READELF(1)

📦 version 12.2.0, in nixpkgs unstable

💖 NAME 💖

okay bestie, meet readelf — the GNU Development Tools icon from manual page readelf(1) that displays information about ELF files. ✨

🦋 SYNOPSIS 🦋

       readelf [-a|--all]
               [-h|--file-header]
               [-l|--program-headers|--segments]
               [-S|--section-headers|--sections]
               [-g|--section-groups]
               [-t|--section-details]
               [-e|--headers]
               [-s|--syms|--symbols]
               [--dyn-syms]
               [-n|--notes]
               [-r|--relocs]
               [-u|--unwind]
               [-d|--dynamic]
               [-V|--version-info]
               [-A|--arch-specific]
               [-D|--use-dynamic]
               [-x <number or name>|--hex-dump=<number or name>]
               [-p <number or name>|--string-dump=<number or name>]
               [-R <number or name>|--relocated-dump=<number or name>]
               [-z|--decompress]
               [-c|--archive-index]
               [-w[lLiaprmfFsoRtUuTgAckK]|
                --debug-dump[=rawline,=decodedline,=info,=abbrev,=pubnames,=aranges,=macro,=frames,=frames-interp,=str,=loc,=Ranges,=pubtypes,=trace_info,=trace_abbrev,=trace_aranges,=gdb_index,=addr,=cu_index,=links,=follow-links]]
               [--dwarf-depth=n]
               [--dwarf-start=n]
               [-I|--histogram]
               [-v|--version]
               [-W|--wide]
               [-H|--help]
               elffile...

🌸 DESCRIPTION 🌸

readelf displays information about one or more ELF format object files. The options control what particular information to display. 💅

elffile... are the object files to be examined. Both 32-bit and 64-bit ELF files are supported, and archives containing ELF files are supported too. 🫶

This program performs a similar function to objdump but it goes into more detail and it exists independently of the BFD library, so if there is a bug in BFD then readelf will not be affected. periodt. 🔥

✨ OPTIONS ✨

okay bestie, quick heads-up before we dive in: the long forms and the short forms of these options are literally the same thing, shown here as alternatives, so -a and --all are giving the exact same energy. Pick whichever one you vibe with.

💀 the vibe check: you have to give at least one option besides -v or -H. like, just asking for the version or the help doesn't count as "doing a thing". sorry, rules are rules.
  • -a, --all — the whole entire menu, bestie. it's equivalent to specifying --file-header, --program-headers, --sections, --symbols, --relocs, --dynamic, --notes, --version-info, --arch-specific, --unwind, --section-groups and --histogram all at once. iconic, yes. BUT — note that this option does not turn on --use-dynamic by itself, so if that option isn't on your command line then the dynamic symbols and dynamic relocs simply will not be displayed. no cap, it's a whole separate switch. 🙈
  • -h, --file-header — shows you the info chillin' in the ELF header right at the start of the file. the opening credits, if you will. 🎬
  • -l, --program-headers, --segments — displays what's inside the file's segment headers, if it has any. no segments? no problem, nothing to show. 🦋
  • -S, --sections, --section-headers — displays what's inside the file's section headers, again if it has any. 💅
  • -g, --section-groups — shows the file's section groups, if there are any. group chat but for sections fr fr. 👑
  • -t, --section-details — the detailed section information. this one implies -S, so you get the sections listing too whether you asked for it or not. main character energy. ✨
  • -s, --symbols, --syms — displays the entries in the symbol table section of the file, if it has one. and if a symbol has version information attached to it, that gets shown too. the version string shows up as a suffix to the symbol name, preceded by an @ character — for example foo@VER_1. if that version is the default version to be used when resolving unversioned references to the symbol, then it's displayed as a suffix preceded by two @ characters, like foo@@VER_2. double @ = default, that's the whole tell. 🎀
  • --dyn-syms — displays the entries in the dynamic symbol table section of the file, if it has one. output format is the same as the one --syms uses, so no new layout to learn. 🫶
  • -e, --headers — displays all the headers in the file. equivalent to -h -l -S. the full header tour, no stops skipped. 🔥
  • -n, --notes — displays the contents of the NOTE segments and/or sections, if any. 📝
  • -r, --relocs — displays the contents of the file's relocation section, if it has one. 📦
  • -u, --unwind — displays the contents of the file's unwind section, if it has one. heads up though: only the unwind sections for IA64 ELF files, as well as ARM unwind tables (".ARM.exidx" / ".ARM.extab"), are currently supported. so if you rock up with some other architecture, this is not the option for you, bestie. 💀
  • -d, --dynamic — displays the contents of the file's dynamic section, if it has one. 🌈
  • -V, --version-info — displays the contents of the version sections in the file, if they exist. (yes, the original manual page really does say "it they exist" — we love a typo moment, but the meaning is clear: if they exist. 🙈) ⭐
  • -A, --arch-specific — displays architecture-specific information in the file, if there's any. 🧚
  • -D, --use-dynamic — this one's a mode-switcher, so pay attention:
    • when displaying symbols, this option makes readelf use the symbol hash tables in the file's dynamic section, rather than the symbol table sections.
    • when displaying relocations, this option makes readelf display the dynamic relocations rather than the static relocations.

two totally different behaviours, one flag. iykyk. 🔥

  • -x <number or name>, --hex-dump=<number or name> — displays the contents of the indicated section as hexadecimal bytes. a number identifies a particular section by its index in the section table; any other string identifies all sections with that name in the object file. so a number is one section, a name can be many. 💜
  • -R <number or name>, --relocated-dump=<number or name> — displays the contents of the indicated section as hexadecimal bytes, same identification rules as above: a number picks a particular section by index in the section table, any other string picks all sections with that name in the object file. the difference? the contents of the section will be relocated before they're displayed. glow-up before the reveal. ✨
  • -p <number or name>, --string-dump=<number or name> — displays the contents of the indicated section as printable strings. again: number = particular section by index in the section table, other string = all sections with that name in the object file. 🍓
  • -z, --decompress — requests that the section(s) being dumped by the x, R or p options are decompressed before being displayed. and if the section(s) aren't compressed in the first place? they're displayed as is. no drama, no error, we just show it. 🦋
  • -c, --archive-index — displays the file symbol index information contained in the header part of binary archives. does the same function as the t command to ar, but without using the BFD library. same result, different plumbing. 🔧
  • -w[lLiaprmfFsoRtUuTgAckK], --debug-dump[=rawline,=decodedline,=info,=abbrev,=pubnames,=aranges,=macro,=frames,=frames-interp,=str,=loc,=Ranges,=pubtypes,=trace_info,=trace_abbrev,=trace_aranges,=gdb_index,=addr,=cu_index,=links,=follow-links] — the big one, the DWARF dump. displays the contents of the DWARF debug sections in the file, if any are present. compressed debug sections are automatically decompressed (temporarily) before they're displayed — temporary, bestie, don't worry, they get put back. if one or more of the optional letters or words follows the switch, then only those type(s) of data get dumped. 💅

the letters and words refer to the following info:

  • "a", "=abbrev" — displays the contents of the .debug_abbrev section.
  • "A", "=addr" — displays the contents of the .debug_addr section.
  • "c", "=cu_index" — displays the contents of the .debug_cu_index and/or .debug_tu_index sections.
  • "f", "=frames" — display the raw contents of a .debug_frame section.
  • "F", "=frame-interp" — display the interpreted contents of a .debug_frame section. (raw vs interpreted, lowercase vs uppercase, that's the whole bit 👀)
  • "g", "=gdb_index" — displays the contents of the .gdb_index and/or .debug_names sections.
  • "i", "=info" — displays the contents of the .debug_info section. ⚠️ note: the output from this option can also be restricted by using the --dwarf-depth and --dwarf-start options.
  • "k", "=links" — displays the contents of the .gnu_debuglink and/or .gnu_debugaltlink sections. also displays the link to a separate dwarf object file (dwo), if one is specified by the DW_AT_GNU_dwo_name or DW_AT_dwo_name attributes in the .debug_info section. 🔗
  • "K", "=follow-links" — display the contents of any selected debug sections that are found in a linked, separate debug info file. heads up: this can result in multiple versions of the same debug section being displayed if both the main file and the separate debug info file contain sections with the same name. so no, it's not a bug, it's literally what you asked for. 🙈

in addition, when displaying DWARF attributes, if a form is found that references the separate debug info file, then the referenced contents will also be displayed. it follows the link all the way down. 🫶

  • "l", "=rawline" — displays the contents of the .debug_line section in a raw format.
  • "L", "=decodedline" — displays the interpreted contents of the .debug_line section.
  • "m", "=macro" — displays the contents of the .debug_macro and/or .debug_macinfo sections.
  • "o", "=loc" — displays the contents of the .debug_loc and/or .debug_loclists sections.
  • "p", "=pubnames" — displays the contents of the .debug_pubnames and/or .debug_gnu_pubnames sections.
  • "r", "=aranges" — displays the contents of the .debug_aranges section.
  • "R", "=Ranges" — displays the contents of the .debug_ranges and/or .debug_rnglists sections.
  • "s", "=str" — displays the contents of the .debug_str, .debug_line_str and/or .debug_str_offsets sections.
  • "t", "=pubtype" — displays the contents of the .debug_pubtypes and/or .debug_gnu_pubtypes sections.
  • "T", "=trace_aranges" — displays the contents of the .trace_aranges section.
  • "u", "=trace_abbrev" — displays the contents of the .trace_abbrev section.
  • "U", "=trace_info" — displays the contents of the .trace_info section.
💀 note: displaying the contents of .debug_static_funcs, .debug_static_vars and debug_weaknames sections is not currently supported. don't come for me, it's just not a thing yet.
  • --dwarf-depth=n — limits the dump of the ".debug_info" section to n children. only useful with --debug-dump=info. the default is to print all DIEs, and the special value 0 for n will also have that effect. with a non-zero value for n, DIEs at or deeper than n levels will not be printed. and the range for n is zero-based, so don't go testing your luck with negatives. 🎚️
  • --dwarf-start=n — print only DIEs beginning with the DIE numbered n. only useful with --debug-dump=info. if specified, this option suppresses printing of any header information and all DIEs before the DIE numbered n — only siblings and children of the specified DIE get printed. and yes, you can absolutely use it together with --dwarf-depth. combo meal. 🍔
  • -I, --histogram — displays a histogram of bucket list lengths when displaying the contents of the symbol tables. graphs! data! slay. 📊
  • -v, --version — displays the version number of readelf. and reminder: this alone does not satisfy the "at least one option besides -v or -H" rule. 😭
  • -W, --wide — tells readelf not to break output lines to fit into 80 columns. by default, readelf breaks section header and segment listing lines for 64-bit ELF files so they fit into 80 columns; this option makes readelf print each section header, respectively each segment, on a single line, which is far more readable on terminals wider than 80 columns. if your terminal is wide, bestie, use this. your eyes will thank you. 👀
  • -H, --help — displays the command line options understood by readelf. the classic "what can u even do" move. 💅
  • @file — reads command-line options from file. the options read are inserted in place of the original @file option. if file doesn't exist, or can't be read, then the option is treated literally and not removed. yep, it just sits there looking like a weird filename. 🫠

options in file are separated by whitespace. a whitespace character may be included in an option by surrounding the entire option in either single or double quotes. any character (including a backslash) may be included by prefixing the character to be included with a backslash. and — plot twist — the file may itself contain additional @file options; any such options will be processed recursively. it's @files all the way down. 🌀

🌸 SEE ALSO 🌸

objdump(1), and the Info entries for binutils. go read those too, they're the extended universe. 📚

okay bestie, legal era 💅 but honestly it's kind of iconic of them to just... let you have this:

Copyright (c) 1991-2018 Free Software Foundation, Inc.

yep, that's the whole range, 1991 all the way through 2018, no cap 🫶

so here's the vibe: permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation ✨ and the conditions are — no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. literally none. zero. the whole thing is free real estate 🌈

and if you wanna read the fine print (and honestly you should, it's giving responsible queen 👑), a copy of the license is included in the section entitled GNU Free Documentation License. it's right there, go look, i'll wait 🦋

and that's the whole page, bestie!! 🌸 this little legend comes from binutils-2.30, dated 2018-01-27 — yes she's a 2018 girlie but she still ate 💀🔥 love that for her. go forth and read some ELF files, mwah 💖🧚‍♀️🍓

📦 where this page comes from