ARM ELF Specification: AAELF32, AAELF64, Headers, Relocations, and Tools

Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.

“ARM ELF specification” is an umbrella term, not the formal name of one document. For 32-bit Arm targets, the relevant specification is AAELF32 (ELF for the Arm Architecture). For 64-bit Arm targets, it is AAELF64 (ELF for the Arm 64-bit Architecture). Both are processor-specific supplements to generic ELF; they do not, by themselves, define every calling convention, operating-system rule, exception format, or security extension.

The current official index is Arm’s ABI repository. Select the document by inspecting the file’s ELF class and machine field, then consult the applicable platform ABI and related Arm ABI specifications.

#	Preview	Product	Price
1		Arm Architecture Reference Manual	$5.50	Buy on Amazon
2		C: A Reference Manual, 5th Edition	$38.49	Buy on Amazon
3		Lua 5.1 Reference Manual	$18.62	Buy on Amazon
4		Power Reference Manual for the Electrical and Computer PE Exam	$227.74	Buy on Amazon
5		The Annotated C++ Reference Manual	$24.56	Buy on Amazon

Which Arm ELF specification do you need?

Do not choose a specification solely from a filename or directory name. A 32-bit Arm object and an AArch64 object use different instruction encodings, relocation namespaces, ABI rules, and execution environments.

ELF in one page

ELF is a container and interchange format used for relocatable objects, executables, shared libraries, and core files. An ELF file can contain:

#1 Best Overall

Arm Architecture Reference Manual

$5.50

Buy on Amazon

• An ELF header identifying its class, byte order, machine, type, and table locations.
• Section headers describing link-time and analysis structures.
• Program headers describing segments that a loader maps into memory.
• Static and dynamic symbol tables.
• String tables.
• Relocation entries used by a linker or dynamic loader.
• Dynamic-linking metadata, notes, initialization arrays, unwind information, and debug data.

The e_type field commonly identifies a relocatable object (ET_REL), executable (ET_EXEC), position-independent executable or shared object (ET_DYN), or core file (ET_CORE).

Sections and segments are not the same

Sections primarily serve linkers, debuggers, and binary-analysis tools. Familiar examples include .text, .rodata, .data, .bss, .symtab, .dynsym, .dynstr, .rela.*, .rel.*, .got, .plt, and .debug_*.

Segments are the loader-facing view. Common program-header types include PT_LOAD, PT_DYNAMIC, PT_INTERP, PT_NOTE, PT_TLS, PT_GNU_STACK, and PT_GNU_RELRO. AArch32 files may also use PT_ARM_EXIDX where the exception-handling ABI requires it.

Loaders generally map segments, not individual sections. The linker combines sections into segments with suitable permissions, alignment, and platform-specific policies. A file can therefore have a section layout that does not directly describe what the operating system maps.

Rank #2

Sale

C: A Reference Manual, 5th Edition

• c
• c programming
• programming language
• reference

$38.49

Buy on Amazon

What AAELF adds to generic ELF

Generic ELF defines the broad file structure. AAELF defines how that structure is interpreted for Arm. Its architecture-specific material includes:

• The machine identifier in e_machine.
• Architecture-specific meanings of e_flags.
• Arm relocation types, formulas, instruction encodings, ranges, and overflow rules.
• Arm attributes and architecture compatibility information.
• Procedure-linkage-table, global-offset-table, and dynamic-linking conventions.
• Architecture-specific section and program-header types.
• AArch32 unwind-related sections and their relationship to EHABI.
• Extensions for features such as pointer authentication and memory tagging.

The most important point for linker and reverse-engineering work is that a relocation is not just a numeric tag. Its meaning depends on the target instruction or data field, symbol value, place, addend, code model, visibility, alignment, range, and whether static linking or dynamic loading performs the operation. Use the relocation definitions in the applicable AAELF32 or AAELF64 revision rather than combining tables from different architectures.

AAELF32: ELF for AArch32

AAELF32 covers ELF32 files for the 32-bit Arm architecture. Its practical concerns include Arm and Thumb/T32 instruction states, Arm-specific flags, attributes, relocations, loading, and dynamic linking.

• Machine identification: AArch32 files conventionally use EM_ARM.
• e_flags: Arm-specific flags can communicate architectural and ABI-related properties. Their interpretation is important when diagnosing incompatible objects.
• Instruction states: AArch32 code may use Arm instructions, Thumb/T32 instructions, or interworking between them. Disassembly and symbol metadata must be interpreted with the relevant code state in mind.
• .ARM.attributes: This can describe architecture, instruction-set, floating-point, and ABI assumptions so linkers and tools can detect incompatible combinations.
• Unwind information: .ARM.exidx and .ARM.extab may be present when the build uses the Arm exception-handling ABI. Their meaning belongs with EHABI, not generic ELF alone.

The current AAELF32 page in Arm’s repository shows a 2025Q4 revision with an issue date of January 23, 2026. That is a revision visible in the repository at the time of publication, not a timeless version label; check the repository for later changes.

Rank #3

Sale

Lua 5.1 Reference Manual

• Used Book in Good Condition

$18.62

Buy on Amazon

AAELF64: ELF for AArch64

AAELF64 defines the ELF conventions for AArch64. Ordinary AArch64 systems use ELF64 objects with ELFCLASS64 and EM_AARCH64. The machine value is 183 decimal, or 0xB7.

• Byte order: Little- and big-endian data encodings are represented by the normal ELF identification field, although actual support depends on the execution environment and toolchain.
• e_flags: Under the AAELF64 base definition, this field contains zero because there are no processor-specific base flags. Operating-system, vendor, or extension rules may impose additional behavior.
• Relocations: AArch64 uses its own relocation families, including instruction relocations, data relocations, page-relative addressing, and dynamic-linking forms.
• Build attributes: AAELF64 defines the SHT_AARCH64_ATTRIBUTES section type and the .ARM.attributes name, while the base document notes that public AArch64 build attributes had not been defined there. Toolchains and later extensions may add practical details.
• Data models: LP64 and ILP32 are distinct AArch64 environments. AAELF64 discusses an ELF32 ILP32 variant and states that ELF32 and ELF64 variants cannot be interlinked.

Thus, “AArch64 is ELF64” is a useful description of ordinary AArch64 binaries, but it is not a complete statement of every variant covered by the specification.

ELF header fields worth inspecting

A valid ELF header does not prove that a file can run on a particular Arm system. Compatibility also depends on the instruction set, calling convention, floating-point ABI, relocation support, loader, operating-system ABI, security extensions, and load address.

Relocations, GOT, PLT, and position-independent code

Object files often do not know final addresses when compiled. A relocation records a location that must be adjusted after symbols and layout are resolved. Static linkers apply many relocations while combining object files; dynamic loaders may apply others when loading a shared object or position-independent executable.

Rank #4

Sale

Power Reference Manual for the Electrical and Computer PE Exam

$227.74

Buy on Amazon

Arm relocation work commonly involves:

• Symbol-relative values: calculations based on a symbol address, sometimes plus an addend.
• Place-relative values: calculations involving the address where the relocated field resides, often used for PC-relative instruction forms.
• AArch64 page-relative addressing: instruction sequences can calculate a page address and then apply a page offset.
• Range and alignment limits: an instruction field may not be able to represent every possible address. A link can fail with a relocation overflow even when all symbols exist.
• Relaxation: a linker may replace or optimize an instruction sequence when the final layout permits it.
• REL versus RELA: relocation formats differ in where the addend is stored. Do not assume that a relocation section’s name alone explains its complete calculation.

Position-independent code commonly uses the GOT for addressable data and the PLT for indirect calls to dynamically resolved functions. Exact sequences and relocation rules differ between AArch32 and AArch64 and must be read from the relevant AAELF specification.

Text relocations, where the loader must modify code pages, can increase startup cost and conflict with read-only or hardened memory policies. A dynamic-loader error naming an unsupported relocation usually means the file’s relocation model, platform, or loader is incompatible—not that the ELF header is necessarily malformed.

Build attributes and compatibility checks

Attributes provide information that may not fit in the generic ELF header. In AArch32, .ARM.attributes is particularly useful for communicating architecture, instruction-set, floating-point, and ABI assumptions to linkers and other tools.

Attributes can help detect errors such as combining objects that require incompatible floating-point calling conventions or instruction-set features. They are not a universal compatibility guarantee: some loaders ignore them, vendor attributes may be unknown to other tools, and platform requirements may extend beyond the attributes recorded in an object.

Best Value

Sale

The Annotated C++ Reference Manual

$24.56

Buy on Amazon

Linux, bare metal, and other platforms

AAELF describes processor-specific and, in places, platform-standard material, but an operating system still defines important additional requirements.

• Bare metal: Toolchains such as arm-none-eabi and aarch64-none-elf may produce ELF for linkers, debuggers, bootloaders, or firmware. The final device image may be converted to a flat binary, Intel HEX, or another deployment format.
• Linux: Dynamic linking, the interpreter, TLS, executable loading, system calls, and process conventions add platform requirements. A Linux PIE is commonly ET_DYN, and a static executable may have no dynamic section.
• Android, BSD, RTOS, bootloaders, and proprietary systems: Each can impose additional loader, relocation, security, memory-layout, or startup rules.

A file can therefore conform to AAELF and still fail on a target platform because it requires a missing interpreter, unsupported relocation, incompatible TLS model, different data model, or unavailable instruction extension.

Inspecting an Arm ELF file

GNU binutils and LLVM tools are normally sufficient for inspection. The official Arm GNU Toolchain provides GNU-based toolchains for Arm targets.

# Identify the file and target
file image.elf

# Header, loader view, and link-time view
readelf -h image.elf
readelf -l image.elf
readelf -S image.elf

# Symbols, dynamic metadata, and relocations
readelf -s image.elf
readelf --dyn-syms image.elf
readelf -d image.elf
readelf -r image.elf

# Notes, attributes, and disassembly
readelf -n image.elf
readelf -A image.elf
objdump -f image.elf
objdump -p image.elf
objdump -d image.elf

For a relocatable object, begin with:

readelf -h module.o
readelf -S module.o
readelf -r module.o
readelf -s module.o

A typical AArch64 file should show ELF64, machine AArch64, a type such as REL, DYN, or EXEC, and—when it is a loadable image—one or more PT_LOAD segments. A typical AArch32 file should show ELF32, machine Arm, architecture-specific flags, and possibly .ARM.attributes or exception-index sections.

Output varies with stripping, static versus dynamic linking, linker scripts, endianness, and the GNU binutils or LLVM version. A stripped file can still retain program headers, dynamic symbols, notes, relocations, attributes, and disassembly clues.

How the surrounding Arm ABI documents fit together

Think of Arm binary compatibility as a stack:

Generic ELF
    ↓
AAELF32 or AAELF64
    ↓
AAPCS, EHABI, DWARF, C++ ABI, and other language/runtime rules
    ↓
Operating-system or platform ABI
    ↓
Toolchain, linker, loader, and deployment policy

Troubleshooting checklist

1. Wrong architecture: Compare EI_CLASS and e_machine. Do not link AArch32 and AArch64 objects together.
2. Data-model mismatch: Check whether the build expects LP64 or AArch64 ILP32.
3. Floating-point mismatch: Inspect AArch32 attributes and toolchain options for incompatible hard- and soft-float assumptions.
4. Unsupported relocation: Identify the exact relocation with readelf -r, then check the applicable AAELF document and platform loader support.
5. Relocation overflow: Check code model, placement, alignment, branch distance, and whether a linker relaxation or veneer is required.
6. Missing interpreter: For a dynamically linked executable, inspect PT_INTERP with readelf -l and verify that the target system provides that loader.
7. Unexpected load behavior: Inspect program headers and segment permissions rather than relying on section names.
8. Firmware startup failure: Verify the entry point, load address, linker script, segment alignment, reset-vector expectations, and any conversion from ELF to a flat image.
9. Security-extension issue: Check whether pointer-authentication or memory-tagging requirements come from an extension ABI rather than base AAELF.

Official references and tool choices

The Arm ABI repository is the best starting point because it separates AAELF32, AAELF64, AAPCS, BPABI, EHABI, DWARF, platform ABI material, and newer extensions. For normal analysis, free GNU binutils or LLVM tools are enough. Commercial products such as Arm Compiler for Embedded, Arm Development Studio, or Lauterbach TRACE32 become relevant for proprietary optimization, integrated enterprise workflows, certification, advanced debugging, or hardware trace—not for basic ELF interpretation.

Quick Recap

Bestseller No. 1

Arm Architecture Reference Manual

$5.50

SaleBestseller No. 2

C: A Reference Manual, 5th Edition

c; c programming; programming language; reference

$38.49

SaleBestseller No. 3

Lua 5.1 Reference Manual

Used Book in Good Condition

$18.62

SaleBestseller No. 4

Power Reference Manual for the Electrical and Computer PE Exam

$227.74

SaleBestseller No. 5

The Annotated C++ Reference Manual

$24.56

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.