readelf(1)
Display information about ELF object files, including headers, sections, symbols, and relocations.
Synopsis
readelf [OPTION]... FILE...Description
readelf displays detailed information from ELF (Executable and Linkable Format) object files, shared libraries, and executables. It reads and parses the ELF file structure to show headers, sections, symbols, relocations, and other binary metadata without executing the file.
Unlike objdump, readelf focuses on structural information and is particularly useful for debugging, reverse engineering, and understanding binary dependencies and symbol tables.
Common options
| Flag | What it does |
|---|---|
-h, --file-header | Display the ELF file header |
-l, --program-headers | Display the program headers (segments) |
-S, --section-headers | Display the section headers table |
-s, --syms, --symbols | Display the symbol table entries |
-r, --relocs | Display the relocation entries |
-d, --dynamic | Display the dynamic section (for shared objects and executables) |
-e, --headers | Display all headers (file, program, and section) |
-a, --all | Display all information (equivalent to -e -l -S -s -r -d) |
-x, --hex-dump=<number|name> | Hex dump of section by number or name |
-p, --string-dump=<number|name> | String dump of section (printable characters only) |
-V, --version-info | Display version symbol section |
-w, --debug-dump=[rawline,=info,=loc,...] | Display DWARF debug information |
Examples
Show the ELF file header of the bash binary, including magic number, architecture, and entry point
readelf -h /bin/bashList all sections in the C library, useful for understanding binary structure
readelf -S /usr/lib/libc.so.6 | head -20Display all function and object symbols in the ls command
readelf -s /bin/ls | grep 'FUNC\|OBJECT'Show all shared library dependencies of a binary
readelf -d /usr/bin/python3 | grep NEEDEDHex dump the .comment section to see compiler information
readelf -x .comment /bin/catFind the dynamic linker path for an executable
readelf -l /bin/dd | grep 'INTERP'Display relocation entries for a shared library
readelf -r /usr/lib/libssl.so.1.1 | head -15Display all headers of a custom binary and page through the output
readelf -e ./myprogram 2>&1 | less