Readelf linux ��

Содержание

Readelf linux ��
readelf command in Linux with Examples
Working with readelf command and ELF files

Readelf linux ��

readelf displays information about one or more ELF format object files. The options control what particular information to display.

elffile … are the object files to be examined. 32-bit and 64-bit ELF files are supported, as are archives containing ELF files.

This program performs a similar function to objdump but it goes into more detail and it exists independently of the BFD library, so if there is a bug in BFD then readelf will not be affected.

The long and short forms of options, shown here as alternatives, are equivalent. At least one option besides ‘ -v ’ or ‘ -H ’ must be given.

Equivalent to specifying —file-header , —program-headers , —sections , —symbols , —relocs , —dynamic , —notes , —version-info , —arch-specific , —unwind , —section-groups and —histogram .

Note — this option does not enable —use-dynamic itself, so if that option is not present on the command line then dynamic symbols and dynamic relocs will not be displayed.

Displays the information contained in the ELF header at the start of the file.

-l —program-headers —segments

Displays the information contained in the file’s segment headers, if it has any.

Suppress «no symbols» diagnostic.

-S —sections —section-headers

Displays the information contained in the file’s section headers, if it has any.

Displays the information contained in the file’s section groups, if it has any.

Displays the detailed section information. Implies -S .

Displays the entries in symbol table section of the file, if it has one. If a symbol has version information associated with it then this is displayed as well. The version string is displayed as a suffix to the symbol name, preceded by an @ character. For example ‘ foo@VER_1 ’. If the version is the default version to be used when resolving unversioned references to the symbol then it is displayed as a suffix preceded by two @ characters. For example ‘ foo@@VER_2 ’.

Displays the entries in dynamic symbol table section of the file, if it has one. The output format is the same as the format used by the —syms option.

Displays the contents of any LTO symbol tables in the file.

Forces the size field of the symbol table to use the given base. Any unrecognized options will be treated as ‘ 0 ’. —sym-base=0 represents the default and legacy behaviour. This will output sizes as decimal for numbers less than 100000. For sizes 100000 and greater hexadecimal notation will be used with a 0x prefix. —sym-base=8 will give the symbol sizes in octal. —sym-base=10 will always give the symbol sizes in decimal. —sym-base=16 will always give the symbol sizes in hexadecimal with a 0x prefix.

-C —demangle[= style ]

Decode (demangle) low-level symbol names into user-level names. This makes C++ function names readable. Different compilers have different mangling styles. The optional demangling style argument can be used to choose an appropriate demangling style for your compiler. See c++filt, for more information on demangling.

Do not demangle low-level symbol names. This is the default.

—recurse-limit —no-recurse-limit —recursion-limit —no-recursion-limit

Enables or disables a limit on the amount of recursion performed whilst demangling strings. Since the name mangling formats allow for an infinite level of recursion it is possible to create strings whose decoding will exhaust the amount of stack space available on the host machine, triggering a memory fault. The limit tries to prevent this from happening by restricting recursion to 2048 levels of nesting.

Читайте также: Clockgen для windows 10

The default is for this limit to be enabled, but disabling it may be necessary in order to demangle truly complicated names. Note however that if the recursion limit is disabled then stack exhaustion is possible and any bug reports about such an event will be rejected.

Display all the headers in the file. Equivalent to -h -l -S .

Displays the contents of the NOTE segments and/or sections, if any.

Displays the contents of the file’s relocation section, if it has one.

Displays the contents of the file’s unwind section, if it has one. Only the unwind sections for IA64 ELF files, as well as ARM unwind tables ( .ARM.exidx / .ARM.extab ) are currently supported. If support is not yet implemented for your architecture you could try dumping the contents of the .eh_frames section using the —debug-dump=frames or —debug-dump=frames-interp options.

Displays the contents of the file’s dynamic section, if it has one.

Displays the contents of the version sections in the file, it they exist.

Displays architecture-specific information in the file, if there is any.

When displaying symbols, this option makes readelf use the symbol hash tables in the file’s dynamic section, rather than the symbol table sections.

When displaying relocations, this option makes readelf display the dynamic relocations rather than the static relocations.

-L —lint —enable-checks

Displays warning messages about possible problems with the file(s) being examined. If used on its own then all of the contents of the file(s) will be examined. If used with one of the dumping options then the warning messages will only be produced for the things being displayed.

Displays the contents of the indicated section as a hexadecimal bytes. A number identifies a particular section by index in the section table; any other string identifies all sections with that name in the object file.

Displays the contents of the indicated section as printable strings. A number identifies a particular section by index in the section table; any other string identifies all sections with that name in the object file.

Requests that the section(s) being dumped by x , R or p options are decompressed before being displayed. If the section(s) are not compressed then they are displayed as is.

Displays the file symbol index information contained in the header part of binary archives. Performs the same function as the t command to ar , but without using the BFD library. See ar.

Displays the contents of the DWARF debug sections in the file, if any are present. Compressed debug sections are automatically decompressed (temporarily) before they are displayed. If one or more of the optional letters or words follows the switch then only those type(s) of data will be dumped. The letters and words refer to the following information:

Displays the contents of the ‘ .debug_abbrev ’ section.

Displays the contents of the ‘ .debug_addr ’ section.

Displays the contents of the ‘ .debug_cu_index ’ and/or ‘ .debug_tu_index ’ sections.

Display the raw contents of a ‘ .debug_frame ’ section.

Display the interpreted contents of a ‘ .debug_frame ’ section.

Displays the contents of the ‘ .gdb_index ’ and/or ‘ .debug_names ’ sections.

Displays the contents of the ‘ .debug_info ’ section. Note: the output from this option can also be restricted by the use of the —dwarf-depth and —dwarf-start options.

Displays the contents of the ‘ .gnu_debuglink ’, ‘ .gnu_debugaltlink ’ and ‘ .debug_sup ’ sections, if any of them are present. Also displays any links to separate dwarf object files (dwo), if they are specified by the DW_AT_GNU_dwo_name or DW_AT_dwo_name attributes in the ‘ .debug_info ’ section.

Display the contents of any selected debug sections that are found in linked, separate debug info file(s). This can result in multiple versions of the same debug section being displayed if it exists in more than one file.

In addition, when displaying DWARF attributes, if a form is found that references the separate debug info file, then the referenced contents will also be displayed.

Note — in some distributions this option is enabled by default. It can be disabled via the N debug option. The default can be chosen when configuring the binutils via the —enable-follow-debug-links=yes or —enable-follow-debug-links=no options. If these are not used then the default is to enable the following of debug links.

Disables the following of links to separate debug info files.

Displays the contents of the ‘ .debug_line ’ section in a raw format.

Displays the interpreted contents of the ‘ .debug_line ’ section.

Displays the contents of the ‘ .debug_macro ’ and/or ‘ .debug_macinfo ’ sections.

Displays the contents of the ‘ .debug_loc ’ and/or ‘ .debug_loclists ’ sections.

Displays the contents of the ‘ .debug_str_offsets ’ section.

Displays the contents of the ‘ .debug_pubnames ’ and/or ‘ .debug_gnu_pubnames ’ sections.

Displays the contents of the ‘ .debug_aranges ’ section.

Displays the contents of the ‘ .debug_ranges ’ and/or ‘ .debug_rnglists ’ sections.

Displays the contents of the ‘ .debug_str ’, ‘ .debug_line_str ’ and/or ‘ .debug_str_offsets ’ sections.

Displays the contents of the ‘ .debug_pubtypes ’ and/or ‘ .debug_gnu_pubtypes ’ sections.

Displays the contents of the ‘ .trace_aranges ’ section.

Displays the contents of the ‘ .trace_abbrev ’ section.

Displays the contents of the ‘ .trace_info ’ section.

Note: displaying the contents of ‘ .debug_static_funcs ’, ‘ .debug_static_vars ’ and ‘ debug_weaknames ’ sections is not currently supported.

Limit the dump of the .debug_info section to n children. This is only useful with —debug-dump=info . The default is to print all DIEs; the special value 0 for n will also have this effect.

With a non-zero value for n , DIEs at or deeper than n levels will not be printed. The range for n is zero-based.

Print only DIEs beginning with the DIE numbered n . This is only useful with —debug-dump=info .

If specified, this option will suppress printing of any header information and all DIEs before the DIE numbered n . Only siblings and children of the specified DIE will be printed.

This can be used in conjunction with —dwarf-depth .

Display the contents of non-debug sections found in separate debuginfo files that are linked to the main file. This option automatically implies the -wK option, and only sections requested by other command line options will be displayed.

Display the contents of the specified CTF section. CTF sections themselves contain many subsections, all of which are displayed in order.

Specify the name of another section from which the CTF dictionary can inherit types. (If none is specified, we assume the CTF dictionary inherits types from the default-named member of the archive contained within this section.)

—ctf-symbols= section —ctf-strings= section

Specify the name of another section from which the CTF file can inherit strings and symbols. By default, the .symtab and its linked string table are used.

If either of —ctf-symbols or —ctf-strings is specified, the other must be specified as well.

Display a histogram of bucket list lengths when displaying the contents of the symbol tables.

Display the version number of readelf.

Don’t break output lines to fit into 80 columns. By default readelf breaks section header and segment listing lines for 64-bit ELF files, so that they fit into 80 columns. This option causes readelf to print each section header resp. each segment one a single line, which is far more readable on terminals wider than 80 columns.

Normally when readelf is displaying a symbol name, and it has to truncate the name to fit into an 80 column display, it will add a suffix of [. ] to the name. This command line option disables this behaviour, allowing 5 more characters of the name to be displayed and restoring the old behaviour of readelf (prior to release 2.35).

Display the command-line options understood by readelf .

Источник

readelf command in Linux with Examples

When we compile source code, an object file is generated of the program and with the help of linker, this object files gets converted to a binary file which, only the machine can understand. This kind of file follows some structures one of which is ELF(Executable and Linkable Format). And to get the information of these ELF files readelf command is used.