--- documentID: "dd20c0d10e2c8801b8f9496039ba559719eafdefc0e4e58238824986442b7370" docname: "formats/coff/python" title: "COFF Python API - LIEF Documentation" description: "COFF Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/coff/python.html" markdownURL: "https://lief.re/doc/latest/formats/coff/python.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "465320e5077eb1babdf911625138458f793e33176df4d133cbc5cab3c2b9f435" --- # [Python]() ## [Parser]() ### [` lief.COFF.parse `]() lief.COFF.parse(*obj: str | io.IOBase | os.PathLike | bytes | list[int]*, *config: [lief.COFF.ParserConfig]( "lief.COFF.ParserConfig")*) → [lief.COFF.Binary]( "lief.COFF.Binary") | None Parse the COFF binary specified in the first parameter and return a [`lief.COFF.Binary`]( "lief.COFF.Binary") object The second argument is an optional configuration that can be used to define which part(s) of the COFF should be parsed or skipped. ### [` lief.COFF.ParserConfig `]() class lief.COFF.ParserConfig(*self*) Bases: `object` #### [` all `]() all = <lief.\_lief.COFF.ParserConfig object> #### [` default_conf `]() default\_conf = <lief.\_lief.COFF.ParserConfig object> ## [Binary]() ### [` lief.COFF.Binary `]() class lief.COFF.Binary Bases: `object` Class that represents a COFF Binary #### [` disassembledisassemble `]() disassemble(*self*, *function: [lief.\_lief.COFF.Symbol]( "lief._lief.COFF.Symbol")*) → Iterator[[lief.\_lief.assembly.Instruction]( "lief._lief.assembly.Instruction") | None] **disassemble(*self*, *function\_name: str*) → Iterator[[lief.\_lief.assembly.Instruction]( "lief._lief.assembly.Instruction") | None]** Overloaded function. 1. `disassemble(self, function: lief._lief.COFF.Symbol) -> Iterator[Optional[lief._lief.assembly.Instruction]]` > Disassemble code for the given symbol > > ```python > func = binary.find_demangled_function("int __cdecl my_function(int, int)"); > insts = binary.disassemble("main"); > for inst in insts: > print(inst) > ``` > > > **See also** > > > > [`lief.assembly.Instruction`]( "lief.assembly.Instruction") 2. `disassemble(self, function_name: str) -> Iterator[Optional[lief._lief.assembly.Instruction]]` > Disassemble code for the given symbol name > > ```python > insts = binary.disassemble("main"); > for inst in insts: > print(inst) > ``` > > > **See also** > > > > [`lief.assembly.Instruction`]( "lief.assembly.Instruction") #### [` disassemble_from_bytes `]() disassemble\_from\_bytes(*self*, *buffer: bytes*, *address: int = 0*) → Iterator[[lief.\_lief.assembly.Instruction]( "lief._lief.assembly.Instruction") | None] Disassemble code from the provided bytes ```python raw = bytes(binary.get_section(".text").content) insts = binary.disassemble_from_bytes(raw); for inst in insts: print(inst) ``` > **See also** > > [`lief.assembly.Instruction`]( "lief.assembly.Instruction") #### [` find_demangled_function `]() find\_demangled\_function(*self*, *name: str*) → [lief.\_lief.COFF.Symbol]( "lief._lief.COFF.Symbol") | None Try to find the function (symbol) with the given **demangled** name #### [` find_function `]() find\_function(*self*, *name: str*) → [lief.\_lief.COFF.Symbol]( "lief._lief.COFF.Symbol") | None Try to find the function (symbol) with the given name #### [` find_string `]() find\_string(*self*, *offset: int*) → [lief.\_lief.COFF.String]( "lief._lief.COFF.String") | None Try to find the COFF string at the given offset in the COFF string table. > **Warning** > > This offset must include the first 4 bytes holding the size of the table. Hence, the first string starts a the offset 4. #### [` functions `]() property functions → lief.COFF.Binary.it\_functions Iterator over the functions implemented in this COFF #### [` get_section `]() get\_section(*self*, *name: str*) → [lief.\_lief.COFF.Section]( "lief._lief.COFF.Section") | None Return the [`Section`]( "lief.COFF.Section") matching the given name. Section names that do not fit in the 8 bytes allocated by the COFF format are stored in the COFF string table while the section itself only holds a `/` placeholder. This function transparently resolves both forms, so a long name can be looked up with its **regular** value: ```python sec = binary.get_section(".debug_rnglists") sec.name # '/18' sec.coff_string.string # '.debug_rnglists' ``` #### [` header `]() property header → [lief.COFF.Header]( "lief.COFF.Header") The COFF header #### [` relocations `]() property relocations → lief.COFF.Binary.it\_relocations Iterator over **all** the relocations used by this COFF binary #### [` sections `]() property sections → lief.COFF.Binary.it\_section Iterator over the different sections located in this COFF binary #### [` string_table `]() property string\_table → lief.PE.Binary.it\_strings\_table Iterator over the COFF’s strings #### [` symbols `]() property symbols → lief.PE.Binary.it\_symbols Iterator over the COFF’s symbols --- ## [Header]() ![Inheritance diagram of lief._lief.COFF.RegularHeader, lief._lief.COFF.BigObjHeader, lief._lief.COFF.Header](https://lief.re/doc/latest/_images/inheritance-bcc7c9a46cad46f6f918721633e6ebeeafe05264.png) ### [` lief.COFF.Header `]() class lief.COFF.Header Bases: `object` Class that represents the COFF header. It is subclassed by [`RegularHeader`]( "lief.COFF.RegularHeader") and [`BigObjHeader`]( "lief.COFF.BigObjHeader") for normal vs `/bigobj` files #### [` KIND `]() class KIND(*\*values*) Bases: `Enum` ##### [` BIGOBJ `]() BIGOBJ = 2 ##### [` REGULAR `]() REGULAR = 1 ##### [` UNKNOWN `]() UNKNOWN = 0 #### [` copy `]() copy(*self*) → [lief.\_lief.COFF.Header]( "lief._lief.COFF.Header") | None Duplicate the current instance of this object #### [` kind `]() property kind → [lief.COFF.Header.KIND]( "lief.COFF.Header.KIND") The type of this header: whether it is regular or using the `/bigobj` format #### [` machine `]() property machine → [lief.PE.Header.MACHINE\_TYPES]( "lief.PE.Header.MACHINE_TYPES") The machine type targeted by this COFF #### [` nb_sections `]() property nb\_sections → int The number of sections #### [` nb_symbols `]() property nb\_symbols → int Number of symbols (including auxiliary symbols) #### [` pointerto_symbol_table `]() property pointerto\_symbol\_table → int Offset of the symbols table #### [` timedatestamp `]() property timedatestamp → int Timestamp when the COFF has been generated --- ## [RegularHeader]() ![Inheritance diagram of lief._lief.COFF.RegularHeader](https://lief.re/doc/latest/_images/inheritance-efbbeab203b9492525f3a5698a1ab46c30433e4e.png) ### [` lief.COFF.RegularHeader `]() class lief.COFF.RegularHeader Bases: [`Header`]( "lief._lief.COFF.Header") This class represents the COFF header for non-bigobj #### [` characteristics `]() property characteristics → int Characteristics #### [` sizeof_optionalheader `]() property sizeof\_optionalheader → int The size of the optional header that follows this header (should be 0) --- ## [BigObjHeader]() ![Inheritance diagram of lief._lief.COFF.BigObjHeader](https://lief.re/doc/latest/_images/inheritance-9504af83e30cea430ca4ca7378a35e6ad7910fc0.png) ### [` lief.COFF.BigObjHeader `]() class lief.COFF.BigObjHeader Bases: [`Header`]( "lief._lief.COFF.Header") This class represents the header for a COFF object compiled with `/bigobj` support (i.e. the number of sections can exceed 65536). The raw definition of the bigobj header is located in `winnt.h` and named `ANON_OBJECT_HEADER_BIGOBJ` #### [` flags `]() property flags → int 1 means that it contains metadata #### [` metadata_offset `]() property metadata\_offset → int Offset of CLR metadata #### [` metadata_size `]() property metadata\_size → int Size of CLR metadata #### [` sizeof_data `]() property sizeof\_data → int Size of data that follows the header #### [` uuid `]() property uuid → memoryview Originally named `ClassID`, this uuid should match: `{D1BAA1C7-BAEE-4ba9-AF20-FAF66AA4DCB8}`. #### [` version `]() property version → int The version of this header which must be >= 2 --- ## [Section]() ### [` lief.COFF.Section `]() class lief.COFF.Section Bases: [`Section`]( "lief._lief.Section") This class represents a COFF section #### [` ComdatInfo `]() class ComdatInfo Bases: `object` This class wraps comdat information which is composed of the symbol associated with the comdat section and its selection flag ##### [` kind `]() property kind → [lief.COFF.AuxiliarySectionDefinition.COMDAT\_SELECTION]( "lief.COFF.AuxiliarySectionDefinition.COMDAT_SELECTION") ##### [` symbol `]() property symbol → [lief.COFF.Symbol]( "lief.COFF.Symbol") #### [` characteristics `]() property characteristics → int The characteristics that describe the purpose of the section #### [` characteristics_lists `]() property characteristics\_lists → list[[lief.PE.Section.CHARACTERISTICS]( "lief.PE.Section.CHARACTERISTICS")] characteristics as a `list` #### [` coff_string `]() property coff\_string → [lief.COFF.String]( "lief.COFF.String") | None Return the COFF string associated with the section’s name (or None) This coff string is usually present for long section names whose length does not fit in the 8 bytes allocated by the COFF format. #### [` comdat_info `]() property comdat\_info → [lief.COFF.Section.ComdatInfo]( "lief.COFF.Section.ComdatInfo") | None Return comdat information (only if the section has the [`lief.PE.Section.CHARACTERISTICS.LNK_COMDAT`]( "lief.PE.Section.CHARACTERISTICS.LNK_COMDAT") characteristic) #### [` has_characteristic `]() has\_characteristic(*self*, *characteristic: [lief.\_lief.PE.Section.CHARACTERISTICS]( "lief._lief.PE.Section.CHARACTERISTICS")*) → bool `True` if the section has the given characteristic #### [` has_extended_relocations `]() property has\_extended\_relocations → bool Whether there is a large number of relocations whose number need to be stored in the virtual address attribute #### [` is_discardable `]() property is\_discardable → bool True if the section can be discarded as needed. This is typically the case for debug-related sections. #### [` numberof_line_numbers `]() property numberof\_line\_numbers → int The number of line-number entries for the section. This value should be zero for an image because COFF debugging information is deprecated. See: [`pointerto_line_numbers`]( "lief.COFF.Section.pointerto_line_numbers") #### [` numberof_relocations `]() property numberof\_relocations → int Number of relocations. > **Warning** > > If the number of relocations is greater than 0xFFFF (maximum value for 16-bits integer), then the number of relocations is stored in the virtual address attribute. #### [` pointerto_line_numbers `]() property pointerto\_line\_numbers → int The file pointer to the beginning of line-number entries for the section. This is set to zero if there are no COFF line numbers. This value should be zero for an image because COFF debugging information is deprecated and modern debug information relies on the PDB files. #### [` pointerto_raw_data `]() property pointerto\_raw\_data → int Offset to the section’s content #### [` pointerto_relocation `]() property pointerto\_relocation → int Offset to the relocation table #### [` relocations `]() property relocations → lief.COFF.Section.it\_relocations Iterator over the relocations performed in this section #### [` sizeof_raw_data `]() property sizeof\_raw\_data → int Return the size of the data in the section. #### [` symbols `]() property symbols → lief.COFF.Section.it\_symbols Iterator over the symbols associated with this section #### [` virtual_size `]() property virtual\_size → int Virtual size of the section (should be 0) --- ## [Relocation]() ### [` lief.COFF.Relocation `]() class lief.COFF.Relocation Bases: [`Relocation`]( "lief._lief.Relocation") #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` ##### [` AMD64_ABSOLUTE `]() AMD64\_ABSOLUTE = 262144 ##### [` AMD64_ADDR32 `]() AMD64\_ADDR32 = 262146 ##### [` AMD64_ADDR32NB `]() AMD64\_ADDR32NB = 262147 ##### [` AMD64_ADDR64 `]() AMD64\_ADDR64 = 262145 ##### [` AMD64_PAIR `]() AMD64\_PAIR = 262159 ##### [` AMD64_REL32 `]() AMD64\_REL32 = 262148 ##### [` AMD64_REL32_1 `]() AMD64\_REL32\_1 = 262149 ##### [` AMD64_REL32_2 `]() AMD64\_REL32\_2 = 262150 ##### [` AMD64_REL32_3 `]() AMD64\_REL32\_3 = 262151 ##### [` AMD64_REL32_4 `]() AMD64\_REL32\_4 = 262152 ##### [` AMD64_REL32_5 `]() AMD64\_REL32\_5 = 262153 ##### [` AMD64_SECREL `]() AMD64\_SECREL = 262155 ##### [` AMD64_SECREL7 `]() AMD64\_SECREL7 = 262156 ##### [` AMD64_SECTION `]() AMD64\_SECTION = 262154 ##### [` AMD64_SREL32 `]() AMD64\_SREL32 = 262158 ##### [` AMD64_SSPAN32 `]() AMD64\_SSPAN32 = 262160 ##### [` AMD64_TOKEN `]() AMD64\_TOKEN = 262157 ##### [` ARM64_ABSOLUTE `]() ARM64\_ABSOLUTE = 1048576 ##### [` ARM64_ADDR32 `]() ARM64\_ADDR32 = 1048577 ##### [` ARM64_ADDR32NB `]() ARM64\_ADDR32NB = 1048578 ##### [` ARM64_ADDR64 `]() ARM64\_ADDR64 = 1048590 ##### [` ARM64_BRANCH14 `]() ARM64\_BRANCH14 = 1048592 ##### [` ARM64_BRANCH19 `]() ARM64\_BRANCH19 = 1048591 ##### [` ARM64_BRANCH26 `]() ARM64\_BRANCH26 = 1048579 ##### [` ARM64_PAGEBASE_REL21 `]() ARM64\_PAGEBASE\_REL21 = 1048580 ##### [` ARM64_PAGEOFFSET_12A `]() ARM64\_PAGEOFFSET\_12A = 1048582 ##### [` ARM64_PAGEOFFSET_12L `]() ARM64\_PAGEOFFSET\_12L = 1048583 ##### [` ARM64_REL21 `]() ARM64\_REL21 = 1048581 ##### [` ARM64_REL32 `]() ARM64\_REL32 = 1048593 ##### [` ARM64_SECREL `]() ARM64\_SECREL = 1048584 ##### [` ARM64_SECREL_HIGH12A `]() ARM64\_SECREL\_HIGH12A = 1048586 ##### [` ARM64_SECREL_LOW12A `]() ARM64\_SECREL\_LOW12A = 1048585 ##### [` ARM64_SECREL_LOW12L `]() ARM64\_SECREL\_LOW12L = 1048587 ##### [` ARM64_SECTION `]() ARM64\_SECTION = 1048589 ##### [` ARM64_TOKEN `]() ARM64\_TOKEN = 1048588 ##### [` ARM_ABSOLUTE `]() ARM\_ABSOLUTE = 524288 ##### [` ARM_ADDR32 `]() ARM\_ADDR32 = 524289 ##### [` ARM_ADDR32NB `]() ARM\_ADDR32NB = 524290 ##### [` ARM_BLX11 `]() ARM\_BLX11 = 524297 ##### [` ARM_BLX23T `]() ARM\_BLX23T = 524309 ##### [` ARM_BLX24 `]() ARM\_BLX24 = 524296 ##### [` ARM_BRANCH11 `]() ARM\_BRANCH11 = 524292 ##### [` ARM_BRANCH20T `]() ARM\_BRANCH20T = 524306 ##### [` ARM_BRANCH24 `]() ARM\_BRANCH24 = 524291 ##### [` ARM_BRANCH24T `]() ARM\_BRANCH24T = 524308 ##### [` ARM_MOV32A `]() ARM\_MOV32A = 524304 ##### [` ARM_MOV32T `]() ARM\_MOV32T = 524305 ##### [` ARM_PAIR `]() ARM\_PAIR = 524310 ##### [` ARM_REL32 `]() ARM\_REL32 = 524298 ##### [` ARM_SECREL `]() ARM\_SECREL = 524303 ##### [` ARM_SECTION `]() ARM\_SECTION = 524302 ##### [` ARM_TOKEN `]() ARM\_TOKEN = 524293 ##### [` I386_ABSOLUTE `]() I386\_ABSOLUTE = 131072 ##### [` I386_DIR16 `]() I386\_DIR16 = 131073 ##### [` I386_DIR32 `]() I386\_DIR32 = 131078 ##### [` I386_DIR32NB `]() I386\_DIR32NB = 131079 ##### [` I386_REL16 `]() I386\_REL16 = 131074 ##### [` I386_REL32 `]() I386\_REL32 = 131092 ##### [` I386_SECREL `]() I386\_SECREL = 131083 ##### [` I386_SECREL7 `]() I386\_SECREL7 = 131085 ##### [` I386_SECTION `]() I386\_SECTION = 131082 ##### [` I386_SEG12 `]() I386\_SEG12 = 131081 ##### [` I386_TOKEN `]() I386\_TOKEN = 131084 ##### [` MIPS_ABSOLUTE `]() MIPS\_ABSOLUTE = 2097152 ##### [` MIPS_GPREL `]() MIPS\_GPREL = 2097158 ##### [` MIPS_JMPADDR `]() MIPS\_JMPADDR = 2097155 ##### [` MIPS_JMPADDR16 `]() MIPS\_JMPADDR16 = 2097168 ##### [` MIPS_LITERAL `]() MIPS\_LITERAL = 2097159 ##### [` MIPS_PAIR `]() MIPS\_PAIR = 2097189 ##### [` MIPS_REFHALF `]() MIPS\_REFHALF = 2097153 ##### [` MIPS_REFHI `]() MIPS\_REFHI = 2097156 ##### [` MIPS_REFLO `]() MIPS\_REFLO = 2097157 ##### [` MIPS_REFWORD `]() MIPS\_REFWORD = 2097154 ##### [` MIPS_REFWORDNB `]() MIPS\_REFWORDNB = 2097186 ##### [` MIPS_SECREL `]() MIPS\_SECREL = 2097163 ##### [` MIPS_SECRELHI `]() MIPS\_SECRELHI = 2097165 ##### [` MIPS_SECRELLO `]() MIPS\_SECRELLO = 2097164 ##### [` MIPS_SECTION `]() MIPS\_SECTION = 2097162 ##### [` UNKNOWN `]() UNKNOWN = 4294967295 ##### [` from_value `]() from\_value(*arg: int*) → [lief.COFF.Relocation.TYPE]( "lief.COFF.Relocation.TYPE") = <nanobind.nb\_func object> #### [` section `]() property section → [lief.COFF.Section]( "lief.COFF.Section") | None Section in which the relocation takes place #### [` symbol `]() property symbol → [lief.COFF.Symbol]( "lief.COFF.Symbol") | None Symbol associated with the relocation (if any) #### [` symbol_idx `]() property symbol\_idx → int Symbol index associated with this relocation #### [` type `]() property type → [lief.COFF.Relocation.TYPE]( "lief.COFF.Relocation.TYPE") Type of the relocation --- ## [String]() ### [` lief.COFF.String `]() class lief.COFF.String Bases: `object` This class represents a string located in the COFF string table. Some of these strings can be used for section’s name where its length is greater than 8 bytes. See: [`coff_string`]( "lief.COFF.Section.coff_string"). Reference: [https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#coff-string-table]() #### [` offset `]() property offset → int The offset of this string the in the COFF string table. This offset includes the first 4-bytes that holds the table size #### [` string `]() property string → str The actual string --- ## [Symbol]() ![Inheritance diagram of lief._lief.COFF.Symbol](https://lief.re/doc/latest/_images/inheritance-9d6e46f60b50057c5307ec849919b9ff37e737a8.png) ### [` lief.COFF.Symbol `]() class lief.COFF.Symbol Bases: [`Symbol`]( "lief._lief.Symbol") Class that represents a COFF symbol. > **Warning** > > The [`lief.Symbol.value`]( "lief.Symbol.value") should be interpreted in perspective of the [`storage_class`]( "lief.COFF.Symbol.storage_class") Reference: [https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#coff-symbol-table]() #### [` BASE_TYPE `]() class BASE\_TYPE(*\*values*) Bases: `Enum` ##### [` BYTE `]() BYTE = 12 ##### [` CHAR `]() CHAR = 2 ##### [` DOUBLE `]() DOUBLE = 7 ##### [` DWORD `]() DWORD = 15 ##### [` ENUM `]() ENUM = 10 ##### [` FLOAT `]() FLOAT = 6 ##### [` INT `]() INT = 4 ##### [` LONG `]() LONG = 5 ##### [` MOE `]() MOE = 11 ##### [` NULL `]() NULL = 0 ##### [` SHORT `]() SHORT = 3 ##### [` STRUCT `]() STRUCT = 8 ##### [` UINT `]() UINT = 14 ##### [` UNION `]() UNION = 9 ##### [` VOID `]() VOID = 1 ##### [` WORD `]() WORD = 13 ##### [` from_value `]() from\_value(*arg: int*) → [lief.COFF.Symbol.BASE\_TYPE]( "lief.COFF.Symbol.BASE_TYPE") = <nanobind.nb\_func object> #### [` COMPLEX_TYPE `]() class COMPLEX\_TYPE(*\*values*) Bases: `Enum` ##### [` ARRAY `]() ARRAY = 3 ##### [` FUNCTION `]() FUNCTION = 2 ##### [` NULL `]() NULL = 0 ##### [` POINTER `]() POINTER = 1 ##### [` from_value `]() from\_value(*arg: int*) → [lief.COFF.Symbol.COMPLEX\_TYPE]( "lief.COFF.Symbol.COMPLEX_TYPE") = <nanobind.nb\_func object> #### [` STORAGE_CLASS `]() class STORAGE\_CLASS(*\*values*) Bases: `Enum` Reference: [https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#storage-class]() ##### [` ARGUMENT `]() ARGUMENT = 9 ##### [` AUTOMATIC `]() AUTOMATIC = 1 ##### [` BIT_FIELD `]() BIT\_FIELD = 18 ##### [` BLOCK `]() BLOCK = 100 ##### [` CLR_TOKEN `]() CLR\_TOKEN = 107 ##### [` END_OF_FUNCTION `]() END\_OF\_FUNCTION = -1 ##### [` END_OF_STRUCT `]() END\_OF\_STRUCT = 102 ##### [` ENUM_TAG `]() ENUM\_TAG = 15 ##### [` EXTERNAL `]() EXTERNAL = 2 ##### [` EXTERNAL_DEF `]() EXTERNAL\_DEF = 5 ##### [` FILE `]() FILE = 103 ##### [` FUNCTION `]() FUNCTION = 101 ##### [` LABEL `]() LABEL = 6 ##### [` MEMBER_OF_ENUM `]() MEMBER\_OF\_ENUM = 16 ##### [` MEMBER_OF_STRUCT `]() MEMBER\_OF\_STRUCT = 8 ##### [` MEMBER_OF_UNION `]() MEMBER\_OF\_UNION = 11 ##### [` NONE `]() NONE = 0 ##### [` REGISTER `]() REGISTER = 4 ##### [` REGISTER_PARAM `]() REGISTER\_PARAM = 17 ##### [` SECTION `]() SECTION = 104 ##### [` STATIC `]() STATIC = 3 ##### [` STRUCT_TAG `]() STRUCT\_TAG = 10 ##### [` TYPE_DEFINITION `]() TYPE\_DEFINITION = 13 ##### [` UNDEFINED_LABEL `]() UNDEFINED\_LABEL = 7 ##### [` UNDEFINED_STATIC `]() UNDEFINED\_STATIC = 14 ##### [` UNION_TAG `]() UNION\_TAG = 12 ##### [` WEAK_EXTERNAL `]() WEAK\_EXTERNAL = 105 ##### [` from_value `]() from\_value(*arg: int*) → [lief.COFF.Symbol.STORAGE\_CLASS]( "lief.COFF.Symbol.STORAGE_CLASS") = <nanobind.nb\_func object> #### [` auxiliary_symbols `]() property auxiliary\_symbols → lief.COFF.Symbol.it\_auxiliary\_symbols\_t Auxiliary symbols associated with this symbol. #### [` base_type `]() property base\_type → [lief.COFF.Symbol.BASE\_TYPE]( "lief.COFF.Symbol.BASE_TYPE") The simple (base) data type #### [` coff_name `]() property coff\_name → [lief.COFF.String]( "lief.COFF.String") | None COFF string used to represents the (long) symbol name #### [` complex_type `]() property complex\_type → [lief.COFF.Symbol.COMPLEX\_TYPE]( "lief.COFF.Symbol.COMPLEX_TYPE") The complex type (if any) #### [` demangled_name `]() property demangled\_name → str Demangled representation of the symbol or an empty string if it can’t be demangled #### [` is_absolute `]() property is\_absolute → bool #### [` is_external `]() property is\_external → bool #### [` is_file_record `]() property is\_file\_record → bool #### [` is_function `]() property is\_function → bool #### [` is_function_line_info `]() property is\_function\_line\_info → bool #### [` is_undefined `]() property is\_undefined → bool #### [` is_weak_external `]() property is\_weak\_external → bool #### [` section `]() property section → [lief.COFF.Section]( "lief.COFF.Section") | None Section associated with this symbol (if any) #### [` section_idx `]() property section\_idx → int The signed integer that identifies the section, using a one-based index into the section table. Some values have special meaning: - **0: The symbol record is not yet assigned a section. A value of zero** indicates that a reference to an external symbol is defined elsewhere. A value of non-zero is a common symbol with a size that is specified by the value. - **-1: The symbol has an absolute (non-relocatable) value and is not an** address. - **-2: The symbol provides general type or debugging information but does** not correspond to a section. Microsoft tools use this setting along with `.file` records #### [` storage_class `]() property storage\_class → [lief.COFF.Symbol.STORAGE\_CLASS]( "lief.COFF.Symbol.STORAGE_CLASS") Storage class of the symbol which indicates what kind of definition a symbol represents. #### [` type `]() property type → int The symbol type. The first byte represents the base type (see: [`base_type`]( "lief.COFF.Symbol.base_type")) while the upper byte represents the complex type, if any (see: [`complex_type`]( "lief.COFF.Symbol.complex_type")). --- ## [AuxiliarySymbol]() ![Inheritance diagram of lief._lief.COFF.AuxiliaryFunctionDefinition, lief._lief.COFF.AuxiliarySectionDefinition, lief._lief.COFF.AuxiliaryWeakExternal, lief._lief.COFF.AuxiliarySymbol, lief._lief.COFF.AuxiliaryCLRToken, lief._lief.COFF.AuxiliaryFile, lief._lief.COFF.AuxiliarybfAndefSymbol](https://lief.re/doc/latest/_images/inheritance-ae6ddf56b3107b0b66ff879432aaaee072c6176e.png) ### [` lief.COFF.AuxiliarySymbol `]() class lief.COFF.AuxiliarySymbol Bases: `object` Class that represents an auxiliary symbol. An auxiliary symbol has the same size as a regular `lief.PE.Symbol` (18 bytes) but its content depends on the parent symbol. #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` Type discriminator for the subclasses ##### [` BF_AND_EF `]() BF\_AND\_EF = 3 ##### [` CLR_TOKEN `]() CLR\_TOKEN = 1 ##### [` FILE `]() FILE = 5 ##### [` FUNC_DEF `]() FUNC\_DEF = 2 ##### [` SEC_DEF `]() SEC\_DEF = 6 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` WEAK_EXTERNAL `]() WEAK\_EXTERNAL = 4 ##### [` from_value `]() from\_value(*arg: int*) → [lief.COFF.AuxiliarySymbol.TYPE]( "lief.COFF.AuxiliarySymbol.TYPE") = <nanobind.nb\_func object> #### [` copy `]() copy(*self*) → [lief.\_lief.COFF.AuxiliarySymbol]( "lief._lief.COFF.AuxiliarySymbol") | None Duplicate the current instance of this object #### [` payload `]() property payload → memoryview For unknown type **only**, return the raw representation of this symbol #### [` type `]() property type → [lief.COFF.AuxiliarySymbol.TYPE]( "lief.COFF.AuxiliarySymbol.TYPE") --- ## [AuxiliaryCLRToken]() ![Inheritance diagram of lief._lief.COFF.AuxiliaryCLRToken](https://lief.re/doc/latest/_images/inheritance-79a9cfc9c89e3e02ed132fc4fe0455073bba85e6.png) ### [` lief.COFF.AuxiliaryCLRToken `]() class lief.COFF.AuxiliaryCLRToken Bases: [`AuxiliarySymbol`]( "lief._lief.COFF.AuxiliarySymbol") Auxiliary symbol associated with the `CLR_TOKEN` storage class #### [` aux_type `]() property aux\_type → int `IMAGE_AUX_SYMBOL_TYPE` which should be `IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF` (1) #### [` reserved `]() property reserved → int Reserved value (should be 0) #### [` rgb_reserved `]() property rgb\_reserved → memoryview Reserved (padding) values. Should be 0 #### [` symbol `]() property symbol → [lief.COFF.Symbol]( "lief.COFF.Symbol") | None Symbol referenced by [`symbol_idx`]( "lief.COFF.AuxiliaryCLRToken.symbol_idx") (if resolved) #### [` symbol_idx `]() property symbol\_idx → int Index in the symbol table --- ## [AuxiliaryFunctionDefinition]() ![Inheritance diagram of lief._lief.COFF.AuxiliaryFunctionDefinition](https://lief.re/doc/latest/_images/inheritance-4f13b18f2f4088db5189525dd98410c14c698e70.png) ### [` lief.COFF.AuxiliaryFunctionDefinition `]() class lief.COFF.AuxiliaryFunctionDefinition Bases: [`AuxiliarySymbol`]( "lief._lief.COFF.AuxiliarySymbol") This auxiliary symbol marks the beginning of a function definition. Reference: [https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#auxiliary-format-1-function-definitions]() #### [` padding `]() property padding → int Padding value (should be 0) #### [` ptr_to_line_number `]() property ptr\_to\_line\_number → int The file offset of the first COFF line-number entry for the function, or zero if none exists (deprecated) #### [` ptr_to_next_func `]() property ptr\_to\_next\_func → int The symbol-table index of the record for the next function. If the function is the last in the symbol table, this field is set to zero #### [` tag_index `]() property tag\_index → int The symbol-table index of the corresponding `.bf` (begin function) symbol record. #### [` total_size `]() property total\_size → int The size of the executable code for the function itself. If the function is in its own section, the `SizeOfRawData` in the section header is greater or equal to this field, depending on alignment considerations --- ## [AuxiliaryWeakExternal]() ![Inheritance diagram of lief._lief.COFF.AuxiliaryWeakExternal](https://lief.re/doc/latest/_images/inheritance-1e262467ebc197517ae14329cfad93486ed89018.png) ### [` lief.COFF.AuxiliaryWeakExternal `]() class lief.COFF.AuxiliaryWeakExternal Bases: [`AuxiliarySymbol`]( "lief._lief.COFF.AuxiliarySymbol") “Weak externals” are a mechanism for object files that allows flexibility at link time. A module can contain an unresolved external symbol (`sym1`), but it can also include an auxiliary record that indicates that if `sym1` is not present at link time, another external symbol (`sym2`) is used to resolve references instead. If a definition of `sym1` is linked, then an external reference to the symbol is resolved normally. If a definition of `sym1` is not linked, then all references to the weak external for `sym1` refer to `sym2` instead. The external symbol, `sym2`, must always be linked; typically, it is defined in the module that contains the weak reference to `sym1`. Reference: [https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#auxiliary-format-3-weak-externals]() #### [` CHARACTERISTICS `]() class CHARACTERISTICS(*\*values*) Bases: `Enum` ##### [` ANTI_DEPENDENCY `]() ANTI\_DEPENDENCY = 4 ##### [` SEARCH_ALIAS `]() SEARCH\_ALIAS = 3 ##### [` SEARCH_LIBRARY `]() SEARCH\_LIBRARY = 2 ##### [` SEARCH_NOLIBRARY `]() SEARCH\_NOLIBRARY = 1 #### [` characteristics `]() property characteristics → [lief.COFF.AuxiliaryWeakExternal.CHARACTERISTICS]( "lief.COFF.AuxiliaryWeakExternal.CHARACTERISTICS") #### [` padding `]() property padding → memoryview #### [` sym_idx `]() property sym\_idx → int The symbol-table index of sym2, the symbol to be linked if `sym1` is not found. --- ## [AuxiliarybfAndefSymbol]() ![Inheritance diagram of lief._lief.COFF.AuxiliarybfAndefSymbol](https://lief.re/doc/latest/_images/inheritance-02d299e259eec33163ad7d484ccd5b4974128ebd.png) ### [` lief.COFF.AuxiliarybfAndefSymbol `]() class lief.COFF.AuxiliarybfAndefSymbol Bases: [`AuxiliarySymbol`]( "lief._lief.COFF.AuxiliarySymbol") --- ## [AuxiliarySectionDefinition]() ![Inheritance diagram of lief._lief.COFF.AuxiliarySectionDefinition](https://lief.re/doc/latest/_images/inheritance-d628fe9cece3a9e4d30978150d56af8fc6bb8d58.png) ### [` lief.COFF.AuxiliarySectionDefinition `]() class lief.COFF.AuxiliarySectionDefinition Bases: [`AuxiliarySymbol`]( "lief._lief.COFF.AuxiliarySymbol") This auxiliary symbol exposes information about the associated section. It **duplicates** some information that are provided in the section header #### [` COMDAT_SELECTION `]() class COMDAT\_SELECTION(*\*values*) Bases: `Enum` Values for the AuxiliarySectionDefinition::selection attribute See: [https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#comdat-sections-object-only]() ##### [` ANY `]() ANY = 2 ##### [` ASSOCIATIVE `]() ASSOCIATIVE = 5 ##### [` EXACT_MATCH `]() EXACT\_MATCH = 4 ##### [` LARGEST `]() LARGEST = 6 ##### [` NODUPLICATES `]() NODUPLICATES = 1 ##### [` NONE `]() NONE = 0 ##### [` SAME_SIZE `]() SAME\_SIZE = 3 #### [` checksum `]() property checksum → int The checksum for communal data. It is applicable if the `IMAGE_SCN_LNK_COMDAT` flag is set in the section header. #### [` length `]() property length → int The size of section data. The same as `SizeOfRawData` in the section header. #### [` nb_line_numbers `]() property nb\_line\_numbers → int The number of line-number entries for the section. #### [` nb_relocs `]() property nb\_relocs → int The number of relocation entries for the section. #### [` reserved `]() property reserved → int Reserved value (should be 0) #### [` section_idx `]() property section\_idx → int One-based index into the section table for the associated section. This is used when the COMDAT selection setting is 5. #### [` selection `]() property selection → [lief.COFF.AuxiliarySectionDefinition.COMDAT\_SELECTION]( "lief.COFF.AuxiliarySectionDefinition.COMDAT_SELECTION") The COMDAT selection number. This is applicable if the section is a COMDAT section. --- ## [AuxiliaryFile]() ![Inheritance diagram of lief._lief.COFF.AuxiliaryFile](https://lief.re/doc/latest/_images/inheritance-b0e9cc4ccf4c91f256bb4605d707ac99bd9e14d6.png) ### [` lief.COFF.AuxiliaryFile `]() class lief.COFF.AuxiliaryFile Bases: [`AuxiliarySymbol`]( "lief._lief.COFF.AuxiliarySymbol") This auxiliary symbol represents a filename (auxiliary format 4) The [`lief.Symbol.name`]( "lief.Symbol.name") itself should start with `.file`, and this auxiliary record gives the name of a source-code file. Reference: [https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#auxiliary-format-4-files]() #### [` filename `]() property filename → str The associated filename ## [Utilities]() ### [` lief.is_coff `]() lief.is\_coff(*file: str | os.PathLike*) → bool Check if the given file is a COFF