The ELF Atlas — /usr/bin/true

/usr/bin/true

Two pictures of the same bytes: the file on disk, and what the loader maps into memory. Hover to connect them; click any block to inspect its real fields, bytes, and code. Press ? or click Help for the full guide.

The file offset 0 → 0xa8f0

Segment mappings PT_LOAD · file → memory

Memory vaddr 0 → 0xa280 (PIE)

How to read this exhibit

The scene

Left: the file's bytes in order, offset 0 at the top. Right: the memory image the loader builds. Ribbons tie each load segment's file bytes to the address range it becomes. A slim SEG gutter beside the file column and SEGMENT chips in the memory column both mark the four PT_LOAD segments.

Views

Atlas narrows the scene to just the file column — what is in the file. Ribbons (the default) shows the full loader mapping: file, ribbons, and memory side by side. Map view gives every block a readable minimum height; True scale is strictly proportional — padding dominates, which is the point. Brackets in the memory column mark non-LOAD program headers: INTERP, RELRO, and DYNAMIC by default, and + more segments adds three more (EH_FRAME, PROPERTY, NOTE).

Inspecting

Click any block to open the inspector drawer: Fields (decoded values), Struct (array entries — step elements with the ‹ › arrows), Bytes (real hex; highlighted runs correspond to fields), Disasm (instructions with hello.c source lines interleaved), Strings. Drag the drawer's left edge to resize it — arrow keys nudge it, double-click resets to the default width.

Relationships

Blocks marked with a dot (•) reference other blocks: hover to see the arrows (section links, relocation patches, library needs); click to pin them. Dashed chips are libraries outside the file.

Segments

Hover a SEG bar or a SEGMENT chip to light up everything that travels together in one mapping. Click ⊕ examine to zoom into a segment. To zoom back out, click that same SEG bar or SEGMENT chip again, click the breadcrumb that appears, or press Esc.

The docent

The left panel offers guided tours — each step drives the scene, and terms in captions are clickable. Paste a tour JSON to play your own. The share icon downloads the current tour as a self-contained story page.

Sharing

The URL hash always encodes the exact current state — copy it to share precisely what you're looking at.