ELF File Format Parsing

In this post i will explain how to parse 32 bit ELF File Format for finding offsets of segments. Firstly we need to lookup ELF Header (First 52 bytes) for taking offsets of Program Headers Table, EntryPoint Addr, Section Headers Tables etc..

If we take an DWORD value from 24th offset of ELF Header we can grab EntryPoint of executable file. DWORD value at 32th offset is start offset of Section Headers Table and size of this headers table is located at 46th offset as a WORD value. We also need number of section headers that located at 48th offset as a WORD value. Also Section Header String Table Index is located at 50th offset as a WORD value. So we can say ELF Header structure is like this;