READELF(1)

📦
version 2.47 · 15 versions
, in ubuntu stonking

💖 READELF(1) — the GNU Development Tools girlie 💖

okay bestie, listen. this is readelf, she's part of GNU Development Tools, and she is that girl. she looks inside ELF files and tells you everything. no cap.

✨ NAME ✨

readelf — display information about ELF files 🦋

🌸 SYNOPSIS 🌸

readelf [-a|--all]
        [-h|--file-header]
        [-l|--program-headers|--segments]
        [-S|--section-headers|--sections]
        [-g|--section-groups]
        [-t|--section-details]
        [-e|--headers]
        [-s|--syms|--symbols]
        [--dyn-syms|--lto-syms]
        [--sym-base=[0|8|10|16]]
        [--demangle=style|--no-demangle]
        [--quiet]
        [--recurse-limit|--no-recurse-limit]
        [-U method|--unicode=method]
        [-X|--extra-sym-info|--no-extra-sym-info]
        [-n|--notes]
        [-r|--relocs]
        [-u|--unwind]
        [-d|--dynamic]
        [-V|--version-info]
        [-A|--arch-specific]
        [-D|--use-dynamic]
        [-L|--lint|--enable-checks]
        [-x <number or name>|--hex-dump=<number or name>]
        [-p <number or name>|--string-dump=<number or name>]
        [-R <number or name>|--relocated-dump=<number or name>]
        [-j <number or name>|--display-section=<number or name>]
        [-z|--decompress]
        [-c|--archive-index]
        [-w|--debug-dump]
        [-wa|--debug-dump=abbrev]
        [-wA|--debug-dump=addr]
        [-wr|--debug-dump=aranges]
        [-wc|--debug-dump=cu_index]
        [-wL|--debug-dump=decodedline]
        [-wf|--debug-dump=frames]
        [-wF|--debug-dump=frames-interp]
        [-wg|--debug-dump=gdb_index]
        [-wi|--debug-dump=info]
        [-wk|--debug-dump=links]
        [-wo|--debug-dump=loc]
        [-wm|--debug-dump=macro]
        [-wp|--debug-dump=pubnames]
        [-wt|--debug-dump=pubtypes]
        [-wR|--debug-dump=Ranges]
        [-wl|--debug-dump=rawline]
        [-ws|--debug-dump=str]
        [-wO|--debug-dump=str-offsets]
        [-wu|--debug-dump=trace_abbrev]
        [-wT|--debug-dump=trace_aranges]
        [-wU|--debug-dump=trace_info]
        [-wK|--debug-dump=follow-links]
        [-wN|--debug-dump=no-follow-links]
        [-wD|--debug-dump=use-debuginfod]
        [-wE|--debug-dump=do-not-use-debuginfod]
        [--debug-dir=dir]
        [-P|--process-links]
        [--dwarf-depth=n]
        [--dwarf-start=n]
        [--ctf=section]
        [--ctf-parent=section]
        [--ctf-symbols=section]
        [--ctf-strings=section]
        [--sframe=section]
        [-I|--histogram]
        [--got-contents]
        [-v|--version]
        [-W|--wide]
        [-T|--silent-truncation]
        [-H|--help]
        elffile...

like, look at her. she has range. 💅

🌈 DESCRIPTION 🌈

readelf displays information about one or more ELF format object files. The options control what particular information to display. periodt.

elffile... are the object files to be examined. 32-bit and 64-bit ELF files are supported, as are archives containing ELF files. so she's versatile, she's not picky, she contains multitudes. 🫶

This program performs a similar function to objdump but it goes into more detail and it exists independently of the BFD library, so if there is a bug in BFD then readelf will not be affected. main character energy tbh — she doesn't need BFD's drama, she stands on her own. 👑

💅 OPTIONS 💅

The long and short forms of options, shown here as alternatives, are equivalent. At least one option besides -v or -H must be given. like, you gotta ask her something, she's not gonna info-dump unprompted (okay she would but still). ✨

  • -a, --all — Equivalent to specifying --file-header, --program-headers, --sections, --symbols, --relocs, --dynamic, --notes, --got-contents, --version-info, --arch-specific, --unwind, --section-groups and --histogram. it's giving "tell me EVERYTHING" and honestly? valid.
⚠️ Note — this option does not enable --use-dynamic itself, so if that option is not present on the command line then dynamic symbols and dynamic relocs will not be displayed. so if you're like "why aren't my dynsyms showing" that's why bestie, no cap. 😭
  • -h, --file-header — Displays the information contained in the ELF header at the start of the file. the little intro card at the top of the file 🎀
  • -l, --program-headers, --segments — Displays the information contained in the file's segment headers, if it has any. conditional queen. ✨
  • --quiet — Suppress "no symbols" diagnostic. sometimes you just don't need the commentary, and that's okay 🦋
  • -S, --sections, --section-headers — Displays the information contained in the file's section headers, if it has any. again: only if she has any. no fake content over here. 💖
  • -g, --section-groups — Displays the information contained in the file's section groups, if it has any.
  • -t, --section-details — Displays the detailed section information. Implies -S. she said "and while we're here, also sections." iconic. 👑
  • -s, --symbols, --syms — Displays the entries in symbol table section of the file, if it has one. If a symbol has version information associated with it then this is displayed as well. The version string is displayed as a suffix to the symbol name, preceded by an @ character. For example foo@VER_1. If the version is the default version to be used when resolving unversioned references to the symbol then it is displayed as a suffix preceded by two @ characters. For example foo@@VER_2. one @ = specific version, two @@ = the default one, iykyk 💅
  • --dyn-syms — Displays the entries in dynamic symbol table section of the file, if it has one. The output format is the same as the format used by the --syms option. same fit, different function. ✨
  • --lto-syms — Displays the contents of any LTO symbol tables in the file. LTO girlies rise 🌸
  • --sym-base=[0|8|10|16] — Forces the size field of the symbol table to use the given base. Any unrecognized options will be treated as 0. --sym-base=0 represents the default and legacy behaviour. This will output sizes as decimal for numbers less than 100000. For sizes 100000 and greater hexadecimal notation will be used with a 0x prefix. --sym-base=8 will give the symbol sizes in octal. --sym-base=10 will always give the symbol sizes in decimal. --sym-base=16 will always give the symbol sizes in hexadecimal with a 0x prefix. so 0 is the chaotic "it depends" one and everything else is committed. 💀
  • -C, --demangle[=style] — Decode (demangle) low-level symbol names into user-level names. This makes C++ function names readable. Different compilers have different mangling styles. The optional demangling style argument can be used to choose an appropriate demangling style for your compiler. untangling the alphabet soup so it actually reads like a function name 🧚
  • --no-demangle — Do not demangle low-level symbol names. This is the default. raw and unfiltered, no makeup, that's just how she wakes up. 🙈
  • --recurse-limit, --no-recurse-limit, --recursion-limit, --no-recursion-limit — Enables or disables a limit on the amount of recursion performed whilst demangling strings. Since the name mangling formats allow for an infinite level of recursion it is possible to create strings whose decoding will exhaust the amount of stack space available on the host machine, triggering a memory fault. The limit tries to prevent this from happening by restricting recursion to 2048 levels of nesting.

The default is for this limit to be enabled, but disabling it may be necessary in order to demangle truly complicated names. Note however that if the recursion limit is disabled then stack exhaustion is possible and any bug reports about such an event will be rejected. ⚠️ like bestie, if you turn off the guardrail and then faceplant, that's on you, the maintainers said so themselves. 😭

  • -U [d|i|l|e|x|h], --unicode=[default|invalid|locale|escape|hex|highlight] — Controls the display of non-ASCII characters in identifier names. The default (--unicode=locale or --unicode=default) is to treat them as multibyte characters and display them in the current locale. All other versions of this option treat the bytes as UTF-8 encoded values and attempt to interpret them. If they cannot be interpreted or if the --unicode=invalid option is used then they are displayed as a sequence of hex bytes, enclosed in curly parenthesis characters.

Using the --unicode=escape option will display the characters as unicode escape sequences (\uxxxx). Using the --unicode=hex will display the characters as hex byte sequences enclosed between angle brackets.

Using the --unicode=highlight will display the characters as unicode escape sequences but it will also highlight them in red, assuming that colouring is supported by the output device. The colouring is intended to draw attention to the presence of unicode sequences when they might not be expected. red flag but make it aesthetic 🚩✨

  • -X, --extra-sym-info — When displaying details of symbols, include extra information not normally presented. Currently this just adds the name of the section referenced by the symbol's index field, if there is one. In the future more information may be displayed when this option is enabled.

Enabling this option effectively enables the --wide option as well, at least when displaying symbol information. bonus feature unlocked 🎁

  • --no-extra-sym-info — Disables the effect of the --extra-sym-info option. This is the default. back to the standard fit. 💅
  • -e, --headers — Display all the headers in the file. Equivalent to -h -l -S. all the headers, all at once, no notes. 👑
  • -n, --notes — Displays the contents of the NOTE segments and/or sections, if any. ready for the notes app section 📝
  • -r, --relocs — Displays the contents of the file's relocation section, if it has one. moving pieces, moving pieces. 🔥
  • -u, --unwind — Displays the contents of the file's unwind section, if it has one. Only the unwind sections for IA64 ELF files, as well as ARM unwind tables (".ARM.exidx" / ".ARM.extab") are currently supported. If support is not yet implemented for your architecture you could try dumping the contents of the .eh_frames section using the --debug-dump=frames or --debug-dump=frames-interp options. so it's giving selective support, but she's honest about it 🫶
  • -d, --dynamic — Displays the contents of the file's dynamic section, if it has one. the dynamic section said let me be dramatic 💜
  • -V, --version-info — Displays the contents of the version sections in the file, if they exist. only if they exist, no ghost content. 🌸
  • -A, --arch-specific — Displays architecture-specific information in the file, if there is any. niche and proud of it. ✨
  • -D, --use-dynamic — When displaying symbols, this option makes readelf use the symbol hash tables in the file's dynamic section, rather than the symbol table sections.

When displaying relocations, this option makes readelf display the dynamic relocations rather than the static relocations. two moods, one flag. 💅

  • -L, --lint, --enable-checks — Displays warning messages about possible problems with the file(s) being examined. If used on its own then all of the contents of the file(s) will be examined. If used with one of the dumping options then the warning messages will only be produced for the things being displayed. she's checking your homework, gently 🎀

okay that's the vibe so far, and we are not done. more coming. 💖

  • -x number or name, --hex-dump=number or name — bestie, this one dumps the vibe of a section as raw hexadecimal bytes 💅. Give it a number and it grabs that one section by its index in the section table; give it literally any other string and it hunts down all the sections with that name in the object file. You can repeat this flag as many times as your heart desires to request multiple hex dumps. Obsessed.
  • -R number or name, --relocated-dump=number or name — same energy as above, it shows the indicated section as hexadecimal bytes, and a number means "that section by index in the section table" while any other string means "all sections with that name in the object file." The glow-up here: the contents get relocated before they're displayed ✨. Also repeatable as many times as you want for multiple relocated dumps.
  • -p number or name, --string-dump=number or name — this one's giving printable strings 🌸. Displays the indicated section's contents as printable strings. number = a particular section by index in the section table; any other string = all sections with that name in the object file. Repeatable multiple times for multiple string dumps, no cap.
  • -j number or name, --display-section — the main character of section dumping fr 🎀. It displays the indicated section's contents according to its section header type: sections with relocations show up as if you'd used --relocations, sections containing symbols show up as if you'd used --syms, and so on.

A number identifies a particular section by index in the section table; any other string identifies all sections with that name in the input file(s).

Repeatable multiple times on the command line for multiple section dumps. Slay.

  • -z, --decompress — politely requests that the section(s) being dumped by the x, R or p options get decompressed before they're displayed 🦋. If the section(s) aren't compressed? Then they're displayed as is. No drama, no notes.
  • -c, --archive-index — shows the file symbol index info chillin' in the header part of binary archives 📦. Does the same thing as the t command to ar, but without using the BFD library. Iconic efficiency.
  • -w[lLiaprmfFsOoRtUuTgAckK], --debug-dump[=rawline,=decodedline,=info,=abbrev,=pubnames,=aranges,=macro,=frames,=frames-interp,=str,=str-offsets,=loc,=Ranges,=pubtypes,=trace_info,=trace_abbrev,=trace_aranges,=gdb_index,=addr,=cu_index,=links,=follow-links] — okay this is the BIG one 🫶. It displays the contents of the DWARF debug sections in the file, if any are even there. Compressed debug sections get automatically decompressed (temporarily!!) before being displayed. If one or more of the optional letters or words follows the switch, then only those type(s) of data get dumped. Here's the tea on each letter and word:
    • a, =abbrev — displays the contents of the .debug_abbrev section.
    • A, =addr — displays the contents of the .debug_addr section.
    • c, =cu_index — displays the contents of the .debug_cu_index and/or .debug_tu_index sections.
    • f, =frames — display the raw contents of a .debug_frame section.
    • F, =frames-interp — display the interpreted contents of a .debug_frame section.
    • g, =gdb_index — displays the contents of the .gdb_index and/or .debug_names sections.
    • i, =info — displays the contents of the .debug_info section. Note: the output from this option can also be restricted by using the --dwarf-depth and --dwarf-start options.
    • k, =links — displays the contents of the .gnu_debuglink, .gnu_debugaltlink and .debug_sup sections, if any of them are present. Also displays any links to separate dwarf object files (dwo), if they're specified by the DW_AT_GNU_dwo_name or DW_AT_dwo_name attributes in the .debug_info section.
    • K, =follow-links — display the contents of any selected debug sections found in linked, separate debug info file(s). Heads up: this can result in multiple versions of the same debug section being displayed if it exists in more than one file 👀.

In addition, when displaying DWARF attributes, if a form is found that references the separate debug info file, then the referenced contents will also be displayed.

Note — in some distributions this option is enabled by default. It can be disabled via the N debug option. The default can be chosen when configuring the binutils via the --enable-follow-debug-links=yes or --enable-follow-debug-links=no options. If these are not used, then the default is to enable the following of debug links.
Note — if support for the debuginfod protocol was enabled when the binutils were built, then this option will also include an attempt to contact any debuginfod servers mentioned in the DEBUGINFOD_URLS environment variable. This could take some time to resolve 😭. This behaviour can be disabled via the =do-not-use-debuginfod debug option.
  • N, =no-follow-links — disables the following of links to separate debug info files.
  • D, =use-debuginfod — enables contacting debuginfod servers if there's a need to follow debug links. This is the default behaviour.
  • E, =do-not-use-debuginfod — disables contacting debuginfod servers when there's a need to follow debug links.
  • l, =rawline — displays the contents of the .debug_line section in a raw format.
  • L, =decodedline — displays the interpreted contents of the .debug_line section.
  • m, =macro — displays the contents of the .debug_macro and/or .debug_macinfo sections.
  • o, =loc — displays the contents of the .debug_loc and/or .debug_loclists sections.
  • O, =str-offsets — displays the contents of the .debug_str_offsets section.
  • p, =pubnames — displays the contents of the .debug_pubnames and/or .debug_gnu_pubnames sections.
  • r, =aranges — displays the contents of the .debug_aranges section.
  • R, =Ranges — displays the contents of the .debug_ranges and/or .debug_rnglists sections.
  • s, =str — displays the contents of the .debug_str, .debug_line_str and/or .debug_str_offsets sections.
  • t, =pubtype — displays the contents of the .debug_pubtypes and/or .debug_gnu_pubtypes sections.
  • T, =trace_aranges — displays the contents of the .trace_aranges section.
  • u, =trace_abbrev — displays the contents of the .trace_abbrev section.
  • U, =trace_info — displays the contents of the .trace_info section.
Note: displaying the contents of .debug_static_funcs, .debug_static_vars and debug_weaknames sections is not currently supported. Sry bestie, it's simply not the moment 💀.
  • --dwarf-depth=n — limits the dump of the .debug_info section to n children 👑. This is only useful with --debug-dump=info. The default is to print all DIEs; the special value 0 for n will also have this effect.

With a non-zero value for n, DIEs at or deeper than n levels will not be printed. The range for n is zero-based.

  • --dwarf-start=n — print only DIEs beginning with the DIE numbered n ✨. This is only useful with --debug-dump=info.

If specified, this option will suppress printing of any header information and all DIEs before the DIE numbered n. Only siblings and children of the specified DIE will be printed.

This can be used in conjunction with --dwarf-depth.

  • --debug-dir=dir — search dir when looking for separate debug info files 🔍.
  • -P, --process-links — display the contents of non-debug sections found in separate debuginfo files that are linked to the main file 🫶. This option automatically implies the -wK option, and only sections requested by other command line options will be displayed.
  • --ctf[=section] — display the contents of the specified CTF section 🌈. CTF sections themselves contain many subsections, all of which are displayed in order.

By default, display the name of the section named .ctf, which is the name emitted by ld.

  • --ctf-parent=member — if the CTF section contains ambiguously-defined types, it'll consist of an archive of many CTF dictionaries, all inheriting from one dictionary containing unambiguous types 😌. This member is by default named .ctf, like the section containing it, but it's possible to change this name using the ctf_link_set_memb_name_changer function at link time. When looking at CTF archives that have been created by a linker that uses the name changer to rename the parent archive member, --ctf-parent can be used to specify the name used for the parent.
  • --ctf-parent-section=section — this option lets you pick a completely different section for the CTF parent dictionary containing unambiguous types than for the child dictionaries that contain the ambiguous remainder 💅. The linker does not emit ELF objects structured like this, but some third-party linkers may. It's also convenient to inspect CTF written out as multiple raw files to compose them with objcopy, which can put them in different ELF sections but not in different members of a single CTF dict.
  • --ctf-symbols=section, --ctf-strings=section — specify the name of another section from which the CTF file can inherit strings and symbols 🎀. By default, the .symtab and its linked string table are used.
If either of --ctf-symbols or --ctf-strings is specified, the other must be specified as well. They're a package deal, no cap.
  • --got-contents — displays the contents of the file's Global Offset Table (GOT) sections, if it has any ⭐. For MIPS, this option is similar to --arch-specific, but it only displays the GOT related contents and it is ignored when --arch-specific is used.
  • -I, --histogram — display a histogram of bucket list lengths when displaying the contents of the symbol tables 📊.
  • -v, --version — bestie, it just tells you which version of readelf you're holding 💅 that's it, that's the whole vibe.
  • -W, --wide — do NOT cram my output into 80 columns, thank you very much 🫶 by default readelf breaks section header lines and segment listing lines for 64-bit ELF files so they fit inside 80 columns, which is giving tiny screen energy. This option makes readelf print each section header — resp. each segment — on a single line, and honestly that's far more readable on terminals wider than 80 columns. periodt.
  • -T, --silent-truncation — okay so normally, when readelf is displaying a symbol name and it has to truncate that name to fit into an 80 column display, it tacks a little suffix of [...] onto the name 😭 this command line option disables that behaviour entirely, which lets you see 5 more characters of the name AND restores the old behaviour of readelf (the way it was prior to release 2.35). no more mystery dots, we love to see it ✨
  • -H, --help — shows you every command-line option readelf understands 👑 a little menu of possibilities, iconic behaviour fr fr.
  • @file — read command-line options from file 🍓 the options that get read are inserted in place of the original @file option. And if file doesn't exist, or it can't be read? Then the option is treated literally, and it is not removed. we respect the literal interpretation here 💀

Options inside file are separated by whitespace. Wanna sneak a whitespace character into an option? Just surround the entire option in either single or double quotes 🎀 and any character at all (yes, even a backslash) can be included by prefixing the character you want with a backslash. Also — plot twist — the file may itself contain additional @file options, and any such options get processed recursively. it's giving inception, it's giving turtles all the way down 🐢

🌈 SEE ALSO 🌈

objdump(1), and the Info entries for binutils 💖

go read those too, bestie, they're literally right there.

Copyright (c) 1991-2026 Free Software Foundation, Inc.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover Texts, and with no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License".

tl;dr: it's free, you can share it, remix it, whatever — just keep the license with it and don't be weird about it 🫶

and that's the whole page, bestie!! 🦋 this beauty is from binutils-2.47, dated 2026-09-05, and it lives in the manual as READELF(1) ✨ now go forth and inspect some ELF files, you gorgeous little binary whisperer you 💜🧚

📦 where this page comes from