As
Intro(ELF)
explains,
ELF
provides a framework for various
classes of files, where basic objects may have 32 bits,
64 bits, and so forth.
To accommodate these differences, without forcing the
larger sizes on smaller machines, the initial bytes in
an
ELF
file hold identification information common
to all file classes.
Every
ELF
header's e_ident has EI_NIDENT bytes
with the following interpretation.
e_ident Index
Value
Purpose
EI_MAG0
ELFMAG0
File identification
EI_MAG1
ELFMAG1
EI_MAG2
ELFMAG2
EI_MAG3
ELFMAG3
EI_CLASS
ELFCLASSNONE
File class
ELFCLASS32
ELFCLASS64
EI_DATA
ELFDATANONE
Data encoding
ELFDATA2LSB
ELFDATA2MSB
EI_VERSION
EV_CURRENT
File version
EI_OSABI
ELFOSABI_NONE
Vendor extension identification
EI_OSABIVERSION
0
Vendor extension version
9-15
0
Unused, set to zero
Other kinds of files [see
elf_kind(ELF)]
also may have identification data, though they would not
conform to e_ident.
elf_getident
returns a pointer to the file's ``initial bytes.''
If the library recognizes the file, a conversion
from the file image to the memory image may occur.
In any case, the identification bytes are guaranteed not to have been modified,
though the size of the unmodified area depends on the file type.
If
ptr
is non-null, the library
stores the number of identification bytes in the location to which
ptr
points.
If no data is present,
elf
is null, or an error occurs,
the return value is a null pointer,
with zero optionally stored through
ptr.