http://www.linker-aliens.org/blogs/ali/entry/gnu_hash_elf_sections/
https://docs.oracle.com/cd/E23824_01/html/819-0690/chapter6-48031.html
- property buckets → list[int]
Buckets values
- property chains → list[int]
Chains values
- property nbucket → int
Return the number of buckets
- property nchain → int
Return the number of chains (symbol table index)
Note
- class lief.ELF.Note
Bases: Object
Class which represents an ELF note.
- class TYPE(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)
Bases: Enum
LIEF representation of the ELF NT_ values.
- ANDROID_IDENT = 38
- ANDROID_KUSER = 40
- ANDROID_MEMTAG = 39
- CORE_ARM_HW_BREAK = 25
- CORE_ARM_HW_WATCH = 26
- CORE_ARM_PACA_KEYS = 30
- CORE_ARM_PACG_KEYS = 31
- CORE_ARM_PAC_MASK = 29
- CORE_ARM_SVE = 28
- CORE_ARM_SYSTEM_CALL = 27
- CORE_ARM_TLS = 24
- CORE_ARM_VFP = 23
- CORE_AUXV = 13
- CORE_FILE = 20
- CORE_FPREGS = 15
- CORE_FPREGSET = 10
- CORE_LWPSINFO = 18
- CORE_LWPSTATUS = 17
- CORE_PAC_ENABLED_KEYS = 33
- CORE_PRPSINFO = 11
- CORE_PRSTATUS = 9
- CORE_PRXFPREG = 21
- CORE_PSINFO = 16
- CORE_PSTATUS = 14
- CORE_SIGINFO = 22
- CORE_TAGGED_ADDR_CTRL = 32
- CORE_TASKSTRUCT = 12
- CORE_WIN32PSTATUS = 19
- CORE_X86_CET = 37
- CORE_X86_IOPERM = 35
- CORE_X86_TLS = 34
- CORE_X86_XSTATE = 36
- CRASHPAD = 8
- GNU_ABI_TAG = 1
- GNU_BUILD_ATTRIBUTE_FUNC = 7
- GNU_BUILD_ATTRIBUTE_OPEN = 6
- GNU_BUILD_ID = 3
- GNU_GOLD_VERSION = 4
- GNU_HWCAP = 2
- GNU_PROPERTY_TYPE_0 = 5
- GO_BUILDID = 41
- QNX_STACK = 43
- STAPSDT = 42
- UNKNOWN = 0
- from_value(arg: int) → lief.ELF.Note.TYPE = <nanobind.nb_func object>
- copy(self) → lief.ELF.Note | None
Duplicate the current instance of this object
- create(*args) → lief.ELF.Note | None = <nanobind.nb_func object>
- property description → memoryview
Return the description associated with the note
- property name → str
Return the name of the note also known as the owner.
- property original_type → int
Return the original NT_ value of the note.
This value should be interpreted according the name
of the note.
- property size → int
Size of the raw note
- property type → lief.ELF.Note.TYPE
Return the LIEF type representation of the note.
Core PrPsInfo
- class lief.ELF.CorePrPsInfo
Bases: Note
- property info → lief.ELF.CorePrPsInfo.info_t | None
- class info_t
Bases: object
- property args → str
- property args_stripped → str
- property filename → str
- property filename_stripped → str
- property flag → int
- property gid → int
- property nice → int
- property pgrp → int
- property pid → int
- property ppid → int
- property sid → int
- property sname → str
- property state → int
- property uid → int
- property zombie → bool
Core PrStatus
- class lief.ELF.CorePrStatus
Bases: Note
- class Registers
Bases: object
- class AARCH64(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)
Bases: Enum
Registers for the AARCH64 architecture (AARCH64
)
- PC = 32
- PSTATE = 33
- X0 = 0
- X1 = 1
- X10 = 10
- X11 = 11
- X12 = 12
- X13 = 13
- X14 = 14
- X15 = 15
- X16 = 16
- X17 = 17
- X18 = 18
- X19 = 19
- X2 = 2
- X20 = 20
- X21 = 21
- X22 = 22
- X23 = 23
- X24 = 24
- X25 = 25
- X26 = 26
- X27 = 27
- X28 = 28
- X29 = 29
- X3 = 3
- X30 = 30
- X31 = 31
- X4 = 4
- X5 = 5
- X6 = 6
- X7 = 7
- X8 = 8
- X9 = 9
- from_value(arg: int) → lief.ELF.CorePrStatus.Registers.AARCH64 = <nanobind.nb_func object>
- class ARM(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)
Bases: Enum
Registers for the ARM architecture (ARM
)
- CPSR = 16
- R0 = 0
- R1 = 1
- R10 = 10
- R11 = 11
- R12 = 12
- R13 = 13
- R14 = 14
- R15 = 15
- R2 = 2
- R3 = 3
- R4 = 4
- R5 = 5
- R6 = 6
- R7 = 7
- R8 = 8
- R9 = 9
- from_value(arg: int) → lief.ELF.CorePrStatus.Registers.ARM = <nanobind.nb_func object>
- class X86(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)
Bases: Enum
Registers for the x86 architecture (i386
)
- CS = 13
- DS = 7
- EAX = 6
- EBP = 5
- EBX = 0
- ECX = 1
- EDI = 4
- EDX = 2
- EFLAGS = 14
- EIP = 12
- ES = 8
- ESI = 3
- ESP = 15
- FS = 9
- GS = 10
- ORIG_EAX = 11
- SS = 16
- from_value(arg: int) → lief.ELF.CorePrStatus.Registers.X86 = <nanobind.nb_func object>
- class X86_64(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)
Bases: Enum
Registers for the x86-64 architecture (x86_64
)
- CS = 17
- EFLAGS = 18
- ORIG_RAX = 15
- R10 = 7
- R11 = 6
- R12 = 3
- R13 = 2
- R14 = 1
- R15 = 0
- R8 = 9
- R9 = 8
- RAX = 10
- RBP = 4
- RBX = 5
- RCX = 11
- RDI = 14
- RDX = 12
- RIP = 16
- RSI = 13
- RSP = 19
- SS = 20
- from_value(arg: int) → lief.ELF.CorePrStatus.Registers.X86_64 = <nanobind.nb_func object>
- property architecture → lief.ELF.ARCH
Original target architecture.
- get(*args) → int | None
Get the register value or non if it is not present
- property pc → int | None
Return the program counter value (rip, pc, eip etc)
- class pr_status_t
Bases: object
- property cstime → lief.ELF.CorePrStatus.timeval_t
- property cursig → int
- property cutime → lief.ELF.CorePrStatus.timeval_t
- property info → lief.ELF.CorePrStatus.siginfo_t
- property pgrp → int
- property pid → int
- property ppid → int
- property reserved → int
- property sid → int
- property sighold → int
- property sigpend → int
- property stime → lief.ELF.CorePrStatus.timeval_t
- property utime → lief.ELF.CorePrStatus.timeval_t
- property register_values → list[int]
List of the register values. This list is guarantee to be as long as the number of registers defined in the Registers
or empty if it can’t be resolved.
Thus, one can access a specific register through:
reg_vals: list[int] = note.register_values()
x20 = reg_vals[CorePrStatus.Registesr.AARCH64.X20.value]
- property return_value → int | None
The value of the register that holds the return value according to the calling convention.
- set(*args) → lief.ok_error_t
Change the register value
- class siginfo_t
Bases: object
- property errno → int
- property sicode → int
- property signo → int
- property sp → int | None
Return the stack pointer value
- property status → lief.ELF.CorePrStatus.pr_status_t
Info associated with the signal
- class timeval_t
Bases: object
- property sec → int
- property usec → int
Core File
- class lief.ELF.CoreFile
Bases: Note
- class entry_t
Bases: object
- property end → int
End address of mapped file
- property file_ofs → int
Offset (in core) of mapped file
- property path → str
Path of mapped file
- property start → int
Start address of mapped file
- property files → lief.ELF.CoreFile.files_t
List of files mapped in core. (list of CoreFileEntry
)
- class files_t(self)
- class files_t(self, arg: lief._lief.ELF.CoreFile.files_t)
- class files_t(self, arg: collections.abc.Iterable[lief._lief.ELF.CoreFile.entry_t], /)
Bases: object
Overloaded function.
__init__(self) -> None
Default constructor
__init__(self, arg: lief._lief.ELF.CoreFile.files_t) -> None
Copy constructor
__init__(self, arg: collections.abc.Iterable[lief._lief.ELF.CoreFile.entry_t], /) -> None
Construct from an iterable object
- append(self, arg: lief.ELF.CoreFile.entry_t) → None
Append arg to the end of the list.
- clear(self) → None
Remove all items from list.
- extend(self, arg: lief.ELF.CoreFile.files_t) → None
Extend self by appending elements from arg.
- insert(self, arg0: int, arg1: lief.ELF.CoreFile.entry_t) → None
Insert object arg1 before index arg0.
- pop(self, index: int) → lief.ELF.CoreFile.entry_t
Remove and return item at index (default last).
Core Siginfo
- class lief.ELF.CoreSigInfo
Bases: Note
- property sigcode → int | None
Signal code
- property sigerrno → int | None
If non-zero, an errno value associated with this signal
- property signo → int | None
Signal number
Core Auxiliary Vector
- class lief.ELF.CoreAuxv
Bases: Note
- class TYPE(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)
Bases: Enum
- BASE = 7
- BASE_PLATFORM = 24
- CLKTCK = 17
- DCACHEBSIZE = 19
- EGID = 14
- END = 0
- ENTRY = 9
- EUID = 12
- EXECFD = 2
- EXECFN = 31
- FLAGS = 8
- FPUCW = 18
- GID = 13
- HWCAP = 16
- HWCAP2 = 26
- ICACHEBSIZE = 20
- IGNORE = 1
- IGNOREPPC = 22
- NOTELF = 10
- PAGESZ = 6
- PHDR = 3
- PHENT = 4
- PHNUM = 5
- RANDOM = 25
- SECURE = 23
- SYSINFO = 32
- SYSINFO_EHDR = 33
- TGT_PLATFORM = 15
- UCACHEBSIZE = 21
- UID = 11
- from_value(arg: int) → lief.ELF.CoreAuxv.TYPE = <nanobind.nb_func object>
- get(self, type: lief.ELF.CoreAuxv.TYPE) → int | None
Get the auxv value from the provided type. Return None if it is not present.
- set(*args) → bool
Overloaded function.
set(self, type: lief._lief.ELF.CoreAuxv.TYPE, value: int) -> bool
Change the value for the given type.
set(self, arg: collections.abc.Mapping[lief._lief.ELF.CoreAuxv.TYPE, int], /) -> bool
Replace all the values by the given dictionary.
- property values → dict[lief.ELF.CoreAuxv.TYPE, int]
Return the auxiliary vector as a dictionary of TYPE
/ int
Android Ident
- class lief.ELF.AndroidIdent
Bases: Note
- property ndk_build_number → str
Android NDK build number
- property ndk_version → str
Android NDK version used to build the current binary
- property sdk_version → int
Target SDK platform
QNX Stack
- class lief.ELF.QNXStack
Bases: Note
- property is_executable → bool
Whether the stack is executable
- property stack_allocated → int
Size of the stack pre-allocated (upfront)
- property stack_size → int
Size of the stack
Note ABI
- class lief.ELF.NoteAbi
Bases: Note
Class that wraps the NT_GNU_ABI_TAG note
- class ABI(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)
Bases: Enum
ABI recognized by this note
- FREEBSD = 3
- GNU = 1
- LINUX = 0
- NACL = 6
- NETBSD = 4
- SOLARIS2 = 2
- SYLLABLE = 5
- from_value(arg: int) → lief.ELF.NoteAbi.ABI = <nanobind.nb_func object>
- property abi → lief.ELF.NoteAbi.ABI | None
Return the target ABI
- property version → list[int] | None
Return the target version as (Major, Minor, Patch)
Note Gnu Property
- class lief.ELF.NoteGnuProperty
Bases: Note
This object represents the NT_GNU_PROPERTY_TYPE_0 note.
- class Property
Bases: object
This class wraps the different properties that can be used in a NT_