readelf

readelf
Name	readelf
Caption	Output fragment of readelf on an ELF executable
Developer	Free Software Foundation, GNU Project, rdc
Released	1991
Latest release version	2.35.1
Operating system	Linux, Unix, BSD, GNU/Hurd
Platform	x86, x86-64, ARM, AArch64, PowerPC, MIPS, RISC-V
Size	small
License	GNU General Public License

readelf readelf is a command-line utility for displaying information about ELF (Executable and Linkable Format) files. It is distributed with the GNU Binutils suite and is widely used by developers, system administrators, and reverse engineers working with Linux and other Unix-like operating systems. The tool inspects executable files, shared libraries, core dumps, and object files to reveal headers, sections, symbols, relocations, and debugging-related metadata.

Overview

readelf focuses on parsing and printing internals of ELF files, exposing data such as the ELF header, program headers, section headers, symbol tables, dynamic tags, relocation entries, and DWARF debugging sections. Its output complements tools like objdump, nm (Unix), and strings (Unix), serving specialists who need precise, low-level visibility into binaries produced by toolchains such as GCC, Clang (compiler), and linkers like GNU ld. The utility is part of the GNU Binutils collection maintained by contributors associated with projects including the GNU Project, Free Software Foundation, and various distributions such as Debian, Fedora, and Ubuntu (operating system).

History and development

readelf was introduced to address the need for a standalone ELF parser independent of disassembly output. Its development is tied to the evolution of the GNU Binutils project under the stewardship of key figures in free software like contributors known through GNU Project mailing lists and maintainers associated with distributions including Red Hat, SUSE, and OpenBSD ports. Over time, readelf has incorporated support for evolving ELF specifications promulgated by the Tool Interface Standard (TIS), System V Release 4, and architecture-specific extensions from vendors such as Intel, ARM, MIPS Technologies, and IBM for PowerPC. The project integrates contributions from maintainers, committers, and bug reporters from organizations like Google, Intel Corporation, ARM Ltd., and academic groups that use ELF in research and teaching at institutions such as MIT and Stanford University.

Features and usage

readelf can: - Dump ELF headers, revealing fields defined by the original System V ABI and later standards used by processors from AMD and Intel to RISC-V International. - Display program headers that describe segments used by runtime engines such as the Linux kernel loader and dynamic linkers like ld.so and GNU libc. - List section headers with details for sections used by compilers and linkers, including sections produced by GCC plugins, Clang frontends, and debuggers like GDB. - Print symbol tables, dynamic tags, and relocation records critical for linkers including Gold (linker) and lld. - Show DWARF debug information generated by toolchains used in IDEs such as Eclipse or Visual Studio Code with extensions for native development.

Typical users include maintainers of Linux kernel, developers working on cross-compilation for Android (operating system), and security researchers analyzing binaries from projects hosted on platforms like GitHub, GitLab, and Bitbucket.

Command-line options

readelf provides a rich set of options to target specific ELF structures. Common options include: - -h to print the ELF header, a critical step when verifying format compatibility with loaders like the Linux kernel. - -l to show program headers and interpreter entries used by runtime linkers such as ld.so. - -S to list section headers, useful when inspecting output from linkers including GNU ld and LLD. - -s to display symbol tables created by compilers like GCC or Clang. - -r to print relocation entries produced by linkers following naming and relocation types defined by vendors such as ARM Ltd. and Intel Corporation. - -d and -D for dynamic section contents and dynamic symbols used by dynamic linkers including GNU libc. - -e for displaying the ELF header and entry point metadata used by bootloaders such as GRUB. Options can be combined to produce focused reports; scriptable output is common in continuous integration pipelines maintained by organizations like Travis CI or Jenkins.

Output formats and interpretation

readelf outputs plain text with human-readable names for numeric constants defined in specifications such as System V Application Binary Interface and vendor extensions from companies like Oracle Corporation and ARM Ltd.. Interpreting output often requires cross-referencing with documentation from standards bodies like IEEE or vendor manuals from Intel Corporation and ARM Ltd.. For DWARF sections, readelf shows abbreviations, line number tables, and frame information used by debuggers such as GDB and analyzers in projects like Valgrind and AddressSanitizer. Understanding relocation types, symbol bindings, and section flags can be essential when porting software between platforms like x86-64, ARM64, and PowerPC.

Examples

- Inspect ELF header: run readelf -h on an executable produced by GCC or Clang (compiler) to view class, endianness, and ABI. - View program headers: use readelf -l on a shared object used by GNU libc to confirm interpreter path and load addresses. - Dump symbols: readelf -s on a library built for Android (operating system) reveals exported and local symbols used by runtime linkers such as Bionic (C library). - Examine relocations: readelf -r on an object file produced by GCC when cross-compiling for RISC-V International shows relocation entries and addends.

Implementation and alternatives

readelf is implemented in C as part of GNU Binutils, relying on internal ELF parsing code shared across binutils tools. Alternatives and complementary tools include objdump for disassembly and richer annotations, nm (Unix) for symbol-only listings, eu-readelf from the elfutils project, and platform-specific utilities such as Windows PE tools from Microsoft and macOS Mach-O utilities from Apple Inc.. For graphical inspection, projects like Radare2, Ghidra, and IDA Pro provide interactive views and analysis that build on the same ELF metadata that readelf exposes.

Category:Unix programming tools