About 0x00000150 vs 0x00000011: 0x00000150 means D_PAGED | DYNAMIC | HAS_SYM and 0x00000011 means HAS_SYMS | HAS_RELOC Here, (from bfd/bfd-in2.h in binutils sources) /* BFD is dynamically paged (this is like an a.out ZMAGIC file) (the linker sets this by default, but clears it for -r or -n or -N). */ #define D_PAGED /* BFD contains relocation entries. */ #define HAS_RELOC 0x1 /* BFD is a dynamic object. */ #define DYNAMIC 0x40 I believe this is a dead end. Writing "int r(void){return 0;}" to a.c and running "gcc -c -shared -fpic a.c" on my x86_64 and "objdump -x a.o", I see architecture: i386:x86-64, flags 0x00000011: HAS_RELOC, HAS_SYMS start address 0x0000000000000000 (The flags are identical) Greetings, Maxime.