Parse the given binary from the given input and return a FatBinary object
One can configure the parser with the config parameter. See ParserConfig
Bases: object
This class is used to tweak the MachO Parser (Parser)
When parsing Mach-O from memory, this option can be used to undo relocations and symbols bindings.
When activated, this option requires parse_dyld_bindings and parse_dyld_rebases to be enabled.
Whether the binary is coming/extracted from Dyld shared cache
If flag is set to true, Exports, Bindings and Rebases opcodes are parsed.
Warning
Enabling this flag can slow down the parsing
Parse the Dyld binding opcodes
Parse the Dyld export trie
Parse the Dyld rebase opcodes
fatbinary_1 = lief.MachO.parse("/usr/bin/ls", config=lief.MachO.ParserConfig.deep)
# or
fatbinary_2 = lief.MachO.parse("/usr/bin/ls", config=lief.MachO.ParserConfig.quick)
Bases: object
Class which represent a Mach-O (fat) binary This object is also used for representing Mach-O binaries that are NOT FAT
Return the Binary at the given index or None if it is not present
Bases: object
Iterator over lief._lief.MachO.Binary
Build a Mach-O universal binary and return its bytes
Build a Mach-O universal binary
Bases: Binary
Class which represents a MachO binary
Overloaded function.
add(self, dylib_command: lief._lief.MachO.DylibCommand) -> lief._lief.MachO.LoadCommand
Add a new DylibCommand
add(self, segment: lief._lief.MachO.SegmentCommand) -> lief._lief.MachO.LoadCommand
Add a new SegmentCommand
add(self, load_command: lief._lief.MachO.LoadCommand) -> lief._lief.MachO.LoadCommand
Add a new LoadCommand
add(self, load_command: lief._lief.MachO.LoadCommand, index: int) -> lief._lief.MachO.LoadCommand
Add a new LoadCommand at index
Add a new export in the binary
Add a new library dependency
Add a new a new symbol in the LC_SYMTAB
Overloaded function.
add_section(self, segment: lief._lief.MachO.SegmentCommand, section: lief._lief.MachO.Section) -> lief._lief.MachO.Section
Add a new Section in the given SegmentCommand
add_section(self, section: lief._lief.MachO.Section) -> lief._lief.MachO.Section
Add a new Section within the __TEXT segment
Return the binary’s AtomInfo if any, or None
Return an iterator over the binding info which can come from either
DyldInfo or DyldChainedFixups commands.
Return the binary’s BuildVersion if any, or None
Check if the given symbol can be safely removed.
Check if the given symbol name can be safely removed.
Return the binary’s CodeSignature if any, or None
Return the binary’s CodeSignatureDir if any, or None
Return an iterator over the binary’s Command
Return the binary’s DataInCode if any, or None
Return the binary’s DyldChainedFixups if any, or None
Return the binary’s DyldEnvironment if any, or None
Return the binary’s DyldExportsTrie if any, or None
Return the binary’s DyldInfo if any, or None
Return the binary’s DylinkerCommand if any, or None
Return the binary’s DynamicSymbolCommand if any, or None
Return the binary’s EncryptionInfo if any, or None
Return the binary’s Symbol which are exported
Extend a LoadCommand by size
Extend the content of the given Section by size
Extend the content of the given SegmentCommand by size
Return binary’s fat offset. 0 if not relevant.
Name associated with the LC_FILESET_ENTRY binary
Return binary’s Filesets
Try to find the library with the given library name.
This function tries to match the fullpath of the DylibCommand or the
library name suffix.
Return the binary’s FunctionStarts if any, or None
Return LC_FUNCTION_VARIANT_FIXUPS command
Return LC_FUNCTION_VARIANTS command
Return list of all Function found
Return the first LoadCommand with the given TYPE or None if it is not present.
Overloaded function.
get_section(self, name: str) -> lief._lief.MachO.Section
Return the section from the given name or None if the section does not exist
get_section(self, segname: str, secname: str) -> lief._lief.MachO.Section
Return the section from the segment with the name given in the first parameter and with the section’s name provided in the second parameter. If the section cannot be found, it returns a nullptr
Return the SegmentCommand from the given name
Return the Symbol from the given name
Check if the current binary has a LoadCommand with the given TYPE
True if the binary embeds the LC_ATOM_INFO command (AtomInfo)
True if the binary has a BuildVersion command
True if the binary is signed (i.e. has a CodeSignature command)
True if the binary is signed (i.e. has a CodeSignatureDir command) with the command LC_DYLIB_CODE_SIGN_DRS
True if the binary has a DataInCode command
True if the binary has a DyldChainedFixups command
True if the binary has a DyldEnvironment command
True if the binary has a DyldExportsTrie command
True if the binary has a DylinkerCommand command.
True if the binary has a DynamicSymbolCommand command.
True if the binary has a EncryptionInfo command
True if the binary has an entrypoint.
Basically for libraries it will return false
Return True if the binary has filesets
True if the binary has a FunctionStarts command.
True if the binary has a LC_FUNCTION_VARIANT_FIXUPS command
True if the binary has a LC_FUNCTION_VARIANTS command
True if the binary embeds the Linker optimization hint command (LinkerOptHint)
True if the binary has a MainCommand command.
True if the binary contains LC_NOTE command(s)
Return True if the heap is flagged as non-executable. False otherwise.
Return True if the stack is flagged as non-executable. False otherwise.
True if the binary has a RPathCommand command.
Check if a section with the given name exists
Check if a SegmentCommand with the given name exists
True if the binary has a SegmentSplitInfo command
True if the binary has a SourceVersion command.
True if the binary has a SubFramework command
True if the binary has a SymbolCommand command.
True if the binary has a ThreadCommand command.
True if the binary embeds the Two Level Hint command (TwoLevelHints)
True if the binary has a UUIDCommand command.
True if the binary has a VersionMin command.
Return binary’s Header
Return the binary’s imagebase which is the base address
where segments are mapped (without the ASLR). 0 if not relevant.
Return the binary’s Symbol which are imported
True if this binary targets iOS
True if this binary targets macOS
Check if the given address is encompassed between the range of virtual addresses.
See: va_ranges
Bases: object
Iterator over lief._lief.MachO.LoadCommand
Bases: object
Iterator over lief._lief.MachO.Symbol
Bases: object
Iterator over lief._lief.MachO.DylibCommand
Bases: object
Iterator over lief._lief.MachO.NoteCommand
Bases: object
Iterator over lief._lief.MachO.Relocation
Bases: object
Iterator over lief._lief.MachO.RPathCommand
Bases: object
Iterator over lief._lief.MachO.Section
Bases: object
Iterator over lief._lief.MachO.SegmentCommand
Bases: object
Iterator over lief._lief.MachO.SubClient
Bases: object
Iterator over lief._lief.MachO.Symbol
Return an iterator over the binary’s DylibCommand
Return the binary’s LinkerOptHint if any, or None
Return the binary’s MainCommand if any, or None
Iterator over the different LC_NOTE commands
Return Objective-C metadata info if present
Warning
This is only available with the extended version of LIEF.
Return the range of offsets as a tuple (off_start, off_end)
Return the platform for which this Mach-O has been compiled
Return an iterator over binary’s Relocation
Overloaded function.
remove(self, load_command: lief._lief.MachO.LoadCommand) -> bool
Remove a LoadCommand
remove(self, type: lief._lief.MachO.LoadCommand.TYPE) -> bool
Remove all the LoadCommand with the given TYPE
remove(self, symbol: lief._lief.MachO.Symbol) -> bool
Remove the given Symbol
Remove the LoadCommand at the given index
Overloaded function.
remove_section(self, name: str, clear: bool = False) -> None
Remove the section with the given name
remove_section(self, segname: str, secname: str, clear: bool = False) -> None
Remove the section from the segment with the name given in the first parameter and with the section’s name provided in the second parameter.
Remove the CodeSignature (if any)
Remove all symbol(s) with the given name
Return the binary’s Routine if any, or None
Return the binary’s RPathCommand if any, or None
Return an iterator over the binary’s RPathCommand
Return the Section which encompasses the offset
Return the Section which encompasses the virtual address
Return an iterator over the binary’s Section
Return the SegmentCommand which encompasses the offset
Return the SegmentCommand which encompasses the virtual address
Return the binary’s SegmentSplitInfo if any, or None
Return an iterator over the binary’s SegmentCommand
Shift the content located right after the Load commands table. This operation can be used to add a new command
Shift the position on the __LINKEDIT data by width
Return the binary’s SourceVersion if any, or None
Return the binary’s SubFramework if any, or None
Return an iterator over the binary’s SubClient
Check if the binary is supporting ARM64 pointer authentication (arm64e)
Return the binary’s SymbolCommand if any, or None
Return an iterator over the symbol stubs.
These stubs are involved when calling an imported function and are similar to the ELF’s plt/got mechanism.
There are located in sections like: __stubs,__auth_stubs,__symbol_stub,__picsymbolstub4
Return an iterator over the binary’s Symbol
Return the binary’s ThreadCommand if any, or None
Return the binary’s TwoLevelHints if any, or None
Remove the symbol from the export table
Return list of Function found in the __unwind_info section
Return the binary’s UUIDCommand if any, or None
Return the range of virtual addresses as a tuple (va_start, va_end)
Return the binary’s VersionMin if any, or None
Convert the virtual address to an offset in the binary
Binary’s memory size when mapped
Overloaded function.
write(self, output: Union[str | os.PathLike]) -> None
Rebuild the binary and write its content in the file given in the first parameter
write(self, output: Union[str | os.PathLike], config: lief._lief.MachO.Builder.config_t) -> None
Rebuild the binary and write its content in the file given in the first parameter. The
configparameter can be used to tweak the building process.
Bases: Object
Class that represents the Mach-O header
Bases: Enum
Bases: Enum
Bases: Flag
Add the given FLAGS
Return the CPU subtype supported by the Mach-O binary. For ARM architectures, this value could represent the minimum version for which the Mach-O binary has been compiled for.
Target CPU
Binary’s type
Binary’s flags
FLAGS as a list
True is the binary is 32-bits
True is the binary is 64-bits
The Mach-O magic bytes. These bytes determine whether it is a 32 bits Mach-O, a 64 bits Mach-O files etc.
Number of LoadCommand
Remove the given FLAGS
According to the official documentation, a reserved value
Size of all LoadCommand
Bases: Section
Class that represents a Mach-O section
Overloaded function.
__init__(self) -> None
__init__(self, section_name: str) -> None
Constructor from a section’s name
__init__(self, section_name: str, content: collections.abc.Sequence[int]) -> None
Constructor from a section’s name and its content
Bases: Flag
Bases: Enum
Add the given SECTION_FLAGS
Section’s alignment as a power of 2
Section’s flags masked with SECTION_FLAGS_MASK (see: FLAGS)
Check if the section has the given SECTION_FLAGS
True if the current section has a segment associated with
Bases: object
Iterator over lief._lief.MachO.Relocation
Number of relocations associated with this section
Offset of the relocation table. This value should be 0
for executable and libraries as the relocations are managed by the lief.MachO.DyldInfo.rebase
Other the other hand, for object files (.o) this value should not be 0
Iterator over the Relocation (if any)
Remove the given SECTION_FLAGS
According to the official loader.h file, this value is reserved for offset or index
According to the official loader.h file, this value is reserved for offset or index
According to the official loader.h file, this value is reserved for offset or index
SegmentCommand associated with the section or None if not present
The segment name associated with the section
Type of the section. This value can help to determine
the purpose of the section (c.f. TYPE)
Bases: LoadCommand
Class which represents a SEGMENT /
SEGMENT_64 command
Bases: Enum
Bases: Enum
Segment’s content
Segment’s file offset
Segment’s file size
Segment’s flags
Get the Section with the given name
Check if the given Section belongs to the current segment
Check if the given section name belongs to the current segment
Relative index of the segment in the segment table
Segment’s initial protection
Bases: object
Iterator over lief._lief.MachO.Relocation
Bases: object
Iterator over lief._lief.MachO.Section
Segment’s max protection
Segment’s name
Number of sections in this segment
Segment’s relocations
Segment’s sections
Segment’s virtual address
Segment’s virtual size
Bases: Object
Based class for the Mach-O load commands
Bases: Enum
Command type
Offset of the command within the Load Command Table
Command’s data
Size of the command (should be greather than sizeof(load_command))
Bases: LoadCommand
Class which represents a library dependency
Library’s compatibility version
Library’s current version
Library’s name
Original string offset of the name
Library’s timestamp
Bases: LoadCommand
Class that represents the Mach-O linker, also named loader
Most of the time, name returns /usr/lib/dyld
Path to the loader/linker
Bases: LoadCommand
Class that represents the UUID command
UUID as a list
Bases: LoadCommand
Class that represent the LC_MAIN command. This kind of command can be used to determine the entrypoint of an executable
Offset of the main function relative to the __TEXT segment
The initial stack size (if not 0)
Bases: LoadCommand
Class that represent the LC_NOTE command.
This command is used to include arbitrary notes or metadata within a binary.
Offset of the data associated with this note
Size of the data referenced by the note_offset
Owner of the note (e.g. AIR_METALLIB)
Owner as a zero-terminated string
Bases: Symbol
Class that represents a Symbol in a Mach-O file.
A Mach-O symbol can come from:
The symbols command (LC_SYMTAB / SymbolCommand)
The Dyld Export trie
The Dyld Symbol bindings
Bases: Enum
Bases: Enum
Bases: Enum
BindingInfo associated with the symbol if any, or None
Category of the symbol according to the LC_DYSYMTAB command
Symbol’s unmangled name
Return information about the symbol
ExportInfo associated with the symbol if any, or None
True if the symbol has an BindingInfo associated with
True if the symbol has an ExportInfo associated with
True if the symbol is defined as an external symbol.
DylibCommand the library where the symbol is exposed
Library ordinal + 1 (0 means self)
It returns the number of sections in which this symbol can be found. If the symbol can’t be found in any section, it returns 0 (NO_SECT)
Return the ORIGIN of this symbol
Raw value of nlist_xx.n_type
Type as defined by nlist_xx.n_type & N_TYPE
Bases: LoadCommand
Class that represents the LC_SYMTAB command
Number of symbols registered
Offset from the start of the file to the string table
Size of the size string table
Offset from the start of the file to the n_list associated with the command
Bases: LoadCommand
Class that represents the LC_DYSYMTAB command. This command completes the LC_SYMTAB (SymbolCommand) to provide a better granularity over the symbols layout.
Byte offset from the start of the file to the external reference table data. This field seems unused by recent Mach-O loader and should be set to 0
Byte offset from the start of the file to the module table data. This field seems unused by recent Mach-O loader and should be set to 0
Index of the first symbol in the group of defined external symbols.
Index of the first symbol in the group of local symbols.
Index of the first symbol in the group of undefined external symbols.
Byte offset from the start of the file to the indirect symbol table data.
Indirect symbol table is used by the loader to speed-up symbol resolution during the lazy binding process
References:
dyld-519.2.1/src/ImageLoaderMachOCompressed.cpp
dyld-519.2.1/src/ImageLoaderMachOClassic.cpp
Iterator over the indirect symbols indexed by this command
Bases: object
Iterator over lief._lief.MachO.Symbol
Byte offset from the start of the file to the local relocation table data. This field seems unused by recent Mach-O loader and should be set to 0
Byte offset from the start of the file to the module table data. This field seems unused by recent Mach-O loader and should be set to 0
Number of symbols in the group of defined external symbols.
Number of entries in the external reference table. This field seems unused by recent Mach-O loader and should be set to 0.
Number of entries in the external relocation table. This field seems unused by recent Mach-O loader and should be set to 0
Number of entries in the indirect symbol table.
Number of entries in the local relocation table. This field seems unused by recent Mach-O loader and should be set to 0
Number of symbols in the group of local symbols.
Number of entries in the module table. This field seems unused by recent Mach-O loader and should be set to 0.
Number of entries in the table of contents Should be set to 0 on recent Mach-O
Number of symbols in the group of undefined external symbols.
Byte offset from the start of the file to the table of contents data. Table of content is used by legacy Mach-O loader and this field should be set to 0
Bases: LoadCommand
Class that represents the LC_DYLD_INFO and LC_DYLD_INFO_ONLY commands
Bases: Enum
Bases: Enum
Bases: Enum
Bind information as a tuple (offset, size)
Dyld binds an image during the loading process, if the image
requires any pointers to be initialized to symbols in other images.
The rebase information is a stream of byte sized opcodes for which symbolic names start with BIND_OPCODE_.
Conceptually the bind information is a table of tuples:
(seg-index, seg-offset, type, symbol-library-ordinal, symbol-name, addend)
The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns
like for runs of pointers initialzed to the same value can be encoded in a few bytes.
See also
/usr/include/mach-o/loader.h
Return the binding’s opcodes as list of bytes
Return an iterator over Dyld’s BindingInfo
Export information as a tuple (offset, size)
The symbols exported by a dylib are encoded in a trie. This is a compact representation that factors out common prefixes.
It also reduces LINKEDIT pages in RAM because it encodes all
information (name, address, flags) in one small, contiguous range.
The export area is a stream of nodes. The first node sequentially
is the start node for the trie.
Nodes for a symbol start with a byte that is the length of the exported symbol information for the string so far. If there is no exported symbol, the byte is zero. If there is exported info, it follows the length byte. The exported info normally consists of a flags and offset both encoded in uleb128. The offset is location of the content named by the symbol. It is the offset from the mach_header for the image.
After the initial byte and optional exported symbol information is a byte of how many edges (0-255) that this node has leaving it, followed by each edge. Each edge is a zero terminated cstring of the addition chars in the symbol, followed by a uleb128 offset for the node that edge points to.
See also
/usr/include/mach-o/loader.h
Return Export’s trie as list of bytes
Return an iterator over Dyld’s ExportInfo
Bases: object
Iterator over lief._lief.MachO.DyldBindingInfo
Bases: object
Iterator over lief._lief.MachO.ExportInfo
Lazy Bind information as a tuple (offset, size)
Some uses of external symbols do not need to be bound immediately. Instead they can be lazily bound on first use. The lazy_bind are contains a stream of BIND opcodes to bind all lazy symbols. Normal use is that dyld ignores the lazy_bind section when loading an image. Instead the static linker arranged for the lazy pointer to initially point to a helper function which pushes the offset into the lazy_bind area for the symbol needing to be bound, then jumps to dyld which simply adds the offset to lazy_bind_off to get the information on what to bind.
See also
/usr/include/mach-o/loader.h
Return lazy binding’s opcodes as list of bytes
Rebase information as a tuple (offset, size)
Dyld rebases an image whenever dyld loads it at an address different
from its preferred address. The rebase information is a stream
of byte sized opcodes for which symbolic names start with REBASE_OPCODE_.
Conceptually the rebase information is a table of tuples: (seg-index, seg-offset, type)
The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like “every n’th offset for m times” can be encoded in a few bytes
See also
/usr/include/mach-o/loader.h
Return the rebase’s opcodes as list of bytes
Return the bind opcodes in a humman-readable way
Return the export trie in a humman-readable way
Return the weak bind opcodes in a humman-readable way
Return the rebase opcodes in a humman-readable way
Return the weak bind opcodes in a humman-readable way
Weak Bind information as a tuple (offset, size)
Some C++ programs require dyld to unique symbols so that all images in the process use the same copy of some code/data.
This step is done after binding.
The content of the weak_bind info is an opcode stream like the bind_info.
But it is sorted alphabetically by symbol name. This enables dyld to walk
all images with weak binding information in order and look for collisions.
If there are no collisions, dyld does no updating.
That means that some fixups are also encoded in the bind_info.
For instance, all calls to operator new are first bound to libstdc++.dylib
using the information in bind_info.
Then if some image overrides operator new that is detected when
the weak_bind information is processed and the call to operator new is then rebound.
See also
/usr/include/mach-o/loader.h
Return Weak binding’s opcodes as list of bytes
Bases: LoadCommand
Class which represents the LC_FUNCTION_STARTS command
This command is an array of ULEB128 encoded values
Add a new function
The original content as a bytes stream
Offset in the binary where start functions are located
Size of the functions list in the binary
Addresses of every function entry point in the executable
This allows functions to exist for which there are no entries in the symbol table.
Warning
The address is relative to the __TEXT segment
Bases: LoadCommand
Class representing the LC_FUNCTION_VARIANTS load command.
Introduced publicly in dyld-1284.13 (April 2025), this command supports
function multiversioning, the ability to associate multiple implementations
of the same function, each optimized for a specific platform, architecture,
or runtime context.
At runtime, the system dispatches the most appropriate variant based on hardware capabilities or execution environment.
For example:
FUNCTION_VARIANT_TABLE(my_function,
{ (void*)my_function$Rosetta, "rosetta" }, // Rosetta translation
{ (void*)my_function$Haswell, "haswell" }, // Haswell-optimized
{ (void*)my_function$Base, "default" } // Default fallback
);
Bases: object
Represents a runtime table of function variants sharing a common namespace
(referred to internally as FunctionVariantsRuntimeTable in dyld).
Each table holds multiple RuntimeTableEntry instances that map to
function implementations optimized for a given KIND.
Bases: Enum
Enumeration describing the namespace or category of a function variant.
Each RuntimeTable is associated with one KIND,
which indicates the domain or context under which its variant entries
should be considered valid or applicable.
These categories map to the runtime dispatch logic used by dyld
when selecting the optimal function variant.
Iterator over the different RuntimeTableEntry entries
Bases: object
Iterator over lief._lief.MachO.RuntimeTableEntry
Kind of the runtime table
Original offset in the payload
Bases: object
This class exposes information about a given implementation.
Bases: Enum
Indicates whether impl refers to an entry in another runtime table,
rather than a direct function implementation address.
The flagBitNums value as a slice of bytes
Return the interpreted flag_bit_nums
The relative address of the implementation or an index if
another_table is set.
Payload content
Offset in the binary where the payload starts
Size of the payload
Bases: object
Iterator over lief._lief.MachO.RuntimeTable
Iterator over the different RuntimeTable entries located in the content
of this __LINKEDIT command
Bases: LoadCommand
Payload content
Offset in the binary where the payload starts
Size of the payload
Bases: LoadCommand
Class that represents the MachO SOURCE_VERSION
This command is used to provide the version of the sources used to build the binary
Version as a tuple of 5 integers
Bases: LoadCommand
Class that wraps the LC_VERSION_MIN_MACOSX, LC_VERSION_MIN_IPHONEOS, … commands
SDK as a tuple of 3 integers
Version as a tuple of 3 integers
Bases: LoadCommand
Class that represents the LC_ROUTINE/LC_ROUTINE64 commands.
Accodring to the Mach-O loader.h documentation:
The routines command contains the address of the dynamic shared library initialization routine and an index into the module table for the module that defines the routine. Before any modules are used from the library the dynamic linker fully binds the module that defines the initialization routine and then calls it. This gets called before any module initialization routines (used for C++ static constructors) in the library.
Address of initialization routine
Index into the module table that the init routine is defined in
Bases: Relocation
It extends the LIEF lief.Relocation abstract class and it is sub-classed by
Bases: Enum
For OBJECT or (origin is RELOC_TABLE) this is an
offset from the start of the Section
to the item containing the address requiring relocation.
For EXECUTE / DYLIB or
(origin is DYLDINFO)
this is a virtual_address.
CPU_TYPE of the relocation
True if the relocation has a SegmentCommand associated with
ORIGIN of the relocation
For OBJECT file it should be RELOC_TABLE
Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.
For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.
Section associated with the relocation if any, or None
SegmentCommand associated with the relocation if any, or None
Symbol associated with the relocation if any, or None
Type of the relocation according to the architecture
and/or origin
If origin is RELOC_TABLE:
See:
If origin is DYLDINFO,
the value is associated with REBASE_TYPE.
Bases: Relocation
Class that represents a relocation presents in the MachO object
file (.o). Usually, this kind of relocation is found in the lief.MachO.Section.
True if the relocation is a scattered one
For scattered relocations, the address of the relocatable expression for the item in the file that needs to be updated if the address is changed.
For relocatable expressions with the difference of two section addresses, the address from which to subtract (in mathematical terms, the minuend) is contained in the first relocation entry and the address to subtract (the subtrahend) is contained in the second relocation entry.”,
Bases: Relocation
Class that represents a relocation found in the DyldInfo structure.
While this class does not have an associated structure in the Mach-O format specification,
it provides a convenient interface for the lief.MachO.DyldInfo.rebase values
See also: RelocationObject
Bases: Relocation
Class that represents a rebase relocation found in the LC_DYLD_CHAINED_FIXUPS command.
This class extends lief.Relocation (and lief.MachO.Relocation) in which
address is set to the absolute virtual address
where the relocation must take place (e.g. 0x10000d270).
On the other hand, target contains the value
that should be set at address if the
imagebase is imagebase (e.g. 0x1000073a8).
If the Mach-O loader chooses another base address (like 0x7ff100000), it must set
0x10000d270 to 0x7ff1073a8.
(unscaled) next offset in the chain
Bases: Object
Class that provides an interface over an entry in DyldInfo structure
This class does not represent a structure that exists in the Mach-O format
specifications but it provides a view of a binding operation that is performed
by the Dyld binding bytecode (LC_DYLD_INFO) or the Dyld chained fixups (DYLD_CHAINED_FIXUPS)
See: ChainedBindingInfo, DyldBindingInfo
Value added to the segment’s virtual address when binding
Binding’s address
True if the binding info has a DylibCommand associated with
True if the binding info has a SegmentCommand associated with
DylibCommand associated with the binding if any, or None
SegmentCommand associated with the binding if any, or None
Symbol associated with the binding if any, or None
Bases: BindingInfo
This class represents a symbol binding operation associated with the LC_DYLD_INFO bytecode.
This class does not represent a structure that exists in the Mach-O format specifications but it provides a view on an entry of the Dyld binding opcodes.
See also: BindingInfo
Bases: Enum
Bases: Enum
BINDING_CLASS of the binding
BIND_TYPES of the binding.
Usually, it is POINTER.
Original relative offset of the binding opcodes
Bases: BindingInfo
This class represents a symbol binding operation associated with the LC_DYLD_CHAINED_FIXUPS command.
This class does not represent a structure that exists in the Mach-O format specifications but it provides a view on an entry.
See also: BindingInfo
DYLD_CHAINED_FORMAT of the import
Offset of the entry in the chained fixups
DYLD_CHAINED_PTR_FORMAT of the import
Bases: Object
Class that provides an interface over the Dyld export info
This class does not represent a structure that exists in the Mach-O format specification but provides a view on an entry of the Dyld export trie.
Bases: Flag
Bases: Enum
The address of the export
Symbol alias if the current symbol is re-exported
If the current symbol has an alias, it returns the DylibCommand command associated with
Return flags as a list of FLAGS
Check if the flag FLAGS given in first parameter is present
The export’s kind: regular, thread local, absolute, … (KIND)
Original offset in the export Trie
Symbol associated with the export if any, or None
Bases: LoadCommand
Class that represents the LC_THREAD / LC_UNIXTHREAD commands and that can be used to get the binary entrypoint when the LC_MAIN (MainCommand) is not present
Generally speaking, this command aims at defining the original state of the main thread which includes the registers’ values
The CPU architecture that is targeted by this ThreadCommand
Size of the thread state data with 32-bits alignment.
This value should match len(state)
Integer that defines a special flavor for the thread.
The meaning of this value depends on the architecture.
The list of the values can be found in the XNU kernel files:
xnu/osfmk/mach/arm/thread_status.h for the ARM/AArch64 architectures
xnu/osfmk/mach/i386/thread_status.h for the x86/x86-64 architectures
Return the initial Program Counter regardless of the underlying architecture. This value, when non null, can be used to determine the binary’s entrypoint.
Underneath, it works by looking for the PC register value in the state data
The actual thread state as a vector of bytes. Depending on the architecture(), these data can be casted into x86_thread_state_t, x86_thread_state64_t, …
Bases: LoadCommand
@rpath path
Original string offset of the path
Bases: LoadCommand
The raw signature as a bytes stream
Offset in the binary where the signature starts
Size of the raw signature
Bases: LoadCommand
Interface of the LC_DATA_IN_CODE command
This command is used to list slices of code sections that contain data. The slices
information are stored as an array of DataCodeEntry
Add an new DataCodeEntry
The original content as a bytes stream
Start of the array of the DataCodeEntry entries
Whole size of the array (size = sizeof(DataCodeEntry) * nb_elements)
Iterator over DataCodeEntry
Bases: Object
Interface over an entry in the DataInCode command
Bases: Enum
Length of the data
Offset of the data
Type of the data (TYPES
Bases: LoadCommand
Class that represents the SEGMENT_SPLIT_INFO command
The original content as a bytes stream
Offset in the binary where the data start
Size of the raw data
Bases: LoadCommand
Class that represents the SubFramework command.
Accodring to the Mach-O loader.h documentation:
> A dynamically linked shared library may be a subframework of an umbrella > framework. If so it will be linked with “-umbrella umbrella_name” where > Where “umbrella_name” is the name of the umbrella framework. A subframework > can only be linked against by its umbrella framework or other subframeworks > that are part of the same umbrella framework. Otherwise the static link > editor produces an error and states to link against the umbrella framework. > The name of the umbrella framework for subframeworks is recorded in the > following structure.
Name of the umbrella framework
Bases: LoadCommand
Class that represents the SubClient command.
Accodring to the Mach-O loader.h documentation:
> For dynamically linked shared libraries that are subframework of an umbrella > framework they can allow clients other than the umbrella framework or other > subframeworks in the same umbrella framework. To do this the subframework > is built with “-allowable_client client_name” and an LC_SUB_CLIENT load > command is created for each -allowable_client flag. The client_name is > usually a framework name. It can also be a name used for bundles clients > where the bundle is built with “-client_name client_name”.
Name of the sub client
Bases: LoadCommand
Class that represents a LC_DYLD_ENVIRONMENT which is used by the Mach-O linker/loader to initialize an environment variable
Environment variable as a string
Bases: LoadCommand
Class that represents the LC_ENCRYPTION_INFO / LC_ENCRYPTION_INFO_64 commands
The encryption info is usually present in Mach-O executables that target iOS to encrypt some sections of the binary
The encryption system. 0 means no encrypted
File offset of encrypted range
File size of encrypted range
Bases: LoadCommand
Bases: Enum
Minimal OS version on which this binary was built to run
Target PLATFORMS
SDK Version
List of BuildToolVersion used when while this binary
Bases: Object
Class that represents a tool’s version that was involved in the build of the binary
Bases: Enum
TOOLS type
Version of the tool
Bases: LoadCommand
Class associated with the LC_FILESET_ENTRY commands
Return the Binary object associated with the entry
Original offset in the kernel cache
Name of the underlying MachO binary
Memory address where the MachO file should be mapped
Bases: LoadCommand
Class that represents the LC_DYLD_CHAINED_FIXUPS command
This command aims at providing rebase and binding information like
the DyldInfo ‘s bytecode. Compared to the DyldInfo bytecode,
these chained fixups are taking less space.
Iterator over the bindings ChainedBindingInfo associated with this command
Bases: object
Structure that mirrors the raw dyld_chained_starts_in_segment which aims at providing information about the chained rebase/bind fixups
The relocations provided by this structure can be accessed through relocations
for 32-bit OS, any value beyond this is not a pointer
Original offset of the structure, relative to starts_offset
How many pages are in the page_start array
Likely 0x1000 for x86/x86_64 architectures and 0x4000 for ARM64 architecture
Offset in the SegmentCommand of the first
element of the chain.
How pointers are encoded
SegmentCommand in which the rebase/bind fixups take place
Offset of the segment’s data from the beginning of the file.
(it should match file_offset)
sizeof(size) + sizeof(page_size) + ... + sizeof(pointer_format)
Iterator over the chained fixup metadata, chained_starts_in_segment
Offset of the LC_DYLD_CHAINED_FIXUPS chained payload.
This offset should point in the __LINKEDIT segment
Size of the LC_DYLD_CHAINED_FIXUPS payload
Chained fixups version. The loader (as far of dyld v852.2) checks that this value is set to 0.
Number of imported symbol names
The format of the imports (ChainedBindingInfo)
Offset of imports table in chain data
Bases: object
Iterator over lief._lief.MachO.ChainedBindingInfo
Bases: object
Iterator over lief._lief.MachO.chained_starts_in_segment
Return the raw content of the command
offset of dyld_chained_starts_in_image in chain_data
The compression algorithm (if any) used to store the symbols 0 means uncompressed while 1 means zlib compressed.
As far of the version v852.2 of dyld loader, it only supports uncompressed format
Offset of symbol strings in chain data
Bases: LoadCommand
Class that represents the LC_DYLD_EXPORTS_TRIE command
In recent Mach-O binaries, this command replace the DyldInfo export trie buffer
The raw export trie
Offset of the trie in the binary. This offset should point in the __LINKEDIT
Raw size of the trie
Iterator over the ExportInfo associated with
this trie.
Bases: object
Iterator over lief._lief.MachO.ExportInfo
Show the trie in a humman-readable way
Bases: LoadCommand
The raw signature as a bytes stream
Offset in the binary where the signature starts
Size of the raw signature
Bases: LoadCommand
Class which represents the LC_TWOLEVEL_HINTS command
The original content as a bytes stream
Bases: object
Bases: LoadCommand
Class which represents the LC_LINKER_OPTIMIZATION_HINT command
The raw payload
Offset in the binary where the payload starts
Size of the raw payload
Bases: LoadCommand
Generic class when the command is not recognized by LIEF
Bases: object
This class represents a stub entry in sections like __stubs,__auth_stubs.
It wraps assembly instructions which are used to access the got where the address of the symbol is resolved.
Example:
0000000236a3c1bc: ___memcpy_chk
adrp x17, #0x241513aa8
add x17, x17, #0x241513aa8
ldr x16, [x17]
braa x16, x17
The virtual address where the stub is located
The (raw) instructions of this entry as a memory view of bytes
The address resolved by this stub.
For instance, given this stub:
0x3eec: adrp x16, #4096
0x3ef0: ldr x16, [x16, #24]
0x3ef4: br x16
The function returns: 0x4018.
Warning
This function is only available with LIEF’s extended version
Bases: object
Bases: Enum
Bases: Enum
Bases: Enum