OBJDUMP(1)

📦 version 2.45, in ubuntu questing

🎀 OBJDUMP(1) 🎀

GNU Development Tools manual page, bestie 💖

✨ NAME ✨

objdump is the tool that spills all the info from object files 🔍. It's basically a little detective for compiled stuff.

🧚 SYNOPSIS ✨

objdump [-a|--archive-headers]
        [-b bfdname|--target=bfdname]
        [-C|--demangle[=style] ]
        [-d|--disassemble[=symbol]]
        [-D|--disassemble-all]
        [-z|--disassemble-zeroes]
        [-EB|-EL|--endian={big | little }]
        [-f|--file-headers]
        [-F|--file-offsets]
        [--file-start-context]
        [-g|--debugging]
        [-e|--debugging-tags]
        [-h|--section-headers|--headers]
        [-i|--info]
        [-j section|--section=section]
        [-l|--line-numbers]
        [-S|--source]
        [--source-comment[=text]]
        [-m machine|--architecture=machine]
        [-M options|--disassembler-options=options]
        [-p|--private-headers]
        [-P options|--private=options]
        [-r|--reloc]
        [-R|--dynamic-reloc]
        [-s|--full-contents]
        [-Z|--decompress]
        [-W[lLiaprmfFsoORtUuTgAck]|
         --dwarf[=rawline,=decodedline,=info,=abbrev,=pubnames,=aranges,=macro,=frames,=frames-interp,=str,=str-offsets,=loc,=Ranges,=pubtypes,=trace_info,=trace_abbrev,=trace_aranges,=gdb_index,=addr,=cu_index,=links]]
        [-WK|--dwarf=follow-links]
        [-WN|--dwarf=no-follow-links]
        [-wD|--dwarf=use-debuginfod]
        [-wE|--dwarf=do-not-use-debuginfod]
        [-L|--process-links]
        [--ctf=section]
        [--sframe=section]
        [-G|--stabs]
        [-t|--syms]
        [-T|--dynamic-syms]
        [-x|--all-headers]
        [-w|--wide]
        [--start-address=address]
        [--stop-address=address]
        [--no-addresses]
        [--prefix-addresses]
        [--[no-]show-raw-insn]
        [--adjust-vma=offset]
        [--show-all-symbols]
        [--dwarf-depth=n]
        [--dwarf-start=n]
        [--ctf-parent=section]
        [--no-recurse-limit|--recurse-limit]
        [--special-syms]
        [--prefix=prefix]
        [--prefix-strip=level]
        [--insn-width=width]
        [--visualize-jumps[=color|=extended-color|=off]
        [--disassembler-color=[off|terminal|on|extended]
        [-U method] [--unicode=method]
        [-V|--version]
        [-H|--help]
        objfile...

💅 DESCRIPTION 💅

okay so objdump shows you info about one or more object files 🫶 The options you pick decide exactly what info you get. ngl this is mostly for the programmers who are building the compilation tools themselves 🛠️, not the ones who just want their program to compile and work and go to bed 😴

objfile... are the object files it'll poke at 👀 If you hand it archives, objdump looks at every single member object file inside them. no cap, that's a lot of info ✨

👑 OPTIONS 👑

The long and short versions of each option are interchangeable, same energy, different outfit 🎀 You must give at least one option from this list: -a, -d, -D, -e, -f, -g, -G, -h, -H, -p, -P, -r, -R, -s, -S, -t, -T, -V, -x. Without one of those, it's giving nothing 💀

  • -a, --archive-header — 📦 If any of your objfile files are archives, this shows the archive header info (kinda like ls -l). On top of what you'd get from ar tv, objdump -a also shows the object file format of each archive member.
  • --adjust-vma=offset — 🦋 When dumping info, it first adds offset to every section address. This is super useful when the section addresses don't line up with the symbol table, which can happen when sections get placed at specific addresses in a format that can't store section addresses, like a.out.
  • -b bfdname, --target=bfdname — 🎯 Tells objdump that the object-code format of your object files is bfdname. You might not even need this, because objdump can often figure out lots of formats on its own 🧠

For example, this:

objdump -b oasys -m vax -h fu.o

shows summary info from the section headers (-h) of fu.o, which is explicitly marked (-m) as a VAX object file in the format made by Oasys compilers. want the full list of formats? use the -i option 📋

  • -C, --demangle[=style] — 🪄 Demangles low-level symbol names back into user-level names. It removes any initial underscore the system tacked on, and it makes C++ function names actually readable 🥹 Different compilers mangle names differently, so the optional style argument lets you pick the demangling style that matches your compiler.
  • --recurse-limit, --no-recurse-limit, --recursion-limit, --no-recursion-limit — 🌀 Turns a limit on how deep demangling is allowed to recurse on or off. Name mangling formats allow infinite levels of recursion, so some strings could eat up all the stack space on the host machine and cause a memory fault 😱 The limit stops that by capping recursion at 2048 levels of nesting.

The limit is on by default, but you might need to turn it off to demangle really complicated names. Just know that if you disable it, stack exhaustion is possible, and any bug reports about that event will be rejected 🙅‍♀️

  • -g, --debugging — 🔎 Displays debugging info. It tries to parse the STABS debugging format info stored in the file and prints it out using C-like syntax. If there's no STABS debugging info, this option falls back to the -W option to print any DWARF info in the file instead.
  • -e, --debugging-tags — 🏷️ Same vibe as -g, but the info is generated in a format that works with the ctags tool.
  • -d, --disassemble, --disassemble=symbol — 🧩 Shows the assembler mnemonics for the machine instructions in the input file. This only disassembles the sections that are expected to hold instructions. If you pass a symbol (you can pass several), it shows the mnemonics starting at (all the) symbol. If the symbol is a function name, disassembly stops at the end of that function; otherwise it stops when the next symbol shows up. If nothing matches any symbol, nothing gets displayed 🫠

Heads up: if --dwarf=follow-links is on, any symbol tables in linked debug info files will be read in and used while disassembling 🔗

  • -D, --disassemble-all — 🌟 Like -d, but it disassembles the contents of every non-empty, non-bss section, not just the ones expected to contain instructions. You can use -j to pick specific sections 🎯

This one also has a subtle effect on code sections. With -d, objdump assumes any symbols in a code section sit on the boundary between instructions, and it refuses to disassemble across that boundary. With -D, that assumption gets suppressed. So -d and -D can give different output if, say, data is stored in code sections 👀

If the target is an ARM architecture, this switch also forces the disassembler to decode pieces of data found in code sections as if they were instructions 🤖

Also, again: if --dwarf=follow-links is on, any symbol tables in linked debug info files will be read in and used while disassembling 🔗

  • --no-addresses — 🙈 When disassembling, it stops printing addresses on each line, and also for symbols and relocation offsets. Paired with --no-show-raw-insn, this can be handy for comparing compiler output 💜
  • --prefix-addresses — 📜 When disassembling, it prints the complete address on each line. This is the older disassembly format, so it's kinda vintage 🕰️
  • -EB, -EL, --endian={big|little} — 🌊 Sets the endianness of the object files. This only affects disassembly 🧠 It's useful when disassembling a file format that doesn't describe endianness, like S-records.
  • -f, --file-headers — 🗂️ Displays summary info from the overall header of each of the objfile files.
  • -F, --file-offsets — 📍 When disassembling sections, every time a symbol gets displayed, it also shows the file offset of the chunk of data about to be dumped. If zeroes are being skipped, then when disassembly picks back up, it tells you how many zeroes got skipped and the file offset of where disassembly resumes. When dumping sections, it shows the file offset of where the dump starts.
  • --file-start-context — 📖 When displaying interlisted source code and disassembly (this assumes -S) from a file that hasn't been displayed yet, it extends the context all the way back to the start of the file.
  • -h, --section-headers, --headers — 🧾 Displays summary info from the section headers of the object file.

Real talk: file segments can get relocated to nonstandard addresses, like with the -Ttext, -Tdata, or -Tbss options to ld. But some object file formats, like a.out, don't store the starting address of file segments. In that case, even though ld relocates the sections correctly, objdump -h can't show the correct addresses. Instead, it shows the usual addresses, which are implicit for the target 🤷‍♀️

Also, in some cases a section can have both the READONLY and NOREAD attributes set. When that happens, NOREAD takes precedence, but objdump reports both anyway, because the exact flag bits might matter 🧐

  • -H, --help — 🆘 Prints a summary of the objdump options and then exits.
  • -i, --info — 📚 Displays a list of every architecture and object format you can specify with -b or -m.
  • -j name, --section=name — 🎀 Displays info for the section name. You can use this more than once 💅
  • -L, --process-links — 🔗 Displays the contents of non-debug sections found in separate debuginfo files that are linked to the main file. This automatically implies the -WK option, and only the sections requested by your other command line options get displayed ✨
  • -l, --line-numbers — okay so this one labels the display with the filename and source line numbers (pulled from debugging info) that match the object code or relocs being shown. It's only useful with -d, -D, or -r. 🎀
  • -m machine, --architecture=machine — tells objdump which architecture to use when disassembling. This is a lifesaver for files that don't describe their own architecture, like S-records. 🦋 You can list the available architectures with the -i option.

For most architectures you can give both an architecture name and a machine name, separated by a colon. So foo:bar means the bar machine type in the foo architecture. This is super helpful if objdump has been configured to support multiple architectures 💅

If the target is an ARM architecture, this switch does something extra: it restricts the disassembly to only the instructions supported by the architecture you pass as machine. 👀 If you need this switch because the input file has no architecture info but you still want to disassemble all the instructions, use -marm. 🫶

  • -M options, --disassembler-options=options — passes target-specific info to the disassembler. This is only supported on some targets 🌸 If you need more than one disassembler option, you can use multiple -M options or stuff them all into one comma separated list.

For ARC, dsp controls the printing of DSP instructions, spfp selects the printing of FPX single precision FP instructions, dpfp selects the printing of FPX double precision FP instructions, quarkse_em selects the printing of special QuarkSE-EM instructions, fpuda selects the printing of double precision assist instructions, fpus selects the printing of FPU single precision FP instructions, and fpud selects the printing of FPU double precision FP instructions. You can also have all the immediates printed in hexadecimal with hex. By default, short immediates are printed in decimal, while long immediate values are printed as hexadecimal ✨

cpu=... lets you enforce a particular ISA when disassembling, overriding the -m value or whatever is in the ELF file. This might be useful for picking ARC EM or HS ISA, since the architecture is the same for both and the disassembler relies on private ELF header data to decide whether code is for EM or HS 🧚 You can specify this option multiple times, but only the latest value is used. Valid values are the same as for the assembler -mcpu=... option.

If the target is an ARM architecture, this switch can select which register name set the disassembler uses. Specifying -M reg-names-std (the default) gives you the register names used in ARM's instruction set documentation, except register 13 is called sp, register 14 is called lr, and register 15 is called pc. Specifying -M reg-names-apcs gives you the name set used by the ARM Procedure Call Standard, and -M reg-names-raw will just use r followed by the register number 🍓

There are also two variants of the APCS register naming scheme, enabled by -M reg-names-atpcs and -M reg-names-special-atpcs. These use the ARM/Thumb Procedure Call Standard naming conventions. (You get these either with the normal register names or the special register names.)

This option can also be used on ARM architectures to force the disassembler to read every instruction as a Thumb instruction, using --disassembler-options=force-thumb. This is handy when you're trying to disassemble Thumb code made by other compilers 💜

For AArch64 targets, this switch controls whether instructions are disassembled as the most general instruction, using -M no-aliases, or whether instruction notes get generated as comments in the disassembly, using -M notes 🌈

For x86, some of these options duplicate what the -m switch does, but they give you finer grained control 💖

  • "x86-64", "i386", "i8086" — select disassembly for the given architecture.
  • "intel", "att" — pick between Intel syntax mode and AT&T syntax mode.
  • "amd64", "intel64" — pick between the AMD64 ISA and the Intel64 ISA.
  • "intel-mnemonic", "att-mnemonic" — pick between Intel mnemonic mode and AT&T mnemonic mode. Note: "intel-mnemonic" implies "intel", and "att-mnemonic" implies "att" 👑
  • "addr64", "addr32", "addr16", "data32", "data16" — set the default address size and operand size. These five get overridden if "x86-64", "i386", or "i8086" show up later in the option string 🙈
  • "suffix" — in AT&T mode (and for a limited set of instructions in Intel mode), this tells the disassembler to print a mnemonic suffix even when the suffix could be inferred from the operands or, for certain instructions, from the execution mode's defaults 🔥

For PowerPC, the -M argument raw selects disassembly of hardware insns instead of aliases. So you'll see rlwinm rather than clrlwi, and addi rather than li ✨ All of the -m arguments for gas that select a CPU are supported. Those are: 403, 405, 440, 464, 476, 601, 603, 604, 620, 7400, 7410, 7450, 7455, 750cl, 821, 850, 860, a2, booke, booke32, cell, com, e200z2, e200z4, e300, e500, e500mc, e500mc64, e500x2, e5500, e6500, efs, power4, power5, power6, power7, power8, power9, power10, power11, ppc, ppc32, ppc64, ppc64bridge, ppcps, pwr, pwr2, pwr4, pwr5, pwr5x, pwr6, pwr7, pwr8, pwr9, pwr10, pwr11, pwrx, titan, vle, and future. 😭

32 and 64 modify the default or a prior CPU selection, disabling and enabling 64-bit insns respectively. Then altivec, any, lsp, htm, vsx, spe, and spe2 add capabilities to a previous or later CPU selection. any will disassemble any opcode known to binutils, but if an opcode has two different meanings or different arguments, you might not get the disassembly you expect 💀 If you disassemble without giving a CPU selection, a default gets picked from info BFD pulls out of the object file headers, but again, the result may not be what you expect.

For RISC-V, the following options are supported:

  • "max" — disassembles without checking the architecture string. This is a best effort mode, so for overlapping ISA extensions the first match (possibly incorrect in a given context) gets used to decode the instruction. It's useful when the ELF file doesn't expose an ISA string, which stops automatic ISA subset deduction, and the default fallback ISA string ("rv64gc") doesn't cover all the instructions in the binary 🌸
  • "numeric" — prints numeric register names instead of ABI names, so you'd see "x2" instead of "sp" 🔢
  • "no-aliases" — disassembles only into canonical instructions. For example, compressed instructions get represented as such, so "addi sp,sp,-128" becomes "c.addi16sp sp,-128" 🧸
  • "priv-spec=SPEC" — prints the CSR according to the chosen privilege spec version (e.g., 1.10, 1.11, 1.12, 1.13) 📜

For MIPS, this option controls how instruction mnemonic names and register names get printed. You can specify multiple selections from the list below as a comma separated string. Invalid options are ignored 🦄

  • "no-aliases" — prints the 'raw' instruction mnemonic instead of a pseudo instruction mnemonic. So you get daddu or or instead of move, and sll instead of nop, and so on.
  • "msa" — disassembles MSA instructions.
  • "virt" — disassembles the virtualization ASE instructions.
  • "xpa" — disassembles the eXtended Physical Address (XPA) ASE instructions.
  • "gpr-names=ABI" — prints GPR (general-purpose register) names as appropriate for the specified ABI. By default, GPR names are picked according to the ABI of the binary being disassembled.
  • "fpr-names=ABI" — prints FPR (floating-point register) names as appropriate for the specified ABI. By default, FPR numbers get printed instead of names.
  • "cp0-names=ARCH" — prints CP0 (system control coprocessor; coprocessor 0) register names as appropriate for the CPU or architecture given as ARCH. By default, CP0 register names are picked according to the architecture and CPU of the binary being disassembled.
  • "hwr-names=ARCH" — prints HWR (hardware register, used by the "rdhwr" instruction) names as appropriate for the CPU or architecture given as ARCH. By default, HWR names are picked according to the architecture and CPU of the binary being disassembled.
  • "reg-names=ABI" — prints GPR and FPR names as appropriate for the selected ABI.
  • "reg-names=ARCH" — prints CPU-specific register names (CP0 register and HWR names) as appropriate for the selected CPU or architecture.

For any of the options above, ABI or ARCH can be set to numeric to print numbers instead of names for the selected types of registers. You can list the available values of ABI and ARCH using the --help option 🎀

For VAX, you can specify function entry addresses with -M entry:0xf00ba. You can use this multiple times to properly disassemble VAX binary files that don't contain symbol tables (like ROM dumps) 🧚 Without this, the function entry mask would get decoded as VAX instructions, which would probably mess up the rest of the function's disassembly 🙃

  • -p, --private-headers — prints info that's specific to the object file format. The exact info depends on the format, and for some formats no extra info gets printed at all 📦
  • -P options, --private=options — prints info that's specific to the object file format too. The options argument is a comma separated list that depends on the format (you can see the lists with the help) 💅

For XCOFF, the available options are:

Okay so the XCOFF list is still going, bestie, and it's literally the menu of section names you can pass in:

  • "header"
  • "aout"
  • "sections"
  • "syms"
  • "relocs"
  • "lineno,"
  • "loader"
  • "except"
  • "typchk"
  • "traceback"
  • "toc"
  • "ldinfo"

For PE files, the only choices are:

  • "header"
  • "sections"
🚨 Not every object format supports this option. ELF doesn't use it at all, so don't waste your time there 💀
  • -r, --reloc — Prints the relocation entries of the file 🔗 If you pair it with -d or -D, the relocations get woven in between the disassembly, which is so satisfying ✨
  • -R, --dynamic-reloc — Prints the dynamic relocation entries 🦋 This only matters for dynamic objects, like certain shared libraries. Same deal as -r: add -d or -D and the relocations sit right in the disassembly.
📝 Heads up: objdump can't show RELR type relocations. If you need those, go ask the readelf program instead 🙈
  • -s, --full-contents — Dumps the full contents of sections 📦 It's usually paired with -j so you can pick out specific sections. By default, every non-empty, non-bss section gets shown. Compressed sections show up in their compressed form unless you add the -Z option, which gives you the decompressed version 🧚
  • -S, --source — Shows source code mixed in with the disassembly, if that's possible 💜 It implies -d, so you don't need to add it yourself.
  • --show-all-symbols — When disassembling, shows every symbol matching a given address, not just the first one 👑
  • --source-comment[=txt] — Basically -S, except every source line gets a prefix of txt 🎀 Usually txt is a comment string so you can tell the assembler code apart from the source code. If you don't give txt, the default is "# " (hash followed by a space) ✨
  • --prefix=prefix — Sets a prefix to stick onto the absolute paths when you use -S 🌸
  • --prefix-strip=level — Tells objdump how many leading directory names to chop off the hardwired absolute paths 🪓 It does nothing unless you also use --prefix=prefix.
  • --show-raw-insn — When disassembling, prints each instruction in hex as well as symbolic form 🍓 This is the default, except when --prefix-addresses is in play.
  • --no-show-raw-insn — When disassembling, skips the instruction bytes entirely 🙈 This is the default when --prefix-addresses is used.
  • --insn-width=width — Shows width bytes on a single line when disassembling instructions 📏
  • --visualize-jumps[=color|=extended-color|=off] — Draws little ASCII art between the start and target addresses for jumps that stay inside a function 🦋 Add =color for simple terminal colors, or =extended-color for 8-bit colors, which might not work on every terminal 🌈

If you turned visualize-jumps on earlier and now want it gone, use visualize-jumps=off 💅

  • --disassembler-color=off, --disassembler-color=terminal, --disassembler-color=on|color|colour, --disassembler-color=extended|extended-color|extended-colour — Turns colored syntax highlighting in the disassembly on or off 🎨 The default is decided by a configure time option. Not every architecture supports colors, and depending on your terminal, the colors might not be very legible 💀
    • on (or color, or colour) adds colors using simple terminal colors ✨
    • terminal does the same thing, but only if the output device is a terminal 🖥️
    • extended (or extended-color, or extended-colour) is like on, but uses 8-bit colors, which may not work everywhere 🌈
    • off turns colored disassembly off completely 🫶
  • -W[lLiaprmfFsoORtUuTgAckK], `--dwarf[=rawline,=decodedline,=info,=abbrev,=pubnames,=aranges,=macro,=frames,=frames-interp,=str,=str-offsets,=loc,=Ranges,=pubtypes,=trace_info,=trace_abbrev,=trace_aranges,=gdb_index,=addr,=cu_index,=links,=follow-links] — Displays the DWARF debug sections in the file, if there are any 🔍 Compressed debug sections get decompressed temporarily before they're shown. If you add one or more of the letters or words after the switch, only those kinds of data get dumped. Here's what each one means:
    • "a", "=abbrev" — Shows the contents of the .debug_abbrev section 📚
    • "A", "=addr" — Shows the contents of the .debug_addr section 📍
    • "c", "=cu_index" — Shows the contents of the .debug_cu_index and/or .debug_tu_index sections 🗂️
    • "f", "=frames" — Displays the raw contents of a .debug_frame section 🧱
    • "F", "=frames-interp" — Displays the interpreted contents of a .debug_frame section 🪄
    • "g", "=gdb_index" — Shows the contents of the .gdb_index and/or .debug_names sections 🔎
    • "i", "=info" — Shows the contents of the .debug_info section 💖 Heads up: the output here can also be narrowed down with --dwarf-depth and --dwarf-start.
    • "k", "=links" — Shows the contents of the .gnu_debuglink, .gnu_debugaltlink and .debug_sup sections, if any are present 🔗 It also shows any links to separate dwarf object files (dwo), if they're specified by the DW_AT_GNU_dwo_name or DW_AT_dwo_name attributes in the .debug_info section.
    • "K", "=follow-links" — Displays the contents of any selected debug sections found in linked, separate debug info files 🕵️‍♀️ This can show you multiple versions of the same debug section if it exists in more than one file.

When you're displaying DWARF attributes, if a form points at the separate debug info file, the referenced contents get shown too 🫧

⚠️ Note: in some distributions this option is on by default. You can turn it off with the N debug option. The default can be picked when configuring binutils with --enable-follow-debug-links=yes or --enable-follow-debug-links=no. If neither is used, following debug links is enabled by default.
⚠️ Note: if debuginfod support was enabled when binutils was built, this option also tries to contact any debuginfod servers listed in the DEBUGINFOD_URLS environment variable 🌐 That could take a little while to sort out. You can turn this behaviour off with the =do-not-use-debuginfod debug option.
  • "N", "=no-follow-links" — Stops following links to separate debug info files 🚫
  • "D", "=use-debuginfod" — Lets objdump contact debuginfod servers when it needs to follow debug links 🌸 This is the default behaviour.
  • "E", "=do-not-use-debuginfod" — Stops objdump from contacting debuginfod servers when it needs to follow debug links 🙅‍♀️
  • "l", "=rawline" — Displays the .debug_line section in a raw format 📜
  • "L", "=decodedline" — Displays the interpreted contents of the .debug_line section 🧠
  • "m", "=macro" — Shows the contents of the .debug_macro and/or .debug_macinfo sections 🧩
  • "o", "=loc" — Shows the contents of the .debug_loc and/or .debug_loclists sections 📍
  • "O", "=str-offsets" — Shows the contents of the .debug_str_offsets section 🔢
  • "p", "=pubnames" — Shows the contents of the .debug_pubnames and/or .debug_gnu_pubnames sections 🏷️
  • "r", "=aranges" — Shows the contents of the .debug_aranges section 🌈
  • "R", "=Ranges" — Shows the contents of the .debug_ranges and/or .debug_rnglists sections 🛤️
  • "s", "=str" — Shows the contents of the .debug_str, .debug_line_str and/or .debug_str_offsets sections 🧵
  • "t", "=pubtype" — Shows the contents of the .debug_pubtypes and/or .debug_gnu_pubtypes sections 🎀
  • "T", "=trace_aranges" — Shows the contents of the .trace_aranges section 🛰️
  • "u", "=trace_abbrev" — Shows the contents of the .trace_abbrev section 🗃️
  • "U", "=trace_info" — Shows the contents of the .trace_info section 🫧
🙈 Note: displaying .debug_static_funcs, .debug_static_vars and debug_weaknames sections isn't supported right now, so don't go looking for them.
  • --dwarf-depth=n — Limits the dump of the ".debug_info" section to n children 🌳 This only matters with --debug-dump=info. By default every DIE gets printed, and the special value 0 for n does the same thing 💫

With a non-zero n, DIEs at or deeper than n levels won't be printed. The range for n is zero-based 🔢

  • --dwarf-start=n — Prints only the DIEs starting with the DIE numbered n 🎯 This only matters with --debug-dump=info.

If you specify it, this option suppresses any header information and every DIE before the DIE numbered n. Only the siblings and children of that specified DIE get printed 👑

This can be combined with --dwarf-depth 🫶

  • --dwarf-check — Turns on extra checks for consistency of DWARF information 🕵️‍♀️✨
  • --ctf[=section] — Displays the contents of the specified CTF section 🧁 CTF sections contain lots of subsections, and they all get displayed in order.

By default, it displays the section named .ctf, which is the name ld emits 💜

  • --ctf-parent=member — okay so this one's for CTF archives 🗂️ If the CTF section has ambiguously-defined types, it becomes an archive of a bunch of CTF dictionaries that all inherit from one parent dictionary holding the unambiguous types. By default that member is named .ctf, same as the section holding it, but you can rename it with the "ctf_link_set_memb_name_changer" function at link time. If you're looking at archives made by a linker that renamed the parent member, --ctf-parent lets you tell objdump what name the parent actually uses ✨
  • --ctf-parent-section=section — this lets you pick a totally different section for the parent dictionary (the one with unambiguous types) than the one for the child dictionaries holding the ambiguous leftovers 🌸 The linker never makes ELF objects shaped like this, but some third-party linkers might. It's also handy when you've got CTF dumped out as multiple raw files you want to glue together with objcopy. objcopy can stick them in different ELF sections, but it can't put them in different members of a single CTF dict 🧚
  • --sframe[=section] — displays the contents of the SFrame section you name 🦋

By default it shows the section called .sframe, which is the name ld uses.

  • -G, --stabs — displays the full contents of whatever sections you asked for. It also shows the .stab, .stab.index and .stab.excl sections from an ELF file. This only really matters on systems like Solaris 2.0, where ".stab" debugging symbol-table entries live in an ELF section. On most other file formats, debugging entries are mixed in with linkage symbols and you'll see them in the --syms output instead 🙈
  • --start-address=address — starts displaying data from the address you give it. This changes what -d, -r and -s print 🍓
  • --stop-address=address — stops displaying data at the address you give it. This also changes what -d, -r and -s print 🛑
  • -t, --syms — prints the symbol table entries of the file. It's kind of like what nm gives you, but the formatting is different 💅 The layout depends on what kind of file you're dumping, but there are two main styles. The first one looks like this:
[  4](sec  3)(fl 0x00)(ty   0)(scl   3) (nx 1) 0x00000000 .bss
[  6](sec  1)(fl 0x00)(ty   0)(scl   2) (nx 0) 0x00000000 fred

The number in the square brackets is the entry's number in the symbol table. sec is the section number, fl holds the symbol's flag bits, ty is its type, scl is its storage class, and nx is how many auxiliary entries go with the symbol. The last two fields are the symbol's value and its name 📚

The other common style, usually seen with ELF-based files, looks like this:

00000000 l    d  .bss   00000000 .bss
00000000 g       .text  00000000 fred

The first number is the symbol's value, which people also call its address. Next comes a run of characters and spaces showing which flag bits are set on the symbol. We'll go through those below 👀 After that is the section the symbol belongs to. It shows *ABS* (as in `*ABS*`) if the section is absolute, meaning it isn't tied to any section, or *UND* if the symbol is referenced in the file but not defined there.

Then there's a number. For common symbols it's the alignment, and for everything else it's the size. Last of all, the symbol's name gets displayed 🎀

The flag characters come in 7 groups, and they go like this:

  • l, g, u, ! — this group tells you the binding. l means local, g means global, u means unique global, a space means neither global nor local, and ! means both global and local. A symbol can be neither local nor global for plenty of reasons, like being used for debugging, but if it ever ends up both local and global, that's probably a bug 🐛 Unique global symbols are a GNU extension to the standard ELF symbol bindings. For one of these, the dynamic linker makes sure there's only one symbol with that name and type in use across the whole process 👑
  • w — the symbol is weak (w) or strong (a space) 💜
  • C — the symbol is a constructor (C) or an ordinary symbol (a space) ✨
  • W — the symbol is a warning (W) or a normal symbol (a space). A warning symbol's name is a message that gets shown if the symbol right after the warning symbol ever gets referenced ⚠️
  • I, i — the symbol is an indirect reference to another symbol (I), a function that gets evaluated during relocation processing (i), or a normal symbol (a space) 🌈
  • d, D — the symbol is a debugging symbol (d), a dynamic symbol (D), or a normal symbol (a space) 🔍
  • F, f, O — the symbol is the name of a function (F), a file (f), an object (O), or just a normal symbol (a space) 🧁
  • -T, --dynamic-syms — prints the dynamic symbol table entries of the file. This is only meaningful for dynamic objects, like certain shared libraries 🌙 It's similar to what nm shows when you give it -D (--dynamic).

The format is close to --syms, except there's an extra field right before the symbol's name that shows the version info tied to the symbol. If that version is the default one used when resolving unversioned references to the symbol, it gets shown as is. Otherwise it goes inside parentheses 🎀

  • --special-syms — when displaying symbols, this includes the ones the target considers special in some way, which normally wouldn't be interesting to you 🔮
  • -U [d|i|l|e|x|h], --unicode=[default|invalid|locale|escape|hex|highlight] — controls how UTF-8 multibyte characters inside strings get displayed 🌏 The default, --unicode=default, gives them no special treatment. --unicode=locale shows the sequence in your current locale, which may or may not support them. --unicode=hex and --unicode=invalid display them as hex byte sequences wrapped in either angle brackets or curly braces 🍭

--unicode=escape shows them as escape sequences like \uxxxx. --unicode=highlight shows the same escape sequences but in red, if your output device supports colour 🚨 The colouring is there to draw your eye to unicode sequences that might be showing up where you didn't expect them 👀

  • -V, --version — prints objdump's version number and exits 🫶
  • -x, --all-headers — displays all the header info that's available, including the symbol table and relocation entries. Using -x is the same as specifying all of -a -f -h -p -r -t 💖
  • -w, --wide — formats some lines for output devices with more than 80 columns. It also stops symbol names from being cut short when they're displayed 📏
  • -z, --disassemble-zeroes — normally the disassembly skips blocks of zeroes. This option tells the disassembler to disassemble them too, just like any other data 🫧
  • -Z, --decompress — this one is meant to go with -s. It tells objdump to decompress any compressed sections before showing their contents 🗜️
  • @file — reads command-line options from file. The options it reads get slotted in right where the @file option was 🧩 If file doesn't exist or can't be read, then @file gets treated literally and doesn't get removed.

Options inside file are separated by whitespace. If you want a whitespace character inside an option, wrap the whole option in single or double quotes. Any character, including a backslash, can be included by putting a backslash in front of it. The file can also have more @file options inside it, and those get processed recursively too 🌀

🔗 SEE ALSO 🔗

nm(1), readelf(1), and the Info entries for binutils. Go check those out, bestie 📖

Copyright (c) 1991-2025 Free Software Foundation, Inc.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation, with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License" 📜

That's the whole OBJDUMP(1) glow-up, bestie! binutils 2.45 from December 3rd, 2025, served with love 💅🌈🦋

📦 where this page comes from