--- documentID: "eed632b369270a2ddd5a79c4c2c3c0d8219b00a8f249614e9bf89f5316126282" docname: "changelog" title: "Changelog - LIEF Documentation" description: "Changelog. This release contains several security fixes:" canonical: "https://lief.re/doc/latest/changelog.html" markdownURL: "https://lief.re/doc/latest/changelog.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "b5b84d2868da1323f9995610f5af2ca58e2574b8731e9fa5ef9470cd1ecb9ce8" --- # [Changelog]() ## [2.0.0 - Not Released Yet]() > **Breaking Changes** > > - **C++17 Migration**: LIEF public headers, public API, and STL have been bumped from C++11 to **C++17**. > - **C API Removal**: The legacy C API has been completely removed. > - **Logging Level Renaming**: `lief.logging.Level` ( [`lief::logging::Level`]() ; [`lief.logging.Level`]() ; [`LIEF::logging::Level`]() ) and its enumerators are now written in `CamelCase` **Assembly:** - Add API to inspect and rewrite the `LOCK` prefix of x86 instructions: - `lief.assembly.x86.Instruction.has_lock_prefix()` ( [`lief::assembly::x86::Instruction::has_lock_prefix`]() ; [`lief.assembly.x86.Instruction.has_lock_prefix`]() ; [`LIEF::assembly::x86::Instruction::has_lock_prefix()`]() ) - `lief.assembly.x86.Instruction.is_lockable()` ( [`lief::assembly::x86::Instruction::is_lockable`]() ; [`lief.assembly.x86.Instruction.is_lockable`]() ; [`LIEF::assembly::x86::Instruction::is_lockable()`]() ) - `lief.assembly.x86.Instruction.is_atomic()` ( [`lief::assembly::x86::Instruction::is_atomic`]() ; [`lief.assembly.x86.Instruction.is_atomic`]() ; [`LIEF::assembly::x86::Instruction::is_atomic()`]() ) - `lief.assembly.x86.Instruction.lock()` ( [`lief::assembly::x86::Instruction::lock`]() ; [`lief.assembly.x86.Instruction.lock()`]() ; [`LIEF::assembly::x86::Instruction::lock()`]() ) - `lief.assembly.x86.Instruction.unlock()` ( [`lief::assembly::x86::Instruction::unlock`]() ; [`lief.assembly.x86.Instruction.unlock()`]() ; [`LIEF::assembly::x86::Instruction::unlock()`]() ) **ELF:** - Fix the layout of the segments added by LIEF for the architectures that can use pages larger than 4K ([#1366]()) - Fix the modification of binaries that have already been modified by LIEF. The segment table was relocated a second time which, for the non-PIE binaries, shifted the sections without shifting the segments nor the dynamic entries. It resulted in a `DT_STRTAB` that was no longer pointing to `.dynstr` (i.e. garbage `DT_NEEDED`/`DT_RUNPATH` names) and in a `PT_PHDR` that was not wrapped by a `PT_LOAD` segment ([#1366]()). - `lief.ELF.check_layout()` ( [`lief.ELF.check_layout()`]() ; [`LIEF::ELF::check_layout()`]() ; [`lief::elf::check_layout`]() ) now reports the `PT_LOAD` segments that can’t be mapped independently because they share the same page. It also report mismatch between `.dynstr` virtual address and `DT_STRTAB`. - Add support for the MIPS n64 relocation encoding ([#1367]() by [plusls]()). - Add `lief.ELF.Header.is_mips_n64` ( [`lief::elf::Header::is_mips_n64`]() ; [`lief.ELF.Header.is_mips_n64`]() ; [`LIEF::ELF::Header::is_mips_n64()`]() ) to check whether a binary uses this encoding. - `lief.ELF.Relocation.resolve()` ( [`lief::elf::Relocation::resolve`]() ; [`lief::elf::Relocation::resolve_with_base_address`]() ; [`lief.ELF.Relocation.resolve()`]() ; [`LIEF::ELF::Relocation::resolve()`]() ) now supports `R_MIPS_REL32`. **COFF:** - Add `lief.COFF.Binary.get_section()` ( [`lief::coff::Binary::section_by_name`]() ; [`lief.COFF.Binary.get_section()`]() ; [`LIEF::COFF::Binary::get_section()`]() ) to look up a section by its name. Names that are stored in the COFF string table (i.e. longer than 8 bytes) can be resolved either from their regular value or from their `/` placeholder: ```python import lief coff = lief.COFF.parse("dwarf.obj") section = coff.get_section(".debug_rnglists") section.name # '/18' section.coff_string.string # '.debug_rnglists' ``` **Runtime:** - Add `lief.runtime.Memory.mmap_hint()` ( [`lief::runtime::Memory::mmap_hint`]() ; [`lief.runtime.Memory.mmap_hint()`]() ; [`LIEF::runtime::Memory::mmap_hint()`]() ) to allocate memory close to a given address. - Add `lief.runtime.MemoryLayout` ( [`lief.runtime.MemoryLayout`]() ; [`LIEF::runtime::MemoryLayout`]() ) to inspect the memory layout of the current process. `lief.runtime.memory_layout()` ( [`lief::runtime::memory_layout`]() ; [`lief.runtime.memory_layout()`]() ; [`LIEF::runtime::memory_layout()`]() ) iterates over the mapped `lief.runtime.MemoryLayout.Region` ( [`lief::runtime::Region`]() ; [`lief.runtime.MemoryLayout.Region`]() ; [`LIEF::runtime::MemoryLayout::Region`]() ) ([documentation]()): ```python import lief for region in lief.runtime.memory_layout(): print(f"{region.addr:#014x}-{region.end_addr:#014x} {region.name}") ``` **C++:** - The parsers now take the file path as a `std::string_view` and they also accept a `std::filesystem::path`: ```cpp #include #include std::filesystem::path path = "/bin/ls"; std::unique_ptr elf = LIEF::ELF::Parser::parse(path); ``` **Dependencies:** - Update nanobind to version `3.0.1` **Python:** - Python 3.9 is no longer supported. nanobind 3 requires Python 3.10 or newer. ## [1.0.0 - July 12th, 2026]() > **Runtime** > > LIEF now provides runtime features as described here: [Runtime]() **BinaryNinja:** - Add [Android JNI Analyzer]() - The DWARF import plugin now supports comments **Ghidra:** - Add support for generating DWARF from firmware or binaries without a precise format or architecture ([#1249]()) **DWARF:** - Add support for accessing the bit size of bit-field declarations ([#1265]()) - Add support for accessing Enum entries: `lief.dwarf.types.Enum.entries()` ( [`lief::dwarf::types::Enum::entries`]() ; [`LIEF::dwarf::types::Enum::entries()`]() ; [`lief.dwarf.types.Enum.entries`]() ) - Add support for reading from or assigning a register to a function parameter - Add support for reading from or assigning a description (`DW_AT_description`) to a `lief.dwarf.Function` ( [`lief::dwarf::Function`]() ; [`lief.dwarf.Function`]() ; [`LIEF::dwarf::Function`]() ), `lief.dwarf.Variable` ( [`lief::dwarf::Variable`]() ; [`lief.dwarf.Variable`]() ; [`LIEF::dwarf::Variable`]() ), or `lief.dwarf.LexicalBlock` ( [`lief::dwarf::LexicalBlock`]() ; [`lief.dwarf.LexicalBlock`]() ; [`LIEF::dwarf::LexicalBlock`]() ): - `lief.dwarf.Function.description()` ( [`lief::dwarf::Function::description`]() ; [`LIEF::dwarf::Function::description()`]() ; [`lief.dwarf.Function.description`]() ) - `lief.dwarf.Variable.description()` ( [`lief::dwarf::Variable::description`]() ; [`LIEF::dwarf::Variable::description()`]() ; [`lief.dwarf.Variable.description`]() ) - `lief.dwarf.LexicalBlock.description()` ( [`lief::dwarf::LexicalBlock::description`]() ; [`LIEF::dwarf::LexicalBlock::description()`]() ; [`lief.dwarf.LexicalBlock.description`]() ) - Enable the creation of nested `lief.dwarf.editor.Function.LexicalBlock` ( [`lief::dwarf::editor::function::LexicalBlock`]() ; [`lief.dwarf.editor.Function.LexicalBlock`]() ; [`LIEF::dwarf::editor::Function::LexicalBlock`]() ) - Add support for generating a C/C++ definition for a whole `lief.dwarf.CompilationUnit` ( [`lief::dwarf::CompilationUnit`]() ; [`lief.dwarf.CompilationUnit`]() ; [`LIEF::dwarf::CompilationUnit`]() ) ( `lief.dwarf.CompilationUnit.to_decl()` ( [`lief::dwarf::CompilationUnit::to_decl`]() ; [`lief::dwarf::CompilationUnit::to_decl_with_opt`]() ; [`lief.dwarf.CompilationUnit.to_decl()`]() ; [`LIEF::dwarf::CompilationUnit::to_decl()`]() )). The output of the following `to_decl()` functions can now be configured through the new `lief.DeclOpt` ( [`lief::DeclOpt`]() ; [`lief.DeclOpt`]() ; [`LIEF::DeclOpt`]() ) structure: - `lief.dwarf.Function.to_decl()` ( [`lief::dwarf::Function::to_decl`]() ; [`lief::dwarf::Function::to_decl_with_opt`]() ; [`lief.dwarf.Function.to_decl()`]() ; [`LIEF::dwarf::Function::to_decl()`]() ) - `lief.dwarf.Variable.to_decl()` ( [`lief::dwarf::Variable::to_decl`]() ; [`lief::dwarf::Variable::to_decl_with_opt`]() ; [`lief.dwarf.Variable.to_decl()`]() ; [`LIEF::dwarf::Variable::to_decl()`]() ) - `lief.dwarf.Type.to_decl()` ( [`lief::dwarf::Type::to_decl`]() ; [`lief::dwarf::Type::to_decl_with_opt`]() ; [`lief.dwarf.Type.to_decl()`]() ; [`LIEF::dwarf::Type::to_decl()`]() ) - `lief.dwarf.CompilationUnit.to_decl()` ( [`lief::dwarf::CompilationUnit::to_decl`]() ; [`lief::dwarf::CompilationUnit::to_decl_with_opt`]() ; [`lief.dwarf.CompilationUnit.to_decl()`]() ; [`LIEF::dwarf::CompilationUnit::to_decl()`]() ) ```python import lief dbg = lief.dwarf.load("/bin/with_debug") opt = lief.DeclOpt() opt.is_cpp = True opt.indentation = 4 for cu in dbg.compilation_units: print(cu.to_decl(opt)) ``` **PDB:** - Improve support and the API for `LF_ENUM`: `lief.pdb.types.Enum` ( [`lief::pdb::types::Enum`]() ; [`lief.pdb.types.Enum`]() ; [`LIEF::pdb::types::Enum`]() ) - Improve support and the API for `LF_PROCEDURE`: `lief.pdb.types.Function` ( [`lief::pdb::types::Function`]() ; [`lief.pdb.types.Function`]() ; [`LIEF::pdb::types::Function`]() ) - Improve support and the API for `LF_ARRAY`: `lief.pdb.types.Array` ( [`lief::pdb::types::Array`]() ; [`lief.pdb.types.Array`]() ; [`LIEF::pdb::types::Array`]() ) - Improve support and the API for *simple* types: `lief.pdb.types.Simple` ( [`lief::pdb::types::Simple`]() ; [`lief.pdb.types.Simple`]() ; [`LIEF::pdb::types::Simple`]() ) - Improve support and the API for `LF_ONEMETHOD`: `lief.pdb.types.Method` ( [`lief::pdb::types::Method`]() ; [`lief.pdb.types.Method`]() ; [`LIEF::pdb::types::Method`]() ) - Add support for generating a C/C++ definition for a `lief.pdb.Function` ( [`lief::pdb::Function`]() ; [`lief.pdb.Function`]() ; [`LIEF::pdb::Function`]() ) ( `lief.pdb.Function.to_decl()` ( [`lief::pdb::Function::to_decl`]() ; [`lief::pdb::Function::to_decl_with_opt`]() ; [`lief.pdb.Function.to_decl()`]() ; [`LIEF::pdb::Function::to_decl()`]() )) and a `lief.pdb.CompilationUnit` ( [`lief::pdb::CompilationUnit`]() ; [`lief.pdb.CompilationUnit`]() ; [`LIEF::pdb::CompilationUnit`]() ) ( `lief.pdb.CompilationUnit.to_decl()` ( [`lief::pdb::CompilationUnit::to_decl`]() ; [`lief::pdb::CompilationUnit::to_decl_with_opt`]() ; [`lief.pdb.CompilationUnit.to_decl()`]() ; [`LIEF::pdb::CompilationUnit::to_decl()`]() )), configurable with the new `lief.DeclOpt` ( [`lief::DeclOpt`]() ; [`lief.DeclOpt`]() ; [`LIEF::DeclOpt`]() ) structure. **ELF:** - Add support for `DT_AUXILIARY` tag: `lief.ELF.DynamicEntryAuxiliary` ( [`lief.ELF.DynamicEntryAuxiliary`]() ; [`LIEF::ELF::DynamicEntryAuxiliary`]() ; [`lief::elf::dynamic::Auxiliary`]() ) ([#1159]()). - Add support for `DT_FILTER` tag: `lief.ELF.DynamicEntryFilter` ( [`lief.ELF.DynamicEntryFilter`]() ; [`LIEF::ELF::DynamicEntryFilter`]() ; [`lief::elf::dynamic::Filter`]() ) - Add `lief.ELF.parse_from_dump()` ( [`lief::elf::Binary::parse_from_dump`]() ; [`lief.ELF.parse_from_dump()`]() ; [`LIEF::ELF::Parser::parse_from_dump()`]() ) to parse an ELF binary from a memory dump **COFF:** - Add `lief.COFF.Section.coff_string` ( [`lief::coff::Section::coff_string`]() ; [`lief.COFF.Section.coff_string`]() ; [`LIEF::COFF::Section::coff_string()`]() ) for accessing the full section name when this name does not fit in 8 bytes. **Mach-O:** - Add support for writing big-endian Mach-O binaries ([#1236]()) - Introduce an API for selecting a specific Mach-O binary by architecture from a FAT binary ([#1283]()) - Add `lief.MachO.FatBinary.create()` ( [`lief.MachO.FatBinary.create()`]() ; [`LIEF::MachO::FatBinary::create()`]() ) to create a FAT binary from a list of `lief.MachO.Binary` ( [`lief::macho::Binary`]() ; [`lief.MachO.Binary`]() ; [`LIEF::MachO::Binary`]() ) objects targeting different architectures - Add support for `lief.MachO.ThreadLocalVariables` ( [`lief::macho::ThreadLocalVariables`]() ; [`lief.MachO.ThreadLocalVariables`]() ; [`LIEF::MachO::ThreadLocalVariables`]() ) - Fix an extra byte being written after the thread state of an `LC_UNIXTHREAD`/`LC_THREAD` command, which shifted the following load commands by one byte ([#1344]()) - Add support for editing the runtime tables of the `LC_FUNCTION_VARIANTS` command and committing the changes on write: `lief.MachO.FunctionVariants` ( [`lief::macho::commands::FunctionVariants`]() ; [`lief.MachO.FunctionVariants`]() ; [`LIEF::MachO::FunctionVariants`]() ) - Add a structured parser, editing API and writer for the `LC_FUNCTION_VARIANT_FIXUPS` command: `lief.MachO.FunctionVariantFixups` ( [`lief::macho::commands::FunctionVariantFixups`]() ; [`lief.MachO.FunctionVariantFixups`]() ; [`LIEF::MachO::FunctionVariantFixups`]() ) - Add support for the `LC_LAZY_LOAD_DYLIB_INFO` command: `lief.MachO.LazyLoadDylibInfo` ( [`lief::macho::commands::LazyLoadDylibInfo`]() ; [`lief.MachO.LazyLoadDylibInfo`]() ; [`LIEF::MachO::LazyLoadDylibInfo`]() ) - Add `lief.MachO.parse_from_dump()` ( [`lief::macho::FatBinary::parse_from_dump`]() ; [`lief.MachO.parse_from_dump()`]() ; [`LIEF::MachO::Parser::parse_from_dump()`]() ) to parse a Mach-O binary from a memory dump **PE:** - Add setters for `lief.PE.ImportEntry.iat_value` ( [`lief::pe::import::ImportEntry::iat_value`]() ; [`lief.PE.ImportEntry.iat_value`]() ; [`LIEF::PE::ImportEntry::iat_value()`]() ) and `lief.PE.ImportEntry.ilt_value` ( [`lief::pe::import::ImportEntry::ilt_value`]() ; [`lief.PE.ImportEntry.ilt_value`]() ; [`LIEF::PE::ImportEntry::ilt_value()`]() ) - Add `lief.PE.Binary.offset_to_rva()` ( [`lief::pe::Binary::offset_to_rva`]() ; [`lief.PE.Binary.offset_to_rva()`]() ; [`LIEF::PE::Binary::offset_to_rva()`]() ) to convert a raw offset into a RVA - Add `lief.PE.parse_from_dump()` ( [`lief::pe::Binary::parse_from_dump`]() ; [`lief.PE.parse_from_dump()`]() ; [`LIEF::PE::Parser::parse_from_dump()`]() ) to parse a PE binary from a memory dump - Update `lief.Binary.offset_to_virtual_address()` ( [`lief::generic::Binary::offset_to_virtual_address`]() ; [`lief.Binary.offset_to_virtual_address()`]() ; [`LIEF::Binary::offset_to_virtual_address()`]() ) for PE binaries to return an **absolute** virtual address instead of a RVA ([#1318]()) - Add support for adding an `lief.PE.Import` ( [`lief::pe::import::Import`]() ; [`lief.PE.Import`]() ; [`LIEF::PE::Import`]() ) at a specific position: `lief.PE.Binary.add_import()` ( [`lief::pe::Binary::add_import`]() ; [`lief::pe::Binary::add_import_at_pos`]() ; [`lief.PE.Binary.add_import()`]() ; [`LIEF::PE::Binary::add_import()`]() ) ([#1298]()) - Improve support for EFI binaries, such as `bzImage` ([#1293]()) **ObjC:** - Add support for Objective-C categories ([#1353]()): `lief.ObjC.Category` ( [`lief::objc::Category`]() ; [`lief.objc.Category`]() ; [`LIEF::objc::Category`]() ), accessible through `lief.ObjC.Metadata.categories` ( [`lief::objc::Metadata::categories`]() ; [`lief.objc.Metadata.categories`]() ; [`LIEF::objc::Metadata::categories()`]() ) **Assembly:** - Add support for iterating over the operands of MIPS, PowerPC, eBPF and RISC-V instructions (`Register`, `Immediate`, `Memory` and `PCRelative`): - `lief.assembly.mips.Instruction.operands()` ( [`lief::assembly::mips::Instruction::operands`]() ; [`lief.assembly.mips.Instruction.operands`]() ; [`LIEF::assembly::mips::Instruction::operands()`]() ) - `lief.assembly.powerpc.Instruction.operands()` ( [`lief::assembly::powerpc::Instruction::operands`]() ; [`lief.assembly.powerpc.Instruction.operands`]() ; [`LIEF::assembly::powerpc::Instruction::operands()`]() ) - `lief.assembly.ebpf.Instruction.operands()` ( [`lief::assembly::ebpf::Instruction::operands`]() ; [`lief.assembly.ebpf.Instruction.operands`]() ; [`LIEF::assembly::ebpf::Instruction::operands()`]() ) - `lief.assembly.riscv.Instruction.operands()` ( [`lief::assembly::riscv::Instruction::operands`]() ; [`lief.assembly.riscv.Instruction.operands`]() ; [`LIEF::assembly::riscv::Instruction::operands()`]() ) **Rust:** > **Warning** > > The Minimum Supported Rust Version (MSRV) is now `1.85.0` (previously `1.74.0`). - The Rust FFI no longer relies on `autocxx` and `bindgen`. It is now built on top of plain `cxx`, which simplifies the bindings and reduces the iteration time - The Rust bindings directory has been renamed from `api/rust/cargo/` to `api/rust/crates/` - Add support for the `aarch64-linux-android` and `x86_64-linux-android` targets **C++:** - Add `LIEF_LIFETIMEBOUND` annotations wrapping `[[clang::lifetimebound]]` to leverage Clang’s [lifetime analysis](). This helps detect dangling references at compile time for methods that return references or iterators tied to an object’s lifetime: ```cpp // Clang can now warn about this dangling reference: auto& hdr = LIEF::ELF::Parser::parse("a.out")->header(); LIEF_INFO("{}", hdr.header_size()); // /src/src/ELF/Binary.cpp:63:15: error: object whose reference is captured // does not live long enough [-Werror,-Wlifetime-safety-use-after-scope] // 63 | auto& hdr = LIEF::ELF::Parser::parse("a.out")->header(); // | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ // /src/src/ELF/Binary.cpp:63:47: note: destroyed here // 63 | auto& hdr = LIEF::ELF::Parser::parse("a.out")->header(); // | ^ // /src/src/ELF/Binary.cpp:64:19: note: later used here // 64 | LIEF_INFO("{}", hdr.header_size()); ``` **Dependencies:** - Update nanobind to version `v2.13.x` - Update tl-expected to version `1.3.1` - Update utfcpp to version `4.0.9` - Update frozen to commit `61dce5a` - Update spdlog to version `1.17.0` - Update mbedtls to version `4.0.0` **Extended:** - Use LLVM `22.x` - Add support to directly download a package from the **History**: [![_images/lief-extended-history-link.webp](https://lief.re/doc/latest/_images/lief-extended-history-link.webp)]() **Python:** - Python 3.8 is no longer supported - Add support for the free-threaded Python builds. The C++ core is now thread-safe with respect to its few static variables, and can be used when the GIL is disabled ([#1255]()): ```python from concurrent.futures import ThreadPoolExecutor import lief def strip(path: str) -> None: binary = lief.ELF.parse(path) binary.strip() binary.write(f"{path}.stripped") with ThreadPoolExecutor() as pool: pool.map(strip, ["/bin/ls", "/bin/cat", "/bin/echo"]) ``` ## [0.17.6 - March 18th, 2026]() **ELF:** - Fix alignment for `PHDR/SHDR` and improve `TLS/RELR` handling ([#1315]()) - Skip `NOBITS` sections in layout calculations and improve index retrieval (related to [#1315]()) **PE:** - Fix IAT parsing issue by [itamarga]() in PR [#1314]()) ## [0.17.5 - March 8th, 2026]() **ELF:** - Add missing segments in X86\_64 coredump parser ([#1278]()) - Add TLSDESC\_PLT and TLSDESC\_GOT to ELF dynamic tags ([#1311]()) - Fix dynamic entry shifting for Android relocations ([#1309]()) **MachO:** - Fix `DyldInfo::show_bindings` integer overflow ([#1313]()) ## [0.17.4 - February 21st, 2026]() **PE:** - Fixed the address type in the TLS builder (by [Immortalety]() in PR [#1296]()) **MachO:** - Fixed `lief.MachO.Binary.virtual_address_to_offset()` ( [`lief::macho::Binary::virtual_address_to_offset`]() ; [`lief.MachO.Binary.virtual_address_to_offset()`]() ; [`LIEF::MachO::Binary::virtual_address_to_offset()`]() ) to properly handle non-file-backed segments, such as `__DATA` segments containing only `ZEROFILL` sections like `__bss` (by [jalopezg-git]() in PR [#1301](), fixing [#1299]()). - Fixed `patch_relocation()` to correctly process tagged pointers (by [jalopezg-git]() in PR [#1302](), fixing [#1300]()). **COFF:** - Resolved a compilation conflict with the Windows `minwindef.h` macro `#define max`. **CMake:** - Fixed compiler flag issues on Windows when compiling with `clang-cl` (by [sigewinnefish]() in PR [#1306]()). **Python:** - Bumped various Python backend build dependencies in `api/python/build-requirements.txt` to support Python `3.14` when compiling from sources ([#1304]()). ## [0.17.3 - January 24th, 2026]() **PE:** - Fixed bug with resources ([#1281]()). - Fixed VA/RVA confusion in the PE builder ([#1284]()). ## [0.17.2 - January 3rd, 2026]() **Mach-O:** - Differentiate Mach-O FAT magic bytes and Java classes (by [wangmot](), [#1215]()). **Compilation:** - Fixed MinGW compilation for some configurations (by [TheBrokenRail](), [dabbb72]()). **PE:** - Fixed alignment issue when rebuilding PE relocations ([#1261]()). - Fixed infinite loop when processing v2 dynamic relocations (by [chengyongru](), fixing [#1273]()). **ELF:** - Ensure that added DYN ELF sections are properly aligned (by [schmchrt](), fixing [#1261]()). - Fixed GnuHash null dereference ([#1277]()). **Mach-O:** - Fixed major performance issue when parsing certain Mach-O files (by [trevor-e](), fixing [#1262]()). ## [0.17.1 - October 25th, 2025]() **ELF:** - Fixed [#1251](). **Compilation:** - Fixed missing visibility ([#1254]()). - Fixed incorrect paging computations that occurred when only a subset of formats was enabled. - Fixed include issue with the COFF format. ## [0.17.0 - September 14th, 2025]() > **BinaryNinja & Ghidra Plugins** > > LIEF-based plugins for Binary Ninja and Ghidra have been bootstrapped here: > > - [Ghidra plugin]() > - [BinaryNinja plugin]() > **LIEF Tools** > > I initiated a `Tools` section which aims at providing utilities based on LIEF (mostly CLI): > > - [lief-patchelf]() **Assembler:** - Add support for [Contextual Assembly Patching]() **DSC:** - Add enum for the latest dyld shared cache version introducing changes in the header layout (`dyld-1284.13 - 2025-04-25`) ```diff uint64_t dynamicDataOffset; uint64_t dynamicDataMaxSize; uint32_t tproMappingsOffset; uint32_t tproMappingsCount; + uint64_t functionVariantInfoAddr; + uint64_t functionVariantInfoSize; + uint64_t prewarmingDataOffset; + uint64_t prewarmingDataSize; }; ``` - Add enum for the latest dyld shared cache version introducing changes in the header layout (`dyld-1231.3 - 2024-09-24`) ```diff uint64_t dynamicDataOffset; uint64_t dynamicDataMaxSize; + uint32_t tproMappingsOffset; + uint32_t tproMappingsCount; }; ``` - Fix symbol resolution issue: [#1127]() **PE:** - Please check [LIEF 0.17.0 - PE changelog]() - [luadebug]() added support for pretty printing OID value and non-roman characters in X509 certificates (see: [#1226](), [#1219]()) **COFF:** - Initial support for the COFF format: see the [COFF section]() **Mach-O:** - Initial support for `lief.MachO.FunctionVariants` ( [`lief::macho::commands::FunctionVariants`]() ; [`lief.MachO.FunctionVariants`]() ; [`LIEF::MachO::FunctionVariants`]() ) and `lief.MachO.FunctionVariantFixups` ( [`lief::macho::commands::FunctionVariantFixups`]() ; [`lief.MachO.FunctionVariantFixups`]() ; [`LIEF::MachO::FunctionVariantFixups`]() ) commands (`LC_FUNCTION_VARIANTS, LC_FUNCTION_VARIANT_FIXUPS`) - Add support for `lief.MachO.Note` ( [`lief::macho::commands::Note`]() ; [`lief.MachO.NoteCommand`]() ; [`LIEF::MachO::NoteCommand`]() ) command (`LC_NOTE`) - Add support for `lief.MachO.AtomInfo` ( [`lief::macho::commands::AtomInfo`]() ; [`lief.MachO.AtomInfo`]() ; [`LIEF::MachO::AtomInfo`]() ) command (`LC_ATOM_INFO`) - Add support for modifying Mach-O commands that embed variable-length data ([#1204](), [#1125]()). See: [RPath and Library Path Modification](). ```python # Change library name for lib in macho.libraries: lib.name += "/some/path/lib.dylib" # Change rpath for rpath in macho.rpaths: rpath.path += '/a/very/long/path/that/needs/expansion' ``` - Add `lief.MachO.Binary.find_library()` ( [`lief::macho::Binary::find_library`]() ; [`lief.MachO.Binary.find_library()`]() ; [`LIEF::MachO::Binary::find_library()`]() ) - To void `#define` conflicts with Apple SDK, the following enums have been renamed: **Python** ```diff - lief.MachO.FAT_MAGIC + lief.MachO.MAGIC_FAT - lief.MachO.FAT_CIGAM + lief.MachO.CIGAM_FAT - lief.MachO.Symbol.ORIGIN.LC_SYMTAB + lief.MachO.Symbol.ORIGIN.SYMTAB - lief.MachO.Section.TYPE.S_4BYTE_LITERALS + lief.MachO.Section.TYPE.IS_4BYTE_LITERALS - lief.MachO.Section.TYPE.S_8BYTE_LITERALS + lief.MachO.Section.TYPE.IS_8BYTE_LITERALS - lief.MachO.Section.TYPE.S_16BYTE_LITERALS + lief.MachO.Section.TYPE.IS_16BYTE_LITERALS ``` **C++** ```diff - MACHO_TYPES::MH_MAGIC - MACHO_TYPES::MH_CIGAM - MACHO_TYPES::MH_MAGIC_64 - MACHO_TYPES::MH_CIGAM_64 - MACHO_TYPES::FAT_MAGIC - MACHO_TYPES::FAT_CIGAM + MACHO_TYPES::MAGIC + MACHO_TYPES::CIGAM + MACHO_TYPES::MAGIC_64 + MACHO_TYPES::CIGAM_64 + MACHO_TYPES::MAGIC_FAT + MACHO_TYPES::CIGAM_FAT - Section::TYPE::S_16BYTE_LITERALS + Section::TYPE::IS_16BYTE_LITERALS - Section::TYPE::S_4BYTE_LITERALS + Section::TYPE::IS_4BYTE_LITERALS - Section::TYPE::S_8BYTE_LITERALS + Section::TYPE::IS_8BYTE_LITERALS - Symbol::ORIGIN::LC_SYMTAB + Symbol::ORIGIN::SYMTAB ``` **ELF:** - LIEF newly-inserted sections are now compatible with a `strip` after the modification of the binary (see: [Adding a section/segment]()) - Enhance support for IA64 architecture. - Introduce [`lief.ELF.Segment.raw_flags`]( "lief.ELF.Segment.raw_flags") to access the raw (integer) value of the flag - If an ELF binary uses a custom page size, its value can be defined in the parser configuration: `lief.ELF.ParserConfig.page_size` ( [`lief::elf::ParserConfig::page_size`]() ; [`lief.ELF.ParserConfig.page_size`]() ; [`LIEF::ELF::ParserConfig::page_size`]() ). - Add support for SH4 - Add suport for x32/ILP32 ELF binaries ([#1225]()) - Add support for S390x - Better endianess support when writing back a binary. - Enhance support for removing segments ([#1233]()): `lief.ELF.Binary.remove_segment()` ( [`lief::elf::Binary::remove_segment`]() ; [`lief::elf::Binary::remove_segments_by_type`]() ; [`lief.ELF.Binary.remove()`]() ; [`void LIEF::ELF::Binary::remove(const Segment &, bool)`]() ; [`void LIEF::ELF::Binary::remove(Segment::TYPE, bool)`]() ) - Enhance support for removing or modifying symbol versions (related to the [lief-patchelf]() initiative) - New doc section: [Symbol Versions]() - New doc section: [R[UN]PATH Modification]() **DWARF:** - LIEF extended can now process DWARF debug info in PE binaries - Add support for creating DWARF: [DWARF Editor]() (require extended version `>= 0.17.0.2623`) **PDB:** - Add `lief.pdb.is_pdb` ( [`lief::pdb::is_pdb`]() ; [`lief.is_pdb()`]() ; [`bool LIEF::pdb::is_pdb(const std::std::string &)()`]() ) - Add support for CodeView symbols: `S_COMPILE3, S_COMPILE2, S_BUILDINFO, S_ENVBLOCK`. These symbols are exposed through the interface `lief.pdb.BuildMetadata` ( [`lief::pdb::BuildMetadata`]() ; [`lief.pdb.BuildMetadata`]() ; [`LIEF::pdb::BuildMetadata`]() ), which can be accessed using `lief.pdb.CompilationUnit.build_metadata()` ( [`lief::pdb::CompilationUnit::build_metadata`]() ; [`lief.pdb.CompilationUnit.build_metadata`]() ; [`LIEF::pdb::CompilationUnit::build_metadata()`]() ). This metadata provides build time information such as: ```text Module Name : * Linker * Build Metadata: Frontend Version: 0.0.0.0 Backend Version : 14.37.32825.0 Tool Version : Microsoft (R) LINK Language : LINK Target : X64 Environment: cwd: C:\Users\romai\dev\rust\ast-grep exe: C:\Program Files\Microsoft Visual Studio\2022\Community\[...] pdb: C:\Users\romai\dev\rust\ast-grep\target\debug\deps\ast_grep.pdb cmd: /NOLOGO /LIBPATH:C:\Users\romai\dev\rust\ast-grep\target\[...] Module Name : std-4ee9ee8805e6ac55.std.ddad90bab7781587-cgu.0.rcgu.o Object : C:\Users\romai\scoop\persist\rustup\.rustup\toolchains\[...] Build Metadata: Frontend Version: 1.74.0.0 Backend Version : 17004.0.0.0 Tool Version : clang LLVM (rustc version 1.74.0 (79e9716c9 2023-11-13)) Language : RUST Target : X64 Build Info: Current directory: /rustc/79e9716c980570bfd1f666e3b16ac583f0168962 Build tool : C:\a\rust\rust\build\x86_64-pc-windows-msvc\stage1\bin\rustc.exe Source file : library\std\src\lib.rs\@\std.ddad90bab7781587-cgu.0 Command line : "-cc1" "--crate-name" "std" "--edition=2021" [...] ``` **OAT:** - Parsing Android OAT files requires to **explicitly** use [`lief.OAT.parse()`]( "lief.OAT.parse") ```python import lief # Before LIEF 0.17.0 this function returned a lief.OAT.Binary object lief.parse("CallDeviceId.oat") # Since LIEF 0.17.0 this function returns a lief.ELF.Binary object lief.parse("CallDeviceId.oat") # Return a lief.OAT.Binary object lief.OAT.parse("CallDeviceId.oat") ``` **Abstraction:** - Expose `lief.abstract.Binary.page_size()` ( [`lief::generic::Binary::page_size`]() ; [`lief.Binary.page_size`]() ; [`LIEF::Binary::page_size()`]() ) - Add `lief.abstract.Binary.load_debug_info()` ( [`lief::generic::Binary::load_debug_info`]() ; [`lief.Binary.load_debug_info()`]() ; [`LIEF::Binary::load_debug_info()`]() ) to attach an external debug file to a `lief.abstract.Binary` ( [`lief::generic::Binary`]() ; [`lief.Binary`]() ; [`LIEF::Binary`]() ). See these sections for more details: [DWARF: Loading an external debug file]()[PDB: Loading an external debug file]() - Add `lief.DebugInfo.find_function_address()` ( [`lief::generic::DebugInfo::find_function_address`]() ; [`lief.DebugInfo.find_function_address()`]() ; [`LIEF::DebugInfo::find_function_address()`]() ) **Extended:** - Fix issue in the Python bindings while trying to access `lief.__LIEF_MAIN_COMMIT__` - Fix CMake issue with `find_package(lief-extended)` - Use LLVM `21.1.x` **Build System:** - LIEF is now available in [vcpkg](). Many thanks to [luadebug]() for this support. **Dependencies:** - Move to tl-expected `1.2.0` - Move to utfcpp `4.0.6` - Move to mbedtls `3.6.4` - Move to spdlog `1.15.3` - Move to `nlohmann/json` `3.12.0` - Upgrade nanobind to version `v2.8.x` **Utilities:** - Add `LIEF.dump()` ( [`lief::dump`]() ; [`lief::dump_with_limit`]() ; [`lief.dump()`]() ; [`LIEF::dump()`]() ) ## [0.16.7 - October 5th, 2025]() **Python:** - Add wheels for Python 3.14 **Mach-O:** - Fix `has_nx` ([#1218]()) - Fix [#1228]() **ELF:** - Fix [#1241]() **Other:** - [#1220]() ## [0.16.6 - May 29th, 2025]() **Compilation:** - Fix missing header ([#1192]()) - Fix GCC 15 issue ([#1203]()) - Fix [#1210]() **Mach-O:** - Fix use-after-move ([#1212]()) - Fix [#1206]() **Python:** - Fix Python logger warning **Other:** - [#1217]() - [#1216]() ## [0.16.5 - April 19th, 2025]() **ELF:** - Relax the condition over the `DT_SYMENT` entry ([#1177]()) **Mach-O:** - Modifications on `lief.MachO.EncryptionInfo` ( [`lief::macho::commands::EncryptionInfo`]() ; [`lief.MachO.EncryptionInfo`]() ; [`LIEF::MachO::EncryptionInfo`]() ) are now committed when doing a `write()`. See: [#1173]() **Compilation:** - Fix compilation issue when targeting Linux i386/i686 ([#1189]()) - Better support for external `fmt` library - Fix `fmt` unicode issue - Fix missing `cstdio` ([#1184]()) **Packages:** - Add Python, Rust, SDK packages for Windows ARM64 (`aarch64-pc-windows-msvc`) - Add Python, Rust, SDK packages for Linux Musl ARM64 (`aarch64-unknown-linux-musl`) - Add Python, Rust, SDK packages for Linux Musl i686 (`i686-unknown-linux-musl`) ## [0.16.4 - February 23rd, 2025]() **Python:** - Relax checks on the enum verification. As described in [#1170]() and [#1172](), an invalid enum led to an unrecoverable error. The new behavior now returns the raw `int` value if it can’t be converted into the given enum. - Upgrade nanobind to version `v2.5.0` **PE:** - Fix export forwarding issue ([#1168]()) **MachO:** - Fix truncated `nlist_t.n_type` when rewriting a Mach-O binary ## [0.16.3 - February 1st, 2025]() **ELF:** - Fix issue when parsing the dynamic table with an invalid offset (bug found by [lebr0nli]()) - Fix endianness issue with `IA64` binaries ([#1164]()) **PE:** - Fix missing original forwarded function name ([#1166]()) **Misc:** - Add support for spdlog compiled with `SPDLOG_WCHAR_FILENAMES` ([#1147]()) ## [0.16.2 - January 1st, 2025]() **Compilation:** - Fix broken `aarch64` Python wheel which is related to a toolchain issue ([#1146]()) ## [0.16.1 - December 26th, 2024]() **MachO:** - Various fixes from [DzenIsRich]() & [peledins-zimperium]() Thanks to them, Mach-O modification is more reliable. - Fix issue when building with `-DLIEF_MACHO=ON` (see: [#1138]()) **Rust:** - Fix min-rustc version issue (see: [75a27f0]()) **Compilation:** - Fix missing `LIEF_API` visibility ([e01f92a](), [#1140]()) ## [0.16.0 - December 10th, 2024]() **Abstraction:** - Add `LIEF.get_int_from_virtual_address()` ( [`lief::elf::Binary::get_int_from_virtual_address`]() ; [`lief.Binary.get_int_from_virtual_address()`]() ; [`LIEF::Binary::get_int_from_virtual_address()`]() ) to read an **integer** value at a specific virtual address **C++** ```cpp LIEF::Binary& bin; uint16_t short_value = bin.get_int_from_virtual_address(0x140002CC8); ``` **Python** ```python some_bin: lief.Binary = ... long_value = some_bin.get_int_from_virtual_address(0x140002CC8, 4) # or long_value = some_bin.get_int_from_virtual_address(0x140002CC8, ctypes.sizeof(ctypes.c_uint32)) ``` **Rust** ```rust elf: &lief::elf::Binary let value: i16 = elf.get_int_from_virtual_address::(0x401126).unwrap(); ``` - Global code cleaning (especially, `lief.Header.ARCHITECTURES` ( [`lief.Header.ARCHITECTURES`]() ; [`LIEF::Header::ARCHITECTURES`]() ) and `lief.Header.MODES` ( [`lief.Header.MODES`]() ; [`LIEF::Header::MODES`]() ) is now more meaningful) - Re-scope `lief.ARCHITECTURES` into `lief.Header.ARCHITECTURES` ( [`lief.Header.ARCHITECTURES`]() ; [`LIEF::Header::ARCHITECTURES`]() ) - Re-scope `lief.MODES` into `lief.Header.MODES` ( [`lief.Header.MODES`]() ; [`LIEF::Header::MODES`]() ) - Re-scope `lief.OBJECT_TYPES` into `lief.Header.OBJECT_TYPES` ( [`lief.Header.OBJECT_TYPES`]() ; [`LIEF::Header::OBJECT_TYPES`]() ) - Re-scope `lief.ENDIANNESS` into `lief.Header.ENDIANNESS` ( [`lief.Header.ENDIANNESS`]() ; [`LIEF::Header::ENDIANNESS`]() ) **MachO:** - Fix endianness support ([#1110]()) - Add helpers to determine the platform targeted by a Mach-O binary: - `lief.MachO.Binary.is_ios()` ( [`lief::macho::Binary::is_ios`]() ; [`lief.MachO.Binary.is_ios`]() ; [`LIEF::MachO::Binary::is_ios()`]() ) - `lief.MachO.Binary.is_macos()` ( [`lief::macho::Binary::is_macos`]() ; [`lief.MachO.Binary.is_macos`]() ; [`LIEF::MachO::Binary::is_macos()`]() ) - `lief.MachO.Binary.platform()` ( [`lief::macho::Binary::platform`]() ; [`lief.MachO.Binary.platform`]() ; [`LIEF::MachO::Binary::platform()`]() ) - Expose an iterator over the stub entries located in `__stubs,__auth_stubs,__symbol_stub,__picsymbolstub4`: `lief.MachO.Binary.symbol_stubs()` ( [`lief::macho::Binary::symbol_stubs`]() ; [`lief.MachO.Binary.symbol_stubs`]() ; [`LIEF::MachO::Binary::symbol_stubs()`]() ) - `lief.MachO.Stub` ( [`lief::macho::Stub`]() ; [`lief.MachO.Stub`]() ; [`LIEF::MachO::Stub`]() ) - Add support for the `LC_SUBCLIENT` command: `lief.MachO.SubClient` ( [`lief::macho::commands::SubClient`]() ; [`lief.MachO.SubClient`]() ; [`LIEF::MachO::SubClient`]() ) - Add support for the `LC_ROUTINE/LC_ROUTINE64` command: `lief.MachO.Routine` ( [`lief::macho::commands::Routine`]() ; [`lief.MachO.Routine`]() ; [`LIEF::MachO::Routine`]() ) - Expose an iterator for the indirect symbols in `lief.MachO.DynamicSymbolCommand` ( [`lief::macho::commands::DynamicSymbolCommand`]() ; [`lief.MachO.DynamicSymbolCommand`]() ; [`LIEF::MachO::DynamicSymbolCommand`]() ) - Add `lief.MachO.Binary.bindings()` ( [`lief::macho::Binary::bindings`]() ; [`lief.MachO.Binary.bindings`]() ; [`LIEF::MachO::Binary::bindings()`]() ) to iterate over the bindings info located in `lief.MachO.DyldInfo` ( [`lief::macho::commands::DyldInfo`]() ; [`lief.MachO.DyldInfo`]() ; [`LIEF::MachO::DyldInfo`]() ) or `lief.MachO.ChainedBindingInfo` ( [`lief::macho::binding_info::Chained`]() ; [`lief.MachO.ChainedBindingInfo`]() ; [`LIEF::MachO::ChainedBindingInfo`]() ) - Add `lief.MachO.IndirectBindingInfo` ( [`lief::macho::binding_info::Indirect`]() ; [`lief.MachO.IndirectBindingInfo`]() ; [`LIEF::MachO::IndirectBindingInfo`]() ) to represent a binding operation inferred from the indirect symbol table. This can be handy if a Mach-O does not have the commands `lief.MachO.DyldInfo` ( [`lief::macho::commands::DyldInfo`]() ; [`lief.MachO.DyldInfo`]() ; [`LIEF::MachO::DyldInfo`]() ) or `lief.MachO.ChainedBindingInfo` ( [`lief::macho::binding_info::Chained`]() ; [`lief.MachO.ChainedBindingInfo`]() ; [`LIEF::MachO::ChainedBindingInfo`]() ) (e.g. extracted shared cache library) **PE:** - Fix authenticode error while reading RSA PKCS#1 1.5 padding **ELF:** - Fix issue when multiple empty strings are present in the `.symtab` section ([#1124]()) - Add `lief.ELF.Relocation.resolve()` ( [`lief::elf::Relocation::resolve`]() ; [`lief::elf::Relocation::resolve_with_base_address`]() ; [`lief.ELF.Relocation.resolve()`]() ; [`LIEF::ELF::Relocation::resolve()`]() ) to resolve the value of relocations - Add support for eBPF relocations. - Add support for `GNU_PROPERTY_AARCH64_FEATURE_PAUTH` GNU property note: `lief.ELF.AArch64PAuth` ( [`lief.ELF.AArch64PAuth`]() ; [`LIEF::ELF::AArch64PAuth`]() ). - Add `lief.ELF.Binary.is_targeting_android` ( [`lief::elf::Binary::is_targeting_android`]() ; [`lief.ELF.Binary.is_targeting_android`]() ; [`LIEF::ELF::Binary::is_targeting_android()`]() ) to check if an ELF targets Android - Fix a critical error when rewriting ELF file with `DT_RELR` relocations. This error leads to a crash of the modified binary. - Fix error while (re)generating ELF’s RELR relocations ([#1097]()) - Add support for RISC-V architecture - Fix bug when trying to remove a dynamic symbol that is associated with multiple relocations ([#1089]()) **Rust:** - Mutable API are progressively introduced: - ELF: - [`lief::elf::Binary::write`]() - [`lief::elf::Binary::write_with_config`]() - [`lief::elf::Binary::add_library`]() - PE: - [`lief::pe::Binary::write`]() - MachO: - [`lief::macho::Binary::write`]() - [`lief::macho::Binary::write_with_config`]() - [`lief::macho::Binary::add_library`]() - Thanks to [Huntragon]() Rust bindings can be used without openssl (see: [#1105]()) - Rust precompiled Linux packages are now supported for Debian 10 & Ubuntu 19.10. Before, they require at least Debian 11 & Ubuntu 20.04 - Add support for the `x86_64-unknown-linux-musl` target which allows to generate full static executable. - Add [`lief::elf::header::Arch`]() - Add [`lief::elf::dynamic::Flags`]() **ObjC:** - The header-like generation ( `lief.ObjC.Metadata.to_decl()` ( [`lief::objc::Metadata::to_decl`]() ; [`lief.objc.Metadata.to_decl()`]() ; [`LIEF::objc::Metadata::to_decl()`]() )) is now including method’s address as a comment: **Before** ```objc @interface GCKUIImageHints { long long _imageType; NSObject * _customData; struct CGSize _imageSize; } + (bool)supportsSecureCoding:(GCKUIImageHints *)self :(SEL)id; - (bool)isEqual:(GCKUIImageHints *)self :(SEL)id :(NSObject *)arg2; ``` **After** ```objc @interface GCKUIImageHints { long long _imageType; NSObject * _customData; struct CGSize _imageSize; } // Address: 0x00001aa448 + (bool)supportsSecureCoding:(GCKUIImageHints *)self :(SEL)id; // Address: 0x00001aa5ec - (bool)isEqual:(GCKUIImageHints *)self :(SEL)id :(NSObject *)arg2; ``` - Fix `lief.ObjC.Method.address()` ( [`lief::objc::Method::address`]() ; [`lief.objc.Method.address`]() ; [`LIEF::objc::Method::address()`]() ) for *small* methods. - The output of `lief.ObjC.Metadata.to_decl()` ( [`lief::objc::Metadata::to_decl_with_opt`]() ; [`lief.objc.Metadata.to_decl()`]() ; [`LIEF::objc::Metadata::to_decl()`]() ) can now be configured with `lief.ObjC.DeclOpt` ( [`lief::objc::DeclOpt`]() ; [`lief.objc.DeclOpt`]() ; [`LIEF::objc::DeclOpt`]() ). **DWARF:** - Add `lief.dwarf.Function.is_external()` ( [`lief::dwarf::Function::is_external`]() ; [`lief.dwarf.Function.is_external`]() ; [`LIEF::dwarf::Function::is_external()`]() ) - Add `lief.dwarf.CompilationUnit.imported_functions()` ( [`lief::dwarf::CompilationUnit::imported_functions`]() ; [`lief.dwarf.CompilationUnit.imported_functions`]() ; [`LIEF::dwarf::CompilationUnit::imported_functions()`]() ) - Add `DW_TAG_typedef` support **Extended:** > **Note** > > - [LIEF extended]() is now open to everyone > - C++ SDK is now available > - Rust package is now available - Initial assembler support: [Assembler]() - Initial disassembler support: [Disassembler]() - Linux Python wheels are now `manylinux_2_27` compliants. In other words, they are working with a glibc from at least 2018. - Support for [Dyld shared cache]() - `lief.ELF.Symbol.demangled_name()` ( [`lief::elf::Symbol::demangled_name`]() ; [`lief.ELF.Symbol.demangled_name`]() ; [`LIEF::ELF::Symbol::demangled_name()`]() ) is working on **all** platforms (not only unix-based builds) - `lief.MachO.Symbol.demangled_name()` ( [`lief::macho::Symbol::demangled_name`]() ; [`lief.MachO.Symbol.demangled_name`]() ; [`LIEF::MachO::Symbol::demangled_name()`]() ) is working on **all** platforms (not only unix-based builds) - `lief.PE.DelayImportEntry.demangled_name()` ( [`lief::pe::delay_import::DelayImportEntry::demangled_name`]() ; [`lief.PE.DelayImportEntry.demangled_name`]() ; [`LIEF::PE::DelayImportEntry::demangled_name()`]() ) - `lief.PE.ImportEntry.demangled_name()` ( [`lief::pe::import::ImportEntry::demangled_name`]() ; [`lief.PE.ImportEntry.demangled_name`]() ; [`LIEF::PE::ImportEntry::demangled_name()`]() ) - `lief.PE.ExportEntry.demangled_name()` ( [`lief::pe::export::Entry::demangled_name`]() ; [`lief.PE.ExportEntry.demangled_name`]() ; [`LIEF::PE::ExportEntry::demangled_name()`]() ) ```python pe = lief.PE.parse("some.exe") if exp := pe.get_export(): for entry in exp.entries: # e.g.void __cdecl Platform::Details::EventSourceUninitialize(void **) print(entry.demangled_name) for imp in pe.imports: for entry in imp.entries: # e.g. void __cdecl std::_Xlength_error(char const *) print(entry.demangled_name) ``` - Add `LIEF.demangle()` ( [`lief::demangle`]() ; [`lief.demangle()`]() ; [`LIEF::demangle()`]() ) to demangle symbols (c.f. [#1054]()) - The extended version is now using a versioning matching LIEF regular version **Python Bindings:** - Upgrade nanobind from `1.8.0` to `2.4.0` - `*.pyi` stubs are now generated by nanobind (replacing mypy’s stugen) **Dependencies:** - Upgrade MbedTLS from `3.2.1` to `3.6.1` **doc:** - Global restructuring of the documentation - Add Sphinx cross-reference support for Rust. For instance, this link: [`lief::elf::Binary::debug_info`]() references the documentation of `debug_info` in the Rust documentation page. - Add cross-api menu directive. For instance, this *link*: `lief.dwarf.DebugInfo` ( [`lief::dwarf::DebugInfo`]() ; [`lief.dwarf.DebugInfo`]() ; [`LIEF::dwarf::DebugInfo`]() ) toggles a menu to access the documentation of DWARF’s debug info for Rust, Python & C++. ## [0.15.1 - July 23th, 2024]() **MachO:** - Fix missing commit for `.hwx` support ## [0.15.0 - July 21th, 2024]() **Extended:** > **Note** > > See: [https://extended.lief.re]() and [What is LIEF Extended?]() - Add support for DWARF: [DWARF]() - Add support for PDB: [PDB]() - Add support for Objective-C: [Objective-C]() **Repo:** - `master` branch has been renamed `main` **Rust:** - First (beta) release of the bindings (c.f. [Rust]()) **ELF:** - Add support to create custom notes ([#1026]()): ```python elf: lief.ELF.Binary = ... elf += lief.ELF.Note.create( name="my-custom-note", original_type=lief.ELF.Note.TYPE.UNKNOWN, description=list(b"Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed"), section_name=".lief.note.custom" ) config = lief.ELF.Builder.config_t() config.notes = True elf.write("/tmp/new-binary.elf", config) ``` - Add [`lief.ELF.Binary.get_relocated_dynamic_array()`]( "lief.ELF.Binary.get_relocated_dynamic_array") which allows to get a **relocated** view of the of init/fini entries. This function can handy ELF init array/fini array functions are defined through relocations. See: [#1058](), [#626]() - Add support for QNX Stack note ([#1065]()) - The `static_symbols` API functions has been renamed in `symtab_symbols`. LIEF was naming symbols located in the `.symtab` sections as **static symbols** in opposition to the `.dynsym` symbols. This naming can be confusing since the concept of **static symbol** in a program is well defined (i.e. `static bool my_var`) and not applicable in this case. **Therefore, the ``xxx\_static\_symbols`` API is has been renamed ``xxx\_symtab\_symbol``.** - Re-scope `DYNAMIC_TAGS` into [`lief.ELF.DynamicEntry.TAG`]( "lief.ELF.DynamicEntry.TAG") - Re-scope `E_TYPE` into [`lief.ELF.Header.FILE_TYPE`]( "lief.ELF.Header.FILE_TYPE") - Re-scope `VERSION` into [`lief.ELF.Header.VERSION`]( "lief.ELF.Header.VERSION") - Re-scope `ELF_CLASS` into [`lief.ELF.Header.CLASS`]( "lief.ELF.Header.CLASS") - Re-scope `ELF_DATA` into [`lief.ELF.Header.ELF_DATA`]( "lief.ELF.Header.ELF_DATA") - Re-scope `OS_ABI` into [`lief.ELF.Header.OS_ABI`]( "lief.ELF.Header.OS_ABI") - Re-scope `ELF_SECTION_TYPES` into [`lief.ELF.Section.TYPE`]( "lief.ELF.Section.TYPE") - Re-scope `ELF_SECTION_FLAGS` into [`lief.ELF.Section.FLAGS`]( "lief.ELF.Section.FLAGS") - Re-scope `SYMBOL_BINDINGS` into [`lief.ELF.Symbol.BINDING`]( "lief.ELF.Symbol.BINDING") - Re-scope `ELF_SYMBOL_TYPES` into [`lief.ELF.Symbol.TYPE`]( "lief.ELF.Symbol.TYPE") - Re-scope `ELF_SYMBOL_VISIBILITY` into [`lief.ELF.Symbol.VISIBILITY`]( "lief.ELF.Symbol.VISIBILITY") - Re-scope `SEGMENT_TYPES` into [`lief.ELF.Segment.TYPE`]( "lief.ELF.Segment.TYPE") - Re-scope `ELF_SEGMENT_FLAGS` into `lief.ELF.Segment.FLAG` - Re-scope `DYNAMIC_FLAGS_1` into [`lief.ELF.DynamicEntryFlags.FLAG`]( "lief.ELF.DynamicEntryFlags.FLAG") - Re-scope `DYNAMIC_FLAGS` into [`lief.ELF.DynamicEntryFlags.FLAG`]( "lief.ELF.DynamicEntryFlags.FLAG") - Re-scope `DYNSYM_COUNT_METHODS` into [`lief.ELF.ParserConfig.DYNSYM_COUNT`]( "lief.ELF.ParserConfig.DYNSYM_COUNT") - Re-scope `RELOCATION_PURPOSES` into [`lief.ELF.Relocation.PURPOSE`]( "lief.ELF.Relocation.PURPOSE") - `RELOC_x86_64`, `RELOC_i386`, … have been re-scoped **and merged** into [`lief.ELF.Relocation.TYPE`]( "lief.ELF.Relocation.TYPE") - Add support for Android packed relocation format (`DT_ANDROID_REL{A}`) - Add support for relative relocation format (`DT_RELR`) **PE:** - Authenticode: Add partial support for the following PKCS #7 attributes: > - `1.3.6.1.4.1.311.3.3.1 - Ms-CounterSign` ([`lief.PE.MsCounterSign`]( "lief.PE.MsCounterSign")) > - `1.3.6.1.4.1.311.10.3.28 - Ms-ManifestBinaryID` ([`lief.PE.MsManifestBinaryID`]( "lief.PE.MsManifestBinaryID")) > - `1.3.6.1.4.1.311.2.6.1 - SPC_RELAXED_PE_MARKER_CHECK_OBJID` ([`lief.PE.SpcRelaxedPeMarkerCheck`]( "lief.PE.SpcRelaxedPeMarkerCheck")) > - `1.2.840.113549.1.9.16.2.47 - SIGNING_CERTIFICATE_V2` ([`lief.PE.SigningCertificateV2`]( "lief.PE.SigningCertificateV2")) - `1.2.840.113549.1.9.16.1.4 - PKCS#9 TSTInfo` ([`lief.PE.PKCS9TSTInfo`]( "lief.PE.PKCS9TSTInfo")) - Add [`lief.PE.CodeViewPDB.guid`]( "lief.PE.CodeViewPDB.guid") attribute ([#480]()) - Move `lief.PE.OptionalHeader.computed_checksum` to [`lief.PE.Binary.compute_checksum()`]( "lief.PE.Binary.compute_checksum") In previous versions of LIEF, [`lief.PE.OptionalHeader.checksum`]( "lief.PE.OptionalHeader.checksum") was re-computed (on purpose) in the parsing phase. On large binaries, this re-computation can have a **strong impact** on the performances. Thus, this computation has been deferred to a dedicated method [`lief.PE.Binary.compute_checksum()`]( "lief.PE.Binary.compute_checksum") ```python pe = lief.PE.parse("...") # Before: computed = pe.optional_header.computed_checksum # Now: computed = pe.compute_checksum() ``` **MachO:** - Add support to modify Mach-O rpath (see: [#1074]()) - Add helper [`lief.MachO.Binary.support_arm64_ptr_auth`]( "lief.MachO.Binary.support_arm64_ptr_auth") to check if a Mach-O binary is supporting ARM64 pointer authentication (arm64e) - Fix **major performance issue when processing Mach-O binaries on Windows & macOS** - Add generic [`lief.MachO.UnknownCommand`]( "lief.MachO.UnknownCommand") to support Apple private Load commands not officially supported by LIEF. - Re-scope `LOAD_COMMAND_TYPES` into [`lief.MachO.LoadCommand.TYPE`]( "lief.MachO.LoadCommand.TYPE") - Re-scope `FILE_TYPES` into [`lief.MachO.Header.FILE_TYPE`]( "lief.MachO.Header.FILE_TYPE") - Re-scope `HEADER_FLAGS` into [`lief.MachO.Header.FLAGS`]( "lief.MachO.Header.FLAGS") - Re-scope `MACHO_SEGMENTS_FLAGS` into [`lief.MachO.SegmentCommand.FLAGS`]( "lief.MachO.SegmentCommand.FLAGS") - Re-scope `MACHO_SECTION_TYPES` into [`lief.MachO.Section.TYPE`]( "lief.MachO.Section.TYPE") - Re-scope `MACHO_SECTION_FLAGS` into [`lief.MachO.Section.FLAGS`]( "lief.MachO.Section.FLAGS") - Re-scope `REBASE_TYPES` into [`lief.MachO.DyldInfo.REBASE_TYPE`]( "lief.MachO.DyldInfo.REBASE_TYPE") - Re-scope `REBASE_OPCODES` into [`lief.MachO.DyldInfo.REBASE_OPCODES`]( "lief.MachO.DyldInfo.REBASE_OPCODES") - Re-scope `BIND_OPCODES` into [`lief.MachO.DyldInfo.BIND_OPCODES`]( "lief.MachO.DyldInfo.BIND_OPCODES") - Re-scope `BINDING_CLASS` into [`lief.MachO.DyldBindingInfo.CLASS`]( "lief.MachO.DyldBindingInfo.CLASS") - Re-scope `BIND_TYPES` into [`lief.MachO.DyldBindingInfo.TYPE`]( "lief.MachO.DyldBindingInfo.TYPE") - Re-scope `EXPORT_SYMBOL_FLAGS` into [`lief.MachO.ExportInfo.FLAGS`]( "lief.MachO.ExportInfo.FLAGS") - Re-scope `EXPORT_SYMBOL_KINDS` into [`lief.MachO.ExportInfo.KIND`]( "lief.MachO.ExportInfo.KIND") - Re-scope `RELOCATION_ORIGINS` into [`lief.MachO.Relocation.ORIGIN`]( "lief.MachO.Relocation.ORIGIN") - Re-scope `SYMBOL_ORIGINS` into [`lief.MachO.Symbol.ORIGIN`]( "lief.MachO.Symbol.ORIGIN") - Re-scope `VM_PROTECTIONS` into [`lief.MachO.SegmentCommand.VM_PROTECTIONS`]( "lief.MachO.SegmentCommand.VM_PROTECTIONS") - Re-scope `CPU_TYPES` into [`lief.MachO.Header.CPU_TYPE`]( "lief.MachO.Header.CPU_TYPE") **CMake:** - `LIEFConfig.cmake` is now installed in `/lib/cmake/LIEF/` instead of `/share/LIEF/cmake/` **Python Bindings:** - Add [`lief.disable_leak_warning()`]( "lief.disable_leak_warning") to disable Nanobind warning about “leaks”. > **Warning** > > These warnings does not necessarily mean that LIEF leak objects. These warnings might happen in [Cyclic garbage collection](). **Documentation:** - Add icons - Include inheritance diagram for Python API (e.g. [`lief.ELF.Note`]( "lief.ELF.Note")) ## [0.14.1 - February 11th, 2024]() **ELF:** - Fix regression in Symbol Version Definition processing ([#1014]()) **PE:** - Address [#1016]() by creating aliases: - [`lief.PE.ContentInfo.digest`]( "lief.PE.ContentInfo.digest") to [`lief.PE.SpcIndirectData.digest`]( "lief.PE.SpcIndirectData.digest") - [`lief.PE.ContentInfo.digest_algorithm`]( "lief.PE.ContentInfo.digest_algorithm") to [`lief.PE.SpcIndirectData.digest_algorithm`]( "lief.PE.SpcIndirectData.digest_algorithm") **Python:** - Fix regression in iterator’s performances ## [0.14.0 - January 20, 2024]() **ELF:** - Add support for the GNU note properies ([#975]()). **Example:** ```python elf = lief.ELF.parse("...") note = elf.get(lief.ELF.Note.TYPE.GNU_PROPERTY_TYPE_0) aarch64_feat: lief.ELF.AArch64Feature = note.find(lief.ELF.NoteGnuProperty.Property.TYPE.AARCH64_FEATURES) if lief.ELF.AArch64Feature.FEATURE.BTI in aarch64_feat.features: print("BTI supported") ``` See: - [`lief.ELF.NoteGnuProperty`]( "lief.ELF.NoteGnuProperty") - [`lief.ELF.AArch64Feature`]( "lief.ELF.AArch64Feature") - [`lief.ELF.NoteNoCopyOnProtected`]( "lief.ELF.NoteNoCopyOnProtected") - [`lief.ELF.StackSize`]( "lief.ELF.StackSize") - [`lief.ELF.X86Features`]( "lief.ELF.X86Features") - [`lief.ELF.X86ISA`]( "lief.ELF.X86ISA") - Refactoring of the ELF note processing - Fix relocation issue when using `-Wl,--emit-relocs` (c.f. [#897]() / [#898]() by [adamjseitz]()) - Improve the computation of the dynamic symbols thanks to [adamjseitz]() (c.f. [#922]()) - Add support for the LoongArch architecture thanks to [loongson-zn]() (c.f. [#921]()) - Add a [`lief.ELF.ParserConfig`]( "lief.ELF.ParserConfig") interface that can be used to tweak which parts of the ELF format should be parsed. **Example:** ```python config = lief.ELF.ParserConfig() # Skip parsing static and dynamic symbols config.parse_static_symbols = False config.parse_dyn_symbols = False elf = lief.ELF.parse("target.elf", config) ``` **MachO:** - The *fileset name* is now stored in [`lief.MachO.Binary.fileset_name`]( "lief.MachO.Binary.fileset_name") (instead of lief.MachO.Binary.name) **PE:** - `RESOURCE_SUBLANGS` has been removed - `RESOURCE_LANGS` is now defined in a dedicated header: `LIEF/PE/resources/langs.hpp` - `RESOURCE_TYPES` is now scoped in `ResourcesManager::TYPE` - `GUARD_CF_FLAGS` is now scoped as `IMAGE_GUARD` in `lief.PE.LoadConfigurationV1` - `SECTION_CHARACTERISTICS` is now scoped within the [`Section`]( "lief.PE.Section") class instead of being globally defined: ```python # Before lief.PE.SECTION_CHARACTERISTICS.CNT_CODE # Now: lief.PE.Section.CHARACTERISTICS.CNT_CODE ``` - `DATA_DIRECTORY` is now scoped within the [`DataDirectory`]( "lief.PE.DataDirectory") class instead of being globally defined: ```python # Before lief.PE.DATA_DIRECTORY.IAT # Now: lief.PE.DataDirectory.TYPES.IAT ``` - `MACHINE_TYPES` and `HEADER_CHARACTERISTICS` are now scoped within the [`Header`]( "lief.PE.Header") class instead of being globally defined: ```python # Before lief.PE.MACHINE_TYPES.AMD64 # Now: lief.PE.Header.MACHINE_TYPES.AMD64 ``` - [`lief.PE.Header.characteristics`]( "lief.PE.Header.characteristics") now returns a list/std::vector instead of a `set`. - [`lief.PE.OptionalHeader.dll_characteristics_lists`]( "lief.PE.OptionalHeader.dll_characteristics_lists") now returns a `list`/`std::vector` instead of a `set`. - `SUBSYSTEM` and `DLL_CHARACTERISTICS` are now scoped within the [`OptionalHeader`]( "lief.PE.OptionalHeader") class instead of being globally defined: ```python # Before lief.PE.SUBSYSTEM.NATIVE # Now: lief.PE.OptionalHeader.SUBSYSTEM.NATIVE ``` - `lief.PE.DosHeader.used_bytes_in_the_last_page` has been renamed in [`lief.PE.DosHeader.used_bytes_in_last_page`]( "lief.PE.DosHeader.used_bytes_in_last_page") - Refactoring of the Debug directory processing: [`lief.PE.Debug`]( "lief.PE.Debug") is now the root class of: [`lief.PE.CodeView`]( "lief.PE.CodeView") / [`lief.PE.CodeView`]( "lief.PE.CodeView"), [`lief.PE.Pogo`]( "lief.PE.Pogo"), [`lief.PE.Repro`]( "lief.PE.Repro"). The parsing logic has been cleaned and the tests updated. - Add a [`lief.PE.ParserConfig`]( "lief.PE.ParserConfig") interface that can be used to tweak which parts of the PE format should be parsed ([#839]()). **Example:** ```python config = lief.PE.ParserConfig() # Skip parsing PE authenticode config.parse_signature = False pe = lief.PE.parse("pe.exe", config) ``` **Abstraction:** - `LIEF::EXE_FORMATS` is now scoped in `LIEF::Binary::FORMATS` - All the Binary classes now implement classof: ```cpp std::unique_ptr bin = LIEF::Parser::parse("..."); if (LIEF::PE::Binary::classof(bin.get())) { auto& pe_file = static_cast(*bin); } ``` **General Design:** - Python parser functions (like: [`lief.PE.parse()`]( "lief.PE.parse")) now accept os.PathLike arguments like pathlib.Path ([#974]()). - Remove the lief.Binary.name attribute - LIEF is now compiled with C++17 (the API remains C++11 compliant) - Switch to [nanobind]() for the Python bindings. - CI are now more efficient. - The Python documentation for properties now contains the type of the property. ## [0.13.2 - June 17, 2023]() **PE:** Fix authenticode inconsitency ([#932]()) **ELF:** Fix missing undef ([#929]()) ## [0.13.1 - May 28, 2023]() **PE:** - Fix PE authenticode verification issue in the case of special characters ([#912]()) **Misc:** - Fix mypy stubs ([#909]()) - Fix missing include ([#918]()) - Fix C99 comments ([#916]()) - Fix AArch64 docker image ([#904]()) ## [0.13.0 - April 9, 2023]() **ELF:** - Fix overflow issue in segments (c.f. [#845]() found by [liyansong2018]()) - Fix missing relationship between symbols and sections (c.f. [#841]()) - Fix coredump parsing issue (c.f. [#830]() found by [Lan1keA]()) - Fix and (re)enable removing dynamic symbols (c.f. [#828]()) - Add support for NT\_GNU\_BUILD\_ATTRIBUTE\_OPEN and NT\_GNU\_BUILD\_ATTRIBUTE\_FUNC (c.f. [#816]()) - [CVE-2022-38497] Fix ELF core parsing issue ([#766]() found by [CCWANG19]()) - [CVE-2022-38306] Fix a heap overflow found by [CCWANG19]() ([#763]()) - [aeflores]() fixed an issue when there are multiple versions associated with a symbol (see: [#749]() for the details). - Handle binaries compiled with the -static-pie flag correctly (see: [#747]()) - Add support for modifying section-less binaries. The ELF [`Section`]( "lief.ELF.Section") objects gain the [`lief.ELF.Section.as_frame()`]( "lief.ELF.Section.as_frame") method which defines the section as a *framed* section. A framed section is a section that concretely does not wraps data and can be corrupted. **Example:** ```python elf = lief.parse("/bin/ssh") text = elf.get_section(".text").as_frame() # We can now corrupt all the fields of the section text.offset = 0xdeadc0de text.size = 0xffffff text.address = 0x123 elf.write("/tmp/out") ``` - Add API to precisely define how the segments table should be relocated. One might want to enforce a certain ELF layout while adding sections/ segments. It is now possible to call the method: [`relocate_phdr_table()`]( "lief.ELF.Binary.relocate_phdr_table") to define how the segments table should be relocated for welcoming the new sections/segments: ```python elf = lief.parse("...") # Enforce a specific relocation type: # The new segments table will be shift at the end # of the file elf.relocate_phdr_table(Binary.PHDR_RELOC.FILE_END) # Add sections/segments # [...] elf.write("out.elf") ``` See: > - [`lief.ELF.Binary.relocate_phdr_table()`]( "lief.ELF.Binary.relocate_phdr_table") > - [`lief.ELF.Binary.PHDR_RELOC`]( "lief.ELF.Binary.PHDR_RELOC") **MachO:** - Add [`rpaths`]( "lief.MachO.Binary.rpaths") iterator ([#291]()) - Add support for parsing Mach-O in memory - Fix a memory issue (found by [bladchan]() via [#806]()) - [CVE-2022-40923] Fix parsing issue ([#784]() found by [bladchan]()) - [CVE-2022-40922] Fix parsing issue ([#781]() found by [bladchan]()) - [CVE-2022-38307] Fix a segfault when the Mach-O binary does not have segments (found by [CCWANG19]() via [#764]()) - Enable to create exports - Fix the layout of the binaries modified by LIEF such as they can be (re)signed. - Add support for LC\_DYLD\_CHAINED\_FIXUPS and LC\_DYLD\_EXPORTS\_TRIE - Global enhancement when modifying the \_\_LINKEDIT content - Add API to get a [`Section`]( "lief.MachO.Section") from a specified segment’s name and section’s name. **Example:** ```python sec = bin.get_section("__DATA", "__objc_metadata") ``` - Add API to remove a [`Section`]( "lief.MachO.Section") from a specified segment’s name and section’s name. **Example:** ```python sec = bin.remove_section("__DATA", "__objc_metadata") ``` - Add `lief.MachO.Binary.page_size` **PE:** - The Python API now returns bytes objects instead of List[int] - Remove `lief.PE.ResourceNode.sort_by_id()` - Fix the ordering of children of [`ResourceNode`]( "lief.PE.ResourceNode") - Remove deprecated functions related to PE hooking. - Add support for new PE LoadConfiguration structures. **DEX:** - Fix multiple parsing issues raised by [bladchan]() **Other:** - [CVE-2022-38497]: [#765]() found by [CCWANG19]() - [CVE-2022-38495]: [#767]() found by [CCWANG19]() **General Design:** - [ZehMatt]() added the support to write LIEF binaries object through a std::ostream interface ([9d55f53]()) - Remove the exceptions - The library contains less static initializers which should improve the loading time. **Python Bindings:** - Move to a build system compliant with `pyproject.toml` - Provide typing stubs: [#650]() - PyPI releases no longer provide source distribution (sdist) **Dependencies:** - Move to spdlog 1.11.0 - Move to [Pybind11 - 2.10.1]() - Move to nlohmann/json 3.11.2 - Move to MbedTLS 3.2.1 - Move to utfcpp 3.2.1 ## [0.12.3 - November 1, 2022]() This release contains several security fixes: > - [CVE-2022-38497] Fix ELF core parsing issue ([#766]() found by [CCWANG19]()) > - [CVE-2022-38306] Fix a heap overflow found by [CCWANG19]() ([#763]()) > - Fix a memory issue (found by [bladchan]() via [#806]()) > - [CVE-2022-40923] Fix parsing issue ([#784]() found by [bladchan]()) > - [CVE-2022-40922] Fix parsing issue ([#781]() found by [bladchan]()) > - [CVE-2022-38307] Fix a segfault when the Mach-O binary does not have segments (found by [CCWANG19]() via [#764]()) ## [0.12.1 - April 08, 2022]() **ELF:** - Fix section inclusion calculations ([#692]()) **PE:** - Fix parsing regressions ([#689](), [#687](), [#686](), [#685](), [#691](), [#693]()) **Compilation:** - Nightly builds are now upload to Saleway’s S3 server: - [https://lief.s3-website.fr-par.scw.cloud/latest/lief]() - [https://lief.s3-website.fr-par.scw.cloud/latest/sdk]() - Fix GLIBCXX\_USE\_CXX11\_ABI=1 ABI issue (see: [#683]()) ## [0.12.0 - March 25, 2022]() **ELF:** - [ahaensler]() added the support to insert and assign a [`lief.ELF.SymbolVersionAuxRequirement`]( "lief.ELF.SymbolVersionAuxRequirement") (see: [#670]()) - Enhance the ELF parser to support corner cases described by [netspooky]() in : - [https://tmpout.sh/2/14.html]() (*84 byte aarch64 ELF*) - [https://tmpout.sh/2/3.html]() (*Some ELF Parser Bugs*) - New ELF Builder which is more efficient in terms of speed and in terms of number of segments added when modifying binaries (see: [https://lief-project.github.io/blog/2022-01-23-new-elf-builder/]()) - [Clcanny]() improved (see [#507]() and [#509]()) the reconstruction of the dynamic symbol table by sorting local symbols and non-exported symbols. It fixes the following warning when parsing a modified binary with `readelf` ```text Warning: local symbol 29 found at index >= .dynsym's sh_info value of 1 ``` **MachO:** - Change the layout of the binaries generated by LIEF such as they are compliant with `codesign` checks - The API to configure the MachO parser has been redesigned to provide a better granularity ```python config = lief.MachO.ParserConfig() config.parse_dyld_bindings = False config.parse_dyld_exports = True config.parse_dyld_rebases = False lief.MachO.parse("/tmp/big.macho", config) ``` - [LucaMoroSyn]() added the support for the `LC_FILESET_ENTRY`. This command is usually found in kernel cache files - `LIEF::MachO::Binary::get_symbol` now returns a pointer (instead of a reference). If the symbol can’t be found, it returns a nullptr. - Add API to select a [`Binary`]( "lief.MachO.Binary") from a [`FatBinary`]( "lief.MachO.FatBinary") by its architecture. See: [`lief.MachO.FatBinary.take()`]( "lief.MachO.FatBinary.take"). ```python fat = lief.MachO.parse("/bin/ls") fit = fat.take(lief.MachO.CPU_TYPES.x86_64) ``` - Handle the 0x0D binding opcode (see: [#524]()) - [xhochy]() fixed performances issues in the Mach-O parser (see [#579]()) **PE:** - Adding `lief.PE.OptionalHeader.computed_checksum` that re-computes the [`lief.PE.OptionalHeader.checksum`]( "lief.PE.OptionalHeader.checksum") (c.f. issue [#660]()) - Enable to recompute the [`RichHeader`]( "lief.PE.RichHeader") (issue: [#587]()) - [`raw()`]( "lief.PE.RichHeader.raw") - [`hash()`]( "lief.PE.RichHeader.hash") - Add support for PE’s delayed imports. see: - [`DelayImport`]( "lief.PE.DelayImport") / [`DelayImportEntry`]( "lief.PE.DelayImportEntry") - [`delay_imports`]( "lief.PE.Binary.delay_imports") - [`lief.PE.LoadConfiguration.reserved1`]( "lief.PE.LoadConfiguration.reserved1") has been aliased to [`lief.PE.LoadConfiguration.dependent_load_flags`]( "lief.PE.LoadConfiguration.dependent_load_flags") - [`lief.PE.LoadConfiguration.characteristics`]( "lief.PE.LoadConfiguration.characteristics") has been aliased to [`lief.PE.LoadConfiguration.size`]( "lief.PE.LoadConfiguration.size") - Thanks to [gdesmar](), we updated the PE checks to support PE files that have a corrupted [`lief.PE.OptionalHeader.magic`]( "lief.PE.OptionalHeader.magic") (cf. [#644]()) **DEX:** - [DanielFi]() added support for DEX’s fields (see: [#547]()) **Abstraction:** - Abstract binary imagebase for PE, ELF and Mach-O ([`lief.Binary.imagebase`]( "lief.Binary.imagebase")) - Add [`lief.Binary.offset_to_virtual_address()`]( "lief.Binary.offset_to_virtual_address") - Add PE imports/exports as *abstracted* symbols **Compilation & Integration:** - [ekilmer]() updated and modernized the CMake integration files through the PR: [#674]() - Enable to use a pre-compiled version of spdlog. This feature aims at improving compilation time when developing on LIEF. One can provide path to spdlog install through: ```console $ python ./setup.py --spdlog-dir=path/to/lib/cmake/spdlog [...] # or $ cmake -DLIEF_EXTERNAL_SPDLOG=ON -Dspdlog_DIR=path/to/lib/cmake/spdlog ... ``` - Enable to feed LIEF’s dependencies externally (c.f. [Third Party]()) - Replace the keywords `and`, `or`, `not` with `&&`, `||` and `!`. **Dependencies:** - Upgrade to MbedTLS 3.1.0 - Upgrade Catch2 to 2.13.8 - The different dependencies can be *linked* externally (cf. above and [Third Party]()) **Documentation:** - New section about the errors handling ( [Error Handling]()) and the upcoming deprecation of the exceptions. - New section about how to compile LIEF for debugging/developing. See: [Debugging]() **General Design:** **span:** LIEF now exposes Section/Segment’s data through a span interface. As std::span is available in the STL from C++20 and the LIEF public API aims at being C++11 compliant, we expose this span thanks to [tcbrindle/span](). This new interface enables to avoid copies of `std::vector` which can be costly. With this new interface, the original `std::vector` can be retrieved as follows: ```cpp auto bin = LIEF::ELF::Parser::parse("/bin/ls"); if (const auto* section = bin->get_section(".text")) { LIEF::span text_ref = section->content(); std::vector copy = {std::begin(text_ref), std::end(text_ref)}; } ``` In Python, span are wrapped by a **read-only** [memory view](). The original *list of bytes* can be retrieved as follows: ```python bin = lief.parse("/bin/ls") section = bin.get_section(".text") if section is not None: memory_view = section.content list_of_bytes = list(memory_view) ``` **Exceptions:** > **Warning** > > We started to refactor the API and the internal design to remove C++ exceptions. These changes are described a the dedicated blog ([LIEF RTTI & Exceptions]()) > > To highlighting the content of the blog for the end users, functions that returned a **reference and which threw an exception** in the case of a failure are now returning a **pointer that is set to nullptr** in the case of a failure. > > If we consider this original code: > > ```cpp > LIEF::MachO::Binary& bin = ...; > > try { > LIEF::MachO::UUIDCommand& cmd = bin.uuid(); > std::cout << cmd << "\n"; > } catch (const LIEF::not_found&) { > // ... dedicated processing > } > > // Other option with has_uuid() > if (bin.has_uuid()) { > LIEF::MachO::UUIDCommand& cmd = bin.uuid(); > std::cout << cmd << "\n"; > } > ``` > > It can now be written as: > > ```cpp > LIEF::MachO::Binary& bin = ...; > > if (LIEF::MachO::UUIDCommand* cmd = bin.uuid();) { > std::cout << *cmd << "\n"; > } else { > // ... dedicated processing as it is a nullptr > } > > // Other option with has_uuid() > if (bin.has_uuid()) { // It ensures that it is not a nullptr > LIEF::MachO::UUIDCommand& cmd = *bin.uuid(); > std::cout << cmd << "\n"; > } > ``` > **See also** > > - [Error Handling section]() > - [List of the functions that changed]() ## [0.11.X - Patch Releases]() ### [0.11.5 - May 22, 2021]() - Remove usage of `not` in public headers ([b8e825b]()) **ELF:** - [pdreiter]() fixed the issue [#418]() **PE:** - Fix issue when computing [`lief.PE.Binary.sizeof_headers`]( "lief.PE.Binary.sizeof_headers") ([ab3f073]()) **MachO:** - Fix error on property [`lief.MachO.BuildVersion.sdk`]( "lief.MachO.BuildVersion.sdk") (see [#533]()) ### [0.11.4 - March 09, 2021]() **PE:** - Fix missing bound check when computing the authentihash ### [0.11.3 - March 03, 2021]() **PE:** - Add sanity check on the signature’s length that could lead to a `std::bad_alloc` exception ### [0.11.2 - February 24, 2021]() **PE:** - Fix regression in the behavior of the PE section’s name. One can now access the full section’s name (with trailing bytes) through `lief.PE.Section.fullname` (see: [#551]()) ### [0.11.1 - February 22, 2021]() **PE:** - [`lief.PE.x509.is_trusted_by()`]( "lief.PE.x509.is_trusted_by") and [`lief.PE.x509.verify()`]( "lief.PE.x509.verify") now return a better [`lief.PE.x509.VERIFICATION_FLAGS`]( "lief.PE.x509.VERIFICATION_FLAGS") instead of just [`lief.PE.x509.VERIFICATION_FLAGS.BADCERT_NOT_TRUSTED`]( "lief.PE.x509.VERIFICATION_FLAGS.BADCERT_NOT_TRUSTED") (see: [#532]()) - Fix errors in the computation of the Authentihash ## [0.11.0 - January 19, 2021]() **ELF:** - [mkomet]() updated enums related to Android (see: [9dd641d]()) - [aeflores]() added MIPS relocations support in the ELF parser - Fix [`extend()`]( "lief.ELF.Binary.extend") on a ELF section (cf. issue [#477]()) - Fix issue when exporting symbols on empty-gnu-hash ELF binary ([1381f9a]()) - Fix reconstruction issue when the binary is prelinked (cf. issue [#466]()) - Add `DF_1_PIE` flag - Fix parsing issue of the `.eh_frame` section when the base address is not 0. - [JanuszL]() enhanced the algorithm that computes the string table. It moves from a `N^2` algorithm to a `Nlog(N)` ([1e0c4e8]()). - Fix `.eh_frame` parsing issue ([b57f323]()) - [aeflores]() fixed parsing issue in ELF relocations ([6c53646]()) - Add `PT_GNU_PROPERTY` enum - Bug fix in the symbols table reconstruction (ELF) **PE:** - Enhance PE Authenticode. See [PE Authenticode]() - [`get_imphash()`]( "lief.PE.get_imphash") can now generate the same value as pefile and Virus Total ([#299]()) ```python pe = lief.parse("example.exe") vt_imphash = lief.PE.get_imphash(pe, lief.PE.IMPHASH_MODE.PEFILE) lief_imphash = lief.PE.get_imphash(pe, lief.PE.IMPHASH_MODE.DEFAULT) ``` > **See also** > > [`lief.PE.IMPHASH_MODE`]( "lief.PE.IMPHASH_MODE") and [`lief.PE.get_imphash()`]( "lief.PE.get_imphash") - Remove the padding entry (0) from the rich header - `lief.PE.LangCodeItem.items` now returns a dictionary for which the values are **bytes** (instead of `str` object). This change is related to `utf-16` support. - [kohnakagawa]() fixed wrong enums values: [c031250](), [6ee808a](), [cd05f34]() - [kohnakagawa]() fixed a bug in the PE resources parser ([a7254d1]()) - Handle PE forwarded exports (issue [#307]()) **Mach-O:** - Add API to access either `LC_CODE_SIGNATURE` or `DYLIB_CODE_SIGN_DRS` (issue [#476]()) - Fix issue when parsing twice a Mach-O file (issue [#479]()) **Dependencies:** - Replace `easyloggingpp` with [spdlog 1.8.1]() - Upgrade `frozen` to 1.0.0 - Upgrade `json` to 3.7.3 - Upgrade `pybind11` to 2.6.0 - Upgrade `mbedtls` to 2.16.6 **Documentation:** - [aguinet]() updated the [bin2lib tutorial]() with the support of the new glibc versions ([7884e57]()) - Global update and enable to build the documentation out-of-tree - Changing the theme **Misc:** - Add Python 3.9 support - `FindLIEF.cmake` deprecates `LIEF_ROOT`. You should use `LIEF_DIR` instead. **Logging:** We changed the logging interface. The following log levels have been removed: - LOG\_GLOBAL - LOG\_FATAL - LOG\_VERBOSE - LOG\_UNKNOWN We also moved from an class-interface based to functions. Example: ```python lief.logging.disable() lief.logging.enable() lief.logging.set_level(lief.logging.LEVEL.INFO) ``` See: [`lief.logging.set_level()`]( "lief.logging.set_level") > **Note** > > The log functions now output on `stderr` instead of `stdout` ## [0.10.1 - November 29, 2019]() - Fix regression in parsing Python `bytes` - Add Python API to demangle strings: `lief.demangle` ## [0.10.0 - November 24, 2019]() **ELF:** - Add build support for ELF notes - Add coredump support ([9fc3a8a]()) - Enable to bind a relocation with a symbol ([a9f3cb8]()) **Example:** ```python relocation = "..." symbol = lief.ELF.Symbol() symbol.name = "printf123" relocation.symbol = symbol ``` - Add constructors ([67d924a]()) - Expose ELF destructors ([957384c]()) - Add `remove_static_symbol` ([c677970]()) - Add support for static relocation writing ([d1b98d6]()) - Expose function to get strings located in the `.rodata` section ([02f4851]()) - Export ELF ABI version ([8d7ec26]()) **PE:** - Improve PE Authenticode parsing ([535623d]()) - Fix alignment issue when removing a PE section ([04dddd3]()) - Parse PE debug data directory as a list of debug entries (by [1orenz0]() - [fcc75dd]()) - Add support to parse POGO debug entries (by [1orenz0]() - [3537440]()) **Mach-O:** - Enhance Mach-O modifications by exposing an API to: - Add load commands - Add sections - Add segments See: [406115c]() - Enable `write()` on FAT Mach-O ([1659531]()) - Introduce Mach-O Build Version command ([6f96723]()) - Enable to remove Mach-O symbols ([616d739]()) - Add support for adding `LC_UNIXTHREAD` commands in a MachO (by [nezetic]() - [64d2597]()) **Abstract Layer:** - Expose `remove_section()` in the abstract layer ([918438c]()) - Expose `write()` in the abstract layer ([af4d48e]()) - Expose API to list functions found in a binary ([b5a0846]()) **Android:** - Add partial support for Android 9 ([bce9ebe]()) **Misc:** - [lkollar]() added support for Python 3.8 in CI (Linux & OSX only) - Update Pybind11 dependency to `v2.4.3` - Enhance Python install - Thanks to [lkollar](), Linux CI now produces **manylinux1-compliant wheels** Many thanks to the contributors: [recvfrom](), [pbrunet](), [mackncheesiest](), [wisk](), [nezetic](), [lkollar](), [jbremer](), [DaLynX](), [1orenz0](), [breadchris](), [0xbf00](), [unratito](), [strazzere](), [aguinetqb](), [mingwandroid](), [serge-sans-paille-qb](), [yrp604](), [majin42](), [KOLANICH]() ## [0.9.0 - June 11, 2018]() LIEF 0.9 comes with new formats related to Android: OAT, DEX, VDEX and ART. It also fixes bugs and thanks to [yd0b0N](), ELF parser now supports big and little endian binaries. We also completed the JSON serialization of LIEF objects. ### [Features]() **MachO:** - Enable to configure the Mach-O parser for quick parsing: [880b99a]() - Add [`lief.MachO.EncryptionInfo`]( "lief.MachO.EncryptionInfo") command: [f4e2d81]() - Add [`lief.MachO.RPathCommand`]( "lief.MachO.RPathCommand") command: [196994d]() - Add [`lief.MachO.DataInCode`]( "lief.MachO.DataInCode") command: [a16e1c4]() - Add [`lief.MachO.SubFramework`]( "lief.MachO.SubFramework") command: [9e3b5b4]() - Add [`lief.MachO.SegmentSplitInfo`]( "lief.MachO.SegmentSplitInfo") command: [9e3b5b4]() - Add [`lief.MachO.DyldEnvironment`]( "lief.MachO.DyldEnvironment") command: [9e3b5b4]() - API to show export-trie, rebase and binding opcodes: [5d56141]() **PE:** - Add PE Code View: [eab4a76]() **ELF:** - Add support for `.note.android.ident` section: [d13db18]() - Enable to add unlimited number of dynamic entries: [a40da3e]() - Add support for PPC relocations: [08b5141]() - Endianness support: [e794ac1]() ### [API]() > - `lief.breakp()` and `lief.shell()` > - [`lief.parse()`]( "lief.parse") now support `io` streams as input > - Parser now returns a `std::unique_ptr` instead of a raw pointer: [cd1cc45]() ### [Misc]() - Use [frozen]() for some internal `std::map` (If C++14 is supported by the compiler) ### [Acknowledgments]() - [yd0b0N]() for [#162]() and [#166]() (Endianness support and PPC relocations) - [0xbf00]() for [#128]() (`LC_RPATH` command) - [illera88]() for [#118]() ## [0.8.3]() - [Mach-O] Fix typo on comparison operator - [abbc264]() ## [0.8.2]() - [ELF] Increase the upper limit of relocation number - [077bc32]() ## [0.8.1 - October 18, 2017]() - Fix an alignment issue in the ELF builder. See [8db199c]() - Add assertion on the setuptools version: [62e5825]() ## [0.8.0 - October 16, 2017]() LIEF 0.8.0 mainly improves the MachO parser and the ELF builder. It comes with [Dockerfiles]() for [CentOS]() and [Android](). [LibFuzzer]() has also been integrated in the project to enhance the parsers ### [Features]() **Abstract Layer:** - [`Relocation`]( "lief.Relocation") are now abstracted from the 3 formats - [9503f2f]() - `PIE` and `NX` are abstracted through the [`is_pie`]( "lief.Binary.is_pie") and [`has_nx`]( "lief.Binary.has_nx") properties - Add the [`lief.Section.search()`]( "lief.Section.search") and [`lief.Section.search_all()`]( "lief.Section.search_all") methods to look for patterns in the section’s content. **ELF:** - `DT_FLAGS` and `DT_FLAGS_1` are now parsed into [`DynamicEntryFlags`]( "lief.ELF.DynamicEntryFlags") - [754b8af]() - Handle relocations of object files (`.o`) - [483b8dc]() - Global enhancement of the ELF builder: One can now add **multiple** [`Section`]( "lief.ELF.Section") or [`Segment`]( "lief.ELF.Segment") into an ELF: ```python elf = lief.parse("/bin/cat") for i in range(3): segment = Segment() segment.type = SEGMENT_TYPES.LOAD segment.content = [i & 0xFF] * 0x1000 elf += segment for i in range(3): section = Section("lief_{:02d}".format(i)) section.content = [i & 0xFF] * 0x1000 elf += section elf.write("foo") ``` ```console $ readelf -l ./foo PHDR 0x0000000000000040 0x0000000000000040 0x0000000000000040 0x00000000000061f8 0x00000000000061f8 R E 0x8 INTERP 0x0000000000006238 0x0000000000006238 0x0000000000006238 0x000000000000001c 0x000000000000001c R 0x1 [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2] LOAD 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x000000000000d6d4 0x000000000000d6d4 R E 0x200000 LOAD 0x000000000000da90 0x000000000020da90 0x000000000020da90 0x0000000000000630 0x00000000000007d0 RW 0x200000 LOAD 0x000000000000f000 0x000000000040f000 0x000000000040f000 0x0000000000001000 0x0000000000001000 0x1000 LOAD 0x0000000000010000 0x0000000000810000 0x0000000000810000 0x0000000000001000 0x0000000000001000 0x1000 LOAD 0x0000000000011000 0x0000000001011000 0x0000000001011000 0x0000000000001000 0x0000000000001000 0x1000 .... $ readelf -S ./foo ... [27] lief_00 PROGBITS 0000000002012000 00012000 0000000000001000 0000000000000000 0 0 4096 [28] lief_01 PROGBITS 0000000004013000 00013000 0000000000001000 0000000000000000 0 0 4096 [29] lief_02 PROGBITS 0000000008014000 00014000 0000000000001000 0000000000000000 0 0 4096 ``` > **Warning** > > There are issues with executables statically linked with libraries that use `TLS` > > See: [#98]() One can now add **multiple** entries in the dynamic table: ```python elf = lief.parse("/bin/cat") elf.add_library("libfoo.so") elf.add(DynamicEntryRunPath("$ORIGIN")) elf.add(DynamicEntry(DYNAMIC_TAGS.INIT, 123)) elf.add(DynamicSharedObject("libbar.so")) elf.write("foo") ``` ```console $ readelf -d foo 0x0000000000000001 (NEEDED) Shared library: [libfoo.so] 0x0000000000000001 (NEEDED) Shared library: [libc.so.6] 0x000000000000000c (INIT) 0x7b 0x000000000000000c (INIT) 0x3600 ... 0x000000000000001d (RUNPATH) Bibliothèque runpath:[$ORIGIN] 0x000000000000000e (SONAME) Bibliothèque soname: [libbar.so] ``` See [b94900c](), [1e410e6]() for details. - [b2d3694]() enables modification of the ELF interpreter without **length restriction** ```python elf = lief.parse("/bin/cat") elf.interpreter = "/a/very/long/path/to/another/interpreter" elf.write("foo") ``` ```console $ readelf -l foo Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align PHDR 0x0000000000000040 0x0000000000000040 0x0000000000000040 0x00000000000011f8 0x00000000000011f8 R E 0x8 INTERP 0x000000000000a000 0x000000000040a000 0x000000000040a000 0x0000000000001000 0x0000000000001000 R 0x1 [Requesting program interpreter: /a/very/long/path/to/another/interpreter] .... ``` - Enhancement of the dynamic symbols counting - [985d124]() - Enable editing ELF’s notes: ```python elf = lief.parse("/bin/ls") build_id = elf[NOTE_TYPES.BUILD_ID] build_id.description = [0xFF] * 20 elf.write("foo") ``` ```console $ readelf -n foo Displaying notes found in: .note.gnu.build-id Owner Data size Description GNU 0x00000014 NT_GNU_BUILD_ID (unique build ID bitstring) Build ID: ffffffffffffffffffffffffffffffffffffffff ``` See commit [3be9dd0]() for more details **PE:** - Add [`get_imphash()`]( "lief.PE.get_imphash") and [`resolve_ordinals()`]( "lief.PE.resolve_ordinals") functions - [a89bc6d](), [dfa8e98]() - Parse the *Load Config Table* into [`LoadConfiguration`]( "lief.PE.LoadConfiguration") (up to Windows 10 SDK 15002 with *hotpatch\_table\_offset*) ```python from lief import to_json import json pe = lief.parse("some.exe") loadconfig = to_json(pe.load_configuration)) # Using the lief.to_json function pprint(json.loads(to_json(loadconfig))) ``` ```javascript {'characteristics': 248, 'code_integrity': {'catalog': 0, 'catalog_offset': 0, 'flags': 0, 'reserved': 0}, 'critical_section_default_timeout': 0, 'csd_version': 0, 'editlist': 0, ... 'guard_cf_check_function_pointer': 5368782848, 'guard_cf_dispatch_function_pointer': 5368782864, 'guard_cf_function_count': 15, 'guard_cf_function_table': 5368778752, 'guard_flags': 66816, 'guard_long_jump_target_count': 0, 'guard_long_jump_target_table': 0, 'guard_rf_failure_routine': 5368713280, 'guard_rf_failure_routine_function_pointer': 5368782880, ... ``` For details, see commit: [0234e3b]() **MachO:** - The `dyld` structure is parsed (deeply) into [`DyldInfo`]( "lief.MachO.DyldInfo"). It includes: - Binding opcodes - Rebases opcodes - Export trie See: [e2b81e0](), [0e972d6](), [f7cc518](), [782295b](), [#67]() - Section relocations are now parsed into [`lief.MachO.Section.relocations`]( "lief.MachO.Section.relocations") - [29c8157]() - `LC_FUNCTION_STARTS` is parsed into [`FunctionStarts`]( "lief.MachO.FunctionStarts") ([18d8919]()) - `LC_SOURCE_VERSION`, `LC_VERSION_MIN_MACOSX` and `LC_VERSION_MIN_IPHONEOS` are parsed into [`SourceVersion`]( "lief.MachO.SourceVersion") and [`VersionMin`]( "lief.MachO.VersionMin") ([c359778](), [0b4bb7d](), [5b99311](), [#45]()) - `LC_THREAD` and `LC_UNIXTHREAD` are now parsed into [`ThreadCommand`]( "lief.MachO.ThreadCommand") - [2325783]() ### [Fixes]() Fix enums conflicts([#32]()) - [66b4cd4]() Fix most of the memory leaks: [88dafa8](), [d9b1436](), [554fa15](), [3602643]() **ELF:** - Bug Fix when counting dynamic symbols from the GnuHash Table - [9036a24]() **PE:** - Fix nullptr dereference in resources - [e90fe1b]() - Handle encoding issues in the Python API - [8c7ceaf]() - Sanitize DLL names **MachO:** - Fix [#87](), [#92]() - Fix memory leaks and *some* performance issues: [#94]() ### [API]() In the C++ API `get_XXX()` getters have been renamed into `XXX()` (e.g. `get_header()` becomes `header()`) - [a4c69f7](), [e805669]() **Abstract:** - [`lief.Binary`]( "lief.Binary") gains the [`format`]( "lief.Binary.format") property - [9391238]() - [`lief.parse()`]( "lief.parse") can now takes a list of integers - [f330fa8]() - Add [`has_symbol()`]( "lief.Binary.has_symbol") and [`get_symbol()`]( "lief.Binary.get_symbol") to [`lief.Binary`]( "lief.Binary") - [f121af5]() - [Python API] Enhance the access to the abstract layer through the [`abstract`]( "lief.Binary.abstract") attribute - [0713854]() One can now do: ```python elf = lief.ELF.parse("/bin/ls") # Could be lief.MachO / lief.PE abstract = elf.abstract # Return the lief.Binary object ``` **ELF:** - Relocation gains the [`purpose`]( "lief.ELF.Relocation.purpose") property - [b7b0bde]() - Add [`lief.ELF.Binary.symbols`]( "lief.ELF.Binary.symbols") which return an iterator over **all** symbols (static and dynamic) - [af6ab65]() - `Header.sizeof_section_header` has been renamed into [`section_header_size`]( "lief.ELF.Header.section_header_size") - [d96971b]() - `Segment.flag` has been renamed into [`flags`]( "lief.ELF.Segment.flags") - [20a5f66]() - Add: - `arm_flags_list`, - `mips_flags_list` - `ppc64_flags_list` - `hexagon_flags_list` to [`Header`]( "lief.ELF.Header") - [730d045]() To check if a given flag is set, one can do: ```python >>> if lief.ELF.ARM_EFLAGS.EABI_VER5 in lief.ELF.Header "yes" else "no" ``` - [Python] Segment flags: `PF_X`, `PF_W`, `PF_X` has been renamed into `X`, `W`, `X` - [d70ef9e]() - Add [`lief.ELF.Section.flags_list`]( "lief.ELF.Section.flags_list") - [4937b71]() - Enhancement for [`DynamicEntryRpath`]( "lief.ELF.DynamicEntryRpath") and [`DynamicEntryRunPath`]( "lief.ELF.DynamicEntryRunPath"): [c375a47]() - Enhancement for [`DynamicEntryArray`]( "lief.ELF.DynamicEntryArray"): [81440ce]() - Add some *operators* [3b200b3](), [43bd06f]() **PE:** - Add some *operators* [5666351]() **MachO:** - [`lief.MachO.parse()`]( "lief.MachO.parse") can now takes a list of integers - [f330fa8]() - [`lief.MachO.parse()`]( "lief.MachO.parse") now returns a [`FatBinary`]( "lief.MachO.FatBinary") instead of a `list` of [`Binary`]( "lief.MachO.Binary"). [`FatBinary`]( "lief.MachO.FatBinary") has a similar API as a list - [3602643]() - Add some *operators*: [cbe8354]() **Logging:** Add an API to configure the logger - [4600c2b]() Example: ```python from lief import Logger Logger.disable() Logger.enable() Logger.set_level(lief.LEVEL.INFO) ``` See: `lief.Logger` ### [Build system]() - Add [`FindLIEF.cmake`]() - [6dd8b10]() - Add ASAN, TSAN, USAN, LSAN - [7f6aeb0]() - Add LibFuzzer - [7a0dc28]() ### [Documentation]() **References:** - recomposer, bearparser, IAT\_patcher, PEframe, Manalyze, MachOView, elf-dissector ### [Acknowledgments]() - [alvarofe]() for [#47]() - [aguinet]() for [#55](), [#61](), [#65](), [#77]() - [jevinskie]() for [#75]() - [liumuqing]() for [#80]() - [Manouchehri]() for [#106]() ## [0.7.0 - July 3, 2017]() ### [Features]() **Abstract Layer:** - Add bitness (32bits / 64bits) - [78d1adb]() - Add object type (Library, executable etc) - [78d1adb]() - Add *mode* Thumbs, 16bits etc - [78d1adb]() - Add endianness - [7ea08f7](), [#29]() **ELF:** - Enable dynamic symbols permutation - [2dea7cb]() - Fully handle section-less binaries - [de40c06]() - Parse ELF notes - [241aac7]() - Parse SYSV hash table - [afa74ce](), [#36]() - Add relocation size - [f1766f2]() **PE:** - Parse PE Overlay - [e0634c1]() - Enable PE Hooking - [24f6b72]() - Parse and rebuilt dos stub - [3f06397]() - Add a *resources manager* to provide an enhanced API over the resources - [8473c8e]() - Serialize PE objects into JSON - [673f5a3](), [#18]() - Parse Rich Header - [0893bd9](), [#15]() ### [Bug Fixes]() **ELF:** - Bug fix when a GNU hash has empty buckets - [21a6c30]() **PE:** - Bug fix in the signature parser: [#30](), [4af0256]() - Bug fix in the resources parser: Infinite loop - [a569cc1]() - Add more *out-of-bounds* checks on relocations and exports - [9364f64]() - Use `min(SizeOfRawData, VirtualSize)` for the section’s size and truncate the size to the file size - [61bf14b]() **MachO:** - Bug fix when a binary hasn’t a `LC_MAIN` command - [957501f]() ### [API]() **Abstract Layer:** - [`lief.Header.is_32`]( "lief.Header.is_32") and [`lief.Header.is_64`]( "lief.Header.is_64") - [`lief.Header.object_type`]( "lief.Header.object_type") - [`lief.Header.modes`]( "lief.Header.modes") - [`lief.Header.endianness`]( "lief.Header.endianness") **ELF:** - [`lief.ELF.Binary.permute_dynamic_symbols()`]( "lief.ELF.Binary.permute_dynamic_symbols") - `lief.ELF.Segment.data` has been renamed to [`lief.ELF.Segment.content`]( "lief.ELF.Segment.content") - [`lief.ELF.parse()`]( "lief.ELF.parse") takes an optional parameters: symbol counting - `lief.ELF.DYNSYM_COUNT_METHODS` - `lief.ELF.Relocation.size` **Notes:** - [`lief.ELF.Note`]( "lief.ELF.Note") - [`lief.ELF.Binary.has_notes`]( "lief.ELF.Binary.has_notes") - [`lief.ELF.Binary.notes`]( "lief.ELF.Binary.notes") **Hash Tables:** - [`lief.ELF.SysvHash`]( "lief.ELF.SysvHash") - [`lief.ELF.Binary.use_gnu_hash`]( "lief.ELF.Binary.use_gnu_hash") - [`lief.ELF.Binary.use_sysv_hash`]( "lief.ELF.Binary.use_sysv_hash") - [`lief.ELF.Binary.sysv_hash`]( "lief.ELF.Binary.sysv_hash") **PE:** - `lief.PE.Symbol.has_section` - `lief.PE.Binary.hook_function()` - `lief.PE.Binary.get_content_from_virtual_address()` takes either an **Absolute** virtual address or a **Relative** virtual address - `lief.PE.Binary.section_from_virtual_address` has been renamed to [`lief.PE.Binary.section_from_rva()`]( "lief.PE.Binary.section_from_rva"). - `lief.PE.parse_from_raw` has been removed. One can use [`lief.PE.parse()`]( "lief.PE.parse"). - `lief.PE.Section.data` has been **removed**. Please use `lief.PE.Section.content` **Dos Stub:** - [`lief.PE.Binary.dos_stub`]( "lief.PE.Binary.dos_stub") - `lief.PE.Builder.build_dos_stub` **Rich Header:** - [`lief.PE.Binary.rich_header`]( "lief.PE.Binary.rich_header") - [`lief.PE.Binary.has_rich_header`]( "lief.PE.Binary.has_rich_header") - [`lief.PE.RichHeader`]( "lief.PE.RichHeader") - [`lief.PE.RichEntry`]( "lief.PE.RichEntry") **Overlay:** - [`lief.PE.Binary.overlay`]( "lief.PE.Binary.overlay") - `lief.PE.Builder.build_overlay` **Imports:** - [`lief.PE.Binary.has_import`]( "lief.PE.Binary.has_import") - [`lief.PE.Binary.get_import()`]( "lief.PE.Binary.get_import") **Resources:** - [`lief.PE.Binary.resources`]( "lief.PE.Binary.resources") - [`lief.PE.ResourceData`]( "lief.PE.ResourceData") - [`lief.PE.ResourceDirectory`]( "lief.PE.ResourceDirectory") - [`lief.PE.ResourceNode`]( "lief.PE.ResourceNode") - `lief.PE.LangCodeItem` - [`lief.PE.ResourceDialog`]( "lief.PE.ResourceDialog") - `lief.PE.ResourceDialogItem` - `lief.PE.ResourceFixedFileInfo` - [`lief.PE.ResourceIcon`]( "lief.PE.ResourceIcon") - [`lief.PE.ResourceStringFileInfo`]( "lief.PE.ResourceStringFileInfo") - [`lief.PE.ResourceVarFileInfo`]( "lief.PE.ResourceVarFileInfo") - [`lief.PE.ResourceVersion`]( "lief.PE.ResourceVersion") **MachO:** - [`lief.MachO.Binary.has_entrypoint`]( "lief.MachO.Binary.has_entrypoint") - [`lief.MachO.Symbol.demangled_name`]( "lief.MachO.Symbol.demangled_name") **UUID:** - [`lief.MachO.Binary.has_uuid`]( "lief.MachO.Binary.has_uuid") - [`lief.MachO.Binary.uuid`]( "lief.MachO.Binary.uuid") - [`lief.MachO.UUIDCommand`]( "lief.MachO.UUIDCommand") **Main Command:** - [`lief.MachO.Binary.has_main_command`]( "lief.MachO.Binary.has_main_command") - [`lief.MachO.Binary.main_command`]( "lief.MachO.Binary.main_command") - [`lief.MachO.MainCommand`]( "lief.MachO.MainCommand") **Dylinker:** - [`lief.MachO.Binary.has_dylinker`]( "lief.MachO.Binary.has_dylinker") - [`lief.MachO.Binary.dylinker`]( "lief.MachO.Binary.dylinker") - [`lief.MachO.DylinkerCommand`]( "lief.MachO.DylinkerCommand") ### [Documentation]() **References:** - elfsteem, pelook, PortEx, elfsharp, metasm, amoco, Goblin **Tutorials:** - [PE Hooking](), [Resources Manipulation]() **Integration:** - [XCode](), [CMake]() ### [Acknowledgments]() - [ek0](): [#24]() - [ACSC-CyberLab](): [#33](), [#34](), [#37](), [#39]() - Hyrum Anderson who pointed bugs in the PE parser - My colleagues for the feedback and suggestions (Adrien, SebK, Pierrick) ## [0.6.1 - April 6, 2017]() ### [Bug Fixes]() **ELF:** - Don’t rely on [`lief.ELF.Section.entry_size`]( "lief.ELF.Section.entry_size") to count symbols - [004c676]() ### [API]() **PE:** - [`lief.PE.TLS.has_section`]( "lief.PE.TLS.has_section") - [`lief.PE.TLS.has_data_directory`]( "lief.PE.TLS.has_data_directory") ### [Documentation]() **Integration:** - [Visual Studio]() ### [Acknowledgments]() - [Philippe]() for the proofreading. ## [0.6.0 - March 30, 2017]() First public release