1SCANELF(1) Documentation for pax-utils SCANELF(1)
2
6 scanelf - user-space utility to scan ELF files
7
9 scanelf [options] ELFs or directories
10
12 scanelf is a user-space utility to quickly scan given ELFs,
13 directories, or common system paths for different information. This may
14 include ELF types, their PaX markings, TEXTRELs, etc...
15
17 -A, --archives
18 Scan archives (.a files)
19 -a, --all
21 Print all useful/simple info
22 -B, --nobanner
24 Don't display the header
25 -b, --bind
27 Print symbol binding information (lazy or now)
28 -D, --endian
30 Print ELF endianness (big/little/...)
31 -E, --etype ETYPE
33 Print only ELF files matching specified etype (like ET_DYN,
34 ET_EXEC, etc...)
35 -e, --header
37 Print GNU_STACK markings
38 -F, --format FORMAT
40 Use specified format for output; see the FORMAT section for more
41 information
42 -f, --from FILE
44 Read input stream from specified filename
45 -g, --gmatch
47 Use strncmp to match libraries (use with -N). Or regexp with symbol
48 matching
49 -h, --help
51 Show condensed usage and exit
52 -I, --osabi
54 Print OSABI
55 -i, --interp
57 Print the interpreter information (.interp/PT_INTERP)
58 -k, --section SECTION
60 Find ELFs with the specified section. May be specified multiple
61 times to match multiple sections simultaneously. See SECTION
62 MATCHING for more info.
63 -L, --ldcache
65 Utilize ld.so.cache information (use with -r/-n)
66 -l, --ldpath
68 Scan all directories in /etc/ld.so.conf
69 -M, --bits BITS
71 Print only ELF files matching specified numeric bits (like 32/64)
72 -m, --mount
74 Don't recursively cross mount points
75 -N, --lib SONAME
77 Find ELFs that need the specified SONAME. May be specified multiple
78 times to match multiple SONAMEs simultaneously. See SONAME MATCHING
79 for more info.
80 -n, --needed
82 Print libraries the ELF is linked against (DT_NEEDED)
83 -O, --perms PERMS
85 Print only ELF files with matching specified octal bits (like 755)
86 -o, --file FILE
88 Write output stream to specified filename
89 -p, --path
91 Scan all directories in PATH environment
92 -q, --quiet
94 Only output 'bad' things
95 -R, --recursive
97 Scan directories recursively
98 -r, --rpath
100 Print runpaths encoded in the ELF (DT_RPATH/DT_RUNPATH)
101 -S, --soname
103 Print the ELF's shared library name (DT_SONAME)
104 -s, --symbol SYMBOL
106 Find the specified symbol; see SYMBOL MATCHING for more info
107 -T, --textrels
109 Locate cause of TEXTRELs via objdump
110 -t, --textrel
112 Print TEXTREL information
113 -V, --version
115 Print version and exit
116 -v, --verbose
118 Be verbose (can be used more than once)
119 -X, --fix
121 Try and 'fix' bad things (use with -r/-e)
122 -x, --pax
124 Print PaX markings
125 -Y, --eabi
127 Print EABI (only matters for a few architectures)
128 -y, --symlink
130 Don't scan symlinks
131 -Z, --size SIZE
133 Print ELF file size
134 -z, --setpax FLAGS
136 Sets EI_PAX/PT_PAX_FLAGS to specified flags (use with -Xx)
137 --use-ldpath
139 Use the ld.so.conf paths to find the full path to libraries (use in
140 conjunction with --needed).
141 --root PATH
143 Search the specified root tree instead of /. Generally paired with
144 options like -l or -p. This implicitly treats all paths specified
145 on the command line as relative to the root, so be sure to omit it
146 if you are explicitly listing ELFs.
147
149 The format string is much like a printf string in that it is a literal
150 string with flags requesting different information. For example, you
151 could use a format string and expect the following results.
152 # scanelf -BF "file %f needs %n; funky time" /bin/bash
154 file bash needs libncurses.so.5,libdl.so.2,libc.so.6; funky time
155 Note that when you use a format string, generally information related
158 flags should be omitted. In other words, you do not want to try and
159 request NEEDED output (-n) and try to specify a format output at the
160 same time as these operations are mutually exclusive. Each information
161 related flag has an equivalent conversion specifier, so use those
162 instead. You can of course continue to use non-information related
163 flags (such as --verbose).
164 There are three characters that introduce conversion specifiers.
166 · % - replace with info
168 · # - silent boolean match
169 · + - verbose match
170 And there are a number of conversion specifiers. We try to match up the
172 specifier with corresponding option.
173 · a - machine (EM) type
175 · b - bind flags
176 · e - program headers
177 · D - endian
178 · I - osabi
179 · Y - eabi
180 · F - long filename
181 · f - short filename
182 · i - interp
183 · k - section
184 · M - EI class
185 · N - specified needed
186 · n - needed libraries
187 · p - filename (minus search)
188 · o - etype
189 · O - perms
190 · r - runpaths
191 · S - SONAME
192 · s - symbol
193 · T - all textrels
194 · t - textrel status
195 · x - pax flags
196
199 The string specified takes the form [%[modifiers]%][[+-]<symbol
200 name>][,[.....]].
201 If the symbol name is empty, then all symbols are matched.
203 If the symbol name is a glob ("*"), then all symbols are dumped in a
205 debug format. Do not rely on the structure of this output as it changes
206 whenever we feel like it.
207 If the first char of the symbol name is a plus ("+"), then only match
209 defined symbols. If it's a minus ("-"), only match undefined symbols.
210 When we say "defined", we mean the symbol is defined in the ELF vs
211 having an external reference.
212 Putting modifiers in between the percent signs ("%") allows for more in
214 depth filters. There are groups of modifiers. If you don't specify a
215 member of a group, then all types in that group are matched.
216 · STT group (symbol type)
218 · n - STT_NOTYPE
219 · o - STT_OBJECT
220 · f - STT_FUNC
221 · F - STT_FILE
222 · STB group (symbol binding)
223 · l - STB_LOCAL
224 · g - STB_GLOBAL
225 · w - STB_WEAK
226 · STV group (symbol visibility)
227 · p - STV_DEFAULT
228 · i - STV_INTERNAL
229 · h - STV_HIDDEN
230 · P - STV_PROTECTED
231 · SHN group (section header)
232 · d - defined
233 · u - SHN_UNDEF
234 · a - SHN_ABS
235 · c - SHN_COMMON
236 You can search for multiple symbols simultaneously by using a comma
238 (",") to separate different searches. Every symbol that matches will be
239 displayed while unmatched symbols will not.
240
242 You can narrow your search by specifying the ELF object file type
243 (ETYPE). The commandline option takes the numeric value and or symbolic
244 type. Multiple values can be passed comma separated. Example -E
245 ET_EXEC,ET_DYN,1
246 Here is the normal list available for your pleasure. You of course are
248 free to specify any numeric value you want.
249 · 0 - ET_NONE - unknown type
251 · 1 - ET_REL - relocatable file
252 · 2 - ET_EXEC - executable file
253 · 3 - ET_DYN - shared object
254 · 4 - ET_CORE - core file
255
258 You can also narrow your search by specifying the ELF bitsize. Again,
259 specify the numeric value or the symbolic define.
260 · 32 - ELFCLASS32 - 32bit ELFs
262 · 64 - ELFCLASS64 - 64bit ELFs
263
266 A ! prefix will only show ELF's that do not have the specified
267 section.
268
270 A ! prefix will only show ELF's that do not depend on the specified
271 library.
272
274 http://hardened.gentoo.org/pax-utils.xml
275
277 Please include as much information as possible (using any available
278 debugging options) and send bug reports to the maintainers (see the
279 AUTHORS section). Please use the Gentoo bugzilla at
280 http://bugs.gentoo.org/ if possible.
281
283 chpax(1), dumpelf(1), paxctl(1), pspax(1), readelf(1), scanelf(1),
284 elf(5)
285
287 Ned Ludd <solar@gentoo.org>
288 Maintainer
289 Mike Frysinger <vapier@gentoo.org>
291 Maintainer
292 Fabian Groffen <grobian@gentoo.org>
294 Mach-O Maintainer
295
297 1. http://hardened.gentoo.org/pax-utils.xml
298 2. http://bugs.gentoo.org/
300pax-utils 1.2.5 02/16/2020 SCANELF(1)