Python

Parser

lief.parse(obj: str | io.IOBase | os.PathLike | bytes | list[int]) → PE.Binary | OAT.Binary | ELF.Binary | MachO.Binary | COFF.Binary | None

Parse a binary supported by LIEF (ELF, PE, Mach-O, …) from the given Python object and return the corresponding Binary object.

---

Binary

class lief.Binary

Bases: Object

Generic interface representing a binary executable.

This class provides a unified interface across multiple binary formats such as ELF, PE, Mach-O, and others. It enables users to access binary components like headers, sections, symbols, relocations, and functions in a format-agnostic way.

Subclasses (like lief.PE.Binary) implement format-specific API

class FORMATS(*values)

Bases: Enum

ELF = 1

MACHO = 3

OAT = 4

PE = 2

UNKNOWN = 0

class VA_TYPES(*values)

Bases: Enum

Enumeration of virtual address types used for patching and memory access.

AUTO = 0

RVA = 1

VA = 2

property abstract → lief.Binary

Return the abstract representation of the current binary (lief.Binary)

assemble(self, address: int, assembly: str, config: lief._lief.assembly.AssemblerConfig = <lief._lief.assembly.AssemblerConfig object at 0x7f3b0e05e790>) → bytes

Assemble and patch the provided assembly code at the specified address.

The function returns the generated assembly bytes.

Example:

bin.assemble(0x12000440, """
xor rax, rbx;
mov rcx, rax;
""")

If you need to configure the assembly engine or to define addresses for symbols, you can provide your own AssemblerConfig instance.

property concrete → lief.ELF.Binary | lief.PE.Binary | lief.MachO.Binary

The concrete representation of the binary. Basically, this property casts a lief.Binary into a lief.PE.Binary, lief.ELF.Binary or lief.MachO.Binary.

See also: lief.Binary.abstract

property ctor_functions → list[lief.Function]

Constructor functions that are called prior to any other functions

property debug_info → lief.DebugInfo | None

Return debug info if present. It can be either a lief.dwarf.DebugInfo or a lief.pdb.DebugInfo

For ELF and Mach-O binaries, it returns the given DebugInfo object only if the binary embeds the DWARF debug info in the binary itself.

For PE file, this function tries to find the external PDB using the lief.PE.CodeViewPDB.filename output (if present). One can also use lief.pdb.load() to manually load a PDB.

Warning

This function requires LIEF’s extended version otherwise it always returns None

disassemble(self, address: int) → Iterator[lief._lief.assembly.Instruction | None]

disassemble(self, address: int, size: int) → Iterator[lief._lief.assembly.Instruction | None]

disassemble(self, function_name: str) → Iterator[lief._lief.assembly.Instruction | None]

Overloaded function.

1. disassemble(self, address: int) -> Iterator[Optional[lief._lief.assembly.Instruction]]

   Disassemble code starting at the given virtual address.

   insts = binary.disassemble(0xacde, 100);
   for inst in insts:
       print(inst)
   

   See also

   lief.assembly.Instruction

2. disassemble(self, address: int, size: int) -> Iterator[Optional[lief._lief.assembly.Instruction]]

   Disassemble code starting at the given virtual address and with the given size.

   insts = binary.disassemble(0xacde, 100);
   for inst in insts:
       print(inst)
   

   See also

   lief.assembly.Instruction

3. disassemble(self, function_name: str) -> Iterator[Optional[lief._lief.assembly.Instruction]]

   Disassemble code for the given symbol name

   insts = binary.disassemble("__libc_start_main");
   for inst in insts:
       print(inst)
   

   See also

   lief.assembly.Instruction

disassemble_from_bytes(self, buffer: bytes, address: int = 0) → Iterator[lief._lief.assembly.Instruction | None]

Disassemble code from the provided bytes

raw = bytes(binary.get_section(".text").content)
insts = binary.disassemble_from_bytes(raw);
for inst in insts:
    print(inst)

See also

lief.assembly.Instruction

property entrypoint → int

Binary’s entrypoint

property exported_functions → list[lief.Function]

Return the binary’s exported Function

property format → lief.Binary.FORMATS

File format (FORMATS) of the underlying binary.

get_content_from_virtual_address(self, virtual_address: int, size: int, va_type: lief._lief.Binary.VA_TYPES = VA_TYPES.AUTO) → memoryview

Return the content located at the provided virtual address. The virtual address is specified in the first argument and size to read (in bytes) in the second.

If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default, it is set to AUTO.

get_function_address(self, function_name: str) → int | lief._lief.lief_errors

Return the address of the given function name

get_int_from_virtual_address(self, address: int, interger_size: int, type: lief._lief.Binary.VA_TYPES = VA_TYPES.AUTO) → int | None

Get an integer representation of the data at the given address

get_symbol(self, symbol_name: str) → lief._lief.Symbol | None

Return the Symbol from the given name.

If the symbol can’t be found, it returns None.

property has_nx → bool

Check if the binary has NX protection (non executable stack)

has_symbol(self, symbol_name: str) → bool

Check if a Symbol with the given name exists

property header → lief.Header

Binary’s abstract header (Header)

property imagebase → int

Default image base (i.e. if the ASLR is not enabled)

property imported_functions → list[lief.Function]

Return the binary’s imported Function (name)

property is_pie → bool

Check if the binary is position independent

property libraries → list[str | bytes]

Return binary’s imported libraries (name)

load_debug_info(self, path: str | os.PathLike) → lief._lief.DebugInfo | None

Load and associate an external debug file (e.g., DWARF or PDB) with this binary.

This method attempts to load the debug information from the file located at the given path, and binds it to the current binary instance. If successful, it returns the loaded DebugInfo object.

Warning

It is the caller’s responsibility to ensure that the debug file is compatible with the binary. Incorrect associations may lead to inconsistent or invalid results.

Note

This function does not verify that the debug file matches the binary’s unique identifier (e.g., build ID, GUID).

offset_to_virtual_address(self, offset: int, slide: int = 0) → int | lief._lief.lief_errors

Convert an offset into a virtual address.

property original_size → int

Original size of the binary

property page_size → int

Get the default memory page size according to the architecture and the format of the current binary

patch_address(self, address: int, patch_value: collections.abc.Sequence[int], va_type: lief._lief.Binary.VA_TYPES = VA_TYPES.AUTO) → None

patch_address(self, address: int, patch_value: int, size: int = 8, va_type: lief._lief.Binary.VA_TYPES = VA_TYPES.AUTO) → None

Overloaded function.

1. patch_address(self, address: int, patch_value: collections.abc.Sequence[int], va_type: lief._lief.Binary.VA_TYPES = VA_TYPES.AUTO) -> None

   Patch the address with the given list of bytes. The virtual address is specified in the first argument and the content in the second (as a list of bytes).

   If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default, it is set to AUTO.

2. patch_address(self, address: int, patch_value: int, size: int = 8, va_type: lief._lief.Binary.VA_TYPES = VA_TYPES.AUTO) -> None

   Patch the address with the given integer value. The virtual address is specified in the first argument, the integer in the second and the integer’s size in the third one.

   If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default, it is set to AUTO.

property relocations → lief.Binary.it_relocations

Return an iterator over abstract Relocation

remove_section(self, name: str, clear: bool = False) → None

Remove the section with the given name

property sections → lief.Binary.it_sections

Return an iterator over the binary’s abstract sections (Section)

property symbols → lief.Binary.it_symbols

Return an iterator over the binary’s abstract Symbol

property virtual_size → int

xref(self, virtual_address: int) → list[int]

Return all virtual addresses that use the address given in parameter

---

Header

class lief.Header

Bases: Object

Class which represents an abstracted Header

class ARCHITECTURES(*values)

Bases: Enum

ARM = 1

ARM64 = 2

LOONGARCH = 11

MIPS = 3

PPC = 6

PPC64 = 12

RISCV = 10

SPARC = 7

SYSZ = 8

UNKNOWN = 0

X86 = 4

X86_64 = 5

XCORE = 9

from_value(arg: int) → lief.Header.ARCHITECTURES = <nanobind.nb_func object>

class ENDIANNESS(*values)

Bases: Enum

BIG = 1

LITTLE = 2

UNKNOWN = 0

from_value(arg: int) → lief.Header.ENDIANNESS = <nanobind.nb_func object>

class MODES(*values)

Bases: Enum

ARM64E = 16

BITS_16 = 1

BITS_32 = 2

BITS_64 = 4

NONE = 0

THUMB = 8

from_value(arg: int) → lief.Header.MODES = <nanobind.nb_func object>

class OBJECT_TYPES(*values)

Bases: Enum

EXECUTABLE = 1

LIBRARY = 2

OBJECT = 3

UNKNOWN = 0

from_value(arg: int) → lief.Header.OBJECT_TYPES = <nanobind.nb_func object>

property architecture → lief.Header.ARCHITECTURES

Target architecture

property endianness → lief.Header.ENDIANNESS

Binary endianness

property entrypoint → int

Binary entrypoint

property is_32 → bool

True if the binary targets a 32-bits architecture

property is_64 → bool

True if the binary targets a 64-bits architecture

property modes → lief.Header.MODES

Architecture details

property modes_list → list[lief.Header.MODES]

Modes as a list

property object_type → lief.Header.OBJECT_TYPES

Type of the binary (executable, library…)

---

Section

class lief.Section

Bases: Object

Class which represents an abstracted section

property content → memoryview

Section’s content

property entropy → float

Section’s entropy

property fullname → bytes

Return the fullname of the section including the trailing bytes

property name → str | bytes

Section’s name

property offset → int

Section’s file offset

search(self, number: int, pos: int = 0, size: int = 0) → int | None

search(self, str: str, pos: int = 0) → int | None

search(self, bytes: bytes, pos: int = 0) → int | None

Overloaded function.

1. search(self, number: int, pos: int = 0, size: int = 0) -> Optional[int]

Look for integer within the current section

2. search(self, str: str, pos: int = 0) -> Optional[int]

Look for string within the current section

3. search(self, bytes: bytes, pos: int = 0) -> Optional[int]

Look for the given bytes within the current section

search_all(self, number: int, size: int = 0) → list[int]

search_all(self, str: str) → list[int]

Overloaded function.

1. search_all(self, number: int, size: int = 0) -> list[int]

Look for all integers within the current section

2. search_all(self, str: str) -> list[int]

Look for all strings within the current section

property size → int

Section’s size

property virtual_address → int

Section’s virtual address

---

Symbol

class lief.Symbol

Bases: Object

This class represents a symbol in an executable format.

property name → str | bytes

Symbol’s name

property size → int

Symbol’s size

property value → int

Symbol’s value

---

Relocation

class lief.Relocation

Bases: Object

Class which represents an abstracted Relocation

property address → int

Relocation’s address

property size → int

Relocation’s size (in bits)

---

Function

class lief.Function(self)

class lief.Function(self, arg: str, /)

class lief.Function(self, arg: int, /)

class lief.Function(self, arg0: str, arg1: int, /)

Bases: Symbol

Class which represents a Function in an executable file format.

class FLAGS(*values)

Bases: Flag

CONSTRUCTOR = 1

DEBUG_INFO = 4

DESTRUCTOR = 2

EXPORTED = 8

IMPORTED = 16

NONE = 0

from_value(arg: int) → lief.Function.FLAGS = <nanobind.nb_func object>

add(self, flag: lief._lief.Function.FLAGS) → lief._lief.Function

Add the given FLAGS

property address → int

Function’s address

property flags → lief.Function.FLAGS

Function flags

property flags_list → list[lief.Function.FLAGS]

Function flags as a list of FLAGS

has(self, flag: lief._lief.Function.FLAGS) → bool

Check if the function has the given flag