bitpeek
  1. Bitpeek
  2. File formats
  3. ELF file format

ELF Header and Magic Bytes

Executable and Linkable Format files start with a 16-byte identification array. Its first bytes establish the format, class, byte order, version, and ABI before the remaining header is interpreted.

Inspect an ELF file Local processing notes

ELF magic bytes at offset 0

7F 45 4C 46

The first byte is 0x7F, followed by ASCII ELF. These four bytes identify an ELF object before processor-specific fields are read.

The 16-byte e_ident array

OffsetNameMeaning
0x00–0x03EI_MAG0–37F 45 4C 46
0x04EI_CLASS1 = ELF32, 2 = ELF64
0x05EI_DATA1 = little-endian, 2 = big-endian
0x06EI_VERSIONELF identification version
0x07EI_OSABIOperating system or ABI identification
0x08EI_ABIVERSIONABI-specific version when defined
0x09–0x0FEI_PADReserved padding bytes

Fields after e_ident

At offset 0x10, e_type identifies relocatable, executable, shared, core, or processor-specific object types. e_machine follows at 0x12, and e_version begins at 0x14.

Later field widths depend on EI_CLASS. For example, e_entry is four bytes in ELF32 and eight bytes in ELF64. The program-header and section-header offsets also move between the two layouts. EI_DATA controls the byte order for all multi-byte values.

Practical ELF inspection checks

  • Read EI_CLASS and EI_DATA before interpreting any multi-byte field.
  • Use e_type and e_machine to understand the object role and target architecture.
  • Check header sizes and entry counts before following program- or section-table offsets.
  • Expect executables and shared objects to have no .elf extension on Unix-like systems.
  • Use platform tools such as readelf for complete semantic validation.

Local processing and privacy

The ELF file format workflow opens the same Bitpeek browser workspace. Selected file bytes, file names, pasted input, searches, edits, hashes, and comparison data are processed in local browser memory and are not sent to a Bitpeek server.

The static guide itself can be read without opening a file or creating an account.

Technical reference: System V ABI — ELF Header.

Frequently asked questions

How do I tell ELF32 from ELF64?

Read byte 4 (EI_CLASS). A value of 1 means ELF32 and 2 means ELF64.

How do I know the ELF byte order?

Read byte 5 (EI_DATA). A value of 1 selects little-endian encoding and 2 selects big-endian encoding for multi-byte fields.

Does an ELF file need an .elf extension?

No. Unix executables, shared libraries, object files, core files, and firmware payloads can all use ELF with different names or extensions.