MachO¶

Parser¶

lief.MachO.parse(*args, **kwargs)¶

Overloaded function.

parse(filename: str, config: lief._lief.MachO.ParserConfig = <lief._lief.MachO.ParserConfig object at 0x7f3b90316e30>) -> LIEF::MachO::FatBinary

Parse the given binary and return a FatBinary object
One can configure the parsing with the config parameter. See ParserConfig,
parse(raw: List[int], name: str = ‘’, config: lief._lief.MachO.ParserConfig = <lief._lief.MachO.ParserConfig object at 0x7f3b903aa470>) -> LIEF::MachO::FatBinary

Parse the given binary (from raw bytes) and return a FatBinary object
One can configure the parsing with the config parameter. See ParserConfig
parse(io: object, name: str = ‘’, config: lief._lief.MachO.ParserConfig = <lief._lief.MachO.ParserConfig object at 0x7f3b9032f1b0>) -> object

Parse the given binary from a Python IO interface and return a FatBinary object
One can configure the parsing with the config parameter. See ParserConfig

class lief.MachO.ParserConfig(self: lief._lief.MachO.ParserConfig)¶

This class is used to tweak the MachO Parser (Parser)

deep = <lief._lief.MachO.ParserConfig object>¶

property fix_from_memory¶

When parsing Mach-O from memory, this option can be used to undo relocations and symbols bindings.

When activated, this option requires parse_dyld_bindings and parse_dyld_rebases to be enabled.

full_dyldinfo(self: lief._lief.MachO.ParserConfig, flag: bool) → lief._lief.MachO.ParserConfig¶: If flag is set to true, Exports, Bindings and Rebases opcodes are parsed.

Warning
Enabling this flag can slow down the parsing

property parse_dyld_bindings¶: Parse the Dyld binding opcodes

property parse_dyld_exports¶: Parse the Dyld export trie

property parse_dyld_rebases¶: Parse the Dyld rebase opcodes

quick = <lief._lief.MachO.ParserConfig object>¶

fatbinary_1 = lief.MachO.parse("/usr/bin/ls", config=lief.MachO.ParserConfig.deep)
# or
fatbinary_2 = lief.MachO.parse("/usr/bin/ls", config=lief.MachO.ParserConfig.quick)

FatBinary¶

class lief.MachO.FatBinary¶

Class which represent a Mach-O (fat) binary This object is also used for representing Mach-O binaries that are NOT FAT

at(self: lief._lief.MachO.FatBinary, index: int) → LIEF::MachO::Binary¶: Return the Binary at the given index or None if it is not present

class it_binaries¶

raw(self: lief._lief.MachO.FatBinary) → List[int]¶: Build a Mach-O universal binary and return its bytes

property size¶: Number of Binary registred

take(self: lief._lief.MachO.FatBinary, cpu: lief._lief.MachO.CPU_TYPES) → LIEF::MachO::Binary¶: Return the Binary that matches the given CPU_TYPES

write(self: lief._lief.MachO.FatBinary, filename: str) → None¶: Build a Mach-O universal binary

Binary¶

class lief.MachO.Binary¶

Class which represents a MachO binary

class VA_TYPES(self: lief._lief.Binary.VA_TYPES, value: int)¶

Members:

AUTO

RVA

AUTO = <VA_TYPES.AUTO: 0>¶

RVA = <VA_TYPES.RVA: 1>¶

VA = <VA_TYPES.VA: 2>¶

property name¶

property value¶

property abstract¶: Return the abstract representation of the current binary (lief.Binary)

Warning
Getting this property modifies the __class__ attribute such as the current binary looks like a lief.Binary.
To get back to the original binary, one needs to access lief.Binary.concrete

add(*args, **kwargs)¶

Overloaded function.

add(self: lief._lief.MachO.Binary, dylib_command: LIEF::MachO::DylibCommand) -> LIEF::MachO::LoadCommand

Add a new DylibCommand

add(self: lief._lief.MachO.Binary, segment: LIEF::MachO::SegmentCommand) -> LIEF::MachO::LoadCommand

Add a new SegmentCommand

add(self: lief._lief.MachO.Binary, load_command: LIEF::MachO::LoadCommand) -> LIEF::MachO::LoadCommand

Add a new LoadCommand

add(self: lief._lief.MachO.Binary, load_command: LIEF::MachO::LoadCommand, index: int) -> LIEF::MachO::LoadCommand

Add a new LoadCommand at index

add_exported_function(self: lief._lief.MachO.Binary, address: int, name: str) → LIEF::MachO::ExportInfo¶: Add a new export in the binary

add_library(self: lief._lief.MachO.Binary, library_name: str) → LIEF::MachO::LoadCommand¶: Add a new library dependency

add_local_symbol(self: lief._lief.MachO.Binary, address: int, name: str) → LIEF::MachO::Symbol¶: Add a new a new symbol in the LC_SYMTAB

add_section(*args, **kwargs)¶

Overloaded function.

add_section(self: lief._lief.MachO.Binary, segment: LIEF::MachO::SegmentCommand, section: LIEF::MachO::Section) -> LIEF::MachO::Section

Add a new Section in the given SegmentCommand

add_section(self: lief._lief.MachO.Binary, section: LIEF::MachO::Section) -> LIEF::MachO::Section

Add a new Section within the __TEXT segment

add_section(self: lief._lief.MachO.Binary, section: LIEF::MachO::SegmentCommand, section: LIEF::MachO::Section) -> LIEF::MachO::Section

Add a new Section in the given SegmentCommand

property build_version¶: Return the binary’s BuildVersion if any, or None

can_remove(self: lief._lief.MachO.Binary, symbol: LIEF::MachO::Symbol) → bool¶: Check if the given symbol can be safely removed.

can_remove_symbol(self: lief._lief.MachO.Binary, symbol_name: str) → bool¶: Check if the given symbol name can be safely removed.

property code_signature¶: Return the binary’s CodeSignature if any, or None

property code_signature_dir¶: Return the binary’s CodeSignatureDir if any, or None

property commands¶: Return an iterator over the binary’s Command

property concrete¶

The concrete representation of the binary. Basically, this property cast a lief.Binary into a lief.PE.Binary, lief.ELF.Binary or lief.MachO.Binary.

Section¶

class lief.MachO.Section(*args, **kwargs)¶

Class that represents a Mach-O section

Overloaded function.

__init__(self: lief._lief.MachO.Section) -> None
__init__(self: lief._lief.MachO.Section, section_name: str) -> None

Constructor from a section’s name

__init__(self: lief._lief.MachO.Section, section_name: str, content: List[int]) -> None

Constructor from a section’s name and its content

add(self: lief._lief.MachO.Section, flag: lief._lief.MachO.SECTION_FLAGS) → None¶: Add the given SECTION_FLAGS

property alignment¶: Section’s alignment as a power of 2

property content¶: Section’s content

property entropy¶: Section’s entropy

property flags¶: Section’s flags masked with SECTION_FLAGS_MASK (see: MACHO_SECTION_FLAGS)

property flags_list¶

property fullname¶: Return the fullname of the section including the trailing bytes

has(self: lief._lief.MachO.Section, flag: lief._lief.MachO.SECTION_FLAGS) → bool¶: Check if the section has the given SECTION_FLAGS

property has_segment¶: True if the current section has a segment associated with

property name¶: Section’s name

property numberof_relocations¶: Number of relocations associated with this section

property offset¶: Section’s file offset

property relocation_offset¶

Offset of the relocation table. This value should be 0 for executable and libraries as the relocations are managed by the lief.MachO.DyldInfo.rebase

Other the other hand, for object files (.o) this value should not be 0

property relocations¶: Iterator over the Relocation (if any)

remove(self: lief._lief.MachO.Section, flag: lief._lief.MachO.SECTION_FLAGS) → None¶: Remove the given SECTION_FLAGS

property reserved1¶: According to the official loader.h file, this value is reserved for offset or index

property reserved2¶: According to the official loader.h file, this value is reserved for offset or index

property reserved3¶: According to the official loader.h file, this value is reserved for offset or index

search(*args, **kwargs)¶

Overloaded function.

search(self: lief._lief.Section, number: int, pos: int = 0, size: int = 0) -> int

Look for integer within the current section

search(self: lief._lief.Section, str: str, pos: int = 0) -> int

Look for string within the current section

search_all(*args, **kwargs)¶

Overloaded function.

search_all(self: lief._lief.Section, number: int, size: int = 0) -> List[int]

Look for all integers within the current section

search_all(self: lief._lief.Section, str: str) -> List[int]

Look for all strings within the current section

property segment¶: SegmentCommand associated with the section or None if not present

property segment_name¶: The segment name associated with the section

property size¶: Section’s size

property type¶: Type of the section. This value can help to determine the purpose of the section (c.f. MACHO_SECTION_TYPES)

property virtual_address¶: Section’s virtual address

SegmentCommand¶

class lief.MachO.SegmentCommand(*args, **kwargs)¶

Class which represents a LOAD_COMMAND_TYPES::LC_SEGMENT / LOAD_COMMAND_TYPES::LC_SEGMENT_64 command

Overloaded function.

__init__(self: lief._lief.MachO.SegmentCommand) -> None
__init__(self: lief._lief.MachO.SegmentCommand, arg0: str) -> None
__init__(self: lief._lief.MachO.SegmentCommand, arg0: str, arg1: List[int]) -> None

add_section(self: lief._lief.MachO.SegmentCommand, section: LIEF::MachO::Section) → LIEF::MachO::Section¶

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property content¶: Segment’s content

property data¶: Command’s data

property file_offset¶: Segment’s file offset

property file_size¶: Segment’s file size

property flags¶: Segment’s flags

get_section(self: lief._lief.MachO.SegmentCommand, name: str) → LIEF::MachO::Section¶: Get the Section with the given name

has(self: lief._lief.MachO.SegmentCommand, section: LIEF::MachO::Section) → bool¶: Check if the given Section belongs to the current segment

has_section(self: lief._lief.MachO.SegmentCommand, section_name: str) → bool¶: Check if the given section name belongs to the current segment

property index¶: Relative index of the segment in the segment table

property init_protection¶: Segment’s initial protection

class it_relocations¶

class it_sections¶

property max_protection¶: Segment’s max protection

property name¶: Segment’s name

property numberof_sections¶: Number of sections in this segment

property relocations¶: Segment’s relocations

property sections¶: Segment’s sections

property size¶: Size of the command (should be greather than sizeof(load_command))

property virtual_address¶: Segment’s virtual address

property virtual_size¶: Segment’s virtual size

LoadCommand¶

class lief.MachO.LoadCommand(self: lief._lief.MachO.LoadCommand)¶

Based class for the Mach-O load commands

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property size¶: Size of the command (should be greather than sizeof(load_command))

DylibCommand¶

class lief.MachO.DylibCommand¶

Class which represents a library dependency

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property compatibility_version¶: Library’s compatibility version

property current_version¶: Library’s current version

property data¶: Command’s data

static id_dylib(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) → lief._lief.MachO.DylibCommand¶: Factory function to generate a ID_DYLIB library

static lazy_load_dylib(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) → lief._lief.MachO.DylibCommand¶: Factory function to generate a LAZY_LOAD_DYLIB library

static load_dylib(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) → lief._lief.MachO.DylibCommand¶: Factory function to generate a LOAD_DYLIB library

static load_upward_dylib(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) → lief._lief.MachO.DylibCommand¶: Factory function to generate a LOAD_UPWARD_DYLIB library

property name¶: Library’s name

static reexport_dylib(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) → lief._lief.MachO.DylibCommand¶: Factory function to generate a REEXPORT_DYLIB library

property size¶: Size of the command (should be greather than sizeof(load_command))

property timestamp¶: Library’s timestamp

static weak_lib(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) → lief._lief.MachO.DylibCommand¶: Factory function to generate a LOAD_WEAK_DYLIB library

DylinkerCommand¶

class lief.MachO.DylinkerCommand¶

Class that represents the Mach-O linker, also named loader Most of the time, name returns /usr/lib/dyld

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property name¶: Path to the loader/linker

property size¶: Size of the command (should be greather than sizeof(load_command))

UUIDCommand¶

class lief.MachO.UUIDCommand¶

Class that represents the UUID command

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property size¶: Size of the command (should be greather than sizeof(load_command))

property uuid¶: UUID as a list

MainCommand¶

class lief.MachO.MainCommand¶

Class that represent the LC_MAIN command. This kind of command can be used to determine the entrypoint of an executable

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property entrypoint¶: Offset of the main function relative to the __TEXT segment

property size¶: Size of the command (should be greather than sizeof(load_command))

property stack_size¶: The initial stack size (if not 0)

Symbol¶

class lief.MachO.Symbol(self: lief._lief.MachO.Symbol)¶

Class that represents a Symbol in a Mach-O file.

A Mach-O symbol can come from:

The symbols command (LC_SYMTAB / SymbolCommand)
The Dyld Export trie
The Dyld Symbol bindings

class TOOLS(self: lief._lief.MachO.Symbol.TOOLS, value: int)¶

Members:

NONE

LOCAL

EXTERNAL

UNDEFINED

INDIRECT_ABS

INDIRECT_LOCAL

EXTERNAL = <TOOLS.EXTERNAL: 2>¶

INDIRECT_ABS = <TOOLS.INDIRECT_ABS: 4>¶

INDIRECT_LOCAL = <TOOLS.INDIRECT_LOCAL: 5>¶

LOCAL = <TOOLS.LOCAL: 1>¶

NONE = <TOOLS.NONE: 0>¶

UNDEFINED = <TOOLS.UNDEFINED: 3>¶

property name¶

property value¶

property binding_info¶: BindingInfo associated with the symbol if any, or None

property demangled_name¶: Symbol’s unmangled name

property description¶: Return information about the symbol (SYMBOL_DESCRIPTIONS)

property export_info¶: ExportInfo associated with the symbol if any, or None

property has_binding_info¶: True if the symbol has an BindingInfo associated with

property has_export_info¶: True if the symbol has an ExportInfo associated with

property name¶: Symbol’s name

property numberof_sections¶: It returns the number of sections in which this symbol can be found. If the symbol can’t be found in any section, it returns 0 (NO_SECT)

property origin¶: Return the SYMBOL_ORIGINS of this symbol

property size¶: Symbol’s size

property type¶

property value¶: Symbol’s value

Symbol Command¶

class lief.MachO.SymbolCommand(self: lief._lief.MachO.SymbolCommand)¶

Class that represents the LC_SYMTAB command

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property numberof_symbols¶: Number of symbols registered

property size¶: Size of the command (should be greather than sizeof(load_command))

property strings_offset¶: Offset from the start of the file to the string table

property strings_size¶: Size of the size string table

property symbol_offset¶: Offset from the start of the file to the n_list associated with the command

Dynamic Symbol Command¶

class lief.MachO.DynamicSymbolCommand¶

Class that represents the LC_DYSYMTAB command. This command completes the LC_SYMTAB (SymbolCommand) to provide a better granularity over the symbols layout.

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property external_reference_symbol_offset¶: Byte offset from the start of the file to the external reference table data. This field seems unused by recent Mach-O loader and should be set to 0

property external_relocation_offset¶: Byte offset from the start of the file to the module table data. This field seems unused by recent Mach-O loader and should be set to 0

property idx_external_define_symbol¶: Index of the first symbol in the group of defined external symbols.

property idx_local_symbol¶: Index of the first symbol in the group of local symbols.

property idx_undefined_symbol¶: Index of the first symbol in the group of undefined external symbols.

property indirect_symbol_offset¶

Byte offset from the start of the file to the indirect symbol table data.

Indirect symbol table is used by the loader to speed-up symbol resolution during the lazy binding process

References:

dyld-519.2.1/src/ImageLoaderMachOCompressed.cpp
dyld-519.2.1/src/ImageLoaderMachOClassic.cpp

property local_relocation_offset¶: Byte offset from the start of the file to the local relocation table data. This field seems unused by recent Mach-O loader and should be set to 0

property module_table_offset¶: Byte offset from the start of the file to the module table data. This field seems unused by recent Mach-O loader and should be set to 0

property nb_external_define_symbols¶: Number of symbols in the group of defined external symbols.

property nb_external_reference_symbols¶: Number of entries in the external reference table. This field seems unused by recent Mach-O loader and should be set to 0.

property nb_external_relocations¶: Number of entries in the external relocation table. This field seems unused by recent Mach-O loader and should be set to 0

property nb_indirect_symbols¶: Number of entries in the indirect symbol table.

property nb_local_relocations¶: Number of entries in the local relocation table. This field seems unused by recent Mach-O loader and should be set to 0

property nb_local_symbols¶: Number of symbols in the group of local symbols.

property nb_module_table¶: Number of entries in the module table. This field seems unused by recent Mach-O loader and should be set to 0.

property nb_toc¶: Number of entries in the table of contents Should be set to 0 on recent Mach-O

property nb_undefined_symbols¶: Number of symbols in the group of undefined external symbols.

property size¶: Size of the command (should be greather than sizeof(load_command))

property toc_offset¶: Byte offset from the start of the file to the table of contents data. Table of content is used by legacy Mach-O loader and this field should be set to 0

Dyld Info¶

class lief.MachO.DyldInfo¶

Class that represents the LC_DYLD_INFO and LC_DYLD_INFO_ONLY commands

property bind¶

Bind information as a tuple (offset, size)

Dyld binds an image during the loading process, if the image requires any pointers to be initialized to symbols in other images. The rebase information is a stream of byte sized opcodes for which symbolic names start with BIND_OPCODE_.

Conceptually the bind information is a table of tuples: (seg-index, seg-offset, type, symbol-library-ordinal, symbol-name, addend) The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like for runs of pointers initialzed to the same value can be encoded in a few bytes.

See also

/usr/include/mach-o/loader.h

property bind_opcodes¶: Return the binding’s opcodes as list of bytes

property bindings¶: Return an iterator over Dyld’s BindingInfo

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property export_info¶

Export information as a tuple (offset, size)

The symbols exported by a dylib are encoded in a trie. This is a compact representation that factors out common prefixes.

It also reduces LINKEDIT pages in RAM because it encodes all information (name, address, flags) in one small, contiguous range. The export area is a stream of nodes. The first node sequentially is the start node for the trie.

Nodes for a symbol start with a byte that is the length of the exported symbol information for the string so far. If there is no exported symbol, the byte is zero. If there is exported info, it follows the length byte. The exported info normally consists of a flags and offset both encoded in uleb128. The offset is location of the content named by the symbol. It is the offset from the mach_header for the image.

After the initial byte and optional exported symbol information is a byte of how many edges (0-255) that this node has leaving it, followed by each edge. Each edge is a zero terminated cstring of the addition chars in the symbol, followed by a uleb128 offset for the node that edge points to.

See also

/usr/include/mach-o/loader.h

property export_trie¶: Return Export’s trie as list of bytes

property exports¶: Return an iterator over Dyld’s ExportInfo

class it_binding_info¶

class it_export_info¶

property lazy_bind¶

Lazy Bind information as a tuple (offset, size)

Some uses of external symbols do not need to be bound immediately. Instead they can be lazily bound on first use. The lazy_bind are contains a stream of BIND opcodes to bind all lazy symbols. Normal use is that dyld ignores the lazy_bind section when loading an image. Instead the static linker arranged for the lazy pointer to initially point to a helper function which pushes the offset into the lazy_bind area for the symbol needing to be bound, then jumps to dyld which simply adds the offset to lazy_bind_off to get the information on what to bind.

See also

/usr/include/mach-o/loader.h

property lazy_bind_opcodes¶: Return lazy binding’s opcodes as list of bytes

property rebase¶

Rebase information as a tuple (offset, size)

Dyld rebases an image whenever dyld loads it at an address different from its preferred address. The rebase information is a stream of byte sized opcodes for which symbolic names start with REBASE_OPCODE_.

Conceptually the rebase information is a table of tuples: (seg-index, seg-offset, type)

The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like “every n’th offset for m times” can be encoded in a few bytes

See also

/usr/include/mach-o/loader.h

property rebase_opcodes¶: Return the rebase’s opcodes as list of bytes

set_bind_offset(self: lief._lief.MachO.DyldInfo, offset: int) → None¶

set_bind_size(self: lief._lief.MachO.DyldInfo, size: int) → None¶

set_export_offset(self: lief._lief.MachO.DyldInfo, offset: int) → None¶

set_export_size(self: lief._lief.MachO.DyldInfo, size: int) → None¶

set_lazy_bind_offset(self: lief._lief.MachO.DyldInfo, offset: int) → None¶

set_lazy_bind_size(self: lief._lief.MachO.DyldInfo, size: int) → None¶

set_rebase_offset(self: lief._lief.MachO.DyldInfo, offset: int) → None¶

set_rebase_size(self: lief._lief.MachO.DyldInfo, size: int) → None¶

set_weak_bind_offset(self: lief._lief.MachO.DyldInfo, offset: int) → None¶

set_weak_bind_size(self: lief._lief.MachO.DyldInfo, size: int) → None¶

property show_bind_opcodes¶: Return the bind opcodes in a humman-readable way

property show_export_trie¶: Return the export trie in a humman-readable way

property show_lazy_bind_opcodes¶: Return the weak bind opcodes in a humman-readable way

property show_rebases_opcodes¶: Return the rebase opcodes in a humman-readable way

property show_weak_bind_opcodes¶: Return the weak bind opcodes in a humman-readable way

property size¶: Size of the command (should be greather than sizeof(load_command))

property weak_bind¶

Weak Bind information as a tuple (offset, size)

Some C++ programs require dyld to unique symbols so that all images in the process use the same copy of some code/data.

This step is done after binding. The content of the weak_bind info is an opcode stream like the bind_info. But it is sorted alphabetically by symbol name. This enables dyld to walk all images with weak binding information in order and look for collisions. If there are no collisions, dyld does no updating. That means that some fixups are also encoded in the bind_info. For instance, all calls to operator new are first bound to libstdc++.dylib using the information in bind_info. Then if some image overrides operator new that is detected when the weak_bind information is processed and the call to operator new is then rebound.

See also

/usr/include/mach-o/loader.h

property weak_bind_opcodes¶: Return Weak binding’s opcodes as list of bytes

Function starts¶

class lief.MachO.FunctionStarts¶

Class which represents the LC_FUNCTION_STARTS command

This command is an array of ULEB128 encoded values

add_function(self: lief._lief.MachO.FunctionStarts, address: int) → None¶: Add a new function

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property content¶: The original content as a bytes stream

property data¶: Command’s data

property data_offset¶: Offset in the binary where start functions are located

property data_size¶: Size of the functions list in the binary

property functions¶

Addresses of every function entry point in the executable

This allows functions to exist for which there are no entries in the symbol table.

Warning

The address is relative to the __TEXT segment

property size¶: Size of the command (should be greather than sizeof(load_command))

Source Version¶

class lief.MachO.SourceVersion¶

Class that represents the MachO LOAD_COMMAND_TYPES::LC_SOURCE_VERSION This command is used to provide the version of the sources used to build the binary

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property size¶: Size of the command (should be greather than sizeof(load_command))

property version¶: Version as a tuple of 5 integers

Version Min¶

class lief.MachO.VersionMin¶

Class that wraps the LC_VERSION_MIN_MACOSX, LC_VERSION_MIN_IPHONEOS, … commands

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property sdk¶: SDK as a tuple of 3 integers

property size¶: Size of the command (should be greather than sizeof(load_command))

property version¶: Version as a tuple of 3 integers

Relocation¶

class lief.MachO.Relocation¶

It extends the LIEF lief.Relocation abstract class and it is sub-classed by

RelocationObject
RelocationDyld

property address¶

For OBJECT or (origin is RELOC_TABLE) this is an ” offset from the start of the Section to the item containing the address requiring relocation.

For EXECUTE / DYLIB or (origin is DYLDINFO) this is a virtual_address.

property architecture¶: CPU_TYPES of the relocation

property has_section¶: True if the relocation has a Section associated with

property has_segment¶: True if the relocation has a SegmentCommand associated with

property has_symbol¶: True if the relocation has a Symbol associated with

property origin¶

RELOCATION_ORIGINS of the relocation

For OBJECT file it should be RELOC_TABLE
For EXECUTE or DYLIB it should be DYLDINFO”)

property pc_relative¶

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

property section¶: Section associated with the relocation if any, or None

property segment¶: SegmentCommand associated with the relocation if any, or None

property size¶: Relocation’s size (in bits)

property symbol¶: Symbol associated with the relocation if any, or None

property type¶

Type of the relocation according to the architecture and/or origin

If origin is RELOC_TABLE:

See:

lief.MachO.X86_RELOCATION
lief.MachO.X86_64_RELOCATION
lief.MachO.PPC_RELOCATION
lief.MachO.ARM_RELOCATION
lief.MachO.ARM64_RELOCATION

If origin is DYLDINFO, the value is associated with REBASE_TYPES.

Relocation Object¶

class lief.MachO.RelocationObject¶

Class that represents a relocation presents in the MachO object file (.o). Usually, this kind of relocation is found in the lief.MachO.Section.

property address¶

For OBJECT or (origin is RELOC_TABLE) this is an ” offset from the start of the Section to the item containing the address requiring relocation.

For EXECUTE / DYLIB or (origin is DYLDINFO) this is a virtual_address.

property architecture¶: CPU_TYPES of the relocation

property has_section¶: True if the relocation has a Section associated with

property has_segment¶: True if the relocation has a SegmentCommand associated with

property has_symbol¶: True if the relocation has a Symbol associated with

property is_scattered¶: True if the relocation is a scattered one

property origin¶

RELOCATION_ORIGINS of the relocation

For OBJECT file it should be RELOC_TABLE
For EXECUTE or DYLIB it should be DYLDINFO”)

property pc_relative¶

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

property section¶: Section associated with the relocation if any, or None

property segment¶: SegmentCommand associated with the relocation if any, or None

property size¶: Relocation’s size (in bits)

property symbol¶: Symbol associated with the relocation if any, or None

property type¶

Type of the relocation according to the architecture and/or origin

If origin is RELOC_TABLE:

See:

lief.MachO.X86_RELOCATION
lief.MachO.X86_64_RELOCATION
lief.MachO.PPC_RELOCATION
lief.MachO.ARM_RELOCATION
lief.MachO.ARM64_RELOCATION

If origin is DYLDINFO, the value is associated with REBASE_TYPES.

property value¶

For scattered relocations, the address of the relocatable expression for the item in the file that needs to be updated if the address is changed.

For relocatable expressions with the difference of two section addresses, the address from which to subtract (in mathematical terms, the minuend) is contained in the first relocation entry and the address to subtract (the subtrahend) is contained in the second relocation entry.”,

Relocation Dyld¶

class lief.MachO.RelocationDyld¶

Class that represents a relocation found in the DyldInfo structure.

While this class does not have an associated structure in the Mach-O format specification, it provides a convenient interface for the lief.MachO.DyldInfo.rebase values

Relocation Fixup¶

class lief.MachO.RelocationFixup¶

Class that represents a rebase relocation found in the LC_DYLD_CHAINED_FIXUPS command.

This class extends lief.Relocation (and lief.MachO.Relocation) in which address is set to the absolute virtual address where the relocation must take place (e.g. 0x10000d270).

On the other hand, target contains the value that should be set at address if the imagebase is imagebase (e.g. 0x1000073a8).

If the Mach-O loader chooses another base address (like 0x7ff100000), it must set 0x10000d270 to 0x7ff1073a8.

property address¶

For OBJECT or (origin is RELOC_TABLE) this is an ” offset from the start of the Section to the item containing the address requiring relocation.

For EXECUTE / DYLIB or (origin is DYLDINFO) this is a virtual_address.

property architecture¶: CPU_TYPES of the relocation

property has_section¶: True if the relocation has a Section associated with

property has_segment¶: True if the relocation has a SegmentCommand associated with

property has_symbol¶: True if the relocation has a Symbol associated with

property origin¶

RELOCATION_ORIGINS of the relocation

For OBJECT file it should be RELOC_TABLE
For EXECUTE or DYLIB it should be DYLDINFO”)

property pc_relative¶

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

property section¶: Section associated with the relocation if any, or None

property segment¶: SegmentCommand associated with the relocation if any, or None

property size¶: Relocation’s size (in bits)

property symbol¶: Symbol associated with the relocation if any, or None

property target¶

property type¶

Type of the relocation according to the architecture and/or origin

If origin is RELOC_TABLE:

See:

lief.MachO.X86_RELOCATION
lief.MachO.X86_64_RELOCATION
lief.MachO.PPC_RELOCATION
lief.MachO.ARM_RELOCATION
lief.MachO.ARM64_RELOCATION

If origin is DYLDINFO, the value is associated with REBASE_TYPES.

Binding Info¶

class lief.MachO.BindingInfo¶

Class that provides an interface over an entry in DyldInfo structure

This class does not represent a structure that exists in the Mach-O format specifications but it provides a view of a binding operation that is performed by the Dyld binding bytecode (LC_DYLD_INFO) or the Dyld chained fixups (DYLD_CHAINED_FIXUPS)

See: ChainedBindingInfo, DyldBindingInfo

property addend¶: Value added to the segment’s virtual address when binding

property address¶: Binding’s address

property has_library¶: True if the binding info has a DylibCommand associated with

property has_segment¶: True if the binding info has a SegmentCommand associated with

property has_symbol¶: True if the binding info has a Symbol associated with

property library¶: DylibCommand associated with the binding if any, or None

property library_ordinal¶

property segment¶: SegmentCommand associated with the binding if any, or None

property symbol¶: Symbol associated with the binding if any, or None

property weak_import¶

Dyld Binding Info¶

class lief.MachO.DyldBindingInfo¶

This class represents a symbol binding operation associated with the LC_DYLD_INFO bytecode.

This class does not represent a structure that exists in the Mach-O format specifications but it provides a view on an entry of the Dyld binding opcodes.

Chained Binding Info¶

class lief.MachO.ChainedBindingInfo¶

This class represents a symbol binding operation associated with the LC_DYLD_CHAINED_FIXUPS command.

This class does not represent a structure that exists in the Mach-O format specifications but it provides a view on an entry.

Export Info¶

class lief.MachO.ExportInfo¶

Class that provides an interface over the Dyld export info

This class does not represent a structure that exists in the Mach-O format specification but provides a view on an entry of the Dyld export trie.

property address¶: The address of the export

property alias¶: Symbol alias if the current symbol is re-exported

property alias_library¶: If the current symbol has an alias, it returns the DylibCommand command associated with

property flags¶: Some information (EXPORT_SYMBOL_FLAGS) about the export (like weak export, reexport, …)

property flags_list¶: Return flags as a list of EXPORT_SYMBOL_KINDS

has(self: lief._lief.MachO.ExportInfo, Check if the flag :class:`~lief.MachO.EXPORT_SYMBOL_FLAGS` given in first parameter is presentflag: lief._lief.MachO.EXPORT_SYMBOL_FLAGS) → bool¶

property has_symbol¶: True if the export info has a Symbol associated with

property kind¶: The export’s kind: regular, thread local, absolute, … (EXPORT_SYMBOL_KINDS)

property node_offset¶: Original offset in the export Trie

property symbol¶: Symbol associated with the export if any, or None

Thread Command¶

class lief.MachO.ThreadCommand¶

Class that represents the LC_THREAD / LC_UNIXTHREAD commands and that can be used to get the binary entrypoint when the LC_MAIN (MainCommand) is not present

Generally speaking, this command aims at defining the original state of the main thread which includes the registers’ values

property architecture¶: The CPU architecture that is targeted by this ThreadCommand

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property count¶

Size of the thread state data with 32-bits alignment.

This value should match len(state)

property data¶: Command’s data

property flavor¶

Integer that defines a special flavor for the thread.

The meaning of this value depends on the architecture. The list of the values can be found in the XNU kernel files:

xnu/osfmk/mach/arm/thread_status.h for the ARM/AArch64 architectures
xnu/osfmk/mach/i386/thread_status.h for the x86/x86-64 architectures

property pc¶

Return the initial Program Counter regardless of the underlying architecture. This value, when non null, can be used to determine the binary’s entrypoint.

Underneath, it works by looking for the PC register value in the state data

property size¶: Size of the command (should be greather than sizeof(load_command))

property state¶: The actual thread state as a vector of bytes. Depending on the architecture(), these data can be casted into x86_thread_state_t, x86_thread_state64_t, …

RPath Command¶

class lief.MachO.RPathCommand¶

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property path¶: @rpath path

property size¶: Size of the command (should be greather than sizeof(load_command))

Code Signature¶

class lief.MachO.CodeSignature¶

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property content¶: The raw signature as a bytes stream

property data¶: Command’s data

property data_offset¶: Offset in the binary where the signature starts

property data_size¶: Size of the raw signature

property size¶: Size of the command (should be greather than sizeof(load_command))

Data In Code¶

class lief.MachO.DataInCode¶

Interface of the LC_DATA_IN_CODE command

This command is used to list slices of code sections that contain data. The slices information are stored as an array of DataCodeEntry

add(self: lief._lief.MachO.DataInCode, entry: LIEF::MachO::DataCodeEntry) → lief._lief.MachO.DataInCode¶: Add an new DataCodeEntry

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property content¶: The original content as a bytes stream

property data¶: Command’s data

property data_offset¶: Start of the array of the DataCodeEntry entries

property data_size¶: Whole size of the array (size = sizeof(DataCodeEntry) * nb_elements)

property entries¶: Iterator over DataCodeEntry

property size¶: Size of the command (should be greather than sizeof(load_command))

Data Code Entry¶

class lief.MachO.DataCodeEntry(self: lief._lief.MachO.DataCodeEntry, arg0: int, arg1: int, arg2: LIEF::MachO::DataCodeEntry::TYPES)¶

Interface over an entry in the DataInCode command

class TYPES(self: lief._lief.MachO.DataCodeEntry.TYPES, value: int)¶

Members:

UNKNOWN

DATA

JUMP_TABLE_8

JUMP_TABLE_16

JUMP_TABLE_32

ABS_JUMP_TABLE_32

ABS_JUMP_TABLE_32 = <TYPES.ABS_JUMP_TABLE_32: 5>¶

DATA = <TYPES.DATA: 1>¶

JUMP_TABLE_16 = <TYPES.JUMP_TABLE_16: 3>¶

JUMP_TABLE_32 = <TYPES.JUMP_TABLE_32: 4>¶

JUMP_TABLE_8 = <TYPES.JUMP_TABLE_8: 2>¶

UNKNOWN = <TYPES.UNKNOWN: 0>¶

property name¶

property value¶

property length¶: Length of the data

property offset¶: Offset of the data

property type¶: Type of the data (TYPES

Segment Split Info¶

class lief.MachO.SegmentSplitInfo¶

Class that represents the LOAD_COMMAND_TYPES::LC_SEGMENT_SPLIT_INFO command

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property content¶: The original content as a bytes stream

property data¶: Command’s data

property data_offset¶: Offset in the binary where the data start

property data_size¶: Size of the raw data

property size¶: Size of the command (should be greather than sizeof(load_command))

Sub Framework¶

class lief.MachO.SubFramework¶

Class that represents the SubFramework command. Accodring to the Mach-O loader.h documentation:

> A dynamically linked shared library may be a subframework of an umbrella > framework. If so it will be linked with “-umbrella umbrella_name” where > Where “umbrella_name” is the name of the umbrella framework. A subframework > can only be linked against by its umbrella framework or other subframeworks > that are part of the same umbrella framework. Otherwise the static link > editor produces an error and states to link against the umbrella framework. > The name of the umbrella framework for subframeworks is recorded in the > following structure.

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property size¶: Size of the command (should be greather than sizeof(load_command))

property umbrella¶: Name of the umbrella framework

Dyld Environment¶

class lief.MachO.DyldEnvironment¶

Class that represents a LC_DYLD_ENVIRONMENT which is used by the Mach-O linker/loader to initialize an environment variable

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property size¶: Size of the command (should be greather than sizeof(load_command))

property value¶: Environment variable as a string

Encryption Info¶

class lief.MachO.EncryptionInfo¶

Class that represents the LC_ENCRYPTION_INFO / LC_ENCRYPTION_INFO_64 commands

The encryption info is usually present in Mach-O executables that target iOS to encrypt some sections of the binary

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property crypt_id¶: The encryption system. 0 means no encrypted

property crypt_offset¶: File offset of encrypted range

property crypt_size¶: File size of encrypted range

property data¶: Command’s data

property size¶: Size of the command (should be greather than sizeof(load_command))

Build Version¶

class lief.MachO.BuildVersion¶

class PLATFORMS(self: lief._lief.MachO.BuildVersion.PLATFORMS, value: int)¶

Members:

UNKNOWN

MACOS

IOS

TVOS

WATCHOS

IOS = <PLATFORMS.IOS: 2>¶

MACOS = <PLATFORMS.MACOS: 1>¶

TVOS = <PLATFORMS.TVOS: 3>¶

UNKNOWN = <PLATFORMS.UNKNOWN: 0>¶

WATCHOS = <PLATFORMS.WATCHOS: 4>¶

property name¶

property value¶

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property minos¶: Minimal OS version on which this binary was built to run

property platform¶: Target PLATFORMS

property sdk¶: SDK Version

property size¶: Size of the command (should be greather than sizeof(load_command))

property tools¶: List of BuildToolVersion used when while this binary

Build Tool Version¶

class lief.MachO.BuildToolVersion¶

Class that represents a tool’s version that was involved in the build of the binary

class TOOLS(self: lief._lief.MachO.BuildToolVersion.TOOLS, value: int)¶

Members:

UNKNOWN

CLANG

SWIFT

CLANG = <TOOLS.CLANG: 1>¶

LD = <TOOLS.LD: 3>¶

SWIFT = <TOOLS.SWIFT: 2>¶

UNKNOWN = <TOOLS.UNKNOWN: 0>¶

property name¶

property value¶

property tool¶: TOOLS type

property version¶: Version of the tool

Fileset Command¶

class lief.MachO.FilesetCommand¶

Class associated with the LC_FILESET_ENTRY commands

property binary¶: Return the Binary object associated with the entry

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property file_offset¶: Original offset in the kernel cache

property name¶: Name of the underlying MachO binary

property size¶: Size of the command (should be greather than sizeof(load_command))

property virtual_address¶: Memory address where the MachO file should be mapped

DyldChainedFixups Command¶

class lief.MachO.DyldChainedFixups¶

Class that represents the LC_DYLD_CHAINED_FIXUPS command

This command aims at providing rebase and binding information like the DyldInfo ‘s bytecode. Compared to the DyldInfo bytecode, these chained fixups are taking less space.

property bindings¶: Iterator over the bindings ChainedBindingInfo associated with this command

class chained_starts_in_segment¶

Structure that mirrors the raw dyld_chained_starts_in_segment which aims at providing information about the chained rebase/bind fixups

The relocations provided by this structure can be accessed through relocations

property max_valid_pointer¶: for 32-bit OS, any value beyond this is not a pointer

property offset¶: Original offset of the structure, relative to starts_offset

property page_count¶: How many pages are in the page_start array

property page_size¶: Likely 0x1000 for x86/x86_64 architectures and 0x4000 for ARM64 architecture

property page_start¶: Offset in the SegmentCommand of the first element of the chain.

property pointer_format¶: How pointers are encoded

property segment¶: SegmentCommand in which the rebase/bind fixups take place

property segment_offset¶: Offset of the segment’s data from the beginning of the file. (it should match file_offset)

property size¶: sizeof(size) + sizeof(page_size) + ... + sizeof(pointer_format)

property chained_starts_in_segments¶: Iterator over the chained fixup metadata, chained_starts_in_segment

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property data_offset¶: Offset of the LC_DYLD_CHAINED_FIXUPS chained payload. This offset should point in the __LINKEDIT segment

property data_size¶: Size of the LC_DYLD_CHAINED_FIXUPS payload

property fixups_version¶: Chained fixups version. The loader (as far of dyld v852.2) checks that this value is set to 0.

property imports_count¶: Number of imported symbol names

property imports_format¶: The format of the imports (ChainedBindingInfo)

property imports_offset¶: Offset of imports table in chain data

class it_binding_info¶

class it_chained_starts_in_segments_t¶

property size¶: Size of the command (should be greather than sizeof(load_command))

property starts_offset¶: offset of dyld_chained_starts_in_image in chain_data

property symbols_format¶

The compression algorithm (if any) used to store the symbols 0 means uncompressed while 1 means zlib compressed.

As far of the version v852.2 of dyld loader, it only supports uncompressed format

property symbols_offset¶: Offset of symbol strings in chain data

DyldExportsTrie Command¶

class lief.MachO.DyldExportsTrie¶

Class that represents the LC_DYLD_EXPORTS_TRIE command

In recent Mach-O binaries, this command replace the DyldInfo export trie buffer

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property content¶: The raw export trie

property data¶: Command’s data

property data_offset¶: Offset of the trie in the binary. This offset should point in the __LINKEDIT

property data_size¶: Raw size of the trie

property exports¶: Iterator over the ExportInfo associated with this trie.

show_export_trie(self: lief._lief.MachO.DyldExportsTrie) → str¶: Show the trie in a humman-readable way

property size¶: Size of the command (should be greather than sizeof(load_command))

Code Signature Dir Command¶

class lief.MachO.CodeSignatureDir¶

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property content¶: The raw signature as a bytes stream

property data¶: Command’s data

property data_offset¶: Offset in the binary where the signature starts

property data_size¶: Size of the raw signature

property size¶: Size of the command (should be greather than sizeof(load_command))

Two Level Hints¶

class lief.MachO.TwoLevelHints¶

Class which represents the LC_TWOLEVEL_HINTS command

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property content¶: The original content as a bytes stream

property data¶: Command’s data

property hints¶

property size¶: Size of the command (should be greather than sizeof(load_command))

Linker Optimization Hint¶

class lief.MachO.LinkerOptHint¶

Class which represents the LC_LINKER_OPTIMIZATION_HINT command

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property content¶: The raw payload

property data¶: Command’s data

property data_offset¶: Offset in the binary where the payload starts

property data_size¶: Size of the raw payload

property size¶: Size of the command (should be greather than sizeof(load_command))

Builder¶

class lief.MachO.Builder¶

Class used to reconstruct a Mach-O binary from its object representation

class config_t(self: lief._lief.MachO.Builder.config_t)¶

Interface to tweak the Builder

property linkedit¶

static write(*args, **kwargs)¶

Overloaded function.

write(binary: lief._lief.MachO.Binary, output: str) -> object
write(binary: lief._lief.MachO.Binary, output: str, config: lief._lief.MachO.Builder.config_t) -> object
write(fat_binary: lief._lief.MachO.FatBinary, output: str) -> object
write(fat_binary: lief._lief.MachO.FatBinary, output: str, config: lief._lief.MachO.Builder.config_t) -> object

Enums¶

CPU_TYPES¶

class lief.MachO.CPU_TYPES(self: lief._lief.MachO.CPU_TYPES, value: int)¶

Members:

ANY

x86

I386

x86_64

MC98000

ARM

ARM64

SPARC

POWERPC

POWERPC64

ANY = <CPU_TYPES.ANY: -1>¶

ARM = <CPU_TYPES.ARM: 12>¶

ARM64 = <CPU_TYPES.ARM64: 16777228>¶

I386 = <CPU_TYPES.x86: 7>¶

MC98000 = <CPU_TYPES.MC98000: 10>¶

POWERPC = <CPU_TYPES.POWERPC: 18>¶

POWERPC64 = <CPU_TYPES.POWERPC64: 16777234>¶

SPARC = <CPU_TYPES.SPARC: 14>¶

property name¶

property value¶

x86 = <CPU_TYPES.x86: 7>¶

x86_64 = <CPU_TYPES.x86_64: 16777223>¶

FILE_TYPES¶

class lief.MachO.FILE_TYPES(self: lief._lief.MachO.FILE_TYPES, value: int)¶

Members:

OBJECT

EXECUTE

FVMLIB

CORE

PRELOAD

DYLIB

DYLINKER

BUNDLE

DYLIB_STUB

DSYM

KEXT_BUNDLE

BUNDLE = <FILE_TYPES.BUNDLE: 8>¶

CORE = <FILE_TYPES.CORE: 4>¶

DSYM = <FILE_TYPES.DSYM: 10>¶

DYLIB = <FILE_TYPES.DYLIB: 6>¶

DYLIB_STUB = <FILE_TYPES.DYLIB_STUB: 9>¶

DYLINKER = <FILE_TYPES.DYLINKER: 7>¶

EXECUTE = <FILE_TYPES.EXECUTE: 2>¶

FVMLIB = <FILE_TYPES.FVMLIB: 3>¶

KEXT_BUNDLE = <FILE_TYPES.KEXT_BUNDLE: 11>¶

OBJECT = <FILE_TYPES.OBJECT: 1>¶

PRELOAD = <FILE_TYPES.PRELOAD: 5>¶

property name¶

property value¶

HEADER_FLAGS¶

class lief.MachO.HEADER_FLAGS(self: lief._lief.MachO.HEADER_FLAGS, value: int)¶

Members:

NOUNDEFS

INCRLINK

DYLDLINK

BINDATLOAD

PREBOUND

SPLIT_SEGS

LAZY_INIT

TWOLEVEL

FORCE_FLAT

NOMULTIDEFS

NOFIXPREBINDING

PREBINDABLE

ALLMODSBOUND

SUBSECTIONS_VIA_SYMBOLS

CANONICAL

WEAK_DEFINES

BINDS_TO_WEAK

ALLOW_STACK_EXECUTION

ROOT_SAFE

SETUID_SAFE

NO_REEXPORTED_DYLIBS

PIE

DEAD_STRIPPABLE_DYLIB

HAS_TLV_DESCRIPTORS

NO_HEAP_EXECUTION

APP_EXTENSION_SAFE

ALLMODSBOUND = <HEADER_FLAGS.ALLMODSBOUND: 4096>¶

ALLOW_STACK_EXECUTION = <HEADER_FLAGS.ALLOW_STACK_EXECUTION: 131072>¶

APP_EXTENSION_SAFE = <HEADER_FLAGS.APP_EXTENSION_SAFE: 33554432>¶

BINDATLOAD = <HEADER_FLAGS.BINDATLOAD: 8>¶

BINDS_TO_WEAK = <HEADER_FLAGS.BINDS_TO_WEAK: 65536>¶

CANONICAL = <HEADER_FLAGS.CANONICAL: 16384>¶

DEAD_STRIPPABLE_DYLIB = <HEADER_FLAGS.DEAD_STRIPPABLE_DYLIB: 4194304>¶

DYLDLINK = <HEADER_FLAGS.DYLDLINK: 4>¶

FORCE_FLAT = <HEADER_FLAGS.FORCE_FLAT: 256>¶

HAS_TLV_DESCRIPTORS = <HEADER_FLAGS.HAS_TLV_DESCRIPTORS: 8388608>¶

INCRLINK = <HEADER_FLAGS.INCRLINK: 2>¶

LAZY_INIT = <HEADER_FLAGS.LAZY_INIT: 64>¶

NOFIXPREBINDING = <HEADER_FLAGS.NOFIXPREBINDING: 1024>¶

NOMULTIDEFS = <HEADER_FLAGS.NOMULTIDEFS: 512>¶

NOUNDEFS = <HEADER_FLAGS.NOUNDEFS: 1>¶

NO_HEAP_EXECUTION = <HEADER_FLAGS.NO_HEAP_EXECUTION: 16777216>¶

NO_REEXPORTED_DYLIBS = <HEADER_FLAGS.NO_REEXPORTED_DYLIBS: 1048576>¶

PIE = <HEADER_FLAGS.PIE: 2097152>¶

PREBINDABLE = <HEADER_FLAGS.PREBINDABLE: 2048>¶

PREBOUND = <HEADER_FLAGS.PREBOUND: 16>¶

ROOT_SAFE = <HEADER_FLAGS.ROOT_SAFE: 262144>¶

SETUID_SAFE = <HEADER_FLAGS.SETUID_SAFE: 524288>¶

SPLIT_SEGS = <HEADER_FLAGS.SPLIT_SEGS: 32>¶

SUBSECTIONS_VIA_SYMBOLS = <HEADER_FLAGS.SUBSECTIONS_VIA_SYMBOLS: 8192>¶

TWOLEVEL = <HEADER_FLAGS.TWOLEVEL: 128>¶

WEAK_DEFINES = <HEADER_FLAGS.WEAK_DEFINES: 32768>¶

property name¶

property value¶

LOAD_COMMAND_TYPES¶

class lief.MachO.LOAD_COMMAND_TYPES(self: lief._lief.MachO.LOAD_COMMAND_TYPES, value: int)¶

Members:

SEGMENT

SYMTAB

SYMSEG

THREAD

UNIXTHREAD

LOADFVMLIB

IDFVMLIB

IDENT

FVMFILE

PREPAGE

DYSYMTAB

LOAD_DYLIB

ID_DYLIB

LOAD_DYLINKER

ID_DYLINKER

PREBOUND_DYLIB

ROUTINES

SUB_FRAMEWORK

SUB_UMBRELLA

SUB_CLIENT

SUB_LIBRARY

TWOLEVEL_HINTS

PREBIND_CKSUM

LOAD_WEAK_DYLIB

SEGMENT_64

ROUTINES_64

UUID

RPATH

CODE_SIGNATURE

SEGMENT_SPLIT_INFO

REEXPORT_DYLIB

LAZY_LOAD_DYLIB

ENCRYPTION_INFO

DYLD_INFO

DYLD_INFO_ONLY

LOAD_UPWARD_DYLIB

VERSION_MIN_MACOSX

VERSION_MIN_IPHONEOS

FUNCTION_STARTS

DYLD_ENVIRONMENT

MAIN

DATA_IN_CODE

SOURCE_VERSION

DYLIB_CODE_SIGN_DRS

ENCRYPTION_INFO_64

LINKER_OPTION

LINKER_OPTIMIZATION_HINT

VERSION_MIN_TVOS

VERSION_MIN_WATCHOS

NOTE

BUILD_VERSION

DYLD_EXPORTS_TRIE

DYLD_CHAINED_FIXUPS

FILESET_ENTRY

BUILD_VERSION = <LOAD_COMMAND_TYPES.BUILD_VERSION: 50>¶

CODE_SIGNATURE = <LOAD_COMMAND_TYPES.CODE_SIGNATURE: 29>¶

DATA_IN_CODE = <LOAD_COMMAND_TYPES.DATA_IN_CODE: 41>¶

DYLD_CHAINED_FIXUPS = <LOAD_COMMAND_TYPES.DYLD_CHAINED_FIXUPS: 2147483700>¶

DYLD_ENVIRONMENT = <LOAD_COMMAND_TYPES.DYLD_ENVIRONMENT: 39>¶

DYLD_EXPORTS_TRIE = <LOAD_COMMAND_TYPES.DYLD_EXPORTS_TRIE: 2147483699>¶

DYLD_INFO = <LOAD_COMMAND_TYPES.DYLD_INFO: 34>¶

DYLD_INFO_ONLY = <LOAD_COMMAND_TYPES.DYLD_INFO_ONLY: 2147483682>¶

DYLIB_CODE_SIGN_DRS = <LOAD_COMMAND_TYPES.DYLIB_CODE_SIGN_DRS: 43>¶

DYSYMTAB = <LOAD_COMMAND_TYPES.DYSYMTAB: 11>¶

ENCRYPTION_INFO = <LOAD_COMMAND_TYPES.ENCRYPTION_INFO: 33>¶

ENCRYPTION_INFO_64 = <LOAD_COMMAND_TYPES.ENCRYPTION_INFO_64: 44>¶

FILESET_ENTRY = <LOAD_COMMAND_TYPES.FILESET_ENTRY: 2147483701>¶

FUNCTION_STARTS = <LOAD_COMMAND_TYPES.FUNCTION_STARTS: 38>¶

FVMFILE = <LOAD_COMMAND_TYPES.FVMFILE: 9>¶

IDENT = <LOAD_COMMAND_TYPES.IDENT: 8>¶

IDFVMLIB = <LOAD_COMMAND_TYPES.IDFVMLIB: 7>¶

ID_DYLIB = <LOAD_COMMAND_TYPES.ID_DYLIB: 13>¶

ID_DYLINKER = <LOAD_COMMAND_TYPES.ID_DYLINKER: 15>¶

LAZY_LOAD_DYLIB = <LOAD_COMMAND_TYPES.LAZY_LOAD_DYLIB: 32>¶

LINKER_OPTIMIZATION_HINT = <LOAD_COMMAND_TYPES.LINKER_OPTIMIZATION_HINT: 46>¶

LINKER_OPTION = <LOAD_COMMAND_TYPES.LINKER_OPTION: 45>¶

LOADFVMLIB = <LOAD_COMMAND_TYPES.LOADFVMLIB: 6>¶

LOAD_DYLIB = <LOAD_COMMAND_TYPES.LOAD_DYLIB: 12>¶

LOAD_DYLINKER = <LOAD_COMMAND_TYPES.LOAD_DYLINKER: 14>¶

LOAD_UPWARD_DYLIB = <LOAD_COMMAND_TYPES.LOAD_UPWARD_DYLIB: 2147483683>¶

LOAD_WEAK_DYLIB = <LOAD_COMMAND_TYPES.LOAD_WEAK_DYLIB: 2147483672>¶

MAIN = <LOAD_COMMAND_TYPES.MAIN: 2147483688>¶

NOTE = <LOAD_COMMAND_TYPES.NOTE: 49>¶

PREBIND_CKSUM = <LOAD_COMMAND_TYPES.PREBIND_CKSUM: 23>¶

PREBOUND_DYLIB = <LOAD_COMMAND_TYPES.PREBOUND_DYLIB: 16>¶

PREPAGE = <LOAD_COMMAND_TYPES.PREPAGE: 10>¶

REEXPORT_DYLIB = <LOAD_COMMAND_TYPES.REEXPORT_DYLIB: 2147483679>¶

ROUTINES = <LOAD_COMMAND_TYPES.ROUTINES: 17>¶

ROUTINES_64 = <LOAD_COMMAND_TYPES.ROUTINES_64: 26>¶

RPATH = <LOAD_COMMAND_TYPES.RPATH: 2147483676>¶

SEGMENT = <LOAD_COMMAND_TYPES.SEGMENT: 1>¶

SEGMENT_64 = <LOAD_COMMAND_TYPES.SEGMENT_64: 25>¶

SEGMENT_SPLIT_INFO = <LOAD_COMMAND_TYPES.SEGMENT_SPLIT_INFO: 30>¶

SOURCE_VERSION = <LOAD_COMMAND_TYPES.SOURCE_VERSION: 42>¶

SUB_CLIENT = <LOAD_COMMAND_TYPES.SUB_CLIENT: 20>¶

SUB_FRAMEWORK = <LOAD_COMMAND_TYPES.SUB_FRAMEWORK: 18>¶

SUB_LIBRARY = <LOAD_COMMAND_TYPES.SUB_LIBRARY: 21>¶

SUB_UMBRELLA = <LOAD_COMMAND_TYPES.SUB_UMBRELLA: 19>¶

SYMSEG = <LOAD_COMMAND_TYPES.SYMSEG: 3>¶

SYMTAB = <LOAD_COMMAND_TYPES.SYMTAB: 2>¶

THREAD = <LOAD_COMMAND_TYPES.THREAD: 4>¶

TWOLEVEL_HINTS = <LOAD_COMMAND_TYPES.TWOLEVEL_HINTS: 22>¶

UNIXTHREAD = <LOAD_COMMAND_TYPES.UNIXTHREAD: 5>¶

UUID = <LOAD_COMMAND_TYPES.UUID: 27>¶

VERSION_MIN_IPHONEOS = <LOAD_COMMAND_TYPES.VERSION_MIN_IPHONEOS: 37>¶

VERSION_MIN_MACOSX = <LOAD_COMMAND_TYPES.VERSION_MIN_MACOSX: 36>¶

VERSION_MIN_TVOS = <LOAD_COMMAND_TYPES.VERSION_MIN_TVOS: 47>¶

VERSION_MIN_WATCHOS = <LOAD_COMMAND_TYPES.VERSION_MIN_WATCHOS: 48>¶

property name¶

property value¶

SECTION_TYPES¶

class lief.MachO.SECTION_TYPES(self: lief._lief.MachO.SECTION_TYPES, value: int)¶

Members:

REGULAR

ZEROFILL

CSTRING_LITERALS

S_4BYTE_LITERALS

S_8BYTE_LITERALS

LITERAL_POINTERS

NON_LAZY_SYMBOL_POINTERS

LAZY_SYMBOL_POINTERS

SYMBOL_STUBS

MOD_INIT_FUNC_POINTERS

MOD_TERM_FUNC_POINTERS

COALESCED

GB_ZEROFILL

INTERPOSING

S_16BYTE_LITERALS

DTRACE_DOF

LAZY_DYLIB_SYMBOL_POINTERS

THREAD_LOCAL_REGULAR

THREAD_LOCAL_ZEROFILL

THREAD_LOCAL_VARIABLES

THREAD_LOCAL_VARIABLE_POINTERS

THREAD_LOCAL_INIT_FUNCTION_POINTERS

COALESCED = <SECTION_TYPES.COALESCED: 11>¶

CSTRING_LITERALS = <SECTION_TYPES.CSTRING_LITERALS: 2>¶

DTRACE_DOF = <SECTION_TYPES.DTRACE_DOF: 15>¶

GB_ZEROFILL = <SECTION_TYPES.GB_ZEROFILL: 12>¶

INTERPOSING = <SECTION_TYPES.INTERPOSING: 13>¶

LAZY_DYLIB_SYMBOL_POINTERS = <SECTION_TYPES.LAZY_DYLIB_SYMBOL_POINTERS: 16>¶

LAZY_SYMBOL_POINTERS = <SECTION_TYPES.LAZY_SYMBOL_POINTERS: 7>¶

LITERAL_POINTERS = <SECTION_TYPES.LITERAL_POINTERS: 5>¶

MOD_INIT_FUNC_POINTERS = <SECTION_TYPES.MOD_INIT_FUNC_POINTERS: 9>¶

MOD_TERM_FUNC_POINTERS = <SECTION_TYPES.MOD_TERM_FUNC_POINTERS: 10>¶

NON_LAZY_SYMBOL_POINTERS = <SECTION_TYPES.NON_LAZY_SYMBOL_POINTERS: 6>¶

REGULAR = <SECTION_TYPES.REGULAR: 0>¶

SYMBOL_STUBS = <SECTION_TYPES.SYMBOL_STUBS: 8>¶

S_16BYTE_LITERALS = <SECTION_TYPES.S_16BYTE_LITERALS: 14>¶

S_4BYTE_LITERALS = <SECTION_TYPES.S_4BYTE_LITERALS: 3>¶

S_8BYTE_LITERALS = <SECTION_TYPES.S_8BYTE_LITERALS: 4>¶

THREAD_LOCAL_INIT_FUNCTION_POINTERS = <SECTION_TYPES.THREAD_LOCAL_INIT_FUNCTION_POINTERS: 21>¶

THREAD_LOCAL_REGULAR = <SECTION_TYPES.THREAD_LOCAL_REGULAR: 17>¶

THREAD_LOCAL_VARIABLES = <SECTION_TYPES.THREAD_LOCAL_VARIABLES: 19>¶

THREAD_LOCAL_VARIABLE_POINTERS = <SECTION_TYPES.THREAD_LOCAL_VARIABLE_POINTERS: 20>¶

THREAD_LOCAL_ZEROFILL = <SECTION_TYPES.THREAD_LOCAL_ZEROFILL: 18>¶

ZEROFILL = <SECTION_TYPES.ZEROFILL: 1>¶

property name¶

property value¶

MACHO_TYPES¶

class lief.MachO.MACHO_TYPES(self: lief._lief.MachO.MACHO_TYPES, value: int)¶

Members:

MAGIC

CIGAM

MAGIC_64

CIGAM_64

FAT_MAGIC

FAT_CIGAM

CIGAM = <MACHO_TYPES.CIGAM: 3472551422>¶

CIGAM_64 = <MACHO_TYPES.CIGAM_64: 3489328638>¶

FAT_CIGAM = <MACHO_TYPES.FAT_CIGAM: 3199925962>¶

FAT_MAGIC = <MACHO_TYPES.FAT_MAGIC: 3405691582>¶

MAGIC = <MACHO_TYPES.MAGIC: 4277009102>¶

MAGIC_64 = <MACHO_TYPES.MAGIC_64: 4277009103>¶

property name¶

property value¶

X86_RELOCATION¶

class lief.MachO.X86_RELOCATION(self: lief._lief.MachO.X86_RELOCATION, value: int)¶

Members:

VANILLA

PAIR

SECTDIFF

PB_LA_PTR

LOCAL_SECTDIFF

TLV

LOCAL_SECTDIFF = <X86_RELOCATION.LOCAL_SECTDIFF: 4>¶

PAIR = <X86_RELOCATION.PAIR: 1>¶

PB_LA_PTR = <X86_RELOCATION.PB_LA_PTR: 3>¶

SECTDIFF = <X86_RELOCATION.SECTDIFF: 2>¶

TLV = <X86_RELOCATION.TLV: 5>¶

VANILLA = <X86_RELOCATION.VANILLA: 0>¶

property name¶

property value¶

X86_64_RELOCATION¶

class lief.MachO.X86_64_RELOCATION(self: lief._lief.MachO.X86_64_RELOCATION, value: int)¶

Members:

UNSIGNED

SIGNED

BRANCH

GOT_LOAD

GOT

SUBTRACTOR

SIGNED_1

SIGNED_2

SIGNED_4

TLV

BRANCH = <X86_64_RELOCATION.BRANCH: 2>¶

GOT = <X86_64_RELOCATION.GOT: 4>¶

GOT_LOAD = <X86_64_RELOCATION.GOT_LOAD: 3>¶

SIGNED = <X86_64_RELOCATION.SIGNED: 1>¶

SIGNED_1 = <X86_64_RELOCATION.SIGNED_1: 6>¶

SIGNED_2 = <X86_64_RELOCATION.SIGNED_2: 7>¶

SIGNED_4 = <X86_64_RELOCATION.SIGNED_4: 8>¶

SUBTRACTOR = <X86_64_RELOCATION.SUBTRACTOR: 5>¶

TLV = <X86_64_RELOCATION.TLV: 9>¶

UNSIGNED = <X86_64_RELOCATION.UNSIGNED: 0>¶

property name¶

property value¶

PPC_RELOCATION¶

class lief.MachO.PPC_RELOCATION(self: lief._lief.MachO.PPC_RELOCATION, value: int)¶

Members:

VANILLA

PAIR

BR14

BR24

HI16

LO16

HA16

LO14

SECTDIFF

PB_LA_PTR

HI16_SECTDIFF

LO16_SECTDIFF

HA16_SECTDIFF

JBSR

LO14_SECTDIFF

LOCAL_SECTDIFF

BR14 = <PPC_RELOCATION.BR14: 2>¶

BR24 = <PPC_RELOCATION.BR24: 3>¶

HA16 = <PPC_RELOCATION.HA16: 6>¶

HA16_SECTDIFF = <PPC_RELOCATION.HA16_SECTDIFF: 12>¶

HI16 = <PPC_RELOCATION.HI16: 4>¶

HI16_SECTDIFF = <PPC_RELOCATION.HI16_SECTDIFF: 10>¶

JBSR = <PPC_RELOCATION.JBSR: 13>¶

LO14 = <PPC_RELOCATION.LO14: 7>¶

LO14_SECTDIFF = <PPC_RELOCATION.LO14_SECTDIFF: 14>¶

LO16 = <PPC_RELOCATION.LO16: 5>¶

LO16_SECTDIFF = <PPC_RELOCATION.LO16_SECTDIFF: 11>¶

LOCAL_SECTDIFF = <PPC_RELOCATION.LOCAL_SECTDIFF: 15>¶

PAIR = <PPC_RELOCATION.PAIR: 1>¶

PB_LA_PTR = <PPC_RELOCATION.PB_LA_PTR: 9>¶

SECTDIFF = <PPC_RELOCATION.SECTDIFF: 8>¶

VANILLA = <PPC_RELOCATION.VANILLA: 0>¶

property name¶

property value¶

ARM_RELOCATION¶

class lief.MachO.ARM_RELOCATION(self: lief._lief.MachO.ARM_RELOCATION, value: int)¶

Members:

VANILLA

PAIR

SECTDIFF

LOCAL_SECTDIFF

PB_LA_PTR

BR24

THUMB_RELOC_BR22

THUMB_32BIT_BRANCH

HALF

HALF_SECTDIFF

BR24 = <ARM_RELOCATION.BR24: 5>¶

HALF = <ARM_RELOCATION.HALF: 8>¶

HALF_SECTDIFF = <ARM_RELOCATION.HALF_SECTDIFF: 9>¶

LOCAL_SECTDIFF = <ARM_RELOCATION.LOCAL_SECTDIFF: 3>¶

PAIR = <ARM_RELOCATION.PAIR: 1>¶

PB_LA_PTR = <ARM_RELOCATION.PB_LA_PTR: 4>¶

SECTDIFF = <ARM_RELOCATION.SECTDIFF: 2>¶

THUMB_32BIT_BRANCH = <ARM_RELOCATION.THUMB_32BIT_BRANCH: 7>¶

THUMB_RELOC_BR22 = <ARM_RELOCATION.THUMB_RELOC_BR22: 6>¶

VANILLA = <ARM_RELOCATION.VANILLA: 0>¶

property name¶

property value¶

ARM64_RELOCATION¶

class lief.MachO.ARM64_RELOCATION(self: lief._lief.MachO.ARM64_RELOCATION, value: int)¶

Members:

UNSIGNED

SUBTRACTOR

BRANCH26

PAGE21

PAGEOFF12

GOT_LOAD_PAGE21

GOT_LOAD_PAGEOFF12

POINTER_TO_GOT

TLVP_LOAD_PAGE21

TLVP_LOAD_PAGEOFF12

ADDEND

ADDEND = <ARM64_RELOCATION.ADDEND: 10>¶

BRANCH26 = <ARM64_RELOCATION.BRANCH26: 2>¶

GOT_LOAD_PAGE21 = <ARM64_RELOCATION.GOT_LOAD_PAGE21: 5>¶

GOT_LOAD_PAGEOFF12 = <ARM64_RELOCATION.GOT_LOAD_PAGEOFF12: 6>¶

PAGE21 = <ARM64_RELOCATION.PAGE21: 3>¶

PAGEOFF12 = <ARM64_RELOCATION.PAGEOFF12: 4>¶

POINTER_TO_GOT = <ARM64_RELOCATION.POINTER_TO_GOT: 7>¶

SUBTRACTOR = <ARM64_RELOCATION.SUBTRACTOR: 1>¶

TLVP_LOAD_PAGE21 = <ARM64_RELOCATION.TLVP_LOAD_PAGE21: 8>¶

TLVP_LOAD_PAGEOFF12 = <ARM64_RELOCATION.TLVP_LOAD_PAGEOFF12: 9>¶

UNSIGNED = <ARM64_RELOCATION.UNSIGNED: 0>¶

property name¶

property value¶

RELOCATION_ORIGINS¶

class lief.MachO.RELOCATION_ORIGINS(self: lief._lief.MachO.RELOCATION_ORIGINS, value: int)¶

Members:

UNKNOWN

DYLDINFO

RELOC_TABLE

CHAINED_FIXUPS

CHAINED_FIXUPS = <RELOCATION_ORIGINS.CHAINED_FIXUPS: 3>¶

DYLDINFO = <RELOCATION_ORIGINS.DYLDINFO: 1>¶

RELOC_TABLE = <RELOCATION_ORIGINS.RELOC_TABLE: 2>¶

UNKNOWN = <RELOCATION_ORIGINS.UNKNOWN: 0>¶

property name¶

property value¶

REBASE_TYPES¶

class lief.MachO.REBASE_TYPES(self: lief._lief.MachO.REBASE_TYPES, value: int)¶

Members:

POINTER

TEXT_ABSOLUTE32

TEXT_PCREL32

POINTER = <REBASE_TYPES.POINTER: 1>¶

TEXT_ABSOLUTE32 = <REBASE_TYPES.TEXT_ABSOLUTE32: 2>¶

TEXT_PCREL32 = <REBASE_TYPES.TEXT_PCREL32: 3>¶

property name¶

property value¶

BINDING_CLASS¶

class lief.MachO.BINDING_CLASS(self: lief._lief.MachO.BINDING_CLASS, value: int)¶

Members:

WEAK

LAZY

STANDARD

THREADED

LAZY = <BINDING_CLASS.LAZY: 2>¶

STANDARD = <BINDING_CLASS.STANDARD: 3>¶

THREADED = <BINDING_CLASS.THREADED: 100>¶

WEAK = <BINDING_CLASS.WEAK: 1>¶

property name¶

property value¶

REBASE_OPCODES¶

class lief.MachO.REBASE_OPCODES(self: lief._lief.MachO.REBASE_OPCODES, value: int)¶

Members:

DONE

SET_TYPE_IMM

SET_SEGMENT_AND_OFFSET_ULEB

ADD_ADDR_ULEB

ADD_ADDR_IMM_SCALED

DO_REBASE_IMM_TIMES

DO_REBASE_ULEB_TIMES

DO_REBASE_ADD_ADDR_ULEB

DO_REBASE_ULEB_TIMES_SKIPPING_ULEB

ADD_ADDR_IMM_SCALED = <REBASE_OPCODES.ADD_ADDR_IMM_SCALED: 64>¶

ADD_ADDR_ULEB = <REBASE_OPCODES.ADD_ADDR_ULEB: 48>¶

DONE = <REBASE_OPCODES.DONE: 0>¶

DO_REBASE_ADD_ADDR_ULEB = <REBASE_OPCODES.DO_REBASE_ADD_ADDR_ULEB: 112>¶

DO_REBASE_IMM_TIMES = <REBASE_OPCODES.DO_REBASE_IMM_TIMES: 80>¶

DO_REBASE_ULEB_TIMES = <REBASE_OPCODES.DO_REBASE_ULEB_TIMES: 96>¶

DO_REBASE_ULEB_TIMES_SKIPPING_ULEB = <REBASE_OPCODES.DO_REBASE_ULEB_TIMES_SKIPPING_ULEB: 128>¶

SET_SEGMENT_AND_OFFSET_ULEB = <REBASE_OPCODES.SET_SEGMENT_AND_OFFSET_ULEB: 32>¶

SET_TYPE_IMM = <REBASE_OPCODES.SET_TYPE_IMM: 16>¶

property name¶

property value¶

BIND_TYPES¶

class lief.MachO.BIND_TYPES(self: lief._lief.MachO.BIND_TYPES, value: int)¶

Members:

POINTER

TEXT_ABSOLUTE32

TEXT_PCREL32

POINTER = <BIND_TYPES.POINTER: 1>¶

TEXT_ABSOLUTE32 = <BIND_TYPES.TEXT_ABSOLUTE32: 2>¶

TEXT_PCREL32 = <BIND_TYPES.TEXT_PCREL32: 3>¶

property name¶

property value¶

BIND_SPECIAL_DYLIB¶

class lief.MachO.BIND_SPECIAL_DYLIB(self: lief._lief.MachO.BIND_SPECIAL_DYLIB, value: int)¶

Members:

SELF

MAIN_EXECUTABLE

FLAT_LOOKUP

FLAT_LOOKUP = <BIND_SPECIAL_DYLIB.FLAT_LOOKUP: -2>¶

MAIN_EXECUTABLE = <BIND_SPECIAL_DYLIB.MAIN_EXECUTABLE: -1>¶

SELF = <BIND_SPECIAL_DYLIB.SELF: 0>¶

property name¶

property value¶

BIND_OPCODES¶

class lief.MachO.BIND_OPCODES(self: lief._lief.MachO.BIND_OPCODES, value: int)¶

Members:

DONE

SET_DYLIB_ORDINAL_IMM

SET_DYLIB_ORDINAL_ULEB

SET_DYLIB_SPECIAL_IMM

SET_SYMBOL_TRAILING_FLAGS_IMM

SET_TYPE_IMM

SET_ADDEND_SLEB

SET_SEGMENT_AND_OFFSET_ULEB

ADD_ADDR_ULEB

DO_BIND

DO_BIND_ADD_ADDR_ULEB

DO_BIND_ADD_ADDR_IMM_SCALED

DO_BIND_ULEB_TIMES_SKIPPING_ULEB

THREADED

ADD_ADDR_ULEB = <BIND_OPCODES.ADD_ADDR_ULEB: 128>¶

DONE = <BIND_OPCODES.DONE: 0>¶

DO_BIND = <BIND_OPCODES.DO_BIND: 144>¶

DO_BIND_ADD_ADDR_IMM_SCALED = <BIND_OPCODES.DO_BIND_ADD_ADDR_IMM_SCALED: 176>¶

DO_BIND_ADD_ADDR_ULEB = <BIND_OPCODES.DO_BIND_ADD_ADDR_ULEB: 160>¶

DO_BIND_ULEB_TIMES_SKIPPING_ULEB = <BIND_OPCODES.DO_BIND_ULEB_TIMES_SKIPPING_ULEB: 192>¶

SET_ADDEND_SLEB = <BIND_OPCODES.SET_ADDEND_SLEB: 96>¶

SET_DYLIB_ORDINAL_IMM = <BIND_OPCODES.SET_DYLIB_ORDINAL_IMM: 16>¶

SET_DYLIB_ORDINAL_ULEB = <BIND_OPCODES.SET_DYLIB_ORDINAL_ULEB: 32>¶

SET_DYLIB_SPECIAL_IMM = <BIND_OPCODES.SET_DYLIB_SPECIAL_IMM: 48>¶

SET_SEGMENT_AND_OFFSET_ULEB = <BIND_OPCODES.SET_SEGMENT_AND_OFFSET_ULEB: 112>¶

SET_SYMBOL_TRAILING_FLAGS_IMM = <BIND_OPCODES.SET_SYMBOL_TRAILING_FLAGS_IMM: 64>¶

SET_TYPE_IMM = <BIND_OPCODES.SET_TYPE_IMM: 80>¶

THREADED = <BIND_OPCODES.THREADED: 208>¶

property name¶

property value¶

EXPORT_SYMBOL_KINDS¶

class lief.MachO.EXPORT_SYMBOL_KINDS(self: lief._lief.MachO.EXPORT_SYMBOL_KINDS, value: int)¶

Members:

REGULAR

THREAD_LOCAL

ABSOLUTE

ABSOLUTE = <EXPORT_SYMBOL_KINDS.ABSOLUTE: 2>¶

REGULAR = <EXPORT_SYMBOL_KINDS.REGULAR: 0>¶

THREAD_LOCAL = <EXPORT_SYMBOL_KINDS.THREAD_LOCAL: 1>¶

property name¶

property value¶

EXPORT_SYMBOL_FLAGS¶

class lief.MachO.EXPORT_SYMBOL_FLAGS(self: lief._lief.MachO.EXPORT_SYMBOL_FLAGS, value: int)¶

Members:

WEAK_DEFINITION

REEXPORT

STUB_AND_RESOLVER

REEXPORT = <EXPORT_SYMBOL_FLAGS.REEXPORT: 8>¶

STUB_AND_RESOLVER = <EXPORT_SYMBOL_FLAGS.STUB_AND_RESOLVER: 16>¶

WEAK_DEFINITION = <EXPORT_SYMBOL_FLAGS.WEAK_DEFINITION: 4>¶

property name¶

property value¶

VM_PROTECTIONS¶

class lief.MachO.VM_PROTECTIONS(self: lief._lief.MachO.VM_PROTECTIONS, value: int)¶

Members:

READ

WRITE

EXECUTE

EXECUTE = <VM_PROTECTIONS.EXECUTE: 4>¶

READ = <VM_PROTECTIONS.READ: 1>¶

WRITE = <VM_PROTECTIONS.WRITE: 2>¶

property name¶

property value¶

SYMBOL_ORIGINS¶

class lief.MachO.SYMBOL_ORIGINS(self: lief._lief.MachO.SYMBOL_ORIGINS, value: int)¶

Members:

UNKNOWN

DYLD_EXPORT

LC_SYMTAB

DYLD_EXPORT = <SYMBOL_ORIGINS.DYLD_EXPORT: 1>¶

LC_SYMTAB = <SYMBOL_ORIGINS.LC_SYMTAB: 3>¶

UNKNOWN = <SYMBOL_ORIGINS.UNKNOWN: 0>¶

property name¶

property value¶

SECTION_FLAGS¶

class lief.MachO.SECTION_FLAGS(self: lief._lief.MachO.SECTION_FLAGS, value: int)¶

Members:

PURE_INSTRUCTIONS

NO_TOC

STRIP_STATIC_SYMS

NO_DEAD_STRIP

LIVE_SUPPORT

SELF_MODIFYING_CODE

DEBUG

SOME_INSTRUCTIONS

EXT_RELOC

LOC_RELOC

DEBUG = <SECTION_FLAGS.DEBUG: 33554432>¶

EXT_RELOC = <SECTION_FLAGS.EXT_RELOC: 512>¶

LIVE_SUPPORT = <SECTION_FLAGS.LIVE_SUPPORT: 134217728>¶

LOC_RELOC = <SECTION_FLAGS.LOC_RELOC: 256>¶

NO_DEAD_STRIP = <SECTION_FLAGS.NO_DEAD_STRIP: 268435456>¶

NO_TOC = <SECTION_FLAGS.NO_TOC: 1073741824>¶

PURE_INSTRUCTIONS = <SECTION_FLAGS.PURE_INSTRUCTIONS: 2147483648>¶

SELF_MODIFYING_CODE = <SECTION_FLAGS.SELF_MODIFYING_CODE: 67108864>¶

SOME_INSTRUCTIONS = <SECTION_FLAGS.SOME_INSTRUCTIONS: 1024>¶

STRIP_STATIC_SYMS = <SECTION_FLAGS.STRIP_STATIC_SYMS: 536870912>¶

property name¶

property value¶

DYLD_CHAINED_FORMAT¶

class lief.MachO.DYLD_CHAINED_FORMAT(self: lief._lief.MachO.DYLD_CHAINED_FORMAT, value: int)¶

Members:

IMPORT

IMPORT_ADDEND

IMPORT_ADDEND64

IMPORT = <DYLD_CHAINED_FORMAT.IMPORT: 1>¶

IMPORT_ADDEND = <DYLD_CHAINED_FORMAT.IMPORT_ADDEND: 2>¶

IMPORT_ADDEND64 = <DYLD_CHAINED_FORMAT.IMPORT_ADDEND64: 3>¶

property name¶

property value¶

DYLD_CHAINED_PTR_FORMAT¶

class lief.MachO.DYLD_CHAINED_PTR_FORMAT(self: lief._lief.MachO.DYLD_CHAINED_PTR_FORMAT, value: int)¶

Members:

PTR_ARM64E

PTR_64

PTR_32

PTR_32_CACHE

PTR_32_FIRMWARE

PTR_64_OFFSET

PTR_ARM64E_KERNEL

PTR_64_KERNEL_CACHE

PTR_ARM64E_USERLAND

PTR_ARM64E_FIRMWARE

PTR_X86_64_KERNEL_CACHE

PTR_ARM64E_USERLAND24

PTR_32 = <DYLD_CHAINED_PTR_FORMAT.PTR_32: 3>¶

PTR_32_CACHE = <DYLD_CHAINED_PTR_FORMAT.PTR_32_CACHE: 4>¶

PTR_32_FIRMWARE = <DYLD_CHAINED_PTR_FORMAT.PTR_32_FIRMWARE: 5>¶

PTR_64 = <DYLD_CHAINED_PTR_FORMAT.PTR_64: 2>¶

PTR_64_KERNEL_CACHE = <DYLD_CHAINED_PTR_FORMAT.PTR_64_KERNEL_CACHE: 8>¶

PTR_64_OFFSET = <DYLD_CHAINED_PTR_FORMAT.PTR_64_OFFSET: 6>¶

PTR_ARM64E = <DYLD_CHAINED_PTR_FORMAT.PTR_ARM64E: 1>¶

PTR_ARM64E_FIRMWARE = <DYLD_CHAINED_PTR_FORMAT.PTR_ARM64E_FIRMWARE: 10>¶

PTR_ARM64E_KERNEL = <DYLD_CHAINED_PTR_FORMAT.PTR_ARM64E_KERNEL: 7>¶

PTR_ARM64E_USERLAND = <DYLD_CHAINED_PTR_FORMAT.PTR_ARM64E_USERLAND: 9>¶

PTR_ARM64E_USERLAND24 = <DYLD_CHAINED_PTR_FORMAT.PTR_ARM64E_USERLAND24: 12>¶

PTR_X86_64_KERNEL_CACHE = <DYLD_CHAINED_PTR_FORMAT.PTR_X86_64_KERNEL_CACHE: 11>¶

property name¶

property value¶

MachO¶

Parser¶

FatBinary¶

Binary¶

Header¶

Section¶

SegmentCommand¶

LoadCommand¶

DylibCommand¶

DylinkerCommand¶

UUIDCommand¶

MainCommand¶

Symbol¶

Symbol Command¶

Dynamic Symbol Command¶

Dyld Info¶

Function starts¶

Source Version¶

Version Min¶

Relocation¶

Relocation Object¶

Relocation Dyld¶

Relocation Fixup¶

Binding Info¶

Dyld Binding Info¶

Chained Binding Info¶

Export Info¶

Thread Command¶

RPath Command¶

Code Signature¶

Data In Code¶

Data Code Entry¶

Segment Split Info¶

Sub Framework¶

Dyld Environment¶

Encryption Info¶

Build Version¶

Build Tool Version¶

Fileset Command¶

DyldChainedFixups Command¶

DyldExportsTrie Command¶

Code Signature Dir Command¶

Two Level Hints¶

Linker Optimization Hint¶

Builder¶

Enums¶

CPU_TYPES¶

FILE_TYPES¶

HEADER_FLAGS¶

LOAD_COMMAND_TYPES¶

SECTION_TYPES¶

MACHO_TYPES¶

X86_RELOCATION¶

X86_64_RELOCATION¶

PPC_RELOCATION¶

ARM_RELOCATION¶

ARM64_RELOCATION¶

RELOCATION_ORIGINS¶

REBASE_TYPES¶

BINDING_CLASS¶

REBASE_OPCODES¶

BIND_TYPES¶

BIND_SPECIAL_DYLIB¶

BIND_OPCODES¶

EXPORT_SYMBOL_KINDS¶

EXPORT_SYMBOL_FLAGS¶

VM_PROTECTIONS¶

SYMBOL_ORIGINS¶

SECTION_FLAGS¶

DYLD_CHAINED_FORMAT¶

DYLD_CHAINED_PTR_FORMAT¶