eu-readelf

Inspect ELF binaries in depth — headers, sections, symbols, DWARF debug info, relocations, and dynamic linking data (from elfutils).

Category: Binary Analysis ELF inspection Debug symbols Toolchain elfutils

What it does

eu-readelf examines ELF (Executable and Linkable Format) files. It displays detailed structural information such as ELF headers, section headers, program headers, symbol tables, relocation entries, and DWARF debugging metadata.

It is part of the elfutils project and is often considered a more modern and feature-rich alternative to GNU readelf.

How it works (mechanical)

ELF binaries are structured files containing headers, tables, and sections. eu-readelf parses these structures directly, decoding metadata such as symbol bindings, relocation types, and debug information (DWARF).

  • Reads ELF64 and ELF32 formats
  • Understands DWARF debug sections
  • Can inspect stripped vs non-stripped binaries
  • Common in toolchain and low-level debugging workflows

10 Practical Examples

# 1) Show ELF header
eu-readelf -h ./binary
# 2) Show section headers
eu-readelf -S ./binary
# 3) Show program headers
eu-readelf -l ./binary
# 4) Display symbol table
eu-readelf -s ./binary
# 5) Show dynamic section (shared libs)
eu-readelf -d ./binary
# 6) Show relocation entries
eu-readelf -r ./binary
# 7) Inspect DWARF debug info
eu-readelf --debug-dump=info ./binary
# 8) Check build ID
eu-readelf -n ./binary
# 9) Compare stripped vs non-stripped binary
eu-readelf -s stripped_binary
# 10) Analyze shared library
eu-readelf -a /lib/x86_64-linux-gnu/libc.so.6

Notes & Gotchas

  • Not installed everywhere: provided by elfutils package.
  • Large output: DWARF dumps can be very verbose.
  • Stripped binaries: limited symbol visibility.
  • Use with ldd/objdump: complementary tools.

Historical Context

As ELF became the dominant binary format on Linux and Unix-like systems, tools were needed to inspect and debug executable internals. The elfutils project introduced eu-readelf as a more actively maintained and DWARF-aware alternative to GNU binutils tools.

Modern Equivalent / Related Tools

  • readelf — GNU binutils equivalent
  • objdump — disassembly and binary inspection
  • nm — symbol listing
  • ldd — shared library dependencies
  • gdb — runtime debugging