readelf is a powerful utility in the GNU Binutils suite used for displaying information about ELF (Executable and Linkable Format) files. ELF is a common standard file format for executables, object code, shared libraries, and core dumps in Unix-based systems. Understanding readelf is essential for developers and system administrators who need to inspect and manipulate these files.

Getting Started with readelf

To use readelf, you need to have it installed on your system. On most Linux distributions, it is part of the binutils package. You can install it using the following commands:

• For Ubuntu/Debian:

sudo apt-get install binutils

Once installed, you can invoke readelf from the command line:

readelf [options] <elf-file>

Key Options and Their Usage

readelf has a multitude of options that allow you to inspect different parts of an ELF file. We will create a sample C program which just displays sample string to the console.

myProgram.c:

#include <stdio.h>

void main() {

	printf("ReadELF Example.\n");
}

This is how we will compile and run this program:

Here, we delve into the most important readelf options:

1. Displaying ELF Header

The ELF header contains important information about the file, such as the type, architecture, entry point address, and program header table location.

readelf -h <elf-file>

Example:

readelf -h myProgram.o

As you can see this elf type is Position-Independent Executable. What if we compile the C program with -c flag, which means compile only no linking.

gcc -c myProgram.c -o myProgram.o

readelf -h myProgram.o

It has became relocatable file, it is no more executable.

2 Displaying Program Headers

Program headers describe segments used at runtime and provide the system with information needed to load the file.

readelf -l <elf-file>

Example:

readeld -l myProgram.o

3 Displaying Section Headers

Section headers describe the sections of an ELF file. Sections contain various types of data used during linking and execution.

readelf -S <elf-file>

Example:

readelf -S myProgram.o

4 Displaying Symbol Tables

Symbol tables contain information about functions and variables defined or used in the file.

readelf -s <elf-file>

Example:

readelf -s myProgram.o

5 Displaying Relocation Information

Relocation sections contain information about address adjustments necessary for the file to execute correctly.

readelf -r <elf-file>

Example:

readelf -r myProgram.o

6 Displaying Notes

Notes sections can contain additional information, such as build information or ABI notes.

readelf -n <elf-file>

Example:

readelf -n myProgram.o

7 Displaying Dynamic Section

The dynamic section contains information that is used by the dynamic linker to load and link shared libraries.

readelf -d <elf-file>

Example:

readelf -d myProgram.o

8 Display All Details

The -a option displays all header information, including ELF header, program headers, section headers, and all the tables associated with the file.

readelf -a <elf-file>

Example:

readelf -a myProgram.o