64字节

typedef struct {unsigned char	e_ident[16];		/* ELF "magic number" */unsigned char	e_type[2];		/* Identifies object file type */unsigned char	e_machine[2];		/* Specifies required architecture */unsigned char	e_version[4];		/* Identifies object file version */unsigned char	e_entry[8];		/* Entry point virtual address */unsigned char	e_phoff[8];		/* Program header table file offset */unsigned char	e_shoff[8];		/* Section header table file offset */unsigned char	e_flags[4];		/* Processor-specific flags */unsigned char	e_ehsize[2];		/* ELF header size in bytes */unsigned char	e_phentsize[2];		/* Program header table entry size */unsigned char	e_phnum[2];		/* Program header table entry count */unsigned char	e_shentsize[2];		/* Section header table entry size */unsigned char	e_shnum[2];		/* Section header table entry count */unsigned char	e_shstrndx[2];		/* Section header string table index */
} Elf64_External_Ehdr;

例子

小段，从0x0024开始倒序向前Elf64_External_Ehdr 对应上图值至Type，Type之上是e_ident值

处理函数get_file_header[字节读取不分析了]

参考文章：

从零解析ELF目标文件(附源码) - 知乎

https://github.com/torvalds/linux/blob/master/include/uapi/linux/elf.h

https://www.cnblogs.com/lwyeric/p/13582112.html#program-header