Python

Parser

lief.MachO.parse(*args) lief.MachO.FatBinary | None
lief.MachO.parse(raw: list[int], config: lief._lief.MachO.ParserConfig = <lief._lief.MachO.ParserConfig object at 0x7f608a996fb0>) lief._lief.MachO.FatBinary | None
lief.MachO.parse(obj: Union[io.IOBase | os.PathLike], config: lief._lief.MachO.ParserConfig = <lief._lief.MachO.ParserConfig object at 0x7f608a996ff0>) lief._lief.MachO.FatBinary | None

Overloaded function.

  1. parse(filename: str, config: lief._lief.MachO.ParserConfig = <lief._lief.MachO.ParserConfig object at 0x7f608a996f90>) -> Optional[lief._lief.MachO.FatBinary]

    Parse the given binary and return a FatBinary object

    One can configure the parsing with the config parameter. See ParserConfig,

  2. parse(raw: list[int], config: lief._lief.MachO.ParserConfig = <lief._lief.MachO.ParserConfig object at 0x7f608a996fb0>) -> Optional[lief._lief.MachO.FatBinary]

    Parse the given binary (from raw bytes) and return a FatBinary object

    One can configure the parsing with the config parameter. See ParserConfig

  3. parse(obj: Union[io.IOBase | os.PathLike], config: lief._lief.MachO.ParserConfig = <lief._lief.MachO.ParserConfig object at 0x7f608a996ff0>) -> Optional[lief._lief.MachO.FatBinary]

    Parse the given binary from the given input and return a FatBinary object

    One can configure the parser with the config parameter. See ParserConfig

class lief.MachO.ParserConfig(self)

Bases: object

This class is used to tweak the MachO Parser (Parser)

deep = <lief._lief.MachO.ParserConfig object>
property fix_from_memory bool

When parsing Mach-O from memory, this option can be used to undo relocations and symbols bindings.

When activated, this option requires parse_dyld_bindings and parse_dyld_rebases to be enabled.

property from_dyld_shared_cache bool

Whether the binary is coming/extracted from Dyld shared cache

full_dyldinfo(self, flag: bool) lief.MachO.ParserConfig

If flag is set to true, Exports, Bindings and Rebases opcodes are parsed.

Warning

Enabling this flag can slow down the parsing

property parse_dyld_bindings bool

Parse the Dyld binding opcodes

property parse_dyld_exports bool

Parse the Dyld export trie

property parse_dyld_rebases bool

Parse the Dyld rebase opcodes

quick = <lief._lief.MachO.ParserConfig object>
fatbinary_1 = lief.MachO.parse("/usr/bin/ls", config=lief.MachO.ParserConfig.deep)
# or
fatbinary_2 = lief.MachO.parse("/usr/bin/ls", config=lief.MachO.ParserConfig.quick)

FatBinary

class lief.MachO.FatBinary

Bases: object

Class which represent a Mach-O (fat) binary This object is also used for representing Mach-O binaries that are NOT FAT

at(self, index: int) lief.MachO.Binary

Return the Binary at the given index or None if it is not present

class it_binaries

Bases: object

Iterator over lief._lief.MachO.Binary

raw(self) list[int]

Build a Mach-O universal binary and return its bytes

property size int

Number of Binary registred

take(self, cpu: lief.MachO.Header.CPU_TYPE) lief.MachO.Binary | None

Return the Binary that matches the given CPU_TYPE

write(self, filename: str) None

Build a Mach-O universal binary


Binary

class lief.MachO.Binary

Bases: Binary

Class which represents a MachO binary

add(*args) lief.MachO.LoadCommand

Overloaded function.

  1. add(self, dylib_command: lief._lief.MachO.DylibCommand) -> lief._lief.MachO.LoadCommand

Add a new DylibCommand

  1. add(self, segment: lief._lief.MachO.SegmentCommand) -> lief._lief.MachO.LoadCommand

Add a new SegmentCommand

  1. add(self, load_command: lief._lief.MachO.LoadCommand) -> lief._lief.MachO.LoadCommand

Add a new LoadCommand

  1. add(self, load_command: lief._lief.MachO.LoadCommand, index: int) -> lief._lief.MachO.LoadCommand

Add a new LoadCommand at index

add_exported_function(self, address: int, name: str) lief.MachO.ExportInfo

Add a new export in the binary

add_library(self, library_name: str) lief.MachO.LoadCommand

Add a new library dependency

add_local_symbol(self, address: int, name: str) lief.MachO.Symbol

Add a new a new symbol in the LC_SYMTAB

add_section(*args) lief.MachO.Section

Overloaded function.

  1. add_section(self, segment: lief._lief.MachO.SegmentCommand, section: lief._lief.MachO.Section) -> lief._lief.MachO.Section

Add a new Section in the given SegmentCommand

  1. add_section(self, section: lief._lief.MachO.Section) -> lief._lief.MachO.Section

Add a new Section within the __TEXT segment

property bindings Iterator[lief.MachO.BindingInfo]

Return an iterator over the binding info which can come from either DyldInfo or DyldChainedFixups commands.

property build_version lief.MachO.BuildVersion

Return the binary’s BuildVersion if any, or None

can_remove(self, symbol: lief.MachO.Symbol) bool

Check if the given symbol can be safely removed.

can_remove_symbol(self, symbol_name: str) bool

Check if the given symbol name can be safely removed.

property code_signature lief.MachO.CodeSignature

Return the binary’s CodeSignature if any, or None

property code_signature_dir lief.MachO.CodeSignatureDir

Return the binary’s CodeSignatureDir if any, or None

property commands lief.MachO.Binary.it_commands

Return an iterator over the binary’s Command

property data_in_code lief.MachO.DataInCode

Return the binary’s DataInCode if any, or None

property dyld_chained_fixups lief.MachO.DyldChainedFixups

Return the binary’s DyldChainedFixups if any, or None

property dyld_environment lief.MachO.DyldEnvironment

Return the binary’s DyldEnvironment if any, or None

property dyld_exports_trie lief.MachO.DyldExportsTrie

Return the binary’s DyldExportsTrie if any, or None

property dyld_info lief.MachO.DyldInfo

Return the binary’s DyldInfo if any, or None

property dylinker lief.MachO.DylinkerCommand

Return the binary’s DylinkerCommand if any, or None

property dynamic_symbol_command lief.MachO.DynamicSymbolCommand

Return the binary’s DynamicSymbolCommand if any, or None

property encryption_info lief.MachO.EncryptionInfo

Return the binary’s EncryptionInfo if any, or None

property exported_symbols lief.MachO.Binary.it_filter_symbols

Return the binary’s Symbol which are exported

extend(self, load_command: lief.MachO.LoadCommand, size: int) bool

Extend a LoadCommand by size

extend_segment(self, segment_command: lief.MachO.SegmentCommand, size: int) bool

Extend the content of the given SegmentCommand by size

property fat_offset int

Return binary’s fat offset. 0 if not relevant.

property fileset_name str

Name associated with the LC_FILESET_ENTRY binary

property filesets lief.MachO.FatBinary.it_binaries

Return binary’s Filesets

property function_starts lief.MachO.FunctionStarts

Return the binary’s FunctionStarts if any, or None

property functions list[lief.Function]

Return list of all Function found

get(self, type: lief.MachO.LoadCommand.TYPE) lief.MachO.LoadCommand

Return the first LoadCommand with the given TYPE or None if it is not present.

get_section(*args) lief.MachO.Section

Overloaded function.

  1. get_section(self, name: str) -> lief._lief.MachO.Section

Return the section from the given name or None if the section does not exist

  1. get_section(self, segname: str, secname: str) -> lief._lief.MachO.Section

    Return the section from the segment with the name given in the first parameter and with the section’s name provided in the second parameter. If the section cannot be found, it returns a nullptr

get_segment(self, name: str) lief.MachO.SegmentCommand

Return the SegmentCommand from the given name

get_symbol(self, name: str) lief.MachO.Symbol

Return the Symbol from the given name

has(self, type: lief.MachO.LoadCommand.TYPE) bool

Check if the current binary has a LoadCommand with the given TYPE

property has_build_version bool

True if the binary has a BuildVersion command

property has_code_signature bool

True if the binary is signed (i.e. has a CodeSignature command)

property has_code_signature_dir bool

True if the binary is signed (i.e. has a CodeSignatureDir command) with the command LC_DYLIB_CODE_SIGN_DRS

property has_data_in_code bool

True if the binary has a DataInCode command

property has_dyld_chained_fixups bool

True if the binary has a DyldChainedFixups command

property has_dyld_environment bool

True if the binary has a DyldEnvironment command

property has_dyld_exports_trie bool

True if the binary has a DyldExportsTrie command

property has_dyld_info bool

True if the binary has a DyldInfo command.

property has_dylinker bool

True if the binary has a DylinkerCommand command.

property has_dynamic_symbol_command bool

True if the binary has a DynamicSymbolCommand command.

property has_encryption_info bool

True if the binary has a EncryptionInfo command

property has_entrypoint bool

True if the binary has an entrypoint.

Basically for libraries it will return false

property has_filesets bool

Return True if the binary has filesets

property has_function_starts bool

True if the binary has a FunctionStarts command.

property has_linker_opt_hint bool

True if the binary embeds the Linker optimization hint command (LinkerOptHint)

property has_main_command bool

True if the binary has a MainCommand command.

property has_nx_heap bool

Return True if the heap is flagged as non-executable. False otherwise.

property has_nx_stack bool

Return True if the stack is flagged as non-executable. False otherwise.

property has_routine_command bool

True if the binary has a Routine command.

property has_rpath bool

True if the binary has a RPathCommand command.

has_section(self, name: str) bool

Check if a section with the given name exists

has_segment(self, name: str) bool

Check if a SegmentCommand with the given name exists

property has_segment_split_info bool

True if the binary has a SegmentSplitInfo command

property has_source_version bool

True if the binary has a SourceVersion command.

property has_sub_framework bool

True if the binary has a SubFramework command

property has_subclients bool

True if the binary has a SubClient command

has_symbol(self, name: str) bool

Check if a Symbol with the given name exists

property has_symbol_command bool

True if the binary has a SymbolCommand command.

property has_thread_command bool

True if the binary has a ThreadCommand command.

property has_two_level_hints bool

True if the binary embeds the Two Level Hint command (TwoLevelHints)

property has_uuid bool

True if the binary has a UUIDCommand command.

property has_version_min bool

True if the binary has a VersionMin command.

property header lief.MachO.Header

Return binary’s Header

property imagebase int

Return the binary’s imagebase which is the base address where segments are mapped (without the ASLR). 0 if not relevant.

property imported_symbols lief.MachO.Binary.it_filter_symbols

Return the binary’s Symbol which are imported

property is_ios bool

True if this binary targets iOS

property is_macos bool

True if this binary targets macOS

is_valid_addr(self, address: int) bool

Check if the given address is encompassed between the range of virtual addresses.

See: va_ranges

class it_commands

Bases: object

Iterator over lief._lief.MachO.LoadCommand

class it_filter_symbols

Bases: object

Iterator over lief._lief.MachO.Symbol

class it_libraries

Bases: object

Iterator over lief._lief.MachO.DylibCommand

class it_relocations

Bases: object

Iterator over lief._lief.MachO.Relocation

class it_rpaths

Bases: object

Iterator over lief._lief.MachO.RPathCommand

class it_sections

Bases: object

Iterator over lief._lief.MachO.Section

class it_segments

Bases: object

Iterator over lief._lief.MachO.SegmentCommand

class it_sub_clients

Bases: object

Iterator over lief._lief.MachO.SubClient

class it_symbols

Bases: object

Iterator over lief._lief.MachO.Symbol

property libraries lief.MachO.Binary.it_libraries

Return an iterator over the binary’s DylibCommand

property linker_opt_hint lief.MachO.LinkerOptHint

Return the binary’s LinkerOptHint if any, or None

property main_command lief.MachO.MainCommand

Return the binary’s MainCommand if any, or None

property objc_metadata lief.objc.Metadata | None

Return Objective-C metadata info if present

Warning

This is only available with the extended version of LIEF.

property off_ranges lief.MachO.Binary.range_t

Return the range of offsets as a tuple (off_start, off_end)

property overlay memoryview
property page_size int

Return the binary’s page size

property platform lief.MachO.BuildVersion.PLATFORMS

Return the platform for which this Mach-O has been compiled

class range_t

Bases: object

property end int
property start int
property relocations lief.MachO.Binary.it_relocations

Return an iterator over binary’s Relocation

remove(*args) bool

Overloaded function.

  1. remove(self, load_command: lief._lief.MachO.LoadCommand) -> bool

Remove a LoadCommand

  1. remove(self, type: lief._lief.MachO.LoadCommand.TYPE) -> bool

Remove all the LoadCommand with the given TYPE

  1. remove(self, symbol: lief._lief.MachO.Symbol) -> bool

Remove the given Symbol

remove_command(self, index: int) bool

Remove the LoadCommand at the given index

remove_section(*args) None

Overloaded function.

  1. remove_section(self, name: str, clear: bool = False) -> None

Remove the section with the given name

  1. remove_section(self, segname: str, secname: str, clear: bool = False) -> None

    Remove the section from the segment with the name given in the first parameter and with the section’s name provided in the second parameter.

remove_signature(self) bool

Remove the CodeSignature (if any)

remove_symbol(self, name: str) bool

Remove all symbol(s) with the given name

property routine_command lief.MachO.Routine

Return the binary’s Routine if any, or None

property rpath lief.MachO.RPathCommand

Return the binary’s RPathCommand if any, or None

property rpaths lief.MachO.Binary.it_rpaths

Return an iterator over the binary’s RPathCommand

section_from_offset(self, arg: int) lief.MachO.Section

Return the Section which encompasses the offset

section_from_virtual_address(self, arg: int) lief.MachO.Section

Return the Section which encompasses the virtual address

property sections lief.MachO.Binary.it_sections

Return an iterator over the binary’s Section

segment_from_offset(self, arg: int) lief.MachO.SegmentCommand

Return the SegmentCommand which encompasses the offset

segment_from_virtual_address(self, arg: int) lief.MachO.SegmentCommand

Return the SegmentCommand which encompasses the virtual address

property segment_split_info lief.MachO.SegmentSplitInfo

Return the binary’s SegmentSplitInfo if any, or None

property segments lief.MachO.Binary.it_segments

Return an iterator over the binary’s SegmentCommand

shift(self, value: int) lief.ok_t | lief.lief_errors

Shift the content located right after the Load commands table. This operation can be used to add a new command

shift_linkedit(self, value: int) lief.ok_t | lief.lief_errors

Shift the position on the __LINKEDIT data by width

property source_version lief.MachO.SourceVersion

Return the binary’s SourceVersion if any, or None

property sub_framework lief.MachO.SubFramework

Return the binary’s SubFramework if any, or None

property subclients lief.MachO.Binary.it_sub_clients

Return an iterator over the binary’s SubClient

property support_arm64_ptr_auth bool

Check if the binary is supporting ARM64 pointer authentication (arm64e)

property symbol_command lief.MachO.SymbolCommand

Return the binary’s SymbolCommand if any, or None

property symbol_stubs collections.abc.Sequence[lief.MachO.Stub]

Return an iterator over the symbol stubs.

These stubs are involved when calling an imported function and are similar to the ELF’s plt/got mechanism.

There are located in sections like: __stubs,__auth_stubs,__symbol_stub,__picsymbolstub4

property symbols lief.MachO.Binary.it_symbols

Return an iterator over the binary’s Symbol

property thread_command lief.MachO.ThreadCommand

Return the binary’s ThreadCommand if any, or None

property two_level_hints lief.MachO.TwoLevelHints

Return the binary’s TwoLevelHints if any, or None

unexport(*args) bool

Overloaded function.

  1. unexport(self, name: str) -> bool

Remove the symbol from the export table

  1. unexport(self, symbol: lief._lief.MachO.Symbol) -> bool

Remove the symbol from the export table

property unwind_functions list[lief.Function]

Return list of Function found in the __unwind_info section

property uuid lief.MachO.UUIDCommand

Return the binary’s UUIDCommand if any, or None

property va_ranges lief.MachO.Binary.range_t

Return the range of virtual addresses as a tuple (va_start, va_end)

property version_min lief.MachO.VersionMin

Return the binary’s VersionMin if any, or None

virtual_address_to_offset(self, virtual_address: int) int | lief.lief_errors

Convert the virtual address to an offset in the binary

property virtual_size int

Binary’s memory size when mapped

write(self, output: str) None

Rebuild the binary and write and write its content if the file given in parameter



Section

Inheritance diagram of lief._lief.MachO.Section
class lief.MachO.Section(self)
class lief.MachO.Section(self, section_name: str)
class lief.MachO.Section(self, section_name: str, content: list[int])

Bases: Section

Class that represents a Mach-O section

Overloaded function.

  1. __init__(self, section_name: str) -> None

Constructor from a section’s name

  1. __init__(self, section_name: str, content: list[int]) -> None

Constructor from a section’s name and its content

class FLAGS

Bases: object

DEBUG_INFO = <lief.MachO.FLAGS.lief.MachO.FLAGS.DEBUG_INFO: 33554432>
EXT_RELOC = <lief.MachO.FLAGS.lief.MachO.FLAGS.EXT_RELOC: 512>
LIVE_SUPPORT = <lief.MachO.FLAGS.lief.MachO.FLAGS.LIVE_SUPPORT: 134217728>
LOC_RELOC = <lief.MachO.FLAGS.lief.MachO.FLAGS.LOC_RELOC: 256>
NO_DEAD_STRIP = <lief.MachO.FLAGS.lief.MachO.FLAGS.NO_DEAD_STRIP: 268435456>
NO_TOC = <lief.MachO.FLAGS.lief.MachO.FLAGS.NO_TOC: 1073741824>
PURE_INSTRUCTIONS = <lief.MachO.FLAGS.lief.MachO.FLAGS.PURE_INSTRUCTIONS: 2147483648>
SELF_MODIFYING_CODE = <lief.MachO.FLAGS.lief.MachO.FLAGS.SELF_MODIFYING_CODE: 67108864>
SOME_INSTRUCTIONS = <lief.MachO.FLAGS.lief.MachO.FLAGS.SOME_INSTRUCTIONS: 1024>
STRIP_STATIC_SYMS = <lief.MachO.FLAGS.lief.MachO.FLAGS.STRIP_STATIC_SYMS: 536870912>
from_value(arg: int) lief.MachO.Section.FLAGS = <nanobind.nb_func object>
property value int

The underlying integer value

class TYPE

Bases: object

COALESCED = lief._lief.MachO.TYPE.COALESCED
CSTRING_LITERALS = lief._lief.MachO.TYPE.CSTRING_LITERALS
DTRACE_DOF = lief._lief.MachO.TYPE.DTRACE_DOF
GB_ZEROFILL = lief._lief.MachO.TYPE.GB_ZEROFILL
INIT_FUNC_OFFSETS = lief._lief.MachO.TYPE.INIT_FUNC_OFFSETS
INTERPOSING = lief._lief.MachO.TYPE.INTERPOSING
LAZY_DYLIB_SYMBOL_POINTERS = lief._lief.MachO.TYPE.LAZY_DYLIB_SYMBOL_POINTERS
LAZY_SYMBOL_POINTERS = lief._lief.MachO.TYPE.LAZY_SYMBOL_POINTERS
LITERAL_POINTERS = lief._lief.MachO.TYPE.LITERAL_POINTERS
MOD_INIT_FUNC_POINTERS = lief._lief.MachO.TYPE.MOD_INIT_FUNC_POINTERS
MOD_TERM_FUNC_POINTERS = lief._lief.MachO.TYPE.MOD_TERM_FUNC_POINTERS
NON_LAZY_SYMBOL_POINTERS = lief._lief.MachO.TYPE.NON_LAZY_SYMBOL_POINTERS
REGULAR = lief._lief.MachO.TYPE.REGULAR
SYMBOL_STUBS = lief._lief.MachO.TYPE.SYMBOL_STUBS
S_16BYTE_LITERALS = lief._lief.MachO.TYPE.S_16BYTE_LITERALS
S_4BYTE_LITERALS = lief._lief.MachO.TYPE.S_4BYTE_LITERALS
S_8BYTE_LITERALS = lief._lief.MachO.TYPE.S_8BYTE_LITERALS
THREAD_LOCAL_INIT_FUNCTION_POINTERS = lief._lief.MachO.TYPE.THREAD_LOCAL_INIT_FUNCTION_POINTERS
THREAD_LOCAL_REGULAR = lief._lief.MachO.TYPE.THREAD_LOCAL_REGULAR
THREAD_LOCAL_VARIABLES = lief._lief.MachO.TYPE.THREAD_LOCAL_VARIABLES
THREAD_LOCAL_VARIABLE_POINTERS = lief._lief.MachO.TYPE.THREAD_LOCAL_VARIABLE_POINTERS
THREAD_LOCAL_ZEROFILL = lief._lief.MachO.TYPE.THREAD_LOCAL_ZEROFILL
ZEROFILL = lief._lief.MachO.TYPE.ZEROFILL
from_value(arg: int) lief.MachO.Section.TYPE = <nanobind.nb_func object>
property value int

The underlying integer value

add(self, flag: lief.MachO.Section.FLAGS) None

Add the given SECTION_FLAGS

property alignment int

Section’s alignment as a power of 2

property flags lief.MachO.Section.FLAGS

Section’s flags masked with SECTION_FLAGS_MASK (see: FLAGS)

property flags_list list[lief.MachO.Section.FLAGS]
has(self, flag: lief.MachO.Section.FLAGS) bool

Check if the section has the given SECTION_FLAGS

property has_segment bool

True if the current section has a segment associated with

class it_relocations

Bases: object

Iterator over lief._lief.MachO.Relocation

property numberof_relocations int

Number of relocations associated with this section

property relocation_offset int

Offset of the relocation table. This value should be 0 for executable and libraries as the relocations are managed by the lief.MachO.DyldInfo.rebase

Other the other hand, for object files (.o) this value should not be 0

property relocations lief.MachO.SegmentCommand.it_relocations

Iterator over the Relocation (if any)

remove(self, flag: lief.MachO.Section.FLAGS) None

Remove the given SECTION_FLAGS

property reserved1 int

According to the official loader.h file, this value is reserved for offset or index

property reserved2 int

According to the official loader.h file, this value is reserved for offset or index

property reserved3 int

According to the official loader.h file, this value is reserved for offset or index

property segment lief.MachO.SegmentCommand

SegmentCommand associated with the section or None if not present

property segment_name str

The segment name associated with the section

property type lief.MachO.Section.TYPE

Type of the section. This value can help to determine the purpose of the section (c.f. TYPE)


SegmentCommand

Inheritance diagram of lief._lief.MachO.LinkEdit, lief._lief.MachO.SegmentCommand
class lief.MachO.SegmentCommand(self)
class lief.MachO.SegmentCommand(self, arg: str, /)
class lief.MachO.SegmentCommand(self, arg0: str, arg1: list[int], /)

Bases: LoadCommand

Class which represents a SEGMENT / SEGMENT_64 command

class FLAGS

Bases: object

FVMLIB = lief._lief.MachO.FLAGS.FVMLIB
HIGHVM = lief._lief.MachO.FLAGS.HIGHVM
NORELOC = lief._lief.MachO.FLAGS.NORELOC
PROTECTED_VERSION_1 = lief._lief.MachO.FLAGS.PROTECTED_VERSION_1
READ_ONLY = lief._lief.MachO.FLAGS.READ_ONLY
from_value(arg: int) lief.MachO.SegmentCommand.FLAGS = <nanobind.nb_func object>
property value int

The underlying integer value

class VM_PROTECTIONS

Bases: object

R = lief._lief.MachO.VM_PROTECTIONS.R
W = lief._lief.MachO.VM_PROTECTIONS.W
X = lief._lief.MachO.VM_PROTECTIONS.X
from_value(arg: int) lief.MachO.SegmentCommand.VM_PROTECTIONS = <nanobind.nb_func object>
property value int

The underlying integer value

add_section(self, section: lief.MachO.Section) lief.MachO.Section
property content memoryview

Segment’s content

property file_offset int

Segment’s file offset

property file_size int

Segment’s file size

property flags int

Segment’s flags

get_section(self, name: str) lief.MachO.Section

Get the Section with the given name

has(self, section: lief.MachO.Section) bool

Check if the given Section belongs to the current segment

has_section(self, section_name: str) bool

Check if the given section name belongs to the current segment

property index int

Relative index of the segment in the segment table

property init_protection int

Segment’s initial protection

class it_relocations

Bases: object

Iterator over lief._lief.MachO.Relocation

class it_sections

Bases: object

Iterator over lief._lief.MachO.Section

property max_protection int

Segment’s max protection

property name str | bytes

Segment’s name

property numberof_sections int

Number of sections in this segment

property relocations lief.MachO.SegmentCommand.it_relocations

Segment’s relocations

property sections lief.MachO.SegmentCommand.it_sections

Segment’s sections

property virtual_address int

Segment’s virtual address

property virtual_size int

Segment’s virtual size


LoadCommand

Inheritance diagram of lief._lief.MachO.LoadCommand, lief._lief.MachO.RPathCommand, lief._lief.MachO.DataInCode, lief._lief.MachO.FilesetCommand, lief._lief.MachO.DylinkerCommand, lief._lief.MachO.UUIDCommand, lief._lief.MachO.MainCommand, lief._lief.MachO.DylibCommand, lief._lief.MachO.UnknownCommand, lief._lief.MachO.VersionMin, lief._lief.MachO.Routine, lief._lief.MachO.BuildVersion, lief._lief.MachO.DyldExportsTrie, lief._lief.MachO.SourceVersion, lief._lief.MachO.DyldEnvironment, lief._lief.MachO.FunctionStarts, lief._lief.MachO.SegmentCommand, lief._lief.MachO.LinkEdit, lief._lief.MachO.TwoLevelHints, lief._lief.MachO.DyldChainedFixups, lief._lief.MachO.LinkerOptHint, lief._lief.MachO.DyldInfo, lief._lief.MachO.SubFramework, lief._lief.MachO.SubClient, lief._lief.MachO.CodeSignatureDir, lief._lief.MachO.ThreadCommand, lief._lief.MachO.EncryptionInfo, lief._lief.MachO.CodeSignature, lief._lief.MachO.SegmentSplitInfo, lief._lief.MachO.DynamicSymbolCommand, lief._lief.MachO.SymbolCommand
class lief.MachO.LoadCommand(self)

Bases: Object

Based class for the Mach-O load commands

class TYPE

Bases: object

BUILD_VERSION = lief._lief.MachO.TYPE.BUILD_VERSION
CODE_SIGNATURE = lief._lief.MachO.TYPE.CODE_SIGNATURE
DATA_IN_CODE = lief._lief.MachO.TYPE.DATA_IN_CODE
DYLD_CHAINED_FIXUPS = lief._lief.MachO.TYPE.DYLD_CHAINED_FIXUPS
DYLD_ENVIRONMENT = lief._lief.MachO.TYPE.DYLD_ENVIRONMENT
DYLD_EXPORTS_TRIE = lief._lief.MachO.TYPE.DYLD_EXPORTS_TRIE
DYLD_INFO = lief._lief.MachO.TYPE.DYLD_INFO
DYLD_INFO_ONLY = lief._lief.MachO.TYPE.DYLD_INFO_ONLY
DYLIB_CODE_SIGN_DRS = lief._lief.MachO.TYPE.DYLIB_CODE_SIGN_DRS
DYSYMTAB = lief._lief.MachO.TYPE.DYSYMTAB
ENCRYPTION_INFO = lief._lief.MachO.TYPE.ENCRYPTION_INFO
ENCRYPTION_INFO_64 = lief._lief.MachO.TYPE.ENCRYPTION_INFO_64
FILESET_ENTRY = lief._lief.MachO.TYPE.FILESET_ENTRY
FUNCTION_STARTS = lief._lief.MachO.TYPE.FUNCTION_STARTS
FVMFILE = lief._lief.MachO.TYPE.FVMFILE
IDENT = lief._lief.MachO.TYPE.IDENT
IDFVMLIB = lief._lief.MachO.TYPE.IDFVMLIB
ID_DYLIB = lief._lief.MachO.TYPE.ID_DYLIB
ID_DYLINKER = lief._lief.MachO.TYPE.ID_DYLINKER
LAZY_LOAD_DYLIB = lief._lief.MachO.TYPE.LAZY_LOAD_DYLIB
LIEF_UNKNOWN = lief._lief.MachO.TYPE.LIEF_UNKNOWN
LINKER_OPTIMIZATION_HINT = lief._lief.MachO.TYPE.LINKER_OPTIMIZATION_HINT
LINKER_OPTION = lief._lief.MachO.TYPE.LINKER_OPTION
LOADFVMLIB = lief._lief.MachO.TYPE.LOADFVMLIB
LOAD_DYLIB = lief._lief.MachO.TYPE.LOAD_DYLIB
LOAD_DYLINKER = lief._lief.MachO.TYPE.LOAD_DYLINKER
LOAD_UPWARD_DYLIB = lief._lief.MachO.TYPE.LOAD_UPWARD_DYLIB
LOAD_WEAK_DYLIB = lief._lief.MachO.TYPE.LOAD_WEAK_DYLIB
MAIN = lief._lief.MachO.TYPE.MAIN
NOTE = lief._lief.MachO.TYPE.NOTE
PREBIND_CKSUM = lief._lief.MachO.TYPE.PREBIND_CKSUM
PREBOUND_DYLIB = lief._lief.MachO.TYPE.PREBOUND_DYLIB
PREPAGE = lief._lief.MachO.TYPE.PREPAGE
REEXPORT_DYLIB = lief._lief.MachO.TYPE.REEXPORT_DYLIB
ROUTINES = lief._lief.MachO.TYPE.ROUTINES
ROUTINES_64 = lief._lief.MachO.TYPE.ROUTINES_64
RPATH = lief._lief.MachO.TYPE.RPATH
SEGMENT = lief._lief.MachO.TYPE.SEGMENT
SEGMENT_64 = lief._lief.MachO.TYPE.SEGMENT_64
SEGMENT_SPLIT_INFO = lief._lief.MachO.TYPE.SEGMENT_SPLIT_INFO
SOURCE_VERSION = lief._lief.MachO.TYPE.SOURCE_VERSION
SUB_CLIENT = lief._lief.MachO.TYPE.SUB_CLIENT
SUB_FRAMEWORK = lief._lief.MachO.TYPE.SUB_FRAMEWORK
SUB_LIBRARY = lief._lief.MachO.TYPE.SUB_LIBRARY
SUB_UMBRELLA = lief._lief.MachO.TYPE.SUB_UMBRELLA
SYMSEG = lief._lief.MachO.TYPE.SYMSEG
SYMTAB = lief._lief.MachO.TYPE.SYMTAB
THREAD = lief._lief.MachO.TYPE.THREAD
TWOLEVEL_HINTS = lief._lief.MachO.TYPE.TWOLEVEL_HINTS
UNIXTHREAD = lief._lief.MachO.TYPE.UNIXTHREAD
UNKNOWN = lief._lief.MachO.TYPE.UNKNOWN
UUID = lief._lief.MachO.TYPE.UUID
VERSION_MIN_IPHONEOS = lief._lief.MachO.TYPE.VERSION_MIN_IPHONEOS
VERSION_MIN_MACOSX = lief._lief.MachO.TYPE.VERSION_MIN_MACOSX
VERSION_MIN_TVOS = lief._lief.MachO.TYPE.VERSION_MIN_TVOS
VERSION_MIN_WATCHOS = lief._lief.MachO.TYPE.VERSION_MIN_WATCHOS
from_value(arg: int) lief.MachO.LoadCommand.TYPE = <nanobind.nb_func object>
property value int

The underlying integer value

property command lief.MachO.LoadCommand.TYPE

Command type

property command_offset int

Offset of the command within the Load Command Table

property data memoryview

Command’s data

property size int

Size of the command (should be greather than sizeof(load_command))


DylibCommand

Inheritance diagram of lief._lief.MachO.DylibCommand
class lief.MachO.DylibCommand

Bases: LoadCommand

Class which represents a library dependency

property compatibility_version list[int]

Library’s compatibility version

property current_version list[int]

Library’s current version

id_dylib(name: str, timestamp: int, current_version: int, compat_version: int) lief.MachO.DylibCommand = <nanobind.nb_func object>
lazy_load_dylib(name: str, timestamp: int, current_version: int, compat_version: int) lief.MachO.DylibCommand = <nanobind.nb_func object>
load_dylib(name: str, timestamp: int, current_version: int, compat_version: int) lief.MachO.DylibCommand = <nanobind.nb_func object>
load_upward_dylib(name: str, timestamp: int, current_version: int, compat_version: int) lief.MachO.DylibCommand = <nanobind.nb_func object>
property name str

Library’s name

reexport_dylib(name: str, timestamp: int, current_version: int, compat_version: int) lief.MachO.DylibCommand = <nanobind.nb_func object>
property timestamp int

Library’s timestamp

weak_lib(name: str, timestamp: int, current_version: int, compat_version: int) lief.MachO.DylibCommand = <nanobind.nb_func object>

DylinkerCommand

Inheritance diagram of lief._lief.MachO.DylinkerCommand
class lief.MachO.DylinkerCommand(self, arg: str, /)

Bases: LoadCommand

Class that represents the Mach-O linker, also named loader Most of the time, name returns /usr/lib/dyld

property name str

Path to the loader/linker


UUIDCommand

Inheritance diagram of lief._lief.MachO.UUIDCommand
class lief.MachO.UUIDCommand

Bases: LoadCommand

Class that represents the UUID command

property uuid list[int]

UUID as a list


MainCommand

Inheritance diagram of lief._lief.MachO.MainCommand
class lief.MachO.MainCommand(self, arg0: int, arg1: int, /)

Bases: LoadCommand

Class that represent the LC_MAIN command. This kind of command can be used to determine the entrypoint of an executable

property entrypoint int

Offset of the main function relative to the __TEXT segment

property stack_size int

The initial stack size (if not 0)


Symbol

Inheritance diagram of lief._lief.MachO.Symbol
class lief.MachO.Symbol(self)

Bases: Symbol

Class that represents a Symbol in a Mach-O file.

A Mach-O symbol can come from:

  1. The symbols command (LC_SYMTAB / SymbolCommand)

  2. The Dyld Export trie

  3. The Dyld Symbol bindings

class CATEGORY

Bases: object

EXTERNAL = lief._lief.MachO.CATEGORY.EXTERNAL
INDIRECT_ABS = lief._lief.MachO.CATEGORY.INDIRECT_ABS
INDIRECT_ABS_LOCAL = lief._lief.MachO.CATEGORY.INDIRECT_ABS_LOCAL
INDIRECT_LOCAL = lief._lief.MachO.CATEGORY.INDIRECT_LOCAL
LOCAL = lief._lief.MachO.CATEGORY.LOCAL
NONE = lief._lief.MachO.CATEGORY.NONE
UNDEFINED = lief._lief.MachO.CATEGORY.UNDEFINED
from_value(arg: int) lief.MachO.Symbol.CATEGORY = <nanobind.nb_func object>
property value int

The underlying integer value

class ORIGIN

Bases: object

DYLD_BIND = lief._lief.MachO.ORIGIN.DYLD_BIND
DYLD_EXPORT = lief._lief.MachO.ORIGIN.DYLD_EXPORT
LC_SYMTAB = lief._lief.MachO.ORIGIN.LC_SYMTAB
UNKNOWN = lief._lief.MachO.ORIGIN.UNKNOWN
from_value(arg: int) lief.MachO.Symbol.ORIGIN = <nanobind.nb_func object>
property value int

The underlying integer value

class TYPE

Bases: object

ABSOLUTE_SYM = lief._lief.MachO.TYPE.ABSOLUTE_SYM
INDIRECT = lief._lief.MachO.TYPE.INDIRECT
PREBOUND = lief._lief.MachO.TYPE.PREBOUND
SECTION = lief._lief.MachO.TYPE.SECTION
UNDEFINED = lief._lief.MachO.TYPE.UNDEFINED
from_value(arg: int) lief.MachO.Symbol.TYPE = <nanobind.nb_func object>
property value int

The underlying integer value

property binding_info lief.MachO.BindingInfo

BindingInfo associated with the symbol if any, or None

property category lief.MachO.Symbol.CATEGORY

Category of the symbol according to the LC_DYSYMTAB command

property demangled_name str

Symbol’s unmangled name

property description int

Return information about the symbol

property export_info lief.MachO.ExportInfo

ExportInfo associated with the symbol if any, or None

property has_binding_info bool

True if the symbol has an BindingInfo associated with

property has_export_info bool

True if the symbol has an ExportInfo associated with

property is_external bool

True if the symbol is defined as an external symbol.

property library lief.MachO.DylibCommand

DylibCommand the library where the symbol is exposed

property library_ordinal int

Library ordinal + 1 (0 means self)

property numberof_sections int

It returns the number of sections in which this symbol can be found. If the symbol can’t be found in any section, it returns 0 (NO_SECT)

property origin lief.MachO.Symbol.ORIGIN

Return the ORIGIN of this symbol

property raw_type int

Raw value of nlist_xx.n_type

property type lief.MachO.Symbol.TYPE

Type as defined by nlist_xx.n_type & N_TYPE


Symbol Command

Inheritance diagram of lief._lief.MachO.DylinkerCommand
class lief.MachO.SymbolCommand(self)

Bases: LoadCommand

Class that represents the LC_SYMTAB command

property numberof_symbols int

Number of symbols registered

property strings_offset int

Offset from the start of the file to the string table

property strings_size int

Size of the size string table

property symbol_offset int

Offset from the start of the file to the n_list associated with the command


Dynamic Symbol Command

Inheritance diagram of lief._lief.MachO.DynamicSymbolCommand
class lief.MachO.DynamicSymbolCommand

Bases: LoadCommand

Class that represents the LC_DYSYMTAB command. This command completes the LC_SYMTAB (SymbolCommand) to provide a better granularity over the symbols layout.

property external_reference_symbol_offset int

Byte offset from the start of the file to the external reference table data. This field seems unused by recent Mach-O loader and should be set to 0

property external_relocation_offset int

Byte offset from the start of the file to the module table data. This field seems unused by recent Mach-O loader and should be set to 0

property idx_external_define_symbol int

Index of the first symbol in the group of defined external symbols.

property idx_local_symbol int

Index of the first symbol in the group of local symbols.

property idx_undefined_symbol int

Index of the first symbol in the group of undefined external symbols.

property indirect_symbol_offset int

Byte offset from the start of the file to the indirect symbol table data.

Indirect symbol table is used by the loader to speed-up symbol resolution during the lazy binding process

References:

  • dyld-519.2.1/src/ImageLoaderMachOCompressed.cpp

  • dyld-519.2.1/src/ImageLoaderMachOClassic.cpp

property indirect_symbols lief.MachO.DynamicSymbolCommand.it_indirect_symbols

Iterator over the indirect symbols indexed by this command

class it_indirect_symbols

Bases: object

Iterator over lief._lief.MachO.Symbol

property local_relocation_offset int

Byte offset from the start of the file to the local relocation table data. This field seems unused by recent Mach-O loader and should be set to 0

property module_table_offset int

Byte offset from the start of the file to the module table data. This field seems unused by recent Mach-O loader and should be set to 0

property nb_external_define_symbols int

Number of symbols in the group of defined external symbols.

property nb_external_reference_symbols int

Number of entries in the external reference table. This field seems unused by recent Mach-O loader and should be set to 0.

property nb_external_relocations int

Number of entries in the external relocation table. This field seems unused by recent Mach-O loader and should be set to 0

property nb_indirect_symbols int

Number of entries in the indirect symbol table.

property nb_local_relocations int

Number of entries in the local relocation table. This field seems unused by recent Mach-O loader and should be set to 0

property nb_local_symbols int

Number of symbols in the group of local symbols.

property nb_module_table int

Number of entries in the module table. This field seems unused by recent Mach-O loader and should be set to 0.

property nb_toc int

Number of entries in the table of contents Should be set to 0 on recent Mach-O

property nb_undefined_symbols int

Number of symbols in the group of undefined external symbols.

property toc_offset int

Byte offset from the start of the file to the table of contents data. Table of content is used by legacy Mach-O loader and this field should be set to 0


Dyld Info

Inheritance diagram of lief._lief.MachO.DyldInfo
class lief.MachO.DyldInfo

Bases: LoadCommand

Class that represents the LC_DYLD_INFO and LC_DYLD_INFO_ONLY commands

class BIND_OPCODES

Bases: object

ADD_ADDR_ULEB = lief._lief.MachO.BIND_OPCODES.ADD_ADDR_ULEB
DONE = lief._lief.MachO.BIND_OPCODES.DONE
DO_BIND = lief._lief.MachO.BIND_OPCODES.DO_BIND
DO_BIND_ADD_ADDR_IMM_SCALED = lief._lief.MachO.BIND_OPCODES.DO_BIND_ADD_ADDR_IMM_SCALED
DO_BIND_ADD_ADDR_ULEB = lief._lief.MachO.BIND_OPCODES.DO_BIND_ADD_ADDR_ULEB
DO_BIND_ULEB_TIMES_SKIPPING_ULEB = lief._lief.MachO.BIND_OPCODES.DO_BIND_ULEB_TIMES_SKIPPING_ULEB
SET_ADDEND_SLEB = lief._lief.MachO.BIND_OPCODES.SET_ADDEND_SLEB
SET_DYLIB_ORDINAL_IMM = lief._lief.MachO.BIND_OPCODES.SET_DYLIB_ORDINAL_IMM
SET_DYLIB_ORDINAL_ULEB = lief._lief.MachO.BIND_OPCODES.SET_DYLIB_ORDINAL_ULEB
SET_DYLIB_SPECIAL_IMM = lief._lief.MachO.BIND_OPCODES.SET_DYLIB_SPECIAL_IMM
SET_SEGMENT_AND_OFFSET_ULEB = lief._lief.MachO.BIND_OPCODES.SET_SEGMENT_AND_OFFSET_ULEB
SET_SYMBOL_TRAILING_FLAGS_IMM = lief._lief.MachO.BIND_OPCODES.SET_SYMBOL_TRAILING_FLAGS_IMM
SET_TYPE_IMM = lief._lief.MachO.BIND_OPCODES.SET_TYPE_IMM
THREADED = lief._lief.MachO.BIND_OPCODES.THREADED
THREADED_APPLY = lief._lief.MachO.BIND_OPCODES.THREADED_APPLY
from_value(arg: int) lief.MachO.DyldInfo.BIND_OPCODES = <nanobind.nb_func object>
property value int

The underlying integer value

class REBASE_OPCODES

Bases: object

ADD_ADDR_IMM_SCALED = lief._lief.MachO.REBASE_OPCODES.ADD_ADDR_IMM_SCALED
ADD_ADDR_ULEB = lief._lief.MachO.REBASE_OPCODES.ADD_ADDR_ULEB
DONE = lief._lief.MachO.REBASE_OPCODES.DONE
DO_REBASE_ADD_ADDR_ULEB = lief._lief.MachO.REBASE_OPCODES.DO_REBASE_ADD_ADDR_ULEB
DO_REBASE_IMM_TIMES = lief._lief.MachO.REBASE_OPCODES.DO_REBASE_IMM_TIMES
DO_REBASE_ULEB_TIMES = lief._lief.MachO.REBASE_OPCODES.DO_REBASE_ULEB_TIMES
DO_REBASE_ULEB_TIMES_SKIPPING_ULEB = lief._lief.MachO.REBASE_OPCODES.DO_REBASE_ULEB_TIMES_SKIPPING_ULEB
SET_SEGMENT_AND_OFFSET_ULEB = lief._lief.MachO.REBASE_OPCODES.SET_SEGMENT_AND_OFFSET_ULEB
SET_TYPE_IMM = lief._lief.MachO.REBASE_OPCODES.SET_TYPE_IMM
from_value(arg: int) lief.MachO.DyldInfo.REBASE_OPCODES = <nanobind.nb_func object>
property value int

The underlying integer value

class REBASE_TYPE

Bases: object

POINTER = lief._lief.MachO.REBASE_TYPE.POINTER
TEXT_ABSOLUTE32 = lief._lief.MachO.REBASE_TYPE.TEXT_ABSOLUTE32
TEXT_PCREL32 = lief._lief.MachO.REBASE_TYPE.TEXT_PCREL32
THREADED = lief._lief.MachO.REBASE_TYPE.THREADED
from_value(arg: int) lief.MachO.DyldInfo.REBASE_TYPE = <nanobind.nb_func object>
property value int

The underlying integer value

property bind tuple[int, int]

Bind information as a tuple (offset, size)

Dyld binds an image during the loading process, if the image requires any pointers to be initialized to symbols in other images. The rebase information is a stream of byte sized opcodes for which symbolic names start with BIND_OPCODE_.

Conceptually the bind information is a table of tuples: (seg-index, seg-offset, type, symbol-library-ordinal, symbol-name, addend) The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like for runs of pointers initialzed to the same value can be encoded in a few bytes.

See also

/usr/include/mach-o/loader.h

property bind_opcodes memoryview

Return the binding’s opcodes as list of bytes

property bindings lief.MachO.DyldInfo.it_binding_info

Return an iterator over Dyld’s BindingInfo

property export_info tuple[int, int]

Export information as a tuple (offset, size)

The symbols exported by a dylib are encoded in a trie. This is a compact representation that factors out common prefixes.

It also reduces LINKEDIT pages in RAM because it encodes all information (name, address, flags) in one small, contiguous range. The export area is a stream of nodes. The first node sequentially is the start node for the trie.

Nodes for a symbol start with a byte that is the length of the exported symbol information for the string so far. If there is no exported symbol, the byte is zero. If there is exported info, it follows the length byte. The exported info normally consists of a flags and offset both encoded in uleb128. The offset is location of the content named by the symbol. It is the offset from the mach_header for the image.

After the initial byte and optional exported symbol information is a byte of how many edges (0-255) that this node has leaving it, followed by each edge. Each edge is a zero terminated cstring of the addition chars in the symbol, followed by a uleb128 offset for the node that edge points to.

See also

/usr/include/mach-o/loader.h

property export_trie memoryview

Return Export’s trie as list of bytes

property exports lief.MachO.DyldExportsTrie.it_export_info

Return an iterator over Dyld’s ExportInfo

class it_binding_info

Bases: object

Iterator over lief._lief.MachO.DyldBindingInfo

class it_export_info

Bases: object

Iterator over lief._lief.MachO.ExportInfo

property lazy_bind tuple[int, int]

Lazy Bind information as a tuple (offset, size)

Some uses of external symbols do not need to be bound immediately. Instead they can be lazily bound on first use. The lazy_bind are contains a stream of BIND opcodes to bind all lazy symbols. Normal use is that dyld ignores the lazy_bind section when loading an image. Instead the static linker arranged for the lazy pointer to initially point to a helper function which pushes the offset into the lazy_bind area for the symbol needing to be bound, then jumps to dyld which simply adds the offset to lazy_bind_off to get the information on what to bind.

See also

/usr/include/mach-o/loader.h

property lazy_bind_opcodes memoryview

Return lazy binding’s opcodes as list of bytes

property rebase tuple[int, int]

Rebase information as a tuple (offset, size)

Dyld rebases an image whenever dyld loads it at an address different from its preferred address. The rebase information is a stream of byte sized opcodes for which symbolic names start with REBASE_OPCODE_.

Conceptually the rebase information is a table of tuples: (seg-index, seg-offset, type)

The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like “every n’th offset for m times” can be encoded in a few bytes

See also

/usr/include/mach-o/loader.h

property rebase_opcodes memoryview

Return the rebase’s opcodes as list of bytes

set_bind_offset(self, offset: int) None
set_bind_size(self, size: int) None
set_export_offset(self, offset: int) None
set_export_size(self, size: int) None
set_lazy_bind_offset(self, offset: int) None
set_lazy_bind_size(self, size: int) None
set_rebase_offset(self, offset: int) None
set_rebase_size(self, size: int) None
set_weak_bind_offset(self, offset: int) None
set_weak_bind_size(self, size: int) None
property show_bind_opcodes str

Return the bind opcodes in a humman-readable way

property show_export_trie str

Return the export trie in a humman-readable way

property show_lazy_bind_opcodes str

Return the weak bind opcodes in a humman-readable way

property show_rebases_opcodes str

Return the rebase opcodes in a humman-readable way

property show_weak_bind_opcodes str

Return the weak bind opcodes in a humman-readable way

property weak_bind tuple[int, int]

Weak Bind information as a tuple (offset, size)

Some C++ programs require dyld to unique symbols so that all images in the process use the same copy of some code/data.

This step is done after binding. The content of the weak_bind info is an opcode stream like the bind_info. But it is sorted alphabetically by symbol name. This enables dyld to walk all images with weak binding information in order and look for collisions. If there are no collisions, dyld does no updating. That means that some fixups are also encoded in the bind_info. For instance, all calls to operator new are first bound to libstdc++.dylib using the information in bind_info. Then if some image overrides operator new that is detected when the weak_bind information is processed and the call to operator new is then rebound.

See also

/usr/include/mach-o/loader.h

property weak_bind_opcodes memoryview

Return Weak binding’s opcodes as list of bytes


Function starts

Inheritance diagram of lief._lief.MachO.FunctionStarts
class lief.MachO.FunctionStarts

Bases: LoadCommand

Class which represents the LC_FUNCTION_STARTS command

This command is an array of ULEB128 encoded values

add_function(self, address: int) None

Add a new function

property content memoryview

The original content as a bytes stream

property data_offset int

Offset in the binary where start functions are located

property data_size int

Size of the functions list in the binary

property functions list[int]

Addresses of every function entry point in the executable

This allows functions to exist for which there are no entries in the symbol table.

Warning

The address is relative to the __TEXT segment


Source Version

Inheritance diagram of lief._lief.MachO.SourceVersion
class lief.MachO.SourceVersion

Bases: LoadCommand

Class that represents the MachO SOURCE_VERSION This command is used to provide the version of the sources used to build the binary

property version list[int]

Version as a tuple of 5 integers


Version Min

Inheritance diagram of lief._lief.MachO.VersionMin
class lief.MachO.VersionMin

Bases: LoadCommand

Class that wraps the LC_VERSION_MIN_MACOSX, LC_VERSION_MIN_IPHONEOS, … commands

property sdk list[int]

SDK as a tuple of 3 integers

property version list[int]

Version as a tuple of 3 integers


Routine

Inheritance diagram of lief._lief.MachO.Routine
class lief.MachO.Routine

Bases: LoadCommand

Class that represents the LC_ROUTINE/LC_ROUTINE64 commands. Accodring to the Mach-O loader.h documentation:

> The routines command contains the address of the dynamic shared library > initialization routine and an index into the module table for the module > that defines the routine. Before any modules are used from the library the > dynamic linker fully binds the module that defines the initialization routine > and then calls it. This gets called before any module initialization > routines (used for C++ static constructors) in the library.

property init_address int

Address of initialization routine

property init_module int

Index into the module table that the init routine is defined in

property reserved1 int
property reserved2 int
property reserved3 int
property reserved4 int
property reserved5 int
property reserved6 int

Relocation

Inheritance diagram of lief._lief.MachO.Relocation, lief._lief.MachO.RelocationDyld, lief._lief.MachO.RelocationObject, lief._lief.MachO.RelocationFixup
class lief.MachO.Relocation

Bases: Relocation

It extends the LIEF lief.Relocation abstract class and it is sub-classed by

  1. RelocationObject

  2. RelocationDyld

class ORIGIN

Bases: object

CHAINED_FIXUPS = lief._lief.MachO.ORIGIN.CHAINED_FIXUPS
DYLDINFO = lief._lief.MachO.ORIGIN.DYLDINFO
RELOC_TABLE = lief._lief.MachO.ORIGIN.RELOC_TABLE
UNKNOWN = lief._lief.MachO.ORIGIN.UNKNOWN
from_value(arg: int) lief.MachO.Relocation.ORIGIN = <nanobind.nb_func object>
property value int

The underlying integer value

property address int

For OBJECT or (origin is RELOC_TABLE) this is an offset from the start of the Section to the item containing the address requiring relocation.

For EXECUTE / DYLIB or (origin is DYLDINFO) this is a virtual_address.

property architecture lief.MachO.Header.CPU_TYPE

CPU_TYPE of the relocation

property has_section bool

True if the relocation has a Section associated with

property has_segment bool

True if the relocation has a SegmentCommand associated with

property has_symbol bool

True if the relocation has a Symbol associated with

property origin lief.MachO.Relocation.ORIGIN

ORIGIN of the relocation

property pc_relative bool

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

property section lief.MachO.Section

Section associated with the relocation if any, or None

property segment lief.MachO.SegmentCommand

SegmentCommand associated with the relocation if any, or None

property symbol lief.MachO.Symbol

Symbol associated with the relocation if any, or None

property type lief.MachO.X86_RELOCATION | lief.MachO.X86_64_RELOCATION | lief.MachO.PPC_RELOCATION | lief.MachO.ARM_RELOCATION | lief.MachO.ARM64_RELOCATION | lief.MachO.DyldInfo.REBASE_TYPE

Type of the relocation according to the architecture and/or origin

If origin is RELOC_TABLE:

See:

If origin is DYLDINFO, the value is associated with REBASE_TYPE.


Relocation Object

Inheritance diagram of lief._lief.MachO.RelocationObject
class lief.MachO.RelocationObject

Bases: Relocation

Class that represents a relocation presents in the MachO object file (.o). Usually, this kind of relocation is found in the lief.MachO.Section.

property is_scattered bool

True if the relocation is a scattered one

property value int

For scattered relocations, the address of the relocatable expression for the item in the file that needs to be updated if the address is changed.

For relocatable expressions with the difference of two section addresses, the address from which to subtract (in mathematical terms, the minuend) is contained in the first relocation entry and the address to subtract (the subtrahend) is contained in the second relocation entry.”,


Relocation Dyld

Inheritance diagram of lief._lief.MachO.RelocationDyld
class lief.MachO.RelocationDyld

Bases: Relocation

Class that represents a relocation found in the DyldInfo structure.

While this class does not have an associated structure in the Mach-O format specification, it provides a convenient interface for the lief.MachO.DyldInfo.rebase values

See also: RelocationObject


Relocation Fixup

Inheritance diagram of lief._lief.MachO.RelocationFixup
class lief.MachO.RelocationFixup

Bases: Relocation

Class that represents a rebase relocation found in the LC_DYLD_CHAINED_FIXUPS command.

This class extends lief.Relocation (and lief.MachO.Relocation) in which address is set to the absolute virtual address where the relocation must take place (e.g. 0x10000d270).

On the other hand, target contains the value that should be set at address if the imagebase is imagebase (e.g. 0x1000073a8).

If the Mach-O loader chooses another base address (like 0x7ff100000), it must set 0x10000d270 to 0x7ff1073a8.

property next int

(unscaled) next offset in the chain

property target int

Binding Info

Inheritance diagram of lief._lief.MachO.ChainedBindingInfo, lief._lief.MachO.IndirectBindingInfo, lief._lief.MachO.DyldBindingInfo, lief._lief.MachO.BindingInfo
class lief.MachO.BindingInfo

Bases: Object

Class that provides an interface over an entry in DyldInfo structure

This class does not represent a structure that exists in the Mach-O format specifications but it provides a view of a binding operation that is performed by the Dyld binding bytecode (LC_DYLD_INFO) or the Dyld chained fixups (DYLD_CHAINED_FIXUPS)

See: ChainedBindingInfo, DyldBindingInfo

property addend int

Value added to the segment’s virtual address when binding

property address int

Binding’s address

property has_library bool

True if the binding info has a DylibCommand associated with

property has_segment bool

True if the binding info has a SegmentCommand associated with

property has_symbol bool

True if the binding info has a Symbol associated with

property library lief.MachO.DylibCommand

DylibCommand associated with the binding if any, or None

property library_ordinal int
property segment lief.MachO.SegmentCommand

SegmentCommand associated with the binding if any, or None

property symbol lief.MachO.Symbol

Symbol associated with the binding if any, or None

property weak_import bool

Dyld Binding Info

Inheritance diagram of lief._lief.MachO.DyldBindingInfo
class lief.MachO.DyldBindingInfo

Bases: BindingInfo

This class represents a symbol binding operation associated with the LC_DYLD_INFO bytecode.

This class does not represent a structure that exists in the Mach-O format specifications but it provides a view on an entry of the Dyld binding opcodes.

See also: BindingInfo

class CLASS

Bases: object

LAZY = lief._lief.MachO.CLASS.LAZY
STANDARD = lief._lief.MachO.CLASS.STANDARD
THREADED = lief._lief.MachO.CLASS.THREADED
WEAK = lief._lief.MachO.CLASS.WEAK
from_value(arg: int) lief.MachO.DyldBindingInfo.CLASS = <nanobind.nb_func object>
property value int

The underlying integer value

class TYPE

Bases: object

POINTER = lief._lief.MachO.TYPE.POINTER
TEXT_ABSOLUTE32 = lief._lief.MachO.TYPE.TEXT_ABSOLUTE32
TEXT_PCREL32 = lief._lief.MachO.TYPE.TEXT_PCREL32
from_value(arg: int) lief.MachO.DyldBindingInfo.TYPE = <nanobind.nb_func object>
property value int

The underlying integer value

property binding_class lief.MachO.DyldBindingInfo.CLASS

BINDING_CLASS of the binding

property binding_type lief.MachO.DyldBindingInfo.TYPE

BIND_TYPES of the binding.

Usually, it is POINTER.

property original_offset int

Original relative offset of the binding opcodes


Chained Binding Info

Inheritance diagram of lief._lief.MachO.ChainedBindingInfo
class lief.MachO.ChainedBindingInfo

Bases: BindingInfo

This class represents a symbol binding operation associated with the LC_DYLD_CHAINED_FIXUPS command.

This class does not represent a structure that exists in the Mach-O format specifications but it provides a view on an entry.

See also: BindingInfo

property format lief.MachO.DYLD_CHAINED_FORMAT

DYLD_CHAINED_FORMAT of the import

property offset int

Offset of the entry in the chained fixups

property ptr_format lief.MachO.DYLD_CHAINED_PTR_FORMAT

DYLD_CHAINED_PTR_FORMAT of the import

property sign_extended_addend int

Export Info

class lief.MachO.ExportInfo

Bases: Object

Class that provides an interface over the Dyld export info

This class does not represent a structure that exists in the Mach-O format specification but provides a view on an entry of the Dyld export trie.

class FLAGS

Bases: object

REEXPORT = <lief.MachO.FLAGS.lief.MachO.FLAGS.REEXPORT: 8>
STUB_AND_RESOLVER = <lief.MachO.FLAGS.lief.MachO.FLAGS.STUB_AND_RESOLVER: 16>
WEAK_DEFINITION = <lief.MachO.FLAGS.lief.MachO.FLAGS.WEAK_DEFINITION: 4>
from_value(arg: int) lief.MachO.ExportInfo.FLAGS = <nanobind.nb_func object>
property value int

The underlying integer value

class KIND

Bases: object

ABSOLUTE_KIND = lief._lief.MachO.KIND.ABSOLUTE_KIND
REGULAR = lief._lief.MachO.KIND.REGULAR
THREAD_LOCAL_KIND = lief._lief.MachO.KIND.THREAD_LOCAL_KIND
from_value(arg: int) lief.MachO.ExportInfo.KIND = <nanobind.nb_func object>
property value int

The underlying integer value

property address int

The address of the export

property alias lief.MachO.Symbol

Symbol alias if the current symbol is re-exported

property alias_library lief.MachO.DylibCommand

If the current symbol has an alias, it returns the DylibCommand command associated with

property flags int

Some information (FLAGS) about the export (like weak export, reexport, …)

property flags_list list[lief.MachO.ExportInfo.FLAGS]

Return flags as a list of FLAGS

has(self, flag: lief.MachO.ExportInfo.FLAGS) bool

Check if the flag FLAGS given in first parameter is present

property has_symbol bool

True if the export info has a Symbol associated with

property kind lief.MachO.ExportInfo.KIND

The export’s kind: regular, thread local, absolute, … (KIND)

property node_offset int

Original offset in the export Trie

property symbol lief.MachO.Symbol

Symbol associated with the export if any, or None


Thread Command

Inheritance diagram of lief._lief.MachO.ThreadCommand
class lief.MachO.ThreadCommand(self, arg0: int, arg1: int, arg2: lief._lief.MachO.Header.CPU_TYPE, /)

Bases: LoadCommand

Class that represents the LC_THREAD / LC_UNIXTHREAD commands and that can be used to get the binary entrypoint when the LC_MAIN (MainCommand) is not present

Generally speaking, this command aims at defining the original state of the main thread which includes the registers’ values

property architecture lief.MachO.Header.CPU_TYPE

The CPU architecture that is targeted by this ThreadCommand

property count int

Size of the thread state data with 32-bits alignment.

This value should match len(state)

property flavor int

Integer that defines a special flavor for the thread.

The meaning of this value depends on the architecture. The list of the values can be found in the XNU kernel files:

  • xnu/osfmk/mach/arm/thread_status.h for the ARM/AArch64 architectures

  • xnu/osfmk/mach/i386/thread_status.h for the x86/x86-64 architectures

property pc int

Return the initial Program Counter regardless of the underlying architecture. This value, when non null, can be used to determine the binary’s entrypoint.

Underneath, it works by looking for the PC register value in the state data

property state memoryview

The actual thread state as a vector of bytes. Depending on the architecture(), these data can be casted into x86_thread_state_t, x86_thread_state64_t, …


RPath Command

Inheritance diagram of lief._lief.MachO.RPathCommand
class lief.MachO.RPathCommand

Bases: LoadCommand

create(path: str) lief.MachO.RPathCommand | None = <nanobind.nb_func object>
property path str

@rpath path


Code Signature

Inheritance diagram of lief._lief.MachO.CodeSignature
class lief.MachO.CodeSignature

Bases: LoadCommand

property content memoryview

The raw signature as a bytes stream

property data_offset int

Offset in the binary where the signature starts

property data_size int

Size of the raw signature


Data In Code

Inheritance diagram of lief._lief.MachO.DataInCode
class lief.MachO.DataInCode

Bases: LoadCommand

Interface of the LC_DATA_IN_CODE command

This command is used to list slices of code sections that contain data. The slices information are stored as an array of DataCodeEntry

add(self, entry: lief.MachO.DataCodeEntry) lief.MachO.DataInCode

Add an new DataCodeEntry

property content memoryview

The original content as a bytes stream

property data_offset int

Start of the array of the DataCodeEntry entries

property data_size int

Whole size of the array (size = sizeof(DataCodeEntry) * nb_elements)

property entries lief.MachO.it_data_in_code_entries

Iterator over DataCodeEntry


Data Code Entry

class lief.MachO.DataCodeEntry

Bases: Object

Interface over an entry in the DataInCode command

class TYPES

Bases: object

ABS_JUMP_TABLE_32 = lief._lief.MachO.TYPES.ABS_JUMP_TABLE_32
DATA = lief._lief.MachO.TYPES.DATA
JUMP_TABLE_16 = lief._lief.MachO.TYPES.JUMP_TABLE_16
JUMP_TABLE_32 = lief._lief.MachO.TYPES.JUMP_TABLE_32
JUMP_TABLE_8 = lief._lief.MachO.TYPES.JUMP_TABLE_8
UNKNOWN = lief._lief.MachO.TYPES.UNKNOWN
from_value(arg: int) lief.MachO.DataCodeEntry.TYPES = <nanobind.nb_func object>
property value int

The underlying integer value

property length int

Length of the data

property offset int

Offset of the data

property type lief.MachO.DataCodeEntry.TYPES

Type of the data (TYPES


Segment Split Info

Inheritance diagram of lief._lief.MachO.SegmentSplitInfo
class lief.MachO.SegmentSplitInfo

Bases: LoadCommand

Class that represents the SEGMENT_SPLIT_INFO command

property content memoryview

The original content as a bytes stream

property data_offset int

Offset in the binary where the data start

property data_size int

Size of the raw data


Sub Framework

Inheritance diagram of lief._lief.MachO.SubFramework
class lief.MachO.SubFramework

Bases: LoadCommand

Class that represents the SubFramework command. Accodring to the Mach-O loader.h documentation:

> A dynamically linked shared library may be a subframework of an umbrella > framework. If so it will be linked with “-umbrella umbrella_name” where > Where “umbrella_name” is the name of the umbrella framework. A subframework > can only be linked against by its umbrella framework or other subframeworks > that are part of the same umbrella framework. Otherwise the static link > editor produces an error and states to link against the umbrella framework. > The name of the umbrella framework for subframeworks is recorded in the > following structure.

property umbrella str

Name of the umbrella framework


Sub Client

Inheritance diagram of lief._lief.MachO.SubClient
class lief.MachO.SubClient

Bases: LoadCommand

Class that represents the SubClient command. Accodring to the Mach-O loader.h documentation:

> For dynamically linked shared libraries that are subframework of an umbrella > framework they can allow clients other than the umbrella framework or other > subframeworks in the same umbrella framework. To do this the subframework > is built with “-allowable_client client_name” and an LC_SUB_CLIENT load > command is created for each -allowable_client flag. The client_name is > usually a framework name. It can also be a name used for bundles clients > where the bundle is built with “-client_name client_name”.

property client str

Name of the sub client


Dyld Environment

Inheritance diagram of lief._lief.MachO.DyldEnvironment
class lief.MachO.DyldEnvironment

Bases: LoadCommand

Class that represents a LC_DYLD_ENVIRONMENT which is used by the Mach-O linker/loader to initialize an environment variable

property value str

Environment variable as a string


Encryption Info

Inheritance diagram of lief._lief.MachO.EncryptionInfo
class lief.MachO.EncryptionInfo

Bases: LoadCommand

Class that represents the LC_ENCRYPTION_INFO / LC_ENCRYPTION_INFO_64 commands

The encryption info is usually present in Mach-O executables that target iOS to encrypt some sections of the binary

property crypt_id int

The encryption system. 0 means no encrypted

property crypt_offset int

File offset of encrypted range

property crypt_size int

File size of encrypted range


Build Version

Inheritance diagram of lief._lief.MachO.BuildVersion
class lief.MachO.BuildVersion

Bases: LoadCommand

class PLATFORMS

Bases: object

ANY = lief._lief.MachO.PLATFORMS.ANY
BRIDGEOS = lief._lief.MachO.PLATFORMS.BRIDGEOS
DRIVERKIT = lief._lief.MachO.PLATFORMS.DRIVERKIT
FIRMWARE = lief._lief.MachO.PLATFORMS.FIRMWARE
IOS = lief._lief.MachO.PLATFORMS.IOS
IOS_SIMULATOR = lief._lief.MachO.PLATFORMS.IOS_SIMULATOR
MACOS = lief._lief.MachO.PLATFORMS.MACOS
MAC_CATALYST = lief._lief.MachO.PLATFORMS.MAC_CATALYST
SEPOS = lief._lief.MachO.PLATFORMS.SEPOS
TVOS = lief._lief.MachO.PLATFORMS.TVOS
TVOS_SIMULATOR = lief._lief.MachO.PLATFORMS.TVOS_SIMULATOR
UNKNOWN = lief._lief.MachO.PLATFORMS.UNKNOWN
VISIONOS = lief._lief.MachO.PLATFORMS.VISIONOS
VISIONOS_SIMULATOR = lief._lief.MachO.PLATFORMS.VISIONOS_SIMULATOR
WATCHOS = lief._lief.MachO.PLATFORMS.WATCHOS
WATCHOS_SIMULATOR = lief._lief.MachO.PLATFORMS.WATCHOS_SIMULATOR
from_value(arg: int) lief.MachO.BuildVersion.PLATFORMS = <nanobind.nb_func object>
property value int

The underlying integer value

property minos list[int]

Minimal OS version on which this binary was built to run

property platform lief.MachO.BuildVersion.PLATFORMS

Target PLATFORMS

property sdk list[int]

SDK Version

property tools list[lief.MachO.BuildToolVersion]

List of BuildToolVersion used when while this binary


Build Tool Version

Inheritance diagram of lief._lief.MachO.BuildToolVersion
class lief.MachO.BuildToolVersion

Bases: Object

Class that represents a tool’s version that was involved in the build of the binary

class TOOLS

Bases: object

CLANG = lief._lief.MachO.TOOLS.CLANG
LD = lief._lief.MachO.TOOLS.LD
LLD = lief._lief.MachO.TOOLS.LLD
SWIFT = lief._lief.MachO.TOOLS.SWIFT
UNKNOWN = lief._lief.MachO.TOOLS.UNKNOWN
from_value(arg: int) lief.MachO.BuildToolVersion.TOOLS = <nanobind.nb_func object>
property value int

The underlying integer value

property tool lief.MachO.BuildToolVersion.TOOLS

TOOLS type

property version list[int]

Version of the tool


Fileset Command

Inheritance diagram of lief._lief.MachO.FilesetCommand
class lief.MachO.FilesetCommand

Bases: LoadCommand

Class associated with the LC_FILESET_ENTRY commands

property binary lief.MachO.Binary

Return the Binary object associated with the entry

property file_offset int

Original offset in the kernel cache

property name str

Name of the underlying MachO binary

property virtual_address int

Memory address where the MachO file should be mapped


DyldChainedFixups Command

Inheritance diagram of lief._lief.MachO.DyldChainedFixups
class lief.MachO.DyldChainedFixups

Bases: LoadCommand

Class that represents the LC_DYLD_CHAINED_FIXUPS command

This command aims at providing rebase and binding information like the DyldInfo ‘s bytecode. Compared to the DyldInfo bytecode, these chained fixups are taking less space.

property bindings lief.MachO.DyldChainedFixups.it_binding_info

Iterator over the bindings ChainedBindingInfo associated with this command

class chained_starts_in_segment

Bases: object

Structure that mirrors the raw dyld_chained_starts_in_segment which aims at providing information about the chained rebase/bind fixups

The relocations provided by this structure can be accessed through relocations

property max_valid_pointer int

for 32-bit OS, any value beyond this is not a pointer

property offset int

Original offset of the structure, relative to starts_offset

property page_count int

How many pages are in the page_start array

property page_size int

Likely 0x1000 for x86/x86_64 architectures and 0x4000 for ARM64 architecture

property page_start list[int]

Offset in the SegmentCommand of the first element of the chain.

property pointer_format lief.MachO.DYLD_CHAINED_PTR_FORMAT

How pointers are encoded

property segment lief.MachO.SegmentCommand

SegmentCommand in which the rebase/bind fixups take place

property segment_offset int

Offset of the segment’s data from the beginning of the file. (it should match file_offset)

property size int

sizeof(size) + sizeof(page_size) + ... + sizeof(pointer_format)

property chained_starts_in_segments lief.MachO.DyldChainedFixups.it_chained_starts_in_segments_t

Iterator over the chained fixup metadata, chained_starts_in_segment

property data_offset int

Offset of the LC_DYLD_CHAINED_FIXUPS chained payload. This offset should point in the __LINKEDIT segment

property data_size int

Size of the LC_DYLD_CHAINED_FIXUPS payload

property fixups_version int

Chained fixups version. The loader (as far of dyld v852.2) checks that this value is set to 0.

property imports_count int

Number of imported symbol names

property imports_format lief.MachO.DYLD_CHAINED_FORMAT

The format of the imports (ChainedBindingInfo)

property imports_offset int

Offset of imports table in chain data

class it_binding_info

Bases: object

Iterator over lief._lief.MachO.ChainedBindingInfo

class it_chained_starts_in_segments_t

Bases: object

Iterator over lief._lief.MachO.chained_starts_in_segment

property payload memoryview

Return the raw content of the command

property starts_offset int

offset of dyld_chained_starts_in_image in chain_data

property symbols_format int

The compression algorithm (if any) used to store the symbols 0 means uncompressed while 1 means zlib compressed.

As far of the version v852.2 of dyld loader, it only supports uncompressed format

property symbols_offset int

Offset of symbol strings in chain data


DyldExportsTrie Command

Inheritance diagram of lief._lief.MachO.DyldExportsTrie
class lief.MachO.DyldExportsTrie

Bases: LoadCommand

Class that represents the LC_DYLD_EXPORTS_TRIE command

In recent Mach-O binaries, this command replace the DyldInfo export trie buffer

property content memoryview

The raw export trie

property data_offset int

Offset of the trie in the binary. This offset should point in the __LINKEDIT

property data_size int

Raw size of the trie

property exports lief.MachO.DyldExportsTrie.it_export_info

Iterator over the ExportInfo associated with this trie.

class it_export_info

Bases: object

Iterator over lief._lief.MachO.ExportInfo

show_export_trie(self) str

Show the trie in a humman-readable way


Code Signature Dir Command

Inheritance diagram of lief._lief.MachO.CodeSignatureDir
class lief.MachO.CodeSignatureDir

Bases: LoadCommand

property content memoryview

The raw signature as a bytes stream

property data_offset int

Offset in the binary where the signature starts

property data_size int

Size of the raw signature


Two Level Hints

Inheritance diagram of lief._lief.MachO.TwoLevelHints
class lief.MachO.TwoLevelHints

Bases: LoadCommand

Class which represents the LC_TWOLEVEL_HINTS command

property content memoryview

The original content as a bytes stream

property hints lief.MachO.TwoLevelHints.it_hints_t
class it_hints_t

Bases: object


Linker Optimization Hint

Inheritance diagram of lief._lief.MachO.LinkerOptHint
class lief.MachO.LinkerOptHint

Bases: LoadCommand

Class which represents the LC_LINKER_OPTIMIZATION_HINT command

property content memoryview

The raw payload

property data_offset int

Offset in the binary where the payload starts

property data_size int

Size of the raw payload


UnknownCommand

Inheritance diagram of lief._lief.MachO.UnknownCommand
class lief.MachO.UnknownCommand

Bases: LoadCommand

Generic class when the command is not recognized by LIEF

property original_command int

Stub

class lief.MachO.Stub(self, target_info: lief._lief.MachO.Stub.target_info_t, address: int, raw_stub: list[int])

Bases: object

This class represents a stub entry in sections like __stubs,__auth_stubs.

It wraps assembly instructions which are used to access the got where the address of the symbol is resolved.

Example:

0000000236a3c1bc: ___memcpy_chk
  adrp            x17, #0x241513aa8
  add             x17, x17, #0x241513aa8
  ldr             x16, [x17]
  braa            x16, x17
property address int

The virtual address where the stub is located

property raw memoryview

The (raw) instructions of this entry as a memory view of bytes

property target int | lief.lief_errors

The address resolved by this stub.

For instance, given this stub:

0x3eec: adrp    x16, #4096
0x3ef0: ldr     x16, [x16, #24]
0x3ef4: br      x16

The function returns: 0x4018.

Warning

This function is only available with LIEF’s extended version

class target_info_t(self)
class target_info_t(self, arg0: lief._lief.MachO.Header.CPU_TYPE, arg1: int, /)

Bases: object

property arch lief.MachO.Header.CPU_TYPE
property subtype int

Builder

class lief.MachO.Builder

Bases: object

Class used to reconstruct a Mach-O binary from its object representation

class config_t(self)

Bases: object

Interface to tweak the Builder

property linkedit bool
write(*args) lief.ok_t | lief.lief_errors = <nanobind.nb_func object at 0x1953d40>

Enums

MACHO_TYPES

class lief.MachO.MACHO_TYPES

Bases: object

CIGAM = lief._lief.MachO.MACHO_TYPES.CIGAM
CIGAM_64 = lief._lief.MachO.MACHO_TYPES.CIGAM_64
FAT_CIGAM = lief._lief.MachO.MACHO_TYPES.FAT_CIGAM
FAT_MAGIC = lief._lief.MachO.MACHO_TYPES.FAT_MAGIC
MAGIC = lief._lief.MachO.MACHO_TYPES.MAGIC
MAGIC_64 = lief._lief.MachO.MACHO_TYPES.MAGIC_64
NEURAL_MODEL = lief._lief.MachO.MACHO_TYPES.NEURAL_MODEL
from_value(arg: int) lief.MachO.MACHO_TYPES = <nanobind.nb_func object>
property value int

The underlying integer value


X86_RELOCATION

class lief.MachO.X86_RELOCATION

Bases: object

LOCAL_SECTDIFF = lief._lief.MachO.X86_RELOCATION.LOCAL_SECTDIFF
PAIR = lief._lief.MachO.X86_RELOCATION.PAIR
PB_LA_PTR = lief._lief.MachO.X86_RELOCATION.PB_LA_PTR
SECTDIFF = lief._lief.MachO.X86_RELOCATION.SECTDIFF
TLV = lief._lief.MachO.X86_RELOCATION.TLV
VANILLA = lief._lief.MachO.X86_RELOCATION.VANILLA
from_value(arg: int) lief.MachO.X86_RELOCATION = <nanobind.nb_func object>
property value int

The underlying integer value


X86_64_RELOCATION

class lief.MachO.X86_64_RELOCATION

Bases: object

BRANCH = lief._lief.MachO.X86_64_RELOCATION.BRANCH
GOT = lief._lief.MachO.X86_64_RELOCATION.GOT
GOT_LOAD = lief._lief.MachO.X86_64_RELOCATION.GOT_LOAD
SIGNED = lief._lief.MachO.X86_64_RELOCATION.SIGNED
SIGNED_1 = lief._lief.MachO.X86_64_RELOCATION.SIGNED_1
SIGNED_2 = lief._lief.MachO.X86_64_RELOCATION.SIGNED_2
SIGNED_4 = lief._lief.MachO.X86_64_RELOCATION.SIGNED_4
SUBTRACTOR = lief._lief.MachO.X86_64_RELOCATION.SUBTRACTOR
TLV = lief._lief.MachO.X86_64_RELOCATION.TLV
UNSIGNED = lief._lief.MachO.X86_64_RELOCATION.UNSIGNED
from_value(arg: int) lief.MachO.X86_64_RELOCATION = <nanobind.nb_func object>
property value int

The underlying integer value


PPC_RELOCATION

class lief.MachO.PPC_RELOCATION

Bases: object

BR14 = lief._lief.MachO.PPC_RELOCATION.BR14
BR24 = lief._lief.MachO.PPC_RELOCATION.BR24
HA16 = lief._lief.MachO.PPC_RELOCATION.HA16
HA16_SECTDIFF = lief._lief.MachO.PPC_RELOCATION.HA16_SECTDIFF
HI16 = lief._lief.MachO.PPC_RELOCATION.HI16
HI16_SECTDIFF = lief._lief.MachO.PPC_RELOCATION.HI16_SECTDIFF
JBSR = lief._lief.MachO.PPC_RELOCATION.JBSR
LO14 = lief._lief.MachO.PPC_RELOCATION.LO14
LO14_SECTDIFF = lief._lief.MachO.PPC_RELOCATION.LO14_SECTDIFF
LO16 = lief._lief.MachO.PPC_RELOCATION.LO16
LO16_SECTDIFF = lief._lief.MachO.PPC_RELOCATION.LO16_SECTDIFF
LOCAL_SECTDIFF = lief._lief.MachO.PPC_RELOCATION.LOCAL_SECTDIFF
PAIR = lief._lief.MachO.PPC_RELOCATION.PAIR
PB_LA_PTR = lief._lief.MachO.PPC_RELOCATION.PB_LA_PTR
SECTDIFF = lief._lief.MachO.PPC_RELOCATION.SECTDIFF
VANILLA = lief._lief.MachO.PPC_RELOCATION.VANILLA
from_value(arg: int) lief.MachO.PPC_RELOCATION = <nanobind.nb_func object>
property value int

The underlying integer value


ARM_RELOCATION

class lief.MachO.ARM_RELOCATION

Bases: object

BR24 = lief._lief.MachO.ARM_RELOCATION.BR24
HALF = lief._lief.MachO.ARM_RELOCATION.HALF
HALF_SECTDIFF = lief._lief.MachO.ARM_RELOCATION.HALF_SECTDIFF
LOCAL_SECTDIFF = lief._lief.MachO.ARM_RELOCATION.LOCAL_SECTDIFF
PAIR = lief._lief.MachO.ARM_RELOCATION.PAIR
PB_LA_PTR = lief._lief.MachO.ARM_RELOCATION.PB_LA_PTR
SECTDIFF = lief._lief.MachO.ARM_RELOCATION.SECTDIFF
THUMB_32BIT_BRANCH = lief._lief.MachO.ARM_RELOCATION.THUMB_32BIT_BRANCH
THUMB_RELOC_BR22 = lief._lief.MachO.ARM_RELOCATION.THUMB_RELOC_BR22
VANILLA = lief._lief.MachO.ARM_RELOCATION.VANILLA
from_value(arg: int) lief.MachO.ARM_RELOCATION = <nanobind.nb_func object>
property value int

The underlying integer value


ARM64_RELOCATION

class lief.MachO.ARM64_RELOCATION

Bases: object

ADDEND = lief._lief.MachO.ARM64_RELOCATION.ADDEND
BRANCH26 = lief._lief.MachO.ARM64_RELOCATION.BRANCH26
GOT_LOAD_PAGE21 = lief._lief.MachO.ARM64_RELOCATION.GOT_LOAD_PAGE21
GOT_LOAD_PAGEOFF12 = lief._lief.MachO.ARM64_RELOCATION.GOT_LOAD_PAGEOFF12
PAGE21 = lief._lief.MachO.ARM64_RELOCATION.PAGE21
PAGEOFF12 = lief._lief.MachO.ARM64_RELOCATION.PAGEOFF12
POINTER_TO_GOT = lief._lief.MachO.ARM64_RELOCATION.POINTER_TO_GOT
SUBTRACTOR = lief._lief.MachO.ARM64_RELOCATION.SUBTRACTOR
TLVP_LOAD_PAGE21 = lief._lief.MachO.ARM64_RELOCATION.TLVP_LOAD_PAGE21
TLVP_LOAD_PAGEOFF12 = lief._lief.MachO.ARM64_RELOCATION.TLVP_LOAD_PAGEOFF12
UNSIGNED = lief._lief.MachO.ARM64_RELOCATION.UNSIGNED
from_value(arg: int) lief.MachO.ARM64_RELOCATION = <nanobind.nb_func object>
property value int

The underlying integer value

DYLD_CHAINED_FORMAT

class lief.MachO.DYLD_CHAINED_FORMAT

Bases: object

IMPORT = lief._lief.MachO.DYLD_CHAINED_FORMAT.IMPORT
IMPORT_ADDEND = lief._lief.MachO.DYLD_CHAINED_FORMAT.IMPORT_ADDEND
IMPORT_ADDEND64 = lief._lief.MachO.DYLD_CHAINED_FORMAT.IMPORT_ADDEND64
from_value(arg: int) lief.MachO.DYLD_CHAINED_FORMAT = <nanobind.nb_func object>
property value int

The underlying integer value

DYLD_CHAINED_PTR_FORMAT

class lief.MachO.DYLD_CHAINED_PTR_FORMAT

Bases: object

NONE = lief._lief.MachO.DYLD_CHAINED_PTR_FORMAT.NONE
PTR_32 = lief._lief.MachO.DYLD_CHAINED_PTR_FORMAT.PTR_32
PTR_32_CACHE = lief._lief.MachO.DYLD_CHAINED_PTR_FORMAT.PTR_32_CACHE
PTR_32_FIRMWARE = lief._lief.MachO.DYLD_CHAINED_PTR_FORMAT.PTR_32_FIRMWARE
PTR_64 = lief._lief.MachO.DYLD_CHAINED_PTR_FORMAT.PTR_64
PTR_64_KERNEL_CACHE = lief._lief.MachO.DYLD_CHAINED_PTR_FORMAT.PTR_64_KERNEL_CACHE
PTR_64_OFFSET = lief._lief.MachO.DYLD_CHAINED_PTR_FORMAT.PTR_64_OFFSET
PTR_ARM64E = lief._lief.MachO.DYLD_CHAINED_PTR_FORMAT.PTR_ARM64E
PTR_ARM64E_FIRMWARE = lief._lief.MachO.DYLD_CHAINED_PTR_FORMAT.PTR_ARM64E_FIRMWARE
PTR_ARM64E_KERNEL = lief._lief.MachO.DYLD_CHAINED_PTR_FORMAT.PTR_ARM64E_KERNEL
PTR_ARM64E_USERLAND = lief._lief.MachO.DYLD_CHAINED_PTR_FORMAT.PTR_ARM64E_USERLAND
PTR_ARM64E_USERLAND24 = lief._lief.MachO.DYLD_CHAINED_PTR_FORMAT.PTR_ARM64E_USERLAND24
PTR_X86_64_KERNEL_CACHE = lief._lief.MachO.DYLD_CHAINED_PTR_FORMAT.PTR_X86_64_KERNEL_CACHE
from_value(arg: int) lief.MachO.DYLD_CHAINED_PTR_FORMAT = <nanobind.nb_func object>
property value int

The underlying integer value