ELF Header, are offset 06h and 14h duplicated?

Question

I would like to know if these 2 headers have the same meaning nor why?

From wikipedia :

offset 06h : Set to 1 for the original version of ELF.

offset 14h : Set to 1 for the original version of ELF.

reference : http://en.wikipedia.org/wiki/Executable_and_Linkable_Format

Answer 1

You may want to read a more detailed document which is likely to include the information you're looking for:

http://www.skyfree.org/linux/references/ELF_Format.pdf

The header structure

#define EINIDENT   16

typedefstruct{
    unsigned char e_ident[EINIDENT];
    Elf32_Half    e_type;
    Elf32_Half    e_machine;
    Elf32_Word    e_version;
    Elf32_Addr    e_entry;
    Elf32_Off     e_phoff;
    Elf32_Off     e_shoff;
    Elf32_Word    e_flags;
    Elf32_Half    e_ehsize;
    Elf32_Half    e_phentsize;
    Elf32_Half    e_phnum;
    Elf32_Half    e_shentsize;
    Elf32_Half    e_shnum;
    Elf32_Half    e_shstrndx;
} Elf32Ehdr;

The 2nd e_version which defines the version as 1 (i.e. "current")

e_version This member identifies the object file version.
          Name        Value    Meaning
          EV_NONE       0      Invalid version
          EV_CURRENT    1      Current version

          The value 1 signifies the original file format; extensions will
          create new versions with higher numbers. The value of EV_CURRENT,
          though given as 1 above, will change as necessary to reflect the
          current version number.

The version in the e_ident part is also EV_CURRENT, so exactly the same version:

EI_VERSION Byte e_ident[EI_VERSION] specifies the ELF header version
           number. Currently, this value must be EV_CURRENT, as
           explained above for e_version.

From what I understand, I would say that the version has not changed yet so it is still 1 in both places, but that could change in the future...