Overloaded function.
parse(raw: bytes) -> lief._lief.Binary
Parse a binary supported by LIEF from the given bytes and return either:
depending on the given binary format.
parse(filepath: str) -> lief._lief.Binary
Parse a binary from the given file path and return either:
depending on the given binary format.
parse(io: object) -> object
Parse a binary supported by LIEF from the given Python IO interface and return either:
depending on the given binary format.
File format abstract representation.
This object represents the abstraction of an executable file format. It enables to access common features (like the entrypoint
) regardless of the concrete format (e.g. lief.ELF.Binary.entrypoint
)
Return the abstract representation of the current binary (lief.Binary
)
The concrete representation of the binary. Basically, this property cast a lief.Binary
into a lief.PE.Binary
, lief.ELF.Binary
or lief.MachO.Binary
.
See also: lief.Binary.abstract
Constructor functions that are called prior to any other functions
Binary’s entrypoint
Return the binary’s exported Function
File format EXE_FORMATS
of the underlying binary.
Return the content located at the provided virtual address. The virtual address is specified in the first argument and size to read (in bytes) in the second.
If the underlying binary is a PE, one can specify if the virtual address is a RVA
or a VA
. By default, it is set to AUTO
.
Return the address of the given function name
Return the Symbol
from the given name
.
If the symbol can’t be found, it returns None.
Check if the binary has NX
protection (non executable stack)
Binary’s abstract header (Header
)
Default image base (i.e. if the ASLR is not enabled)
Return the binary’s imported Function
(name)
Check if the binary is position independent
Iterator over lief._lief.Relocation
Iterator over lief._lief.Section
Iterator over lief._lief.Symbol
Return binary’s imported libraries (name)
Convert an offset into a virtual address.
Overloaded function.
patch_address(self, address: int, patch_value: list[int], va_type: lief._lief.Binary.VA_TYPES = lief._lief.VA_TYPES.AUTO) -> None
patch_address(self, address: int, patch_value: int, size: int = 8, va_type: lief._lief.Binary.VA_TYPES = lief._lief.VA_TYPES.AUTO) -> None
Return an iterator over abstract Relocation
Remove the section with the given name
Return an iterator over the binary’s abstract sections (Section
)
Return an iterator over the binary’s abstract Symbol
Return all virtual addresses that use the address
given in parameter
Class which represents an abstracted Header
Target architecture (ARCHITECTURES
)
Binary endianness See: ENDIANNESS
Binary entrypoint
True
if the binary targets a 32-bits
architecture
True
if the binary targets a 64-bits
architecture
Target MODES
(32-bits, 64-bits…)
Type of the binary (executable, library…) See: OBJECT_TYPES
Class which represents an abstracted section
Section’s content
Section’s entropy
Return the fullname of the section including the trailing bytes
Section’s name
Section’s file offset
Overloaded function.
search(self, number: int, pos: int = 0, size: int = 0) -> object
Look for integer within the current section
search(self, str: str, pos: int = 0) -> object
Look for string within the current section
search(self, bytes: bytes, pos: int = 0) -> object
Look for the given bytes within the current section
Overloaded function.
search_all(self, number: int, size: int = 0) -> list[int]
Look for all integers within the current section
search_all(self, str: str) -> list[int]
Look for all strings within the current section
Section’s size
Section’s virtual address
Class which represents a Function in an executable file format.
Add the given FLAGS
Function’s address
Function flags as a list of FLAGS
Symbol’s name
Symbol’s size
Symbol’s value
The underlying integer value
The underlying integer value
The underlying integer value