SCANELF(1)

📦
version 1.3.11 · 13 versions
, in arch rolling

🌸 NAME 🌸

okay so bestie, meet scanelf(1) — the user-space utility to scan ELF files. It's living in the pax-utils docs, and it's literally here to make your ELF life easier. 💅

✨ SYNOPSIS ✨

scanelf [options] ELFs or directories

🦋 DESCRIPTION 🦋

scanelf is a user-space utility that quickly scans the ELFs, directories, or common system paths you give it for different kinds of information. That can include ELF types, their PaX markings, TEXTRELs, etc... iykyk. It's giving main character energy for your binary inspection era. 💖

🎀 OPTIONS 🎀

  • -A, --archives — scans archives (.a files). yes bestie, it does archives too.
  • -a, --all — prints all useful/simple info. the whole little info menu, periodt.
  • -B, --nobanner — don't display the header. no banner, no problem.
  • -b, --bind — prints symbol binding information (lazy or now). lowkey useful.
  • -D, --endian — prints ELF endianness (big/little/...). endian vibe check 💅
  • -E, --etype ETYPE — prints only ELF files matching the specified etype (like ET_DYN, ET_EXEC, etc...). filter that stack, bestie.
  • -e, --header — prints GNU_STACK markings. iconic header info.
  • -F, --format FORMAT — uses the specified format for output; see the FORMAT section for more information. custom output slay.
  • -f, --from FILE — reads input stream from the specified filename. feed it a file, fr fr.
  • -g, --gmatch — uses strncmp to match libraries (use with -N). Or regexp with symbol matching. matching mode activated.
  • -h, --help — shows condensed usage and exits. tiny help moment 🫶
  • -I, --osabi — prints OSABI. get that ABI tea.
  • -i, --interp — prints the interpreter information (.interp/PT_INTERP). interpreter reveal ✨
  • -k, --section SECTION — finds ELFs with the specified section. May be specified multiple times to match multiple sections simultaneously. See SECTION MATCHING for more info. section-hunting bestie.
  • -L, --ldcache — utilizes ld.so.cache information (use with -r/-n). cache behavior, no cap.
  • -l, --ldpath — scans all directories in /etc/ld.so.conf. path-scanning era.
  • -M, --bits BITS — prints only ELF files matching the specified numeric bits (like 32/64). bits filter, cute.
  • -m, --mount — don't recursively cross mount points. stay in your lane, mount-wise.
  • -N, --lib SONAME — finds ELFs that need the specified SONAME. May be specified multiple times to match multiple SONAMEs simultaneously. See SONAME MATCHING for more info. library-needs detective work 🔍
  • -n, --needed — prints libraries the ELF is linked against (DT_NEEDED). dependency drama, printed.
  • -O, --perms PERMS — prints only ELF files with matching specified octal bits (like 755). perms filter, slay.
  • -o, --file FILE — writes output stream to the specified filename. redirect that output 💅
  • -p, --path — scans all directories in PATH environment. yes, that PATH.
  • -q, --quiet — only outputs 'bad' things. quiet mode, but make it shady.
  • -R, --recursive — scans directories recursively. go deeper, bestie.
  • -r, --rpath — prints runpaths encoded in the ELF (DT_RPATH/DT_RUNPATH). runpath reveal.
  • -S, --soname — prints the ELF's shared library name (DT_SONAME). soname moment.
  • -s, --symbol SYMBOL — finds the specified symbol; see SYMBOL MATCHING for more info. symbol search, iconic.
  • -T, --textrels — locates cause of TEXTRELs via objdump. detective mode, TEXTREL edition.
  • -t, --textrel — prints TEXTREL information. textrel tea ☕
  • -V, --version — prints version and exits. version check, then bye.
  • -v, --verbose — be verbose (can be used more than once). more -v, more talking.
  • -X, --fix — tries and 'fixes' bad things (use with -r/-e). fix-it era, carefully.
  • -x, --pax — prints PaX markings. PaX info, periodt.
  • -Y, --eabi — prints EABI (only matters for a few architectures). niche but valid.
  • -y, --symlink — don't scan symlinks. symlinks can sit this one out.
  • -Z, --size SIZE — prints ELF file size. size check, cute.
  • -z, --setpax FLAGS — sets EI_PAX/PT_PAX_FLAGS to specified flags (use with -Xx). flag-setting business.
  • --use-ldpath — uses the ld.so.conf paths to find the full path to libraries (use in conjunction with --needed). path-finding assist.
  • --root PATH — searches the specified root tree instead of /. Generally paired with options like -l or -p. This implicitly treats all paths specified on the command line as relative to the root, so be sure to omit it if you are explicitly listing ELFs. root-tree energy, but read the warning bestie.
  • --ldcache PATH — uses the specified path instead of /etc/ld.so.cache. Generally paired with options like -L or -n. custom cache path, no cap.

🌈 FORMAT 🌈

The format string is much like a printf string in that it is a literal string with flags requesting different information. For example, you could use a format string and expect the following results.

# scanelf -BF "file %f needs %n; funky time" /bin/bash
file bash needs libncurses.so.5,libdl.so.2,libc.so.6; funky time

Note that when you use a format string, generally information related flags should be omitted. In other words, you do not want to try and request NEEDED output (-n) and try to specify a format output at the same time as these operations are mutually exclusive. Each information related flag has an equivalent conversion specifier, so use those instead. You can of course continue to use non-information related flags (such as --verbose). 🫶

There are three characters that introduce conversion specifiers.

  • % — replace with info
  • # — silent boolean match
  • + — verbose match

And there are a number of conversion specifiers. We try to match up the specifier with corresponding option. ✨

  • a — machine (EM) type
  • b — bind flags
  • e — program headers
  • D — endian
  • I — osabi
  • Y — eabi
  • F — long filename
  • f — short filename
  • i — interp
  • k — section
  • M — EI class
  • N — specified needed
  • n — needed libraries
  • p — filename (minus search)
  • o — etype
  • O — perms
  • r — runpaths
  • S — SONAME
  • s — symbol
  • T — all textrels
  • t — textrel status
  • x — pax flags

🧚 SYMBOL MATCHING 🧚

The string specified takes the form [%[modifiers]%][[+-]<symbol name>][,[.....]]. 💅

If the symbol name is empty, then all symbols are matched.

If the symbol name is a glob ("*"), then all symbols are dumped in a debug format. Do not rely on the structure of this output as it changes whenever we feel like it. fr fr, do not build on it.

If the first char of the symbol name is a plus ("+"), then only match defined symbols. If it's a minus ("-"), only match undefined symbols. When we say "defined", we mean the symbol is defined in the ELF vs having an external reference. yes bestie, that distinction matters.

Putting modifiers in between the percent signs ("%") allows for more in depth filters. There are groups of modifiers. If you don't specify a member of a group, then all types in that group are matched.

  • STT group (symbol type)
    • n — STT_NOTYPE
    • o — STT_OBJECT
    • f — STT_FUNC
    • F — STT_FILE
  • STB group (symbol binding)
    • l — STB_LOCAL
    • g — STB_GLOBAL
    • w — STB_WEAK
  • STV group (symbol visibility)
    • p — STV_DEFAULT
    • i — STV_INTERNAL
    • h — STV_HIDDEN
    • P — STV_PROTECTED
  • SHN group (section header)
    • d — defined
    • u — SHN_UNDEF
    • a — SHN_ABS
    • c — SHN_COMMON

You can search for multiple symbols simultaneously by using a comma (,) to separate different searches. Every symbol that matches will be displayed while unmatched symbols will not. 🎀

🔥 ELF ETYPES 🔥

You can narrow your search by specifying the ELF object file type (ETYPE). The commandline option takes the numeric value and or symbolic type. Multiple values can be passed comma separated. Example -E ET_EXEC,ET_DYN,1. ✨

Here is the normal list available for your pleasure. You of course are free to specify any numeric value you want.

  • 0 — ET_NONE — unknown type
  • 1 — ET_REL — relocatable file
  • 2 — ET_EXEC — executable file
  • 3 — ET_DYN — shared object
  • 4 — ET_CORE — core file

💜 ELF BITS 💜

You can also narrow your search by specifying the ELF bitsize. Again, specify the numeric value or the symbolic define.

  • 32 — ELFCLASS32 — 32bit ELFs
  • 64 — ELFCLASS64 — 64bit ELFs

🍓 SECTION MATCHING 🍓

A ! prefix will only show ELF's that do not have the specified section. not me using the ! to flip the vibe check.

🦋 NEEDED SONAME MATCHING 🦋

A ! prefix will only show ELF's that do not depend on the specified library. same shady little ! energy.

🌐 HOMEPAGE 🌐

https://wiki.gentoo.org/wiki/Hardened/PaX_Utilities

😭 REPORTING BUGS 😭

Please include as much information as possible (using any available debugging options) and send bug reports to the maintainers (see the AUTHORS section). Please use the Gentoo bugzilla at https://bugs.gentoo.org/ if possible. bestie, give them all the deets so they can actually help 🫶

👑 SEE ALSO 👑

chpax(1), dumpelf(1), paxctl(1), pspax(1), readelf(1), scanelf(1), elf(5)

🌸 AUTHORS 🌸

  • Ned Ludd <solar@gentoo.org> — Maintainer
  • Mike Frysinger <vapier@gentoo.org> — Maintainer
  • Fabian Groffen <grobian@gentoo.org> — Mach-O Maintainer

🎀 NOTES 🎀

  1. https://wiki.gentoo.org/wiki/Hardened/PaX_Utilities
  2. https://bugs.gentoo.org/

this iconic lil' page is from pax-utils 1.3.11, dated 08/02/2026, and yes bestie it's the scanelf(1) manual — mwah 💋💖

📦 where this page comes from