COFF¶

API

Introduction¶

COFF object files can be parsed using or the generic function:

import lief

# Using a filepath as a string
coff: lief.COFF.Binary | None = lief.COFF.parse("hello.obj")

# Using a Path from pathlib
coff: lief.COFF.Binary | None = lief.COFF.parse(
    pathlib.Path(r"C:\Users\romain\test.obj")
)

# Using a io object
with open("/tmp/test.ob", "rb") as f:
    coff: lief.COFF.Binary | None = lief.COFF.parse(f)

#include <LIEF/COFF.hpp>

// Using a file path as a std::string
std::unique_ptr<LIEF::COFF::Binary> coff = LIEF::COFF::Parser::parse("test.obj");

let coff: lief::coff::Binary = lief::coff::Binary::parse("test.obj").unwrap();

These functions return a instance that exposes the main API for processing and accessing COFF information:

coff: lief.COFF.Binary

for section in coff.sections:
    print(section.name)

std::unique_ptr<LIEF::COFF::Binary> coff;

for (const LIEF::COFF::Section& section : coff->sections()) {
  std::cout << section.name() << '\n';
}

let coff: &lief::coff::Binary = some_coff;

for section in coff.sections() {
    println!("{section:?} {section}");
}

Disassembler¶

The object exposes a disassembler API for iterating over the instructions of a COFF binary. One can disassemble a function using :

coff: lief.COFF.Binary

for inst in coff.disassemble("?foo@@YAHHH@Z"):
    print(inst)

# Using demangled representation
for inst in coff.disassemble("int __cdecl bar(int, int)"):
    print(inst)

std::unique_ptr<LIEF::COFF::Binary> coff;

for (const auto& inst : coff->disassemble("?foo@@YAHHH@Z")) {
  std::cout << inst.to_string() << '\n';
}

// Using demangled representation
for (const auto& inst : coff->disassemble("int __cdecl bar(int, int)")) {
  std::cout << inst.to_string() << '\n';
}

let coff: &lief::coff::Binary = some_coff;

for inst in coff.disassemble_function("?foo@@YAHHH@Z") {
    println!("{}", inst);
}

// Using demangled representation
for inst in coff.disassemble_function("int __cdecl bar(int, int)") {
    println!("{}", inst);
}

For more details about the disassembler and the API, please refer to the Disassembler section.