LIEF Docs Extended Sponsor

Utilities

Demangling

LIEF exposes a demangling API for the following formats:

Input

lief.demangle("?h@@YAXH@Z")

Result

void __cdecl h(int)
result<std::string> LIEF::demangle(std::string_view mangled)

Demangle the given input.

This function only works with the extended version of LIEF

lief.demangle(mangled: str) → str | None

Demangle the given input.

Warning

This function only works with the extended version of LIEF

lief::demangle

Extended Version

To check if the current build is an extended version, you can use:

bool LIEF::is_extended()

Whether this version of LIEF includes extended features.

lief._lief.__extended__ = False

Returns True when the argument is true, False otherwise. The builtins True and False are the only two instances of the class bool. The class bool is a subclass of the class int, and cannot be subclassed.

lief::is_extended

In C++, you can also check if LIEF_EXTENDED is defined:

#include <LIEF/config.hpp>

#if defined(LIEF_EXTENDED)
// Extended version
#else
// Regular version
#endif

To get details about the version of the current extended build:

std::string LIEF::extended_version_info()

Details about the extended version.

Android Platform

lief.Android.code_name(version: lief.Android.ANDROID_VERSIONS) → str

Return the Android code associated with a ANDROID_VERSIONS.

For example: Nougat

lief.Android.version_string(version: lief.Android.ANDROID_VERSIONS) → str

Return the ANDROID_VERSIONS as a string.

For example: 7.0.1

class lief.Android.ANDROID_VERSIONS(*values)

Bases: Enum

UNKNOWN = 0
VERSION_601 = 1
VERSION_700 = 2
VERSION_710 = 3
VERSION_712 = 4
VERSION_800 = 5
VERSION_810 = 6
VERSION_900 = 7
from_value(arg: int) → lief.Android.ANDROID_VERSIONS = <nanobind.nb_func object>
const char *LIEF::Android::code_name(ANDROID_VERSIONS version)
const char *LIEF::Android::version_string(ANDROID_VERSIONS version)
enum class LIEF::Android::ANDROID_VERSIONS

Values:

enumerator VERSION_UNKNOWN = 0
enumerator VERSION_601 = 1
enumerator VERSION_700 = 2
enumerator VERSION_710 = 3
enumerator VERSION_712 = 4
enumerator VERSION_800 = 5
enumerator VERSION_810 = 6
enumerator VERSION_900 = 7

Python Leaks

lief.disable_leak_warning() → None

Disable nanobind warnings about leaked objects. For instance:

nanobind: leaked 45 instances!
nanobind: leaked 25 types!
 - leaked type "lief._lief.FORMATS"
 - ... skipped remainder
nanobind: leaked 201 functions!
 - leaked function ""
 - leaked function "export_symbol"
 - ... skipped remainder
nanobind: this is likely caused by a reference counting issue in the binding code.

Helpers

The lief.dump() utility can be used to pretty-print a buffer.

For example:

pe = lief.PE.parse("some.exe")
assert isinstance(pe, lief.PE.Binary)

text = pe.get_section(".text")
assert isinstance(pe, lief.PE.Section)

print(lief.dump(text.content))
lief.dump(*args) → str
lief.dump(buffer: bytes, title: str = '', prefix: str = '', limit: int = 0) → str

Hexdump the provided buffer:

+---------------------------------------------------------------------+
| 88 56 05 00 00 00 00 00 00 00 00 00 22 58 05 00  | .V.........."X.. |
| 10 71 02 00 78 55 05 00 00 00 00 00 00 00 00 00  | .q..xU.......... |
| 68 5c 05 00 00 70 02 00 00 00 00 00 00 00 00 00  | h\...p.......... |
| 00 00 00 00 00 00 00 00 00 00 00 00              | ............     |
+---------------------------------------------------------------------+
inline std::string LIEF::dump(const std::vector<uint8_t> &data, const std::string &title = "", const std::string &prefix = "", size_t limit = 0)
std::string LIEF::dump(const uint8_t *buffer, size_t size, const std::string &title = "", const std::string &prefix = "", size_t limit = 0)

Hexdump the provided buffer.

For instance:

+---------------------------------------------------------------------+
| 88 56 05 00 00 00 00 00 00 00 00 00 22 58 05 00  | .V.........."X.. |
| 10 71 02 00 78 55 05 00 00 00 00 00 00 00 00 00  | .q..xU.......... |
| 68 5c 05 00 00 70 02 00 00 00 00 00 00 00 00 00  | h\...p.......... |
| 00 00 00 00 00 00 00 00 00 00 00 00              | ............     |
+---------------------------------------------------------------------+
inline std::string LIEF::dump(span<const uint8_t> data, const std::string &title = "", const std::string &prefix = "", size_t limit = 0)