LLVM-OBJDUMP(1)

📦
version 23.1.4 · 11 versions
, in arch rolling

🦋 llvm-objdump — LLVM's object file dumper 🦋

okay bestie, welcome to the LLVM-OBJDUMP(1) manual page — this is the one where we dump object files and look at what's inside, and honestly it's giving main-character energy for binary inspection 💅✨

💖 NAME 💖

llvm-objdump — LLVM's object file dumper

✨ SYNOPSIS ✨

llvm-objdump [commands] [options] [filenames...]

🌸 DESCRIPTION 🌸

The llvm-objdump utility prints the contents of object files and final linked images named on the command line. If no file name is specified, llvm-objdump will attempt to read from a.out. If - is used as a file name, llvm-objdump will process a file on its standard input stream. 🫶

💅 COMMANDS 💅

At least one of the following commands are required, and some commands can be combined with other commands:

  • -a, --archive-headers — display the information contained within an archive's headers. 🎀
  • -d, --disassemble — disassemble all executable sections found in the input files. On some architectures (AArch64, PowerPC, x86), all known instructions are disassembled by default. On the others, --mcpu or --mattr is needed to enable some instruction sets. Disabled instructions are displayed as <unknown>. 😭
  • -D, --disassemble-all — disassemble all sections found in the input files. 🔥
  • --disassemble-symbols=<symbol1[,symbol2,...]> and --disassemble=symbol1 --disassemble=symbol2 ... — disassemble only the specified symbols. Takes demangled symbol names when --demangle is specified, otherwise takes mangled symbol names. Implies --disassemble. 👑
  • --dwarf=<value> — dump the specified DWARF debug sections. The supported values are:
    • frames - .debug_frame 🧚
  • -f, --file-headers — display the contents of the overall file header. 🌈
  • --fault-map-section — display the content of the fault map section. ⭐
  • -h, --headers, --section-headers — display summaries of the headers for each section. 💜
  • --help — display usage information and exit. Does not stack with other commands. 💀
  • -p, --private-headers — display format-specific file headers. 🍓
  • -r, --reloc — display the relocation entries in the file. 🎀
  • -R, --dynamic-reloc — display the dynamic relocation entries in the file. ✨
  • --raw-clang-ast — dump the raw binary contents of the clang AST section. 🦋
  • -s, --full-contents — display the contents of each section. 🌸
  • -t, --syms — display the symbol table. 💖
  • -T, --dynamic-syms — display the contents of the dynamic symbol table. 🔥
  • -u, --unwind-info — display the unwind info of the input(s). This operation is only currently supported for COFF and Mach-O object files. 🫶
  • -v, --version — display the version of the llvm-objdump executable. Does not stack with other commands. 👑
  • -x, --all-headers — display all available header information. Equivalent to specifying --archive-headers, --file-headers, --private-headers, --reloc, --section-headers, and --syms. 🌟

✨ OPTIONS ✨

llvm-objdump ships with the whole buffet of options, bestie. Here's the full menu, nothing skipped, not one crumb:

  • --adjust-vma=<offset> — bumps the address shown in disassembly (or in section header printing) up by offset. Basically "shift everything, I said so." 💫
  • --arch-name=<string> — tells it which target architecture to disassemble for. Wanna know what's on the list? Run --version, it'll tell you. 🎯
  • --build-id=<string> — finds the object using the build ID you give it, as a hex string. Whatever object it finds gets treated exactly like it was an input filename. Iconic lookup behavior fr.
  • -C, --demangle — demangles symbol names in the output. No more mangled gobbledygook, we're getting readable names. 💅
  • --debug-file-directory <path> — hands over a path to a directory containing a .build-id subdirectory, which it'll search for debug info for stripped binaries. You can pass this more than once, and they get searched in the order you gave 'em.
  • --debug-indent=<width> — how far to indent the source-level variable / inlined function display, measured from the start of the disassembly. Defaults to 52 characters. Yes, a very specific number, and yes it's the default. 🎀
  • --debug-inlined-funcs[=<format>] — prints where inlined functions live, right there alongside the disassembly. format can be ascii, limits-only, or unicode, and it defaults to unicode if you just leave it blank. 🦋
  • --debug-vars[=<format>] — prints the locations (registers or memory, no cap) of source-level variables alongside the disassembly. format is ascii or unicode, defaulting to unicode when omitted. 🌸
  • --debuginfod, --no-debuginfod — toggles whether it tries debuginfod lookups for debug binaries. Heads up though: unless you say otherwise, debuginfod is only enabled if libcurl was compiled in (LLVM_ENABLE_CURL) and at least one server URL came from the environment variable DEBUGINFOD_URLS. Both conditions, no shortcuts. ⭐
  • -j, --section=<section1[,section2,...]> — only runs commands on the sections you name, and nothing else. For Mach-O, write it as segment,section to specify the section name. 🫶
  • -l, --line-numbers — while disassembling, shows source line numbers. Also implies --disassemble, so it comes with a friend. 😌
  • -M, --disassembler-options=<opt1[,opt2,...]> — passes target-specific disassembler options through. Here's what's available:
    • reg-names-std: ARM only, and it's the default. Prints using ARM's instruction set documentation, with r13/r14/r15 swapped out for sp/lr/pc.
    • reg-names-raw: ARM only. Uses r followed by the register number.
    • no-aliases: AArch64 and RISC-V only. Prints the raw instruction mnemonic instead of the pseudo instruction mnemonic.
    • numeric: RISC-V only. Prints raw register names instead of the ABI mnemonic — like printing x1 instead of ra.
    • att: x86 only, and it's the default. Prints in the AT&T syntax.
    • intel: x86 only. Prints in the intel syntax.
  • --disassembler-color=<mode> — turns disassembler color output on or off. Your choices:
    • off: disassembler color output off. simple as that.
    • on: disassembler color output on. slay.
    • terminal: on only if the terminal supports it — and this is the default. 🌈
  • --mcpu=<cpu-name> — targets a specific CPU type for disassembly. Wanna see the list? --mcpu=help will dump the available CPUs for you. 🍓
  • --mattr=<a1,+a2,-a3,...> — enables/disables target-specific attributes. Same deal: --mattr=help shows you the available attributes.
  • -mllvm <arg> — passes an argument straight along to LLVM's CommandLine library. Forwarded, untouched. 💌
  • --no-leading-addr, --no-addresses — while disassembling, don't print the leading addresses for instructions or inline relocations. Minimalist era.
  • --no-print-imm-hex — don't use hex format for immediate values in the disassembly output. ngl sometimes you just want the other format.
  • --no-show-raw-insn — while disassembling, don't print the raw bytes of each instruction. Just the instruction, thanks. ✨
  • --offloading — shows the content of the LLVM offloading sections plus HIP offload bundles. 👑
  • --prefix=<prefix> — when you're disassembling with the --source option, this prepends prefix to absolute paths.
  • --prefix-strip=<level> — when disassembling with --source, strips out level initial directories from absolute paths. Warning bestie: this option does nothing without --prefix. Zero effect. 💀
  • --source-dir <dir> — when disassembling with --source, adds dir to the front of the source search path when it's looking up source files. For each source file, llvm-objdump tries the path from the debug info first, then each search directory with the full path appended, then each search directory with only the file name. You can hand it this option multiple times; every --source-dir adds one directory. Options on the command line are searched in first-to-last order. 🎀
  • --substitute-path <from> <to> — when disassembling with --source, replaces from with to at the start of the directory part of source file paths while looking up sources. A rule only gets applied if from ends at a directory separator in the path. This can be specified multiple times; rules are evaluated in the order given and the first matching rule wins — same as GDB set substitute-path. 🌸
  • --print-imm-hex — uses hex format when printing immediate values in disassembly output. It's the default, so this is the "on purpose, explicitly" version. 🧚
  • -S, --source — while disassembling, shows source interleaved with the disassembly. Implies --disassemble. best of both worlds fr fr 🫶
  • --show-all-symbols — shows every symbol during disassembly, even when multiple symbols are defined at the same location. No hiding, no picking favorites. 💖
  • --show-lma — displays the LMA column when dumping ELF section headers. Off by default — unless any section has different VMA and LMAs, in which case it kicks in on its own.
  • --start-address=<address> — depends what you're doing, so listen up:
    • When disassembling: only disassemble from the specified address onward.
    • When printing relocations: only print relocations patching offsets from at least address.
    • When printing symbols: only print symbols with a value of at least address.
  • --stop-address=<address> — the other end of the range:
    • When disassembling: only disassemble up to, but not including, the specified address.
    • When printing relocations: only print relocations patching offsets up to address.
    • When printing symbols: only print symbols with a value up to address.
  • --symbolize-operands, --no-symbolize-operands — this one's a whole moment, so buckle up:
    • While disassembling, it symbolizes a branch target operand so it prints a label instead of a real address.
    • When printing a PC-relative global symbol reference, it prints it as an offset from the leading symbol.
    • When a bb-address-map section is present (i.e., the object file is built with -fbasic-block-address-map), labels are retrieved from that section instead. And if a pgo-analysis-map is present alongside the bb-address-map, any available analyses get printed after the relevant block label. By default, any analysis with a special representation (i.e. BlockFrequency, BranchProbability, etc) gets printed as raw hex values.
    • Only supported for AArch64, BPF, PowerPC, RISC-V, and X86. It's enabled by default for BPF — use --no-symbolize-operands to turn it off. 🦋

Example: a non-symbolized branch instruction with a local target and pc-relative memory access, like

cmp eax, dword ptr [rip + 4112]
jge 0x20117e <_start+0x25>

might become

<L0>:
  cmp eax, dword ptr <g>
  jge      <L0>
  • --pretty-pgo-analysis-map — when you're using --symbolize-operands with bb-address-map and pgo-analysis-map, this prints analyses using the same format as their analysis passes would. An example of pretty format would be printing block frequencies relative to the entry block, the same as BFI. 💅
Careful! This only works when --symbolize-operands is enabled. Otherwise it's just sitting there doing nothing.
  • --triple=<string> — the target triple to disassemble for. Peep --version for the available targets. ⭐
  • -w, --wide — ignored, purely for compatibility with GNU objdump. It's there, it's vibing, it does nothing. 🙈
  • --x86-asm-syntax=<style> — deprecated, so heads up. When used with --disassemble, it chooses the style of code emitted from the X86 backend. Supported values:
    • att — AT&T-style assembly
    • intel — Intel-style assembly

The default disassembly style is att. 🔥

  • -z, --disassemble-zeroes — does not skip blocks of zeroes when disassembling. Every zero gets its moment.
  • @<FILE> — reads command-line options and commands from the response file <FILE>. 🎀

💅 MACH-O ONLY OPTIONS AND COMMANDS 💅

Okay bestie, this whole chunk is Apple-kid territory — Mach-O is the file format macOS/iOS use, and these flags are the ones that only make sense there. Slay.

  • --arch=<architecture> — tells it which architecture to disassemble. Not sure what you've got? Peek at --version for the list of available architectures, iykyk.
  • --archive-member-offsets — prints the offset of each archive member for Mach-O archives. Heads up though: it requires --archive-headers. It won't vibe alone.
  • --bind — shows binding info.
  • --data-in-code — prints the data in code table.
  • --dis-symname=<name> — disassembles just the instructions of the symbol you name. One symbol, main character energy, no entourage.
  • --chained-fixups — prints chained fixup information.
  • --dyld-info — prints the bind and rebase information dyld uses to resolve external references in a final linked binary.
  • --dylibs-used — shows the shared libraries used for linked files.
  • --dsym=<string> — uses a .dSYM file for debug info.
  • --dylib-id — shows the shared library's ID for dylib files.
  • --exports-trie — prints the exported symbols.
  • --function-starts [=<addrs|names|both>] — prints the function starts table for Mach-O objects. You pick: addrs (the default) prints only function addresses, names prints only the function names (when they're available), and both prints the names right beside the addresses. Choose your fighter 🫶
  • -g — prints line information from debug info, if it's there.
  • --full-leading-addr — prints the full leading address when disassembling. No truncation, no shame.
  • --indirect-symbols — shows the indirect symbol table.
  • --info-plist — shows the info plist section as strings.
  • --lazy-bind — shows lazy binding info.
  • --link-opt-hints — shows the linker optimization hints.
  • -m, --macho — use the Mach-O specific object file parser. Fair warning: commands and other options may behave differently when you use them with --macho. So like, don't come for me if the output looks different — that's literally documented.
  • --no-leading-headers — prints no leading headers at all.
  • --no-symbolic-operands — doesn't print symbolic operands when disassembling.
  • --non-verbose — displays info for Mach-O objects in non-verbose (numeric) form. Straight to the numbers, no small talk.
  • --objc-meta-data — shows the Objective-C runtime meta data.
  • --private-header — shows only the first format specific file header. That's it. That's the whole output. Minimalist queen.
  • --rebase — shows rebasing information.
  • --rpaths — shows runtime search paths for the binary.
  • --universal-headers — shows universal headers.
  • --weak-bind — shows weak binding information.

🌈 XCOFF ONLY OPTIONS AND COMMANDS 🌈

Tiny section, but it ate — XCOFF is the AIX crowd, and there are exactly two flags here:

  • --symbol-description — adds a symbol description to the disassembly output.
  • --traceback-table — decodes the traceback table in the disassembly output. And important: it implies --disassemble, so you don't gotta say it twice 💜

🐛 BUGS 🐛

Found a bug? First of all, thank you for your service 🫶 Please report it at <https://github.com/llvm/llvm-project/labels/tools:llvm-objdump/>. That's the spot, no cap.

👀 SEE ALSO 👀

Your other faves, all linked up:

👑 Author 👑

Maintained by the LLVM Team (<https://llvm.org/>). They're the ones keeping this whole thing alive, bless.

2003-2026, LLVM Project — respect the legacy, periodt.

And that's the whole page, bestie!! 💖 This was page 23 of the manual, dated 2026-10-20, from the LLVM-OBJDUMP(1) source — go forth and dump those objects, you absolute icon 🦋✨

📦 where this page comes from