LIEF has been created to provide a cross-platform library that can parse and modify executable formats.

Written in C++, LIEF tries to be the go-to library when you need to process ELF, PE, or Mach-O with a friendly API. It also supports compilation options so that the ELF parser is only 900Kb on AArch64.

Additional features

In addition to standard executable formats, LIEF supports DEX, VDEX, and OAT files.

Since v0.11, it also supports the parsing and the verification of PE's Authenticode.

LIEF features overview
LIEF Public Release


After one year of internal development, Quarkslab open-sourced LIEF!

Recon Montreal
Presentation at Recon Montréal and Pass The Salt


In 2018, we presented format modification techniques to perform code injection and hooking regardless of the underlying architecture.

LIEF 0.10.1


LIEF 0.10.1 came with enhanced Mach-O modifications to add load-commands, sections, segments, ...

What a Peaceful Year!


In 2020, we mostly worked on bug fixes and the enhancement of PE Authenticode that arrives in LIEF v0.11.0. In addition, we worked on refactoring the whole ELF builder so that it scales on large binaries.

Need a special feature?

We are open for sponsoring to develop private or public features related to LIEF