Developer knowledge network · moderated exchange

Zajednica UnreliableCode

Zajednica za istraživanje, obrnuti inženjering i programiranje programera

Knowledge indexŽivjeti
4Categories
919Threads
2.8KPostovi
Podforumi Leaderboard Prijavite se za objavljivanje
Analysis

Executable Binary Layout: Comparing ELF Header Tables vs Windows PE/COFF Format [StackOverflow Architecture Guide]

llvm_compiler_dev
LLVM & Clang Hacker
MEMBER
Rep: 139
Datum pridruživanja: Jul 2018
Postovi: 21
Hvala: 15
prije 1 mjeseci · Jul 24, 2026 12:54 PM
#1

Key structural differences between Linux ELF and Windows PE executables:

  • ELF (Executable and Linkable Format):
    • ELF Header -> Program Header Table (Segments: PT_LOAD, PT_DYNAMIC) -> Section Header Table (.text, .rodata, .bss).
    • Dynamic linking uses Global Offset Table (GOT) and Procedure Linkage Table (PLT).
  • PE/COFF (Portable Executable):
    • DOS Header (MZ) -> PE Header (PE\0\0) -> Optional Header -> Section Table (.text, .rdata, .pdata).
    • Dynamic linking uses Import Address Table (IAT) populated by Windows loader.
memory_model_mook
Low-Level C Veteran
MEMBER
Rep: 163
Datum pridruživanja: Jan 2019
Postovi: 11
Hvala: 33
prije 1 mjeseci · Jul 24, 2026 4:58 PM
#2

Great comparative analysis. Both achieve similar goals with different metadata organizations.

vtable_slayer
Senior Reverser
MEMBER
Rep: 215
Datum pridruživanja: Mar 2018
Postovi: 86
Hvala: 61
prije 1 mjeseci · Jul 25, 2026 12:28 AM
#3

Understanding the GOT/PLT lazy binding mechanism is vital for Linux binary analysis.