Home
Overloaded function.
parse(raw: bytes, name: str = ‘’) -> lief._lief.Binary
Parse a binary supported by LIEF from the given bytes and return either:
depending on the given binary format.
parse(filepath: str) -> lief._lief.Binary
Parse a binary from the given file path and return either:
depending on the given binary format.
parse(io: object, name: str = ‘’) -> object
Parse a binary supported by LIEF from the given Python IO interface and return either:
depending on the given binary format.
File format abstract representation.
This object represents the abstraction of an executable file format. It enables to access common features (like the entrypoint
) regardless of the concrete format (e.g. lief.ELF.Binary.entrypoint
)
Members:
AUTO
VA
RVA
Return the abstract representation of the current binary (lief.Binary
)
Warning
Getting this property modifies the __class__
attribute such as the current binary looks like a lief.Binary
.
To get back to the original binary, one needs to access lief.Binary.concrete
The concrete representation of the binary. Basically, this property cast a lief.Binary
into a lief.PE.Binary
, lief.ELF.Binary
or lief.MachO.Binary
.
See also: lief.Binary.abstract
Constructor functions that are called prior to any other functions
Binary’s entrypoint
File format EXE_FORMATS
of the underlying binary.
Return the content located at the provided virtual address. The virtual address is specified in the first argument and size to read (in bytes) in the second.
If the underlying binary is a PE, one can specify if the virtual address is a RVA
or a VA
. By default, it is set to AUTO
.
Return the address of the given function name
Return the Symbol
from the given name
.
If the symbol can’t be found, it returns None.
Check if the binary has NX
protection (non executable stack)
Check if a Symbol
with the given name exists
Default image base (i.e. if the ASLR is not enabled)
Check if the binary is position independent
Return binary’s imported libraries (name)
Binary’s name
Convert an offset into a virtual address.
Overloaded function.
patch_address(self: lief._lief.Binary, address: int, patch_value: List[int], va_type: lief._lief.Binary.VA_TYPES = <VA_TYPES.AUTO: 0>) -> None
patch_address(self: lief._lief.Binary, address: int, patch_value: int, size: int = 8, va_type: lief._lief.Binary.VA_TYPES = <VA_TYPES.AUTO: 0>) -> None
Return an iterator over abstract Relocation
Remove the section with the given name
Return all virtual addresses that use the address
given in parameter
Target architecture (ARCHITECTURES
)
Binary endianness See: ENDIANNESS
Binary entrypoint
True
if the binary targets a 32-bits
architecture
True
if the binary targets a 64-bits
architecture
Type of the binary (executable, library…) See: OBJECT_TYPES
Class which represents an abstracted section
Overloaded function.
__init__(self: lief._lief.Section) -> None
Default constructor
__init__(self: lief._lief.Section, name: str) -> None
Constructor from section name
Section’s content
Section’s entropy
Return the fullname of the section including the trailing bytes
Section’s name
Section’s file offset
Overloaded function.
search(self: lief._lief.Section, number: int, pos: int = 0, size: int = 0) -> int
Look for integer within the current section
search(self: lief._lief.Section, str: str, pos: int = 0) -> int
Look for string within the current section
Overloaded function.
search_all(self: lief._lief.Section, number: int, size: int = 0) -> List[int]
Look for all integers within the current section
search_all(self: lief._lief.Section, str: str) -> List[int]
Look for all strings within the current section
Section’s size
Section’s virtual address
This class represents a symbol in an executable format.
Symbol’s name
Symbol’s size
Symbol’s value
Class which represents an abstracted Relocation
Overloaded function.
__init__(self: lief._lief.Relocation) -> None
Default constructor
__init__(self: lief._lief.Relocation, address: int, size: int) -> None
Constructor from an address
and a size
Relocation’s address
Relocation’s size (in bits)
Class which represents a Function in an executable file format.
Overloaded function.
__init__(self: lief._lief.Function) -> None
__init__(self: lief._lief.Function, arg0: str) -> None
__init__(self: lief._lief.Function, arg0: int) -> None
__init__(self: lief._lief.Function, arg0: str, arg1: int) -> None
Members:
IMPORTED
EXPORTED
CONSTRUCTOR
DESTRUCTOR
DEBUG
Add the given FLAGS
Function’s address
Symbol’s name
Symbol’s size
Symbol’s value
Members:
NONE
ARM
ARM64
MIPS
X86
PPC
SPARC
SYSZ
XCORE
INTEL
RISCV
Members:
NONE
M16
M32
M64
ARM
THUMB
MCLASS
UNDEFINED
MIPS3
MIPS32R6
MIPSGP64
V7
V8
V9
MIPS32
MIPS64