--- documentID: "f5ee3f490aed9a938733d2e80f209a0ab905430aaf59a382cabd61a646248a41" docname: "formats/pe/python" title: "PE Python API - LIEF Documentation" description: "PE Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/pe/python.html" markdownURL: "https://lief.re/doc/latest/formats/pe/python.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "576863a830cdca9641ff6aca29f1fdd18d5f9dfe6c897f8a574cc10e925a7299" --- # [Python]() ## [Parser]() ### [` lief.PE.parse `]() lief.PE.parse(*obj: str | io.IOBase | os.PathLike | bytes | list[int]*, *config: [lief.PE.ParserConfig]( "lief.PE.ParserConfig")*) → [lief.PE.Binary]( "lief.PE.Binary") | None Parse the PE binary from the given parameter and return a [`lief.PE.Binary`]( "lief.PE.Binary") object ### [` lief.PE.ParserConfig `]() class lief.PE.ParserConfig(*self*) Bases: `object` This class is used to configure the behavior of the PE Parser ([`lief.PE.parse()`]( "lief.PE.parse")) #### [` all `]() all = <lief.\_lief.PE.ParserConfig object> #### [` default_conf `]() default\_conf = <lief.\_lief.PE.ParserConfig object> #### [` parse_arm64x_binary `]() property parse\_arm64x\_binary → bool Whether to parse nested ARM64X binaries. This option is disabled by default because it can introduce significant parsing overhead. #### [` parse_exceptions `]() property parse\_exceptions → bool Whether to parse in-depth exception metadata. This option is disabled by default because it can introduce significant parsing overhead. #### [` parse_exports `]() property parse\_exports → bool Whether to parse the PE Export Directory. #### [` parse_imports `]() property parse\_imports → bool Whether to parse the PE Import Directory. #### [` parse_reloc `]() property parse\_reloc → bool Whether to parse PE relocations. #### [` parse_rsrc `]() property parse\_rsrc → bool Whether to parse the PE resources tree. #### [` parse_signature `]() property parse\_signature → bool Whether to parse the PE Authenticode signature. #### [` rebase `]() property rebase → int | None If set, this value holds the original image base from which the binary should be rebased. This is used to *undo* relocations and IAT bindings when parsing a PE loaded in memory. ## [Binary]() ### [` lief.PE.Binary `]() class lief.PE.Binary Bases: [`Binary`]( "lief._lief.Binary") Class which represents a PE binary which is the main interface to manage and modify a PE executable. This object can be instantiated through [`lief.parse()`]( "lief.parse") or [`lief.PE.parse()`]( "lief.PE.parse") while the constructor of this object can be used to craft a binary from scratch (see: [02 - Create a PE from scratch (Deprecated)]()) #### [` add_debug_info `]() add\_debug\_info(*self*, *entry: [lief.\_lief.PE.Debug]( "lief._lief.PE.Debug")*) → [lief.\_lief.PE.Debug]( "lief._lief.PE.Debug") | None Add a new debug entry #### [` add_import `]() add\_import(*self*, *import\_name: str*, *pos: int = -1*) → [lief.\_lief.PE.Import]( "lief._lief.PE.Import") Add an imported library (i.e. `DLL`) to the binary. The second parameter `pos` defines where to insert the import. If negative (default), the import is appended to the end of the list. #### [` add_relocation `]() add\_relocation(*self*, *relocation: [lief.\_lief.PE.Relocation]( "lief._lief.PE.Relocation")*) → [lief.\_lief.PE.Relocation]( "lief._lief.PE.Relocation") Add a [`Relocation`]( "lief.PE.Relocation") to the binary #### [` add_section `]() add\_section(*self*, *section: [lief.\_lief.PE.Section]( "lief._lief.PE.Section")*) → [lief.\_lief.PE.Section]( "lief._lief.PE.Section") | None Add a [`Section`]( "lief.PE.Section") to the binary. #### [` authentihash `]() authentihash(*self*, *algorithm: [lief.\_lief.PE.ALGORITHMS]( "lief._lief.PE.ALGORITHMS")*) → bytes Compute the authentihash according to the [`ALGORITHMS`]( "lief.PE.ALGORITHMS") given in the first parameter #### [` authentihash_md5 `]() property authentihash\_md5 → bytes Authentihash **MD5** value #### [` authentihash_sha1 `]() property authentihash\_sha1 → bytes Authentihash **SHA1** value #### [` authentihash_sha256 `]() property authentihash\_sha256 → bytes Authentihash **SHA-256** value #### [` authentihash_sha512 `]() property authentihash\_sha512 → bytes Authentihash **SHA-512** value #### [` cert_dir `]() property cert\_dir → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the data directory associated with the certificate table (authenticode). #### [` clear_debug `]() clear\_debug(*self*) → bool Remove all debug info from the binary #### [` codeview_pdb `]() property codeview\_pdb → [lief.PE.CodeViewPDB]( "lief.PE.CodeViewPDB") | None Return the [`CodeViewPDB`]( "lief.PE.CodeViewPDB") if present #### [` coff_string_table `]() property coff\_string\_table → lief.PE.Binary.it\_strings\_table Iterator over the strings located in the COFF string table #### [` compute_checksum `]() compute\_checksum(*self*) → int Re-compute the value of [`checksum`]( "lief.PE.OptionalHeader.checksum"). If both values do not match, it could mean that the binary has been modified after the compilation. This value is computed by LIEF for the current binary object. #### [` data_directories `]() property data\_directories → lief.PE.Binary.it\_data\_directories Return an iterator over the [`DataDirectory`]( "lief.PE.DataDirectory") #### [` data_directory `]() data\_directory(*self*, *type: [lief.\_lief.PE.DataDirectory.TYPES]( "lief._lief.PE.DataDirectory.TYPES")*) → [lief.\_lief.PE.DataDirectory]( "lief._lief.PE.DataDirectory") | None Return the [`DataDirectory`]( "lief.PE.DataDirectory") object from the given [`TYPES`]( "lief.PE.DataDirectory.TYPES") type #### [` debug `]() property debug → lief.PE.Binary.it\_debug Return the [`Debug`]( "lief.PE.Debug") #### [` debug_dir `]() property debug\_dir → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the data directory associated with the debug table #### [` delay_dir `]() property delay\_dir → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the data directory associated with delayed imports #### [` delay_imports `]() property delay\_imports → lief.PE.Binary.it\_delay\_imports Return an iterator over the [`DelayImport`]( "lief.PE.DelayImport") #### [` dos_header `]() property dos\_header → [lief.PE.DosHeader]( "lief.PE.DosHeader") Return the [`DosHeader`]( "lief.PE.DosHeader") #### [` dos_stub `]() property dos\_stub → memoryview DOS stub content as a `list` of bytes #### [` exception_functions `]() property exception\_functions → list[[lief.Function]( "lief.Function")] [`Function`]( "lief.Function") found in the Exception directory #### [` exceptions `]() property exceptions → lief.PE.Binary.it\_exceptions Iterator over the exception (`_RUNTIME_FUNCTION`) functions. > **Warning** > > This property requires that the option [`lief.PE.ParserConfig.parse_exceptions`]( "lief.PE.ParserConfig.parse_exceptions") was turned on (default is `False`) when parsing the binary. #### [` exceptions_dir `]() property exceptions\_dir → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the data directory associated with the exceptions #### [` export_dir `]() property export\_dir → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the data directory associated with the export table #### [` fill_address `]() fill\_address(*self*, *address: int*, *size: int*, *value: int = 0*, *addr\_type: [lief.\_lief.Binary.VA\_TYPES]( "lief._lief.Binary.VA_TYPES") = VA\_TYPES.AUTO*) → None Fill the content at the provided address with a fixed value #### [` find_coff_string `]() find\_coff\_string(*self*, *offset: int*) → [lief.\_lief.COFF.String]( "lief._lief.COFF.String") | None Try to find the COFF string at the given offset in the COFF string table. > **Warning** > > This offset must include the first 4 bytes holding the size of the table. Hence, the first string starts a the offset 4. #### [` find_exception_at `]() find\_exception\_at(*self*, *rva: int*) → [lief.\_lief.PE.ExceptionInfo]( "lief._lief.PE.ExceptionInfo") | None Try to find the exception info at the given RVA. > **Warning** > > This property requires that the option [`lief.PE.ParserConfig.parse_exceptions`]( "lief.PE.ParserConfig.parse_exceptions") was turned on (default is `False`) when parsing the binary. #### [` functions `]() property functions → list[[lief.Function]( "lief.Function")] **All** [`Function`]( "lief.Function") found in the binary #### [` get_delay_import `]() get\_delay\_import(*self*, *import\_name: str*) → [lief.\_lief.PE.DelayImport]( "lief._lief.PE.DelayImport") | None Return the [`DelayImport`]( "lief.PE.DelayImport") from the given name or None if not found #### [` get_export `]() get\_export(*self*) → [lief.\_lief.PE.Export]( "lief._lief.PE.Export") | None Return the [`Export`]( "lief.PE.Export") object #### [` get_import `]() get\_import(*self*, *import\_name: str*) → [lief.\_lief.PE.Import]( "lief._lief.PE.Import") | None Return the [`Import`]( "lief.PE.Import") from the given name or None if it can’t be found #### [` get_section `]() get\_section(*self*, *section\_name: str*) → [lief.\_lief.PE.Section]( "lief._lief.PE.Section") | None Return the [`Section`]( "lief.PE.Section") object from the given name or None if not found #### [` has_configuration `]() property has\_configuration → bool `True` if the current binary has [`LoadConfiguration`]( "lief.PE.LoadConfiguration") #### [` has_debug `]() property has\_debug → bool `True` if the current binary has a [`Debug`]( "lief.PE.Debug") object #### [` has_delay_import `]() has\_delay\_import(*self*, *import\_name: str*) → bool `True` if the binary imports the given library name #### [` has_delay_imports `]() property has\_delay\_imports → bool `True` if the current binary has delay imports ([`DelayImport`]( "lief.PE.DelayImport")) #### [` has_exceptions `]() property has\_exceptions → bool `True` if the current binary uses `Exceptions` #### [` has_exports `]() property has\_exports → bool `True` if the current binary has a [`Export`]( "lief.PE.Export") object #### [` has_import `]() has\_import(*self*, *import\_name: str*) → bool `True` if the binary imports the given library name #### [` has_imports `]() property has\_imports → bool `True` if the current binary has imports ([`Import`]( "lief.PE.Import")) #### [` has_relocations `]() property has\_relocations → bool `True` if the current binary uses [`Relocation`]( "lief.PE.Relocation") #### [` has_resources `]() property has\_resources → bool `True` if the current binary has a `Resources` object #### [` has_rich_header `]() property has\_rich\_header → bool `True` if the current binary has a [`RichHeader`]( "lief.PE.RichHeader") object #### [` has_signatures `]() property has\_signatures → bool `True` if the binary is signed with the PE authenticode ([`Signature`]( "lief.PE.Signature")) #### [` has_tls `]() property has\_tls → bool `True` if the current binary has a [`TLS`]( "lief.PE.TLS") object #### [` header `]() property header → [lief.PE.Header]( "lief.PE.Header") Return the [`Header`]( "lief.PE.Header") #### [` iat_dir `]() property iat\_dir → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the data directory associated with the IAT #### [` import_dir `]() property import\_dir → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the data directory associated with the import table #### [` imports `]() property imports → lief.PE.Binary.it\_imports Return an iterator over the [`Import`]( "lief.PE.Import") libraries #### [` is_arm64ec `]() property is\_arm64ec → bool True if this binary is compiled in ARM64EC mode (emulation compatible) #### [` is_arm64x `]() property is\_arm64x → bool True if this binary is compiled in ARM64X mode (contains both ARM64 and ARM64EC #### [` is_reproducible_build `]() property is\_reproducible\_build → bool `True` if the binary was compiled with a reproducible build directive ([`Debug`]( "lief.PE.Debug")) #### [` load_config_dir `]() property load\_config\_dir → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the data directory associated with the load config #### [` load_configuration `]() property load\_configuration → [lief.PE.LoadConfiguration]( "lief.PE.LoadConfiguration") | None Return the [`LoadConfiguration`]( "lief.PE.LoadConfiguration") object or None if not present #### [` nested_pe_binary `]() property nested\_pe\_binary → [lief.PE.Binary]( "lief.PE.Binary") | None If the current binary contains dynamic relocations (e.g. [`lief.PE.DynamicFixupARM64X`]( "lief.PE.DynamicFixupARM64X")), this function returns the **relocated** view of the current PE. This can be used to get the alternative PE binary, targeting a different architecture. > **Warning** > > This property requires that the option [`lief.PE.ParserConfig.parse_arm64x_binary`]( "lief.PE.ParserConfig.parse_arm64x_binary") was turned on (default is `False`) when parsing the binary. #### [` offset_to_rva `]() offset\_to\_rva(*self*, *offset: int*) → int Convert the given offset into a relative virtual address (RVA). #### [` optional_header `]() property optional\_header → [lief.PE.OptionalHeader]( "lief.PE.OptionalHeader") Header that follows the [`header`]( "lief.PE.Binary.header"). It is named optional from the COFF specifications but it is mandatory in a PE file. #### [` overlay `]() property overlay → memoryview Return the overlay content as a `list` of bytes #### [` overlay_offset `]() property overlay\_offset → int Return the original overlay offset #### [` relocation_dir `]() property relocation\_dir → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the data directory associated with the relocation table #### [` relocations `]() property relocations → lief.PE.DynamicFixupGeneric.it\_relocations Return an iterator over the [`Relocation`]( "lief.PE.Relocation") #### [` remove `]() remove(*self*, *section: [lief.\_lief.PE.Section]( "lief._lief.PE.Section")*, *clear: bool = False*) → None Remove the [`Section`]( "lief.PE.Section") given in first parameter #### [` remove_all_imports `]() remove\_all\_imports(*self*) → None Remove all imported libraries #### [` remove_all_relocations `]() remove\_all\_relocations(*self*) → None #### [` remove_debug `]() remove\_debug(*self*, *entry: [lief.\_lief.PE.Debug]( "lief._lief.PE.Debug")*) → bool Remove a specific debug entry #### [` remove_import `]() remove\_import(*self*, *name: str*) → bool Remove the imported library with the given name #### [` remove_tls `]() remove\_tls(*self*) → None Remove the TLS from the binary #### [` resources `]() property resources → [lief.PE.ResourceNode]( "lief.PE.ResourceNode") | None Return the [`ResourceNode`]( "lief.PE.ResourceNode") tree or None if not present #### [` resources_manager `]() property resources\_manager → [lief.PE.ResourcesManager]( "lief.PE.ResourcesManager") | [lief.lief\_errors]( "lief.lief_errors") Return the [`ResourcesManager`]( "lief.PE.ResourcesManager") to manage resources #### [` rich_header `]() property rich\_header → [lief.PE.RichHeader]( "lief.PE.RichHeader") | None [`RichHeader`]( "lief.PE.RichHeader") object (if present) #### [` rsrc_dir `]() property rsrc\_dir → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the data directory associated with the resources tree #### [` rva_to_offset `]() rva\_to\_offset(*self*, *rva\_address: int*) → int Convert a relative virtual address to an offset The conversion is performed by looking for the section that encompasses the provided RVA. #### [` section_from_offset `]() section\_from\_offset(*self*, *offset: int*) → [lief.\_lief.PE.Section]( "lief._lief.PE.Section") | None Return the [`Section`]( "lief.PE.Section") which encompasses the provided offset. It returns None if a section can’t be found. #### [` section_from_rva `]() section\_from\_rva(*self*, *rva: int*) → [lief.\_lief.PE.Section]( "lief._lief.PE.Section") | None Return the [`Section`]( "lief.PE.Section") which encompasses the provided **relative** virtual address. If a section can’t be found, it returns None. #### [` sections `]() property sections → lief.PE.Binary.it\_section Return an iterator over the PE’s [`Section`]( "lief.PE.Section") #### [` set_export `]() set\_export(*self*, *arg: [lief.\_lief.PE.Export]( "lief._lief.PE.Export")*, */*) → [lief.\_lief.PE.Export]( "lief._lief.PE.Export") Add or replace the export table #### [` set_resources `]() set\_resources(*self*, *new\_tree: [lief.\_lief.PE.ResourceNode]( "lief._lief.PE.ResourceNode")*) → [lief.\_lief.PE.ResourceNode]( "lief._lief.PE.ResourceNode") | None Change or set the current resource tree with the new one provided in parameter. #### [` signatures `]() property signatures → lief.PE.Binary.it\_const\_signatures Return an iterator over the [`Signature`]( "lief.PE.Signature") objects #### [` sizeof_headers `]() property sizeof\_headers → int Size of all the PE headers #### [` symbols `]() property symbols → lief.PE.Binary.it\_symbols Return binary’s `Symbol` #### [` tls `]() property tls → [lief.PE.TLS]( "lief.PE.TLS") | None [`TLS`]( "lief.PE.TLS") object (if present) #### [` tls_dir `]() property tls\_dir → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the data directory associated with TLS #### [` va_to_offset `]() va\_to\_offset(*self*, *va\_address: int*) → int Convert an **absolute** virtual address into an offset See: [`rva_to_offset()`]( "lief.PE.Binary.rva_to_offset") #### [` verify_signatureverify_signature `]() verify\_signature(*self*, *checks: [lief.\_lief.PE.Signature.VERIFICATION\_CHECKS]( "lief._lief.PE.Signature.VERIFICATION_CHECKS") = VERIFICATION\_CHECKS.DEFAULT*) → [lief.\_lief.PE.Signature.VERIFICATION\_FLAGS]( "lief._lief.PE.Signature.VERIFICATION_FLAGS") **verify\_signature(*self*, *signature: [lief.\_lief.PE.Signature]( "lief._lief.PE.Signature")*, *checks: [lief.\_lief.PE.Signature.VERIFICATION\_CHECKS]( "lief._lief.PE.Signature.VERIFICATION_CHECKS") = VERIFICATION\_CHECKS.DEFAULT*) → [lief.\_lief.PE.Signature.VERIFICATION\_FLAGS]( "lief._lief.PE.Signature.VERIFICATION_FLAGS")** Overloaded function. 1. `verify_signature(self, checks: lief._lief.PE.Signature.VERIFICATION_CHECKS = VERIFICATION_CHECKS.DEFAULT) -> lief._lief.PE.Signature.VERIFICATION_FLAGS` > Verify the binary against the embedded signature(s) (if any) > > First off, it checks that the embedded signatures are correct (c.f. [`lief.PE.Signature.check()`]( "lief.PE.Signature.check")) and then it checks that the authentihash matches [`lief.PE.ContentInfo.digest`]( "lief.PE.ContentInfo.digest") > > One can tweak the verification process with the [`lief.PE.Signature.VERIFICATION_CHECKS`]( "lief.PE.Signature.VERIFICATION_CHECKS") flags > > > **See also** > > > > [`lief.PE.Signature.check()`]( "lief.PE.Signature.check") 2. `verify_signature(self, signature: lief._lief.PE.Signature, checks: lief._lief.PE.Signature.VERIFICATION_CHECKS = VERIFICATION_CHECKS.DEFAULT) -> lief._lief.PE.Signature.VERIFICATION_FLAGS` > Verify the binary with the Signature object provided in the first parameter It can be used to verify a detached signature: > > ```python > detached = lief.PE.Signature.parse("sig.pkcs7") > binary.verify_signature(detached) > ``` #### [` virtual_size `]() property virtual\_size → int Return the binary’s virtual size. This value should match [`sizeof_image`]( "lief.PE.OptionalHeader.sizeof_image") #### [` writewrite `]() write(*self*, *output\_path: str | os.PathLike*) → None **write(*self*, *output\_path: str | os.PathLike*, *config: [lief.\_lief.PE.Builder.config\_t]( "lief._lief.PE.Builder.config_t")*) → None** Overloaded function. 1. `write(self, output_path: Union[str | os.PathLike]) -> None` Build the binary and write the result in the given `output` file 2. `write(self, output_path: Union[str | os.PathLike], config: lief._lief.PE.Builder.config_t) -> None` Build the binary with the given config and write the result in the given `output` file #### [` write_to_byteswrite_to_bytes `]() write\_to\_bytes(*self*, *config: [lief.\_lief.PE.Builder.config\_t]( "lief._lief.PE.Builder.config_t")*) → bytes **write\_to\_bytes(*self*) → bytes** --- ## [Dos Header]() ### [` lief.PE.DosHeader `]() class lief.PE.DosHeader Bases: `Object` Class which represents the DosHeader, the **first** structure present at the beginning of a PE file. Most of the attributes of this structures are not relevant, except [`addressof_new_exeheader`]( "lief.PE.DosHeader.addressof_new_exeheader") #### [` addressof_new_exeheader `]() property addressof\_new\_exeheader → int #### [` addressof_relocation_table `]() property addressof\_relocation\_table → int #### [` checksum `]() property checksum → int #### [` copy `]() copy(*self*) → [lief.\_lief.PE.DosHeader]( "lief._lief.PE.DosHeader") Duplicate the current instance of this object #### [` create `]() create(*arg: [lief.PE.PE\_TYPE]( "lief.PE.PE_TYPE")*) → [lief.PE.DosHeader]( "lief.PE.DosHeader") = <nanobind.nb\_func object> #### [` file_size_in_pages `]() property file\_size\_in\_pages → int #### [` header_size_in_paragraphs `]() property header\_size\_in\_paragraphs → int #### [` initial_ip `]() property initial\_ip → int #### [` initial_relative_cs `]() property initial\_relative\_cs → int #### [` initial_relative_ss `]() property initial\_relative\_ss → int #### [` initial_sp `]() property initial\_sp → int #### [` magic `]() property magic → int #### [` maximum_extra_paragraphs `]() property maximum\_extra\_paragraphs → int #### [` minimum_extra_paragraphs `]() property minimum\_extra\_paragraphs → int #### [` numberof_relocation `]() property numberof\_relocation → int #### [` oem_id `]() property oem\_id → int #### [` oem_info `]() property oem\_info → int #### [` overlay_number `]() property overlay\_number → int #### [` used_bytes_in_last_page `]() property used\_bytes\_in\_last\_page → int --- ## [Header]() ### [` lief.PE.Header `]() class lief.PE.Header Bases: `Object` Class that represents the PE header (which follows the [`lief.PE.DosHeader`]( "lief.PE.DosHeader")) #### [` CHARACTERISTICS `]() class CHARACTERISTICS(*\*values*) Bases: `Flag` ##### [` AGGRESSIVE_WS_TRIM `]() AGGRESSIVE\_WS\_TRIM = 16 ##### [` BYTES_REVERSED_HI `]() BYTES\_REVERSED\_HI = 32768 ##### [` BYTES_REVERSED_LO `]() BYTES\_REVERSED\_LO = 128 ##### [` DEBUG_STRIPPED `]() DEBUG\_STRIPPED = 512 ##### [` DLL `]() DLL = 8192 ##### [` EXECUTABLE_IMAGE `]() EXECUTABLE\_IMAGE = 2 ##### [` LARGE_ADDRESS_AWARE `]() LARGE\_ADDRESS\_AWARE = 32 ##### [` LINE_NUMS_STRIPPED `]() LINE\_NUMS\_STRIPPED = 4 ##### [` LOCAL_SYMS_STRIPPED `]() LOCAL\_SYMS\_STRIPPED = 8 ##### [` NEED_32BIT_MACHINE `]() NEED\_32BIT\_MACHINE = 256 ##### [` NET_RUN_FROM_SWAP `]() NET\_RUN\_FROM\_SWAP = 2048 ##### [` RELOCS_STRIPPED `]() RELOCS\_STRIPPED = 1 ##### [` REMOVABLE_RUN_FROM_SWAP `]() REMOVABLE\_RUN\_FROM\_SWAP = 1024 ##### [` SYSTEM `]() SYSTEM = 4096 ##### [` UP_SYSTEM_ONLY `]() UP\_SYSTEM\_ONLY = 16384 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.Header.CHARACTERISTICS]( "lief.PE.Header.CHARACTERISTICS") = <nanobind.nb\_func object> #### [` MACHINE_TYPES `]() class MACHINE\_TYPES(*\*values*) Bases: `Enum` ##### [` ALPHA `]() ALPHA = 388 ##### [` ALPHA64 `]() ALPHA64 = 644 ##### [` AM33 `]() AM33 = 467 ##### [` AMD64 `]() AMD64 = 34404 ##### [` ARM `]() ARM = 448 ##### [` ARM64 `]() ARM64 = 43620 ##### [` ARM64EC `]() ARM64EC = 42561 ##### [` ARM64X `]() ARM64X = 42574 ##### [` ARMNT `]() ARMNT = 452 ##### [` CHPE_X86 `]() CHPE\_X86 = 14948 ##### [` EBC `]() EBC = 3772 ##### [` I386 `]() I386 = 332 ##### [` IA64 `]() IA64 = 512 ##### [` LOONGARCH32 `]() LOONGARCH32 = 25138 ##### [` LOONGARCH64 `]() LOONGARCH64 = 25188 ##### [` M32R `]() M32R = 36929 ##### [` MIPS16 `]() MIPS16 = 614 ##### [` MIPSFPU `]() MIPSFPU = 870 ##### [` MIPSFPU16 `]() MIPSFPU16 = 1126 ##### [` POWERPC `]() POWERPC = 496 ##### [` POWERPCBE `]() POWERPCBE = 498 ##### [` POWERPCFP `]() POWERPCFP = 497 ##### [` R4000 `]() R4000 = 358 ##### [` SH3 `]() SH3 = 418 ##### [` SH3DSP `]() SH3DSP = 419 ##### [` SH4 `]() SH4 = 422 ##### [` SH5 `]() SH5 = 424 ##### [` THUMB `]() THUMB = 450 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` WCEMIPSV2 `]() WCEMIPSV2 = 361 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.Header.MACHINE\_TYPES]( "lief.PE.Header.MACHINE_TYPES") = <nanobind.nb\_func object> #### [` add_characteristic `]() add\_characteristic(*self*, *characteristic: [lief.\_lief.PE.Header.CHARACTERISTICS]( "lief._lief.PE.Header.CHARACTERISTICS")*) → None Add the given [`CHARACTERISTICS`]( "lief.PE.Header.CHARACTERISTICS") to the header #### [` characteristics `]() property characteristics → int The [`CHARACTERISTICS`]( "lief.PE.Header.CHARACTERISTICS") that indicate the attributes of the file. #### [` characteristics_list `]() property characteristics\_list → list[[lief.PE.Header.CHARACTERISTICS]( "lief.PE.Header.CHARACTERISTICS")] Return the [`CHARACTERISTICS`]( "lief.PE.Header.CHARACTERISTICS") as a `list` #### [` copy `]() copy(*self*) → [lief.\_lief.PE.Header]( "lief._lief.PE.Header") Duplicate the current instance of this object #### [` create `]() create(*type: [lief.PE.PE\_TYPE]( "lief.PE.PE_TYPE")*) → [lief.PE.Header]( "lief.PE.Header") = <nanobind.nb\_func object> #### [` has_characteristic `]() has\_characteristic(*self*, *characteristic: [lief.\_lief.PE.Header.CHARACTERISTICS]( "lief._lief.PE.Header.CHARACTERISTICS")*) → bool `True` if the header has the given [`CHARACTERISTICS`]( "lief.PE.Header.CHARACTERISTICS") #### [` machine `]() property machine → [lief.PE.Header.MACHINE\_TYPES]( "lief.PE.Header.MACHINE_TYPES") The target machine architecture ([`MACHINE_TYPES`]( "lief.PE.Header.MACHINE_TYPES")) #### [` numberof_sections `]() property numberof\_sections → int Number of sections in the binary #### [` numberof_symbols `]() property numberof\_symbols → int The number of entries in the symbol table. This data can be used to locate the string table which immediately follows the symbol table. This value should be zero for an image because COFF debugging information is deprecated. #### [` pointerto_symbol_table `]() property pointerto\_symbol\_table → int The file offset of the COFF symbol table, or zero if no COFF symbol table is present. This value should be zero for an image because COFF debugging information is deprecated. #### [` remove_characteristic `]() remove\_characteristic(*self*, *characteristic: [lief.\_lief.PE.Header.CHARACTERISTICS]( "lief._lief.PE.Header.CHARACTERISTICS")*) → None Remove the given [`CHARACTERISTICS`]( "lief.PE.Header.CHARACTERISTICS") from the header #### [` signature `]() property signature → list[int] Signature (or magic byte) of the header. It must be: `PE\0\0` #### [` sizeof_optional_header `]() property sizeof\_optional\_header → int Size of the [`OptionalHeader`]( "lief.PE.OptionalHeader") **AND** the data directories which follows this header. This value is equivalent to: `sizeof(pe_optional_header) + NB_DATA_DIR * sizeof(data_directory)` This size **should** be either: > - 0xE0 (224) for a PE32 (32 bits) > - 0xF0 (240) for a PE32+ (64 bits) #### [` time_date_stamps `]() property time\_date\_stamps → int The low 32 bits of the number of seconds since 00:00 January 1, 1970 that indicates when the file was created. --- ## [Optional Header]() ### [` lief.PE.OptionalHeader `]() class lief.PE.OptionalHeader Bases: `Object` Class which represents the PE OptionalHeader structure. #### [` DLL_CHARACTERISTICS `]() class DLL\_CHARACTERISTICS(*\*values*) Bases: `IntFlag` ##### [` APPCONTAINER `]() APPCONTAINER = 4096 ##### [` DYNAMIC_BASE `]() DYNAMIC\_BASE = 64 ##### [` FORCE_INTEGRITY `]() FORCE\_INTEGRITY = 128 ##### [` GUARD_CF `]() GUARD\_CF = 16384 ##### [` HIGH_ENTROPY_VA `]() HIGH\_ENTROPY\_VA = 32 ##### [` NO_BIND `]() NO\_BIND = 2048 ##### [` NO_ISOLATION `]() NO\_ISOLATION = 512 ##### [` NO_SEH `]() NO\_SEH = 1024 ##### [` NX_COMPAT `]() NX\_COMPAT = 256 ##### [` TERMINAL_SERVER_AWARE `]() TERMINAL\_SERVER\_AWARE = 32768 ##### [` WDM_DRIVER `]() WDM\_DRIVER = 8192 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.OptionalHeader.DLL\_CHARACTERISTICS]( "lief.PE.OptionalHeader.DLL_CHARACTERISTICS") = <nanobind.nb\_func object> #### [` SUBSYSTEM `]() class SUBSYSTEM(*\*values*) Bases: `Enum` ##### [` EFI_APPLICATION `]() EFI\_APPLICATION = 10 ##### [` EFI_BOOT_SERVICE_DRIVER `]() EFI\_BOOT\_SERVICE\_DRIVER = 11 ##### [` EFI_ROM `]() EFI\_ROM = 13 ##### [` EFI_RUNTIME_DRIVER `]() EFI\_RUNTIME\_DRIVER = 12 ##### [` NATIVE `]() NATIVE = 1 ##### [` NATIVE_WINDOWS `]() NATIVE\_WINDOWS = 8 ##### [` OS2_CUI `]() OS2\_CUI = 5 ##### [` POSIX_CUI `]() POSIX\_CUI = 7 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` WINDOWS_BOOT_APPLICATION `]() WINDOWS\_BOOT\_APPLICATION = 16 ##### [` WINDOWS_CE_GUI `]() WINDOWS\_CE\_GUI = 9 ##### [` WINDOWS_CUI `]() WINDOWS\_CUI = 3 ##### [` WINDOWS_GUI `]() WINDOWS\_GUI = 2 ##### [` XBOX `]() XBOX = 14 ##### [` XBOX_CODE_CATALOG `]() XBOX\_CODE\_CATALOG = 17 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.OptionalHeader.SUBSYSTEM]( "lief.PE.OptionalHeader.SUBSYSTEM") = <nanobind.nb\_func object> #### [` add `]() add(*self*, *characteristic: [lief.\_lief.PE.OptionalHeader.DLL\_CHARACTERISTICS]( "lief._lief.PE.OptionalHeader.DLL_CHARACTERISTICS")*) → None Add the given [`DLL_CHARACTERISTICS`]( "lief.PE.OptionalHeader.DLL_CHARACTERISTICS") #### [` addressof_entrypoint `]() property addressof\_entrypoint → int The address of the entry point relative to the image base when the executable file is loaded into memory. For program images, this is the starting address. For device drivers, this is the address of the initialization function. An entry point is optional for DLLs. When no entry point is present, this field must be zero. #### [` baseof_code `]() property baseof\_code → int Address relative to the imagebase where the binary’s code starts #### [` baseof_data `]() property baseof\_data → int Address relative to the imagebase where the binary’s data starts. > **Warning** > > This value is not present for `PE64` files #### [` checksum `]() property checksum → int The image file checksum. The algorithm for computing the checksum is incorporated into `IMAGHELP.DLL`. The following are checked for validation at load time all **drivers**, any **DLL loaded at boot** time, and any **DLL** that is loaded into a **critical** Windows process. #### [` copy `]() copy(*self*) → [lief.\_lief.PE.OptionalHeader]( "lief._lief.PE.OptionalHeader") Duplicate the current instance of this object #### [` create `]() create(*type: [lief.PE.PE\_TYPE]( "lief.PE.PE_TYPE")*) → [lief.PE.OptionalHeader]( "lief.PE.OptionalHeader") = <nanobind.nb\_func object> #### [` dll_characteristics `]() property dll\_characteristics → int Some characteristics ([`DLL_CHARACTERISTICS`]( "lief.PE.OptionalHeader.DLL_CHARACTERISTICS")) of the underlying binary like the support of the PIE. The prefix `dll` comes from the official PE specifications but these characteristics are also used for **executables** #### [` dll_characteristics_lists `]() property dll\_characteristics\_lists → list[[lief.PE.OptionalHeader.DLL\_CHARACTERISTICS]( "lief.PE.OptionalHeader.DLL_CHARACTERISTICS")] [`dll_characteristics`]( "lief.PE.OptionalHeader.dll_characteristics") as a list of [`DLL_CHARACTERISTICS`]( "lief.PE.OptionalHeader.DLL_CHARACTERISTICS") #### [` file_alignment `]() property file\_alignment → int The alignment factor (in bytes) that is used to align the raw data of sections in the image file. The value should be a **power of 2** between 512 and 64K, inclusive. The default value is 512. If the [`section_alignment`]( "lief.PE.OptionalHeader.section_alignment") is less than the architecture’s page size, then [`file_alignment`]( "lief.PE.OptionalHeader.file_alignment") must match [`section_alignment`]( "lief.PE.OptionalHeader.section_alignment"). #### [` has `]() has(*self*, *characteristics: [lief.\_lief.PE.OptionalHeader.DLL\_CHARACTERISTICS]( "lief._lief.PE.OptionalHeader.DLL_CHARACTERISTICS")*) → bool `True` if the given [`DLL_CHARACTERISTICS`]( "lief.PE.OptionalHeader.DLL_CHARACTERISTICS") is in the [`dll_characteristics`]( "lief.PE.OptionalHeader.dll_characteristics") #### [` imagebase `]() property imagebase → int The preferred base address when mapping the binary in memory #### [` loader_flags `]() property loader\_flags → int According to the PE specifications, this value is *reserved* and **should** be 0. #### [` magic `]() property magic → [lief.PE.PE\_TYPE]( "lief.PE.PE_TYPE") Magic value ([`PE_TYPE`]( "lief.PE.PE_TYPE")) that identifies a `PE32` from a `PE64` #### [` major_image_version `]() property major\_image\_version → int The major version number of the image. #### [` major_linker_version `]() property major\_linker\_version → int The linker major version number #### [` major_operating_system_version `]() property major\_operating\_system\_version → int The major version number of the required operating system. #### [` major_subsystem_version `]() property major\_subsystem\_version → int The major version number of the subsystem. #### [` minor_image_version `]() property minor\_image\_version → int The minor version number of the image. #### [` minor_linker_version `]() property minor\_linker\_version → int The linker minor version number #### [` minor_operating_system_version `]() property minor\_operating\_system\_version → int The minor version number of the required operating system. #### [` minor_subsystem_version `]() property minor\_subsystem\_version → int The minor version number of the subsystem #### [` numberof_rva_and_size `]() property numberof\_rva\_and\_size → int The number of [`DataDirectory`]( "lief.PE.DataDirectory") that follow this header #### [` remove `]() remove(*self*, *characteristic: [lief.\_lief.PE.OptionalHeader.DLL\_CHARACTERISTICS]( "lief._lief.PE.OptionalHeader.DLL_CHARACTERISTICS")*) → None Remove the given [`DLL_CHARACTERISTICS`]( "lief.PE.OptionalHeader.DLL_CHARACTERISTICS") #### [` section_alignment `]() property section\_alignment → int The alignment (in bytes) of sections when they are loaded into memory. It must be greater than or equal to [`file_alignment`]( "lief.PE.OptionalHeader.file_alignment") and the default is the page size for the architecture. #### [` sizeof_code `]() property sizeof\_code → int The size of the code `.text` section or the sum of all the sections that contain code (ie. [`Section`]( "lief.PE.Section") with the flag [`CNT_CODE`]( "lief.PE.Section.CHARACTERISTICS.CNT_CODE")) #### [` sizeof_headers `]() property sizeof\_headers → int The combined size of an MS-DOS stub, PE header, and section headers rounded up to a multiple of [`file_alignment`]( "lief.PE.OptionalHeader.file_alignment"). #### [` sizeof_heap_commit `]() property sizeof\_heap\_commit → int The size of the local heap space to commit. #### [` sizeof_heap_reserve `]() property sizeof\_heap\_reserve → int The size of the local heap space to reserve. Only [`sizeof_heap_commit`]( "lief.PE.OptionalHeader.sizeof_heap_commit") is available one page at a time until the reserve size is reached. #### [` sizeof_image `]() property sizeof\_image → int The size (in bytes) of the image, including all headers, as the image is loaded in memory. It must be a multiple of [`section_alignment`]( "lief.PE.OptionalHeader.section_alignment") and should match [`virtual_size`]( "lief.PE.Binary.virtual_size"). #### [` sizeof_initialized_data `]() property sizeof\_initialized\_data → int The size of the initialized data which are usually located in the `.data` section. If the initialized data are split across multiple sections, it is the sum of the sections. The sections associated with the initialized data are usually identified with the flag [`CNT_INITIALIZED_DATA`]( "lief.PE.Section.CHARACTERISTICS.CNT_INITIALIZED_DATA") #### [` sizeof_stack_commit `]() property sizeof\_stack\_commit → int The size of the stack to commit. #### [` sizeof_stack_reserve `]() property sizeof\_stack\_reserve → int The size of the stack to reserve. Only [`sizeof_stack_commit`]( "lief.PE.OptionalHeader.sizeof_stack_commit") is committed, the rest is made available one page at a time until the reserve size is reached. #### [` sizeof_uninitialized_data `]() property sizeof\_uninitialized\_data → int The size of the uninitialized data which are usually located in the `.bss` section. If the uninitialized data are split across multiple sections, it is the sum of the sections. The sections associated with the uninitialized data are usually identified with the flag [`CNT_UNINITIALIZED_DATA`]( "lief.PE.Section.CHARACTERISTICS.CNT_UNINITIALIZED_DATA") #### [` subsystem `]() property subsystem → [lief.PE.OptionalHeader.SUBSYSTEM]( "lief.PE.OptionalHeader.SUBSYSTEM") Target subsystem ([`SUBSYSTEM`]( "lief.PE.OptionalHeader.SUBSYSTEM")) like Driver, XBox, Windows GUI, .. #### [` win32_version_value `]() property win32\_version\_value → int Reserved, must be zero. --- ## [Data Directory]() ### [` lief.PE.DataDirectory `]() class lief.PE.DataDirectory(*self*) Bases: `Object` Class that represents a PE data directory entry #### [` TYPES `]() class TYPES(*\*values*) Bases: `Enum` ##### [` ARCHITECTURE `]() ARCHITECTURE = 7 ##### [` BASE_RELOCATION_TABLE `]() BASE\_RELOCATION\_TABLE = 5 ##### [` BOUND_IMPORT `]() BOUND\_IMPORT = 11 ##### [` CERTIFICATE_TABLE `]() CERTIFICATE\_TABLE = 4 ##### [` CLR_RUNTIME_HEADER `]() CLR\_RUNTIME\_HEADER = 14 ##### [` DEBUG_DIR `]() DEBUG\_DIR = 6 ##### [` DELAY_IMPORT_DESCRIPTOR `]() DELAY\_IMPORT\_DESCRIPTOR = 13 ##### [` EXCEPTION_TABLE `]() EXCEPTION\_TABLE = 3 ##### [` EXPORT_TABLE `]() EXPORT\_TABLE = 0 ##### [` GLOBAL_PTR `]() GLOBAL\_PTR = 8 ##### [` IAT `]() IAT = 12 ##### [` IMPORT_TABLE `]() IMPORT\_TABLE = 1 ##### [` LOAD_CONFIG_TABLE `]() LOAD\_CONFIG\_TABLE = 10 ##### [` RESERVED `]() RESERVED = 15 ##### [` RESOURCE_TABLE `]() RESOURCE\_TABLE = 2 ##### [` TLS_TABLE `]() TLS\_TABLE = 9 ##### [` UNKNOWN `]() UNKNOWN = 16 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.DataDirectory.TYPES]( "lief.PE.DataDirectory.TYPES") = <nanobind.nb\_func object> #### [` content `]() property content → memoryview Raw content (bytes) referenced by this data directory #### [` copy `]() copy(*self*) → [lief.\_lief.PE.DataDirectory]( "lief._lief.PE.DataDirectory") Duplicate the current instance of this object #### [` has_section `]() property has\_section → bool `True` if the current data directory is tied to a [`Section`]( "lief.PE.Section") #### [` rva `]() property rva → int **Relative** virtual address of the content associated with the current data directory #### [` section `]() property section → [lief.PE.Section]( "lief.PE.Section") | None [`Section`]( "lief.PE.Section") associated with the current data directory or None if not linked #### [` size `]() property size → int Size in bytes of the content associated with the current data directory #### [` type `]() property type → [lief.PE.DataDirectory.TYPES]( "lief.PE.DataDirectory.TYPES") Type ([`TYPES`]( "lief.PE.DataDirectory.TYPES")) of the current data directory --- ## [Section]() ![Inheritance diagram of lief._lief.PE.Section](https://lief.re/doc/latest/_images/inheritance-4ec5847f99e6746fb5ba5ed346b3612401634fa6.png) ### [` lief.PE.Sectionlief.PE.Sectionlief.PE.Section `]() class lief.PE.Section(*self*) **class lief.PE.Section(*self*, *name: str*, *content: collections.abc.Sequence[int]*) **class lief.PE.Section(*self*, *name: str*)**** Bases: [`Section`]( "lief._lief.Section") Class which represents a PE section. It extends the base class [`lief.Section`]( "lief.Section") #### [` CHARACTERISTICS `]() class CHARACTERISTICS(*\*values*) Bases: `Flag` ##### [` ALIGN_1024BYTES `]() ALIGN\_1024BYTES = 11534336 ##### [` ALIGN_128BYTES `]() ALIGN\_128BYTES = 8388608 ##### [` ALIGN_16BYTES `]() ALIGN\_16BYTES = 5242880 ##### [` ALIGN_1BYTES `]() ALIGN\_1BYTES = 1048576 ##### [` ALIGN_2048BYTES `]() ALIGN\_2048BYTES = 12582912 ##### [` ALIGN_256BYTES `]() ALIGN\_256BYTES = 9437184 ##### [` ALIGN_2BYTES `]() ALIGN\_2BYTES = 2097152 ##### [` ALIGN_32BYTES `]() ALIGN\_32BYTES = 6291456 ##### [` ALIGN_4096BYTES `]() ALIGN\_4096BYTES = 13631488 ##### [` ALIGN_4BYTES `]() ALIGN\_4BYTES = 3145728 ##### [` ALIGN_512BYTES `]() ALIGN\_512BYTES = 10485760 ##### [` ALIGN_64BYTES `]() ALIGN\_64BYTES = 7340032 ##### [` ALIGN_8192BYTES `]() ALIGN\_8192BYTES = 14680064 ##### [` ALIGN_8BYTES `]() ALIGN\_8BYTES = 4194304 ##### [` CNT_CODE `]() CNT\_CODE = 32 ##### [` CNT_INITIALIZED_DATA `]() CNT\_INITIALIZED\_DATA = 64 ##### [` CNT_UNINITIALIZED_DATA `]() CNT\_UNINITIALIZED\_DATA = 128 ##### [` GPREL `]() GPREL = 32768 ##### [` LNK_COMDAT `]() LNK\_COMDAT = 4096 ##### [` LNK_INFO `]() LNK\_INFO = 512 ##### [` LNK_NRELOC_OVFL `]() LNK\_NRELOC\_OVFL = 16777216 ##### [` LNK_OTHER `]() LNK\_OTHER = 256 ##### [` LNK_REMOVE `]() LNK\_REMOVE = 2048 ##### [` MEM_16BIT `]() MEM\_16BIT = 131072 ##### [` MEM_DISCARDABLE `]() MEM\_DISCARDABLE = 33554432 ##### [` MEM_EXECUTE `]() MEM\_EXECUTE = 536870912 ##### [` MEM_LOCKED `]() MEM\_LOCKED = 262144 ##### [` MEM_NOT_CACHED `]() MEM\_NOT\_CACHED = 67108864 ##### [` MEM_NOT_PAGED `]() MEM\_NOT\_PAGED = 134217728 ##### [` MEM_PRELOAD `]() MEM\_PRELOAD = 524288 ##### [` MEM_PURGEABLE `]() MEM\_PURGEABLE = 65536 ##### [` MEM_READ `]() MEM\_READ = 1073741824 ##### [` MEM_SHARED `]() MEM\_SHARED = 268435456 ##### [` MEM_WRITE `]() MEM\_WRITE = 2147483648 ##### [` TYPE_NO_PAD `]() TYPE\_NO\_PAD = 8 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.Section.CHARACTERISTICS]( "lief.PE.Section.CHARACTERISTICS") = <nanobind.nb\_func object> #### [` characteristics `]() property characteristics → int The [`CHARACTERISTICS`]( "lief.PE.Section.CHARACTERISTICS") that describe the characteristics of the section #### [` characteristics_lists `]() property characteristics\_lists → list[[lief.PE.Section.CHARACTERISTICS]( "lief.PE.Section.CHARACTERISTICS")] [`characteristics`]( "lief.PE.Section.characteristics") as a `list` #### [` coff_string `]() property coff\_string → [lief.COFF.String]( "lief.COFF.String") | None Return the COFF string associated with the section’s name (or None) This coff string is usually present for long section names whose length does not fit in the 8 bytes allocated by the PE format. #### [` copy `]() copy(*self*) → [lief.\_lief.PE.Section]( "lief._lief.PE.Section") Duplicate the current instance of this object #### [` has_characteristic `]() has\_characteristic(*self*, *characteristic: [lief.\_lief.PE.Section.CHARACTERISTICS]( "lief._lief.PE.Section.CHARACTERISTICS")*) → bool `True` if the section has the given [`CHARACTERISTICS`]( "lief.PE.Section.CHARACTERISTICS") #### [` is_discardable `]() property is\_discardable → bool True if the section can be discarded as needed. This is typically the case for debug-related sections. #### [` numberof_line_numbers `]() property numberof\_line\_numbers → int The number of line-number entries for the section. This value should be zero for an image because COFF debugging information is deprecated. See: [`pointerto_line_numbers`]( "lief.PE.Section.pointerto_line_numbers") #### [` numberof_relocations `]() property numberof\_relocations → int The number of relocation entries for the section. See: [`pointerto_relocation`]( "lief.PE.Section.pointerto_relocation") #### [` padding `]() property padding → bytes Section padding content as bytes #### [` pointerto_line_numbers `]() property pointerto\_line\_numbers → int The file pointer to the beginning of line-number entries for the section. This is set to zero if there are no COFF line numbers. This value should be zero for an image because COFF debugging information is deprecated and modern debug information relies on the PDB files. #### [` pointerto_raw_data `]() property pointerto\_raw\_data → int The offset of the section data in the PE file. Alias of `offset` #### [` pointerto_relocation `]() property pointerto\_relocation → int The file pointer to the beginning of the COFF relocation entries for the section. This is set to zero for executable images or if there are no relocations. For modern PE binaries, this value is usually set to 0 as the relocations are managed by [`Relocation`]( "lief.PE.Relocation"). #### [` sizeof_raw_data `]() property sizeof\_raw\_data → int Alias of `size` (size of the data in the section) #### [` virtual_size `]() property virtual\_size → int The total size of the section when loaded into memory. If this value is greater than [`sizeof_raw_data`]( "lief.PE.Section.sizeof_raw_data"), the section is zero-padded. --- ## [Import]() ### [` lief.PE.Importlief.PE.Import `]() class lief.PE.Import(*self*) **class lief.PE.Import(*self*, *library\_name: str*)** Bases: `Object` Class that represents a PE import Overloaded function. 1. `__init__(self) -> None` Default constructor 2. `__init__(self, library_name: str) -> None` Constructor from a library name #### [` add_entryadd_entry `]() add\_entry(*self*, *entry: [lief.\_lief.PE.ImportEntry]( "lief._lief.PE.ImportEntry")*) → [lief.\_lief.PE.ImportEntry]( "lief._lief.PE.ImportEntry") **add\_entry(*self*, *function\_name: str*) → [lief.\_lief.PE.ImportEntry]( "lief._lief.PE.ImportEntry")** Add an [`ImportEntry`]( "lief.PE.ImportEntry") (function) to the current import #### [` directory `]() property directory → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the [`DataDirectory`]( "lief.PE.DataDirectory") associated with this import. It should be the one at index [`lief.PE.DataDirectory.TYPES.IMPORT_TABLE`]( "lief.PE.DataDirectory.TYPES.IMPORT_TABLE"). It can return None if the Import directory can’t be resolved. #### [` entries `]() property entries → lief.PE.Import.it\_entries Iterator over the [`ImportEntry`]( "lief.PE.ImportEntry") (functions) #### [` forwarder_chain `]() property forwarder\_chain → int The index of the first forwarder reference #### [` get_entry `]() get\_entry(*self*, *function\_name: str*) → [lief.\_lief.PE.ImportEntry]( "lief._lief.PE.ImportEntry") | None Return the [`ImportEntry`]( "lief.PE.ImportEntry") with the given name or None if not found #### [` get_function_rva_from_iat `]() get\_function\_rva\_from\_iat(*self*, *function\_name: str*) → int | [lief.\_lief.lief\_errors]( "lief._lief.lief_errors") Return the relative virtual address of the given function within the *Import Address Table* #### [` iat_directory `]() property iat\_directory → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the [`DataDirectory`]( "lief.PE.DataDirectory") associated with the `IAT` table. It should be the one at index [`lief.PE.DataDirectory.TYPES.IAT`]( "lief.PE.DataDirectory.TYPES.IAT"). It can return None if the IAT directory can’t be resolved. #### [` import_address_table_rva `]() property import\_address\_table\_rva → int The RVA of the import address table (`IAT`). The content of this table is **identical** to the content of the Import Lookup Table (`ILT`) until the image is bound. > **Warning** > > This address could change when re-building the binary #### [` import_lookup_table_rva `]() property import\_lookup\_table\_rva → int The RVA of the import lookup table. This table contains the [`name`]( "lief.PE.ImportEntry.name") or the [`ordinal`]( "lief.PE.ImportEntry.ordinal") for all the imports. #### [` name `]() property name → str | bytes Library name (e.g. `kernel32.dll`) #### [` name_rva `]() property name\_rva → int The original name rva #### [` remove_entryremove_entry `]() remove\_entry(*self*, *name: str*) → bool **remove\_entry(*self*, *ord: int*) → bool** Overloaded function. 1. `remove_entry(self, name: str) -> bool` > Remove the import entry with the given name. > > Return True if the deletion succeeds, False otherwise 2. `remove_entry(self, ord: int) -> bool` > Remove the import entry with the given ordinal number > > Return True if the deletion succeeds, False otherwise #### [` timedatestamp `]() property timedatestamp → int The stamp that is set to zero until the image is bound. After the image is bound, this field is set to the time/data stamp of the DLL --- ## [Import Entry]() ![Inheritance diagram of lief._lief.PE.ImportEntry](https://lief.re/doc/latest/_images/inheritance-0d8847179a2a8791a1abb018ab960e38abe26ede.png) ### [` lief.PE.ImportEntrylief.PE.ImportEntrylief.PE.ImportEntry `]() class lief.PE.ImportEntry(*self*) **class lief.PE.ImportEntry(*self*, *import\_name: str*) **class lief.PE.ImportEntry(*self*, *data: int*, *type: [lief.\_lief.PE.PE\_TYPE]( "lief._lief.PE.PE_TYPE")*)**** Bases: [`Symbol`]( "lief._lief.Symbol") Class that represents an entry (i.e. an import) in the import table ([`Import`]( "lief.PE.Import")). It extends the [`lief.Symbol`]( "lief.Symbol") generic class that provides the [`lief.Symbol.name`]( "lief.Symbol.name") and [`lief.Symbol.value`]( "lief.Symbol.value") Overloaded function. 1. `__init__(self) -> None` 2. `__init__(self, import_name: str) -> None` Constructor from a [`name`]( "lief.PE.ImportEntry.name") 3. `__init__(self, data: int, type: lief._lief.PE.PE_TYPE) -> None` #### [` copy `]() copy(*self*) → [lief.\_lief.PE.ImportEntry]( "lief._lief.PE.ImportEntry") Duplicate the current instance of this object #### [` data `]() property data → int Raw value #### [` demangled_name `]() property demangled\_name → str Demangled representation of the symbol or an empty string if it can’t be demangled. #### [` hint `]() property hint → int Index into the [`lief.PE.Export.entries`]( "lief.PE.Export.entries") that is used to speed-up the symbol resolution #### [` iat_address `]() property iat\_address → int **Original** address of the entry in the Import Address Table #### [` iat_value `]() property iat\_value → int Value of the current entry in the Import Address Table. It should match the lookup table value. #### [` ilt_value `]() property ilt\_value → int Original value in the import lookup table. This value should match the [`iat_value`]( "lief.PE.ImportEntry.iat_value") #### [` is_ordinal `]() property is\_ordinal → bool `True` if it is an import by ordinal #### [` name `]() property name → str | bytes Import name if not ordinal #### [` ordinal `]() property ordinal → int Ordinal value (if any). See: [`is_ordinal`]( "lief.PE.ImportEntry.is_ordinal") --- ## [Delay Import]() ### [` lief.PE.DelayImport `]() class lief.PE.DelayImport(*self*, *library\_name: str*) Bases: `Object` Class that represents a PE delay import Constructor from a library name #### [` attribute `]() property attribute → int Reserved and **should** be zero according to the PE specifications #### [` biat `]() property biat → int RVA of the **bound** delay-load import address table or 0 if the table does not exist. #### [` copy `]() copy(*self*) → [lief.\_lief.PE.DelayImport]( "lief._lief.PE.DelayImport") Duplicate the current instance of this object #### [` entries `]() property entries → lief.PE.DelayImport.it\_entries Iterator over the [`DelayImportEntry`]( "lief.PE.DelayImportEntry") (functions) #### [` handle `]() property handle → int The RVA of the module handle (in the `.data` section) It is used for storage by the routine that is supplied to manage delay-loading. #### [` iat `]() property iat → int RVA of the delay-load import address table. #### [` name `]() property name → str | bytes Library name (e.g. `kernel32.dll`) #### [` names_table `]() property names\_table → int RVA of the delay-load import names table. The content of this table has the same layout as the Import lookup table #### [` timestamp `]() property timestamp → int The timestamp of the DLL to which this image has been bound. #### [` uiat `]() property uiat → int RVA of the **unload** delay-load import address table or 0 if the table does not exist. According to the PE specifications, this table is an exact copy of the delay import address table that can be used to restore the original IAT in the case of unloading. --- ## [Delay Import Entry]() ![Inheritance diagram of lief._lief.PE.DelayImportEntry](https://lief.re/doc/latest/_images/inheritance-eb3b10b9aa120286296559dc2f4cc31831aae3ba.png) ### [` lief.PE.DelayImportEntry `]() class lief.PE.DelayImportEntry(*self*) Bases: [`Symbol`]( "lief._lief.Symbol") Class that represents an entry (i.e. a delay import) in the delay import table ([`DelayImport`]( "lief.PE.DelayImport")). It extends the [`lief.Symbol`]( "lief.Symbol") generic class that provides the [`lief.Symbol.name`]( "lief.Symbol.name") and [`lief.Symbol.value`]( "lief.Symbol.value") The meaning of [`lief.Symbol.value`]( "lief.Symbol.value") for this PE object is the address (as an RVA) in the IAT where the resolution should take place #### [` copy `]() copy(*self*) → [lief.\_lief.PE.DelayImportEntry]( "lief._lief.PE.DelayImportEntry") Duplicate the current instance of this object #### [` data `]() property data → int Raw value #### [` demangled_name `]() property demangled\_name → str Demangled representation of the symbol or an empty string if it can’t be demangled. #### [` hint `]() property hint → int Index into the [`lief.PE.Export.entries`]( "lief.PE.Export.entries") that is used to speed-up the symbol resolution #### [` iat_value `]() property iat\_value → int Value of the current entry in the delay-loaded import address table. See: `iat` #### [` is_ordinal `]() property is\_ordinal → bool `True` if it is an import by ordinal #### [` name `]() property name → str | bytes Delay import name if not ordinal #### [` ordinal `]() property ordinal → int Ordinal value (if any). See: [`is_ordinal`]( "lief.PE.DelayImportEntry.is_ordinal") --- ## [TLS]() ### [` lief.PE.TLS `]() class lief.PE.TLS(*self*) Bases: `Object` Class which represents the PE Thread Local Storage. This PE structure is also used to implement binary/library constructors. Default constructor #### [` add_callback `]() add\_callback(*self*, *addr: int*) → [lief.\_lief.PE.TLS]( "lief._lief.PE.TLS") Add a new TLS callback #### [` addressof_callbacks `]() property addressof\_callbacks → int Pointer to an array of TLS callback functions. The array is null-terminated, so if there is no callback, this field points to 4 bytes set to zero. See: [`callbacks`]( "lief.PE.TLS.callbacks") #### [` addressof_index `]() property addressof\_index → int The location to receive the TLS index assigned by the loader. This location should be located in a writable section like `.data`. #### [` addressof_raw_data `]() property addressof\_raw\_data → tuple[int, int] Tuple `(start address, end address)` of the TLS template. The template is a block of data that is used to initialize TLS data. The system copies all of this data each time a thread is created, so it must not be corrupted. > **Note** > > These addresses are not RVA. It is addresses for which there should be a base relocation in the `.reloc` section. #### [` callbacks `]() property callbacks → list[int] List of the callbacks associated with the current TLS. These functions are called before any other functions. #### [` characteristics `]() property characteristics → int The four bits [23:20] describe alignment info. Possible values are those defined as `IMAGE_SCN_ALIGN_*`, which are also used to describe alignment of section in object files. The other 28 bits are reserved for future use. #### [` copy `]() copy(*self*) → [lief.\_lief.PE.TLS]( "lief._lief.PE.TLS") Duplicate the current instance of this object #### [` data_template `]() property data\_template → memoryview The initial content used to initialize TLS data. #### [` directory `]() property directory → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None [`DataDirectory`]( "lief.PE.DataDirectory") associated with the TLS object (or None if not linked) #### [` has_data_directory `]() property has\_data\_directory → bool `True` if there is a [`DataDirectory`]( "lief.PE.DataDirectory") associated with the TLS object #### [` has_section `]() property has\_section → bool `True` if there is a [`Section`]( "lief.PE.Section") associated with the TLS object #### [` section `]() property section → [lief.PE.Section]( "lief.PE.Section") | None [`Section`]( "lief.PE.Section") associated with the TLS object (or None if not linked) #### [` sizeof_zero_fill `]() property sizeof\_zero\_fill → int Size in bytes of the zeros to be *padded* after the data specified by [`data_template`]( "lief.PE.TLS.data_template"). --- ## [Relocation]() ### [` lief.PE.Relocation `]() class lief.PE.Relocation(*self*) Bases: `Object` Class which represents the *Base Relocation Block* Usually, we find this structure in the `.reloc` section #### [` add_entry `]() add\_entry(*self*, *new\_entry: [lief.\_lief.PE.RelocationEntry]( "lief._lief.PE.RelocationEntry")*) → [lief.\_lief.PE.RelocationEntry]( "lief._lief.PE.RelocationEntry") Add a new [`RelocationEntry`]( "lief.PE.RelocationEntry") #### [` block_size `]() property block\_size → int The total number of bytes in the base relocation block. `block_size = sizeof(BaseRelocationBlock) + nb_of_relocs * sizeof(uint16_t = RelocationEntry)` #### [` copy `]() copy(*self*) → [lief.\_lief.PE.Relocation]( "lief._lief.PE.Relocation") Duplicate the current instance of this object #### [` entries `]() property entries → lief.PE.Relocation.it\_entries Iterator over the [`RelocationEntry`]( "lief.PE.RelocationEntry") #### [` virtual_address `]() property virtual\_address → int The RVA for which the offset of the relocation entries (RelocationEntry) is added --- ## [Relocation Entry]() ![Inheritance diagram of lief._lief.PE.RelocationEntry](https://lief.re/doc/latest/_images/inheritance-95557131fc2837858595d2a195361e582d395a11.png) ### [` lief.PE.RelocationEntrylief.PE.RelocationEntry `]() class lief.PE.RelocationEntry(*self*) **class lief.PE.RelocationEntry(*self*, *arg0: int*, *arg1: [lief.\_lief.PE.RelocationEntry.BASE\_TYPES]( "lief._lief.PE.RelocationEntry.BASE_TYPES")*, */*)** Bases: [`Relocation`]( "lief._lief.Relocation") Class which represents an entry of the PE relocation table. It extends the [`lief.Relocation`]( "lief.Relocation") object to provide an uniform API across the file formats. #### [` BASE_TYPES `]() class BASE\_TYPES(*\*values*) Bases: `Enum` ##### [` ABS `]() ABS = 0 ##### [` ARM_MOV32 `]() ARM\_MOV32 = 517 ##### [` DIR64 `]() DIR64 = 10 ##### [` HIGH `]() HIGH = 1 ##### [` HIGH3ADJ `]() HIGH3ADJ = 11 ##### [` HIGHADJ `]() HIGHADJ = 4 ##### [` HIGHLOW `]() HIGHLOW = 3 ##### [` LOW `]() LOW = 2 ##### [` MIPS_JMPADDR `]() MIPS\_JMPADDR = 261 ##### [` MIPS_JMPADDR16 `]() MIPS\_JMPADDR16 = 9 ##### [` RISCV_HI20 `]() RISCV\_HI20 = 1029 ##### [` RISCV_LOW12I `]() RISCV\_LOW12I = 4103 ##### [` RISCV_LOW12S `]() RISCV\_LOW12S = 8200 ##### [` SECTION `]() SECTION = 6 ##### [` THUMB_MOV32 `]() THUMB\_MOV32 = 2055 ##### [` UNKNOWN `]() UNKNOWN = -1 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.RelocationEntry.BASE\_TYPES]( "lief.PE.RelocationEntry.BASE_TYPES") = <nanobind.nb\_func object> #### [` data `]() property data → int Raw data of the relocation: - The **high** 4 bits store the relocation [`type`]( "lief.PE.RelocationEntry.type") - The **low** 12 bits store the relocation offset ([`position`]( "lief.PE.RelocationEntry.position")) #### [` position `]() property position → int Offset - relative to [`virtual_address`]( "lief.PE.Relocation.virtual_address") - where the relocation occurs #### [` type `]() property type → [lief.PE.RelocationEntry.BASE\_TYPES]( "lief.PE.RelocationEntry.BASE_TYPES") Type of the relocation --- ## [Export]() ### [` lief.PE.Exportlief.PE.Export `]() class lief.PE.Export(*self*) **class lief.PE.Export(*self*, *name: str*, *entries: collections.abc.Sequence[[lief.\_lief.PE.ExportEntry]( "lief._lief.PE.ExportEntry")]*)** Bases: `Object` Class which represents a PE Export Overloaded function. 1. `__init__(self) -> None` Default constructor 2. `__init__(self, name: str, entries: collections.abc.Sequence[lief._lief.PE.ExportEntry]) -> None` Constructor from DLL name and its exports #### [` add_entryadd_entry `]() add\_entry(*self*, *exp: [lief.\_lief.PE.ExportEntry]( "lief._lief.PE.ExportEntry")*) → [lief.\_lief.PE.ExportEntry]( "lief._lief.PE.ExportEntry") **add\_entry(*self*, *name: str*, *addr: int*) → [lief.\_lief.PE.ExportEntry]( "lief._lief.PE.ExportEntry")** Add the given export and return the newly created and added entry #### [` copy `]() copy(*self*) → [lief.\_lief.PE.Export]( "lief._lief.PE.Export") Duplicate the current instance of this object #### [` entries `]() property entries → lief.PE.Export.it\_entries Iterator over the [`ExportEntry`]( "lief.PE.ExportEntry") #### [` export_addr_table_cnt `]() property export\_addr\_table\_cnt → int Number of entries in the export address table #### [` export_addr_table_rva `]() property export\_addr\_table\_rva → int RVA of the export address table #### [` export_flags `]() property export\_flags → int According to the PE specifications this value is reserved and should be set to 0 #### [` find_entryfind_entry `]() find\_entry(*self*, *name: str*) → [lief.\_lief.PE.ExportEntry]( "lief._lief.PE.ExportEntry") | None **find\_entry(*self*, *ordinal: int*) → [lief.\_lief.PE.ExportEntry]( "lief._lief.PE.ExportEntry") | None** Overloaded function. 1. `find_entry(self, name: str) -> lief._lief.PE.ExportEntry | None` Find the export with the given name 2. `find_entry(self, ordinal: int) -> lief._lief.PE.ExportEntry | None` Find the export entry with the given ordinal number #### [` find_entry_at `]() find\_entry\_at(*self*, *rva\_addr: int*) → [lief.\_lief.PE.ExportEntry]( "lief._lief.PE.ExportEntry") | None Find the export entry at the provided RVA #### [` major_version `]() property major\_version → int The major version number (can be user-defined) #### [` minor_version `]() property minor\_version → int The minor version number (can be user-defined) #### [` name `]() property name → str | bytes The name of the library exported (e.g. `KERNEL32.dll`) #### [` name_rva `]() property name\_rva → int Address of the ASCII DLL’s name (RVA) #### [` names_addr_table_cnt `]() property names\_addr\_table\_cnt → int Number of exports by name #### [` names_addr_table_rva `]() property names\_addr\_table\_rva → int RVA to the list of exported names #### [` ord_addr_table_rva `]() property ord\_addr\_table\_rva → int RVA to the list of exported ordinals #### [` ordinal_base `]() property ordinal\_base → int The starting number for the exports. Usually this value is set to 1 #### [` remove_entryremove_entryremove_entry `]() remove\_entry(*self*, *entry: [lief.\_lief.PE.ExportEntry]( "lief._lief.PE.ExportEntry")*) → bool **remove\_entry(*self*, *name: str*) → bool **remove\_entry(*self*, *rva: int*) → bool**** Overloaded function. 1. `remove_entry(self, entry: lief._lief.PE.ExportEntry) -> bool` Remove the given export entry 2. `remove_entry(self, name: str) -> bool` Remove the export entry with the given name 3. `remove_entry(self, rva: int) -> bool` Remove the export entry with the given RVA #### [` timestamp `]() property timestamp → int The time and date that the export data was created --- ## [Export Entry]() ![Inheritance diagram of lief._lief.PE.ExportEntry](https://lief.re/doc/latest/_images/inheritance-f7265a6267bcab14ecabc92c7abd26727b8d91dd.png) ### [` lief.PE.ExportEntrylief.PE.ExportEntry `]() class lief.PE.ExportEntry(*self*) **class lief.PE.ExportEntry(*self*, *name: str*, *addr: int*)** Bases: [`Symbol`]( "lief._lief.Symbol") Class which represents a PE Export entry (cf. [`lief.PE.Export`]( "lief.PE.Export")) Overloaded function. 1. `__init__(self) -> None` Default constructor 2. `__init__(self, name: str, addr: int) -> None` Constructor with export name and address #### [` address `]() property address → int #### [` demangled_name `]() property demangled\_name → str Demangled representation of the symbol or an empty string if it can’t be demangled. #### [` forward_information `]() property forward\_information → [lief.PE.ExportEntry.forward\_information\_t]( "lief.PE.ExportEntry.forward_information_t") #### [` forward_information_t `]() class forward\_information\_t Bases: `object` ##### [` function `]() property function → str ##### [` library `]() property library → str #### [` function_rva `]() property function\_rva → int #### [` is_extern `]() property is\_extern → bool #### [` is_forwarded `]() property is\_forwarded → bool #### [` name `]() property name → str | bytes #### [` ordinal `]() property ordinal → int #### [` set_forward_info `]() set\_forward\_info(*self*, *lib: str*, *function: str*) → None --- ## [Signature]() ### [` lief.PE.Signature `]() class lief.PE.Signature Bases: `Object` #### [` VERIFICATION_CHECKS `]() class VERIFICATION\_CHECKS(*\*values*) Bases: `Flag` Flags to tweak the verification process of the signature See [`lief.PE.Signature.check()`]( "lief.PE.Signature.check") and [`lief.PE.Binary.verify_signature()`]( "lief.PE.Binary.verify_signature") ##### [` DEFAULT `]() DEFAULT = 1 ##### [` HASH_ONLY `]() HASH\_ONLY = 2 ##### [` LIFETIME_SIGNING `]() LIFETIME\_SIGNING = 4 ##### [` SKIP_CERT_TIME `]() SKIP\_CERT\_TIME = 8 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.Signature.VERIFICATION\_CHECKS]( "lief.PE.Signature.VERIFICATION_CHECKS") = <nanobind.nb\_func object> #### [` VERIFICATION_FLAGS `]() class VERIFICATION\_FLAGS(*\*values*) Bases: `Flag` ##### [` BAD_DIGEST `]() BAD\_DIGEST = 128 ##### [` BAD_SIGNATURE `]() BAD\_SIGNATURE = 256 ##### [` CERT_EXPIRED `]() CERT\_EXPIRED = 1024 ##### [` CERT_FUTURE `]() CERT\_FUTURE = 2048 ##### [` CERT_NOT_FOUND `]() CERT\_NOT\_FOUND = 8 ##### [` CORRUPTED_AUTH_DATA `]() CORRUPTED\_AUTH\_DATA = 32 ##### [` CORRUPTED_CONTENT_INFO `]() CORRUPTED\_CONTENT\_INFO = 16 ##### [` INCONSISTENT_DIGEST_ALGORITHM `]() INCONSISTENT\_DIGEST\_ALGORITHM = 4 ##### [` INVALID_SIGNER `]() INVALID\_SIGNER = 1 ##### [` MISSING_PKCS9_MESSAGE_DIGEST `]() MISSING\_PKCS9\_MESSAGE\_DIGEST = 64 ##### [` NO_SIGNATURE `]() NO\_SIGNATURE = 512 ##### [` OK `]() OK = 0 ##### [` UNSUPPORTED_ALGORITHM `]() UNSUPPORTED\_ALGORITHM = 2 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.Signature.VERIFICATION\_FLAGS]( "lief.PE.Signature.VERIFICATION_FLAGS") = <nanobind.nb\_func object> #### [` certificates `]() property certificates → lief.PE.Signature.it\_const\_crt Return an iterator over [`x509`]( "lief.PE.x509") certificates #### [` check `]() check(*self*, *checks: [lief.\_lief.PE.Signature.VERIFICATION\_CHECKS]( "lief._lief.PE.Signature.VERIFICATION_CHECKS") = VERIFICATION\_CHECKS.DEFAULT*) → [lief.\_lief.PE.Signature.VERIFICATION\_FLAGS]( "lief._lief.PE.Signature.VERIFICATION_FLAGS") Check the integrity of the signature and return a [`lief.PE.Signature.VERIFICATION_FLAGS`]( "lief.PE.Signature.VERIFICATION_FLAGS") By default, it performs the following verifications: 1. It must contain only **one** signer info ([`signers`]( "lief.PE.Signature.signers")) 2. [`lief.PE.Signature.digest_algorithm`]( "lief.PE.Signature.digest_algorithm") must match: - [`lief.PE.ContentInfo.digest_algorithm`]( "lief.PE.ContentInfo.digest_algorithm") - [`lief.PE.SignerInfo.digest_algorithm`]( "lief.PE.SignerInfo.digest_algorithm") 3. The x509 certificate specified by [`lief.PE.SignerInfo.serial_number`]( "lief.PE.SignerInfo.serial_number") **and** [`lief.PE.SignerInfo.issuer`]( "lief.PE.SignerInfo.issuer") must exist within [`lief.PE.Signature.certificates`]( "lief.PE.Signature.certificates") 4. Given the x509 certificate, compare [`lief.PE.SignerInfo.encrypted_digest`]( "lief.PE.SignerInfo.encrypted_digest") against either: - hash of authenticated attributes ([`authenticated_attributes`]( "lief.PE.SignerInfo.authenticated_attributes")) if present - hash of ContentInfo 5. If they are Authenticated attributes, check that a PKCS9\_MESSAGE\_DIGEST ([`lief.PE.PKCS9MessageDigest`]( "lief.PE.PKCS9MessageDigest")) attribute exists and that its value matches hash of ContentInfo 6. Check the validity of the PKCS #9 counter signature if present 7. If the signature doesn’t embed a signing-time in the counter signature, check the certificate validity. (See [`lief.PE.Signature.VERIFICATION_CHECKS.LIFETIME_SIGNING`]( "lief.PE.Signature.VERIFICATION_CHECKS.LIFETIME_SIGNING") and [`lief.PE.Signature.VERIFICATION_CHECKS.SKIP_CERT_TIME`]( "lief.PE.Signature.VERIFICATION_CHECKS.SKIP_CERT_TIME")) See: [`lief.PE.Signature.VERIFICATION_CHECKS`]( "lief.PE.Signature.VERIFICATION_CHECKS") to tweak the behavior #### [` content_info `]() property content\_info → [lief.PE.ContentInfo]( "lief.PE.ContentInfo") Return the [`ContentInfo`]( "lief.PE.ContentInfo") #### [` digest_algorithm `]() property digest\_algorithm → [lief.PE.ALGORITHMS]( "lief.PE.ALGORITHMS") Return the algorithm ([`ALGORITHMS`]( "lief.PE.ALGORITHMS")) used to sign the content of [`ContentInfo`]( "lief.PE.ContentInfo") #### [` find_crt `]() find\_crt(*self*, *serialno: collections.abc.Sequence[int]*) → [lief.\_lief.PE.x509]( "lief._lief.PE.x509") | None Find the [`x509`]( "lief.PE.x509") certificate according to its serial number #### [` find_crt_issuerfind_crt_issuer `]() find\_crt\_issuer(*self*, *issuer: str*) → [lief.\_lief.PE.x509]( "lief._lief.PE.x509") | None **find\_crt\_issuer(*self*, *issuer: str*, *serialno: collections.abc.Sequence[int]*) → [lief.\_lief.PE.x509]( "lief._lief.PE.x509") | None** Overloaded function. 1. `find_crt_issuer(self, issuer: str) -> lief._lief.PE.x509 | None` Find the [`x509`]( "lief.PE.x509") certificate according to its issuer 2. `find_crt_issuer(self, issuer: str, serialno: collections.abc.Sequence[int]) -> lief._lief.PE.x509 | None` Find the [`x509`]( "lief.PE.x509") certificate according to its issuer **AND** its serial number #### [` find_crt_subjectfind_crt_subject `]() find\_crt\_subject(*self*, *subject: str*) → [lief.\_lief.PE.x509]( "lief._lief.PE.x509") | None **find\_crt\_subject(*self*, *subject: str*, *serialno: collections.abc.Sequence[int]*) → [lief.\_lief.PE.x509]( "lief._lief.PE.x509") | None** Overloaded function. 1. `find_crt_subject(self, subject: str) -> lief._lief.PE.x509 | None` Find the [`x509`]( "lief.PE.x509") certificate according to its subject 2. `find_crt_subject(self, subject: str, serialno: collections.abc.Sequence[int]) -> lief._lief.PE.x509 | None` Find the [`x509`]( "lief.PE.x509") certificate according to its subject **AND** its serial number #### [` parse `]() parse(*\*args*) → [lief.PE.Signature]( "lief.PE.Signature") | None = <nanobind.nb\_func object> #### [` raw_der `]() property raw\_der → memoryview Return the raw original signature as a byte object #### [` signers `]() property signers → lief.PE.Signature.it\_const\_signers\_t Return an iterator over the signers ([`SignerInfo`]( "lief.PE.SignerInfo")) #### [` version `]() property version → int Version of the signature. It should be 1 --- ## [Signature Attribute]() ![Inheritance diagram of lief._lief.PE.PKCS9CounterSignature, lief._lief.PE.Attribute, lief._lief.PE.MsCounterSign, lief._lief.PE.MsManifestBinaryID, lief._lief.PE.PKCS9AtSequenceNumber, lief._lief.PE.ContentType, lief._lief.PE.SpcRelaxedPeMarkerCheck, lief._lief.PE.MsSpcNestedSignature, lief._lief.PE.SigningCertificateV2, lief._lief.PE.SpcSpOpusInfo, lief._lief.PE.PKCS9SigningTime, lief._lief.PE.GenericType, lief._lief.PE.PKCS9MessageDigest, lief._lief.PE.MsSpcStatementType](https://lief.re/doc/latest/_images/inheritance-94f3792e965be92f8a7903556e513bf93ea4b820.png) ### [` lief.PE.Attribute `]() class lief.PE.Attribute Bases: `Object` Interface over PKCS #7 attribute #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` ##### [` CONTENT_TYPE `]() CONTENT\_TYPE = 1 ##### [` GENERIC_TYPE `]() GENERIC\_TYPE = 2 ##### [` MS_COUNTER_SIGN `]() MS\_COUNTER\_SIGN = 6 ##### [` MS_PLATFORM_MANIFEST_BINARY_ID `]() MS\_PLATFORM\_MANIFEST\_BINARY\_ID = 9 ##### [` MS_SPC_NESTED_SIGN `]() MS\_SPC\_NESTED\_SIGN = 7 ##### [` MS_SPC_STATEMENT_TYPE `]() MS\_SPC\_STATEMENT\_TYPE = 8 ##### [` PKCS9_AT_SEQUENCE_NUMBER `]() PKCS9\_AT\_SEQUENCE\_NUMBER = 10 ##### [` PKCS9_COUNTER_SIGNATURE `]() PKCS9\_COUNTER\_SIGNATURE = 11 ##### [` PKCS9_MESSAGE_DIGEST `]() PKCS9\_MESSAGE\_DIGEST = 12 ##### [` PKCS9_SIGNING_TIME `]() PKCS9\_SIGNING\_TIME = 13 ##### [` SIGNING_CERTIFICATE_V2 `]() SIGNING\_CERTIFICATE\_V2 = 3 ##### [` SPC_RELAXED_PE_MARKER_CHECK `]() SPC\_RELAXED\_PE\_MARKER\_CHECK = 5 ##### [` SPC_SP_OPUS_INFO `]() SPC\_SP\_OPUS\_INFO = 4 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.Attribute.TYPE]( "lief.PE.Attribute.TYPE") = <nanobind.nb\_func object> #### [` type `]() property type → [lief.PE.Attribute.TYPE]( "lief.PE.Attribute.TYPE") Concrete type of the attribute --- ## [Signature ContentType]() ![Inheritance diagram of lief._lief.PE.ContentType](https://lief.re/doc/latest/_images/inheritance-68ea2eed31ab0290254f41e5c925d99b28995375.png) ### [` lief.PE.ContentType `]() class lief.PE.ContentType Bases: [`Attribute`]( "lief._lief.PE.Attribute") Interface over the structure described by the OID `1.2.840.113549.1.9.3` (PKCS #9) The internal structure is described in the: [RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0]() ```text ContentType ::= OBJECT IDENTIFIER ``` #### [` oid `]() property oid → str OID as described in RFC #2985 (string object) --- ## [Signature GenericType]() ![Inheritance diagram of lief._lief.PE.GenericType](https://lief.re/doc/latest/_images/inheritance-6072a4c4cb1f8467d8b3bd789137016f89966b4b.png) ### [` lief.PE.GenericType `]() class lief.PE.GenericType Bases: [`Attribute`]( "lief._lief.PE.Attribute") Interface over an attribute for which the internal structure is not supported by LIEF #### [` oid `]() property oid → str OID of the original attribute #### [` raw_content `]() property raw\_content → memoryview Original DER blob of the attribute --- ## [Signature MsSpcNestedSignature]() ![Inheritance diagram of lief._lief.PE.MsSpcNestedSignature](https://lief.re/doc/latest/_images/inheritance-c583655be46254480df30f51fe698addaef7ecf0.png) ### [` lief.PE.MsSpcNestedSignature `]() class lief.PE.MsSpcNestedSignature Bases: [`Attribute`]( "lief._lief.PE.Attribute") Interface over the structure described by the OID `1.3.6.1.4.1.311.2.4.1` The internal structure is not documented but we can infer the following structure: ```text MsSpcNestedSignature ::= SET OF SignedData ``` With `SignedData`, the structure described in PKCS #7 RFC (See: [`lief.PE.Signature`]( "lief.PE.Signature")) #### [` signature `]() property signature → [lief.PE.Signature]( "lief.PE.Signature") Underlying [`Signature`]( "lief.PE.Signature") object --- ## [Signature MsSpcStatementType]() ![Inheritance diagram of lief._lief.PE.MsSpcStatementType](https://lief.re/doc/latest/_images/inheritance-a99d0cdd8d0b2066ff4126281fe75e12c38726df.png) ### [` lief.PE.MsSpcStatementType `]() class lief.PE.MsSpcStatementType Bases: [`Attribute`]( "lief._lief.PE.Attribute") Interface over the structure described by the OID `1.3.6.1.4.1.311.2.1.11` The internal structure is described in the official document: [Windows Authenticode Portable Executable Signature Format]() ```text SpcStatementType ::= SEQUENCE of OBJECT IDENTIFIER ``` #### [` oid `]() property oid → str According to the documentation: ```default The SpcStatementType MUST contain one Object Identifier with either the value ``1.3.6.1.4.1.311.2.1.21 (SPC_INDIVIDUAL_SP_KEY_PURPOSE_OBJID)`` or ``1.3.6.1.4.1.311.2.1.22 (SPC_COMMERCIAL_SP_KEY_PURPOSE_OBJID)``. ``` --- ## [Signature PKCS9AtSequenceNumber]() ![Inheritance diagram of lief._lief.PE.PKCS9AtSequenceNumber](https://lief.re/doc/latest/_images/inheritance-c566c72b742bfc686faeba12a40fd9de7ebb3eee.png) ### [` lief.PE.PKCS9AtSequenceNumber `]() class lief.PE.PKCS9AtSequenceNumber Bases: [`Attribute`]( "lief._lief.PE.Attribute") Interface over the structure described by the OID `1.2.840.113549.1.9.25.4` (PKCS #9) The internal structure is described in the [RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0]() ```text sequenceNumber ATTRIBUTE ::= { WITH SYNTAX SequenceNumber EQUALITY MATCHING RULE integerMat SINGLE VALUE TRUE ID pkcs-9-at-sequenceNumber } SequenceNumber ::= INTEGER (1..MAX) ``` #### [` number `]() property number → int Number as described in the RFC --- ## [Signature PKCS9CounterSignature]() ![Inheritance diagram of lief._lief.PE.PKCS9CounterSignature](https://lief.re/doc/latest/_images/inheritance-aec95366d78a3cd0fe415bb41938bde6d7ee3ae9.png) ### [` lief.PE.PKCS9CounterSignature `]() class lief.PE.PKCS9CounterSignature Bases: [`Attribute`]( "lief._lief.PE.Attribute") Interface over the structure described by the OID `1.2.840.113549.1.9.6` (PKCS #9) The internal structure is described in the [RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0]() ```text counterSignature ATTRIBUTE ::= { WITH SYNTAX SignerInfo ID pkcs-9-at-counterSignature } ``` #### [` signer `]() property signer → [lief.PE.SignerInfo]( "lief.PE.SignerInfo") Return the [`SignerInfo`]( "lief.PE.SignerInfo") as described in the RFC #2985 --- ## [Signature PKCS9MessageDigest]() ![Inheritance diagram of lief._lief.PE.PKCS9MessageDigest](https://lief.re/doc/latest/_images/inheritance-44cb689b680e830bcf5ed055db8aba6bfbec9ff8.png) ### [` lief.PE.PKCS9MessageDigest `]() class lief.PE.PKCS9MessageDigest Bases: [`Attribute`]( "lief._lief.PE.Attribute") Interface over the structure described by the OID `1.2.840.113549.1.9.4` (PKCS #9) The internal structure is described in the [RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0]() ```text messageDigest ATTRIBUTE ::= { WITH SYNTAX MessageDigest EQUALITY MATCHING RULE octet SINGLE VALUE TRUE ID pkcs-9-at-messageDigest } MessageDigest ::= OCTET STRING ``` #### [` digest `]() property digest → bytes Message digest as a blob of bytes as described in the RFC --- ## [Signature PKCS9SigningTime]() ![Inheritance diagram of lief._lief.PE.PKCS9SigningTime](https://lief.re/doc/latest/_images/inheritance-63d71d38b0452b44085c9b0424f9908b81750f2a.png) ### [` lief.PE.PKCS9SigningTime `]() class lief.PE.PKCS9SigningTime Bases: [`Attribute`]( "lief._lief.PE.Attribute") Interface over the structure described by the OID `1.2.840.113549.1.9.5` (PKCS #9) The internal structure is described in the [RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0]() ```text signingTime ATTRIBUTE ::= { WITH SYNTAX SigningTime EQUALITY MATCHING RULE signingTimeMatch SINGLE VALUE TRUE ID pkcs-9-at-signingTime } SigningTime ::= Time -- imported from ISO/IEC 9594-8 ``` #### [` time `]() property time → list[int] Time as a list [year, month, day, hour, min, sec] --- ## [Signature SpcSpOpusInfo]() ![Inheritance diagram of lief._lief.PE.SpcSpOpusInfo](https://lief.re/doc/latest/_images/inheritance-93dd785fdff90ccf7d2b3c2c253963b4ea15d799.png) ### [` lief.PE.SpcSpOpusInfo `]() class lief.PE.SpcSpOpusInfo Bases: [`Attribute`]( "lief._lief.PE.Attribute") Interface over the structure described by the OID `1.3.6.1.4.1.311.2.1.12` The internal structure is described in the official document: [Windows Authenticode Portable Executable Signature Format]() ```text SpcSpOpusInfo ::= SEQUENCE { programName [0] EXPLICIT SpcString OPTIONAL, moreInfo [1] EXPLICIT SpcLink OPTIONAL } ``` #### [` more_info `]() property more\_info → str | bytes Other information such as an URL #### [` program_name `]() property program\_name → str | bytes Program description provided by the publisher --- ## [Signature SpcIndirectData]() ![Inheritance diagram of lief._lief.PE.SpcIndirectData](https://lief.re/doc/latest/_images/inheritance-74d8c1344ad990b674d2729a43782875d2d3b408.png) ### [` lief.PE.SpcIndirectData `]() class lief.PE.SpcIndirectData Bases: [`Content`]( "lief._lief.PE.ContentInfo.Content") #### [` digest `]() property digest → memoryview #### [` digest_algorithm `]() property digest\_algorithm → [lief.PE.ALGORITHMS]( "lief.PE.ALGORITHMS") Digest used to hash the file. This should match [`digest_algorithm`]( "lief.PE.SignerInfo.digest_algorithm") #### [` file `]() property file → str #### [` url `]() property url → str --- ## [GenericContent]() ![Inheritance diagram of lief._lief.PE.GenericContent](https://lief.re/doc/latest/_images/inheritance-ac9d59568814b05fc4fcd19223b35675ee727938.png) ### [` lief.PE.GenericContent `]() class lief.PE.GenericContent Bases: [`Content`]( "lief._lief.PE.ContentInfo.Content") --- ## [RsaInfo]() ### [` lief.PE.RsaInfo `]() class lief.PE.RsaInfo Bases: `object` Object representing a RSA key #### [` D `]() property D → bytes RSA private exponent (in bytes) #### [` E `]() property E → bytes RSA public exponent (in bytes) #### [` N `]() property N → bytes RSA public modulus (in bytes) #### [` P `]() property P → bytes First prime factor (in bytes) #### [` Q `]() property Q → bytes Second prime factor (in bytes) #### [` has_private_key `]() property has\_private\_key → bool True if it embeds a private key #### [` has_public_key `]() property has\_public\_key → bool True if it embeds a public key #### [` key_size `]() property key\_size → int Size of the public modulus in bits --- ## [x509]() ### [` lief.PE.x509 `]() class lief.PE.x509 Bases: `Object` Interface over a x509 certificate #### [` KEY_TYPES `]() class KEY\_TYPES(*\*values*) Bases: `Enum` Public key scheme used by the x509 certificate ##### [` ECDSA `]() ECDSA = 4 ##### [` ECKEY `]() ECKEY = 2 ##### [` ECKEY_DH `]() ECKEY\_DH = 3 ##### [` NONE `]() NONE = 0 ##### [` RSA `]() RSA = 1 ##### [` RSASSA_PSS `]() RSASSA\_PSS = 6 ##### [` RSA_ALT `]() RSA\_ALT = 5 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.x509.KEY\_TYPES]( "lief.PE.x509.KEY_TYPES") = <nanobind.nb\_func object> #### [` KEY_USAGE `]() class KEY\_USAGE(*\*values*) Bases: `Enum` Key usage as defined in [RFC #5280 - section-4.2.1.3]() ##### [` CRL_SIGN `]() CRL\_SIGN = 6 ##### [` DATA_ENCIPHERMENT `]() DATA\_ENCIPHERMENT = 3 ##### [` DECIPHER_ONLY `]() DECIPHER\_ONLY = 8 ##### [` DIGITAL_SIGNATURE `]() DIGITAL\_SIGNATURE = 0 ##### [` ENCIPHER_ONLY `]() ENCIPHER\_ONLY = 7 ##### [` KEY_AGREEMENT `]() KEY\_AGREEMENT = 4 ##### [` KEY_CERT_SIGN `]() KEY\_CERT\_SIGN = 5 ##### [` KEY_ENCIPHERMENT `]() KEY\_ENCIPHERMENT = 2 ##### [` NON_REPUDIATION `]() NON\_REPUDIATION = 1 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.x509.KEY\_USAGE]( "lief.PE.x509.KEY_USAGE") = <nanobind.nb\_func object> #### [` VERIFICATION_FLAGS `]() class VERIFICATION\_FLAGS(*\*values*) Bases: `Flag` Verification flags associated with [`verify`]( "lief.PE.x509.verify") ##### [` BADCERT_BAD_KEY `]() BADCERT\_BAD\_KEY = 65536 ##### [` BADCERT_BAD_MD `]() BADCERT\_BAD\_MD = 16384 ##### [` BADCERT_BAD_PK `]() BADCERT\_BAD\_PK = 32768 ##### [` BADCERT_CN_MISMATCH `]() BADCERT\_CN\_MISMATCH = 4 ##### [` BADCERT_EXPIRED `]() BADCERT\_EXPIRED = 1 ##### [` BADCERT_EXT_KEY_USAGE `]() BADCERT\_EXT\_KEY\_USAGE = 4096 ##### [` BADCERT_FUTURE `]() BADCERT\_FUTURE = 512 ##### [` BADCERT_KEY_USAGE `]() BADCERT\_KEY\_USAGE = 2048 ##### [` BADCERT_MISSING `]() BADCERT\_MISSING = 64 ##### [` BADCERT_NOT_TRUSTED `]() BADCERT\_NOT\_TRUSTED = 8 ##### [` BADCERT_NS_CERT_TYPE `]() BADCERT\_NS\_CERT\_TYPE = 8192 ##### [` BADCERT_OTHERNATURE `]() BADCERT\_OTHERNATURE = 256 ##### [` BADCERT_REVOKED `]() BADCERT\_REVOKED = 2 ##### [` BADCERT_SKIP_VERIFY `]() BADCERT\_SKIP\_VERIFY = 128 ##### [` BADCRL_BAD_KEY `]() BADCRL\_BAD\_KEY = 524288 ##### [` BADCRL_BAD_MD `]() BADCRL\_BAD\_MD = 131072 ##### [` BADCRL_BAD_PK `]() BADCRL\_BAD\_PK = 262144 ##### [` BADCRL_EXPIRED `]() BADCRL\_EXPIRED = 32 ##### [` BADCRL_FUTURE `]() BADCRL\_FUTURE = 1024 ##### [` BADCRL_NOT_TRUSTED `]() BADCRL\_NOT\_TRUSTED = 16 ##### [` OK `]() OK = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.x509.VERIFICATION\_FLAGS]( "lief.PE.x509.VERIFICATION_FLAGS") = <nanobind.nb\_func object> #### [` certificate_policies `]() property certificate\_policies → list[str] Policy information terms as list of OID (see RFC #5280) #### [` ext_key_usage `]() property ext\_key\_usage → list[str] Indicates one or more purposes for which the certified public key may be used (list of OID) #### [` is_ca `]() property is\_ca → bool #### [` is_trusted_by `]() is\_trusted\_by(*self*, *ca\_list: collections.abc.Sequence[[lief.\_lief.PE.x509]( "lief._lief.PE.x509")]*) → [lief.\_lief.PE.x509.VERIFICATION\_FLAGS]( "lief._lief.PE.x509.VERIFICATION_FLAGS") Verify this certificate against a list of root CA (list of [`x509`]( "lief.PE.x509") objects) It returns a set of flags defined by [`VERIFICATION_FLAGS`]( "lief.PE.x509.VERIFICATION_FLAGS") **Example:** ```python signer = binary.signatures[0].signers[0] microsoft_ca_bundle = lief.PE.x509.parse("bundle.pem") print(signer.cert.is_trusted_by(microsoft_ca_bundle)) ``` #### [` issuer `]() property issuer → str | bytes Issuer of the certificate #### [` key_type `]() property key\_type → [lief.PE.x509.KEY\_TYPES]( "lief.PE.x509.KEY_TYPES") Return the underlying public-key scheme ([`KEY_TYPES`]( "lief.PE.x509.KEY_TYPES")) #### [` key_usage `]() property key\_usage → list[[lief.PE.x509.KEY\_USAGE]( "lief.PE.x509.KEY_USAGE")] Purpose of the key contained in the certificate (see [`KEY_USAGE`]( "lief.PE.x509.KEY_USAGE")) #### [` parse `]() parse(*\*args*) → list[[lief.PE.x509]( "lief.PE.x509")] = <nanobind.nb\_func object> #### [` raw `]() property raw → bytes The raw bytes associated with this x509 cert (DER encoded) #### [` rsa_info `]() property rsa\_info → [lief.PE.RsaInfo]( "lief.PE.RsaInfo") | None If the underlying public-key scheme is RSA, return the [`RsaInfo`]( "lief.PE.RsaInfo") associated with this certificate. Otherwise, return None #### [` serial_number `]() property serial\_number → bytes Unique id for certificate issued by a specific CA. #### [` signature `]() property signature → bytes The signature of the certificate #### [` signature_algorithm `]() property signature\_algorithm → str Signature algorithm (OID) #### [` subject `]() property subject → str | bytes Subject of the certificate #### [` valid_from `]() property valid\_from → list[int] Start time of certificate validity #### [` valid_to `]() property valid\_to → list[int] End time of certificate validity #### [` verify `]() verify(*self*, *ca: [lief.\_lief.PE.x509]( "lief._lief.PE.x509")*) → [lief.\_lief.PE.x509.VERIFICATION\_FLAGS]( "lief._lief.PE.x509.VERIFICATION_FLAGS") Verify that this certificate has been used **to trust** the given [`x509`]( "lief.PE.x509") certificate It returns a set of flags defined by [`VERIFICATION_FLAGS`]( "lief.PE.x509.VERIFICATION_FLAGS") **Example:** ```python ca = lief.PE.x509.parse("ca.crt")[0] signer = lief.PE.x509.parse("signer.crt")[0] print(ca.verify(signer)) # lief.PE.x509.VERIFICATION_FLAGS.OK ``` #### [` version `]() property version → int X.509 version. (1=v1, 2=v2, 3=v3) --- ## [ContentInfo]() ![Inheritance diagram of lief._lief.PE.PKCS9TSTInfo, lief._lief.PE.GenericContent, lief._lief.PE.SpcIndirectData](https://lief.re/doc/latest/_images/inheritance-e740c3930d239e3b56437a7ebd01caecb679c0b3.png) ### [` lief.PE.ContentInfo `]() class lief.PE.ContentInfo Bases: `Object` ContentInfo as described in the [RFC 2315]() ```text ContentInfo ::= SEQUENCE { contentType ContentType, content [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL } ContentType ::= OBJECT IDENTIFIER ``` In the case of PE signature, ContentType **must** be set to SPC\_INDIRECT\_DATA\_OBJID OID: `1.3.6.1.4.1.311.2.1.4` and content is defined by the structure: `SpcIndirectDataContent` ```text SpcIndirectDataContent ::= SEQUENCE { data SpcAttributeTypeAndOptionalValue, messageDigest DigestInfo } SpcAttributeTypeAndOptionalValue ::= SEQUENCE { type ObjectID, value [0] EXPLICIT ANY OPTIONAL } ``` For PE signature, `SpcAttributeTypeAndOptionalValue.type` is set to `SPC_PE_IMAGE_DATAOBJ` (OID: `1.3.6.1.4.1.311.2.1.15`) and the value is defined by `SpcPeImageData` ```text DigestInfo ::= SEQUENCE { digestAlgorithm AlgorithmIdentifier, digest OCTETSTRING } AlgorithmIdentifier ::= SEQUENCE { algorithm ObjectID, parameters [0] EXPLICIT ANY OPTIONAL } ``` #### [` Content `]() class Content Bases: `Object` ##### [` content_type `]() property content\_type → str OID of the content type. This value should match `SPC_INDIRECT_DATA_OBJID` ##### [` copy `]() copy(*self*) → [lief.\_lief.PE.ContentInfo.Content]( "lief._lief.PE.ContentInfo.Content") | None Duplicate the current instance of this object #### [` content_type `]() property content\_type → str An alias for [`content_type`]( "lief.PE.ContentInfo.content_type") #### [` copy `]() copy(*self*) → [lief.\_lief.PE.ContentInfo]( "lief._lief.PE.ContentInfo") Duplicate the current instance of this object #### [` digest `]() property digest → bytes Return the digest (authentihash) if the underlying content type is `SPC_INDIRECT_DATA_OBJID`. Return empty bytes otherwise. #### [` digest_algorithm `]() property digest\_algorithm → [lief.PE.ALGORITHMS]( "lief.PE.ALGORITHMS") Return the hash algorithm used to generate the [`digest`]( "lief.PE.ContentInfo.digest") #### [` value `]() property value → [lief.PE.ContentInfo.Content]( "lief.PE.ContentInfo.Content") --- ## [SignerInfo]() ### [` lief.PE.SignerInfo `]() class lief.PE.SignerInfo Bases: `Object` SignerInfo as described in the [RFC 2315 #Section 9.2]() ```text SignerInfo ::= SEQUENCE { version Version, issuerAndSerialNumber IssuerAndSerialNumber, digestAlgorithm DigestAlgorithmIdentifier, authenticatedAttributes [0] IMPLICIT Attributes OPTIONAL, digestEncryptionAlgorithm DigestEncryptionAlgorithmIdentifier, encryptedDigest EncryptedDigest, unauthenticatedAttributes [1] IMPLICIT Attributes OPTIONAL } EncryptedDigest ::= OCTET STRING ``` #### [` authenticated_attributes `]() property authenticated\_attributes → lief.PE.SignerInfo.it\_const\_attributes\_t Return an iterator over the authenticated attributes ([`Attribute`]( "lief.PE.Attribute")) #### [` cert `]() property cert → [lief.PE.x509]( "lief.PE.x509") | None [`x509`]( "lief.PE.x509") certificate used by this signer. If it can’t be found, it returns None #### [` digest_algorithm `]() property digest\_algorithm → [lief.PE.ALGORITHMS]( "lief.PE.ALGORITHMS") Algorithm ([`ALGORITHMS`]( "lief.PE.ALGORITHMS")) used to hash the file. This value should match [`ContentInfo.digest_algorithm`]( "lief.PE.ContentInfo.digest_algorithm") and [`Signature.digest_algorithm`]( "lief.PE.Signature.digest_algorithm") #### [` encrypted_digest `]() property encrypted\_digest → bytes Return the signature created by the signing certificate’s private key #### [` encryption_algorithm `]() property encryption\_algorithm → [lief.PE.ALGORITHMS]( "lief.PE.ALGORITHMS") Return algorithm ([`ALGORITHMS`]( "lief.PE.ALGORITHMS")) used to encrypt the digest #### [` get_attribute `]() get\_attribute(*self*, *type: [lief.\_lief.PE.Attribute.TYPE]( "lief._lief.PE.Attribute.TYPE")*) → [lief.\_lief.PE.Attribute]( "lief._lief.PE.Attribute") | None Return the authenticated or un-authenticated attribute matching the given `lief.PE.SIG_ATTRIBUTE_TYPES` It returns **the first** entry that matches the given type. If it can’t be found, it returns None #### [` get_auth_attribute `]() get\_auth\_attribute(*self*, *type: [lief.\_lief.PE.Attribute.TYPE]( "lief._lief.PE.Attribute.TYPE")*) → [lief.\_lief.PE.Attribute]( "lief._lief.PE.Attribute") | None Return the authenticated attribute matching the given `lief.PE.SIG_ATTRIBUTE_TYPES` It returns **the first** entry that matches the given type. If it can’t be found, it returns None #### [` get_unauth_attribute `]() get\_unauth\_attribute(*self*, *type: [lief.\_lief.PE.Attribute.TYPE]( "lief._lief.PE.Attribute.TYPE")*) → [lief.\_lief.PE.Attribute]( "lief._lief.PE.Attribute") | None Return the un-authenticated attribute matching the given `lief.PE.SIG_ATTRIBUTE_TYPES` It returns **the first** entry that matches the given type. If it can’t be found, it returns None #### [` issuer `]() property issuer → str | bytes The X509 issuer used to sign the signed-data (see: [`lief.PE.x509.issuer`]( "lief.PE.x509.issuer")) #### [` serial_number `]() property serial\_number → bytes The X509 serial number used to sign the signed-data (see: [`lief.PE.x509.serial_number`]( "lief.PE.x509.serial_number")) #### [` unauthenticated_attributes `]() property unauthenticated\_attributes → lief.PE.SignerInfo.it\_const\_attributes\_t Return an iterator over the unauthenticated attributes ([`Attribute`]( "lief.PE.Attribute")) #### [` version `]() property version → int Should be 1 --- ## [MsCounterSign]() ### [` lief.PE.MsCounterSign `]() class lief.PE.MsCounterSign Bases: [`Attribute`]( "lief._lief.PE.Attribute") This class exposes the ms-counter-signature. #### [` certificates `]() property certificates → lief.PE.MsCounterSign.it\_const\_crt Return an iterator over [`x509`]( "lief.PE.x509") certificates #### [` content_info `]() property content\_info → [lief.PE.ContentInfo]( "lief.PE.ContentInfo") #### [` digest_algorithm `]() property digest\_algorithm → [lief.PE.ALGORITHMS]( "lief.PE.ALGORITHMS") #### [` signers `]() property signers → lief.PE.MsCounterSign.it\_const\_signers\_t Return an iterator over the signers ([`SignerInfo`]( "lief.PE.SignerInfo")) #### [` version `]() property version → int --- ## [PKCS9TSTInfo]() ### [` lief.PE.PKCS9TSTInfo `]() class lief.PE.PKCS9TSTInfo Bases: [`Content`]( "lief._lief.PE.ContentInfo.Content") Interface over the structure described by the OID `1.2.840.113549.1.9.16.1.4` (PKCS #9) The internal structure is described in the [RFC #3161]() ```text TSTInfo ::= SEQUENCE { version INTEGER { v1(1) }, policy TSAPolicyId, messageImprint MessageImprint, serialNumber INTEGER, genTime GeneralizedTime, accuracy Accuracy OPTIONAL, ordering BOOLEAN DEFAULT FALSE, nonce INTEGER OPTIONAL, tsa [0] GeneralName OPTIONAL, extensions [1] IMPLICIT Extensions OPTIONAL } TSAPolicyId ::= OBJECT IDENTIFIER MessageImprint ::= SEQUENCE { hashAlgorithm AlgorithmIdentifier, hashedMessage OCTET STRING } Accuracy ::= SEQUENCE { seconds INTEGER OPTIONAL, millis [0] INTEGER (1..999) OPTIONAL, micros [1] INTEGER (1..999) OPTIONAL } ``` --- ## [MsManifestBinaryID]() ### [` lief.PE.MsManifestBinaryID `]() class lief.PE.MsManifestBinaryID Bases: [`Attribute`]( "lief._lief.PE.Attribute") Interface over the structure described by the OID `1.3.6.1.4.1.311.10.3.28` (`szOID_PLATFORM_MANIFEST_BINARY_ID`) The internal structure is not documented but we can infer the following structure: ```text szOID_PLATFORM_MANIFEST_BINARY_ID ::= SET OF BinaryID BinaryID ::= UTF8STRING ``` #### [` manifest_id `]() property manifest\_id → str The manifest id --- ## [SpcRelaxedPeMarkerCheck]() ### [` lief.PE.SpcRelaxedPeMarkerCheck `]() class lief.PE.SpcRelaxedPeMarkerCheck Bases: [`Attribute`]( "lief._lief.PE.Attribute") #### [` value `]() property value → int --- ## [SigningCertificateV2]() ### [` lief.PE.SigningCertificateV2 `]() class lief.PE.SigningCertificateV2 Bases: [`Attribute`]( "lief._lief.PE.Attribute") ```text SigningCertificateV2 ::= SEQUENCE { certs SEQUENCE OF ESSCertIDv2, policies SEQUENCE OF PolicyInformation OPTIONAL } ESSCertIDv2 ::= SEQUENCE { hashAlgorithm AlgorithmIdentifier DEFAULT {algorithm id-sha256}, certHash OCTET STRING, issuerSerial IssuerSerial OPTIONAL } IssuerSerial ::= SEQUENCE { issuer GeneralNames, serialNumber CertificateSerialNumber } PolicyInformation ::= SEQUENCE { policyIdentifier OBJECT IDENTIFIER, policyQualifiers SEQUENCE SIZE (1..MAX) OF PolicyQualifierInfo OPTIONAL } ``` --- ## [Builder]() ### [` lief.PE.Builder `]() class lief.PE.Builder(*self*, *binary: [lief.\_lief.PE.Binary]( "lief._lief.PE.Binary")*, *config: [lief.\_lief.PE.Builder.config\_t]( "lief._lief.PE.Builder.config_t")*) Bases: `object` #### [` build `]() build(*self*) → [lief.\_lief.ok\_t]( "lief._lief.ok_t") | [lief.\_lief.lief\_errors]( "lief._lief.lief_errors") Perform the build process #### [` config_t `]() class config\_t(*self*) Bases: `object` This structure is used to configure the build operation. The default value of these attributes is set to `False` if the operation modifies the binary layout even though nothing changed. For instance, building the import table **always** requires relocating the table to another place. Thus, the default value is false and must be explicitly set to true. ##### [` debug `]() property debug → bool Whether the builder should regenerate debug entries ##### [` debug_section `]() property debug\_section → str Section that holds the debug entries ##### [` dos_stub `]() property dos\_stub → bool Whether the builder should write back dos stub (including the rich header) ##### [` export_section `]() property export\_section → str Section that holds the export table ##### [` exports `]() property exports → bool Whether the builder should reconstruct the export table This option should be turned on if you modify exports. Please check LIEF website for more details ##### [` force_relocating `]() property force\_relocating → bool ##### [` idata_section `]() property idata\_section → str Section that holds the relocated import table (IAT/ILT) ##### [` imports `]() property imports → bool Whether the builder should reconstruct the imports table. This option should be turned on if you modify imports. Please check LIEF website for more details ##### [` load_configuration `]() property load\_configuration → bool Whether the builder should regenerate the load configuration ##### [` overlay `]() property overlay → bool Whether the builder should write back any overlay data ##### [` reloc_section `]() property reloc\_section → str Section that holds the relocated relocations ##### [` relocations `]() property relocations → bool Whether the builder should regenerate relocations ##### [` resolved_iat_cbk `]() property resolved\_iat\_cbk → collections.abc.Callable[[[lief.PE.Binary]( "lief.PE.Binary"), [lief.PE.Import]( "lief.PE.Import"), [lief.PE.ImportEntry]( "lief.PE.ImportEntry"), int], None] ##### [` resources `]() property resources → bool Whether the builder should regenerate the resources tree ##### [` rsrc_section `]() property rsrc\_section → str If the resources tree needs to be relocated, this attribute defines the name of the new section that contains the relocated tree. ##### [` tls `]() property tls → bool Whether the builder should regenerate the TLS info ##### [` tls_section `]() property tls\_section → str Section that holds the relocated TLS info #### [` raw_bytes `]() raw\_bytes(*self*) → bytes #### [` rsrc_data `]() property rsrc\_data → memoryview #### [` write `]() write(*self*, *output: str*) → None Write the build result into the `output` file --- ## [Resource Node]() ![Inheritance diagram of lief._lief.PE.ResourceDirectory, lief._lief.PE.ResourceNode, lief._lief.PE.ResourceData](https://lief.re/doc/latest/_images/inheritance-ddb7f6effe66ce89bc2bb80a7d2f5df47a9fe83d.png) ### [` lief.PE.ResourceNode `]() class lief.PE.ResourceNode Bases: `Object` Class which represents a Node in the resource tree. It is extended by [`lief.PE.ResourceData`]( "lief.PE.ResourceData") and [`lief.PE.ResourceDirectory`]( "lief.PE.ResourceDirectory") #### [` add_child `]() add\_child(*self*, *node: [lief.\_lief.PE.ResourceNode]( "lief._lief.PE.ResourceNode")*) → [lief.\_lief.PE.ResourceNode]( "lief._lief.PE.ResourceNode") Add a new child to the current node #### [` childs `]() property childs → lief.PE.ResourceNode.it\_childs Node’s children #### [` copy `]() copy(*self*) → [lief.\_lief.PE.ResourceNode]( "lief._lief.PE.ResourceNode") | None Duplicate the current instance of this object #### [` delete_childdelete_child `]() delete\_child(*self*, *node: [lief.\_lief.PE.ResourceNode]( "lief._lief.PE.ResourceNode")*) → None **delete\_child(*self*, *id: int*) → None** Overloaded function. 1. `delete_child(self, node: lief._lief.PE.ResourceNode) -> None` Delete the given [`ResourceNode`]( "lief.PE.ResourceNode") from the current children 2. `delete_child(self, id: int) -> None` > Delete the [`ResourceNode`]( "lief.PE.ResourceNode") with the given [`id`]( "lief.PE.ResourceNode.id") from the current children #### [` depth `]() property depth → int Current depth of the node in the resource tree #### [` has_name `]() property has\_name → bool `True` if the current node uses a name #### [` id `]() property id → int Integer that identifies the Type, Name, or Language ID entry. #### [` is_data `]() property is\_data → bool `True` if the current node is a [`ResourceData`]( "lief.PE.ResourceData") #### [` is_directory `]() property is\_directory → bool `True` if the current node is a [`ResourceDirectory`]( "lief.PE.ResourceDirectory") #### [` name `]() property name → str Resource’s name #### [` parse `]() parse(*bytes: bytes*, *rva: int*) → [lief.PE.ResourceNode]( "lief.PE.ResourceNode") | None = <nanobind.nb\_func object> --- ## [Resource Directory]() ![Inheritance diagram of lief._lief.PE.ResourceDirectory](https://lief.re/doc/latest/_images/inheritance-8328839eac0f516c1cd5ade72642bc6a04518e81.png) ### [` lief.PE.ResourceDirectorylief.PE.ResourceDirectory `]() class lief.PE.ResourceDirectory(*self*) **class lief.PE.ResourceDirectory(*self*, *arg: int*, */*)** Bases: [`ResourceNode`]( "lief._lief.PE.ResourceNode") Overloaded function. 1. `__init__(self) -> None` Default constructor 2. `__init__(self, arg: int, /) -> None` Constructor from an ID #### [` characteristics `]() property characteristics → int Resource characteristics. This field is reserved for future use. It is currently set to zero. #### [` major_version `]() property major\_version → int The major version number, set by the user. #### [` minor_version `]() property minor\_version → int The minor version number, set by the user. #### [` numberof_id_entries `]() property numberof\_id\_entries → int The number of directory entries immediately following the Name entries that use numeric IDs for Type, Name, or Language entries. #### [` numberof_name_entries `]() property numberof\_name\_entries → int The number of directory entries immediately following the table that use strings to identify Type, Name, or Language entries (depending on the level of the table #### [` time_date_stamp `]() property time\_date\_stamp → int The time that the resource data was created by the resource compiler. --- ## [Resource Data]() ![Inheritance diagram of lief._lief.PE.ResourceData](https://lief.re/doc/latest/_images/inheritance-55e48956f9b2cf7d9c131a300a29764795c01291.png) ### [` lief.PE.ResourceDatalief.PE.ResourceData `]() class lief.PE.ResourceData(*self*) **class lief.PE.ResourceData(*self*, *content: collections.abc.Sequence[int]*, *code\_page: int = 0*)** Bases: [`ResourceNode`]( "lief._lief.PE.ResourceNode") Class which represents a Data Node in the PE resources tree Overloaded function. 1. `__init__(self) -> None` Default constructor 2. `__init__(self, content: collections.abc.Sequence[int], code_page: int = 0) -> None` #### [` code_page `]() property code\_page → int Return the code page that is used to decode code point values within the resource data. Typically, the code page is the Unicode code page. #### [` content `]() property content → memoryview Resource content #### [` offset `]() property offset → int Offset of the content within the resource > **Warning** > > This value can change when re-building the resource table #### [` reserved `]() property reserved → int Reserved value. Should be `0` --- ## [Resources Manager]() ### [` lief.PE.ResourcesManager `]() class lief.PE.ResourcesManager(*self*, *node: [lief.\_lief.PE.ResourceNode]( "lief._lief.PE.ResourceNode")*) Bases: `Object` The Resource Manager provides an enhanced API to manipulate the resource tree #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` ##### [` ACCELERATOR `]() ACCELERATOR = 9 ##### [` ANICURSOR `]() ANICURSOR = 21 ##### [` ANIICON `]() ANIICON = 22 ##### [` BITMAP `]() BITMAP = 2 ##### [` CURSOR `]() CURSOR = 1 ##### [` DIALOG `]() DIALOG = 5 ##### [` DLGINCLUDE `]() DLGINCLUDE = 17 ##### [` FONT `]() FONT = 8 ##### [` FONTDIR `]() FONTDIR = 7 ##### [` GROUP_CURSOR `]() GROUP\_CURSOR = 12 ##### [` GROUP_ICON `]() GROUP\_ICON = 14 ##### [` HTML `]() HTML = 23 ##### [` ICON `]() ICON = 3 ##### [` MANIFEST `]() MANIFEST = 24 ##### [` MENU `]() MENU = 4 ##### [` MESSAGETABLE `]() MESSAGETABLE = 11 ##### [` PLUGPLAY `]() PLUGPLAY = 19 ##### [` RCDATA `]() RCDATA = 10 ##### [` STRING `]() STRING = 6 ##### [` VERSION `]() VERSION = 16 ##### [` VXD `]() VXD = 20 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.ResourcesManager.TYPE]( "lief.PE.ResourcesManager.TYPE") = <nanobind.nb\_func object> #### [` accelerator `]() property accelerator → lief.PE.ResourcesManager.it\_const\_accelerators Return list of [`ResourceAccelerator`]( "lief.PE.ResourceAccelerator") present in the resource #### [` add_icon `]() add\_icon(*self*, *icon: [lief.\_lief.PE.ResourceIcon]( "lief._lief.PE.ResourceIcon")*) → None Add an icon to the resources #### [` change_icon `]() change\_icon(*self*, *old\_one: [lief.\_lief.PE.ResourceIcon]( "lief._lief.PE.ResourceIcon")*, *new\_one: [lief.\_lief.PE.ResourceIcon]( "lief._lief.PE.ResourceIcon")*) → None Switch the given icons #### [` dialogs `]() property dialogs → lief.PE.ResourcesManager.it\_const\_dialogs Return the list of the [`ResourceDialog`]( "lief.PE.ResourceDialog") present in the resource #### [` get_node_type `]() get\_node\_type(*self*, *type: [lief.\_lief.PE.ResourcesManager.TYPE]( "lief._lief.PE.ResourcesManager.TYPE")*) → [lief.\_lief.PE.ResourceNode]( "lief._lief.PE.ResourceNode") | None Return [`ResourceNode`]( "lief.PE.ResourceNode") with the given [`TYPE`]( "lief.PE.ResourcesManager.TYPE") or None if not found. #### [` has_accelerator `]() property has\_accelerator → bool `True` if resources contain [`ResourceAccelerator`]( "lief.PE.ResourceAccelerator") #### [` has_dialogs `]() property has\_dialogs → bool `True` if the resources contain [`ResourceDialog`]( "lief.PE.ResourceDialog") #### [` has_html `]() property has\_html → bool `True` if resources contain HTML resource #### [` has_icons `]() property has\_icons → bool `True` if the resources contain [`ResourceIcon`]( "lief.PE.ResourceIcon") #### [` has_manifest `]() property has\_manifest → bool `True` if the resources contain a Manifest element #### [` has_string_table `]() property has\_string\_table → bool `True` if resources contain [`ResourceStringTable`]( "lief.PE.ResourceStringTable") #### [` has_type `]() has\_type(*self*, *type: [lief.\_lief.PE.ResourcesManager.TYPE]( "lief._lief.PE.ResourcesManager.TYPE")*) → bool `True` if the resource has the given [`TYPE`]( "lief.PE.ResourcesManager.TYPE") #### [` has_version `]() property has\_version → bool `True` if the resources contain a [`ResourceVersion`]( "lief.PE.ResourceVersion") #### [` html `]() property html → list[str] HTML resource as the list of `string` #### [` icons `]() property icons → lief.PE.ResourcesManager.it\_const\_icons Return the list of the [`ResourceIcon`]( "lief.PE.ResourceIcon") present in the resource #### [` manifest `]() property manifest → str | bytes Manifest as a `string` #### [` print `]() print(*self*, *max\_depth: int = 0*) → str Print the current resource tree #### [` string_entry_t `]() class string\_entry\_t Bases: `object` ##### [` id `]() property id → int ##### [` string `]() property string → str #### [` string_table `]() property string\_table → list[[lief.PE.ResourcesManager.string\_entry\_t]( "lief.PE.ResourcesManager.string_entry_t")] Return the list of the strings embedded in the string table (`RT_STRING`) #### [` types `]() property types → list[[lief.PE.ResourcesManager.TYPE]( "lief.PE.ResourcesManager.TYPE")] Return list of [`TYPE`]( "lief.PE.ResourcesManager.TYPE") present in the resources #### [` version `]() property version → list[[lief.PE.ResourceVersion]( "lief.PE.ResourceVersion")] Return a list of version info (`VS_VERSIONINFO`). --- ## [Resource Icon]() ### [` lief.PE.ResourceIcon `]() class lief.PE.ResourceIcon Bases: `Object` #### [` bit_count `]() property bit\_count → int Bits per pixel #### [` color_count `]() property color\_count → int Number of colors in image (0 if >=8bpp) #### [` from_serialization `]() from\_serialization(*arg: bytes*) → [lief.PE.ResourceIcon]( "lief.PE.ResourceIcon") | [lief.lief\_errors]( "lief.lief_errors") = <nanobind.nb\_func object> #### [` height `]() property height → int Height in pixels of the image #### [` id `]() property id → int Id associated with the icon #### [` lang `]() property lang → int Language associated with the icon #### [` pixels `]() property pixels → memoryview #### [` planes `]() property planes → int Color Planes #### [` reserved `]() property reserved → int Reserved (must be 0) #### [` save `]() save(*self*, *filepath: str*) → None Save the icon to the given filepath #### [` serialize `]() serialize(*self*) → bytes Serialize the current icon into bytes #### [` sublang `]() property sublang → int Sublanguage associated with the icon #### [` width `]() property width → int Width in pixels of the image --- ## [Resource Dialog]() ![Inheritance diagram of lief._lief.PE.ResourceDialogRegular, lief._lief.PE.ResourceDialog, lief._lief.PE.ResourceDialogExtended](https://lief.re/doc/latest/_images/inheritance-2421608f967145b603913d08c1aaab97863bc4ba.png) ### [` lief.PE.ResourceDialog `]() class lief.PE.ResourceDialog Bases: `Object` This class is the base class for either a regular (legacy) Dialog or an extended Dialog. These different kinds of Dialogs are documented by MS at the following addresses: - [https://learn.microsoft.com/en-us/windows/win32/api/winuser/ns-winuser-dlgtemplate]() - [https://learn.microsoft.com/fr-fr/windows/win32/dlgbox/dlgitemtemplateex]() #### [` CONTROL_STYLES `]() class CONTROL\_STYLES(*\*values*) Bases: `Flag` From: [https://learn.microsoft.com/en-us/windows/win32/controls/common-control-styles]() ##### [` ADJUSTABLE `]() ADJUSTABLE = 32 ##### [` BOTTOM `]() BOTTOM = 3 ##### [` LEFT `]() LEFT = 129 ##### [` NODIVIDER `]() NODIVIDER = 64 ##### [` NOMOVEX `]() NOMOVEX = 130 ##### [` NOMOVEY `]() NOMOVEY = 2 ##### [` NOPARENTALIGN `]() NOPARENTALIGN = 8 ##### [` NORESIZE `]() NORESIZE = 4 ##### [` RIGHT `]() RIGHT = 131 ##### [` TOP `]() TOP = 1 ##### [` VERT `]() VERT = 128 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.ResourceDialog.CONTROL\_STYLES]( "lief.PE.ResourceDialog.CONTROL_STYLES") = <nanobind.nb\_func object> #### [` DIALOG_STYLES `]() class DIALOG\_STYLES(*\*values*) Bases: `Flag` From: [https://learn.microsoft.com/en-us/windows/win32/dlgbox/dialog-box-styles]() ##### [` ABSALIGN `]() ABSALIGN = 1 ##### [` CENTER `]() CENTER = 2048 ##### [` CENTERMOUSE `]() CENTERMOUSE = 4096 ##### [` CONTEXTHELP `]() CONTEXTHELP = 8192 ##### [` CONTROL `]() CONTROL = 1024 ##### [` FIXEDSYS `]() FIXEDSYS = 8 ##### [` LOCALEDIT `]() LOCALEDIT = 32 ##### [` MODALFRAME `]() MODALFRAME = 128 ##### [` NOFAILCREATE `]() NOFAILCREATE = 16 ##### [` NOIDLEMSG `]() NOIDLEMSG = 256 ##### [` S3DLOOK `]() S3DLOOK = 4 ##### [` SETFONT `]() SETFONT = 64 ##### [` SETFOREGROUND `]() SETFOREGROUND = 512 ##### [` SHELLFONT `]() SHELLFONT = 72 ##### [` SYSMODAL `]() SYSMODAL = 2 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.ResourceDialog.DIALOG\_STYLES]( "lief.PE.ResourceDialog.DIALOG_STYLES") = <nanobind.nb\_func object> #### [` Item `]() class Item Bases: `object` ##### [` clazz `]() property clazz → int | str | None Window class of the control. This can be either: a string that specifies the name of a registered window class or an ordinal value of a predefined system class. ##### [` control_styles `]() property control\_styles → list[[lief.PE.ResourceDialog.CONTROL\_STYLES]( "lief.PE.ResourceDialog.CONTROL_STYLES")] List of [`CONTROL_STYLES`]( "lief.PE.ResourceDialog.CONTROL_STYLES") used by this item ##### [` creation_data `]() property creation\_data → memoryview Creation data that is passed to the control’s window procedure ##### [` cx `]() property cx → int The width, in dialog box units, of the control. ##### [` cy `]() property cy → int The height, in dialog box units, of the control. ##### [` extended_style `]() property extended\_style → int The extended styles for a window. This member is not used to create controls in dialog boxes, but applications that use dialog box templates can use it to create other types of windows. It can take a combination of [`WINDOW_EXTENDED_STYLES`]( "lief.PE.ResourceDialog.WINDOW_EXTENDED_STYLES") ##### [` hashas `]() has(*self*, *style: [lief.\_lief.PE.ResourceDialog.WINDOW\_STYLES]( "lief._lief.PE.ResourceDialog.WINDOW_STYLES")*) → bool **has(*self*, *style: [lief.\_lief.PE.ResourceDialog.CONTROL\_STYLES]( "lief._lief.PE.ResourceDialog.CONTROL_STYLES")*) → bool** Overloaded function. 1. `has(self, style: lief._lief.PE.ResourceDialog.WINDOW_STYLES) -> bool` Check if this item has the given [`WINDOW_STYLES`]( "lief.PE.ResourceDialog.WINDOW_STYLES") 2. `has(self, style: lief._lief.PE.ResourceDialog.CONTROL_STYLES) -> bool` Check if this item has the given [`CONTROL_STYLES`]( "lief.PE.ResourceDialog.CONTROL_STYLES") ##### [` id `]() property id → int The control identifier. ##### [` style `]() property style → int The style of the control. This can be a combination of [`WINDOW_STYLES`]( "lief.PE.ResourceDialog.WINDOW_STYLES") or [`CONTROL_STYLES`]( "lief.PE.ResourceDialog.CONTROL_STYLES"). ##### [` title `]() property title → int | str | None Title of the item which can be either: a string that specifies the initial text or an ordinal value of a resource, such as an icon, in an executable file ##### [` window_styles `]() property window\_styles → list[[lief.PE.ResourceDialog.WINDOW\_STYLES]( "lief.PE.ResourceDialog.WINDOW_STYLES")] List of [`WINDOW_STYLES`]( "lief.PE.ResourceDialog.WINDOW_STYLES") used by this item ##### [` x `]() property x → int The x-coordinate, in dialog box units, of the upper-left corner of the control. This coordinate is always relative to the upper-left corner of the dialog box’s client area. ##### [` y `]() property y → int The y-coordinate, in dialog box units, of the upper-left corner of the control. This coordinate is always relative to the upper-left corner of the dialog box’s client area. #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` Enum for discriminating the kind of the Dialog (regular vs extended) ##### [` EXTENDED `]() EXTENDED = 2 ##### [` REGULAR `]() REGULAR = 1 ##### [` UNKNOWN `]() UNKNOWN = 0 #### [` WINDOW_EXTENDED_STYLES `]() class WINDOW\_EXTENDED\_STYLES(*\*values*) Bases: `Flag` From: [https://docs.microsoft.com/en-us/windows/win32/winmsg/extended-window-styles]() ##### [` ACCEPTFILES `]() ACCEPTFILES = 16 ##### [` APPWINDOW `]() APPWINDOW = 262144 ##### [` CLIENTEDGE `]() CLIENTEDGE = 512 ##### [` CONTEXTHELP `]() CONTEXTHELP = 1024 ##### [` CONTROLPARENT `]() CONTROLPARENT = 65536 ##### [` DLGMODALFRAME `]() DLGMODALFRAME = 1 ##### [` LEFT `]() LEFT = 0 ##### [` LEFTSCROLLBAR `]() LEFTSCROLLBAR = 16384 ##### [` MDICHILD `]() MDICHILD = 64 ##### [` NOPARENTNOTIFY `]() NOPARENTNOTIFY = 4 ##### [` RIGHT `]() RIGHT = 4096 ##### [` RTLREADING `]() RTLREADING = 8192 ##### [` STATICEDGE `]() STATICEDGE = 131072 ##### [` TOOLWINDOW `]() TOOLWINDOW = 128 ##### [` TOPMOST `]() TOPMOST = 8 ##### [` TRANSPARENT_STY `]() TRANSPARENT\_STY = 32 ##### [` WINDOWEDGE `]() WINDOWEDGE = 256 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.ResourceDialog.WINDOW\_EXTENDED\_STYLES]( "lief.PE.ResourceDialog.WINDOW_EXTENDED_STYLES") = <nanobind.nb\_func object> #### [` WINDOW_STYLES `]() class WINDOW\_STYLES(*\*values*) Bases: `Flag` From: [https://docs.microsoft.com/en-us/windows/win32/winmsg/window-styles]() ##### [` BORDER `]() BORDER = 8388608 ##### [` CAPTION `]() CAPTION = 12582912 ##### [` CHILD `]() CHILD = 1073741824 ##### [` CLIPCHILDREN `]() CLIPCHILDREN = 33554432 ##### [` CLIPSIBLINGS `]() CLIPSIBLINGS = 67108864 ##### [` DISABLED `]() DISABLED = 134217728 ##### [` DLGFRAME `]() DLGFRAME = 4194304 ##### [` GROUP `]() GROUP = 131072 ##### [` HSCROLL `]() HSCROLL = 1048576 ##### [` MAXIMIZE `]() MAXIMIZE = 16777216 ##### [` MINIMIZE `]() MINIMIZE = 536870912 ##### [` OVERLAPPED `]() OVERLAPPED = 0 ##### [` POPUP `]() POPUP = 2147483648 ##### [` SYSMENU `]() SYSMENU = 524288 ##### [` TABSTOP `]() TABSTOP = 65536 ##### [` THICKFRAME `]() THICKFRAME = 262144 ##### [` VISIBLE `]() VISIBLE = 268435456 ##### [` VSCROLL `]() VSCROLL = 2097152 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.ResourceDialog.WINDOW\_STYLES]( "lief.PE.ResourceDialog.WINDOW_STYLES") = <nanobind.nb\_func object> #### [` copy `]() copy(*self*) → [lief.\_lief.PE.ResourceDialog]( "lief._lief.PE.ResourceDialog") | None Duplicate the current instance of this object #### [` cx `]() property cx → int The width, in dialog box units, of the dialog box. #### [` cy `]() property cy → int The height, in dialog box units, of the dialog box #### [` extended_style `]() property extended\_style → int The extended styles for a window. This member is not used to create dialog boxes, but applications that use dialog box templates can use it to create other types of windows. For a list of values, see [`WINDOW_EXTENDED_STYLES`]( "lief.PE.ResourceDialog.WINDOW_EXTENDED_STYLES") #### [` hashashas `]() has(*self*, *arg: [lief.\_lief.PE.ResourceDialog.DIALOG\_STYLES]( "lief._lief.PE.ResourceDialog.DIALOG_STYLES")*, */*) → bool **has(*self*, *arg: [lief.\_lief.PE.ResourceDialog.WINDOW\_STYLES]( "lief._lief.PE.ResourceDialog.WINDOW_STYLES")*, */*) → bool **has(*self*, *arg: [lief.\_lief.PE.ResourceDialog.WINDOW\_EXTENDED\_STYLES]( "lief._lief.PE.ResourceDialog.WINDOW_EXTENDED_STYLES")*, */*) → bool**** Overloaded function. 1. `has(self, arg: lief._lief.PE.ResourceDialog.DIALOG_STYLES, /) -> bool` Check if the dialog uses the given dialog style 2. `has(self, arg: lief._lief.PE.ResourceDialog.WINDOW_STYLES, /) -> bool` Check if the dialog uses the given window style 3. `has(self, arg: lief._lief.PE.ResourceDialog.WINDOW_EXTENDED_STYLES, /) -> bool` Check if the dialog uses the given extended window style #### [` menu `]() property menu → int | str | None ordinal or name value of a menu resource #### [` style `]() property style → int The style of the dialog box. This member can be a combination of window style values (such as [`CAPTION`]( "lief.PE.ResourceDialog.WINDOW_STYLES.CAPTION") and [`SYSMENU`]( "lief.PE.ResourceDialog.WINDOW_STYLES.SYSMENU")) and dialog box style values (such as [`CENTER`]( "lief.PE.ResourceDialog.DIALOG_STYLES.CENTER")). #### [` styles_list `]() property styles\_list → list[[lief.PE.ResourceDialog.DIALOG\_STYLES]( "lief.PE.ResourceDialog.DIALOG_STYLES")] List of [`DIALOG_STYLES`]( "lief.PE.ResourceDialog.DIALOG_STYLES") used by this dialog #### [` title `]() property title → str title of the dialog box #### [` type `]() property type → [lief.PE.ResourceDialog.TYPE]( "lief.PE.ResourceDialog.TYPE") #### [` window_class `]() property window\_class → int | str | None ordinal of a predefined system window class or name of a registered window class #### [` windows_ext_styles_list `]() property windows\_ext\_styles\_list → list[[lief.PE.ResourceDialog.WINDOW\_EXTENDED\_STYLES]( "lief.PE.ResourceDialog.WINDOW_EXTENDED_STYLES")] List of [`WINDOW_EXTENDED_STYLES`]( "lief.PE.ResourceDialog.WINDOW_EXTENDED_STYLES") used by this dialog #### [` windows_styles_list `]() property windows\_styles\_list → list[[lief.PE.ResourceDialog.WINDOW\_STYLES]( "lief.PE.ResourceDialog.WINDOW_STYLES")] List of [`WINDOW_STYLES`]( "lief.PE.ResourceDialog.WINDOW_STYLES") used by this dialog #### [` x `]() property x → int The x-coordinate, in dialog box units, of the upper-left corner of the dialog box. #### [` y `]() property y → int The y-coordinate, in dialog box units, of the upper-left corner of the dialog box. --- ## [Resource Dialog – Regular]() ![Inheritance diagram of lief._lief.PE.ResourceDialogRegular](https://lief.re/doc/latest/_images/inheritance-2b9c806f92793b04be85796f6188ca18a6b07e0c.png) ### [` lief.PE.ResourceDialogRegular `]() class lief.PE.ResourceDialogRegular(*self*) Bases: [`ResourceDialog`]( "lief._lief.PE.ResourceDialog") Implementation for a regular/legacy dialog box. See: [https://learn.microsoft.com/en-us/windows/win32/api/winuser/ns-winuser-dlgtemplate]() #### [` Item `]() class Item(*self*) Bases: [`Item`]( "lief._lief.PE.ResourceDialog.Item") This class represents a `DLGTEMPLATE` item (`DLGITEMTEMPLATE`) See: [https://learn.microsoft.com/en-us/windows/win32/api/winuser/ns-winuser-dlgitemtemplate]() #### [` add_item `]() add\_item(*self*, *item: [lief.\_lief.PE.ResourceDialogRegular.Item]( "lief._lief.PE.ResourceDialogRegular.Item")*) → None Add a new control item to the dialog #### [` font `]() property font → [lief.PE.ResourceDialogRegular.font\_t]( "lief.PE.ResourceDialogRegular.font_t") Additional font information #### [` font_t `]() class font\_t Bases: `object` This structure represents additional font information that might be embedded at the end of the DLGTEMPLATE stream ##### [` name `]() property name → str ##### [` point_size `]() property point\_size → int #### [` items `]() property items → lief.PE.ResourceDialogRegular.it\_items Iterator over the different control items #### [` nb_items `]() property nb\_items → int Number of control items --- ## [Resource Dialog – Extended]() ![Inheritance diagram of lief._lief.PE.ResourceDialogExtended](https://lief.re/doc/latest/_images/inheritance-a63e6bbdd6a5981d2f0ab5c6629aaaf03139aed7.png) ### [` lief.PE.ResourceDialogExtended `]() class lief.PE.ResourceDialogExtended(*self*) Bases: [`ResourceDialog`]( "lief._lief.PE.ResourceDialog") Implementation for the new extended dialogbox format. See: [https://learn.microsoft.com/en-us/windows/win32/dlgbox/dlgtemplateex]() #### [` Item `]() class Item(*self*) Bases: [`Item`]( "lief._lief.PE.ResourceDialog.Item") This class represents a `DLGTEMPLATEEX` item (`DLGITEMTEMPLATEEX`). See: [https://learn.microsoft.com/en-us/windows/win32/dlgbox/dlgitemtemplateex]() ##### [` help_id `]() property help\_id → int The help context identifier for the control. When the system sends a `WM_HELP` message, it passes the `helpID` value in the `dwContextId` member of the `HELPINFO` structure. #### [` add_item `]() add\_item(*self*, *item: [lief.\_lief.PE.ResourceDialogExtended.Item]( "lief._lief.PE.ResourceDialogExtended.Item")*) → None Add a new control item to the dialog #### [` font `]() property font → [lief.PE.ResourceDialogExtended.font\_t]( "lief.PE.ResourceDialogExtended.font_t") Additional font information #### [` font_t `]() class font\_t Bases: `object` Font information for the font to use for the text in the dialog box and its controls ##### [` charset `]() property charset → int The character set to be used ##### [` italic `]() property italic → bool Indicates whether the font is italic ##### [` point_size `]() property point\_size → int The point size of the font ##### [` typeface `]() property typeface → str The name of the typeface for the font. ##### [` weight `]() property weight → int The weight of the font #### [` help_id `]() property help\_id → int The help context identifier for the dialog box window. When the system sends a `WM_HELP` message, it passes the `helpID` value in the `dwContextId` member of the `HELPINFO` structure. #### [` items `]() property items → lief.PE.ResourceDialogExtended.it\_items Iterator over the different control items #### [` signature `]() property signature → int Indicates whether a template is an extended dialog box template. If signature is 0xFFFF, this is an extended dialog box template. In this case, the dlgVer member specifies the template version number. #### [` version `]() property version → int The version number of the extended dialog box template. This member must be set to 1. --- ## [Resource Version]() ### [` lief.PE.ResourceVersion `]() class lief.PE.ResourceVersion Bases: `Object` Class that represents the data associated with the `RT_VERSION` entry See: VS\_VERSIONINFO – [https://docs.microsoft.com/en-us/windows/win32/menurc/vs-versioninfo]() #### [` file_info `]() property file\_info → [lief.PE.ResourceVersion.fixed\_file\_info\_t]( "lief.PE.ResourceVersion.fixed_file_info_t") Return the fixed file info (`VS_FIXEDFILEINFO`) #### [` fixed_file_info_t `]() class fixed\_file\_info\_t Bases: `object` This structure represents the `VS_FIXEDFILEINFO` structure defined in `verrsrc.h`. ##### [` FILE_FLAGS `]() class FILE\_FLAGS(*\*values*) Bases: `Enum` ###### [` DEBUG `]() DEBUG = 1 ###### [` INFO_INFERRED `]() INFO\_INFERRED = 16 ###### [` PATCHED `]() PATCHED = 4 ###### [` PRERELEASE `]() PRERELEASE = 2 ###### [` PRIVATEBUILD `]() PRIVATEBUILD = 8 ###### [` SPECIALBUILD `]() SPECIALBUILD = 32 ##### [` FILE_TYPE `]() class FILE\_TYPE(*\*values*) Bases: `Enum` ###### [` APP `]() APP = 1 ###### [` DLL `]() DLL = 2 ###### [` DRV `]() DRV = 3 ###### [` FONT `]() FONT = 4 ###### [` STATIC_LIB `]() STATIC\_LIB = 7 ###### [` UNKNOWN `]() UNKNOWN = 0 ###### [` VXD `]() VXD = 5 ##### [` FILE_TYPE_DETAILS `]() class FILE\_TYPE\_DETAILS(*\*values*) Bases: `Enum` ###### [` DRV_COMM `]() DRV\_COMM = 8589934602 ###### [` DRV_DISPLAY `]() DRV\_DISPLAY = 8589934596 ###### [` DRV_INPUTMETHOD `]() DRV\_INPUTMETHOD = 8589934603 ###### [` DRV_INSTALLABLE `]() DRV\_INSTALLABLE = 8589934600 ###### [` DRV_KEYBOARD `]() DRV\_KEYBOARD = 8589934594 ###### [` DRV_LANGUAGE `]() DRV\_LANGUAGE = 8589934595 ###### [` DRV_MOUSE `]() DRV\_MOUSE = 8589934597 ###### [` DRV_NETWORK `]() DRV\_NETWORK = 8589934598 ###### [` DRV_PRINTER `]() DRV\_PRINTER = 8589934593 ###### [` DRV_SOUND `]() DRV\_SOUND = 8589934601 ###### [` DRV_SYSTEM `]() DRV\_SYSTEM = 8589934599 ###### [` DRV_VERSIONED_PRINTER `]() DRV\_VERSIONED\_PRINTER = 12 ###### [` FONT_RASTER `]() FONT\_RASTER = 17179869185 ###### [` FONT_TRUETYPE `]() FONT\_TRUETYPE = 17179869187 ###### [` FONT_VECTOR `]() FONT\_VECTOR = 17179869186 ###### [` UNKNOWN `]() UNKNOWN = 0 ##### [` VERSION_OS `]() class VERSION\_OS(*\*values*) Bases: `Enum` ###### [` DOS_WINDOWS16 `]() DOS\_WINDOWS16 = 65537 ###### [` DOS_WINDOWS32 `]() DOS\_WINDOWS32 = 65540 ###### [` NT `]() NT = 262144 ###### [` NT_WINDOWS32 `]() NT\_WINDOWS32 = 262148 ###### [` OS216 `]() OS216 = 131072 ###### [` OS216_PM16 `]() OS216\_PM16 = 131074 ###### [` OS232 `]() OS232 = 196608 ###### [` OS232_PM32 `]() OS232\_PM32 = 196611 ###### [` PM16 `]() PM16 = 2 ###### [` PM32 `]() PM32 = 3 ###### [` UNKNOWN `]() UNKNOWN = 0 ###### [` WINCE `]() WINCE = 327680 ###### [` WINDOWS16 `]() WINDOWS16 = 1 ###### [` WINDOWS32 `]() WINDOWS32 = 4 ##### [` file_date_ls `]() property file\_date\_ls → int The least significant 32 bits of the file’s 64-bit binary creation date and time stamp. ##### [` file_date_ms `]() property file\_date\_ms → int The most significant 32 bits of the file’s 64-bit binary creation date and time stamp. ##### [` file_flags `]() property file\_flags → int Contains a bitmask that specifies the Boolean attributes of the file. This member can include one or more of the values specified in [`FILE_FLAGS`]( "lief.PE.ResourceVersion.fixed_file_info_t.FILE_FLAGS"). ##### [` file_flags_mask `]() property file\_flags\_mask → int Contains a bitmask that specifies the valid bits in file\_flags. A bit is valid only if it was defined when the file was created. ##### [` file_os `]() property file\_os → int The operating system for which this file was designed. This member can be one of the values specified in [`VERSION_OS`]( "lief.PE.ResourceVersion.fixed_file_info_t.VERSION_OS"). ##### [` file_subtype `]() property file\_subtype → int The function of the file. The possible values depend on the value of file\_type. ##### [` file_type `]() property file\_type → int The general type of file. This member can be one of the values specified in [`FILE_TYPE`]( "lief.PE.ResourceVersion.fixed_file_info_t.FILE_TYPE"). All other values are reserved. ##### [` file_type_details `]() property file\_type\_details → [lief.PE.ResourceVersion.fixed\_file\_info\_t.FILE\_TYPE\_DETAILS]( "lief.PE.ResourceVersion.fixed_file_info_t.FILE_TYPE_DETAILS") ##### [` file_version_ls `]() property file\_version\_ls → int The least significant 32 bits of the file’s binary version number. This member is used with [`file_version_ms`]( "lief.PE.ResourceVersion.fixed_file_info_t.file_version_ms") to form a 64-bit value used for numeric comparisons. ##### [` file_version_ms `]() property file\_version\_ms → int The most significant 32 bits of the file’s binary version number. This member is used with [`file_version_ls`]( "lief.PE.ResourceVersion.fixed_file_info_t.file_version_ls") to form a 64-bit value used for numeric comparisons. ##### [` flags `]() property flags → list[[lief.PE.ResourceVersion.fixed\_file\_info\_t.FILE\_FLAGS]( "lief.PE.ResourceVersion.fixed_file_info_t.FILE_FLAGS")] List of flags ##### [` has `]() has(*self*, *flag: [lief.\_lief.PE.ResourceVersion.fixed\_file\_info\_t.FILE\_FLAGS]( "lief._lief.PE.ResourceVersion.fixed_file_info_t.FILE_FLAGS")*) → bool Check if the given flag is present ##### [` product_version_ls `]() property product\_version\_ls → int The least significant 32 bits of the binary version number of the product with which this file was distributed. This member is used with [`product_version_ms`]( "lief.PE.ResourceVersion.fixed_file_info_t.product_version_ms") to form a 64-bit value used for numeric comparisons. ##### [` product_version_ms `]() property product\_version\_ms → int The most significant 32 bits of the binary version number of the product with which this file was distributed. This member is used with [`product_version_ls`]( "lief.PE.ResourceVersion.fixed_file_info_t.product_version_ls") to form a 64-bit value used for numeric comparisons. ##### [` signature `]() property signature → int Contains the value `0xFEEF04BD`. This is used with the `szKey` member of the `VS_VERSIONINFO` structure when searching a file for the `VS_FIXEDFILEINFO` structure. ##### [` struct_version `]() property struct\_version → int The binary version number of this structure. The high-order word of this member contains the major version number, and the low-order word contains the minor version number. #### [` key `]() property key → str The Unicode string L”VS\_VERSION\_INFO”” #### [` string_file_info `]() property string\_file\_info → [lief.PE.ResourceStringFileInfo]( "lief.PE.ResourceStringFileInfo") | None Return the `StringFileInfo` element #### [` type `]() property type → int The type of data in the version resource: \* `1` if it contains text data \* `0` if it contains binary data #### [` var_file_info `]() property var\_file\_info → [lief.PE.ResourceVarFileInfo]( "lief.PE.ResourceVarFileInfo") | None Return the `VarFileInfo` element --- ## [Resource Var File Info]() ### [` lief.PE.ResourceVarFileInfo `]() class lief.PE.ResourceVarFileInfo Bases: `Object` Representation of the `VarFileInfo` structure This structure represents the organization of data in a file-version resource. It contains version information not dependent on a particular language and code page combination. See: [https://learn.microsoft.com/en-us/windows/win32/menurc/varfileinfo]() #### [` key `]() property key → str Signature of the structure. Must be the unicode string “VarFileInfo” #### [` type `]() property type → int The type of data in the version resource: \* `1` if it contains text data \* `0` if it contains binary data #### [` vars `]() property vars → lief.PE.ResourceVarFileInfo.it\_vars Iterator over the embedded variables associated to the structure --- ## [Resource String File Info]() ### [` lief.PE.ResourceStringFileInfo `]() class lief.PE.ResourceStringFileInfo Bases: `Object` Representation of the `StringFileInfo` structure See: [https://docs.microsoft.com/en-us/windows/win32/menurc/stringfileinfo]() #### [` children `]() property children → lief.PE.ResourceStringFileInfo.it\_elements Iterator over the children values #### [` key `]() property key → str Signature of the structure. Must be the unicode string “StringFileInfo” #### [` type `]() property type → int The type of data in the version resource: \* `1` if it contains text data \* `0` if it contains binary data --- ## [Resource Var]() ### [` lief.PE.ResourceVar `]() class lief.PE.ResourceVar Bases: `object` This class represents an element of the [`ResourceVarFileInfo`]( "lief.PE.ResourceVarFileInfo") structure It typically contains a list of language and code page identifier pairs that the version of the application or DLL supports. See: [https://learn.microsoft.com/en-us/windows/win32/menurc/var-str]() #### [` key `]() property key → str Signature of the structure. Must be the unicode string “Translation” #### [` type `]() property type → int The type of data in the version resource: \* `1` if it contains text data \* `0` if it contains binary data #### [` values `]() property values → list[int] Return the translation values. The low-order word of each uint32\_t must contain a Microsoft language identifier, and the high-order word must contain the IBM code page number. Either high-order or low-order word can be zero, indicating that the file is language or code page independent --- ## [Resource String Table]() ### [` lief.PE.ResourceStringTable `]() class lief.PE.ResourceStringTable Bases: `Object` This class represents the `StringTable` structure. This structure can be seen as a dictionary of key, values with key and values defined as utf-16 strings. #### [` entries `]() property entries → lief.PE.ResourceStringTable.it\_entries Iterator over the different [`entry_t`]( "lief.PE.ResourceStringTable.entry_t") in this table #### [` entry_t `]() class entry\_t Bases: `object` An entry in this table which is composed of an UTF-16 key and an UTF-16 value. ##### [` key `]() property key → str ##### [` value `]() property value → str #### [` get `]() get(*self*, *key: str*) → str | None #### [` key `]() property key → str An 8-digit hexadecimal number stored as a Unicode string. The four most significant digits represent the language identifier. The four least significant digits represent the code page for which the data is formatted. Each Microsoft Standard Language identifier contains two parts: the low-order 10 bits specify the major language, and the high-order 6 bits specify the sublanguage. #### [` type `]() property type → int The type of data in the version resource: \* `1` if it contains text data \* `0` if it contains binary data --- ## [Resource Accelerator]() ### [` lief.PE.ResourceAccelerator `]() class lief.PE.ResourceAccelerator Bases: `Object` #### [` FLAGS `]() class FLAGS(*\*values*) Bases: `Flag` From: [https://docs.microsoft.com/en-us/windows/win32/menurc/acceltableentry]() ##### [` ALT `]() ALT = 16 ##### [` CONTROL `]() CONTROL = 8 ##### [` END `]() END = 128 ##### [` NOINVERT `]() NOINVERT = 2 ##### [` SHIFT `]() SHIFT = 4 ##### [` VIRTKEY `]() VIRTKEY = 1 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.ResourceAccelerator.FLAGS]( "lief.PE.ResourceAccelerator.FLAGS") = <nanobind.nb\_func object> #### [` add `]() add(*self*, *arg: [lief.\_lief.PE.ResourceAccelerator.FLAGS]( "lief._lief.PE.ResourceAccelerator.FLAGS")*, */*) → [lief.\_lief.PE.ResourceAccelerator]( "lief._lief.PE.ResourceAccelerator") Append the given flag #### [` ansi `]() property ansi → int An ANSI character value or a virtual-key code that identifies the accelerator key. #### [` ansi_str `]() property ansi\_str → str #### [` flags `]() property flags → int Describe the keyboard accelerator characteristics. #### [` has `]() has(*self*, *arg: [lief.\_lief.PE.ResourceAccelerator.FLAGS]( "lief._lief.PE.ResourceAccelerator.FLAGS")*, */*) → bool Whether the entry has the given flag #### [` id `]() property id → int An identifier for the keyboard accelerator. #### [` padding `]() property padding → int The number of bytes inserted to ensure that the structure is aligned on a DWORD boundary. #### [` remove `]() remove(*self*, *arg: [lief.\_lief.PE.ResourceAccelerator.FLAGS]( "lief._lief.PE.ResourceAccelerator.FLAGS")*, */*) → [lief.\_lief.PE.ResourceAccelerator]( "lief._lief.PE.ResourceAccelerator") Remove the given flag --- ## [Rich Header]() ### [` lief.PE.RichHeader `]() class lief.PE.RichHeader(*self*) Bases: `Object` Class which represents the not-so-documented rich header This structure is usually located at the end of the [`dos_stub`]( "lief.PE.Binary.dos_stub") and contains information about the build environment. It is generated by the Microsoft linker link.exe and there are no options to disable or remove this information. #### [` add_entryadd_entry `]() add\_entry(*self*, *entry: [lief.\_lief.PE.RichEntry]( "lief._lief.PE.RichEntry")*) → None **add\_entry(*self*, *id: int*, *build\_id: int*, *count: int*) → None** Overloaded function. 1. `add_entry(self, entry: lief._lief.PE.RichEntry) -> None` Add a new [`RichEntry`]( "lief.PE.RichEntry") 2. `add_entry(self, id: int, build_id: int, count: int) -> None` Add a new [`RichEntry`]( "lief.PE.RichEntry") given its [`id`]( "lief.PE.RichEntry.id"), [`build_id`]( "lief.PE.RichEntry.build_id"), [`count`]( "lief.PE.RichEntry.count") #### [` copy `]() copy(*self*) → [lief.\_lief.PE.RichHeader]( "lief._lief.PE.RichHeader") Duplicate the current instance of this object #### [` entries `]() property entries → lief.PE.RichHeader.it\_entries Return an iterator over the [`RichEntry`]( "lief.PE.RichEntry") within the header #### [` hashhash `]() hash(*self*, *algo: [lief.\_lief.PE.ALGORITHMS]( "lief._lief.PE.ALGORITHMS")*) → list[int] **hash(*self*, *algo: [lief.\_lief.PE.ALGORITHMS]( "lief._lief.PE.ALGORITHMS")*, *xor\_key: int*) → list[int]** Overloaded function. 1. `hash(self, algo: lief._lief.PE.ALGORITHMS) -> list[int]` > Compute the hash of the decoded rich header structure with the given hash [`ALGORITHMS`]( "lief.PE.ALGORITHMS") 2. `hash(self, algo: lief._lief.PE.ALGORITHMS, xor_key: int) -> list[int]` > Compute the hash of the rich header structure encoded with the provided key and the given hash [`ALGORITHMS`]( "lief.PE.ALGORITHMS") #### [` key `]() property key → int Key used to encode the header (xor operation) #### [` rawraw `]() raw(*self*) → list[int] **raw(*self*, *xor\_key: int*) → list[int]** Overloaded function. 1. `raw(self) -> list[int]` > The raw structure of the Rich header without xor-encoding. > > This function is equivalent as calling the other raw function with a xor\_key set to 0 2. `raw(self, xor_key: int) -> list[int]` > Given this rich header, this function re-computes the raw bytes of the structure with the provided xor-key. > > You can access the decoded data’s structure with the xor\_key set to 0 --- ## [Rich Entry]() ### [` lief.PE.RichEntrylief.PE.RichEntry `]() class lief.PE.RichEntry(*self*) **class lief.PE.RichEntry(*self*, *id: int*, *build\_id: int*, *count: int*)** Bases: `Object` Class which represents an entry associated to the RichHeader Overloaded function. 1. `__init__(self) -> None` 2. `__init__(self, id: int, build_id: int, count: int) -> None` Constructor from [`id`]( "lief.PE.RichEntry.id"), [`build_id`]( "lief.PE.RichEntry.build_id") and [`count`]( "lief.PE.RichEntry.count") #### [` build_id `]() property build\_id → int Builder number of the tool (if any) #### [` copy `]() copy(*self*) → [lief.\_lief.PE.RichEntry]( "lief._lief.PE.RichEntry") Duplicate the current instance of this object #### [` count `]() property count → int *Occurrence* count #### [` id `]() property id → int Type of the entry --- ## [Debug]() ![Inheritance diagram of lief._lief.PE.ExDllCharacteristics, lief._lief.PE.CodeView, lief._lief.PE.VCFeature, lief._lief.PE.Pogo, lief._lief.PE.FPO, lief._lief.PE.Debug, lief._lief.PE.Repro, lief._lief.PE.PDBChecksum, lief._lief.PE.CodeViewPDB](https://lief.re/doc/latest/_images/inheritance-fbde315166f89f11cf52c88af307b6b709a864ac.png) ### [` lief.PE.Debug `]() class lief.PE.Debug(*self*) Bases: `Object` This class represents a generic entry in the debug data directory. For known types, this class is extended to provide a dedicated API (see: [`CodeView`]( "lief.PE.CodeView")) #### [` TYPES `]() class TYPES(*\*values*) Bases: `Enum` The entry types ##### [` BORLAND `]() BORLAND = 9 ##### [` CLSID `]() CLSID = 11 ##### [` CODEVIEW `]() CODEVIEW = 2 ##### [` COFF `]() COFF = 1 ##### [` EXCEPTION `]() EXCEPTION = 5 ##### [` EX_DLLCHARACTERISTICS `]() EX\_DLLCHARACTERISTICS = 20 ##### [` FIXUP `]() FIXUP = 6 ##### [` FPO `]() FPO = 3 ##### [` ILTCG `]() ILTCG = 14 ##### [` MISC `]() MISC = 4 ##### [` MPX `]() MPX = 15 ##### [` OMAP_FROM_SRC `]() OMAP\_FROM\_SRC = 8 ##### [` OMAP_TO_SRC `]() OMAP\_TO\_SRC = 7 ##### [` PDBCHECKSUM `]() PDBCHECKSUM = 19 ##### [` POGO `]() POGO = 13 ##### [` REPRO `]() REPRO = 16 ##### [` RESERVED10 `]() RESERVED10 = 10 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` VC_FEATURE `]() VC\_FEATURE = 12 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.Debug.TYPES]( "lief.PE.Debug.TYPES") = <nanobind.nb\_func object> #### [` addressof_rawdata `]() property addressof\_rawdata → int Address of the debug data relative to the image base #### [` characteristics `]() property characteristics → int Reserved should be 0 #### [` copy `]() copy(*self*) → [lief.\_lief.PE.Debug]( "lief._lief.PE.Debug") | None Duplicate the current instance of this object #### [` major_version `]() property major\_version → int The major version number of the debug data format. #### [` minor_version `]() property minor\_version → int The minor version number of the debug data format. #### [` payload `]() property payload → memoryview Debug data associated with this entry #### [` pointerto_rawdata `]() property pointerto\_rawdata → int File offset of the debug data #### [` section `]() property section → [lief.PE.Section]( "lief.PE.Section") | None The section where debug data is located #### [` sizeof_data `]() property sizeof\_data → int Size of the debug data #### [` timestamp `]() property timestamp → int The time and date when the debug data was created. #### [` type `]() property type → [lief.PE.Debug.TYPES]( "lief.PE.Debug.TYPES") The format ([`TYPES`]( "lief.PE.Debug.TYPES")) of the debugging information --- ## [Code View]() ![Inheritance diagram of lief._lief.PE.CodeView, lief._lief.PE.CodeViewPDB](https://lief.re/doc/latest/_images/inheritance-e9f8a7d74456f46b65866cd68f7564de313cd2a8.png) ### [` lief.PE.CodeViewlief.PE.CodeView `]() class lief.PE.CodeView(*self*) **class lief.PE.CodeView(*self*, *arg: [lief.\_lief.PE.CodeView.SIGNATURES]( "lief._lief.PE.CodeView.SIGNATURES")*, */*)** Bases: [`Debug`]( "lief._lief.PE.Debug") #### [` SIGNATURES `]() class SIGNATURES(*\*values*) Bases: `Enum` ##### [` CV_41 `]() CV\_41 = 959464014 ##### [` CV_50 `]() CV\_50 = 825311822 ##### [` PDB_20 `]() PDB\_20 = 808534606 ##### [` PDB_70 `]() PDB\_70 = 1396986706 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.CodeView.SIGNATURES]( "lief.PE.CodeView.SIGNATURES") = <nanobind.nb\_func object> #### [` cv_signature `]() property cv\_signature → [lief.PE.CodeView.SIGNATURES]( "lief.PE.CodeView.SIGNATURES") Type of the code view ([`SIGNATURES`]( "lief.PE.CodeView.SIGNATURES")) --- ## [Code View PDB]() ![Inheritance diagram of lief._lief.PE.CodeViewPDB](https://lief.re/doc/latest/_images/inheritance-0ce9d372a40e1ccad005610ebcd1b1ff1383dfe4.png) ### [` lief.PE.CodeViewPDBlief.PE.CodeViewPDB `]() class lief.PE.CodeViewPDB(*self*) **class lief.PE.CodeViewPDB(*self*, *filename: str*)** Bases: [`CodeView`]( "lief._lief.PE.CodeView") CodeView PDB specialization Overloaded function. 1. `__init__(self) -> None` Default constructor 2. `__init__(self, filename: str) -> None` Filename-based constructor #### [` age `]() property age → int Age value to verify. The age does not necessarily correspond to any known time value, it is used to determine if a .pdb file is out of sync with a corresponding .exe file. #### [` filename `]() property filename → str | bytes The path to the `.pdb` file #### [` guid `]() property guid → str The GUID signature to verify against the .pdb file signature. This attribute might be used to lookup remote PDB file on a symbol server #### [` parent `]() property parent → [lief.PE.CodeView]( "lief.PE.CodeView") Return a reference to the parent [`lief.PE.CodeView`]( "lief.PE.CodeView") #### [` signature `]() property signature → list[int] The 32-bit signature to verify against the .pdb file signature. --- ## [Code Integrity]() ### [` lief.PE.CodeIntegrity `]() class lief.PE.CodeIntegrity(*self*) Bases: `Object` #### [` catalog `]() property catalog → int `0xFFFF` means not available #### [` catalog_offset `]() property catalog\_offset → int #### [` flags `]() property flags → int Flags to indicate if CI information is available, etc. #### [` reserved `]() property reserved → int Additional bitmask to be defined later --- ## [Pogo]() ![Inheritance diagram of lief._lief.PE.Pogo](https://lief.re/doc/latest/_images/inheritance-dd30c158f5f4a77263dd1bdb9d538cef832100c9.png) ### [` lief.PE.Pogo `]() class lief.PE.Pogo(*self*) Bases: [`Debug`]( "lief._lief.PE.Debug") #### [` SIGNATURES `]() class SIGNATURES(*\*values*) Bases: `Enum` ##### [` LCTG `]() LCTG = 1280590663 ##### [` PGI `]() PGI = 1346849024 ##### [` PGO `]() PGO = 1346850560 ##### [` PGU `]() PGU = 1346852096 ##### [` SPGO `]() SPGO = 1397770063 ##### [` UNKNOWN `]() UNKNOWN = 268435455 ##### [` ZERO `]() ZERO = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.Pogo.SIGNATURES]( "lief.PE.Pogo.SIGNATURES") = <nanobind.nb\_func object> #### [` entries `]() property entries → lief.PE.Pogo.it\_entries #### [` signature `]() property signature → [lief.PE.Pogo.SIGNATURES]( "lief.PE.Pogo.SIGNATURES") Type of the pogo ([`SIGNATURES`]( "lief.PE.Pogo.SIGNATURES")) --- ## [Pogo Entry]() ### [` lief.PE.PogoEntry `]() class lief.PE.PogoEntry(*self*) Bases: `Object` #### [` copy `]() copy(*self*) → [lief.\_lief.PE.PogoEntry]( "lief._lief.PE.PogoEntry") Duplicate the current instance of this object #### [` name `]() property name → str | bytes #### [` size `]() property size → int #### [` start_rva `]() property start\_rva → int --- ## [Repro]() ![Inheritance diagram of lief._lief.PE.Repro](https://lief.re/doc/latest/_images/inheritance-a4618a37c1668ee05ba4dc75bbc1b0ac8e950ead.png) ### [` lief.PE.Repro `]() class lief.PE.Repro Bases: [`Debug`]( "lief._lief.PE.Debug") This class represents a reproducible build entry from the debug directory. (`IMAGE_DEBUG_TYPE_REPRO`). This entry is usually generated with the undocumented /Brepro linker flag. See: [https://nikhilism.com/post/2020/windows-deterministic-builds/]() #### [` hash `]() property hash → memoryview The hash associated with the reproducible build --- ## [PDBChecksum]() ![Inheritance diagram of lief._lief.PE.PDBChecksum](https://lief.re/doc/latest/_images/inheritance-956f427dab66275c2cca7bcf26c9d2cb1b152d6b.png) ### [` lief.PE.PDBChecksum `]() class lief.PE.PDBChecksum(*self*, *algo: [lief.\_lief.PE.PDBChecksum.HASH\_ALGO]( "lief._lief.PE.PDBChecksum.HASH_ALGO")*, *hash: collections.abc.Sequence[int]*) Bases: [`Debug`]( "lief._lief.PE.Debug") This class represents the PDB Checksum debug entry which is essentially an array of bytes representing the checksum of the PDB content. #### [` HASH_ALGO `]() class HASH\_ALGO(*\*values*) Bases: `Enum` ##### [` SHA256 `]() SHA256 = 1 ##### [` UNKNOWN `]() UNKNOWN = 0 #### [` algorithm `]() property algorithm → [lief.PE.PDBChecksum.HASH\_ALGO]( "lief.PE.PDBChecksum.HASH_ALGO") Algorithm used for hashing the PDB content #### [` hash `]() property hash → memoryview Hash of the PDB content --- ## [VCFeature]() ![Inheritance diagram of lief._lief.PE.VCFeature](https://lief.re/doc/latest/_images/inheritance-35e0913f46335201c76afeabd5ef7dcd694f10a8.png) ### [` lief.PE.VCFeature `]() class lief.PE.VCFeature Bases: [`Debug`]( "lief._lief.PE.Debug") This class represents the `IMAGE_DEBUG_TYPE_VC_FEATURE` debug entry #### [` c_cpp `]() property c\_cpp → int Count for `C/C++` #### [` gs `]() property gs → int Count for `/GS` (number of guard stack) #### [` guards `]() property guards → int Count for `/guardN` #### [` pre_vcpp `]() property pre\_vcpp → int Count for `Pre-VC++ 11.00` #### [` sdl `]() property sdl → int Whether `/sdl` was enabled for this binary. `sdl` stands for Security Development Lifecycle and provides enhanced security features like changing security-relevant warnings into errors or enforcing guard stack. --- ## [ExDllCharacteristics]() ![Inheritance diagram of lief._lief.PE.ExDllCharacteristics](https://lief.re/doc/latest/_images/inheritance-c590e5f217242ec7542cab43163b5b04a96c047b.png) ### [` lief.PE.ExDllCharacteristics `]() class lief.PE.ExDllCharacteristics Bases: [`Debug`]( "lief._lief.PE.Debug") This class represents the `IMAGE_DEBUG_TYPE_EX_DLLCHARACTERISTICS` debug entry #### [` CHARACTERISTICS `]() class CHARACTERISTICS(*\*values*) Bases: `Flag` Extended DLL Characteristics ##### [` CET_COMPAT `]() CET\_COMPAT = 1 ##### [` CET_COMPAT_STRICT_MODE `]() CET\_COMPAT\_STRICT\_MODE = 2 ##### [` CET_DYNAMIC_APIS_ALLOW_IN_PROC `]() CET\_DYNAMIC\_APIS\_ALLOW\_IN\_PROC = 8 ##### [` CET_RESERVED_1 `]() CET\_RESERVED\_1 = 16 ##### [` CET_RESERVED_2 `]() CET\_RESERVED\_2 = 32 ##### [` CET_SET_CONTEXT_IP_VALIDATION_RELAXED_MODE `]() CET\_SET\_CONTEXT\_IP\_VALIDATION\_RELAXED\_MODE = 4 ##### [` FORWARD_CFI_COMPAT `]() FORWARD\_CFI\_COMPAT = 64 ##### [` HOTPATCH_COMPATIBLE `]() HOTPATCH\_COMPATIBLE = 128 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.ExDllCharacteristics.CHARACTERISTICS]( "lief.PE.ExDllCharacteristics.CHARACTERISTICS") = <nanobind.nb\_func object> #### [` ex_characteristics `]() property ex\_characteristics → [lief.PE.ExDllCharacteristics.CHARACTERISTICS]( "lief.PE.ExDllCharacteristics.CHARACTERISTICS") The extended characteristics #### [` ex_characteristics_list `]() property ex\_characteristics\_list → list[[lief.PE.ExDllCharacteristics.CHARACTERISTICS]( "lief.PE.ExDllCharacteristics.CHARACTERISTICS")] Characteristics as a vector #### [` has `]() has(*self*, *characteristic: [lief.\_lief.PE.ExDllCharacteristics.CHARACTERISTICS]( "lief._lief.PE.ExDllCharacteristics.CHARACTERISTICS")*) → bool Check if the given CHARACTERISTICS is used --- ## [Frame Pointer Omission (FPO)]() ![Inheritance diagram of lief._lief.PE.FPO](https://lief.re/doc/latest/_images/inheritance-2ca251243b9682efb5f61542367a4014e25083d2.png) ### [` lief.PE.FPO `]() class lief.PE.FPO Bases: [`Debug`]( "lief._lief.PE.Debug") This class represents the `IMAGE_DEBUG_TYPE_FPO` debug entry #### [` FRAME_TYPE `]() class FRAME\_TYPE(*\*values*) Bases: `Enum` ##### [` FPO_ `]() FPO\_ = 0 ##### [` NON_FPO `]() NON\_FPO = 3 ##### [` TRAP `]() TRAP = 1 ##### [` TSS `]() TSS = 2 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.FPO.FRAME\_TYPE]( "lief.PE.FPO.FRAME_TYPE") = <nanobind.nb\_func object> #### [` entries `]() property entries → lief.PE.FPO.it\_entries Iterator over the different FPO entries #### [` entry_t `]() class entry\_t Bases: `object` Represents the stack frame layout for a x86 function when frame pointer omission (FPO) optimization is used. ##### [` nb_locals `]() property nb\_locals → int The number of local variables. ##### [` nb_saved_regs `]() property nb\_saved\_regs → int Number of registers saved. ##### [` parameters_size `]() property parameters\_size → int The size of the parameters. ##### [` proc_size `]() property proc\_size → int The number of bytes in the function. ##### [` prolog_size `]() property prolog\_size → int The number of bytes in the function prolog code. ##### [` reserved `]() property reserved → int reserved for future use ##### [` rva `]() property rva → int The function RVA ##### [` type `]() property type → [lief.PE.FPO.FRAME\_TYPE]( "lief.PE.FPO.FRAME_TYPE") Variable that indicates the frame type. ##### [` use_bp `]() property use\_bp → bool Whether the EBP register has been allocated. ##### [` use_seh `]() property use\_seh → bool Whether the function uses structured exception handling. --- ## [Exception Info]() ![Inheritance diagram of lief._lief.PE.ExceptionInfo, lief._lief.PE.RuntimeFunctionAArch64, lief._lief.PE.unwind_aarch64.UnpackedFunction, lief._lief.PE.unwind_aarch64.PackedFunction, lief._lief.PE.RuntimeFunctionX64](https://lief.re/doc/latest/_images/inheritance-f0c6864431ee343df21cbaadcd4a611c95727c95.png) ### [` lief.PE.ExceptionInfo `]() class lief.PE.ExceptionInfo Bases: `object` This class is the base class for any exception or runtime function entry #### [` ARCH `]() class ARCH(*\*values*) Bases: `Enum` Arch discriminator for the subclasses ##### [` ARM64 `]() ARM64 = 1 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` X86_64 `]() X86\_64 = 2 #### [` arch `]() property arch → [lief.PE.ExceptionInfo.ARCH]( "lief.PE.ExceptionInfo.ARCH") Target architecture of this exception #### [` copy `]() copy(*self*) → [lief.\_lief.PE.ExceptionInfo]( "lief._lief.PE.ExceptionInfo") | None Duplicate the current instance of this object #### [` offset `]() property offset → int Offset in the binary where the raw exception information associated with this entry is defined #### [` rva_start `]() property rva\_start → int Function start address --- ## [RuntimeFunctionX64]() ![Inheritance diagram of lief._lief.PE.RuntimeFunctionX64](https://lief.re/doc/latest/_images/inheritance-a67b8160b956027a2d597bab5b2df2305c43cc1b.png) ### [` lief.PE.RuntimeFunctionX64 `]() class lief.PE.RuntimeFunctionX64 Bases: [`ExceptionInfo`]( "lief._lief.PE.ExceptionInfo") This class represents an entry in the exception table (`.pdata` section) for the x86-64 architecture. Reference: [https://learn.microsoft.com/en-us/cpp/build/exception-handling-x64]() #### [` UNWIND_FLAGS `]() class UNWIND\_FLAGS(*\*values*) Bases: `Flag` ##### [` CHAIN_INFO `]() CHAIN\_INFO = 4 ##### [` EXCEPTION_HANDLER `]() EXCEPTION\_HANDLER = 1 ##### [` TERMINATE_HANDLER `]() TERMINATE\_HANDLER = 2 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.RuntimeFunctionX64.UNWIND\_FLAGS]( "lief.PE.RuntimeFunctionX64.UNWIND_FLAGS") = <nanobind.nb\_func object> #### [` UNWIND_OPCODES `]() class UNWIND\_OPCODES(*\*values*) Bases: `Enum` ##### [` ALLOC_LARGE `]() ALLOC\_LARGE = 1 ##### [` ALLOC_SMALL `]() ALLOC\_SMALL = 2 ##### [` EPILOG `]() EPILOG = 6 ##### [` PUSH_MACHFRAME `]() PUSH\_MACHFRAME = 10 ##### [` PUSH_NONVOL `]() PUSH\_NONVOL = 0 ##### [` SAVE_NONVOL `]() SAVE\_NONVOL = 4 ##### [` SAVE_NONVOL_FAR `]() SAVE\_NONVOL\_FAR = 5 ##### [` SAVE_XMM128 `]() SAVE\_XMM128 = 8 ##### [` SAVE_XMM128_FAR `]() SAVE\_XMM128\_FAR = 9 ##### [` SET_FPREG `]() SET\_FPREG = 3 ##### [` SPARE `]() SPARE = 7 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.RuntimeFunctionX64.UNWIND\_OPCODES]( "lief.PE.RuntimeFunctionX64.UNWIND_OPCODES") = <nanobind.nb\_func object> #### [` UNWIND_REG `]() class UNWIND\_REG(*\*values*) Bases: `Enum` ##### [` R10 `]() R10 = 10 ##### [` R11 `]() R11 = 11 ##### [` R12 `]() R12 = 12 ##### [` R13 `]() R13 = 13 ##### [` R14 `]() R14 = 14 ##### [` R15 `]() R15 = 15 ##### [` R8 `]() R8 = 8 ##### [` R9 `]() R9 = 9 ##### [` RAX `]() RAX = 0 ##### [` RBP `]() RBP = 5 ##### [` RBX `]() RBX = 3 ##### [` RCX `]() RCX = 1 ##### [` RDI `]() RDI = 7 ##### [` RDX `]() RDX = 2 ##### [` RSI `]() RSI = 6 ##### [` RSP `]() RSP = 4 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.RuntimeFunctionX64.UNWIND\_REG]( "lief.PE.RuntimeFunctionX64.UNWIND_REG") = <nanobind.nb\_func object> #### [` rva_end `]() property rva\_end → int Function end address #### [` size `]() property size → int Size of the function (in bytes) #### [` unwind_info `]() property unwind\_info → [lief.PE.RuntimeFunctionX64.unwind\_info\_t]( "lief.PE.RuntimeFunctionX64.unwind_info_t") | None Detailed unwind information #### [` unwind_info_t `]() class unwind\_info\_t Bases: `object` ##### [` chained `]() property chained → [lief.PE.RuntimeFunctionX64]( "lief.PE.RuntimeFunctionX64") If [`lief.PE.RuntimeFunctionX64.UNWIND_FLAGS.CHAIN_INFO`]( "lief.PE.RuntimeFunctionX64.UNWIND_FLAGS.CHAIN_INFO") is set, this attribute references the chained runtime function. ##### [` count_opcodes `]() property count\_opcodes → int The number of slots in the unwind codes array. Some unwind codes, for example, [`lief.PE.RuntimeFunctionX64.UNWIND_OPCODES.SAVE_NONVOL`]( "lief.PE.RuntimeFunctionX64.UNWIND_OPCODES.SAVE_NONVOL"), require more than one slot in the array. ##### [` flags `]() property flags → int See: [`lief.PE.RuntimeFunctionX64.UNWIND_FLAGS`]( "lief.PE.RuntimeFunctionX64.UNWIND_FLAGS") ##### [` frame_reg `]() property frame\_reg → int If nonzero, then the function uses a frame pointer (FP), and this field is the number of the nonvolatile register used as the frame pointer, using the same encoding for the operation info field of [`UNWIND_OPCODES`]( "lief.PE.RuntimeFunctionX64.UNWIND_OPCODES") node ##### [` frame_reg_offset `]() property frame\_reg\_offset → int If the frame register field is nonzero, this field is the scaled offset from RSP that is applied to the FP register when it’s established ##### [` handler `]() property handler → int | None An image-relative pointer to either the function’s language-specific exception or termination handler. This value is set if one of these flags is set: [`lief.PE.RuntimeFunctionX64.UNWIND_FLAGS.EXCEPTION_HANDLER`]( "lief.PE.RuntimeFunctionX64.UNWIND_FLAGS.EXCEPTION_HANDLER"), [`lief.PE.RuntimeFunctionX64.UNWIND_FLAGS.TERMINATE_HANDLER`]( "lief.PE.RuntimeFunctionX64.UNWIND_FLAGS.TERMINATE_HANDLER"). ##### [` has `]() has(*self*, *arg: [lief.\_lief.PE.RuntimeFunctionX64.UNWIND\_FLAGS]( "lief._lief.PE.RuntimeFunctionX64.UNWIND_FLAGS")*, */*) → bool Check if the given flag is used ##### [` opcodes `]() property opcodes → list[[lief.PE.unwind\_x64.Code]( "lief.PE.unwind_x64.Code") | None] Enhanced representation of the unwind code ##### [` raw_opcodes `]() property raw\_opcodes → list[int] An array of items that explains the effect of the prolog on the nonvolatile registers and RSP ##### [` sizeof_prologue `]() property sizeof\_prologue → int Length of the function prolog in bytes. ##### [` version `]() property version → int Version number of the unwind data, currently 1 or 2. #### [` unwind_rva `]() property unwind\_rva → int Unwind info address --- ## [unwind\_x64 - Code]() ![Inheritance diagram of lief._lief.PE.unwind_x64.Spare, lief._lief.PE.unwind_x64.Code, lief._lief.PE.unwind_x64.PushNonVol, lief._lief.PE.unwind_x64.SaveNonVolatile, lief._lief.PE.unwind_x64.SetFPReg, lief._lief.PE.unwind_x64.PushMachFrame, lief._lief.PE.unwind_x64.SaveXMM128, lief._lief.PE.unwind_x64.Epilog, lief._lief.PE.unwind_x64.Alloc](https://lief.re/doc/latest/_images/inheritance-90dab8e8a11b4d878444ffd41a29893a3271c51f.png) ### [` lief.PE.unwind_x64.Code `]() class lief.PE.unwind\_x64.Code Bases: `object` Base class for all unwind operations #### [` opcode `]() property opcode → [lief.PE.RuntimeFunctionX64.UNWIND\_OPCODES]( "lief.PE.RuntimeFunctionX64.UNWIND_OPCODES") The original opcode #### [` position `]() property position → int Offset in the prolog --- ## [unwind\_x64 - Alloc]() ![Inheritance diagram of lief._lief.PE.unwind_x64.Alloc](https://lief.re/doc/latest/_images/inheritance-7932a760e824ebd8327192d9407686191ba0c101.png) ### [` lief.PE.unwind_x64.Alloc `]() class lief.PE.unwind\_x64.Alloc Bases: [`Code`]( "lief._lief.PE.unwind_x64.Code") This class represents a stack-allocation operation ([`lief.PE.RuntimeFunctionX64.UNWIND_OPCODES.ALLOC_SMALL`]( "lief.PE.RuntimeFunctionX64.UNWIND_OPCODES.ALLOC_SMALL"), [`lief.PE.RuntimeFunctionX64.UNWIND_OPCODES.ALLOC_LARGE`]( "lief.PE.RuntimeFunctionX64.UNWIND_OPCODES.ALLOC_LARGE")) #### [` size `]() property size → int The size allocated --- ## [unwind\_x64 - PushNonVol]() ![Inheritance diagram of lief._lief.PE.unwind_x64.PushNonVol](https://lief.re/doc/latest/_images/inheritance-5eac9f87597251388a440f3a60d481db96fe2564.png) ### [` lief.PE.unwind_x64.PushNonVol `]() class lief.PE.unwind\_x64.PushNonVol Bases: [`Code`]( "lief._lief.PE.unwind_x64.Code") Push a nonvolatile integer register, decrementing RSP by 8 #### [` reg `]() property reg → [lief.PE.RuntimeFunctionX64.UNWIND\_REG]( "lief.PE.RuntimeFunctionX64.UNWIND_REG") The register pushed --- ## [unwind\_x64 - PushMachFrame]() ![Inheritance diagram of lief._lief.PE.unwind_x64.PushMachFrame](https://lief.re/doc/latest/_images/inheritance-83f06da173147608509db8e636e283220441f4ec.png) ### [` lief.PE.unwind_x64.PushMachFrame `]() class lief.PE.unwind\_x64.PushMachFrame Bases: [`Code`]( "lief._lief.PE.unwind_x64.Code") Push a machine frame #### [` value `]() property value → int 0 or 1 --- ## [unwind\_x64 - SetFPReg]() ![Inheritance diagram of lief._lief.PE.unwind_x64.SetFPReg](https://lief.re/doc/latest/_images/inheritance-f4fd7774f8d5969331cb79842a09b6b1506851d5.png) ### [` lief.PE.unwind_x64.SetFPReg `]() class lief.PE.unwind\_x64.SetFPReg Bases: [`Code`]( "lief._lief.PE.unwind_x64.Code") Establish the frame pointer register by setting the register to some offset of the current RSP #### [` reg `]() property reg → [lief.PE.RuntimeFunctionX64.UNWIND\_REG]( "lief.PE.RuntimeFunctionX64.UNWIND_REG") Frame pointer register --- ## [unwind\_x64 - SaveNonVolatile]() ![Inheritance diagram of lief._lief.PE.unwind_x64.SaveNonVolatile](https://lief.re/doc/latest/_images/inheritance-14dd76e7d856869346e54e3568e2a502f80710ba.png) ### [` lief.PE.unwind_x64.SaveNonVolatile `]() class lief.PE.unwind\_x64.SaveNonVolatile Bases: [`Code`]( "lief._lief.PE.unwind_x64.Code") Save a nonvolatile integer register on the stack using a MOV instead of a PUSH. #### [` offset `]() property offset → int The offset where to save the register #### [` reg `]() property reg → [lief.PE.RuntimeFunctionX64.UNWIND\_REG]( "lief.PE.RuntimeFunctionX64.UNWIND_REG") The register to save --- ## [unwind\_x64 - SaveXMM128]() ![Inheritance diagram of lief._lief.PE.unwind_x64.SaveXMM128](https://lief.re/doc/latest/_images/inheritance-17a1bf8e61c218b96e60c63ac497b6e22c11b166.png) ### [` lief.PE.unwind_x64.SaveXMM128 `]() class lief.PE.unwind\_x64.SaveXMM128 Bases: [`Code`]( "lief._lief.PE.unwind_x64.Code") Save all 128 bits of a nonvolatile XMM register on the stack #### [` num `]() property num → int XMM register number #### [` offset `]() property offset → int The offset where to save the register --- ## [unwind\_x64 - Epilog]() ![Inheritance diagram of lief._lief.PE.unwind_x64.Epilog](https://lief.re/doc/latest/_images/inheritance-437397e8ee9ee6de699dc8140357066f7458375c.png) ### [` lief.PE.unwind_x64.Epilog `]() class lief.PE.unwind\_x64.Epilog Bases: [`Code`]( "lief._lief.PE.unwind_x64.Code") Describes the function’s epilog #### [` flags `]() property flags → int #### [` size `]() property size → int Size of the epilog --- ## [unwind\_x64 - Spare]() ![Inheritance diagram of lief._lief.PE.unwind_x64.Spare](https://lief.re/doc/latest/_images/inheritance-e73f005757aa71a7c1c1dd2b7c860591b9abc76f.png) ### [` lief.PE.unwind_x64.Spare `]() class lief.PE.unwind\_x64.Spare Bases: [`Code`]( "lief._lief.PE.unwind_x64.Code") --- ## [RuntimeFunctionAArch64]() ![Inheritance diagram of lief._lief.PE.unwind_aarch64.UnpackedFunction, lief._lief.PE.RuntimeFunctionAArch64, lief._lief.PE.unwind_aarch64.PackedFunction](https://lief.re/doc/latest/_images/inheritance-8c2e084ff297ede8b2084e665de7e6a265e9dcf6.png) ### [` lief.PE.RuntimeFunctionAArch64 `]() class lief.PE.RuntimeFunctionAArch64 Bases: [`ExceptionInfo`]( "lief._lief.PE.ExceptionInfo") This class represents an entry in the exception table (`.pdata` section) for the AArch64 architecture. Since the ARM64 unwinding info can be encoded in a *packed* and *unpacked* format, this class is inherited by [`lief.PE.unwind_aarch64.PackedFunction`]( "lief.PE.unwind_aarch64.PackedFunction") and [`lief.PE.unwind_aarch64.UnpackedFunction`]( "lief.PE.unwind_aarch64.UnpackedFunction") Reference: [https://learn.microsoft.com/en-us/cpp/build/arm64-exception-handling#arm64-exception-handling-information]() #### [` PACKED_FLAGS `]() class PACKED\_FLAGS(*\*values*) Bases: `Enum` ##### [` PACKED `]() PACKED = 1 ##### [` PACKED_FRAGMENT `]() PACKED\_FRAGMENT = 2 ##### [` RESERVED `]() RESERVED = 3 ##### [` UNPACKED `]() UNPACKED = 0 #### [` flag `]() property flag → [lief.PE.RuntimeFunctionAArch64.PACKED\_FLAGS]( "lief.PE.RuntimeFunctionAArch64.PACKED_FLAGS") Flag describing the format the unwind data #### [` length `]() property length → int Length of the function in bytes #### [` rva_end `]() property rva\_end → int Function end address ## [Runtime AArch64 (Packed) Function]() ![Inheritance diagram of lief._lief.PE.unwind_aarch64.PackedFunction](https://lief.re/doc/latest/_images/inheritance-f28464486f1fd687abc93c5686a0ec0397a0f65d.png) ### [` lief.PE.unwind_aarch64.PackedFunction `]() class lief.PE.unwind\_aarch64.PackedFunction Bases: [`RuntimeFunctionAArch64`]( "lief._lief.PE.RuntimeFunctionAArch64") This class represents a packed AArch64 exception entry. An exception entry can be packed if the unwind data fit in 30 bits Reference: [https://learn.microsoft.com/en-us/cpp/build/arm64-exception-handling?view=msvc-170#packed-unwind-data]() #### [` CR `]() property CR → int Flag indicating whether the function includes extra instructions to set up a frame chain and return link. #### [` H `]() property H → int 1-bit flag indicating whether the function homes the integer parameter registers (x0-x7) by storing them at the very start of the function. (0 = doesn’t home registers, 1 = homes registers). #### [` frame_size `]() property frame\_size → int Size of the allocated stack #### [` reg_F `]() property reg\_F → int Number of non-volatile FP registers (d8-d15) saved in the canonical stack location #### [` reg_I `]() property reg\_I → int Number of non-volatile INT registers (x19-x28) saved in the canonical stack location. ## [Runtime AArch64 (UnpackedFunction) Function]() ![Inheritance diagram of lief._lief.PE.unwind_aarch64.UnpackedFunction](https://lief.re/doc/latest/_images/inheritance-bb38985a5022477862bb99d31f385669f31b4248.png) ### [` lief.PE.unwind_aarch64.UnpackedFunction `]() class lief.PE.unwind\_aarch64.UnpackedFunction Bases: [`RuntimeFunctionAArch64`]( "lief._lief.PE.RuntimeFunctionAArch64") This class represents an unpacked AArch64 exception entry Reference: [https://learn.microsoft.com/en-us/cpp/build/arm64-exception-handling?view=msvc-170#xdata-records]() #### [` E `]() property E → int 1-bit field that indicates that information describing a single epilog is packed into the header (1) rather than requiring more scope words later (0). #### [` X `]() property X → int 1-bit field that indicates the presence (1) or absence (0) of exception data. #### [` code_words `]() property code\_words → int Number of 32-bit words needed to contain all of the unwind codes #### [` epilog_count `]() property epilog\_count → int **If E == 0**, specifies the count of the total number of epilog scopes. Otherwise, return 0. #### [` epilog_offset `]() property epilog\_offset → int **If E() == 1**, index of the first unwind code that describes the one and only epilog. #### [` epilog_scope_t `]() class epilog\_scope\_t Bases: `object` This structure describes an epilog scope. ##### [` reserved `]() property reserved → int Reserved for future expansion. Should be 0. ##### [` start_index `]() property start\_index → int Byte index of the first unwind code that describes this epilog ##### [` start_offset `]() property start\_offset → int Offset of the epilog relative to the start of the function #### [` epilog_scopes `]() property epilog\_scopes → lief.PE.unwind\_aarch64.UnpackedFunction.it\_epilog\_scopes Iterator over the epilog scopes #### [` exception_handler `]() property exception\_handler → int Exception handler RVA (if any) #### [` is_extended `]() property is\_extended → bool Whether it uses 2-words encoding #### [` unwind_code `]() property unwind\_code → memoryview Bytes that contain unwind codes #### [` version `]() property version → int Describes the version of the remaining `.xdata`. Currently (2025-01-04), only version 0 is defined, so values of 1-3 aren’t permitted. #### [` xdata_rva `]() property xdata\_rva → int RVA where this unpacked data is located (usually pointing in `.xdata`) --- ## [Load Configuration]() ### [` lief.PE.LoadConfiguration `]() class lief.PE.LoadConfiguration Bases: `Object` This class represents the load configuration data associated with the `IMAGE_LOAD_CONFIG_DIRECTORY`. This structure is frequently updated by Microsoft to add new metadata. Reference: [https://github.com/MicrosoftDocs/sdk-api/blob/cbeab4d371e8bc7e352c4d3a4c5819caa08c6a1c/sdk-api-src/content/winnt/ns-winnt-image\_load\_config\_directory64.md#L2]() #### [` IMAGE_GUARD `]() class IMAGE\_GUARD(*\*values*) Bases: `Flag` ##### [` CASTGUARD_PRESENT `]() CASTGUARD\_PRESENT = 16777216 ##### [` CFW_INSTRUMENTED `]() CFW\_INSTRUMENTED = 512 ##### [` CF_ENABLE_EXPORT_SUPPRESSION `]() CF\_ENABLE\_EXPORT\_SUPPRESSION = 32768 ##### [` CF_EXPORT_SUPPRESSION_INFO_PRESENT `]() CF\_EXPORT\_SUPPRESSION\_INFO\_PRESENT = 16384 ##### [` CF_FUNCTION_TABLE_PRESENT `]() CF\_FUNCTION\_TABLE\_PRESENT = 1024 ##### [` CF_INSTRUMENTED `]() CF\_INSTRUMENTED = 256 ##### [` CF_LONGJUMP_TABLE_PRESENT `]() CF\_LONGJUMP\_TABLE\_PRESENT = 65536 ##### [` DELAYLOAD_IAT_IN_ITS_OWN_SECTION `]() DELAYLOAD\_IAT\_IN\_ITS\_OWN\_SECTION = 8192 ##### [` EH_CONTINUATION_TABLE_PRESENT `]() EH\_CONTINUATION\_TABLE\_PRESENT = 4194304 ##### [` MEMCPY_PRESENT `]() MEMCPY\_PRESENT = 33554432 ##### [` NONE `]() NONE = 0 ##### [` PROTECT_DELAYLOAD_IAT `]() PROTECT\_DELAYLOAD\_IAT = 4096 ##### [` RETPOLINE_PRESENT `]() RETPOLINE\_PRESENT = 1048576 ##### [` RF_ENABLE `]() RF\_ENABLE = 262144 ##### [` RF_INSTRUMENTED `]() RF\_INSTRUMENTED = 131072 ##### [` RF_STRICT `]() RF\_STRICT = 524288 ##### [` SECURITY_COOKIE_UNUSED `]() SECURITY\_COOKIE\_UNUSED = 2048 ##### [` XFG_ENABLED `]() XFG\_ENABLED = 8388608 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.LoadConfiguration.IMAGE\_GUARD]( "lief.PE.LoadConfiguration.IMAGE_GUARD") = <nanobind.nb\_func object> #### [` cast_guard_os_determined_failure_mode `]() property cast\_guard\_os\_determined\_failure\_mode → int | None #### [` characteristics `]() property characteristics → int Characteristics of the structure which is defined by its size #### [` chpe_metadata `]() property chpe\_metadata → [lief.PE.CHPEMetadata]( "lief.PE.CHPEMetadata") | None Compiled Hybrid Portable Executable (CHPE) metadata (if any) #### [` chpe_metadata_pointer `]() property chpe\_metadata\_pointer → int | None VA to the extra Compiled Hybrid Portable Executable (CHPE) metadata. #### [` code_integrity `]() property code\_integrity → [lief.PE.CodeIntegrity]( "lief.PE.CodeIntegrity") | None Code integrity information. #### [` copy `]() copy(*self*) → [lief.\_lief.PE.LoadConfiguration]( "lief._lief.PE.LoadConfiguration") Duplicate the current instance of this object #### [` critical_section_default_timeout `]() property critical\_section\_default\_timeout → int The critical section default time-out value. #### [` csd_version `]() property csd\_version → int The service pack version. #### [` decommit_free_block_threshold `]() property decommit\_free\_block\_threshold → int The size of the minimum block that must be freed before it is freed (de-committed), in bytes. This value is advisory. #### [` decommit_total_free_threshold `]() property decommit\_total\_free\_threshold → int The size of the minimum total memory that must be freed in the process heap before it is freed (de-committed), in bytes. This value is advisory. #### [` dependent_load_flags `]() property dependent\_load\_flags → int Alias for [`reserved1`]( "lief.PE.LoadConfiguration.reserved1"). The default load flags used when the operating system resolves the statically linked imports of a module. For more information, see `LoadLibraryEx`. #### [` dynamic_relocations `]() property dynamic\_relocations → lief.PE.LoadConfiguration.it\_dynamic\_relocations\_t #### [` dynamic_value_reloc_table `]() property dynamic\_value\_reloc\_table → int | None VA pointing to a `IMAGE_DYNAMIC_RELOCATION_TABLE` #### [` dynamic_value_reloctable_offset `]() property dynamic\_value\_reloctable\_offset → int | None Offset of dynamic relocation table relative to the relocation table #### [` dynamic_value_reloctable_section `]() property dynamic\_value\_reloctable\_section → int | None The section index of the dynamic value relocation table #### [` editlist `]() property editlist → int Reserved for use by the system. #### [` enclave_config `]() property enclave\_config → [lief.PE.EnclaveConfiguration]( "lief.PE.EnclaveConfiguration") | None #### [` enclave_configuration_ptr `]() property enclave\_configuration\_ptr → int | None #### [` global_flags_clear `]() property global\_flags\_clear → int The global flags that control system behavior. For more information, see `Gflags.exe`. #### [` global_flags_set `]() property global\_flags\_set → int The global flags that control system behavior. For more information, see `Gflags.exe`. #### [` guard_address_taken_iat_entries `]() property guard\_address\_taken\_iat\_entries → lief.PE.LoadConfiguration.it\_guard\_functions List of RVA pointed by [`guard_address_taken_iat_entry_table`]( "lief.PE.LoadConfiguration.guard_address_taken_iat_entry_table") #### [` guard_address_taken_iat_entry_count `]() property guard\_address\_taken\_iat\_entry\_count → int | None The count of unique RVAs in the table pointed by [`guard_address_taken_iat_entry_table`]( "lief.PE.LoadConfiguration.guard_address_taken_iat_entry_table"). #### [` guard_address_taken_iat_entry_table `]() property guard\_address\_taken\_iat\_entry\_table → int | None The VA where Control Flow Guard address taken IAT table is stored. #### [` guard_cf_check_function_pointer `]() property guard\_cf\_check\_function\_pointer → int | None The VA where Control Flow Guard check-function pointer is stored. #### [` guard_cf_dispatch_function_pointer `]() property guard\_cf\_dispatch\_function\_pointer → int | None The VA where Control Flow Guard dispatch-function pointer is stored. #### [` guard_cf_flags_list `]() property guard\_cf\_flags\_list → list[[lief.PE.LoadConfiguration.IMAGE\_GUARD]( "lief.PE.LoadConfiguration.IMAGE_GUARD")] List of flags #### [` guard_cf_function_count `]() property guard\_cf\_function\_count → int | None The count of unique RVAs in the [`guard_cf_function_table`]( "lief.PE.LoadConfiguration.guard_cf_function_table") table. #### [` guard_cf_function_table `]() property guard\_cf\_function\_table → int | None The VA of the sorted table of RVAs of each Control Flow Guard function in the image. #### [` guard_cf_functions `]() property guard\_cf\_functions → lief.PE.LoadConfiguration.it\_guard\_functions Iterator over the Control Flow Guard functions referenced by [`guard_cf_function_table`]( "lief.PE.LoadConfiguration.guard_cf_function_table") #### [` guard_eh_continuation_count `]() property guard\_eh\_continuation\_count → int | None #### [` guard_eh_continuation_functions `]() property guard\_eh\_continuation\_functions → lief.PE.LoadConfiguration.it\_guard\_functions List of RVA pointed by [`guard_eh_continuation_table`]( "lief.PE.LoadConfiguration.guard_eh_continuation_table") #### [` guard_eh_continuation_table `]() property guard\_eh\_continuation\_table → int | None #### [` guard_flags `]() property guard\_flags → int | None Control Flow Guard related flags. #### [` guard_function_t `]() class guard\_function\_t Bases: `object` ##### [` extra `]() property extra → int ##### [` rva `]() property rva → int #### [` guard_long_jump_target_count `]() property guard\_long\_jump\_target\_count → int | None The count of unique RVAs in the table pointed by [`guard_long_jump_target_table`]( "lief.PE.LoadConfiguration.guard_long_jump_target_table"). #### [` guard_long_jump_target_table `]() property guard\_long\_jump\_target\_table → int | None The VA where Control Flow Guard long jump target table is stored. #### [` guard_long_jump_targets `]() property guard\_long\_jump\_targets → lief.PE.LoadConfiguration.it\_guard\_functions List of RVA pointed by [`guard_long_jump_target_table`]( "lief.PE.LoadConfiguration.guard_long_jump_target_table") #### [` guard_memcpy_function_pointer `]() property guard\_memcpy\_function\_pointer → int | None #### [` guard_rf_failure_routine `]() property guard\_rf\_failure\_routine → int | None VA of the failure routine #### [` guard_rf_failure_routine_function_pointer `]() property guard\_rf\_failure\_routine\_function\_pointer → int | None VA of the failure routine `fptr`. #### [` guard_rf_verify_stackpointer_function_pointer `]() property guard\_rf\_verify\_stackpointer\_function\_pointer → int | None VA of the Function verifying the stack pointer #### [` guard_xfg_check_function_pointer `]() property guard\_xfg\_check\_function\_pointer → int | None #### [` guard_xfg_dispatch_function_pointer `]() property guard\_xfg\_dispatch\_function\_pointer → int | None #### [` guard_xfg_table_dispatch_function_pointer `]() property guard\_xfg\_table\_dispatch\_function\_pointer → int | None #### [` has `]() has(*self*, *arg: [lief.\_lief.PE.LoadConfiguration.IMAGE\_GUARD]( "lief._lief.PE.LoadConfiguration.IMAGE_GUARD")*, */*) → bool Check if the given flag is present #### [` hotpatch_table_offset `]() property hotpatch\_table\_offset → int | None Offset to the *hotpatch* table #### [` hybrid_metadata_pointer `]() property hybrid\_metadata\_pointer → int | None Alias for [`chpe_metadata_pointer`]( "lief.PE.LoadConfiguration.chpe_metadata_pointer"). #### [` lock_prefix_table `]() property lock\_prefix\_table → int The VA of a list of addresses where the `LOCK` prefix is used. These will be replaced by `NOP` on single-processor systems. This member is available only for `x86`. #### [` major_version `]() property major\_version → int Major version #### [` maximum_allocation_size `]() property maximum\_allocation\_size → int The maximum allocation size, in bytes. This member is obsolete and is used only for debugging purposes. #### [` minor_version `]() property minor\_version → int Minor version #### [` process_affinity_mask `]() property process\_affinity\_mask → int The process affinity mask. For more information, see `GetProcessAffinityMask`. This member is available only for `.exe` files. #### [` process_heap_flags `]() property process\_heap\_flags → int The process heap flags. For more information, see `HeapCreate`. #### [` reserved1 `]() property reserved1 → int See: [`dependent_load_flags`]( "lief.PE.LoadConfiguration.dependent_load_flags") #### [` reserved2 `]() property reserved2 → int | None Must be 0 #### [` reserved3 `]() property reserved3 → int | None #### [` se_handler_count `]() property se\_handler\_count → int | None The count of unique handlers in the table. This member is available only for x86. #### [` se_handler_table `]() property se\_handler\_table → int | None The VA of the sorted table of RVAs of each valid, unique handler in the image. This member is available only for x86. #### [` security_cookie `]() property security\_cookie → int A pointer to a cookie that is used by Visual C++ or GS implementation. #### [` seh_functions `]() property seh\_functions → list[int] Return the list of the function RVA in the SEH table (if any) #### [` size `]() property size → int Size of the current structure #### [` timedatestamp `]() property timedatestamp → int The date and time stamp value #### [` uma_function_pointers `]() property uma\_function\_pointers → int | None #### [` virtual_memory_threshold `]() property virtual\_memory\_threshold → int The maximum block size that can be allocated from heap segments, in bytes. #### [` volatile_metadata `]() property volatile\_metadata → [lief.PE.VolatileMetadata]( "lief.PE.VolatileMetadata") | None #### [` volatile_metadata_pointer `]() property volatile\_metadata\_pointer → int | None --- ## [CHPEMetadata]() ![Inheritance diagram of lief._lief.PE.CHPEMetadata, lief._lief.PE.CHPEMetadataX86, lief._lief.PE.CHPEMetadataARM64](https://lief.re/doc/latest/_images/inheritance-7dbd6ebcce071b8fbb0282a4bb3cbd6d97573f8e.png) ### [` lief.PE.CHPEMetadata `]() class lief.PE.CHPEMetadata Bases: `object` Base class for any Compiled Hybrid Portable Executable (CHPE) metadata. This class is inherited by architecture-specific implementation. #### [` KIND `]() class KIND(*\*values*) Bases: `Enum` Discriminator for the subclasses ##### [` ARM64 `]() ARM64 = 1 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` X86 `]() X86 = 2 #### [` copy `]() copy(*self*) → [lief.\_lief.PE.CHPEMetadata]( "lief._lief.PE.CHPEMetadata") | None Duplicate the current instance of this object #### [` kind `]() property kind → [lief.PE.CHPEMetadata.KIND]( "lief.PE.CHPEMetadata.KIND") Determine the type of the concrete implementation #### [` version `]() property version → int Version of the structure --- ## [CHPEMetadata (ARM64)]() ![Inheritance diagram of lief._lief.PE.CHPEMetadataARM64](https://lief.re/doc/latest/_images/inheritance-e619027d09ee0cfabf2613b44f245186d5b2cfb1.png) ### [` lief.PE.CHPEMetadataARM64 `]() class lief.PE.CHPEMetadataARM64 Bases: [`CHPEMetadata`]( "lief._lief.PE.CHPEMetadata") This class represents ARM64-specific metadata used in CHPE (Compatible Hybrid PE) binaries, particularly for hybrid architectures like ARM64EC and ARM64X. It extends the [`CHPEMetadata`]( "lief.PE.CHPEMetadata") base class and provides access to metadata describing code ranges, redirections, entry points, and other hybrid-specific information relevant for binary analysis. #### [` alternate_entry_point `]() property alternate\_entry\_point → int #### [` auxiliary_delay_import `]() property auxiliary\_delay\_import → int #### [` auxiliary_delay_import_copy `]() property auxiliary\_delay\_import\_copy → int #### [` auxiliary_iat `]() property auxiliary\_iat → int #### [` auxiliary_iat_copy `]() property auxiliary\_iat\_copy → int #### [` bitfield_info `]() property bitfield\_info → int #### [` code_map `]() property code\_map → int #### [` code_map_count `]() property code\_map\_count → int #### [` code_range_entry_point `]() property code\_range\_entry\_point → lief.PE.CHPEMetadataARM64.it\_code\_range\_entry\_point #### [` code_range_entry_point_t `]() class code\_range\_entry\_point\_t Bases: `object` Mirror of IMAGE\_ARM64EC\_CODE\_RANGE\_ENTRY\_POINT: Represents a mapping between code range and its entry point. ##### [` end_rva `]() property end\_rva → int End of the code range (RVA). ##### [` entrypoint `]() property entrypoint → int RVA of the entry point for this range. ##### [` start_rva `]() property start\_rva → int Start of the code range. #### [` code_ranges `]() property code\_ranges → lief.PE.CHPEMetadataARM64.it\_range\_entries #### [` code_ranges_to_entry_points_count `]() property code\_ranges\_to\_entry\_points\_count → int #### [` code_ranges_to_entrypoints `]() property code\_ranges\_to\_entrypoints → int #### [` extra_rfe_table `]() property extra\_rfe\_table → int #### [` extra_rfe_table_size `]() property extra\_rfe\_table\_size → int #### [` get_x64_information_function_pointer `]() property get\_x64\_information\_function\_pointer → int #### [` os_arm64x_dispatch_call `]() property os\_arm64x\_dispatch\_call → int #### [` os_arm64x_dispatch_call_no_redirect `]() property os\_arm64x\_dispatch\_call\_no\_redirect → int #### [` os_arm64x_dispatch_fptr `]() property os\_arm64x\_dispatch\_fptr → int #### [` os_arm64x_dispatch_icall `]() property os\_arm64x\_dispatch\_icall → int #### [` os_arm64x_dispatch_icall_cfg `]() property os\_arm64x\_dispatch\_icall\_cfg → int #### [` os_arm64x_dispatch_ret `]() property os\_arm64x\_dispatch\_ret → int #### [` range_entry_t `]() class range\_entry\_t Bases: `object` Structure that describes architecture-specific ranges ##### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` ###### [` AMD64 `]() AMD64 = 2 ###### [` ARM64 `]() ARM64 = 0 ###### [` ARM64EC `]() ARM64EC = 1 ##### [` end `]() property end → int End of the range (RVA) ##### [` length `]() property length → int Range’s length ##### [` start `]() property start → int Start of the range (RVA) ##### [` start_offset `]() property start\_offset → int Raw data (includes start RVA and type) ##### [` type `]() property type → [lief.PE.CHPEMetadataARM64.range\_entry\_t.TYPE]( "lief.PE.CHPEMetadataARM64.range_entry_t.TYPE") Architecture for this range #### [` redirection_entry_t `]() class redirection\_entry\_t Bases: `object` Structure that describes a redirection ##### [` dst `]() property dst → int ##### [` src `]() property src → int #### [` redirection_metadata `]() property redirection\_metadata → int #### [` redirection_metadata_count `]() property redirection\_metadata\_count → int #### [` redirections `]() property redirections → lief.PE.CHPEMetadataARM64.it\_redirection\_entries #### [` set_x64_information_function_pointer `]() property set\_x64\_information\_function\_pointer → int ## [CHPEMetadata (X86)]() ![Inheritance diagram of lief._lief.PE.CHPEMetadataX86](https://lief.re/doc/latest/_images/inheritance-69c5c94a06f64ba854c16000b7e606af5b99537b.png) ### [` lief.PE.CHPEMetadataX86 `]() class lief.PE.CHPEMetadataX86 Bases: [`CHPEMetadata`]( "lief._lief.PE.CHPEMetadata") This class represents hybrid metadata for X86. #### [` chpe_code_address_range_count `]() property chpe\_code\_address\_range\_count → int #### [` chpe_code_address_range_offset `]() property chpe\_code\_address\_range\_offset → int #### [` compiler_iat_pointer `]() property compiler\_iat\_pointer → int | None #### [` wowa64_dispatch_call_function_pointer `]() property wowa64\_dispatch\_call\_function\_pointer → int #### [` wowa64_dispatch_indirect_call_cfg_function_pointer `]() property wowa64\_dispatch\_indirect\_call\_cfg\_function\_pointer → int #### [` wowa64_dispatch_indirect_call_function_pointer `]() property wowa64\_dispatch\_indirect\_call\_function\_pointer → int #### [` wowa64_dispatch_jump_function_pointer `]() property wowa64\_dispatch\_jump\_function\_pointer → int #### [` wowa64_dispatch_ret_function_pointer `]() property wowa64\_dispatch\_ret\_function\_pointer → int #### [` wowa64_dispatch_ret_leaf_function_pointer `]() property wowa64\_dispatch\_ret\_leaf\_function\_pointer → int #### [` wowa64_exception_handler_function_pointer `]() property wowa64\_exception\_handler\_function\_pointer → int #### [` wowa64_rdtsc_function_pointer `]() property wowa64\_rdtsc\_function\_pointer → int | None --- ## [DynamicRelocation]() ![Inheritance diagram of lief._lief.PE.DynamicRelocationV1, lief._lief.PE.DynamicRelocation, lief._lief.PE.DynamicRelocationV2](https://lief.re/doc/latest/_images/inheritance-8357f44e4cc25ea0ec9cb170066d01984720b7b3.png) ### [` lief.PE.DynamicRelocation `]() class lief.PE.DynamicRelocation Bases: `object` This is the base class for any `IMAGE_DYNAMIC_RELOCATION32`, `IMAGE_DYNAMIC_RELOCATION32_V2`, `IMAGE_DYNAMIC_RELOCATION64`, `IMAGE_DYNAMIC_RELOCATION64_V2` dynamic relocations. #### [` IMAGE_DYNAMIC_RELOCATION `]() class IMAGE\_DYNAMIC\_RELOCATION(*\*values*) Bases: `Enum` Special symbol values as defined in `link.exe - GetDVRTSpecialSymbolName` ##### [` RELOCATION_ARM64X `]() RELOCATION\_ARM64X = 6 ##### [` RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER `]() RELOCATION\_ARM64\_KERNEL\_IMPORT\_CALL\_TRANSFER = 8 ##### [` RELOCATION_FUNCTION_OVERRIDE `]() RELOCATION\_FUNCTION\_OVERRIDE = 7 ##### [` RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER `]() RELOCATION\_GUARD\_IMPORT\_CONTROL\_TRANSFER = 3 ##### [` RELOCATION_GUARD_INDIR_CONTROL_TRANSFER `]() RELOCATION\_GUARD\_INDIR\_CONTROL\_TRANSFER = 4 ##### [` RELOCATION_GUARD_RF_EPILOGUE `]() RELOCATION\_GUARD\_RF\_EPILOGUE = 2 ##### [` RELOCATION_GUARD_RF_PROLOGUE `]() RELOCATION\_GUARD\_RF\_PROLOGUE = 1 ##### [` RELOCATION_GUARD_SWITCHTABLE_BRANCH `]() RELOCATION\_GUARD\_SWITCHTABLE\_BRANCH = 5 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.DynamicRelocation.IMAGE\_DYNAMIC\_RELOCATION]( "lief.PE.DynamicRelocation.IMAGE_DYNAMIC_RELOCATION") = <nanobind.nb\_func object> #### [` copy `]() copy(*self*) → [lief.\_lief.PE.DynamicRelocation]( "lief._lief.PE.DynamicRelocation") | None Duplicate the current instance of this object #### [` fixups `]() property fixups → [lief.PE.DynamicFixup]( "lief.PE.DynamicFixup") | None Return fixups information, where the interpretation may depend on the symbol’s value #### [` symbol `]() property symbol → int Symbol address. Some values have a special meaning (c.f. [`IMAGE_DYNAMIC_RELOCATION`]( "lief.PE.DynamicRelocation.IMAGE_DYNAMIC_RELOCATION")) and define how fixups are encoded. #### [` version `]() property version → int Version of the structure ## [DynamicRelocationV1]() ![Inheritance diagram of lief._lief.PE.DynamicRelocationV1](https://lief.re/doc/latest/_images/inheritance-89cbcc8c24de64d687cb2754c13ee518ef489792.png) ### [` lief.PE.DynamicRelocationV1 `]() class lief.PE.DynamicRelocationV1 Bases: [`DynamicRelocation`]( "lief._lief.PE.DynamicRelocation") This class represents a dynamic relocation (`IMAGE_DYNAMIC_RELOCATION32` or `IMAGE_DYNAMIC_RELOCATION64`). ## [DynamicRelocationV2]() ![Inheritance diagram of lief._lief.PE.DynamicRelocationV2](https://lief.re/doc/latest/_images/inheritance-d1b5fa919e7330d2079d457d92ea5b012e5632ed.png) ### [` lief.PE.DynamicRelocationV2 `]() class lief.PE.DynamicRelocationV2 Bases: [`DynamicRelocation`]( "lief._lief.PE.DynamicRelocation") This class represents a dynamic relocation (`IMAGE_DYNAMIC_RELOCATION64_V2` or `IMAGE_DYNAMIC_RELOCATION32_V2`) --- ## [DynamicFixup]() ![Inheritance diagram of lief._lief.PE.FunctionOverride, lief._lief.PE.DynamicFixup, lief._lief.PE.DynamicFixupControlTransfer, lief._lief.PE.DynamicFixupARM64X, lief._lief.PE.DynamicFixupUnknown, lief._lief.PE.DynamicFixupARM64Kernel, lief._lief.PE.DynamicFixupGeneric](https://lief.re/doc/latest/_images/inheritance-f6123f716a39902b0b7a4c52b943736f12b1bfa6.png) ### [` lief.PE.DynamicFixup `]() class lief.PE.DynamicFixup Bases: `object` This is the base class for any fixups located in [`DynamicRelocation`]( "lief.PE.DynamicRelocation") #### [` KIND `]() class KIND(*\*values*) Bases: `Enum` ##### [` ARM64X `]() ARM64X = 2 ##### [` ARM64_KERNEL_IMPORT_CALL_TRANSFER `]() ARM64\_KERNEL\_IMPORT\_CALL\_TRANSFER = 4 ##### [` FUNCTION_OVERRIDE `]() FUNCTION\_OVERRIDE = 3 ##### [` GENERIC `]() GENERIC = 1 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.DynamicFixup.KIND]( "lief.PE.DynamicFixup.KIND") = <nanobind.nb\_func object> #### [` copy `]() copy(*self*) → [lief.\_lief.PE.DynamicFixup]( "lief._lief.PE.DynamicFixup") | None Duplicate the current instance of this object #### [` kind `]() property kind → [lief.PE.DynamicFixup.KIND]( "lief.PE.DynamicFixup.KIND") Encoding of the fixups ## [DynamicFixupControlTransfer]() ![Inheritance diagram of lief._lief.PE.DynamicFixupControlTransfer](https://lief.re/doc/latest/_images/inheritance-a19386df3dd4ce210dc0298114798cf0678e8cbb.png) ### [` lief.PE.DynamicFixupControlTransfer `]() class lief.PE.DynamicFixupControlTransfer Bases: [`DynamicFixup`]( "lief._lief.PE.DynamicFixup") This class wraps fixups associated with the (special) symbol value: `IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER (3)`. #### [` NO_IAT_INDEX `]() NO\_IAT\_INDEX = 32767 #### [` reloc_entry_t `]() class reloc\_entry\_t Bases: `object` Mirror IMAGE\_IMPORT\_CONTROL\_TRANSFER\_DYNAMIC\_RELOCATION ##### [` iat_index `]() property iat\_index → int IAT index of the corresponding import. `0x7FFF` is a special value indicating no index. ##### [` is_call `]() property is\_call → bool True if target instruction is a `call`, false otherwise ##### [` rva `]() property rva → int RVA to the instruction #### [` relocations `]() property relocations → lief.PE.DynamicFixupControlTransfer.it\_relocations Iterator over the relocations ## [DynamicFixupARM64Kernel]() ![Inheritance diagram of lief._lief.PE.DynamicFixupARM64Kernel](https://lief.re/doc/latest/_images/inheritance-19a4c466231f4f7b8fc2005617c508e59cf6aa08.png) ### [` lief.PE.DynamicFixupARM64Kernel `]() class lief.PE.DynamicFixupARM64Kernel Bases: [`DynamicFixup`]( "lief._lief.PE.DynamicFixup") This class wraps fixups associated with the (special) symbol value: `IMAGE_DYNAMIC_RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER (8)`. #### [` IMPORT_TYPE `]() class IMPORT\_TYPE(*\*values*) Bases: `Enum` ##### [` DELAYED `]() DELAYED = 1 ##### [` STATIC `]() STATIC = 0 #### [` NO_IAT_INDEX `]() NO\_IAT\_INDEX = 32767 #### [` reloc_entry_t `]() class reloc\_entry\_t Bases: `object` Mirror `IMAGE_IMPORT_CONTROL_TRANSFER_ARM64_RELOCATION` ##### [` iat_index `]() property iat\_index → int IAT index of the corresponding import. `0x7FFF` is a special value indicating no index. ##### [` import_type `]() property import\_type → [lief.PE.DynamicFixupARM64Kernel.IMPORT\_TYPE]( "lief.PE.DynamicFixupARM64Kernel.IMPORT_TYPE") See: [`IMPORT_TYPE`]( "lief.PE.DynamicFixupARM64Kernel.IMPORT_TYPE") ##### [` indirect_call `]() property indirect\_call → bool True if target instruction is a `blr`, false if it’s a `br`. ##### [` register_index `]() property register\_index → int Register index used for the indirect call/jump. For instance, if the instruction is `br x3`, this index is set to `3` ##### [` rva `]() property rva → int RVA to the call instruction #### [` relocations `]() property relocations → lief.PE.DynamicFixupARM64Kernel.it\_relocations Iterator over the relocations ## [DynamicFixupARM64X]() ![Inheritance diagram of lief._lief.PE.DynamicFixupARM64X](https://lief.re/doc/latest/_images/inheritance-925804b9f9696ad6f5aecd59645a406a5aa9525c.png) ### [` lief.PE.DynamicFixupARM64X `]() class lief.PE.DynamicFixupARM64X Bases: [`DynamicFixup`]( "lief._lief.PE.DynamicFixup") This class represents `IMAGE_DYNAMIC_RELOCATION_ARM64X` #### [` FIXUP_TYPE `]() class FIXUP\_TYPE(*\*values*) Bases: `Enum` ##### [` DELTA `]() DELTA = 2 ##### [` VALUE `]() VALUE = 1 ##### [` ZEROFILL `]() ZEROFILL = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.DynamicFixupARM64X.FIXUP\_TYPE]( "lief.PE.DynamicFixupARM64X.FIXUP_TYPE") = <nanobind.nb\_func object> #### [` reloc_entry_t `]() class reloc\_entry\_t Bases: `object` ##### [` raw_bytes `]() property raw\_bytes → list[int] If the type is class:~.FIXUP\_TYPE.VALUE, the bytes associated with the fixup. ##### [` rva `]() property rva → int RVA where the fixup takes place ##### [` size `]() property size → int Size of the value to patch ##### [` type `]() property type → [lief.PE.DynamicFixupARM64X.FIXUP\_TYPE]( "lief.PE.DynamicFixupARM64X.FIXUP_TYPE") Fixup’s kind ##### [` value `]() property value → int If the type is class:~.FIXUP\_TYPE.DELTA, the (signed) value #### [` relocations `]() property relocations → lief.PE.DynamicFixupARM64X.it\_relocations Iterator over the different fixup entries ## [DynamicFixupGeneric]() ![Inheritance diagram of lief._lief.PE.DynamicFixupGeneric](https://lief.re/doc/latest/_images/inheritance-5ddb4ff0999a1991c7671b8337a429fcdaf51bf6.png) ### [` lief.PE.DynamicFixupGeneric `]() class lief.PE.DynamicFixupGeneric Bases: [`DynamicFixup`]( "lief._lief.PE.DynamicFixup") This class represents a generic entry where the fixups are regular relocations ([`lief.PE.Relocation`]( "lief.PE.Relocation")) #### [` relocations `]() property relocations → lief.PE.DynamicFixupGeneric.it\_relocations Iterator over the relocations ## [DynamicFixupUnknown]() ![Inheritance diagram of lief._lief.PE.DynamicFixupUnknown](https://lief.re/doc/latest/_images/inheritance-c4a4895ab753ab3b8e742bc708b347ae062811bd.png) ### [` lief.PE.DynamicFixupUnknown `]() class lief.PE.DynamicFixupUnknown Bases: [`DynamicFixup`]( "lief._lief.PE.DynamicFixup") This class represents a special dynamic relocation where the format of the fixups is not supported by LIEF. #### [` payload `]() property payload → memoryview Raw fixups ## [FunctionOverride]() ![Inheritance diagram of lief._lief.PE.FunctionOverride](https://lief.re/doc/latest/_images/inheritance-d2bb6cf821159f887d14e027f3de02c16ee3b962.png) ### [` lief.PE.FunctionOverride `]() class lief.PE.FunctionOverride Bases: [`DynamicFixup`]( "lief._lief.PE.DynamicFixup") This class represents `IMAGE_DYNAMIC_RELOCATION_FUNCTION_OVERRIDE` #### [` bdd_info `]() property bdd\_info → lief.PE.FunctionOverride.it\_bdd\_info Iterator over the BDD info #### [` find_bdd_infofind_bdd_info `]() find\_bdd\_info(*self*, *arg: int*, */*) → [lief.\_lief.PE.FunctionOverride.image\_bdd\_info\_t]( "lief._lief.PE.FunctionOverride.image_bdd_info_t") | None **find\_bdd\_info(*self*, *arg: [lief.\_lief.PE.FunctionOverrideInfo]( "lief._lief.PE.FunctionOverrideInfo")*, */*) → [lief.\_lief.PE.FunctionOverride.image\_bdd\_info\_t]( "lief._lief.PE.FunctionOverride.image_bdd_info_t") | None** Overloaded function. 1. `find_bdd_info(self, arg: int, /) -> lief._lief.PE.FunctionOverride.image_bdd_info_t | None` Find the `IMAGE_BDD_INFO` at the given offset 2. `find_bdd_info(self, arg: lief._lief.PE.FunctionOverrideInfo, /) -> lief._lief.PE.FunctionOverride.image_bdd_info_t | None` Find the `IMAGE_BDD_INFO` associated with the given function override info #### [` func_overriding_info `]() property func\_overriding\_info → lief.PE.FunctionOverride.it\_func\_overriding\_info Iterator over the overriding info #### [` image_bdd_dynamic_relocation_t `]() class image\_bdd\_dynamic\_relocation\_t Bases: `object` Mirror `IMAGE_BDD_DYNAMIC_RELOCATION` ##### [` left `]() property left → int ##### [` right `]() property right → int ##### [` value `]() property value → int #### [` image_bdd_info_t `]() class image\_bdd\_info\_t Bases: `object` Mirror `IMAGE_BDD_INFO` ##### [` original_offset `]() property original\_offset → int ##### [` original_size `]() property original\_size → int ##### [` payload `]() property payload → list[int] ##### [` relocations `]() property relocations → list[[lief.PE.FunctionOverride.image\_bdd\_dynamic\_relocation\_t]( "lief.PE.FunctionOverride.image_bdd_dynamic_relocation_t")] ##### [` version `]() property version → int ## [FunctionOverrideInfo]() ### [` lief.PE.FunctionOverrideInfo `]() class lief.PE.FunctionOverrideInfo Bases: `object` #### [` base_reloc_size `]() property base\_reloc\_size → int Size in bytes taken by BaseRelocs #### [` bdd_offset `]() property bdd\_offset → int Offset into the BDD region #### [` functions_rva `]() property functions\_rva → list[int] #### [` original_rva `]() property original\_rva → int RVA of original function #### [` relocations `]() property relocations → lief.PE.DynamicFixupGeneric.it\_relocations #### [` rva_size `]() property rva\_size → int Size in bytes taken by RVAs --- ## [EnclaveConfiguration]() ### [` lief.PE.EnclaveConfiguration `]() class lief.PE.EnclaveConfiguration Bases: `object` This class represents the enclave configuration #### [` enclave_flags `]() property enclave\_flags → int A flag that indicates whether the image is suitable for use as the primary image in the enclave. #### [` enclave_size `]() property enclave\_size → int The expected virtual size of the private address range for the enclave, in bytes. #### [` family_id `]() property family\_id → list[int] The family identifier that the author of the enclave assigned to the enclave. #### [` image_id `]() property image\_id → list[int] The image identifier that the author of the enclave assigned to the enclave. #### [` image_version `]() property image\_version → int The version number that the author of the enclave assigned to the enclave. #### [` import_entry_size `]() property import\_entry\_size → int The size of each image in the array of images that the [`import_list_rva`]( "lief.PE.EnclaveConfiguration.import_list_rva") member points to. #### [` import_list_rva `]() property import\_list\_rva → int The RVA of the array of images that the enclave image may import, with identity information for each image. #### [` imports `]() property imports → lief.PE.EnclaveConfiguration.it\_imports Iterator over the enclave’s imports #### [` is_debuggable `]() property is\_debuggable → bool Whether this enclave can be debugged #### [` min_required_config_size `]() property min\_required\_config\_size → int The minimum size of the `IMAGE_ENCLAVE_CONFIG(32,64)` structure that the image loader must be able to process in order for the enclave to be usable. This member allows an enclave to inform an earlier version of the image loader that the image loader can safely load the enclave and ignore optional members added to `IMAGE_ENCLAVE_CONFIG(32,64)` for later versions of the enclave. If the size of `IMAGE_ENCLAVE_CONFIG(32,64)` that the image loader can process is less than `MinimumRequiredConfigSize`, the enclave cannot be run securely. If `MinimumRequiredConfigSize` is zero, the minimum size of the `IMAGE_ENCLAVE_CONFIG(32,64)` structure that the image loader must be able to process in order for the enclave to be usable is assumed to be the size of the structure through and including the `MinimumRequiredConfigSize` member. #### [` nb_imports `]() property nb\_imports → int The number of images in the array of images that the [`import_list_rva`]( "lief.PE.EnclaveConfiguration.import_list_rva") member points to. #### [` nb_threads `]() property nb\_threads → int The maximum number of threads that can be created within the enclave. #### [` policy_flags `]() property policy\_flags → int A flag that indicates whether the enclave permits debugging. #### [` security_version `]() property security\_version → int The security version number that the author of the enclave assigned to the enclave. #### [` size `]() property size → int The size of the `IMAGE_ENCLAVE_CONFIG64/IMAGE_ENCLAVE_CONFIG32` structure, in bytes. --- ## [EnclaveImport]() ### [` lief.PE.EnclaveImport `]() class lief.PE.EnclaveImport Bases: `object` Defines an entry in the array of images that an enclave can import. #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` ##### [` AUTHOR_ID `]() AUTHOR\_ID = 2 ##### [` FAMILY_ID `]() FAMILY\_ID = 3 ##### [` IMAGE_ID `]() IMAGE\_ID = 4 ##### [` NONE `]() NONE = 0 ##### [` UNIQUE_ID `]() UNIQUE\_ID = 1 #### [` family_id `]() property family\_id → list[int] The family identifier of the primary module for the enclave. #### [` id `]() property id → list[int] The unique identifier of the primary module for the enclave, if the [`type`]( "lief.PE.EnclaveImport.type") is [`UNIQUE_ID`]( "lief.PE.EnclaveImport.TYPE.UNIQUE_ID"). Otherwise, the author identifier of the primary module for the enclave. #### [` image_id `]() property image\_id → list[int] The image identifier of the primary module for the enclave. #### [` import_name `]() property import\_name → str Resolved import name #### [` import_name_rva `]() property import\_name\_rva → int The relative virtual address of a NULL-terminated string that contains the same value found in the import directory for the image. #### [` min_security_version `]() property min\_security\_version → int The minimum enclave security version that each image must have for the image to be imported successfully. The image is rejected unless its enclave security version is equal to or greater than the minimum value in the import record. Set the value in the import record to zero to turn off the security version check. #### [` reserved `]() property reserved → int Reserved. Should be 0 #### [` type `]() property type → [lief.PE.EnclaveImport.TYPE]( "lief.PE.EnclaveImport.TYPE") The type of identifier of the image that must match the value in the import record. --- ## [Volatile Metadata]() ### [` lief.PE.VolatileMetadata `]() class lief.PE.VolatileMetadata Bases: `object` This class represents volatile metadata which can be enabled at link time with `/volatileMetadata`. This metadata aims to improve performances when running x64 code on ARM64. #### [` access_table `]() property access\_table → list[int] #### [` access_table_rva `]() property access\_table\_rva → int #### [` access_table_size `]() property access\_table\_size → int #### [` info_range_rva `]() property info\_range\_rva → int #### [` info_ranges `]() property info\_ranges → lief.PE.VolatileMetadata.it\_info\_ranges\_t #### [` info_ranges_size `]() property info\_ranges\_size → int #### [` max_version `]() property max\_version → int #### [` min_version `]() property min\_version → int #### [` range_t `]() class range\_t Bases: `object` ##### [` end `]() property end → int ##### [` size `]() property size → int ##### [` start `]() property start → int #### [` size `]() property size → int --- ## [Utilities]() ### [` lief.PE.check_layout `]() lief.PE.check\_layout(*binary: [lief.PE.Binary]( "lief.PE.Binary")*) → tuple[bool, str] Check that the layout of the given binary is correct from the Windows loader perspective. ### [` lief.is_pelief.is_pe `]() lief.is\_pe(*\*args*) → bool **lief.is\_pe(*raw: collections.abc.Sequence[int]*) → bool** Overloaded function. 1. `is_pe(file: Union[str | os.PathLike]) -> bool` Check if the given file is a `PE` 2. `is_pe(raw: collections.abc.Sequence[int]) -> bool` Check if the given raw data is a `PE` ### [` lief.PE.get_typelief.PE.get_type `]() lief.PE.get\_type(*\*args*) → [lief.PE.PE\_TYPE]( "lief.PE.PE_TYPE") | [lief.lief\_errors]( "lief.lief_errors") **lief.PE.get\_type(*raw: collections.abc.Sequence[int]*) → [lief.\_lief.PE.PE\_TYPE]( "lief._lief.PE.PE_TYPE") | [lief.\_lief.lief\_errors]( "lief._lief.lief_errors")** Overloaded function. 1. `get_type(file: Union[str | os.PathLike]) -> Union[lief._lief.PE.PE_TYPE, lief._lief.lief_errors]` > If the input file is a valid `PE`, return the [`PE_TYPE`]( "lief.PE.PE_TYPE"). Otherwise, return a [`lief.lief_errors`]( "lief.lief_errors"). 2. `get_type(raw: collections.abc.Sequence[int]) -> Union[lief._lief.PE.PE_TYPE, lief._lief.lief_errors]` ### [` lief.PE.get_imphash `]() lief.PE.get\_imphash(*binary: [lief.PE.Binary]( "lief.PE.Binary")*, *mode: [lief.PE.IMPHASH\_MODE]( "lief.PE.IMPHASH_MODE")*) → str Compute the hash of imported functions Properties of the hash generated: > - Order agnostic > - Case agnostic > - Ordinal (**in some extent**) agnostic If one needs the same output as Virus Total (i.e. pefile), you can use [`PEFILE`]( "lief.PE.IMPHASH_MODE.PEFILE") as second parameter. > **Warning** > > The algorithm used to compute the *imphash* value has some variations compared to Yara, pefile, VT implementation > **See also** > > [https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html]() ### [` lief.PE.IMPHASH_MODE `]() class lief.PE.IMPHASH\_MODE(*\*values*) Bases: `Enum` Enum to define the behavior of [`get_imphash()`]( "lief.PE.get_imphash") #### [` DEFAULT `]() DEFAULT = 0 #### [` LIEF `]() LIEF = 0 #### [` PEFILE `]() PEFILE = 1 #### [` VT `]() VT = 1 ### [` lief.PE.resolve_ordinals `]() lief.PE.resolve\_ordinals(*imp: [lief.PE.Import]( "lief.PE.Import")*, *strict: bool*, *use\_std: bool*) → [lief.PE.Import]( "lief.PE.Import") | [lief.lief\_errors]( "lief.lief_errors") Take a [`Import`]( "lief.PE.Import") as input and try to resolve its ordinal imports. If the `strict` boolean parameter is set, a [`lief.lief_errors.not_found`]( "lief.lief_errors.not_found") error is returned upon the first non-resolvable ordinal. --- ## [Enums]() ### [PE\_TYPE]() #### [` lief.PE.PE_TYPE `]() class lief.PE.PE\_TYPE(*\*values*) Bases: `Enum` ##### [` PE32 `]() PE32 = 267 ##### [` PE32_PLUS `]() PE32\_PLUS = 523 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.PE\_TYPE]( "lief.PE.PE_TYPE") = <nanobind.nb\_func object> --- ### [RESOURCE\_LANGS]() #### [` lief.PE.RESOURCE_LANGS `]() class lief.PE.RESOURCE\_LANGS(*\*values*) Bases: `Enum` ##### [` AFRIKAANS `]() AFRIKAANS = 54 ##### [` ALBANIAN `]() ALBANIAN = 28 ##### [` ARABIC `]() ARABIC = 1 ##### [` ARMENIAN `]() ARMENIAN = 43 ##### [` ASSAMESE `]() ASSAMESE = 77 ##### [` AZERI `]() AZERI = 44 ##### [` BANGLA `]() BANGLA = 69 ##### [` BASQUE `]() BASQUE = 45 ##### [` BELARUSIAN `]() BELARUSIAN = 35 ##### [` BOSNIAN `]() BOSNIAN = 26 ##### [` BRETON `]() BRETON = 147 ##### [` BULGARIAN `]() BULGARIAN = 2 ##### [` CATALAN `]() CATALAN = 3 ##### [` CHINESE `]() CHINESE = 4 ##### [` CORNISH `]() CORNISH = 145 ##### [` CROATIAN `]() CROATIAN = 26 ##### [` CZECH `]() CZECH = 5 ##### [` DANISH `]() DANISH = 6 ##### [` DIVEHI `]() DIVEHI = 101 ##### [` DUTCH `]() DUTCH = 19 ##### [` ENGLISH `]() ENGLISH = 9 ##### [` ESPERANTO `]() ESPERANTO = 143 ##### [` ESTONIAN `]() ESTONIAN = 37 ##### [` FAEROESE `]() FAEROESE = 56 ##### [` FARSI `]() FARSI = 41 ##### [` FINNISH `]() FINNISH = 11 ##### [` FRENCH `]() FRENCH = 12 ##### [` GAELIC `]() GAELIC = 60 ##### [` GALICIAN `]() GALICIAN = 86 ##### [` GEORGIAN `]() GEORGIAN = 55 ##### [` GERMAN `]() GERMAN = 7 ##### [` GREEK `]() GREEK = 8 ##### [` GUJARATI `]() GUJARATI = 71 ##### [` HEBREW `]() HEBREW = 13 ##### [` HINDI `]() HINDI = 57 ##### [` HUNGARIAN `]() HUNGARIAN = 14 ##### [` ICELANDIC `]() ICELANDIC = 15 ##### [` INDONESIAN `]() INDONESIAN = 33 ##### [` INUKTITUT `]() INUKTITUT = 93 ##### [` INVARIANT `]() INVARIANT = 127 ##### [` IRISH `]() IRISH = 60 ##### [` ITALIAN `]() ITALIAN = 16 ##### [` JAPANESE `]() JAPANESE = 17 ##### [` KANNADA `]() KANNADA = 75 ##### [` KASHMIRI `]() KASHMIRI = 96 ##### [` KAZAK `]() KAZAK = 63 ##### [` KONKANI `]() KONKANI = 87 ##### [` KOREAN `]() KOREAN = 18 ##### [` KYRGYZ `]() KYRGYZ = 64 ##### [` LATVIAN `]() LATVIAN = 38 ##### [` LITHUANIAN `]() LITHUANIAN = 39 ##### [` LOWER_SORBIAN `]() LOWER\_SORBIAN = 46 ##### [` MACEDONIAN `]() MACEDONIAN = 47 ##### [` MALAY `]() MALAY = 62 ##### [` MALAYALAM `]() MALAYALAM = 76 ##### [` MALTESE `]() MALTESE = 58 ##### [` MANIPURI `]() MANIPURI = 88 ##### [` MAORI `]() MAORI = 40 ##### [` MARATHI `]() MARATHI = 78 ##### [` MONGOLIAN `]() MONGOLIAN = 80 ##### [` NEPALI `]() NEPALI = 97 ##### [` NEUTRAL `]() NEUTRAL = 0 ##### [` NORWEGIAN `]() NORWEGIAN = 20 ##### [` ORIYA `]() ORIYA = 72 ##### [` POLISH `]() POLISH = 21 ##### [` PORTUGUESE `]() PORTUGUESE = 22 ##### [` PULAR `]() PULAR = 103 ##### [` PUNJABI `]() PUNJABI = 70 ##### [` QUECHUA `]() QUECHUA = 107 ##### [` RHAETO_ROMANCE `]() RHAETO\_ROMANCE = 23 ##### [` ROMANIAN `]() ROMANIAN = 24 ##### [` RUSSIAN `]() RUSSIAN = 25 ##### [` SAMI `]() SAMI = 59 ##### [` SANSKRIT `]() SANSKRIT = 79 ##### [` SERBIAN `]() SERBIAN = 26 ##### [` SINDHI `]() SINDHI = 89 ##### [` SLOVAK `]() SLOVAK = 27 ##### [` SLOVENIAN `]() SLOVENIAN = 36 ##### [` SORBIAN `]() SORBIAN = 46 ##### [` SPANISH `]() SPANISH = 10 ##### [` SUTU `]() SUTU = 48 ##### [` SWAHILI `]() SWAHILI = 65 ##### [` SWEDISH `]() SWEDISH = 29 ##### [` SYRIAC `]() SYRIAC = 90 ##### [` TAMAZIGHT `]() TAMAZIGHT = 95 ##### [` TAMIL `]() TAMIL = 73 ##### [` TATAR `]() TATAR = 68 ##### [` TELUGU `]() TELUGU = 74 ##### [` THAI `]() THAI = 30 ##### [` TIGRINYA `]() TIGRINYA = 115 ##### [` TSONGA `]() TSONGA = 49 ##### [` TSWANA `]() TSWANA = 50 ##### [` TURKISH `]() TURKISH = 31 ##### [` UKRAINIAN `]() UKRAINIAN = 34 ##### [` URDU `]() URDU = 32 ##### [` UZBEK `]() UZBEK = 67 ##### [` VALENCIAN `]() VALENCIAN = 3 ##### [` VENDA `]() VENDA = 51 ##### [` VIETNAMESE `]() VIETNAMESE = 42 ##### [` WALON `]() WALON = 144 ##### [` WELSH `]() WELSH = 146 ##### [` XHOSA `]() XHOSA = 52 ##### [` ZULU `]() ZULU = 53 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.RESOURCE\_LANGS]( "lief.PE.RESOURCE_LANGS") = <nanobind.nb\_func object> ### [ACCELERATOR\_CODES]() #### [` lief.PE.ACCELERATOR_CODES `]() class lief.PE.ACCELERATOR\_CODES(*\*values*) Bases: `Enum` ##### [` A `]() A = 65 ##### [` ACCEPT `]() ACCEPT = 30 ##### [` ADD `]() ADD = 107 ##### [` APPS `]() APPS = 93 ##### [` ATTN `]() ATTN = 246 ##### [` B `]() B = 66 ##### [` BACK `]() BACK = 8 ##### [` BROWSER_BACK `]() BROWSER\_BACK = 166 ##### [` BROWSER_FAVORITES `]() BROWSER\_FAVORITES = 171 ##### [` BROWSER_FORWARD `]() BROWSER\_FORWARD = 167 ##### [` BROWSER_HOME `]() BROWSER\_HOME = 172 ##### [` BROWSER_REFRESH `]() BROWSER\_REFRESH = 168 ##### [` BROWSER_SEARCH `]() BROWSER\_SEARCH = 170 ##### [` BROWSER_STOP `]() BROWSER\_STOP = 169 ##### [` C `]() C = 67 ##### [` CANCEL `]() CANCEL = 3 ##### [` CAPITAL `]() CAPITAL = 20 ##### [` CLEAR `]() CLEAR = 12 ##### [` CONTROL `]() CONTROL = 17 ##### [` CONVERT `]() CONVERT = 28 ##### [` CRSEL `]() CRSEL = 247 ##### [` D `]() D = 68 ##### [` DECIMAL `]() DECIMAL = 110 ##### [` DELETE_K `]() DELETE\_K = 46 ##### [` DIVIDE `]() DIVIDE = 111 ##### [` DOWN `]() DOWN = 40 ##### [` E `]() E = 69 ##### [` END `]() END = 35 ##### [` EREOF `]() EREOF = 249 ##### [` ESCAPE `]() ESCAPE = 27 ##### [` EXECUTE `]() EXECUTE = 43 ##### [` EXSEL `]() EXSEL = 248 ##### [` F `]() F = 70 ##### [` F1 `]() F1 = 112 ##### [` F10 `]() F10 = 121 ##### [` F11 `]() F11 = 122 ##### [` F12 `]() F12 = 123 ##### [` F13 `]() F13 = 124 ##### [` F14 `]() F14 = 125 ##### [` F15 `]() F15 = 126 ##### [` F16 `]() F16 = 127 ##### [` F17 `]() F17 = 128 ##### [` F18 `]() F18 = 129 ##### [` F19 `]() F19 = 130 ##### [` F2 `]() F2 = 113 ##### [` F20 `]() F20 = 131 ##### [` F21 `]() F21 = 132 ##### [` F22 `]() F22 = 133 ##### [` F23 `]() F23 = 134 ##### [` F24 `]() F24 = 135 ##### [` F3 `]() F3 = 114 ##### [` F4 `]() F4 = 115 ##### [` F5 `]() F5 = 116 ##### [` F6 `]() F6 = 117 ##### [` F7 `]() F7 = 118 ##### [` F8 `]() F8 = 119 ##### [` F9 `]() F9 = 120 ##### [` FINAL `]() FINAL = 24 ##### [` G `]() G = 71 ##### [` H `]() H = 72 ##### [` HELP `]() HELP = 47 ##### [` HOME `]() HOME = 36 ##### [` I `]() I = 73 ##### [` IME_OFF `]() IME\_OFF = 26 ##### [` IME_ON `]() IME\_ON = 22 ##### [` INSERT `]() INSERT = 45 ##### [` J `]() J = 74 ##### [` JUNJA `]() JUNJA = 23 ##### [` K `]() K = 75 ##### [` KANA `]() KANA = 21 ##### [` KANJI `]() KANJI = 25 ##### [` L `]() L = 76 ##### [` LAUNCH_APP1 `]() LAUNCH\_APP1 = 182 ##### [` LAUNCH_APP2 `]() LAUNCH\_APP2 = 183 ##### [` LAUNCH_MAIL `]() LAUNCH\_MAIL = 180 ##### [` LAUNCH_MEDIA_SELECT `]() LAUNCH\_MEDIA\_SELECT = 181 ##### [` LBUTTON `]() LBUTTON = 1 ##### [` LCONTROL `]() LCONTROL = 162 ##### [` LEFT `]() LEFT = 37 ##### [` LMENU `]() LMENU = 164 ##### [` LSHIFT `]() LSHIFT = 160 ##### [` LWIN `]() LWIN = 91 ##### [` M `]() M = 77 ##### [` MBUTTON `]() MBUTTON = 4 ##### [` MEDIA_NEXT_TRACK `]() MEDIA\_NEXT\_TRACK = 176 ##### [` MEDIA_PLAY_PAUSE `]() MEDIA\_PLAY\_PAUSE = 179 ##### [` MEDIA_PREV_TRACK `]() MEDIA\_PREV\_TRACK = 177 ##### [` MEDIA_STOP `]() MEDIA\_STOP = 178 ##### [` MENU `]() MENU = 18 ##### [` MODECHANGE `]() MODECHANGE = 31 ##### [` MULTIPLY `]() MULTIPLY = 106 ##### [` N `]() N = 78 ##### [` NEXT `]() NEXT = 34 ##### [` NONAME `]() NONAME = 252 ##### [` NONCONVERT `]() NONCONVERT = 29 ##### [` NUMLOCK `]() NUMLOCK = 144 ##### [` NUMPAD0 `]() NUMPAD0 = 96 ##### [` NUMPAD1 `]() NUMPAD1 = 97 ##### [` NUMPAD2 `]() NUMPAD2 = 98 ##### [` NUMPAD3 `]() NUMPAD3 = 99 ##### [` NUMPAD4 `]() NUMPAD4 = 100 ##### [` NUMPAD5 `]() NUMPAD5 = 101 ##### [` NUMPAD6 `]() NUMPAD6 = 102 ##### [` NUMPAD7 `]() NUMPAD7 = 103 ##### [` NUMPAD8 `]() NUMPAD8 = 104 ##### [` NUMPAD9 `]() NUMPAD9 = 105 ##### [` NUM_0 `]() NUM\_0 = 48 ##### [` NUM_1 `]() NUM\_1 = 49 ##### [` NUM_2 `]() NUM\_2 = 50 ##### [` NUM_3 `]() NUM\_3 = 51 ##### [` NUM_4 `]() NUM\_4 = 52 ##### [` NUM_5 `]() NUM\_5 = 53 ##### [` NUM_6 `]() NUM\_6 = 54 ##### [` NUM_7 `]() NUM\_7 = 55 ##### [` NUM_8 `]() NUM\_8 = 56 ##### [` NUM_9 `]() NUM\_9 = 57 ##### [` O `]() O = 79 ##### [` OEM_1 `]() OEM\_1 = 186 ##### [` OEM_102 `]() OEM\_102 = 226 ##### [` OEM_2 `]() OEM\_2 = 191 ##### [` OEM_4 `]() OEM\_4 = 219 ##### [` OEM_5 `]() OEM\_5 = 220 ##### [` OEM_6 `]() OEM\_6 = 221 ##### [` OEM_7 `]() OEM\_7 = 222 ##### [` OEM_8 `]() OEM\_8 = 223 ##### [` OEM_CLEAR `]() OEM\_CLEAR = 254 ##### [` OEM_COMMA `]() OEM\_COMMA = 188 ##### [` OEM_MINUS `]() OEM\_MINUS = 189 ##### [` OEM_PERIOD `]() OEM\_PERIOD = 190 ##### [` OEM_PLUS `]() OEM\_PLUS = 187 ##### [` P `]() P = 80 ##### [` PA1 `]() PA1 = 253 ##### [` PACKET `]() PACKET = 231 ##### [` PAUSE `]() PAUSE = 19 ##### [` PLAY `]() PLAY = 250 ##### [` PRINT `]() PRINT = 42 ##### [` PRIOR `]() PRIOR = 33 ##### [` PROCESSKEY `]() PROCESSKEY = 229 ##### [` Q `]() Q = 81 ##### [` R `]() R = 82 ##### [` RBUTTON `]() RBUTTON = 2 ##### [` RCONTROL `]() RCONTROL = 163 ##### [` RETURN `]() RETURN = 13 ##### [` RIGHT `]() RIGHT = 39 ##### [` RMENU `]() RMENU = 165 ##### [` RSHIFT `]() RSHIFT = 161 ##### [` RWIN `]() RWIN = 92 ##### [` S `]() S = 83 ##### [` SCROLL `]() SCROLL = 145 ##### [` SELECT `]() SELECT = 41 ##### [` SEPARATOR `]() SEPARATOR = 108 ##### [` SHIFT `]() SHIFT = 16 ##### [` SLEEP `]() SLEEP = 95 ##### [` SNAPSHOT `]() SNAPSHOT = 44 ##### [` SPACE `]() SPACE = 32 ##### [` SUBTRACT `]() SUBTRACT = 109 ##### [` T `]() T = 84 ##### [` TAB `]() TAB = 9 ##### [` U `]() U = 85 ##### [` UP `]() UP = 38 ##### [` V `]() V = 86 ##### [` VOLUME_DOWN `]() VOLUME\_DOWN = 174 ##### [` VOLUME_MUTE `]() VOLUME\_MUTE = 173 ##### [` VOLUME_UP `]() VOLUME\_UP = 175 ##### [` W `]() W = 87 ##### [` X `]() X = 88 ##### [` XBUTTON1_K `]() XBUTTON1\_K = 5 ##### [` XBUTTON2_K `]() XBUTTON2\_K = 6 ##### [` Y `]() Y = 89 ##### [` Z `]() Z = 90 ##### [` ZOOM `]() ZOOM = 251 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.ACCELERATOR\_CODES]( "lief.PE.ACCELERATOR_CODES") = <nanobind.nb\_func object> --- ### [ALGORITHMS]() #### [` lief.PE.ALGORITHMS `]() class lief.PE.ALGORITHMS(*\*values*) Bases: `Enum` ##### [` EC `]() EC = 9 ##### [` MD2 `]() MD2 = 7 ##### [` MD4 `]() MD4 = 6 ##### [` MD5 `]() MD5 = 5 ##### [` MD5_RSA `]() MD5\_RSA = 10 ##### [` RSA `]() RSA = 8 ##### [` SHA1_DSA `]() SHA1\_DSA = 11 ##### [` SHA1_ECDSA `]() SHA1\_ECDSA = 16 ##### [` SHA1_RSA `]() SHA1\_RSA = 12 ##### [` SHA_1 `]() SHA\_1 = 4 ##### [` SHA_256 `]() SHA\_256 = 3 ##### [` SHA_256_ECDSA `]() SHA\_256\_ECDSA = 17 ##### [` SHA_256_RSA `]() SHA\_256\_RSA = 13 ##### [` SHA_384 `]() SHA\_384 = 2 ##### [` SHA_384_ECDSA `]() SHA\_384\_ECDSA = 18 ##### [` SHA_384_RSA `]() SHA\_384\_RSA = 14 ##### [` SHA_512 `]() SHA\_512 = 1 ##### [` SHA_512_ECDSA `]() SHA\_512\_ECDSA = 19 ##### [` SHA_512_RSA `]() SHA\_512\_RSA = 15 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.ALGORITHMS]( "lief.PE.ALGORITHMS") = <nanobind.nb\_func object>