Tiny ELF Files: Revisited in 2021
Last November, I looked into this problem a bit more thoroughly, studying all the conditions that the Linux kernel actually checks. My conclusion was that the absolute smallest possible 64-bit ELF file in Linux was 80 bytes. (The smallest 32-bit ELF file was indeed 45 bytes, as in the original article.) This version was written to simply call _exit(0), but I recall that there are a few more opcode bytes to spare:<p><pre><code>  00000000: 7f45 4c46 b0e7 0f05 0000 0000 0000 0000  .ELF............
  00000010: 0200 3e00 0000 0000 0100 0000 0100 0000  ..&gt;.............
  00000020: 1800 0000 0000 0000 1800 0000 0100 0000  ................
  00000030: 0000 0000 0000 3800 0100 0000 0000 0000  ......8.........
  00000040: 0100 0000 0000 0000 0000 0000 0000 0000  ................
</code></pre>
I wonder if this version could be modified to create a Hello World smaller than 105 bytes? Unfortunately, I can&#x27;t find where I put all my notes for this, though I did keep the snippet I used to generate it:<p><pre><code>  alignas(Elf64_Ehdr) char data[80] = {0};
  Elf64_Ehdr *elf_ex = (Elf64_Ehdr *)data;
  memcpy(elf_ex-&gt;e_ident, ELFMAG, SELFMAG);
  elf_ex-&gt;e_type = ET_EXEC;
  elf_ex-&gt;e_machine = EM_X86_64;
  elf_ex-&gt;e_entry = 0x0000000100000001;
  elf_ex-&gt;e_phoff = 24;
  elf_ex-&gt;e_phentsize = sizeof(Elf64_Phdr);
  elf_ex-&gt;e_phnum = 1;
  Elf64_Phdr *elf_ppnt = (Elf64_Phdr *)(data + 24);
  &#x2F;&#x2F; elf_ppnt-&gt;p_type = PT_LOAD;
  &#x2F;&#x2F; elf_ppnt-&gt;p_flags = PF_X;
  &#x2F;&#x2F; elf_ppnt-&gt;p_offset = 24;
  elf_ppnt-&gt;p_vaddr = 0x0000000100000018;
  &#x2F;&#x2F; elf_ppnt-&gt;p_paddr = 0x0038000000000000;
  &#x2F;&#x2F; elf_ppnt-&gt;p_filesz = 1;
  elf_ppnt-&gt;p_memsz = 1;
  &#x2F;&#x2F; elf_ppnt-&gt;p_align = 0;
  memcpy(data + 4, &quot;\260\347\17\5&quot;, 4);</code></pre>