An ELF file is a standard format that tells your operating system how to run a program
ELF stands for Executable and Linkable Format. It is a file structure that holds the actual instructions a computer executes, along with metadata that tells the operating system how to load and run those instructions. When you read a program for Linux or Unix, or when your phone runs Android apps, you are working with ELF files — even if you never see the .elf extension.
The format was created in the 1990s and became the standard way Unix-like systems package executable code. Windows uses a different format called PE (Portable Executable), and macOS uses Mach-O, but the principle is the same: the file contains both the program code and instructions for how to run it.
You do not need to open or edit ELF files yourself. Your operating system reads them automatically when you launch a program. Understanding what they are helps explain why a program compiled for Linux will not run on Windows, and why your phone's apps are structured the way they are.
Key Takeaways
- ELF files contain executable code and metadata that tells your operating system how to load and run a program.
- Linux, Unix, and Android all use ELF format as their standard for programs and libraries.
- An ELF file is not human-readable — it is binary code designed for machines, not people.
- A program compiled as an ELF file for Linux will not run on Windows or macOS because those systems use different executable formats.
What is actually inside an ELF file
An ELF file is divided into sections, each serving a specific purpose. The header sits at the very beginning and tells the operating system basic facts: what architecture the code was built for (32-bit or 64-bit, Intel or ARM), what type of file it is (executable or library), and where to find the actual program code.
The code section contains the actual machine instructions — the low-level commands that the processor executes. The data section holds variables and constants the program needs while running. A symbol table keeps track of function names and variable names so the operating system can link this program to libraries it depends on. There are also sections for debugging information, relocation data, and other metadata.
When you run a program, the operating system reads the ELF header first, checks that the architecture matches your processor, then loads the code and data sections into memory in the order the header specifies. The program then begins executing from a designated entry point.
Why Linux and Android use ELF instead of other formats
ELF became the standard for Unix-like systems because it is flexible and efficient. The format can handle both small embedded programs and massive applications. It supports dynamic linking, which means a program can load libraries at runtime rather than bundling everything into one file — this saves disk space and lets multiple programs share the same library code.
Android chose ELF for the same reason. Android apps are written in Java or Kotlin, but they are compiled down to native code in ELF format before they run on your phone. The Android runtime reads the ELF file and executes the instructions on your device's processor.
Windows and macOS use different formats because they were designed independently, but the concept is identical: each format specifies how to package executable code so the operating system knows what to do with it.
How ELF files relate to source code and compilation
When a programmer writes code in C, C++, Rust, or another compiled language, that code is human-readable text. A compiler reads that text and translates it into machine instructions, then packages those instructions into an ELF file. The original source code is gone — the ELF file contains only the compiled result.
This is why you cannot reverse-engineer a program back to its original source code just by looking at the ELF file, though you can extract some information. The symbol table may contain function names if the programmer did not strip them out, and debugging sections may contain line numbers and variable names. But the actual logic and structure of the original code is lost.
If you read source code and want to run it, you have to compile it first — the compiler will produce an ELF file that your operating system can execute.
Static versus dynamic linking in ELF files
An ELF file can be statically linked, meaning all the code it needs is bundled inside the file itself. A statically linked program is larger but can run on any system with the right architecture, because it does not depend on external libraries.
A dynamically linked ELF file is smaller because it references libraries that live elsewhere on your system. When you run the program, the operating system loads those libraries into memory alongside the program code. This is more efficient — if ten programs all use the same library, the library loads once and all ten programs share it. But a dynamically linked program will not run if the required libraries are missing.
Most programs you install on Linux are dynamically linked. The installer ensures the necessary libraries are present. Embedded systems and specialized applications often use static linking to avoid dependencies.
How to tell if a file is an ELF file
ELF files do not always have a .elf extension. On Linux, executable programs often have no extension at all, or they might have .so (shared object, meaning library) or .a (archive, meaning static library). The only way to know for certain is to look at the file's contents.
Every ELF file begins with a four-byte magic number: 0x7F followed by the letters E, L, F in ASCII. If you open an ELF file in a hex editor, the first bytes will read as 7F 45 4C 46. On Linux, you can use the file command to check: type file /path/to/program and it will tell you whether the file is an ELF executable, a shared library, or something else.
Windows executables start with the letters MZ. macOS executables start with different magic numbers depending on whether they are 32-bit or 64-bit. This magic number is how the operating system when ready knows what format it is dealing with.
Why this matters for your devices
Understanding ELF files explains why programs are not portable across operating systems. A program compiled as an ELF file for Linux will not run on Windows, even if the source code is identical, because Windows expects PE format. If you want to run the same program on multiple systems, you have to compile it separately for each one.
On your phone, every app is ultimately an ELF file (or multiple ELF files bundled together). The Android system manages these files in the background — you never see them. But when your phone feels slow or an app crashes, part of what is happening involves the operating system managing ELF files in memory.
For most users, ELF files are invisible. But they are the reason your Linux computer can run programs, why your Android phone works the way it does, and why you cannot straightforward copy a Windows program onto a Mac and expect it to work.
Frequently Asked Questions
Can I open and read an ELF file like a text document?
No. ELF files contain compiled machine code, which is binary data designed for processors, not people. Opening one in a text editor will show gibberish. You can use specialized tools like objdump or readelf to extract some information, but you cannot read the actual program logic.
What is the difference between an ELF file and a library?
Both are ELF format, but an executable ELF file has an entry point — a designated place where the program starts running. A library ELF file (usually with .so extension) has no entry point; instead, it provides functions that other programs call. You cannot run a library directly, but you can run an executable.
Why do some Linux programs have no file extension?
Linux does not require file extensions the way Windows does. The operating system determines what a file is by reading its contents, not its name. An ELF executable can be named anything. The convention is to use no extension for executables and .so for libraries, but the extension is optional.
Can I convert an ELF file to run on Windows?
Not directly. You would need the original source code and a Windows compiler. Emulation tools like Wine can run some Linux programs on Windows by translating system calls, but this is not a true conversion — it is a compatibility layer.
Are all Linux programs ELF files?
Most are, but not all. Shell scripts and interpreted languages like Python are text files that a separate interpreter reads and executes. Only compiled programs are ELF files. Some older Unix systems used different executable formats, but ELF is the modern standard across Linux, Unix, and Android.