Tl;DRLIEF v0.11.0 is out. The main changelog is available here and packages can be downloaded on the official website.
As for the previous versions, release packages are available on the Github release page and Python packages can be installed from PyPI:
1$ pip install [--user] lief==0.11.0
It has spent more than one year since the release of the version 0.10.1 but we are glad to announce that LIEF v0.11.0 is finally out!
This new version does not introduce a lot of new features but rather small improvements in the different formats. One of the main changes in terms of new functionalities is the refactoring of the PE Authenticode. We fixed parsing issues and we implemented verification functions so that we can now verify a PE signed binary through:
2pe = lief.parse("signed.exe")
3assert pe.verify_signature() == lief.PE.Signature.VERIFICATION_FLAGS.OK
We also improved the computation of imphash so that it can generate the same value as pefile (and therefore, Virus Total)
1pe = lief.parse("example.exe")
2vt_imphash = lief.PE.get_imphash(pe, lief.PE.IMPHASH_MODE.PEFILE)
3lief_imphash = lief.PE.get_imphash(pe, lief.PE.IMPHASH_MODE.DEFAULT)
Regarding the contributions, Janusz Lisiecki fixed a performance issue in the ELF
builder that moved from
N2 computations to
Nlog(N). His contribution raised a major weakness in LIEF:
performances issue when re-building objects. We started to refactor the whole ELF builder to avoid recursive
We improved AppVeyor Windows CI to be more efficient on the compiler cache. It results in a decrease of 1-hour compilation time to ~20 minutes thanks to sccache and Ninja.
If Ninja is installed on Windows, one can now use the
--ninja flag when calling
1$ python.exe .\setup.py --ninja build install [--user]
Using Ninja on Windows requires to invoke the
vcvarsall.bat script beforehand. This script can be tricky to
locate depending on the MSVC versions. Thankfully, setuptools provides the msvc.msvc14_get_vc_env()
helper to get the environment variables that need to populate the calling script. We use it in LIEF’s
2env = os.environ
3if platform.system() == "Windows":
4 from setuptools import msvc
5 if build_with_ninja:
6 arch = 'x64' if is64 else 'x86'
7 ninja_env = msvc.msvc14_get_vc_env(arch)
Regarding the CI, we added Android and iOS SDK packages as well as Python wheels for Linux AArch64
We have a few ideas of what would like to improve and introduce in the next releases of LIEF which includes:
Refactoring the ELF builder to address performances issues (see also #482)
Supporting OAT/VDEX/CDEX for Android 9, 10 and 11
Supporting Mach-O signature (as for PE Authenticode)
Supporting Android packed relocations (in the parser and in the builder)
Improving the C API to ease Rust bindings
Supporting DART snapshot formats to ease reverse-engineering of Flutter applications.
Spoiler: we can process all the clusters of a snapshot for a fixed version of the DART runtime.
+= Fixing issues
Although the roadmap mostly follows Quarkslab’s needs, the R&D time we have and the topic we enjoy to work on, we are open to the development of private or public features as it has been done for improving PE Authenticode.