READELF(1)

📦
version 2.47 · 6 versions
, in ubuntu stonking

🌸 NAME 🌸

okay so bestie, welcome to the readelf page — it's the GNU Development Tools one, section 1, a real command-line girly. And what does she do? She displays information about ELF files. That's it. That's the whole job. 💅

✨ SYNOPSIS ✨

like, here's how you call her:

readelf [-a|--all]
        [-h|--file-header]
        [-l|--program-headers|--segments]
        [-S|--section-headers|--sections]
        [-g|--section-groups]
        [-t|--section-details]
        [-e|--headers]
        [-s|--syms|--symbols]
        [--dyn-syms|--lto-syms]
        [--sym-base=[0|8|10|16]]
        [--demangle=style|--no-demangle]
        [--quiet]
        [--recurse-limit|--no-recurse-limit]
        [-U method|--unicode=method]
        [-X|--extra-sym-info|--no-extra-sym-info]
        [-n|--notes]
        [-r|--relocs]
        [-u|--unwind]
        [-d|--dynamic]
        [-V|--version-info]
        [-A|--arch-specific]
        [-D|--use-dynamic]
        [-L|--lint|--enable-checks]
        [-x <number or name>|--hex-dump=<number or name>]
        [-p <number or name>|--string-dump=<number or name>]
        [-R <number or name>|--relocated-dump=<number or name>]
        [-j <number or name>|--display-section=<number or name>]
        [-z|--decompress]
        [-c|--archive-index]
        [-w|--debug-dump]
        [-wa|--debug-dump=abbrev]
        [-wA|--debug-dump=addr]
        [-wr|--debug-dump=aranges]
        [-wc|--debug-dump=cu_index]
        [-wL|--debug-dump=decodedline]
        [-wf|--debug-dump=frames]
        [-wF|--debug-dump=frames-interp]
        [-wg|--debug-dump=gdb_index]
        [-wi|--debug-dump=info]
        [-wk|--debug-dump=links]
        [-wo|--debug-dump=loc]
        [-wm|--debug-dump=macro]
        [-wp|--debug-dump=pubnames]
        [-wt|--debug-dump=pubtypes]
        [-wR|--debug-dump=Ranges]
        [-wl|--debug-dump=rawline]
        [-ws|--debug-dump=str]
        [-wO|--debug-dump=str-offsets]
        [-wu|--debug-dump=trace_abbrev]
        [-wT|--debug-dump=trace_aranges]
        [-wU|--debug-dump=trace_info]
        [-wK|--debug-dump=follow-links]
        [-wN|--debug-dump=no-follow-links]
        [-wD|--debug-dump=use-debuginfod]
        [-wE|--debug-dump=do-not-use-debuginfod]
        [--debug-dir=dir]
        [-P|--process-links]
        [--dwarf-depth=n]
        [--dwarf-start=n]
        [--ctf=section]
        [--ctf-parent=section]
        [--ctf-symbols=section]
        [--ctf-strings=section]
        [--sframe=section]
        [-I|--histogram]
        [--got-contents]
        [-v|--version]
        [-W|--wide]
        [-T|--silent-truncation]
        [-H|--help]
        elffile...

she's got options for days, fr fr. 👑

💖 DESCRIPTION 💖

So readelf displays information about one or more ELF format object files. The options control what particular information to display — basically you pick your vibe and she serves exactly that info. ✨

The elffile... bits are the object files to be examined. 32-bit and 64-bit ELF files are both supported, and so are archives containing ELF files. She's inclusive like that. 🫶

Now, this program performs a similar function to objdump, but bestie she goes into more detail and she exists independently of the BFD library. So if there's a bug in BFD? readelf will not be affected. She doesn't share a brain with BFD, she's her own girl. 💅 lowkey iconic.

🎀 OPTIONS 🎀

The long and short forms of options, shown here as alternatives, are equivalent — so pick whichever one your fingers feel like typing. And at least one option besides -v or -H must be given, no cap. Just showing up with nothing is not the move. 🙈

  • -a, --all — the everything shower option. 🚿 Equivalent to specifying --file-header, --program-headers, --sections, --symbols, --relocs, --dynamic, --notes, --got-contents, --version-info, --arch-specific, --unwind, --section-groups and --histogram.
⚠️ note — this option does not enable --use-dynamic itself, so if that option is not present on the command line then dynamic symbols and dynamic relocs will not be displayed. Sneaky little detail, don't get caught out bestie. 💀
  • -h, --file-header — Displays the information contained in the ELF header at the start of the file. The little opening number. 🎬
  • -l, --program-headers, --segments — Displays the information contained in the file's segment headers, if it has any.
  • --quiet — Suppress the "no symbols" diagnostic. She just stops complaining about it. 🤫
  • -S, --sections, --section-headers — Displays the information contained in the file's section headers, if it has any.
  • -g, --section-groups — Displays the information contained in the file's section groups, if it has any.
  • -t, --section-details — Displays the detailed section information. Implies -S. Girl comes with a plus-one. ✨
  • -s, --symbols, --syms — Displays the entries in the symbol table section of the file, if it has one. If a symbol has version information associated with it then this is displayed as well. The version string is displayed as a suffix to the symbol name, preceded by an @ character — for example foo@VER_1. If the version is the default version to be used when resolving unversioned references to the symbol, then it's displayed as a suffix preceded by two @ characters — for example foo@@VER_2. One @ for a vibe, two @@ for the main character. 👑
  • --dyn-syms — Displays the entries in the dynamic symbol table section of the file, if it has one. The output format is the same as the format used by the --syms option.
  • --lto-syms — Displays the contents of any LTO symbol tables in the file.
  • --sym-base=[0|8|10|16] — Forces the size field of the symbol table to use the given base. Any unrecognized options will be treated as 0. So here's the tea: --sym-base=0 represents the default and legacy behaviour — this will output sizes as decimal for numbers less than 100000, and for sizes 100000 and greater hexadecimal notation will be used with a 0x prefix. --sym-base=8 will give the symbol sizes in octal. --sym-base=10 will always give the symbol sizes in decimal. --sym-base=16 will always give the symbol sizes in hexadecimal with a 0x prefix. Pick your numeral system, bestie, there's one for every mood. 🔢
  • -C, --demangle[=style] — Decode (demangle) low-level symbol names into user-level names. This makes C++ function names readable, which, thank god. 😭 Different compilers have different mangling styles. The optional demangling style argument can be used to choose an appropriate demangling style for your compiler.
  • --no-demangle — Do not demangle low-level symbol names. This is the default. She leaves the names as they are unless you ask nicely.
  • --recurse-limit, --no-recurse-limit, --recursion-limit, --no-recursion-limit — Enables or disables a limit on the amount of recursion performed whilst demangling strings. Here's why this matters: since the name mangling formats allow for an infinite level of recursion, it is possible to create strings whose decoding will exhaust the amount of stack space available on the host machine, triggering a memory fault. 💀 The limit tries to prevent this from happening by restricting recursion to 2048 levels of nesting.

The default is for this limit to be enabled, but disabling it may be necessary in order to demangle truly complicated names. Note however that if the recursion limit is disabled then stack exhaustion is possible and any bug reports about such an event will be rejected. So like… you were warned. 🙈

  • -U [d|i|l|e|x|h], --unicode=[default|invalid|locale|escape|hex|highlight] — Controls the display of non-ASCII characters in identifier names. The default (--unicode=locale or --unicode=default) is to treat them as multibyte characters and display them in the current locale. All other versions of this option treat the bytes as UTF-8 encoded values and attempt to interpret them. If they cannot be interpreted, or if the --unicode=invalid option is used, then they are displayed as a sequence of hex bytes, enclosed in curly parenthesis characters.

Using the --unicode=escape option will display the characters as unicode escape sequences (\uxxxx). Using the --unicode=hex will display the characters as hex byte sequences enclosed between angle brackets. ⭐

Using the --unicode=highlight will display the characters as unicode escape sequences but it will also highlight them in red, assuming that colouring is supported by the output device. The colouring is intended to draw attention to the presence of unicode sequences when they might not be expected — like a lil "bestie, look at THIS" moment. 🚨

  • -X, --extra-sym-info — When displaying details of symbols, include extra information not normally presented. Currently this just adds the name of the section referenced by the symbol's index field, if there is one. In the future more information may be displayed when this option is enabled. 🌈

Enabling this option effectively enables the --wide option as well, at least when displaying symbol information. Package deal, no extra charge.

  • --no-extra-sym-info — Disables the effect of the --extra-sym-info option. This is the default.
  • -e, --headers — Display all the headers in the file. Equivalent to -h -l -S. The whole header situation, at once. 💅
  • -n, --notes — Displays the contents of the NOTE segments and/or sections, if any.
  • -r, --relocs — Displays the contents of the file's relocation section, if it has one.
  • -u, --unwind — Displays the contents of the file's unwind section, if it has one. Heads up: only the unwind sections for IA64 ELF files, as well as ARM unwind tables (".ARM.exidx" / ".ARM.extab") are currently supported. If support is not yet implemented for your architecture, you could try dumping the contents of the .eh_frames section using the --debug-dump=frames or --debug-dump=frames-interp options. 🧚 adaptation era
  • -d, --dynamic — Displays the contents of the file's dynamic section, if it has one.
  • -V, --version-info — Displays the contents of the version sections in the file, if they exist.
  • -A, --arch-specific — Displays architecture-specific information in the file, if there is any.
  • -D, --use-dynamic — When displaying symbols, this option makes readelf use the symbol hash tables in the file's dynamic section, rather than the symbol table sections.

When displaying relocations, this option makes readelf display the dynamic relocations rather than the static relocations. Two completely different girls, don't mix them up. 🙅

  • -L, --lint, --enable-checks — Displays warning messages about possible problems with the file(s) being examined. If used on its own then all of the contents of the file(s) will be examined. If used with one of the dumping options, then the warning messages will only be produced for the things being displayed. She's the friend who tells you the truth, and she scopes it to whatever you actually asked about. 🫶
  • -x <number or name>, --hex-dump=<number or name> — shows you the contents of the section you point at, as raw hexadecimal bytes ✨. A number means "grab me the section at this index in the section table", and literally any other string means "grab me every section in the object file with that name". You can stack this one as many times as you want on the command line, so go off — request all the hex dumps your little heart desires 💅.
  • -R <number or name>, --relocated-dump=<number or name> — same vibe as above, contents of the section in hexadecimal bytes, number = index in the section table, any other string = all sections with that name in the object file. But — and this is the whole point — the contents get relocated before they're displayed 🔥. Repeatable as many times as you like for multiple relocated dumps.
  • -p <number or name>, --string-dump=<number or name> — dumps the section as printable strings instead of hex, bestie 🎀. number picks a section by index in the section table, any other string picks every section with that name in the object file. Also repeatable, so stack away for multiple string dumps.
  • -j <number or name>, --display-section — displays the contents of the section according to its section header type, iykyk. Sections holding relocations get shown as if you'd used --relocations, sections holding symbols get shown as if you'd used --syms, and so on down the line. A number picks a particular section by index in the section table; any other string picks all sections with that name in the input file(s). Repeatable too — multiple section dumps, multiple times, no problem 🦋.
  • -z, --decompress — asks that whatever section(s) you're dumping with x, R or p get decompressed before they hit your screen 💖. And if they weren't compressed in the first place? They just display as is, no drama.
  • -c, --archive-index — shows the file symbol index info sitting in the header part of binary archives. Does the exact same job as the t command to ar, except it does it without the BFD library. iconic behavior honestly 👑.
  • -w[lLiaprmfFsOoRtUuTgAckK], --debug-dump[=rawline,=decodedline,=info,=abbrev,=pubnames,=aranges,=macro,=frames,=frames-interp,=str,=str-offsets,=loc,=Ranges,=pubtypes,=trace_info,=trace_abbrev,=trace_aranges,=gdb_index,=addr,=cu_index,=links,=follow-links] — displays the contents of the DWARF debug sections in the file, if any are even present 🙈. Compressed debug sections get automatically (and temporarily) decompressed before they show up. If you tack one or more of the optional letters or words onto the switch, then only those type(s) of data get dumped. Here's what all the letters and words mean, no gatekeeping:
    • a, =abbrev — displays the contents of the .debug_abbrev section.
    • A, =addr — displays the contents of the .debug_addr section.
    • c, =cu_index — displays the contents of the .debug_cu_index and/or .debug_tu_index sections.
    • f, =frames — display the raw contents of a .debug_frame section.
    • F, =frames-interp — display the interpreted contents of a .debug_frame section.
    • g, =gdb_index — displays the contents of the .gdb_index and/or .debug_names sections.
    • i, =info — displays the contents of the .debug_info section. Note: you can also restrict this output by using the --dwarf-depth and --dwarf-start options, bestie.
    • k, =links — displays the contents of the .gnu_debuglink, .gnu_debugaltlink and .debug_sup sections, if any of them are around. It also shows any links to separate dwarf object files (dwo) when they're specified by the DW_AT_GNU_dwo_name or DW_AT_dwo_name attributes in the .debug_info section.
    • K, =follow-links — display the contents of any selected debug sections found in linked, separate debug info file(s). Heads up: this can end up showing you multiple versions of the same debug section if it lives in more than one file 👀.

On top of that, when displaying DWARF attributes, if a form is found that references the separate debug info file, then the referenced contents get displayed too.

Note — on some distributions this option is enabled by default. You can turn it off via the N debug option. The default gets chosen when configuring the binutils, using the --enable-follow-debug-links=yes or --enable-follow-debug-links=no options. If neither of those is used, then the default is to enable the following of debug links.

Note — if support for the debuginfod protocol was enabled when the binutils were built, then this option will also include an attempt to contact any debuginfod servers mentioned in the DEBUGINFOD_URLS environment variable. That could take a minute (or a while) to resolve ⏳. You can disable this behaviour via the =do-not-use-debuginfod debug option.

  • N, =no-follow-links — disables the following of links to separate debug info files. Bye 👋.
  • D, =use-debuginfod — enables contacting debuginfod servers when there's a need to follow debug links. This is the default behaviour.
  • E, =do-not-use-debuginfod — disables contacting debuginfod servers when there's a need to follow debug links.
  • l, =rawline — displays the contents of the .debug_line section in a raw format.
  • L, =decodedline — displays the interpreted contents of the .debug_line section.
  • m, =macro — displays the contents of the .debug_macro and/or .debug_macinfo sections.
  • o, =loc — displays the contents of the .debug_loc and/or .debug_loclists sections.
  • O, =str-offsets — displays the contents of the .debug_str_offsets section.
  • p, =pubnames — displays the contents of the .debug_pubnames and/or .debug_gnu_pubnames sections.
  • r, =aranges — displays the contents of the .debug_aranges section.
  • R, =Ranges — displays the contents of the .debug_ranges and/or .debug_rnglists sections.
  • s, =str — displays the contents of the .debug_str, .debug_line_str and/or .debug_str_offsets sections.
  • t, =pubtype — displays the contents of the .debug_pubtypes and/or .debug_gnu_pubtypes sections.
  • T, =trace_aranges — displays the contents of the .trace_aranges section.
  • u, =trace_abbrev — displays the contents of the .trace_abbrev section.
  • U, =trace_info — displays the contents of the .trace_info section.
Note: displaying the contents of .debug_static_funcs, .debug_static_vars and debug_weaknames sections is not currently supported. sad 😭
  • --dwarf-depth=n — limits the dump of the .debug_info section to n children. Only useful with --debug-dump=info, just so you know. The default is to print all DIEs, and the special value 0 for n does that too.

With a non-zero value for n, DIEs at or deeper than n levels will not be printed. And the range for n is zero-based — stay woke 🧚.

  • --dwarf-start=n — prints only DIEs beginning with the DIE numbered n. Again, only useful with --debug-dump=info.

If you specify it, this option suppresses printing of any header information and all DIEs before the DIE numbered n. Only siblings and children of the specified DIE get printed.

You can absolutely use this in conjunction with --dwarf-depth. power couple fr fr 💜

  • --debug-dir=dir — search dir when looking for separate debug info files.
  • -P, --process-links — displays the contents of non-debug sections found in separate debuginfo files that are linked to the main file. Fair warning: this option automatically implies the -wK option, and only sections requested by other command line options will be displayed. So it's not gonna dump everything, just the stuff you asked for ✨.
  • --ctf[=section] — displays the contents of the specified CTF section. CTF sections are little matryoshka dolls of their own: they contain many subsections, and all of them get displayed in order 🎀.

By default it displays the name of the section named .ctf, which is the name emitted by ld.

  • --ctf-parent=member — if the CTF section contains ambiguously-defined types, it'll consist of an archive of many CTF dictionaries, all inheriting from one dictionary that holds the unambiguous types. That member is by default named .ctf, just like the section containing it, but it's possible to change this name using the ctf_link_set_memb_name_changer function at link time. So when you're looking at CTF archives created by a linker that used the name changer to rename the parent archive member, --ctf-parent lets you specify the name used for the parent 💅.
  • --ctf-parent-section=section — this one lets you pick a completely different section for the CTF parent dictionary (the one with the unambiguous types) than for the child dictionaries (the ones with the ambiguous remainder). The linker does not emit ELF objects structured like this, but some third-party linkers may. It's also convenient for inspecting CTF written out as multiple raw files to compose them with objcopy, which can put them in different ELF sections but not in different members of a single CTF dict. wild, but okay 🦋.
  • --ctf-symbols=section
  • --ctf-strings=section — specify the name of another section from which the CTF file can inherit strings and symbols. By default, the .symtab and its linked string table are used.

If either --ctf-symbols or --ctf-strings is specified, the other must be specified as well. no skipping, bestie 🙅‍♀️.

  • --got-contents — displays the contents of the file's Global Offset Table (GOT) sections, if it has any. For MIPS, this option is similar to --arch-specific, but it only displays the GOT-related contents, and it gets ignored when --arch-specific is used.
  • -I, --histogram — display a histogram of bucket list lengths when displaying the contents of the symbol tables. cute little bar chart energy 📊✨.
  • -v, --version — spills the tea on which version of readelf you're running. version check slay ✨
  • -W, --wide — do NOT let the output get chopped up to squeeze into 80 columns bestie. By default readelf breaks section header and segment listing lines for 64-bit ELF files so they fit inside 80 columns, and honestly? tragic. This option makes readelf print each section header resp. each segment on a single line, which is sooo much more readable on terminals wider than 80 columns. 💅
  • -T, --silent-truncation — okay so normally, when readelf is displaying a symbol name and it has to truncate that name to fit into an 80 column display, it slaps a little suffix of "[...]" on the end. 🙈 This command line option disables that behaviour, which means you get 5 more characters of the name on screen, and it restores the old behaviour of readelf (from before release 2.35). vintage era, no cap.
  • -H, --help — shows you all the command-line options readelf understands. your lil cheat sheet, your bestie's notes 🫶
  • @file — reads command-line options straight out of file. The options it reads get inserted *in place of the original @file* option. But listen: if file doesn't exist, or can't be read, then the option is treated literally and not removed. it just sits there. 💀

Options in file are separated by whitespace. Wanna sneak a whitespace character into an option? Just surround the entire option in either single or double quotes. Want any character (including a backslash!) in there? Prefix it with a backslash. And plot twist — the file itself may contain additional @file options, and any such options will be processed recursively. it's giving inception. 🌀

🌈 SEE ALSO 🌈

  • objdump(1), and the Info entries for binutils. go read those too, they're iconic 👑

Copyright (c) 1991-2026 Free Software Foundation, Inc.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover Texts, and with no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License".

and that's the whole page bestie, we ate 🍓 this was binutils-2.47, dated 2026-09-12, and it's the READELF(1) manual — periodt ✨🦋🎀

📦 where this page comes from