OAT

Utilities

lief.OAT.is_oat(*args, **kwargs)

Overloaded function.

  1. is_oat(binary: lief.ELF.Binary) -> bool

Check if the Binary given in parameter is a OAT one

  1. is_oat(path: str) -> bool

Check if the file given in parameter is a OAT one

  1. is_oat(raw: List[int]) -> bool

Check if the raw data given in parameter is a OAT one

lief.OAT.version(*args, **kwargs)

Overloaded function.

  1. version(binary: lief.ELF.Binary) -> int

Return the OAT version of the Binary given in parameter

  1. version(file: str) -> int

Return the OAT version of the file given in parameter

  1. version(raw: List[int]) -> int

Return the OAT version of the raw data given in parameter

lief.OAT.android_version(arg0: int) LIEF::Android::ANDROID_VERSIONS

Return the ANDROID_VERSIONS associated with the given OAT version


Parser

lief.OAT.parse(*args, **kwargs)

Overloaded function.

  1. parse(oat_file: str) -> LIEF::OAT::Binary

Parse the given OAT file and return a Binary object

  1. parse(oat_file: str, vdex_file: str) -> LIEF::OAT::Binary

Parse the given OAT with its VDEX file and return a Binary object

  1. parse(raw: List[int], name: str = ‘’) -> LIEF::OAT::Binary

Parse the given raw data and return a Binary object

  1. parse(io: object, name: str = ‘’) -> LIEF::OAT::Binary


Binary

class lief.OAT.Binary

OAT binary representation

class VA_TYPES(self: lief.Binary.VA_TYPES, value: int) None

Members:

AUTO

VA

RVA

AUTO = <VA_TYPES.AUTO: 0>
RVA = <VA_TYPES.RVA: 1>
VA = <VA_TYPES.VA: 2>
property name
property value
property abstract

Return the abstract representation of the current binary (lief.Binary)

Warning

Getting this property modifies the __class__ attribute such as the current binary looks like a lief.Binary.

To get back to the original binary, one needs to access lief.Binary.concrete

add(*args, **kwargs)

Overloaded function.

  1. add(self: lief.ELF.Binary, arg0: LIEF::ELF::DynamicEntry) -> LIEF::ELF::DynamicEntry

dynamic_entry

  1. add(self: lief.ELF.Binary, section: LIEF::ELF::Section, loaded: bool = True) -> LIEF::ELF::Section

    Add the given Section to the binary.

    If the section does not aim at being loaded in memory, the loaded parameter has to be set to False (default: True)

  2. add(self: lief.ELF.Binary, Add a new Segment in the binarysegment: LIEF::ELF::Segment, base: int = 0) -> LIEF::ELF::Segment

  3. add(self: lief.ELF.Binary, note: LIEF::ELF::Note) -> LIEF::ELF::Note

Add a new Note in the binary

add_dynamic_relocation(self: lief.ELF.Binary, relocation: LIEF::ELF::Relocation) LIEF::ELF::Relocation

Add a new dynamic relocation.

We consider a dynamic relocation as a relocation which is not plt-related.

See: lief.ELF.Binary.add_pltgot_relocation()

add_dynamic_symbol(self: lief.ELF.Binary, symbol: LIEF::ELF::Symbol, symbol_version: lief.ELF.SymbolVersion = None) LIEF::ELF::Symbol

Add a dynamic Symbol to the binary

The function also takes an optional lief.ELF.SymbolVersion

add_exported_function(self: lief.ELF.Binary, address: int, name: str = '') LIEF::ELF::Symbol

Create a symbol for the function at the given address and create an export

add_library(self: lief.ELF.Binary, library_name: str) LIEF::ELF::DynamicEntryLibrary

Add a library with the given name as dependency

add_object_relocation(self: lief.ELF.Binary, relocation: LIEF::ELF::Relocation, section: LIEF::ELF::Section) LIEF::ELF::Relocation

Add relocation for object file (.o)

The first parameter is the section to add while the second parameter is the Section associated with the relocation.

If there is an error, this function returns a nullptr. Otherwise, it returns the relocation added.”,

add_pltgot_relocation(self: lief.ELF.Binary, relocation: LIEF::ELF::Relocation) LIEF::ELF::Relocation

Add a .plt.got relocation. This kind of relocation is usually associated with a PLT stub that aims at resolving the underlying symbol.

See: lief.ELF.Binary.add_dynamic_relocation()

add_static_symbol(self: lief.ELF.Binary, symbol: LIEF::ELF::Symbol) LIEF::ELF::Symbol

Add a static Symbol to the binary

property classes

Return an iterator over Class

property concrete

The concrete representation of the binary. Basically, this property cast a lief.Binary into a lief.PE.Binary, lief.ELF.Binary or lief.MachO.Binary.

See also: lief.Binary.abstract

property ctor_functions

Constructor functions that are called prior to any other functions

property dex2dex_json_info
property dex_files

Return an iterator over File

property dtor_functions

List of the binary destructors (typically, the functions located in the .fini_array)

property dynamic_entries

Return an iterator to DynamicEntry entries as a list

property dynamic_relocations

Return an iterator over dynamics Relocation

property dynamic_symbols

Return an iterator to dynamic Symbol

property entrypoint

Binary’s entrypoint

property eof_offset

Return the last offset used by the ELF binary according to both: the sections table and the segments table.

export_symbol(*args, **kwargs)

Overloaded function.

  1. export_symbol(self: lief.ELF.Binary, symbol: LIEF::ELF::Symbol) -> LIEF::ELF::Symbol

Export the given symbol and create an entry if it doesn’t exist

  1. export_symbol(self: lief.ELF.Binary, symbol_name: str, value: int = 0) -> LIEF::ELF::Symbol

Export the symbol with the given name and create an entry if it doesn’t exist

property exported_functions

Return the binary’s exported Function

property exported_symbols

Return dynamic Symbol which are exported

extend(*args, **kwargs)

Overloaded function.

  1. extend(self: lief.ELF.Binary, segment: LIEF::ELF::Segment, size: int) -> LIEF::ELF::Segment

Extend the given given Segment by the given size

  1. extend(self: lief.ELF.Binary, segment: LIEF::ELF::Section, size: int) -> LIEF::ELF::Section

Extend the given given Section by the given size

property format

File format EXE_FORMATS of the underlying binary.

property functions

List of the functions found the in the binary

get(*args, **kwargs)

Overloaded function.

  1. get(self: lief.ELF.Binary, tag: lief.ELF.DYNAMIC_TAGS) -> LIEF::ELF::DynamicEntry

    Return the first binary’s DynamicEntry from the given DYNAMIC_TAGS.

    It returns None if the dynamic entry can’t be found.

  2. get(self: lief.ELF.Binary, type: lief.ELF.SEGMENT_TYPES) -> LIEF::ELF::Segment

    Return the first binary’s Segment from the given SEGMENT_TYPES

    It returns None if the segment can’t be found.

  3. get(self: lief.ELF.Binary, type: lief.ELF.NOTE_TYPES) -> LIEF::ELF::Note

    Return the first binary’s Note from the given NOTE_TYPES.

    It returns None if the note can’t be found.

  4. get(self: lief.ELF.Binary, type: lief.ELF.SECTION_TYPES) -> LIEF::ELF::Section

    Return the first binary’s Section from the given ELF_SECTION_TYPES

    It returns None if the section can’t be found.

get_class(*args, **kwargs)

Overloaded function.

  1. get_class(self: lief.OAT.Binary, class_name: str) -> LIEF::OAT::Class

Return the Class from its name

  1. get_class(self: lief.OAT.Binary, class_index: int) -> LIEF::OAT::Class

Return the Class from its index

get_content_from_virtual_address(self: lief.Binary, virtual_address: int, size: int, va_type: lief.Binary.VA_TYPES = <VA_TYPES.AUTO: 0>) List[int]

Return the content located at the provided virtual address. The virtual address is specified in the first argument and size to read (in bytes) in the second.

If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default, it is set to AUTO.

get_dynamic_symbol(self: lief.ELF.Binary, symbol_name: str) LIEF::ELF::Symbol

Get the dynamic symbol from the given name.

It returns None if it can’t be found.

get_function_address(self: lief.Binary, function_name: str) object

Return the address of the given function name

get_library(self: lief.ELF.Binary, library_name: str) LIEF::ELF::DynamicEntryLibrary

Return the DynamicEntryLibrary with the given name

It returns None if the library can’t be found.

get_relocation(*args, **kwargs)

Overloaded function.

  1. get_relocation(self: lief.ELF.Binary, symbol_name: str) -> LIEF::ELF::Relocation

Return the Relocation associated with the given symbol name

  1. get_relocation(self: lief.ELF.Binary, symbol: LIEF::ELF::Symbol) -> LIEF::ELF::Relocation

Return the Relocation associated with the given Symbol

  1. get_relocation(self: lief.ELF.Binary, address: int) -> LIEF::ELF::Relocation

Return the Relocation associated with the given address

get_section(self: lief.ELF.Binary, section_name: str) LIEF::ELF::Section

Return the Section with the given name

It returns None if the section can’t be found.

get_static_symbol(self: lief.ELF.Binary, symbol_name: str) LIEF::ELF::Symbol

Get the static symbol from the given name.

It returns None if it can’t be found.

get_strings(self: lief.ELF.Binary, min_size: int = 5) List[str]

Return list of strings used in the current ELF file with a minimal size given in first parameter (Default: 5) It looks for strings in the .roadata section

get_symbol(self: lief.Binary, symbol_name: str) LIEF::Symbol

Return the Symbol from the given name.

If the symbol can’t be found, it returns None.

property gnu_hash

Return the GnuHash object

Hash are used by the loader to speed up symbols resolution (GNU Version)

has(*args, **kwargs)

Overloaded function.

  1. has(self: lief.ELF.Binary, tag: lief.ELF.DYNAMIC_TAGS) -> bool

    Check if it exists a DynamicEntry with the given DYNAMIC_TAGS

  2. has(self: lief.ELF.Binary, type: lief.ELF.SEGMENT_TYPES) -> bool

Check if a Segment of type (SEGMENT_TYPES) exists

  1. has(self: lief.ELF.Binary, type: lief.ELF.NOTE_TYPES) -> bool

Check if a Note of type (NOTE_TYPES) exists

  1. has(self: lief.ELF.Binary, type: lief.ELF.SECTION_TYPES) -> bool

Check if a Section of type (ECTION_TYPES) exists

property has_class

Check if the class if the given name is present in the current OAT binary

has_dynamic_symbol(self: lief.ELF.Binary, symbol_name: str) bool

Check if the symbol with the given name exists in the dynamic symbol table

property has_interpreter

Check if the binary uses a loader (also named linker or interpreter)

has_library(self: lief.ELF.Binary, library_name: str) bool

Check if the given library name exists in the current binary

property has_notes

True if the binary contains notes

property has_nx

Check if the binary has NX protection (non executable stack)

property has_overlay

True if data are appended to the end of the binary

has_section(self: lief.ELF.Binary, section_name: str) bool

Check if a Section with the given name exists in the binary

has_section_with_offset(self: lief.ELF.Binary, offset: int) bool

Check if a Section that encompasses the given offset exists

has_section_with_va(self: lief.ELF.Binary, virtual_address: int) bool

Check if a Section that encompasses the given virtual address exists

has_static_symbol(self: lief.ELF.Binary, symbol_name: str) bool

Check if the symbol with the given name exists in the static symbol table

has_symbol(self: lief.Binary, symbol_name: str) bool

Check if a Symbol with the given name exists

property header

Return the OAT Header

property imagebase

Return the program image base. (e.g. 0x400000)

property imported_functions

Return the binary’s imported Function (name)

property imported_symbols

Return dynamic Symbol which are imported

property interpreter

ELF interpreter (loader) if any. (e.g. /lib64/ld-linux-x86-64.so.2)

property is_pie

Check if the binary has been compiled with -fpie -pie flags

To do so we check if there is a PT_INTERP segment and if the binary type is ET_DYN (Shared object)

class it_classes
class it_dex_files
class it_dyn_static_symbols
class it_dynamic_entries
class it_filter_relocation
class it_filter_symbols
class it_methods
class it_notes
class it_oat_dex_files
class it_relocations
class it_sections
class it_segments
class it_symbols
class it_symbols_version
class it_symbols_version_definition
class it_symbols_version_requirement
property last_offset_section

Return the last offset used in binary according to sections table

property last_offset_segment

Return the last offset used in binary according to segments table

property libraries

Return binary’s imported libraries (name)

property methods

Return an iterator over Method

property name

Binary’s name

property next_virtual_address

Return the next virtual address available

property notes

Return an iterator over the Note entries

property oat_dex_files

Return an iterator over DexFile

property object_relocations

Return an iterator over object Relocation

offset_to_virtual_address(self: lief.Binary, offset: int, slide: int = 0) object

Convert an offset into a virtual address.

property overlay

Overlay data that are not a part of the ELF format

patch_address(*args, **kwargs)

Overloaded function.

  1. patch_address(self: lief.Binary, address: int, patch_value: List[int], va_type: lief.Binary.VA_TYPES = <VA_TYPES.AUTO: 0>) -> None

    Patch the address with the given list of bytes. The virtual address is specified in the first argument and the content in the second (as a list of bytes).

    If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default, it is set to AUTO.

  2. patch_address(self: lief.Binary, address: int, patch_value: int, size: int = 8, va_type: lief.Binary.VA_TYPES = <VA_TYPES.AUTO: 0>) -> None

    Patch the address with the given integer value. The virtual address is specified in the first argument, the integer in the second and the integer’s size of in third one.

    If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default, it is set to AUTO.

patch_pltgot(*args, **kwargs)

Overloaded function.

  1. patch_pltgot(self: lief.ELF.Binary, symbol_name: str, address: int) -> None

Patch the imported symbol’s name with the address

  1. patch_pltgot(self: lief.ELF.Binary, symbol: LIEF::ELF::Symbol, address: int) -> None

Patch the imported Symbol with the address

permute_dynamic_symbols(self: lief.ELF.Binary, permutation: List[int]) None

Apply the given permutation on the dynamic symbols table

property pltgot_relocations

Return an iterator over PLT/GOT Relocation

property relocations

Return an iterator over all Relocation

remove(*args, **kwargs)

Overloaded function.

  1. remove(self: lief.ELF.Binary, dynamic_entry: LIEF::ELF::DynamicEntry) -> None

Remove the given DynamicEntry from the dynamic table

  1. remove(self: lief.ELF.Binary, tag: lief.ELF.DYNAMIC_TAGS) -> None

Remove all the DynamicEntry with the given DYNAMIC_TAGS

  1. remove(self: lief.ELF.Binary, section: LIEF::ELF::Section, clear: bool = False) -> None

Remove the given Section. The clear parameter specifies whether or not we must fill its content with 0 before removing

  1. remove(self: lief.ELF.Binary, note: LIEF::ELF::Note) -> None

Remove the given Note

  1. remove(self: lief.ELF.Binary, type: lief.ELF.NOTE_TYPES) -> None

Remove all the Note with the given NOTE_TYPES

remove_library(self: lief.ELF.Binary, library_name: str) None

Remove the given library

remove_section(self: lief.Binary, name: str, clear: bool = False) None

Remove the section with the given name

remove_static_symbol(self: lief.ELF.Binary, arg0: LIEF::ELF::Symbol) None

Remove the given Symbol from the .symtab section

replace(self: lief.ELF.Binary, new_segment: LIEF::ELF::Segment, original_segment: LIEF::ELF::Segment, base: int = 0) LIEF::ELF::Segment

Replace the Segment given in 2nd parameter with the Segment given in the first parameter and return the updated segment.

Warning

The original_segment is no longer valid after this function

section_from_offset(self: lief.ELF.Binary, offset: int, skip_nobits: bool = True) LIEF::ELF::Section

Return the Section which encompasses the given offset. It returns None if a section can’t be found.

If skip_nobits is set (which is the case by default), this function won’t consider sections for which the type is SHT_NOBITS (like .bss, .tbss, ...)

section_from_virtual_address(self: lief.ELF.Binary, address: int, skip_nobits: bool = True) LIEF::ELF::Section

Return the Section which encompasses the given virtual address. It returns None if a section can’t be found.

If skip_nobits is set (which is the case by default), this function won’t consider sections for which the type is SHT_NOBITS (like .bss, .tbss, ...)

property sections

Return an iterator over binary’s Section

segment_from_offset(self: lief.ELF.Binary, offset: int) LIEF::ELF::Segment

Return the Segment which encompasses the given offset. It returns None if a segment can’t be found.

segment_from_virtual_address(self: lief.ELF.Binary, address: int) LIEF::ELF::Segment

Return the Segment which encompasses the given virtual address. It returns None if a segment can’t be found.

property segments

Return an iterator to binary’s Segment

property static_symbols

Return an iterator to static Symbol

property strings

Return list of strings used in the current ELF file. Basically this function looks for strings in the .roadata section

strip(self: lief.ELF.Binary) None

Strip the binary

property symbols

Return an iterator over both static and dynamic Symbol

property symbols_version

Return an iterator SymbolVersion

property symbols_version_definition

Return an iterator to SymbolVersionDefinition

property symbols_version_requirement

Return an iterator to SymbolVersionRequirement

property sysv_hash

Return the SysvHash object

Hash are used by the loader to speed up symbols resolution (SYSV version)

property type

Return the binary’s ELF_CLASS

property use_gnu_hash

True if GNU hash is used

property use_sysv_hash

True if SYSV hash is used

virtual_address_to_offset(self: lief.ELF.Binary, virtual_address: int) object

Convert the virtual address to a file offset

property virtual_size

Return the size of the mapped binary

write(self: lief.ELF.Binary, output: str) None

Rebuild the binary and write it in a file

xref(self: lief.Binary, virtual_address: int) List[int]

Return all virtual addresses that use the address given in parameter



DexFile

class lief.OAT.DexFile(self: lief.OAT.DexFile) None

OAT DexFile representation

property checksum

Checksum of the underlying DEX file

property dex_file

Associated lief.DEX.File

property dex_offset

Offset to the raw lief.DEX.File

property has_dex_file

Check if the lief.DEX.File is present

property location

Original location of the DEX file


Class

class lief.OAT.Class(self: lief.OAT.Class) None

OAT Class representation

property bitmap

Bitmap information used to quickly find which methods are optimized

property fullname

Class mangled name (e.g. Lcom/android/MyActivity;)

has_dex_class(self: lief.OAT.Class) bool

True if a lief.DEX.Class object is associated with this OAT Class

property index

Index the DEX classes pool (lief.DEX.File.classes)

is_quickened(*args, **kwargs)

Overloaded function.

  1. is_quickened(self: lief.OAT.Class, dex_method: LIEF::DEX::Method) -> bool

Check if the given lief.DEX.Method is compiled into native code

  1. is_quickened(self: lief.OAT.Class, method_index: int) -> bool

Check if the Method at the given index is compiled into native code

class it_methods
method_offsets_index(*args, **kwargs)

Overloaded function.

  1. method_offsets_index(self: lief.OAT.Class, arg0: LIEF::DEX::Method) -> int

  2. method_offsets_index(self: lief.OAT.Class, arg0: int) -> int

property methods

Iterator over lief.OAT.Method

property status

Class OAT_CLASS_STATUS

property type

Information (OAT_CLASS_TYPES) about how methods are optimized


Method

class lief.OAT.Method(self: lief.OAT.Method) None

OAT Method representation

property dex_method

Mirrored Method associated with the OAT method (or None)

property has_dex_method

Check if a Method is associated with the OAT method

property is_compiled

True if the optimization is native

property is_dex2dex_optimized

True if the optimization is DEX

property name

Method’s name

property oat_class

Class associated with the method (or None)

property quick_code

Quick code associated with the method


Enums

OAT Class types

class lief.OAT.OAT_CLASS_TYPES(self: lief.OAT.OAT_CLASS_TYPES, value: int) None

Members:

ALL_COMPILED

SOME_COMPILED

NONE_COMPILED

ALL_COMPILED = <OAT_CLASS_TYPES.ALL_COMPILED: 0>
NONE_COMPILED = <OAT_CLASS_TYPES.NONE_COMPILED: 2>
SOME_COMPILED = <OAT_CLASS_TYPES.SOME_COMPILED: 1>
property name
property value

OAT Class Status

class lief.OAT.OAT_CLASS_STATUS(self: lief.OAT.OAT_CLASS_STATUS, value: int) None

Members:

RETIRED

ERROR

NOTREADY

IDX

LOADED

RESOLVING

RESOLVED

VERIFYING

VERIFICATION_AT_RUNTIME

VERIFYING_AT_RUNTIME

VERIFIED

INITIALIZING

INITIALIZED

ERROR = <OAT_CLASS_STATUS.ERROR: -1>
IDX = <OAT_CLASS_STATUS.IDX: 1>
INITIALIZED = <OAT_CLASS_STATUS.INITIALIZED: 10>
INITIALIZING = <OAT_CLASS_STATUS.INITIALIZING: 9>
LOADED = <OAT_CLASS_STATUS.LOADED: 2>
NOTREADY = <OAT_CLASS_STATUS.NOTREADY: 0>
RESOLVED = <OAT_CLASS_STATUS.RESOLVED: 4>
RESOLVING = <OAT_CLASS_STATUS.RESOLVING: 3>
RETIRED = <OAT_CLASS_STATUS.RETIRED: -2>
VERIFICATION_AT_RUNTIME = <OAT_CLASS_STATUS.VERIFICATION_AT_RUNTIME: 6>
VERIFIED = <OAT_CLASS_STATUS.VERIFIED: 8>
VERIFYING = <OAT_CLASS_STATUS.VERIFYING: 5>
VERIFYING_AT_RUNTIME = <OAT_CLASS_STATUS.VERIFYING_AT_RUNTIME: 7>
property name
property value

Header Keys

class lief.OAT.HEADER_KEYS(self: lief.OAT.HEADER_KEYS, value: int) None

Members:

IMAGE_LOCATION

DEX2OAT_CMD_LINE

DEX2OAT_HOST

PIC

HAS_PATCH_INFO

DEBUGGABLE

NATIVE_DEBUGGABLE

COMPILER_FILTER

CLASS_PATH

BOOT_CLASS_PATH

CONCURRENT_COPYING

BOOT_CLASS_PATH = <HEADER_KEYS.BOOT_CLASS_PATH: 9>
CLASS_PATH = <HEADER_KEYS.CLASS_PATH: 8>
COMPILER_FILTER = <HEADER_KEYS.COMPILER_FILTER: 7>
CONCURRENT_COPYING = <HEADER_KEYS.CONCURRENT_COPYING: 10>
DEBUGGABLE = <HEADER_KEYS.DEBUGGABLE: 5>
DEX2OAT_CMD_LINE = <HEADER_KEYS.DEX2OAT_CMD_LINE: 1>
DEX2OAT_HOST = <HEADER_KEYS.DEX2OAT_HOST: 2>
HAS_PATCH_INFO = <HEADER_KEYS.HAS_PATCH_INFO: 4>
IMAGE_LOCATION = <HEADER_KEYS.IMAGE_LOCATION: 0>
NATIVE_DEBUGGABLE = <HEADER_KEYS.NATIVE_DEBUGGABLE: 6>
PIC = <HEADER_KEYS.PIC: 3>
property name
property value

Instruction sets

class lief.OAT.INSTRUCTION_SETS(self: lief.OAT.INSTRUCTION_SETS, value: int) None

Members:

NONE

ARM

ARM_64

THUMB2

X86

X86_64

MIPS

MIPS_64

ARM = <INSTRUCTION_SETS.ARM: 1>
ARM_64 = <INSTRUCTION_SETS.ARM_64: 2>
MIPS = <INSTRUCTION_SETS.MIPS: 6>
MIPS_64 = <INSTRUCTION_SETS.MIPS_64: 7>
NONE = <INSTRUCTION_SETS.NONE: 0>
THUMB2 = <INSTRUCTION_SETS.THUMB2: 3>
X86 = <INSTRUCTION_SETS.X86: 4>
X86_64 = <INSTRUCTION_SETS.X86_64: 5>
property name
property value