OBJDUMP(1)
πΈ NAME πΈ
okay bestie, welcome to OBJDUMP(1), aka the GNU Development Tools page thatβs about to make object files make sense. Main character energy only π
objdump β display information from object files.
β¨ SYNOPSIS β¨
objdump [-a|--archive-headers]
[-b bfdname|--target=bfdname]
[-C|--demangle[=style] ]
[-d|--disassemble]
[-D|--disassemble-all]
[-z|--disassemble-zeroes]
[-EB|-EL|--endian={big | little }]
[-f|--file-headers]
[-F|--file-offsets]
[--file-start-context]
[-g|--debugging]
[-e|--debugging-tags]
[-h|--section-headers|--headers]
[-i|--info]
[-j section|--section=section]
[-l|--line-numbers]
[-S|--source]
[-m machine|--architecture=machine]
[-M options|--disassembler-options=options]
[-p|--private-headers]
[-P options|--private=options]
[-r|--reloc]
[-R|--dynamic-reloc]
[-s|--full-contents]
[-W[lLiaprmfFsoRtUuTgAckK]|
--dwarf[=rawline,=decodedline,=info,=abbrev,=pubnames,=aranges,=macro,=frames,=frames-interp,=str,=loc,=Ranges,=pubtypes,=trace_info,=trace_abbrev,=trace_aranges,=gdb_index,=addr,=cu_index,=links,=follow-links]
[-G|--stabs]
[-t|--syms]
[-T|--dynamic-syms]
[-x|--all-headers]
[-w|--wide]
[--start-address=address]
[--stop-address=address]
[--prefix-addresses]
[--[no-]show-raw-insn]
[--adjust-vma=offset]
[--dwarf-depth=n]
[--dwarf-start=n]
[--special-syms]
[--prefix=prefix]
[--prefix-strip=level]
[--insn-width=width]
[-V|--version]
[-H|--help]
objfile...
π¦ DESCRIPTION π¦
So objdump displays information about one or more object files. The options control what particular information gets shown, and honestly this info is mostly useful to programmers who are working on the compilation tools β not so much for programmers who just want their program to compile and work, yβknow?
The objfile... are the object files to be examined. And when you specify archives, objdump shows information on each of the member object files. Cute, thorough, obsessed π«Ά
π OPTIONS π
The long and short forms of options, shown here as alternatives, are equivalent. At least one option from the list -a,-d,-D,-e,-f,-g,-G,-h,-H,-p,-P,-r,-R,-s,-S,-t,-T,-V,-x must be given. Like, pick at least one, bestie π
-a,--archive-headerβ if any of the objfile files are archives, display the archive header information (in a format similar tols -l). Besides the information you could list withar tv,objdump -ashows the object file format of each archive member. Slay.--adjust-vma=offsetβ when dumping information, first add offset to all the section addresses. This is useful if the section addresses do not correspond to the symbol table, which can happen when putting sections at particular addresses when using a format which can not represent section addresses, such asa.out. Ngl, classic a.out behavior π-b bfdname,--target=bfdnameβ specify that the object-code format for the object files is bfdname. This option may not be necessary;objdumpcan automatically recognize many formats.
For example:
objdump -b oasys -m vax -h fu.o
displays summary information from the section headers (-h) of fu.o, which is explicitly identified (-m) as a VAX object file in the format produced by Oasys compilers. You can list the formats available with the -i option. Iconic little format check β¨
-C,--demangle[=style]β decode (demangle) low-level symbol names into user-level names. Besides removing any initial underscore prepended by the system, this makes C++ function names readable. Different compilers have different mangling styles. The optional demangling style argument can be used to choose an appropriate demangling style for your compiler. Your fave readability glow-up π-g,--debuggingβ display debugging information. This attempts to parse STABS and IEEE debugging format information stored in the file and print it out using a C like syntax. If neither of these formats are found, this option falls back on the-Woption to print any DWARF information in the file. Fallback behavior ate, fr fr π-e,--debugging-tagsβ like-g, but the information is generated in a format compatible withctagstool.-d,--disassembleβ display the assembler mnemonics for the machine instructions from objfile. This option only disassembles those sections which are expected to contain instructions. No chaotic extra sections, just the expected ones π-D,--disassemble-allβ like-d, but disassemble the contents of all sections, not just those expected to contain instructions.
This option also has a subtle effect on the disassembly of instructions in code sections. When option -d is in effect objdump will assume that any symbols present in a code section occur on the boundary between instructions and it will refuse to disassemble across such a boundary. When option -D is in effect however this assumption is suppressed. This means that it is possible for the output of -d and -D to differ if, for example, data is stored in code sections. Lowkey important π
If the target is an ARM architecture this switch also has the effect of forcing the disassembler to decode pieces of data found in code sections as if they were instructions.
--prefix-addressesβ when disassembling, print the complete address on each line. This is the older disassembly format. Vintage but valid π-EB,-EL,--endian={big|little}β specify the endianness of the object files. This only affects disassembly. This can be useful when disassembling a file format which does not describe endianness information, such as S-records. Endianness check bestie π-f,--file-headersβ display summary information from the overall header of each of the objfile files.-F,--file-offsetsβ when disassembling sections, whenever a symbol is displayed, also display the file offset of the region of data that is about to be dumped. If zeroes are being skipped, then when disassembly resumes, tell the user how many zeroes were skipped and the file offset of the location from where the disassembly resumes. When dumping sections, display the file offset of the location from where the dump starts. File offset lore, iykyk π₯--file-start-contextβ specify that when displaying interlisted source code/disassembly (assumes-S) from a file that has not yet been displayed, extend the context to the start of the file. Context from the very beginning, periodt.-h,--section-headers,--headersβ display summary information from the section headers of the object file.
File segments may be relocated to nonstandard addresses, for example by using the -Ttext, -Tdata, or -Tbss options to ld. However, some object file formats, such as a.out, do not store the starting address of the file segments. In those situations, although ld relocates the sections correctly, using objdump -h to list the file section headers cannot show the correct addresses. Instead, it shows the usual addresses, which are implicit for the target. Not me learning a.out limits again π
Note, in some cases it is possible for a section to have both the READONLY and the NOREAD attributes set. In such cases the NOREAD attribute takes precedence, but objdump will report both since the exact setting of the flag bits might be important. Flag bit accuracy is the moment π
-H,--helpβ print a summary of the options toobjdumpand exit.-i,--infoβ display a list showing all architectures and object formats available for specification with-bor-m.-j name,--section=nameβ display information only for section name. One section, main character only π-l,--line-numbersβ label the display (using debugging information) with the filename and source line numbers corresponding to the object code or relocs shown. Only useful with-d,-D, or-r.-m machine,--architecture=machineβ specify the architecture to use when disassembling object files. This can be useful when disassembling object files which do not describe architecture information, such as S-records. You can list the available architectures with the-ioption.
If the target is an ARM architecture then this switch has an additional effect. It restricts the disassembly to only those instructions supported by the architecture specified by machine. If it is necessary to use this switch because the input file does not contain any architecture information, but it is also desired to disassemble all the instructions use -marm. ARM girlies know π§
-M options,--disassembler-options=optionsβ pass target specific information to the disassembler. Only supported on some targets. If it is necessary to specify more than one disassembler option then multiple-Moptions can be used or can be placed together into a comma separated list.
For ARC:
dspcontrols the printing of DSP instructions.spfpselects the printing of FPX single precision FP instructions.dpfpselects the printing of FPX double precision FP instructions.quarkse_emselects the printing of special QuarkSE-EM instructions.fpudaselects the printing of double precision assist instructions.fpusselects the printing of FPU single precision FP instructions.fpudselects the printing of FPU souble precision FP instructions.
Additionally, one can choose to have all the immediates printed in hexadecimal using hex. By default, the short immediates are printed using the decimal representation, while the long immediate values are printed as hexadecimal. Hex mode moment β¨
cpu=... allows to enforce a particular ISA when disassembling instructions, overriding the -m value or whatever is in the ELF file. This might be useful to select ARC EM or HS ISA, because architecture is same for those and disassembler relies on private ELF header data to decide if code is for EM or HS. This option might be specified multiple times - only the latest value will be used. Valid values are same as for the assembler -mcpu=... option.
okay continuing the -M saga, bestie β we were literally mid-sentence, so let's go π
π ARM vibes
If your target is an ARM architecture, this switch lets you pick which register name set the disassembler uses.
-M reg-names-std(the default) β names exactly like ARM's own instruction set docs, except register 13 is calledsp, register 14 islr, and register 15 ispc.-M reg-names-apcsβ the name set used by the ARM Procedure Call Standard.-M reg-names-rawβ justrfollowed by the register number, no frills, no cap.
There's also two variants on the APCS naming scheme:
-M reg-names-atpcsβ ARM/Thumb Procedure Call Standard naming conventions.-M reg-names-special-atpcsβ same, but with the special register names.
(Either with the normal register names or the special ones, iykyk β¨)
Also, for ARM architectures you can force the disassembler to read every instruction as a Thumb instruction:
--disassembler-options=force-thumb
Which is lowkey iconic when you're trying to disassemble thumb code some other compiler coughed up π«Ά
π» x86 (finer-grained control, she's precise)
Some of these duplicate what -m does, but with finer grained control. You can stack multiple picks as a comma separated string.
x86-64,i386,i8086β select disassembly for that architecture.intel,attβ pick intel syntax mode vs AT&T syntax mode.amd64,intel64β pick AMD64 ISA vs Intel64 ISA.intel-mnemonic,att-mnemonicβ pick intel mnemonic mode vs AT&T mnemonic mode. > Note:intel-mnemonicimpliesintel, andatt-mnemonicimpliesatt.addr64,addr32,addr16,data32,data16β set the default address size and operand size. These get overridden ifx86-64,i386ori8086appear later in the option string. (The page says "these four" while listing five, and honestly? not my problem π« the override rule is the part that matters.)suffixβ in AT&T mode, tells the disassembler to print a mnemonic suffix even when the operands would've made it obvious anyway. She's extra, we love her.
π₯ PowerPC
For PowerPC, -M raw selects disassembly of hardware insns rather than aliases. So you'll see rlwinm instead of clrlwi, and addi instead of li. Slay.
Every -m argument for gas that selects a CPU is supported. The full roster, no cap:
403, 405, 440, 464, 476, 601, 603, 604, 620, 7400, 7410, 7450, 7455, 750cl, 821, 850, 860, a2, booke, booke32, cell, com, e200z4, e300, e500, e500mc, e500mc64, e500x2, e5500, e6500, efs, power4, power5, power6, power7, power8, power9, ppc, ppc32, ppc64, ppc64bridge, ppcps, pwr, pwr2, pwr4, pwr5, pwr5x, pwr6, pwr7, pwr8, pwr9, pwrx, titan, and vle.
32and64β modify the default or a prior CPU selection, disabling and enabling 64-bit insns respectively.altivec,any,htm,vsx, andspeβ add capabilities to a previous or later CPU selection.
β οΈ any will disassemble any opcode known to binutils, but when an opcode has two different meanings or different arguments, you may not see the disassembly you expected. Same energy if you disassemble without giving a CPU selection β a default gets chosen from info BFD gleaned from the object file headers, and the result again may not be what you expected. It's giving "trust the process" π
π MIPS
For MIPS, this option controls how instruction mnemonic names and register names get printed in disassembled instructions. Multiple picks as a comma separated string, and invalid options are just ignored (she's unbothered).
no-aliasesβ print the 'raw' instruction mnemonic instead of some pseudo instruction mnemonic. I.e. printdadduororinstead ofmove,sllinstead ofnop, etc.msaβ disassemble MSA instructions.virtβ disassemble the virtualization ASE instructions.xpaβ disassemble the eXtended Physical Address (XPA) ASE instructions.gpr-names=ABI β print GPR (general-purpose register) names as appropriate for the specified ABI. By default, GPR names are selected according to the ABI of the binary being disassembled.fpr-names=ABI β print FPR (floating-point register) names as appropriate for the specified ABI. By default, FPR numbers are printed rather than names.cp0-names=ARCH β print CP0 (system control coprocessor; coprocessor 0) register names as appropriate for the CPU or architecture specified by ARCH. By default, CP0 register names are selected according to the architecture and CPU of the binary being disassembled.hwr-names=ARCH β print HWR (hardware register, used by therdhwrinstruction) names as appropriate for the CPU or architecture specified by ARCH. By default, HWR names are selected according to the architecture and CPU of the binary being disassembled.reg-names=ABI β print GPR and FPR names as appropriate for the selected ABI.reg-names=ARCH β print CPU-specific register names (CP0 register and HWR names) as appropriate for the selected CPU or architecture.
For any of the options up there, ABI or ARCH can be given as a number to get numbers printed instead of names, for the selected types of registers. You can list the available values of ABI and ARCH with the --help option π
π¦ VAX
You can specify function entry addresses like this:
-M entry:0xf00ba
Use it multiple times to properly disassemble VAX binary files that don't contain symbol tables (ROM dumps, bestie, we've all been there). Without it, the function entry mask would be decoded as VAX instructions, which would probably lead to the rest of the function being wrongly disassembled. Not the vibe π
the rest of the options, let's keep going π§
-p,--private-headersβ print information specific to the object file format. The exact info depends on the object file format. For some object file formats, no additional information is printed at all (yes, really, she said nothing π« ).-Poptions, *--private=options* β print information specific to the object file format. The argument options is a comma separated list that depends on the format (the lists of options is displayed with the help). For XCOFF, the available options are:headeraoutsectionssymsrelocslineno,loaderexcepttypchktracebacktocldinfo
Not all object formats support this option. In particular the ELF format does not use it.
-r,--relocβ print the relocation entries of the file. If used with-dor-D, the relocations get printed interspersed with the disassembly. Cute little interleaving moment β¨-R,--dynamic-relocβ print the dynamic relocation entries of the file. Only meaningful for dynamic objects, like certain types of shared libraries. As for-r, if used with-dor-D, the relocations get printed interspersed with the disassembly.-s,--full-contentsβ display the full contents of any sections requested. By default all non-empty sections are displayed.-S,--sourceβ display source code intermixed with disassembly, if possible. Implies-d.- *
--prefix=prefix* β specify prefix to add to the absolute paths when used with-S. - *
--prefix-strip=level* β indicate how many initial directory names to strip off the hardwired absolute paths. It has no effect without--prefix=prefix. --show-raw-insnβ when disassembling instructions, print the instruction in hex as well as in symbolic form. This is the default except when--prefix-addressesis used.--no-show-raw-insnβ when disassembling instructions, do not print the instruction bytes. This is the default when--prefix-addressesis used.- *
--insn-width=width* β display width bytes on a single line when disassembling instructions. -W[lLiaprmfFsoRtUuTgAckK],--dwarf[=rawline,=decodedline,=info,=abbrev,=pubnames,=aranges,=macro,=frames,=frames-interp,=str,=loc,=Ranges,=pubtypes,=trace_info,=trace_abbrev,=trace_aranges,=gdb_index,=addr,=cu_index,=links,=follow-links]β displays the contents of the DWARF debug sections in the file, if any are present. Compressed debug sections are automatically decompressed (temporarily) before they're displayed. If one or more of the optional letters or words follows the switch, then only those type(s) of data get dumped. The letters and words refer to:a,=abbrevβ displays the contents of the.debug_abbrevsection.A,=addrβ displays the contents of the.debug_addrsection.c,=cu_indexβ displays the contents of the.debug_cu_indexand/or.debug_tu_indexsections.f,=framesβ display the raw contents of a.debug_framesection.F,=frame-interpβ display the interpreted contents of a.debug_framesection.g,=gdb_indexβ displays the contents of the.gdb_indexand/or.debug_namessections.i,=infoβ displays the contents of the.debug_infosection. > Note: the output from this option can also be restricted by the use of the--dwarf-depthand--dwarf-startoptions.k,=linksβ displays the contents of the.gnu_debuglinkand/or.gnu_debugaltlinksections. Also displays the link to a separate dwarf object file (dwo), if one is specified by theDW_AT_GNU_dwo_nameorDW_AT_dwo_nameattributes in the.debug_infosection.K,=follow-linksβ display the contents of any selected debug sections found in a linked, separate debug info file. This can result in multiple versions of the same debug section being displayed if both the main file and the separate debug info file contain sections with the same name.
In addition, when displaying DWARF attributes, if a form is found that references the separate debug info file, then the referenced contents will also be displayed too π«Ά
β tiny heads-up: in the long-option list up top it's spelled=frames-interp, but theFentry spells it=frame-interp. Copy-paste exactly whichever one your build wants β I don't make the rules π
β¦and the rest of the --debug-dump letters, no cap, here they are:
l,=rawlineβ shows you the contents of the.debug_linesection in a raw format (as-is, no interpretation, straight out the box π ).L,=decodedlineβ shows you the interpreted contents of the.debug_linesection (same section, but translated so it actually reads like something π«Ά).m,=macroβ dumps the contents of the.debug_macroand/or.debug_macinfosections.o,=locβ dumps the contents of the.debug_locand/or.debug_loclistssections.p,=pubnamesβ dumps the contents of the.debug_pubnamesand/or.debug_gnu_pubnamessections.r,=arangesβ dumps the contents of the.debug_arangessection.R,=Rangesβ dumps the contents of the.debug_rangesand/or.debug_rnglistssections. (Yes, capitalRhere and capitalRinRangesβ it's giving case-sensitive, respect it π)s,=strβ dumps the contents of the.debug_str,.debug_line_strand/or.debug_str_offsetssections.t,=pubtypeβ dumps the contents of the.debug_pubtypesand/or.debug_gnu_pubtypessections.T,=trace_arangesβ dumps the contents of the.trace_arangessection.u,=trace_abbrevβ dumps the contents of the.trace_abbrevsection.U,=trace_infoβ dumps the contents of the.trace_infosection.
β οΈ Heads up bestie: displaying the contents of.debug_static_funcs,.debug_static_varsanddebug_weaknamessections is not currently supported. Not me trying to dump those π β it just won't work.
--dwarf-depth=nβ limits the dump of the".debug_info"section tonchildren. This is only useful with--debug-dump=info. Default vibe is to print all the DIEs; the special value0fornwill also have this effect (so0= no limit, cute).
With a non-zero value for n, DIEs at or deeper than n levels will not be printed. The range for n is zero-based β so it starts counting from 0, periodt.
--dwarf-start=nβ prints only DIEs beginning with the DIE numberedn. This is only useful with--debug-dump=info.
If you specify it, this option will suppress printing of any header information and all DIEs before the DIE numbered n. Only siblings and children of the specified DIE will be printed. It's giving "skip to the good part" β¨
This can be used in conjunction with --dwarf-depth β they're besties, they work together π«Ά.
--dwarf-checkβ enables additional checks for consistency of Dwarf information. Basically the vibe check for your DWARF data π.-G,--stabsβ displays the full contents of any sections requested. Also displays the contents of the.staband.stab.indexand.stab.exclsections from an ELF file. This is only useful on systems (such as Solaris 2.0) in which".stab"debugging symbol-table entries are carried in an ELF section. In most other file formats, debugging symbol-table entries are interleaved with linkage symbols, and are visible in the--symsoutput β so like, don't come for this flag on Linux, it's just not its moment π.--start-address=addressβ starts displaying data at the specified address. This affects the output of the-d,-rand-soptions. Think of it as your "start here bestie" marker π.--stop-address=addressβ stops displaying data at the specified address. This affects the output of the-d,-rand-soptions. The "okay that's enough" marker β.-t,--symsβ prints the symbol table entries of the file. This is similar to the information provided by thenmprogram, although the display format is different. The format of the output depends upon the format of the file being dumped, but there are two main types. One looks like this:
[ 4](sec 3)(fl 0x00)(ty 0)(scl 3) (nx 1) 0x00000000 .bss
[ 6](sec 1)(fl 0x00)(ty 0)(scl 2) (nx 0) 0x00000000 fred
where the number inside the square brackets is the number of the entry in the symbol table, the sec number is the section number, the fl value are the symbol's flag bits, the ty number is the symbol's type, the scl number is the symbol's storage class and the nx value is the number of auxiliary entries associated with the symbol. The last two fields are the symbol's value and its name. Okay so that's a lot of little fields but honestly they all slay in their own way π
.
The other common output format, usually seen with ELF based files, looks like this:
00000000 l d .bss 00000000 .bss
00000000 g .text 00000000 fred
Here the first number is the symbol's value (sometimes referred to as its address). The next field is actually a set of characters and spaces indicating the flag bits that are set on the symbol β those characters are described below, keep scrolling π. Next is the section with which the symbol is associated, or *ABS* if the section is absolute (i.e. not connected with any section), or *UND* if the section is referenced in the file being dumped, but not defined there.
After the section name comes another field, a number, which for common symbols is the alignment and for other symbol is the size. Finally the symbol's name is displayed. Iconic lineup, honestly π
The flag characters are divided into 7 groups as follows:
l,g,u,!β the symbol is a local (l), global (g), unique global (u), neither global nor local (a space) or both global and local (!). A symbol can be neither local or global for a variety of reasons, e.g., because it is used for debugging, but it is probably an indication of a bug if it is ever both local and global π. Unique global symbols are a GNU extension to the standard set of ELF symbol bindings. For such a symbol the dynamic linker will make sure that in the entire process there is just one symbol with this name and type in use. One symbol to rule them all, fr fr.wβ the symbol is weak (w) or strong (a space).Cβ the symbol denotes a constructor (C) or an ordinary symbol (a space).Wβ the symbol is a warning (W) or a normal symbol (a space). A warning symbol's name is a message to be displayed if the symbol following the warning symbol is ever referenced. It's literally a little note-to-self in symbol form π.I,iβ the symbol is an indirect reference to another symbol (I), a function to be evaluated during reloc processing (i) or a normal symbol (a space).d,Dβ the symbol is a debugging symbol (d) or a dynamic symbol (D) or a normal symbol (a space).F,f,Oβ the symbol is the name of a function (F) or a file (f) or an object (O) or just a normal symbol (a space).-T,--dynamic-symsβ prints the dynamic symbol table entries of the file. This is only meaningful for dynamic objects, such as certain types of shared libraries. This is similar to the information provided by thenmprogram when given the-D(--dynamic) option.
The output format is similar to that produced by the --syms option, except that an extra field is inserted before the symbol's name, giving the version information associated with the symbol. If the version is the default version to be used when resolving unversioned references to the symbol then it's displayed as is, otherwise it's put into parentheses. Parentheses = "not the default, bestie" π«Ά.
--special-symsβ when displaying symbols, include those which the target considers to be special in some way and which would not normally be of interest to the user. Main character symbols that usually get left out of the group photo π.-V,--versionβ prints the version number ofobjdumpand exits. Short, sweet, slays, leaves immediately π¨.-x,--all-headersβ displays all available header information, including the symbol table and relocation entries. Using-xis equivalent to specifying all of-a -f -h -p -r -t. The "give me everything" option, the full Platte, obsessed π.-w,--wideβ formats some lines for output devices that have more than 80 columns. Also does not truncate symbol names when they are displayed. If your terminal is wide and you're tired of names getting cut off mid-std::__cxx11::basic_strβ¦β this is your girl π.-z,--disassemble-zeroesβ normally the disassembly output will skip blocks of zeroes. This option directs the disassembler to disassemble those blocks, just like any other data. Yes bestie, we're looking at the zeroes today. All of them. π«@fileβ read command-line options from file. The options read are inserted in place of the original@fileoption. If file does not exist, or cannot be read, then the option will be treated literally, and not removed.
Options in file are separated by whitespace. A whitespace character may be included in an option by surrounding the entire option in either single or double quotes. Any character (including a backslash) may be included by prefixing the character to be included with a backslash. The file may itself contain additional @file options; any such options will be processed recursively. It's files all the way down π β but like, in a cute way.
π SEE ALSO
nm(1)readelf(1)- and the Info entries for
binutils.
Go read those too, they're the friend group, iykyk π
π COPYRIGHT
Copyright (c) 1991-2018 Free Software Foundation, Inc.
Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover Texts, and with no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License". (Legal text but make it fashion β it means yes you can share this, just keep the license with it π)
β¨ and that's the whole page bestie β¨ This masterpiece is from binutils-2.30, dated 2018-01-27, and it's the OBJDUMP(1) manual β go forth and dump responsibly, mwah ππ¦
π¦ where this page comes from
- nixpkgs unstable: djgpp 12.2.0
- π girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on : a language model's rewrite of the original, under its terms