ELF_GETIDENT(3)

💖 elf_getident(3) 💖

okay bestie, welcome to the Libelf Programmer's Manual ✨ this one's short and sweet and honestly kinda iconic — it's the page about peeking at your ELF file's identification bytes, aka the little 16-byte vibe check at the very top of every ELF header. no cap.

---

🌸 NAME 🌸

elf_getident — return the ELF identification bytes 🦋

---

✨ SYNOPSIS ✨

#include <libelf.h>

char * elf_getident("Elf *elf", size_t *nbytes );

(yes the quotes are literally in there, we don't question it, we just vibe 💅)

---

👑 DESCRIPTION 👑

So the elf_getident() function hands you back a pointer to the 16-byte ELF identification array from the ELF header of the descriptor elf you passed in. it's giving "show me your ID" but for binaries 💳✨

That identification data starts with the magic number \177ELF and then rolls through the class, data encoding, ELF version, OS ABI, and ABI version fields. it corresponds to the first EI_NIDENT bytes of the ELF header, and you can also get at it through the e_ident field of either Elf32_Ehdr or Elf64_Ehdr. same bytes, different door 🚪✨

If elf is a valid descriptor for an ELF object, the function returns a pointer to the internal buffer holding the header's identification bytes. and listen — that buffer is owned by the library. do not modify it, do not free it, do not touch it, bestie, it is NOT yours 🙈 it's a look-don't-touch situation fr fr.

If nbytes is not NULL, the function sets it to EI_NIDENT (16) — that's the length in bytes of the returned identifier. cute, consistent, always 16. 💖

---

🎀 PARAMETERS 🎀

• elf — pointer to an Elf descriptor referring to a valid ELF object. If the descriptor does not represent an ELF object file (it's NULL, or elf_kind() is not ELF_K_ELF), NULL gets returned. no ELF, no entry 🚫
• nbytes — optional pointer to a size_t variable. If it's non-NULL, it gets set to the length of the returned buffer (always EI_NIDENT on success, 0 on failure). so on success you get 16, on failure you get 0, and them's the rules ✨

---

🔥 RETURN VALUE 🔥

Returns a pointer to the internal 16-byte e_ident buffer on success, and NULL on failure. and here's the quirky part — it does not set elf_errno. so don't go checking elf_errno expecting answers, it simply did not leave a note 💀

That buffer is indexed using the EI_CLASS, EI_DATA, EI_VERSION, EI_OSABI, and EI_ABIVERSION macros found in elf.h. also see elf(5) for the lore 📖

---

🌈 SEE ALSO 🌈

• libelf(3)
• elf(5)

---

🧚 ATTRIBUTES 🧚

• elf_getident() — Thread safety: MT-Safe — so yes, you and your besties can all call it at the same time, it's chill 🫶

---

😭 REPORTING BUGS 😭

found a bug? spill it to <elfutils-devel@sourceware.org> or drop it at https://sourceware.org/bugzilla/. we listen, we fix, we slay 🐛💅

---

okay that's the whole page!! this was brought to you by Libelf, dated 2025-06-30, and filed under ELF_GETIDENT(3) — go read your bytes, main character 👑✨🦋💜