Abstract¶

Parser¶

lief.parse(*args, **kwargs)¶

Overloaded function.

1. parse(raw: bytes, name: str = ‘’) -> lief._lief.Binary

   Parse a binary supported by LIEF from the given bytes and return either:

   • lief.ELF.Binary

   • lief.PE.Binary

   • lief.MachO.Binary

   depending on the given binary format.

2. parse(filepath: str) -> lief._lief.Binary

   Parse a binary from the given file path and return either:

   • lief.ELF.Binary

   • lief.PE.Binary

   • lief.MachO.Binary

   depending on the given binary format.

3. parse(io: object, name: str = ‘’) -> object

   Parse a binary supported by LIEF from the given Python IO interface and return either:

   • lief.ELF.Binary

   • lief.PE.Binary

   • lief.MachO.Binary

   depending on the given binary format.

Binary¶

class lief.Binary¶

File format abstract representation.

This object represents the abstraction of an executable file format. It enables to access common features (like the entrypoint) regardless of the concrete format (e.g. lief.ELF.Binary.entrypoint)

class VA_TYPES(self: lief._lief.Binary.VA_TYPES, value: int)¶

Members:

AUTO

VA

RVA

AUTO = <VA_TYPES.AUTO: 0>¶

RVA = <VA_TYPES.RVA: 1>¶

VA = <VA_TYPES.VA: 2>¶

property name¶

property value¶

property abstract¶

Return the abstract representation of the current binary (lief.Binary)

Warning

Getting this property modifies the __class__ attribute such as the current binary looks like a lief.Binary.

To get back to the original binary, one needs to access lief.Binary.concrete

property concrete¶

The concrete representation of the binary. Basically, this property cast a lief.Binary into a lief.PE.Binary, lief.ELF.Binary or lief.MachO.Binary.

See also: lief.Binary.abstract

property ctor_functions¶

Constructor functions that are called prior to any other functions

property entrypoint¶

Binary’s entrypoint

property exported_functions¶

Return the binary’s exported Function

property format¶

File format EXE_FORMATS of the underlying binary.

get_content_from_virtual_address(self: lief._lief.Binary, virtual_address: int, size: int, va_type: lief._lief.Binary.VA_TYPES = <VA_TYPES.AUTO: 0>) → memoryview¶

Return the content located at the provided virtual address. The virtual address is specified in the first argument and size to read (in bytes) in the second.

If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default, it is set to AUTO.

get_function_address(self: lief._lief.Binary, function_name: str) → object¶

Return the address of the given function name

get_symbol(self: lief._lief.Binary, symbol_name: str) → LIEF::Symbol¶

Return the Symbol from the given name.

If the symbol can’t be found, it returns None.

property has_nx¶

Check if the binary has NX protection (non executable stack)

has_symbol(self: lief._lief.Binary, symbol_name: str) → bool¶

Check if a Symbol with the given name exists

property header¶

Binary’s abstract header (Header)

property imagebase¶

Default image base (i.e. if the ASLR is not enabled)

property imported_functions¶

Return the binary’s imported Function (name)

property is_pie¶

Check if the binary is position independent

class it_relocations¶

class it_sections¶

class it_symbols¶

property libraries¶

Return binary’s imported libraries (name)

property name¶

Binary’s name

offset_to_virtual_address(self: lief._lief.Binary, offset: int, slide: int = 0) → object¶

Convert an offset into a virtual address.

patch_address(*args, **kwargs)¶

Overloaded function.

1. patch_address(self: lief._lief.Binary, address: int, patch_value: List[int], va_type: lief._lief.Binary.VA_TYPES = <VA_TYPES.AUTO: 0>) -> None

   Patch the address with the given list of bytes. The virtual address is specified in the first argument and the content in the second (as a list of bytes).

   If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default, it is set to AUTO.

2. patch_address(self: lief._lief.Binary, address: int, patch_value: int, size: int = 8, va_type: lief._lief.Binary.VA_TYPES = <VA_TYPES.AUTO: 0>) -> None

   Patch the address with the given integer value. The virtual address is specified in the first argument, the integer in the second and the integer’s size of in third one.

   If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default, it is set to AUTO.

property relocations¶

Return an iterator over abstract Relocation

remove_section(self: lief._lief.Binary, name: str, clear: bool = False) → None¶

Remove the section with the given name

property sections¶

Return an iterator over the binary’s abstract sections (Section)

property symbols¶

Return an iterator over the binary’s abstract Symbol

xref(self: lief._lief.Binary, virtual_address: int) → List[int]¶

Return all virtual addresses that use the address given in parameter

Header¶

class lief.Header(self: lief._lief.Header)¶

property architecture¶

Target architecture (ARCHITECTURES)

property endianness¶

Binary endianness See: ENDIANNESS

property entrypoint¶

Binary entrypoint

property is_32¶

True if the binary targets a 32-bits architecture

property is_64¶

True if the binary targets a 64-bits architecture

property modes¶

Target MODES (32-bits, 64-bits…)

property object_type¶

Type of the binary (executable, library…) See: OBJECT_TYPES

Section¶

class lief.Section(*args, **kwargs)¶

Class which represents an abstracted section

Overloaded function.

1. __init__(self: lief._lief.Section) -> None

Default constructor

2. __init__(self: lief._lief.Section, name: str) -> None

Constructor from section name

property content¶

Section’s content

property entropy¶

Section’s entropy

property fullname¶

Return the fullname of the section including the trailing bytes

property name¶

Section’s name

property offset¶

Section’s file offset

search(*args, **kwargs)¶

Overloaded function.

1. search(self: lief._lief.Section, number: int, pos: int = 0, size: int = 0) -> int

Look for integer within the current section

2. search(self: lief._lief.Section, str: str, pos: int = 0) -> int

Look for string within the current section

search_all(*args, **kwargs)¶

Overloaded function.

1. search_all(self: lief._lief.Section, number: int, size: int = 0) -> List[int]

Look for all integers within the current section

2. search_all(self: lief._lief.Section, str: str) -> List[int]

Look for all strings within the current section

property size¶

Section’s size

property virtual_address¶

Section’s virtual address

Symbol¶

class lief.Symbol(self: lief._lief.Symbol)¶

This class represents a symbol in an executable format.

property name¶

Symbol’s name

property size¶

Symbol’s size

property value¶

Symbol’s value

Relocation¶

class lief.Relocation(*args, **kwargs)¶

Class which represents an abstracted Relocation

Overloaded function.

1. __init__(self: lief._lief.Relocation) -> None

Default constructor

2. __init__(self: lief._lief.Relocation, address: int, size: int) -> None

Constructor from an address and a size

property address¶

Relocation’s address

property size¶

Relocation’s size (in bits)

Function¶

class lief.Function(*args, **kwargs)¶

Class which represents a Function in an executable file format.

Overloaded function.

1. __init__(self: lief._lief.Function) -> None

2. __init__(self: lief._lief.Function, arg0: str) -> None

3. __init__(self: lief._lief.Function, arg0: int) -> None

4. __init__(self: lief._lief.Function, arg0: str, arg1: int) -> None

class FLAGS(self: lief._lief.Function.FLAGS, value: int)¶

Members:

IMPORTED

EXPORTED

CONSTRUCTOR

DESTRUCTOR

DEBUG

CONSTRUCTOR = <FLAGS.CONSTRUCTOR: 1>¶

DEBUG = <FLAGS.DEBUG: 3>¶

DESTRUCTOR = <FLAGS.DESTRUCTOR: 2>¶

EXPORTED = <FLAGS.EXPORTED: 4>¶

IMPORTED = <FLAGS.IMPORTED: 5>¶

property name¶

property value¶

add(self: lief._lief.Function, flag: lief._lief.Function.FLAGS) → lief._lief.Function¶

Add the given FLAGS

property address¶

Function’s address

property flags¶

Function flags as a list of FLAGS

property name¶

Symbol’s name

property size¶

Symbol’s size

property value¶

Symbol’s value

Enums¶