objdump / readelf — authorized ELF/object inspection

Last updated: · By the BinBench editorial team · Stars and releases checked via the GitHub API
For legal, authorized and educational use only. Only analyze software you own or have written permission to examine.
Quick answer

objdump and readelf are the classic GNU Binutils pair for looking inside object files and ELF binaries you are authorized to examine. Prefer the official docs at sourceware.org/binutils.

On this page

Snapshot

ToolStrengthTypical first flags
readelfELF header/sections/segments/dynamic without BFD-h, -S, -l, -d, -s
objdumpMulti-format via BFD; disassembly-x, -d, -t, -r
PeersLLVM objdump, LIEF, PE-bear (PE)

Allowed framing

  • Teaching ELF layouts on binaries you compiled.
  • Quick triage of section/symbol tables before opening Ghidra/Cutter.
  • Comparing stripped vs unstripped builds in coursework.

Scope we will not cover

  • No exploit / ROP / shellcode cookbooks from disassembly dumps.
  • No crack/keygen framing.
  • No claiming readelf “defeats” packers — packed payloads need other authorized tooling.

Beginner path (authorized only)

  1. Compile a tiny C program you own; keep both stripped and unstripped copies.
  2. readelf -h -S -l ./a.out — read ELF header, sections, segments.
  3. readelf -d -s ./a.out — dynamic tags and symbols (when present).
  4. objdump -d -M intel ./a.out (or AT&T syntax) — skim disassembly; do not treat it as a decompiler.
  5. Escalate complex malware/firmware to dedicated RE suites; keep Binutils as the always-available baseline.
Which to pick
  • Use readelf for ELF structure and objdump for portable object dumps / disassembly.
  • Prefer LLVM objdump when your toolchain is LLVM-first.
  • Refuse exploit and crack framing.

For legal, authorized and educational use only.

FAQ

What are objdump and readelf?

Both are GNU Binutils programs. objdump displays object-file information (headers, symbols, relocations, disassembly) via BFD. readelf focuses on ELF details and does not use BFD, so it can show ELF structures even when BFD disagrees.

Which version is cited?

Binutils versions ship with your distro/toolchain (for example 2.4x lines on many 2025–2026 Linux distros). Run objdump -V / readelf -v and record the exact string in lab notes (checked 2026-10-24).

What license applies?

GNU Binutils is GPL-licensed (see the package LICENSE for your build). Prefer distro packages or official sourceware builds.

LLVM objdump or GNU objdump?

See llvm-objdump-overview when your lab standardizes on LLVM. Prefer GNU readelf/objdump when teaching classic ELF headers on Linux toolchains.

Does this teach writing exploits from disassembly?

No. Authorized inspection and education only — BinBench will not supply exploit PoCs or crack framing.

Sources