LLVM-SYMBOLIZER(1)

📦 version 23.1.3, in centos-stream 9

🦋 LLVM-SYMBOLIZER(1) — `llvm-symbolizer` 🦋

Okay bestie, welcome to the LLVM manual page for llvm-symbolizer. This is the whole “address goes in, source location comes out” situation, and honestly? Iconic. 💅

✨ NAME ✨

llvm-symbolizer — convert addresses into source code locations. 🎀

🌸 SYNOPSIS 🌸

llvm-symbolizer [options] [addresses...]

💖 DESCRIPTION 💖

Okay so llvm-symbolizer reads input names and addresses from the command line, then prints the matching source code locations to standard output. It can also symbolize logs containing Symbolizer Markup via --filter-markup. Addresses can be numbers or symbol names. No cap. ✨

If no address is specified on the command line, it reads the addresses from standard input. If no input name is specified on the command line but addresses are, then the first address value is treated as an input name. If an input value is not recognized, it reports that source information is not found. Lowkey helpful. 😌

Input names can be specified together with the addresses, either on standard input or as positional arguments on the command line. By default, input names are interpreted as object file paths. But prefixing a name with BUILDID: states that it is a hex build ID rather than a path — and this will look up the corresponding debug binary. For consistency, prefixing a name with FILE: explicitly states that it is an object file path, which is the default anyway. Bestie, the prefixes are giving clarity. 💅

A positional argument or standard input value can be preceded by "DATA" or "CODE" to indicate that the address should be symbolized as data or executable code, respectively. If neither is specified, "CODE" is assumed. DATA is symbolized as address and symbol size rather than line number. So if you wanted a line number for that one? That’s not what DATA does. 😭

Also, llvm-symbolizer parses options from the environment variable LLVM_SYMBOLIZER_OPTS after parsing options from the command line. LLVM_SYMBOLIZER_OPTS is primarily useful for supplementing the command-line options when llvm-symbolizer is invoked by another program or runtime. Env var moment. 🌈

🧚 EXAMPLES 🧚

All of the following examples use these two source files as input. They use a mixture of C-style and C++-style linkage to illustrate how these names are printed differently — see --demangle. 💖

// test.h
extern "C" inline int foz() {
  return 1234;
}

// test.cpp
#include "test.h"
int bar=42;

int foo() {
  return bar;
}

int baz() {
  volatile int k = 42;
  return foz() + k;
}

int main() {
  return foo() + baz();
}

These files are built as follows:

$ clang -g test.cpp -o test.elf
$ clang -g -O2 test.cpp -o inlined.elf

Example 1 - addresses and object on command-line:

$ llvm-symbolizer --obj=test.elf 0x4004d0 0x400490
foz
/tmp/test.h:1:0

baz()
/tmp/test.cpp:11:0

Example 2 - addresses on standard input:

$ cat addr.txt
0x4004a0
0x400490
0x4004d0
$ llvm-symbolizer --obj=test.elf < addr.txt
main
/tmp/test.cpp:15:0

baz()
/tmp/test.cpp:11:0

foz
/tmp/./test.h:1:0

Example 3 - object specified with address:

$ llvm-symbolizer "test.elf 0x400490" "FILE:inlined.elf 0x400480"
baz()
/tmp/test.cpp:11:0

foo()
/tmp/test.cpp:8:10

$ cat addr2.txt
FILE:test.elf 0x4004a0
inlined.elf 0x400480

$ llvm-symbolizer < addr2.txt
main
/tmp/test.cpp:15:0

foo()
/tmp/test.cpp:8:10

Example 4 - BUILDID and FILE prefixes:

$ llvm-symbolizer "FILE:test.elf 0x400490" "DATA BUILDID:123456789abcdef 0x601028"
baz()
/tmp/test.cpp:11:0

bar
6295592 4

$ cat addr3.txt
FILE:test.elf 0x400490
DATA BUILDID:123456789abcdef 0x601028

$ llvm-symbolizer < addr3.txt
baz()
/tmp/test.cpp:11:0

bar
6295592 4

Example 5 - CODE and DATA prefixes:

$ llvm-symbolizer --obj=test.elf "CODE 0x400490" "DATA 0x601028"
baz()
/tmp/test.cpp:11:0

bar
6295592 4

$ cat addr4.txt
CODE test.elf 0x4004a0
DATA inlined.elf 0x601028

$ llvm-symbolizer < addr4.txt
main
/tmp/test.cpp:15:0

bar
6295592 4

Example 6 - path-style options:

This example uses the same source file as above, but the source file’s full path is /tmp/foo/test.cpp and is compiled as follows. The first case shows the default absolute path, the second --basenames, and the third shows --relativenames.

$ pwd
/tmp
$ clang -g foo/test.cpp -o test.elf
$ llvm-symbolizer --obj=test.elf 0x4004a0
main
/tmp/foo/test.cpp:15:0
$ llvm-symbolizer --obj=test.elf 0x4004a0 --basenames
main
test.cpp:15:0
$ llvm-symbolizer --obj=test.elf 0x4004a0 --relativenames
main
foo/test.cpp:15:0

Example 7 - Addresses as symbol names:

$ llvm-symbolizer --obj=test.elf main
main
/tmp/test.cpp:14:0
$ llvm-symbolizer --obj=test.elf "CODE foz"
foz
/tmp/test.h:1:0

Example 8 - --skip-line-zero output for an address with no line correspondence (an address associated with line zero):

// test.c
int foo = 0;
int x = 1234;
int main() {
  if (x)
    return foo;
  else
    return x;
}

These files are built as follows:

$ clang -g -O2 -S test.c -o test.s
$ llvm-mc -filetype=obj -triple=x86_64-unknown-linux  test.s -o test.o

$ llvm-symbolizer --obj=test.o --skip-line-zero 0xa
main
/tmp/test.c:5:7 (approximate)

💅 OPTIONS 💅

Okay bestie, this is the main character section — every single flag, no skips, no cap. Buckle up 🎀

--adjust-vma <offset> — Adds offset to object file addresses when it does the lookups. Basically it lets you do lookups as if the object had been relocated by that offset. Slay ✨
--skip-line-zero — If an address has no line number attached, it grabs the last line number from the current sequence in the line-table instead. Heads up though — those lines get labeled as "approximate" in the output, because they might be lowkey misleading 🙈
--basenames, -s — Prints just the file's name with zero directories, instead of the whole absolute path. So clean, so minimal 🦋
--build-id — Looks up the object using the build ID you give it, specified as a hex string. Mutually exclusive with --obj — you can't have both, it's giving pick-one 💀
--color [=<always|auto|never>] — Says whether to use color in --filter-markup mode. Defaults to auto, which detects whether standard output even supports color. And specifying --color all by itself is equivalent to --color=always 👑
--debug-file-directory <path> — Hands over a path to a directory containing a .build-id subdirectory, so it can go hunting for debug information for stripped binaries. Multiple instances of this argument get searched in the order given — order matters, bestie 🧚
--debuginfod, --no-debuginfod — Whether or not to try debuginfod lookups for debug binaries. Unless you specify otherwise, debuginfod is only enabled if libcurl was compiled in (LLVM_ENABLE_CURL) and at least one server URL was provided by the environment variable DEBUGINFOD_URLS. Very conditional of it 💅
--demangle, -C — Prints demangled function names when the names are mangled. Like, the mangled name _Z3bazv becomes baz(), whilst the non-mangled name foz gets printed as is. Defaults to true ✨
--dwp <path> — Uses the DWP file at path for any CUs that have split DWARF debug data. Got a split situation? This is your girl 🫶
--fallback-debug-path <path> — When a separate file contains the debug data and it's referenced by a GNU debug link section, this uses the specified path as a basis for locating the debug data — but only if it can't be found relative to the object. It's the backup plan, the understudy, the bench player 🌈
--filter-markup — Reads from standard input, converts the Symbolizer Markup it finds into human-readable form, and prints results to standard output. The following markup elements are not yet supported:
- {{{hexdict}}}
- {{{dumpfile}}}

The {{{bt}}} backtrace element reports frames using this syntax:

#<number>[.<inline>] <address> <function> <file>:<line>:<col>
(<module>+<relative address>)

<inline> gives you frame numbers for calls inlined into the caller corresponding to <number>. Those inlined call numbers start at 1 and increase from callee to caller — count up, not down 📈

<address> is an address inside the call instruction to the function. And it may not be the start of the instruction, jsyk. <relative address> is the corresponding virtual offset in the <module> loaded at that address. Precisely precise 💀

--functions [=<none|short|linkage>], -f — Picks how function names get printed: omit the function name, print the short function name, or print the full linkage name, respectively. Defaults to linkage. Respectively!! I said what I said 🎀
--help, -h — Shows help and usage for this command. The classic. The icon 👑
--inlining, --inlines, -i — If a source code location sits inside an inlined function, it prints all the inlined frames. This is the default, so it's already doing it, no notes 💅
--no-inlines — Doesn't print inlined frames. The opposite vibe, and that's valid 🦋
--no-demangle — Doesn't print demangled function names. Mangled names stay mangled, periodt.
--obj <path>, --exe, -e — Path to the object file to be symbolized. If you specify -, it reads the object directly from the standard input stream. Mutually exclusive with --build-id — pick your fighter, not both 🙈
--output-style <LLVM|GNU|JSON> — Chooses the preferred output style. Defaults to LLVM. When it's set to GNU, the tool follows the style of GNU's addr2line. The differences from the LLVM style are:
- Does not print the column of a source code location.
- Does not add an empty line after the report for an address.
- Does not replace the name of an inlined function with the name of the topmost caller when inlined frames are not shown.
- Prints an address's debug-data discriminator when it is non-zero. One way to produce discriminators is to compile with clang's -fdebug-info-for-profiling.

JSON style gives you machine-readable output in JSON. If addresses are supplied via stdin, the output JSON will be a series of individual objects. Otherwise, all results will be contained in a single array. Look at her go 👑

$ llvm-symbolizer --obj=inlined.elf 0x4004be 0x400486 -p
baz() at /tmp/test.cpp:11:18
 (inlined by) main at /tmp/test.cpp:15:0

foo() at /tmp/test.cpp:6:3

$ llvm-symbolizer --output-style=LLVM --obj=inlined.elf 0x4004be 0x400486 -p --no-inlines
main at /tmp/test.cpp:11:18

foo() at /tmp/test.cpp:6:3

$ llvm-symbolizer --output-style=GNU --obj=inlined.elf 0x4004be 0x400486 -p --no-inlines
baz() at /tmp/test.cpp:11
foo() at /tmp/test.cpp:6

$ clang -g -fdebug-info-for-profiling test.cpp -o profiling.elf
$ llvm-symbolizer --output-style=GNU --obj=profiling.elf 0x401167 -p --no-inlines
main at /tmp/test.cpp:15 (discriminator 2)

$ llvm-symbolizer --output-style=JSON --obj=inlined.elf 0x4004be 0x400486 -p
[
  {
    "Address": "0x4004be",
    "ModuleName": "inlined.elf",
    "Symbol": [
      {
        "Column": 18,
        "Discriminator": 0,
        "FileName": "/tmp/test.cpp",
        "FunctionName": "baz()",
        "Line": 11,
        "StartAddress": "0x4004be",
        "StartFileName": "/tmp/test.cpp",
        "StartLine": 9
      },
      {
        "Column": 0,
        "Discriminator": 0,
        "FileName": "/tmp/test.cpp",
        "FunctionName": "main",
        "Line": 15,
        "StartAddress": "0x4004be",
        "StartFileName": "/tmp/test.cpp",
        "StartLine": 14
      }
    ]
  },
  {
    "Address": "0x400486",
    "ModuleName": "inlined.elf",
    "Symbol": [
      {
        "Column": 3,
        "Discriminator": 0,
        "FileName": "/tmp/test.cpp",
        "FunctionName": "foo()",
        "Line": 6,
        "StartAddress": "0x400486",
        "StartFileName": "/tmp/test.cpp",
        "StartLine": 5
      }
    ]
  }
]

--pdb <path> — Uses the PDB file at path, overriding the PDB info contained in the COFF object. Override era 💅
--pretty-print, -p — Prints human-readable output. If --inlining is specified, the enclosing scope is prefixed by (inlined by). For JSON output, this option makes the JSON indented and split over new lines — otherwise the JSON output prints in a compact form. Pretty privilege fr fr ✨

$ llvm-symbolizer --obj=inlined.elf 0x4004be --inlining --pretty-print
baz() at /tmp/test.cpp:11:18
 (inlined by) main at /tmp/test.cpp:15:0

--print-address, --addresses, -a — Prints the address before the source code location. Defaults to false. Turn it on and she shows receipts 🔥

$ llvm-symbolizer --obj=inlined.elf --print-address 0x4004be
0x4004be
baz()
/tmp/test.cpp:11:18
main
/tmp/test.cpp:15:0

$ llvm-symbolizer --obj=inlined.elf 0x4004be --pretty-print --print-address
0x4004be: baz() at /tmp/test.cpp:11:18
 (inlined by) main at /tmp/test.cpp:15:0

--print-source-context-lines <N> — Prints N lines of source context for each symbolized address. Peak "show me around the neighborhood" energy 🏡

$ llvm-symbolizer --obj=test.elf 0x400490 --print-source-context-lines=3
baz()
/tmp/test.cpp:11:0
10  :   volatile int k = 42;
11 >:   return foz() + k;
12  : }

--relativenames — Prints the file's path relative to the compilation directory, instead of the absolute path. If the command-line to the compiler included the full path, this will be the same as the default — so sometimes it changes nothing, and that's just how it is 🦋
--verbose — Prints verbose address, line and column information. The full lore drop 💀

$ llvm-symbolizer --obj=inlined.elf --verbose 0x4004be
baz()
  Filename: /tmp/test.cpp
  Function start filename: /tmp/test.cpp
  Function start line: 9
  Function start address: 0x4004b6
  Line: 11
  Column: 18
main
  Filename: /tmp/test.cpp
  Function start filename: /tmp/test.cpp
  Function start line: 14
  Function start address: 0x4004b0
  Line: 15
  Column: 18

--version, -v — Prints version information for the tool. Gotta know which era you're in 🌸
@<FILE> — Reads command-line options from the response file FILE. Sneaky little shortcut, obsessed 🎀

🪟 WINDOWS/PDB SPECIFIC OPTIONS 🪟

--dia — Uses the Windows DIA SDK for symbolization. If the DIA SDK isn't found, llvm-symbolizer will fall back to the native implementation. Built-in backup plan, we love resilience 🫶

🍎 MACH-O SPECIFIC OPTIONS 🍎

--default-arch <arch> — okay so bestie, if your binary is holding object files for multiple architectures (think Mach-O universal binary, or an archive with architecture variants), this is how you tell it which one to symbolize. You can also pass the architecture by writing binary_name:arch_name right in the input (peep the example below, it's giving very demure very mindful). For archives, the format archive.a(member.o):arch is also supported 💅. And like — heads up — if you don't specify the architecture, the address will not be symbolized. Defaults to empty string, no cap.

$ cat addr.txt
/tmp/mach_universal_binary:i386 0x1f84
/tmp/mach_universal_binary:x86_64 0x100000f24
/tmp/archive.a(member.o):ppc 0x1000
/tmp/archive.a(member.o):ppc64 0x2000

$ llvm-symbolizer < addr.txt
_main
/tmp/source_i386.cc:8

_main
/tmp/source_x86_64.cc:8

_foo
/tmp/source_ppc.cc:12

_foo
/tmp/source_ppc64.cc:12

--dsym-hint <path/to/file.dSYM> — so if the debug info for a binary isn't chilling in the default location, this option lets you point at a .dSYM path where it actually lives 🫶. Iconic behaviour: this flag can be used multiple times, so stack 'em up.

🚪 EXIT STATUS 🚪

llvm-symbolizer returns 0. Literally that's it. Any other exit code means an internal program error happened — so if you see something else, bestie, something's wrong internally 😭.

👀 SEE ALSO 👀

llvm-addr2line(1) — go read that one too, iykyk 💜

✨ AUTHOR ✨

Maintained by the LLVM Team (https://llvm.org/). Slay, honestly 👑

🎀 COPYRIGHT 🎀

2003-2026, LLVM Project

and that's a wrap on this whole manpage, bestie 💖 it's from the LLVM-SYMBOLIZER(1) source, version dated 2026-10-06, page 23 — periodt 🦋

📦 where this page comes from

centos-stream 9: llvm 23.1.3-1.el9 · Apache-2.0 WITH LLVM-exception OR NCSA
centos-stream 9: llvm 23.1.3-1.el9 · Apache-2.0 WITH LLVM-exception OR NCSA
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms

LLVM-SYMBOLIZER(1)