nm / objdump tips — authorized symbol triage

Last updated: · By the BinBench editorial team · Stars and releases checked via the GitHub API
For legal, authorized and educational use only. Only analyze software you own or have written permission to examine.
Quick answer

nm and objdump (GNU Binutils) are the usual first stop for symbol and section triage on objects you are authorized to examine. This page is a tip checklist beside the fuller objdump/readelf overview.

On this page

Snapshot

FieldValue
Toolsnm, objdump (GNU Binutils; LLVM cousins optional)
JobAuthorized symbol / section / light disassembly triage
Sibling overviewobjdump / readelf
First-pass peersstrings + xxd, DiE

Tip checklist (authorized only)

  1. Record toolchain identity first (nm --version, objdump -V) in the case binder.
  2. Prefer absolute paths to the object you may examine; hash the file before and after any copy.
  3. Start with nm -C / nm -S (or your man-page equivalents) for a demangled symbol size map.
  4. Use objdump -h / -T / -d selectively — tight flags beat dumping every section into chat logs.
  5. If symbols vanish (strip/pack), note the gap and escalate; do not invent names.
  6. Keep binutils output as Evidence beside later Ghidra/Cutter notes under one case ID.

Allowed framing

  • Classroom ELF/PE/Mach-O objects your syllabus provides.
  • Comparing GNU nm/objdump vs LLVM objdump as a lab packaging choice.
  • Teaching students to quote exact flag strings so reviews are reproducible.
  • Pairing with strings/xxd before opening a full decompiler.

Scope we will not cover

  • No exploit / ROP / shellcode cookbooks derived from symbols.
  • No crack/keygen or license-patch recipes via objdump hex edits.
  • No anti-anti-debug or packer-defeat cookbooks.
  • No unauthorized examination of third-party production binaries "just to see."

Beginner path (authorized only)

  1. Install Binutils (or LLVM tools) from the channel your lab approves.
  2. Run nm/objdump on a student-built binary; save stdout beside the SHA-256.
  3. Compare a stripped vs unstripped build of the same authorized program.
  4. Hand interesting offsets to a decompiler only when the case needs it.
  5. Refuse any request to turn this checklist into a piracy or exploit guide.
Which to pick
  • Use nm for fast symbol maps; objdump for headers/sections/light disassembly.
  • Prefer the objdump/readelf overview for tool literacy, this page for tips.
  • Authorized objects only — no exploit PoCs or crack framing.

For legal, authorized and educational use only.

FAQ

How is this different from objdump-readelf-overview?

objdump/readelf overview is the tool orientation. This page is a tip checklist focused on nm symbol triage beside a few high-value objdump flags — still authorized objects only.

When should I reach for nm first?

When you need a quick symbol / binding / section map before full disassembly. nm -C (demangle) and nm -S (size) are common literacy flags — confirm against man nm on your lab image.

nm vs readelf -s?

Both can list symbols. Prefer the tool your syllabus standardizes on; record which binary and flags you used. See also llvm-objdump if the lab is LLVM-first.

Stripped binaries?

Empty or tiny nm output is itself Evidence. Escalate to strings/xxd, DiE/capa or a full RE suite — do not invent symbols that are not there.

Does this teach writing exploits from symbols?

No. Authorized inspection and education only — BinBench will not supply exploit PoCs, ROP cookbooks or crack patches from symbol tables.

Sources