User Commands elfdump(1)
NAME
elfdump - dumps selected parts of an object file
SYNOPSIS
elfdump [-cCdegGhHiklmnPrsSuvy] [-p | -w file] [-I index-expr]
[-N name] [-O osabi] [-T type] filename...
DESCRIPTION
The elfdump utility symbolically dumps selected parts of the
specified object file(s). The options allow specific por-
tions of the file to be displayed.The elfdump utility is similar in function to the dump(1)
utility. The dump utility offers an older and less user-
friendly interface than elfdump, although dump might be more
appropriate for certain uses such as in shell scripts. Archive files, produced by ar(1), can also be inspected withelfdump. In this case, each object within the archive is
processed using the options supplied.elfdump can display the ELF header, program header array,
and section header array for any ELF object. It is also ableto display the data found in the following types of sec-
tions: Category Option ELF Section TypeDynamic -d SHT_DYNAMIC
Global Offset Table (GOT) -G Special. See below.
Group -g SHT_GROUP
Capabilities -H SHT_SUNW_cap
Hash Table -h SHT_HASH
Interpreter -i Special, see below.
Move -m SHT_SUNW_move
Note -n SHT_NOTE
Relocation -r SHT_RELA
SHT_REL
Stack Unwind/Exceptions -u Special. See below.
Syminfo -y SHT_SUNW_syminfo
Symbol Sort -S SHT_SUNW_symsort
SHT_SUNW_tlssort
Symbol Table -s SHT_SYMTAB
SHT_DYNSYM
SHT_SUNW_LDYNSYM
SHT_SUNW_versym
Versioning -v SHT_SUNW_verdef
SHT_SUNW_verneed
SunOS 5.11 Last change: 17 May 2010 1
User Commands elfdump(1)
Interpreter and global offset table sections do not have a special ELF section type, but are instead implemented asSHT_PROGBITS sections with well known names (.interp and
.got respectively). elfdump is able to recognize and display
these special sections. Sections used for stack unwinding and exception handling canhave the ELF section type SHT_PROGBITS, or SHT_AMD64_UNWIND,
depending on the compiler and platform involved. These sec-
tions are recognized by name: .eh_frame, .eh_frame_hdr, and
.exception_ranges.
When run without options to narrow the informationdisplayed, elfdump displays all available information for
each object. For a complete description of the displayed information, refer to the Linker and Libraries Guide. OPTIONS The following options are supported:-c
Dumps section header information.-C
Demangles C++ symbol names.-d
Dumps the contents of the .dynamic section.-e
Dumps the ELF header.-g
Dumps the contents of the .group section.-G
SunOS 5.11 Last change: 17 May 2010 2
User Commands elfdump(1)
Dumps the contents of the .got section.-h
Dumps the contents of the .hash section.-H
Dumps the contents of the .SUNW_cap capabilities sec-
tion.-i
Dumps the contents of the .interp section.-I index-expr
Qualifies the sections or program headers to examine with a specific index or index range. For example, the third section header in a file can be displayed using:example% elfdump -c -I 3 filename
An index-expr can be a single non-negative integer value
that specifies a specific item, as shown in the previousexample. Alternatively, an index-expr can consist of two
such values separated by a colon (:), indicating a range of items. The following example displays the third, fourth, and fifth program headers in a file:example% elfdump -p -I 3:5 filename
When specifying an index range, the second value can be omitted to indicate the final item in the file. For example, the following statement lists all section headers from the tenth to the end:example% elfdump -c -I 10: filename
See Matching Options for additional information aboutthe matching options (-I, -N, -T).
-k
SunOS 5.11 Last change: 17 May 2010 3
User Commands elfdump(1)
Calculates the ELF checksum. See gelf_checksum(3ELF).
-l
Displays long section names without truncation.-m
Dumps the contents of the .SUNW_move section.
-n
Dumps the contents of .note sections. By default, elf-
dump displays this data without interpretation in hexa-
decimal form. Core files are an exception. A subset of the core file notes described in core(4) are interpretedby elfdump and displayed in a high level format:
NT_PRSTATUS, NT_PRPSINFO, NT_PLATFORM, NT_AUXV, NT_ASRS,
NT_PSTATUS, NT_PSINFO, NT_PRCRED, NT_UTSNAME,
NT_LWPSTATUS, NT_LWPSINFO, NT_PRPRIV, NT_PRPRIVINFO,
NT_CONTENT, and NT_ZONENAME.
-N name
Qualifies the sections or program headers to examinewith a specific name. For example, in a file that con-
tains more than one symbol table, the .dynsym symbol table can be displayed by itself using:example% elfdump -N .dynsym filename
ELF program headers do not have names. If the -p option
is specified, name refers to the program header type,and the behavior of the -N option is identical to that
of the -T option. For example, the program header that
identifies an interpreter can be displayed using:example% elfdump -p -N PT_INTERP filename
See Matching Options for additional information aboutthe matching options (-I, -N, -T).
-O osabi
Specifies the Operating System ABI to apply whenSunOS 5.11 Last change: 17 May 2010 4
User Commands elfdump(1)
interpreting the object. osabi can be the name or valueof any of the ELFOSABI_ constants found in
/usr/include/sys/elf.h. For convenience, the ELFOSABI_
prefix may be omitted from these names. Two osabi values are fully supported: solaris is the native ABI of the Solaris operating system. none is the generic ELF ABI.Support for other operating system ABIs may be incom-
plete or missing. Items for which strings are unavail-
able are displayed in numeric form.If -O is not used, and the object ELF header specifies a
non-generic ABI, the ABI specified by the object is
used. If the object specifies the generic ELF ABI, elf-
dump searches for a .note.ABI-tag section, and if found,
identifies the object as having the linux ABI. Other-
wise, an object that specifies the generic ELF ABI is assumed to conform to the solaris ABI.-p
Dumps the program headers. Individual program headerscan be specified using the matching options (-I, -N,
-T). See Matching Options for additional information.
The -p and -w options are mutually exclusive. Only one
of these options can be used in a given elfdump invoca-
tion-P
Generate and use alternative section header information based on the information from the program headers, ignoring any section header information contained in thefile. If the file has no section headers a warning mes-
sage is printed and this option is automatically selected. Section headers are not used by the system to execute a program. As such, a malicious program can have its section headers stripped or altered to provide misleading information. In contrast the program headers must be accurate for the program to be runnable. The use of synthetic section header information derived from the program headers allows files with altered section headers to be examined.-r
Dumps the contents of the .rel[a] relocation sections.SunOS 5.11 Last change: 17 May 2010 5
User Commands elfdump(1)
-s
Dumps the contents of the .SUNW_ldynsym, .dynsym, and
.symtab symbol table sections. For archives, the archive symbol table is also dumped. Individual sections can bespecified with the matching options (-I, -N, -T). An
archive symbol table can be specified using the specialsection name -N ARSYM.
In the case of core files, the shndx field has the value "unknown" since the field does not contain the valid values. In addition to the standard symbol table information,the version definition index of the symbol is also pro-
vided under the ver heading. See Matching Options for additional information aboutthe matching options (-I, -N, -T).
-S
Dumps the contents of the .SUNW_ldynsym and .dynsym sym-
bol table sections sorted in the order given by the.SUNW_dynsymsort and .SUNW_dyntlssort symbol sort sec-
tions. Thread Local Storage (TLS) symbols are sorted by offset. Regular symbols are sorted by address. Symbols not referenced by the sort sections are not displayed.-T type
Qualifies the sections or program headers to examinewith a specific type. For example, in a file that con-
tains more than one symbol table, the .dynsym symbol table can be displayed by itself using:example% elfdump -T SHT_DYNSYM filename
The value of type can be a numeric value, or any of theSHT_ symbolic names defined in /usr/include/sys/elf.h.
The SHT_ prefix is optional, and type is case insensi-
tive. Therefore, the above example can also be written as:example% elfdump -T dynsym filename
If the -p option is specified, type refers to the pro-
gram header type, which allows for the display ofSunOS 5.11 Last change: 17 May 2010 6
User Commands elfdump(1)
specific program headers. For example, the program header that identifies an interpreter can be displayed using:example% elfdump -p -T PT_INTERP filename
The value of type can be a numeric value, or any of thePT_ symbolic names defined in /usr/include/sys/elf.h.
The PT_ prefix is optional, and type is case insensi-
tive. Therefore, the above example can also be written as:example% elfdump -p -T interp filename
See Matching Options for additional information aboutthe matching options (-I, -N, -T).
-u
Dumps the contents of sections used for stack frame unwinding and exception processing.-v
Dumps the contents of the .SUNW_version version sec-
tions.-w file
Writes the contents of sections which are specified withthe matching options (-I, -N, -T) to the named file. For
example, extracting the .text section of a file can be carried out with:example% elfdump -w text.out -N .text filename
See Matching Options for additional information aboutthe matching options (-I, -N, -T).
The -p and -w options are mutually exclusive. Only one
of these options can be used in a given elfdump invoca-
tion-y
SunOS 5.11 Last change: 17 May 2010 7
User Commands elfdump(1)
Dumps the contents of the .SUNW_syminfo section. Symbol
attributes are conveyed by character tokens. A Symbol definition acts as an auxiliary filter. B Assigned with D, symbol reference should be directly bound to the associated dependency definition.C Symbol definition is the result of a copy-
relocation. D Symbol reference has a direct association to a dependency containing the definition. F Symbol definition acts as a standard filter. I Symbol definition acts as an interposer. L Symbol reference is to a dependency that should be lazily loaded. N External references can not directly bind to this symbol definition.P Symbol is associated with deferred (post-
poned) dependency. S Symbol is associated with capabilities. OPERANDS The following operand is supported: filename The name of the specified object file.USAGE
Matching OptionsSunOS 5.11 Last change: 17 May 2010 8
User Commands elfdump(1)
The options -I, -N, and -T are collectively referred to as
the matching options. These options are used to narrow the range of program headers or sections to examine, by index, name, or type. The exact interpretation of the matching options depends on the other options used:o When used with the -p option, the matching options
reference program headers. -I refers to program
header indexes. -T refers to program header types.
As program headers do not have names, the -N option
behaves identically to -T for program headers.
o The matching options are used to select sections by index, name, or type when used with any of theoptions -c, -g, -m, -n, -r, -s, -S, -u, or -w.
o If matching options are used alone without any ofthe options -c, -g, -m, -n, -p-r, -s, -S, -u, or
-w, then elfdump examines each object, and displays
the contents of any sections matched. Any number and type of matching option can be mixed in agiven invocation of elfdump. In this case, elfdump displays
the superset of all items matched by any of the matchingoptions used. This feature allows for the selection of com-
plex groupings of items using the most convenient form for specifying each item. FILES liblddbg.so linker debugging libraryATTRIBUTES
See attributes(5) for descriptions of the following attri-
butes:SunOS 5.11 Last change: 17 May 2010 9
User Commands elfdump(1)
____________________________________________________________
| ATTRIBUTE TYPE | ATTRIBUTE VALUE |
|_____________________________|_____________________________|
| Availability | developer/object-file |
|_____________________________|_____________________________|
| Interface Stability | Committed ||_____________________________|_____________________________|
SEE ALSO
ar(1), dump(1), nm(1), pvs(1), elf(3ELF), core(4), attri-
butes(5) Linker and Libraries GuideSunOS 5.11 Last change: 17 May 2010 10