NM(1)

📦
version 2.44 · 7 versions
, in debian trixie

✨ NM(1) — GNU Development Tools ✨

okay bestie, gather round, because today we're talking about nm from the GNU Development Tools, and it is lowkey one of the most useful little gremlins in your whole toolchain. it's giving detective energy. it's giving "i know what's inside your object files" energy. 🕵️♀️💅

🌸 NAME 🌸

nm — list symbols from object files

like, that's it. that's the whole job. it opens up an object file and tells you every symbol chillin' inside it. iconic behaviour honestly.

🎀 SYNOPSIS 🎀

nm [-A|-o|--print-file-name]
   [-a|--debug-syms]
   [-B|--format=bsd]
   [-C|--demangle[=style]]
   [-D|--dynamic]
   [-fformat|--format=format]
   [-g|--extern-only]
   [-h|--help]
   [--ifunc-chars=CHARS]
   [-j|--format=just-symbols]
   [-l|--line-numbers] [--inlines]
   [-n|-v|--numeric-sort]
   [-P|--portability]
   [-p|--no-sort]
   [-r|--reverse-sort]
   [-S|--print-size]
   [-s|--print-armap]
   [-t radix|--radix=radix]
   [-u|--undefined-only]
   [-U|--defined-only]
   [-V|--version]
   [-W|--no-weak]
   [-X 32_64]
   [--no-demangle]
   [--no-recurse-limit|--recurse-limit]]
   [--plugin name]
   [--size-sort]
   [--special-syms]
   [--synthetic]
   [--target=bfdname]
   [--unicode=method]
   [--with-symbol-versions]
   [--without-symbol-versions]
   [objfile...]

look at all those flags, she's flexible. we'll go through every single one, don't you worry. 🫶

💖 DESCRIPTION 💖

so, GNU nm lists the symbols from the object files objfile... and if you don't hand it any object files as arguments? it just assumes you mean the file a.out. bold of it, but okay bestie, we move. 💀

for each symbol, nm shows you this:

  • the symbol value, printed in whatever radix you picked with the options (scroll down, they're all there), or hexadecimal by default.
  • the symbol type. and at least these types get used — there are others too, depending on the object file format. here's the tea: if it's lowercase, the symbol is usually local. if it's uppercase, the symbol is global (external). BUT — and this is the plot twist — there are a few lowercase symbols that get shown for special global symbols: "u", "v" and "w". not me being confused by that the first time, i literally gasped. 😭
  • the symbol name. and if a symbol has version info attached, that gets displayed too. more on that below 👇

🌈 the symbol types, one by one, no skips, periodt

  • "A" — the symbol's value is absolute, and further linking will not change it. it is what it is, fr fr.
  • "B", "b" — the symbol lives in the BSS data section. that section typically holds zero-initialized or uninitialized data, though the exact behaviour is system dependent. (so like, usually this, but don't @ me.)
  • "C", "c" — the symbol is common. common symbols are uninitialized data. when you're linking, multiple common symbols can show up with the same name. if the symbol is defined anywhere, then the common symbols get treated as undefined references. and the lowercase c character? that's used when the symbol is in a special section for small commons.
  • "D", "d" — the symbol is in the initialized data section.
  • "G", "g" — the symbol is in an initialized data section for small objects. some object file formats let you access small data objects more efficiently — think a global int variable versus a big ol' global array. small object privilege, honestly. 💅
  • "i" — this one's a double agent, she does two things:
    • for PE format files, it means the symbol is in a section specific to the implementation of DLLs.
    • for ELF format files, it means the symbol is an indirect function. this is a GNU extension to the standard set of ELF symbol types. it indicates a symbol which, if referenced by a relocation, does not evaluate to its address — instead it must be invoked at runtime. the runtime execution will then return the value to be used in the relocation. (wild, right?)
    • > heads up bestie: the actual symbols display for GNU indirect symbols is controlled by the --ifunc-chars command line option. if that option has been provided, then the first character in the string gets used for global indirect function symbols. and if the string contains a second character, that one gets used for local indirect function symbols. iykyk.
  • "I" — the symbol is an indirect reference to another symbol.
  • "N" — the symbol is a debugging symbol.
  • "n" — the symbol is in a non-data, non-code, non-debug read-only section. she's just existing, not participating. 🦋
  • "p" — the symbol is in a stack unwind section.
  • "R", "r" — the symbol is in a read only data section.
  • "S", "s" — the symbol is in an uninitialized or zero-initialized data section for small objects.
  • "T", "t" — the symbol is in the text (code) section. the main character section, let's be real. 👑
  • "U" — the symbol is undefined. it's giving "i exist but also i don't". 🙈
  • "u" — the symbol is a unique global symbol. this is a GNU extension to the standard set of ELF symbol bindings. for this kind of symbol, the dynamic linker makes sure that in the entire process there is just one symbol with this name and type in use. exclusive. no dupes. periodt.
  • "V", "v" — the symbol is a weak object. here's the deal:
    • when a weak defined symbol gets linked with a normal defined symbol, the normal defined symbol is used, no error.
    • when a weak undefined symbol gets linked and the symbol is not defined, the value of the weak symbol becomes zero, no error.
    • on some systems, uppercase indicates that a default value has been specified.
  • "W", "w" — the symbol is a weak symbol that has not been specifically tagged as a weak object symbol. so:
    • when a weak defined symbol gets linked with a normal defined symbol, the normal defined symbol is used, no error.
    • when a weak undefined symbol gets linked and the symbol is not defined, the value of the symbol is determined in a system-specific manner, without error.
    • on some systems, uppercase indicates that a default value has been specified.
  • "-" — the symbol is a stabs symbol in an a.out object file. in this case, the next values printed are the stabs other field, the stabs desc field, and the stab type. stabs symbols are used to hold debugging information. extra fields, extra drama. ✨
  • "?" — the symbol type is unknown, or it's object file format specific. mystery symbol. we love a little enigma. 🧚

💜 and then... the symbol name 💜

after the value and the type comes the symbol name. and if a symbol has version information associated with it, that version info is displayed as well. here's how that works:

  • if the versioned symbol is undefined or hidden from the linker, the version string is displayed as a suffix to the symbol name, preceded by an @ character. for example: foo@VER_1.
  • if the version is the default version to be used when resolving unversioned references to the symbol, then it's displayed as a suffix preceded by two @ characters. for example: foo@@VER_2.

double @ means default. single @ means not. that's the whole trick bestie, you're gonna remember it forever now. 🫶✨

✨ OPTIONS ✨

okay so bestie, here's the thing: the long forms and the short forms are literally the same option wearing different outfits 💅 shown side by side here as alternatives, but they do exactly the same thing.

  • -A, -o, --print-file-name — put the name of the input file (or the archive member) right before each symbol, instead of doing the lazy thing and naming the input file only once, up top, before all of its symbols.
  • -a, --debug-syms — show every single symbol, even the debugger-only ones. Normally those don't get listed, so this is the "no secrets" mode. 🙈
  • -B — same as --format=bsd. It exists purely for compatibility with the MIPS nm, so yeah, it's giving legacy ✨
  • -C, --demangle[=style] — decode (demangle) those crusty low-level symbol names back into human-readable user-level names. It strips off any initial underscore the system prepended, and it's what makes C++ function names actually readable instead of a keyboard smash 😭. Different compilers mangle in different styles, so the optional style argument lets you pick a demangling style that matches your compiler.
  • --no-demangle — don't demangle low-level symbol names. This is the default, so if you did nothing, congrats, this is already you. 🎀
  • --recurse-limit, --no-recurse-limit, --recursion-limit, --no-recursion-limit — turns a limit on recursion during demangling on or off. Here's the tea: name mangling formats allow infinite recursion, so it's genuinely possible to craft strings whose decoding eats up all the stack space on the host machine and triggers a memory fault 💀. The limit tries to stop that by capping recursion at 2048 levels of nesting.

The default is for the limit to be enabled, but you might need to disable it to demangle truly complicated names. But lowkey important: if you disable the recursion limit, stack exhaustion is possible, and any bug report about that happening will be rejected. So like. Choose wisely bestie.

  • -D, --dynamic — show the dynamic symbols instead of the normal ones. Only meaningful for dynamic objects, like certain types of shared libraries. 🦋
  • -f format, --format=format — use output format format, which can be "bsd", "sysv", "posix" or "just-symbols". Default is "bsd". Only the *first character of *format matters, and it can be upper or lower case, because we're chill like that.
  • -g, --extern-only — only show external symbols. Keep it external, keep it iconic 👑
  • -h, --help — show a summary of the options for nm and dip out.
  • --ifunc-chars=CHARS — when showing GNU indirect function symbols, nm defaults to using the "i" character for both local indirect functions and global indirect functions. This option lets you hand it a string with **one or two characters. The first character gets used for global indirect function symbols, and the second one, if you bothered to include it, gets used for local indirect function symbols. ✨
  • j — same as --format=just-symbols. Just the symbols, nothing else, main character energy only.
  • -l, --line-numbers — for each symbol, use the debugging info to try to find a filename and line number. For a defined symbol, it looks for the line number of the symbol's address. For an undefined symbol, it looks for the line number of a relocation entry that refers to the symbol. If it finds line number info, it prints it after all the other symbol info. 🎀
  • --inlines — when -l is active, if the address belongs to a function that got inlined, this makes it print the source info for all the enclosing scopes back to the first non-inlined function too. Example: if "main" inlines "callee1" which inlines "callee2", and the address is from "callee2", then the source info for "callee1" and "main" gets printed as well. It's giving ancestry reveal 🧚
  • -n, -v, --numeric-sort — sort symbols numerically by their addresses instead of alphabetically by their names. Numbers stay winning 🔥
  • -p, --no-sort — don't even bother sorting, just print the symbols in the order they were encountered. Chaos mode, no notes.
  • -P, --portability — use the POSIX.2 standard output format instead of the default one. Equivalent to -f posix. ✨
  • -r, --reverse-sort — flip the sort order (numeric or alphabetic, whichever you picked); last comes first. Reverse it, bestie. 💅
  • -S, --print-size — print both the value and the size of defined symbols for the "bsd" output style. This option has no effect for object formats that don't record symbol sizes — unless --size-sort is also used, in which case a calculated size gets displayed instead.
  • -s, --print-armap — when listing symbols from archive members, include the index: a mapping (stored in the archive by ar or ranlib) of which modules contain definitions for which names. Receipts included 🧾
  • -t radix, --radix=radix — use radix as the radix for printing symbol values. It **must be d for decimal, o for octal, or x for hexadecimal. Those are the only options, don't try to be cute.
  • -u, --undefined-only — only show undefined symbols (the ones external to each object file). By default both defined and undefined symbols get displayed, so this is the "unresolved only" filter.
  • -U, --defined-only — only show defined symbols for each object file. Again, by default both defined and undefined symbols get displayed.
  • -V, --version — show the version number of nm and exit. Slay.
  • -X — this option is ignored, for compatibility with the AIX version of nm. It takes one parameter, which must be the string 32_64. The default mode of AIX nm corresponds to -X 32, which is not supported by GNU nm. So it's giving decorative 😭
  • --plugin name — load the plugin called name to add support for extra target types. This option is only available if the toolchain was built with plugin support enabled.

If --plugin isn't provided, but plugin support has been enabled, then nm iterates over the files in ${libdir}/bfd-plugins in alphabetic order, and the first plugin that claims the object in question gets used.

Heads up: this plugin search directory is not the one used by ld's -plugin option. To make nm use the linker plugin, it has to be copied into the ${libdir}/bfd-plugins directory. For GCC based compilations the linker plugin is called liblto_plugin.so.0.0.0. For Clang based compilations it's called LLVMgold.so. The GCC plugin is always backwards compatible with earlier versions, so it's sufficient to just copy the newest one. 🫶

  • --size-sort — sort symbols by size. For ELF objects, symbol sizes are read straight from the ELF; for other object types the symbol sizes are computed as the difference between the value of the symbol and the value of the symbol with the next higher value. If the "bsd" output format is used, the size of the symbol gets printed rather than the value, and -S must be used in order for both size and value to be printed.
Note — this option does not work if --undefined-only has been enabled, because undefined symbols have no size. Sorry bestie, they're just built different (empty).
  • --special-syms — display symbols that have a target-specific special meaning. These are usually used by the target for some special processing and are not normally helpful when included in normal symbol lists. For example, for ARM targets this option would skip the mapping symbols used to mark transitions between ARM code, THUMB code and data.
  • --synthetic — include synthetic symbols in the output. These are special symbols created by the linker for various purposes. They're not shown by default since they aren't part of the binary's original source code. Manufactured ✨
  • --unicode=[default|invalid|locale|escape|hex|highlight] — controls how UTF-8 encoded multibyte characters in strings get displayed.
    • --unicode=default gives them no special treatment. That's the default, obvs.
    • --unicode=locale displays the sequence in the current locale, which may or may not support them.
    • --unicode=hex and --unicode=invalid display them as hex byte sequences, enclosed by either angle brackets or curly braces.
    • --unicode=escape displays them as escape sequences (\uxxxx).
    • --unicode=highlight displays them as escape sequences highlighted in red (if the output device supports it). The colouring is meant to draw attention to unicode sequences where they might not be expected. 🚨
  • -W, --no-weak — do not display weak symbols. Protect your peace.
  • --with-symbol-versions, --without-symbol-versions — enables or disables the display of symbol version information. The version string shows up as a suffix on the symbol name, preceded by an @ character. For example foo@VER_1. If the version is the default version to be used when resolving unversioned references to the symbol, then it's displayed as a suffix preceded by two @ characters. For example foo@@VER_2. By default, symbol version information is displayed.
  • *--target=bfdname* — specify an object code format other than your system's default format.
  • @file — read command-line options from file. The options read get inserted in place of the original @file option. If file doesn't exist, or can't be read, then the option is treated **literally, and not removed.

Options in file are separated by whitespace. A whitespace character can be included in an option by surrounding the entire option in either single or double quotes. Any character (including a backslash) can be included by prefixing the character to be included with a backslash. The file may itself contain additional @file options; any such options get processed recursively. 🌀

🌈 SEE ALSO 🌈

ar(1), objdump(1), ranlib(1), and the Info entries for binutils. Go read the friends, they're all iconic in their own way 💖

Copyright (c) 1991-2025 Free Software Foundation, Inc.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover Texts, and with no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License".

and that's the whole page bestie!! 🎀✨ this was binutils-2.44, dated 2025-03-28, and yes it really is called NM(1) — go sort some symbols, you absolute icon 💅👑

📦 where this page comes from