elfdump(1) User Commands elfdump(1)NAMEelfdump - dumps selected parts of an object file
SYNOPSISelfdump [-cCdegGhHiklmnPrsSuvy] [-p | -w file] [-I index-expr]
[-N name] [-O osabi] [-T type] filename...
DESCRIPTION
The elfdump utility symbolically dumps selected parts of the specified
object file(s). The options allow specific portions of the file to be
displayed.
The elfdump utility is similar in function to the dump(1) utility. The
dump utility offers an older and less user-friendly interface than elf‐
dump, although dump might be more appropriate for certain uses such as
in shell scripts.
Archive files, produced by ar(1), can also be inspected with elfdump.
In this case, each object within the archive is processed using the
options supplied.
elfdump can display the ELF header, program header array, and section
header array for any ELF object. It is also able to display the data
found in the following types of sections:
Category Option ELF Section Type
Dynamic -d SHT_DYNAMIC
Global Offset Table (GOT) -G Special. See below.
Group -g SHT_GROUP
Hardware/Software
Capabilities -H SHT_SUNW_cap
Hash Table -h SHT_HASH
Interpreter -i Special, see below.
Move -m SHT_SUNW_move
Note -n SHT_NOTE
Relocation -r SHT_RELA
SHT_REL
Stack Unwind/Exceptions -u Special. See below.
Syminfo -y SHT_SUNW_syminfo
Symbol Sort -S SHT_SUNW_symsort
SHT_SUNW_tlssort
Symbol Table -s SHT_SYMTAB
SHT_DYNSYM
SHT_SUNW_LDYNSYM
SHT_SUNW_versym
Versioning -v SHT_SUNW_verdef
SHT_SUNW_verneed
Interpreter and global offset table sections do not have a special ELF
section type, but are instead implemented as SHT_PROGBITS sections with
well known names (.interp and .got respectively). elfdump is able to
recognize and display these special sections.
Sections used for stack unwinding and exception handling can have the
ELF section type SHT_PROGBITS, or SHT_AMD64_UNWIND, depending on the
compiler and platform involved. These sections are recognized by name:
.eh_frame, .eh_frame_hdr, and .exception_ranges.
When run without options to narrow the information displayed, elfdump
displays all available information for each object.
For a complete description of the displayed information, refer to the
Linker and Libraries Guide.
OPTIONS
The following options are supported:
-c Dumps section header information.
-C Demangles C++ symbol names.
-d Dumps the contents of the .dynamic section.
-e Dumps the ELF header.
-g Dumps the contents of the .group section.
-G Dumps the contents of the .got section.
-h Dumps the contents of the .hash section.
-H Dumps the contents of the .SUNW_cap hardware and
software capabilities section.
-i Dumps the contents of the .interp section.
-I index-expr Qualifies the sections or program headers to examine
with a specific index or index range. For example,
the third section header in a file can be displayed
using:
example% elfdump-c -I 3 filename
An index-expr can be a single non-negative integer
value that specifies a specific item, as shown in the
previous example. Alternatively, an index-expr can
consist of two such values separated by a colon (:),
indicating a range of items. The following example
displays the third, fourth, and fifth program headers
in a file:
example% elfdump-p -I 3:5 filename
When specifying an index range, the second value can
be omitted to indicate the final item in the file.
For example, the following statement lists all sec‐
tion headers from the tenth to the end:
example% elfdump-c -I 10: filename
See Matching Options for additional information about
the matching options (-I, -N, -T).
-k Calculates the ELF checksum. See gelf_checksum(3ELF).
-l Displays long section names without truncation.
-m Dumps the contents of the .SUNW_move section.
-n Dumps the contents of .note sections. By default,
elfdump displays this data without interpretation in
hexadecimal form. Core files are an exception. A sub‐
set of the core file notes described in core(4) are
interpreted by elfdump and displayed in a high level
format: NT_PRSTATUS, NT_PRPSINFO, NT_PLATFORM,
NT_AUXV, NT_ASRS, NT_PSTATUS, NT_PSINFO, NT_PRCRED,
NT_UTSNAME, NT_LWPSTATUS, NT_LWPSINFO, NT_PRPRIV,
NT_PRPRIVINFO, NT_CONTENT, and NT_ZONENAME.
-N name Qualifies the sections or program headers to examine
with a specific name. For example, in a file that
contains more than one symbol table, the .dynsym sym‐
bol table can be displayed by itself using:
example% elfdump-N .dynsym filename
ELF program headers do not have names. If the -p
option is specified, name refers to the program
header type, and the behavior of the -N option is
identical to that of the -T option. For example, the
program header that identifies an interpreter can be
displayed using:
example% elfdump-p -N PT_INTERP filename
See Matching Options for additional information about
the matching options (-I, -N, -T).
-O osabi Specifies the Operating System ABI to apply when
interpreting the object. osabi can be the name or
value of any of the ELFOSABI_ constants found in
/usr/include/sys/elf.h. For convenience, the ELFOS‐
ABI_ prefix may be omitted from these names. Two
osabi values are fully supported: solaris is the
native ABI of the Solaris operating system. none is
the generic ELF ABI. Support for other operating sys‐
tem ABIs may be incomplete or missing. Items for
which strings are unavailable are displayed in
numeric form.
If -O is not used, and the object ELF header speci‐
fies a non-generic ABI, the ABI specified by the
object is used. If the object specifies the generic
ELF ABI, elfdump searches for a .note.ABI-tag sec‐
tion, and if found, identifies the object as having
the linux ABI. Otherwise, an object that specifies
the generic ELF ABI is assumed to conform to the
solaris ABI.
-p Dumps the program headers. Individual program headers
can be specified using the matching options (-I, -N,
-T). See Matching Options for additional information.
The -p and -w options are mutually exclusive. Only
one of these options can be used in a given elfdump
invocation
-P Generate and use alternative section header informa‐
tion based on the information from the program head‐
ers, ignoring any section header information con‐
tained in the file. If the file has no section head‐
ers a warning message is printed and this option is
automatically selected. Section headers are not used
by the system to execute a program. As such, a mali‐
cious program can have its section headers stripped
or altered to provide misleading information. In con‐
trast the program headers must be accurate for the
program to be runnable. The use of synthetic section
header information derived from the program headers
allows files with altered section headers to be exam‐
ined.
-r Dumps the contents of the .rel[a] relocation sec‐
tions.
-s Dumps the contents of the .SUNW_ldynsym, .dynsym, and
.symtab symbol table sections. For archives, the ar‐
chive symbol table is also dumped. Individual sec‐
tions can be specified with the matching options (-I,
-N, -T). An archive symbol table can be specified
using the special section name -N ARSYM.
In the case of core files, the shndx field has the
value "unknown" since the field does not contain the
valid values.
In addition to the standard symbol table information,
the version definition index of the symbol is also
provided under the ver heading.
See Matching Options for additional information
about the matching options (-I, -N, -T).
-S Dumps the contents of the .SUNW_ldynsym and .dynsym
symbol table sections sorted in the order given by
the .SUNW_dynsymsort and .SUNW_dyntlssort symbol sort
sections. Thread Local Storage (TLS) symbols are
sorted by offset. Regular symbols are sorted by
address. Symbols not referenced by the sort sections
are not displayed.
-T type Qualifies the sections or program headers to examine
with a specific type. For example, in a file that
contains more than one symbol table, the .dynsym sym‐
bol table can be displayed by itself using:
example% elfdump-T SHT_DYNSYM filename
The value of type can be a numeric value, or any of
the SHT_ symbolic names defined in
/usr/include/sys/elf.h. The SHT_ prefix is optional,
and type is case insensitive. Therefore, the above
example can also be written as:
example% elfdump-T dynsym filename
If the -p option is specified, type refers to the
program header type, which allows for the display of
specific program headers. For example, the program
header that identifies an interpreter can be dis‐
played using:
example% elfdump-p -T PT_INTERP filename
The value of type can be a numeric value, or any of
the PT_ symbolic names defined in
/usr/include/sys/elf.h. The PT_ prefix is optional,
and type is case insensitive. Therefore, the above
example can also be written as:
example% elfdump-p -T interp filename
See Matching Options for additional information about
the matching options (-I, -N, -T).
-u Dumps the contents of sections used for stack frame
unwinding and exception processing.
-v Dumps the contents of the .SUNW_version version sec‐
tions.
-w file Writes the contents of sections which are specified
with the matching options (-I, -N, -T) to the named
file. For example, extracting the .text section of a
file can be carried out with:
example% elfdump-w text.out -N .text filename
See Matching Options for additional information about
the matching options (-I, -N, -T).
The -p and -w options are mutually exclusive. Only
one of these options can be used in a given elfdump
invocation
-y Dumps the contents of the .SUNW_syminfo section.
OPERANDS
The following operand is supported:
filename The name of the specified object file.
USAGE
Matching Options
The options -I, -N, and -T are collectively referred to as the matching
options. These options are used to narrow the range of program headers
or sections to examine, by index, name, or type.
The exact interpretation of the matching options depends on the other
options used:
o When used with the -p option, the matching options reference
program headers. -I refers to program header indexes. -T
refers to program header types. As program headers do not
have names, the -N option behaves identically to -T for pro‐
gram headers.
o The matching options are used to select sections by index,
name, or type when used with any of the options -c, -g, -m,
-n, -r, -s, -S, -u, or -w.
o If matching options are used alone without any of the
options -c, -g, -m, -n, -p-r, -s, -S, -u, or -w, then elf‐
dump examines each object, and displays the contents of any
sections matched.
Any number and type of matching option can be mixed in a given invoca‐
tion of elfdump. In this case, elfdump displays the superset of all
items matched by any of the matching options used. This feature allows
for the selection of complex groupings of items using the most conve‐
nient form for specifying each item.
FILES
liblddbg.so linker debugging library
ATTRIBUTES
See attributes(5) for descriptions of the following attributes:
┌─────────────────────────────┬─────────────────────────────┐
│ ATTRIBUTE TYPE │ ATTRIBUTE VALUE │
├─────────────────────────────┼─────────────────────────────┤
│Availability │developer/object-file │
├─────────────────────────────┼─────────────────────────────┤
│Interface Stability │Committed │
└─────────────────────────────┴─────────────────────────────┘
SEE ALSOar(1), dump(1), nm(1), pvs(1), elf(3ELF), core(4), attributes(5)
Linker and Libraries Guide
SunOS 5.11 3 Apr 2009 elfdump(1)
