Python¶

Parser¶

Parse the given binary from the given input and return a FatBinary object

One can configure the parser with the config parameter. See ParserConfig

class lief.MachO.ParserConfig(self)¶

Bases: object

This class is used to tweak the MachO Parser (Parser)

deep = <lief._lief.MachO.ParserConfig object>¶

property fix_from_memory → bool¶

When parsing Mach-O from memory, this option can be used to undo relocations and symbols bindings.

When activated, this option requires parse_dyld_bindings and parse_dyld_rebases to be enabled.

property from_dyld_shared_cache → bool¶: Whether the binary is coming/extracted from Dyld shared cache

full_dyldinfo(self, flag: bool) → lief._lief.MachO.ParserConfig¶: If flag is set to true, Exports, Bindings and Rebases opcodes are parsed.

Warning
Enabling this flag can slow down the parsing

property parse_dyld_bindings → bool¶: Parse the Dyld binding opcodes

property parse_dyld_exports → bool¶: Parse the Dyld export trie

property parse_dyld_rebases → bool¶: Parse the Dyld rebase opcodes

quick = <lief._lief.MachO.ParserConfig object>¶

fatbinary_1 = lief.MachO.parse("/usr/bin/ls", config=lief.MachO.ParserConfig.deep)
# or
fatbinary_2 = lief.MachO.parse("/usr/bin/ls", config=lief.MachO.ParserConfig.quick)

FatBinary¶

class lief.MachO.FatBinary¶

Bases: object

Class which represents a Mach-O (fat) binary This object is also used for representing Mach-O binaries that are NOT FAT

at(self, index: int) → lief._lief.MachO.Binary | None¶: Return the Binary at the given index or None if it is not present

create(binaries: collections.abc.Sequence[lief.MachO.Binary | None]) → lief.MachO.FatBinary | None = <nanobind.nb_func object>¶

get(self, arg: lief._lief.MachO.Header.CPU_TYPE, /) → lief._lief.MachO.Binary | None¶: Gets the Binary that matches the given architecture

raw(self) → list[int]¶: Build a Mach-O universal binary and return its bytes

property size → int¶: Number of Binary registered

take(self, cpu: lief._lief.MachO.Header.CPU_TYPE) → lief._lief.MachO.Binary | None¶: Return the Binary that matches the given CPU_TYPE

write(self, filename: str | os.PathLike) → None¶: Build a Mach-O universal binary

Binary¶

class lief.MachO.Binary¶

Bases: Binary

Class which represents a MachO binary

add(self, dylib_command: lief._lief.MachO.DylibCommand) → lief._lief.MachO.LoadCommand | None¶

add(self, segment: lief._lief.MachO.SegmentCommand) → lief._lief.MachO.LoadCommand | None

add(self, load_command: lief._lief.MachO.LoadCommand) → lief._lief.MachO.LoadCommand | None

add(self, load_command: lief._lief.MachO.LoadCommand, index: int) → lief._lief.MachO.LoadCommand | None

Overloaded function.

add(self, dylib_command: lief._lief.MachO.DylibCommand) -> lief._lief.MachO.LoadCommand | None

Add a new DylibCommand

add(self, segment: lief._lief.MachO.SegmentCommand) -> lief._lief.MachO.LoadCommand | None

Add a new SegmentCommand

add(self, load_command: lief._lief.MachO.LoadCommand) -> lief._lief.MachO.LoadCommand | None

Add a new LoadCommand

add(self, load_command: lief._lief.MachO.LoadCommand, index: int) -> lief._lief.MachO.LoadCommand | None

Add a new LoadCommand at index

add_exported_function(self, address: int, name: str) → lief._lief.MachO.ExportInfo | None¶: Add a new export in the binary

add_library(self, library_name: str) → lief._lief.MachO.LoadCommand | None¶: Add a new library dependency

add_local_symbol(self, address: int, name: str) → lief._lief.MachO.Symbol | None¶: Add a new symbol in the LC_SYMTAB

add_section(self, segment: lief._lief.MachO.SegmentCommand, section: lief._lief.MachO.Section) → lief._lief.MachO.Section | None¶

add_section(self, section: lief._lief.MachO.Section) → lief._lief.MachO.Section | None

Overloaded function.

add_section(self, segment: lief._lief.MachO.SegmentCommand, section: lief._lief.MachO.Section) -> lief._lief.MachO.Section | None

Add a new Section in the given SegmentCommand

add_section(self, section: lief._lief.MachO.Section) -> lief._lief.MachO.Section | None

Add a new Section within the __TEXT segment

property atom_info → lief.MachO.AtomInfo | None¶: Return the binary’s AtomInfo if any, or None

property available_command_space → int¶

property bindings → Iterator[lief.MachO.BindingInfo]¶: Return an iterator over the binding info which can come from either DyldInfo or DyldChainedFixups commands.

property build_version → lief.MachO.BuildVersion | None¶: Return the binary’s BuildVersion if any, or None

can_remove(self, symbol: lief._lief.MachO.Symbol) → bool¶: Check if the given symbol can be safely removed.

can_remove_symbol(self, symbol_name: str) → bool¶: Check if the given symbol name can be safely removed.

property code_signature → lief.MachO.CodeSignature | None¶: Return the binary’s CodeSignature if any, or None

property code_signature_dir → lief.MachO.CodeSignatureDir | None¶: Return the binary’s CodeSignatureDir if any, or None

property commands → lief.MachO.Binary.it_commands¶: Return an iterator over the binary’s Command

property data_in_code → lief.MachO.DataInCode | None¶: Return the binary’s DataInCode if any, or None

property dyld_chained_fixups → lief.MachO.DyldChainedFixups | None¶: Return the binary’s DyldChainedFixups if any, or None

property dyld_environment → lief.MachO.DyldEnvironment | None¶: Return the binary’s DyldEnvironment if any, or None

property dyld_exports_trie → lief.MachO.DyldExportsTrie | None¶: Return the binary’s DyldExportsTrie if any, or None

property dyld_info → lief.MachO.DyldInfo | None¶: Return the binary’s DyldInfo if any, or None

property dylinker → lief.MachO.DylinkerCommand | None¶: Return the binary’s DylinkerCommand if any, or None

property dynamic_symbol_command → lief.MachO.DynamicSymbolCommand | None¶: Return the binary’s DynamicSymbolCommand if any, or None

property encryption_info → lief.MachO.EncryptionInfo | None¶: Return the binary’s EncryptionInfo if any, or None

property exported_symbols → lief.MachO.Binary.it_filter_symbols¶: Return the binary’s Symbol which are exported

extend(self, load_command: lief._lief.MachO.LoadCommand, size: int) → bool¶: Extend a LoadCommand by size

extend_section(self, section: lief._lief.MachO.Section, size: int) → bool¶: Extend the content of the given Section by size

extend_segment(self, segment_command: lief._lief.MachO.SegmentCommand, size: int) → bool¶: Extend the content of the given SegmentCommand by size

property fat_offset → int¶: Return binary’s fat offset. 0 if not relevant.

property fileset_addr → int¶: Original address associated with the LC_FILESET_ENTRY for this MachO.

property fileset_name → str¶: Name associated with the LC_FILESET_ENTRY for this MachO. For instance: com.apple.kec.corecrypto

property filesets → lief.MachO.FatBinary.it_binaries¶: Return binary’s Filesets

find_library(self, name: str) → lief._lief.MachO.DylibCommand | None¶

Try to find the library with the given library name.

This function tries to match the fullpath of the DylibCommand or the library name suffix.

property function_starts → lief.MachO.FunctionStarts | None¶: Return the binary’s FunctionStarts if any, or None

property function_variant_fixups → lief.MachO.FunctionVariantFixups | None¶: Return LC_FUNCTION_VARIANT_FIXUPS command

property function_variants → lief.MachO.FunctionVariants | None¶: Return LC_FUNCTION_VARIANTS command

property functions → list[lief.Function]¶: Return list of all Function found

get(self, type: lief._lief.MachO.LoadCommand.TYPE) → lief._lief.MachO.LoadCommand | None¶: Return the first LoadCommand with the given TYPE or None if it is not present.

get_section(self, name: str) → lief._lief.MachO.Section | None¶

get_section(self, segname: str, secname: str) → lief._lief.MachO.Section | None

Overloaded function.

get_section(self, name: str) -> lief._lief.MachO.Section | None

Return the section from the given name or None if the section does not exist

get_section(self, segname: str, secname: str) -> lief._lief.MachO.Section | None

Return the section from the segment with the name given in the first parameter and with the section’s name provided in the second parameter. If the section cannot be found, it returns a nullptr

get_segment(self, name: str) → lief._lief.MachO.SegmentCommand | None¶: Return the SegmentCommand from the given name

get_symbol(self, name: str) → lief._lief.MachO.Symbol | None¶: Return the Symbol from the given name

has(self, type: lief._lief.MachO.LoadCommand.TYPE) → bool¶: Check if the current binary has a LoadCommand with the given TYPE

property has_atom_info → bool¶: True if the binary embeds the LC_ATOM_INFO command (AtomInfo)

property has_build_version → bool¶: True if the binary has a BuildVersion command

property has_code_signature → bool¶: True if the binary is signed (i.e. has a CodeSignature command)

property has_code_signature_dir → bool¶: True if the binary is signed (i.e. has a CodeSignatureDir command) with the command LC_DYLIB_CODE_SIGN_DRS

property has_data_in_code → bool¶: True if the binary has a DataInCode command

property has_dyld_chained_fixups → bool¶: True if the binary has a DyldChainedFixups command

property has_dyld_environment → bool¶: True if the binary has a DyldEnvironment command

property has_dyld_exports_trie → bool¶: True if the binary has a DyldExportsTrie command

property has_dyld_info → bool¶: True if the binary has a DyldInfo command.

property has_dylinker → bool¶: True if the binary has a DylinkerCommand command.

property has_dynamic_symbol_command → bool¶: True if the binary has a DynamicSymbolCommand command.

property has_encryption_info → bool¶: True if the binary has a EncryptionInfo command

property has_entrypoint → bool¶

True if the binary has an entrypoint.

Basically for libraries it will return false

property has_filesets → bool¶: Return True if the binary has filesets

property has_function_starts → bool¶: True if the binary has a FunctionStarts command.

property has_function_variant_fixups → bool¶: True if the binary has a LC_FUNCTION_VARIANT_FIXUPS command

property has_function_variants → bool¶: True if the binary has a LC_FUNCTION_VARIANTS command

property has_linker_opt_hint → bool¶: True if the binary embeds the Linker optimization hint command (LinkerOptHint)

property has_main_command → bool¶: True if the binary has a MainCommand command.

property has_notes → bool¶: True if the binary contains LC_NOTE command(s)

property has_nx_heap → bool¶: Return True if the heap is flagged as non-executable. False otherwise.

property has_nx_stack → bool¶: Return True if the stack is flagged as non-executable. False otherwise.

property has_routine_command → bool¶: True if the binary has a Routine command.

property has_rpath → bool¶: True if the binary has a RPathCommand command.

has_section(self, name: str) → bool¶: Check if a section with the given name exists

has_segment(self, name: str) → bool¶: Check if a SegmentCommand with the given name exists

property has_segment_split_info → bool¶: True if the binary has a SegmentSplitInfo command

property has_source_version → bool¶: True if the binary has a SourceVersion command.

property has_sub_framework → bool¶: True if the binary has a SubFramework command

property has_subclients → bool¶: True if the binary has a SubClient command

has_symbol(self, name: str) → bool¶: Check if a Symbol with the given name exists

property has_symbol_command → bool¶: True if the binary has a SymbolCommand command.

property has_thread_command → bool¶: True if the binary has a ThreadCommand command.

property has_two_level_hints → bool¶: True if the binary embeds the Two Level Hint command (TwoLevelHints)

property has_uuid → bool¶: True if the binary has a UUIDCommand command.

property has_version_min → bool¶: True if the binary has a VersionMin command.

property header → lief.MachO.Header¶: Return binary’s Header

property imagebase → int¶: Return the binary’s imagebase which is the base address where segments are mapped (without the ASLR). 0 if not relevant.

property imported_symbols → lief.MachO.Binary.it_filter_symbols¶: Return the binary’s Symbol which are imported

property is_ios → bool¶: True if this binary targets iOS

property is_macos → bool¶: True if this binary targets macOS

is_valid_addr(self, address: int) → bool¶

Check if the given address is encompassed between the range of virtual addresses.

See: va_ranges

property lazy_load_dylib_infos → lief.MachO.Binary.it_lazy_load_dylib_info¶: Return an iterator over the binary’s LazyLoadDylibInfo

property libraries → lief.MachO.Binary.it_libraries¶: Return an iterator over the binary’s DylibCommand

property linker_opt_hint → lief.MachO.LinkerOptHint | None¶: Return the binary’s LinkerOptHint if any, or None

property main_command → lief.MachO.MainCommand | None¶: Return the binary’s MainCommand if any, or None

property notes → lief.MachO.Binary.it_notes¶: Iterator over the different LC_NOTE commands

property objc_metadata → lief.objc.Metadata | None¶: Return Objective-C metadata info if present

Warning
This is only available with the extended version of LIEF.

property off_ranges → lief.MachO.Binary.range_t¶: Return the range of offsets as a tuple (off_start, off_end)

property overlay → memoryview¶

property platform → lief.MachO.BuildVersion.PLATFORMS¶: Return the platform for which this Mach-O has been compiled

class range_t¶

Bases: object

property end → int¶

property start → int¶

property relocations → lief.MachO.Binary.it_relocations¶: Return an iterator over binary’s Relocation

remove(self, load_command: lief._lief.MachO.LoadCommand) → bool¶

remove(self, type: lief._lief.MachO.LoadCommand.TYPE) → bool

remove(self, symbol: lief._lief.MachO.Symbol) → bool

Overloaded function.

remove(self, load_command: lief._lief.MachO.LoadCommand) -> bool

Remove a LoadCommand

remove(self, type: lief._lief.MachO.LoadCommand.TYPE) -> bool

Remove all the LoadCommand with the given TYPE

remove(self, symbol: lief._lief.MachO.Symbol) -> bool

Remove the given Symbol

remove_command(self, index: int) → bool¶: Remove the LoadCommand at the given index

remove_section(self, name: str, clear: bool = False) → None¶

remove_section(self, segname: str, secname: str, clear: bool = False) → None

Overloaded function.

remove_section(self, name: str, clear: bool = False) -> None

Remove the section with the given name

remove_section(self, segname: str, secname: str, clear: bool = False) -> None

Remove the section from the segment with the name given in the first parameter and with the section’s name provided in the second parameter.

remove_signature(self) → bool¶: Remove the CodeSignature (if any)

remove_symbol(self, name: str) → bool¶: Remove all symbol(s) with the given name

property routine_command → lief.MachO.Routine | None¶: Return the binary’s Routine if any, or None

property rpath → lief.MachO.RPathCommand | None¶: Return the binary’s RPathCommand if any, or None

property rpaths → lief.MachO.Binary.it_rpaths¶: Return an iterator over the binary’s RPathCommand

section_from_offset(self, arg: int, /) → lief._lief.MachO.Section | None¶: Return the Section which encompasses the offset

section_from_virtual_address(self, arg: int, /) → lief._lief.MachO.Section | None¶: Return the Section which encompasses the virtual address

property sections → lief.MachO.Binary.it_sections¶: Return an iterator over the binary’s Section

segment_from_offset(self, arg: int, /) → lief._lief.MachO.SegmentCommand | None¶: Return the SegmentCommand which encompasses the offset

segment_from_virtual_address(self, arg: int, /) → lief._lief.MachO.SegmentCommand | None¶: Return the SegmentCommand which encompasses the virtual address

property segment_split_info → lief.MachO.SegmentSplitInfo | None¶: Return the binary’s SegmentSplitInfo if any, or None

property segments → lief.MachO.Binary.it_segments¶: Return an iterator over the binary’s SegmentCommand

shift(self, value: int) → lief._lief.ok_t | lief._lief.lief_errors¶: Shift the content located right after the Load commands table. This operation can be used to add a new command

shift_linkedit(self, value: int) → lief._lief.ok_t | lief._lief.lief_errors¶: Shift the position on the __LINKEDIT data by width

property source_version → lief.MachO.SourceVersion | None¶: Return the binary’s SourceVersion if any, or None

property sub_framework → lief.MachO.SubFramework | None¶: Return the binary’s SubFramework if any, or None

property subclients → lief.MachO.Binary.it_sub_clients¶: Return an iterator over the binary’s SubClient

property support_arm64_ptr_auth → bool¶: Check if the binary is supporting ARM64 pointer authentication (arm64e)

property symbol_command → lief.MachO.SymbolCommand | None¶: Return the binary’s SymbolCommand if any, or None

property symbol_stubs → collections.abc.Sequence[lief.MachO.Stub]¶

Return an iterator over the symbol stubs.

These stubs are involved when calling an imported function and are similar to the ELF’s plt/got mechanism.

There are located in sections like: __stubs,__auth_stubs,__symbol_stub,__picsymbolstub4

property symbols → lief.MachO.Binary.it_symbols¶: Return an iterator over the binary’s Symbol

property thread_command → lief.MachO.ThreadCommand | None¶: Return the binary’s ThreadCommand if any, or None

property tlv_initial_content_range → lief.MachO.Binary.range_t¶: Return the TLV initial content range

property two_level_hints → lief.MachO.TwoLevelHints | None¶: Return the binary’s TwoLevelHints if any, or None

unexport(self, name: str) → bool¶
unexport(self, symbol: lief._lief.MachO.Symbol) → bool: Remove the symbol from the export table

property unwind_functions → list[lief.Function]¶: Return list of Function found in the __unwind_info section

property uuid → lief.MachO.UUIDCommand | None¶: Return the binary’s UUIDCommand if any, or None

property va_ranges → lief.MachO.Binary.range_t¶: Return the range of virtual addresses as a tuple (va_start, va_end)

property version_min → lief.MachO.VersionMin | None¶: Return the binary’s VersionMin if any, or None

virtual_address_to_offset(self, virtual_address: int) → int | lief._lief.lief_errors¶: Convert the virtual address to an offset in the binary

property virtual_size → int¶: Binary’s memory size when mapped

write(self, output: str | os.PathLike) → None¶

write(self, output: str | os.PathLike, config: lief._lief.MachO.Builder.config_t) → None

Overloaded function.

write(self, output: Union[str | os.PathLike]) -> None

Rebuild the binary and write its content in the file given in the first parameter

write(self, output: Union[str | os.PathLike], config: lief._lief.MachO.Builder.config_t) -> None

Rebuild the binary and write its content in the file given in the first parameter. The config parameter can be used to tweak the building process.

write_to_bytes(self, config: lief._lief.MachO.Builder.config_t) → bytes¶
write_to_bytes(self) → bytes

Header¶

class lief.MachO.Header(self)¶

Bases: Object

Class that represents the Mach-O header

class CPU_TYPE(*values)¶

Bases: Enum

AIR64 = 16777239¶

ALPHA = 16¶

AMD_GPU = 16777236¶

ANY = -1¶

APPLE_GPU = 16777235¶

ARM = 12¶

ARM64 = 16777228¶

HPPA = 11¶

I860 = 15¶

INTEL_GPU = 16777237¶

MC88000 = 13¶

MC98000 = 10¶

MIPS = 8¶

POWERPC = 18¶

POWERPC64 = 16777234¶

SPARC = 14¶

X86 = 7¶

X86_64 = 16777223¶

from_value(arg: int) → lief.MachO.Header.CPU_TYPE = <nanobind.nb_func object>¶

class FILE_TYPE(*values)¶

Bases: Enum

BUNDLE = 8¶

CORE = 4¶

DSYM = 10¶

DYLIB = 6¶

DYLIB_STUB = 9¶

DYLINKER = 7¶

EXECUTE = 2¶

FILESET = 12¶

FVMLIB = 3¶

GPU_DYLIB = 14¶

GPU_EXECUTE = 13¶

KEXT_BUNDLE = 11¶

OBJECT = 1¶

PRELOAD = 5¶

UNKNOWN = 0¶

from_value(arg: int) → lief.MachO.Header.FILE_TYPE = <nanobind.nb_func object>¶

class FLAGS(*values)¶

Bases: Flag

ALLMODSBOUND = 4096¶

ALLOW_STACK_EXECUTION = 131072¶

APP_EXTENSION_SAFE = 33554432¶

BINDATLOAD = 8¶

BINDS_TO_WEAK = 65536¶

CANONICAL = 16384¶

DEAD_STRIPPABLE_DYLIB = 4194304¶

DYLDLINK = 4¶

DYLIB_IN_CACHE = 2147483648¶

FORCE_FLAT = 256¶

HAS_TLV_DESCRIPTORS = 8388608¶

IMPLICIT_PAGEZERO = 268435456¶

INCRLINK = 2¶

LAZY_INIT = 64¶

NLIST_OUTOFSYNC_WITH_DYLDINFO = 67108864¶

NOFIXPREBINDING = 1024¶

NOMULTIDEFS = 512¶

NOUNDEFS = 1¶

NO_HEAP_EXECUTION = 16777216¶

NO_REEXPORTED_DYLIBS = 1048576¶

PIE = 2097152¶

PREBINDABLE = 2048¶

PREBOUND = 16¶

ROOT_SAFE = 262144¶

SETUID_SAFE = 524288¶

SIM_SUPPORT = 134217728¶

SPLIT_SEGS = 32¶

SUBSECTIONS_VIA_SYMBOLS = 8192¶

TWOLEVEL = 128¶

WEAK_DEFINES = 32768¶

from_value(arg: int) → lief.MachO.Header.FLAGS = <nanobind.nb_func object>¶

add(self, flag: lief._lief.MachO.Header.FLAGS) → None¶: Add the given FLAGS

property cpu_subtype → int¶: Return the CPU subtype supported by the Mach-O binary. For ARM architectures, this value could represent the minimum version for which the Mach-O binary has been compiled for.

property cpu_type → lief.MachO.Header.CPU_TYPE¶: Target CPU

property file_type → lief.MachO.Header.FILE_TYPE¶: Binary’s type

property flags → int¶: Binary’s flags

property flags_list → list[lief.MachO.Header.FLAGS]¶: FLAGS as a list

has(self, flag: lief._lief.MachO.Header.FLAGS) → bool¶: True if the given FLAGS is in the flags

property is_32bit → bool¶: True if the binary is 32-bits

property is_64bit → bool¶: True if the binary is 64-bits

property magic → lief.MachO.MACHO_TYPES¶: The Mach-O magic bytes. These bytes determine whether it is a 32 bits Mach-O, a 64 bits Mach-O files etc.

property nb_cmds → int¶: Number of LoadCommand

remove(self, flag: lief._lief.MachO.Header.FLAGS) → None¶: Remove the given FLAGS

property reserved → int¶: According to the official documentation, a reserved value

property sizeof_cmds → int¶: Size of all LoadCommand

Section¶

class lief.MachO.Section¶

Bases: Section

Class that represents a Mach-O section

class FLAGS(*values)¶

Bases: Flag

DEBUG_INFO = 33554432¶

EXT_RELOC = 512¶

LIVE_SUPPORT = 134217728¶

LOC_RELOC = 256¶

NO_DEAD_STRIP = 268435456¶

NO_TOC = 1073741824¶

PURE_INSTRUCTIONS = 2147483648¶

SELF_MODIFYING_CODE = 67108864¶

SOME_INSTRUCTIONS = 1024¶

STRIP_STATIC_SYMS = 536870912¶

from_value(arg: int) → lief.MachO.Section.FLAGS = <nanobind.nb_func object>¶

class TYPE(*values)¶

Bases: Enum

COALESCED = 11¶

CSTRING_LITERALS = 2¶

DTRACE_DOF = 15¶

GB_ZEROFILL = 12¶

INIT_FUNC_OFFSETS = 22¶

INTERPOSING = 13¶

IS_16BYTE_LITERALS = 14¶

IS_4BYTE_LITERALS = 3¶

IS_8BYTE_LITERALS = 4¶

LAZY_DYLIB_SYMBOL_POINTERS = 16¶

LAZY_SYMBOL_POINTERS = 7¶

LITERAL_POINTERS = 5¶

MOD_INIT_FUNC_POINTERS = 9¶

MOD_TERM_FUNC_POINTERS = 10¶

NON_LAZY_SYMBOL_POINTERS = 6¶

REGULAR = 0¶

SYMBOL_STUBS = 8¶

THREAD_LOCAL_INIT_FUNCTION_POINTERS = 21¶

THREAD_LOCAL_REGULAR = 17¶

THREAD_LOCAL_VARIABLES = 19¶

THREAD_LOCAL_VARIABLE_POINTERS = 20¶

THREAD_LOCAL_ZEROFILL = 18¶

ZEROFILL = 1¶

from_value(arg: int) → lief.MachO.Section.TYPE = <nanobind.nb_func object>¶

add(self, flag: lief._lief.MachO.Section.FLAGS) → None¶: Add the given SECTION_FLAGS

property alignment → int¶: Section’s alignment as a power of 2

create(*args) → lief.MachO.Section | None = <nanobind.nb_func object>¶

property flags → lief.MachO.Section.FLAGS¶: Section’s flags masked with SECTION_FLAGS_MASK (see: FLAGS)

property flags_list → list[lief.MachO.Section.FLAGS]¶

has(self, flag: lief._lief.MachO.Section.FLAGS) → bool¶: Check if the section has the given SECTION_FLAGS

property has_segment → bool¶: True if the current section has a segment associated with

property numberof_relocations → int¶: Number of relocations associated with this section

property relocation_offset → int¶

Offset of the relocation table. This value should be 0 for executable and libraries as the relocations are managed by the lief.MachO.DyldInfo.rebase

On the other hand, for object files (.o) this value should not be 0

property relocations → lief.MachO.SegmentCommand.it_relocations¶: Iterator over the Relocation (if any)

remove(self, flag: lief._lief.MachO.Section.FLAGS) → None¶: Remove the given SECTION_FLAGS

property reserved1 → int¶: According to the official loader.h file, this value is reserved for offset or index

property reserved2 → int¶: According to the official loader.h file, this value is reserved for offset or index

property reserved3 → int¶: According to the official loader.h file, this value is reserved for offset or index

property segment → lief.MachO.SegmentCommand | None¶: SegmentCommand associated with the section or None if not present

property segment_name → str¶: The segment name associated with the section

property type → lief.MachO.Section.TYPE¶: Type of the section. This value can help to determine the purpose of the section (c.f. TYPE)

ThreadLocalVariables¶

class lief.MachO.ThreadLocalVariables¶

Bases: Section

This class represents a MachO section whose type is THREAD_LOCAL_VARIABLES.

It contains an array of thread-local variable descriptors (Thunk) used by dyld to lazily initialize thread-local storage on first access.

class Thunk(self)¶

class Thunk(self, func: int, key: int, offset: int)

Bases: object

Descriptor for a single thread-local variable.

The layout mirrors the tlv_descriptor structure from <mach-o/loader.h>.

property func → int¶: Address of the initializer function (tlv_thunk)

property key → int¶: pthread_key_t key used by the runtime

property offset → int¶: Offset of the variable in the TLS block

get(self, idx: int) → lief._lief.MachO.ThreadLocalVariables.Thunk | None¶: Return the Thunk at the given index, or None if the index is out of range.

property nb_thunks → int¶: Number of Thunk descriptors

set(self, idx: int, thunk: lief._lief.MachO.ThreadLocalVariables.Thunk) → None¶: Change the Thunk at the given index.

property thunks → collections.abc.Sequence[lief.MachO.ThreadLocalVariables.Thunk]¶: Return an iterator over the Thunk descriptors stored in this section.

SegmentCommand¶

class lief.MachO.SegmentCommand(self)¶

class lief.MachO.SegmentCommand(self, arg: str, /)

class lief.MachO.SegmentCommand(self, arg0: str, arg1: collections.abc.Sequence[int], /)

Bases: LoadCommand

Class which represents a SEGMENT / SEGMENT_64 command

class FLAGS(*values)¶

Bases: Enum

FVMLIB = 2¶

HIGHVM = 1¶

NORELOC = 4¶

PROTECTED_VERSION_1 = 8¶

READ_ONLY = 16¶

from_value(arg: int) → lief.MachO.SegmentCommand.FLAGS = <nanobind.nb_func object>¶

class VM_PROTECTIONS(*values)¶

Bases: Enum

R = 1¶

W = 2¶

X = 4¶

from_value(arg: int) → lief.MachO.SegmentCommand.VM_PROTECTIONS = <nanobind.nb_func object>¶

add_section(self, section: lief._lief.MachO.Section) → lief._lief.MachO.Section¶

property content → memoryview¶: Segment’s content

property file_offset → int¶: Segment’s file offset

property file_size → int¶: Segment’s file size

property flags → int¶: Segment’s flags

get_section(self, name: str) → lief._lief.MachO.Section | None¶: Get the Section with the given name

has(self, section: lief._lief.MachO.Section) → bool¶: Check if the given Section belongs to the current segment

has_section(self, section_name: str) → bool¶: Check if the given section name belongs to the current segment

property index → int¶: Relative index of the segment in the segment table

property init_protection → int¶: Segment’s initial protection

property max_protection → int¶: Segment’s max protection

property name → str | bytes¶: Segment’s name

property numberof_sections → int¶: Number of sections in this segment

property relocations → lief.MachO.SegmentCommand.it_relocations¶: Segment’s relocations

property sections → lief.MachO.SegmentCommand.it_sections¶: Segment’s sections

property virtual_address → int¶: Segment’s virtual address

property virtual_size → int¶: Segment’s virtual size

LoadCommand¶

Inheritance diagram of lief._lief.MachO.VersionMin, lief._lief.MachO.BuildVersion, lief._lief.MachO.ThreadCommand, lief._lief.MachO.DylinkerCommand, lief._lief.MachO.CodeSignatureDir, lief._lief.MachO.LinkerOptHint, lief._lief.MachO.RPathCommand, lief._lief.MachO.DyldInfo, lief._lief.MachO.Routine, lief._lief.MachO.DylibCommand, lief._lief.MachO.MainCommand, lief._lief.MachO.UUIDCommand, lief._lief.MachO.FunctionVariants, lief._lief.MachO.CodeSignature, lief._lief.MachO.SegmentSplitInfo, lief._lief.MachO.DyldEnvironment, lief._lief.MachO.DataInCode, lief._lief.MachO.FunctionVariantFixups, lief._lief.MachO.SourceVersion, lief._lief.MachO.LazyLoadDylibInfo, lief._lief.MachO.SegmentCommand, lief._lief.MachO.LinkEdit, lief._lief.MachO.FilesetCommand, lief._lief.MachO.DyldChainedFixups, lief._lief.MachO.DynamicSymbolCommand, lief._lief.MachO.AtomInfo, lief._lief.MachO.LoadCommand, lief._lief.MachO.DyldExportsTrie, lief._lief.MachO.TwoLevelHints, lief._lief.MachO.SymbolCommand, lief._lief.MachO.SubClient, lief._lief.MachO.NoteCommand, lief._lief.MachO.UnknownCommand, lief._lief.MachO.FunctionStarts, lief._lief.MachO.EncryptionInfo, lief._lief.MachO.SubFramework

class lief.MachO.LoadCommand(self)¶

Bases: Object

Base class for the Mach-O load commands

class TYPE(*values)¶

Bases: Enum

ATOM_INFO = 54¶

BUILD_VERSION = 50¶

CODE_SIGNATURE = 29¶

DATA_IN_CODE = 41¶

DYLD_CHAINED_FIXUPS = 2147483700¶

DYLD_ENVIRONMENT = 39¶

DYLD_EXPORTS_TRIE = 2147483699¶

DYLD_INFO = 34¶

DYLD_INFO_ONLY = 2147483682¶

DYLIB_CODE_SIGN_DRS = 43¶

DYSYMTAB = 11¶

ENCRYPTION_INFO = 33¶

ENCRYPTION_INFO_64 = 44¶

FILESET_ENTRY = 2147483701¶

FUNCTION_STARTS = 38¶

FUNCTION_VARIANTS = 55¶

FUNCTION_VARIANT_FIXUPS = 56¶

FVMFILE = 9¶

IDENT = 8¶

IDFVMLIB = 7¶

ID_DYLIB = 13¶

ID_DYLINKER = 15¶

LAZY_LOAD_DYLIB = 32¶

LAZY_LOAD_DYLIB_INFO = 58¶

LIEF_UNKNOWN = 4293787649¶

LINKER_OPTIMIZATION_HINT = 46¶

LINKER_OPTION = 45¶

LOADFVMLIB = 6¶

LOAD_DYLIB = 12¶

LOAD_DYLINKER = 14¶

LOAD_UPWARD_DYLIB = 2147483683¶

LOAD_WEAK_DYLIB = 2147483672¶

MAIN = 2147483688¶

NOTE = 49¶

PREBIND_CKSUM = 23¶

PREBOUND_DYLIB = 16¶

PREPAGE = 10¶

REEXPORT_DYLIB = 2147483679¶

ROUTINES = 17¶

ROUTINES_64 = 26¶

RPATH = 2147483676¶

SEGMENT = 1¶

SEGMENT_64 = 25¶

SEGMENT_SPLIT_INFO = 30¶

SOURCE_VERSION = 42¶

SUB_CLIENT = 20¶

SUB_FRAMEWORK = 18¶

SUB_LIBRARY = 21¶

SUB_UMBRELLA = 19¶

SYMSEG = 3¶

SYMTAB = 2¶

TARGET_TRIPLE = 57¶

THREAD = 4¶

TWOLEVEL_HINTS = 22¶

UNIXTHREAD = 5¶

UNKNOWN = 0¶

UUID = 27¶

VERSION_MIN_IPHONEOS = 37¶

VERSION_MIN_MACOSX = 36¶

VERSION_MIN_TVOS = 47¶

VERSION_MIN_WATCHOS = 48¶

from_value(arg: int) → lief.MachO.LoadCommand.TYPE = <nanobind.nb_func object>¶

property command → lief.MachO.LoadCommand.TYPE¶: Command type

property command_offset → int¶: Offset of the command within the Load Command Table

property data → memoryview¶: Command’s data

property size → int¶: Size of the command (should be greater than sizeof(load_command))

DylibCommand¶

class lief.MachO.DylibCommand¶

Bases: LoadCommand

Class which represents a library dependency

property compatibility_version → list[int]¶: Library’s compatibility version

property current_version → list[int]¶: Library’s current version

id_dylib(name: str, timestamp: int, current_version: int, compat_version: int) → lief.MachO.DylibCommand = <nanobind.nb_func object>¶

lazy_load_dylib(name: str, timestamp: int, current_version: int, compat_version: int) → lief.MachO.DylibCommand = <nanobind.nb_func object>¶

load_dylib(name: str, timestamp: int, current_version: int, compat_version: int) → lief.MachO.DylibCommand = <nanobind.nb_func object>¶

load_upward_dylib(name: str, timestamp: int, current_version: int, compat_version: int) → lief.MachO.DylibCommand = <nanobind.nb_func object>¶

property name → str¶: Library’s name

property name_offset → int¶: Original string offset of the name

reexport_dylib(name: str, timestamp: int, current_version: int, compat_version: int) → lief.MachO.DylibCommand = <nanobind.nb_func object>¶

property timestamp → int¶: Library’s timestamp

weak_lib(name: str, timestamp: int, current_version: int, compat_version: int) → lief.MachO.DylibCommand = <nanobind.nb_func object>¶

DylinkerCommand¶

class lief.MachO.DylinkerCommand(self, arg: str, /)¶

Bases: LoadCommand

Class that represents the Mach-O linker, also named loader Most of the time, name returns /usr/lib/dyld

property name → str¶: Path to the loader/linker

UUIDCommand¶

class lief.MachO.UUIDCommand¶

Bases: LoadCommand

Class that represents the UUID command

property uuid → list[int]¶: UUID as a list

MainCommand¶

class lief.MachO.MainCommand(self, arg0: int, arg1: int, /)¶

Bases: LoadCommand

Class that represents the LC_MAIN command. This kind of command can be used to determine the entrypoint of an executable

property entrypoint → int¶: Offset of the main function relative to the __TEXT segment

property stack_size → int¶: The initial stack size (if not 0)

NoteCommand¶

class lief.MachO.NoteCommand¶

Bases: LoadCommand

Class that represent the LC_NOTE command.

This command is used to include arbitrary notes or metadata within a binary.

property note_offset → int¶: Offset of the data associated with this note

property note_size → int¶: Size of the data referenced by the note_offset

property owner → memoryview¶: Owner of the note (e.g. AIR_METALLIB)

property owner_str → str¶: Owner as a zero-terminated string

Symbol¶

class lief.MachO.Symbol(self)¶

Bases: Symbol

Class that represents a Symbol in a Mach-O file.

A Mach-O symbol can come from:

The symbols command (LC_SYMTAB / SymbolCommand)
The Dyld Export trie
The Dyld Symbol bindings

class CATEGORY(*values)¶

Bases: Enum

EXTERNAL = 2¶

INDIRECT_ABS = 4¶

INDIRECT_ABS_LOCAL = 6¶

INDIRECT_LOCAL = 5¶

LOCAL = 1¶

NONE = 0¶

UNDEFINED = 3¶

from_value(arg: int) → lief.MachO.Symbol.CATEGORY = <nanobind.nb_func object>¶

class ORIGIN(*values)¶

Bases: Enum

DYLD_BIND = 2¶

DYLD_EXPORT = 1¶

SYMTAB = 3¶

UNKNOWN = 0¶

from_value(arg: int) → lief.MachO.Symbol.ORIGIN = <nanobind.nb_func object>¶

class TYPE(*values)¶

Bases: Enum

ABSOLUTE_SYM = 2¶

INDIRECT = 10¶

PREBOUND = 12¶

SECTION = 14¶

UNDEFINED = 0¶

from_value(arg: int) → lief.MachO.Symbol.TYPE = <nanobind.nb_func object>¶

property binding_info → lief.MachO.BindingInfo | None¶: BindingInfo associated with the symbol if any, or None

property category → lief.MachO.Symbol.CATEGORY¶: Category of the symbol according to the LC_DYSYMTAB command

property demangled_name → str¶: Symbol’s unmangled name

property description → int¶: Return information about the symbol

property export_info → lief.MachO.ExportInfo | None¶: ExportInfo associated with the symbol if any, or None

property has_binding_info → bool¶: True if the symbol has an BindingInfo associated with

property has_export_info → bool¶: True if the symbol has an ExportInfo associated with

property is_external → bool¶: True if the symbol is defined as an external symbol.

property library → lief.MachO.DylibCommand | None¶: DylibCommand the library where the symbol is exposed

property library_ordinal → int¶: Library ordinal + 1 (0 means self)

property numberof_sections → int¶: It returns the number of sections in which this symbol can be found. If the symbol can’t be found in any section, it returns 0 (NO_SECT)

property origin → lief.MachO.Symbol.ORIGIN¶: Return the ORIGIN of this symbol

property raw_type → int¶: Raw value of nlist_xx.n_type

property type → lief.MachO.Symbol.TYPE¶: Type as defined by nlist_xx.n_type & N_TYPE

Symbol Command¶

class lief.MachO.SymbolCommand(self)¶

Bases: LoadCommand

Class that represents the LC_SYMTAB command

property numberof_symbols → int¶: Number of symbols registered

property strings_offset → int¶: Offset from the start of the file to the string table

property strings_size → int¶: Size of the string table

property symbol_offset → int¶: Offset from the start of the file to the n_list associated with the command

Dynamic Symbol Command¶

class lief.MachO.DynamicSymbolCommand¶

Bases: LoadCommand

Class that represents the LC_DYSYMTAB command. This command completes the LC_SYMTAB (SymbolCommand) to provide a better granularity over the symbols layout.

property external_reference_symbol_offset → int¶: Byte offset from the start of the file to the external reference table data. This field seems unused by recent Mach-O loader and should be set to 0

property external_relocation_offset → int¶: Byte offset from the start of the file to the module table data. This field seems unused by recent Mach-O loader and should be set to 0

property idx_external_define_symbol → int¶: Index of the first symbol in the group of defined external symbols.

property idx_local_symbol → int¶: Index of the first symbol in the group of local symbols.

property idx_undefined_symbol → int¶: Index of the first symbol in the group of undefined external symbols.

property indirect_symbol_offset → int¶

Byte offset from the start of the file to the indirect symbol table data.

Indirect symbol table is used by the loader to speed-up symbol resolution during the lazy binding process

References:

dyld-519.2.1/src/ImageLoaderMachOCompressed.cpp
dyld-519.2.1/src/ImageLoaderMachOClassic.cpp

property indirect_symbols → lief.MachO.DynamicSymbolCommand.it_indirect_symbols¶: Iterator over the indirect symbols indexed by this command

property local_relocation_offset → int¶: Byte offset from the start of the file to the local relocation table data. This field seems unused by recent Mach-O loader and should be set to 0

property module_table_offset → int¶: Byte offset from the start of the file to the module table data. This field seems unused by recent Mach-O loader and should be set to 0

property nb_external_define_symbols → int¶: Number of symbols in the group of defined external symbols.

property nb_external_reference_symbols → int¶: Number of entries in the external reference table. This field seems unused by recent Mach-O loader and should be set to 0.

property nb_external_relocations → int¶: Number of entries in the external relocation table. This field seems unused by recent Mach-O loader and should be set to 0

property nb_indirect_symbols → int¶: Number of entries in the indirect symbol table.

property nb_local_relocations → int¶: Number of entries in the local relocation table. This field seems unused by recent Mach-O loader and should be set to 0

property nb_local_symbols → int¶: Number of symbols in the group of local symbols.

property nb_module_table → int¶: Number of entries in the module table. This field seems unused by recent Mach-O loader and should be set to 0.

property nb_toc → int¶: Number of entries in the table of contents Should be set to 0 on recent Mach-O

property nb_undefined_symbols → int¶: Number of symbols in the group of undefined external symbols.

property toc_offset → int¶: Byte offset from the start of the file to the table of contents data. Table of content is used by legacy Mach-O loader and this field should be set to 0

Dyld Info¶

class lief.MachO.DyldInfo¶

Bases: LoadCommand

Class that represents the LC_DYLD_INFO and LC_DYLD_INFO_ONLY commands

class BIND_OPCODES(*values)¶

Bases: Enum

ADD_ADDR_ULEB = 128¶

DONE = 0¶

DO_BIND = 144¶

DO_BIND_ADD_ADDR_IMM_SCALED = 176¶

DO_BIND_ADD_ADDR_ULEB = 160¶

DO_BIND_ULEB_TIMES_SKIPPING_ULEB = 192¶

SET_ADDEND_SLEB = 96¶

SET_DYLIB_ORDINAL_IMM = 16¶

SET_DYLIB_ORDINAL_ULEB = 32¶

SET_DYLIB_SPECIAL_IMM = 48¶

SET_SEGMENT_AND_OFFSET_ULEB = 112¶

SET_SYMBOL_TRAILING_FLAGS_IMM = 64¶

SET_TYPE_IMM = 80¶

THREADED = 208¶

THREADED_APPLY = 209¶

from_value(arg: int) → lief.MachO.DyldInfo.BIND_OPCODES = <nanobind.nb_func object>¶

class REBASE_OPCODES(*values)¶

Bases: Enum

ADD_ADDR_IMM_SCALED = 64¶

ADD_ADDR_ULEB = 48¶

DONE = 0¶

DO_REBASE_ADD_ADDR_ULEB = 112¶

DO_REBASE_IMM_TIMES = 80¶

DO_REBASE_ULEB_TIMES = 96¶

DO_REBASE_ULEB_TIMES_SKIPPING_ULEB = 128¶

SET_SEGMENT_AND_OFFSET_ULEB = 32¶

SET_TYPE_IMM = 16¶

from_value(arg: int) → lief.MachO.DyldInfo.REBASE_OPCODES = <nanobind.nb_func object>¶

class REBASE_TYPE(*values)¶

Bases: Enum

POINTER = 1¶

TEXT_ABSOLUTE32 = 2¶

TEXT_PCREL32 = 3¶

THREADED = 102¶

from_value(arg: int) → lief.MachO.DyldInfo.REBASE_TYPE = <nanobind.nb_func object>¶

property bind → tuple[int, int]¶

Bind information as a tuple (offset, size)

Dyld binds an image during the loading process, if the image requires any pointers to be initialized to symbols in other images. The rebase information is a stream of byte sized opcodes for which symbolic names start with BIND_OPCODE_.

Conceptually the bind information is a table of tuples: (seg-index, seg-offset, type, symbol-library-ordinal, symbol-name, addend) The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like for runs of pointers initialized to the same value can be encoded in a few bytes.

See also

/usr/include/mach-o/loader.h

property bind_opcodes → memoryview¶: Return the binding’s opcodes as list of bytes

property bindings → lief.MachO.DyldInfo.it_binding_info¶: Return an iterator over Dyld’s BindingInfo

property export_info → tuple[int, int]¶

Export information as a tuple (offset, size)

The symbols exported by a dylib are encoded in a trie. This is a compact representation that factors out common prefixes.

It also reduces LINKEDIT pages in RAM because it encodes all information (name, address, flags) in one small, contiguous range. The export area is a stream of nodes. The first node sequentially is the start node for the trie.

Nodes for a symbol start with a byte that is the length of the exported symbol information for the string so far. If there is no exported symbol, the byte is zero. If there is exported info, it follows the length byte. The exported info normally consists of a flags and offset both encoded in uleb128. The offset is location of the content named by the symbol. It is the offset from the mach_header for the image.

After the initial byte and optional exported symbol information is a byte of how many edges (0-255) that this node has leaving it, followed by each edge. Each edge is a zero terminated cstring of the addition chars in the symbol, followed by a uleb128 offset for the node that edge points to.

See also

/usr/include/mach-o/loader.h

property export_trie → memoryview¶: Return Export’s trie as list of bytes

property exports → lief.MachO.DyldExportsTrie.it_export_info¶: Return an iterator over Dyld’s ExportInfo

property lazy_bind → tuple[int, int]¶

Lazy Bind information as a tuple (offset, size)

Some uses of external symbols do not need to be bound immediately. Instead they can be lazily bound on first use. The lazy_bind contains a stream of BIND opcodes to bind all lazy symbols. Normal use is that dyld ignores the lazy_bind section when loading an image. Instead the static linker arranged for the lazy pointer to initially point to a helper function which pushes the offset into the lazy_bind area for the symbol needing to be bound, then jumps to dyld which simply adds the offset to lazy_bind_off to get the information on what to bind.

See also

/usr/include/mach-o/loader.h

property lazy_bind_opcodes → memoryview¶: Return lazy binding’s opcodes as list of bytes

property rebase → tuple[int, int]¶

Rebase information as a tuple (offset, size)

Dyld rebases an image whenever dyld loads it at an address different from its preferred address. The rebase information is a stream of byte sized opcodes for which symbolic names start with REBASE_OPCODE_.

Conceptually the rebase information is a table of tuples: (seg-index, seg-offset, type)

The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like “every n’th offset for m times” can be encoded in a few bytes

See also

/usr/include/mach-o/loader.h

property rebase_opcodes → memoryview¶: Return the rebase’s opcodes as list of bytes

set_bind_offset(self, offset: int) → None¶

set_bind_size(self, size: int) → None¶

set_export_offset(self, offset: int) → None¶

set_export_size(self, size: int) → None¶

set_lazy_bind_offset(self, offset: int) → None¶

set_lazy_bind_size(self, size: int) → None¶

set_rebase_offset(self, offset: int) → None¶

set_rebase_size(self, size: int) → None¶

set_weak_bind_offset(self, offset: int) → None¶

set_weak_bind_size(self, size: int) → None¶

property show_bind_opcodes → str¶: Return the bind opcodes in a human-readable way

property show_export_trie → str¶: Return the export trie in a human-readable way

property show_lazy_bind_opcodes → str¶: Return the lazy bind opcodes in a human-readable way

property show_rebases_opcodes → str¶: Return the rebase opcodes in a human-readable way

property show_weak_bind_opcodes → str¶: Return the weak bind opcodes in a human-readable way

property weak_bind → tuple[int, int]¶

Weak Bind information as a tuple (offset, size)

Some C++ programs require dyld to unique symbols so that all images in the process use the same copy of some code/data.

This step is done after binding. The content of the weak_bind info is an opcode stream like the bind_info. But it is sorted alphabetically by symbol name. This enables dyld to walk all images with weak binding information in order and look for collisions. If there are no collisions, dyld does no updating. That means that some fixups are also encoded in the bind_info. For instance, all calls to operator new are first bound to libstdc++.dylib using the information in bind_info. Then if some image overrides operator new that is detected when the weak_bind information is processed and the call to operator new is then rebound.

See also

/usr/include/mach-o/loader.h

property weak_bind_opcodes → memoryview¶: Return Weak binding’s opcodes as list of bytes

Function starts¶

class lief.MachO.FunctionStarts¶

Bases: LoadCommand

Class which represents the LC_FUNCTION_STARTS command

This command is an array of ULEB128 encoded values

add_function(self, address: int) → None¶: Add a new function

property content → memoryview¶: The original content as a bytes stream

property data_offset → int¶: Offset in the binary where start functions are located

property data_size → int¶: Size of the functions list in the binary

property functions → list[int]¶

Addresses of every function entry point in the executable

This allows functions to exist for which there are no entries in the symbol table.

Warning

The address is relative to the __TEXT segment

Function Variants¶

class lief.MachO.FunctionVariants¶

Bases: LoadCommand

Class representing the LC_FUNCTION_VARIANTS load command.

Introduced publicly in dyld-1284.13 (April 2025), this command supports function multiversioning, the ability to associate multiple implementations of the same function, each optimized for a specific platform, architecture, or runtime context.

At runtime, the system dispatches the most appropriate variant based on hardware capabilities or execution environment.

For example:

FUNCTION_VARIANT_TABLE(my_function,
  { (void*)my_function$Rosetta,  "rosetta" }, // Rosetta translation
  { (void*)my_function$Haswell,  "haswell" }, // Haswell-optimized
  { (void*)my_function$Base,     "default" }  // Default fallback
);

class RuntimeTable¶

Bases: object

Represents a runtime table of function variants sharing a common namespace (referred to internally as FunctionVariantsRuntimeTable in dyld).

Each table holds multiple RuntimeTableEntry instances that map to function implementations optimized for a given KIND.

class KIND(*values)¶

Bases: Enum

Enumeration describing the namespace or category of a function variant.

Each RuntimeTable is associated with one KIND, which indicates the domain or context under which its variant entries should be considered valid or applicable.

These categories map to the runtime dispatch logic used by dyld when selecting the optimal function variant.

ARM64 = 3¶

PER_PROCESS = 1¶

SYSTEM_WIDE = 2¶

UNKNOWN = 0¶

X86_64 = 4¶

property entries → lief.MachO.FunctionVariants.RuntimeTable.it_entries¶: Iterator over the different RuntimeTableEntry entries

property kind → lief.MachO.FunctionVariants.RuntimeTable.KIND¶: Kind of the runtime table

property offset → int¶: Original offset in the payload

class RuntimeTableEntry¶

Bases: object

This class exposes information about a given implementation.

class FLAGS(*values)¶

Bases: Enum

ARM64_ADVSIMD = 3145782¶

ARM64_ADVSIMDHPFP = 3145783¶

ARM64_AES = 3145739¶

ARM64_AFP = 3145758¶

ARM64_BF16 = 3145753¶

ARM64_BTI = 3145765¶

ARM64_CRC32 = 3145784¶

ARM64_CSV2 = 3145760¶

ARM64_CVS3 = 3145761¶

ARM64_DEFAULT = 3145728¶

ARM64_DIT = 3145762¶

ARM64_DOTPROD = 3145732¶

ARM64_DPB = 3145751¶

ARM64_DPB2 = 3145752¶

ARM64_ECV = 3145757¶

ARM64_FCMA = 3145746¶

ARM64_FHM = 3145731¶

ARM64_FLAGM = 3145729¶

ARM64_FLAGM2 = 3145730¶

ARM64_FP16 = 3145763¶

ARM64_FPAC = 3145750¶

ARM64_FRINTTS = 3145743¶

ARM64_I8MM = 3145754¶

ARM64_JSCVT = 3145747¶

ARM64_LRCPC = 3145744¶

ARM64_LRCPC2 = 3145745¶

ARM64_LSE = 3145735¶

ARM64_LSE2 = 3145759¶

ARM64_PAUTH = 3145748¶

ARM64_PAUTH2 = 3145749¶

ARM64_PMULL = 3145740¶

ARM64_RDM = 3145734¶

ARM64_RPRES = 3145756¶

ARM64_SB = 3145742¶

ARM64_SHA1 = 3145738¶

ARM64_SHA256 = 3145736¶

ARM64_SHA3 = 3145733¶

ARM64_SHA512 = 3145737¶

ARM64_SME = 3145772¶

ARM64_SME2 = 3145773¶

ARM64_SMEB16F32 = 3145778¶

ARM64_SMEBI32I32 = 3145777¶

ARM64_SMEF16F32 = 3145779¶

ARM64_SMEF32F32 = 3145776¶

ARM64_SMEF64F64 = 3145774¶

ARM64_SMEI16I32 = 3145781¶

ARM64_SMEI16I64 = 3145775¶

ARM64_SMEI8I32 = 3145780¶

ARM64_SPECRES = 3145741¶

ARM64_SSBS = 3145764¶

ARM64_WFXT = 3145755¶

PER_PROCESS_DEFAULT = 1048576¶

PER_PROCESS_MTE_ENABLED = 1048578¶

PER_PROCESS_NO_OVERREAD = 1048579¶

PER_PROCESS_TRANSLATED = 1048577¶

SYSTEM_WIDE_CUSTOMER_INSTALL = 2097154¶

SYSTEM_WIDE_DEFAULT = 2097152¶

SYSTEM_WIDE_INTERNAL_INSTALL = 2097153¶

SYSTEM_WIDE_LOCKDOWN = 2097155¶

UNKNOWN = 0¶

X86_64_AVX = 4194307¶

X86_64_AVX2 = 4194308¶

X86_64_AVX512BW = 4194310¶

X86_64_AVX512F = 4194309¶

X86_64_BMI1 = 4194311¶

X86_64_DEFAULT = 4194304¶

X86_64_FMA = 4194306¶

X86_64_HASWELL = 4194313¶

X86_64_IVYBRIDGE = 4194314¶

X86_64_NEHALEM = 4194315¶

X86_64_ROSETTA = 4194312¶

X86_64_SSE41 = 4194305¶

property another_table → bool¶: Indicates whether impl refers to an entry in another runtime table, rather than a direct function implementation address.

property flag_bit_nums → memoryview¶: The flagBitNums value as a slice of bytes

property flags → list[lief.MachO.FunctionVariants.RuntimeTableEntry.FLAGS]¶: Return the interpreted flag_bit_nums

property impl → int¶: The relative address of the implementation or an index if another_table is set.

property content → memoryview¶: Payload content

property data_offset → int¶: Offset in the binary where the payload starts

property data_size → int¶: Size of the payload

property runtime_table → lief.MachO.FunctionVariants.it_runtime_table¶: Iterator over the different RuntimeTable entries located in the content of this __LINKEDIT command

Function Variant Fixups¶

class lief.MachO.FunctionVariantFixups¶

Bases: LoadCommand

Class which represents the LC_FUNCTION_VARIANT_FIXUPS command.

This command contains the relocations that must be applied to the GOT-like slots associated with a FunctionVariants table. At runtime, dyld resolves each slot to the best implementation and (re-)signs it according to the pointer-authentication information.

class Fixup(self)¶

class Fixup(self, seg_offset: int, seg_index: int, variant_index: int, pac_auth: bool, pac_address: bool, pac_key: int, pac_diversity: int)

Bases: object

A single relocation associated with a function-variant. It mirrors the FunctionVariantFixups::InternalFixup structure used by dyld and describes a slot that must be fixed up to point to the variant referenced by variant_index.

property pac_address → bool¶: Whether the PAC signature mixes the storage address (address diversity)

property pac_auth → bool¶: Whether the slot is signed with pointer authentication (arm64e)

property pac_diversity → int¶: PAC diversity (discriminator) of the slot

property pac_key → int¶: PAC key used to sign the slot

property seg_index → int¶: Index of the segment that owns the slot to fix up

property seg_offset → int¶: Offset of the slot to fix up, relative to seg_index

property segment → lief.MachO.SegmentCommand | None¶: SegmentCommand referenced by seg_index if it could be resolved, or None

property variant_index → int¶: Index of the FunctionVariants runtime table used to resolve the slot

add(self, fixup: lief._lief.MachO.FunctionVariantFixups.Fixup) → lief._lief.MachO.FunctionVariantFixups¶: Append a new Fixup

property content → memoryview¶: Payload content

property data_offset → int¶: Offset in the binary where the payload starts

property data_size → int¶: Size of the payload

property fixups → lief.MachO.FunctionVariantFixups.it_fixups¶: Iterator over the different Fixup entries

Lazy Load Dylib Info¶

class lief.MachO.LazyLoadDylibInfo¶

Bases: LoadCommand

Class representing the LC_LAZY_LOAD_DYLIB_INFO load command.

This command describes how to lazily load a dylib: instead of binding the library and its symbols at launch time, dyld keeps the information required to resolve the dylib on the first use of one of its symbols.

class Fixup¶

Bases: object

A single lazy-binding fixup decoded from the chain referenced by chain_start_image_offset and decoded according to pointer_format.

property address → int¶: Virtual address of the slot bound by this fixup

property is_auth → bool¶: Whether the bound pointer is authenticated (arm64e PAC)

property ordinal → int¶: Index of the bound symbol in symbols

property symbol → str¶: Name of the bound symbol (resolved from ordinal)

add_symbol(self, symbol: str) → lief._lief.MachO.LazyLoadDylibInfo¶: Append a symbol name to the list of symbols to bind lazily

property chain_start_image_offset → int¶: Image offset of the fixup chain start used to bind the dylib’s symbols

clear_symbols(self) → lief._lief.MachO.LazyLoadDylibInfo¶: Remove all the symbol names to bind lazily

property content → memoryview¶: The original content of this payload

property data_offset → int¶: Offset in the __LINKEDIT segment where the payload starts

property data_size → int¶: Size of the payload

property fixups → lief.MachO.LazyLoadDylibInfo.it_fixups¶: Iterator over the lazy-binding Fixup entries decoded from the chain

property flag_image_offset → int¶: Image offset of the global flag that is set once the dylib has been loaded by dyld

property flags → int¶: Raw flags associated with this command (see may_be_missing)

property load_path → str¶: Load path of the dylib to bind lazily

property may_be_missing → bool¶: Whether the dylib is allowed to be missing at runtime (weak linked)

property pointer_format → int¶: Chained-fixups pointer format used by the binding chain

property symbols → list[str]¶: List of the symbol names to bind lazily for this dylib

Source Version¶

class lief.MachO.SourceVersion¶

Bases: LoadCommand

Class that represents the MachO SOURCE_VERSION This command is used to provide the version of the sources used to build the binary

property version → list[int]¶: Version as a tuple of 5 integers

Version Min¶

class lief.MachO.VersionMin¶

Bases: LoadCommand

Class that wraps the LC_VERSION_MIN_MACOSX, LC_VERSION_MIN_IPHONEOS, … commands

property sdk → list[int]¶: SDK as a tuple of 3 integers

property version → list[int]¶: Version as a tuple of 3 integers

Routine¶

class lief.MachO.Routine¶

Bases: LoadCommand

Class that represents the LC_ROUTINE/LC_ROUTINE64 commands. According to the Mach-O loader.h documentation:

The routines command contains the address of the dynamic shared library initialization routine and an index into the module table for the module that defines the routine. Before any modules are used from the library the dynamic linker fully binds the module that defines the initialization routine and then calls it. This gets called before any module initialization routines (used for C++ static constructors) in the library.

property init_address → int¶: Address of initialization routine

property init_module → int¶: Index into the module table that the init routine is defined in

property reserved1 → int¶

property reserved2 → int¶

property reserved3 → int¶

property reserved4 → int¶

property reserved5 → int¶

property reserved6 → int¶

Relocation¶

class lief.MachO.Relocation¶

Bases: Relocation

It extends the LIEF lief.Relocation abstract class and it is sub-classed by

RelocationObject
RelocationDyld

class ORIGIN(*values)¶

Bases: Enum

CHAINED_FIXUPS = 3¶

DYLDINFO = 1¶

RELOC_TABLE = 2¶

UNKNOWN = 0¶

from_value(arg: int) → lief.MachO.Relocation.ORIGIN = <nanobind.nb_func object>¶

property address → int¶

For OBJECT or (origin is RELOC_TABLE) this is an offset from the start of the Section to the item containing the address requiring relocation.

For EXECUTE / DYLIB or (origin is DYLDINFO) this is a virtual_address.

property architecture → lief.MachO.Header.CPU_TYPE¶: CPU_TYPE of the relocation

property has_section → bool¶: True if the relocation has a Section associated with

property has_segment → bool¶: True if the relocation has a SegmentCommand associated with

property has_symbol → bool¶: True if the relocation has a Symbol associated with

property origin → lief.MachO.Relocation.ORIGIN¶

ORIGIN of the relocation

For OBJECT file it should be RELOC_TABLE
For EXECUTE or DYLIB it should be DYLDINFO”)

property pc_relative → bool¶

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

property section → lief.MachO.Section | None¶: Section associated with the relocation if any, or None

property segment → lief.MachO.SegmentCommand | None¶: SegmentCommand associated with the relocation if any, or None

property symbol → lief.MachO.Symbol | None¶: Symbol associated with the relocation if any, or None

Type of the relocation according to the architecture and/or origin

If origin is RELOC_TABLE:

See:

lief.MachO.X86_RELOCATION
lief.MachO.X86_64_RELOCATION
lief.MachO.PPC_RELOCATION
lief.MachO.ARM_RELOCATION
lief.MachO.ARM64_RELOCATION

If origin is DYLDINFO, the value is associated with REBASE_TYPE.

Relocation Object¶

class lief.MachO.RelocationObject¶

Bases: Relocation

Class that represents a relocation present in the MachO object file (.o). Usually, this kind of relocation is found in the lief.MachO.Section.

property is_scattered → bool¶: True if the relocation is a scattered one

property value → int¶

For scattered relocations, the address of the relocatable expression for the item in the file that needs to be updated if the address is changed.

For relocatable expressions with the difference of two section addresses, the address from which to subtract (in mathematical terms, the minuend) is contained in the first relocation entry and the address to subtract (the subtrahend) is contained in the second relocation entry.”,

Relocation Dyld¶

class lief.MachO.RelocationDyld¶

Bases: Relocation

Class that represents a relocation found in the DyldInfo structure.

While this class does not have an associated structure in the Mach-O format specification, it provides a convenient interface for the lief.MachO.DyldInfo.rebase values

Relocation Fixup¶

class lief.MachO.RelocationFixup¶

Bases: Relocation

Class that represents a rebase relocation found in the LC_DYLD_CHAINED_FIXUPS command.

This class extends lief.Relocation (and lief.MachO.Relocation) in which address is set to the absolute virtual address where the relocation must take place (e.g. 0x10000d270).

On the other hand, target contains the value that should be set at address if the imagebase is imagebase (e.g. 0x1000073a8).

If the Mach-O loader chooses another base address (like 0x7ff100000), it must set 0x10000d270 to 0x7ff1073a8.

property next → int¶: (unscaled) next offset in the chain

property target → int¶

Binding Info¶

class lief.MachO.BindingInfo¶

Bases: Object

Class that provides an interface over an entry in DyldInfo structure

This class does not represent a structure that exists in the Mach-O format specifications but it provides a view of a binding operation that is performed by the Dyld binding bytecode (LC_DYLD_INFO) or the Dyld chained fixups (DYLD_CHAINED_FIXUPS)

See: ChainedBindingInfo, DyldBindingInfo

property addend → int¶: Value added to the segment’s virtual address when binding

property address → int¶: Binding’s address

property has_library → bool¶: True if the binding info has a DylibCommand associated with

property has_segment → bool¶: True if the binding info has a SegmentCommand associated with

property has_symbol → bool¶: True if the binding info has a Symbol associated with

property library → lief.MachO.DylibCommand | None¶: DylibCommand associated with the binding if any, or None

property library_ordinal → int¶

property segment → lief.MachO.SegmentCommand | None¶: SegmentCommand associated with the binding if any, or None

property symbol → lief.MachO.Symbol | None¶: Symbol associated with the binding if any, or None

property weak_import → bool¶

Dyld Binding Info¶

class lief.MachO.DyldBindingInfo¶

Bases: BindingInfo

This class represents a symbol binding operation associated with the LC_DYLD_INFO bytecode.

This class does not represent a structure that exists in the Mach-O format specifications but it provides a view on an entry of the Dyld binding opcodes.

Chained Binding Info¶

class lief.MachO.ChainedBindingInfo¶

Bases: BindingInfo

This class represents a symbol binding operation associated with the LC_DYLD_CHAINED_FIXUPS command.

This class does not represent a structure that exists in the Mach-O format specifications but it provides a view on an entry.

Export Info¶

class lief.MachO.ExportInfo¶

Bases: Object

Class that provides an interface over the Dyld export info

This class does not represent a structure that exists in the Mach-O format specification but provides a view on an entry of the Dyld export trie.

class FLAGS(*values)¶

Bases: Flag

REEXPORT = 8¶

STATIC_RESOLVER = 32¶

STUB_AND_RESOLVER = 16¶

WEAK_DEFINITION = 4¶

from_value(arg: int) → lief.MachO.ExportInfo.FLAGS = <nanobind.nb_func object>¶

class KIND(*values)¶

Bases: Enum

ABSOLUTE_KIND = 2¶

REGULAR = 0¶

THREAD_LOCAL_KIND = 1¶

from_value(arg: int) → lief.MachO.ExportInfo.KIND = <nanobind.nb_func object>¶

property address → int¶: The address of the export

property alias → lief.MachO.Symbol | None¶: Symbol alias if the current symbol is re-exported

property alias_library → lief.MachO.DylibCommand | None¶: If the current symbol has an alias, it returns the DylibCommand command associated with

property flags → int¶: Some information (FLAGS) about the export (like weak export, reexport, …)

property flags_list → list[lief.MachO.ExportInfo.FLAGS]¶: Return flags as a list of FLAGS

has(self, flag: lief._lief.MachO.ExportInfo.FLAGS) → bool¶: Check if the flag FLAGS given in first parameter is present

property has_symbol → bool¶: True if the export info has a Symbol associated with

property kind → lief.MachO.ExportInfo.KIND¶: The export’s kind: regular, thread local, absolute, … (KIND)

property node_offset → int¶: Original offset in the export Trie

property symbol → lief.MachO.Symbol | None¶: Symbol associated with the export if any, or None

Thread Command¶

class lief.MachO.ThreadCommand(self, arg0: int, arg1: int, arg2: lief._lief.MachO.Header.CPU_TYPE, /)¶

Bases: LoadCommand

Class that represents the LC_THREAD / LC_UNIXTHREAD commands and that can be used to get the binary entrypoint when the LC_MAIN (MainCommand) is not present

Generally speaking, this command aims at defining the original state of the main thread which includes the registers’ values

property architecture → lief.MachO.Header.CPU_TYPE¶: The CPU architecture that is targeted by this ThreadCommand

property count → int¶

Size of the thread state data with 32-bits alignment.

This value should match len(state)

property flavor → int¶

Integer that defines a special flavor for the thread.

The meaning of this value depends on the architecture. The list of the values can be found in the XNU kernel files:

xnu/osfmk/mach/arm/thread_status.h for the ARM/AArch64 architectures
xnu/osfmk/mach/i386/thread_status.h for the x86/x86-64 architectures

property pc → int¶

Return the initial Program Counter regardless of the underlying architecture. This value, when non null, can be used to determine the binary’s entrypoint.

Underneath, it works by looking for the PC register value in the state data

property state → memoryview¶: The actual thread state as a vector of bytes. Depending on the architecture(), these data can be casted into x86_thread_state_t, x86_thread_state64_t, …

RPath Command¶

class lief.MachO.RPathCommand¶

Bases: LoadCommand

create(path: str) → lief.MachO.RPathCommand | None = <nanobind.nb_func object>¶

property path → str¶: @rpath path

property path_offset → int¶: Original string offset of the path

Code Signature¶

class lief.MachO.CodeSignature¶

Bases: LoadCommand

property content → memoryview¶: The raw signature as a bytes stream

property data_offset → int¶: Offset in the binary where the signature starts

property data_size → int¶: Size of the raw signature

Data In Code¶

class lief.MachO.DataInCode¶

Bases: LoadCommand

Interface of the LC_DATA_IN_CODE command

This command is used to list slices of code sections that contain data. The slices information are stored as an array of DataCodeEntry

add(self, entry: lief._lief.MachO.DataCodeEntry) → lief._lief.MachO.DataInCode¶: Add a new DataCodeEntry

property content → memoryview¶: The original content as a bytes stream

property data_offset → int¶: Start of the array of the DataCodeEntry entries

property data_size → int¶: Whole size of the array (size = sizeof(DataCodeEntry) * nb_elements)

property entries → lief.MachO.it_data_in_code_entries¶: Iterator over DataCodeEntry

Data Code Entry¶

class lief.MachO.DataCodeEntry¶

Bases: Object

Interface over an entry in the DataInCode command

class TYPES(*values)¶

Bases: Enum

ABS_JUMP_TABLE_32 = 5¶

DATA = 1¶

JUMP_TABLE_16 = 3¶

JUMP_TABLE_32 = 4¶

JUMP_TABLE_8 = 2¶

UNKNOWN = 0¶

from_value(arg: int) → lief.MachO.DataCodeEntry.TYPES = <nanobind.nb_func object>¶

property length → int¶: Length of the data

property offset → int¶: Offset of the data

property type → lief.MachO.DataCodeEntry.TYPES¶: Type of the data (TYPES

Segment Split Info¶

class lief.MachO.SegmentSplitInfo¶

Bases: LoadCommand

Class that represents the SEGMENT_SPLIT_INFO command

property content → memoryview¶: The original content as a bytes stream

property data_offset → int¶: Offset in the binary where the data start

property data_size → int¶: Size of the raw data

Sub Framework¶

class lief.MachO.SubFramework¶

Bases: LoadCommand

Class that represents the SubFramework command. According to the Mach-O loader.h documentation:

> A dynamically linked shared library may be a subframework of an umbrella > framework. If so it will be linked with “-umbrella umbrella_name” where > Where “umbrella_name” is the name of the umbrella framework. A subframework > can only be linked against by its umbrella framework or other subframeworks > that are part of the same umbrella framework. Otherwise the static link > editor produces an error and states to link against the umbrella framework. > The name of the umbrella framework for subframeworks is recorded in the > following structure.

property umbrella → str¶: Name of the umbrella framework

Sub Client¶

class lief.MachO.SubClient¶

Bases: LoadCommand

Class that represents the SubClient command. According to the Mach-O loader.h documentation:

> For dynamically linked shared libraries that are subframework of an umbrella > framework they can allow clients other than the umbrella framework or other > subframeworks in the same umbrella framework. To do this the subframework > is built with “-allowable_client client_name” and an LC_SUB_CLIENT load > command is created for each -allowable_client flag. The client_name is > usually a framework name. It can also be a name used for bundles clients > where the bundle is built with “-client_name client_name”.

property client → str¶: Name of the sub client

Dyld Environment¶

class lief.MachO.DyldEnvironment¶

Bases: LoadCommand

Class that represents a LC_DYLD_ENVIRONMENT which is used by the Mach-O linker/loader to initialize an environment variable

property value → str¶: Environment variable as a string

Encryption Info¶

class lief.MachO.EncryptionInfo¶

Bases: LoadCommand

Class that represents the LC_ENCRYPTION_INFO / LC_ENCRYPTION_INFO_64 commands

The encryption info is usually present in Mach-O executables that target iOS to encrypt some sections of the binary

property crypt_id → int¶: The encryption system. 0 means not encrypted

property crypt_offset → int¶: File offset of encrypted range

property crypt_size → int¶: File size of encrypted range

Build Version¶

class lief.MachO.BuildVersion¶

Bases: LoadCommand

class PLATFORMS(*values)¶

Bases: Enum

ANY = 4294967295¶

BRIDGEOS = 5¶

DRIVERKIT = 10¶

FIRMWARE = 13¶

IOS = 2¶

IOS_EXCLAVE_CORE = 17¶

IOS_EXCLAVE_KIT = 18¶

IOS_SIMULATOR = 7¶

MACOS = 1¶

MACOS_EXCLAVE_CORE = 15¶

MACOS_EXCLAVE_KIT = 16¶

MAC_CATALYST = 6¶

SEPOS = 14¶

TVOS = 3¶

TVOS_EXCLAVE_CORE = 19¶

TVOS_EXCLAVE_KIT = 20¶

TVOS_SIMULATOR = 8¶

UNKNOWN = 0¶

VISIONOS = 11¶

VISIONOS_EXCLAVE_CORE = 23¶

VISIONOS_EXCLAVE_KIT = 24¶

VISIONOS_SIMULATOR = 12¶

WATCHOS = 4¶

WATCHOS_EXCLAVE_CORE = 21¶

WATCHOS_EXCLAVE_KIT = 22¶

WATCHOS_SIMULATOR = 9¶

from_value(arg: int) → lief.MachO.BuildVersion.PLATFORMS = <nanobind.nb_func object>¶

property minos → list[int]¶: Minimal OS version on which this binary was built to run

property platform → lief.MachO.BuildVersion.PLATFORMS¶: Target PLATFORMS

property sdk → list[int]¶: SDK Version

property tools → list[lief.MachO.BuildToolVersion]¶: List of BuildToolVersion used while building this binary

Build Tool Version¶

class lief.MachO.BuildToolVersion¶

Bases: Object

Class that represents a tool’s version that was involved in the build of the binary

class TOOLS(*values)¶

Bases: Enum

AIRLLD = 1025¶

AIRNT = 1026¶

AIRNT_PLUGIN = 1027¶

AIRPACK = 1028¶

CLANG = 1¶

GPUARCHIVER = 1031¶

LD = 3¶

LLD = 4¶

METAL = 1024¶

METAL_FRAMEWORK = 1032¶

SWIFT = 2¶

UNKNOWN = 0¶

from_value(arg: int) → lief.MachO.BuildToolVersion.TOOLS = <nanobind.nb_func object>¶

property tool → lief.MachO.BuildToolVersion.TOOLS¶: TOOLS type

property version → list[int]¶: Version of the tool

Fileset Command¶

class lief.MachO.FilesetCommand¶

Bases: LoadCommand

Class associated with the LC_FILESET_ENTRY commands

property binary → lief.MachO.Binary | None¶: Return the Binary object associated with the entry

property file_offset → int¶: Original offset in the kernel cache

property name → str¶: Name of the underlying MachO binary

property virtual_address → int¶: Memory address where the MachO file should be mapped

DyldChainedFixups Command¶

Inheritance diagram of lief._lief.MachO.DyldChainedFixups

class lief.MachO.DyldChainedFixups¶

Bases: LoadCommand

Class that represents the LC_DYLD_CHAINED_FIXUPS command

This command aims at providing rebase and binding information like the DyldInfo ‘s bytecode. Compared to the DyldInfo bytecode, these chained fixups are taking less space.

property bindings → lief.MachO.DyldChainedFixups.it_binding_info¶: Iterator over the bindings ChainedBindingInfo associated with this command

class chained_starts_in_segment¶

Bases: object

Structure that mirrors the raw dyld_chained_starts_in_segment which aims at providing information about the chained rebase/bind fixups

The relocations provided by this structure can be accessed through relocations

property max_valid_pointer → int¶: for 32-bit OS, any value beyond this is not a pointer

property offset → int¶: Original offset of the structure, relative to starts_offset

property page_count → int¶: How many pages are in the page_start array

property page_size → int¶: Likely 0x1000 for x86/x86_64 architectures and 0x4000 for ARM64 architecture

property page_start → list[int]¶: Offset in the SegmentCommand of the first element of the chain.

property pointer_format → lief.MachO.DYLD_CHAINED_PTR_FORMAT¶: How pointers are encoded

property segment → lief.MachO.SegmentCommand | None¶: SegmentCommand in which the rebase/bind fixups take place

property segment_offset → int¶: Offset of the segment’s data from the beginning of the file. (it should match file_offset)

property size → int¶: sizeof(size) + sizeof(page_size) + ... + sizeof(pointer_format)

property chained_starts_in_segments → lief.MachO.DyldChainedFixups.it_chained_starts_in_segments_t¶: Iterator over the chained fixup metadata, chained_starts_in_segment

property data_offset → int¶: Offset of the LC_DYLD_CHAINED_FIXUPS chained payload. This offset should point in the __LINKEDIT segment

property data_size → int¶: Size of the LC_DYLD_CHAINED_FIXUPS payload

property fixups_version → int¶: Chained fixups version. The loader (as of dyld v852.2) checks that this value is set to 0.

property imports_count → int¶: Number of imported symbol names

property imports_format → lief.MachO.DYLD_CHAINED_FORMAT¶: The format of the imports (ChainedBindingInfo)

property imports_offset → int¶: Offset of imports table in chain data

property payload → memoryview¶: Return the raw content of the command

property starts_offset → int¶: offset of dyld_chained_starts_in_image in chain_data

property symbols_format → int¶

The compression algorithm (if any) used to store the symbols 0 means uncompressed while 1 means zlib compressed.

As of the version v852.2 of dyld loader, it only supports uncompressed format

property symbols_offset → int¶: Offset of symbol strings in chain data

DyldExportsTrie Command¶

Inheritance diagram of lief._lief.MachO.DyldExportsTrie

class lief.MachO.DyldExportsTrie¶

Bases: LoadCommand

Class that represents the LC_DYLD_EXPORTS_TRIE command

In recent Mach-O binaries, this command replace the DyldInfo export trie buffer

property content → memoryview¶: The raw export trie

property data_offset → int¶: Offset of the trie in the binary. This offset should point in the __LINKEDIT

property data_size → int¶: Raw size of the trie

property exports → lief.MachO.DyldExportsTrie.it_export_info¶: Iterator over the ExportInfo associated with this trie.

show_export_trie(self) → str¶: Show the trie in a human-readable way

Code Signature Dir Command¶

Inheritance diagram of lief._lief.MachO.CodeSignatureDir

class lief.MachO.CodeSignatureDir¶

Bases: LoadCommand

property content → memoryview¶: The raw signature as a bytes stream

property data_offset → int¶: Offset in the binary where the signature starts

property data_size → int¶: Size of the raw signature

Two Level Hints¶

class lief.MachO.TwoLevelHints¶

Bases: LoadCommand

Class which represents the LC_TWOLEVEL_HINTS command

property content → memoryview¶: The original content as a bytes stream

property hints → lief.MachO.TwoLevelHints.it_hints_t¶

Linker Optimization Hint¶

Inheritance diagram of lief._lief.MachO.LinkerOptHint

class lief.MachO.LinkerOptHint¶

Bases: LoadCommand

Class which represents the LC_LINKER_OPTIMIZATION_HINT command

property content → memoryview¶: The raw payload

property data_offset → int¶: Offset in the binary where the payload starts

property data_size → int¶: Size of the raw payload

UnknownCommand¶

class lief.MachO.UnknownCommand¶

Bases: LoadCommand

Generic class when the command is not recognized by LIEF

property original_command → int¶

Stub¶

class lief.MachO.Stub(self, target_info: lief._lief.MachO.Stub.target_info_t, address: int, raw_stub: collections.abc.Sequence[int])¶

Bases: object

This class represents a stub entry in sections like __stubs,__auth_stubs.

It wraps assembly instructions which are used to access the got where the address of the symbol is resolved.

Example:

0000000236a3c1bc: ___memcpy_chk
  adrp            x17, #0x241513aa8
  add             x17, x17, #0x241513aa8
  ldr             x16, [x17]
  braa            x16, x17

property address → int¶: The virtual address where the stub is located

property raw → memoryview¶: The (raw) instructions of this entry as a memory view of bytes

property target → int | lief.lief_errors¶

The address resolved by this stub.

For instance, given this stub:

0x3eec: adrp    x16, #4096
0x3ef0: ldr     x16, [x16, #24]
0x3ef4: br      x16

The function returns: 0x4018.

Warning

This function is only available with LIEF’s extended version

class target_info_t(self)¶

class target_info_t(self, arg0: lief._lief.MachO.Header.CPU_TYPE, arg1: int, /)

Bases: object

property arch → lief.MachO.Header.CPU_TYPE¶

property subtype → int¶

Builder¶

class lief.MachO.Builder¶

Bases: object

Class used to reconstruct a Mach-O binary from its object representation

class config_t(self)¶

Bases: object

Interface to tweak the Builder

property linkedit → bool¶

write(*args) → lief.ok_t | lief.lief_errors = <nanobind.nb_func object>¶

Utilities¶

lief.MachO.check_layout(*args) → tuple[bool, str]¶

lief.MachO.check_layout(file: lief._lief.MachO.FatBinary) → tuple[bool, str]

Overloaded function.

check_layout(file: lief._lief.MachO.Binary) -> tuple[bool, str]

Check the layout of the given Mach-O binary. It checks if it can be signed according to cctools-921/libstuff/checkout.c

check_layout(file: lief._lief.MachO.FatBinary) -> tuple[bool, str]

Check the layout of the given FAT Mach-O by checking individually the layout of the binaries embedded in the FAT.

Enums¶

MACHO_TYPES¶

class lief.MachO.MACHO_TYPES(*values)¶

Bases: Enum

CIGAM = 3472551422¶

CIGAM_64 = 3489328638¶

CIGAM_FAT = 3199925962¶

MAGIC = 4277009102¶

MAGIC_64 = 4277009103¶

MAGIC_FAT = 3405691582¶

NEURAL_MODEL = 3203398350¶

from_value(arg: int) → lief.MachO.MACHO_TYPES = <nanobind.nb_func object>¶

X86_RELOCATION¶

class lief.MachO.X86_RELOCATION(*values)¶

Bases: Enum

LOCAL_SECTDIFF = 4¶

PAIR = 1¶

PB_LA_PTR = 3¶

SECTDIFF = 2¶

TLV = 5¶

VANILLA = 0¶

from_value(arg: int) → lief.MachO.X86_RELOCATION = <nanobind.nb_func object>¶

X86_64_RELOCATION¶

class lief.MachO.X86_64_RELOCATION(*values)¶

Bases: Enum

BRANCH = 2¶

GOT = 4¶

GOT_LOAD = 3¶

SIGNED = 1¶

SIGNED_1 = 6¶

SIGNED_2 = 7¶

SIGNED_4 = 8¶

SUBTRACTOR = 5¶

TLV = 9¶

UNSIGNED = 0¶

from_value(arg: int) → lief.MachO.X86_64_RELOCATION = <nanobind.nb_func object>¶

PPC_RELOCATION¶

class lief.MachO.PPC_RELOCATION(*values)¶

Bases: Enum

BR14 = 2¶

BR24 = 3¶

HA16 = 6¶

HA16_SECTDIFF = 12¶

HI16 = 4¶

HI16_SECTDIFF = 10¶

JBSR = 13¶

LO14 = 7¶

LO14_SECTDIFF = 14¶

LO16 = 5¶

LO16_SECTDIFF = 11¶

LOCAL_SECTDIFF = 15¶

PAIR = 1¶

PB_LA_PTR = 9¶

SECTDIFF = 8¶

VANILLA = 0¶

from_value(arg: int) → lief.MachO.PPC_RELOCATION = <nanobind.nb_func object>¶

ARM_RELOCATION¶

class lief.MachO.ARM_RELOCATION(*values)¶

Bases: Enum

BR24 = 5¶

HALF = 8¶

HALF_SECTDIFF = 9¶

LOCAL_SECTDIFF = 3¶

PAIR = 1¶

PB_LA_PTR = 4¶

SECTDIFF = 2¶

THUMB_32BIT_BRANCH = 7¶

THUMB_RELOC_BR22 = 6¶

VANILLA = 0¶

from_value(arg: int) → lief.MachO.ARM_RELOCATION = <nanobind.nb_func object>¶

ARM64_RELOCATION¶

class lief.MachO.ARM64_RELOCATION(*values)¶

Bases: Enum

ADDEND = 10¶

BRANCH26 = 2¶

GOT_LOAD_PAGE21 = 5¶

GOT_LOAD_PAGEOFF12 = 6¶

PAGE21 = 3¶

PAGEOFF12 = 4¶

POINTER_TO_GOT = 7¶

SUBTRACTOR = 1¶

TLVP_LOAD_PAGE21 = 8¶

TLVP_LOAD_PAGEOFF12 = 9¶

UNSIGNED = 0¶

from_value(arg: int) → lief.MachO.ARM64_RELOCATION = <nanobind.nb_func object>¶

DYLD_CHAINED_FORMAT¶

class lief.MachO.DYLD_CHAINED_FORMAT(*values)¶

Bases: Enum

IMPORT = 1¶

IMPORT_ADDEND = 2¶

IMPORT_ADDEND64 = 3¶

from_value(arg: int) → lief.MachO.DYLD_CHAINED_FORMAT = <nanobind.nb_func object>¶

DYLD_CHAINED_PTR_FORMAT¶

class lief.MachO.DYLD_CHAINED_PTR_FORMAT(*values)¶

Bases: Enum

NONE = 0¶

PTR_32 = 3¶

PTR_32_CACHE = 4¶

PTR_32_FIRMWARE = 5¶

PTR_64 = 2¶

PTR_64_KERNEL_CACHE = 8¶

PTR_64_OFFSET = 6¶

PTR_ARM64E = 1¶

PTR_ARM64E_FIRMWARE = 10¶

PTR_ARM64E_KERNEL = 7¶

PTR_ARM64E_SEGMENTED = 14¶

PTR_ARM64E_SHARED_CACHE = 13¶

PTR_ARM64E_USERLAND = 9¶

PTR_ARM64E_USERLAND24 = 12¶

PTR_X86_64_KERNEL_CACHE = 11¶

from_value(arg: int) → lief.MachO.DYLD_CHAINED_PTR_FORMAT = <nanobind.nb_func object>¶