How to View ELF File Information Using the readelf Command in Linux

When you download a compiled binary executable or a shared library on a Linux system, simply viewing the file with a text editor will yield absolute gibberish. If you are debugging software, attempting to reverse-engineer a proprietary driver, or trying to understand why a specific program refuses to execute, you must inspect the file’s internal structure. In the Linux world, compiled binaries generally use the Executable and Linkable Format (ELF). The readelf command is the definitive tool for dissecting and displaying information about these complex files.

How the readelf Command Works

The readelf utility is part of the standard GNU Binutils package. Unlike the objdump command which relies on the Binary File Descriptor (BFD) library to parse files, readelf reads the ELF file directly on its own. This makes it significantly faster and often more accurate when dealing with corrupted or non-standard ELF files.

Viewing the ELF Header

Every ELF file begins with a critical header that acts as a blueprint, describing exactly what the file is and what kind of hardware it expects to run on. If a program crashes with an “Exec format error”, checking the header should be your very first troubleshooting step.

readelf -h my_binary_program

This command prints the header, revealing critical information:

• Class: Is it a 32-bit (ELF32) or 64-bit (ELF64) program?
• Type: Is it an executable program (EXEC), a shared library (DYN), or an object file (REL)?
• Machine: What CPU architecture was this compiled for? (e.g., Advanced Micro Devices X86-64, or ARM AArch64). If you attempt to run an ARM binary on an Intel CPU, it will fail, and the header will instantly tell you why.

Listing the Program Sections

An ELF file is divided into various sections. The .text section contains the actual executable machine code, the .data section contains initialized variables, and the .rodata section holds read-only strings. To view a complete map of all the sections housed within the file, use the -S flag.

readelf -S my_binary_program

This will output a large table showing the name, type, memory address, and exact byte size of every section in the file.

Viewing the Symbol Table

If you are a developer and you need to see exactly which functions and variables are embedded inside a shared library (.so file), you can dump the symbol table using the -s flag.

readelf -s libcustom.so

This will list every single function exported by the library, which is invaluable when troubleshooting “undefined reference” linker errors during software compilation.