Python¶

lief.pdb.load(path: str) → lief.pdb.DebugInfo | None¶: Load the PDB from the given path

DebugInfo¶

class lief.pdb.DebugInfo¶

Bases: DebugInfo

This class provides an interface for PDB files.

One can instantiate this class using lief.pdb.load() or lief.pdb.DebugInfo.from_file()

property age → int¶: The number of times the PDB file has been written.

property compilation_units → Iterator[lief.pdb.CompilationUnit | None]¶: Iterator over the CompilationUnit from the PDB’s DBI stream. CompilationUnit are also named “Module” in the PDB’s official documentation

find_public_symbol(self, name: str) → lief.pdb.PublicSymbol | None¶

Try to find the PublicSymbol from the given name (based on the public symbol stream) The function returns None if the symbol can’t be found.

debug_info: lief.pdb.DebugInfo = ...
if sym := debug_info.find_public_symbol("MiSyncSystemPdes"):
    print("found")

find_type(self, name: str) → lief.pdb.Type | None¶: Find the type with the given name

from_file(filepath: str) → lief.pdb.DebugInfo | None = <nanobind.nb_func object>¶

property guid → str¶: Unique identifier of the PDB file.

property public_symbols → Iterator[lief.pdb.PublicSymbol | None]¶: Return an iterator over the public symbol stream.

property types → Iterator[lief.pdb.Type | None]¶: Return an iterator over the different types registered in this PDB file

CompilationUnit¶

class lief.pdb.CompilationUnit¶

Bases: object

This class represents a Compilation Unit (or Module) in a PDB file

property build_metadata → lief.pdb.BuildMetadata | None¶

property functions → Iterator[lief.pdb.Function | None]¶: Return an iterator over the function defined in this compilation unit. If the PDB does not contain or has an empty DBI stream, it returns an empty iterator.

property module_name → str¶: Name (or path) to the COFF object (.obj) associated with this compilation unit (e.g. e:\obj.amd64fre\minkernel\ntos\hvl\mp\objfre\amd64\hvlp.obj)

property object_filename → str¶: Name of path to the original binary object (COFF, Archive) in which the compilation unit was located before being linked. e.g. e:\obj.amd64fre\minkernel\ntos\hvl\mp\objfre\amd64\hvl.lib

property sources → Iterator[str]¶: Iterator over the sources files that compose this compilation unit. These files include headers (.h, .hpp, …).

BuildMetadata¶

class lief.pdb.BuildMetadata¶

Bases: object

This class wraps build metadata represented by the codeview symbols: S_COMPILE3, S_COMPILE2, S_BUILDINFO

class CPU(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Enum

ALPHA = 48¶

ALPHA_21164 = 49¶

ALPHA_21164A = 50¶

ALPHA_21264 = 51¶

ALPHA_21364 = 52¶

AM33 = 160¶

ARM3 = 96¶

ARM4 = 97¶

ARM4T = 98¶

ARM5 = 99¶

ARM5T = 100¶

ARM6 = 101¶

ARM64 = 246¶

ARM64EC = 248¶

ARM64X = 249¶

ARM7 = 104¶

ARMNT = 244¶

ARM_WMMX = 103¶

ARM_XMAC = 102¶

CEE = 144¶

D3D11_SHADER = 256¶

EBC = 224¶

HYBRID_X86ARM64 = 247¶

IA64 = 128¶

IA64_2 = 129¶

INTEL_80286 = 2¶

INTEL_80386 = 3¶

INTEL_80486 = 4¶

INTEL_8080 = 0¶

INTEL_8086 = 1¶

M32R = 176¶

M68000 = 32¶

M68010 = 33¶

M68020 = 34¶

M68030 = 35¶

M68040 = 36¶

MIPS = 16¶

MIPS16 = 17¶

MIPS32 = 18¶

MIPS64 = 19¶

MIPSI = 20¶

MIPSII = 21¶

MIPSIII = 22¶

MIPSIV = 23¶

MIPSV = 24¶

OMNI = 112¶

PENTIUM = 5¶

PENTIUM3 = 7¶

PENTIUMPRO = 6¶

PPC601 = 64¶

PPC603 = 65¶

PPC604 = 66¶

PPC620 = 67¶

PPCBE = 69¶

PPCFP = 68¶

SH3 = 80¶

SH3DSP = 82¶

SH3E = 81¶

SH4 = 83¶

SHMEDIA = 84¶

THUMB = 240¶

TRICORE = 192¶

UNKNOWN = 255¶

X64 = 208¶

class LANG(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Enum

ALIASOBJ = 20¶

BASIC = 5¶

C = 0¶

COBOL = 6¶

CPP = 1¶

CSHARP = 10¶

CVTPGD = 9¶

CVTRES = 8¶

FORTRAN = 2¶

GO = 22¶

HLSL = 16¶

ILASM = 12¶

JAVA = 13¶

JSCRIPT = 14¶

LINK = 7¶

MASM = 3¶

MSIL = 15¶

OBJC = 17¶

OBJCPP = 18¶

PASCAL_LANG = 4¶

RUST = 21¶

SWIFT = 19¶

UNKNOWN = 255¶

VB = 11¶

property backend_version → lief.pdb.BuildMetadata.version_t¶: Version of the backend (e.g. 14.36.32537)

property build_info → lief.pdb.BuildMetadata.build_info_t | None¶: Build information represented by the S_BUILDINFO symbol

class build_info_t¶

Bases: object

Build information represented by the S_BUILDINFO symbol

property build_tool → str¶: Path to the build tool (e.g. C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX64\x64\CL.exe

property command_line → str¶: Command line arguments used to invoke the build tool

property cwd → str¶: Working directory where the build tool was invoked

property pdb → str¶: PDB path

property source_file → str¶: Source file consumed by the build tool

property env → list[str]¶: Environment information represented by the S_ENVBLOCK symbol

property frontend_version → lief.pdb.BuildMetadata.version_t¶: Version of the frontend (e.g. 19.36.32537)

property language → lief.pdb.BuildMetadata.LANG¶: Source language

property target_cpu → lief.pdb.BuildMetadata.CPU¶: Target CPU

property version → str¶: Version of the tool as a string. For instance, Microsoft (R) CVTRES, Microsoft (R) LINK.

class version_t¶

Bases: object

This structure represents a version for the backend or the frontend

property build → int¶: Build version

property major → int¶: Major version

property minor → int¶: Minor version

property qfe → int¶: Quick Fix Engineeringa version

PublicSymbol¶

class lief.pdb.PublicSymbol¶

Bases: object

This class provides general information (RVA, name) about a symbol from the PDB’s public symbol stream (or Public symbol hash stream)

property RVA → int¶

Relative Virtual Address of this symbol.

This function returns 0 if the RVA can’t be computed.

property demangled_name → str¶: Demangled representation of the symbol

property name → str¶: Name of the symbol

property section_name → str¶: Name of the section in which this symbol is defined (e.g. .text). This function returns an empty string if the section’s name can’t be found

Function¶

class lief.pdb.Function¶

Bases: object

property RVA → int¶: The Relative Virtual Address of the function

property code_size → int¶: The size of the function

property debug_location → lief.debug_location_t¶: Original source code location.

property name → str¶: Name of the function

property section_name → str¶: The name of the section in which this function is defined

Type¶

class lief.pdb.Type¶

Bases: object

class KIND(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Enum

ARRAY = 8¶

BITFIELD = 7¶

CLASS = 1¶

ENUM = 4¶

FUNCTION = 5¶

INTERFACE = 11¶

MODIFIER = 6¶

POINTER = 2¶

SIMPLE = 3¶

STRUCTURE = 10¶

UNION = 9¶

UNKNOWN = 0¶

property kind → lief.pdb.Type.KIND¶: Discriminator for the type’s subclasses

Array¶

class lief.pdb.types.Array¶

Bases: Type

This class represents a LF_ARRAY PDB type.

Attribute (type)¶

Inheritance diagram of lief._lief.pdb.types.Attribute

class lief.pdb.types.Attribute¶

Bases: object

This class represents an attribute (LF_MEMBER) in an aggregate (class, struct, union, …)

property field_offset → int¶: Offset of this attribute in the aggregate

property name → str¶: Name of this attribute.

property type → lief.pdb.Type | None¶: Type of this attribute

BitField¶

class lief.pdb.types.BitField¶

Bases: Type

This class represents a LF_BITFIELD PDB type

ClassLike¶

Inheritance diagram of lief._lief.pdb.types.Union, lief._lief.pdb.types.Interface, lief._lief.pdb.types.Class, lief._lief.pdb.types.Structure, lief._lief.pdb.types.ClassLike

class lief.pdb.types.ClassLike¶

Bases: Type

This class abstracts the following PDB types: LF_STRUCTURE, LF_INTERFACE, LF_CLASS or LF_UNION.

property attributes → Iterator[lief.pdb.types.Attribute | None]¶: Return an iterator over the different attributes defined in this class-like type