The ELF Atlas · live & verified
Real artifacts, real bytes, made narratable.
A trivial program becomes the narrative thread through the whole invisible
machine — not toy diagrams, not raw internals, but the rare middle: one real
hello binary dissected byte by byte, where every beautiful claim has a
trapdoor down to evidence.
What it is
A canonical artifact, a finite state grammar over it, and validated narration — readable as a story, drivable as an instrument, honest by construction.
The Atlas is the instrument — the interactive ELF viewer. A Room is one real binary you explore in it. An Exhibit is a curated, narrated story an agent can author from a room.
One committed, byte-canonical 16,984-byte PIE, dissected completely — every header, section, table, and padding gap in a coverage partition a checker enforces. Two acts: the file on disk, and the ribbons that show what the loader does with it.
Point your Claude, Codex, or claude.ai connector at one authless MCP URL and it becomes a docent — reading the same real bytes, byte-verbatim from a pinned glibc.
The docent points by moving the camera, not by describing. And play_step is
strict: a caption citing an out-of-range offset is rejected verbatim, no beat recorded.
Verification, not eyeballs
Honesty here is not a promise; it is enforced by machines. The figures below are all real, all checkable against committed bytes.
The rooms
Each room is a real binary, dissected to the byte and opened in the Atlas. Explore one yourself — or point an agent at it.
helloA 16,984-byte hello — every header, section, and padding gap accounted for, with
source-mapped disassembly down to the call puts@plt.
/usr/bin/trueA real, stripped distro binary: 43,248 bytes, no .plt, 46 libc imports bound eagerly.
The program that does nothing, exactly as it ships.
hello: debug vs releaseThe same hello.c, two builds in one view. Click a section in either panel to inspect
it in both — the debug build maps its .text to source; the release build can’t.
/usr/bin/true, made legibleThe coreutils source rebuilt with symbols: 5,404 instructions mapping back to
true.c and the gnulib scaffolding that makes it a model GNU command.
A conversable book
An exhibit is a curated, narrated story over a room. A tour is not a video — it is data:
{title, steps:[{state, caption, highlights}]}, validated and replayable. Each of
these opens a scrollytelling story over the real bytes.
main calls putsFollow the call 1030 <puts@plt> out of .text, through the
PLT stub and GOT, into the real libc body.
execve to mainThe loader builds a world: mappings, relocation, and the handoff that finally lands on the program’s first instruction.
Read the exhibit →exit and __cxa_finalizeThe at-exit teardown dance — how a process returns 0 cleanly, traced to the
glibc source lines that do it.
hello: debug vs releaseStrip and optimize the same hello.c and the file shrinks while the
.text grows. What did stripping actually take away?
/usr/bin/true, made legibleRebuilt with symbols, true.c is just 32 of 1,693 instruction ranges — the rest
is gnulib. The “model GNU command” scaffolding, named by source file.
The instrument
One small Cloudflare Worker is the entire backend — authless for readers, edge-served from every PoP, sized to stay inside the free tier. A single MCP endpoint spans two things that don’t exist elsewhere:
call from the
room straight into the real libc body and narrate the whole path as one story.Reproducible by construction
Every disassembly row, build-id, and source line is pinned to one exact userland — and that userland is frozen. The freeze ships in two shapes because two jobs need two things: a container reproduces builds and fixtures perfectly (they only touch userland), while a pinned-kernel Azure VM does the instruction tracing a container cannot.
perf, eBPF read facilities a
container borrows from the host; the frozen VM owns its own.prove.sh has already regenerated the
committed archive: 402/402 stage-0 rows byte-identical.What gets built next
More territory, and deeper medium — at once. The cathedral was never the point; the point was that each room be real.
execve, mappings, relocation in motion, the PLT resolving puts live.write(1, "hello, world\n", 13) crossing the boundary.