objdump
Objdump is a command-line utility included in the GNU Binutils suite of tools, designed to display comprehensive information about one or more object files, executable binaries, shared libraries, and core dumps.[1] It operates by parsing the contents of these files using the Binary File Descriptor (BFD) library, allowing users to extract details such as section headers, symbol tables, relocation entries, and disassembled machine code.[2] This functionality makes objdump particularly valuable for software developers, reverse engineers, and system analysts working with compiled programs on Unix-like systems.[1]
Key features of objdump include options for selective output, such as -d or -D to disassemble executable sections into assembly language, -t to list the symbol table, -r to show relocation entries, and -h to display section headers with sizes and addresses.[1] It supports a wide range of object file formats (e.g., ELF, COFF, PE) and target architectures, which can be specified via -b for format and -m for machine type, enabling cross-platform analysis without recompilation.[1] Additional capabilities encompass intermixing source code with disassembly (-S), wide output formatting (-w), and processing of debugging information like DWARF sections (-W).[1] These options provide fine-grained control, making objdump an essential tool for debugging, optimization, and binary inspection in development workflows.[2]
Objdump originated as a core component of the GNU Binutils project, which began development in the late 1980s as part of the broader GNU Project to create free software alternatives to proprietary Unix utilities.[2] Its initial copyrights date back to 1990, reflecting early work on binary manipulation tools for the GNU toolchain. Maintained collaboratively through the Sourceware infrastructure, objdump has evolved continuously to support emerging architectures and file formats, with the latest stable release of Binutils at version 2.45.1 as of November 2025.[2] The tool's integration with GNU Compiler Collection (GCC) and other free software projects underscores its role in fostering open-source software development.[2]
Introduction
Purpose and Capabilities
objdump is a command-line utility within the GNU Binutils suite designed to display detailed information from object files, executables, shared libraries, and core dumps, enabling users to inspect the structure and contents of binary data.[1] This tool is particularly valuable for programmers developing compilation tools or seeking to comprehend the internal organization of compiled binaries.[1] By parsing the binary format, objdump extracts metadata and code in a structured manner without altering the source file.[1]
Its core capabilities include retrieving and presenting file headers to reveal format-specific details, disassembling machine instructions into readable assembly mnemonics, enumerating symbols from the symbol table to identify functions and variables, displaying relocation entries that indicate how symbols are resolved during linking, and dumping raw contents of data sections for direct examination.[1] These features allow for a granular breakdown of binary components, supporting analysis across various architectures and formats supported by the underlying BFD library.[1] objdump operates non-destructively, reading the input files solely for output generation and preserving the originals intact to facilitate safe inspection.[1]
In practice, objdump serves key use cases such as reverse engineering binaries to uncover their operational logic, as demonstrated in educational contexts where it aids in disassembling executables for analysis.[3] It is also instrumental in debugging, where developers inspect object files to trace compilation artifacts or verify symbol presence.[4] Additionally, it supports validation of compiler output by allowing comparison of expected versus actual binary structures, enhancing reliability in software development workflows.[5]
Integration with GNU Binutils
GNU Binutils is a collection of binary tools developed as part of the GNU Project, primarily used for creating and manipulating executable and library files on Unix-like systems. The suite includes the GNU assembler (as) for translating assembly language into object code, the GNU linker (ld) for combining object files into executables or shared libraries, and the archiver (ar) for creating and managing static libraries, among other utilities. Objdump serves as a key inspection tool within this ecosystem, enabling users to examine the contents of object files, including disassembly of code sections and analysis of symbols and headers.[2]
Objdump relies on the Binary File Descriptor (BFD) library, a core component shared across the Binutils suite, to handle multiple object file formats transparently without requiring format-specific code in the tool itself. BFD provides a uniform interface for reading and writing binary files in formats such as ELF, COFF, and a.out, allowing objdump to process diverse inputs generated by other Binutils tools like as and ld. This integration ensures that objdump can seamlessly inspect outputs from the compilation and linking pipeline, abstracting away low-level format details.[1]
Within development workflows, objdump complements tools like objcopy, which copies and translates object files between formats or modifies their contents, by providing detailed post-processing analysis of the resulting binaries. Similarly, it extends the functionality of nm, a simpler utility for listing symbols in object files, by offering richer disassembly and section-specific insights that aid in debugging and optimization. For instance, after linking an executable with ld, objdump can be used to disassemble and verify the final binary structure, forming a common pipeline for binary verification in software development.
Historical Development
Origins in GNU Project
Objdump was developed in the early 1990s as part of the GNU Binutils collection, a set of tools initiated by the Free Software Foundation (FSF) to provide a complete free software toolchain for compiling, linking, and manipulating binaries on Unix-like systems.[2] The FSF's broader GNU Project, launched in 1983, aimed to create a free operating system compatible with Unix, necessitating open-source utilities to handle object files and executables without reliance on proprietary software from vendors like AT&T or Microsoft. This effort included Binutils to support cross-architecture development, enabling portability across diverse hardware platforms such as Intel x86, Motorola 68k, and others.[6]
The initial implementation of objdump emerged from work at Cygnus Support (later Cygnus Solutions), a company founded in 1989 to offer commercial support for GNU software.[7] David V. Henkel-Wallace, known by his handle "gumby," contributed initial code to objdump, building on the Binary File Descriptor (BFD) library developed by the Cygnus team.[6] Other early contributors included Steve Chamberlain, John Gilmore, and K. Richard Pixley, who focused on BFD's core functionality to abstract object file formats, allowing tools like objdump to operate uniformly regardless of the underlying binary structure.[6] Cygnus was contracted by entities like Intel and Ready Systems to address the limitations of format-specific tools, leading to BFD's design for handling multiple formats including a.out and early COFF variants.[6]
The primary motivation for objdump was to create a portable, open-source alternative to proprietary binary inspection utilities, such as AT&T's adb debugger or Microsoft's dumpbin, which were tied to specific architectures and operating systems.[6] By leveraging BFD, objdump could disassemble and analyze binaries in a vendor-neutral way, supporting the FSF's goal of fostering free software ecosystems that avoided licensing restrictions on essential development tools. This addressed the growing need in the early 1990s for multi-architecture support as Unix variants proliferated and new formats like ELF emerged, with objdump initially targeting a.out (the traditional Unix executable format) and COFF for compatibility with systems like MS-DOS derivatives.[7]
Objdump's debut occurred in the context of GNU Binutils 1.9, released on April 17, 1991, marking an early milestone in the toolchain's evolution toward version 2.0 by late 1991.[8] This initial release emphasized support for common formats like a.out and nascent ELF, aligning with the FSF's push for standardized, free utilities to inspect and debug executables across emerging hardware.[7] By January 1993, Binutils 2.0, rewritten using BFD, was included on the FSF's experimental distribution tape, solidifying objdump's role in the GNU ecosystem.[7]
Evolution and Milestones
Objdump's development within the GNU Binutils suite has seen iterative enhancements focused on debugging capabilities, disassembly flexibility, and format compatibility. A key milestone occurred with the release of Binutils 2.10 in 2000, which integrated DWARF debugging support into objdump, enabling the tool to parse and display debugging information embedded in object files for improved reverse engineering and analysis.
Subsequent updates expanded disassembly options, notably in Binutils 2.15 released in 2004, where support for Intel syntax was introduced through the -M intel option, allowing users to output assembly in Intel's operand notation rather than the default AT&T style. This change addressed preferences among developers working with x86 architectures. Further refinement came in Binutils 2.33 in 2019, adding the --source-comment option to objdump, which permits custom prefixes for source code lines intermixed with disassembly, enhancing readability in mixed-mode outputs.[9]
Architectural expansions have broadened objdump's applicability across platforms, including support for PE/COFF formats used in Windows executables and Mach-O binaries common on macOS, primarily through extensions in the underlying BFD library. These additions, along with enhancements for cross-compilation targets, have enabled objdump to handle diverse object files in embedded and multi-architecture environments without requiring platform-specific tools.[10]
The tool's evolution relies heavily on community contributions coordinated via the Sourceware platform, with Free Software Foundation maintainers such as Nick Clifton playing a central role in reviewing patches, managing releases, and ensuring compatibility.[11] Clifton, as chief maintainer, has overseen numerous updates integrating volunteer-submitted improvements.[12]
As of November 2025, Binutils 2.45 marks the latest stable release, including advancements such as support for new RISC-V architecture extensions (e.g., zicfiss and zicfilp) and improvements to unwind information formats like SFrame, enhancing objdump's capabilities for parsing debugging data and handling instructions on emerging architectures.[13]
Technical Details
objdump primarily supports the Executable and Linkable Format (ELF), which is the standard for Unix-like systems and embedded environments, enabling detailed disassembly and analysis of executables, shared libraries, and object files.[1] It also handles the legacy a.out format, historically used in early Unix systems for simple executables and relocatable objects.[1] Additionally, objdump processes the Common Object File Format (COFF) and its extension, the Portable Executable (PE) format prevalent in Windows environments, allowing inspection of DLLs and EXEs.[1] Support for the Mach-O format, native to macOS and iOS, is available through the underlying BFD library, though it is limited to basic header and section reading rather than full disassembly in all cases.[14]
The tool extends its capabilities to archive files via the Binary File Descriptor (BFD) abstraction, permitting examination of static libraries (.a files) and dynamic shared objects (.so files) by treating them as collections of constituent object modules.[1] This abstraction layer ensures portability across diverse host systems, as BFD automatically recognizes and parses these formats without requiring format-specific code in objdump itself.
objdump covers a broad spectrum of processor architectures, including x86 (encompassing i386, x86-64, and legacy i8086 variants), ARM (with support for multiple profiles and extensions), MIPS, PowerPC, RISC-V, and numerous others such as Alpha, SPARC, and IA-64.[1] Endianness is handled transparently, with automatic detection for big-endian and little-endian byte orders based on the file's metadata, facilitating cross-platform analysis.[1]
Despite its extensibility through BFD, which allows backends for new formats to be added modularly, objdump offers only partial support for proprietary formats like Intel's Object Module Format (OMF), an older standard for 80x86 object files that lacks full integration in mainstream builds. This reliance on BFD underscores objdump's design for broad interoperability while highlighting gaps in legacy or vendor-specific ecosystems.
Core Libraries and Algorithms
Objdump relies on the Binary File Descriptor (BFD) library from the GNU Binutils suite to achieve format-agnostic reading of object files, encompassing sections, symbols, headers, and relocations across diverse formats such as ELF, COFF (including PE), and a.out. BFD abstracts the underlying file structure, providing a unified interface that allows objdump to access binary data without embedding format-specific parsing logic, thereby supporting portability and extensibility for new formats through backend implementations.
The tool's disassembly engine draws from the opcodes library, which supplies architecture-specific backends responsible for instruction decoding and translation into assembly mnemonics. For example, when processing x86-64 code, the relevant backend interprets opcodes, operands, and modifiers to generate annotated output, while handling variations like endianness and processor modes via configurable parameters. This modular design ensures accurate disassembly for over 50 supported architectures, from ARM to MIPS.
Relocation resolution in objdump leverages BFD's algorithms to process and apply relocation entries during analysis, interspersing them with disassembly to illustrate address computations and linking dependencies. Symbol demangling employs the c++filt component's algorithms, which decode mangled names from languages like C++ (supporting GNU v3, ARM, and other styles) and Java into readable identifiers, facilitating comprehension of complex binaries.[1][15]
Debug format handling is integrated via BFD and dedicated parsers for DWARF (versions 2 through 5), STABS, and PE-specific debug information, enabling extraction of metadata such as line numbers, types, and scopes without invoking external tools like GDB. For DWARF, objdump decodes sections like .debug_info and .debug_line to support source-level insights, while STABS parsing targets legacy formats in ELF or a.out files, and PE handling covers COFF debug records for Windows binaries. This self-contained approach allows standalone inspection of debugging artifacts.[1]
Command-Line Interface
Basic Syntax and Arguments
The basic syntax for invoking objdump is objdump [options] objfile..., where options specify the type of information to display and objfile... denotes one or more input files to analyze.[1]
The objfile argument accepts a single object file, an archive library (in which case objdump processes and displays information for each member object file within the archive), or a core dump file generated by a crashed process.[1] Multiple files can be specified simultaneously on the command line, allowing batch processing; shell wildcards (e.g., *.o) expand to handle sets of files as needed.[16]
To produce any output, at least one display option must be provided, such as -d for disassembly of executable sections; without such an option, objdump will not generate meaningful results and may exit silently or with minimal information.[1]
Objdump returns an exit status of 0 upon successful completion and a non-zero value in case of errors, such as an invalid file format or inability to read the input.
Option Categories and Usage
Objdump's command-line options are organized into categories that allow users to control the type of information displayed from object files, the target architecture and format, debugging features, and output presentation. These options enable precise customization of the tool's output, facilitating tasks from basic file inspection to detailed reverse engineering. The primary reference for these options is the official GNU Binutils documentation.[1]
Display Options govern the core content shown in the output, such as headers, symbols, disassembly, or raw data dumps. The -h or --section-headers option displays a summary of the file's section headers, including names, sizes, and virtual addresses, providing an overview of the object's structure.[1] The -t or --syms option prints the symbol table, listing symbols with their values, sizes, types, and names, which is essential for understanding exported functions and variables.[1] For disassembly, -d or --disassemble generates assembler mnemonics for executable sections, optionally starting from a specified symbol, while -D or --disassemble-all extends this to all non-empty, non-BSS sections, including data areas.[1] The -s or --full-contents option outputs a hexadecimal dump of section contents, often combined with section selection for targeted views of binary data.[1]
Architecture and Format Options ensure compatibility with diverse binary formats and processor architectures. The -m or --architecture option specifies the machine type for disassembly, such as i386 or arm, allowing objdump to interpret instructions correctly for cross-platform files.[1] The -b or --target option defines the binary file format, like elf64-x86-64 or pe-i386, enabling objdump to parse non-native object types.[1] Section selection via -j or --section restricts output to a particular section, such as .text or .data, optimizing analysis by focusing on relevant parts of the file.[1]
Debug and Advanced Options support extraction of debugging information and relocation details. The --dwarf option displays contents from DWARF debug sections, with suboptions like info for general data or frames for call frame information, aiding in source-level debugging.[1] The -S or --source option intermixes original source code with disassembly output, requiring debug symbols and implying -d for instruction listing.[1] The -r or --reloc option prints relocation entries, showing how addresses are adjusted during linking, which is crucial for analyzing dynamic binaries.[1]
Output Control Options refine the formatting and layout of the generated report. The --wide option produces output suitable for wide displays by avoiding truncation of symbol names and disabling line wrapping.[1] The --prefix-addresses option prepends full addresses to each disassembly line, improving readability in complex outputs.[1]
In practice, options are frequently combined to tailor analyses; for instance, -S -d merges source code with disassembly for a hybrid view that correlates high-level code to machine instructions, while adding -j .text limits the scope to the code section.[1] Such combinations leverage objdump's flexibility, assuming the basic syntax of objdump [options] file as the invocation template.[1]
Disassembly and Source Intermixing
Objdump's disassembly output presents machine code in a human-readable assembly language format, typically structured with the instruction's memory address in hexadecimal, followed by the raw byte representation of the instruction, the mnemonic for the operation, and its operands. This format facilitates precise analysis of executable content within object files. For instance, on x86 architectures, an output line might appear as 00000000 <main>: e8 00 00 00 00 call 0x5, where 00000000 is the address, e8 00 00 00 00 are the bytes, call is the mnemonic, and 0x5 is the operand specifying the call target.[1]
The syntax of the disassembly can be adjusted using the -M or --disassembler-options flag to select variants such as Intel or AT&T notation for x86 targets, influencing operand display (e.g., Intel uses mov eax, ebx while AT&T uses movl %ebx, %eax). This flexibility supports users familiar with different assembly conventions, with the default often being AT&T for GNU tools.[1]
When debug information is present in the object file, the -S or --source option enables intermixing of original source code lines with the corresponding disassembly, providing a mixed view that aligns high-level code with low-level instructions for easier debugging and reverse engineering. Source lines are prefixed by default with # (configurable via --source-comment), and the output might look like:
# 0: int main() {
00000000 <main>:
0: 55 push %ebp
# 1: return 0;
1: b8 00 00 00 00 mov $0x0,%eax
# 0: int main() {
00000000 <main>:
0: 55 push %ebp
# 1: return 0;
1: b8 00 00 00 00 mov $0x0,%eax
This feature requires symbols and line number information, typically from compilers like GCC with the -g flag.[1]
For enhanced visualization of control flow, recent versions of objdump include the --visualize-jumps option, which generates ASCII art diagrams representing jumps and branches within functions, using simple terminal colors or extended 8-bit colors to highlight control transfers. This aids in understanding program flow without external tools, though it applies only to intra-function jumps.[1]
Objdump differentiates executable code sections from data sections during disassembly; by default, it processes only sections marked as executable (e.g., .text), skipping non-executable areas like .data to avoid misleading interpretations of binary data as instructions. The -D or --disassemble-all option overrides this to disassemble all non-empty, non-BSS sections, while -z or --disassemble-zeroes ensures blocks of zero bytes are not skipped, treating them as potential code.[1]
Headers, Symbols, and Relocations
Objdump provides detailed views of an executable or object file's structural metadata through options that reveal section headers, symbol tables, and relocation entries, essential for understanding file organization and linking dependencies.[1]
The -h or --section-headers option displays the section headers of the file, listing each section's name, size in bytes, virtual address, file offset, and access permissions such as read (R), write (W), execute (X), and allocate (A).[1] For instance, the output includes columns for these attributes, allowing users to map sections like .text (code) or .data (initialized data) to their memory layout and protections.[1] The -f or --file-headers option complements this by summarizing the overall file header, including the machine architecture, entry point, and file format details.[1] Additionally, -p or --private-headers outputs format-specific information, such as ELF program headers or PE section details, which vary by object file type.[1]
Symbol tables are examined using the -t or --syms option, which lists entries from the static symbol table with fields for the symbol's value (often an address), size, type (e.g., FUNC for function or OBJECT for object), binding (LOCAL for local or GLOBAL for global), visibility (e.g., HIDDEN for hidden), and name.[1] Objdump supports demangling of C++ symbols to produce readable names from encoded forms.[1] For dynamic symbols in shared objects, the -T or --dynamic-syms option provides similar output but from the dynamic symbol table, including version information where applicable.[1] These tables help identify functions, variables, and their scopes without delving into code content.
Relocation entries, which record unresolved references for the linker, are shown with -r or --reloc, detailing the offset within the section, relocation type (e.g., R_X86_64_PC32 for PC-relative 32-bit displacements on x86-64), associated symbol, and addend value.[1] The -R or --dynamic-reloc option focuses on dynamic relocations in shared libraries, aiding analysis of runtime linking.[1] These entries are crucial for debugging linking issues, as they indicate how addresses are adjusted during final executable creation.
For archive files (e.g., .a libraries), the -a or --archive-headers option lists member files in a format resembling ls -l, including each object's name, timestamp, size, and the underlying file format, facilitating inspection of static library contents.[1] The -x or --all-headers option combines these views, aggregating headers, symbols, and relocations for a comprehensive metadata overview.[1]
Practical Applications
Basic Inspection Examples
One of the fundamental tasks in binary analysis involves examining the structure and contents of object files using objdump's basic options. These inspections allow users to quickly overview sections, symbols, and raw data without delving into disassembly or advanced debugging. The following examples illustrate straightforward commands for common introductory tasks, assuming a typical ELF executable or object file built with standard tools like GCC.
To view the section headers of an executable, the -h or --section-headers option lists the file's sections, including their names, sizes, and virtual addresses. This is useful for understanding the layout of code, data, and other segments such as .text (executable code) and .data (initialized variables). For instance, running objdump -h executable on a simple compiled program produces output like the following, which summarizes the sections in a tabular format:
Sections:
Idx Name Size VMA LMA File off Algn
7 .text 00000250 0000000000401136 0000000000401136 00001136 2**4
CONTENTS, ALLOC, LOAD, READONLY, CODE
8 .fini 0000000e 0000000000401386 0000000000401386 00001386 2**2
CONTENTS, ALLOC, LOAD, READONLY, CODE
24 .data 00000000 0000000000602000 0000000000602000 00002000 2**3
CONTENTS, ALLOC, LOAD, DATA
Sections:
Idx Name Size VMA LMA File off Algn
7 .text 00000250 0000000000401136 0000000000401136 00001136 2**4
CONTENTS, ALLOC, LOAD, READONLY, CODE
8 .fini 0000000e 0000000000401386 0000000000401386 00001386 2**2
CONTENTS, ALLOC, LOAD, READONLY, CODE
24 .data 00000000 0000000000602000 0000000000602000 00002000 2**3
CONTENTS, ALLOC, LOAD, DATA
This output, sourced from the GNU Binutils manual, highlights key attributes like alignment and permissions for each section.[1]
For listing symbols, the -t or --syms option displays the symbol table, showing function names, variables, and their associated addresses, types, and sections. This helps identify entry points or exported functions in libraries or executables. Applying objdump -t library.so to a shared library file yields a format similar to:
00000000 l d .text 0000000000000000 .text
00000000 l d .data 0000000000000000 .data
0000000000400520 l F .text 0000000000000019 _init
000000000040053a l F .text 000000000000000c foo
0000000000401000 [g](/page/G) F .text 0000000000000048 main
00000000 l d .text 0000000000000000 .text
00000000 l d .data 0000000000000000 .data
0000000000400520 l F .text 0000000000000019 _init
000000000040053a l F .text 000000000000000c foo
0000000000401000 [g](/page/G) F .text 0000000000000048 main
Here, symbols are prefixed with types (e.g., g for global, l for local) and include sizes, providing a quick map of the file's named elements as detailed in the official documentation.[1]
To inspect raw bytes in a specific section, combine the -s (full contents) and -j section (select section) options for a hexadecimal dump. This reveals the unprocessed data, such as strings or constants in read-only sections. For example, objdump -s -j .rodata file.o on an object file with string literals might output:
Contents of section .rodata:
80484b0 01000000 47455420 2f657463 2f706173 ....GET /etc/pas
80484c0 73776400 48656c6c 6f20576f 726c6400 swd.[Hello World](/page/Hello_World).
Contents of section .rodata:
80484b0 01000000 47455420 2f657463 2f706173 ....GET /etc/pas
80484c0 73776400 48656c6c 6f20576f 726c6400 swd.[Hello World](/page/Hello_World).
The dump shows addresses, hexadecimal values, and ASCII interpretations where applicable, enabling verification of embedded data without interpretation overhead, per the GNU Binutils reference.[1]
Advanced Analysis Scenarios
In advanced analysis workflows, objdump enables reverse engineering by correlating high-level source code with low-level assembly instructions, facilitating the verification of compiler optimizations or the dissection of proprietary binaries. For instance, the command objdump -S -d program interleaves disassembled code with corresponding C source lines, assuming debug information is present in the object file; this is particularly valuable in compiler verification to confirm that transformations like inlining or loop unrolling preserve semantic equivalence between source and machine code.[1] In reverse engineering scenarios, this option helps analysts map obfuscated assembly back to potential original logic, revealing control flow and data dependencies without access to the full build environment.[1]
Cross-architecture analysis extends objdump's utility to heterogeneous environments, such as examining ARM binaries on an x86 host system, which is common in embedded systems reverse engineering or multi-platform development. The -m arm option specifies the target architecture, paired with -d for disassembly, as in objdump -m arm -d binary, allowing objdump to interpret raw or partially formatted binaries lacking explicit machine metadata.[1] This capability supports workflows where developers verify cross-compiled executables or security researchers analyze firmware from diverse instruction sets, ensuring accurate decoding of opcodes and registers without native hardware.[1]
Extracting DWARF debugging information from core dumps represents another sophisticated use case, aiding in post-mortem analysis of crashes in production environments. The --dwarf=info option dumps the contents of the .debug_info section, as shown in objdump --dwarf=info core, which reveals type definitions, variable scopes, and call frame information essential for reconstructing stack traces.[1] In complex debugging scenarios, this facilitates root-cause identification in optimized builds where source is unavailable, enabling engineers to correlate runtime failures with static binary structures.[1]
For dynamic linking investigations, objdump's -R option inspects relocation entries in shared libraries, crucial for understanding procedure linkage table (PLT) stubs and lazy binding mechanisms in executables. Executing objdump -R sharedlib.so lists relocations such as R_X86_64_JUMP_SLOT for PLT entries, highlighting how symbols are resolved at runtime by the dynamic linker.[1] This is integral to reverse engineering malware that exploits dynamic loaders or verifying library compatibility in large-scale software deployments, where mismatches in relocation types can lead to loading failures.[1]