OBJDUMP(1)

📦
version 2.45.50.20251209 · 5 versions
, in ubuntu resolute, ubuntu stonking

💖 OBJDUMP(1) 💖

the GNU Development Tools manual, but make it a group chat 🫶

✨ NAME ✨

objdump — bestie, it displays information from object files 💅 and it eats every single time

🎀 SYNOPSIS 🎀

okay so here's the whole vibe, verbatim, no cap:

objdump [-a|--archive-headers]
        [-b bfdname|--target=bfdname]
        [-C|--demangle[=style] ]
        [-d|--disassemble[=symbol]]
        [-D|--disassemble-all]
        [-z|--disassemble-zeroes]
        [-EB|-EL|--endian={big | little }]
        [-f|--file-headers]
        [-F|--file-offsets]
        [--file-start-context]
        [-g|--debugging]
        [-e|--debugging-tags]
        [-h|--section-headers|--headers]
        [-i|--info]
        [-j section|--section=section]
        [-l|--line-numbers]
        [-S|--source]
        [--source-comment[=text]]
        [-m machine|--architecture=machine]
        [-M options|--disassembler-options=options]
        [-p|--private-headers]
        [-P options|--private=options]
        [-r|--reloc]
        [-R|--dynamic-reloc]
        [-s|--full-contents]
        [-Z|--decompress]
        [-W[lLiaprmfFsoORtUuTgAck]|
         --dwarf[=rawline,=decodedline,=info,=abbrev,=pubnames,=aranges,=macro,=frames,=frames-interp,=str,=str-offsets,=loc,=Ranges,=pubtypes,=trace_info,=trace_abbrev,=trace_aranges,=gdb_index,=addr,=cu_index,=links]]
        [-WK|--dwarf=follow-links]
        [-WN|--dwarf=no-follow-links]
        [-wD|--dwarf=use-debuginfod]
        [-wE|--dwarf=do-not-use-debuginfod]
        [-L|--process-links]
        [--ctf=section]
        [--sframe=section]
        [-G|--stabs]
        [-t|--syms]
        [-T|--dynamic-syms]
        [-x|--all-headers]
        [-w|--wide]
        [--start-address=address]
        [--stop-address=address]
        [--no-addresses]
        [--prefix-addresses]
        [--[no-]show-raw-insn]
        [--adjust-vma=offset]
        [--show-all-symbols]
        [--dwarf-depth=n]
        [--dwarf-start=n]
        [--ctf-parent=section]
        [--no-recurse-limit|--recurse-limit]
        [--special-syms]
        [--prefix=prefix]
        [--prefix-strip=level]
        [--insn-width=width]
        [--visualize-jumps[=color|=extended-color|=off]
        [--disassembler-color=[off|terminal|on|extended]
        [-U method] [--unicode=method]
        [-V|--version]
        [-H|--help]
        objfile...

🦋 DESCRIPTION 🦋

okay so objdump displays information about one or more object files. the options are literally the whole point — they control what particular information you're gonna see. and like, who is this even for? mostly programmers working on the compilation tools themselves, not the girlies who just want their program to compile and work. different demographic, fr fr.

objfile... are the object files to be examined, bestie. and when you specify archives? objdump shows information on each of the member object files. every single one. it's giving thorough. 👑

💅 OPTIONS 💅

The long and short forms of options, shown here as alternatives, are equivalent. At least one option from the list -a,-d,-D,-e,-f,-g,-G,-h,-H,-p,-P,-r,-R,-s,-S,-t,-T,-V,-x must be given.

not me showing up with zero options… bestie you HAVE to pick at least one from that list. it's the law. 🚨
  • -a, --archive-header — if any of the objfile files are archives, display the archive header information (in a format similar to ls -l). and listen, besides the info you could already get from ar tv, objdump -a also shows the object file format of each archive member. extra. iconic. ✨
  • --adjust-vma=offset — when dumping information, first add offset to all the section addresses. super useful if the section addresses don't correspond to the symbol table — which, yes, can happen when you're putting sections at particular addresses using a format that can't represent section addresses, like a.out. (a.out girlies, we see you 🫶)
  • -b bfdname, --target=bfdname — specify that the object-code format for the object files is bfdname. honestly this might not even be necessary, because objdump can automatically recognize many formats. she just knows. 💅

for example,

objdump -b oasys -m vax -h fu.o

displays summary information from the section headers (-h) of fu.o, which is explicitly identified (-m) as a VAX object file in the format produced by Oasys compilers. and you can list the formats available with the -i option, bestie.

  • -C, --demangle[=style] — decode (demangle) low-level symbol names into user-level names. besides removing any initial underscore prepended by the system, this makes C++ function names readable. different compilers have different mangling styles, and the optional demangling style argument can be used to choose an appropriate demangling style for your compiler. your eyes will thank you 😭
  • --recurse-limit, --no-recurse-limit, --recursion-limit, --no-recursion-limit — enables or disables a limit on the amount of recursion performed whilst demangling strings. here's the tea: since the name mangling formats allow for an infinite level of recursion, it's possible to create strings whose decoding will exhaust the amount of stack space available on the host machine, triggering a memory fault. a MEMORY FAULT. the limit tries to prevent this from happening by restricting recursion to 2048 levels of nesting.

the default is for this limit to be enabled, but disabling it may be necessary in order to demangle truly complicated names. note however that if the recursion limit is disabled then stack exhaustion is possible and any bug reports about such an event will be rejected. 💀

girl. turn off the safety rail and you're on your own. they will NOT be hearing your bug report. read the room.
  • -g, --debugging — display debugging information. this attempts to parse STABS debugging format information stored in the file and print it out using a C like syntax. if no STABS debugging was found, this option falls back on the -W option to print any DWARF information in the file. she's flexible like that. 🙈
  • -e, --debugging-tags — like -g, but the information is generated in a format compatible with the ctags tool. same energy, different font. ✨
  • -d, --disassemble, --disassemble=symbol — display the assembler mnemonics for the machine instructions from the input file. this option only disassembles those sections which are expected to contain instructions. if the optional symbol argument is given (perhaps multiple times), then display the assembler mnemonics starting at (all the) symbol. if symbol is a function name then disassembly will stop at the end of the function, otherwise it will stop when the next symbol is encountered. if there are no matches for any symbol then nothing will be displayed. ghosted by the disassembler fr

note: if the --dwarf=follow-links option is enabled then any symbol tables in linked debug info files will be read in and used when disassembling.

  • -D, --disassemble-all — like -d, but disassemble the contents of all non-empty non-bss sections, not just those expected to contain instructions. -j may be used to select specific sections. the whole thing. everything. no crumbs. 🔥

this option also has a subtle effect on the disassembly of instructions in code sections. when option -d is in effect, objdump will assume that any symbols present in a code section occur on the boundary between instructions and it will refuse to disassemble across such a boundary. when option -D is in effect however this assumption is supressed. this means that it is possible for the output of -d and -D to differ if, for example, data is stored in code sections.

if the target is an ARM architecture, this switch also has the effect of forcing the disassembler to decode pieces of data found in code sections as if they were instructions. ARM girlies, this one's for you. 🦋

note: if the --dwarf=follow-links option is enabled then any symbol tables in linked debug info files will be read in and used when disassembling.

  • --no-addresses — when disassembling, don't print addresses on each line or for symbols and relocation offsets. in combination with --no-show-raw-insn this may be useful for comparing compiler output. clean. minimal. aesthetic. ✨
  • --prefix-addresses — when disassembling, print the complete address on each line. this is the older disassembly format. vintage, if you will 🎀
  • -EB, -EL, --endian={big|little} — specify the endianness of the object files. this only affects disassembly. can be useful when disassembling a file format which does not describe endianness information, such as S-records. big or little, pick your fighter 💅
  • -f, --file-headers — display summary information from the overall header of each of the objfile files. the whole overview, bestie. 🌸
  • -F, --file-offsets — when disassembling sections, whenever a symbol is displayed, also display the file offset of the region of data that is about to be dumped. if zeroes are being skipped, then when disassembly resumes, tell the user how many zeroes were skipped and the file offset of the location from where the disassembly resumes. when dumping sections, display the file offset of the location from where the dump starts. receipts for every single byte 🧾
  • --file-start-context — specify that when displaying interlisted source code/disassembly (assumes -S) from a file that has not yet been displayed, extend the context to the start of the file. go all the way back. no half measures. 🫶
  • -h, --section-headers, --headers — display summary information from the section headers of the object file.

file segments may be relocated to nonstandard addresses, for example by using the -Ttext, -Tdata, or -Tbss options to ld. however, some object file formats, such as a.out, do not store the starting address of the file segments. in those situations, although ld relocates the sections correctly, using objdump -h to list the file section headers cannot show the correct addresses. instead, it shows the usual addresses, which are implicit for the target. she's doing her best okay 😭

note, in some cases it is possible for a section to have both the READONLY and the NOREAD attributes set. in such cases the NOREAD attribute takes precedence, but objdump will report both since the exact setting of the flag bits might be important.

  • -H, --help — print a summary of the options to objdump and exit. the girlies love a quick exit 💅
  • -i, --info — display a list showing all architectures and object formats available for specification with -b or -m. the full menu, bestie. 🍓
  • -j name, --section=name — display information for section name. this option may be specified multiple times. stack 'em, queen 👑
  • -L, --process-links — display the contents of non-debug sections found in separate debuginfo files that are linked to the main file. this option automatically implies the -WK option, and only sections requested by other command line options will be displayed. she brings her friends, but only the invited ones ✨
  • -l, --line-numbers — bestie this one slaps debugging info onto your output 💖 it labels the display with the filename and source line numbers that match up to the object code or relocs you're looking at. Only actually useful with -d, -D, or -r tho, so don't come crying if it does nothing on its own.
  • -m machine, --architecture=machine — tells objdump which architecture to use when it's disassembling object files 🎀 literally a lifesaver when your object files don't describe their own architecture info (looking at you, S-records). Wanna see every architecture you've got? Run -i, she'll list them all.

For most architectures you can hand over an architecture name AND a machine name, separated by a colon — like foo:bar would mean the bar machine type inside the foo architecture. Super handy if your objdump was configured to support multiple architectures ✨

If the target is an ARM architecture, this switch does a lil extra: it restricts the disassembly to only those instructions supported by the architecture you named in machine. And if you're forced to use this switch because your input file has zero architecture info, but you still wanna disassemble ALL the instructions? Use -marm. Periodt.

  • -M options, --disassembler-options=options — passes target-specific info down to the disassembler 🦋 only supported on some targets, so vibe check your target first. Need more than one disassembler option? Either stack multiple -M options or smoosh them into one comma-separated list. Both work.

For ARC: dsp controls printing of DSP instructions, spfp selects printing of FPX single precision FP instructions, dpfp selects printing of FPX double precision FP instructions, quarkse_em selects printing of special QuarkSE-EM instructions, fpuda selects printing of double precision assist instructions, fpus selects printing of FPU single precision FP instructions, and fpud selects printing of FPU double precision FP instructions. You can also make all the immediates print in hexadecimal with hex — by default the short immediates print in decimal while the long immediate values print as hexadecimal.

cpu=... lets you enforce a particular ISA when disassembling instructions, overriding the -m value or whatever's sitting in the ELF file. Useful for picking ARC EM or HS ISA, since the architecture is the same for both and the disassembler has to rely on private ELF header data to guess whether the code is EM or HS. You can specify this option multiple times — only the latest value counts, no cap. Valid values are the same as for the assembler -mcpu=... option.

If the target is an ARM architecture, this switch picks which register name set gets used during disassembly:

  • -M reg-names-std (the default) selects the register names as used in ARM's instruction set documentation, except register 13 is called sp, register 14 is called lr and register 15 is called pc.
  • -M reg-names-apcs selects the name set used by the ARM Procedure Call Standard.
  • -M reg-names-raw just uses r followed by the register number.

There are also two variants on the APCS register naming scheme: -M reg-names-atpcs and -M reg-names-special-atpcs, which use the ARM/Thumb Procedure Call Standard naming conventions (either with the normal register names or the special register names 💅).

Still on ARM — you can also force the disassembler to interpret all instructions as Thumb instructions with --disassembler-options=force-thumb. Iconic when you're trying to disassemble thumb code produced by other compilers.

For AArch64 targets, this switch sets whether instructions are disassembled as the most general instruction with -M no-aliases, or whether instruction notes get generated as comments in the disassembly with -M notes.

For the x86, some of these options duplicate what -m does, but they give you finer-grained control:

  • "x86-64", "i386", "i8086" — select disassembly for the given architecture.
  • "intel", "att" — select between intel syntax mode and AT&T syntax mode.
  • "amd64", "intel64" — select between AMD64 ISA and Intel64 ISA.
  • "intel-mnemonic", "att-mnemonic" — select between intel mnemonic mode and AT&T mnemonic mode. Note: "intel-mnemonic" implies "intel" and "att-mnemonic" implies "att".
  • "addr64", "addr32", "addr16", "data32", "data16" — specify the default address size and operand size. These five options get overridden if "x86-64", "i386" or "i8086" show up later in the option string.
  • "suffix" — when in AT&T mode (and also for a limited set of instructions when in Intel mode), tells the disassembler to print a mnemonic suffix even when the suffix could be inferred from the operands, or for certain instructions, from the execution mode's defaults.

For PowerPC, the -M argument raw selects disassembly of hardware insns rather than aliases — so you'll see "rlwinm" instead of "clrlwi", and "addi" instead of "li". All of the -m arguments for gas that select a CPU are supported, and they are: 403, 405, 440, 464, 476, 601, 603, 604, 620, 7400, 7410, 7450, 7455, 750cl, 821, 850, 860, a2, booke, booke32, cell, com, e200z2, e200z4, e300, e500, e500mc, e500mc64, e500x2, e5500, e6500, efs, power4, power5, power6, power7, power8, power9, power10, power11, ppc, ppc32, ppc64, ppc64bridge, ppcps, pwr, pwr2, pwr4, pwr5, pwr5x, pwr6, pwr7, pwr8, pwr9, pwr10, pwr11, pwrx, titan, vle, and future. The 32 and 64 options modify the default or a prior CPU selection, disabling and enabling 64-bit insns respectively. On top of that, altivec, any, lsp, htm, vsx, spe and spe2 add capabilities to a previous or later CPU selection. any will disassemble any opcode known to binutils, but in cases where an opcode has two different meanings or different arguments, you may not see the disassembly you expect 😭. And if you disassemble without giving a CPU selection, a default gets chosen from info BFD gleaned from the object file headers — but the result again may not be what you expect.

For RISC-V, these options are supported:

  • "max" — disassemble without checking the architecture string. It's a best effort mode, so for overlapping ISA extensions the first match (possibly incorrect in a given context) will be used to decode the instruction. Useful if the ELF file doesn't expose an ISA string, preventing automatic ISA subset deduction, and the default fallback ISA string ("rv64gc") doesn't cover all the instructions in the binary.
  • "numeric" — print numeric register names rather than ABI names (e.g., print "x2" instead of "sp").
  • "no-aliases" — disassemble only into canonical instructions. For example, compressed instructions will be represented as such ("addi sp,sp,-128" will be "c.addi16sp sp,-128").
  • "priv-spec=SPEC" — print the CSR according to the chosen privilege spec version (e.g., 1.10, 1.11, 1.12, 1.13).

For MIPS, this option controls the printing of instruction mnemonic names and register names in disassembled instructions. You can specify multiple selections from the following as a comma-separated string, and invalid options are just ignored (she's chill like that):

  • "no-aliases" — print the 'raw' instruction mnemonic instead of some pseudo instruction mnemonic. I.e., print 'daddu' or 'or' instead of 'move', 'sll' instead of 'nop', etc.
  • "msa" — disassemble MSA instructions.
  • "virt" — disassemble the virtualization ASE instructions.
  • "xpa" — disassemble the eXtended Physical Address (XPA) ASE instructions.
  • "gpr-names=ABI" — print GPR (general-purpose register) names as appropriate for the specified ABI. By default, GPR names are selected according to the ABI of the binary being disassembled.
  • "fpr-names=ABI" — print FPR (floating-point register) names as appropriate for the specified ABI. By default, FPR numbers are printed rather than names.
  • "cp0-names=ARCH" — print CP0 (system control coprocessor; coprocessor 0) register names as appropriate for the CPU or architecture specified by ARCH. By default, CP0 register names are selected according to the architecture and CPU of the binary being disassembled.
  • "hwr-names=ARCH" — print HWR (hardware register, used by the "rdhwr" instruction) names as appropriate for the CPU or architecture specified by ARCH. By default, HWR names are selected according to the architecture and CPU of the binary being disassembled.
  • "reg-names=ABI" — print GPR and FPR names as appropriate for the selected ABI.
  • "reg-names=ARCH" — print CPU-specific register names (CP0 register and HWR names) as appropriate for the selected CPU or architecture.

For any of the options listed above, ABI or ARCH may be specified as numeric to have numbers printed rather than names, for the selected types of registers. You can list the available values of ABI and ARCH using the --help option 🫶

For VAX, you can specify function entry addresses with -M entry:0xf00ba. You can use this multiple times to properly disassemble VAX binary files that don't contain symbol tables (like ROM dumps). In those cases the function entry mask would otherwise be decoded as VAX instructions, which would probably lead to the rest of the function being wrongly disassembled. So like, do it.

  • -p, --private-headers — prints info that's specific to the object file format 💜 the exact info printed depends on the object file format. And for some object file formats? No additional information is printed at all. Not me getting zero output and panicking 🙈
  • -P options, --private=options — also prints info specific to the object file format. The argument options is a comma separated list that depends on the format (the lists of options is displayed with the help).

For XCOFF, the available options are:

  • "header"
  • "aout"
  • "sections"
  • "syms"
  • "relocs"
  • "lineno,"
  • "loader"
  • "except"
  • "typchk"
  • "traceback"
  • "toc"
  • "ldinfo"

And if you're dealing with PE, the menu is shorter — literally just these two:

  • "header"
  • "sections"

Not every object format is gonna play along with this option, bestie. In particular, ELF does not use it — it's just not that girl for ELF. 💅

  • -r, --reloc — Prints the relocation entries of the file. And ooh, if you pair it with -d or -D, the relocations get printed interspersed with the disassembly — like they're holding hands walking down the output together. 🫶
  • -R, --dynamic-reloc — Prints the dynamic relocation entries of the file. This one only really means something for dynamic objects — think certain types of shared libraries. And same energy as -r: if you use it with -d or -D, the relocations show up interspersed with the disassembly. ✨
Heads up bestie: objdump does not support displaying RELR type relocations. If you need those, the readelf program is your girl. 💀
  • -s, --full-contents — Displays the full contents of sections, and it's usually living its best life combined with -j when you want specific sections. By default, all non-empty non-bss sections get displayed. And by default, any compressed section gets shown in its compressed form. Wanna see it decompressed instead? Add the -Z option to the command line. 🎀
  • -S, --source — Displays source code intermixed with disassembly, if possible. It implies -d. So it's giving ✨annotated✨ energy.
  • --show-all-symbols — When disassembling, show all the symbols that match a given address, not just the first one. No leaving anyone out. 👑
  • --source-comment[=txt] — Like the -S option, but every single source code line gets displayed with a prefix of txt. Typically txt is a comment string, which is how you tell the assembler code apart from the source code. If txt isn't provided, you get a default string of "# " (that's a hash followed by a space). Cute and functional. 💖
  • --prefix=prefix — Specify prefix to add to the absolute paths when used with -S.
  • --prefix-strip=level — Tells it how many initial directory names to strip off the hardwired absolute paths. Real talk: it has no effect without --prefix=prefix. So don't use it solo, it'll just be standing there. 🙈
  • --show-raw-insn — When disassembling instructions, print the instruction in hex as well as in symbolic form. This is the default — except when --prefix-addresses is used.
  • --no-show-raw-insn — When disassembling instructions, don't print the instruction bytes. This is the default when --prefix-addresses is used.
  • --insn-width=width — Display width bytes on a single line when disassembling instructions.
  • --visualize-jumps[=color|=extended-color|=off] — Visualizes jumps that stay inside a function by drawing ASCII art between the start and target addresses. Yes bestie, actual art. 🎨 The optional =color argument adds color to the output using simple terminal colors. Or, alternatively, the =extended-color argument adds color using 8bit colors — but ngl these might not work on all terminals, so vibe check your setup first.

And if you ever need to disable the visualize-jumps option after you previously enabled it? Just use visualize-jumps=off. Problem solved, no drama. ✨

  • --disassembler-color=off
  • --disassembler-color=terminal
  • --disassembler-color=on|color|colour
  • --disassembler-color=extended|extended-color|extended-colour

These enable or disable the use of colored syntax highlighting in disassembly output. The default behaviour is determined via a configure time option. Note: not all architectures support colored syntax highlighting, and depending on the terminal you're using, colored output may not actually be legible. 😭 So pretty, but maybe unreadable.

The on argument adds colors using simple terminal colors.

The terminal argument does the same thing — but only if the output device is a terminal.

The extended-color argument is similar to the on argument, except it uses 8-bit colors. These may not work on all terminals, iykyk.

The off argument disables colored disassembly. Sad but sometimes necessary. 💔

  • -W[lLiaprmfFsoORtUuTgAckK]
  • --dwarf[=rawline,=decodedline,=info,=abbrev,=pubnames,=aranges,=macro,=frames,=frames-interp,=str,=str-offsets,=loc,=Ranges,=pubtypes,=trace_info,=trace_abbrev,=trace_aranges,=gdb_index,=addr,=cu_index,=links,=follow-links]

Displays the contents of the DWARF debug sections in the file, if any are present. Compressed debug sections get automatically decompressed (temporarily!) before they're displayed — how thoughtful. 🧚 If one or more of the optional letters or words follows the switch, then only those type(s) of data get dumped. The letters and words mean the following:

  • "a", "=abbrev" — Displays the contents of the .debug_abbrev section.
  • "A", "=addr" — Displays the contents of the .debug_addr section.
  • "c", "=cu_index" — Displays the contents of the .debug_cu_index and/or .debug_tu_index sections.
  • "f", "=frames" — Display the raw contents of a .debug_frame section.
  • "F", "=frames-interp" — Display the interpreted contents of a .debug_frame section.
  • "g", "=gdb_index" — Displays the contents of the .gdb_index and/or .debug_names sections.
  • "i", "=info" — Displays the contents of the .debug_info section. Note: the output from this option can also be restricted by using the --dwarf-depth and --dwarf-start options. Chain them, bestie. 🔗
  • "k", "=links" — Displays the contents of the .gnu_debuglink, .gnu_debugaltlink and .debug_sup sections, if any of them are present. It also displays any links to separate dwarf object files (dwo), if they're specified by the DW_AT_GNU_dwo_name or DW_AT_dwo_name attributes in the .debug_info section.
  • "K", "=follow-links" — Display the contents of any selected debug sections that are found in linked, separate debug info file(s). This can result in multiple versions of the same debug section being displayed if it exists in more than one file. Yeah, it can get a little extra. 🙈

In addition, when displaying DWARF attributes, if a form is found that references the separate debug info file, then the referenced contents will also be displayed.

Note — in some distributions this option is enabled by default. It can be disabled via the N debug option. The default can be chosen when configuring the binutils via the --enable-follow-debug-links=yes or --enable-follow-debug-links=no options. If these aren't used, then the default is to enable the following of debug links.

Note — if support for the debuginfod protocol was enabled when the binutils were built, then this option will also include an attempt to contact any debuginfod servers mentioned in the DEBUGINFOD_URLS environment variable. This could take some time to resolve. This behaviour can be disabled via the =do-not-use-debuginfod debug option.

  • "N", "=no-follow-links" — Disables the following of links to separate debug info files.
  • "D", "=use-debuginfod" — Enables contacting debuginfod servers if there's a need to follow debug links. This is the default behaviour.
  • "E", "=do-not-use-debuginfod" — Disables contacting debuginfod servers when there's a need to follow debug links.
  • "l", "=rawline" — Displays the contents of the .debug_line section in a raw format.
  • "L", "=decodedline" — Displays the interpreted contents of the .debug_line section.
  • "m", "=macro" — Displays the contents of the .debug_macro and/or .debug_macinfo sections.
  • "o", "=loc" — Displays the contents of the .debug_loc and/or .debug_loclists sections.
  • "O", "=str-offsets" — Displays the contents of the .debug_str_offsets section.
  • "p", "=pubnames" — Displays the contents of the .debug_pubnames and/or .debug_gnu_pubnames sections.
  • "r", "=aranges" — Displays the contents of the .debug_aranges section.
  • "R", "=Ranges" — Displays the contents of the .debug_ranges and/or .debug_rnglists sections.
  • "s", "=str" — Displays the contents of the .debug_str, .debug_line_str and/or .debug_str_offsets sections.
  • "t", "=pubtype" — Displays the contents of the .debug_pubtypes and/or .debug_gnu_pubtypes sections.
  • "T", "=trace_aranges" — Displays the contents of the .trace_aranges section.
  • "u", "=trace_abbrev" — Displays the contents of the .trace_abbrev section.
  • "U", "=trace_info" — Displays the contents of the .trace_info section.
Note: displaying the contents of .debug_static_funcs, .debug_static_vars and debug_weaknames sections is not currently supported. Sorry bestie, those ones aren't invited to the party. 💀
  • --dwarf-depth=n — Limits the dump of the ".debug_info" section to n children. This is only useful with --debug-dump=info. The default is to print all DIEs; the special value 0 for n will also have this effect.

With a non-zero value for n, DIEs at or deeper than n levels will not be printed. The range for n is zero-based. Counting from zero, as is tradition. ✨

  • --dwarf-start=n — Print only DIEs beginning with the DIE numbered n. This is only useful with --debug-dump=info.

If specified, this option will suppress printing of any header information and all DIEs before the DIE numbered n. Only siblings and children of the specified DIE will be printed. So it's giving very "just this branch of the family tree please". 🌸

This can be used in conjunction with --dwarf-depth.

  • --dwarf-check — Enable additional checks for consistency of Dwarf information. Bestie said let me double-check that for you. 🔍
  • --ctf[=section] — Display the contents of the specified CTF section. CTF sections themselves contain many subsections, all of which are displayed in order. Very organized, very demure. 💅

By default, it displays the name of the section named .ctf, which is the name emitted by ld.

  • --ctf-parent=member — okay so sometimes a CTF section is giving ✨ambiguous types✨, and when that happens it's actually a whole archive of many CTF dictionaries, all of them inheriting from one dictionary that holds the unambiguous types. That member is named .ctf by default (same as the section holding it, cute right), BUT the name can be changed at link time with the ctf_link_set_memb_name_changer function. So if you're looking at a CTF archive made by a linker that used the name changer to rename the parent archive member, --ctf-parent is how you tell objdump the name that got used for the parent. 💅
  • --ctf-parent-section=section — this one lets you pick a completely different section for the CTF parent dictionary (the unambiguous types) than the one used for the child dictionaries (the ambiguous remainder). The linker does not emit ELF objects structured like this, but some third-party linkers might. It's also handy for inspecting CTF written out as multiple raw files so you can compose them with objcopy — objcopy can put them in different ELF sections, but it can't put them in different members of a single CTF dict. iykyk 🫶
  • --sframe[=section] — shows you the contents of the SFrame section you asked for. By default it displays the name of the section named .sframe, which is the name ld emits.
  • -G, --stabs — displays the full contents of any sections requested. It shows the contents of the .stab, .stab.index and .stab.excl sections from an ELF file. This is only useful on systems (like Solaris 2.0) where ".stab" debugging symbol-table entries are carried in an ELF section. In most other file formats the debugging symbol-table entries are interleaved with linkage symbols, and you'll see them in the --syms output instead. no cap 🎀
  • --start-address=address — start displaying data at the address you specify. This affects the output of the -d, -r and -s options.
  • --stop-address=address — stop displaying data at the address you specify. This also affects the output of the -d, -r and -s options.
  • -t, --syms — prints the symbol table entries of the file. Lowkey similar to what the nm program gives you, though the display format is different. The format depends on the format of the file being dumped, but there are two main types. One looks like this:
        [  4](sec  3)(fl 0x00)(ty   0)(scl   3) (nx 1) 0x00000000 .bss
        [  6](sec  1)(fl 0x00)(ty   0)(scl   2) (nx 0) 0x00000000 fred

where the number inside the square brackets is the number of the entry in the symbol table, the sec number is the section number, the fl value are the symbol's flag bits, the ty number is the symbol's type, the scl number is the symbol's storage class and the nx value is the number of auxiliary entries associated with the symbol. The last two fields are the symbol's value and its name. 🌸

The other common output format, usually seen with ELF based files, looks like this:

        00000000 l    d  .bss   00000000 .bss
        00000000 g       .text  00000000 fred

Here the first number is the symbol's value (sometimes called its address, bestie). The next field is actually a set of characters and spaces showing which flag bits are set on the symbol — those characters are described below. Next comes the section the symbol is associated with, or *ABS* if the section is absolute (i.e. not connected with any section), or *UND* if the section is referenced in the file being dumped but not defined there.

After the section name comes another field, a number, which for common symbols is the alignment and for other symbols is the size. Finally the symbol's name gets displayed.

The flag characters are divided into 7 groups, and here they are, iconic behaviour:

  • "l", "g", "u", "!" — the symbol is a local (l), global (g), unique global (u), neither global nor local (a space) or both global and local (!). A symbol can be neither local nor global for a bunch of reasons, e.g. because it's used for debugging, but if it's ever both local and global that's probably an indication of a bug. Unique global symbols are a GNU extension to the standard set of ELF symbol bindings. For such a symbol the dynamic linker will make sure that in the entire process there is just one symbol with this name and type in use. 💀
  • "w" — the symbol is weak (w) or strong (a space).
  • "C" — the symbol denotes a constructor (C) or an ordinary symbol (a space).
  • "W" — the symbol is a warning (W) or a normal symbol (a space). A warning symbol's name is a message to be displayed if the symbol following the warning symbol is ever referenced.
  • "I", "i" — the symbol is an indirect reference to another symbol (I), a function to be evaluated during reloc processing (i) or a normal symbol (a space).
  • "d", "D" — the symbol is a debugging symbol (d) or a dynamic symbol (D) or a normal symbol (a space).
  • "F", "f", "O" — the symbol is the name of a function (F) or a file (f) or an object (O) or just a normal symbol (a space).
  • -T, --dynamic-syms — prints the dynamic symbol table entries of the file. This is only meaningful for dynamic objects, like certain types of shared libraries. It's similar to the info nm gives you when you pass it the -D (--dynamic) option. ✨

The output format is similar to what --syms produces, except an extra field is inserted before the symbol's name, giving the version information associated with the symbol. If the version is the default version to be used when resolving unversioned references to the symbol, then it's displayed as is — otherwise it gets put into parentheses.

  • --special-syms — when displaying symbols, this includes those which the target considers to be special in some way, and which would not normally be of interest to the user. 👑
  • -U [d|i|l|e|x|h], --unicode=[default|invalid|locale|escape|hex|highlight] — controls the display of UTF-8 encoded multibyte characters in strings. The default (--unicode=default) is to give them no special treatment. The --unicode=locale option displays the sequence in the current locale, which may or may not support them. The options --unicode=hex and --unicode=invalid display them as hex byte sequences enclosed by either angle brackets or curly braces.

The --unicode=escape option displays them as escape sequences (\uxxxx) and the --unicode=highlight option displays them as escape sequences highlighted in red (if supported by the output device). The colouring is intended to draw attention to the presence of unicode sequences where they might not be expected. 🌈

  • -V, --version — prints the version number of objdump and exits. short and sweet, we stan 💖
  • -x, --all-headers — displays all available header information, including the symbol table and relocation entries. Using -x is equivalent to specifying all of -a -f -h -p -r -t. the whole menu, bestie 🍓
  • -w, --wide — formats some lines for output devices that have more than 80 columns. Also stops truncating symbol names when they're displayed. wide girl summer 🦋
  • -z, --disassemble-zeroes — normally the disassembly output skips blocks of zeroes. This option tells the disassembler to disassemble those blocks, just like any other data.
  • -Z, --decompress — the -Z option is meant to be used in conjunction with the -s option. It instructs objdump to decompress any compressed sections before displaying their contents. (yes, "conunction" is how the original spells it, I'm not fixing the lore 🙈)
  • @file — read command-line options from file. The options read are inserted in place of the original @file option. If file does not exist, or cannot be read, then the option will be treated literally, and not removed.

Options in file are separated by whitespace. A whitespace character may be included in an option by surrounding the entire option in either single or double quotes. Any character (including a backslash) may be included by prefixing the character to be included with a backslash. The file may itself contain additional @file options; any such options will be processed recursively. 🧚

✨ SEE ALSO ✨

nm(1), readelf(1), and the Info entries for binutils. go read those too, they're the friend group 💜

Copyright (c) 1991-2025 Free Software Foundation, Inc.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover Texts, and with no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License".

And that's the whole page, bestie — you made it to the end and honestly? main character energy. 💅✨

This one's from binutils-2.45.50, dated 2025-12-09, and it lives at OBJDUMP(1). Now go disassemble something and slay. 🎀💖

📦 where this page comes from