OBJDUMP(1)

💖 OBJDUMP(1) 💖

okay bestie, we're doing a GNU Development Tools classic today — it's objdump, and she's an iconic one 💅

---

✨ NAME ✨

objdump — display information from object files 🫶

---

🌸 SYNOPSIS 🌸

objdump [-a|--archive-headers]
        [-b bfdname|--target=bfdname]
        [-C|--demangle[=style] ]
        [-d|--disassemble[=symbol]]
        [-D|--disassemble-all]
        [-z|--disassemble-zeroes]
        [-EB|-EL|--endian={big | little }]
        [-f|--file-headers]
        [-F|--file-offsets]
        [--file-start-context]
        [-g|--debugging]
        [-e|--debugging-tags]
        [-h|--section-headers|--headers]
        [-i|--info]
        [-j section|--section=section]
        [-l|--line-numbers]
        [-S|--source]
        [--source-comment[=text]]
        [-m machine|--architecture=machine]
        [-M options|--disassembler-options=options]
        [-p|--private-headers]
        [-P options|--private=options]
        [-r|--reloc]
        [-R|--dynamic-reloc]
        [-s|--full-contents]
        [-Z|--decompress]
        [-W|--dwarf]
        [-Wa|--dwarf=abbrev]
        [-WA|--dwarf=addr]
        [-Wr|--dwarf=aranges]
        [-Wc|--dwarf=cu_index]
        [-WL|--dwarf=decodedline]
        [-Wf|--dwarf=frames]
        [-WF|--dwarf=frames-interp]
        [-Wg|--dwarf=gdb_index]
        [-Wi|--dwarf=info]
        [-Wk|--dwarf=links]
        [-Wo|--dwarf=loc]
        [-Wm|--dwarf=macro]
        [-Wp|--dwarf=pubnames]
        [-Wt|--dwarf=pubtypes]
        [-WR|--dwarf=Ranges]
        [-Wl|--dwarf=rawline]
        [-Ws|--dwarf=str]
        [-WO|--dwarf=str-offsets]
        [-Wu|--dwarf=trace_abbrev]
        [-WT|--dwarf=trace_aranges]
        [-WU|--dwarf=trace_info]
        [-WK|--dwarf=follow-links]
        [-WN|--dwarf=no-follow-links]
        [-WD|--dwarf=use-debuginfod]
        [-WE|--dwarf=do-not-use-debuginfod]
        [--debug-dir=dir]
        [--map-global-vars]
        [-L|--process-links]
        [--ctf=section]
        [--sframe=section]
        [-G|--stabs]
        [-t|--syms]
        [-T|--dynamic-syms]
        [-x|--all-headers]
        [-w|--wide]
        [--start-address=address]
        [--stop-address=address]
        [--no-addresses]
        [--prefix-addresses]
        [--[no-]show-raw-insn]
        [--adjust-vma=offset]
        [--show-all-symbols]
        [--dwarf-depth=n]
        [--dwarf-start=n]
        [--ctf-parent=section]
        [--no-recurse-limit|--recurse-limit]
        [--special-syms]
        [--prefix=prefix]
        [--prefix-strip=level]
        [--insn-width=width]
        [--visualize-jumps[=color|=extended-color|=off]
        [--disassembler-color=[off|terminal|on|extended]
        [-U method] [--unicode=method]
        [-V|--version]
        [-H|--help]
        objfile...

---

🦋 DESCRIPTION 🦋

so objdump is literally your girl for displaying information about one or more object files. the options? they control what particular info she shows you, periodt.

ngl this info is mostly for the programmers who are out here working on the compilation tools themselves — not the ones who just want their program to compile and work, iykyk 🧚

objfile... are the object files you want examined. and when you hand her archives? she shows info on each of the member object files one by one 💖

---

👑 OPTIONS 👑

the long and short forms of options are shown here as alternatives, and bestie, they are equivalent — pick whichever one vibes with you.

literally at least one option from this list must be given: -a, -d, -D, -e, -f, -g, -G, -h, -H, -p, -P, -r, -R, -s, -S, -t, -T, -V, -x. no options, no info, fr fr 😭

• -a, --archive-header — if any of the objfile files are archives, show the archive header info in a format kinda like ls -l. and besides the stuff you could already list with ar tv, objdump -a also shows the object file format of each archive member ✨
• --adjust-vma=offset — when dumping, first add offset to all the section addresses. this hits different when the section addresses don't correspond to the symbol table, which can happen when you're putting sections at particular addresses using a format that can't represent section addresses — like a.out, bestie, she's going through it 💀
• -b bfdname, --target=bfdname — tell her the object-code format for the object files is bfdname. lowkey you might not even need this, objdump can auto-recognize many formats on her own 💅

like for example:

objdump -b oasys -m vax -h fu.o

this displays summary info from the section headers (-h) of fu.o, which is explicitly identified (-m) as a VAX object file in the format produced by Oasys compilers. and if you wanna see the formats available? just hit her with -i 🌈

• -C, --demangle[=style] — decode (demangle) those low-level symbol names into user-level names. besides removing any initial underscore that the system prepended, this makes C++ function names readable 🙈. different compilers have different mangling styles, so the optional demangling style argument lets you choose the right demangling style for your compiler 🎀
• --recurse-limit, --no-recurse-limit, --recursion-limit, --no-recursion-limit — turns a limit on the amount of recursion done while demangling strings on or off. here's the tea: since the name mangling formats allow for an infinite level of recursion, it's possible to create strings whose decoding will exhaust the stack space available on the host machine, triggering a memory fault 😭. the limit tries to stop that from happening by restricting recursion to 2048 levels of nesting.

the default is for this limit to be enabled, but disabling it may be necessary if you gotta demangle truly complicated names. note however that if the recursion limit is disabled then stack exhaustion is possible, and any bug reports about such an event will be rejected. periodt. 🚫

• -g, --debugging — display debugging information. she attempts to parse STABS debugging format info stored in the file and print it out using a C-like syntax 💜. if no STABS debugging was found, this option falls back on the -W option to print any DWARF information in the file.
• -e, --debugging-tags — like -g, but the information is generated in a format compatible with the ctags tool 🏷️
• -d, --disassemble, --disassemble=symbol — display the assembler mnemonics for the machine instructions from the input file ✨. this option only disassembles those sections that are expected to contain instructions. if the optional symbol argument is given (maybe multiple times!), then display the assembler mnemonics starting at (all the) symbol. if symbol is a function name then disassembly stops at the end of the function; otherwise it stops when the next symbol is encountered. and if there are no matches for any symbol, nothing will be displayed 🙈

note: if the --dwarf=follow-links option is enabled, then any symbol tables in linked debug info files will be read in and used when disassembling 👑

• -D, --disassemble-all — like -d, but disassemble the contents of all non-empty non-bss sections, not just the ones expected to contain instructions. -j may be used to select specific sections 💅

this option also has a subtle effect on the disassembly of instructions in code sections. when option -d is in effect, objdump will assume that any symbols present in a code section occur on the boundary between instructions, and she will refuse to disassemble across such a boundary 😤. when option -D is in effect however, this assumption is suppressed. this means it's possible for the output of -d and -D to differ if, for example, data is stored in code sections 💀

if the target is an ARM architecture, this switch also has the effect of forcing the disassembler to decode pieces of data found in code sections as if they were instructions 🔥

note: if the --dwarf=follow-links option is enabled, then any symbol tables in linked debug info files will be read in and used when disassembling 👑

• --no-addresses — when disassembling, don't print addresses on each line or for symbols and relocation offsets. in combination with --no-show-raw-insn this may be useful for comparing compiler output 🌸
• --prefix-addresses — when disassembling, print the complete address on each line. this is the older disassembly format 🕰️
• -EB, -EL, --endian={big|little} — specify the endianness of the object files. this only affects disassembly. can be useful when disassembling a file format which doesn't describe endianness information, such as S-records 🦋
• -f, --file-headers — display summary info from the overall header of each of the objfile files 💖
• -F, --file-offsets — when disassembling sections, whenever a symbol is displayed, also display the file offset of the region of data that's about to be dumped. if zeroes are being skipped, then when disassembly resumes, tell the user how many zeroes were skipped and the file offset of the location from where the disassembly resumes. and when dumping sections, display the file offset of the location from where the dump starts ✨
• --file-start-context — specify that when displaying interlisted source code/disassembly (assumes -S) from a file that hasn't been displayed yet, extend the context to the start of the file 🌈
• -h, --section-headers, --headers — display summary info from the section headers of the object file 👑

file segments may be relocated to nonstandard addresses, for example by using the -Ttext, -Tdata, or -Tbss options to ld. however, some object file formats — like a.out — do not store the starting address of the file segments 💀. in those situations, although ld relocates the sections correctly, using objdump -h to list the file section headers cannot show the correct addresses. instead, it shows the usual addresses, which are implicit for the target.

note: in some cases it's possible for a section to have both the READONLY and the NOREAD attributes set. in such cases the NOREAD attribute takes precedence, but objdump will report both, since the exact setting of the flag bits might be important 🙈

• -H, --help — print a summary of the options to objdump and exit 🫶
• -i, --info — display a list showing all architectures and object formats available for specification with -b or -m 💅
• -j name, --section=name — babe, show me what's happening in section name. and you can say it as many times as you want, one section per -j 💖
• --map-global-vars — spills all the global variable info. it's giving "where does every global variable live and what type is it", and it's genuinely so useful for tracking that down in the object file you handed over. ⚠️ but heads up: this ONLY works when the object file was compiled with the debug option. more precisely, it relies on DWARF2 debug information entries. no debug info, no map. periodt.
• -L, --process-links — shows you the contents of non-debug sections that are hanging out in separate debuginfo files linked to the main file. the way this one works: it automatically implies the -WK option, and only the sections you actually requested via other command line options will be displayed. nothing extra, nothing sneaky. 🎀
• -l, --line-numbers — labels the display with the filename and source line numbers that line up with the object code or relocs being shown, using debugging information to figure it out. only useful with -d, -D, or -r, bestie — don't expect magic without one of those. ✨
• -m machine, --architecture=machine — tells objdump which architecture to use when disassembling. highkey a lifesaver when you're disassembling object files that don't describe their own architecture info, like S-records. wanna see what architectures you've got? run -i and it'll list them all out for you. 🦋

For most architectures you can supply an architecture name AND a machine name, separated by a colon. so foo:bar would refer to the bar machine type in the foo architecture. super helpful if objdump has been configured to support multiple architectures — which, slay. 👑

If the target is an ARM architecture then this switch hits different — it has an additional effect. it restricts the disassembly to only those instructions supported by the architecture specified by machine. now if you NEED this switch because the input file doesn't contain any architecture information, but you also want to disassemble all the instructions, just use -marm. problem solved, you're welcome. 💅

• -M options, --disassembler-options=options — passes target specific information through to the disassembler. only supported on some targets, ngl. if you need to specify more than one disassembler option, you can stack multiple -M options, or you can place them together into a comma separated list. do whatever feels right. 🌸
  • ARC — dsp controls the printing of DSP instructions. spfp selects the printing of FPX single precision FP instructions. dpfp selects the printing of FPX double precision FP instructions. quarkse_em selects the printing of special QuarkSE-EM instructions. fpuda selects the printing of double precision assist instructions. fpus selects the printing of FPU single precision FP instructions, while fpud selects the printing of FPU double precision FP instructions. additionally, you can choose to have all the immediates printed in hexadecimal using hex. by default the short immediates are printed using the decimal representation, while the long immediate values are printed as hexadecimal. that's just how it vibes. 🔥
  • ARC cpu=... — lets you enforce a particular ISA when disassembling instructions, overriding the -m value or whatever's sitting in the ELF file. this might be useful to select ARC EM or HS ISA, because the architecture is the same for those and the disassembler relies on private ELF header data to decide if the code is for EM or HS. this option might be specified multiple times — but only the latest value will be used, sorry bestie. valid values are the same as for the assembler's -mcpu=... option.
  • ARM — this switch can be used to select which register name set is used during disassembly. specifying -M reg-names-std (the default) will select the register names as used in ARM's instruction set documentation, but with register 13 called sp, register 14 called lr and register 15 called pc. specifying -M reg-names-apcs will select the name set used by the ARM Procedure Call Standard, whilst specifying -M reg-names-raw will just use r followed by the register number. pick your fighter. 🥊
  • There are also two variants on the APCS register naming scheme, enabled by -M reg-names-atpcs and -M reg-names-special-atpcs, which use the ARM/Thumb Procedure Call Standard naming conventions. (either with the normal register names or the special register names — dealer's choice.)
  • On ARM architectures this option can also force the disassembler to interpret all instructions as Thumb instructions by using the switch --disassembler-options=force-thumb. lowkey iconic when you're trying to disassemble thumb code produced by other compilers.
  • AArch64 — this switch can be used to set whether instructions are disassembled as the most general instruction using the -M no-aliases option, or whether instruction notes should be generated as comments in the disassembly using -M notes. in addition the -M annotate option can be used to customise the handling of undefined instructions when disassembling executables and shared libraries. normally the disassembler will just show the hexadecimal value of the undefined instruction, but if annotation is enabled it will first try to find a symbol whose value matches the instruction's encoding. if there's a match then the symbol name will be displayed instead. super useful when disassembling non-code sections which may contain function and data addresses. 🙈
  • x86 — some of these options duplicate functions of the -m switch, but they allow finer grained control. the range is giving options-on-options:
    • "x86-64", "i386", "i8086" — select disassembly for the given architecture.
    • "intel", "att" — select between intel syntax mode and AT&T syntax mode.
    • "amd64", "intel64" — select between AMD64 ISA and Intel64 ISA.
    • "intel-mnemonic", "att-mnemonic" — select between intel mnemonic mode and AT&T mnemonic mode. note: "intel-mnemonic" implies "intel" and "att-mnemonic" implies "att".
    • "addr64", "addr32", "addr16", "data32", "data16" — specify the default address size and operand size. these five options will be overridden if "x86-64", "i386" or "i8086" appear later in the option string, so order matters, bestie.
    • "suffix" — when in AT&T mode, and also for a limited set of instructions when in Intel mode, instructs the disassembler to print a mnemonic suffix even when the suffix could be inferred by the operands or, for certain instructions, the execution mode's defaults.
    • "annotate-immediates" — display the symbol associated with immediate values, should there be one. only works on executable binaries and shared libraries, not static object files. don't @ me, that's just the rule. 💀
  • PowerPC — the -M argument raw selects disassembly of hardware insns rather than aliases. for example, you will see "rlwinm" rather than "clrlwi", and "addi" rather than "li". all of the -m arguments for gas that select a CPU are supported. these are: 403, 405, 440, 464, 476, 601, 603, 604, 620, 7400, 7410, 7450, 7455, 750cl, 821, 850, 860, a2, booke, booke32, cell, com, e200z2, e200z4, e300, e500, e500mc, e500mc64, e500x2, e5500, e6500, efs, power4, power5, power6, power7, power8, power9, power10, power11, ppc, ppc32, ppc64, ppc64bridge, ppcps, pwr, pwr2, pwr4, pwr5, pwr5x, pwr6, pwr7, pwr8, pwr9, pwr10, pwr11, pwrx, titan, vle, and future. that's a whole alphabet of CPUs, we love to see it.
  • 32 and 64 modify the default or a prior CPU selection, disabling and enabling 64-bit insns respectively. in addition, altivec, any, lsp, htm, vsx, spe and spe2 add capabilities to a previous or later CPU selection. any will disassemble any opcode known to binutils, but in cases where an opcode has two different meanings or different arguments, you may not see the disassembly you expect. if you disassemble without giving a CPU selection, a default will be chosen from information gleaned by BFD from the object files headers — but the result again may not be as you expect. so like… vibe check your output, fr fr. 😭
  • RISC-V — the following options are supported:
    • "max" — disassemble without checking architecture string. this is a best effort mode, so for overlapping ISA extensions the first match (possibly incorrect in a given context) will be used to decode the instruction. it's useful if the ELF file doesn't expose ISA string, preventing automatic ISA subset deduction, and the default fallback ISA string ("rv64gc") doesn't cover all instructions in the binary.
    • "numeric" — print numeric register names, rather than ABI names (e.g., print "x2" instead of "sp").
    • "no-aliases" — disassemble only into canonical instructions. for example, compressed instructions will be represented as such ("addi sp,sp,-128" will be "c.addi16sp sp,-128").
    • "priv-spec=SPEC" — print the CSR according to the chosen privilege spec version (e.g., 1.10, 1.11, 1.12, 1.13).
  • MIPS — this option controls the printing of instruction mnemonic names and register names in disassembled instructions. multiple selections from the following may be specified as a comma separated string, and invalid options are ignored (iconic, honestly — no crash, no drama). 🌈
    • "no-aliases" — print the 'raw' instruction mnemonic instead of some pseudo instruction mnemonic. i.e., print 'daddu' or 'or' instead of 'move', 'sll' instead of 'nop', etc.
    • "msa" — disassemble MSA instructions.
    • "virt" — disassemble the virtualization ASE instructions.
    • "xpa" — disassemble the eXtended Physical Address (XPA) ASE instructions.
    • "gpr-names=ABI" — print GPR (general-purpose register) names as appropriate for the specified ABI. by default, GPR names are selected according to the ABI of the binary being disassembled.
    • "fpr-names=ABI" — print FPR (floating-point register) names as appropriate for the specified ABI. by default, FPR numbers are printed rather than names.
    • "cp0-names=ARCH" — print CP0 (system control coprocessor; coprocessor 0) register names as appropriate for the CPU or architecture specified by ARCH. by default, CP0 register names are selected according to the architecture and CPU of the binary being disassembled.
• hwr-names=ARCH — this one prints the HWR names (hardware register, the whole thing the rdhwr instruction is obsessed with) matched up to whatever CPU or architecture you put in ARCH. If you don't say anything? It just vibes and picks HWR names based on the architecture + CPU of the binary you're disassembling. 💅
  • reg-names=ABI — prints GPR and FPR names for the ABI you selected. ✨
  • reg-names=ARCH — prints the CPU-specific register names (that's CP0 registers and HWR names, bestie) for the CPU/architecture you picked. 💖

For literally all of the options above ⬆️ you can pass ABI or ARCH as a number instead of a name, and you'll get numbers printed instead of names for whichever register types you asked about. And if you wanna know what ABI and ARCH values even exist? Just hit up the --help option. 🫶

For VAX, you can hand over function entry addresses with -M entry:0xf00ba. Not me being able to use that multiple times to properly disassemble VAX binary files that have no symbol tables (ROM dumps, iykyk). Because otherwise the function entry mask gets decoded as VAX instructions, which would probably lead to the rest of the function being wrongly disassembled. 💀 so yeah, use it more than once, be that girl.

• -p, --private-headers — prints info specific to the object file format. What exactly gets printed depends on the object file format in question, and for some formats literally no additional information is printed. It's giving mysterious. 🙈
• -P options, --private=options — prints info that's specific to the object file format. options is a comma separated list that depends on the format (the lists of options is displayed with the help). 📋

For XCOFF, the available options are:

• header
• aout
• sections
• syms
• relocs
• lineno,
• loader
• except
• typchk
• traceback
• toc
• ldinfo

For PE, the available options are:

• header
• sections

Not all object formats support this option, fr fr. In particular the ELF format does not use it. 🚫

• -r, --reloc — prints the relocation entries of the file. And if you pair it with -d or -D, the relocations get printed interspersed with the disassembly. Like a little collab. 🤝✨
• -R, --dynamic-reloc — prints the dynamic relocation entries of the file. This is only meaningful for dynamic objects, like certain types of shared libraries. Same deal as -r: if used with -d or -D, the relocations are printed interspersed with the disassembly. 💫

Note: objdump does not support displaying RELR type relocations. Those can be displayed by the readelf program. No shade, just facts. 😭

• -s, --full-contents — displays the full contents of sections, often used in combination with -j to request specific sections. By default all non-empty non-bss sections are displayed. By default any compressed section will be displayed in its compressed form. And if you wanna see the contents in a decompressed form, just add the -Z option to the command line. Unzip that vibe. 🦋
• -S, --source — displays source code intermixed with the disassembly, if possible. Implies -d. She said "I come with friends." 👑
• --show-all-symbols — when disassembling, show all the symbols that match a given address, not just the first one. Equal opportunity symbol representation. 🌈
• --source-comment[=txt] — like the -S option, but all source code lines are displayed with a prefix of txt. Typically txt will be a comment string, which you can use to distinguish the assembler code from the source code. If txt isn't provided then a default string of # (hash followed by a space) gets used. Lowkey elegant. 💅
• --prefix=prefix — specify prefix to add to the absolute paths when used with -S. 🎀
• --prefix-strip=level — indicate how many initial directory names to strip off the hardwired absolute paths. Heads up bestie: it has no effect without --prefix=prefix. Periodt.
• --show-raw-insn — when disassembling instructions, print the instruction in hex as well as in symbolic form. This is the default except when --prefix-addresses is used. 🔥
• --no-show-raw-insn — when disassembling instructions, do not print the instruction bytes. This is the default when --prefix-addresses is used. ✨
• --insn-width=width — display width bytes on a single line when disassembling instructions. 📏
• --visualize-jumps[=color|=extended-color|=off] — visualize jumps that stay inside a function by drawing ASCII art between the start and target addresses. The way that it just draws?? The optional =color argument adds color to the output using simple terminal colors. Alternatively the =extended-color argument will add color using 8bit colors, but these might not work on all terminals. 😬

If it's necessary to disable the visualize-jumps option after it has previously been enabled, then use visualize-jumps=off. 🛑

• --disassembler-color=off
• --disassembler-color=terminal
• --disassembler-color=on|color|colour
• --disassembler-color=extended|extended-color|extended-colour

Enables or disables the use of colored syntax highlighting in disassembly output. The default behaviour is determined via a configure time option. Note, not all architectures support colored syntax highlighting, and depending upon the terminal used, colored output may not actually be legible. 🙈

The on argument adds colors using simple terminal colors. 🎨

The terminal argument does the same, but only if the output device is a terminal. 🖥️

The extended-color argument is similar to the on argument, but it uses 8-bit colors. These may not work on all terminals. ⚠️

The off argument disables colored disassembly. 💀

• -W[lLiaprmfFsoORtUuTgAckK]
• --dwarf[=rawline,=decodedline,=info,=abbrev,=pubnames,=aranges,=macro,=frames,=frames-interp,=str,=str-offsets,=loc,=Ranges,=pubtypes,=trace_info,=trace_abbrev,=trace_aranges,=gdb_index,=addr,=cu_index,=links,=follow-links]

Displays the contents of the DWARF debug sections in the file, if any are present. Compressed debug sections are automatically decompressed (temporarily) before they are displayed — like, she unpacks herself and then repacks, iconic behaviour. ✨ If one or more of the optional letters or words follows the switch, then only those type(s) of data will be dumped. The letters and words refer to the following info:

• a, =abbrev — displays the contents of the .debug_abbrev section. 🔤
• A, =addr — displays the contents of the .debug_addr section. 📍
• c, =cu_index — displays the contents of the .debug_cu_index and/or .debug_tu_index sections. 🗂️
• f, =frames — display the raw contents of a .debug_frame section. 🦴
• F, =frames-interp — display the interpreted contents of a .debug_frame section. 🔍
• g, =gdb_index — displays the contents of the .gdb_index and/or .debug_names sections. 💜
• i, =info — displays the contents of the .debug_info section. Note: the output from this option can also be restricted by the use of the --dwarf-depth and --dwarf-start options. 📚
• k, =links — displays the contents of the .gnu_debuglink, .gnu_debugaltlink and .debug_sup sections, if any of them are present. Also displays any links to separate dwarf object files (dwo), if they are specified by the DW_AT_GNU_dwo_name or DW_AT_dwo_name attributes in the .debug_info section. 🔗
• K, =follow-links — display the contents of any selected debug sections that are found in linked, separate debug info file(s). This can result in multiple versions of the same debug section being displayed if it exists in more than one file. 😵‍💫

In addition, when displaying DWARF attributes, if a form is found that references the separate debug info file, then the referenced contents will also be displayed. 👀

Note — in some distributions this option is enabled by default. It can be disabled via the N debug option. The default can be chosen when configuring the binutils via the --enable-follow-debug-links=yes or --enable-follow-debug-links=no options. If these are not used then the default is to enable the following of debug links. ⚙️

Note — if support for the debuginfod protocol was enabled when the binutils were built, then this option will also include an attempt to contact any debuginfod servers mentioned in the DEBUGINFOD_URLS environment variable. This could take some time to resolve. 😴 This behaviour can be disabled via the =do-not-use-debuginfod debug option. 🚫

• N, =no-follow-links — disables the following of links to separate debug info files. 🛑
• D, =use-debuginfod — enables contacting debuginfod servers if there is a need to follow debug links. This is the default behaviour. ✅
• E, =do-not-use-debuginfod — disables contacting debuginfod servers when there is a need to follow debug links. ❌
• l, =rawline — displays the contents of the .debug_line section in a raw format. 📄
• L, =decodedline — displays the interpreted contents of the .debug_line section. 🧠
• m, =macro — displays the contents of the .debug_macro and/or .debug_macinfo sections. 🧩
• o, =loc — displays the contents of the .debug_loc and/or .debug_loclists sections. 📌
• O, =str-offsets — displays the contents of the .debug_str_offsets section. 📐
• p, =pubnames — displays the contents of the .debug_pubnames and/or .debug_gnu_pubnames sections. 📣
• r, =aranges — displays the contents of the .debug_aranges section. 📊
• R, =Ranges — displays the contents of the .debug_ranges and/or .debug_rnglists sections. 📈
• s, =str — displays the contents of the .debug_str, .debug_line_str and/or .debug_str_offsets sections. 🔤
• t, =pubtype — displays the contents of the .debug_pubtypes and/or .debug_gnu_pubtypes sections. 🏷️
• T, =trace_aranges — displays the contents of the .trace_aranges section. 🌀
• u, =trace_abbrev — displays the contents of the .trace_abbrev section. 🌸
• U, =trace_info — displays the contents of the .trace_info section. 💫

• --dwarf-depth=n — caps how deep the dump of the .debug_info section goes, at n children. only useful with --debug-dump=info. default is ✨all the DIEs✨ (and n = 0 gives you that same all-you-can-eat behaviour, no cap). but if you give n a non-zero value, any DIE sitting at or deeper than n levels just... doesn't get printed. range for n starts at zero, so it's zero-based, bestie.
• --dwarf-start=n — only print DIEs starting from the one numbered n. also only useful with --debug-dump=info. if you use it, it suppresses any header info and every DIE before number n, so you only get the siblings and children of the DIE you named. plays super nicely together with --dwarf-depth.
• --dwarf-check — turns on extra consistency checks for the Dwarf info. hi bestie, we're double-checking 💅
• --debug-dir=dir — search dir when it goes hunting for separate debug info files.
• --ctf[=section] — shows you the contents of the CTF section you pick. CTF sections are lowkey a whole stack of subsections inside, and they all get displayed in order. by default you get the section named .ctf, because that's the name ld emits. 🦋
• --ctf-parent=member — okay so, if a CTF section has ambiguously-defined types, it'll be an archive of many CTF dictionaries, all inheriting from one dictionary that holds the unambiguous types. that member is by default named .ctf, just like the section containing it — but you can rename it at link time with the "ctf_link_set_memb_name_changer" function. so when you're staring at CTF archives made by a linker that used the name changer, --ctf-parent lets you say what the parent archive member is actually called now.
• --ctf-parent-section=section — this one lets you pick a completely different section for the CTF parent dictionary (the unambiguous types) than the one holding the child dictionaries (the ambiguous remainder). the linker doesn't emit ELF objects structured like this, but some third-party linkers might. it's also just convenient for inspecting CTF that's been written out as multiple raw files so you can compose them with objcopy — objcopy can put them in different ELF sections, but it can't put them in different members of one single CTF dict. periodt.
• --sframe[=section] — displays the contents of the SFrame section you specify. by default it shows the section named .sframe, which is the name ld emits. 🎀
• -G, --stabs — displays the full contents of any requested sections. it shows the contents of the .stab, .stab.index and .stab.excl sections from an ELF file. this is only useful on systems (like Solaris 2.0, yeah, that Solaris) where ".stab" debugging symbol-table entries live inside an ELF section. in most other file formats those debugging symbol-table entries are interleaved with linkage symbols and you can just see them in the --syms output anyway.
• --start-address=address — start showing data at address. this affects the output of -d, -r and -s.
• --stop-address=address — stop showing data at address. this affects the output of -d, -r and -s.
• -t, --syms — prints the symbol table entries of the file. it's similar to what nm gives you, though the display format is different. the format depends on the file format you're dumping, but there are two main flavours. one looks like this:

[  4](sec  3)(fl 0x00)(ty   0)(scl   3) (nx 1) 0x00000000 .bss
[  6](sec  1)(fl 0x00)(ty   0)(scl   2) (nx 0) 0x00000000 fred

where the number inside the square brackets is the entry's number in the symbol table, sec is the section number, fl is the symbol's flag bits, ty is the symbol's type, scl is the symbol's storage class, and nx is how many auxiliary entries are attached to the symbol. the last two fields are the symbol's value and its name. ✨

the other common format, usually what you see with ELF based files, looks like this:

00000000 l    d  .bss   00000000 .bss
00000000 g       .text  00000000 fred

here the first number is the symbol's value (sometimes called its address). next field is actually a little set of characters and spaces showing which flag bits are set on the symbol — those characters are described below, don't worry. then comes the section the symbol is associated with, or *ABS* if the section is absolute (like, not connected to any section at all), or *UND* if the section is referenced in the file you're dumping but not defined there. after the section name comes another field, a number, which is the alignment for common symbols and the size for any other symbol. and finally, the symbol's name. 🫶

the flag characters split into 7 groups, bestie, here we go:

• "l", "g", "u", "!" — the symbol is local (l), global (g), unique global (u), neither global nor local (a space), or both global and local (!). a symbol can end up neither local nor global for loads of reasons, e.g. because it's used for debugging — but if it's ever both local and global, that's probably a bug fr. unique global symbols are a GNU extension to the standard set of ELF symbol bindings, and for one of those the dynamic linker makes sure there's just one symbol with that name and type in use across the entire process. no cap.
• "w" — the symbol is weak (w) or strong (a space).
• "C" — the symbol denotes a constructor (C) or it's an ordinary symbol (a space).
• "W" — the symbol is a warning (W) or a normal symbol (a space). a warning symbol's name is literally a message to be displayed if the symbol following the warning symbol is ever referenced. iconic behaviour honestly.
• "I", "i" — the symbol is an indirect reference to another symbol (I), a function to be evaluated during reloc processing (i), or a normal symbol (a space).
• "d", "D" — the symbol is a debugging symbol (d), a dynamic symbol (D), or a normal symbol (a space).
• "F", "f", "O" — the symbol is the name of a function (F), a file (f), an object (O), or just a normal symbol (a space).
• -T, --dynamic-syms — prints the dynamic symbol table entries of the file. only meaningful for dynamic objects, like certain types of shared libraries. similar to what nm tells you when you hand it the -D (--dynamic) option. the output format is like the one --syms produces, except an extra field gets wedged in before the symbol's name giving you the version info attached to the symbol. if the version is the default one used when resolving unversioned references to that symbol, it's displayed as-is; otherwise it gets wrapped in parentheses.
• --special-syms — when displaying symbols, also include the ones the target considers special in some way, the ones that normally wouldn't be interesting to you. 👑
• -U [d|i|l|e|x|h], --unicode=[default|invalid|locale|escape|hex|highlight] — controls how UTF-8 encoded multibyte characters get displayed inside strings. the default (--unicode=default) gives them no special treatment at all. --unicode=locale shows the sequence in the current locale, which may or may not support them (vibe check tbh). --unicode=hex and --unicode=invalid display them as hex byte sequences enclosed by either angle brackets or curly braces. --unicode=escape shows them as escape sequences (\uxxxx), and --unicode=highlight shows them as escape sequences highlighted in red, if your output device supports it. the colouring is there to draw attention to unicode sequences hanging out where you might not expect them. 💅
• -V, --version — prints the version number of objdump and exits. bye bestie 🌈
• -x, --all-headers — displays all available header information, symbol table and relocation entries included. using -x is equivalent to specifying all of -a -f -h -p -r -t.
• -w, --wide — formats some lines for output devices with more than 80 columns. also, it stops truncating symbol names when they're displayed. slay.
• -z, --disassemble-zeroes — normally the disassembly output skips blocks of zeroes. this option tells the disassembler to disassemble those blocks like any other data.
• -Z, --decompress — the -Z option is meant to be used in conunction with the -s option. it instructs objdump to decompress any compressed sections before displaying their contents.
• @file — read command-line options from file. the options read get inserted in place of the original @file option. if file doesn't exist or can't be read, the option is treated literally and not removed. options inside file are separated by whitespace, and you can include a whitespace character in an option by wrapping the whole option in single or double quotes. any character — backslash included — can be included by prefixing it with a backslash. the file itself may contain further @file options, and those get processed recursively. 🌀

---

🌸 SEE ALSO 🌸

nm(1), readelf(1), and the Info entries for binutils.

---

💖 COPYRIGHT 💖

Copyright (c) 1991-2026 Free Software Foundation, Inc.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover Texts, and with no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License".

---

and that's the whole page, bestie, you made it to the end 🎀 this was the binutils-2.47 era of the manual, dated 2026-09-05, and the page you just read is OBJDUMP(1). go read some headers, you've earned it 💜