulator)
Open-source Run a PS2 homebrew/SDK .elf: File > Run ELF (or boot the .elf directly). For PS2 ELF binaries only.
Dolphin (GameCube/Wii emulator)
Open-source Open a GameCube/Wii homebrew .elf in Dolphin to run it. For Nintendo console ELF binaries only. 
macOS1 app
Ghidra
Open-source Analyse an ELF on macOS by importing it into Ghidra (ELF won't run natively on macOS). 
Linux4 apps
Linux (run it)
Built-in Make it executable and run: 'chmod +x ./program && ./program'. An ELF executable IS the program - there's nothing to 'view'. It must match your CPU architecture.
readelf (GNU binutils)
Open-source Inspect without running: 'readelf -a file.elf' shows headers, sections, symbols and the target architecture.
objdump (GNU binutils)
Open-source Disassemble: 'objdump -d file.elf' shows the machine code; 'objdump -x' shows all headers.
Ghidra
Open-source Import the ELF to disassemble and decompile it to readable C - for reverse engineering/analysis. Technical details
deep spec| Magic number | `7F 45 4C 46` (0x7F followed by ASCII `ELF`) at byte offset 0, present in every valid ELF file |
| MIME type | `application/x-elf` |
| Word-size variants | 32-bit (EI_CLASS = `01`) and 64-bit (EI_CLASS = `02`), encoded at offset 4 in the ELF header |
| Byte-order field | EI_DATA at offset 5: `01` = little-endian, `02` = big-endian; determined by the target hardware architecture |
| File types (e_type) | ET_EXEC (executable), ET_REL (relocatable object), ET_DYN (shared object or PIE), ET_CORE (core dump) |
| Target architectures | x86, x86-64, ARM, AArch64, MIPS, RISC-V, PowerPC, SPARC and many others, identified by the `e_machine` field in the ELF header |
| OS/ABI identifier | EI_OSABI byte at offset 7 specifies the target ABI: 0 = System V, 3 = Linux, 9 = FreeBSD, 12 = Solaris |
| Structure layout | ELF header → optional program header table (runtime load segments) → data → optional section header table (link-time sections) |
| Key named sections | `.text` (code), `.data` (initialised data), `.bss` (zero-initialised data), `.rodata` (constants), `.symtab` / `.dynsym` (symbols), `.rel` / `.rela` (relocations) |
| Dynamic linking | Shared objects are resolved at load time by the runtime linker (`ld.so`); the required interpreter path is stored in the `PT_INTERP` program header |
| Debug information | DWARF debug data is embedded in `.debug_*` ELF sections and can be removed from production binaries with the `strip` command |
| Position-independent executables | PIE binaries are typed ET_DYN and support ASLR; the Linux kernel randomises their base load address at each launch |
| Primary inspection tools | `readelf -a` (headers, symbols, sections) and `objdump -d` (disassembly), both provided by GNU Binutils |
| Released | 1989 (Unix System V Release 4); adopted as the TIS/System V ABI standard |
| Open standard | Yes · royalty-free |
| Specification | refspecs.linuxfoundation.org |
ELF conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about ELF files.
