OAT¶

Utilities¶

lief.is_oat(*args) → bool¶

lief.is_oat(path: str) → bool

lief.is_oat(raw: list[int]) → bool

Overloaded function.

1. is_oat(binary: lief._lief.ELF.Binary) -> bool

Check if the Binary given in parameter is an OAT

2. is_oat(path: str) -> bool

Check if the file given in parameter is an OAT

3. is_oat(raw: list[int]) -> bool

Check if the raw data given in parameter is an OAT

lief.OAT.version(*args) → int¶

lief.OAT.version(file: str) → int

lief.OAT.version(raw: list[int]) → int

Overloaded function.

1. version(binary: lief._lief.ELF.Binary) -> int

Return the OAT version of the Binary given in parameter

2. version(file: str) -> int

Return the OAT version of the file given in parameter

3. version(raw: list[int]) -> int

Return the OAT version of the raw data given in parameter

lief.OAT.android_version(arg: int) → lief.Android.ANDROID_VERSIONS¶

Return the ANDROID_VERSIONS associated with the given OAT version

Parser¶

lief.OAT.parse(*args) → lief.OAT.Binary | None¶

lief.OAT.parse(oat_file: str, vdex_file: str) → lief._lief.OAT.Binary | None

lief.OAT.parse(raw: list[int]) → lief._lief.OAT.Binary | None

lief.OAT.parse(obj: io.IOBase | os.PathLike) → lief._lief.OAT.Binary | None

Overloaded function.

1. parse(oat_file: str) -> Optional[lief._lief.OAT.Binary]

Parse the given OAT file and return a Binary object

2. parse(oat_file: str, vdex_file: str) -> Optional[lief._lief.OAT.Binary]

Parse the given OAT with its VDEX file and return a Binary object

3. parse(raw: list[int]) -> Optional[lief._lief.OAT.Binary]

Parse the given raw data and return a Binary object

Binary¶

class lief.OAT.Binary¶

OAT binary representation

class FORMATS¶

ELF = lief._lief.FORMATS.ELF¶

MACHO = lief._lief.FORMATS.MACHO¶

OAT = lief._lief.FORMATS.OAT¶

PE = lief._lief.FORMATS.PE¶

UNKNOWN = lief._lief.FORMATS.UNKNOWN¶

class PHDR_RELOC¶

AUTO = lief._lief.ELF.PHDR_RELOC.AUTO¶

BSS_END = lief._lief.ELF.PHDR_RELOC.BSS_END¶

FILE_END = lief._lief.ELF.PHDR_RELOC.FILE_END¶

PIE_SHIFT = lief._lief.ELF.PHDR_RELOC.PIE_SHIFT¶

SEGMENT_GAP = lief._lief.ELF.PHDR_RELOC.SEGMENT_GAP¶

class VA_TYPES¶

AUTO = lief._lief.VA_TYPES.AUTO¶

RVA = lief._lief.VA_TYPES.RVA¶

VA = lief._lief.VA_TYPES.VA¶

property abstract → lief.Binary¶

Return the abstract representation of the current binary (lief.Binary)

add(*args) → lief.ELF.Section | lief.ELF.Note | lief.ELF.Segment | lief.ELF.DynamicEntry¶

Overloaded function.

1. add(self, arg: lief._lief.ELF.DynamicEntry, /) -> lief._lief.ELF.DynamicEntry

dynamic_entry

2. add(self, section: lief._lief.ELF.Section, loaded: bool = True) -> lief._lief.ELF.Section

   Add the given Section to the binary.

   If the section does not aim at being loaded in memory, the loaded parameter has to be set to False (default: True)

3. add(self, segment: lief._lief.ELF.Segment, base: int = 0) -> lief._lief.ELF.Segment

Add a new Segment in the binary

4. add(self, note: lief._lief.ELF.Note) -> lief._lief.ELF.Note

Add a new Note in the binary

add_dynamic_relocation(self, relocation: lief.ELF.Relocation) → lief.ELF.Relocation¶

Add a new dynamic relocation.

We consider a dynamic relocation as a relocation which is not plt-related.

See: lief.ELF.Binary.add_pltgot_relocation()

add_dynamic_symbol(self, symbol: lief.ELF.Symbol, symbol_version: lief.ELF.SymbolVersion | None) → lief.ELF.Symbol¶

Add a dynamic Symbol to the binary

The function also takes an optional lief.ELF.SymbolVersion

add_exported_function(self, address: int, name: str) → lief.ELF.Symbol¶

Create a symbol for the function at the given address and create an export

add_library(self, library_name: str) → lief.ELF.DynamicEntryLibrary¶

Add a library with the given name as dependency

add_object_relocation(self, relocation: lief.ELF.Relocation, section: lief.ELF.Section) → lief.ELF.Relocation¶

Add relocation for object file (.o)

The first parameter is the section to add while the second parameter is the Section associated with the relocation.

If there is an error, this function returns a nullptr. Otherwise, it returns the relocation added.”,

add_pltgot_relocation(self, relocation: lief.ELF.Relocation) → lief.ELF.Relocation¶

Add a .plt.got relocation. This kind of relocation is usually associated with a PLT stub that aims at resolving the underlying symbol.

See: lief.ELF.Binary.add_dynamic_relocation()

add_static_symbol(self, symbol: lief.ELF.Symbol) → lief.ELF.Symbol¶

Add a static Symbol to the binary

property classes → lief.OAT.Binary.it_classes¶

Return an iterator over Class

property concrete → lief.ELF.Binary | lief.PE.Binary | lief.MachO.Binary¶

The concrete representation of the binary. Basically, this property cast a lief.Binary into a lief.PE.Binary, lief.ELF.Binary or lief.MachO.Binary.

See also: lief.Binary.abstract

property ctor_functions → list[lief.Function]¶

Constructor functions that are called prior to any other functions

property dex2dex_json_info → str¶

property dex_files → lief.OAT.Binary.it_dex_files¶

Return an iterator over File

property dtor_functions → list[lief.Function]¶

List of the binary destructors (typically, the functions located in the .fini_array)

property dynamic_entries → lief.ELF.Binary.it_dynamic_entries¶

Return an iterator to DynamicEntry entries as a list

property dynamic_relocations → lief.ELF.Binary.it_filter_relocation¶

Return an iterator over dynamics Relocation

property dynamic_symbols → lief.ELF.Binary.it_symbols¶

Return an iterator to dynamic Symbol

property entrypoint → int¶

Binary’s entrypoint

property eof_offset → int¶

Return the last offset used by the ELF binary according to both, the sections table and the segments table.

export_symbol(*args) → lief.ELF.Symbol¶

Overloaded function.

1. export_symbol(self, symbol: lief._lief.ELF.Symbol) -> lief._lief.ELF.Symbol

Export the given symbol and create an entry if it doesn’t exist

2. export_symbol(self, symbol_name: str, value: int = 0) -> lief._lief.ELF.Symbol

Export the symbol with the given name and create an entry if it doesn’t exist

property exported_functions → list[lief.Function]¶

Return the binary’s exported Function

property exported_symbols → lief.ELF.Binary.it_filter_symbols¶

Return dynamic Symbol which are exported

extend(*args) → lief.ELF.Section | lief.ELF.Segment¶

Overloaded function.

1. extend(self, segment: lief._lief.ELF.Segment, size: int) -> lief._lief.ELF.Segment

Extend the given given Segment by the given size

2. extend(self, segment: lief._lief.ELF.Section, size: int) -> lief._lief.ELF.Section

Extend the given given Section by the given size

property format → lief.Binary.FORMATS¶

File format (FORMATS) of the underlying binary.

property functions → list[lief.Function]¶

List of the functions found the in the binary

get(*args) → lief.ELF.Note | lief.ELF.Segment | lief.ELF.Section | lief.ELF.DynamicEntry¶

Overloaded function.

1. get(self, tag: lief._lief.ELF.DYNAMIC_TAGS) -> lief._lief.ELF.DynamicEntry

   Return the first binary’s DynamicEntry from the given DYNAMIC_TAGS.

   It returns None if the dynamic entry can’t be found.

2. get(self, type: lief._lief.ELF.SEGMENT_TYPES) -> lief._lief.ELF.Segment

   Return the first binary’s Segment from the given SEGMENT_TYPES

   It returns None if the segment can’t be found.

3. get(self, type: lief._lief.ELF.Note.TYPE) -> lief._lief.ELF.Note

   Return the first binary’s Note from the given TYPE.

   It returns None if the note can’t be found.

4. get(self, type: lief._lief.ELF.SECTION_TYPES) -> lief._lief.ELF.Section

   Return the first binary’s Section from the given ELF_SECTION_TYPES

   It returns None if the section can’t be found.

get_class(*args) → lief.OAT.Class¶

Overloaded function.

1. get_class(self, class_name: str) -> lief._lief.OAT.Class

Return the Class from its name

2. get_class(self, class_index: int) -> lief._lief.OAT.Class

Return the Class from its index

get_content_from_virtual_address(self, virtual_address: int, size: int, va_type: lief.Binary.VA_TYPES) → memoryview¶

Return the content located at the provided virtual address. The virtual address is specified in the first argument and size to read (in bytes) in the second.

If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default, it is set to AUTO.

get_dynamic_symbol(self, symbol_name: str) → lief.ELF.Symbol¶

Get the dynamic symbol from the given name.

It returns None if it can’t be found.

get_function_address(self, function_name: str) → int | lief.lief_errors¶

Return the address of the given function name

get_library(self, library_name: str) → lief.ELF.DynamicEntryLibrary¶

Return the DynamicEntryLibrary with the given name

It returns None if the library can’t be found.

get_relocation(*args) → lief.ELF.Relocation¶

Overloaded function.

1. get_relocation(self, symbol_name: str) -> lief._lief.ELF.Relocation

Return the Relocation associated with the given symbol name

2. get_relocation(self, symbol: lief._lief.ELF.Symbol) -> lief._lief.ELF.Relocation

Return the Relocation associated with the given Symbol

3. get_relocation(self, address: int) -> lief._lief.ELF.Relocation

Return the Relocation associated with the given address

get_section(self, section_name: str) → lief.ELF.Section¶

Return the Section with the given name

It returns None if the section can’t be found.

get_static_symbol(self, symbol_name: str) → lief.ELF.Symbol¶

Get the static symbol from the given name.

It returns None if it can’t be found.

get_strings(self, min_size: int) → list[str]¶

Return list of strings used in the current ELF file with a minimal size given in first parameter (Default: 5) It looks for strings in the .roadata section

get_symbol(self, symbol_name: str) → lief.Symbol¶

Return the Symbol from the given name.

If the symbol can’t be found, it returns None.

property gnu_hash → lief.ELF.GnuHash¶

Return the GnuHash object

Hash are used by the loader to speed up symbols resolution (GNU Version)

has(*args) → bool¶

Overloaded function.

1. has(self, tag: lief._lief.ELF.DYNAMIC_TAGS) -> bool

   Check if it exists a DynamicEntry with the given DYNAMIC_TAGS

2. has(self, type: lief._lief.ELF.SEGMENT_TYPES) -> bool

Check if a Segment of type (SEGMENT_TYPES) exists

3. has(self, type: lief._lief.ELF.Note.TYPE) -> bool

Check if a Note of type (TYPE) exists

4. has(self, type: lief._lief.ELF.SECTION_TYPES) -> bool

Check if a Section of type (SECTION_TYPES) exists

property has_class → bool¶

Check if the class if the given name is present in the current OAT binary

has_dynamic_symbol(self, symbol_name: str) → bool¶

Check if the symbol with the given name exists in the dynamic symbol table

property has_interpreter → bool¶

Check if the binary uses a loader (also named linker or interpreter)

has_library(self, library_name: str) → bool¶

Check if the given library name exists in the current binary

property has_notes → bool¶

True if the binary contains notes

property has_nx → bool¶

Check if the binary has NX protection (non executable stack)

property has_overlay → bool¶

True if data are appended to the end of the binary

has_section(self, section_name: str) → bool¶

Check if a Section with the given name exists in the binary

has_section_with_offset(self, offset: int) → bool¶

Check if a Section that encompasses the given offset exists

has_section_with_va(self, virtual_address: int) → bool¶

Check if a Section that encompasses the given virtual address exists

has_static_symbol(self, symbol_name: str) → bool¶

Check if the symbol with the given name exists in the static symbol table

has_symbol(self, symbol_name: str) → bool¶

Check if a Symbol with the given name exists

property header → lief.OAT.Header¶

Return the OAT Header

property imagebase → int¶

Return the program image base. (e.g. 0x400000)

property imported_functions → list[lief.Function]¶

Return the binary’s imported Function (name)

property imported_symbols → lief.ELF.Binary.it_filter_symbols¶

Return dynamic Symbol which are imported

property interpreter → str¶

ELF interpreter (loader) if any. (e.g. /lib64/ld-linux-x86-64.so.2)

property is_pie → bool¶

Check if the binary has been compiled with -fpie -pie flags

To do so we check if there is a PT_INTERP segment and if the binary type is ET_DYN (Shared object)

class it_classes¶

Iterator over lief._lief.OAT.Class

class it_dex_files¶

Iterator over lief._lief.DEX.File

class it_dyn_static_symbols¶

Iterator over lief._lief.ELF.Symbol

class it_dynamic_entries¶

Iterator over lief._lief.ELF.DynamicEntry

class it_filter_relocation¶

Iterator over lief._lief.ELF.Relocation

class it_filter_symbols¶

Iterator over lief._lief.ELF.Symbol

class it_methods¶

Iterator over lief._lief.OAT.Method

class it_notes¶

Iterator over lief._lief.ELF.Note

class it_oat_dex_files¶

Iterator over lief._lief.OAT.DexFile

class it_relocations¶

Iterator over lief._lief.ELF.Relocation

class it_sections¶

Iterator over lief._lief.ELF.Section

class it_segments¶

Iterator over lief._lief.ELF.Segment

class it_symbols¶

Iterator over lief._lief.ELF.Symbol

class it_symbols_version¶

Iterator over lief._lief.ELF.SymbolVersion

class it_symbols_version_definition¶

Iterator over lief._lief.ELF.SymbolVersionDefinition

class it_symbols_version_requirement¶

Iterator over lief._lief.ELF.SymbolVersionRequirement

property last_offset_section → int¶

Return the last offset used in binary according to sections table

property last_offset_segment → int¶

Return the last offset used in binary according to segments table

property libraries → list[str | bytes]¶

Return binary’s imported libraries (name)

property methods → lief.OAT.Binary.it_methods¶

Return an iterator over Method

property next_virtual_address → int¶

Return the next virtual address available

property notes → lief.ELF.Binary.it_notes¶

Return an iterator over the Note entries

property oat_dex_files → lief.OAT.Binary.it_oat_dex_files¶

Return an iterator over DexFile

property object_relocations → lief.ELF.Binary.it_filter_relocation¶

Return an iterator over object Relocation

offset_to_virtual_address(self, offset: int, slide: int) → int | lief.lief_errors¶

Convert an offset into a virtual address.

property overlay → memoryview¶

Overlay data that are not a part of the ELF format

patch_address(*args) → None¶

Overloaded function.

1. patch_address(self, address: int, patch_value: list[int], va_type: lief._lief.Binary.VA_TYPES = lief._lief.VA_TYPES.AUTO) -> None

   Patch the address with the given list of bytes. The virtual address is specified in the first argument and the content in the second (as a list of bytes).

   If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default, it is set to AUTO.

2. patch_address(self, address: int, patch_value: int, size: int = 8, va_type: lief._lief.Binary.VA_TYPES = lief._lief.VA_TYPES.AUTO) -> None

   Patch the address with the given integer value. The virtual address is specified in the first argument, the integer in the second and the integer’s size of in third one.

   If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default, it is set to AUTO.

patch_pltgot(*args) → None¶

Overloaded function.

1. patch_pltgot(self, symbol_name: str, address: int) -> None

Patch the imported symbol’s name with the address

2. patch_pltgot(self, symbol: lief._lief.ELF.Symbol, address: int) -> None

Patch the imported Symbol with the address

permute_dynamic_symbols(self, permutation: list[int]) → None¶

Apply the given permutation on the dynamic symbols table

property pltgot_relocations → lief.ELF.Binary.it_filter_relocation¶

Return an iterator over PLT/GOT Relocation

relocate_phdr_table(self, type: lief.ELF.Binary.PHDR_RELOC) → int¶

Force relocating the segments table in a specific way (see: PHDR_RELOC).

This function can be used to enforce a specific relocation of the segments table. Upon successful relocation, the function returns the offset of the relocated segments table. Otherwise, if the function fails, it returns 0

property relocations → lief.ELF.Binary.it_relocations¶

Return an iterator over all Relocation

remove(*args) → None¶

Overloaded function.

1. remove(self, dynamic_entry: lief._lief.ELF.DynamicEntry) -> None

Remove the given DynamicEntry from the dynamic table

2. remove(self, tag: lief._lief.ELF.DYNAMIC_TAGS) -> None

Remove all the DynamicEntry with the given DYNAMIC_TAGS

3. remove(self, section: lief._lief.ELF.Section, clear: bool = False) -> None

Remove the given Section. The clear parameter specifies whether or not we must fill its content with 0 before removing

4. remove(self, note: lief._lief.ELF.Note) -> None

Remove the given Note

5. remove(self, type: lief._lief.ELF.Note.TYPE) -> None

Remove all the Note with the given TYPE

remove_dynamic_symbol(*args) → None¶

Overloaded function.

1. remove_dynamic_symbol(self, arg: lief._lief.ELF.Symbol, /) -> None

Remove the given Symbol from the .dynsym section

2. remove_dynamic_symbol(self, arg: str, /) -> None

Remove the Symbol with the name given in parameter from the .dynsym section

remove_library(self, library_name: str) → None¶

Remove the given library

remove_section(self, name: str, clear: bool) → None¶

Remove the section with the given name

remove_static_symbol(self, arg: lief.ELF.Symbol) → None¶

Remove the given Symbol from the .symtab section

replace(self, new_segment: lief.ELF.Segment, original_segment: lief.ELF.Segment, base: int) → lief.ELF.Segment¶

Replace the Segment given in 2nd parameter with the Segment given in the first parameter and return the updated segment.

Warning

The original_segment is no longer valid after this function

section_from_offset(self, offset: int, skip_nobits: bool) → lief.ELF.Section¶

Return the Section which encompasses the given offset. It returns None if a section can’t be found.

If skip_nobits is set (which is the case by default), this function won’t consider sections for which the type is SHT_NOBITS (like .bss, .tbss, ...)

section_from_virtual_address(self, address: int, skip_nobits: bool) → lief.ELF.Section¶

Return the Section which encompasses the given virtual address. It returns None if a section can’t be found.

If skip_nobits is set (which is the case by default), this function won’t consider sections for which the type is SHT_NOBITS (like .bss, .tbss, ...)

property sections → lief.ELF.Binary.it_sections¶

Return an iterator over binary’s Section

segment_from_offset(self, offset: int) → lief.ELF.Segment¶

Return the Segment which encompasses the given offset. It returns None if a segment can’t be found.

segment_from_virtual_address(self, address: int) → lief.ELF.Segment¶

Return the Segment which encompasses the given virtual address. It returns None if a segment can’t be found.

property segments → lief.ELF.Binary.it_segments¶

Return an iterator to binary’s Segment

property static_symbols → lief.ELF.Binary.it_symbols¶

Return an iterator to static Symbol

property strings → list[str | bytes]¶

Return list of strings used in the current ELF file. Basically this function looks for strings in the .roadata section

strip(self) → None¶

Strip the binary

property symbols → lief.ELF.Binary.it_dyn_static_symbols¶

Return an iterator over both static and dynamic Symbol

property symbols_version → lief.ELF.Binary.it_symbols_version¶

Return an iterator SymbolVersion

property symbols_version_definition → lief.ELF.Binary.it_symbols_version_definition¶

Return an iterator to SymbolVersionDefinition

property symbols_version_requirement → lief.ELF.Binary.it_symbols_version_requirement¶

Return an iterator to SymbolVersionRequirement

property sysv_hash → lief.ELF.SysvHash¶

Return the SysvHash object

Hash are used by the loader to speed up symbols resolution (SYSV version)

property type → lief.ELF.ELF_CLASS¶

Return the binary’s ELF_CLASS

property use_gnu_hash → bool¶

True if GNU hash is used

property use_sysv_hash → bool¶

True if SYSV hash is used

virtual_address_to_offset(self, virtual_address: int) → int | lief.lief_errors¶

Convert the virtual address to a file offset

property virtual_size → int¶

Return the size of the mapped binary

write(*args) → None¶

Overloaded function.

1. write(self, output: str) -> None

Rebuild the binary and write it in a file

2. write(self, output: str, config: lief._lief.ELF.Builder.config_t) -> None

Rebuild the binary with the given configuration and write it in a file

xref(self, virtual_address: int) → list[int]¶

Return all virtual addresses that use the address given in parameter

Header¶

class lief.OAT.Header(self)¶

OAT Header representation

property checksum → int¶

Checksum of the OAT file

class element_t¶

property key → lief.OAT.HEADER_KEYS¶

property value → str¶

property executable_offset → int¶

get(self, key: lief.OAT.HEADER_KEYS) → str¶

property i2c_code_bridge_offset → int¶

property i2i_bridge_offset → int¶

property image_file_location_oat_checksum → int¶

property image_file_location_oat_data_begin → int¶

property image_patch_delta → int¶

property instruction_set → lief.OAT.INSTRUCTION_SETS¶

List of INSTRUCTION_SETS

class it_key_values_t¶

property jni_dlsym_lookup_offset → int¶

property key_value_size → int¶

property key_values → lief.OAT.Header.it_key_values_t¶

Configuration used for the dex2oat transformation

property keys → list[lief.OAT.HEADER_KEYS]¶

List of HEADER_KEYS present

property magic → list[int]¶

Magic number which shoud be oat\x0A

property nb_dex_files → int¶

Number of lief.DEX.File registred in the current OAT

property oat_dex_files_offset → int¶

Offset to the raw lief.OAT.Dexfile

Warning

This attribute is only relevant for OAT for which the version is above 131

property quick_generic_jni_trampoline_offset → int¶

property quick_imt_conflict_trampoline_offset → int¶

property quick_resolution_trampoline_offset → int¶

property quick_to_interpreter_bridge_offset → int¶

set(self, key: lief.OAT.HEADER_KEYS, value: str) → lief.OAT.Header¶

property values → list[str]¶

List of values associated with keys

property version → int¶

Underlying version of the OAT file

DexFile¶

class lief.OAT.DexFile(self)¶

OAT DexFile representation

property checksum → int¶

Checksum of the underlying DEX file

property dex_file → lief.DEX.File¶

Associated lief.DEX.File

property dex_offset → int¶

Offset to the raw lief.DEX.File

property has_dex_file → bool¶

Check if the lief.DEX.File is present

property location → str¶

Original location of the DEX file

Class¶

class lief.OAT.Class(self)¶

OAT Class representation

property bitmap → list[int]¶

Bitmap information used to quickly find which methods are optimized

property fullname → str¶

Class mangled name (e.g. Lcom/android/MyActivity;)

has_dex_class(self) → bool¶

True if a lief.DEX.Class object is associated with this OAT Class

property index → int¶

Index the DEX classes pool (lief.DEX.File.classes)

is_quickened(*args) → bool¶

Overloaded function.

1. is_quickened(self, dex_method: lief._lief.DEX.Method) -> bool

Check if the given lief.DEX.Method is compiled into native code

2. is_quickened(self, method_index: int) -> bool

Check if the Method at the given index is compiled into native code

class it_methods¶

Iterator over lief._lief.OAT.Method

method_offsets_index(self, arg: int) → int¶

property methods → lief.OAT.Class.it_methods¶

Iterator over lief.OAT.Method

property status → lief.OAT.OAT_CLASS_STATUS¶

Class OAT_CLASS_STATUS

property type → lief.OAT.OAT_CLASS_TYPES¶

Information (OAT_CLASS_TYPES) about how methods are optimized

Method¶

class lief.OAT.Method(self)¶

OAT Method representation

property dex_method → lief.DEX.Method¶

Mirrored Method associated with the OAT method (or None)

property has_dex_method → bool¶

Check if a Method is associated with the OAT method

property is_compiled → bool¶

True if the optimization is native

property is_dex2dex_optimized → bool¶

True if the optimization is DEX

property name → str¶

Method’s name

property oat_class → lief.OAT.Class¶

Class associated with the method (or None)

property quick_code → list[int]¶

Quick code associated with the method

Enums¶