private void determineHeaderEndianness() throws ElfException, IOException {

		if (provider.length() < INITIAL_READ_LEN) {
			throw new ElfException("Not enough bytes to be a valid ELF executable.");
		}

		hasLittleEndianHeaders = true;
		byte[] bytes = provider.readBytes(0, INITIAL_READ_LEN);
		if (bytes[ElfConstants.EI_DATA] == ElfConstants.ELF_DATA_BE) {
			hasLittleEndianHeaders = false;
		}
		else if (bytes[ElfConstants.EI_DATA] != ElfConstants.ELF_DATA_LE) {
			errorConsumer.accept("Invalid EI_DATA, assuming little-endian headers (EI_DATA=0x" +
				Integer.toHexString(bytes[ElfConstants.EI_DATA]) + ")");
		}
		if (!hasLittleEndianHeaders && bytes[ElfConstants.EI_NIDENT] != 0) {
			// Header endianness sanity check
			// Some toolchains always use little endian Elf Headers

			// TODO: unsure if forced endianness applies to relocation data

			// Check first byte of version (allow switch if equal 1)
			if (bytes[ElfConstants.EI_NIDENT + 4] == 1) {
				hasLittleEndianHeaders = true;
			}
		}
	}
Some elfs can get pre-linked to an OS.
    At the very end a "PRE " string is appended with the image base load address
    set.  Try there if none of the images told us where to load.
@return -1 - if the imagebase is not a pre-link image base.
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/elf/ElfHeader.java