elf-inspection

ELF Inspection

Purpose

Guide agents through inspecting Linux ELF binaries: symbol tables, section layout, dynamic linking, debug info, and diagnosing linker errors.

Triggers

• "What libraries does this binary depend on?"
• "Why is this binary so large?"
• "I have an undefined reference or symbol not found at runtime"
• "How do I check if debug info is in this binary?"
• "How do I find what symbols a library exports?"
• "How do I check if a binary is PIE / has RELRO?"

Workflow

1. Quick overview: file and size

file prog                    # type, arch, linkage, stripped or not
size prog                    # section sizes: text, data, bss
size --format=sysv prog      # detailed per-section breakdown

2. Dynamic dependencies: ldd

ldd ./prog                   # show all shared lib dependencies
ldd -v ./prog                # verbose: include symbol versions

# Check why a library is loaded
ldd ./prog | grep libssl

# For a library (not an executable)
ldd ./libfoo.so

If ldd shows not found, the shared library is missing from LD_LIBRARY_PATH or /etc/ld.so.conf.

Fix:

export LD_LIBRARY_PATH=/path/to/libs:$LD_LIBRARY_PATH
# Or install the library and run ldconfig
sudo ldconfig

3. Symbols: nm

nm prog                       # all symbols (T=text, D=data, U=undefined, etc.)
nm -D ./libfoo.so             # dynamic symbols only
nm -C prog                    # demangle C++ symbols
nm --defined-only prog        # only defined symbols
nm -u prog                    # only undefined (needed) symbols
nm -S prog                    # include symbol size

# Search for a symbol
nm -D /usr/lib/libssl.so | grep SSL_read

Symbol type codes:

• T / t — text (code): global / local
• D / d — data (initialised): global / local
• B / b — BSS (uninitialised): global / local
• R / r — read-only data: global / local
• U — undefined (needs to be provided at link time)
• W / w — weak symbol