READELF(1)

📦
version 2.45.50.20251209 · 5 versions
, in ubuntu resolute, ubuntu stonking

okay so bestie, welcome to readelf(1) from the GNU Development Tools family — the manual page that's about to become your roman empire. buckle up, we're reading ELF files together and it's gonna be a whole vibe 💖

✨ NAME ✨

readelf — display information about ELF files

🎀 SYNOPSIS 🎀

okay so here's the full spell, no cap, copy it exactly:

readelf [-a|--all]
        [-h|--file-header]
        [-l|--program-headers|--segments]
        [-S|--section-headers|--sections]
        [-g|--section-groups]
        [-t|--section-details]
        [-e|--headers]
        [-s|--syms|--symbols]
        [--dyn-syms|--lto-syms]
        [--sym-base=[0|8|10|16]]
        [--demangle=style|--no-demangle]
        [--quiet]
        [--recurse-limit|--no-recurse-limit]
        [-U method|--unicode=method]
        [-X|--extra-sym-info|--no-extra-sym-info]
        [-n|--notes]
        [-r|--relocs]
        [-u|--unwind]
        [-d|--dynamic]
        [-V|--version-info]
        [-A|--arch-specific]
        [-D|--use-dynamic]
        [-L|--lint|--enable-checks]
        [-x <number or name>|--hex-dump=<number or name>]
        [-p <number or name>|--string-dump=<number or name>]
        [-R <number or name>|--relocated-dump=<number or name>]
        [-j <number or name>|--display-section=<number or name>]
        [-z|--decompress]
        [-c|--archive-index]
        [-w[lLiaprmfFsoORtUuTgAck]|
         --debug-dump[=rawline,=decodedline,=info,=abbrev,=pubnames,=aranges,=macro,=frames,=frames-interp,=str,=str-offsets,=loc,=Ranges,=pubtypes,=trace_info,=trace_abbrev,=trace_aranges,=gdb_index,=addr,=cu_index,=links]]
        [-wK|--debug-dump=follow-links]
        [-wN|--debug-dump=no-follow-links]
        [-wD|--debug-dump=use-debuginfod]
        [-wE|--debug-dump=do-not-use-debuginfod]
        [-P|--process-links]
        [--dwarf-depth=n]
        [--dwarf-start=n]
        [--ctf=section]
        [--ctf-parent=section]
        [--ctf-symbols=section]
        [--ctf-strings=section]
        [--sframe=section]
        [-I|--histogram]
        [--got-contents]
        [-v|--version]
        [-W|--wide]
        [-T|--silent-truncation]
        [-H|--help]
        elffile...

💅 DESCRIPTION 💅

so what does readelf actually do, you ask? it displays information about one or more ELF format object files. that's the whole gig. and the options? they control what particular information gets displayed. pick your fighter 🎀

elffile... are the object files to be examined — that's the stuff you're snooping on. 32-bit and 64-bit ELF files are supported, as are archives containing ELF files. versatile queen, honestly.

real talk though: this program performs a similar function to objdump, but it goes into more detail and it exists independently of the BFD library. which means — and this is the iconic part — if there's a bug in BFD then readelf will not be affected. it's giving self-sufficient. it's giving unbothered. 💅

🔥 OPTIONS 🔥

the long and short forms of options, shown here as alternatives, are equivalent — so pick whichever one matches your outfit today. also, real talk: at least one option besides -v or -H must be given. you can't just show up with nothing, bestie.

  • -a, --all — the "give me everything" option, the full charcuterie board. equivalent to specifying --file-header, --program-headers, --sections, --symbols, --relocs, --dynamic, --notes, --got-contents, --version-info, --arch-specific, --unwind, --section-groups and --histogram.
⚠️ but wait — this option does not enable --use-dynamic itself, so if that option is not present on the command line then dynamic symbols and dynamic relocs will not be displayed. yes, --all has a blind spot. no, it's not a bug, it's a feature. 🙈
  • -h, --file-header — displays the information contained in the ELF header at the start of the file. the opening credits, if you will 🎬
  • -l, --program-headers, --segments — displays the information contained in the file's segment headers, if it has any. if it doesn't, no drama, we move on.
  • --quiet — suppresses the "no symbols" diagnostic. so when there are, in fact, no symbols, it just... doesn't tell you. silence is golden ✨
  • -S, --sections, --section-headers — displays the information contained in the file's section headers, if it has any.
  • -g, --section-groups — displays the information contained in the file's section groups, if it has any.
  • -t, --section-details — displays the detailed section information. also implies -S, so you get the section headers too. two for one, we love a bundle 🫶
  • -s, --symbols, --syms — displays the entries in the symbol table section of the file, if it has one. and if a symbol has version information associated with it, that gets displayed too. the version string shows up as a suffix to the symbol name, preceded by an @ character — for example foo@VER_1. and if that version is the default version used when resolving unversioned references to the symbol, it's displayed as a suffix preceded by two @ characters — for example foo@@VER_2. one @ vs two @... iykyk 💀
  • --dyn-syms — displays the entries in the dynamic symbol table section of the file, if it has one. the output format is exactly the same as the format used by the --syms option. same fit, different table 💅
  • --lto-syms — displays the contents of any LTO symbol tables in the file. LTO girlies rise 👑
  • --sym-base=[0|8|10|16] — forces the size field of the symbol table to use the given base. any unrecognized options will be treated as 0. here's the breakdown, no notes:
    • --sym-base=0 is the default and the legacy behaviour — it outputs sizes as decimal for numbers less than 100000, and for sizes 100000 and greater it uses hexadecimal notation with a 0x prefix.
    • --sym-base=8 gives you the symbol sizes in octal.
    • --sym-base=10 always gives you the symbol sizes in decimal.
    • --sym-base=16 always gives you the symbol sizes in hexadecimal with a 0x prefix.
  • -C, --demangle[=style] — decodes (demangles) low-level symbol names into user-level names, which makes C++ function names readable instead of giving you the ick. different compilers have different mangling styles, and the optional demangling style argument can be used to choose an appropriate demangling style for your compiler. tailor it to your compiler, periodt 🪡
  • --no-demangle — do not demangle low-level symbol names. this is the default. raw names, no filter, stay feral 🌸
  • --recurse-limit, --no-recurse-limit, --recursion-limit, --no-recursion-limit — enables or disables a limit on the amount of recursion performed whilst demangling strings. here's why this matters: since the name mangling formats allow for an infinite level of recursion, it is possible to create strings whose decoding will exhaust the amount of stack space available on the host machine, triggering a memory fault. the limit tries to prevent this from happening by restricting recursion to 2048 levels of nesting.

the default is for this limit to be enabled, but disabling it may be necessary in order to demangle truly complicated names.

🚨 BUT. if the recursion limit is disabled then stack exhaustion is possible, and any bug reports about such an event will be rejected. so like... don't come crying to the maintainers, bestie, they warned you 😭
  • -U [d|i|l|e|x|h], --unicode=[default|invalid|locale|escape|hex|highlight] — controls the display of non-ASCII characters in identifier names. the default (--unicode=locale or --unicode=default) is to treat them as multibyte characters and display them in the current locale. all other versions of this option treat the bytes as UTF-8 encoded values and attempt to interpret them. if they cannot be interpreted, or if the --unicode=invalid option is used, then they are displayed as a sequence of hex bytes, enclosed in curly parenthesis characters.
    • --unicode=escape displays the characters as unicode escape sequences (\uxxxx).
    • --unicode=hex displays the characters as hex byte sequences enclosed between angle brackets.
    • --unicode=highlight displays the characters as unicode escape sequences and highlights them in red, assuming that colouring is supported by the output device. the colouring is intended to draw attention to the presence of unicode sequences when they might not be expected. it's giving "girl why is there unicode here" energy 🔥
  • -X, --extra-sym-info — when displaying details of symbols, this includes extra information that isn't normally presented. currently it just adds the name of the section referenced by the symbol's index field, if there is one. in the future, more information may be displayed when this option is enabled. a little bonus lore, as a treat 🍓

enabling this option effectively enables the --wide option as well, at least when displaying symbol information.

  • --no-extra-sym-info — disables the effect of the --extra-sym-info option. this is the default. back to the regular amount of info 💅
  • -e, --headers — displays all the headers in the file. equivalent to -h -l -S. the combo meal 🍔
  • -n, --notes — displays the contents of the NOTE segments and/or sections, if any. the little sticky notes of the binary 🗒️
  • -r, --relocs — displays the contents of the file's relocation section, if it has one.
  • -u, --unwind — displays the contents of the file's unwind section, if it has one. heads up though: only the unwind sections for IA64 ELF files, as well as ARM unwind tables (".ARM.exidx" / ".ARM.extab") are currently supported. if support is not yet implemented for your architecture, you could try dumping the contents of the .eh_frames section using the --debug-dump=frames or --debug-dump=frames-interp options. workaround queen 🧚
  • -d, --dynamic — displays the contents of the file's dynamic section, if it has one.
  • -V, --version-info — displays the contents of the version sections in the file, if they exist.
  • -A, --arch-specific — displays architecture-specific information in the file, if there is any. the niche stuff. the deep lore. the "if you know you know" 🦋
  • -D, --use-dynamic — this one does two things depending on the situation:
    • when displaying symbols, it makes readelf use the symbol hash tables in the file's dynamic section, rather than the symbol table sections.
    • when displaying relocations, it makes readelf display the dynamic relocations rather than the static relocations.
  • -L, --lint, --enable-checks — displays warning messages about possible problems with the file(s) being examined. if used on its own, then all of the contents of the file(s) will be examined. if used with one of the dumping options, then the warning messages will only be produced for the things being displayed. it's the concerned bestie checking your outfit before you leave the house 🫶
  • -x <number or name>, --hex-dump=<number or name> — displays the contents of the indicated section as hexadecimal bytes. a number identifies a particular section by index in the section table; any other string identifies all sections with that name in the object file. this option can be repeated multiple times on the command line in order to request multiple hex dumps. hex hex hex, we love a repeatable 💜
  • -R <number or name>, --relocated-dump=<number or name> — displays the contents of the indicated section as hexadecimal bytes, same as above. a number identifies a particular section by index in the section table; any other string identifies all sections with that name in the object file. the difference? the contents of the section will be relocated before they are displayed. this option can also be repeated multiple times on the command line in order to request multiple relocated dumps. slay, flexibility 💅
  • -p <number or name>, --string-dump=<number or name> — dumps the contents of the section you point at, as printable strings ✨. Give it a number and it finds that one section by index in the section table; give it literally any other string and it grabs every section with that name in the object file. And bestie, you can repeat this one as many times as you want on the command line to request multiple string dumps at once. Go off 💅
  • -j <number or name>, --display-section — shows the contents of the section you point at, formatted according to its section header type. Sections with relocations get shown like you'd used --relocations, sections with symbols get shown like you'd used --syms, and so on — it just reads the vibe of the section and matches it. 🦋

A number identifies one particular section by its index in the section table; any other string identifies all sections with that name in the input file(s).

Repeat this option as many times as you like to request multiple section dumps.

  • -z, --decompress — asks readelf to decompress the section(s) being dumped by the x, R or p options before showing them to you. If those sections aren't compressed in the first place, they just get displayed as-is. No drama 🌸
  • -c, --archive-index — shows you the file symbol index info hiding in the header part of binary archives. Does the exact same thing as the t command to ar, except it does it without using the BFD library. Iconic, honestly 👑
  • -w[lLiaprmfFsOoRtUuTgAckK], --debug-dump[=rawline,=decodedline,=info,=abbrev,=pubnames,=aranges,=macro,=frames,=frames-interp,=str,=str-offsets,=loc,=Ranges,=pubtypes,=trace_info,=trace_abbrev,=trace_aranges,=gdb_index,=addr,=cu_index,=links,=follow-links] — displays the contents of the DWARF debug sections in the file, if any are even there. Compressed debug sections get automatically decompressed (temporarily!) before being displayed. 🧚

If one or more of the optional letters or words follows the switch, then only those type(s) of data get dumped. Here's what the letters and words actually mean:

  • a / =abbrev — displays the contents of the .debug_abbrev section.
  • A / =addr — displays the contents of the .debug_addr section.
  • c / =cu_index — displays the contents of the .debug_cu_index and/or .debug_tu_index sections.
  • f / =frames — displays the raw contents of a .debug_frame section.
  • F / =frames-interp — displays the interpreted contents of a .debug_frame section.
  • g / =gdb_index — displays the contents of the .gdb_index and/or .debug_names sections.
  • i / =info — displays the contents of the .debug_info section. Note: the output from this option can also be restricted by the --dwarf-depth and --dwarf-start options. 🙈
  • k / =links — displays the contents of the .gnu_debuglink, .gnu_debugaltlink and .debug_sup sections, if any of them are present. It also displays any links to separate dwarf object files (dwo), if they're specified by the DW_AT_GNU_dwo_name or DW_AT_dwo_name attributes in the .debug_info section.
  • K / =follow-links — displays the contents of any selected debug sections found in linked, separate debug info file(s). Heads up: this can result in multiple versions of the same debug section being displayed if it exists in more than one file. 😭

On top of that, when displaying DWARF attributes, if a form is found that references the separate debug info file, the referenced contents get displayed too.

Note — in some distributions this option is enabled by default. It can be disabled via the N debug option. The default can be chosen when configuring the binutils via the --enable-follow-debug-links=yes or --enable-follow-debug-links=no options. If these are not used then the default is to enable the following of debug links.
Note — if support for the debuginfod protocol was enabled when the binutils were built, then this option will also include an attempt to contact any debuginfod servers mentioned in the DEBUGINFOD_URLS environment variable. This could take some time to resolve. ⏳ This behaviour can be disabled via the =do-not-use-debuginfod debug option.
  • N / =no-follow-links — disables the following of links to separate debug info files. 🚫
  • D / =use-debuginfod — enables contacting debuginfod servers if there's a need to follow debug links. This is the default behaviour.
  • E / =do-not-use-debuginfod — disables contacting debuginfod servers when there's a need to follow debug links.
  • l / =rawline — displays the contents of the .debug_line section in a raw format.
  • L / =decodedline — displays the interpreted contents of the .debug_line section.
  • m / =macro — displays the contents of the .debug_macro and/or .debug_macinfo sections.
  • o / =loc — displays the contents of the .debug_loc and/or .debug_loclists sections.
  • O / =str-offsets — displays the contents of the .debug_str_offsets section.
  • p / =pubnames — displays the contents of the .debug_pubnames and/or .debug_gnu_pubnames sections.
  • r / =aranges — displays the contents of the .debug_aranges section.
  • R / =Ranges — displays the contents of the .debug_ranges and/or .debug_rnglists sections.
  • s / =str — displays the contents of the .debug_str, .debug_line_str and/or .debug_str_offsets sections.
  • t / =pubtype — displays the contents of the .debug_pubtypes and/or .debug_gnu_pubtypes sections.
  • T / =trace_aranges — displays the contents of the .trace_aranges section.
  • u / =trace_abbrev — displays the contents of the .trace_abbrev section.
  • U / =trace_info — displays the contents of the .trace_info section.
Note — displaying the contents of .debug_static_funcs, .debug_static_vars and debug_weaknames sections is not currently supported. Sorry bestie, them's the rules 💀
  • --dwarf-depth=n — limits the dump of the .debug_info section to n children. This is only useful with --debug-dump=info. The default is to print all DIEs; the special value 0 for n also has that effect. ✨

With a non-zero value for n, DIEs at or deeper than n levels will not be printed. The range for n is zero-based.

  • --dwarf-start=n — prints only DIEs beginning with the DIE numbered n. This is only useful with --debug-dump=info.

If specified, this option suppresses printing of any header information and all DIEs before the DIE numbered n. Only siblings and children of the specified DIE get printed.

This one can be used in conjunction with --dwarf-depth. 🫶

  • -P, --process-links — displays the contents of non-debug sections found in separate debuginfo files that are linked to the main file. This option automatically implies the -wK option, and only sections requested by other command line options get displayed.
  • --ctf[=section] — displays the contents of the specified CTF section. CTF sections themselves contain many subsections, and all of them get displayed in order. 🌈

By default it displays the section named .ctf, which is the name emitted by ld.

  • --ctf-parent=member — if the CTF section contains ambiguously-defined types, it'll consist of an archive of many CTF dictionaries, all inheriting from one dictionary that holds the unambiguous types. That member is by default named .ctf, same as the section containing it, but you can change this name using the ctf_link_set_memb_name_changer function at link time. So when you're looking at CTF archives created by a linker that used the name changer to rename the parent archive member, --ctf-parent lets you specify the name used for the parent. 🎀
  • --ctf-parent-section=section — this one lets you pick a completely different section for the CTF parent dictionary (the one with unambiguous types) than for the child dictionaries that hold the ambiguous remainder. The linker doesn't emit ELF objects structured like this, but some third-party linkers might. It's also convenient for inspecting CTF written out as multiple raw files so you can compose them with objcopy, which can put them in different ELF sections but not in different members of a single CTF dict. 💅
  • --ctf-symbols=section, --ctf-strings=section — specify the name of another section from which the CTF file can inherit strings and symbols. By default, the .symtab and its linked string table are used.

If either --ctf-symbols or --ctf-strings is specified, the other must be specified as well. No half-measures, bestie 🦋

  • --got-contents — displays the contents of the file's Global Offset Table (GOT) sections, if it has any. For MIPS, this option is similar to --arch-specific, but it only displays the GOT-related contents and it gets ignored when --arch-specific is used.
  • -I, --histogram — displays a histogram of bucket list lengths when displaying the contents of the symbol tables. 📊
  • -v, --version — displays the version number of readelf.
  • -W, --wide — don't break output lines to fit into 80 columns. By default readelf breaks section header and segment listing lines for 64-bit ELF files so they fit into 80 columns. This option makes readelf print each section header resp. each segment on a single line, which is far more readable on terminals wider than 80 columns. Periodt 👑
  • -T, --silent-truncation — normally, when readelf is displaying a symbol name and has to truncate it to fit into an 80 column display, it adds a suffix of [...] to the name. This command line option disables that behaviour, letting 5 more characters of the name be displayed and restoring the old readelf behaviour from prior to release 2.35. 😌
  • -H, --help — displays the command-line options understood by readelf. 💖
  • @file — okay bestie, this one is a ✨lore drop✨. You can put your command-line options in a file and readelf will scoop them up from there. The options it reads get inserted right in place of the original @file option, like a little plug-and-play moment. But here's the tea: if file doesn't exist, or you can't read it, then the option gets treated literally — like, it just sits there as a plain old @file string — and it does not get removed. Not me getting ghosted by a missing file 😭

Inside the file, options are separated by whitespace. Wanna sneak a whitespace character into an option? Wrap the whole option in single or double quotes. Want literally any character in there — yes, even a backslash — just prefix it with a backslash. And plot twist 👑: the file can itself contain more @file options, and those get processed recursively. It's files all the way down, fr fr.

🌈 SEE ALSO 🌈

Like, go read those too. We love a supportive ecosystem. 🫶

Copyright (c) 1991-2025 Free Software Foundation, Inc.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover Texts, and with no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License".

And that's a wrap on the whole readelf era, bestie 💖 This absolute icon of a page is binutils-2.45.50, dated 2025-12-09, and honestly? Slay. Go inspect some ELF files, you main character 🦋✨💅

📦 where this page comes from