What it does
objdump displays detailed information about object files and executables, including headers, sections, symbols, and disassembled machine instructions. It’s a primary tool for understanding binaries.
How it works (mechanical)
objdump parses binary formats (commonly ELF on Linux) and
decodes their internal structures. For disassembly, it translates
machine instructions into assembly using architecture-specific decoders.
- Reads ELF headers and section tables
- Interprets symbol and relocation tables
- Disassembles text sections into assembly
- Architecture-aware (x86, ARM, RISC-V, etc.)
10 Practical Examples
# 1) Display file headers objdump -f mybinary
# 2) List sections objdump -h mybinary
# 3) Show symbol table objdump -t mybinary
# 4) Disassemble executable sections objdump -d mybinary
# 5) Disassemble with source code (if available) objdump -S mybinary
# 6) Disassemble a specific function objdump -d mybinary | less
# 7) Show relocation entries objdump -r mybinary
# 8) Inspect a shared library objdump -T /lib/x86_64-linux-gnu/libc.so.6
# 9) Identify architecture and format objdump -a mybinary
# 10) Quick static analysis of unknown binary objdump -f -h -t mybinary
Notes & Gotchas
- Output can be very large; pipe through
less. - Stripped binaries have limited symbol information.
- Use matching toolchain (binutils) for the target architecture.
-Srequires binaries built with debug symbols.- For interactive reversing, combine with debuggers.
Historical Context
objdump is part of GNU binutils and has long been a foundational
tool for compiler writers, kernel developers, and reverse engineers.
It exposes the boundary between source code and machine execution.
Modern Equivalent / Related Tools
- readelf — ELF-specific inspection
- nm — symbol listings
- strings — printable string extraction
- gdb — interactive debugging
- radare2 / ghidra — advanced reverse engineering