elf_getident.3e (2010 09)

elf_getident(3E) elf_getident(3E)

NAME

elf_getident - retrieve ﬁle identiﬁcation data

SYNOPSIS

cc [ﬂag... ] ﬁle...

-lelf [library ] ...

#include <libelf.h>

char *elf_getident(Elf *elf, size_t *ptr);

DESCRIPTION

As elf (3E) explains, ELF provides a framework for various classes of ﬁles, where basic objects may have

32 bits, 64 bits, and so forth. To accommodate these differences, without forcing the larger sizes on

smaller machines, the initial bytes in an ELF ﬁle hold identiﬁcation information common to all ﬁle

classes. Every ELF header’s

e_ident has EI_NIDENT bytes with the following interpretation.

e_ident Index Value Purpose

EI_MAG0 ELFMAG0 File identification

EI_MAG1 ELFMAG1

EI_MAG2 ELFMAG2

EI_MAG3 ELFMAG3

EI_CLASS ELFCLASSNONE File class

ELFCLASS32

ELFCLASS64

EI_DATA ELFDATANONE Data encoding

ELFDATA2LSB

ELFDATA2MSB

EI_VERSION EV_CURRENT File version

EI_OSABI ELFOSABI_NONE OS/ABI identification

ELFOSABI_HPUX

EI_ABIVERSION 0 ABI version

EI_PAD Start of padding bytes

10-15 0 Unused, set to zero

Other kinds of ﬁles (see elf_kind (3E)) also may have identiﬁcation data, though they would not conform

to e_ident.

elf_getident returns a pointer to the ﬁle’s ‘‘initial bytes.’’ If the library recognizes the ﬁle, a conver-

sion from the ﬁle image to the memory image may occur. In any case, the identiﬁcation bytes are

guaranteed not to have been modiﬁed, though the size of the unmodiﬁed area depends on the ﬁle type. If

ptr is non-null, the library stores the number of identiﬁcation bytes in the location to which ptr points. If

no data is present, elf is null, or an error occurs, the return value is a null pointer, with zero optionally

stored through ptr .