eu-readelf

Display information about ELF format files

TLDR

Display all extractable information contained in the ELF file

$ eu-readelf [[-a|--all]] [path/to/file]

Display the contents of all NOTE segments/sections, or of a particular segment/section

$ eu-readelf [[-n|--notes]] [.note.ABI-tag] [path/to/file]

SYNOPSIS

eu-readelf [options] elf-file...

-a, --all
    Displays all information available in the ELF file.

-h, --file-header
    Displays the ELF file header information.

-l, --program-headers, --segments
    Displays the program headers (segments) of the ELF file.

-S, --section-headers, --sections
    Displays the section headers of the ELF file.

-s, --symbols, --syms
    Displays the symbol table entries.

-D, --debug-dump
    Dumps all available debugging information sections. This is a primary feature of eu-readelf.

-w

, --debug-dump=

Dumps specific debugging information sections, such as .debug_info, .debug_abbrev, .debug_line, .debug_str, etc.

-x

, --hex-dump=

Performs a hexadecimal dump of the specified section's contents.

-p

, --string-dump=

    Prints the contents of the specified section as strings.

-r, --relocs
    Displays the relocation entries.

-d, --dynamic
    Displays the dynamic section information.

-V, --version-info
    Displays version sections (.gnu.version, .gnu.version_r, .gnu.version_d).

-i, --interpreter
    Displays the program interpreter path, if present.

-W, --wide
    Don't break output lines to fit display width.

-v, --version
    Displays the version information for eu-readelf.

DESCRIPTION

eu-readelf is a command-line utility from the elfutils project used to display information about ELF (Executable and Linkable Format) files. It serves as an alternative to the traditional GNU readelf, offering enhanced capabilities, particularly in handling modern DWARF (Debugging With Attributed Record Formats) versions, including DWARF5, and complex debug scenarios like split debuginfo.

The tool parses various sections of an ELF file, presenting their contents in a human-readable format. This includes file headers, program headers, section headers, symbol tables, relocation entries, and, most notably, detailed debugging information. Its robust support for debuginfo makes it an invaluable tool for developers, reverse engineers, and system administrators needing to analyze executables, libraries, and core dumps with rich debugging data.

CAVEATS

eu-readelf is part of the elfutils project, which is often distributed separately from GNU binutils. Therefore, it might not be pre-installed on all Linux distributions by default. Its primary advantage lies in its more advanced and up-to-date support for DWARF debugging information (especially DWARF5) and its robust handling of split debuginfo files, which can differ in output format or completeness compared to GNU readelf.

<I>SPLIT DEBUGINFO SUPPORT</I>

eu-readelf is highly proficient in analyzing ELF files that utilize split debuginfo, where debugging information is stored in separate files (e.g., .debug files). This is crucial for reducing the size of deployed binaries without losing debuggability.

<I>DWARF5 COMPATIBILITY</I>

One of its key strengths is comprehensive support for DWARF5, the latest version of the DWARF debugging information format. This ensures accurate and complete parsing of debug data from modern compilers and toolchains.

HISTORY

eu-readelf emerged as part of the elfutils project, initiated primarily by Red Hat engineers. The project's goal was to provide a set of robust, efficient, and well-maintained tools for handling ELF files, with a particular focus on debugging information. Its development has been driven by the need for better support for modern DWARF standards and the growing complexity of debug scenarios, including separate debug files and compressed debug sections, offering a more capable alternative to existing ELF utilities.