LLVM-SYMBOLIZER(1)

Welcome to the llvm-symbolizer(1) page from the LLVM manual, bestie 💖 — this is the tool that turns addresses into source code locations, and it is honestly so useful it's giving main character energy.

🌸 NAME 🌸

llvm-symbolizer — convert addresses into source code locations ✨

✨ SYNOPSIS ✨

llvm-symbolizer [options] [addresses...]

💅 DESCRIPTION 💅

Okay so llvm-symbolizer reads input names and addresses from the command-line and prints the corresponding source code locations to standard output — like a little glow-up for your stack traces, no cap 🔥. It can also symbolize logs containing Symbolizer Markup <> via --filter-markup. Addresses may be specified as numbers or symbol names, which is lowkey iconic.

If no address is specified on the command-line, it reads the addresses from standard input. If no input name is specified on the command-line, but addresses are, the first address value is treated as an input name — yes, really, that's the vibe. If an input value is not recognized, it reports that source information is not found 💀.

Input names can be specified together with the addresses either on standard input or as positional arguments on the command-line. By default, input names are interpreted as object file paths. However, prefixing a name with BUILDID: states that it is a hex build ID rather than a path. This will look up the corresponding debug binary — very detective bestie of it 🔍. For consistency, prefixing a name with FILE: explicitly states that it is an object file path (the default).

A positional argument or standard input value can be preceded by DATA or CODE to indicate that the address should be symbolized as data or executable code respectively. If neither is specified, CODE is assumed. DATA is symbolized as address and symbol size rather than line number — very demure, very data 🍓.

llvm-symbolizer parses options from the environment variable LLVM_SYMBOLIZER_OPTS after parsing options from the command line. LLVM_SYMBOLIZER_OPTS is primarily useful for supplementing the command-line options when llvm-symbolizer is invoked by another program or runtime 🫶.

🎀 EXAMPLES 🎀

All of the following examples use the following two source files as input. They use a mixture of C-style and C++-style linkage to illustrate how these names are printed differently (see --demangle). 💖

// test.h
extern "C" inline int foz() {
  return 1234;
}

// test.cpp
#include "test.h"
int bar=42;

int foo() {
  return bar;
}

int baz() {
  volatile int k = 42;
  return foz() + k;
}

int main() {
  return foo() + baz();
}

These files are built as follows:

$ clang -g test.cpp -o test.elf
$ clang -g -O2 test.cpp -o inlined.elf

Example 1 - addresses and object on command-line:

$ llvm-symbolizer --obj=test.elf 0x4004d0 0x400490
foz
/tmp/test.h:1:0

baz()
/tmp/test.cpp:11:0

Example 2 - addresses on standard input:

$ cat addr.txt
0x4004a0
0x400490
0x4004d0
$ llvm-symbolizer --obj=test.elf < addr.txt
main
/tmp/test.cpp:15:0

baz()
/tmp/test.cpp:11:0

foz
/tmp/./test.h:1:0

Example 3 - object specified with address:

$ llvm-symbolizer "test.elf 0x400490" "FILE:inlined.elf 0x400480"
baz()
/tmp/test.cpp:11:0

foo()
/tmp/test.cpp:8:10

$ cat addr2.txt
FILE:test.elf 0x4004a0
inlined.elf 0x400480

$ llvm-symbolizer < addr2.txt
main
/tmp/test.cpp:15:0

foo()
/tmp/test.cpp:8:10

Example 4 - BUILDID and FILE prefixes:

$ llvm-symbolizer "FILE:test.elf 0x400490" "DATA BUILDID:123456789abcdef 0x601028"
baz()
/tmp/test.cpp:11:0

bar
6295592 4

$ cat addr3.txt
FILE:test.elf 0x400490
DATA BUILDID:123456789abcdef 0x601028

$ llvm-symbolizer < addr3.txt
baz()
/tmp/test.cpp:11:0

bar
6295592 4

Example 5 - CODE and DATA prefixes:

$ llvm-symbolizer --obj=test.elf "CODE 0x400490" "DATA 0x601028"
baz()
/tmp/test.cpp:11:0

bar
6295592 4

$ cat addr4.txt
CODE test.elf 0x4004a0
DATA inlined.elf 0x601028

$ llvm-symbolizer < addr4.txt
main
/tmp/test.cpp:15:0

bar
6295592 4

Example 6 - path-style options:

This example uses the same source file as above, but the source file's full path is /tmp/foo/test.cpp and is compiled as follows. The first case shows the default absolute path, the second --basenames, and the third shows --relativenames.

$ pwd
/tmp
$ clang -g foo/test.cpp -o test.elf
$ llvm-symbolizer --obj=test.elf 0x4004a0
main
/tmp/foo/test.cpp:15:0
$ llvm-symbolizer --obj=test.elf 0x4004a0 --basenames
main
test.cpp:15:0
$ llvm-symbolizer --obj=test.elf 0x4004a0 --relativenames
main
foo/test.cpp:15:0

Example 7 - Addresses as symbol names:

$ llvm-symbolizer --obj=test.elf main
main
/tmp/test.cpp:14:0
$ llvm-symbolizer --obj=test.elf "CODE foz"
foz
/tmp/test.h:1:0

Example 8 - --skip-line-zero output for an address with no line correspondence (an address associated with line zero):

// test.c
int foo = 0;
int x = 1234;
int main() {
  if (x)
    return foo;
  else
    return x;
}

These files are built as follows:

$ clang -g -O2 -S test.c -o test.s
$ llvm-mc -filetype=obj -triple=x86_64-unknown-linux  test.s -o test.o

$ llvm-symbolizer --obj=test.o --skip-line-zero 0xa
main
/tmp/test.c:5:7 (approximate)

✨ OPTIONS ✨

okay bestie, this is the part where we meet all the flags 💅 there are a lot of them, but every single one is here, no cap.

• --adjust-vma <offset> — adds offset to object file addresses before it does any lookups. basically it lets you pretend the object got relocated by that offset, so the lookups land where they would have if it had. 🎀
• --skip-line-zero — if an address has no line number attached, it grabs the last line number from the current sequence in the line-table instead. those lines get labeled "approximate" in the output, because ngl they might be misleading 🙈
• --basenames, -s — prints just the file's name with zero directories, instead of the whole absolute path. short and cute 🍓
• --build-id — looks up the object using the build ID you give it, written as a hexadecimal string. mutually exclusive with --obj, so pick one, you can't have both 💀
• --color [=<always|auto|never>] — says whether to use color in --filter-markup mode. defaults to auto, which sniffs out whether standard output even supports color. if you just say --color on its own, that's the same as --color=always ✨
• --debug-file-directory <path> — hands over a path to a directory that has a .build-id subdirectory inside, so it can go hunting for debug info for stripped binaries. you can pass this multiple times, and multiple instances get searched in the order you gave them 🔍
• --debuginfod, --no-debuginfod — controls whether it tries debuginfod lookups for debug binaries. heads up: unless you say otherwise, debuginfod is only enabled if libcurl was compiled in (LLVM_ENABLE_CURL) and at least one server URL came in through the DEBUGINFOD_URLS environment variable 👑
• --demangle, -C — prints demangled function names when the names are mangled. like, the mangled name _Z3bazv becomes baz(), but the non-mangled name foz gets printed as-is. defaults to true 💖
• --dwp <path> — uses the DWP file sitting at path for any CUs that have split DWARF debug data.
• --fallback-debug-path <path> — when a separate file holds the debug data and a GNU debug link section points at it, this gives a path to use as the basis for finding that debug data if it can't be located relative to the object. a little backup plan 🫶
• --filter-markup — reads from standard input, converts the contained Symbolizer Markup <> into human-readable form, and prints the results to standard output. the following markup elements are not yet supported, sorry babes 😭:
  • {{{hexdict}}}
  • {{{dumpfile}}}

the {{{bt}}} backtrace element reports frames using this syntax:

#<number>[.<inline>] <address> <function> <file>:<line>:<col>
(<module>+<relative address>)

<inline> gives you the frame numbers for calls inlined into the caller that corresponds to <number>. the inlined call numbers start at 1 and go up from callee to caller.

<address> is an address inside the call instruction to the function — so it might not be the start of the instruction, lowkey. <relative address> is the corresponding virtual offset in the <module> loaded at that address 🦋

• --functions [=<none|short|linkage>], -f — picks how function names get printed: omit the function name, print the short function name, or print the full linkage name (that's none, short, linkage respectively, in case the order wasn't obvious 💅). defaults to linkage.
• --help, -h — shows help and usage for this command. the classic.
• --inlining, --inlines, -i — if a source code location sits inside an inlined function, this prints all the inlined frames. and yes, this is the default ✨
• --no-inlines — doesn't print inlined frames. the opposite vibe.
• --no-demangle — doesn't print demangled function names. also the opposite vibe.
• --obj <path>, --exe, -e — path to the object file to be symbolized. if you pass -, it reads the object straight from the standard input stream. mutually exclusive with --build-id 👀
• --output-style <LLVM|GNU|JSON> — picks your preferred output style. defaults to LLVM. when it's set to GNU, the tool follows the style of GNU's addr2line. the differences from the LLVM style are:
  • it does not print the column of a source code location.
  • it does not add an empty line after the report for an address.
  • it does not replace the name of an inlined function with the name of the topmost caller when inlined frames aren't shown.
  • it does print an address's debug-data discriminator when it's non-zero. one way to produce discriminators is compiling with clang's -fdebug-info-for-profiling.

JSON style gives you machine readable output in JSON. if addresses are supplied via stdin, the output JSON will be a series of individual objects. otherwise, all results will be contained in a single array 🧚

$ llvm-symbolizer --obj=inlined.elf 0x4004be 0x400486 -p
baz() at /tmp/test.cpp:11:18
 (inlined by) main at /tmp/test.cpp:15:0

foo() at /tmp/test.cpp:6:3

$ llvm-symbolizer --output-style=LLVM --obj=inlined.elf 0x4004be 0x400486 -p --no-inlines
main at /tmp/test.cpp:11:18

foo() at /tmp/test.cpp:6:3

$ llvm-symbolizer --output-style=GNU --obj=inlined.elf 0x4004be 0x400486 -p --no-inlines
baz() at /tmp/test.cpp:11
foo() at /tmp/test.cpp:6

$ clang -g -fdebug-info-for-profiling test.cpp -o profiling.elf
$ llvm-symbolizer --output-style=GNU --obj=profiling.elf 0x401167 -p --no-inlines
main at /tmp/test.cpp:15 (discriminator 2)

$ llvm-symbolizer --output-style=JSON --obj=inlined.elf 0x4004be 0x400486 -p
[
  {
    "Address": "0x4004be",
    "ModuleName": "inlined.elf",
    "Symbol": [
      {
        "Column": 18,
        "Discriminator": 0,
        "FileName": "/tmp/test.cpp",
        "FunctionName": "baz()",
        "Line": 11,
        "StartAddress": "0x4004be",
        "StartFileName": "/tmp/test.cpp",
        "StartLine": 9
      },
      {
        "Column": 0,
        "Discriminator": 0,
        "FileName": "/tmp/test.cpp",
        "FunctionName": "main",
        "Line": 15,
        "StartAddress": "0x4004be",
        "StartFileName": "/tmp/test.cpp",
        "StartLine": 14
      }
    ]
  },
  {
    "Address": "0x400486",
    "ModuleName": "inlined.elf",
    "Symbol": [
      {
        "Column": 3,
        "Discriminator": 0,
        "FileName": "/tmp/test.cpp",
        "FunctionName": "foo()",
        "Line": 6,
        "StartAddress": "0x400486",
        "StartFileName": "/tmp/test.cpp",
        "StartLine": 5
      }
    ]
  }
]

• --pretty-print, -p — prints human readable output. if --inlining is specified, the enclosing scope gets prefixed by (inlined by). for JSON output, this option makes the JSON indented and split over new lines — otherwise the JSON gets printed in a compact form, which is giving "unreadable wall of text" tbh 💀

$ llvm-symbolizer --obj=inlined.elf 0x4004be --inlining --pretty-print
baz() at /tmp/test.cpp:11:18
 (inlined by) main at /tmp/test.cpp:15:0

• --print-address, --addresses, -a — prints the address before the source code location. defaults to false 🌸

$ llvm-symbolizer --obj=inlined.elf --print-address 0x4004be
0x4004be
baz()
/tmp/test.cpp:11:18
main
/tmp/test.cpp:15:0

$ llvm-symbolizer --obj=inlined.elf 0x4004be --pretty-print --print-address
0x4004be: baz() at /tmp/test.cpp:11:18
 (inlined by) main at /tmp/test.cpp:15:0

• --print-source-context-lines <N> — prints N lines of source context for each symbolized address. it's giving "let me show you around the neighborhood" 🏡

$ llvm-symbolizer --obj=test.elf 0x400490 --print-source-context-lines=3
baz()
/tmp/test.cpp:11:0
10  :   volatile int k = 42;
11 >:   return foz() + k;
12  : }

• --relativenames — prints the file's path relative to the compilation directory instead of the absolute path. if the command-line to the compiler included the full path, this will be the same as the default. iykyk 🎀
• --verbose — prints verbose address, line and column information. so much detail, we love a thorough queen 👑

$ llvm-symbolizer --obj=inlined.elf --verbose 0x4004be
baz()
  Filename: /tmp/test.cpp
  Function start filename: /tmp/test.cpp
  Function start line: 9
  Function start address: 0x4004b6
  Line: 11
  Column: 18
main
  Filename: /tmp/test.cpp
  Function start filename: /tmp/test.cpp
  Function start line: 14
  Function start address: 0x4004b0
  Line: 15
  Column: 18

• --version, -v — prints version information for the tool ⭐
• @<FILE> — reads command-line options from the response file <FILE>. cute lil shortcut 🦋

---

🪟 WINDOWS/PDB SPECIFIC OPTIONS 🪟

• --dia — uses the Windows DIA SDK for symbolization. if the DIA SDK isn't found, llvm-symbolizer falls back to the native implementation. plan B is always loaded 🙈

---

🍎 MACH-O SPECIFIC OPTIONS 🍎

• --default-arch <arch> — if a binary contains object files for multiple architectures (like, say, it's a Mach-O universal binary), this symbolizes the object file for the architecture you name. you can also specify the architecture by writing binary_name:arch_name in the input (peep the example below 👇). if the architecture isn't specified either way, the address won't be symbolized at all. defaults to the empty string 😭

$ cat addr.txt
/tmp/mach_universal_binary:i386 0x1f84
/tmp/mach_universal_binary:x86_64 0x100000f24

$ llvm-symbolizer < addr.txt
_main
/tmp/source_i386.cc:8

_main
/tmp/source_x86_64.cc:8

• --dsym-hint <path/to/file.dSYM> — if the debug info for a binary isn't chilling in the default location, this tells it to look for the debug info at the .dSYM path you provide. you can use this flag multiple times, go off 💅

---

🚪 EXIT STATUS 🚪

llvm-symbolizer returns 0. any other exit codes mean an internal program error — so if you see one, something went wrong inside the tool itself 😭

---

👀 SEE ALSO 👀

llvm-addr2line(1) <llvm-addr2line.html> — go say hi to the cousin 🫶

💖 AUTHOR 💖

So who's behind all this magic, you ask? The page is maintained by the LLVM Team — you can find them at https://llvm.org/ ✨. That's the whole crew keeping the vibes immaculate and the symbolizer symbolizing, bestie 🫶.

---

🎀 COPYRIGHT 🎀

Copyright 2003-2026, LLVM Project 💅. That's it, that's the whole thing — iconic behavior from a project that's been serving for literal decades 👑.

ngl, if you're out here copying this without reading the license, that's not it. Respect the copyright, bestie 🙈.

---

okay and that's a wrap on the whole man page!! 🎉 You made it to the very end, I'm so proud of you fr fr 🌸💜. This page is LLVM-SYMBOLIZER(1), dated 2026-05-15 — screenshot it, bookmark it, tattoo it on your arm, idk 😭. Now go symbolize something beautiful and slay the stack trace 💅✨🦋

bye bestie, ily, go touch some grass and then come back and debug 💖🌈