What it does
readelf displays detailed structural information about ELF binaries, including headers, program segments, sections, symbols, relocations, and dynamic linking metadata. It does not attempt to disassemble code.
How it works (mechanical)
readelf parses ELF file structures directly according to the ELF
specification. Unlike objdump, it focuses purely on metadata and layout
rather than instruction decoding.
- Reads ELF headers and tables verbatim
- Interprets section and program headers
- Displays dynamic loader information
- No architecture-specific disassembly
10 Practical Examples
# 1) Show ELF header readelf -h mybinary
# 2) List program headers (segments) readelf -l mybinary
# 3) List section headers readelf -S mybinary
# 4) Show dynamic section (needed libraries) readelf -d mybinary
# 5) Show symbol table readelf -s mybinary
# 6) Show relocations readelf -r mybinary
# 7) Inspect interpreter (dynamic loader) readelf -l mybinary | grep interpreter
# 8) Identify ABI and OS compatibility readelf -h mybinary | grep ABI
# 9) Check if binary is PIE readelf -h mybinary | grep Type
# 10) Diagnose missing shared libraries readelf -d mybinary | grep NEEDED
Notes & Gotchas
- Only works on ELF binaries (Linux/Unix).
- Output can be verbose; pipe to
less. - Does not show instructions or control flow.
- Prefer
readelfoverobjdumpfor ELF-only inspection. - Extremely useful for loader and linker debugging.
Historical Context
readelf was introduced as part of GNU binutils to provide a
specification-accurate view of ELF binaries, avoiding the extra abstraction
layers present in multi-format tools.
Modern Equivalent / Related Tools
- objdump — combined disassembly and metadata
- nm — symbol listings
- ldd — runtime library resolution
- patchelf — modify ELF metadata
- eu-readelf — elfutils alternative