Python¶

Utilities¶

lief.is_dex(*args) → bool¶

lief.is_dex(raw: list[int]) → bool

Overloaded function.

is_dex(path: str) -> bool

Check if the file given in parameter is a DEX

is_dex(raw: list[int]) -> bool

Check if the raw data given in parameter is a DEX

lief.DEX.version(*args) → int¶

lief.DEX.version(raw: list[int]) → int

Overloaded function.

version(file: str) -> int

Return the DEX version of the file given in parameter

version(raw: list[int]) -> int

Return the DEX version of the raw data given in parameter

Parser¶

lief.DEX.parse(*args) → lief.DEX.File | None¶

lief.DEX.parse(raw: list[int], name: str = '') → lief._lief.DEX.File | None

lief.DEX.parse(obj: io.IOBase | os.PathLike, name: str = '') → lief._lief.DEX.File | None

Overloaded function.

parse(filename: str) -> Optional[lief._lief.DEX.File]

Parse the given filename and return a File object

parse(raw: list[int], name: str = '') -> Optional[lief._lief.DEX.File]

Parse the given raw data and return a File object

File¶

class lief.DEX.File¶

Bases: Object

DEX File representation

property classes → lief.DEX.File.it_classes¶: Iterator over Dex Class

property dex2dex_json_info → str¶

property fields → lief.DEX.File.it_fields¶: Iterator over Dex Field

get_class(self, classname: int) → lief.DEX.Class¶

has_class(self, classname: str) → bool¶: Check if a class with a name given in parameter exists

property header → lief.DEX.Header¶: Dex File Header

class it_classes¶

Bases: object

Iterator over lief._lief.DEX.Class

class it_fields¶

Bases: object

Iterator over lief._lief.DEX.Field

class it_methods¶

Bases: object

Iterator over lief._lief.DEX.Method

class it_prototypes¶

Bases: object

Iterator over lief._lief.DEX.Prototype

class it_strings¶: Bases: object

class it_types¶

Bases: object

Iterator over lief._lief.DEX.Type

property location → str¶: Original location of the dex file

property map → lief.DEX.MapList¶: Dex MapList

property methods → lief.DEX.File.it_methods¶: Iterator over Dex Method

property name → str¶: Name of the dex file

property prototypes → lief.DEX.File.it_prototypes¶: Iterator over Dex Prototype

raw(self, deoptimize: bool) → list[int]¶: Original raw file

save(self, output: str, deoptimize: bool) → str¶: Save the original file into the file given in first parameter

property strings → lief.DEX.File.it_strings¶: Iterator over Dex strings

property types → lief.DEX.File.it_types¶: Iterator over Dex Type

property version → int¶: Dex version

class lief.DEX.Header¶

Bases: Object

DEX Header

property checksum → int¶: Checksum value of the rest of the file (without magic)

property classes → tuple[int, int]¶: Classess identifiers

property data → tuple[int, int]¶: Raw data. Should be align on 32-bits

property endian_tag → int¶: Endianness tag. Should be ENDIAN_CONSTANT

property fields → tuple[int, int]¶: Fields identifiers

property file_size → int¶: Size of the current DEX file

property header_size → int¶: Size of this header. Should be 0x70

property link → tuple[int, int]¶: Link (raw data)

property magic → list[int]¶: Magic value

property map_offset → int¶: Offset from the start of the file to the map item

property methods → tuple[int, int]¶: Methods identifiers

property nb_classes → int¶: Number of classes in the current DEX

property nb_methods → int¶: Number of methods in the current DEX

property prototypes → tuple[int, int]¶: Prototypes identifiers

property signature → list[int]¶: SHA-1 signature of the rest of the file (without magic and checksum).

property strings → tuple[int, int]¶: String identifiers

property types → tuple[int, int]¶: Type identifiers

Method¶

class lief.DEX.Method¶

Bases: Object

DEX Method representation

property access_flags → list[lief.DEX.ACCESS_FLAGS]¶: List of ACCESS_FLAGS

property bytecode → list[int]¶: Dalvik Bytecode as a list of bytes

property cls → lief.DEX.Class¶: Class associated with this method

property code_offset → int¶: Offset to the Dalvik Bytecode

has(self, flag: lief.DEX.ACCESS_FLAGS) → bool¶: Check if the given ACCESS_FLAGS is present

property has_class → bool¶: True if a class is associated with this method

property index → int¶: Original DEX file index of the method

insert_dex2dex_info(self, pc: int, index: int) → None¶: Insert de-optimization information

property is_virtual → bool¶: True if the method is a virtual (not private, static, final, constructor)

property name → str¶: Method’s name

property prototype → lief.DEX.Prototype¶: Prototype of this method

Field¶

class lief.DEX.Field¶

Bases: Object

DEX Field representation

property access_flags → list[lief.DEX.ACCESS_FLAGS]¶: List of ACCESS_FLAGS

property cls → lief.DEX.Class¶: Class associated with this field

has(self, flag: lief.DEX.ACCESS_FLAGS) → bool¶: Check if the given ACCESS_FLAGS is present

property has_class → bool¶: True if a class is associated with this field

property index → int¶: Original DEX file index of the field

property is_static → bool¶: True if the field is static

property name → str¶: Field’s name

property type → lief.DEX.Type¶: Type of this field

Class¶

class lief.DEX.Class¶

Bases: Object

DEX Class representation

property access_flags → list[lief.DEX.ACCESS_FLAGS]¶: List of ACCESS_FLAGS

property dex2dex_info → dict[lief.DEX.Method, dict[int, int]]¶: De-optimize information

property fields → lief.DEX.Class.it_fields¶: Iterator over Field in this class

property fullname → str¶: Mangled class name (e.g. Lcom/example/android/MyActivity;)

get_field(self, name: str) → lief.DEX.Class.it_named_fields¶: Iterator over Field (s) having the given name

get_method(self, name: str) → lief.DEX.Class.it_named_methods¶: Iterator over Method (s) having the given name

has(self, flag: lief.DEX.ACCESS_FLAGS) → bool¶: Check if the given ACCESS_FLAGS is present

property has_parent → bool¶: True if the current class extends another one

property index → int¶: Original index in the DEX class pool

class it_fields¶

Bases: object

Iterator over lief._lief.DEX.Field

class it_methods¶

Bases: object

Iterator over lief._lief.DEX.Method

class it_named_fields¶

Bases: object

Iterator over lief._lief.DEX.Field

class it_named_methods¶

Bases: object

Iterator over lief._lief.DEX.Method

property methods → lief.DEX.Class.it_methods¶: Iterator over Method implemented in this class

property name → str¶: Class name (e.g. MyActivity)

property package_name → str¶: Package Name (e.g. com.example.android)

property parent → lief.DEX.Class¶: Class parent class

property pretty_name → str¶: Demangled class name (e.g. com.example.android.MyActivity)

property source_filename → str¶: Original filename

Code Info¶

class lief.DEX.CodeInfo¶

Bases: Object

DEX CodeInfo representation

Prototype¶

class lief.DEX.Prototype¶

Bases: Object

DEX Prototype representation

class it_params¶

Bases: object

Iterator over lief._lief.DEX.Type

property parameters_type → lief.DEX.Prototype.it_params¶: Iterator over parameters Type

property return_type → lief.DEX.Type¶: Type returned

Type¶

class lief.DEX.Type¶

Bases: Object

DEX Type representation

class PRIMITIVES¶

Bases: object

BOOLEAN = lief._lief.DEX.PRIMITIVES.BOOLEAN¶

BYTE = lief._lief.DEX.PRIMITIVES.BYTE¶

CHAR = lief._lief.DEX.PRIMITIVES.CHAR¶

DOUBLE = lief._lief.DEX.PRIMITIVES.DOUBLE¶

FLOAT = lief._lief.DEX.PRIMITIVES.FLOAT¶

INT = lief._lief.DEX.PRIMITIVES.INT¶

LONG = lief._lief.DEX.PRIMITIVES.LONG¶

SHORT = lief._lief.DEX.PRIMITIVES.SHORT¶

VOID_T = lief._lief.DEX.PRIMITIVES.VOID_T¶

class TYPES¶

Bases: object

ARRAY = lief._lief.DEX.TYPES.ARRAY¶

CLASS = lief._lief.DEX.TYPES.CLASS¶

PRIMITIVE = lief._lief.DEX.TYPES.PRIMITIVE¶

UNKNOWN = lief._lief.DEX.TYPES.UNKNOWN¶

property dim → int¶: If the current type is an array, return its dimension otherwise 0

pretty_name(primitive: lief.DEX.Type.PRIMITIVES) → str = <nanobind.nb_func object>¶

property type → lief.DEX.Type.TYPES¶: TYPES of this object

property underlying_array_type → lief.DEX.Type¶: Underlying type of the array

property value → object¶: Depending on the TYPES, return Class or PRIMITIVES or array

MapList¶

class lief.DEX.MapList¶

Bases: Object

DEX MapList representation

get(self, type: lief.DEX.MapItem.TYPES) → lief.DEX.MapItem¶: Return the MapItem from the given TYPES

has(self, type: lief.DEX.MapItem.TYPES) → bool¶: Check if the given TYPES is present

class it_items_t¶

Bases: object

Iterator over lief._lief.DEX.MapItem

property items → lief.DEX.MapList.it_items_t¶: Iterator over MapItem

MapItem¶

class lief.DEX.MapItem¶

Bases: Object

DEX MapItem representation

class TYPES¶

Bases: object

ANNOTATION = lief._lief.DEX.TYPES.ANNOTATION¶

ANNOTATIONS_DIRECTORY = lief._lief.DEX.TYPES.ANNOTATIONS_DIRECTORY¶

ANNOTATION_SET = lief._lief.DEX.TYPES.ANNOTATION_SET¶

ANNOTATION_SET_REF_LIST = lief._lief.DEX.TYPES.ANNOTATION_SET_REF_LIST¶

CALL_SITE_ID = lief._lief.DEX.TYPES.CALL_SITE_ID¶

CLASS_DATA = lief._lief.DEX.TYPES.CLASS_DATA¶

CLASS_DEF = lief._lief.DEX.TYPES.CLASS_DEF¶

CODE = lief._lief.DEX.TYPES.CODE¶

DEBUG_INFO = lief._lief.DEX.TYPES.DEBUG_INFO¶

ENCODED_ARRAY = lief._lief.DEX.TYPES.ENCODED_ARRAY¶

FIELD_ID = lief._lief.DEX.TYPES.FIELD_ID¶

HEADER = lief._lief.DEX.TYPES.HEADER¶

MAP_LIST = lief._lief.DEX.TYPES.MAP_LIST¶

METHOD_HANDLE = lief._lief.DEX.TYPES.METHOD_HANDLE¶

METHOD_ID = lief._lief.DEX.TYPES.METHOD_ID¶

PROTO_ID = lief._lief.DEX.TYPES.PROTO_ID¶

STRING_DATA = lief._lief.DEX.TYPES.STRING_DATA¶

STRING_ID = lief._lief.DEX.TYPES.STRING_ID¶

TYPE_ID = lief._lief.DEX.TYPES.TYPE_ID¶

TYPE_LIST = lief._lief.DEX.TYPES.TYPE_LIST¶

from_value(arg: int) → lief.DEX.MapItem.TYPES = <nanobind.nb_func object>¶

property value → int¶: The underlying integer value

property offset → int¶: Offset from the start of the file to the items in question

property size → int¶: count of the number of items to be found at the indicated offset

property type → lief.DEX.MapItem.TYPES¶: TYPES of the item

Enums¶

Access Flags¶

class lief.DEX.ACCESS_FLAGS¶

Bases: object

ABSTRACT = lief._lief.DEX.ACCESS_FLAGS.ABSTRACT¶

ANNOTATION = lief._lief.DEX.ACCESS_FLAGS.ANNOTATION¶

BRIDGE = lief._lief.DEX.ACCESS_FLAGS.BRIDGE¶

CONSTRUCTOR = lief._lief.DEX.ACCESS_FLAGS.CONSTRUCTOR¶

DECLARED_SYNCHRONIZED = lief._lief.DEX.ACCESS_FLAGS.DECLARED_SYNCHRONIZED¶

ENUM = lief._lief.DEX.ACCESS_FLAGS.ENUM¶

FINAL = lief._lief.DEX.ACCESS_FLAGS.FINAL¶

INTERFACE = lief._lief.DEX.ACCESS_FLAGS.INTERFACE¶

NATIVE = lief._lief.DEX.ACCESS_FLAGS.NATIVE¶

PRIVATE = lief._lief.DEX.ACCESS_FLAGS.PRIVATE¶

PROTECTED = lief._lief.DEX.ACCESS_FLAGS.PROTECTED¶

PUBLIC = lief._lief.DEX.ACCESS_FLAGS.PUBLIC¶

STATIC = lief._lief.DEX.ACCESS_FLAGS.STATIC¶

STRICT = lief._lief.DEX.ACCESS_FLAGS.STRICT¶

SYNCHRONIZED = lief._lief.DEX.ACCESS_FLAGS.SYNCHRONIZED¶

SYNTHETIC = lief._lief.DEX.ACCESS_FLAGS.SYNTHETIC¶

TRANSIENT = lief._lief.DEX.ACCESS_FLAGS.VARARGS¶

UNKNOWN = lief._lief.DEX.ACCESS_FLAGS.UNKNOWN¶

VARARGS = lief._lief.DEX.ACCESS_FLAGS.VARARGS¶

VOLATILE = lief._lief.DEX.ACCESS_FLAGS.BRIDGE¶