ELF Executable
| Format | ELF Executable |
|---|---|
| Short name | ELF |
| Category | execution |
| Platforms | Linux, Android, QNX |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Native executable and shared library format for Android and Linux. On Android, ELF shared libraries (.so) are bundled inside APK packages under lib/ and loaded at runtime via JNI — they often contain hardcoded strings, API endpoints, encryption keys, and security-sensitive logic not visible in DEX bytecode. Malware authors frequently move sensitive code into native libraries precisely because ELF is harder to decompile than DEX. On Linux, ELF binaries reveal installed software and potential implants. Strings extraction is a fast first step; full analysis requires disassembly.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 7F 45 4C 46 | .ELF | ELF magic number |
Known extensions
.so, .elf, .ko, .o
References
- System V ABI — generic ELF specification (gABI) https://refspecs.linuxfoundation.org/elf/gabi4+/contents.html
- ELF format specification (man page) https://man7.org/linux/man-pages/man5/elf.5.html
- Ghidra — open source reverse engineering tool (NSA) https://github.com/NationalSecurityAgency/ghidra
- Reversing Android native libraries (HackTricks) https://hacktricks.wiki/en/mobile-pentesting/android-app-pentesting/reversing-native-libraries.html
- ELF shared library injection forensics (Ryan O'Neill, 2016) https://engineering.backtrace.io/2016-04-14-elf-shared-library-injection-forensics/
Cite this entry
Crush Format Reference, “ELF Executable”. https://kalink0.github.io/crush-forensics/formats/elf/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction