2 Methods to Check if Binary File is Statically or Dynamically Linked on Linux

When analyzing binary files on Linux, understanding whether a binary is statically or dynamically linked is crucial for debugging, performance optimization, and security auditing. This tutorial provides 2 methods how to check if binary file is statically or dynamically linked on Linux.

A statically linked binary includes all necessary libraries within itself, making it self-contained and independent of external libraries. This can be useful for portability since it ensures that the binary runs regardless of the libraries available on the system. However, it also increases the file size and can make updates harder because the entire binary must be replaced if a dependency changes.

On the other hand, a dynamically linked binary relies on shared libraries, which means it requires specific libraries to be present on the system. This approach reduces the binary size and allows for easier updates, as shared libraries can be upgraded without modifying the executable. However, it can also lead to compatibility issues if required libraries are missing or incompatible.

Method 1 - ldd command

The ldd command prints shared library dependencies of a binary. If a binary is statically linked, ldd will return a message "not a dynamic executable".

For example:

ldd /bin/busybox

Output:

not a dynamic executable

This indicates that /bin/busybox is statically linked.

For example:

ldd /usr/bin/mkdir

Output:

linux-vdso.so.1 (0x00007ffc947f7000)
libselinux.so.1 => /lib/x86_64-linux-gnu/libselinux.so.1 (0x0000754cdf140000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x0000754cdee00000)
libpcre2-8.so.0 => /lib/x86_64-linux-gnu/libpcre2-8.so.0 (0x0000754cdf0a6000)
/lib64/ld-linux-x86-64.so.2 (0x0000754cdf187000)

Since ldd lists shared library dependencies, /usr/bin/mkdir is dynamically linked.

Method 2 - file command

The file command provides detailed information about a binary, including whether it is statically or dynamically linked.

For example:

file /bin/busybox

Output:

/bin/busybox: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked ...

For example:

file /usr/bin/mkdir

Output:

/usr/bin/mkdir: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked ...