MachO

Parser

lief.MachO.parse(*args, **kwargs)

Overloaded function.

  1. parse(filename: str, config: lief._lief.MachO.ParserConfig = <lief._lief.MachO.ParserConfig object at 0x7f3b90316e30>) -> LIEF::MachO::FatBinary

    Parse the given binary and return a FatBinary object

    One can configure the parsing with the config parameter. See ParserConfig,

  2. parse(raw: List[int], name: str = ‘’, config: lief._lief.MachO.ParserConfig = <lief._lief.MachO.ParserConfig object at 0x7f3b903aa470>) -> LIEF::MachO::FatBinary

    Parse the given binary (from raw bytes) and return a FatBinary object

    One can configure the parsing with the config parameter. See ParserConfig

  3. parse(io: object, name: str = ‘’, config: lief._lief.MachO.ParserConfig = <lief._lief.MachO.ParserConfig object at 0x7f3b9032f1b0>) -> object

    Parse the given binary from a Python IO interface and return a FatBinary object

    One can configure the parsing with the config parameter. See ParserConfig

class lief.MachO.ParserConfig(self: lief._lief.MachO.ParserConfig)

This class is used to tweak the MachO Parser (Parser)

deep = <lief._lief.MachO.ParserConfig object>
property fix_from_memory

When parsing Mach-O from memory, this option can be used to undo relocations and symbols bindings.

When activated, this option requires parse_dyld_bindings and parse_dyld_rebases to be enabled.

full_dyldinfo(self: lief._lief.MachO.ParserConfig, flag: bool) lief._lief.MachO.ParserConfig

If flag is set to true, Exports, Bindings and Rebases opcodes are parsed.

Warning

Enabling this flag can slow down the parsing

property parse_dyld_bindings

Parse the Dyld binding opcodes

property parse_dyld_exports

Parse the Dyld export trie

property parse_dyld_rebases

Parse the Dyld rebase opcodes

quick = <lief._lief.MachO.ParserConfig object>
fatbinary_1 = lief.MachO.parse("/usr/bin/ls", config=lief.MachO.ParserConfig.deep)
# or
fatbinary_2 = lief.MachO.parse("/usr/bin/ls", config=lief.MachO.ParserConfig.quick)

FatBinary

class lief.MachO.FatBinary

Class which represent a Mach-O (fat) binary This object is also used for representing Mach-O binaries that are NOT FAT

at(self: lief._lief.MachO.FatBinary, index: int) LIEF::MachO::Binary

Return the Binary at the given index or None if it is not present

class it_binaries
raw(self: lief._lief.MachO.FatBinary) List[int]

Build a Mach-O universal binary and return its bytes

property size

Number of Binary registred

take(self: lief._lief.MachO.FatBinary, cpu: lief._lief.MachO.CPU_TYPES) LIEF::MachO::Binary

Return the Binary that matches the given CPU_TYPES

write(self: lief._lief.MachO.FatBinary, filename: str) None

Build a Mach-O universal binary


Binary

class lief.MachO.Binary

Class which represents a MachO binary

class VA_TYPES(self: lief._lief.Binary.VA_TYPES, value: int)

Members:

AUTO

VA

RVA

AUTO = <VA_TYPES.AUTO: 0>
RVA = <VA_TYPES.RVA: 1>
VA = <VA_TYPES.VA: 2>
property name
property value
property abstract

Return the abstract representation of the current binary (lief.Binary)

Warning

Getting this property modifies the __class__ attribute such as the current binary looks like a lief.Binary.

To get back to the original binary, one needs to access lief.Binary.concrete

add(*args, **kwargs)

Overloaded function.

  1. add(self: lief._lief.MachO.Binary, dylib_command: LIEF::MachO::DylibCommand) -> LIEF::MachO::LoadCommand

Add a new DylibCommand

  1. add(self: lief._lief.MachO.Binary, segment: LIEF::MachO::SegmentCommand) -> LIEF::MachO::LoadCommand

Add a new SegmentCommand

  1. add(self: lief._lief.MachO.Binary, load_command: LIEF::MachO::LoadCommand) -> LIEF::MachO::LoadCommand

Add a new LoadCommand

  1. add(self: lief._lief.MachO.Binary, load_command: LIEF::MachO::LoadCommand, index: int) -> LIEF::MachO::LoadCommand

Add a new LoadCommand at index

add_exported_function(self: lief._lief.MachO.Binary, address: int, name: str) LIEF::MachO::ExportInfo

Add a new export in the binary

add_library(self: lief._lief.MachO.Binary, library_name: str) LIEF::MachO::LoadCommand

Add a new library dependency

add_local_symbol(self: lief._lief.MachO.Binary, address: int, name: str) LIEF::MachO::Symbol

Add a new a new symbol in the LC_SYMTAB

add_section(*args, **kwargs)

Overloaded function.

  1. add_section(self: lief._lief.MachO.Binary, segment: LIEF::MachO::SegmentCommand, section: LIEF::MachO::Section) -> LIEF::MachO::Section

Add a new Section in the given SegmentCommand

  1. add_section(self: lief._lief.MachO.Binary, section: LIEF::MachO::Section) -> LIEF::MachO::Section

Add a new Section within the __TEXT segment

  1. add_section(self: lief._lief.MachO.Binary, section: LIEF::MachO::SegmentCommand, section: LIEF::MachO::Section) -> LIEF::MachO::Section

Add a new Section in the given SegmentCommand

property build_version

Return the binary’s BuildVersion if any, or None

can_remove(self: lief._lief.MachO.Binary, symbol: LIEF::MachO::Symbol) bool

Check if the given symbol can be safely removed.

can_remove_symbol(self: lief._lief.MachO.Binary, symbol_name: str) bool

Check if the given symbol name can be safely removed.

property code_signature

Return the binary’s CodeSignature if any, or None

property code_signature_dir

Return the binary’s CodeSignatureDir if any, or None

property commands

Return an iterator over the binary’s Command

property concrete

The concrete representation of the binary. Basically, this property cast a lief.Binary into a lief.PE.Binary, lief.ELF.Binary or lief.MachO.Binary.

See also: lief.Binary.abstract

property ctor_functions

Constructor functions that are called prior to any other functions

property data_in_code

Return the binary’s DataInCode if any, or None

property dyld_chained_fixups

Return the binary’s DyldChainedFixups if any, or None

property dyld_environment

Return the binary’s DyldEnvironment if any, or None

property dyld_exports_trie

Return the binary’s DyldExportsTrie if any, or None

property dyld_info

Return the binary’s DyldInfo if any, or None

property dylinker

Return the binary’s DylinkerCommand if any, or None

property dynamic_symbol_command

Return the binary’s DynamicSymbolCommand if any, or None

property encryption_info

Return the binary’s EncryptionInfo if any, or None

property entrypoint

Binary’s entrypoint

property exported_functions

Return the binary’s exported Function

property exported_symbols

Return the binary’s Symbol which are exported

extend(self: lief._lief.MachO.Binary, load_command: LIEF::MachO::LoadCommand, size: int) bool

Extend a LoadCommand by size

extend_segment(self: lief._lief.MachO.Binary, segment_command: LIEF::MachO::SegmentCommand, size: int) bool

Extend the content of the given SegmentCommand by size

property fat_offset

Return binary’s fat offset. 0 if not relevant.

property filesets

Return binary’s Filesets

property format

File format EXE_FORMATS of the underlying binary.

property function_starts

Return the binary’s FunctionStarts if any, or None

property functions

Return list of all Function found

get(self: lief._lief.MachO.Binary, type: lief._lief.MachO.LOAD_COMMAND_TYPES) LIEF::MachO::LoadCommand

Return the first LoadCommand having the given LOAD_COMMAND_TYPES or None if it is not present.

get_content_from_virtual_address(self: lief._lief.Binary, virtual_address: int, size: int, va_type: lief._lief.Binary.VA_TYPES = <VA_TYPES.AUTO: 0>) memoryview

Return the content located at the provided virtual address. The virtual address is specified in the first argument and size to read (in bytes) in the second.

If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default, it is set to AUTO.

get_function_address(self: lief._lief.Binary, function_name: str) object

Return the address of the given function name

get_section(*args, **kwargs)

Overloaded function.

  1. get_section(self: lief._lief.MachO.Binary, name: str) -> LIEF::MachO::Section

Return the section from the given name or None if the section does not exist

  1. get_section(self: lief._lief.MachO.Binary, segname: str, secname: str) -> LIEF::MachO::Section

    Return the section from the segment with the name given in the first parameter and with the section’s name provided in the second parameter. If the section cannot be found, it returns a nullptr

get_segment(self: lief._lief.MachO.Binary, name: str) LIEF::MachO::SegmentCommand

Return the SegmentCommand from the given name

get_symbol(self: lief._lief.MachO.Binary, name: str) LIEF::MachO::Symbol

Return the Symbol from the given name

has(self: lief._lief.MachO.Binary, type: lief._lief.MachO.LOAD_COMMAND_TYPES) bool

Check if the current binary has a LoadCommand with the given LOAD_COMMAND_TYPES

property has_build_version

True if the binary has a BuildVersion command

property has_code_signature

True if the binary is signed (i.e. has a CodeSignature command)

property has_code_signature_dir

True if the binary is signed (i.e. has a CodeSignatureDir command) with the command LC_DYLIB_CODE_SIGN_DRS

property has_data_in_code

True if the binary has a DataInCode command

property has_dyld_chained_fixups

True if the binary has a DyldChainedFixups command

property has_dyld_environment

True if the binary has a DyldEnvironment command

property has_dyld_exports_trie

True if the binary has a DyldExportsTrie command

property has_dyld_info

True if the binary has a DyldInfo command.

property has_dylinker

True if the binary has a DylinkerCommand command.

property has_dynamic_symbol_command

True if the binary has a DynamicSymbolCommand command.

property has_encryption_info

True if the binary has a EncryptionInfo command

property has_entrypoint

True if the binary has an entrypoint.

Basically for libraries it will return false

property has_filesets

Return True if the binary has filesets

property has_function_starts

True if the binary has a FunctionStarts command.

property has_linker_opt_hint

True if the binary embeds the Linker optimization hint command (LinkerOptHint)

property has_main_command

True if the binary has a MainCommand command.

property has_nx

Check if the binary has NX protection (non executable stack)

property has_rpath

True if the binary has a RPathCommand command.

has_section(self: lief._lief.MachO.Binary, name: str) bool

Check if a section with the given name exists

has_segment(self: lief._lief.MachO.Binary, name: str) bool

Check if a SegmentCommand with the given name exists

property has_segment_split_info

True if the binary has a SegmentSplitInfo command

property has_source_version

True if the binary has a SourceVersion command.

property has_sub_framework

True if the binary has a SubFramework command

has_symbol(self: lief._lief.MachO.Binary, name: str) bool

Check if a Symbol with the given name exists

property has_symbol_command

True if the binary has a SymbolCommand command.

property has_thread_command

True if the binary has a ThreadCommand command.

property has_two_level_hints

True if the binary embeds the Two Level Hint command (TwoLevelHints)

property has_uuid

True if the binary has a UUIDCommand command.

property has_version_min

True if the binary has a VersionMin command.

property header

Return binary’s Header

property imagebase

Return the binary’s imagebase which is the base address where segments are mapped (without the ASLR). 0 if not relevant.

property imported_functions

Return the binary’s imported Function (name)

property imported_symbols

Return the binary’s Symbol which are imported

property is_pie

Check if the binary is position independent

is_valid_addr(self: lief._lief.MachO.Binary, address: int) bool

Check if the given address is encompassed between the range of virtual addresses.

See: va_ranges

class it_commands
class it_filter_symbols
class it_libraries
class it_relocations
class it_sections
class it_segments
class it_symbols
property libraries

Return an iterator over the binary’s DylibCommand

property linker_opt_hint

Return the binary’s LinkerOptHint if any, or None

property main_command

Return the binary’s MainCommand if any, or None

property name

Binary’s name

property off_ranges

Return the range of offsets as a tuple (off_start, off_end)

offset_to_virtual_address(self: lief._lief.Binary, offset: int, slide: int = 0) object

Convert an offset into a virtual address.

property page_size

Return the binary’s page size

patch_address(*args, **kwargs)

Overloaded function.

  1. patch_address(self: lief._lief.Binary, address: int, patch_value: List[int], va_type: lief._lief.Binary.VA_TYPES = <VA_TYPES.AUTO: 0>) -> None

    Patch the address with the given list of bytes. The virtual address is specified in the first argument and the content in the second (as a list of bytes).

    If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default, it is set to AUTO.

  2. patch_address(self: lief._lief.Binary, address: int, patch_value: int, size: int = 8, va_type: lief._lief.Binary.VA_TYPES = <VA_TYPES.AUTO: 0>) -> None

    Patch the address with the given integer value. The virtual address is specified in the first argument, the integer in the second and the integer’s size of in third one.

    If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default, it is set to AUTO.

class range_t
property end
property start
property relocations

Return an iterator over binary’s Relocation

remove(*args, **kwargs)

Overloaded function.

  1. remove(self: lief._lief.MachO.Binary, load_command: LIEF::MachO::LoadCommand) -> bool

Remove a LoadCommand

  1. remove(self: lief._lief.MachO.Binary, type: lief._lief.MachO.LOAD_COMMAND_TYPES) -> bool

Remove all the LoadCommand having the given LOAD_COMMAND_TYPES

  1. remove(self: lief._lief.MachO.Binary, symbol: LIEF::MachO::Symbol) -> bool

Remove the given Symbol

remove_command(self: lief._lief.MachO.Binary, index: int) bool

Remove the LoadCommand at the given index

remove_section(*args, **kwargs)

Overloaded function.

  1. remove_section(self: lief._lief.MachO.Binary, name: str, clear: bool = False) -> None

Remove the section with the given name

  1. remove_section(self: lief._lief.MachO.Binary, segname: str, secname: str, clear: bool = False) -> None

    Remove the section from the segment with the name given in the first parameter and with the section’s name provided in the second parameter.

remove_signature(self: lief._lief.MachO.Binary) bool

Remove the CodeSignature (if any)

remove_symbol(self: lief._lief.MachO.Binary, name: str) bool

Remove all symbol(s) with the given name

property rpath

Return the binary’s RPathCommand if any, or None

section_from_offset(self: lief._lief.MachO.Binary, arg0: int) LIEF::MachO::Section

Return the Section which encompasses the offset

section_from_virtual_address(self: lief._lief.MachO.Binary, arg0: int) LIEF::MachO::Section

Return the Section which encompasses the virtual address

property sections

Return an iterator over the binary’s Section

segment_from_offset(self: lief._lief.MachO.Binary, arg0: int) LIEF::MachO::SegmentCommand

Return the SegmentCommand which encompasses the offset

segment_from_virtual_address(self: lief._lief.MachO.Binary, arg0: int) LIEF::MachO::SegmentCommand

Return the SegmentCommand which encompasses the virtual address

property segment_split_info

Return the binary’s SegmentSplitInfo if any, or None

property segments

Return an iterator over the binary’s SegmentCommand

shift(self: lief._lief.MachO.Binary, value: int) object

Shift the content located right after the Load commands table. This operation can be used to add a new command

shift_linkedit(self: lief._lief.MachO.Binary, value: int) object

Shift the position on the __LINKEDIT data by width

property source_version

Return the binary’s SourceVersion if any, or None

property sub_framework

Return the binary’s SubFramework if any, or None

property symbol_command

Return the binary’s SymbolCommand if any, or None

property symbols

Return an iterator over the binary’s Symbol

property thread_command

Return the binary’s ThreadCommand if any, or None

property two_level_hints

Return the binary’s TwoLevelHints if any, or None

unexport(*args, **kwargs)

Overloaded function.

  1. unexport(self: lief._lief.MachO.Binary, name: str) -> bool

Remove the symbol from the export table

  1. unexport(self: lief._lief.MachO.Binary, symbol: LIEF::MachO::Symbol) -> bool

Remove the symbol from the export table

property unwind_functions

Return list of Function found in the __unwind_info section

property uuid

Return the binary’s UUIDCommand if any, or None

property va_ranges

Return the range of virtual addresses as a tuple (va_start, va_end)

property version_min

Return the binary’s VersionMin if any, or None

virtual_address_to_offset(self: lief._lief.MachO.Binary, virtual_address: int) object

Convert the virtual address to an offset in the binary

property virtual_size

Binary’s memory size when mapped

write(self: lief._lief.MachO.Binary, output: str) None

Rebuild the binary and write and write its content if the file given in parameter

xref(self: lief._lief.Binary, virtual_address: int) List[int]

Return all virtual addresses that use the address given in parameter



Section

class lief.MachO.Section(*args, **kwargs)

Class that represents a Mach-O section

Overloaded function.

  1. __init__(self: lief._lief.MachO.Section) -> None

  2. __init__(self: lief._lief.MachO.Section, section_name: str) -> None

Constructor from a section’s name

  1. __init__(self: lief._lief.MachO.Section, section_name: str, content: List[int]) -> None

Constructor from a section’s name and its content

add(self: lief._lief.MachO.Section, flag: lief._lief.MachO.SECTION_FLAGS) None

Add the given SECTION_FLAGS

property alignment

Section’s alignment as a power of 2

property content

Section’s content

property entropy

Section’s entropy

property flags

Section’s flags masked with SECTION_FLAGS_MASK (see: MACHO_SECTION_FLAGS)

property flags_list
property fullname

Return the fullname of the section including the trailing bytes

has(self: lief._lief.MachO.Section, flag: lief._lief.MachO.SECTION_FLAGS) bool

Check if the section has the given SECTION_FLAGS

property has_segment

True if the current section has a segment associated with

property name

Section’s name

property numberof_relocations

Number of relocations associated with this section

property offset

Section’s file offset

property relocation_offset

Offset of the relocation table. This value should be 0 for executable and libraries as the relocations are managed by the lief.MachO.DyldInfo.rebase

Other the other hand, for object files (.o) this value should not be 0

property relocations

Iterator over the Relocation (if any)

remove(self: lief._lief.MachO.Section, flag: lief._lief.MachO.SECTION_FLAGS) None

Remove the given SECTION_FLAGS

property reserved1

According to the official loader.h file, this value is reserved for offset or index

property reserved2

According to the official loader.h file, this value is reserved for offset or index

property reserved3

According to the official loader.h file, this value is reserved for offset or index

search(*args, **kwargs)

Overloaded function.

  1. search(self: lief._lief.Section, number: int, pos: int = 0, size: int = 0) -> int

Look for integer within the current section

  1. search(self: lief._lief.Section, str: str, pos: int = 0) -> int

Look for string within the current section

search_all(*args, **kwargs)

Overloaded function.

  1. search_all(self: lief._lief.Section, number: int, size: int = 0) -> List[int]

Look for all integers within the current section

  1. search_all(self: lief._lief.Section, str: str) -> List[int]

Look for all strings within the current section

property segment

SegmentCommand associated with the section or None if not present

property segment_name

The segment name associated with the section

property size

Section’s size

property type

Type of the section. This value can help to determine the purpose of the section (c.f. MACHO_SECTION_TYPES)

property virtual_address

Section’s virtual address


SegmentCommand

class lief.MachO.SegmentCommand(*args, **kwargs)

Class which represents a LOAD_COMMAND_TYPES::LC_SEGMENT / LOAD_COMMAND_TYPES::LC_SEGMENT_64 command

Overloaded function.

  1. __init__(self: lief._lief.MachO.SegmentCommand) -> None

  2. __init__(self: lief._lief.MachO.SegmentCommand, arg0: str) -> None

  3. __init__(self: lief._lief.MachO.SegmentCommand, arg0: str, arg1: List[int]) -> None

add_section(self: lief._lief.MachO.SegmentCommand, section: LIEF::MachO::Section) LIEF::MachO::Section
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property content

Segment’s content

property data

Command’s data

property file_offset

Segment’s file offset

property file_size

Segment’s file size

property flags

Segment’s flags

get_section(self: lief._lief.MachO.SegmentCommand, name: str) LIEF::MachO::Section

Get the Section with the given name

has(self: lief._lief.MachO.SegmentCommand, section: LIEF::MachO::Section) bool

Check if the given Section belongs to the current segment

has_section(self: lief._lief.MachO.SegmentCommand, section_name: str) bool

Check if the given section name belongs to the current segment

property index

Relative index of the segment in the segment table

property init_protection

Segment’s initial protection

class it_relocations
class it_sections
property max_protection

Segment’s max protection

property name

Segment’s name

property numberof_sections

Number of sections in this segment

property relocations

Segment’s relocations

property sections

Segment’s sections

property size

Size of the command (should be greather than sizeof(load_command))

property virtual_address

Segment’s virtual address

property virtual_size

Segment’s virtual size


LoadCommand

class lief.MachO.LoadCommand(self: lief._lief.MachO.LoadCommand)

Based class for the Mach-O load commands

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property size

Size of the command (should be greather than sizeof(load_command))


DylibCommand

class lief.MachO.DylibCommand

Class which represents a library dependency

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property compatibility_version

Library’s compatibility version

property current_version

Library’s current version

property data

Command’s data

static id_dylib(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) lief._lief.MachO.DylibCommand

Factory function to generate a ID_DYLIB library

static lazy_load_dylib(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) lief._lief.MachO.DylibCommand

Factory function to generate a LAZY_LOAD_DYLIB library

static load_dylib(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) lief._lief.MachO.DylibCommand

Factory function to generate a LOAD_DYLIB library

static load_upward_dylib(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) lief._lief.MachO.DylibCommand

Factory function to generate a LOAD_UPWARD_DYLIB library

property name

Library’s name

static reexport_dylib(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) lief._lief.MachO.DylibCommand

Factory function to generate a REEXPORT_DYLIB library

property size

Size of the command (should be greather than sizeof(load_command))

property timestamp

Library’s timestamp

static weak_lib(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) lief._lief.MachO.DylibCommand

Factory function to generate a LOAD_WEAK_DYLIB library


DylinkerCommand

class lief.MachO.DylinkerCommand

Class that represents the Mach-O linker, also named loader Most of the time, name returns /usr/lib/dyld

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property name

Path to the loader/linker

property size

Size of the command (should be greather than sizeof(load_command))


UUIDCommand

class lief.MachO.UUIDCommand

Class that represents the UUID command

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property size

Size of the command (should be greather than sizeof(load_command))

property uuid

UUID as a list


MainCommand

class lief.MachO.MainCommand

Class that represent the LC_MAIN command. This kind of command can be used to determine the entrypoint of an executable

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property entrypoint

Offset of the main function relative to the __TEXT segment

property size

Size of the command (should be greather than sizeof(load_command))

property stack_size

The initial stack size (if not 0)


Symbol

class lief.MachO.Symbol(self: lief._lief.MachO.Symbol)

Class that represents a Symbol in a Mach-O file.

A Mach-O symbol can come from:

  1. The symbols command (LC_SYMTAB / SymbolCommand)

  2. The Dyld Export trie

  3. The Dyld Symbol bindings

class TOOLS(self: lief._lief.MachO.Symbol.TOOLS, value: int)

Members:

NONE

LOCAL

EXTERNAL

UNDEFINED

INDIRECT_ABS

INDIRECT_LOCAL

EXTERNAL = <TOOLS.EXTERNAL: 2>
INDIRECT_ABS = <TOOLS.INDIRECT_ABS: 4>
INDIRECT_LOCAL = <TOOLS.INDIRECT_LOCAL: 5>
LOCAL = <TOOLS.LOCAL: 1>
NONE = <TOOLS.NONE: 0>
UNDEFINED = <TOOLS.UNDEFINED: 3>
property name
property value
property binding_info

BindingInfo associated with the symbol if any, or None

property demangled_name

Symbol’s unmangled name

property description

Return information about the symbol (SYMBOL_DESCRIPTIONS)

property export_info

ExportInfo associated with the symbol if any, or None

property has_binding_info

True if the symbol has an BindingInfo associated with

property has_export_info

True if the symbol has an ExportInfo associated with

property name

Symbol’s name

property numberof_sections

It returns the number of sections in which this symbol can be found. If the symbol can’t be found in any section, it returns 0 (NO_SECT)

property origin

Return the SYMBOL_ORIGINS of this symbol

property size

Symbol’s size

property type
property value

Symbol’s value


Symbol Command

class lief.MachO.SymbolCommand(self: lief._lief.MachO.SymbolCommand)

Class that represents the LC_SYMTAB command

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property numberof_symbols

Number of symbols registered

property size

Size of the command (should be greather than sizeof(load_command))

property strings_offset

Offset from the start of the file to the string table

property strings_size

Size of the size string table

property symbol_offset

Offset from the start of the file to the n_list associated with the command


Dynamic Symbol Command

class lief.MachO.DynamicSymbolCommand

Class that represents the LC_DYSYMTAB command. This command completes the LC_SYMTAB (SymbolCommand) to provide a better granularity over the symbols layout.

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property external_reference_symbol_offset

Byte offset from the start of the file to the external reference table data. This field seems unused by recent Mach-O loader and should be set to 0

property external_relocation_offset

Byte offset from the start of the file to the module table data. This field seems unused by recent Mach-O loader and should be set to 0

property idx_external_define_symbol

Index of the first symbol in the group of defined external symbols.

property idx_local_symbol

Index of the first symbol in the group of local symbols.

property idx_undefined_symbol

Index of the first symbol in the group of undefined external symbols.

property indirect_symbol_offset

Byte offset from the start of the file to the indirect symbol table data.

Indirect symbol table is used by the loader to speed-up symbol resolution during the lazy binding process

References:

  • dyld-519.2.1/src/ImageLoaderMachOCompressed.cpp

  • dyld-519.2.1/src/ImageLoaderMachOClassic.cpp

property local_relocation_offset

Byte offset from the start of the file to the local relocation table data. This field seems unused by recent Mach-O loader and should be set to 0

property module_table_offset

Byte offset from the start of the file to the module table data. This field seems unused by recent Mach-O loader and should be set to 0

property nb_external_define_symbols

Number of symbols in the group of defined external symbols.

property nb_external_reference_symbols

Number of entries in the external reference table. This field seems unused by recent Mach-O loader and should be set to 0.

property nb_external_relocations

Number of entries in the external relocation table. This field seems unused by recent Mach-O loader and should be set to 0

property nb_indirect_symbols

Number of entries in the indirect symbol table.

property nb_local_relocations

Number of entries in the local relocation table. This field seems unused by recent Mach-O loader and should be set to 0

property nb_local_symbols

Number of symbols in the group of local symbols.

property nb_module_table

Number of entries in the module table. This field seems unused by recent Mach-O loader and should be set to 0.

property nb_toc

Number of entries in the table of contents Should be set to 0 on recent Mach-O

property nb_undefined_symbols

Number of symbols in the group of undefined external symbols.

property size

Size of the command (should be greather than sizeof(load_command))

property toc_offset

Byte offset from the start of the file to the table of contents data. Table of content is used by legacy Mach-O loader and this field should be set to 0


Dyld Info

class lief.MachO.DyldInfo

Class that represents the LC_DYLD_INFO and LC_DYLD_INFO_ONLY commands

property bind

Bind information as a tuple (offset, size)

Dyld binds an image during the loading process, if the image requires any pointers to be initialized to symbols in other images. The rebase information is a stream of byte sized opcodes for which symbolic names start with BIND_OPCODE_.

Conceptually the bind information is a table of tuples: (seg-index, seg-offset, type, symbol-library-ordinal, symbol-name, addend) The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like for runs of pointers initialzed to the same value can be encoded in a few bytes.

See also

/usr/include/mach-o/loader.h

property bind_opcodes

Return the binding’s opcodes as list of bytes

property bindings

Return an iterator over Dyld’s BindingInfo

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property export_info

Export information as a tuple (offset, size)

The symbols exported by a dylib are encoded in a trie. This is a compact representation that factors out common prefixes.

It also reduces LINKEDIT pages in RAM because it encodes all information (name, address, flags) in one small, contiguous range. The export area is a stream of nodes. The first node sequentially is the start node for the trie.

Nodes for a symbol start with a byte that is the length of the exported symbol information for the string so far. If there is no exported symbol, the byte is zero. If there is exported info, it follows the length byte. The exported info normally consists of a flags and offset both encoded in uleb128. The offset is location of the content named by the symbol. It is the offset from the mach_header for the image.

After the initial byte and optional exported symbol information is a byte of how many edges (0-255) that this node has leaving it, followed by each edge. Each edge is a zero terminated cstring of the addition chars in the symbol, followed by a uleb128 offset for the node that edge points to.

See also

/usr/include/mach-o/loader.h

property export_trie

Return Export’s trie as list of bytes

property exports

Return an iterator over Dyld’s ExportInfo

class it_binding_info
class it_export_info
property lazy_bind

Lazy Bind information as a tuple (offset, size)

Some uses of external symbols do not need to be bound immediately. Instead they can be lazily bound on first use. The lazy_bind are contains a stream of BIND opcodes to bind all lazy symbols. Normal use is that dyld ignores the lazy_bind section when loading an image. Instead the static linker arranged for the lazy pointer to initially point to a helper function which pushes the offset into the lazy_bind area for the symbol needing to be bound, then jumps to dyld which simply adds the offset to lazy_bind_off to get the information on what to bind.

See also

/usr/include/mach-o/loader.h

property lazy_bind_opcodes

Return lazy binding’s opcodes as list of bytes

property rebase

Rebase information as a tuple (offset, size)

Dyld rebases an image whenever dyld loads it at an address different from its preferred address. The rebase information is a stream of byte sized opcodes for which symbolic names start with REBASE_OPCODE_.

Conceptually the rebase information is a table of tuples: (seg-index, seg-offset, type)

The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like “every n’th offset for m times” can be encoded in a few bytes

See also

/usr/include/mach-o/loader.h

property rebase_opcodes

Return the rebase’s opcodes as list of bytes

set_bind_offset(self: lief._lief.MachO.DyldInfo, offset: int) None
set_bind_size(self: lief._lief.MachO.DyldInfo, size: int) None
set_export_offset(self: lief._lief.MachO.DyldInfo, offset: int) None
set_export_size(self: lief._lief.MachO.DyldInfo, size: int) None
set_lazy_bind_offset(self: lief._lief.MachO.DyldInfo, offset: int) None
set_lazy_bind_size(self: lief._lief.MachO.DyldInfo, size: int) None
set_rebase_offset(self: lief._lief.MachO.DyldInfo, offset: int) None
set_rebase_size(self: lief._lief.MachO.DyldInfo, size: int) None
set_weak_bind_offset(self: lief._lief.MachO.DyldInfo, offset: int) None
set_weak_bind_size(self: lief._lief.MachO.DyldInfo, size: int) None
property show_bind_opcodes

Return the bind opcodes in a humman-readable way

property show_export_trie

Return the export trie in a humman-readable way

property show_lazy_bind_opcodes

Return the weak bind opcodes in a humman-readable way

property show_rebases_opcodes

Return the rebase opcodes in a humman-readable way

property show_weak_bind_opcodes

Return the weak bind opcodes in a humman-readable way

property size

Size of the command (should be greather than sizeof(load_command))

property weak_bind

Weak Bind information as a tuple (offset, size)

Some C++ programs require dyld to unique symbols so that all images in the process use the same copy of some code/data.

This step is done after binding. The content of the weak_bind info is an opcode stream like the bind_info. But it is sorted alphabetically by symbol name. This enables dyld to walk all images with weak binding information in order and look for collisions. If there are no collisions, dyld does no updating. That means that some fixups are also encoded in the bind_info. For instance, all calls to operator new are first bound to libstdc++.dylib using the information in bind_info. Then if some image overrides operator new that is detected when the weak_bind information is processed and the call to operator new is then rebound.

See also

/usr/include/mach-o/loader.h

property weak_bind_opcodes

Return Weak binding’s opcodes as list of bytes


Function starts

class lief.MachO.FunctionStarts

Class which represents the LC_FUNCTION_STARTS command

This command is an array of ULEB128 encoded values

add_function(self: lief._lief.MachO.FunctionStarts, address: int) None

Add a new function

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property content

The original content as a bytes stream

property data

Command’s data

property data_offset

Offset in the binary where start functions are located

property data_size

Size of the functions list in the binary

property functions

Addresses of every function entry point in the executable

This allows functions to exist for which there are no entries in the symbol table.

Warning

The address is relative to the __TEXT segment

property size

Size of the command (should be greather than sizeof(load_command))


Source Version

class lief.MachO.SourceVersion

Class that represents the MachO LOAD_COMMAND_TYPES::LC_SOURCE_VERSION This command is used to provide the version of the sources used to build the binary

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property size

Size of the command (should be greather than sizeof(load_command))

property version

Version as a tuple of 5 integers


Version Min

class lief.MachO.VersionMin

Class that wraps the LC_VERSION_MIN_MACOSX, LC_VERSION_MIN_IPHONEOS, … commands

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property sdk

SDK as a tuple of 3 integers

property size

Size of the command (should be greather than sizeof(load_command))

property version

Version as a tuple of 3 integers


Relocation

class lief.MachO.Relocation

It extends the LIEF lief.Relocation abstract class and it is sub-classed by

  1. RelocationObject

  2. RelocationDyld

property address

For OBJECT or (origin is RELOC_TABLE) this is an ” offset from the start of the Section to the item containing the address requiring relocation.

For EXECUTE / DYLIB or (origin is DYLDINFO) this is a virtual_address.

property architecture

CPU_TYPES of the relocation

property has_section

True if the relocation has a Section associated with

property has_segment

True if the relocation has a SegmentCommand associated with

property has_symbol

True if the relocation has a Symbol associated with

property origin

RELOCATION_ORIGINS of the relocation

property pc_relative

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

property section

Section associated with the relocation if any, or None

property segment

SegmentCommand associated with the relocation if any, or None

property size

Relocation’s size (in bits)

property symbol

Symbol associated with the relocation if any, or None

property type

Type of the relocation according to the architecture and/or origin

If origin is RELOC_TABLE:

See:

If origin is DYLDINFO, the value is associated with REBASE_TYPES.


Relocation Object

class lief.MachO.RelocationObject

Class that represents a relocation presents in the MachO object file (.o). Usually, this kind of relocation is found in the lief.MachO.Section.

property address

For OBJECT or (origin is RELOC_TABLE) this is an ” offset from the start of the Section to the item containing the address requiring relocation.

For EXECUTE / DYLIB or (origin is DYLDINFO) this is a virtual_address.

property architecture

CPU_TYPES of the relocation

property has_section

True if the relocation has a Section associated with

property has_segment

True if the relocation has a SegmentCommand associated with

property has_symbol

True if the relocation has a Symbol associated with

property is_scattered

True if the relocation is a scattered one

property origin

RELOCATION_ORIGINS of the relocation

property pc_relative

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

property section

Section associated with the relocation if any, or None

property segment

SegmentCommand associated with the relocation if any, or None

property size

Relocation’s size (in bits)

property symbol

Symbol associated with the relocation if any, or None

property type

Type of the relocation according to the architecture and/or origin

If origin is RELOC_TABLE:

See:

If origin is DYLDINFO, the value is associated with REBASE_TYPES.

property value

For scattered relocations, the address of the relocatable expression for the item in the file that needs to be updated if the address is changed.

For relocatable expressions with the difference of two section addresses, the address from which to subtract (in mathematical terms, the minuend) is contained in the first relocation entry and the address to subtract (the subtrahend) is contained in the second relocation entry.”,


Relocation Dyld

class lief.MachO.RelocationDyld

Class that represents a relocation found in the DyldInfo structure.

While this class does not have an associated structure in the Mach-O format specification, it provides a convenient interface for the lief.MachO.DyldInfo.rebase values

See also: RelocationObject

property address

For OBJECT or (origin is RELOC_TABLE) this is an ” offset from the start of the Section to the item containing the address requiring relocation.

For EXECUTE / DYLIB or (origin is DYLDINFO) this is a virtual_address.

property architecture

CPU_TYPES of the relocation

property has_section

True if the relocation has a Section associated with

property has_segment

True if the relocation has a SegmentCommand associated with

property has_symbol

True if the relocation has a Symbol associated with

property origin

RELOCATION_ORIGINS of the relocation

property pc_relative

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

property section

Section associated with the relocation if any, or None

property segment

SegmentCommand associated with the relocation if any, or None

property size

Relocation’s size (in bits)

property symbol

Symbol associated with the relocation if any, or None

property type

Type of the relocation according to the architecture and/or origin

If origin is RELOC_TABLE:

See:

If origin is DYLDINFO, the value is associated with REBASE_TYPES.


Relocation Fixup

class lief.MachO.RelocationFixup

Class that represents a rebase relocation found in the LC_DYLD_CHAINED_FIXUPS command.

This class extends lief.Relocation (and lief.MachO.Relocation) in which address is set to the absolute virtual address where the relocation must take place (e.g. 0x10000d270).

On the other hand, target contains the value that should be set at address if the imagebase is imagebase (e.g. 0x1000073a8).

If the Mach-O loader chooses another base address (like 0x7ff100000), it must set 0x10000d270 to 0x7ff1073a8.

property address

For OBJECT or (origin is RELOC_TABLE) this is an ” offset from the start of the Section to the item containing the address requiring relocation.

For EXECUTE / DYLIB or (origin is DYLDINFO) this is a virtual_address.

property architecture

CPU_TYPES of the relocation

property has_section

True if the relocation has a Section associated with

property has_segment

True if the relocation has a SegmentCommand associated with

property has_symbol

True if the relocation has a Symbol associated with

property origin

RELOCATION_ORIGINS of the relocation

property pc_relative

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

property section

Section associated with the relocation if any, or None

property segment

SegmentCommand associated with the relocation if any, or None

property size

Relocation’s size (in bits)

property symbol

Symbol associated with the relocation if any, or None

property target
property type

Type of the relocation according to the architecture and/or origin

If origin is RELOC_TABLE:

See:

If origin is DYLDINFO, the value is associated with REBASE_TYPES.


Binding Info

class lief.MachO.BindingInfo

Class that provides an interface over an entry in DyldInfo structure

This class does not represent a structure that exists in the Mach-O format specifications but it provides a view of a binding operation that is performed by the Dyld binding bytecode (LC_DYLD_INFO) or the Dyld chained fixups (DYLD_CHAINED_FIXUPS)

See: ChainedBindingInfo, DyldBindingInfo

property addend

Value added to the segment’s virtual address when binding

property address

Binding’s address

property has_library

True if the binding info has a DylibCommand associated with

property has_segment

True if the binding info has a SegmentCommand associated with

property has_symbol

True if the binding info has a Symbol associated with

property library

DylibCommand associated with the binding if any, or None

property library_ordinal
property segment

SegmentCommand associated with the binding if any, or None

property symbol

Symbol associated with the binding if any, or None

property weak_import

Dyld Binding Info

class lief.MachO.DyldBindingInfo

This class represents a symbol binding operation associated with the LC_DYLD_INFO bytecode.

This class does not represent a structure that exists in the Mach-O format specifications but it provides a view on an entry of the Dyld binding opcodes.

See also: BindingInfo

property addend

Value added to the segment’s virtual address when binding

property address

Binding’s address

property binding_class

BINDING_CLASS of the binding

property binding_type

BIND_TYPES of the binding.

Usually, it is POINTER.

property has_library

True if the binding info has a DylibCommand associated with

property has_segment

True if the binding info has a SegmentCommand associated with

property has_symbol

True if the binding info has a Symbol associated with

property library

DylibCommand associated with the binding if any, or None

property library_ordinal
property original_offset

Original relative offset of the binding opcodes

property segment

SegmentCommand associated with the binding if any, or None

property symbol

Symbol associated with the binding if any, or None

property weak_import

Chained Binding Info

class lief.MachO.ChainedBindingInfo

This class represents a symbol binding operation associated with the LC_DYLD_CHAINED_FIXUPS command.

This class does not represent a structure that exists in the Mach-O format specifications but it provides a view on an entry.

See also: BindingInfo

property addend

Value added to the segment’s virtual address when binding

property address

Binding’s address

property format

DYLD_CHAINED_FORMAT of the import

property has_library

True if the binding info has a DylibCommand associated with

property has_segment

True if the binding info has a SegmentCommand associated with

property has_symbol

True if the binding info has a Symbol associated with

property library

DylibCommand associated with the binding if any, or None

property library_ordinal
property offset

Offset of the entry in the chained fixups

property ptr_format

DYLD_CHAINED_PTR_FORMAT of the import

property segment

SegmentCommand associated with the binding if any, or None

property sign_extended_addend
property symbol

Symbol associated with the binding if any, or None

property weak_import

Export Info

class lief.MachO.ExportInfo

Class that provides an interface over the Dyld export info

This class does not represent a structure that exists in the Mach-O format specification but provides a view on an entry of the Dyld export trie.

property address

The address of the export

property alias

Symbol alias if the current symbol is re-exported

property alias_library

If the current symbol has an alias, it returns the DylibCommand command associated with

property flags

Some information (EXPORT_SYMBOL_FLAGS) about the export (like weak export, reexport, …)

property flags_list

Return flags as a list of EXPORT_SYMBOL_KINDS

has(self: lief._lief.MachO.ExportInfo, Check if the flag :class:`~lief.MachO.EXPORT_SYMBOL_FLAGS` given in first parameter is presentflag: lief._lief.MachO.EXPORT_SYMBOL_FLAGS) bool
property has_symbol

True if the export info has a Symbol associated with

property kind

The export’s kind: regular, thread local, absolute, … (EXPORT_SYMBOL_KINDS)

property node_offset

Original offset in the export Trie

property symbol

Symbol associated with the export if any, or None


Thread Command

class lief.MachO.ThreadCommand

Class that represents the LC_THREAD / LC_UNIXTHREAD commands and that can be used to get the binary entrypoint when the LC_MAIN (MainCommand) is not present

Generally speaking, this command aims at defining the original state of the main thread which includes the registers’ values

property architecture

The CPU architecture that is targeted by this ThreadCommand

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property count

Size of the thread state data with 32-bits alignment.

This value should match len(state)

property data

Command’s data

property flavor

Integer that defines a special flavor for the thread.

The meaning of this value depends on the architecture. The list of the values can be found in the XNU kernel files:

  • xnu/osfmk/mach/arm/thread_status.h for the ARM/AArch64 architectures

  • xnu/osfmk/mach/i386/thread_status.h for the x86/x86-64 architectures

property pc

Return the initial Program Counter regardless of the underlying architecture. This value, when non null, can be used to determine the binary’s entrypoint.

Underneath, it works by looking for the PC register value in the state data

property size

Size of the command (should be greather than sizeof(load_command))

property state

The actual thread state as a vector of bytes. Depending on the architecture(), these data can be casted into x86_thread_state_t, x86_thread_state64_t, …


RPath Command

class lief.MachO.RPathCommand
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property path

@rpath path

property size

Size of the command (should be greather than sizeof(load_command))


Code Signature

class lief.MachO.CodeSignature
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property content

The raw signature as a bytes stream

property data

Command’s data

property data_offset

Offset in the binary where the signature starts

property data_size

Size of the raw signature

property size

Size of the command (should be greather than sizeof(load_command))


Data In Code

class lief.MachO.DataInCode

Interface of the LC_DATA_IN_CODE command

This command is used to list slices of code sections that contain data. The slices information are stored as an array of DataCodeEntry

add(self: lief._lief.MachO.DataInCode, entry: LIEF::MachO::DataCodeEntry) lief._lief.MachO.DataInCode

Add an new DataCodeEntry

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property content

The original content as a bytes stream

property data

Command’s data

property data_offset

Start of the array of the DataCodeEntry entries

property data_size

Whole size of the array (size = sizeof(DataCodeEntry) * nb_elements)

property entries

Iterator over DataCodeEntry

property size

Size of the command (should be greather than sizeof(load_command))


Data Code Entry

class lief.MachO.DataCodeEntry(self: lief._lief.MachO.DataCodeEntry, arg0: int, arg1: int, arg2: LIEF::MachO::DataCodeEntry::TYPES)

Interface over an entry in the DataInCode command

class TYPES(self: lief._lief.MachO.DataCodeEntry.TYPES, value: int)

Members:

UNKNOWN

DATA

JUMP_TABLE_8

JUMP_TABLE_16

JUMP_TABLE_32

ABS_JUMP_TABLE_32

ABS_JUMP_TABLE_32 = <TYPES.ABS_JUMP_TABLE_32: 5>
DATA = <TYPES.DATA: 1>
JUMP_TABLE_16 = <TYPES.JUMP_TABLE_16: 3>
JUMP_TABLE_32 = <TYPES.JUMP_TABLE_32: 4>
JUMP_TABLE_8 = <TYPES.JUMP_TABLE_8: 2>
UNKNOWN = <TYPES.UNKNOWN: 0>
property name
property value
property length

Length of the data

property offset

Offset of the data

property type

Type of the data (TYPES


Segment Split Info

class lief.MachO.SegmentSplitInfo

Class that represents the LOAD_COMMAND_TYPES::LC_SEGMENT_SPLIT_INFO command

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property content

The original content as a bytes stream

property data

Command’s data

property data_offset

Offset in the binary where the data start

property data_size

Size of the raw data

property size

Size of the command (should be greather than sizeof(load_command))


Sub Framework

class lief.MachO.SubFramework

Class that represents the SubFramework command. Accodring to the Mach-O loader.h documentation:

> A dynamically linked shared library may be a subframework of an umbrella > framework. If so it will be linked with “-umbrella umbrella_name” where > Where “umbrella_name” is the name of the umbrella framework. A subframework > can only be linked against by its umbrella framework or other subframeworks > that are part of the same umbrella framework. Otherwise the static link > editor produces an error and states to link against the umbrella framework. > The name of the umbrella framework for subframeworks is recorded in the > following structure.

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property size

Size of the command (should be greather than sizeof(load_command))

property umbrella

Name of the umbrella framework


Dyld Environment

class lief.MachO.DyldEnvironment

Class that represents a LC_DYLD_ENVIRONMENT which is used by the Mach-O linker/loader to initialize an environment variable

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property size

Size of the command (should be greather than sizeof(load_command))

property value

Environment variable as a string


Encryption Info

class lief.MachO.EncryptionInfo

Class that represents the LC_ENCRYPTION_INFO / LC_ENCRYPTION_INFO_64 commands

The encryption info is usually present in Mach-O executables that target iOS to encrypt some sections of the binary

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property crypt_id

The encryption system. 0 means no encrypted

property crypt_offset

File offset of encrypted range

property crypt_size

File size of encrypted range

property data

Command’s data

property size

Size of the command (should be greather than sizeof(load_command))


Build Version

class lief.MachO.BuildVersion
class PLATFORMS(self: lief._lief.MachO.BuildVersion.PLATFORMS, value: int)

Members:

UNKNOWN

MACOS

IOS

TVOS

WATCHOS

IOS = <PLATFORMS.IOS: 2>
MACOS = <PLATFORMS.MACOS: 1>
TVOS = <PLATFORMS.TVOS: 3>
UNKNOWN = <PLATFORMS.UNKNOWN: 0>
WATCHOS = <PLATFORMS.WATCHOS: 4>
property name
property value
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property minos

Minimal OS version on which this binary was built to run

property platform

Target PLATFORMS

property sdk

SDK Version

property size

Size of the command (should be greather than sizeof(load_command))

property tools

List of BuildToolVersion used when while this binary


Build Tool Version

class lief.MachO.BuildToolVersion

Class that represents a tool’s version that was involved in the build of the binary

class TOOLS(self: lief._lief.MachO.BuildToolVersion.TOOLS, value: int)

Members:

UNKNOWN

CLANG

SWIFT

LD

CLANG = <TOOLS.CLANG: 1>
LD = <TOOLS.LD: 3>
SWIFT = <TOOLS.SWIFT: 2>
UNKNOWN = <TOOLS.UNKNOWN: 0>
property name
property value
property tool

TOOLS type

property version

Version of the tool


Fileset Command

class lief.MachO.FilesetCommand

Class associated with the LC_FILESET_ENTRY commands

property binary

Return the Binary object associated with the entry

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property file_offset

Original offset in the kernel cache

property name

Name of the underlying MachO binary

property size

Size of the command (should be greather than sizeof(load_command))

property virtual_address

Memory address where the MachO file should be mapped


DyldChainedFixups Command

class lief.MachO.DyldChainedFixups

Class that represents the LC_DYLD_CHAINED_FIXUPS command

This command aims at providing rebase and binding information like the DyldInfo ‘s bytecode. Compared to the DyldInfo bytecode, these chained fixups are taking less space.

property bindings

Iterator over the bindings ChainedBindingInfo associated with this command

class chained_starts_in_segment

Structure that mirrors the raw dyld_chained_starts_in_segment which aims at providing information about the chained rebase/bind fixups

The relocations provided by this structure can be accessed through relocations

property max_valid_pointer

for 32-bit OS, any value beyond this is not a pointer

property offset

Original offset of the structure, relative to starts_offset

property page_count

How many pages are in the page_start array

property page_size

Likely 0x1000 for x86/x86_64 architectures and 0x4000 for ARM64 architecture

property page_start

Offset in the SegmentCommand of the first element of the chain.

property pointer_format

How pointers are encoded

property segment

SegmentCommand in which the rebase/bind fixups take place

property segment_offset

Offset of the segment’s data from the beginning of the file. (it should match file_offset)

property size

sizeof(size) + sizeof(page_size) + ... + sizeof(pointer_format)

property chained_starts_in_segments

Iterator over the chained fixup metadata, chained_starts_in_segment

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property data_offset

Offset of the LC_DYLD_CHAINED_FIXUPS chained payload. This offset should point in the __LINKEDIT segment

property data_size

Size of the LC_DYLD_CHAINED_FIXUPS payload

property fixups_version

Chained fixups version. The loader (as far of dyld v852.2) checks that this value is set to 0.

property imports_count

Number of imported symbol names

property imports_format

The format of the imports (ChainedBindingInfo)

property imports_offset

Offset of imports table in chain data

class it_binding_info
class it_chained_starts_in_segments_t
property size

Size of the command (should be greather than sizeof(load_command))

property starts_offset

offset of dyld_chained_starts_in_image in chain_data

property symbols_format

The compression algorithm (if any) used to store the symbols 0 means uncompressed while 1 means zlib compressed.

As far of the version v852.2 of dyld loader, it only supports uncompressed format

property symbols_offset

Offset of symbol strings in chain data


DyldExportsTrie Command

class lief.MachO.DyldExportsTrie

Class that represents the LC_DYLD_EXPORTS_TRIE command

In recent Mach-O binaries, this command replace the DyldInfo export trie buffer

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property content

The raw export trie

property data

Command’s data

property data_offset

Offset of the trie in the binary. This offset should point in the __LINKEDIT

property data_size

Raw size of the trie

property exports

Iterator over the ExportInfo associated with this trie.

show_export_trie(self: lief._lief.MachO.DyldExportsTrie) str

Show the trie in a humman-readable way

property size

Size of the command (should be greather than sizeof(load_command))


Code Signature Dir Command

class lief.MachO.CodeSignatureDir
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property content

The raw signature as a bytes stream

property data

Command’s data

property data_offset

Offset in the binary where the signature starts

property data_size

Size of the raw signature

property size

Size of the command (should be greather than sizeof(load_command))


Two Level Hints

class lief.MachO.TwoLevelHints

Class which represents the LC_TWOLEVEL_HINTS command

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property content

The original content as a bytes stream

property data

Command’s data

property hints
property size

Size of the command (should be greather than sizeof(load_command))


Linker Optimization Hint

class lief.MachO.LinkerOptHint

Class which represents the LC_LINKER_OPTIMIZATION_HINT command

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property content

The raw payload

property data

Command’s data

property data_offset

Offset in the binary where the payload starts

property data_size

Size of the raw payload

property size

Size of the command (should be greather than sizeof(load_command))


Builder

class lief.MachO.Builder

Class used to reconstruct a Mach-O binary from its object representation

class config_t(self: lief._lief.MachO.Builder.config_t)

Interface to tweak the Builder

property linkedit
static write(*args, **kwargs)

Overloaded function.

  1. write(binary: lief._lief.MachO.Binary, output: str) -> object

  2. write(binary: lief._lief.MachO.Binary, output: str, config: lief._lief.MachO.Builder.config_t) -> object

  3. write(fat_binary: lief._lief.MachO.FatBinary, output: str) -> object

  4. write(fat_binary: lief._lief.MachO.FatBinary, output: str, config: lief._lief.MachO.Builder.config_t) -> object


Enums

CPU_TYPES

class lief.MachO.CPU_TYPES(self: lief._lief.MachO.CPU_TYPES, value: int)

Members:

ANY

x86

I386

x86_64

MC98000

ARM

ARM64

SPARC

POWERPC

POWERPC64

ANY = <CPU_TYPES.ANY: -1>
ARM = <CPU_TYPES.ARM: 12>
ARM64 = <CPU_TYPES.ARM64: 16777228>
I386 = <CPU_TYPES.x86: 7>
MC98000 = <CPU_TYPES.MC98000: 10>
POWERPC = <CPU_TYPES.POWERPC: 18>
POWERPC64 = <CPU_TYPES.POWERPC64: 16777234>
SPARC = <CPU_TYPES.SPARC: 14>
property name
property value
x86 = <CPU_TYPES.x86: 7>
x86_64 = <CPU_TYPES.x86_64: 16777223>

FILE_TYPES

class lief.MachO.FILE_TYPES(self: lief._lief.MachO.FILE_TYPES, value: int)

Members:

OBJECT

EXECUTE

FVMLIB

CORE

PRELOAD

DYLIB

DYLINKER

BUNDLE

DYLIB_STUB

DSYM

KEXT_BUNDLE

BUNDLE = <FILE_TYPES.BUNDLE: 8>
CORE = <FILE_TYPES.CORE: 4>
DSYM = <FILE_TYPES.DSYM: 10>
DYLIB = <FILE_TYPES.DYLIB: 6>
DYLIB_STUB = <FILE_TYPES.DYLIB_STUB: 9>
DYLINKER = <FILE_TYPES.DYLINKER: 7>
EXECUTE = <FILE_TYPES.EXECUTE: 2>
FVMLIB = <FILE_TYPES.FVMLIB: 3>
KEXT_BUNDLE = <FILE_TYPES.KEXT_BUNDLE: 11>
OBJECT = <FILE_TYPES.OBJECT: 1>
PRELOAD = <FILE_TYPES.PRELOAD: 5>
property name
property value

HEADER_FLAGS

class lief.MachO.HEADER_FLAGS(self: lief._lief.MachO.HEADER_FLAGS, value: int)

Members:

NOUNDEFS

INCRLINK

DYLDLINK

BINDATLOAD

PREBOUND

SPLIT_SEGS

LAZY_INIT

TWOLEVEL

FORCE_FLAT

NOMULTIDEFS

NOFIXPREBINDING

PREBINDABLE

ALLMODSBOUND

SUBSECTIONS_VIA_SYMBOLS

CANONICAL

WEAK_DEFINES

BINDS_TO_WEAK

ALLOW_STACK_EXECUTION

ROOT_SAFE

SETUID_SAFE

NO_REEXPORTED_DYLIBS

PIE

DEAD_STRIPPABLE_DYLIB

HAS_TLV_DESCRIPTORS

NO_HEAP_EXECUTION

APP_EXTENSION_SAFE

ALLMODSBOUND = <HEADER_FLAGS.ALLMODSBOUND: 4096>
ALLOW_STACK_EXECUTION = <HEADER_FLAGS.ALLOW_STACK_EXECUTION: 131072>
APP_EXTENSION_SAFE = <HEADER_FLAGS.APP_EXTENSION_SAFE: 33554432>
BINDATLOAD = <HEADER_FLAGS.BINDATLOAD: 8>
BINDS_TO_WEAK = <HEADER_FLAGS.BINDS_TO_WEAK: 65536>
CANONICAL = <HEADER_FLAGS.CANONICAL: 16384>
DEAD_STRIPPABLE_DYLIB = <HEADER_FLAGS.DEAD_STRIPPABLE_DYLIB: 4194304>
FORCE_FLAT = <HEADER_FLAGS.FORCE_FLAT: 256>
HAS_TLV_DESCRIPTORS = <HEADER_FLAGS.HAS_TLV_DESCRIPTORS: 8388608>
LAZY_INIT = <HEADER_FLAGS.LAZY_INIT: 64>
NOFIXPREBINDING = <HEADER_FLAGS.NOFIXPREBINDING: 1024>
NOMULTIDEFS = <HEADER_FLAGS.NOMULTIDEFS: 512>
NOUNDEFS = <HEADER_FLAGS.NOUNDEFS: 1>
NO_HEAP_EXECUTION = <HEADER_FLAGS.NO_HEAP_EXECUTION: 16777216>
NO_REEXPORTED_DYLIBS = <HEADER_FLAGS.NO_REEXPORTED_DYLIBS: 1048576>
PIE = <HEADER_FLAGS.PIE: 2097152>
PREBINDABLE = <HEADER_FLAGS.PREBINDABLE: 2048>
PREBOUND = <HEADER_FLAGS.PREBOUND: 16>
ROOT_SAFE = <HEADER_FLAGS.ROOT_SAFE: 262144>
SETUID_SAFE = <HEADER_FLAGS.SETUID_SAFE: 524288>
SPLIT_SEGS = <HEADER_FLAGS.SPLIT_SEGS: 32>
SUBSECTIONS_VIA_SYMBOLS = <HEADER_FLAGS.SUBSECTIONS_VIA_SYMBOLS: 8192>
TWOLEVEL = <HEADER_FLAGS.TWOLEVEL: 128>
WEAK_DEFINES = <HEADER_FLAGS.WEAK_DEFINES: 32768>
property name
property value

LOAD_COMMAND_TYPES

class lief.MachO.LOAD_COMMAND_TYPES(self: lief._lief.MachO.LOAD_COMMAND_TYPES, value: int)

Members:

SEGMENT

SYMTAB

SYMSEG

THREAD

UNIXTHREAD

LOADFVMLIB

IDFVMLIB

IDENT

FVMFILE

PREPAGE

DYSYMTAB

LOAD_DYLIB

ID_DYLIB

LOAD_DYLINKER

ID_DYLINKER

PREBOUND_DYLIB

ROUTINES

SUB_FRAMEWORK

SUB_UMBRELLA

SUB_CLIENT

SUB_LIBRARY

TWOLEVEL_HINTS

PREBIND_CKSUM

LOAD_WEAK_DYLIB

SEGMENT_64

ROUTINES_64

UUID

RPATH

CODE_SIGNATURE

SEGMENT_SPLIT_INFO

REEXPORT_DYLIB

LAZY_LOAD_DYLIB

ENCRYPTION_INFO

DYLD_INFO

DYLD_INFO_ONLY

LOAD_UPWARD_DYLIB

VERSION_MIN_MACOSX

VERSION_MIN_IPHONEOS

FUNCTION_STARTS

DYLD_ENVIRONMENT

MAIN

DATA_IN_CODE

SOURCE_VERSION

DYLIB_CODE_SIGN_DRS

ENCRYPTION_INFO_64

LINKER_OPTION

LINKER_OPTIMIZATION_HINT

VERSION_MIN_TVOS

VERSION_MIN_WATCHOS

NOTE

BUILD_VERSION

DYLD_EXPORTS_TRIE

DYLD_CHAINED_FIXUPS

FILESET_ENTRY

BUILD_VERSION = <LOAD_COMMAND_TYPES.BUILD_VERSION: 50>
CODE_SIGNATURE = <LOAD_COMMAND_TYPES.CODE_SIGNATURE: 29>
DATA_IN_CODE = <LOAD_COMMAND_TYPES.DATA_IN_CODE: 41>
DYLD_CHAINED_FIXUPS = <LOAD_COMMAND_TYPES.DYLD_CHAINED_FIXUPS: 2147483700>
DYLD_ENVIRONMENT = <LOAD_COMMAND_TYPES.DYLD_ENVIRONMENT: 39>
DYLD_EXPORTS_TRIE = <LOAD_COMMAND_TYPES.DYLD_EXPORTS_TRIE: 2147483699>
DYLD_INFO = <LOAD_COMMAND_TYPES.DYLD_INFO: 34>
DYLD_INFO_ONLY = <LOAD_COMMAND_TYPES.DYLD_INFO_ONLY: 2147483682>
DYLIB_CODE_SIGN_DRS = <LOAD_COMMAND_TYPES.DYLIB_CODE_SIGN_DRS: 43>
DYSYMTAB = <LOAD_COMMAND_TYPES.DYSYMTAB: 11>
ENCRYPTION_INFO = <LOAD_COMMAND_TYPES.ENCRYPTION_INFO: 33>
ENCRYPTION_INFO_64 = <LOAD_COMMAND_TYPES.ENCRYPTION_INFO_64: 44>
FILESET_ENTRY = <LOAD_COMMAND_TYPES.FILESET_ENTRY: 2147483701>
FUNCTION_STARTS = <LOAD_COMMAND_TYPES.FUNCTION_STARTS: 38>
FVMFILE = <LOAD_COMMAND_TYPES.FVMFILE: 9>
IDENT = <LOAD_COMMAND_TYPES.IDENT: 8>
IDFVMLIB = <LOAD_COMMAND_TYPES.IDFVMLIB: 7>
ID_DYLIB = <LOAD_COMMAND_TYPES.ID_DYLIB: 13>
ID_DYLINKER = <LOAD_COMMAND_TYPES.ID_DYLINKER: 15>
LAZY_LOAD_DYLIB = <LOAD_COMMAND_TYPES.LAZY_LOAD_DYLIB: 32>
LINKER_OPTIMIZATION_HINT = <LOAD_COMMAND_TYPES.LINKER_OPTIMIZATION_HINT: 46>
LINKER_OPTION = <LOAD_COMMAND_TYPES.LINKER_OPTION: 45>
LOADFVMLIB = <LOAD_COMMAND_TYPES.LOADFVMLIB: 6>
LOAD_DYLIB = <LOAD_COMMAND_TYPES.LOAD_DYLIB: 12>
LOAD_DYLINKER = <LOAD_COMMAND_TYPES.LOAD_DYLINKER: 14>
LOAD_UPWARD_DYLIB = <LOAD_COMMAND_TYPES.LOAD_UPWARD_DYLIB: 2147483683>
LOAD_WEAK_DYLIB = <LOAD_COMMAND_TYPES.LOAD_WEAK_DYLIB: 2147483672>
MAIN = <LOAD_COMMAND_TYPES.MAIN: 2147483688>
NOTE = <LOAD_COMMAND_TYPES.NOTE: 49>
PREBIND_CKSUM = <LOAD_COMMAND_TYPES.PREBIND_CKSUM: 23>
PREBOUND_DYLIB = <LOAD_COMMAND_TYPES.PREBOUND_DYLIB: 16>
PREPAGE = <LOAD_COMMAND_TYPES.PREPAGE: 10>
REEXPORT_DYLIB = <LOAD_COMMAND_TYPES.REEXPORT_DYLIB: 2147483679>
ROUTINES = <LOAD_COMMAND_TYPES.ROUTINES: 17>
ROUTINES_64 = <LOAD_COMMAND_TYPES.ROUTINES_64: 26>
RPATH = <LOAD_COMMAND_TYPES.RPATH: 2147483676>
SEGMENT = <LOAD_COMMAND_TYPES.SEGMENT: 1>
SEGMENT_64 = <LOAD_COMMAND_TYPES.SEGMENT_64: 25>
SEGMENT_SPLIT_INFO = <LOAD_COMMAND_TYPES.SEGMENT_SPLIT_INFO: 30>
SOURCE_VERSION = <LOAD_COMMAND_TYPES.SOURCE_VERSION: 42>
SUB_CLIENT = <LOAD_COMMAND_TYPES.SUB_CLIENT: 20>
SUB_FRAMEWORK = <LOAD_COMMAND_TYPES.SUB_FRAMEWORK: 18>
SUB_LIBRARY = <LOAD_COMMAND_TYPES.SUB_LIBRARY: 21>
SUB_UMBRELLA = <LOAD_COMMAND_TYPES.SUB_UMBRELLA: 19>
SYMSEG = <LOAD_COMMAND_TYPES.SYMSEG: 3>
SYMTAB = <LOAD_COMMAND_TYPES.SYMTAB: 2>
THREAD = <LOAD_COMMAND_TYPES.THREAD: 4>
TWOLEVEL_HINTS = <LOAD_COMMAND_TYPES.TWOLEVEL_HINTS: 22>
UNIXTHREAD = <LOAD_COMMAND_TYPES.UNIXTHREAD: 5>
UUID = <LOAD_COMMAND_TYPES.UUID: 27>
VERSION_MIN_IPHONEOS = <LOAD_COMMAND_TYPES.VERSION_MIN_IPHONEOS: 37>
VERSION_MIN_MACOSX = <LOAD_COMMAND_TYPES.VERSION_MIN_MACOSX: 36>
VERSION_MIN_TVOS = <LOAD_COMMAND_TYPES.VERSION_MIN_TVOS: 47>
VERSION_MIN_WATCHOS = <LOAD_COMMAND_TYPES.VERSION_MIN_WATCHOS: 48>
property name
property value

SECTION_TYPES

class lief.MachO.SECTION_TYPES(self: lief._lief.MachO.SECTION_TYPES, value: int)

Members:

REGULAR

ZEROFILL

CSTRING_LITERALS

S_4BYTE_LITERALS

S_8BYTE_LITERALS

LITERAL_POINTERS

NON_LAZY_SYMBOL_POINTERS

LAZY_SYMBOL_POINTERS

SYMBOL_STUBS

MOD_INIT_FUNC_POINTERS

MOD_TERM_FUNC_POINTERS

COALESCED

GB_ZEROFILL

INTERPOSING

S_16BYTE_LITERALS

DTRACE_DOF

LAZY_DYLIB_SYMBOL_POINTERS

THREAD_LOCAL_REGULAR

THREAD_LOCAL_ZEROFILL

THREAD_LOCAL_VARIABLES

THREAD_LOCAL_VARIABLE_POINTERS

THREAD_LOCAL_INIT_FUNCTION_POINTERS

COALESCED = <SECTION_TYPES.COALESCED: 11>
CSTRING_LITERALS = <SECTION_TYPES.CSTRING_LITERALS: 2>
DTRACE_DOF = <SECTION_TYPES.DTRACE_DOF: 15>
GB_ZEROFILL = <SECTION_TYPES.GB_ZEROFILL: 12>
INTERPOSING = <SECTION_TYPES.INTERPOSING: 13>
LAZY_DYLIB_SYMBOL_POINTERS = <SECTION_TYPES.LAZY_DYLIB_SYMBOL_POINTERS: 16>
LAZY_SYMBOL_POINTERS = <SECTION_TYPES.LAZY_SYMBOL_POINTERS: 7>
LITERAL_POINTERS = <SECTION_TYPES.LITERAL_POINTERS: 5>
MOD_INIT_FUNC_POINTERS = <SECTION_TYPES.MOD_INIT_FUNC_POINTERS: 9>
MOD_TERM_FUNC_POINTERS = <SECTION_TYPES.MOD_TERM_FUNC_POINTERS: 10>
NON_LAZY_SYMBOL_POINTERS = <SECTION_TYPES.NON_LAZY_SYMBOL_POINTERS: 6>
REGULAR = <SECTION_TYPES.REGULAR: 0>
SYMBOL_STUBS = <SECTION_TYPES.SYMBOL_STUBS: 8>
S_16BYTE_LITERALS = <SECTION_TYPES.S_16BYTE_LITERALS: 14>
S_4BYTE_LITERALS = <SECTION_TYPES.S_4BYTE_LITERALS: 3>
S_8BYTE_LITERALS = <SECTION_TYPES.S_8BYTE_LITERALS: 4>
THREAD_LOCAL_INIT_FUNCTION_POINTERS = <SECTION_TYPES.THREAD_LOCAL_INIT_FUNCTION_POINTERS: 21>
THREAD_LOCAL_REGULAR = <SECTION_TYPES.THREAD_LOCAL_REGULAR: 17>
THREAD_LOCAL_VARIABLES = <SECTION_TYPES.THREAD_LOCAL_VARIABLES: 19>
THREAD_LOCAL_VARIABLE_POINTERS = <SECTION_TYPES.THREAD_LOCAL_VARIABLE_POINTERS: 20>
THREAD_LOCAL_ZEROFILL = <SECTION_TYPES.THREAD_LOCAL_ZEROFILL: 18>
ZEROFILL = <SECTION_TYPES.ZEROFILL: 1>
property name
property value

MACHO_TYPES

class lief.MachO.MACHO_TYPES(self: lief._lief.MachO.MACHO_TYPES, value: int)

Members:

MAGIC

CIGAM

MAGIC_64

CIGAM_64

FAT_MAGIC

FAT_CIGAM

CIGAM = <MACHO_TYPES.CIGAM: 3472551422>
CIGAM_64 = <MACHO_TYPES.CIGAM_64: 3489328638>
FAT_CIGAM = <MACHO_TYPES.FAT_CIGAM: 3199925962>
FAT_MAGIC = <MACHO_TYPES.FAT_MAGIC: 3405691582>
MAGIC = <MACHO_TYPES.MAGIC: 4277009102>
MAGIC_64 = <MACHO_TYPES.MAGIC_64: 4277009103>
property name
property value

X86_RELOCATION

class lief.MachO.X86_RELOCATION(self: lief._lief.MachO.X86_RELOCATION, value: int)

Members:

VANILLA

PAIR

SECTDIFF

PB_LA_PTR

LOCAL_SECTDIFF

TLV

LOCAL_SECTDIFF = <X86_RELOCATION.LOCAL_SECTDIFF: 4>
PAIR = <X86_RELOCATION.PAIR: 1>
PB_LA_PTR = <X86_RELOCATION.PB_LA_PTR: 3>
SECTDIFF = <X86_RELOCATION.SECTDIFF: 2>
TLV = <X86_RELOCATION.TLV: 5>
VANILLA = <X86_RELOCATION.VANILLA: 0>
property name
property value

X86_64_RELOCATION

class lief.MachO.X86_64_RELOCATION(self: lief._lief.MachO.X86_64_RELOCATION, value: int)

Members:

UNSIGNED

SIGNED

BRANCH

GOT_LOAD

GOT

SUBTRACTOR

SIGNED_1

SIGNED_2

SIGNED_4

TLV

BRANCH = <X86_64_RELOCATION.BRANCH: 2>
GOT = <X86_64_RELOCATION.GOT: 4>
GOT_LOAD = <X86_64_RELOCATION.GOT_LOAD: 3>
SIGNED = <X86_64_RELOCATION.SIGNED: 1>
SIGNED_1 = <X86_64_RELOCATION.SIGNED_1: 6>
SIGNED_2 = <X86_64_RELOCATION.SIGNED_2: 7>
SIGNED_4 = <X86_64_RELOCATION.SIGNED_4: 8>
SUBTRACTOR = <X86_64_RELOCATION.SUBTRACTOR: 5>
TLV = <X86_64_RELOCATION.TLV: 9>
UNSIGNED = <X86_64_RELOCATION.UNSIGNED: 0>
property name
property value

PPC_RELOCATION

class lief.MachO.PPC_RELOCATION(self: lief._lief.MachO.PPC_RELOCATION, value: int)

Members:

VANILLA

PAIR

BR14

BR24

HI16

LO16

HA16

LO14

SECTDIFF

PB_LA_PTR

HI16_SECTDIFF

LO16_SECTDIFF

HA16_SECTDIFF

JBSR

LO14_SECTDIFF

LOCAL_SECTDIFF

BR14 = <PPC_RELOCATION.BR14: 2>
BR24 = <PPC_RELOCATION.BR24: 3>
HA16 = <PPC_RELOCATION.HA16: 6>
HA16_SECTDIFF = <PPC_RELOCATION.HA16_SECTDIFF: 12>
HI16 = <PPC_RELOCATION.HI16: 4>
HI16_SECTDIFF = <PPC_RELOCATION.HI16_SECTDIFF: 10>
JBSR = <PPC_RELOCATION.JBSR: 13>
LO14 = <PPC_RELOCATION.LO14: 7>
LO14_SECTDIFF = <PPC_RELOCATION.LO14_SECTDIFF: 14>
LO16 = <PPC_RELOCATION.LO16: 5>
LO16_SECTDIFF = <PPC_RELOCATION.LO16_SECTDIFF: 11>
LOCAL_SECTDIFF = <PPC_RELOCATION.LOCAL_SECTDIFF: 15>
PAIR = <PPC_RELOCATION.PAIR: 1>
PB_LA_PTR = <PPC_RELOCATION.PB_LA_PTR: 9>
SECTDIFF = <PPC_RELOCATION.SECTDIFF: 8>
VANILLA = <PPC_RELOCATION.VANILLA: 0>
property name
property value

ARM_RELOCATION

class lief.MachO.ARM_RELOCATION(self: lief._lief.MachO.ARM_RELOCATION, value: int)

Members:

VANILLA

PAIR

SECTDIFF

LOCAL_SECTDIFF

PB_LA_PTR

BR24

THUMB_RELOC_BR22

THUMB_32BIT_BRANCH

HALF

HALF_SECTDIFF

BR24 = <ARM_RELOCATION.BR24: 5>
HALF = <ARM_RELOCATION.HALF: 8>
HALF_SECTDIFF = <ARM_RELOCATION.HALF_SECTDIFF: 9>
LOCAL_SECTDIFF = <ARM_RELOCATION.LOCAL_SECTDIFF: 3>
PAIR = <ARM_RELOCATION.PAIR: 1>
PB_LA_PTR = <ARM_RELOCATION.PB_LA_PTR: 4>
SECTDIFF = <ARM_RELOCATION.SECTDIFF: 2>
THUMB_32BIT_BRANCH = <ARM_RELOCATION.THUMB_32BIT_BRANCH: 7>
THUMB_RELOC_BR22 = <ARM_RELOCATION.THUMB_RELOC_BR22: 6>
VANILLA = <ARM_RELOCATION.VANILLA: 0>
property name
property value

ARM64_RELOCATION

class lief.MachO.ARM64_RELOCATION(self: lief._lief.MachO.ARM64_RELOCATION, value: int)

Members:

UNSIGNED

SUBTRACTOR

BRANCH26

PAGE21

PAGEOFF12

GOT_LOAD_PAGE21

GOT_LOAD_PAGEOFF12

POINTER_TO_GOT

TLVP_LOAD_PAGE21

TLVP_LOAD_PAGEOFF12

ADDEND

ADDEND = <ARM64_RELOCATION.ADDEND: 10>
BRANCH26 = <ARM64_RELOCATION.BRANCH26: 2>
GOT_LOAD_PAGE21 = <ARM64_RELOCATION.GOT_LOAD_PAGE21: 5>
GOT_LOAD_PAGEOFF12 = <ARM64_RELOCATION.GOT_LOAD_PAGEOFF12: 6>
PAGE21 = <ARM64_RELOCATION.PAGE21: 3>
PAGEOFF12 = <ARM64_RELOCATION.PAGEOFF12: 4>
POINTER_TO_GOT = <ARM64_RELOCATION.POINTER_TO_GOT: 7>
SUBTRACTOR = <ARM64_RELOCATION.SUBTRACTOR: 1>
TLVP_LOAD_PAGE21 = <ARM64_RELOCATION.TLVP_LOAD_PAGE21: 8>
TLVP_LOAD_PAGEOFF12 = <ARM64_RELOCATION.TLVP_LOAD_PAGEOFF12: 9>
UNSIGNED = <ARM64_RELOCATION.UNSIGNED: 0>
property name
property value

RELOCATION_ORIGINS

class lief.MachO.RELOCATION_ORIGINS(self: lief._lief.MachO.RELOCATION_ORIGINS, value: int)

Members:

UNKNOWN

DYLDINFO

RELOC_TABLE

CHAINED_FIXUPS

CHAINED_FIXUPS = <RELOCATION_ORIGINS.CHAINED_FIXUPS: 3>
DYLDINFO = <RELOCATION_ORIGINS.DYLDINFO: 1>
RELOC_TABLE = <RELOCATION_ORIGINS.RELOC_TABLE: 2>
UNKNOWN = <RELOCATION_ORIGINS.UNKNOWN: 0>
property name
property value

REBASE_TYPES

class lief.MachO.REBASE_TYPES(self: lief._lief.MachO.REBASE_TYPES, value: int)

Members:

POINTER

TEXT_ABSOLUTE32

TEXT_PCREL32

POINTER = <REBASE_TYPES.POINTER: 1>
TEXT_ABSOLUTE32 = <REBASE_TYPES.TEXT_ABSOLUTE32: 2>
TEXT_PCREL32 = <REBASE_TYPES.TEXT_PCREL32: 3>
property name
property value

BINDING_CLASS

class lief.MachO.BINDING_CLASS(self: lief._lief.MachO.BINDING_CLASS, value: int)

Members:

WEAK

LAZY

STANDARD

THREADED

LAZY = <BINDING_CLASS.LAZY: 2>
STANDARD = <BINDING_CLASS.STANDARD: 3>
THREADED = <BINDING_CLASS.THREADED: 100>
WEAK = <BINDING_CLASS.WEAK: 1>
property name
property value

REBASE_OPCODES

class lief.MachO.REBASE_OPCODES(self: lief._lief.MachO.REBASE_OPCODES, value: int)

Members:

DONE

SET_TYPE_IMM

SET_SEGMENT_AND_OFFSET_ULEB

ADD_ADDR_ULEB

ADD_ADDR_IMM_SCALED

DO_REBASE_IMM_TIMES

DO_REBASE_ULEB_TIMES

DO_REBASE_ADD_ADDR_ULEB

DO_REBASE_ULEB_TIMES_SKIPPING_ULEB

ADD_ADDR_IMM_SCALED = <REBASE_OPCODES.ADD_ADDR_IMM_SCALED: 64>
ADD_ADDR_ULEB = <REBASE_OPCODES.ADD_ADDR_ULEB: 48>
DONE = <REBASE_OPCODES.DONE: 0>
DO_REBASE_ADD_ADDR_ULEB = <REBASE_OPCODES.DO_REBASE_ADD_ADDR_ULEB: 112>
DO_REBASE_IMM_TIMES = <REBASE_OPCODES.DO_REBASE_IMM_TIMES: 80>
DO_REBASE_ULEB_TIMES = <REBASE_OPCODES.DO_REBASE_ULEB_TIMES: 96>
DO_REBASE_ULEB_TIMES_SKIPPING_ULEB = <REBASE_OPCODES.DO_REBASE_ULEB_TIMES_SKIPPING_ULEB: 128>
SET_SEGMENT_AND_OFFSET_ULEB = <REBASE_OPCODES.SET_SEGMENT_AND_OFFSET_ULEB: 32>
SET_TYPE_IMM = <REBASE_OPCODES.SET_TYPE_IMM: 16>
property name
property value

BIND_TYPES

class lief.MachO.BIND_TYPES(self: lief._lief.MachO.BIND_TYPES, value: int)

Members:

POINTER

TEXT_ABSOLUTE32

TEXT_PCREL32

POINTER = <BIND_TYPES.POINTER: 1>
TEXT_ABSOLUTE32 = <BIND_TYPES.TEXT_ABSOLUTE32: 2>
TEXT_PCREL32 = <BIND_TYPES.TEXT_PCREL32: 3>
property name
property value

BIND_SPECIAL_DYLIB

class lief.MachO.BIND_SPECIAL_DYLIB(self: lief._lief.MachO.BIND_SPECIAL_DYLIB, value: int)

Members:

SELF

MAIN_EXECUTABLE

FLAT_LOOKUP

FLAT_LOOKUP = <BIND_SPECIAL_DYLIB.FLAT_LOOKUP: -2>
MAIN_EXECUTABLE = <BIND_SPECIAL_DYLIB.MAIN_EXECUTABLE: -1>
SELF = <BIND_SPECIAL_DYLIB.SELF: 0>
property name
property value

BIND_OPCODES

class lief.MachO.BIND_OPCODES(self: lief._lief.MachO.BIND_OPCODES, value: int)

Members:

DONE

SET_DYLIB_ORDINAL_IMM

SET_DYLIB_ORDINAL_ULEB

SET_DYLIB_SPECIAL_IMM

SET_SYMBOL_TRAILING_FLAGS_IMM

SET_TYPE_IMM

SET_ADDEND_SLEB

SET_SEGMENT_AND_OFFSET_ULEB

ADD_ADDR_ULEB

DO_BIND

DO_BIND_ADD_ADDR_ULEB

DO_BIND_ADD_ADDR_IMM_SCALED

DO_BIND_ULEB_TIMES_SKIPPING_ULEB

THREADED

ADD_ADDR_ULEB = <BIND_OPCODES.ADD_ADDR_ULEB: 128>
DONE = <BIND_OPCODES.DONE: 0>
DO_BIND = <BIND_OPCODES.DO_BIND: 144>
DO_BIND_ADD_ADDR_IMM_SCALED = <BIND_OPCODES.DO_BIND_ADD_ADDR_IMM_SCALED: 176>
DO_BIND_ADD_ADDR_ULEB = <BIND_OPCODES.DO_BIND_ADD_ADDR_ULEB: 160>
DO_BIND_ULEB_TIMES_SKIPPING_ULEB = <BIND_OPCODES.DO_BIND_ULEB_TIMES_SKIPPING_ULEB: 192>
SET_ADDEND_SLEB = <BIND_OPCODES.SET_ADDEND_SLEB: 96>
SET_DYLIB_ORDINAL_IMM = <BIND_OPCODES.SET_DYLIB_ORDINAL_IMM: 16>
SET_DYLIB_ORDINAL_ULEB = <BIND_OPCODES.SET_DYLIB_ORDINAL_ULEB: 32>
SET_DYLIB_SPECIAL_IMM = <BIND_OPCODES.SET_DYLIB_SPECIAL_IMM: 48>
SET_SEGMENT_AND_OFFSET_ULEB = <BIND_OPCODES.SET_SEGMENT_AND_OFFSET_ULEB: 112>
SET_SYMBOL_TRAILING_FLAGS_IMM = <BIND_OPCODES.SET_SYMBOL_TRAILING_FLAGS_IMM: 64>
SET_TYPE_IMM = <BIND_OPCODES.SET_TYPE_IMM: 80>
THREADED = <BIND_OPCODES.THREADED: 208>
property name
property value

EXPORT_SYMBOL_KINDS

class lief.MachO.EXPORT_SYMBOL_KINDS(self: lief._lief.MachO.EXPORT_SYMBOL_KINDS, value: int)

Members:

REGULAR

THREAD_LOCAL

ABSOLUTE

ABSOLUTE = <EXPORT_SYMBOL_KINDS.ABSOLUTE: 2>
REGULAR = <EXPORT_SYMBOL_KINDS.REGULAR: 0>
THREAD_LOCAL = <EXPORT_SYMBOL_KINDS.THREAD_LOCAL: 1>
property name
property value

EXPORT_SYMBOL_FLAGS

class lief.MachO.EXPORT_SYMBOL_FLAGS(self: lief._lief.MachO.EXPORT_SYMBOL_FLAGS, value: int)

Members:

WEAK_DEFINITION

REEXPORT

STUB_AND_RESOLVER

REEXPORT = <EXPORT_SYMBOL_FLAGS.REEXPORT: 8>
STUB_AND_RESOLVER = <EXPORT_SYMBOL_FLAGS.STUB_AND_RESOLVER: 16>
WEAK_DEFINITION = <EXPORT_SYMBOL_FLAGS.WEAK_DEFINITION: 4>
property name
property value

VM_PROTECTIONS

class lief.MachO.VM_PROTECTIONS(self: lief._lief.MachO.VM_PROTECTIONS, value: int)

Members:

READ

WRITE

EXECUTE

EXECUTE = <VM_PROTECTIONS.EXECUTE: 4>
READ = <VM_PROTECTIONS.READ: 1>
WRITE = <VM_PROTECTIONS.WRITE: 2>
property name
property value

SYMBOL_ORIGINS

class lief.MachO.SYMBOL_ORIGINS(self: lief._lief.MachO.SYMBOL_ORIGINS, value: int)

Members:

UNKNOWN

DYLD_EXPORT

LC_SYMTAB

DYLD_EXPORT = <SYMBOL_ORIGINS.DYLD_EXPORT: 1>
LC_SYMTAB = <SYMBOL_ORIGINS.LC_SYMTAB: 3>
UNKNOWN = <SYMBOL_ORIGINS.UNKNOWN: 0>
property name
property value

SECTION_FLAGS

class lief.MachO.SECTION_FLAGS(self: lief._lief.MachO.SECTION_FLAGS, value: int)

Members:

PURE_INSTRUCTIONS

NO_TOC

STRIP_STATIC_SYMS

NO_DEAD_STRIP

LIVE_SUPPORT

SELF_MODIFYING_CODE

DEBUG

SOME_INSTRUCTIONS

EXT_RELOC

LOC_RELOC

DEBUG = <SECTION_FLAGS.DEBUG: 33554432>
EXT_RELOC = <SECTION_FLAGS.EXT_RELOC: 512>
LIVE_SUPPORT = <SECTION_FLAGS.LIVE_SUPPORT: 134217728>
LOC_RELOC = <SECTION_FLAGS.LOC_RELOC: 256>
NO_DEAD_STRIP = <SECTION_FLAGS.NO_DEAD_STRIP: 268435456>
NO_TOC = <SECTION_FLAGS.NO_TOC: 1073741824>
PURE_INSTRUCTIONS = <SECTION_FLAGS.PURE_INSTRUCTIONS: 2147483648>
SELF_MODIFYING_CODE = <SECTION_FLAGS.SELF_MODIFYING_CODE: 67108864>
SOME_INSTRUCTIONS = <SECTION_FLAGS.SOME_INSTRUCTIONS: 1024>
STRIP_STATIC_SYMS = <SECTION_FLAGS.STRIP_STATIC_SYMS: 536870912>
property name
property value

DYLD_CHAINED_FORMAT

class lief.MachO.DYLD_CHAINED_FORMAT(self: lief._lief.MachO.DYLD_CHAINED_FORMAT, value: int)

Members:

IMPORT

IMPORT_ADDEND

IMPORT_ADDEND64

IMPORT = <DYLD_CHAINED_FORMAT.IMPORT: 1>
IMPORT_ADDEND = <DYLD_CHAINED_FORMAT.IMPORT_ADDEND: 2>
IMPORT_ADDEND64 = <DYLD_CHAINED_FORMAT.IMPORT_ADDEND64: 3>
property name
property value

DYLD_CHAINED_PTR_FORMAT

class lief.MachO.DYLD_CHAINED_PTR_FORMAT(self: lief._lief.MachO.DYLD_CHAINED_PTR_FORMAT, value: int)

Members:

PTR_ARM64E

PTR_64

PTR_32

PTR_32_CACHE

PTR_32_FIRMWARE

PTR_64_OFFSET

PTR_ARM64E_KERNEL

PTR_64_KERNEL_CACHE

PTR_ARM64E_USERLAND

PTR_ARM64E_FIRMWARE

PTR_X86_64_KERNEL_CACHE

PTR_ARM64E_USERLAND24

PTR_32 = <DYLD_CHAINED_PTR_FORMAT.PTR_32: 3>
PTR_32_CACHE = <DYLD_CHAINED_PTR_FORMAT.PTR_32_CACHE: 4>
PTR_32_FIRMWARE = <DYLD_CHAINED_PTR_FORMAT.PTR_32_FIRMWARE: 5>
PTR_64 = <DYLD_CHAINED_PTR_FORMAT.PTR_64: 2>
PTR_64_KERNEL_CACHE = <DYLD_CHAINED_PTR_FORMAT.PTR_64_KERNEL_CACHE: 8>
PTR_64_OFFSET = <DYLD_CHAINED_PTR_FORMAT.PTR_64_OFFSET: 6>
PTR_ARM64E = <DYLD_CHAINED_PTR_FORMAT.PTR_ARM64E: 1>
PTR_ARM64E_FIRMWARE = <DYLD_CHAINED_PTR_FORMAT.PTR_ARM64E_FIRMWARE: 10>
PTR_ARM64E_KERNEL = <DYLD_CHAINED_PTR_FORMAT.PTR_ARM64E_KERNEL: 7>
PTR_ARM64E_USERLAND = <DYLD_CHAINED_PTR_FORMAT.PTR_ARM64E_USERLAND: 9>
PTR_ARM64E_USERLAND24 = <DYLD_CHAINED_PTR_FORMAT.PTR_ARM64E_USERLAND24: 12>
PTR_X86_64_KERNEL_CACHE = <DYLD_CHAINED_PTR_FORMAT.PTR_X86_64_KERNEL_CACHE: 11>
property name
property value