Utilities¶

Demangling¶

LIEF exposes a demangling API for the following formats:

lief.demangle("?h@@YAXH@Z")

void __cdecl h(int)

lief.demangle("_RNvCskwGfYPst2Cb_3foo16example_function")

foo::example_function

lief.demangle("_ZTSN3lld13SpecificAllocINS_4coff9TpiSourceEEE")

typeinfo name for lld::SpecificAlloc<lld::coff::TpiSource>

lief.demangle("_$s10Foundation4DataV15_RepresentationON")

type metadata for Foundation.Data._Representation

lief.demangle(mangled: str) → str | None¶

Demangle the given input.

Warning

This function only works with the extended version of LIEF

lief::demangle

Extended Version¶

To check if the current build is an extended version you can use:

lief._lief.__extended__ = False¶

bool(x) -> bool

Returns True when the argument x is true, False otherwise. The builtins True and False are the only two instances of the class bool. The class bool is a subclass of the class int, and cannot be subclassed.

lief::is_extended

In C++ you can also check if the LIEF_EXTENDED is defined:

#include <LIEF/config.hpp>

#if defined(LIEF_EXTENDED)
// Extended version
#else
// Regular version
#endif

To get details about the version of the current extended build:

Android Platform¶

lief.Android.code_name(version: lief.Android.ANDROID_VERSIONS) → str¶

Return the Android code associated with a ANDROID_VERSIONS.

For example: Nougat

lief.Android.version_string(version: lief.Android.ANDROID_VERSIONS) → str¶

Return the ANDROID_VERSIONS as a string..

For example: 7.0.1

class lief.Android.ANDROID_VERSIONS(value)¶

Bases: Enum

UNKNOWN = 0¶

VERSION_601 = 1¶

VERSION_700 = 2¶

VERSION_710 = 3¶

VERSION_712 = 4¶

VERSION_800 = 5¶

VERSION_810 = 6¶

VERSION_900 = 7¶

from_value(arg: int) → lief.Android.ANDROID_VERSIONS = <nanobind.nb_func object>¶

Python Leaks¶

lief.disable_leak_warning() → None¶

Disable nanobind warnings about leaked objects. For instance:

nanobind: leaked 45 instances!
nanobind: leaked 25 types!
 - leaked type "lief._lief.FORMATS"
 - ... skipped remainder
nanobind: leaked 201 functions!
 - leaked function ""
 - leaked function "export_symbol"
 - ... skipped remainder
nanobind: this is likely caused by a reference counting issue in the binding code.

Helpers¶

The lief.dump() utility can be used to pretty dump a buffer.

For instance:

pe = lief.PE.parse("some.exe")
text = pe.get_section(".text")
print(lief.dump(text.content))

lief.dump(buffer: memoryview, title: str, prefix: str, limit: int) → str¶

Hexdump the provided buffer:

+---------------------------------------------------------------------+
| 88 56 05 00 00 00 00 00 00 00 00 00 22 58 05 00  | .V.........."X.. |
| 10 71 02 00 78 55 05 00 00 00 00 00 00 00 00 00  | .q..xU.......... |
| 68 5c 05 00 00 70 02 00 00 00 00 00 00 00 00 00  | h\...p.......... |
| 00 00 00 00 00 00 00 00 00 00 00 00              | ............     |
+---------------------------------------------------------------------+

• lief::dump

• lief::dump_with_limit