Perhaps I am misunderstanding how this works, but to my knowledge ELF binaries can either have NX protections for the stack, or not. What I am assuming is that there is a place in the binary that spells this out, but I'm not sure exactly where this information is stored.

How do you figure out the page permissions for an ELF binary from a disassembly?

  • Turns out it's in the headers, but I might leave the question up for other people who had trouble googling it like me. Serves me right for not knowing the ELF header format. Commented Mar 25, 2015 at 18:34
  • 1
    Well, you can always answer your own question.
    – Jongware
    Commented Mar 25, 2015 at 20:23
  • I will when I am eligible, unless someone answers it in a fancy way :) Commented Mar 25, 2015 at 22:02

2 Answers 2


Permissions are in the p_flags member of the program header.

       typedef struct {
           uint32_t   p_type;
           Elf32_Off  p_offset;
           Elf32_Addr p_vaddr;
           Elf32_Addr p_paddr;
           uint32_t   p_filesz;
           uint32_t   p_memsz;
           uint32_t   p_flags;
           uint32_t   p_align;
       } Elf32_Phdr;

       p_flags     This member holds a bit mask of flags relevant to the

                   PF_X   An executable segment.
                   PF_W   A writable segment.
                   PF_R   A readable segment.

                   A text segment commonly has the flags PF_X and PF_R.  A
                   data segment commonly has PF_X, PF_W and PF_R.

The ELF binaries have in them headers named "program headers". When the kernel loads up a binary into memory, it only cares about 3 types of headers. PT_LOAD indicating whether or not the content corresponding to the header needs to be loaded into memory, PT_GNU_STACK indicating whether or not the stack needs to be made executable and PT_INTERP for determining the interpreter used to execute the binary.

So yes, the kernel sets the stack as non-executable or executable depending on whether or not a program header is present in the ELF. The ELF process can later use mmap/mmap2/mprotect libc/system calls to give executable privileges to specific pages in memory.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.