Home
Overloaded function.
is_oat(binary: lief._lief.ELF.Binary) -> bool
Check if the Binary
given in parameter is an OAT
is_oat(path: str) -> bool
Check if the file given in parameter is an OAT
is_oat(raw: List[int]) -> bool
Check if the raw data given in parameter is an OAT
Overloaded function.
version(binary: lief._lief.ELF.Binary) -> int
Return the OAT version of the Binary
given in parameter
version(file: str) -> int
Return the OAT version of the file given in parameter
version(raw: List[int]) -> int
Return the OAT version of the raw data given in parameter
Return the ANDROID_VERSIONS
associated with the given OAT version
Overloaded function.
parse(oat_file: str) -> LIEF::OAT::Binary
Parse the given OAT file and return a Binary
object
parse(oat_file: str, vdex_file: str) -> LIEF::OAT::Binary
Parse the given OAT with its VDEX file and return a Binary
object
parse(raw: List[int]) -> LIEF::OAT::Binary
Parse the given raw data and return a Binary
object
parse(io: object) -> LIEF::OAT::Binary
OAT binary representation
This enum describes the different ways to relocate the segments table.
Members:
- AUTO
Defer the choice of the layout to LIEF.
- PIE_SHIFT
The content of the binary right after the segments table is shifted and the relocations are updated accordingly. This kind of shift only works with PIE binaries.
- BSS_END
The new segments table is relocated right after the first bss-like segments.
- FILE_END
The new segments table is relocated at the end of the binary.
- SEGMENT_GAP
The new segments table is relocated between two LOAD segments. This kind of relocation is only doable when there is an alignment enforcement.
Members:
AUTO
VA
RVA
Return the abstract representation of the current binary (lief.Binary
)
Warning
Getting this property modifies the __class__
attribute such as the current binary looks like a lief.Binary
.
To get back to the original binary, one needs to access lief.Binary.concrete
Overloaded function.
add(self: lief._lief.ELF.Binary, arg0: LIEF::ELF::DynamicEntry) -> LIEF::ELF::DynamicEntry
dynamic_entry
add(self: lief._lief.ELF.Binary, section: LIEF::ELF::Section, loaded: bool = True) -> LIEF::ELF::Section
Add the given
Section
to the binary.If the section does not aim at being loaded in memory, the
loaded
parameter has to be set toFalse
(default:True
)
add(self: lief._lief.ELF.Binary, Add a new Segment
in the binarysegment: LIEF::ELF::Segment, base: int = 0) -> LIEF::ELF::Segment
add(self: lief._lief.ELF.Binary, note: LIEF::ELF::Note) -> LIEF::ELF::Note
Add a new Note
in the binary
Add a new dynamic relocation.
We consider a dynamic relocation as a relocation which is not plt-related.
Add a dynamic Symbol
to the binary
The function also takes an optional lief.ELF.SymbolVersion
Create a symbol for the function at the given address
and create an export
Add a library with the given name as dependency
Add relocation for object file (.o)
The first parameter is the section to add while the second parameter is the Section
associated with the relocation.
If there is an error, this function returns a nullptr. Otherwise, it returns the relocation added.”,
Add a .plt.got relocation. This kind of relocation is usually associated with a PLT stub that aims at resolving the underlying symbol.
Add a static Symbol
to the binary
The concrete representation of the binary. Basically, this property cast a lief.Binary
into a lief.PE.Binary
, lief.ELF.Binary
or lief.MachO.Binary
.
See also: lief.Binary.abstract
Constructor functions that are called prior to any other functions
List of the binary destructors (typically, the functions located in the .fini_array
)
Return an iterator to DynamicEntry
entries as a list
Return an iterator over dynamics Relocation
Binary’s entrypoint
Return the last offset used by the ELF binary according to both, the sections table and the segments table.
Overloaded function.
export_symbol(self: lief._lief.ELF.Binary, symbol: LIEF::ELF::Symbol) -> LIEF::ELF::Symbol
Export the given symbol and create an entry if it doesn’t exist
export_symbol(self: lief._lief.ELF.Binary, symbol_name: str, value: int = 0) -> LIEF::ELF::Symbol
Export the symbol with the given name and create an entry if it doesn’t exist
Overloaded function.
extend(self: lief._lief.ELF.Binary, segment: LIEF::ELF::Segment, size: int) -> LIEF::ELF::Segment
Extend the given given Segment
by the given size
extend(self: lief._lief.ELF.Binary, segment: LIEF::ELF::Section, size: int) -> LIEF::ELF::Section
Extend the given given Section
by the given size
File format EXE_FORMATS
of the underlying binary.
List of the functions found the in the binary
Overloaded function.
get(self: lief._lief.ELF.Binary, tag: lief._lief.ELF.DYNAMIC_TAGS) -> LIEF::ELF::DynamicEntry
Return the first binary’s
DynamicEntry
from the givenDYNAMIC_TAGS
.It returns None if the dynamic entry can’t be found.
get(self: lief._lief.ELF.Binary, type: lief._lief.ELF.SEGMENT_TYPES) -> LIEF::ELF::Segment
Return the first binary’s
Segment
from the givenSEGMENT_TYPES
It returns None if the segment can’t be found.
get(self: lief._lief.ELF.Binary, type: lief._lief.ELF.NOTE_TYPES) -> LIEF::ELF::Note
Return the first binary’s
Note
from the givenNOTE_TYPES
.It returns None if the note can’t be found.
get(self: lief._lief.ELF.Binary, type: lief._lief.ELF.SECTION_TYPES) -> LIEF::ELF::Section
Return the first binary’s
Section
from the givenELF_SECTION_TYPES
It returns None if the section can’t be found.
Overloaded function.
get_class(self: lief._lief.OAT.Binary, class_name: str) -> LIEF::OAT::Class
Return the Class
from its name
get_class(self: lief._lief.OAT.Binary, class_index: int) -> LIEF::OAT::Class
Return the Class
from its index
Return the content located at the provided virtual address. The virtual address is specified in the first argument and size to read (in bytes) in the second.
If the underlying binary is a PE, one can specify if the virtual address is a RVA
or a VA
. By default, it is set to AUTO
.
Get the dynamic symbol from the given name.
It returns None if it can’t be found.
Return the address of the given function name
Return the DynamicEntryLibrary
with the given name
It returns None if the library can’t be found.
Overloaded function.
get_relocation(self: lief._lief.ELF.Binary, symbol_name: str) -> LIEF::ELF::Relocation
Return the Relocation
associated with the given symbol name
get_relocation(self: lief._lief.ELF.Binary, symbol: LIEF::ELF::Symbol) -> LIEF::ELF::Relocation
Return the Relocation
associated with the given Symbol
get_relocation(self: lief._lief.ELF.Binary, address: int) -> LIEF::ELF::Relocation
Return the Relocation
associated with the given address
Return the Section
with the given name
It returns None if the section can’t be found.
Get the static symbol from the given name
.
It returns None if it can’t be found.
Return list of strings used in the current ELF file with a minimal size given in first parameter (Default: 5) It looks for strings in the .roadata
section
Return the Symbol
from the given name
.
If the symbol can’t be found, it returns None.
Return the GnuHash
object
Hash are used by the loader to speed up symbols resolution (GNU Version)
Overloaded function.
has(self: lief._lief.ELF.Binary, tag: lief._lief.ELF.DYNAMIC_TAGS) -> bool
Check if it exists a
DynamicEntry
with the givenDYNAMIC_TAGS
has(self: lief._lief.ELF.Binary, type: lief._lief.ELF.SEGMENT_TYPES) -> bool
Check if a Segment
of type (SEGMENT_TYPES
) exists
has(self: lief._lief.ELF.Binary, type: lief._lief.ELF.NOTE_TYPES) -> bool
Check if a Note
of type (NOTE_TYPES
) exists
has(self: lief._lief.ELF.Binary, type: lief._lief.ELF.SECTION_TYPES) -> bool
Check if a Section
of type (SECTION_TYPES
) exists
Check if the class if the given name is present in the current OAT binary
Check if the symbol with the given name
exists in the dynamic symbol table
Check if the binary uses a loader (also named linker or interpreter)
Check if the given library name exists in the current binary
True
if the binary contains notes
Check if the binary has NX
protection (non executable stack)
True if data are appended to the end of the binary
Check if a Section
with the given name exists in the binary
Check if a Section
that encompasses the given offset exists
Check if a Section
that encompasses the given virtual address exists
Check if the symbol with the given name
exists in the static symbol table
Check if a Symbol
with the given name exists
Return the program image base. (e.g. 0x400000
)
ELF interpreter (loader) if any. (e.g. /lib64/ld-linux-x86-64.so.2
)
Check if the binary has been compiled with -fpie -pie flags
To do so we check if there is a PT_INTERP segment and if the binary type is ET_DYN (Shared object)
Return the last offset used in binary according to sections table
Return the last offset used in binary according to segments table
Return binary’s imported libraries (name)
Return the next virtual address available
Return an iterator over object Relocation
Convert an offset into a virtual address.
Overlay data that are not a part of the ELF format
Overloaded function.
patch_address(self: lief._lief.Binary, address: int, patch_value: List[int], va_type: lief._lief.Binary.VA_TYPES = <VA_TYPES.AUTO: 0>) -> None
patch_address(self: lief._lief.Binary, address: int, patch_value: int, size: int = 8, va_type: lief._lief.Binary.VA_TYPES = <VA_TYPES.AUTO: 0>) -> None
Overloaded function.
patch_pltgot(self: lief._lief.ELF.Binary, symbol_name: str, address: int) -> None
Patch the imported symbol’s name with the address
patch_pltgot(self: lief._lief.ELF.Binary, symbol: LIEF::ELF::Symbol, address: int) -> None
Patch the imported Symbol
with the address
Apply the given permutation on the dynamic symbols table
Return an iterator over PLT/GOT Relocation
Force relocating the segments table in a specific way (see: PHDR_RELOC
).
This function can be used to enforce a specific relocation of the segments table. Upon successful relocation, the function returns the offset of the relocated segments table. Otherwise, if the function fails, it returns 0
Return an iterator over all Relocation
Overloaded function.
remove(self: lief._lief.ELF.Binary, dynamic_entry: LIEF::ELF::DynamicEntry) -> None
Remove the given DynamicEntry
from the dynamic table
remove(self: lief._lief.ELF.Binary, tag: lief._lief.ELF.DYNAMIC_TAGS) -> None
Remove all the DynamicEntry
with the given DYNAMIC_TAGS
remove(self: lief._lief.ELF.Binary, section: LIEF::ELF::Section, clear: bool = False) -> None
Remove the given Section
. The clear
parameter specifies whether or not we must fill its content with 0
before removing
remove(self: lief._lief.ELF.Binary, note: LIEF::ELF::Note) -> None
Remove the given Note
remove(self: lief._lief.ELF.Binary, type: lief._lief.ELF.NOTE_TYPES) -> None
Remove all the Note
with the given NOTE_TYPES
Overloaded function.
remove_dynamic_symbol(self: lief._lief.ELF.Binary, arg0: LIEF::ELF::Symbol) -> None
Remove the given Symbol
from the .dynsym
section
remove_dynamic_symbol(self: lief._lief.ELF.Binary, arg0: str) -> None
Remove the Symbol
with the name given in parameter from the .dynsym
section
Remove the given library
Remove the section with the given name
Remove the given Symbol
from the .symtab
section
Replace the Segment
given in 2nd parameter with the Segment
given in the first parameter and return the updated segment.
Warning
The original_segment
is no longer valid after this function
Return the Section
which encompasses the given offset. It returns None if a section can’t be found.
If skip_nobits
is set (which is the case by default), this function won’t consider sections for which the type is SHT_NOBITS
(like .bss, .tbss, ...
)
Return the Section
which encompasses the given virtual address. It returns None if a section can’t be found.
If skip_nobits
is set (which is the case by default), this function won’t consider sections for which the type is SHT_NOBITS
(like .bss, .tbss, ...
)
Return the Segment
which encompasses the given offset. It returns None if a segment can’t be found.
Return the Segment
which encompasses the given virtual address. It returns None if a segment can’t be found.
Return list of strings used in the current ELF file. Basically this function looks for strings in the .roadata
section
Strip the binary
Return an iterator SymbolVersion
Return an iterator to SymbolVersionDefinition
Return an iterator to SymbolVersionRequirement
Return the SysvHash
object
Hash are used by the loader to speed up symbols resolution (SYSV version)
True
if GNU hash is used
True
if SYSV hash is used
Convert the virtual address to a file offset
Return the size of the mapped binary
Overloaded function.
write(self: lief._lief.ELF.Binary, output: str) -> None
Rebuild the binary and write it in a file
write(self: lief._lief.ELF.Binary, output: str, config: LIEF::ELF::Builder::config_t) -> None
Rebuild the binary with the given configuration and write it in a file
Return all virtual addresses that use the address
given in parameter
OAT Header representation
Checksum of the OAT file
List of INSTRUCTION_SETS
Configuration used for the dex2oat
transformation
List of HEADER_KEYS
present
Magic number which shoud be oat\x0A
Number of lief.DEX.File
registred in the current OAT
Offset to the raw lief.OAT.DexFile
Warning
This attribute is only relevant for OAT for which the version is above 131
Underlying version of the OAT file
OAT DexFile representation
Checksum of the underlying DEX file
Associated lief.DEX.File
Offset to the raw lief.DEX.File
Check if the lief.DEX.File
is present
Original location of the DEX file
OAT Class representation
Bitmap information used to quickly find which methods are optimized
Class mangled name (e.g. Lcom/android/MyActivity;
)
True if a lief.DEX.Class
object is associated with this OAT Class
Index the DEX classes pool (lief.DEX.File.classes
)
Overloaded function.
is_quickened(self: lief._lief.OAT.Class, dex_method: LIEF::DEX::Method) -> bool
Check if the given lief.DEX.Method
is compiled into native code
is_quickened(self: lief._lief.OAT.Class, method_index: int) -> bool
Check if the Method at the given index is compiled into native code
Overloaded function.
method_offsets_index(self: lief._lief.OAT.Class, arg0: LIEF::DEX::Method) -> int
method_offsets_index(self: lief._lief.OAT.Class, arg0: int) -> int
Iterator over lief.OAT.Method
Class OAT_CLASS_STATUS
Information (OAT_CLASS_TYPES
) about how methods are optimized
Members:
ALL_COMPILED
SOME_COMPILED
NONE_COMPILED
Members:
RETIRED
ERROR
NOTREADY
IDX
LOADED
RESOLVING
RESOLVED
VERIFYING
VERIFICATION_AT_RUNTIME
VERIFYING_AT_RUNTIME
VERIFIED
INITIALIZING
INITIALIZED
Members:
IMAGE_LOCATION
DEX2OAT_CMD_LINE
DEX2OAT_HOST
PIC
HAS_PATCH_INFO
DEBUGGABLE
NATIVE_DEBUGGABLE
COMPILER_FILTER
CLASS_PATH
BOOT_CLASS_PATH
CONCURRENT_COPYING
Members:
NONE
ARM
ARM_64
THUMB2
X86
X86_64
MIPS
MIPS_64