READELF(1)

📦
version 2.44 · 7 versions
, in debian trixie

💖 READELF(1) — GNU Development Tools 💖

okay bestie, sit down, hydrate, and let me tell you about readelf — it's the GNU Development Tools girlie that displays information about ELF files. she's iconic, she's independent, she's not like other binutils ✨

🌸 NAME 🌸

readelf — display information about ELF files 🦋

✨ SYNOPSIS ✨

readelf [-a|--all]
        [-h|--file-header]
        [-l|--program-headers|--segments]
        [-S|--section-headers|--sections]
        [-g|--section-groups]
        [-t|--section-details]
        [-e|--headers]
        [-s|--syms|--symbols]
        [--dyn-syms|--lto-syms]
        [--sym-base=[0|8|10|16]]
        [--demangle=style|--no-demangle]
        [--quiet]
        [--recurse-limit|--no-recurse-limit]
        [-U method|--unicode=method]
        [-X|--extra-sym-info|--no-extra-sym-info]
        [-n|--notes]
        [-r|--relocs]
        [-u|--unwind]
        [-d|--dynamic]
        [-V|--version-info]
        [-A|--arch-specific]
        [-D|--use-dynamic]
        [-L|--lint|--enable-checks]
        [-x <number or name>|--hex-dump=<number or name>]
        [-p <number or name>|--string-dump=<number or name>]
        [-R <number or name>|--relocated-dump=<number or name>]
        [-j <number or name>|--display-section=<number or name>]
        [-z|--decompress]
        [-c|--archive-index]
        [-w[lLiaprmfFsoORtUuTgAck]|
         --debug-dump[=rawline,=decodedline,=info,=abbrev,=pubnames,=aranges,=macro,=frames,=frames-interp,=str,=str-offsets,=loc,=Ranges,=pubtypes,=trace_info,=trace_abbrev,=trace_aranges,=gdb_index,=addr,=cu_index,=links]]
        [-wK|--debug-dump=follow-links]
        [-wN|--debug-dump=no-follow-links]
        [-wD|--debug-dump=use-debuginfod]
        [-wE|--debug-dump=do-not-use-debuginfod]
        [-P|--process-links]
        [--dwarf-depth=n]
        [--dwarf-start=n]
        [--ctf=section]
        [--ctf-parent=section]
        [--ctf-symbols=section]
        [--ctf-strings=section]
        [--sframe=section]
        [-I|--histogram]
        [-v|--version]
        [-W|--wide]
        [-T|--silent-truncation]
        [-H|--help]
        elffile...

look at all those flags, she's got RANGE 💅

🫶 DESCRIPTION 🫶

so readelf displays information about one or more ELF format object files. The options control what particular information to display. like a lil menu, you pick your vibe.

elffile... are the object files to be examined. 32-bit and 64-bit ELF files are supported, as are archives containing ELF files. so she's flexible, she's inclusive, we love that 🦋

This program performs a similar function to objdump but it goes into more detail and it exists independently of the BFD library, so if there is a bug in BFD then readelf will not be affected. not me being immune to BFD's drama ✨ 💀

👑 OPTIONS 👑

The long and short forms of options, shown here as alternatives, are equivalent. At least one option besides -v or -H must be given. fr fr, you gotta actually ask her for something.

  • -a, --all — Equivalent to specifying --file-header, --program-headers, --sections, --symbols, --relocs, --dynamic, --notes, --version-info, --arch-specific, --unwind, --section-groups and --histogram. the whole entire buffet, bestie 🍓
Note — this option does not enable --use-dynamic itself, so if that option is not present on the command line then dynamic symbols and dynamic relocs will not be displayed. she said no freebies 💅
  • -h, --file-header — Displays the information contained in the ELF header at the start of the file. the lil intro card of the file ✨
  • -l, --program-headers, --segments — Displays the information contained in the file's segment headers, if it has any. conditional queen 🎀
  • --quiet — Suppress "no symbols" diagnostic. shhh, no negativity in this household 🤫
  • -S, --sections, --section-headers — Displays the information contained in the file's section headers, if it has any.
  • -g, --section-groups — Displays the information contained in the file's section groups, if it has any.
  • -t, --section-details — Displays the detailed section information. Implies -S. she's thorough, she's giving main character energy 👑
  • -s, --symbols, --syms — Displays the entries in symbol table section of the file, if it has one. If a symbol has version information associated with it then this is displayed as well. The version string is displayed as a suffix to the symbol name, preceded by an @ character. For example foo@VER_1. If the version is the default version to be used when resolving unversioned references to the symbol then it is displayed as a suffix preceded by two @ characters. For example foo@@VER_2. double @ = default, single @ = not the default, iykyk 💜
  • --dyn-syms — Displays the entries in dynamic symbol table section of the file, if it has one. The output format is the same as the format used by the --syms option. same fit, different table 🦋
  • --lto-syms — Displays the contents of any LTO symbol tables in the file. LTO stans rise 🔥
  • --sym-base=[0|8|10|16] — Forces the size field of the symbol table to use the given base. Any unrecognized options will be treated as 0. --sym-base=0 represents the default and legacy behaviour. This will output sizes as decimal for numbers less than 100000. For sizes 100000 and greater hexadecimal notation will be used with a 0x prefix. --sym-base=8 will give the symbol sizes in octal. --sym-base=10 will always give the symbol sizes in decimal. --sym-base=16 will always give the symbol sizes in hexadecimal with a 0x prefix. pick your numeral aesthetic 💅
  • -C, --demangle[=style] — Decode (demangle) low-level symbol names into user-level names. This makes C++ function names readable. Different compilers have different mangling styles. The optional demangling style argument can be used to choose an appropriate demangling style for your compiler. turning _ZN3foo3barEv into foo::bar() — the glow-up of the century ✨
  • --no-demangle — Do not demangle low-level symbol names. This is the default. raw and unfiltered, no makeup era 🎀
  • --recurse-limit, --no-recurse-limit, --recursion-limit, --no-recursion-limit — Enables or disables a limit on the amount of recursion performed whilst demangling strings. Since the name mangling formats allow for an infinite level of recursion it is possible to create strings whose decoding will exhaust the amount of stack space available on the host machine, triggering a memory fault. The limit tries to prevent this from happening by restricting recursion to 2048 levels of nesting.

The default is for this limit to be enabled, but disabling it may be necessary in order to demangle truly complicated names. Note however that if the recursion limit is disabled then stack exhaustion is possible and any bug reports about such an event will be rejected. she WILL not be taking questions 💀

  • -U [d|i|l|e|x|h], --unicode=[default|invalid|locale|escape|hex|highlight] — Controls the display of non-ASCII characters in identifier names. The default (--unicode=locale or --unicode=default) is to treat them as multibyte characters and display them in the current locale. All other versions of this option treat the bytes as UTF-8 encoded values and attempt to interpret them. If they cannot be interpreted or if the --unicode=invalid option is used then they are displayed as a sequence of hex bytes, encloses in curly parethesis characters. (yes the original really says "encloses" and "parethesis", we keep the lore intact 😭)

Using the --unicode=escape option will display the characters as as unicode escape sequences (\uxxxx). Using the --unicode=hex will display the characters as hex byte sequences enclosed between angle brackets. (the double "as as" is canon, bestie, I don't make the rules)

Using the --unicode=highlight will display the characters as unicode escape sequences but it will also highlighted them in red, assuming that colouring is supported by the output device. The colouring is intended to draw attention to the presence of unicode sequences when they might not be expected. RED ALERT unicode jumpscare 🙈

  • -X, --extra-sym-info — When displaying details of symbols, include extra information not normally presented. Currently this just adds the name of the section referenced by the symbol's index field, if there is one. In the future more information may be displayed when this option is enabled. she's future-proofing, we respect it 🌸

Enabling this option effectively enables the --wide option as well, at least when displaying symbol information. sneaky lil bonus 💅

  • --no-extra-sym-info — Disables the effect of the --extra-sym-info option. This is the default. back to basics ✨
  • -e, --headers — Display all the headers in the file. Equivalent to -h -l -S. the triple threat combo 🎀
  • -n, --notes — Displays the contents of the NOTE segments and/or sections, if any. post-it notes but make them binary 🗒️
  • -r, --relocs — Displays the contents of the file's relocation section, if it has one. things are moving, things are shifting ✨
  • -u, --unwind — Displays the contents of the file's unwind section, if it has one. Only the unwind sections for IA64 ELF files, as well as ARM unwind tables (".ARM.exidx" / ".ARM.extab") are currently supported. If support is not yet implemented for your architecture you could try dumping the contents of the .eh_frames section using the --debug-dump=frames or --debug-dump=frames-interp options. if she can't do it, she'll tell you who can 🫶
  • -d, --dynamic — Displays the contents of the file's dynamic section, if it has one. so much happening, so much drama 🔥
  • -V, --version-info — Displays the contents of the version sections in the file, it they exist. (yes, "it they exist" — the typo is part of the family history now, we protect it 😭)
  • -A, --arch-specific — Displays architecture-specific information in the file, if there is any. architecture lore drop 🦋
  • -D, --use-dynamic — When displaying symbols, this option makes readelf use the symbol hash tables in the file's dynamic section, rather than the symbol table sections.

When displaying relocations, this option makes readelf display the dynamic relocations rather than the static relocations. dynamic girlie mode: ON 💅

  • -L, --lint, --enable-checks — Displays warning messages about possible problems with the file(s) being examined. If used on its own then all of the contents of the file(s) will be examined. If used with one of the dumping options then the warning messages will only be produced for the things being displayed. constructive criticism, but make it ELF 🎀
  • -x <number or name>, --hex-dump=<number or name> — Displays the contents of the indicated section as a hexadecimal bytes. A number identifies a particular section by index in the section table; any other string identifies all sections with that name in the object file. This option can be repeated multiple times on the command line in order to request multiple hex dumps. hex hex hex, stack 'em up 🍓
  • -R <number or name>, --relocated-dump=<number or name> — Displays the contents of the indicated section as a hexadecimal bytes. A number identifies a particular section by index in the section table; any other string identifies all sections with that name in the object file. The contents of the section will be relocated before they are displayed. This option can be repeated multiple times on the command line in order to request multiple relocated dumps. same energy as -x but she FIXES the addresses first, obsessed ✨
  • -p <number or name> / --string-dump=<number or name> ** — prints whatever's in that section as printable strings, bestie. Give it a number and it picks that exact section by index in the section table; give it literally anything else and it grabs **every section with that name in the object file. And yes you can stack it — repeat it as many times as you want to dump multiple sections. 💖
  • -j <number or name> / --display-section — shows the section you asked for, formatted based on its section header type. Sections with relocations get shown like you'd used --relocations, sections with symbols get shown like --syms, and so on down the line. A number = that section by index in the section table; any other string = all sections with that name across the input file(s). Repeatable too, because why stop at one dump. ✨
  • -z / --decompress — asks nicely for the section(s) being dumped by x, R or p to get decompressed before showing. If they're not compressed? They just show up as-is, no drama. 🦋
  • -c / --archive-index — shows the file symbol index info hiding in the header of binary archives. Does the same job as the t command to ar, except it skips the BFD library entirely. iconic behaviour honestly. 👑
  • -w[lLiaprmfFsOoRtUuTgAckK] / --debug-dump[=rawline,=decodedline,=info,=abbrev,=pubnames,=aranges,=macro,=frames,=frames-interp,=str,=str-offsets,=loc,=Ranges,=pubtypes,=trace_info,=trace_abbrev,=trace_aranges,=gdb_index,=addr,=cu_index,=links,=follow-links] — dumps the DWARF debug sections in the file, if there even are any. Compressed debug sections get auto-decompressed (temporarily!) before they're shown. Add one or more of the optional letters or words after the switch and you only get that type of data. Here's the whole menu:

"a" / "=abbrev" — shows the contents of the .debug_abbrev section.

"A" / "=addr" — shows the contents of the .debug_addr section.

"c" / "=cu_index" — shows the contents of the .debug_cu_index and/or .debug_tu_index sections.

"f" / "=frames" — displays the raw contents of a .debug_frame section.

"F" / "=frames-interp" — displays the interpreted contents of a .debug_frame section.

"g" / "=gdb_index" — shows the contents of the .gdb_index and/or .debug_names sections.

"i" / "=info" — shows the contents of the .debug_info section. Heads up: this output can also be reined in with the --dwarf-depth and --dwarf-start options.

"k" / "=links" — shows the contents of the .gnu_debuglink, .gnu_debugaltlink and .debug_sup sections, if any of them are even there. Also shows any links to separate dwarf object files (dwo), if they're specified by the DW_AT_GNU_dwo_name or DW_AT_dwo_name attributes in the .debug_info section.

"K" / "=follow-links" — shows the contents of any selected debug sections found in linked, separate debug info file(s). Which means you might see multiple versions of the same debug section if it lives in more than one file. 💀 Also, when displaying DWARF attributes, if a form is found that references the separate debug info file, then the referenced contents get displayed too.

Heads up — on some distributions this option is enabled by default. You can turn it off with the N debug option. The default gets chosen when configuring binutils via --enable-follow-debug-links=yes or --enable-follow-debug-links=no. If neither is used, the default is to enable following of debug links.
Also heads up — if debuginfod protocol support was enabled when binutils was built, this option will also try to contact any debuginfod servers mentioned in the DEBUGINFOD_URLS environment variable. That could take a hot minute to resolve. Disable it with the =do-not-use-debuginfod debug option.

"N" / "=no-follow-links" — disables the following of links to separate debug info files. bye bestie ✋

"D" / "=use-debuginfod" — enables contacting debuginfod servers if there's a need to follow debug links. This is the default behaviour.

"E" / "=do-not-use-debuginfod" — disables contacting debuginfod servers when there's a need to follow debug links.

"l" / "=rawline" — shows the contents of the .debug_line section in a raw format.

"L" / "=decodedline" — shows the interpreted contents of the .debug_line section.

"m" / "=macro" — shows the contents of the .debug_macro and/or .debug_macinfo sections.

"o" / "=loc" — shows the contents of the .debug_loc and/or .debug_loclists sections.

"O" / "=str-offsets" — shows the contents of the .debug_str_offsets section.

"p" / "=pubnames" — shows the contents of the .debug_pubnames and/or .debug_gnu_pubnames sections.

"r" / "=aranges" — shows the contents of the .debug_aranges section.

"R" / "=Ranges" — shows the contents of the .debug_ranges and/or .debug_rnglists sections.

"s" / "=str" — shows the contents of the .debug_str, .debug_line_str and/or .debug_str_offsets sections.

"t" / "=pubtype" — shows the contents of the .debug_pubtypes and/or .debug_gnu_pubtypes sections.

"T" / "=trace_aranges" — shows the contents of the .trace_aranges section.

"u" / "=trace_abbrev" — shows the contents of the .trace_abbrev section.

"U" / "=trace_info" — shows the contents of the .trace_info section.

Note: displaying the contents of .debug_static_funcs, .debug_static_vars and debug_weaknames sections is not currently supported. we don't do that here 🙈
  • --dwarf-depth=n — limits the dump of the ".debug_info" section to n children. Only useful with --debug-dump=info. Default is to print all DIEs; the special value 0 for n does that too. With a non-zero n, DIEs at or deeper than n levels won't be printed. The range for n is zero-based.
  • --dwarf-start=n — prints only DIEs beginning with the DIE numbered n. Again, only useful with --debug-dump=info. If you use it, it suppresses printing of any header info and all DIEs before the DIE numbered n — only siblings and children of the specified DIE get printed. Pairs gorgeously with --dwarf-depth. ✨
  • -P / --process-links — displays the contents of non-debug sections found in separate debuginfo files linked to the main file. This option automatically implies -wK, and only sections requested by other command line options get displayed.
  • --ctf[=section] — displays the contents of the specified CTF section. CTF sections themselves contain many subsections, and all of them get shown in order. By default it displays the section named .ctf, which is the name emitted by ld.
  • --ctf-parent=member — if the CTF section contains ambiguously-defined types, it'll be an archive of many CTF dictionaries, all inheriting from one dictionary holding the unambiguous types. That member is by default named .ctf, same as the section containing it, but the name can be changed using the "ctf_link_set_memb_name_changer" function at link time. So when you're looking at CTF archives made by a linker that used the name changer to rename the parent archive member, --ctf-parent lets you specify the name used for the parent. 🫶
  • --ctf-parent-section=section — lets you pick a completely different section for the CTF parent dictionary (the one with unambiguous types) than for the child dictionaries (the ambiguous remainder). The linker doesn't emit ELF objects structured like this, but some third-party linkers might. It's also convenient for inspecting CTF written out as multiple raw files to compose with objcopy, which can put them in different ELF sections but not in different members of a single CTF dict.
  • --ctf-symbols=section / --ctf-strings=section — specify the name of another section from which the CTF file can inherit strings and symbols. By default, the ".symtab" and its linked string table are used. If either --ctf-symbols or --ctf-strings is specified, the other must be specified too. they're a package deal, iykyk 💅
  • -I / --histogram — displays a histogram of bucket list lengths when displaying the contents of the symbol tables. 📊
  • -v / --version — displays the version number of readelf.
  • -W / --wide — don't break output lines to fit into 80 columns. By default readelf breaks section header and segment listing lines for 64-bit ELF files so they fit into 80 columns. This option makes readelf print each section header resp. each segment on a single line, which is far more readable on terminals wider than 80 columns. trust. 🔥
  • -T / --silent-truncation — normally when readelf is displaying a symbol name and has to truncate it to fit into an 80 column display, it adds a suffix of "[...]" to the name. This option disables that, letting 5 more characters of the name show up and restoring the old readelf behaviour (from before release 2.35).
  • -H / --help — displays the command-line options understood by readelf.
  • @file — reads command-line options from file. The options read get inserted in place of the original @file option. If file doesn't exist or can't be read, then the option is treated literally and not removed. 😭

ok so real talk about how @file actually eats its options 💅 the parser splits stuff on whitespace, periodt. so if you wanna sneak a space into one single option, you gotta wrap the whole option in either single quotes or double quotes — like a little blanket for your option, it's giving cozy 🎀

and if you want any character in there — and yes bestie, that includes a literal backslash — you just slap a backslash in front of it. that's it, that's the whole trick ✨

not me about to blow your mind: the file can contain even more @file options inside it 🫠 and those get processed recursively. it's @file-ception fr fr. keep that in mind or you'll be tracing includes all afternoon 😭

🌈 SEE ALSO 🌈

  • objdump(1) — your other bestie in the binutils friend group 💖
  • and the Info entries for binutils — the deep lore, iykyk 👑

Copyright (c) 1991-2025 Free Software Foundation, Inc. 🫶

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation — with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. a copy of the license is chillin' in the section entitled "GNU Free Documentation License" 🌸

and that's the whole page, bestie!! 💖✨ this one shipped as part of binutils-2.44, dated 2025-03-28 — go forth and read your ELF files like the main character you are 🧚💅🦋

📦 where this page comes from