MachO¶

Parser¶

lief.MachO.parse(*args) → object | lief.MachO.FatBinary¶

lief.MachO.parse(raw: list[int], config: lief._lief.MachO.ParserConfig = <lief._lief.MachO.ParserConfig object at 0x7f5b02c90b10>) → lief._lief.MachO.FatBinary

lief.MachO.parse(io: object, config: lief._lief.MachO.ParserConfig = <lief._lief.MachO.ParserConfig object at 0x7f5b02c90b50>) → object

Overloaded function.

1. parse(filename: str, config: lief._lief.MachO.ParserConfig = <lief._lief.MachO.ParserConfig object at 0x7f5b02c90af0>) -> lief._lief.MachO.FatBinary

   Parse the given binary and return a FatBinary object

   One can configure the parsing with the config parameter. See ParserConfig,

2. parse(raw: list[int], config: lief._lief.MachO.ParserConfig = <lief._lief.MachO.ParserConfig object at 0x7f5b02c90b10>) -> lief._lief.MachO.FatBinary

   Parse the given binary (from raw bytes) and return a FatBinary object

   One can configure the parsing with the config parameter. See ParserConfig

3. parse(io: object, config: lief._lief.MachO.ParserConfig = <lief._lief.MachO.ParserConfig object at 0x7f5b02c90b50>) -> object

   Parse the given binary from a Python IO interface and return a FatBinary object

   One can configure the parsing with the config parameter. See ParserConfig

class lief.MachO.ParserConfig(self)¶

This class is used to tweak the MachO Parser (Parser)

deep = <lief._lief.MachO.ParserConfig object>¶

property fix_from_memory → bool¶

When parsing Mach-O from memory, this option can be used to undo relocations and symbols bindings.

When activated, this option requires parse_dyld_bindings and parse_dyld_rebases to be enabled.

full_dyldinfo(self, flag: bool) → lief.MachO.ParserConfig¶

If flag is set to true, Exports, Bindings and Rebases opcodes are parsed.

Warning

Enabling this flag can slow down the parsing

property parse_dyld_bindings → bool¶

Parse the Dyld binding opcodes

property parse_dyld_exports → bool¶

Parse the Dyld export trie

property parse_dyld_rebases → bool¶

Parse the Dyld rebase opcodes

quick = <lief._lief.MachO.ParserConfig object>¶

fatbinary_1 = lief.MachO.parse("/usr/bin/ls", config=lief.MachO.ParserConfig.deep)
# or
fatbinary_2 = lief.MachO.parse("/usr/bin/ls", config=lief.MachO.ParserConfig.quick)

FatBinary¶

class lief.MachO.FatBinary¶

Class which represent a Mach-O (fat) binary This object is also used for representing Mach-O binaries that are NOT FAT

at(self, index: int) → lief.MachO.Binary¶

Return the Binary at the given index or None if it is not present

class it_binaries¶

Iterator over lief._lief.MachO.Binary

raw(self) → list[int]¶

Build a Mach-O universal binary and return its bytes

property size → int¶

Number of Binary registred

take(self, cpu: lief.MachO.CPU_TYPES) → lief.MachO.Binary¶

Return the Binary that matches the given CPU_TYPES

write(self, filename: str) → None¶

Build a Mach-O universal binary

Binary¶

class lief.MachO.Binary¶

Class which represents a MachO binary

class VA_TYPES¶

AUTO = lief._lief.VA_TYPES.AUTO¶

RVA = lief._lief.VA_TYPES.RVA¶

VA = lief._lief.VA_TYPES.VA¶

property abstract → object¶

Return the abstract representation of the current binary (lief.Binary)

add(*args) → lief.MachO.LoadCommand¶

Overloaded function.

1. add(self, dylib_command: lief._lief.MachO.DylibCommand) -> lief._lief.MachO.LoadCommand

Add a new DylibCommand

2. add(self, segment: lief._lief.MachO.SegmentCommand) -> lief._lief.MachO.LoadCommand

Add a new SegmentCommand

3. add(self, load_command: lief._lief.MachO.LoadCommand) -> lief._lief.MachO.LoadCommand

Add a new LoadCommand

4. add(self, load_command: lief._lief.MachO.LoadCommand, index: int) -> lief._lief.MachO.LoadCommand

Add a new LoadCommand at index

add_exported_function(self, address: int, name: str) → lief.MachO.ExportInfo¶

Add a new export in the binary

add_library(self, library_name: str) → lief.MachO.LoadCommand¶

Add a new library dependency

add_local_symbol(self, address: int, name: str) → lief.MachO.Symbol¶

Add a new a new symbol in the LC_SYMTAB

add_section(*args) → lief.MachO.Section¶

Overloaded function.

1. add_section(self, segment: lief._lief.MachO.SegmentCommand, section: lief._lief.MachO.Section) -> lief._lief.MachO.Section

Add a new Section in the given SegmentCommand

2. add_section(self, section: lief._lief.MachO.Section) -> lief._lief.MachO.Section

Add a new Section within the __TEXT segment

property build_version → lief.MachO.BuildVersion¶

Return the binary’s BuildVersion if any, or None

can_remove(self, symbol: lief.MachO.Symbol) → bool¶

Check if the given symbol can be safely removed.

can_remove_symbol(self, symbol_name: str) → bool¶

Check if the given symbol name can be safely removed.

property code_signature → lief.MachO.CodeSignature¶

Return the binary’s CodeSignature if any, or None

property code_signature_dir → lief.MachO.CodeSignatureDir¶

Return the binary’s CodeSignatureDir if any, or None

property commands → lief.MachO.Binary.it_commands¶

Return an iterator over the binary’s Command

property concrete → object¶

The concrete representation of the binary. Basically, this property cast a lief.Binary into a lief.PE.Binary, lief.ELF.Binary or lief.MachO.Binary.

See also: lief.Binary.abstract

property ctor_functions → list[lief.Function]¶

Constructor functions that are called prior to any other functions

property data_in_code → lief.MachO.DataInCode¶

Return the binary’s DataInCode if any, or None

property dyld_chained_fixups → lief.MachO.DyldChainedFixups¶

Return the binary’s DyldChainedFixups if any, or None

property dyld_environment → lief.MachO.DyldEnvironment¶

Return the binary’s DyldEnvironment if any, or None

property dyld_exports_trie → lief.MachO.DyldExportsTrie¶

Return the binary’s DyldExportsTrie if any, or None

property dyld_info → lief.MachO.DyldInfo¶

Return the binary’s DyldInfo if any, or None

property dylinker → lief.MachO.DylinkerCommand¶

Return the binary’s DylinkerCommand if any, or None

property dynamic_symbol_command → lief.MachO.DynamicSymbolCommand¶

Return the binary’s DynamicSymbolCommand if any, or None

property encryption_info → lief.MachO.EncryptionInfo¶

Return the binary’s EncryptionInfo if any, or None

property entrypoint → int¶

Binary’s entrypoint

property exported_functions → list[lief.Function]¶

Return the binary’s exported Function

property exported_symbols → lief.MachO.Binary.it_filter_symbols¶

Return the binary’s Symbol which are exported

extend(self, load_command: lief.MachO.LoadCommand, size: int) → bool¶

Extend a LoadCommand by size

extend_segment(self, segment_command: lief.MachO.SegmentCommand, size: int) → bool¶

Extend the content of the given SegmentCommand by size

property fat_offset → int¶

Return binary’s fat offset. 0 if not relevant.

property fileset_name → str¶

Name associated with the LC_FILESET_ENTRY binary

property filesets → lief.MachO.FatBinary.it_binaries¶

Return binary’s Filesets

property format → lief.EXE_FORMATS¶

File format EXE_FORMATS of the underlying binary.

property function_starts → lief.MachO.FunctionStarts¶

Return the binary’s FunctionStarts if any, or None

property functions → list[lief.Function]¶

Return list of all Function found

get(self, type: lief.MachO.LOAD_COMMAND_TYPES) → lief.MachO.LoadCommand¶

Return the first LoadCommand having the given LOAD_COMMAND_TYPES or None if it is not present.

get_content_from_virtual_address(self, virtual_address: int, size: int, va_type: lief.Binary.VA_TYPES) → memoryview¶

Return the content located at the provided virtual address. The virtual address is specified in the first argument and size to read (in bytes) in the second.

If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default, it is set to AUTO.

get_function_address(self, function_name: str) → object¶

Return the address of the given function name

get_section(*args) → lief.MachO.Section¶

Overloaded function.

1. get_section(self, name: str) -> lief._lief.MachO.Section

Return the section from the given name or None if the section does not exist

2. get_section(self, segname: str, secname: str) -> lief._lief.MachO.Section

   Return the section from the segment with the name given in the first parameter and with the section’s name provided in the second parameter. If the section cannot be found, it returns a nullptr

get_segment(self, name: str) → lief.MachO.SegmentCommand¶

Return the SegmentCommand from the given name

get_symbol(self, name: str) → lief.MachO.Symbol¶

Return the Symbol from the given name

has(self, type: lief.MachO.LOAD_COMMAND_TYPES) → bool¶

Check if the current binary has a LoadCommand with the given LOAD_COMMAND_TYPES

property has_build_version → bool¶

True if the binary has a BuildVersion command

property has_code_signature → bool¶

True if the binary is signed (i.e. has a CodeSignature command)

property has_code_signature_dir → bool¶

True if the binary is signed (i.e. has a CodeSignatureDir command) with the command LC_DYLIB_CODE_SIGN_DRS

property has_data_in_code → bool¶

True if the binary has a DataInCode command

property has_dyld_chained_fixups → bool¶

True if the binary has a DyldChainedFixups command

property has_dyld_environment → bool¶

True if the binary has a DyldEnvironment command

property has_dyld_exports_trie → bool¶

True if the binary has a DyldExportsTrie command

property has_dyld_info → bool¶

True if the binary has a DyldInfo command.

property has_dylinker → bool¶

True if the binary has a DylinkerCommand command.

property has_dynamic_symbol_command → bool¶

True if the binary has a DynamicSymbolCommand command.

property has_encryption_info → bool¶

True if the binary has a EncryptionInfo command

property has_entrypoint → bool¶

True if the binary has an entrypoint.

Basically for libraries it will return false

property has_filesets → bool¶

Return True if the binary has filesets

property has_function_starts → bool¶

True if the binary has a FunctionStarts command.

property has_linker_opt_hint → bool¶

True if the binary embeds the Linker optimization hint command (LinkerOptHint)

property has_main_command → bool¶

True if the binary has a MainCommand command.

property has_nx → bool¶

Check if the binary has NX protection (non executable stack)

property has_rpath → bool¶

True if the binary has a RPathCommand command.

has_section(self, name: str) → bool¶

Check if a section with the given name exists

has_segment(self, name: str) → bool¶

Check if a SegmentCommand with the given name exists

property has_segment_split_info → bool¶

True if the binary has a SegmentSplitInfo command

property has_source_version → bool¶

True if the binary has a SourceVersion command.

property has_sub_framework → bool¶

True if the binary has a SubFramework command

has_symbol(self, name: str) → bool¶

Check if a Symbol with the given name exists

property has_symbol_command → bool¶

True if the binary has a SymbolCommand command.

property has_thread_command → bool¶

True if the binary has a ThreadCommand command.

property has_two_level_hints → bool¶

True if the binary embeds the Two Level Hint command (TwoLevelHints)

property has_uuid → bool¶

True if the binary has a UUIDCommand command.

property has_version_min → bool¶

True if the binary has a VersionMin command.

property header → lief.MachO.Header¶

Return binary’s Header

property imagebase → int¶

Return the binary’s imagebase which is the base address where segments are mapped (without the ASLR). 0 if not relevant.

property imported_functions → list[lief.Function]¶

Return the binary’s imported Function (name)

property imported_symbols → lief.MachO.Binary.it_filter_symbols¶

Return the binary’s Symbol which are imported

property is_pie → bool¶

Check if the binary is position independent

is_valid_addr(self, address: int) → bool¶

Check if the given address is encompassed between the range of virtual addresses.

See: va_ranges

class it_commands¶

Iterator over lief._lief.MachO.LoadCommand

class it_filter_symbols¶

Iterator over lief._lief.MachO.Symbol

class it_libraries¶

Iterator over lief._lief.MachO.DylibCommand

class it_relocations¶

Iterator over lief._lief.MachO.Relocation

class it_rpaths¶

Iterator over lief._lief.MachO.RPathCommand

class it_sections¶

Iterator over lief._lief.MachO.Section

class it_segments¶

Iterator over lief._lief.MachO.SegmentCommand

class it_symbols¶

Iterator over lief._lief.MachO.Symbol

property libraries → lief.MachO.Binary.it_libraries¶

Return an iterator over the binary’s DylibCommand

property linker_opt_hint → lief.MachO.LinkerOptHint¶

Return the binary’s LinkerOptHint if any, or None

property main_command → lief.MachO.MainCommand¶

Return the binary’s MainCommand if any, or None

property off_ranges → lief.MachO.Binary.range_t¶

Return the range of offsets as a tuple (off_start, off_end)

offset_to_virtual_address(self, offset: int, slide: int) → object¶

Convert an offset into a virtual address.

property page_size → int¶

Return the binary’s page size

patch_address(*args) → None¶

Overloaded function.

1. patch_address(self, address: int, patch_value: list[int], va_type: lief._lief.Binary.VA_TYPES = lief._lief.VA_TYPES.AUTO) -> None

   Patch the address with the given list of bytes. The virtual address is specified in the first argument and the content in the second (as a list of bytes).

   If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default, it is set to AUTO.

2. patch_address(self, address: int, patch_value: int, size: int = 8, va_type: lief._lief.Binary.VA_TYPES = lief._lief.VA_TYPES.AUTO) -> None

   Patch the address with the given integer value. The virtual address is specified in the first argument, the integer in the second and the integer’s size of in third one.

   If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default, it is set to AUTO.

class range_t¶

property end → int¶

property start → int¶

property relocations → lief.MachO.Binary.it_relocations¶

Return an iterator over binary’s Relocation

remove(*args) → bool¶

Overloaded function.

1. remove(self, load_command: lief._lief.MachO.LoadCommand) -> bool

Remove a LoadCommand

2. remove(self, type: lief._lief.MachO.LOAD_COMMAND_TYPES) -> bool

Remove all the LoadCommand having the given LOAD_COMMAND_TYPES

3. remove(self, symbol: lief._lief.MachO.Symbol) -> bool

Remove the given Symbol

remove_command(self, index: int) → bool¶

Remove the LoadCommand at the given index

remove_section(*args) → None¶

Overloaded function.

1. remove_section(self, name: str, clear: bool = False) -> None

Remove the section with the given name

2. remove_section(self, segname: str, secname: str, clear: bool = False) -> None

   Remove the section from the segment with the name given in the first parameter and with the section’s name provided in the second parameter.

remove_signature(self) → bool¶

Remove the CodeSignature (if any)

remove_symbol(self, name: str) → bool¶

Remove all symbol(s) with the given name

property rpath → lief.MachO.RPathCommand¶

Return the binary’s RPathCommand if any, or None

property rpaths → lief.MachO.Binary.it_rpaths¶

Return an iterator over the binary’s RPathCommand

section_from_offset(self, arg: int) → lief.MachO.Section¶

Return the Section which encompasses the offset

section_from_virtual_address(self, arg: int) → lief.MachO.Section¶

Return the Section which encompasses the virtual address

property sections → lief.MachO.Binary.it_sections¶

Return an iterator over the binary’s Section

segment_from_offset(self, arg: int) → lief.MachO.SegmentCommand¶

Return the SegmentCommand which encompasses the offset

segment_from_virtual_address(self, arg: int) → lief.MachO.SegmentCommand¶

Return the SegmentCommand which encompasses the virtual address

property segment_split_info → lief.MachO.SegmentSplitInfo¶

Return the binary’s SegmentSplitInfo if any, or None

property segments → lief.MachO.Binary.it_segments¶

Return an iterator over the binary’s SegmentCommand

shift(self, value: int) → object¶

Shift the content located right after the Load commands table. This operation can be used to add a new command

shift_linkedit(self, value: int) → object¶

Shift the position on the __LINKEDIT data by width

property source_version → lief.MachO.SourceVersion¶

Return the binary’s SourceVersion if any, or None

property sub_framework → lief.MachO.SubFramework¶

Return the binary’s SubFramework if any, or None

property symbol_command → lief.MachO.SymbolCommand¶

Return the binary’s SymbolCommand if any, or None

property symbols → lief.MachO.Binary.it_symbols¶

Return an iterator over the binary’s Symbol

property thread_command → lief.MachO.ThreadCommand¶

Return the binary’s ThreadCommand if any, or None

property two_level_hints → lief.MachO.TwoLevelHints¶

Return the binary’s TwoLevelHints if any, or None

unexport(*args) → bool¶

Overloaded function.

1. unexport(self, name: str) -> bool

Remove the symbol from the export table

2. unexport(self, symbol: lief._lief.MachO.Symbol) -> bool

Remove the symbol from the export table

property unwind_functions → list[lief.Function]¶

Return list of Function found in the __unwind_info section

property uuid → lief.MachO.UUIDCommand¶

Return the binary’s UUIDCommand if any, or None

property va_ranges → lief.MachO.Binary.range_t¶

Return the range of virtual addresses as a tuple (va_start, va_end)

property version_min → lief.MachO.VersionMin¶

Return the binary’s VersionMin if any, or None

virtual_address_to_offset(self, virtual_address: int) → object¶

Convert the virtual address to an offset in the binary

property virtual_size → int¶

Binary’s memory size when mapped

write(self, output: str) → None¶

Rebuild the binary and write and write its content if the file given in parameter

xref(self, virtual_address: int) → list[int]¶

Return all virtual addresses that use the address given in parameter

Header¶

class lief.MachO.Header(self)¶

Class that represents the Mach-O header

add(self, flag: lief.MachO.HEADER_FLAGS) → None¶

Add the given HEADER_FLAGS

property cpu_subtype → int¶

Return the CPU subtype supported by the Mach-O binary. For ARM architectures, this value could represent the minimum version for which the Mach-O binary has been compiled for.

property cpu_type → lief.MachO.CPU_TYPES¶

Target CPU ( CPU_TYPES)

property file_type → lief.MachO.FILE_TYPES¶

Binary’s type ( FILE_TYPES)

property flags → int¶

Binary’s flags ( HEADER_FLAGS)

property flags_list → set[lief.MachO.HEADER_FLAGS]¶

HEADER_FLAGS as a list

has(self, flag: lief.MachO.HEADER_FLAGS) → bool¶

True if the given HEADER_FLAGS is in the flags

property magic → lief.MachO.MACHO_TYPES¶

The Mach-O magic bytes. These bytes determine whether it is a 32 bits Mach-O, a 64 bits Mach-O files etc.

property nb_cmds → int¶

Number of LoadCommand

remove(self, flag: lief.MachO.HEADER_FLAGS) → None¶

Remove the given HEADER_FLAGS

property reserved → int¶

According to the official documentation, a reserved value

property sizeof_cmds → int¶

Size of all LoadCommand

Section¶

class lief.MachO.Section(self)¶

class lief.MachO.Section(self, section_name: str)

class lief.MachO.Section(self, section_name: str, content: list[int])

Class that represents a Mach-O section

Overloaded function.

2. __init__(self, section_name: str) -> None

Constructor from a section’s name

3. __init__(self, section_name: str, content: list[int]) -> None

Constructor from a section’s name and its content

add(self, flag: lief.MachO.SECTION_FLAGS) → None¶

Add the given SECTION_FLAGS

property alignment → int¶

Section’s alignment as a power of 2

property content → memoryview¶

Section’s content

property entropy → float¶

Section’s entropy

property flags → int¶

Section’s flags masked with SECTION_FLAGS_MASK (see: MACHO_SECTION_FLAGS)

property flags_list → set[lief.MachO.SECTION_FLAGS]¶

property fullname → bytes¶

Return the fullname of the section including the trailing bytes

has(self, flag: lief.MachO.SECTION_FLAGS) → bool¶

Check if the section has the given SECTION_FLAGS

property has_segment → bool¶

True if the current section has a segment associated with

class it_relocations¶

Iterator over lief._lief.MachO.Relocation

property name → object¶

Section’s name

property numberof_relocations → int¶

Number of relocations associated with this section

property offset → int¶

Section’s file offset

property relocation_offset → int¶

Offset of the relocation table. This value should be 0 for executable and libraries as the relocations are managed by the lief.MachO.DyldInfo.rebase

Other the other hand, for object files (.o) this value should not be 0

property relocations → lief.MachO.SegmentCommand.it_relocations¶

Iterator over the Relocation (if any)

remove(self, flag: lief.MachO.SECTION_FLAGS) → None¶

Remove the given SECTION_FLAGS

property reserved1 → int¶

According to the official loader.h file, this value is reserved for offset or index

property reserved2 → int¶

According to the official loader.h file, this value is reserved for offset or index

property reserved3 → int¶

According to the official loader.h file, this value is reserved for offset or index

search(*args) → object¶

Overloaded function.

1. search(self, number: int, pos: int = 0, size: int = 0) -> object

Look for integer within the current section

2. search(self, str: str, pos: int = 0) -> object

Look for string within the current section

3. search(self, bytes: bytes, pos: int = 0) -> object

Look for the given bytes within the current section

search_all(*args) → list[int]¶

Overloaded function.

1. search_all(self, number: int, size: int = 0) -> list[int]

Look for all integers within the current section

2. search_all(self, str: str) -> list[int]

Look for all strings within the current section

property segment → lief.MachO.SegmentCommand¶

SegmentCommand associated with the section or None if not present

property segment_name → str¶

The segment name associated with the section

property size → int¶

Section’s size

property type → lief.MachO.SECTION_TYPES¶

Type of the section. This value can help to determine the purpose of the section (c.f. MACHO_SECTION_TYPES)

property virtual_address → int¶

Section’s virtual address

SegmentCommand¶

class lief.MachO.SegmentCommand(self)¶

class lief.MachO.SegmentCommand(self, arg: str, /)

class lief.MachO.SegmentCommand(self, arg0: str, arg1: list[int], /)

Class which represents a LOAD_COMMAND_TYPES::LC_SEGMENT / LOAD_COMMAND_TYPES::LC_SEGMENT_64 command

add_section(self, section: lief.MachO.Section) → lief.MachO.Section¶

property command → lief.MachO.LOAD_COMMAND_TYPES¶

Command type ( LOAD_COMMAND_TYPES)

property command_offset → int¶

Offset of the command within the Load Command Table

property content → memoryview¶

Segment’s content

property data → memoryview¶

Command’s data

property file_offset → int¶

Segment’s file offset

property file_size → int¶

Segment’s file size

property flags → int¶

Segment’s flags

get_section(self, name: str) → lief.MachO.Section¶

Get the Section with the given name

has(self, section: lief.MachO.Section) → bool¶

Check if the given Section belongs to the current segment

has_section(self, section_name: str) → bool¶

Check if the given section name belongs to the current segment

property index → int¶

Relative index of the segment in the segment table

property init_protection → int¶

Segment’s initial protection

class it_relocations¶

Iterator over lief._lief.MachO.Relocation

class it_sections¶

Iterator over lief._lief.MachO.Section

property max_protection → int¶

Segment’s max protection

property name → object¶

Segment’s name

property numberof_sections → int¶

Number of sections in this segment

property relocations → lief.MachO.SegmentCommand.it_relocations¶

Segment’s relocations

property sections → lief.MachO.SegmentCommand.it_sections¶

Segment’s sections

property size → int¶

Size of the command (should be greather than sizeof(load_command))

property virtual_address → int¶

Segment’s virtual address

property virtual_size → int¶

Segment’s virtual size

LoadCommand¶

class lief.MachO.LoadCommand(self)¶

Based class for the Mach-O load commands

property command → lief.MachO.LOAD_COMMAND_TYPES¶

Command type ( LOAD_COMMAND_TYPES)

property command_offset → int¶

Offset of the command within the Load Command Table

property data → memoryview¶

Command’s data

property size → int¶

Size of the command (should be greather than sizeof(load_command))

DylibCommand¶

class lief.MachO.DylibCommand¶

Class which represents a library dependency

property command → lief.MachO.LOAD_COMMAND_TYPES¶

Command type ( LOAD_COMMAND_TYPES)

property command_offset → int¶

Offset of the command within the Load Command Table

property compatibility_version → list[int]¶

Library’s compatibility version

property current_version → list[int]¶

Library’s current version

property data → memoryview¶

Command’s data

id_dylib(name: str, timestamp: int, current_version: int, compat_version: int) → lief.MachO.DylibCommand = <nanobind.nb_func object>¶

lazy_load_dylib(name: str, timestamp: int, current_version: int, compat_version: int) → lief.MachO.DylibCommand = <nanobind.nb_func object>¶

load_dylib(name: str, timestamp: int, current_version: int, compat_version: int) → lief.MachO.DylibCommand = <nanobind.nb_func object>¶

load_upward_dylib(name: str, timestamp: int, current_version: int, compat_version: int) → lief.MachO.DylibCommand = <nanobind.nb_func object>¶

property name → str¶

Library’s name

reexport_dylib(name: str, timestamp: int, current_version: int, compat_version: int) → lief.MachO.DylibCommand = <nanobind.nb_func object>¶

property size → int¶

Size of the command (should be greather than sizeof(load_command))

property timestamp → int¶

Library’s timestamp

weak_lib(name: str, timestamp: int, current_version: int, compat_version: int) → lief.MachO.DylibCommand = <nanobind.nb_func object>¶

DylinkerCommand¶

class lief.MachO.DylinkerCommand(self, arg: str, /)¶

Class that represents the Mach-O linker, also named loader Most of the time, name returns /usr/lib/dyld

property command → lief.MachO.LOAD_COMMAND_TYPES¶

Command type ( LOAD_COMMAND_TYPES)

property command_offset → int¶

Offset of the command within the Load Command Table

property data → memoryview¶

Command’s data

property name → str¶

Path to the loader/linker

property size → int¶

Size of the command (should be greather than sizeof(load_command))

UUIDCommand¶

class lief.MachO.UUIDCommand¶

Class that represents the UUID command

property command → lief.MachO.LOAD_COMMAND_TYPES¶

Command type ( LOAD_COMMAND_TYPES)

property command_offset → int¶

Offset of the command within the Load Command Table

property data → memoryview¶

Command’s data

property size → int¶

Size of the command (should be greather than sizeof(load_command))

property uuid → list[int]¶

UUID as a list

MainCommand¶

class lief.MachO.MainCommand(self, arg0: int, arg1: int, /)¶

Class that represent the LC_MAIN command. This kind of command can be used to determine the entrypoint of an executable

property command → lief.MachO.LOAD_COMMAND_TYPES¶

Command type ( LOAD_COMMAND_TYPES)

property command_offset → int¶

Offset of the command within the Load Command Table

property data → memoryview¶

Command’s data

property entrypoint → int¶

Offset of the main function relative to the __TEXT segment

property size → int¶

Size of the command (should be greather than sizeof(load_command))

property stack_size → int¶

The initial stack size (if not 0)

Symbol¶

class lief.MachO.Symbol(self)¶

Class that represents a Symbol in a Mach-O file.

A Mach-O symbol can come from:

1. The symbols command (LC_SYMTAB / SymbolCommand)

2. The Dyld Export trie

3. The Dyld Symbol bindings

class CATEGORY¶

EXTERNAL = lief._lief.MachO.CATEGORY.EXTERNAL¶

INDIRECT_ABS = lief._lief.MachO.CATEGORY.INDIRECT_ABS¶

INDIRECT_LOCAL = lief._lief.MachO.CATEGORY.INDIRECT_LOCAL¶

LOCAL = lief._lief.MachO.CATEGORY.LOCAL¶

NONE = lief._lief.MachO.CATEGORY.NONE¶

UNDEFINED = lief._lief.MachO.CATEGORY.UNDEFINED¶

from_value(arg: int) → lief.MachO.Symbol.CATEGORY = <nanobind.nb_func object>¶

property value → int¶

The underlying integer value

property binding_info → lief.MachO.BindingInfo¶

BindingInfo associated with the symbol if any, or None

property category → lief.MachO.Symbol.CATEGORY¶

Category of the symbol according to the LC_DYSYMTAB command

property demangled_name → str¶

Symbol’s unmangled name

property description → int¶

Return information about the symbol (SYMBOL_DESCRIPTIONS)

property export_info → lief.MachO.ExportInfo¶

ExportInfo associated with the symbol if any, or None

property has_binding_info → bool¶

True if the symbol has an BindingInfo associated with

property has_export_info → bool¶

True if the symbol has an ExportInfo associated with

property name → object¶

Symbol’s name

property numberof_sections → int¶

It returns the number of sections in which this symbol can be found. If the symbol can’t be found in any section, it returns 0 (NO_SECT)

property origin → lief.MachO.SYMBOL_ORIGINS¶

Return the SYMBOL_ORIGINS of this symbol

property size → int¶

Symbol’s size

property type → int¶

property value → int¶

Symbol’s value

Symbol Command¶

class lief.MachO.SymbolCommand(self)¶

Class that represents the LC_SYMTAB command

property command → lief.MachO.LOAD_COMMAND_TYPES¶

Command type ( LOAD_COMMAND_TYPES)

property command_offset → int¶

Offset of the command within the Load Command Table

property data → memoryview¶

Command’s data

property numberof_symbols → int¶

Number of symbols registered

property size → int¶

Size of the command (should be greather than sizeof(load_command))

property strings_offset → int¶

Offset from the start of the file to the string table

property strings_size → int¶

Size of the size string table

property symbol_offset → int¶

Offset from the start of the file to the n_list associated with the command

Dynamic Symbol Command¶

class lief.MachO.DynamicSymbolCommand¶

Class that represents the LC_DYSYMTAB command. This command completes the LC_SYMTAB (SymbolCommand) to provide a better granularity over the symbols layout.

property command → lief.MachO.LOAD_COMMAND_TYPES¶

Command type ( LOAD_COMMAND_TYPES)

property command_offset → int¶

Offset of the command within the Load Command Table

property data → memoryview¶

Command’s data

property external_reference_symbol_offset → int¶

Byte offset from the start of the file to the external reference table data. This field seems unused by recent Mach-O loader and should be set to 0

property external_relocation_offset → int¶

Byte offset from the start of the file to the module table data. This field seems unused by recent Mach-O loader and should be set to 0

property idx_external_define_symbol → int¶

Index of the first symbol in the group of defined external symbols.

property idx_local_symbol → int¶

Index of the first symbol in the group of local symbols.

property idx_undefined_symbol → int¶

Index of the first symbol in the group of undefined external symbols.

property indirect_symbol_offset → int¶

Byte offset from the start of the file to the indirect symbol table data.

Indirect symbol table is used by the loader to speed-up symbol resolution during the lazy binding process

References:

• dyld-519.2.1/src/ImageLoaderMachOCompressed.cpp

• dyld-519.2.1/src/ImageLoaderMachOClassic.cpp

property local_relocation_offset → int¶

Byte offset from the start of the file to the local relocation table data. This field seems unused by recent Mach-O loader and should be set to 0

property module_table_offset → int¶

Byte offset from the start of the file to the module table data. This field seems unused by recent Mach-O loader and should be set to 0

property nb_external_define_symbols → int¶

Number of symbols in the group of defined external symbols.

property nb_external_reference_symbols → int¶

Number of entries in the external reference table. This field seems unused by recent Mach-O loader and should be set to 0.

property nb_external_relocations → int¶

Number of entries in the external relocation table. This field seems unused by recent Mach-O loader and should be set to 0

property nb_indirect_symbols → int¶

Number of entries in the indirect symbol table.

property nb_local_relocations → int¶

Number of entries in the local relocation table. This field seems unused by recent Mach-O loader and should be set to 0

property nb_local_symbols → int¶

Number of symbols in the group of local symbols.

property nb_module_table → int¶

Number of entries in the module table. This field seems unused by recent Mach-O loader and should be set to 0.

property nb_toc → int¶

Number of entries in the table of contents Should be set to 0 on recent Mach-O

property nb_undefined_symbols → int¶

Number of symbols in the group of undefined external symbols.

property size → int¶

Size of the command (should be greather than sizeof(load_command))

property toc_offset → int¶

Byte offset from the start of the file to the table of contents data. Table of content is used by legacy Mach-O loader and this field should be set to 0

Dyld Info¶

class lief.MachO.DyldInfo¶

Class that represents the LC_DYLD_INFO and LC_DYLD_INFO_ONLY commands

property bind → tuple[int, int]¶

Bind information as a tuple (offset, size)

Dyld binds an image during the loading process, if the image requires any pointers to be initialized to symbols in other images. The rebase information is a stream of byte sized opcodes for which symbolic names start with BIND_OPCODE_.

Conceptually the bind information is a table of tuples: (seg-index, seg-offset, type, symbol-library-ordinal, symbol-name, addend) The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like for runs of pointers initialzed to the same value can be encoded in a few bytes.

See also

/usr/include/mach-o/loader.h

property bind_opcodes → memoryview¶

Return the binding’s opcodes as list of bytes

property bindings → lief.MachO.DyldInfo.it_binding_info¶

Return an iterator over Dyld’s BindingInfo

property command → lief.MachO.LOAD_COMMAND_TYPES¶

Command type ( LOAD_COMMAND_TYPES)

property command_offset → int¶

Offset of the command within the Load Command Table

property data → memoryview¶

Command’s data

property export_info → tuple[int, int]¶

Export information as a tuple (offset, size)

The symbols exported by a dylib are encoded in a trie. This is a compact representation that factors out common prefixes.

It also reduces LINKEDIT pages in RAM because it encodes all information (name, address, flags) in one small, contiguous range. The export area is a stream of nodes. The first node sequentially is the start node for the trie.

Nodes for a symbol start with a byte that is the length of the exported symbol information for the string so far. If there is no exported symbol, the byte is zero. If there is exported info, it follows the length byte. The exported info normally consists of a flags and offset both encoded in uleb128. The offset is location of the content named by the symbol. It is the offset from the mach_header for the image.

After the initial byte and optional exported symbol information is a byte of how many edges (0-255) that this node has leaving it, followed by each edge. Each edge is a zero terminated cstring of the addition chars in the symbol, followed by a uleb128 offset for the node that edge points to.

See also

/usr/include/mach-o/loader.h

property export_trie → memoryview¶

Return Export’s trie as list of bytes

property exports → lief.MachO.DyldInfo.it_export_info¶

Return an iterator over Dyld’s ExportInfo

class it_binding_info¶

Iterator over lief._lief.MachO.DyldBindingInfo

class it_export_info¶

Iterator over lief._lief.MachO.ExportInfo

property lazy_bind → tuple[int, int]¶

Lazy Bind information as a tuple (offset, size)

Some uses of external symbols do not need to be bound immediately. Instead they can be lazily bound on first use. The lazy_bind are contains a stream of BIND opcodes to bind all lazy symbols. Normal use is that dyld ignores the lazy_bind section when loading an image. Instead the static linker arranged for the lazy pointer to initially point to a helper function which pushes the offset into the lazy_bind area for the symbol needing to be bound, then jumps to dyld which simply adds the offset to lazy_bind_off to get the information on what to bind.

See also

/usr/include/mach-o/loader.h

property lazy_bind_opcodes → memoryview¶

Return lazy binding’s opcodes as list of bytes

property rebase → tuple[int, int]¶

Rebase information as a tuple (offset, size)

Dyld rebases an image whenever dyld loads it at an address different from its preferred address. The rebase information is a stream of byte sized opcodes for which symbolic names start with REBASE_OPCODE_.

Conceptually the rebase information is a table of tuples: (seg-index, seg-offset, type)

The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like “every n’th offset for m times” can be encoded in a few bytes

See also

/usr/include/mach-o/loader.h

property rebase_opcodes → memoryview¶

Return the rebase’s opcodes as list of bytes

set_bind_offset(self, offset: int) → None¶

set_bind_size(self, size: int) → None¶

set_export_offset(self, offset: int) → None¶

set_export_size(self, size: int) → None¶

set_lazy_bind_offset(self, offset: int) → None¶

set_lazy_bind_size(self, size: int) → None¶

set_rebase_offset(self, offset: int) → None¶

set_rebase_size(self, size: int) → None¶

set_weak_bind_offset(self, offset: int) → None¶

set_weak_bind_size(self, size: int) → None¶

property show_bind_opcodes → str¶

Return the bind opcodes in a humman-readable way

property show_export_trie → str¶

Return the export trie in a humman-readable way

property show_lazy_bind_opcodes → str¶

Return the weak bind opcodes in a humman-readable way

property show_rebases_opcodes → str¶

Return the rebase opcodes in a humman-readable way

property show_weak_bind_opcodes → str¶

Return the weak bind opcodes in a humman-readable way

property size → int¶

Size of the command (should be greather than sizeof(load_command))

property weak_bind → tuple[int, int]¶

Weak Bind information as a tuple (offset, size)

Some C++ programs require dyld to unique symbols so that all images in the process use the same copy of some code/data.

This step is done after binding. The content of the weak_bind info is an opcode stream like the bind_info. But it is sorted alphabetically by symbol name. This enables dyld to walk all images with weak binding information in order and look for collisions. If there are no collisions, dyld does no updating. That means that some fixups are also encoded in the bind_info. For instance, all calls to operator new are first bound to libstdc++.dylib using the information in bind_info. Then if some image overrides operator new that is detected when the weak_bind information is processed and the call to operator new is then rebound.

See also

/usr/include/mach-o/loader.h

property weak_bind_opcodes → memoryview¶

Return Weak binding’s opcodes as list of bytes

Function starts¶

class lief.MachO.FunctionStarts¶

Class which represents the LC_FUNCTION_STARTS command

This command is an array of ULEB128 encoded values

add_function(self, address: int) → None¶

Add a new function

property command → lief.MachO.LOAD_COMMAND_TYPES¶

Command type ( LOAD_COMMAND_TYPES)

property command_offset → int¶

Offset of the command within the Load Command Table

property content → memoryview¶

The original content as a bytes stream

property data → memoryview¶

Command’s data

property data_offset → int¶

Offset in the binary where start functions are located

property data_size → int¶

Size of the functions list in the binary

property functions → list[int]¶

Addresses of every function entry point in the executable

This allows functions to exist for which there are no entries in the symbol table.

Warning

The address is relative to the __TEXT segment

property size → int¶

Size of the command (should be greather than sizeof(load_command))

Source Version¶

class lief.MachO.SourceVersion¶

Class that represents the MachO LOAD_COMMAND_TYPES::LC_SOURCE_VERSION This command is used to provide the version of the sources used to build the binary

property command → lief.MachO.LOAD_COMMAND_TYPES¶

Command type ( LOAD_COMMAND_TYPES)

property command_offset → int¶

Offset of the command within the Load Command Table

property data → memoryview¶

Command’s data

property size → int¶

Size of the command (should be greather than sizeof(load_command))

property version → list[int]¶

Version as a tuple of 5 integers

Version Min¶

class lief.MachO.VersionMin¶

Class that wraps the LC_VERSION_MIN_MACOSX, LC_VERSION_MIN_IPHONEOS, … commands

property command → lief.MachO.LOAD_COMMAND_TYPES¶

Command type ( LOAD_COMMAND_TYPES)

property command_offset → int¶

Offset of the command within the Load Command Table

property data → memoryview¶

Command’s data

property sdk → list[int]¶

SDK as a tuple of 3 integers

property size → int¶

Size of the command (should be greather than sizeof(load_command))

property version → list[int]¶

Version as a tuple of 3 integers

Relocation¶

class lief.MachO.Relocation¶

It extends the LIEF lief.Relocation abstract class and it is sub-classed by

1. RelocationObject

2. RelocationDyld

property address → int¶

For OBJECT or (origin is RELOC_TABLE) this is an ” offset from the start of the Section to the item containing the address requiring relocation.

For EXECUTE / DYLIB or (origin is DYLDINFO) this is a virtual_address.

property architecture → lief.MachO.CPU_TYPES¶

CPU_TYPES of the relocation

property has_section → bool¶

True if the relocation has a Section associated with

property has_segment → bool¶

True if the relocation has a SegmentCommand associated with

property has_symbol → bool¶

True if the relocation has a Symbol associated with

property origin → lief.MachO.RELOCATION_ORIGINS¶

RELOCATION_ORIGINS of the relocation

• For OBJECT file it should be RELOC_TABLE

• For EXECUTE or DYLIB it should be DYLDINFO”)

property pc_relative → bool¶

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

property section → lief.MachO.Section¶

Section associated with the relocation if any, or None

property segment → lief.MachO.SegmentCommand¶

SegmentCommand associated with the relocation if any, or None

property size → int¶

Relocation’s size (in bits)

property symbol → lief.MachO.Symbol¶

Symbol associated with the relocation if any, or None

property type → object¶

Type of the relocation according to the architecture and/or origin

If origin is RELOC_TABLE:

See:

• lief.MachO.X86_RELOCATION

• lief.MachO.X86_64_RELOCATION

• lief.MachO.PPC_RELOCATION

• lief.MachO.ARM_RELOCATION

• lief.MachO.ARM64_RELOCATION

If origin is DYLDINFO, the value is associated with REBASE_TYPES.

Relocation Object¶

class lief.MachO.RelocationObject¶

Class that represents a relocation presents in the MachO object file (.o). Usually, this kind of relocation is found in the lief.MachO.Section.

property address → int¶

For OBJECT or (origin is RELOC_TABLE) this is an ” offset from the start of the Section to the item containing the address requiring relocation.

For EXECUTE / DYLIB or (origin is DYLDINFO) this is a virtual_address.

property architecture → lief.MachO.CPU_TYPES¶

CPU_TYPES of the relocation

property has_section → bool¶

True if the relocation has a Section associated with

property has_segment → bool¶

True if the relocation has a SegmentCommand associated with

property has_symbol → bool¶

True if the relocation has a Symbol associated with

property is_scattered → bool¶

True if the relocation is a scattered one

property origin → lief.MachO.RELOCATION_ORIGINS¶

RELOCATION_ORIGINS of the relocation

• For OBJECT file it should be RELOC_TABLE

• For EXECUTE or DYLIB it should be DYLDINFO”)

property pc_relative → bool¶

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

property section → lief.MachO.Section¶

Section associated with the relocation if any, or None

property segment → lief.MachO.SegmentCommand¶

SegmentCommand associated with the relocation if any, or None

property size → int¶

Relocation’s size (in bits)

property symbol → lief.MachO.Symbol¶

Symbol associated with the relocation if any, or None

property type → object¶

Type of the relocation according to the architecture and/or origin

If origin is RELOC_TABLE:

See:

• lief.MachO.X86_RELOCATION

• lief.MachO.X86_64_RELOCATION

• lief.MachO.PPC_RELOCATION

• lief.MachO.ARM_RELOCATION

• lief.MachO.ARM64_RELOCATION

If origin is DYLDINFO, the value is associated with REBASE_TYPES.

property value → int¶

For scattered relocations, the address of the relocatable expression for the item in the file that needs to be updated if the address is changed.

For relocatable expressions with the difference of two section addresses, the address from which to subtract (in mathematical terms, the minuend) is contained in the first relocation entry and the address to subtract (the subtrahend) is contained in the second relocation entry.”,