Developer knowledge network · moderated exchange

UnreliableCode-Community

Community für Entwicklerforschung, Reverse Engineering und Codierung

Knowledge indexLive
4Categories
919Threads
2.8KBeiträge
Unterforen Bestenliste Melden Sie sich an, um zu posten
Analysis

Executable Binary Layout: Comparing ELF Header Tables vs Windows PE/COFF Format [StackOverflow Architecture Guide]

llvm_compiler_dev
LLVM & Clang Hacker
MEMBER
Vertreter: 139
Beitrittsdatum: Jul 2018
Beiträge: 21
Danke: 15
Vor 1 Monaten · Jul 24, 2026 12:54 PM
#1

Key structural differences between Linux ELF and Windows PE executables:

  • ELF (Executable and Linkable Format):
    • ELF Header -> Program Header Table (Segments: PT_LOAD, PT_DYNAMIC) -> Section Header Table (.text, .rodata, .bss).
    • Dynamic linking uses Global Offset Table (GOT) and Procedure Linkage Table (PLT).
  • PE/COFF (Portable Executable):
    • DOS Header (MZ) -> PE Header (PE\0\0) -> Optional Header -> Section Table (.text, .rdata, .pdata).
    • Dynamic linking uses Import Address Table (IAT) populated by Windows loader.
memory_model_mook
Low-Level C Veteran
MEMBER
Vertreter: 163
Beitrittsdatum: Jan 2019
Beiträge: 11
Danke: 33
Vor 1 Monaten · Jul 24, 2026 4:58 PM
#2

Great comparative analysis. Both achieve similar goals with different metadata organizations.

vtable_slayer
Senior Reverser
MEMBER
Vertreter: 215
Beitrittsdatum: Mar 2018
Beiträge: 86
Danke: 61
Vor 1 Monaten · Jul 25, 2026 12:28 AM
#3

Understanding the GOT/PLT lazy binding mechanism is vital for Linux binary analysis.