windows 二进制文件 (PE/COFF & ELF) 格式和术语的说明

Clarification on Binary file (PE/COFF & ELF) formats & terminology

提问by claws

I'm confusing little in terminology.

我在术语上很少混淆。

A file that is given as input to the linker is called Object File. The linker produces an Image file, which in turn is used as input by the loader.

作为链接器输入的文件称为Object File。链接器生成一个Image file，该文件又被加载程序用作输入。

I got this from "MS PE & COFF Specification"

我从“MS PE & COFF 规范”中得到了这个

Q1.Image file is also referred to as Binary Image, Binary Fileor just Binary. Right?

一季度。图像文件也称为Binary Image，Binary File或简称为Binary. 对？

Q2.So, according to the above stated terminology, the PE/ELF/COFF are the formats of Image File& not the Object File.right? But http://www.sco.com/developers/gabi/latest/ch4.intro.htmlsays

Q2。因此，根据上述术语，PE/ELF/COFF 是图像文件的格式而不是目标文件。对？但是http://www.sco.com/developers/gabi/latest/ch4.intro.html说

This chapter describes the object file format, called ELF (Executable and Linking Format). There are three main types of object files.

• A relocatable fileholds code and data suitable for linking with other object files to create an executable or a shared object file.

• An executable fileholds a program suitable for execution; the file specifies how exec(BA_OS) creates a program's process image.

• A shared object fileholds code and data suitable for linking in two contexts. First, the link editor [see ld(BA_OS)] processes the shared object file with other relocatable and shared object files to create another object file. Second, the dynamic linker combines it with an executable file and other shared objects to create a process image.

本章介绍目标文件格式，称为 ELF（可执行和链接格式）。存在三种主要类型的目标文件。

• 可重定位文件包含适合与其他目标文件链接以创建可执行文件或共享目标文件的代码和数据。

• 一个可执行文件包含一个适合执行的程序；该文件指定 exec(BA_OS) 如何创建程序的进程映像。

• 共享目标文件包含适合在两个上下文中链接的代码和数据。首先，链接编辑器 [参见 ld(BA_OS)] 将共享对象文件与其他可重定位和共享对象文件一起处理以创建另一个对象文件。其次，动态链接器将它与可执行文件和其他共享对象结合起来创建进程映像。

contradictorily he is saying that both Object File & Image File are ELF formats & He is not at all differentiating between object & image files but referring them commonly as Object files. Isn't it wrong?

矛盾的是，他说目标文件和图像文件都是 ELF 格式，他根本没有区分目标文件和图像文件，而是通常将它们称为目标文件。是不是错了？

Q3.I know that PE is derived from COFF. But why does the Microsoft specifications of PE format is named Microsoft Portable Executable "and Common Object File Format Specification". Do they still support COFF? If they, in which OS? I thought PE completely replaced COFF long ago.

Q3。我知道PE是从COFF派生出来的。但是为什么微软的PE格式规范被命名为Microsoft Portable Executable“和Common Object File Format Specification”。他们还支持 COFF 吗？如果是，在哪个操作系统中？很久以前我以为PE完全取代了COFF。

回答by claws

I'm the OP. Every one's answer is a partial answer. So, I'm combining all the other answers with what I learnt to complete the answer.

我是 OP。每个人的答案都是部分答案。所以，我将所有其他答案与我学到的知识结合起来完成答案。

This is the "Generally" used terminology.

这是“一般”使用的术语。

• A file that is given as input to the linker (output of assembler) is called Object Fileor Relocatable File.

• The linker produces an Image file, which in turn is used as input by the loader. Now, an Image filecan either be an Executable fileor Library file. These 'Library files' are of two kinds:

  1. Static Library (*.lib files for windows. *.a for linux)
  2. Shared/Dynamic libraries : DLL( *.dll on windows) & Shared Object file( *.so in Linux)

• The term Binary File/ Binarycan be used to refer to either an ObjectFile or an ImageFile. Undestand depending up on the context. It is a very general term.

• Loader when loads the image file into memory. Then it is called Module(I'm not sure about Linux guys, but windows guys call it Module

• 作为链接器的输入（汇编器的输出）给出的文件称为Object Fileor Relocatable File。

• 链接器生成一个Image file，然后加载器将其用作输入。现在， anImage file可以是 anExecutable file或Library file。这些“库文件”有两种：

  1. 静态库（*.lib 文件用于 windows。*.a 用于 linux）
  2. 共享/动态库：DLL（Windows 上的 *.dll）& Shared Object file（Linux 上的 *.so）

• 术语Binary File/Binary可用于指代 ObjectFile 或 ImageFile。根据上下文理解。这是一个非常笼统的术语。

• 将图像文件加载到内存时的加载器。然后它被称为Module（我不确定 Linux 人，但 Windows 人称它为Module

http://www.gliffy.com/pubdoc/1978433/L.jpgalt text http://www.gliffy.com/pubdoc/1978433/L.jpg

http://www.gliffy.com/pubdoc/1978433/L.jpg替代文字 http://www.gliffy.com/pubdoc/1978433/L.jpg

As I said, these are "Generally" used terminology. There are no strict definitions for the terms 'binary file', 'image file', or 'object file'.

正如我所说，这些是“一般”使用的术语。术语“二进制文件”、“图像文件”或“目标文件”没有严格的定义。

Particularly the term 'object file' might sometimes be used to mean an intermediate file output by the compiler for use by the linker, but in another context might mean an executable file.

特别是术语“目标文件”有时可能用于表示编译器输出供链接器使用的中间文件，但在另一种上下文中可能表示可执行文件。

Especially on different platforms they might be used for refer to different or similar things. Even when discussing issues on a single platform, one writer might use the terms somewhat differently than another.

特别是在不同的平台上，它们可能用于指代不同或相似的事物。即使在单个平台上讨论问题时，一位作者使用的术语也可能与另一位有所不同。

• Both ObjectFile & ImageFile are in PE Format in windows & ELF format in linux.
• ELF is not only the format of the image file but is also the format of the object file.
• Every ELF file starts with an ELF Header. The second field of an ELF Header is e_type; this fields lets us know whether the file is an object file (aka a relocatable in ELF parlance), or an image (which can be either an executable or a shared object) or something else (core file's are also ELF files).
• I don't know if there is any bit in header that differentiates an Object file from Image file. It needs to be checked.

• ObjectFile 和 ImageFile 在 windows 中都是 PE 格式，在 linux 中是 ELF 格式。
• ELF 不仅是图像文件的格式，也是目标文件的格式。
• 每个 ELF 文件都以 ELF Header 开头。ELF 标头的第二个字段是e_type; 这个字段让我们知道文件是目标文件（也就是 ELF 说法中的可重定位文件），还是图像（可以是可执行文件或共享对象）或其他东西（核心文件也是 ELF 文件）。
• 我不知道标题中是否有任何位区分对象文件和图像文件。它需要检查。

I know that PE is derived from COFF. But why does the Microsoft specifications of PE format is named Microsoft Portable Executable "and Common Object File Format Specification". Do they still support COFF? If they, in which OS? I thought PE completely replaced COFF long ago.

我知道PE是从COFF派生出来的。但是为什么微软的PE格式规范被命名为Microsoft Portable Executable“和Common Object File Format Specification”。他们还支持 COFF 吗？如果是，在哪个操作系统中？很久以前我以为PE完全取代了COFF。

As far as "PE" vs "COFF", my recollection is that Microsoft use the "COFF" specification as the starting point for the "PE" specification but extended it for their needs. So strictly speaking a "PE" file isn't a "COFF" file, but it's very similar in many ways.

至于“PE”与“COFF”，我记得微软使用“COFF”规范作为“PE”规范的起点，但根据他们的需要对其进行了扩展。所以严格来说“PE”文件不是“COFF”文件，但它在很多方面都非常相似。

回答by Michael Burr

There are no strict definitions for the terms 'binary file', 'image file', or 'object file'.

术语“二进制文件”、“图像文件”或“目标文件”没有严格的定义。

Particularly the term 'object file' might sometimes be used to mean an intermediate file output by the compiler for use by the linker, but in another context might mean an executable file.

特别是术语“目标文件”有时可能用于表示编译器输出供链接器使用的中间文件，但在另一种上下文中可能表示可执行文件。

Especially on different platforms they might be used for refer to different or similar things. Even when discussing issues on a single platform, one writer might use the terms somewhat differently than another.

特别是在不同的平台上，它们可能用于指代不同或相似的事物。即使在单个平台上讨论问题时，一位作者使用的术语也可能与另一位有所不同。

As far as "PE" vs "COFF", my recollection is that Microsoft use the "COFF" specification as the starting point for the "PE" specification but extended it for their needs. So strictly speaking a "PE" file isn't a "COFF" file, but it's very similar in many ways.

至于“PE”与“COFF”，我记得微软使用“COFF”规范作为“PE”规范的起点，但根据他们的需要对其进行了扩展。所以严格来说“PE”文件不是“COFF”文件，但它在很多方面都非常相似。

回答by Justin Smith

gcc -c will produce a .o file, which is an elf format object file, on a Linux system. "ELF 32-bit LSB relocatable, Intel 80386, version 1 (SYSV)" is how a .o file is described by the file command on my machine.

gcc -c 将在 Linux 系统上生成一个 .o 文件，它是一个 elf 格式的目标文件。“ELF 32 位 LSB 可重定位，英特尔 80386，版本 1 (SYSV)”是我机器上的 file 命令描述 .o 文件的方式。

回答by R Samuel Klatchko

In regards to Q2 for ELF, ELF is not only the format of the image file but is alsothe format of the object file.

在问候Q2为ELF，ELF不仅是图像文件的格式，但也将目标文件的格式。

Every ELF file starts with an ELF Header. The second field of an ELF Header is e_type; this fields lets us know whether the file is an object file (aka a relocatable in ELF parlance), an image (which can be either an executable or a shared object) or something else (core file's are also ELF files).

每个 ELF 文件都以ELF Header 开头。ELF 标头的第二个字段是e_type; 这个字段让我们知道文件是目标文件（也就是 ELF 说法中的可重定位文件）、映像（可以是可执行文件或共享对象）或其他东西（核心文件也是 ELF 文件）。

回答by user281446

As an aside, I know core dumps on Solaris (and I am guessing other Unix flavors) can be in ELF format.

顺便说一句，我知道 Solaris 上的核心转储（我猜其他 Unix 风格）可以采用 ELF 格式。