{"canonicalSite": "https://lief.re/doc/latest/", "corpusHash": "e32fd2a9fb9034dfa076b6fc0241d35ae16e44b2352a10e1722de88f9c30b960", "documentCount": 128, "documentationChannel": "latest", "documentationVersion": "2.0.0", "documents": [{"canonical": "https://lief.re/doc/latest/ai.html", "content": "Documentation for AI Every documentation page has a Markdown copy at the same path with .html replaced by .md . For example, runtime/intro.html has a runtime/intro.md copy. The HTML page advertises this copy with an alternate link in its head, following the llms.txt proposal . The Markdown contains the rendered documentation: code included from example files, every language tab, API signatures, tables, and notes. Links and image URLs are absolute, so content remains usable when read outside this website. Section and API headings link to their original HTML anchors for citation. Choose a resource These files are generated alongside each version of the documentation: Resource Use it to llms.txt Find the relevant guide or API page, with a description of each page index.json Search document titles, descriptions, and full text, then fetch a Markdown page index.chunks.json Retrieve individual sections or API symbols with their heading context and citation URLs llms-full.txt Download all Markdown pages, including API references, for local indexing objects.inv Look up documented symbols by name sitemap.xml Enumerate canonical HTML pages Start with llms.txt and fetch the pages relevant to the task. The full corpus includes large API references; it may exceed an assistant’s context window. The exported corpus covers the Sphinx documentation. The API guides also link to the separate Rust and Doxygen references. Match the documentation to the installation Markdown metadata and JSON records carry documentationVersion , documentationChannel , canonical , and markdownURL . The latest channel tracks development; stable tracks the latest release. Match API usage to the installed LIEF version, platform, architecture, and enabled features. Use the Installation and Integration guide to choose a build. Read What is LIEF Extended? for Extended features and Runtime for runtime availability. Basic runtime support is an independent build option. Memory-layout enumeration, assembly, and disassembly require Extended. Retrieve and update chunks Both JSON indexes declare a schemaVersion . Each chunk contains Markdown and plain text, its document title and description, a headingPath , and a url pointing to the canonical HTML section or API symbol. Chunk sizes follow the documentation structure; code blocks stay intact. documentID identifies a canonical page, including its version channel. chunkID identifies a section within that page. These IDs remain stable across builds when the page URL and section anchor stay the same. position , documentChunkCount , previousChunkID , and nextChunkID allow retrieval of surrounding context. Positions start at zero; neighbors are empty strings at document boundaries. Compare the index’s corpusHash to detect changes to content or metadata, then compare individual contentHash values to find changed Markdown bodies. Both use SHA-256. The chunk index describes the hash inputs and ordering. Build timestamps are excluded so unchanged content produces the same indexes.", "contentHash": "a1c14c0ee97acfbc9246df376f8f958edb2f9cb11def599651e0cc89f821436e", "description": "Read LIEF documentation as resolved Markdown or retrieve guides and API symbols from versioned JSON indexes with canonical links and content hashes.", "docname": "ai", "documentID": "41dfaff050b253cfc068916df602d7c202b24f5299d00597859cfe69e9ba8264", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/ai.md", "title": "Documentation for AI - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/api/binary_abstraction/cpp.html", "content": "C++ Parser Parser class Parser Main interface to parse an executable regardless of its format. Subclassed by LIEF::ELF::Parser , LIEF::MachO::BinaryParser , LIEF::MachO::Parser , LIEF::PE::Parser Public Static Functions parse static std::unique_ptr< Binary > parse(std::string_view filename) Construct an LIEF::Binary from the given filename. See also LIEF::MachO::Parser::parse Warning If the target file is a FAT Mach-O, it will return the last one PathTparse template = 0> static inline std::unique_ptr< Binary > parse(const PathT &filename) Same as parse(std::string_view) but the file is given as a std::filesystem::path . parse static std::unique_ptr< Binary > parse(const std::vector &raw) Construct an LIEF::Binary from the given raw data. See also LIEF::MachO::Parser::parse Warning If the target file is a FAT Mach-O, it will return the last one parse static std::unique_ptr< Binary > parse(std::unique_ptr< BinaryStream > stream) Construct an LIEF::Binary from the given stream. See also LIEF::MachO::Parser::parse Warning If the target file is a FAT Mach-O, it will return the last one Header Header class Header : public LIEF::Object Public Types ARCHITECTURES enum class ARCHITECTURES Values: UNKNOWN enumerator UNKNOWN = 0 ARM enumerator ARM ARM64 enumerator ARM64 MIPS enumerator MIPS X86 enumerator X86 X86_64 enumerator X86_64 PPC enumerator PPC SPARC enumerator SPARC SYSZ enumerator SYSZ XCORE enumerator XCORE RISCV enumerator RISCV LOONGARCH enumerator LOONGARCH PPC64 enumerator PPC64 ENDIANNESS enum class ENDIANNESS Values: UNKNOWN enumerator UNKNOWN = 0 BIG enumerator BIG LITTLE enumerator LITTLE MODES enum MODES Values: NONE enumerator NONE = 0 BITS_16 enumerator BITS_16 = 1LLU << 0 BITS_32 enumerator BITS_32 = 1LLU << 1 16-bits architecture BITS_64 enumerator BITS_64 = 1LLU << 2 32-bits architecture THUMB enumerator THUMB = 1LLU << 3 64-bits architecture ARM64E enumerator ARM64E = 1LLU << 4 Support ARM Thumb mode. OBJECT_TYPES enum class OBJECT_TYPES Values: UNKNOWN enumerator UNKNOWN = 0 EXECUTABLE enumerator EXECUTABLE LIBRARY enumerator LIBRARY OBJECT enumerator OBJECT Public Functions Header Header() = default Header Header(const Header &) = default operator= Header &operator=(const Header &) = default ~Header ~Header() override = default architecture inline ARCHITECTURES architecture() const Target architecture. modes inline MODES modes() const Optional features for the given architecture. modes_list std::vector< MODES > modes_list() const MODES as a vector. is inline bool is( MODES m) const object_type inline OBJECT_TYPES object_type() const entrypoint inline uint64_t entrypoint() const endianness inline ENDIANNESS endianness() const is_32 inline bool is_32() const is_64 inline bool is_64() const accept virtual void accept(Visitor &visitor) const override Public Static Functions from static Header from(const LIEF::ELF:: Binary &elf) from static Header from(const LIEF::PE:: Binary &pe) from static Header from(const LIEF::MachO:: Binary &macho) Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Header &hdr) Binary Binary class Binary : public LIEF::Object Generic interface representing a binary executable. This class provides a unified interface across multiple binary formats such as ELF, PE, Mach-O, and others. It enables users to access binary components like headers, sections, symbols, relocations, and functions in a format-agnostic way. Subclasses like LIEF::PE::Binary implement format-specific API Subclassed by LIEF::ELF::Binary , LIEF::MachO::Binary , LIEF::PE::Binary Public Types VA_TYPES enum class VA_TYPES Enumeration of virtual address types used for patching and memory access. Values: AUTO enumerator AUTO = 0 Automatically determine if the address is absolute or relative (default behavior). RVA enumerator RVA = 1 Relative Virtual Address (RVA), offset from image base. VA enumerator VA = 2 Absolute Virtual Address. FORMATS enum FORMATS Values: UNKNOWN enumerator UNKNOWN = 0 ELF enumerator ELF PE enumerator PE MACHO enumerator MACHO OAT enumerator OAT functions_t using functions_t = std::vector< Function > sections_t using sections_t = std::vector< Section *> Internal container. it_sections using it_sections = ref_iterator < sections_t > Iterator that outputs LIEF::Section &. it_const_sections using it_const_sections = const_ref_iterator < sections_t > Iterator that outputs const LIEF::Section &. symbols_t using symbols_t = std::vector< Symbol *> Internal container. it_symbols using it_symbols = ref_iterator < symbols_t > Iterator that outputs LIEF::Symbol &. it_const_symbols using it_const_symbols = const_ref_iterator < symbols_t > Iterator that outputs const LIEF::Symbol &. relocations_t using relocations_t = std::vector< Relocation *> Internal container. it_relocations using it_relocations = ref_iterator < relocations_t > Iterator that outputs LIEF::Relocation &. it_const_relocations using it_const_relocations = const_ref_iterator < relocations_t > Iterator that outputs const LIEF::Relocation &. instructions_it using instructions_it = iterator_range Instruction iterator. Public Functions Binary Binary() Binary Binary( FORMATS fmt) ~Binary ~Binary() override operator= Binary &operator=(const Binary &) = delete Binary Binary(const Binary &) = delete format inline FORMATS format() const Executable format (ELF, PE, Mach-O) of the underlying binary. header inline Header header() const Return the abstract header of the binary. symbols inline it_symbols symbols() Return an iterator over the abstracted symbols in which the elements can be modified. symbols inline it_const_symbols symbols() const Return an iterator over the abstracted symbols in which the elements can’t be modified. has_symbol inline bool has_symbol(const std::string &name) const Check if a Symbol with the given name exists. get_symbol const Symbol *get_symbol(const std::string &name) const Return the Symbol with the given name If the symbol does not exist, return a nullptr. get_symbol inline Symbol *get_symbol(const std::string &name) sections inline it_sections sections() Return an iterator over the binary’s sections ( LIEF::Section ). sections inline it_const_sections sections() const remove_section virtual void remove_section(const std::string &name, bool clear = false) = 0 Remove all the sections in the underlying binary. relocations inline it_relocations relocations() Return an iterator over the binary relocations ( LIEF::Relocation ). relocations inline it_const_relocations relocations() const entrypoint virtual uint64_t entrypoint() const = 0 Binary ’s entrypoint (if any). original_size inline uint64_t original_size() const Binary ’s original size. exported_functions inline functions_t exported_functions() const Return the functions exported by the binary. imported_libraries inline std::vector imported_libraries() const Return libraries which are imported by the binary. imported_functions inline functions_t imported_functions() const Return functions imported by the binary. get_function_address virtual result get_function_address(const std::string &func_name) const Return the address of the given function name. accept virtual void accept(Visitor &visitor) const override Method so that a visitor can visit us. xref std::vector xref(uint64_t address) const patch_address virtual void patch_address(uint64_t address, const std::vector &patch_value, VA_TYPES addr_type = VA_TYPES :: AUTO ) = 0 Patch the content at virtual address address with patch_value . Parameters: address – [in] Address to patch patch_value – [in] Patch to apply addr_type – [in] Specify if the address should be used as an absolute virtual address or a RVA patch_address virtual void patch_address(uint64_t address, uint64_t patch_value, size_t size = sizeof(uint64_t), VA_TYPES addr_type = VA_TYPES :: AUTO ) = 0 Patch the address with the given value. Parameters: address – [in] Address to patch patch_value – [in] Patch to apply size – [in] Size of the value in bytes (1, 2, … 8) addr_type – [in] Specify if the address should be used as an absolute virtual address or an RVA get_content_from_virtual_address virtual span get_content_from_virtual_address(uint64_t virtual_address, uint64_t size, VA_TYPES addr_type = VA_TYPES :: AUTO ) const = 0 Return the content located at the given virtual address. Tget_int_from_virtual_address template inline LIEF:: result < T > get_int_from_virtual_address(uint64_t va, VA_TYPES addr_type = VA_TYPES :: AUTO ) const Get the integer value at the given virtual address. original_size inline void original_size(uint64_t size) Change binary’s original size. Warning This function should be used carefully as some optimizations can be performed with this value is_pie virtual bool is_pie() const = 0 Check if the binary is position independent. has_nx virtual bool has_nx() const = 0 Check if the binary uses NX protection. imagebase virtual uint64_t imagebase() const = 0 Default image base address if the ASLR is not enabled. ctor_functions virtual functions_t ctor_functions() const = 0 Constructor functions that are called prior any other functions. offset_to_virtual_address virtual result offset_to_virtual_address(uint64_t offset, uint64_t slide = 0) const = 0 Convert the given offset into a virtual address. Parameters: offset – [in] The offset to convert. slide – [in] If not 0, it will replace the default base address (if any) print inline virtual std::ostream &print(std::ostream &os) const debug_info DebugInfo *debug_info() const Return the debug info if present. It can be either a LIEF::dwarf::DebugInfo or a LIEF::pdb::DebugInfo . For ELF and Mach-O binaries, it returns the given DebugInfo object only if the binary embeds the DWARF debug info in the binary itself. For PE file, this function tries to find the external PDB using the LIEF::PE::CodeViewPDB::filename() output (if present). One can also use LIEF::pdb::load() or LIEF::pdb::DebugInfo::from_file() to get PDB debug info. Warning This function requires LIEF’s extended version otherwise it always returns a nullptr disassemble instructions_it disassemble(uint64_t address, size_t size) const Disassemble code starting at the given virtual address and with the given size. auto insts = binary->disassemble(0xacde, 100); for (std::unique_ptr inst : insts) { std::cout << inst->to_string() << '\\n'; } See also LIEF::assembly::Instruction disassemble instructions_it disassemble(uint64_t address) const Disassemble code starting at the given virtual address. auto insts = binary->disassemble(0xacde); for (std::unique_ptr inst : insts) { std::cout << inst->to_string() << '\\n'; } See also LIEF::assembly::Instruction disassemble instructions_it disassemble(const std::string &function) const Disassemble code for the given symbol name. auto insts = binary->disassemble(\"__libc_start_main\"); for (std::unique_ptr inst : insts) { std::cout << inst->to_string() << '\\n'; } See also LIEF::assembly::Instruction disassemble instructions_it disassemble(const uint8_t *buffer, size_t size, uint64_t address = 0) const Disassemble code provided by the given buffer at the specified address parameter. See also LIEF::assembly::Instruction disassemble inline instructions_it disassemble(const std::vector &buffer, uint64_t address = 0) const Disassemble code provided by the given vector of bytes at the specified address parameter. See also LIEF::assembly::Instruction disassemble inline instructions_it disassemble(LIEF::span buffer, uint64_t address = 0) const disassemble inline instructions_it disassemble(LIEF::span buffer, uint64_t address = 0) const assemble std::vector assemble(uint64_t address, const std::string &Asm, assembly:: AssemblerConfig &config = assembly:: AssemblerConfig :: default_config ()) Assemble and patch the provided assembly code at the specified address. The function returns the generated assembly bytes bin->assemble(0x12000440, R\"asm( xor rax, rbx; mov rcx, rax; )asm\"); If you need to configure the assembly engine or to define addresses for symbols, you can provide your own assembly::AssemblerConfig . assemble std::vector assemble(uint64_t address, const llvm::MCInst &inst) Assemble and patch the address with the given LLVM MCInst. Warning Because of ABI compatibility, this MCInst can only be used with the same version of LLVM used by LIEF (see documentation) assemble std::vector assemble(uint64_t address, const std::vector &insts) Assemble and patch the address with the given LLVM MCInst. Warning Because of ABI compatibility, this MCInst can only be used with the same version of LLVM used by LIEF (see documentation) page_size virtual uint64_t page_size() const Get the default memory page size according to the architecture and the format of the current binary. load_debug_info DebugInfo *load_debug_info(const std::string &path) Load and associate an external debug file (e.g., DWARF or PDB) with this binary. This method attempts to load the debug information from the file located at the given path, and binds it to the current binary instance. If successful, it returns a pointer to the loaded DebugInfo object. Note This function does not verify that the debug file matches the binary’s unique identifier (e.g., build ID, GUID). Warning It is the caller’s responsibility to ensure that the debug file is compatible with the binary. Incorrect associations may lead to inconsistent or invalid results. Parameters: path – Path to the external debug file (e.g., .dwarf , .pdb ) Returns: Pointer to the loaded DebugInfo object on success, or nullptr on failure. virtual_size inline virtual uint64_t virtual_size() const Size of the binary when mapped in memory. Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Binary &binary) Section Section class Section : public LIEF::Object Class which represents an abstracted section. Subclassed by LIEF::COFF::Section , LIEF::ELF::Section , LIEF::MachO::Section , LIEF::PE::Section Public Functions Section Section() = default Section inline Section(std::string name) ~Section ~Section() override = default operator= Section &operator=(const Section &) = default Section Section(const Section &) = default name inline virtual std::string_view name() const Section ’s name. fullname inline virtual std::string_view fullname() const Return the complete section’s name which might include trailing ( 0 ) bytes. content inline virtual span content() const Section ’s content. size inline virtual void size(uint64_t size) Change the section size. size inline virtual uint64_t size() const Section ’s size (size in the binary, not the virtual size). offset inline virtual uint64_t offset() const Offset in the binary. virtual_address inline virtual uint64_t virtual_address() const Address where the section should be mapped. virtual_address inline virtual void virtual_address(uint64_t virtual_address) name inline virtual void name(std::string name) Change the section’s name. content inline virtual void content(const std::vector&) Change section content. offset inline virtual void offset(uint64_t offset) entropy double entropy() const Section ’s entropy. search size_t search(uint64_t integer, size_t pos, size_t size) const search size_t search(const std::vector &pattern, size_t pos = 0) const search size_t search(const std::string &pattern, size_t pos = 0) const search size_t search(uint64_t integer, size_t pos = 0) const search_all std::vector search_all(uint64_t v, size_t size) const search_all std::vector search_all(uint64_t v) const search_all std::vector search_all(const std::string &v) const accept virtual void accept(Visitor &visitor) const override Method so that the visitor can visit us. Public Static Attributes npos static size_t npos = -1 Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Section &entry) Symbol Symbol class Symbol : public LIEF::Object This class represents a symbol in an executable format. Subclassed by LIEF::COFF::Symbol , LIEF::ELF::Symbol , LIEF::Function , LIEF::MachO::Symbol , LIEF::PE::DelayImportEntry , LIEF::PE::ExportEntry , LIEF::PE::ImportEntry Public Functions Symbol Symbol() = default Symbol inline Symbol(std::string name) Symbol inline Symbol(std::string name, uint64_t value) Symbol inline Symbol(std::string name, uint64_t value, uint64_t size) Symbol Symbol(const Symbol &) = default operator= Symbol &operator=(const Symbol &) = default Symbol Symbol( Symbol &&) = default operator= Symbol &operator=( Symbol &&) = default ~Symbol ~Symbol() override = default swap void swap( Symbol &other) noexcept name inline virtual std::string_view name() const Return the symbol’s name. name inline virtual std::string &name() name inline virtual void name(std::string name) Set symbol name. value inline virtual uint64_t value() const Symbol ’s value which is usually the address of the symbol. value inline virtual void value(uint64_t value) size inline virtual uint64_t size() const The size of the symbol (when applicable). size inline virtual void size(uint64_t value) accept virtual void accept(Visitor &visitor) const override Method so that the visitor can visit us. Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Symbol &entry) Relocation Relocation class Relocation : public LIEF::Object Class which represents an abstracted Relocation . Subclassed by LIEF::COFF::Relocation , LIEF::ELF::Relocation , LIEF::MachO::Relocation , LIEF::PE::RelocationEntry Public Functions Relocation Relocation() = default Relocation inline Relocation(uint64_t address, uint8_t size) Constructor from a relocation’s address and size. ~Relocation ~Relocation() override = default operator= Relocation &operator=(const Relocation &) = default Relocation Relocation(const Relocation &) = default swap inline void swap( Relocation &other) address inline virtual uint64_t address() const Relocation ’s address. size inline virtual size_t size() const Relocation size in bits . address inline virtual void address(uint64_t address) size inline virtual void size(size_t size) accept virtual void accept(Visitor &visitor) const override Method so that the visitor can visit us. operator< inline virtual bool operator<(const Relocation &rhs) const Comparison based on the Relocation ’s address . operator<= inline virtual bool operator<=(const Relocation &rhs) const Comparison based on the Relocation ’s address . operator> inline virtual bool operator>(const Relocation &rhs) const Comparison based on the Relocation ’s address . operator>= inline virtual bool operator>=(const Relocation &rhs) const Comparison based on the Relocation ’s address . Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Relocation &entry) Function Function class Function : public LIEF:: Symbol Class that represents a function in the binary. Public Types FLAGS enum class FLAGS : uint32_t Flags used to characterize the semantics of the function. Values: NONE enumerator NONE = 0 CONSTRUCTOR enumerator CONSTRUCTOR = 1 << 0 The function acts as a constructor. Usually this flag is associated with functions that are located in the .init_array , __mod_init_func or .tls sections DESTRUCTOR enumerator DESTRUCTOR = 1 << 1 The function acts as a destructor. Usually this flag is associated with functions that are located in the .fini_array or __mod_term_func sections DEBUG_INFO enumerator DEBUG_INFO = 1 << 2 The function is associated with Debug information. EXPORTED enumerator EXPORTED = 1 << 3 The function is exported by the binary and the address() method returns its virtual address in the binary. IMPORTED enumerator IMPORTED = 1 << 4 The function is imported by the binary and the address() should return 0. Public Functions Function Function() = default Function inline Function(const std::string &name) Function inline Function(uint64_t address) Function inline Function(const std::string &name, uint64_t address) Function inline Function(const std::string &name, uint64_t address, FLAGS flags) Function Function(const Function &) = default operator= Function &operator=(const Function &) = default ~Function ~Function() override = default flags_list std::vector< FLAGS > flags_list() const List of FLAGS . flags inline FLAGS flags() const add inline Function &add( FLAGS f) Add a flag to the current function. has inline bool has( FLAGS f) const Check if the function has the given flag. address inline uint64_t address() const Address of the current function. For functions that are set with the FLAGS::IMPORTED flag, this value is likely 0. address inline void address(uint64_t address) accept virtual void accept(Visitor &visitor) const override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Function &entry)", "contentHash": "878139aff75e096fc2a6d7b7e1464741fe07d20375526e95ea06a2fc6cd41dc9", "description": "Binary Abstraction C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "api/binary_abstraction/cpp", "documentID": "33678d82524e3a7e956d6497286b9c4f7228723cbf832139d7e479105006cda3", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/api/binary_abstraction/cpp.md", "title": "Binary Abstraction C++ API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/api/binary_abstraction/index.html", "content": "Binary Abstraction API C++ Python Rust Introduction ELF , PE , Mach-O binaries share similar characteristics, such as an entry point, imported/exported functions, etc. These shared characteristics are represented in an abstract layer, which is defined by an inheritance relationship in C++/Python and by a trait in Rust. Specifically, lief.ELF.Binary ( lief::elf::Binary ; lief.ELF.Binary ; LIEF::ELF::Binary ), lief.PE.Binary ( lief::pe::Binary ; lief.PE.Binary ; LIEF::PE::Binary ), and lief.MachO.Binary ( lief::macho::Binary ; lief.MachO.Binary ; LIEF::MachO::Binary ) either inherit or implement the trait: lief.abstract.Binary ( lief::generic::Binary ; lief.Binary ; LIEF::Binary ). In Python/C++, one can access an abstract binary object by using the generic lief.abstract.parse ( lief.parse() ; LIEF::Parser::parse() ) function: Python target = lief.parse(\"/tmp/some.elf\") target = lief.parse(\"/Users/demo/some.macho\") target = lief.parse(r\"C:\\some.pe.exe\") C++ std::unique_ptr target = LIEF::Parser::parse(\"some.elf\"); target = LIEF::Parser::parse(\"some.macho\"); target = LIEF::Parser::parse(\"some.exe\"); Due to Python’s dynamic polymorphism, the return value of lief.parse() is automatically cast into either: lief.ELF.Binary , lief.PE.Binary , or lief.MachO.Binary . To upcast this object into a lief.Binary object, one can use the lief.Binary.abstract attribute, which returns a lief.Binary instance: target = lief.parse(\"some.elf\") assert type(target) is lief.ELF.Binary abstract = target.abstract assert type(abstract) is lief.Binary In C++, a LIEF::Binary instance can be downcast to its underlying type using the classof idiom: std::unique_ptr target = LIEF::Parser::parse(\"some.elf\"); if (LIEF::ELF::Binary::classof(target.get())) { auto& elf = static_cast(*target); } See also LIEF::ELF::Binary::classof() LIEF::PE::Binary::classof() LIEF::MachO::Binary::classof()", "contentHash": "d447feee82bd78a238a2aecb490e9440b5c0d7971efee5e2ee18f039b3ab96c9", "description": "Binary Abstraction. ELF, PE, Mach-O binaries share similar characteristics, such as an entry point, imported/exported functions, etc.", "docname": "api/binary_abstraction/index", "documentID": "eaec95ccf9c76f730f93fe5ccf7b39f3dfcf28d2c79721cd6a73a2f4d6450915", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/api/binary_abstraction/index.md", "title": "Binary Abstraction - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/api/binary_abstraction/python.html", "content": "Python Parser lief.parse lief.parse( obj: str | io.IOBase | os.PathLike | bytes | list[int] ) → PE.Binary | OAT.Binary | ELF.Binary | MachO.Binary | COFF.Binary | None Parse a binary supported by LIEF (ELF, PE, Mach-O, …) from the given Python object and return the corresponding Binary object. Binary lief.Binary class lief.Binary Bases: Object Generic interface representing a binary executable. This class provides a unified interface across multiple binary formats such as ELF, PE, Mach-O, and others. It enables users to access binary components like headers, sections, symbols, relocations, and functions in a format-agnostic way. Subclasses (like lief.PE.Binary ) implement format-specific API FORMATS class FORMATS( *values ) Bases: Enum ELF ELF = 1 MACHO MACHO = 3 OAT OAT = 4 PE PE = 2 UNKNOWN UNKNOWN = 0 VA_TYPES class VA_TYPES( *values ) Bases: Enum Enumeration of virtual address types used for patching and memory access. AUTO AUTO = 0 RVA RVA = 1 VA VA = 2 abstract property abstract → lief.Binary Return the abstract representation of the current binary ( lief.Binary ) assemble assemble( self , address: int , assembly: str , config: lief._lief.assembly.AssemblerConfig = ) → bytes Assemble and patch the provided assembly code at the specified address. The function returns the generated assembly bytes. Example: bin.assemble(0x12000440, \"\"\" xor rax, rbx; mov rcx, rax; \"\"\") If you need to configure the assembly engine or to define addresses for symbols, you can provide your own AssemblerConfig instance. concrete property concrete → lief.ELF.Binary | lief.PE.Binary | lief.MachO.Binary The concrete representation of the binary. Basically, this property casts a lief.Binary into a lief.PE.Binary , lief.ELF.Binary or lief.MachO.Binary . See also: lief.Binary.abstract ctor_functions property ctor_functions → list[ lief.Function ] Constructor functions that are called prior to any other functions debug_info property debug_info → lief.DebugInfo | None Return debug info if present. It can be either a lief.dwarf.DebugInfo or a lief.pdb.DebugInfo For ELF and Mach-O binaries, it returns the given DebugInfo object only if the binary embeds the DWARF debug info in the binary itself. For PE file, this function tries to find the external PDB using the lief.PE.CodeViewPDB.filename output (if present). One can also use lief.pdb.load() to manually load a PDB. Warning This function requires LIEF’s extended version otherwise it always returns None disassembledisassembledisassemble disassemble( self , address: int ) → Iterator[ lief._lief.assembly.Instruction | None] **disassemble( self , address: int , size: int ) → Iterator[ lief._lief.assembly.Instruction | None] disassemble( self , function_name: str ) → Iterator[ lief._lief.assembly.Instruction | None] ** Overloaded function. disassemble(self, address: int) -> Iterator[Optional[lief._lief.assembly.Instruction]] Disassemble code starting at the given virtual address. insts = binary.disassemble(0xacde, 100); for inst in insts: print(inst) See also lief.assembly.Instruction disassemble(self, address: int, size: int) -> Iterator[Optional[lief._lief.assembly.Instruction]] Disassemble code starting at the given virtual address and with the given size. insts = binary.disassemble(0xacde, 100); for inst in insts: print(inst) See also lief.assembly.Instruction disassemble(self, function_name: str) -> Iterator[Optional[lief._lief.assembly.Instruction]] Disassemble code for the given symbol name insts = binary.disassemble(\"__libc_start_main\"); for inst in insts: print(inst) See also lief.assembly.Instruction disassemble_from_bytes disassemble_from_bytes( self , buffer: bytes , address: int = 0 ) → Iterator[ lief._lief.assembly.Instruction | None] Disassemble code from the provided bytes raw = bytes(binary.get_section(\".text\").content) insts = binary.disassemble_from_bytes(raw); for inst in insts: print(inst) See also lief.assembly.Instruction entrypoint property entrypoint → int Binary’s entrypoint exported_functions property exported_functions → list[ lief.Function ] Return the binary’s exported Function format property format → lief.Binary.FORMATS File format ( FORMATS ) of the underlying binary. get_content_from_virtual_address get_content_from_virtual_address( self , virtual_address: int , size: int , va_type: lief._lief.Binary.VA_TYPES = VA_TYPES.AUTO ) → memoryview Return the content located at the provided virtual address. The virtual address is specified in the first argument and size to read (in bytes) in the second. If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA . By default, it is set to AUTO . get_function_address get_function_address( self , function_name: str ) → int | lief._lief.lief_errors Return the address of the given function name get_int_from_virtual_address get_int_from_virtual_address( self , address: int , interger_size: int , type: lief._lief.Binary.VA_TYPES = VA_TYPES.AUTO ) → int | None Get an integer representation of the data at the given address get_symbol get_symbol( self , symbol_name: str ) → lief._lief.Symbol | None Return the Symbol from the given name . If the symbol can’t be found, it returns None. has_nx property has_nx → bool Check if the binary has NX protection (non executable stack) has_symbol has_symbol( self , symbol_name: str ) → bool Check if a Symbol with the given name exists header property header → lief.Header Binary’s abstract header ( Header ) imagebase property imagebase → int Default image base (i.e. if the ASLR is not enabled) imported_functions property imported_functions → list[ lief.Function ] Return the binary’s imported Function (name) is_pie property is_pie → bool Check if the binary is position independent libraries property libraries → list[str | bytes] Return binary’s imported libraries (name) load_debug_info load_debug_info( self , path: str | os.PathLike ) → lief._lief.DebugInfo | None Load and associate an external debug file (e.g., DWARF or PDB) with this binary. This method attempts to load the debug information from the file located at the given path, and binds it to the current binary instance. If successful, it returns the loaded DebugInfo object. Warning It is the caller’s responsibility to ensure that the debug file is compatible with the binary. Incorrect associations may lead to inconsistent or invalid results. Note This function does not verify that the debug file matches the binary’s unique identifier (e.g., build ID, GUID). offset_to_virtual_address offset_to_virtual_address( self , offset: int , slide: int = 0 ) → int | lief._lief.lief_errors Convert an offset into a virtual address. original_size property original_size → int Original size of the binary page_size property page_size → int Get the default memory page size according to the architecture and the format of the current binary patch_addresspatch_address patch_address( self , address: int , patch_value: collections.abc.Sequence[int] , va_type: lief._lief.Binary.VA_TYPES = VA_TYPES.AUTO ) → None patch_address( self , address: int , patch_value: int , size: int = 8 , va_type: lief._lief.Binary.VA_TYPES = VA_TYPES.AUTO ) → None Overloaded function. patch_address(self, address: int, patch_value: collections.abc.Sequence[int], va_type: lief._lief.Binary.VA_TYPES = VA_TYPES.AUTO) -> None Patch the address with the given list of bytes. The virtual address is specified in the first argument and the content in the second (as a list of bytes). If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA . By default, it is set to AUTO . patch_address(self, address: int, patch_value: int, size: int = 8, va_type: lief._lief.Binary.VA_TYPES = VA_TYPES.AUTO) -> None Patch the address with the given integer value. The virtual address is specified in the first argument, the integer in the second and the integer’s size in the third one. If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA . By default, it is set to AUTO . relocations property relocations → lief.Binary.it_relocations Return an iterator over abstract Relocation remove_section remove_section( self , name: str , clear: bool = False ) → None Remove the section with the given name sections property sections → lief.Binary.it_sections Return an iterator over the binary’s abstract sections ( Section ) symbols property symbols → lief.Binary.it_symbols Return an iterator over the binary’s abstract Symbol virtual_size property virtual_size → int xref xref( self , virtual_address: int ) → list[int] Return all virtual addresses that use the address given in parameter Header lief.Header class lief.Header Bases: Object Class which represents an abstracted Header ARCHITECTURES class ARCHITECTURES( *values ) Bases: Enum ARM ARM = 1 ARM64 ARM64 = 2 LOONGARCH LOONGARCH = 11 MIPS MIPS = 3 PPC PPC = 6 PPC64 PPC64 = 12 RISCV RISCV = 10 SPARC SPARC = 7 SYSZ SYSZ = 8 UNKNOWN UNKNOWN = 0 X86 X86 = 4 X86_64 X86_64 = 5 XCORE XCORE = 9 from_value from_value( arg: int ) → lief.Header.ARCHITECTURES = ENDIANNESS class ENDIANNESS( *values ) Bases: Enum BIG BIG = 1 LITTLE LITTLE = 2 UNKNOWN UNKNOWN = 0 from_value from_value( arg: int ) → lief.Header.ENDIANNESS = MODES class MODES( *values ) Bases: Enum ARM64E ARM64E = 16 BITS_16 BITS_16 = 1 BITS_32 BITS_32 = 2 BITS_64 BITS_64 = 4 NONE NONE = 0 THUMB THUMB = 8 from_value from_value( arg: int ) → lief.Header.MODES = OBJECT_TYPES class OBJECT_TYPES( *values ) Bases: Enum EXECUTABLE EXECUTABLE = 1 LIBRARY LIBRARY = 2 OBJECT OBJECT = 3 UNKNOWN UNKNOWN = 0 from_value from_value( arg: int ) → lief.Header.OBJECT_TYPES = architecture property architecture → lief.Header.ARCHITECTURES Target architecture endianness property endianness → lief.Header.ENDIANNESS Binary endianness entrypoint property entrypoint → int Binary entrypoint is_32 property is_32 → bool True if the binary targets a 32-bits architecture is_64 property is_64 → bool True if the binary targets a 64-bits architecture modes property modes → lief.Header.MODES Architecture details modes_list property modes_list → list[ lief.Header.MODES ] Modes as a list object_type property object_type → lief.Header.OBJECT_TYPES Type of the binary (executable, library…) Section lief.Section class lief.Section Bases: Object Class which represents an abstracted section content property content → memoryview Section’s content entropy property entropy → float Section’s entropy fullname property fullname → bytes Return the fullname of the section including the trailing bytes name property name → str | bytes Section’s name offset property offset → int Section’s file offset searchsearchsearch search( self , number: int , pos: int = 0 , size: int = 0 ) → int | None **search( self , str: str , pos: int = 0 ) → int | None search( self , bytes: bytes , pos: int = 0 ) → int | None ** Overloaded function. search(self, number: int, pos: int = 0, size: int = 0) -> Optional[int] Look for integer within the current section search(self, str: str, pos: int = 0) -> Optional[int] Look for string within the current section search(self, bytes: bytes, pos: int = 0) -> Optional[int] Look for the given bytes within the current section search_allsearch_all search_all( self , number: int , size: int = 0 ) → list[int] search_all( self , str: str ) → list[int] Overloaded function. search_all(self, number: int, size: int = 0) -> list[int] Look for all integers within the current section search_all(self, str: str) -> list[int] Look for all strings within the current section size property size → int Section’s size virtual_address property virtual_address → int Section’s virtual address Symbol lief.Symbol class lief.Symbol Bases: Object This class represents a symbol in an executable format. name property name → str | bytes Symbol’s name size property size → int Symbol’s size value property value → int Symbol’s value Relocation lief.Relocation class lief.Relocation Bases: Object Class which represents an abstracted Relocation address property address → int Relocation’s address size property size → int Relocation’s size (in bits ) Function lief.Functionlief.Functionlief.Functionlief.Function class lief.Function( self ) **class lief.Function( self , arg: str , / ) **class lief.Function( self , arg: int , / ) class lief.Function( self , arg0: str , arg1: int , / ) **** Bases: Symbol Class which represents a Function in an executable file format. FLAGS class FLAGS( *values ) Bases: Flag CONSTRUCTOR CONSTRUCTOR = 1 DEBUG_INFO DEBUG_INFO = 4 DESTRUCTOR DESTRUCTOR = 2 EXPORTED EXPORTED = 8 IMPORTED IMPORTED = 16 NONE NONE = 0 from_value from_value( arg: int ) → lief.Function.FLAGS = add add( self , flag: lief._lief.Function.FLAGS ) → lief._lief.Function Add the given FLAGS address property address → int Function’s address flags property flags → lief.Function.FLAGS Function flags flags_list property flags_list → list[ lief.Function.FLAGS ] Function flags as a list of FLAGS has has( self , flag: lief._lief.Function.FLAGS ) → bool Check if the function has the given flag", "contentHash": "62aec87edd78b6b4afd2b431c2c058b46a00fc2a89bc37f6991bba1fa6233aa2", "description": "Binary Abstraction Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "api/binary_abstraction/python", "documentID": "1c128f7d90e890100e819351b175f8106c10f998539753b85aedc52368f0490d", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/api/binary_abstraction/python.md", "title": "Binary Abstraction Python API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/api/binary_abstraction/rust.html", "content": "Rust Note Please check the module lief::generic which contains all the abstracted traits", "contentHash": "4a24d46b3ea2abcdb516547a66d5c8d681fe156c49877c0e6e2a4866943deb53", "description": "Binary Abstraction Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "api/binary_abstraction/rust", "documentID": "1ec5e14ecbc5d658a34a1398fdfd4f4172d9eafdab81400d267f8caf77f27e62", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/api/binary_abstraction/rust.md", "title": "Binary Abstraction Rust API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/api/cpp/index.html", "content": "C++ Note You can also find the Doxygen documentation here Iterators TUITERATOR_Tref_iterator template::value_type, class ITERATOR_T = typename decay_t< T >::iterator> class ref_iterator Iterator which returns reference on container’s values. Public Types iterator_category using iterator_category = std::bidirectional_iterator_tag value_type using value_type = decay_t< U > difference_type using difference_type = ptrdiff_t pointer using pointer = std::remove_pointer_t< U >* reference using reference = std::remove_pointer_t< U >& container_type using container_type = T DT_VAL using DT_VAL = U DT using DT = decay_t< T > ref_t using ref_t = typename ref_iterator :: reference pointer_t using pointer_t = typename ref_iterator :: pointer Public Functions ref_iterator inline ref_iterator( ref_iterator &&other) noexcept operator= inline ref_iterator &operator=( ref_iterator &&other) noexcept T2U2IT2ref_iterator template> && std::is_same_v, decay_t< T2 >>>> inline ref_iterator(const ref_iterator < T2 , U2 , IT2 > &other) T2U2IT2ref_iterator template> && std::is_same_v, decay_t< T2 >>>> inline ref_iterator( ref_iterator < T2 , U2 , IT2 > &&other) noexcept ~ref_iterator ~ref_iterator() = default ref_iterator inline ref_iterator( T container) ref_iterator inline ref_iterator(const ref_iterator ©) operator= inline ref_iterator &operator=( ref_iterator other) swap inline void swap( ref_iterator &other) noexcept operator++ inline ref_iterator &operator++() operator++ inline ref_iterator operator++(int) operator-- inline ref_iterator &operator--() operator-- inline ref_iterator operator--(int) operator+= inline ref_iterator &operator+=(const typename ref_iterator :: difference_type &movement) operator-= inline ref_iterator &operator-=(const typename ref_iterator :: difference_type &movement) operator[] inline std::enable_if_t, remove_const_t< ref_t >> operator[](size_t n) operator[] inline add_const_t< ref_t > operator[](size_t n) const operator+ inline ref_iterator operator+(typename ref_iterator :: difference_type n) const operator- inline ref_iterator operator-(typename ref_iterator :: difference_type n) const operator- inline ref_iterator :: difference_type operator-(const ref_iterator &rhs) const operator< inline bool operator<(const ref_iterator &rhs) const operator> inline bool operator>(const ref_iterator &rhs) const operator>= inline bool operator>=(const ref_iterator &rhs) const operator<= inline bool operator<=(const ref_iterator &rhs) const begin inline ref_iterator begin() const cbegin inline ref_iterator cbegin() const end inline ref_iterator end() const cend inline ref_iterator cend() const operator== inline bool operator==(const ref_iterator &other) const operator!= inline bool operator!=(const ref_iterator &other) const size inline size_t size() const empty inline bool empty() const operator* inline std::enable_if_t, remove_const_t< ref_t >> operator*() Voperator* template inline std::enable_if_t, add_const_t< ref_t >> operator*() const Voperator* template inline std::enable_if_t, add_const_t< ref_t >> operator*() const operator-> inline std::enable_if_t, pointer_t > operator->() operator-> inline add_const_t< pointer_t > operator->() const TUCTLIEF::const_ref_iterator template::value_type, class CT = std::add_const_t< T >> using LIEF::const_ref_iterator = ref_iterator < CT , U , typename decay_t< CT >::const_iterator> Iterator which returns a const ref on container’s values. TUITERATOR_Tfilter_iterator template::value_type, class ITERATOR_T = typename decay_t< T >::iterator> class filter_iterator Iterator which returns a ref on container’s values given predicates. Public Types iterator_category using iterator_category = std::forward_iterator_tag value_type using value_type = decay_t< U > difference_type using difference_type = ptrdiff_t pointer using pointer = std::remove_pointer_t< U >* reference using reference = std::remove_pointer_t< U >& container_type using container_type = T DT_VAL using DT_VAL = U DT using DT = decay_t< T > ref_t using ref_t = typename filter_iterator :: reference pointer_t using pointer_t = typename filter_iterator :: pointer filter_t using filter_t = std::function Public Functions filter_iterator inline filter_iterator( filter_iterator &&other) noexcept operator= inline filter_iterator &operator=( filter_iterator &&other) noexcept ~filter_iterator ~filter_iterator() = default filter_iterator inline filter_iterator( T container, filter_t filter) filter_iterator inline filter_iterator( T container, const std::vector< filter_t > &filters) filter_iterator inline filter_iterator( T container) filter_iterator inline filter_iterator(const filter_iterator ©) operator= inline filter_iterator &operator=( filter_iterator other) swap inline void swap( filter_iterator &other) noexcept def inline filter_iterator &def( filter_t func) operator++ inline filter_iterator &operator++() operator++ inline filter_iterator operator++(int) begin inline filter_iterator begin() const cbegin inline filter_iterator cbegin() const end inline filter_iterator end() const cend inline filter_iterator cend() const operator* inline std::enable_if_t, remove_const_t< ref_t >> operator*() Voperator* template inline std::enable_if_t, add_const_t< ref_t >> operator*() const Voperator* template inline std::enable_if_t, add_const_t< ref_t >> operator*() const operator[] inline std::enable_if_t, remove_const_t< ref_t >> operator[](size_t n) operator[] inline add_const_t< ref_t > operator[](size_t n) const operator-> inline std::enable_if_t, pointer_t > operator->() operator-> inline add_const_t< pointer_t > operator->() const size inline size_t size() const empty inline bool empty() const operator== inline bool operator==(const filter_iterator &other) const operator!= inline bool operator!=(const filter_iterator &other) const TUCTLIEF::const_filter_iterator template::value_type, class CT = std::add_const_t< T >> using LIEF::const_filter_iterator = filter_iterator < CT , U , typename decay_t< CT >::const_iterator> Iterator which returns a const ref on container’s values given predicates. IteratorTiterator_range template class iterator_range Public Types IteratorTy using IteratorTy = IteratorT IteratorDecayTy using IteratorDecayTy = std::decay_t< IteratorT > Public Functions Titerator_range template inline iterator_range( T &&it_begin, T &&it_end) begin inline IteratorT begin() const end inline IteratorT end() const empty inline bool empty() const at inline ReferenceProxy at(typename IteratorDecayTy ::difference_type pos) const operator[] inline ReferenceProxy operator[](typename IteratorDecayTy ::difference_type pos) const size inline std::ptrdiff_t size() const ReferenceProxy class ReferenceProxy Public Types reference using reference = decltype(*std::declval()) Public Functions operator reference inline operator reference () const Itoperator-> template inline decltype(&*std::declval()) operator->() const BinaryStream BinaryStream class BinaryStream Class that is used to a read stream of data from different sources. Subclassed by LIEF::DumpStream, LIEF::FileStream , LIEF::MemoryStream , LIEF::SpanStream , LIEF::VectorStream Public Types STREAM_TYPE enum class STREAM_TYPE Values: UNKNOWN enumerator UNKNOWN = 0 VECTOR enumerator VECTOR MEMORY enumerator MEMORY SPAN enumerator SPAN FILE enumerator FILE DUMP enumerator DUMP ELF_DATA_HANDLER enumerator ELF_DATA_HANDLER Public Functions BinaryStream inline BinaryStream( STREAM_TYPE type) ~BinaryStream virtual ~BinaryStream() = default size virtual uint64_t size() const = 0 type inline STREAM_TYPE type() const is_memory_stream inline bool is_memory_stream() const is_dump_stream inline bool is_dump_stream() const is_memory_view inline bool is_memory_view() const skip_uleb128 inline const BinaryStream &skip_uleb128() const skip_sleb128 inline const BinaryStream &skip_sleb128() const read_uleb128 result read_uleb128(size_t *size = nullptr) const read_sleb128 result read_sleb128(size_t *size = nullptr) const read_dwarf_encoded result read_dwarf_encoded(uint8_t encoding) const read_string result read_string(size_t maxsize = ~size_t{0}) const peek_string result peek_string(size_t maxsize = ~size_t{0}) const peek_string_at result peek_string_at(size_t offset, size_t maxsize = ~size_t{0}) const read_u16string result read_u16string() const peek_u16string result peek_u16string() const read_mutf8 result read_mutf8(size_t maxsize = ~size_t{0}) const read_u16string result read_u16string(size_t length) const peek_u16string result peek_u16string(size_t length) const peek_u16string_at result peek_u16string_at(size_t offset, size_t length) const peek_data inline virtual ok_error_t peek_data(std::vector &container, uint64_t offset, uint64_t size, uint64_t virtual_address = 0) read_data inline virtual ok_error_t read_data(std::vector &container, uint64_t size) read_data inline ok_error_t read_data(std::vector &container) Tread_objects template inline ok_error_t read_objects(std::vector< T > &container, uint64_t count) Tpeek_objects template inline ok_error_t peek_objects(std::vector< T > &container, uint64_t count) Tpeek_objects_at template inline ok_error_t peek_objects_at(uint64_t offset, std::vector< T > &container, uint64_t count) setpos inline void setpos(size_t pos) const increment_pos inline const BinaryStream &increment_pos(size_t value) const decrement_pos inline void decrement_pos(size_t value) const pos inline size_t pos() const is_valid inline bool is_valid() const operator bool inline operator bool() const Tread_array template const T *read_array(size_t size) const TNpeek_array template inline ok_error_t peek_array(std::array< T , N > &dst) const TNread_array template inline ok_error_t read_array(std::array< T , N > &dst) const Tpeek template result < T > peek() const Tpeek template result < T > peek(size_t offset) const Tpeek_array template const T *peek_array(size_t size) const Tpeek_array template const T *peek_array(size_t offset, size_t size) const Tread template result < T > read() const Tskip template inline const BinaryStream &skip() const Tcan_read template bool can_read() const Tcan_read template bool can_read(size_t offset) const can_read inline bool can_read(int64_t offset, int64_t size) const align size_t align(size_t align_on) const set_endian_swap inline void set_endian_swap(bool swap) should_swap inline bool should_swap() const p inline virtual const uint8_t *p() const start inline virtual uint8_t *start() p inline virtual uint8_t *p() end inline virtual uint8_t *end() start inline virtual const uint8_t *start() const end inline virtual const uint8_t *end() const read_at virtual result read_at(uint64_t offset, uint64_t size, uint64_t virtual_address = 0) const = 0 peek_in inline virtual ok_error_t peek_in(void *dst, uint64_t offset, uint64_t size, uint64_t virtual_address = 0) const Tcast template inline const T *cast() const Tcast template inline T *cast() bind_binary inline virtual bool bind_binary( Binary &) Public Static Functions Tis_all_zero template static inline bool is_all_zero(const T &buffer) Friends friend class ASN1Reader FileStream class FileStream : public LIEF:: BinaryStream Stream interface over a std::ifstream . Public Functions FileStream inline FileStream(std::ifstream fs, uint64_t size) FileStream FileStream() = delete FileStream FileStream(const FileStream &) = delete operator= FileStream &operator=(const FileStream &) = delete FileStream FileStream( FileStream &&other) noexcept = default operator= FileStream &operator=( FileStream &&other) noexcept = default size inline virtual uint64_t size() const override content std::vector content() const ~FileStream ~FileStream() override = default peek_in inline virtual ok_error_t peek_in(void *dst, uint64_t offset, uint64_t size, uint64_t = 0) const override read_at inline virtual result read_at(uint64_t, uint64_t, uint64_t) const override Public Static Functions from_file static result < FileStream > from_file(std::string_view file) classof static inline bool classof(const BinaryStream &stream) SpanStream class SpanStream : public LIEF:: BinaryStream Public Functions SpanStream inline SpanStream(span data) SpanStream inline SpanStream(span data) SpanStream inline SpanStream(const uint8_t *p, size_t size) SpanStream inline SpanStream(const std::vector &data) clone inline std::unique_ptr< SpanStream > clone() const SpanStream SpanStream() = delete SpanStream SpanStream(const SpanStream &other) = default operator= SpanStream &operator=(const SpanStream &other) = default SpanStream SpanStream( SpanStream &&other) noexcept = default operator= SpanStream &operator=( SpanStream &&other) noexcept = default size inline virtual uint64_t size() const override p inline virtual const uint8_t *p() const override start inline virtual const uint8_t *start() const override end inline virtual const uint8_t *end() const override content inline std::vector content() const slice inline result < SpanStream > slice(size_t offset, size_t size) const slice inline result < SpanStream > slice(size_t offset) const to_vector std::unique_ptr< VectorStream > to_vector() const ~SpanStream ~SpanStream() override = default end inline virtual uint8_t *end() p inline virtual uint8_t *p() start inline virtual uint8_t *start() Public Static Functions from_vector static inline result < SpanStream > from_vector(const std::vector &data) Nfrom_array template static inline result < SpanStream > from_array(const std::array &data) classof static inline bool classof(const BinaryStream &stream) VectorStream class VectorStream : public LIEF:: BinaryStream Public Functions VectorStream inline VectorStream(std::vector data) VectorStream VectorStream() = delete VectorStream VectorStream(const VectorStream &) = delete operator= VectorStream &operator=(const VectorStream &) = delete VectorStream VectorStream( VectorStream &&other) noexcept = default operator= VectorStream &operator=( VectorStream &&other) noexcept = default size inline virtual uint64_t size() const override content inline const std::vector &content() const move_content inline std::vector &&move_content() p inline virtual const uint8_t *p() const override start inline virtual const uint8_t *start() const override end inline virtual const uint8_t *end() const override slice std::unique_ptr< SpanStream > slice(uint32_t offset, size_t size) const slice std::unique_ptr< SpanStream > slice(uint32_t offset) const end inline virtual uint8_t *end() p inline virtual uint8_t *p() start inline virtual uint8_t *start() Public Static Functions from_file static result < VectorStream > from_file(std::string_view file) classof static inline bool classof(const BinaryStream &stream) MemoryStream class MemoryStream : public LIEF:: BinaryStream Public Functions MemoryStream MemoryStream() = delete MemoryStream MemoryStream(uintptr_t base_address) MemoryStream inline MemoryStream(uintptr_t base_address, uint64_t size) MemoryStream MemoryStream(const MemoryStream &) = delete operator= MemoryStream &operator=(const MemoryStream &) = delete MemoryStream MemoryStream( MemoryStream &&) noexcept = default operator= MemoryStream &operator=( MemoryStream &&) noexcept = default base_address inline uintptr_t base_address() const p inline virtual const uint8_t *p() const override start inline virtual const uint8_t *start() const override end inline virtual const uint8_t *end() const override binary inline Binary *binary() size inline virtual uint64_t size() const override bind_binary inline virtual bool bind_binary( Binary &bin) override ~MemoryStream ~MemoryStream() override = default end inline virtual uint8_t *end() p inline virtual uint8_t *p() start inline virtual uint8_t *start() Public Static Functions classof static inline bool classof(const BinaryStream &stream)", "contentHash": "23ea3e162d56acb62d24513e45e84d4e2853cd69db43c727d517d1aa01277c27", "description": "C++ reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "api/cpp/index", "documentID": "e1bf9750dd3d1fce566257b8893bb4844f89677b8d9bf4e0e73697b33407eb83", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/api/cpp/index.md", "title": "C++ - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/api/error_handling/index.html", "content": "Error Handling Introduction LIEF manages errors using: Exceptions (deprecated and removed since LIEF 0.13.0) std::expected (tl::expected) It turns out that using C++ exceptions (and RTTI) was not the best design choice, as LIEF, as a library, can be used in a -fno-exceptions context. Consequently, we moved to a mechanism based on the ResultOrError idiom. This idiom is similar to those found in LLVM with llvm::ErrorOr and in Rust with std::result . LIEF uses a std::expected-like interface to handle errors. Since this interface is only available in C++23, we rely on TartanLlama/expected , which provides this interface for C++11/C++17. Functions using this idiom return a LIEF::result , which wraps either the successful result or an error. The user can process this result as follows: result pe_type = PE::get_type(\"/tmp/NotPE.elf\"); if (pe_type) { PE_TYPE effective_type = pe_type.value(); } else { lief_errors err = as_lief_err(pe_type); } In the case of Python, we leverage the dynamic features of the language to return either the expected value or an error if the function fails. For instance, in previous versions of lief.PE.get_type() , the implementation raised an exception to inform the user: try: pe_type = lief.PE.get_type(\"/tmp/NotPE.elf\") # If it does not fail, pe_type handles a lief.PE.PE_TYPE object except Exception as e: print(f\"Error: {e}\") With the new implementation that relies on the ResultOrError idiom, the function returns the lief.PE.PE_TYPE value if everything is correct, and returns a lief.lief_errors in case of a processing error. The user can handle this new interface by using the isinstance() function or by comparing the value with a lief.lief_errors attribute: pe_type = lief.PE.get_type(\"/tmp/NotPE.elf\") if pe_type == lief.lief_errors.file_error: print(\"File error\") elif isinstance(pe_type, lief.lief_errors): print(\"Another kind of error\") else: print(f\"No error, type is: {pe_type}\") API C++ Tresult template class result : public tl::expected< T , lief_errors > Wrapper that contains an Object ( T ) or an error. The tl/expected implementation exposes the method value() to access the underlying object (if no error) Typical usage is: result intval = my_function(); if (intval) { int val = intval.value(); } else { // There is an error std::cout << get_error(intval).message() << \"\\n\"; } See https://tl.tartanllama.xyz/en/latest/api/expected.html for more details Public Types ExpectedType using ExpectedType = T Public Functions result inline result(tl::expected< T , lief_errors > e) TLIEF::as_lief_err template lief_errors LIEF::as_lief_err( result < T > &err) Return the lief_errors when the provided result is an error. lief_errors enum class lief_errors : uint32_t LIEF error codes definition. Values: read_error enumerator read_error = 1 not_found enumerator not_found not_implemented enumerator not_implemented not_supported enumerator not_supported corrupted enumerator corrupted conversion_error enumerator conversion_error read_out_of_bound enumerator read_out_of_bound asn1_bad_tag enumerator asn1_bad_tag file_error enumerator file_error file_format_error enumerator file_format_error parsing_error enumerator parsing_error build_error enumerator build_error data_too_large enumerator data_too_large require_extended_version enumerator require_extended_version inconsistent enumerator inconsistent runtime_error enumerator runtime_error ok_error_t class ok_error_t : public LIEF:: result < ok_t > Opaque structure that is used by LIEF to avoid writing result f(...) . Instead, it makes the output explicit such as: ok_error_t process() { if (fail) { return make_error_code(...); } return ok(); } LIEF::ok inline ok_t LIEF::ok() Return success for function with return type ok_error_t . ok_t struct ok_t Opaque structure used by ok_error_t . Python lief.lief_errors class lief.lief_errors( *values ) Bases: Enum Enum class which represents an error generated by LIEF’s functions asn1_bad_tag asn1_bad_tag = 8 build_error build_error = 12 conversion_error conversion_error = 6 corrupted corrupted = 5 data_too_large data_too_large = 13 file_error file_error = 9 file_format_error file_format_error = 10 inconsistent inconsistent = 15 not_found not_found = 2 not_implemented not_implemented = 3 not_supported not_supported = 4 parsing_error parsing_error = 11 read_error read_error = 1 read_out_of_bound read_out_of_bound = 7 require_extended_version require_extended_version = 14 runtime_error runtime_error = 16 lief.ok_t class lief.ok_t Bases: object Opaque value returned when a void function is executed successfully. lief.ok_error_t class lief.ok_error_t Bases: object Return either: ok_t (success) or lief_errors (error) error property error → lief.lief_errors is_error property is_error → bool is_value property is_value → bool value property value → lief.ok_t", "contentHash": "24e460caaee932038c92deb9e36615861780167d32d8b64c07a1bb95f8bc34f3", "description": "Error Handling reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "api/error_handling/index", "documentID": "c10f09fce52a0c164dd8375d680a57107c5be62156543e7de81185ba40013ec7", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/api/error_handling/index.md", "title": "Error Handling - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/api/logging/index.html", "content": "Logging This section details the API for interacting with LIEF’s logging engine. LIEF uses spdlog for its logging mechanism, and this API provides an abstraction over that implementation. API C++ LIEF::logging::disable void LIEF::logging::disable() Globally disable the logging module. LIEF::logging::enable void LIEF::logging::enable() Globally enable the logging module. LIEF::logging::set_level void LIEF::logging::set_level( Level level) Change the logging level ( hierarchical ). LIEF::logging::set_path void LIEF::logging::set_path(const std::string &path) Change the logger to a file-based logging and set its path. ArgsLIEF::logging::log template void LIEF::logging::log( Level level, const std::string &fmt, const Args &... args) LIEF::logging::log void LIEF::logging::log( Level level, const std::string &fmt, const std::vector &args) LIEF::logging::log void LIEF::logging::log( Level level, const std::string &msg) Log a message with the LIEF’s logger. LIEF::logging::reset void LIEF::logging::reset() LIEF::logging::Level enum class LIEF::logging::Level : uint32_t Hierarchical logging level From a given level set, all levels below this level are enabled For example, if Level::Info is enabled then Level::Warn , Level::Err are also enabled Values: Off enumerator Off = 0 Trace enumerator Trace Debug enumerator Debug Info enumerator Info Warn enumerator Warn Err enumerator Err Critical enumerator Critical Scoped class Scoped Public Functions Scoped Scoped(const Scoped &) = delete operator= Scoped &operator=(const Scoped &) = delete Scoped Scoped( Scoped &&) = delete operator= Scoped &operator=( Scoped &&) = delete Scoped inline explicit Scoped( Level level) Scoped inline explicit Scoped( Level level, std::string name) set_level inline const Scoped &set_level( Level lvl) const reset inline void reset() ~Scoped inline ~Scoped() Example // Set global level to Err LIEF::logging::set_level(LIEF::logging::Level::Err); { // Temporarily set global level to Debug (RAII) LIEF::logging::Scoped _(LIEF::logging::Level::Debug); LIEF::logging::log(LIEF::logging::Level::Debug, \"This is a debug message\"); } Python lief.logging.set_level lief.logging.set_level( level: lief.logging.Level ) → None Change logging level lief.logging.enable lief.logging.enable() → None Enable the logger globally lief.logging.disable lief.logging.disable() → None Disable the logger globally lief.logging.set_path lief.logging.set_path( path: str | os.PathLike ) → None Change the logger as a file-base logging and set its path lief.logging.log lief.logging.log( level: lief.logging.Level , msg: str ) → None Log a message with the LIEF’s logger lief.logging.level_scopelief.logging.level_scope lief.logging.level_scope( name: str , lvl: Level ) → Scoped lief.logging.level_scope( name: str , lvl: Level ) → Scoped lief.logging.Scoped class lief.logging.Scoped Bases: object lief.logging.Level class lief.logging.Level( *values ) Bases: Enum Critical Critical = 6 Debug Debug = 2 Err Err = 5 Info Info = 3 Off Off = 0 Trace Trace = 1 Warn Warn = 4 Example # Set global level to Err lief.logging.set_level(lief.logging.Level.Err) # Temporarily set global level to Debug with lief.logging.level_scope(lief.logging.Level.Debug): lief.logging.log(lief.logging.Level.Debug, \"This is a debug message\") Rust lief::logging::disable lief::logging::enable lief::logging::set_level lief::logging::set_path lief::logging::log lief::logging::reset lief::logging::Level lief::logging::Scoped Example // Set global level to Err lief::logging::set_level(lief::logging::Level::Err); { // Temporarily set global level to Debug (RAII) let _scoped = lief::logging::Scoped::new(lief::logging::Level::Debug); lief::logging::log(lief::logging::Level::Debug, \"This is a debug message\"); }", "contentHash": "5a56f6df33e0d2db8e7f1f1ea3f09614cd1ded39fb2590e66370797b07b3c229", "description": "This section details the API for interacting with LIEF’s logging engine.", "docname": "api/logging/index", "documentID": "f650521a704e8a834c98e634f3d3b98668d79902fe83f626ec34ecff083d19dd", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/api/logging/index.md", "title": "Logging - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/api/rust/index.html", "content": "Rust Note The API is documented here https://lief.re/doc/stable/rust/lief and the nightly doc is here: https://lief-rs.s3.fr-par.scw.cloud/doc/latest/lief/index.html . [package] name = \"my-awesome-project\" version = \"0.0.1\" edition = \"2024\" [dependencies] lief = { git = \"https://github.com/lief-project/LIEF\", branch = \"main\" } Warning LIEF rust bindings are not on docs.rs because of network restrictions: https://github.com/rust-lang/docs.rs/issues/2563 Precompiled FFI Bindings LIEF’s Rust bindings are split into two parts: lief : the high-level, idiomatic Rust API. lief-ffi : the low-level FFI API based on cxx . Two additional crates support the build process: lief-build : build-script helper used by lief-ffi to fetch the pre-compiled artifacts and emit the cargo link directives. lief-ffigen : standalone CLI that generates the C++ side of the cxx bridge from the #[cxx::bridge] modules declared in lief-ffi . Building lief-ffi requires generating the C++ bridge files with lief-ffigen and then compiling them alongside libLIEF . Both steps can take several minutes. To save time, LIEF provides pre-compiled versions of these artifacts, which are downloaded from GitHub (for releases) or an S3 bucket (for nightly builds). LIEF_RUST_PRECOMPILED If you need to avoid downloading these pre-compiled files, set LIEF_RUST_PRECOMPILED to point to the directory that contains these files: /home/romain/out └── lib ├── libLIEF.a └── liblief-sys.a 1 directory, 2 files LIEF_RUST_PRECOMPILED=/home/romain/out cargo build [...] This variable can also be used when building in offline mode (e.g., cargo --offline ). As of now, the following targets are supported with pre-compilation: Target Description x86_64-unknown-linux-gnu Regular Linux x86-64 (Ubuntu 21.10+, Debian 12+, …) i686-unknown-linux-gnu Regular Linux i686 (Ubuntu 19.10, Debian 10, …) x86_64-unknown-linux-musl Musl target that allows full static build i686-unknown-linux-musl Linux i686 with Musl aarch64-unknown-linux-gnu Linux aarch64 (Debian 12+) aarch64-unknown-linux-musl Linux aarch64 with Musl aarch64-linux-android Android aarch64 (API 30+) x86_64-linux-android Android x86_64 (API 30+) x86_64-apple-darwin macOS 11+ x86-64 aarch64-apple-darwin macOS 11+ arm64 (Apple Silicon) aarch64-apple-ios iOS 12+ x86_64-pc-windows-msvc[MT] Regular Windows x86-64 (static UCRT runtime) x86_64-pc-windows-msvc[MD] Regular Windows x86-64 (dynamic UCRT runtime .dll ) aarch64-pc-windows-msvc[MT] Regular Windows arm64 (static UCRT runtime) aarch64-pc-windows-msvc[MD] Regular Windows arm64 (dynamic UCRT runtime .dll ) Precompilation The assets of the pre-compiled output are: LIEF static library: LIEF.{a,lib} liefsys.{a,lib} : bridge between C++ and Rust The LIEF static library must be compiled as described in the Compilation section using the CMake option: -DLIEF_RUST_API=ON . liefsys.{a,lib} is built in two steps. First, generate the C++ bridge files with lief-ffigen : $ cargo build [--profile release] -p lief-ffigen $ target/{release,debug}/lief-ffigen \\ --output-dir cxx-bridge/ \\ --source-dir lief-ffi/ Then compile them as a regular CMake-based library: $ cmake -GNinja \\ -S api/rust/cmake-ffi/ \\ -B cxx-bridge-build/ \\ -DLIEF_DIR=$INSTALL_DIR/lib/cmake/LIEF \\ -DLIEF_RUST_FFI_SRC=cxx-bridge/ \\ -DCMAKE_INSTALL_PREFIX=cxx-bridge-out/ $ ninja -C cxx-bridge-build/", "contentHash": "d3429e99afcbc26a1a56ff50f95e262635b44627aa0b62ad32230ea262cc8bf2", "description": "Rust reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "api/rust/index", "documentID": "db6231dac8cfd495b1c205b0e8a32bb2ca1ade49051a78b165cdde3b8e0eb307", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/api/rust/index.md", "title": "Rust - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/api/utilities/index.html", "content": "Utilities Demangling LIEF exposes a demangling API for the following formats: MSVC Input lief.demangle(\"?h@@YAXH@Z\") Result void __cdecl h(int) Rust Input lief.demangle(\"_RNvCskwGfYPst2Cb_3foo16example_function\") Result foo::example_function Itanium C++ Input lief.demangle(\"_ZTSN3lld13SpecificAllocINS_4coff9TpiSourceEEE\") Result typeinfo name for lld::SpecificAlloc Swift/Obj-C Input lief.demangle(\"_$s10Foundation4DataV15_RepresentationON\") Result type metadata for Foundation.Data._Representation LIEF::demangle result LIEF::demangle(std::string_view mangled) Demangle the given input. This function only works with the extended version of LIEF lief.demangle lief.demangle( mangled: str ) → str | None Demangle the given input. Warning This function only works with the extended version of LIEF lief::demangle Extended Version To check if the current build is an extended version, you can use: LIEF::is_extended bool LIEF::is_extended() Whether this version of LIEF includes extended features. lief._lief.__extended__ lief._lief.__extended__ = False Returns True when the argument is true, False otherwise. The builtins True and False are the only two instances of the class bool. The class bool is a subclass of the class int, and cannot be subclassed. lief::is_extended In C++, you can also check if LIEF_EXTENDED is defined: #include #if defined(LIEF_EXTENDED) // Extended version #else // Regular version #endif To get details about the version of the current extended build: LIEF::extended_version_info std::string LIEF::extended_version_info() Details about the extended version. Android Platform lief.Android.code_name lief.Android.code_name( version: lief.Android.ANDROID_VERSIONS ) → str Return the Android code associated with a ANDROID_VERSIONS . For example: Nougat lief.Android.version_string lief.Android.version_string( version: lief.Android.ANDROID_VERSIONS ) → str Return the ANDROID_VERSIONS as a string. For example: 7.0.1 lief.Android.ANDROID_VERSIONS class lief.Android.ANDROID_VERSIONS( *values ) Bases: Enum UNKNOWN UNKNOWN = 0 VERSION_601 VERSION_601 = 1 VERSION_700 VERSION_700 = 2 VERSION_710 VERSION_710 = 3 VERSION_712 VERSION_712 = 4 VERSION_800 VERSION_800 = 5 VERSION_810 VERSION_810 = 6 VERSION_900 VERSION_900 = 7 from_value from_value( arg: int ) → lief.Android.ANDROID_VERSIONS = LIEF::Android::code_name const char *LIEF::Android::code_name( ANDROID_VERSIONS version) LIEF::Android::version_string const char *LIEF::Android::version_string( ANDROID_VERSIONS version) LIEF::Android::ANDROID_VERSIONS enum class LIEF::Android::ANDROID_VERSIONS Values: VERSION_UNKNOWN enumerator VERSION_UNKNOWN = 0 VERSION_601 enumerator VERSION_601 = 1 VERSION_700 enumerator VERSION_700 = 2 VERSION_710 enumerator VERSION_710 = 3 VERSION_712 enumerator VERSION_712 = 4 VERSION_800 enumerator VERSION_800 = 5 VERSION_810 enumerator VERSION_810 = 6 VERSION_900 enumerator VERSION_900 = 7 Python Leaks lief.disable_leak_warning lief.disable_leak_warning() → None Disable nanobind warnings about leaked objects. For instance: nanobind: leaked 45 instances! nanobind: leaked 25 types! - leaked type \"lief._lief.FORMATS\" - ... skipped remainder nanobind: leaked 201 functions! - leaked function \"\" - leaked function \"export_symbol\" - ... skipped remainder nanobind: this is likely caused by a reference counting issue in the binding code. Helpers The lief.dump() utility can be used to pretty-print a buffer. For example: pe = lief.PE.parse(\"some.exe\") assert isinstance(pe, lief.PE.Binary) text = pe.get_section(\".text\") assert isinstance(pe, lief.PE.Section) print(lief.dump(text.content)) lief.dumplief.dump lief.dump( *args ) → str lief.dump( buffer: bytes , title: str = '' , prefix: str = '' , limit: int = 0 ) → str Hexdump the provided buffer: +---------------------------------------------------------------------+ | 88 56 05 00 00 00 00 00 00 00 00 00 22 58 05 00 | .V..........\"X.. | | 10 71 02 00 78 55 05 00 00 00 00 00 00 00 00 00 | .q..xU.......... | | 68 5c 05 00 00 70 02 00 00 00 00 00 00 00 00 00 | h\\...p.......... | | 00 00 00 00 00 00 00 00 00 00 00 00 | ............ | +---------------------------------------------------------------------+ LIEF::dump inline std::string LIEF::dump(const std::vector &data, const std::string &title = \"\", const std::string &prefix = \"\", size_t limit = 0) LIEF::dump std::string LIEF::dump(const uint8_t *buffer, size_t size, const std::string &title = \"\", const std::string &prefix = \"\", size_t limit = 0) Hexdump the provided buffer. For instance: +---------------------------------------------------------------------+ | 88 56 05 00 00 00 00 00 00 00 00 00 22 58 05 00 | .V..........\"X.. | | 10 71 02 00 78 55 05 00 00 00 00 00 00 00 00 00 | .q..xU.......... | | 68 5c 05 00 00 70 02 00 00 00 00 00 00 00 00 00 | h\\...p.......... | | 00 00 00 00 00 00 00 00 00 00 00 00 | ............ | +---------------------------------------------------------------------+ LIEF::dump inline std::string LIEF::dump(span data, const std::string &title = \"\", const std::string &prefix = \"\", size_t limit = 0) lief::dump lief::dump_with_limit", "contentHash": "70b78fc27af63d06ef9f4f404a4e9c0cf05b647854f0fcb5476a00f59afe76d1", "description": "Utilities. LIEF exposes a demangling API for the following formats:", "docname": "api/utilities/index", "documentID": "6924d829b0dd6852baf34b6441ea5606133b947c530c38bd5c3238311b2a5b28", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/api/utilities/index.md", "title": "Utilities - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/changelog.html", "content": "Changelog 2.0.0 - Not Released Yet Breaking Changes C++17 Migration : LIEF public headers, public API, and STL have been bumped from C++11 to C++17 . C API Removal : The legacy C API has been completely removed. Logging Level Renaming : lief.logging.Level ( lief::logging::Level ; lief.logging.Level ; LIEF::logging::Level ) and its enumerators are now written in CamelCase Assembly: Add API to inspect and rewrite the LOCK prefix of x86 instructions: lief.assembly.x86.Instruction.has_lock_prefix() ( lief::assembly::x86::Instruction::has_lock_prefix ; lief.assembly.x86.Instruction.has_lock_prefix ; LIEF::assembly::x86::Instruction::has_lock_prefix() ) lief.assembly.x86.Instruction.is_lockable() ( lief::assembly::x86::Instruction::is_lockable ; lief.assembly.x86.Instruction.is_lockable ; LIEF::assembly::x86::Instruction::is_lockable() ) lief.assembly.x86.Instruction.is_atomic() ( lief::assembly::x86::Instruction::is_atomic ; lief.assembly.x86.Instruction.is_atomic ; LIEF::assembly::x86::Instruction::is_atomic() ) lief.assembly.x86.Instruction.lock() ( lief::assembly::x86::Instruction::lock ; lief.assembly.x86.Instruction.lock() ; LIEF::assembly::x86::Instruction::lock() ) lief.assembly.x86.Instruction.unlock() ( lief::assembly::x86::Instruction::unlock ; lief.assembly.x86.Instruction.unlock() ; LIEF::assembly::x86::Instruction::unlock() ) ELF: Fix the layout of the segments added by LIEF for the architectures that can use pages larger than 4K ( #1366 ) Fix the modification of binaries that have already been modified by LIEF. The segment table was relocated a second time which, for the non-PIE binaries, shifted the sections without shifting the segments nor the dynamic entries. It resulted in a DT_STRTAB that was no longer pointing to .dynstr (i.e. garbage DT_NEEDED / DT_RUNPATH names) and in a PT_PHDR that was not wrapped by a PT_LOAD segment ( #1366 ). lief.ELF.check_layout() ( lief.ELF.check_layout() ; LIEF::ELF::check_layout() ; lief::elf::check_layout ) now reports the PT_LOAD segments that can’t be mapped independently because they share the same page. It also report mismatch between .dynstr virtual address and DT_STRTAB . Add support for the MIPS n64 relocation encoding ( #1367 by plusls ). Add lief.ELF.Header.is_mips_n64 ( lief::elf::Header::is_mips_n64 ; lief.ELF.Header.is_mips_n64 ; LIEF::ELF::Header::is_mips_n64() ) to check whether a binary uses this encoding. lief.ELF.Relocation.resolve() ( lief::elf::Relocation::resolve ; lief::elf::Relocation::resolve_with_base_address ; lief.ELF.Relocation.resolve() ; LIEF::ELF::Relocation::resolve() ) now supports R_MIPS_REL32 . COFF: Add lief.COFF.Binary.get_section() ( lief::coff::Binary::section_by_name ; lief.COFF.Binary.get_section() ; LIEF::COFF::Binary::get_section() ) to look up a section by its name. Names that are stored in the COFF string table (i.e. longer than 8 bytes) can be resolved either from their regular value or from their / placeholder: import lief coff = lief.COFF.parse(\"dwarf.obj\") section = coff.get_section(\".debug_rnglists\") section.name # '/18' section.coff_string.string # '.debug_rnglists' Runtime: Add lief.runtime.Memory.mmap_hint() ( lief::runtime::Memory::mmap_hint ; lief.runtime.Memory.mmap_hint() ; LIEF::runtime::Memory::mmap_hint() ) to allocate memory close to a given address. Add lief.runtime.MemoryLayout ( lief.runtime.MemoryLayout ; LIEF::runtime::MemoryLayout ) to inspect the memory layout of the current process. lief.runtime.memory_layout() ( lief::runtime::memory_layout ; lief.runtime.memory_layout() ; LIEF::runtime::memory_layout() ) iterates over the mapped lief.runtime.MemoryLayout.Region ( lief::runtime::Region ; lief.runtime.MemoryLayout.Region ; LIEF::runtime::MemoryLayout::Region ) ( documentation ): import lief for region in lief.runtime.memory_layout(): print(f\"{region.addr:#014x}-{region.end_addr:#014x} {region.name}\") C++: The parsers now take the file path as a std::string_view and they also accept a std::filesystem::path : #include #include std::filesystem::path path = \"/bin/ls\"; std::unique_ptr elf = LIEF::ELF::Parser::parse(path); Dependencies: Update nanobind to version 3.0.1 Python: Python 3.9 is no longer supported. nanobind 3 requires Python 3.10 or newer. 1.0.0 - July 12th, 2026 Runtime LIEF now provides runtime features as described here: Runtime BinaryNinja: Add Android JNI Analyzer The DWARF import plugin now supports comments Ghidra: Add support for generating DWARF from firmware or binaries without a precise format or architecture ( #1249 ) DWARF: Add support for accessing the bit size of bit-field declarations ( #1265 ) Add support for accessing Enum entries: lief.dwarf.types.Enum.entries() ( lief::dwarf::types::Enum::entries ; LIEF::dwarf::types::Enum::entries() ; lief.dwarf.types.Enum.entries ) Add support for reading from or assigning a register to a function parameter Add support for reading from or assigning a description ( DW_AT_description ) to a lief.dwarf.Function ( lief::dwarf::Function ; lief.dwarf.Function ; LIEF::dwarf::Function ), lief.dwarf.Variable ( lief::dwarf::Variable ; lief.dwarf.Variable ; LIEF::dwarf::Variable ), or lief.dwarf.LexicalBlock ( lief::dwarf::LexicalBlock ; lief.dwarf.LexicalBlock ; LIEF::dwarf::LexicalBlock ): lief.dwarf.Function.description() ( lief::dwarf::Function::description ; LIEF::dwarf::Function::description() ; lief.dwarf.Function.description ) lief.dwarf.Variable.description() ( lief::dwarf::Variable::description ; LIEF::dwarf::Variable::description() ; lief.dwarf.Variable.description ) lief.dwarf.LexicalBlock.description() ( lief::dwarf::LexicalBlock::description ; LIEF::dwarf::LexicalBlock::description() ; lief.dwarf.LexicalBlock.description ) Enable the creation of nested lief.dwarf.editor.Function.LexicalBlock ( lief::dwarf::editor::function::LexicalBlock ; lief.dwarf.editor.Function.LexicalBlock ; LIEF::dwarf::editor::Function::LexicalBlock ) Add support for generating a C/C++ definition for a whole lief.dwarf.CompilationUnit ( lief::dwarf::CompilationUnit ; lief.dwarf.CompilationUnit ; LIEF::dwarf::CompilationUnit ) ( lief.dwarf.CompilationUnit.to_decl() ( lief::dwarf::CompilationUnit::to_decl ; lief::dwarf::CompilationUnit::to_decl_with_opt ; lief.dwarf.CompilationUnit.to_decl() ; LIEF::dwarf::CompilationUnit::to_decl() )). The output of the following to_decl() functions can now be configured through the new lief.DeclOpt ( lief::DeclOpt ; lief.DeclOpt ; LIEF::DeclOpt ) structure: lief.dwarf.Function.to_decl() ( lief::dwarf::Function::to_decl ; lief::dwarf::Function::to_decl_with_opt ; lief.dwarf.Function.to_decl() ; LIEF::dwarf::Function::to_decl() ) lief.dwarf.Variable.to_decl() ( lief::dwarf::Variable::to_decl ; lief::dwarf::Variable::to_decl_with_opt ; lief.dwarf.Variable.to_decl() ; LIEF::dwarf::Variable::to_decl() ) lief.dwarf.Type.to_decl() ( lief::dwarf::Type::to_decl ; lief::dwarf::Type::to_decl_with_opt ; lief.dwarf.Type.to_decl() ; LIEF::dwarf::Type::to_decl() ) lief.dwarf.CompilationUnit.to_decl() ( lief::dwarf::CompilationUnit::to_decl ; lief::dwarf::CompilationUnit::to_decl_with_opt ; lief.dwarf.CompilationUnit.to_decl() ; LIEF::dwarf::CompilationUnit::to_decl() ) import lief dbg = lief.dwarf.load(\"/bin/with_debug\") opt = lief.DeclOpt() opt.is_cpp = True opt.indentation = 4 for cu in dbg.compilation_units: print(cu.to_decl(opt)) PDB: Improve support and the API for LF_ENUM : lief.pdb.types.Enum ( lief::pdb::types::Enum ; lief.pdb.types.Enum ; LIEF::pdb::types::Enum ) Improve support and the API for LF_PROCEDURE : lief.pdb.types.Function ( lief::pdb::types::Function ; lief.pdb.types.Function ; LIEF::pdb::types::Function ) Improve support and the API for LF_ARRAY : lief.pdb.types.Array ( lief::pdb::types::Array ; lief.pdb.types.Array ; LIEF::pdb::types::Array ) Improve support and the API for simple types: lief.pdb.types.Simple ( lief::pdb::types::Simple ; lief.pdb.types.Simple ; LIEF::pdb::types::Simple ) Improve support and the API for LF_ONEMETHOD : lief.pdb.types.Method ( lief::pdb::types::Method ; lief.pdb.types.Method ; LIEF::pdb::types::Method ) Add support for generating a C/C++ definition for a lief.pdb.Function ( lief::pdb::Function ; lief.pdb.Function ; LIEF::pdb::Function ) ( lief.pdb.Function.to_decl() ( lief::pdb::Function::to_decl ; lief::pdb::Function::to_decl_with_opt ; lief.pdb.Function.to_decl() ; LIEF::pdb::Function::to_decl() )) and a lief.pdb.CompilationUnit ( lief::pdb::CompilationUnit ; lief.pdb.CompilationUnit ; LIEF::pdb::CompilationUnit ) ( lief.pdb.CompilationUnit.to_decl() ( lief::pdb::CompilationUnit::to_decl ; lief::pdb::CompilationUnit::to_decl_with_opt ; lief.pdb.CompilationUnit.to_decl() ; LIEF::pdb::CompilationUnit::to_decl() )), configurable with the new lief.DeclOpt ( lief::DeclOpt ; lief.DeclOpt ; LIEF::DeclOpt ) structure. ELF: Add support for DT_AUXILIARY tag: lief.ELF.DynamicEntryAuxiliary ( lief.ELF.DynamicEntryAuxiliary ; LIEF::ELF::DynamicEntryAuxiliary ; lief::elf::dynamic::Auxiliary ) ( #1159 ). Add support for DT_FILTER tag: lief.ELF.DynamicEntryFilter ( lief.ELF.DynamicEntryFilter ; LIEF::ELF::DynamicEntryFilter ; lief::elf::dynamic::Filter ) Add lief.ELF.parse_from_dump() ( lief::elf::Binary::parse_from_dump ; lief.ELF.parse_from_dump() ; LIEF::ELF::Parser::parse_from_dump() ) to parse an ELF binary from a memory dump COFF: Add lief.COFF.Section.coff_string ( lief::coff::Section::coff_string ; lief.COFF.Section.coff_string ; LIEF::COFF::Section::coff_string() ) for accessing the full section name when this name does not fit in 8 bytes. Mach-O: Add support for writing big-endian Mach-O binaries ( #1236 ) Introduce an API for selecting a specific Mach-O binary by architecture from a FAT binary ( #1283 ) Add lief.MachO.FatBinary.create() ( lief.MachO.FatBinary.create() ; LIEF::MachO::FatBinary::create() ) to create a FAT binary from a list of lief.MachO.Binary ( lief::macho::Binary ; lief.MachO.Binary ; LIEF::MachO::Binary ) objects targeting different architectures Add support for lief.MachO.ThreadLocalVariables ( lief::macho::ThreadLocalVariables ; lief.MachO.ThreadLocalVariables ; LIEF::MachO::ThreadLocalVariables ) Fix an extra byte being written after the thread state of an LC_UNIXTHREAD / LC_THREAD command, which shifted the following load commands by one byte ( #1344 ) Add support for editing the runtime tables of the LC_FUNCTION_VARIANTS command and committing the changes on write: lief.MachO.FunctionVariants ( lief::macho::commands::FunctionVariants ; lief.MachO.FunctionVariants ; LIEF::MachO::FunctionVariants ) Add a structured parser, editing API and writer for the LC_FUNCTION_VARIANT_FIXUPS command: lief.MachO.FunctionVariantFixups ( lief::macho::commands::FunctionVariantFixups ; lief.MachO.FunctionVariantFixups ; LIEF::MachO::FunctionVariantFixups ) Add support for the LC_LAZY_LOAD_DYLIB_INFO command: lief.MachO.LazyLoadDylibInfo ( lief::macho::commands::LazyLoadDylibInfo ; lief.MachO.LazyLoadDylibInfo ; LIEF::MachO::LazyLoadDylibInfo ) Add lief.MachO.parse_from_dump() ( lief::macho::FatBinary::parse_from_dump ; lief.MachO.parse_from_dump() ; LIEF::MachO::Parser::parse_from_dump() ) to parse a Mach-O binary from a memory dump PE: Add setters for lief.PE.ImportEntry.iat_value ( lief::pe::import::ImportEntry::iat_value ; lief.PE.ImportEntry.iat_value ; LIEF::PE::ImportEntry::iat_value() ) and lief.PE.ImportEntry.ilt_value ( lief::pe::import::ImportEntry::ilt_value ; lief.PE.ImportEntry.ilt_value ; LIEF::PE::ImportEntry::ilt_value() ) Add lief.PE.Binary.offset_to_rva() ( lief::pe::Binary::offset_to_rva ; lief.PE.Binary.offset_to_rva() ; LIEF::PE::Binary::offset_to_rva() ) to convert a raw offset into a RVA Add lief.PE.parse_from_dump() ( lief::pe::Binary::parse_from_dump ; lief.PE.parse_from_dump() ; LIEF::PE::Parser::parse_from_dump() ) to parse a PE binary from a memory dump Update lief.Binary.offset_to_virtual_address() ( lief::generic::Binary::offset_to_virtual_address ; lief.Binary.offset_to_virtual_address() ; LIEF::Binary::offset_to_virtual_address() ) for PE binaries to return an absolute virtual address instead of a RVA ( #1318 ) Add support for adding an lief.PE.Import ( lief::pe::import::Import ; lief.PE.Import ; LIEF::PE::Import ) at a specific position: lief.PE.Binary.add_import() ( lief::pe::Binary::add_import ; lief::pe::Binary::add_import_at_pos ; lief.PE.Binary.add_import() ; LIEF::PE::Binary::add_import() ) ( #1298 ) Improve support for EFI binaries, such as bzImage ( #1293 ) ObjC: Add support for Objective-C categories ( #1353 ): lief.ObjC.Category ( lief::objc::Category ; lief.objc.Category ; LIEF::objc::Category ), accessible through lief.ObjC.Metadata.categories ( lief::objc::Metadata::categories ; lief.objc.Metadata.categories ; LIEF::objc::Metadata::categories() ) Assembly: Add support for iterating over the operands of MIPS, PowerPC, eBPF and RISC-V instructions ( Register , Immediate , Memory and PCRelative ): lief.assembly.mips.Instruction.operands() ( lief::assembly::mips::Instruction::operands ; lief.assembly.mips.Instruction.operands ; LIEF::assembly::mips::Instruction::operands() ) lief.assembly.powerpc.Instruction.operands() ( lief::assembly::powerpc::Instruction::operands ; lief.assembly.powerpc.Instruction.operands ; LIEF::assembly::powerpc::Instruction::operands() ) lief.assembly.ebpf.Instruction.operands() ( lief::assembly::ebpf::Instruction::operands ; lief.assembly.ebpf.Instruction.operands ; LIEF::assembly::ebpf::Instruction::operands() ) lief.assembly.riscv.Instruction.operands() ( lief::assembly::riscv::Instruction::operands ; lief.assembly.riscv.Instruction.operands ; LIEF::assembly::riscv::Instruction::operands() ) Rust: Warning The Minimum Supported Rust Version (MSRV) is now 1.85.0 (previously 1.74.0 ). The Rust FFI no longer relies on autocxx and bindgen . It is now built on top of plain cxx , which simplifies the bindings and reduces the iteration time The Rust bindings directory has been renamed from api/rust/cargo/ to api/rust/crates/ Add support for the aarch64-linux-android and x86_64-linux-android targets C++: Add LIEF_LIFETIMEBOUND annotations wrapping [[clang::lifetimebound]] to leverage Clang’s lifetime analysis . This helps detect dangling references at compile time for methods that return references or iterators tied to an object’s lifetime: // Clang can now warn about this dangling reference: auto& hdr = LIEF::ELF::Parser::parse(\"a.out\")->header(); LIEF_INFO(\"{}\", hdr.header_size()); // /src/src/ELF/Binary.cpp:63:15: error: object whose reference is captured // does not live long enough [-Werror,-Wlifetime-safety-use-after-scope] // 63 | auto& hdr = LIEF::ELF::Parser::parse(\"a.out\")->header(); // | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ // /src/src/ELF/Binary.cpp:63:47: note: destroyed here // 63 | auto& hdr = LIEF::ELF::Parser::parse(\"a.out\")->header(); // | ^ // /src/src/ELF/Binary.cpp:64:19: note: later used here // 64 | LIEF_INFO(\"{}\", hdr.header_size()); Dependencies: Update nanobind to version v2.13.x Update tl-expected to version 1.3.1 Update utfcpp to version 4.0.9 Update frozen to commit 61dce5a Update spdlog to version 1.17.0 Update mbedtls to version 4.0.0 Extended: Use LLVM 22.x Add support to directly download a package from the History : Python: Python 3.8 is no longer supported Add support for the free-threaded Python builds. The C++ core is now thread-safe with respect to its few static variables, and can be used when the GIL is disabled ( #1255 ): from concurrent.futures import ThreadPoolExecutor import lief def strip(path: str) -> None: binary = lief.ELF.parse(path) binary.strip() binary.write(f\"{path}.stripped\") with ThreadPoolExecutor() as pool: pool.map(strip, [\"/bin/ls\", \"/bin/cat\", \"/bin/echo\"]) 0.17.6 - March 18th, 2026 ELF: Fix alignment for PHDR/SHDR and improve TLS/RELR handling ( #1315 ) Skip NOBITS sections in layout calculations and improve index retrieval (related to #1315 ) PE: Fix IAT parsing issue by itamarga in PR #1314 ) 0.17.5 - March 8th, 2026 ELF: Add missing segments in X86_64 coredump parser ( #1278 ) Add TLSDESC_PLT and TLSDESC_GOT to ELF dynamic tags ( #1311 ) Fix dynamic entry shifting for Android relocations ( #1309 ) MachO: Fix DyldInfo::show_bindings integer overflow ( #1313 ) 0.17.4 - February 21st, 2026 PE: Fixed the address type in the TLS builder (by Immortalety in PR #1296 ) MachO: Fixed lief.MachO.Binary.virtual_address_to_offset() ( lief::macho::Binary::virtual_address_to_offset ; lief.MachO.Binary.virtual_address_to_offset() ; LIEF::MachO::Binary::virtual_address_to_offset() ) to properly handle non-file-backed segments, such as __DATA segments containing only ZEROFILL sections like __bss (by jalopezg-git in PR #1301 , fixing #1299 ). Fixed patch_relocation() to correctly process tagged pointers (by jalopezg-git in PR #1302 , fixing #1300 ). COFF: Resolved a compilation conflict with the Windows minwindef.h macro #define max . CMake: Fixed compiler flag issues on Windows when compiling with clang-cl (by sigewinnefish in PR #1306 ). Python: Bumped various Python backend build dependencies in api/python/build-requirements.txt to support Python 3.14 when compiling from sources ( #1304 ). 0.17.3 - January 24th, 2026 PE: Fixed bug with resources ( #1281 ). Fixed VA/RVA confusion in the PE builder ( #1284 ). 0.17.2 - January 3rd, 2026 Mach-O: Differentiate Mach-O FAT magic bytes and Java classes (by wangmot , #1215 ). Compilation: Fixed MinGW compilation for some configurations (by TheBrokenRail , dabbb72 ). PE: Fixed alignment issue when rebuilding PE relocations ( #1261 ). Fixed infinite loop when processing v2 dynamic relocations (by chengyongru , fixing #1273 ). ELF: Ensure that added DYN ELF sections are properly aligned (by schmchrt , fixing #1261 ). Fixed GnuHash null dereference ( #1277 ). Mach-O: Fixed major performance issue when parsing certain Mach-O files (by trevor-e , fixing #1262 ). 0.17.1 - October 25th, 2025 ELF: Fixed #1251 . Compilation: Fixed missing visibility ( #1254 ). Fixed incorrect paging computations that occurred when only a subset of formats was enabled. Fixed include issue with the COFF format. 0.17.0 - September 14th, 2025 BinaryNinja & Ghidra Plugins LIEF-based plugins for Binary Ninja and Ghidra have been bootstrapped here: Ghidra plugin BinaryNinja plugin LIEF Tools I initiated a Tools section which aims at providing utilities based on LIEF (mostly CLI): lief-patchelf Assembler: Add support for Contextual Assembly Patching DSC: Add enum for the latest dyld shared cache version introducing changes in the header layout ( dyld-1284.13 - 2025-04-25 ) uint64_t dynamicDataOffset; uint64_t dynamicDataMaxSize; uint32_t tproMappingsOffset; uint32_t tproMappingsCount; + uint64_t functionVariantInfoAddr; + uint64_t functionVariantInfoSize; + uint64_t prewarmingDataOffset; + uint64_t prewarmingDataSize; }; Add enum for the latest dyld shared cache version introducing changes in the header layout ( dyld-1231.3 - 2024-09-24 ) uint64_t dynamicDataOffset; uint64_t dynamicDataMaxSize; + uint32_t tproMappingsOffset; + uint32_t tproMappingsCount; }; Fix symbol resolution issue: #1127 PE: Please check LIEF 0.17.0 - PE changelog luadebug added support for pretty printing OID value and non-roman characters in X509 certificates (see: #1226 , #1219 ) COFF: Initial support for the COFF format: see the COFF section Mach-O: Initial support for lief.MachO.FunctionVariants ( lief::macho::commands::FunctionVariants ; lief.MachO.FunctionVariants ; LIEF::MachO::FunctionVariants ) and lief.MachO.FunctionVariantFixups ( lief::macho::commands::FunctionVariantFixups ; lief.MachO.FunctionVariantFixups ; LIEF::MachO::FunctionVariantFixups ) commands ( LC_FUNCTION_VARIANTS, LC_FUNCTION_VARIANT_FIXUPS ) Add support for lief.MachO.Note ( lief::macho::commands::Note ; lief.MachO.NoteCommand ; LIEF::MachO::NoteCommand ) command ( LC_NOTE ) Add support for lief.MachO.AtomInfo ( lief::macho::commands::AtomInfo ; lief.MachO.AtomInfo ; LIEF::MachO::AtomInfo ) command ( LC_ATOM_INFO ) Add support for modifying Mach-O commands that embed variable-length data ( #1204 , #1125 ). See: RPath and Library Path Modification . # Change library name for lib in macho.libraries: lib.name += \"/some/path/lib.dylib\" # Change rpath for rpath in macho.rpaths: rpath.path += '/a/very/long/path/that/needs/expansion' Add lief.MachO.Binary.find_library() ( lief::macho::Binary::find_library ; lief.MachO.Binary.find_library() ; LIEF::MachO::Binary::find_library() ) To void #define conflicts with Apple SDK, the following enums have been renamed: Python - lief.MachO.FAT_MAGIC + lief.MachO.MAGIC_FAT - lief.MachO.FAT_CIGAM + lief.MachO.CIGAM_FAT - lief.MachO.Symbol.ORIGIN.LC_SYMTAB + lief.MachO.Symbol.ORIGIN.SYMTAB - lief.MachO.Section.TYPE.S_4BYTE_LITERALS + lief.MachO.Section.TYPE.IS_4BYTE_LITERALS - lief.MachO.Section.TYPE.S_8BYTE_LITERALS + lief.MachO.Section.TYPE.IS_8BYTE_LITERALS - lief.MachO.Section.TYPE.S_16BYTE_LITERALS + lief.MachO.Section.TYPE.IS_16BYTE_LITERALS C++ - MACHO_TYPES::MH_MAGIC - MACHO_TYPES::MH_CIGAM - MACHO_TYPES::MH_MAGIC_64 - MACHO_TYPES::MH_CIGAM_64 - MACHO_TYPES::FAT_MAGIC - MACHO_TYPES::FAT_CIGAM + MACHO_TYPES::MAGIC + MACHO_TYPES::CIGAM + MACHO_TYPES::MAGIC_64 + MACHO_TYPES::CIGAM_64 + MACHO_TYPES::MAGIC_FAT + MACHO_TYPES::CIGAM_FAT - Section::TYPE::S_16BYTE_LITERALS + Section::TYPE::IS_16BYTE_LITERALS - Section::TYPE::S_4BYTE_LITERALS + Section::TYPE::IS_4BYTE_LITERALS - Section::TYPE::S_8BYTE_LITERALS + Section::TYPE::IS_8BYTE_LITERALS - Symbol::ORIGIN::LC_SYMTAB + Symbol::ORIGIN::SYMTAB ELF: LIEF newly-inserted sections are now compatible with a strip after the modification of the binary (see: Adding a section/segment ) Enhance support for IA64 architecture. Introduce lief.ELF.Segment.raw_flags to access the raw (integer) value of the flag If an ELF binary uses a custom page size, its value can be defined in the parser configuration: lief.ELF.ParserConfig.page_size ( lief::elf::ParserConfig::page_size ; lief.ELF.ParserConfig.page_size ; LIEF::ELF::ParserConfig::page_size ). Add support for SH4 Add suport for x32/ILP32 ELF binaries ( #1225 ) Add support for S390x Better endianess support when writing back a binary. Enhance support for removing segments ( #1233 ): lief.ELF.Binary.remove_segment() ( lief::elf::Binary::remove_segment ; lief::elf::Binary::remove_segments_by_type ; lief.ELF.Binary.remove() ; void LIEF::ELF::Binary::remove(const Segment &, bool) ; void LIEF::ELF::Binary::remove(Segment::TYPE, bool) ) Enhance support for removing or modifying symbol versions (related to the lief-patchelf initiative) New doc section: Symbol Versions New doc section: R[UN]PATH Modification DWARF: LIEF extended can now process DWARF debug info in PE binaries Add support for creating DWARF: DWARF Editor (require extended version >= 0.17.0.2623 ) PDB: Add lief.pdb.is_pdb ( lief::pdb::is_pdb ; lief.is_pdb() ; bool LIEF::pdb::is_pdb(const std::std::string &)() ) Add support for CodeView symbols: S_COMPILE3, S_COMPILE2, S_BUILDINFO, S_ENVBLOCK . These symbols are exposed through the interface lief.pdb.BuildMetadata ( lief::pdb::BuildMetadata ; lief.pdb.BuildMetadata ; LIEF::pdb::BuildMetadata ), which can be accessed using lief.pdb.CompilationUnit.build_metadata() ( lief::pdb::CompilationUnit::build_metadata ; lief.pdb.CompilationUnit.build_metadata ; LIEF::pdb::CompilationUnit::build_metadata() ). This metadata provides build time information such as: Module Name : * Linker * Build Metadata: Frontend Version: 0.0.0.0 Backend Version : 14.37.32825.0 Tool Version : Microsoft (R) LINK Language : LINK Target : X64 Environment: cwd: C:\\Users\\romai\\dev\\rust\\ast-grep exe: C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\[...] pdb: C:\\Users\\romai\\dev\\rust\\ast-grep\\target\\debug\\deps\\ast_grep.pdb cmd: /NOLOGO /LIBPATH:C:\\Users\\romai\\dev\\rust\\ast-grep\\target\\[...] Module Name : std-4ee9ee8805e6ac55.std.ddad90bab7781587-cgu.0.rcgu.o Object : C:\\Users\\romai\\scoop\\persist\\rustup\\.rustup\\toolchains\\[...] Build Metadata: Frontend Version: 1.74.0.0 Backend Version : 17004.0.0.0 Tool Version : clang LLVM (rustc version 1.74.0 (79e9716c9 2023-11-13)) Language : RUST Target : X64 Build Info: Current directory: /rustc/79e9716c980570bfd1f666e3b16ac583f0168962 Build tool : C:\\a\\rust\\rust\\build\\x86_64-pc-windows-msvc\\stage1\\bin\\rustc.exe Source file : library\\std\\src\\lib.rs\\@\\std.ddad90bab7781587-cgu.0 Command line : \"-cc1\" \"--crate-name\" \"std\" \"--edition=2021\" [...] OAT: Parsing Android OAT files requires to explicitly use lief.OAT.parse() import lief # Before LIEF 0.17.0 this function returned a lief.OAT.Binary object lief.parse(\"CallDeviceId.oat\") # Since LIEF 0.17.0 this function returns a lief.ELF.Binary object lief.parse(\"CallDeviceId.oat\") # Return a lief.OAT.Binary object lief.OAT.parse(\"CallDeviceId.oat\") Abstraction: Expose lief.abstract.Binary.page_size() ( lief::generic::Binary::page_size ; lief.Binary.page_size ; LIEF::Binary::page_size() ) Add lief.abstract.Binary.load_debug_info() ( lief::generic::Binary::load_debug_info ; lief.Binary.load_debug_info() ; LIEF::Binary::load_debug_info() ) to attach an external debug file to a lief.abstract.Binary ( lief::generic::Binary ; lief.Binary ; LIEF::Binary ). See these sections for more details: DWARF: Loading an external debug file PDB: Loading an external debug file Add lief.DebugInfo.find_function_address() ( lief::generic::DebugInfo::find_function_address ; lief.DebugInfo.find_function_address() ; LIEF::DebugInfo::find_function_address() ) Extended: Fix issue in the Python bindings while trying to access lief.__LIEF_MAIN_COMMIT__ Fix CMake issue with find_package(lief-extended) Use LLVM 21.1.x Build System: LIEF is now available in vcpkg . Many thanks to luadebug for this support. Dependencies: Move to tl-expected 1.2.0 Move to utfcpp 4.0.6 Move to mbedtls 3.6.4 Move to spdlog 1.15.3 Move to nlohmann/json 3.12.0 Upgrade nanobind to version v2.8.x Utilities: Add LIEF.dump() ( lief::dump ; lief::dump_with_limit ; lief.dump() ; LIEF::dump() ) 0.16.7 - October 5th, 2025 Python: Add wheels for Python 3.14 Mach-O: Fix has_nx ( #1218 ) Fix #1228 ELF: Fix #1241 Other: #1220 0.16.6 - May 29th, 2025 Compilation: Fix missing header ( #1192 ) Fix GCC 15 issue ( #1203 ) Fix #1210 Mach-O: Fix use-after-move ( #1212 ) Fix #1206 Python: Fix Python logger warning Other: #1217 #1216 0.16.5 - April 19th, 2025 ELF: Relax the condition over the DT_SYMENT entry ( #1177 ) Mach-O: Modifications on lief.MachO.EncryptionInfo ( lief::macho::commands::EncryptionInfo ; lief.MachO.EncryptionInfo ; LIEF::MachO::EncryptionInfo ) are now committed when doing a write() . See: #1173 Compilation: Fix compilation issue when targeting Linux i386/i686 ( #1189 ) Better support for external fmt library Fix fmt unicode issue Fix missing cstdio ( #1184 ) Packages: Add Python, Rust, SDK packages for Windows ARM64 ( aarch64-pc-windows-msvc ) Add Python, Rust, SDK packages for Linux Musl ARM64 ( aarch64-unknown-linux-musl ) Add Python, Rust, SDK packages for Linux Musl i686 ( i686-unknown-linux-musl ) 0.16.4 - February 23rd, 2025 Python: Relax checks on the enum verification. As described in #1170 and #1172 , an invalid enum led to an unrecoverable error. The new behavior now returns the raw int value if it can’t be converted into the given enum. Upgrade nanobind to version v2.5.0 PE: Fix export forwarding issue ( #1168 ) MachO: Fix truncated nlist_t.n_type when rewriting a Mach-O binary 0.16.3 - February 1st, 2025 ELF: Fix issue when parsing the dynamic table with an invalid offset (bug found by lebr0nli ) Fix endianness issue with IA64 binaries ( #1164 ) PE: Fix missing original forwarded function name ( #1166 ) Misc: Add support for spdlog compiled with SPDLOG_WCHAR_FILENAMES ( #1147 ) 0.16.2 - January 1st, 2025 Compilation: Fix broken aarch64 Python wheel which is related to a toolchain issue ( #1146 ) 0.16.1 - December 26th, 2024 MachO: Various fixes from DzenIsRich & peledins-zimperium Thanks to them, Mach-O modification is more reliable. Fix issue when building with -DLIEF_MACHO=ON (see: #1138 ) Rust: Fix min-rustc version issue (see: 75a27f0 ) Compilation: Fix missing LIEF_API visibility ( e01f92a , #1140 ) 0.16.0 - December 10th, 2024 Abstraction: Add LIEF.get_int_from_virtual_address() ( lief::elf::Binary::get_int_from_virtual_address ; lief.Binary.get_int_from_virtual_address() ; LIEF::Binary::get_int_from_virtual_address() ) to read an integer value at a specific virtual address C++ LIEF::Binary& bin; uint16_t short_value = bin.get_int_from_virtual_address(0x140002CC8); Python some_bin: lief.Binary = ... long_value = some_bin.get_int_from_virtual_address(0x140002CC8, 4) # or long_value = some_bin.get_int_from_virtual_address(0x140002CC8, ctypes.sizeof(ctypes.c_uint32)) Rust elf: &lief::elf::Binary let value: i16 = elf.get_int_from_virtual_address::(0x401126).unwrap(); Global code cleaning (especially, lief.Header.ARCHITECTURES ( lief.Header.ARCHITECTURES ; LIEF::Header::ARCHITECTURES ) and lief.Header.MODES ( lief.Header.MODES ; LIEF::Header::MODES ) is now more meaningful) Re-scope lief.ARCHITECTURES into lief.Header.ARCHITECTURES ( lief.Header.ARCHITECTURES ; LIEF::Header::ARCHITECTURES ) Re-scope lief.MODES into lief.Header.MODES ( lief.Header.MODES ; LIEF::Header::MODES ) Re-scope lief.OBJECT_TYPES into lief.Header.OBJECT_TYPES ( lief.Header.OBJECT_TYPES ; LIEF::Header::OBJECT_TYPES ) Re-scope lief.ENDIANNESS into lief.Header.ENDIANNESS ( lief.Header.ENDIANNESS ; LIEF::Header::ENDIANNESS ) MachO: Fix endianness support ( #1110 ) Add helpers to determine the platform targeted by a Mach-O binary: lief.MachO.Binary.is_ios() ( lief::macho::Binary::is_ios ; lief.MachO.Binary.is_ios ; LIEF::MachO::Binary::is_ios() ) lief.MachO.Binary.is_macos() ( lief::macho::Binary::is_macos ; lief.MachO.Binary.is_macos ; LIEF::MachO::Binary::is_macos() ) lief.MachO.Binary.platform() ( lief::macho::Binary::platform ; lief.MachO.Binary.platform ; LIEF::MachO::Binary::platform() ) Expose an iterator over the stub entries located in __stubs,__auth_stubs,__symbol_stub,__picsymbolstub4 : lief.MachO.Binary.symbol_stubs() ( lief::macho::Binary::symbol_stubs ; lief.MachO.Binary.symbol_stubs ; LIEF::MachO::Binary::symbol_stubs() ) - lief.MachO.Stub ( lief::macho::Stub ; lief.MachO.Stub ; LIEF::MachO::Stub ) Add support for the LC_SUBCLIENT command: lief.MachO.SubClient ( lief::macho::commands::SubClient ; lief.MachO.SubClient ; LIEF::MachO::SubClient ) Add support for the LC_ROUTINE/LC_ROUTINE64 command: lief.MachO.Routine ( lief::macho::commands::Routine ; lief.MachO.Routine ; LIEF::MachO::Routine ) Expose an iterator for the indirect symbols in lief.MachO.DynamicSymbolCommand ( lief::macho::commands::DynamicSymbolCommand ; lief.MachO.DynamicSymbolCommand ; LIEF::MachO::DynamicSymbolCommand ) Add lief.MachO.Binary.bindings() ( lief::macho::Binary::bindings ; lief.MachO.Binary.bindings ; LIEF::MachO::Binary::bindings() ) to iterate over the bindings info located in lief.MachO.DyldInfo ( lief::macho::commands::DyldInfo ; lief.MachO.DyldInfo ; LIEF::MachO::DyldInfo ) or lief.MachO.ChainedBindingInfo ( lief::macho::binding_info::Chained ; lief.MachO.ChainedBindingInfo ; LIEF::MachO::ChainedBindingInfo ) Add lief.MachO.IndirectBindingInfo ( lief::macho::binding_info::Indirect ; lief.MachO.IndirectBindingInfo ; LIEF::MachO::IndirectBindingInfo ) to represent a binding operation inferred from the indirect symbol table. This can be handy if a Mach-O does not have the commands lief.MachO.DyldInfo ( lief::macho::commands::DyldInfo ; lief.MachO.DyldInfo ; LIEF::MachO::DyldInfo ) or lief.MachO.ChainedBindingInfo ( lief::macho::binding_info::Chained ; lief.MachO.ChainedBindingInfo ; LIEF::MachO::ChainedBindingInfo ) (e.g. extracted shared cache library) PE: Fix authenticode error while reading RSA PKCS#1 1.5 padding ELF: Fix issue when multiple empty strings are present in the .symtab section ( #1124 ) Add lief.ELF.Relocation.resolve() ( lief::elf::Relocation::resolve ; lief::elf::Relocation::resolve_with_base_address ; lief.ELF.Relocation.resolve() ; LIEF::ELF::Relocation::resolve() ) to resolve the value of relocations Add support for eBPF relocations. Add support for GNU_PROPERTY_AARCH64_FEATURE_PAUTH GNU property note: lief.ELF.AArch64PAuth ( lief.ELF.AArch64PAuth ; LIEF::ELF::AArch64PAuth ). Add lief.ELF.Binary.is_targeting_android ( lief::elf::Binary::is_targeting_android ; lief.ELF.Binary.is_targeting_android ; LIEF::ELF::Binary::is_targeting_android() ) to check if an ELF targets Android Fix a critical error when rewriting ELF file with DT_RELR relocations. This error leads to a crash of the modified binary. Fix error while (re)generating ELF’s RELR relocations ( #1097 ) Add support for RISC-V architecture Fix bug when trying to remove a dynamic symbol that is associated with multiple relocations ( #1089 ) Rust: Mutable API are progressively introduced: ELF: lief::elf::Binary::write lief::elf::Binary::write_with_config lief::elf::Binary::add_library PE: lief::pe::Binary::write MachO: lief::macho::Binary::write lief::macho::Binary::write_with_config lief::macho::Binary::add_library Thanks to Huntragon Rust bindings can be used without openssl (see: #1105 ) Rust precompiled Linux packages are now supported for Debian 10 & Ubuntu 19.10. Before, they require at least Debian 11 & Ubuntu 20.04 Add support for the x86_64-unknown-linux-musl target which allows to generate full static executable. Add lief::elf::header::Arch Add lief::elf::dynamic::Flags ObjC: The header-like generation ( lief.ObjC.Metadata.to_decl() ( lief::objc::Metadata::to_decl ; lief.objc.Metadata.to_decl() ; LIEF::objc::Metadata::to_decl() )) is now including method’s address as a comment: Before @interface GCKUIImageHints { long long _imageType; NSObject * _customData; struct CGSize _imageSize; } + (bool)supportsSecureCoding:(GCKUIImageHints *)self :(SEL)id; - (bool)isEqual:(GCKUIImageHints *)self :(SEL)id :(NSObject *)arg2; After @interface GCKUIImageHints { long long _imageType; NSObject * _customData; struct CGSize _imageSize; } // Address: 0x00001aa448 + (bool)supportsSecureCoding:(GCKUIImageHints *)self :(SEL)id; // Address: 0x00001aa5ec - (bool)isEqual:(GCKUIImageHints *)self :(SEL)id :(NSObject *)arg2; Fix lief.ObjC.Method.address() ( lief::objc::Method::address ; lief.objc.Method.address ; LIEF::objc::Method::address() ) for small methods. The output of lief.ObjC.Metadata.to_decl() ( lief::objc::Metadata::to_decl_with_opt ; lief.objc.Metadata.to_decl() ; LIEF::objc::Metadata::to_decl() ) can now be configured with lief.ObjC.DeclOpt ( lief::objc::DeclOpt ; lief.objc.DeclOpt ; LIEF::objc::DeclOpt ). DWARF: Add lief.dwarf.Function.is_external() ( lief::dwarf::Function::is_external ; lief.dwarf.Function.is_external ; LIEF::dwarf::Function::is_external() ) Add lief.dwarf.CompilationUnit.imported_functions() ( lief::dwarf::CompilationUnit::imported_functions ; lief.dwarf.CompilationUnit.imported_functions ; LIEF::dwarf::CompilationUnit::imported_functions() ) Add DW_TAG_typedef support Extended: Note LIEF extended is now open to everyone C++ SDK is now available Rust package is now available Initial assembler support: Assembler Initial disassembler support: Disassembler Linux Python wheels are now manylinux_2_27 compliants. In other words, they are working with a glibc from at least 2018. Support for Dyld shared cache lief.ELF.Symbol.demangled_name() ( lief::elf::Symbol::demangled_name ; lief.ELF.Symbol.demangled_name ; LIEF::ELF::Symbol::demangled_name() ) is working on all platforms (not only unix-based builds) lief.MachO.Symbol.demangled_name() ( lief::macho::Symbol::demangled_name ; lief.MachO.Symbol.demangled_name ; LIEF::MachO::Symbol::demangled_name() ) is working on all platforms (not only unix-based builds) lief.PE.DelayImportEntry.demangled_name() ( lief::pe::delay_import::DelayImportEntry::demangled_name ; lief.PE.DelayImportEntry.demangled_name ; LIEF::PE::DelayImportEntry::demangled_name() ) lief.PE.ImportEntry.demangled_name() ( lief::pe::import::ImportEntry::demangled_name ; lief.PE.ImportEntry.demangled_name ; LIEF::PE::ImportEntry::demangled_name() ) lief.PE.ExportEntry.demangled_name() ( lief::pe::export::Entry::demangled_name ; lief.PE.ExportEntry.demangled_name ; LIEF::PE::ExportEntry::demangled_name() ) pe = lief.PE.parse(\"some.exe\") if exp := pe.get_export(): for entry in exp.entries: # e.g.void __cdecl Platform::Details::EventSourceUninitialize(void **) print(entry.demangled_name) for imp in pe.imports: for entry in imp.entries: # e.g. void __cdecl std::_Xlength_error(char const *) print(entry.demangled_name) Add LIEF.demangle() ( lief::demangle ; lief.demangle() ; LIEF::demangle() ) to demangle symbols (c.f. #1054 ) The extended version is now using a versioning matching LIEF regular version Python Bindings: Upgrade nanobind from 1.8.0 to 2.4.0 *.pyi stubs are now generated by nanobind (replacing mypy’s stugen) Dependencies: Upgrade MbedTLS from 3.2.1 to 3.6.1 doc: Global restructuring of the documentation Add Sphinx cross-reference support for Rust. For instance, this link: lief::elf::Binary::debug_info references the documentation of debug_info in the Rust documentation page. Add cross-api menu directive. For instance, this link : lief.dwarf.DebugInfo ( lief::dwarf::DebugInfo ; lief.dwarf.DebugInfo ; LIEF::dwarf::DebugInfo ) toggles a menu to access the documentation of DWARF’s debug info for Rust, Python & C++. 0.15.1 - July 23th, 2024 MachO: Fix missing commit for .hwx support 0.15.0 - July 21th, 2024 Extended: Note See: https://extended.lief.re and What is LIEF Extended? Add support for DWARF: DWARF Add support for PDB: PDB Add support for Objective-C: Objective-C Repo: master branch has been renamed main Rust: First (beta) release of the bindings (c.f. Rust ) ELF: Add support to create custom notes ( #1026 ): elf: lief.ELF.Binary = ... elf += lief.ELF.Note.create( name=\"my-custom-note\", original_type=lief.ELF.Note.TYPE.UNKNOWN, description=list(b\"Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed\"), section_name=\".lief.note.custom\" ) config = lief.ELF.Builder.config_t() config.notes = True elf.write(\"/tmp/new-binary.elf\", config) Add lief.ELF.Binary.get_relocated_dynamic_array() which allows to get a relocated view of the of init/fini entries. This function can handy ELF init array/fini array functions are defined through relocations. See: #1058 , #626 Add support for QNX Stack note ( #1065 ) The static_symbols API functions has been renamed in symtab_symbols . LIEF was naming symbols located in the .symtab sections as static symbols in opposition to the .dynsym symbols. This naming can be confusing since the concept of static symbol in a program is well defined (i.e. static bool my_var ) and not applicable in this case. Therefore, the xxx\\_static\\_symbols API is has been renamed xxx\\_symtab\\_symbol . Re-scope DYNAMIC_TAGS into lief.ELF.DynamicEntry.TAG Re-scope E_TYPE into lief.ELF.Header.FILE_TYPE Re-scope VERSION into lief.ELF.Header.VERSION Re-scope ELF_CLASS into lief.ELF.Header.CLASS Re-scope ELF_DATA into lief.ELF.Header.ELF_DATA Re-scope OS_ABI into lief.ELF.Header.OS_ABI Re-scope ELF_SECTION_TYPES into lief.ELF.Section.TYPE Re-scope ELF_SECTION_FLAGS into lief.ELF.Section.FLAGS Re-scope SYMBOL_BINDINGS into lief.ELF.Symbol.BINDING Re-scope ELF_SYMBOL_TYPES into lief.ELF.Symbol.TYPE Re-scope ELF_SYMBOL_VISIBILITY into lief.ELF.Symbol.VISIBILITY Re-scope SEGMENT_TYPES into lief.ELF.Segment.TYPE Re-scope ELF_SEGMENT_FLAGS into lief.ELF.Segment.FLAG Re-scope DYNAMIC_FLAGS_1 into lief.ELF.DynamicEntryFlags.FLAG Re-scope DYNAMIC_FLAGS into lief.ELF.DynamicEntryFlags.FLAG Re-scope DYNSYM_COUNT_METHODS into lief.ELF.ParserConfig.DYNSYM_COUNT Re-scope RELOCATION_PURPOSES into lief.ELF.Relocation.PURPOSE RELOC_x86_64 , RELOC_i386 , … have been re-scoped and merged into lief.ELF.Relocation.TYPE Add support for Android packed relocation format ( DT_ANDROID_REL{A} ) Add support for relative relocation format ( DT_RELR ) PE: Authenticode: Add partial support for the following PKCS #7 attributes: 1.3.6.1.4.1.311.3.3.1 - Ms-CounterSign ( lief.PE.MsCounterSign ) 1.3.6.1.4.1.311.10.3.28 - Ms-ManifestBinaryID ( lief.PE.MsManifestBinaryID ) 1.3.6.1.4.1.311.2.6.1 - SPC_RELAXED_PE_MARKER_CHECK_OBJID ( lief.PE.SpcRelaxedPeMarkerCheck ) 1.2.840.113549.1.9.16.2.47 - SIGNING_CERTIFICATE_V2 ( lief.PE.SigningCertificateV2 ) 1.2.840.113549.1.9.16.1.4 - PKCS#9 TSTInfo ( lief.PE.PKCS9TSTInfo ) Add lief.PE.CodeViewPDB.guid attribute ( #480 ) Move lief.PE.OptionalHeader.computed_checksum to lief.PE.Binary.compute_checksum() In previous versions of LIEF, lief.PE.OptionalHeader.checksum was re-computed (on purpose) in the parsing phase. On large binaries, this re-computation can have a strong impact on the performances. Thus, this computation has been deferred to a dedicated method lief.PE.Binary.compute_checksum() pe = lief.PE.parse(\"...\") # Before: computed = pe.optional_header.computed_checksum # Now: computed = pe.compute_checksum() MachO: Add support to modify Mach-O rpath (see: #1074 ) Add helper lief.MachO.Binary.support_arm64_ptr_auth to check if a Mach-O binary is supporting ARM64 pointer authentication (arm64e) Fix major performance issue when processing Mach-O binaries on Windows & macOS Add generic lief.MachO.UnknownCommand to support Apple private Load commands not officially supported by LIEF. Re-scope LOAD_COMMAND_TYPES into lief.MachO.LoadCommand.TYPE Re-scope FILE_TYPES into lief.MachO.Header.FILE_TYPE Re-scope HEADER_FLAGS into lief.MachO.Header.FLAGS Re-scope MACHO_SEGMENTS_FLAGS into lief.MachO.SegmentCommand.FLAGS Re-scope MACHO_SECTION_TYPES into lief.MachO.Section.TYPE Re-scope MACHO_SECTION_FLAGS into lief.MachO.Section.FLAGS Re-scope REBASE_TYPES into lief.MachO.DyldInfo.REBASE_TYPE Re-scope REBASE_OPCODES into lief.MachO.DyldInfo.REBASE_OPCODES Re-scope BIND_OPCODES into lief.MachO.DyldInfo.BIND_OPCODES Re-scope BINDING_CLASS into lief.MachO.DyldBindingInfo.CLASS Re-scope BIND_TYPES into lief.MachO.DyldBindingInfo.TYPE Re-scope EXPORT_SYMBOL_FLAGS into lief.MachO.ExportInfo.FLAGS Re-scope EXPORT_SYMBOL_KINDS into lief.MachO.ExportInfo.KIND Re-scope RELOCATION_ORIGINS into lief.MachO.Relocation.ORIGIN Re-scope SYMBOL_ORIGINS into lief.MachO.Symbol.ORIGIN Re-scope VM_PROTECTIONS into lief.MachO.SegmentCommand.VM_PROTECTIONS Re-scope CPU_TYPES into lief.MachO.Header.CPU_TYPE CMake: LIEFConfig.cmake is now installed in /lib/cmake/LIEF/ instead of /share/LIEF/cmake/ Python Bindings: Add lief.disable_leak_warning() to disable Nanobind warning about “leaks”. Warning These warnings does not necessarily mean that LIEF leak objects. These warnings might happen in Cyclic garbage collection . Documentation: Add icons Include inheritance diagram for Python API (e.g. lief.ELF.Note ) 0.14.1 - February 11th, 2024 ELF: Fix regression in Symbol Version Definition processing ( #1014 ) PE: Address #1016 by creating aliases: lief.PE.ContentInfo.digest to lief.PE.SpcIndirectData.digest lief.PE.ContentInfo.digest_algorithm to lief.PE.SpcIndirectData.digest_algorithm Python: Fix regression in iterator’s performances 0.14.0 - January 20, 2024 ELF: Add support for the GNU note properies ( #975 ). Example: elf = lief.ELF.parse(\"...\") note = elf.get(lief.ELF.Note.TYPE.GNU_PROPERTY_TYPE_0) aarch64_feat: lief.ELF.AArch64Feature = note.find(lief.ELF.NoteGnuProperty.Property.TYPE.AARCH64_FEATURES) if lief.ELF.AArch64Feature.FEATURE.BTI in aarch64_feat.features: print(\"BTI supported\") See: lief.ELF.NoteGnuProperty lief.ELF.AArch64Feature lief.ELF.NoteNoCopyOnProtected lief.ELF.StackSize lief.ELF.X86Features lief.ELF.X86ISA Refactoring of the ELF note processing Fix relocation issue when using -Wl,--emit-relocs (c.f. #897 / #898 by adamjseitz ) Improve the computation of the dynamic symbols thanks to adamjseitz (c.f. #922 ) Add support for the LoongArch architecture thanks to loongson-zn (c.f. #921 ) Add a lief.ELF.ParserConfig interface that can be used to tweak which parts of the ELF format should be parsed. Example: config = lief.ELF.ParserConfig() # Skip parsing static and dynamic symbols config.parse_static_symbols = False config.parse_dyn_symbols = False elf = lief.ELF.parse(\"target.elf\", config) MachO: The fileset name is now stored in lief.MachO.Binary.fileset_name (instead of lief.MachO.Binary.name) PE: RESOURCE_SUBLANGS has been removed RESOURCE_LANGS is now defined in a dedicated header: LIEF/PE/resources/langs.hpp RESOURCE_TYPES is now scoped in ResourcesManager::TYPE GUARD_CF_FLAGS is now scoped as IMAGE_GUARD in lief.PE.LoadConfigurationV1 SECTION_CHARACTERISTICS is now scoped within the Section class instead of being globally defined: # Before lief.PE.SECTION_CHARACTERISTICS.CNT_CODE # Now: lief.PE.Section.CHARACTERISTICS.CNT_CODE DATA_DIRECTORY is now scoped within the DataDirectory class instead of being globally defined: # Before lief.PE.DATA_DIRECTORY.IAT # Now: lief.PE.DataDirectory.TYPES.IAT MACHINE_TYPES and HEADER_CHARACTERISTICS are now scoped within the Header class instead of being globally defined: # Before lief.PE.MACHINE_TYPES.AMD64 # Now: lief.PE.Header.MACHINE_TYPES.AMD64 lief.PE.Header.characteristics now returns a list/std::vector instead of a set . lief.PE.OptionalHeader.dll_characteristics_lists now returns a list / std::vector instead of a set . SUBSYSTEM and DLL_CHARACTERISTICS are now scoped within the OptionalHeader class instead of being globally defined: # Before lief.PE.SUBSYSTEM.NATIVE # Now: lief.PE.OptionalHeader.SUBSYSTEM.NATIVE lief.PE.DosHeader.used_bytes_in_the_last_page has been renamed in lief.PE.DosHeader.used_bytes_in_last_page Refactoring of the Debug directory processing: lief.PE.Debug is now the root class of: lief.PE.CodeView / lief.PE.CodeView , lief.PE.Pogo , lief.PE.Repro . The parsing logic has been cleaned and the tests updated. Add a lief.PE.ParserConfig interface that can be used to tweak which parts of the PE format should be parsed ( #839 ). Example: config = lief.PE.ParserConfig() # Skip parsing PE authenticode config.parse_signature = False pe = lief.PE.parse(\"pe.exe\", config) Abstraction: LIEF::EXE_FORMATS is now scoped in LIEF::Binary::FORMATS All the Binary classes now implement classof: std::unique_ptr bin = LIEF::Parser::parse(\"...\"); if (LIEF::PE::Binary::classof(bin.get())) { auto& pe_file = static_cast(*bin); } General Design: Python parser functions (like: lief.PE.parse() ) now accept os.PathLike arguments like pathlib.Path ( #974 ). Remove the lief.Binary.name attribute LIEF is now compiled with C++17 (the API remains C++11 compliant) Switch to nanobind for the Python bindings. CI are now more efficient. The Python documentation for properties now contains the type of the property. 0.13.2 - June 17, 2023 PE: Fix authenticode inconsitency ( #932 ) ELF: Fix missing undef ( #929 ) 0.13.1 - May 28, 2023 PE: Fix PE authenticode verification issue in the case of special characters ( #912 ) Misc: Fix mypy stubs ( #909 ) Fix missing include ( #918 ) Fix C99 comments ( #916 ) Fix AArch64 docker image ( #904 ) 0.13.0 - April 9, 2023 ELF: Fix overflow issue in segments (c.f. #845 found by liyansong2018 ) Fix missing relationship between symbols and sections (c.f. #841 ) Fix coredump parsing issue (c.f. #830 found by Lan1keA ) Fix and (re)enable removing dynamic symbols (c.f. #828 ) Add support for NT_GNU_BUILD_ATTRIBUTE_OPEN and NT_GNU_BUILD_ATTRIBUTE_FUNC (c.f. #816 ) [CVE-2022-38497] Fix ELF core parsing issue ( #766 found by CCWANG19 ) [CVE-2022-38306] Fix a heap overflow found by CCWANG19 ( #763 ) aeflores fixed an issue when there are multiple versions associated with a symbol (see: #749 for the details). Handle binaries compiled with the -static-pie flag correctly (see: #747 ) Add support for modifying section-less binaries. The ELF Section objects gain the lief.ELF.Section.as_frame() method which defines the section as a framed section. A framed section is a section that concretely does not wraps data and can be corrupted. Example: elf = lief.parse(\"/bin/ssh\") text = elf.get_section(\".text\").as_frame() # We can now corrupt all the fields of the section text.offset = 0xdeadc0de text.size = 0xffffff text.address = 0x123 elf.write(\"/tmp/out\") Add API to precisely define how the segments table should be relocated. One might want to enforce a certain ELF layout while adding sections/ segments. It is now possible to call the method: relocate_phdr_table() to define how the segments table should be relocated for welcoming the new sections/segments: elf = lief.parse(\"...\") # Enforce a specific relocation type: # The new segments table will be shift at the end # of the file elf.relocate_phdr_table(Binary.PHDR_RELOC.FILE_END) # Add sections/segments # [...] elf.write(\"out.elf\") See: lief.ELF.Binary.relocate_phdr_table() lief.ELF.Binary.PHDR_RELOC MachO: Add rpaths iterator ( #291 ) Add support for parsing Mach-O in memory Fix a memory issue (found by bladchan via #806 ) [CVE-2022-40923] Fix parsing issue ( #784 found by bladchan ) [CVE-2022-40922] Fix parsing issue ( #781 found by bladchan ) [CVE-2022-38307] Fix a segfault when the Mach-O binary does not have segments (found by CCWANG19 via #764 ) Enable to create exports Fix the layout of the binaries modified by LIEF such as they can be (re)signed. Add support for LC_DYLD_CHAINED_FIXUPS and LC_DYLD_EXPORTS_TRIE Global enhancement when modifying the __LINKEDIT content Add API to get a Section from a specified segment’s name and section’s name. Example: sec = bin.get_section(\"__DATA\", \"__objc_metadata\") Add API to remove a Section from a specified segment’s name and section’s name. Example: sec = bin.remove_section(\"__DATA\", \"__objc_metadata\") Add lief.MachO.Binary.page_size PE: The Python API now returns bytes objects instead of List[int] Remove lief.PE.ResourceNode.sort_by_id() Fix the ordering of children of ResourceNode Remove deprecated functions related to PE hooking. Add support for new PE LoadConfiguration structures. DEX: Fix multiple parsing issues raised by bladchan Other: [CVE-2022-38497]: #765 found by CCWANG19 [CVE-2022-38495]: #767 found by CCWANG19 General Design: ZehMatt added the support to write LIEF binaries object through a std::ostream interface ( 9d55f53 ) Remove the exceptions The library contains less static initializers which should improve the loading time. Python Bindings: Move to a build system compliant with pyproject.toml Provide typing stubs: #650 PyPI releases no longer provide source distribution (sdist) Dependencies: Move to spdlog 1.11.0 Move to Pybind11 - 2.10.1 Move to nlohmann/json 3.11.2 Move to MbedTLS 3.2.1 Move to utfcpp 3.2.1 0.12.3 - November 1, 2022 This release contains several security fixes: [CVE-2022-38497] Fix ELF core parsing issue ( #766 found by CCWANG19 ) [CVE-2022-38306] Fix a heap overflow found by CCWANG19 ( #763 ) Fix a memory issue (found by bladchan via #806 ) [CVE-2022-40923] Fix parsing issue ( #784 found by bladchan ) [CVE-2022-40922] Fix parsing issue ( #781 found by bladchan ) [CVE-2022-38307] Fix a segfault when the Mach-O binary does not have segments (found by CCWANG19 via #764 ) 0.12.1 - April 08, 2022 ELF: Fix section inclusion calculations ( #692 ) PE: Fix parsing regressions ( #689 , #687 , #686 , #685 , #691 , #693 ) Compilation: Nightly builds are now upload to Saleway’s S3 server: https://lief.s3-website.fr-par.scw.cloud/latest/lief https://lief.s3-website.fr-par.scw.cloud/latest/sdk Fix GLIBCXX_USE_CXX11_ABI=1 ABI issue (see: #683 ) 0.12.0 - March 25, 2022 ELF: ahaensler added the support to insert and assign a lief.ELF.SymbolVersionAuxRequirement (see: #670 ) Enhance the ELF parser to support corner cases described by netspooky in : https://tmpout.sh/2/14.html ( 84 byte aarch64 ELF ) https://tmpout.sh/2/3.html ( Some ELF Parser Bugs ) New ELF Builder which is more efficient in terms of speed and in terms of number of segments added when modifying binaries (see: https://lief-project.github.io/blog/2022-01-23-new-elf-builder/ ) Clcanny improved (see #507 and #509 ) the reconstruction of the dynamic symbol table by sorting local symbols and non-exported symbols. It fixes the following warning when parsing a modified binary with readelf Warning: local symbol 29 found at index >= .dynsym's sh_info value of 1 MachO: Change the layout of the binaries generated by LIEF such as they are compliant with codesign checks The API to configure the MachO parser has been redesigned to provide a better granularity config = lief.MachO.ParserConfig() config.parse_dyld_bindings = False config.parse_dyld_exports = True config.parse_dyld_rebases = False lief.MachO.parse(\"/tmp/big.macho\", config) LucaMoroSyn added the support for the LC_FILESET_ENTRY . This command is usually found in kernel cache files LIEF::MachO::Binary::get_symbol now returns a pointer (instead of a reference). If the symbol can’t be found, it returns a nullptr. Add API to select a Binary from a FatBinary by its architecture. See: lief.MachO.FatBinary.take() . fat = lief.MachO.parse(\"/bin/ls\") fit = fat.take(lief.MachO.CPU_TYPES.x86_64) Handle the 0x0D binding opcode (see: #524 ) xhochy fixed performances issues in the Mach-O parser (see #579 ) PE: Adding lief.PE.OptionalHeader.computed_checksum that re-computes the lief.PE.OptionalHeader.checksum (c.f. issue #660 ) Enable to recompute the RichHeader (issue: #587 ) raw() hash() Add support for PE’s delayed imports. see: DelayImport / DelayImportEntry delay_imports lief.PE.LoadConfiguration.reserved1 has been aliased to lief.PE.LoadConfiguration.dependent_load_flags lief.PE.LoadConfiguration.characteristics has been aliased to lief.PE.LoadConfiguration.size Thanks to gdesmar , we updated the PE checks to support PE files that have a corrupted lief.PE.OptionalHeader.magic (cf. #644 ) DEX: DanielFi added support for DEX’s fields (see: #547 ) Abstraction: Abstract binary imagebase for PE, ELF and Mach-O ( lief.Binary.imagebase ) Add lief.Binary.offset_to_virtual_address() Add PE imports/exports as abstracted symbols Compilation & Integration: ekilmer updated and modernized the CMake integration files through the PR: #674 Enable to use a pre-compiled version of spdlog. This feature aims at improving compilation time when developing on LIEF. One can provide path to spdlog install through: $ python ./setup.py --spdlog-dir=path/to/lib/cmake/spdlog [...] # or $ cmake -DLIEF_EXTERNAL_SPDLOG=ON -Dspdlog_DIR=path/to/lib/cmake/spdlog ... Enable to feed LIEF’s dependencies externally (c.f. Third Party ) Replace the keywords and , or , not with && , || and ! . Dependencies: Upgrade to MbedTLS 3.1.0 Upgrade Catch2 to 2.13.8 The different dependencies can be linked externally (cf. above and Third Party ) Documentation: New section about the errors handling ( Error Handling ) and the upcoming deprecation of the exceptions. New section about how to compile LIEF for debugging/developing. See: Debugging General Design: span: LIEF now exposes Section/Segment’s data through a span interface. As std::span is available in the STL from C++20 and the LIEF public API aims at being C++11 compliant, we expose this span thanks to tcbrindle/span . This new interface enables to avoid copies of std::vector which can be costly. With this new interface, the original std::vector can be retrieved as follows: auto bin = LIEF::ELF::Parser::parse(\"/bin/ls\"); if (const auto* section = bin->get_section(\".text\")) { LIEF::span text_ref = section->content(); std::vector copy = {std::begin(text_ref), std::end(text_ref)}; } In Python, span are wrapped by a read-only memory view . The original list of bytes can be retrieved as follows: bin = lief.parse(\"/bin/ls\") section = bin.get_section(\".text\") if section is not None: memory_view = section.content list_of_bytes = list(memory_view) Exceptions: Warning We started to refactor the API and the internal design to remove C++ exceptions. These changes are described a the dedicated blog ( LIEF RTTI & Exceptions ) To highlighting the content of the blog for the end users, functions that returned a reference and which threw an exception in the case of a failure are now returning a pointer that is set to nullptr in the case of a failure. If we consider this original code: LIEF::MachO::Binary& bin = ...; try { LIEF::MachO::UUIDCommand& cmd = bin.uuid(); std::cout << cmd << \"\\n\"; } catch (const LIEF::not_found&) { // ... dedicated processing } // Other option with has_uuid() if (bin.has_uuid()) { LIEF::MachO::UUIDCommand& cmd = bin.uuid(); std::cout << cmd << \"\\n\"; } It can now be written as: LIEF::MachO::Binary& bin = ...; if (LIEF::MachO::UUIDCommand* cmd = bin.uuid();) { std::cout << *cmd << \"\\n\"; } else { // ... dedicated processing as it is a nullptr } // Other option with has_uuid() if (bin.has_uuid()) { // It ensures that it is not a nullptr LIEF::MachO::UUIDCommand& cmd = *bin.uuid(); std::cout << cmd << \"\\n\"; } See also Error Handling section List of the functions that changed 0.11.X - Patch Releases 0.11.5 - May 22, 2021 Remove usage of not in public headers ( b8e825b ) ELF: pdreiter fixed the issue #418 PE: Fix issue when computing lief.PE.Binary.sizeof_headers ( ab3f073 ) MachO: Fix error on property lief.MachO.BuildVersion.sdk (see #533 ) 0.11.4 - March 09, 2021 PE: Fix missing bound check when computing the authentihash 0.11.3 - March 03, 2021 PE: Add sanity check on the signature’s length that could lead to a std::bad_alloc exception 0.11.2 - February 24, 2021 PE: Fix regression in the behavior of the PE section’s name. One can now access the full section’s name (with trailing bytes) through lief.PE.Section.fullname (see: #551 ) 0.11.1 - February 22, 2021 PE: lief.PE.x509.is_trusted_by() and lief.PE.x509.verify() now return a better lief.PE.x509.VERIFICATION_FLAGS instead of just lief.PE.x509.VERIFICATION_FLAGS.BADCERT_NOT_TRUSTED (see: #532 ) Fix errors in the computation of the Authentihash 0.11.0 - January 19, 2021 ELF: mkomet updated enums related to Android (see: 9dd641d ) aeflores added MIPS relocations support in the ELF parser Fix extend() on a ELF section (cf. issue #477 ) Fix issue when exporting symbols on empty-gnu-hash ELF binary ( 1381f9a ) Fix reconstruction issue when the binary is prelinked (cf. issue #466 ) Add DF_1_PIE flag Fix parsing issue of the .eh_frame section when the base address is not 0. JanuszL enhanced the algorithm that computes the string table. It moves from a N^2 algorithm to a Nlog(N) ( 1e0c4e8 ). Fix .eh_frame parsing issue ( b57f323 ) aeflores fixed parsing issue in ELF relocations ( 6c53646 ) Add PT_GNU_PROPERTY enum Bug fix in the symbols table reconstruction (ELF) PE: Enhance PE Authenticode. See PE Authenticode get_imphash() can now generate the same value as pefile and Virus Total ( #299 ) pe = lief.parse(\"example.exe\") vt_imphash = lief.PE.get_imphash(pe, lief.PE.IMPHASH_MODE.PEFILE) lief_imphash = lief.PE.get_imphash(pe, lief.PE.IMPHASH_MODE.DEFAULT) See also lief.PE.IMPHASH_MODE and lief.PE.get_imphash() Remove the padding entry (0) from the rich header lief.PE.LangCodeItem.items now returns a dictionary for which the values are bytes (instead of str object). This change is related to utf-16 support. kohnakagawa fixed wrong enums values: c031250 , 6ee808a , cd05f34 kohnakagawa fixed a bug in the PE resources parser ( a7254d1 ) Handle PE forwarded exports (issue #307 ) Mach-O: Add API to access either LC_CODE_SIGNATURE or DYLIB_CODE_SIGN_DRS (issue #476 ) Fix issue when parsing twice a Mach-O file (issue #479 ) Dependencies: Replace easyloggingpp with spdlog 1.8.1 Upgrade frozen to 1.0.0 Upgrade json to 3.7.3 Upgrade pybind11 to 2.6.0 Upgrade mbedtls to 2.16.6 Documentation: aguinet updated the bin2lib tutorial with the support of the new glibc versions ( 7884e57 ) Global update and enable to build the documentation out-of-tree Changing the theme Misc: Add Python 3.9 support FindLIEF.cmake deprecates LIEF_ROOT . You should use LIEF_DIR instead. Logging: We changed the logging interface. The following log levels have been removed: LOG_GLOBAL LOG_FATAL LOG_VERBOSE LOG_UNKNOWN We also moved from an class-interface based to functions. Example: lief.logging.disable() lief.logging.enable() lief.logging.set_level(lief.logging.LEVEL.INFO) See: lief.logging.set_level() Note The log functions now output on stderr instead of stdout 0.10.1 - November 29, 2019 Fix regression in parsing Python bytes Add Python API to demangle strings: lief.demangle 0.10.0 - November 24, 2019 ELF: Add build support for ELF notes Add coredump support ( 9fc3a8a ) Enable to bind a relocation with a symbol ( a9f3cb8 ) Example: relocation = \"...\" symbol = lief.ELF.Symbol() symbol.name = \"printf123\" relocation.symbol = symbol Add constructors ( 67d924a ) Expose ELF destructors ( 957384c ) Add remove_static_symbol ( c677970 ) Add support for static relocation writing ( d1b98d6 ) Expose function to get strings located in the .rodata section ( 02f4851 ) Export ELF ABI version ( 8d7ec26 ) PE: Improve PE Authenticode parsing ( 535623d ) Fix alignment issue when removing a PE section ( 04dddd3 ) Parse PE debug data directory as a list of debug entries (by 1orenz0 - fcc75dd ) Add support to parse POGO debug entries (by 1orenz0 - 3537440 ) Mach-O: Enhance Mach-O modifications by exposing an API to: Add load commands Add sections Add segments See: 406115c Enable write() on FAT Mach-O ( 1659531 ) Introduce Mach-O Build Version command ( 6f96723 ) Enable to remove Mach-O symbols ( 616d739 ) Add support for adding LC_UNIXTHREAD commands in a MachO (by nezetic - 64d2597 ) Abstract Layer: Expose remove_section() in the abstract layer ( 918438c ) Expose write() in the abstract layer ( af4d48e ) Expose API to list functions found in a binary ( b5a0846 ) Android: Add partial support for Android 9 ( bce9ebe ) Misc: lkollar added support for Python 3.8 in CI (Linux & OSX only) Update Pybind11 dependency to v2.4.3 Enhance Python install Thanks to lkollar , Linux CI now produces manylinux1-compliant wheels Many thanks to the contributors: recvfrom , pbrunet , mackncheesiest , wisk , nezetic , lkollar , jbremer , DaLynX , 1orenz0 , breadchris , 0xbf00 , unratito , strazzere , aguinetqb , mingwandroid , serge-sans-paille-qb , yrp604 , majin42 , KOLANICH 0.9.0 - June 11, 2018 LIEF 0.9 comes with new formats related to Android: OAT, DEX, VDEX and ART. It also fixes bugs and thanks to yd0b0N , ELF parser now supports big and little endian binaries. We also completed the JSON serialization of LIEF objects. Features MachO: Enable to configure the Mach-O parser for quick parsing: 880b99a Add lief.MachO.EncryptionInfo command: f4e2d81 Add lief.MachO.RPathCommand command: 196994d Add lief.MachO.DataInCode command: a16e1c4 Add lief.MachO.SubFramework command: 9e3b5b4 Add lief.MachO.SegmentSplitInfo command: 9e3b5b4 Add lief.MachO.DyldEnvironment command: 9e3b5b4 API to show export-trie, rebase and binding opcodes: 5d56141 PE: Add PE Code View: eab4a76 ELF: Add support for .note.android.ident section: d13db18 Enable to add unlimited number of dynamic entries: a40da3e Add support for PPC relocations: 08b5141 Endianness support: e794ac1 API lief.breakp() and lief.shell() lief.parse() now support io streams as input Parser now returns a std::unique_ptr instead of a raw pointer: cd1cc45 Misc Use frozen for some internal std::map (If C++14 is supported by the compiler) Acknowledgments yd0b0N for #162 and #166 (Endianness support and PPC relocations) 0xbf00 for #128 ( LC_RPATH command) illera88 for #118 0.8.3 [Mach-O] Fix typo on comparison operator - abbc264 0.8.2 [ELF] Increase the upper limit of relocation number - 077bc32 0.8.1 - October 18, 2017 Fix an alignment issue in the ELF builder. See 8db199c Add assertion on the setuptools version: 62e5825 0.8.0 - October 16, 2017 LIEF 0.8.0 mainly improves the MachO parser and the ELF builder. It comes with Dockerfiles for CentOS and Android . LibFuzzer has also been integrated in the project to enhance the parsers Features Abstract Layer: Relocation are now abstracted from the 3 formats - 9503f2f PIE and NX are abstracted through the is_pie and has_nx properties Add the lief.Section.search() and lief.Section.search_all() methods to look for patterns in the section’s content. ELF: DT_FLAGS and DT_FLAGS_1 are now parsed into DynamicEntryFlags - 754b8af Handle relocations of object files ( .o ) - 483b8dc Global enhancement of the ELF builder: One can now add multiple Section or Segment into an ELF: elf = lief.parse(\"/bin/cat\") for i in range(3): segment = Segment() segment.type = SEGMENT_TYPES.LOAD segment.content = [i & 0xFF] * 0x1000 elf += segment for i in range(3): section = Section(\"lief_{:02d}\".format(i)) section.content = [i & 0xFF] * 0x1000 elf += section elf.write(\"foo\") $ readelf -l ./foo PHDR 0x0000000000000040 0x0000000000000040 0x0000000000000040 0x00000000000061f8 0x00000000000061f8 R E 0x8 INTERP 0x0000000000006238 0x0000000000006238 0x0000000000006238 0x000000000000001c 0x000000000000001c R 0x1 [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2] LOAD 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x000000000000d6d4 0x000000000000d6d4 R E 0x200000 LOAD 0x000000000000da90 0x000000000020da90 0x000000000020da90 0x0000000000000630 0x00000000000007d0 RW 0x200000 LOAD 0x000000000000f000 0x000000000040f000 0x000000000040f000 0x0000000000001000 0x0000000000001000 0x1000 LOAD 0x0000000000010000 0x0000000000810000 0x0000000000810000 0x0000000000001000 0x0000000000001000 0x1000 LOAD 0x0000000000011000 0x0000000001011000 0x0000000001011000 0x0000000000001000 0x0000000000001000 0x1000 .... $ readelf -S ./foo ... [27] lief_00 PROGBITS 0000000002012000 00012000 0000000000001000 0000000000000000 0 0 4096 [28] lief_01 PROGBITS 0000000004013000 00013000 0000000000001000 0000000000000000 0 0 4096 [29] lief_02 PROGBITS 0000000008014000 00014000 0000000000001000 0000000000000000 0 0 4096 Warning There are issues with executables statically linked with libraries that use TLS See: #98 One can now add multiple entries in the dynamic table: elf = lief.parse(\"/bin/cat\") elf.add_library(\"libfoo.so\") elf.add(DynamicEntryRunPath(\"$ORIGIN\")) elf.add(DynamicEntry(DYNAMIC_TAGS.INIT, 123)) elf.add(DynamicSharedObject(\"libbar.so\")) elf.write(\"foo\") $ readelf -d foo 0x0000000000000001 (NEEDED) Shared library: [libfoo.so] 0x0000000000000001 (NEEDED) Shared library: [libc.so.6] 0x000000000000000c (INIT) 0x7b 0x000000000000000c (INIT) 0x3600 ... 0x000000000000001d (RUNPATH) Bibliothèque runpath:[$ORIGIN] 0x000000000000000e (SONAME) Bibliothèque soname: [libbar.so] See b94900c , 1e410e6 for details. b2d3694 enables modification of the ELF interpreter without length restriction elf = lief.parse(\"/bin/cat\") elf.interpreter = \"/a/very/long/path/to/another/interpreter\" elf.write(\"foo\") $ readelf -l foo Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align PHDR 0x0000000000000040 0x0000000000000040 0x0000000000000040 0x00000000000011f8 0x00000000000011f8 R E 0x8 INTERP 0x000000000000a000 0x000000000040a000 0x000000000040a000 0x0000000000001000 0x0000000000001000 R 0x1 [Requesting program interpreter: /a/very/long/path/to/another/interpreter] .... Enhancement of the dynamic symbols counting - 985d124 Enable editing ELF’s notes: elf = lief.parse(\"/bin/ls\") build_id = elf[NOTE_TYPES.BUILD_ID] build_id.description = [0xFF] * 20 elf.write(\"foo\") $ readelf -n foo Displaying notes found in: .note.gnu.build-id Owner Data size Description GNU 0x00000014 NT_GNU_BUILD_ID (unique build ID bitstring) Build ID: ffffffffffffffffffffffffffffffffffffffff See commit 3be9dd0 for more details PE: Add get_imphash() and resolve_ordinals() functions - a89bc6d , dfa8e98 Parse the Load Config Table into LoadConfiguration (up to Windows 10 SDK 15002 with hotpatch_table_offset ) from lief import to_json import json pe = lief.parse(\"some.exe\") loadconfig = to_json(pe.load_configuration)) # Using the lief.to_json function pprint(json.loads(to_json(loadconfig))) {'characteristics': 248, 'code_integrity': {'catalog': 0, 'catalog_offset': 0, 'flags': 0, 'reserved': 0}, 'critical_section_default_timeout': 0, 'csd_version': 0, 'editlist': 0, ... 'guard_cf_check_function_pointer': 5368782848, 'guard_cf_dispatch_function_pointer': 5368782864, 'guard_cf_function_count': 15, 'guard_cf_function_table': 5368778752, 'guard_flags': 66816, 'guard_long_jump_target_count': 0, 'guard_long_jump_target_table': 0, 'guard_rf_failure_routine': 5368713280, 'guard_rf_failure_routine_function_pointer': 5368782880, ... For details, see commit: 0234e3b MachO: The dyld structure is parsed (deeply) into DyldInfo . It includes: Binding opcodes Rebases opcodes Export trie See: e2b81e0 , 0e972d6 , f7cc518 , 782295b , #67 Section relocations are now parsed into lief.MachO.Section.relocations - 29c8157 LC_FUNCTION_STARTS is parsed into FunctionStarts ( 18d8919 ) LC_SOURCE_VERSION , LC_VERSION_MIN_MACOSX and LC_VERSION_MIN_IPHONEOS are parsed into SourceVersion and VersionMin ( c359778 , 0b4bb7d , 5b99311 , #45 ) LC_THREAD and LC_UNIXTHREAD are now parsed into ThreadCommand - 2325783 Fixes Fix enums conflicts( #32 ) - 66b4cd4 Fix most of the memory leaks: 88dafa8 , d9b1436 , 554fa15 , 3602643 ELF: Bug Fix when counting dynamic symbols from the GnuHash Table - 9036a24 PE: Fix nullptr dereference in resources - e90fe1b Handle encoding issues in the Python API - 8c7ceaf Sanitize DLL names MachO: Fix #87 , #92 Fix memory leaks and some performance issues: #94 API In the C++ API get_XXX() getters have been renamed into XXX() (e.g. get_header() becomes header() ) - a4c69f7 , e805669 Abstract: lief.Binary gains the format property - 9391238 lief.parse() can now takes a list of integers - f330fa8 Add has_symbol() and get_symbol() to lief.Binary - f121af5 [Python API] Enhance the access to the abstract layer through the abstract attribute - 0713854 One can now do: elf = lief.ELF.parse(\"/bin/ls\") # Could be lief.MachO / lief.PE abstract = elf.abstract # Return the lief.Binary object ELF: Relocation gains the purpose property - b7b0bde Add lief.ELF.Binary.symbols which return an iterator over all symbols (static and dynamic) - af6ab65 Header.sizeof_section_header has been renamed into section_header_size - d96971b Segment.flag has been renamed into flags - 20a5f66 Add: arm_flags_list , mips_flags_list ppc64_flags_list hexagon_flags_list to Header - 730d045 To check if a given flag is set, one can do: >>> if lief.ELF.ARM_EFLAGS.EABI_VER5 in lief.ELF.Header \"yes\" else \"no\" [Python] Segment flags: PF_X , PF_W , PF_X has been renamed into X , W , X - d70ef9e Add lief.ELF.Section.flags_list - 4937b71 Enhancement for DynamicEntryRpath and DynamicEntryRunPath : c375a47 Enhancement for DynamicEntryArray : 81440ce Add some operators 3b200b3 , 43bd06f PE: Add some operators 5666351 MachO: lief.MachO.parse() can now takes a list of integers - f330fa8 lief.MachO.parse() now returns a FatBinary instead of a list of Binary . FatBinary has a similar API as a list - 3602643 Add some operators : cbe8354 Logging: Add an API to configure the logger - 4600c2b Example: from lief import Logger Logger.disable() Logger.enable() Logger.set_level(lief.LEVEL.INFO) See: lief.Logger Build system Add FindLIEF.cmake - 6dd8b10 Add ASAN, TSAN, USAN, LSAN - 7f6aeb0 Add LibFuzzer - 7a0dc28 Documentation References: recomposer, bearparser, IAT_patcher, PEframe, Manalyze, MachOView, elf-dissector Acknowledgments alvarofe for #47 aguinet for #55 , #61 , #65 , #77 jevinskie for #75 liumuqing for #80 Manouchehri for #106 0.7.0 - July 3, 2017 Features Abstract Layer: Add bitness (32bits / 64bits) - 78d1adb Add object type (Library, executable etc) - 78d1adb Add mode Thumbs, 16bits etc - 78d1adb Add endianness - 7ea08f7 , #29 ELF: Enable dynamic symbols permutation - 2dea7cb Fully handle section-less binaries - de40c06 Parse ELF notes - 241aac7 Parse SYSV hash table - afa74ce , #36 Add relocation size - f1766f2 PE: Parse PE Overlay - e0634c1 Enable PE Hooking - 24f6b72 Parse and rebuilt dos stub - 3f06397 Add a resources manager to provide an enhanced API over the resources - 8473c8e Serialize PE objects into JSON - 673f5a3 , #18 Parse Rich Header - 0893bd9 , #15 Bug Fixes ELF: Bug fix when a GNU hash has empty buckets - 21a6c30 PE: Bug fix in the signature parser: #30 , 4af0256 Bug fix in the resources parser: Infinite loop - a569cc1 Add more out-of-bounds checks on relocations and exports - 9364f64 Use min(SizeOfRawData, VirtualSize) for the section’s size and truncate the size to the file size - 61bf14b MachO: Bug fix when a binary hasn’t a LC_MAIN command - 957501f API Abstract Layer: lief.Header.is_32 and lief.Header.is_64 lief.Header.object_type lief.Header.modes lief.Header.endianness ELF: lief.ELF.Binary.permute_dynamic_symbols() lief.ELF.Segment.data has been renamed to lief.ELF.Segment.content lief.ELF.parse() takes an optional parameters: symbol counting - lief.ELF.DYNSYM_COUNT_METHODS lief.ELF.Relocation.size Notes: lief.ELF.Note lief.ELF.Binary.has_notes lief.ELF.Binary.notes Hash Tables: lief.ELF.SysvHash lief.ELF.Binary.use_gnu_hash lief.ELF.Binary.use_sysv_hash lief.ELF.Binary.sysv_hash PE: lief.PE.Symbol.has_section lief.PE.Binary.hook_function() lief.PE.Binary.get_content_from_virtual_address() takes either an Absolute virtual address or a Relative virtual address lief.PE.Binary.section_from_virtual_address has been renamed to lief.PE.Binary.section_from_rva() . lief.PE.parse_from_raw has been removed. One can use lief.PE.parse() . lief.PE.Section.data has been removed . Please use lief.PE.Section.content Dos Stub: lief.PE.Binary.dos_stub lief.PE.Builder.build_dos_stub Rich Header: lief.PE.Binary.rich_header lief.PE.Binary.has_rich_header lief.PE.RichHeader lief.PE.RichEntry Overlay: lief.PE.Binary.overlay lief.PE.Builder.build_overlay Imports: lief.PE.Binary.has_import lief.PE.Binary.get_import() Resources: lief.PE.Binary.resources lief.PE.ResourceData lief.PE.ResourceDirectory lief.PE.ResourceNode lief.PE.LangCodeItem lief.PE.ResourceDialog lief.PE.ResourceDialogItem lief.PE.ResourceFixedFileInfo lief.PE.ResourceIcon lief.PE.ResourceStringFileInfo lief.PE.ResourceVarFileInfo lief.PE.ResourceVersion MachO: lief.MachO.Binary.has_entrypoint lief.MachO.Symbol.demangled_name UUID: lief.MachO.Binary.has_uuid lief.MachO.Binary.uuid lief.MachO.UUIDCommand Main Command: lief.MachO.Binary.has_main_command lief.MachO.Binary.main_command lief.MachO.MainCommand Dylinker: lief.MachO.Binary.has_dylinker lief.MachO.Binary.dylinker lief.MachO.DylinkerCommand Documentation References: elfsteem, pelook, PortEx, elfsharp, metasm, amoco, Goblin Tutorials: PE Hooking , Resources Manipulation Integration: XCode , CMake Acknowledgments ek0 : #24 ACSC-CyberLab : #33 , #34 , #37 , #39 Hyrum Anderson who pointed bugs in the PE parser My colleagues for the feedback and suggestions (Adrien, SebK, Pierrick) 0.6.1 - April 6, 2017 Bug Fixes ELF: Don’t rely on lief.ELF.Section.entry_size to count symbols - 004c676 API PE: lief.PE.TLS.has_section lief.PE.TLS.has_data_directory Documentation Integration: Visual Studio Acknowledgments Philippe for the proofreading. 0.6.0 - March 30, 2017 First public release", "contentHash": "b5b84d2868da1323f9995610f5af2ca58e2574b8731e9fa5ef9470cd1ecb9ce8", "description": "Changelog. This release contains several security fixes:", "docname": "changelog", "documentID": "eed632b369270a2ddd5a79c4c2c3c0d8219b00a8f249614e9bf89f5316126282", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/changelog.md", "title": "Changelog - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/changelog/pe-0-17-0.html", "content": "PE Changelog for LIEF 0.17.0 Compared to LIEF v0.16.x, version 0.17.0 includes a significant refactoring of the PE parser and builder. These changes were necessary to align LIEF’s PE functionality with its ELF and Mach-O counterparts. If your codebase uses LIEF to process PE binaries, you may encounter issues when upgrading to LIEF 0.17.0. This page provides a comprehensive overview of the various changes, but it cannot cover every detail. If you encounter an API issue that is not described here, you can: Join our Discord server and ask your questions: https://discord.gg/jGQtyAYChJ Review the git diff of the tests. Most of these changes are covered by tests, so you should be able to find a relevant example. Email me at: me[at]romainthomas.fr PE Modifications To explore the new modification features, you can check the following pages: Imports Modification Resources Modification TLS Modification Debug Modification Exports Modification COFF String & COFF Symbol As described in issue #1043 , if a section name exceeds 8 bytes, the linker may allocate a longer name in the COFF string pool while setting the section’s name with the offset in the COFF string pool. You can access this COFF string using lief.PE.Section.coff_string ( lief::pe::Section::coff_string ; lief.PE.Section.coff_string ; LIEF::PE::Section::coff_string() ), while the string representing the offset (e.g., /230 ) remains in the section’s name. Additionally, optional COFF symbols, along with any auxiliary symbols, are now processed correctly by LIEF: import lief pe = lief.PE.parse(\"libLIEF.dll\") section = pe.sections[10] print(section.name) # --> '/19' print(section.coff_string) # --> '.debug_info' for symbol in pe.symbols: print(symbol.name) for aux in symbol.auxiliary_symbols: print(aux) Although this example is written in Python, the API is also available in C++ and Rust. Load Configuration The IMAGE_LOAD_CONFIG_DIRECTORY structures, represented in LIEF by lief.PE.LoadConfiguration ( lief::pe::LoadConfiguration ; lief.PE.LoadConfiguration ; LIEF::PE::LoadConfiguration ), regularly evolve with new Windows releases. New Windows versions may introduce attributes for additional functionality, such as Control Flow Guard. To manage these changes, lief.PE.LoadConfiguration ( lief::pe::LoadConfiguration ; lief.PE.LoadConfiguration ; LIEF::PE::LoadConfiguration ) previously used a form of inheritance. For each new attribute, a new class, such as LoadConfigurationV12 , would inherit from LoadConfigurationV11 . This approach, though systematic, resulted in numerous modifications – especially in Rust – raising questions about the decision to use inheritance. Starting with LIEF v0.17.0, lief.PE.LoadConfiguration ( lief::pe::LoadConfiguration ; lief.PE.LoadConfiguration ; LIEF::PE::LoadConfiguration ) has adopted a flat representation. In this new model, version-dependent attributes are represented with an option<> -like container. Python import lief pe = lief.PE.parse(\"demo.exe\") offset: Optional[int] = pe.load_configuration.hotpatch_table_offset C++ auto pe = LIEF::PE::Parser::parse(\"demo.exe\"); if (const LoadConfiguration* lconf = pe->load_configuration()) { LIEF::optional offset = lconf->hotpatch_table_offset(); } Rust if let Some(lief::Binary::PE(pe)) = lief::Binary::parse(\"demo.exe\") { if let Some(lconf) = pe.load_configuration() { let offset: Option = lconf.hotpatch_table_offset(); } } Additionally, lief.PE.LoadConfiguration ( lief::pe::LoadConfiguration ; lief.PE.LoadConfiguration ; LIEF::PE::LoadConfiguration ) now provides an API that allows access to the internal data associated with this structure: lief.PE.CHPEMetadata ( lief::pe::CHPEMetadata ; lief.PE.CHPEMetadata ; LIEF::PE::CHPEMetadata ) lief.PE.DynamicRelocation ( lief::pe::DynamicRelocation ; lief.PE.DynamicRelocation ; LIEF::PE::DynamicRelocation ) lief.PE.EnclaveConfiguration ( lief::pe::EnclaveConfiguration ; lief.PE.EnclaveConfiguration ; LIEF::PE::EnclaveConfiguration ) lief.PE.VolatileMetadata ( lief::pe::VolatileMetadata ; lief.PE.VolatileMetadata ; LIEF::PE::VolatileMetadata ) Some of these structures are important to correctly support ARM64EC/ARM64X PE binaries (#teasing). Debug Information LIEF version 0.17.0 supports more types of debug entries and provides a user-friendly API: lief.PE.VCFeature ( lief::pe::debug::VCFeature ; lief.PE.VCFeature ; LIEF::PE::VCFeature ) lief.PE.FPO ( lief::pe::debug::FPO ; lief.PE.FPO ; LIEF::PE::FPO ) lief.PE.ExDllCharacteristics ( lief::pe::debug::ExDllCharacteristics ; lief.PE.ExDllCharacteristics ; LIEF::PE::ExDllCharacteristics ) lief.PE.PDBChecksum ( lief::pe::debug::PDBChecksum ; lief.PE.PDBChecksum ; LIEF::PE::PDBChecksum ) As described in the Debug Modification section, you can modify debug entries to perform various actions: pe = lief.PE.parse(\"some.dll\") # Changing the PDB file path to a URL pe.codeview_pdb.filename = \"https://lief.re/\" pe.write(\"out.dll\") Resources Some interfaces exposed by the lief.PE.ResourcesManager ( lief::pe::resources::Manager ; lief.PE.ResourcesManager ; LIEF::PE::ResourcesManager ) have been redesigned to make them more consistent with their underlying representation in the PE format. For example, lief.PE.LangCodeItem has been renamed and refactored into lief.PE.ResourceStringTable ( lief.PE.ResourceStringTable ; LIEF::PE::ResourceStringTable ). Resource-related enums have been re-scoped to avoid definition conflicts between Windows headers and LIEF: lief.PE.EXTENDED_WINDOW_STYLES lief.PE.ResourceDialog.WINDOW_EXTENDED_STYLES lief.PE.WINDOW_STYLES lief.PE.ResourceDialog.WINDOW_STYLES lief.PE.DIALOG_BOX_STYLES lief.PE.ResourceDialog.DIALOG_STYLES lief.PE.FIXED_VERSION_OS lief.PE.ResourceVersion.fixed_file_info_t.VERSION_OS lief.PE.FIXED_VERSION_FILE_FLAGS lief.PE.ResourceVersion.fixed_file_info_t.FILE_FLAGS lief.PE.FIXED_VERSION_FILE_SUB_TYPES lief.PE.ResourceVersion.fixed_file_info_t.FILE_TYPE_DETAILS lief.PE.ACCELERATOR_FLAGS lief.PE.ResourceAccelerator.FLAGS lief.PE.ACCELERATOR_VK_CODES lief.PE.ACCELERATOR_CODES Exception Info For x86-64 and ARM64 PE binaries, stack unwinding information is referenced by the data directory: IMAGE_DIRECTORY_ENTRY_EXCEPTION . Even if your code is compiled without exception support, this information may still be generated by the linker. The entries of this data directory are represented by the lief.PE.ExceptionInfo ( lief::pe::exception::RuntimeExceptionFunction ; lief.PE.ExceptionInfo ; LIEF::PE::ExceptionInfo ) structure, which is specialized for x64 and ARM64 functions. Regardless of the underlying architecture, each entry in this table exposes a function RVA. From a reverse engineering perspective, these RVAs offer a valuable set of function start addresses that can be used to begin disassembling the binary. Given a lief.PE.Binary ( lief::pe::Binary ; lief.PE.Binary ; LIEF::PE::Binary ) instance, one can iterate over these lief.PE.ExceptionInfo ( lief::pe::exception::RuntimeExceptionFunction ; lief.PE.ExceptionInfo ; LIEF::PE::ExceptionInfo ) entries using lief.PE.Binary ( lief::pe::Binary::exceptions ; lief.PE.Binary.exceptions ; LIEF::PE::Binary::exceptions() ): pe = lief.PE.parse(\"Windows.Media.Protection.PlayReady.dll\", lief.PE.ParserConfgi.all) print(pe.exceptions[10]) RuntimeFunctionX64 { RVA: [0x0c9350, 0x0c9382] (50 bytes) Unwind info RVA: 0x68eb5c unwind_info_t { Version: 1 Flags: 0 Size of prologue: 20 Nb opcodes: 8 (6) Opcodes: [ 0x14 SAVE_NONVOL reg=RDI, offset=0x000078 0x14 SAVE_NONVOL reg=RBX, offset=0x000070 0x14 ALLOC_SMALL size=64 0x10 PUSH_NONVOL reg=R15 0x0e PUSH_NONVOL reg=R14 0x0c PUSH_NONVOL reg=R12 ]; } } pe = lief.PE.parse(\"win11_arm64x_Windows.Media.Protection.PlayReady.dll\", lief.PE.ParserConfgi.all) print(pe.exceptions[10]) Runtime Unpacked AArch64 Function { Range(RVA): 0x00822bb8 - 0x00822c08 Unwind location (RVA): 0x00d63838 Length=80 Vers=0 X=0 E=0, CodeWords=8 Epilogs=1 Prolog unwind: 0x0000 e1...... mov fp, sp 0x0001 81...... stp x29, x30, [sp, #-16]! 0x0002 e6...... save next 0x0003 e6...... save next 0x0004 e6...... save next 0x0005 e6...... save next 0x0006 e76689.. stp q6, q7, [sp, #-160]! 0x0009 fc...... pacibsp 0x000a e4...... end Epilog #1 unwind: (Offset=10, Index=11, Reserved=0) 0x0000 81...... ldp x29, x30, [sp], #16 0x0001 e74e88.. ldp q14, q15, [sp, #128] 0x0004 e74c86.. ldp q12, q13, [sp, #96] 0x0007 e74a84.. ldp q10, q11, [sp, #64] 0x000a e74882.. ldp q8, q9, [sp, #32] 0x000d e76689.. ldp q6, q7, [sp], #160 0x0010 fc...... autibsp 0x0011 e3...... nop 0x0012 e3...... nop 0x0013 e4...... end } ARM64 - SAVE_ANY_REG Thank you to Eli Friedman and Martin Storsjö for their work on reverse engineering this undocumented unwind opcode. LIEF provides a detailed API for the structures involved in PE exceptions and stack unwinding. Performance Considerations In-depth analysis of exception metadata can introduce significant overhead. Therefore, lief.PE.ParserConfig.parse_exceptions ( lief::pe::ParserConfig::parse_exceptions ; lief.PE.ParserConfig.parse_exceptions ; LIEF::PE::ParserConfig::parse_exceptions ) must be explicitly enabled. ARM64EC / ARM64X With the recent release of Snapdragon X, ARM64-based Windows computers are becoming increasingly popular. This shift introduces some changes to the PE format. One notable change is the introduction of ARM64X binaries, which can be compared to the Mach-O FAT concept, where a single binary contains multiple architectures. In the case of ARM64X, a single PE file encapsulates ARM64 and ARM64EC architectures. LIEF v0.17.0 exposes the following helpers to determine whether the binary is ARM64X or ARM64EC: lief.PE.Binary.is_arm64ec() ( lief::pe::Binary::is_arm64ec ; lief.PE.Binary.is_arm64ec ; LIEF::PE::Binary::is_arm64ec() ), lief.PE.Binary.is_arm64x() ( lief::pe::Binary::is_arm64x ; lief.PE.Binary.is_arm64x ; LIEF::PE::Binary::is_arm64x() ). For an ARM64X binary, you can use lief.PE.Binary.nested_pe_binary() ( lief::pe::Binary::nested_pe_binary ; lief.PE.Binary.nested_pe_binary ; LIEF::PE::Binary::nested_pe_binary() ) to access the embedded ARM64EC representation of the binary. Performance Considerations Parsing a nested ARM64EC binary can introduce additional overhead compared to the 0.16.x version. Therefore, lief.PE.ParserConfig.parse_arm64x_binary ( lief::pe::ParserConfig::parse_arm64x_binary ; lief.PE.ParserConfig.parse_arm64x_binary ; LIEF::PE::ParserConfig::parse_arm64x_binary ) must be explicitly enabled. Other Changes The workaround involving undef.h has been removed. This file was used to #undef certain Windows defines that conflicted with LIEF enum definitions. You can now safely include Windows headers alongside LIEF headers. If you encounter any conflicts, please report the issue. The builder engine has been refactored to resolve numerous errors and bugs associated with PE modifications. It now uses a more conservative approach. For more details, please refer to the PE page. The “PE from Scratch” feature has been removed, as it had significant bugs that often resulted in corrupted binaries. This feature will be reintroduced in a future release. If you rely on this feature, please reach out. List of changes: Fixed missing original forwarded function name ( #1166 ) lief.PE.DataDirectory ( lief::pe::DataDirectory ; lief.PE.DataDirectory ; LIEF::PE::DataDirectory ) now exposes lief.PE.DataDirectory.content() ( lief::pe::DataDirectory::content ; lief.PE.DataDirectory.content ; LIEF::PE::DataDirectory::content() ) to access the raw bytes wrapped by the data directory PE’s resource tree can now be parsed in a standalone way using lief.PE.ResourceNode.parse() ( lief::pe::ResourceNode::from_slice ; lief.PE.ResourceNode.parse() ; LIEF::PE::ResourceNode::parse() ). resource_tree = bytes(\"....\") original_rva = 0x20000 tree: lief.PE.ResourceNode = lief.PE.ResourceNode.parse(resource_tree, original_rva)", "contentHash": "12ff98b83fd096f93e49557274dc301e026c835f167a6f760c2f64cf6bf1f61f", "description": "PE Changelog for LIEF 0.17.0. Compared to LIEF v0.16.x, version 0.17.0 includes a significant refactoring of the PE parser and builder. These changes were…", "docname": "changelog/pe-0-17-0", "documentID": "7ba08b30511fc562a90edcc95b2b926281cabafc34807b1977c6e038151201f6", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/changelog/pe-0-17-0.md", "title": "PE Changelog for LIEF 0.17.0 - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/compilation.html", "content": "Compilation To compile LIEF , you need at least the following: C++17 compiler (GCC, Clang, MSVC, etc.) CMake Python >= 3.10 (for the bindings) Note Compiling from scratch with all options enabled can take approximately 20 minutes on a standard laptop. Libraries only (SDK) $ git clone https://github.com/lief-project/LIEF.git $ cd LIEF $ mkdir build $ cd build $ cmake -DCMAKE_BUILD_TYPE=Release .. $ cmake --build . --target LIB_LIEF --config Release Warning On Windows, you can choose which CRT to use by setting the CMAKE_MSVC_RUNTIME_LIBRARY variable: $ cmake -DCMAKE_BUILD_TYPE=Release -DCMAKE_MSVC_RUNTIME_LIBRARY=MultiThreaded .. For Debug, you should set the CRT to MTd : $ cmake -DCMAKE_BUILD_TYPE=Debug -DCMAKE_MSVC_RUNTIME_LIBRARY=MultiThreadedDebug .. $ cmake --build . --target LIB_LIEF --config Debug Python bindings The Python bindings are built from the api/python directory, which uses a PEP 517 build backend based on scikit-build-core : $ git clone https://github.com/lief-project/LIEF.git $ cd LIEF/api/python $ pip install [-e] [--user] . # Or $ pip install [-e] api/python Note You can speed up the compilation by installing ccache or sccache . You can customize the compilation by setting the PYLIEF_CONF environment variable to the path of a TOML configuration file. By default, the Python bindings use config-default.toml in the Python binding directory: [lief.build] type = \"Release\" cache = true ninja = true parallel-jobs = 0 [lief.formats] elf = true pe = false macho = true ... $ PYLIEF_CONF=/tmp/my-custom.toml pip install . Free-threaded Python Since LIEF 1.0.0, the Python bindings can be compiled against the free-threaded Python builds. This is controlled through the free-threaded flag of the [lief.build] section of the configuration: [lief.build] type = \"Release\" free-threaded = true Warning When MbedTLS is resolved externally ( LIEF_OPT_MBEDTLS_EXTERNAL=ON ), you must make sure that the provided build enables threading support. LIEF cannot tweak the threading configuration in that case. At runtime, you can check whether the currently loaded extension was compiled with free-threading support through lief.__free_threaded__ . Runtime features The runtime features are not enabled by default and must be explicitly turned on. See Runtime for the CMake options and TOML configuration used to enable the runtime module. Debugging By default, LIEF is compiled with CMAKE_BUILD_TYPE set to Release . You can change this behavior by setting it to either RelWithDebInfo or Debug during CMake’s configuration step: $ cmake -DCMAKE_BUILD_TYPE=RelWithDebInfo [...] .. Alternatively, the Python bindings can also be compiled with debug information by changing the type in the [lief.build] section of config-default.toml : [lief.build] type = \"RelWithDebInfo\" Note When developing LIEF, you can use: $ PYLIEF_CONF=~/lief-debug.toml pip install [-e] api/python With lief-debug.toml set to: [lief.build] type = \"RelWithDebInfo\" ... [lief.logging] enabled = true debug = true Third Party LIEF relies on several external projects, and we aim to limit dependencies in the public headers as much as possible. The following table summarizes these dependencies and their scopes. internal means that it is required to compile LIEF but not to use it. external means that it is required for both. Dependency Scope Purpose tcbrindle/span external C++11 span interface TartanLlama/expected external Error handling (see: Error Handling ) gabime/spdlog internal Logging Mbed-TLS/mbedtls internal ASN.1 parser / Hash functions nemtrif/utfcpp internal Unicode support (for PE and DEX files) nlohmann/json internal Serialize LIEF objects into JSON wjakob/nanobind internal Python bindings serge-sans-paille/frozen internal constexpr containers IOActive/Melkor_ELF_Fuzzer internal ELF Fuzzing catchorg/Catch2 internal Unit Testing With the exception of MbedTLS, all of these dependencies are header-only. By default, they are embedded and managed by LIEF to simplify compilation and integration. Nevertheless, package managers often require linking against system libraries rather than using vendored dependencies [1] [2] . To address this requirement, you can control the integration of LIEF’s dependencies using the following CMake options: LIEF_OPT_NLOHMANN_JSON_EXTERNAL LIEF_OPT_UTFCPP_EXTERNAL LIEF_OPT_MBEDTLS_EXTERNAL LIEF_EXTERNAL_SPDLOG LIEF_OPT_FROZEN_EXTERNAL LIEF_OPT_EXTERNAL_SPAN/LIEF_EXTERNAL_SPAN_DIR LIEF_OPT_EXTERNAL_EXPECTED LIEF_OPT_NANOBIND_EXTERNAL By setting these flags, LIEF will resolve dependencies using CMake’s find_package(...) , which relies on _DIR to locate the package. For example, LIEF can be compiled using the following configuration: $ cmake .. -GNinja \\ -DLIEF_OPT_NLOHMANN_JSON_EXTERNAL=ON \\ -Dnlohmann_json_DIR=/lief-third-party/json/install/lib/cmake/nlohmann_json \\ -DLIEF_OPT_MBEDTLS_EXTERNAL=on \\ -DMbedTLS_DIR=/lief-third-party/mbedtls/install/cmake Warning As mentioned previously, MbedTLS is not header-only. This means that if it is externalized , the static version of LIEF will not include the MbedTLS object files, and the end user will have to manually link LIEF.a with a provided version of MbedTLS. [ 1 ] https://github.com/lief-project/LIEF/issues/605 [ 2 ] https://learn.microsoft.com/en-us/vcpkg/contributing/maintainer-guide#do-not-use-vendored-dependencies Continuous Integration LIEF uses GitHub Actions to test and release nightly builds. The configuration of this CI can also be a good source of information for the compilation process. In particular, scripts/docker/linux-sdk-x64 contains the build process to generate the Linux x86-64 SDK . On Windows, the SDK is built with the following Python script: scripts/windows/package_sdk.py For OSX , refer to the CI config .github/workflows/osx.yml , and for iOS , see the scripts/osx/package_ios.sh script, to see how LIEF is compiled (and cross-compiled) for these platforms. CMake Options include_guard(GLOBAL) include(CMakeDependentOption) option(LIEF_TESTS \"Enable tests\" OFF) option(LIEF_PYTHON_API \"Enable Python Bindings\" OFF) option(LIEF_EXAMPLES \"Build LIEF C++ examples\" ON) option(LIEF_FORCE32 \"Force build LIEF 32 bits version\" OFF) option(LIEF_USE_CCACHE \"Use ccache to speed up compilation\" ON) option(LIEF_EXTRA_WARNINGS \"Enable extra warning from the compiler\" OFF) option(LIEF_LOGGING \"Enable logging\" ON) option(LIEF_LOGGING_DEBUG \"Enable debug logging\" ON) option(LIEF_ENABLE_JSON \"Enable JSON-related APIs\" ON) option(LIEF_OPT_NLOHMANN_JSON_EXTERNAL \"Use nlohmann/json externally\" OFF) option(LIEF_FORCE_API_EXPORTS \"Force exports of API symbols\" OFF) option(LIEF_PY_LIEF_EXT \"Use a pre-installed version of LIEF for the bindings\" OFF) option(LIEF_PRECOMPILED \"Use a pre-compiled version of LIEF\" OFF) option(LIEF_RUST_API \"Generate the C++ bridge for Rust's cxx\" OFF) option(LIEF_DISABLE_EXCEPTIONS \"Disable C++ exceptions on the core library\" ON) option(LIEF_SO_VERSION \"Embed versioning for LIEF shared library target\" OFF) option(LIEF_COMPILE_DOC_EXAMPLES \"Compile C++ examples in doc/code/\" OFF) option(LIEF_DISABLE_FROZEN \"Disable Frozen even if it is supported\" OFF) option(LIEF_RUNTIME \"Enable runtime features\" OFF) option(LIEF_ELF \"Build LIEF with ELF module\" ON) option(LIEF_PE \"Build LIEF with PE module\" ON) option(LIEF_COFF \"Build LIEF with COFF module\" ON) option(LIEF_MACHO \"Build LIEF with MachO module\" ON) option(LIEF_DEX \"Build LIEF with DEX module\" ON) option(LIEF_ART \"Build LIEF with ART module\" ON) # Extended features option(LIEF_DEBUG_INFO \"Build LIEF with DWARF/PDB support\" OFF) option(LIEF_OBJC \"Build LIEF with ObjC metadata support\" OFF) option(LIEF_DYLD_SHARED_CACHE \"Build LIEF with Dyld shared cache support\" OFF) option(LIEF_ASM \"Build LIEF with assembler/disassembler support\" OFF) option(LIEF_RUNTIME_EXTENDED \"Build LIEF with assembler/disassembler support\" OFF) if (LIEF_COFF AND NOT LIEF_PE) message(FATAL_ERROR \"COFF module requires LIEF_PE enabled\") endif() if (LIEF_PE AND NOT LIEF_COFF) message(FATAL_ERROR \"PE module requires LIEF_COFF enabled\") endif() if (LIEF_PY_LIEF_EXT) set(LIEF_PRECOMPILED ON) endif() cmake_dependent_option(LIEF_PYTHON_EDITABLE \"Make an editable build \" OFF \"LIEF_PYTHON_API\" OFF) cmake_dependent_option(LIEF_PY_LIEF_EXT_SHARED \"Use a 'SHARED' version of LIEF instead of a static one\" OFF \"LIEF_PY_LIEF_EXT\" OFF) cmake_dependent_option(LIEF_PYTHON_STATIC \"Internal usage\" OFF \"LIEF_PYTHON_API\" OFF) cmake_dependent_option(LIEF_PYTHON_STABLE_ABI \"Compile LIEF Python bindings with the stable ABI\" OFF \"LIEF_PYTHON_API\" OFF) cmake_dependent_option(LIEF_PYTHON_FREE_THREADED \"Compile LIEF Python bindings with free-threading enabled\" OFF \"LIEF_PYTHON_API\" OFF) # OAT support relies on the ELF and DEX format. # Therefore, these options must be enabled to support this format cmake_dependent_option(LIEF_OAT \"Build LIEF with OAT module\" ON \"LIEF_ELF;LIEF_DEX\" OFF) # VDEX format depends on the DEX module cmake_dependent_option(LIEF_VDEX \"Build LIEF with VDEX module\" ON \"LIEF_DEX\" OFF) # Sanitizer option(LIEF_ASAN \"Enable Address sanitizer\" OFF) option(LIEF_LSAN \"Enable Leak sanitizer\" OFF) option(LIEF_TSAN \"Enable Thread sanitizer\" OFF) option(LIEF_USAN \"Enable undefined sanitizer\" OFF) # Fuzzer option(LIEF_FUZZING \"Fuzz LIEF\" OFF) # Profiling option(LIEF_PROFILING \"Enable performance profiling\" OFF) # QA / Linters option(LIEF_CLANG_TIDY \"Enable clang-tidy checks\" OFF) cmake_dependent_option(LIEF_CLANG_TIDY_WARN_ERR \"Enable WarningsAsErrors when running clang-tidy\" OFF \"LIEF_CLANG_TIDY\" OFF) # Install options cmake_dependent_option(LIEF_INSTALL_COMPILED_EXAMPLES \"Install LIEF Compiled examples\" OFF \"LIEF_EXAMPLES\" OFF) # Use a user-provided version of spdlog # It can be useful to reduce compile time option(LIEF_EXTERNAL_SPDLOG OFF) # This option enables to provide an external # version of TartanLlama/expected (e.g. present on the system) option(LIEF_OPT_EXTERNAL_EXPECTED OFF) # This option enables to provide an external version of utf8cpp option(LIEF_OPT_UTFCPP_EXTERNAL OFF) # This option enables to provide an external version of MbedTLS option(LIEF_OPT_MBEDTLS_EXTERNAL OFF) # This option enables to provide an external version of nanobind option(LIEF_OPT_NANOBIND_EXTERNAL OFF) # This option enables to provide an external # version of https://github.com/tcbrindle/span (e.g. present on the system) option(LIEF_OPT_EXTERNAL_SPAN OFF) set(LIEF_EXTERNAL_SPAN_DIR ) # This option enables to provide an external version of Frozen set(_LIEF_USE_FROZEN ON) if(LIEF_DISABLE_FROZEN) set(_LIEF_USE_FROZEN OFF) endif() cmake_dependent_option(LIEF_OPT_FROZEN_EXTERNAL \"Use an external provided version of Frozen\" OFF \"_LIEF_USE_FROZEN\" OFF) option(LIEF_USE_MELKOR \"Build Melkor for testing\" ON) # This option enables the install target in the cmake option(LIEF_INSTALL \"Generate the install target.\" ON) set(LIEF_RUNTIME_SUPPORT 0) set(LIEF_ELF_SUPPORT 0) set(LIEF_PE_SUPPORT 0) set(LIEF_MACHO_SUPPORT 0) set(LIEF_COFF_SUPPORT 0) set(LIEF_OAT_SUPPORT 0) set(LIEF_DEX_SUPPORT 0) set(LIEF_VDEX_SUPPORT 0) set(LIEF_ART_SUPPORT 0) set(LIEF_JSON_SUPPORT 0) set(LIEF_NLOHMANN_JSON_EXTERNAL 0) set(LIEF_LOGGING_SUPPORT 0) set(LIEF_LOGGING_DEBUG_SUPPORT 0) set(LIEF_FROZEN_ENABLED 0) set(LIEF_EXTERNAL_FROZEN 0) set(LIEF_EXTERNAL_EXPECTED 0) set(LIEF_EXTERNAL_UTF8CPP 0) set(LIEF_EXTERNAL_MBEDTLS 0) set(LIEF_EXTERNAL_SPAN 0) set(LIEF_DEBUG_INFO_SUPPORT 0) set(LIEF_OBJC_SUPPORT 0) set(LIEF_DYLD_SHARED_CACHE_SUPPORT 0) set(LIEF_ASM_SUPPORT 0) set(LIEF_EXTENDED 0) if(LIEF_RUNTIME) set(LIEF_RUNTIME_SUPPORT 1) endif() if(LIEF_ELF) set(LIEF_ELF_SUPPORT 1) endif() if(LIEF_PE) set(LIEF_PE_SUPPORT 1) endif() if(LIEF_MACHO) set(LIEF_MACHO_SUPPORT 1) endif() if(LIEF_COFF) set(LIEF_COFF_SUPPORT 1) endif() if(LIEF_OAT) set(LIEF_OAT_SUPPORT 1) endif() if(LIEF_DEX) set(LIEF_DEX_SUPPORT 1) endif() if(LIEF_VDEX) set(LIEF_VDEX_SUPPORT 1) endif() if(LIEF_ART) set(LIEF_ART_SUPPORT 1) endif() if(LIEF_ENABLE_JSON) set(LIEF_JSON_SUPPORT 1) if(LIEF_OPT_NLOHMANN_JSON_EXTERNAL) set(LIEF_NLOHMANN_JSON_EXTERNAL 1) endif() endif() if(LIEF_LOGGING) set(LIEF_LOGGING_SUPPORT 1) if(LIEF_LOGGING_DEBUG) set(LIEF_LOGGING_DEBUG_SUPPORT 1) else() set(LIEF_LOGGING_DEBUG_SUPPORT 0) endif() endif() if(NOT LIEF_DISABLE_FROZEN) set(LIEF_FROZEN_ENABLED 1) if(LIEF_OPT_FROZEN_EXTERNAL) set(LIEF_EXTERNAL_FROZEN 1) endif() endif() if(LIEF_OPT_EXTERNAL_EXPECTED) set(LIEF_EXTERNAL_EXPECTED 1) endif() if(LIEF_OPT_UTFCPP_EXTERNAL) set(LIEF_EXTERNAL_UTF8CPP 1) endif() if(LIEF_OPT_MBEDTLS_EXTERNAL) set(LIEF_EXTERNAL_MBEDTLS 1) endif() if(LIEF_OPT_EXTERNAL_SPAN) set(LIEF_EXTERNAL_SPAN 1) endif() if(LIEF_PYTHON_API) if(LIEF_OPT_NANOBIND_EXTERNAL) set(LIEF_EXTERNAL_NANOBIND 1) endif() endif() # ------------------------------------------------------------------------------ # Extended features # ------------------------------------------------------------------------------ if (LIEF_DEBUG_INFO) set(LIEF_DEBUG_INFO_SUPPORT 1) endif() if (LIEF_OBJC) set(LIEF_OBJC_SUPPORT 1) endif() if (LIEF_DYLD_SHARED_CACHE) set(LIEF_DYLD_SHARED_CACHE_SUPPORT 1) endif() if (LIEF_ASM) set(LIEF_ASM_SUPPORT 1) endif() if (LIEF_RUNTIME_EXTENDED) set(LIEF_RUNTIME_EXTENDED_SUPPORT 1) endif() if (LIEF_DEBUG_INFO OR LIEF_OBJC OR LIEF_DYLD_SHARED_CACHE OR LIEF_ASM OR LIEF_RUNTIME_EXTENDED) # or any other extended feature set(LIEF_EXTENDED 1) endif() if (LIEF_RUNTIME) include(LIEFRuntime) endif() Docker See liefproject on Docker Hub", "contentHash": "d56bf622ebd71a76e5c68e26004de6c287c3e72f138e916d090311865fe1a5aa", "description": "Compilation. To compile LIEF, you need at least the following:", "docname": "compilation", "documentID": "aae98ef7eba7d7c35725bc1aa4bb954daca08d44231bca326640218c42ee65cd", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/compilation.md", "title": "Compilation - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/assembler/cpp.html", "content": "C++ LIEF::Binary::assemble() LIEF::assembly::Engine AssemblerConfig AssemblerConfig class AssemblerConfig This class exposes the different elements that can be configured to assemble code. Public Types DIALECT enum class DIALECT The different supported dialects. Values: DEFAULT_DIALECT enumerator DEFAULT_DIALECT = 0 X86_INTEL enumerator X86_INTEL Intel syntax. X86_ATT enumerator X86_ATT AT&T syntax. Public Functions AssemblerConfig AssemblerConfig() = default AssemblerConfig AssemblerConfig(const AssemblerConfig &) = default operator= AssemblerConfig &operator=(const AssemblerConfig &) = default AssemblerConfig AssemblerConfig( AssemblerConfig &&) = default operator= AssemblerConfig &operator=( AssemblerConfig &&) = default resolve_symbol inline virtual std::optional resolve_symbol(const std::string&) This function aims to be overloaded in order to resolve symbols used in the assembly listing. For instance, given this assembly code: 0x1000: mov rdi, rbx 0x1003: call _my_function The function _my_function will remain undefined unless we return its address in resolve_symbol() : class MyConfig : public AssemblerConfig { public: std::optional resolve_symbol(const std::string& name) { if (name == \"_my_function\") { return 0x4000; } return std::nullopt; // or AssemblerConfig::resolve_symbol(name) } }; ~AssemblerConfig virtual ~AssemblerConfig() = default Public Members dialect DIALECT dialect = DIALECT :: DEFAULT_DIALECT The dialect of the input assembly code. Public Static Functions default_config static inline AssemblerConfig &default_config() Default configuration.", "contentHash": "80aa192870bd18696d66ca0287e64094f01736fb9e783c80d853f11027c13b87", "description": "Assembler C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "extended/assembler/cpp", "documentID": "6b3782f431df89f4fb9b6765277a317fc6f9af94fcad633f927d89ff793de218", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/assembler/cpp.md", "title": "Assembler C++ API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/assembler/index.html", "content": "Assembler API C++ Python Rust Introduction LIEF Extended can assemble instructions and patch them into a parsed binary with lief.Binary.assemble() ( lief::generic::Binary::assemble ; LIEF::Binary::assemble() ; lief.Binary.assemble() ). Patch a binary Pass a virtual address in the binary and assembly text for its architecture. The following example assumes an AArch64 ELF binary: Python elf: lief.ELF.Binary syscall_addresses = [ inst.address for inst in elf.disassemble(0x400090) if inst.is_syscall ] for syscall_addr in syscall_addresses: elf.assemble( syscall_addr, \"\"\" mov x1, x0; str x1, [x2, #8]; \"\"\", ) C++ std::unique_ptr elf; std::vector syscall_addresses; for (const auto& inst : elf->disassemble(0x400090)) { if (inst.is_syscall()) { syscall_addresses.push_back(inst.address()); } } for (uint64_t addr : syscall_addresses) { elf->assemble(addr, R\"asm( mov x1, x0; str x1, [x2, #8]; )asm\"); } Rust let elf: &mut lief::elf::Binary = some_elf; let syscall_addresses: Vec = elf .disassemble_address(0x400090) .filter(|inst| inst.is_syscall()) .map(|inst| inst.address()) .collect(); for addr in syscall_addresses { elf.assemble( addr, r#\" mov x1, x0; str x1, [x2, #8]; \"#, ); } The call returns the generated bytes and patches the binary object. Save the result with the format’s write API, such as lief.ELF.Binary.write() ( lief::elf::Binary::write ; lief::elf::Binary::write_with_config ; lief.ELF.Binary.write() ; LIEF::ELF::Binary::write() ), lief.PE.Binary.write() ( lief::pe::Binary::write ; lief.PE.Binary.write() ; LIEF::PE::Binary::write() ), or lief.MachO.Binary.write() ( lief::macho::Binary::write ; lief::macho::Binary::write_with_config ; lief.MachO.Binary.write() ; LIEF::MachO::Binary::write() ). Warning The assembler works well for AArch64/ARM64E , x86/x86-64 , and RISC-V but support for other architectures is currently limited. Technical Details Similar to the disassembler , this assembler is based on the LLVM MC layer. The assembly text is consumed by the llvm::MCAsmParser object, and we intercept the raw generated assembly bytes from the llvm::MCObjectWriter . We also resolve llvm::MCFixup for a vast majority of the generated fixups. An important feature introduced in LIEF 0.17.0 is support for resolving symbols or labels on the fly . Contextual Assembly Patching Given assembly code and a target address, we might want to use a context to resolve symbols referenced in the assembly listing. For example, consider the following x86-64 patch: Python elf: lief.ELF.Binary elf.assemble( elf.entrypoint, \"\"\" mov rdi, rax; call a_custom_function; \"\"\", ) C++ std::unique_ptr elf; elf->assemble(elf->entrypoint(), R\"asm( mov rdi, rax; call a_custom_function; )asm\"); Rust let elf: &mut lief::elf::Binary = some_elf; elf.assemble( elf.entrypoint(), r#\" mov rdi, rax; call a_custom_function; \"#, ); In this example, a_custom_function is undefined, so the assembler engine cannot resolve it and reports an unresolved fixup: warning: Fixup not resolved: call a_custom_function LIEF exposes a lief.assembly.AssemblerConfig ( lief::assembly::AssemblerConfig ; LIEF::assembly::AssemblerConfig ; lief.assembly.AssemblerConfig ) interface that can be used to configure the engine and to dynamically resolve symbols used in the assembly listing: Python class MyConfig(lief.assembly.AssemblerConfig): def __init__(self): super().__init__() # Important! @override def resolve_symbol(self, name: str) -> int | None: if name == \"a_custom_function\": return 0x1000 return None elf: lief.ELF.Binary elf.assemble( elf.entrypoint, \"\"\" mov rdi, rax; call a_custom_function; \"\"\", MyConfig(), ) C++ class MyConfig : public LIEF::assembly::AssemblerConfig { public: std::optional resolve_symbol(const std::string& name) override { if (name == \"a_custom_function\") { return 0x1000; } return std::nullopt; } }; MyConfig myconfig; std::unique_ptr elf; elf->assemble(elf->entrypoint(), R\"asm( mov rdi, rax; call a_custom_function; )asm\", myconfig); Rust let elf: &mut lief::elf::Binary = some_elf; let mut config = lief::assembly::AssemblerConfig::default(); let resolver = Arc::new(|symbol: &str| { if symbol == \"a_custom_function\" { return Some(0x1000); } None }); config.symbol_resolver = Some(resolver); elf.assemble_with_config( elf.entrypoint(), r#\" mov rdi, rax; call a_custom_function; \"#, &config, ); Return the symbol’s address in the same address space as the patch, or no value when it cannot be resolved. An unresolved symbol diagnostic needs to be handled before using the resulting patch. This interface can be used to wrap a context, such as a generic lief.abstract.Binary ( lief::generic::Binary ; lief.Binary ; LIEF::Binary ): Python import lief class MyConfig(lief.assembly.AssemblerConfig): def __init__(self, target: lief.Binary): super().__init__() # Important! self._target = target @override def resolve_symbol(self, name: str) -> int | None: addr = self._target.get_function_address(name) if isinstance(addr, lief.lief_errors): return None return addr elf: lief.ELF.Binary config = MyConfig(elf) elf.assemble( elf.entrypoint, \"\"\" mov rdi, rax; call a_custom_function; \"\"\", config, ) C++ class MyConfig : public LIEF::assembly::AssemblerConfig { public: MyConfig() = delete; MyConfig(LIEF::Binary& target) : LIEF::assembly::AssemblerConfig(), target_(&target) {} std::optional resolve_symbol(const std::string& name) override { if (auto addr = target_->get_function_address(name)) { return *addr; } return std::nullopt; } ~MyConfig() override = default; private: LIEF::Binary* target_ = nullptr; }; std::unique_ptr elf; MyConfig myconfig(*elf); elf->assemble(elf->entrypoint(), R\"asm( mov rdi, rax; call a_custom_function; )asm\", myconfig); The Rust bindings do not offer the same flexibility to capture the lief.abstract.Binary ( lief::generic::Binary ; lief.Binary ; LIEF::Binary ). Nevertheless, the closure associated with the lief::assembly::AssemblerConfig::symbol_resolver can capture most of its context: Rust let elf: &mut lief::elf::Binary = some_elf; let mut config = lief::assembly::AssemblerConfig::default(); let sym_map: HashMap = elf .exported_symbols() .map(|sym| (sym.name(), sym.value())) .collect(); let resolver = Arc::new(move |symbol: &str| sym_map.get(symbol).copied()); config.symbol_resolver = Some(resolver); elf.assemble_with_config( elf.entrypoint(), r#\" mov rdi, rax; call a_custom_function; \"#, &config, ); Use Cases Patching code with the assembler is a fast alternative to editing raw bytes by hand: it is useful for bypassing a check while reverse engineering, hot-patching a bug in a shipped executable, or inserting instrumentation. Disabling an Instruction To strip a single instruction like a call to a telemetry or anti-debugging routine without shifting the rest of the function we can overwrite it with as many nop bytes as it occupied. Pairing the disassembler with lief.Binary.assemble() ( lief::generic::Binary::assemble ; LIEF::Binary::assemble() ; lief.Binary.assemble() ) lets you do this: Python elf: lief.ELF.Binary # Overwrite the first call in the region (e.g. a call to an anti-debugging # routine) with nops for inst in elf.disassemble(0x401200): if inst.is_call: elf.assemble(inst.address, \"nop\\n\" * inst.size) break elf.write(\"patched.bin\") C++ std::unique_ptr elf; // Overwrite the first call in the region (e.g. a call to an anti-debugging // routine) with nops for (const auto& inst : elf->disassemble(0x401200)) { if (inst.is_call()) { std::string nops; for (size_t i = 0; i < inst.size(); ++i) { nops += \"nop\\n\"; } elf->assemble(inst.address(), nops); break; } } elf->write(\"patched.bin\"); Rust let elf: &mut lief::elf::Binary = some_elf; // Overwrite the first call in the region (e.g. a call to an anti-debugging // routine) with nops let target = elf .disassemble_address(0x401200) .find(|inst| inst.is_call()) .map(|inst| (inst.address(), inst.size())); if let Some((address, size)) = target { elf.assemble(address, &\"nop\\n\".repeat(size as usize)); } elf.write(\"patched.bin\"); Note The snippets above assume x86/x86-64 , where a nop is a single byte, so inst.size of them fill the slot exactly. On a fixed-width instruction set such as AArch64 every instruction is 4 bytes, so we would emit inst.size / 4 instead. In-Memory Assembler In addition to patching binaries on disk or within standard file formats, the assembly engine is also available for JIT compilation and in-memory operations. This is exposed through the runtime API lief.runtime.assemble() ( lief::runtime::assemble ; lief::runtime::assemble_with_config ; lief.runtime.assemble() ; LIEF::runtime::assemble() ), as detailed in the Runtime Memory documentation. API Python API C++ API Rust API", "contentHash": "6bd6bc0bb47a7fc6be5bbc69decb11ea6f7f6c6ae822be97507495c558a489cf", "description": "Patch executable code with LIEF Extended, choose virtual addresses and patch sizes, and resolve symbols through an assembler configuration.", "docname": "extended/assembler/index", "documentID": "ce4def58194691d52ba5d885d5285c10ec7e272e16d656397f3f1cc2620deb88", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/assembler/index.md", "title": "Assembler - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/assembler/python.html", "content": "Python lief.Binary.assemble() lief.assembly.Engine AssemblerConfig lief.assembly.AssemblerConfig class lief.assembly.AssemblerConfig( self ) Bases: object This class exposes the different elements that can be configured to assemble code. DIALECT class DIALECT( *values ) Bases: Enum The different supported dialects DEFAULT_DIALECT DEFAULT_DIALECT = 0 X86_ATT X86_ATT = 2 X86_INTEL X86_INTEL = 1 default_config default_config → lief.assembly.AssemblerConfig = dialect property dialect → lief.assembly.AssemblerConfig.DIALECT The dialect of the input assembly code resolve_symbol resolve_symbol( self , name: str ) → int | None This function aims to be overloaded in order to resolve symbols used in the assembly listing. For instance, given this assembly code: 0x1000: mov rdi, rbx 0x1003: call _my_function The function _my_function will remain undefined unless we return its address in resolve_symbol() : class MyConfig(lief.assembly.AssemblerConfig): def __init__(self): super().__init__() # This is important @override def resolve_symbol(self, name: str) -> int | None: if name == '_my_function': return 0x4000 return None # Or super().resolve_symbol(name)", "contentHash": "424117067121d041f79defa4ccda0047f8e5ef38933bbe42c4a6e9a473809e45", "description": "Assembler Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "extended/assembler/python", "documentID": "bfd73052ed524448859f36b751ba1ce18589cfc8e3657b722c9a5bdbbdb7b1ee", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/assembler/python.md", "title": "Assembler Python API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/assembler/rust.html", "content": "Rust lief::generic::Binary::assemble", "contentHash": "4c8b79bfa9998f7ffa90a87da83798cbc2451ff48bc3aa96a158c0bcc84adbe3", "description": "Assembler Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "extended/assembler/rust", "documentID": "d09616b3b3fbf63ee80176d2fc3dfbd05fe276ffe9648158d677f948309a950d", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/assembler/rust.md", "title": "Assembler Rust API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/debug_info/index.html", "content": "Debug Information Debug information connects machine code with source-level names, types, functions, variables, and locations. LIEF Extended reads DWARF and PDB through format-specific APIs and the common interfaces documented below. Choose how to load debug information Input Starting point A binary containing DWARF sections Parse the binary and access lief.Binary.debug_info() ( lief::elf::Binary::debug_info ; lief.Binary.debug_info ; LIEF::Binary::debug_info() ) A separate DWARF file or a Mach-O debug companion Load it with lief.dwarf.load() ( lief::dwarf::load ; lief.dwarf.load() ; LIEF::dwarf::load() ) A PDB file Load it with lief.pdb.load() ( lief::pdb::load ; lief.pdb.load() ; LIEF::pdb::load() ) A parsed binary and its matching external debug file Attach the file with lief.abstract.Binary.load_debug_info() ( lief::generic::Binary::load_debug_info ; lief.Binary.load_debug_info() ; LIEF::Binary::load_debug_info() ) Attaching an external file makes its information available to the parsed binary. The lief.Binary.disassemble() ( lief::generic::Binary::disassemble ; lief::generic::Binary::disassemble_symbol ; lief::generic::Binary::disassemble_address ; lief::generic::Binary::disassemble_slice ; LIEF::Binary::disassemble() ; lief.Binary.disassemble() ; lief.Binary.disassemble_from_bytes() ) API can then disassemble functions by name. Attaching the file does not embed it into the executable. Use the debug file from the same build: lief.abstract.Binary.load_debug_info() ( lief::generic::Binary::load_debug_info ; lief.Binary.load_debug_info() ; LIEF::Binary::load_debug_info() ) does not verify build IDs or PDB identifiers for you. The DWARF and PDB guides show how to iterate over compilation units, find functions and types, and generate C/C++ declarations. Shared API reference C++ DebugInfo DebugInfo class DebugInfo This class provides a generic interface for accessing debug information from different formats such as DWARF and PDB. Users can use this interface to access high-level debug features like resolving function addresses. See also LIEF::pdb::DebugInfo , LIEF::dwarf::DebugInfo Subclassed by LIEF::dwarf::DebugInfo , LIEF::pdb::DebugInfo Public Types FORMAT enum class FORMAT Values: UNKNOWN enumerator UNKNOWN = 0 DWARF enumerator DWARF PDB enumerator PDB Public Functions DebugInfo DebugInfo(std::unique_ptr impl) ~DebugInfo virtual ~DebugInfo() format inline virtual FORMAT format() const Tas template inline const T *as() const This function can be used to down cast a DebugInfo instance: std::unique_ptr dbg = bin->debug_info(); if (const auto* dwarf = inst->as()) { dwarf->find_function(\"main\"); } find_function_address virtual std::optional find_function_address(const std::string &name) const = 0 Attempt to resolve the address of the function specified by name . Friends friend class Binary debug_location_t debug_location_t struct debug_location_t This structure holds a debug location (source filename & line). Public Members file std::string file line uint64_t line = 0 DeclOpt DeclOpt class DeclOpt Configuration options for generated code from debug info. This structure configures how the debug information (DWARF/PDB) translated into an AST is generated. You can use it to configure the indentation, and the information to generate when translating DWARF/PDB into C++-like definitions Public Types type_aliases_t using type_aliases_t = std::unordered_map Mapping between a type name and a user-friendly aliases. (e.g. std::basic_string,std::allocator> -> std::string ). Public Functions DeclOpt DeclOpt() DeclOpt DeclOpt(const DeclOpt &other) operator= DeclOpt &operator=(const DeclOpt &other) DeclOpt DeclOpt( DeclOpt &&other) noexcept operator= DeclOpt &operator=( DeclOpt &&other) noexcept ~DeclOpt ~DeclOpt() indentation uint32_t indentation() const The number of spaces for indentation. indentation DeclOpt &indentation(uint32_t value) is_cpp bool is_cpp() const Prefer C++ syntax over C syntax. If true, the output will use C++ features (e.g. bool keyword) is_cpp DeclOpt &is_cpp(bool value) show_extended_annotations bool show_extended_annotations() const Enable extended comments and annotations. If true, the generated code will include comments containing low-level details such as memory addresses, offsets, type sizes, and original source locations. show_extended_annotations DeclOpt &show_extended_annotations(bool value) include_types bool include_types() const Include full type definitions. If true, the output will contain the full definition of types (structs, enums, unions). include_types DeclOpt &include_types(bool value) include_locals bool include_locals() const Emit a function body listing its local / stack variables. include_locals DeclOpt &include_locals(bool value) desugar bool desugar() const Resolve type aliases (sugar). If true, typedef and type aliases are replaced by their underlying canonical types (e.g., uint32_t might become unsigned int ). desugar DeclOpt &desugar(bool value) show_field_offsets bool show_field_offsets() const Show the relative offset of each field/attribute in structures. If true, every member of a structure is prefixed with its byte offset, struct Foo { /* 0x00 *‍/ int A; /* 0x04 *‍/ int B; }; show_field_offsets DeclOpt &show_field_offsets(bool value) type_aliases const type_aliases_t &type_aliases() const Mapping of type names to user-friendly aliases. type_aliases DeclOpt &type_aliases( type_aliases_t aliases) add_type_alias DeclOpt &add_type_alias(std::string name, std::string alias) Register a single type alias. Python DebugInfo lief.DebugInfo class lief.DebugInfo Bases: object This class provides a generic interface for accessing debug information from different formats such as DWARF and PDB. Users can use this interface to access high-level debug features like resolving function addresses. See: DebugInfo , lief.dwarf.DebugInfo FORMAT class FORMAT( *values ) Bases: Enum DWARF DWARF = 1 PDB PDB = 2 UNKNOWN UNKNOWN = 0 from_value from_value( arg: int ) → lief.DebugInfo.FORMAT = find_function_address find_function_address( self , name: str ) → int | None Attempt to resolve the address of the function specified by name . format property format → lief.DebugInfo.FORMAT The actual debug format (PDB/DWARF) debug_location_t lief.debug_location_t class lief.debug_location_t Bases: object file property file → str line property line → int DeclOpt lief.DeclOpt class lief.DeclOpt( self ) Bases: object Configuration options for generated code from debug info. This structure configures how the debug information (DWARF/PDB) translated into an AST is generated. You can use it to configure the indentation, and the information to generate when translating DWARF/PDB into C++-like definitions add_type_alias add_type_alias( self , name: str , alias: str ) → lief._lief.DeclOpt Register a single type alias (see type_aliases ). desugar property desugar → bool Resolve type aliases (sugar). If true, typedef and type aliases are replaced by their underlying canonical types (e.g., uint32_t might become unsigned int ). include_locals property include_locals → bool Emit a function body listing its local / stack variables. include_types property include_types → bool Include full type definitions. If true, the output will contain the full definition of types (structs, enums, unions). indentation property indentation → int The number of spaces for indentation. is_cpp property is_cpp → bool Prefer C++ syntax over C syntax. If true, the output will use C++ features (e.g., bool keyword) show_extended_annotations property show_extended_annotations → bool Enable extended comments and annotations. If true, the generated code will include comments containing low-level details such as memory addresses, offsets, type sizes, and original source locations. show_field_offsets property show_field_offsets → bool Show the relative offset of each field/attribute in structures. If true, every member of a structure is prefixed with its byte offset (e.g. /* 0x04 */ ). type_aliases property type_aliases → dict[str, str] Mapping of type names to user-friendly aliases used while rendering types (e.g. std::basic_string -> std::string ). Rust lief::generic::DebugInfo lief::DebugLocation lief::DeclOpt", "contentHash": "df58ab23032cad6658ee4e6ef7397e2cdcf48631bf38e4d0beaf4a239f2fd348", "description": "Load DWARF and PDB debug information, attach matching debug files to binaries, and navigate the shared Python, C++, and Rust APIs.", "docname": "extended/debug_info/index", "documentID": "56fb1685892b85202d6c176a1e22d939201f0c0a79f93e53993ff05aeeb82c35", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/debug_info/index.md", "title": "Debug Information - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/disassembler/cpp/arch/aarch64.html", "content": "AArch64 Instruction Instruction class Instruction : public LIEF::assembly:: Instruction This class represents an AArch64 instruction. Public Types operands_it using operands_it = iterator_range < Operand :: Iterator > Public Functions opcode OPCODE opcode() const The instruction opcode as defined in LLVM. operands operands_it operands() const Iterator over the operands of the current instruction. ~Instruction virtual ~Instruction() override = default Public Static Functions classof static bool classof(const assembly:: Instruction *inst) True if inst is an effective instance of aarch64::Instruction . Opcodes See LIEF::assembly::aarch64::OPCODE in include/asm/aarch64/opcodes.hpp Operands Operand class Operand This class represents an operand for an AArch64 instruction. Subclassed by LIEF::assembly::aarch64::operands::Immediate , LIEF::assembly::aarch64::operands::Memory , LIEF::assembly::aarch64::operands::PCRelative , LIEF::assembly::aarch64::operands::Register Public Functions to_string std::string to_string() const Pretty representation of the operand. Tas template inline const T *as() const This function can be used to down cast an Operand instance: std::unique_ptr op = ...; if (const auto* imm = inst->as()) { const int64_t value = imm->value(); } ~Operand virtual ~Operand() Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Operand &op) Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::forward_iterator_tag, Operand , std::ptrdiff_t, const Operand *, const Operand &> Forward iterator that lazily disassembles aarch64 Operand . Public Types implementation using implementation = details::OperandIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator* const Operand &operator*() const operator-> const Operand *operator->() const yield std::unique_ptr< Operand > yield() Transfer ownership of the operand at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) Immediate Immediate class Immediate : public LIEF::assembly::aarch64:: Operand This class represents an immediate operand (i.e. a constant). For instance: mov x0, #8; | +---> Immediate(8) Public Functions value int64_t value() const The constant value wrapped by this operand. ~Immediate ~Immediate() override = default Public Static Functions classof static bool classof(const Operand *op) Register Register class Register : public LIEF::assembly::aarch64:: Operand This class represents a register operand. mrs x0, TPIDR_EL0 | | +------+ +-------+ | | v v REG SYSREG Public Functions value reg_t value() const The effective register as either: a REG or a SYSREG. ~Register ~Register() override = default Public Static Functions classof static bool classof(const Operand *op) reg_t struct reg_t Public Types TYPE enum class TYPE Enum type used to discriminate the anonymous union. Values: NONE enumerator NONE = 0 SYSREG enumerator SYSREG The union holds a sysreg attribute. REG enumerator REG The union holds the reg attribute. Public Members [anonymous] union LIEF::assembly::aarch64::operands:: Register :: reg_t ::[anonymous] [anonymous] type TYPE type = TYPE :: NONE [union].__unnamed0__ Public Members reg REG reg sysreg SYSREG sysreg Memory Memory class Memory : public LIEF::assembly::aarch64:: Operand This class represents a memory operand. ldr x0, [x1, x2, lsl #3] | | | +------------+ | +--------+ | | | v v v Base Reg Offset Shift Public Types SHIFT enum class SHIFT : int32_t Values: UNKNOWN enumerator UNKNOWN = 0 LSL enumerator LSL UXTX enumerator UXTX UXTW enumerator UXTW SXTX enumerator SXTX SXTW enumerator SXTW Public Functions base REG base() const The base register. For str x3, [x8, #8] it would return x8 . offset offset_t offset() const The addressing offset. It can be either: A register (e.g. ldr x0, [x1, x3] ) An offset (e.g. ldr x0, [x1, #8] ) shift shift_info_t shift() const Shift information. For instance, for ldr x1, [x2, x3, lsl #3] it would return a SHIFT::LSL with a shift_info_t::value set to 3 . ~Memory ~Memory() override = default Public Static Functions classof static bool classof(const Operand *op) shift_info_t struct shift_info_t This structure holds shift info (type + value). Public Members type SHIFT type = SHIFT :: UNKNOWN value int8_t value = -1 offset_t struct offset_t Wraps a memory offset as an integer offset or as a register offset. Public Types TYPE enum class TYPE Enum type used to discriminate the anonymous union. Values: NONE enumerator NONE = 0 REG enumerator REG The union holds the REG attribute. DISP enumerator DISP The union holds the displacement attribute ( int64_t ). Public Members [anonymous] union LIEF::assembly::aarch64::operands:: Memory :: offset_t ::[anonymous] [anonymous] type TYPE type = TYPE :: NONE [union].__unnamed0__ Public Members reg REG reg Register offset. displacement int64_t displacement Integer offset. PCRelative PCRelative class PCRelative : public LIEF::assembly::aarch64:: Operand This class represents a PC-relative operand. ldr x0, #8 | v PC Relative operand Public Functions value int64_t value() const The effective value that is relative to the current pc register. ~PCRelative ~PCRelative() override = default Public Static Functions classof static bool classof(const Operand *op)", "contentHash": "4ce859202cec9539e552681d230711bdb89dd0274deb7fc61ee6eed87d2c2dca", "description": "AArch64 C++ Disassembler. See LIEF::assembly::aarch64::OPCODE in include/asm/aarch64/opcodes.hpp", "docname": "extended/disassembler/cpp/arch/aarch64", "documentID": "03505adf58bbae96640ed2364838a7da4718662c60d2b39210435d8c1e06290f", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/disassembler/cpp/arch/aarch64.md", "title": "AArch64 - C++ Disassembler - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/disassembler/cpp/arch/arm.html", "content": "ARM Instruction Instruction class Instruction : public LIEF::assembly:: Instruction This class represents an ARM/Thumb instruction. Public Functions opcode OPCODE opcode() const The instruction opcode as defined in LLVM. ~Instruction virtual ~Instruction() override = default Public Static Functions classof static bool classof(const assembly:: Instruction *inst) True if inst is an effective instance of arm::Instruction . Opcodes See LIEF::assembly::arm::OPCODE in include/asm/arm/opcodes.hpp", "contentHash": "d1bf21eab8063f94553a25ce8530d8e8c42e32f00ab8dec798f460a8e8a0ba7e", "description": "ARM C++ Disassembler. See LIEF::assembly::arm::OPCODE in include/asm/arm/opcodes.hpp", "docname": "extended/disassembler/cpp/arch/arm", "documentID": "3c525601b912f19deaf722c137d2cd1decf635e3a1f38b74199950a61ed333b9", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/disassembler/cpp/arch/arm.md", "title": "ARM - C++ Disassembler - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/disassembler/cpp/arch/ebpf.html", "content": "eBPF Instruction Instruction class Instruction : public LIEF::assembly:: Instruction This class represents an eBPF instruction. Public Types operands_it using operands_it = iterator_range < Operand :: Iterator > Public Functions opcode OPCODE opcode() const The instruction opcode as defined in LLVM. operands operands_it operands() const Iterator over the operands of the current instruction. ~Instruction virtual ~Instruction() override = default Public Static Functions classof static bool classof(const assembly:: Instruction *inst) True if inst is an effective instance of ebpf::Instruction . Opcodes See LIEF::assembly::ebpf::OPCODE in include/asm/ebpf/opcodes.hpp Operands Operand class Operand This class represents an operand for an eBPF instruction. Subclassed by LIEF::assembly::ebpf::operands::Immediate , LIEF::assembly::ebpf::operands::Memory , LIEF::assembly::ebpf::operands::PCRelative , LIEF::assembly::ebpf::operands::Register Public Functions to_string std::string to_string() const Pretty representation of the operand. Tas template inline const T *as() const This function can be used to down cast an Operand instance: std::unique_ptr op = ...; if (const auto* imm = inst->as()) { const int64_t value = imm->value(); } ~Operand virtual ~Operand() Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Operand &op) Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::forward_iterator_tag, Operand , std::ptrdiff_t, const Operand *, const Operand &> Forward iterator that lazily disassembles ebpf Operand . Public Types implementation using implementation = details::OperandIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator* const Operand &operator*() const operator-> const Operand *operator->() const yield std::unique_ptr< Operand > yield() Transfer ownership of the operand at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) Immediate Immediate class Immediate : public LIEF::assembly::ebpf:: Operand This class represents an immediate operand (i.e. a constant). For instance: r1 = 8 | +---> Immediate(8) Public Functions value int64_t value() const The constant value wrapped by this operand. ~Immediate ~Immediate() override = default Public Static Functions classof static bool classof(const Operand *op) Register Register class Register : public LIEF::assembly::ebpf:: Operand This class represents a register operand. For instance: r0 = r1 | | | +---------> Register(r1) | +--------------> Register(r0) Public Functions value REG value() const The effective REG wrapped by this operand. ~Register ~Register() override = default Public Static Functions classof static bool classof(const Operand *op) Memory Memory class Memory : public LIEF::assembly::ebpf:: Operand This class represents a memory operand. *(u64 *)(r1 + 8) = r2 | | | +-----> Displacement: 8 | +----------> Base: r1 Public Functions base REG base() const The base register. For *(u64 *)(r1 + 8) it would return r1 . displacement int64_t displacement() const The displacement value. For *(u64 *)(r1 + 8) it would return 8 . ~Memory ~Memory() override = default Public Static Functions classof static bool classof(const Operand *op) PCRelative PCRelative class PCRelative : public LIEF::assembly::ebpf:: Operand This class represents a PC-relative operand. if r1 == 0 goto +5 | v PC Relative operand Public Functions value int64_t value() const The effective value that is relative to the current pc register. ~PCRelative ~PCRelative() override = default Public Static Functions classof static bool classof(const Operand *op)", "contentHash": "98c4eefa87aff1cef09e7731500234a6b3d111d160e1f5e3242ed1867208ed9b", "description": "eBPF C++ Disassembler. See LIEF::assembly::ebpf::OPCODE in include/asm/ebpf/opcodes.hpp", "docname": "extended/disassembler/cpp/arch/ebpf", "documentID": "8d62d614620115bc4ecb1efefd78a8dd8d2129f2840272382827ad1f0c213220", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/disassembler/cpp/arch/ebpf.md", "title": "eBPF - C++ Disassembler - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/disassembler/cpp/arch/mips.html", "content": "Mips Instruction Instruction class Instruction : public LIEF::assembly:: Instruction This class represents a Mips instruction (including mips64, mips32). Public Types operands_it using operands_it = iterator_range < Operand :: Iterator > Public Functions opcode OPCODE opcode() const The instruction opcode as defined in LLVM. operands operands_it operands() const Iterator over the operands of the current instruction. ~Instruction virtual ~Instruction() override = default Public Static Functions classof static bool classof(const assembly:: Instruction *inst) True if inst is an effective instance of mips::Instruction . Opcodes See LIEF::assembly::mips::OPCODE in include/asm/mips/opcodes.hpp Operands Operand class Operand This class represents an operand for a Mips instruction. Subclassed by LIEF::assembly::mips::operands::Immediate , LIEF::assembly::mips::operands::Memory , LIEF::assembly::mips::operands::PCRelative , LIEF::assembly::mips::operands::Register Public Functions to_string std::string to_string() const Pretty representation of the operand. Tas template inline const T *as() const This function can be used to down cast an Operand instance: std::unique_ptr op = ...; if (const auto* imm = inst->as()) { const int64_t value = imm->value(); } ~Operand virtual ~Operand() Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Operand &op) Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::forward_iterator_tag, Operand , std::ptrdiff_t, const Operand *, const Operand &> Forward iterator that lazily disassembles mips Operand . Public Types implementation using implementation = details::OperandIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator* const Operand &operator*() const operator-> const Operand *operator->() const yield std::unique_ptr< Operand > yield() Transfer ownership of the operand at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) Immediate Immediate class Immediate : public LIEF::assembly::mips:: Operand This class represents an immediate operand (i.e. a constant). For instance: addiu $4, $5, 8 | +---> Immediate(8) Public Functions value int64_t value() const The constant value wrapped by this operand. ~Immediate ~Immediate() override = default Public Static Functions classof static bool classof(const Operand *op) Register Register class Register : public LIEF::assembly::mips:: Operand This class represents a register operand. For instance: move $4, $5 | | | +---------> Register($5) | +-------------> Register($4) Public Functions value REG value() const The effective REG wrapped by this operand. ~Register ~Register() override = default Public Static Functions classof static bool classof(const Operand *op) Memory Memory class Memory : public LIEF::assembly::mips:: Operand This class represents a memory operand. MIPS has two addressing forms: lw $4, 8($5) ldxc1 $f2, $4($7) | | | | | | +------+ | +---+ +-------+ | +-----+ | | | | | | v v v v v v Reg Disp Base Reg Index Base Public Functions base REG base() const The base register. For lw $4, 8($5) it would return $5 . offset offset_t offset() const The addressing offset. It can be either: A register (e.g. ldxc1 $f2, $4($7) ) A displacement (e.g. lw $4, 8($5) ) ~Memory ~Memory() override = default Public Static Functions classof static bool classof(const Operand *op) offset_t struct offset_t Wraps the memory offset as either an integer displacement or an index register. Public Types TYPE enum class TYPE Enum type used to discriminate the anonymous union. Values: NONE enumerator NONE = 0 REG enumerator REG The union holds the REG attribute. DISP enumerator DISP The union holds the displacement attribute ( int64_t ). Public Members [anonymous] union LIEF::assembly::mips::operands:: Memory :: offset_t ::[anonymous] [anonymous] type TYPE type = TYPE :: NONE [union].__unnamed0__ Public Members reg REG reg Register offset (index register). displacement int64_t displacement Integer offset. PCRelative PCRelative class PCRelative : public LIEF::assembly::mips:: Operand This class represents a PC-relative operand. bal 0x100 | v PC Relative operand Public Functions value int64_t value() const The effective value that is relative to the current pc register. ~PCRelative ~PCRelative() override = default Public Static Functions classof static bool classof(const Operand *op)", "contentHash": "5c4cd36fcc3764dcc7d35e8889134ffce140e3ba1777ed90b607205b852b540f", "description": "Mips C++ Disassembler. See LIEF::assembly::mips::OPCODE in include/asm/mips/opcodes.hpp", "docname": "extended/disassembler/cpp/arch/mips", "documentID": "d91f8bcf149c799357bf8cc1485239911af3900df958b68df10820c6f771916d", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/disassembler/cpp/arch/mips.md", "title": "Mips - C++ Disassembler - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/disassembler/cpp/arch/powerpc.html", "content": "PowerPC Instruction Instruction class Instruction : public LIEF::assembly:: Instruction Public Types operands_it using operands_it = iterator_range < Operand :: Iterator > Public Functions opcode OPCODE opcode() const The instruction opcode as defined in LLVM. operands operands_it operands() const Iterator over the operands of the current instruction. ~Instruction virtual ~Instruction() override = default Public Static Functions classof static bool classof(const assembly:: Instruction *inst) True if inst is an effective instance of powerpc::Instruction . Opcodes See LIEF::assembly::powerpc::OPCODE in include/asm/powerpc/opcodes.hpp Operands Operand class Operand This class represents an operand for a PowerPC instruction. Subclassed by LIEF::assembly::powerpc::operands::Immediate , LIEF::assembly::powerpc::operands::Memory , LIEF::assembly::powerpc::operands::PCRelative , LIEF::assembly::powerpc::operands::Register Public Functions to_string std::string to_string() const Pretty representation of the operand. Tas template inline const T *as() const This function can be used to down cast an Operand instance: std::unique_ptr op = ...; if (const auto* imm = inst->as()) { const int64_t value = imm->value(); } ~Operand virtual ~Operand() Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Operand &op) Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::forward_iterator_tag, Operand , std::ptrdiff_t, const Operand *, const Operand &> Forward iterator that lazily disassembles powerpc Operand . Public Types implementation using implementation = details::OperandIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator* const Operand &operator*() const operator-> const Operand *operator->() const yield std::unique_ptr< Operand > yield() Transfer ownership of the operand at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) Immediate Immediate class Immediate : public LIEF::assembly::powerpc:: Operand This class represents an immediate operand (i.e. a constant). For instance: li 3, 8 | +---> Immediate(8) Public Functions value int64_t value() const The constant value wrapped by this operand. ~Immediate ~Immediate() override = default Public Static Functions classof static bool classof(const Operand *op) Register Register class Register : public LIEF::assembly::powerpc:: Operand This class represents a register operand. For instance: add 3, 4, 5 | | | | | +---------> Register(5) | +------------> Register(4) +---------------> Register(3) Public Functions value REG value() const The effective REG wrapped by this operand. ~Register ~Register() override = default Public Static Functions classof static bool classof(const Operand *op) Memory Memory class Memory : public LIEF::assembly::powerpc:: Operand This class represents a memory operand. PowerPC has two addressing forms: lwz 3, 8(4) lwzx 3, 4, 5 | | | | | +------+ +---+ +------+ | +---+ | | | | | v v v v v Disp Base Reg Base Index Public Functions base REG base() const The base register. For lwz 3, 8(4) it would return 4 . offset offset_t offset() const The addressing offset. It can be either: An index register (e.g. lwzx 3, 4, 5 ) A displacement (e.g. lwz 3, 8(4) ) ~Memory ~Memory() override = default Public Static Functions classof static bool classof(const Operand *op) offset_t struct offset_t Wraps the memory offset as either an integer displacement or an index register. Public Types TYPE enum class TYPE Enum type used to discriminate the anonymous union. Values: NONE enumerator NONE = 0 REG enumerator REG The union holds the REG attribute. DISP enumerator DISP The union holds the displacement attribute ( int64_t ). Public Members [anonymous] union LIEF::assembly::powerpc::operands:: Memory :: offset_t ::[anonymous] [anonymous] type TYPE type = TYPE :: NONE [union].__unnamed0__ Public Members reg REG reg Register offset (index register). displacement int64_t displacement Integer offset. PCRelative PCRelative class PCRelative : public LIEF::assembly::powerpc:: Operand This class represents a PC-relative operand. bl 0x100 | v PC Relative operand Public Functions value int64_t value() const The effective value that is relative to the current pc register. ~PCRelative ~PCRelative() override = default Public Static Functions classof static bool classof(const Operand *op)", "contentHash": "6d0d5e88e6fabea53d910c739a19a0daf12a9f3326dbfa2591bd6b94c2c765ae", "description": "PowerPC C++ Disassembler. See LIEF::assembly::powerpc::OPCODE in include/asm/powerpc/opcodes.hpp", "docname": "extended/disassembler/cpp/arch/powerpc", "documentID": "b1129caa73e5671e3361306b29d1802870aa782fc8c521e98d4a806fde1c28b7", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/disassembler/cpp/arch/powerpc.md", "title": "PowerPC - C++ Disassembler - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/disassembler/cpp/arch/riscv.html", "content": "RISC-V Instruction Instruction class Instruction : public LIEF::assembly:: Instruction This class represents a RISC-V (32 or 64 bit) instruction. Public Types operands_it using operands_it = iterator_range < Operand :: Iterator > Public Functions opcode OPCODE opcode() const The instruction opcode as defined in LLVM. operands operands_it operands() const Iterator over the operands of the current instruction. ~Instruction virtual ~Instruction() override = default Public Static Functions classof static bool classof(const assembly:: Instruction *inst) True if inst is an effective instance of riscv::Instruction . Opcodes See LIEF::assembly::riscv::OPCODE in include/asm/riscv/opcodes.hpp Operands Operand class Operand This class represents an operand for a RISC-V instruction. Subclassed by LIEF::assembly::riscv::operands::Immediate , LIEF::assembly::riscv::operands::Memory , LIEF::assembly::riscv::operands::PCRelative , LIEF::assembly::riscv::operands::Register Public Functions to_string std::string to_string() const Pretty representation of the operand. Tas template inline const T *as() const This function can be used to down cast an Operand instance: std::unique_ptr op = ...; if (const auto* imm = inst->as()) { const int64_t value = imm->value(); } ~Operand virtual ~Operand() Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Operand &op) Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::forward_iterator_tag, Operand , std::ptrdiff_t, const Operand *, const Operand &> Forward iterator that lazily disassembles riscv Operand . Public Types implementation using implementation = details::OperandIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator* const Operand &operator*() const operator-> const Operand *operator->() const yield std::unique_ptr< Operand > yield() Transfer ownership of the operand at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) Immediate Immediate class Immediate : public LIEF::assembly::riscv:: Operand This class represents an immediate operand (i.e. a constant). For instance: addi a0, a1, 8 | +---> Immediate(8) Public Functions value int64_t value() const The constant value wrapped by this operand. ~Immediate ~Immediate() override = default Public Static Functions classof static bool classof(const Operand *op) Register Register class Register : public LIEF::assembly::riscv:: Operand This class represents a register operand. RISC-V exposes two kinds of registers: regular registers (GPR, FPR, vector, …) and control and status registers (CSR / system registers). csrr a0, mstatus | | +------+ +-------+ | | v v REG SYSREG Public Functions value reg_t value() const The effective register as either: a REG or a SYSREG. ~Register ~Register() override = default Public Static Functions classof static bool classof(const Operand *op) reg_t struct reg_t Public Types TYPE enum class TYPE Enum type used to discriminate the anonymous union. Values: NONE enumerator NONE = 0 SYSREG enumerator SYSREG The union holds a sysreg attribute. REG enumerator REG The union holds the reg attribute. Public Members [anonymous] union LIEF::assembly::riscv::operands:: Register :: reg_t ::[anonymous] [anonymous] type TYPE type = TYPE :: NONE [union].__unnamed0__ Public Members reg REG reg sysreg SYSREG sysreg Memory Memory class Memory : public LIEF::assembly::riscv:: Operand This class represents a memory operand. lw a0, 8(sp) | | | +----> Base: sp | +-------> Displacement: 8 Public Functions base REG base() const The base register. For lw a0, 8(sp) it would return sp . displacement int64_t displacement() const The displacement value. For lw a0, 8(sp) it would return 8 . ~Memory ~Memory() override = default Public Static Functions classof static bool classof(const Operand *op) PCRelative PCRelative class PCRelative : public LIEF::assembly::riscv:: Operand This class represents a PC-relative operand. auipc a0, 0x1 | v PC Relative operand Public Functions value int64_t value() const The effective value that is relative to the current pc register. ~PCRelative ~PCRelative() override = default Public Static Functions classof static bool classof(const Operand *op)", "contentHash": "62d1e1503bee3adbc40aee68760b1fbb7446373d80d7371fd0b3fc53357eec0a", "description": "RISC-V C++ Disassembler. See LIEF::assembly::riscv::OPCODE in include/asm/riscv/opcodes.hpp", "docname": "extended/disassembler/cpp/arch/riscv", "documentID": "c47f722d47efba5f635ff0ff517f9b452bc679bb3b0c426d3b61285a3d7bb05e", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/disassembler/cpp/arch/riscv.md", "title": "RISC-V - C++ Disassembler - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/disassembler/cpp/arch/x86.html", "content": "X86/x86-64 Instruction Instruction class Instruction : public LIEF::assembly:: Instruction This class represents a x86/x86-64 instruction. Public Types operands_it using operands_it = iterator_range < Operand :: Iterator > Public Functions opcode OPCODE opcode() const The instruction opcode as defined in LLVM. operands operands_it operands() const Iterator over the operands of the current instruction. has_lock_prefix bool has_lock_prefix() const True if this instruction has a LOCK prefix. is_lockable bool is_lockable() const True if the LOCK prefix is architecturally valid on this instruction. is_atomic bool is_atomic() const True if this instruction executes as an atomic read-modify-write. lock std::unique_ptr< Instruction > lock() const Re-encoded copy of this instruction with a LOCK prefix added. If the instruction already has a LOCK prefix, it returns a plain copy. unlock std::unique_ptr< Instruction > unlock() const Re-encoded copy of this instruction with the LOCK prefix removed. If the instruction does not have a LOCK prefix, it returns a plain copy or a nullptr if the LOCK semantic can’t be removed. ~Instruction virtual ~Instruction() override = default Public Static Functions classof static bool classof(const assembly:: Instruction *inst) True if inst is an effective instance of x86::Instruction . Opcodes See LIEF::assembly::x86::OPCODE in include/asm/x86/opcodes.hpp Operands Operand class Operand This class represents an operand for an x86/x86-64 instruction. Subclassed by LIEF::assembly::x86::operands::Immediate , LIEF::assembly::x86::operands::Memory , LIEF::assembly::x86::operands::PCRelative , LIEF::assembly::x86::operands::Register Public Functions to_string std::string to_string() const Pretty representation of the operand. Tas template inline const T *as() const This function can be used to down cast an Operand instance: std::unique_ptr op = ...; if (const auto* memory = inst->as()) { const assembly::x86::REG base = memory->base(); } ~Operand virtual ~Operand() Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Operand &op) Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::forward_iterator_tag, Operand , std::ptrdiff_t, const Operand *, const Operand &> Forward iterator that lazily disassembles x86 Operand . Public Types implementation using implementation = details::OperandIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator* const Operand &operator*() const operator-> const Operand *operator->() const yield std::unique_ptr< Operand > yield() Transfer ownership of the operand at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) Immediate Immediate class Immediate : public LIEF::assembly::x86:: Operand This class represents an immediate operand (i.e. a constant). For instance: mov edi, 1; | +---> Immediate(1) Public Functions value int64_t value() const The constant value wrapped by this operand. ~Immediate ~Immediate() override = default Public Static Functions classof static bool classof(const Operand *op) Register Register class Register : public LIEF::assembly::x86:: Operand This class represents a register operand. For instance: mov r15d, edi | | | +---------> Register(EDI) | +---------------> Register(R15D) Public Functions value REG value() const The effective REG wrapped by this operand. ~Register ~Register() override = default Public Static Functions classof static bool classof(const Operand *op) Memory Memory class Memory : public LIEF::assembly::x86:: Operand This class represents a memory operand. For instance: movq xmm3, qword ptr [rip + 823864]; | | Memory | +-----------+-----------+ | | | Base: rip Scale: 1 Displacement: 823864 Public Functions base REG base() const The base register. For lea rdx, [rip + 244634] it would return rip scaled_register REG scaled_register() const The scaled register. For mov rdi, qword ptr [r13 + 8*r14] it would return r14 segment_register REG segment_register() const The segment register associated with the memory operation. For mov eax, dword ptr gs:[0] is would return gs scale uint64_t scale() const The scale value associated with the scaled_register() : For mov rdi, qword ptr [r13 + 8*r14] it would return 8 displacement int64_t displacement() const The displacement value. For call qword ptr [rip + 248779] it would return 248779 ~Memory ~Memory() override = default Public Static Functions classof static bool classof(const Operand *op) PCRelative PCRelative class PCRelative : public LIEF::assembly::x86:: Operand This class represents a RIP/EIP-relative operand. For instance: jmp 67633; | +----------> PCRelative(67633) Public Functions value int64_t value() const The effective value that is relative to the current rip/eip register. ~PCRelative ~PCRelative() override = default Public Static Functions classof static bool classof(const Operand *op)", "contentHash": "10d987bf8cb4e8e3ae5ad2b97421c95dec068a83af03f425a1c4d15b1af89f06", "description": "X86/x86-64 C++ Disassembler. See LIEF::assembly::x86::OPCODE in include/asm/x86/opcodes.hpp", "docname": "extended/disassembler/cpp/arch/x86", "documentID": "0450de3562891c41ae9e6729cf3225141d77dd1e4530db18b0411f4e5e5b48da", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/disassembler/cpp/arch/x86.md", "title": "X86/x86-64 - C++ Disassembler - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/disassembler/cpp/index.html", "content": "C++ Architectures Architectures X86/x86-64 AArch64 RISC-V ARM eBPF Mips PowerPC Engine Engine class Engine This class interfaces the assembler/disassembler support. Public Types instructions_it using instructions_it = iterator_range < Instruction :: Iterator > Disassembly instruction iterator. Public Functions Engine Engine() = delete Engine Engine(std::unique_ptr impl) Engine Engine(const Engine &) = delete operator= Engine &operator=(const Engine &) = delete Engine Engine( Engine &&) noexcept operator= Engine &operator=( Engine &&) noexcept disassemble instructions_it disassemble(const uint8_t *buffer, size_t size, uint64_t addr) Disassemble the provided buffer with the address specified in the second parameter. disassemble inline instructions_it disassemble(const std::vector &bytes, uint64_t addr) Disassemble the given vector of bytes with the address specified in the second parameter. assemble std::vector assemble(uint64_t address, const std::string &Asm, AssemblerConfig &config = AssemblerConfig :: default_config ()) assemble std::vector assemble(uint64_t address, const std::string &Asm, LIEF:: Binary &bin, AssemblerConfig &config = AssemblerConfig :: default_config ()) assemble std::vector assemble(const llvm::MCInst &inst) assemble std::vector assemble(const std::vector &inst) ~Engine ~Engine() Instruction Instruction class Instruction This class represents an assembly instruction. Subclassed by LIEF::assembly::aarch64::Instruction , LIEF::assembly::arm::Instruction , LIEF::assembly::ebpf::Instruction , LIEF::assembly::mips::Instruction , LIEF::assembly::powerpc::Instruction , LIEF::assembly::riscv::Instruction , LIEF::assembly::x86::Instruction Public Types MemoryAccess enum class MemoryAccess : uint8_t Memory operation flags. Values: NONE enumerator NONE = 0 READ enumerator READ = 1 << 0 WRITE enumerator WRITE = 1 << 1 READ_WRITE enumerator READ_WRITE = READ | WRITE Public Functions address uint64_t address() const Address of the instruction. size size_t size() const Size of the instruction in bytes. raw const std::vector &raw() const Raw bytes of the current instruction. mnemonic std::string mnemonic() const Instruction mnemonic (e.g. br ). to_string std::string to_string(bool with_address = true) const Representation of the current instruction in a pretty assembly way. is_call bool is_call() const True if the instruction is a call. is_terminator bool is_terminator() const True if the instruction marks the end of a basic block. is_branch bool is_branch() const True if the instruction is a branch. is_syscall bool is_syscall() const True if the instruction is a syscall. is_memory_access bool is_memory_access() const True if the instruction performs a memory access. is_move_reg bool is_move_reg() const True if the instruction is a register to register move. is_add bool is_add() const True if the instruction performs an arithmetic addition. is_trap bool is_trap() const True if the instruction is a trap. On x86/x86-64 this includes the ud1/ud2 instructions On AArch64 this includes the brk/udf instructions is_barrier bool is_barrier() const True if the instruction prevents executing the instruction that immediately follows the current. This includes return or unconditional branch instructions. is_return bool is_return() const True if the instruction is a return. is_indirect_branch bool is_indirect_branch() const True if the instruction is an indirect branch. This includes instructions that branch through a register (e.g. jmp rax , br x1 ). is_conditional_branch bool is_conditional_branch() const True if the instruction is conditionally jumping to the next instruction or an instruction into some other basic block. is_unconditional_branch bool is_unconditional_branch() const True if the instruction is jumping ( unconditionally ) to some other basic block. is_compare bool is_compare() const True if the instruction is a comparison. is_move_immediate bool is_move_immediate() const True if the instruction is moving an immediate. is_bitcast bool is_bitcast() const True if the instruction is doing a bitcast. memory_access MemoryAccess memory_access() const Memory access flags. branch_target result branch_target() const Given a is_branch() instruction, try to evaluate the address of the destination. mcinst const llvm::MCInst &mcinst() const Return the underlying llvm::MCInst implementation. Warning Because of ABI compatibility, this MCInst can only be used with the same version of LLVM used by LIEF (see documentation) Tas template inline const T *as() const This function can be used to down cast an Instruction instance: std::unique_ptr inst = get_inst(); if (const auto* arm = inst->as()) { const arm::OPCODE op = arm->opcode(); } ~Instruction virtual ~Instruction() Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Instruction &inst) Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::forward_iterator_tag, Instruction , std::ptrdiff_t, const Instruction *, const Instruction &> Lazy-forward iterator that disassembles instructions on demand. Public Types implementation using implementation = details::InstructionIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator* const Instruction &operator*() const operator-> const Instruction *operator->() const yield std::unique_ptr< Instruction > yield() Transfer ownership of the instruction at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS)", "contentHash": "aa200159dd6bc4d86d57e222cc00118b1797c10082aac23fd47616e6d006e8ae", "description": "Disassembler C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "extended/disassembler/cpp/index", "documentID": "516146c596309920f673ad4ce0f0ee2f1faa47bc05ab40f2521a6dadf7e05176", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/disassembler/cpp/index.md", "title": "Disassembler C++ API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/disassembler/index.html", "content": "Disassembler API C++ Python Rust Introduction LIEF Extended provides a user-friendly API for disassembling code within various parts of executable formats for the following architectures: x86/x86-64, ARM, AArch64, RISC-V, MIPS, PowerPC, and eBPF. Disassemble a binary You can begin disassembling code within a binary using the lief.Binary.disassemble() ( lief::generic::Binary::disassemble ; lief::generic::Binary::disassemble_symbol ; lief::generic::Binary::disassemble_address ; lief::generic::Binary::disassemble_slice ; LIEF::Binary::disassemble() ; lief.Binary.disassemble() ; lief.Binary.disassemble_from_bytes() ) function, which is exposed in the abstraction layer: Python elf: lief.ELF.Binary for inst in elf.disassemble(0x400120): print(inst) C++ std::unique_ptr pe; for (const auto& inst : pe->disassemble(\"_WinRT\")) { std::cout << inst.to_string() << '\\n'; } Rust let elf: &lief::elf::Binary = some_elf; for inst in elf.disassemble_address(0x400) { println!(\"{}\", inst); } From a design perspective, the disassembler returns a lazy iterator, yielding a lief.assembly.Instruction ( lief::assembly::Instructions ; LIEF::assembly::Instruction ; lief.assembly.Instruction ) instance as it evaluates the instruction at each address. Consequently, when calling elf.disassemble_address(0x400) , no disassembly occurs until the iterator is advanced. Inspect instructions and operands Instructions are represented by the lief.assembly.Instruction ( lief::assembly::Instructions ; LIEF::assembly::Instruction ; lief.assembly.Instruction ) object, which is extended by architecture-specific objects: lief.assembly.x86.Instruction ( lief::assembly::x86::Instruction ; LIEF::assembly::x86::Instruction ; lief.assembly.x86.Instruction ) lief.assembly.arm.Instruction ( lief::assembly::arm::Instruction ; LIEF::assembly::arm::Instruction ; lief.assembly.arm.Instruction ) lief.assembly.aarch64.Instruction ( lief::assembly::aarch64::Instruction ; LIEF::assembly::aarch64::Instruction ; lief.assembly.aarch64.Instruction ) lief.assembly.powerpc.Instruction ( lief::assembly::powerpc::Instruction ; LIEF::assembly::powerpc::Instruction ; lief.assembly.powerpc.Instruction ) lief.assembly.mips.Instruction ( lief::assembly::mips::Instruction ; LIEF::assembly::mips::Instruction ; lief.assembly.mips.Instruction ) lief.assembly.riscv.Instruction ( lief::assembly::riscv::Instruction ; LIEF::assembly::riscv::Instruction ; lief.assembly.riscv.Instruction ) lief.assembly.ebpf.Instruction ( lief::assembly::ebpf::Instruction ; LIEF::assembly::ebpf::Instruction ; lief.assembly.ebpf.Instruction ) In Python, use pattern matching or isinstance(...) to select an architecture-specific lief.assembly.Instruction ( lief::assembly::Instructions ; LIEF::assembly::Instruction ; lief.assembly.Instruction ): inst: lief.assembly.Instruction match inst: case lief.assembly.riscv.Instruction(): opcode: lief.assembly.riscv.OPCODE = inst.opcode In C++, use LIEF::assembly::Instruction::as() ( LIEF::assembly::Instruction::as() ) to access the architecture-specific instruction: std::unique_ptr inst; if (const auto* riscv_inst = inst->as()) { LIEF::assembly::riscv::OPCODE opcode = riscv_inst->opcode(); } In Rust, match the architecture variant of lief.assembly.Instruction ( lief::assembly::Instructions ; LIEF::assembly::Instruction ; lief.assembly.Instruction ): pub fn check_opcode(some_inst: &lief::assembly::Instructions) { let inst: &lief::assembly::Instructions = some_inst; if let lief::assembly::Instructions::RiscV(riscv) = inst { println!(\"{:?}\", riscv.opcode()); } } Note You can also check the assembler documentation here: Assembler For the x86/x86-64 and AArch64 architectures, you can also iterate over an instruction’s operands: AArch64 import lief macho: lief.MachO.Binary for inst in macho.disassemble(0x400120): print(inst) # Check inst properties if inst.is_branch: print(f\"Resolved: {inst.branch_target}\") for idx, operand in enumerate(inst.operands): match operand: case lief.assembly.aarch64.operands.Register(): print(f\"op[{idx}]: REG - {operand.value}\") case lief.assembly.aarch64.operands.Memory(): print(f\"op[{idx}]: MEM - {operand.base}\") case lief.assembly.aarch64.operands.PCRelative(): print(f\"op[{idx}]: PCR - {operand.value}\") case lief.assembly.aarch64.operands.Immediate(): print(f\"op[{idx}]: IMM - {operand.value}\") x86/x86-64 import lief elf: lief.ELF.Binary for inst in elf.disassemble(0x1000200): print(inst) # Check inst properties if inst.is_branch: print(f\"Resolved: {inst.branch_target}\") for idx, operand in enumerate(inst.operands): match operand: case lief.assembly.x86.operands.Register(): print(f\"op[{idx}]: REG - {operand.value}\") case lief.assembly.x86.operands.Memory(): print(f\"op[{idx}]: MEM - {operand.base}\") case lief.assembly.x86.operands.PCRelative(): print(f\"op[{idx}]: PCR - {operand.value}\") case lief.assembly.x86.operands.Immediate(): print(f\"op[{idx}]: IMM - {operand.value}\") See the architecture-specific Python and C++ references for operand types and instruction properties. To write a patch using assembly text, continue with the assembler guide . x86/x86-64 On x86/x86-64, lief.assembly.x86.Instruction ( lief::assembly::x86::Instruction ; LIEF::assembly::x86::Instruction ; lief.assembly.x86.Instruction ) also exposes an API to inspect and rewrite the LOCK prefix of an instruction: lief.assembly.x86.Instruction.has_lock_prefix() ( lief::assembly::x86::Instruction::has_lock_prefix ; lief.assembly.x86.Instruction.has_lock_prefix ; LIEF::assembly::x86::Instruction::has_lock_prefix() ) lief.assembly.x86.Instruction.is_lockable() ( lief::assembly::x86::Instruction::is_lockable ; lief.assembly.x86.Instruction.is_lockable ; LIEF::assembly::x86::Instruction::is_lockable() ) lief.assembly.x86.Instruction.is_atomic() ( lief::assembly::x86::Instruction::is_atomic ; lief.assembly.x86.Instruction.is_atomic ; LIEF::assembly::x86::Instruction::is_atomic() ) lief.assembly.x86.Instruction.lock() ( lief::assembly::x86::Instruction::lock ; lief.assembly.x86.Instruction.lock() ; LIEF::assembly::x86::Instruction::lock() ) lief.assembly.x86.Instruction.unlock() ( lief::assembly::x86::Instruction::unlock ; lief.assembly.x86.Instruction.unlock() ; LIEF::assembly::x86::Instruction::unlock() ) Python import lief inst: lief.assembly.x86.Instruction if inst.has_lock_prefix or inst.is_atomic: print(f\"{inst} is atomic\") elif inst.is_lockable and (locked := inst.lock()) is not None: print(f\"atomic version of {inst}: {locked}\") C++ std::unique_ptr inst; if (inst->has_lock_prefix() || inst->is_atomic()) { std::cout << inst->to_string() << \" is atomic\\n\"; } else if (inst->is_lockable()) { if (auto locked = inst->lock()) { std::cout << \"atomic version: \" << locked->to_string() << '\\n'; } } Rust let inst: &lief::assembly::x86::Instruction = some_inst; if inst.has_lock_prefix() || inst.is_atomic() { println!(\"{} is atomic\", inst); } else if inst.is_lockable() && let Some(locked) = inst.lock() { println!(\"atomic version: {}\", locked); } Use Cases DWARF Function In addition to the regular lief.Binary.disassemble() ( lief::generic::Binary::disassemble ; lief::generic::Binary::disassemble_symbol ; lief::generic::Binary::disassemble_address ; lief::generic::Binary::disassemble_slice ; LIEF::Binary::disassemble() ; lief.Binary.disassemble() ; lief.Binary.disassemble_from_bytes() ) API, you can use lief.dwarf.Function.instructions() ( lief::dwarf::Function::instructions ; LIEF::dwarf::Function::instructions() ; lief.dwarf.Function.instructions ) to disassemble a DWARF function. Warning lief.dwarf.Function.instructions() ( lief::dwarf::Function::instructions ; LIEF::dwarf::Function::instructions() ; lief.dwarf.Function.instructions ) only works if the DWARF debug info is embedded in the binary. This is the default behavior for ELF binaries, but this is not the case for Mach-O .dSYM files. Python import lief elf = lief.ELF.parse(\"/bin/hello\") main = elf.debug_info.find_function(\"main\") for inst in main.instructions: print(inst) C++ auto elf = LIEF::ELF::Parser::parse(\"/bin/hello\"); if (const auto* dwarf = elf->debug_info()->as()) { std::unique_ptr _main = dwarf->find_function(\"main\"); for (const auto& inst : _main->instructions()) { std::cout << inst.to_string() << '\\n'; } } Rust let elf = lief::elf::Binary::parse(\"/bin/ls\").unwrap(); if let Some(lief::DebugInfo::Dwarf(dwarf)) = elf.debug_info() && let Some(func) = dwarf.function_by_name(\"main\") { for inst in func.instructions() { println!(\"{}\", inst); } } Dyld Shared Cache A disassembly API is also provided for the lief.dsc.DyldSharedCache ( lief::dsc::DyldSharedCache ; lief.dsc.DyldSharedCache ; LIEF::dsc::DyldSharedCache ) object via lief.dsc.DyldSharedCache.disassemble() ( lief::dsc::DyldSharedCache::disassemble ; lief.dsc.DyldSharedCache.disassemble() ; LIEF::dsc::DyldSharedCache::disassemble() ): Python dyld_cache: lief.dsc.DyldSharedCache for inst in dyld_cache.disassemble(0x1886F4A44): print(inst) C++ std::unique_ptr dyld_cache; for (const auto& inst : dyld_cache->disassemble(0x1886f4a44)) { std::cout << inst.to_string() << '\\n'; } Rust let dyld_cache: &lief::dsc::DyldSharedCache = some_dyld_cache; for inst in dyld_cache.disassemble(0x1886f4a44) { println!(\"{}\", inst); } COFF Support The lief.COFF.Binary ( lief::coff::Binary ; lief.COFF.Binary ; LIEF::COFF::Binary ) interface does not inherit from the generic lief.abstract.Binary ( lief::generic::Binary ; lief.Binary ; LIEF::Binary ), but it also exposes an API to disassemble code in COFF object files: lief.COFF.Binary.disassemble() ( lief::coff::Binary::disassemble_slice ; lief::coff::Binary::disassemble_function ; lief::coff::Binary::disassemble_symbol ; lief.COFF.Binary.disassemble() ; lief.COFF.Binary.disassemble_from_bytes() ; LIEF::COFF::Binary::disassemble() ). For more details, please check the COFF Disassembler section In-Memory Disassembler The disassembler is also available for analyzing code directly in the memory of the running process. This functionality is exposed through the runtime API lief.runtime.disassemble() ( lief::runtime::disassemble ; lief.runtime.disassemble() ; LIEF::runtime::disassemble() ), as detailed in the Runtime Memory documentation. Technical Details The disassembler is based on LLVM’s MC layer, which is known to be efficient and accurate for disassembling code. This LLVM MC layer is already used by other projects like capstone or, more recently, Nyxstone . Compared to Capstone, LIEF uses a mainstream LLVM version with limited modifications to the MC layer. On the other hand, it does not expose a C API, supports fewer architectures than Capstone, and does not expose a standalone API. Note The current LLVM version is 22.x. Unlike Nyxstone’s disassembler, LIEF hides LLVM from the public API, meaning that LLVM does not need to be installed on the system. On the other hand, it does not expose a standalone API. The major difference between LIEF’s disassembler and other projects is that it does not expose a standalone API for disassembling arbitrary code. The disassembler is bound to the object from which the API is exposed ( lief.abstract.Binary ( lief::generic::Binary ; lief.Binary ; LIEF::Binary ), lief.dwarf.Function ( lief::dwarf::Function ; lief.dwarf.Function ; LIEF::dwarf::Function ), lief.dsc.DyldSharedCache.disassemble() ( lief::dsc::DyldSharedCache::disassemble ; lief.dsc.DyldSharedCache.disassemble() ; LIEF::dsc::DyldSharedCache::disassemble() ), etc.). API Python API C++ API Rust API: lief::assembly", "contentHash": "cc344f87759e569f51eb17bc87542aa1280db04c53f5ac73e9b26b2502bade62", "description": "Disassemble executable code with LIEF Extended, inspect architecture-specific instructions and operands, and use debug information or live memory.", "docname": "extended/disassembler/index", "documentID": "58d5fd6e1134d2e86c817f3d11f8b88f41ff38774180629490d702ac48628f78", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/disassembler/index.md", "title": "Disassembler - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/disassembler/python/arch/aarch64.html", "content": "AArch64 Instruction lief.assembly.aarch64.Instruction class lief.assembly.aarch64.Instruction Bases: Instruction This class represents an AArch64 instruction opcode property opcode → lief.assembly.aarch64.OPCODE The instruction opcode as defined in LLVM operands property operands → Iterator[ lief.assembly.aarch64.Operand | None] Iterator over the operands of the current instruction Opcodes See: lief.assembly.aarch64.OPCODE Operands lief.assembly.aarch64.Operand class lief.assembly.aarch64.Operand Bases: object This class represents an operand for an AArch64 instruction to_string property to_string → str Pretty representation of the operand Immediate lief.assembly.aarch64.operands.Immediate class lief.assembly.aarch64.operands.Immediate Bases: Operand This class represents an immediate operand (i.e. a constant) For instance: mov x0, #8; | +---> Immediate(8) value property value → int The constant value wrapped by this operand Register lief.assembly.aarch64.operands.Register class lief.assembly.aarch64.operands.Register Bases: Operand This class represents a register operand. mrs x0, TPIDR_EL0 | | +------+ +-------+ | | v v REG SYSREG value property value → lief.assembly.aarch64.REG | lief.assembly.aarch64.SYSREG | None The effective register as either: a lief.assembly.aarch64.REG or a lief.assembly.aarch64.SYSREG . Memory lief.assembly.aarch64.operands.Memory class lief.assembly.aarch64.operands.Memory Bases: Operand This class represents a memory operand. ldr x0, [x1, x2, lsl #3] | | | +------------+ | +--------+ | | | v v v Base Reg Offset Shift SHIFT class SHIFT( *values ) Bases: Enum LSL LSL = 1 SXTW SXTW = 5 SXTX SXTX = 4 UNKNOWN UNKNOWN = 0 UXTW UXTW = 3 UXTX UXTX = 2 base property base → lief.assembly.aarch64.REG The base register. For str x3, [x8, #8] it would return x8 . offset property offset → lief.assembly.aarch64.REG | int | None The addressing offset. It can be either: A register (e.g. ldr x0, [x1, x3] ) An offset (e.g. ldr x0, [x1, #8] ) shift property shift → lief.assembly.aarch64.operands.Memory.shift_info_t Shift information. For instance, for ldr x1, [x2, x3, lsl #3] it would return a LSL with a value set to 3 . shift_info_t class shift_info_t Bases: object This structure holds shift info (type + value) type property type → lief.assembly.aarch64.operands.Memory.SHIFT value property value → int PCRelative lief.assembly.aarch64.operands.PCRelative class lief.assembly.aarch64.operands.PCRelative Bases: Operand This class represents a PC-relative operand. ldr x0, #8 | v PC Relative operand value property value → int The effective value that is relative to the current pc register", "contentHash": "6db05a76287a7a8f8c79ad5c665f819a51cea4dd9eee409dd3bf55b25d4a75de", "description": "AArch64 Python Disassembler. See: lief.assembly.aarch64.OPCODE", "docname": "extended/disassembler/python/arch/aarch64", "documentID": "cc7a3c7c1e2b129e669f94b62ca4fb25fe6a1aa68e86734d8ce38d052d4bf113", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/disassembler/python/arch/aarch64.md", "title": "AArch64 - Python Disassembler - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/disassembler/python/arch/arm.html", "content": "ARM Instruction lief.assembly.arm.Instruction class lief.assembly.arm.Instruction Bases: Instruction This class represents an ARM/Thumb instruction opcode property opcode → lief.assembly.arm.OPCODE The instruction opcode as defined in LLVM Opcodes See: lief.assembly.arm.OPCODE", "contentHash": "f5c990c5aa0fededae330f333871bd5a7f52f4f44eea3328c773dcf0dadd1b52", "description": "ARM Python Disassembler. See: lief.assembly.arm.OPCODE", "docname": "extended/disassembler/python/arch/arm", "documentID": "53cfadccb05891b1bd353b350116db8873230738dfd9f5ade046cc450cec4740", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/disassembler/python/arch/arm.md", "title": "ARM - Python Disassembler - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/disassembler/python/arch/ebpf.html", "content": "eBPF Instruction lief.assembly.ebpf.Instruction class lief.assembly.ebpf.Instruction Bases: Instruction This class represents an eBPF instruction opcode property opcode → lief.assembly.ebpf.OPCODE The instruction opcode as defined in LLVM operands property operands → Iterator[ lief.assembly.ebpf.Operand | None] Iterator over the operands of the current instruction Opcodes See: lief.assembly.ebpf.OPCODE Operands lief.assembly.ebpf.Operand class lief.assembly.ebpf.Operand Bases: object This class represents an operand for an eBPF instruction to_string property to_string → str Pretty representation of the operand Immediate lief.assembly.ebpf.operands.Immediate class lief.assembly.ebpf.operands.Immediate Bases: Operand This class represents an immediate operand (i.e. a constant) For instance: r1 = 8 | +---> Immediate(8) value property value → int The constant value wrapped by this operand Register lief.assembly.ebpf.operands.Register class lief.assembly.ebpf.operands.Register Bases: Operand This class represents a register operand. For instance: r0 = r1 | | | +---------> Register(r1) | +--------------> Register(r0) value property value → lief.assembly.ebpf.REG The effective lief.assembly.ebpf.REG wrapped by this operand Memory lief.assembly.ebpf.operands.Memory class lief.assembly.ebpf.operands.Memory Bases: Operand This class represents a memory operand. *(u64 *)(r1 + 8) = r2 | | | +-----> Displacement: 8 | +----------> Base: r1 base property base → lief.assembly.ebpf.REG The base register. For *(u64 *)(r1 + 8) it would return r1 . displacement property displacement → int The displacement value. For *(u64 *)(r1 + 8) it would return 8 . PCRelative lief.assembly.ebpf.operands.PCRelative class lief.assembly.ebpf.operands.PCRelative Bases: Operand This class represents a PC-relative operand. if r1 == 0 goto +5 | v PC Relative operand value property value → int The effective value that is relative to the current pc register", "contentHash": "05c0fa4a2253df73f2f8c5ac131b670b0620cce7c45f197377a48a2cd2c95195", "description": "eBPF Python Disassembler. See: lief.assembly.ebpf.OPCODE", "docname": "extended/disassembler/python/arch/ebpf", "documentID": "1d1dcc92425a51af98aae586c37f79195e5f3a1b67743df467796115fc7d922a", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/disassembler/python/arch/ebpf.md", "title": "eBPF - Python Disassembler - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/disassembler/python/arch/mips.html", "content": "Mips Instruction lief.assembly.mips.Instruction class lief.assembly.mips.Instruction Bases: Instruction This class represents a Mips instruction (including mips64, mips32) opcode property opcode → lief.assembly.mips.OPCODE The instruction opcode as defined in LLVM operands property operands → Iterator[ lief.assembly.mips.Operand | None] Iterator over the operands of the current instruction Opcodes See: lief.assembly.mips.OPCODE Operands lief.assembly.mips.Operand class lief.assembly.mips.Operand Bases: object This class represents an operand for a Mips instruction to_string property to_string → str Pretty representation of the operand Immediate lief.assembly.mips.operands.Immediate class lief.assembly.mips.operands.Immediate Bases: Operand This class represents an immediate operand (i.e. a constant) For instance: addiu $4, $5, 8 | +---> Immediate(8) value property value → int The constant value wrapped by this operand Register lief.assembly.mips.operands.Register class lief.assembly.mips.operands.Register Bases: Operand This class represents a register operand. For instance: move $4, $5 | | | +---------> Register($5) | +-------------> Register($4) value property value → lief.assembly.mips.REG The effective lief.assembly.mips.REG wrapped by this operand Memory lief.assembly.mips.operands.Memory class lief.assembly.mips.operands.Memory Bases: Operand This class represents a memory operand. lw $4, 8($5) ldxc1 $f2, $4($7) | | | | | | +------+ | +---+ +-------+ | +-----+ | | | | | | v v v v v v Reg Disp Base Reg Index Base base property base → lief.assembly.mips.REG The base register. For lw $4, 8($5) it would return $5 . offset property offset → lief.assembly.mips.REG | int | None The addressing offset. It can be either: A register (e.g. ldxc1 $f2, $4($7) ) A displacement (e.g. lw $4, 8($5) ) PCRelative lief.assembly.mips.operands.PCRelative class lief.assembly.mips.operands.PCRelative Bases: Operand This class represents a PC-relative operand. bal 0x100 | v PC Relative operand value property value → int The effective value that is relative to the current pc register", "contentHash": "6702a5d9a8273903b8f72676cf6989d90fe8c8ff70e7add97a10a0a0ee9beb83", "description": "Mips Python Disassembler. See: lief.assembly.mips.OPCODE", "docname": "extended/disassembler/python/arch/mips", "documentID": "cb6c5798255800b24f516705a8fe59ff38b3f5989d7a1f855d5cabca41152488", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/disassembler/python/arch/mips.md", "title": "Mips - Python Disassembler - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/disassembler/python/arch/powerpc.html", "content": "PowerPC Instruction lief.assembly.powerpc.Instruction class lief.assembly.powerpc.Instruction Bases: Instruction This class represents a PowerPC (ppc64/ppc32) instruction opcode property opcode → lief.assembly.powerpc.OPCODE The instruction opcode as defined in LLVM operands property operands → Iterator[ lief.assembly.powerpc.Operand | None] Iterator over the operands of the current instruction Opcodes See: lief.assembly.powerpc.OPCODE Operands lief.assembly.powerpc.Operand class lief.assembly.powerpc.Operand Bases: object This class represents an operand for a PowerPC instruction to_string property to_string → str Pretty representation of the operand Immediate lief.assembly.powerpc.operands.Immediate class lief.assembly.powerpc.operands.Immediate Bases: Operand This class represents an immediate operand (i.e. a constant) For instance: li 3, 8 | +---> Immediate(8) value property value → int The constant value wrapped by this operand Register lief.assembly.powerpc.operands.Register class lief.assembly.powerpc.operands.Register Bases: Operand This class represents a register operand. For instance: add 3, 4, 5 | | | | | +---------> Register(5) | +------------> Register(4) +---------------> Register(3) value property value → lief.assembly.powerpc.REG The effective lief.assembly.powerpc.REG wrapped by this operand Memory lief.assembly.powerpc.operands.Memory class lief.assembly.powerpc.operands.Memory Bases: Operand This class represents a memory operand. lwz 3, 8(4) lwzx 3, 4, 5 | | | | | +------+ +---+ +------+ | +---+ | | | | | v v v v v Disp Base Reg Base Index base property base → lief.assembly.powerpc.REG The base register. For lwz 3, 8(4) it would return 4 . offset property offset → lief.assembly.powerpc.REG | int | None The addressing offset. It can be either: An index register (e.g. lwzx 3, 4, 5 ) A displacement (e.g. lwz 3, 8(4) ) PCRelative lief.assembly.powerpc.operands.PCRelative class lief.assembly.powerpc.operands.PCRelative Bases: Operand This class represents a PC-relative operand. bl 0x100 | v PC Relative operand value property value → int The effective value that is relative to the current pc register", "contentHash": "9ae7a6b08b59ca0b081de396acd3af2d15436a6f0f6e90586960e82391f5e08f", "description": "PowerPC Python Disassembler. See: lief.assembly.powerpc.OPCODE", "docname": "extended/disassembler/python/arch/powerpc", "documentID": "bbad85ae06f6c21d37813c61721b1878411ef700c318098ec4e9f4274f859d94", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/disassembler/python/arch/powerpc.md", "title": "PowerPC - Python Disassembler - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/disassembler/python/arch/riscv.html", "content": "RISC-V Instruction lief.assembly.riscv.Instruction class lief.assembly.riscv.Instruction Bases: Instruction This class represents a RISC-V (32 or 64 bit) instruction opcode property opcode → lief.assembly.riscv.OPCODE The instruction opcode as defined in LLVM operands property operands → Iterator[ lief.assembly.riscv.Operand | None] Iterator over the operands of the current instruction Opcodes See: lief.assembly.riscv.OPCODE Operands lief.assembly.riscv.Operand class lief.assembly.riscv.Operand Bases: object This class represents an operand for a RISC-V instruction to_string property to_string → str Pretty representation of the operand Immediate lief.assembly.riscv.operands.Immediate class lief.assembly.riscv.operands.Immediate Bases: Operand This class represents an immediate operand (i.e. a constant) For instance: addi a0, a1, 8 | +---> Immediate(8) value property value → int The constant value wrapped by this operand Register lief.assembly.riscv.operands.Register class lief.assembly.riscv.operands.Register Bases: Operand This class represents a register operand. csrr a0, mstatus | | +------+ +-------+ | | v v REG SYSREG value property value → lief.assembly.riscv.REG | lief.assembly.riscv.SYSREG | None The effective register as either: a lief.assembly.riscv.REG or a lief.assembly.riscv.SYSREG . Memory lief.assembly.riscv.operands.Memory class lief.assembly.riscv.operands.Memory Bases: Operand This class represents a memory operand. lw a0, 8(sp) | | | +----> Base: sp | +-------> Displacement: 8 base property base → lief.assembly.riscv.REG The base register. For lw a0, 8(sp) it would return sp . displacement property displacement → int The displacement value. For lw a0, 8(sp) it would return 8 . PCRelative lief.assembly.riscv.operands.PCRelative class lief.assembly.riscv.operands.PCRelative Bases: Operand This class represents a PC-relative operand. auipc a0, 0x1 | v PC Relative operand value property value → int The effective value that is relative to the current pc register", "contentHash": "4ea25fe0f0fc059cbe96fd5a0b3ffe727a78579d447c365274e7772228d19bd8", "description": "RISC-V Python Disassembler. See: lief.assembly.riscv.OPCODE", "docname": "extended/disassembler/python/arch/riscv", "documentID": "46b9dc425d6956638c07ced520f8d8946c1a4433775a52f8b1d1d69d5cf42137", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/disassembler/python/arch/riscv.md", "title": "RISC-V - Python Disassembler - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/disassembler/python/arch/x86.html", "content": "x86/x86-64 Instruction lief.assembly.x86.Instruction class lief.assembly.x86.Instruction Bases: Instruction This class represents a x86/x86-64 instruction has_lock_prefix property has_lock_prefix → bool True if this instruction has a LOCK prefix is_atomic property is_atomic → bool True if this instruction executes as an atomic read-modify-write is_lockable property is_lockable → bool True if the LOCK prefix is architecturally valid on this instruction lock lock( self ) → lief._lief.assembly.x86.Instruction | None Re-encoded copy of this instruction with a LOCK prefix added. If the instruction already has a LOCK prefix, it returns a plain copy. opcode property opcode → lief.assembly.x86.OPCODE The instruction opcode as defined in LLVM operands property operands → Iterator[ lief.assembly.x86.Operand | None] Iterator over the operands of the current instruction unlock unlock( self ) → lief._lief.assembly.x86.Instruction | None Re-encoded copy of this instruction with the LOCK prefix removed. If the instruction does not have a LOCK prefix, it returns a plain copy or None if the LOCK semantic can’t be removed. Opcodes See: lief.assembly.x86.OPCODE Operands lief.assembly.x86.Operand class lief.assembly.x86.Operand Bases: object This class represents an operand for an x86/x86-64 instruction to_string property to_string → str Pretty representation of the operand Immediate lief.assembly.x86.operands.Immediate class lief.assembly.x86.operands.Immediate Bases: Operand This class represents an immediate operand (i.e. a constant) For instance: mov edi, 1; | +---> Immediate(1) value property value → int The constant value wrapped by this operand Register lief.assembly.x86.operands.Register class lief.assembly.x86.operands.Register Bases: Operand This class represents a register operand. For instance: mov r15d, edi | | | +---------> Register(EDI) | +---------------> Register(R15D) value property value → lief.assembly.x86.REG The effective lief.assembly.x86.REG wrapped by this operand Memory lief.assembly.x86.operands.Memory class lief.assembly.x86.operands.Memory Bases: Operand This class represents a memory operand. For instance: movq xmm3, qword ptr [rip + 823864]; | | Memory | +-----------+-----------+ | | | Base: rip Scale: 1 Displacement: 823864 base property base → lief.assembly.x86.REG The base register. For lea rdx, [rip + 244634] it would return rip displacement property displacement → int The displacement value. For call qword ptr [rip + 248779] it would return 248779 scale property scale → int The scale value associated with the scaled_register : For mov rdi, qword ptr [r13 + 8*r14] it would return 8 scaled_register property scaled_register → lief.assembly.x86.REG The scaled register. For mov rdi, qword ptr [r13 + 8*r14] it would return r14 segment_register property segment_register → lief.assembly.x86.REG The segment register associated with the memory operation. For mov eax, dword ptr gs:[0] it would return gs PCRelative lief.assembly.x86.operands.PCRelative class lief.assembly.x86.operands.PCRelative Bases: Operand This class represents a RIP/EIP-relative operand. For instance: jmp 67633; | +----------> PCRelative(67633) value property value → int The effective value that is relative to the current rip/eip register", "contentHash": "671a15857ef6d1134d074bc8e189d5a95fc13ff9be6fe3832bff6e993c82d187", "description": "x86/x86-64 Python Disassembler. See: lief.assembly.x86.OPCODE", "docname": "extended/disassembler/python/arch/x86", "documentID": "f71a2b4d7dee613bef0c375fd7fbf8f49ce2bb954525270333626c48d70322ec", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/disassembler/python/arch/x86.md", "title": "x86/x86-64 - Python Disassembler - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/disassembler/python/index.html", "content": "Python Architectures Architectures x86/x86-64 AArch64 ARM eBPF RISC-V Mips PowerPC Engine lief.assembly.Engine class lief.assembly.Engine Bases: object This class interfaces the assembler/disassembler support Instruction lief.assembly.Instruction class lief.assembly.Instruction Bases: object This class represents an assembly instruction MemoryAccess class MemoryAccess( *values ) Bases: Flag NONE NONE = 0 READ READ = 1 WRITE WRITE = 2 from_value from_value( arg: int ) → lief.assembly.Instruction.MemoryAccess = address property address → int Address of the instruction branch_target property branch_target → int | lief.lief_errors Given a is_branch instruction, try to evaluate the address of the destination. is_add property is_add → bool True if the instruction performs an arithmetic addition. is_barrier property is_barrier → bool True if the instruction prevents executing the instruction that immediately follows the current. This includes return or unconditional branch instructions is_bitcast property is_bitcast → bool True if the instruction is doing a bitcast is_branch property is_branch → bool True if the instruction is a branch is_call property is_call → bool True if the instruction is a call is_compare property is_compare → bool True if the instruction is a comparison is_conditional_branch property is_conditional_branch → bool True if the instruction is conditionally jumping to the next instruction or an instruction into some other basic block. is_indirect_branch property is_indirect_branch → bool True if the instruction is an indirect branch. This includes instructions that branch through a register (e.g. jmp rax , br x1 ). is_memory_access property is_memory_access → bool True if the instruction performs a memory access is_move_immediate property is_move_immediate → bool True if the instruction is moving an immediate is_move_reg property is_move_reg → bool True if the instruction is a register to register move. is_return property is_return → bool True if the instruction is a return is_syscall property is_syscall → bool True if the instruction is a syscall is_terminator property is_terminator → bool True if the instruction marks the end of a basic block is_trap property is_trap → bool True if the instruction is a trap. On x86/x86-64 this includes the ud1/ud2 instructions On AArch64 this includes the brk/udf instructions is_unconditional_branch property is_unconditional_branch → bool True if the instruction is jumping ( unconditionally ) to some other basic block. memory_access property memory_access → lief.assembly.Instruction.MemoryAccess Memory access flags mnemonic property mnemonic → str Instruction mnemonic (e.g. br ) raw property raw → bytes Raw bytes of the current instruction size property size → int Size of the instruction in bytes to_string to_string( self , with_address: bool = True ) → str Representation of the current instruction in a pretty assembly way", "contentHash": "8e0935c3daab1e0f5128d659d512c181d3b8a24d9da35fdbca49947f0adaca53", "description": "Disassembler Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "extended/disassembler/python/index", "documentID": "8191668a8a6dfa2b2fb6f4967c98282ea3d810ec6c8b16a343d44f54f2c78ff9", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/disassembler/python/index.md", "title": "Disassembler Python API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/disassembler/rust.html", "content": "Rust Note Please check: lief::assembly", "contentHash": "439f59c03386cfbb4a9ca9d28c4c246c31fa2a6308ac02be6069cf6b5a542a14", "description": "Disassembler Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "extended/disassembler/rust", "documentID": "0b45cd91842bdc1926045aa36b1ffffc184c288641f1a48bb85d9ccc75dd6cc4", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/disassembler/rust.md", "title": "Disassembler Rust API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/dsc/cpp.html", "content": "C++ Note You can also find the Doxygen documentation here: here LIEF::dsc::load inline std::unique_ptr< DyldSharedCache > LIEF::dsc::load(const std::string &path, const std::string &arch = \"\") Load a shared cache from a single file or from a directory specified by the path parameter. In the case where multiple architectures are available in the path directory, the arch parameter can be used to define which architecture should be preferred. Example: // From a directory (split caches) auto cache = LIEF::dsc::load(\"vision-pro-2.0/\"); // From a single cache file auto cache = LIEF::dsc::load(\"ios-14.2/dyld_shared_cache_arm64\"); // From a directory with multiple architectures auto cache = LIEF::dsc::load(\"macos-12.6/\", /*arch=*‍/\"x86_64h\"); LIEF::dsc::load inline std::unique_ptr< DyldSharedCache > LIEF::dsc::load(const std::vector &files) Load a shared cache from a list of files. std::vector files = { \"/tmp/dsc/dyld_shared_cache_arm64e\", \"/tmp/dsc/dyld_shared_cache_arm64e.1\" }; auto cache = LIEF::dsc::load(files); Cache Processing Warning If you aim at extracting several libraries from a dyld shared cache, it is highly recommended to enable caching. Otherwise, performances can be impacted. LIEF::dsc::enable_cache bool LIEF::dsc::enable_cache() Enable globally cache/memoization. One can also leverage this function by setting the environment variable DYLDSC_ENABLE_CACHE to 1 . By default, LIEF will use the directory specified by the environment variable DYLDSC_CACHE_DIR as its cache-root directory: DYLDSC_ENABLE_CACHE=1 DYLDSC_CACHE_DIR=/tmp/my_dir ./my-program Otherwise, if DYLDSC_CACHE_DIR is not set, LIEF will use the following directory (in this priority): System or user cache directory macOS: DARWIN_USER_TEMP_DIR / DARWIN_USER_CACHE_DIR + /dyld_shared_cache Linux: ${XDG_CACHE_HOME}/dyld_shared_cache Windows: LOCALAPPDATA%\\dyld_shared_cache Home directory macOS/Linux: $HOME/.dyld_shared_cache Windows: USERPROFILE%\\.dyld_shared_cache See also LIEF::dsc::DyldSharedCache::enable_caching for a finer granularity LIEF::dsc::enable_cache bool LIEF::dsc::enable_cache(const std::string &dir) Same behavior as enable_cache() but with a user-provided cache directory. DyldSharedCache DyldSharedCache class DyldSharedCache This class represents a dyld shared cache file. Public Types VERSION enum class VERSION : uint32_t This enum wraps the dyld’s git tags for which the structure of dyld shared cache evolved. Values: UNKNOWN enumerator UNKNOWN = 0 DYLD_95_3 enumerator DYLD_95_3 dyld-95.3 (2007-10-30) DYLD_195_5 enumerator DYLD_195_5 dyld-195.5 (2011-07-13) DYLD_239_3 enumerator DYLD_239_3 dyld-239.3 (2013-10-29) DYLD_360_14 enumerator DYLD_360_14 dyld-360.14 (2015-09-04) DYLD_421_1 enumerator DYLD_421_1 dyld-421.1 (2016-09-22) DYLD_832_7_1 enumerator DYLD_832_7_1 dyld-832.7.1 (2020-11-19) DYLD_940 enumerator DYLD_940 dyld-940 (2021-02-09) DYLD_1042_1 enumerator DYLD_1042_1 dyld-1042.1 (2022-10-19) DYLD_1231_3 enumerator DYLD_1231_3 dyld-1231.3 (2024-09-24) DYLD_1284_13 enumerator DYLD_1284_13 dyld-1284.13 (2025-04-25) UNRELEASED enumerator UNRELEASED This value is used for versions of dyld not publicly released or not yet supported by LIEF. DYLD_TARGET_PLATFORM enum class DYLD_TARGET_PLATFORM : uint32_t Platforms supported by the dyld shared cache. Values: UNKNOWN enumerator UNKNOWN = 0 MACOS enumerator MACOS = 1 IOS enumerator IOS = 2 TVOS enumerator TVOS = 3 WATCHOS enumerator WATCHOS = 4 BRIDGEOS enumerator BRIDGEOS = 5 IOSMAC enumerator IOSMAC = 6 IOS_SIMULATOR enumerator IOS_SIMULATOR = 7 TVOS_SIMULATOR enumerator TVOS_SIMULATOR = 8 WATCHOS_SIMULATOR enumerator WATCHOS_SIMULATOR = 9 DRIVERKIT enumerator DRIVERKIT = 10 VISIONOS enumerator VISIONOS = 11 VISIONOS_SIMULATOR enumerator VISIONOS_SIMULATOR = 12 FIRMWARE enumerator FIRMWARE = 13 SEPOS enumerator SEPOS = 14 ANY enumerator ANY = 0xFFFFFFFF DYLD_TARGET_ARCH enum class DYLD_TARGET_ARCH Architecture supported by the dyld shared cache. Values: UNKNOWN enumerator UNKNOWN = 0 I386 enumerator I386 X86_64 enumerator X86_64 X86_64H enumerator X86_64H ARMV5 enumerator ARMV5 ARMV6 enumerator ARMV6 ARMV7 enumerator ARMV7 ARM64 enumerator ARM64 ARM64E enumerator ARM64E dylib_iterator using dylib_iterator = iterator_range < Dylib :: Iterator > Iterator over the libraries in the shared cache. mapping_info_iterator using mapping_info_iterator = iterator_range < MappingInfo :: Iterator > Iterator over the mapping info in the shared cache. subcache_iterator using subcache_iterator = iterator_range < SubCache :: Iterator > Iterator over the split/sub-cache in this main shared cache. instructions_iterator using instructions_iterator = iterator_range Public Functions DyldSharedCache DyldSharedCache(std::unique_ptr impl) ~DyldSharedCache ~DyldSharedCache() filename std::string filename() const Filename of the dyld shared file associated with this object. For instance: dyld_shared_cache_arm64e, dyld_shared_cache_arm64e.62.dyldlinkedit version VERSION version() const Version of dyld used by this cache. filepath std::string filepath() const Full path to the original dyld shared cache file associated with object (e.g. /home/lief/downloads/visionos/dyld_shared_cache_arm64e.42 ). load_address uint64_t load_address() const Based address of this cache. arch_name std::string arch_name() const Name of the architecture targeted by this cache ( x86_64h ). platform DYLD_TARGET_PLATFORM platform() const Platform targeted by this cache (e.g. visionOS). arch DYLD_TARGET_ARCH arch() const Architecture targeted by this cache. find_lib_from_va std::unique_ptr< Dylib > find_lib_from_va(uint64_t va) const Find the Dylib that encompasses the given virtual address. It returns a nullptr if a Dylib can’t be found. find_lib_from_path std::unique_ptr< Dylib > find_lib_from_path(const std::string &path) const Find the Dylib whose Dylib::path matches the provided path. find_lib_from_name std::unique_ptr< Dylib > find_lib_from_name(const std::string &name) const Find the Dylib whose filename of Dylib::path matches the provided name. If multiple libraries have the same name (but with a different path), the first one matching the provided name is returned. has_subcaches bool has_subcaches() const True if the subcaches are associated with this cache. libraries dylib_iterator libraries() const Return an iterator over the libraries embedded in this dyld shared cache. This iterator implements the random access trait. Thus, one can use iterator_range::size , iterator_range::at , iterator_range::operator[] to access Dylib at an arbitrary index: auto libraries = cache.libaries(); for (size_t i = 0; i < libraries.size(); ++i) { std::string path = libaries[i]->path(); } mapping_info mapping_info_iterator mapping_info() const Return an iterator over the mapping information of this dyld shared cache. This iterator implements the random access trait. Thus, one can use iterator_range::size , iterator_range::at , iterator_range::operator[] to access a MappingInfo at an arbitrary index: auto mapping = cache.mapping_info(); for (size_t i = 0; i < mapping.size(); ++i) { const uint64_t addr = mapping[i]->address(); } subcaches subcache_iterator subcaches() const Return an iterator over the subcaches associated with this (main) dyld shared cache. This iterator implements the random access trait. Thus, one can use iterator_range::size , iterator_range::at , iterator_range::operator[] to access a SubCache at an arbitrary index: auto subcaches = cache.subcaches(); for (size_t i = 0; i < subcaches.size(); ++i) { std::unique_ptr impl = subcaches[i]->cache(); } disassemble instructions_iterator disassemble(uint64_t va) const Disassemble instructions at the provided virtual address. This function returns an iterator over assembly::Instruction . get_content_from_va std::vector get_content_from_va(uint64_t va, uint64_t size) const Return the content at the specified virtual address. cache_for_address std::unique_ptr< DyldSharedCache > cache_for_address(uint64_t va) const Find the sub-DyldSharedCache that wraps the given virtual address. main_cache std::unique_ptr< DyldSharedCache > main_cache() const Return the principal dyld shared cache in the case of multiple subcaches. find_subcache std::unique_ptr< DyldSharedCache > find_subcache(const std::string &filename) const Try to find the DyldSharedCache associated with the filename given in the first parameter. va_to_offset result va_to_offset(uint64_t va) const Convert the given virtual address into an offset. Warning If the shared cache contains multiple subcaches, this function needs to be called on the targeted subcache. See cache_for_address() to find the associated subcache. stream FileStream &stream() const Return the stream associated with this dyld shared cache. stream FileStream &stream() Return the stream associated with this dyld shared cache. enable_caching void enable_caching(const std::string &target_cache_dir) const When enabled, this function records and keeps in cache the dyld shared cache information that is costly to access. For instance, GOT symbols, rebases information, stub symbols, … It is highly recommended to enable this function when processing a dyld shared cache several times or when extracting a large number of LIEF::dsc::Dylib with enhanced extraction options (e.g. Dylib::extract_opt_t::fix_branches ) One can enable caching by calling this function: auto dyld_cache = LIEF::dsc::load(\"macos-15.0.1/\"); dyld_cache->enable_caching(\"/home/user/.cache/lief-dsc\"); One can also enable this cache optimization globally using the function: LIEF::dsc::enable_cache or by setting the environment variable DYLDSC_ENABLE_CACHE to 1. flush_cache void flush_cache() const Flush internal information into the on-disk cache (see: enable_caching). Public Static Functions from_path static std::unique_ptr< DyldSharedCache > from_path(const std::string &path, const std::string &arch = \"\") See the load functions for the details. from_files static std::unique_ptr< DyldSharedCache > from_files(const std::vector &path) See the load functions for the details. Dylib Dylib class Dylib This class represents a library embedded in a dyld shared cache. It mirrors the original dyld_cache_image_info structure. Public Functions Dylib Dylib(std::unique_ptr impl) ~Dylib ~Dylib() path std::string path() const Original path of the library (e.g. /usr/lib/libcryptex.dylib ). address uint64_t address() const In-memory address of the library. modtime uint64_t modtime() const Modification time of the library matching stat.st_mtime , or 0. inode uint64_t inode() const File serial number matching stat.st_ino or 0. Note that for shared cache targeting iOS, this value can hold a hash of the path (if modtime is set to 0) padding uint64_t padding() const Padding alignment value (should be 0). get std::unique_ptr get(const extract_opt_t &opt = extract_opt_t ()) const Get a MachO::Binary representation for this Dylib . One can use this function to write back the Mach-O binary on the disk: dyld_cache->libraries()[12]->get()->write(\"liblockdown.dylib\"); Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::random_access_iterator_tag, Dylib , std::ptrdiff_t, const Dylib *, const Dylib &> Dylib Iterator . Public Types implementation using implementation = details::DylibIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator< bool operator<(const Iterator &rhs) const operator- std::ptrdiff_t operator-(const Iterator &R) const operator+= Iterator &operator+=(std::ptrdiff_t n) operator-= Iterator &operator-=(std::ptrdiff_t n) operator* const Dylib &operator*() const operator-> const Dylib *operator->() const yield std::unique_ptr< Dylib > yield() Transfer ownership of the dylib at the current position to the caller. Returns nullptr if the iterator is past-the-end. Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) extract_opt_t struct extract_opt_t This structure is used to tweak the extraction process while calling Dylib::get . These options allow deoptimizing the dylib to get an accurate representation of the origin Mach-O binary. Public Functions extract_opt_t extract_opt_t() Public Members pack bool pack = true Whether the segment’s offsets should be packed to avoid an in-memory size while writing back the binary. Note This option does not have an impact on the performances fix_branches bool fix_branches = false Fix call instructions that target addresses outside the current dylib virtual space. Warning Enabling this option can have a significant impact on the performances. Make sure to enable the internal cache mechanism: LIEF::dsc::enable_cache or LIEF::dsc::DyldSharedCache::enable_caching fix_memory bool fix_memory = false Fix memory accesses performed outside the dylib’s virtual space. Warning Enabling this option can have a significant impact on the performances. Make sure to enable the internal cache mechanism: LIEF::dsc::enable_cache or LIEF::dsc::DyldSharedCache::enable_caching fix_relocations bool fix_relocations = false Recover and fix relocations. Warning Enabling this option can have a significant impact on the performances. Make sure to enable the internal cache mechanism: LIEF::dsc::enable_cache or LIEF::dsc::DyldSharedCache::enable_caching fix_objc bool fix_objc = false Fix Objective-C information. create_dyld_chained_fixup_cmd LIEF:: result create_dyld_chained_fixup_cmd Whether the LC_DYLD_CHAINED_FIXUPS command should be (re)created. If this value is not set, LIEF will add the command only if it’s meaningful regarding the other options MappingInfo MappingInfo class MappingInfo This class represents a dyld_cache_mapping_info entry. It provides information about the relationship between on-disk shared cache and in-memory shared cache. Public Functions MappingInfo MappingInfo(std::unique_ptr impl) ~MappingInfo ~MappingInfo() address uint64_t address() const The in-memory address where this dyld shared cache region is mapped. size uint64_t size() const Size of the region being mapped. end_address inline uint64_t end_address() const End virtual address of the region. file_offset uint64_t file_offset() const On-disk file offset. max_prot uint32_t max_prot() const Max memory protection. init_prot uint32_t init_prot() const Initial memory protection. Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::random_access_iterator_tag, MappingInfo , std::ptrdiff_t, const MappingInfo *, const MappingInfo &> MappingInfo Iterator . Public Types implementation using implementation = details::MappingInfoIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator< bool operator<(const Iterator &rhs) const operator- std::ptrdiff_t operator-(const Iterator &R) const operator+= Iterator &operator+=(std::ptrdiff_t n) operator-= Iterator &operator-=(std::ptrdiff_t n) operator* const MappingInfo &operator*() const operator-> const MappingInfo *operator->() const yield std::unique_ptr< MappingInfo > yield() Transfer ownership of the mapping info at the current position to the caller. Returns nullptr if the iterator is past-the-end. Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) SubCache SubCache class SubCache This class represents a subcache in the case of large/split dyld shared cache. It mirrors (and abstracts) the original dyld_subcache_entry / dyld_subcache_entry_v1 Public Functions SubCache SubCache(std::unique_ptr impl) ~SubCache ~SubCache() uuid sc_uuid_t uuid() const The uuid of the subcache file. vm_offset uint64_t vm_offset() const The offset of this subcache from the main cache base address. suffix std::string suffix() const The file name suffix of the subCache file (e.g. .25.data , .03.development ). cache std::unique_ptr cache() const The associated DyldSharedCache object for this subcache. Friends operator<< friend std::ostream &operator<<(std::ostream &os, const SubCache &subcache) Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::random_access_iterator_tag, SubCache , std::ptrdiff_t, const SubCache *, const SubCache &> SubCache Iterator . Public Types implementation using implementation = details::SubCacheIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator< bool operator<(const Iterator &rhs) const operator- std::ptrdiff_t operator-(const Iterator &R) const operator+= Iterator &operator+=(std::ptrdiff_t n) operator-= Iterator &operator-=(std::ptrdiff_t n) operator* const SubCache &operator*() const operator-> const SubCache *operator->() const yield std::unique_ptr< SubCache > yield() Transfer ownership of the subcache at the current position to the caller. Returns nullptr if the iterator is past-the-end. Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) Utilities LIEF::dsc::is_shared_cache bool LIEF::dsc::is_shared_cache( BinaryStream &stream) Check if the given stream wraps a Dyld Shared Cache. LIEF::dsc::is_shared_cache inline bool LIEF::dsc::is_shared_cache(const std::vector &buffer) Check if the given buffer points to a dyld shared cache file. LIEF::dsc::is_shared_cache inline bool LIEF::dsc::is_shared_cache(const uint8_t *buffer, size_t size) Check if the given buffer points to a dyld shared cache file.", "contentHash": "ea526a360d569fa63b7d9af9cb9022d314617c8401c1feb9c9f8e4305d7d9e43", "description": "Dyld Shared Cache C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "extended/dsc/cpp", "documentID": "1dacedc968429ba2ba47e5b9daf0ed1d492bdd2c414696821647ea1c1cb87f32", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/dsc/cpp.md", "title": "Dyld Shared Cache C++ API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/dsc/index.html", "content": "Dyld Shared Cache API C++ Python Rust Introduction LIEF Extended can inspect Apple’s Dyld shared cache, enumerate its libraries, and extract them as Mach-O binaries. Load a cache and list its libraries One can load a shared cache using the lief.dsc.load() ( lief::dsc::load_from_path ; lief::dsc::load_from_files ; lief.dsc.load() ; LIEF::dsc::load() ) function: Python import lief dyld_cache: lief.dsc.DyldSharedCache | None = lief.dsc.load(\"macos-15.0.1/\") C++ #include std::unique_ptr dyld_cache = LIEF::dsc::load(\"macos-15.0.1/\"); Rust let dyld_cache = lief::dsc::load_from_path(\"macos-15.0.1/\", \"\"); Note Pass a directory to lief.dsc.load() ( lief::dsc::load_from_path ; lief::dsc::load_from_files ; lief.dsc.load() ; LIEF::dsc::load() ) to load the whole cache, or an explicit set of files to load a subset. Keep the main cache and its matching subcache files together: an extraction may need data from more than one file. From this lief.dsc.DyldSharedCache ( lief::dsc::DyldSharedCache ; lief.dsc.DyldSharedCache ; LIEF::dsc::DyldSharedCache ) object, we can inspect the embedded lief.dsc.Dylib ( lief::dsc::Dylib ; lief.dsc.Dylib ; LIEF::dsc::Dylib ) as follows: Python dyld_cache: lief.dsc.DyldSharedCache for dylib in dyld_cache.libraries: print(f\"{dylib.address:#016x}: {dylib.path}\") C++ std::unique_ptr dyld_cache; for (const LIEF::dsc::Dylib& dylib : dyld_cache->libraries()) { std::cout << dylib.address() << ' ' << dylib.path() << '\\n'; } Rust let dyld_cache: &lief::dsc::DyldSharedCache = some_dyld_cache; for dylib in dyld_cache.libraries() { println!(\"0x{:016x}: {}\", dylib.address(), dylib.path()); } Extract a library Find a lief.dsc.Dylib ( lief::dsc::Dylib ; lief.dsc.Dylib ; LIEF::dsc::Dylib ), then use lief.dsc.Dylib.get() ( lief::dsc::Dylib::get ; lief.dsc.Dylib.get() ; LIEF::dsc::Dylib::get() ) to extract a lief.MachO.Binary ( lief::macho::Binary ; lief.MachO.Binary ; LIEF::MachO::Binary ) for analysis. Check both the library lookup and the extraction result before using the Mach-O object: Python dyld_cache: lief.dsc.DyldSharedCache liblockdown = dyld_cache.find_lib_from_name(\"liblockdown.dylib\") macho = liblockdown.get() for segment in macho.segments: print(segment.name) C++ std::unique_ptr dyld_cache; std::unique_ptr liblockdown = dyld_cache->find_lib_from_name(\"liblockdown.dylib\"); std::unique_ptr macho = liblockdown->get(); for (const LIEF::MachO::SegmentCommand& segment : macho->segments()) { std::cout << segment.name() << '\\n'; } Rust let dyld_cache: &lief::dsc::DyldSharedCache = some_dyld_cache; let liblockdown = dyld_cache.find_lib_from_name(\"liblockdown.dylib\").unwrap(); let macho = liblockdown.get().unwrap(); for segment in macho.segments() { println!(\"{}\", segment.name()); } Use lief.MachO.Binary.write() ( lief::macho::Binary::write ; lief::macho::Binary::write_with_config ; lief.MachO.Binary.write() ; LIEF::MachO::Binary::write() ) to save the extracted object to a file: Python dyld_cache: lief.dsc.DyldSharedCache liblockdown = dyld_cache.find_lib_from_name(\"liblockdown.dylib\") macho = liblockdown.get() macho.write(\"on-disk-liblockdown.dylib\") C++ std::unique_ptr dyld_cache; std::unique_ptr liblockdown = dyld_cache->find_lib_from_name(\"liblockdown.dylib\"); std::unique_ptr macho = liblockdown->get(); macho->write(\"on-disk-liblockdown.dylib\"); Rust let dyld_cache: &lief::dsc::DyldSharedCache = some_dyld_cache; let liblockdown = dyld_cache.find_lib_from_name(\"liblockdown.dylib\").unwrap(); let mut macho = liblockdown.get().unwrap(); macho.write(\"on-disk-liblockdown.dylib\"); Warning By default, LIEF retains Dyld shared cache optimizations. Review lief.dsc.Dylib.extract_opt_t ( lief::dsc::dylib::ExtractOpt ; lief.dsc.Dylib.extract_opt_t ; LIEF::dsc::Dylib::extract_opt_t ) when the extracted library needs references and other cache-specific structures recovered. Writing a Mach-O file alone does not guarantee it can be loaded independently of the cache. Performance Considerations Dyld shared cache files are quite large, meaning they cannot be processed in the same way as standard lief.MachO.Binary ( lief::macho::Binary ; lief.MachO.Binary ; LIEF::MachO::Binary ) or lief.ELF.Binary ( lief::elf::Binary ; lief.ELF.Binary ; LIEF::ELF::Binary ) binaries. The Dyld shared cache support in LIEF follows the principle: don’t pay overhead for what you don’t access . This is the opposite of the implementation of lief.PE.parse() ( lief::pe::Binary::parse ; lief.PE.parse() ; LIEF::PE::Parser::parse() ), lief.MachO.parse() ( lief::macho::FatBinary::parse ; lief.MachO.parse() ; LIEF::MachO::Parser::parse() ), and lief.ELF.parse() ( lief::elf::Binary::parse ; lief.ELF.parse() ; LIEF::ELF::Parser::parse() ). Note These functions parse all format structures (with decent performance) because: Most binary sizes are less than one gigabyte. A complete representation is required for modifying binaries. From a technical perspective, LIEF uses a LIEF::FileStream to access Dyld shared cache structures on demand. Thus, in-memory consumption is limited to the size of the structures being accessed. The drawback of using FileStream is that because it uses file-based access, it takes more time compared to a LIEF::VectorStream . Additionally, LIEF’s Dyld shared cache implementation heavily relies on the iterator pattern to follow the principle: don’t pay overhead for what you don’t access . For instance, lief.dsc.DyldSharedCache.libraries() ( lief::dsc::DyldSharedCache::libraries ; lief.dsc.DyldSharedCache.libraries ; LIEF::dsc::DyldSharedCache::libraries() ) returns an iterator over the lief.dsc.Dylib ( lief::dsc::Dylib ; lief.dsc.Dylib ; LIEF::dsc::Dylib ). Therefore, if you don’t iterate, you don’t pay for the access and parsing of the lief.dsc.Dylib ( lief::dsc::Dylib ; lief.dsc.Dylib ; LIEF::dsc::Dylib ) objects. Where possible, LIEF implements the random access iterator trait [1] so that we can programmatically do: Python dyld_cache: lief.dsc.DyldSharedCache # No cost libraries = dyld_cache.libraries # O(1) cost first_lib = libraries[0] # O(len(libraries)) cost for lib in libraries: print(lib.path) C++ std::unique_ptr dyld_cache; // No cost auto libraries = dyld_cache->libraries(); // O(1) cost: the iterator is random access, so an arbitrary library can be // reached by index without materializing the ones before it. std::cout << \"First library: \" << libraries[0]->path() << '\\n'; // O(libraries.size()) cost for (const Dylib& dylib : libraries) { std::cout << dylib.path() << '\\n'; } When extracting a lief.MachO.Binary ( lief::macho::Binary ; lief.MachO.Binary ; LIEF::MachO::Binary ) from a lief.dsc.Dylib ( lief::dsc::Dylib ; lief.dsc.Dylib ; LIEF::dsc::Dylib ) object using lief.dsc.Dylib.get() ( lief::dsc::Dylib::get ; lief.dsc.Dylib.get() ; LIEF::dsc::Dylib::get() ), the extraction can take a substantial amount of time , especially if certain deoptimizations are enabled (c.f. lief.dsc.Dylib.extract_opt_t ( lief::dsc::dylib::ExtractOpt ; lief.dsc.Dylib.extract_opt_t ; LIEF::dsc::Dylib::extract_opt_t )). For instance, lief.dsc.Dylib.extract_opt_t.fix_branches ( lief::dsc::dylib::ExtractOpt::fix_branches ; lief.dsc.Dylib.extract_opt_t.fix_branches ; LIEF::dsc::Dylib::extract_opt_t::fix_branches ) may require iterating over the Dyld shared cache’s stub islands several times. To improve overall performance, LIEF provides a cache-based optimization that can be enabled and configured with: lief.dsc.enable_cache() ( lief::dsc::enable_cache ; lief.dsc.enable_cache() ; LIEF::dsc::enable_cache() ) lief.dsc.DyldSharedCache.enable_caching ( lief::dsc::DyldSharedCache::enable_caching ; lief.dsc.DyldSharedCache.enable_caching() ; LIEF::dsc::DyldSharedCache::enable_caching() ) When should you turn caching on? You can skip LIEF’s caching if: You don’t plan to extract libraries from the shared cache. You plan to extract only one library from the shared cache and only once You don’t want to have LIEF cache artifacts on your system. For all other situations, you should turn on lief.dsc.enable_cache() ( lief::dsc::enable_cache ; lief.dsc.enable_cache() ; LIEF::dsc::enable_cache() ). By default, the cache mechanism is not enabled. [ 1 ] https://en.cppreference.com/w/cpp/iterator/random_access_iterator References arandomdev/DyldExtractor blacktop/ipsw apple-oss-distributions/dyld https://www.romainthomas.fr/post/24-09-apple-lockdown-dbi-lifting/ Python API C++ API Rust API: lief::dsc", "contentHash": "c9c38604da64cb6db368a7b2531c08c4a62982a627a35aa205bcd58f1c85c30e", "description": "Load Apple Dyld shared caches, inspect and extract libraries as Mach-O files, and configure extraction and caching with LIEF Extended.", "docname": "extended/dsc/index", "documentID": "b2e20ca344aa12515d073b90c420faecee7d27d73bddf73463741419d87afd9c", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/dsc/index.md", "title": "Dyld Shared Cache - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/dsc/python.html", "content": "Python lief.dsc.loadlief.dsc.load lief.dsc.load( *args ) → lief.dsc.DyldSharedCache | None lief.dsc.load( path: str | os.PathLike , arch: str = '' ) → lief._lief.dsc.DyldSharedCache | None Overloaded function. load(files: collections.abc.Sequence[str]) -> Optional[lief._lief.dsc.DyldSharedCache] Load a shared cache from a list of files. files = [ \"/tmp/dsc/dyld_shared_cache_arm64e\", \"/tmp/dsc/dyld_shared_cache_arm64e.1\" ] cache = lief.dsc.load(files) load(path: Union[str | os.PathLike], arch: str = '') -> Optional[lief._lief.dsc.DyldSharedCache] Load a shared cache from a single file or from a directory specified by the path parameter. In the case where multiple architectures are available in the path directory, the arch parameter can be used to define which architecture should be preferred. Example: # From a directory (split caches) cache = lief.dsc.load(\"vision-pro-2.0/\") # From a single cache file cache = lief.dsc.load(\"ios-14.2/dyld_shared_cache_arm64\") # From a directory with multiple architectures cache = lief.dsc.load(\"macos-12.6/\", \"x86_64h\") Cache Processing Warning If you aim at extracting several libraries from a dyld shared cache, it is highly recommended to enable caching. Otherwise, performances can be impacted. lief.dsc.enable_cachelief.dsc.enable_cache lief.dsc.enable_cache( *args ) → bool lief.dsc.enable_cache( target_cache_dir: str | os.PathLike ) → bool Overloaded function. enable_cache() -> bool Enable globally cache/memoization. One can also leverage this function by setting the environment variable DYLDSC_ENABLE_CACHE to 1 By default, LIEF will use the directory specified by the environment variable DYLDSC_CACHE_DIR as its cache-root directory: DYLDSC_ENABLE_CACHE=1 DYLDSC_CACHE_DIR=/tmp/my_dir python ./my-script.py Otherwise, if DYLDSC_CACHE_DIR is not set, LIEF will use the following directory (in this priority): System or user cache directory macOS: DARWIN_USER_TEMP_DIR / DARWIN_USER_CACHE_DIR + /dyld_shared_cache Linux: ${XDG_CACHE_HOME}/dyld_shared_cache Windows: %LOCALAPPDATA%\\dyld_shared_cache Home directory macOS/Linux: $HOME/.dyld_shared_cache Windows: %USERPROFILE%\\.dyld_shared_cache See lief.dsc.DyldSharedCache.enable_caching() for a finer granularity enable_cache(target_cache_dir: Union[str | os.PathLike]) -> bool Same behavior as the other enable_cache() function but using a user-provided cache directory instead of an inferred one. DyldSharedCache lief.dsc.DyldSharedCache class lief.dsc.DyldSharedCache Bases: object This class represents a dyld shared cache file. ARCH class ARCH( *values ) Bases: Enum Architecture supported by the dyld shared cache ARM64 ARM64 = 7 ARM64E ARM64E = 8 ARMV5 ARMV5 = 4 ARMV6 ARMV6 = 5 ARMV7 ARMV7 = 6 I386 I386 = 1 UNKNOWN UNKNOWN = 0 X86_64 X86_64 = 2 X86_64H X86_64H = 3 PLATFORM class PLATFORM( *values ) Bases: Enum Platforms supported by the dyld shared cache ANY ANY = 4294967295 BRIDGEOS BRIDGEOS = 5 DRIVERKIT DRIVERKIT = 10 FIRMWARE FIRMWARE = 13 IOS IOS = 2 IOSMAC IOSMAC = 6 IOS_SIMULATOR IOS_SIMULATOR = 7 MACOS MACOS = 1 SEPOS SEPOS = 14 TVOS TVOS = 3 TVOS_SIMULATOR TVOS_SIMULATOR = 8 UNKNOWN UNKNOWN = 0 VISIONOS VISIONOS = 11 VISIONOS_SIMULATOR VISIONOS_SIMULATOR = 12 WATCHOS WATCHOS = 4 WATCHOS_SIMULATOR WATCHOS_SIMULATOR = 9 VERSION class VERSION( *values ) Bases: Enum DYLD_1042_1 DYLD_1042_1 = 8 DYLD_1231_3 DYLD_1231_3 = 9 DYLD_1284_13 DYLD_1284_13 = 10 DYLD_195_5 DYLD_195_5 = 2 DYLD_239_3 DYLD_239_3 = 3 DYLD_360_14 DYLD_360_14 = 4 DYLD_421_1 DYLD_421_1 = 5 DYLD_832_7_1 DYLD_832_7_1 = 6 DYLD_940 DYLD_940 = 7 DYLD_95_3 DYLD_95_3 = 1 UNKNOWN UNKNOWN = 0 UNRELEASED UNRELEASED = 11 arch property arch → lief.dsc.DyldSharedCache.ARCH Architecture targeted by this cache arch_name property arch_name → str Name of the architecture targeted by this cache ( x86_64h ) cache_for_address cache_for_address( self , address: int ) → lief._lief.dsc.DyldSharedCache | None Find the sub-DyldSharedCache that wraps the given virtual address disassemble disassemble( self , arg: int , / ) → Iterator[ lief._lief.assembly.Instruction | None] Disassemble instructions at the provided virtual address. This function returns an iterator over lief.assembly.Instruction . enable_caching enable_caching( self , target_dir: str ) → None When enabled, this function allows to record and to keep in cache , dyld shared cache information that are costly to access. For instance, GOT symbols, rebases information, stub symbols, … It is highly recommended to enable this function when processing a dyld shared cache several times or when extracting a large number of lief.dsc.Dylib with enhanced extraction options (e.g. lief.dsc.Dylib.extract_opt_t.fix_branches ) One can enable caching by calling this function: dyld_cache = lief.dsc.load(\"macos-15.0.1/\"); dyld_cache.enable_caching(\"~/.cache/lief-dsc\"); One can also enable this cache optimization globally using the function: lief.dsc.enable_cache() or by setting the environment variable DYLDSC_ENABLE_CACHE to 1. filename property filename → str Filename of the dyld shared file associated with this object. For instance: dyld_shared_cache_arm64e, dyld_shared_cache_arm64e.62.dyldlinkedit filepath property filepath → str Full path to the original dyld shared cache file associated with object (e.g. /cache/visionos/dyld_shared_cache_arm64e.42 ) find_lib_from_name find_lib_from_name( self , name: str ) → lief._lief.dsc.Dylib | None Find the Dylib whose filename of lief.dsc.Dylib.path matches the provided name. If multiple libraries have the same name (but with a different path), the first one matching the provided name is returned. find_lib_from_path find_lib_from_path( self , path: str ) → lief._lief.dsc.Dylib | None Find the Dylib whose lief.dsc.Dylib.path matches the provided path. find_lib_from_va find_lib_from_va( self , virtual_address: int ) → lief._lief.dsc.Dylib | None Find the lief.dsc.Dylib that encompasses the given virtual address. It returns None if a Dylib can’t be found. find_subcache find_subcache( self , filename: str ) → lief._lief.dsc.DyldSharedCache | None Try to find the DyldSharedCache associated with the filename given in the first parameter. flush_cache flush_cache( self ) → None Flush internal information into the on-disk cache (see: enable_caching() ) from_files from_files( files: collections.abc.Sequence[str] ) → lief.dsc.DyldSharedCache | None = from_path from_path( path: str , arch: str ) → lief.dsc.DyldSharedCache | None = get_content_from_va get_content_from_va( self , addr: int , size: int ) → bytes Return the content at the specified virtual address has_subcaches property has_subcaches → bool True if the subcaches are associated with this cache libraries property libraries → collections.abc.Sequence[ lief.dsc.Dylib | None] Return a list-like of the Dylib embedded in this dyld shared cache load_address property load_address → int Base address of this cache main_cache property main_cache → lief.dsc.DyldSharedCache | None Return the principal dyld shared cache in the case of multiple subcaches mapping_info property mapping_info → collections.abc.Sequence[ lief.dsc.MappingInfo | None] Return a list-like of the MappingInfo embedded in this dyld shared cache platform property platform → lief.dsc.DyldSharedCache.PLATFORM Platform targeted by this cache (e.g. vision-os) subcaches property subcaches → collections.abc.Sequence[ lief.dsc.SubCache | None] Return a list-like of SubCache embedded in this (main) dyld shared cache va_to_offset va_to_offset( self , virtual_address: int ) → int | lief._lief.lief_errors Convert the given virtual address into an offset. Warning If the shared cache contains multiple subcaches, this function needs to be called on the targeted subcache. See cache_for_address() to find the associated subcache. version property version → lief.dsc.DyldSharedCache.VERSION Version of dyld used by this cache Dylib lief.dsc.Dylib class lief.dsc.Dylib Bases: object This class represents a library embedded in a dyld shared cache. It mirrors the original dyld_cache_image_info structure. address property address → int In-memory address of the library extract_opt_t class extract_opt_t( self ) Bases: object This structure is used to tweak the extraction process while calling lief.dsc.Dylib.get() . These options allow to deoptimize the dylib and get an accurate representation of the original Mach-O binary. create_dyld_chained_fixup_cmd property create_dyld_chained_fixup_cmd → bool Whether the LC_DYLD_CHAINED_FIXUPS command should be (re)created. If this value is not set, LIEF will add the command only if it’s meaningful regarding the other options fix_branches property fix_branches → bool Fix call instructions that target addresses outside the current dylib virtual space. Warning Enabling this option can have a significant impact on the performances. Make sure to enable the internal cache mechanism: lief.dsc.enable_cache() or lief.dsc.DyldSharedCache.enable_caching() fix_memory property fix_memory → bool Fix memory accesses performed outside the dylib’s virtual space Warning Enabling this option can have a significant impact on the performances. Make sure to enable the internal cache mechanism: lief.dsc.enable_cache() or lief.dsc.DyldSharedCache.enable_caching() fix_objc property fix_objc → bool Fix Objective-C information Warning Enabling this option can have a significant impact on the performances. Make sure to enable the internal cache mechanism: lief.dsc.enable_cache() or lief.dsc.DyldSharedCache.enable_caching() fix_relocations property fix_relocations → bool Recover and fix relocations Warning Enabling this option can have a significant impact on the performances. Make sure to enable the internal cache mechanism: lief.dsc.enable_cache() or lief.dsc.DyldSharedCache.enable_caching() pack property pack → bool Whether the segment’s offsets should be packed to avoid an in-memory size while writing back the binary. Note This option does not have an impact on the performances get get( self , opt: lief._lief.dsc.Dylib.extract_opt_t = ) → lief._lief.MachO.Binary | None Get a lief.MachO.Binary representation for this Dylib. One can use this function to write back the Mach-O binary on the disk: dyld_cache: lief.dsc.DyldSharedCache = ... dyld_cache.libraries[10].get().write(\"libsystem.dylib\") inode property inode → int File serial number matching stat.st_ino or 0 Note that for shared cache targeting iOS, this value can hold a hash of the path (if modtime is set to 0) modtime property modtime → int Modification time of the library matching stat.st_mtime , or 0 padding property padding → int Padding alignment value (should be 0) path property path → str Original path of the library (e.g. /usr/lib/libcryptex.dylib ) MappingInfo lief.dsc.MappingInfo class lief.dsc.MappingInfo Bases: object This class represents a dyld_cache_mapping_info entry. It provides information about the relationship between on-disk shared cache and in-memory shared cache. address property address → int The in-memory address where this dyld shared cache region is mapped end_address property end_address → int End virtual address of the region file_offset property file_offset → int On-disk file offset init_prot property init_prot → int Initial memory protection max_prot property max_prot → int Max memory protection size property size → int Size of the region being mapped SubCache lief.dsc.SubCache class lief.dsc.SubCache Bases: object This class represents a subcache in the case of large/split dyld shared cache. It mirror (and abstracts) the original dyld_subcache_entry / dyld_subcache_entry_v1 cache property cache → lief.dsc.DyldSharedCache | None The associated DyldSharedCache object for this subcache suffix property suffix → str The file name suffix of the subCache file (e.g. .25.data , .03.development ) uuid property uuid → list[int] The uuid of the subcache file vm_offset property vm_offset → int The offset of this subcache from the main cache base address Utilities lief.is_shared_cache lief.is_shared_cache( file: str | os.PathLike ) → bool Check if the given file is a dyld shared cache", "contentHash": "00c117c5d0ff01ffaf990a6ead3fbd35ba67ff0a51a045df024ed13448f1b079", "description": "Dyld Shared Cache Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "extended/dsc/python", "documentID": "8526e79645ff813633df72e443e8ec7b697331f8c7d9511401e5e0d19a9f05eb", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/dsc/python.md", "title": "Dyld Shared Cache Python API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/dsc/rust.html", "content": "Rust Note Please check: lief::dsc", "contentHash": "727e584e83baf1de4e837f0a5265c91a82c8fc238d9d66fbef2379cbc76abcfe", "description": "Dyld Shared Cache Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "extended/dsc/rust", "documentID": "9af2475628e60fd16392811f30e9da364307572c880fe69bdc8750a25cd4e501", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/dsc/rust.md", "title": "Dyld Shared Cache Rust API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/dwarf/cpp.html", "content": "C++ Note You can also find the Doxygen documentation here: here LIEF::dwarf::load inline std::unique_ptr< DebugInfo > LIEF::dwarf::load(const std::string &dwarf_path) Load DWARF file from the given path. DebugInfo DebugInfo class DebugInfo : public LIEF:: DebugInfo This class represents a DWARF debug information. It can embed different compilation units which can be accessed through compilation_units() . This class can be instantiated from LIEF::Binary::debug_info() or load() Public Types compilation_units_it using compilation_units_it = iterator_range < CompilationUnit :: Iterator > Iterator over the CompilationUnit . Public Functions find_function std::unique_ptr< Function > find_function(const std::string &name) const Try to find the function with the given name (mangled or not). const DebugInfo& info = ...; if (auto func = info.find_function(\"_ZNSt6localeD1Ev\")) { // Found } if (auto func = info.find_function(\"std::locale::~locale()\")) { // Found } find_function std::unique_ptr< Function > find_function(uint64_t addr) const Try to find the function at the given virtual address. find_variable std::unique_ptr< Variable > find_variable(const std::string &name) const Try to find the variable with the given name. This name can be mangled or not. find_variable std::unique_ptr< Variable > find_variable(uint64_t addr) const Try to find the variable at the given virtual address. find_type std::unique_ptr< Type > find_type(const std::string &name) const Try to find the type with the given name. compilation_units compilation_units_it compilation_units() const Iterator on the CompilationUnit embedded in this dwarf. find_function_address virtual std::optional find_function_address(const std::string &name) const override Attempt to resolve the address of the function specified by name . format inline virtual FORMAT format() const override ~DebugInfo virtual ~DebugInfo() override = default DebugInfo DebugInfo(std::unique_ptr impl) Public Static Functions from_file static std::unique_ptr< DebugInfo > from_file(const std::string &path) classof static inline bool classof(const LIEF:: DebugInfo *info) CompilationUnit CompilationUnit class CompilationUnit This class represents a DWARF compilation unit. Public Types functions_it using functions_it = iterator_range < Function :: Iterator > Iterator over the dwarf::Function . types_it using types_it = iterator_range < Type :: Iterator > Iterator over the dwarf::Type . vars_it using vars_it = iterator_range < Variable :: Iterator > Iterator over the CompilationUnit ’s variables. Public Functions CompilationUnit CompilationUnit(std::unique_ptr impl) ~CompilationUnit ~CompilationUnit() name std::string name() const Name of the file associated with this compilation unit (e.g. test.cpp ) Return an empty string if the name is not found or can’t be resolved. This value matches the DW_AT_name attribute producer std::string producer() const Information about the program (or library) that generated this compilation unit. For instance, it can output: Debian clang version 17.0.6 . It returns an empty string if the producer is not present or can’t be resolved This value matches the DW_AT_producer attribute compilation_dir std::string compilation_dir() const Return the path to the directory in which the compilation took place for compiling this compilation unit (e.g. /workdir/build ). It returns an empty string if the entry is not present or can’t be resolved This value matches the DW_AT_comp_dir attribute language Language language() const Original language of this compilation unit. This value matches the DW_AT_language attribute. low_address uint64_t low_address() const Return the lowest virtual address owned by this compilation unit. high_address uint64_t high_address() const Return the highest virtual address owned by this compilation unit. size uint64_t size() const Return the size of the compilation unit according to its range of address. If the compilation is fragmented (i.e. there are some address ranges between the lowest address and the highest that are not owned by the CU), then it returns the sum of all the address ranges owned by this CU. If the compilation unit is not fragmented, then it basically returns high_address - low_address . ranges std::vector ranges() const Return a list of address ranges owned by this compilation unit. If the compilation unit owns a contiguous range, it should return a single range. find_function std::unique_ptr< Function > find_function(const std::string &name) const Try to find the function whose name is given in parameter. The provided name can be demangled find_function std::unique_ptr< Function > find_function(uint64_t addr) const Try to find the function at the given address. find_variable std::unique_ptr< Variable > find_variable(uint64_t addr) const Try to find the Variable at the given address. find_variable std::unique_ptr< Variable > find_variable(const std::string &name) const Try to find the Variable with the given name. functions functions_it functions() const Return an iterator over the functions implemented in this compilation unit. Note that this iterator only iterates over the functions that have a concrete implementation in the compilation unit. For instance with this code: inline const char* get_secret_env() { return getenv(\"MY_SECRET_ENV\"); } int main() { printf(\"%s\", get_secret_env()); return 0; } The iterator will only return one function for main since get_secret_env is inlined and thus, its implementation is located in main . imported_functions functions_it imported_functions() const Return an iterator over the functions imported in this compilation unit but not implemented. For instance with this code: #include int main() { printf(\"Hello\\n\"); return 0; } printf is imported from the standard libc so the function is returned by the iterator. On the other hand, main() is implemented in this compilation unit so it is not returned by imported_function() but functions() . types types_it types() const Return an iterator over the different types defined in this compilation unit. variables vars_it variables() const Return an iterator over all the variables defined in this compilation unit: static int A = 1; // Returned by the iterator static const char* B = \"Hello\"; // Returned by the iterator int get() { static int C = 2; // Returned by the iterator return C; } to_decl std::string to_decl(const DeclOpt &opt = DeclOpt ()) const Generate a C/C++ definition for the functions defined in this compilation unit. Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::bidirectional_iterator_tag, CompilationUnit , std::ptrdiff_t, const CompilationUnit *, const CompilationUnit &> Public Types implementation using implementation = details::CompilationUnitIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator-- Iterator &operator--() operator* const CompilationUnit &operator*() const operator-> const CompilationUnit *operator->() const yield std::unique_ptr< CompilationUnit > yield() Transfer ownership of the compilation unit at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) operator-- inline DerivedT operator--(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) Language class Language Languages supported by the DWARF (v5) format. See: https://dwarfstd.org/languages.html . Some languages (like C++11, C++17, ..) have a version (11, 17, …) which is stored in a dedicated attribute: version Public Types LANG enum LANG Values: UNKNOWN enumerator UNKNOWN = 0 C enumerator C CPP enumerator CPP RUST enumerator RUST DART enumerator DART MODULA enumerator MODULA FORTRAN enumerator FORTRAN SWIFT enumerator SWIFT D enumerator D JAVA enumerator JAVA COBOL enumerator COBOL Public Functions Language Language() = default Language inline Language( LANG lang, uint32_t version) Language inline Language( LANG lang) Language Language(const Language &) = default operator= Language &operator=(const Language &) = default Language Language( Language &&) = default operator= Language &operator=( Language &&) = default ~Language ~Language() = default Public Members lang LANG lang = UNKNOWN The language itself. version uint32_t version = 0 Version of the language (e.g. 17 for C++17). Function Function class Function This class represents a DWARF function which can be associated with either: DW_TAG_subprogram or DW_TAG_inlined_subroutine . Public Types vars_it using vars_it = iterator_range < Variable :: Iterator > Iterator over the variables defined in the scope of this function. parameters_t using parameters_t = std::vector> thrown_types_t using thrown_types_t = std::vector> lexical_blocks_it using lexical_blocks_it = iterator_range < LexicalBlock :: Iterator > instructions_it using instructions_it = iterator_range Public Functions Function Function(std::unique_ptr impl) name std::string name() const The name of the function ( DW_AT_name ). linkage_name std::string linkage_name() const The name of the function which is used for linking ( DW_AT_linkage_name ). This name differs from name() as it is usually mangled. The function returns an empty string if the linkage name is not available. address result address() const Return the address of the function ( DW_AT_entry_pc or DW_AT_low_pc ). variables vars_it variables() const Return an iterator of variables ( DW_TAG_variable ) defined within the scope of this function. This includes regular stack-based variables as well as static ones. is_artificial bool is_artificial() const Whether this function is created by the compiler and not present in the original source code. is_external bool is_external() const Whether the function is defined outside the current compilation unit ( DW_AT_external ). size uint64_t size() const Return the size taken by this function in the binary. ranges std::vector ranges() const Ranges of virtual addresses owned by this function. debug_location debug_location_t debug_location() const Original source code location. type std::unique_ptr< Type > type() const Return the dwarf::Type associated with the return type of this function. parameters parameters_t parameters() const Return the function’s parameters (including any template parameter). thrown_types thrown_types_t thrown_types() const List of exceptions (types) that can be thrown by the function. For instance, given this Swift code: func summarize(_ ratings: [Int]) throws(StatisticsError) { // ... } thrown_types() returns one element associated with the Type : StatisticsError . scope std::unique_ptr< Scope > scope() const Return the scope in which this function is defined. instructions instructions_it instructions() const Disassemble the current function by returning an iterator over the assembly::Instruction . lexical_blocks lexical_blocks_it lexical_blocks() const Iterator over the LexicalBlock owned by this function. description std::string description() const Description ( DW_AT_description ) of this function or an empty string. to_decl std::string to_decl(const DeclOpt &opt = DeclOpt ()) const Generates a C/C++ definition for this function. ~Function ~Function() Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::bidirectional_iterator_tag, Function , std::ptrdiff_t, const Function *, const Function &> Public Types implementation using implementation = details::FunctionIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator-- Iterator &operator--() operator* const Function &operator*() const operator-> const Function *operator->() const yield std::unique_ptr< Function > yield() Transfer ownership of the function at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) operator-- inline DerivedT operator--(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) Parameter Parameter class Parameter This class represents a DWARF parameter which can be either: A regular function parameter (see: parameters::Formal ) A template type parameter (see: parameters::TemplateType ) A template value parameter (see: parameters::TemplateValue ) Subclassed by LIEF::dwarf::parameters::Formal , LIEF::dwarf::parameters::TemplateType , LIEF::dwarf::parameters::TemplateValue Public Types KIND enum class KIND Values: UNKNOWN enumerator UNKNOWN = 0 TEMPLATE_TYPE enumerator TEMPLATE_TYPE DW_TAG_template_type_parameter. TEMPLATE_VALUE enumerator TEMPLATE_VALUE DW_TAG_template_value_parameter. FORMAL enumerator FORMAL DW_TAG_formal_parameter. Public Functions Parameter Parameter() = delete Parameter Parameter( Parameter &&other) noexcept operator= Parameter &operator=( Parameter &&other) noexcept operator= Parameter &operator=(const Parameter &) = delete Parameter Parameter(const Parameter &) = delete kind KIND kind() const name std::string name() const Name of the parameter. type std::unique_ptr< Type > type() const Type of this parameter. location std::unique_ptr< Location > location() const Location of this parameter. For instance it can be a specific register that is not following the calling convention. Tas template inline const T *as() const ~Parameter virtual ~Parameter() Public Static Functions create static std::unique_ptr< Parameter > create(std::unique_ptr impl) Location class Location This class exposes information about the location of a parameter. Subclassed by LIEF::dwarf::Parameter::RegisterLoc Public Types Type enum class Type : uint8_t Values: UNKNOWN enumerator UNKNOWN = 0 REG enumerator REG Public Functions Location inline Location( Type ty) Tas template inline const T *as() const Public Members type Type type = Type :: UNKNOWN RegisterLoc class RegisterLoc : public LIEF::dwarf:: Parameter :: Location This class represents a register location. Public Functions RegisterLoc inline RegisterLoc(uint64_t reg_id) Public Members id uint64_t id = 0 DWARF id of the register. Public Static Functions classof static inline bool classof(const Location *loc) Formal Parameter Formal class Formal : public LIEF::dwarf:: Parameter This class represents a regular function parameter. For instance, given this prototype: int main(int argc, const char** argv); The function main has two parameters::Formal parameters: argc ( Parameter::name ) typed as int ( types::Base from Parameter::type ) argv ( Parameter::name ) typed as const char** ( types::Const from Parameter::type ) Public Functions ~Formal ~Formal() override = default Parameter Parameter() = delete Parameter Parameter( Parameter &&other) noexcept Parameter Parameter(const Parameter &) = delete Public Static Functions classof static inline bool classof(const Parameter *P) Template Value Parameter TemplateValue class TemplateValue : public LIEF::dwarf:: Parameter This class represents a template value parameter. For instance, given this prototype: template void generic(); The function generic has one parameters::TemplateValue parameter: X . Public Functions ~TemplateValue ~TemplateValue() override = default Parameter Parameter() = delete Parameter Parameter( Parameter &&other) noexcept Parameter Parameter(const Parameter &) = delete Public Static Functions classof static inline bool classof(const Parameter *P) Template Type Parameter TemplateType class TemplateType : public LIEF::dwarf:: Parameter This class represents a template type parameter. For instance, given this prototype: template void generic(); The function generic has one parameters::TemplateType parameter: Y . Public Functions ~TemplateType ~TemplateType() override = default Parameter Parameter() = delete Parameter Parameter( Parameter &&other) noexcept Parameter Parameter(const Parameter &) = delete Public Static Functions classof static inline bool classof(const Parameter *P) Scope Scope class Scope This class materializes a scope in which Function , Variable , Type , … can be defined. Public Types TYPE enum class TYPE : uint32_t Values: UNKNOWN enumerator UNKNOWN = 0 UNION enumerator UNION CLASS enumerator CLASS STRUCT enumerator STRUCT NAMESPACE enumerator NAMESPACE FUNCTION enumerator FUNCTION COMPILATION_UNIT enumerator COMPILATION_UNIT Public Functions Scope Scope(std::unique_ptr impl) name std::string name() const Name of the scope. For instance namespace’s name or function’s name. parent std::unique_ptr< Scope > parent() const Parent scope (if any). type TYPE type() const The current scope type. chained std::string chained(const std::string &sep = \"::\") const Represent the whole chain of all (parent) scopes using the provided separator. E.g. ns1::ns2::Class1::Struct2::Type . ~Scope ~Scope() Variable Variable class Variable This class represents a DWARF variable which can be owned by a dwarf::Function or a dwarf::CompilationUnit . Public Functions Variable Variable(std::unique_ptr impl) name std::string name() const Name of the variable (usually demangled). linkage_name std::string linkage_name() const The name of the variable which is used for linking ( DW_AT_linkage_name ). This name differs from name() as it is usually mangled. The function returns an empty string if the linkage name is not available. address result address() const Address of the variable. If the variable is static , it returns the virtual address where it is defined. If the variable is stack-based, it returns the relative offset from the frame based register. If the address can’t be resolved, it returns a lief_errors . size result size() const Return the size of the variable (or a lief_errors if it can’t be resolved). This size is defined by its type. is_constexpr bool is_constexpr() const Whether it’s a constexpr variable. is_stack_based bool is_stack_based() const Whether this variable is allocated on the stack. debug_location debug_location_t debug_location() const The original source location where the variable is defined. type std::unique_ptr< Type > type() const Return the type of this variable. scope std::unique_ptr< Scope > scope() const Return the scope in which this variable is defined. description std::string description() const Description ( DW_AT_description ) of the variable or an empty string. to_decl std::string to_decl(const DeclOpt &opt = DeclOpt ()) const Generates a C/C++ definition for this variable. ~Variable ~Variable() Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::bidirectional_iterator_tag, Variable , std::ptrdiff_t, const Variable *, const Variable &> Public Types implementation using implementation = details::VariableIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator-- Iterator &operator--() operator* const Variable &operator*() const operator-> const Variable *operator->() const yield std::unique_ptr< Variable > yield() Transfer ownership of the variable at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) operator-- inline DerivedT operator--(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) LexicalBlock LexicalBlock class LexicalBlock This class represents a DWARF lexical block ( DW_TAG_lexical_block ). Public Types sub_blocks_it using sub_blocks_it = iterator_range < Iterator > Public Functions LexicalBlock LexicalBlock(std::unique_ptr impl) LexicalBlock LexicalBlock() = delete operator= LexicalBlock &operator=(const LexicalBlock &) = delete LexicalBlock LexicalBlock(const LexicalBlock &) = delete name std::string name() const Return the name associated with this lexical block or an empty string. description std::string description() const Return the description associated with this lexical block or an empty string. sub_blocks sub_blocks_it sub_blocks() const Return an iterator over the sub-LexicalBlock owned by this block. addr std::optional addr() const Return the start address of this block. size uint64_t size() const Return the size of this block as the difference of the highest address and the lowest address. low_pc std::optional low_pc() const Return the lowest virtual address owned by this block. high_pc std::optional high_pc() const Return the highest virtual address owned by this block. ranges std::vector ranges() const Return a list of address ranges owned by this block. If the lexical block owns a contiguous range, it should return a single range. ~LexicalBlock ~LexicalBlock() Public Static Functions create static std::unique_ptr< LexicalBlock > create(std::unique_ptr impl) Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::bidirectional_iterator_tag, LexicalBlock , std::ptrdiff_t, const LexicalBlock *, const LexicalBlock &> Public Types implementation using implementation = details::LexicalBlockIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator-- Iterator &operator--() operator* const LexicalBlock &operator*() const operator-> const LexicalBlock *operator->() const yield std::unique_ptr< LexicalBlock > yield() Transfer ownership of the lexical block at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) operator-- inline DerivedT operator--(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) Type Type class Type This class represents a DWARF Type which includes: DW_TAG_array_type DW_TAG_atomic_type DW_TAG_base_type DW_TAG_class_type DW_TAG_coarray_type DW_TAG_const_type DW_TAG_dynamic_type DW_TAG_enumeration_type DW_TAG_file_type DW_TAG_immutable_type DW_TAG_interface_type DW_TAG_packed_type DW_TAG_pointer_type DW_TAG_ptr_to_member_type DW_TAG_reference_type DW_TAG_restrict_type DW_TAG_rvalue_reference_type DW_TAG_set_type DW_TAG_shared_type DW_TAG_string_type DW_TAG_structure_type DW_TAG_subroutine_type DW_TAG_template_alias DW_TAG_thrown_type DW_TAG_typedef DW_TAG_union_type DW_TAG_unspecified_type DW_TAG_volatile_type Subclassed by LIEF::dwarf::types::Array , LIEF::dwarf::types::Atomic , LIEF::dwarf::types::Base , LIEF::dwarf::types::ClassLike , LIEF::dwarf::types::Coarray , LIEF::dwarf::types::Const , LIEF::dwarf::types::Dynamic , LIEF::dwarf::types::Enum , LIEF::dwarf::types::File , LIEF::dwarf::types::Immutable , LIEF::dwarf::types::Interface , LIEF::dwarf::types::Pointer , LIEF::dwarf::types::PointerToMember , LIEF::dwarf::types::RValueReference , LIEF::dwarf::types::Reference , LIEF::dwarf::types::Restrict , LIEF::dwarf::types::SetTy , LIEF::dwarf::types::Shared , LIEF::dwarf::types::StringTy , LIEF::dwarf::types::Subroutine , LIEF::dwarf::types::TemplateAlias , LIEF::dwarf::types::Thrown , LIEF::dwarf::types::Typedef , LIEF::dwarf::types::Volatile Public Types KIND enum class KIND Values: UNKNOWN enumerator UNKNOWN = 0 UNSPECIFIED enumerator UNSPECIFIED BASE enumerator BASE CONST_KIND enumerator CONST_KIND CLASS enumerator CLASS ARRAY enumerator ARRAY POINTER enumerator POINTER STRUCT enumerator STRUCT UNION enumerator UNION TYPEDEF enumerator TYPEDEF REF enumerator REF SET_TYPE enumerator SET_TYPE STRING enumerator STRING SUBROUTINE enumerator SUBROUTINE POINTER_MEMBER enumerator POINTER_MEMBER PACKED enumerator PACKED FILE enumerator FILE THROWN enumerator THROWN VOLATILE enumerator VOLATILE RESTRICT enumerator RESTRICT INTERFACE enumerator INTERFACE SHARED enumerator SHARED RVALREF enumerator RVALREF TEMPLATE_ALIAS enumerator TEMPLATE_ALIAS COARRAY enumerator COARRAY DYNAMIC enumerator DYNAMIC ATOMIC enumerator ATOMIC IMMUTABLE enumerator IMMUTABLE ENUM enumerator ENUM Public Functions Type Type(std::unique_ptr impl) Type Type(details::Type &impl) Type Type(const Type &) = delete operator= Type &operator=(const Type &) = delete Type Type( Type &&) noexcept operator= Type &operator=( Type &&) noexcept ~Type virtual ~Type() kind KIND kind() const is_unspecified inline bool is_unspecified() const Whether this type is a DW_TAG_unspecified_type . name result name() const Return the type’s name using either DW_AT_name or DW_AT_picture_string (if any). size result size() const Return the size of the type or an error if it can’t be computed. This size should match the equivalent of sizeof(Type) . location debug_location_t location() const Return the debug location where this type is defined. scope std::unique_ptr< Scope > scope() const Return the scope in which this type is defined. to_decl std::string to_decl(const DeclOpt &opt = DeclOpt ()) const Generates a C/C++ definition for this type. Tas template inline const T *as() const Public Static Functions create static std::unique_ptr< Type > create(std::unique_ptr impl) Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::bidirectional_iterator_tag, Type , std::ptrdiff_t, const Type *, const Type &> Public Types implementation using implementation = details::TypeIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator-- Iterator &operator--() operator* const Type &operator*() const operator-> const Type *operator->() const yield std::unique_ptr< Type > yield() Transfer ownership of the type at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) operator-- inline DerivedT operator--(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) Array Array class Array : public LIEF::dwarf:: Type This class represents a DW_TAG_array_type . Public Functions ArgsArray template>> inline Array( Args &&... args) Array Array(const Array &) = delete operator= Array &operator=(const Array &) = delete Array Array( Array &&) noexcept = default operator= Array &operator=( Array &&) noexcept = default underlying_type const Type *underlying_type() const The underlying type of this array. operator-> inline const Type *operator->() const operator* inline const Type &operator*() const size_info size_info_t size_info() const Return information about the size of this array. This size info is usually embedded in a DW_TAG_subrange_type DIE which is represented by the size_info_t structure. ~Array ~Array() override Public Static Functions classof static inline bool classof(const Type *type) size_info_t struct size_info_t Structure that wraps information about the dimension of this array. Public Functions operator bool inline operator bool() const Public Members type std::unique_ptr< Type > type = nullptr Type of the index for this array. For instance in uint8_t[3] the index type could be set to a size_t . name std::string name Name of the index (usually not relevant like __ARRAY_SIZE_TYPE__ ). size size_t size = 0 Size of the array. For instance in uint8_t[3] , it returns 3. Base Base class Base : public LIEF::dwarf:: Type This class wraps the DW_TAG_base_type type which can be used — for instance — to represent integers or primitive types. Public Types ENCODING enum class ENCODING Values: NONE enumerator NONE = 0 SIGNED enumerator SIGNED Mirror DW_ATE_signed . SIGNED_CHAR enumerator SIGNED_CHAR Mirror DW_ATE_signed_char . UNSIGNED enumerator UNSIGNED Mirror DW_ATE_unsigned . UNSIGNED_CHAR enumerator UNSIGNED_CHAR Mirror DW_ATE_unsigned_char . FLOAT enumerator FLOAT Mirror DW_ATE_float . BOOLEAN enumerator BOOLEAN Mirror DW_ATE_boolean . ADDRESS enumerator ADDRESS Mirror DW_ATE_address . Public Functions ArgsBase template>> inline Base( Args &&... args) Base Base(const Base &) = delete operator= Base &operator=(const Base &) = delete Base Base( Base &&) noexcept = default operator= Base &operator=( Base &&) noexcept = default encoding ENCODING encoding() const Describe how the base type is encoded and should be interpreted. ~Base ~Base() override Public Static Functions classof static inline bool classof(const Type *type) ClassLike ClassLike class ClassLike : public LIEF::dwarf:: Type This class abstracts a DWARF aggregate: DW_TAG_structure_type , DW_TAG_class_type , DW_TAG_union_type . Subclassed by LIEF::dwarf::types::Class , LIEF::dwarf::types::Packed , LIEF::dwarf::types::Structure , LIEF::dwarf::types::Union Public Types functions_it using functions_it = iterator_range < Function :: Iterator > Public Functions ArgsClassLike template>> inline ClassLike( Args &&... args) ClassLike ClassLike(const ClassLike &) = delete operator= ClassLike &operator=(const ClassLike &) = delete ClassLike ClassLike( ClassLike &&) noexcept = default operator= ClassLike &operator=( ClassLike &&) noexcept = default members std::vector< Member > members() const Return the list of all the attributes defined in this class-like type. find_member std::unique_ptr< Member > find_member(uint64_t offset) const Try to find the attribute at the given offset. functions functions_it functions() const Iterator over the functions defined by the class-like. ~ClassLike ~ClassLike() override Public Static Functions classof static inline bool classof(const Type *type) Member class Member This represents a class/struct/union attribute. Public Functions Member Member(std::unique_ptr impl) Member Member( Member &&other) noexcept operator= Member &operator=( Member &&other) noexcept Member Member(const Member &) = delete operator= Member &operator=(const Member &) = delete name std::string name() const Name of the member. offset result offset() const Offset of the current member in the struct/union/class. If the offset can’t be resolved it returns a lief_errors bit_offset result bit_offset() const Offset of the current member in bits in the struct/union/class. This function differs from offset() for aggregates using bit-field declaration: struct S { int flag : 4; int opt : 1 }; Usually, offset() * 8 == bit_offset() If the offset can’t be resolved it returns a lief_errors bit_size result bit_size() const If the current member is a bit-field, this function returns its size in bits. type std::unique_ptr< Type > type() const Type of the current member. is_external bool is_external() const is_declaration bool is_declaration() const ~Member ~Member() Structure Structure class Structure : public LIEF::dwarf::types:: ClassLike This class represents a DWARF struct type ( DW_TAG_structure_type ). Public Functions ArgsStructure template>> inline Structure( Args &&... args) Structure Structure(const Structure &) = delete operator= Structure &operator=(const Structure &) = delete Structure Structure( Structure &&) noexcept = default operator= Structure &operator=( Structure &&) noexcept = default ~Structure ~Structure() override Public Static Functions classof static inline bool classof(const Type *type) Class Class class Class : public LIEF::dwarf::types:: ClassLike This class represents a DWARF class type ( DW_TAG_class_type ). Public Functions ArgsClass template>> inline Class( Args &&... args) Class Class(const Class &) = delete operator= Class &operator=(const Class &) = delete Class Class( Class &&) noexcept = default operator= Class &operator=( Class &&) noexcept = default ~Class ~Class() override Public Static Functions classof static inline bool classof(const Type *type) Union Union class Union : public LIEF::dwarf::types:: ClassLike This class represents a DWARF union type ( DW_TAG_union_type ). Public Functions ArgsUnion template>> inline Union( Args &&... args) Union Union(const Union &) = delete operator= Union &operator=(const Union &) = delete Union Union( Union &&) noexcept = default operator= Union &operator=( Union &&) noexcept = default ~Union ~Union() override Public Static Functions classof static inline bool classof(const Type *type) Packed Packed class Packed : public LIEF::dwarf::types:: ClassLike This class represents a DWARF packed type ( DW_TAG_packed_type ). Public Functions ArgsPacked template>> inline Packed( Args &&... args) Packed Packed(const Packed &) = delete operator= Packed &operator=(const Packed &) = delete Packed Packed( Packed &&) noexcept = default operator= Packed &operator=( Packed &&) noexcept = default ~Packed ~Packed() override Public Static Functions classof static inline bool classof(const Type *type) Const Const class Const : public LIEF::dwarf:: Type This class represents a DW_TAG_const_type . Public Functions ArgsConst template>> inline Const( Args &&... args) Const Const(const Const &) = delete operator= Const &operator=(const Const &) = delete Const Const( Const &&) noexcept = default operator= Const &operator=( Const &&) noexcept = default underlying_type const Type *underlying_type() const The underlying type being const-ed. operator-> inline const Type *operator->() const operator* inline const Type &operator*() const ~Const ~Const() override Public Static Functions classof static inline bool classof(const Type *type) Pointer Pointer class Pointer : public LIEF::dwarf:: Type This class represents a DW_TAG_pointer_type DWARF type. Public Functions ArgsPointer template>> inline Pointer( Args &&... args) Pointer Pointer(const Pointer &) = delete operator= Pointer &operator=(const Pointer &) = delete Pointer Pointer( Pointer &&) noexcept = default operator= Pointer &operator=( Pointer &&) noexcept = default underlying_type const Type *underlying_type() const The type pointed by this pointer. operator-> inline const Type *operator->() const operator* inline const Type &operator*() const ~Pointer ~Pointer() override Public Static Functions classof static inline bool classof(const Type *type) Typedef Typedef class Typedef : public LIEF::dwarf:: Type This class represents a DW_TAG_typedef type. Public Functions ArgsTypedef template>> inline Typedef( Args &&... args) Typedef Typedef(const Typedef &) = delete operator= Typedef &operator=(const Typedef &) = delete Typedef Typedef( Typedef &&) noexcept = default operator= Typedef &operator=( Typedef &&) noexcept = default underlying_type const Type *underlying_type() const The type aliased by this typedef. operator-> inline const Type *operator->() const operator* inline const Type &operator*() const ~Typedef ~Typedef() override Public Static Functions classof static inline bool classof(const Type *type) Atomic Atomic class Atomic : public LIEF::dwarf:: Type This class represents a DW_TAG_atomic_type . Public Functions ArgsAtomic template>> inline Atomic( Args &&... args) Atomic Atomic(const Atomic &) = delete operator= Atomic &operator=(const Atomic &) = delete Atomic Atomic( Atomic &&) noexcept = default operator= Atomic &operator=( Atomic &&) noexcept = default underlying_type const Type *underlying_type() const The underlying type being atomic. operator-> inline const Type *operator->() const operator* inline const Type &operator*() const ~Atomic ~Atomic() override Public Static Functions classof static inline bool classof(const Type *type) Coarray Coarray class Coarray : public LIEF::dwarf:: Type This class represents a DW_TAG_coarray_type . Public Functions ArgsCoarray template>> inline Coarray( Args &&... args) Coarray Coarray(const Coarray &) = delete operator= Coarray &operator=(const Coarray &) = delete Coarray Coarray( Coarray &&) noexcept = default operator= Coarray &operator=( Coarray &&) noexcept = default ~Coarray ~Coarray() override Public Static Functions classof static inline bool classof(const Type *type) Dynamic Dynamic class Dynamic : public LIEF::dwarf:: Type This class represents a DW_TAG_dynamic_type . Public Functions ArgsDynamic template>> inline Dynamic( Args &&... args) Dynamic Dynamic(const Dynamic &) = delete operator= Dynamic &operator=(const Dynamic &) = delete Dynamic Dynamic( Dynamic &&) noexcept = default operator= Dynamic &operator=( Dynamic &&) noexcept = default ~Dynamic ~Dynamic() override Public Static Functions classof static inline bool classof(const Type *type) Enum Enum class Enum : public LIEF::dwarf:: Type This class represents a DW_TAG_enumeration_type . Public Functions ArgsEnum template>> inline Enum( Args &&... args) Enum Enum(const Enum &) = delete operator= Enum &operator=(const Enum &) = delete Enum Enum( Enum &&) noexcept = default operator= Enum &operator=( Enum &&) noexcept = default entries std::vector< Entry > entries() const Return the different entries associated with this enum. underlying_type const Type *underlying_type() const The underlying type that is used to encode this enum. find_entry std::optional< Entry > find_entry(int64_t value) const Try to find the enum matching the given value. ~Enum ~Enum() override Public Static Functions classof static inline bool classof(const Type *type) Entry class Entry This class represents an enum entry which is essentially composed of a name and its value (integer). Public Functions Entry Entry(std::unique_ptr impl) Entry Entry( Entry &&other) noexcept operator= Entry &operator=( Entry &&other) noexcept Entry Entry(const Entry &) = delete operator= Entry &operator=(const Entry &) = delete name std::string name() const Enum entry’s name. value std::optional value() const Enum entry’s value (if any). ~Entry ~Entry() File File class File : public LIEF::dwarf:: Type This class represents a DW_TAG_file_type . Public Functions ArgsFile template>> inline File( Args &&... args) File File(const File &) = delete operator= File &operator=(const File &) = delete File File( File &&) noexcept = default operator= File &operator=( File &&) noexcept = default ~File ~File() override Public Static Functions classof static inline bool classof(const Type *type) Immutable Immutable class Immutable : public LIEF::dwarf:: Type This class represents a DW_TAG_immutable_type . Public Functions ArgsImmutable template>> inline Immutable( Args &&... args) Immutable Immutable(const Immutable &) = delete operator= Immutable &operator=(const Immutable &) = delete Immutable Immutable( Immutable &&) noexcept = default operator= Immutable &operator=( Immutable &&) noexcept = default underlying_type const Type *underlying_type() const The underlying type. operator-> inline const Type *operator->() const operator* inline const Type &operator*() const ~Immutable ~Immutable() override Public Static Functions classof static inline bool classof(const Type *type) Interface Interface class Interface : public LIEF::dwarf:: Type This class represents a DW_TAG_interface_type . Public Functions ArgsInterface template>> inline Interface( Args &&... args) Interface Interface(const Interface &) = delete operator= Interface &operator=(const Interface &) = delete Interface Interface( Interface &&) noexcept = default operator= Interface &operator=( Interface &&) noexcept = default ~Interface ~Interface() override Public Static Functions classof static inline bool classof(const Type *type) PointerToMember PointerToMember class PointerToMember : public LIEF::dwarf:: Type This class represents a DW_TAG_ptr_to_member_type . Public Functions ArgsPointerToMember template>> inline PointerToMember( Args &&... args) PointerToMember PointerToMember(const PointerToMember &) = delete operator= PointerToMember &operator=(const PointerToMember &) = delete PointerToMember PointerToMember( PointerToMember &&) noexcept = default operator= PointerToMember &operator=( PointerToMember &&) noexcept = default underlying_type const Type *underlying_type() const The type of the member referenced by this pointer. operator-> inline const Type *operator->() const operator* inline const Type *operator*() const containing_type std::unique_ptr< Type > containing_type() const The type that embeds this member. ~PointerToMember ~PointerToMember() override Public Static Functions classof static inline bool classof(const Type *type) RValueReference RValueReference class RValueReference : public LIEF::dwarf:: Type This class represents a DW_TAG_rvalue_reference_type . Public Functions ArgsRValueReference template>> inline RValueReference( Args &&... args) RValueReference RValueReference(const RValueReference &) = delete operator= RValueReference &operator=(const RValueReference &) = delete RValueReference RValueReference( RValueReference &&) noexcept = default operator= RValueReference &operator=( RValueReference &&) noexcept = default underlying_type const Type *underlying_type() const The underlying type referenced by this rvalue-type. operator-> inline const Type *operator->() const operator* inline const Type *operator*() const ~RValueReference ~RValueReference() override Public Static Functions classof static inline bool classof(const Type *type) Reference Reference class Reference : public LIEF::dwarf:: Type This class represents a DW_TAG_reference_type . Public Functions ArgsReference template>> inline Reference( Args &&... args) Reference Reference(const Reference &) = delete operator= Reference &operator=(const Reference &) = delete Reference Reference( Reference &&) noexcept = default operator= Reference &operator=( Reference &&) noexcept = default underlying_type const Type *underlying_type() const The underlying type referenced by this ref-type. operator-> inline const Type *operator->() const operator* inline const Type *operator*() const ~Reference ~Reference() override Public Static Functions classof static inline bool classof(const Type *type) Restrict Restrict class Restrict : public LIEF::dwarf:: Type This class represents a DW_TAG_restrict_type . Public Functions ArgsRestrict template>> inline Restrict( Args &&... args) Restrict Restrict(const Restrict &) = delete operator= Restrict &operator=(const Restrict &) = delete Restrict Restrict( Restrict &&) noexcept = default operator= Restrict &operator=( Restrict &&) noexcept = default underlying_type const Type *underlying_type() const The underlying type referenced by this restrict-type. operator-> inline const Type *operator->() const operator* inline const Type *operator*() const ~Restrict ~Restrict() override Public Static Functions classof static inline bool classof(const Type *type) SetTy SetTy class SetTy : public LIEF::dwarf:: Type This class represents a DW_TAG_set_type . Public Functions ArgsSetTy template>> inline SetTy( Args &&... args) SetTy SetTy(const SetTy &) = delete operator= SetTy &operator=(const SetTy &) = delete SetTy SetTy( SetTy &&) noexcept = default operator= SetTy &operator=( SetTy &&) noexcept = default underlying_type const Type *underlying_type() const The underlying type referenced by this set-type. operator-> inline const Type *operator->() const operator* inline const Type *operator*() const ~SetTy ~SetTy() override Public Static Functions classof static inline bool classof(const Type *type) Shared Shared class Shared : public LIEF::dwarf:: Type This class represents a DW_TAG_shared_type . Public Functions ArgsShared template>> inline Shared( Args &&... args) Shared Shared(const Shared &) = delete operator= Shared &operator=(const Shared &) = delete Shared Shared( Shared &&) noexcept = default operator= Shared &operator=( Shared &&) noexcept = default underlying_type const Type *underlying_type() const The underlying type referenced by this shared-type. operator-> inline const Type *operator->() const operator* inline const Type *operator*() const ~Shared ~Shared() override Public Static Functions classof static inline bool classof(const Type *type) StringTy StringTy class StringTy : public LIEF::dwarf:: Type This class represents a DW_TAG_string_type . Public Functions ArgsStringTy template>> inline StringTy( Args &&... args) StringTy StringTy(const StringTy &) = delete operator= StringTy &operator=(const StringTy &) = delete StringTy StringTy( StringTy &&) noexcept = default operator= StringTy &operator=( StringTy &&) noexcept = default ~StringTy ~StringTy() override Public Static Functions classof static inline bool classof(const Type *type) Subroutine Subroutine class Subroutine : public LIEF::dwarf:: Type This class represents a DW_TAG_subroutine_type . Public Types parameters_t using parameters_t = std::vector> Public Functions ArgsSubroutine template>> inline Subroutine( Args &&... args) Subroutine Subroutine(const Subroutine &) = delete operator= Subroutine &operator=(const Subroutine &) = delete Subroutine Subroutine( Subroutine &&) noexcept = default operator= Subroutine &operator=( Subroutine &&) noexcept = default return_type std::unique_ptr< Type > return_type() const Return the dwarf::Type associated with the return type of this function. parameters parameters_t parameters() const Parameters of this subroutine. ~Subroutine ~Subroutine() override Public Static Functions classof static inline bool classof(const Type *type) TemplateAlias TemplateAlias class TemplateAlias : public LIEF::dwarf:: Type This class represents a DW_TAG_template_alias . Public Types parameters_t using parameters_t = std::vector> Public Functions ArgsTemplateAlias template>> inline TemplateAlias( Args &&... args) TemplateAlias TemplateAlias(const TemplateAlias &) = delete operator= TemplateAlias &operator=(const TemplateAlias &) = delete TemplateAlias TemplateAlias( TemplateAlias &&) noexcept = default operator= TemplateAlias &operator=( TemplateAlias &&) noexcept = default underlying_type const Type *underlying_type() const The underlying type aliased by this type. operator-> inline const Type *operator->() const operator* inline const Type &operator*() const parameters parameters_t parameters() const Parameters associated with the underlying template. ~TemplateAlias ~TemplateAlias() override Public Static Functions classof static inline bool classof(const Type *type) Thrown Thrown class Thrown : public LIEF::dwarf:: Type This class represents a DW_TAG_thrown_type . Public Functions ArgsThrown template>> inline Thrown( Args &&... args) Thrown Thrown(const Thrown &) = delete operator= Thrown &operator=(const Thrown &) = delete Thrown Thrown( Thrown &&) noexcept = default operator= Thrown &operator=( Thrown &&) noexcept = default underlying_type const Type *underlying_type() const The underlying type being thrown. operator-> inline const Type *operator->() const operator* inline const Type &operator*() const ~Thrown ~Thrown() override Public Static Functions classof static inline bool classof(const Type *type) Volatile Volatile class Volatile : public LIEF::dwarf:: Type This class represents a DW_TAG_volatile_type . Public Functions ArgsVolatile template>> inline Volatile( Args &&... args) Volatile Volatile(const Volatile &) = delete operator= Volatile &operator=(const Volatile &) = delete Volatile Volatile( Volatile &&) noexcept = default operator= Volatile &operator=( Volatile &&) noexcept = default underlying_type const Type *underlying_type() const The underlying type. operator-> inline const Type *operator->() const operator* inline const Type &operator*() const ~Volatile ~Volatile() override Public Static Functions classof static inline bool classof(const Type *type) Editor Editor class Editor This class exposes the main API to create DWARF information. Public Types FORMAT enum class FORMAT : uint32_t Values: ELF enumerator ELF MACHO enumerator MACHO PE enumerator PE ARCH enum class ARCH : uint32_t Values: UNKNOWN enumerator UNKNOWN X64 enumerator X64 X86 enumerator X86 AARCH64 enumerator AARCH64 ARM enumerator ARM Public Functions Editor Editor() = delete Editor Editor(std::unique_ptr impl) create_compilation_unit std::unique_ptr create_compilation_unit() Create a new compilation unit. write void write(const std::string &output) Write the DWARF file to the specified output. ~Editor ~Editor() Public Static Functions from_binary static std::unique_ptr< Editor > from_binary(LIEF:: Binary &bin) Instantiate an editor for the given binary object. create static std::unique_ptr< Editor > create( FORMAT fmt, ARCH arch) Instantiate an editor for the given format and arch. Editor - CompilationUnit CompilationUnit class CompilationUnit This class represents an editable DWARF compilation unit. Public Functions CompilationUnit CompilationUnit() = delete CompilationUnit CompilationUnit(std::unique_ptr impl) set_producer CompilationUnit &set_producer(const std::string &producer) Set the DW_AT_producer producer attribute. This attribute aims to inform about the program that generated this compilation unit (e.g. LIEF Extended ) create_function std::unique_ptr< Function > create_function(const std::string &name) Create a new function owned by this compilation unit. create_variable std::unique_ptr< Variable > create_variable(const std::string &name) Create a new global variable owned by this compilation unit. create_generic_type std::unique_ptr< Type > create_generic_type(const std::string &name) Create a DW_TAG_unspecified_type type with the given name. create_enum std::unique_ptr< EnumType > create_enum(const std::string &name) Create an enum type ( DW_TAG_enumeration_type ). create_typedef std::unique_ptr< TypeDef > create_typedef(const std::string &name, const Type &type) Create a typedef with the name provided in the first parameter which aliases the type provided in the second parameter. create_structure std::unique_ptr< StructType > create_structure(const std::string &name, StructType :: TYPE kind = StructType :: TYPE :: STRUCT ) Create a struct-like type (struct, class, union) with the given name. create_base_type std::unique_ptr< BaseType > create_base_type(const std::string &name, size_t size, BaseType :: ENCODING encoding = BaseType :: ENCODING :: NONE ) Create a primitive type with the given name and size. create_function_type std::unique_ptr< FunctionType > create_function_type(const std::string &name) Create a function type with the given name. create_pointer_type inline std::unique_ptr< PointerType > create_pointer_type(const Type &ty) Create a pointer on the provided type. create_void_type std::unique_ptr< Type > create_void_type() Create a void type. create_array std::unique_ptr< ArrayType > create_array(const std::string &name, const Type &type, size_t count) Create an array type with the given name, type and size. ~CompilationUnit ~CompilationUnit() Editor - Function Function class Function This class represents an editable DWARF function ( DW_TAG_subprogram ). Public Functions Function Function() = delete Function Function(std::unique_ptr impl) set_address Function &set_address(uint64_t addr) Set the address of this function by defining DW_AT_entry_pc . set_low_high Function &set_low_high(uint64_t low, uint64_t high) Set the upper and lower bound addresses for this function. This assumes that the function is contiguous between low and high . Underneath, the function defines DW_AT_low_pc and DW_AT_high_pc set_ranges Function &set_ranges(const std::vector< range_t > &ranges) Set the ranges of addresses owned by the implementation of this function by setting the DW_AT_ranges attribute. This setter should be used for non-contiguous functions. set_external Function &set_external() Set the function as external by defining DW_AT_external to true. This means that the function is imported by the current compilation unit. set_return_type Function &set_return_type(const Type &type) Set the return type of this function. add_parameter std::unique_ptr< Parameter > add_parameter(const std::string &name, const Type &type) Add a parameter to the current function. create_stack_variable std::unique_ptr< Variable > create_stack_variable(const std::string &name) Create a stack-based variable owned by the current function. add_lexical_block std::unique_ptr< LexicalBlock > add_lexical_block(uint64_t start, uint64_t end) Add a lexical block with the given range. add_label std::unique_ptr< Label > add_label(uint64_t addr, const std::string &label) Add a label at the given address. add_description Function &add_description(const std::string &description) Create a DW_AT_description entry with the description provided in parameter. ~Function ~Function() range_t struct range_t Public Functions range_t range_t() = default range_t inline range_t(uint64_t start, uint64_t end) Public Members start uint64_t start = 0 end uint64_t end = 0 Parameter class Parameter This class represents a parameter of the current function ( DW_TAG_formal_parameter ). Public Functions Parameter Parameter() = delete Parameter Parameter(std::unique_ptr impl) ~Parameter ~Parameter() assign_register Parameter &assign_register(const std::string &name) Assign this parameter to a specific named register. assign_register Parameter &assign_register(uint64_t reg) Assign this parameter to the given DWARF register id (e.g. DW_OP_reg0 ). LexicalBlock class LexicalBlock This class mirrors the DW_TAG_lexical_block DWARF tag. Public Functions LexicalBlock LexicalBlock() = delete LexicalBlock LexicalBlock(std::unique_ptr impl) add_block std::unique_ptr< LexicalBlock > add_block(uint64_t start, uint64_t end) Create a sub-block with the given low/high addresses. add_block std::unique_ptr< LexicalBlock > add_block(const std::vector< range_t > &range) Create a sub-block with the given range of addresses. add_description LexicalBlock &add_description(const std::string &description) Create a DW_AT_description entry with the description provided in parameter. add_name LexicalBlock &add_name(const std::string &name) Create a DW_AT_name entry to associate a name to this entry. ~LexicalBlock ~LexicalBlock() Label class Label This class mirrors the DW_TAG_label DWARF tag. Public Functions Label Label() = delete Label Label(std::unique_ptr impl) ~Label ~Label() Editor - Variable Variable class Variable This class represents an editable DWARF variable which can be scoped by a function or a compilation unit ( DW_TAG_variable ). Public Functions Variable Variable() = delete Variable Variable(std::unique_ptr impl) set_addr Variable &set_addr(uint64_t address) Set the global address of this variable. Setting this address is only relevant in the case of a static global variable. For stack variable, you should use set_stack_offset. This function sets the DW_AT_location attribute set_stack_offset Variable &set_stack_offset(uint64_t offset) Set the stack offset of this variable. This function sets the DW_AT_location attribute set_external Variable &set_external() Mark this variable as imported . set_type Variable &set_type(const Type &type) Set the type of the current variable. add_description Variable &add_description(const std::string &description) Create a DW_AT_description entry with the description provided in parameter. ~Variable ~Variable() Editor - Type Type class Type This class is the base class for any types created when editing DWARF debug info. A type is owned by a LIEF::dwarf::editor::CompilationUnit and should be created from this class. Subclassed by LIEF::dwarf::editor::ArrayType , LIEF::dwarf::editor::BaseType , LIEF::dwarf::editor::EnumType , LIEF::dwarf::editor::FunctionType , LIEF::dwarf::editor::PointerType , LIEF::dwarf::editor::StructType , LIEF::dwarf::editor::TypeDef Public Functions Type Type() = delete Type Type(std::unique_ptr impl) pointer_to std::unique_ptr< PointerType > pointer_to() const Create a pointer type pointing to this type. ~Type virtual ~Type() impl inline const details::Type &impl() const Editor - PointerType PointerType class PointerType : public LIEF::dwarf::editor:: Type This class represents a pointer to another type. Public Functions ArgsPointerType template>> inline PointerType( Args &&... args) ~PointerType ~PointerType() override = default Public Static Functions classof static bool classof(const Type *type) Editor - EnumType EnumType class EnumType : public LIEF::dwarf::editor:: Type This class represents an editable enum type ( DW_TAG_enumeration_type ). Public Functions ArgsEnumType template>> inline EnumType( Args &&... args) set_size EnumType &set_size(uint64_t size) Define the number of bytes required to hold an instance of the enumeration ( DW_AT_byte_size ). set_underlying_type EnumType &set_underlying_type(const Type &type) Set the underlying type that is used to encode this enum. add_value std::unique_ptr< Value > add_value(const std::string &name, int64_t value) Add an enum value by specifying its name and its integer value. ~EnumType ~EnumType() override = default Public Static Functions classof static bool classof(const Type *type) Value class Value This class represents an enum value. Public Functions Value Value() = delete Value Value(std::unique_ptr impl) ~Value ~Value() Editor - BaseType BaseType class BaseType : public LIEF::dwarf::editor:: Type This class represents a primitive type like int, char . Public Types ENCODING enum class ENCODING : uint32_t Values: NONE enumerator NONE = 0 ADDRESS enumerator ADDRESS SIGNED enumerator SIGNED SIGNED_CHAR enumerator SIGNED_CHAR UNSIGNED enumerator UNSIGNED UNSIGNED_CHAR enumerator UNSIGNED_CHAR BOOLEAN enumerator BOOLEAN FLOAT enumerator FLOAT Public Functions ArgsBaseType template>> inline BaseType( Args &&... args) ~BaseType ~BaseType() override = default Public Static Functions classof static bool classof(const Type *type) Editor - ArrayType ArrayType class ArrayType : public LIEF::dwarf::editor:: Type This class represents an array type ( DW_TAG_array_type ). Public Functions ArgsArrayType template>> inline ArrayType( Args &&... args) ~ArrayType ~ArrayType() override = default Public Static Functions classof static bool classof(const Type *type) Editor - FunctionType FunctionType class FunctionType : public LIEF::dwarf::editor:: Type This class represents a function type ( DW_TAG_subroutine_type ). Public Functions ArgsFunctionType template>> inline FunctionType( Args &&... args) set_return_type FunctionType &set_return_type(const Type &type) Set the return type of this function. add_parameter std::unique_ptr< Parameter > add_parameter(const Type &type) Add a parameter. ~FunctionType ~FunctionType() override = default Public Static Functions classof static bool classof(const Type *type) Parameter class Parameter This class represents a function’s parameter. Public Functions Parameter Parameter() = delete Parameter Parameter(std::unique_ptr impl) ~Parameter ~Parameter() Editor - TypeDef TypeDef class TypeDef : public LIEF::dwarf::editor:: Type This class represents a typedef ( DW_TAG_typedef ). Public Functions ArgsTypeDef template>> inline TypeDef( Args &&... args) ~TypeDef ~TypeDef() override = default Public Static Functions classof static bool classof(const Type *type) Editor - StructType StructType class StructType : public LIEF::dwarf::editor:: Type This class represents a struct-like type which can be: DW_TAG_class_type DW_TAG_structure_type DW_TAG_union_type Public Types TYPE enum class TYPE : uint32_t Values: CLASS enumerator CLASS STRUCT enumerator STRUCT Discriminant for DW_TAG_class_type . UNION enumerator UNION Discriminant for DW_TAG_structure_type . Public Functions ArgsStructType template>> inline StructType( Args &&... args) set_size StructType &set_size(uint64_t size) Define the overall size which is equivalent to the sizeof of the current type. This function defines the DW_AT_byte_size attribute add_member std::unique_ptr< Member > add_member(const std::string &name, const Type &type, int64_t offset = -1) Adds a member to the current struct-like. add_bitfield std::unique_ptr< Member > add_bitfield(const std::string &name, const Type &type, uint64_t bitsize, int64_t bitoffset = -1) Adds a bitfield member to the current structure. ~StructType ~StructType() override = default Public Static Functions classof static bool classof(const Type *type) Member class Member This class represents a member of the struct-like. Public Functions Member Member() = delete Member Member(std::unique_ptr impl) ~Member ~Member()", "contentHash": "c2c73cbab50486b66d0114509bee2fab89d21a848b51a755fedc6efc50eb6bdf", "description": "DWARF C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "extended/dwarf/cpp", "documentID": "97df546bf02b908886d651fe6e934050dbee923b4228827a1a017f2af1b18117", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/dwarf/cpp.md", "title": "DWARF C++ API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/dwarf/index.html", "content": "DWARF API C++ Python Rust Introduction LIEF Extended can read DWARF functions, variables, types, and source locations, generate C/C++ declarations, and create new debug files. DWARF debug information can be embedded in a binary or stored in a separate file. To inspect compiler-generated DWARF, build with debug information and preserve it when stripping the binary. Debug files can also be generated from analysis results with the DWARF editor . For an overview of loading and associating debug files, see Debug Information . Load and inspect DWARF When DWARF debug information is embedded within the binary, you can access it using the lief.Binary.debug_info() ( lief::elf::Binary::debug_info ; lief.Binary.debug_info ; LIEF::Binary::debug_info() ) attribute. This attribute returns a lief.dwarf.DebugInfo ( lief::dwarf::DebugInfo ; lief.dwarf.DebugInfo ; LIEF::dwarf::DebugInfo ) object: Python import lief elf = lief.ELF.parse(\"/bin/with_debug\") if debug_info := elf.debug_info: assert isinstance(debug_info, lief.dwarf.DebugInfo) print(f\"DWARF Debug handler: {debug_info}\") C++ auto elf = LIEF::ELF::Parser::parse(\"/bin/with_debug\"); if (const LIEF::DebugInfo* info = elf->debug_info()) { assert(LIEF::dwarf::DebugInfo::classof(info) && \"Wrong debug type\"); const auto& dwarf_dbg = static_cast(*info); } Rust let elf = lief::elf::Binary::parse(\"/bin/ls\").unwrap(); if let Some(lief::DebugInfo::Dwarf(dwarf)) = elf.debug_info() { // DWARF debug info } Additionally, the lief.dwarf.load() ( lief::dwarf::load ; lief.dwarf.load() ; LIEF::dwarf::load() ) function can be used to load a DWARF file, whether it is embedded or standalone: Python import lief dbg: lief.dwarf.DebugInfo | None = lief.dwarf.load(\"/bin/with_debug\") dbg: lief.dwarf.DebugInfo | None = lief.dwarf.load(\"external_dwarf\") dbg: lief.dwarf.DebugInfo | None = lief.dwarf.load(\"debug.dwo\") C++ auto dbg = LIEF::dwarf::load(\"/bin/with_debug\"); dbg = LIEF::dwarf::load(\"external_dwarf\"); dbg = LIEF::dwarf::load(\"debug.dwo\"); Rust let dbg = lief::dwarf::load(\"/bin/with_debug\"); let dbg = lief::dwarf::load(\"external_dwarf\"); let dbg = lief::dwarf::load(\"debug.dwo\"); For a macOS .dSYM bundle, pass the path to the DWARF object inside Contents/Resources/DWARF/ . Check the loader’s return value before accessing compilation units or searching for a function or type. Once loaded, you can use the lief.dwarf.DebugInfo ( lief::dwarf::DebugInfo ; lief.dwarf.DebugInfo ; LIEF::dwarf::DebugInfo ) API to interact with the debug information: Python dbg: lief.dwarf.DebugInfo for compilation_unit in dbg.compilation_units: print(compilation_unit.producer) for func in compilation_unit.functions: print(func.name, func.linkage_name, func.address) for var in compilation_unit.variables: print(var.name, var.address) for ty in compilation_unit.types: print(ty.name, ty.size) dbg.find_function(\"_ZNSi4peekEv\") dbg.find_function(\"std::basic_istream >::peek()\") dbg.find_function(0x137A70) dbg.find_variable(\"_ZNSt12out_of_rangeC1EPKc\") dbg.find_variable(\"std::out_of_range::out_of_range(char const*)\") dbg.find_variable(0x2773A0) dbg.find_type(\"my_type_t\") C++ std::unique_ptr dbg; for (const LIEF::dwarf::CompilationUnit& CU : dbg->compilation_units()) { log(Level::Info, \"Producer: {}\", CU.producer()); for (const LIEF::dwarf::Function& func : CU.functions()) { log(Level::Info, \"name={}, linkage={}, address={}\", func.name(), func.linkage_name(), std::to_string(func.address().value_or(0))); } for (const LIEF::dwarf::Variable& var : CU.variables()) { log(Level::Info, \"name={}, address={}\", var.name(), std::to_string(var.address().value_or(0))); } for (const LIEF::dwarf::Type& ty : CU.types()) { log(Level::Info, \"name={}, size={}\", ty.name().value_or(\"\"), std::to_string(ty.size().value_or(0))); } } dbg->find_function(\"_ZNSi4peekEv\"); dbg->find_function(\"std::basic_istream >::peek()\"); dbg->find_function(0x137a70); dbg->find_variable(\"_ZNSt12out_of_rangeC1EPKc\"); dbg->find_variable(\"std::out_of_range::out_of_range(char const*)\"); dbg->find_variable(0x2773a0); Rust let path: &Path = some_path; let dbg = lief::dwarf::load(path).unwrap_or_else(|| { process::exit(1); }); for cu in dbg.compilation_units() { println!(\"Producer: {}\", cu.producer()); for func in cu.functions() { println!( \"name={}, linkage={}, address={}\", func.name(), func.linkage_name(), func.address().unwrap_or(0) ); } for var in cu.variables() { println!( \"name={}, address={}\", var.name(), var.address().unwrap_or(0) ); } for ty in cu.types() { println!( \"name={}, size={}\", ty.name().unwrap_or(\"\".to_string()), ty.size().unwrap_or(0) ); } } dbg.function_by_name(\"_ZNSi4peekEv\"); dbg.function_by_name(\"std::basic_istream >::peek()\"); dbg.function_by_addr(0x137a70); dbg.variable_by_name(\"_ZNSt12out_of_rangeC1EPKc\"); dbg.variable_by_name(\"std::out_of_range::out_of_range(char const*)\"); dbg.variable_by_addr(0x137a70); Attach an external debug file In the case of an external DWARF file, you can bind this debug file to a lief.abstract.Binary ( lief::generic::Binary ; lief.Binary ; LIEF::Binary ) using the lief.abstract.Binary.load_debug_info() ( lief::generic::Binary::load_debug_info ; lief.Binary.load_debug_info() ; LIEF::Binary::load_debug_info() ) function. Here’s an example: Python binary: lief.Binary dbg = binary.load_debug_info(\"/home/romain/dev/LIEF/some.dwo\") C++ std::unique_ptr binary; binary->load_debug_info(\"/home/romain/dev/LIEF/some.dwo\"); Rust let bin: &mut dyn lief::generic::Binary = some_bin; let path = PathBuf::from(\"/home/romain/dev/LIEF/some.dwo\"); bin.load_debug_info(&path); Use a debug file produced by the same build as the binary. Attaching it updates LIEF’s analysis object. It does not insert DWARF sections into the executable. The lief.Binary.disassemble() ( lief::generic::Binary::disassemble ; lief::generic::Binary::disassemble_symbol ; lief::generic::Binary::disassemble_address ; lief::generic::Binary::disassemble_slice ; LIEF::Binary::disassemble() ; lief.Binary.disassemble() ; lief.Binary.disassemble_from_bytes() ) function can then resolve functions defined by that debug file while reading their machine code from the binary: Python binary: lief.Binary binary.load_debug_info(\"/home/romain/dev/LIEF/some.dwo\") # The location (address/size) of `my_function` is defined in some.dwo for inst in binary.disassemble(\"my_function\"): print(inst) C++ std::unique_ptr binary; binary->load_debug_info(\"/home/romain/dev/LIEF/some.dwo\"); // The location (address/size) of `my_function` is defined in some.dwo for (const LIEF::assembly::Instruction& inst : binary->disassemble(\"my_function\")) { std::cout << inst << '\\n'; } Rust let bin: &mut dyn lief::generic::Binary = some_bin; let path = PathBuf::from(\"/home/romain/dev/LIEF/some.dwo\"); bin.load_debug_info(&path); // The location (address/size) of `my_function` is defined in some.dwo for inst in bin.disassemble_symbol(\"my_function\") { println!(\"{inst}\"); } Additionally, you may also want to explore the BinaryNinja and Ghidra DWARF export plugins, which generate debug information based on the analysis performed by these frameworks. Generating C/C++ Definitions DWARF functions, variables, types, and compilation units can be rendered as C/C++ declarations using: lief.dwarf.Function.to_decl() ( lief::dwarf::Function::to_decl ; lief::dwarf::Function::to_decl_with_opt ; lief.dwarf.Function.to_decl() ; LIEF::dwarf::Function::to_decl() ) lief.dwarf.Variable.to_decl() ( lief::dwarf::Variable::to_decl ; lief::dwarf::Variable::to_decl_with_opt ; lief.dwarf.Variable.to_decl() ; LIEF::dwarf::Variable::to_decl() ) lief.dwarf.Type.to_decl() ( lief::dwarf::Type::to_decl ; lief::dwarf::Type::to_decl_with_opt ; lief.dwarf.Type.to_decl() ; LIEF::dwarf::Type::to_decl() ) lief.dwarf.CompilationUnit.to_decl() ( lief::dwarf::CompilationUnit::to_decl ; lief::dwarf::CompilationUnit::to_decl_with_opt ; lief.dwarf.CompilationUnit.to_decl() ; LIEF::dwarf::CompilationUnit::to_decl() ) The generated output can be configured with a lief.DeclOpt ( lief::DeclOpt ; lief.DeclOpt ; LIEF::DeclOpt ) structure (e.g. to prefer C++ syntax or change the indentation): Python dbg = lief.dwarf.load(\"/bin/with_debug\") func = dbg.find_function(\"main\") print(func.to_decl()) opt = lief.DeclOpt() opt.is_cpp = True opt.indentation = 4 for cu in dbg.compilation_units: # Emit the definition of the functions of the compilation unit print(cu.to_decl(opt)) C++ auto dbg = LIEF::dwarf::load(\"/bin/with_debug\"); std::unique_ptr func = dbg->find_function(\"main\"); std::cout << func->to_decl() << '\\n'; LIEF::DeclOpt opt; opt.is_cpp(true).indentation(4); for (const LIEF::dwarf::CompilationUnit& CU : dbg->compilation_units()) { std::cout << CU.to_decl(opt) << '\\n'; } Rust let dbg = lief::dwarf::load(\"/bin/with_debug\").unwrap(); if let Some(func) = dbg.function_by_name(\"main\") { println!(\"{}\", func.to_decl()); } let opt = lief::DeclOpt { is_cpp: true, indentation: 4, ..Default::default() }; for cu in dbg.compilation_units() { println!(\"{}\", cu.to_decl_with_opt(&opt)); } DWARF Editor Editing Existing DWARF LIEF does not currently support modifying an existing DWARF file. LIEF provides a comprehensive high-level API for programmatically creating DWARF files. This works by using the lief.dwarf.Editor ( lief::dwarf::Editor ; lief.dwarf.Editor ; LIEF::dwarf::Editor ) interface, which can be instantiated using lief.dwarf.Editor.from_binary() ( lief::dwarf::Editor::from_binary ; LIEF::dwarf::Editor::from_binary() ; lief.dwarf.Editor.from_binary() ): Python pe = lief.PE.parse(\"demo.exe\") assert isinstance(pe, lief.PE.Binary) editor = lief.dwarf.Editor.from_binary(pe) C++ std::unique_ptr pe = LIEF::PE::Parser::parse(\"demo.exe\"); std::unique_ptr editor = LIEF::dwarf::Editor::from_binary(*pe); Rust let path: &Path = some_path; let mut bin = lief::pe::Binary::parse(path).unwrap(); let editor = lief::dwarf::Editor::from_binary(&mut bin); Given this lief.dwarf.Editor ( lief::dwarf::Editor ; lief.dwarf.Editor ; LIEF::dwarf::Editor ), you can create one or more lief.dwarf.editor.CompilationUnit ( lief::dwarf::editor::CompilationUnit ; lief.dwarf.editor.CompilationUnit ; LIEF::dwarf::editor::CompilationUnit ) entries, which own various lief.dwarf.editor.Function ( lief::dwarf::editor::Function ; lief.dwarf.editor.Function ; LIEF::dwarf::editor::Function ), lief.dwarf.editor.Variable ( lief::dwarf::editor::Variable ; lief.dwarf.editor.Variable ; LIEF::dwarf::editor::Variable ), and lief.dwarf.editor.Type ( lief::dwarf::editor::Type ; lief.dwarf.editor.Type ; LIEF::dwarf::editor::Type ) objects. Python editor: lief.dwarf.Editor unit = editor.create_compilation_unit() unit.set_producer(\"LIEF\") func = unit.create_function(\"hello\") func.set_address(0x123) struct_ptr = unit.create_structure(\"my_struct_t\").pointer_to() assert isinstance(struct_ptr, lief.dwarf.editor.PointerType) func.set_return_type(struct_ptr) var = func.create_stack_variable(\"local_var\") var.set_stack_offset(8) editor.write(\"/tmp/out.debug\") C++ std::unique_ptr editor; std::unique_ptr unit = editor->create_compilation_unit(); unit->set_producer(\"LIEF\"); std::unique_ptr func = unit->create_function(\"hello\"); func->set_address(0x123); func->set_return_type(*unit->create_structure(\"my_struct_t\")->pointer_to()); std::unique_ptr var = func->create_stack_variable(\"local_var\"); var->set_stack_offset(8); editor->write(\"/tmp/out.debug\"); Rust let editor: &mut lief::dwarf::Editor = some_editor; let mut unit = editor.create_compile_unit().unwrap(); unit.set_producer(\"LIEF\"); let mut func = unit.create_function(\"hello\").unwrap(); func.set_address(0x123); func.set_return_type(&unit.create_structure(\"my_struct_t\").pointer_to()); let mut var = func.create_stack_variable(\"local_var\"); var.set_stack_offset(8); editor.write(\"/tmp/out.debug\"); BinaryNinja & Ghidra This feature is provided as a plugin for BinaryNinja and Ghidra . API You can find the documentation of the API for the different languages here: Python API C++ API Rust API: lief::dwarf", "contentHash": "f0da595676a3dfd37893771704221931388714de01a4889dab140800095932cd", "description": "Read DWARF functions, types, and variables, attach external debug files, generate declarations, and create new DWARF files with LIEF Extended.", "docname": "extended/dwarf/index", "documentID": "d2dc67f9f86c5bb7c87fd836dc62abba63943066801fe3a19ccdbfcf55739c93", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/dwarf/index.md", "title": "DWARF - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/dwarf/python.html", "content": "Python lief.dwarf.load lief.dwarf.load( path: str | os.PathLike ) → lief.dwarf.DebugInfo | None Load the DWARF from the given path DebugInfo lief.dwarf.DebugInfo class lief.dwarf.DebugInfo Bases: DebugInfo This class represents a DWARF debug information. It can embed different compilation units which can be accessed through compilation_units . This class can be instantiated from lief.Binary.debug_info or lief.dwarf.load() compilation_units property compilation_units → Iterator[ lief.dwarf.CompilationUnit | None] Iterator on the CompilationUnit embedded in this dwarf find_functionfind_function find_function( self , name: str ) → lief._lief.dwarf.Function | None find_function( self , addr: int ) → lief._lief.dwarf.Function | None Overloaded function. find_function(self, name: str) -> Optional[lief._lief.dwarf.Function] Try to find the function with the given name (mangled or not) info: lief.dwarf.DebugInfo = ... if func := info.find_function(\"_ZNSt6localeD1Ev\"): print(\"Found\") if func := info.find_function(\"std::locale::~locale()\"): print(\"Found\") find_function(self, addr: int) -> Optional[lief._lief.dwarf.Function] Try to find the function at the given virtual address. find_type find_type( self , name: str ) → lief._lief.dwarf.Type | None Try to find the type with the given name. find_variablefind_variable find_variable( self , addr: int ) → lief._lief.dwarf.Variable | None find_variable( self , name: str ) → lief._lief.dwarf.Variable | None Overloaded function. find_variable(self, addr: int) -> Optional[lief._lief.dwarf.Variable] Try to find the (static) variable at the given virtual address. find_variable(self, name: str) -> Optional[lief._lief.dwarf.Variable] Try to find the variable with the given name. This name can be mangled or not. CompilationUnit lief.dwarf.CompilationUnit class lief.dwarf.CompilationUnit Bases: object This class represents a DWARF compilation unit Language class Language Bases: object Languages supported by the DWARF (v5) format. See: https://dwarfstd.org/languages.html Some languages (like C++11, C++17, ..) have a version (11, 17, …) which is stored in a dedicated attribute: version LANG class LANG( *values ) Bases: Enum C C = 1 COBOL COBOL = 10 CPP CPP = 2 D D = 8 DART DART = 4 FORTRAN FORTRAN = 6 JAVA JAVA = 9 MODULA MODULA = 5 RUST RUST = 3 SWIFT SWIFT = 7 UNKNOWN UNKNOWN = 0 from_value from_value( arg: int ) → lief.dwarf.CompilationUnit.Language.LANG = lang property lang → lief.dwarf.CompilationUnit.Language.LANG The language itself version property version → int Version of the language (e.g. 17 for C++17) compilation_dir property compilation_dir → str Return the path to the directory in which the compilation took place for compiling this compilation unit (e.g. /workdir/build ) It returns an empty string if the entry is not present or can’t be resolved. This value matches the DW_AT_comp_dir attribute. find_functionfind_function find_function( self , name: str ) → lief._lief.dwarf.Function | None find_function( self , addr: int ) → lief._lief.dwarf.Function | None Overloaded function. find_function(self, name: str) -> Optional[lief._lief.dwarf.Function] Try to find the function whose name is given in parameter. The provided name can be demangled. find_function(self, addr: int) -> Optional[lief._lief.dwarf.Function] Try to find the function at the given address find_variablefind_variable find_variable( self , addr: int ) → lief._lief.dwarf.Variable | None find_variable( self , name: str ) → lief._lief.dwarf.Variable | None Overloaded function. find_variable(self, addr: int) -> Optional[lief._lief.dwarf.Variable] Try to find the variable at the given address find_variable(self, name: str) -> Optional[lief._lief.dwarf.Variable] Try to find the variable with the given name (mangled or not) functions property functions → Iterator[ lief.dwarf.Function | None] Return an iterator over the functions implemented in this compilation unit. Note that this iterator only iterates over the functions that have a concrete implementation in the compilation unit. For instance with this code: inline const char* get_secret_env() { return getenv(\"MY_SECRET_ENV\"); } int main() { printf(\"%s\", get_secret_env()); return 0; } The iterator will only return one function for main since get_secret_env is inlined and thus, its implementation is located in main . high_address property high_address → int Return the highest virtual address owned by this compilation unit imported_functions property imported_functions → Iterator[ lief.dwarf.Function | None] Return an iterator over the functions imported in this compilation unit but not implemented. For instance with this code: #include int main() { printf(\"Hello\\n\"); return 0; } printf is imported from the standard libc so the function is returned by the iterator. On the other hand, main() is implemented in this compilation unit so it is not returned by imported_functions but functions . language property language → lief.dwarf.CompilationUnit.Language Original language of this compilation unit. This value matches the DW_AT_language attribute. low_address property low_address → int Return the lowest virtual address owned by this compilation unit. name property name → str Name of the file associated with this compilation unit (e.g. test.cpp ) Return an empty string if the name is not found or can’t be resolved This value matches the DW_AT_name attribute. producer property producer → str Information about the program (or library) that generated this compilation unit. For instance, it can output: Debian clang version 17.0.6 . It returns an empty string if the producer is not present or can’t be resolved. This value matches the DW_AT_producer attribute. ranges property ranges → list[lief.range_t] Return a list of address ranges owned by this compilation unit. If the compilation unit owns a contiguous range, it returns a single range. size property size → int Return the size of the compilation unit according to its range of address. If the compilation is fragmented (i.e. there are some address ranges between the lowest address and the highest that are not owned by the CU), then it returns the sum of all the address ranges owned by this CU. If the compilation unit is not fragmented, then it basically returns high_address - low_address . to_decl to_decl( self , opt: lief._lief.DeclOpt | None = None ) → str Generates a C/C++ definition for the functions defined in this compilation unit types property types → Iterator[ lief.dwarf.Type | None] Return an iterator over the different types defined in this compilation unit. variables property variables → Iterator[ lief.dwarf.Variable | None] Return an iterator over the variables defined in any scope of this compilation unit: static int A = 1; // Returned by the iterator static const char* B = \"Hello\"; // Returned by the iterator int get() { static int C = 2; // Returned by the iterator return C; } Function lief.dwarf.Function class lief.dwarf.Function Bases: object This class represents a DWARF function which can be associated with either: DW_TAG_subprogram or DW_TAG_inlined_subroutine . address property address → int | None Return the address of the function ( DW_AT_entry_pc or DW_AT_low_pc ) or None if it’s not available. debug_location property debug_location → lief.debug_location_t Original source code location. description property description → str Description ( DW_AT_description ) of this function or an empty string instructions property instructions → Iterator[ lief.assembly.Instruction | None] Disassemble the current function by returning an iterator over the lief.assembly.Instruction . is_artificial property is_artificial → bool Whether this function is created by the compiler and not present in the original source code. is_external property is_external → bool Whether the function is defined outside the current compilation unit ( DW_AT_external ). lexical_blocks property lexical_blocks → Iterator[ lief.dwarf.LexicalBlock | None] Iterator over the LexicalBlock owned by this function linkage_name property linkage_name → str The name of the function which is used for linking (DW_AT_linkage_name). This name differs from name as it is usually mangled. The function returns an empty string if the linkage name is not available. name property name → str The name of the function ( DW_AT_name ) parameters property parameters → list[ lief.dwarf.Parameter | None] Return the list of parameters used by this function (including template parameters) ranges property ranges → list[lief.range_t] Ranges of virtual addresses owned by this function. scope property scope → lief.dwarf.Scope | None Scope in which this function is defined size property size → int Return the size taken by this function in the binary. thrown_types property thrown_types → list[ lief.dwarf.Type | None] List of exceptions (types) that can be thrown by the function. For instance, given this Swift code: func summarize(_ ratings: [Int]) throws(StatisticsError) { // ... } thrown_types returns one element associated with the Type : StatisticsError . to_decl to_decl( self , opt: lief._lief.DeclOpt | None = None ) → str Generates a C/C++ definition for this function type property type → lief.dwarf.Type | None Return the Type associated with the return type of this function variables property variables → Iterator[ lief.dwarf.Variable | None] Return an iterator over the variables ( DW_TAG_variable ) defined within the scope of this function. This includes regular stack-based variables as well as static ones. Parameter lief.dwarf.Parameter class lief.dwarf.Parameter Bases: object This class represents a DWARF parameter which can be either: - A regular function parameter (see: parameters.Formal ) - A template type parameter (see: parameters.TemplateType ) - A template value parameter (see: parameters.TemplateValue ) Location class Location Bases: object This class exposes information about the location of a parameter Type class Type( *values ) Bases: Enum REGISTER REGISTER = 1 UNKNOWN UNKNOWN = 0 type property type → lief.dwarf.Parameter.Location.Type RegisterLoc class RegisterLoc Bases: Location This class represents a register location id property id → int DWARF id of the register location property location → lief.dwarf.Parameter.Location | None Location of this parameter. For instance it can be a specific register that is not following the calling convention. name property name → str Name of the parameter type property type → lief.dwarf.Type | None Type of this parameter Formal Parameter lief.dwarf.parameters.Formal class lief.dwarf.parameters.Formal Bases: Parameter This class represents a regular function parameter. For instance, given this prototype: int main(int argc, const char** argv); The function main has two Formal parameters: argc ( lief.dwarf.Parameter.name ) typed as int ( Base from lief.dwarf.Parameter.type ) argv ( lief.dwarf.Parameter.name ) typed as const char** ( Const ) type property type → lief.dwarf.Type | None Template Value Parameter lief.dwarf.parameters.TemplateValue class lief.dwarf.parameters.TemplateValue Bases: Parameter This class represents a template value parameter. For instance, given this prototype: template void generic(); The function generic has one TemplateValue parameter: X Template Type Parameter lief.dwarf.parameters.TemplateType class lief.dwarf.parameters.TemplateType Bases: Parameter This class represents a template type parameter. For instance, given this prototype: template void generic(); The function generic has one TemplateType parameter: Y Scope lief.dwarf.Scope class lief.dwarf.Scope Bases: object This class materializes a scope in which Function , Variable , Type , … can be defined. TYPE class TYPE( *values ) Bases: Enum CLASS CLASS = 2 COMPILATION_UNIT COMPILATION_UNIT = 6 FUNCTION FUNCTION = 5 NAMESPACE NAMESPACE = 4 STRUCT STRUCT = 3 UNION UNION = 1 UNKNOWN UNKNOWN = 0 chained chained( self , sep: str = '::' ) → str Represent the whole chain of all (parent) scopes using the provided separator. E.g. ns1::ns2::Class1::Struct2::Type . name property name → str Name of the scope. For instance namespace’s name or function’s name. parent property parent → lief.dwarf.Scope | None Parent scope (if any). type property type → lief.dwarf.Scope.TYPE The current scope type. Variable lief.dwarf.Variable class lief.dwarf.Variable Bases: object This class represents a DWARF variable which can be owned by a Function or a CompilationUnit . address property address → int | None Address of the variable. If the variable is static , it returns the virtual address where it is defined. If the variable is stack-based, it returns the relative offset from the frame-base register. If the address can’t be resolved, it returns None . debug_location property debug_location → lief.debug_location_t The original source location where the variable is defined. description property description → str Description ( DW_AT_description ) of the variable or an empty string. is_constexpr property is_constexpr → bool Whether it’s a constexpr variable. is_stack_based property is_stack_based → bool Whether this variable is allocated on the stack linkage_name property linkage_name → str The name of the variable which is used for linking ( DW_AT_linkage_name ). This name differs from name as it is usually mangled. The function returns an empty string if the linkage name is not available. name property name → str Name of the variable (usually demangled) scope property scope → lief.dwarf.Scope | None Scope in which this variable is defined size property size → int | None Return the size of the variable (or a lief_errors if it can’t be resolved). This size is defined by the type of the variable. to_decl to_decl( self , opt: lief._lief.DeclOpt | None = None ) → str Generates a C/C++ definition for this variable type property type → lief.dwarf.Type | None Return the type of this variable. LexicalBlock lief.dwarf.LexicalBlock class lief.dwarf.LexicalBlock Bases: object This class represents a DWARF lexical block ( DW_TAG_lexical_block ) addr property addr → int | None Return the start address of this block description property description → str Return the description associated with this lexical block or an empty string high_pc property high_pc → int | None Return the highest virtual address owned by this block. low_pc property low_pc → int | None Return the lowest virtual address owned by this block. name property name → str Return the name associated with this lexical block or an empty string ranges property ranges → list[lief.range_t] Return a list of address ranges owned by this block. If the lexical block owns a contiguous range, it should return a single range. size property size → int Return the size of this block as the difference of the highest address and the lowest address. sub_blocks property sub_blocks → Iterator[ lief.dwarf.LexicalBlock | None] Return an iterator over the sub-LexicalBlock owned by this block. Type lief.dwarf.Type class lief.dwarf.Type Bases: object This class represents a DWARF Type which includes: DW_TAG_array_type DW_TAG_const_type DW_TAG_pointer_type DW_TAG_structure_type DW_TAG_base_type DW_TAG_class_type DW_TAG_enumeration_type DW_TAG_string_type DW_TAG_union_type DW_TAG_volatile_type DW_TAG_unspecified_type DW_TAG_typedef DW_TAG_reference_type DW_TAG_subroutine_type DW_TAG_ptr_to_member_type DW_TAG_set_type DW_TAG_packed_type DW_TAG_file_type DW_TAG_thrown_type DW_TAG_restrict_type DW_TAG_interface_type DW_TAG_shared_type DW_TAG_rvalue_reference_type DW_TAG_template_alias DW_TAG_coarray_type DW_TAG_dynamic_type DW_TAG_atomic_type DW_TAG_immutable_type KIND class KIND( *values ) Bases: Enum ARRAY ARRAY = 5 ATOMIC ATOMIC = 26 BASE BASE = 2 CLASS CLASS = 4 COARRAY COARRAY = 24 CONST_KIND CONST_KIND = 3 DYNAMIC DYNAMIC = 25 ENUM ENUM = 28 FILE FILE = 16 IMMUTABLE IMMUTABLE = 27 INTERFACE INTERFACE = 20 PACKED PACKED = 15 POINTER POINTER = 6 POINTER_MEMBER POINTER_MEMBER = 14 REF REF = 10 RESTRICT RESTRICT = 19 RVALREF RVALREF = 22 SET_TYPE SET_TYPE = 11 SHARED SHARED = 21 STRING STRING = 12 STRUCT STRUCT = 7 SUBROUTINE SUBROUTINE = 13 TEMPLATE_ALIAS TEMPLATE_ALIAS = 23 THROWN THROWN = 17 TYPEDEF TYPEDEF = 9 UNION UNION = 8 UNKNOWN UNKNOWN = 0 UNSPECIFIED UNSPECIFIED = 1 VOLATILE VOLATILE = 18 is_unspecified property is_unspecified → bool Whether this type is a DW_TAG_unspecified_type kind property kind → lief.dwarf.Type.KIND Discriminator for the type’s subclasses location property location → lief.debug_location_t Return the debug location where this type is defined. name property name → str | None Return the type’s name or None if it can’t be resolved. The name is resolved using either DW_AT_name or DW_AT_picture_string . scope property scope → lief.dwarf.Scope | None Scope in which this type is defined size property size → int | None Return the size of the type or None if it can’t be computed. This size should match the equivalent of sizeof(Type) . to_decl to_decl( self , opt: lief._lief.DeclOpt | None = None ) → str Generates a C/C++ definition for this type Array lief.dwarf.types.Array class lief.dwarf.types.Array Bases: Type This class represents a DW_TAG_array_type size_info property size_info → lief.dwarf.types.Array.size_info_t Return information about the size of this array. This size info is usually embedded in a DW_TAG_subrange_type DIE which is represented by the Array.size_info_t class. size_info_t class size_info_t Bases: object Class that wraps information about the dimension of this array name property name → str Name of the index (usually not relevant like __ARRAY_SIZE_TYPE__ ) size property size → int Size of the array. For instance in uint8_t[3] , it returns 3. type property type → lief.dwarf.Type | None Type of the index for this array. For instance in uint8_t[3] the index type could be set to a size_t . underlying_type property underlying_type → lief.dwarf.Type | None The underlying type of this array. Base lief.dwarf.types.Base class lief.dwarf.types.Base Bases: Type This class wraps the DW_TAG_base_type type which can be used – for instance – to represent integers or primitive types. ENCODING class ENCODING( *values ) Bases: Enum ADDRESS ADDRESS = 7 BOOLEAN BOOLEAN = 6 FLOAT FLOAT = 5 NONE NONE = 0 SIGNED SIGNED = 1 SIGNED_CHAR SIGNED_CHAR = 2 UNSIGNED UNSIGNED = 3 UNSIGNED_CHAR UNSIGNED_CHAR = 4 encoding property encoding → lief.dwarf.types.Base.ENCODING Describe how the base type is encoded and should be interpreted. ClassLike lief.dwarf.types.ClassLike class lief.dwarf.types.ClassLike Bases: Type This class abstracts a DWARF aggregate ( DW_TAG_structure_type , DW_TAG_class_type , DW_TAG_union_type ). Member class Member Bases: object This class represents a class/struct/union attribute. bit_offset property bit_offset → int | None Offset of the current member in bits in the current struct/union/class This function differs from offset for aggregates using bit-field declaration: struct S { int flag : 4; int opt : 1 }; Usually, offset * 8 == bit_offset If the offset can’t be resolved it returns None bit_size property bit_size → int | None If the current member is a bit-field, this function returns its size in bits. is_declaration property is_declaration → bool is_external property is_external → bool name property name → str Name of the member offset property offset → int | None Offset of the current member in the struct/union/class If the offset can’t be resolved it returns None type property type → lief.dwarf.Type | None Type of the current member find_member find_member( self , offset: int ) → lief._lief.dwarf.types.ClassLike.Member | None Try to find the attribute at the given offset functions property functions → Iterator[ lief.dwarf.Function | None] Iterator over the functions defined by the class-like. members property members → list[ lief.dwarf.types.ClassLike.Member ] Return a list of all the members defined in this class-like type. Structure lief.dwarf.types.Structure class lief.dwarf.types.Structure Bases: ClassLike This class represents a DWARF struct type ( DW_TAG_structure_type ) Class lief.dwarf.types.Class class lief.dwarf.types.Class Bases: ClassLike This class represents a DWARF class type ( DW_TAG_class_type ) Union lief.dwarf.types.Union class lief.dwarf.types.Union Bases: ClassLike This class represents a DWARF union type ( DW_TAG_union_type ) Packed lief.dwarf.types.Packed class lief.dwarf.types.Packed Bases: ClassLike This class represents a DWARF packed type ( DW_TAG_packed_type ) Const lief.dwarf.types.Const class lief.dwarf.types.Const Bases: Type This class represents a DW_TAG_const_type modifier underlying_type property underlying_type → lief.dwarf.Type | None The underlying type being const-ed by this type. Pointer lief.dwarf.types.Pointer class lief.dwarf.types.Pointer Bases: Type This class represents a DW_TAG_pointer_type DWARF type. underlying_type property underlying_type → lief.dwarf.Type | None The type pointed by this pointer Typedef lief.dwarf.types.Typedef class lief.dwarf.types.Typedef Bases: Type This class represents a DW_TAG_typedef type underlying_type property underlying_type → lief.dwarf.Type | None The type aliased by this typedef Atomic lief.dwarf.types.Atomic class lief.dwarf.types.Atomic Bases: Type This class represents the DW_TAG_atomic_type type underlying_type property underlying_type → lief.dwarf.Type | None The underlying type being atomized by this type. Coarray lief.dwarf.types.Coarray class lief.dwarf.types.Coarray Bases: Type This class represents the DW_TAG_coarray_type type Dynamic lief.dwarf.types.Dynamic class lief.dwarf.types.Dynamic Bases: Type This class represents the DW_TAG_dynamic_type type Enum lief.dwarf.types.Enum class lief.dwarf.types.Enum Bases: Type This class represents the DW_TAG_enumeration_type type Entry class Entry Bases: object This class represents an enum entry which is essentially composed of a name and its value (integer). name property name → str Enum entry’s name value property value → int | None Enum entry’s value entries property entries → list[ lief.dwarf.types.Enum.Entry ] Entries associated with this enum find_entry find_entry( self , value: int ) → lief._lief.dwarf.types.Enum.Entry | None Try to find the entry matching the given value underlying_type property underlying_type → lief.dwarf.Type | None The underlying type that is used to encode this enum File lief.dwarf.types.File class lief.dwarf.types.File Bases: Type This class represents the DW_TAG_file_type type Immutable lief.dwarf.types.Immutable class lief.dwarf.types.Immutable Bases: Type This class represents the DW_TAG_immutable_type type underlying_type property underlying_type → lief.dwarf.Type | None The underlying type. Interface lief.dwarf.types.Interface class lief.dwarf.types.Interface Bases: Type This class represents the DW_TAG_interface_type type PointerToMember lief.dwarf.types.PointerToMember class lief.dwarf.types.PointerToMember Bases: Type This class represents the DW_TAG_ptr_to_member_type type containing_type property containing_type → lief.dwarf.Type | None The type that embeds this member. underlying_type property underlying_type → lief.dwarf.Type | None The type of the member referenced by this pointer. RValueReference lief.dwarf.types.RValueReference class lief.dwarf.types.RValueReference Bases: Type This class represents the DW_TAG_rvalue_reference_type type underlying_type property underlying_type → lief.dwarf.Type | None The underlying type referenced by this rvalue-type. Reference lief.dwarf.types.Reference class lief.dwarf.types.Reference Bases: Type This class represents the DW_TAG_reference_type type underlying_type property underlying_type → lief.dwarf.Type | None The underlying type referenced by this ref-type. Restrict lief.dwarf.types.Restrict class lief.dwarf.types.Restrict Bases: Type This class represents the DW_TAG_restrict_type type underlying_type property underlying_type → lief.dwarf.Type | None The underlying type referenced by this restrict-type. SetTy lief.dwarf.types.SetTy class lief.dwarf.types.SetTy Bases: Type This class represents the DW_TAG_set_type type underlying_type property underlying_type → lief.dwarf.Type | None The underlying type referenced by this set-type. Shared lief.dwarf.types.Shared class lief.dwarf.types.Shared Bases: Type This class represents the DW_TAG_shared_type type underlying_type property underlying_type → lief.dwarf.Type | None The underlying type referenced by this shared-type. StringTy lief.dwarf.types.StringTy class lief.dwarf.types.StringTy Bases: Type This class represents the DW_TAG_string_type type Subroutine lief.dwarf.types.Subroutine class lief.dwarf.types.Subroutine Bases: Type This class represents the DW_TAG_subroutine_type type parameters property parameters → list[ lief.dwarf.Parameter | None] Parameters of this subroutine return_type property return_type → lief.dwarf.Type | None Return the Type associated with the return type of this function TemplateAlias lief.dwarf.types.TemplateAlias class lief.dwarf.types.TemplateAlias Bases: Type This class represents the DW_TAG_template_alias type parameters property parameters → list[ lief.dwarf.Parameter | None] Parameters associated with the underlying template underlying_type property underlying_type → lief.dwarf.Type | None The underlying type aliased by this type. Thrown lief.dwarf.types.Thrown class lief.dwarf.types.Thrown Bases: Type This class represents a DW_TAG_thrown_type underlying_type property underlying_type → lief.dwarf.Type | None The underlying type being thrown Volatile lief.dwarf.types.Volatile class lief.dwarf.types.Volatile Bases: Type This class represents a DW_TAG_volatile_type underlying_type property underlying_type → lief.dwarf.Type | None The underlying type. Editor lief.dwarf.Editor class lief.dwarf.Editor Bases: object This class exposes the main API to create DWARF information ARCH class ARCH( *values ) Bases: Enum AARCH64 AARCH64 = 3 ARM ARM = 4 UNKNOWN UNKNOWN = 0 X64 X64 = 1 X86 X86 = 2 FORMAT class FORMAT( *values ) Bases: Enum ELF ELF = 0 MACHO MACHO = 1 PE PE = 2 create create( fmt: lief.dwarf.Editor.FORMAT , arch: lief.dwarf.Editor.ARCH ) → lief.dwarf.Editor | None = create_compilation_unit create_compilation_unit( self ) → lief._lief.dwarf.editor.CompilationUnit | None Create a new compilation unit from_binary from_binary( bin: lief.Binary ) → lief.dwarf.Editor | None = write write( self , output: str | os.PathLike ) → None Write the DWARF file to the specified output Editor - CompilationUnit lief.dwarf.editor.CompilationUnit class lief.dwarf.editor.CompilationUnit Bases: object This class represents an editable DWARF compilation unit create_array create_array( self , name: str , ty: lief._lief.dwarf.editor.Type , count: int ) → lief._lief.dwarf.editor.ArrayType | None Create an array type with the given name, type and size. create_base_type create_base_type( self , name: str , size: int , encoding: lief._lief.dwarf.editor.BaseType.ENCODING = ENCODING.NONE ) → lief._lief.dwarf.editor.BaseType | None Create a primitive type with the given name and size. create_enum create_enum( self , name: str ) → lief._lief.dwarf.editor.EnumType | None Create an enum type ( DW_TAG_enumeration_type ) create_function create_function( self , name: str ) → lief._lief.dwarf.editor.Function | None Create a new function owned by this compilation unit create_function_type create_function_type( self , name: str ) → lief._lief.dwarf.editor.FunctionType | None Create a function type with the given name. create_generic_type create_generic_type( self , name: str ) → lief._lief.dwarf.editor.Type | None Create a DW_TAG_unspecified_type type with the given name create_pointer_type create_pointer_type( self , ty: lief._lief.dwarf.editor.Type ) → lief._lief.dwarf.editor.PointerType | None Create a pointer on the provided type. create_structure create_structure( self , name: str , kind: lief._lief.dwarf.editor.StructType.TYPE = TYPE.STRUCT ) → lief._lief.dwarf.editor.StructType | None Create a struct-like type (struct, class, union) with the given name create_typedef create_typedef( self , name: str , ty: lief._lief.dwarf.editor.Type ) → lief._lief.dwarf.editor.TypeDef | None Create a typedef with the name provided in the first parameter which aliases the type provided in the second parameter create_variable create_variable( self , name: str ) → lief._lief.dwarf.editor.Variable | None Create a new global variable owned by this compilation unit create_void_type create_void_type( self ) → lief._lief.dwarf.editor.Type | None Create a void type set_producer set_producer( self , arg: str , / ) → lief._lief.dwarf.editor.CompilationUnit Set the DW_AT_producer producer attribute. This attribute aims to inform about the program that generated this compilation unit (e.g. LIEF Extended ) Editor - Function lief.dwarf.editor.Function class lief.dwarf.editor.Function Bases: object This class represents an editable DWARF function ( DW_TAG_subprogram ) Label class Label Bases: object This class mirrors the DW_TAG_label DWARF tag LexicalBlock class LexicalBlock Bases: object This class mirrors the DW_TAG_lexical_block DWARF tag add_blockadd_block add_block( self , start: int , end: int ) → lief._lief.dwarf.editor.Function.LexicalBlock | None add_block( self , range: collections.abc.Sequence[ lief._lief.dwarf.editor.Function.range_t ] ) → lief._lief.dwarf.editor.Function.LexicalBlock | None Overloaded function. add_block(self, start: int, end: int) -> Optional[lief._lief.dwarf.editor.Function.LexicalBlock] Create a sub-block with the given low/high addresses. If the function managed to create the new block, it returns the newly created block, otherwise it returns the current block add_block(self, range: collections.abc.Sequence[lief._lief.dwarf.editor.Function.range_t]) -> Optional[lief._lief.dwarf.editor.Function.LexicalBlock] Create a sub-block with the given range of addresses. If the function managed to create the new block, it returns the newly created block, otherwise it returns the current block add_description add_description( self , description: str ) → lief._lief.dwarf.editor.Function.LexicalBlock Create a DW_AT_description entry with the description provided in parameter. add_name add_name( self , name: str ) → lief._lief.dwarf.editor.Function.LexicalBlock Create a DW_AT_name entry to associate a name to this entry Parameter class Parameter Bases: object This class represents a parameter of the current function ( DW_TAG_formal_parameter ) assign_registerassign_register assign_register( self , arg: str , / ) → lief._lief.dwarf.editor.Function.Parameter assign_register( self , arg: int , / ) → lief._lief.dwarf.editor.Function.Parameter Overloaded function. assign_register(self, arg: str, /) -> lief._lief.dwarf.editor.Function.Parameter Assign this parameter to a specific named register. assign_register(self, arg: int, /) -> lief._lief.dwarf.editor.Function.Parameter Assign this parameter to the given DWARF register id (e.g. DW_OP_reg0 ) add_description add_description( self , description: str ) → lief._lief.dwarf.editor.Function Create a DW_AT_description entry with the description provided in parameter. add_label add_label( self , addr: int , label: str ) → lief._lief.dwarf.editor.Function.Label | None Add a label at the given address add_lexical_block add_lexical_block( self , start: int , end: int ) → lief._lief.dwarf.editor.Function.LexicalBlock | None Add a lexical block with the given range add_parameter add_parameter( self , name: str , type: lief._lief.dwarf.editor.Type ) → lief._lief.dwarf.editor.Function.Parameter | None Add a parameter to the current function create_stack_variable create_stack_variable( self , name: str ) → lief._lief.dwarf.editor.Variable | None Create a stack-based variable owned by the current function range_trange_t class range_t( self ) class range_t( self , start: int , end: int ) Bases: object end property end → int start property start → int set_address set_address( self , addr: int ) → lief._lief.dwarf.editor.Function Set the address of this function by defining DW_AT_entry_pc set_external set_external( self ) → lief._lief.dwarf.editor.Function Set the function as external by defining DW_AT_external to true. This means that the function is imported by the current compilation unit. set_low_high set_low_high( self , low: int , high: int ) → lief._lief.dwarf.editor.Function Set the upper and lower bound addresses for this function. This assumes that the function is contiguous between low and high . Underneath, the function defines DW_AT_low_pc and DW_AT_high_pc set_ranges set_ranges( self , ranges: collections.abc.Sequence[ lief._lief.dwarf.editor.Function.range_t ] ) → lief._lief.dwarf.editor.Function Set the ranges of addresses owned by the implementation of this function by setting the DW_AT_ranges attribute. This setter should be used for non-contiguous functions. set_return_type set_return_type( self , type: lief._lief.dwarf.editor.Type ) → lief._lief.dwarf.editor.Function Set the return type of this function Editor - Variable lief.dwarf.editor.Variable class lief.dwarf.editor.Variable Bases: object This class represents an editable DWARF variable which can be scoped by a function or a compilation unit ( DW_TAG_variable ) add_description add_description( self , description: str ) → lief._lief.dwarf.editor.Variable Create a DW_AT_description entry with the description provided in parameter. set_addr set_addr( self , addr: int ) → lief._lief.dwarf.editor.Variable Set the global address of this variable. Setting this address is only relevant in the case of a static global variable. For stack variable, you should use set_stack_offset() . This function sets the DW_AT_location attribute set_external set_external( self ) → lief._lief.dwarf.editor.Variable Mark this variable as imported set_stack_offset set_stack_offset( self , offset: int ) → lief._lief.dwarf.editor.Variable Set the stack offset of this variable. This function sets the DW_AT_location attribute set_type set_type( self , type: lief._lief.dwarf.editor.Type ) → lief._lief.dwarf.editor.Variable Set the type of the current variable Editor - Type lief.dwarf.editor.Type class lief.dwarf.editor.Type Bases: object This class is the base class for any types created when editing DWARF debug info. A type is owned by a lief.dwarf.editor.CompilationUnit and should be created from this class. pointer_to pointer_to( self ) → lief._lief.dwarf.editor.PointerType | None Create a pointer type pointing to this type Editor - PointerType lief.dwarf.editor.PointerType class lief.dwarf.editor.PointerType Bases: Type This class represents a pointer to another type. Editor - EnumType lief.dwarf.editor.EnumType class lief.dwarf.editor.EnumType Bases: Type This class represents an editable enum type ( DW_TAG_enumeration_type ) Value class Value Bases: object This class represents an enum value add_value add_value( self , name: str , value: int ) → lief._lief.dwarf.editor.EnumType.Value | None Add an enum value by specifying its name and its integer value. set_size set_size( self , size: int ) → lief._lief.dwarf.editor.EnumType Define the number of bytes required to hold an instance of the enumeration ( DW_AT_byte_size ). set_underlying_type set_underlying_type( self , type: lief._lief.dwarf.editor.Type ) → lief._lief.dwarf.editor.EnumType Set the underlying type that is used to encode this enum Editor - BaseType lief.dwarf.editor.BaseType class lief.dwarf.editor.BaseType Bases: Type This class represents a primitive type like int, char . ENCODING class ENCODING( *values ) Bases: Enum ADDRESS ADDRESS = 1 BOOLEAN BOOLEAN = 6 FLOAT FLOAT = 7 NONE NONE = 0 SIGNED SIGNED = 2 SIGNED_CHAR SIGNED_CHAR = 3 UNSIGNED UNSIGNED = 4 UNSIGNED_CHAR UNSIGNED_CHAR = 5 Editor - ArrayType lief.dwarf.editor.ArrayType class lief.dwarf.editor.ArrayType Bases: Type This class represents an array type. Editor - FunctionType lief.dwarf.editor.FunctionType class lief.dwarf.editor.FunctionType Bases: Type This class represents a function type ( DW_TAG_subroutine_type ) Parameter class Parameter Bases: object This class represents a function’s parameter add_parameter add_parameter( self , type: lief._lief.dwarf.editor.Type ) → lief._lief.dwarf.editor.FunctionType.Parameter | None Add a parameter set_return_type set_return_type( self , type: lief._lief.dwarf.editor.Type ) → lief._lief.dwarf.editor.FunctionType Set the return type of this function Editor - TypeDef lief.dwarf.editor.TypeDef class lief.dwarf.editor.TypeDef Bases: Type This class represents a typedef ( DW_TAG_typedef ). Editor - StructType lief.dwarf.editor.StructType class lief.dwarf.editor.StructType Bases: Type This class represents a struct-like type which can be: DW_TAG_class_type DW_TAG_structure_type DW_TAG_union_type Member class Member Bases: object This class represents a member of the struct-like TYPE class TYPE( *values ) Bases: Enum CLASS CLASS = 0 STRUCT STRUCT = 1 UNION UNION = 2 add_bitfield add_bitfield( self , name: str , type: lief._lief.dwarf.editor.Type , bitsize: int , bitoffset: int = -1 ) → lief._lief.dwarf.editor.StructType.Member | None Adds a member to the current struct-like add_member add_member( self , name: str , type: lief._lief.dwarf.editor.Type , offset: int = -1 ) → lief._lief.dwarf.editor.StructType.Member | None Adds a member to the current struct-like set_size set_size( self , size: int ) → lief._lief.dwarf.editor.StructType Define the overall size which is equivalent to the sizeof of the current type. This function defines the DW_AT_byte_size attribute", "contentHash": "a1e6fa1cdd743d6f5c202b1a915d581c68046c546175e976204bb8f1ef6eddef", "description": "DWARF Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "extended/dwarf/python", "documentID": "da6eee04e1a735b125dea00ef9639aaeafe6ea2128dc67d67a23cb81f31e6e6d", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/dwarf/python.md", "title": "DWARF Python API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/dwarf/rust.html", "content": "Rust Note Please check: lief::dwarf", "contentHash": "0f00069a1fda51b559541dbe34aeccb889f39e9ada7dd717c164f3f369e69db7", "description": "DWARF Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "extended/dwarf/rust", "documentID": "0d2b4827bd40ecb8a439a603354bfdf03f91943200ed2a128d3f8a44fc129584", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/dwarf/rust.md", "title": "DWARF Rust API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/intro.html", "content": "What is LIEF Extended? Introduction LIEF Extended is an enhanced version of LIEF, providing additional features such as support for the Dyld shared cache, Objective-C metadata, PDB, and DWARF. While the main version of LIEF focuses on providing support for ELF, PE, and Mach-O, LIEF Extended aims to provide functionality that was not originally intended for integration into the core LIEF project. You can find the differences between the two versions in this table: Module Regular Version Extended Version Note ELF PE Mach-O COFF DEX OAT VDEX ART Runtime Only enabled in LIEF extended wheels PDB Support based on LLVM [1] DWARF Support based on LLVM [1] ObjC Support based on romainthomas/iCDump Dyld Shared Cache Disassembler Support based on LLVM [1] Assembler Support based on LLVM [1] Get Access To access the extended version, you must oauth-login with GitHub here: LIEF Extended To access the extended version, you must oauth-login with GitHub here: https://extended.lief.re/ . Once logged in, you can download the package of your choice (e.g., LIEF Extended - Python 3.10 for macOS arm64). Email If you don’t receive the download email, you can download the package directly from your History section. Versioning LIEF Extended uses a slightly different versioning scheme than regular LIEF packages. First, every extended package is based on the current main branch of LIEF. If you need an (extended) build for a specific commit or tag, please contact extended@lief.re. In Python, you can check the commit of LIEF being used in the extended version with: # Make sure it's the extended version $ python -c \"import lief;print(lief.__extended__)\" # Print LIEF's main commit $ python -c \"import lief;print(lief.__LIEF_MAIN_COMMIT__)\" With the C++/Rust SDK, you can call lief.extended_version_info() ( lief::extended_version_info ; LIEF::extended_version_info() ) to get details about the current version. Additional features exposed by LIEF Extended are not always represented in a public commit while still being git-versioned. An incremental build number is used to represent internal changes not associated with a public commit. For example, version 0.16.0.2380 includes 10 more commits than version 0.16.0.2370 . Python Wheels Python packages are delivered as a wheel for the required platform/version (e.g., lief_extended-0.16.0.post2370-cp312-cp312-win_amd64.whl ). You can install this wheel using pip in one of the following ways: $ venv\\Scripts\\python.exe -m pip install C:\\Users\\tmp\\lief_extended-0.16.0.post2370-cp312-cp312-win_amd64.whl Or $ venv\\Scripts\\python.exe -m pip install --find-links C:\\Users\\tmp\\ lief_extended You can verify that LIEF Extended is correctly installed with: $ python -c \"import lief;print(lief.__extended__)\" True C++ SDK The C++ SDK is delivered as a .zip/.tar.gz archive containing: A compiled shared library ( libLIEF.so , LIEF.dll , libLIEF.dylib ) Header files CMake helper files Compared to the regular version, this SDK does not ship a static version of LIEF, and the shared library is compiled with all extended features. Here is the layout for the macOS arm64 SDK, for example: LIEF-extended-sdk-0.16.0.2378-Darwin-arm64/ lib/libLIEF.dylib lib/cmake/LIEF/lief-extended-config-version.cmake include/[...] Rust SDK The Rust SDK is also delivered as a .zip/.tar.gz archive containing all the files needed for use with the LIEF_RUST_PRECOMPILED environment variable, as described in the Rust section. Once the archive is extracted, you just have to set the LIEF_RUST_PRECOMPILED environment variable to the extracted path: $ tar xzvf LIEF-extended-rust-0.16.0.2378-Linux-x86_64.tar.gz LIEF-extended-rust-0.16.0.2378-Linux-x86_64/lib/ LIEF-extended-rust-0.16.0.2378-Linux-x86_64/lib/libLIEF.so LIEF-extended-rust-0.16.0.2378-Linux-x86_64/lib/liblief-sys.a $ export LIEF_RUST_PRECOMPILED=$(pwd)/LIEF-extended-rust-0.16.0.2378-Linux-x86_64 You can then use all the extended features in Rust: $ cargo build my-lief-extended-project LIEF Extended & LLVM LIEF Extended relies on LLVM for certain features, such as the disassembler and DWARF / PDB support. The LLVM version used by LIEF is based on the upstream version and integrated into LIEF Extended so that users do not have to handle LLVM compilation or integration. Note LIEF is currently using LLVM 22.x. Whenever possible and appropriate, bug fixes and enhancements have been submitted as PRs to the LLVM project: llvm/llvm-project#119057 llvm/llvm-project#119056 llvm/llvm-project#116480 llvm/llvm-project#116479 llvm/llvm-project#97954", "contentHash": "8f6aa4ffd2bd1c78a1954623ef68629bf6b08d3e64f73c10dc18d3828eb082ca", "description": "LIEF Extended features, install Python wheels or C++ and Rust SDKs, verify your build, and find guides for debug information, assembly, Apple metadata, and…", "docname": "extended/intro", "documentID": "b2bdbcdf4d3e225feb7736c9f519912601c61438f3419a6affa874db012cd09d", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/intro.md", "title": "What is LIEF Extended? - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/objc/cpp.html", "content": "C++ Note You can also find the Doxygen documentation here: here Metadata Metadata class Metadata This class is the main interface to inspect Objective-C metadata. It can be instantiated using the function LIEF::MachO::Binary::objc_metadata Public Types classes_it using classes_it = iterator_range < Class :: Iterator > protocols_it using protocols_it = iterator_range < Protocol :: Iterator > categories_it using categories_it = iterator_range < Category :: Iterator > Public Functions Metadata Metadata(std::unique_ptr impl) classes classes_it classes() const Return an iterator over the different Objective-C classes ( @interface ). protocols protocols_it protocols() const Return an iterator over the Objective-C protocols declared in this binary ( @protocol ). categories categories_it categories() const Return an iterator over the Objective-C categories declared in this binary (e.g. @interface NSString (MyAdditions) ). get_class std::unique_ptr< Class > get_class(const std::string &name) const Try to find the Objective-C class with the given mangled name. get_protocol std::unique_ptr< Protocol > get_protocol(const std::string &name) const Try to find the Objective-C protocol with the given mangled name. to_decl std::string to_decl(const DeclOpt &opt = DeclOpt ()) const Generate a header-like of all the Objective-C metadata identified in the binary. The generated output can be configured with the DeclOpt . ~Metadata ~Metadata() Class Class class Class This class represents an Objective-C class ( @interface ). Public Types methods_t using methods_t = iterator_range < Method :: Iterator > Iterator for the class’s methods. protocols_t using protocols_t = iterator_range < Protocol :: Iterator > Iterator for the protocols implemented by this class. properties_t using properties_t = iterator_range < Property :: Iterator > Iterator for the properties declared by this class. ivars_t using ivars_t = iterator_range < IVar :: Iterator > Iterator for the instance variables defined by this class. Public Functions Class Class(std::unique_ptr impl) name std::string name() const Name of the class. demangled_name std::string demangled_name() const Demangled name of the class. super_class std::unique_ptr< Class > super_class() const Parent class in case of inheritance. This returns the superclass object only when it is defined in the same binary. For root classes (e.g. NSObject ) or superclasses imported from another image, it returns a null pointer even though the name can still be resolved through super_name() / demangled_super_name() . super_name std::string super_name() const (raw) name of the superclass (empty for root classes or when it could not be resolved). demangled_super_name std::string demangled_super_name() const Demangled name of the superclass. is_meta bool is_meta() const methods methods_t methods() const Iterator over the different methods defined by this class. protocols protocols_t protocols() const Iterator over the different protocols implemented by this class. properties properties_t properties() const Iterator over the properties of this class. ivars ivars_t ivars() const Iterator over the different instance variables defined in this class. to_decl std::string to_decl(const DeclOpt &opt = DeclOpt ()) const Generate a header-like string for this specific class. The generated output can be configured with DeclOpt ~Class ~Class() Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::bidirectional_iterator_tag, Class , std::ptrdiff_t, const Class *, const Class &> Public Types implementation using implementation = details::ClassIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator-- Iterator &operator--() operator* const Class &operator*() const operator-> const Class *operator->() const yield std::unique_ptr< Class > yield() Transfer ownership of the class at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) operator-- inline DerivedT operator--(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) Category Category class Category This class represents an Objective-C category (e.g. @interface NSString (MyAdditions) ). Public Types methods_t using methods_t = iterator_range < Method :: Iterator > Iterator for the category’s methods. protocols_t using protocols_t = iterator_range < Protocol :: Iterator > Iterator for the protocols adopted by this category. properties_t using properties_t = iterator_range < Property :: Iterator > Iterator for the properties declared by this category. Public Functions Category Category(std::unique_ptr impl) name std::string name() const Name of the category. class_name std::string class_name() const (demangled) name of the class extended by this category methods methods_t methods() const Iterator over the different methods defined by this category. protocols protocols_t protocols() const Iterator over the different protocols adopted by this category. properties properties_t properties() const Iterator over the properties of this category. to_decl std::string to_decl(const DeclOpt &opt = DeclOpt ()) const Generate a header-like string for this specific category. The generated output can be configured with DeclOpt ~Category ~Category() Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::bidirectional_iterator_tag, Category , std::ptrdiff_t, const Category *, const Category &> Public Types implementation using implementation = details::CategoryIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator-- Iterator &operator--() operator* const Category &operator*() const operator-> const Category *operator->() const yield std::unique_ptr< Category > yield() Transfer ownership of the category at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) operator-- inline DerivedT operator--(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) Protocol Protocol class Protocol This class represents an Objective-C @protocol . Public Types methods_it using methods_it = iterator_range < Method :: Iterator > properties_it using properties_it = iterator_range < Property :: Iterator > protocols_it using protocols_it = iterator_range < Iterator > Public Functions Protocol Protocol(std::unique_ptr impl) mangled_name std::string mangled_name() const Mangled name of the protocol. protocols protocols_it protocols() const Iterator over the protocols adopted by this protocol (e.g. the in @protocol Foo ). optional_methods methods_it optional_methods() const Iterator over the methods that could be overridden. required_methods methods_it required_methods() const Iterator over the methods of this protocol that must be implemented. properties properties_it properties() const Iterator over the properties defined in this protocol. to_decl std::string to_decl(const DeclOpt &opt = DeclOpt ()) const Generate a header-like string for this specific protocol. The generated output can be configured with DeclOpt ~Protocol ~Protocol() Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::bidirectional_iterator_tag, Protocol , std::ptrdiff_t, const Protocol *, const Protocol &> Public Types implementation using implementation = details::ProtocolIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator-- Iterator &operator--() operator* const Protocol &operator*() const operator-> const Protocol *operator->() const yield std::unique_ptr< Protocol > yield() Transfer ownership of the protocol at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) operator-- inline DerivedT operator--(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) Instance Variable (IVar) IVar class IVar This class represents an instance variable (ivar). Public Functions IVar IVar(std::unique_ptr impl) name std::string name() const Name of the instance variable. mangled_type std::string mangled_type() const Type of the instance var in its mangled representation ( [29i] ). ~IVar ~IVar() Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::bidirectional_iterator_tag, IVar , std::ptrdiff_t, const IVar *, const IVar &> Public Types implementation using implementation = details::IVarIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator-- Iterator &operator--() operator* const IVar &operator*() const operator-> const IVar *operator->() const yield std::unique_ptr< IVar > yield() Transfer ownership of the ivar at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) operator-- inline DerivedT operator--(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) Method Method class Method This class represents an Objective-C Method . Public Functions Method Method(std::unique_ptr impl) name std::string name() const Name of the method. mangled_type std::string mangled_type() const Prototype of the method in its mangled representation (e.g. @16@0:8 ). address uintptr_t address() const Virtual address where this method is implemented in the binary. is_instance bool is_instance() const Whether it’s an instance method. ~Method ~Method() Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::bidirectional_iterator_tag, Method , std::ptrdiff_t, const Method *, const Method &> Public Types implementation using implementation = details::MethodIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator-- Iterator &operator--() operator* const Method &operator*() const operator-> const Method *operator->() const yield std::unique_ptr< Method > yield() Transfer ownership of the method at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) operator-- inline DerivedT operator--(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) Property Property class Property This class represents a @property in Objective-C. Public Functions Property Property(std::unique_ptr impl) name std::string name() const Name of the property. attribute std::string attribute() const (raw) property’s attributes (e.g. T@\"NSString\",C,D,N ) ~Property ~Property() Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::bidirectional_iterator_tag, Property , std::ptrdiff_t, const Property *, const Property &> Public Types implementation using implementation = details::PropertyIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator-- Iterator &operator--() operator* const Property &operator*() const operator-> const Property *operator->() const yield std::unique_ptr< Property > yield() Transfer ownership of the property at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) operator-- inline DerivedT operator--(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) DeclOpt DeclOpt struct DeclOpt This structure wraps options to tweak the generated output of functions like LIEF::objc::Metadata::to_decl . Public Members show_annotations bool show_annotations = true Whether annotations like method’s address should be printed.", "contentHash": "011917b265dbc8e50837f3d5a34b077c666a09448714d542cf2fbccf8389ba43", "description": "Objective-C C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "extended/objc/cpp", "documentID": "5e66d3f1b9f06f5c521f61daf9e0bbbea2e8ac0a1b7cd0b308d792f08e75c9fb", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/objc/cpp.md", "title": "Objective-C C++ API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/objc/index.html", "content": "Objective-C API C++ Metadata Class Category Protocol Instance Variable (IVar) Method Property DeclOpt Python Metadata Class Category Protocol Method IVar Property DeclOpt Rust Introduction LIEF Extended reads Objective-C classes, methods, properties, and protocols from Mach-O metadata. It can also generate header-like declarations. This information comes from Objective-C runtime metadata in the file, so it can be present even when source-level debug information is unavailable. Inspect metadata If a Mach-O binary embeds Objective-C metadata, it can be accessed through lief.MachO.Binary.objc_metadata ( lief::macho::Binary::objc_metadata ; lief.MachO.Binary.objc_metadata ; LIEF::MachO::Binary::objc_metadata() ): Python macho: lief.MachO.Binary metadata = macho.objc_metadata if metadata is not None: print(\"Objective-C metadata found\") C++ std::unique_ptr macho; std::unique_ptr metadata = macho->objc_metadata(); if (metadata != nullptr) { std::cout << \"Objective metadata found\\n\"; } Rust let macho: &lief::macho::Binary = some_macho; if let Some(metadata) = macho.objc_metadata() { println!(\"Objective-C metadata found\"); } When metadata is present, use lief.ObjC.Metadata ( lief::objc::Metadata ; lief.objc.Metadata ; LIEF::objc::Metadata ) to inspect it. In particular, the lief.ObjC.Metadata.to_decl() ( lief::objc::Metadata::to_decl ; lief.objc.Metadata.to_decl() ; LIEF::objc::Metadata::to_decl() ) function can be used to generate a header-like output of all the Objective-C metadata found in the binary. Python macho: lief.MachO.Binary metadata = macho.objc_metadata for clazz in metadata.classes: print(f\"name={clazz.name}\") for meth in clazz.methods: print(f\" method.name={meth.name}\") print(metadata.to_decl()) C++ std::unique_ptr bin; std::unique_ptr metadata = bin->objc_metadata(); for (const LIEF::objc::Class& clazz : metadata->classes()) { std::cout << \"name=\" << clazz.name() << '\\n'; for (const LIEF::objc::Method& meth : clazz.methods()) { std::cout << \" method.name=\" << meth.name() << '\\n'; } } std::cout << metadata->to_decl(); Rust let macho: &lief::macho::Binary = some_macho; let Some(metadata) = macho.objc_metadata() else { process::exit(1); }; for class in metadata.classes() { println!(\"name={}\", class.name()); for method in class.methods() { println!(\" method.name={}\", method.name()); } } println!(\"{}\", metadata.to_decl()); Class Dump Generate header-like declarations to review the classes and protocols found in the binary. The output describes the recorded metadata, including method signatures. It does not recover method implementations or the original headers. LIEF provides a way to generate this header-like information at various levels: lief.ObjC.Metadata.to_decl() ( lief::objc::Metadata::to_decl_with_opt ; lief.objc.Metadata.to_decl() ; LIEF::objc::Metadata::to_decl() ) lief.ObjC.Class.to_decl() ( lief::objc::Class::to_decl_with_opt ; lief.objc.Class.to_decl() ; LIEF::objc::Class::to_decl() ) lief.ObjC.Protocol.to_decl() ( lief::objc::Protocol::to_decl_with_opt ; lief.objc.Protocol.to_decl() ; LIEF::objc::Protocol::to_decl() ) Technically, this output is created by generating a Clang AST and applying the LLVM printer visitor to it. Code fn classdump(macho: &lief::macho::Binary) { let metadata = macho.objc_metadata().expect(\"Missing Objective-C info\"); for class in metadata.classes() { println!(\"{}\", class.to_decl()); } } Result @interface APMEventFilter { bool _sessionScoped; bool _dynamic; bool _sequence; int _audienceID; int _filterID; NSString * _eventName; NSData * _data; } // Address: 0x0101859ee0 - (NSObject *)initWithAudienceID:(APMEventFilter *)self filterID:(SEL)id eventName:(int)arg2 data:(int)arg3 sessionScoped:(NSObject *)arg4 dynamic:(NSObject *)arg5 sequence:(bool)arg6 :(bool)arg7 :(bool)arg8; // Address: 0x0101682590 - (int)audienceID:(APMEventFilter *)self :(SEL)id; // Address: 0x01017b6d98 - (int)filterID:(APMEventFilter *)self :(SEL)id; // Address: 0x01018a4a6c - (bool)isSessionScoped:(APMEventFilter *)self :(SEL)id; // Address: 0x01017630d4 - (bool)isDynamic:(APMEventFilter *)self :(SEL)id; // Address: 0x01016adbb4 - (bool)isSequence:(APMEventFilter *)self :(SEL)id; // Address: 0x010187a5f8 - (NSObject *)eventName:(APMEventFilter *)self :(SEL)id; // Address: 0x0101581bfc - (NSObject *)data:(APMEventFilter *)self :(SEL)id; // Address: 0x01018e1f3c - (void).cxx_destruct:(APMEventFilter *)self :(SEL)id; @property void eventName; @property void data; @property void audienceID; @property void filterID; @property void sessionScoped; @property void dynamic; @property void sequence; @property void hash; @property void superclass; @property void description; @property void debugDescription; @end The lief.ObjC.DeclOpt ( lief::objc::DeclOpt ; lief.objc.DeclOpt ; LIEF::objc::DeclOpt ) can be used to customize the generated output. For example, we can remove the commented addresses associated with Objective-C methods using this option: def print_without_address(macho: lief.MachO.Binary): metadata = macho.objc_metadata config = lief.objc.DeclOpt() config.show_annotations = False for cls in metadata.classes: print(cls.to_decl(config)) References romainthomas/iCDump nygard/class-dump https://www.romainthomas.fr/post/23-01-icdump/ API You can find the documentation of the API for the different languages here: Python API C++ API Rust API: lief::objc", "contentHash": "ecaaea19b7ab1f22f0889cddc0e98977c2a9718b9cb7047ea10cd92b9cca25e4", "description": "Inspect Objective-C classes, methods, properties, and protocols in Mach-O files and generate header-like declarations with LIEF Extended.", "docname": "extended/objc/index", "documentID": "f89a23b58e22d1d6c1677fdf240bdafb678c8242dbc5981ad12d512bab4a9b02", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/objc/index.md", "title": "Objective-C - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/objc/python.html", "content": "Python Metadata lief.objc.Metadata class lief.objc.Metadata Bases: object This class is the main interface to inspect Objective-C metadata It can be instantiated using the function lief.MachO.Binary.objc_metadata categories property categories → Iterator[ lief.objc.Category | None] Return an iterator over the Objective-C categories declared in this binary (e.g. @interface NSString (MyAdditions) ). classes property classes → Iterator[ lief.objc.Class | None] Return an iterator over the different Objective-C classes ( @interface ). get_class get_class( self , name: str ) → lief._lief.objc.Class | None Try to find the Objective-C class with the given mangled name. get_protocol get_protocol( self , name: str ) → lief._lief.objc.Protocol | None Try to find the Objective-C protocol with the given mangled name. protocols property protocols → Iterator[ lief.objc.Protocol | None] Return an iterator over the Objective-C protocols declared in this binary ( @protocol ). to_decl to_decl( self , opt: lief._lief.objc.DeclOpt = ) → str Generate a header-like of all the Objective-C metadata identified in the binary. The generated output can be configured with the provided DeclOpt parameter. Class lief.objc.Class class lief.objc.Class Bases: object This class represents an Objective-C class ( @interface ) demangled_name property demangled_name → str Demangled name of the class demangled_super_name property demangled_super_name → str Demangled name of the superclass. is_meta property is_meta → bool ivars property ivars → Iterator[ lief.objc.IVar | None] Iterator over the different instance variables defined in this class. methods property methods → Iterator[ lief.objc.Method | None] Iterator over the different methods defined by this class. name property name → str Name of the class properties property properties → Iterator[ lief.objc.Property | None] Iterator over the properties of this class. protocols property protocols → Iterator[ lief.objc.Protocol | None] Iterator over the different protocols implemented by this class. super_class property super_class → lief.objc.Class | None Parent class in case of inheritance. This is set only when the superclass is defined in the same binary. For root classes (e.g. NSObject ) or superclasses imported from another image, it is None even though super_name / demangled_super_name may still be resolved. super_name property super_name → str (raw) name of the superclass (empty for root classes or when it could not be resolved). to_decl to_decl( self , opt: lief._lief.objc.DeclOpt = ) → str Generate a header-like string for this specific class. The generated output can be configured with the provided DeclOpt parameter. Category lief.objc.Category class lief.objc.Category Bases: object This class represents an Objective-C category (e.g. @interface NSString (MyAdditions) ) class_name property class_name → str (demangled) name of the class extended by this category methods property methods → Iterator[ lief.objc.Method | None] Iterator over the different methods defined by this category. name property name → str Name of the category properties property properties → Iterator[ lief.objc.Property | None] Iterator over the properties of this category. protocols property protocols → Iterator[ lief.objc.Protocol | None] Iterator over the different protocols adopted by this category. to_decl to_decl( self , opt: lief._lief.objc.DeclOpt = ) → str Generate a header-like string for this specific category. The generated output can be configured with the provided DeclOpt parameter. Protocol lief.objc.Protocol class lief.objc.Protocol Bases: object This class represents an Objective-C @protocol mangled_name property mangled_name → str Mangled name of the protocol optional_methods property optional_methods → Iterator[ lief.objc.Method | None] Iterator over the methods that could be overridden properties property properties → Iterator[ lief.objc.Property | None] Iterator over the properties defined in this protocol protocols property protocols → Iterator[ lief.objc.Protocol | None] Iterator over the protocols adopted by this protocol (e.g. the in @protocol Foo ). required_methods property required_methods → Iterator[ lief.objc.Method | None] Iterator over the methods of this protocol that must be implemented to_decl to_decl( self , opt: lief._lief.objc.DeclOpt = ) → str Generate a header-like string for this specific protocol. The generated output can be configured with the provided DeclOpt parameter. Method lief.objc.Method class lief.objc.Method Bases: object This class represents an Objective-C Method. address property address → int Virtual address where this method is implemented in the binary is_instance property is_instance → bool Whether it’s an instance method or not. mangled_type property mangled_type → str Prototype of the method in its mangled representation (e.g. @16@0:8 ) name property name → str Name of the method IVar lief.objc.IVar class lief.objc.IVar Bases: object This class represents an instance variable (ivar) mangled_type property mangled_type → str Type of the instance var in its mangled representation (e.g. [29i] ) name property name → str Name of the instance variable Property lief.objc.Property class lief.objc.Property Bases: object This class represents a @property in Objective-C attribute property attribute → str (raw) property’s attributes (e.g. T@\"NSString\",C,D,N ) name property name → str Name of the property DeclOpt lief.objc.DeclOpt class lief.objc.DeclOpt( self ) Bases: object This structure wraps options to tweak the generated output of functions like lief.objc.Metadata.to_decl() show_annotations property show_annotations → bool Whether annotations like method’s address should be printed.", "contentHash": "a9e84b90719e80c6234a7fead9970839ad306999132c24cb9a9d4750b292312d", "description": "Objective-C Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "extended/objc/python", "documentID": "9186404652aeb90b8f55ea845e1c5db781e7633ff11a50e72497cdba4700ff4a", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/objc/python.md", "title": "Objective-C Python API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/objc/rust.html", "content": "Rust Note Please check: lief::objc", "contentHash": "5de9384197910fc298bcc06387992fbda328a85d292c4fb4fcfb364ff3c572ac", "description": "Objective-C Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "extended/objc/rust", "documentID": "9f32d22fd0385fe603d6f1eac5bb71cc7bd366072e49d436e13454cac4abf9f3", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/objc/rust.md", "title": "Objective-C Rust API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/pdb/cpp.html", "content": "C++ Note You can also find the Doxygen documentation here: here LIEF::pdb::load inline std::unique_ptr< DebugInfo > LIEF::pdb::load(const std::string &pdb_path) Load the PDB file from the given path. DebugInfo DebugInfo class DebugInfo : public LIEF:: DebugInfo This class provides an interface for PDB files. One can instantiate this class using LIEF::pdb::load() or LIEF::pdb::DebugInfo::from_file . Public Types compilation_units_it using compilation_units_it = iterator_range < CompilationUnit :: Iterator > Iterator over the CompilationUnit . public_symbols_it using public_symbols_it = iterator_range < PublicSymbol :: Iterator > Iterator over the symbols located in the PDB public symbol stream. types_it using types_it = iterator_range < Type :: Iterator > Iterator over the PDB’s types. Public Functions format inline virtual FORMAT format() const override compilation_units compilation_units_it compilation_units() const Iterator over the CompilationUnit from the PDB’s DBI stream. CompilationUnit are also named “Module” in the PDB’s official documentation. public_symbols public_symbols_it public_symbols() const Return an iterator over the public symbol stream. types types_it types() const Return an iterator over the different types registered in this PDB. find_type std::unique_ptr< Type > find_type(const std::string &name) const Find the type with the given name. find_type std::unique_ptr< Type > find_type(uint32_t index) const Find the type at the given index. find_public_symbol std::unique_ptr< PublicSymbol > find_public_symbol(const std::string &name) const Try to find the PublicSymbol from the given name (based on the public symbol stream). The function returns a nullptr if the symbol can’t be found const DebugInfo& info = ...; if (auto found = info.find_public_symbol(\"MiSyncSystemPdes\")) { // FOUND! } find_function_address virtual std::optional find_function_address(const std::string &name) const override Attempt to resolve the address of the function specified by name . age uint32_t age() const The number of times the PDB file has been written. guid std::string guid() const Unique identifier of the PDB file. to_string std::string to_string() const Pretty representation. ~DebugInfo virtual ~DebugInfo() override = default DebugInfo DebugInfo(std::unique_ptr impl) Public Static Functions from_file static std::unique_ptr< DebugInfo > from_file(const std::string &pdb_path) Instantiate this class from the given PDB file. It returns a nullptr if the PDB can’t be processed. classof static inline bool classof(const LIEF:: DebugInfo *info) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const DebugInfo &dbg) PublicSymbol PublicSymbol class PublicSymbol This class provides general information (RVA, name) about a symbol from the PDB’s public symbol stream (or Public symbol hash stream). Public Types FLAGS enum class FLAGS : uint32_t Values: NONE enumerator NONE = 0 CODE enumerator CODE = 1 << 0 FUNCTION enumerator FUNCTION = 1 << 1 MANAGED enumerator MANAGED = 1 << 2 MSIL enumerator MSIL = 1 << 3 Public Functions PublicSymbol PublicSymbol(std::unique_ptr impl) ~PublicSymbol ~PublicSymbol() name std::string name() const Name of the symbol. demangled_name std::string demangled_name() const Demangled representation of the symbol. section_name std::string section_name() const Name of the section in which this symbol is defined (e.g. .text ). This function returns an empty string if the section’s name can’t be found RVA uint32_t RVA() const Relative Virtual Address of this symbol. This function returns 0 if the RVA can’t be computed. to_string std::string to_string() const Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const PublicSymbol &sym) Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::forward_iterator_tag, PublicSymbol , std::ptrdiff_t, const PublicSymbol *, const PublicSymbol &> Public Types implementation using implementation = details::PublicSymbolIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator* const PublicSymbol &operator*() const operator-> const PublicSymbol *operator->() const yield std::unique_ptr< PublicSymbol > yield() Transfer ownership of the public symbol at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) CompilationUnit CompilationUnit class CompilationUnit This class represents a CompilationUnit (or Module) in a PDB file. Public Types sources_iterator using sources_iterator = iterator_range ::const_iterator> Iterator over the source files (std::string). function_iterator using function_iterator = iterator_range < Function :: Iterator > Public Functions CompilationUnit CompilationUnit(std::unique_ptr impl) ~CompilationUnit ~CompilationUnit() module_name std::string module_name() const Name (or path) to the COFF object ( .obj ) associated with this compilation unit (e.g. e:\\obj.amd64fre\\minkernel\\ntos\\hvl\\mp\\objfre\\amd64\\hvlp.obj ). object_filename std::string object_filename() const Name or path to the original binary object (COFF, Archive) in which the compilation unit was located before being linked. e.g. e:\\obj.amd64fre\\minkernel\\ntos\\hvl\\mp\\objfre\\amd64\\hvl.lib . sources sources_iterator sources() const Iterator over the sources files that compose this compilation unit. These files also include headers ( .h, .hpp , …). functions function_iterator functions() const Return an iterator over the function defined in this compilation unit. If the PDB does not contain or has an empty DBI stream, it returns an empty iterator. build_metadata std::unique_ptr< BuildMetadata > build_metadata() const Return build metadata such as the version of the compiler or the original source language of this compilation unit. to_decl std::string to_decl(const DeclOpt &opt = DeclOpt ()) const Generate a C/C++ definition for the functions defined in this compilation unit. to_string std::string to_string() const Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const CompilationUnit &CU) Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::bidirectional_iterator_tag, CompilationUnit , std::ptrdiff_t, const CompilationUnit *, const CompilationUnit &> Public Types implementation using implementation = details::CompilationUnitIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator-- Iterator &operator--() operator* const CompilationUnit &operator*() const operator-> const CompilationUnit *operator->() const yield std::unique_ptr< CompilationUnit > yield() Transfer ownership of the compilation unit at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) operator-- inline DerivedT operator--(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) BuildMetadata BuildMetadata class BuildMetadata This class wraps build metadata represented by the codeview symbols: S_COMPILE3, S_COMPILE2, S_BUILDINFO, S_ENVBLOCK . Public Types LANG enum class LANG : uint8_t Values: C enumerator C = 0x00 CPP enumerator CPP = 0x01 FORTRAN enumerator FORTRAN = 0x02 MASM enumerator MASM = 0x03 PASCAL_LANG enumerator PASCAL_LANG = 0x04 BASIC enumerator BASIC = 0x05 COBOL enumerator COBOL = 0x06 LINK enumerator LINK = 0x07 CVTRES enumerator CVTRES = 0x08 CVTPGD enumerator CVTPGD = 0x09 CSHARP enumerator CSHARP = 0x0a VB enumerator VB = 0x0b ILASM enumerator ILASM = 0x0c JAVA enumerator JAVA = 0x0d JSCRIPT enumerator JSCRIPT = 0x0e MSIL enumerator MSIL = 0x0f HLSL enumerator HLSL = 0x10 OBJC enumerator OBJC = 0x11 OBJCPP enumerator OBJCPP = 0x12 SWIFT enumerator SWIFT = 0x13 ALIASOBJ enumerator ALIASOBJ = 0x14 RUST enumerator RUST = 0x15 GO enumerator GO = 0x16 UNKNOWN enumerator UNKNOWN = 0xFF CPU enum class CPU : uint16_t Values: INTEL_8080 enumerator INTEL_8080 = 0x0 INTEL_8086 enumerator INTEL_8086 = 0x1 INTEL_80286 enumerator INTEL_80286 = 0x2 INTEL_80386 enumerator INTEL_80386 = 0x3 INTEL_80486 enumerator INTEL_80486 = 0x4 PENTIUM enumerator PENTIUM = 0x5 PENTIUMPRO enumerator PENTIUMPRO = 0x6 PENTIUM3 enumerator PENTIUM3 = 0x7 MIPS enumerator MIPS = 0x10 MIPS16 enumerator MIPS16 = 0x11 MIPS32 enumerator MIPS32 = 0x12 MIPS64 enumerator MIPS64 = 0x13 MIPSI enumerator MIPSI = 0x14 MIPSII enumerator MIPSII = 0x15 MIPSIII enumerator MIPSIII = 0x16 MIPSIV enumerator MIPSIV = 0x17 MIPSV enumerator MIPSV = 0x18 M68000 enumerator M68000 = 0x20 M68010 enumerator M68010 = 0x21 M68020 enumerator M68020 = 0x22 M68030 enumerator M68030 = 0x23 M68040 enumerator M68040 = 0x24 ALPHA enumerator ALPHA = 0x30 ALPHA_21164 enumerator ALPHA_21164 = 0x31 ALPHA_21164A enumerator ALPHA_21164A = 0x32 ALPHA_21264 enumerator ALPHA_21264 = 0x33 ALPHA_21364 enumerator ALPHA_21364 = 0x34 PPC601 enumerator PPC601 = 0x40 PPC603 enumerator PPC603 = 0x41 PPC604 enumerator PPC604 = 0x42 PPC620 enumerator PPC620 = 0x43 PPCFP enumerator PPCFP = 0x44 PPCBE enumerator PPCBE = 0x45 SH3 enumerator SH3 = 0x50 SH3E enumerator SH3E = 0x51 SH3DSP enumerator SH3DSP = 0x52 SH4 enumerator SH4 = 0x53 SHMEDIA enumerator SHMEDIA = 0x54 ARM3 enumerator ARM3 = 0x60 ARM4 enumerator ARM4 = 0x61 ARM4T enumerator ARM4T = 0x62 ARM5 enumerator ARM5 = 0x63 ARM5T enumerator ARM5T = 0x64 ARM6 enumerator ARM6 = 0x65 ARM_XMAC enumerator ARM_XMAC = 0x66 ARM_WMMX enumerator ARM_WMMX = 0x67 ARM7 enumerator ARM7 = 0x68 OMNI enumerator OMNI = 0x70 IA64 enumerator IA64 = 0x80 IA64_2 enumerator IA64_2 = 0x81 CEE enumerator CEE = 0x90 AM33 enumerator AM33 = 0xa0 M32R enumerator M32R = 0xb0 TRICORE enumerator TRICORE = 0xc0 X64 enumerator X64 = 0xd0 EBC enumerator EBC = 0xe0 THUMB enumerator THUMB = 0xf0 ARMNT enumerator ARMNT = 0xf4 ARM64 enumerator ARM64 = 0xf6 HYBRID_X86ARM64 enumerator HYBRID_X86ARM64 = 0xf7 ARM64EC enumerator ARM64EC = 0xf8 ARM64X enumerator ARM64X = 0xf9 D3D11_SHADER enumerator D3D11_SHADER = 0x100 UNKNOWN enumerator UNKNOWN = 0xff Public Functions BuildMetadata BuildMetadata(std::unique_ptr impl) ~BuildMetadata ~BuildMetadata() frontend_version version_t frontend_version() const Version of the frontend (e.g. 19.36.32537 ). backend_version version_t backend_version() const Version of the backend (e.g. 14.36.32537 ). version std::string version() const Version of the tool as a string. For instance, Microsoft (R) CVTRES , Microsoft (R) LINK . language LANG language() const Source language. target_cpu CPU target_cpu() const Target CPU . build_info std::optional< build_info_t > build_info() const Build information represented by the S_BUILDINFO symbol. env std::vector env() const Environment information represented by the S_ENVBLOCK symbol. to_string std::string to_string() const Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const BuildMetadata &meta) version_t struct version_t This structure represents a version for the backend or the frontend. Public Members major uint16_t major = 0 Major version. minor uint16_t minor = 0 Minor version. build uint16_t build = 0 Build version. qfe uint16_t qfe = 0 Quick Fix Engineering version. build_info_t struct build_info_t This structure represents information wrapped by the S_BUILDINFO symbol. Public Members cwd std::string cwd Working directory where the build tool was invoked. build_tool std::string build_tool Path to the build tool (e.g. C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\VC\\Tools\\MSVC\\14.36.32532\\bin\\HostX64\\x64\\CL.exe ). source_file std::string source_file Source file consumed by the build tool . pdb std::string pdb PDB path. command_line std::string command_line Command line arguments used to invoke the build tool . Function Function class Function Public Functions Function Function(std::unique_ptr impl) ~Function ~Function() name std::string name() const The name of the function (this name is usually demangled). RVA uint32_t RVA() const The Relative Virtual Address of the function. code_size uint32_t code_size() const The size of the function. section_name std::string section_name() const The name of the section in which this function is defined. debug_location debug_location_t debug_location() const Original source code location. to_decl std::string to_decl(const DeclOpt &opt = DeclOpt ()) const Generate a C/C++ definition for this function. to_string std::string to_string() const Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Function &F) Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::forward_iterator_tag, Function , std::ptrdiff_t, const Function *, const Function &> Public Types implementation using implementation = details::FunctionIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator* const Function &operator*() const operator-> const Function *operator->() const yield std::unique_ptr< Function > yield() Transfer ownership of the function at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) Type Type class Type This is the base class for any PDB type. Subclassed by LIEF::pdb::types::Array , LIEF::pdb::types::BitField , LIEF::pdb::types::ClassLike , LIEF::pdb::types::Enum , LIEF::pdb::types::Function , LIEF::pdb::types::Modifier , LIEF::pdb::types::Pointer , LIEF::pdb::types::Simple Public Types KIND enum class KIND Values: UNKNOWN enumerator UNKNOWN = 0 CLASS enumerator CLASS POINTER enumerator POINTER SIMPLE enumerator SIMPLE ENUM enumerator ENUM FUNCTION enumerator FUNCTION MODIFIER enumerator MODIFIER BITFIELD enumerator BITFIELD ARRAY enumerator ARRAY UNION enumerator UNION STRUCTURE enumerator STRUCTURE INTERFACE enumerator INTERFACE Public Functions Type Type(std::unique_ptr impl) kind KIND kind() const size std::optional size() const Size of the type. This size should match the value of sizeof(...) applied to this type. name std::optional name() const Type ’s name (if present). to_decl std::string to_decl(const DeclOpt &opt = DeclOpt ()) const Generates a C/C++ definition for this type. Tas template inline const T *as() const ~Type virtual ~Type() Public Static Functions create static std::unique_ptr< Type > create(std::unique_ptr impl) Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::forward_iterator_tag, Type , std::ptrdiff_t, const Type *, const Type &> Public Types implementation using implementation = details::TypeIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator* const Type &operator*() const operator-> const Type *operator->() const yield std::unique_ptr< Type > yield() Transfer ownership of the type at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) Array Array class Array : public LIEF::pdb:: Type This class represents a LF_ARRAY PDB type. Public Functions ArgsArray template>> inline Array( Args &&... args) numberof_elements size_t numberof_elements() const The number of elements in this array. element_type std::unique_ptr< Type > element_type() const Type of the elements. index_type std::unique_ptr< Type > index_type() const Type of the index. ~Array ~Array() override Public Static Functions classof static inline bool classof(const Type *type) Attribute (type) Attribute class Attribute This class represents an attribute ( LF_MEMBER ) in an aggregate (class, struct, union, …). Public Functions Attribute Attribute(std::unique_ptr impl) name std::string name() const Name of the attribute. type std::unique_ptr< Type > type() const Type of this attribute. field_offset uint64_t field_offset() const Offset of this attribute in the aggregate. ~Attribute ~Attribute() Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::forward_iterator_tag, Attribute , std::ptrdiff_t, const Attribute *, const Attribute &> Public Types implementation using implementation = details::AttributeIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator* const Attribute &operator*() const operator-> const Attribute *operator->() const yield std::unique_ptr< Attribute > yield() Transfer ownership of the attribute at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) BitField BitField class BitField : public LIEF::pdb:: Type This class represents a LF_BITFIELD PDB type. Public Functions ArgsBitField template>> inline BitField( Args &&... args) ~BitField ~BitField() override Public Static Functions classof static inline bool classof(const Type *type) ClassLike ClassLike class ClassLike : public LIEF::pdb:: Type This class abstracts the following PDB types: LF_STRUCTURE , LF_INTERFACE , LF_CLASS or LF_UNION . Subclassed by LIEF::pdb::types::Class , LIEF::pdb::types::Interface , LIEF::pdb::types::Structure , LIEF::pdb::types::Union Public Types attributes_iterator using attributes_iterator = iterator_range < Attribute :: Iterator > Attributes iterator. methods_iterator using methods_iterator = iterator_range < Method :: Iterator > Methods iterator. Public Functions ArgsClassLike template>> inline ClassLike( Args &&... args) unique_name std::string unique_name() const Mangled type name. attributes attributes_iterator attributes() const Iterator over the different attributes defined in this class-like type. methods methods_iterator methods() const Iterator over the different methods implemented in this class-type type. ~ClassLike ~ClassLike() override Public Static Functions Tclassof template static inline bool classof(const T *, std::enable_if_t>* = 0) Structure Structure class Structure : public LIEF::pdb::types:: ClassLike Interface for the LF_STRUCTURE PDB type. Public Functions ArgsStructure template>> inline Structure( Args &&... args) ~Structure ~Structure() override Public Static Functions classof static inline bool classof(const Type *type) Class Class class Class : public LIEF::pdb::types:: ClassLike Interface for the LF_CLASS PDB type. Public Functions ArgsClass template>> inline Class( Args &&... args) ~Class ~Class() override Public Static Functions classof static inline bool classof(const Type *type) Interface Interface class Interface : public LIEF::pdb::types:: ClassLike Interface for the LF_INTERFACE PDB type. Public Functions ArgsInterface template>> inline Interface( Args &&... args) ~Interface ~Interface() override Public Static Functions classof static inline bool classof(const Type *type) Enum Enum class Enum : public LIEF::pdb:: Type This class represents a LF_ENUM PDB type. Public Functions ArgsEnum template>> inline Enum( Args &&... args) unique_name std::string unique_name() const Enum ’s mangled name. entries std::vector< Entry > entries() const Return the different entries associated with this enum. underlying_type const Type *underlying_type() const The underlying type that is used to encode this enum. find_entry std::optional< Entry > find_entry(int64_t value) const Try to find the enum matching the given value. ~Enum ~Enum() override Public Static Functions classof static inline bool classof(const Type *type) Entry class Entry This class represents an enum entry which is essentially composed of a name and its value (integer). Public Functions Entry Entry(std::unique_ptr impl) Entry Entry( Entry &&other) noexcept operator= Entry &operator=( Entry &&other) noexcept name std::string name() const Enum entry’s name. value int64_t value() const Enum entry’s value (if any). ~Entry ~Entry() Function (type) Function class Function : public LIEF::pdb:: Type This class represents a LF_PROCEDURE PDB type. Public Types parameters_t using parameters_t = std::vector> Public Functions ArgsFunction template>> inline Function( Args &&... args) return_type std::unique_ptr< Type > return_type() const Type returned by the function. parameters parameters_t parameters() const Types of the function’s parameters. ~Function ~Function() override Public Static Functions classof static inline bool classof(const Type *type) Method (type) Method class Method This class represents a Method ( LF_ONEMETHOD ) that can be defined in a ClassLike PDB type ( Class , Structure , Union , Interface ). Public Types TYPE enum class TYPE The type (or property) of the method. Values: VANILLA enumerator VANILLA = 0x00 Regular instance method. VIRTUAL enumerator VIRTUAL = 0x01 Virtual method. STATIC enumerator STATIC = 0x02 Static method. FRIEND enumerator FRIEND = 0x03 Friend method. INTRODUCING_VIRTUAL enumerator INTRODUCING_VIRTUAL = 0x04 Virtual method that introduces a new vtable slot. PURE_VIRTUAL enumerator PURE_VIRTUAL = 0x05 Pure virtual method (abstract). PURE_INTRODUCING_VIRTUAL enumerator PURE_INTRODUCING_VIRTUAL = 0x06 Pure virtual method that introduces a new vtable slot. ACCESS enum class ACCESS : uint8_t Visibility access for the method. Values: NONE enumerator NONE = 0 PRIVATE enumerator PRIVATE = 1 No access specifier (or unknown). PROTECTED enumerator PROTECTED = 2 Private access. PUBLIC enumerator PUBLIC = 3 Protected access. Public Functions Method Method(std::unique_ptr impl) name std::string name() const Name of the method. type TYPE type() const Type/Properties of the method (virtual, static, etc.). access ACCESS access() const Visibility access (public, private, …). ~Method ~Method() Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::forward_iterator_tag, Method , std::ptrdiff_t, const Method *, const Method &> Public Types implementation using implementation = details::MethodIt Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator* const Method &operator*() const operator-> const Method *operator->() const yield std::unique_ptr< Method > yield() Transfer ownership of the method at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) Modifier Modifier class Modifier : public LIEF::pdb:: Type This class represents a LF_MODIFIER PDB type. Public Functions ArgsModifier template>> inline Modifier( Args &&... args) underlying_type std::unique_ptr< Type > underlying_type() const Underlying type targeted by this modifier. ~Modifier ~Modifier() override Public Static Functions classof static inline bool classof(const Type *type) Pointer Pointer class Pointer : public LIEF::pdb:: Type This class represents a LF_POINTER PDB type. Public Functions ArgsPointer template>> inline Pointer( Args &&... args) underlying_type std::unique_ptr< Type > underlying_type() const The underlying type pointed by this pointer. ~Pointer ~Pointer() override Public Static Functions classof static inline bool classof(const Type *type) Simple Simple class Simple : public LIEF::pdb:: Type This class represents primitive types (int, float, …) which are also named simple types in the PDB format. Public Types TYPES enum class TYPES Identifier of the primitive type. These values correspond to the low bits of the CodeView Type Index. Values: UNKNOWN enumerator UNKNOWN = 0 VOID_ enumerator VOID_ = 0x0003 SCHAR enumerator SCHAR = 0x0010 Signed Character. UCHAR enumerator UCHAR = 0x0020 Unsigned Character. RCHAR enumerator RCHAR = 0x0070 “Real” Character (char) WCHAR enumerator WCHAR = 0x0071 Wide Character (wchar_t). CHAR16 enumerator CHAR16 = 0x007a 16-bit Character (char16_t) CHAR32 enumerator CHAR32 = 0x007b 32-bit Character (char32_t) CHAR8 enumerator CHAR8 = 0x007c 8-bit Character (char8_t) SBYTE enumerator SBYTE = 0x0068 Signed Byte. UBYTE enumerator UBYTE = 0x0069 Unsigned Byte. SSHORT enumerator SSHORT = 0x0011 Signed Short. USHORT enumerator USHORT = 0x0021 Unsigned Short. SINT16 enumerator SINT16 = 0x0072 Explicit Signed 16-bit Integer. UINT16 enumerator UINT16 = 0x0073 Explicit Unsigned 16-bit Integer. SLONG enumerator SLONG = 0x0012 Signed Long. ULONG enumerator ULONG = 0x0022 Unsigned Long. SINT32 enumerator SINT32 = 0x0074 Explicit Signed 32-bit Integer. UINT32 enumerator UINT32 = 0x0075 Explicit Unsigned 32-bit Integer. SQUAD enumerator SQUAD = 0x0013 Signed Quadword. UQUAD enumerator UQUAD = 0x0023 Unsigned Quadword. SINT64 enumerator SINT64 = 0x0076 Explicit Signed 64-bit Integer. UINT64 enumerator UINT64 = 0x0077 Explicit Unsigned 64-bit Integer. SOCTA enumerator SOCTA = 0x0014 Signed Octaword. UOCTA enumerator UOCTA = 0x0024 Unsigned Octaword. SINT128 enumerator SINT128 = 0x0078 Explicit Signed 128-bit Integer. UINT128 enumerator UINT128 = 0x0079 Explicit Unsigned 128-bit Integer. FLOAT16 enumerator FLOAT16 = 0x0046 16-bit Floating point FLOAT32 enumerator FLOAT32 = 0x0040 32-bit Floating point (float) FLOAT32_PARTIAL_PRECISION enumerator FLOAT32_PARTIAL_PRECISION = 0x45 FLOAT48 enumerator FLOAT48 = 0x0044 48-bit Floating point FLOAT64 enumerator FLOAT64 = 0x0041 64-bit Floating point (double) FLOAT80 enumerator FLOAT80 = 0x0042 80-bit Floating point FLOAT128 enumerator FLOAT128 = 0x0043 128-bit Floating point COMPLEX16 enumerator COMPLEX16 = 0x0056 COMPLEX32 enumerator COMPLEX32 = 0x0050 COMPLEX32_PARTIAL_PRECISION enumerator COMPLEX32_PARTIAL_PRECISION = 0x0055 COMPLEX48 enumerator COMPLEX48 = 0x0054 COMPLEX64 enumerator COMPLEX64 = 0x0051 COMPLEX80 enumerator COMPLEX80 = 0x0052 COMPLEX128 enumerator COMPLEX128 = 0x0053 BOOL8 enumerator BOOL8 = 0x0030 8-bit Boolean BOOL16 enumerator BOOL16 = 0x0031 16-bit Boolean BOOL32 enumerator BOOL32 = 0x0032 32-bit Boolean BOOL64 enumerator BOOL64 = 0x0033 64-bit Boolean BOOL128 enumerator BOOL128 = 0x0034 128-bit Boolean MODES enum class MODES : uint32_t Modifier applied to the underlying type. In the PDB Simple Type encoding, these represent pointer attributes. Values: DIRECT enumerator DIRECT = 0x00000000 Not a pointer (direct access). FAR_POINTER enumerator FAR_POINTER = 0x00000200 Far pointer. HUGE_POINTER enumerator HUGE_POINTER = 0x00000300 Huge pointer. NEAR_POINTER32 enumerator NEAR_POINTER32 = 0x00000400 32-bit Near pointer FAR_POINTER32 enumerator FAR_POINTER32 = 0x00000500 32-bit Far pointer NEAR_POINTER64 enumerator NEAR_POINTER64 = 0x00000600 64-bit Near pointer NEAR_POINTER128 enumerator NEAR_POINTER128 = 0x00000700 128-bit Near pointer Public Functions ArgsSimple template>> inline Simple( Args &&... args) type TYPES type() const Returns the underlying primitive type. modes MODES modes() const Returns the mode (pointer type) of this Simple type. is_pointer inline bool is_pointer() const Check if this simple type is a pointer. is_signed inline bool is_signed() const Check if the underlying type is signed. ~Simple ~Simple() override Public Static Functions classof static inline bool classof(const Type *type) Union Union class Union : public LIEF::pdb::types:: ClassLike This class represents a LF_UNION PDB type. Public Functions ArgsUnion template>> inline Union( Args &&... args) ~Union ~Union() override Public Static Functions classof static inline bool classof(const Type *type) Utilities LIEF::pdb::is_pdb bool LIEF::pdb::is_pdb(const std::string &pdb_path) Check if the file given in parameter points to a PDB file.", "contentHash": "550c4650c53aaa2ff383b51278f41b83fead207d19200ad65468d43a167192c8", "description": "PDB C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "extended/pdb/cpp", "documentID": "f9ecd9575abf7930cc73d9203870d4426629bb62508511b10066da37ce533cfe", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/pdb/cpp.md", "title": "PDB C++ API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/pdb/index.html", "content": "PDB API C++ Python Rust Introduction Unlike DWARF debug information, PDB debug information is always stored externally from the original binary. Nevertheless, the original binary keeps the path of the PDB file in the lief.PE.CodeViewPDB.filename() ( lief::pe::debug::CodeViewPDB::filename ; lief.PE.CodeViewPDB.filename ; LIEF::PE::CodeViewPDB::filename() ) attribute. Based on this fact, lief.Binary.debug_info() ( lief::pe::Binary::debug_info ; lief.Binary.debug_info ; LIEF::Binary::debug_info() ) tries to instantiate a lief.pdb.DebugInfo ( lief::pdb::DebugInfo ; lief.pdb.DebugInfo ; LIEF::pdb::DebugInfo ) object using this file path. If it fails, it returns nullptr or None . You can also instantiate a lief.pdb.DebugInfo ( lief::pdb::DebugInfo ; lief.pdb.DebugInfo ; LIEF::pdb::DebugInfo ) object using lief.pdb.load() ( lief::pdb::load ; lief.pdb.load() ; LIEF::pdb::load() ): Python pe: lief.PE.Binary if (debug_info := pe.debug_info) is not None: assert isinstance(debug_info, lief.pdb.DebugInfo) print(f\"PDB Debug handler: {debug_info}\") # Or you can load the PDB directly: pdb = lief.pdb.load(\"some.pdb\") C++ std::unique_ptr pe; if (const LIEF::DebugInfo* info = pe->debug_info()) { assert(LIEF::pdb::DebugInfo::classof(info) && \"Wrong DebugInfo type\"); const auto& pdb = static_cast(*info); } // Or loading directly the pdb file std::unique_ptr pdb = LIEF::pdb::load(\"some.pdb\"); Rust let pe: &lief::pe::Binary = some_pe; if let Some(lief::DebugInfo::Pdb(pdb)) = pe.debug_info() { // PDB debug info } let pdb = lief::pdb::load(\"some.pdb\"); At this point, the PDB instance ( lief.pdb.DebugInfo ( lief::pdb::DebugInfo ; lief.pdb.DebugInfo ; LIEF::pdb::DebugInfo )) can be used to explore the PDB debug information: Python pdb: lief.pdb.DebugInfo print(f\"arg={pdb.age}, guid={pdb.guid}\") for sym in pdb.public_symbols: print(f\"name={sym.name}, section={sym.section_name}, RVA={sym.RVA}\") for ty in pdb.types: if isinstance(ty, lief.pdb.types.Class): print(f\"Class[name]={ty.name}\") for cu in pdb.compilation_units: print(f\"module={cu.module_name}\") for src in cu.sources: print(f\" - {src}\") for func in cu.functions: print( f\"name={func.name}, section={func.section_name}, RVA={func.RVA}, code_size={func.code_size}\" ) C++ std::unique_ptr pdb; log(Level::Info, \"age={}, guid={}\", std::to_string(pdb->age()), pdb->guid()); for (const LIEF::pdb::PublicSymbol& symbol : pdb->public_symbols()) { log(Level::Info, \"name={}, section={}, RVA={}\", symbol.name(), symbol.section_name(), std::to_string(symbol.RVA())); } for (const LIEF::pdb::Type& ty : pdb->types()) { if (LIEF::pdb::types::Class::classof(&ty)) { const auto* clazz = ty.as(); log(Level::Info, \"Class[name]={}\", clazz->name().value_or(\"\")); } } for (const LIEF::pdb::CompilationUnit& CU : pdb->compilation_units()) { log(Level::Info, \"module={}\", CU.module_name()); for (const std::string& src : CU.sources()) { log(Level::Info, \" - {}\", src); } for (const LIEF::pdb::Function& func : CU.functions()) { log(Level::Info, \"name={}, section={}, RVA={}, code size={}\", func.name(), func.section_name(), std::to_string(func.RVA()), std::to_string(func.code_size())); } } Rust let pdb = lief::pdb::load(path).unwrap_or_else(|| { process::exit(1); }); println!(\"age={}, guid={}\", pdb.age(), pdb.guid()); for symbol in pdb.public_symbols() { println!( \"name={}, section={}, RVA={}\", symbol.name(), symbol.section_name().unwrap_or(\"\".to_string()), symbol.rva() ); } for ty in pdb.types() { if let lief::pdb::Type::Class(clazz) = ty { println!(\"Class[name]={}\", clazz.name().unwrap_or_default()); } } for cu in pdb.compilation_units() { println!(\"module={}\", cu.module_name()); for src in cu.sources() { println!(\" - {}\", src); } for func in cu.functions() { println!( \"name={}, section={}, RVA={}, code_size={}\", func.name(), func.section_name(), func.rva(), func.code_size() ); } } Attach a PDB to a binary You can also use the lief.abstract.Binary.load_debug_info() ( lief::generic::Binary::load_debug_info ; lief.Binary.load_debug_info() ; LIEF::Binary::load_debug_info() ) function to bind a PDB file to an existing lief.abstract.Binary ( lief::generic::Binary ; lief.Binary ; LIEF::Binary ): Python binary: lief.Binary dbg = binary.load_debug_info(r\"C:\\Users\\romain\\LIEF.pdb\") C++ std::unique_ptr binary; binary->load_debug_info(R\"(C:\\Users\\romain\\LIEF.pdb)\"); Rust let bin: &mut dyn lief::generic::Binary = some_bin; let path = PathBuf::from(\"C:\\\\Users\\\\romain\\\\LIEF.pdb\"); bin.load_debug_info(&path); Note that lief.abstract.Binary.load_debug_info() ( lief::generic::Binary::load_debug_info ; lief.Binary.load_debug_info() ; LIEF::Binary::load_debug_info() ) can also attach an external DWARF file to a PE binary, even though this is not a typical use case. For instance, the BinaryNinja and Ghidra DWARF export plugins can generate a DWARF file for a PE binary based on analysis performed by these frameworks. This external loading API is useful for adding debug information that might not already be present in the binary. For instance, the lief.Binary.disassemble() ( lief::generic::Binary::disassemble ; lief::generic::Binary::disassemble_symbol ; lief::generic::Binary::disassemble_address ; lief::generic::Binary::disassemble_slice ; LIEF::Binary::disassemble() ; lief.Binary.disassemble() ; lief.Binary.disassemble_from_bytes() ) function can leverage this additional debug information to disassemble functions defined in the debug file previously loaded: Python binary: lief.Binary dbg = binary.load_debug_info(r\"C:\\Users\\romain\\LIEF.pdb\") # The location (address/size) of `my_function` is defined in LIEF.pdb for inst in binary.disassemble(\"my_function\"): print(inst) C++ std::unique_ptr binary; binary->load_debug_info(R\"(C:\\Users\\romain\\LIEF.pdb)\"); // The location (address/size) of `my_function` is defined in LIEF.pdb for (const LIEF::assembly::Instruction& inst : binary->disassemble(\"my_function\")) { std::cout << inst << '\\n'; } Rust let bin: &mut dyn lief::generic::Binary = some_bin; let path = PathBuf::from(\"C:\\\\Users\\\\romain\\\\LIEF.pdb\"); bin.load_debug_info(&path); // The location (address/size) of `my_function` is defined in LIEF.pdb for inst in bin.disassemble_symbol(\"my_function\") { println!(\"{inst}\"); } Generating C/C++ Definitions PDB types, functions and compilation units can be turned into C/C++ definitions using the to_decl() function: lief.pdb.Type.to_decl() ( lief::pdb::Type::to_decl ; lief::pdb::Type::to_decl_with_opt ; lief.pdb.Type.to_decl() ; LIEF::pdb::Type::to_decl() ) lief.pdb.Function.to_decl() ( lief::pdb::Function::to_decl ; lief::pdb::Function::to_decl_with_opt ; lief.pdb.Function.to_decl() ; LIEF::pdb::Function::to_decl() ) lief.pdb.CompilationUnit.to_decl() ( lief::pdb::CompilationUnit::to_decl ; lief::pdb::CompilationUnit::to_decl_with_opt ; lief.pdb.CompilationUnit.to_decl() ; LIEF::pdb::CompilationUnit::to_decl() ) The generated output can be configured with a lief.DeclOpt ( lief::DeclOpt ; lief.DeclOpt ; LIEF::DeclOpt ) structure: Python pdb: lief.pdb.DebugInfo opt = lief.DeclOpt() opt.is_cpp = True for ty in pdb.types: print(ty.to_decl(opt)) for cu in pdb.compilation_units: # Emit the definition of the functions of the compilation unit print(cu.to_decl(opt)) for func in cu.functions: print(func.to_decl(opt)) C++ std::unique_ptr pdb; LIEF::DeclOpt opt; opt.is_cpp(true); for (const LIEF::pdb::Type& ty : pdb->types()) { std::cout << ty.to_decl(opt) << '\\n'; } for (const LIEF::pdb::CompilationUnit& CU : pdb->compilation_units()) { std::cout << CU.to_decl(opt) << '\\n'; for (const LIEF::pdb::Function& func : CU.functions()) { std::cout << func.to_decl(opt) << '\\n'; } } Rust let pdb: &lief::pdb::DebugInfo = some_pdb; let opt = lief::DeclOpt { is_cpp: true, ..Default::default() }; for ty in pdb.types() { println!(\"{}\", ty.to_decl_with_opt(&opt)); } for cu in pdb.compilation_units() { println!(\"{}\", cu.to_decl_with_opt(&opt)); for func in cu.functions() { println!(\"{}\", func.to_decl_with_opt(&opt)); } } API You can find the documentation of the API for the different languages here: Python API C++ API Rust API: lief::pdb", "contentHash": "98cb9d75b8cf00ddb5de464213b530a766a0bc28cfa69f610da733676e00b03b", "description": "Locate and load PDB debug information, associate it with a PE binary, inspect symbols and types, and generate C++ declarations with LIEF Extended.", "docname": "extended/pdb/index", "documentID": "8fde65b34ef071cf986043126072ebc822d99a8148416f7a669512d67f88be6c", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/pdb/index.md", "title": "PDB - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/pdb/python.html", "content": "Python lief.pdb.load lief.pdb.load( path: str ) → lief.pdb.DebugInfo | None Load the PDB from the given path DebugInfo lief.pdb.DebugInfo class lief.pdb.DebugInfo Bases: DebugInfo This class provides an interface for PDB files. One can instantiate this class using lief.pdb.load() or lief.pdb.DebugInfo.from_file() age property age → int The number of times the PDB file has been written. compilation_units property compilation_units → Iterator[ lief.pdb.CompilationUnit | None] Iterator over the CompilationUnit from the PDB’s DBI stream. CompilationUnit are also named “Module” in the PDB’s official documentation find_public_symbol find_public_symbol( self , name: str ) → lief._lief.pdb.PublicSymbol | None Try to find the PublicSymbol from the given name (based on the public symbol stream) The function returns None if the symbol can’t be found. debug_info: lief.pdb.DebugInfo = ... if sym := debug_info.find_public_symbol(\"MiSyncSystemPdes\"): print(\"found\") find_typefind_type find_type( self , name: str ) → lief._lief.pdb.Type | None find_type( self , index: int ) → lief._lief.pdb.Type | None Overloaded function. find_type(self, name: str) -> Optional[lief._lief.pdb.Type] Find the type with the given name find_type(self, index: int) -> Optional[lief._lief.pdb.Type] Find type at the given index from_file from_file( filepath: str | os.PathLike ) → lief.pdb.DebugInfo | None = guid property guid → str Unique identifier of the PDB file. public_symbols property public_symbols → Iterator[ lief.pdb.PublicSymbol | None] Return an iterator over the public symbol stream. types property types → Iterator[ lief.pdb.Type | None] Return an iterator over the different types registered in this PDB file CompilationUnit lief.pdb.CompilationUnit class lief.pdb.CompilationUnit Bases: object This class represents a Compilation Unit (or Module) in a PDB file build_metadata property build_metadata → lief.pdb.BuildMetadata | None functions property functions → Iterator[ lief.pdb.Function | None] Return an iterator over the functions defined in this compilation unit. If the PDB does not contain or has an empty DBI stream, it returns an empty iterator. module_name property module_name → str Name (or path) to the COFF object ( .obj ) associated with this compilation unit (e.g. e:\\obj.amd64fre\\minkernel\\ntos\\hvl\\mp\\objfre\\amd64\\hvlp.obj ) object_filename property object_filename → str Name of path to the original binary object (COFF, Archive) in which the compilation unit was located before being linked. e.g. e:\\obj.amd64fre\\minkernel\\ntos\\hvl\\mp\\objfre\\amd64\\hvl.lib sources property sources → Iterator[str] Iterator over the sources files that compose this compilation unit. These files include headers ( .h, .hpp , …). to_decl to_decl( self , opt: lief._lief.DeclOpt | None = None ) → str Generates a C/C++ definition for the functions defined in this compilation unit BuildMetadata lief.pdb.BuildMetadata class lief.pdb.BuildMetadata Bases: object This class wraps build metadata represented by the codeview symbols: S_COMPILE3, S_COMPILE2, S_BUILDINFO CPU class CPU( *values ) Bases: Enum ALPHA ALPHA = 48 ALPHA_21164 ALPHA_21164 = 49 ALPHA_21164A ALPHA_21164A = 50 ALPHA_21264 ALPHA_21264 = 51 ALPHA_21364 ALPHA_21364 = 52 AM33 AM33 = 160 ARM3 ARM3 = 96 ARM4 ARM4 = 97 ARM4T ARM4T = 98 ARM5 ARM5 = 99 ARM5T ARM5T = 100 ARM6 ARM6 = 101 ARM64 ARM64 = 246 ARM64EC ARM64EC = 248 ARM64X ARM64X = 249 ARM7 ARM7 = 104 ARMNT ARMNT = 244 ARM_WMMX ARM_WMMX = 103 ARM_XMAC ARM_XMAC = 102 CEE CEE = 144 D3D11_SHADER D3D11_SHADER = 256 EBC EBC = 224 HYBRID_X86ARM64 HYBRID_X86ARM64 = 247 IA64 IA64 = 128 IA64_2 IA64_2 = 129 INTEL_80286 INTEL_80286 = 2 INTEL_80386 INTEL_80386 = 3 INTEL_80486 INTEL_80486 = 4 INTEL_8080 INTEL_8080 = 0 INTEL_8086 INTEL_8086 = 1 M32R M32R = 176 M68000 M68000 = 32 M68010 M68010 = 33 M68020 M68020 = 34 M68030 M68030 = 35 M68040 M68040 = 36 MIPS MIPS = 16 MIPS16 MIPS16 = 17 MIPS32 MIPS32 = 18 MIPS64 MIPS64 = 19 MIPSI MIPSI = 20 MIPSII MIPSII = 21 MIPSIII MIPSIII = 22 MIPSIV MIPSIV = 23 MIPSV MIPSV = 24 OMNI OMNI = 112 PENTIUM PENTIUM = 5 PENTIUM3 PENTIUM3 = 7 PENTIUMPRO PENTIUMPRO = 6 PPC601 PPC601 = 64 PPC603 PPC603 = 65 PPC604 PPC604 = 66 PPC620 PPC620 = 67 PPCBE PPCBE = 69 PPCFP PPCFP = 68 SH3 SH3 = 80 SH3DSP SH3DSP = 82 SH3E SH3E = 81 SH4 SH4 = 83 SHMEDIA SHMEDIA = 84 THUMB THUMB = 240 TRICORE TRICORE = 192 UNKNOWN UNKNOWN = 255 X64 X64 = 208 LANG class LANG( *values ) Bases: Enum ALIASOBJ ALIASOBJ = 20 BASIC BASIC = 5 C C = 0 COBOL COBOL = 6 CPP CPP = 1 CSHARP CSHARP = 10 CVTPGD CVTPGD = 9 CVTRES CVTRES = 8 FORTRAN FORTRAN = 2 GO GO = 22 HLSL HLSL = 16 ILASM ILASM = 12 JAVA JAVA = 13 JSCRIPT JSCRIPT = 14 LINK LINK = 7 MASM MASM = 3 MSIL MSIL = 15 OBJC OBJC = 17 OBJCPP OBJCPP = 18 PASCAL_LANG PASCAL_LANG = 4 RUST RUST = 21 SWIFT SWIFT = 19 UNKNOWN UNKNOWN = 255 VB VB = 11 backend_version property backend_version → lief.pdb.BuildMetadata.version_t Version of the backend (e.g. 14.36.32537 ) build_info property build_info → lief.pdb.BuildMetadata.build_info_t | None Build information represented by the S_BUILDINFO symbol build_info_t class build_info_t Bases: object Build information represented by the S_BUILDINFO symbol build_tool property build_tool → str Path to the build tool (e.g. C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\VC\\Tools\\MSVC\\14.36.32532\\bin\\HostX64\\x64\\CL.exe command_line property command_line → str Command line arguments used to invoke the build tool cwd property cwd → str Working directory where the build tool was invoked pdb property pdb → str PDB path source_file property source_file → str Source file consumed by the build tool env property env → list[str] Environment information represented by the S_ENVBLOCK symbol frontend_version property frontend_version → lief.pdb.BuildMetadata.version_t Version of the frontend (e.g. 19.36.32537 ) language property language → lief.pdb.BuildMetadata.LANG Source language target_cpu property target_cpu → lief.pdb.BuildMetadata.CPU Target CPU version property version → str Version of the tool as a string. For instance, Microsoft (R) CVTRES , Microsoft (R) LINK . version_t class version_t Bases: object This structure represents a version for the backend or the frontend build property build → int Build version major property major → int Major version minor property minor → int Minor version qfe property qfe → int Quick Fix Engineering version PublicSymbol lief.pdb.PublicSymbol class lief.pdb.PublicSymbol Bases: object This class provides general information (RVA, name) about a symbol from the PDB’s public symbol stream (or Public symbol hash stream) RVA property RVA → int Relative Virtual Address of this symbol. This function returns 0 if the RVA can’t be computed. demangled_name property demangled_name → str Demangled representation of the symbol name property name → str Name of the symbol section_name property section_name → str Name of the section in which this symbol is defined (e.g. .text ). This function returns an empty string if the section’s name can’t be found Function lief.pdb.Function class lief.pdb.Function Bases: object RVA property RVA → int The Relative Virtual Address of the function code_size property code_size → int The size of the function debug_location property debug_location → lief.debug_location_t Original source code location. name property name → str Name of the function section_name property section_name → str The name of the section in which this function is defined to_decl to_decl( self , opt: lief._lief.DeclOpt | None = None ) → str Generates a C/C++ definition for this function Type lief.pdb.Type class lief.pdb.Type Bases: object KIND class KIND( *values ) Bases: Enum ARRAY ARRAY = 8 BITFIELD BITFIELD = 7 CLASS CLASS = 1 ENUM ENUM = 4 FUNCTION FUNCTION = 5 INTERFACE INTERFACE = 11 MODIFIER MODIFIER = 6 POINTER POINTER = 2 SIMPLE SIMPLE = 3 STRUCTURE STRUCTURE = 10 UNION UNION = 9 UNKNOWN UNKNOWN = 0 kind property kind → lief.pdb.Type.KIND Discriminator for the type’s subclasses name property name → str | None Type’s name (if present) size property size → int | None Size of the type. This size should match the value of sizeof(...) applied to this type. to_decl to_decl( self , opt: lief._lief.DeclOpt | None = None ) → str Generates a C/C++ definition for this type Array lief.pdb.types.Array class lief.pdb.types.Array Bases: Type This class represents a LF_ARRAY PDB type. element_type property element_type → lief.pdb.Type | None Type of the elements index_type property index_type → lief.pdb.Type | None Type of the index numberof_elements property numberof_elements → int Number of elements in this array Attribute (type) lief.pdb.types.Attribute class lief.pdb.types.Attribute Bases: object This class represents an attribute ( LF_MEMBER ) in an aggregate (class, struct, union, …) field_offset property field_offset → int Offset of this attribute in the aggregate name property name → str Name of this attribute. type property type → lief.pdb.Type | None Type of this attribute BitField lief.pdb.types.BitField class lief.pdb.types.BitField Bases: Type This class represents a LF_BITFIELD PDB type ClassLike lief.pdb.types.ClassLike class lief.pdb.types.ClassLike Bases: Type This class abstracts the following PDB types: LF_STRUCTURE , LF_INTERFACE , LF_CLASS or LF_UNION . attributes property attributes → Iterator[ lief.pdb.types.Attribute | None] Return an iterator over the different attributes defined in this class-like type methods property methods → Iterator[ lief.pdb.types.Method | None] Return an iterator over the different methods implemented in this class-like type unique_name property unique_name → str Mangled type name. Structure lief.pdb.types.Structure class lief.pdb.types.Structure Bases: ClassLike Interface for the LF_STRUCTURE PDB type Class lief.pdb.types.Class class lief.pdb.types.Class Bases: ClassLike Interface for the LF_CLASS PDB type Interface lief.pdb.types.Interface class lief.pdb.types.Interface Bases: ClassLike Interface for the LF_INTERFACE PDB type Enum lief.pdb.types.Enum class lief.pdb.types.Enum Bases: Type This class represents a LF_ENUM PDB type Entry class Entry Bases: object This class represents an enum entry which is essentially composed of a name and its value (integer). name property name → str Enum entry’s name value property value → int Enum entry’s value (if any) entries property entries → list[ lief.pdb.types.Enum.Entry ] Return the different entries associated with this enum find_entry find_entry( self , value: int ) → lief._lief.pdb.types.Enum.Entry | None Try to find the enum matching the given value underlying_type property underlying_type → lief.pdb.Type | None The underlying type that is used to encode this enum unique_name property unique_name → str Enum’s mangled name Function (type) lief.pdb.types.Function class lief.pdb.types.Function Bases: Type This class represents a LF_PROCEDURE PDB type parameters property parameters → list[ lief.pdb.Type | None] Types of the function’s parameters return_type property return_type → lief.pdb.Type | None Type returned by this function Method (type) lief.pdb.types.Method class lief.pdb.types.Method Bases: object This class represents a Method ( LF_ONEMETHOD ) that can be defined in ClassLike PDB type ACCESS class ACCESS( *values ) Bases: Enum NONE NONE = 0 PRIVATE PRIVATE = 1 PROTECTED PROTECTED = 2 PUBLIC PUBLIC = 3 TYPE class TYPE( *values ) Bases: Enum FRIEND FRIEND = 3 INTRODUCING_VIRTUAL INTRODUCING_VIRTUAL = 4 PURE_INTRODUCING_VIRTUAL PURE_INTRODUCING_VIRTUAL = 6 PURE_VIRTUAL PURE_VIRTUAL = 5 STATIC STATIC = 2 VANILLA VANILLA = 0 VIRTUAL VIRTUAL = 1 access property access → lief.pdb.types.Method.ACCESS Visibility access (public, private, …) name property name → str Name of the method type property type → lief.pdb.types.Method.TYPE Type/Properties of the method (virtual, static, etc.) Modifier lief.pdb.types.Modifier class lief.pdb.types.Modifier Bases: Type This class represents a LF_MODIFIER PDB type underlying_type property underlying_type → lief.pdb.Type | None Underlying type targeted by this modifier Pointer lief.pdb.types.Pointer class lief.pdb.types.Pointer Bases: Type This class represents a LF_POINTER PDB type underlying_type property underlying_type → lief.pdb.Type | None The underlying type pointed to by this pointer Simple lief.pdb.types.Simple class lief.pdb.types.Simple Bases: Type This class represents primitive types (int, float, …) which are also named simple types in the PDB format. MODES class MODES( *values ) Bases: Enum DIRECT DIRECT = 0 FAR_POINTER FAR_POINTER = 512 FAR_POINTER32 FAR_POINTER32 = 1280 HUGE_POINTER HUGE_POINTER = 768 NEAR_POINTER128 NEAR_POINTER128 = 1792 NEAR_POINTER32 NEAR_POINTER32 = 1024 NEAR_POINTER64 NEAR_POINTER64 = 1536 TYPES class TYPES( *values ) Bases: Enum BOOL128 BOOL128 = 52 BOOL16 BOOL16 = 49 BOOL32 BOOL32 = 50 BOOL64 BOOL64 = 51 BOOL8 BOOL8 = 48 CHAR16 CHAR16 = 122 CHAR32 CHAR32 = 123 CHAR8 CHAR8 = 124 COMPLEX128 COMPLEX128 = 83 COMPLEX16 COMPLEX16 = 86 COMPLEX32 COMPLEX32 = 80 COMPLEX32_PARTIAL_PRECISION COMPLEX32_PARTIAL_PRECISION = 85 COMPLEX48 COMPLEX48 = 84 COMPLEX64 COMPLEX64 = 81 COMPLEX80 COMPLEX80 = 82 FLOAT128 FLOAT128 = 67 FLOAT16 FLOAT16 = 70 FLOAT32 FLOAT32 = 64 FLOAT32_PARTIAL_PRECISION FLOAT32_PARTIAL_PRECISION = 69 FLOAT48 FLOAT48 = 68 FLOAT64 FLOAT64 = 65 FLOAT80 FLOAT80 = 66 RCHAR RCHAR = 112 SBYTE SBYTE = 104 SCHAR SCHAR = 16 SINT128 SINT128 = 120 SINT16 SINT16 = 114 SINT32 SINT32 = 116 SINT64 SINT64 = 118 SLONG SLONG = 18 SOCTA SOCTA = 20 SQUAD SQUAD = 19 SSHORT SSHORT = 17 UBYTE UBYTE = 105 UCHAR UCHAR = 32 UINT128 UINT128 = 121 UINT16 UINT16 = 115 UINT32 UINT32 = 117 UINT64 UINT64 = 119 ULONG ULONG = 34 UNKNOWN UNKNOWN = 0 UOCTA UOCTA = 36 UQUAD UQUAD = 35 USHORT USHORT = 33 VOID VOID = 3 WCHAR WCHAR = 113 is_pointer property is_pointer → bool Check if this simple type is a pointer. is_signed property is_signed → bool Check if the underlying type is signed. modes property modes → lief.pdb.types.Simple.MODES Returns the mode (pointer type) of this Simple type. type property type → lief.pdb.types.Simple.TYPES Returns the underlying primitive type. Union lief.pdb.types.Union class lief.pdb.types.Union Bases: ClassLike This class represents a LF_UNION PDB type Utilities lief.is_pdb lief.is_pdb( file: str | os.PathLike ) → bool Check if the given file is a PDB", "contentHash": "43b8ccd61271994ae2acf504b5661d65b37a46a5d8ea466dd4c79326cc4f82bf", "description": "PDB Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "extended/pdb/python", "documentID": "88121a5f381e7fbef87bbb8127d3dbcd61a1d2e84ba88a9801ccd72dbb538e80", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/pdb/python.md", "title": "PDB Python API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/extended/pdb/rust.html", "content": "Rust Note Please check: lief::pdb", "contentHash": "a69d3630c5ec87847ea570b81116a1afc40ad3582d730edc28be970d0a70af5f", "description": "PDB Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "extended/pdb/rust", "documentID": "d7ccefb715b985f9711912b177aa384d23258889d6b22b1b9fe4d61c98a59c6e", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/extended/pdb/rust.md", "title": "PDB Rust API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/android/art/cpp.html", "content": "C++ Utilities LIEF::ART::is_art bool LIEF::ART::is_art(std::string_view file) Check if the given file is an ART one. LIEF::ART::is_art bool LIEF::ART::is_art(const std::vector &raw) Check if the given raw data is an ART one. LIEF::ART::version art_version_t LIEF::ART::version(std::string_view file) Return the ART version of the given file. LIEF::ART::version art_version_t LIEF::ART::version(const std::vector &raw) Return the ART version of the raw data. LIEF::ART::android_version LIEF::Android:: ANDROID_VERSIONS LIEF::ART::android_version(art_version_t version) Return the ANDROID_VERSIONS associated with the given ART version. Parser Parser class Parser Class which parses an ART file and transforms it into an ART::File object. Public Functions operator= Parser &operator=(const Parser ©) = delete Parser Parser(const Parser ©) = delete Public Static Functions parse static std::unique_ptr< File > parse(std::string_view file) PathTparse template = 0> static inline std::unique_ptr< File > parse(const PathT &file) Same as parse(std::string_view) but the file is given as a std::filesystem::path . parse static std::unique_ptr< File > parse(std::vector data, std::string_view name = \"\") File File class File : public LIEF::Object Public Functions operator= File &operator=(const File ©) = delete File File(const File ©) = delete header const Header &header() const header Header &header() accept virtual void accept(Visitor &visitor) const override ~File ~File() override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const File &art_file) Header Header class Header : public LIEF::Object Public Types magic_t using magic_t = std::array Public Functions Header Header() THeader template Header(const T *header) Header Header(const Header &) operator= Header &operator=(const Header &) magic magic_t magic() const version art_version_t version() const image_begin uint32_t image_begin() const image_size uint32_t image_size() const oat_checksum uint32_t oat_checksum() const oat_file_begin uint32_t oat_file_begin() const oat_file_end uint32_t oat_file_end() const oat_data_begin uint32_t oat_data_begin() const oat_data_end uint32_t oat_data_end() const patch_delta int32_t patch_delta() const image_roots uint32_t image_roots() const pointer_size uint32_t pointer_size() const compile_pic bool compile_pic() const nb_sections uint32_t nb_sections() const nb_methods uint32_t nb_methods() const boot_image_begin uint32_t boot_image_begin() const boot_image_size uint32_t boot_image_size() const boot_oat_begin uint32_t boot_oat_begin() const boot_oat_size uint32_t boot_oat_size() const storage_mode STORAGE_MODES storage_mode() const data_size uint32_t data_size() const accept virtual void accept(Visitor &visitor) const override ~Header ~Header() override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Header &hdr)", "contentHash": "a2a7eaff96486e530b8aa263396eb0f1b61d5f383161021cbae9ca06af8a74aa", "description": "ART C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "formats/android/art/cpp", "documentID": "0c9c18912be25a6405c7b94c0d74ecb4491d3a51311de386ed4a80acbc9986bd", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/android/art/cpp.md", "title": "ART C++ API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/android/art/index.html", "content": "ART API C++ Python LIEF provides basic support for Android’s ART files. For details about this format, please refer to the Android Formats tutorial.", "contentHash": "4e2fd0bb1e578395068bad92c1f97fd3a098480c9729984dccf54737255b6fb8", "description": "ART in Android. LIEF provides basic support for Android’s ART files. For details about this format, please refer to the Android Formats tutorial.", "docname": "formats/android/art/index", "documentID": "ef58a17741ed7b1cfc52ec4a778094d04f9fffabca3ada04ad7437ac2d910df6", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/android/art/index.md", "title": "ART - Android - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/android/art/python.html", "content": "Python Utilities lief.is_artlief.is_art lief.is_art( *args ) → bool lief.is_art( raw: collections.abc.Sequence[int] ) → bool Overloaded function. is_art(path: str) -> bool Check if the file given in parameter is an ART is_art(raw: collections.abc.Sequence[int]) -> bool Check if the raw data given in parameter is an ART lief.ART.versionlief.ART.version lief.ART.version( *args ) → int lief.ART.version( raw: collections.abc.Sequence[int] ) → int Overloaded function. version(file: str) -> int Return the ART version of the file given in parameter version(raw: collections.abc.Sequence[int]) -> int Return the ART version of the raw data given in parameter lief.ART.android_version lief.ART.android_version( art_version: int ) → lief.Android.ANDROID_VERSIONS Return the ANDROID_VERSIONS associated with the given ART version Parser lief.ART.parselief.ART.parselief.ART.parse lief.ART.parse( *args ) → lief.ART.File | None **lief.ART.parse( raw: collections.abc.Sequence[int] , name: str = '' ) → lief._lief.ART.File | None lief.ART.parse( obj: str | io.IOBase | os.PathLike | bytes | list[int] , name: str = '' ) → lief._lief.ART.File | None ** Overloaded function. parse(filename: str) -> Optional[lief._lief.ART.File] Parse the given filename and return an File object parse(raw: collections.abc.Sequence[int], name: str = '') -> Optional[lief._lief.ART.File] Parse the given raw data and return an File object parse(obj: Union[str | io.IOBase | os.PathLike | bytes | list[int]], name: str = '') -> Optional[lief._lief.ART.File] File lief.ART.File class lief.ART.File Bases: Object ART File representation header property header → lief.ART.Header Return the ART Header Header lief.ART.Header class lief.ART.Header Bases: Object ART Header representation boot_image_begin property boot_image_begin → int boot_image_size property boot_image_size → int boot_oat_begin property boot_oat_begin → int boot_oat_size property boot_oat_size → int compile_pic property compile_pic → bool data_size property data_size → int image_begin property image_begin → int image_roots property image_roots → int image_size property image_size → int magic property magic → list[int] nb_methods property nb_methods → int nb_sections property nb_sections → int oat_checksum property oat_checksum → int oat_data_end property oat_data_end → int oat_file_begin property oat_file_begin → int oat_file_end property oat_file_end → int patch_delta property patch_delta → int pointer_size property pointer_size → int storage_mode property storage_mode → lief.ART.STORAGE_MODES version property version → int", "contentHash": "68037f5852582fefea05bcb9a7f599285c6c7923de4bbb8f74e25f8576d0c2e2", "description": "ART Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "formats/android/art/python", "documentID": "2143a597977c7c2186fed2f4ea4444ef4d333c9504d1a90a46c10a9e56d8b7c9", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/android/art/python.md", "title": "ART Python API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/android/dex/cpp.html", "content": "C++ Utilities LIEF::DEX::is_dex bool LIEF::DEX::is_dex(std::string_view file) Check if the given file is a DEX. LIEF::DEX::is_dex bool LIEF::DEX::is_dex(const std::vector &raw) Check if the given raw data is a DEX. LIEF::DEX::version dex_version_t LIEF::DEX::version(std::string_view file) Return the DEX version of the given file. LIEF::DEX::version dex_version_t LIEF::DEX::version(const std::vector &raw) Return the DEX version of the raw data. Parser Parser class Parser Class which parses a DEX file to produce a DEX::File object. Public Functions operator= Parser &operator=(const Parser ©) = delete Parser Parser(const Parser ©) = delete Public Static Functions parse static std::unique_ptr< File > parse(std::string_view file) Parse the DEX file from the file path given in parameter. PathTparse template = 0> static inline std::unique_ptr< File > parse(const PathT &file) Same as parse(std::string_view) but the file is given as a std::filesystem::path . parse static std::unique_ptr< File > parse(std::vector data, std::string_view name = \"\") File File class File : public LIEF::Object Class that represents a DEX file. Public Types classes_t using classes_t = std::unordered_map classes_list_t using classes_list_t = std::vector> it_classes using it_classes = ref_iterator < classes_list_t &, Class *> it_const_classes using it_const_classes = const_ref_iterator methods_t using methods_t = std::vector> it_methods using it_methods = ref_iterator < methods_t &, Method *> it_const_methods using it_const_methods = const_ref_iterator strings_t using strings_t = std::vector> it_strings using it_strings = ref_iterator < strings_t &, std::string*> it_const_strings using it_const_strings = const_ref_iterator types_t using types_t = std::vector> it_types using it_types = ref_iterator < types_t &, Type *> it_const_types using it_const_types = const_ref_iterator prototypes_t using prototypes_t = std::vector> it_prototypes using it_prototypes = ref_iterator < prototypes_t &, Prototype *> it_const_prototypes using it_const_prototypes = const_ref_iterator fields_t using fields_t = std::vector> it_fields using it_fields = ref_iterator < fields_t &, Field *> it_const_fields using it_const_fields = const_ref_iterator Public Functions operator= File &operator=(const File ©) = delete File File(const File ©) = delete version dex_version_t version() const Version of the current DEX file. name std::string_view name() const Name of this file. name void name(const std::string &name) location std::string_view location() const Location of this file. location void location(const std::string &location) header const Header &header() const DEX header. header Header &header() classes it_const_classes classes() const All classes used in the DEX file classes it_classes classes() has_class bool has_class(const std::string &class_name) const Check if the given class name exists. get_class const Class *get_class(const std::string &class_name) const Return the DEX::Class object associated with the given name. get_class Class *get_class(const std::string &class_name) get_class const Class *get_class(size_t index) const Return the DEX::Class object associated with the given index. get_class Class *get_class(size_t index) dex2dex_info dex2dex_info_t dex2dex_info() const De-optimize information. dex2dex_json_info std::string dex2dex_json_info() const De-optimize information as JSON. methods it_const_methods methods() const Return an iterator over all the DEX::Method used in this DEX file. methods it_methods methods() fields it_const_fields fields() const Return an iterator over all the DEX::Field used in this DEX file. fields it_fields fields() strings it_const_strings strings() const String pool. strings it_strings strings() types it_const_types types() const Type pool. types it_types types() prototypes it_prototypes prototypes() Prototype pool. prototypes it_const_prototypes prototypes() const map const MapList &map() const DEX Map. map MapList &map() save std::string save(const std::string &path = \"\", bool deoptimize = true) const Extract the current dex file and deoptimize it. raw std::vector raw(bool deoptimize = true) const accept virtual void accept(Visitor &visitor) const override ~File ~File() override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const File &file) Header Header class Header : public LIEF::Object Class which represents the DEX header. This is the first structure that begins the DEX format. The official documentation is provided here: https://source.android.com/devices/tech/dalvik/dex-format#header-item Public Types location_t using location_t = std::pair magic_t using magic_t = std::array signature_t using signature_t = std::array Public Functions Header Header() Header Header(const Header &) operator= Header &operator=(const Header &) THeader template Header(const T &header) magic magic_t magic() const The DEX magic bytes ( DEX\\n followed by the DEX version). checksum uint32_t checksum() const The file checksum. signature signature_t signature() const SHA-1 DEX signature (which is not really used as a signature). file_size uint32_t file_size() const Size of the entire file (including the current the header). header_size uint32_t header_size() const Size of this header. It should be 0x70. endian_tag uint32_t endian_tag() const File endianness of the file. map uint32_t map() const Offset from the start of the file to the map list (see: DEX::MapList ). strings location_t strings() const Offset and size of the string pool. link location_t link() const types location_t types() const prototypes location_t prototypes() const fields location_t fields() const methods location_t methods() const classes location_t classes() const data location_t data() const nb_classes uint32_t nb_classes() const nb_methods uint32_t nb_methods() const accept virtual void accept(Visitor &visitor) const override ~Header ~Header() override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Header &hdr) Method Method class Method : public LIEF::Object Class which represents a DEX::Method . Public Types access_flags_list_t using access_flags_list_t = std::vector bytecode_t using bytecode_t = std::vector Public Functions Method Method() Method Method(std::string name, Class *parent = nullptr) Method Method(const Method &) operator= Method &operator=(const Method &) name std::string_view name() const Name of the Method . has_class bool has_class() const True if a class is associated with this method. cls const Class *cls() const DEX::Class associated with this Method or a nullptr if not resolved. cls Class *cls() code_offset uint64_t code_offset() const Offset to the Dalvik Bytecode. bytecode const bytecode_t &bytecode() const Dalvik Bytecode as bytes. index size_t index() const Index in the DEX Methods pool. is_virtual bool is_virtual() const True if this method is a virtual one. i.e. not static , private , final or constructor. prototype const Prototype *prototype() const Method ’s prototype or a nullptr if it is not resolved. prototype Prototype *prototype() insert_dex2dex_info void insert_dex2dex_info(uint32_t pc, uint32_t index) accept virtual void accept(Visitor &visitor) const override dex2dex_info const dex2dex_method_info_t &dex2dex_info() const has bool has(ACCESS_FLAGS f) const Check if the current method has the given ACCESS_FLAGS. access_flags access_flags_list_t access_flags() const ACCESS_FLAGS as an std::set. code_info const CodeInfo &code_info() const ~Method ~Method() override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Method &mtd) Class Class class Class : public LIEF::Object Class which represents a DEX Class (i.e. a Java/Kotlin class). Public Types access_flags_list_t using access_flags_list_t = std::vector methods_t using methods_t = std::vector< Method *> it_methods using it_methods = ref_iterator < methods_t &> it_const_methods using it_const_methods = const_ref_iterator fields_t using fields_t = std::vector< Field *> it_fields using it_fields = ref_iterator < fields_t &> it_const_fields using it_const_fields = const_ref_iterator it_named_methods using it_named_methods = filter_iterator < methods_t &> it_const_named_methods using it_const_named_methods = const_filter_iterator it_named_fields using it_named_fields = filter_iterator < fields_t &> it_const_named_fields using it_const_named_fields = const_filter_iterator Public Functions Class Class() Class Class(const Class &) = delete operator= Class &operator=(const Class &) = delete Class Class(std::string fullname, uint32_t access_flags = ACCESS_FLAGS::ACC_UNKNOWN, Class *parent = nullptr, std::string source_filename = \"\") fullname std::string_view fullname() const Mangled class name (e.g. Lcom/example/android/MyActivity; ). package_name std::string package_name() const Package Name. name std::string name() const Class name. pretty_name std::string pretty_name() const Demangled class name. has bool has(ACCESS_FLAGS f) const Check if the class has the given access flag. access_flags access_flags_list_t access_flags() const Access flags used by this class. source_filename std::string_view source_filename() const Filename associated with this class (if any). has_parent bool has_parent() const True if the current class extends another one. parent const Class *parent() const Parent class. parent Class *parent() methods it_const_methods methods() const Methods implemented in this class. methods it_methods methods() methods it_named_methods methods(const std::string &name) Return Methods having the given name. methods it_const_named_methods methods(const std::string &name) const fields it_const_fields fields() const Fields implemented in this class. fields it_fields fields() fields it_named_fields fields(const std::string &name) Return Fields having the given name. fields it_const_named_fields fields(const std::string &name) const dex2dex_info dex2dex_class_info_t dex2dex_info() const De-optimize information. index size_t index() const Original index in the DEX class pool. accept virtual void accept(Visitor &visitor) const override ~Class ~Class() override Public Static Functions package_normalized static std::string package_normalized(const std::string &pkg_name) fullname_normalized static std::string fullname_normalized(const std::string &pkg_cls) fullname_normalized static std::string fullname_normalized(const std::string &pkg, const std::string &cls_name) Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Class &cls) Field Field class Field : public LIEF::Object Class which represents a DEX Field . Public Types access_flags_list_t using access_flags_list_t = std::vector Public Functions Field Field() Field Field(std::string name, Class *parent = nullptr) Field Field(const Field &) operator= Field &operator=(const Field &) name std::string_view name() const Name of the Field . has_class bool has_class() const True if a class is associated with this field (which should be the case). cls const Class *cls() const Class associated with this Field . cls Class *cls() index size_t index() const Index in the DEX Fields pool. is_static bool is_static() const True if this field is a static one. type const Type *type() const Field ’s prototype. type Type *type() accept virtual void accept(Visitor &visitor) const override has bool has(ACCESS_FLAGS f) const Check if the field has the given ACCESS_FLAGS. access_flags access_flags_list_t access_flags() const ACCESS_FLAGS as a list. ~Field ~Field() override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Field &mtd) Code Info CodeInfo class CodeInfo : public LIEF::Object Public Functions CodeInfo CodeInfo() CodeInfo CodeInfo(const details::code_item &codeitem) CodeInfo CodeInfo(const CodeInfo &) operator= CodeInfo &operator=(const CodeInfo &) accept virtual void accept(Visitor &visitor) const override nb_registers uint16_t nb_registers() const ~CodeInfo ~CodeInfo() override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const CodeInfo &cinfo) Prototype Prototype class Prototype : public LIEF::Object Class which represents a DEX method prototype. Public Types parameters_type_t using parameters_type_t = std::vector< Type *> it_params using it_params = ref_iterator < parameters_type_t > it_const_params using it_const_params = const_ref_iterator Public Functions Prototype Prototype() Prototype Prototype(const Prototype &other) return_type const Type *return_type() const Type returned or a nullptr if not resolved. return_type Type *return_type() parameters_type it_const_params parameters_type() const Types of the parameters. parameters_type it_params parameters_type() accept virtual void accept(Visitor &visitor) const override ~Prototype ~Prototype() override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Prototype &type) Type Type class Type : public LIEF::Object Class which represents a DEX type as described in the format specifications: https://source.android.com/devices/tech/dalvik/dex-format#typedescriptor . Public Types TYPES enum class TYPES Values: UNKNOWN enumerator UNKNOWN = 0 PRIMITIVE enumerator PRIMITIVE = 1 CLASS enumerator CLASS = 2 ARRAY enumerator ARRAY = 3 PRIMITIVES enum class PRIMITIVES Values: VOID_T enumerator VOID_T = 0x01 BOOLEAN enumerator BOOLEAN = 0x02 BYTE enumerator BYTE = 0x03 SHORT enumerator SHORT = 0x04 CHAR enumerator CHAR = 0x05 INT enumerator INT = 0x06 LONG enumerator LONG = 0x07 FLOAT enumerator FLOAT = 0x08 DOUBLE enumerator DOUBLE = 0x09 array_t using array_t = std::vector< Type > Public Functions Type Type() Type Type(const std::string &mangled) Type Type(const Type &other) type TYPES type() const Whether it is a primitive type, a class, … cls const Class &cls() const array const array_t &array() const primitive const PRIMITIVES &primitive() const cls Class &cls() IF the current type is a TYPES::CLASS , return the associated DEX::CLASS. Otherwise, the returned value is undefined . array array_t &array() IF the current type is a TYPES::ARRAY , return the associated array. Otherwise, the returned value is undefined . primitive PRIMITIVES &primitive() IF the current type is a TYPES::PRIMITIVE , return the associated PRIMITIVES . Otherwise, the returned value is undefined . dim size_t dim() const Return the array dimension if the current type is an array. Otherwise, it returns 0. underlying_array_type const Type &underlying_array_type() const In the case of a TYPES::ARRAY , return the array’s type. underlying_array_type Type &underlying_array_type() accept virtual void accept(Visitor &visitor) const override ~Type ~Type() override Public Static Functions pretty_name static std::string pretty_name( PRIMITIVES p) Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Type &type) MapList MapList class MapList : public LIEF::Object Class which represents the map_list structure that follows the main DEX header. This MapList aims at referencing the location of other DEX structures as described in https://source.android.com/devices/tech/dalvik/dex-format#map-item Public Types items_t using items_t = std::map< MapItem :: TYPES , MapItem > it_items_t using it_items_t = ref_iterator > it_const_items_t using it_const_items_t = const_ref_iterator > Public Functions MapList MapList() MapList MapList(const MapList &) operator= MapList &operator=(const MapList &) items it_items_t items() Iterator over LIEF::DEX::MapItem . items it_const_items_t items() const has bool has( MapItem :: TYPES type) const Check if the given type exists. get const MapItem &get( MapItem :: TYPES type) const Return the LIEF::DEX::MapItem associated with the given type. get MapItem &get( MapItem :: TYPES type) Return the LIEF::DEX::MapItem associated with the given type. operator[] const MapItem &operator[]( MapItem :: TYPES type) const Return the LIEF::DEX::MapItem associated with the given type. operator[] MapItem &operator[]( MapItem :: TYPES type) Return the LIEF::DEX::MapItem associated with the given type. accept virtual void accept(Visitor &visitor) const override ~MapList ~MapList() override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const MapList &mtd) MapItem MapItem class MapItem : public LIEF::Object Class which represents an element of the MapList object. Public Types TYPES enum class TYPES : uint16_t Values: HEADER enumerator HEADER = 0x0000 STRING_ID enumerator STRING_ID = 0x0001 TYPE_ID enumerator TYPE_ID = 0x0002 PROTO_ID enumerator PROTO_ID = 0x0003 FIELD_ID enumerator FIELD_ID = 0x0004 METHOD_ID enumerator METHOD_ID = 0x0005 CLASS_DEF enumerator CLASS_DEF = 0x0006 CALL_SITE_ID enumerator CALL_SITE_ID = 0x0007 METHOD_HANDLE enumerator METHOD_HANDLE = 0x0008 MAP_LIST enumerator MAP_LIST = 0x1000 TYPE_LIST enumerator TYPE_LIST = 0x1001 ANNOTATION_SET_REF_LIST enumerator ANNOTATION_SET_REF_LIST = 0x1002 ANNOTATION_SET enumerator ANNOTATION_SET = 0x1003 CLASS_DATA enumerator CLASS_DATA = 0x2000 CODE enumerator CODE = 0x2001 STRING_DATA enumerator STRING_DATA = 0x2002 DEBUG_INFO enumerator DEBUG_INFO = 0x2003 ANNOTATION enumerator ANNOTATION = 0x2004 ENCODED_ARRAY enumerator ENCODED_ARRAY = 0x2005 ANNOTATIONS_DIRECTORY enumerator ANNOTATIONS_DIRECTORY = 0x2006 Public Functions MapItem MapItem() MapItem MapItem( TYPES type, uint32_t offset, uint32_t size, uint16_t reserved = 0) MapItem MapItem(const MapItem &) operator= MapItem &operator=(const MapItem &) type TYPES type() const The type of the item. reserved uint16_t reserved() const Reserved value (likely for alignment purpose). size uint32_t size() const The number of elements (the real meaning depends on the type). offset uint32_t offset() const Offset from the start of the DEX file to the items associated with the underlying TYPES . accept virtual void accept(Visitor &visitor) const override ~MapItem ~MapItem() override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const MapItem &item)", "contentHash": "d97c8a328018cc60cf286fe21a68d5c86ee099dcfebe008b7b12374ff030945b", "description": "DEX C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "formats/android/dex/cpp", "documentID": "927c7ba0e7bbb2c21da71165301a12d204827fe193e2ad685dcfeffeb63e0599", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/android/dex/cpp.md", "title": "DEX C++ API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/android/dex/index.html", "content": "DEX API C++ Python LIEF enables parsing Android DEX files as detailed in the tutorial: Android Formats .", "contentHash": "68ab11185dec7c87af34ba00951effe1372224c670d9d616788c1d6c80316e23", "description": "DEX in Android. LIEF enables parsing Android DEX files as detailed in the tutorial: Android Formats.", "docname": "formats/android/dex/index", "documentID": "0d19e87d2984f9f006a6f7f2d560ed69e04325de10895b8b767a5175cb818ce4", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/android/dex/index.md", "title": "DEX - Android - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/android/dex/python.html", "content": "Python Utilities lief.is_dexlief.is_dex lief.is_dex( *args ) → bool lief.is_dex( raw: collections.abc.Sequence[int] ) → bool Overloaded function. is_dex(path: str) -> bool Check if the file given in parameter is a DEX is_dex(raw: collections.abc.Sequence[int]) -> bool Check if the raw data given in parameter is a DEX lief.DEX.versionlief.DEX.version lief.DEX.version( *args ) → int lief.DEX.version( raw: collections.abc.Sequence[int] ) → int Overloaded function. version(file: str) -> int Return the DEX version of the file given in parameter version(raw: collections.abc.Sequence[int]) -> int Return the DEX version of the raw data given in parameter Parser lief.DEX.parselief.DEX.parselief.DEX.parse lief.DEX.parse( *args ) → lief.DEX.File | None **lief.DEX.parse( raw: collections.abc.Sequence[int] , name: str = '' ) → lief._lief.DEX.File | None lief.DEX.parse( obj: str | io.IOBase | os.PathLike | bytes | list[int] , name: str = '' ) → lief._lief.DEX.File | None ** Overloaded function. parse(filename: str) -> Optional[lief._lief.DEX.File] Parse the given filename and return a File object parse(raw: collections.abc.Sequence[int], name: str = '') -> Optional[lief._lief.DEX.File] Parse the given raw data and return a File object parse(obj: Union[str | io.IOBase | os.PathLike | bytes | list[int]], name: str = '') -> Optional[lief._lief.DEX.File] File lief.DEX.File class lief.DEX.File Bases: Object DEX File representation classes property classes → lief.DEX.File.it_classes Iterator over Dex Class dex2dex_json_info property dex2dex_json_info → str fields property fields → lief.DEX.File.it_fields Iterator over Dex Field get_classget_class get_class( self , classname: str ) → lief._lief.DEX.Class | None get_class( self , classname: int ) → lief._lief.DEX.Class | None has_class has_class( self , classname: str ) → bool Check if a class with a name given in parameter exists header property header → lief.DEX.Header Dex File Header location property location → str Original location of the dex file map property map → lief.DEX.MapList Dex MapList methods property methods → lief.DEX.File.it_methods Iterator over Dex Method name property name → str Name of the dex file prototypes property prototypes → lief.DEX.File.it_prototypes Iterator over Dex Prototype raw raw( self , deoptimize: bool = True ) → list[int] Original raw file save save( self , output: str = '' , deoptimize: bool = True ) → str Save the original file into the file given in first parameter strings property strings → lief.DEX.File.it_strings Iterator over Dex strings types property types → lief.DEX.File.it_types Iterator over Dex Type version property version → int Dex version Header lief.DEX.Header class lief.DEX.Header Bases: Object DEX Header checksum property checksum → int Checksum value of the rest of the file (without magic ) classes property classes → tuple[int, int] Classes identifiers data property data → tuple[int, int] Raw data. Should be align on 32-bits endian_tag property endian_tag → int Endianness tag. Should be ENDIAN_CONSTANT fields property fields → tuple[int, int] Fields identifiers file_size property file_size → int Size of the current DEX file header_size property header_size → int Size of this header. Should be 0x70 link property link → tuple[int, int] Link (raw data) magic property magic → list[int] Magic value map_offset property map_offset → int Offset from the start of the file to the map item methods property methods → tuple[int, int] Methods identifiers nb_classes property nb_classes → int Number of classes in the current DEX nb_methods property nb_methods → int Number of methods in the current DEX prototypes property prototypes → tuple[int, int] Prototypes identifiers signature property signature → list[int] SHA-1 signature of the rest of the file (without magic and checksum ). strings property strings → tuple[int, int] String identifiers types property types → tuple[int, int] Type identifiers Method lief.DEX.Method class lief.DEX.Method Bases: Object DEX Method representation access_flags property access_flags → list[ lief.DEX.ACCESS_FLAGS ] List of ACCESS_FLAGS bytecode property bytecode → list[int] Dalvik Bytecode as a list of bytes cls property cls → lief.DEX.Class | None Class associated with this method code_info property code_info → lief.DEX.CodeInfo CodeInfo associated with this method code_offset property code_offset → int Offset to the Dalvik Bytecode has has( self , flag: lief._lief.DEX.ACCESS_FLAGS ) → bool Check if the given ACCESS_FLAGS is present has_class property has_class → bool True if a class is associated with this method index property index → int Original DEX file index of the method insert_dex2dex_info insert_dex2dex_info( self , pc: int , index: int ) → None Insert de-optimization information is_virtual property is_virtual → bool True if the method is a virtual (not private , static , final , constructor ) name property name → str Method’s name prototype property prototype → lief.DEX.Prototype | None Prototype of this method Field lief.DEX.Field class lief.DEX.Field Bases: Object DEX Field representation access_flags property access_flags → list[ lief.DEX.ACCESS_FLAGS ] List of ACCESS_FLAGS cls property cls → lief.DEX.Class | None Class associated with this field has has( self , flag: lief._lief.DEX.ACCESS_FLAGS ) → bool Check if the given ACCESS_FLAGS is present has_class property has_class → bool True if a class is associated with this field index property index → int Original DEX file index of the field is_static property is_static → bool True if the field is static name property name → str Field’s name type property type → lief.DEX.Type | None Type of this field Class lief.DEX.Class class lief.DEX.Class Bases: Object DEX Class representation access_flags property access_flags → list[ lief.DEX.ACCESS_FLAGS ] List of ACCESS_FLAGS dex2dex_info property dex2dex_info → dict[ lief.DEX.Method , dict[int, int]] De-optimize information fields property fields → lief.DEX.Class.it_fields Iterator over Field in this class fullname property fullname → str Mangled class name (e.g. Lcom/example/android/MyActivity; ) get_field get_field( self , name: str ) → lief._lief.DEX.Class.it_named_fields Iterator over Field (s) having the given name get_method get_method( self , name: str ) → lief._lief.DEX.Class.it_named_methods Iterator over Method (s) having the given name has has( self , flag: lief._lief.DEX.ACCESS_FLAGS ) → bool Check if the given ACCESS_FLAGS is present has_parent property has_parent → bool True if the current class extends another one index property index → int Original index in the DEX class pool methods property methods → lief.DEX.Class.it_methods Iterator over Method implemented in this class name property name → str Class name (e.g. MyActivity ) package_name property package_name → str Package Name (e.g. com.example.android ) parent property parent → lief.DEX.Class | None Class parent class pretty_name property pretty_name → str Demangled class name (e.g. com.example.android.MyActivity ) source_filename property source_filename → str Original filename Code Info lief.DEX.CodeInfo class lief.DEX.CodeInfo Bases: Object DEX CodeInfo representation nb_registers property nb_registers → int Number of registers used by the method Prototype lief.DEX.Prototype class lief.DEX.Prototype Bases: Object DEX Prototype representation parameters_type property parameters_type → lief.DEX.Prototype.it_params Iterator over parameters Type return_type property return_type → lief.DEX.Type | None Type returned Type lief.DEX.Type class lief.DEX.Type Bases: Object DEX Type representation PRIMITIVES class PRIMITIVES( *values ) Bases: Enum BOOLEAN BOOLEAN = 2 BYTE BYTE = 3 CHAR CHAR = 5 DOUBLE DOUBLE = 9 FLOAT FLOAT = 8 INT INT = 6 LONG LONG = 7 SHORT SHORT = 4 VOID_T VOID_T = 1 TYPES class TYPES( *values ) Bases: Enum ARRAY ARRAY = 3 CLASS CLASS = 2 PRIMITIVE PRIMITIVE = 1 UNKNOWN UNKNOWN = 0 dim property dim → int If the current type is an array, return its dimension otherwise 0 pretty_name pretty_name( primitive: lief.DEX.Type.PRIMITIVES ) → str = type property type → lief.DEX.Type.TYPES TYPES of this object underlying_array_type property underlying_array_type → lief.DEX.Type Underlying type of the array value property value → object Depending on the TYPES , return Class or PRIMITIVES or array MapList lief.DEX.MapList class lief.DEX.MapList Bases: Object DEX MapList representation get get( self , type: lief._lief.DEX.MapItem.TYPES ) → lief._lief.DEX.MapItem Return the MapItem from the given TYPES has has( self , type: lief._lief.DEX.MapItem.TYPES ) → bool Check if the given TYPES is present items property items → lief.DEX.MapList.it_items_t Iterator over MapItem MapItem lief.DEX.MapItem class lief.DEX.MapItem Bases: Object DEX MapItem representation TYPES class TYPES( *values ) Bases: Enum ANNOTATION ANNOTATION = 8196 ANNOTATIONS_DIRECTORY ANNOTATIONS_DIRECTORY = 8198 ANNOTATION_SET ANNOTATION_SET = 4099 ANNOTATION_SET_REF_LIST ANNOTATION_SET_REF_LIST = 4098 CALL_SITE_ID CALL_SITE_ID = 7 CLASS_DATA CLASS_DATA = 8192 CLASS_DEF CLASS_DEF = 6 CODE CODE = 8193 DEBUG_INFO DEBUG_INFO = 8195 ENCODED_ARRAY ENCODED_ARRAY = 8197 FIELD_ID FIELD_ID = 4 HEADER HEADER = 0 MAP_LIST MAP_LIST = 4096 METHOD_HANDLE METHOD_HANDLE = 8 METHOD_ID METHOD_ID = 5 PROTO_ID PROTO_ID = 3 STRING_DATA STRING_DATA = 8194 STRING_ID STRING_ID = 1 TYPE_ID TYPE_ID = 2 TYPE_LIST TYPE_LIST = 4097 from_value from_value( arg: int ) → lief.DEX.MapItem.TYPES = offset property offset → int Offset from the start of the file to the items in question size property size → int Count of the number of items to be found at the indicated offset type property type → lief.DEX.MapItem.TYPES TYPES of the item Enums Access Flags lief.DEX.ACCESS_FLAGS class lief.DEX.ACCESS_FLAGS( *values ) Bases: Enum ABSTRACT ABSTRACT = 1024 ANNOTATION ANNOTATION = 8192 BRIDGE BRIDGE = 64 CONSTRUCTOR CONSTRUCTOR = 65536 DECLARED_SYNCHRONIZED DECLARED_SYNCHRONIZED = 131072 ENUM ENUM = 16384 FINAL FINAL = 16 INTERFACE INTERFACE = 512 NATIVE NATIVE = 256 PRIVATE PRIVATE = 2 PROTECTED PROTECTED = 4 PUBLIC PUBLIC = 1 STATIC STATIC = 8 STRICT STRICT = 2048 SYNCHRONIZED SYNCHRONIZED = 32 SYNTHETIC SYNTHETIC = 4096 TRANSIENT TRANSIENT = 128 UNKNOWN UNKNOWN = 0 VARARGS VARARGS = 128 VOLATILE VOLATILE = 64", "contentHash": "809c8d7d3356323ef7225e8dd5e7bc460cf983fc2e084e9506b9be9e62a38e6d", "description": "DEX Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "formats/android/dex/python", "documentID": "e1ad0509ee4ca2b145a1b828aeb8a68a6a879459a56983f88fceb7aa17a26740", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/android/dex/python.md", "title": "DEX Python API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/android/index.html", "content": "Android OAT DEX VDEX ART", "contentHash": "f163c99c842d961ee365b17a9afede273a11fe457e1f75f4c9ae1173e8809ba9", "description": "Android reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "formats/android/index", "documentID": "058a04915fdc3e2a3d7a6d35703c3547523c166582d495d293b48c13f39fb177", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/android/index.md", "title": "Android - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/android/oat/cpp.html", "content": "C++ Utilities LIEF::OAT::is_oat bool LIEF::OAT::is_oat(const LIEF::ELF:: Binary &elf_binary) Check if the given LIEF::ELF::Binary is an OAT one. LIEF::OAT::is_oat bool LIEF::OAT::is_oat(std::string_view file) Check if the given file is an OAT one. LIEF::OAT::is_oat bool LIEF::OAT::is_oat(const std::vector &raw) Check if the given raw data is an OAT one. LIEF::OAT::version oat_version_t LIEF::OAT::version(const LIEF::ELF:: Binary &elf_binary) Return the OAT version of the given LIEF::ELF::Binary . LIEF::OAT::version oat_version_t LIEF::OAT::version(std::string_view file) Return the OAT version of the given file. LIEF::OAT::version oat_version_t LIEF::OAT::version(const std::vector &raw) Return the OAT version of the raw data. LIEF::OAT::android_version LIEF::Android:: ANDROID_VERSIONS LIEF::OAT::android_version(oat_version_t version) Return the ANDROID_VERSIONS associated with the given OAT version. Parser Parser class Parser : public LIEF::ELF:: Parser Class to parse an OAT file to produce an OAT::Binary . Public Functions operator= Parser &operator=(const Parser ©) = delete Parser Parser(const Parser ©) = delete Public Static Functions parse static std::unique_ptr< Binary > parse(std::string_view oat_file) Parse an OAT file. parse static std::unique_ptr< Binary > parse(std::string_view oat_file, std::string_view vdex_file) PathTparse template = 0> static inline std::unique_ptr< Binary > parse(const PathT &oat_file) Same as parse(std::string_view) but the file is given as a std::filesystem::path . OatTVdexTparse template = 0> static inline std::unique_ptr< Binary > parse(const OatT &oat_file, const VdexT &vdex_file) Same as parse(std::string_view, std::string_view) but at least one of the files is given as a std::filesystem::path . parse static std::unique_ptr< Binary > parse(std::vector data) Binary Binary class Binary : public LIEF::ELF:: Binary Public Types dex_files_t using dex_files_t = std::vector> it_dex_files using it_dex_files = ref_iterator < dex_files_t &, DEX:: File *> it_const_dex_files using it_const_dex_files = const_ref_iterator classes_t using classes_t = std::unordered_map classes_list_t using classes_list_t = std::vector> it_classes using it_classes = ref_iterator < classes_list_t &, Class *> it_const_classes using it_const_classes = const_ref_iterator oat_dex_files_t using oat_dex_files_t = std::vector> it_oat_dex_files using it_oat_dex_files = ref_iterator < oat_dex_files_t &, DexFile *> it_const_oat_dex_files using it_const_oat_dex_files = const_ref_iterator methods_t using methods_t = std::vector> it_methods using it_methods = ref_iterator < methods_t &, Method *> it_const_methods using it_const_methods = const_ref_iterator dex2dex_info_t using dex2dex_info_t = std::unordered_map Public Functions operator= Binary &operator=(const Binary ©) = delete Binary Binary(const Binary ©) = delete header const Header &header() const OAT Header . header Header &header() dex_files it_dex_files dex_files() Iterator over LIEF::DEX::File . dex_files it_const_dex_files dex_files() const oat_dex_files it_oat_dex_files oat_dex_files() Iterator over LIEF::OAT::DexFile . oat_dex_files it_const_oat_dex_files oat_dex_files() const classes it_const_classes classes() const Iterator over LIEF::OAT::Class . classes it_classes classes() has_class bool has_class(const std::string &class_name) const Check if the current OAT has the given class. get_class const Class *get_class(const std::string &class_name) const Return the LIEF::OAT::Class with the given name or a nullptr if the class can’t be found. get_class Class *get_class(const std::string &class_name) get_class const Class *get_class(size_t index) const Return the LIEF::OAT::Class at the given index or a nullptr if it does not exist. get_class Class *get_class(size_t index) methods it_const_methods methods() const Iterator over LIEF::OAT::Method . methods it_methods methods() dex2dex_info dex2dex_info_t dex2dex_info() const dex2dex_json_info std::string dex2dex_json_info() has_vdex inline bool has_vdex() const accept virtual void accept(Visitor &visitor) const override Method associated with the visitor pattern. ~Binary ~Binary() override Public Static Functions classof static inline bool classof(const LIEF:: Binary *bin) Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Binary &binary) Header Header class Header : public LIEF::Object Public Types magic_t using magic_t = std::array key_values_t using key_values_t = std::map< HEADER_KEYS , std::string> it_key_values_t using it_key_values_t = ref_iterator > it_const_key_values_t using it_const_key_values_t = const_ref_iterator > keys_t using keys_t = std::vector< HEADER_KEYS > Iterator type over. values_t using values_t = std::vector Public Functions Header Header() Header Header(const Header &) operator= Header &operator=(const Header &) THeader template Header(const T *header) magic Header :: magic_t magic() const Magic value: oat . version oat_version_t version() const OAT version. checksum uint32_t checksum() const instruction_set INSTRUCTION_SETS instruction_set() const nb_dex_files uint32_t nb_dex_files() const oat_dex_files_offset uint32_t oat_dex_files_offset() const executable_offset uint32_t executable_offset() const i2i_bridge_offset uint32_t i2i_bridge_offset() const i2c_code_bridge_offset uint32_t i2c_code_bridge_offset() const jni_dlsym_lookup_offset uint32_t jni_dlsym_lookup_offset() const quick_generic_jni_trampoline_offset uint32_t quick_generic_jni_trampoline_offset() const quick_imt_conflict_trampoline_offset uint32_t quick_imt_conflict_trampoline_offset() const quick_resolution_trampoline_offset uint32_t quick_resolution_trampoline_offset() const quick_to_interpreter_bridge_offset uint32_t quick_to_interpreter_bridge_offset() const image_patch_delta int32_t image_patch_delta() const image_file_location_oat_checksum uint32_t image_file_location_oat_checksum() const image_file_location_oat_data_begin uint32_t image_file_location_oat_data_begin() const key_value_size uint32_t key_value_size() const key_values it_key_values_t key_values() key_values it_const_key_values_t key_values() const keys keys_t keys() const values values_t values() const get const std::string *get( HEADER_KEYS key) const get std::string *get( HEADER_KEYS key) set Header &set( HEADER_KEYS key, const std::string &value) operator[] const std::string *operator[]( HEADER_KEYS key) const operator[] std::string *operator[]( HEADER_KEYS key) magic void magic(const magic_t &magic) accept virtual void accept(Visitor &visitor) const override Public Static Functions key_to_string static std::string key_to_string( HEADER_KEYS key) Return the string value associated with the given key. Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Header &hdr) element_t struct element_t Public Functions element_t inline element_t( HEADER_KEYS key, const std::string &value) Public Members key HEADER_KEYS key value std::string *value = nullptr DexFile DexFile class DexFile : public LIEF::Object Public Functions DexFile DexFile() DexFile DexFile(const DexFile &) operator= DexFile &operator=(const DexFile &) location std::string_view location() const checksum uint32_t checksum() const dex_offset uint32_t dex_offset() const has_dex_file bool has_dex_file() const dex_file const DEX:: File *dex_file() const dex_file DEX:: File *dex_file() location void location(const std::string &location) checksum void checksum(uint32_t checksum) dex_offset void dex_offset(uint32_t dex_offset) classes_offsets const std::vector &classes_offsets() const lookup_table_offset uint32_t lookup_table_offset() const class_offsets_offset void class_offsets_offset(uint32_t offset) lookup_table_offset void lookup_table_offset(uint32_t offset) accept virtual void accept(Visitor &visitor) const override ~DexFile ~DexFile() override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const DexFile &dex_file) Class Class class Class : public LIEF::Object Public Types methods_t using methods_t = std::vector< Method *> it_methods using it_methods = ref_iterator < methods_t &> it_const_methods using it_const_methods = const_ref_iterator Public Functions Class Class() Class Class( OAT_CLASS_STATUS status, OAT_CLASS_TYPES type, DEX:: Class *dex_class, std::vector bitmap = {}) Class Class(const Class &) operator= Class &operator=(const Class &) has_dex_class bool has_dex_class() const dex_class const DEX:: Class *dex_class() const dex_class DEX:: Class *dex_class() status OAT_CLASS_STATUS status() const type OAT_CLASS_TYPES type() const fullname std::string_view fullname() const index size_t index() const methods it_methods methods() methods it_const_methods methods() const bitmap const std::vector &bitmap() const is_quickened bool is_quickened(const DEX:: Method &m) const is_quickened bool is_quickened(uint32_t relative_index) const method_offsets_index uint32_t method_offsets_index(const DEX:: Method &m) const method_offsets_index uint32_t method_offsets_index(uint32_t relative_index) const relative_index uint32_t relative_index(const DEX:: Method &m) const relative_index uint32_t relative_index(uint32_t method_absolute_index) const dex2dex_info DEX::dex2dex_class_info_t dex2dex_info() const accept virtual void accept(Visitor &visitor) const override ~Class ~Class() override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Class &cls) Method Method class Method : public LIEF::Object Public Types quick_code_t using quick_code_t = std::vector Container for the Quick Code. Public Functions Method Method() Method Method(DEX:: Method *method, Class *oat_class, std::vector code = {}) Method Method(const Method &) operator= Method &operator=(const Method &) name std::string name() const Method ’s name. oat_class const Class *oat_class() const OAT Class associated with this Method . oat_class Class *oat_class() has_dex_method bool has_dex_method() const Check if a LIEF::DEX::Method is associated with this Method . dex_method const DEX:: Method *dex_method() const LIEF::DEX::Method associated (if any). dex_method DEX:: Method *dex_method() is_dex2dex_optimized bool is_dex2dex_optimized() const True if the optimization is DEX. is_compiled bool is_compiled() const dex2dex_info const DEX::dex2dex_method_info_t &dex2dex_info() const quick_code const quick_code_t &quick_code() const Quick code associated with the method. quick_code void quick_code(const quick_code_t &code) accept virtual void accept(Visitor &visitor) const override ~Method ~Method() override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Method &meth) Enums OAT Class types LIEF::OAT::OAT_CLASS_TYPES enum LIEF::OAT::OAT_CLASS_TYPES Values: OAT_CLASS_ALL_COMPILED enumerator OAT_CLASS_ALL_COMPILED = 0 OAT_CLASS_SOME_COMPILED enumerator OAT_CLASS_SOME_COMPILED = 1 OatClass is followed by an OatMethodOffsets for each method. OAT_CLASS_NONE_COMPILED enumerator OAT_CLASS_NONE_COMPILED = 2 A bitmap of which OatMethodOffsets are present follows the OatClass. OAT Class Status LIEF::OAT::OAT_CLASS_STATUS enum LIEF::OAT::OAT_CLASS_STATUS Values: STATUS_RETIRED enumerator STATUS_RETIRED = -2 STATUS_ERROR enumerator STATUS_ERROR = -1 STATUS_NOTREADY enumerator STATUS_NOTREADY = 0 STATUS_IDX enumerator STATUS_IDX = 1 STATUS_LOADED enumerator STATUS_LOADED = 2 STATUS_RESOLVING enumerator STATUS_RESOLVING = 3 STATUS_RESOLVED enumerator STATUS_RESOLVED = 4 STATUS_VERIFYING enumerator STATUS_VERIFYING = 5 STATUS_RETRY_VERIFICATION_AT_RUNTIME enumerator STATUS_RETRY_VERIFICATION_AT_RUNTIME = 6 STATUS_VERIFYING_AT_RUNTIME enumerator STATUS_VERIFYING_AT_RUNTIME = 7 STATUS_VERIFIED enumerator STATUS_VERIFIED = 8 STATUS_INITIALIZING enumerator STATUS_INITIALIZING = 9 STATUS_INITIALIZED enumerator STATUS_INITIALIZED = 10 Header Keys LIEF::OAT::HEADER_KEYS enum LIEF::OAT::HEADER_KEYS Values: KEY_IMAGE_LOCATION enumerator KEY_IMAGE_LOCATION = 0 KEY_DEX2OAT_CMD_LINE enumerator KEY_DEX2OAT_CMD_LINE = 1 KEY_DEX2OAT_HOST enumerator KEY_DEX2OAT_HOST = 2 KEY_PIC enumerator KEY_PIC = 3 KEY_HAS_PATCH_INFO enumerator KEY_HAS_PATCH_INFO = 4 KEY_DEBUGGABLE enumerator KEY_DEBUGGABLE = 5 KEY_NATIVE_DEBUGGABLE enumerator KEY_NATIVE_DEBUGGABLE = 6 KEY_COMPILER_FILTER enumerator KEY_COMPILER_FILTER = 7 KEY_CLASS_PATH enumerator KEY_CLASS_PATH = 8 KEY_BOOT_CLASS_PATH enumerator KEY_BOOT_CLASS_PATH = 9 KEY_CONCURRENT_COPYING enumerator KEY_CONCURRENT_COPYING = 10 KE_COMPILATION_REASON enumerator KE_COMPILATION_REASON = 11 Instruction sets LIEF::OAT::INSTRUCTION_SETS enum LIEF::OAT::INSTRUCTION_SETS Values: INST_SET_NONE enumerator INST_SET_NONE = 0 INST_SET_ARM enumerator INST_SET_ARM = 1 INST_SET_ARM_64 enumerator INST_SET_ARM_64 = 2 INST_SET_THUMB2 enumerator INST_SET_THUMB2 = 3 INST_SET_X86 enumerator INST_SET_X86 = 4 INST_SET_X86_64 enumerator INST_SET_X86_64 = 5 INST_SET_MIPS enumerator INST_SET_MIPS = 6 INST_SET_MIPS_64 enumerator INST_SET_MIPS_64 = 7", "contentHash": "8e5d5fb053af47139582956764d6493c33f41327574ca003189aac94d536b6da", "description": "OAT C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "formats/android/oat/cpp", "documentID": "014463d46dac604d0d15d4b84e40268f42129871b21722dfcf3d703e81ee736a", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/android/oat/cpp.md", "title": "OAT C++ API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/android/oat/index.html", "content": "OAT API C++ Python Android OAT files are essentially ELF files, and LIEF exposes a specific API for them. You can check out the Android Formats tutorial for more details.", "contentHash": "547061a036e1f56c2892ff4acf8377e7b746102ed17654f0ac1691adf8ecca75", "description": "OAT in Android. Android OAT files are essentially ELF files, and LIEF exposes a specific API for them. You can check out the Android Formats tutorial for more…", "docname": "formats/android/oat/index", "documentID": "a62a4541758459d5eed03b4624509f0331510199fec0b4e088235caf8a988ebe", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/android/oat/index.md", "title": "OAT - Android - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/android/oat/python.html", "content": "Python Utilities lief.is_oatlief.is_oatlief.is_oat lief.is_oat( *args ) → bool **lief.is_oat( path: str ) → bool lief.is_oat( raw: collections.abc.Sequence[int] ) → bool ** Overloaded function. is_oat(binary: lief._lief.ELF.Binary) -> bool Check if the Binary given in parameter is an OAT is_oat(path: str) -> bool Check if the file given in parameter is an OAT is_oat(raw: collections.abc.Sequence[int]) -> bool Check if the raw data given in parameter is an OAT lief.OAT.versionlief.OAT.versionlief.OAT.version lief.OAT.version( *args ) → int **lief.OAT.version( file: str ) → int lief.OAT.version( raw: collections.abc.Sequence[int] ) → int ** Overloaded function. version(binary: lief._lief.ELF.Binary) -> int Return the OAT version of the Binary given in parameter version(file: str) -> int Return the OAT version of the file given in parameter version(raw: collections.abc.Sequence[int]) -> int Return the OAT version of the raw data given in parameter lief.OAT.android_version lief.OAT.android_version( arg: int ) → lief.Android.ANDROID_VERSIONS Return the ANDROID_VERSIONS associated with the given OAT version Parser lief.OAT.parselief.OAT.parselief.OAT.parselief.OAT.parse lief.OAT.parse( *args ) → lief.OAT.Binary | None **lief.OAT.parse( oat_file: str , vdex_file: str ) → lief._lief.OAT.Binary | None **lief.OAT.parse( raw: collections.abc.Sequence[int] ) → lief._lief.OAT.Binary | None lief.OAT.parse( obj: str | io.IOBase | os.PathLike | bytes | list[int] ) → lief._lief.OAT.Binary | None **** Overloaded function. parse(oat_file: str) -> Optional[lief._lief.OAT.Binary] Parse the given OAT file and return a Binary object parse(oat_file: str, vdex_file: str) -> Optional[lief._lief.OAT.Binary] Parse the given OAT with its VDEX file and return a Binary object parse(raw: collections.abc.Sequence[int]) -> Optional[lief._lief.OAT.Binary] Parse the given raw data and return a Binary object parse(obj: Union[str | io.IOBase | os.PathLike | bytes | list[int]]) -> Optional[lief._lief.OAT.Binary] Binary lief.OAT.Binary class lief.OAT.Binary Bases: Binary OAT binary representation classes property classes → lief.OAT.Binary.it_classes Return an iterator over Class dex2dex_json_info property dex2dex_json_info → str dex_files property dex_files → lief.OAT.Binary.it_dex_files Return an iterator over File get_classget_class get_class( self , class_name: str ) → lief._lief.OAT.Class | None get_class( self , class_index: int ) → lief._lief.OAT.Class | None Overloaded function. get_class(self, class_name: str) -> lief._lief.OAT.Class | None Return the Class from its name get_class(self, class_index: int) -> lief._lief.OAT.Class | None Return the Class from its index has_class has_class( self , arg: str , / ) → bool Check if the class with the given name is present in the current OAT binary header property header → lief.OAT.Header Return the OAT Header methods property methods → lief.OAT.Binary.it_methods Return an iterator over Method oat_dex_files property oat_dex_files → lief.OAT.Binary.it_oat_dex_files Return an iterator over DexFile Header lief.OAT.Header class lief.OAT.Header( self ) Bases: Object OAT Header representation checksum property checksum → int Checksum of the OAT file element_t class element_t Bases: object key property key → lief.OAT.HEADER_KEYS value property value → str executable_offset property executable_offset → int get get( self , key: lief._lief.OAT.HEADER_KEYS ) → str i2c_code_bridge_offset property i2c_code_bridge_offset → int i2i_bridge_offset property i2i_bridge_offset → int image_file_location_oat_checksum property image_file_location_oat_checksum → int image_file_location_oat_data_begin property image_file_location_oat_data_begin → int image_patch_delta property image_patch_delta → int instruction_set property instruction_set → lief.OAT.INSTRUCTION_SETS List of INSTRUCTION_SETS jni_dlsym_lookup_offset property jni_dlsym_lookup_offset → int key_value_size property key_value_size → int key_values property key_values → lief.OAT.Header.it_key_values_t Configuration used for the dex2oat transformation keys property keys → list[ lief.OAT.HEADER_KEYS ] List of HEADER_KEYS present magic property magic → list[int] Magic number which shoud be oat\\x0A nb_dex_files property nb_dex_files → int Number of lief.DEX.File registered in the current OAT oat_dex_files_offset property oat_dex_files_offset → int Offset to the raw lief.OAT.Dexfile Warning This attribute is only relevant for OAT for which the version is above 131 quick_generic_jni_trampoline_offset property quick_generic_jni_trampoline_offset → int quick_imt_conflict_trampoline_offset property quick_imt_conflict_trampoline_offset → int quick_resolution_trampoline_offset property quick_resolution_trampoline_offset → int quick_to_interpreter_bridge_offset property quick_to_interpreter_bridge_offset → int set set( self , key: lief._lief.OAT.HEADER_KEYS , value: str ) → lief._lief.OAT.Header values property values → list[str] List of values associated with keys version property version → int Underlying version of the OAT file DexFile lief.OAT.DexFile class lief.OAT.DexFile( self ) Bases: Object OAT DexFile representation checksum property checksum → int Checksum of the underlying DEX file dex_file property dex_file → lief.DEX.File | None Associated lief.DEX.File dex_offset property dex_offset → int Offset to the raw lief.DEX.File has_dex_file property has_dex_file → bool Check if the lief.DEX.File is present location property location → str Original location of the DEX file Class lief.OAT.Class class lief.OAT.Class( self ) Bases: Object OAT Class representation bitmap property bitmap → list[int] Bitmap information used to quickly find which methods are optimized fullname property fullname → str Class mangled name (e.g. Lcom/android/MyActivity; ) has_dex_class has_dex_class( self ) → bool True if a lief.DEX.Class object is associated with this OAT Class index property index → int Index the DEX classes pool ( lief.DEX.File.classes ) is_quickenedis_quickened is_quickened( self , dex_method: lief._lief.DEX.Method ) → bool is_quickened( self , method_index: int ) → bool Overloaded function. is_quickened(self, dex_method: lief._lief.DEX.Method) -> bool Check if the given lief.DEX.Method is compiled into native code is_quickened(self, method_index: int) -> bool Check if the Method at the given index is compiled into native code method_offsets_indexmethod_offsets_index method_offsets_index( self , arg: lief._lief.DEX.Method , / ) → int method_offsets_index( self , arg: int , / ) → int methods property methods → lief.OAT.Class.it_methods Iterator over lief.OAT.Method status property status → lief.OAT.OAT_CLASS_STATUS Class OAT_CLASS_STATUS type property type → lief.OAT.OAT_CLASS_TYPES Information ( OAT_CLASS_TYPES ) about how methods are optimized Method lief.OAT.Method class lief.OAT.Method( self ) Bases: Object OAT Method representation dex_method property dex_method → lief.DEX.Method | None Mirrored Method associated with the OAT method (or None) has_dex_method property has_dex_method → bool Check if a Method is associated with the OAT method is_compiled property is_compiled → bool True if the optimization is native is_dex2dex_optimized property is_dex2dex_optimized → bool True if the optimization is DEX name property name → str Method’s name oat_class property oat_class → lief.OAT.Class | None Class associated with the method (or None) quick_code property quick_code → list[int] Quick code associated with the method Enums OAT Class types lief.OAT.OAT_CLASS_TYPES class lief.OAT.OAT_CLASS_TYPES( *values ) Bases: Enum ALL_COMPILED ALL_COMPILED = 0 NONE_COMPILED NONE_COMPILED = 2 SOME_COMPILED SOME_COMPILED = 1 OAT Class Status lief.OAT.OAT_CLASS_STATUS class lief.OAT.OAT_CLASS_STATUS( *values ) Bases: Enum ERROR ERROR = -1 IDX IDX = 1 INITIALIZED INITIALIZED = 10 INITIALIZING INITIALIZING = 9 LOADED LOADED = 2 NOTREADY NOTREADY = 0 RESOLVED RESOLVED = 4 RESOLVING RESOLVING = 3 RETIRED RETIRED = -2 VERIFICATION_AT_RUNTIME VERIFICATION_AT_RUNTIME = 6 VERIFIED VERIFIED = 8 VERIFYING VERIFYING = 5 VERIFYING_AT_RUNTIME VERIFYING_AT_RUNTIME = 7 Header Keys lief.OAT.HEADER_KEYS class lief.OAT.HEADER_KEYS( *values ) Bases: Enum BOOT_CLASS_PATH BOOT_CLASS_PATH = 9 CLASS_PATH CLASS_PATH = 8 COMPILER_FILTER COMPILER_FILTER = 7 CONCURRENT_COPYING CONCURRENT_COPYING = 10 DEBUGGABLE DEBUGGABLE = 5 DEX2OAT_CMD_LINE DEX2OAT_CMD_LINE = 1 DEX2OAT_HOST DEX2OAT_HOST = 2 HAS_PATCH_INFO HAS_PATCH_INFO = 4 IMAGE_LOCATION IMAGE_LOCATION = 0 NATIVE_DEBUGGABLE NATIVE_DEBUGGABLE = 6 PIC PIC = 3 Instruction sets lief.OAT.INSTRUCTION_SETS class lief.OAT.INSTRUCTION_SETS( *values ) Bases: Enum ARM ARM = 1 ARM_64 ARM_64 = 2 MIPS MIPS = 6 MIPS_64 MIPS_64 = 7 NONE NONE = 0 THUMB2 THUMB2 = 3 X86 X86 = 4 X86_64 X86_64 = 5", "contentHash": "99e3d7554395d63dc8051c0ed3e24606345970b2c21b8a1fd251a547aeaf2174", "description": "OAT Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "formats/android/oat/python", "documentID": "d517a05bb56f618f6d904bfd3eaa720986cb60ae327907dc70a117c97788098e", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/android/oat/python.md", "title": "OAT Python API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/android/vdex/cpp.html", "content": "C++ Utilities LIEF::VDEX::is_vdex bool LIEF::VDEX::is_vdex(std::string_view file) Check if the given file is a VDEX one. LIEF::VDEX::is_vdex bool LIEF::VDEX::is_vdex(const std::vector &raw) Check if the given raw data is a VDEX one. LIEF::VDEX::version vdex_version_t LIEF::VDEX::version(std::string_view file) Return the VDEX version of the given file. LIEF::VDEX::version vdex_version_t LIEF::VDEX::version(const std::vector &raw) Return the VDEX version of the raw data. LIEF::VDEX::android_version Android:: ANDROID_VERSIONS LIEF::VDEX::android_version(vdex_version_t version) Return the ANDROID_VERSIONS associated with the given VDEX version. Parser Parser class Parser Class which parses a VDEX file and transforms it into a VDEX::File object. Public Functions operator= Parser &operator=(const Parser ©) = delete Parser Parser(const Parser ©) = delete Public Static Functions parse static std::unique_ptr< File > parse(std::string_view file) PathTparse template = 0> static inline std::unique_ptr< File > parse(const PathT &file) Same as parse(std::string_view) but the file is given as a std::filesystem::path . parse static std::unique_ptr< File > parse(const std::vector &data, std::string_view name = \"\") File File class File : public LIEF::Object Main class for the VDEX module which represents a VDEX file. Public Types dex_files_t using dex_files_t = std::vector> it_dex_files using it_dex_files = ref_iterator < dex_files_t &, DEX:: File *> it_const_dex_files using it_const_dex_files = const_ref_iterator Public Functions operator= File &operator=(const File ©) = delete File File(const File ©) = delete header const Header &header() const VDEX Header . header Header &header() dex_files it_dex_files dex_files() Iterator over LIEF::DEX::Files registered. dex_files it_const_dex_files dex_files() const dex2dex_info dex2dex_info_t dex2dex_info() const dex2dex_json_info std::string dex2dex_json_info() accept virtual void accept(Visitor &visitor) const override ~File ~File() override Friends friend class OAT::Binary operator<< friend std::ostream &operator<<(std::ostream &os, const File &vdex_file) Header Header class Header : public LIEF::Object Public Types magic_t using magic_t = std::array Public Functions Header Header() THeader template Header(const T *header) Header Header(const Header &) operator= Header &operator=(const Header &) magic magic_t magic() const Magic value used to identify VDEX. version vdex_version_t version() const VDEX version number. nb_dex_files uint32_t nb_dex_files() const Number of LIEF::DEX::File files registered. dex_size uint32_t dex_size() const Size of all LIEF::DEX::File . verifier_deps_size uint32_t verifier_deps_size() const Size of verifier deps section. quickening_info_size uint32_t quickening_info_size() const Size of quickening info section. accept virtual void accept(Visitor &visitor) const override ~Header ~Header() override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Header &header)", "contentHash": "4a32ea3c4015a20566e2a02b50f880813e8e79afb5ca7baf9947f0d1378aed70", "description": "VDEX C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "formats/android/vdex/cpp", "documentID": "f2f3ce2eb971b174d3a0d6cb40267b80c0814cc758235b7b4dbcf426178573fc", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/android/vdex/cpp.md", "title": "VDEX C++ API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/android/vdex/index.html", "content": "VDEX API C++ Python Android VDEX files are partially supported by LIEF, and you can refer to the Android Formats tutorial for details.", "contentHash": "64cd06efe4703b96bab19f046084f9e1da3e248222d33b2f64659a8a16a4f4a2", "description": "VDEX in Android. Android VDEX files are partially supported by LIEF, and you can refer to the Android Formats tutorial for details.", "docname": "formats/android/vdex/index", "documentID": "c0dd34746be54f8f61180cb1adeec2d5aafce1f1bac934b467b510f7f32d57ca", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/android/vdex/index.md", "title": "VDEX - Android - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/android/vdex/python.html", "content": "Python Utilities lief.is_vdexlief.is_vdex lief.is_vdex( *args ) → bool lief.is_vdex( raw: collections.abc.Sequence[int] ) → bool Overloaded function. is_vdex(path: str) -> bool Check if the file given in parameter is a VDEX is_vdex(raw: collections.abc.Sequence[int]) -> bool Check if the raw data given in parameter is a VDEX lief.VDEX.versionlief.VDEX.version lief.VDEX.version( *args ) → int lief.VDEX.version( raw: collections.abc.Sequence[int] ) → int Overloaded function. version(file: str) -> int Return the VDEX version of the file given in parameter version(raw: collections.abc.Sequence[int]) -> int Return the VDEX version of the raw data given in parameter lief.VDEX.android_version lief.VDEX.android_version( vdex_version: int ) → lief.Android.ANDROID_VERSIONS Return the ANDROID_VERSIONS associated with the given VDEX version Parser lief.VDEX.parselief.VDEX.parse lief.VDEX.parse( *args ) → lief.VDEX.File | None lief.VDEX.parse( obj: str | io.IOBase | os.PathLike | bytes | list[int] , name: str = '' ) → lief._lief.VDEX.File | None Overloaded function. parse(filename: str) -> Optional[lief._lief.VDEX.File] Parse the given filename and return a File object parse(obj: Union[str | io.IOBase | os.PathLike | bytes | list[int]], name: str = '') -> Optional[lief._lief.VDEX.File] File lief.VDEX.File class lief.VDEX.File Bases: Object VDEX File representation dex2dex_json_info property dex2dex_json_info → str dex_files property dex_files → lief.OAT.Binary.it_dex_files Return an iterator over File header property header → lief.VDEX.Header Return the VDEX Header Header lief.VDEX.Header class lief.VDEX.Header Bases: Object VDEX Header representation dex_size property dex_size → int Size of all File magic property magic → list[int] Magic value used to identify VDEX nb_dex_files property nb_dex_files → int Number of File files registered quickening_info_size property quickening_info_size → int Size of quickening info section verifier_deps_size property verifier_deps_size → int Size of verifier deps section version property version → int VDEX version number", "contentHash": "eb7d3600c3d88944bb973ef2fa4dc028c335b83e73fcbcee9c7a9eabf44c7a3d", "description": "VDEX Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "formats/android/vdex/python", "documentID": "1d84ffc4a58e840bb9c603fac05854a7e375bbbf90079bccf5eeaeef294fb56e", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/android/vdex/python.md", "title": "VDEX Python API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/coff/cpp.html", "content": "C++ Parser Parser class Parser Public Types SymSecMap using SymSecMap = std::vector <=> std::unordered_multimap
Public Functions ~Parser ~Parser() Public Static Functions parse static std::unique_ptr< Binary > parse(std::unique_ptr< BinaryStream > stream, const ParserConfig &config = ParserConfig :: default_conf ()) Parse the COFF binary referenced by the stream argument with the given config. parse static std::unique_ptr< Binary > parse(std::string_view file, const ParserConfig &config = ParserConfig :: default_conf ()) Parse the COFF binary pointed by the file argument with the given config. PathTparse template = 0> static inline std::unique_ptr< Binary > parse(const PathT &file, const ParserConfig &config = ParserConfig :: default_conf ()) Same as parse(std::string_view, const ParserConfig&) but the file is given as a std::filesystem::path . Public Static Attributes MAX_NB_SECTIONS static size_t MAX_NB_SECTIONS = 1 << 20 ParserConfig class ParserConfig Class used to configure the COFF parser. Public Static Functions default_conf static inline const ParserConfig &default_conf() all static inline const ParserConfig &all() Binary Binary class Binary Class that represents a COFF Binary . Public Types sections_t using sections_t = std::vector> Internal container used to store COFF’s section. it_sections using it_sections = ref_iterator < sections_t &, Section *> Iterator that outputs Section & object. it_const_sections using it_const_sections = const_ref_iterator Iterator that outputs const Section & object. relocations_t using relocations_t = std::vector> Internal container used to store COFF’s relocations. it_relocations using it_relocations = ref_iterator < relocations_t &, Relocation *> Iterator that outputs Relocation & object. it_const_relocations using it_const_relocations = const_ref_iterator Iterator that outputs const Relocation & object. strings_table_t using strings_table_t = std::vector< String > Internal container used to store COFF’s strings. it_strings_table using it_strings_table = ref_iterator < strings_table_t &> Iterator that outputs String & object. it_const_strings_table using it_const_strings_table = const_ref_iterator Iterator that outputs const String & object. symbols_t using symbols_t = std::vector> Internal container used to store COFF’s symbols. it_symbols using it_symbols = ref_iterator < symbols_t &, Symbol *> Iterator that outputs Symbol & object. it_const_symbols using it_const_symbols = const_ref_iterator Iterator that outputs Symbol & object. instructions_it using instructions_it = iterator_range Instruction iterator. it_functions using it_functions = filter_iterator < symbols_t &, Symbol *> Iterator which outputs COFF symbols representing functions. it_const_function using it_const_function = const_filter_iterator Iterator which outputs COFF symbols representing functions. Public Functions header inline const Header &header() const The COFF header. header inline Header &header() sections inline it_sections sections() Iterator over the different sections located in this COFF binary. sections inline it_const_sections sections() const relocations inline it_relocations relocations() Iterator over all the relocations used by this COFF binary. relocations inline it_const_relocations relocations() const symbols inline it_symbols symbols() Iterator over the COFF’s symbols. symbols inline it_const_symbols symbols() const string_table inline it_const_strings_table string_table() const Iterator over the COFF’s strings. string_table inline it_strings_table string_table() find_string inline String *find_string(uint32_t offset) Try to find the COFF string at the given offset in the COFF string table. Warning This offset must include the first 4 bytes holding the size of the table. Hence, the first string starts a the offset 4. find_string inline const String *find_string(uint32_t offset) const functions it_const_function functions() const Iterator over the functions implemented in this COFF. functions it_functions functions() find_function const Symbol *find_function(const std::string &name) const Try to find the function (symbol) with the given name. find_function inline Symbol *find_function(const std::string &name) find_demangled_function const Symbol *find_demangled_function(const std::string &name) const Try to find the function (symbol) with the given demangled name. find_demangled_function inline Symbol *find_demangled_function(const std::string &name) disassemble instructions_it disassemble(const Symbol &symbol) const Disassemble code for the given symbol. const Symbol* func = binary->find_demangled_function(\"int __cdecl my_function(int, int)\"); auto insts = binary->disassemble(*func); for (std::unique_ptr inst : insts) { std::cout << inst->to_string() << '\\n'; } See also LIEF::assembly::Instruction disassemble instructions_it disassemble(const std::string &symbol) const Disassemble code for the given symbol name. auto insts = binary->disassemble(\"main\"); for (std::unique_ptr inst : insts) { std::cout << inst->to_string() << '\\n'; } See also LIEF::assembly::Instruction disassemble instructions_it disassemble(const uint8_t *buffer, size_t size, uint64_t address = 0) const Disassemble code provided by the given buffer at the specified address parameter. See also LIEF::assembly::Instruction disassemble inline instructions_it disassemble(const std::vector &buffer, uint64_t address = 0) const Disassemble code provided by the given vector of bytes at the specified address parameter. See also LIEF::assembly::Instruction disassemble inline instructions_it disassemble(LIEF::span buffer, uint64_t address = 0) const disassemble inline instructions_it disassemble(LIEF::span buffer, uint64_t address = 0) const get_section inline Section *get_section(std::string_view name) Return the section matching the given name or a nullptr if it can’t be found. Section names that do not fit in the 8 bytes allocated by the COFF format are stored in the COFF string table while the section itself only holds a / placeholder. This function transparently resolves both forms, so a long name can be looked up with its regular value: const Section* sec = binary->get_section(\".debug_rnglists\"); sec->name(); // \"/18\" sec->coff_string()->str(); // \".debug_rnglists\" Parameters: name – [in] Name of the section get_section const Section *get_section(std::string_view name) const to_string std::string to_string() const ~Binary ~Binary() Friends friend class Parser operator<< inline friend std::ostream &operator<<(std::ostream &os, const Binary &bin) Header Header class Header Class that represents the COFF header. It is subclassed by LIEF::COFF::RegularHeader and LIEF::COFF::BigObjHeader for normal vs /bigobj files. Subclassed by LIEF::COFF::BigObjHeader , LIEF::COFF::RegularHeader Public Types KIND enum class KIND Values: UNKNOWN enumerator UNKNOWN = 0 REGULAR enumerator REGULAR BIGOBJ enumerator BIGOBJ MACHINE_TYPES using MACHINE_TYPES = LIEF::PE:: Header :: MACHINE_TYPES The different architectures (mirrored from PE). Public Functions Header Header() = default Header inline Header( KIND kind) operator= Header &operator=(const Header &) = default Header Header(const Header &) = default operator= Header &operator=( Header &&) = default Header Header( Header &&) = default clone virtual std::unique_ptr< Header > clone() const = 0 kind inline KIND kind() const The type of this header: whether it is regular or using the /bigobj format. machine inline MACHINE_TYPES machine() const The machine type targeted by this COFF. nb_sections inline uint32_t nb_sections() const The number of sections. pointerto_symbol_table inline uint32_t pointerto_symbol_table() const Offset of the symbols table. nb_symbols inline uint32_t nb_symbols() const Number of symbols (including auxiliary symbols). timedatestamp inline uint32_t timedatestamp() const Timestamp when the COFF has been generated. machine inline void machine( MACHINE_TYPES machine) nb_sections inline void nb_sections(uint32_t value) pointerto_symbol_table inline void pointerto_symbol_table(uint32_t value) nb_symbols inline void nb_symbols(uint32_t value) timedatestamp inline void timedatestamp(uint32_t value) to_string virtual std::string to_string() const Tas template inline const T *as() const ~Header virtual ~Header() = default Public Static Functions create static std::unique_ptr< Header > create( BinaryStream &stream) Create a header from the given stream. create static std::unique_ptr< Header > create( BinaryStream &stream, KIND kind) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Header &hdr) Regular Header RegularHeader class RegularHeader : public LIEF::COFF:: Header This class represents the COFF header for non-bigobj. Public Functions RegularHeader inline RegularHeader() operator= RegularHeader &operator=(const RegularHeader &) = default RegularHeader RegularHeader(const RegularHeader &) = default operator= RegularHeader &operator=( RegularHeader &&) = default RegularHeader RegularHeader( RegularHeader &&) = default clone inline virtual std::unique_ptr< Header > clone() const override sizeof_optionalheader inline uint16_t sizeof_optionalheader() const The size of the optional header which follows this header (should be 0). characteristics inline uint16_t characteristics() const Characteristics. sizeof_optionalheader inline void sizeof_optionalheader(uint16_t value) characteristics inline void characteristics(uint16_t value) ~RegularHeader ~RegularHeader() override = default to_string virtual std::string to_string() const override Public Static Functions create static std::unique_ptr< RegularHeader > create( BinaryStream &stream) Create a RegularHeader from the given stream. classof static inline bool classof(const Header *header) BigObj Header BigObjHeader class BigObjHeader : public LIEF::COFF:: Header This class represents the header for a COFF object compiled with /bigobj support (i.e. the number of sections can exceed 65536). The raw definition of the bigobj header is located in winnt.h and named ANON_OBJECT_HEADER_BIGOBJ Public Functions BigObjHeader inline BigObjHeader() operator= BigObjHeader &operator=(const BigObjHeader &) = default BigObjHeader BigObjHeader(const BigObjHeader &) = default operator= BigObjHeader &operator=( BigObjHeader &&) = default BigObjHeader BigObjHeader( BigObjHeader &&) = default clone inline virtual std::unique_ptr< Header > clone() const override version inline uint16_t version() const The version of this header which must be >= 2. uuid inline span uuid() const Originally named ClassID , this uuid should match: {D1BAA1C7-BAEE-4ba9-AF20-FAF66AA4DCB8} . sizeof_data inline uint32_t sizeof_data() const Size of data that follows the header. flags inline uint32_t flags() const 1 means that it contains metadata metadata_size inline uint32_t metadata_size() const Size of CLR metadata. metadata_offset inline uint32_t metadata_offset() const Offset of CLR metadata. version inline void version(uint16_t value) sizeof_data inline void sizeof_data(uint32_t value) flags inline void flags(uint32_t value) metadata_size inline void metadata_size(uint32_t value) metadata_offset inline void metadata_offset(uint32_t value) ~BigObjHeader ~BigObjHeader() override = default to_string virtual std::string to_string() const override Public Static Functions create static std::unique_ptr< BigObjHeader > create( BinaryStream &stream) classof static inline bool classof(const Header *header) Public Static Attributes UUID_SZ static auto UUID_SZ = 16 Section Section class Section : public LIEF:: Section This class represents a COFF section. Public Types COMDAT_SELECTION using COMDAT_SELECTION = AuxiliarySectionDefinition :: COMDAT_SELECTION CHARACTERISTICS using CHARACTERISTICS = LIEF::PE:: Section :: CHARACTERISTICS Mirror Characteristics from PE. relocations_t using relocations_t = std::vector< Relocation *> Container for the relocations in this section (owned by the Binary object). it_relocations using it_relocations = ref_iterator < relocations_t &, Relocation *> Iterator that outputs Relocation &. it_const_relocations using it_const_relocations = const_ref_iterator Iterator that outputs const Relocation &. symbols_t using symbols_t = std::vector< Symbol *> Container for the symbols associated with this section (owned by the Binary object). it_symbols using it_symbols = ref_iterator < symbols_t &, Symbol *> Iterator that outputs Symbol &. it_const_symbols using it_const_symbols = const_ref_iterator Iterator that outputs const Symbol &. Public Functions sizeof_raw_data inline uint32_t sizeof_raw_data() const Return the size of the data in the section. virtual_size inline uint32_t virtual_size() const Virtual size of the section (should be 0). content inline virtual span content() const override Content wrapped by this section. pointerto_raw_data inline uint32_t pointerto_raw_data() const Offset to the section’s content. pointerto_relocation inline uint32_t pointerto_relocation() const Offset to the relocation table. pointerto_line_numbers inline uint32_t pointerto_line_numbers() const The file pointer to the beginning of line-number entries for the section. This is set to zero if there are no COFF line numbers. This value should be zero for an image because COFF debugging information is deprecated and modern debug information relies on the PDB files. numberof_relocations inline uint16_t numberof_relocations() const Number of relocations. Warning If the number of relocations is greater than 0xFFFF (maximum value for 16-bits integer), then the number of relocations is stored in the virtual address of the first relocation. numberof_line_numbers inline uint16_t numberof_line_numbers() const Number of line number entries (if any). characteristics inline uint32_t characteristics() const Characteristics of the section: it provides information about the permissions of the section when mapped. It can also provide information about the purpose of the section (contain code, BSS-like, …). has_characteristic inline bool has_characteristic( CHARACTERISTICS c) const Check if the section has the given CHARACTERISTICS . characteristics_list inline std::vector< CHARACTERISTICS > characteristics_list() const List of the section characteristics. is_discardable inline bool is_discardable() const True if the section can be discarded as needed. This is typically the case for debug-related sections clear inline void clear(uint8_t c) relocations inline it_relocations relocations() Iterator over the relocations associated with this section. relocations inline it_const_relocations relocations() const symbols inline it_symbols symbols() Iterator over the symbols associated with this section. symbols inline it_const_symbols symbols() const comdat_info std::optional< ComdatInfo > comdat_info() const Return comdat information (only if the section has the CHARACTERISTICS::LNK_COMDAT characteristic). has_extended_relocations inline bool has_extended_relocations() const Whether there is a large number of relocations whose number need to be stored in the virtual address attribute. content inline virtual void content(const std::vector &data) override Change section content. name virtual void name(std::string name) override Change the section’s name. virtual_size inline void virtual_size(uint32_t virtual_sz) pointerto_raw_data inline void pointerto_raw_data(uint32_t ptr) pointerto_relocation inline void pointerto_relocation(uint32_t ptr) pointerto_line_numbers inline void pointerto_line_numbers(uint32_t ptr) numberof_relocations inline void numberof_relocations(uint16_t nb) numberof_line_numbers inline void numberof_line_numbers(uint16_t nb) sizeof_raw_data inline void sizeof_raw_data(uint32_t size) characteristics inline void characteristics(uint32_t characteristics) coff_string inline String *coff_string() Return the COFF string associated with the section’s name (or a nullptr). This coff string is usually present for long section names whose length does not fit in the 8 bytes allocated by the COFF format. coff_string inline const String *coff_string() const to_string std::string to_string() const ~Section ~Section() override = default name inline virtual std::string_view name() const Section ’s name. Public Static Functions parse static std::unique_ptr< Section > parse( BinaryStream &stream) Parse a section from the given stream. Friends friend class Parser operator<< inline friend std::ostream &operator<<(std::ostream &os, const Section &sec) ComdatInfo struct ComdatInfo This structure wraps comdat information which is composed of the symbol associated with the comdat section and its selection flag. Public Members symbol Symbol *symbol = nullptr kind COMDAT_SELECTION kind = COMDAT_SELECTION ::NONE Relocation Relocation class Relocation : public LIEF:: Relocation This class represents a COFF relocation. Public Types TYPE enum class TYPE : uint32_t The different relocation types. Please note that the original type is encoded on 16 bits but we encode the type on 32-bits by adding a discriminator from the 17th bit Values: UNKNOWN enumerator UNKNOWN = uint32_t(-1) I386_ABSOLUTE enumerator I386_ABSOLUTE = I386 + 0x0000 I386_DIR16 enumerator I386_DIR16 = I386 + 0x0001 I386_REL16 enumerator I386_REL16 = I386 + 0x0002 I386_DIR32 enumerator I386_DIR32 = I386 + 0x0006 I386_DIR32NB enumerator I386_DIR32NB = I386 + 0x0007 I386_SEG12 enumerator I386_SEG12 = I386 + 0x0009 I386_SECTION enumerator I386_SECTION = I386 + 0x000A I386_SECREL enumerator I386_SECREL = I386 + 0x000B I386_TOKEN enumerator I386_TOKEN = I386 + 0x000C I386_SECREL7 enumerator I386_SECREL7 = I386 + 0x000D I386_REL32 enumerator I386_REL32 = I386 + 0x0014 AMD64_ABSOLUTE enumerator AMD64_ABSOLUTE = X64 + 0x0000 AMD64_ADDR64 enumerator AMD64_ADDR64 = X64 + 0x0001 AMD64_ADDR32 enumerator AMD64_ADDR32 = X64 + 0x0002 AMD64_ADDR32NB enumerator AMD64_ADDR32NB = X64 + 0x0003 AMD64_REL32 enumerator AMD64_REL32 = X64 + 0x0004 AMD64_REL32_1 enumerator AMD64_REL32_1 = X64 + 0x0005 AMD64_REL32_2 enumerator AMD64_REL32_2 = X64 + 0x0006 AMD64_REL32_3 enumerator AMD64_REL32_3 = X64 + 0x0007 AMD64_REL32_4 enumerator AMD64_REL32_4 = X64 + 0x0008 AMD64_REL32_5 enumerator AMD64_REL32_5 = X64 + 0x0009 AMD64_SECTION enumerator AMD64_SECTION = X64 + 0x000A AMD64_SECREL enumerator AMD64_SECREL = X64 + 0x000B AMD64_SECREL7 enumerator AMD64_SECREL7 = X64 + 0x000C AMD64_TOKEN enumerator AMD64_TOKEN = X64 + 0x000D AMD64_SREL32 enumerator AMD64_SREL32 = X64 + 0x000E AMD64_PAIR enumerator AMD64_PAIR = X64 + 0x000F AMD64_SSPAN32 enumerator AMD64_SSPAN32 = X64 + 0x0010 ARM_ABSOLUTE enumerator ARM_ABSOLUTE = ARM + 0x0000 ARM_ADDR32 enumerator ARM_ADDR32 = ARM + 0x0001 ARM_ADDR32NB enumerator ARM_ADDR32NB = ARM + 0x0002 ARM_BRANCH24 enumerator ARM_BRANCH24 = ARM + 0x0003 ARM_BRANCH11 enumerator ARM_BRANCH11 = ARM + 0x0004 ARM_TOKEN enumerator ARM_TOKEN = ARM + 0x0005 ARM_BLX24 enumerator ARM_BLX24 = ARM + 0x0008 ARM_BLX11 enumerator ARM_BLX11 = ARM + 0x0009 ARM_REL32 enumerator ARM_REL32 = ARM + 0x000A ARM_SECTION enumerator ARM_SECTION = ARM + 0x000E ARM_SECREL enumerator ARM_SECREL = ARM + 0x000F ARM_MOV32A enumerator ARM_MOV32A = ARM + 0x0010 ARM_MOV32T enumerator ARM_MOV32T = ARM + 0x0011 ARM_BRANCH20T enumerator ARM_BRANCH20T = ARM + 0x0012 ARM_BRANCH24T enumerator ARM_BRANCH24T = ARM + 0x0014 ARM_BLX23T enumerator ARM_BLX23T = ARM + 0x0015 ARM_PAIR enumerator ARM_PAIR = ARM + 0x0016 ARM64_ABSOLUTE enumerator ARM64_ABSOLUTE = ARM64 + 0x0000 ARM64_ADDR32 enumerator ARM64_ADDR32 = ARM64 + 0x0001 ARM64_ADDR32NB enumerator ARM64_ADDR32NB = ARM64 + 0x0002 ARM64_BRANCH26 enumerator ARM64_BRANCH26 = ARM64 + 0x0003 ARM64_PAGEBASE_REL21 enumerator ARM64_PAGEBASE_REL21 = ARM64 + 0x0004 ARM64_REL21 enumerator ARM64_REL21 = ARM64 + 0x0005 ARM64_PAGEOFFSET_12A enumerator ARM64_PAGEOFFSET_12A = ARM64 + 0x0006 ARM64_PAGEOFFSET_12L enumerator ARM64_PAGEOFFSET_12L = ARM64 + 0x0007 ARM64_SECREL enumerator ARM64_SECREL = ARM64 + 0x0008 ARM64_SECREL_LOW12A enumerator ARM64_SECREL_LOW12A = ARM64 + 0x0009 ARM64_SECREL_HIGH12A enumerator ARM64_SECREL_HIGH12A = ARM64 + 0x000A ARM64_SECREL_LOW12L enumerator ARM64_SECREL_LOW12L = ARM64 + 0x000B ARM64_TOKEN enumerator ARM64_TOKEN = ARM64 + 0x000C ARM64_SECTION enumerator ARM64_SECTION = ARM64 + 0x000D ARM64_ADDR64 enumerator ARM64_ADDR64 = ARM64 + 0x000E ARM64_BRANCH19 enumerator ARM64_BRANCH19 = ARM64 + 0x000F ARM64_BRANCH14 enumerator ARM64_BRANCH14 = ARM64 + 0x0010 ARM64_REL32 enumerator ARM64_REL32 = ARM64 + 0x0011 MIPS_ABSOLUTE enumerator MIPS_ABSOLUTE = MIPS + 0x0000 MIPS_REFHALF enumerator MIPS_REFHALF = MIPS + 0x0001 MIPS_REFWORD enumerator MIPS_REFWORD = MIPS + 0x0002 MIPS_JMPADDR enumerator MIPS_JMPADDR = MIPS + 0x0003 MIPS_REFHI enumerator MIPS_REFHI = MIPS + 0x0004 MIPS_REFLO enumerator MIPS_REFLO = MIPS + 0x0005 MIPS_GPREL enumerator MIPS_GPREL = MIPS + 0x0006 MIPS_LITERAL enumerator MIPS_LITERAL = MIPS + 0x0007 MIPS_SECTION enumerator MIPS_SECTION = MIPS + 0x000A MIPS_SECREL enumerator MIPS_SECREL = MIPS + 0x000B MIPS_SECRELLO enumerator MIPS_SECRELLO = MIPS + 0x000C MIPS_SECRELHI enumerator MIPS_SECRELHI = MIPS + 0x000D MIPS_JMPADDR16 enumerator MIPS_JMPADDR16 = MIPS + 0x0010 MIPS_REFWORDNB enumerator MIPS_REFWORDNB = MIPS + 0x0022 MIPS_PAIR enumerator MIPS_PAIR = MIPS + 0x0025 Public Functions symbol_idx inline uint32_t symbol_idx() const Symbol index associated with this relocation. symbol inline Symbol *symbol() Symbol associated with the relocation (if any). symbol inline const Symbol *symbol() const type inline TYPE type() const Type of the relocation. section inline Section *section() Section in which the relocation takes place. section inline const Section *section() const to_string std::string to_string() const ~Relocation ~Relocation() override = default Public Static Functions to_value static inline uint16_t to_value( TYPE rtype) Convert a relocation enum type into a 16-bits value. from_value static inline TYPE from_value(uint16_t value, Header :: MACHINE_TYPES arch) Create a relocation type from its raw value and the architecture. parse static std::unique_ptr< Relocation > parse( BinaryStream &stream, Header :: MACHINE_TYPES arch) Create a relocation from the given stream. Public Static Attributes I386 static uint32_t I386 = 1 << 17 X64 static uint32_t X64 = 1 << 18 ARM static uint32_t ARM = 1 << 19 ARM64 static uint32_t ARM64 = 1 << 20 MIPS static uint32_t MIPS = 1 << 21 Friends friend class Parser operator<< inline friend std::ostream &operator<<(std::ostream &os, const Relocation &R) String String class String This class represents a string located in the COFF string table. Some of these strings can be used for section names that are greater than 8 bytes. See: LIEF::PE::Section::coff_string() Reference: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#coff-string-table Public Functions String String() = default String inline String(uint32_t offset, std::string str) String String(const String &) = default operator= String &operator=(const String &) = default String String( String &&) = default operator= String &operator=( String &&) = default ~String ~String() = default str inline std::string_view str() const The actual string. str inline std::string &str() Mutable access to the underlying string storage. offset inline uint32_t offset() const The offset of this string the in the COFF string table. This offset includes the first 4-bytes that holds the table size. str inline String &str(std::string str) offset inline String &offset(uint32_t value) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const String &str) Symbol Symbol class Symbol : public LIEF:: Symbol This class represents a COFF symbol. Public Types STORAGE_CLASS enum class STORAGE_CLASS : int32_t Reference: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#storage-class . Values: INVALID enumerator INVALID = 0xFF END_OF_FUNCTION enumerator END_OF_FUNCTION = -1 Physical end of function. NONE enumerator NONE = 0 No symbol. AUTOMATIC enumerator AUTOMATIC = 1 Stack variable. EXTERNAL enumerator EXTERNAL = 2 External symbol. STATIC enumerator STATIC = 3 Static. REGISTER enumerator REGISTER = 4 Register variable. EXTERNAL_DEF enumerator EXTERNAL_DEF = 5 External definition. LABEL enumerator LABEL = 6 Label. UNDEFINED_LABEL enumerator UNDEFINED_LABEL = 7 Undefined label. MEMBER_OF_STRUCT enumerator MEMBER_OF_STRUCT = 8 Member of structure. ARGUMENT enumerator ARGUMENT = 9 Function argument. STRUCT_TAG enumerator STRUCT_TAG = 10 Structure tag. MEMBER_OF_UNION enumerator MEMBER_OF_UNION = 11 Member of union. UNION_TAG enumerator UNION_TAG = 12 Union tag. TYPE_DEFINITION enumerator TYPE_DEFINITION = 13 Type definition. UNDEFINED_STATIC enumerator UNDEFINED_STATIC = 14 Undefined static. ENUM_TAG enumerator ENUM_TAG = 15 Enumeration tag. MEMBER_OF_ENUM enumerator MEMBER_OF_ENUM = 16 Member of enumeration. REGISTER_PARAM enumerator REGISTER_PARAM = 17 Register parameter. BIT_FIELD enumerator BIT_FIELD = 18 Bit field. BLOCK enumerator BLOCK = 100 FUNCTION enumerator FUNCTION = 101 END_OF_STRUCT enumerator END_OF_STRUCT = 102 End of structure. FILE enumerator FILE = 103 File name. SECTION enumerator SECTION = 104 WEAK_EXTERNAL enumerator WEAK_EXTERNAL = 105 Duplicate tag. CLR_TOKEN enumerator CLR_TOKEN = 107 BASE_TYPE enum class BASE_TYPE : uint32_t Values: TY_NULL enumerator TY_NULL = 0 No type information or unknown base type. TY_VOID enumerator TY_VOID = 1 Used with void pointers and functions. TY_CHAR enumerator TY_CHAR = 2 A character (signed byte). TY_SHORT enumerator TY_SHORT = 3 A 2-byte signed integer. TY_INT enumerator TY_INT = 4 A natural integer type on the target. TY_LONG enumerator TY_LONG = 5 A 4-byte signed integer. TY_FLOAT enumerator TY_FLOAT = 6 A 4-byte floating-point number. TY_DOUBLE enumerator TY_DOUBLE = 7 An 8-byte floating-point number. TY_STRUCT enumerator TY_STRUCT = 8 A structure. TY_UNION enumerator TY_UNION = 9 A union. TY_ENUM enumerator TY_ENUM = 10 An enumerated type. TY_MOE enumerator TY_MOE = 11 A member of enumeration (a specific value). TY_BYTE enumerator TY_BYTE = 12 A byte; unsigned 1-byte integer. TY_WORD enumerator TY_WORD = 13 A word; unsigned 2-byte integer. TY_UINT enumerator TY_UINT = 14 An unsigned integer of natural size. TY_DWORD enumerator TY_DWORD = 15 An unsigned 4-byte integer. COMPLEX_TYPE enum class COMPLEX_TYPE : uint32_t Values: TY_NULL enumerator TY_NULL = 0 No complex type; simple scalar variable. TY_POINTER enumerator TY_POINTER = 1 A pointer to base type. TY_FUNCTION enumerator TY_FUNCTION = 2 A function that returns a base type. TY_ARRAY enumerator TY_ARRAY = 3 An array of base type. auxiliary_symbols_t using auxiliary_symbols_t = std::vector> it_auxiliary_symbols_t using it_auxiliary_symbols_t = ref_iterator < auxiliary_symbols_t &, AuxiliarySymbol *> it_const_auxiliary_symbols_t using it_const_auxiliary_symbols_t = const_ref_iterator Public Functions Symbol Symbol() Symbol Symbol(const Symbol &) operator= Symbol &operator=(const Symbol &) Symbol Symbol( Symbol &&) noexcept operator= Symbol &operator=( Symbol &&) noexcept type inline uint16_t type() const The symbol type. The first byte represents the base type (see: base_type() ) while the upper byte represents the complex type, if any (see: complex_type() ). storage_class inline STORAGE_CLASS storage_class() const Storage class of the symbol which indicates what kind of definition a symbol represents. base_type inline BASE_TYPE base_type() const The simple (base) data type. complex_type inline COMPLEX_TYPE complex_type() const The complex type (if any). section_idx inline int16_t section_idx() const The signed integer that identifies the section, using a one-based index into the section table. Some values have special meaning: 0: The symbol record is not yet assigned a section. A value of zero indicates that a reference to an external symbol is defined elsewhere. A value of non-zero is a common symbol with a size that is specified by the value. -1: The symbol has an absolute (non-relocatable) value and is not an address. -2: The symbol provides general type or debugging information but does not correspond to a section. Microsoft tools use this setting along with .file records section inline Section *section() Section associated with this symbol (if any). section inline const Section *section() const is_external inline bool is_external() const is_weak_external inline bool is_weak_external() const is_absolute inline bool is_absolute() const is_undefined inline bool is_undefined() const is_function_line_info inline bool is_function_line_info() const is_function inline bool is_function() const is_file_record inline bool is_file_record() const auxiliary_symbols inline it_auxiliary_symbols_t auxiliary_symbols() Auxiliary symbols associated with this symbol. auxiliary_symbols inline it_const_auxiliary_symbols_t auxiliary_symbols() const name virtual std::string_view name() const override Name of the symbol. If the symbol does not use a short name, it returns the string pointed by the COFF string offset. name virtual std::string &name() override coff_name inline const String *coff_name() const COFF string used to represent the (long) symbol name. coff_name inline String *coff_name() demangled_name std::string demangled_name() const Demangled representation of the symbol or an empty string if it can’t be demangled. type inline Symbol &type(uint16_t ty) storage_class inline Symbol &storage_class(uint8_t value) section_idx inline Symbol §ion_idx(int16_t idx) add_aux AuxiliarySymbol &add_aux(std::unique_ptr< AuxiliarySymbol > sym) Add a new auxiliary record. to_string std::string to_string() const ~Symbol ~Symbol() override Public Static Functions parse static std::unique_ptr< Symbol > parse( parsing_context_t &ctx, BinaryStream &stream, size_t *idx) is_reversed_sec_idx static inline bool is_reversed_sec_idx(int16_t idx) Check if the given section index is a reserved value. Public Static Attributes SYM_SEC_IDX_DEBUG static auto SYM_SEC_IDX_DEBUG = -2 The symbol provides general type or debugging information but does not correspond to a section. Microsoft tools use this setting along with .file records. SYM_SEC_IDX_ABS static auto SYM_SEC_IDX_ABS = -1 The symbol has an absolute (non-relocatable) value and is not an address. SYM_SEC_IDX_UNDEF static auto SYM_SEC_IDX_UNDEF = 0 The symbol record is not yet assigned a section. A value of zero indicates that a reference to an external symbol is defined elsewhere. A value of non-zero is a common symbol with a size that is specified by the value. SYM_COMPLEX_TYPE_SHIFT static auto SYM_COMPLEX_TYPE_SHIFT = 4 Friends friend class Parser operator<< inline friend std::ostream &operator<<(std::ostream &os, const Symbol &entry) parsing_context_t struct parsing_context_t Public Members find_string std::function< String *(uint32_t)> find_string is_bigobj bool is_bigobj AuxiliarySymbol AuxiliarySymbol class AuxiliarySymbol Class that represents an auxiliary symbol. An auxiliary symbol has the same size as a regular LIEF::PE::Symbol (18 bytes) but its content depends on the parent symbol. Subclassed by LIEF::COFF::AuxiliaryCLRToken , LIEF::COFF::AuxiliaryFile , LIEF::COFF::AuxiliaryFunctionDefinition , LIEF::COFF::AuxiliarySectionDefinition , LIEF::COFF::AuxiliaryWeakExternal , LIEF::COFF::AuxiliarybfAndefSymbol Public Types TYPE enum class TYPE Type discriminator for the subclasses. Values: UNKNOWN enumerator UNKNOWN = 0 CLR_TOKEN enumerator CLR_TOKEN FUNC_DEF enumerator FUNC_DEF Auxiliary Format 1 from the PE-COFF documentation. BF_AND_EF enumerator BF_AND_EF Auxiliary Format 2: .bf and .ef Symbols from the PE-COFF documentation. WEAK_EXTERNAL enumerator WEAK_EXTERNAL Auxiliary Format 3: Weak Externals from the PE-COFF documentation. FILE enumerator FILE Auxiliary Format 4: Files from the PE-COFF documentation. SEC_DEF enumerator SEC_DEF Auxiliary Format 5: Section Definitions from the PE-COFF documentation. Public Functions AuxiliarySymbol AuxiliarySymbol() = default AuxiliarySymbol inline AuxiliarySymbol(std::vector payload) AuxiliarySymbol AuxiliarySymbol(const AuxiliarySymbol &) = default operator= AuxiliarySymbol &operator=(const AuxiliarySymbol &) = default AuxiliarySymbol AuxiliarySymbol( AuxiliarySymbol &&) = default operator= AuxiliarySymbol &operator=( AuxiliarySymbol &&) = default clone inline virtual std::unique_ptr< AuxiliarySymbol > clone() const AuxiliarySymbol inline AuxiliarySymbol( TYPE ty) type inline TYPE type() const payload inline span payload() const For unknown type only , return the raw representation of this symbol. payload inline span payload() to_string virtual std::string to_string() const ~AuxiliarySymbol virtual ~AuxiliarySymbol() = default Tas template inline const T *as() const Helper to downcast an AuxiliarySymbol into a concrete implementation. Tas template inline T *as() Public Static Functions parse static std::unique_ptr< AuxiliarySymbol > parse( Symbol &sym, std::vector payload) get_aux_type static TYPE get_aux_type(const Symbol &sym) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const AuxiliarySymbol &aux) AuxiliaryCLRToken AuxiliaryCLRToken class AuxiliaryCLRToken : public LIEF::COFF:: AuxiliarySymbol Auxiliary symbol associated with the CLR_TOKEN storage class. Public Functions AuxiliaryCLRToken inline AuxiliaryCLRToken() AuxiliaryCLRToken inline AuxiliaryCLRToken(uint8_t aux_type, uint8_t reserved, uint32_t symbol_idx, std::vector rgb_reserved) AuxiliaryCLRToken AuxiliaryCLRToken(const AuxiliaryCLRToken &) = default operator= AuxiliaryCLRToken &operator=(const AuxiliaryCLRToken &) = default AuxiliaryCLRToken AuxiliaryCLRToken( AuxiliaryCLRToken &&) = default operator= AuxiliaryCLRToken &operator=( AuxiliaryCLRToken &&) = default clone inline virtual std::unique_ptr< AuxiliarySymbol > clone() const override aux_type inline uint8_t aux_type() const IMAGE_AUX_SYMBOL_TYPE which should be IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF (1) reserved inline uint8_t reserved() const Reserved value (should be 0). symbol_idx inline uint32_t symbol_idx() const Index in the symbol table. symbol inline const Symbol *symbol() const Symbol referenced by symbol_idx() (if resolved). symbol inline Symbol *symbol() rgb_reserved inline span rgb_reserved() const Reserved (padding) values. Should be 0. to_string virtual std::string to_string() const override ~AuxiliaryCLRToken ~AuxiliaryCLRToken() override = default Public Static Functions parse static std::unique_ptr< AuxiliaryCLRToken > parse(const std::vector &payload) classof static inline bool classof(const AuxiliarySymbol *sym) Friends friend class Parser AuxiliaryFunctionDefinition AuxiliaryFunctionDefinition class AuxiliaryFunctionDefinition : public LIEF::COFF:: AuxiliarySymbol This auxiliary symbols marks the beginning of a function definition. Reference: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#auxiliary-format-1-function-definitions Public Functions AuxiliaryFunctionDefinition inline AuxiliaryFunctionDefinition() AuxiliaryFunctionDefinition inline AuxiliaryFunctionDefinition(uint32_t tagidx, uint32_t totalsz, uint32_t ptr_line, uint32_t ptr_next_func, uint16_t padding) AuxiliaryFunctionDefinition AuxiliaryFunctionDefinition(const AuxiliaryFunctionDefinition &) = default operator= AuxiliaryFunctionDefinition &operator=(const AuxiliaryFunctionDefinition &) = default AuxiliaryFunctionDefinition AuxiliaryFunctionDefinition( AuxiliaryFunctionDefinition &&) = default operator= AuxiliaryFunctionDefinition &operator=( AuxiliaryFunctionDefinition &&) = default clone inline virtual std::unique_ptr< AuxiliarySymbol > clone() const override tag_index inline uint32_t tag_index() const The symbol-table index of the corresponding .bf (begin function) symbol record. total_size inline uint32_t total_size() const The size of the executable code for the function itself. If the function is in its own section, the SizeOfRawData in the section header is greater or equal to this field, depending on alignment considerations. ptr_to_line_number inline uint32_t ptr_to_line_number() const The file offset of the first COFF line-number entry for the function, or zero if none exists (deprecated). ptr_to_next_func inline uint32_t ptr_to_next_func() const The symbol-table index of the record for the next function. If the function is the last in the symbol table, this field is set to zero. padding inline uint16_t padding() const Padding value (should be 0). to_string virtual std::string to_string() const override ~AuxiliaryFunctionDefinition ~AuxiliaryFunctionDefinition() override = default Public Static Functions parse static std::unique_ptr< AuxiliaryFunctionDefinition > parse(const std::vector &payload) classof static inline bool classof(const AuxiliarySymbol *sym) AuxiliaryWeakExternal AuxiliaryWeakExternal class AuxiliaryWeakExternal : public LIEF::COFF:: AuxiliarySymbol “Weak externals” are a mechanism for object files that allows flexibility at link time. A module can contain an unresolved external symbol ( sym1 ), but it can also include an auxiliary record that indicates that if sym1 is not present at link time, another external symbol ( sym2 ) is used to resolve references instead. If a definition of sym1 is linked, then an external reference to the symbol is resolved normally. If a definition of sym1 is not linked, then all references to the weak external for sym1 refer to sym2 instead. The external symbol, sym2 , must always be linked; typically, it is defined in the module that contains the weak reference to sym1 . Reference: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#auxiliary-format-3-weak-externals Public Types CHARACTERISTICS enum class CHARACTERISTICS : uint32_t Values: SEARCH_NOLIBRARY enumerator SEARCH_NOLIBRARY = 1 No library search for sym1 should be performed. SEARCH_LIBRARY enumerator SEARCH_LIBRARY = 2 A library search for sym1 should be performed. SEARCH_ALIAS enumerator SEARCH_ALIAS = 3 sym1 is an alias for sym2 ANTI_DEPENDENCY enumerator ANTI_DEPENDENCY = 4 Public Functions AuxiliaryWeakExternal inline AuxiliaryWeakExternal() AuxiliaryWeakExternal inline AuxiliaryWeakExternal(uint32_t sym_idx, uint32_t characteristics, std::vector padding) AuxiliaryWeakExternal AuxiliaryWeakExternal(const AuxiliaryWeakExternal &) = default operator= AuxiliaryWeakExternal &operator=(const AuxiliaryWeakExternal &) = default AuxiliaryWeakExternal AuxiliaryWeakExternal( AuxiliaryWeakExternal &&) = default operator= AuxiliaryWeakExternal &operator=( AuxiliaryWeakExternal &&) = default clone inline virtual std::unique_ptr< AuxiliarySymbol > clone() const override sym_idx inline uint32_t sym_idx() const The symbol-table index of sym2 , the symbol to be linked if sym1 is not found. characteristics inline CHARACTERISTICS characteristics() const padding inline span padding() const to_string virtual std::string to_string() const override ~AuxiliaryWeakExternal ~AuxiliaryWeakExternal() override = default Public Static Functions parse static std::unique_ptr< AuxiliaryWeakExternal > parse(const std::vector &payload) classof static inline bool classof(const AuxiliarySymbol *sym) AuxiliarybfAndefSymbol AuxiliarybfAndefSymbol class AuxiliarybfAndefSymbol : public LIEF::COFF:: AuxiliarySymbol Public Functions AuxiliarybfAndefSymbol inline AuxiliarybfAndefSymbol() AuxiliarybfAndefSymbol AuxiliarybfAndefSymbol(const AuxiliarybfAndefSymbol &) = default operator= AuxiliarybfAndefSymbol &operator=(const AuxiliarybfAndefSymbol &) = default AuxiliarybfAndefSymbol AuxiliarybfAndefSymbol( AuxiliarybfAndefSymbol &&) = default operator= AuxiliarybfAndefSymbol &operator=( AuxiliarybfAndefSymbol &&) = default clone inline virtual std::unique_ptr< AuxiliarySymbol > clone() const override to_string inline virtual std::string to_string() const override ~AuxiliarybfAndefSymbol ~AuxiliarybfAndefSymbol() override = default Public Static Functions parse static std::unique_ptr< AuxiliarybfAndefSymbol > parse( Symbol &sym, const std::vector &payload) classof static inline bool classof(const AuxiliarySymbol *sym) AuxiliarySectionDefinition AuxiliarySectionDefinition class AuxiliarySectionDefinition : public LIEF::COFF:: AuxiliarySymbol This auxiliary symbol exposes information about the associated section. It duplicates some information that are provided in the section header Public Types COMDAT_SELECTION enum class COMDAT_SELECTION : uint8_t Values for the AuxiliarySectionDefinition::selection attribute. See: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#comdat-sections-object-only Values: NONE enumerator NONE = 0 NODUPLICATES enumerator NODUPLICATES = 1 If this symbol is already defined, the linker issues a multiply defined symbol error. ANY enumerator ANY Any section that defines the same COMDAT symbol can be linked; the rest are removed. SAME_SIZE enumerator SAME_SIZE The linker chooses an arbitrary section among the definitions for this symbol. If all definitions are not the same size, a multiply defined symbol error is issued. EXACT_MATCH enumerator EXACT_MATCH The linker chooses an arbitrary section among the definitions for this symbol. If all definitions do not match exactly, a multiply defined symbol error is issued. ASSOCIATIVE enumerator ASSOCIATIVE The section is linked if a certain other COMDAT section is linked. This other section is indicated by the Number field of the auxiliary symbol record for the section definition. This setting is useful for definitions that have components in multiple sections (for example, code in one and data in another), but where all must be linked or discarded as a set. The other section this section is associated with must be a COMDAT section, which can be another associative COMDAT section. An associative COMDAT section’s section association chain can’t form a loop. The section association chain must eventually come to a COMDAT section that doesn’t have COMDAT_SELECTION::ASSOCIATIVE set. LARGEST enumerator LARGEST The linker chooses the largest definition from among all the definitions for this symbol. If multiple definitions have this size, the choice between them is arbitrary. Public Functions AuxiliarySectionDefinition inline AuxiliarySectionDefinition() AuxiliarySectionDefinition inline AuxiliarySectionDefinition(uint32_t length, uint16_t nb_relocs, uint16_t nb_lines, uint32_t checksum, uint32_t sec_idx, uint8_t selection, uint8_t reserved) AuxiliarySectionDefinition AuxiliarySectionDefinition(const AuxiliarySectionDefinition &) = default operator= AuxiliarySectionDefinition &operator=(const AuxiliarySectionDefinition &) = default AuxiliarySectionDefinition AuxiliarySectionDefinition( AuxiliarySectionDefinition &&) = default operator= AuxiliarySectionDefinition &operator=( AuxiliarySectionDefinition &&) = default clone inline virtual std::unique_ptr< AuxiliarySymbol > clone() const override length inline uint32_t length() const The size of section data. The same as SizeOfRawData in the section header. nb_relocs inline uint16_t nb_relocs() const The number of relocation entries for the section. nb_line_numbers inline uint16_t nb_line_numbers() const The number of line-number entries for the section. checksum inline uint32_t checksum() const The checksum for communal data. It is applicable if the IMAGE_SCN_LNK_COMDAT flag is set in the section header. section_idx inline uint32_t section_idx() const One-based index into the section table for the associated section. This is used when the COMDAT selection setting is 5. selection inline COMDAT_SELECTION selection() const The COMDAT selection number. This is applicable if the section is a COMDAT section. reserved inline uint8_t reserved() const Reserved value (should be 0). to_string virtual std::string to_string() const override ~AuxiliarySectionDefinition ~AuxiliarySectionDefinition() override = default Public Static Functions parse static std::unique_ptr< AuxiliarySectionDefinition > parse(const std::vector &payload) classof static inline bool classof(const AuxiliarySymbol *sym) AuxiliaryFile AuxiliaryFile class AuxiliaryFile : public LIEF::COFF:: AuxiliarySymbol This auxiliary symbol represents a filename (auxiliary format 4). The Symbol::name itself should start with .file , and this auxiliary record gives the name of a source-code file. Reference: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#auxiliary-format-4-files Public Functions AuxiliaryFile inline AuxiliaryFile() AuxiliaryFile inline AuxiliaryFile(std::string file) AuxiliaryFile AuxiliaryFile(const AuxiliaryFile &) = default operator= AuxiliaryFile &operator=(const AuxiliaryFile &) = default AuxiliaryFile AuxiliaryFile( AuxiliaryFile &&) = default operator= AuxiliaryFile &operator=( AuxiliaryFile &&) = default clone inline virtual std::unique_ptr< AuxiliarySymbol > clone() const override filename inline std::string_view filename() const The associated filename. filename inline AuxiliaryFile &filename(std::string file) to_string inline virtual std::string to_string() const override ~AuxiliaryFile ~AuxiliaryFile() override = default Public Static Functions parse static std::unique_ptr< AuxiliaryFile > parse(const std::vector &payload) classof static inline bool classof(const AuxiliarySymbol *sym) Utilities LIEF::COFF::get_kind Header :: KIND LIEF::COFF::get_kind( BinaryStream &stream) This function determines if the given stream wraps a COFF binary and if so, whether it’s a regular or bigobj COFF. LIEF::COFF::is_coff inline bool LIEF::COFF::is_coff( BinaryStream &stream) Check if the given stream wraps a COFF file. LIEF::COFF::is_coff bool LIEF::COFF::is_coff(std::string_view file) Check if the file is a COFF. LIEF::COFF::is_coff inline bool LIEF::COFF::is_coff(const std::vector &buffer) Check if the given buffer points to a COFF file. LIEF::COFF::is_coff inline bool LIEF::COFF::is_coff(const uint8_t *buffer, size_t size) Check if the given buffer points to a COFF file. LIEF::COFF::is_bigobj inline bool LIEF::COFF::is_bigobj( BinaryStream &stream) Check if the COFF file wrapped by the given stream is a bigobj . LIEF::COFF::is_regular inline bool LIEF::COFF::is_regular( BinaryStream &stream) Check if the COFF file wrapped by the given stream is regular (i.e. not a bigobj).", "contentHash": "faad5f74a22dae3caa7ac3cbcd17db434d1f9da1dbd9ee6f375880907bc474b7", "description": "COFF C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "formats/coff/cpp", "documentID": "320f29aa44638993d5c4981ca7c8e9414475e7571248480b0cb32e03563c1c10", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/coff/cpp.md", "title": "COFF C++ API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/coff/index.html", "content": "COFF API C++ Python Rust Introduction COFF object files can be parsed using lief.COFF.parse() ( lief::coff::Binary::parse ; lief.COFF.parse() ; LIEF::COFF::Parser::parse() ) or the generic lief.parse() ( lief::Binary::parse ; lief::Binary::from ; lief.parse() ) function: Python import lief # Using a filepath as a string coff: lief.COFF.Binary | None = lief.COFF.parse(\"hello.obj\") # Using a Path from pathlib coff: lief.COFF.Binary | None = lief.COFF.parse( pathlib.Path(r\"C:\\Users\\romain\\test.obj\") ) # Using an io object with open(\"/tmp/test.ob\", \"rb\") as f: coff: lief.COFF.Binary | None = lief.COFF.parse(f) C++ #include // Using a file path as a std::string std::unique_ptr coff = LIEF::COFF::Parser::parse(\"test.obj\"); Rust let coff: lief::coff::Binary = lief::coff::Binary::parse(\"test.obj\").unwrap(); These functions return a lief.COFF.Binary ( lief::coff::Binary ; lief.COFF.Binary ; LIEF::COFF::Binary ) instance that exposes the main API for processing and accessing COFF information: Python coff: lief.COFF.Binary for section in coff.sections: print(section.name) C++ std::unique_ptr coff; for (const LIEF::COFF::Section& section : coff->sections()) { std::cout << section.name() << '\\n'; } Rust let coff: &lief::coff::Binary = some_coff; for section in coff.sections() { println!(\"{section:?} {section}\"); } Disassembler The lief.COFF.Binary ( lief::coff::Binary ; lief.COFF.Binary ; LIEF::COFF::Binary ) object exposes a disassembler API for iterating over the instructions of a COFF binary. One can disassemble a function using lief.COFF.Binary.disassemble() ( lief::coff::Binary::disassemble_slice ; lief::coff::Binary::disassemble_function ; lief::coff::Binary::disassemble_symbol ; lief.COFF.Binary.disassemble() ; lief.COFF.Binary.disassemble_from_bytes() ; LIEF::COFF::Binary::disassemble() ): Python coff: lief.COFF.Binary for inst in coff.disassemble(\"?foo@@YAHHH@Z\"): print(inst) # Using demangled representation for inst in coff.disassemble(\"int __cdecl bar(int, int)\"): print(inst) C++ std::unique_ptr coff; for (const auto& inst : coff->disassemble(\"?foo@@YAHHH@Z\")) { std::cout << inst.to_string() << '\\n'; } // Using demangled representation for (const auto& inst : coff->disassemble(\"int __cdecl bar(int, int)\")) { std::cout << inst.to_string() << '\\n'; } Rust let coff: &lief::coff::Binary = some_coff; for inst in coff.disassemble_function(\"?foo@@YAHHH@Z\") { println!(\"{}\", inst); } // Using demangled representation for inst in coff.disassemble_function(\"int __cdecl bar(int, int)\") { println!(\"{}\", inst); } For more details about the disassembler and the lief.assembly.Instruction ( lief::assembly::Instructions ; LIEF::assembly::Instruction ; lief.assembly.Instruction ) API, please refer to the Disassembler section .", "contentHash": "0f56fe4e0bda30344f2c5a1d1bc790a28258f13c9178756de5e1714de77c7636", "description": "COFF object files can be parsed using lief.COFF.parse() or the generic lief.parse() function:", "docname": "formats/coff/index", "documentID": "81188adcf5169a4cfb22825c82f8c2767f17a43f79506a601158d257417bd56b", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/coff/index.md", "title": "COFF - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/coff/python.html", "content": "Python Parser lief.COFF.parse lief.COFF.parse( obj: str | io.IOBase | os.PathLike | bytes | list[int] , config: lief.COFF.ParserConfig ) → lief.COFF.Binary | None Parse the COFF binary specified in the first parameter and return a lief.COFF.Binary object The second argument is an optional configuration that can be used to define which part(s) of the COFF should be parsed or skipped. lief.COFF.ParserConfig class lief.COFF.ParserConfig( self ) Bases: object all all = default_conf default_conf = Binary lief.COFF.Binary class lief.COFF.Binary Bases: object Class that represents a COFF Binary disassembledisassemble disassemble( self , function: lief._lief.COFF.Symbol ) → Iterator[ lief._lief.assembly.Instruction | None] disassemble( self , function_name: str ) → Iterator[ lief._lief.assembly.Instruction | None] Overloaded function. disassemble(self, function: lief._lief.COFF.Symbol) -> Iterator[Optional[lief._lief.assembly.Instruction]] Disassemble code for the given symbol func = binary.find_demangled_function(\"int __cdecl my_function(int, int)\"); insts = binary.disassemble(\"main\"); for inst in insts: print(inst) See also lief.assembly.Instruction disassemble(self, function_name: str) -> Iterator[Optional[lief._lief.assembly.Instruction]] Disassemble code for the given symbol name insts = binary.disassemble(\"main\"); for inst in insts: print(inst) See also lief.assembly.Instruction disassemble_from_bytes disassemble_from_bytes( self , buffer: bytes , address: int = 0 ) → Iterator[ lief._lief.assembly.Instruction | None] Disassemble code from the provided bytes raw = bytes(binary.get_section(\".text\").content) insts = binary.disassemble_from_bytes(raw); for inst in insts: print(inst) See also lief.assembly.Instruction find_demangled_function find_demangled_function( self , name: str ) → lief._lief.COFF.Symbol | None Try to find the function (symbol) with the given demangled name find_function find_function( self , name: str ) → lief._lief.COFF.Symbol | None Try to find the function (symbol) with the given name find_string find_string( self , offset: int ) → lief._lief.COFF.String | None Try to find the COFF string at the given offset in the COFF string table. Warning This offset must include the first 4 bytes holding the size of the table. Hence, the first string starts a the offset 4. functions property functions → lief.COFF.Binary.it_functions Iterator over the functions implemented in this COFF get_section get_section( self , name: str ) → lief._lief.COFF.Section | None Return the Section matching the given name. Section names that do not fit in the 8 bytes allocated by the COFF format are stored in the COFF string table while the section itself only holds a / placeholder. This function transparently resolves both forms, so a long name can be looked up with its regular value: sec = binary.get_section(\".debug_rnglists\") sec.name # '/18' sec.coff_string.string # '.debug_rnglists' header property header → lief.COFF.Header The COFF header relocations property relocations → lief.COFF.Binary.it_relocations Iterator over all the relocations used by this COFF binary sections property sections → lief.COFF.Binary.it_section Iterator over the different sections located in this COFF binary string_table property string_table → lief.PE.Binary.it_strings_table Iterator over the COFF’s strings symbols property symbols → lief.PE.Binary.it_symbols Iterator over the COFF’s symbols Header lief.COFF.Header class lief.COFF.Header Bases: object Class that represents the COFF header. It is subclassed by RegularHeader and BigObjHeader for normal vs /bigobj files KIND class KIND( *values ) Bases: Enum BIGOBJ BIGOBJ = 2 REGULAR REGULAR = 1 UNKNOWN UNKNOWN = 0 copy copy( self ) → lief._lief.COFF.Header | None Duplicate the current instance of this object kind property kind → lief.COFF.Header.KIND The type of this header: whether it is regular or using the /bigobj format machine property machine → lief.PE.Header.MACHINE_TYPES The machine type targeted by this COFF nb_sections property nb_sections → int The number of sections nb_symbols property nb_symbols → int Number of symbols (including auxiliary symbols) pointerto_symbol_table property pointerto_symbol_table → int Offset of the symbols table timedatestamp property timedatestamp → int Timestamp when the COFF has been generated RegularHeader lief.COFF.RegularHeader class lief.COFF.RegularHeader Bases: Header This class represents the COFF header for non-bigobj characteristics property characteristics → int Characteristics sizeof_optionalheader property sizeof_optionalheader → int The size of the optional header that follows this header (should be 0) BigObjHeader lief.COFF.BigObjHeader class lief.COFF.BigObjHeader Bases: Header This class represents the header for a COFF object compiled with /bigobj support (i.e. the number of sections can exceed 65536). The raw definition of the bigobj header is located in winnt.h and named ANON_OBJECT_HEADER_BIGOBJ flags property flags → int 1 means that it contains metadata metadata_offset property metadata_offset → int Offset of CLR metadata metadata_size property metadata_size → int Size of CLR metadata sizeof_data property sizeof_data → int Size of data that follows the header uuid property uuid → memoryview Originally named ClassID , this uuid should match: {D1BAA1C7-BAEE-4ba9-AF20-FAF66AA4DCB8} . version property version → int The version of this header which must be >= 2 Section lief.COFF.Section class lief.COFF.Section Bases: Section This class represents a COFF section ComdatInfo class ComdatInfo Bases: object This class wraps comdat information which is composed of the symbol associated with the comdat section and its selection flag kind property kind → lief.COFF.AuxiliarySectionDefinition.COMDAT_SELECTION symbol property symbol → lief.COFF.Symbol characteristics property characteristics → int The characteristics that describe the purpose of the section characteristics_lists property characteristics_lists → list[ lief.PE.Section.CHARACTERISTICS ] characteristics as a list coff_string property coff_string → lief.COFF.String | None Return the COFF string associated with the section’s name (or None) This coff string is usually present for long section names whose length does not fit in the 8 bytes allocated by the COFF format. comdat_info property comdat_info → lief.COFF.Section.ComdatInfo | None Return comdat information (only if the section has the lief.PE.Section.CHARACTERISTICS.LNK_COMDAT characteristic) has_characteristic has_characteristic( self , characteristic: lief._lief.PE.Section.CHARACTERISTICS ) → bool True if the section has the given characteristic has_extended_relocations property has_extended_relocations → bool Whether there is a large number of relocations whose number need to be stored in the virtual address attribute is_discardable property is_discardable → bool True if the section can be discarded as needed. This is typically the case for debug-related sections. numberof_line_numbers property numberof_line_numbers → int The number of line-number entries for the section. This value should be zero for an image because COFF debugging information is deprecated. See: pointerto_line_numbers numberof_relocations property numberof_relocations → int Number of relocations. Warning If the number of relocations is greater than 0xFFFF (maximum value for 16-bits integer), then the number of relocations is stored in the virtual address attribute. pointerto_line_numbers property pointerto_line_numbers → int The file pointer to the beginning of line-number entries for the section. This is set to zero if there are no COFF line numbers. This value should be zero for an image because COFF debugging information is deprecated and modern debug information relies on the PDB files. pointerto_raw_data property pointerto_raw_data → int Offset to the section’s content pointerto_relocation property pointerto_relocation → int Offset to the relocation table relocations property relocations → lief.COFF.Section.it_relocations Iterator over the relocations performed in this section sizeof_raw_data property sizeof_raw_data → int Return the size of the data in the section. symbols property symbols → lief.COFF.Section.it_symbols Iterator over the symbols associated with this section virtual_size property virtual_size → int Virtual size of the section (should be 0) Relocation lief.COFF.Relocation class lief.COFF.Relocation Bases: Relocation TYPE class TYPE( *values ) Bases: Enum AMD64_ABSOLUTE AMD64_ABSOLUTE = 262144 AMD64_ADDR32 AMD64_ADDR32 = 262146 AMD64_ADDR32NB AMD64_ADDR32NB = 262147 AMD64_ADDR64 AMD64_ADDR64 = 262145 AMD64_PAIR AMD64_PAIR = 262159 AMD64_REL32 AMD64_REL32 = 262148 AMD64_REL32_1 AMD64_REL32_1 = 262149 AMD64_REL32_2 AMD64_REL32_2 = 262150 AMD64_REL32_3 AMD64_REL32_3 = 262151 AMD64_REL32_4 AMD64_REL32_4 = 262152 AMD64_REL32_5 AMD64_REL32_5 = 262153 AMD64_SECREL AMD64_SECREL = 262155 AMD64_SECREL7 AMD64_SECREL7 = 262156 AMD64_SECTION AMD64_SECTION = 262154 AMD64_SREL32 AMD64_SREL32 = 262158 AMD64_SSPAN32 AMD64_SSPAN32 = 262160 AMD64_TOKEN AMD64_TOKEN = 262157 ARM64_ABSOLUTE ARM64_ABSOLUTE = 1048576 ARM64_ADDR32 ARM64_ADDR32 = 1048577 ARM64_ADDR32NB ARM64_ADDR32NB = 1048578 ARM64_ADDR64 ARM64_ADDR64 = 1048590 ARM64_BRANCH14 ARM64_BRANCH14 = 1048592 ARM64_BRANCH19 ARM64_BRANCH19 = 1048591 ARM64_BRANCH26 ARM64_BRANCH26 = 1048579 ARM64_PAGEBASE_REL21 ARM64_PAGEBASE_REL21 = 1048580 ARM64_PAGEOFFSET_12A ARM64_PAGEOFFSET_12A = 1048582 ARM64_PAGEOFFSET_12L ARM64_PAGEOFFSET_12L = 1048583 ARM64_REL21 ARM64_REL21 = 1048581 ARM64_REL32 ARM64_REL32 = 1048593 ARM64_SECREL ARM64_SECREL = 1048584 ARM64_SECREL_HIGH12A ARM64_SECREL_HIGH12A = 1048586 ARM64_SECREL_LOW12A ARM64_SECREL_LOW12A = 1048585 ARM64_SECREL_LOW12L ARM64_SECREL_LOW12L = 1048587 ARM64_SECTION ARM64_SECTION = 1048589 ARM64_TOKEN ARM64_TOKEN = 1048588 ARM_ABSOLUTE ARM_ABSOLUTE = 524288 ARM_ADDR32 ARM_ADDR32 = 524289 ARM_ADDR32NB ARM_ADDR32NB = 524290 ARM_BLX11 ARM_BLX11 = 524297 ARM_BLX23T ARM_BLX23T = 524309 ARM_BLX24 ARM_BLX24 = 524296 ARM_BRANCH11 ARM_BRANCH11 = 524292 ARM_BRANCH20T ARM_BRANCH20T = 524306 ARM_BRANCH24 ARM_BRANCH24 = 524291 ARM_BRANCH24T ARM_BRANCH24T = 524308 ARM_MOV32A ARM_MOV32A = 524304 ARM_MOV32T ARM_MOV32T = 524305 ARM_PAIR ARM_PAIR = 524310 ARM_REL32 ARM_REL32 = 524298 ARM_SECREL ARM_SECREL = 524303 ARM_SECTION ARM_SECTION = 524302 ARM_TOKEN ARM_TOKEN = 524293 I386_ABSOLUTE I386_ABSOLUTE = 131072 I386_DIR16 I386_DIR16 = 131073 I386_DIR32 I386_DIR32 = 131078 I386_DIR32NB I386_DIR32NB = 131079 I386_REL16 I386_REL16 = 131074 I386_REL32 I386_REL32 = 131092 I386_SECREL I386_SECREL = 131083 I386_SECREL7 I386_SECREL7 = 131085 I386_SECTION I386_SECTION = 131082 I386_SEG12 I386_SEG12 = 131081 I386_TOKEN I386_TOKEN = 131084 MIPS_ABSOLUTE MIPS_ABSOLUTE = 2097152 MIPS_GPREL MIPS_GPREL = 2097158 MIPS_JMPADDR MIPS_JMPADDR = 2097155 MIPS_JMPADDR16 MIPS_JMPADDR16 = 2097168 MIPS_LITERAL MIPS_LITERAL = 2097159 MIPS_PAIR MIPS_PAIR = 2097189 MIPS_REFHALF MIPS_REFHALF = 2097153 MIPS_REFHI MIPS_REFHI = 2097156 MIPS_REFLO MIPS_REFLO = 2097157 MIPS_REFWORD MIPS_REFWORD = 2097154 MIPS_REFWORDNB MIPS_REFWORDNB = 2097186 MIPS_SECREL MIPS_SECREL = 2097163 MIPS_SECRELHI MIPS_SECRELHI = 2097165 MIPS_SECRELLO MIPS_SECRELLO = 2097164 MIPS_SECTION MIPS_SECTION = 2097162 UNKNOWN UNKNOWN = 4294967295 from_value from_value( arg: int ) → lief.COFF.Relocation.TYPE = section property section → lief.COFF.Section | None Section in which the relocation takes place symbol property symbol → lief.COFF.Symbol | None Symbol associated with the relocation (if any) symbol_idx property symbol_idx → int Symbol index associated with this relocation type property type → lief.COFF.Relocation.TYPE Type of the relocation String lief.COFF.String class lief.COFF.String Bases: object This class represents a string located in the COFF string table. Some of these strings can be used for section’s name where its length is greater than 8 bytes. See: coff_string . Reference: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#coff-string-table offset property offset → int The offset of this string the in the COFF string table. This offset includes the first 4-bytes that holds the table size string property string → str The actual string Symbol lief.COFF.Symbol class lief.COFF.Symbol Bases: Symbol Class that represents a COFF symbol. Warning The lief.Symbol.value should be interpreted in perspective of the storage_class Reference: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#coff-symbol-table BASE_TYPE class BASE_TYPE( *values ) Bases: Enum BYTE BYTE = 12 CHAR CHAR = 2 DOUBLE DOUBLE = 7 DWORD DWORD = 15 ENUM ENUM = 10 FLOAT FLOAT = 6 INT INT = 4 LONG LONG = 5 MOE MOE = 11 NULL NULL = 0 SHORT SHORT = 3 STRUCT STRUCT = 8 UINT UINT = 14 UNION UNION = 9 VOID VOID = 1 WORD WORD = 13 from_value from_value( arg: int ) → lief.COFF.Symbol.BASE_TYPE = COMPLEX_TYPE class COMPLEX_TYPE( *values ) Bases: Enum ARRAY ARRAY = 3 FUNCTION FUNCTION = 2 NULL NULL = 0 POINTER POINTER = 1 from_value from_value( arg: int ) → lief.COFF.Symbol.COMPLEX_TYPE = STORAGE_CLASS class STORAGE_CLASS( *values ) Bases: Enum Reference: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#storage-class ARGUMENT ARGUMENT = 9 AUTOMATIC AUTOMATIC = 1 BIT_FIELD BIT_FIELD = 18 BLOCK BLOCK = 100 CLR_TOKEN CLR_TOKEN = 107 END_OF_FUNCTION END_OF_FUNCTION = -1 END_OF_STRUCT END_OF_STRUCT = 102 ENUM_TAG ENUM_TAG = 15 EXTERNAL EXTERNAL = 2 EXTERNAL_DEF EXTERNAL_DEF = 5 FILE FILE = 103 FUNCTION FUNCTION = 101 LABEL LABEL = 6 MEMBER_OF_ENUM MEMBER_OF_ENUM = 16 MEMBER_OF_STRUCT MEMBER_OF_STRUCT = 8 MEMBER_OF_UNION MEMBER_OF_UNION = 11 NONE NONE = 0 REGISTER REGISTER = 4 REGISTER_PARAM REGISTER_PARAM = 17 SECTION SECTION = 104 STATIC STATIC = 3 STRUCT_TAG STRUCT_TAG = 10 TYPE_DEFINITION TYPE_DEFINITION = 13 UNDEFINED_LABEL UNDEFINED_LABEL = 7 UNDEFINED_STATIC UNDEFINED_STATIC = 14 UNION_TAG UNION_TAG = 12 WEAK_EXTERNAL WEAK_EXTERNAL = 105 from_value from_value( arg: int ) → lief.COFF.Symbol.STORAGE_CLASS = auxiliary_symbols property auxiliary_symbols → lief.COFF.Symbol.it_auxiliary_symbols_t Auxiliary symbols associated with this symbol. base_type property base_type → lief.COFF.Symbol.BASE_TYPE The simple (base) data type coff_name property coff_name → lief.COFF.String | None COFF string used to represents the (long) symbol name complex_type property complex_type → lief.COFF.Symbol.COMPLEX_TYPE The complex type (if any) demangled_name property demangled_name → str Demangled representation of the symbol or an empty string if it can’t be demangled is_absolute property is_absolute → bool is_external property is_external → bool is_file_record property is_file_record → bool is_function property is_function → bool is_function_line_info property is_function_line_info → bool is_undefined property is_undefined → bool is_weak_external property is_weak_external → bool section property section → lief.COFF.Section | None Section associated with this symbol (if any) section_idx property section_idx → int The signed integer that identifies the section, using a one-based index into the section table. Some values have special meaning: 0: The symbol record is not yet assigned a section. A value of zero indicates that a reference to an external symbol is defined elsewhere. A value of non-zero is a common symbol with a size that is specified by the value. -1: The symbol has an absolute (non-relocatable) value and is not an address. -2: The symbol provides general type or debugging information but does not correspond to a section. Microsoft tools use this setting along with .file records storage_class property storage_class → lief.COFF.Symbol.STORAGE_CLASS Storage class of the symbol which indicates what kind of definition a symbol represents. type property type → int The symbol type. The first byte represents the base type (see: base_type ) while the upper byte represents the complex type, if any (see: complex_type ). AuxiliarySymbol lief.COFF.AuxiliarySymbol class lief.COFF.AuxiliarySymbol Bases: object Class that represents an auxiliary symbol. An auxiliary symbol has the same size as a regular lief.PE.Symbol (18 bytes) but its content depends on the parent symbol. TYPE class TYPE( *values ) Bases: Enum Type discriminator for the subclasses BF_AND_EF BF_AND_EF = 3 CLR_TOKEN CLR_TOKEN = 1 FILE FILE = 5 FUNC_DEF FUNC_DEF = 2 SEC_DEF SEC_DEF = 6 UNKNOWN UNKNOWN = 0 WEAK_EXTERNAL WEAK_EXTERNAL = 4 from_value from_value( arg: int ) → lief.COFF.AuxiliarySymbol.TYPE = copy copy( self ) → lief._lief.COFF.AuxiliarySymbol | None Duplicate the current instance of this object payload property payload → memoryview For unknown type only , return the raw representation of this symbol type property type → lief.COFF.AuxiliarySymbol.TYPE AuxiliaryCLRToken lief.COFF.AuxiliaryCLRToken class lief.COFF.AuxiliaryCLRToken Bases: AuxiliarySymbol Auxiliary symbol associated with the CLR_TOKEN storage class aux_type property aux_type → int IMAGE_AUX_SYMBOL_TYPE which should be IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF (1) reserved property reserved → int Reserved value (should be 0) rgb_reserved property rgb_reserved → memoryview Reserved (padding) values. Should be 0 symbol property symbol → lief.COFF.Symbol | None Symbol referenced by symbol_idx (if resolved) symbol_idx property symbol_idx → int Index in the symbol table AuxiliaryFunctionDefinition lief.COFF.AuxiliaryFunctionDefinition class lief.COFF.AuxiliaryFunctionDefinition Bases: AuxiliarySymbol This auxiliary symbol marks the beginning of a function definition. Reference: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#auxiliary-format-1-function-definitions padding property padding → int Padding value (should be 0) ptr_to_line_number property ptr_to_line_number → int The file offset of the first COFF line-number entry for the function, or zero if none exists (deprecated) ptr_to_next_func property ptr_to_next_func → int The symbol-table index of the record for the next function. If the function is the last in the symbol table, this field is set to zero tag_index property tag_index → int The symbol-table index of the corresponding .bf (begin function) symbol record. total_size property total_size → int The size of the executable code for the function itself. If the function is in its own section, the SizeOfRawData in the section header is greater or equal to this field, depending on alignment considerations AuxiliaryWeakExternal lief.COFF.AuxiliaryWeakExternal class lief.COFF.AuxiliaryWeakExternal Bases: AuxiliarySymbol “Weak externals” are a mechanism for object files that allows flexibility at link time. A module can contain an unresolved external symbol ( sym1 ), but it can also include an auxiliary record that indicates that if sym1 is not present at link time, another external symbol ( sym2 ) is used to resolve references instead. If a definition of sym1 is linked, then an external reference to the symbol is resolved normally. If a definition of sym1 is not linked, then all references to the weak external for sym1 refer to sym2 instead. The external symbol, sym2 , must always be linked; typically, it is defined in the module that contains the weak reference to sym1 . Reference: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#auxiliary-format-3-weak-externals CHARACTERISTICS class CHARACTERISTICS( *values ) Bases: Enum ANTI_DEPENDENCY ANTI_DEPENDENCY = 4 SEARCH_ALIAS SEARCH_ALIAS = 3 SEARCH_LIBRARY SEARCH_LIBRARY = 2 SEARCH_NOLIBRARY SEARCH_NOLIBRARY = 1 characteristics property characteristics → lief.COFF.AuxiliaryWeakExternal.CHARACTERISTICS padding property padding → memoryview sym_idx property sym_idx → int The symbol-table index of sym2, the symbol to be linked if sym1 is not found. AuxiliarybfAndefSymbol lief.COFF.AuxiliarybfAndefSymbol class lief.COFF.AuxiliarybfAndefSymbol Bases: AuxiliarySymbol AuxiliarySectionDefinition lief.COFF.AuxiliarySectionDefinition class lief.COFF.AuxiliarySectionDefinition Bases: AuxiliarySymbol This auxiliary symbol exposes information about the associated section. It duplicates some information that are provided in the section header COMDAT_SELECTION class COMDAT_SELECTION( *values ) Bases: Enum Values for the AuxiliarySectionDefinition::selection attribute See: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#comdat-sections-object-only ANY ANY = 2 ASSOCIATIVE ASSOCIATIVE = 5 EXACT_MATCH EXACT_MATCH = 4 LARGEST LARGEST = 6 NODUPLICATES NODUPLICATES = 1 NONE NONE = 0 SAME_SIZE SAME_SIZE = 3 checksum property checksum → int The checksum for communal data. It is applicable if the IMAGE_SCN_LNK_COMDAT flag is set in the section header. length property length → int The size of section data. The same as SizeOfRawData in the section header. nb_line_numbers property nb_line_numbers → int The number of line-number entries for the section. nb_relocs property nb_relocs → int The number of relocation entries for the section. reserved property reserved → int Reserved value (should be 0) section_idx property section_idx → int One-based index into the section table for the associated section. This is used when the COMDAT selection setting is 5. selection property selection → lief.COFF.AuxiliarySectionDefinition.COMDAT_SELECTION The COMDAT selection number. This is applicable if the section is a COMDAT section. AuxiliaryFile lief.COFF.AuxiliaryFile class lief.COFF.AuxiliaryFile Bases: AuxiliarySymbol This auxiliary symbol represents a filename (auxiliary format 4) The lief.Symbol.name itself should start with .file , and this auxiliary record gives the name of a source-code file. Reference: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#auxiliary-format-4-files filename property filename → str The associated filename Utilities lief.is_coff lief.is_coff( file: str | os.PathLike ) → bool Check if the given file is a COFF", "contentHash": "465320e5077eb1babdf911625138458f793e33176df4d133cbc5cab3c2b9f435", "description": "COFF Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "formats/coff/python", "documentID": "dd20c0d10e2c8801b8f9496039ba559719eafdefc0e4e58238824986442b7370", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/coff/python.md", "title": "COFF Python API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/coff/rust.html", "content": "Rust Note Please check: lief::coff", "contentHash": "9180a30aea0bc7d1a05d37a5323dc2b79d41c50cbd0de16d25aa4d0ec00f59a4", "description": "COFF Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "formats/coff/rust", "documentID": "e94d5580fee88fc2c065033f6b37dfe2227c4589ca8bf5435d65fec47cf3b2e6", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/coff/rust.md", "title": "COFF Rust API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/elf/cpp.html", "content": "C++ Parser Parser class Parser : public LIEF:: Parser Class which parses and transforms an ELF file into a ELF::Binary object. Subclassed by LIEF::OAT::Parser Public Types ELF_TYPE enum ELF_TYPE Values: ELF_UNKNOWN enumerator ELF_UNKNOWN ELF32 enumerator ELF32 ELF64 enumerator ELF64 Public Functions operator= Parser &operator=(const Parser &) = delete Parser Parser(const Parser &) = delete ~Parser ~Parser() Public Static Functions parse static std::unique_ptr< Binary > parse(std::string_view file, const ParserConfig &conf = ParserConfig :: all ()) Parse an ELF file and return a LIEF::ELF::Binary object. For weird binaries (e.g. sectionless) you can choose which method to use for counting dynamic symbols Parameters: file – [in] Path to the ELF binary conf – [in] Optional configuration for the parser Returns: LIEF::ELF::Binary as a unique_ptr PathTparse template = 0> static inline std::unique_ptr< Binary > parse(const PathT &file, const ParserConfig &conf = ParserConfig :: all ()) Same as parse(std::string_view, const ParserConfig&) but the file is given as a std::filesystem::path . parse static std::unique_ptr< Binary > parse(const std::vector &data, const ParserConfig &conf = ParserConfig :: all ()) Parse the given raw data as an ELF binary and return a LIEF::ELF::Binary object. For weird binaries (e.g. sectionless) you can choose which method to use to count dynamic symbols Parameters: data – [in] Raw ELF as a std::vector of uint8_t conf – [in] Optional configuration for the parser Returns: LIEF::ELF::Binary parse static std::unique_ptr< Binary > parse(std::unique_ptr< BinaryStream > stream, const ParserConfig &conf = ParserConfig :: all ()) Parse the ELF binary from the given stream and return a LIEF::ELF::Binary object. For weird binaries (e.g. sectionless) you can choose which method to use to count dynamic symbols Parameters: stream – [in] The stream which wraps the ELF binary conf – [in] Optional configuration for the parser Returns: LIEF::ELF::Binary parse_from_memory static std::unique_ptr< Binary > parse_from_memory(uintptr_t address, const ParserConfig &conf = ParserConfig :: all ()) Parse the ELF binary from the given memory address. Parameters: address – [in] Base address of the ELF binary in memory conf – [in] Optional configuration for the parser Returns: LIEF::ELF::Binary parse_from_memory static std::unique_ptr< Binary > parse_from_memory(uintptr_t address, size_t size, const ParserConfig &conf = ParserConfig :: all ()) Parse the ELF binary from the given memory address with the given size. Parameters: address – [in] Base address of the ELF binary in memory size – [in] Size of the memory region conf – [in] Optional configuration for the parser Returns: LIEF::ELF::Binary parse_from_dump static std::unique_ptr< Binary > parse_from_dump(std::string_view filepath, uint64_t addr, const ParserConfig &conf = ParserConfig :: all ()) Parse an ELF binary from a memory dump located on disk. A dump is a raw capture of the process memory that was mapped starting at the virtual address addr . This is typically used to parse an ELF image that has been dumped from memory (e.g. from a debugger or a runtime hook). Parameters: filepath – [in] Path to the file that contains the memory dump addr – [in] Virtual address at which the dump was mapped conf – [in] Optional configuration for the parser PathTparse_from_dump template = 0> static inline std::unique_ptr< Binary > parse_from_dump(const PathT &filepath, uint64_t addr, const ParserConfig &conf = ParserConfig :: all ()) Same as parse_from_dump(std::string_view, uint64_t, const ParserConfig&) but the dump file is given as a std::filesystem::path . parse_from_dump static std::unique_ptr< Binary > parse_from_dump( BinaryStream &stream, uint64_t addr, const ParserConfig &conf = ParserConfig :: all ()) Same as parse_from_dump(std::string_view, uint64_t, const ParserConfig&) but the dump is wrapped in the given non-owned stream. parse_from_dump static std::unique_ptr< Binary > parse_from_dump(std::unique_ptr< BinaryStream > stream, uint64_t addr, const ParserConfig &conf = ParserConfig :: all ()) Same as parse_from_dump(std::string_view, uint64_t, const ParserConfig&) but the dump is wrapped in the given owned stream. Public Static Attributes NB_MAX_SYMBOLS static uint32_t NB_MAX_SYMBOLS = 1000000 DELTA_NB_SYMBOLS static uint32_t DELTA_NB_SYMBOLS = 3000 NB_MAX_BUCKETS static uint32_t NB_MAX_BUCKETS = NB_MAX_SYMBOLS NB_MAX_CHAINS static uint32_t NB_MAX_CHAINS = 1000000 NB_MAX_SEGMENTS static uint32_t NB_MAX_SEGMENTS = 10000 NB_MAX_RELOCATIONS static uint32_t NB_MAX_RELOCATIONS = 3000000 NB_MAX_DYNAMIC_ENTRIES static uint32_t NB_MAX_DYNAMIC_ENTRIES = 1000 MAX_SEGMENT_SIZE static uint32_t MAX_SEGMENT_SIZE = 3_GB Friends friend class OAT::Parser ParserConfig struct ParserConfig This structure is used to tweak the ELF Parser ( ELF::Parser ). Public Types DYNSYM_COUNT enum class DYNSYM_COUNT Methods that can be used by the LIEF::ELF::Parser to count the number of dynamic symbols. Values: AUTO enumerator AUTO = 0 Automatic detection. SECTION enumerator SECTION Count based on sections (not very reliable). HASH enumerator HASH Count based on hash table (reliable). RELOCATIONS enumerator RELOCATIONS Count based on PLT/GOT relocations (very reliable but not accurate). Public Members parse_relocations bool parse_relocations = true Whether relocations (including plt-like relocations) should be parsed. parse_dyn_symbols bool parse_dyn_symbols = true Whether dynamic symbols (those from .dynsym ) should be parsed. parse_symtab_symbols bool parse_symtab_symbols = true Whether debug symbols (those from .symtab ) should be parsed. parse_symbol_versions bool parse_symbol_versions = true Whether versioning symbols should be parsed. parse_notes bool parse_notes = true Whether ELF notes information should be parsed. parse_overlay bool parse_overlay = true Whether the overlay data should be parsed. count_mtd DYNSYM_COUNT count_mtd = DYNSYM_COUNT :: AUTO The method used to count the number of dynamic symbols. page_size uint64_t page_size = 0 Memory page size if the binary uses a non-standard value. For instance, SPARCV9 binary can use page size from 0x2000 to 0x100000. Public Static Functions all static inline ParserConfig all() This returns a ParserConfig object configured to process all the ELF elements. Binary Binary class Binary : public LIEF:: Binary Class which represents an ELF binary. Subclassed by LIEF::OAT::Binary Public Types PHDR_RELOC enum PHDR_RELOC This enum describes the different ways to relocate the segments table. Values: AUTO enumerator AUTO = 0 Defer the choice of the layout to LIEF. PIE_SHIFT enumerator PIE_SHIFT The content of the binary right after the segments table is shifted and the relocations are updated accordingly. This kind of shift only works with PIE binaries. BSS_END enumerator BSS_END The new segments table is relocated right after the first bss-like segment. BINARY_END enumerator BINARY_END The new segments table is relocated at the end of the binary. SEGMENT_GAP enumerator SEGMENT_GAP The new segments table is relocated between two LOAD segments. This kind of relocation is only doable when there is an alignment enforcement. SEC_INSERT_POS enum class SEC_INSERT_POS This enum defines where the content of a newly added section should be inserted. Values: AUTO enumerator AUTO = 0 Defer the choice to LIEF. POST_SEGMENT enumerator POST_SEGMENT Insert the section after the last valid offset in the segments table. With this choice, the section is inserted after the loaded content but before any debug information. POST_SECTION enumerator POST_SECTION Insert the section after the last valid offset in the section table. With this choice, the section is inserted at the very end of the binary. string_list_t using string_list_t = std::vector notes_t using notes_t = std::vector> Internal container for storing notes. it_notes using it_notes = ref_iterator < notes_t &, Note *> Iterator which outputs Note & object. it_const_notes using it_const_notes = const_ref_iterator Iterator which outputs const Note & object. symbols_version_requirement_t using symbols_version_requirement_t = std::vector> Internal container for storing SymbolVersionRequirement . it_symbols_version_requirement using it_symbols_version_requirement = ref_iterator < symbols_version_requirement_t &, SymbolVersionRequirement *> Iterator which outputs SymbolVersionRequirement & object. it_const_symbols_version_requirement using it_const_symbols_version_requirement = const_ref_iterator Iterator which outputs const SymbolVersionRequirement & object. symbols_version_definition_t using symbols_version_definition_t = std::vector> Internal container for storing SymbolVersionDefinition . it_symbols_version_definition using it_symbols_version_definition = ref_iterator < symbols_version_definition_t &, SymbolVersionDefinition *> Iterator which outputs SymbolVersionDefinition & object. it_const_symbols_version_definition using it_const_symbols_version_definition = const_ref_iterator Iterator which outputs const SymbolVersionDefinition & object. segments_t using segments_t = std::vector> Internal container for storing ELF’s Segment . it_segments using it_segments = ref_iterator < segments_t &, Segment *> Iterator which outputs Segment & object. it_const_segments using it_const_segments = const_ref_iterator Iterator which outputs const Segment & object. dynamic_entries_t using dynamic_entries_t = std::vector> Internal container for storing ELF’s DynamicEntry . it_dynamic_entries using it_dynamic_entries = ref_iterator < dynamic_entries_t &, DynamicEntry *> Iterator which outputs DynamicEntry & object. it_const_dynamic_entries using it_const_dynamic_entries = const_ref_iterator Iterator which outputs const DynamicEntry & object. symbols_version_t using symbols_version_t = std::vector> Internal container for storing ELF’s SymbolVersion . it_symbols_version using it_symbols_version = ref_iterator < symbols_version_t &, SymbolVersion *> Iterator which outputs SymbolVersion & object. it_const_symbols_version using it_const_symbols_version = const_ref_iterator Iterator which outputs const SymbolVersion & object. relocations_t using relocations_t = std::vector> Internal container for storing ELF’s Relocation . it_pltgot_relocations using it_pltgot_relocations = filter_iterator < relocations_t &, Relocation *> Iterator which outputs plt/got Relocation & object. it_const_pltgot_relocations using it_const_pltgot_relocations = const_filter_iterator Iterator which outputs plt/got const Relocation & object. it_dynamic_relocations using it_dynamic_relocations = filter_iterator < relocations_t &, Relocation *> Iterator which outputs dynamic Relocation & object (not related to the PLT/GOT mechanism). it_const_dynamic_relocations using it_const_dynamic_relocations = const_filter_iterator Iterator which outputs dynamic const Relocation & object (not related to the PLT/GOT mechanism). it_object_relocations using it_object_relocations = filter_iterator < relocations_t &, Relocation *> Iterator which outputs Relocation & object found in object files (.o). it_const_object_relocations using it_const_object_relocations = const_filter_iterator Iterator which outputs const Relocation & object found in object files (.o). it_relocations using it_relocations = ref_iterator < relocations_t &, Relocation *> Iterator which outputs Relocation & object. it_const_relocations using it_const_relocations = const_ref_iterator Iterator which outputs const Relocation & object. symbols_t using symbols_t = std::vector> Internal container for storing ELF’s Symbol . it_dynamic_symbols using it_dynamic_symbols = ref_iterator < symbols_t &, Symbol *> Iterator which outputs the Dynamic Symbol & object. it_const_dynamic_symbols using it_const_dynamic_symbols = const_ref_iterator Iterator which outputs the Dynamic const Symbol & object. it_symtab_symbols using it_symtab_symbols = ref_iterator < symbols_t &, Symbol *> Iterator which outputs the static/debug Symbol & object. it_const_symtab_symbols using it_const_symtab_symbols = const_ref_iterator Iterator which outputs the static/debug const Symbol & object. it_symbols using it_symbols = ref_iterator > Iterator which outputs static and dynamic Symbol & object. it_const_symbols using it_const_symbols = const_ref_iterator > Iterator which outputs static and dynamic const Symbol & object. it_exported_symbols using it_exported_symbols = filter_iterator > Iterator which outputs exported Symbol & object. it_const_exported_symbols using it_const_exported_symbols = const_filter_iterator > Iterator which outputs exported const Symbol & object. it_imported_symbols using it_imported_symbols = filter_iterator > Iterator which outputs imported Symbol & object. it_const_imported_symbols using it_const_imported_symbols = const_filter_iterator > Iterator which outputs imported const Symbol & object. sections_t using sections_t = std::vector> Internal container for storing ELF’s Section . it_sections using it_sections = ref_iterator < sections_t &, Section *> Iterator which outputs Section & object. it_const_sections using it_const_sections = const_ref_iterator Iterator which outputs const Section & object. Public Functions operator= Binary &operator=(const Binary &) = delete Binary Binary(const Binary ©) = delete type inline Header :: CLASS type() const Return binary’s class (ELF32 or ELF64). header inline Header &header() Return Elf header . header inline const Header &header() const last_offset_section uint64_t last_offset_section() const Return the last offset used in binary according to sections table. last_offset_segment uint64_t last_offset_segment() const Return the last offset used in binary according to segments table. next_virtual_address uint64_t next_virtual_address() const Return the next virtual address available. sections inline it_sections sections() Return an iterator over the binary’s sections. sections inline it_const_sections sections() const entrypoint inline virtual uint64_t entrypoint() const override Return the binary’s entrypoint. segments inline it_segments segments() Return binary’s segments. segments inline it_const_segments segments() const dynamic_entries inline it_dynamic_entries dynamic_entries() Return binary’s dynamic entries. dynamic_entries inline it_const_dynamic_entries dynamic_entries() const add DynamicEntry &add(const DynamicEntry &entry) Add the given dynamic entry and return the new entry. add Note &add(const Note ¬e) Add the given note and return the created entry. remove void remove(const DynamicEntry &entry) Remove the given dynamic entry. remove void remove( DynamicEntry :: TAG tag) Remove all dynamic entries with the given tag. remove void remove(const Section §ion, bool clear = false) Remove the given section. The clear parameter can be used to zeroize the original content beforehand. Parameters: section – [in] The section to remove clear – [in] Whether zeroize the original content remove void remove(const Note ¬e) Remove the given note. remove void remove( Note :: TYPE type) Remove all notes with the given type. remove void remove(const Segment &seg, bool clear = false) Remove the given segment. If clear is set, the original content of the segment will be filled with zeros before removal. remove void remove( Segment :: TYPE type, bool clear = false) Remove all segments associated with the given type. If clear is set, the original content of the segment will be filled with zeros before removal. dynamic_symbols inline it_dynamic_symbols dynamic_symbols() Return an iterator over the binary’s dynamic symbols The dynamic symbols are those located in the .dynsym section. dynamic_symbols inline it_const_dynamic_symbols dynamic_symbols() const exported_symbols it_exported_symbols exported_symbols() Return symbols which are exported by the binary. exported_symbols it_const_exported_symbols exported_symbols() const imported_symbols it_imported_symbols imported_symbols() Return symbols which are imported by the binary. imported_symbols it_const_imported_symbols imported_symbols() const symtab_symbols inline it_symtab_symbols symtab_symbols() Return the debug symbols from the .symtab section. symtab_symbols inline it_const_symtab_symbols symtab_symbols() const symbols_version inline it_symbols_version symbols_version() Return the symbol versions. symbols_version inline it_const_symbols_version symbols_version() const symbols_version_definition inline it_symbols_version_definition symbols_version_definition() Return symbols version definition. symbols_version_definition inline it_const_symbols_version_definition symbols_version_definition() const symbols_version_requirement inline it_symbols_version_requirement symbols_version_requirement() Return Symbol version requirement. symbols_version_requirement inline it_const_symbols_version_requirement symbols_version_requirement() const dynamic_relocations it_dynamic_relocations dynamic_relocations() Return dynamic relocations. dynamic_relocations it_const_dynamic_relocations dynamic_relocations() const add_dynamic_relocation Relocation &add_dynamic_relocation(const Relocation &relocation) Add a new dynamic relocation. We consider a dynamic relocation as a relocation which is not plt-related See: add_pltgot_relocation add_pltgot_relocation Relocation &add_pltgot_relocation(const Relocation &relocation) Add a .plt.got relocation. This kind of relocation is usually associated with a PLT stub that aims at resolving the underlying symbol. See also: add_dynamic_relocation add_object_relocation Relocation *add_object_relocation(const Relocation &relocation, const Section §ion) Add relocation for object file (.o). The first parameter is the section to add while the second parameter is the LIEF::ELF::Section associated with the relocation. If there is an error, this function returns a nullptr . Otherwise, it returns the relocation added. pltgot_relocations it_pltgot_relocations pltgot_relocations() Return plt.got relocations. pltgot_relocations it_const_pltgot_relocations pltgot_relocations() const object_relocations it_object_relocations object_relocations() Return relocations used in an object file ( *.o ). object_relocations it_const_object_relocations object_relocations() const relocations inline it_relocations relocations() Return all relocations present in the binary. relocations inline it_const_relocations relocations() const get_relocation const Relocation *get_relocation(uint64_t address) const Return relocation associated with the given address. It returns a nullptr if it is not found. get_relocation inline Relocation *get_relocation(uint64_t address) get_relocation const Relocation *get_relocation(const Symbol &symbol) const Return relocation associated with the given Symbol It returns a nullptr if it is not found. get_relocation inline Relocation *get_relocation(const Symbol &symbol) get_relocation const Relocation *get_relocation(const std::string &symbol_name) const Return relocation associated with the given Symbol name It returns a nullptr if it is not found. get_relocation inline Relocation *get_relocation(const std::string &symbol_name) use_gnu_hash inline bool use_gnu_hash() const true if GNU hash is used See also gnu_hash and use_sysv_hash gnu_hash inline const GnuHash *gnu_hash() const Return the GnuHash object in readonly If the ELF binary does not use the GNU hash table, return a nullptr. use_sysv_hash inline bool use_sysv_hash() const true if SYSV hash is used See also sysv_hash and use_gnu_hash sysv_hash inline const SysvHash *sysv_hash() const Return the SysvHash object as a read-only object If the ELF binary does not use the legacy sysv hash table, return a nullptr. has_section inline bool has_section(const std::string &name) const Check if a section with the given name exists in the binary. has_section_with_offset bool has_section_with_offset(uint64_t offset) const Check if a section that handles the given offset exists. has_section_with_va bool has_section_with_va(uint64_t va) const Check if a section that handles the given virtual address exists. get_section inline Section *get_section(std::string_view name) Return Section with the given name . If the section can’t be found, it returns a nullptr. get_section const Section *get_section(std::string_view name) const text_section inline Section *text_section() Return the .text section. If the section can’t be found, it returns a nullptr. dynamic_section Section *dynamic_section() Return the .dynamic section. If the section can’t be found, it returns a nullptr. hash_section Section *hash_section() Return the hash section. If the section can’t be found, it returns a nullptr. symtab_symbols_section Section *symtab_symbols_section() Return section which holds the symtab symbols. If the section can’t be found, it returns a nullptr. imagebase virtual uint64_t imagebase() const override Return program image base. For instance 0x40000 . To compute the image base, we look for the PT_PHDR segment header (phdr), and we return phdr->p_vaddr - phdr->p_offset virtual_size virtual uint64_t virtual_size() const override Return the size of the mapped binary. has_interpreter bool has_interpreter() const Check if the binary uses a loader (also named linker or interpreter). See also interpreter interpreter inline std::string_view interpreter() const Return the ELF interpreter if any. (e.g. /lib64/ld-linux-x86-64.so.2 ) If the binary does not have an interpreter, it returns an empty string. See also has_interpreter interpreter inline void interpreter(const std::string &interpreter) Change the interpreter. symbols inline it_symbols symbols() Return an iterator on both static and dynamic symbols. symbols inline it_const_symbols symbols() const export_symbol Symbol &export_symbol(const Symbol &symbol) Export the given symbol and create it if it doesn’t exist. export_symbol Symbol &export_symbol(const std::string &symbol_name, uint64_t value = 0) Export the symbol with the given name and create it if it doesn’t exist. has_dynamic_symbol inline bool has_dynamic_symbol(const std::string &name) const Check if the symbol with the given name exists in the dynamic symbols table. get_dynamic_symbol const Symbol *get_dynamic_symbol(const std::string &name) const Get the dynamic symbol from the given name. Return a nullptr if it can’t be found. get_dynamic_symbol inline Symbol *get_dynamic_symbol(const std::string &name) has_symtab_symbol inline bool has_symtab_symbol(const std::string &name) const Check if the symbol with the given name exists in the symtab symbol table. get_symtab_symbol const Symbol *get_symtab_symbol(const std::string &name) const Get the symtab symbol from the given name Return a nullptr if it can’t be found. get_symtab_symbol inline Symbol *get_symtab_symbol(const std::string &name) strings string_list_t strings(size_t min_size = 5) const Return list of the strings used by the ELF binary. Basically, this function looks for strings in the .rodata section remove_symbol void remove_symbol(const std::string &name) Remove symbols with the given name in both: dynamic symbols symtab symbols See also remove_symtab_symbol , remove_dynamic_symbol remove_symtab_symbol void remove_symtab_symbol(const std::string &name) Remove symtab symbols with the given name. remove_symtab_symbol void remove_symtab_symbol( Symbol *symbol) remove_dynamic_symbol void remove_dynamic_symbol(const std::string &name) Remove dynamic symbols with the given name. remove_dynamic_symbol void remove_dynamic_symbol( Symbol *symbol) Remove the given symbol from the dynamic symbols table. As a side effect, it will remove any ELF::Relocation that refers to this symbol and the SymbolVersion (if any) associated with this symbol get_function_address virtual result get_function_address(const std::string &func_name) const override Return the address of the given function name. get_function_address result get_function_address(const std::string &func_name, bool demangled) const Return the address of the given function name. Parameters: func_name – [in] The function’s name target demangled – [in] Use the demangled name add Section *add(const Section §ion, bool loaded = true, SEC_INSERT_POS pos = SEC_INSERT_POS :: AUTO ) Add a new section in the binary. This function requires a well-formed ELF binary Parameters: section – [in] The section object to insert loaded – [in] Boolean value to indicate that section’s data must be loaded by a PT_LOAD segment pos – [in] Position where to insert the data in the sections table Returns: The section added. The size and the virtual address might change. extend Section *extend(const Section §ion, uint64_t size) add_symtab_symbol Symbol &add_symtab_symbol(const Symbol &symbol) Add a symtab symbol. add_dynamic_symbol Symbol &add_dynamic_symbol(const Symbol &symbol, const SymbolVersion *version = nullptr) Add a dynamic symbol with the associated SymbolVersion . add_exported_function Symbol &add_exported_function(uint64_t address, const std::string &name = \"\") Create a symbol for the function at the given address and export it. add_library DynamicEntryLibrary &add_library(const std::string &library_name) Add a library as dependency. remove_library void remove_library(const std::string &library_name) Remove the given library from the dependencies. get_library inline DynamicEntryLibrary *get_library(const std::string &library_name) Get the library object ( DynamicEntryLibrary ) from the given name If the library can’t be found, it returns a nullptr. get_library const DynamicEntryLibrary *get_library(const std::string &library_name) const Get the library object ( DynamicEntryLibrary ) from the given name If the library can’t be found, it returns a nullptr. has_library inline bool has_library(const std::string &name) const Check if the given library name exists in the current binary. add Segment *add(const Segment &segment, uint64_t base = 0) Add a new segment in the binary. The segment is inserted at the end This function requires a well-formed ELF binary Returns: The segment added. Virtual address and File Offset might change. replace Segment *replace(const Segment &new_segment, const Segment &original_segment, uint64_t base = 0) Replace the segment given in 2nd parameter with the segment given in the first one and return the updated segment. Warning The original_segment is no longer valid after this function extend Segment *extend(const Segment &segment, uint64_t size) patch_address virtual void patch_address(uint64_t address, const std::vector &patch_value, LIEF:: Binary :: VA_TYPES addr_type = LIEF:: Binary :: VA_TYPES :: AUTO ) override Patch the content at virtual address address with patch_value . Parameters: address – [in] Address to patch patch_value – [in] Patch to apply addr_type – [in] Specify if the address should be used as an absolute virtual address or an RVA patch_address virtual void patch_address(uint64_t address, uint64_t patch_value, size_t size = sizeof(uint64_t), LIEF:: Binary :: VA_TYPES addr_type = LIEF:: Binary :: VA_TYPES :: AUTO ) override Patch the address with the given value. Parameters: address – [in] Address to patch patch_value – [in] Patch to apply size – [in] Size of the value in bytes (1, 2, … 8) addr_type – [in] Specify if the address should be used as an absolute virtual address or an RVA patch_pltgot void patch_pltgot(const Symbol &symbol, uint64_t address) Patch the imported symbol with the address . Parameters: symbol – [in] Imported symbol to patch address – [in] New address patch_pltgot void patch_pltgot(const std::string &symbol_name, uint64_t address) Patch the imported symbol’s name with the address . Parameters: symbol_name – [in] Imported symbol’s name to patch address – [in] New address strip void strip() Strip the binary by removing symtab symbols. remove_section virtual void remove_section(const std::string &name, bool clear = false) override Remove a binary’s section. Parameters: name – [in] The name of the section to remove clear – [in] Whether zeroize the original content write inline void write(const std::string &filename) Reconstruct the binary object and write it in filename . This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run). Parameters: filename – Path for the written ELF binary write void write(const std::string &filename, const Builder :: config_t &config) Reconstruct the binary object with the given config and write it in filename . This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run). Parameters: filename – Path for the written ELF binary config – Builder configuration write inline void write(std::ostream &os) Reconstruct the binary object and write it in os stream. This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run). Parameters: os – Output stream for the written ELF binary write void write(std::ostream &os, const Builder :: config_t &config) Reconstruct the binary object with the given config and write it in os stream. Parameters: os – Output stream for the written ELF binary config – Builder configuration raw std::vector raw() Reconstruct the binary object and return its content as a byte vector. virtual_address_to_offset result virtual_address_to_offset(uint64_t virtual_address) const Convert a virtual address to a file offset. offset_to_virtual_address virtual result offset_to_virtual_address(uint64_t offset, uint64_t slide = 0) const override Convert the given offset into a virtual address. Parameters: offset – [in] The offset to convert. slide – [in] If not 0, it will replace the default base address (if any) is_pie virtual bool is_pie() const override Check if the binary has been compiled with -fpie -pie flags. To do so we check if there is a PT_INTERP segment and if the binary type is ET_DYN (Shared object) has_nx virtual bool has_nx() const override Check if the binary uses the NX protection (Non executable stack). dynsym_idx int64_t dynsym_idx(const std::string &name) const Symbol index in the dynamic symbol table or -1 if the symbol does not exist. dynsym_idx int64_t dynsym_idx(const Symbol &sym) const symtab_idx int64_t symtab_idx(const std::string &name) const Symbol index from the .symtab section or -1 if the symbol is not present. symtab_idx int64_t symtab_idx(const Symbol &sym) const section_from_offset const Section *section_from_offset(uint64_t offset, bool skip_nobits = true) const Return the ELF::Section from the given offset . Return a nullptr if a section can’t be found. If skip_nobits is set (which is the case by default), this function won’t consider section for which the type is SHT_NOBITS (like .bss, .tbss, ... ) section_from_offset inline Section *section_from_offset(uint64_t offset, bool skip_nobits = true) section_from_virtual_address const Section *section_from_virtual_address(uint64_t address, bool skip_nobits = true) const Return the ELF::Section from the given address . Return a nullptr if a section can’t be found. If skip_nobits is set (which is the case by default), this function won’t consider section for which type is SHT_NOBITS (like .bss, .tbss, ... ) section_from_virtual_address inline Section *section_from_virtual_address(uint64_t address, bool skip_nobits = true) segment_from_virtual_address const Segment *segment_from_virtual_address(uint64_t address) const Return the ELF::Segment from the given address . Return a nullptr if a segment can’t be found. segment_from_virtual_address inline Segment *segment_from_virtual_address(uint64_t address) segment_from_virtual_address const Segment *segment_from_virtual_address( Segment :: TYPE type, uint64_t address) const segment_from_virtual_address inline Segment *segment_from_virtual_address( Segment :: TYPE type, uint64_t address) segment_from_offset const Segment *segment_from_offset(uint64_t offset) const Return the ELF::Segment from the offset . Return a nullptr if a segment can’t be found. segment_from_offset inline Segment *segment_from_offset(uint64_t offset) get const DynamicEntry *get( DynamicEntry :: TAG tag) const Return the first ELF::DynamicEntry associated with the given tag If the tag can’t be found, it returns a nullptr. get inline DynamicEntry *get( DynamicEntry :: TAG tag) get const Segment *get( Segment :: TYPE type) const Return the first ELF::Segment associated with the given type. If a segment can’t be found, it returns a nullptr. get inline Segment *get( Segment :: TYPE type) get const Note *get( Note :: TYPE type) const Return the first ELF::Note associated with the given type If a note can’t be found, it returns a nullptr. get inline Note *get( Note :: TYPE type) get const Section *get( Section :: TYPE type) const Return the first ELF::Section associated with the given type If a section can’t be found, it returns a nullptr. get inline Section *get( Section :: TYPE type) has inline bool has( DynamicEntry :: TAG tag) const Check if an ELF::DynamicEntry associated with the given tag exists. has inline bool has( Segment :: TYPE type) const Check if ELF::Segment associated with the given type exists. has inline bool has( Note :: TYPE type) const Check if a ELF::Note associated with the given type exists. has inline bool has( Section :: TYPE type) const Check if a ELF::Section associated with the given type exists. get_content_from_virtual_address virtual span get_content_from_virtual_address(uint64_t virtual_address, uint64_t size, Binary ::VA_TYPES addr_type = Binary ::VA_TYPES::AUTO) const override Return the content located at virtual address. accept virtual void accept(LIEF::Visitor &visitor) const override Method associated with the visitor pattern. permute_dynamic_symbols void permute_dynamic_symbols(const std::vector &permutation) Apply the given permutation on the dynamic symbols table. ctor_functions virtual LIEF:: Binary :: functions_t ctor_functions() const override List of binary constructors (typically, the functions located in the .init_array ). dtor_functions LIEF:: Binary :: functions_t dtor_functions() const List of the binary destructors (typically, the functions located in the .fini_array ). functions LIEF:: Binary :: functions_t functions() const List of the functions found in the binary. has_notes bool has_notes() const true if the binary embeds notes notes inline it_const_notes notes() const Return an iterator over the ELF’s LIEF::ELF::Note . See also has_note notes inline it_notes notes() eof_offset uint64_t eof_offset() const Return the last offset used by the ELF binary according to both: the sections table and the segments table. has_overlay inline bool has_overlay() const True if data are present at the end of the binary. overlay inline span overlay() const Overlay data (if any). overlay inline void overlay(std::vector overlay) Function to set the overlay. relocate_phdr_table uint64_t relocate_phdr_table( PHDR_RELOC type) Force relocating the segments table in a specific way. This function can be used to enforce a specific relocation of the segments table. Parameters: type – [in] The relocation type to apply Returns: The offset of the new segments table or 0 if it fails with the given method. get_relocated_dynamic_array std::vector get_relocated_dynamic_array( DynamicEntry :: TAG tag) const Return the array defined by the given tag (e.g. DynamicEntry::TAG::INIT_ARRAY ) with relocations applied (if any). is_targeting_android bool is_targeting_android() const True if the current ELF is targeting Android. get_section_idx inline result get_section_idx(const Section §ion) const Find the index of the section given in the first parameter. get_section_idx inline result get_section_idx(const std::string &name) const Find the index of the section with the name given in the first parameter. find_version_requirement const SymbolVersionRequirement *find_version_requirement(const std::string &libname) const Try to find the SymbolVersionRequirement associated with the given library name (e.g. libc.so.6 ). find_version_requirement inline SymbolVersionRequirement *find_version_requirement(const std::string &name) remove_version_requirement bool remove_version_requirement(const std::string &libname) Deletes all required symbol versions linked to the specified library name. The function returns true if the operation succeed, false otherwise. Warning To maintain consistency, this function also removes versions associated with dynamic symbols that are linked to the specified library name. ptr_size inline uint8_t ptr_size() const page_size virtual uint64_t page_size() const override Get the default memory page size according to the architecture and the format of the current binary. layout_pagesize uint64_t layout_pagesize() const hash size_t hash(const std::string &name) ~Binary ~Binary() override print virtual std::ostream &print(std::ostream &os) const override operator+= inline Binary &operator+=(const DynamicEntry &entry) operator+= inline Binary &operator+=(const Section §ion) operator+= inline Binary &operator+=(const Segment &segment) operator+= inline Binary &operator+=(const Note ¬e) operator-= inline Binary &operator-=(const DynamicEntry &entry) operator-= inline Binary &operator-=( DynamicEntry :: TAG tag) operator-= inline Binary &operator-=(const Note ¬e) operator-= inline Binary &operator-=( Note :: TYPE type) operator[] inline Segment *operator[]( Segment :: TYPE type) operator[] inline const Segment *operator[]( Segment :: TYPE type) const operator[] inline DynamicEntry *operator[]( DynamicEntry :: TAG tag) operator[] inline const DynamicEntry *operator[]( DynamicEntry :: TAG tag) const operator[] inline Note *operator[]( Note :: TYPE type) operator[] inline const Note *operator[]( Note :: TYPE type) const operator[] inline Section *operator[]( Section :: TYPE type) operator[] inline const Section *operator[]( Section :: TYPE type) const should_swap inline bool should_swap() const Public Static Functions classof static inline bool classof(const LIEF:: Binary *bin) Header Header class Header : public LIEF::Object Class which represents the ELF’s header. This class mirrors the raw ELF Elfxx_Ehdr structure. Public Types ELF_INDENT enum ELF_INDENT e_ident size and indices. Values: ELI_MAG0 enumerator ELI_MAG0 = 0 File identification index. ELI_MAG1 enumerator ELI_MAG1 = 1 File identification index. ELI_MAG2 enumerator ELI_MAG2 = 2 File identification index. ELI_MAG3 enumerator ELI_MAG3 = 3 File identification index. ELI_CLASS enumerator ELI_CLASS = 4 File class. ELI_DATA enumerator ELI_DATA = 5 Data encoding. ELI_VERSION enumerator ELI_VERSION = 6 File version. ELI_OSABI enumerator ELI_OSABI = 7 OS/ABI identification. ELI_ABIVERSION enumerator ELI_ABIVERSION = 8 ABI version. ELI_PAD enumerator ELI_PAD = 9 Start of padding bytes. ELI_NIDENT enumerator ELI_NIDENT = 16 Number of bytes in e_ident. FILE_TYPE enum class FILE_TYPE The type of the underlying ELF file. This enum matches the semantic of ET_NONE , ET_REL , … Values: NONE enumerator NONE = 0 Can’t be determined. REL enumerator REL = 1 Relocatable file (or object file). EXEC enumerator EXEC = 2 non-pie executable DYN enumerator DYN = 3 Shared library or a pie-executable. CORE enumerator CORE = 4 Core dump file. VERSION enum class VERSION Match the result of Elfxx_Ehdr.e_version . Values: NONE enumerator NONE = 0 Invalid ELF version. CURRENT enumerator CURRENT = 1 Current version (default). CLASS enum class CLASS Match the result of Elfxx_Ehdr.e_ident[EI_CLASS] . Values: NONE enumerator NONE = 0 Invalid class. ELF32 enumerator ELF32 32-bit objects ELF64 enumerator ELF64 64-bit objects OS_ABI enum class OS_ABI Match the result Elfxx_Ehdr.e_ident[EI_OSABI] . Values: SYSTEMV enumerator SYSTEMV = 0 UNIX System V ABI. HPUX enumerator HPUX = 1 HP-UX operating system. NETBSD enumerator NETBSD = 2 NetBSD. GNU enumerator GNU = 3 GNU/Linux. LINUX enumerator LINUX = 3 Historical alias for ELFOSABI_GNU. HURD enumerator HURD = 4 GNU/Hurd. SOLARIS enumerator SOLARIS = 6 Solaris. AIX enumerator AIX = 7 AIX. IRIX enumerator IRIX = 8 IRIX. FREEBSD enumerator FREEBSD = 9 FreeBSD. TRU64 enumerator TRU64 = 10 TRU64 UNIX. MODESTO enumerator MODESTO = 11 Novell Modesto. OPENBSD enumerator OPENBSD = 12 OpenBSD. OPENVMS enumerator OPENVMS = 13 OpenVMS. NSK enumerator NSK = 14 Hewlett-Packard Non-Stop Kernel. AROS enumerator AROS = 15 AROS. FENIXOS enumerator FENIXOS = 16 FenixOS. CLOUDABI enumerator CLOUDABI = 17 Nuxi CloudABI. C6000_ELFABI enumerator C6000_ELFABI = 64 Bare-metal TMS320C6000. AMDGPU_HSA enumerator AMDGPU_HSA = 64 AMD HSA runtime. C6000_LINUX enumerator C6000_LINUX = 65 Linux TMS320C6000. ARM enumerator ARM = 97 ARM. STANDALONE enumerator STANDALONE = 255 Standalone (embedded) application. ELF_DATA enum class ELF_DATA Match the result Elfxx_Ehdr.e_ident[EI_DATA] . Values: NONE enumerator NONE = 0 Invalid data encoding. LSB enumerator LSB = 1 2’s complement, little endian MSB enumerator MSB = 2 2’s complement, big endian identity_t using identity_t = std::array Public Functions Header Header() = default operator= Header &operator=(const Header &) = default Header Header(const Header &) = default ~Header ~Header() override = default file_type inline FILE_TYPE file_type() const Define the object file type. (e.g. executable, library…). machine_type inline ARCH machine_type() const Target architecture. object_file_version inline VERSION object_file_version() const Version of the object file format. entrypoint inline uint64_t entrypoint() const Executable entrypoint. program_headers_offset inline uint64_t program_headers_offset() const Offset of the programs table (also known as segments table). section_headers_offset inline uint64_t section_headers_offset() const Offset of the sections table. processor_flag inline uint32_t processor_flag() const Processor-specific flags. header_size inline uint32_t header_size() const Size of the current header (i.e. sizeof(Elfxx_Ehdr) ) This size should be 64 for an ELF64 binary and 52 for an ELF32 . program_header_size inline uint32_t program_header_size() const Return the size of a program header (i.e. sizeof(Elfxx_Phdr) ) This size should be 56 for an ELF64 binary and 32 for an ELF32 . numberof_segments inline uint32_t numberof_segments() const Return the number of segments. section_header_size inline uint32_t section_header_size() const Return the size of a section header (i.e. sizeof(Elfxx_Shdr) ) This size should be 64 for a ELF64 binary and 40 for an ELF32 . numberof_sections inline uint32_t numberof_sections() const Return the number of sections. Warning This value could differ from the real number of sections present in the binary. It must be taken as an indication section_name_table_idx inline uint32_t section_name_table_idx() const Return the section’s index which contains sections’ names. identity inline identity_t &identity() Return the ELF identity as an std::array . identity inline const identity_t &identity() const identity_class inline CLASS identity_class() const Return the object’s class. ELF64 or ELF32 . identity_data inline ELF_DATA identity_data() const Specify the data encoding. identity_version inline VERSION identity_version() const See also object_file_version identity_os_abi inline OS_ABI identity_os_abi() const Identifies the version of the ABI for which the object is prepared. identity_abi_version inline uint32_t identity_abi_version() const ABI Version. is_mips_n64 inline bool is_mips_n64() const Check whether this header identifies a 64-bit MIPS ELF file whose relocations use the MIPS-specific n64 encoding. has bool has( PROCESSOR_FLAGS flag) const flags_list std::vector< PROCESSOR_FLAGS > flags_list() const file_type inline void file_type( FILE_TYPE type) machine_type inline void machine_type( ARCH arch) object_file_version inline void object_file_version( VERSION version) entrypoint inline void entrypoint(uint64_t entry) program_headers_offset inline void program_headers_offset(uint64_t offset) section_headers_offset inline void section_headers_offset(uint64_t offset) processor_flag inline void processor_flag(uint32_t flags) header_size inline void header_size(uint32_t size) program_header_size inline void program_header_size(uint32_t size) numberof_segments inline void numberof_segments(uint32_t n) section_header_size inline void section_header_size(uint32_t size) numberof_sections inline void numberof_sections(uint32_t n) section_name_table_idx inline void section_name_table_idx(uint32_t idx) identity void identity(const std::string &identity) identity void identity(const identity_t &identity) identity_class inline void identity_class( CLASS cls) identity_data inline void identity_data( ELF_DATA data) identity_version inline void identity_version( VERSION version) identity_os_abi inline void identity_os_abi( OS_ABI osabi) identity_abi_version inline void identity_abi_version(uint8_t version) accept virtual void accept(Visitor &visitor) const override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Header &hdr) Section Section class Section : public LIEF:: Section Class which represents an ELF Section . Public Types TYPE enum class TYPE : uint64_t Values: SHT_NULL_ enumerator SHT_NULL_ = 0 No associated section (inactive entry). PROGBITS enumerator PROGBITS = 1 Program-defined contents. SYMTAB enumerator SYMTAB = 2 Symbol table. STRTAB enumerator STRTAB = 3 String table. RELA enumerator RELA = 4 Relocation entries; explicit addends. HASH enumerator HASH = 5 Symbol hash table. DYNAMIC enumerator DYNAMIC = 6 Information for dynamic linking. NOTE enumerator NOTE = 7 Information about the file. NOBITS enumerator NOBITS = 8 Data occupies no space in the file. REL enumerator REL = 9 Relocation entries; no explicit addends. SHLIB enumerator SHLIB = 10 Reserved. DYNSYM enumerator DYNSYM = 11 Symbol table. INIT_ARRAY enumerator INIT_ARRAY = 14 Pointers to initialization functions. FINI_ARRAY enumerator FINI_ARRAY = 15 Pointers to termination functions. PREINIT_ARRAY enumerator PREINIT_ARRAY = 16 Pointers to pre-init functions. GROUP enumerator GROUP = 17 Section group. SYMTAB_SHNDX enumerator SYMTAB_SHNDX = 18 Indices for SHN_XINDEX entries. RELR enumerator RELR = 19 Relocation entries; only offsets. ANDROID_REL enumerator ANDROID_REL = 0x60000001 Packed relocations (Android specific). ANDROID_RELA enumerator ANDROID_RELA = 0x60000002 Packed relocations (Android specific). LLVM_ADDRSIG enumerator LLVM_ADDRSIG = 0x6fff4c03 This section is used to mark symbols as address-significant. ANDROID_RELR enumerator ANDROID_RELR = 0x6fffff00 New relr relocations (Android specific). GNU_ATTRIBUTES enumerator GNU_ATTRIBUTES = 0x6ffffff5 Object attributes. GNU_HASH enumerator GNU_HASH = 0x6ffffff6 GNU-style hash table. GNU_VERDEF enumerator GNU_VERDEF = 0x6ffffffd GNU version definitions. GNU_VERNEED enumerator GNU_VERNEED = 0x6ffffffe GNU version references. GNU_VERSYM enumerator GNU_VERSYM = 0x6fffffff GNU symbol versions table. _ID_SHIFT_ enumerator _ID_SHIFT_ = 32 _ARM_ID_ enumerator _ARM_ID_ = 1LLU _HEX_ID_ enumerator _HEX_ID_ = 2LLU _X86_64_ID_ enumerator _X86_64_ID_ = 2LLU _MIPS_ID_ enumerator _MIPS_ID_ = 3LLU _RISCV_ID_ enumerator _RISCV_ID_ = 4LLU _AARCH64_ID_ enumerator _AARCH64_ID_ = 5LLU ARM_EXIDX enumerator ARM_EXIDX = 0x70000001U + ( _ARM_ID_ << _ID_SHIFT_ ) Exception Index table ARM_PREEMPTMAP enumerator ARM_PREEMPTMAP = 0x70000002U + ( _ARM_ID_ << _ID_SHIFT_ ) BPABI DLL dynamic linking preemption map ARM_ATTRIBUTES enumerator ARM_ATTRIBUTES = 0x70000003U + ( _ARM_ID_ << _ID_SHIFT_ ) Object file compatibility attributes ARM_DEBUGOVERLAY enumerator ARM_DEBUGOVERLAY = 0x70000004U + ( _ARM_ID_ << _ID_SHIFT_ ) ARM_OVERLAYSECTION enumerator ARM_OVERLAYSECTION = 0x70000005U + ( _ARM_ID_ << _ID_SHIFT_ ) HEX_ORDERED enumerator HEX_ORDERED = 0x70000000 + ( _HEX_ID_ << _ID_SHIFT_ ) Link editor is to sort the entries in this section based on their sizes X86_64_UNWIND enumerator X86_64_UNWIND = 0x70000001 + ( _X86_64_ID_ << _ID_SHIFT_ ) Unwind information MIPS_LIBLIST enumerator MIPS_LIBLIST = 0x70000000 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_MSYM enumerator MIPS_MSYM = 0x70000001 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_CONFLICT enumerator MIPS_CONFLICT = 0x70000002 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_GPTAB enumerator MIPS_GPTAB = 0x70000003 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_UCODE enumerator MIPS_UCODE = 0x70000004 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_DEBUG enumerator MIPS_DEBUG = 0x70000005 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_REGINFO enumerator MIPS_REGINFO = 0x70000006 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_PACKAGE enumerator MIPS_PACKAGE = 0x70000007 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_PACKSYM enumerator MIPS_PACKSYM = 0x70000008 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_RELD enumerator MIPS_RELD = 0x70000009 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_IFACE enumerator MIPS_IFACE = 0x7000000b + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_CONTENT enumerator MIPS_CONTENT = 0x7000000c + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_OPTIONS enumerator MIPS_OPTIONS = 0x7000000d + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_SHDR enumerator MIPS_SHDR = 0x70000010 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_FDESC enumerator MIPS_FDESC = 0x70000011 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_EXTSYM enumerator MIPS_EXTSYM = 0x70000012 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_DENSE enumerator MIPS_DENSE = 0x70000013 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_PDESC enumerator MIPS_PDESC = 0x70000014 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_LOCSYM enumerator MIPS_LOCSYM = 0x70000015 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_AUXSYM enumerator MIPS_AUXSYM = 0x70000016 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_OPTSYM enumerator MIPS_OPTSYM = 0x70000017 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_LOCSTR enumerator MIPS_LOCSTR = 0x70000018 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_LINE enumerator MIPS_LINE = 0x70000019 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_RFDESC enumerator MIPS_RFDESC = 0x7000001a + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_DELTASYM enumerator MIPS_DELTASYM = 0x7000001b + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_DELTAINST enumerator MIPS_DELTAINST = 0x7000001c + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_DELTACLASS enumerator MIPS_DELTACLASS = 0x7000001d + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_DWARF enumerator MIPS_DWARF = 0x7000001e + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_DELTADECL enumerator MIPS_DELTADECL = 0x7000001f + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_SYMBOL_LIB enumerator MIPS_SYMBOL_LIB = 0x70000020 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_EVENTS enumerator MIPS_EVENTS = 0x70000021 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_TRANSLATE enumerator MIPS_TRANSLATE = 0x70000022 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_PIXIE enumerator MIPS_PIXIE = 0x70000023 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_XLATE enumerator MIPS_XLATE = 0x70000024 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_XLATE_DEBUG enumerator MIPS_XLATE_DEBUG = 0x70000025 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_WHIRL enumerator MIPS_WHIRL = 0x70000026 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_EH_REGION enumerator MIPS_EH_REGION = 0x70000027 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_XLATE_OLD enumerator MIPS_XLATE_OLD = 0x70000028 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_PDR_EXCEPTION enumerator MIPS_PDR_EXCEPTION = 0x70000029 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_ABIFLAGS enumerator MIPS_ABIFLAGS = 0x7000002a + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_XHASH enumerator MIPS_XHASH = 0x7000002b + ( _MIPS_ID_ << _ID_SHIFT_ ) RISCV_ATTRIBUTES enumerator RISCV_ATTRIBUTES = 0x70000003 + ( _RISCV_ID_ << _ID_SHIFT_ ) AARCH64_ATTRIBUTES enumerator AARCH64_ATTRIBUTES = 0x70000003 + ( _AARCH64_ID_ << _ID_SHIFT_ ) AARCH64_AUTH_RELR enumerator AARCH64_AUTH_RELR = 0x70000004 + ( _AARCH64_ID_ << _ID_SHIFT_ ) AARCH64_MEMTAG_GLOBALS_STATIC enumerator AARCH64_MEMTAG_GLOBALS_STATIC = 0x70000007 + ( _AARCH64_ID_ << _ID_SHIFT_ ) AARCH64_MEMTAG_GLOBALS_DYNAMIC enumerator AARCH64_MEMTAG_GLOBALS_DYNAMIC = 0x70000008 + ( _AARCH64_ID_ << _ID_SHIFT_ ) FLAGS enum class FLAGS : uint64_t Values: NONE enumerator NONE = 0x000000000 WRITE enumerator WRITE = 0x000000001 Section data should be writable during execution. ALLOC enumerator ALLOC = 0x000000002 Section occupies memory during program execution. EXECINSTR enumerator EXECINSTR = 0x000000004 Section contains executable machine instructions. MERGE enumerator MERGE = 0x000000010 The data in this section may be merged. STRINGS enumerator STRINGS = 0x000000020 The data in this section is null-terminated strings. INFO_LINK enumerator INFO_LINK = 0x000000040 A field in this section holds a section header table index. LINK_ORDER enumerator LINK_ORDER = 0x000000080 Adds special ordering requirements for link editors. OS_NONCONFORMING enumerator OS_NONCONFORMING = 0x000000100 This section requires special OS-specific processing to avoid incorrect behavior GROUP enumerator GROUP = 0x000000200 This section is a member of a section group. TLS enumerator TLS = 0x000000400 This section holds Thread-Local Storage. COMPRESSED enumerator COMPRESSED = 0x000000800 GNU_RETAIN enumerator GNU_RETAIN = 0x000200000 EXCLUDE enumerator EXCLUDE = 0x080000000 _ID_SHIFT_ enumerator _ID_SHIFT_ = 32 _XCORE_ID_ enumerator _XCORE_ID_ = 1LLU _HEX_ID_ enumerator _HEX_ID_ = 3LLU _X86_64_ID_ enumerator _X86_64_ID_ = 2LLU _MIPS_ID_ enumerator _MIPS_ID_ = 4LLU _ARM_ID_ enumerator _ARM_ID_ = 5LLU _AARCH64_ID_ enumerator _AARCH64_ID_ = 6LLU XCORE_SHF_DP_SECTION enumerator XCORE_SHF_DP_SECTION = 0x010000000 + ( _XCORE_ID_ << _ID_SHIFT_ ) XCORE_SHF_CP_SECTION enumerator XCORE_SHF_CP_SECTION = 0x020000000 + ( _XCORE_ID_ << _ID_SHIFT_ ) X86_64_LARGE enumerator X86_64_LARGE = 0x010000000 + ( _X86_64_ID_ << _ID_SHIFT_ ) HEX_GPREL enumerator HEX_GPREL = 0x010000000 + ( _HEX_ID_ << _ID_SHIFT_ ) MIPS_NODUPES enumerator MIPS_NODUPES = 0x001000000 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_NAMES enumerator MIPS_NAMES = 0x002000000 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_LOCAL enumerator MIPS_LOCAL = 0x004000000 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_NOSTRIP enumerator MIPS_NOSTRIP = 0x008000000 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_GPREL enumerator MIPS_GPREL = 0x010000000 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_MERGE enumerator MIPS_MERGE = 0x020000000 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_ADDR enumerator MIPS_ADDR = 0x040000000 + ( _MIPS_ID_ << _ID_SHIFT_ ) MIPS_STRING enumerator MIPS_STRING = 0x080000000 + ( _MIPS_ID_ << _ID_SHIFT_ ) ARM_PURECODE enumerator ARM_PURECODE = 0x020000000 + ( _ARM_ID_ << _ID_SHIFT_ ) AARCH64_PURECODE enumerator AARCH64_PURECODE = 0x020000000 + ( _AARCH64_ID_ << _ID_SHIFT_ ) segments_t using segments_t = std::vector< Segment *> it_segments using it_segments = ref_iterator < segments_t &> it_const_segments using it_const_segments = const_ref_iterator Public Functions Section inline Section(const std::string &name, TYPE type = TYPE :: PROGBITS ) Section Section() = default ~Section ~Section() override = default operator= inline Section &operator=( Section other) Section Section(const Section &other) swap void swap( Section &other) noexcept type inline TYPE type() const content virtual span content() const override Section ’s content. content virtual void content(const std::vector &data) override Set section content. content void content(std::vector &&data) flags inline uint64_t flags() const Section flags. has bool has( FLAGS flag) const True if the section has the given flag has bool has(const Segment &segment) const True if the section is wrapped by the given Segment flags_list std::vector< FLAGS > flags_list() const Return section flags as a std::set . size inline virtual uint64_t size() const override Section ’s size (size in the binary, not the virtual size). size virtual void size(uint64_t size) override Change the section size. offset virtual void offset(uint64_t offset) override offset inline virtual uint64_t offset() const override Offset in the binary. file_offset inline uint64_t file_offset() const See also offset original_size inline uint64_t original_size() const Original size of the section’s data. This value is used by the ELF::Builder to determine if it needs to be relocated to avoid an override of the data alignment inline uint64_t alignment() const Section file alignment. information inline uint64_t information() const Section information. The meaning of this value depends on the section’s type. entry_size inline uint64_t entry_size() const This function returns the size of an element in the case of a section that contains an array. For instance, the .dynamic section contains an array of DynamicEntry . As the size of the raw C structure of this entry is 0x10 ( sizeof(Elf64_Dyn) ) in an ELF64, the entry_size is set to this value. link inline uint32_t link() const Index to another section. clear Section &clear(uint8_t value = 0) Clear the content of the section with the given value . add void add( FLAGS flag) Add the given ELF_SECTION_FLAGS. remove void remove( FLAGS flag) Remove the given ELF_SECTION_FLAGS. type inline void type( TYPE type) flags inline void flags(uint64_t flags) clear_flags inline void clear_flags() file_offset inline void file_offset(uint64_t offset) link inline void link(uint32_t link) information inline void information(uint32_t info) alignment inline void alignment(uint64_t alignment) entry_size inline void entry_size(uint64_t entry_size) segments inline it_segments segments() segments inline it_const_segments segments() const as_frame inline Section &as_frame() is_frame inline bool is_frame() const accept virtual void accept(Visitor &visitor) const override operator+= inline Section &operator+=( FLAGS c) operator-= inline Section &operator-=( FLAGS c) stream std::unique_ptr< SpanStream > stream() const Return a stream over the content of this section. Public Static Functions type_from static TYPE type_from(uint32_t value, ARCH arch) to_value static inline uint32_t to_value( TYPE type) Public Static Attributes MAX_SECTION_SIZE static uint32_t MAX_SECTION_SIZE = 2_GB FLAG_MASK static uint64_t FLAG_MASK = (uint64_t(1) << uint8_t( FLAGS :: _ID_SHIFT_ )) - 1 TYPE_MASK static uint64_t TYPE_MASK = (uint64_t(1) << uint8_t( TYPE :: _ID_SHIFT_ )) - 1 Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Section §ion) Segment Segment class Segment : public LIEF::Object Class which represents the ELF segments. Public Types TYPE enum class TYPE : uint64_t Values: UNKNOWN enumerator UNKNOWN = uint64_t(-1) PT_NULL_ enumerator PT_NULL_ = 0 Unused segment. LOAD enumerator LOAD = 1 Loadable segment. DYNAMIC enumerator DYNAMIC = 2 Dynamic linking information. INTERP enumerator INTERP = 3 Interpreter pathname. NOTE enumerator NOTE = 4 Auxiliary information. SHLIB enumerator SHLIB = 5 Reserved. PHDR enumerator PHDR = 6 The program header table itself. TLS enumerator TLS = 7 The thread-local storage template. GNU_EH_FRAME enumerator GNU_EH_FRAME = 0x6474e550 GNU_STACK enumerator GNU_STACK = 0x6474e551 Indicates stack executability. GNU_PROPERTY enumerator GNU_PROPERTY = 0x6474e553 GNU property GNU_RELRO enumerator GNU_RELRO = 0x6474e552 Read-only after relocation. PAX_FLAGS enumerator PAX_FLAGS = 0x65041580 ARM_ARCHEXT enumerator ARM_ARCHEXT = 0x70000000 | PT_ARM Platform architecture compatibility info ARM_EXIDX enumerator ARM_EXIDX = 0x70000001 | PT_ARM AARCH64_MEMTAG_MTE enumerator AARCH64_MEMTAG_MTE = 0x70000002 | PT_AARCH64 MIPS_REGINFO enumerator MIPS_REGINFO = 0x70000000 | PT_MIPS Register usage information. MIPS_RTPROC enumerator MIPS_RTPROC = 0x70000001 | PT_MIPS Runtime procedure table. MIPS_OPTIONS enumerator MIPS_OPTIONS = 0x70000002 | PT_MIPS Options segment. MIPS_ABIFLAGS enumerator MIPS_ABIFLAGS = 0x70000003 | PT_MIPS Abiflags segment. RISCV_ATTRIBUTES enumerator RISCV_ATTRIBUTES = 0x70000003 | PT_RISCV IA_64_EXT enumerator IA_64_EXT = (0x70000000 + 0x0) | PT_IA_64 IA_64_UNWIND enumerator IA_64_UNWIND = (0x70000000 + 0x1) | PT_IA_64 HP_TLS enumerator HP_TLS = (0x60000000 + 0x00) | PT_HPUX HP_CORE_NONE enumerator HP_CORE_NONE = (0x60000000 + 0x01) | PT_HPUX HP_CORE_VERSION enumerator HP_CORE_VERSION = (0x60000000 + 0x02) | PT_HPUX HP_CORE_KERNEL enumerator HP_CORE_KERNEL = (0x60000000 + 0x03) | PT_HPUX HP_CORE_COMM enumerator HP_CORE_COMM = (0x60000000 + 0x04) | PT_HPUX HP_CORE_PROC enumerator HP_CORE_PROC = (0x60000000 + 0x05) | PT_HPUX HP_CORE_LOADABLE enumerator HP_CORE_LOADABLE = (0x60000000 + 0x06) | PT_HPUX HP_CORE_STACK enumerator HP_CORE_STACK = (0x60000000 + 0x07) | PT_HPUX HP_CORE_SHM enumerator HP_CORE_SHM = (0x60000000 + 0x08) | PT_HPUX HP_CORE_MMF enumerator HP_CORE_MMF = (0x60000000 + 0x09) | PT_HPUX HP_PARALLEL enumerator HP_PARALLEL = (0x60000000 + 0x10) | PT_HPUX HP_FASTBIND enumerator HP_FASTBIND = (0x60000000 + 0x11) | PT_HPUX HP_OPT_ANNOT enumerator HP_OPT_ANNOT = (0x60000000 + 0x12) | PT_HPUX HP_HSL_ANNOT enumerator HP_HSL_ANNOT = (0x60000000 + 0x13) | PT_HPUX HP_STACK enumerator HP_STACK = (0x60000000 + 0x14) | PT_HPUX HP_CORE_UTSNAME enumerator HP_CORE_UTSNAME = (0x60000000 + 0x15) | PT_HPUX FLAGS enum class FLAGS Values: NONE enumerator NONE = 0 X enumerator X = 1 W enumerator W = 2 R enumerator R = 4 sections_t using sections_t = std::vector< Section *> it_sections using it_sections = ref_iterator < sections_t &> it_const_sections using it_const_sections = const_ref_iterator Public Functions Segment Segment() = default ~Segment ~Segment() override = default operator= Segment &operator=( Segment other) Segment Segment(const Segment &other) operator= Segment &operator=( Segment &&) = default Segment Segment( Segment &&) = default swap void swap( Segment &other) is_load inline bool is_load() const is_interpreter inline bool is_interpreter() const is_phdr inline bool is_phdr() const type inline TYPE type() const The segment’s type (LOAD, DYNAMIC, …). flags inline FLAGS flags() const The flag permissions associated with this segment. file_offset inline uint64_t file_offset() const The file offset of the data associated with this segment. virtual_address inline uint64_t virtual_address() const The virtual address of the segment. physical_address inline uint64_t physical_address() const The physical address of the segment. This value is not really relevant on systems like Linux or Android. On the other hand, Qualcomm trustlets might use this value. Usually this value matches virtual_address physical_size inline uint64_t physical_size() const The file size of the data associated with this segment. virtual_size inline uint64_t virtual_size() const The in-memory size of this segment. Usually, if the .bss segment is wrapped by this segment then, virtual_size is larger than physical_size. alignment inline uint64_t alignment() const The offset alignment of the segment. content span content() const The raw data associated with this segment. has inline bool has( FLAGS flag) const Check if the current segment has the given flag. has bool has(const Section §ion) const Check if the current segment wraps the given ELF::Section . has bool has(const std::string §ion_name) const Check if the current segment wraps the given section’s name. add void add( FLAGS flag) Append the given ELF_SEGMENT_FLAGS. remove void remove( FLAGS flag) Remove the given ELF_SEGMENT_FLAGS. type inline void type( TYPE type) flags inline void flags( FLAGS flags) flags inline void flags(uint32_t flags) clear_flags inline void clear_flags() file_offset void file_offset(uint64_t file_offset) virtual_address inline void virtual_address(uint64_t virtual_address) physical_address inline void physical_address(uint64_t physical_address) physical_size void physical_size(uint64_t physical_size) virtual_size inline void virtual_size(uint64_t virtual_size) alignment inline void alignment(uint64_t alignment) content void content(std::vector content) fill inline void fill(char c) Fill the content of this segment with the value provided in parameter. clear inline void clear() Clear the content of this segment. Tget_content_value template T get_content_value(size_t offset) const Tset_content_value template void set_content_value(size_t offset, T value) get_content_size size_t get_content_size() const sections inline it_sections sections() Iterator over the sections wrapped by this segment. sections inline it_const_sections sections() const stream std::unique_ptr< SpanStream > stream() const accept virtual void accept(Visitor &visitor) const override operator+= inline Segment &operator+=( FLAGS flag) operator-= inline Segment &operator-=( FLAGS flag) Public Static Functions type_from static TYPE type_from(uint64_t value, ARCH arch, Header :: OS_ABI os) to_value static inline uint64_t to_value( TYPE type) from_raw static result < Segment > from_raw(const uint8_t *ptr, size_t size) from_raw static inline result < Segment > from_raw(const std::vector &raw) Public Static Attributes PT_BIT static uint64_t PT_BIT = 33 PT_OS_BIT static uint64_t PT_OS_BIT = 53 PT_MASK static uint64_t PT_MASK = (uint64_t(1) << PT_BIT ) - 1 PT_ARM static uint64_t PT_ARM = uint64_t(1) << PT_BIT PT_AARCH64 static uint64_t PT_AARCH64 = uint64_t(2) << PT_BIT PT_MIPS static uint64_t PT_MIPS = uint64_t(3) << PT_BIT PT_RISCV static uint64_t PT_RISCV = uint64_t(4) << PT_BIT PT_IA_64 static uint64_t PT_IA_64 = uint64_t(5) << PT_BIT PT_HPUX static uint64_t PT_HPUX = uint64_t(1) << PT_OS_BIT Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Segment &segment) Dynamic Entry DynamicEntry class DynamicEntry : public LIEF::Object Class which represents an entry in the dynamic table These entries are located in the .dynamic section or the PT_DYNAMIC segment. Subclassed by LIEF::ELF::DynamicEntryArray , LIEF::ELF::DynamicEntryAuxiliary , LIEF::ELF::DynamicEntryFilter , LIEF::ELF::DynamicEntryFlags , LIEF::ELF::DynamicEntryLibrary , LIEF::ELF::DynamicEntryRpath , LIEF::ELF::DynamicEntryRunPath , LIEF::ELF::DynamicSharedObject Public Types TAG enum class TAG : uint64_t Values: UNKNOWN enumerator UNKNOWN = uint64_t(-1) DT_NULL_ enumerator DT_NULL_ = 0 Marks end of dynamic array. NEEDED enumerator NEEDED = 1 String table offset of needed library. PLTRELSZ enumerator PLTRELSZ = 2 Size of relocation entries in PLT. PLTGOT enumerator PLTGOT = 3 Address associated with linkage table. HASH enumerator HASH = 4 Address of symbolic hash table. STRTAB enumerator STRTAB = 5 Address of dynamic string table. SYMTAB enumerator SYMTAB = 6 Address of dynamic symbol table. RELA enumerator RELA = 7 Address of relocation table (Rela entries). RELASZ enumerator RELASZ = 8 Size of Rela relocation table. RELAENT enumerator RELAENT = 9 Size of a Rela relocation entry. STRSZ enumerator STRSZ = 10 Total size of the string table. SYMENT enumerator SYMENT = 11 Size of a symbol table entry. INIT enumerator INIT = 12 Address of initialization function. FINI enumerator FINI = 13 Address of termination function. SONAME enumerator SONAME = 14 String table offset of a shared objects name. RPATH enumerator RPATH = 15 String table offset of library search path. SYMBOLIC enumerator SYMBOLIC = 16 Changes symbol resolution algorithm. REL enumerator REL = 17 Address of relocation table (Rel entries). RELSZ enumerator RELSZ = 18 Size of Rel relocation table. RELENT enumerator RELENT = 19 Size of a Rel relocation entry. PLTREL enumerator PLTREL = 20 Type of relocation entry used for linking. DEBUG_TAG enumerator DEBUG_TAG = 21 Reserved for debugger. TEXTREL enumerator TEXTREL = 22 Relocations exist for non-writable segments. JMPREL enumerator JMPREL = 23 Address of relocations associated with PLT. BIND_NOW enumerator BIND_NOW = 24 Process all relocations before execution. INIT_ARRAY enumerator INIT_ARRAY = 25 Pointer to array of initialization functions. FINI_ARRAY enumerator FINI_ARRAY = 26 Pointer to array of termination functions. INIT_ARRAYSZ enumerator INIT_ARRAYSZ = 27 Size of DT_INIT_ARRAY. FINI_ARRAYSZ enumerator FINI_ARRAYSZ = 28 Size of DT_FINI_ARRAY. RUNPATH enumerator RUNPATH = 29 String table offset of lib search path. FLAGS enumerator FLAGS = 30 Flags. PREINIT_ARRAY enumerator PREINIT_ARRAY = 32 Pointer to array of preinit functions. PREINIT_ARRAYSZ enumerator PREINIT_ARRAYSZ = 33 Size of the DT_PREINIT_ARRAY array. SYMTAB_SHNDX enumerator SYMTAB_SHNDX = 34 Address of SYMTAB_SHNDX section RELRSZ enumerator RELRSZ = 35 Total size of RELR relative relocations RELR enumerator RELR = 36 Address of RELR relative relocations RELRENT enumerator RELRENT = 37 Size of one RELR relative relocation GNU_HASH enumerator GNU_HASH = 0x6FFFFEF5 Reference to the GNU hash table. TLSDESC_PLT enumerator TLSDESC_PLT = 0x6FFFFEF6 Location of PLT entry for TLS descriptor resolver calls. TLSDESC_GOT enumerator TLSDESC_GOT = 0x6FFFFEF7 Location of GOT entry for TLS descriptor resolver PLT entry. RELACOUNT enumerator RELACOUNT = 0x6FFFFFF9 ELF32_Rela count. RELCOUNT enumerator RELCOUNT = 0x6FFFFFFA ELF32_Rel count. FLAGS_1 enumerator FLAGS_1 = 0x6FFFFFFB Flags_1. VERSYM enumerator VERSYM = 0x6FFFFFF0 The address of .gnu.version section. VERDEF enumerator VERDEF = 0x6FFFFFFC The address of the version definition table. VERDEFNUM enumerator VERDEFNUM = 0x6FFFFFFD The number of entries in DT_VERDEF. VERNEED enumerator VERNEED = 0x6FFFFFFE The address of the version Dependency table. VERNEEDNUM enumerator VERNEEDNUM = 0x6FFFFFFF The number of entries in DT_VERNEED. AUXILIARY enumerator AUXILIARY = 0x7ffffffd Shared object to load before self FILTER enumerator FILTER = 0x7fffffff Shared object to filter from ANDROID_REL_OFFSET enumerator ANDROID_REL_OFFSET = 0x6000000D The offset of packed relocation data (older version < M) (Android specific). ANDROID_REL_SIZE enumerator ANDROID_REL_SIZE = 0x6000000E The size of packed relocation data in bytes (older version < M) (Android specific). ANDROID_REL enumerator ANDROID_REL = 0x6000000F The offset of packed relocation data (Android specific). ANDROID_RELSZ enumerator ANDROID_RELSZ = 0x60000010 The size of packed relocation data in bytes (Android specific). ANDROID_RELA enumerator ANDROID_RELA = 0x60000011 The offset of packed relocation data (Android specific). ANDROID_RELASZ enumerator ANDROID_RELASZ = 0x60000012 The size of packed relocation data in bytes (Android specific). ANDROID_RELR enumerator ANDROID_RELR = 0x6FFFE000 The offset of new relr relocation data (Android specific). ANDROID_RELRSZ enumerator ANDROID_RELRSZ = 0x6FFFE001 The size of new relr relocation data in bytes (Android specific). ANDROID_RELRENT enumerator ANDROID_RELRENT = 0x6FFFE003 The size of a new relr relocation entry (Android specific). ANDROID_RELRCOUNT enumerator ANDROID_RELRCOUNT = 0x6FFFE005 Specifies the relative count of new relr relocation entries (Android specific). MIPS_RLD_VERSION enumerator MIPS_RLD_VERSION = MIPS_DISC + 0x70000001 32 bit version number for runtime linker interface. MIPS_TIME_STAMP enumerator MIPS_TIME_STAMP = MIPS_DISC + 0x70000002 Time stamp. MIPS_ICHECKSUM enumerator MIPS_ICHECKSUM = MIPS_DISC + 0x70000003 Checksum of external strings and common sizes. MIPS_IVERSION enumerator MIPS_IVERSION = MIPS_DISC + 0x70000004 Index of version string in string table. MIPS_FLAGS enumerator MIPS_FLAGS = MIPS_DISC + 0x70000005 32 bits of flags. MIPS_BASE_ADDRESS enumerator MIPS_BASE_ADDRESS = MIPS_DISC + 0x70000006 Base address of the segment. MIPS_MSYM enumerator MIPS_MSYM = MIPS_DISC + 0x70000007 Address of .msym section. MIPS_CONFLICT enumerator MIPS_CONFLICT = MIPS_DISC + 0x70000008 Address of .conflict section. MIPS_LIBLIST enumerator MIPS_LIBLIST = MIPS_DISC + 0x70000009 Address of .liblist section. MIPS_LOCAL_GOTNO enumerator MIPS_LOCAL_GOTNO = MIPS_DISC + 0x7000000a Number of local global offset table entries. MIPS_CONFLICTNO enumerator MIPS_CONFLICTNO = MIPS_DISC + 0x7000000b Number of entries in the .conflict section. MIPS_LIBLISTNO enumerator MIPS_LIBLISTNO = MIPS_DISC + 0x70000010 Number of entries in the .liblist section. MIPS_SYMTABNO enumerator MIPS_SYMTABNO = MIPS_DISC + 0x70000011 Number of entries in the .dynsym section. MIPS_UNREFEXTNO enumerator MIPS_UNREFEXTNO = MIPS_DISC + 0x70000012 Index of first external dynamic symbol not referenced locally. MIPS_GOTSYM enumerator MIPS_GOTSYM = MIPS_DISC + 0x70000013 Index of first dynamic symbol in global offset table. MIPS_HIPAGENO enumerator MIPS_HIPAGENO = MIPS_DISC + 0x70000014 Number of page table entries in global offset table. MIPS_RLD_MAP enumerator MIPS_RLD_MAP = MIPS_DISC + 0x70000016 Address of run time loader map, used for debugging. MIPS_DELTA_CLASS enumerator MIPS_DELTA_CLASS = MIPS_DISC + 0x70000017 Delta C++ class definition. MIPS_DELTA_CLASS_NO enumerator MIPS_DELTA_CLASS_NO = MIPS_DISC + 0x70000018 Number of entries in DT_MIPS_DELTA_CLASS. MIPS_DELTA_INSTANCE enumerator MIPS_DELTA_INSTANCE = MIPS_DISC + 0x70000019 Delta C++ class instances. MIPS_DELTA_INSTANCE_NO enumerator MIPS_DELTA_INSTANCE_NO = MIPS_DISC + 0x7000001A Number of entries in DT_MIPS_DELTA_INSTANCE. MIPS_DELTA_RELOC enumerator MIPS_DELTA_RELOC = MIPS_DISC + 0x7000001B Delta relocations. MIPS_DELTA_RELOC_NO enumerator MIPS_DELTA_RELOC_NO = MIPS_DISC + 0x7000001C Number of entries in DT_MIPS_DELTA_RELOC. MIPS_DELTA_SYM enumerator MIPS_DELTA_SYM = MIPS_DISC + 0x7000001D Delta symbols that Delta relocations refer to. MIPS_DELTA_SYM_NO enumerator MIPS_DELTA_SYM_NO = MIPS_DISC + 0x7000001E Number of entries in DT_MIPS_DELTA_SYM. MIPS_DELTA_CLASSSYM enumerator MIPS_DELTA_CLASSSYM = MIPS_DISC + 0x70000020 Delta symbols that hold class declarations. MIPS_DELTA_CLASSSYM_NO enumerator MIPS_DELTA_CLASSSYM_NO = MIPS_DISC + 0x70000021 Number of entries in DT_MIPS_DELTA_CLASSSYM. MIPS_CXX_FLAGS enumerator MIPS_CXX_FLAGS = MIPS_DISC + 0x70000022 Flags indicating information about C++ flavor. MIPS_PIXIE_INIT enumerator MIPS_PIXIE_INIT = MIPS_DISC + 0x70000023 Pixie information. MIPS_SYMBOL_LIB enumerator MIPS_SYMBOL_LIB = MIPS_DISC + 0x70000024 Address of .MIPS.symlib MIPS_LOCALPAGE_GOTIDX enumerator MIPS_LOCALPAGE_GOTIDX = MIPS_DISC + 0x70000025 The GOT index of the first PTE for a segment MIPS_LOCAL_GOTIDX enumerator MIPS_LOCAL_GOTIDX = MIPS_DISC + 0x70000026 The GOT index of the first PTE for a local symbol MIPS_HIDDEN_GOTIDX enumerator MIPS_HIDDEN_GOTIDX = MIPS_DISC + 0x70000027 The GOT index of the first PTE for a hidden symbol MIPS_PROTECTED_GOTIDX enumerator MIPS_PROTECTED_GOTIDX = MIPS_DISC + 0x70000028 The GOT index of the first PTE for a protected symbol MIPS_OPTIONS enumerator MIPS_OPTIONS = MIPS_DISC + 0x70000029 Address of .MIPS.options'. */ MIPS_INTERFACE = MIPS_DISC + 0x7000002A, /**< Address of .interface’. */ MIPS_DYNSTR_ALIGN = MIPS_DISC + 0x7000002B, /**< Unknown. MIPS_INTERFACE_SIZE enumerator MIPS_INTERFACE_SIZE = MIPS_DISC + 0x7000002C Size of the .interface section. MIPS_RLD_TEXT_RESOLVE_ADDR enumerator MIPS_RLD_TEXT_RESOLVE_ADDR = MIPS_DISC + 0x7000002D Size of rld_text_resolve function stored in the GOT. MIPS_PERF_SUFFIX enumerator MIPS_PERF_SUFFIX = MIPS_DISC + 0x7000002E Default suffix of DSO to be added by rld on dlopen() calls. MIPS_COMPACT_SIZE enumerator MIPS_COMPACT_SIZE = MIPS_DISC + 0x7000002F Size of compact relocation section (O32). MIPS_GP_VALUE enumerator MIPS_GP_VALUE = MIPS_DISC + 0x70000030 GP value for auxiliary GOTs. MIPS_AUX_DYNAMIC enumerator MIPS_AUX_DYNAMIC = MIPS_DISC + 0x70000031 Address of auxiliary .dynamic. MIPS_PLTGOT enumerator MIPS_PLTGOT = MIPS_DISC + 0x70000032 Address of the base of the PLTGOT. MIPS_RWPLT enumerator MIPS_RWPLT = MIPS_DISC + 0x70000034 MIPS_RLD_MAP_REL enumerator MIPS_RLD_MAP_REL = MIPS_DISC + 0x70000035 MIPS_XHASH enumerator MIPS_XHASH = MIPS_DISC + 0x70000036 AARCH64_BTI_PLT enumerator AARCH64_BTI_PLT = AARCH64_DISC + 0x70000001 AARCH64_PAC_PLT enumerator AARCH64_PAC_PLT = AARCH64_DISC + 0x70000003 AARCH64_VARIANT_PCS enumerator AARCH64_VARIANT_PCS = AARCH64_DISC + 0x70000005 AARCH64_MEMTAG_MODE enumerator AARCH64_MEMTAG_MODE = AARCH64_DISC + 0x70000009 AARCH64_MEMTAG_HEAP enumerator AARCH64_MEMTAG_HEAP = AARCH64_DISC + 0x7000000b AARCH64_MEMTAG_STACK enumerator AARCH64_MEMTAG_STACK = AARCH64_DISC + 0x7000000c AARCH64_MEMTAG_GLOBALS enumerator AARCH64_MEMTAG_GLOBALS = AARCH64_DISC + 0x7000000d AARCH64_MEMTAG_GLOBALSSZ enumerator AARCH64_MEMTAG_GLOBALSSZ = AARCH64_DISC + 0x7000000f HEXAGON_SYMSZ enumerator HEXAGON_SYMSZ = HEXAGON_DISC + 0x70000000 HEXAGON_VER enumerator HEXAGON_VER = HEXAGON_DISC + 0x70000001 HEXAGON_PLT enumerator HEXAGON_PLT = HEXAGON_DISC + 0x70000002 PPC_GOT enumerator PPC_GOT = PPC_DISC + 0x70000000 PPC_OPT enumerator PPC_OPT = PPC_DISC + 0x70000001 PPC64_GLINK enumerator PPC64_GLINK = PPC64_DISC + 0x70000000 PPC64_OPT enumerator PPC64_OPT = PPC64_DISC + 0x70000003 RISCV_VARIANT_CC enumerator RISCV_VARIANT_CC = RISCV_DISC + 0x70000003 X86_64_PLT enumerator X86_64_PLT = X86_64_DISC + 0x70000000 X86_64_PLTSZ enumerator X86_64_PLTSZ = X86_64_DISC + 0x70000001 X86_64_PLTENT enumerator X86_64_PLTENT = X86_64_DISC + 0x70000003 IA_64_PLT_RESERVE enumerator IA_64_PLT_RESERVE = IA_64_DISC + (0x70000000 + 0) IA_64_VMS_SUBTYPE enumerator IA_64_VMS_SUBTYPE = IA_64_DISC + (0x60000000 + 0) IA_64_VMS_IMGIOCNT enumerator IA_64_VMS_IMGIOCNT = IA_64_DISC + (0x60000000 + 2) IA_64_VMS_LNKFLAGS enumerator IA_64_VMS_LNKFLAGS = IA_64_DISC + (0x60000000 + 8) IA_64_VMS_VIR_MEM_BLK_SIZ enumerator IA_64_VMS_VIR_MEM_BLK_SIZ = IA_64_DISC + (0x60000000 + 10) IA_64_VMS_IDENT enumerator IA_64_VMS_IDENT = IA_64_DISC + (0x60000000 + 12) IA_64_VMS_NEEDED_IDENT enumerator IA_64_VMS_NEEDED_IDENT = IA_64_DISC + (0x60000000 + 16) IA_64_VMS_IMG_RELA_CNT enumerator IA_64_VMS_IMG_RELA_CNT = IA_64_DISC + (0x60000000 + 18) IA_64_VMS_SEG_RELA_CNT enumerator IA_64_VMS_SEG_RELA_CNT = IA_64_DISC + (0x60000000 + 20) IA_64_VMS_FIXUP_RELA_CNT enumerator IA_64_VMS_FIXUP_RELA_CNT = IA_64_DISC + (0x60000000 + 22) IA_64_VMS_FIXUP_NEEDED enumerator IA_64_VMS_FIXUP_NEEDED = IA_64_DISC + (0x60000000 + 24) IA_64_VMS_SYMVEC_CNT enumerator IA_64_VMS_SYMVEC_CNT = IA_64_DISC + (0x60000000 + 26) IA_64_VMS_XLATED enumerator IA_64_VMS_XLATED = IA_64_DISC + (0x60000000 + 30) IA_64_VMS_STACKSIZE enumerator IA_64_VMS_STACKSIZE = IA_64_DISC + (0x60000000 + 32) IA_64_VMS_UNWINDSZ enumerator IA_64_VMS_UNWINDSZ = IA_64_DISC + (0x60000000 + 34) IA_64_VMS_UNWIND_CODSEG enumerator IA_64_VMS_UNWIND_CODSEG = IA_64_DISC + (0x60000000 + 36) IA_64_VMS_UNWIND_INFOSEG enumerator IA_64_VMS_UNWIND_INFOSEG = IA_64_DISC + (0x60000000 + 38) IA_64_VMS_LINKTIME enumerator IA_64_VMS_LINKTIME = IA_64_DISC + (0x60000000 + 40) IA_64_VMS_SEG_NO enumerator IA_64_VMS_SEG_NO = IA_64_DISC + (0x60000000 + 42) IA_64_VMS_SYMVEC_OFFSET enumerator IA_64_VMS_SYMVEC_OFFSET = IA_64_DISC + (0x60000000 + 44) IA_64_VMS_SYMVEC_SEG enumerator IA_64_VMS_SYMVEC_SEG = IA_64_DISC + (0x60000000 + 46) IA_64_VMS_UNWIND_OFFSET enumerator IA_64_VMS_UNWIND_OFFSET = IA_64_DISC + (0x60000000 + 48) IA_64_VMS_UNWIND_SEG enumerator IA_64_VMS_UNWIND_SEG = IA_64_DISC + (0x60000000 + 50) IA_64_VMS_STRTAB_OFFSET enumerator IA_64_VMS_STRTAB_OFFSET = IA_64_DISC + (0x60000000 + 52) IA_64_VMS_SYSVER_OFFSET enumerator IA_64_VMS_SYSVER_OFFSET = IA_64_DISC + (0x60000000 + 54) IA_64_VMS_IMG_RELA_OFF enumerator IA_64_VMS_IMG_RELA_OFF = IA_64_DISC + (0x60000000 + 56) IA_64_VMS_SEG_RELA_OFF enumerator IA_64_VMS_SEG_RELA_OFF = IA_64_DISC + (0x60000000 + 58) IA_64_VMS_FIXUP_RELA_OFF enumerator IA_64_VMS_FIXUP_RELA_OFF = IA_64_DISC + (0x60000000 + 60) IA_64_VMS_PLTGOT_OFFSET enumerator IA_64_VMS_PLTGOT_OFFSET = IA_64_DISC + (0x60000000 + 62) IA_64_VMS_PLTGOT_SEG enumerator IA_64_VMS_PLTGOT_SEG = IA_64_DISC + (0x60000000 + 64) IA_64_VMS_FPMODE enumerator IA_64_VMS_FPMODE = IA_64_DISC + (0x60000000 + 66) Public Functions DynamicEntry DynamicEntry() = default DynamicEntry DynamicEntry(const details::Elf64_Dyn &header, ARCH arch) DynamicEntry DynamicEntry(const details::Elf32_Dyn &header, ARCH arch) DynamicEntry inline DynamicEntry( TAG tag, uint64_t value) operator= DynamicEntry &operator=(const DynamicEntry &) = default DynamicEntry DynamicEntry(const DynamicEntry &) = default ~DynamicEntry ~DynamicEntry() override = default clone inline virtual std::unique_ptr< DynamicEntry > clone() const tag inline TAG tag() const Tag of the current entry. The most common tags are: DT_NEEDED, DT_INIT, … value inline uint64_t value() const Return the entry’s value. The meaning of the value strongly depends on the tag. It can be an offset, an index, a flag, … tag inline void tag( TAG tag) value inline void value(uint64_t value) accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const to_string std::string to_string() const Tcast template inline const T *cast() const Tcast template inline T *cast() Public Static Functions from_value static TAG from_value(uint64_t value, ARCH arch) to_value static uint64_t to_value( TAG tag) create static std::unique_ptr< DynamicEntry > create( TAG tag, uint64_t value) create static inline std::unique_ptr< DynamicEntry > create( TAG tag) Public Static Attributes MIPS_DISC static uint64_t MIPS_DISC = 0x100000000 AARCH64_DISC static uint64_t AARCH64_DISC = 0x200000000 HEXAGON_DISC static uint64_t HEXAGON_DISC = 0x300000000 PPC_DISC static uint64_t PPC_DISC = 0x400000000 PPC64_DISC static uint64_t PPC64_DISC = 0x500000000 RISCV_DISC static uint64_t RISCV_DISC = 0x600000000 X86_64_DISC static uint64_t X86_64_DISC = 0x700000000 IA_64_DISC static uint64_t IA_64_DISC = 0x800000000 Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const DynamicEntry &entry) Dynamic Entry Library DynamicEntryLibrary class DynamicEntryLibrary : public LIEF::ELF:: DynamicEntry Class which represents a DT_NEEDED entry in the dynamic table. This kind of entry is usually used to create library dependency. Public Functions DynamicEntryLibrary inline DynamicEntryLibrary() DynamicEntryLibrary inline DynamicEntryLibrary(std::string name) operator= DynamicEntryLibrary &operator=(const DynamicEntryLibrary &) = default DynamicEntryLibrary DynamicEntryLibrary(const DynamicEntryLibrary &) = default clone inline virtual std::unique_ptr< DynamicEntry > clone() const override name inline std::string_view name() const Return the library associated with this entry (e.g. libc.so.6 ). name inline void name(std::string name) accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override DynamicEntry DynamicEntry() = default DynamicEntry DynamicEntry(const details::Elf64_Dyn &header, ARCH arch) DynamicEntry DynamicEntry(const details::Elf32_Dyn &header, ARCH arch) DynamicEntry inline DynamicEntry(TAG tag, uint64_t value) DynamicEntry DynamicEntry(const DynamicEntry &) = default Public Static Functions classof static inline bool classof(const DynamicEntry *entry) Dynamic Shared Object DynamicSharedObject class DynamicSharedObject : public LIEF::ELF:: DynamicEntry Class which represents a DT_SONAME entry in the dynamic table This kind of entry is usually used to name the original library. This entry is not present for executables. Public Functions DynamicSharedObject inline DynamicSharedObject() DynamicSharedObject inline DynamicSharedObject(std::string name) operator= DynamicSharedObject &operator=(const DynamicSharedObject &) = default DynamicSharedObject DynamicSharedObject(const DynamicSharedObject &) = default clone inline virtual std::unique_ptr< DynamicEntry > clone() const override name inline std::string_view name() const The actual name (e.g. libMyLib.so ). name inline void name(std::string name) accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override ~DynamicSharedObject ~DynamicSharedObject() override = default DynamicEntry DynamicEntry() = default DynamicEntry DynamicEntry(const details::Elf64_Dyn &header, ARCH arch) DynamicEntry DynamicEntry(const details::Elf32_Dyn &header, ARCH arch) DynamicEntry inline DynamicEntry(TAG tag, uint64_t value) DynamicEntry DynamicEntry(const DynamicEntry &) = default Public Static Functions classof static inline bool classof(const DynamicEntry *entry) Dynamic Entry Run Path DynamicEntryRunPath class DynamicEntryRunPath : public LIEF::ELF:: DynamicEntry Class that represents a DT_RUNPATH which is used by the loader to resolve libraries ( DynamicEntryLibrary ). Public Functions DynamicEntryRunPath inline DynamicEntryRunPath() DynamicEntryRunPath inline DynamicEntryRunPath(std::string runpath) Constructor from (run)path. DynamicEntryRunPath inline DynamicEntryRunPath(const std::vector &paths) Constructor from a list of paths. operator= DynamicEntryRunPath &operator=(const DynamicEntryRunPath &) = default DynamicEntryRunPath DynamicEntryRunPath(const DynamicEntryRunPath &) = default clone inline virtual std::unique_ptr< DynamicEntry > clone() const override runpath inline std::string_view runpath() const Runpath raw value. runpath inline void runpath(std::string runpath) paths std::vector paths() const Paths as a list. paths void paths(const std::vector &paths) insert DynamicEntryRunPath &insert(size_t pos, const std::string &path) Insert a path at the given position . append DynamicEntryRunPath &append(const std::string &path) Append the given path . remove DynamicEntryRunPath &remove(const std::string &path) Remove the given path . operator+= inline DynamicEntryRunPath &operator+=(const std::string &path) operator-= inline DynamicEntryRunPath &operator-=(const std::string &path) accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override ~DynamicEntryRunPath ~DynamicEntryRunPath() override = default DynamicEntry DynamicEntry() = default DynamicEntry DynamicEntry(const details::Elf64_Dyn &header, ARCH arch) DynamicEntry DynamicEntry(const details::Elf32_Dyn &header, ARCH arch) DynamicEntry inline DynamicEntry(TAG tag, uint64_t value) DynamicEntry DynamicEntry(const DynamicEntry &) = default Public Static Functions classof static inline bool classof(const DynamicEntry *entry) Public Static Attributes delimiter static char delimiter = ':' Dynamic Entry RPath DynamicEntryRpath class DynamicEntryRpath : public LIEF::ELF:: DynamicEntry Class which represents a DT_RPATH entry. This attribute is deprecated (cf. man ld ) in favor of DT_RUNPATH (See DynamicEntryRunPath ). Public Functions DynamicEntryRpath inline DynamicEntryRpath() DynamicEntryRpath inline DynamicEntryRpath(std::string rpath) DynamicEntryRpath inline DynamicEntryRpath(const std::vector &paths) Constructor from a list of paths. operator= DynamicEntryRpath &operator=(const DynamicEntryRpath &) = default DynamicEntryRpath DynamicEntryRpath(const DynamicEntryRpath &) = default clone inline virtual std::unique_ptr< DynamicEntry > clone() const override rpath inline std::string_view rpath() const The actual rpath as a string. rpath inline void rpath(std::string name) paths std::vector paths() const Paths as a list. paths void paths(const std::vector &paths) insert DynamicEntryRpath &insert(size_t pos, const std::string &path) Insert a path at the given position . append DynamicEntryRpath &append(std::string path) Append the given path . remove DynamicEntryRpath &remove(const std::string &path) Remove the given path . operator+= inline DynamicEntryRpath &operator+=(std::string path) operator-= inline DynamicEntryRpath &operator-=(const std::string &path) accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override ~DynamicEntryRpath ~DynamicEntryRpath() override = default DynamicEntry DynamicEntry() = default DynamicEntry DynamicEntry(const details::Elf64_Dyn &header, ARCH arch) DynamicEntry DynamicEntry(const details::Elf32_Dyn &header, ARCH arch) DynamicEntry inline DynamicEntry(TAG tag, uint64_t value) DynamicEntry DynamicEntry(const DynamicEntry &) = default Public Static Functions classof static inline bool classof(const DynamicEntry *entry) Public Static Attributes delimiter static char delimiter = ':' Dynamic Entry Array DynamicEntryArray class DynamicEntryArray : public LIEF::ELF:: DynamicEntry Class that represent an Array in the dynamic table. This entry is associated with constructors: DT_PREINIT_ARRAY DT_INIT_ARRAY DT_FINI_ARRAY The underlying values are 64-bits integers to cover both: ELF32 and ELF64 binaries. Public Types array_t using array_t = std::vector Public Functions DynamicEntryArray DynamicEntryArray() = delete DynamicEntryArray inline DynamicEntryArray( DynamicEntry ::TAG tag, array_t array) operator= DynamicEntryArray &operator=(const DynamicEntryArray &) = default DynamicEntryArray DynamicEntryArray(const DynamicEntryArray &) = default clone inline virtual std::unique_ptr< DynamicEntry > clone() const override array inline array_t &array() Return the array values (list of pointers). array inline const array_t &array() const array inline void array(const array_t &array) insert DynamicEntryArray &insert(size_t pos, uint64_t function) Insert the given function at pos . append inline DynamicEntryArray &append(uint64_t function) Append the given function. remove DynamicEntryArray &remove(uint64_t function) Remove the given function. size inline size_t size() const Number of functions registered in this array. operator+= inline DynamicEntryArray &operator+=(uint64_t value) operator-= inline DynamicEntryArray &operator-=(uint64_t value) operator[] const uint64_t &operator[](size_t idx) const operator[] uint64_t &operator[](size_t idx) accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override ~DynamicEntryArray ~DynamicEntryArray() override = default DynamicEntry DynamicEntry() = default DynamicEntry DynamicEntry(const details::Elf64_Dyn &header, ARCH arch) DynamicEntry DynamicEntry(const details::Elf32_Dyn &header, ARCH arch) DynamicEntry inline DynamicEntry(TAG tag, uint64_t value) DynamicEntry DynamicEntry(const DynamicEntry &) = default Public Static Functions classof static inline bool classof(const DynamicEntry *entry) Dynamic Entry Flags DynamicEntryFlags class DynamicEntryFlags : public LIEF::ELF:: DynamicEntry Public Types FLAG enum class FLAG : uint64_t Values: ORIGIN enumerator ORIGIN = 0x00000001 The object may reference $ORIGIN. SYMBOLIC enumerator SYMBOLIC = 0x00000002 Search the shared lib before searching the exe. TEXTREL enumerator TEXTREL = 0x00000004 Relocations may modify a non-writable segment. BIND_NOW enumerator BIND_NOW = 0x00000008 Process all relocations on load. STATIC_TLS enumerator STATIC_TLS = 0x00000010 Reject attempts to load dynamically. NOW enumerator NOW = BASE + 0x000000001 Set RTLD_NOW for this object. GLOBAL enumerator GLOBAL = BASE + 0x000000002 Set RTLD_GLOBAL for this object. GROUP enumerator GROUP = BASE + 0x000000004 Set RTLD_GROUP for this object. NODELETE enumerator NODELETE = BASE + 0x000000008 Set RTLD_NODELETE for this object. LOADFLTR enumerator LOADFLTR = BASE + 0x000000010 Trigger filtee loading at runtime. INITFIRST enumerator INITFIRST = BASE + 0x000000020 Set RTLD_INITFIRST for this object. NOOPEN enumerator NOOPEN = BASE + 0x000000040 Set RTLD_NOOPEN for this object. HANDLE_ORIGIN enumerator HANDLE_ORIGIN = BASE + 0x000000080 $ORIGIN must be handled. DIRECT enumerator DIRECT = BASE + 0x000000100 Direct binding enabled. TRANS enumerator TRANS = BASE + 0x000000200 INTERPOSE enumerator INTERPOSE = BASE + 0x000000400 Object is used to interpose. NODEFLIB enumerator NODEFLIB = BASE + 0x000000800 Ignore default lib search path. NODUMP enumerator NODUMP = BASE + 0x000001000 Object can’t be dumped with dldump(). CONFALT enumerator CONFALT = BASE + 0x000002000 Configuration alternative created. ENDFILTEE enumerator ENDFILTEE = BASE + 0x000004000 Filtee terminates filters search. DISPRELDNE enumerator DISPRELDNE = BASE + 0x000008000 Disp reloc applied at build time. DISPRELPND enumerator DISPRELPND = BASE + 0x000010000 Disp reloc applied at run-time. NODIRECT enumerator NODIRECT = BASE + 0x000020000 Object has no-direct binding. IGNMULDEF enumerator IGNMULDEF = BASE + 0x000040000 NOKSYMS enumerator NOKSYMS = BASE + 0x000080000 NOHDR enumerator NOHDR = BASE + 0x000100000 EDITED enumerator EDITED = BASE + 0x000200000 Object is modified after built. NORELOC enumerator NORELOC = BASE + 0x000400000 SYMINTPOSE enumerator SYMINTPOSE = BASE + 0x000800000 Object has individual interposers. GLOBAUDIT enumerator GLOBAUDIT = BASE + 0x001000000 Global auditing required. SINGLETON enumerator SINGLETON = BASE + 0x002000000 Singleton symbols are used. PIE enumerator PIE = BASE + 0x008000000 Singleton symbols are used. KMOD enumerator KMOD = BASE + 0x010000000 WEAKFILTER enumerator WEAKFILTER = BASE + 0x020000000 NOCOMMON enumerator NOCOMMON = BASE + 0x040000000 flags_list_t using flags_list_t = std::vector< FLAG > Public Functions DynamicEntryFlags DynamicEntryFlags() = delete operator= DynamicEntryFlags &operator=(const DynamicEntryFlags &) = default DynamicEntryFlags DynamicEntryFlags(const DynamicEntryFlags &) = default clone inline virtual std::unique_ptr< DynamicEntry > clone() const override has bool has( FLAG f) const If the current entry has the given FLAG . flags flags_list_t flags() const Return flags as a list of integers. raw_flags inline uint64_t raw_flags() const add void add( FLAG f) Add the given FLAG . remove void remove( FLAG f) Remove the given FLAG . operator+= inline DynamicEntryFlags &operator+=( FLAG f) operator-= inline DynamicEntryFlags &operator-=( FLAG f) accept virtual void accept(Visitor &visitor) const override ~DynamicEntryFlags ~DynamicEntryFlags() override = default print virtual std::ostream &print(std::ostream &os) const override DynamicEntry DynamicEntry() = default DynamicEntry DynamicEntry(const details::Elf64_Dyn &header, ARCH arch) DynamicEntry DynamicEntry(const details::Elf32_Dyn &header, ARCH arch) DynamicEntry inline DynamicEntry(TAG tag, uint64_t value) DynamicEntry DynamicEntry(const DynamicEntry &) = default Public Static Functions create_dt_flag static inline DynamicEntryFlags create_dt_flag(uint64_t value) create_dt_flag_1 static inline DynamicEntryFlags create_dt_flag_1(uint64_t value) classof static inline bool classof(const DynamicEntry *entry) Public Static Attributes BASE static uint64_t BASE = 0x100000000 Dynamic Entry Auxiliary DynamicEntryAuxiliary class DynamicEntryAuxiliary : public LIEF::ELF:: DynamicEntry Class which represents a DT_AUXILIARY entry in the dynamic table This kind of entry is used to specify a shared object that should be loaded before the current one. Public Functions DynamicEntryAuxiliary inline DynamicEntryAuxiliary() DynamicEntryAuxiliary inline DynamicEntryAuxiliary(std::string name) operator= DynamicEntryAuxiliary &operator=(const DynamicEntryAuxiliary &) = default DynamicEntryAuxiliary DynamicEntryAuxiliary(const DynamicEntryAuxiliary &) = default clone inline virtual std::unique_ptr< DynamicEntry > clone() const override name inline std::string_view name() const The actual name (e.g. libaux.so ). name inline void name(std::string name) accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override ~DynamicEntryAuxiliary ~DynamicEntryAuxiliary() override = default DynamicEntry DynamicEntry() = default DynamicEntry DynamicEntry(const details::Elf64_Dyn &header, ARCH arch) DynamicEntry DynamicEntry(const details::Elf32_Dyn &header, ARCH arch) DynamicEntry inline DynamicEntry(TAG tag, uint64_t value) DynamicEntry DynamicEntry(const DynamicEntry &) = default Public Static Functions classof static inline bool classof(const DynamicEntry *entry) Dynamic Entry Filter DynamicEntryFilter class DynamicEntryFilter : public LIEF::ELF:: DynamicEntry Class which represents a DT_FILTER entry in the dynamic table This kind of entry is used to specify a shared object for which the current one is a filter. Public Functions DynamicEntryFilter inline DynamicEntryFilter() DynamicEntryFilter inline DynamicEntryFilter(std::string name) operator= DynamicEntryFilter &operator=(const DynamicEntryFilter &) = default DynamicEntryFilter DynamicEntryFilter(const DynamicEntryFilter &) = default clone inline virtual std::unique_ptr< DynamicEntry > clone() const override name inline std::string_view name() const The actual name (e.g. libfilter.so ). name inline void name(std::string name) accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override ~DynamicEntryFilter ~DynamicEntryFilter() override = default DynamicEntry DynamicEntry() = default DynamicEntry DynamicEntry(const details::Elf64_Dyn &header, ARCH arch) DynamicEntry DynamicEntry(const details::Elf32_Dyn &header, ARCH arch) DynamicEntry inline DynamicEntry(TAG tag, uint64_t value) DynamicEntry DynamicEntry(const DynamicEntry &) = default Public Static Functions classof static inline bool classof(const DynamicEntry *entry) Relocations Relocation class Relocation : public LIEF:: Relocation Class that represents an ELF relocation. Public Types PURPOSE enum class PURPOSE The purpose of a relocation defines how this relocation is used by the loader. Values: NONE enumerator NONE = 0 PLTGOT enumerator PLTGOT The relocation is associated with the PLT/GOT resolution. DYNAMIC enumerator DYNAMIC The relocation is used for regular data/code relocation. OBJECT enumerator OBJECT The relocation is used in an object file. ENCODING enum class ENCODING Values: UNKNOWN enumerator UNKNOWN = 0 REL enumerator REL The relocation is using the regular Elf_Rel structure. RELA enumerator RELA The relocation is using the regular Elf_Rela structure. RELR enumerator RELR The relocation is using the relative relocation format. ANDROID_SLEB enumerator ANDROID_SLEB The relocation is using the packed Android-SLEB128 format. TYPE enum class TYPE : uint32_t The different types of the relocation. Values: UNKNOWN enumerator UNKNOWN = uint32_t(-1) X86_64_NONE enumerator X86_64_NONE = (0 | R_X64 ) X86_64_64 enumerator X86_64_64 = (1 | R_X64 ) X86_64_PC32 enumerator X86_64_PC32 = (2 | R_X64 ) X86_64_GOT32 enumerator X86_64_GOT32 = (3 | R_X64 ) X86_64_PLT32 enumerator X86_64_PLT32 = (4 | R_X64 ) X86_64_COPY enumerator X86_64_COPY = (5 | R_X64 ) X86_64_GLOB_DAT enumerator X86_64_GLOB_DAT = (6 | R_X64 ) X86_64_JUMP_SLOT enumerator X86_64_JUMP_SLOT = (7 | R_X64 ) X86_64_RELATIVE enumerator X86_64_RELATIVE = (8 | R_X64 ) X86_64_GOTPCREL enumerator X86_64_GOTPCREL = (9 | R_X64 ) X86_64_32 enumerator X86_64_32 = (10 | R_X64 ) X86_64_32S enumerator X86_64_32S = (11 | R_X64 ) X86_64_16 enumerator X86_64_16 = (12 | R_X64 ) X86_64_PC16 enumerator X86_64_PC16 = (13 | R_X64 ) X86_64_8 enumerator X86_64_8 = (14 | R_X64 ) X86_64_PC8 enumerator X86_64_PC8 = (15 | R_X64 ) X86_64_DTPMOD64 enumerator X86_64_DTPMOD64 = (16 | R_X64 ) X86_64_DTPOFF64 enumerator X86_64_DTPOFF64 = (17 | R_X64 ) X86_64_TPOFF64 enumerator X86_64_TPOFF64 = (18 | R_X64 ) X86_64_TLSGD enumerator X86_64_TLSGD = (19 | R_X64 ) X86_64_TLSLD enumerator X86_64_TLSLD = (20 | R_X64 ) X86_64_DTPOFF32 enumerator X86_64_DTPOFF32 = (21 | R_X64 ) X86_64_GOTTPOFF enumerator X86_64_GOTTPOFF = (22 | R_X64 ) X86_64_TPOFF32 enumerator X86_64_TPOFF32 = (23 | R_X64 ) X86_64_PC64 enumerator X86_64_PC64 = (24 | R_X64 ) X86_64_GOTOFF64 enumerator X86_64_GOTOFF64 = (25 | R_X64 ) X86_64_GOTPC32 enumerator X86_64_GOTPC32 = (26 | R_X64 ) X86_64_GOT64 enumerator X86_64_GOT64 = (27 | R_X64 ) X86_64_GOTPCREL64 enumerator X86_64_GOTPCREL64 = (28 | R_X64 ) X86_64_GOTPC64 enumerator X86_64_GOTPC64 = (29 | R_X64 ) X86_64_GOTPLT64 enumerator X86_64_GOTPLT64 = (30 | R_X64 ) X86_64_PLTOFF64 enumerator X86_64_PLTOFF64 = (31 | R_X64 ) X86_64_SIZE32 enumerator X86_64_SIZE32 = (32 | R_X64 ) X86_64_SIZE64 enumerator X86_64_SIZE64 = (33 | R_X64 ) X86_64_GOTPC32_TLSDESC enumerator X86_64_GOTPC32_TLSDESC = (34 | R_X64 ) X86_64_TLSDESC_CALL enumerator X86_64_TLSDESC_CALL = (35 | R_X64 ) X86_64_TLSDESC enumerator X86_64_TLSDESC = (36 | R_X64 ) X86_64_IRELATIVE enumerator X86_64_IRELATIVE = (37 | R_X64 ) X86_64_RELATIVE64 enumerator X86_64_RELATIVE64 = (38 | R_X64 ) X86_64_PC32_BND enumerator X86_64_PC32_BND = (39 | R_X64 ) X86_64_PLT32_BND enumerator X86_64_PLT32_BND = (40 | R_X64 ) X86_64_GOTPCRELX enumerator X86_64_GOTPCRELX = (41 | R_X64 ) X86_64_REX_GOTPCRELX enumerator X86_64_REX_GOTPCRELX = (42 | R_X64 ) AARCH64_NONE enumerator AARCH64_NONE = (0 | R_AARCH64 ) AARCH64_ABS64 enumerator AARCH64_ABS64 = (0x101 | R_AARCH64 ) AARCH64_ABS32 enumerator AARCH64_ABS32 = (0x102 | R_AARCH64 ) AARCH64_ABS16 enumerator AARCH64_ABS16 = (0x103 | R_AARCH64 ) AARCH64_PREL64 enumerator AARCH64_PREL64 = (0x104 | R_AARCH64 ) AARCH64_PREL32 enumerator AARCH64_PREL32 = (0x105 | R_AARCH64 ) AARCH64_PREL16 enumerator AARCH64_PREL16 = (0x106 | R_AARCH64 ) AARCH64_MOVW_UABS_G0 enumerator AARCH64_MOVW_UABS_G0 = (0x107 | R_AARCH64 ) AARCH64_MOVW_UABS_G0_NC enumerator AARCH64_MOVW_UABS_G0_NC = (0x108 | R_AARCH64 ) AARCH64_MOVW_UABS_G1 enumerator AARCH64_MOVW_UABS_G1 = (0x109 | R_AARCH64 ) AARCH64_MOVW_UABS_G1_NC enumerator AARCH64_MOVW_UABS_G1_NC = (0x10a | R_AARCH64 ) AARCH64_MOVW_UABS_G2 enumerator AARCH64_MOVW_UABS_G2 = (0x10b | R_AARCH64 ) AARCH64_MOVW_UABS_G2_NC enumerator AARCH64_MOVW_UABS_G2_NC = (0x10c | R_AARCH64 ) AARCH64_MOVW_UABS_G3 enumerator AARCH64_MOVW_UABS_G3 = (0x10d | R_AARCH64 ) AARCH64_MOVW_SABS_G0 enumerator AARCH64_MOVW_SABS_G0 = (0x10e | R_AARCH64 ) AARCH64_MOVW_SABS_G1 enumerator AARCH64_MOVW_SABS_G1 = (0x10f | R_AARCH64 ) AARCH64_MOVW_SABS_G2 enumerator AARCH64_MOVW_SABS_G2 = (0x110 | R_AARCH64 ) AARCH64_LD_PREL_LO19 enumerator AARCH64_LD_PREL_LO19 = (0x111 | R_AARCH64 ) AARCH64_ADR_PREL_LO21 enumerator AARCH64_ADR_PREL_LO21 = (0x112 | R_AARCH64 ) AARCH64_ADR_PREL_PG_HI21 enumerator AARCH64_ADR_PREL_PG_HI21 = (0x113 | R_AARCH64 ) AARCH64_ADR_PREL_PG_HI21_NC enumerator AARCH64_ADR_PREL_PG_HI21_NC = (0x114 | R_AARCH64 ) AARCH64_ADD_ABS_LO12_NC enumerator AARCH64_ADD_ABS_LO12_NC = (0x115 | R_AARCH64 ) AARCH64_LDST8_ABS_LO12_NC enumerator AARCH64_LDST8_ABS_LO12_NC = (0x116 | R_AARCH64 ) AARCH64_TSTBR14 enumerator AARCH64_TSTBR14 = (0x117 | R_AARCH64 ) AARCH64_CONDBR19 enumerator AARCH64_CONDBR19 = (0x118 | R_AARCH64 ) AARCH64_JUMP26 enumerator AARCH64_JUMP26 = (0x11a | R_AARCH64 ) AARCH64_CALL26 enumerator AARCH64_CALL26 = (0x11b | R_AARCH64 ) AARCH64_LDST16_ABS_LO12_NC enumerator AARCH64_LDST16_ABS_LO12_NC = (0x11c | R_AARCH64 ) AARCH64_LDST32_ABS_LO12_NC enumerator AARCH64_LDST32_ABS_LO12_NC = (0x11d | R_AARCH64 ) AARCH64_LDST64_ABS_LO12_NC enumerator AARCH64_LDST64_ABS_LO12_NC = (0x11e | R_AARCH64 ) AARCH64_MOVW_PREL_G0 enumerator AARCH64_MOVW_PREL_G0 = (0x11f | R_AARCH64 ) AARCH64_MOVW_PREL_G0_NC enumerator AARCH64_MOVW_PREL_G0_NC = (0x120 | R_AARCH64 ) AARCH64_MOVW_PREL_G1 enumerator AARCH64_MOVW_PREL_G1 = (0x121 | R_AARCH64 ) AARCH64_MOVW_PREL_G1_NC enumerator AARCH64_MOVW_PREL_G1_NC = (0x122 | R_AARCH64 ) AARCH64_MOVW_PREL_G2 enumerator AARCH64_MOVW_PREL_G2 = (0x123 | R_AARCH64 ) AARCH64_MOVW_PREL_G2_NC enumerator AARCH64_MOVW_PREL_G2_NC = (0x124 | R_AARCH64 ) AARCH64_MOVW_PREL_G3 enumerator AARCH64_MOVW_PREL_G3 = (0x125 | R_AARCH64 ) AARCH64_LDST128_ABS_LO12_NC enumerator AARCH64_LDST128_ABS_LO12_NC = (0x12b | R_AARCH64 ) AARCH64_MOVW_GOTOFF_G0 enumerator AARCH64_MOVW_GOTOFF_G0 = (0x12c | R_AARCH64 ) AARCH64_MOVW_GOTOFF_G0_NC enumerator AARCH64_MOVW_GOTOFF_G0_NC = (0x12d | R_AARCH64 ) AARCH64_MOVW_GOTOFF_G1 enumerator AARCH64_MOVW_GOTOFF_G1 = (0x12e | R_AARCH64 ) AARCH64_MOVW_GOTOFF_G1_NC enumerator AARCH64_MOVW_GOTOFF_G1_NC = (0x12f | R_AARCH64 ) AARCH64_MOVW_GOTOFF_G2 enumerator AARCH64_MOVW_GOTOFF_G2 = (0x130 | R_AARCH64 ) AARCH64_MOVW_GOTOFF_G2_NC enumerator AARCH64_MOVW_GOTOFF_G2_NC = (0x131 | R_AARCH64 ) AARCH64_MOVW_GOTOFF_G3 enumerator AARCH64_MOVW_GOTOFF_G3 = (0x132 | R_AARCH64 ) AARCH64_GOTREL64 enumerator AARCH64_GOTREL64 = (0x133 | R_AARCH64 ) AARCH64_GOTREL32 enumerator AARCH64_GOTREL32 = (0x134 | R_AARCH64 ) AARCH64_GOT_LD_PREL19 enumerator AARCH64_GOT_LD_PREL19 = (0x135 | R_AARCH64 ) AARCH64_LD64_GOTOFF_LO15 enumerator AARCH64_LD64_GOTOFF_LO15 = (0x136 | R_AARCH64 ) AARCH64_ADR_GOT_PAGE enumerator AARCH64_ADR_GOT_PAGE = (0x137 | R_AARCH64 ) AARCH64_LD64_GOT_LO12_NC enumerator AARCH64_LD64_GOT_LO12_NC = (0x138 | R_AARCH64 ) AARCH64_LD64_GOTPAGE_LO15 enumerator AARCH64_LD64_GOTPAGE_LO15 = (0x139 | R_AARCH64 ) AARCH64_TLSGD_ADR_PREL21 enumerator AARCH64_TLSGD_ADR_PREL21 = (0x200 | R_AARCH64 ) AARCH64_TLSGD_ADR_PAGE21 enumerator AARCH64_TLSGD_ADR_PAGE21 = (0x201 | R_AARCH64 ) AARCH64_TLSGD_ADD_LO12_NC enumerator AARCH64_TLSGD_ADD_LO12_NC = (0x202 | R_AARCH64 ) AARCH64_TLSGD_MOVW_G1 enumerator AARCH64_TLSGD_MOVW_G1 = (0x203 | R_AARCH64 ) AARCH64_TLSGD_MOVW_G0_NC enumerator AARCH64_TLSGD_MOVW_G0_NC = (0x204 | R_AARCH64 ) AARCH64_TLSLD_ADR_PREL21 enumerator AARCH64_TLSLD_ADR_PREL21 = (0x205 | R_AARCH64 ) AARCH64_TLSLD_ADR_PAGE21 enumerator AARCH64_TLSLD_ADR_PAGE21 = (0x206 | R_AARCH64 ) AARCH64_TLSLD_ADD_LO12_NC enumerator AARCH64_TLSLD_ADD_LO12_NC = (0x207 | R_AARCH64 ) AARCH64_TLSLD_MOVW_G1 enumerator AARCH64_TLSLD_MOVW_G1 = (0x208 | R_AARCH64 ) AARCH64_TLSLD_MOVW_G0_NC enumerator AARCH64_TLSLD_MOVW_G0_NC = (0x209 | R_AARCH64 ) AARCH64_TLSLD_LD_PREL19 enumerator AARCH64_TLSLD_LD_PREL19 = (0x20a | R_AARCH64 ) AARCH64_TLSLD_MOVW_DTPREL_G2 enumerator AARCH64_TLSLD_MOVW_DTPREL_G2 = (0x20b | R_AARCH64 ) AARCH64_TLSLD_MOVW_DTPREL_G1 enumerator AARCH64_TLSLD_MOVW_DTPREL_G1 = (0x20c | R_AARCH64 ) AARCH64_TLSLD_MOVW_DTPREL_G1_NC enumerator AARCH64_TLSLD_MOVW_DTPREL_G1_NC = (0x20d | R_AARCH64 ) AARCH64_TLSLD_MOVW_DTPREL_G0 enumerator AARCH64_TLSLD_MOVW_DTPREL_G0 = (0x20e | R_AARCH64 ) AARCH64_TLSLD_MOVW_DTPREL_G0_NC enumerator AARCH64_TLSLD_MOVW_DTPREL_G0_NC = (0x20f | R_AARCH64 ) AARCH64_TLSLD_ADD_DTPREL_HI12 enumerator AARCH64_TLSLD_ADD_DTPREL_HI12 = (0x210 | R_AARCH64 ) AARCH64_TLSLD_ADD_DTPREL_LO12 enumerator AARCH64_TLSLD_ADD_DTPREL_LO12 = (0x211 | R_AARCH64 ) AARCH64_TLSLD_ADD_DTPREL_LO12_NC enumerator AARCH64_TLSLD_ADD_DTPREL_LO12_NC = (0x212 | R_AARCH64 ) AARCH64_TLSLD_LDST8_DTPREL_LO12 enumerator AARCH64_TLSLD_LDST8_DTPREL_LO12 = (0x213 | R_AARCH64 ) AARCH64_TLSLD_LDST8_DTPREL_LO12_NC enumerator AARCH64_TLSLD_LDST8_DTPREL_LO12_NC = (0x214 | R_AARCH64 ) AARCH64_TLSLD_LDST16_DTPREL_LO12 enumerator AARCH64_TLSLD_LDST16_DTPREL_LO12 = (0x215 | R_AARCH64 ) AARCH64_TLSLD_LDST16_DTPREL_LO12_NC enumerator AARCH64_TLSLD_LDST16_DTPREL_LO12_NC = (0x216 | R_AARCH64 ) AARCH64_TLSLD_LDST32_DTPREL_LO12 enumerator AARCH64_TLSLD_LDST32_DTPREL_LO12 = (0x217 | R_AARCH64 ) AARCH64_TLSLD_LDST32_DTPREL_LO12_NC enumerator AARCH64_TLSLD_LDST32_DTPREL_LO12_NC = (0x218 | R_AARCH64 ) AARCH64_TLSLD_LDST64_DTPREL_LO12 enumerator AARCH64_TLSLD_LDST64_DTPREL_LO12 = (0x219 | R_AARCH64 ) AARCH64_TLSLD_LDST64_DTPREL_LO12_NC enumerator AARCH64_TLSLD_LDST64_DTPREL_LO12_NC = (0x21a | R_AARCH64 ) AARCH64_TLSIE_MOVW_GOTTPREL_G1 enumerator AARCH64_TLSIE_MOVW_GOTTPREL_G1 = (0x21b | R_AARCH64 ) AARCH64_TLSIE_MOVW_GOTTPREL_G0_NC enumerator AARCH64_TLSIE_MOVW_GOTTPREL_G0_NC = (0x21c | R_AARCH64 ) AARCH64_TLSIE_ADR_GOTTPREL_PAGE21 enumerator AARCH64_TLSIE_ADR_GOTTPREL_PAGE21 = (0x21d | R_AARCH64 ) AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC enumerator AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC = (0x21e | R_AARCH64 ) AARCH64_TLSIE_LD_GOTTPREL_PREL19 enumerator AARCH64_TLSIE_LD_GOTTPREL_PREL19 = (0x21f | R_AARCH64 ) AARCH64_TLSLE_MOVW_TPREL_G2 enumerator AARCH64_TLSLE_MOVW_TPREL_G2 = (0x220 | R_AARCH64 ) AARCH64_TLSLE_MOVW_TPREL_G1 enumerator AARCH64_TLSLE_MOVW_TPREL_G1 = (0x221 | R_AARCH64 ) AARCH64_TLSLE_MOVW_TPREL_G1_NC enumerator AARCH64_TLSLE_MOVW_TPREL_G1_NC = (0x222 | R_AARCH64 ) AARCH64_TLSLE_MOVW_TPREL_G0 enumerator AARCH64_TLSLE_MOVW_TPREL_G0 = (0x223 | R_AARCH64 ) AARCH64_TLSLE_MOVW_TPREL_G0_NC enumerator AARCH64_TLSLE_MOVW_TPREL_G0_NC = (0x224 | R_AARCH64 ) AARCH64_TLSLE_ADD_TPREL_HI12 enumerator AARCH64_TLSLE_ADD_TPREL_HI12 = (0x225 | R_AARCH64 ) AARCH64_TLSLE_ADD_TPREL_LO12 enumerator AARCH64_TLSLE_ADD_TPREL_LO12 = (0x226 | R_AARCH64 ) AARCH64_TLSLE_ADD_TPREL_LO12_NC enumerator AARCH64_TLSLE_ADD_TPREL_LO12_NC = (0x227 | R_AARCH64 ) AARCH64_TLSLE_LDST8_TPREL_LO12 enumerator AARCH64_TLSLE_LDST8_TPREL_LO12 = (0x228 | R_AARCH64 ) AARCH64_TLSLE_LDST8_TPREL_LO12_NC enumerator AARCH64_TLSLE_LDST8_TPREL_LO12_NC = (0x229 | R_AARCH64 ) AARCH64_TLSLE_LDST16_TPREL_LO12 enumerator AARCH64_TLSLE_LDST16_TPREL_LO12 = (0x22a | R_AARCH64 ) AARCH64_TLSLE_LDST16_TPREL_LO12_NC enumerator AARCH64_TLSLE_LDST16_TPREL_LO12_NC = (0x22b | R_AARCH64 ) AARCH64_TLSLE_LDST32_TPREL_LO12 enumerator AARCH64_TLSLE_LDST32_TPREL_LO12 = (0x22c | R_AARCH64 ) AARCH64_TLSLE_LDST32_TPREL_LO12_NC enumerator AARCH64_TLSLE_LDST32_TPREL_LO12_NC = (0x22d | R_AARCH64 ) AARCH64_TLSLE_LDST64_TPREL_LO12 enumerator AARCH64_TLSLE_LDST64_TPREL_LO12 = (0x22e | R_AARCH64 ) AARCH64_TLSLE_LDST64_TPREL_LO12_NC enumerator AARCH64_TLSLE_LDST64_TPREL_LO12_NC = (0x22f | R_AARCH64 ) AARCH64_TLSDESC_LD_PREL19 enumerator AARCH64_TLSDESC_LD_PREL19 = (0x230 | R_AARCH64 ) AARCH64_TLSDESC_ADR_PREL21 enumerator AARCH64_TLSDESC_ADR_PREL21 = (0x231 | R_AARCH64 ) AARCH64_TLSDESC_ADR_PAGE21 enumerator AARCH64_TLSDESC_ADR_PAGE21 = (0x232 | R_AARCH64 ) AARCH64_TLSDESC_LD64_LO12_NC enumerator AARCH64_TLSDESC_LD64_LO12_NC = (0x233 | R_AARCH64 ) AARCH64_TLSDESC_ADD_LO12_NC enumerator AARCH64_TLSDESC_ADD_LO12_NC = (0x234 | R_AARCH64 ) AARCH64_TLSDESC_OFF_G1 enumerator AARCH64_TLSDESC_OFF_G1 = (0x235 | R_AARCH64 ) AARCH64_TLSDESC_OFF_G0_NC enumerator AARCH64_TLSDESC_OFF_G0_NC = (0x236 | R_AARCH64 ) AARCH64_TLSDESC_LDR enumerator AARCH64_TLSDESC_LDR = (0x237 | R_AARCH64 ) AARCH64_TLSDESC_ADD enumerator AARCH64_TLSDESC_ADD = (0x238 | R_AARCH64 ) AARCH64_TLSDESC_CALL enumerator AARCH64_TLSDESC_CALL = (0x239 | R_AARCH64 ) AARCH64_TLSLE_LDST128_TPREL_LO12 enumerator AARCH64_TLSLE_LDST128_TPREL_LO12 = (0x23a | R_AARCH64 ) AARCH64_TLSLE_LDST128_TPREL_LO12_NC enumerator AARCH64_TLSLE_LDST128_TPREL_LO12_NC = (0x23b | R_AARCH64 ) AARCH64_TLSLD_LDST128_DTPREL_LO12 enumerator AARCH64_TLSLD_LDST128_DTPREL_LO12 = (0x23c | R_AARCH64 ) AARCH64_TLSLD_LDST128_DTPREL_LO12_NC enumerator AARCH64_TLSLD_LDST128_DTPREL_LO12_NC = (0x23d | R_AARCH64 ) AARCH64_COPY enumerator AARCH64_COPY = (0x400 | R_AARCH64 ) AARCH64_GLOB_DAT enumerator AARCH64_GLOB_DAT = (0x401 | R_AARCH64 ) AARCH64_JUMP_SLOT enumerator AARCH64_JUMP_SLOT = (0x402 | R_AARCH64 ) AARCH64_RELATIVE enumerator AARCH64_RELATIVE = (0x403 | R_AARCH64 ) AARCH64_TLS_DTPREL64 enumerator AARCH64_TLS_DTPREL64 = (0x404 | R_AARCH64 ) AARCH64_TLS_DTPMOD64 enumerator AARCH64_TLS_DTPMOD64 = (0x405 | R_AARCH64 ) AARCH64_TLS_TPREL64 enumerator AARCH64_TLS_TPREL64 = (0x406 | R_AARCH64 ) AARCH64_TLSDESC enumerator AARCH64_TLSDESC = (0x407 | R_AARCH64 ) AARCH64_IRELATIVE enumerator AARCH64_IRELATIVE = (0x408 | R_AARCH64 ) ARM_NONE enumerator ARM_NONE = (0x00 | R_ARM ) ARM_PC24 enumerator ARM_PC24 = (0x01 | R_ARM ) ARM_ABS32 enumerator ARM_ABS32 = (0x02 | R_ARM ) ARM_REL32 enumerator ARM_REL32 = (0x03 | R_ARM ) ARM_LDR_PC_G0 enumerator ARM_LDR_PC_G0 = (0x04 | R_ARM ) ARM_ABS16 enumerator ARM_ABS16 = (0x05 | R_ARM ) ARM_ABS12 enumerator ARM_ABS12 = (0x06 | R_ARM ) ARM_THM_ABS5 enumerator ARM_THM_ABS5 = (0x07 | R_ARM ) ARM_ABS8 enumerator ARM_ABS8 = (0x08 | R_ARM ) ARM_SBREL32 enumerator ARM_SBREL32 = (0x09 | R_ARM ) ARM_THM_CALL enumerator ARM_THM_CALL = (0x0a | R_ARM ) ARM_THM_PC8 enumerator ARM_THM_PC8 = (0x0b | R_ARM ) ARM_BREL_ADJ enumerator ARM_BREL_ADJ = (0x0c | R_ARM ) ARM_TLS_DESC enumerator ARM_TLS_DESC = (0x0d | R_ARM ) ARM_THM_SWI8 enumerator ARM_THM_SWI8 = (0x0e | R_ARM ) ARM_XPC25 enumerator ARM_XPC25 = (0x0f | R_ARM ) ARM_THM_XPC22 enumerator ARM_THM_XPC22 = (0x10 | R_ARM ) ARM_TLS_DTPMOD32 enumerator ARM_TLS_DTPMOD32 = (0x11 | R_ARM ) ARM_TLS_DTPOFF32 enumerator ARM_TLS_DTPOFF32 = (0x12 | R_ARM ) ARM_TLS_TPOFF32 enumerator ARM_TLS_TPOFF32 = (0x13 | R_ARM ) ARM_COPY enumerator ARM_COPY = (0x14 | R_ARM ) ARM_GLOB_DAT enumerator ARM_GLOB_DAT = (0x15 | R_ARM ) ARM_JUMP_SLOT enumerator ARM_JUMP_SLOT = (0x16 | R_ARM ) ARM_RELATIVE enumerator ARM_RELATIVE = (0x17 | R_ARM ) ARM_GOTOFF32 enumerator ARM_GOTOFF32 = (0x18 | R_ARM ) ARM_BASE_PREL enumerator ARM_BASE_PREL = (0x19 | R_ARM ) ARM_GOT_BREL enumerator ARM_GOT_BREL = (0x1a | R_ARM ) ARM_PLT32 enumerator ARM_PLT32 = (0x1b | R_ARM ) ARM_CALL enumerator ARM_CALL = (0x1c | R_ARM ) ARM_JUMP24 enumerator ARM_JUMP24 = (0x1d | R_ARM ) ARM_THM_JUMP24 enumerator ARM_THM_JUMP24 = (0x1e | R_ARM ) ARM_BASE_ABS enumerator ARM_BASE_ABS = (0x1f | R_ARM ) ARM_ALU_PCREL_7_0 enumerator ARM_ALU_PCREL_7_0 = (0x20 | R_ARM ) ARM_ALU_PCREL_15_8 enumerator ARM_ALU_PCREL_15_8 = (0x21 | R_ARM ) ARM_ALU_PCREL_23_15 enumerator ARM_ALU_PCREL_23_15 = (0x22 | R_ARM ) ARM_LDR_SBREL_11_0_NC enumerator ARM_LDR_SBREL_11_0_NC = (0x23 | R_ARM ) ARM_ALU_SBREL_19_12_NC enumerator ARM_ALU_SBREL_19_12_NC = (0x24 | R_ARM ) ARM_ALU_SBREL_27_20_CK enumerator ARM_ALU_SBREL_27_20_CK = (0x25 | R_ARM ) ARM_TARGET1 enumerator ARM_TARGET1 = (0x26 | R_ARM ) ARM_SBREL31 enumerator ARM_SBREL31 = (0x27 | R_ARM ) ARM_V4BX enumerator ARM_V4BX = (0x28 | R_ARM ) ARM_TARGET2 enumerator ARM_TARGET2 = (0x29 | R_ARM ) ARM_PREL31 enumerator ARM_PREL31 = (0x2a | R_ARM ) ARM_MOVW_ABS_NC enumerator ARM_MOVW_ABS_NC = (0x2b | R_ARM ) ARM_MOVT_ABS enumerator ARM_MOVT_ABS = (0x2c | R_ARM ) ARM_MOVW_PREL_NC enumerator ARM_MOVW_PREL_NC = (0x2d | R_ARM ) ARM_MOVT_PREL enumerator ARM_MOVT_PREL = (0x2e | R_ARM ) ARM_THM_MOVW_ABS_NC enumerator ARM_THM_MOVW_ABS_NC = (0x2f | R_ARM ) ARM_THM_MOVT_ABS enumerator ARM_THM_MOVT_ABS = (0x30 | R_ARM ) ARM_THM_MOVW_PREL_NC enumerator ARM_THM_MOVW_PREL_NC = (0x31 | R_ARM ) ARM_THM_MOVT_PREL enumerator ARM_THM_MOVT_PREL = (0x32 | R_ARM ) ARM_THM_JUMP19 enumerator ARM_THM_JUMP19 = (0x33 | R_ARM ) ARM_THM_JUMP6 enumerator ARM_THM_JUMP6 = (0x34 | R_ARM ) ARM_THM_ALU_PREL_11_0 enumerator ARM_THM_ALU_PREL_11_0 = (0x35 | R_ARM ) ARM_THM_PC12 enumerator ARM_THM_PC12 = (0x36 | R_ARM ) ARM_ABS32_NOI enumerator ARM_ABS32_NOI = (0x37 | R_ARM ) ARM_REL32_NOI enumerator ARM_REL32_NOI = (0x38 | R_ARM ) ARM_ALU_PC_G0_NC enumerator ARM_ALU_PC_G0_NC = (0x39 | R_ARM ) ARM_ALU_PC_G0 enumerator ARM_ALU_PC_G0 = (0x3a | R_ARM ) ARM_ALU_PC_G1_NC enumerator ARM_ALU_PC_G1_NC = (0x3b | R_ARM ) ARM_ALU_PC_G1 enumerator ARM_ALU_PC_G1 = (0x3c | R_ARM ) ARM_ALU_PC_G2 enumerator ARM_ALU_PC_G2 = (0x3d | R_ARM ) ARM_LDR_PC_G1 enumerator ARM_LDR_PC_G1 = (0x3e | R_ARM ) ARM_LDR_PC_G2 enumerator ARM_LDR_PC_G2 = (0x3f | R_ARM ) ARM_LDRS_PC_G0 enumerator ARM_LDRS_PC_G0 = (0x40 | R_ARM ) ARM_LDRS_PC_G1 enumerator ARM_LDRS_PC_G1 = (0x41 | R_ARM ) ARM_LDRS_PC_G2 enumerator ARM_LDRS_PC_G2 = (0x42 | R_ARM ) ARM_LDC_PC_G0 enumerator ARM_LDC_PC_G0 = (0x43 | R_ARM ) ARM_LDC_PC_G1 enumerator ARM_LDC_PC_G1 = (0x44 | R_ARM ) ARM_LDC_PC_G2 enumerator ARM_LDC_PC_G2 = (0x45 | R_ARM ) ARM_ALU_SB_G0_NC enumerator ARM_ALU_SB_G0_NC = (0x46 | R_ARM ) ARM_ALU_SB_G0 enumerator ARM_ALU_SB_G0 = (0x47 | R_ARM ) ARM_ALU_SB_G1_NC enumerator ARM_ALU_SB_G1_NC = (0x48 | R_ARM ) ARM_ALU_SB_G1 enumerator ARM_ALU_SB_G1 = (0x49 | R_ARM ) ARM_ALU_SB_G2 enumerator ARM_ALU_SB_G2 = (0x4a | R_ARM ) ARM_LDR_SB_G0 enumerator ARM_LDR_SB_G0 = (0x4b | R_ARM ) ARM_LDR_SB_G1 enumerator ARM_LDR_SB_G1 = (0x4c | R_ARM ) ARM_LDR_SB_G2 enumerator ARM_LDR_SB_G2 = (0x4d | R_ARM ) ARM_LDRS_SB_G0 enumerator ARM_LDRS_SB_G0 = (0x4e | R_ARM ) ARM_LDRS_SB_G1 enumerator ARM_LDRS_SB_G1 = (0x4f | R_ARM ) ARM_LDRS_SB_G2 enumerator ARM_LDRS_SB_G2 = (0x50 | R_ARM ) ARM_LDC_SB_G0 enumerator ARM_LDC_SB_G0 = (0x51 | R_ARM ) ARM_LDC_SB_G1 enumerator ARM_LDC_SB_G1 = (0x52 | R_ARM ) ARM_LDC_SB_G2 enumerator ARM_LDC_SB_G2 = (0x53 | R_ARM ) ARM_MOVW_BREL_NC enumerator ARM_MOVW_BREL_NC = (0x54 | R_ARM ) ARM_MOVT_BREL enumerator ARM_MOVT_BREL = (0x55 | R_ARM ) ARM_MOVW_BREL enumerator ARM_MOVW_BREL = (0x56 | R_ARM ) ARM_THM_MOVW_BREL_NC enumerator ARM_THM_MOVW_BREL_NC = (0x57 | R_ARM ) ARM_THM_MOVT_BREL enumerator ARM_THM_MOVT_BREL = (0x58 | R_ARM ) ARM_THM_MOVW_BREL enumerator ARM_THM_MOVW_BREL = (0x59 | R_ARM ) ARM_TLS_GOTDESC enumerator ARM_TLS_GOTDESC = (0x5a | R_ARM ) ARM_TLS_CALL enumerator ARM_TLS_CALL = (0x5b | R_ARM ) ARM_TLS_DESCSEQ enumerator ARM_TLS_DESCSEQ = (0x5c | R_ARM ) ARM_THM_TLS_CALL enumerator ARM_THM_TLS_CALL = (0x5d | R_ARM ) ARM_PLT32_ABS enumerator ARM_PLT32_ABS = (0x5e | R_ARM ) ARM_GOT_ABS enumerator ARM_GOT_ABS = (0x5f | R_ARM ) ARM_GOT_PREL enumerator ARM_GOT_PREL = (0x60 | R_ARM ) ARM_GOT_BREL12 enumerator ARM_GOT_BREL12 = (0x61 | R_ARM ) ARM_GOTOFF12 enumerator ARM_GOTOFF12 = (0x62 | R_ARM ) ARM_GOTRELAX enumerator ARM_GOTRELAX = (0x63 | R_ARM ) ARM_GNU_VTENTRY enumerator ARM_GNU_VTENTRY = (0x64 | R_ARM ) ARM_GNU_VTINHERIT enumerator ARM_GNU_VTINHERIT = (0x65 | R_ARM ) ARM_THM_JUMP11 enumerator ARM_THM_JUMP11 = (0x66 | R_ARM ) ARM_THM_JUMP8 enumerator ARM_THM_JUMP8 = (0x67 | R_ARM ) ARM_TLS_GD32 enumerator ARM_TLS_GD32 = (0x68 | R_ARM ) ARM_TLS_LDM32 enumerator ARM_TLS_LDM32 = (0x69 | R_ARM ) ARM_TLS_LDO32 enumerator ARM_TLS_LDO32 = (0x6a | R_ARM ) ARM_TLS_IE32 enumerator ARM_TLS_IE32 = (0x6b | R_ARM ) ARM_TLS_LE32 enumerator ARM_TLS_LE32 = (0x6c | R_ARM ) ARM_TLS_LDO12 enumerator ARM_TLS_LDO12 = (0x6d | R_ARM ) ARM_TLS_LE12 enumerator ARM_TLS_LE12 = (0x6e | R_ARM ) ARM_TLS_IE12GP enumerator ARM_TLS_IE12GP = (0x6f | R_ARM ) ARM_PRIVATE_0 enumerator ARM_PRIVATE_0 = (0x70 | R_ARM ) ARM_PRIVATE_1 enumerator ARM_PRIVATE_1 = (0x71 | R_ARM ) ARM_PRIVATE_2 enumerator ARM_PRIVATE_2 = (0x72 | R_ARM ) ARM_PRIVATE_3 enumerator ARM_PRIVATE_3 = (0x73 | R_ARM ) ARM_PRIVATE_4 enumerator ARM_PRIVATE_4 = (0x74 | R_ARM ) ARM_PRIVATE_5 enumerator ARM_PRIVATE_5 = (0x75 | R_ARM ) ARM_PRIVATE_6 enumerator ARM_PRIVATE_6 = (0x76 | R_ARM ) ARM_PRIVATE_7 enumerator ARM_PRIVATE_7 = (0x77 | R_ARM ) ARM_PRIVATE_8 enumerator ARM_PRIVATE_8 = (0x78 | R_ARM ) ARM_PRIVATE_9 enumerator ARM_PRIVATE_9 = (0x79 | R_ARM ) ARM_PRIVATE_10 enumerator ARM_PRIVATE_10 = (0x7a | R_ARM ) ARM_PRIVATE_11 enumerator ARM_PRIVATE_11 = (0x7b | R_ARM ) ARM_PRIVATE_12 enumerator ARM_PRIVATE_12 = (0x7c | R_ARM ) ARM_PRIVATE_13 enumerator ARM_PRIVATE_13 = (0x7d | R_ARM ) ARM_PRIVATE_14 enumerator ARM_PRIVATE_14 = (0x7e | R_ARM ) ARM_PRIVATE_15 enumerator ARM_PRIVATE_15 = (0x7f | R_ARM ) ARM_ME_TOO enumerator ARM_ME_TOO = (0x80 | R_ARM ) ARM_THM_TLS_DESCSEQ16 enumerator ARM_THM_TLS_DESCSEQ16 = (0x81 | R_ARM ) ARM_THM_TLS_DESCSEQ32 enumerator ARM_THM_TLS_DESCSEQ32 = (0x82 | R_ARM ) ARM_IRELATIVE enumerator ARM_IRELATIVE = (0xa0 | R_ARM ) ARM_RXPC25 enumerator ARM_RXPC25 = (0xF9 | R_ARM ) ARM_RSBREL32 enumerator ARM_RSBREL32 = (0xFA | R_ARM ) ARM_THM_RPC22 enumerator ARM_THM_RPC22 = (0xFB | R_ARM ) ARM_RREL32 enumerator ARM_RREL32 = (0xFC | R_ARM ) ARM_RPC24 enumerator ARM_RPC24 = (0xFD | R_ARM ) ARM_RBASE enumerator ARM_RBASE = (0xFE | R_ARM ) HEX_NONE enumerator HEX_NONE = (0 | R_HEXAGON ) HEX_B22_PCREL enumerator HEX_B22_PCREL = (1 | R_HEXAGON ) HEX_B15_PCREL enumerator HEX_B15_PCREL = (2 | R_HEXAGON ) HEX_B7_PCREL enumerator HEX_B7_PCREL = (3 | R_HEXAGON ) HEX_LO16 enumerator HEX_LO16 = (4 | R_HEXAGON ) HEX_HI16 enumerator HEX_HI16 = (5 | R_HEXAGON ) HEX_32 enumerator HEX_32 = (6 | R_HEXAGON ) HEX_16 enumerator HEX_16 = (7 | R_HEXAGON ) HEX_8 enumerator HEX_8 = (8 | R_HEXAGON ) HEX_GPREL16_0 enumerator HEX_GPREL16_0 = (9 | R_HEXAGON ) HEX_GPREL16_1 enumerator HEX_GPREL16_1 = (10 | R_HEXAGON ) HEX_GPREL16_2 enumerator HEX_GPREL16_2 = (11 | R_HEXAGON ) HEX_GPREL16_3 enumerator HEX_GPREL16_3 = (12 | R_HEXAGON ) HEX_HL16 enumerator HEX_HL16 = (13 | R_HEXAGON ) HEX_B13_PCREL enumerator HEX_B13_PCREL = (14 | R_HEXAGON ) HEX_B9_PCREL enumerator HEX_B9_PCREL = (15 | R_HEXAGON ) HEX_B32_PCREL_X enumerator HEX_B32_PCREL_X = (16 | R_HEXAGON ) HEX_32_6_X enumerator HEX_32_6_X = (17 | R_HEXAGON ) HEX_B22_PCREL_X enumerator HEX_B22_PCREL_X = (18 | R_HEXAGON ) HEX_B15_PCREL_X enumerator HEX_B15_PCREL_X = (19 | R_HEXAGON ) HEX_B13_PCREL_X enumerator HEX_B13_PCREL_X = (20 | R_HEXAGON ) HEX_B9_PCREL_X enumerator HEX_B9_PCREL_X = (21 | R_HEXAGON ) HEX_B7_PCREL_X enumerator HEX_B7_PCREL_X = (22 | R_HEXAGON ) HEX_16_X enumerator HEX_16_X = (23 | R_HEXAGON ) HEX_12_X enumerator HEX_12_X = (24 | R_HEXAGON ) HEX_11_X enumerator HEX_11_X = (25 | R_HEXAGON ) HEX_10_X enumerator HEX_10_X = (26 | R_HEXAGON ) HEX_9_X enumerator HEX_9_X = (27 | R_HEXAGON ) HEX_8_X enumerator HEX_8_X = (28 | R_HEXAGON ) HEX_7_X enumerator HEX_7_X = (29 | R_HEXAGON ) HEX_6_X enumerator HEX_6_X = (30 | R_HEXAGON ) HEX_32_PCREL enumerator HEX_32_PCREL = (31 | R_HEXAGON ) HEX_COPY enumerator HEX_COPY = (32 | R_HEXAGON ) HEX_GLOB_DAT enumerator HEX_GLOB_DAT = (33 | R_HEXAGON ) HEX_JMP_SLOT enumerator HEX_JMP_SLOT = (34 | R_HEXAGON ) HEX_RELATIVE enumerator HEX_RELATIVE = (35 | R_HEXAGON ) HEX_PLT_B22_PCREL enumerator HEX_PLT_B22_PCREL = (36 | R_HEXAGON ) HEX_GOTREL_LO16 enumerator HEX_GOTREL_LO16 = (37 | R_HEXAGON ) HEX_GOTREL_HI16 enumerator HEX_GOTREL_HI16 = (38 | R_HEXAGON ) HEX_GOTREL_32 enumerator HEX_GOTREL_32 = (39 | R_HEXAGON ) HEX_GOT_LO16 enumerator HEX_GOT_LO16 = (40 | R_HEXAGON ) HEX_GOT_HI16 enumerator HEX_GOT_HI16 = (41 | R_HEXAGON ) HEX_GOT_32 enumerator HEX_GOT_32 = (42 | R_HEXAGON ) HEX_GOT_16 enumerator HEX_GOT_16 = (43 | R_HEXAGON ) HEX_DTPMOD_32 enumerator HEX_DTPMOD_32 = (44 | R_HEXAGON ) HEX_DTPREL_LO16 enumerator HEX_DTPREL_LO16 = (45 | R_HEXAGON ) HEX_DTPREL_HI16 enumerator HEX_DTPREL_HI16 = (46 | R_HEXAGON ) HEX_DTPREL_32 enumerator HEX_DTPREL_32 = (47 | R_HEXAGON ) HEX_DTPREL_16 enumerator HEX_DTPREL_16 = (48 | R_HEXAGON ) HEX_GD_PLT_B22_PCREL enumerator HEX_GD_PLT_B22_PCREL = (49 | R_HEXAGON ) HEX_GD_GOT_LO16 enumerator HEX_GD_GOT_LO16 = (50 | R_HEXAGON ) HEX_GD_GOT_HI16 enumerator HEX_GD_GOT_HI16 = (51 | R_HEXAGON ) HEX_GD_GOT_32 enumerator HEX_GD_GOT_32 = (52 | R_HEXAGON ) HEX_GD_GOT_16 enumerator HEX_GD_GOT_16 = (53 | R_HEXAGON ) HEX_IE_LO16 enumerator HEX_IE_LO16 = (54 | R_HEXAGON ) HEX_IE_HI16 enumerator HEX_IE_HI16 = (55 | R_HEXAGON ) HEX_IE_32 enumerator HEX_IE_32 = (56 | R_HEXAGON ) HEX_IE_GOT_LO16 enumerator HEX_IE_GOT_LO16 = (57 | R_HEXAGON ) HEX_IE_GOT_HI16 enumerator HEX_IE_GOT_HI16 = (58 | R_HEXAGON ) HEX_IE_GOT_32 enumerator HEX_IE_GOT_32 = (59 | R_HEXAGON ) HEX_IE_GOT_16 enumerator HEX_IE_GOT_16 = (60 | R_HEXAGON ) HEX_TPREL_LO16 enumerator HEX_TPREL_LO16 = (61 | R_HEXAGON ) HEX_TPREL_HI16 enumerator HEX_TPREL_HI16 = (62 | R_HEXAGON ) HEX_TPREL_32 enumerator HEX_TPREL_32 = (63 | R_HEXAGON ) HEX_TPREL_16 enumerator HEX_TPREL_16 = (64 | R_HEXAGON ) HEX_6_PCREL_X enumerator HEX_6_PCREL_X = (65 | R_HEXAGON ) HEX_GOTREL_32_6_X enumerator HEX_GOTREL_32_6_X = (66 | R_HEXAGON ) HEX_GOTREL_16_X enumerator HEX_GOTREL_16_X = (67 | R_HEXAGON ) HEX_GOTREL_11_X enumerator HEX_GOTREL_11_X = (68 | R_HEXAGON ) HEX_GOT_32_6_X enumerator HEX_GOT_32_6_X = (69 | R_HEXAGON ) HEX_GOT_16_X enumerator HEX_GOT_16_X = (70 | R_HEXAGON ) HEX_GOT_11_X enumerator HEX_GOT_11_X = (71 | R_HEXAGON ) HEX_DTPREL_32_6_X enumerator HEX_DTPREL_32_6_X = (72 | R_HEXAGON ) HEX_DTPREL_16_X enumerator HEX_DTPREL_16_X = (73 | R_HEXAGON ) HEX_DTPREL_11_X enumerator HEX_DTPREL_11_X = (74 | R_HEXAGON ) HEX_GD_GOT_32_6_X enumerator HEX_GD_GOT_32_6_X = (75 | R_HEXAGON ) HEX_GD_GOT_16_X enumerator HEX_GD_GOT_16_X = (76 | R_HEXAGON ) HEX_GD_GOT_11_X enumerator HEX_GD_GOT_11_X = (77 | R_HEXAGON ) HEX_IE_32_6_X enumerator HEX_IE_32_6_X = (78 | R_HEXAGON ) HEX_IE_16_X enumerator HEX_IE_16_X = (79 | R_HEXAGON ) HEX_IE_GOT_32_6_X enumerator HEX_IE_GOT_32_6_X = (80 | R_HEXAGON ) HEX_IE_GOT_16_X enumerator HEX_IE_GOT_16_X = (81 | R_HEXAGON ) HEX_IE_GOT_11_X enumerator HEX_IE_GOT_11_X = (82 | R_HEXAGON ) HEX_TPREL_32_6_X enumerator HEX_TPREL_32_6_X = (83 | R_HEXAGON ) HEX_TPREL_16_X enumerator HEX_TPREL_16_X = (84 | R_HEXAGON ) HEX_TPREL_11_X enumerator HEX_TPREL_11_X = (85 | R_HEXAGON ) HEX_LD_PLT_B22_PCREL enumerator HEX_LD_PLT_B22_PCREL = (86 | R_HEXAGON ) HEX_LD_GOT_LO16 enumerator HEX_LD_GOT_LO16 = (87 | R_HEXAGON ) HEX_LD_GOT_HI16 enumerator HEX_LD_GOT_HI16 = (88 | R_HEXAGON ) HEX_LD_GOT_32 enumerator HEX_LD_GOT_32 = (89 | R_HEXAGON ) HEX_LD_GOT_16 enumerator HEX_LD_GOT_16 = (90 | R_HEXAGON ) HEX_LD_GOT_32_6_X enumerator HEX_LD_GOT_32_6_X = (91 | R_HEXAGON ) HEX_LD_GOT_16_X enumerator HEX_LD_GOT_16_X = (92 | R_HEXAGON ) HEX_LD_GOT_11_X enumerator HEX_LD_GOT_11_X = (93 | R_HEXAGON ) X86_NONE enumerator X86_NONE = (0 | R_X86 ) X86_32 enumerator X86_32 = (1 | R_X86 ) X86_PC32 enumerator X86_PC32 = (2 | R_X86 ) X86_GOT32 enumerator X86_GOT32 = (3 | R_X86 ) X86_PLT32 enumerator X86_PLT32 = (4 | R_X86 ) X86_COPY enumerator X86_COPY = (5 | R_X86 ) X86_GLOB_DAT enumerator X86_GLOB_DAT = (6 | R_X86 ) X86_JUMP_SLOT enumerator X86_JUMP_SLOT = (7 | R_X86 ) X86_RELATIVE enumerator X86_RELATIVE = (8 | R_X86 ) X86_GOTOFF enumerator X86_GOTOFF = (9 | R_X86 ) X86_GOTPC enumerator X86_GOTPC = (10 | R_X86 ) X86_32PLT enumerator X86_32PLT = (11 | R_X86 ) X86_TLS_TPOFF enumerator X86_TLS_TPOFF = (14 | R_X86 ) X86_TLS_IE enumerator X86_TLS_IE = (15 | R_X86 ) X86_TLS_GOTIE enumerator X86_TLS_GOTIE = (16 | R_X86 ) X86_TLS_LE enumerator X86_TLS_LE = (17 | R_X86 ) X86_TLS_GD enumerator X86_TLS_GD = (18 | R_X86 ) X86_TLS_LDM enumerator X86_TLS_LDM = (19 | R_X86 ) X86_16 enumerator X86_16 = (20 | R_X86 ) X86_PC16 enumerator X86_PC16 = (21 | R_X86 ) X86_8 enumerator X86_8 = (22 | R_X86 ) X86_PC8 enumerator X86_PC8 = (23 | R_X86 ) X86_TLS_GD_32 enumerator X86_TLS_GD_32 = (24 | R_X86 ) X86_TLS_GD_PUSH enumerator X86_TLS_GD_PUSH = (25 | R_X86 ) X86_TLS_GD_CALL enumerator X86_TLS_GD_CALL = (26 | R_X86 ) X86_TLS_GD_POP enumerator X86_TLS_GD_POP = (27 | R_X86 ) X86_TLS_LDM_32 enumerator X86_TLS_LDM_32 = (28 | R_X86 ) X86_TLS_LDM_PUSH enumerator X86_TLS_LDM_PUSH = (29 | R_X86 ) X86_TLS_LDM_CALL enumerator X86_TLS_LDM_CALL = (30 | R_X86 ) X86_TLS_LDM_POP enumerator X86_TLS_LDM_POP = (31 | R_X86 ) X86_TLS_LDO_32 enumerator X86_TLS_LDO_32 = (32 | R_X86 ) X86_TLS_IE_32 enumerator X86_TLS_IE_32 = (33 | R_X86 ) X86_TLS_LE_32 enumerator X86_TLS_LE_32 = (34 | R_X86 ) X86_TLS_DTPMOD32 enumerator X86_TLS_DTPMOD32 = (35 | R_X86 ) X86_TLS_DTPOFF32 enumerator X86_TLS_DTPOFF32 = (36 | R_X86 ) X86_TLS_TPOFF32 enumerator X86_TLS_TPOFF32 = (37 | R_X86 ) X86_TLS_GOTDESC enumerator X86_TLS_GOTDESC = (39 | R_X86 ) X86_TLS_DESC_CALL enumerator X86_TLS_DESC_CALL = (40 | R_X86 ) X86_TLS_DESC enumerator X86_TLS_DESC = (41 | R_X86 ) X86_IRELATIVE enumerator X86_IRELATIVE = (42 | R_X86 ) LARCH_NONE enumerator LARCH_NONE = (0 | R_LARCH ) LARCH_32 enumerator LARCH_32 = (1 | R_LARCH ) LARCH_64 enumerator LARCH_64 = (2 | R_LARCH ) LARCH_RELATIVE enumerator LARCH_RELATIVE = (3 | R_LARCH ) LARCH_COPY enumerator LARCH_COPY = (4 | R_LARCH ) LARCH_JUMP_SLOT enumerator LARCH_JUMP_SLOT = (5 | R_LARCH ) LARCH_TLS_DTPMOD32 enumerator LARCH_TLS_DTPMOD32 = (6 | R_LARCH ) LARCH_TLS_DTPMOD64 enumerator LARCH_TLS_DTPMOD64 = (7 | R_LARCH ) LARCH_TLS_DTPREL32 enumerator LARCH_TLS_DTPREL32 = (8 | R_LARCH ) LARCH_TLS_DTPREL64 enumerator LARCH_TLS_DTPREL64 = (9 | R_LARCH ) LARCH_TLS_TPREL32 enumerator LARCH_TLS_TPREL32 = (10 | R_LARCH ) LARCH_TLS_TPREL64 enumerator LARCH_TLS_TPREL64 = (11 | R_LARCH ) LARCH_IRELATIVE enumerator LARCH_IRELATIVE = (12 | R_LARCH ) LARCH_MARK_LA enumerator LARCH_MARK_LA = (20 | R_LARCH ) LARCH_MARK_PCREL enumerator LARCH_MARK_PCREL = (21 | R_LARCH ) LARCH_SOP_PUSH_PCREL enumerator LARCH_SOP_PUSH_PCREL = (22 | R_LARCH ) LARCH_SOP_PUSH_ABSOLUTE enumerator LARCH_SOP_PUSH_ABSOLUTE = (23 | R_LARCH ) LARCH_SOP_PUSH_DUP enumerator LARCH_SOP_PUSH_DUP = (24 | R_LARCH ) LARCH_SOP_PUSH_GPREL enumerator LARCH_SOP_PUSH_GPREL = (25 | R_LARCH ) LARCH_SOP_PUSH_TLS_TPREL enumerator LARCH_SOP_PUSH_TLS_TPREL = (26 | R_LARCH ) LARCH_SOP_PUSH_TLS_GOT enumerator LARCH_SOP_PUSH_TLS_GOT = (27 | R_LARCH ) LARCH_SOP_PUSH_TLS_GD enumerator LARCH_SOP_PUSH_TLS_GD = (28 | R_LARCH ) LARCH_SOP_PUSH_PLT_PCREL enumerator LARCH_SOP_PUSH_PLT_PCREL = (29 | R_LARCH ) LARCH_SOP_ASSERT enumerator LARCH_SOP_ASSERT = (30 | R_LARCH ) LARCH_SOP_NOT enumerator LARCH_SOP_NOT = (31 | R_LARCH ) LARCH_SOP_SUB enumerator LARCH_SOP_SUB = (32 | R_LARCH ) LARCH_SOP_SL enumerator LARCH_SOP_SL = (33 | R_LARCH ) LARCH_SOP_SR enumerator LARCH_SOP_SR = (34 | R_LARCH ) LARCH_SOP_ADD enumerator LARCH_SOP_ADD = (35 | R_LARCH ) LARCH_SOP_AND enumerator LARCH_SOP_AND = (36 | R_LARCH ) LARCH_SOP_IF_ELSE enumerator LARCH_SOP_IF_ELSE = (37 | R_LARCH ) LARCH_SOP_POP_32_S_10_5 enumerator LARCH_SOP_POP_32_S_10_5 = (38 | R_LARCH ) LARCH_SOP_POP_32_U_10_12 enumerator LARCH_SOP_POP_32_U_10_12 = (39 | R_LARCH ) LARCH_SOP_POP_32_S_10_12 enumerator LARCH_SOP_POP_32_S_10_12 = (40 | R_LARCH ) LARCH_SOP_POP_32_S_10_16 enumerator LARCH_SOP_POP_32_S_10_16 = (41 | R_LARCH ) LARCH_SOP_POP_32_S_10_16_S2 enumerator LARCH_SOP_POP_32_S_10_16_S2 = (42 | R_LARCH ) LARCH_SOP_POP_32_S_5_20 enumerator LARCH_SOP_POP_32_S_5_20 = (43 | R_LARCH ) LARCH_SOP_POP_32_S_0_5_10_16_S2 enumerator LARCH_SOP_POP_32_S_0_5_10_16_S2 = (44 | R_LARCH ) LARCH_SOP_POP_32_S_0_10_10_16_S2 enumerator LARCH_SOP_POP_32_S_0_10_10_16_S2 = (45 | R_LARCH ) LARCH_SOP_POP_32_U enumerator LARCH_SOP_POP_32_U = (46 | R_LARCH ) LARCH_ADD8 enumerator LARCH_ADD8 = (47 | R_LARCH ) LARCH_ADD16 enumerator LARCH_ADD16 = (48 | R_LARCH ) LARCH_ADD24 enumerator LARCH_ADD24 = (49 | R_LARCH ) LARCH_ADD32 enumerator LARCH_ADD32 = (50 | R_LARCH ) LARCH_ADD64 enumerator LARCH_ADD64 = (51 | R_LARCH ) LARCH_SUB8 enumerator LARCH_SUB8 = (52 | R_LARCH ) LARCH_SUB16 enumerator LARCH_SUB16 = (53 | R_LARCH ) LARCH_SUB24 enumerator LARCH_SUB24 = (54 | R_LARCH ) LARCH_SUB32 enumerator LARCH_SUB32 = (55 | R_LARCH ) LARCH_SUB64 enumerator LARCH_SUB64 = (56 | R_LARCH ) LARCH_GNU_VTINHERIT enumerator LARCH_GNU_VTINHERIT = (57 | R_LARCH ) LARCH_GNU_VTENTRY enumerator LARCH_GNU_VTENTRY = (58 | R_LARCH ) LARCH_B16 enumerator LARCH_B16 = (64 | R_LARCH ) LARCH_B21 enumerator LARCH_B21 = (65 | R_LARCH ) LARCH_B26 enumerator LARCH_B26 = (66 | R_LARCH ) LARCH_ABS_HI20 enumerator LARCH_ABS_HI20 = (67 | R_LARCH ) LARCH_ABS_LO12 enumerator LARCH_ABS_LO12 = (68 | R_LARCH ) LARCH_ABS64_LO20 enumerator LARCH_ABS64_LO20 = (69 | R_LARCH ) LARCH_ABS64_HI12 enumerator LARCH_ABS64_HI12 = (70 | R_LARCH ) LARCH_PCALA_HI20 enumerator LARCH_PCALA_HI20 = (71 | R_LARCH ) LARCH_PCALA_LO12 enumerator LARCH_PCALA_LO12 = (72 | R_LARCH ) LARCH_PCALA64_LO20 enumerator LARCH_PCALA64_LO20 = (73 | R_LARCH ) LARCH_PCALA64_HI12 enumerator LARCH_PCALA64_HI12 = (74 | R_LARCH ) LARCH_GOT_PC_HI20 enumerator LARCH_GOT_PC_HI20 = (75 | R_LARCH ) LARCH_GOT_PC_LO12 enumerator LARCH_GOT_PC_LO12 = (76 | R_LARCH ) LARCH_GOT64_PC_LO20 enumerator LARCH_GOT64_PC_LO20 = (77 | R_LARCH ) LARCH_GOT64_PC_HI12 enumerator LARCH_GOT64_PC_HI12 = (78 | R_LARCH ) LARCH_GOT_HI20 enumerator LARCH_GOT_HI20 = (79 | R_LARCH ) LARCH_GOT_LO12 enumerator LARCH_GOT_LO12 = (80 | R_LARCH ) LARCH_GOT64_LO20 enumerator LARCH_GOT64_LO20 = (81 | R_LARCH ) LARCH_GOT64_HI12 enumerator LARCH_GOT64_HI12 = (82 | R_LARCH ) LARCH_TLS_LE_HI20 enumerator LARCH_TLS_LE_HI20 = (83 | R_LARCH ) LARCH_TLS_LE_LO12 enumerator LARCH_TLS_LE_LO12 = (84 | R_LARCH ) LARCH_TLS_LE64_LO20 enumerator LARCH_TLS_LE64_LO20 = (85 | R_LARCH ) LARCH_TLS_LE64_HI12 enumerator LARCH_TLS_LE64_HI12 = (86 | R_LARCH ) LARCH_TLS_IE_PC_HI20 enumerator LARCH_TLS_IE_PC_HI20 = (87 | R_LARCH ) LARCH_TLS_IE_PC_LO12 enumerator LARCH_TLS_IE_PC_LO12 = (88 | R_LARCH ) LARCH_TLS_IE64_PC_LO20 enumerator LARCH_TLS_IE64_PC_LO20 = (89 | R_LARCH ) LARCH_TLS_IE64_PC_HI12 enumerator LARCH_TLS_IE64_PC_HI12 = (90 | R_LARCH ) LARCH_TLS_IE_HI20 enumerator LARCH_TLS_IE_HI20 = (91 | R_LARCH ) LARCH_TLS_IE_LO12 enumerator LARCH_TLS_IE_LO12 = (92 | R_LARCH ) LARCH_TLS_IE64_LO20 enumerator LARCH_TLS_IE64_LO20 = (93 | R_LARCH ) LARCH_TLS_IE64_HI12 enumerator LARCH_TLS_IE64_HI12 = (94 | R_LARCH ) LARCH_TLS_LD_PC_HI20 enumerator LARCH_TLS_LD_PC_HI20 = (95 | R_LARCH ) LARCH_TLS_LD_HI20 enumerator LARCH_TLS_LD_HI20 = (96 | R_LARCH ) LARCH_TLS_GD_PC_HI20 enumerator LARCH_TLS_GD_PC_HI20 = (97 | R_LARCH ) LARCH_TLS_GD_HI20 enumerator LARCH_TLS_GD_HI20 = (98 | R_LARCH ) LARCH_32_PCREL enumerator LARCH_32_PCREL = (99 | R_LARCH ) LARCH_RELAX enumerator LARCH_RELAX = (100 | R_LARCH ) LARCH_ALIGN enumerator LARCH_ALIGN = (102 | R_LARCH ) LARCH_PCREL20_S2 enumerator LARCH_PCREL20_S2 = (103 | R_LARCH ) LARCH_ADD6 enumerator LARCH_ADD6 = (105 | R_LARCH ) LARCH_SUB6 enumerator LARCH_SUB6 = (106 | R_LARCH ) LARCH_ADD_ULEB128 enumerator LARCH_ADD_ULEB128 = (107 | R_LARCH ) LARCH_SUB_ULEB128 enumerator LARCH_SUB_ULEB128 = (108 | R_LARCH ) LARCH_64_PCREL enumerator LARCH_64_PCREL = (109 | R_LARCH ) LARCH_CALL36 enumerator LARCH_CALL36 = (110 | R_LARCH ) LARCH_TLS_DESC32 enumerator LARCH_TLS_DESC32 = (13 | R_LARCH ) LARCH_TLS_DESC64 enumerator LARCH_TLS_DESC64 = (14 | R_LARCH ) LARCH_TLS_DESC_PC_HI20 enumerator LARCH_TLS_DESC_PC_HI20 = (111 | R_LARCH ) LARCH_TLS_DESC_PC_LO12 enumerator LARCH_TLS_DESC_PC_LO12 = (112 | R_LARCH ) LARCH_TLS_DESC64_PC_LO20 enumerator LARCH_TLS_DESC64_PC_LO20 = (113 | R_LARCH ) LARCH_TLS_DESC64_PC_HI12 enumerator LARCH_TLS_DESC64_PC_HI12 = (114 | R_LARCH ) LARCH_TLS_DESC_HI20 enumerator LARCH_TLS_DESC_HI20 = (115 | R_LARCH ) LARCH_TLS_DESC_LO12 enumerator LARCH_TLS_DESC_LO12 = (116 | R_LARCH ) LARCH_TLS_DESC64_LO20 enumerator LARCH_TLS_DESC64_LO20 = (117 | R_LARCH ) LARCH_TLS_DESC64_HI12 enumerator LARCH_TLS_DESC64_HI12 = (118 | R_LARCH ) LARCH_TLS_DESC_LD enumerator LARCH_TLS_DESC_LD = (119 | R_LARCH ) LARCH_TLS_DESC_CALL enumerator LARCH_TLS_DESC_CALL = (120 | R_LARCH ) LARCH_TLS_LE_HI20_R enumerator LARCH_TLS_LE_HI20_R = (121 | R_LARCH ) LARCH_TLS_LE_ADD_R enumerator LARCH_TLS_LE_ADD_R = (122 | R_LARCH ) LARCH_TLS_LE_LO12_R enumerator LARCH_TLS_LE_LO12_R = (123 | R_LARCH ) LARCH_TLS_LD_PCREL20_S2 enumerator LARCH_TLS_LD_PCREL20_S2 = (124 | R_LARCH ) LARCH_TLS_GD_PCREL20_S2 enumerator LARCH_TLS_GD_PCREL20_S2 = (125 | R_LARCH ) LARCH_TLS_DESC_PCREL20_S2 enumerator LARCH_TLS_DESC_PCREL20_S2 = (126 | R_LARCH ) MIPS_NONE enumerator MIPS_NONE = (0 | R_MIPS ) MIPS_16 enumerator MIPS_16 = (1 | R_MIPS ) MIPS_32 enumerator MIPS_32 = (2 | R_MIPS ) MIPS_REL32 enumerator MIPS_REL32 = (3 | R_MIPS ) MIPS_26 enumerator MIPS_26 = (4 | R_MIPS ) MIPS_HI16 enumerator MIPS_HI16 = (5 | R_MIPS ) MIPS_LO16 enumerator MIPS_LO16 = (6 | R_MIPS ) MIPS_GPREL16 enumerator MIPS_GPREL16 = (7 | R_MIPS ) MIPS_LITERAL enumerator MIPS_LITERAL = (8 | R_MIPS ) MIPS_GOT16 enumerator MIPS_GOT16 = (9 | R_MIPS ) MIPS_PC16 enumerator MIPS_PC16 = (10 | R_MIPS ) MIPS_CALL16 enumerator MIPS_CALL16 = (11 | R_MIPS ) MIPS_GPREL32 enumerator MIPS_GPREL32 = (12 | R_MIPS ) MIPS_UNUSED1 enumerator MIPS_UNUSED1 = (13 | R_MIPS ) MIPS_UNUSED2 enumerator MIPS_UNUSED2 = (14 | R_MIPS ) MIPS_UNUSED3 enumerator MIPS_UNUSED3 = (15 | R_MIPS ) MIPS_SHIFT5 enumerator MIPS_SHIFT5 = (16 | R_MIPS ) MIPS_SHIFT6 enumerator MIPS_SHIFT6 = (17 | R_MIPS ) MIPS_64 enumerator MIPS_64 = (18 | R_MIPS ) MIPS_GOT_DISP enumerator MIPS_GOT_DISP = (19 | R_MIPS ) MIPS_GOT_PAGE enumerator MIPS_GOT_PAGE = (20 | R_MIPS ) MIPS_GOT_OFST enumerator MIPS_GOT_OFST = (21 | R_MIPS ) MIPS_GOT_HI16 enumerator MIPS_GOT_HI16 = (22 | R_MIPS ) MIPS_GOT_LO16 enumerator MIPS_GOT_LO16 = (23 | R_MIPS ) MIPS_SUB enumerator MIPS_SUB = (24 | R_MIPS ) MIPS_INSERT_A enumerator MIPS_INSERT_A = (25 | R_MIPS ) MIPS_INSERT_B enumerator MIPS_INSERT_B = (26 | R_MIPS ) MIPS_DELETE enumerator MIPS_DELETE = (27 | R_MIPS ) MIPS_HIGHER enumerator MIPS_HIGHER = (28 | R_MIPS ) MIPS_HIGHEST enumerator MIPS_HIGHEST = (29 | R_MIPS ) MIPS_CALL_HI16 enumerator MIPS_CALL_HI16 = (30 | R_MIPS ) MIPS_CALL_LO16 enumerator MIPS_CALL_LO16 = (31 | R_MIPS ) MIPS_SCN_DISP enumerator MIPS_SCN_DISP = (32 | R_MIPS ) MIPS_REL16 enumerator MIPS_REL16 = (33 | R_MIPS ) MIPS_ADD_IMMEDIATE enumerator MIPS_ADD_IMMEDIATE = (34 | R_MIPS ) MIPS_PJUMP enumerator MIPS_PJUMP = (35 | R_MIPS ) MIPS_RELGOT enumerator MIPS_RELGOT = (36 | R_MIPS ) MIPS_JALR enumerator MIPS_JALR = (37 | R_MIPS ) MIPS_TLS_DTPMOD32 enumerator MIPS_TLS_DTPMOD32 = (38 | R_MIPS ) MIPS_TLS_DTPREL32 enumerator MIPS_TLS_DTPREL32 = (39 | R_MIPS ) MIPS_TLS_DTPMOD64 enumerator MIPS_TLS_DTPMOD64 = (40 | R_MIPS ) MIPS_TLS_DTPREL64 enumerator MIPS_TLS_DTPREL64 = (41 | R_MIPS ) MIPS_TLS_GD enumerator MIPS_TLS_GD = (42 | R_MIPS ) MIPS_TLS_LDM enumerator MIPS_TLS_LDM = (43 | R_MIPS ) MIPS_TLS_DTPREL_HI16 enumerator MIPS_TLS_DTPREL_HI16 = (44 | R_MIPS ) MIPS_TLS_DTPREL_LO16 enumerator MIPS_TLS_DTPREL_LO16 = (45 | R_MIPS ) MIPS_TLS_GOTTPREL enumerator MIPS_TLS_GOTTPREL = (46 | R_MIPS ) MIPS_TLS_TPREL32 enumerator MIPS_TLS_TPREL32 = (47 | R_MIPS ) MIPS_TLS_TPREL64 enumerator MIPS_TLS_TPREL64 = (48 | R_MIPS ) MIPS_TLS_TPREL_HI16 enumerator MIPS_TLS_TPREL_HI16 = (49 | R_MIPS ) MIPS_TLS_TPREL_LO16 enumerator MIPS_TLS_TPREL_LO16 = (50 | R_MIPS ) MIPS_GLOB_DAT enumerator MIPS_GLOB_DAT = (51 | R_MIPS ) MIPS_PC21_S2 enumerator MIPS_PC21_S2 = (60 | R_MIPS ) MIPS_PC26_S2 enumerator MIPS_PC26_S2 = (61 | R_MIPS ) MIPS_PC18_S3 enumerator MIPS_PC18_S3 = (62 | R_MIPS ) MIPS_PC19_S2 enumerator MIPS_PC19_S2 = (63 | R_MIPS ) MIPS_PCHI16 enumerator MIPS_PCHI16 = (64 | R_MIPS ) MIPS_PCLO16 enumerator MIPS_PCLO16 = (65 | R_MIPS ) MIPS16_26 enumerator MIPS16_26 = (100 | R_MIPS ) MIPS16_GPREL enumerator MIPS16_GPREL = (101 | R_MIPS ) MIPS16_GOT16 enumerator MIPS16_GOT16 = (102 | R_MIPS ) MIPS16_CALL16 enumerator MIPS16_CALL16 = (103 | R_MIPS ) MIPS16_HI16 enumerator MIPS16_HI16 = (104 | R_MIPS ) MIPS16_LO16 enumerator MIPS16_LO16 = (105 | R_MIPS ) MIPS16_TLS_GD enumerator MIPS16_TLS_GD = (106 | R_MIPS ) MIPS16_TLS_LDM enumerator MIPS16_TLS_LDM = (107 | R_MIPS ) MIPS16_TLS_DTPREL_HI16 enumerator MIPS16_TLS_DTPREL_HI16 = (108 | R_MIPS ) MIPS16_TLS_DTPREL_LO16 enumerator MIPS16_TLS_DTPREL_LO16 = (109 | R_MIPS ) MIPS16_TLS_GOTTPREL enumerator MIPS16_TLS_GOTTPREL = (110 | R_MIPS ) MIPS16_TLS_TPREL_HI16 enumerator MIPS16_TLS_TPREL_HI16 = (111 | R_MIPS ) MIPS16_TLS_TPREL_LO16 enumerator MIPS16_TLS_TPREL_LO16 = (112 | R_MIPS ) MIPS_COPY enumerator MIPS_COPY = (126 | R_MIPS ) MIPS_JUMP_SLOT enumerator MIPS_JUMP_SLOT = (127 | R_MIPS ) MICROMIPS_26_S1 enumerator MICROMIPS_26_S1 = (133 | R_MIPS ) MICROMIPS_HI16 enumerator MICROMIPS_HI16 = (134 | R_MIPS ) MICROMIPS_LO16 enumerator MICROMIPS_LO16 = (135 | R_MIPS ) MICROMIPS_GPREL16 enumerator MICROMIPS_GPREL16 = (136 | R_MIPS ) MICROMIPS_LITERAL enumerator MICROMIPS_LITERAL = (137 | R_MIPS ) MICROMIPS_GOT16 enumerator MICROMIPS_GOT16 = (138 | R_MIPS ) MICROMIPS_PC7_S1 enumerator MICROMIPS_PC7_S1 = (139 | R_MIPS ) MICROMIPS_PC10_S1 enumerator MICROMIPS_PC10_S1 = (140 | R_MIPS ) MICROMIPS_PC16_S1 enumerator MICROMIPS_PC16_S1 = (141 | R_MIPS ) MICROMIPS_CALL16 enumerator MICROMIPS_CALL16 = (142 | R_MIPS ) MICROMIPS_GOT_DISP enumerator MICROMIPS_GOT_DISP = (145 | R_MIPS ) MICROMIPS_GOT_PAGE enumerator MICROMIPS_GOT_PAGE = (146 | R_MIPS ) MICROMIPS_GOT_OFST enumerator MICROMIPS_GOT_OFST = (147 | R_MIPS ) MICROMIPS_GOT_HI16 enumerator MICROMIPS_GOT_HI16 = (148 | R_MIPS ) MICROMIPS_GOT_LO16 enumerator MICROMIPS_GOT_LO16 = (149 | R_MIPS ) MICROMIPS_SUB enumerator MICROMIPS_SUB = (150 | R_MIPS ) MICROMIPS_HIGHER enumerator MICROMIPS_HIGHER = (151 | R_MIPS ) MICROMIPS_HIGHEST enumerator MICROMIPS_HIGHEST = (152 | R_MIPS ) MICROMIPS_CALL_HI16 enumerator MICROMIPS_CALL_HI16 = (153 | R_MIPS ) MICROMIPS_CALL_LO16 enumerator MICROMIPS_CALL_LO16 = (154 | R_MIPS ) MICROMIPS_SCN_DISP enumerator MICROMIPS_SCN_DISP = (155 | R_MIPS ) MICROMIPS_JALR enumerator MICROMIPS_JALR = (156 | R_MIPS ) MICROMIPS_HI0_LO16 enumerator MICROMIPS_HI0_LO16 = (157 | R_MIPS ) MICROMIPS_TLS_GD enumerator MICROMIPS_TLS_GD = (162 | R_MIPS ) MICROMIPS_TLS_LDM enumerator MICROMIPS_TLS_LDM = (163 | R_MIPS ) MICROMIPS_TLS_DTPREL_HI16 enumerator MICROMIPS_TLS_DTPREL_HI16 = (164 | R_MIPS ) MICROMIPS_TLS_DTPREL_LO16 enumerator MICROMIPS_TLS_DTPREL_LO16 = (165 | R_MIPS ) MICROMIPS_TLS_GOTTPREL enumerator MICROMIPS_TLS_GOTTPREL = (166 | R_MIPS ) MICROMIPS_TLS_TPREL_HI16 enumerator MICROMIPS_TLS_TPREL_HI16 = (169 | R_MIPS ) MICROMIPS_TLS_TPREL_LO16 enumerator MICROMIPS_TLS_TPREL_LO16 = (170 | R_MIPS ) MICROMIPS_GPREL7_S2 enumerator MICROMIPS_GPREL7_S2 = (172 | R_MIPS ) MICROMIPS_PC23_S2 enumerator MICROMIPS_PC23_S2 = (173 | R_MIPS ) MICROMIPS_PC21_S2 enumerator MICROMIPS_PC21_S2 = (174 | R_MIPS ) MICROMIPS_PC26_S2 enumerator MICROMIPS_PC26_S2 = (175 | R_MIPS ) MICROMIPS_PC18_S3 enumerator MICROMIPS_PC18_S3 = (176 | R_MIPS ) MICROMIPS_PC19_S2 enumerator MICROMIPS_PC19_S2 = (177 | R_MIPS ) MIPS_NUM enumerator MIPS_NUM = (218 | R_MIPS ) MIPS_PC32 enumerator MIPS_PC32 = (248 | R_MIPS ) MIPS_EH enumerator MIPS_EH = (249 | R_MIPS ) PPC_NONE enumerator PPC_NONE = (0 | R_PPC ) PPC_ADDR32 enumerator PPC_ADDR32 = (1 | R_PPC ) PPC_ADDR24 enumerator PPC_ADDR24 = (2 | R_PPC ) PPC_ADDR16 enumerator PPC_ADDR16 = (3 | R_PPC ) PPC_ADDR16_LO enumerator PPC_ADDR16_LO = (4 | R_PPC ) PPC_ADDR16_HI enumerator PPC_ADDR16_HI = (5 | R_PPC ) PPC_ADDR16_HA enumerator PPC_ADDR16_HA = (6 | R_PPC ) PPC_ADDR14 enumerator PPC_ADDR14 = (7 | R_PPC ) PPC_ADDR14_BRTAKEN enumerator PPC_ADDR14_BRTAKEN = (8 | R_PPC ) PPC_ADDR14_BRNTAKEN enumerator PPC_ADDR14_BRNTAKEN = (9 | R_PPC ) PPC_REL24 enumerator PPC_REL24 = (10 | R_PPC ) PPC_REL14 enumerator PPC_REL14 = (11 | R_PPC ) PPC_REL14_BRTAKEN enumerator PPC_REL14_BRTAKEN = (12 | R_PPC ) PPC_REL14_BRNTAKEN enumerator PPC_REL14_BRNTAKEN = (13 | R_PPC ) PPC_GOT16 enumerator PPC_GOT16 = (14 | R_PPC ) PPC_GOT16_LO enumerator PPC_GOT16_LO = (15 | R_PPC ) PPC_GOT16_HI enumerator PPC_GOT16_HI = (16 | R_PPC ) PPC_GOT16_HA enumerator PPC_GOT16_HA = (17 | R_PPC ) PPC_PLTREL24 enumerator PPC_PLTREL24 = (18 | R_PPC ) PPC_JMP_SLOT enumerator PPC_JMP_SLOT = (21 | R_PPC ) PPC_RELATIVE enumerator PPC_RELATIVE = (22 | R_PPC ) PPC_LOCAL24PC enumerator PPC_LOCAL24PC = (23 | R_PPC ) PPC_REL32 enumerator PPC_REL32 = (26 | R_PPC ) PPC_TLS enumerator PPC_TLS = (67 | R_PPC ) PPC_DTPMOD32 enumerator PPC_DTPMOD32 = (68 | R_PPC ) PPC_TPREL16 enumerator PPC_TPREL16 = (69 | R_PPC ) PPC_TPREL16_LO enumerator PPC_TPREL16_LO = (70 | R_PPC ) PPC_TPREL16_HI enumerator PPC_TPREL16_HI = (71 | R_PPC ) PPC_TPREL16_HA enumerator PPC_TPREL16_HA = (72 | R_PPC ) PPC_TPREL32 enumerator PPC_TPREL32 = (73 | R_PPC ) PPC_DTPREL16 enumerator PPC_DTPREL16 = (74 | R_PPC ) PPC_DTPREL16_LO enumerator PPC_DTPREL16_LO = (75 | R_PPC ) PPC_DTPREL16_HI enumerator PPC_DTPREL16_HI = (76 | R_PPC ) PPC_DTPREL16_HA enumerator PPC_DTPREL16_HA = (77 | R_PPC ) PPC_DTPREL32 enumerator PPC_DTPREL32 = (78 | R_PPC ) PPC_GOT_TLSGD16 enumerator PPC_GOT_TLSGD16 = (79 | R_PPC ) PPC_GOT_TLSGD16_LO enumerator PPC_GOT_TLSGD16_LO = (80 | R_PPC ) PPC_GOT_TLSGD16_HI enumerator PPC_GOT_TLSGD16_HI = (81 | R_PPC ) PPC_GOT_TLSGD16_HA enumerator PPC_GOT_TLSGD16_HA = (82 | R_PPC ) PPC_GOT_TLSLD16 enumerator PPC_GOT_TLSLD16 = (83 | R_PPC ) PPC_GOT_TLSLD16_LO enumerator PPC_GOT_TLSLD16_LO = (84 | R_PPC ) PPC_GOT_TLSLD16_HI enumerator PPC_GOT_TLSLD16_HI = (85 | R_PPC ) PPC_GOT_TLSLD16_HA enumerator PPC_GOT_TLSLD16_HA = (86 | R_PPC ) PPC_GOT_TPREL16 enumerator PPC_GOT_TPREL16 = (87 | R_PPC ) PPC_GOT_TPREL16_LO enumerator PPC_GOT_TPREL16_LO = (88 | R_PPC ) PPC_GOT_TPREL16_HI enumerator PPC_GOT_TPREL16_HI = (89 | R_PPC ) PPC_GOT_TPREL16_HA enumerator PPC_GOT_TPREL16_HA = (90 | R_PPC ) PPC_GOT_DTPREL16 enumerator PPC_GOT_DTPREL16 = (91 | R_PPC ) PPC_GOT_DTPREL16_LO enumerator PPC_GOT_DTPREL16_LO = (92 | R_PPC ) PPC_GOT_DTPREL16_HI enumerator PPC_GOT_DTPREL16_HI = (93 | R_PPC ) PPC_GOT_DTPREL16_HA enumerator PPC_GOT_DTPREL16_HA = (94 | R_PPC ) PPC_TLSGD enumerator PPC_TLSGD = (95 | R_PPC ) PPC_TLSLD enumerator PPC_TLSLD = (96 | R_PPC ) PPC_REL16 enumerator PPC_REL16 = (249 | R_PPC ) PPC_REL16_LO enumerator PPC_REL16_LO = (250 | R_PPC ) PPC_REL16_HI enumerator PPC_REL16_HI = (251 | R_PPC ) PPC_REL16_HA enumerator PPC_REL16_HA = (252 | R_PPC ) PPC64_NONE enumerator PPC64_NONE = (0 | R_PPC64 ) PPC64_ADDR32 enumerator PPC64_ADDR32 = (1 | R_PPC64 ) PPC64_ADDR24 enumerator PPC64_ADDR24 = (2 | R_PPC64 ) PPC64_ADDR16 enumerator PPC64_ADDR16 = (3 | R_PPC64 ) PPC64_ADDR16_LO enumerator PPC64_ADDR16_LO = (4 | R_PPC64 ) PPC64_ADDR16_HI enumerator PPC64_ADDR16_HI = (5 | R_PPC64 ) PPC64_ADDR16_HA enumerator PPC64_ADDR16_HA = (6 | R_PPC64 ) PPC64_ADDR14 enumerator PPC64_ADDR14 = (7 | R_PPC64 ) PPC64_ADDR14_BRTAKEN enumerator PPC64_ADDR14_BRTAKEN = (8 | R_PPC64 ) PPC64_ADDR14_BRNTAKEN enumerator PPC64_ADDR14_BRNTAKEN = (9 | R_PPC64 ) PPC64_REL24 enumerator PPC64_REL24 = (10 | R_PPC64 ) PPC64_REL14 enumerator PPC64_REL14 = (11 | R_PPC64 ) PPC64_REL14_BRTAKEN enumerator PPC64_REL14_BRTAKEN = (12 | R_PPC64 ) PPC64_REL14_BRNTAKEN enumerator PPC64_REL14_BRNTAKEN = (13 | R_PPC64 ) PPC64_GOT16 enumerator PPC64_GOT16 = (14 | R_PPC64 ) PPC64_GOT16_LO enumerator PPC64_GOT16_LO = (15 | R_PPC64 ) PPC64_GOT16_HI enumerator PPC64_GOT16_HI = (16 | R_PPC64 ) PPC64_GOT16_HA enumerator PPC64_GOT16_HA = (17 | R_PPC64 ) PPC64_JMP_SLOT enumerator PPC64_JMP_SLOT = (21 | R_PPC64 ) PPC64_RELATIVE enumerator PPC64_RELATIVE = (22 | R_PPC64 ) PPC64_REL32 enumerator PPC64_REL32 = (26 | R_PPC64 ) PPC64_ADDR64 enumerator PPC64_ADDR64 = (38 | R_PPC64 ) PPC64_ADDR16_HIGHER enumerator PPC64_ADDR16_HIGHER = (39 | R_PPC64 ) PPC64_ADDR16_HIGHERA enumerator PPC64_ADDR16_HIGHERA = (40 | R_PPC64 ) PPC64_ADDR16_HIGHEST enumerator PPC64_ADDR16_HIGHEST = (41 | R_PPC64 ) PPC64_ADDR16_HIGHESTA enumerator PPC64_ADDR16_HIGHESTA = (42 | R_PPC64 ) PPC64_REL64 enumerator PPC64_REL64 = (44 | R_PPC64 ) PPC64_TOC16 enumerator PPC64_TOC16 = (47 | R_PPC64 ) PPC64_TOC16_LO enumerator PPC64_TOC16_LO = (48 | R_PPC64 ) PPC64_TOC16_HI enumerator PPC64_TOC16_HI = (49 | R_PPC64 ) PPC64_TOC16_HA enumerator PPC64_TOC16_HA = (50 | R_PPC64 ) PPC64_TOC enumerator PPC64_TOC = (51 | R_PPC64 ) PPC64_ADDR16_DS enumerator PPC64_ADDR16_DS = (56 | R_PPC64 ) PPC64_ADDR16_LO_DS enumerator PPC64_ADDR16_LO_DS = (57 | R_PPC64 ) PPC64_GOT16_DS enumerator PPC64_GOT16_DS = (58 | R_PPC64 ) PPC64_GOT16_LO_DS enumerator PPC64_GOT16_LO_DS = (59 | R_PPC64 ) PPC64_TOC16_DS enumerator PPC64_TOC16_DS = (63 | R_PPC64 ) PPC64_TOC16_LO_DS enumerator PPC64_TOC16_LO_DS = (64 | R_PPC64 ) PPC64_TLS enumerator PPC64_TLS = (67 | R_PPC64 ) PPC64_DTPMOD64 enumerator PPC64_DTPMOD64 = (68 | R_PPC64 ) PPC64_TPREL16 enumerator PPC64_TPREL16 = (69 | R_PPC64 ) PPC64_TPREL16_LO enumerator PPC64_TPREL16_LO = (70 | R_PPC64 ) PPC64_TPREL16_HI enumerator PPC64_TPREL16_HI = (71 | R_PPC64 ) PPC64_TPREL16_HA enumerator PPC64_TPREL16_HA = (72 | R_PPC64 ) PPC64_TPREL64 enumerator PPC64_TPREL64 = (73 | R_PPC64 ) PPC64_DTPREL16 enumerator PPC64_DTPREL16 = (74 | R_PPC64 ) PPC64_DTPREL16_LO enumerator PPC64_DTPREL16_LO = (75 | R_PPC64 ) PPC64_DTPREL16_HI enumerator PPC64_DTPREL16_HI = (76 | R_PPC64 ) PPC64_DTPREL16_HA enumerator PPC64_DTPREL16_HA = (77 | R_PPC64 ) PPC64_DTPREL64 enumerator PPC64_DTPREL64 = (78 | R_PPC64 ) PPC64_GOT_TLSGD16 enumerator PPC64_GOT_TLSGD16 = (79 | R_PPC64 ) PPC64_GOT_TLSGD16_LO enumerator PPC64_GOT_TLSGD16_LO = (80 | R_PPC64 ) PPC64_GOT_TLSGD16_HI enumerator PPC64_GOT_TLSGD16_HI = (81 | R_PPC64 ) PPC64_GOT_TLSGD16_HA enumerator PPC64_GOT_TLSGD16_HA = (82 | R_PPC64 ) PPC64_GOT_TLSLD16 enumerator PPC64_GOT_TLSLD16 = (83 | R_PPC64 ) PPC64_GOT_TLSLD16_LO enumerator PPC64_GOT_TLSLD16_LO = (84 | R_PPC64 ) PPC64_GOT_TLSLD16_HI enumerator PPC64_GOT_TLSLD16_HI = (85 | R_PPC64 ) PPC64_GOT_TLSLD16_HA enumerator PPC64_GOT_TLSLD16_HA = (86 | R_PPC64 ) PPC64_GOT_TPREL16_DS enumerator PPC64_GOT_TPREL16_DS = (87 | R_PPC64 ) PPC64_GOT_TPREL16_LO_DS enumerator PPC64_GOT_TPREL16_LO_DS = (88 | R_PPC64 ) PPC64_GOT_TPREL16_HI enumerator PPC64_GOT_TPREL16_HI = (89 | R_PPC64 ) PPC64_GOT_TPREL16_HA enumerator PPC64_GOT_TPREL16_HA = (90 | R_PPC64 ) PPC64_GOT_DTPREL16_DS enumerator PPC64_GOT_DTPREL16_DS = (91 | R_PPC64 ) PPC64_GOT_DTPREL16_LO_DS enumerator PPC64_GOT_DTPREL16_LO_DS = (92 | R_PPC64 ) PPC64_GOT_DTPREL16_HI enumerator PPC64_GOT_DTPREL16_HI = (93 | R_PPC64 ) PPC64_GOT_DTPREL16_HA enumerator PPC64_GOT_DTPREL16_HA = (94 | R_PPC64 ) PPC64_TPREL16_DS enumerator PPC64_TPREL16_DS = (95 | R_PPC64 ) PPC64_TPREL16_LO_DS enumerator PPC64_TPREL16_LO_DS = (96 | R_PPC64 ) PPC64_TPREL16_HIGHER enumerator PPC64_TPREL16_HIGHER = (97 | R_PPC64 ) PPC64_TPREL16_HIGHERA enumerator PPC64_TPREL16_HIGHERA = (98 | R_PPC64 ) PPC64_TPREL16_HIGHEST enumerator PPC64_TPREL16_HIGHEST = (99 | R_PPC64 ) PPC64_TPREL16_HIGHESTA enumerator PPC64_TPREL16_HIGHESTA = (100 | R_PPC64 ) PPC64_DTPREL16_DS enumerator PPC64_DTPREL16_DS = (101 | R_PPC64 ) PPC64_DTPREL16_LO_DS enumerator PPC64_DTPREL16_LO_DS = (102 | R_PPC64 ) PPC64_DTPREL16_HIGHER enumerator PPC64_DTPREL16_HIGHER = (103 | R_PPC64 ) PPC64_DTPREL16_HIGHERA enumerator PPC64_DTPREL16_HIGHERA = (104 | R_PPC64 ) PPC64_DTPREL16_HIGHEST enumerator PPC64_DTPREL16_HIGHEST = (105 | R_PPC64 ) PPC64_DTPREL16_HIGHESTA enumerator PPC64_DTPREL16_HIGHESTA = (106 | R_PPC64 ) PPC64_TLSGD enumerator PPC64_TLSGD = (107 | R_PPC64 ) PPC64_TLSLD enumerator PPC64_TLSLD = (108 | R_PPC64 ) PPC64_REL16 enumerator PPC64_REL16 = (249 | R_PPC64 ) PPC64_REL16_LO enumerator PPC64_REL16_LO = (250 | R_PPC64 ) PPC64_REL16_HI enumerator PPC64_REL16_HI = (251 | R_PPC64 ) PPC64_REL16_HA enumerator PPC64_REL16_HA = (252 | R_PPC64 ) SPARC_NONE enumerator SPARC_NONE = (0 | R_SPARC ) SPARC_8 enumerator SPARC_8 = (1 | R_SPARC ) SPARC_16 enumerator SPARC_16 = (2 | R_SPARC ) SPARC_32 enumerator SPARC_32 = (3 | R_SPARC ) SPARC_DISP8 enumerator SPARC_DISP8 = (4 | R_SPARC ) SPARC_DISP16 enumerator SPARC_DISP16 = (5 | R_SPARC ) SPARC_DISP32 enumerator SPARC_DISP32 = (6 | R_SPARC ) SPARC_WDISP30 enumerator SPARC_WDISP30 = (7 | R_SPARC ) SPARC_WDISP22 enumerator SPARC_WDISP22 = (8 | R_SPARC ) SPARC_HI22 enumerator SPARC_HI22 = (9 | R_SPARC ) SPARC_22 enumerator SPARC_22 = (10 | R_SPARC ) SPARC_13 enumerator SPARC_13 = (11 | R_SPARC ) SPARC_LO10 enumerator SPARC_LO10 = (12 | R_SPARC ) SPARC_GOT10 enumerator SPARC_GOT10 = (13 | R_SPARC ) SPARC_GOT13 enumerator SPARC_GOT13 = (14 | R_SPARC ) SPARC_GOT22 enumerator SPARC_GOT22 = (15 | R_SPARC ) SPARC_PC10 enumerator SPARC_PC10 = (16 | R_SPARC ) SPARC_PC22 enumerator SPARC_PC22 = (17 | R_SPARC ) SPARC_WPLT30 enumerator SPARC_WPLT30 = (18 | R_SPARC ) SPARC_COPY enumerator SPARC_COPY = (19 | R_SPARC ) SPARC_GLOB_DAT enumerator SPARC_GLOB_DAT = (20 | R_SPARC ) SPARC_JMP_SLOT enumerator SPARC_JMP_SLOT = (21 | R_SPARC ) SPARC_RELATIVE enumerator SPARC_RELATIVE = (22 | R_SPARC ) SPARC_UA32 enumerator SPARC_UA32 = (23 | R_SPARC ) SPARC_PLT32 enumerator SPARC_PLT32 = (24 | R_SPARC ) SPARC_HIPLT22 enumerator SPARC_HIPLT22 = (25 | R_SPARC ) SPARC_LOPLT10 enumerator SPARC_LOPLT10 = (26 | R_SPARC ) SPARC_PCPLT32 enumerator SPARC_PCPLT32 = (27 | R_SPARC ) SPARC_PCPLT22 enumerator SPARC_PCPLT22 = (28 | R_SPARC ) SPARC_PCPLT10 enumerator SPARC_PCPLT10 = (29 | R_SPARC ) SPARC_10 enumerator SPARC_10 = (30 | R_SPARC ) SPARC_11 enumerator SPARC_11 = (31 | R_SPARC ) SPARC_64 enumerator SPARC_64 = (32 | R_SPARC ) SPARC_OLO10 enumerator SPARC_OLO10 = (33 | R_SPARC ) SPARC_HH22 enumerator SPARC_HH22 = (34 | R_SPARC ) SPARC_HM10 enumerator SPARC_HM10 = (35 | R_SPARC ) SPARC_LM22 enumerator SPARC_LM22 = (36 | R_SPARC ) SPARC_PC_HH22 enumerator SPARC_PC_HH22 = (37 | R_SPARC ) SPARC_PC_HM10 enumerator SPARC_PC_HM10 = (38 | R_SPARC ) SPARC_PC_LM22 enumerator SPARC_PC_LM22 = (39 | R_SPARC ) SPARC_WDISP16 enumerator SPARC_WDISP16 = (40 | R_SPARC ) SPARC_WDISP19 enumerator SPARC_WDISP19 = (41 | R_SPARC ) SPARC_7 enumerator SPARC_7 = (43 | R_SPARC ) SPARC_5 enumerator SPARC_5 = (44 | R_SPARC ) SPARC_6 enumerator SPARC_6 = (45 | R_SPARC ) SPARC_DISP64 enumerator SPARC_DISP64 = (46 | R_SPARC ) SPARC_PLT64 enumerator SPARC_PLT64 = (47 | R_SPARC ) SPARC_HIX22 enumerator SPARC_HIX22 = (48 | R_SPARC ) SPARC_LOX10 enumerator SPARC_LOX10 = (49 | R_SPARC ) SPARC_H44 enumerator SPARC_H44 = (50 | R_SPARC ) SPARC_M44 enumerator SPARC_M44 = (51 | R_SPARC ) SPARC_L44 enumerator SPARC_L44 = (52 | R_SPARC ) SPARC_REGISTER enumerator SPARC_REGISTER = (53 | R_SPARC ) SPARC_UA64 enumerator SPARC_UA64 = (54 | R_SPARC ) SPARC_UA16 enumerator SPARC_UA16 = (55 | R_SPARC ) SPARC_TLS_GD_HI22 enumerator SPARC_TLS_GD_HI22 = (56 | R_SPARC ) SPARC_TLS_GD_LO10 enumerator SPARC_TLS_GD_LO10 = (57 | R_SPARC ) SPARC_TLS_GD_ADD enumerator SPARC_TLS_GD_ADD = (58 | R_SPARC ) SPARC_TLS_GD_CALL enumerator SPARC_TLS_GD_CALL = (59 | R_SPARC ) SPARC_TLS_LDM_HI22 enumerator SPARC_TLS_LDM_HI22 = (60 | R_SPARC ) SPARC_TLS_LDM_LO10 enumerator SPARC_TLS_LDM_LO10 = (61 | R_SPARC ) SPARC_TLS_LDM_ADD enumerator SPARC_TLS_LDM_ADD = (62 | R_SPARC ) SPARC_TLS_LDM_CALL enumerator SPARC_TLS_LDM_CALL = (63 | R_SPARC ) SPARC_TLS_LDO_HIX22 enumerator SPARC_TLS_LDO_HIX22 = (64 | R_SPARC ) SPARC_TLS_LDO_LOX10 enumerator SPARC_TLS_LDO_LOX10 = (65 | R_SPARC ) SPARC_TLS_LDO_ADD enumerator SPARC_TLS_LDO_ADD = (66 | R_SPARC ) SPARC_TLS_IE_HI22 enumerator SPARC_TLS_IE_HI22 = (67 | R_SPARC ) SPARC_TLS_IE_LO10 enumerator SPARC_TLS_IE_LO10 = (68 | R_SPARC ) SPARC_TLS_IE_LD enumerator SPARC_TLS_IE_LD = (69 | R_SPARC ) SPARC_TLS_IE_LDX enumerator SPARC_TLS_IE_LDX = (70 | R_SPARC ) SPARC_TLS_IE_ADD enumerator SPARC_TLS_IE_ADD = (71 | R_SPARC ) SPARC_TLS_LE_HIX22 enumerator SPARC_TLS_LE_HIX22 = (72 | R_SPARC ) SPARC_TLS_LE_LOX10 enumerator SPARC_TLS_LE_LOX10 = (73 | R_SPARC ) SPARC_TLS_DTPMOD32 enumerator SPARC_TLS_DTPMOD32 = (74 | R_SPARC ) SPARC_TLS_DTPMOD64 enumerator SPARC_TLS_DTPMOD64 = (75 | R_SPARC ) SPARC_TLS_DTPOFF32 enumerator SPARC_TLS_DTPOFF32 = (76 | R_SPARC ) SPARC_TLS_DTPOFF64 enumerator SPARC_TLS_DTPOFF64 = (77 | R_SPARC ) SPARC_TLS_TPOFF32 enumerator SPARC_TLS_TPOFF32 = (78 | R_SPARC ) SPARC_TLS_TPOFF64 enumerator SPARC_TLS_TPOFF64 = (79 | R_SPARC ) SPARC_GOTDATA_HIX22 enumerator SPARC_GOTDATA_HIX22 = (80 | R_SPARC ) SPARC_GOTDATA_LOX10 enumerator SPARC_GOTDATA_LOX10 = (81 | R_SPARC ) SPARC_GOTDATA_OP_HIX22 enumerator SPARC_GOTDATA_OP_HIX22 = (82 | R_SPARC ) SPARC_GOTDATA_OP_LOX10 enumerator SPARC_GOTDATA_OP_LOX10 = (83 | R_SPARC ) SPARC_GOTDATA_OP enumerator SPARC_GOTDATA_OP = (84 | R_SPARC ) SYSZ_NONE enumerator SYSZ_NONE = (0 | R_SYSZ ) SYSZ_8 enumerator SYSZ_8 = (1 | R_SYSZ ) SYSZ_12 enumerator SYSZ_12 = (2 | R_SYSZ ) SYSZ_16 enumerator SYSZ_16 = (3 | R_SYSZ ) SYSZ_32 enumerator SYSZ_32 = (4 | R_SYSZ ) SYSZ_PC32 enumerator SYSZ_PC32 = (5 | R_SYSZ ) SYSZ_GOT12 enumerator SYSZ_GOT12 = (6 | R_SYSZ ) SYSZ_GOT32 enumerator SYSZ_GOT32 = (7 | R_SYSZ ) SYSZ_PLT32 enumerator SYSZ_PLT32 = (8 | R_SYSZ ) SYSZ_COPY enumerator SYSZ_COPY = (9 | R_SYSZ ) SYSZ_GLOB_DAT enumerator SYSZ_GLOB_DAT = (10 | R_SYSZ ) SYSZ_JMP_SLOT enumerator SYSZ_JMP_SLOT = (11 | R_SYSZ ) SYSZ_RELATIVE enumerator SYSZ_RELATIVE = (12 | R_SYSZ ) SYSZ_GOTOFF enumerator SYSZ_GOTOFF = (13 | R_SYSZ ) SYSZ_GOTPC enumerator SYSZ_GOTPC = (14 | R_SYSZ ) SYSZ_GOT16 enumerator SYSZ_GOT16 = (15 | R_SYSZ ) SYSZ_PC16 enumerator SYSZ_PC16 = (16 | R_SYSZ ) SYSZ_PC16DBL enumerator SYSZ_PC16DBL = (17 | R_SYSZ ) SYSZ_PLT16DBL enumerator SYSZ_PLT16DBL = (18 | R_SYSZ ) SYSZ_PC32DBL enumerator SYSZ_PC32DBL = (19 | R_SYSZ ) SYSZ_PLT32DBL enumerator SYSZ_PLT32DBL = (20 | R_SYSZ ) SYSZ_GOTPCDBL enumerator SYSZ_GOTPCDBL = (21 | R_SYSZ ) SYSZ_64 enumerator SYSZ_64 = (22 | R_SYSZ ) SYSZ_PC64 enumerator SYSZ_PC64 = (23 | R_SYSZ ) SYSZ_GOT64 enumerator SYSZ_GOT64 = (24 | R_SYSZ ) SYSZ_PLT64 enumerator SYSZ_PLT64 = (25 | R_SYSZ ) SYSZ_GOTENT enumerator SYSZ_GOTENT = (26 | R_SYSZ ) SYSZ_GOTOFF16 enumerator SYSZ_GOTOFF16 = (27 | R_SYSZ ) SYSZ_GOTOFF64 enumerator SYSZ_GOTOFF64 = (28 | R_SYSZ ) SYSZ_GOTPLT12 enumerator SYSZ_GOTPLT12 = (29 | R_SYSZ ) SYSZ_GOTPLT16 enumerator SYSZ_GOTPLT16 = (30 | R_SYSZ ) SYSZ_GOTPLT32 enumerator SYSZ_GOTPLT32 = (31 | R_SYSZ ) SYSZ_GOTPLT64 enumerator SYSZ_GOTPLT64 = (32 | R_SYSZ ) SYSZ_GOTPLTENT enumerator SYSZ_GOTPLTENT = (33 | R_SYSZ ) SYSZ_PLTOFF16 enumerator SYSZ_PLTOFF16 = (34 | R_SYSZ ) SYSZ_PLTOFF32 enumerator SYSZ_PLTOFF32 = (35 | R_SYSZ ) SYSZ_PLTOFF64 enumerator SYSZ_PLTOFF64 = (36 | R_SYSZ ) SYSZ_TLS_LOAD enumerator SYSZ_TLS_LOAD = (37 | R_SYSZ ) SYSZ_TLS_GDCALL enumerator SYSZ_TLS_GDCALL = (38 | R_SYSZ ) SYSZ_TLS_LDCALL enumerator SYSZ_TLS_LDCALL = (39 | R_SYSZ ) SYSZ_TLS_GD32 enumerator SYSZ_TLS_GD32 = (40 | R_SYSZ ) SYSZ_TLS_GD64 enumerator SYSZ_TLS_GD64 = (41 | R_SYSZ ) SYSZ_TLS_GOTIE12 enumerator SYSZ_TLS_GOTIE12 = (42 | R_SYSZ ) SYSZ_TLS_GOTIE32 enumerator SYSZ_TLS_GOTIE32 = (43 | R_SYSZ ) SYSZ_TLS_GOTIE64 enumerator SYSZ_TLS_GOTIE64 = (44 | R_SYSZ ) SYSZ_TLS_LDM32 enumerator SYSZ_TLS_LDM32 = (45 | R_SYSZ ) SYSZ_TLS_LDM64 enumerator SYSZ_TLS_LDM64 = (46 | R_SYSZ ) SYSZ_TLS_IE32 enumerator SYSZ_TLS_IE32 = (47 | R_SYSZ ) SYSZ_TLS_IE64 enumerator SYSZ_TLS_IE64 = (48 | R_SYSZ ) SYSZ_TLS_IEENT enumerator SYSZ_TLS_IEENT = (49 | R_SYSZ ) SYSZ_TLS_LE32 enumerator SYSZ_TLS_LE32 = (50 | R_SYSZ ) SYSZ_TLS_LE64 enumerator SYSZ_TLS_LE64 = (51 | R_SYSZ ) SYSZ_TLS_LDO32 enumerator SYSZ_TLS_LDO32 = (52 | R_SYSZ ) SYSZ_TLS_LDO64 enumerator SYSZ_TLS_LDO64 = (53 | R_SYSZ ) SYSZ_TLS_DTPMOD enumerator SYSZ_TLS_DTPMOD = (54 | R_SYSZ ) SYSZ_TLS_DTPOFF enumerator SYSZ_TLS_DTPOFF = (55 | R_SYSZ ) SYSZ_TLS_TPOFF enumerator SYSZ_TLS_TPOFF = (56 | R_SYSZ ) SYSZ_20 enumerator SYSZ_20 = (57 | R_SYSZ ) SYSZ_GOT20 enumerator SYSZ_GOT20 = (58 | R_SYSZ ) SYSZ_GOTPLT20 enumerator SYSZ_GOTPLT20 = (59 | R_SYSZ ) SYSZ_TLS_GOTIE20 enumerator SYSZ_TLS_GOTIE20 = (60 | R_SYSZ ) SYSZ_IRELATIVE enumerator SYSZ_IRELATIVE = (61 | R_SYSZ ) SYSZ_PC12DBL enumerator SYSZ_PC12DBL = (62 | R_SYSZ ) SYSZ_PLT12DBL enumerator SYSZ_PLT12DBL = (63 | R_SYSZ ) SYSZ_PC24DBL enumerator SYSZ_PC24DBL = (64 | R_SYSZ ) SYSZ_PLT24DBL enumerator SYSZ_PLT24DBL = (65 | R_SYSZ ) RISCV_NONE enumerator RISCV_NONE = (0 | R_RISCV ) RISCV_32 enumerator RISCV_32 = (1 | R_RISCV ) RISCV_64 enumerator RISCV_64 = (2 | R_RISCV ) RISCV_RELATIVE enumerator RISCV_RELATIVE = (3 | R_RISCV ) RISCV_COPY enumerator RISCV_COPY = (4 | R_RISCV ) RISCV_JUMP_SLOT enumerator RISCV_JUMP_SLOT = (5 | R_RISCV ) RISCV_TLS_DTPMOD32 enumerator RISCV_TLS_DTPMOD32 = (6 | R_RISCV ) RISCV_TLS_DTPMOD64 enumerator RISCV_TLS_DTPMOD64 = (7 | R_RISCV ) RISCV_TLS_DTPREL32 enumerator RISCV_TLS_DTPREL32 = (8 | R_RISCV ) RISCV_TLS_DTPREL64 enumerator RISCV_TLS_DTPREL64 = (9 | R_RISCV ) RISCV_TLS_TPREL32 enumerator RISCV_TLS_TPREL32 = (10 | R_RISCV ) RISCV_TLS_TPREL64 enumerator RISCV_TLS_TPREL64 = (11 | R_RISCV ) RISCV_TLSDESC enumerator RISCV_TLSDESC = (12 | R_RISCV ) RISCV_BRANCH enumerator RISCV_BRANCH = (16 | R_RISCV ) RISCV_JAL enumerator RISCV_JAL = (17 | R_RISCV ) RISCV_CALL enumerator RISCV_CALL = (18 | R_RISCV ) RISCV_CALL_PLT enumerator RISCV_CALL_PLT = (19 | R_RISCV ) RISCV_GOT_HI20 enumerator RISCV_GOT_HI20 = (20 | R_RISCV ) RISCV_TLS_GOT_HI20 enumerator RISCV_TLS_GOT_HI20 = (21 | R_RISCV ) RISCV_TLS_GD_HI20 enumerator RISCV_TLS_GD_HI20 = (22 | R_RISCV ) RISCV_PCREL_HI20 enumerator RISCV_PCREL_HI20 = (23 | R_RISCV ) RISCV_PCREL_LO12_I enumerator RISCV_PCREL_LO12_I = (24 | R_RISCV ) RISCV_PCREL_LO12_S enumerator RISCV_PCREL_LO12_S = (25 | R_RISCV ) RISCV_HI20 enumerator RISCV_HI20 = (26 | R_RISCV ) RISCV_LO12_I enumerator RISCV_LO12_I = (27 | R_RISCV ) RISCV_LO12_S enumerator RISCV_LO12_S = (28 | R_RISCV ) RISCV_TPREL_HI20 enumerator RISCV_TPREL_HI20 = (29 | R_RISCV ) RISCV_TPREL_LO12_I enumerator RISCV_TPREL_LO12_I = (30 | R_RISCV ) RISCV_TPREL_LO12_S enumerator RISCV_TPREL_LO12_S = (31 | R_RISCV ) RISCV_TPREL_ADD enumerator RISCV_TPREL_ADD = (32 | R_RISCV ) RISCV_ADD8 enumerator RISCV_ADD8 = (33 | R_RISCV ) RISCV_ADD16 enumerator RISCV_ADD16 = (34 | R_RISCV ) RISCV_ADD32 enumerator RISCV_ADD32 = (35 | R_RISCV ) RISCV_ADD64 enumerator RISCV_ADD64 = (36 | R_RISCV ) RISCV_SUB8 enumerator RISCV_SUB8 = (37 | R_RISCV ) RISCV_SUB16 enumerator RISCV_SUB16 = (38 | R_RISCV ) RISCV_SUB32 enumerator RISCV_SUB32 = (39 | R_RISCV ) RISCV_SUB64 enumerator RISCV_SUB64 = (40 | R_RISCV ) RISCV_GOT32_PCREL enumerator RISCV_GOT32_PCREL = (41 | R_RISCV ) RISCV_ALIGN enumerator RISCV_ALIGN = (43 | R_RISCV ) RISCV_RVC_BRANCH enumerator RISCV_RVC_BRANCH = (44 | R_RISCV ) RISCV_RVC_JUMP enumerator RISCV_RVC_JUMP = (45 | R_RISCV ) RISCV_RVC_LUI enumerator RISCV_RVC_LUI = (46 | R_RISCV ) RISCV_RELAX enumerator RISCV_RELAX = (51 | R_RISCV ) RISCV_SUB6 enumerator RISCV_SUB6 = (52 | R_RISCV ) RISCV_SET6 enumerator RISCV_SET6 = (53 | R_RISCV ) RISCV_SET8 enumerator RISCV_SET8 = (54 | R_RISCV ) RISCV_SET16 enumerator RISCV_SET16 = (55 | R_RISCV ) RISCV_SET32 enumerator RISCV_SET32 = (56 | R_RISCV ) RISCV_32_PCREL enumerator RISCV_32_PCREL = (57 | R_RISCV ) RISCV_IRELATIVE enumerator RISCV_IRELATIVE = (58 | R_RISCV ) RISCV_PLT32 enumerator RISCV_PLT32 = (59 | R_RISCV ) RISCV_SET_ULEB128 enumerator RISCV_SET_ULEB128 = (60 | R_RISCV ) RISCV_SUB_ULEB128 enumerator RISCV_SUB_ULEB128 = (61 | R_RISCV ) RISCV_TLSDESC_HI20 enumerator RISCV_TLSDESC_HI20 = (62 | R_RISCV ) RISCV_TLSDESC_LOAD_LO12 enumerator RISCV_TLSDESC_LOAD_LO12 = (63 | R_RISCV ) RISCV_TLSDESC_ADD_LO12 enumerator RISCV_TLSDESC_ADD_LO12 = (64 | R_RISCV ) RISCV_TLSDESC_CALL enumerator RISCV_TLSDESC_CALL = (65 | R_RISCV ) BPF_NONE enumerator BPF_NONE = (0 | R_BPF ) BPF_64_64 enumerator BPF_64_64 = (1 | R_BPF ) BPF_64_ABS64 enumerator BPF_64_ABS64 = (2 | R_BPF ) BPF_64_ABS32 enumerator BPF_64_ABS32 = (3 | R_BPF ) BPF_64_NODYLD32 enumerator BPF_64_NODYLD32 = (4 | R_BPF ) BPF_64_32 enumerator BPF_64_32 = (10 | R_BPF ) SH_NONE enumerator SH_NONE = (0 | R_SH4 ) SH_DIR32 enumerator SH_DIR32 = (1 | R_SH4 ) SH_REL32 enumerator SH_REL32 = (2 | R_SH4 ) SH_DIR8WPN enumerator SH_DIR8WPN = (3 | R_SH4 ) SH_IND12W enumerator SH_IND12W = (4 | R_SH4 ) SH_DIR8WPL enumerator SH_DIR8WPL = (5 | R_SH4 ) SH_DIR8WPZ enumerator SH_DIR8WPZ = (6 | R_SH4 ) SH_DIR8BP enumerator SH_DIR8BP = (7 | R_SH4 ) SH_DIR8W enumerator SH_DIR8W = (8 | R_SH4 ) SH_DIR8L enumerator SH_DIR8L = (9 | R_SH4 ) SH_LOOP_START enumerator SH_LOOP_START = (10 | R_SH4 ) SH_LOOP_END enumerator SH_LOOP_END = (11 | R_SH4 ) SH_GNU_VTINHERIT enumerator SH_GNU_VTINHERIT = (22 | R_SH4 ) SH_GNU_VTENTRY enumerator SH_GNU_VTENTRY = (23 | R_SH4 ) SH_SWITCH8 enumerator SH_SWITCH8 = (24 | R_SH4 ) SH_SWITCH16 enumerator SH_SWITCH16 = (25 | R_SH4 ) SH_SWITCH32 enumerator SH_SWITCH32 = (26 | R_SH4 ) SH_USES enumerator SH_USES = (27 | R_SH4 ) SH_COUNT enumerator SH_COUNT = (28 | R_SH4 ) SH_ALIGN enumerator SH_ALIGN = (29 | R_SH4 ) SH_CODE enumerator SH_CODE = (30 | R_SH4 ) SH_DATA enumerator SH_DATA = (31 | R_SH4 ) SH_LABEL enumerator SH_LABEL = (32 | R_SH4 ) SH_DIR16 enumerator SH_DIR16 = (33 | R_SH4 ) SH_DIR8 enumerator SH_DIR8 = (34 | R_SH4 ) SH_DIR8UL enumerator SH_DIR8UL = (35 | R_SH4 ) SH_DIR8UW enumerator SH_DIR8UW = (36 | R_SH4 ) SH_DIR8U enumerator SH_DIR8U = (37 | R_SH4 ) SH_DIR8SW enumerator SH_DIR8SW = (38 | R_SH4 ) SH_DIR8S enumerator SH_DIR8S = (39 | R_SH4 ) SH_DIR4UL enumerator SH_DIR4UL = (40 | R_SH4 ) SH_DIR4UW enumerator SH_DIR4UW = (41 | R_SH4 ) SH_DIR4U enumerator SH_DIR4U = (42 | R_SH4 ) SH_PSHA enumerator SH_PSHA = (43 | R_SH4 ) SH_PSHL enumerator SH_PSHL = (44 | R_SH4 ) SH_DIR5U enumerator SH_DIR5U = (45 | R_SH4 ) SH_DIR6U enumerator SH_DIR6U = (46 | R_SH4 ) SH_DIR6S enumerator SH_DIR6S = (47 | R_SH4 ) SH_DIR10S enumerator SH_DIR10S = (48 | R_SH4 ) SH_DIR10SW enumerator SH_DIR10SW = (49 | R_SH4 ) SH_DIR10SL enumerator SH_DIR10SL = (50 | R_SH4 ) SH_DIR10SQ enumerator SH_DIR10SQ = (51 | R_SH4 ) SH_DIR16S enumerator SH_DIR16S = (53 | R_SH4 ) SH_TLS_GD_32 enumerator SH_TLS_GD_32 = (144 | R_SH4 ) SH_TLS_LD_32 enumerator SH_TLS_LD_32 = (145 | R_SH4 ) SH_TLS_LDO_32 enumerator SH_TLS_LDO_32 = (146 | R_SH4 ) SH_TLS_IE_32 enumerator SH_TLS_IE_32 = (147 | R_SH4 ) SH_TLS_LE_32 enumerator SH_TLS_LE_32 = (148 | R_SH4 ) SH_TLS_DTPMOD32 enumerator SH_TLS_DTPMOD32 = (149 | R_SH4 ) SH_TLS_DTPOFF32 enumerator SH_TLS_DTPOFF32 = (150 | R_SH4 ) SH_TLS_TPOFF32 enumerator SH_TLS_TPOFF32 = (151 | R_SH4 ) SH_GOT32 enumerator SH_GOT32 = (160 | R_SH4 ) SH_PLT32 enumerator SH_PLT32 = (161 | R_SH4 ) SH_COPY enumerator SH_COPY = (162 | R_SH4 ) SH_GLOB_DAT enumerator SH_GLOB_DAT = (163 | R_SH4 ) SH_JMP_SLOT enumerator SH_JMP_SLOT = (164 | R_SH4 ) SH_RELATIVE enumerator SH_RELATIVE = (165 | R_SH4 ) SH_GOTOFF enumerator SH_GOTOFF = (166 | R_SH4 ) SH_GOTPC enumerator SH_GOTPC = (167 | R_SH4 ) SH_GOTPLT32 enumerator SH_GOTPLT32 = (168 | R_SH4 ) SH_GOT_LOW16 enumerator SH_GOT_LOW16 = (169 | R_SH4 ) SH_GOT_MEDLOW16 enumerator SH_GOT_MEDLOW16 = (170 | R_SH4 ) SH_GOT_MEDHI16 enumerator SH_GOT_MEDHI16 = (171 | R_SH4 ) SH_GOT_HI16 enumerator SH_GOT_HI16 = (172 | R_SH4 ) SH_GOTPLT_LOW16 enumerator SH_GOTPLT_LOW16 = (173 | R_SH4 ) SH_GOTPLT_MEDLOW16 enumerator SH_GOTPLT_MEDLOW16 = (174 | R_SH4 ) SH_GOTPLT_MEDHI16 enumerator SH_GOTPLT_MEDHI16 = (175 | R_SH4 ) SH_GOTPLT_HI16 enumerator SH_GOTPLT_HI16 = (176 | R_SH4 ) SH_PLT_LOW16 enumerator SH_PLT_LOW16 = (177 | R_SH4 ) SH_PLT_MEDLOW16 enumerator SH_PLT_MEDLOW16 = (178 | R_SH4 ) SH_PLT_MEDHI16 enumerator SH_PLT_MEDHI16 = (179 | R_SH4 ) SH_PLT_HI16 enumerator SH_PLT_HI16 = (180 | R_SH4 ) SH_GOTOFF_LOW16 enumerator SH_GOTOFF_LOW16 = (181 | R_SH4 ) SH_GOTOFF_MEDLOW16 enumerator SH_GOTOFF_MEDLOW16 = (182 | R_SH4 ) SH_GOTOFF_MEDHI16 enumerator SH_GOTOFF_MEDHI16 = (183 | R_SH4 ) SH_GOTOFF_HI16 enumerator SH_GOTOFF_HI16 = (184 | R_SH4 ) SH_GOTPC_LOW16 enumerator SH_GOTPC_LOW16 = (185 | R_SH4 ) SH_GOTPC_MEDLOW16 enumerator SH_GOTPC_MEDLOW16 = (186 | R_SH4 ) SH_GOTPC_MEDHI16 enumerator SH_GOTPC_MEDHI16 = (187 | R_SH4 ) SH_GOTPC_HI16 enumerator SH_GOTPC_HI16 = (188 | R_SH4 ) SH_GOT10BY4 enumerator SH_GOT10BY4 = (189 | R_SH4 ) SH_GOTPLT10BY4 enumerator SH_GOTPLT10BY4 = (190 | R_SH4 ) SH_GOT10BY8 enumerator SH_GOT10BY8 = (191 | R_SH4 ) SH_GOTPLT10BY8 enumerator SH_GOTPLT10BY8 = (192 | R_SH4 ) SH_COPY64 enumerator SH_COPY64 = (193 | R_SH4 ) SH_GLOB_DAT64 enumerator SH_GLOB_DAT64 = (194 | R_SH4 ) SH_JMP_SLOT64 enumerator SH_JMP_SLOT64 = (195 | R_SH4 ) SH_RELATIVE64 enumerator SH_RELATIVE64 = (196 | R_SH4 ) SH_GOT20 enumerator SH_GOT20 = (201 | R_SH4 ) SH_GOTOFF20 enumerator SH_GOTOFF20 = (202 | R_SH4 ) SH_GOTFUNCDESC enumerator SH_GOTFUNCDESC = (203 | R_SH4 ) SH_GOTFUNCDESC20 enumerator SH_GOTFUNCDESC20 = (204 | R_SH4 ) SH_GOTOFFFUNCDESC enumerator SH_GOTOFFFUNCDESC = (205 | R_SH4 ) SH_GOTOFFFUNCDESC20 enumerator SH_GOTOFFFUNCDESC20 = (206 | R_SH4 ) SH_FUNCDESC enumerator SH_FUNCDESC = (207 | R_SH4 ) SH_FUNCDESC_VALUE enumerator SH_FUNCDESC_VALUE = (208 | R_SH4 ) SH_SHMEDIA_CODE enumerator SH_SHMEDIA_CODE = (242 | R_SH4 ) SH_PT_16 enumerator SH_PT_16 = (243 | R_SH4 ) SH_IMMS16 enumerator SH_IMMS16 = (244 | R_SH4 ) SH_IMMU16 enumerator SH_IMMU16 = (245 | R_SH4 ) SH_IMM_LOW16 enumerator SH_IMM_LOW16 = (246 | R_SH4 ) SH_IMM_LOW16_PCREL enumerator SH_IMM_LOW16_PCREL = (247 | R_SH4 ) SH_IMM_MEDLOW16 enumerator SH_IMM_MEDLOW16 = (248 | R_SH4 ) SH_IMM_MEDLOW16_PCREL enumerator SH_IMM_MEDLOW16_PCREL = (249 | R_SH4 ) SH_IMM_MEDHI16 enumerator SH_IMM_MEDHI16 = (250 | R_SH4 ) SH_IMM_MEDHI16_PCREL enumerator SH_IMM_MEDHI16_PCREL = (251 | R_SH4 ) SH_IMM_HI16 enumerator SH_IMM_HI16 = (252 | R_SH4 ) SH_IMM_HI16_PCREL enumerator SH_IMM_HI16_PCREL = (253 | R_SH4 ) SH_64 enumerator SH_64 = (254 | R_SH4 ) SH_64_PCREL enumerator SH_64_PCREL = (255 | R_SH4 ) Public Functions Relocation Relocation(uint64_t address, TYPE type, ENCODING enc) Relocation Relocation() = default Relocation inline Relocation( ARCH arch) ~Relocation ~Relocation() override = default Relocation inline Relocation(const Relocation &other) Copy constructor. Warning When this constructor is invoked, referenced sections or symbols are discarded. This means that on the copied Relocation , Relocation::section , Relocation::symbol and Relocation::symbol_table are set to a nullptr. operator= inline Relocation &operator=( Relocation other) Copy assignment operator. Please read the notice of the copy constructor swap inline void swap( Relocation &other) addend inline int64_t addend() const Additional value that can be involved in the relocation processing. type inline TYPE type() const Type of the relocation. is_rela inline bool is_rela() const Check if the relocation uses the explicit addend() field (this is usually the case for 64 bits binaries). is_rel inline bool is_rel() const Check if the relocation uses the implicit addend (i.e. not present in the ELF structure). is_relatively_encoded inline bool is_relatively_encoded() const True if the relocation is using the relative encoding. is_android_packed inline bool is_android_packed() const True if the relocation is using the Android packed relocation format. info inline uint32_t info() const Relocation info which contains, for instance, the symbol index. r_info inline uint64_t r_info( Header :: CLASS clazz, Header :: ELF_DATA data) const (re)Compute the raw r_info attribute based on the given ELF class and endianness. r_info inline uint64_t r_info(const Header &hdr) const (re)Compute the raw r_info attribute from the given ELF header. architecture inline ARCH architecture() const Target architecture for this relocation. purpose inline PURPOSE purpose() const encoding inline ENCODING encoding() const The encoding of the relocation. is_relative inline bool is_relative() const True if the semantic of the relocation is _RELATIVE . size virtual size_t size() const override Return the size (in bits ) of the value associated with this relocation Return -1 if the size can’t be determined. has_symbol inline bool has_symbol() const True if the current relocation is associated with a symbol. symbol inline Symbol *symbol() Symbol associated with the relocation (or a nullptr). symbol inline const Symbol *symbol() const has_section inline bool has_section() const True if the relocation has an associated section. section inline Section *section() The section in which the relocation is applied (or a nullptr). section inline const Section *section() const symbol_table inline Section *symbol_table() The associated symbol table (or a nullptr). symbol_table inline const Section *symbol_table() const addend inline void addend(int64_t addend) type inline void type( TYPE type) purpose inline void purpose( PURPOSE purpose) info inline void info(uint32_t v) symbol inline void symbol( Symbol *symbol) section inline void section( Section *section) symbol_table inline void symbol_table( Section *section) resolve result resolve(uint64_t base_address = 0) const Try to resolve the value of the relocation such as *address() = resolve() . accept virtual void accept(Visitor &visitor) const override Public Static Functions decode_mips_n64 static inline DecodedMipsN64 decode_mips_n64(uint64_t r_info, Header :: ELF_DATA data) Decode r_info for MIPS n64. encode_mips_n64 static inline uint64_t encode_mips_n64( DecodedMipsN64 decoded, Header :: ELF_DATA data) Encode all the fields of a MIPS n64 relocation into a r_info value. encode_mips_n64 static inline uint64_t encode_mips_n64(uint32_t type_value, uint32_t sym_idx, Header :: ELF_DATA data) type_from static TYPE type_from(uint32_t value, ARCH arch) to_value static inline uint32_t to_value( TYPE type) Tcreate template static std::unique_ptr< Relocation > create(const T &header, PURPOSE purpose, ENCODING enc, const Header &elf_hdr) Public Static Attributes R_BIT static uint64_t R_BIT = 27 R_MASK static uint64_t R_MASK = (uint64_t(1) << R_BIT ) - 1 R_X64 static uint64_t R_X64 = uint64_t(1) << R_BIT R_AARCH64 static uint64_t R_AARCH64 = uint64_t(2) << R_BIT R_ARM static uint64_t R_ARM = uint64_t(3) << R_BIT R_HEXAGON static uint64_t R_HEXAGON = uint64_t(4) << R_BIT R_X86 static uint64_t R_X86 = uint64_t(5) << R_BIT R_LARCH static uint64_t R_LARCH = uint64_t(6) << R_BIT R_MIPS static uint64_t R_MIPS = uint64_t(7) << R_BIT R_PPC static uint64_t R_PPC = uint64_t(8) << R_BIT R_PPC64 static uint64_t R_PPC64 = uint64_t(9) << R_BIT R_SPARC static uint64_t R_SPARC = uint64_t(10) << R_BIT R_SYSZ static uint64_t R_SYSZ = uint64_t(11) << R_BIT R_RISCV static uint64_t R_RISCV = uint64_t(12) << R_BIT R_BPF static uint64_t R_BPF = uint64_t(13) << R_BIT R_SH4 static uint64_t R_SH4 = uint64_t(14) << R_BIT Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Relocation &entry) DecodedMipsN64 struct DecodedMipsN64 Fields decoded from the MIPS-specific n64 r_info layout. Public Members type_value uint32_t type_value = 0 Primary relocation type. sym_idx uint32_t sym_idx = 0 Index of the symbol associated with the relocation. special_symbol uint8_t special_symbol = 0 Special symbol used by the second relocation operation. type2 uint8_t type2 = 0 Second relocation type. type3 uint8_t type3 = 0 Third relocation type. Symbol Symbol class Symbol : public LIEF:: Symbol Class which represents an ELF symbol. Public Types BINDING enum class BINDING Values: LOCAL enumerator LOCAL = 0 Local symbol. GLOBAL enumerator GLOBAL Global symbol. WEAK enumerator WEAK Weak symbol. GNU_UNIQUE enumerator GNU_UNIQUE = 10 Unique symbol. TYPE enum class TYPE Type of the symbol. This enum matches the STT_xxx values of the ELF specs. Values: NOTYPE enumerator NOTYPE = 0 Symbol ’s type is not specified. OBJECT enumerator OBJECT Symbol is a data object (variable, array, etc.). FUNC enumerator FUNC Symbol is executable code (function, etc.). SECTION enumerator SECTION Symbol refers to a section. FILE enumerator FILE Local, absolute symbol that refers to a file. COMMON enumerator COMMON An uninitialized common block. TLS enumerator TLS Thread local data object. GNU_IFUNC enumerator GNU_IFUNC = 10 GNU indirect function. VISIBILITY enum class VISIBILITY Visibility of the symbol. This enum matches the STV_xxx values of the official ELF specs. Values: DEFAULT enumerator DEFAULT = 0 Visibility is specified by binding type. INTERNAL enumerator INTERNAL Defined by processor supplements. HIDDEN enumerator HIDDEN Not visible to other components. PROTECTED enumerator PROTECTED Visible in other components but not preemptable. SECTION_INDEX enum SECTION_INDEX Special section indices. Values: UNDEF enumerator UNDEF = 0 Undefined section. ABS enumerator ABS = 0xfff1 Associated symbol is absolute. COMMON enumerator COMMON = 0xfff2 Associated symbol is common. Public Functions Symbol inline Symbol(std::string name) Symbol Symbol() = default ~Symbol ~Symbol() override = default operator= Symbol &operator=( Symbol other) Symbol Symbol(const Symbol &other) swap void swap( Symbol &other) type inline TYPE type() const The symbol’s type provides a general classification for the associated entity. binding inline BINDING binding() const The symbol’s binding determines the linkage visibility and behavior. information uint8_t information() const This member specifies the symbol’s type and binding attributes. other inline uint8_t other() const Alias for visibility() . section_idx inline uint16_t section_idx() const ELF::Section index associated with the symbol. visibility inline VISIBILITY visibility() const Symbol visibility. section inline Section *section() Section associated with the symbol or a nullptr if it does not exist. section inline const Section *section() const value inline virtual uint64_t value() const override This member has slightly different interpretations: In relocatable files, value holds alignment constraints for a symbol for which section index is SHN_COMMON In relocatable files, value holds a section offset for a defined symbol. That is, value is an offset from the beginning of the section associated with this symbol. In executable and shared object files, value holds a virtual address. To make these files’ symbols more useful for the dynamic linker, the section offset (file interpretation) gives way to a virtual address (memory interpretation) for which the section number is irrelevant. size inline virtual uint64_t size() const override Symbol size. Many symbols have associated sizes. For example, a data object’s size is the number of bytes contained in the object. This member holds 0 if the symbol has no size or an unknown size. shndx inline uint16_t shndx() const See also Symbol::section_idx has_version inline bool has_version() const Check if this symbols has a symbol version . symbol_version inline SymbolVersion *symbol_version() Return the SymbolVersion associated with this symbol. If there is no symbol version, return a nullptr. symbol_version inline const SymbolVersion *symbol_version() const is_local inline bool is_local() const is_global inline bool is_global() const is_weak inline bool is_weak() const demangled_name std::string demangled_name() const Symbol ’s unmangled name. If not available, it returns an empty string. type inline void type( TYPE type) binding inline void binding( BINDING binding) other inline void other(uint8_t other) visibility inline void visibility( VISIBILITY visibility) information void information(uint8_t info) shndx inline void shndx(uint16_t idx) value inline virtual void value(uint64_t value) override size inline virtual void size(uint64_t size) override is_exported bool is_exported() const Check if the current symbol is exported. set_exported void set_exported(bool flag = true) Set whether or not the symbol is exported. is_imported bool is_imported() const Check if the current symbol is imported. set_imported void set_imported(bool flag = true) Set whether or not the symbol is imported. is_static inline bool is_static() const True if the symbol is a static one. is_function inline bool is_function() const True if the symbol represents a function. is_variable inline bool is_variable() const True if the symbol represents a variable. accept virtual void accept(Visitor &visitor) const override Public Static Functions binding_from static inline BINDING binding_from(uint32_t value, ARCH ) type_from static inline TYPE type_from(uint32_t value, ARCH ) to_value static inline uint8_t to_value( BINDING binding) to_value static inline uint8_t to_value( TYPE type) Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Symbol &entry) Symbol Version SymbolVersion class SymbolVersion : public LIEF::Object Class which represents an entry defined in the DT_VERSYM dynamic entry. Public Functions SymbolVersion inline SymbolVersion(uint16_t value) SymbolVersion SymbolVersion() = default ~SymbolVersion ~SymbolVersion() override = default operator= SymbolVersion &operator=(const SymbolVersion &) = default SymbolVersion SymbolVersion(const SymbolVersion &) = default value inline uint16_t value() const Value associated with the symbol. If the given SymbolVersion hasn’t Auxiliary version: 0 means Local 1 means Global has_auxiliary_version inline bool has_auxiliary_version() const Whether the current SymbolVersion has an auxiliary one. symbol_version_auxiliary inline SymbolVersionAux *symbol_version_auxiliary() SymbolVersionAux associated with the current Version if any, or a nullptr. symbol_version_auxiliary inline const SymbolVersionAux *symbol_version_auxiliary() const symbol_version_auxiliary void symbol_version_auxiliary( SymbolVersionAuxRequirement &svauxr) Set the version’s auxiliary requirement The given SymbolVersionAuxRequirement must be an existing reference in the ELF::Binary . On can add a new SymbolVersionAuxRequirement by using SymbolVersionRequirement::add_aux_requirement drop_version inline void drop_version(uint16_t value) Drop the versioning requirement and replace the value (local/global). as_global inline void as_global() Redefine this version as global by dropping its auxiliary version. See also as_local() drop_version() as_local inline void as_local() Redefine this version as local by dropping its auxiliary version. See also as_global() drop_version() value inline void value(uint16_t v) accept virtual void accept(Visitor &visitor) const override Public Static Functions local static inline SymbolVersion local() Generate a local SymbolVersion . global static inline SymbolVersion global() Generate a global SymbolVersion . Public Static Attributes LOCAL_VERSION static auto LOCAL_VERSION = 0 GLOBAL_VERSION static auto GLOBAL_VERSION = 1 Friends operator<< friend std::ostream &operator<<(std::ostream &os, const SymbolVersion &symv) Symbol Version Auxiliary SymbolVersionAux class SymbolVersionAux : public LIEF::Object Class which represents an Auxiliary Symbol version. Subclassed by LIEF::ELF::SymbolVersionAuxRequirement Public Functions SymbolVersionAux inline SymbolVersionAux(std::string name) SymbolVersionAux SymbolVersionAux() = default ~SymbolVersionAux ~SymbolVersionAux() override = default operator= SymbolVersionAux &operator=(const SymbolVersionAux &) = default SymbolVersionAux SymbolVersionAux(const SymbolVersionAux &) = default name inline std::string_view name() const Symbol ’s aux name (e.g. GLIBC_2.2.5 ). name inline void name(std::string name) accept virtual void accept(Visitor &visitor) const override Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const SymbolVersionAux &aux) Symbol Version Definition SymbolVersionDefinition class SymbolVersionDefinition : public LIEF::Object Class which represents an entry defined in DT_VERDEF or .gnu.version_d . Public Types version_aux_t using version_aux_t = std::vector> it_version_aux using it_version_aux = ref_iterator < version_aux_t &, SymbolVersionAux *> it_const_version_aux using it_const_version_aux = const_ref_iterator Public Functions SymbolVersionDefinition SymbolVersionDefinition() = default SymbolVersionDefinition SymbolVersionDefinition(const details::Elf64_Verdef &header) SymbolVersionDefinition SymbolVersionDefinition(const details::Elf32_Verdef &header) ~SymbolVersionDefinition ~SymbolVersionDefinition() override operator= SymbolVersionDefinition &operator=( SymbolVersionDefinition other) SymbolVersionDefinition SymbolVersionDefinition(const SymbolVersionDefinition &other) swap void swap( SymbolVersionDefinition &other) version inline uint16_t version() const Version revision. This field should always have the value 1 . It will be changed if the versioning implementation has to be changed in an incompatible way. flags inline uint16_t flags() const Version information. ndx inline uint16_t ndx() const Version index. Numeric value used as an index in the LIEF::ELF::SymbolVersion table hash inline uint32_t hash() const Hash value of the symbol’s name (using ELF hash function). symbols_aux inline it_version_aux symbols_aux() SymbolVersionAux entries. symbols_aux inline it_const_version_aux symbols_aux() const version inline void version(uint16_t version) flags inline void flags(uint16_t flags) hash inline void hash(uint32_t hash) accept virtual void accept(Visitor &visitor) const override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const SymbolVersionDefinition &sym) Symbol Version Requirement SymbolVersionRequirement class SymbolVersionRequirement : public LIEF::Object Class which represents an entry in the DT_VERNEED or .gnu.version_r table. Public Types aux_requirement_t using aux_requirement_t = std::vector> it_aux_requirement using it_aux_requirement = ref_iterator < aux_requirement_t &, SymbolVersionAuxRequirement *> it_const_aux_requirement using it_const_aux_requirement = const_ref_iterator Public Functions SymbolVersionRequirement SymbolVersionRequirement() = default SymbolVersionRequirement SymbolVersionRequirement(const details::Elf64_Verneed &header) SymbolVersionRequirement SymbolVersionRequirement(const details::Elf32_Verneed &header) ~SymbolVersionRequirement ~SymbolVersionRequirement() override = default operator= SymbolVersionRequirement &operator=( SymbolVersionRequirement other) SymbolVersionRequirement SymbolVersionRequirement(const SymbolVersionRequirement &other) swap void swap( SymbolVersionRequirement &other) version inline uint16_t version() const Version revision. This field should always have the value 1 . It will be changed if the versioning implementation has to be changed in an incompatible way. cnt inline size_t cnt() const Number of auxiliary entries. auxiliary_symbols inline it_aux_requirement auxiliary_symbols() Auxiliary entries as an iterator over SymbolVersionAuxRequirement . auxiliary_symbols inline it_const_aux_requirement auxiliary_symbols() const name inline std::string_view name() const Return the library name associated with this requirement (e.g. libc.so.6 ). version inline void version(uint16_t version) name inline void name(const std::string &name) add_aux_requirement SymbolVersionAuxRequirement &add_aux_requirement(const SymbolVersionAuxRequirement &aux_requirement) Add a version auxiliary requirement to the existing list. find_aux const SymbolVersionAuxRequirement *find_aux(const std::string &name) const Try to find the SymbolVersionAuxRequirement with the given name (e.g. GLIBC_2.27 ). find_aux inline SymbolVersionAuxRequirement *find_aux(const std::string &name) remove_aux_requirement inline bool remove_aux_requirement(const std::string &name) Try to remove the auxiliary requirement symbol with the given name. The function returns true if the operation succeed, false otherwise. Warning this function invalidates all the references (pointers) of SymbolVersionAuxRequirement . Therefore, the user is responsible to ensure that the auxiliary requirement is no longer used in the ELF binary (e.g. in SymbolVersion ) remove_aux_requirement bool remove_aux_requirement( SymbolVersionAuxRequirement &aux) Try to remove the given auxiliary requirement symbol. The function returns true if the operation succeed, false otherwise. Warning this function invalidates all the references (pointers) of SymbolVersionAuxRequirement . Therefore, the user is responsible to ensure that the auxiliary requirement is no longer used in the ELF binary (e.g. in SymbolVersion ) accept virtual void accept(Visitor &visitor) const override Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const SymbolVersionRequirement &symr) Symbol Version Auxiliary Requirement SymbolVersionAuxRequirement class SymbolVersionAuxRequirement : public LIEF::ELF:: SymbolVersionAux Public Functions SymbolVersionAuxRequirement SymbolVersionAuxRequirement(const details::Elf64_Vernaux &header) SymbolVersionAuxRequirement SymbolVersionAuxRequirement(const details::Elf32_Vernaux &header) SymbolVersionAuxRequirement SymbolVersionAuxRequirement() = default operator= SymbolVersionAuxRequirement &operator=(const SymbolVersionAuxRequirement &) = default SymbolVersionAuxRequirement SymbolVersionAuxRequirement(const SymbolVersionAuxRequirement &) = default ~SymbolVersionAuxRequirement ~SymbolVersionAuxRequirement() override = default hash inline uint32_t hash() const Hash value of the dependency name (use ELF hashing function). flags inline uint16_t flags() const Bitmask of flags. other inline uint16_t other() const It returns the unique version index for the file which is used in the version symbol table. If the highest bit (bit 15) is set this is a hidden symbol which cannot be referenced from outside the object. hash inline void hash(uint32_t hash) flags inline void flags(uint16_t flags) other inline void other(uint16_t other) accept virtual void accept(Visitor &visitor) const override name inline std::string_view name() const Symbol ’s aux name (e.g. GLIBC_2.2.5 ). name inline void name(std::string name) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const SymbolVersionAuxRequirement &aux) GNU Hash table GnuHash class GnuHash : public LIEF::Object Class which provides a view over the GNU Hash implementation. Most of the fields are read-only since the values are re-computed by the LIEF::ELF::Builder . Public Functions GnuHash GnuHash() = default GnuHash inline GnuHash(uint32_t symbol_idx, uint32_t shift2, std::vector bloom_filters, std::vector buckets, std::vector hash_values = {}) operator= GnuHash &operator=(const GnuHash ©) = default GnuHash GnuHash(const GnuHash ©) = default GnuHash GnuHash( GnuHash &&) = default operator= GnuHash &operator=( GnuHash &&) = default ~GnuHash ~GnuHash() override = default nb_buckets inline uint32_t nb_buckets() const Return the number of buckets. See also GnuHash::buckets symbol_index inline uint32_t symbol_index() const Index of the first symbol in the dynamic symbols table which is accessible with the hash table. shift2 inline uint32_t shift2() const Shift count used in the bloom filter. maskwords inline uint32_t maskwords() const Number of bloom filters used. It must be a power of 2. bloom_filters inline const std::vector &bloom_filters() const Bloom filters. buckets inline const std::vector &buckets() const Hash buckets. hash_values inline const std::vector &hash_values() const Hash values. check_bloom_filter bool check_bloom_filter(uint32_t hash) const Check if the given hash passes the bloom filter. check_bucket inline bool check_bucket(uint32_t hash) const Check if the given hash passes the bucket filter. check bool check(const std::string &symbol_name) const Check if the symbol probably exists. If the returned value is false you can assume at 100% that the symbol with the given name doesn’t exist. If true , you can’t do any assumption. check bool check(uint32_t hash) const Check if the symbol associated with the given hash probably exists. If the returned value is false you can assume at 100% that the symbol doesn’t exist. If true you can’t do any assumption. accept virtual void accept(Visitor &visitor) const override original_size inline uint64_t original_size() const Public Static Functions ELF_Tparse template static std::unique_ptr< GnuHash > parse( SpanStream &strm, uint64_t dynsymcount) ELF_Tnb_symbols template static result nb_symbols( SpanStream &strm) Friends operator<< friend std::ostream &operator<<(std::ostream &os, const GnuHash &gnuhash) SYSV Hash table SysvHash class SysvHash : public LIEF::Object Class which represents the SYSV hash for the symbols resolution. References: http://www.linker-aliens.org/blogs/ali/entry/gnu_hash_elf_sections/ https://docs.oracle.com/cd/E23824_01/html/819-0690/chapter6-48031.html Public Functions SysvHash SysvHash() = default operator= SysvHash &operator=(const SysvHash ©) = default SysvHash SysvHash(const SysvHash ©) = default operator= SysvHash &operator=( SysvHash &&) = default SysvHash SysvHash( SysvHash &&) = default ~SysvHash ~SysvHash() override = default nbucket inline uint32_t nbucket() const Return the number of buckets used. nchain inline uint32_t nchain() const Return the number of chain used. buckets inline const std::vector &buckets() const Buckets values. chains inline const std::vector &chains() const Chains values. nchain inline void nchain(uint32_t nb) accept virtual void accept(Visitor &visitor) const override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const SysvHash &sysvhash) Note Note class Note : public LIEF::Object Class which represents an ELF note. This class can be instantiated using the static Note::create functions. Subclassed by LIEF::ELF::AndroidIdent , LIEF::ELF::CoreAuxv , LIEF::ELF::CoreFile , LIEF::ELF::CorePrPsInfo , LIEF::ELF::CorePrStatus , LIEF::ELF::CoreSigInfo , LIEF::ELF::NoteAbi , LIEF::ELF::NoteGnuProperty , LIEF::ELF::QNXStack Public Types TYPE enum class TYPE LIEF representation of the ELF NT_ values. Values: UNKNOWN enumerator UNKNOWN = 0 GNU_ABI_TAG enumerator GNU_ABI_TAG Match NT_GNU_ABI_TAG : Operating system (OS) ABI information. See: NoteAbi GNU_HWCAP enumerator GNU_HWCAP Match NT_HWCAP : Synthetic hardware capabilities information. GNU_BUILD_ID enumerator GNU_BUILD_ID Match NT_GNU_BUILD_ID : Unique build ID as generated by the GNU ld. GNU_GOLD_VERSION enumerator GNU_GOLD_VERSION Match NT_GNU_GOLD_VERSION : The version of gold used to link. GNU_PROPERTY_TYPE_0 enumerator GNU_PROPERTY_TYPE_0 Match NT_GNU_PROPERTY_TYPE_0 : Program property note, as described in “Linux Extensions to the gABI”. GNU_BUILD_ATTRIBUTE_OPEN enumerator GNU_BUILD_ATTRIBUTE_OPEN GNU_BUILD_ATTRIBUTE_FUNC enumerator GNU_BUILD_ATTRIBUTE_FUNC CRASHPAD enumerator CRASHPAD Crashpad note used by the Chromium project. CORE_PRSTATUS enumerator CORE_PRSTATUS Coredump that wraps the elf_prstatus structure. CORE_FPREGSET enumerator CORE_FPREGSET CORE_PRPSINFO enumerator CORE_PRPSINFO Coredump that wraps the elf_prpsinfo structure. See: CorePrPsInfo CORE_TASKSTRUCT enumerator CORE_TASKSTRUCT CORE_AUXV enumerator CORE_AUXV Coredump that contains a copy of all the auxiliary vectors (auxv). See: CoreAuxv CORE_PSTATUS enumerator CORE_PSTATUS CORE_FPREGS enumerator CORE_FPREGS Coredump that wraps the fpregset structure. CORE_PSINFO enumerator CORE_PSINFO Coredump that wraps the psinfo structure. CORE_LWPSTATUS enumerator CORE_LWPSTATUS CORE_LWPSINFO enumerator CORE_LWPSINFO CORE_WIN32PSTATUS enumerator CORE_WIN32PSTATUS CORE_FILE enumerator CORE_FILE CORE_PRXFPREG enumerator CORE_PRXFPREG CORE_SIGINFO enumerator CORE_SIGINFO CORE_ARM_VFP enumerator CORE_ARM_VFP CORE_ARM_TLS enumerator CORE_ARM_TLS CORE_ARM_HW_BREAK enumerator CORE_ARM_HW_BREAK CORE_ARM_HW_WATCH enumerator CORE_ARM_HW_WATCH CORE_ARM_SYSTEM_CALL enumerator CORE_ARM_SYSTEM_CALL CORE_ARM_SVE enumerator CORE_ARM_SVE CORE_ARM_PAC_MASK enumerator CORE_ARM_PAC_MASK CORE_ARM_PACA_KEYS enumerator CORE_ARM_PACA_KEYS CORE_ARM_PACG_KEYS enumerator CORE_ARM_PACG_KEYS CORE_TAGGED_ADDR_CTRL enumerator CORE_TAGGED_ADDR_CTRL CORE_PAC_ENABLED_KEYS enumerator CORE_PAC_ENABLED_KEYS CORE_X86_TLS enumerator CORE_X86_TLS CORE_X86_IOPERM enumerator CORE_X86_IOPERM CORE_X86_XSTATE enumerator CORE_X86_XSTATE CORE_X86_CET enumerator CORE_X86_CET ANDROID_IDENT enumerator ANDROID_IDENT Note that is specific to Android and that describes information such as the NDK version or the SDK build number. See AndroidIdent ANDROID_MEMTAG enumerator ANDROID_MEMTAG ANDROID_KUSER enumerator ANDROID_KUSER GO_BUILDID enumerator GO_BUILDID Note specific to Go binaries. STAPSDT enumerator STAPSDT Note for SystemTap probes. QNX_STACK enumerator QNX_STACK QNX Note . description_t using description_t = std::vector Container used to handle the description data. Public Functions operator= Note &operator=(const Note ©) = default Note Note(const Note ©) = default ~Note ~Note() override = default clone inline virtual std::unique_ptr< Note > clone() const Clone the current note and keep its polymorphic type. name inline std::string_view name() const Return the name of the note (also known as ‘owner’ ). section_name inline std::string_view section_name() const Return the section name in which the note is or should be stored. type inline TYPE type() const Return the type of the note. This type does not match the NT_ type value. For accessing the original NT_ value, check original_type() . original_type inline uint32_t original_type() const The original NT_xxx integer value. The meaning of this value likely depends on the owner of the note. description inline span description() const Return the description associated with the note. description inline span description() name inline void name(std::string name) description inline void description( description_t description) Change the description of the note. size uint64_t size() const Size of the raw note which includes padding. dump virtual void dump(std::ostream &os) const accept virtual void accept(Visitor &visitor) const override Tcast template inline const T *cast() const Tcast template inline T *cast() Public Static Functions convert_type static result < TYPE > convert_type( Header :: FILE_TYPE ftype, uint32_t type, const std::string &name) Convert the raw integer note type into a TYPE according to the owner. type_to_section static result type_to_section( TYPE type) Try to determine the ELF section name associated with the TYPE provided in parameter. note_to_section static inline result note_to_section(const Note ¬e) type_owner static result type_owner( TYPE type) Try to determine the owner’s name of the TYPE provided in parameter. create static std::unique_ptr< Note > create(const std::string &name, uint32_t type, description_t description, std::string section_name, Header :: FILE_TYPE ftype = Header :: FILE_TYPE :: NONE , ARCH arch = ARCH :: NONE , Header :: CLASS cls = Header :: CLASS :: NONE ) Create a new note from the given parameters. Additional information such as the architecture or the ELF class could be required for creating notes like Coredump notes. create static std::unique_ptr< Note > create(const std::string &name, TYPE type, description_t description, std::string section_name, ARCH arch = ARCH :: NONE , Header :: CLASS cls = Header :: CLASS :: NONE ) Create a new note from the given parameters. Additional information such as the architecture or the ELF class could be required for creating notes like Coredump notes. create static std::unique_ptr< Note > create( BinaryStream &stream, std::string section_name, Header :: FILE_TYPE ftype = Header :: FILE_TYPE :: NONE , ARCH arch = ARCH :: NONE , Header :: CLASS cls = Header :: CLASS :: NONE ) Create a new note from the given stream. Additional information such as the architecture or the ELF class could be required for creating notes like Coredump notes. Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Note ¬e) Core PrPsInfo CorePrPsInfo class CorePrPsInfo : public LIEF::ELF:: Note Class representing the NT_PRPSINFO core note. This kind of note represents general information about the process. Public Functions CorePrPsInfo inline CorePrPsInfo( ARCH arch, Header :: CLASS cls, std::string name, uint32_t type, description_t description) clone inline virtual std::unique_ptr< Note > clone() const override Clone the current note and keep its polymorphic type. info result < info_t > info() const Return a elf_prpsinfo -like structure or an error if it can’t be parsed. info void info(const info_t &info) dump virtual void dump(std::ostream &os) const override accept virtual void accept(Visitor &visitor) const override ~CorePrPsInfo ~CorePrPsInfo() override = default Public Static Functions classof static inline bool classof(const Note *note) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const CorePrPsInfo ¬e) info_t struct info_t Public Functions filename_stripped inline std::string filename_stripped() const Return the filename without the ending \\x00 . args_stripped inline std::string args_stripped() const Return the args without the ending \\x00 . Public Members state uint8_t state = 0 Numeric process state. sname char sname = ' ' Printable character representing state. zombie bool zombie = false Whether the process is a zombie. nice uint8_t nice = 0 Nice value. flag uint64_t flag = 0 Process flag. uid uint32_t uid = 0 Process user ID. gid uint32_t gid = 0 Process group ID. pid uint32_t pid = 0 Process ID. ppid uint32_t ppid = 0 Process parent ID. pgrp uint32_t pgrp = 0 Process group. sid uint32_t sid = 0 Process session ID. filename std::string filename Filename of the executable. args std::string args Initial part of the arguments. Core File CoreFile class CoreFile : public LIEF::ELF:: Note Class representing a core NT_FILE which describes the mapped files of the process. Public Types files_t using files_t = std::vector< entry_t > iterator using iterator = files_t ::iterator const_iterator using const_iterator = files_t ::const_iterator Public Functions CoreFile CoreFile( ARCH arch, Header :: CLASS cls, std::string name, uint32_t type, Note :: description_t description) clone inline virtual std::unique_ptr< Note > clone() const override Clone the current note and keep its polymorphic type. count inline uint64_t count() const Number of coredump file entries. files inline const files_t &files() const Coredump file entries. begin inline iterator begin() end inline iterator end() begin inline const_iterator begin() const end inline const_iterator end() const files void files(const files_t &file) dump virtual void dump(std::ostream &os) const override accept virtual void accept(Visitor &visitor) const override ~CoreFile ~CoreFile() override = default Public Static Functions classof static inline bool classof(const Note *note) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const CoreFile ¬e) entry_t struct entry_t Core file entry. Public Members start uint64_t start = 0 Start address of mapped file. end uint64_t end = 0 End address of mapped file. file_ofs uint64_t file_ofs = 0 Offset (in core) of mapped file. path std::string path Path of mapped file. Friends operator<< friend std::ostream &operator<<(std::ostream &os, const entry_t &entry) Core PrStatus CorePrStatus class CorePrStatus : public LIEF::ELF:: Note Class representing core PrPsInfo object. Public Functions CorePrStatus inline CorePrStatus( ARCH arch, Header :: CLASS cls, std::string name, uint32_t type, description_t description) clone inline virtual std::unique_ptr< Note > clone() const override Clone the current note and keep its polymorphic type. status pr_status_t status() const Return the pr_status_t structure. status void status(const pr_status_t &status) architecture inline ARCH architecture() const pc result pc() const The program counter or an error if not found. sp result sp() const The stack pointer or an error if not found. return_value result return_value() const The value of the register that holds the return value according to the calling convention. get result get( Registers :: X86 reg) const Get the value for the given X86 register or return an error. get result get( Registers :: X86_64 reg) const Get the value for the given X86_64 register or return an error. get result get( Registers :: ARM reg) const Get the value for the given ARM register or return an error. get result get( Registers :: AARCH64 reg) const Get the value for the given AARCH64 register or return an error. set ok_error_t set( Registers :: X86 reg, uint64_t value) set ok_error_t set( Registers :: X86_64 reg, uint64_t value) set ok_error_t set( Registers :: ARM reg, uint64_t value) set ok_error_t set( Registers :: AARCH64 reg, uint64_t value) register_values std::vector register_values() const A list of the register values. This list is guarantee to be as long as the Registers::ARM::_COUNT or empty if it can’t be resolved. Thus, one can access a specific register with: if (architecture() == ARCH::AARCH64) { auto reg_vals = register_values() if (!reg_vals.empty()) { auto x20 = reg_vals[static_cast(Register::AARCH64::X20)] } } operator[] inline result operator[]( Registers :: X86 reg) const operator[] inline result operator[]( Registers :: X86_64 reg) const operator[] inline result operator[]( Registers :: ARM reg) const operator[] inline result operator[]( Registers :: AARCH64 reg) const dump virtual void dump(std::ostream &os) const override accept virtual void accept(Visitor &visitor) const override ~CorePrStatus ~CorePrStatus() override = default Public Static Functions classof static inline bool classof(const Note *note) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const CorePrStatus ¬e) siginfo_t struct siginfo_t Public Members signo int32_t signo = 0 code int32_t code = 0 err int32_t err = 0 timeval_t struct timeval_t Public Members sec uint64_t sec = 0 usec uint64_t usec = 0 pr_status_t struct pr_status_t Status information from a core dump. This structure mirrors the kernel’s prstatus data embedded in NT_PRSTATUS core-dump notes and exposes signal state, process identifiers, and CPU-time accounting. Public Members info siginfo_t info cursig uint16_t cursig = 0 reserved uint16_t reserved = 0 sigpend uint64_t sigpend = 0 sighold uint64_t sighold = 0 pid int32_t pid = 0 ppid int32_t ppid = 0 pgrp int32_t pgrp = 0 sid int32_t sid = 0 utime timeval_t utime stime timeval_t stime cutime timeval_t cutime cstime timeval_t cstime Registers struct Registers Public Types X86 enum class X86 Register for the x86 architecture ( ARCH::I386 ). Values: EBX enumerator EBX = 0 ECX enumerator ECX EDX enumerator EDX ESI enumerator ESI EDI enumerator EDI EBP enumerator EBP EAX enumerator EAX DS enumerator DS ES enumerator ES FS enumerator FS GS enumerator GS ORIG_EAX enumerator ORIG_EAX EIP enumerator EIP CS enumerator CS EFLAGS enumerator EFLAGS ESP enumerator ESP SS enumerator SS _COUNT enumerator _COUNT X86_64 enum class X86_64 Register for the x86-64 architecture ( ARCH::X86_64 ). Values: R15 enumerator R15 = 0 R14 enumerator R14 R13 enumerator R13 R12 enumerator R12 RBP enumerator RBP RBX enumerator RBX R11 enumerator R11 R10 enumerator R10 R9 enumerator R9 R8 enumerator R8 RAX enumerator RAX RCX enumerator RCX RDX enumerator RDX RSI enumerator RSI RDI enumerator RDI ORIG_RAX enumerator ORIG_RAX RIP enumerator RIP CS enumerator CS EFLAGS enumerator EFLAGS RSP enumerator RSP SS enumerator SS FS_BASE enumerator FS_BASE GS_BASE enumerator GS_BASE DS enumerator DS ES enumerator ES _COUNT enumerator _COUNT ARM enum class ARM Register for the ARM architecture ( ARCH::ARM ). Values: R0 enumerator R0 = 0 R1 enumerator R1 R2 enumerator R2 R3 enumerator R3 R4 enumerator R4 R5 enumerator R5 R6 enumerator R6 R7 enumerator R7 R8 enumerator R8 R9 enumerator R9 R10 enumerator R10 R11 enumerator R11 R12 enumerator R12 R13 enumerator R13 R14 enumerator R14 R15 enumerator R15 CPSR enumerator CPSR _COUNT enumerator _COUNT AARCH64 enum class AARCH64 Register for the AARCH64 architecture ( ARCH::AARCH64 ). Values: X0 enumerator X0 = 0 X1 enumerator X1 X2 enumerator X2 X3 enumerator X3 X4 enumerator X4 X5 enumerator X5 X6 enumerator X6 X7 enumerator X7 X8 enumerator X8 X9 enumerator X9 X10 enumerator X10 X11 enumerator X11 X12 enumerator X12 X13 enumerator X13 X14 enumerator X14 X15 enumerator X15 X16 enumerator X16 X17 enumerator X17 X18 enumerator X18 X19 enumerator X19 X20 enumerator X20 X21 enumerator X21 X22 enumerator X22 X23 enumerator X23 X24 enumerator X24 X25 enumerator X25 X26 enumerator X26 X27 enumerator X27 X28 enumerator X28 X29 enumerator X29 X30 enumerator X30 X31 enumerator X31 PC enumerator PC PSTATE enumerator PSTATE _COUNT enumerator _COUNT Core Siginfo CoreSigInfo class CoreSigInfo : public LIEF::ELF:: Note Class representing a core siginfo object. Public Functions clone inline virtual std::unique_ptr< Note > clone() const override Clone the current note and keep its polymorphic type. signo result signo() const Signal number or an error if it can’t be resolved. sigcode result sigcode() const Signal code or an error if it can’t be resolved. sigerrno result sigerrno() const Signal error number or an error if it can’t be resolved. signo void signo(uint32_t value) sigcode void sigcode(uint32_t value) sigerrno void sigerrno(uint32_t value) dump virtual void dump(std::ostream &os) const override accept virtual void accept(Visitor &visitor) const override ~CoreSigInfo ~CoreSigInfo() override = default Public Static Functions classof static inline bool classof(const Note *note) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const CoreSigInfo ¬e) Core Auxiliary Vector CoreAuxv class CoreAuxv : public LIEF::ELF:: Note Class representing core auxv object. Public Types TYPE enum class TYPE Values: END enumerator END = 0 End of vector IGNORE_TY enumerator IGNORE_TY Entry should be ignored EXECFD enumerator EXECFD File descriptor of program PHDR enumerator PHDR Program headers for program PHENT enumerator PHENT Size of program header entry PHNUM enumerator PHNUM Number of program headers PAGESZ enumerator PAGESZ System page size BASE enumerator BASE Base address of interpreter FLAGS enumerator FLAGS Flags ENTRY enumerator ENTRY Entry point of program NOTELF enumerator NOTELF Program is not ELF UID enumerator UID Real uid EUID enumerator EUID Effective uid GID enumerator GID Real gid EGID enumerator EGID Effective gid TGT_PLATFORM enumerator TGT_PLATFORM String identifying platform. HWCAP enumerator HWCAP Machine dependent hints about processor capabilities. CLKTCK enumerator CLKTCK Frequency of times() FPUCW enumerator FPUCW Used FPU control word. DCACHEBSIZE enumerator DCACHEBSIZE Data cache block size. ICACHEBSIZE enumerator ICACHEBSIZE Instruction cache block size. UCACHEBSIZE enumerator UCACHEBSIZE Unified cache block size. IGNOREPPC enumerator IGNOREPPC Entry should be ignored. SECURE enumerator SECURE Boolean, was exec setuid-like?. BASE_PLATFORM enumerator BASE_PLATFORM String identifying real platform RANDOM enumerator RANDOM Address of 16 random bytes HWCAP2 enumerator HWCAP2 Extension of AT_HWCAP EXECFN enumerator EXECFN = 31 Filename of executable SYSINFO enumerator SYSINFO Filename of executable SYSINFO_EHDR enumerator SYSINFO_EHDR Pointer to ELF header of system-supplied DSO. Public Functions CoreAuxv inline CoreAuxv( ARCH arch, Header :: CLASS cls, std::string name, uint32_t type, description_t description) clone inline virtual std::unique_ptr< Note > clone() const override Clone the current note and keep its polymorphic type. values std::map< TYPE , uint64_t> values() const A map of CoreAuxv::TYPE and the value. get result get( TYPE type) const Return the value associated with the provided TYPE or a lief_errors::not_found if the type is not present. operator[] inline result operator[]( TYPE type) const set bool set( TYPE type, uint64_t value) set bool set(const std::map< TYPE , uint64_t> &values) dump virtual void dump(std::ostream &os) const override accept virtual void accept(Visitor &visitor) const override ~CoreAuxv ~CoreAuxv() override = default Public Static Functions classof static inline bool classof(const Note *note) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const CoreAuxv ¬e) Android Identity AndroidIdent class AndroidIdent : public LIEF::ELF:: Note Class representing the “.note.android.ident” section. See also https://android.googlesource.com/platform/ndk/+/ndk-release-r16/sources/crt/crtbrand.S#39 Public Functions clone inline virtual std::unique_ptr< Note > clone() const override Clone the current note and keep its polymorphic type. sdk_version uint32_t sdk_version() const Target SDK version (or 0 if it can’t be resolved). ndk_version std::string ndk_version() const NDK version used (or an empty string if it can’t be parsed). ndk_build_number std::string ndk_build_number() const NDK build number (or an empty string if it can’t be parsed). sdk_version void sdk_version(uint32_t version) ndk_version void ndk_version(const std::string &ndk_version) ndk_build_number void ndk_build_number(const std::string &ndk_build_number) dump virtual void dump(std::ostream &os) const override accept virtual void accept(Visitor &visitor) const override ~AndroidIdent ~AndroidIdent() override = default Public Static Functions classof static inline bool classof(const Note *note) description_size static inline size_t description_size() Public Static Attributes sdk_version_size static size_t sdk_version_size = sizeof(uint32_t) ndk_version_size static size_t ndk_version_size = 64 * sizeof(char) ndk_build_number_size static size_t ndk_build_number_size = 64 * sizeof(char) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const AndroidIdent ¬e) QNX Stack QNXStack class QNXStack : public LIEF::ELF:: Note Class representing the QNX QNT_STACK note. Public Functions clone inline virtual std::unique_ptr< Note > clone() const override Clone the current note and keep its polymorphic type. stack_size uint32_t stack_size() const Size of the stack. stack_allocated uint32_t stack_allocated() const Size of the stack pre-allocated (upfront). is_executable bool is_executable() const Whether the stack is executable. stack_size void stack_size(uint32_t value) stack_allocated void stack_allocated(uint32_t value) set_is_executable void set_is_executable(bool value) dump virtual void dump(std::ostream &os) const override accept virtual void accept(Visitor &visitor) const override ~QNXStack ~QNXStack() override = default Public Static Functions classof static inline bool classof(const Note *note) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const QNXStack ¬e) Note ABI NoteAbi class NoteAbi : public LIEF::ELF:: Note Class that wraps the NT_GNU_ABI_TAG note. Public Types ABI enum class ABI ABI recognized by this note. Values: LINUX enumerator LINUX = 0 GNU enumerator GNU SOLARIS2 enumerator SOLARIS2 FREEBSD enumerator FREEBSD NETBSD enumerator NETBSD SYLLABLE enumerator SYLLABLE NACL enumerator NACL version_t using version_t = std::array Version type: (Major, Minor, Patch). Public Functions clone inline virtual std::unique_ptr< Note > clone() const override Clone the current note and keep its polymorphic type. version result < version_t > version() const Return the version or an error if it can’t be parsed. abi result < ABI > abi() const Return the ABI or an error if it can’t be parsed. version void version(const version_t &version) version void version( ABI abi) dump virtual void dump(std::ostream &os) const override accept virtual void accept(Visitor &visitor) const override ~NoteAbi ~NoteAbi() override = default Note Note(const Note ©) = default Public Static Functions classof static inline bool classof(const Note *note) description_size static inline uint8_t description_size() Size of the description content. Public Static Attributes abi_offset static size_t abi_offset = 0 abi_size static size_t abi_size = sizeof(uint32_t) version_offset static size_t version_offset = abi_size version_size static size_t version_size = 3 * sizeof(uint32_t) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const NoteAbi ¬e) Note Gnu Property NoteGnuProperty class NoteGnuProperty : public LIEF::ELF:: Note Class that wraps the NT_GNU_PROPERTY_TYPE_0 note. Public Types properties_t using properties_t = std::vector> Public Functions NoteGnuProperty inline NoteGnuProperty( ARCH arch, Header :: CLASS cls, std::string name, uint32_t type, description_t description, std::string secname) clone inline virtual std::unique_ptr< Note > clone() const override Clone the current note and keep its polymorphic type. find std::unique_ptr< NoteGnuProperty :: Property > find( Property :: TYPE type) const Find the property with the given type or return a nullptr . properties properties_t properties() const Return the properties as a list of Property . dump virtual void dump(std::ostream &os) const override accept virtual void accept(Visitor &visitor) const override ~NoteGnuProperty ~NoteGnuProperty() override = default Public Static Functions classof static inline bool classof(const Note *note) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const NoteGnuProperty ¬e) Property class Property This class wraps the different properties that can be used in a NT_GNU_PROPERTY_TYPE_0 note. Subclassed by LIEF::ELF::AArch64Feature , LIEF::ELF::AArch64PAuth , LIEF::ELF::Generic , LIEF::ELF::Needed , LIEF::ELF::NoteNoCopyOnProtected , LIEF::ELF::StackSize , LIEF::ELF::X86Features , LIEF::ELF::X86ISA Public Types TYPE enum class TYPE LIEF’s mirror types of the original GNU_PROPERTY_ values. Values: UNKNOWN enumerator UNKNOWN = 0 GENERIC enumerator GENERIC Property that doesn’t have a special implementation. AARCH64_FEATURES enumerator AARCH64_FEATURES Mirror of GNU_PROPERTY_AARCH64_FEATURE_1_AND . AARCH64_PAUTH enumerator AARCH64_PAUTH Mirror of GNU_PROPERTY_AARCH64_FEATURE_PAUTH . STACK_SIZE enumerator STACK_SIZE Mirror of GNU_PROPERTY_STACK_SIZE . NO_COPY_ON_PROTECTED enumerator NO_COPY_ON_PROTECTED Mirror of GNU_PROPERTY_NO_COPY_ON_PROTECTED . X86_ISA enumerator X86_ISA Mirror of GNU_PROPERTY_X86_ISA_1_* and GNU_PROPERTY_X86_COMPAT_* . Mirror of GNU_PROPERTY_X86_FEATURE_* X86_FEATURE enumerator X86_FEATURE NEEDED enumerator NEEDED Public Functions Property Property() = delete type inline TYPE type() const Return the LIEF’s mirror type of the note. dump virtual void dump(std::ostream &os) const ~Property virtual ~Property() = default Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Property &prop) Generic Generic class Generic : public LIEF::ELF:: NoteGnuProperty :: Property This class represents a property which doesn’t have a concrete LIEF implementation. Public Functions type inline uint32_t type() const The original raw type as an integer. This value might depends on the architecture and/or the file type. ~Generic ~Generic() override = default Public Static Functions classof static inline bool classof(const NoteGnuProperty :: Property *prop) create static inline std::unique_ptr< Generic > create(uint32_t raw_type) AArch64 Feature AArch64Feature class AArch64Feature : public LIEF::ELF:: NoteGnuProperty :: Property This class represents the GNU_PROPERTY_AARCH64_FEATURE_1_AND property. Public Types FEATURE enum class FEATURE Values: UNKNOWN enumerator UNKNOWN = 0 BTI enumerator BTI Support Branch Target Identification (BTI). PAC enumerator PAC Support Pointer authentication (PAC). GCS enumerator GCS Guarded Control Stack. Public Functions features inline const std::vector< FEATURE > &features() const Return the list of the supported features. dump virtual void dump(std::ostream &os) const override ~AArch64Feature ~AArch64Feature() override = default Public Static Functions classof static inline bool classof(const NoteGnuProperty :: Property *prop) create static std::unique_ptr< AArch64Feature > create( BinaryStream &stream) AArch64 PAuth AArch64PAuth class AArch64PAuth : public LIEF::ELF:: NoteGnuProperty :: Property This class represents the GNU_PROPERTY_AARCH64_FEATURE_PAUTH property. Note If both AArch64PAuth::platform and AArch64PAuth::version are set to 0, this means that the binary is incompatible with PAuth ABI extension. Public Functions platform inline uint64_t platform() const 64-bit value that specifies the platform vendor. A 0 value is associated with an invalid platform while the value 1 is associated with a baremetal platform. version inline uint64_t version() const 64-bit value that identifies the signing schema used by the ELF file. dump virtual void dump(std::ostream &os) const override ~AArch64PAuth ~AArch64PAuth() override = default Public Static Functions classof static inline bool classof(const NoteGnuProperty :: Property *prop) create static std::unique_ptr< AArch64PAuth > create( BinaryStream &stream) Needed Needed class Needed : public LIEF::ELF:: NoteGnuProperty :: Property This class represents the GNU_PROPERTY_1_NEEDED note property. This property provides information about additional features that the object file needs at runtime (e.g. indirect external access). Public Types NEED enum class NEED Values: UNKNOWN enumerator UNKNOWN = 0 INDIRECT_EXTERN_ACCESS enumerator INDIRECT_EXTERN_ACCESS The object needs indirect external access. Public Functions needs inline const std::vector< NEED > &needs() const Return the list of needed features. dump virtual void dump(std::ostream &os) const override ~Needed ~Needed() override = default Public Static Functions classof static inline bool classof(const NoteGnuProperty :: Property *prop) create static std::unique_ptr< Needed > create( BinaryStream &stream) No Copy on Protected NoteNoCopyOnProtected class NoteNoCopyOnProtected : public LIEF::ELF:: NoteGnuProperty :: Property This class provides an interface over the GNU_PROPERTY_NO_COPY_ON_PROTECTED property. This property indicates that the linker shouldn’t copy relocations against protected symbols. Public Functions ~NoteNoCopyOnProtected ~NoteNoCopyOnProtected() override = default Public Static Functions classof static inline bool classof(const NoteGnuProperty :: Property *prop) create static inline std::unique_ptr< NoteNoCopyOnProtected > create() Stack Size StackSize class StackSize : public LIEF::ELF:: NoteGnuProperty :: Property This class provides an interface over the GNU_PROPERTY_STACK_SIZE property. This property can be used by the loader to raise the stack limit. Public Functions stack_size inline uint64_t stack_size() const The indicated stack size. dump virtual void dump(std::ostream &os) const override ~StackSize ~StackSize() override = default Public Static Functions classof static inline bool classof(const NoteGnuProperty :: Property *prop) create static inline std::unique_ptr< StackSize > create(uint64_t stack_size) X86 Feature X86Features class X86Features : public LIEF::ELF:: NoteGnuProperty :: Property This class interfaces the different GNU_PROPERTY_X86_FEATURE_* properties which includes: GNU_PROPERTY_X86_FEATURE_1_AND GNU_PROPERTY_X86_FEATURE_2_USED GNU_PROPERTY_X86_FEATURE_2_NEEDED Public Types FLAG enum class FLAG Flag according to the _AND , _USED or _NEEDED suffixes. Values: NONE enumerator NONE = 0 For the original GNU_PROPERTY_X86_FEATURE_1_AND property. USED enumerator USED For the original GNU_PROPERTY_X86_FEATURE_2_USED property. NEEDED enumerator NEEDED For the original GNU_PROPERTY_X86_FEATURE_2_NEEDED property. FEATURE enum class FEATURE Features provided by these different properties. Values: UNKNOWN enumerator UNKNOWN = 0 IBT enumerator IBT SHSTK enumerator SHSTK LAM_U48 enumerator LAM_U48 LAM_U57 enumerator LAM_U57 X86 enumerator X86 X87 enumerator X87 MMX enumerator MMX XMM enumerator XMM YMM enumerator YMM ZMM enumerator ZMM FXSR enumerator FXSR XSAVE enumerator XSAVE XSAVEOPT enumerator XSAVEOPT XSAVEC enumerator XSAVEC TMM enumerator TMM MASK enumerator MASK features_t using features_t = std::vector> List of the features as a pair of FLAG , FEATURE . For instance, if the raw property is GNU_PROPERTY_X86_FEATURE_2_USED with a bitmask set to GNU_PROPERTY_X86_FEATURE_2_XSAVE , it generates the pair: FLAG::USED , FEATURE::XSAVE Public Functions features inline const features_t &features() const List of the features. dump virtual void dump(std::ostream &os) const override ~X86Features ~X86Features() override = default Public Static Functions classof static inline bool classof(const NoteGnuProperty :: Property *prop) create static std::unique_ptr< X86Features > create(uint32_t type, BinaryStream &stream) X86 ISA X86ISA class X86ISA : public LIEF::ELF:: NoteGnuProperty :: Property This class interfaces the different GNU_PROPERTY_X86_ISA_* properties which includes: GNU_PROPERTY_X86_ISA_1_USED GNU_PROPERTY_X86_ISA_1_NEEDED GNU_PROPERTY_X86_COMPAT_ISA_1_USED GNU_PROPERTY_X86_COMPAT_ISA_1_NEEDED GNU_PROPERTY_X86_COMPAT_2_ISA_1_USED GNU_PROPERTY_X86_COMPAT_2_ISA_1_NEEDED Public Types FLAG enum class FLAG Values: NONE enumerator NONE = 0 USED enumerator USED NEEDED enumerator NEEDED ISA enum class ISA Values: UNKNOWN enumerator UNKNOWN = 0 BASELINE enumerator BASELINE V2 enumerator V2 V3 enumerator V3 V4 enumerator V4 CMOV enumerator CMOV FMA enumerator FMA I486 enumerator I486 I586 enumerator I586 I686 enumerator I686 SSE enumerator SSE SSE2 enumerator SSE2 SSE3 enumerator SSE3 SSSE3 enumerator SSSE3 SSE4_1 enumerator SSE4_1 SSE4_2 enumerator SSE4_2 AVX enumerator AVX AVX2 enumerator AVX2 AVX512F enumerator AVX512F AVX512CD enumerator AVX512CD AVX512ER enumerator AVX512ER AVX512PF enumerator AVX512PF AVX512VL enumerator AVX512VL AVX512DQ enumerator AVX512DQ AVX512BW enumerator AVX512BW AVX512_4FMAPS enumerator AVX512_4FMAPS AVX512_4VNNIW enumerator AVX512_4VNNIW AVX512_BITALG enumerator AVX512_BITALG AVX512_IFMA enumerator AVX512_IFMA AVX512_VBMI enumerator AVX512_VBMI AVX512_VBMI2 enumerator AVX512_VBMI2 AVX512_VNNI enumerator AVX512_VNNI AVX512_BF16 enumerator AVX512_BF16 values_t using values_t = std::vector> Public Functions values inline const values_t &values() const List of the ISA values in this property. ~X86ISA ~X86ISA() override = default dump virtual void dump(std::ostream &os) const override Public Static Functions classof static inline bool classof(const NoteGnuProperty :: Property *prop) create static std::unique_ptr< X86ISA > create(uint32_t type, BinaryStream &stream) Builder Builder class Builder Class which takes an ELF::Binary object and reconstructs a valid binary. This interface assumes that the layout of input ELF binary is correct (i.e. the binary can run). Public Functions Builder Builder( Binary &binary, const config_t &config) Builder inline Builder( Binary &binary) Builder Builder() = delete ~Builder ~Builder() build void build() Perform the build of the provided ELF binary. config inline config_t &config() get_build const std::vector &get_build() Return the built ELF binary as a byte vector. write void write(const std::string &filename) const Write the built ELF binary in the filename given in parameter. write void write(std::ostream &os) const Write the built ELF binary in the stream os given in parameter. config_t struct config_t Configuration options to tweak the building process. Public Members dt_hash bool dt_hash = true Rebuild DT_HASH. dyn_str bool dyn_str = true Rebuild DT_STRTAB. dynamic_section bool dynamic_section = true Rebuild PT_DYNAMIC segment. fini_array bool fini_array = true Rebuild DT_FINI_ARRAY. gnu_hash bool gnu_hash = true Rebuild DT_GNU_HASH. init_array bool init_array = true Rebuild DT_INIT_ARRAY. interpreter bool interpreter = true Rebuild PT_INTERPRETER. jmprel bool jmprel = true Rebuild DT_JMPREL. notes bool notes = false Disable note building since it can break the default layout. preinit_array bool preinit_array = true Rebuild DT_PREINIT_ARRAY. relr bool relr = true Rebuild DT_RELR. android_rela bool android_rela = true Rebuild DT_ANDROID_REL[A]. rela bool rela = true Rebuild DT_REL[A]. static_symtab bool static_symtab = true Rebuild .symtab . sym_verdef bool sym_verdef = true Rebuild DT_VERDEF. sym_verneed bool sym_verneed = true Rebuild DT_VERNEED. sym_versym bool sym_versym = true Rebuild DT_VERSYM. symtab bool symtab = true Rebuild DT_SYMTAB. coredump_notes bool coredump_notes = true Rebuild the Coredump notes. force_relocate bool force_relocate = false Force to relocating all the ELF structures that are supported by LIEF (mostly for testing). skip_dynamic bool skip_dynamic = false Skip relocating the PT_DYNAMIC segment (only relevant if force_relocate is set. keep_empty_version_requirement bool keep_empty_version_requirement = false Remove entries in .gnu.version_r if they are not associated with at least one version. Utilities LIEF::ELF::check_layout bool LIEF::ELF::check_layout(const Binary &bin, std::string *error_info = nullptr) Check that the layout of the given Binary is correct. LIEF::ELF::is_elf bool LIEF::ELF::is_elf(std::string_view file) Check if the given file is an ELF one. LIEF::ELF::is_elf bool LIEF::ELF::is_elf(const std::vector &raw) Check if the raw data is an ELF file. Enums Architectures LIEF::ELF::ARCH enum class LIEF::ELF::ARCH Machine architectures See current registered ELF machine architectures at: http://www.sco.com/developers/gabi/latest/ch4.eheader.html Values: NONE enumerator NONE = 0 No machine M32 enumerator M32 = 1 AT&T WE 32100 SPARC enumerator SPARC = 2 SPARC I386 enumerator I386 = 3 Intel 386 M68K enumerator M68K = 4 Motorola 68000 M88K enumerator M88K = 5 Motorola 88000 IAMCU enumerator IAMCU = 6 Intel MCU I860 enumerator I860 = 7 Intel 80860 MIPS enumerator MIPS = 8 MIPS R3000 S370 enumerator S370 = 9 IBM System/370 MIPS_RS3_LE enumerator MIPS_RS3_LE = 10 MIPS RS3000 Little-endian PARISC enumerator PARISC = 15 Hewlett-Packard PA-RISC VPP500 enumerator VPP500 = 17 Fujitsu VPP500 SPARC32PLUS enumerator SPARC32PLUS = 18 Enhanced instruction set SPARC I60 enumerator I60 = 19 Intel 80960 PPC enumerator PPC = 20 PowerPC PPC64 enumerator PPC64 = 21 PowerPC64 S390 enumerator S390 = 22 IBM System/390 SPU enumerator SPU = 23 IBM SPU/SPC V800 enumerator V800 = 36 NEC V800 FR20 enumerator FR20 = 37 Fujitsu FR20 RH32 enumerator RH32 = 38 TRW RH-32 RCE enumerator RCE = 39 Motorola RCE ARM enumerator ARM = 40 ARM ALPHA enumerator ALPHA = 41 DEC Alpha SH enumerator SH = 42 Hitachi SH SPARCV9 enumerator SPARCV9 = 43 SPARC V9 TRICORE enumerator TRICORE = 44 Siemens TriCore ARC enumerator ARC = 45 Argonaut RISC Core H8_300 enumerator H8_300 = 46 Hitachi H8/300 H8_300H enumerator H8_300H = 47 Hitachi H8/300H H8S enumerator H8S = 48 Hitachi H8S H8_500 enumerator H8_500 = 49 Hitachi H8/500 IA_64 enumerator IA_64 = 50 Intel IA-64 processor architecture MIPS_X enumerator MIPS_X = 51 Stanford MIPS-X COLDFIRE enumerator COLDFIRE = 52 Motorola ColdFire M68HC12 enumerator M68HC12 = 53 Motorola M68HC12 MMA enumerator MMA = 54 Fujitsu MMA Multimedia Accelerator PCP enumerator PCP = 55 Siemens PCP NCPU enumerator NCPU = 56 Sony nCPU embedded RISC processor NDR1 enumerator NDR1 = 57 Denso NDR1 microprocessor STARCORE enumerator STARCORE = 58 Motorola Star*Core processor ME16 enumerator ME16 = 59 Toyota ME16 processor ST100 enumerator ST100 = 60 STMicroelectronics ST100 processor TINYJ enumerator TINYJ = 61 Advanced Logic Corp. TinyJ embedded processor family X86_64 enumerator X86_64 = 62 AMD x86-64 architecture PDSP enumerator PDSP = 63 Sony DSP Processor PDP10 enumerator PDP10 = 64 Digital Equipment Corp. PDP-10 PDP11 enumerator PDP11 = 65 Digital Equipment Corp. PDP-11 FX66 enumerator FX66 = 66 Siemens FX66 microcontroller ST9PLUS enumerator ST9PLUS = 67 STMicroelectronics ST9+ 8/16 bit microcontroller ST7 enumerator ST7 = 68 STMicroelectronics ST7 8-bit microcontroller M68HC16 enumerator M68HC16 = 69 Motorola MC68HC16 Microcontroller M68HC11 enumerator M68HC11 = 70 Motorola MC68HC11 Microcontroller M68HC08 enumerator M68HC08 = 71 Motorola MC68HC08 Microcontroller M68HC05 enumerator M68HC05 = 72 Motorola MC68HC05 Microcontroller SVX enumerator SVX = 73 Silicon Graphics SVx ST19 enumerator ST19 = 74 STMicroelectronics ST19 8-bit microcontroller VAX enumerator VAX = 75 Digital VAX CRIS enumerator CRIS = 76 Axis Communications 32-bit embedded processor JAVELIN enumerator JAVELIN = 77 Infineon Technologies 32-bit embedded processor FIREPATH enumerator FIREPATH = 78 Element 14 64-bit DSP Processor ZSP enumerator ZSP = 79 LSI Logic 16-bit DSP Processor MMIX enumerator MMIX = 80 Donald Knuth’s educational 64-bit processor HUANY enumerator HUANY = 81 Harvard University machine-independent object files PRISM enumerator PRISM = 82 SiTera Prism AVR enumerator AVR = 83 Atmel AVR 8-bit microcontroller FR30 enumerator FR30 = 84 Fujitsu FR30 D10V enumerator D10V = 85 Mitsubishi D10V D30V enumerator D30V = 86 Mitsubishi D30V V850 enumerator V850 = 87 NEC v850 M32R enumerator M32R = 88 Mitsubishi M32R MN10300 enumerator MN10300 = 89 Matsushita MN10300 MN10200 enumerator MN10200 = 90 Matsushita MN10200 PJ enumerator PJ = 91 picoJava OPENRISC enumerator OPENRISC = 92 OpenRISC 32-bit embedded processor ARC_COMPACT enumerator ARC_COMPACT = 93 ARC International ARCompact processor (old spelling/synonym: EM_ARC_A5) XTENSA enumerator XTENSA = 94 Tensilica Xtensa Architecture VIDEOCORE enumerator VIDEOCORE = 95 Alphamosaic VideoCore processor TMM_GPP enumerator TMM_GPP = 96 Thompson Multimedia General Purpose Processor NS32K enumerator NS32K = 97 National Semiconductor 32000 series TPC enumerator TPC = 98 Tenor Network TPC processor SNP1K enumerator SNP1K = 99 Trebia SNP 1000 processor ST200 enumerator ST200 = 100 STMicroelectronics (www.st.com) ST200 IP2K enumerator IP2K = 101 Ubicom IP2xxx microcontroller family MAX enumerator MAX = 102 MAX Processor CR enumerator CR = 103 National Semiconductor CompactRISC microprocessor F2MC16 enumerator F2MC16 = 104 Fujitsu F2MC16 MSP430 enumerator MSP430 = 105 Texas Instruments embedded microcontroller msp430 BLACKFIN enumerator BLACKFIN = 106 Analog Devices Blackfin (DSP) processor SE_C33 enumerator SE_C33 = 107 S1C33 Family of Seiko Epson processors SEP enumerator SEP = 108 Sharp embedded microprocessor ARCA enumerator ARCA = 109 Arca RISC Microprocessor UNICORE enumerator UNICORE = 110 Microprocessor series from PKU-Unity Ltd. and MPRC of Peking University EXCESS enumerator EXCESS = 111 eXcess: 16/32/64-bit configurable embedded CPU DXP enumerator DXP = 112 Icera Semiconductor Inc. Deep Execution Processor ALTERA_NIOS2 enumerator ALTERA_NIOS2 = 113 Altera Nios II soft-core processor CRX enumerator CRX = 114 National Semiconductor CompactRISC CRX XGATE enumerator XGATE = 115 Motorola XGATE embedded processor C166 enumerator C166 = 116 Infineon C16x/XC16x processor M16C enumerator M16C = 117 Renesas M16C series microprocessors DSPIC30F enumerator DSPIC30F = 118 Microchip Technology dsPIC30F Digital Signal CE enumerator CE = 119 Freescale Communication Engine RISC core M32C enumerator M32C = 120 Renesas M32C series microprocessors TSK3000 enumerator TSK3000 = 131 Altium TSK3000 core RS08 enumerator RS08 = 132 Freescale RS08 embedded processor SHARC enumerator SHARC = 133 Analog Devices SHARC family of 32-bit DSP ECOG2 enumerator ECOG2 = 134 Cyan Technology eCOG2 microprocessor SCORE7 enumerator SCORE7 = 135 Sunplus S+core7 RISC processor DSP24 enumerator DSP24 = 136 New Japan Radio (NJR) 24-bit DSP Processor VIDEOCORE3 enumerator VIDEOCORE3 = 137 Broadcom VideoCore III processor LATTICEMICO32 enumerator LATTICEMICO32 = 138 RISC processor for Lattice FPGA architecture SE_C17 enumerator SE_C17 = 139 Seiko Epson C17 family TI_C6000 enumerator TI_C6000 = 140 The Texas Instruments TMS320C6000 DSP family TI_C2000 enumerator TI_C2000 = 141 The Texas Instruments TMS320C2000 DSP family TI_C5500 enumerator TI_C5500 = 142 The Texas Instruments TMS320C55x DSP family MMDSP_PLUS enumerator MMDSP_PLUS = 160 STMicroelectronics 64bit VLIW Data Signal Processor CYPRESS_M8C enumerator CYPRESS_M8C = 161 Cypress M8C microprocessor R32C enumerator R32C = 162 Renesas R32C series microprocessors TRIMEDIA enumerator TRIMEDIA = 163 NXP Semiconductors TriMedia architecture family HEXAGON enumerator HEXAGON = 164 Qualcomm Hexagon processor M8051 enumerator M8051 = 165 Intel 8051 and variants STXP7X enumerator STXP7X = 166 STMicroelectronics STxP7x family of configurable NDS32 enumerator NDS32 = 167 ECOG1 enumerator ECOG1 = 168 Cyan Technology eCOG1X family ECOG1X enumerator ECOG1X = 168 Cyan Technology eCOG1X family MAXQ30 enumerator MAXQ30 = 169 Dallas Semiconductor MAXQ30 Core Micro-controllers XIMO16 enumerator XIMO16 = 170 New Japan Radio (NJR) 16-bit DSP Processor MANIK enumerator MANIK = 171 M2000 Reconfigurable RISC Microprocessor CRAYNV2 enumerator CRAYNV2 = 172 Cray Inc. NV2 vector architecture RX enumerator RX = 173 Renesas RX family METAG enumerator METAG = 174 Imagination Technologies META processor MCST_ELBRUS enumerator MCST_ELBRUS = 175 MCST Elbrus general purpose hardware architecture ECOG16 enumerator ECOG16 = 176 Cyan Technology eCOG16 family CR16 enumerator CR16 = 177 National Semiconductor CompactRISC CR16 16-bit ETPU enumerator ETPU = 178 Freescale Extended Time Processing Unit SLE9X enumerator SLE9X = 179 Infineon Technologies SLE9X core L10M enumerator L10M = 180 Intel L10M K10M enumerator K10M = 181 Intel K10M AARCH64 enumerator AARCH64 = 183 ARM AArch64 AVR32 enumerator AVR32 = 185 Atmel Corporation 32-bit microprocessor family STM8 enumerator STM8 = 186 STMicroeletronics STM8 8-bit microcontroller TILE64 enumerator TILE64 = 187 Tilera TILE64 multicore architecture family TILEPRO enumerator TILEPRO = 188 Tilera TILEPro multicore architecture family CUDA enumerator CUDA = 190 NVIDIA CUDA architecture TILEGX enumerator TILEGX = 191 Tilera TILE-Gx multicore architecture family CLOUDSHIELD enumerator CLOUDSHIELD = 192 CloudShield architecture family COREA_1ST enumerator COREA_1ST = 193 KIPO-KAIST Core-A 1st generation processor family COREA_2ND enumerator COREA_2ND = 194 KIPO-KAIST Core-A 2nd generation processor family ARC_COMPACT2 enumerator ARC_COMPACT2 = 195 Synopsys ARCompact V2 OPEN8 enumerator OPEN8 = 196 Open8 8-bit RISC soft processor core RL78 enumerator RL78 = 197 Renesas RL78 family VIDEOCORE5 enumerator VIDEOCORE5 = 198 Broadcom VideoCore V processor M78KOR enumerator M78KOR = 199 Renesas 78KOR family M56800EX enumerator M56800EX = 200 Freescale 56800EX Digital Signal Controller (DSC) BA1 enumerator BA1 = 201 Beyond BA1 CPU architecture BA2 enumerator BA2 = 202 Beyond BA2 CPU architecture XCORE enumerator XCORE = 203 XMOS xCORE processor family MCHP_PIC enumerator MCHP_PIC = 204 Microchip 8-bit PIC(r) family INTEL205 enumerator INTEL205 = 205 Reserved by Intel INTEL206 enumerator INTEL206 = 206 Reserved by Intel INTEL207 enumerator INTEL207 = 207 Reserved by Intel INTEL208 enumerator INTEL208 = 208 Reserved by Intel INTEL209 enumerator INTEL209 = 209 Reserved by Intel KM32 enumerator KM32 = 210 KM211 KM32 32-bit processor KMX32 enumerator KMX32 = 211 KM211 KMX32 32-bit processor KMX16 enumerator KMX16 = 212 KM211 KMX16 16-bit processor KMX8 enumerator KMX8 = 213 KM211 KMX8 8-bit processor KVARC enumerator KVARC = 214 KM211 KVARC processor CDP enumerator CDP = 215 Paneve CDP architecture family COGE enumerator COGE = 216 Cognitive Smart Memory Processor COOL enumerator COOL = 217 iCelero CoolEngine NORC enumerator NORC = 218 Nanoradio Optimized RISC CSR_KALIMBA enumerator CSR_KALIMBA = 219 CSR Kalimba architecture family AMDGPU enumerator AMDGPU = 224 AMD GPU architecture RISCV enumerator RISCV = 243 RISC-V BPF enumerator BPF = 247 eBPF Filter CSKY enumerator CSKY = 252 C-SKY LOONGARCH enumerator LOONGARCH = 258 LoongArch ALPHA_ALT enumerator ALPHA_ALT = 0x9026 Processor Flags LIEF::ELF::PROCESSOR_FLAGS enum class LIEF::ELF::PROCESSOR_FLAGS : uint64_t Values: ARM_EABI_UNKNOWN enumerator ARM_EABI_UNKNOWN = 0x00000000 | (PF_ARM_ID << PFLAGS_BIT) ARM_SOFT_FLOAT enumerator ARM_SOFT_FLOAT = 0x00000200 | (PF_ARM_ID << PFLAGS_BIT) ARM_VFP_FLOAT enumerator ARM_VFP_FLOAT = 0x00000400 | (PF_ARM_ID << PFLAGS_BIT) ARM_EABI_VER1 enumerator ARM_EABI_VER1 = 0x01000000 | (PF_ARM_ID << PFLAGS_BIT) ARM_EABI_VER2 enumerator ARM_EABI_VER2 = 0x02000000 | (PF_ARM_ID << PFLAGS_BIT) ARM_EABI_VER3 enumerator ARM_EABI_VER3 = 0x03000000 | (PF_ARM_ID << PFLAGS_BIT) ARM_EABI_VER4 enumerator ARM_EABI_VER4 = 0x04000000 | (PF_ARM_ID << PFLAGS_BIT) ARM_EABI_VER5 enumerator ARM_EABI_VER5 = 0x05000000 | (PF_ARM_ID << PFLAGS_BIT) HEXAGON_MACH_V2 enumerator HEXAGON_MACH_V2 = 0x00000001 | (PF_HEX_ID << PFLAGS_BIT) HEXAGON_MACH_V3 enumerator HEXAGON_MACH_V3 = 0x00000002 | (PF_HEX_ID << PFLAGS_BIT) HEXAGON_MACH_V4 enumerator HEXAGON_MACH_V4 = 0x00000003 | (PF_HEX_ID << PFLAGS_BIT) HEXAGON_MACH_V5 enumerator HEXAGON_MACH_V5 = 0x00000004 | (PF_HEX_ID << PFLAGS_BIT) HEXAGON_ISA_V2 enumerator HEXAGON_ISA_V2 = 0x00000010 | (PF_HEX_ID << PFLAGS_BIT) HEXAGON_ISA_V3 enumerator HEXAGON_ISA_V3 = 0x00000020 | (PF_HEX_ID << PFLAGS_BIT) HEXAGON_ISA_V4 enumerator HEXAGON_ISA_V4 = 0x00000030 | (PF_HEX_ID << PFLAGS_BIT) HEXAGON_ISA_V5 enumerator HEXAGON_ISA_V5 = 0x00000040 | (PF_HEX_ID << PFLAGS_BIT) LOONGARCH_ABI_SOFT_FLOAT enumerator LOONGARCH_ABI_SOFT_FLOAT = 0x1 | (PF_LOONGARCH_ID << PFLAGS_BIT) LOONGARCH_ABI_SINGLE_FLOAT enumerator LOONGARCH_ABI_SINGLE_FLOAT = 0x2 | (PF_LOONGARCH_ID << PFLAGS_BIT) LOONGARCH_ABI_DOUBLE_FLOAT enumerator LOONGARCH_ABI_DOUBLE_FLOAT = 0x3 | (PF_LOONGARCH_ID << PFLAGS_BIT) MIPS_NOREORDER enumerator MIPS_NOREORDER = 0x00000001 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_PIC enumerator MIPS_PIC = 0x00000002 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_CPIC enumerator MIPS_CPIC = 0x00000004 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_ABI2 enumerator MIPS_ABI2 = 0x00000020 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_32BITMODE enumerator MIPS_32BITMODE = 0x00000100 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_FP64 enumerator MIPS_FP64 = 0x00000200 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_NAN2008 enumerator MIPS_NAN2008 = 0x00000400 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_ABI_O32 enumerator MIPS_ABI_O32 = 0x00001000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_ABI_O64 enumerator MIPS_ABI_O64 = 0x00002000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_ABI_EABI32 enumerator MIPS_ABI_EABI32 = 0x00003000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_ABI_EABI64 enumerator MIPS_ABI_EABI64 = 0x00004000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_MACH_3900 enumerator MIPS_MACH_3900 = 0x00810000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_MACH_4010 enumerator MIPS_MACH_4010 = 0x00820000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_MACH_4100 enumerator MIPS_MACH_4100 = 0x00830000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_MACH_4650 enumerator MIPS_MACH_4650 = 0x00850000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_MACH_4120 enumerator MIPS_MACH_4120 = 0x00870000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_MACH_4111 enumerator MIPS_MACH_4111 = 0x00880000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_MACH_SB1 enumerator MIPS_MACH_SB1 = 0x008a0000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_MACH_OCTEON enumerator MIPS_MACH_OCTEON = 0x008b0000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_MACH_XLR enumerator MIPS_MACH_XLR = 0x008c0000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_MACH_OCTEON2 enumerator MIPS_MACH_OCTEON2 = 0x008d0000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_MACH_OCTEON3 enumerator MIPS_MACH_OCTEON3 = 0x008e0000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_MACH_5400 enumerator MIPS_MACH_5400 = 0x00910000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_MACH_5900 enumerator MIPS_MACH_5900 = 0x00920000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_MACH_5500 enumerator MIPS_MACH_5500 = 0x00980000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_MACH_9000 enumerator MIPS_MACH_9000 = 0x00990000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_MACH_LS2E enumerator MIPS_MACH_LS2E = 0x00a00000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_MACH_LS2F enumerator MIPS_MACH_LS2F = 0x00a10000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_MACH_LS3A enumerator MIPS_MACH_LS3A = 0x00a20000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_MICROMIPS enumerator MIPS_MICROMIPS = 0x02000000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_ARCH_ASE_M16 enumerator MIPS_ARCH_ASE_M16 = 0x04000000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_ARCH_ASE_MDMX enumerator MIPS_ARCH_ASE_MDMX = 0x08000000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_ARCH_1 enumerator MIPS_ARCH_1 = 0x00000000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_ARCH_2 enumerator MIPS_ARCH_2 = 0x10000000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_ARCH_3 enumerator MIPS_ARCH_3 = 0x20000000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_ARCH_4 enumerator MIPS_ARCH_4 = 0x30000000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_ARCH_5 enumerator MIPS_ARCH_5 = 0x40000000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_ARCH_32 enumerator MIPS_ARCH_32 = 0x50000000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_ARCH_64 enumerator MIPS_ARCH_64 = 0x60000000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_ARCH_32R2 enumerator MIPS_ARCH_32R2 = 0x70000000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_ARCH_64R2 enumerator MIPS_ARCH_64R2 = 0x80000000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_ARCH_32R6 enumerator MIPS_ARCH_32R6 = 0x90000000 | (PF_MIPS_ID << PFLAGS_BIT) MIPS_ARCH_64R6 enumerator MIPS_ARCH_64R6 = 0xa0000000 | (PF_MIPS_ID << PFLAGS_BIT) RISCV_RVC enumerator RISCV_RVC = 0x00000001 | (PF_RISCV_ID << PFLAGS_BIT) RISCV_FLOAT_ABI_SOFT enumerator RISCV_FLOAT_ABI_SOFT = 0x00000000 | (PF_RISCV_ID << PFLAGS_BIT) RISCV_FLOAT_ABI_SINGLE enumerator RISCV_FLOAT_ABI_SINGLE = 0x00000002 | (PF_RISCV_ID << PFLAGS_BIT) RISCV_FLOAT_ABI_DOUBLE enumerator RISCV_FLOAT_ABI_DOUBLE = 0x00000004 | (PF_RISCV_ID << PFLAGS_BIT) RISCV_FLOAT_ABI_QUAD enumerator RISCV_FLOAT_ABI_QUAD = 0x00000006 | (PF_RISCV_ID << PFLAGS_BIT) RISCV_FLOAT_ABI_RVE enumerator RISCV_FLOAT_ABI_RVE = 0x00000008 | (PF_RISCV_ID << PFLAGS_BIT) RISCV_FLOAT_ABI_TSO enumerator RISCV_FLOAT_ABI_TSO = 0x00000010 | (PF_RISCV_ID << PFLAGS_BIT)", "contentHash": "f5343f7f1c69aeb1fef0f40e77f8f311741f6313bf9d42bd3934dc4fc885ba07", "description": "ELF C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "formats/elf/cpp", "documentID": "642673de815b64d38a0a1a7280e50b797af4f9dd6e295635511d53b418a4af3f", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/elf/cpp.md", "title": "ELF C++ API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/elf/index.html", "content": "ELF API C++ Python Rust Introduction ELF binaries can be parsed with LIEF using the lief.ELF.parse() ( lief::elf::Binary::parse ; lief.ELF.parse() ; LIEF::ELF::Parser::parse() ) function: Python import lief # Using filepath elf: lief.ELF.Binary | None = lief.ELF.parse(\"/bin/ls\") # Using a Path from pathlib elf: lief.ELF.Binary | None = lief.ELF.parse(pathlib.Path(r\"C:\\Users\\test.elf\")) # Using an io object with open(\"/bin/ssh\", \"rb\") as f: elf: lief.ELF.Binary | None = lief.ELF.parse(f) C++ #include // Using a file path as a std::string std::unique_ptr elf = LIEF::ELF::Parser::parse(\"/bin/ls\"); // Using a vector std::vector my_raw_elf; elf = LIEF::ELF::Parser::parse(my_raw_elf); Rust let elf: lief::elf::Binary = lief::elf::Binary::parse(\"/bin/ls\").unwrap(); Note In Python, you can also use lief.parse() , which returns a lief.ELF.Binary object. With the parsed ELF binary, you can use the lief.ELF.Binary ( lief::elf::Binary ; lief.ELF.Binary ; LIEF::ELF::Binary ) API to inspect or modify the binary itself. Python elf: lief.ELF.Binary print(elf.header.entrypoint) for section in elf.sections: print(section.name, len(section.content)) C++ std::unique_ptr elf; std::cout << elf->header().entrypoint(); for (const LIEF::ELF::Section& section : elf->sections()) { std::cout << section.name() << section.content().size() << '\\n'; } Rust let elf: &lief::elf::Binary = some_elf; println!(\"{}\", elf.header().entrypoint()); for section in elf.sections() { println!(\"{} {}\", section.name(), section.content().len()); } After modifying a lief.ELF.Binary ( lief::elf::Binary ; lief.ELF.Binary ; LIEF::ELF::Binary ) object, you can use the lief.ELF.Binary.write() ( lief::elf::Binary::write ; lief::elf::Binary::write_with_config ; lief.ELF.Binary.write() ; LIEF::ELF::Binary::write() ) method to write it back to a raw ELF file. Python elf: lief.ELF.Binary elf.add_library(\"libdemo.so\") elf.write(\"new.elf\") C++ std::unique_ptr elf; elf->add_library(\"libdemo.so\"); elf->write(\"new.elf\"); Rust let elf: &mut lief::elf::Binary = some_elf; elf.add_library(\"libdemo.so\"); elf.write(\"new.elf\"); See also Binary Abstraction You can also use lief.ELF.Binary.write_to_bytes() ( lief::elf::Binary::write_to_bytes ; lief::elf::Binary::write_to_bytes_with_config ; lief.ELF.Binary.write_to_bytes() ; std::unique_ptr LIEF::ELF::Binary::write(std::ostream &) ; std::unique_ptr LIEF::ELF::Binary::write(std::ostream &, const Builder::config_t &) ) to get the new ELF binary as a buffer of bytes: Note This API can also take an extra lief.ELF.Builder.config_t ( lief.ELF.Builder.config_t ; LIEF::ELF::Builder::config_t ) parameter. Python elf: lief.ELF.Binary new_elf: bytes = elf.write_to_bytes() C++ std::unique_ptr elf; std::ostringstream os; elf->write(os); std::string buffer = os.str(); const auto* start = reinterpret_cast(buffer.data()); size_t size = buffer.size(); Rust let elf: &mut lief::elf::Binary = some_elf; let bytes: Vec = elf.write_to_bytes(); Adding a Section/Segment The ELF format uses two tables to represent different slices of the binary: The sections table The segments table While the sections table offers a detailed view of the binary, it is primarily used by the compiler and the linker . In particular, this table is not required for loading and executing an ELF file. While the Android loader enforces the presence of a sections table and requires specific sections, this table is not used during the actual loading process. To modify an ELF file to load additional content into memory (e.g., code or data), adding a lief.ELF.Segment ( lief::elf::Segment ; lief.ELF.Segment ; LIEF::ELF::Segment ) is recommended over adding a section: Python elf: lief.ELF.Binary segment = lief.ELF.Segment() segment.type = lief.ELF.Segment.TYPES.LOAD segment.content = list(b\"Hello World\") new_segment = elf.add(segment) elf.write(\"new.elf\") C++ std::unique_ptr elf; LIEF::ELF::Segment segment; segment.type(LIEF::ELF::Segment::TYPE::LOAD); segment.content({1, 2, 3}); LIEF::ELF::Segment* new_segment = elf->add(segment); elf->write(\"new.elf\"); Rust let elf: &mut lief::elf::Binary = some_elf; let mut segment = lief::elf::Segment::new(); segment.set_type(lief::elf::segment::Type::LOAD); segment.set_content(&[1, 2, 3]); elf.add_segment(&segment); elf.write(\"new.elf\"); Alternatively, you can create a lief.ELF.Section ( lief::elf::Section ; lief.ELF.Section ; LIEF::ELF::Section ), which will implicitly create an associated PT_LOAD segment: Python elf: lief.ELF.Binary section = lief.ELF.Section(\".lief_demo\") section.content = list(b\"Hello World\") new_section = elf.add(section, loaded=True) elf.write(\"new.elf\") C++ std::unique_ptr elf; LIEF::ELF::Section section(\".lief_demo\"); section.content({1, 2, 3}); LIEF::ELF::Section* new_section = elf->add(section, /*loaded=*/true); elf->write(\"new.elf\"); Rust let elf: &mut lief::elf::Binary = some_elf; let section = lief::elf::Section::new_with_content(\".lief_demo\", &[1, 2, 3]); elf.add_section( §ion, /* loaded= */ true, lief::elf::binary::SecInsertPos::AUTO, ); elf.write(\"new.elf\"); As mentioned above, the segments table is more critical than the sections table from a loading perspective. Therefore, it is more appropriate to explicitly add a new segment rather than adding a section that implicitly adds a segment. On the other hand, for debugging purposes or specialized tools, you might want to add a non-loaded section. In this case, the section data is inserted at the end of the binary, immediately after the data wrapped by the segments: Python elf: lief.ELF.Binary section = lief.ELF.Section(\".metadata\") section.content = list(b\"version: 1.2.3\") # /!\\ Note that loaded is set to False here # ------------------------------------------ new_section = elf.add(section, loaded=False) elf.write(\"new.elf\") C++ std::unique_ptr elf; LIEF::ELF::Section section(\".metadata\"); section.content({1, 2, 3}); LIEF::ELF::Section* new_section = elf->add(section, /*loaded=*/false); elf->write(\"new.elf\"); Rust let elf: &mut lief::elf::Binary = some_elf; let section = lief::elf::Section::new_with_content(\".metadata\", b\"version: 1.2.3\"); // /!\\ Note that loaded is set to false here // ----------------------------------------- elf.add_section( §ion, /* loaded= */ false, lief::elf::binary::SecInsertPos::AUTO, ); elf.write(\"new.elf\"); See: lief.ELF.Binary.add() ( lief::elf::Binary::add_section ; lief::elf::Binary::add_segment ; lief.ELF.Binary.add() ; LIEF::ELF::Binary::add() ) for detailed API information. Dump Analysis LIEF has the support to process ELF memory dump with lief.ELF.parse_from_dump() ( lief::elf::Binary::parse_from_dump ; lief.ELF.parse_from_dump() ; LIEF::ELF::Parser::parse_from_dump() ). This function translates the file offsets referenced by the ELF structures into their location inside the dump, using the base address passed as the second parameter: Python # 0x7f9b98e00000 is the (absolute) address at which the dump was mapped elf = lief.ELF.parse_from_dump(\"module.dump\", 0x7F9B98E00000) assert elf is not None for segment in elf.segments: print(segment.type, hex(segment.virtual_address)) C++ auto elf = LIEF::ELF::Parser::parse_from_dump(\"module.dump\", 0x7f9b98e00000); for (const LIEF::ELF::Segment& segment : elf->segments()) { std::cout << to_string(segment.type()) << '\\n'; } Rust let elf = lief::elf::Binary::parse_from_dump(\"module.dump\", 0x7f9b_98e0_0000).unwrap(); for segment in elf.segments() { println!(\"{:?} {:#x}\", segment.p_type(), segment.virtual_address()); } Note The second parameter must be the (absolute) virtual address at which the dump was mapped. It is used to convert the virtual addresses found in the ELF structures back into an offset within the dump. Warning Parsing an ELF from a dump is subject to the same limitations as parsing it from memory: the segments ( PT_LOAD ) and the program headers are reliable, but the section header table is generally not mapped and the content of the dynamic table (dynamic entries, dynamic symbols and relocations) reflects its runtime state and may not be recoverable. Prefer working with the segments when analyzing a dump. Producing a dump with the runtime API Such a dump can be produced from a live process thanks to the LIEF runtime and, more precisely, the Module API . lief.runtime.Module.dump() ( lief::runtime::module::Module::dump ; lief.runtime.Module.dump() ; LIEF::runtime::Module::dump() ) captures the memory of a loaded module (from its imagebase over its virtual size): Python # Find the module to dump in the current process mod = lief.runtime.module_from_name(\"libc.so.6\") assert mod is not None # Dump the module's memory into a file (the raw bytes are also returned) data: bytes = mod.dump(\"module.dump\") # and parse it back using the same imagebase: elf = lief.ELF.parse_from_dump(data, mod.imagebase) C++ // Find the module to dump in the current process auto mod = LIEF::runtime::module_from_name(\"libc.so.6\"); // Dump the module's memory into a file (the raw bytes are also returned) std::vector data = mod->dump(\"module.dump\"); auto elf = LIEF::ELF::Parser::parse_from_dump(\"module.dump\", mod->imagebase()); Rust use lief::runtime::Module; let module = lief::runtime::module_from_name(\"libc.so.6\").unwrap(); // Dump the module's memory into a file (the raw bytes are also returned) let data = module.dump_to_file(\"module.dump\"); let elf = lief::elf::Binary::parse_from_dump(\"module.dump\", module.imagebase()).unwrap(); Advanced Parsing/Writing lief.ELF.parse() ( lief::elf::Binary::parse ; lief.ELF.parse() ; LIEF::ELF::Parser::parse() ) can take an extra lief.ELF.ParserConfig ( lief.ELF.ParserConfig ; LIEF::ELF::ParserConfig ) parameter to specify parts of the ELF format to skip during parsing. Warning Generally, lief.ELF.Binary.write() ( lief::elf::Binary::write ; lief::elf::Binary::write_with_config ; lief.ELF.Binary.write() ; LIEF::ELF::Binary::write() ) requires a complete initial parsing of the ELF file. Similarly, lief.ELF.Binary.write() ( lief::elf::Binary::write ; lief::elf::Binary::write_with_config ; lief.ELF.Binary.write() ; LIEF::ELF::Binary::write() ) can also take an extra lief.ELF.Builder.config_t ( lief.ELF.Builder.config_t ; LIEF::ELF::Builder::config_t ) to specify which parts of the ELF should be rebuilt. Python parser_config = lief.ELF.ParserConfig() parser_config.parse_overlay = False elf = lief.ELF.parse(\"my.elf\", parser_config) assert isinstance(elf, lief.ELF.Binary) builder_config = lief.ELF.Builder.config_t() builder_config.gnu_hash = False elf.write(\"new.elf\", builder_config) C++ LIEF::ELF::ParserConfig parser_config; parser_config.parse_overlay = false; auto elf = LIEF::ELF::Parser::parse(\"my.elf\", parser_config); LIEF::ELF::Builder::config_t builder_config; builder_config.gnu_hash = false; elf->write(\"new.elf\", builder_config); Rust let mut parser_config = lief::elf::ParserConfig::default(); parser_config.parse_overlay = false; let mut elf = lief::elf::parse_with_config(\"my.elf\", &parser_config).unwrap(); let mut builder_config = lief::elf::builder::Config::default(); builder_config.gnu_hash = false; elf.write_with_config(\"new.elf\", builder_config); DWARF Support If the binary embeds DWARF debug information, you can use lief.Binary.debug_info() ( lief::elf::Binary::debug_info ; lief.Binary.debug_info ; LIEF::Binary::debug_info() ) to access the underlying lief.dwarf.DebugInfo ( lief::dwarf::DebugInfo ; lief.dwarf.DebugInfo ; LIEF::dwarf::DebugInfo ) object. Note that this support is only available in the Extended version of LIEF. R[UN]PATH Modification LIEF provides comprehensive facilities for manipulating a binary’s RPATH/RUNPATH. DT_RPATH vs DT_RUNPATH DT_RPATH and DT_RUNPATH are both dynamic tags used to specify runtime library search paths. DT_RPATH is now considered legacy because it does not respect the precedence of the LD_LIBRARY_PATH environment variable. This means that if LD_LIBRARY_PATH is set to a valid directory where the library can be found, it will be ignored in favor of the DT_RPATH value. Therefore, the DT_RUNPATH tag should be preferred over DT_RPATH . Note that if both tags are present, the loader will use the DT_RUNPATH entry over the legacy DT_RPATH . The DT_RPATH tag is represented by the lief.ELF.DynamicEntryRpath ( lief::elf::dynamic::Rpath ; lief.ELF.DynamicEntryRpath ; LIEF::ELF::DynamicEntryRpath ) interface, and the DT_RUNPATH tag by lief.ELF.DynamicEntryRunPath ( lief::elf::dynamic::RunPath ; lief.ELF.DynamicEntryRunPath ; LIEF::ELF::DynamicEntryRunPath ). The RPATH/RUNPATH modifications supported by LIEF include: Adding a new entry Python elf: lief.ELF.Binary runpath = lief.ELF.DynamicEntryRunPath(\"$ORIGIN:/opt/lib64\") elf.add(runpath) other_runpath = lief.ELF.DynamicEntryRunPath([\"$ORIGIN\", \"/opt/lib64\"]) elf.add(other_runpath) elf.write(\"updated.elf\") C++ std::unique_ptr elf; LIEF::ELF::DynamicEntryRunPath runpath(\"$ORIGIN:/opt/lib64\"); elf->add(runpath); LIEF::ELF::DynamicEntryRunPath other_runpath( std::vector{\"$ORIGIN\", \"/opt/lib64\"} ); elf->add(other_runpath); elf->write(\"updated.elf\"); Rust let elf: &mut lief::elf::Binary = some_elf; let runpath = lief::elf::dynamic::RunPath::new(\"$ORIGIN:/opt/lib64\"); elf.add_dynamic_entry(&runpath); let other_runpath = lief::elf::dynamic::RunPath::with_paths(&[\"$ORIGIN\", \"/opt/lib64\"]); elf.add_dynamic_entry(&other_runpath); let output = PathBuf::from(\"updated.elf\"); elf.write(output.as_path()); Changing an entry Python elf: lief.ELF.Binary runpath = elf.get(lief.ELF.DynamicEntry.TAG.RUNPATH) assert runpath is not None runpath.runpath = \"$ORIGIN:/opt/lib64\" runpath.append(\"lib-x86_64-gnu\") elf.write(\"updated.elf\") C++ std::unique_ptr elf; auto* runpath = elf->get(LIEF::ELF::DynamicEntry::TAG::RUNPATH) ->cast(); assert(runpath != nullptr); runpath->runpath(\"$ORIGIN:/opt/lib64\"); runpath->append(\"lib-x86_64-gnu\"); elf->write(\"updated.elf\"); Rust let elf: &mut lief::elf::Binary = some_elf; if let Some(dynamic::Entries::RunPath(mut runpath)) = elf.dynamic_entry_by_tag(dynamic::Tag::RUNPATH) { runpath.set_runpath(\"$ORIGIN:/opt/lib64\"); runpath.append(\"lib-x86_64-gnu\"); } let output = PathBuf::from(\"updated.elf\"); elf.write(output.as_path()); Removing entries Python elf: lief.ELF.Binary # Remove **all** DT_RUNPATH entries elf.remove(lief.ELF.DynamicEntry.TAG.RUNPATH) # Remove all entries that contain '$ORIGIN' to_remove: list[lief.ELF.DynamicEntryRunPath] = [] for dt_entry in elf.dynamic_entries: if not isinstance(dt_entry, lief.ELF.DynamicEntryRunPath): continue if \"$ORIGIN\" in dt_entry.runpath: to_remove.append(dt_entry) for entry in to_remove: elf.remove(entry) elf.write(\"updated.elf\") C++ std::unique_ptr elf; // Remove **all** DT_RUNPATH entries elf->remove(LIEF::ELF::DynamicEntry::TAG::RUNPATH); // Remove all entries that contain '$ORIGIN' std::vector to_remove; for (DynamicEntry& entry : elf->dynamic_entries()) { if (auto* dt_entry = entry.cast()) { if (dt_entry->runpath().find(\"$ORIGIN\") != std::string::npos) { to_remove.push_back(dt_entry); } } } for (LIEF::ELF::DynamicEntryRunPath* entry : to_remove) { elf->remove(*entry); } elf->write(\"updated.elf\"); Rust let elf: &mut lief::elf::Binary = some_elf; // Remove **all** DT_RUNPATH entries elf.remove_dynamic_entries_by_tag(dynamic::Tag::RUNPATH); // Remove all entries that contain '$ORIGIN' elf.remove_dynamic_entry_if(|e| { if let dynamic::Entries::RunPath(runpath) = e { return runpath.runpath().contains(\"$ORIGIN\"); } false }); let output = PathBuf::from(\"updated.elf\"); elf.write(output.as_path()); You can also check the lief-patchelf section for a command-line interface. Symbol Versions The ELF format supports symbol versioning, allowing multiple versions of the same function or variable to coexist within a single shared object. During compilation, the linker selects the appropriate symbols and versions based on the libraries provided as input. For example, if a program uses the printf function and is linked with a version of libc.so that exposes printf@@GLIBC_2.40 , the compiled executable will require at least that version of the libc to run. These versioning requirements can be problematic when creating executables or libraries intended for a wide range of Linux distributions. The best way to ensure maximum compatibility is to target the minimum supported version of glibc. For instance, if you aim to support Linux distributions with at least glibc version 2.28 (released in 2018), you should specifically provide that version of libc.so during linking: $ ld --sysroot=/sysroot/glibc-2.28/ my_program.o -o my_program.elf $ ld -L /sysroot/glibc-2.28/lib64/ my_program.o -o my_program.elf -lc In situations where you lack control over the link step, you may want to change the versioning post-compilation . LIEF can be used in these situations to perform the following modifications on symbol versions. Remove the version for a specific symbol In this example, we remove the version attached to the printf symbol by setting the versioning as global (the default setting for imported functions). Python elf: lief.ELF.Binary sym = elf.get_dynamic_symbol(\"printf\") assert sym is not None and sym.symbol_version is not None sym.symbol_version.as_global() elf.write(\"updated.elf\") C++ std::unique_ptr elf; LIEF::ELF::Symbol* sym = elf->get_dynamic_symbol(\"printf\"); assert(sym != nullptr); sym->symbol_version()->as_global(); elf->write(\"updated.elf\"); Rust let elf: &mut lief::elf::Binary = some_elf; if let Some(sym) = elf.dynamic_symbol_by_name(\"printf\") && let Some(mut symver) = sym.symbol_version() { symver.as_global(); } let output = PathBuf::from(\"updated.elf\"); elf.write(output.as_path()); Remove all the versions for a specific library In this example, we remove all the symbol versions associated with an imported library ( libm.so.6 ): Python elf: lief.ELF.Binary elf.remove_version_requirement(\"libm.so.6\") elf.write(\"updated.elf\") C++ std::unique_ptr elf; elf->remove_version_requirement(\"libm.so.6\"); elf->write(\"updated.elf\"); Rust let elf: &mut lief::elf::Binary = some_elf; elf.remove_version_requirement(\"libm.so.6\"); let output = PathBuf::from(\"updated.elf\"); elf.write(output.as_path()); Before $ readelf -V input.elf Version symbols section '.gnu.version' contains 48 entries: Addr: 00000000000009bc Offset: 0x0009bc Link: 6 (.dynsym) 000: 0 (*local*) 2 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 2 (GLIBC_2.2.5) 004: 2 (GLIBC_2.2.5) 0 (*local*) 4 (GLIBC_2.17) 3 (GLIBC_2.2.5) 008: 2 (GLIBC_2.2.5) 5 (GLIBC_2.27) 2 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 00c: 3 (GLIBC_2.2.5) 2 (GLIBC_2.2.5) 6 (GLIBC_2.4) 2 (GLIBC_2.2.5) 010: 3 (GLIBC_2.2.5) 2 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 014: 2 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 0 (*local*) 018: 3 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 2 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 01c: 3 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 2 (GLIBC_2.2.5) 2 (GLIBC_2.2.5) 020: 2 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 2 (GLIBC_2.2.5) 2 (GLIBC_2.2.5) 024: 3 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 2 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 028: 3 (GLIBC_2.2.5) 0 (*local*) 3 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 02c: 3 (GLIBC_2.2.5) 7 (GLIBC_2.29) 2 (GLIBC_2.2.5) 2 (GLIBC_2.2.5) Version needs section '.gnu.version_r' contains 2 entries: Addr: 0000000000000a20 Offset: 0x000a20 Link: 7 (.dynstr) 0x0000: Version: 1 File: libm.so.6 Cnt: 3 0x0010: Name: GLIBC_2.29 Flags: none Version: 7 0x0020: Name: GLIBC_2.27 Flags: none Version: 5 0x0030: Name: GLIBC_2.2.5 Flags: none Version: 3 0x0040: Version: 1 File: libc.so.6 Cnt: 3 0x0050: Name: GLIBC_2.4 Flags: none Version: 6 0x0060: Name: GLIBC_2.17 Flags: none Version: 4 0x0070: Name: GLIBC_2.2.5 Flags: none Version: 2 After $ readelf -V updated.elf Version symbols section '.gnu.version' contains 48 entries: Addr: 00000000000009bc Offset: 0x0009bc Link: 6 (.dynsym) 000: 0 (*local*) 1 (*global*) 1 (*global*) 1 (*global*) 004: 1 (*global*) 0 (*local*) 4 (GLIBC_2.17) 1 (*global*) 008: 1 (*global*) 1 (*global*) 1 (*global*) 1 (*global*) 00c: 1 (*global*) 1 (*global*) 6 (GLIBC_2.4) 1 (*global*) 010: 1 (*global*) 1 (*global*) 1 (*global*) 1 (*global*) 014: 1 (*global*) 1 (*global*) 1 (*global*) 0 (*local*) 018: 1 (*global*) 1 (*global*) 1 (*global*) 1 (*global*) 01c: 1 (*global*) 1 (*global*) 1 (*global*) 1 (*global*) 020: 1 (*global*) 1 (*global*) 1 (*global*) 1 (*global*) 024: 1 (*global*) 1 (*global*) 1 (*global*) 1 (*global*) 028: 1 (*global*) 0 (*local*) 1 (*global*) 1 (*global*) 02c: 1 (*global*) 1 (*global*) 1 (*global*) 1 (*global*) Version needs section '.gnu.version_r' contains 1 entries: Addr: 0000000000000a20 Offset: 0x000a20 Link: 7 (.dynstr) 0x0000: Version: 1 File: libc.so.6 Cnt: 3 0x0010: Name: GLIBC_2.4 Flags: none Version: 6 0x0020: Name: GLIBC_2.17 Flags: none Version: 4 0x0030: Name: GLIBC_2.2.5 Flags: none Version: 2", "contentHash": "23a05b3b71003f15aa07da62983219d705a6377441e807280a58371f860f373e", "description": "ELF binaries can be parsed with LIEF using the lief.ELF.parse() function:", "docname": "formats/elf/index", "documentID": "b9cfec9b8fbd73cb490900a3da4fdbe3735d0443354fe1eb32b4e0a18ae34a0d", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/elf/index.md", "title": "ELF - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/elf/python.html", "content": "Python Parser lief.ELF.parse lief.ELF.parse( obj: str | io.IOBase | os.PathLike | bytes | list[int] , config: lief.ELF.ParserConfig ) → lief.ELF.Binary | None Parse the ELF binary from the given Python object and return a lief.ELF.Binary object The second argument is an optional configuration ( ParserConfig ) that can be used to define which part(s) of the ELF should be parsed or skipped. lief.ELF.ParserConfig class lief.ELF.ParserConfig( self ) Bases: object This class is used to tweak the ELF Parser DYNSYM_COUNT class DYNSYM_COUNT( *values ) Bases: Enum AUTO AUTO = 0 HASH HASH = 2 RELOCATIONS RELOCATIONS = 3 SECTION SECTION = 1 from_value from_value( arg: int ) → lief.ELF.ParserConfig.DYNSYM_COUNT = all all = count_mtd property count_mtd → lief.ELF.ParserConfig.DYNSYM_COUNT The DYNSYM_COUNT_METHODS to use for counting the dynamic symbols For weird binaries (e.g sectionless) you can choose the method for counting dynamic symbols ( lief.ELF.DYNSYM_COUNT_METHODS ). By default, the value is set to lief.ELF.DYNSYM_COUNT_METHODS.COUNT_AUTO page_size property page_size → int Memory page size if the binary uses a non-standard value. For instance, SPARCV9 binary can use a page size from 0x2000 to 0x100000. parse_dyn_symbols property parse_dyn_symbols → bool Whether dynamic symbols (those from .dynsym) should be parsed parse_notes property parse_notes → bool Whether ELF notes information should be parsed parse_overlay property parse_overlay → bool Whether the overlay data should be parsed parse_relocations property parse_relocations → bool Whether relocations (including plt-like relocations) should be parsed. parse_symbol_versions property parse_symbol_versions → bool Whether versioning symbols should be parsed parse_symtab_symbols property parse_symtab_symbols → bool Whether debug symbols (those from .symtab) should be parsed Binary lief.ELF.Binary class lief.ELF.Binary Bases: Binary Class which represents an ELF binary PHDR_RELOC class PHDR_RELOC( *values ) Bases: Enum This enum describes the different ways to relocate the segments table. AUTO AUTO = 0 BSS_END BSS_END = 2 FILE_END FILE_END = 3 PIE_SHIFT PIE_SHIFT = 1 SEGMENT_GAP SEGMENT_GAP = 4 SEC_INSERT_POS class SEC_INSERT_POS( *values ) Bases: Enum This enum defines where the content of a newly added section should be inserted. AUTO AUTO = 0 POST_SECTION POST_SECTION = 2 POST_SEGMENT POST_SEGMENT = 1 addaddaddadd add( self , arg: lief._lief.ELF.DynamicEntry , / ) → lief._lief.ELF.DynamicEntry **add( self , section: lief._lief.ELF.Section , loaded: bool = True , pos: lief._lief.ELF.Binary.SEC_INSERT_POS = SEC_INSERT_POS.AUTO ) → lief._lief.ELF.Section | None **add( self , segment: lief._lief.ELF.Segment , base: int = 0 ) → lief._lief.ELF.Segment | None add( self , note: lief._lief.ELF.Note ) → lief._lief.ELF.Note **** Overloaded function. add(self, arg: lief._lief.ELF.DynamicEntry, /) -> lief._lief.ELF.DynamicEntry dynamic_entry add(self, section: lief._lief.ELF.Section, loaded: bool = True, pos: lief._lief.ELF.Binary.SEC_INSERT_POS = SEC_INSERT_POS.AUTO) -> lief._lief.ELF.Section | None Add the given Section to the binary. If the section does not aim at being loaded in memory, the loaded parameter has to be set to False (default: True ) add(self, segment: lief._lief.ELF.Segment, base: int = 0) -> lief._lief.ELF.Segment | None Add a new Segment in the binary add(self, note: lief._lief.ELF.Note) -> lief._lief.ELF.Note Add a new Note in the binary add_dynamic_relocation add_dynamic_relocation( self , relocation: lief._lief.ELF.Relocation ) → lief._lief.ELF.Relocation Add a new dynamic relocation. We consider a dynamic relocation as a relocation which is not plt-related. See: lief.ELF.Binary.add_pltgot_relocation() add_dynamic_symbol add_dynamic_symbol( self , symbol: lief._lief.ELF.Symbol , symbol_version: lief._lief.ELF.SymbolVersion | None = None ) → lief._lief.ELF.Symbol Add a dynamic Symbol to the binary The function also takes an optional lief.ELF.SymbolVersion add_exported_function add_exported_function( self , address: int , name: str = '' ) → lief._lief.ELF.Symbol Create a symbol for the function at the given address and create an export add_library add_library( self , library_name: str ) → lief._lief.ELF.DynamicEntryLibrary Add a library with the given name as dependency add_object_relocation add_object_relocation( self , relocation: lief._lief.ELF.Relocation , section: lief._lief.ELF.Section ) → lief._lief.ELF.Relocation | None Add relocation for object file (.o) The first parameter is the relocation to add while the second parameter is the Section associated with the relocation. If there is an error, this function returns a nullptr. Otherwise, it returns the relocation added. add_pltgot_relocation add_pltgot_relocation( self , relocation: lief._lief.ELF.Relocation ) → lief._lief.ELF.Relocation Add a .plt.got relocation. This kind of relocation is usually associated with a PLT stub that aims at resolving the underlying symbol. See: lief.ELF.Binary.add_dynamic_relocation() add_symtab_symbol add_symtab_symbol( self , symbol: lief._lief.ELF.Symbol ) → lief._lief.ELF.Symbol Add a static Symbol to the binary dtor_functions property dtor_functions → list[ lief.Function ] List of the binary destructors (typically, the functions located in the .fini_array ) dynamic_entries property dynamic_entries → lief.ELF.Binary.it_dynamic_entries Return an iterator to DynamicEntry entries dynamic_relocations property dynamic_relocations → lief.ELF.Binary.it_filter_relocation Return an iterator over dynamic Relocation dynamic_symbols property dynamic_symbols → lief.ELF.Binary.it_symbols Return an iterator to dynamic Symbol dynsym_idxdynsym_idx dynsym_idx( self , name: str ) → int dynsym_idx( self , symbol: lief._lief.ELF.Symbol ) → int Overloaded function. dynsym_idx(self, name: str) -> int Get the symbol index in the dynamic symbol from the given name or return -1 if the symbol does not exist. dynsym_idx(self, symbol: lief._lief.ELF.Symbol) -> int Get the symbol index in the dynamic symbol table for the given symbol or return -1 if the symbol does not exist eof_offset property eof_offset → int Return the last offset used by the ELF binary according to both, the sections table and the segments table. export_symbolexport_symbol export_symbol( self , symbol: lief._lief.ELF.Symbol ) → lief._lief.ELF.Symbol export_symbol( self , symbol_name: str , value: int = 0 ) → lief._lief.ELF.Symbol Overloaded function. export_symbol(self, symbol: lief._lief.ELF.Symbol) -> lief._lief.ELF.Symbol Export the given symbol and create an entry if it doesn’t exist export_symbol(self, symbol_name: str, value: int = 0) -> lief._lief.ELF.Symbol Export the symbol with the given name and create an entry if it doesn’t exist exported_symbols property exported_symbols → lief.ELF.Binary.it_filter_symbols Return dynamic Symbol which are exported extendextend extend( self , segment: lief._lief.ELF.Segment , size: int ) → lief._lief.ELF.Segment | None extend( self , segment: lief._lief.ELF.Section , size: int ) → lief._lief.ELF.Section | None Overloaded function. extend(self, segment: lief._lief.ELF.Segment, size: int) -> lief._lief.ELF.Segment | None Extend the given Segment by the given size extend(self, segment: lief._lief.ELF.Section, size: int) -> lief._lief.ELF.Section | None Extend the given Section by the given size find_version_requirement find_version_requirement( self , libname: str ) → lief._lief.ELF.SymbolVersionRequirement | None Try to find the SymbolVersionRequirement associated with the given library name (e.g. libc.so.6 ) functions property functions → list[ lief.Function ] List of the functions found in the binary getgetgetget get( self , tag: lief._lief.ELF.DynamicEntry.TAG ) → lief._lief.ELF.DynamicEntry | None **get( self , type: lief._lief.ELF.Segment.TYPE ) → lief._lief.ELF.Segment | None **get( self , type: lief._lief.ELF.Note.TYPE ) → lief._lief.ELF.Note | None get( self , type: lief._lief.ELF.Section.TYPE ) → lief._lief.ELF.Section | None **** Overloaded function. get(self, tag: lief._lief.ELF.DynamicEntry.TAG) -> lief._lief.ELF.DynamicEntry | None Return the first binary’s DynamicEntry from the given TAG . It returns None if the dynamic entry can’t be found. get(self, type: lief._lief.ELF.Segment.TYPE) -> lief._lief.ELF.Segment | None Return the first binary’s Segment from the given SEGMENT_TYPES It returns None if the segment can’t be found. get(self, type: lief._lief.ELF.Note.TYPE) -> lief._lief.ELF.Note | None Return the first binary’s Note from the given TYPE . It returns None if the note can’t be found. get(self, type: lief._lief.ELF.Section.TYPE) -> lief._lief.ELF.Section | None Return the first binary’s Section from the given ELF_SECTION_TYPES It returns None if the section can’t be found. get_dynamic_symbol get_dynamic_symbol( self , symbol_name: str ) → lief._lief.ELF.Symbol | None Get the dynamic symbol from the given name. It returns None if it can’t be found. get_library get_library( self , library_name: str ) → lief._lief.ELF.DynamicEntryLibrary | None Return the DynamicEntryLibrary with the given name It returns None if the library can’t be found. get_relocated_dynamic_array get_relocated_dynamic_array( self , array_tag: lief._lief.ELF.DynamicEntry.TAG ) → list[int] Return the array defined by the given tag (e.g. INIT_ARRAY ) with relocations applied (if any) get_relocationget_relocationget_relocation get_relocation( self , symbol_name: str ) → lief._lief.ELF.Relocation | None **get_relocation( self , symbol: lief._lief.ELF.Symbol ) → lief._lief.ELF.Relocation | None get_relocation( self , address: int ) → lief._lief.ELF.Relocation | None ** Overloaded function. get_relocation(self, symbol_name: str) -> lief._lief.ELF.Relocation | None Return the Relocation associated with the given symbol name get_relocation(self, symbol: lief._lief.ELF.Symbol) -> lief._lief.ELF.Relocation | None Return the Relocation associated with the given Symbol get_relocation(self, address: int) -> lief._lief.ELF.Relocation | None Return the Relocation associated with the given address get_section get_section( self , section_name: str ) → lief._lief.ELF.Section | None Return the Section with the given name It returns None if the section can’t be found. get_section_idxget_section_idx get_section_idx( self , arg: lief._lief.ELF.Section , / ) → int | lief._lief.lief_errors get_section_idx( self , arg: str , / ) → int | lief._lief.lief_errors Overloaded function. get_section_idx(self, arg: lief._lief.ELF.Section, /) -> Union[int, lief._lief.lief_errors] Find the index of the section given in the first parameter get_section_idx(self, arg: str, /) -> Union[int, lief._lief.lief_errors] Find the index of the section with the name given in the first parameter get_strings get_strings( self , min_size: int = 5 ) → list[str] Return list of strings used in the current ELF file with a minimal size given in first parameter (Default: 5) It looks for strings in the .rodata section get_symtab_symbol get_symtab_symbol( self , symbol_name: str ) → lief._lief.ELF.Symbol | None Get the static symbol from the given name . It returns None if it can’t be found. gnu_hash property gnu_hash → lief.ELF.GnuHash | None Return the GnuHash object Hashes are used by the loader to speed up symbol resolution (GNU Version) hashashashas has( self , tag: lief._lief.ELF.DynamicEntry.TAG ) → bool **has( self , type: lief._lief.ELF.Segment.TYPE ) → bool **has( self , type: lief._lief.ELF.Note.TYPE ) → bool has( self , type: lief._lief.ELF.Section.TYPE ) → bool **** Overloaded function. has(self, tag: lief._lief.ELF.DynamicEntry.TAG) -> bool Check if there exists a DynamicEntry with the given TAG has(self, type: lief._lief.ELF.Segment.TYPE) -> bool Check if a Segment of type ( SEGMENT_TYPES ) exists has(self, type: lief._lief.ELF.Note.TYPE) -> bool Check if a Note of type ( TYPE ) exists has(self, type: lief._lief.ELF.Section.TYPE) -> bool Check if a Section of type ( SECTION_TYPES ) exists has_dynamic_symbol has_dynamic_symbol( self , symbol_name: str ) → bool Check if the symbol with the given name exists in the dynamic symbol table has_interpreter property has_interpreter → bool Check if the binary uses a loader (also named linker or interpreter) has_library has_library( self , library_name: str ) → bool Check if the given library name exists in the current binary has_notes property has_notes → bool True if the binary contains notes has_overlay property has_overlay → bool True if data are appended to the end of the binary has_section has_section( self , section_name: str ) → bool Check if a Section with the given name exists in the binary has_section_with_offset has_section_with_offset( self , offset: int ) → bool Check if a Section that encompasses the given offset exists has_section_with_va has_section_with_va( self , virtual_address: int ) → bool Check if a Section that encompasses the given virtual address exists has_symtab_symbol has_symtab_symbol( self , symbol_name: str ) → bool Check if the symbol with the given name exists in the static symbol table header property header → lief.ELF.Header Return Header object imagebase property imagebase → int Return the program image base. (e.g. 0x400000 ) imported_symbols property imported_symbols → lief.ELF.Binary.it_filter_symbols Return dynamic Symbol which are imported interpreter property interpreter → str ELF interpreter (loader) if any. (e.g. /lib64/ld-linux-x86-64.so.2 ) is_pie property is_pie → bool Check if the binary has been compiled with -fpie -pie flags To do so we check if there is a PT_INTERP segment and if the binary type is ET_DYN (Shared object) is_targeting_android property is_targeting_android → bool True if the current binary is targeting Android last_offset_section property last_offset_section → int Return the last offset used in binary according to sections table last_offset_segment property last_offset_segment → int Return the last offset used in binary according to segments table next_virtual_address property next_virtual_address → int Return the next virtual address available notes property notes → lief.ELF.Binary.it_notes Return an iterator over the Note entries object_relocations property object_relocations → lief.ELF.Binary.it_filter_relocation Return an iterator over object Relocation overlay property overlay → memoryview Overlay data that is not part of the ELF format patch_pltgotpatch_pltgot patch_pltgot( self , symbol_name: str , address: int ) → None patch_pltgot( self , symbol: lief._lief.ELF.Symbol , address: int ) → None Overloaded function. patch_pltgot(self, symbol_name: str, address: int) -> None Patch the imported symbol’s name with the address patch_pltgot(self, symbol: lief._lief.ELF.Symbol, address: int) -> None Patch the imported Symbol with the address permute_dynamic_symbols permute_dynamic_symbols( self , permutation: collections.abc.Sequence[int] ) → None Apply the given permutation on the dynamic symbols table pltgot_relocations property pltgot_relocations → lief.ELF.Binary.it_filter_relocation Return an iterator over PLT/GOT Relocation relocate_phdr_table relocate_phdr_table( self , type: lief._lief.ELF.Binary.PHDR_RELOC = PHDR_RELOC.AUTO ) → int Force relocating the segments table in a specific way (see: PHDR_RELOC ). This function can be used to enforce a specific relocation of the segments table. Upon successful relocation, the function returns the offset of the relocated segments table. Otherwise, if the function fails, it returns 0 relocations property relocations → lief.ELF.Binary.it_relocations Return an iterator over all Relocation removeremoveremoveremoveremoveremoveremove remove( self , dynamic_entry: lief._lief.ELF.DynamicEntry ) → None **remove( self , tag: lief._lief.ELF.DynamicEntry.TAG ) → None **remove( self , section: lief._lief.ELF.Section , clear: bool = False ) → None **remove( self , segment: lief._lief.ELF.Segment , clear: bool = False ) → None **remove( self , type: lief._lief.ELF.Segment.TYPE , clear: bool = False ) → None **remove( self , note: lief._lief.ELF.Note ) → None remove( self , type: lief._lief.ELF.Note.TYPE ) → None ********** Overloaded function. remove(self, dynamic_entry: lief._lief.ELF.DynamicEntry) -> None Remove the given DynamicEntry from the dynamic table remove(self, tag: lief._lief.ELF.DynamicEntry.TAG) -> None Remove all the DynamicEntry with the given TAG remove(self, section: lief._lief.ELF.Section, clear: bool = False) -> None Remove the given Section . The clear parameter specifies whether or not we must fill its content with 0 before removing remove(self, segment: lief._lief.ELF.Segment, clear: bool = False) -> None Remove the segment provided in parameter. If clear is set, the original content of the segment will be filled with zeros before removal. remove(self, type: lief._lief.ELF.Segment.TYPE, clear: bool = False) -> None Remove all segments with the given type. If clear is set, the original content of the segment will be filled with zeros before removal. remove(self, note: lief._lief.ELF.Note) -> None Remove the given Note remove(self, type: lief._lief.ELF.Note.TYPE) -> None Remove all the Note with the given TYPE remove_dynamic_symbolremove_dynamic_symbol remove_dynamic_symbol( self , arg: lief._lief.ELF.Symbol , / ) → None remove_dynamic_symbol( self , arg: str , / ) → None Overloaded function. remove_dynamic_symbol(self, arg: lief._lief.ELF.Symbol, /) -> None Remove the given Symbol from the .dynsym section remove_dynamic_symbol(self, arg: str, /) -> None Remove the Symbol with the name given in parameter from the .dynsym section remove_library remove_library( self , library_name: str ) → None Remove the given library remove_symtab_symbol remove_symtab_symbol( self , arg: lief._lief.ELF.Symbol , / ) → None Remove the given Symbol from the .symtab section remove_version_requirement remove_version_requirement( self , libname: str ) → bool Deletes all required symbol versions linked to the specified library name. The function returns true if the operation succeeds, false otherwise. Warning To maintain consistency, this function also removes versions associated with dynamic symbols that are linked to the specified library name. replace replace( self , new_segment: lief._lief.ELF.Segment , original_segment: lief._lief.ELF.Segment , base: int = 0 ) → lief._lief.ELF.Segment | None Replace the Segment given in 2nd parameter with the Segment given in the first parameter and return the updated segment. Warning The original_segment is no longer valid after this function section_from_offset section_from_offset( self , offset: int , skip_nobits: bool = True ) → lief._lief.ELF.Section | None Return the Section which encompasses the given offset. It returns None if a section can’t be found. If skip_nobits is set (which is the case by default), this function won’t consider sections for which the type is SHT_NOBITS (like .bss, .tbss, ... ) section_from_virtual_address section_from_virtual_address( self , address: int , skip_nobits: bool = True ) → lief._lief.ELF.Section | None Return the Section which encompasses the given virtual address. It returns None if a section can’t be found. If skip_nobits is set (which is the case by default), this function won’t consider sections for which the type is SHT_NOBITS (like .bss, .tbss, ... ) sections property sections → lief.ELF.Binary.it_sections Return an iterator over binary’s Section segment_from_offset segment_from_offset( self , offset: int ) → lief._lief.ELF.Segment | None Return the Segment which encompasses the given offset. It returns None if a segment can’t be found. segment_from_virtual_address segment_from_virtual_address( self , address: int ) → lief._lief.ELF.Segment | None Return the Segment which encompasses the given virtual address. It returns None if a segment can’t be found. segments property segments → lief.ELF.Binary.it_segments Return an iterator to binary’s Segment strings property strings → list[str | bytes] Return list of strings used in the current ELF file. Basically this function looks for strings in the .rodata section strip strip( self ) → None Strip the binary symbols property symbols → lief.ELF.Binary.it_dyn_symtab_symbols Return an iterator over both static and dynamic Symbol symbols_version property symbols_version → lief.ELF.Binary.it_symbols_version Return an iterator over SymbolVersion symbols_version_definition property symbols_version_definition → lief.ELF.Binary.it_symbols_version_definition Return an iterator to SymbolVersionDefinition symbols_version_requirement property symbols_version_requirement → lief.ELF.Binary.it_symbols_version_requirement Return an iterator to SymbolVersionRequirement symtab_idxsymtab_idx symtab_idx( self , name: str ) → int symtab_idx( self , symbol: lief._lief.ELF.Symbol ) → int Overloaded function. symtab_idx(self, name: str) -> int Get the symbol index in the .symtab section from the given name or return -1 if the symbol does not exist. symtab_idx(self, symbol: lief._lief.ELF.Symbol) -> int Get the symbol index in the .symtab section or return -1 if the symbol does not exist symtab_symbols property symtab_symbols → lief.ELF.Binary.it_symbols Return an iterator to static Symbol sysv_hash property sysv_hash → lief.ELF.SysvHash | None Return the SysvHash object Hashes are used by the loader to speed up symbol resolution (SYSV version) type property type → lief.ELF.Header.CLASS Return the binary’s ELF_CLASS use_gnu_hash property use_gnu_hash → bool True if GNU hash is used use_sysv_hash property use_sysv_hash → bool True if SYSV hash is used virtual_address_to_offset virtual_address_to_offset( self , virtual_address: int ) → int | lief._lief.lief_errors Convert the virtual address to a file offset virtual_size property virtual_size → int Return the size of the mapped binary writewrite write( self , output: str | os.PathLike ) → None write( self , output: str | os.PathLike , config: lief._lief.ELF.Builder.config_t ) → None Overloaded function. write(self, output: Union[str | os.PathLike]) -> None Rebuild the binary and write it in a file write(self, output: Union[str | os.PathLike], config: lief._lief.ELF.Builder.config_t) -> None Rebuild the binary with the given configuration and write it in a file write_to_byteswrite_to_bytes write_to_bytes( self , config: lief._lief.ELF.Builder.config_t ) → bytes write_to_bytes( self ) → bytes Header lief.ELF.Header class lief.ELF.Header( self ) Bases: Object Class which represents the ELF’s header. This class mirrors the raw ELF Elfxx_Ehdr structure. CLASS class CLASS( *values ) Bases: Enum Matches the result of Elfxx_Ehdr.e_ident[EI_CLASS] ELF32 ELF32 = 1 ELF64 ELF64 = 2 NONE NONE = 0 from_value from_value( arg: int ) → lief.ELF.Header.CLASS = ELF_DATA class ELF_DATA( *values ) Bases: Enum Matches the result of Elfxx_Ehdr.e_ident[EI_DATA] LSB LSB = 1 MSB MSB = 2 NONE NONE = 0 from_value from_value( arg: int ) → lief.ELF.Header.ELF_DATA = FILE_TYPE class FILE_TYPE( *values ) Bases: Enum The type of the underlying ELF file. This enum matches the semantic of ET_NONE , ET_REL , … CORE CORE = 4 DYN DYN = 3 EXEC EXEC = 2 NONE NONE = 0 REL REL = 1 from_value from_value( arg: int ) → lief.ELF.Header.FILE_TYPE = OS_ABI class OS_ABI( *values ) Bases: Enum AIX AIX = 7 AMDGPU_HSA AMDGPU_HSA = 64 ARM ARM = 97 AROS AROS = 15 C6000_LINUX C6000_LINUX = 65 CLOUDABI CLOUDABI = 17 FENIXOS FENIXOS = 16 FREEBSD FREEBSD = 9 HPUX HPUX = 1 HURD HURD = 4 IRIX IRIX = 8 LINUX LINUX = 3 MODESTO MODESTO = 11 NETBSD NETBSD = 2 NSK NSK = 14 OPENBSD OPENBSD = 12 OPENVMS OPENVMS = 13 SOLARIS SOLARIS = 6 STANDALONE STANDALONE = 255 SYSTEMV SYSTEMV = 0 TRU64 TRU64 = 10 from_value from_value( arg: int ) → lief.ELF.Header.OS_ABI = VERSION class VERSION( *values ) Bases: Enum Matches the result of Elfxx_Ehdr.e_version CURRENT CURRENT = 1 NONE NONE = 0 from_value from_value( arg: int ) → lief.ELF.Header.VERSION = entrypoint property entrypoint → int Return the binary entry point file_type property file_type → lief.ELF.Header.FILE_TYPE Return binary’s type. This field determines if the binary is an executable, a library… flags_list property flags_list → list[ lief.ELF.PROCESSOR_FLAGS ] Processor flags as a list has has( self , arg: lief._lief.ELF.PROCESSOR_FLAGS , / ) → bool Check if the given processor flag is present header_size property header_size → int Return the size of the ELF header This size should be 64 for an ELF64 binary and 52 for an ELF32 . identity property identity → list[int] Header’s identity. identity_abi_version property identity_abi_version → int Return the ABI version (integer). identity_class property identity_class → lief.ELF.Header.CLASS Header’s class. identity_data property identity_data → lief.ELF.Header.ELF_DATA Specify the data encoding identity_os_abi property identity_os_abi → lief.ELF.Header.OS_ABI Identifies the version of the ABI for which the object is prepared. identity_version property identity_version → lief.ELF.Header.VERSION is_mips_n64 property is_mips_n64 → bool Whether this header uses the MIPS n64 ELF encoding machine_type property machine_type → lief.ELF.ARCH Return the target architecture numberof_sections property numberof_sections → int Return the number of sections numberof_segments property numberof_segments → int Return the number of program headers (segments) object_file_version property object_file_version → lief.ELF.Header.VERSION Return the version processor_flag property processor_flag → int Processor-specific flags program_header_offset property program_header_offset → int Offset of program table (also known as segments table) program_header_size property program_header_size → int Return the size of the raw Elfxx_Phdr structure (see lief.ELF.Segment ) This size should be 56 for an ELF64 binary and 32 for an ELF32 . section_header_offset property section_header_offset → int Offset of section table section_header_size property section_header_size → int Return the size of the raw Elfxx_Shdr ( lief.ELF.Section ) This size should be 64 for an ELF64 binary and 40 for an ELF32 . section_name_table_idx property section_name_table_idx → int Return the section index which contains sections’ names Section lief.ELF.Sectionlief.ELF.Section class lief.ELF.Section( self ) class lief.ELF.Section( self , name: str , type: lief._lief.ELF.Section.TYPE = TYPE.PROGBITS ) Bases: Section Class which represents an ELF section. Overloaded function. __init__(self) -> None Default constructor __init__(self, name: str, type: lief._lief.ELF.Section.TYPE = TYPE.PROGBITS) -> None Constructor from a name and a section type FLAGS class FLAGS( *values ) Bases: Flag AARCH64_PURECODE AARCH64_PURECODE = 26306674688 ALLOC ALLOC = 2 ARM_PURECODE ARM_PURECODE = 22011707392 COMPRESSED COMPRESSED = 2048 EXCLUDE EXCLUDE = 2147483648 EXECINSTR EXECINSTR = 4 GNU_RETAIN GNU_RETAIN = 2097152 GROUP GROUP = 512 HEX_GPREL HEX_GPREL = 13153337344 INFO_LINK INFO_LINK = 64 LINK_ORDER LINK_ORDER = 128 MERGE MERGE = 16 MIPS_ADDR MIPS_ADDR = 18253611008 MIPS_GPREL MIPS_GPREL = 17448304640 MIPS_LOCAL MIPS_LOCAL = 17246978048 MIPS_MERGE MIPS_MERGE = 17716740096 MIPS_NAMES MIPS_NAMES = 17213423616 MIPS_NODUPES MIPS_NODUPES = 17196646400 MIPS_NOSTRIP MIPS_NOSTRIP = 17314086912 MIPS_STRING MIPS_STRING = 19327352832 NONE NONE = 0 OS_NONCONFORMING OS_NONCONFORMING = 256 STRINGS STRINGS = 32 TLS TLS = 1024 WRITE WRITE = 1 X86_64_LARGE X86_64_LARGE = 8858370048 XCORE_SHF_CP_SECTION XCORE_SHF_CP_SECTION = 4831838208 XCORE_SHF_DP_SECTION XCORE_SHF_DP_SECTION = 4563402752 from_value from_value( arg: int ) → lief.ELF.Section.FLAGS = TYPE class TYPE( *values ) Bases: Enum AARCH64_ATTRIBUTES AARCH64_ATTRIBUTES = 23353884675 AARCH64_AUTH_RELR AARCH64_AUTH_RELR = 23353884676 AARCH64_MEMTAG_GLOBALS_DYNAMIC AARCH64_MEMTAG_GLOBALS_DYNAMIC = 23353884680 AARCH64_MEMTAG_GLOBALS_STATIC AARCH64_MEMTAG_GLOBALS_STATIC = 23353884679 ANDROID_REL ANDROID_REL = 1610612737 ANDROID_RELA ANDROID_RELA = 1610612738 ANDROID_RELR ANDROID_RELR = 1879047936 ARM_ATTRIBUTES ARM_ATTRIBUTES = 6174015491 ARM_DEBUGOVERLAY ARM_DEBUGOVERLAY = 6174015492 ARM_EXIDX ARM_EXIDX = 6174015489 ARM_OVERLAYSECTION ARM_OVERLAYSECTION = 6174015493 ARM_PREEMPTMAP ARM_PREEMPTMAP = 6174015490 DYNAMIC DYNAMIC = 6 DYNSYM DYNSYM = 11 FINI_ARRAY FINI_ARRAY = 15 GNU_ATTRIBUTES GNU_ATTRIBUTES = 1879048181 GNU_HASH GNU_HASH = 1879048182 GNU_VERDEF GNU_VERDEF = 1879048189 GNU_VERNEED GNU_VERNEED = 1879048190 GNU_VERSYM GNU_VERSYM = 1879048191 GROUP GROUP = 17 HASH HASH = 5 HEX_ORDERED HEX_ORDERED = 10468982784 INIT_ARRAY INIT_ARRAY = 14 LLVM_ADDRSIG LLVM_ADDRSIG = 1879002115 MIPS_ABIFLAGS MIPS_ABIFLAGS = 14763950122 MIPS_AUXSYM MIPS_AUXSYM = 14763950102 MIPS_CONFLICT MIPS_CONFLICT = 14763950082 MIPS_CONTENT MIPS_CONTENT = 14763950092 MIPS_DEBUG MIPS_DEBUG = 14763950085 MIPS_DELTACLASS MIPS_DELTACLASS = 14763950109 MIPS_DELTADECL MIPS_DELTADECL = 14763950111 MIPS_DELTAINST MIPS_DELTAINST = 14763950108 MIPS_DELTASYM MIPS_DELTASYM = 14763950107 MIPS_DENSE MIPS_DENSE = 14763950099 MIPS_DWARF MIPS_DWARF = 14763950110 MIPS_EH_REGION MIPS_EH_REGION = 14763950119 MIPS_EVENTS MIPS_EVENTS = 14763950113 MIPS_EXTSYM MIPS_EXTSYM = 14763950098 MIPS_FDESC MIPS_FDESC = 14763950097 MIPS_GPTAB MIPS_GPTAB = 14763950083 MIPS_IFACE MIPS_IFACE = 14763950091 MIPS_LIBLIST MIPS_LIBLIST = 14763950080 MIPS_LINE MIPS_LINE = 14763950105 MIPS_LOCSTR MIPS_LOCSTR = 14763950104 MIPS_LOCSYM MIPS_LOCSYM = 14763950101 MIPS_MSYM MIPS_MSYM = 14763950081 MIPS_OPTIONS MIPS_OPTIONS = 14763950093 MIPS_OPTSYM MIPS_OPTSYM = 14763950103 MIPS_PACKAGE MIPS_PACKAGE = 14763950087 MIPS_PACKSYM MIPS_PACKSYM = 14763950088 MIPS_PDESC MIPS_PDESC = 14763950100 MIPS_PDR_EXCEPTION MIPS_PDR_EXCEPTION = 14763950121 MIPS_PIXIE MIPS_PIXIE = 14763950115 MIPS_REGINFO MIPS_REGINFO = 14763950086 MIPS_RELD MIPS_RELD = 14763950089 MIPS_RFDESC MIPS_RFDESC = 14763950106 MIPS_SHDR MIPS_SHDR = 14763950096 MIPS_SYMBOL_LIB MIPS_SYMBOL_LIB = 14763950112 MIPS_TRANSLATE MIPS_TRANSLATE = 14763950114 MIPS_UCODE MIPS_UCODE = 14763950084 MIPS_WHIRL MIPS_WHIRL = 14763950118 MIPS_XHASH MIPS_XHASH = 14763950123 MIPS_XLATE MIPS_XLATE = 14763950116 MIPS_XLATE_DEBUG MIPS_XLATE_DEBUG = 14763950117 MIPS_XLATE_OLD MIPS_XLATE_OLD = 14763950120 NOBITS NOBITS = 8 NOTE NOTE = 7 PREINIT_ARRAY PREINIT_ARRAY = 16 PROGBITS PROGBITS = 1 REL REL = 9 RELA RELA = 4 RELR RELR = 19 RISCV_ATTRIBUTES RISCV_ATTRIBUTES = 19058917379 SHLIB SHLIB = 10 SHT_NULL_ SHT_NULL_ = 0 STRTAB STRTAB = 3 SYMTAB SYMTAB = 2 SYMTAB_SHNDX SYMTAB_SHNDX = 18 X86_64_UNWIND X86_64_UNWIND = 10468982785 from_value from_value( arg: int ) → lief.ELF.Section.TYPE = add add( self , flag: lief._lief.ELF.Section.FLAGS ) → None Add the given flag to the list of flags alignment property alignment → int Section alignment as_frame as_frame( self ) → lief._lief.ELF.Section clear clear( self , value: int = 0 ) → lief._lief.ELF.Section Clear the content of the section with the given value entry_size property entry_size → int This property returns the size of an element in the case of a section that contains an array. Example: The .dynamic section contains an array of DynamicEntry . As the size of the raw C structure of this entry is 0x10 ( sizeof(Elf64_Dyn) ) in a ELF64, the entry_size , is set to this value. file_offset property file_offset → int Offset of the section’s content flags property flags → int Return the section’s flags as an integer flags_list property flags_list → list[ lief.ELF.Section.FLAGS ] Return section’s flags as a list hashas has( self , flag: lief._lief.ELF.Section.FLAGS ) → bool has( self , segment: lief._lief.ELF.Segment ) → bool Overloaded function. has(self, flag: lief._lief.ELF.Section.FLAGS) -> bool Check if the given flag is present has(self, segment: lief._lief.ELF.Segment) -> bool Check if the given Segment is present in segments information property information → int Section information (this value depends on the section) is_frame property is_frame → bool link property link → int Index to another section original_size property original_size → int Original size of the section’s data. This value is used by the Builder to determine if it needs to be relocated to avoid an overwrite of the data remove remove( self , flag: lief._lief.ELF.Section.FLAGS ) → None Remove the given flag from the list of flags segments property segments → lief.ELF.Section.it_segments Return segment(s) associated with the given section type property type → lief.ELF.Section.TYPE Return the type of the section Segment lief.ELF.Segment class lief.ELF.Segment( self ) Bases: Object Class which represents the ELF segments FLAGS class FLAGS( *values ) Bases: Flag NONE NONE = 0 R R = 4 W W = 2 X X = 1 from_value from_value( arg: int ) → lief.ELF.Segment.FLAGS = TYPE class TYPE( *values ) Bases: Enum AARCH64_MEMTAG_MTE AARCH64_MEMTAG_MTE = 19058917378 ARM_ARCHEXT ARM_ARCHEXT = 10468982784 ARM_EXIDX ARM_EXIDX = 10468982785 DYNAMIC DYNAMIC = 2 GNU_EH_FRAME GNU_EH_FRAME = 1685382480 GNU_PROPERTY GNU_PROPERTY = 1685382483 GNU_RELRO GNU_RELRO = 1685382482 GNU_STACK GNU_STACK = 1685382481 HP_CORE_COMM HP_CORE_COMM = 9007200865353732 HP_CORE_KERNEL HP_CORE_KERNEL = 9007200865353731 HP_CORE_LOADABLE HP_CORE_LOADABLE = 9007200865353734 HP_CORE_MMF HP_CORE_MMF = 9007200865353737 HP_CORE_NONE HP_CORE_NONE = 9007200865353729 HP_CORE_PROC HP_CORE_PROC = 9007200865353733 HP_CORE_SHM HP_CORE_SHM = 9007200865353736 HP_CORE_STACK HP_CORE_STACK = 9007200865353735 HP_CORE_UTSNAME HP_CORE_UTSNAME = 9007200865353749 HP_CORE_VERSION HP_CORE_VERSION = 9007200865353730 HP_FASTBIND HP_FASTBIND = 9007200865353745 HP_HSL_ANNOT HP_HSL_ANNOT = 9007200865353747 HP_OPT_ANNOT HP_OPT_ANNOT = 9007200865353746 HP_PARALLEL HP_PARALLEL = 9007200865353744 HP_STACK HP_STACK = 9007200865353748 HP_TLS HP_TLS = 9007200865353728 IA_64_EXT IA_64_EXT = 44828721152 IA_64_UNWIND IA_64_UNWIND = 44828721153 INTERP INTERP = 3 LOAD LOAD = 1 MIPS_ABIFLAGS MIPS_ABIFLAGS = 27648851971 MIPS_OPTIONS MIPS_OPTIONS = 27648851970 MIPS_REGINFO MIPS_REGINFO = 27648851968 MIPS_RTPROC MIPS_RTPROC = 27648851969 NOTE NOTE = 4 PAX_FLAGS PAX_FLAGS = 1694766464 PHDR PHDR = 6 PT_NULL_ PT_NULL_ = 0 RISCV_ATTRIBUTES RISCV_ATTRIBUTES = 36238786563 SHLIB SHLIB = 5 TLS TLS = 7 from_value from_value( arg: int ) → lief.ELF.Segment.TYPE = add add( self , flag: lief._lief.ELF.Segment.FLAGS ) → None Add the given flag to the list of flags alignment property alignment → int The offset alignment of the segment clear clear( self ) → None Clear the content of this segment content property content → memoryview The raw data associated with this segment. file_offset property file_offset → int The file offset of the data associated with this segment fill fill( self , value: str ) → None Fill the content of this segment with the value provided in parameter flags property flags → lief.ELF.Segment.FLAGS The flag permissions associated with this segment from_raw from_raw( arg: bytes ) → lief.ELF.Segment | lief.lief_errors = hashashas has( self , flag: lief._lief.ELF.Segment.FLAGS ) → bool **has( self , section: lief._lief.ELF.Section ) → bool has( self , section_name: str ) → bool ** Overloaded function. has(self, flag: lief._lief.ELF.Segment.FLAGS) -> bool Check if the given flag is present has(self, section: lief._lief.ELF.Section) -> bool Check if the given Section is present in sections has(self, section_name: str) -> bool Check if the given Section ‘s name is present in sections physical_address property physical_address → int The physical address of the segment. This value is not really relevant on systems like Linux or Android. On the other hand, Qualcomm trustlets might use this value. Usually this value matches virtual_address physical_size property physical_size → int The file size of the data associated with this segment raw_flags property raw_flags → int The flag permissions as an integer remove remove( self , flag: lief._lief.ELF.Segment.FLAGS ) → None Remove the given flag from the list of flags sections property sections → lief.ELF.Segment.it_sections Iterator over the Section wrapped by this segment type property type → lief.ELF.Segment.TYPE Segment’s type virtual_address property virtual_address → int The virtual address of the segment. Warning The ELF format specifications require the following relationship: [\\text{virtual address} \\equiv \\text{file offset} \\pmod{\\text{page size}} \\text{virtual address} \\equiv \\text{file offset} \\pmod{\\text{alignment}}] virtual_size property virtual_size → int The in-memory size of this segment. Usually, if the .bss segment is wrapped by this segment then, virtual_size is larger than physical_size Dynamic Entry lief.ELF.DynamicEntrylief.ELF.DynamicEntry class lief.ELF.DynamicEntry( self ) class lief.ELF.DynamicEntry( self , tag: lief._lief.ELF.DynamicEntry.TAG , value: int ) Bases: Object Class which represents an entry in the dynamic table These entries are located in the .dynamic section or the PT_DYNAMIC segment Overloaded function. __init__(self) -> None Default constructor __init__(self, tag: lief._lief.ELF.DynamicEntry.TAG, value: int) -> None Constructor from a TAG and value TAG class TAG( *values ) Bases: Enum AARCH64_BTI_PLT AARCH64_BTI_PLT = 10468982785 AARCH64_MEMTAG_GLOBALS AARCH64_MEMTAG_GLOBALS = 10468982797 AARCH64_MEMTAG_GLOBALSSZ AARCH64_MEMTAG_GLOBALSSZ = 10468982799 AARCH64_MEMTAG_HEAP AARCH64_MEMTAG_HEAP = 10468982795 AARCH64_MEMTAG_MODE AARCH64_MEMTAG_MODE = 10468982793 AARCH64_MEMTAG_STACK AARCH64_MEMTAG_STACK = 10468982796 AARCH64_PAC_PLT AARCH64_PAC_PLT = 10468982787 AARCH64_VARIANT_PCS AARCH64_VARIANT_PCS = 10468982789 ANDROID_REL ANDROID_REL = 1610612751 ANDROID_RELA ANDROID_RELA = 1610612753 ANDROID_RELASZ ANDROID_RELASZ = 1610612754 ANDROID_RELR ANDROID_RELR = 1879040000 ANDROID_RELRCOUNT ANDROID_RELRCOUNT = 1879040005 ANDROID_RELRENT ANDROID_RELRENT = 1879040003 ANDROID_RELRSZ ANDROID_RELRSZ = 1879040001 ANDROID_RELSZ ANDROID_RELSZ = 1610612752 ANDROID_REL_OFFSET ANDROID_REL_OFFSET = 1610612749 ANDROID_REL_SIZE ANDROID_REL_SIZE = 1610612750 AUXILIARY AUXILIARY = 2147483645 BIND_NOW BIND_NOW = 24 DEBUG_TAG DEBUG_TAG = 21 FILTER FILTER = 2147483647 FINI FINI = 13 FINI_ARRAY FINI_ARRAY = 26 FINI_ARRAYSZ FINI_ARRAYSZ = 28 FLAGS FLAGS = 30 FLAGS_1 FLAGS_1 = 1879048187 GNU_HASH GNU_HASH = 1879047925 HASH HASH = 4 HEXAGON_PLT HEXAGON_PLT = 14763950082 HEXAGON_SYMSZ HEXAGON_SYMSZ = 14763950080 HEXAGON_VER HEXAGON_VER = 14763950081 IA_64_PLT_RESERVE IA_64_PLT_RESERVE = 36238786560 IA_64_VMS_FIXUP_NEEDED IA_64_VMS_FIXUP_NEEDED = 35970351128 IA_64_VMS_FIXUP_RELA_CNT IA_64_VMS_FIXUP_RELA_CNT = 35970351126 IA_64_VMS_FIXUP_RELA_OFF IA_64_VMS_FIXUP_RELA_OFF = 35970351164 IA_64_VMS_FPMODE IA_64_VMS_FPMODE = 35970351170 IA_64_VMS_IDENT IA_64_VMS_IDENT = 35970351116 IA_64_VMS_IMGIOCNT IA_64_VMS_IMGIOCNT = 35970351106 IA_64_VMS_IMG_RELA_CNT IA_64_VMS_IMG_RELA_CNT = 35970351122 IA_64_VMS_IMG_RELA_OFF IA_64_VMS_IMG_RELA_OFF = 35970351160 IA_64_VMS_LINKTIME IA_64_VMS_LINKTIME = 35970351144 IA_64_VMS_LNKFLAGS IA_64_VMS_LNKFLAGS = 35970351112 IA_64_VMS_NEEDED_IDENT IA_64_VMS_NEEDED_IDENT = 35970351120 IA_64_VMS_PLTGOT_OFFSET IA_64_VMS_PLTGOT_OFFSET = 35970351166 IA_64_VMS_PLTGOT_SEG IA_64_VMS_PLTGOT_SEG = 35970351168 IA_64_VMS_SEG_NO IA_64_VMS_SEG_NO = 35970351146 IA_64_VMS_SEG_RELA_CNT IA_64_VMS_SEG_RELA_CNT = 35970351124 IA_64_VMS_SEG_RELA_OFF IA_64_VMS_SEG_RELA_OFF = 35970351162 IA_64_VMS_STACKSIZE IA_64_VMS_STACKSIZE = 35970351136 IA_64_VMS_STRTAB_OFFSET IA_64_VMS_STRTAB_OFFSET = 35970351156 IA_64_VMS_SUBTYPE IA_64_VMS_SUBTYPE = 35970351104 IA_64_VMS_SYMVEC_CNT IA_64_VMS_SYMVEC_CNT = 35970351130 IA_64_VMS_SYMVEC_OFFSET IA_64_VMS_SYMVEC_OFFSET = 35970351148 IA_64_VMS_SYMVEC_SEG IA_64_VMS_SYMVEC_SEG = 35970351150 IA_64_VMS_SYSVER_OFFSET IA_64_VMS_SYSVER_OFFSET = 35970351158 IA_64_VMS_UNWINDSZ IA_64_VMS_UNWINDSZ = 35970351138 IA_64_VMS_UNWIND_CODSEG IA_64_VMS_UNWIND_CODSEG = 35970351140 IA_64_VMS_UNWIND_INFOSEG IA_64_VMS_UNWIND_INFOSEG = 35970351142 IA_64_VMS_UNWIND_OFFSET IA_64_VMS_UNWIND_OFFSET = 35970351152 IA_64_VMS_UNWIND_SEG IA_64_VMS_UNWIND_SEG = 35970351154 IA_64_VMS_VIR_MEM_BLK_SIZ IA_64_VMS_VIR_MEM_BLK_SIZ = 35970351114 IA_64_VMS_XLATED IA_64_VMS_XLATED = 35970351134 INIT INIT = 12 INIT_ARRAY INIT_ARRAY = 25 INIT_ARRAYSZ INIT_ARRAYSZ = 27 JMPREL JMPREL = 23 MIPS_AUX_DYNAMIC MIPS_AUX_DYNAMIC = 6174015537 MIPS_BASE_ADDRESS MIPS_BASE_ADDRESS = 6174015494 MIPS_COMPACT_SIZE MIPS_COMPACT_SIZE = 6174015535 MIPS_CONFLICT MIPS_CONFLICT = 6174015496 MIPS_CONFLICTNO MIPS_CONFLICTNO = 6174015499 MIPS_CXX_FLAGS MIPS_CXX_FLAGS = 6174015522 MIPS_DELTA_CLASS MIPS_DELTA_CLASS = 6174015511 MIPS_DELTA_CLASSSYM MIPS_DELTA_CLASSSYM = 6174015520 MIPS_DELTA_CLASSSYM_NO MIPS_DELTA_CLASSSYM_NO = 6174015521 MIPS_DELTA_CLASS_NO MIPS_DELTA_CLASS_NO = 6174015512 MIPS_DELTA_INSTANCE MIPS_DELTA_INSTANCE = 6174015513 MIPS_DELTA_INSTANCE_NO MIPS_DELTA_INSTANCE_NO = 6174015514 MIPS_DELTA_RELOC MIPS_DELTA_RELOC = 6174015515 MIPS_DELTA_RELOC_NO MIPS_DELTA_RELOC_NO = 6174015516 MIPS_DELTA_SYM MIPS_DELTA_SYM = 6174015517 MIPS_DELTA_SYM_NO MIPS_DELTA_SYM_NO = 6174015518 MIPS_DYNSTR_ALIGN MIPS_DYNSTR_ALIGN = 6174015531 MIPS_FLAGS MIPS_FLAGS = 6174015493 MIPS_GOTSYM MIPS_GOTSYM = 6174015507 MIPS_GP_VALUE MIPS_GP_VALUE = 6174015536 MIPS_HIDDEN_GOTIDX MIPS_HIDDEN_GOTIDX = 6174015527 MIPS_HIPAGENO MIPS_HIPAGENO = 6174015508 MIPS_ICHECKSUM MIPS_ICHECKSUM = 6174015491 MIPS_INTERFACE MIPS_INTERFACE = 6174015530 MIPS_INTERFACE_SIZE MIPS_INTERFACE_SIZE = 6174015532 MIPS_IVERSION MIPS_IVERSION = 6174015492 MIPS_LIBLIST MIPS_LIBLIST = 6174015497 MIPS_LIBLISTNO MIPS_LIBLISTNO = 6174015504 MIPS_LOCALPAGE_GOTIDX MIPS_LOCALPAGE_GOTIDX = 6174015525 MIPS_LOCAL_GOTIDX MIPS_LOCAL_GOTIDX = 6174015526 MIPS_LOCAL_GOTNO MIPS_LOCAL_GOTNO = 6174015498 MIPS_MSYM MIPS_MSYM = 6174015495 MIPS_OPTIONS MIPS_OPTIONS = 6174015529 MIPS_PERF_SUFFIX MIPS_PERF_SUFFIX = 6174015534 MIPS_PIXIE_INIT MIPS_PIXIE_INIT = 6174015523 MIPS_PLTGOT MIPS_PLTGOT = 6174015538 MIPS_PROTECTED_GOTIDX MIPS_PROTECTED_GOTIDX = 6174015528 MIPS_RLD_MAP MIPS_RLD_MAP = 6174015510 MIPS_RLD_MAP_REL MIPS_RLD_MAP_REL = 6174015541 MIPS_RLD_TEXT_RESOLVE_ADDR MIPS_RLD_TEXT_RESOLVE_ADDR = 6174015533 MIPS_RLD_VERSION MIPS_RLD_VERSION = 6174015489 MIPS_RWPLT MIPS_RWPLT = 6174015540 MIPS_SYMBOL_LIB MIPS_SYMBOL_LIB = 6174015524 MIPS_SYMTABNO MIPS_SYMTABNO = 6174015505 MIPS_TIME_STAMP MIPS_TIME_STAMP = 6174015490 MIPS_UNREFEXTNO MIPS_UNREFEXTNO = 6174015506 MIPS_XHASH MIPS_XHASH = 6174015542 NEEDED NEEDED = 1 NULL NULL = 0 PLTGOT PLTGOT = 3 PLTREL PLTREL = 20 PLTRELSZ PLTRELSZ = 2 PPC64_GLINK PPC64_GLINK = 23353884672 PPC64_OPT PPC64_OPT = 23353884675 PPC_GOT PPC_GOT = 19058917376 PPC_OPT PPC_OPT = 19058917377 PREINIT_ARRAY PREINIT_ARRAY = 32 PREINIT_ARRAYSZ PREINIT_ARRAYSZ = 33 REL REL = 17 RELA RELA = 7 RELACOUNT RELACOUNT = 1879048185 RELAENT RELAENT = 9 RELASZ RELASZ = 8 RELCOUNT RELCOUNT = 1879048186 RELENT RELENT = 19 RELR RELR = 36 RELRENT RELRENT = 37 RELRSZ RELRSZ = 35 RELSZ RELSZ = 18 RISCV_VARIANT_CC RISCV_VARIANT_CC = 27648851971 RPATH RPATH = 15 RUNPATH RUNPATH = 29 SONAME SONAME = 14 STRSZ STRSZ = 10 STRTAB STRTAB = 5 SYMBOLIC SYMBOLIC = 16 SYMENT SYMENT = 11 SYMTAB SYMTAB = 6 SYMTAB_SHNDX SYMTAB_SHNDX = 34 TEXTREL TEXTREL = 22 TLSDESC_GOT TLSDESC_GOT = 1879047927 TLSDESC_PLT TLSDESC_PLT = 1879047926 UNKNOWN UNKNOWN = 18446744073709551615 VERDEF VERDEF = 1879048188 VERDEFNUM VERDEFNUM = 1879048189 VERNEED VERNEED = 1879048190 VERNEEDNUM VERNEEDNUM = 1879048191 VERSYM VERSYM = 1879048176 X86_64_PLT X86_64_PLT = 31943819264 X86_64_PLTENT X86_64_PLTENT = 31943819267 X86_64_PLTSZ X86_64_PLTSZ = 31943819265 from_value from_value( arg: int ) → lief.ELF.DynamicEntry.TAG = tag property tag → lief.ELF.DynamicEntry.TAG Return the entry’s TAG which represent the entry type value property value → int Return the entry’s value The meaning of the value strongly depends on the tag. It can be an offset, an index, a flag, … Dynamic Entry Library lief.ELF.DynamicEntryLibrary class lief.ELF.DynamicEntryLibrary( self , library_name: str ) Bases: DynamicEntry Class which represents a DT_NEEDED entry in the dynamic table. This kind of entry is usually used to create library dependency. Constructor from a library name name property name → str | bytes Library associated with this entry (e.g. libc.so.6 ) Dynamic Shared Object lief.ELF.DynamicSharedObject class lief.ELF.DynamicSharedObject( self , library_name: str ) Bases: DynamicEntry Class which represents a DT_SONAME entry in the dynamic table This kind of entry is usually used to name the original library. This entry is not present for executables. Constructor from library name name property name → str | bytes Return the library name Dynamic Entry Run Path lief.ELF.DynamicEntryRunPathlief.ELF.DynamicEntryRunPath class lief.ELF.DynamicEntryRunPath( self , path: str = '' ) class lief.ELF.DynamicEntryRunPath( self , paths: collections.abc.Sequence[str] ) Bases: DynamicEntry Class that represents a DT_RUNPATH which is used by the loader to resolve libraries ( DynamicEntryLibrary ). Overloaded function. __init__(self, path: str = '') -> None Constructor from a (run)path __init__(self, paths: collections.abc.Sequence[str]) -> None Constructor from a list of paths append append( self , path: str ) → lief._lief.ELF.DynamicEntryRunPath Append the given path insert insert( self , position: int , path: str ) → lief._lief.ELF.DynamicEntryRunPath Insert a path at the given position paths property paths → list[str] Paths as a list remove remove( self , path: str ) → lief._lief.ELF.DynamicEntryRunPath Remove the given path runpath property runpath → str | bytes Runpath raw value Dynamic Entry RPath lief.ELF.DynamicEntryRpathlief.ELF.DynamicEntryRpath class lief.ELF.DynamicEntryRpath( self , path: str = '' ) class lief.ELF.DynamicEntryRpath( self , paths: collections.abc.Sequence[str] ) Bases: DynamicEntry Class which represents a DT_RPATH entry. This attribute is deprecated (cf. man ld ) in favour of DT_RUNPATH (See DynamicEntryRunPath ) Overloaded function. __init__(self, path: str = '') -> None Constructor from (r)path __init__(self, paths: collections.abc.Sequence[str]) -> None Constructor from a list of paths append append( self , path: str ) → lief._lief.ELF.DynamicEntryRpath Append the given path insert insert( self , position: int , path: str ) → lief._lief.ELF.DynamicEntryRpath Insert a path at the given position paths property paths → list[str] Paths as a list remove remove( self , path: str ) → lief._lief.ELF.DynamicEntryRpath Remove the given path rpath property rpath → str | bytes The actual rpath as a string Dynamic Entry Array lief.ELF.DynamicEntryArray class lief.ELF.DynamicEntryArray( self , tag: lief._lief.ELF.DynamicEntry.TAG , array: collections.abc.Sequence[int] ) Bases: DynamicEntry Class that represents an array in the dynamic table. This entry is associated with constructors: - DT_PREINIT_ARRAY - DT_INIT_ARRAY - DT_FINI_ARRAY The underlying values are 64-bits integers to cover both: ELF32 and ELF64 binaries. append append( self , function: int ) → lief._lief.ELF.DynamicEntryArray Append the given function array property array → list[int] Return the array as a list of integers insert insert( self , pos: int , function: int ) → lief._lief.ELF.DynamicEntryArray Insert the given function at pos remove remove( self , function: int ) → lief._lief.ELF.DynamicEntryArray Remove the given function Dynamic Entry Flags lief.ELF.DynamicEntryFlags class lief.ELF.DynamicEntryFlags Bases: DynamicEntry FLAG class FLAG( *values ) Bases: Enum BIND_NOW BIND_NOW = 8 CONFALT CONFALT = 4294975488 DIRECT DIRECT = 4294967552 DISPRELDNE DISPRELDNE = 4295000064 DISPRELPND DISPRELPND = 4295032832 EDITED EDITED = 4297064448 ENDFILTEE ENDFILTEE = 4294983680 GLOBAL GLOBAL = 4294967298 GLOBAUDIT GLOBAUDIT = 4311744512 GROUP GROUP = 4294967300 HANDLE_ORIGIN HANDLE_ORIGIN = 4294967424 IGNMULDEF IGNMULDEF = 4295229440 INITFIRST INITFIRST = 4294967328 INTERPOSE INTERPOSE = 4294968320 KMOD KMOD = 4563402752 LOADFLTR LOADFLTR = 4294967312 NOCOMMON NOCOMMON = 5368709120 NODEFLIB NODEFLIB = 4294969344 NODELETE NODELETE = 4294967304 NODIRECT NODIRECT = 4295098368 NODUMP NODUMP = 4294971392 NOHDR NOHDR = 4296015872 NOKSYMS NOKSYMS = 4295491584 NOOPEN NOOPEN = 4294967360 NORELOC NORELOC = 4299161600 NOW NOW = 4294967297 ORIGIN ORIGIN = 1 PIE PIE = 4429185024 SINGLETON SINGLETON = 4328521728 STATIC_TLS STATIC_TLS = 16 SYMBOLIC SYMBOLIC = 2 SYMINTPOSE SYMINTPOSE = 4303355904 TEXTREL TEXTREL = 4 TRANS TRANS = 4294967808 WEAKFILTER WEAKFILTER = 4831838208 from_value from_value( arg: int ) → lief.ELF.DynamicEntryFlags.FLAG = add add( self , flag: lief._lief.ELF.DynamicEntryFlags.FLAG ) → None Add the given FLAG flags property flags → list[ lief.ELF.DynamicEntryFlags.FLAG ] Return list of FLAG has has( self , flag: lief._lief.ELF.DynamicEntryFlags.FLAG ) → bool Check if this entry contains the given FLAG remove remove( self , flag: lief._lief.ELF.DynamicEntryFlags.FLAG ) → None Remove the given FLAG Dynamic Entry Auxiliary lief.ELF.DynamicEntryAuxiliary class lief.ELF.DynamicEntryAuxiliary( self , library_name: str ) Bases: DynamicEntry Class which represents a DT_AUXILIARY entry in the dynamic table. This kind of entry is used to specify a shared object that should be loaded before the current one. Constructor from library name name property name → str | bytes Return the library name Dynamic Entry Filter lief.ELF.DynamicEntryFilter class lief.ELF.DynamicEntryFilter( self , library_name: str ) Bases: DynamicEntry Class which represents a DT_FILTER entry in the dynamic table. This kind of entry is used to specify a shared object for which the current one is a filter. Constructor from library name name property name → str | bytes Return the library name Relocations lief.ELF.Relocationlief.ELF.Relocationlief.ELF.Relocation class lief.ELF.Relocation( self ) **class lief.ELF.Relocation( self , arch: lief._lief.ELF.ARCH ) class lief.ELF.Relocation( self , address: int , type: lief._lief.ELF.Relocation.TYPE , encoding: lief._lief.ELF.Relocation.ENCODING ) ** Bases: Relocation Class that represents an ELF relocation. ENCODING class ENCODING( *values ) Bases: Enum ANDROID_SLEB ANDROID_SLEB = 4 REL REL = 1 RELA RELA = 2 RELR RELR = 3 UNKNOWN UNKNOWN = 0 from_value from_value( arg: int ) → lief.ELF.Relocation.ENCODING = PURPOSE class PURPOSE( *values ) Bases: Enum DYNAMIC DYNAMIC = 2 NONE NONE = 0 OBJECT OBJECT = 3 PLTGOT PLTGOT = 1 from_value from_value( arg: int ) → lief.ELF.Relocation.PURPOSE = TYPE class TYPE( *values ) Bases: Enum AARCH64_ABS16 AARCH64_ABS16 = 268435715 AARCH64_ABS32 AARCH64_ABS32 = 268435714 AARCH64_ABS64 AARCH64_ABS64 = 268435713 AARCH64_ADD_ABS_LO12_NC AARCH64_ADD_ABS_LO12_NC = 268435733 AARCH64_ADR_GOT_PAGE AARCH64_ADR_GOT_PAGE = 268435767 AARCH64_ADR_PREL_LO21 AARCH64_ADR_PREL_LO21 = 268435730 AARCH64_ADR_PREL_PG_HI21 AARCH64_ADR_PREL_PG_HI21 = 268435731 AARCH64_ADR_PREL_PG_HI21_NC AARCH64_ADR_PREL_PG_HI21_NC = 268435732 AARCH64_CALL26 AARCH64_CALL26 = 268435739 AARCH64_CONDBR19 AARCH64_CONDBR19 = 268435736 AARCH64_COPY AARCH64_COPY = 268436480 AARCH64_GLOB_DAT AARCH64_GLOB_DAT = 268436481 AARCH64_GOTREL32 AARCH64_GOTREL32 = 268435764 AARCH64_GOTREL64 AARCH64_GOTREL64 = 268435763 AARCH64_GOT_LD_PREL19 AARCH64_GOT_LD_PREL19 = 268435765 AARCH64_IRELATIVE AARCH64_IRELATIVE = 268436488 AARCH64_JUMP26 AARCH64_JUMP26 = 268435738 AARCH64_JUMP_SLOT AARCH64_JUMP_SLOT = 268436482 AARCH64_LD64_GOTOFF_LO15 AARCH64_LD64_GOTOFF_LO15 = 268435766 AARCH64_LD64_GOTPAGE_LO15 AARCH64_LD64_GOTPAGE_LO15 = 268435769 AARCH64_LD64_GOT_LO12_NC AARCH64_LD64_GOT_LO12_NC = 268435768 AARCH64_LDST128_ABS_LO12_NC AARCH64_LDST128_ABS_LO12_NC = 268435755 AARCH64_LDST16_ABS_LO12_NC AARCH64_LDST16_ABS_LO12_NC = 268435740 AARCH64_LDST32_ABS_LO12_NC AARCH64_LDST32_ABS_LO12_NC = 268435741 AARCH64_LDST64_ABS_LO12_NC AARCH64_LDST64_ABS_LO12_NC = 268435742 AARCH64_LDST8_ABS_LO12_NC AARCH64_LDST8_ABS_LO12_NC = 268435734 AARCH64_LD_PREL_LO19 AARCH64_LD_PREL_LO19 = 268435729 AARCH64_MOVW_GOTOFF_G0 AARCH64_MOVW_GOTOFF_G0 = 268435756 AARCH64_MOVW_GOTOFF_G0_NC AARCH64_MOVW_GOTOFF_G0_NC = 268435757 AARCH64_MOVW_GOTOFF_G1 AARCH64_MOVW_GOTOFF_G1 = 268435758 AARCH64_MOVW_GOTOFF_G1_NC AARCH64_MOVW_GOTOFF_G1_NC = 268435759 AARCH64_MOVW_GOTOFF_G2 AARCH64_MOVW_GOTOFF_G2 = 268435760 AARCH64_MOVW_GOTOFF_G2_NC AARCH64_MOVW_GOTOFF_G2_NC = 268435761 AARCH64_MOVW_GOTOFF_G3 AARCH64_MOVW_GOTOFF_G3 = 268435762 AARCH64_MOVW_PREL_G0 AARCH64_MOVW_PREL_G0 = 268435743 AARCH64_MOVW_PREL_G0_NC AARCH64_MOVW_PREL_G0_NC = 268435744 AARCH64_MOVW_PREL_G1 AARCH64_MOVW_PREL_G1 = 268435745 AARCH64_MOVW_PREL_G1_NC AARCH64_MOVW_PREL_G1_NC = 268435746 AARCH64_MOVW_PREL_G2 AARCH64_MOVW_PREL_G2 = 268435747 AARCH64_MOVW_PREL_G2_NC AARCH64_MOVW_PREL_G2_NC = 268435748 AARCH64_MOVW_PREL_G3 AARCH64_MOVW_PREL_G3 = 268435749 AARCH64_MOVW_SABS_G0 AARCH64_MOVW_SABS_G0 = 268435726 AARCH64_MOVW_SABS_G1 AARCH64_MOVW_SABS_G1 = 268435727 AARCH64_MOVW_SABS_G2 AARCH64_MOVW_SABS_G2 = 268435728 AARCH64_MOVW_UABS_G0 AARCH64_MOVW_UABS_G0 = 268435719 AARCH64_MOVW_UABS_G0_NC AARCH64_MOVW_UABS_G0_NC = 268435720 AARCH64_MOVW_UABS_G1 AARCH64_MOVW_UABS_G1 = 268435721 AARCH64_MOVW_UABS_G1_NC AARCH64_MOVW_UABS_G1_NC = 268435722 AARCH64_MOVW_UABS_G2 AARCH64_MOVW_UABS_G2 = 268435723 AARCH64_MOVW_UABS_G2_NC AARCH64_MOVW_UABS_G2_NC = 268435724 AARCH64_MOVW_UABS_G3 AARCH64_MOVW_UABS_G3 = 268435725 AARCH64_NONE AARCH64_NONE = 268435456 AARCH64_PREL16 AARCH64_PREL16 = 268435718 AARCH64_PREL32 AARCH64_PREL32 = 268435717 AARCH64_PREL64 AARCH64_PREL64 = 268435716 AARCH64_RELATIVE AARCH64_RELATIVE = 268436483 AARCH64_TLSDESC AARCH64_TLSDESC = 268436487 AARCH64_TLSDESC_ADD AARCH64_TLSDESC_ADD = 268436024 AARCH64_TLSDESC_ADD_LO12_NC AARCH64_TLSDESC_ADD_LO12_NC = 268436020 AARCH64_TLSDESC_ADR_PAGE21 AARCH64_TLSDESC_ADR_PAGE21 = 268436018 AARCH64_TLSDESC_ADR_PREL21 AARCH64_TLSDESC_ADR_PREL21 = 268436017 AARCH64_TLSDESC_CALL AARCH64_TLSDESC_CALL = 268436025 AARCH64_TLSDESC_LD64_LO12_NC AARCH64_TLSDESC_LD64_LO12_NC = 268436019 AARCH64_TLSDESC_LDR AARCH64_TLSDESC_LDR = 268436023 AARCH64_TLSDESC_LD_PREL19 AARCH64_TLSDESC_LD_PREL19 = 268436016 AARCH64_TLSDESC_OFF_G0_NC AARCH64_TLSDESC_OFF_G0_NC = 268436022 AARCH64_TLSDESC_OFF_G1 AARCH64_TLSDESC_OFF_G1 = 268436021 AARCH64_TLSGD_ADD_LO12_NC AARCH64_TLSGD_ADD_LO12_NC = 268435970 AARCH64_TLSGD_ADR_PAGE21 AARCH64_TLSGD_ADR_PAGE21 = 268435969 AARCH64_TLSGD_ADR_PREL21 AARCH64_TLSGD_ADR_PREL21 = 268435968 AARCH64_TLSGD_MOVW_G0_NC AARCH64_TLSGD_MOVW_G0_NC = 268435972 AARCH64_TLSGD_MOVW_G1 AARCH64_TLSGD_MOVW_G1 = 268435971 AARCH64_TLSIE_ADR_GOTTPREL_PAGE21 AARCH64_TLSIE_ADR_GOTTPREL_PAGE21 = 268435997 AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC = 268435998 AARCH64_TLSIE_LD_GOTTPREL_PREL19 AARCH64_TLSIE_LD_GOTTPREL_PREL19 = 268435999 AARCH64_TLSIE_MOVW_GOTTPREL_G0_NC AARCH64_TLSIE_MOVW_GOTTPREL_G0_NC = 268435996 AARCH64_TLSIE_MOVW_GOTTPREL_G1 AARCH64_TLSIE_MOVW_GOTTPREL_G1 = 268435995 AARCH64_TLSLD_ADD_DTPREL_HI12 AARCH64_TLSLD_ADD_DTPREL_HI12 = 268435984 AARCH64_TLSLD_ADD_DTPREL_LO12 AARCH64_TLSLD_ADD_DTPREL_LO12 = 268435985 AARCH64_TLSLD_ADD_DTPREL_LO12_NC AARCH64_TLSLD_ADD_DTPREL_LO12_NC = 268435986 AARCH64_TLSLD_ADD_LO12_NC AARCH64_TLSLD_ADD_LO12_NC = 268435975 AARCH64_TLSLD_ADR_PAGE21 AARCH64_TLSLD_ADR_PAGE21 = 268435974 AARCH64_TLSLD_ADR_PREL21 AARCH64_TLSLD_ADR_PREL21 = 268435973 AARCH64_TLSLD_LDST128_DTPREL_LO12 AARCH64_TLSLD_LDST128_DTPREL_LO12 = 268436028 AARCH64_TLSLD_LDST128_DTPREL_LO12_NC AARCH64_TLSLD_LDST128_DTPREL_LO12_NC = 268436029 AARCH64_TLSLD_LDST16_DTPREL_LO12 AARCH64_TLSLD_LDST16_DTPREL_LO12 = 268435989 AARCH64_TLSLD_LDST16_DTPREL_LO12_NC AARCH64_TLSLD_LDST16_DTPREL_LO12_NC = 268435990 AARCH64_TLSLD_LDST32_DTPREL_LO12 AARCH64_TLSLD_LDST32_DTPREL_LO12 = 268435991 AARCH64_TLSLD_LDST32_DTPREL_LO12_NC AARCH64_TLSLD_LDST32_DTPREL_LO12_NC = 268435992 AARCH64_TLSLD_LDST64_DTPREL_LO12 AARCH64_TLSLD_LDST64_DTPREL_LO12 = 268435993 AARCH64_TLSLD_LDST64_DTPREL_LO12_NC AARCH64_TLSLD_LDST64_DTPREL_LO12_NC = 268435994 AARCH64_TLSLD_LDST8_DTPREL_LO12 AARCH64_TLSLD_LDST8_DTPREL_LO12 = 268435987 AARCH64_TLSLD_LDST8_DTPREL_LO12_NC AARCH64_TLSLD_LDST8_DTPREL_LO12_NC = 268435988 AARCH64_TLSLD_LD_PREL19 AARCH64_TLSLD_LD_PREL19 = 268435978 AARCH64_TLSLD_MOVW_DTPREL_G0 AARCH64_TLSLD_MOVW_DTPREL_G0 = 268435982 AARCH64_TLSLD_MOVW_DTPREL_G0_NC AARCH64_TLSLD_MOVW_DTPREL_G0_NC = 268435983 AARCH64_TLSLD_MOVW_DTPREL_G1 AARCH64_TLSLD_MOVW_DTPREL_G1 = 268435980 AARCH64_TLSLD_MOVW_DTPREL_G1_NC AARCH64_TLSLD_MOVW_DTPREL_G1_NC = 268435981 AARCH64_TLSLD_MOVW_DTPREL_G2 AARCH64_TLSLD_MOVW_DTPREL_G2 = 268435979 AARCH64_TLSLD_MOVW_G0_NC AARCH64_TLSLD_MOVW_G0_NC = 268435977 AARCH64_TLSLD_MOVW_G1 AARCH64_TLSLD_MOVW_G1 = 268435976 AARCH64_TLSLE_ADD_TPREL_HI12 AARCH64_TLSLE_ADD_TPREL_HI12 = 268436005 AARCH64_TLSLE_ADD_TPREL_LO12 AARCH64_TLSLE_ADD_TPREL_LO12 = 268436006 AARCH64_TLSLE_ADD_TPREL_LO12_NC AARCH64_TLSLE_ADD_TPREL_LO12_NC = 268436007 AARCH64_TLSLE_LDST128_TPREL_LO12 AARCH64_TLSLE_LDST128_TPREL_LO12 = 268436026 AARCH64_TLSLE_LDST128_TPREL_LO12_NC AARCH64_TLSLE_LDST128_TPREL_LO12_NC = 268436027 AARCH64_TLSLE_LDST16_TPREL_LO12 AARCH64_TLSLE_LDST16_TPREL_LO12 = 268436010 AARCH64_TLSLE_LDST16_TPREL_LO12_NC AARCH64_TLSLE_LDST16_TPREL_LO12_NC = 268436011 AARCH64_TLSLE_LDST32_TPREL_LO12 AARCH64_TLSLE_LDST32_TPREL_LO12 = 268436012 AARCH64_TLSLE_LDST32_TPREL_LO12_NC AARCH64_TLSLE_LDST32_TPREL_LO12_NC = 268436013 AARCH64_TLSLE_LDST64_TPREL_LO12 AARCH64_TLSLE_LDST64_TPREL_LO12 = 268436014 AARCH64_TLSLE_LDST64_TPREL_LO12_NC AARCH64_TLSLE_LDST64_TPREL_LO12_NC = 268436015 AARCH64_TLSLE_LDST8_TPREL_LO12 AARCH64_TLSLE_LDST8_TPREL_LO12 = 268436008 AARCH64_TLSLE_LDST8_TPREL_LO12_NC AARCH64_TLSLE_LDST8_TPREL_LO12_NC = 268436009 AARCH64_TLSLE_MOVW_TPREL_G0 AARCH64_TLSLE_MOVW_TPREL_G0 = 268436003 AARCH64_TLSLE_MOVW_TPREL_G0_NC AARCH64_TLSLE_MOVW_TPREL_G0_NC = 268436004 AARCH64_TLSLE_MOVW_TPREL_G1 AARCH64_TLSLE_MOVW_TPREL_G1 = 268436001 AARCH64_TLSLE_MOVW_TPREL_G1_NC AARCH64_TLSLE_MOVW_TPREL_G1_NC = 268436002 AARCH64_TLSLE_MOVW_TPREL_G2 AARCH64_TLSLE_MOVW_TPREL_G2 = 268436000 AARCH64_TLS_DTPMOD64 AARCH64_TLS_DTPMOD64 = 268436485 AARCH64_TLS_DTPREL64 AARCH64_TLS_DTPREL64 = 268436484 AARCH64_TLS_TPREL64 AARCH64_TLS_TPREL64 = 268436486 AARCH64_TSTBR14 AARCH64_TSTBR14 = 268435735 ARM_ABS12 ARM_ABS12 = 402653190 ARM_ABS16 ARM_ABS16 = 402653189 ARM_ABS32 ARM_ABS32 = 402653186 ARM_ABS32_NOI ARM_ABS32_NOI = 402653239 ARM_ABS8 ARM_ABS8 = 402653192 ARM_ALU_PCREL_15_8 ARM_ALU_PCREL_15_8 = 402653217 ARM_ALU_PCREL_23_15 ARM_ALU_PCREL_23_15 = 402653218 ARM_ALU_PCREL_7_0 ARM_ALU_PCREL_7_0 = 402653216 ARM_ALU_PC_G0 ARM_ALU_PC_G0 = 402653242 ARM_ALU_PC_G0_NC ARM_ALU_PC_G0_NC = 402653241 ARM_ALU_PC_G1 ARM_ALU_PC_G1 = 402653244 ARM_ALU_PC_G1_NC ARM_ALU_PC_G1_NC = 402653243 ARM_ALU_PC_G2 ARM_ALU_PC_G2 = 402653245 ARM_ALU_SBREL_19_12_NC ARM_ALU_SBREL_19_12_NC = 402653220 ARM_ALU_SBREL_27_20_CK ARM_ALU_SBREL_27_20_CK = 402653221 ARM_ALU_SB_G0 ARM_ALU_SB_G0 = 402653255 ARM_ALU_SB_G0_NC ARM_ALU_SB_G0_NC = 402653254 ARM_ALU_SB_G1 ARM_ALU_SB_G1 = 402653257 ARM_ALU_SB_G1_NC ARM_ALU_SB_G1_NC = 402653256 ARM_ALU_SB_G2 ARM_ALU_SB_G2 = 402653258 ARM_BASE_ABS ARM_BASE_ABS = 402653215 ARM_BASE_PREL ARM_BASE_PREL = 402653209 ARM_BREL_ADJ ARM_BREL_ADJ = 402653196 ARM_CALL ARM_CALL = 402653212 ARM_COPY ARM_COPY = 402653204 ARM_GLOB_DAT ARM_GLOB_DAT = 402653205 ARM_GNU_VTENTRY ARM_GNU_VTENTRY = 402653284 ARM_GNU_VTINHERIT ARM_GNU_VTINHERIT = 402653285 ARM_GOTOFF12 ARM_GOTOFF12 = 402653282 ARM_GOTOFF32 ARM_GOTOFF32 = 402653208 ARM_GOTRELAX ARM_GOTRELAX = 402653283 ARM_GOT_ABS ARM_GOT_ABS = 402653279 ARM_GOT_BREL ARM_GOT_BREL = 402653210 ARM_GOT_BREL12 ARM_GOT_BREL12 = 402653281 ARM_GOT_PREL ARM_GOT_PREL = 402653280 ARM_IRELATIVE ARM_IRELATIVE = 402653344 ARM_JUMP24 ARM_JUMP24 = 402653213 ARM_JUMP_SLOT ARM_JUMP_SLOT = 402653206 ARM_LDC_PC_G0 ARM_LDC_PC_G0 = 402653251 ARM_LDC_PC_G1 ARM_LDC_PC_G1 = 402653252 ARM_LDC_PC_G2 ARM_LDC_PC_G2 = 402653253 ARM_LDC_SB_G0 ARM_LDC_SB_G0 = 402653265 ARM_LDC_SB_G1 ARM_LDC_SB_G1 = 402653266 ARM_LDC_SB_G2 ARM_LDC_SB_G2 = 402653267 ARM_LDRS_PC_G0 ARM_LDRS_PC_G0 = 402653248 ARM_LDRS_PC_G1 ARM_LDRS_PC_G1 = 402653249 ARM_LDRS_PC_G2 ARM_LDRS_PC_G2 = 402653250 ARM_LDRS_SB_G0 ARM_LDRS_SB_G0 = 402653262 ARM_LDRS_SB_G1 ARM_LDRS_SB_G1 = 402653263 ARM_LDRS_SB_G2 ARM_LDRS_SB_G2 = 402653264 ARM_LDR_PC_G0 ARM_LDR_PC_G0 = 402653188 ARM_LDR_PC_G1 ARM_LDR_PC_G1 = 402653246 ARM_LDR_PC_G2 ARM_LDR_PC_G2 = 402653247 ARM_LDR_SBREL_11_0_NC ARM_LDR_SBREL_11_0_NC = 402653219 ARM_LDR_SB_G0 ARM_LDR_SB_G0 = 402653259 ARM_LDR_SB_G1 ARM_LDR_SB_G1 = 402653260 ARM_LDR_SB_G2 ARM_LDR_SB_G2 = 402653261 ARM_ME_TOO ARM_ME_TOO = 402653312 ARM_MOVT_ABS ARM_MOVT_ABS = 402653228 ARM_MOVT_BREL ARM_MOVT_BREL = 402653269 ARM_MOVT_PREL ARM_MOVT_PREL = 402653230 ARM_MOVW_ABS_NC ARM_MOVW_ABS_NC = 402653227 ARM_MOVW_BREL ARM_MOVW_BREL = 402653270 ARM_MOVW_BREL_NC ARM_MOVW_BREL_NC = 402653268 ARM_MOVW_PREL_NC ARM_MOVW_PREL_NC = 402653229 ARM_NONE ARM_NONE = 402653184 ARM_PC24 ARM_PC24 = 402653185 ARM_PLT32 ARM_PLT32 = 402653211 ARM_PLT32_ABS ARM_PLT32_ABS = 402653278 ARM_PREL31 ARM_PREL31 = 402653226 ARM_PRIVATE_0 ARM_PRIVATE_0 = 402653296 ARM_PRIVATE_1 ARM_PRIVATE_1 = 402653297 ARM_PRIVATE_10 ARM_PRIVATE_10 = 402653306 ARM_PRIVATE_11 ARM_PRIVATE_11 = 402653307 ARM_PRIVATE_12 ARM_PRIVATE_12 = 402653308 ARM_PRIVATE_13 ARM_PRIVATE_13 = 402653309 ARM_PRIVATE_14 ARM_PRIVATE_14 = 402653310 ARM_PRIVATE_15 ARM_PRIVATE_15 = 402653311 ARM_PRIVATE_2 ARM_PRIVATE_2 = 402653298 ARM_PRIVATE_3 ARM_PRIVATE_3 = 402653299 ARM_PRIVATE_4 ARM_PRIVATE_4 = 402653300 ARM_PRIVATE_5 ARM_PRIVATE_5 = 402653301 ARM_PRIVATE_6 ARM_PRIVATE_6 = 402653302 ARM_PRIVATE_7 ARM_PRIVATE_7 = 402653303 ARM_PRIVATE_8 ARM_PRIVATE_8 = 402653304 ARM_PRIVATE_9 ARM_PRIVATE_9 = 402653305 ARM_RBASE ARM_RBASE = 402653438 ARM_REL32 ARM_REL32 = 402653187 ARM_REL32_NOI ARM_REL32_NOI = 402653240 ARM_RELATIVE ARM_RELATIVE = 402653207 ARM_RPC24 ARM_RPC24 = 402653437 ARM_RREL32 ARM_RREL32 = 402653436 ARM_RSBREL32 ARM_RSBREL32 = 402653434 ARM_RXPC25 ARM_RXPC25 = 402653433 ARM_SBREL31 ARM_SBREL31 = 402653223 ARM_SBREL32 ARM_SBREL32 = 402653193 ARM_TARGET1 ARM_TARGET1 = 402653222 ARM_TARGET2 ARM_TARGET2 = 402653225 ARM_THM_ABS5 ARM_THM_ABS5 = 402653191 ARM_THM_ALU_PREL_11_0 ARM_THM_ALU_PREL_11_0 = 402653237 ARM_THM_CALL ARM_THM_CALL = 402653194 ARM_THM_JUMP11 ARM_THM_JUMP11 = 402653286 ARM_THM_JUMP19 ARM_THM_JUMP19 = 402653235 ARM_THM_JUMP24 ARM_THM_JUMP24 = 402653214 ARM_THM_JUMP6 ARM_THM_JUMP6 = 402653236 ARM_THM_JUMP8 ARM_THM_JUMP8 = 402653287 ARM_THM_MOVT_ABS ARM_THM_MOVT_ABS = 402653232 ARM_THM_MOVT_BREL ARM_THM_MOVT_BREL = 402653272 ARM_THM_MOVT_PREL ARM_THM_MOVT_PREL = 402653234 ARM_THM_MOVW_ABS_NC ARM_THM_MOVW_ABS_NC = 402653231 ARM_THM_MOVW_BREL ARM_THM_MOVW_BREL = 402653273 ARM_THM_MOVW_BREL_NC ARM_THM_MOVW_BREL_NC = 402653271 ARM_THM_MOVW_PREL_NC ARM_THM_MOVW_PREL_NC = 402653233 ARM_THM_PC12 ARM_THM_PC12 = 402653238 ARM_THM_PC8 ARM_THM_PC8 = 402653195 ARM_THM_RPC22 ARM_THM_RPC22 = 402653435 ARM_THM_SWI8 ARM_THM_SWI8 = 402653198 ARM_THM_TLS_CALL ARM_THM_TLS_CALL = 402653277 ARM_THM_TLS_DESCSEQ16 ARM_THM_TLS_DESCSEQ16 = 402653313 ARM_THM_TLS_DESCSEQ32 ARM_THM_TLS_DESCSEQ32 = 402653314 ARM_THM_XPC22 ARM_THM_XPC22 = 402653200 ARM_TLS_CALL ARM_TLS_CALL = 402653275 ARM_TLS_DESC ARM_TLS_DESC = 402653197 ARM_TLS_DESCSEQ ARM_TLS_DESCSEQ = 402653276 ARM_TLS_DTPMOD32 ARM_TLS_DTPMOD32 = 402653201 ARM_TLS_DTPOFF32 ARM_TLS_DTPOFF32 = 402653202 ARM_TLS_GD32 ARM_TLS_GD32 = 402653288 ARM_TLS_GOTDESC ARM_TLS_GOTDESC = 402653274 ARM_TLS_IE12GP ARM_TLS_IE12GP = 402653295 ARM_TLS_IE32 ARM_TLS_IE32 = 402653291 ARM_TLS_LDM32 ARM_TLS_LDM32 = 402653289 ARM_TLS_LDO12 ARM_TLS_LDO12 = 402653293 ARM_TLS_LDO32 ARM_TLS_LDO32 = 402653290 ARM_TLS_LE12 ARM_TLS_LE12 = 402653294 ARM_TLS_LE32 ARM_TLS_LE32 = 402653292 ARM_TLS_TPOFF32 ARM_TLS_TPOFF32 = 402653203 ARM_V4BX ARM_V4BX = 402653224 ARM_XPC25 ARM_XPC25 = 402653199 BPF_64_32 BPF_64_32 = 1744830474 BPF_64_64 BPF_64_64 = 1744830465 BPF_64_ABS32 BPF_64_ABS32 = 1744830467 BPF_64_ABS64 BPF_64_ABS64 = 1744830466 BPF_64_NODYLD32 BPF_64_NODYLD32 = 1744830468 BPF_NONE BPF_NONE = 1744830464 HEX_10_X HEX_10_X = 536870938 HEX_11_X HEX_11_X = 536870937 HEX_12_X HEX_12_X = 536870936 HEX_16 HEX_16 = 536870919 HEX_16_X HEX_16_X = 536870935 HEX_32 HEX_32 = 536870918 HEX_32_6_X HEX_32_6_X = 536870929 HEX_32_PCREL HEX_32_PCREL = 536870943 HEX_6_PCREL_X HEX_6_PCREL_X = 536870977 HEX_6_X HEX_6_X = 536870942 HEX_7_X HEX_7_X = 536870941 HEX_8 HEX_8 = 536870920 HEX_8_X HEX_8_X = 536870940 HEX_9_X HEX_9_X = 536870939 HEX_B13_PCREL HEX_B13_PCREL = 536870926 HEX_B13_PCREL_X HEX_B13_PCREL_X = 536870932 HEX_B15_PCREL HEX_B15_PCREL = 536870914 HEX_B15_PCREL_X HEX_B15_PCREL_X = 536870931 HEX_B22_PCREL HEX_B22_PCREL = 536870913 HEX_B22_PCREL_X HEX_B22_PCREL_X = 536870930 HEX_B32_PCREL_X HEX_B32_PCREL_X = 536870928 HEX_B7_PCREL HEX_B7_PCREL = 536870915 HEX_B7_PCREL_X HEX_B7_PCREL_X = 536870934 HEX_B9_PCREL HEX_B9_PCREL = 536870927 HEX_B9_PCREL_X HEX_B9_PCREL_X = 536870933 HEX_COPY HEX_COPY = 536870944 HEX_DTPMOD_32 HEX_DTPMOD_32 = 536870956 HEX_DTPREL_11_X HEX_DTPREL_11_X = 536870986 HEX_DTPREL_16 HEX_DTPREL_16 = 536870960 HEX_DTPREL_16_X HEX_DTPREL_16_X = 536870985 HEX_DTPREL_32 HEX_DTPREL_32 = 536870959 HEX_DTPREL_32_6_X HEX_DTPREL_32_6_X = 536870984 HEX_DTPREL_HI16 HEX_DTPREL_HI16 = 536870958 HEX_DTPREL_LO16 HEX_DTPREL_LO16 = 536870957 HEX_GD_GOT_11_X HEX_GD_GOT_11_X = 536870989 HEX_GD_GOT_16 HEX_GD_GOT_16 = 536870965 HEX_GD_GOT_16_X HEX_GD_GOT_16_X = 536870988 HEX_GD_GOT_32 HEX_GD_GOT_32 = 536870964 HEX_GD_GOT_32_6_X HEX_GD_GOT_32_6_X = 536870987 HEX_GD_GOT_HI16 HEX_GD_GOT_HI16 = 536870963 HEX_GD_GOT_LO16 HEX_GD_GOT_LO16 = 536870962 HEX_GD_PLT_B22_PCREL HEX_GD_PLT_B22_PCREL = 536870961 HEX_GLOB_DAT HEX_GLOB_DAT = 536870945 HEX_GOTREL_11_X HEX_GOTREL_11_X = 536870980 HEX_GOTREL_16_X HEX_GOTREL_16_X = 536870979 HEX_GOTREL_32 HEX_GOTREL_32 = 536870951 HEX_GOTREL_32_6_X HEX_GOTREL_32_6_X = 536870978 HEX_GOTREL_HI16 HEX_GOTREL_HI16 = 536870950 HEX_GOTREL_LO16 HEX_GOTREL_LO16 = 536870949 HEX_GOT_11_X HEX_GOT_11_X = 536870983 HEX_GOT_16 HEX_GOT_16 = 536870955 HEX_GOT_16_X HEX_GOT_16_X = 536870982 HEX_GOT_32 HEX_GOT_32 = 536870954 HEX_GOT_32_6_X HEX_GOT_32_6_X = 536870981 HEX_GOT_HI16 HEX_GOT_HI16 = 536870953 HEX_GOT_LO16 HEX_GOT_LO16 = 536870952 HEX_GPREL16_0 HEX_GPREL16_0 = 536870921 HEX_GPREL16_1 HEX_GPREL16_1 = 536870922 HEX_GPREL16_2 HEX_GPREL16_2 = 536870923 HEX_GPREL16_3 HEX_GPREL16_3 = 536870924 HEX_HI16 HEX_HI16 = 536870917 HEX_HL16 HEX_HL16 = 536870925 HEX_IE_16_X HEX_IE_16_X = 536870991 HEX_IE_32 HEX_IE_32 = 536870968 HEX_IE_32_6_X HEX_IE_32_6_X = 536870990 HEX_IE_GOT_11_X HEX_IE_GOT_11_X = 536870994 HEX_IE_GOT_16 HEX_IE_GOT_16 = 536870972 HEX_IE_GOT_16_X HEX_IE_GOT_16_X = 536870993 HEX_IE_GOT_32 HEX_IE_GOT_32 = 536870971 HEX_IE_GOT_32_6_X HEX_IE_GOT_32_6_X = 536870992 HEX_IE_GOT_HI16 HEX_IE_GOT_HI16 = 536870970 HEX_IE_GOT_LO16 HEX_IE_GOT_LO16 = 536870969 HEX_IE_HI16 HEX_IE_HI16 = 536870967 HEX_IE_LO16 HEX_IE_LO16 = 536870966 HEX_JMP_SLOT HEX_JMP_SLOT = 536870946 HEX_LD_GOT_11_X HEX_LD_GOT_11_X = 536871005 HEX_LD_GOT_16 HEX_LD_GOT_16 = 536871002 HEX_LD_GOT_16_X HEX_LD_GOT_16_X = 536871004 HEX_LD_GOT_32 HEX_LD_GOT_32 = 536871001 HEX_LD_GOT_32_6_X HEX_LD_GOT_32_6_X = 536871003 HEX_LD_GOT_HI16 HEX_LD_GOT_HI16 = 536871000 HEX_LD_GOT_LO16 HEX_LD_GOT_LO16 = 536870999 HEX_LD_PLT_B22_PCREL HEX_LD_PLT_B22_PCREL = 536870998 HEX_LO16 HEX_LO16 = 536870916 HEX_NONE HEX_NONE = 536870912 HEX_PLT_B22_PCREL HEX_PLT_B22_PCREL = 536870948 HEX_RELATIVE HEX_RELATIVE = 536870947 HEX_TPREL_11_X HEX_TPREL_11_X = 536870997 HEX_TPREL_16 HEX_TPREL_16 = 536870976 HEX_TPREL_16_X HEX_TPREL_16_X = 536870996 HEX_TPREL_32 HEX_TPREL_32 = 536870975 HEX_TPREL_32_6_X HEX_TPREL_32_6_X = 536870995 HEX_TPREL_HI16 HEX_TPREL_HI16 = 536870974 HEX_TPREL_LO16 HEX_TPREL_LO16 = 536870973 LARCH_32 LARCH_32 = 805306369 LARCH_32_PCREL LARCH_32_PCREL = 805306467 LARCH_64 LARCH_64 = 805306370 LARCH_64_PCREL LARCH_64_PCREL = 805306477 LARCH_ABS64_HI12 LARCH_ABS64_HI12 = 805306438 LARCH_ABS64_LO20 LARCH_ABS64_LO20 = 805306437 LARCH_ABS_HI20 LARCH_ABS_HI20 = 805306435 LARCH_ABS_LO12 LARCH_ABS_LO12 = 805306436 LARCH_ADD16 LARCH_ADD16 = 805306416 LARCH_ADD24 LARCH_ADD24 = 805306417 LARCH_ADD32 LARCH_ADD32 = 805306418 LARCH_ADD6 LARCH_ADD6 = 805306473 LARCH_ADD64 LARCH_ADD64 = 805306419 LARCH_ADD8 LARCH_ADD8 = 805306415 LARCH_ADD_ULEB128 LARCH_ADD_ULEB128 = 805306475 LARCH_ALIGN LARCH_ALIGN = 805306470 LARCH_B16 LARCH_B16 = 805306432 LARCH_B21 LARCH_B21 = 805306433 LARCH_B26 LARCH_B26 = 805306434 LARCH_CALL36 LARCH_CALL36 = 805306478 LARCH_COPY LARCH_COPY = 805306372 LARCH_GNU_VTENTRY LARCH_GNU_VTENTRY = 805306426 LARCH_GNU_VTINHERIT LARCH_GNU_VTINHERIT = 805306425 LARCH_GOT64_HI12 LARCH_GOT64_HI12 = 805306450 LARCH_GOT64_LO20 LARCH_GOT64_LO20 = 805306449 LARCH_GOT64_PC_HI12 LARCH_GOT64_PC_HI12 = 805306446 LARCH_GOT64_PC_LO20 LARCH_GOT64_PC_LO20 = 805306445 LARCH_GOT_HI20 LARCH_GOT_HI20 = 805306447 LARCH_GOT_LO12 LARCH_GOT_LO12 = 805306448 LARCH_GOT_PC_HI20 LARCH_GOT_PC_HI20 = 805306443 LARCH_GOT_PC_LO12 LARCH_GOT_PC_LO12 = 805306444 LARCH_IRELATIVE LARCH_IRELATIVE = 805306380 LARCH_JUMP_SLOT LARCH_JUMP_SLOT = 805306373 LARCH_MARK_LA LARCH_MARK_LA = 805306388 LARCH_MARK_PCREL LARCH_MARK_PCREL = 805306389 LARCH_NONE LARCH_NONE = 805306368 LARCH_PCALA64_HI12 LARCH_PCALA64_HI12 = 805306442 LARCH_PCALA64_LO20 LARCH_PCALA64_LO20 = 805306441 LARCH_PCALA_HI20 LARCH_PCALA_HI20 = 805306439 LARCH_PCALA_LO12 LARCH_PCALA_LO12 = 805306440 LARCH_PCREL20_S2 LARCH_PCREL20_S2 = 805306471 LARCH_RELATIVE LARCH_RELATIVE = 805306371 LARCH_RELAX LARCH_RELAX = 805306468 LARCH_SOP_ADD LARCH_SOP_ADD = 805306403 LARCH_SOP_AND LARCH_SOP_AND = 805306404 LARCH_SOP_ASSERT LARCH_SOP_ASSERT = 805306398 LARCH_SOP_IF_ELSE LARCH_SOP_IF_ELSE = 805306405 LARCH_SOP_NOT LARCH_SOP_NOT = 805306399 LARCH_SOP_POP_32_S_0_10_10_16_S2 LARCH_SOP_POP_32_S_0_10_10_16_S2 = 805306413 LARCH_SOP_POP_32_S_0_5_10_16_S2 LARCH_SOP_POP_32_S_0_5_10_16_S2 = 805306412 LARCH_SOP_POP_32_S_10_12 LARCH_SOP_POP_32_S_10_12 = 805306408 LARCH_SOP_POP_32_S_10_16 LARCH_SOP_POP_32_S_10_16 = 805306409 LARCH_SOP_POP_32_S_10_16_S2 LARCH_SOP_POP_32_S_10_16_S2 = 805306410 LARCH_SOP_POP_32_S_10_5 LARCH_SOP_POP_32_S_10_5 = 805306406 LARCH_SOP_POP_32_S_5_20 LARCH_SOP_POP_32_S_5_20 = 805306411 LARCH_SOP_POP_32_U LARCH_SOP_POP_32_U = 805306414 LARCH_SOP_POP_32_U_10_12 LARCH_SOP_POP_32_U_10_12 = 805306407 LARCH_SOP_PUSH_ABSOLUTE LARCH_SOP_PUSH_ABSOLUTE = 805306391 LARCH_SOP_PUSH_DUP LARCH_SOP_PUSH_DUP = 805306392 LARCH_SOP_PUSH_GPREL LARCH_SOP_PUSH_GPREL = 805306393 LARCH_SOP_PUSH_PCREL LARCH_SOP_PUSH_PCREL = 805306390 LARCH_SOP_PUSH_PLT_PCREL LARCH_SOP_PUSH_PLT_PCREL = 805306397 LARCH_SOP_PUSH_TLS_GD LARCH_SOP_PUSH_TLS_GD = 805306396 LARCH_SOP_PUSH_TLS_GOT LARCH_SOP_PUSH_TLS_GOT = 805306395 LARCH_SOP_PUSH_TLS_TPREL LARCH_SOP_PUSH_TLS_TPREL = 805306394 LARCH_SOP_SL LARCH_SOP_SL = 805306401 LARCH_SOP_SR LARCH_SOP_SR = 805306402 LARCH_SOP_SUB LARCH_SOP_SUB = 805306400 LARCH_SUB16 LARCH_SUB16 = 805306421 LARCH_SUB24 LARCH_SUB24 = 805306422 LARCH_SUB32 LARCH_SUB32 = 805306423 LARCH_SUB6 LARCH_SUB6 = 805306474 LARCH_SUB64 LARCH_SUB64 = 805306424 LARCH_SUB8 LARCH_SUB8 = 805306420 LARCH_SUB_ULEB128 LARCH_SUB_ULEB128 = 805306476 LARCH_TLS_DESC32 LARCH_TLS_DESC32 = 805306381 LARCH_TLS_DESC64 LARCH_TLS_DESC64 = 805306382 LARCH_TLS_DESC64_HI12 LARCH_TLS_DESC64_HI12 = 805306486 LARCH_TLS_DESC64_LO20 LARCH_TLS_DESC64_LO20 = 805306485 LARCH_TLS_DESC64_PC_HI12 LARCH_TLS_DESC64_PC_HI12 = 805306482 LARCH_TLS_DESC64_PC_LO20 LARCH_TLS_DESC64_PC_LO20 = 805306481 LARCH_TLS_DESC_CALL LARCH_TLS_DESC_CALL = 805306488 LARCH_TLS_DESC_HI20 LARCH_TLS_DESC_HI20 = 805306483 LARCH_TLS_DESC_LD LARCH_TLS_DESC_LD = 805306487 LARCH_TLS_DESC_LO12 LARCH_TLS_DESC_LO12 = 805306484 LARCH_TLS_DESC_PCREL20_S2 LARCH_TLS_DESC_PCREL20_S2 = 805306494 LARCH_TLS_DESC_PC_HI20 LARCH_TLS_DESC_PC_HI20 = 805306479 LARCH_TLS_DESC_PC_LO12 LARCH_TLS_DESC_PC_LO12 = 805306480 LARCH_TLS_DTPMOD32 LARCH_TLS_DTPMOD32 = 805306374 LARCH_TLS_DTPMOD64 LARCH_TLS_DTPMOD64 = 805306375 LARCH_TLS_DTPREL32 LARCH_TLS_DTPREL32 = 805306376 LARCH_TLS_DTPREL64 LARCH_TLS_DTPREL64 = 805306377 LARCH_TLS_GD_HI20 LARCH_TLS_GD_HI20 = 805306466 LARCH_TLS_GD_PCREL20_S2 LARCH_TLS_GD_PCREL20_S2 = 805306493 LARCH_TLS_GD_PC_HI20 LARCH_TLS_GD_PC_HI20 = 805306465 LARCH_TLS_IE64_HI12 LARCH_TLS_IE64_HI12 = 805306462 LARCH_TLS_IE64_LO20 LARCH_TLS_IE64_LO20 = 805306461 LARCH_TLS_IE64_PC_HI12 LARCH_TLS_IE64_PC_HI12 = 805306458 LARCH_TLS_IE64_PC_LO20 LARCH_TLS_IE64_PC_LO20 = 805306457 LARCH_TLS_IE_HI20 LARCH_TLS_IE_HI20 = 805306459 LARCH_TLS_IE_LO12 LARCH_TLS_IE_LO12 = 805306460 LARCH_TLS_IE_PC_HI20 LARCH_TLS_IE_PC_HI20 = 805306455 LARCH_TLS_IE_PC_LO12 LARCH_TLS_IE_PC_LO12 = 805306456 LARCH_TLS_LD_HI20 LARCH_TLS_LD_HI20 = 805306464 LARCH_TLS_LD_PCREL20_S2 LARCH_TLS_LD_PCREL20_S2 = 805306492 LARCH_TLS_LD_PC_HI20 LARCH_TLS_LD_PC_HI20 = 805306463 LARCH_TLS_LE64_HI12 LARCH_TLS_LE64_HI12 = 805306454 LARCH_TLS_LE64_LO20 LARCH_TLS_LE64_LO20 = 805306453 LARCH_TLS_LE_ADD_R LARCH_TLS_LE_ADD_R = 805306490 LARCH_TLS_LE_HI20 LARCH_TLS_LE_HI20 = 805306451 LARCH_TLS_LE_HI20_R LARCH_TLS_LE_HI20_R = 805306489 LARCH_TLS_LE_LO12 LARCH_TLS_LE_LO12 = 805306452 LARCH_TLS_LE_LO12_R LARCH_TLS_LE_LO12_R = 805306491 LARCH_TLS_TPREL32 LARCH_TLS_TPREL32 = 805306378 LARCH_TLS_TPREL64 LARCH_TLS_TPREL64 = 805306379 MICROMIPS_26_S1 MICROMIPS_26_S1 = 939524229 MICROMIPS_CALL16 MICROMIPS_CALL16 = 939524238 MICROMIPS_CALL_HI16 MICROMIPS_CALL_HI16 = 939524249 MICROMIPS_CALL_LO16 MICROMIPS_CALL_LO16 = 939524250 MICROMIPS_GOT16 MICROMIPS_GOT16 = 939524234 MICROMIPS_GOT_DISP MICROMIPS_GOT_DISP = 939524241 MICROMIPS_GOT_HI16 MICROMIPS_GOT_HI16 = 939524244 MICROMIPS_GOT_LO16 MICROMIPS_GOT_LO16 = 939524245 MICROMIPS_GOT_OFST MICROMIPS_GOT_OFST = 939524243 MICROMIPS_GOT_PAGE MICROMIPS_GOT_PAGE = 939524242 MICROMIPS_GPREL16 MICROMIPS_GPREL16 = 939524232 MICROMIPS_GPREL7_S2 MICROMIPS_GPREL7_S2 = 939524268 MICROMIPS_HI0_LO16 MICROMIPS_HI0_LO16 = 939524253 MICROMIPS_HI16 MICROMIPS_HI16 = 939524230 MICROMIPS_HIGHER MICROMIPS_HIGHER = 939524247 MICROMIPS_HIGHEST MICROMIPS_HIGHEST = 939524248 MICROMIPS_JALR MICROMIPS_JALR = 939524252 MICROMIPS_LITERAL MICROMIPS_LITERAL = 939524233 MICROMIPS_LO16 MICROMIPS_LO16 = 939524231 MICROMIPS_PC10_S1 MICROMIPS_PC10_S1 = 939524236 MICROMIPS_PC16_S1 MICROMIPS_PC16_S1 = 939524237 MICROMIPS_PC18_S3 MICROMIPS_PC18_S3 = 939524272 MICROMIPS_PC19_S2 MICROMIPS_PC19_S2 = 939524273 MICROMIPS_PC21_S2 MICROMIPS_PC21_S2 = 939524270 MICROMIPS_PC23_S2 MICROMIPS_PC23_S2 = 939524269 MICROMIPS_PC26_S2 MICROMIPS_PC26_S2 = 939524271 MICROMIPS_PC7_S1 MICROMIPS_PC7_S1 = 939524235 MICROMIPS_SCN_DISP MICROMIPS_SCN_DISP = 939524251 MICROMIPS_SUB MICROMIPS_SUB = 939524246 MICROMIPS_TLS_DTPREL_HI16 MICROMIPS_TLS_DTPREL_HI16 = 939524260 MICROMIPS_TLS_DTPREL_LO16 MICROMIPS_TLS_DTPREL_LO16 = 939524261 MICROMIPS_TLS_GD MICROMIPS_TLS_GD = 939524258 MICROMIPS_TLS_GOTTPREL MICROMIPS_TLS_GOTTPREL = 939524262 MICROMIPS_TLS_LDM MICROMIPS_TLS_LDM = 939524259 MICROMIPS_TLS_TPREL_HI16 MICROMIPS_TLS_TPREL_HI16 = 939524265 MICROMIPS_TLS_TPREL_LO16 MICROMIPS_TLS_TPREL_LO16 = 939524266 MIPS16_26 MIPS16_26 = 939524196 MIPS16_CALL16 MIPS16_CALL16 = 939524199 MIPS16_GOT16 MIPS16_GOT16 = 939524198 MIPS16_GPREL MIPS16_GPREL = 939524197 MIPS16_HI16 MIPS16_HI16 = 939524200 MIPS16_LO16 MIPS16_LO16 = 939524201 MIPS16_TLS_DTPREL_HI16 MIPS16_TLS_DTPREL_HI16 = 939524204 MIPS16_TLS_DTPREL_LO16 MIPS16_TLS_DTPREL_LO16 = 939524205 MIPS16_TLS_GD MIPS16_TLS_GD = 939524202 MIPS16_TLS_GOTTPREL MIPS16_TLS_GOTTPREL = 939524206 MIPS16_TLS_LDM MIPS16_TLS_LDM = 939524203 MIPS16_TLS_TPREL_HI16 MIPS16_TLS_TPREL_HI16 = 939524207 MIPS16_TLS_TPREL_LO16 MIPS16_TLS_TPREL_LO16 = 939524208 MIPS_16 MIPS_16 = 939524097 MIPS_26 MIPS_26 = 939524100 MIPS_32 MIPS_32 = 939524098 MIPS_64 MIPS_64 = 939524114 MIPS_ADD_IMMEDIATE MIPS_ADD_IMMEDIATE = 939524130 MIPS_CALL16 MIPS_CALL16 = 939524107 MIPS_CALL_HI16 MIPS_CALL_HI16 = 939524126 MIPS_CALL_LO16 MIPS_CALL_LO16 = 939524127 MIPS_COPY MIPS_COPY = 939524222 MIPS_DELETE MIPS_DELETE = 939524123 MIPS_EH MIPS_EH = 939524345 MIPS_GLOB_DAT MIPS_GLOB_DAT = 939524147 MIPS_GOT16 MIPS_GOT16 = 939524105 MIPS_GOT_DISP MIPS_GOT_DISP = 939524115 MIPS_GOT_HI16 MIPS_GOT_HI16 = 939524118 MIPS_GOT_LO16 MIPS_GOT_LO16 = 939524119 MIPS_GOT_OFST MIPS_GOT_OFST = 939524117 MIPS_GOT_PAGE MIPS_GOT_PAGE = 939524116 MIPS_GPREL16 MIPS_GPREL16 = 939524103 MIPS_GPREL32 MIPS_GPREL32 = 939524108 MIPS_HI16 MIPS_HI16 = 939524101 MIPS_HIGHER MIPS_HIGHER = 939524124 MIPS_HIGHEST MIPS_HIGHEST = 939524125 MIPS_INSERT_A MIPS_INSERT_A = 939524121 MIPS_INSERT_B MIPS_INSERT_B = 939524122 MIPS_JALR MIPS_JALR = 939524133 MIPS_JUMP_SLOT MIPS_JUMP_SLOT = 939524223 MIPS_LITERAL MIPS_LITERAL = 939524104 MIPS_LO16 MIPS_LO16 = 939524102 MIPS_NONE MIPS_NONE = 939524096 MIPS_NUM MIPS_NUM = 939524314 MIPS_PC16 MIPS_PC16 = 939524106 MIPS_PC18_S3 MIPS_PC18_S3 = 939524158 MIPS_PC19_S2 MIPS_PC19_S2 = 939524159 MIPS_PC21_S2 MIPS_PC21_S2 = 939524156 MIPS_PC26_S2 MIPS_PC26_S2 = 939524157 MIPS_PC32 MIPS_PC32 = 939524344 MIPS_PCHI16 MIPS_PCHI16 = 939524160 MIPS_PCLO16 MIPS_PCLO16 = 939524161 MIPS_PJUMP MIPS_PJUMP = 939524131 MIPS_REL16 MIPS_REL16 = 939524129 MIPS_REL32 MIPS_REL32 = 939524099 MIPS_RELGOT MIPS_RELGOT = 939524132 MIPS_SCN_DISP MIPS_SCN_DISP = 939524128 MIPS_SHIFT5 MIPS_SHIFT5 = 939524112 MIPS_SHIFT6 MIPS_SHIFT6 = 939524113 MIPS_SUB MIPS_SUB = 939524120 MIPS_TLS_DTPMOD32 MIPS_TLS_DTPMOD32 = 939524134 MIPS_TLS_DTPMOD64 MIPS_TLS_DTPMOD64 = 939524136 MIPS_TLS_DTPREL32 MIPS_TLS_DTPREL32 = 939524135 MIPS_TLS_DTPREL64 MIPS_TLS_DTPREL64 = 939524137 MIPS_TLS_DTPREL_HI16 MIPS_TLS_DTPREL_HI16 = 939524140 MIPS_TLS_DTPREL_LO16 MIPS_TLS_DTPREL_LO16 = 939524141 MIPS_TLS_GD MIPS_TLS_GD = 939524138 MIPS_TLS_GOTTPREL MIPS_TLS_GOTTPREL = 939524142 MIPS_TLS_LDM MIPS_TLS_LDM = 939524139 MIPS_TLS_TPREL32 MIPS_TLS_TPREL32 = 939524143 MIPS_TLS_TPREL64 MIPS_TLS_TPREL64 = 939524144 MIPS_TLS_TPREL_HI16 MIPS_TLS_TPREL_HI16 = 939524145 MIPS_TLS_TPREL_LO16 MIPS_TLS_TPREL_LO16 = 939524146 MIPS_UNUSED1 MIPS_UNUSED1 = 939524109 MIPS_UNUSED2 MIPS_UNUSED2 = 939524110 MIPS_UNUSED3 MIPS_UNUSED3 = 939524111 PPC64_ADDR14 PPC64_ADDR14 = 1207959559 PPC64_ADDR14_BRNTAKEN PPC64_ADDR14_BRNTAKEN = 1207959561 PPC64_ADDR14_BRTAKEN PPC64_ADDR14_BRTAKEN = 1207959560 PPC64_ADDR16 PPC64_ADDR16 = 1207959555 PPC64_ADDR16_DS PPC64_ADDR16_DS = 1207959608 PPC64_ADDR16_HA PPC64_ADDR16_HA = 1207959558 PPC64_ADDR16_HI PPC64_ADDR16_HI = 1207959557 PPC64_ADDR16_HIGHER PPC64_ADDR16_HIGHER = 1207959591 PPC64_ADDR16_HIGHERA PPC64_ADDR16_HIGHERA = 1207959592 PPC64_ADDR16_HIGHEST PPC64_ADDR16_HIGHEST = 1207959593 PPC64_ADDR16_HIGHESTA PPC64_ADDR16_HIGHESTA = 1207959594 PPC64_ADDR16_LO PPC64_ADDR16_LO = 1207959556 PPC64_ADDR16_LO_DS PPC64_ADDR16_LO_DS = 1207959609 PPC64_ADDR24 PPC64_ADDR24 = 1207959554 PPC64_ADDR32 PPC64_ADDR32 = 1207959553 PPC64_ADDR64 PPC64_ADDR64 = 1207959590 PPC64_DTPMOD64 PPC64_DTPMOD64 = 1207959620 PPC64_DTPREL16 PPC64_DTPREL16 = 1207959626 PPC64_DTPREL16_DS PPC64_DTPREL16_DS = 1207959653 PPC64_DTPREL16_HA PPC64_DTPREL16_HA = 1207959629 PPC64_DTPREL16_HI PPC64_DTPREL16_HI = 1207959628 PPC64_DTPREL16_HIGHER PPC64_DTPREL16_HIGHER = 1207959655 PPC64_DTPREL16_HIGHERA PPC64_DTPREL16_HIGHERA = 1207959656 PPC64_DTPREL16_HIGHEST PPC64_DTPREL16_HIGHEST = 1207959657 PPC64_DTPREL16_HIGHESTA PPC64_DTPREL16_HIGHESTA = 1207959658 PPC64_DTPREL16_LO PPC64_DTPREL16_LO = 1207959627 PPC64_DTPREL16_LO_DS PPC64_DTPREL16_LO_DS = 1207959654 PPC64_DTPREL64 PPC64_DTPREL64 = 1207959630 PPC64_GOT16 PPC64_GOT16 = 1207959566 PPC64_GOT16_DS PPC64_GOT16_DS = 1207959610 PPC64_GOT16_HA PPC64_GOT16_HA = 1207959569 PPC64_GOT16_HI PPC64_GOT16_HI = 1207959568 PPC64_GOT16_LO PPC64_GOT16_LO = 1207959567 PPC64_GOT16_LO_DS PPC64_GOT16_LO_DS = 1207959611 PPC64_GOT_DTPREL16_DS PPC64_GOT_DTPREL16_DS = 1207959643 PPC64_GOT_DTPREL16_HA PPC64_GOT_DTPREL16_HA = 1207959646 PPC64_GOT_DTPREL16_HI PPC64_GOT_DTPREL16_HI = 1207959645 PPC64_GOT_DTPREL16_LO_DS PPC64_GOT_DTPREL16_LO_DS = 1207959644 PPC64_GOT_TLSGD16 PPC64_GOT_TLSGD16 = 1207959631 PPC64_GOT_TLSGD16_HA PPC64_GOT_TLSGD16_HA = 1207959634 PPC64_GOT_TLSGD16_HI PPC64_GOT_TLSGD16_HI = 1207959633 PPC64_GOT_TLSGD16_LO PPC64_GOT_TLSGD16_LO = 1207959632 PPC64_GOT_TLSLD16 PPC64_GOT_TLSLD16 = 1207959635 PPC64_GOT_TLSLD16_HA PPC64_GOT_TLSLD16_HA = 1207959638 PPC64_GOT_TLSLD16_HI PPC64_GOT_TLSLD16_HI = 1207959637 PPC64_GOT_TLSLD16_LO PPC64_GOT_TLSLD16_LO = 1207959636 PPC64_GOT_TPREL16_DS PPC64_GOT_TPREL16_DS = 1207959639 PPC64_GOT_TPREL16_HA PPC64_GOT_TPREL16_HA = 1207959642 PPC64_GOT_TPREL16_HI PPC64_GOT_TPREL16_HI = 1207959641 PPC64_GOT_TPREL16_LO_DS PPC64_GOT_TPREL16_LO_DS = 1207959640 PPC64_JMP_SLOT PPC64_JMP_SLOT = 1207959573 PPC64_NONE PPC64_NONE = 1207959552 PPC64_REL14 PPC64_REL14 = 1207959563 PPC64_REL14_BRNTAKEN PPC64_REL14_BRNTAKEN = 1207959565 PPC64_REL14_BRTAKEN PPC64_REL14_BRTAKEN = 1207959564 PPC64_REL16 PPC64_REL16 = 1207959801 PPC64_REL16_HA PPC64_REL16_HA = 1207959804 PPC64_REL16_HI PPC64_REL16_HI = 1207959803 PPC64_REL16_LO PPC64_REL16_LO = 1207959802 PPC64_REL24 PPC64_REL24 = 1207959562 PPC64_REL32 PPC64_REL32 = 1207959578 PPC64_REL64 PPC64_REL64 = 1207959596 PPC64_RELATIVE PPC64_RELATIVE = 1207959574 PPC64_TLS PPC64_TLS = 1207959619 PPC64_TLSGD PPC64_TLSGD = 1207959659 PPC64_TLSLD PPC64_TLSLD = 1207959660 PPC64_TOC PPC64_TOC = 1207959603 PPC64_TOC16 PPC64_TOC16 = 1207959599 PPC64_TOC16_DS PPC64_TOC16_DS = 1207959615 PPC64_TOC16_HA PPC64_TOC16_HA = 1207959602 PPC64_TOC16_HI PPC64_TOC16_HI = 1207959601 PPC64_TOC16_LO PPC64_TOC16_LO = 1207959600 PPC64_TOC16_LO_DS PPC64_TOC16_LO_DS = 1207959616 PPC64_TPREL16 PPC64_TPREL16 = 1207959621 PPC64_TPREL16_DS PPC64_TPREL16_DS = 1207959647 PPC64_TPREL16_HA PPC64_TPREL16_HA = 1207959624 PPC64_TPREL16_HI PPC64_TPREL16_HI = 1207959623 PPC64_TPREL16_HIGHER PPC64_TPREL16_HIGHER = 1207959649 PPC64_TPREL16_HIGHERA PPC64_TPREL16_HIGHERA = 1207959650 PPC64_TPREL16_HIGHEST PPC64_TPREL16_HIGHEST = 1207959651 PPC64_TPREL16_HIGHESTA PPC64_TPREL16_HIGHESTA = 1207959652 PPC64_TPREL16_LO PPC64_TPREL16_LO = 1207959622 PPC64_TPREL16_LO_DS PPC64_TPREL16_LO_DS = 1207959648 PPC64_TPREL64 PPC64_TPREL64 = 1207959625 PPC_ADDR14 PPC_ADDR14 = 1073741831 PPC_ADDR14_BRNTAKEN PPC_ADDR14_BRNTAKEN = 1073741833 PPC_ADDR14_BRTAKEN PPC_ADDR14_BRTAKEN = 1073741832 PPC_ADDR16 PPC_ADDR16 = 1073741827 PPC_ADDR16_HA PPC_ADDR16_HA = 1073741830 PPC_ADDR16_HI PPC_ADDR16_HI = 1073741829 PPC_ADDR16_LO PPC_ADDR16_LO = 1073741828 PPC_ADDR24 PPC_ADDR24 = 1073741826 PPC_ADDR32 PPC_ADDR32 = 1073741825 PPC_DTPMOD32 PPC_DTPMOD32 = 1073741892 PPC_DTPREL16 PPC_DTPREL16 = 1073741898 PPC_DTPREL16_HA PPC_DTPREL16_HA = 1073741901 PPC_DTPREL16_HI PPC_DTPREL16_HI = 1073741900 PPC_DTPREL16_LO PPC_DTPREL16_LO = 1073741899 PPC_DTPREL32 PPC_DTPREL32 = 1073741902 PPC_GOT16 PPC_GOT16 = 1073741838 PPC_GOT16_HA PPC_GOT16_HA = 1073741841 PPC_GOT16_HI PPC_GOT16_HI = 1073741840 PPC_GOT16_LO PPC_GOT16_LO = 1073741839 PPC_GOT_DTPREL16 PPC_GOT_DTPREL16 = 1073741915 PPC_GOT_DTPREL16_HA PPC_GOT_DTPREL16_HA = 1073741918 PPC_GOT_DTPREL16_HI PPC_GOT_DTPREL16_HI = 1073741917 PPC_GOT_DTPREL16_LO PPC_GOT_DTPREL16_LO = 1073741916 PPC_GOT_TLSGD16 PPC_GOT_TLSGD16 = 1073741903 PPC_GOT_TLSGD16_HA PPC_GOT_TLSGD16_HA = 1073741906 PPC_GOT_TLSGD16_HI PPC_GOT_TLSGD16_HI = 1073741905 PPC_GOT_TLSGD16_LO PPC_GOT_TLSGD16_LO = 1073741904 PPC_GOT_TLSLD16 PPC_GOT_TLSLD16 = 1073741907 PPC_GOT_TLSLD16_HA PPC_GOT_TLSLD16_HA = 1073741910 PPC_GOT_TLSLD16_HI PPC_GOT_TLSLD16_HI = 1073741909 PPC_GOT_TLSLD16_LO PPC_GOT_TLSLD16_LO = 1073741908 PPC_GOT_TPREL16 PPC_GOT_TPREL16 = 1073741911 PPC_GOT_TPREL16_HA PPC_GOT_TPREL16_HA = 1073741914 PPC_GOT_TPREL16_HI PPC_GOT_TPREL16_HI = 1073741913 PPC_GOT_TPREL16_LO PPC_GOT_TPREL16_LO = 1073741912 PPC_JMP_SLOT PPC_JMP_SLOT = 1073741845 PPC_LOCAL24PC PPC_LOCAL24PC = 1073741847 PPC_NONE PPC_NONE = 1073741824 PPC_PLTREL24 PPC_PLTREL24 = 1073741842 PPC_REL14 PPC_REL14 = 1073741835 PPC_REL14_BRNTAKEN PPC_REL14_BRNTAKEN = 1073741837 PPC_REL14_BRTAKEN PPC_REL14_BRTAKEN = 1073741836 PPC_REL16 PPC_REL16 = 1073742073 PPC_REL16_HA PPC_REL16_HA = 1073742076 PPC_REL16_HI PPC_REL16_HI = 1073742075 PPC_REL16_LO PPC_REL16_LO = 1073742074 PPC_REL24 PPC_REL24 = 1073741834 PPC_REL32 PPC_REL32 = 1073741850 PPC_RELATIVE PPC_RELATIVE = 1073741846 PPC_TLS PPC_TLS = 1073741891 PPC_TLSGD PPC_TLSGD = 1073741919 PPC_TLSLD PPC_TLSLD = 1073741920 PPC_TPREL16 PPC_TPREL16 = 1073741893 PPC_TPREL16_HA PPC_TPREL16_HA = 1073741896 PPC_TPREL16_HI PPC_TPREL16_HI = 1073741895 PPC_TPREL16_LO PPC_TPREL16_LO = 1073741894 PPC_TPREL32 PPC_TPREL32 = 1073741897 RISCV_32 RISCV_32 = 1610612737 RISCV_32_PCREL RISCV_32_PCREL = 1610612793 RISCV_64 RISCV_64 = 1610612738 RISCV_ADD16 RISCV_ADD16 = 1610612770 RISCV_ADD32 RISCV_ADD32 = 1610612771 RISCV_ADD64 RISCV_ADD64 = 1610612772 RISCV_ADD8 RISCV_ADD8 = 1610612769 RISCV_ALIGN RISCV_ALIGN = 1610612779 RISCV_BRANCH RISCV_BRANCH = 1610612752 RISCV_CALL RISCV_CALL = 1610612754 RISCV_CALL_PLT RISCV_CALL_PLT = 1610612755 RISCV_COPY RISCV_COPY = 1610612740 RISCV_GOT32_PCREL RISCV_GOT32_PCREL = 1610612777 RISCV_GOT_HI20 RISCV_GOT_HI20 = 1610612756 RISCV_HI20 RISCV_HI20 = 1610612762 RISCV_IRELATIVE RISCV_IRELATIVE = 1610612794 RISCV_JAL RISCV_JAL = 1610612753 RISCV_JUMP_SLOT RISCV_JUMP_SLOT = 1610612741 RISCV_LO12_I RISCV_LO12_I = 1610612763 RISCV_LO12_S RISCV_LO12_S = 1610612764 RISCV_NONE RISCV_NONE = 1610612736 RISCV_PCREL_HI20 RISCV_PCREL_HI20 = 1610612759 RISCV_PCREL_LO12_I RISCV_PCREL_LO12_I = 1610612760 RISCV_PCREL_LO12_S RISCV_PCREL_LO12_S = 1610612761 RISCV_PLT32 RISCV_PLT32 = 1610612795 RISCV_RELATIVE RISCV_RELATIVE = 1610612739 RISCV_RELAX RISCV_RELAX = 1610612787 RISCV_RVC_BRANCH RISCV_RVC_BRANCH = 1610612780 RISCV_RVC_JUMP RISCV_RVC_JUMP = 1610612781 RISCV_RVC_LUI RISCV_RVC_LUI = 1610612782 RISCV_SET16 RISCV_SET16 = 1610612791 RISCV_SET32 RISCV_SET32 = 1610612792 RISCV_SET6 RISCV_SET6 = 1610612789 RISCV_SET8 RISCV_SET8 = 1610612790 RISCV_SET_ULEB128 RISCV_SET_ULEB128 = 1610612796 RISCV_SUB16 RISCV_SUB16 = 1610612774 RISCV_SUB32 RISCV_SUB32 = 1610612775 RISCV_SUB6 RISCV_SUB6 = 1610612788 RISCV_SUB64 RISCV_SUB64 = 1610612776 RISCV_SUB8 RISCV_SUB8 = 1610612773 RISCV_SUB_ULEB128 RISCV_SUB_ULEB128 = 1610612797 RISCV_TLSDESC RISCV_TLSDESC = 1610612748 RISCV_TLSDESC_ADD_LO12 RISCV_TLSDESC_ADD_LO12 = 1610612800 RISCV_TLSDESC_CALL RISCV_TLSDESC_CALL = 1610612801 RISCV_TLSDESC_HI20 RISCV_TLSDESC_HI20 = 1610612798 RISCV_TLSDESC_LOAD_LO12 RISCV_TLSDESC_LOAD_LO12 = 1610612799 RISCV_TLS_DTPMOD32 RISCV_TLS_DTPMOD32 = 1610612742 RISCV_TLS_DTPMOD64 RISCV_TLS_DTPMOD64 = 1610612743 RISCV_TLS_DTPREL32 RISCV_TLS_DTPREL32 = 1610612744 RISCV_TLS_DTPREL64 RISCV_TLS_DTPREL64 = 1610612745 RISCV_TLS_GD_HI20 RISCV_TLS_GD_HI20 = 1610612758 RISCV_TLS_GOT_HI20 RISCV_TLS_GOT_HI20 = 1610612757 RISCV_TLS_TPREL32 RISCV_TLS_TPREL32 = 1610612746 RISCV_TLS_TPREL64 RISCV_TLS_TPREL64 = 1610612747 RISCV_TPREL_ADD RISCV_TPREL_ADD = 1610612768 RISCV_TPREL_HI20 RISCV_TPREL_HI20 = 1610612765 RISCV_TPREL_LO12_I RISCV_TPREL_LO12_I = 1610612766 RISCV_TPREL_LO12_S RISCV_TPREL_LO12_S = 1610612767 SH_64 SH_64 = 1879048446 SH_64_PCREL SH_64_PCREL = 1879048447 SH_ALIGN SH_ALIGN = 1879048221 SH_CODE SH_CODE = 1879048222 SH_COPY SH_COPY = 1879048354 SH_COPY64 SH_COPY64 = 1879048385 SH_COUNT SH_COUNT = 1879048220 SH_DATA SH_DATA = 1879048223 SH_DIR10S SH_DIR10S = 1879048240 SH_DIR10SL SH_DIR10SL = 1879048242 SH_DIR10SQ SH_DIR10SQ = 1879048243 SH_DIR10SW SH_DIR10SW = 1879048241 SH_DIR16 SH_DIR16 = 1879048225 SH_DIR16S SH_DIR16S = 1879048245 SH_DIR32 SH_DIR32 = 1879048193 SH_DIR4U SH_DIR4U = 1879048234 SH_DIR4UL SH_DIR4UL = 1879048232 SH_DIR4UW SH_DIR4UW = 1879048233 SH_DIR5U SH_DIR5U = 1879048237 SH_DIR6S SH_DIR6S = 1879048239 SH_DIR6U SH_DIR6U = 1879048238 SH_DIR8 SH_DIR8 = 1879048226 SH_DIR8BP SH_DIR8BP = 1879048199 SH_DIR8L SH_DIR8L = 1879048201 SH_DIR8S SH_DIR8S = 1879048231 SH_DIR8SW SH_DIR8SW = 1879048230 SH_DIR8U SH_DIR8U = 1879048229 SH_DIR8UL SH_DIR8UL = 1879048227 SH_DIR8UW SH_DIR8UW = 1879048228 SH_DIR8W SH_DIR8W = 1879048200 SH_DIR8WPL SH_DIR8WPL = 1879048197 SH_DIR8WPN SH_DIR8WPN = 1879048195 SH_DIR8WPZ SH_DIR8WPZ = 1879048198 SH_FUNCDESC SH_FUNCDESC = 1879048399 SH_FUNCDESC_VALUE SH_FUNCDESC_VALUE = 1879048400 SH_GLOB_DAT SH_GLOB_DAT = 1879048355 SH_GLOB_DAT64 SH_GLOB_DAT64 = 1879048386 SH_GNU_VTENTRY SH_GNU_VTENTRY = 1879048215 SH_GNU_VTINHERIT SH_GNU_VTINHERIT = 1879048214 SH_GOT10BY4 SH_GOT10BY4 = 1879048381 SH_GOT10BY8 SH_GOT10BY8 = 1879048383 SH_GOT20 SH_GOT20 = 1879048393 SH_GOT32 SH_GOT32 = 1879048352 SH_GOTFUNCDESC SH_GOTFUNCDESC = 1879048395 SH_GOTFUNCDESC20 SH_GOTFUNCDESC20 = 1879048396 SH_GOTOFF SH_GOTOFF = 1879048358 SH_GOTOFF20 SH_GOTOFF20 = 1879048394 SH_GOTOFFFUNCDESC SH_GOTOFFFUNCDESC = 1879048397 SH_GOTOFFFUNCDESC20 SH_GOTOFFFUNCDESC20 = 1879048398 SH_GOTOFF_HI16 SH_GOTOFF_HI16 = 1879048376 SH_GOTOFF_LOW16 SH_GOTOFF_LOW16 = 1879048373 SH_GOTOFF_MEDHI16 SH_GOTOFF_MEDHI16 = 1879048375 SH_GOTOFF_MEDLOW16 SH_GOTOFF_MEDLOW16 = 1879048374 SH_GOTPC SH_GOTPC = 1879048359 SH_GOTPC_HI16 SH_GOTPC_HI16 = 1879048380 SH_GOTPC_LOW16 SH_GOTPC_LOW16 = 1879048377 SH_GOTPC_MEDHI16 SH_GOTPC_MEDHI16 = 1879048379 SH_GOTPC_MEDLOW16 SH_GOTPC_MEDLOW16 = 1879048378 SH_GOTPLT10BY4 SH_GOTPLT10BY4 = 1879048382 SH_GOTPLT10BY8 SH_GOTPLT10BY8 = 1879048384 SH_GOTPLT32 SH_GOTPLT32 = 1879048360 SH_GOTPLT_HI16 SH_GOTPLT_HI16 = 1879048368 SH_GOTPLT_LOW16 SH_GOTPLT_LOW16 = 1879048365 SH_GOTPLT_MEDHI16 SH_GOTPLT_MEDHI16 = 1879048367 SH_GOTPLT_MEDLOW16 SH_GOTPLT_MEDLOW16 = 1879048366 SH_GOT_HI16 SH_GOT_HI16 = 1879048364 SH_GOT_LOW16 SH_GOT_LOW16 = 1879048361 SH_GOT_MEDHI16 SH_GOT_MEDHI16 = 1879048363 SH_GOT_MEDLOW16 SH_GOT_MEDLOW16 = 1879048362 SH_IMMS16 SH_IMMS16 = 1879048436 SH_IMMU16 SH_IMMU16 = 1879048437 SH_IMM_HI16 SH_IMM_HI16 = 1879048444 SH_IMM_HI16_PCREL SH_IMM_HI16_PCREL = 1879048445 SH_IMM_LOW16 SH_IMM_LOW16 = 1879048438 SH_IMM_LOW16_PCREL SH_IMM_LOW16_PCREL = 1879048439 SH_IMM_MEDHI16 SH_IMM_MEDHI16 = 1879048442 SH_IMM_MEDHI16_PCREL SH_IMM_MEDHI16_PCREL = 1879048443 SH_IMM_MEDLOW16 SH_IMM_MEDLOW16 = 1879048440 SH_IMM_MEDLOW16_PCREL SH_IMM_MEDLOW16_PCREL = 1879048441 SH_IND12W SH_IND12W = 1879048196 SH_JMP_SLOT SH_JMP_SLOT = 1879048356 SH_JMP_SLOT64 SH_JMP_SLOT64 = 1879048387 SH_LABEL SH_LABEL = 1879048224 SH_LOOP_END SH_LOOP_END = 1879048203 SH_LOOP_START SH_LOOP_START = 1879048202 SH_NONE SH_NONE = 1879048192 SH_PLT32 SH_PLT32 = 1879048353 SH_PLT_HI16 SH_PLT_HI16 = 1879048372 SH_PLT_LOW16 SH_PLT_LOW16 = 1879048369 SH_PLT_MEDHI16 SH_PLT_MEDHI16 = 1879048371 SH_PLT_MEDLOW16 SH_PLT_MEDLOW16 = 1879048370 SH_PSHA SH_PSHA = 1879048235 SH_PSHL SH_PSHL = 1879048236 SH_PT_16 SH_PT_16 = 1879048435 SH_REL32 SH_REL32 = 1879048194 SH_RELATIVE SH_RELATIVE = 1879048357 SH_RELATIVE64 SH_RELATIVE64 = 1879048388 SH_SHMEDIA_CODE SH_SHMEDIA_CODE = 1879048434 SH_SWITCH16 SH_SWITCH16 = 1879048217 SH_SWITCH32 SH_SWITCH32 = 1879048218 SH_SWITCH8 SH_SWITCH8 = 1879048216 SH_TLS_DTPMOD32 SH_TLS_DTPMOD32 = 1879048341 SH_TLS_DTPOFF32 SH_TLS_DTPOFF32 = 1879048342 SH_TLS_GD_32 SH_TLS_GD_32 = 1879048336 SH_TLS_IE_32 SH_TLS_IE_32 = 1879048339 SH_TLS_LDO_32 SH_TLS_LDO_32 = 1879048338 SH_TLS_LD_32 SH_TLS_LD_32 = 1879048337 SH_TLS_LE_32 SH_TLS_LE_32 = 1879048340 SH_TLS_TPOFF32 SH_TLS_TPOFF32 = 1879048343 SH_USES SH_USES = 1879048219 SPARC_10 SPARC_10 = 1342177310 SPARC_11 SPARC_11 = 1342177311 SPARC_13 SPARC_13 = 1342177291 SPARC_16 SPARC_16 = 1342177282 SPARC_22 SPARC_22 = 1342177290 SPARC_32 SPARC_32 = 1342177283 SPARC_5 SPARC_5 = 1342177324 SPARC_6 SPARC_6 = 1342177325 SPARC_64 SPARC_64 = 1342177312 SPARC_7 SPARC_7 = 1342177323 SPARC_8 SPARC_8 = 1342177281 SPARC_COPY SPARC_COPY = 1342177299 SPARC_DISP16 SPARC_DISP16 = 1342177285 SPARC_DISP32 SPARC_DISP32 = 1342177286 SPARC_DISP64 SPARC_DISP64 = 1342177326 SPARC_DISP8 SPARC_DISP8 = 1342177284 SPARC_GLOB_DAT SPARC_GLOB_DAT = 1342177300 SPARC_GOT10 SPARC_GOT10 = 1342177293 SPARC_GOT13 SPARC_GOT13 = 1342177294 SPARC_GOT22 SPARC_GOT22 = 1342177295 SPARC_GOTDATA_HIX22 SPARC_GOTDATA_HIX22 = 1342177360 SPARC_GOTDATA_LOX10 SPARC_GOTDATA_LOX10 = 1342177361 SPARC_GOTDATA_OP SPARC_GOTDATA_OP = 1342177364 SPARC_GOTDATA_OP_HIX22 SPARC_GOTDATA_OP_HIX22 = 1342177362 SPARC_GOTDATA_OP_LOX10 SPARC_GOTDATA_OP_LOX10 = 1342177363 SPARC_H44 SPARC_H44 = 1342177330 SPARC_HH22 SPARC_HH22 = 1342177314 SPARC_HI22 SPARC_HI22 = 1342177289 SPARC_HIPLT22 SPARC_HIPLT22 = 1342177305 SPARC_HIX22 SPARC_HIX22 = 1342177328 SPARC_HM10 SPARC_HM10 = 1342177315 SPARC_JMP_SLOT SPARC_JMP_SLOT = 1342177301 SPARC_L44 SPARC_L44 = 1342177332 SPARC_LM22 SPARC_LM22 = 1342177316 SPARC_LO10 SPARC_LO10 = 1342177292 SPARC_LOPLT10 SPARC_LOPLT10 = 1342177306 SPARC_LOX10 SPARC_LOX10 = 1342177329 SPARC_M44 SPARC_M44 = 1342177331 SPARC_NONE SPARC_NONE = 1342177280 SPARC_OLO10 SPARC_OLO10 = 1342177313 SPARC_PC10 SPARC_PC10 = 1342177296 SPARC_PC22 SPARC_PC22 = 1342177297 SPARC_PCPLT10 SPARC_PCPLT10 = 1342177309 SPARC_PCPLT22 SPARC_PCPLT22 = 1342177308 SPARC_PCPLT32 SPARC_PCPLT32 = 1342177307 SPARC_PC_HH22 SPARC_PC_HH22 = 1342177317 SPARC_PC_HM10 SPARC_PC_HM10 = 1342177318 SPARC_PC_LM22 SPARC_PC_LM22 = 1342177319 SPARC_PLT32 SPARC_PLT32 = 1342177304 SPARC_PLT64 SPARC_PLT64 = 1342177327 SPARC_REGISTER SPARC_REGISTER = 1342177333 SPARC_RELATIVE SPARC_RELATIVE = 1342177302 SPARC_TLS_DTPMOD32 SPARC_TLS_DTPMOD32 = 1342177354 SPARC_TLS_DTPMOD64 SPARC_TLS_DTPMOD64 = 1342177355 SPARC_TLS_DTPOFF32 SPARC_TLS_DTPOFF32 = 1342177356 SPARC_TLS_DTPOFF64 SPARC_TLS_DTPOFF64 = 1342177357 SPARC_TLS_GD_ADD SPARC_TLS_GD_ADD = 1342177338 SPARC_TLS_GD_CALL SPARC_TLS_GD_CALL = 1342177339 SPARC_TLS_GD_HI22 SPARC_TLS_GD_HI22 = 1342177336 SPARC_TLS_GD_LO10 SPARC_TLS_GD_LO10 = 1342177337 SPARC_TLS_IE_ADD SPARC_TLS_IE_ADD = 1342177351 SPARC_TLS_IE_HI22 SPARC_TLS_IE_HI22 = 1342177347 SPARC_TLS_IE_LD SPARC_TLS_IE_LD = 1342177349 SPARC_TLS_IE_LDX SPARC_TLS_IE_LDX = 1342177350 SPARC_TLS_IE_LO10 SPARC_TLS_IE_LO10 = 1342177348 SPARC_TLS_LDM_ADD SPARC_TLS_LDM_ADD = 1342177342 SPARC_TLS_LDM_CALL SPARC_TLS_LDM_CALL = 1342177343 SPARC_TLS_LDM_HI22 SPARC_TLS_LDM_HI22 = 1342177340 SPARC_TLS_LDM_LO10 SPARC_TLS_LDM_LO10 = 1342177341 SPARC_TLS_LDO_ADD SPARC_TLS_LDO_ADD = 1342177346 SPARC_TLS_LDO_HIX22 SPARC_TLS_LDO_HIX22 = 1342177344 SPARC_TLS_LDO_LOX10 SPARC_TLS_LDO_LOX10 = 1342177345 SPARC_TLS_LE_HIX22 SPARC_TLS_LE_HIX22 = 1342177352 SPARC_TLS_LE_LOX10 SPARC_TLS_LE_LOX10 = 1342177353 SPARC_TLS_TPOFF32 SPARC_TLS_TPOFF32 = 1342177358 SPARC_TLS_TPOFF64 SPARC_TLS_TPOFF64 = 1342177359 SPARC_UA16 SPARC_UA16 = 1342177335 SPARC_UA32 SPARC_UA32 = 1342177303 SPARC_UA64 SPARC_UA64 = 1342177334 SPARC_WDISP16 SPARC_WDISP16 = 1342177320 SPARC_WDISP19 SPARC_WDISP19 = 1342177321 SPARC_WDISP22 SPARC_WDISP22 = 1342177288 SPARC_WDISP30 SPARC_WDISP30 = 1342177287 SPARC_WPLT30 SPARC_WPLT30 = 1342177298 SYSZ_12 SYSZ_12 = 1476395010 SYSZ_16 SYSZ_16 = 1476395011 SYSZ_20 SYSZ_20 = 1476395065 SYSZ_32 SYSZ_32 = 1476395012 SYSZ_64 SYSZ_64 = 1476395030 SYSZ_8 SYSZ_8 = 1476395009 SYSZ_COPY SYSZ_COPY = 1476395017 SYSZ_GLOB_DAT SYSZ_GLOB_DAT = 1476395018 SYSZ_GOT12 SYSZ_GOT12 = 1476395014 SYSZ_GOT16 SYSZ_GOT16 = 1476395023 SYSZ_GOT20 SYSZ_GOT20 = 1476395066 SYSZ_GOT32 SYSZ_GOT32 = 1476395015 SYSZ_GOT64 SYSZ_GOT64 = 1476395032 SYSZ_GOTENT SYSZ_GOTENT = 1476395034 SYSZ_GOTOFF SYSZ_GOTOFF = 1476395021 SYSZ_GOTOFF16 SYSZ_GOTOFF16 = 1476395035 SYSZ_GOTOFF64 SYSZ_GOTOFF64 = 1476395036 SYSZ_GOTPC SYSZ_GOTPC = 1476395022 SYSZ_GOTPCDBL SYSZ_GOTPCDBL = 1476395029 SYSZ_GOTPLT12 SYSZ_GOTPLT12 = 1476395037 SYSZ_GOTPLT16 SYSZ_GOTPLT16 = 1476395038 SYSZ_GOTPLT20 SYSZ_GOTPLT20 = 1476395067 SYSZ_GOTPLT32 SYSZ_GOTPLT32 = 1476395039 SYSZ_GOTPLT64 SYSZ_GOTPLT64 = 1476395040 SYSZ_GOTPLTENT SYSZ_GOTPLTENT = 1476395041 SYSZ_IRELATIVE SYSZ_IRELATIVE = 1476395069 SYSZ_JMP_SLOT SYSZ_JMP_SLOT = 1476395019 SYSZ_NONE SYSZ_NONE = 1476395008 SYSZ_PC12DBL SYSZ_PC12DBL = 1476395070 SYSZ_PC16 SYSZ_PC16 = 1476395024 SYSZ_PC16DBL SYSZ_PC16DBL = 1476395025 SYSZ_PC24DBL SYSZ_PC24DBL = 1476395072 SYSZ_PC32 SYSZ_PC32 = 1476395013 SYSZ_PC32DBL SYSZ_PC32DBL = 1476395027 SYSZ_PC64 SYSZ_PC64 = 1476395031 SYSZ_PLT12DBL SYSZ_PLT12DBL = 1476395071 SYSZ_PLT16DBL SYSZ_PLT16DBL = 1476395026 SYSZ_PLT24DBL SYSZ_PLT24DBL = 1476395073 SYSZ_PLT32 SYSZ_PLT32 = 1476395016 SYSZ_PLT32DBL SYSZ_PLT32DBL = 1476395028 SYSZ_PLT64 SYSZ_PLT64 = 1476395033 SYSZ_PLTOFF16 SYSZ_PLTOFF16 = 1476395042 SYSZ_PLTOFF32 SYSZ_PLTOFF32 = 1476395043 SYSZ_PLTOFF64 SYSZ_PLTOFF64 = 1476395044 SYSZ_RELATIVE SYSZ_RELATIVE = 1476395020 SYSZ_TLS_DTPMOD SYSZ_TLS_DTPMOD = 1476395062 SYSZ_TLS_DTPOFF SYSZ_TLS_DTPOFF = 1476395063 SYSZ_TLS_GD32 SYSZ_TLS_GD32 = 1476395048 SYSZ_TLS_GD64 SYSZ_TLS_GD64 = 1476395049 SYSZ_TLS_GDCALL SYSZ_TLS_GDCALL = 1476395046 SYSZ_TLS_GOTIE12 SYSZ_TLS_GOTIE12 = 1476395050 SYSZ_TLS_GOTIE20 SYSZ_TLS_GOTIE20 = 1476395068 SYSZ_TLS_GOTIE32 SYSZ_TLS_GOTIE32 = 1476395051 SYSZ_TLS_GOTIE64 SYSZ_TLS_GOTIE64 = 1476395052 SYSZ_TLS_IE32 SYSZ_TLS_IE32 = 1476395055 SYSZ_TLS_IE64 SYSZ_TLS_IE64 = 1476395056 SYSZ_TLS_IEENT SYSZ_TLS_IEENT = 1476395057 SYSZ_TLS_LDCALL SYSZ_TLS_LDCALL = 1476395047 SYSZ_TLS_LDM32 SYSZ_TLS_LDM32 = 1476395053 SYSZ_TLS_LDM64 SYSZ_TLS_LDM64 = 1476395054 SYSZ_TLS_LDO32 SYSZ_TLS_LDO32 = 1476395060 SYSZ_TLS_LDO64 SYSZ_TLS_LDO64 = 1476395061 SYSZ_TLS_LE32 SYSZ_TLS_LE32 = 1476395058 SYSZ_TLS_LE64 SYSZ_TLS_LE64 = 1476395059 SYSZ_TLS_LOAD SYSZ_TLS_LOAD = 1476395045 SYSZ_TLS_TPOFF SYSZ_TLS_TPOFF = 1476395064 X86_16 X86_16 = 671088660 X86_32 X86_32 = 671088641 X86_32PLT X86_32PLT = 671088651 X86_64_16 X86_64_16 = 134217740 X86_64_32 X86_64_32 = 134217738 X86_64_32S X86_64_32S = 134217739 X86_64_64 X86_64_64 = 134217729 X86_64_8 X86_64_8 = 134217742 X86_64_COPY X86_64_COPY = 134217733 X86_64_DTPMOD64 X86_64_DTPMOD64 = 134217744 X86_64_DTPOFF32 X86_64_DTPOFF32 = 134217749 X86_64_DTPOFF64 X86_64_DTPOFF64 = 134217745 X86_64_GLOB_DAT X86_64_GLOB_DAT = 134217734 X86_64_GOT32 X86_64_GOT32 = 134217731 X86_64_GOT64 X86_64_GOT64 = 134217755 X86_64_GOTOFF64 X86_64_GOTOFF64 = 134217753 X86_64_GOTPC32 X86_64_GOTPC32 = 134217754 X86_64_GOTPC32_TLSDESC X86_64_GOTPC32_TLSDESC = 134217762 X86_64_GOTPC64 X86_64_GOTPC64 = 134217757 X86_64_GOTPCREL X86_64_GOTPCREL = 134217737 X86_64_GOTPCREL64 X86_64_GOTPCREL64 = 134217756 X86_64_GOTPCRELX X86_64_GOTPCRELX = 134217769 X86_64_GOTPLT64 X86_64_GOTPLT64 = 134217758 X86_64_GOTTPOFF X86_64_GOTTPOFF = 134217750 X86_64_IRELATIVE X86_64_IRELATIVE = 134217765 X86_64_JUMP_SLOT X86_64_JUMP_SLOT = 134217735 X86_64_NONE X86_64_NONE = 134217728 X86_64_PC16 X86_64_PC16 = 134217741 X86_64_PC32 X86_64_PC32 = 134217730 X86_64_PC32_BND X86_64_PC32_BND = 134217767 X86_64_PC64 X86_64_PC64 = 134217752 X86_64_PC8 X86_64_PC8 = 134217743 X86_64_PLT32 X86_64_PLT32 = 134217732 X86_64_PLT32_BND X86_64_PLT32_BND = 134217768 X86_64_PLTOFF64 X86_64_PLTOFF64 = 134217759 X86_64_RELATIVE X86_64_RELATIVE = 134217736 X86_64_RELATIVE64 X86_64_RELATIVE64 = 134217766 X86_64_REX_GOTPCRELX X86_64_REX_GOTPCRELX = 134217770 X86_64_SIZE32 X86_64_SIZE32 = 134217760 X86_64_SIZE64 X86_64_SIZE64 = 134217761 X86_64_TLSDESC X86_64_TLSDESC = 134217764 X86_64_TLSDESC_CALL X86_64_TLSDESC_CALL = 134217763 X86_64_TLSGD X86_64_TLSGD = 134217747 X86_64_TLSLD X86_64_TLSLD = 134217748 X86_64_TPOFF32 X86_64_TPOFF32 = 134217751 X86_64_TPOFF64 X86_64_TPOFF64 = 134217746 X86_8 X86_8 = 671088662 X86_COPY X86_COPY = 671088645 X86_GLOB_DAT X86_GLOB_DAT = 671088646 X86_GOT32 X86_GOT32 = 671088643 X86_GOTOFF X86_GOTOFF = 671088649 X86_GOTPC X86_GOTPC = 671088650 X86_IRELATIVE X86_IRELATIVE = 671088682 X86_JUMP_SLOT X86_JUMP_SLOT = 671088647 X86_NONE X86_NONE = 671088640 X86_PC16 X86_PC16 = 671088661 X86_PC32 X86_PC32 = 671088642 X86_PC8 X86_PC8 = 671088663 X86_PLT32 X86_PLT32 = 671088644 X86_RELATIVE X86_RELATIVE = 671088648 X86_TLS_DESC X86_TLS_DESC = 671088681 X86_TLS_DESC_CALL X86_TLS_DESC_CALL = 671088680 X86_TLS_DTPMOD32 X86_TLS_DTPMOD32 = 671088675 X86_TLS_DTPOFF32 X86_TLS_DTPOFF32 = 671088676 X86_TLS_GD X86_TLS_GD = 671088658 X86_TLS_GD_32 X86_TLS_GD_32 = 671088664 X86_TLS_GD_CALL X86_TLS_GD_CALL = 671088666 X86_TLS_GD_POP X86_TLS_GD_POP = 671088667 X86_TLS_GD_PUSH X86_TLS_GD_PUSH = 671088665 X86_TLS_GOTDESC X86_TLS_GOTDESC = 671088679 X86_TLS_GOTIE X86_TLS_GOTIE = 671088656 X86_TLS_IE X86_TLS_IE = 671088655 X86_TLS_IE_32 X86_TLS_IE_32 = 671088673 X86_TLS_LDM X86_TLS_LDM = 671088659 X86_TLS_LDM_32 X86_TLS_LDM_32 = 671088668 X86_TLS_LDM_CALL X86_TLS_LDM_CALL = 671088670 X86_TLS_LDM_POP X86_TLS_LDM_POP = 671088671 X86_TLS_LDM_PUSH X86_TLS_LDM_PUSH = 671088669 X86_TLS_LDO_32 X86_TLS_LDO_32 = 671088672 X86_TLS_LE X86_TLS_LE = 671088657 X86_TLS_LE_32 X86_TLS_LE_32 = 671088674 X86_TLS_TPOFF X86_TLS_TPOFF = 671088654 X86_TLS_TPOFF32 X86_TLS_TPOFF32 = 671088677 from_value from_value( arg: int ) → lief.ELF.Relocation.TYPE = addend property addend → int Additional value encoding property encoding → lief.ELF.Relocation.ENCODING The encoding of the relocation has_section property has_section → bool True if this relocation has a lief.ELF.Section associated with. This is usually the case for object files ( .o ) has_symbol property has_symbol → bool True if a Symbol is associated with the relocation info property info → int Extra information like the symbol index is_android_packed property is_android_packed → bool True if the relocation is using the Android packed relocation format is_rel property is_rel → bool Check if the relocation uses the implicit addend (i.e. not present in the ELF structure) is_rela property is_rela → bool True if the relocation uses the addend property is_relatively_encoded property is_relatively_encoded → bool True if the relocation is using the relative encoding purpose property purpose → lief.ELF.Relocation.PURPOSE Purpose of the relocation. This value provides the information about how the relocation is used (PLT/GOT resolution, .o file, …) r_infor_info r_info( self , clazz: lief._lief.ELF.Header.CLASS , data: lief._lief.ELF.Header.ELF_DATA ) → int r_info( self , header: lief._lief.ELF.Header ) → int Overloaded function. r_info(self, clazz: lief._lief.ELF.Header.CLASS, data: lief._lief.ELF.Header.ELF_DATA) -> int (re)Compute the raw r_info attribute based on the given ELF class and endianness r_info(self, header: lief._lief.ELF.Header) -> int (re)Compute the raw r_info attribute based on the ELF Header resolve resolve( self , base_address: int = 0 ) → int | lief._lief.lief_errors Try to resolve the value of the relocation such as *address() = resolve() section property section → lief.ELF.Section | None Section in which the relocation is applied or None if not relevant symbol property symbol → lief.ELF.Symbol | None Symbol associated with the relocation or None if no symbol is associated with this relocation. symbol_table property symbol_table → lief.ELF.Section | None The symbol table Section which the relocation references type property type → lief.ELF.Relocation.TYPE Relocation type. Symbol lief.ELF.Symbol class lief.ELF.Symbol( self ) Bases: Symbol Class which represents an ELF symbol BINDING class BINDING( *values ) Bases: Enum GLOBAL GLOBAL = 1 GNU_UNIQUE GNU_UNIQUE = 10 LOCAL LOCAL = 0 WEAK WEAK = 2 from_value from_value( arg: int ) → lief.ELF.Symbol.BINDING = TYPE class TYPE( *values ) Bases: Enum COMMON COMMON = 5 FILE FILE = 4 FUNC FUNC = 2 GNU_IFUNC GNU_IFUNC = 10 NOTYPE NOTYPE = 0 OBJECT OBJECT = 1 SECTION SECTION = 3 TLS TLS = 6 from_value from_value( arg: int ) → lief.ELF.Symbol.TYPE = VISIBILITY class VISIBILITY( *values ) Bases: Enum DEFAULT DEFAULT = 0 HIDDEN HIDDEN = 2 INTERNAL INTERNAL = 1 PROTECTED PROTECTED = 3 from_value from_value( arg: int ) → lief.ELF.Symbol.VISIBILITY = binding property binding → lief.ELF.Symbol.BINDING A symbol’s binding determines the linkage visibility and behavior. demangled_name property demangled_name → str Symbol’s name demangled or an empty string if the demangling is not possible/failed exported property exported → bool Whether the symbol is exported has_version property has_version → bool Check if this symbols has a SymbolVersion imported property imported → bool Whether the symbol is imported information property information → int This property specifies the symbol’s type and binding attributes is_function property is_function → bool True if the symbol is a function is_static property is_static → bool True if the symbol has static visibility is_variable property is_variable → bool True if the symbol is a variable other property other → int Alias for visibility section property section → lief.ELF.Section | None Return the section ( Section ) associated with this symbol if any. Otherwise, return None. shndx property shndx → int Section index associated with the symbol size property size → int Many symbols have associated sizes. For example, a data object’s size is the number of bytes contained in the object. This member holds 0 if the symbol has no size or an unknown size. symbol_version property symbol_version → lief.ELF.SymbolVersion | None Return the SymbolVersion associated with this symbol It returns None if no version is tied to this symbol. type property type → lief.ELF.Symbol.TYPE The symbol’s type provides a general classification for the associated entity. value property value → int This member has different meaning depending on the symbol’s type and the type of the ELF file (library, object, …) In relocatable files, this property contains the alignment constraints of the symbol for which the section index is SHN_COMMON. In relocatable files, can also contain a section’s offset for a defined symbol. That is, value is an offset from the beginning of the section associated with this symbol. In executable and libraries, this property contains a virtual address. visibility property visibility → lief.ELF.Symbol.VISIBILITY Symbol visibility. It’s basically an alias on other Symbol Version lief.ELF.SymbolVersionlief.ELF.SymbolVersion class lief.ELF.SymbolVersion( self ) class lief.ELF.SymbolVersion( self , arg: int , / ) Bases: Object Overloaded function. __init__(self) -> None Default constructor __init__(self, arg: int, /) -> None Constructor from value as_global as_global( self ) → None Redefine this version as global by dropping its auxiliary version as_local as_local( self ) → None Redefine this version as local by dropping its auxiliary version drop_version drop_version( self , value: int ) → None Drop the versioning requirement and replace the value (local/global) global_ global_ = has_auxiliary_version property has_auxiliary_version → bool Check if this symbols has a SymbolVersionAux local local = symbol_version_auxiliary property symbol_version_auxiliary → lief.ELF.SymbolVersionAux | None Return the SymbolVersionAux associated with this version or None if not present. The value can be changed by assigning a SymbolVersionAuxRequirement which must already exist in the SymbolVersionRequirement . One can use add_aux_requirement() to add a new SymbolVersionAuxRequirement . value property value → int Value associated with the symbol. If the given SymbolVersion has no auxiliary version: 0 : The symbol is local 1 : The symbol is global All other values are used for versions in the own object or in any of the dependencies. This is the version the symbol is tied to. Symbol Version Auxiliary lief.ELF.SymbolVersionAux class lief.ELF.SymbolVersionAux Bases: Object Class which represents an Auxiliary Symbol version name property name → str | bytes Symbol’s name (e.g. GLIBC_2.2.5 ) Symbol Version Definition lief.ELF.SymbolVersionDefinition class lief.ELF.SymbolVersionDefinition Bases: Object Class which represents an entry defined in DT_VERDEF or .gnu.version_d auxiliary_symbols property auxiliary_symbols → lief.ELF.SymbolVersionDefinition.it_version_aux flags property flags → int Version information hash property hash → int Hash value of the symbol’s name (using ELF hash function) ndx property ndx → int Numeric value used as an index in the SymbolVersion table version property version → int Version revision. Should be 1 This field should always have the value 1 . It will be changed if the versioning implementation has to be changed in an incompatible way. Symbol Version Requirement lief.ELF.SymbolVersionRequirement class lief.ELF.SymbolVersionRequirement Bases: Object Class which represents an entry in the DT_VERNEED or .gnu.version_r table add_auxiliary_requirement add_auxiliary_requirement( self , arg: lief._lief.ELF.SymbolVersionAuxRequirement , / ) → lief._lief.ELF.SymbolVersionAuxRequirement Add an auxiliary version requirement to the existing entries find_aux find_aux( self , name: str ) → lief._lief.ELF.SymbolVersionAuxRequirement | None Try to find the SymbolVersionAuxRequirement with the given name (e.g. GLIBC_2.27 ) get_auxiliary_symbols get_auxiliary_symbols( self ) → lief._lief.ELF.SymbolVersionRequirement.it_aux_requirement Auxiliary entries (iterator over SymbolVersionAuxRequirement ) name property name → str Library’s name associated with this requirement (e.g. libc.so.6 ) remove_aux_requirementremove_aux_requirement remove_aux_requirement( self , name: str ) → bool remove_aux_requirement( self , aux: lief._lief.ELF.SymbolVersionAuxRequirement ) → bool Overloaded function. remove_aux_requirement(self, name: str) -> bool Try to remove the auxiliary requirement symbol with the given name. The function returns true if the operation succeeds, false otherwise. Warning This function invalidates all the references (pointers) of SymbolVersionAuxRequirement . Therefore, the user is responsible to ensure that the auxiliary requirement is no longer used in the ELF binary (e.g. in SymbolVersion ) remove_aux_requirement(self, aux: lief._lief.ELF.SymbolVersionAuxRequirement) -> bool Try to remove the given auxiliary requirement symbol. The function returns true if the operation succeeds, false otherwise. Warning This function invalidates all the references (pointers) of SymbolVersionAuxRequirement . Therefore, the user is responsible to ensure that the auxiliary requirement is no longer used in the ELF binary (e.g. in SymbolVersion ) version property version → int Version revision. Should be 1 Symbol Version Auxiliary Requirement lief.ELF.SymbolVersionAuxRequirement class lief.ELF.SymbolVersionAuxRequirement( self ) Bases: SymbolVersionAux Default constructor flags property flags → int Bitmask of flags hash property hash → int Hash value of the dependency name (use ELF hashing function) other property other → int It returns the unique version index for the file which is used in the version symbol table. If the highest bit (bit 15) is set this is a hidden symbol which cannot be referenced from outside the object. GNU Hash table lief.ELF.GnuHash class lief.ELF.GnuHash( self ) Bases: Object Class which provides a view over the GNU Hash implementation. Most of the fields are read-only since the values are re-computed by the lief.ELF.Builder . bloom_filters property bloom_filters → list[int] Bloom filters buckets property buckets → list[int] hash buckets checkcheck check( self , symbol_name: str ) → bool check( self , hash_value: int ) → bool Overloaded function. check(self, symbol_name: str) -> bool Check if the symbol probably exists. If the returned value is false you can assume at 100% that the symbol with the given name doesn’t exist. If true you can’t do any assumption check(self, hash_value: int) -> bool Check if the symbol associated with the given hash probably exists. If the returned value is false you can assume at 100% that the symbol doesn’t exist. If true you can’t do any assumption check_bloom_filter check_bloom_filter( self , hash: int ) → bool Check if the given hash passes the bloom filter check_bucket check_bucket( self , hash: int ) → bool Check if the given hash passes the bucket filter hash_values property hash_values → list[int] Hash values nb_buckets property nb_buckets → int Return the number of buckets shift2 property shift2 → int Shift count used in the bloom filter symbol_index property symbol_index → int Index of the first symbol in the dynamic symbols table which is accessible with the hash table SYSV Hash table lief.ELF.SysvHash class lief.ELF.SysvHash( self ) Bases: Object Class which represents the SYSV hash for the symbols resolution References: http://www.linker-aliens.org/blogs/ali/entry/gnu_hash_elf_sections/ https://docs.oracle.com/cd/E23824_01/html/819-0690/chapter6-48031.html buckets property buckets → list[int] Buckets values chains property chains → list[int] Chains values nbucket property nbucket → int Return the number of buckets nchain property nchain → int Return the number of chains (symbol table index) Note lief.ELF.Note class lief.ELF.Note Bases: Object Class which represents an ELF note. TYPE class TYPE( *values ) Bases: Enum LIEF representation of the ELF NT_ values. ANDROID_IDENT ANDROID_IDENT = 38 ANDROID_KUSER ANDROID_KUSER = 40 ANDROID_MEMTAG ANDROID_MEMTAG = 39 CORE_ARM_HW_BREAK CORE_ARM_HW_BREAK = 25 CORE_ARM_HW_WATCH CORE_ARM_HW_WATCH = 26 CORE_ARM_PACA_KEYS CORE_ARM_PACA_KEYS = 30 CORE_ARM_PACG_KEYS CORE_ARM_PACG_KEYS = 31 CORE_ARM_PAC_MASK CORE_ARM_PAC_MASK = 29 CORE_ARM_SVE CORE_ARM_SVE = 28 CORE_ARM_SYSTEM_CALL CORE_ARM_SYSTEM_CALL = 27 CORE_ARM_TLS CORE_ARM_TLS = 24 CORE_ARM_VFP CORE_ARM_VFP = 23 CORE_AUXV CORE_AUXV = 13 CORE_FILE CORE_FILE = 20 CORE_FPREGS CORE_FPREGS = 15 CORE_FPREGSET CORE_FPREGSET = 10 CORE_LWPSINFO CORE_LWPSINFO = 18 CORE_LWPSTATUS CORE_LWPSTATUS = 17 CORE_PAC_ENABLED_KEYS CORE_PAC_ENABLED_KEYS = 33 CORE_PRPSINFO CORE_PRPSINFO = 11 CORE_PRSTATUS CORE_PRSTATUS = 9 CORE_PRXFPREG CORE_PRXFPREG = 21 CORE_PSINFO CORE_PSINFO = 16 CORE_PSTATUS CORE_PSTATUS = 14 CORE_SIGINFO CORE_SIGINFO = 22 CORE_TAGGED_ADDR_CTRL CORE_TAGGED_ADDR_CTRL = 32 CORE_TASKSTRUCT CORE_TASKSTRUCT = 12 CORE_WIN32PSTATUS CORE_WIN32PSTATUS = 19 CORE_X86_CET CORE_X86_CET = 37 CORE_X86_IOPERM CORE_X86_IOPERM = 35 CORE_X86_TLS CORE_X86_TLS = 34 CORE_X86_XSTATE CORE_X86_XSTATE = 36 CRASHPAD CRASHPAD = 8 GNU_ABI_TAG GNU_ABI_TAG = 1 GNU_BUILD_ATTRIBUTE_FUNC GNU_BUILD_ATTRIBUTE_FUNC = 7 GNU_BUILD_ATTRIBUTE_OPEN GNU_BUILD_ATTRIBUTE_OPEN = 6 GNU_BUILD_ID GNU_BUILD_ID = 3 GNU_GOLD_VERSION GNU_GOLD_VERSION = 4 GNU_HWCAP GNU_HWCAP = 2 GNU_PROPERTY_TYPE_0 GNU_PROPERTY_TYPE_0 = 5 GO_BUILDID GO_BUILDID = 41 QNX_STACK QNX_STACK = 43 STAPSDT STAPSDT = 42 UNKNOWN UNKNOWN = 0 from_value from_value( arg: int ) → lief.ELF.Note.TYPE = copy copy( self ) → lief._lief.ELF.Note | None Duplicate the current instance of this object create create( *args ) → lief.ELF.Note | None = description property description → memoryview Return the description associated with the note name property name → str Return the name of the note also known as the owner. original_type property original_type → int Return the original NT_ value of the note. This value should be interpreted according the name of the note. size property size → int Size of the raw note type property type → lief.ELF.Note.TYPE Return the LIEF type representation of the note. Core PrPsInfo lief.ELF.CorePrPsInfo class lief.ELF.CorePrPsInfo Bases: Note info property info → lief.ELF.CorePrPsInfo.info_t | None info_t class info_t Bases: object args property args → str args_stripped property args_stripped → str filename property filename → str filename_stripped property filename_stripped → str flag property flag → int gid property gid → int nice property nice → int pgrp property pgrp → int pid property pid → int ppid property ppid → int sid property sid → int sname property sname → str state property state → int uid property uid → int zombie property zombie → bool Core PrStatus lief.ELF.CorePrStatus class lief.ELF.CorePrStatus Bases: Note Registers class Registers Bases: object AARCH64 class AARCH64( *values ) Bases: Enum Registers for the AARCH64 architecture ( AARCH64 ) PC PC = 32 PSTATE PSTATE = 33 X0 X0 = 0 X1 X1 = 1 X10 X10 = 10 X11 X11 = 11 X12 X12 = 12 X13 X13 = 13 X14 X14 = 14 X15 X15 = 15 X16 X16 = 16 X17 X17 = 17 X18 X18 = 18 X19 X19 = 19 X2 X2 = 2 X20 X20 = 20 X21 X21 = 21 X22 X22 = 22 X23 X23 = 23 X24 X24 = 24 X25 X25 = 25 X26 X26 = 26 X27 X27 = 27 X28 X28 = 28 X29 X29 = 29 X3 X3 = 3 X30 X30 = 30 X31 X31 = 31 X4 X4 = 4 X5 X5 = 5 X6 X6 = 6 X7 X7 = 7 X8 X8 = 8 X9 X9 = 9 from_value from_value( arg: int ) → lief.ELF.CorePrStatus.Registers.AARCH64 = ARM class ARM( *values ) Bases: Enum Registers for the ARM architecture ( ARM ) CPSR CPSR = 16 R0 R0 = 0 R1 R1 = 1 R10 R10 = 10 R11 R11 = 11 R12 R12 = 12 R13 R13 = 13 R14 R14 = 14 R15 R15 = 15 R2 R2 = 2 R3 R3 = 3 R4 R4 = 4 R5 R5 = 5 R6 R6 = 6 R7 R7 = 7 R8 R8 = 8 R9 R9 = 9 from_value from_value( arg: int ) → lief.ELF.CorePrStatus.Registers.ARM = X86 class X86( *values ) Bases: Enum Registers for the x86 architecture ( i386 ) CS CS = 13 DS DS = 7 EAX EAX = 6 EBP EBP = 5 EBX EBX = 0 ECX ECX = 1 EDI EDI = 4 EDX EDX = 2 EFLAGS EFLAGS = 14 EIP EIP = 12 ES ES = 8 ESI ESI = 3 ESP ESP = 15 FS FS = 9 GS GS = 10 ORIG_EAX ORIG_EAX = 11 SS SS = 16 from_value from_value( arg: int ) → lief.ELF.CorePrStatus.Registers.X86 = X86_64 class X86_64( *values ) Bases: Enum Registers for the x86-64 architecture ( x86_64 ) CS CS = 17 DS DS = 23 EFLAGS EFLAGS = 18 ES ES = 24 FS_BASE FS_BASE = 21 GS_BASE GS_BASE = 22 ORIG_RAX ORIG_RAX = 15 R10 R10 = 7 R11 R11 = 6 R12 R12 = 3 R13 R13 = 2 R14 R14 = 1 R15 R15 = 0 R8 R8 = 9 R9 R9 = 8 RAX RAX = 10 RBP RBP = 4 RBX RBX = 5 RCX RCX = 11 RDI RDI = 14 RDX RDX = 12 RIP RIP = 16 RSI RSI = 13 RSP RSP = 19 SS SS = 20 from_value from_value( arg: int ) → lief.ELF.CorePrStatus.Registers.X86_64 = architecture property architecture → lief.ELF.ARCH Original target architecture. getgetgetget get( self , reg: lief._lief.ELF.CorePrStatus.Registers.X86 ) → int | None **get( self , reg: lief._lief.ELF.CorePrStatus.Registers.X86_64 ) → int | None **get( self , reg: lief._lief.ELF.CorePrStatus.Registers.ARM ) → int | None get( self , reg: lief._lief.ELF.CorePrStatus.Registers.AARCH64 ) → int | None **** Get the register value or non if it is not present pc property pc → int | None Return the program counter value (rip, pc, eip etc) pr_status_t class pr_status_t Bases: object cstime property cstime → lief.ELF.CorePrStatus.timeval_t cursig property cursig → int cutime property cutime → lief.ELF.CorePrStatus.timeval_t info property info → lief.ELF.CorePrStatus.siginfo_t pgrp property pgrp → int pid property pid → int ppid property ppid → int reserved property reserved → int sid property sid → int sighold property sighold → int sigpend property sigpend → int stime property stime → lief.ELF.CorePrStatus.timeval_t utime property utime → lief.ELF.CorePrStatus.timeval_t register_values property register_values → list[int] List of the register values. This list is guaranteed to be as long as the number of registers defined in the Registers or empty if it can’t be resolved. Thus, one can access a specific register through: reg_vals: list[int] = note.register_values() x20 = reg_vals[CorePrStatus.Registers.AARCH64.X20.value] return_value property return_value → int | None The value of the register that holds the return value according to the calling convention. setsetsetset set( self , reg: lief._lief.ELF.CorePrStatus.Registers.X86 , value: int ) → lief._lief.ok_error_t **set( self , reg: lief._lief.ELF.CorePrStatus.Registers.X86_64 , value: int ) → lief._lief.ok_error_t **set( self , reg: lief._lief.ELF.CorePrStatus.Registers.ARM , value: int ) → lief._lief.ok_error_t set( self , reg: lief._lief.ELF.CorePrStatus.Registers.AARCH64 , value: int ) → lief._lief.ok_error_t **** Change the register value siginfo_t class siginfo_t Bases: object errno property errno → int sicode property sicode → int signo property signo → int sp property sp → int | None Return the stack pointer value status property status → lief.ELF.CorePrStatus.pr_status_t Status information from a core dump This structure mirrors the kernel’s prstatus data embedded in NT_PRSTATUS core-dump notes and exposes signal state, process identifiers, and CPU-time accounting. timeval_t class timeval_t Bases: object sec property sec → int usec property usec → int Core File lief.ELF.CoreFile class lief.ELF.CoreFile Bases: Note entry_t class entry_t Bases: object end property end → int End address of mapped file file_ofs property file_ofs → int Offset (in core) of mapped file path property path → str Path of mapped file start property start → int Start address of mapped file files property files → lief.ELF.CoreFile.files_t List of files mapped in core. (list of CoreFileEntry ) files_tfiles_tfiles_t class files_t( self ) **class files_t( self , arg: lief._lief.ELF.CoreFile.files_t , / ) class files_t( self , arg: collections.abc.Iterable[ lief._lief.ELF.CoreFile.entry_t ] , / ) ** Bases: object Overloaded function. __init__(self) -> None Default constructor __init__(self, arg: lief._lief.ELF.CoreFile.files_t, /) -> None Copy constructor __init__(self, arg: collections.abc.Iterable[lief._lief.ELF.CoreFile.entry_t], /) -> None Construct from an iterable object append append( self , arg: lief._lief.ELF.CoreFile.entry_t , / ) → None Append arg to the end of the list. clear clear( self ) → None Remove all items from list. extend extend( self , arg: lief._lief.ELF.CoreFile.files_t , / ) → None Extend self by appending elements from arg . insert insert( self , arg0: int , arg1: lief._lief.ELF.CoreFile.entry_t , / ) → None Insert object arg1 before index arg0 . pop pop( self , index: int = -1 ) → lief._lief.ELF.CoreFile.entry_t Remove and return item at index (default last). Core Siginfo lief.ELF.CoreSigInfo class lief.ELF.CoreSigInfo Bases: Note sigcode property sigcode → int | None Signal code sigerrno property sigerrno → int | None If non-zero, an errno value associated with this signal signo property signo → int | None Signal number Core Auxiliary Vector lief.ELF.CoreAuxv class lief.ELF.CoreAuxv Bases: Note TYPE class TYPE( *values ) Bases: Enum BASE BASE = 7 BASE_PLATFORM BASE_PLATFORM = 24 CLKTCK CLKTCK = 17 DCACHEBSIZE DCACHEBSIZE = 19 EGID EGID = 14 END END = 0 ENTRY ENTRY = 9 EUID EUID = 12 EXECFD EXECFD = 2 EXECFN EXECFN = 31 FLAGS FLAGS = 8 FPUCW FPUCW = 18 GID GID = 13 HWCAP HWCAP = 16 HWCAP2 HWCAP2 = 26 ICACHEBSIZE ICACHEBSIZE = 20 IGNOREPPC IGNOREPPC = 22 IGNORE_TY IGNORE_TY = 1 NOTELF NOTELF = 10 PAGESZ PAGESZ = 6 PHDR PHDR = 3 PHENT PHENT = 4 PHNUM PHNUM = 5 RANDOM RANDOM = 25 SECURE SECURE = 23 SYSINFO SYSINFO = 32 SYSINFO_EHDR SYSINFO_EHDR = 33 TGT_PLATFORM TGT_PLATFORM = 15 UCACHEBSIZE UCACHEBSIZE = 21 UID UID = 11 from_value from_value( arg: int ) → lief.ELF.CoreAuxv.TYPE = get get( self , type: lief._lief.ELF.CoreAuxv.TYPE ) → int | None Get the auxv value from the provided type. Return None if it is not present. setset set( self , type: lief._lief.ELF.CoreAuxv.TYPE , value: int ) → bool set( self , arg: collections.abc.Mapping[ lief._lief.ELF.CoreAuxv.TYPE , int] , / ) → bool Overloaded function. set(self, type: lief._lief.ELF.CoreAuxv.TYPE, value: int) -> bool Change the value for the given type. set(self, arg: collections.abc.Mapping[lief._lief.ELF.CoreAuxv.TYPE, int], /) -> bool Replace all the values by the given dictionary. values property values → dict[ lief.ELF.CoreAuxv.TYPE , int] Return the auxiliary vector as a dictionary of TYPE / int Android Ident lief.ELF.AndroidIdent class lief.ELF.AndroidIdent Bases: Note ndk_build_number property ndk_build_number → str Android NDK build number ndk_version property ndk_version → str Android NDK version used to build the current binary sdk_version property sdk_version → int Target SDK platform QNX Stack lief.ELF.QNXStack class lief.ELF.QNXStack Bases: Note is_executable property is_executable → bool Whether the stack is executable stack_allocated property stack_allocated → int Size of the stack pre-allocated (upfront) stack_size property stack_size → int Size of the stack Note ABI lief.ELF.NoteAbi class lief.ELF.NoteAbi Bases: Note Class that wraps the NT_GNU_ABI_TAG note ABI class ABI( *values ) Bases: Enum ABI recognized by this note FREEBSD FREEBSD = 3 GNU GNU = 1 LINUX LINUX = 0 NACL NACL = 6 NETBSD NETBSD = 4 SOLARIS2 SOLARIS2 = 2 SYLLABLE SYLLABLE = 5 from_value from_value( arg: int ) → lief.ELF.NoteAbi.ABI = abi property abi → lief.ELF.NoteAbi.ABI | None Return the target ABI version property version → list[int] | None Return the target version as (Major, Minor, Patch) Note Gnu Property lief.ELF.NoteGnuProperty class lief.ELF.NoteGnuProperty Bases: Note This object represents the NT_GNU_PROPERTY_TYPE_0 note. Property class Property Bases: object This class wraps the different properties that can be used in a NT_GNU_PROPERTY_TYPE_0 note TYPE class TYPE( *values ) Bases: Enum LIEF’s mirror types of the original GNU_PROPERTY_ values AARCH64_FEATURES AARCH64_FEATURES = 2 AARCH64_PAUTH AARCH64_PAUTH = 3 GENERIC GENERIC = 1 NEEDED NEEDED = 8 NO_COPY_ON_PROTECTED NO_COPY_ON_PROTECTED = 5 STACK_SIZE STACK_SIZE = 4 UNKNOWN UNKNOWN = 0 X86_FEATURE X86_FEATURE = 7 X86_ISA X86_ISA = 6 from_value from_value( arg: int ) → lief.ELF.NoteGnuProperty.Property.TYPE = type property type → lief.ELF.NoteGnuProperty.Property.TYPE find find( self , arg: lief._lief.ELF.NoteGnuProperty.Property.TYPE , / ) → lief._lief.ELF.NoteGnuProperty.Property | None Find the property with the given type or return None properties property properties → list[ lief.ELF.NoteGnuProperty.Property | None] Return the properties as a list of Property Generic lief.ELF.Generic class lief.ELF.Generic Bases: Property This class represents a property which doesn’t have a concrete LIEF implementation. raw_type property raw_type → int The original raw type as an integer. This value might depend on the architecture and/or the file type. AArch64 Feature lief.ELF.AArch64Feature class lief.ELF.AArch64Feature Bases: Property This class represents the GNU_PROPERTY_AARCH64_FEATURE_1_AND note. FEATURE class FEATURE( *values ) Bases: Enum BTI BTI = 1 GCS GCS = 3 PAC PAC = 2 UNKNOWN UNKNOWN = 0 from_value from_value( arg: int ) → lief.ELF.AArch64Feature.FEATURE = features property features → list[ lief.ELF.AArch64Feature.FEATURE ] Return the list of the supported features. AArch64 PAuth lief.ELF.AArch64PAuth class lief.ELF.AArch64PAuth Bases: Property This class represents the GNU_PROPERTY_AARCH64_FEATURE_PAUTH note. Note If both: AArch64PAuth.platform and AArch64PAuth.version are set to 0, this means that the binary is incompatible with PAuth ABI extension. platform property platform → int 64-bit value that specifies the platform vendor. A 0 value is associated with an invalid platform while the value 1 is associated with a baremetal platform. version property version → int 64-bit value that identifies the signing schema used by the ELF file. Needed lief.ELF.Needed class lief.ELF.Needed Bases: Property This class represents the GNU_PROPERTY_1_NEEDED note property which provides information about additional features the object file needs at runtime. NEED class NEED( *values ) Bases: Enum INDIRECT_EXTERN_ACCESS INDIRECT_EXTERN_ACCESS = 1 NEED NEED = 0 from_value from_value( arg: int ) → lief.ELF.Needed.NEED = needs property needs → list[ lief.ELF.Needed.NEED ] Return the list of the needed features. No Copy on Protected lief.ELF.NoteNoCopyOnProtected class lief.ELF.NoteNoCopyOnProtected Bases: Property This class provides an interface over the GNU_PROPERTY_NO_COPY_ON_PROTECTED property. This property indicates that the linker shouldn’t copy relocations against protected symbols. Stack Size lief.ELF.StackSize class lief.ELF.StackSize Bases: Property This class provides an interface over the GNU_PROPERTY_STACK_SIZE property This property can be used by the loader to raise the stack limit. stack_size property stack_size → int X86 Feature lief.ELF.X86Features class lief.ELF.X86Features Bases: Property This class interfaces the different GNU_PROPERTY_X86_FEATURE_* properties which includes: GNU_PROPERTY_X86_FEATURE_1_AND GNU_PROPERTY_X86_FEATURE_2_USED GNU_PROPERTY_X86_FEATURE_2_NEEDED FEATURE class FEATURE( *values ) Bases: Enum Features provided by these different properties FXSR FXSR = 11 IBT IBT = 1 LAM_U48 LAM_U48 = 3 LAM_U57 LAM_U57 = 4 MASK MASK = 16 MMX MMX = 7 SHSTK SHSTK = 2 TMM TMM = 15 UNKNOWN UNKNOWN = 0 X86 X86 = 5 X87 X87 = 6 XMM XMM = 8 XSAVE XSAVE = 12 XSAVEC XSAVEC = 14 XSAVEOPT XSAVEOPT = 13 YMM YMM = 9 ZMM ZMM = 10 from_value from_value( arg: int ) → lief.ELF.X86Features.FEATURE = FLAG class FLAG( *values ) Bases: Enum Flag according to the _AND , _USED or _NEEDED suffixes NEEDED NEEDED = 2 NONE NONE = 0 USED USED = 1 from_value from_value( arg: int ) → lief.ELF.X86Features.FLAG = features property features → list[tuple[ lief.ELF.X86Features.FLAG , lief.ELF.X86Features.FEATURE ]] List of the features as a pair of ( FLAG , FEATURE ). X86 ISA lief.ELF.X86ISA class lief.ELF.X86ISA Bases: Property This class interfaces the different GNU_PROPERTY_X86_ISA_* properties which includes: GNU_PROPERTY_X86_ISA_1_USED GNU_PROPERTY_X86_ISA_1_NEEDED GNU_PROPERTY_X86_COMPAT_ISA_1_USED GNU_PROPERTY_X86_COMPAT_ISA_1_NEEDED GNU_PROPERTY_X86_COMPAT_2_ISA_1_USED GNU_PROPERTY_X86_COMPAT_2_ISA_1_NEEDED FLAG class FLAG( *values ) Bases: Enum NEEDED NEEDED = 2 NONE NONE = 0 USED USED = 1 from_value from_value( arg: int ) → lief.ELF.X86ISA.FLAG = ISA class ISA( *values ) Bases: Enum AVX AVX = 16 AVX2 AVX2 = 17 AVX512BW AVX512BW = 24 AVX512CD AVX512CD = 19 AVX512DQ AVX512DQ = 23 AVX512ER AVX512ER = 20 AVX512F AVX512F = 18 AVX512PF AVX512PF = 21 AVX512VL AVX512VL = 22 AVX512_4FMAPS AVX512_4FMAPS = 25 AVX512_4VNNIW AVX512_4VNNIW = 26 AVX512_BF16 AVX512_BF16 = 32 AVX512_BITALG AVX512_BITALG = 27 AVX512_IFMA AVX512_IFMA = 28 AVX512_VBMI AVX512_VBMI = 29 AVX512_VBMI2 AVX512_VBMI2 = 30 AVX512_VNNI AVX512_VNNI = 31 BASELINE BASELINE = 1 CMOV CMOV = 5 FMA FMA = 6 I486 I486 = 7 I586 I586 = 8 I686 I686 = 9 SSE SSE = 10 SSE2 SSE2 = 11 SSE3 SSE3 = 12 SSE4_1 SSE4_1 = 14 SSE4_2 SSE4_2 = 15 SSSE3 SSSE3 = 13 UNKNOWN UNKNOWN = 0 V2 V2 = 2 V3 V3 = 3 V4 V4 = 4 from_value from_value( arg: int ) → lief.ELF.X86ISA.ISA = values property values → list[tuple[ lief.ELF.X86ISA.FLAG , lief.ELF.X86ISA.ISA ]] List of the ISA values in this property Builder lief.ELF.Builderlief.ELF.Builder class lief.ELF.Builder( self , elf: lief._lief.ELF.Binary ) class lief.ELF.Builder( self , elf: lief._lief.ELF.Binary , config: lief._lief.ELF.Builder.config_t ) Bases: object Class which takes an lief.ELF.Binary object and reconstructs a valid binary build build( self ) → None Perform the build of the provided ELF binary config property config → lief.ELF.Builder.config_t Configuration of the builder config_t class config_t( self ) Bases: object Interface to tweak the Builder android_rela property android_rela → bool Rebuild ANDROID_RELA coredump_notes property coredump_notes → bool Rebuild the Coredump notes dt_hash property dt_hash → bool Rebuild HASH dyn_str property dyn_str → bool Rebuild STRTAB dynamic_section property dynamic_section → bool Rebuild the PT_DYNAMIC segment fini_array property fini_array → bool Rebuild FINI_ARRAY force_relocate property force_relocate → bool Force to relocate all the ELF structures that can be relocated (mostly for testing) init_array property init_array → bool Rebuild INIT_ARRAY interpreter property interpreter → bool Rebuild the PT_INTERP segment jmprel property jmprel → bool Rebuild JMPREL keep_empty_version_requirement property keep_empty_version_requirement → bool Remove entries in .gnu.version_r if they are not associated with at least one version notes property notes → bool Rebuild PT_NOTES segment(s) preinit_array property preinit_array → bool Rebuild PREINIT_ARRAY rela property rela → bool Rebuild RELA relr property relr → bool Rebuild RELR skip_dynamic property skip_dynamic → bool Skip relocating the PT_DYNAMIC segment (only relevant if force_relocate is set) static_symtab property static_symtab → bool Rebuild .symtab section sym_verdef property sym_verdef → bool Rebuild VERDEF sym_verneed property sym_verneed → bool Rebuild VERNEED sym_versym property sym_versym → bool Rebuild VERSYM symtab property symtab → bool Rebuild SYMTAB get_build get_build( self ) → list[int] Return the build result as a list of bytes write write( self , output: str ) → None Write the build result into the output file Enums Architectures lief.ELF.ARCH class lief.ELF.ARCH( *values ) Bases: Enum AARCH64 AARCH64 = 183 ALPHA ALPHA = 41 ALPHA_ALT ALPHA_ALT = 36902 ALTERA_NIOS2 ALTERA_NIOS2 = 113 AMDGPU AMDGPU = 224 ARC ARC = 45 ARCA ARCA = 109 ARC_COMPACT ARC_COMPACT = 93 ARC_COMPACT2 ARC_COMPACT2 = 195 ARM ARM = 40 AVR AVR = 83 AVR32 AVR32 = 185 BA1 BA1 = 201 BA2 BA2 = 202 BLACKFIN BLACKFIN = 106 BPF BPF = 247 C166 C166 = 116 CDP CDP = 215 CE CE = 119 CLOUDSHIELD CLOUDSHIELD = 192 COGE COGE = 216 COLDFIRE COLDFIRE = 52 COOL COOL = 217 COREA_1ST COREA_1ST = 193 COREA_2ND COREA_2ND = 194 CR CR = 103 CR16 CR16 = 177 CRAYNV2 CRAYNV2 = 172 CRIS CRIS = 76 CRX CRX = 114 CSKY CSKY = 252 CSR_KALIMBA CSR_KALIMBA = 219 CUDA CUDA = 190 CYPRESS_M8C CYPRESS_M8C = 161 D10V D10V = 85 D30V D30V = 86 DSP24 DSP24 = 136 DSPIC30F DSPIC30F = 118 DXP DXP = 112 ECOG16 ECOG16 = 176 ECOG1X ECOG1X = 168 ECOG2 ECOG2 = 134 ETPU ETPU = 178 EXCESS EXCESS = 111 F2MC16 F2MC16 = 104 FIREPATH FIREPATH = 78 FR20 FR20 = 37 FR30 FR30 = 84 FX66 FX66 = 66 H8S H8S = 48 H8_300 H8_300 = 46 H8_300H H8_300H = 47 H8_500 H8_500 = 49 HEXAGON HEXAGON = 164 HUANY HUANY = 81 I386 I386 = 3 I60 I60 = 19 I860 I860 = 7 IAMCU IAMCU = 6 IA_64 IA_64 = 50 INTEL205 INTEL205 = 205 INTEL206 INTEL206 = 206 INTEL207 INTEL207 = 207 INTEL208 INTEL208 = 208 INTEL209 INTEL209 = 209 IP2K IP2K = 101 JAVELIN JAVELIN = 77 K10M K10M = 181 KM32 KM32 = 210 KMX16 KMX16 = 212 KMX32 KMX32 = 211 KMX8 KMX8 = 213 KVARC KVARC = 214 L10M L10M = 180 LATTICEMICO32 LATTICEMICO32 = 138 LOONGARCH LOONGARCH = 258 M16C M16C = 117 M32 M32 = 1 M32C M32C = 120 M32R M32R = 88 M56800EX M56800EX = 200 M68HC05 M68HC05 = 72 M68HC08 M68HC08 = 71 M68HC11 M68HC11 = 70 M68HC12 M68HC12 = 53 M68HC16 M68HC16 = 69 M68K M68K = 4 M78KOR M78KOR = 199 M8051 M8051 = 165 M88K M88K = 5 MANIK MANIK = 171 MAX MAX = 102 MAXQ30 MAXQ30 = 169 MCHP_PIC MCHP_PIC = 204 MCST_ELBRUS MCST_ELBRUS = 175 ME16 ME16 = 59 METAG METAG = 174 MIPS MIPS = 8 MIPS_RS3_LE MIPS_RS3_LE = 10 MIPS_X MIPS_X = 51 MMA MMA = 54 MMDSP_PLUS MMDSP_PLUS = 160 MMIX MMIX = 80 MN10200 MN10200 = 90 MN10300 MN10300 = 89 MSP430 MSP430 = 105 NCPU NCPU = 56 NDR1 NDR1 = 57 NDS32 NDS32 = 167 NONE NONE = 0 NORC NORC = 218 NS32K NS32K = 97 OPEN8 OPEN8 = 196 OPENRISC OPENRISC = 92 PARISC PARISC = 15 PCP PCP = 55 PDP10 PDP10 = 64 PDP11 PDP11 = 65 PDSP PDSP = 63 PJ PJ = 91 PPC PPC = 20 PPC64 PPC64 = 21 PRISM PRISM = 82 R32C R32C = 162 RCE RCE = 39 RH32 RH32 = 38 RISCV RISCV = 243 RL78 RL78 = 197 RS08 RS08 = 132 RX RX = 173 S370 S370 = 9 S390 S390 = 22 SCORE7 SCORE7 = 135 SEP SEP = 108 SE_C17 SE_C17 = 139 SE_C33 SE_C33 = 107 SH SH = 42 SHARC SHARC = 133 SLE9X SLE9X = 179 SNP1K SNP1K = 99 SPARC SPARC = 2 SPARC32PLUS SPARC32PLUS = 18 SPARCV9 SPARCV9 = 43 SPU SPU = 23 ST100 ST100 = 60 ST19 ST19 = 74 ST200 ST200 = 100 ST7 ST7 = 68 ST9PLUS ST9PLUS = 67 STARCORE STARCORE = 58 STM8 STM8 = 186 STXP7X STXP7X = 166 SVX SVX = 73 TILE64 TILE64 = 187 TILEGX TILEGX = 191 TILEPRO TILEPRO = 188 TINYJ TINYJ = 61 TI_C2000 TI_C2000 = 141 TI_C5500 TI_C5500 = 142 TI_C6000 TI_C6000 = 140 TMM_GPP TMM_GPP = 96 TPC TPC = 98 TRICORE TRICORE = 44 TRIMEDIA TRIMEDIA = 163 TSK3000 TSK3000 = 131 UNICORE UNICORE = 110 V800 V800 = 36 V850 V850 = 87 VAX VAX = 75 VIDEOCORE VIDEOCORE = 95 VIDEOCORE3 VIDEOCORE3 = 137 VIDEOCORE5 VIDEOCORE5 = 198 VPP500 VPP500 = 17 X86_64 X86_64 = 62 XCORE XCORE = 203 XGATE XGATE = 115 XIMO16 XIMO16 = 170 XTENSA XTENSA = 94 ZSP ZSP = 79 from_value from_value( arg: int ) → lief.ELF.ARCH = Processor Flags lief.ELF.PROCESSOR_FLAGS class lief.ELF.PROCESSOR_FLAGS( *values ) Bases: Enum ARM_EABI_UNKNOWN ARM_EABI_UNKNOWN = 8796093022208 ARM_EABI_VER1 ARM_EABI_VER1 = 8796109799424 ARM_EABI_VER2 ARM_EABI_VER2 = 8796126576640 ARM_EABI_VER3 ARM_EABI_VER3 = 8796143353856 ARM_EABI_VER4 ARM_EABI_VER4 = 8796160131072 ARM_EABI_VER5 ARM_EABI_VER5 = 8796176908288 ARM_SOFT_FLOAT ARM_SOFT_FLOAT = 8796093022720 ARM_VFP_FLOAT ARM_VFP_FLOAT = 8796093023232 HEXAGON_ISA_V2 HEXAGON_ISA_V2 = 17592186044432 HEXAGON_ISA_V3 HEXAGON_ISA_V3 = 17592186044448 HEXAGON_ISA_V4 HEXAGON_ISA_V4 = 17592186044464 HEXAGON_ISA_V5 HEXAGON_ISA_V5 = 17592186044480 HEXAGON_MACH_V2 HEXAGON_MACH_V2 = 17592186044417 HEXAGON_MACH_V3 HEXAGON_MACH_V3 = 17592186044418 HEXAGON_MACH_V4 HEXAGON_MACH_V4 = 17592186044419 HEXAGON_MACH_V5 HEXAGON_MACH_V5 = 17592186044420 LOONGARCH_ABI_DOUBLE_FLOAT LOONGARCH_ABI_DOUBLE_FLOAT = 26388279066627 LOONGARCH_ABI_SINGLE_FLOAT LOONGARCH_ABI_SINGLE_FLOAT = 26388279066626 LOONGARCH_ABI_SOFT_FLOAT LOONGARCH_ABI_SOFT_FLOAT = 26388279066625 MIPS_32BITMODE MIPS_32BITMODE = 35184372089088 MIPS_ABI2 MIPS_ABI2 = 35184372088864 MIPS_ABI_EABI32 MIPS_ABI_EABI32 = 35184372101120 MIPS_ABI_EABI64 MIPS_ABI_EABI64 = 35184372105216 MIPS_ABI_O32 MIPS_ABI_O32 = 35184372092928 MIPS_ABI_O64 MIPS_ABI_O64 = 35184372097024 MIPS_ARCH_1 MIPS_ARCH_1 = 35184372088832 MIPS_ARCH_2 MIPS_ARCH_2 = 35184640524288 MIPS_ARCH_3 MIPS_ARCH_3 = 35184908959744 MIPS_ARCH_32 MIPS_ARCH_32 = 35185714266112 MIPS_ARCH_32R2 MIPS_ARCH_32R2 = 35186251137024 MIPS_ARCH_32R6 MIPS_ARCH_32R6 = 35186788007936 MIPS_ARCH_4 MIPS_ARCH_4 = 35185177395200 MIPS_ARCH_5 MIPS_ARCH_5 = 35185445830656 MIPS_ARCH_64 MIPS_ARCH_64 = 35185982701568 MIPS_ARCH_64R2 MIPS_ARCH_64R2 = 35186519572480 MIPS_ARCH_64R6 MIPS_ARCH_64R6 = 35187056443392 MIPS_ARCH_ASE_M16 MIPS_ARCH_ASE_M16 = 35184439197696 MIPS_ARCH_ASE_MDMX MIPS_ARCH_ASE_MDMX = 35184506306560 MIPS_CPIC MIPS_CPIC = 35184372088836 MIPS_FP64 MIPS_FP64 = 35184372089344 MIPS_MACH_3900 MIPS_MACH_3900 = 35184380542976 MIPS_MACH_4010 MIPS_MACH_4010 = 35184380608512 MIPS_MACH_4100 MIPS_MACH_4100 = 35184380674048 MIPS_MACH_4111 MIPS_MACH_4111 = 35184381001728 MIPS_MACH_4120 MIPS_MACH_4120 = 35184380936192 MIPS_MACH_4650 MIPS_MACH_4650 = 35184380805120 MIPS_MACH_5400 MIPS_MACH_5400 = 35184381591552 MIPS_MACH_5500 MIPS_MACH_5500 = 35184382050304 MIPS_MACH_5900 MIPS_MACH_5900 = 35184381657088 MIPS_MACH_9000 MIPS_MACH_9000 = 35184382115840 MIPS_MACH_LS2E MIPS_MACH_LS2E = 35184382574592 MIPS_MACH_LS2F MIPS_MACH_LS2F = 35184382640128 MIPS_MACH_LS3A MIPS_MACH_LS3A = 35184382705664 MIPS_MACH_OCTEON MIPS_MACH_OCTEON = 35184381198336 MIPS_MACH_OCTEON2 MIPS_MACH_OCTEON2 = 35184381329408 MIPS_MACH_OCTEON3 MIPS_MACH_OCTEON3 = 35184381394944 MIPS_MACH_SB1 MIPS_MACH_SB1 = 35184381132800 MIPS_MACH_XLR MIPS_MACH_XLR = 35184381263872 MIPS_MICROMIPS MIPS_MICROMIPS = 35184405643264 MIPS_NAN2008 MIPS_NAN2008 = 35184372089856 MIPS_NOREORDER MIPS_NOREORDER = 35184372088833 MIPS_PIC MIPS_PIC = 35184372088834 RISCV_FLOAT_ABI_DOUBLE RISCV_FLOAT_ABI_DOUBLE = 43980465111044 RISCV_FLOAT_ABI_QUAD RISCV_FLOAT_ABI_QUAD = 43980465111046 RISCV_FLOAT_ABI_RVE RISCV_FLOAT_ABI_RVE = 43980465111048 RISCV_FLOAT_ABI_SINGLE RISCV_FLOAT_ABI_SINGLE = 43980465111042 RISCV_FLOAT_ABI_SOFT RISCV_FLOAT_ABI_SOFT = 43980465111040 RISCV_FLOAT_ABI_TSO RISCV_FLOAT_ABI_TSO = 43980465111056 RISCV_RVC RISCV_RVC = 43980465111041 from_value from_value( arg: int ) → lief.ELF.PROCESSOR_FLAGS = Utilities lief.ELF.check_layout lief.ELF.check_layout( binary: lief.ELF.Binary ) → tuple[bool, str] Check that the layout of the given binary is correct. lief.is_elflief.is_elf lief.is_elf( *args ) → bool lief.is_elf( raw: collections.abc.Sequence[int] ) → bool Overloaded function. is_elf(filename: Union[str | os.PathLike]) -> bool Check if the given file is an ELF is_elf(raw: collections.abc.Sequence[int]) -> bool Check if the given raw data is an ELF", "contentHash": "f30b5be9fb304898df4412ea4647f7c9b6a19ca335ea8ec7cd869b5385fd5410", "description": "ELF Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "formats/elf/python", "documentID": "287ebd41de445d5debb713a6e2e1b79005802c3b5e9e74b251bcf63a8791463b", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/elf/python.md", "title": "ELF Python API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/elf/rust.html", "content": "Rust Note Please check: lief::elf", "contentHash": "b6c7e4e7e599949e5a107cbab12d5d276c9543573718ea32546ebc3afc62e15c", "description": "ELF Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "formats/elf/rust", "documentID": "44445ac13b53f42af6232705417a74e4afc2e635a5937b7ad8daa1bfade0285d", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/elf/rust.md", "title": "ELF Rust API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/macho/cpp.html", "content": "C++ Parser Parser class Parser : public LIEF:: Parser The main interface to parse a Mach-O binary. This class is used to parse both Fat & non-Fat binary. Non-fat binaries are considered as a fat with only one architecture. This is why MachO::Parser::parse outputs a FatBinary object. Public Functions operator= Parser &operator=(const Parser ©) = delete Parser Parser(const Parser ©) = delete ~Parser ~Parser() Public Static Functions parse static std::unique_ptr< FatBinary > parse(std::string_view filename, const ParserConfig &conf = ParserConfig :: deep ()) Parse a Mach-O file from the path provided by the filename parameter. The conf parameter can be used to tweak the configuration of the parser Parameters: filename – [in] Path to the Mach-O file conf – [in] Parser configuration (Default: ParserConfig::deep ) PathTparse template = 0> static inline std::unique_ptr< FatBinary > parse(const PathT &filename, const ParserConfig &conf = ParserConfig :: deep ()) Same as parse(std::string_view, const ParserConfig&) but the file is given as a std::filesystem::path . parse static std::unique_ptr< FatBinary > parse(const std::vector &data, const ParserConfig &conf = ParserConfig :: deep ()) Parse a Mach-O file from the raw content provided by the data parameter. The conf parameter can be used to tweak the configuration of the parser Parameters: data – [in] Mach-O file as a vector of bytes conf – [in] Parser configuration (Default: ParserConfig::deep ) parse static std::unique_ptr< FatBinary > parse(std::unique_ptr< BinaryStream > stream, const ParserConfig &conf = ParserConfig :: deep ()) Parse a Mach-O binary from the provided BinaryStream . parse_from_memory static std::unique_ptr< FatBinary > parse_from_memory(uintptr_t address, const ParserConfig &conf = ParserConfig :: deep ()) Parse the Mach-O binary from the address given in the first parameter. parse_from_memory static std::unique_ptr< FatBinary > parse_from_memory(uintptr_t address, size_t size, const ParserConfig &conf = ParserConfig :: deep ()) Parse the Mach-O binary from the address given in the first parameter and the size given in the second parameter. parse_from_dump static std::unique_ptr< FatBinary > parse_from_dump(std::string_view filepath, uint64_t addr, const ParserConfig &conf = ParserConfig :: deep ()) Parse a Mach-O binary from a memory dump located on disk. A dump is a raw capture of the process memory that was mapped starting at the virtual address addr . This is typically used to parse a Mach-O image that has been dumped from memory (e.g. from a debugger or a runtime hook). Parameters: filepath – [in] Path to the file that contains the memory dump addr – [in] Virtual address at which the dump was mapped conf – [in] Optional configuration for the parser PathTparse_from_dump template = 0> static inline std::unique_ptr< FatBinary > parse_from_dump(const PathT &filepath, uint64_t addr, const ParserConfig &conf = ParserConfig :: deep ()) Same as parse_from_dump(std::string_view, uint64_t, const ParserConfig&) but the dump file is given as a std::filesystem::path . parse_from_dump static std::unique_ptr< FatBinary > parse_from_dump( BinaryStream &stream, uint64_t addr, const ParserConfig &conf = ParserConfig :: deep ()) Same as parse_from_dump(std::string_view, uint64_t, const ParserConfig&) but the dump is wrapped in the given non-owned stream. parse_from_dump static std::unique_ptr< FatBinary > parse_from_dump(std::unique_ptr< BinaryStream > stream, uint64_t addr, const ParserConfig &conf = ParserConfig :: deep ()) Same as parse_from_dump(std::string_view, uint64_t, const ParserConfig&) but the dump is wrapped in the given owned stream. BinaryParser class BinaryParser : public LIEF:: Parser Class used to parse a single binary (i.e. non-FAT). See also MachO::Parser Warning This class should not be used directly. Public Functions operator= BinaryParser &operator=(const BinaryParser ©) = delete BinaryParser BinaryParser(const BinaryParser ©) = delete ~BinaryParser ~BinaryParser() Public Static Functions parse static std::unique_ptr< Binary > parse(std::string_view file) parse static std::unique_ptr< Binary > parse(std::string_view file, const ParserConfig &conf) PathTparse template = 0> static inline std::unique_ptr< Binary > parse(const PathT &file, const ParserConfig &conf = ParserConfig :: deep ()) Same as parse(std::string_view, const ParserConfig&) but the file is given as a std::filesystem::path . parse static std::unique_ptr< Binary > parse(const std::vector &data, const ParserConfig &conf = ParserConfig :: deep ()) parse static std::unique_ptr< Binary > parse(const std::vector &data, uint64_t fat_offset, const ParserConfig &conf = ParserConfig :: deep ()) parse static std::unique_ptr< Binary > parse(std::unique_ptr< BinaryStream > stream, uint64_t fat_offset, const ParserConfig &conf) Friends friend class MachO::Parser ParserConfig struct ParserConfig This structure is used to tweak the MachO Parser ( MachO::Parser ). Public Functions full_dyldinfo ParserConfig &full_dyldinfo(bool flag) If flag is set to true , Exports, Bindings and Rebases opcodes are parsed. Warning Enabling this flag can slow down the parsing Public Members parse_dyld_exports bool parse_dyld_exports = true Parse the Dyld export trie. parse_dyld_bindings bool parse_dyld_bindings = true Parse the Dyld binding opcodes. parse_dyld_rebases bool parse_dyld_rebases = true Parse the Dyld rebase opcodes. parse_overlay bool parse_overlay = true Whether the overlay data should be parsed. fix_from_memory bool fix_from_memory = false When parsing Mach-O from memory, this option can be used to undo relocations and symbols bindings. When activated, this option requires parse_dyld_bindings and parse_dyld_rebases to be enabled. from_dyld_shared_cache bool from_dyld_shared_cache = false Whether the binary is coming/extracted from Dyld shared cache. Public Static Functions deep static ParserConfig deep() Return a parser configuration such as all the objects supported by LIEF are parsed. quick static ParserConfig quick() Return a configuration to parse the most important MachO structures. FatBinary FatBinary class FatBinary Class which represents a Mach-O (fat) binary This object is also used for representing Mach-O binaries that are NOT FAT . Public Types binaries_t using binaries_t = std::vector> Internal container used to store Binary objects within a Fat Mach-O. it_binaries using it_binaries = ref_iterator < binaries_t &, Binary *> Iterator that outputs Binary &. it_const_binaries using it_const_binaries = const_ref_iterator Iterator that outputs const Binary &. Public Functions FatBinary FatBinary(const FatBinary &) = delete operator= FatBinary &operator=(const FatBinary &) = delete ~FatBinary virtual ~FatBinary() size inline size_t size() const Number of MachO::Binary wrapped by this object. empty inline bool empty() const Checks whether this object contains MachO::Binary . begin inline it_binaries begin() begin inline it_const_binaries begin() const end inline it_binaries end() end inline it_const_binaries end() const release_all_binaries inline void release_all_binaries() pop_back std::unique_ptr< Binary > pop_back() Get a pointer to the last MachO::Binary object present in this Fat Binary . It returns a nullptr if no binaries are present. at inline Binary *at(size_t index) Get a pointer to the MachO::Binary specified by the index . It returns a nullptr if the binary does not exist at the given index. at inline const Binary *at(size_t index) const back inline Binary *back() back inline const Binary *back() const front inline Binary *front() front inline const Binary *front() const operator[] inline Binary *operator[](size_t index) operator[] inline const Binary *operator[](size_t index) const take std::unique_ptr< Binary > take(size_t index) Extract a MachO::Binary object. Gives ownership to the caller, and remove it from this FatBinary object. Warning This invalidates any previously held iterator! take std::unique_ptr< Binary > take( Header :: CPU_TYPE cpu) Take the underlying MachO::Binary that matches the given architecture If no binary with the architecture can be found, return a nullptr. write void write(const std::string &filename) Reconstruct the Fat binary object and write it in filename . Parameters: filename – Path to write the reconstructed binary raw std::vector raw() Reconstruct the Fat binary object and return its content as bytes. get inline Binary *get( Header :: CPU_TYPE cpu) get const Binary *get( Header :: CPU_TYPE cpu) const Gets a pointer to the MachO::Binary that matches the given architecture. operator[] inline Binary *operator[]( Header :: CPU_TYPE cpu) operator[] inline const Binary *operator[]( Header :: CPU_TYPE cpu) const Public Static Functions create static std::unique_ptr< FatBinary > create( binaries_t binaries) Create a FatBinary object from the provided list of Binary objects. The binaries must target different architectures (i.e. unique CPU type and subtype). If a duplicate architecture is detected, this function returns a nullptr. Friends friend class LIEF::Parser operator<< friend std::ostream &operator<<(std::ostream &os, const FatBinary &fatbinary) Binary Binary class Binary : public LIEF:: Binary Class which represents a MachO binary. Public Types commands_t using commands_t = std::vector> Internal container for storing Mach-O LoadCommand . it_commands using it_commands = ref_iterator < commands_t &, LoadCommand *> Iterator that outputs LoadCommand &. it_const_commands using it_const_commands = const_ref_iterator Iterator that outputs const LoadCommand &. symbols_t using symbols_t = std::vector> Internal container for storing Mach-O Symbol . it_symbols using it_symbols = ref_iterator < symbols_t &, Symbol *> Iterator that outputs Symbol &. it_const_symbols using it_const_symbols = const_ref_iterator Iterator that outputs const Symbol &. it_exported_symbols using it_exported_symbols = filter_iterator < symbols_t &, Symbol *> Iterator that outputs exported Symbol &. it_const_exported_symbols using it_const_exported_symbols = const_filter_iterator Iterator that outputs exported const Symbol &. it_imported_symbols using it_imported_symbols = filter_iterator < symbols_t &, Symbol *> Iterator that outputs imported Symbol &. it_const_imported_symbols using it_const_imported_symbols = const_filter_iterator Iterator that outputs imported const Symbol &. sections_cache_t using sections_cache_t = std::vector< Section *> Internal container for caching Mach-O Section . it_sections using it_sections = ref_iterator < sections_cache_t &> Iterator that outputs Section &. it_const_sections using it_const_sections = const_ref_iterator Iterator that outputs const Section &. segments_cache_t using segments_cache_t = std::vector< SegmentCommand *> Internal container for storing Mach-O SegmentCommand . it_segments using it_segments = ref_iterator < segments_cache_t &> Iterator that outputs SegmentCommand &. it_const_segments using it_const_segments = const_ref_iterator Iterator that outputs const SegmentCommand &. libraries_cache_t using libraries_cache_t = std::vector< DylibCommand *> Internal container for storing Mach-O DylibCommand . it_libraries using it_libraries = ref_iterator < libraries_cache_t &> Iterator that outputs DylibCommand &. it_const_libraries using it_const_libraries = const_ref_iterator Iterator that outputs const DylibCommand &. lazy_load_dylib_info_cache_t using lazy_load_dylib_info_cache_t = std::vector< LazyLoadDylibInfo *> Internal container for storing Mach-O LazyLoadDylibInfo . it_lazy_load_dylib_info using it_lazy_load_dylib_info = ref_iterator < lazy_load_dylib_info_cache_t &> Iterator that outputs LazyLoadDylibInfo &. it_const_lazy_load_dylib_info using it_const_lazy_load_dylib_info = const_ref_iterator Iterator that outputs const LazyLoadDylibInfo &. fileset_binaries_t using fileset_binaries_t = std::vector> Internal container for storing Mach-O Fileset Binary . it_fileset_binaries using it_fileset_binaries = ref_iterator < fileset_binaries_t &, Binary *> Iterator that outputs Binary &. it_const_fileset_binaries using it_const_fileset_binaries = const_ref_iterator Iterator that outputs const Binary &. relocations_t using relocations_t = std::set< Relocation *, KeyCmp > Internal container that store all the relocations found in a Mach-O. The relocations are actually owned by Section & SegmentCommand and these references are used for convenience. it_relocations using it_relocations = ref_iterator < relocations_t &, Relocation *> Iterator which outputs Relocation &. it_const_relocations using it_const_relocations = const_ref_iterator Iterator which outputs const Relocation &. it_rpaths using it_rpaths = filter_iterator < commands_t &, RPathCommand *> Iterator which outputs RPathCommand &. it_const_rpaths using it_const_rpaths = const_filter_iterator Iterator which outputs const RPathCommand &. it_sub_clients using it_sub_clients = filter_iterator < commands_t &, SubClient *> Iterator which outputs SubClient &. it_const_sub_clients using it_const_sub_clients = const_filter_iterator Iterator which outputs const SubClient &. it_bindings using it_bindings = iterator_range stub_iterator using stub_iterator = iterator_range < Stub :: Iterator > Iterator type for Symbol ’s stub. it_notes using it_notes = filter_iterator < commands_t &, NoteCommand *> Iterator which outputs NoteCommand &. it_const_notes using it_const_notes = const_filter_iterator Iterator which outputs const NoteCommand &. Public Functions Binary Binary(const Binary &) = delete operator= Binary &operator=(const Binary &) = delete header inline Header &header() Return a reference to the MachO::Header . header inline const Header &header() const commands inline it_commands commands() Return an iterator over the MachO LoadCommand present in the binary. commands inline it_const_commands commands() const filesets inline it_fileset_binaries filesets() Return an iterator over the MachO::Binary associated with the LoadCommand::TYPE::FILESET_ENTRY commands. filesets inline it_const_fileset_binaries filesets() const symbols inline it_symbols symbols() Return binary’s symbols . symbols inline it_const_symbols symbols() const has_symbol inline bool has_symbol(const std::string &name) const Check if a symbol with the given name exists. get_symbol const Symbol *get_symbol(const std::string &name) const Return Symbol from the given name. If the symbol does not exist, it returns a null pointer. get_symbol inline Symbol *get_symbol(const std::string &name) exported_symbols inline it_exported_symbols exported_symbols() Return binary’s exported symbols (iterator over LIEF::MachO::Symbol ). exported_symbols inline it_const_exported_symbols exported_symbols() const imported_symbols inline it_imported_symbols imported_symbols() Return binary’s imported symbols (iterator over LIEF::MachO::Symbol ). imported_symbols inline it_const_imported_symbols imported_symbols() const libraries inline it_libraries libraries() Return binary imported libraries ( MachO::DylibCommand ). libraries inline it_const_libraries libraries() const lazy_load_dylib_infos inline it_lazy_load_dylib_info lazy_load_dylib_infos() Return an iterator over the binary’s LazyLoadDylibInfo commands ( LC_LAZY_LOAD_DYLIB_INFO ). lazy_load_dylib_infos inline it_const_lazy_load_dylib_info lazy_load_dylib_infos() const segments inline it_segments segments() Return an iterator over the SegmentCommand . segments inline it_const_segments segments() const sections inline it_sections sections() Return an iterator over the MachO::Section . sections inline it_const_sections sections() const relocations inline it_relocations relocations() Return an iterator over the MachO::Relocation . relocations it_const_relocations relocations() const write void write(const std::string &filename) Reconstruct the binary object and write the result in the given filename . Parameters: filename – Path to write the reconstructed binary write void write(const std::string &filename, Builder :: config_t config) Reconstruct the binary object and write the result in the given filename . The second config parameter is used to tweak the building process Parameters: filename – Path to write the reconstructed binary config – Builder configuration write void write(std::ostream &os) Reconstruct the binary object and write the result in the given os stream. Parameters: os – Output stream to write the reconstructed binary write void write(std::ostream &os, Builder :: config_t config) Reconstruct the binary object and write the result in the given os stream for the given configuration. Parameters: os – Output stream to write the reconstructed binary config – Builder configuration raw std::vector raw() Reconstruct the binary object and return its content as bytes. has bool has( LoadCommand :: TYPE type) const Check if the current binary has the given MachO::LoadCommand::TYPE . get const LoadCommand *get( LoadCommand :: TYPE type) const Return the LoadCommand associated with the given LoadCommand::TYPE or a nullptr if the command can’t be found. get inline LoadCommand *get( LoadCommand :: TYPE type) add LoadCommand *add(std::unique_ptr< LoadCommand > command) add inline LoadCommand *add(const LoadCommand &command) Insert a new LoadCommand . add LoadCommand *add(const LoadCommand &command, size_t index) Insert a new LoadCommand at the specified index . add LoadCommand *add(const DylibCommand &library) Insert the given DylibCommand . add LoadCommand *add(const SegmentCommand &segment) Add a new LC_SEGMENT command from the given SegmentCommand . add_library LoadCommand *add_library(const std::string &name) Insert a new shared library through a LC_LOAD_DYLIB command. add_section Section *add_section(const Section §ion) Add a new MachO::Section in the __TEXT segment. find_library const DylibCommand *find_library(const std::string &name) const Try to find the library with the given library name. This function tries to match the fullpath of the DylibCommand or the library name suffix. find_library inline DylibCommand *find_library(const std::string &name) add_section Section *add_section(const SegmentCommand &segment, const Section §ion) Add a section in the given MachO::SegmentCommand . Warning This method may corrupt the file if the segment is not the first one nor the last one remove_section virtual void remove_section(const std::string &name, bool clear = false) override Remove the section with the name provided in the first parameter. Parameters: name – Name of the MachO::Section to remove clear – If true clear the content of the section before removing remove_section void remove_section(const std::string &segname, const std::string &secname, bool clear = false) Remove the section from the segment with the name given in the first parameter and with the section’s name provided in the second parameter. Parameters: segname – Name of the MachO::Segment secname – Name of the MachO::Section to remove clear – If true clear the content of the section before removing remove bool remove(const LoadCommand &command) Remove the given LoadCommand . remove bool remove( LoadCommand :: TYPE type) Remove all LoadCommand with the given type ( MachO::LoadCommand::TYPE ). remove_command bool remove_command(size_t index) Remove the Load Command at the provided index . remove_signature bool remove_signature() Remove the LC_SIGNATURE command. extend bool extend(const LoadCommand &command, uint64_t size) Extend the size of the given LoadCommand . extend_segment bool extend_segment(const SegmentCommand &segment, size_t size) Extend the content of the given SegmentCommand . extend_section bool extend_section( Section §ion, size_t size) Extend the content of the given Section . Note This method may extend the section more than size preventing creation a gap between the current section and the next one. This may happen trying to satisfy alignment requirement of sections. Note This method works only with sections that belong to the first segment. disable_pie bool disable_pie() Remove the PIE flag. imagebase virtual uint64_t imagebase() const override Return the binary’s imagebase. 0 if not relevant. virtual_size inline virtual uint64_t virtual_size() const override Size of the binary in memory when mapped by the loader ( dyld ). loader std::string_view loader() const Return the binary’s loader (e.g. /usr/lib/dyld ) or an empty string if the binary does not use a loader/linker. has_section inline bool has_section(const std::string &name) const Check if a section with the given name exists. get_section inline Section *get_section(const std::string &name) Return the section from the given name or a nullptr if the section can’t be found. get_section const Section *get_section(const std::string &name) const Return the section from the given name or a nullptr if the section can’t be found. get_section inline Section *get_section(const std::string &segname, const std::string &secname) Return the section from the segment with the name given in the first parameter and with the section’s name provided in the second parameter. If the section cannot be found, it returns a nullptr. get_section const Section *get_section(const std::string &segname, const std::string &secname) const has_segment inline bool has_segment(const std::string &name) const Check if a segment with the given name exists. get_segment const SegmentCommand *get_segment(const std::string &name) const Return the segment from the given name. get_segment inline SegmentCommand *get_segment(const std::string &name) Return the segment from the given name. remove_symbol bool remove_symbol(const std::string &name) Remove the symbol with the given name. remove bool remove(const Symbol &sym) Remove the given symbol. can_remove bool can_remove(const Symbol &sym) const Check if the given symbol can be safely removed. can_remove_symbol bool can_remove_symbol(const std::string &name) const Check if the MachO::Symbol with the given name can be safely removed. unexport bool unexport(const std::string &name) Remove the given MachO::Symbol with the given name from the export table. unexport bool unexport(const Symbol &sym) Remove the given symbol from the export table. section_from_offset inline Section *section_from_offset(uint64_t offset) Return the MachO::Section that encompasses the provided offset. If a section can’t be found, it returns a null pointer ( nullptr ). section_from_offset const Section *section_from_offset(uint64_t offset) const section_from_virtual_address inline Section *section_from_virtual_address(uint64_t virtual_address) Return the MachO::Section that encompasses the provided virtual address. If a section can’t be found, it returns a null pointer ( nullptr ). section_from_virtual_address const Section *section_from_virtual_address(uint64_t virtual_address) const virtual_address_to_offset result virtual_address_to_offset(uint64_t virtual_address) const Convert a virtual address to an offset in the file. offset_to_virtual_address virtual result offset_to_virtual_address(uint64_t offset, uint64_t slide = 0) const override Convert the given offset into a virtual address. Parameters: offset – [in] The offset to convert. slide – [in] If not 0, it will replace the default base address (if any) segment_from_offset inline SegmentCommand *segment_from_offset(uint64_t offset) Return the binary’s SegmentCommand that encompasses the provided offset. If a SegmentCommand can’t be found it returns a null pointer ( nullptr ). segment_from_offset const SegmentCommand *segment_from_offset(uint64_t offset) const segment_index size_t segment_index(const SegmentCommand &segment) const Return the index of the given SegmentCommand . fat_offset inline uint64_t fat_offset() const Return binary’s fat offset . 0 if not relevant. segment_from_virtual_address inline SegmentCommand *segment_from_virtual_address(uint64_t virtual_address) Return the binary’s SegmentCommand which encompasses the given virtual address or a nullptr if not found. segment_from_virtual_address const SegmentCommand *segment_from_virtual_address(uint64_t virtual_address) const va_ranges range_t va_ranges() const Return the range of virtual addresses. off_ranges range_t off_ranges() const Return the range of offsets. tlv_initial_content_range range_t tlv_initial_content_range() const Return the TLV initial content range. is_valid_addr inline bool is_valid_addr(uint64_t address) const Check if the given address is encompassed in the binary’s virtual addresses range. accept virtual void accept(LIEF::Visitor &visitor) const override Method so that the visitor can visit us. print virtual std::ostream &print(std::ostream &os) const override patch_address virtual void patch_address(uint64_t address, const std::vector &patch_value, LIEF:: Binary :: VA_TYPES addr_type = LIEF:: Binary :: VA_TYPES :: AUTO ) override Patch the content at virtual address address with patch_value . Parameters: address – [in] Address to patch patch_value – [in] Patch to apply addr_type – [in] Specify if the address should be used as an absolute virtual address or an RVA patch_address virtual void patch_address(uint64_t address, uint64_t patch_value, size_t size = sizeof(uint64_t), LIEF:: Binary :: VA_TYPES addr_type = LIEF:: Binary :: VA_TYPES :: AUTO ) override Patch the address with the given value. Parameters: address – [in] Address to patch patch_value – [in] Patch to apply size – [in] Size of the value in bytes (1, 2, … 8) addr_type – [in] Specify if the address should be used as an absolute virtual address or an RVA get_content_from_virtual_address virtual span get_content_from_virtual_address(uint64_t virtual_address, uint64_t size, Binary ::VA_TYPES addr_type = Binary ::VA_TYPES::AUTO) const override Return the content located at virtual address. entrypoint virtual uint64_t entrypoint() const override The binary entrypoint. is_pie inline virtual bool is_pie() const override Check if the binary is position independent. has_nx inline virtual bool has_nx() const override Check if the binary uses NX protection. has_nx_stack inline bool has_nx_stack() const Return True if the stack is flagged as non-executable. False otherwise. has_nx_heap inline bool has_nx_heap() const Return True if the heap is flagged as non-executable. False otherwise. has_entrypoint inline bool has_entrypoint() const true if the binary has an entrypoint. Basically for libraries it will return false has_uuid inline bool has_uuid() const true if the binary has a MachO::UUIDCommand command. uuid UUIDCommand *uuid() Return the MachO::UUIDCommand if present, a nullptr otherwise. uuid const UUIDCommand *uuid() const has_main_command inline bool has_main_command() const true if the binary has a MachO::MainCommand command. main_command MainCommand *main_command() Return the MachO::MainCommand if present, a nullptr otherwise. main_command const MainCommand *main_command() const has_dylinker inline bool has_dylinker() const true if the binary has a MachO::DylinkerCommand . dylinker DylinkerCommand *dylinker() Return the MachO::DylinkerCommand if present, a nullptr otherwise. dylinker const DylinkerCommand *dylinker() const has_dyld_info inline bool has_dyld_info() const true if the binary has a MachO::DyldInfo command. dyld_info DyldInfo *dyld_info() Return the MachO::Dyld command if present, a nullptr otherwise. dyld_info const DyldInfo *dyld_info() const has_function_starts inline bool has_function_starts() const true if the binary has a MachO::FunctionStarts command. function_starts FunctionStarts *function_starts() Return the MachO::FunctionStarts command if present, a nullptr otherwise. function_starts const FunctionStarts *function_starts() const has_source_version inline bool has_source_version() const true if the binary has a MachO::SourceVersion command. source_version SourceVersion *source_version() Return the MachO::SourceVersion command if present, a nullptr otherwise. source_version const SourceVersion *source_version() const has_version_min inline bool has_version_min() const true if the binary has a MachO::VersionMin command. version_min VersionMin *version_min() Return the MachO::VersionMin command if present, a nullptr otherwise. version_min const VersionMin *version_min() const has_thread_command inline bool has_thread_command() const true if the binary has a MachO::ThreadCommand command. thread_command ThreadCommand *thread_command() Return the MachO::ThreadCommand command if present, a nullptr otherwise. thread_command const ThreadCommand *thread_command() const has_routine_command inline bool has_routine_command() const true if the binary has a MachO::Routine command. routine_command Routine *routine_command() Return the MachO::Routine command if present, a nullptr otherwise. routine_command const Routine *routine_command() const has_rpath inline bool has_rpath() const true if the binary has a MachO::RPathCommand command. rpath RPathCommand *rpath() Return the MachO::RPathCommand command if present, a nullptr otherwise. rpath const RPathCommand *rpath() const rpaths it_rpaths rpaths() Iterator over all the MachO::RPathCommand commands. rpaths it_const_rpaths rpaths() const has_symbol_command inline bool has_symbol_command() const true if the binary has a MachO::SymbolCommand command. symbol_command SymbolCommand *symbol_command() Return the MachO::SymbolCommand if present, a nullptr otherwise. symbol_command const SymbolCommand *symbol_command() const has_dynamic_symbol_command inline bool has_dynamic_symbol_command() const true if the binary has a MachO::DynamicSymbolCommand command. dynamic_symbol_command DynamicSymbolCommand *dynamic_symbol_command() Return the MachO::SymbolCommand if present, a nullptr otherwise. dynamic_symbol_command const DynamicSymbolCommand *dynamic_symbol_command() const has_code_signature inline bool has_code_signature() const true if the binary is signed with LC_CODE_SIGNATURE command code_signature inline CodeSignature *code_signature() Return the MachO::CodeSignature if present, a nullptr otherwise. code_signature const CodeSignature *code_signature() const has_code_signature_dir inline bool has_code_signature_dir() const true if the binary is signed with the command DYLIB_CODE_SIGN_DRS code_signature_dir inline CodeSignatureDir *code_signature_dir() Return the MachO::CodeSignatureDir if present, a nullptr otherwise. code_signature_dir const CodeSignatureDir *code_signature_dir() const has_data_in_code inline bool has_data_in_code() const true if the binary has a MachO::DataInCode command. data_in_code DataInCode *data_in_code() Return the MachO::DataInCode if present, a nullptr otherwise. data_in_code const DataInCode *data_in_code() const has_segment_split_info inline bool has_segment_split_info() const true if the binary has segment split info. segment_split_info SegmentSplitInfo *segment_split_info() Return the MachO::SegmentSplitInfo if present, a nullptr otherwise. segment_split_info const SegmentSplitInfo *segment_split_info() const has_sub_framework inline bool has_sub_framework() const true if the binary has a sub framework command. has_encryption_info inline bool has_encryption_info() const true if the binary has Encryption Info. encryption_info EncryptionInfo *encryption_info() Return the MachO::EncryptionInfo if present, a nullptr otherwise. encryption_info const EncryptionInfo *encryption_info() const sub_framework SubFramework *sub_framework() Return the MachO::SubFramework if present, a nullptr otherwise. sub_framework const SubFramework *sub_framework() const subclients it_sub_clients subclients() Iterator over all the MachO::SubClient commands. subclients it_const_sub_clients subclients() const has_subclients bool has_subclients() const has_dyld_environment inline bool has_dyld_environment() const true if the binary has Dyld environment variables. dyld_environment DyldEnvironment *dyld_environment() Return the MachO::DyldEnvironment if present, a nullptr otherwise. dyld_environment const DyldEnvironment *dyld_environment() const has_build_version inline bool has_build_version() const true if the binary has the BuildVersion command. build_version BuildVersion *build_version() Return the MachO::BuildVersion if present, a nullptr otherwise. build_version const BuildVersion *build_version() const platform inline BuildVersion :: PLATFORMS platform() const Return the platform for which this Mach-O has been compiled for. is_ios inline bool is_ios() const True if this binary targets iOS. is_macos inline bool is_macos() const True if this binary targets macOS. has_dyld_chained_fixups inline bool has_dyld_chained_fixups() const true if the binary has the command LC_DYLD_CHAINED_FIXUPS. dyld_chained_fixups DyldChainedFixups *dyld_chained_fixups() Return the MachO::DyldChainedFixups if present, a nullptr otherwise. dyld_chained_fixups const DyldChainedFixups *dyld_chained_fixups() const has_dyld_exports_trie inline bool has_dyld_exports_trie() const true if the binary has the command LC_DYLD_EXPORTS_TRIE. dyld_exports_trie DyldExportsTrie *dyld_exports_trie() Return the MachO::DyldExportsTrie if present, a nullptr otherwise. dyld_exports_trie const DyldExportsTrie *dyld_exports_trie() const has_two_level_hints inline bool has_two_level_hints() const true if the binary has the command LC_TWO_LEVEL_HINTS. two_level_hints inline TwoLevelHints *two_level_hints() Return the MachO::TwoLevelHints if present, a nullptr otherwise. two_level_hints const TwoLevelHints *two_level_hints() const has_linker_opt_hint inline bool has_linker_opt_hint() const true if the binary has the command LC_LINKER_OPTIMIZATION_HINT. linker_opt_hint inline LinkerOptHint *linker_opt_hint() Return the MachO::LinkerOptHint if present, a nullptr otherwise. linker_opt_hint const LinkerOptHint *linker_opt_hint() const add_exported_function ExportInfo *add_exported_function(uint64_t address, const std::string &name) Add a symbol in the export trie of the current binary. add_local_symbol Symbol *add_local_symbol(uint64_t address, const std::string &name) Add a symbol in LC_SYMTAB command of the current binary. objc_metadata std::unique_ptr objc_metadata() const Return Objective-C metadata if present. symbol_stubs stub_iterator symbol_stubs() const Return an iterator over the symbol stubs. These stubs are involved when calling an imported function and are similar to the ELF’s plt/got mechanism. There are located in sections like: __stubs,__auth_stubs,__symbol_stub,__picsymbolstub4 has_atom_info inline bool has_atom_info() const true if the binary has the command LC_ATOM_INFO. atom_info inline AtomInfo *atom_info() Return the MachO::AtomInfo if present, a nullptr otherwise. atom_info const AtomInfo *atom_info() const notes it_notes notes() Iterator over the different LC_NOTE commands. notes it_const_notes notes() const has_notes inline bool has_notes() const True if the binary contains LC_NOTE command(s). has_function_variants inline bool has_function_variants() const true if the binary has the command LC_FUNCTION_VARIANTS . function_variants inline FunctionVariants *function_variants() Return the FunctionVariants if present, a nullptr otherwise. function_variants const FunctionVariants *function_variants() const has_function_variant_fixups inline bool has_function_variant_fixups() const true if the binary has the command LC_FUNCTION_VARIANT_FIXUPS . function_variant_fixups inline FunctionVariantFixups *function_variant_fixups() Return the FunctionVariantFixups if present, a nullptr otherwise. function_variant_fixups const FunctionVariantFixups *function_variant_fixups() const Thas_command template bool has_command() const Tcommand template T *command() Tcommand template const T *command() const Tcount_commands template size_t count_commands() const CMDFuncfor_commands template Binary &for_commands( Func f) operator[] inline LoadCommand *operator[]( LoadCommand :: TYPE type) operator[] inline const LoadCommand *operator[]( LoadCommand :: TYPE type) const ctor_functions virtual LIEF:: Binary :: functions_t ctor_functions() const override Return the list of the MachO’s constructors. functions LIEF:: Binary :: functions_t functions() const Return all the functions found in this MachO. unwind_functions LIEF:: Binary :: functions_t unwind_functions() const Return the functions found in the __unwind_info section. has_filesets inline bool has_filesets() const true if the binary has a LoadCommand::TYPE::FILESET_ENTRY command fileset_name inline std::string_view fileset_name() const Name associated with the LC_FILESET_ENTRY for this MachO. For instance: com.apple.kec.corecrypto . fileset_addr inline uint64_t fileset_addr() const Original address associated with the LC_FILESET_ENTRY for this MachO. add Symbol &add(const Symbol &symbol) Add a symbol to this binary. ~Binary ~Binary() override shift ok_error_t shift(size_t value) Shift the content located right after the Load commands table. This operation can be used to add a new command. shift_linkedit ok_error_t shift_linkedit(size_t width) Shift the position on the __LINKEDIT data by width . memory_base_address inline uint64_t memory_base_address() const If this Mach-O binary has been parsed from memory, it returns the in-memory base address of this binary. Otherwise, it returns 0 support_arm64_ptr_auth inline bool support_arm64_ptr_auth() const Check if the binary is supporting ARM64 pointer authentication (arm64e). bindings it_bindings bindings() const Return an iterator over the binding info which can come from either DyldInfo or DyldChainedFixups commands. get_function_address virtual result get_function_address(const std::string &name) const override Try to get the address for the function’s name given in parameter. overlay inline span overlay() const sort_segments void sort_segments() refresh_seg_offset void refresh_seg_offset() Public Static Functions is_exported static bool is_exported(const Symbol &symbol) Check if the given symbol is exported. is_imported static bool is_imported(const Symbol &symbol) Check if the given symbol is an imported one. classof static inline bool classof(const LIEF:: Binary *bin) can_cache_segment static bool can_cache_segment(const SegmentCommand &segment) Check if the given segment can go in the offset_seg_ cache. range_t struct range_t Public Functions size inline uint64_t size() const empty inline bool empty() const Public Members start uint64_t start = 0 end uint64_t end = 0 KeyCmp struct KeyCmp Public Functions operator() bool operator()(const Relocation *lhs, const Relocation *rhs) const Header Header class Header : public LIEF::Object Class that represents the Mach-O header. Public Types FILE_TYPE enum class FILE_TYPE : uint32_t Values: UNKNOWN enumerator UNKNOWN = 0 OBJECT enumerator OBJECT = 0x1u EXECUTE enumerator EXECUTE = 0x2u FVMLIB enumerator FVMLIB = 0x3u CORE enumerator CORE = 0x4u PRELOAD enumerator PRELOAD = 0x5u DYLIB enumerator DYLIB = 0x6u DYLINKER enumerator DYLINKER = 0x7u BUNDLE enumerator BUNDLE = 0x8u DYLIB_STUB enumerator DYLIB_STUB = 0x9u DSYM enumerator DSYM = 0xAu KEXT_BUNDLE enumerator KEXT_BUNDLE = 0xBu FILESET enumerator FILESET = 0xCu GPU_EXECUTE enumerator GPU_EXECUTE = 0xDu GPU_DYLIB enumerator GPU_DYLIB = 0xEu FLAGS enum class FLAGS : uint32_t Values: NOUNDEFS enumerator NOUNDEFS = 0x00000001u INCRLINK enumerator INCRLINK = 0x00000002u DYLDLINK enumerator DYLDLINK = 0x00000004u BINDATLOAD enumerator BINDATLOAD = 0x00000008u PREBOUND enumerator PREBOUND = 0x00000010u SPLIT_SEGS enumerator SPLIT_SEGS = 0x00000020u LAZY_INIT enumerator LAZY_INIT = 0x00000040u TWOLEVEL enumerator TWOLEVEL = 0x00000080u FORCE_FLAT enumerator FORCE_FLAT = 0x00000100u NOMULTIDEFS enumerator NOMULTIDEFS = 0x00000200u NOFIXPREBINDING enumerator NOFIXPREBINDING = 0x00000400u PREBINDABLE enumerator PREBINDABLE = 0x00000800u ALLMODSBOUND enumerator ALLMODSBOUND = 0x00001000u SUBSECTIONS_VIA_SYMBOLS enumerator SUBSECTIONS_VIA_SYMBOLS = 0x00002000u CANONICAL enumerator CANONICAL = 0x00004000u WEAK_DEFINES enumerator WEAK_DEFINES = 0x00008000u BINDS_TO_WEAK enumerator BINDS_TO_WEAK = 0x00010000u ALLOW_STACK_EXECUTION enumerator ALLOW_STACK_EXECUTION = 0x00020000u ROOT_SAFE enumerator ROOT_SAFE = 0x00040000u SETUID_SAFE enumerator SETUID_SAFE = 0x00080000u NO_REEXPORTED_DYLIBS enumerator NO_REEXPORTED_DYLIBS = 0x00100000u PIE enumerator PIE = 0x00200000u DEAD_STRIPPABLE_DYLIB enumerator DEAD_STRIPPABLE_DYLIB = 0x00400000u HAS_TLV_DESCRIPTORS enumerator HAS_TLV_DESCRIPTORS = 0x00800000u NO_HEAP_EXECUTION enumerator NO_HEAP_EXECUTION = 0x01000000u APP_EXTENSION_SAFE enumerator APP_EXTENSION_SAFE = 0x02000000u NLIST_OUTOFSYNC_WITH_DYLDINFO enumerator NLIST_OUTOFSYNC_WITH_DYLDINFO = 0x04000000u SIM_SUPPORT enumerator SIM_SUPPORT = 0x08000000u IMPLICIT_PAGEZERO enumerator IMPLICIT_PAGEZERO = 0x10000000u DYLIB_IN_CACHE enumerator DYLIB_IN_CACHE = 0x80000000u CPU_TYPE enum class CPU_TYPE : int32_t Values: ANY enumerator ANY = -1 X86 enumerator X86 = 7 X86_64 enumerator X86_64 = 7 | ABI64 MIPS enumerator MIPS = 8 MC98000 enumerator MC98000 = 10 HPPA enumerator HPPA = 11 ARM enumerator ARM = 12 ARM64 enumerator ARM64 = 12 | ABI64 MC88000 enumerator MC88000 = 13 SPARC enumerator SPARC = 14 I860 enumerator I860 = 15 ALPHA enumerator ALPHA = 16 POWERPC enumerator POWERPC = 18 POWERPC64 enumerator POWERPC64 = 18 | ABI64 APPLE_GPU enumerator APPLE_GPU = 19 | ABI64 AMD_GPU enumerator AMD_GPU = 20 | ABI64 INTEL_GPU enumerator INTEL_GPU = 21 | ABI64 AIR64 enumerator AIR64 = 23 | ABI64 Public Functions Header Header() = default operator= Header &operator=(const Header ©) = default Header Header(const Header ©) = default ~Header ~Header() override = default magic inline MACHO_TYPES magic() const The Mach-O magic bytes. These bytes determine whether it is a 32 bits Mach-O, a 64 bits Mach-O files etc. cpu_type inline CPU_TYPE cpu_type() const The CPU architecture targeted by this binary. cpu_subtype inline uint32_t cpu_subtype() const Return the CPU subtype supported by the Mach-O binary. For ARM architectures, this value could represent the minimum version for which the Mach-O binary has been compiled for. file_type inline FILE_TYPE file_type() const Return the type of the Mach-O file (executable, object, shared library, …). flags_list std::vector< FLAGS > flags_list() const Return the FLAGS as a list. has bool has( FLAGS flag) const Check if the given HEADER_FLAGS is present in the header’s flags. nb_cmds inline uint32_t nb_cmds() const Number of LoadCommand present in the Mach-O binary. sizeof_cmds inline uint32_t sizeof_cmds() const The size of all the LoadCommand . flags inline uint32_t flags() const Header flags (cf. HEADER_FLAGS). See also flags_list reserved inline uint32_t reserved() const According to the official documentation, a reserved value. add void add( FLAGS flag) magic inline void magic( MACHO_TYPES magic) cpu_type inline void cpu_type( CPU_TYPE type) cpu_subtype inline void cpu_subtype(uint32_t cpusubtype) file_type inline void file_type( FILE_TYPE filetype) nb_cmds inline void nb_cmds(uint32_t ncmds) sizeof_cmds inline void sizeof_cmds(uint32_t sizeofcmds) flags inline void flags(uint32_t flags) is_32bit inline bool is_32bit() const True if the binary is 32-bit. is_64bit inline bool is_64bit() const True if the binary is 64-bit. remove void remove( FLAGS flag) reserved inline void reserved(uint32_t reserved) operator+= inline Header &operator+=( FLAGS c) operator-= inline Header &operator-=( FLAGS c) accept virtual void accept(Visitor &visitor) const override Public Static Attributes ABI64 static int ABI64 = 0x01000000 SUBTYPE_MASK static uint32_t SUBTYPE_MASK = 0xff000000 SUBTYPE_LIB64 static uint32_t SUBTYPE_LIB64 = 0x80000000 CPU_SUBTYPE_ARM64_ARM64E static auto CPU_SUBTYPE_ARM64_ARM64E = 2 Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Header &hdr) Builder Builder class Builder Class used to rebuild a Mach-O file. Public Functions Builder Builder() = delete ~Builder ~Builder() Public Static Functions write static ok_error_t write( Binary &binary, const std::string &filename) write static ok_error_t write( Binary &binary, const std::string &filename, config_t config) write static ok_error_t write( Binary &binary, std::vector &out) write static ok_error_t write( Binary &binary, std::vector &out, config_t config) write static ok_error_t write( Binary &binary, std::ostream &out) write static ok_error_t write( Binary &binary, std::ostream &out, config_t config) write static ok_error_t write( FatBinary &fat, const std::string &filename) write static ok_error_t write( FatBinary &fat, const std::string &filename, config_t config) write static ok_error_t write( FatBinary &fat, std::vector &out) write static ok_error_t write( FatBinary &fat, std::vector &out, config_t config) write static ok_error_t write( FatBinary &fat, std::ostream &out) write static ok_error_t write( FatBinary &fat, std::ostream &out, config_t config) config_t struct config_t Options to tweak the building process. Public Members linkedit bool linkedit = true DylibCommand DylibCommand class DylibCommand : public LIEF::MachO:: LoadCommand Class which represents a library dependency. Public Types version_t using version_t = std::array Public Functions DylibCommand DylibCommand() = default DylibCommand DylibCommand(const details::dylib_command &cmd) operator= DylibCommand &operator=(const DylibCommand ©) = default DylibCommand DylibCommand(const DylibCommand ©) = default ~DylibCommand ~DylibCommand() override = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override name inline std::string_view name() const Library name. name_offset inline uint32_t name_offset() const Original string offset of the name. timestamp inline uint32_t timestamp() const Date and Time when the shared library was built. current_version inline version_t current_version() const Current version of the shared library. compatibility_version inline version_t compatibility_version() const Compatibility version of the shared library. name inline void name(std::string name) timestamp inline void timestamp(uint32_t timestamp) current_version inline void current_version( version_t version) compatibility_version inline void compatibility_version( version_t version) print virtual std::ostream &print(std::ostream &os) const override accept virtual void accept(Visitor &visitor) const override Public Static Functions int2version static inline version_t int2version(uint32_t version) Helper to convert an integer into a version array. version2int static inline uint32_t version2int( version_t version) Helper to convert a version array into an integer. weak_dylib static DylibCommand weak_dylib(const std::string &name, uint32_t timestamp = 0, uint32_t current_version = 0, uint32_t compat_version = 0) Factory function to generate a LC_LOAD_WEAK_DYLIB library. id_dylib static DylibCommand id_dylib(const std::string &name, uint32_t timestamp = 0, uint32_t current_version = 0, uint32_t compat_version = 0) Factory function to generate a LC_ID_DYLIB library. load_dylib static DylibCommand load_dylib(const std::string &name, uint32_t timestamp = 2, uint32_t current_version = 0, uint32_t compat_version = 0) Factory function to generate a LC_LOAD_DYLIB library. reexport_dylib static DylibCommand reexport_dylib(const std::string &name, uint32_t timestamp = 0, uint32_t current_version = 0, uint32_t compat_version = 0) Factory function to generate a LC_REEXPORT_DYLIB library. load_upward_dylib static DylibCommand load_upward_dylib(const std::string &name, uint32_t timestamp = 0, uint32_t current_version = 0, uint32_t compat_version = 0) Factory function to generate a LC_LOAD_UPWARD_DYLIB library. lazy_load_dylib static DylibCommand lazy_load_dylib(const std::string &name, uint32_t timestamp = 0, uint32_t current_version = 0, uint32_t compat_version = 0) Factory function to generate a LC_LAZY_LOAD_DYLIB library. classof static inline bool classof(const LoadCommand *cmd) DylinkerCommand DylinkerCommand class DylinkerCommand : public LIEF::MachO:: LoadCommand Class that represents the Mach-O linker, also named loader. Most of the time, DylinkerCommand::name() should return /usr/lib/dyld . Public Functions DylinkerCommand DylinkerCommand() = default DylinkerCommand DylinkerCommand(const details::dylinker_command &cmd) DylinkerCommand DylinkerCommand(std::string name) operator= DylinkerCommand &operator=(const DylinkerCommand ©) = default DylinkerCommand DylinkerCommand(const DylinkerCommand ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override ~DylinkerCommand ~DylinkerCommand() override = default print virtual std::ostream &print(std::ostream &os) const override name inline std::string_view name() const Path to the linker (or loader). name inline void name(std::string name) accept virtual void accept(Visitor &visitor) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) DynamicSymbolCommand DynamicSymbolCommand class DynamicSymbolCommand : public LIEF::MachO:: LoadCommand Class that represents the LC_DYSYMTAB command. This command completes the LC_SYMTAB ( SymbolCommand ) to provide a better granularity over the symbols layout. Public Types indirect_symbols_t using indirect_symbols_t = std::vector< Symbol *> Container for the indirect symbols references (owned by MachO::Binary ). it_indirect_symbols using it_indirect_symbols = ref_iterator < indirect_symbols_t &> Iterator for the indirect symbols referenced by this command. it_const_indirect_symbols using it_const_indirect_symbols = const_ref_iterator Public Functions DynamicSymbolCommand DynamicSymbolCommand() DynamicSymbolCommand DynamicSymbolCommand(const details::dysymtab_command &cmd) operator= DynamicSymbolCommand &operator=(const DynamicSymbolCommand ©) = default DynamicSymbolCommand DynamicSymbolCommand(const DynamicSymbolCommand ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override ~DynamicSymbolCommand ~DynamicSymbolCommand() override = default accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override idx_local_symbol inline uint32_t idx_local_symbol() const Index of the first symbol in the group of local symbols. nb_local_symbols inline uint32_t nb_local_symbols() const Number of symbols in the group of local symbols. idx_external_define_symbol inline uint32_t idx_external_define_symbol() const Index of the first symbol in the group of defined external symbols. nb_external_define_symbols inline uint32_t nb_external_define_symbols() const Number of symbols in the group of defined external symbols. idx_undefined_symbol inline uint32_t idx_undefined_symbol() const Index of the first symbol in the group of undefined external symbols. nb_undefined_symbols inline uint32_t nb_undefined_symbols() const Number of symbols in the group of undefined external symbols. toc_offset inline uint32_t toc_offset() const Byte offset from the start of the file to the table of contents data. Table of content is used by legacy Mach-O loader and this field should be set to 0 nb_toc inline uint32_t nb_toc() const Number of entries in the table of contents. Should be set to 0 on recent Mach-O module_table_offset inline uint32_t module_table_offset() const Byte offset from the start of the file to the module table data. This field seems unused by recent Mach-O loader and should be set to 0 nb_module_table inline uint32_t nb_module_table() const Number of entries in the module table. This field seems unused by recent Mach-O loader and should be set to 0 external_reference_symbol_offset inline uint32_t external_reference_symbol_offset() const Byte offset from the start of the file to the external reference table data. This field seems unused by recent Mach-O loader and should be set to 0 nb_external_reference_symbols inline uint32_t nb_external_reference_symbols() const Number of entries in the external reference table. This field seems unused by recent Mach-O loader and should be set to 0 indirect_symbol_offset inline uint32_t indirect_symbol_offset() const Byte offset from the start of the file to the indirect symbol table data. Indirect symbol table is used by the loader to speed-up symbol resolution during the lazy binding process References: dyld-519.2.1/src/ImageLoaderMachOCompressed.cpp dyld-519.2.1/src/ImageLoaderMachOClassic.cpp nb_indirect_symbols inline uint32_t nb_indirect_symbols() const Number of entries in the indirect symbol table. See also indirect_symbol_offset external_relocation_offset inline uint32_t external_relocation_offset() const Byte offset from the start of the file to the external relocation table data. This field seems unused by recent Mach-O loader and should be set to 0 nb_external_relocations inline uint32_t nb_external_relocations() const Number of entries in the external relocation table. This field seems unused by recent Mach-O loader and should be set to 0 local_relocation_offset inline uint32_t local_relocation_offset() const Byte offset from the start of the file to the local relocation table data. This field seems unused by recent Mach-O loader and should be set to 0 nb_local_relocations inline uint32_t nb_local_relocations() const Number of entries in the local relocation table. This field seems unused by recent Mach-O loader and should be set to 0 idx_local_symbol inline void idx_local_symbol(uint32_t value) nb_local_symbols inline void nb_local_symbols(uint32_t value) idx_external_define_symbol inline void idx_external_define_symbol(uint32_t value) nb_external_define_symbols inline void nb_external_define_symbols(uint32_t value) idx_undefined_symbol inline void idx_undefined_symbol(uint32_t value) nb_undefined_symbols inline void nb_undefined_symbols(uint32_t value) toc_offset inline void toc_offset(uint32_t value) nb_toc inline void nb_toc(uint32_t value) module_table_offset inline void module_table_offset(uint32_t value) nb_module_table inline void nb_module_table(uint32_t value) external_reference_symbol_offset inline void external_reference_symbol_offset(uint32_t value) nb_external_reference_symbols inline void nb_external_reference_symbols(uint32_t value) indirect_symbol_offset inline void indirect_symbol_offset(uint32_t value) nb_indirect_symbols inline void nb_indirect_symbols(uint32_t value) external_relocation_offset inline void external_relocation_offset(uint32_t value) nb_external_relocations inline void nb_external_relocations(uint32_t value) local_relocation_offset inline void local_relocation_offset(uint32_t value) nb_local_relocations inline void nb_local_relocations(uint32_t value) indirect_symbols inline it_indirect_symbols indirect_symbols() Iterator over the indirect symbols indexed by this command. indirect_symbols inline it_const_indirect_symbols indirect_symbols() const Public Static Functions classof static inline bool classof(const LoadCommand *cmd) LoadCommand LoadCommand class LoadCommand : public LIEF::Object Base class for the Mach-O load commands. Subclassed by LIEF::MachO::AtomInfo, LIEF::MachO::BuildVersion , LIEF::MachO::CodeSignature , LIEF::MachO::CodeSignatureDir , LIEF::MachO::DataInCode , LIEF::MachO::DyldChainedFixups , LIEF::MachO::DyldEnvironment , LIEF::MachO::DyldExportsTrie , LIEF::MachO::DyldInfo , LIEF::MachO::DylibCommand , LIEF::MachO::DylinkerCommand , LIEF::MachO::DynamicSymbolCommand , LIEF::MachO::EncryptionInfo , LIEF::MachO::FilesetCommand , LIEF::MachO::FunctionStarts , LIEF::MachO::FunctionVariantFixups , LIEF::MachO::FunctionVariants , LIEF::MachO::LazyLoadDylibInfo , LIEF::MachO::LinkerOptHint , LIEF::MachO::MainCommand , LIEF::MachO::NoteCommand , LIEF::MachO::RPathCommand , LIEF::MachO::Routine , LIEF::MachO::SegmentCommand , LIEF::MachO::SegmentSplitInfo , LIEF::MachO::SourceVersion , LIEF::MachO::SubClient , LIEF::MachO::SubFramework , LIEF::MachO::SymbolCommand , LIEF::MachO::ThreadCommand , LIEF::MachO::TwoLevelHints , LIEF::MachO::UUIDCommand , LIEF::MachO::UnknownCommand , LIEF::MachO::VersionMin Public Types TYPE enum class TYPE : uint64_t Values: UNKNOWN enumerator UNKNOWN = 0 SEGMENT enumerator SEGMENT = 0x00000001u SYMTAB enumerator SYMTAB = 0x00000002u SYMSEG enumerator SYMSEG = 0x00000003u THREAD enumerator THREAD = 0x00000004u UNIXTHREAD enumerator UNIXTHREAD = 0x00000005u LOADFVMLIB enumerator LOADFVMLIB = 0x00000006u IDFVMLIB enumerator IDFVMLIB = 0x00000007u IDENT enumerator IDENT = 0x00000008u FVMFILE enumerator FVMFILE = 0x00000009u PREPAGE enumerator PREPAGE = 0x0000000Au DYSYMTAB enumerator DYSYMTAB = 0x0000000Bu LOAD_DYLIB enumerator LOAD_DYLIB = 0x0000000Cu ID_DYLIB enumerator ID_DYLIB = 0x0000000Du LOAD_DYLINKER enumerator LOAD_DYLINKER = 0x0000000Eu ID_DYLINKER enumerator ID_DYLINKER = 0x0000000Fu PREBOUND_DYLIB enumerator PREBOUND_DYLIB = 0x00000010u ROUTINES enumerator ROUTINES = 0x00000011u SUB_FRAMEWORK enumerator SUB_FRAMEWORK = 0x00000012u SUB_UMBRELLA enumerator SUB_UMBRELLA = 0x00000013u SUB_CLIENT enumerator SUB_CLIENT = 0x00000014u SUB_LIBRARY enumerator SUB_LIBRARY = 0x00000015u TWOLEVEL_HINTS enumerator TWOLEVEL_HINTS = 0x00000016u PREBIND_CKSUM enumerator PREBIND_CKSUM = 0x00000017u LOAD_WEAK_DYLIB enumerator LOAD_WEAK_DYLIB = 0x80000018u SEGMENT_64 enumerator SEGMENT_64 = 0x00000019u ROUTINES_64 enumerator ROUTINES_64 = 0x0000001Au UUID enumerator UUID = 0x0000001Bu RPATH enumerator RPATH = 0x8000001Cu CODE_SIGNATURE enumerator CODE_SIGNATURE = 0x0000001Du SEGMENT_SPLIT_INFO enumerator SEGMENT_SPLIT_INFO = 0x0000001Eu REEXPORT_DYLIB enumerator REEXPORT_DYLIB = 0x8000001Fu LAZY_LOAD_DYLIB enumerator LAZY_LOAD_DYLIB = 0x00000020u ENCRYPTION_INFO enumerator ENCRYPTION_INFO = 0x00000021u DYLD_INFO enumerator DYLD_INFO = 0x00000022u DYLD_INFO_ONLY enumerator DYLD_INFO_ONLY = 0x80000022u LOAD_UPWARD_DYLIB enumerator LOAD_UPWARD_DYLIB = 0x80000023u VERSION_MIN_MACOSX enumerator VERSION_MIN_MACOSX = 0x00000024u VERSION_MIN_IPHONEOS enumerator VERSION_MIN_IPHONEOS = 0x00000025u FUNCTION_STARTS enumerator FUNCTION_STARTS = 0x00000026u DYLD_ENVIRONMENT enumerator DYLD_ENVIRONMENT = 0x00000027u MAIN enumerator MAIN = 0x80000028u DATA_IN_CODE enumerator DATA_IN_CODE = 0x00000029u SOURCE_VERSION enumerator SOURCE_VERSION = 0x0000002Au DYLIB_CODE_SIGN_DRS enumerator DYLIB_CODE_SIGN_DRS = 0x0000002Bu ENCRYPTION_INFO_64 enumerator ENCRYPTION_INFO_64 = 0x0000002Cu LINKER_OPTION enumerator LINKER_OPTION = 0x0000002Du LINKER_OPTIMIZATION_HINT enumerator LINKER_OPTIMIZATION_HINT = 0x0000002Eu VERSION_MIN_TVOS enumerator VERSION_MIN_TVOS = 0x0000002Fu VERSION_MIN_WATCHOS enumerator VERSION_MIN_WATCHOS = 0x00000030u NOTE enumerator NOTE = 0x00000031u BUILD_VERSION enumerator BUILD_VERSION = 0x00000032u DYLD_EXPORTS_TRIE enumerator DYLD_EXPORTS_TRIE = 0x80000033u DYLD_CHAINED_FIXUPS enumerator DYLD_CHAINED_FIXUPS = 0x80000034u FILESET_ENTRY enumerator FILESET_ENTRY = 0x80000035u ATOM_INFO enumerator ATOM_INFO = 0x00000036u FUNCTION_VARIANTS enumerator FUNCTION_VARIANTS = 0x00000037u FUNCTION_VARIANT_FIXUPS enumerator FUNCTION_VARIANT_FIXUPS = 0x00000038u TARGET_TRIPLE enumerator TARGET_TRIPLE = 0x00000039u LAZY_LOAD_DYLIB_INFO enumerator LAZY_LOAD_DYLIB_INFO = 0x0000003Au LIEF_UNKNOWN enumerator LIEF_UNKNOWN = 0xffee0001u raw_t using raw_t = std::vector Public Functions LoadCommand LoadCommand() = default LoadCommand LoadCommand(const details::load_command &command) LoadCommand inline LoadCommand( LoadCommand ::TYPE type, uint32_t size) operator= LoadCommand &operator=(const LoadCommand ©) = default LoadCommand LoadCommand(const LoadCommand ©) = default swap void swap( LoadCommand &other) noexcept clone inline virtual std::unique_ptr< LoadCommand > clone() const ~LoadCommand ~LoadCommand() override = default command inline LoadCommand :: TYPE command() const Command type. size inline uint32_t size() const Size of the command (should be greater than sizeof(load_command) ). data inline span data() const Raw command. command_offset inline uint64_t command_offset() const Offset of the command within the Load Command Table . data inline void data( raw_t data) command inline void command( LoadCommand :: TYPE command) size inline void size(uint32_t size) command_offset inline void command_offset(uint64_t offset) print virtual std::ostream &print(std::ostream &os) const accept virtual void accept(Visitor &visitor) const override Tcast template inline const T *cast() const Tcast template inline T *cast() Public Static Functions is_linkedit_data static bool is_linkedit_data(const LoadCommand &cmd) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const LoadCommand &cmd) MainCommand MainCommand class MainCommand : public LIEF::MachO:: LoadCommand Class that represents the LC_MAIN command. This kind of command can be used to determine the entrypoint of an executable. Public Functions MainCommand MainCommand() = default MainCommand MainCommand(const details::entry_point_command &cmd) MainCommand MainCommand(uint64_t entrypoint, uint64_t stacksize) operator= MainCommand &operator=(const MainCommand ©) = default MainCommand MainCommand(const MainCommand ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override ~MainCommand ~MainCommand() override = default entrypoint inline uint64_t entrypoint() const Offset of the main function relative to the __TEXT segment. stack_size inline uint64_t stack_size() const The initial stack size. entrypoint inline void entrypoint(uint64_t entrypoint) stack_size inline void stack_size(uint64_t stacksize) print virtual std::ostream &print(std::ostream &os) const override accept virtual void accept(Visitor &visitor) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) NoteCommand NoteCommand class NoteCommand : public LIEF::MachO:: LoadCommand Class that represents the LC_NOTE command. This command is used to include arbitrary notes or metadata within a binary. Public Functions NoteCommand NoteCommand() = default NoteCommand NoteCommand(const details::note_command &cmd) operator= NoteCommand &operator=(const NoteCommand ©) = default NoteCommand NoteCommand(const NoteCommand ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override note_offset inline uint64_t note_offset() const Offset of the data associated with this note. note_size inline uint64_t note_size() const Size of the data referenced by the note_offset. owner inline span owner() const Owner of the note (e.g. AIR_METALLIB ). owner inline span owner() owner_str inline std::string owner_str() const Owner as a zero-terminated string. note_offset inline void note_offset(uint64_t offset) note_size inline void note_size(uint64_t size) ~NoteCommand ~NoteCommand() override = default print virtual std::ostream &print(std::ostream &os) const override accept virtual void accept(Visitor &visitor) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Section Section class Section : public LIEF:: Section Class that represents a Mach-O section. Subclassed by LIEF::MachO::ThreadLocalVariables Public Types TYPE enum class TYPE : uint64_t Values: REGULAR enumerator REGULAR = 0x00u Regular section. ZEROFILL enumerator ZEROFILL = 0x01u Zero fill on demand section. CSTRING_LITERALS enumerator CSTRING_LITERALS = 0x02u Section with literal C strings. IS_4BYTE_LITERALS enumerator IS_4BYTE_LITERALS = 0x03u Section with 4 byte literals. IS_8BYTE_LITERALS enumerator IS_8BYTE_LITERALS = 0x04u Section with 8 byte literals. LITERAL_POINTERS enumerator LITERAL_POINTERS = 0x05u Section with pointers to literals. NON_LAZY_SYMBOL_POINTERS enumerator NON_LAZY_SYMBOL_POINTERS = 0x06u Section with non-lazy symbol pointers. LAZY_SYMBOL_POINTERS enumerator LAZY_SYMBOL_POINTERS = 0x07u Section with lazy symbol pointers. SYMBOL_STUBS enumerator SYMBOL_STUBS = 0x08u Section with symbol stubs, byte size of stub in the Reserved2 field. MOD_INIT_FUNC_POINTERS enumerator MOD_INIT_FUNC_POINTERS = 0x09u Section with only function pointers for initialization. MOD_TERM_FUNC_POINTERS enumerator MOD_TERM_FUNC_POINTERS = 0x0au Section with only function pointers for termination. COALESCED enumerator COALESCED = 0x0bu Section contains symbols that are to be coalesced. GB_ZEROFILL enumerator GB_ZEROFILL = 0x0cu Zero fill on demand section (that can be larger than 4 gigabytes). INTERPOSING enumerator INTERPOSING = 0x0du Section with only pairs of function pointers for interposing. IS_16BYTE_LITERALS enumerator IS_16BYTE_LITERALS = 0x0eu Section with only 16 byte literals. DTRACE_DOF enumerator DTRACE_DOF = 0x0fu Section contains DTrace Object Format. LAZY_DYLIB_SYMBOL_POINTERS enumerator LAZY_DYLIB_SYMBOL_POINTERS = 0x10u Section with lazy symbol pointers to lazy loaded dylibs. THREAD_LOCAL_REGULAR enumerator THREAD_LOCAL_REGULAR = 0x11u Thread local data section. THREAD_LOCAL_ZEROFILL enumerator THREAD_LOCAL_ZEROFILL = 0x12u Thread local zerofill section. THREAD_LOCAL_VARIABLES enumerator THREAD_LOCAL_VARIABLES = 0x13u Section with thread local variable structure data. THREAD_LOCAL_VARIABLE_POINTERS enumerator THREAD_LOCAL_VARIABLE_POINTERS = 0x14u Section with pointers to thread local structures. THREAD_LOCAL_INIT_FUNCTION_POINTERS enumerator THREAD_LOCAL_INIT_FUNCTION_POINTERS = 0x15u Section with thread local variable initialization pointers to functions. INIT_FUNC_OFFSETS enumerator INIT_FUNC_OFFSETS = 0x16u Section with 32-bit offsets to initializer functions. FLAGS enum class FLAGS : uint64_t Values: PURE_INSTRUCTIONS enumerator PURE_INSTRUCTIONS = 0x80000000u Section contains only true machine instructions. NO_TOC enumerator NO_TOC = 0x40000000u Section contains coalesced symbols that are not to be in a ranlib table of contents. STRIP_STATIC_SYMS enumerator STRIP_STATIC_SYMS = 0x20000000u Okay to strip static symbols in this section in files with the MY_DYLDLINK flag. NO_DEAD_STRIP enumerator NO_DEAD_STRIP = 0x10000000u No dead stripping. LIVE_SUPPORT enumerator LIVE_SUPPORT = 0x08000000u Blocks are live if they reference live blocks. SELF_MODIFYING_CODE enumerator SELF_MODIFYING_CODE = 0x04000000u Used with i386 code stubs written on by dyld. DEBUG_INFO enumerator DEBUG_INFO = 0x02000000u A debug section. SOME_INSTRUCTIONS enumerator SOME_INSTRUCTIONS = 0x00000400u Section contains some machine instructions. EXT_RELOC enumerator EXT_RELOC = 0x00000200u Section has external relocation entries. LOC_RELOC enumerator LOC_RELOC = 0x00000100u Section has local relocation entries. content_t using content_t = std::vector relocations_t using relocations_t = std::vector> Internal container for storing Mach-O Relocation . it_relocations using it_relocations = ref_iterator < relocations_t &, Relocation *> Iterator which outputs Relocation &. it_const_relocations using it_const_relocations = const_ref_iterator Iterator which outputs const Relocation &. Public Functions Section Section(const details::section_32 &sec) Section Section(const details::section_64 &sec) Section Section( Section &&) operator= Section &operator=( Section &&) ~Section ~Section() override clone inline virtual std::unique_ptr< Section > clone() const content virtual span content() const override Section ’s content. content inline span content() content virtual void content(const content_t &data) override Update the content of the section. segment_name std::string_view segment_name() const Return the name of the segment linked to this section. address inline uint64_t address() const Virtual base address of the section. alignment inline uint32_t alignment() const Section alignment as a power of 2. relocation_offset inline uint32_t relocation_offset() const Offset of the relocation table. This value should be 0 for executable and libraries as the relocations are managed by the DyldInfo::rebase . On the other hand, for object files ( .o ) this value should not be 0 See also numberof_relocations See also relocations numberof_relocations inline uint32_t numberof_relocations() const Number of relocations associated with this section. flags inline FLAGS flags() const Section ’s flags masked with SECTION_FLAGS_MASK (see: Section::FLAGS ). See also flags type inline TYPE type() const Type of the section. This value can help to determine the purpose of the section (e.g. TYPE::INTERPOSING ). reserved1 inline uint32_t reserved1() const According to the official loader.h file, this value is reserved for offset or index . reserved2 inline uint32_t reserved2() const According to the official loader.h file, this value is reserved for count or sizeof . reserved3 inline uint32_t reserved3() const This value is only present for 64 bits Mach-O files. In that case, the value is reserved . flags_list std::vector< FLAGS > flags_list() const Return the Section::flags as a list of Section::FLAGS . See also flags raw_flags inline uint32_t raw_flags() const Section flags without applying the SECTION_FLAGS_MASK mask. has_segment inline bool has_segment() const Check if this section is correctly linked with a MachO::SegmentCommand . segment inline SegmentCommand *segment() The segment associated with this section or a nullptr if not present. segment inline const SegmentCommand *segment() const stream std::unique_ptr< SpanStream > stream() const Return a stream over the content of this section. clear inline void clear(uint8_t v) Clear the content of this section by filling its values with the byte provided in parameter. relocations inline it_relocations relocations() Return an iterator over the MachO::Relocation associated with this section. This iterator is likely to be empty for executables and libraries while it should not be for object files ( .o ) relocations inline it_const_relocations relocations() const segment_name void segment_name(const std::string &name) address inline void address(uint64_t address) alignment inline void alignment(uint32_t align) relocation_offset inline void relocation_offset(uint32_t offset) numberof_relocations inline void numberof_relocations(uint32_t nb_reloc) flags inline void flags(uint32_t flags) flags void flags(std::vector< FLAGS > flags) type inline void type( TYPE type) reserved1 inline void reserved1(uint32_t reserved1) reserved2 inline void reserved2(uint32_t reserved2) reserved3 inline void reserved3(uint32_t reserved3) has bool has( FLAGS flag) const Check if the section has the given Section::FLAGS flag. add void add( FLAGS flag) Append a Section::FLAGS to the current section. remove void remove( FLAGS flag) Remove a Section::FLAGS to the current section. operator+= inline Section &operator+=( FLAGS flag) operator-= inline Section &operator-=( FLAGS flag) Tcast template inline const T *cast() const Tcast template inline T *cast() accept virtual void accept(Visitor &visitor) const override Public Static Functions create static std::unique_ptr< Section > create(const details::section_32 &sec) create static std::unique_ptr< Section > create(const details::section_64 &sec) create static std::unique_ptr< Section > create(std::string name, const content_t &content, TYPE type = TYPE :: REGULAR ) create static inline std::unique_ptr< Section > create(std::string name, TYPE type = TYPE :: REGULAR ) Public Static Attributes FLAGS_MASK static auto FLAGS_MASK = uint32_t(0xffffff00u) TYPE_MASK static auto TYPE_MASK = uint32_t(0xff) Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Section §ion) ThreadLocalVariables ThreadLocalVariables class ThreadLocalVariables : public LIEF::MachO:: Section This class represents a MachO section with type Section::TYPE::THREAD_LOCAL_VARIABLES ( S_THREAD_LOCAL_VARIABLES ). Such a section contains an array of thread-local variable descriptors ( Thunk ) that the dynamic linker (dyld) uses to lazily initialize thread-local storage (TLS) on first access. Each descriptor holds a pointer to the initializer function, a TLS key, and the offset of the variable in the TLS block. Public Types thunks_it using thunks_it = iterator_range < Iterator > Public Functions ThreadLocalVariables ThreadLocalVariables() ThreadLocalVariables ThreadLocalVariables(const ThreadLocalVariables &) = default ThreadLocalVariables ThreadLocalVariables( ThreadLocalVariables &&) noexcept = default operator= ThreadLocalVariables &operator=(const ThreadLocalVariables &) = default operator= ThreadLocalVariables &operator=( ThreadLocalVariables &&) noexcept = default clone inline virtual std::unique_ptr< Section > clone() const override thunks inline thunks_it thunks() const Return an iterator range over the Thunk descriptors stored in this section. nb_thunks size_t nb_thunks() const Number of Thunk descriptors in this section. get std::optional< Thunk > get(size_t idx) const Access the Thunk at the given idx , or return an empty optional if the index is out of range. set void set(size_t idx, const Thunk &thunk) Change the Thunk at the given idx . operator[] inline std::optional< Thunk > operator[](size_t idx) const Access the Thunk at the given idx . ~ThreadLocalVariables ~ThreadLocalVariables() override = default Section Section(const details::section_32 &sec) Section Section(const details::section_64 &sec) Section Section( Section &&) Public Static Functions classof static inline bool classof(const Section *section) Friends friend class Section Thunk struct Thunk Descriptor for a single thread-local variable. The layout mirrors the tlv_descriptor structure defined in (see also libdyld/ThreadLocalVariables.h in dyld). Public Functions to_string std::string to_string() const Public Members func uint64_t func = 0 Address of the initializer function ( tlv_thunk ). key uint64_t key = 0 pthread_key_t key used by the runtime offset uint64_t offset = 0 Offset of the variable in the TLS block. Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Thunk &thunk) Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::random_access_iterator_tag, const Thunk > Random-access iterator that materializes Thunk values on the fly from the raw section content. Public Functions Iterator Iterator() = default Iterator inline Iterator(const ThreadLocalVariables &parent, size_t pos) Iterator Iterator(const Iterator &) = default operator= Iterator &operator=(const Iterator &) = default Iterator Iterator( Iterator &&) noexcept = default operator= Iterator &operator=( Iterator &&) noexcept = default ~Iterator ~Iterator() = default operator< inline bool operator<(const Iterator &rhs) const operator- inline std::ptrdiff_t operator-(const Iterator &R) const operator+= inline Iterator &operator+=(std::ptrdiff_t n) operator-= inline Iterator &operator-=(std::ptrdiff_t n) operator* inline Thunk operator*() const Friends operator== inline friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) SegmentCommand SegmentCommand class SegmentCommand : public LIEF::MachO:: LoadCommand Class which represents a LoadCommand::TYPE::SEGMENT / LoadCommand::TYPE::SEGMENT_64 command. Subclassed by LIEF::MachO::LinkEdit Public Types FLAGS enum class FLAGS : uint64_t Values: HIGHVM enumerator HIGHVM = 0x1u The file contents for this segment are for the high part of the virtual memory space; the low part is zero filled (for stacks in core files). FVMLIB enumerator FVMLIB = 0x2u This segment is the VM that is allocated by a fixed VM library, for overlap checking in the link editor. NORELOC enumerator NORELOC = 0x4u This segment has nothing that was relocated in it and nothing relocated to it. It may be safely replaced without relocation. PROTECTED_VERSION_1 enumerator PROTECTED_VERSION_1 = 0x8u READ_ONLY enumerator READ_ONLY = 0x10u VM_PROTECTIONS enum class VM_PROTECTIONS Values for segment_command.initprot. From . Values: READ enumerator READ = 0x1 Reading data within the segment is allowed. WRITE enumerator WRITE = 0x2 Writing data within the segment is allowed. EXECUTE enumerator EXECUTE = 0x4 Executing data within the segment is allowed. content_t using content_t = std::vector sections_t using sections_t = std::vector> Internal container for storing Mach-O Section . it_sections using it_sections = ref_iterator < sections_t &, Section *> Iterator which outputs Section &. it_const_sections using it_const_sections = const_ref_iterator Iterator which outputs const Section &. relocations_t using relocations_t = std::vector> Internal container for storing Mach-O Relocation . it_relocations using it_relocations = ref_iterator < relocations_t &, Relocation *> Iterator which outputs Relocation &. it_const_relocations using it_const_relocations = const_ref_iterator Iterator which outputs const Relocation &. Public Functions SegmentCommand SegmentCommand() SegmentCommand SegmentCommand(const details::segment_command_32 &cmd) SegmentCommand SegmentCommand(const details::segment_command_64 &cmd) operator= SegmentCommand &operator=( SegmentCommand other) SegmentCommand SegmentCommand(const SegmentCommand ©) SegmentCommand SegmentCommand(std::string name, content_t content) SegmentCommand SegmentCommand(std::string name) swap void swap( SegmentCommand &other) noexcept clone inline virtual std::unique_ptr< LoadCommand > clone() const override ~SegmentCommand ~SegmentCommand() override name inline std::string_view name() const Name of the segment (e.g. __TEXT ). virtual_address inline uint64_t virtual_address() const Absolute virtual base address of the segment. virtual_size inline uint64_t virtual_size() const Virtual size of the segment. file_size inline uint64_t file_size() const Size of this segment in the binary file. file_offset inline uint64_t file_offset() const Offset of the data of this segment in the file. max_protection inline uint32_t max_protection() const The maximum of protections for this segment (cf. VM_PROTECTIONS ). init_protection inline uint32_t init_protection() const The initial protections of this segment (cf. VM_PROTECTIONS ). numberof_sections inline uint32_t numberof_sections() const The number of sections associated with this segment. flags inline uint32_t flags() const Flags associated with this segment (cf. SegmentCommand::FLAGS ). sections inline it_sections sections() Return an iterator over the MachO::Section linked to this segment. sections inline it_const_sections sections() const relocations inline it_relocations relocations() Return an iterator over the MachO::Relocation linked to this segment. For Mach-O executable or library this iterator should be empty as the relocations are managed by the Dyld::rebase_opcodes. On the other hand, for object files ( .o ) this iterator should not be empty relocations inline it_const_relocations relocations() const get_section const Section *get_section(const std::string &name) const Get the section with the given name. get_section Section *get_section(const std::string &name) content inline span content() const The raw content of this segment. content inline span content() stream std::unique_ptr< SpanStream > stream() const Return a stream over the content of this segment. index inline int8_t index() const The original index of this segment or -1 if not defined. name inline void name(std::string name) virtual_address inline void virtual_address(uint64_t virtual_address) virtual_size inline void virtual_size(uint64_t virtual_size) file_offset inline void file_offset(uint64_t file_offset) file_size inline void file_size(uint64_t file_size) max_protection inline void max_protection(uint32_t max_protection) init_protection inline void init_protection(uint32_t init_protection) numberof_sections inline void numberof_sections(uint32_t nb_section) flags inline void flags(uint32_t flags) content void content( content_t data) add_section Section &add_section(const Section §ion) Add a new section in this segment. remove_all_sections void remove_all_sections() Remove all the sections linked to this segment. has bool has(const Section §ion) const Check if the current segment embeds the given section. has_section bool has_section(const std::string §ion_name) const Check if the current segment embeds the given section name. is inline bool is( VM_PROTECTIONS prot) const print virtual std::ostream &print(std::ostream &os) const override accept virtual void accept(Visitor &visitor) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Symbol Symbol class Symbol : public LIEF:: Symbol Class that represents a Symbol in a Mach-O file. A Mach-O symbol can come from: The symbols command (LC_SYMTAB / SymbolCommand ) The Dyld Export trie The Dyld Symbol bindings Public Types CATEGORY enum class CATEGORY : uint32_t Category of the symbol when the symbol comes from the LC_SYMTAB command. The category is defined according to the LC_DYSYMTAB ( DynamicSymbolCommand ) command. Values: NONE enumerator NONE = 0 LOCAL enumerator LOCAL EXTERNAL enumerator EXTERNAL UNDEFINED enumerator UNDEFINED INDIRECT_ABS enumerator INDIRECT_ABS INDIRECT_LOCAL enumerator INDIRECT_LOCAL INDIRECT_ABS_LOCAL enumerator INDIRECT_ABS_LOCAL ORIGIN enum class ORIGIN : uint32_t Values: UNKNOWN enumerator UNKNOWN = 0 DYLD_EXPORT enumerator DYLD_EXPORT = 1 DYLD_BIND enumerator DYLD_BIND = 2 The symbol comes from the binding opcodes. SYMTAB enumerator SYMTAB = 3 The symbol comes from the LC_SYMTAB command. TYPE enum class TYPE : uint32_t Values: UNDEFINED enumerator UNDEFINED = 0x0u The symbol is undefined. It is referenced in a different module. ABSOLUTE_SYM enumerator ABSOLUTE_SYM = 0x2u The symbol is absolute. The linker doesn’t update its value. SECTION enumerator SECTION = 0xeu The symbol is defined in the section number given in nlist_base.n_sect. PREBOUND enumerator PREBOUND = 0xcu The symbol is undefined and the image is using a prebound value for the symbol. Set the n_sect field to NO_SECT. INDIRECT enumerator INDIRECT = 0xau The symbol is defined to be the same as another symbol. The n_value field is an index into the string table specifying the name of the other symbol. When that symbol is linked, both this and the other symbol point to the same defined type and value. Public Functions Symbol Symbol() = default Symbol Symbol(const details::nlist_32 &cmd) Symbol Symbol(const details::nlist_64 &cmd) Symbol inline Symbol(uint8_t n_type, uint8_t n_sect, uint8_t n_desc, uint64_t value) operator= Symbol &operator=( Symbol other) Symbol Symbol(const Symbol &other) swap void swap( Symbol &other) noexcept ~Symbol ~Symbol() override = default library_ordinal inline int library_ordinal() const raw_type inline uint8_t raw_type() const Raw value of nlist_xx.n_type . type inline TYPE type() const Type as defined by nlist_xx.n_type & N_TYPE . numberof_sections inline uint8_t numberof_sections() const It returns the number of sections in which this symbol can be found. If the symbol can’t be found in any section, it returns 0 (NO_SECT). description inline uint16_t description() const Return information about the symbol (SYMBOL_DESCRIPTIONS). has_export_info inline bool has_export_info() const True if the symbol is associated with an ExportInfo This value is set when the symbol comes from the Dyld Export trie. export_info inline const ExportInfo *export_info() const Return the ExportInfo associated with this symbol (or nullptr if not present). See also has_export_info export_info inline ExportInfo *export_info() has_binding_info inline bool has_binding_info() const True if the symbol is associated with a BindingInfo This value is set when the symbol comes from the Dyld symbol bindings. binding_info inline const BindingInfo *binding_info() const Return the BindingInfo associated with this symbol (or nullptr if not present). See also has_binding_info binding_info inline BindingInfo *binding_info() demangled_name std::string demangled_name() const Try to demangle the symbol or return an empty string if it is not possible. is_external inline bool is_external() const True if the symbol is defined as an external symbol. library inline const DylibCommand *library() const Return the library in which the symbol is defined. It returns a null pointer if the library can’t be resolved. library inline DylibCommand *library() origin inline ORIGIN origin() const Return the origin of the symbol: from LC_SYMTAB command or from the Dyld information. category inline CATEGORY category() const Category of the symbol according to the LC_DYSYMTAB command. raw_type inline void raw_type(uint8_t type) numberof_sections inline void numberof_sections(uint8_t nbsections) description inline void description(uint16_t desc) accept virtual void accept(Visitor &visitor) const override Public Static Functions is_valid_index_ordinal static inline bool is_valid_index_ordinal(int idx) indirect_abs static const Symbol &indirect_abs() indirect_local static const Symbol &indirect_local() indirect_abs_local static const Symbol &indirect_abs_local() Public Static Attributes SELF_LIBRARY_ORD static int SELF_LIBRARY_ORD = 0x0 MAIN_EXECUTABLE_ORD static int MAIN_EXECUTABLE_ORD = 0xff DYNAMIC_LOOKUP_ORD static int DYNAMIC_LOOKUP_ORD = 0xfe TYPE_MASK static uint32_t TYPE_MASK = 0x0e Same as N_TYPE. Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Symbol &symbol) SymbolCommand SymbolCommand class SymbolCommand : public LIEF::MachO:: LoadCommand Class that represents the LC_SYMTAB command. Public Functions SymbolCommand SymbolCommand() = default SymbolCommand SymbolCommand(const details::symtab_command &command) operator= SymbolCommand &operator=(const SymbolCommand ©) = default SymbolCommand SymbolCommand(const SymbolCommand ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override ~SymbolCommand ~SymbolCommand() override = default symbol_offset inline uint32_t symbol_offset() const Offset from the start of the file to the n_list associated with the command. numberof_symbols inline uint32_t numberof_symbols() const Number of symbols registered. strings_offset inline uint32_t strings_offset() const Offset from the start of the file to the string table. strings_size inline uint32_t strings_size() const Size of the string table. symbol_offset inline void symbol_offset(uint32_t offset) numberof_symbols inline void numberof_symbols(uint32_t nb) strings_offset inline void strings_offset(uint32_t offset) strings_size inline void strings_size(uint32_t size) symbol_table inline span symbol_table() const symbol_table inline span symbol_table() string_table inline span string_table() const string_table inline span string_table() original_str_size inline uint32_t original_str_size() const original_nb_symbols inline uint32_t original_nb_symbols() const print virtual std::ostream &print(std::ostream &os) const override accept virtual void accept(Visitor &visitor) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) UUIDCommand UUIDCommand class UUIDCommand : public LIEF::MachO:: LoadCommand Class that represents the UUID command. Public Functions UUIDCommand UUIDCommand() = default UUIDCommand UUIDCommand(const details::uuid_command &cmd) operator= UUIDCommand &operator=(const UUIDCommand ©) = default UUIDCommand UUIDCommand(const UUIDCommand ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override ~UUIDCommand ~UUIDCommand() override = default uuid inline const uuid_t &uuid() const The UUID as a 16-bytes array. uuid inline void uuid(const uuid_t &uuid) accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Dyld Info DyldInfo class DyldInfo : public LIEF::MachO:: LoadCommand Class that represents the LC_DYLD_INFO and LC_DYLD_INFO_ONLY commands. Public Types BINDING_ENCODING_VERSION enum class BINDING_ENCODING_VERSION Values: UNKNOWN enumerator UNKNOWN = 0 V1 enumerator V1 V2 enumerator V2 REBASE_TYPE enum class REBASE_TYPE : uint64_t Values: POINTER enumerator POINTER = 1u TEXT_ABSOLUTE32 enumerator TEXT_ABSOLUTE32 = 2u TEXT_PCREL32 enumerator TEXT_PCREL32 = 3u THREADED enumerator THREADED = 102u REBASE_OPCODES enum class REBASE_OPCODES : uint8_t Values: DONE enumerator DONE = 0x00u It’s finished. SET_TYPE_IMM enumerator SET_TYPE_IMM = 0x10u Set type to immediate (lower 4-bits). Used for ordinal numbers from 0-15. SET_SEGMENT_AND_OFFSET_ULEB enumerator SET_SEGMENT_AND_OFFSET_ULEB = 0x20u Set segment’s index to immediate (lower 4-bits) and segment’s offset to following ULEB128 encoding. ADD_ADDR_ULEB enumerator ADD_ADDR_ULEB = 0x30u Add segment’s offset with the following ULEB128 encoding. ADD_ADDR_IMM_SCALED enumerator ADD_ADDR_IMM_SCALED = 0x40u Add segment’s offset with immediate scaling. DO_REBASE_IMM_TIMES enumerator DO_REBASE_IMM_TIMES = 0x50u Rebase in the range of [segment's offset; segment's offset + immediate * sizeof(ptr)] . DO_REBASE_ULEB_TIMES enumerator DO_REBASE_ULEB_TIMES = 0x60u Same as REBASE_OPCODE_DO_REBASE_IMM_TIMES but immediate is replaced with ULEB128 value. DO_REBASE_ADD_ADDR_ULEB enumerator DO_REBASE_ADD_ADDR_ULEB = 0x70u Rebase and increment segment’s offset with following ULEB128 encoding + pointer’s size. DO_REBASE_ULEB_TIMES_SKIPPING_ULEB enumerator DO_REBASE_ULEB_TIMES_SKIPPING_ULEB = 0x80u Rebase and skip several bytes. BIND_OPCODES enum class BIND_OPCODES : uint8_t Opcodes used by Dyld info to bind symbols. Values: DONE enumerator DONE = 0x00u It’s finished. SET_DYLIB_ORDINAL_IMM enumerator SET_DYLIB_ORDINAL_IMM = 0x10u Set ordinal to immediate (lower 4-bits). Used for ordinal numbers from 0-15. SET_DYLIB_ORDINAL_ULEB enumerator SET_DYLIB_ORDINAL_ULEB = 0x20u Set ordinal to following ULEB128 encoding. Used for ordinal numbers from 16+. SET_DYLIB_SPECIAL_IMM enumerator SET_DYLIB_SPECIAL_IMM = 0x30u Set ordinal, with 0 or negative number as immediate. The value is sign extended. SET_SYMBOL_TRAILING_FLAGS_IMM enumerator SET_SYMBOL_TRAILING_FLAGS_IMM = 0x40u Set the following symbol (NULL-terminated char*). SET_TYPE_IMM enumerator SET_TYPE_IMM = 0x50u Set the type to immediate (lower 4-bits). See BIND_TYPES. SET_ADDEND_SLEB enumerator SET_ADDEND_SLEB = 0x60u Set the addend field to the following SLEB128 encoding. SET_SEGMENT_AND_OFFSET_ULEB enumerator SET_SEGMENT_AND_OFFSET_ULEB = 0x70u Set Segment to immediate value, and address to the following SLEB128 encoding. ADD_ADDR_ULEB enumerator ADD_ADDR_ULEB = 0x80u Set the address field to the following SLEB128 encoding. DO_BIND enumerator DO_BIND = 0x90u Perform binding of current table row. DO_BIND_ADD_ADDR_ULEB enumerator DO_BIND_ADD_ADDR_ULEB = 0xA0u Perform binding, also add following ULEB128 as address. DO_BIND_ADD_ADDR_IMM_SCALED enumerator DO_BIND_ADD_ADDR_IMM_SCALED = 0xB0u Perform binding, also add immediate (lower 4-bits) using scaling. DO_BIND_ULEB_TIMES_SKIPPING_ULEB enumerator DO_BIND_ULEB_TIMES_SKIPPING_ULEB = 0xC0u Perform binding for several symbols (as following ULEB128), and skip several bytes. THREADED enumerator THREADED = 0xD0u THREADED_APPLY enumerator THREADED_APPLY = 0xD0u | 0x01u THREADED_SET_BIND_ORDINAL_TABLE_SIZE_ULEB enumerator THREADED_SET_BIND_ORDINAL_TABLE_SIZE_ULEB = 0xD0u | 0x00u BIND_SUBOPCODE_THREADED enum class BIND_SUBOPCODE_THREADED : uint8_t Values: SET_BIND_ORDINAL_TABLE_SIZE_ULEB enumerator SET_BIND_ORDINAL_TABLE_SIZE_ULEB = 0x00u APPLY enumerator APPLY = 0x01u BIND_SYMBOL_FLAGS enum BIND_SYMBOL_FLAGS Values: WEAK_IMPORT enumerator WEAK_IMPORT = 0x1u NON_WEAK_DEFINITION enumerator NON_WEAK_DEFINITION = 0x8u info_t using info_t = std::pair Tuple of offset and size . binding_info_t using binding_info_t = std::vector> Internal container for storing DyldBindingInfo . it_binding_info using it_binding_info = ref_iterator < binding_info_t &, DyldBindingInfo *> Iterator which outputs DyldBindingInfo &. it_const_binding_info using it_const_binding_info = const_ref_iterator Iterator which outputs const DyldBindingInfo &. export_info_t using export_info_t = std::vector> Internal container for storing ExportInfo . it_export_info using it_export_info = ref_iterator < export_info_t &, ExportInfo *> Iterator which outputs const ExportInfo &. it_const_export_info using it_const_export_info = const_ref_iterator Iterator which outputs const ExportInfo &. Public Functions DyldInfo DyldInfo() DyldInfo DyldInfo(const details::dyld_info_command &dyld_info_cmd) operator= DyldInfo &operator=( DyldInfo other) DyldInfo DyldInfo(const DyldInfo ©) swap void swap( DyldInfo &other) noexcept clone inline virtual std::unique_ptr< LoadCommand > clone() const override ~DyldInfo ~DyldInfo() override rebase inline const info_t &rebase() const Rebase information Dyld rebases an image whenever dyld loads it at an address different from its preferred address. The rebase information is a stream of byte sized opcodes for which symbolic names start with REBASE_OPCODE_. Conceptually the rebase information is a table of tuples: The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like “every nth offset for m times” can be encoded in a few bytes. See also /usr/include/mach-o/loader.h rebase_opcodes inline span rebase_opcodes() const Return Rebase’s opcodes as raw data. rebase_opcodes inline span rebase_opcodes() rebase_opcodes void rebase_opcodes(buffer_t raw) Set new opcodes. show_rebases_opcodes std::string show_rebases_opcodes() const Return the rebase opcodes in a human-readable way. bind inline const info_t &bind() const Bind information Dyld binds an image during the loading process, if the image requires any pointers to be initialized to symbols in other images. The rebase information is a stream of byte sized opcodes for which symbolic names start with BIND_OPCODE_. Conceptually the bind information is a table of tuples: The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like for runs of pointers initialized to the same value can be encoded in a few bytes. See also /usr/include/mach-o/loader.h bind_opcodes inline span bind_opcodes() const Return Binding’s opcodes as raw data. bind_opcodes inline span bind_opcodes() bind_opcodes void bind_opcodes(buffer_t raw) Set new opcodes. show_bind_opcodes std::string show_bind_opcodes() const Return the bind opcodes in a human-readable way. weak_bind inline const info_t &weak_bind() const Weak Bind information Some C++ programs require dyld to unique symbols so that all images in the process use the same copy of some code/data. This step is done after binding. The content of the weak_bind info is an opcode stream like the bind_info. But it is sorted alphabetically by symbol name. This enables dyld to walk all images with weak binding information in order and look for collisions. If there are no collisions, dyld does no updating. That means that some fixups are also encoded in the bind_info. For instance, all calls to “operator new” are first bound to libstdc++.dylib using the information in bind_info. Then if some image overrides operator new that is detected when the weak_bind information is processed and the call to operator new is then rebound. See also /usr/include/mach-o/loader.h weak_bind_opcodes inline span weak_bind_opcodes() const Return Weak Binding’s opcodes as raw data. weak_bind_opcodes inline span weak_bind_opcodes() weak_bind_opcodes void weak_bind_opcodes(buffer_t raw) Set new opcodes. show_weak_bind_opcodes std::string show_weak_bind_opcodes() const Return the bind opcodes in a human-readable way. lazy_bind inline const info_t &lazy_bind() const Lazy Bind information Some uses of external symbols do not need to be bound immediately. Instead, they can be lazily bound on first use. The lazy_bind area contains a stream of BIND opcodes to bind all lazy symbols. Normal use is that dyld ignores the lazy_bind section when loading an image. Instead, the static linker arranged for the lazy pointer to initially point to a helper function which pushes the offset into the lazy_bind area for the symbol needing to be bound, then jumps to dyld which simply adds the offset to lazy_bind_off to get the information on what to bind. See also /usr/include/mach-o/loader.h lazy_bind_opcodes inline span lazy_bind_opcodes() const Return Lazy Binding’s opcodes as raw data. lazy_bind_opcodes inline span lazy_bind_opcodes() lazy_bind_opcodes void lazy_bind_opcodes(buffer_t raw) Set new opcodes. show_lazy_bind_opcodes std::string show_lazy_bind_opcodes() const Return the lazy opcodes in a human-readable way. bindings inline it_binding_info bindings() Iterator over BindingInfo entries. bindings inline it_const_binding_info bindings() const export_info inline const info_t &export_info() const Export information The symbols exported by a dylib are encoded in a trie. This is a compact representation that factors out common prefixes. It also reduces LINKEDIT pages in RAM because it encodes all information (name, address, flags) in one small, contiguous range. The export area is a stream of nodes. The first node sequentially is the start node for the trie. Nodes for a symbol start with a byte that is the length of the exported symbol information for the string so far. If there is no exported symbol, the byte is zero. If there is exported info, it follows the length byte. The exported info normally consists of a flags and offset both encoded in uleb128. The offset is location of the content named by the symbol. It is the offset from the mach_header for the image. After the initial byte and optional exported symbol information is a byte of how many edges (0-255) that this node has leaving it, followed by each edge. Each edge is a zero terminated cstring of the addition chars in the symbol, followed by a uleb128 offset for the node that edge points to. See also /usr/include/mach-o/loader.h exports inline it_export_info exports() Iterator over ExportInfo entries. exports inline it_const_export_info exports() const export_trie inline span export_trie() const Return Export’s trie as raw data. export_trie inline span export_trie() export_trie void export_trie(buffer_t raw) Set new trie. show_export_trie std::string show_export_trie() const Return the export trie in a human-readable way. rebase inline void rebase(const info_t &info) bind inline void bind(const info_t &info) weak_bind inline void weak_bind(const info_t &info) lazy_bind inline void lazy_bind(const info_t &info) export_info inline void export_info(const info_t &info) set_rebase_offset inline void set_rebase_offset(uint32_t offset) set_rebase_size inline void set_rebase_size(uint32_t size) set_bind_offset inline void set_bind_offset(uint32_t offset) set_bind_size inline void set_bind_size(uint32_t size) set_weak_bind_offset inline void set_weak_bind_offset(uint32_t offset) set_weak_bind_size inline void set_weak_bind_size(uint32_t size) set_lazy_bind_offset inline void set_lazy_bind_offset(uint32_t offset) set_lazy_bind_size inline void set_lazy_bind_size(uint32_t size) set_export_offset inline void set_export_offset(uint32_t offset) set_export_size inline void set_export_size(uint32_t size) add ExportInfo *add(std::unique_ptr< ExportInfo > info) accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Public Static Attributes OPCODE_MASK static auto OPCODE_MASK = uint32_t(0xF0) IMMEDIATE_MASK static auto IMMEDIATE_MASK = uint32_t(0x0F) Function starts FunctionStarts class FunctionStarts : public LIEF::MachO:: LoadCommand Class which represents the LC_FUNCTION_STARTS command. This command is an array of ULEB128 encoded values Public Functions FunctionStarts FunctionStarts() = default FunctionStarts FunctionStarts(const details::linkedit_data_command &cmd) operator= FunctionStarts &operator=(const FunctionStarts ©) = default FunctionStarts FunctionStarts(const FunctionStarts ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override data_offset inline uint32_t data_offset() const Offset in the __LINKEDIT SegmentCommand where start functions are located. data_size inline uint32_t data_size() const Size of the functions list in the binary. functions inline const std::vector &functions() const Addresses of every function entry point in the executable. This allows functions to exist for which there are no entries in the symbol table. Warning The address is relative to the __TEXT segment functions inline std::vector &functions() add_function inline void add_function(uint64_t address) Add a new function. data_offset inline void data_offset(uint32_t offset) data_size inline void data_size(uint32_t size) functions inline void functions(std::vector funcs) content inline span content() const content inline span content() ~FunctionStarts ~FunctionStarts() override = default accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Function Variants FunctionVariants class FunctionVariants : public LIEF::MachO:: LoadCommand Class representing the LC_FUNCTION_VARIANTS load command. Introduced publicly in dyld-1284.13 (April 2025), this command supports function multiversioning , the ability to associate multiple implementations of the same function, each optimized for a specific platform, architecture, or runtime context. At runtime, the system dispatches the most appropriate variant based on hardware capabilities or execution environment. For example: FUNCTION_VARIANT_TABLE(my_function, { (void*)my_function$Rosetta, \"rosetta\" }, // Rosetta translation { (void*)my_function$Haswell, \"haswell\" }, // Haswell-optimized { (void*)my_function$Base, \"default\" } // Default fallback ); Public Types runtime_table_t using runtime_table_t = std::vector< RuntimeTable > it_runtime_table using it_runtime_table = ref_iterator < runtime_table_t &> Iterator that outputs RuntimeTable &. it_const_runtime_table using it_const_runtime_table = const_ref_iterator Iterator that outputs const RuntimeTable &. Public Functions FunctionVariants FunctionVariants() = default FunctionVariants FunctionVariants(const details::linkedit_data_command &cmd) operator= FunctionVariants &operator=(const FunctionVariants ©) = default FunctionVariants FunctionVariants(const FunctionVariants ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override data_offset inline uint32_t data_offset() const Offset in the __LINKEDIT SegmentCommand where the payload starts. data_size inline uint32_t data_size() const Size of the payload. data_offset inline void data_offset(uint32_t offset) data_size inline void data_size(uint32_t size) content inline span content() const Return the data slice in the __LINKEDIT segment referenced by data_offset and data_size;. content inline span content() runtime_table inline it_runtime_table runtime_table() Iterator over the different RuntimeTable entries located in the content of this __LINKEDIT command. runtime_table inline it_const_runtime_table runtime_table() const add inline RuntimeTable &add( RuntimeTable table) Append a new RuntimeTable and return a reference to the inserted table. ~FunctionVariants ~FunctionVariants() override = default print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) parse_payload static std::vector< RuntimeTable > parse_payload( SpanStream &stream) parse_entry static result < RuntimeTable > parse_entry( BinaryStream &stream, uint64_t max_entries) RuntimeTableEntry class RuntimeTableEntry This class exposes information about a given implementation. Public Types FLAGS enum class FLAGS : uint32_t Flags describing the target platform, environment, or architecture for a given function implementation. These are encoded as a uint32_t , where high bits determine the namespace ( KIND ), and the lower bits encode the specific capability. Values: UNKNOWN enumerator UNKNOWN = 0 ARM64_DEFAULT enumerator ARM64_DEFAULT = (0 | F_ARM64 ) ARM64_FLAGM enumerator ARM64_FLAGM = (1 | F_ARM64 ) ARM64_FLAGM2 enumerator ARM64_FLAGM2 = (2 | F_ARM64 ) ARM64_FHM enumerator ARM64_FHM = (3 | F_ARM64 ) ARM64_DOTPROD enumerator ARM64_DOTPROD = (4 | F_ARM64 ) ARM64_SHA3 enumerator ARM64_SHA3 = (5 | F_ARM64 ) ARM64_RDM enumerator ARM64_RDM = (6 | F_ARM64 ) ARM64_LSE enumerator ARM64_LSE = (7 | F_ARM64 ) ARM64_SHA256 enumerator ARM64_SHA256 = (8 | F_ARM64 ) ARM64_SHA512 enumerator ARM64_SHA512 = (9 | F_ARM64 ) ARM64_SHA1 enumerator ARM64_SHA1 = (10 | F_ARM64 ) ARM64_AES enumerator ARM64_AES = (11 | F_ARM64 ) ARM64_PMULL enumerator ARM64_PMULL = (12 | F_ARM64 ) ARM64_SPECRES enumerator ARM64_SPECRES = (13 | F_ARM64 ) ARM64_SB enumerator ARM64_SB = (14 | F_ARM64 ) ARM64_FRINTTS enumerator ARM64_FRINTTS = (15 | F_ARM64 ) ARM64_LRCPC enumerator ARM64_LRCPC = (16 | F_ARM64 ) ARM64_LRCPC2 enumerator ARM64_LRCPC2 = (17 | F_ARM64 ) ARM64_FCMA enumerator ARM64_FCMA = (18 | F_ARM64 ) ARM64_JSCVT enumerator ARM64_JSCVT = (19 | F_ARM64 ) ARM64_PAUTH enumerator ARM64_PAUTH = (20 | F_ARM64 ) ARM64_PAUTH2 enumerator ARM64_PAUTH2 = (21 | F_ARM64 ) ARM64_FPAC enumerator ARM64_FPAC = (22 | F_ARM64 ) ARM64_DPB enumerator ARM64_DPB = (23 | F_ARM64 ) ARM64_DPB2 enumerator ARM64_DPB2 = (24 | F_ARM64 ) ARM64_BF16 enumerator ARM64_BF16 = (25 | F_ARM64 ) ARM64_I8MM enumerator ARM64_I8MM = (26 | F_ARM64 ) ARM64_WFXT enumerator ARM64_WFXT = (27 | F_ARM64 ) ARM64_RPRES enumerator ARM64_RPRES = (28 | F_ARM64 ) ARM64_ECV enumerator ARM64_ECV = (29 | F_ARM64 ) ARM64_AFP enumerator ARM64_AFP = (30 | F_ARM64 ) ARM64_LSE2 enumerator ARM64_LSE2 = (31 | F_ARM64 ) ARM64_CSV2 enumerator ARM64_CSV2 = (32 | F_ARM64 ) ARM64_CVS3 enumerator ARM64_CVS3 = (33 | F_ARM64 ) ARM64_DIT enumerator ARM64_DIT = (34 | F_ARM64 ) ARM64_FP16 enumerator ARM64_FP16 = (35 | F_ARM64 ) ARM64_SSBS enumerator ARM64_SSBS = (36 | F_ARM64 ) ARM64_BTI enumerator ARM64_BTI = (37 | F_ARM64 ) ARM64_SME enumerator ARM64_SME = (44 | F_ARM64 ) ARM64_SME2 enumerator ARM64_SME2 = (45 | F_ARM64 ) ARM64_SMEF64F64 enumerator ARM64_SMEF64F64 = (46 | F_ARM64 ) ARM64_SMEI16I64 enumerator ARM64_SMEI16I64 = (47 | F_ARM64 ) ARM64_SMEF32F32 enumerator ARM64_SMEF32F32 = (48 | F_ARM64 ) ARM64_SMEBI32I32 enumerator ARM64_SMEBI32I32 = (49 | F_ARM64 ) ARM64_SMEB16F32 enumerator ARM64_SMEB16F32 = (50 | F_ARM64 ) ARM64_SMEF16F32 enumerator ARM64_SMEF16F32 = (51 | F_ARM64 ) ARM64_SMEI8I32 enumerator ARM64_SMEI8I32 = (52 | F_ARM64 ) ARM64_SMEI16I32 enumerator ARM64_SMEI16I32 = (53 | F_ARM64 ) ARM64_ADVSIMD enumerator ARM64_ADVSIMD = (54 | F_ARM64 ) ARM64_ADVSIMDHPFP enumerator ARM64_ADVSIMDHPFP = (55 | F_ARM64 ) ARM64_CRC32 enumerator ARM64_CRC32 = (56 | F_ARM64 ) X86_64_DEFAULT enumerator X86_64_DEFAULT = (0 | F_X86_64 ) X86_64_SSE41 enumerator X86_64_SSE41 = (1 | F_X86_64 ) X86_64_FMA enumerator X86_64_FMA = (2 | F_X86_64 ) X86_64_AVX enumerator X86_64_AVX = (3 | F_X86_64 ) X86_64_AVX2 enumerator X86_64_AVX2 = (4 | F_X86_64 ) X86_64_AVX512F enumerator X86_64_AVX512F = (5 | F_X86_64 ) X86_64_AVX512BW enumerator X86_64_AVX512BW = (6 | F_X86_64 ) X86_64_BMI1 enumerator X86_64_BMI1 = (7 | F_X86_64 ) X86_64_ROSETTA enumerator X86_64_ROSETTA = (8 | F_X86_64 ) X86_64_HASWELL enumerator X86_64_HASWELL = (9 | F_X86_64 ) X86_64_IVYBRIDGE enumerator X86_64_IVYBRIDGE = (10 | F_X86_64 ) X86_64_NEHALEM enumerator X86_64_NEHALEM = (11 | F_X86_64 ) SYSTEM_WIDE_DEFAULT enumerator SYSTEM_WIDE_DEFAULT = (0 | F_SYSTEM_WIDE ) SYSTEM_WIDE_INTERNAL_INSTALL enumerator SYSTEM_WIDE_INTERNAL_INSTALL = (1 | F_SYSTEM_WIDE ) SYSTEM_WIDE_CUSTOMER_INSTALL enumerator SYSTEM_WIDE_CUSTOMER_INSTALL = (2 | F_SYSTEM_WIDE ) SYSTEM_WIDE_LOCKDOWN enumerator SYSTEM_WIDE_LOCKDOWN = (3 | F_SYSTEM_WIDE ) PER_PROCESS_DEFAULT enumerator PER_PROCESS_DEFAULT = (0 | F_PER_PROCESS ) PER_PROCESS_TRANSLATED enumerator PER_PROCESS_TRANSLATED = (1 | F_PER_PROCESS ) PER_PROCESS_MTE_ENABLED enumerator PER_PROCESS_MTE_ENABLED = (2 | F_PER_PROCESS ) PER_PROCESS_NO_OVERREAD enumerator PER_PROCESS_NO_OVERREAD = (3 | F_PER_PROCESS ) Public Functions RuntimeTableEntry RuntimeTableEntry() = default RuntimeTableEntry RuntimeTableEntry(const details::runtime_table_entry_t &entry) RuntimeTableEntry RuntimeTableEntry(const RuntimeTableEntry &) = default operator= RuntimeTableEntry &operator=(const RuntimeTableEntry &) = default RuntimeTableEntry RuntimeTableEntry( RuntimeTableEntry &&) noexcept = default operator= RuntimeTableEntry &operator=( RuntimeTableEntry &&) noexcept = default ~RuntimeTableEntry ~RuntimeTableEntry() = default impl inline uint32_t impl() const The relative address of the implementation or an index if another_table() is set. impl inline void impl(uint32_t value) Set the relative address of the implementation (or the index of the target entry when another_table() is set). Note The value is stored on 31 bits, so the most significant bit is silently dropped. another_table inline bool another_table() const Indicates whether impl() refers to an entry in another runtime table, rather than a direct function implementation address. another_table inline void another_table(bool value) Set whether impl() refers to an entry in another runtime table. flag_bit_nums inline span flag_bit_nums() const The flagBitNums value as a slice of bytes. flags inline const std::vector< FLAGS > &flags() const Return the interpreted flag_bit_nums() . to_string std::string to_string() const Public Static Functions get_raw static inline uint8_t get_raw( FLAGS f) Public Static Attributes MAX_IMPL static uint32_t MAX_IMPL = (uint32_t(1) << 31) - 1 The implementation address/index is encoded on 31 bits. F_BIT static uint32_t F_BIT = 20 F_MASK static uint32_t F_MASK = (uint32_t(1) << F_BIT ) - 1 F_PER_PROCESS static uint32_t F_PER_PROCESS = uint32_t(1) << F_BIT F_SYSTEM_WIDE static uint32_t F_SYSTEM_WIDE = uint32_t(2) << F_BIT F_ARM64 static uint32_t F_ARM64 = uint32_t(3) << F_BIT F_X86_64 static uint32_t F_X86_64 = uint32_t(4) << F_BIT Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const RuntimeTableEntry &entry) RuntimeTable class RuntimeTable Represents a runtime table of function variants sharing a common namespace (referred to internally as FunctionVariantsRuntimeTable in dyld ). Each table holds multiple RuntimeTableEntry instances that map to function implementations optimized for a given KIND . Public Types KIND enum class KIND : uint32_t Enumeration describing the namespace or category of a function variant. Each FunctionVariants::RuntimeTable is associated with one KIND , which indicates the domain or context under which its variant entries should be considered valid or applicable. These categories map to the runtime dispatch logic used by dyld when selecting the optimal function variant. Values: UNKNOWN enumerator UNKNOWN = 0 Fallback/default kind when the category is not recognized. PER_PROCESS enumerator PER_PROCESS = 1 Variants that apply on a per-process basis. SYSTEM_WIDE enumerator SYSTEM_WIDE = 2 Variants that are selected based on system-wide capabilities or configurations. ARM64 enumerator ARM64 = 3 Variants optimized for the ARM64 architecture. X86_64 enumerator X86_64 = 4 Variants optimized for the x86-64 architecture. entries_t using entries_t = std::vector< RuntimeTableEntry > it_entries using it_entries = ref_iterator < entries_t &> Iterator that outputs RuntimeTableEntry &. it_const_entries using it_const_entries = const_ref_iterator Iterator that outputs const RuntimeTableEntry &. Public Functions RuntimeTable RuntimeTable() = default RuntimeTable inline RuntimeTable( KIND kind, uint32_t offset) RuntimeTable RuntimeTable(const RuntimeTable &) = default operator= RuntimeTable &operator=(const RuntimeTable &) = default RuntimeTable RuntimeTable( RuntimeTable &&) noexcept = default operator= RuntimeTable &operator=( RuntimeTable &&) noexcept = default ~RuntimeTable ~RuntimeTable() = default kind inline KIND kind() const Kind of this runtime table. offset inline uint32_t offset() const Original offset in the payload. entries inline it_entries entries() Iterator over the different RuntimeTableEntry entries. entries inline it_const_entries entries() const add inline void add( RuntimeTableEntry entry) to_string std::string to_string() const Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const RuntimeTable &table) Function Variant Fixups FunctionVariantFixups class FunctionVariantFixups : public LIEF::MachO:: LoadCommand Class which represents the LC_FUNCTION_VARIANT_FIXUPS command. This command contains the relocations that must be applied to the GOT-like slots associated with a FunctionVariants table. At runtime, dyld resolves each slot to the best implementation and (re-)signs it according to the pointer-authentication information. Public Types fixups_t using fixups_t = std::vector< Fixup > it_fixups using it_fixups = ref_iterator < fixups_t &> Iterator that outputs Fixup &. it_const_fixups using it_const_fixups = const_ref_iterator Iterator that outputs const Fixup &. Public Functions FunctionVariantFixups FunctionVariantFixups() = default FunctionVariantFixups FunctionVariantFixups( FunctionVariantFixups &&) noexcept = default operator= FunctionVariantFixups &operator=( FunctionVariantFixups &&) noexcept = default FunctionVariantFixups FunctionVariantFixups(const details::linkedit_data_command &cmd) operator= FunctionVariantFixups &operator=(const FunctionVariantFixups ©) = default FunctionVariantFixups FunctionVariantFixups(const FunctionVariantFixups ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override data_offset inline uint32_t data_offset() const Offset in the __LINKEDIT SegmentCommand where the payload starts. data_size inline uint32_t data_size() const Size of the payload. data_offset inline void data_offset(uint32_t offset) data_size inline void data_size(uint32_t size) content inline span content() const Return the data slice in the __LINKEDIT segment referenced by data_offset and data_size. content inline span content() fixups inline it_fixups fixups() Iterator over the different Fixup entries. fixups inline it_const_fixups fixups() const add inline FunctionVariantFixups &add( Fixup fixup) Append a new Fixup . ~FunctionVariantFixups ~FunctionVariantFixups() override = default print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) parse_payload static std::vector< Fixup > parse_payload( SpanStream &stream) Fixup class Fixup A single relocation associated with a function-variant. It mirrors the FunctionVariantFixups::InternalFixup structure used by dyld and describes a slot that must be fixed up to point to the variant referenced by variant_index() . Public Functions Fixup Fixup() = default Fixup inline Fixup(uint32_t seg_offset, uint32_t seg_index, uint32_t variant_index, bool pac_auth, bool pac_address, uint8_t pac_key, uint16_t pac_diversity) Fixup Fixup(const details::function_variant_fixup_t &raw) Fixup Fixup(const Fixup &) = default operator= Fixup &operator=(const Fixup &) = default Fixup Fixup( Fixup &&) noexcept = default operator= Fixup &operator=( Fixup &&) noexcept = default ~Fixup ~Fixup() = default seg_offset inline uint32_t seg_offset() const Offset of the slot to fix up, relative to the segment designated by seg_index() . seg_index inline uint32_t seg_index() const Index of the segment that owns the slot to fix up. variant_index inline uint32_t variant_index() const Index of the FunctionVariants runtime table used to resolve the slot. pac_auth inline bool pac_auth() const Whether the slot is signed with pointer authentication (arm64e). pac_address inline bool pac_address() const Whether the pointer-authentication signature mixes the storage address (address diversity). pac_key inline uint8_t pac_key() const Pointer-authentication key used to sign the slot. pac_diversity inline uint16_t pac_diversity() const Pointer-authentication diversity (discriminator) of the slot. segment inline SegmentCommand *segment() SegmentCommand referenced by seg_index() if it could be resolved. segment inline const SegmentCommand *segment() const seg_offset inline void seg_offset(uint32_t value) seg_index inline void seg_index(uint32_t value) variant_index inline void variant_index(uint32_t value) pac_auth inline void pac_auth(bool value) pac_address inline void pac_address(bool value) pac_key inline void pac_key(uint8_t value) pac_diversity inline void pac_diversity(uint16_t value) segment inline void segment( SegmentCommand &seg) to_string std::string to_string() const Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Fixup &fixup) Lazy Load Dylib Info LazyLoadDylibInfo class LazyLoadDylibInfo : public LIEF::MachO:: LoadCommand Class representing the LC_LAZY_LOAD_DYLIB_INFO load command. This command describes how to lazily load a dylib : instead of binding the library and its symbols at launch time, dyld keeps the information required to resolve the dylib on the first use of one of its symbols. Public Types fixups_t using fixups_t = std::vector< Fixup > it_fixups using it_fixups = ref_iterator < fixups_t &> Iterator that outputs Fixup &. it_const_fixups using it_const_fixups = const_ref_iterator Iterator that outputs const Fixup &. Public Functions LazyLoadDylibInfo LazyLoadDylibInfo() LazyLoadDylibInfo LazyLoadDylibInfo(const details::linkedit_data_command &cmd) operator= LazyLoadDylibInfo &operator=(const LazyLoadDylibInfo ©) = default LazyLoadDylibInfo LazyLoadDylibInfo(const LazyLoadDylibInfo ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override data_offset inline uint32_t data_offset() const Offset in the __LINKEDIT segment where the payload starts. data_size inline uint32_t data_size() const Size of the payload. data_offset inline void data_offset(uint32_t offset) data_size inline void data_size(uint32_t size) content inline span content() const Return the data slice in the __LINKEDIT segment referenced by data_offset and data_size. content inline span content() load_path inline std::string_view load_path() const Load path of the dylib to bind lazily. load_path inline LazyLoadDylibInfo &load_path(std::string value) Change the load path of the dylib to bind lazily. flag_image_offset inline uint32_t flag_image_offset() const Image offset of the global flag that is set once the dylib has been loaded by dyld. flag_image_offset inline LazyLoadDylibInfo &flag_image_offset(uint32_t value) flags inline uint16_t flags() const Raw flags associated with this command. flags inline LazyLoadDylibInfo &flags(uint16_t value) may_be_missing inline bool may_be_missing() const Whether the dylib is allowed to be missing at runtime (i.e. “weak linked”). may_be_missing inline LazyLoadDylibInfo &may_be_missing(bool value) Set or clear the “may be missing” (weak linked) bit of flags() . pointer_format inline uint16_t pointer_format() const Chained-fixups pointer format used by the binding chain (e.g. DYLD_CHAINED_PTR_ARM64E_USERLAND ). pointer_format inline LazyLoadDylibInfo &pointer_format(uint16_t value) chain_start_image_offset inline uint32_t chain_start_image_offset() const Image offset of the fixup chain start used to bind the dylib’s symbols. chain_start_image_offset inline LazyLoadDylibInfo &chain_start_image_offset(uint32_t value) symbols inline const std::vector &symbols() const List of the symbol names to bind lazily for this dylib. symbols inline LazyLoadDylibInfo &symbols(std::vector value) Replace the list of the symbol names to bind lazily for this dylib. add_symbol inline LazyLoadDylibInfo &add_symbol(std::string value) Append a symbol name to the list of symbols to bind lazily. clear_symbols inline LazyLoadDylibInfo &clear_symbols() Remove all the symbol names to bind lazily. fixups inline it_fixups fixups() Iterator over the lazy-binding Fixup entries. fixups inline it_const_fixups fixups() const ~LazyLoadDylibInfo ~LazyLoadDylibInfo() override = default print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Public Static Attributes MAYBE_MISSING_FLAG static auto MAYBE_MISSING_FLAG = 1 Fixup class Fixup A single lazy-binding fixup decoded from the chain referenced by chain_start_image_offset and decoded according to pointer_format. Public Functions Fixup Fixup() = default Fixup inline Fixup(uint64_t address, uint32_t ordinal, std::string symbol, bool is_auth) Fixup Fixup(const Fixup &) = default operator= Fixup &operator=(const Fixup &) = default Fixup Fixup( Fixup &&) noexcept = default operator= Fixup &operator=( Fixup &&) noexcept = default ~Fixup ~Fixup() = default address inline uint64_t address() const Virtual address of the slot bound by this fixup. address inline void address(uint64_t value) ordinal inline uint32_t ordinal() const Index of the bound symbol in the symbols table of LazyLoadDylibInfo . symbol inline std::string_view symbol() const Name of the bound symbol, resolved from ordinal() (empty if the ordinal is out of the symbols() range). is_auth inline bool is_auth() const Whether the bound pointer is authenticated ( arm64e PAC). to_string std::string to_string() const Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Fixup &fixup) Source Version SourceVersion class SourceVersion : public LIEF::MachO:: LoadCommand Class that represents the MachO LoadCommand::TYPE::SOURCE_VERSION This command is used to provide the version of the sources used to build the binary. Public Types version_t using version_t = std::array Version is an array of 5 integers. Public Functions SourceVersion SourceVersion() = default SourceVersion SourceVersion(const details::source_version_command &version_cmd) operator= SourceVersion &operator=(const SourceVersion ©) = default SourceVersion SourceVersion(const SourceVersion ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override ~SourceVersion ~SourceVersion() override = default version inline const version_t &version() const Return the version as an array. version inline void version(const version_t &version) accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Version Min VersionMin class VersionMin : public LIEF::MachO:: LoadCommand Class that wraps the LC_VERSION_MIN_MACOSX, LC_VERSION_MIN_IPHONEOS, … commands. Public Types version_t using version_t = std::array Version is an array of 3 integers. Public Functions VersionMin VersionMin() = default VersionMin VersionMin(const details::version_min_command &version_cmd) operator= VersionMin &operator=(const VersionMin ©) = default VersionMin VersionMin(const VersionMin ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override ~VersionMin ~VersionMin() override = default version inline const version_t &version() const Return the version as an array. version inline void version(const version_t &version) sdk inline const version_t &sdk() const Return the sdk version as an array. sdk inline void sdk(const version_t &sdk) accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Routine Routine class Routine : public LIEF::MachO:: LoadCommand Class that represents the LC_ROUTINE/LC_ROUTINE64 commands. According to the Mach-O loader.h documentation: The routines command contains the address of the dynamic shared library initialization routine and an index into the module table for the module that defines the routine. Before any modules are used from the library the dynamic linker fully binds the module that defines the initialization routine and then calls it. This gets called before any module initialization routines (used for C++ static constructors) in the library. Public Functions Routine Routine() = default TRoutine template Routine(const T &cmd) operator= Routine &operator=(const Routine ©) = default Routine Routine(const Routine ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override init_address inline uint64_t init_address() const address of initialization routine init_address inline void init_address(uint64_t addr) init_module inline uint64_t init_module() const Index into the module table that the init routine is defined in. init_module inline void init_module(uint64_t mod) reserved1 inline uint64_t reserved1() const reserved1 inline void reserved1(uint64_t value) reserved2 inline uint64_t reserved2() const reserved2 inline void reserved2(uint64_t value) reserved3 inline uint64_t reserved3() const reserved3 inline void reserved3(uint64_t value) reserved4 inline uint64_t reserved4() const reserved4 inline void reserved4(uint64_t value) reserved5 inline uint64_t reserved5() const reserved5 inline void reserved5(uint64_t value) reserved6 inline uint64_t reserved6() const reserved6 inline void reserved6(uint64_t value) ~Routine ~Routine() override = default accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Relocation Relocation class Relocation : public LIEF:: Relocation Class that represents a Mach-O relocation. See also MachO::RelocationObject MachO::RelocationDyld MachO::RelocationFixup Subclassed by LIEF::MachO::RelocationDyld , LIEF::MachO::RelocationFixup , LIEF::MachO::RelocationObject Public Types ORIGIN enum class ORIGIN Values: UNKNOWN enumerator UNKNOWN = 0 DYLDINFO enumerator DYLDINFO = 1 RELOC_TABLE enumerator RELOC_TABLE = 2 CHAINED_FIXUPS enumerator CHAINED_FIXUPS = 3 Public Functions Relocation Relocation() = default Relocation Relocation(uint64_t address, uint8_t type) operator= Relocation &operator=(const Relocation &other) Relocation Relocation(const Relocation &other) swap void swap( Relocation &other) noexcept ~Relocation ~Relocation() override = default clone virtual std::unique_ptr< Relocation > clone() const = 0 is_pc_relative virtual bool is_pc_relative() const = 0 Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing. For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction. type inline virtual uint8_t type() const Type of the relocation according to the Relocation::architecture and/or the Relocation::origin . See: MachO::X86_RELOCATION MachO::X86_64_RELOCATION MachO::PPC_RELOCATION MachO::ARM_RELOCATION MachO::ARM64_RELOCATION MachO::REBASE_TYPES architecture inline Header :: CPU_TYPE architecture() const Architecture targeted by this relocation. origin virtual ORIGIN origin() const = 0 Origin of the relocation. has_symbol inline bool has_symbol() const true if the relocation has a symbol associated with symbol inline Symbol *symbol() Symbol associated with the relocation, if any, otherwise a nullptr. symbol inline const Symbol *symbol() const has_section inline bool has_section() const true if the relocation has a section associated with section inline Section *section() Section associated with the relocation, if any, otherwise a nullptr. section inline const Section *section() const has_segment inline bool has_segment() const true if the relocation has a SegmentCommand associated with segment inline SegmentCommand *segment() SegmentCommand associated with the relocation, if any, otherwise a nullptr. segment inline const SegmentCommand *segment() const Tcast template inline const T *cast() const Tcast template inline T *cast() pc_relative virtual void pc_relative(bool val) = 0 type virtual void type(uint8_t type) accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const address inline virtual uint64_t address() const Relocation ’s address. address inline virtual void address(uint64_t address) size inline virtual size_t size() const Relocation size in bits . size inline virtual void size(size_t size) Public Static Attributes R_SCATTERED static auto R_SCATTERED = uint32_t(0x80000000) R_ABS static auto R_ABS = uint32_t(0) Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Relocation &relocation) Relocation Object RelocationObject class RelocationObject : public LIEF::MachO:: Relocation Class that represents a relocation present in the MachO object file ( .o ). Usually, this kind of relocation is found in the MachO::Section . See also RelocationDyld Public Functions RelocationObject RelocationObject() = default RelocationObject RelocationObject(const details::relocation_info &relocinfo) RelocationObject RelocationObject(const details::scattered_relocation_info &scattered_relocinfo) operator= RelocationObject &operator=(const RelocationObject &other) = default RelocationObject RelocationObject(const RelocationObject &other) = default swap void swap( RelocationObject &other) noexcept ~RelocationObject ~RelocationObject() override = default clone inline virtual std::unique_ptr< Relocation > clone() const override is_pc_relative inline virtual bool is_pc_relative() const override Whether the relocation is PC relative. size virtual size_t size() const override Size of the relocation. address virtual uint64_t address() const override Address where the relocation is applied This address is relative to the start of the section where the relocation takes place. is_scattered inline bool is_scattered() const true if the relocation is a scattered one value int32_t value() const For scattered relocations: The address of the relocatable expression for the item in the file that needs to be updated if the address is changed. For relocatable expressions with the difference of two section addresses, the address from which to subtract (in mathematical terms, the minuend) is contained in the first relocation entry and the address to subtract (the subtrahend) is contained in the second relocation entry. origin inline virtual ORIGIN origin() const override Origin of the relocation. For this object it should be Relocation::ORIGIN::RELOC_TABLE ). pc_relative inline virtual void pc_relative(bool val) override size virtual void size(size_t size) override value void value(int32_t value) accept virtual void accept(Visitor &visitor) const override print inline virtual std::ostream &print(std::ostream &os) const override Relocation Relocation() = default Relocation Relocation(uint64_t address, uint8_t type) Relocation Relocation(const Relocation &other) Public Static Functions classof static inline bool classof(const Relocation &r) Relocation Dyld RelocationDyld class RelocationDyld : public LIEF::MachO:: Relocation Class that represents a relocation found in the DyldInfo structure. While this class does not have an associated structure in the Mach-O format specification, it provides a convenient interface for the Dyld::rebase Public Functions RelocationDyld RelocationDyld() = default operator= RelocationDyld &operator=(const RelocationDyld &) = default RelocationDyld RelocationDyld(const RelocationDyld &) = default ~RelocationDyld ~RelocationDyld() override = default clone inline virtual std::unique_ptr< Relocation > clone() const override is_pc_relative virtual bool is_pc_relative() const override Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing. For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction. origin inline virtual ORIGIN origin() const override Origin of the relocation. For this concrete object, it should be Relocation::ORIGIN::DYLDINFO . pc_relative virtual void pc_relative(bool val) override operator< bool operator<(const RelocationDyld &rhs) const operator>= inline bool operator>=(const RelocationDyld &rhs) const operator> bool operator>(const RelocationDyld &rhs) const operator<= inline bool operator<=(const RelocationDyld &rhs) const accept virtual void accept(Visitor &visitor) const override print inline virtual std::ostream &print(std::ostream &os) const override Relocation Relocation() = default Relocation Relocation(uint64_t address, uint8_t type) Relocation Relocation(const Relocation &other) operator< inline virtual bool operator<(const Relocation &rhs) const Comparison based on the Relocation ’s address . operator<= inline virtual bool operator<=(const Relocation &rhs) const Comparison based on the Relocation ’s address . operator> inline virtual bool operator>(const Relocation &rhs) const Comparison based on the Relocation ’s address . operator>= inline virtual bool operator>=(const Relocation &rhs) const Comparison based on the Relocation ’s address . Public Static Functions classof static inline bool classof(const Relocation &r) Relocation Fixup RelocationFixup class RelocationFixup : public LIEF::MachO:: Relocation Class that represents a rebase relocation found in the LC_DYLD_CHAINED_FIXUPS command. This class extends LIEF::Relocation in which LIEF::Relocation::address is set to the absolute virtual address where the relocation must take place (e.g. 0x10000d270 ). On the other hand, RelocationFixup::target contains the value that should be set at LIEF::Relocation::address if the imagebase is LIEF::Binary::imagebase (e.g. 0x1000073a8 ). If the Mach-O loader chooses another base address (like 0x7ff100000), it must set 0x10000d270 to 0x7ff1073a8 . Public Functions RelocationFixup RelocationFixup() = delete RelocationFixup RelocationFixup( DYLD_CHAINED_PTR_FORMAT fmt, uint64_t imagebase) operator= RelocationFixup &operator=(const RelocationFixup &) RelocationFixup RelocationFixup(const RelocationFixup &) operator= RelocationFixup &operator=( RelocationFixup &&) noexcept = default RelocationFixup RelocationFixup( RelocationFixup &&) noexcept = default ~RelocationFixup ~RelocationFixup() override clone inline virtual std::unique_ptr< Relocation > clone() const override is_pc_relative inline virtual bool is_pc_relative() const override Not relevant for this kind of relocation. origin inline virtual ORIGIN origin() const override Origin of the relocation. For this concrete object, it should be Relocation::ORIGIN::CHAINED_FIXUPS . ptr_format inline DYLD_CHAINED_PTR_FORMAT ptr_format() const target uint64_t target() const The value that should be set at the address pointed by LIEF::Relocation::address if the imagebase chosen by the loader is LIEF::Binary::imagebase . Otherwise: target() - LIEF::Binary::imagebase() + new_imagebase. target void target(uint64_t target) pc_relative inline virtual void pc_relative(bool) override Not relevant for this kind of relocation. offset inline uint32_t offset() const offset inline void offset(uint32_t offset) address inline virtual uint64_t address() const override The address of this relocation is bound to its offset. address inline virtual void address(uint64_t address) override Changing the address means changing the offset. next uint32_t next() const Return the (unscaled) next offset in the chain. next void next(uint32_t value) Change next offset of the current element. accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const Relocation &r) Dyld Binding Info DyldBindingInfo class DyldBindingInfo : public LIEF::MachO::BindingInfo This class represents a symbol binding operation associated with the LC_DYLD_INFO bytecode. It does not represent a structure that exists in the Mach-O format specifications but it provides a view on an entry of the Dyld binding opcodes. See also BindingInfo Public Types CLASS enum class CLASS : uint64_t Values: WEAK enumerator WEAK = 1u LAZY enumerator LAZY = 2u STANDARD enumerator STANDARD = 3u THREADED enumerator THREADED = 100u TYPE enum class TYPE : uint64_t Values: POINTER enumerator POINTER = 1u TEXT_ABSOLUTE32 enumerator TEXT_ABSOLUTE32 = 2u TEXT_PCREL32 enumerator TEXT_PCREL32 = 3u Public Functions DyldBindingInfo DyldBindingInfo() = default DyldBindingInfo DyldBindingInfo( CLASS cls, TYPE type, uint64_t address, int64_t addend = 0, int32_t oridnal = 0, bool is_weak = false, bool is_non_weak_definition = false, uint64_t offset = 0) operator= DyldBindingInfo &operator=(const DyldBindingInfo &other) = default DyldBindingInfo DyldBindingInfo(const DyldBindingInfo &other) = default operator= DyldBindingInfo &operator=( DyldBindingInfo &&) noexcept = default DyldBindingInfo DyldBindingInfo( DyldBindingInfo &&) noexcept = default swap void swap( DyldBindingInfo &other) noexcept binding_class inline CLASS binding_class() const Class of the binding (weak, lazy, …). binding_class inline void binding_class( CLASS bind_class) binding_type inline TYPE binding_type() const Type of the binding. Most of the time it’s TYPE::POINTER . binding_type inline void binding_type( TYPE type) is_non_weak_definition inline bool is_non_weak_definition() const set_non_weak_definition inline void set_non_weak_definition(bool val) original_offset inline uint64_t original_offset() const Original relative offset of the binding opcodes. type inline virtual BindingInfo::TYPES type() const override The type of the binding. This type provides the origin of the binding (LC_DYLD_INFO or LC_DYLD_CHAINED_FIXUPS). ~DyldBindingInfo ~DyldBindingInfo() override = default accept virtual void accept(Visitor &visitor) const override Public Static Functions classof static inline bool classof(const BindingInfo *info) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const DyldBindingInfo &info) Chained Binding Info ChainedBindingInfo class ChainedBindingInfo : public LIEF::MachO::BindingInfo This class represents a symbol binding operation associated with the LC_DYLD_CHAINED_FIXUPS command. This class does not represent a structure that exists in the Mach-O format specifications but it provides a view on an entry. See also BindingInfo Public Functions ChainedBindingInfo ChainedBindingInfo() = delete ChainedBindingInfo explicit ChainedBindingInfo( DYLD_CHAINED_FORMAT fmt, bool is_weak) operator= ChainedBindingInfo &operator=(const ChainedBindingInfo &other) ChainedBindingInfo ChainedBindingInfo(const ChainedBindingInfo &other) ChainedBindingInfo ChainedBindingInfo( ChainedBindingInfo &&) noexcept operator= ChainedBindingInfo &operator=( ChainedBindingInfo &&) noexcept format inline DYLD_CHAINED_FORMAT format() const Format of the imports. ptr_format inline DYLD_CHAINED_PTR_FORMAT ptr_format() const Format of the pointer. offset inline uint32_t offset() const Original offset in the chain of this binding. offset inline void offset(uint32_t offset) address inline virtual uint64_t address() const override Address of the binding. address inline virtual void address(uint64_t address) override sign_extended_addend uint64_t sign_extended_addend() const type inline virtual TYPES type() const override The type of the binding. This type provides the origin of the binding (LC_DYLD_INFO or LC_DYLD_CHAINED_FIXUPS). ~ChainedBindingInfo ~ChainedBindingInfo() override accept virtual void accept(Visitor &visitor) const override Public Static Functions classof static inline bool classof(const BindingInfo *info) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const ChainedBindingInfo &info) Export Info ExportInfo class ExportInfo : public LIEF::Object Class that provides an interface over the Dyld export info. This class does not represent a structure that exists in the Mach-O format specification but provides a view on an entry of the Dyld export trie. Public Types KIND enum class KIND : uint64_t Values: REGULAR enumerator REGULAR = 0x00u THREAD_LOCAL_KIND enumerator THREAD_LOCAL_KIND = 0x01u ABSOLUTE_KIND enumerator ABSOLUTE_KIND = 0x02u FLAGS enum class FLAGS : uint64_t Values: WEAK_DEFINITION enumerator WEAK_DEFINITION = 0x04u REEXPORT enumerator REEXPORT = 0x08u STUB_AND_RESOLVER enumerator STUB_AND_RESOLVER = 0x10u STATIC_RESOLVER enumerator STATIC_RESOLVER = 0x20u flag_list_t using flag_list_t = std::vector< FLAGS > Public Functions ExportInfo ExportInfo() = default ExportInfo inline ExportInfo(uint64_t address, uint64_t flags, uint64_t offset = 0) operator= ExportInfo &operator=( ExportInfo copy) ExportInfo ExportInfo(const ExportInfo ©) swap void swap( ExportInfo &other) noexcept node_offset inline uint64_t node_offset() const Original offset in the export Trie. flags inline uint64_t flags() const Some information ( ExportInfo::FLAGS ) about the export. (like weak export, reexport, …). flags inline void flags(uint64_t flags) flags_list flag_list_t flags_list() const The export flags() as a list. has bool has( FLAGS flag) const Check if the current entry contains the provided ExportInfo::FLAGS . kind inline KIND kind() const The export’s kind (regular, thread local, absolute, …). other inline uint64_t other() const address inline uint64_t address() const The address of the export. address inline void address(uint64_t addr) has_symbol inline bool has_symbol() const Check if a symbol is associated with this export. symbol inline const Symbol *symbol() const MachO::Symbol associated with this export or a nullptr if no symbol. symbol inline Symbol *symbol() alias inline Symbol *alias() If the export is a ExportInfo::FLAGS::REEXPORT , this returns the (optional) MachO::Symbol . alias inline const Symbol *alias() const alias_library inline DylibCommand *alias_library() If the export is a ExportInfo::FLAGS::REEXPORT , this returns the (optional) library ( MachO::DylibCommand ). alias_library inline const DylibCommand *alias_library() const ~ExportInfo ~ExportInfo() override = default accept virtual void accept(Visitor &visitor) const override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const ExportInfo &export_info) Thread Command ThreadCommand class ThreadCommand : public LIEF::MachO:: LoadCommand Class that represents the LC_THREAD / LC_UNIXTHREAD commands and that can be used to get the binary entrypoint when the LC_MAIN ( MainCommand ) is not present. Generally speaking, this command aims at defining the original state of the main thread which includes the registers’ values Public Functions ThreadCommand ThreadCommand() = default ThreadCommand ThreadCommand(const details::thread_command &cmd, Header :: CPU_TYPE arch = Header :: CPU_TYPE :: ANY ) ThreadCommand ThreadCommand(uint32_t flavor, uint32_t count, Header :: CPU_TYPE arch = Header :: CPU_TYPE :: ANY ) operator= ThreadCommand &operator=(const ThreadCommand ©) = default ThreadCommand ThreadCommand(const ThreadCommand ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override ~ThreadCommand ~ThreadCommand() override = default flavor inline uint32_t flavor() const Integer that defines a special flavor for the thread. The meaning of this value depends on the architecture() . The list of the values can be found in the XNU kernel files: xnu/osfmk/mach/arm/thread_status.h for the ARM/AArch64 architectures xnu/osfmk/mach/i386/thread_status.h for the x86/x86-64 architectures count inline uint32_t count() const Size of the thread state data with 32-bits alignment. This value should match state() . size() architecture inline Header :: CPU_TYPE architecture() const The CPU architecture that is targeted by this ThreadCommand . state inline span state() const The actual thread state as a vector of bytes. Depending on the architecture() , these data can be cast into x86_thread_state_t, x86_thread_state64_t, … state inline span state() pc uint64_t pc() const Return the initial Program Counter regardless of the underlying architecture. This value, when non null, can be used to determine the binary’s entrypoint. Underneath, it works by looking for the PC register value in the state() data state inline void state(std::vector state) flavor inline void flavor(uint32_t flavor) count inline void count(uint32_t count) architecture inline void architecture( Header :: CPU_TYPE arch) accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) RPath Command RPathCommand class RPathCommand : public LIEF::MachO:: LoadCommand Class that represents the LC_RPATH command. This command is used to add path for searching libraries associated with the @rpath prefix. Public Functions RPathCommand RPathCommand() = default RPathCommand RPathCommand(std::string path) RPathCommand RPathCommand(const details::rpath_command &rpathCmd) operator= RPathCommand &operator=(const RPathCommand ©) = default RPathCommand RPathCommand(const RPathCommand ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override ~RPathCommand ~RPathCommand() override = default path inline std::string_view path() const The rpath value as a string. path_offset inline uint32_t path_offset() const Original string offset of the path. path inline void path(std::string path) accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override Public Static Functions create static inline std::unique_ptr< RPathCommand > create(std::string path) Create a new RPath command for the provided path . classof static inline bool classof(const LoadCommand *cmd) Code Signature CodeSignature class CodeSignature : public LIEF::MachO:: LoadCommand Public Functions CodeSignature CodeSignature() = default CodeSignature CodeSignature(const details::linkedit_data_command &cmd) operator= CodeSignature &operator=(const CodeSignature ©) = default CodeSignature CodeSignature(const CodeSignature ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override data_offset inline uint32_t data_offset() const Offset in the binary where the signature starts. data_size inline uint32_t data_size() const Size of the raw signature. data_offset inline void data_offset(uint32_t offset) data_size inline void data_size(uint32_t size) content inline span content() content inline span content() const ~CodeSignature ~CodeSignature() override = default accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Data In Code DataInCode class DataInCode : public LIEF::MachO:: LoadCommand Interface of the LC_DATA_IN_CODE command This command is used to list slices of code sections that contain data. The slices information are stored as an array of DataCodeEntry . See also DataCodeEntry Public Types entries_t using entries_t = std::vector< DataCodeEntry > it_const_entries using it_const_entries = const_ref_iterator it_entries using it_entries = ref_iterator < entries_t &> Public Functions DataInCode DataInCode() = default DataInCode DataInCode(const details::linkedit_data_command &cmd) operator= DataInCode &operator=(const DataInCode &) = default DataInCode DataInCode(const DataInCode &) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override data_offset inline uint32_t data_offset() const Start of the array of the DataCodeEntry entries. data_size inline uint32_t data_size() const Size of the raw array ( size = sizeof(DataCodeEntry) * nb_elements ). data_offset inline void data_offset(uint32_t offset) data_size inline void data_size(uint32_t size) add inline DataInCode &add( DataCodeEntry entry) Add a new entry. entries inline it_const_entries entries() const Iterator over the DataCodeEntry . entries inline it_entries entries() content inline span content() content inline span content() const ~DataInCode ~DataInCode() override = default accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Data Code Entry DataCodeEntry class DataCodeEntry : public LIEF::Object Interface over an entry in the DataInCode command. Public Types TYPES enum class TYPES Values: UNKNOWN enumerator UNKNOWN = 0 DATA enumerator DATA = 1 JUMP_TABLE_8 enumerator JUMP_TABLE_8 = 2 JUMP_TABLE_16 enumerator JUMP_TABLE_16 = 3 JUMP_TABLE_32 enumerator JUMP_TABLE_32 = 4 ABS_JUMP_TABLE_32 enumerator ABS_JUMP_TABLE_32 = 5 Public Functions DataCodeEntry DataCodeEntry() = default DataCodeEntry inline DataCodeEntry(uint32_t off, uint16_t length, TYPES type) DataCodeEntry DataCodeEntry(const details::data_in_code_entry &entry) operator= DataCodeEntry &operator=(const DataCodeEntry &) = default DataCodeEntry DataCodeEntry(const DataCodeEntry &) = default offset inline uint32_t offset() const Offset of the data. length inline uint16_t length() const Length of the data. type inline TYPES type() const offset inline void offset(uint32_t off) length inline void length(uint16_t length) type inline void type( TYPES type) ~DataCodeEntry ~DataCodeEntry() override = default accept virtual void accept(Visitor &visitor) const override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const DataCodeEntry &entry) Segment Split Info SegmentSplitInfo class SegmentSplitInfo : public LIEF::MachO:: LoadCommand Class that represents the LoadCommand::TYPE::SEGMENT_SPLIT_INFO command. Public Functions SegmentSplitInfo SegmentSplitInfo() = default SegmentSplitInfo SegmentSplitInfo(const details::linkedit_data_command &cmd) operator= SegmentSplitInfo &operator=(const SegmentSplitInfo ©) = default SegmentSplitInfo SegmentSplitInfo(const SegmentSplitInfo ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override data_offset inline uint32_t data_offset() const data_size inline uint32_t data_size() const data_offset inline void data_offset(uint32_t offset) data_size inline void data_size(uint32_t size) content inline span content() content inline span content() const ~SegmentSplitInfo ~SegmentSplitInfo() override = default accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Sub-Framework SubFramework class SubFramework : public LIEF::MachO:: LoadCommand Class that represents the SubFramework command. According to the Mach-O loader.h documentation: A dynamically linked shared library may be a subframework of an umbrella framework. If so it will be linked with “-umbrella umbrella_name” where Where “umbrella_name” is the name of the umbrella framework. A subframework can only be linked against by its umbrella framework or other subframeworks that are part of the same umbrella framework. Otherwise the static link editor produces an error and states to link against the umbrella framework. The name of the umbrella framework for subframeworks is recorded in the following structure. Public Functions SubFramework SubFramework() = default SubFramework SubFramework(const details::sub_framework_command &cmd) operator= SubFramework &operator=(const SubFramework ©) = default SubFramework SubFramework(const SubFramework ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override umbrella inline std::string_view umbrella() const Name of the umbrella framework. umbrella inline void umbrella(std::string u) ~SubFramework ~SubFramework() override = default accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Sub-Client SubClient class SubClient : public LIEF::MachO:: LoadCommand Class that represents the SubClient command. According to the Mach-O loader.h documentation: For dynamically linked shared libraries that are subframework of an umbrella framework they can allow clients other than the umbrella framework or other subframeworks in the same umbrella framework. To do this the subframework is built with “-allowable_client client_name” and an LC_SUB_CLIENT load command is created for each -allowable_client flag. The client_name is usually a framework name. It can also be a name used for bundles clients where the bundle is built with “-client_name client_name”. Public Functions SubClient SubClient() = default SubClient SubClient(const details::sub_client_command &cmd) operator= SubClient &operator=(const SubClient ©) = default SubClient SubClient(const SubClient ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override client inline std::string_view client() const Name of the client. client inline void client(std::string u) ~SubClient ~SubClient() override = default accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Dyld Environment DyldEnvironment class DyldEnvironment : public LIEF::MachO:: LoadCommand Class that represents a LC_DYLD_ENVIRONMENT command which is used by the Mach-O linker/loader to initialize an environment variable. Public Functions DyldEnvironment DyldEnvironment() = default DyldEnvironment DyldEnvironment(const details::dylinker_command &cmd) operator= DyldEnvironment &operator=(const DyldEnvironment ©) = default DyldEnvironment DyldEnvironment(const DyldEnvironment ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override ~DyldEnvironment ~DyldEnvironment() override = default print virtual std::ostream &print(std::ostream &os) const override value inline std::string_view value() const The actual environment variable. value inline void value(std::string value) accept virtual void accept(Visitor &visitor) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Encryption Info EncryptionInfo class EncryptionInfo : public LIEF::MachO:: LoadCommand Class that represents the LC_ENCRYPTION_INFO / LC_ENCRYPTION_INFO_64 commands. The encryption info is usually present in Mach-O executables that target iOS to encrypt some sections of the binary Public Functions EncryptionInfo EncryptionInfo() = default EncryptionInfo EncryptionInfo(const details::encryption_info_command &cmd) operator= EncryptionInfo &operator=(const EncryptionInfo ©) = default EncryptionInfo EncryptionInfo(const EncryptionInfo ©) = default ~EncryptionInfo ~EncryptionInfo() override = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override crypt_offset inline uint32_t crypt_offset() const The beginning of the encrypted area. crypt_size inline uint32_t crypt_size() const The size of the encrypted area. crypt_id inline uint32_t crypt_id() const The encryption system. 0 means not encrypted. crypt_offset inline void crypt_offset(uint32_t offset) crypt_size inline void crypt_size(uint32_t size) crypt_id inline void crypt_id(uint32_t id) accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Build Version BuildVersion class BuildVersion : public LIEF::MachO:: LoadCommand Public Types PLATFORMS enum class PLATFORMS : uint32_t Values: UNKNOWN enumerator UNKNOWN = 0 MACOS enumerator MACOS = 1 IOS enumerator IOS = 2 TVOS enumerator TVOS = 3 WATCHOS enumerator WATCHOS = 4 BRIDGEOS enumerator BRIDGEOS = 5 MAC_CATALYST enumerator MAC_CATALYST = 6 IOS_SIMULATOR enumerator IOS_SIMULATOR = 7 TVOS_SIMULATOR enumerator TVOS_SIMULATOR = 8 WATCHOS_SIMULATOR enumerator WATCHOS_SIMULATOR = 9 DRIVERKIT enumerator DRIVERKIT = 10 VISIONOS enumerator VISIONOS = 11 VISIONOS_SIMULATOR enumerator VISIONOS_SIMULATOR = 12 FIRMWARE enumerator FIRMWARE = 13 SEPOS enumerator SEPOS = 14 MACOS_EXCLAVE_CORE enumerator MACOS_EXCLAVE_CORE = 15 MACOS_EXCLAVE_KIT enumerator MACOS_EXCLAVE_KIT = 16 IOS_EXCLAVE_CORE enumerator IOS_EXCLAVE_CORE = 17 IOS_EXCLAVE_KIT enumerator IOS_EXCLAVE_KIT = 18 TVOS_EXCLAVE_CORE enumerator TVOS_EXCLAVE_CORE = 19 TVOS_EXCLAVE_KIT enumerator TVOS_EXCLAVE_KIT = 20 WATCHOS_EXCLAVE_CORE enumerator WATCHOS_EXCLAVE_CORE = 21 WATCHOS_EXCLAVE_KIT enumerator WATCHOS_EXCLAVE_KIT = 22 VISIONOS_EXCLAVE_CORE enumerator VISIONOS_EXCLAVE_CORE = 23 VISIONOS_EXCLAVE_KIT enumerator VISIONOS_EXCLAVE_KIT = 24 ANY enumerator ANY = 0xFFFFFFFF version_t using version_t = std::array Version is an array of 3 integers. tools_list_t using tools_list_t = std::vector< BuildToolVersion > Public Functions BuildVersion BuildVersion() = default BuildVersion BuildVersion(const details::build_version_command &version_cmd) BuildVersion BuildVersion(const PLATFORMS platform, const version_t &minos, const version_t &sdk, const tools_list_t &tools) operator= BuildVersion &operator=(const BuildVersion ©) = default BuildVersion BuildVersion(const BuildVersion ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override minos inline version_t minos() const minos inline void minos( version_t version) sdk inline version_t sdk() const sdk inline void sdk( version_t version) platform inline PLATFORMS platform() const platform inline void platform( PLATFORMS plat) tools inline const tools_list_t &tools() const ~BuildVersion ~BuildVersion() override = default accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Build Tool Version BuildToolVersion class BuildToolVersion : public LIEF::Object Class that represents a tool’s version that was involved in the build of the binary. Public Types TOOLS enum class TOOLS Values: UNKNOWN enumerator UNKNOWN = 0 CLANG enumerator CLANG = 1 SWIFT enumerator SWIFT = 2 LD enumerator LD = 3 LLD enumerator LLD = 4 METAL enumerator METAL = 1024 AIRLLD enumerator AIRLLD = 1025 AIRNT enumerator AIRNT = 1026 AIRNT_PLUGIN enumerator AIRNT_PLUGIN = 1027 AIRPACK enumerator AIRPACK = 1028 GPUARCHIVER enumerator GPUARCHIVER = 1031 METAL_FRAMEWORK enumerator METAL_FRAMEWORK = 1032 version_t using version_t = std::array A version is an array of 3 integers. Public Functions BuildToolVersion BuildToolVersion() = default BuildToolVersion BuildToolVersion(const details::build_tool_version &tool) tool inline TOOLS tool() const The tools used. version inline version_t version() const Version associated with the tool. ~BuildToolVersion ~BuildToolVersion() override = default accept virtual void accept(Visitor &visitor) const override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const BuildToolVersion &tool) Fileset Command FilesetCommand class FilesetCommand : public LIEF::MachO:: LoadCommand Class associated with the LC_FILESET_ENTRY commands. Public Types content_t using content_t = std::vector Public Functions FilesetCommand FilesetCommand() = default FilesetCommand FilesetCommand(const details::fileset_entry_command &command) FilesetCommand inline FilesetCommand(std::string name) operator= FilesetCommand &operator=( FilesetCommand copy) FilesetCommand FilesetCommand(const FilesetCommand ©) swap void swap( FilesetCommand &other) noexcept clone inline virtual std::unique_ptr< LoadCommand > clone() const override ~FilesetCommand ~FilesetCommand() override = default name inline std::string_view name() const Name of the underlying MachO binary (e.g. com.apple.security.quarantine ). virtual_address inline uint64_t virtual_address() const Memory address where the MachO file should be mapped. file_offset inline uint64_t file_offset() const Original offset in the kernel cache. binary inline const Binary *binary() const Return a pointer on the LIEF::MachO::Binary associated with this entry. binary inline Binary *binary() name inline void name(std::string name) virtual_address inline void virtual_address(uint64_t virtual_address) file_offset inline void file_offset(uint64_t file_offset) print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Friends friend class BinaryParser DyldChainedFixups Command DyldChainedFixups class DyldChainedFixups : public LIEF::MachO:: LoadCommand Class that represents the LC_DYLD_CHAINED_FIXUPS command. This command aims at providing rebase and binding information like the DyldInfo ’s bytecode. Compared to the DyldInfo bytecode, these chained fixups are taking less space. Public Types chained_starts_in_segments_t using chained_starts_in_segments_t = std::vector< chained_starts_in_segment > Internal container for storing chained_starts_in_segment . it_chained_starts_in_segments_t using it_chained_starts_in_segments_t = ref_iterator < chained_starts_in_segments_t &> Iterator that outputs chained_starts_in_segment &. it_const_chained_starts_in_segments_t using it_const_chained_starts_in_segments_t = const_ref_iterator Iterator that outputs const chained_starts_in_segment &. binding_info_t using binding_info_t = std::vector> Internal container for storing DyldBindingInfo . it_binding_info using it_binding_info = ref_iterator < binding_info_t &, ChainedBindingInfo *> Iterator which outputs DyldBindingInfo &. it_const_binding_info using it_const_binding_info = const_ref_iterator Iterator which outputs const DyldBindingInfo &. Public Functions DyldChainedFixups DyldChainedFixups() DyldChainedFixups DyldChainedFixups(const details::linkedit_data_command &cmd) clone inline virtual std::unique_ptr< LoadCommand > clone() const override ~DyldChainedFixups ~DyldChainedFixups() override data_offset inline uint32_t data_offset() const Offset of the LC_DYLD_CHAINED_FIXUPS chained payload. This offset should point in the __LINKEDIT segment. data_size inline uint32_t data_size() const Size of the LC_DYLD_CHAINED_FIXUPS payload. data_offset inline void data_offset(uint32_t offset) data_size inline void data_size(uint32_t size) payload inline span payload() const Return the raw content of the command. bindings inline it_binding_info bindings() Iterator over the bindings ( ChainedBindingInfo ) associated with this command. bindings inline it_const_binding_info bindings() const Iterator over the bindings ( ChainedBindingInfo ) associated with this command. chained_starts_in_segments inline it_chained_starts_in_segments_t chained_starts_in_segments() Iterator over the chained fixup metadata. chained_starts_in_segments inline it_const_chained_starts_in_segments_t chained_starts_in_segments() const fixups_version inline uint32_t fixups_version() const Chained fixups version. The loader (dyld v852.2) checks that this value is set to 0. fixups_version inline void fixups_version(uint32_t version) starts_offset inline uint32_t starts_offset() const offset of dyld_chained_starts_in_image in chain_data starts_offset inline void starts_offset(uint32_t offset) imports_offset inline uint32_t imports_offset() const Offset of imports table in chain data. imports_offset inline void imports_offset(uint32_t offset) symbols_offset inline uint32_t symbols_offset() const Offset of symbol strings in chain data. symbols_offset inline void symbols_offset(uint32_t offset) imports_count inline uint32_t imports_count() const Number of imported symbol names. imports_count inline void imports_count(uint32_t cnt) symbols_format inline uint32_t symbols_format() const The compression algorithm (if any) used to store the symbols 0 means uncompressed while 1 means zlib compressed. As far of the version v852.2 of dyld loader, it only supports uncompressed format symbols_format inline void symbols_format(uint32_t fmt) imports_format inline DYLD_CHAINED_FORMAT imports_format() const The format of the imports ( ChainedBindingInfo ). imports_format inline void imports_format( DYLD_CHAINED_FORMAT fmt) add inline chained_starts_in_segment &add( chained_starts_in_segment start_info) accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) chained_starts_in_segment struct chained_starts_in_segment Structure that mirrors the raw dyld_chained_starts_in_segment which aims at providing information about the chained rebase/bind fixups. The relocations provided by this structure can be accessed through SegmentCommand::relocations Public Functions page_count inline size_t page_count() const How many pages are in the page_start array. Public Members offset uint32_t offset = 0 Original offset of the structure, relative to DyldChainedFixups::starts_offset . size uint32_t size = 0 sizeof(size) + sizeof(page_size) + … + sizeof(pointer_format) page_size uint16_t page_size = 0 Likely 0x1000 for x86/x86_64 architectures and 0x4000 for ARM64 architecture. segment_offset uint64_t segment_offset = 0 Offset of the segment’s data from the beginning of the file (it should match SegmentCommand::file_offset ). max_valid_pointer uint32_t max_valid_pointer = 0 for 32-bit OS, any value beyond this is not a pointer pointer_format DYLD_CHAINED_PTR_FORMAT pointer_format = DYLD_CHAINED_PTR_FORMAT :: NONE How pointers are encoded. page_start std::vector page_start Offset in the SegmentCommand of the first element of the chain. chain_starts std::vector chain_starts Currently not supported. segment SegmentCommand &segment Segment in which the rebase/bind fixups take place. Public Static Functions create_empty_chained static inline chained_starts_in_segment create_empty_chained( SegmentCommand &segment) Friends operator<< friend std::ostream &operator<<(std::ostream &os, const chained_starts_in_segment &info) DyldExportsTrie Command DyldExportsTrie class DyldExportsTrie : public LIEF::MachO:: LoadCommand Class that represents the LC_DYLD_EXPORTS_TRIE command. In recent Mach-O binaries, this command replaces the DyldInfo export trie buffer Public Types export_info_t using export_info_t = std::vector> Internal container for storing ExportInfo . it_export_info using it_export_info = ref_iterator < export_info_t &, ExportInfo *> Iterator which outputs const ExportInfo &. it_const_export_info using it_const_export_info = const_ref_iterator Iterator which outputs const ExportInfo &. Public Functions DyldExportsTrie DyldExportsTrie() DyldExportsTrie DyldExportsTrie(const details::linkedit_data_command &cmd) clone inline virtual std::unique_ptr< LoadCommand > clone() const override swap void swap( DyldExportsTrie &other) noexcept ~DyldExportsTrie ~DyldExportsTrie() override data_offset inline uint32_t data_offset() const Offset of the LC_DYLD_EXPORTS_TRIE. This offset should point in the __LINKEDIT segment. data_size inline uint32_t data_size() const Size of the LC_DYLD_EXPORTS_TRIE payload. data_offset inline void data_offset(uint32_t offset) data_size inline void data_size(uint32_t size) content inline span content() const exports inline it_export_info exports() Iterator over the ExportInfo entries. exports inline it_const_export_info exports() const show_export_trie std::string show_export_trie() const Print the exports trie in a human-readable way. add ExportInfo *add(std::unique_ptr< ExportInfo > info) Add an entry in the current trie. See also: LIEF::MachO::Binary::add_exported_function . accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Code Signature Dir Command CodeSignatureDir class CodeSignatureDir : public LIEF::MachO:: LoadCommand Public Functions CodeSignatureDir CodeSignatureDir() = default CodeSignatureDir CodeSignatureDir(const details::linkedit_data_command &cmd) operator= CodeSignatureDir &operator=(const CodeSignatureDir ©) = default CodeSignatureDir CodeSignatureDir(const CodeSignatureDir ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override data_offset inline uint32_t data_offset() const Offset in the binary where the signature starts. data_size inline uint32_t data_size() const Size of the raw signature. data_offset inline void data_offset(uint32_t offset) data_size inline void data_size(uint32_t size) content inline span content() const content inline span content() ~CodeSignatureDir ~CodeSignatureDir() override = default accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Linker Optimization Hint Command LinkerOptHint class LinkerOptHint : public LIEF::MachO:: LoadCommand Class which represents the LC_LINKER_OPTIMIZATION_HINT command. Public Functions LinkerOptHint LinkerOptHint() = default LinkerOptHint LinkerOptHint(const details::linkedit_data_command &cmd) operator= LinkerOptHint &operator=(const LinkerOptHint ©) = default LinkerOptHint LinkerOptHint(const LinkerOptHint ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override data_offset inline uint32_t data_offset() const Offset in the binary where the hint starts. data_size inline uint32_t data_size() const Size of the payload. data_offset inline void data_offset(uint32_t offset) data_size inline void data_size(uint32_t size) content inline span content() const content inline span content() ~LinkerOptHint ~LinkerOptHint() override = default accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Two Level Hints Command TwoLevelHints class TwoLevelHints : public LIEF::MachO:: LoadCommand Class which represents the LC_TWOLEVEL_HINTS command. Public Types hints_list_t using hints_list_t = std::vector it_hints_t using it_hints_t = ref_iterator < hints_list_t &> it_const_hints_t using it_const_hints_t = const_ref_iterator Public Functions TwoLevelHints TwoLevelHints() = default TwoLevelHints TwoLevelHints(const details::twolevel_hints_command &cmd) operator= TwoLevelHints &operator=(const TwoLevelHints ©) = default TwoLevelHints TwoLevelHints(const TwoLevelHints ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override content inline span content() const Original payload of the command. content inline span content() hints inline it_hints_t hints() Iterator over the hints ( uint32_t integers). hints inline it_const_hints_t hints() const offset inline uint32_t offset() const Original offset of the command. It should point in the __LINKEDIT segment. offset inline void offset(uint32_t offset) original_nb_hints inline uint32_t original_nb_hints() const ~TwoLevelHints ~TwoLevelHints() override = default accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Unknown Command UnknownCommand class UnknownCommand : public LIEF::MachO:: LoadCommand Generic class when the command is not recognized by LIEF. Public Functions UnknownCommand UnknownCommand() = delete UnknownCommand inline UnknownCommand(const details::load_command &command) operator= UnknownCommand &operator=(const UnknownCommand ©) = default UnknownCommand UnknownCommand(const UnknownCommand ©) = default clone inline virtual std::unique_ptr< LoadCommand > clone() const override ~UnknownCommand ~UnknownCommand() override = default original_command inline uint64_t original_command() const The original LC_ int that is not supported by LIEF. accept virtual void accept(Visitor &visitor) const override print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LoadCommand *cmd) Stub Stub class Stub This class represents a stub entry in sections like __stubs,__auth_stubs . It wraps assembly instructions which are used to access the got where the address of the symbol is resolved. Example: 0000000236a3c1bc: ___memcpy_chk adrp x17, #0x241513aa8 add x17, x17, #0x241513aa8 ldr x16, [x17] braa x16, x17 Public Functions Stub Stub() = delete Stub Stub(const Stub &) = default operator= Stub &operator=(const Stub &) = default Stub Stub( Stub &&) noexcept = default operator= Stub &operator=( Stub &&) noexcept = default ~Stub ~Stub() = default Stub inline Stub( target_info_t target_info, uint64_t addr, std::vector raw) raw inline span raw() const The (raw) instructions of this entry as a slice of bytes. address inline uint64_t address() const The virtual address where the stub is located. target result target() const The address resolved by this stub. For instance, given this stub: 0x3eec: adrp x16, #4096 0x3ef0: ldr x16, [x16, #24] 0x3ef4: br x16 The function returns: 0x4018 . Warning This function is only available with LIEF’s extended version Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Stub &stub) target_info_t struct target_info_t Public Members arch Header :: CPU_TYPE arch = Header :: CPU_TYPE :: ANY subtype uint32_t subtype = 0 Friends operator== inline friend bool operator==( Stub :: target_info_t lhs, Stub :: target_info_t rhs) Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::random_access_iterator_tag, const Stub > Public Functions Iterator Iterator() = default Iterator inline Iterator( target_info_t target_info, std::vector sections, size_t pos) Iterator Iterator(const Iterator &) = default operator= Iterator &operator=(const Iterator &) = default Iterator Iterator( Iterator &&) noexcept = default operator= Iterator &operator=( Iterator &&) noexcept = default ~Iterator ~Iterator() = default operator< inline bool operator<(const Iterator &rhs) const operator- inline std::ptrdiff_t operator-(const Iterator &R) const operator+= inline Iterator &operator+=(std::ptrdiff_t n) operator-= inline Iterator &operator-=(std::ptrdiff_t n) operator* Stub operator*() const Friends operator== inline friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) Utilities LIEF::MachO::check_layout bool LIEF::MachO::check_layout(const Binary &binary, std::string *error = nullptr) Check the layout of the given Mach-O binary. It checks if it can be signed according to cctools-921/libstuff/checkout.c. LIEF::MachO::check_layout bool LIEF::MachO::check_layout(const FatBinary &binary, std::string *error = nullptr) Check the layout of the given FAT Mach-O by checking individually the layout of the binaries embedded in the FAT. LIEF::MachO::is_macho bool LIEF::MachO::is_macho(std::string_view file) Check if the given file is a Mach-O binary. LIEF::MachO::is_macho bool LIEF::MachO::is_macho(const std::vector &raw) Check if the given raw data is a Mach-O binary. LIEF::MachO::is_fat bool LIEF::MachO::is_fat(std::string_view file) Check if the given file is a FAT Mach-O. LIEF::MachO::is_64 bool LIEF::MachO::is_64(std::string_view file) Check if the given Mach-O is 64-bits. Enums LIEF::MachO::MACHO_TYPES enum class LIEF::MachO::MACHO_TYPES : uint32_t Values: UNKNOWN enumerator UNKNOWN = 0 MAGIC enumerator MAGIC = 0xFEEDFACEu 32-bit big-endian magic CIGAM enumerator CIGAM = 0xCEFAEDFEu 32-bit little-endian magic MAGIC_64 enumerator MAGIC_64 = 0xFEEDFACFu 64-bit big-endian magic CIGAM_64 enumerator CIGAM_64 = 0xCFFAEDFEu 64-bit little-endian magic MAGIC_FAT enumerator MAGIC_FAT = 0xCAFEBABEu big-endian fat magic CIGAM_FAT enumerator CIGAM_FAT = 0xBEBAFECAu little-endian fat magic NEURAL_MODEL enumerator NEURAL_MODEL = 0xbeeffaceu LIEF::MachO::X86_RELOCATION enum class LIEF::MachO::X86_RELOCATION Values: GENERIC_RELOC_VANILLA enumerator GENERIC_RELOC_VANILLA = 0 A generic relocation entry for both addresses contained in data and addresses contained in CPU instructions. GENERIC_RELOC_PAIR enumerator GENERIC_RELOC_PAIR = 1 The second relocation entry of a pair. GENERIC_RELOC_SECTDIFF enumerator GENERIC_RELOC_SECTDIFF = 2 A relocation entry for an item that contains the difference of two section addresses. This is generally used for position-independent code generation. GENERIC_RELOC_PB_LA_PTR enumerator GENERIC_RELOC_PB_LA_PTR = 3 contains the address from which to subtract; it must be followed by a X86_RELOCATION::GENERIC_RELOC_PAIR containing the address to subtract. GENERIC_RELOC_LOCAL_SECTDIFF enumerator GENERIC_RELOC_LOCAL_SECTDIFF = 4 Similar to X86_RELOCATION::GENERIC_RELOC_SECTDIFF except that this entry refers specifically to the address in this item. If the address is that of a globally visible coalesced symbol, this relocation entry does not change if the symbol is overridden. This is used to associate stack unwinding information with the object code this relocation entry describes. GENERIC_RELOC_TLV enumerator GENERIC_RELOC_TLV = 5 A relocation entry for a prebound lazy pointer. This is always a scattered relocation entry. The MachO::Relocation::value field contains the non-prebound value of the lazy pointer. LIEF::MachO::X86_64_RELOCATION enum class LIEF::MachO::X86_64_RELOCATION Values: X86_64_RELOC_UNSIGNED enumerator X86_64_RELOC_UNSIGNED = 0 A CALL/JMP instruction with 32-bit displacement. X86_64_RELOC_SIGNED enumerator X86_64_RELOC_SIGNED = 1 A MOVQ load of a GOT entry. X86_64_RELOC_BRANCH enumerator X86_64_RELOC_BRANCH = 2 Other GOT references. X86_64_RELOC_GOT_LOAD enumerator X86_64_RELOC_GOT_LOAD = 3 Signed 32-bit displacement. X86_64_RELOC_GOT enumerator X86_64_RELOC_GOT = 4 Absolute address. X86_64_RELOC_SUBTRACTOR enumerator X86_64_RELOC_SUBTRACTOR = 5 Must be followed by a X86_64_RELOCATION::X86_64_RELOC_UNSIGNED relocation. X86_64_RELOC_SIGNED_1 enumerator X86_64_RELOC_SIGNED_1 = 6 X86_64_RELOC_SIGNED_2 enumerator X86_64_RELOC_SIGNED_2 = 7 X86_64_RELOC_SIGNED_4 enumerator X86_64_RELOC_SIGNED_4 = 8 X86_64_RELOC_TLV enumerator X86_64_RELOC_TLV = 9 LIEF::MachO::PPC_RELOCATION enum class LIEF::MachO::PPC_RELOCATION Values: PPC_RELOC_VANILLA enumerator PPC_RELOC_VANILLA = 0 PPC_RELOC_PAIR enumerator PPC_RELOC_PAIR = 1 PPC_RELOC_BR14 enumerator PPC_RELOC_BR14 = 2 PPC_RELOC_BR24 enumerator PPC_RELOC_BR24 = 3 PPC_RELOC_HI16 enumerator PPC_RELOC_HI16 = 4 PPC_RELOC_LO16 enumerator PPC_RELOC_LO16 = 5 PPC_RELOC_HA16 enumerator PPC_RELOC_HA16 = 6 PPC_RELOC_LO14 enumerator PPC_RELOC_LO14 = 7 PPC_RELOC_SECTDIFF enumerator PPC_RELOC_SECTDIFF = 8 PPC_RELOC_PB_LA_PTR enumerator PPC_RELOC_PB_LA_PTR = 9 PPC_RELOC_HI16_SECTDIFF enumerator PPC_RELOC_HI16_SECTDIFF = 10 PPC_RELOC_LO16_SECTDIFF enumerator PPC_RELOC_LO16_SECTDIFF = 11 PPC_RELOC_HA16_SECTDIFF enumerator PPC_RELOC_HA16_SECTDIFF = 12 PPC_RELOC_JBSR enumerator PPC_RELOC_JBSR = 13 PPC_RELOC_LO14_SECTDIFF enumerator PPC_RELOC_LO14_SECTDIFF = 14 PPC_RELOC_LOCAL_SECTDIFF enumerator PPC_RELOC_LOCAL_SECTDIFF = 15 LIEF::MachO::ARM_RELOCATION enum class LIEF::MachO::ARM_RELOCATION Values: ARM_RELOC_VANILLA enumerator ARM_RELOC_VANILLA = 0 ARM_RELOC_PAIR enumerator ARM_RELOC_PAIR = 1 ARM_RELOC_SECTDIFF enumerator ARM_RELOC_SECTDIFF = 2 ARM_RELOC_LOCAL_SECTDIFF enumerator ARM_RELOC_LOCAL_SECTDIFF = 3 ARM_RELOC_PB_LA_PTR enumerator ARM_RELOC_PB_LA_PTR = 4 ARM_RELOC_BR24 enumerator ARM_RELOC_BR24 = 5 ARM_THUMB_RELOC_BR22 enumerator ARM_THUMB_RELOC_BR22 = 6 ARM_THUMB_32BIT_BRANCH enumerator ARM_THUMB_32BIT_BRANCH = 7 ARM_RELOC_HALF enumerator ARM_RELOC_HALF = 8 ARM_RELOC_HALF_SECTDIFF enumerator ARM_RELOC_HALF_SECTDIFF = 9 LIEF::MachO::ARM64_RELOCATION enum class LIEF::MachO::ARM64_RELOCATION Values: ARM64_RELOC_UNSIGNED enumerator ARM64_RELOC_UNSIGNED = 0 For pointers. ARM64_RELOC_SUBTRACTOR enumerator ARM64_RELOC_SUBTRACTOR = 1 Must be followed by an ARM64_RELOCATION::ARM64_RELOC_UNSIGNED . ARM64_RELOC_BRANCH26 enumerator ARM64_RELOC_BRANCH26 = 2 A B/BL instruction with 26-bit displacement. ARM64_RELOC_PAGE21 enumerator ARM64_RELOC_PAGE21 = 3 PC-rel distance to page of target. ARM64_RELOC_PAGEOFF12 enumerator ARM64_RELOC_PAGEOFF12 = 4 Offset within page, scaled by MachO::Relocation::size . ARM64_RELOC_GOT_LOAD_PAGE21 enumerator ARM64_RELOC_GOT_LOAD_PAGE21 = 5 PC-rel distance to page of GOT slot. ARM64_RELOC_GOT_LOAD_PAGEOFF12 enumerator ARM64_RELOC_GOT_LOAD_PAGEOFF12 = 6 Offset within page of GOT slot, scaled by MachO::Relocation::size . ARM64_RELOC_POINTER_TO_GOT enumerator ARM64_RELOC_POINTER_TO_GOT = 7 For pointers to GOT slots. ARM64_RELOC_TLVP_LOAD_PAGE21 enumerator ARM64_RELOC_TLVP_LOAD_PAGE21 = 8 PC-rel distance to page of TLVP slot. ARM64_RELOC_TLVP_LOAD_PAGEOFF12 enumerator ARM64_RELOC_TLVP_LOAD_PAGEOFF12 = 9 Offset within page of TLVP slot, scaled by MachO::Relocation::size . ARM64_RELOC_ADDEND enumerator ARM64_RELOC_ADDEND = 10 Must be followed by ARM64_RELOCATION::ARM64_RELOC_PAGE21 or ARM64_RELOCATION::ARM64_RELOC_PAGEOFF12 . LIEF::MachO::DYLD_CHAINED_FORMAT enum class LIEF::MachO::DYLD_CHAINED_FORMAT Values: IMPORT enumerator IMPORT = 1 Originally: DYLD_CHAINED_IMPORT. IMPORT_ADDEND enumerator IMPORT_ADDEND = 2 Originally: DYLD_CHAINED_IMPORT_ADDEND. IMPORT_ADDEND64 enumerator IMPORT_ADDEND64 = 3 Originally: DYLD_CHAINED_IMPORT_ADDEND64. LIEF::MachO::DYLD_CHAINED_PTR_FORMAT enum class LIEF::MachO::DYLD_CHAINED_PTR_FORMAT Values: NONE enumerator NONE = 0 PTR_ARM64E enumerator PTR_ARM64E = 1 PTR_64 enumerator PTR_64 = 2 PTR_32 enumerator PTR_32 = 3 PTR_32_CACHE enumerator PTR_32_CACHE = 4 PTR_32_FIRMWARE enumerator PTR_32_FIRMWARE = 5 PTR_64_OFFSET enumerator PTR_64_OFFSET = 6 PTR_ARM64E_OFFSET enumerator PTR_ARM64E_OFFSET = 7 PTR_ARM64E_KERNEL enumerator PTR_ARM64E_KERNEL = 7 PTR_64_KERNEL_CACHE enumerator PTR_64_KERNEL_CACHE = 8 PTR_ARM64E_USERLAND enumerator PTR_ARM64E_USERLAND = 9 PTR_ARM64E_FIRMWARE enumerator PTR_ARM64E_FIRMWARE = 10 PTR_X86_64_KERNEL_CACHE enumerator PTR_X86_64_KERNEL_CACHE = 11 PTR_ARM64E_USERLAND24 enumerator PTR_ARM64E_USERLAND24 = 12 PTR_ARM64E_SHARED_CACHE enumerator PTR_ARM64E_SHARED_CACHE = 13 PTR_ARM64E_SEGMENTED enumerator PTR_ARM64E_SEGMENTED = 14", "contentHash": "5c75e9781c7028c0a49dca1f1b95183e23f6e33e8f28483b7dc941bd8bf50ac9", "description": "Mach-O C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "formats/macho/cpp", "documentID": "9234e6bbacb2f0d3db307e70152f1335b633e161a06198ed452a3a25cb9454b3", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/macho/cpp.md", "title": "Mach-O C++ API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/macho/index.html", "content": "Mach-O API C++ Python Rust Introduction Mach-O binaries can be parsed using the lief.MachO.parse() ( lief::macho::FatBinary::parse ; lief.MachO.parse() ; LIEF::MachO::Parser::parse() ) function. Note The Mach-O format defines FAT binaries, which can embed different architectures into a single file. lief.MachO.parse() ( lief::macho::FatBinary::parse ; lief.MachO.parse() ; LIEF::MachO::Parser::parse() ) always returns a lief.MachO.FatBinary ( lief::macho::FatBinary ; lief.MachO.FatBinary ; LIEF::MachO::FatBinary ), assuming that a non-FAT Mach-O can be represented as a lief.MachO.FatBinary ( lief::macho::FatBinary ; lief.MachO.FatBinary ; LIEF::MachO::FatBinary ) containing a single architecture. Python import lief # Using filepath macho: lief.MachO.FatBinary | None = lief.MachO.parse(\"/bin/ls\") # Using a Path from pathlib macho: lief.MachO.FatBinary | None = lief.MachO.parse( pathlib.Path(r\"C:\\Users\\test.macho\") ) # Using an io object with open(\"/bin/ssh\", \"rb\") as f: macho: lief.MachO.FatBinary | None = lief.MachO.parse(f) C++ #include // Using a file path as a std::string std::unique_ptr macho = LIEF::MachO::Parser::parse(\"/bin/ls\"); // Using a vector std::vector my_raw_macho; macho = LIEF::MachO::Parser::parse(my_raw_macho); Rust let macho: lief::macho::FatBinary = lief::macho::FatBinary::parse(\"/bin/ls\").unwrap(); This lief.MachO.FatBinary ( lief::macho::FatBinary ; lief.MachO.FatBinary ; LIEF::MachO::FatBinary ) object exposes facilities to either iterate over the different lief.MachO.Binary ( lief::macho::Binary ; lief.MachO.Binary ; LIEF::MachO::Binary ) or pick/take a specific one: Python fat: lief.MachO.FatBinary # Iterate for macho in fat: print(macho.entrypoint) print(len(macho.commands)) # Pick one at the specified index macho = fat.at(0) # Pick one based on the architecture macho = fat.take(lief.MachO.Header.CPU_TYPE.ARM64) C++ std::unique_ptr fat; // Iterate for (const LIEF::MachO::Binary& macho : *fat) { std::cout << macho.entrypoint() << '\\n'; std::cout << macho.commands().size() << '\\n'; } // Pick one at the specified index (without taking ownership) const LIEF::MachO::Binary* macho = fat->at(0); // Pick one at the specified index and taking ownership std::unique_ptr owned = fat->take(0); // Pick one with the given arch and taking ownership std::unique_ptr arm64 = fat->take(LIEF::MachO::Header::CPU_TYPE::ARM64); Rust let fat: &lief::macho::FatBinary = some_fat; // Iterate for macho in fat.iter() { println!(\"{}\", macho.entrypoint()); } // Pick one with the given arch let arm64 = fat .with_cpu(lief::macho::header::CpuType::ARM64) .expect(\"Missing ARM64\"); After modifying a lief.MachO.Binary ( lief::macho::Binary ; lief.MachO.Binary ; LIEF::MachO::Binary ) or lief.MachO.FatBinary ( lief::macho::FatBinary ; lief.MachO.FatBinary ; LIEF::MachO::FatBinary ) object, you can use either lief.MachO.Binary.write() ( lief::macho::Binary::write ; lief::macho::Binary::write_with_config ; lief.MachO.Binary.write() ; LIEF::MachO::Binary::write() ) or lief.MachO.FatBinary.write() ( lief.FatBinary.Binary.write() ; LIEF::FatBinary::Binary::write() ) to write it back to a raw Mach-O file. Python macho: lief.MachO.FatBinary macho.at(0).write(\"fit.macho\") macho.write(\"fat.macho\") # write-back the whole FAT binary C++ std::unique_ptr macho; macho->take(LIEF::MachO::Header::CPU_TYPE::ARM64)->write(\"fit.macho\"); macho->write(\"fat.macho\"); Rust let fat: &mut lief::macho::FatBinary = some_fat; fat.with_cpu(lief::macho::header::CpuType::ARM64) .unwrap() .write(\"fit.macho\"); You can also use lief.MachO.Binary.write_to_bytes() ( lief::macho::Binary::write_to_bytes ; lief::macho::Binary::write_to_bytes_with_config ; lief.MachO.Binary.write_to_bytes() ; std::unique_ptr LIEF::MachO::Binary::write(std::ostream &) ; std::unique_ptr LIEF::MachO::Binary::write(std::ostream &, const Builder::config_t &)() ) to get the new Mach-O binary as a buffer of bytes: Note This API can also take an extra lief.MachO.Builder.config_t ( lief::pe::builder::Config ; lief.MachO.Builder.config_t ; LIEF::MachO::Builder::config_t ) parameter. Python macho: lief.MachO.Binary new_macho: bytes = macho.write_to_bytes() C++ std::unique_ptr macho; std::ostringstream os; macho->write(os); std::string buffer = os.str(); const auto* start = reinterpret_cast(buffer.data()); size_t size = buffer.size(); Rust let macho: &mut lief::macho::Binary = some_macho; let bytes: Vec = macho.write_to_bytes(); Advanced Parsing/Writing lief.MachO.parse() ( lief::macho::FatBinary::parse ; lief.MachO.parse() ; LIEF::MachO::Parser::parse() ) can take an extra lief.MachO.ParserConfig ( lief.MachO.ParserConfig ; LIEF::MachO::ParserConfig ) parameter to specify parts of the Mach-O format to skip during parsing. Warning Generally, lief.MachO.Binary.write() ( lief::macho::Binary::write ; lief::macho::Binary::write_with_config ; lief.MachO.Binary.write() ; LIEF::MachO::Binary::write() ) and lief.MachO.FatBinary.write() ( lief.FatBinary.Binary.write() ; LIEF::FatBinary::Binary::write() ) require a complete initial parsing of the Mach-O file. Similarly, lief.MachO.Binary.write() ( lief::macho::Binary::write ; lief::macho::Binary::write_with_config ; lief.MachO.Binary.write() ; LIEF::MachO::Binary::write() ) can also take an extra lief.MachO.Builder.config_t ( lief::pe::builder::Config ; lief.MachO.Builder.config_t ; LIEF::MachO::Builder::config_t ) to specify which parts of the Mach-O should be rebuilt. Python parser_config = lief.MachO.ParserConfig() parser_config.parse_dyld_bindings = False fat = lief.MachO.parse(\"my.macho\", parser_config) assert isinstance(fat, lief.MachO.FatBinary) macho = fat.at(0) assert isinstance(fat, lief.MachO.Binary) builder_config = lief.MachO.Builder.config_t() builder_config.linkedit = False macho.write(\"new.macho\", builder_config) C++ LIEF::MachO::ParserConfig parser_config; parser_config.parse_dyld_bindings = false; std::unique_ptr fat = LIEF::MachO::Parser::parse(\"my.macho\", parser_config); LIEF::MachO::Binary* macho = fat->at(0); LIEF::MachO::Builder::config_t builder_config; builder_config.linkedit = false; macho->write(\"new.macho\", builder_config); Rust let mut parser_config = lief::macho::ParserConfig::default(); parser_config.parse_dyld_bindings = false; let mut fat = lief::macho::parse_with_config(\"my.macho\", &parser_config).unwrap(); let mut macho = fat.iter().next().unwrap(); let mut builder_config = lief::macho::builder::Config::default(); builder_config.linkedit = false; macho.write_with_config(\"new.macho\", builder_config); See also Binary Abstraction Dump Analysis LIEF has the support to process Mach-O memory dump with lief.MachO.parse_from_dump() ( lief::macho::FatBinary::parse_from_dump ; lief.MachO.parse_from_dump() ; LIEF::MachO::Parser::parse_from_dump() ). This function translates the file offsets referenced by the Mach-O structures into their location inside the dump, using the base address passed as the second parameter. As for the regular parser, it returns a lief.MachO.FatBinary ( lief::macho::FatBinary ; lief.MachO.FatBinary ; LIEF::MachO::FatBinary ): Python # 0x11e32c000 is the (absolute) address at which the dump was mapped fat = lief.MachO.parse_from_dump(\"module.dump\", 0x11E32C000) assert isinstance(fat, lief.MachO.FatBinary) macho = fat.at(0) assert isinstance(fat, lief.MachO.Binary) for segment in macho.segments: print(segment.name, hex(segment.virtual_address)) C++ auto fat = LIEF::MachO::Parser::parse_from_dump(\"module.dump\", 0x11e32c000); const LIEF::MachO::Binary* macho = fat->at(0); for (const LIEF::MachO::SegmentCommand& segment : macho->segments()) { std::cout << segment.name() << '\\n'; } Rust let fat = lief::macho::FatBinary::parse_from_dump(\"module.dump\", 0x1_1e32_c000).unwrap(); let macho = fat.iter().next().unwrap(); for segment in macho.segments() { println!(\"{} {:#x}\", segment.name(), segment.virtual_address()); } Note The second parameter must be the (absolute) virtual address at which the dump was mapped. It is used to convert the virtual addresses found in the Mach-O structures back into an offset within the dump. Producing a dump with the runtime API Such a dump can be produced from a live process thanks to the LIEF runtime and, more precisely, the Module API . lief.runtime.Module.dump() ( lief::runtime::module::Module::dump ; lief.runtime.Module.dump() ; LIEF::runtime::Module::dump() ) captures the memory of a loaded module (from its imagebase over its virtual size): Python # Find the module to dump in the current process mod = lief.runtime.module_from_name(\"libsystem_c.dylib\") assert isinstance(mod, lief.runtime.osx.Module) # Dump the module's memory into a file (the raw bytes are also returned) ... data: bytes = mod.dump(\"module.dump\") # ... and parse it back using the same imagebase: macho = lief.MachO.parse_from_dump(data, mod.imagebase) C++ // Find the module to dump in the current process auto mod = LIEF::runtime::module_from_name(\"libsystem_c.dylib\"); // Dump the module's memory into a file (the raw bytes are also returned) std::vector data = mod->dump(\"module.dump\"); auto fat = LIEF::MachO::Parser::parse_from_dump(\"module.dump\", mod->imagebase()); Rust use lief::runtime::Module; let module = lief::runtime::module_from_name(\"libsystem_c.dylib\").unwrap(); // Dump the module's memory into a file (the raw bytes are also returned) let data = module.dump_to_file(\"module.dump\"); let fat = lief::macho::FatBinary::parse_from_dump(\"module.dump\", module.imagebase()).unwrap(); RPath and Library Path Modification Sometimes, we need to modify the Mach-O RPath commands or the (absolute) path of a linked library in an executable. When recompiling or linking the executable is not possible, LIEF can be used for these modifications. For example, let’s consider a binary with the following dependencies: $ otool -L hello.bin hello: /Users/romain/dev/libmylib.dylib (compatibility version 0.0.0, current version 0.0.0) /usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 1700.255.0) /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.100.2) One can change the directory of libmylib.dylib with the following code: Python fat = lief.MachO.parse(\"hello.bin\") assert isinstance(fat, lief.MachO.FatBinary) macho = fat.at(0) assert isinstance(fat, lief.MachO.Binary) lib = macho.find_library(\"libmylib.dylib\") assert isinstance(lib, lief.MachO.DylibCommand) lib.name = \"/opt/homebrew/my_package/libmylib.dylib\" macho.write(\"hello_fixed.bin\") C++ std::unique_ptr macho = LIEF::MachO::Parser::parse(\"hello.bin\")->take(0); LIEF::MachO::DylibCommand* lib = macho->find_library(\"libmylib.dylib\"); lib->name(\"/opt/homebrew/my_package/libmylib.dylib\"); macho->write(\"hello_fixed.bin\"); Rust let fat = lief::macho::FatBinary::parse(\"hello.bin\").unwrap(); let mut binary = fat.iter().next().unwrap(); let mut lib = binary.find_library(\"libmylib.dylib\").unwrap(); lib.set_name(\"/opt/homebrew/my_package/libmylib.dylib\"); binary.write(\"hello_fixed.bin\"); Note It is worth mentioning that LIEF doesn’t impose restrictions on the length of modified library paths. LIEF manages all internal modifications to support both longer and shorter library paths. This type of modification can be used in conjunction with the @rpath feature of Mach-O binaries: We can add an extra LC_RPATH ( lief.MachO.RPathCommand ( lief::macho::commands::RPath ; lief.MachO.RPathCommand ; LIEF::MachO::RPathCommand )) command to hello.bin : Python fat = lief.MachO.parse(\"hello.bin\") assert isinstance(fat, lief.MachO.FatBinary) macho = fat.at(0) assert isinstance(fat, lief.MachO.Binary) rpath = lief.MachO.RPathCommand.create(\"/opt/homebrew/my_package\") assert isinstance(rpath, lief.MachO.RPathCommand) macho.add(rpath) C++ std::unique_ptr macho = LIEF::MachO::Parser::parse(\"hello.bin\")->take(0); auto rpath = LIEF::MachO::RPathCommand::create(\"/opt/homebrew/my_package\"); macho->add(*rpath); Rust let fat = lief::macho::FatBinary::parse(\"hello.bin\").unwrap(); let mut binary = fat.iter().next().unwrap(); let rpath = RPath::new(\"/opt/homebrew/my_package\"); binary.add_command(rpath); Then, we can change the library path of libmylib.dylib to include the RPath prefix: Python macho: lief.MachO.Binary lib = macho.find_library(\"libmylib.dylib\") assert isinstance(lib, lief.MachO.DylibCommand) lib.name = \"@rpath/libmylib.dylib\" macho.write(\"hello_fixed.bin\") C++ std::unique_ptr macho; LIEF::MachO::DylibCommand* lib = macho->find_library(\"libmylib.dylib\"); lib->name(\"@rpath/libmylib.dylib\"); macho->write(\"hello_fixed.bin\"); Rust let binary: &mut lief::macho::Binary = some_binary; let mut lib = binary.find_library(\"libmylib.dylib\").unwrap(); lib.set_name(\"@rpath/libmylib.dylib\"); binary.write(\"hello_fixed.bin\"); Objective-C Support If a Mach-O binary is compiled from Objective-C sources, it may contain metadata represented by the lief.ObjC.Metadata ( lief::objc::Metadata ; lief.objc.Metadata ; LIEF::objc::Metadata ) object. This metadata can help understand the underlying structures of the binary, and LIEF Extended provides support for accessing this information through lief.MachO.Binary.objc_metadata ( lief::macho::Binary::objc_metadata ; lief.MachO.Binary.objc_metadata ; LIEF::MachO::Binary::objc_metadata() ). For more details, you can check the Obj-C section .", "contentHash": "43ace54784265dbc8a28b8f9338638faf8c98c004ee3552c1b1e966bfea13850", "description": "Mach-O binaries can be parsed using the lief.MachO.parse() function.", "docname": "formats/macho/index", "documentID": "480297733823647889e4623a5505326a975fc97b11fd3e8be42a75d63e4b65ed", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/macho/index.md", "title": "Mach-O - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/macho/python.html", "content": "Python Parser lief.MachO.parse lief.MachO.parse( obj: str | io.IOBase | os.PathLike | bytes | list[int] , config: lief.MachO.ParserConfig ) → lief.MachO.FatBinary | None Parse the given binary from the given input and return a FatBinary object One can configure the parser with the config parameter. See ParserConfig lief.MachO.ParserConfig class lief.MachO.ParserConfig( self ) Bases: object This class is used to tweak the MachO Parser ( Parser ) deep deep = fix_from_memory property fix_from_memory → bool When parsing Mach-O from memory, this option can be used to undo relocations and symbols bindings. When activated, this option requires parse_dyld_bindings and parse_dyld_rebases to be enabled. from_dyld_shared_cache property from_dyld_shared_cache → bool Whether the binary is coming/extracted from Dyld shared cache full_dyldinfo full_dyldinfo( self , flag: bool ) → lief._lief.MachO.ParserConfig If flag is set to true , Exports, Bindings and Rebases opcodes are parsed. Warning Enabling this flag can slow down the parsing parse_dyld_bindings property parse_dyld_bindings → bool Parse the Dyld binding opcodes parse_dyld_exports property parse_dyld_exports → bool Parse the Dyld export trie parse_dyld_rebases property parse_dyld_rebases → bool Parse the Dyld rebase opcodes quick quick = fatbinary_1 = lief.MachO.parse(\"/usr/bin/ls\", config=lief.MachO.ParserConfig.deep) # or fatbinary_2 = lief.MachO.parse(\"/usr/bin/ls\", config=lief.MachO.ParserConfig.quick) FatBinary lief.MachO.FatBinary class lief.MachO.FatBinary Bases: object Class which represents a Mach-O (fat) binary This object is also used for representing Mach-O binaries that are NOT FAT at at( self , index: int ) → lief._lief.MachO.Binary | None Return the Binary at the given index or None if it is not present create create( binaries: collections.abc.Sequence[ lief.MachO.Binary | None] ) → lief.MachO.FatBinary | None = get get( self , arg: lief._lief.MachO.Header.CPU_TYPE , / ) → lief._lief.MachO.Binary | None Gets the Binary that matches the given architecture raw raw( self ) → list[int] Build a Mach-O universal binary and return its bytes size property size → int Number of Binary registered take take( self , cpu: lief._lief.MachO.Header.CPU_TYPE ) → lief._lief.MachO.Binary | None Return the Binary that matches the given CPU_TYPE write write( self , filename: str | os.PathLike ) → None Build a Mach-O universal binary Binary lief.MachO.Binary class lief.MachO.Binary Bases: Binary Class which represents a MachO binary addaddaddadd add( self , dylib_command: lief._lief.MachO.DylibCommand ) → lief._lief.MachO.LoadCommand | None **add( self , segment: lief._lief.MachO.SegmentCommand ) → lief._lief.MachO.LoadCommand | None **add( self , load_command: lief._lief.MachO.LoadCommand ) → lief._lief.MachO.LoadCommand | None add( self , load_command: lief._lief.MachO.LoadCommand , index: int ) → lief._lief.MachO.LoadCommand | None **** Overloaded function. add(self, dylib_command: lief._lief.MachO.DylibCommand) -> lief._lief.MachO.LoadCommand | None Add a new DylibCommand add(self, segment: lief._lief.MachO.SegmentCommand) -> lief._lief.MachO.LoadCommand | None Add a new SegmentCommand add(self, load_command: lief._lief.MachO.LoadCommand) -> lief._lief.MachO.LoadCommand | None Add a new LoadCommand add(self, load_command: lief._lief.MachO.LoadCommand, index: int) -> lief._lief.MachO.LoadCommand | None Add a new LoadCommand at index add_exported_function add_exported_function( self , address: int , name: str ) → lief._lief.MachO.ExportInfo | None Add a new export in the binary add_library add_library( self , library_name: str ) → lief._lief.MachO.LoadCommand | None Add a new library dependency add_local_symbol add_local_symbol( self , address: int , name: str ) → lief._lief.MachO.Symbol | None Add a new symbol in the LC_SYMTAB add_sectionadd_section add_section( self , segment: lief._lief.MachO.SegmentCommand , section: lief._lief.MachO.Section ) → lief._lief.MachO.Section | None add_section( self , section: lief._lief.MachO.Section ) → lief._lief.MachO.Section | None Overloaded function. add_section(self, segment: lief._lief.MachO.SegmentCommand, section: lief._lief.MachO.Section) -> lief._lief.MachO.Section | None Add a new Section in the given SegmentCommand add_section(self, section: lief._lief.MachO.Section) -> lief._lief.MachO.Section | None Add a new Section within the __TEXT segment atom_info property atom_info → lief.MachO.AtomInfo | None Return the binary’s AtomInfo if any, or None available_command_space property available_command_space → int bindings property bindings → Iterator[ lief.MachO.BindingInfo ] Return an iterator over the binding info which can come from either DyldInfo or DyldChainedFixups commands. build_version property build_version → lief.MachO.BuildVersion | None Return the binary’s BuildVersion if any, or None can_remove can_remove( self , symbol: lief._lief.MachO.Symbol ) → bool Check if the given symbol can be safely removed. can_remove_symbol can_remove_symbol( self , symbol_name: str ) → bool Check if the given symbol name can be safely removed. code_signature property code_signature → lief.MachO.CodeSignature | None Return the binary’s CodeSignature if any, or None code_signature_dir property code_signature_dir → lief.MachO.CodeSignatureDir | None Return the binary’s CodeSignatureDir if any, or None commands property commands → lief.MachO.Binary.it_commands Return an iterator over the binary’s Command data_in_code property data_in_code → lief.MachO.DataInCode | None Return the binary’s DataInCode if any, or None dyld_chained_fixups property dyld_chained_fixups → lief.MachO.DyldChainedFixups | None Return the binary’s DyldChainedFixups if any, or None dyld_environment property dyld_environment → lief.MachO.DyldEnvironment | None Return the binary’s DyldEnvironment if any, or None dyld_exports_trie property dyld_exports_trie → lief.MachO.DyldExportsTrie | None Return the binary’s DyldExportsTrie if any, or None dyld_info property dyld_info → lief.MachO.DyldInfo | None Return the binary’s DyldInfo if any, or None dylinker property dylinker → lief.MachO.DylinkerCommand | None Return the binary’s DylinkerCommand if any, or None dynamic_symbol_command property dynamic_symbol_command → lief.MachO.DynamicSymbolCommand | None Return the binary’s DynamicSymbolCommand if any, or None encryption_info property encryption_info → lief.MachO.EncryptionInfo | None Return the binary’s EncryptionInfo if any, or None exported_symbols property exported_symbols → lief.MachO.Binary.it_filter_symbols Return the binary’s Symbol which are exported extend extend( self , load_command: lief._lief.MachO.LoadCommand , size: int ) → bool Extend a LoadCommand by size extend_section extend_section( self , section: lief._lief.MachO.Section , size: int ) → bool Extend the content of the given Section by size extend_segment extend_segment( self , segment_command: lief._lief.MachO.SegmentCommand , size: int ) → bool Extend the content of the given SegmentCommand by size fat_offset property fat_offset → int Return binary’s fat offset . 0 if not relevant. fileset_addr property fileset_addr → int Original address associated with the LC_FILESET_ENTRY for this MachO. fileset_name property fileset_name → str Name associated with the LC_FILESET_ENTRY for this MachO. For instance: com.apple.kec.corecrypto filesets property filesets → lief.MachO.FatBinary.it_binaries Return binary’s Filesets find_library find_library( self , name: str ) → lief._lief.MachO.DylibCommand | None Try to find the library with the given library name. This function tries to match the fullpath of the DylibCommand or the library name suffix. function_starts property function_starts → lief.MachO.FunctionStarts | None Return the binary’s FunctionStarts if any, or None function_variant_fixups property function_variant_fixups → lief.MachO.FunctionVariantFixups | None Return LC_FUNCTION_VARIANT_FIXUPS command function_variants property function_variants → lief.MachO.FunctionVariants | None Return LC_FUNCTION_VARIANTS command functions property functions → list[ lief.Function ] Return list of all Function found get get( self , type: lief._lief.MachO.LoadCommand.TYPE ) → lief._lief.MachO.LoadCommand | None Return the first LoadCommand with the given TYPE or None if it is not present. get_sectionget_section get_section( self , name: str ) → lief._lief.MachO.Section | None get_section( self , segname: str , secname: str ) → lief._lief.MachO.Section | None Overloaded function. get_section(self, name: str) -> lief._lief.MachO.Section | None Return the section from the given name or None if the section does not exist get_section(self, segname: str, secname: str) -> lief._lief.MachO.Section | None Return the section from the segment with the name given in the first parameter and with the section’s name provided in the second parameter. If the section cannot be found, it returns a nullptr get_segment get_segment( self , name: str ) → lief._lief.MachO.SegmentCommand | None Return the SegmentCommand from the given name get_symbol get_symbol( self , name: str ) → lief._lief.MachO.Symbol | None Return the Symbol from the given name has has( self , type: lief._lief.MachO.LoadCommand.TYPE ) → bool Check if the current binary has a LoadCommand with the given TYPE has_atom_info property has_atom_info → bool True if the binary embeds the LC_ATOM_INFO command ( AtomInfo ) has_build_version property has_build_version → bool True if the binary has a BuildVersion command has_code_signature property has_code_signature → bool True if the binary is signed (i.e. has a CodeSignature command) has_code_signature_dir property has_code_signature_dir → bool True if the binary is signed (i.e. has a CodeSignatureDir command) with the command LC_DYLIB_CODE_SIGN_DRS has_data_in_code property has_data_in_code → bool True if the binary has a DataInCode command has_dyld_chained_fixups property has_dyld_chained_fixups → bool True if the binary has a DyldChainedFixups command has_dyld_environment property has_dyld_environment → bool True if the binary has a DyldEnvironment command has_dyld_exports_trie property has_dyld_exports_trie → bool True if the binary has a DyldExportsTrie command has_dyld_info property has_dyld_info → bool True if the binary has a DyldInfo command. has_dylinker property has_dylinker → bool True if the binary has a DylinkerCommand command. has_dynamic_symbol_command property has_dynamic_symbol_command → bool True if the binary has a DynamicSymbolCommand command. has_encryption_info property has_encryption_info → bool True if the binary has a EncryptionInfo command has_entrypoint property has_entrypoint → bool True if the binary has an entrypoint. Basically for libraries it will return false has_filesets property has_filesets → bool Return True if the binary has filesets has_function_starts property has_function_starts → bool True if the binary has a FunctionStarts command. has_function_variant_fixups property has_function_variant_fixups → bool True if the binary has a LC_FUNCTION_VARIANT_FIXUPS command has_function_variants property has_function_variants → bool True if the binary has a LC_FUNCTION_VARIANTS command has_linker_opt_hint property has_linker_opt_hint → bool True if the binary embeds the Linker optimization hint command ( LinkerOptHint ) has_main_command property has_main_command → bool True if the binary has a MainCommand command. has_notes property has_notes → bool True if the binary contains LC_NOTE command(s) has_nx_heap property has_nx_heap → bool Return True if the heap is flagged as non-executable. False otherwise. has_nx_stack property has_nx_stack → bool Return True if the stack is flagged as non-executable. False otherwise. has_routine_command property has_routine_command → bool True if the binary has a Routine command. has_rpath property has_rpath → bool True if the binary has a RPathCommand command. has_section has_section( self , name: str ) → bool Check if a section with the given name exists has_segment has_segment( self , name: str ) → bool Check if a SegmentCommand with the given name exists has_segment_split_info property has_segment_split_info → bool True if the binary has a SegmentSplitInfo command has_source_version property has_source_version → bool True if the binary has a SourceVersion command. has_sub_framework property has_sub_framework → bool True if the binary has a SubFramework command has_subclients property has_subclients → bool True if the binary has a SubClient command has_symbol has_symbol( self , name: str ) → bool Check if a Symbol with the given name exists has_symbol_command property has_symbol_command → bool True if the binary has a SymbolCommand command. has_thread_command property has_thread_command → bool True if the binary has a ThreadCommand command. has_two_level_hints property has_two_level_hints → bool True if the binary embeds the Two Level Hint command ( TwoLevelHints ) has_uuid property has_uuid → bool True if the binary has a UUIDCommand command. has_version_min property has_version_min → bool True if the binary has a VersionMin command. header property header → lief.MachO.Header Return binary’s Header imagebase property imagebase → int Return the binary’s imagebase which is the base address where segments are mapped (without the ASLR). 0 if not relevant. imported_symbols property imported_symbols → lief.MachO.Binary.it_filter_symbols Return the binary’s Symbol which are imported is_ios property is_ios → bool True if this binary targets iOS is_macos property is_macos → bool True if this binary targets macOS is_valid_addr is_valid_addr( self , address: int ) → bool Check if the given address is encompassed between the range of virtual addresses. See: va_ranges lazy_load_dylib_infos property lazy_load_dylib_infos → lief.MachO.Binary.it_lazy_load_dylib_info Return an iterator over the binary’s LazyLoadDylibInfo libraries property libraries → lief.MachO.Binary.it_libraries Return an iterator over the binary’s DylibCommand linker_opt_hint property linker_opt_hint → lief.MachO.LinkerOptHint | None Return the binary’s LinkerOptHint if any, or None main_command property main_command → lief.MachO.MainCommand | None Return the binary’s MainCommand if any, or None notes property notes → lief.MachO.Binary.it_notes Iterator over the different LC_NOTE commands objc_metadata property objc_metadata → lief.objc.Metadata | None Return Objective-C metadata info if present Warning This is only available with the extended version of LIEF. off_ranges property off_ranges → lief.MachO.Binary.range_t Return the range of offsets as a tuple (off_start, off_end) overlay property overlay → memoryview platform property platform → lief.MachO.BuildVersion.PLATFORMS Return the platform for which this Mach-O has been compiled range_t class range_t Bases: object end property end → int start property start → int relocations property relocations → lief.MachO.Binary.it_relocations Return an iterator over binary’s Relocation removeremoveremove remove( self , load_command: lief._lief.MachO.LoadCommand ) → bool **remove( self , type: lief._lief.MachO.LoadCommand.TYPE ) → bool remove( self , symbol: lief._lief.MachO.Symbol ) → bool ** Overloaded function. remove(self, load_command: lief._lief.MachO.LoadCommand) -> bool Remove a LoadCommand remove(self, type: lief._lief.MachO.LoadCommand.TYPE) -> bool Remove all the LoadCommand with the given TYPE remove(self, symbol: lief._lief.MachO.Symbol) -> bool Remove the given Symbol remove_command remove_command( self , index: int ) → bool Remove the LoadCommand at the given index remove_sectionremove_section remove_section( self , name: str , clear: bool = False ) → None remove_section( self , segname: str , secname: str , clear: bool = False ) → None Overloaded function. remove_section(self, name: str, clear: bool = False) -> None Remove the section with the given name remove_section(self, segname: str, secname: str, clear: bool = False) -> None Remove the section from the segment with the name given in the first parameter and with the section’s name provided in the second parameter. remove_signature remove_signature( self ) → bool Remove the CodeSignature (if any) remove_symbol remove_symbol( self , name: str ) → bool Remove all symbol(s) with the given name routine_command property routine_command → lief.MachO.Routine | None Return the binary’s Routine if any, or None rpath property rpath → lief.MachO.RPathCommand | None Return the binary’s RPathCommand if any, or None rpaths property rpaths → lief.MachO.Binary.it_rpaths Return an iterator over the binary’s RPathCommand section_from_offset section_from_offset( self , arg: int , / ) → lief._lief.MachO.Section | None Return the Section which encompasses the offset section_from_virtual_address section_from_virtual_address( self , arg: int , / ) → lief._lief.MachO.Section | None Return the Section which encompasses the virtual address sections property sections → lief.MachO.Binary.it_sections Return an iterator over the binary’s Section segment_from_offset segment_from_offset( self , arg: int , / ) → lief._lief.MachO.SegmentCommand | None Return the SegmentCommand which encompasses the offset segment_from_virtual_address segment_from_virtual_address( self , arg: int , / ) → lief._lief.MachO.SegmentCommand | None Return the SegmentCommand which encompasses the virtual address segment_split_info property segment_split_info → lief.MachO.SegmentSplitInfo | None Return the binary’s SegmentSplitInfo if any, or None segments property segments → lief.MachO.Binary.it_segments Return an iterator over the binary’s SegmentCommand shift shift( self , value: int ) → lief._lief.ok_t | lief._lief.lief_errors Shift the content located right after the Load commands table. This operation can be used to add a new command shift_linkedit shift_linkedit( self , value: int ) → lief._lief.ok_t | lief._lief.lief_errors Shift the position on the __LINKEDIT data by width source_version property source_version → lief.MachO.SourceVersion | None Return the binary’s SourceVersion if any, or None sub_framework property sub_framework → lief.MachO.SubFramework | None Return the binary’s SubFramework if any, or None subclients property subclients → lief.MachO.Binary.it_sub_clients Return an iterator over the binary’s SubClient support_arm64_ptr_auth property support_arm64_ptr_auth → bool Check if the binary is supporting ARM64 pointer authentication (arm64e) symbol_command property symbol_command → lief.MachO.SymbolCommand | None Return the binary’s SymbolCommand if any, or None symbol_stubs property symbol_stubs → collections.abc.Sequence[ lief.MachO.Stub ] Return an iterator over the symbol stubs. These stubs are involved when calling an imported function and are similar to the ELF’s plt/got mechanism. There are located in sections like: __stubs,__auth_stubs,__symbol_stub,__picsymbolstub4 symbols property symbols → lief.MachO.Binary.it_symbols Return an iterator over the binary’s Symbol thread_command property thread_command → lief.MachO.ThreadCommand | None Return the binary’s ThreadCommand if any, or None tlv_initial_content_range property tlv_initial_content_range → lief.MachO.Binary.range_t Return the TLV initial content range two_level_hints property two_level_hints → lief.MachO.TwoLevelHints | None Return the binary’s TwoLevelHints if any, or None unexportunexport unexport( self , name: str ) → bool unexport( self , symbol: lief._lief.MachO.Symbol ) → bool Remove the symbol from the export table unwind_functions property unwind_functions → list[ lief.Function ] Return list of Function found in the __unwind_info section uuid property uuid → lief.MachO.UUIDCommand | None Return the binary’s UUIDCommand if any, or None va_ranges property va_ranges → lief.MachO.Binary.range_t Return the range of virtual addresses as a tuple (va_start, va_end) version_min property version_min → lief.MachO.VersionMin | None Return the binary’s VersionMin if any, or None virtual_address_to_offset virtual_address_to_offset( self , virtual_address: int ) → int | lief._lief.lief_errors Convert the virtual address to an offset in the binary virtual_size property virtual_size → int Binary’s memory size when mapped writewrite write( self , output: str | os.PathLike ) → None write( self , output: str | os.PathLike , config: lief._lief.MachO.Builder.config_t ) → None Overloaded function. write(self, output: Union[str | os.PathLike]) -> None Rebuild the binary and write its content in the file given in the first parameter write(self, output: Union[str | os.PathLike], config: lief._lief.MachO.Builder.config_t) -> None Rebuild the binary and write its content in the file given in the first parameter. The config parameter can be used to tweak the building process. write_to_byteswrite_to_bytes write_to_bytes( self , config: lief._lief.MachO.Builder.config_t ) → bytes write_to_bytes( self ) → bytes Header lief.MachO.Header class lief.MachO.Header( self ) Bases: Object Class that represents the Mach-O header CPU_TYPE class CPU_TYPE( *values ) Bases: Enum AIR64 AIR64 = 16777239 ALPHA ALPHA = 16 AMD_GPU AMD_GPU = 16777236 ANY ANY = -1 APPLE_GPU APPLE_GPU = 16777235 ARM ARM = 12 ARM64 ARM64 = 16777228 HPPA HPPA = 11 I860 I860 = 15 INTEL_GPU INTEL_GPU = 16777237 MC88000 MC88000 = 13 MC98000 MC98000 = 10 MIPS MIPS = 8 POWERPC POWERPC = 18 POWERPC64 POWERPC64 = 16777234 SPARC SPARC = 14 X86 X86 = 7 X86_64 X86_64 = 16777223 from_value from_value( arg: int ) → lief.MachO.Header.CPU_TYPE = FILE_TYPE class FILE_TYPE( *values ) Bases: Enum BUNDLE BUNDLE = 8 CORE CORE = 4 DSYM DSYM = 10 DYLIB DYLIB = 6 DYLIB_STUB DYLIB_STUB = 9 DYLINKER DYLINKER = 7 EXECUTE EXECUTE = 2 FILESET FILESET = 12 FVMLIB FVMLIB = 3 GPU_DYLIB GPU_DYLIB = 14 GPU_EXECUTE GPU_EXECUTE = 13 KEXT_BUNDLE KEXT_BUNDLE = 11 OBJECT OBJECT = 1 PRELOAD PRELOAD = 5 UNKNOWN UNKNOWN = 0 from_value from_value( arg: int ) → lief.MachO.Header.FILE_TYPE = FLAGS class FLAGS( *values ) Bases: Flag ALLMODSBOUND ALLMODSBOUND = 4096 ALLOW_STACK_EXECUTION ALLOW_STACK_EXECUTION = 131072 APP_EXTENSION_SAFE APP_EXTENSION_SAFE = 33554432 BINDATLOAD BINDATLOAD = 8 BINDS_TO_WEAK BINDS_TO_WEAK = 65536 CANONICAL CANONICAL = 16384 DEAD_STRIPPABLE_DYLIB DEAD_STRIPPABLE_DYLIB = 4194304 DYLDLINK DYLDLINK = 4 DYLIB_IN_CACHE DYLIB_IN_CACHE = 2147483648 FORCE_FLAT FORCE_FLAT = 256 HAS_TLV_DESCRIPTORS HAS_TLV_DESCRIPTORS = 8388608 IMPLICIT_PAGEZERO IMPLICIT_PAGEZERO = 268435456 INCRLINK INCRLINK = 2 LAZY_INIT LAZY_INIT = 64 NLIST_OUTOFSYNC_WITH_DYLDINFO NLIST_OUTOFSYNC_WITH_DYLDINFO = 67108864 NOFIXPREBINDING NOFIXPREBINDING = 1024 NOMULTIDEFS NOMULTIDEFS = 512 NOUNDEFS NOUNDEFS = 1 NO_HEAP_EXECUTION NO_HEAP_EXECUTION = 16777216 NO_REEXPORTED_DYLIBS NO_REEXPORTED_DYLIBS = 1048576 PIE PIE = 2097152 PREBINDABLE PREBINDABLE = 2048 PREBOUND PREBOUND = 16 ROOT_SAFE ROOT_SAFE = 262144 SETUID_SAFE SETUID_SAFE = 524288 SIM_SUPPORT SIM_SUPPORT = 134217728 SPLIT_SEGS SPLIT_SEGS = 32 SUBSECTIONS_VIA_SYMBOLS SUBSECTIONS_VIA_SYMBOLS = 8192 TWOLEVEL TWOLEVEL = 128 WEAK_DEFINES WEAK_DEFINES = 32768 from_value from_value( arg: int ) → lief.MachO.Header.FLAGS = add add( self , flag: lief._lief.MachO.Header.FLAGS ) → None Add the given FLAGS cpu_subtype property cpu_subtype → int Return the CPU subtype supported by the Mach-O binary. For ARM architectures, this value could represent the minimum version for which the Mach-O binary has been compiled for. cpu_type property cpu_type → lief.MachO.Header.CPU_TYPE Target CPU file_type property file_type → lief.MachO.Header.FILE_TYPE Binary’s type flags property flags → int Binary’s flags flags_list property flags_list → list[ lief.MachO.Header.FLAGS ] FLAGS as a list has has( self , flag: lief._lief.MachO.Header.FLAGS ) → bool True if the given FLAGS is in the flags is_32bit property is_32bit → bool True if the binary is 32-bits is_64bit property is_64bit → bool True if the binary is 64-bits magic property magic → lief.MachO.MACHO_TYPES The Mach-O magic bytes. These bytes determine whether it is a 32 bits Mach-O, a 64 bits Mach-O files etc. nb_cmds property nb_cmds → int Number of LoadCommand remove remove( self , flag: lief._lief.MachO.Header.FLAGS ) → None Remove the given FLAGS reserved property reserved → int According to the official documentation, a reserved value sizeof_cmds property sizeof_cmds → int Size of all LoadCommand Section lief.MachO.Section class lief.MachO.Section Bases: Section Class that represents a Mach-O section FLAGS class FLAGS( *values ) Bases: Flag DEBUG_INFO DEBUG_INFO = 33554432 EXT_RELOC EXT_RELOC = 512 LIVE_SUPPORT LIVE_SUPPORT = 134217728 LOC_RELOC LOC_RELOC = 256 NO_DEAD_STRIP NO_DEAD_STRIP = 268435456 NO_TOC NO_TOC = 1073741824 PURE_INSTRUCTIONS PURE_INSTRUCTIONS = 2147483648 SELF_MODIFYING_CODE SELF_MODIFYING_CODE = 67108864 SOME_INSTRUCTIONS SOME_INSTRUCTIONS = 1024 STRIP_STATIC_SYMS STRIP_STATIC_SYMS = 536870912 from_value from_value( arg: int ) → lief.MachO.Section.FLAGS = TYPE class TYPE( *values ) Bases: Enum COALESCED COALESCED = 11 CSTRING_LITERALS CSTRING_LITERALS = 2 DTRACE_DOF DTRACE_DOF = 15 GB_ZEROFILL GB_ZEROFILL = 12 INIT_FUNC_OFFSETS INIT_FUNC_OFFSETS = 22 INTERPOSING INTERPOSING = 13 IS_16BYTE_LITERALS IS_16BYTE_LITERALS = 14 IS_4BYTE_LITERALS IS_4BYTE_LITERALS = 3 IS_8BYTE_LITERALS IS_8BYTE_LITERALS = 4 LAZY_DYLIB_SYMBOL_POINTERS LAZY_DYLIB_SYMBOL_POINTERS = 16 LAZY_SYMBOL_POINTERS LAZY_SYMBOL_POINTERS = 7 LITERAL_POINTERS LITERAL_POINTERS = 5 MOD_INIT_FUNC_POINTERS MOD_INIT_FUNC_POINTERS = 9 MOD_TERM_FUNC_POINTERS MOD_TERM_FUNC_POINTERS = 10 NON_LAZY_SYMBOL_POINTERS NON_LAZY_SYMBOL_POINTERS = 6 REGULAR REGULAR = 0 SYMBOL_STUBS SYMBOL_STUBS = 8 THREAD_LOCAL_INIT_FUNCTION_POINTERS THREAD_LOCAL_INIT_FUNCTION_POINTERS = 21 THREAD_LOCAL_REGULAR THREAD_LOCAL_REGULAR = 17 THREAD_LOCAL_VARIABLES THREAD_LOCAL_VARIABLES = 19 THREAD_LOCAL_VARIABLE_POINTERS THREAD_LOCAL_VARIABLE_POINTERS = 20 THREAD_LOCAL_ZEROFILL THREAD_LOCAL_ZEROFILL = 18 ZEROFILL ZEROFILL = 1 from_value from_value( arg: int ) → lief.MachO.Section.TYPE = add add( self , flag: lief._lief.MachO.Section.FLAGS ) → None Add the given SECTION_FLAGS alignment property alignment → int Section’s alignment as a power of 2 create create( *args ) → lief.MachO.Section | None = flags property flags → lief.MachO.Section.FLAGS Section’s flags masked with SECTION_FLAGS_MASK (see: FLAGS ) flags_list property flags_list → list[ lief.MachO.Section.FLAGS ] has has( self , flag: lief._lief.MachO.Section.FLAGS ) → bool Check if the section has the given SECTION_FLAGS has_segment property has_segment → bool True if the current section has a segment associated with numberof_relocations property numberof_relocations → int Number of relocations associated with this section relocation_offset property relocation_offset → int Offset of the relocation table. This value should be 0 for executable and libraries as the relocations are managed by the lief.MachO.DyldInfo.rebase On the other hand, for object files ( .o ) this value should not be 0 relocations property relocations → lief.MachO.SegmentCommand.it_relocations Iterator over the Relocation (if any) remove remove( self , flag: lief._lief.MachO.Section.FLAGS ) → None Remove the given SECTION_FLAGS reserved1 property reserved1 → int According to the official loader.h file, this value is reserved for offset or index reserved2 property reserved2 → int According to the official loader.h file, this value is reserved for offset or index reserved3 property reserved3 → int According to the official loader.h file, this value is reserved for offset or index segment property segment → lief.MachO.SegmentCommand | None SegmentCommand associated with the section or None if not present segment_name property segment_name → str The segment name associated with the section type property type → lief.MachO.Section.TYPE Type of the section. This value can help to determine the purpose of the section (c.f. TYPE ) ThreadLocalVariables lief.MachO.ThreadLocalVariables class lief.MachO.ThreadLocalVariables Bases: Section This class represents a MachO section whose type is THREAD_LOCAL_VARIABLES . It contains an array of thread-local variable descriptors ( Thunk ) used by dyld to lazily initialize thread-local storage on first access. ThunkThunk class Thunk( self ) class Thunk( self , func: int , key: int , offset: int ) Bases: object Descriptor for a single thread-local variable. The layout mirrors the tlv_descriptor structure from . func property func → int Address of the initializer function ( tlv_thunk ) key property key → int pthread_key_t key used by the runtime offset property offset → int Offset of the variable in the TLS block get get( self , idx: int ) → lief._lief.MachO.ThreadLocalVariables.Thunk | None Return the Thunk at the given index, or None if the index is out of range. nb_thunks property nb_thunks → int Number of Thunk descriptors set set( self , idx: int , thunk: lief._lief.MachO.ThreadLocalVariables.Thunk ) → None Change the Thunk at the given index. thunks property thunks → collections.abc.Sequence[ lief.MachO.ThreadLocalVariables.Thunk ] Return an iterator over the Thunk descriptors stored in this section. SegmentCommand lief.MachO.SegmentCommandlief.MachO.SegmentCommandlief.MachO.SegmentCommand class lief.MachO.SegmentCommand( self ) **class lief.MachO.SegmentCommand( self , arg: str , / ) class lief.MachO.SegmentCommand( self , arg0: str , arg1: collections.abc.Sequence[int] , / ) ** Bases: LoadCommand Class which represents a SEGMENT / SEGMENT_64 command FLAGS class FLAGS( *values ) Bases: Enum FVMLIB FVMLIB = 2 HIGHVM HIGHVM = 1 NORELOC NORELOC = 4 PROTECTED_VERSION_1 PROTECTED_VERSION_1 = 8 READ_ONLY READ_ONLY = 16 from_value from_value( arg: int ) → lief.MachO.SegmentCommand.FLAGS = VM_PROTECTIONS class VM_PROTECTIONS( *values ) Bases: Enum R R = 1 W W = 2 X X = 4 from_value from_value( arg: int ) → lief.MachO.SegmentCommand.VM_PROTECTIONS = add_section add_section( self , section: lief._lief.MachO.Section ) → lief._lief.MachO.Section content property content → memoryview Segment’s content file_offset property file_offset → int Segment’s file offset file_size property file_size → int Segment’s file size flags property flags → int Segment’s flags get_section get_section( self , name: str ) → lief._lief.MachO.Section | None Get the Section with the given name has has( self , section: lief._lief.MachO.Section ) → bool Check if the given Section belongs to the current segment has_section has_section( self , section_name: str ) → bool Check if the given section name belongs to the current segment index property index → int Relative index of the segment in the segment table init_protection property init_protection → int Segment’s initial protection max_protection property max_protection → int Segment’s max protection name property name → str | bytes Segment’s name numberof_sections property numberof_sections → int Number of sections in this segment relocations property relocations → lief.MachO.SegmentCommand.it_relocations Segment’s relocations sections property sections → lief.MachO.SegmentCommand.it_sections Segment’s sections virtual_address property virtual_address → int Segment’s virtual address virtual_size property virtual_size → int Segment’s virtual size LoadCommand lief.MachO.LoadCommand class lief.MachO.LoadCommand( self ) Bases: Object Base class for the Mach-O load commands TYPE class TYPE( *values ) Bases: Enum ATOM_INFO ATOM_INFO = 54 BUILD_VERSION BUILD_VERSION = 50 CODE_SIGNATURE CODE_SIGNATURE = 29 DATA_IN_CODE DATA_IN_CODE = 41 DYLD_CHAINED_FIXUPS DYLD_CHAINED_FIXUPS = 2147483700 DYLD_ENVIRONMENT DYLD_ENVIRONMENT = 39 DYLD_EXPORTS_TRIE DYLD_EXPORTS_TRIE = 2147483699 DYLD_INFO DYLD_INFO = 34 DYLD_INFO_ONLY DYLD_INFO_ONLY = 2147483682 DYLIB_CODE_SIGN_DRS DYLIB_CODE_SIGN_DRS = 43 DYSYMTAB DYSYMTAB = 11 ENCRYPTION_INFO ENCRYPTION_INFO = 33 ENCRYPTION_INFO_64 ENCRYPTION_INFO_64 = 44 FILESET_ENTRY FILESET_ENTRY = 2147483701 FUNCTION_STARTS FUNCTION_STARTS = 38 FUNCTION_VARIANTS FUNCTION_VARIANTS = 55 FUNCTION_VARIANT_FIXUPS FUNCTION_VARIANT_FIXUPS = 56 FVMFILE FVMFILE = 9 IDENT IDENT = 8 IDFVMLIB IDFVMLIB = 7 ID_DYLIB ID_DYLIB = 13 ID_DYLINKER ID_DYLINKER = 15 LAZY_LOAD_DYLIB LAZY_LOAD_DYLIB = 32 LAZY_LOAD_DYLIB_INFO LAZY_LOAD_DYLIB_INFO = 58 LIEF_UNKNOWN LIEF_UNKNOWN = 4293787649 LINKER_OPTIMIZATION_HINT LINKER_OPTIMIZATION_HINT = 46 LINKER_OPTION LINKER_OPTION = 45 LOADFVMLIB LOADFVMLIB = 6 LOAD_DYLIB LOAD_DYLIB = 12 LOAD_DYLINKER LOAD_DYLINKER = 14 LOAD_UPWARD_DYLIB LOAD_UPWARD_DYLIB = 2147483683 LOAD_WEAK_DYLIB LOAD_WEAK_DYLIB = 2147483672 MAIN MAIN = 2147483688 NOTE NOTE = 49 PREBIND_CKSUM PREBIND_CKSUM = 23 PREBOUND_DYLIB PREBOUND_DYLIB = 16 PREPAGE PREPAGE = 10 REEXPORT_DYLIB REEXPORT_DYLIB = 2147483679 ROUTINES ROUTINES = 17 ROUTINES_64 ROUTINES_64 = 26 RPATH RPATH = 2147483676 SEGMENT SEGMENT = 1 SEGMENT_64 SEGMENT_64 = 25 SEGMENT_SPLIT_INFO SEGMENT_SPLIT_INFO = 30 SOURCE_VERSION SOURCE_VERSION = 42 SUB_CLIENT SUB_CLIENT = 20 SUB_FRAMEWORK SUB_FRAMEWORK = 18 SUB_LIBRARY SUB_LIBRARY = 21 SUB_UMBRELLA SUB_UMBRELLA = 19 SYMSEG SYMSEG = 3 SYMTAB SYMTAB = 2 TARGET_TRIPLE TARGET_TRIPLE = 57 THREAD THREAD = 4 TWOLEVEL_HINTS TWOLEVEL_HINTS = 22 UNIXTHREAD UNIXTHREAD = 5 UNKNOWN UNKNOWN = 0 UUID UUID = 27 VERSION_MIN_IPHONEOS VERSION_MIN_IPHONEOS = 37 VERSION_MIN_MACOSX VERSION_MIN_MACOSX = 36 VERSION_MIN_TVOS VERSION_MIN_TVOS = 47 VERSION_MIN_WATCHOS VERSION_MIN_WATCHOS = 48 from_value from_value( arg: int ) → lief.MachO.LoadCommand.TYPE = command property command → lief.MachO.LoadCommand.TYPE Command type command_offset property command_offset → int Offset of the command within the Load Command Table data property data → memoryview Command’s data size property size → int Size of the command (should be greater than sizeof(load_command) ) DylibCommand lief.MachO.DylibCommand class lief.MachO.DylibCommand Bases: LoadCommand Class which represents a library dependency compatibility_version property compatibility_version → list[int] Library’s compatibility version current_version property current_version → list[int] Library’s current version id_dylib id_dylib( name: str , timestamp: int , current_version: int , compat_version: int ) → lief.MachO.DylibCommand = lazy_load_dylib lazy_load_dylib( name: str , timestamp: int , current_version: int , compat_version: int ) → lief.MachO.DylibCommand = load_dylib load_dylib( name: str , timestamp: int , current_version: int , compat_version: int ) → lief.MachO.DylibCommand = load_upward_dylib load_upward_dylib( name: str , timestamp: int , current_version: int , compat_version: int ) → lief.MachO.DylibCommand = name property name → str Library’s name name_offset property name_offset → int Original string offset of the name reexport_dylib reexport_dylib( name: str , timestamp: int , current_version: int , compat_version: int ) → lief.MachO.DylibCommand = timestamp property timestamp → int Library’s timestamp weak_lib weak_lib( name: str , timestamp: int , current_version: int , compat_version: int ) → lief.MachO.DylibCommand = DylinkerCommand lief.MachO.DylinkerCommand class lief.MachO.DylinkerCommand( self , arg: str , / ) Bases: LoadCommand Class that represents the Mach-O linker, also named loader Most of the time, name returns /usr/lib/dyld name property name → str Path to the loader/linker UUIDCommand lief.MachO.UUIDCommand class lief.MachO.UUIDCommand Bases: LoadCommand Class that represents the UUID command uuid property uuid → list[int] UUID as a list MainCommand lief.MachO.MainCommand class lief.MachO.MainCommand( self , arg0: int , arg1: int , / ) Bases: LoadCommand Class that represents the LC_MAIN command. This kind of command can be used to determine the entrypoint of an executable entrypoint property entrypoint → int Offset of the main function relative to the __TEXT segment stack_size property stack_size → int The initial stack size (if not 0) NoteCommand lief.MachO.NoteCommand class lief.MachO.NoteCommand Bases: LoadCommand Class that represent the LC_NOTE command. This command is used to include arbitrary notes or metadata within a binary. note_offset property note_offset → int Offset of the data associated with this note note_size property note_size → int Size of the data referenced by the note_offset owner property owner → memoryview Owner of the note (e.g. AIR_METALLIB ) owner_str property owner_str → str Owner as a zero-terminated string Symbol lief.MachO.Symbol class lief.MachO.Symbol( self ) Bases: Symbol Class that represents a Symbol in a Mach-O file. A Mach-O symbol can come from: The symbols command (LC_SYMTAB / SymbolCommand) The Dyld Export trie The Dyld Symbol bindings CATEGORY class CATEGORY( *values ) Bases: Enum EXTERNAL EXTERNAL = 2 INDIRECT_ABS INDIRECT_ABS = 4 INDIRECT_ABS_LOCAL INDIRECT_ABS_LOCAL = 6 INDIRECT_LOCAL INDIRECT_LOCAL = 5 LOCAL LOCAL = 1 NONE NONE = 0 UNDEFINED UNDEFINED = 3 from_value from_value( arg: int ) → lief.MachO.Symbol.CATEGORY = ORIGIN class ORIGIN( *values ) Bases: Enum DYLD_BIND DYLD_BIND = 2 DYLD_EXPORT DYLD_EXPORT = 1 SYMTAB SYMTAB = 3 UNKNOWN UNKNOWN = 0 from_value from_value( arg: int ) → lief.MachO.Symbol.ORIGIN = TYPE class TYPE( *values ) Bases: Enum ABSOLUTE_SYM ABSOLUTE_SYM = 2 INDIRECT INDIRECT = 10 PREBOUND PREBOUND = 12 SECTION SECTION = 14 UNDEFINED UNDEFINED = 0 from_value from_value( arg: int ) → lief.MachO.Symbol.TYPE = binding_info property binding_info → lief.MachO.BindingInfo | None BindingInfo associated with the symbol if any, or None category property category → lief.MachO.Symbol.CATEGORY Category of the symbol according to the LC_DYSYMTAB command demangled_name property demangled_name → str Symbol’s unmangled name description property description → int Return information about the symbol export_info property export_info → lief.MachO.ExportInfo | None ExportInfo associated with the symbol if any, or None has_binding_info property has_binding_info → bool True if the symbol has an BindingInfo associated with has_export_info property has_export_info → bool True if the symbol has an ExportInfo associated with is_external property is_external → bool True if the symbol is defined as an external symbol. library property library → lief.MachO.DylibCommand | None DylibCommand the library where the symbol is exposed library_ordinal property library_ordinal → int Library ordinal + 1 (0 means self) numberof_sections property numberof_sections → int It returns the number of sections in which this symbol can be found. If the symbol can’t be found in any section, it returns 0 (NO_SECT) origin property origin → lief.MachO.Symbol.ORIGIN Return the ORIGIN of this symbol raw_type property raw_type → int Raw value of nlist_xx.n_type type property type → lief.MachO.Symbol.TYPE Type as defined by nlist_xx.n_type & N_TYPE Symbol Command lief.MachO.SymbolCommand class lief.MachO.SymbolCommand( self ) Bases: LoadCommand Class that represents the LC_SYMTAB command numberof_symbols property numberof_symbols → int Number of symbols registered strings_offset property strings_offset → int Offset from the start of the file to the string table strings_size property strings_size → int Size of the string table symbol_offset property symbol_offset → int Offset from the start of the file to the n_list associated with the command Dynamic Symbol Command lief.MachO.DynamicSymbolCommand class lief.MachO.DynamicSymbolCommand Bases: LoadCommand Class that represents the LC_DYSYMTAB command. This command completes the LC_SYMTAB (SymbolCommand) to provide a better granularity over the symbols layout. external_reference_symbol_offset property external_reference_symbol_offset → int Byte offset from the start of the file to the external reference table data. This field seems unused by recent Mach-O loader and should be set to 0 external_relocation_offset property external_relocation_offset → int Byte offset from the start of the file to the module table data. This field seems unused by recent Mach-O loader and should be set to 0 idx_external_define_symbol property idx_external_define_symbol → int Index of the first symbol in the group of defined external symbols. idx_local_symbol property idx_local_symbol → int Index of the first symbol in the group of local symbols. idx_undefined_symbol property idx_undefined_symbol → int Index of the first symbol in the group of undefined external symbols. indirect_symbol_offset property indirect_symbol_offset → int Byte offset from the start of the file to the indirect symbol table data. Indirect symbol table is used by the loader to speed-up symbol resolution during the lazy binding process References: dyld-519.2.1/src/ImageLoaderMachOCompressed.cpp dyld-519.2.1/src/ImageLoaderMachOClassic.cpp indirect_symbols property indirect_symbols → lief.MachO.DynamicSymbolCommand.it_indirect_symbols Iterator over the indirect symbols indexed by this command local_relocation_offset property local_relocation_offset → int Byte offset from the start of the file to the local relocation table data. This field seems unused by recent Mach-O loader and should be set to 0 module_table_offset property module_table_offset → int Byte offset from the start of the file to the module table data. This field seems unused by recent Mach-O loader and should be set to 0 nb_external_define_symbols property nb_external_define_symbols → int Number of symbols in the group of defined external symbols. nb_external_reference_symbols property nb_external_reference_symbols → int Number of entries in the external reference table. This field seems unused by recent Mach-O loader and should be set to 0. nb_external_relocations property nb_external_relocations → int Number of entries in the external relocation table. This field seems unused by recent Mach-O loader and should be set to 0 nb_indirect_symbols property nb_indirect_symbols → int Number of entries in the indirect symbol table. nb_local_relocations property nb_local_relocations → int Number of entries in the local relocation table. This field seems unused by recent Mach-O loader and should be set to 0 nb_local_symbols property nb_local_symbols → int Number of symbols in the group of local symbols. nb_module_table property nb_module_table → int Number of entries in the module table. This field seems unused by recent Mach-O loader and should be set to 0. nb_toc property nb_toc → int Number of entries in the table of contents Should be set to 0 on recent Mach-O nb_undefined_symbols property nb_undefined_symbols → int Number of symbols in the group of undefined external symbols. toc_offset property toc_offset → int Byte offset from the start of the file to the table of contents data. Table of content is used by legacy Mach-O loader and this field should be set to 0 Dyld Info lief.MachO.DyldInfo class lief.MachO.DyldInfo Bases: LoadCommand Class that represents the LC_DYLD_INFO and LC_DYLD_INFO_ONLY commands BIND_OPCODES class BIND_OPCODES( *values ) Bases: Enum ADD_ADDR_ULEB ADD_ADDR_ULEB = 128 DONE DONE = 0 DO_BIND DO_BIND = 144 DO_BIND_ADD_ADDR_IMM_SCALED DO_BIND_ADD_ADDR_IMM_SCALED = 176 DO_BIND_ADD_ADDR_ULEB DO_BIND_ADD_ADDR_ULEB = 160 DO_BIND_ULEB_TIMES_SKIPPING_ULEB DO_BIND_ULEB_TIMES_SKIPPING_ULEB = 192 SET_ADDEND_SLEB SET_ADDEND_SLEB = 96 SET_DYLIB_ORDINAL_IMM SET_DYLIB_ORDINAL_IMM = 16 SET_DYLIB_ORDINAL_ULEB SET_DYLIB_ORDINAL_ULEB = 32 SET_DYLIB_SPECIAL_IMM SET_DYLIB_SPECIAL_IMM = 48 SET_SEGMENT_AND_OFFSET_ULEB SET_SEGMENT_AND_OFFSET_ULEB = 112 SET_SYMBOL_TRAILING_FLAGS_IMM SET_SYMBOL_TRAILING_FLAGS_IMM = 64 SET_TYPE_IMM SET_TYPE_IMM = 80 THREADED THREADED = 208 THREADED_APPLY THREADED_APPLY = 209 from_value from_value( arg: int ) → lief.MachO.DyldInfo.BIND_OPCODES = REBASE_OPCODES class REBASE_OPCODES( *values ) Bases: Enum ADD_ADDR_IMM_SCALED ADD_ADDR_IMM_SCALED = 64 ADD_ADDR_ULEB ADD_ADDR_ULEB = 48 DONE DONE = 0 DO_REBASE_ADD_ADDR_ULEB DO_REBASE_ADD_ADDR_ULEB = 112 DO_REBASE_IMM_TIMES DO_REBASE_IMM_TIMES = 80 DO_REBASE_ULEB_TIMES DO_REBASE_ULEB_TIMES = 96 DO_REBASE_ULEB_TIMES_SKIPPING_ULEB DO_REBASE_ULEB_TIMES_SKIPPING_ULEB = 128 SET_SEGMENT_AND_OFFSET_ULEB SET_SEGMENT_AND_OFFSET_ULEB = 32 SET_TYPE_IMM SET_TYPE_IMM = 16 from_value from_value( arg: int ) → lief.MachO.DyldInfo.REBASE_OPCODES = REBASE_TYPE class REBASE_TYPE( *values ) Bases: Enum POINTER POINTER = 1 TEXT_ABSOLUTE32 TEXT_ABSOLUTE32 = 2 TEXT_PCREL32 TEXT_PCREL32 = 3 THREADED THREADED = 102 from_value from_value( arg: int ) → lief.MachO.DyldInfo.REBASE_TYPE = bind property bind → tuple[int, int] Bind information as a tuple (offset, size) Dyld binds an image during the loading process, if the image requires any pointers to be initialized to symbols in other images. The rebase information is a stream of byte sized opcodes for which symbolic names start with BIND_OPCODE_ . Conceptually the bind information is a table of tuples: (seg-index, seg-offset, type, symbol-library-ordinal, symbol-name, addend) The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like for runs of pointers initialized to the same value can be encoded in a few bytes. See also /usr/include/mach-o/loader.h bind_opcodes property bind_opcodes → memoryview Return the binding’s opcodes as list of bytes bindings property bindings → lief.MachO.DyldInfo.it_binding_info Return an iterator over Dyld’s BindingInfo export_info property export_info → tuple[int, int] Export information as a tuple (offset, size) The symbols exported by a dylib are encoded in a trie. This is a compact representation that factors out common prefixes. It also reduces LINKEDIT pages in RAM because it encodes all information (name, address, flags) in one small, contiguous range. The export area is a stream of nodes. The first node sequentially is the start node for the trie. Nodes for a symbol start with a byte that is the length of the exported symbol information for the string so far. If there is no exported symbol, the byte is zero. If there is exported info, it follows the length byte. The exported info normally consists of a flags and offset both encoded in uleb128 . The offset is location of the content named by the symbol. It is the offset from the mach_header for the image. After the initial byte and optional exported symbol information is a byte of how many edges (0-255) that this node has leaving it, followed by each edge. Each edge is a zero terminated cstring of the addition chars in the symbol, followed by a uleb128 offset for the node that edge points to. See also /usr/include/mach-o/loader.h export_trie property export_trie → memoryview Return Export’s trie as list of bytes exports property exports → lief.MachO.DyldExportsTrie.it_export_info Return an iterator over Dyld’s ExportInfo lazy_bind property lazy_bind → tuple[int, int] Lazy Bind information as a tuple (offset, size) Some uses of external symbols do not need to be bound immediately. Instead they can be lazily bound on first use. The lazy_bind contains a stream of BIND opcodes to bind all lazy symbols. Normal use is that dyld ignores the lazy_bind section when loading an image. Instead the static linker arranged for the lazy pointer to initially point to a helper function which pushes the offset into the lazy_bind area for the symbol needing to be bound, then jumps to dyld which simply adds the offset to lazy_bind_off to get the information on what to bind. See also /usr/include/mach-o/loader.h lazy_bind_opcodes property lazy_bind_opcodes → memoryview Return lazy binding’s opcodes as list of bytes rebase property rebase → tuple[int, int] Rebase information as a tuple (offset, size) Dyld rebases an image whenever dyld loads it at an address different from its preferred address. The rebase information is a stream of byte sized opcodes for which symbolic names start with REBASE_OPCODE_ . Conceptually the rebase information is a table of tuples: (seg-index, seg-offset, type) The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like “every n’th offset for m times” can be encoded in a few bytes See also /usr/include/mach-o/loader.h rebase_opcodes property rebase_opcodes → memoryview Return the rebase’s opcodes as list of bytes set_bind_offset set_bind_offset( self , offset: int ) → None set_bind_size set_bind_size( self , size: int ) → None set_export_offset set_export_offset( self , offset: int ) → None set_export_size set_export_size( self , size: int ) → None set_lazy_bind_offset set_lazy_bind_offset( self , offset: int ) → None set_lazy_bind_size set_lazy_bind_size( self , size: int ) → None set_rebase_offset set_rebase_offset( self , offset: int ) → None set_rebase_size set_rebase_size( self , size: int ) → None set_weak_bind_offset set_weak_bind_offset( self , offset: int ) → None set_weak_bind_size set_weak_bind_size( self , size: int ) → None show_bind_opcodes property show_bind_opcodes → str Return the bind opcodes in a human-readable way show_export_trie property show_export_trie → str Return the export trie in a human-readable way show_lazy_bind_opcodes property show_lazy_bind_opcodes → str Return the lazy bind opcodes in a human-readable way show_rebases_opcodes property show_rebases_opcodes → str Return the rebase opcodes in a human-readable way show_weak_bind_opcodes property show_weak_bind_opcodes → str Return the weak bind opcodes in a human-readable way weak_bind property weak_bind → tuple[int, int] Weak Bind information as a tuple (offset, size) Some C++ programs require dyld to unique symbols so that all images in the process use the same copy of some code/data. This step is done after binding. The content of the weak_bind info is an opcode stream like the bind_info. But it is sorted alphabetically by symbol name. This enables dyld to walk all images with weak binding information in order and look for collisions. If there are no collisions, dyld does no updating. That means that some fixups are also encoded in the bind_info. For instance, all calls to operator new are first bound to libstdc++.dylib using the information in bind_info. Then if some image overrides operator new that is detected when the weak_bind information is processed and the call to operator new is then rebound. See also /usr/include/mach-o/loader.h weak_bind_opcodes property weak_bind_opcodes → memoryview Return Weak binding’s opcodes as list of bytes Function starts lief.MachO.FunctionStarts class lief.MachO.FunctionStarts Bases: LoadCommand Class which represents the LC_FUNCTION_STARTS command This command is an array of ULEB128 encoded values add_function add_function( self , address: int ) → None Add a new function content property content → memoryview The original content as a bytes stream data_offset property data_offset → int Offset in the binary where start functions are located data_size property data_size → int Size of the functions list in the binary functions property functions → list[int] Addresses of every function entry point in the executable This allows functions to exist for which there are no entries in the symbol table. Warning The address is relative to the __TEXT segment Function Variants lief.MachO.FunctionVariants class lief.MachO.FunctionVariants Bases: LoadCommand Class representing the LC_FUNCTION_VARIANTS load command. Introduced publicly in dyld-1284.13 (April 2025), this command supports function multiversioning , the ability to associate multiple implementations of the same function, each optimized for a specific platform, architecture, or runtime context. At runtime, the system dispatches the most appropriate variant based on hardware capabilities or execution environment. For example: FUNCTION_VARIANT_TABLE(my_function, { (void*)my_function$Rosetta, \"rosetta\" }, // Rosetta translation { (void*)my_function$Haswell, \"haswell\" }, // Haswell-optimized { (void*)my_function$Base, \"default\" } // Default fallback ); RuntimeTable class RuntimeTable Bases: object Represents a runtime table of function variants sharing a common namespace (referred to internally as FunctionVariantsRuntimeTable in dyld ). Each table holds multiple RuntimeTableEntry instances that map to function implementations optimized for a given KIND . KIND class KIND( *values ) Bases: Enum Enumeration describing the namespace or category of a function variant. Each RuntimeTable is associated with one KIND , which indicates the domain or context under which its variant entries should be considered valid or applicable. These categories map to the runtime dispatch logic used by dyld when selecting the optimal function variant. ARM64 ARM64 = 3 PER_PROCESS PER_PROCESS = 1 SYSTEM_WIDE SYSTEM_WIDE = 2 UNKNOWN UNKNOWN = 0 X86_64 X86_64 = 4 entries property entries → lief.MachO.FunctionVariants.RuntimeTable.it_entries Iterator over the different RuntimeTableEntry entries kind property kind → lief.MachO.FunctionVariants.RuntimeTable.KIND Kind of the runtime table offset property offset → int Original offset in the payload RuntimeTableEntry class RuntimeTableEntry Bases: object This class exposes information about a given implementation. FLAGS class FLAGS( *values ) Bases: Enum ARM64_ADVSIMD ARM64_ADVSIMD = 3145782 ARM64_ADVSIMDHPFP ARM64_ADVSIMDHPFP = 3145783 ARM64_AES ARM64_AES = 3145739 ARM64_AFP ARM64_AFP = 3145758 ARM64_BF16 ARM64_BF16 = 3145753 ARM64_BTI ARM64_BTI = 3145765 ARM64_CRC32 ARM64_CRC32 = 3145784 ARM64_CSV2 ARM64_CSV2 = 3145760 ARM64_CVS3 ARM64_CVS3 = 3145761 ARM64_DEFAULT ARM64_DEFAULT = 3145728 ARM64_DIT ARM64_DIT = 3145762 ARM64_DOTPROD ARM64_DOTPROD = 3145732 ARM64_DPB ARM64_DPB = 3145751 ARM64_DPB2 ARM64_DPB2 = 3145752 ARM64_ECV ARM64_ECV = 3145757 ARM64_FCMA ARM64_FCMA = 3145746 ARM64_FHM ARM64_FHM = 3145731 ARM64_FLAGM ARM64_FLAGM = 3145729 ARM64_FLAGM2 ARM64_FLAGM2 = 3145730 ARM64_FP16 ARM64_FP16 = 3145763 ARM64_FPAC ARM64_FPAC = 3145750 ARM64_FRINTTS ARM64_FRINTTS = 3145743 ARM64_I8MM ARM64_I8MM = 3145754 ARM64_JSCVT ARM64_JSCVT = 3145747 ARM64_LRCPC ARM64_LRCPC = 3145744 ARM64_LRCPC2 ARM64_LRCPC2 = 3145745 ARM64_LSE ARM64_LSE = 3145735 ARM64_LSE2 ARM64_LSE2 = 3145759 ARM64_PAUTH ARM64_PAUTH = 3145748 ARM64_PAUTH2 ARM64_PAUTH2 = 3145749 ARM64_PMULL ARM64_PMULL = 3145740 ARM64_RDM ARM64_RDM = 3145734 ARM64_RPRES ARM64_RPRES = 3145756 ARM64_SB ARM64_SB = 3145742 ARM64_SHA1 ARM64_SHA1 = 3145738 ARM64_SHA256 ARM64_SHA256 = 3145736 ARM64_SHA3 ARM64_SHA3 = 3145733 ARM64_SHA512 ARM64_SHA512 = 3145737 ARM64_SME ARM64_SME = 3145772 ARM64_SME2 ARM64_SME2 = 3145773 ARM64_SMEB16F32 ARM64_SMEB16F32 = 3145778 ARM64_SMEBI32I32 ARM64_SMEBI32I32 = 3145777 ARM64_SMEF16F32 ARM64_SMEF16F32 = 3145779 ARM64_SMEF32F32 ARM64_SMEF32F32 = 3145776 ARM64_SMEF64F64 ARM64_SMEF64F64 = 3145774 ARM64_SMEI16I32 ARM64_SMEI16I32 = 3145781 ARM64_SMEI16I64 ARM64_SMEI16I64 = 3145775 ARM64_SMEI8I32 ARM64_SMEI8I32 = 3145780 ARM64_SPECRES ARM64_SPECRES = 3145741 ARM64_SSBS ARM64_SSBS = 3145764 ARM64_WFXT ARM64_WFXT = 3145755 PER_PROCESS_DEFAULT PER_PROCESS_DEFAULT = 1048576 PER_PROCESS_MTE_ENABLED PER_PROCESS_MTE_ENABLED = 1048578 PER_PROCESS_NO_OVERREAD PER_PROCESS_NO_OVERREAD = 1048579 PER_PROCESS_TRANSLATED PER_PROCESS_TRANSLATED = 1048577 SYSTEM_WIDE_CUSTOMER_INSTALL SYSTEM_WIDE_CUSTOMER_INSTALL = 2097154 SYSTEM_WIDE_DEFAULT SYSTEM_WIDE_DEFAULT = 2097152 SYSTEM_WIDE_INTERNAL_INSTALL SYSTEM_WIDE_INTERNAL_INSTALL = 2097153 SYSTEM_WIDE_LOCKDOWN SYSTEM_WIDE_LOCKDOWN = 2097155 UNKNOWN UNKNOWN = 0 X86_64_AVX X86_64_AVX = 4194307 X86_64_AVX2 X86_64_AVX2 = 4194308 X86_64_AVX512BW X86_64_AVX512BW = 4194310 X86_64_AVX512F X86_64_AVX512F = 4194309 X86_64_BMI1 X86_64_BMI1 = 4194311 X86_64_DEFAULT X86_64_DEFAULT = 4194304 X86_64_FMA X86_64_FMA = 4194306 X86_64_HASWELL X86_64_HASWELL = 4194313 X86_64_IVYBRIDGE X86_64_IVYBRIDGE = 4194314 X86_64_NEHALEM X86_64_NEHALEM = 4194315 X86_64_ROSETTA X86_64_ROSETTA = 4194312 X86_64_SSE41 X86_64_SSE41 = 4194305 another_table property another_table → bool Indicates whether impl refers to an entry in another runtime table, rather than a direct function implementation address. flag_bit_nums property flag_bit_nums → memoryview The flagBitNums value as a slice of bytes flags property flags → list[ lief.MachO.FunctionVariants.RuntimeTableEntry.FLAGS ] Return the interpreted flag_bit_nums impl property impl → int The relative address of the implementation or an index if another_table is set. content property content → memoryview Payload content data_offset property data_offset → int Offset in the binary where the payload starts data_size property data_size → int Size of the payload runtime_table property runtime_table → lief.MachO.FunctionVariants.it_runtime_table Iterator over the different RuntimeTable entries located in the content of this __LINKEDIT command Function Variant Fixups lief.MachO.FunctionVariantFixups class lief.MachO.FunctionVariantFixups Bases: LoadCommand Class which represents the LC_FUNCTION_VARIANT_FIXUPS command. This command contains the relocations that must be applied to the GOT-like slots associated with a FunctionVariants table. At runtime, dyld resolves each slot to the best implementation and (re-)signs it according to the pointer-authentication information. FixupFixup class Fixup( self ) class Fixup( self , seg_offset: int , seg_index: int , variant_index: int , pac_auth: bool , pac_address: bool , pac_key: int , pac_diversity: int ) Bases: object A single relocation associated with a function-variant. It mirrors the FunctionVariantFixups::InternalFixup structure used by dyld and describes a slot that must be fixed up to point to the variant referenced by variant_index . pac_address property pac_address → bool Whether the PAC signature mixes the storage address (address diversity) pac_auth property pac_auth → bool Whether the slot is signed with pointer authentication (arm64e) pac_diversity property pac_diversity → int PAC diversity (discriminator) of the slot pac_key property pac_key → int PAC key used to sign the slot seg_index property seg_index → int Index of the segment that owns the slot to fix up seg_offset property seg_offset → int Offset of the slot to fix up, relative to seg_index segment property segment → lief.MachO.SegmentCommand | None SegmentCommand referenced by seg_index if it could be resolved, or None variant_index property variant_index → int Index of the FunctionVariants runtime table used to resolve the slot add add( self , fixup: lief._lief.MachO.FunctionVariantFixups.Fixup ) → lief._lief.MachO.FunctionVariantFixups Append a new Fixup content property content → memoryview Payload content data_offset property data_offset → int Offset in the binary where the payload starts data_size property data_size → int Size of the payload fixups property fixups → lief.MachO.FunctionVariantFixups.it_fixups Iterator over the different Fixup entries Lazy Load Dylib Info lief.MachO.LazyLoadDylibInfo class lief.MachO.LazyLoadDylibInfo Bases: LoadCommand Class representing the LC_LAZY_LOAD_DYLIB_INFO load command. This command describes how to lazily load a dylib : instead of binding the library and its symbols at launch time, dyld keeps the information required to resolve the dylib on the first use of one of its symbols. Fixup class Fixup Bases: object A single lazy-binding fixup decoded from the chain referenced by chain_start_image_offset and decoded according to pointer_format . address property address → int Virtual address of the slot bound by this fixup is_auth property is_auth → bool Whether the bound pointer is authenticated ( arm64e PAC) ordinal property ordinal → int Index of the bound symbol in symbols symbol property symbol → str Name of the bound symbol (resolved from ordinal ) add_symbol add_symbol( self , symbol: str ) → lief._lief.MachO.LazyLoadDylibInfo Append a symbol name to the list of symbols to bind lazily chain_start_image_offset property chain_start_image_offset → int Image offset of the fixup chain start used to bind the dylib’s symbols clear_symbols clear_symbols( self ) → lief._lief.MachO.LazyLoadDylibInfo Remove all the symbol names to bind lazily content property content → memoryview The original content of this payload data_offset property data_offset → int Offset in the __LINKEDIT segment where the payload starts data_size property data_size → int Size of the payload fixups property fixups → lief.MachO.LazyLoadDylibInfo.it_fixups Iterator over the lazy-binding Fixup entries decoded from the chain flag_image_offset property flag_image_offset → int Image offset of the global flag that is set once the dylib has been loaded by dyld flags property flags → int Raw flags associated with this command (see may_be_missing ) load_path property load_path → str Load path of the dylib to bind lazily may_be_missing property may_be_missing → bool Whether the dylib is allowed to be missing at runtime (weak linked) pointer_format property pointer_format → int Chained-fixups pointer format used by the binding chain symbols property symbols → list[str] List of the symbol names to bind lazily for this dylib Source Version lief.MachO.SourceVersion class lief.MachO.SourceVersion Bases: LoadCommand Class that represents the MachO SOURCE_VERSION This command is used to provide the version of the sources used to build the binary version property version → list[int] Version as a tuple of 5 integers Version Min lief.MachO.VersionMin class lief.MachO.VersionMin Bases: LoadCommand Class that wraps the LC_VERSION_MIN_MACOSX, LC_VERSION_MIN_IPHONEOS, … commands sdk property sdk → list[int] SDK as a tuple of 3 integers version property version → list[int] Version as a tuple of 3 integers Routine lief.MachO.Routine class lief.MachO.Routine Bases: LoadCommand Class that represents the LC_ROUTINE/LC_ROUTINE64 commands. According to the Mach-O loader.h documentation: The routines command contains the address of the dynamic shared library initialization routine and an index into the module table for the module that defines the routine. Before any modules are used from the library the dynamic linker fully binds the module that defines the initialization routine and then calls it. This gets called before any module initialization routines (used for C++ static constructors) in the library. init_address property init_address → int Address of initialization routine init_module property init_module → int Index into the module table that the init routine is defined in reserved1 property reserved1 → int reserved2 property reserved2 → int reserved3 property reserved3 → int reserved4 property reserved4 → int reserved5 property reserved5 → int reserved6 property reserved6 → int Relocation lief.MachO.Relocation class lief.MachO.Relocation Bases: Relocation It extends the LIEF lief.Relocation abstract class and it is sub-classed by RelocationObject RelocationDyld ORIGIN class ORIGIN( *values ) Bases: Enum CHAINED_FIXUPS CHAINED_FIXUPS = 3 DYLDINFO DYLDINFO = 1 RELOC_TABLE RELOC_TABLE = 2 UNKNOWN UNKNOWN = 0 from_value from_value( arg: int ) → lief.MachO.Relocation.ORIGIN = address property address → int For OBJECT or ( origin is RELOC_TABLE ) this is an offset from the start of the Section to the item containing the address requiring relocation. For EXECUTE / DYLIB or ( origin is DYLDINFO ) this is a virtual_address . architecture property architecture → lief.MachO.Header.CPU_TYPE CPU_TYPE of the relocation has_section property has_section → bool True if the relocation has a Section associated with has_segment property has_segment → bool True if the relocation has a SegmentCommand associated with has_symbol property has_symbol → bool True if the relocation has a Symbol associated with origin property origin → lief.MachO.Relocation.ORIGIN ORIGIN of the relocation For OBJECT file it should be RELOC_TABLE For EXECUTE or DYLIB it should be DYLDINFO ”) pc_relative property pc_relative → bool Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing. For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction. section property section → lief.MachO.Section | None Section associated with the relocation if any, or None segment property segment → lief.MachO.SegmentCommand | None SegmentCommand associated with the relocation if any, or None symbol property symbol → lief.MachO.Symbol | None Symbol associated with the relocation if any, or None type property type → lief.MachO.X86_RELOCATION | lief.MachO.X86_64_RELOCATION | lief.MachO.PPC_RELOCATION | lief.MachO.ARM_RELOCATION | lief.MachO.ARM64_RELOCATION | lief.MachO.DyldInfo.REBASE_TYPE Type of the relocation according to the architecture and/or origin If origin is RELOC_TABLE : See: lief.MachO.X86_RELOCATION lief.MachO.X86_64_RELOCATION lief.MachO.PPC_RELOCATION lief.MachO.ARM_RELOCATION lief.MachO.ARM64_RELOCATION If origin is DYLDINFO , the value is associated with REBASE_TYPE . Relocation Object lief.MachO.RelocationObject class lief.MachO.RelocationObject Bases: Relocation Class that represents a relocation present in the MachO object file ( .o ). Usually, this kind of relocation is found in the lief.MachO.Section . is_scattered property is_scattered → bool True if the relocation is a scattered one value property value → int For scattered relocations, the address of the relocatable expression for the item in the file that needs to be updated if the address is changed. For relocatable expressions with the difference of two section addresses, the address from which to subtract (in mathematical terms, the minuend) is contained in the first relocation entry and the address to subtract (the subtrahend) is contained in the second relocation entry.”, Relocation Dyld lief.MachO.RelocationDyld class lief.MachO.RelocationDyld Bases: Relocation Class that represents a relocation found in the DyldInfo structure. While this class does not have an associated structure in the Mach-O format specification, it provides a convenient interface for the lief.MachO.DyldInfo.rebase values See also: RelocationObject Relocation Fixup lief.MachO.RelocationFixup class lief.MachO.RelocationFixup Bases: Relocation Class that represents a rebase relocation found in the LC_DYLD_CHAINED_FIXUPS command. This class extends lief.Relocation (and lief.MachO.Relocation ) in which address is set to the absolute virtual address where the relocation must take place (e.g. 0x10000d270 ). On the other hand, target contains the value that should be set at address if the imagebase is imagebase (e.g. 0x1000073a8 ). If the Mach-O loader chooses another base address (like 0x7ff100000 ), it must set 0x10000d270 to 0x7ff1073a8 . next property next → int (unscaled) next offset in the chain target property target → int Binding Info lief.MachO.BindingInfo class lief.MachO.BindingInfo Bases: Object Class that provides an interface over an entry in DyldInfo structure This class does not represent a structure that exists in the Mach-O format specifications but it provides a view of a binding operation that is performed by the Dyld binding bytecode ( LC_DYLD_INFO ) or the Dyld chained fixups ( DYLD_CHAINED_FIXUPS ) See: ChainedBindingInfo , DyldBindingInfo addend property addend → int Value added to the segment’s virtual address when binding address property address → int Binding’s address has_library property has_library → bool True if the binding info has a DylibCommand associated with has_segment property has_segment → bool True if the binding info has a SegmentCommand associated with has_symbol property has_symbol → bool True if the binding info has a Symbol associated with library property library → lief.MachO.DylibCommand | None DylibCommand associated with the binding if any, or None library_ordinal property library_ordinal → int segment property segment → lief.MachO.SegmentCommand | None SegmentCommand associated with the binding if any, or None symbol property symbol → lief.MachO.Symbol | None Symbol associated with the binding if any, or None weak_import property weak_import → bool Dyld Binding Info lief.MachO.DyldBindingInfo class lief.MachO.DyldBindingInfo Bases: BindingInfo This class represents a symbol binding operation associated with the LC_DYLD_INFO bytecode. This class does not represent a structure that exists in the Mach-O format specifications but it provides a view on an entry of the Dyld binding opcodes. See also: BindingInfo CLASS class CLASS( *values ) Bases: Enum LAZY LAZY = 2 STANDARD STANDARD = 3 THREADED THREADED = 100 WEAK WEAK = 1 from_value from_value( arg: int ) → lief.MachO.DyldBindingInfo.CLASS = TYPE class TYPE( *values ) Bases: Enum POINTER POINTER = 1 TEXT_ABSOLUTE32 TEXT_ABSOLUTE32 = 2 TEXT_PCREL32 TEXT_PCREL32 = 3 from_value from_value( arg: int ) → lief.MachO.DyldBindingInfo.TYPE = binding_class property binding_class → lief.MachO.DyldBindingInfo.CLASS BINDING_CLASS of the binding binding_type property binding_type → lief.MachO.DyldBindingInfo.TYPE BIND_TYPES of the binding. Usually, it is POINTER . original_offset property original_offset → int Original relative offset of the binding opcodes Chained Binding Info lief.MachO.ChainedBindingInfo class lief.MachO.ChainedBindingInfo Bases: BindingInfo This class represents a symbol binding operation associated with the LC_DYLD_CHAINED_FIXUPS command. This class does not represent a structure that exists in the Mach-O format specifications but it provides a view on an entry. See also: BindingInfo format property format → lief.MachO.DYLD_CHAINED_FORMAT DYLD_CHAINED_FORMAT of the import offset property offset → int Offset of the entry in the chained fixups ptr_format property ptr_format → lief.MachO.DYLD_CHAINED_PTR_FORMAT DYLD_CHAINED_PTR_FORMAT of the import sign_extended_addend property sign_extended_addend → int Export Info lief.MachO.ExportInfo class lief.MachO.ExportInfo Bases: Object Class that provides an interface over the Dyld export info This class does not represent a structure that exists in the Mach-O format specification but provides a view on an entry of the Dyld export trie. FLAGS class FLAGS( *values ) Bases: Flag REEXPORT REEXPORT = 8 STATIC_RESOLVER STATIC_RESOLVER = 32 STUB_AND_RESOLVER STUB_AND_RESOLVER = 16 WEAK_DEFINITION WEAK_DEFINITION = 4 from_value from_value( arg: int ) → lief.MachO.ExportInfo.FLAGS = KIND class KIND( *values ) Bases: Enum ABSOLUTE_KIND ABSOLUTE_KIND = 2 REGULAR REGULAR = 0 THREAD_LOCAL_KIND THREAD_LOCAL_KIND = 1 from_value from_value( arg: int ) → lief.MachO.ExportInfo.KIND = address property address → int The address of the export alias property alias → lief.MachO.Symbol | None Symbol alias if the current symbol is re-exported alias_library property alias_library → lief.MachO.DylibCommand | None If the current symbol has an alias, it returns the DylibCommand command associated with flags property flags → int Some information ( FLAGS ) about the export (like weak export, reexport, …) flags_list property flags_list → list[ lief.MachO.ExportInfo.FLAGS ] Return flags as a list of FLAGS has has( self , flag: lief._lief.MachO.ExportInfo.FLAGS ) → bool Check if the flag FLAGS given in first parameter is present has_symbol property has_symbol → bool True if the export info has a Symbol associated with kind property kind → lief.MachO.ExportInfo.KIND The export’s kind: regular, thread local, absolute, … ( KIND ) node_offset property node_offset → int Original offset in the export Trie symbol property symbol → lief.MachO.Symbol | None Symbol associated with the export if any, or None Thread Command lief.MachO.ThreadCommand class lief.MachO.ThreadCommand( self , arg0: int , arg1: int , arg2: lief._lief.MachO.Header.CPU_TYPE , / ) Bases: LoadCommand Class that represents the LC_THREAD / LC_UNIXTHREAD commands and that can be used to get the binary entrypoint when the LC_MAIN (MainCommand) is not present Generally speaking, this command aims at defining the original state of the main thread which includes the registers’ values architecture property architecture → lief.MachO.Header.CPU_TYPE The CPU architecture that is targeted by this ThreadCommand count property count → int Size of the thread state data with 32-bits alignment. This value should match len( state ) flavor property flavor → int Integer that defines a special flavor for the thread. The meaning of this value depends on the architecture . The list of the values can be found in the XNU kernel files: xnu/osfmk/mach/arm/thread_status.h for the ARM/AArch64 architectures xnu/osfmk/mach/i386/thread_status.h for the x86/x86-64 architectures pc property pc → int Return the initial Program Counter regardless of the underlying architecture. This value, when non null, can be used to determine the binary’s entrypoint. Underneath, it works by looking for the PC register value in the state data state property state → memoryview The actual thread state as a vector of bytes. Depending on the architecture(), these data can be casted into x86_thread_state_t, x86_thread_state64_t, … RPath Command lief.MachO.RPathCommand class lief.MachO.RPathCommand Bases: LoadCommand create create( path: str ) → lief.MachO.RPathCommand | None = path property path → str @rpath path path_offset property path_offset → int Original string offset of the path Code Signature lief.MachO.CodeSignature class lief.MachO.CodeSignature Bases: LoadCommand content property content → memoryview The raw signature as a bytes stream data_offset property data_offset → int Offset in the binary where the signature starts data_size property data_size → int Size of the raw signature Data In Code lief.MachO.DataInCode class lief.MachO.DataInCode Bases: LoadCommand Interface of the LC_DATA_IN_CODE command This command is used to list slices of code sections that contain data. The slices information are stored as an array of DataCodeEntry add add( self , entry: lief._lief.MachO.DataCodeEntry ) → lief._lief.MachO.DataInCode Add a new DataCodeEntry content property content → memoryview The original content as a bytes stream data_offset property data_offset → int Start of the array of the DataCodeEntry entries data_size property data_size → int Whole size of the array ( size = sizeof(DataCodeEntry) * nb_elements ) entries property entries → lief.MachO.it_data_in_code_entries Iterator over DataCodeEntry Data Code Entry lief.MachO.DataCodeEntry class lief.MachO.DataCodeEntry Bases: Object Interface over an entry in the DataInCode command TYPES class TYPES( *values ) Bases: Enum ABS_JUMP_TABLE_32 ABS_JUMP_TABLE_32 = 5 DATA DATA = 1 JUMP_TABLE_16 JUMP_TABLE_16 = 3 JUMP_TABLE_32 JUMP_TABLE_32 = 4 JUMP_TABLE_8 JUMP_TABLE_8 = 2 UNKNOWN UNKNOWN = 0 from_value from_value( arg: int ) → lief.MachO.DataCodeEntry.TYPES = length property length → int Length of the data offset property offset → int Offset of the data type property type → lief.MachO.DataCodeEntry.TYPES Type of the data ( TYPES Segment Split Info lief.MachO.SegmentSplitInfo class lief.MachO.SegmentSplitInfo Bases: LoadCommand Class that represents the SEGMENT_SPLIT_INFO command content property content → memoryview The original content as a bytes stream data_offset property data_offset → int Offset in the binary where the data start data_size property data_size → int Size of the raw data Sub Framework lief.MachO.SubFramework class lief.MachO.SubFramework Bases: LoadCommand Class that represents the SubFramework command. According to the Mach-O loader.h documentation: > A dynamically linked shared library may be a subframework of an umbrella > framework. If so it will be linked with “-umbrella umbrella_name” where > Where “umbrella_name” is the name of the umbrella framework. A subframework > can only be linked against by its umbrella framework or other subframeworks > that are part of the same umbrella framework. Otherwise the static link > editor produces an error and states to link against the umbrella framework. > The name of the umbrella framework for subframeworks is recorded in the > following structure. umbrella property umbrella → str Name of the umbrella framework Sub Client lief.MachO.SubClient class lief.MachO.SubClient Bases: LoadCommand Class that represents the SubClient command. According to the Mach-O loader.h documentation: > For dynamically linked shared libraries that are subframework of an umbrella > framework they can allow clients other than the umbrella framework or other > subframeworks in the same umbrella framework. To do this the subframework > is built with “-allowable_client client_name” and an LC_SUB_CLIENT load > command is created for each -allowable_client flag. The client_name is > usually a framework name. It can also be a name used for bundles clients > where the bundle is built with “-client_name client_name”. client property client → str Name of the sub client Dyld Environment lief.MachO.DyldEnvironment class lief.MachO.DyldEnvironment Bases: LoadCommand Class that represents a LC_DYLD_ENVIRONMENT which is used by the Mach-O linker/loader to initialize an environment variable value property value → str Environment variable as a string Encryption Info lief.MachO.EncryptionInfo class lief.MachO.EncryptionInfo Bases: LoadCommand Class that represents the LC_ENCRYPTION_INFO / LC_ENCRYPTION_INFO_64 commands The encryption info is usually present in Mach-O executables that target iOS to encrypt some sections of the binary crypt_id property crypt_id → int The encryption system. 0 means not encrypted crypt_offset property crypt_offset → int File offset of encrypted range crypt_size property crypt_size → int File size of encrypted range Build Version lief.MachO.BuildVersion class lief.MachO.BuildVersion Bases: LoadCommand PLATFORMS class PLATFORMS( *values ) Bases: Enum ANY ANY = 4294967295 BRIDGEOS BRIDGEOS = 5 DRIVERKIT DRIVERKIT = 10 FIRMWARE FIRMWARE = 13 IOS IOS = 2 IOS_EXCLAVE_CORE IOS_EXCLAVE_CORE = 17 IOS_EXCLAVE_KIT IOS_EXCLAVE_KIT = 18 IOS_SIMULATOR IOS_SIMULATOR = 7 MACOS MACOS = 1 MACOS_EXCLAVE_CORE MACOS_EXCLAVE_CORE = 15 MACOS_EXCLAVE_KIT MACOS_EXCLAVE_KIT = 16 MAC_CATALYST MAC_CATALYST = 6 SEPOS SEPOS = 14 TVOS TVOS = 3 TVOS_EXCLAVE_CORE TVOS_EXCLAVE_CORE = 19 TVOS_EXCLAVE_KIT TVOS_EXCLAVE_KIT = 20 TVOS_SIMULATOR TVOS_SIMULATOR = 8 UNKNOWN UNKNOWN = 0 VISIONOS VISIONOS = 11 VISIONOS_EXCLAVE_CORE VISIONOS_EXCLAVE_CORE = 23 VISIONOS_EXCLAVE_KIT VISIONOS_EXCLAVE_KIT = 24 VISIONOS_SIMULATOR VISIONOS_SIMULATOR = 12 WATCHOS WATCHOS = 4 WATCHOS_EXCLAVE_CORE WATCHOS_EXCLAVE_CORE = 21 WATCHOS_EXCLAVE_KIT WATCHOS_EXCLAVE_KIT = 22 WATCHOS_SIMULATOR WATCHOS_SIMULATOR = 9 from_value from_value( arg: int ) → lief.MachO.BuildVersion.PLATFORMS = minos property minos → list[int] Minimal OS version on which this binary was built to run platform property platform → lief.MachO.BuildVersion.PLATFORMS Target PLATFORMS sdk property sdk → list[int] SDK Version tools property tools → list[ lief.MachO.BuildToolVersion ] List of BuildToolVersion used while building this binary Build Tool Version lief.MachO.BuildToolVersion class lief.MachO.BuildToolVersion Bases: Object Class that represents a tool’s version that was involved in the build of the binary TOOLS class TOOLS( *values ) Bases: Enum AIRLLD AIRLLD = 1025 AIRNT AIRNT = 1026 AIRNT_PLUGIN AIRNT_PLUGIN = 1027 AIRPACK AIRPACK = 1028 CLANG CLANG = 1 GPUARCHIVER GPUARCHIVER = 1031 LD LD = 3 LLD LLD = 4 METAL METAL = 1024 METAL_FRAMEWORK METAL_FRAMEWORK = 1032 SWIFT SWIFT = 2 UNKNOWN UNKNOWN = 0 from_value from_value( arg: int ) → lief.MachO.BuildToolVersion.TOOLS = tool property tool → lief.MachO.BuildToolVersion.TOOLS TOOLS type version property version → list[int] Version of the tool Fileset Command lief.MachO.FilesetCommand class lief.MachO.FilesetCommand Bases: LoadCommand Class associated with the LC_FILESET_ENTRY commands binary property binary → lief.MachO.Binary | None Return the Binary object associated with the entry file_offset property file_offset → int Original offset in the kernel cache name property name → str Name of the underlying MachO binary virtual_address property virtual_address → int Memory address where the MachO file should be mapped DyldChainedFixups Command lief.MachO.DyldChainedFixups class lief.MachO.DyldChainedFixups Bases: LoadCommand Class that represents the LC_DYLD_CHAINED_FIXUPS command This command aims at providing rebase and binding information like the DyldInfo ‘s bytecode. Compared to the DyldInfo bytecode, these chained fixups are taking less space. bindings property bindings → lief.MachO.DyldChainedFixups.it_binding_info Iterator over the bindings ChainedBindingInfo associated with this command chained_starts_in_segment class chained_starts_in_segment Bases: object Structure that mirrors the raw dyld_chained_starts_in_segment which aims at providing information about the chained rebase/bind fixups The relocations provided by this structure can be accessed through relocations max_valid_pointer property max_valid_pointer → int for 32-bit OS, any value beyond this is not a pointer offset property offset → int Original offset of the structure, relative to starts_offset page_count property page_count → int How many pages are in the page_start array page_size property page_size → int Likely 0x1000 for x86/x86_64 architectures and 0x4000 for ARM64 architecture page_start property page_start → list[int] Offset in the SegmentCommand of the first element of the chain. pointer_format property pointer_format → lief.MachO.DYLD_CHAINED_PTR_FORMAT How pointers are encoded segment property segment → lief.MachO.SegmentCommand | None SegmentCommand in which the rebase/bind fixups take place segment_offset property segment_offset → int Offset of the segment’s data from the beginning of the file. (it should match file_offset ) size property size → int sizeof(size) + sizeof(page_size) + ... + sizeof(pointer_format) chained_starts_in_segments property chained_starts_in_segments → lief.MachO.DyldChainedFixups.it_chained_starts_in_segments_t Iterator over the chained fixup metadata, chained_starts_in_segment data_offset property data_offset → int Offset of the LC_DYLD_CHAINED_FIXUPS chained payload. This offset should point in the __LINKEDIT segment data_size property data_size → int Size of the LC_DYLD_CHAINED_FIXUPS payload fixups_version property fixups_version → int Chained fixups version. The loader (as of dyld v852.2) checks that this value is set to 0. imports_count property imports_count → int Number of imported symbol names imports_format property imports_format → lief.MachO.DYLD_CHAINED_FORMAT The format of the imports ( ChainedBindingInfo ) imports_offset property imports_offset → int Offset of imports table in chain data payload property payload → memoryview Return the raw content of the command starts_offset property starts_offset → int offset of dyld_chained_starts_in_image in chain_data symbols_format property symbols_format → int The compression algorithm (if any) used to store the symbols 0 means uncompressed while 1 means zlib compressed. As of the version v852.2 of dyld loader, it only supports uncompressed format symbols_offset property symbols_offset → int Offset of symbol strings in chain data DyldExportsTrie Command lief.MachO.DyldExportsTrie class lief.MachO.DyldExportsTrie Bases: LoadCommand Class that represents the LC_DYLD_EXPORTS_TRIE command In recent Mach-O binaries, this command replace the DyldInfo export trie buffer content property content → memoryview The raw export trie data_offset property data_offset → int Offset of the trie in the binary. This offset should point in the __LINKEDIT data_size property data_size → int Raw size of the trie exports property exports → lief.MachO.DyldExportsTrie.it_export_info Iterator over the ExportInfo associated with this trie. show_export_trie show_export_trie( self ) → str Show the trie in a human-readable way Code Signature Dir Command lief.MachO.CodeSignatureDir class lief.MachO.CodeSignatureDir Bases: LoadCommand content property content → memoryview The raw signature as a bytes stream data_offset property data_offset → int Offset in the binary where the signature starts data_size property data_size → int Size of the raw signature Two Level Hints lief.MachO.TwoLevelHints class lief.MachO.TwoLevelHints Bases: LoadCommand Class which represents the LC_TWOLEVEL_HINTS command content property content → memoryview The original content as a bytes stream hints property hints → lief.MachO.TwoLevelHints.it_hints_t Linker Optimization Hint lief.MachO.LinkerOptHint class lief.MachO.LinkerOptHint Bases: LoadCommand Class which represents the LC_LINKER_OPTIMIZATION_HINT command content property content → memoryview The raw payload data_offset property data_offset → int Offset in the binary where the payload starts data_size property data_size → int Size of the raw payload UnknownCommand lief.MachO.UnknownCommand class lief.MachO.UnknownCommand Bases: LoadCommand Generic class when the command is not recognized by LIEF original_command property original_command → int Stub lief.MachO.Stub class lief.MachO.Stub( self , target_info: lief._lief.MachO.Stub.target_info_t , address: int , raw_stub: collections.abc.Sequence[int] ) Bases: object This class represents a stub entry in sections like __stubs,__auth_stubs . It wraps assembly instructions which are used to access the got where the address of the symbol is resolved. Example: 0000000236a3c1bc: ___memcpy_chk adrp x17, #0x241513aa8 add x17, x17, #0x241513aa8 ldr x16, [x17] braa x16, x17 address property address → int The virtual address where the stub is located raw property raw → memoryview The (raw) instructions of this entry as a memory view of bytes target property target → int | lief.lief_errors The address resolved by this stub. For instance, given this stub: 0x3eec: adrp x16, #4096 0x3ef0: ldr x16, [x16, #24] 0x3ef4: br x16 The function returns: 0x4018 . Warning This function is only available with LIEF’s extended version target_info_ttarget_info_t class target_info_t( self ) class target_info_t( self , arg0: lief._lief.MachO.Header.CPU_TYPE , arg1: int , / ) Bases: object arch property arch → lief.MachO.Header.CPU_TYPE subtype property subtype → int Builder lief.MachO.Builder class lief.MachO.Builder Bases: object Class used to reconstruct a Mach-O binary from its object representation config_t class config_t( self ) Bases: object Interface to tweak the Builder linkedit property linkedit → bool write write( *args ) → lief.ok_t | lief.lief_errors = Utilities lief.MachO.check_layoutlief.MachO.check_layout lief.MachO.check_layout( *args ) → tuple[bool, str] lief.MachO.check_layout( file: lief._lief.MachO.FatBinary ) → tuple[bool, str] Overloaded function. check_layout(file: lief._lief.MachO.Binary) -> tuple[bool, str] Check the layout of the given Mach-O binary. It checks if it can be signed according to cctools-921/libstuff/checkout.c check_layout(file: lief._lief.MachO.FatBinary) -> tuple[bool, str] Check the layout of the given FAT Mach-O by checking individually the layout of the binaries embedded in the FAT. Enums MACHO_TYPES lief.MachO.MACHO_TYPES class lief.MachO.MACHO_TYPES( *values ) Bases: Enum CIGAM CIGAM = 3472551422 CIGAM_64 CIGAM_64 = 3489328638 CIGAM_FAT CIGAM_FAT = 3199925962 MAGIC MAGIC = 4277009102 MAGIC_64 MAGIC_64 = 4277009103 MAGIC_FAT MAGIC_FAT = 3405691582 NEURAL_MODEL NEURAL_MODEL = 3203398350 from_value from_value( arg: int ) → lief.MachO.MACHO_TYPES = X86_RELOCATION lief.MachO.X86_RELOCATION class lief.MachO.X86_RELOCATION( *values ) Bases: Enum LOCAL_SECTDIFF LOCAL_SECTDIFF = 4 PAIR PAIR = 1 PB_LA_PTR PB_LA_PTR = 3 SECTDIFF SECTDIFF = 2 TLV TLV = 5 VANILLA VANILLA = 0 from_value from_value( arg: int ) → lief.MachO.X86_RELOCATION = X86_64_RELOCATION lief.MachO.X86_64_RELOCATION class lief.MachO.X86_64_RELOCATION( *values ) Bases: Enum BRANCH BRANCH = 2 GOT GOT = 4 GOT_LOAD GOT_LOAD = 3 SIGNED SIGNED = 1 SIGNED_1 SIGNED_1 = 6 SIGNED_2 SIGNED_2 = 7 SIGNED_4 SIGNED_4 = 8 SUBTRACTOR SUBTRACTOR = 5 TLV TLV = 9 UNSIGNED UNSIGNED = 0 from_value from_value( arg: int ) → lief.MachO.X86_64_RELOCATION = PPC_RELOCATION lief.MachO.PPC_RELOCATION class lief.MachO.PPC_RELOCATION( *values ) Bases: Enum BR14 BR14 = 2 BR24 BR24 = 3 HA16 HA16 = 6 HA16_SECTDIFF HA16_SECTDIFF = 12 HI16 HI16 = 4 HI16_SECTDIFF HI16_SECTDIFF = 10 JBSR JBSR = 13 LO14 LO14 = 7 LO14_SECTDIFF LO14_SECTDIFF = 14 LO16 LO16 = 5 LO16_SECTDIFF LO16_SECTDIFF = 11 LOCAL_SECTDIFF LOCAL_SECTDIFF = 15 PAIR PAIR = 1 PB_LA_PTR PB_LA_PTR = 9 SECTDIFF SECTDIFF = 8 VANILLA VANILLA = 0 from_value from_value( arg: int ) → lief.MachO.PPC_RELOCATION = ARM_RELOCATION lief.MachO.ARM_RELOCATION class lief.MachO.ARM_RELOCATION( *values ) Bases: Enum BR24 BR24 = 5 HALF HALF = 8 HALF_SECTDIFF HALF_SECTDIFF = 9 LOCAL_SECTDIFF LOCAL_SECTDIFF = 3 PAIR PAIR = 1 PB_LA_PTR PB_LA_PTR = 4 SECTDIFF SECTDIFF = 2 THUMB_32BIT_BRANCH THUMB_32BIT_BRANCH = 7 THUMB_RELOC_BR22 THUMB_RELOC_BR22 = 6 VANILLA VANILLA = 0 from_value from_value( arg: int ) → lief.MachO.ARM_RELOCATION = ARM64_RELOCATION lief.MachO.ARM64_RELOCATION class lief.MachO.ARM64_RELOCATION( *values ) Bases: Enum ADDEND ADDEND = 10 BRANCH26 BRANCH26 = 2 GOT_LOAD_PAGE21 GOT_LOAD_PAGE21 = 5 GOT_LOAD_PAGEOFF12 GOT_LOAD_PAGEOFF12 = 6 PAGE21 PAGE21 = 3 PAGEOFF12 PAGEOFF12 = 4 POINTER_TO_GOT POINTER_TO_GOT = 7 SUBTRACTOR SUBTRACTOR = 1 TLVP_LOAD_PAGE21 TLVP_LOAD_PAGE21 = 8 TLVP_LOAD_PAGEOFF12 TLVP_LOAD_PAGEOFF12 = 9 UNSIGNED UNSIGNED = 0 from_value from_value( arg: int ) → lief.MachO.ARM64_RELOCATION = DYLD_CHAINED_FORMAT lief.MachO.DYLD_CHAINED_FORMAT class lief.MachO.DYLD_CHAINED_FORMAT( *values ) Bases: Enum IMPORT IMPORT = 1 IMPORT_ADDEND IMPORT_ADDEND = 2 IMPORT_ADDEND64 IMPORT_ADDEND64 = 3 from_value from_value( arg: int ) → lief.MachO.DYLD_CHAINED_FORMAT = DYLD_CHAINED_PTR_FORMAT lief.MachO.DYLD_CHAINED_PTR_FORMAT class lief.MachO.DYLD_CHAINED_PTR_FORMAT( *values ) Bases: Enum NONE NONE = 0 PTR_32 PTR_32 = 3 PTR_32_CACHE PTR_32_CACHE = 4 PTR_32_FIRMWARE PTR_32_FIRMWARE = 5 PTR_64 PTR_64 = 2 PTR_64_KERNEL_CACHE PTR_64_KERNEL_CACHE = 8 PTR_64_OFFSET PTR_64_OFFSET = 6 PTR_ARM64E PTR_ARM64E = 1 PTR_ARM64E_FIRMWARE PTR_ARM64E_FIRMWARE = 10 PTR_ARM64E_KERNEL PTR_ARM64E_KERNEL = 7 PTR_ARM64E_SEGMENTED PTR_ARM64E_SEGMENTED = 14 PTR_ARM64E_SHARED_CACHE PTR_ARM64E_SHARED_CACHE = 13 PTR_ARM64E_USERLAND PTR_ARM64E_USERLAND = 9 PTR_ARM64E_USERLAND24 PTR_ARM64E_USERLAND24 = 12 PTR_X86_64_KERNEL_CACHE PTR_X86_64_KERNEL_CACHE = 11 from_value from_value( arg: int ) → lief.MachO.DYLD_CHAINED_PTR_FORMAT = ", "contentHash": "a91b59945edd309bcbc8e9511eeab66aa9a40aaebe628ce3c02dc93ec09937fc", "description": "Mach-O Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "formats/macho/python", "documentID": "931a8e3a90f715f97d3dd6f6afc9c0bd5e7d4a678bda9cd08123b0d129fc8cb7", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/macho/python.md", "title": "Mach-O Python API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/macho/rust.html", "content": "Rust Note Please check: lief::macho", "contentHash": "1c7562925959d13eea9b20e47284b58791493c0fa42e6e210946198b780f19a5", "description": "Mach-O Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "formats/macho/rust", "documentID": "91f1c4ea2ae5a1866fe57037003d09c5608127950be3324a9fdbc211673b72e5", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/macho/rust.md", "title": "Mach-O Rust API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/pe/cpp.html", "content": "C++ Parser Parser class Parser : public LIEF:: Parser Main interface to parse PE binaries. In particular, the static Parser::parse functions should be used to get a LIEF::PE::Binary instance. Public Functions operator= Parser &operator=(const Parser ©) = delete Parser Parser(const Parser ©) = delete find_coff_string COFF:: String *find_coff_string(uint32_t offset) const find_exception_info inline ExceptionInfo *find_exception_info(uint32_t rva) const bin inline const Binary &bin() const bin inline Binary &bin() stream inline BinaryStream &stream() config inline const ParserConfig &config() const memoize void memoize( ExceptionInfo &info) memoize void memoize(COFF:: String str) add_non_resolved inline void add_non_resolved( ExceptionInfo &info, uint32_t target) stream_from_rva std::unique_ptr< SpanStream > stream_from_rva(uint32_t rva, size_t size = 0) record_relocation void record_relocation(uint32_t rva, span data) record_delta_relocation ok_error_t record_delta_relocation(uint32_t rva, int64_t delta, size_t size) Public Static Functions is_valid_import_name static bool is_valid_import_name(std::string_view name) Check if the given name is a valid import. This check verifies that: The name is not too large or empty (cf. https://stackoverflow.com/a/23340781 ) All the characters are printable is_valid_dll_name static bool is_valid_dll_name(std::string_view name) Check if the given name is a valid DLL name. This check verifies that: The name of the DLL is at least 4 characters long All the characters are printable parse static std::unique_ptr< Binary > parse(std::string_view filename, const ParserConfig &conf = ParserConfig :: default_conf ()) Parse a PE binary from the given filename. PathTparse template = 0> static inline std::unique_ptr< Binary > parse(const PathT &filename, const ParserConfig &conf = ParserConfig :: default_conf ()) Same as parse(std::string_view, const ParserConfig&) but the file is given as a std::filesystem::path . parse static std::unique_ptr< Binary > parse(std::vector data, const ParserConfig &conf = ParserConfig :: default_conf ()) Parse a PE binary from a data buffer. parse static std::unique_ptr< Binary > parse(const uint8_t *buffer, size_t size, const ParserConfig &conf = ParserConfig :: default_conf ()) parse static std::unique_ptr< Binary > parse(std::unique_ptr< BinaryStream > stream, const ParserConfig &conf = ParserConfig :: default_conf ()) Parse a PE binary from the given BinaryStream . parse_from_memory static std::unique_ptr< Binary > parse_from_memory(uintptr_t address, const ParserConfig &config = ParserConfig :: default_conf ()) Parse the PE binary at the given memory address. parse_from_memory static std::unique_ptr< Binary > parse_from_memory(uintptr_t address, size_t size, const ParserConfig &config = ParserConfig :: default_conf ()) Parse the PE binary at the given memory address and with the given size. parse_from_dump static std::unique_ptr< Binary > parse_from_dump(std::string_view filepath, uint64_t addr, const ParserConfig &config = ParserConfig :: default_conf ()) Parse a PE binary from a memory dump located on disk. A dump is a raw capture of the process memory that was mapped starting at the virtual address addr . This is typically used to parse a PE image that has been dumped from memory (e.g. from a debugger or a runtime hook). Parameters: filepath – [in] Path to the file that contains the memory dump addr – [in] Virtual address at which the dump was mapped config – [in] Optional configuration for the parser PathTparse_from_dump template = 0> static inline std::unique_ptr< Binary > parse_from_dump(const PathT &filepath, uint64_t addr, const ParserConfig &config = ParserConfig :: default_conf ()) Same as parse_from_dump(std::string_view, uint64_t, const ParserConfig&) but the dump file is given as a std::filesystem::path . parse_from_dump static std::unique_ptr< Binary > parse_from_dump( BinaryStream &stream, uint64_t addr, const ParserConfig &config = ParserConfig :: default_conf ()) Same as parse_from_dump(std::string_view, uint64_t, const ParserConfig&) but the dump is wrapped in the given non-owned stream. parse_from_dump static std::unique_ptr< Binary > parse_from_dump(std::unique_ptr< BinaryStream > stream, uint64_t addr, const ParserConfig &config = ParserConfig :: default_conf ()) Same as parse_from_dump(std::string_view, uint64_t, const ParserConfig&) but the dump is wrapped in the given owned stream. Public Static Attributes MAX_DATA_SIZE static size_t MAX_DATA_SIZE = 3_GB Maximum size of the data read. MAX_TLS_CALLBACKS static size_t MAX_TLS_CALLBACKS = 3000 MAX_IMPORT_ENTRIES static size_t MAX_IMPORT_ENTRIES = 0x10000 MAX_IMPORT_NAME_SIZE static size_t MAX_IMPORT_NAME_SIZE = 0x1000 MAX_DLL_NAME_SIZE static size_t MAX_DLL_NAME_SIZE = 255 MAX_PADDING_SIZE static size_t MAX_PADDING_SIZE = 1_GB Max size of the padding section. ParserConfig struct ParserConfig This structure is used to configure the behavior of the PE Parser ( PE::Parser ). Public Functions to_string std::string to_string() const Public Members parse_signature bool parse_signature = true Whether to parse the PE Authenticode signature. parse_exports bool parse_exports = true Whether to parse the PE Export Directory. parse_imports bool parse_imports = true Whether to parse the PE Import Directory. parse_rsrc bool parse_rsrc = true Whether to parse the PE resources tree. parse_reloc bool parse_reloc = true Whether to parse PE relocations. parse_exceptions bool parse_exceptions = false Whether to parse in-depth exception metadata. This option is disabled by default because it can introduce significant parsing overhead. parse_arm64x_binary bool parse_arm64x_binary = false Whether to parse nested ARM64X binaries. This option is disabled by default because it can introduce significant parsing overhead. rebase std::optional rebase If set, this value holds the original image base from which the binary should be rebased. This is used to undo relocations and IAT bindings when parsing a PE loaded in memory. Public Static Functions default_conf static inline const ParserConfig &default_conf() Returns the default configuration for the PE Parser . all static inline ParserConfig all() Returns a configuration that enables all optional parsing features. Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const ParserConfig &config) Binary Binary class Binary : public LIEF:: Binary Class which represents a PE binary This is the main interface to manage and modify a PE executable. Public Types sections_t using sections_t = std::vector> Internal container for storing PE’s Section . it_sections using it_sections = ref_iterator < sections_t &, Section *> Iterator that outputs Section & object. it_const_sections using it_const_sections = const_ref_iterator Iterator that outputs const Section & object. data_directories_t using data_directories_t = std::vector> Internal container for storing PE’s DataDirectory . it_data_directories using it_data_directories = ref_iterator < data_directories_t &, DataDirectory *> Iterator that outputs DataDirectory &. it_const_data_directories using it_const_data_directories = const_ref_iterator Iterator that outputs const DataDirectory &. relocations_t using relocations_t = std::vector> Internal container for storing PE’s Relocation . it_relocations using it_relocations = ref_iterator < relocations_t &, Relocation *> Iterator that outputs Relocation &. it_const_relocations using it_const_relocations = const_ref_iterator Iterator that outputs const Relocation &. imports_t using imports_t = std::vector> Internal container for storing PE’s Import . it_imports using it_imports = ref_iterator < imports_t &, Import *> Iterator that outputs Import &. it_const_imports using it_const_imports = const_ref_iterator Iterator that outputs const Import &. delay_imports_t using delay_imports_t = std::vector> Internal container for storing PE’s DelayImport . it_delay_imports using it_delay_imports = ref_iterator < delay_imports_t &, DelayImport *> Iterator that outputs DelayImport &. it_const_delay_imports using it_const_delay_imports = const_ref_iterator Iterator that outputs const DelayImport &. debug_entries_t using debug_entries_t = std::vector> Internal container for storing Debug information. it_debug_entries using it_debug_entries = ref_iterator < debug_entries_t &, Debug *> Iterator that outputs Debug &. it_const_debug_entries using it_const_debug_entries = const_ref_iterator Iterator that outputs const Debug &. symbols_t using symbols_t = std::vector> Internal container for storing COFF Symbols. it_symbols using it_symbols = ref_iterator < symbols_t &, COFF:: Symbol *> Iterator that outputs Symbol &. it_const_symbols using it_const_symbols = const_ref_iterator Iterator that outputs const Symbol &. strings_table_t using strings_table_t = std::vector Internal container for storing strings. it_strings_table using it_strings_table = ref_iterator < strings_table_t &> Iterator that outputs COFF::String &. it_const_strings_table using it_const_strings_table = const_ref_iterator Iterator that outputs const COFF::String &. signatures_t using signatures_t = std::vector< Signature > Internal container for storing PE’s authenticode Signature . it_signatures using it_signatures = ref_iterator < signatures_t &> Iterator that outputs Signature &. it_const_signatures using it_const_signatures = const_ref_iterator Iterator that outputs const Signature &. exceptions_t using exceptions_t = std::vector> Internal container for storing runtime function associated with exceptions. it_exceptions using it_exceptions = ref_iterator < exceptions_t &, ExceptionInfo *> Iterator that outputs ExceptionInfo &. it_const_exceptions using it_const_exceptions = const_ref_iterator Iterator that outputs const ExceptionInfo &. Public Functions Binary Binary() ~Binary ~Binary() override type inline PE_TYPE type() const Return PE32 or PE32+ . rva_to_offset uint64_t rva_to_offset(uint64_t RVA) const Convert a Relative Virtual Address into an offset. The conversion is performed by looking for the section that encompasses the provided RVA. va_to_offset inline uint64_t va_to_offset(uint64_t VA) const Convert the absolute virtual address into an offset. See also rva_to_offset offset_to_virtual_address virtual result offset_to_virtual_address(uint64_t offset, uint64_t slide = 0) const override Convert the given offset into an absolute virtual address. Parameters: offset – [in] The offset to convert. slide – [in] If not 0, it will replace the default base address (if any) offset_to_rva uint64_t offset_to_rva(uint64_t offset) const Convert the given offset into a relative virtual address (RVA). imagebase inline virtual uint64_t imagebase() const override Return binary’s imagebase. 0 if not relevant. The value is the same as those returned by OptionalHeader::imagebase section_from_offset inline Section *section_from_offset(uint64_t offset) Find the section that encompasses the given offset. If no section can be found, return a nullptr section_from_offset const Section *section_from_offset(uint64_t offset) const section_from_rva inline Section *section_from_rva(uint64_t virtual_address) Find the section that encompasses the given RVA. If no section can be found, return a nullptr section_from_rva const Section *section_from_rva(uint64_t virtual_address) const sections inline it_sections sections() Return an iterator over the PE’s Section . sections inline it_const_sections sections() const dos_header inline DosHeader &dos_header() Return a reference to the PE::DosHeader object. dos_header inline const DosHeader &dos_header() const header inline Header &header() Return a reference to the PE::Header object. header inline const Header &header() const optional_header inline OptionalHeader &optional_header() Header that follows the header() . It is named optional from the COFF specification but it is mandatory in a PE file. optional_header inline const OptionalHeader &optional_header() const compute_checksum uint32_t compute_checksum() const Re-compute the value of OptionalHeader::checksum . If both values do not match, it could mean that the binary has been modified after the compilation. This value is computed by LIEF for the current binary object. virtual_size virtual uint64_t virtual_size() const override Compute the binary’s virtual size. It should match OptionalHeader::sizeof_image . sizeof_headers uint32_t sizeof_headers() const Compute the size of all the headers. tls inline TLS *tls() Return a reference to the TLS object. tls inline const TLS *tls() const tls TLS &tls(const TLS &tls) Set a TLS object in the current Binary . has_tls inline bool has_tls() const Check if the current binary has a TLS object. remove_tls void remove_tls() Remove the TLS from the binary. has_imports inline bool has_imports() const Check if the current binary contains imports. See also Import has_signatures inline bool has_signatures() const Check if the current binary contains signatures. See also signatures has_exports inline bool has_exports() const Check if the current binary has exports. See also Export has_resources inline bool has_resources() const Check if the current binary has resources. has_exceptions inline bool has_exceptions() const Check if the current binary has exceptions. has_relocations inline bool has_relocations() const Check if the current binary has relocations. See also Relocation has_debug inline bool has_debug() const Check if the current binary contains debug information. has_configuration inline bool has_configuration() const Check if the current binary has a load configuration. is_reproducible_build bool is_reproducible_build() const Check if the current binary is reproducible build , replacing timestamps by a compile hash. See also Repro signatures inline it_const_signatures signatures() const Return an iterator over the Signature object(s) if the binary is signed. signatures inline it_signatures signatures() verify_signature Signature :: VERIFICATION_FLAGS verify_signature( Signature :: VERIFICATION_CHECKS checks = Signature :: VERIFICATION_CHECKS :: DEFAULT ) const Verify the binary against the embedded signature(s) (if any) First, it checks that the embedded signatures are correct (c.f. Signature::check ) and then, it checks that the authentihash matches ContentInfo::digest . One can tweak the verification process with the Signature::VERIFICATION_CHECKS flags See also LIEF::PE::Signature::check verify_signature Signature :: VERIFICATION_FLAGS verify_signature(const Signature &sig, Signature :: VERIFICATION_CHECKS checks = Signature :: VERIFICATION_CHECKS :: DEFAULT ) const Verify the binary with the Signature object provided in the first parameter. It can be used to verify a detached signature: result detached = LIEF::PE::SignatureParser::parse(\"sig.pkcs7\") if (detached) { binary->verify_signature(detached.value()); } authentihash std::vector authentihash( ALGORITHMS algo) const Compute the authentihash according to the algorithm provided in the first parameter. get_export inline Export *get_export() Return the Export object. get_export inline const Export *get_export() const set_export Export &set_export(const Export &export_table) symbols inline it_symbols symbols() Return binary Symbols. symbols inline it_const_symbols symbols() const coff_string_table inline it_const_strings_table coff_string_table() const Iterator over the strings located in the COFF string table. coff_string_table inline it_strings_table coff_string_table() find_coff_string inline COFF:: String *find_coff_string(uint32_t offset) Try to find the COFF string at the given offset in the COFF string table. Warning This offset must include the first 4 bytes holding the size of the table. Hence, the first string starts at the offset 4. find_coff_string inline const COFF:: String *find_coff_string(uint32_t offset) const resources inline ResourceNode *resources() Return resources as a tree or a nullptr if there is no resources. resources inline const ResourceNode *resources() const set_resources ResourceNode *set_resources(const ResourceNode &root) Change or set the current resource tree with the new one provided in parameter. set_resources ResourceNode *set_resources(std::unique_ptr< ResourceNode > root) resources_manager result < ResourcesManager > resources_manager() const Return the ResourcesManager (class to manage resources more easily than the tree one). get_section inline Section *get_section(const std::string &name) Return binary’s section from its name. If the section can’t be found, return a nullptr. Parameters: name – [in] Name of the Section get_section const Section *get_section(const std::string &name) const import_section const Section *import_section() const Return the section associated with import table or a nullptr if the binary does not have an import table. import_section inline Section *import_section() remove_section virtual void remove_section(const std::string &name, bool clear = false) override Delete the section with the given name. Parameters: name – [in] Name of section to delete clear – [in] if true clear the section’s content with 0 before removing (default: false ) remove void remove(const Section §ion, bool clear = false) Remove the given section. See also remove_section add_section Section *add_section(const Section §ion) Add a section to the binary and return the section added. relocations inline it_relocations relocations() Return an iterator over the PE’s Relocation . relocations inline it_const_relocations relocations() const add_relocation Relocation &add_relocation(const Relocation &relocation) Add a new PE Relocation . remove_all_relocations void remove_all_relocations() Remove all the relocations. data_directories inline it_data_directories data_directories() Return an iterator over the DataDirectory present in the Binary . data_directories inline it_const_data_directories data_directories() const data_directory inline DataDirectory *data_directory( DataDirectory :: TYPES type) Return the DataDirectory with the given type (or index). data_directory const DataDirectory *data_directory( DataDirectory :: TYPES type) const has inline bool has( DataDirectory :: TYPES type) const Check if the current binary has the given DataDirectory::TYPES . debug inline it_debug_entries debug() Return an iterator over the Debug entries. debug inline it_const_debug_entries debug() const add_debug_info Debug *add_debug_info(const Debug &entry) Add a new debug entry. remove_debug bool remove_debug(const Debug &entry) Remove a specific debug entry. clear_debug bool clear_debug() Remove all debug info from the binary. codeview_pdb const CodeViewPDB *codeview_pdb() const Return the CodeViewPDB object if present. codeview_pdb inline CodeViewPDB *codeview_pdb() load_configuration inline const LoadConfiguration *load_configuration() const Return the LoadConfiguration object or a nullptr if the binary does not use the LoadConfiguration . load_configuration inline LoadConfiguration *load_configuration() overlay inline span overlay() const Return the overlay content. overlay inline span overlay() overlay_offset inline uint64_t overlay_offset() const Return the original overlay offset. dos_stub inline span dos_stub() const Return the DOS stub content. dos_stub inline span dos_stub() dos_stub inline void dos_stub(std::vector content) Update the DOS stub content. rich_header inline RichHeader *rich_header() Return a reference to the RichHeader object. rich_header inline const RichHeader *rich_header() const rich_header void rich_header(const RichHeader &rich_header) Set a RichHeader object in the current Binary . has_rich_header inline bool has_rich_header() const Check if the current binary has a RichHeader object. imports inline it_imports imports() Return an iterator over the binary imports. imports inline it_const_imports imports() const get_import inline Import *get_import(const std::string &import_name) Return the Import matching the provided name (case-sensitive). If the import can’t be found, it returns a nullptr get_import const Import *get_import(const std::string &import_name) const has_import inline bool has_import(const std::string &import_name) const True if the binary imports the given library name has_delay_imports inline bool has_delay_imports() const Check if the current binary contains delay imports. delay_imports inline it_delay_imports delay_imports() Return an iterator over the binary’s delay imports. delay_imports inline it_const_delay_imports delay_imports() const get_delay_import inline DelayImport *get_delay_import(const std::string &import_name) Returns the DelayImport matching the given name. If it can’t be found, it returns a nullptr. get_delay_import const DelayImport *get_delay_import(const std::string &import_name) const has_delay_import inline bool has_delay_import(const std::string &import_name) const True if the binary delay-imports the given library name add_import inline Import &add_import(const std::string &name, int32_t pos = -1) Add an imported library (i.e. DLL ) to the binary. The second parameter pos defines where to insert the import. If negative (default), the import is appended to the end of the list. remove_import bool remove_import(const std::string &name) Remove the imported library with the given name . Return true if the deletion succeeded, false otherwise. remove_all_imports inline void remove_all_imports() Remove all libraries in the binary. write inline std::unique_ptr< Builder > write(const std::string &filename) Reconstruct the binary object and write the raw PE in filename . write std::unique_ptr< Builder > write(const std::string &filename, const Builder :: config_t &config) Reconstruct the binary object with the given configuration and write it in filename . write inline std::unique_ptr< Builder > write(std::ostream &os) Reconstruct the binary object and write the raw PE in os stream. Rebuild a PE binary from the current Binary object. When rebuilding, import table and relocations are not rebuilt. write std::unique_ptr< Builder > write(std::ostream &os, const Builder :: config_t &config) accept virtual void accept(Visitor &visitor) const override Method so that a visitor can visit us. patch_address virtual void patch_address(uint64_t address, const std::vector &patch_value, VA_TYPES addr_type = VA_TYPES::AUTO) override Patch the content at virtual address address with patch_value . Parameters: address – [in] Address to patch patch_value – [in] Patch to apply addr_type – [in] Type of the Virtual address: VA or RVA. Default: Auto patch_address virtual void patch_address(uint64_t address, uint64_t patch_value, size_t size = sizeof(uint64_t), VA_TYPES addr_type = VA_TYPES::AUTO) override Patch the address with the given value. Parameters: address – [in] Address to patch patch_value – [in] Patch to apply size – [in] Size of the value in bytes (1, 2, … 8) addr_type – [in] Type of the Virtual address: VA or RVA. Default: Auto fill_address void fill_address(uint64_t address, size_t size, uint8_t value = 0, VA_TYPES addr_type = VA_TYPES::AUTO) Fill the content at the provided address with a fixed value. get_content_from_virtual_address virtual span get_content_from_virtual_address(uint64_t virtual_address, uint64_t size, Binary ::VA_TYPES addr_type = Binary ::VA_TYPES::AUTO) const override Return the content located at the provided virtual address. Parameters: virtual_address – [in] Virtual address of the data to retrieve size – [in] Size in bytes of the data to retrieve addr_type – [in] Type of the Virtual address: VA or RVA. Default: Auto entrypoint inline virtual uint64_t entrypoint() const override Return the binary’s entrypoint (it is the same value as OptionalHeader::addressof_entrypoint ). is_pie inline virtual bool is_pie() const override Check if the binary is position independent. has_nx inline virtual bool has_nx() const override Check if the binary uses NX protection. last_section_offset uint64_t last_section_offset() const export_dir inline DataDirectory *export_dir() Return the data directory associated with the export table. export_dir inline const DataDirectory *export_dir() const import_dir inline DataDirectory *import_dir() Return the data directory associated with the import table. import_dir inline const DataDirectory *import_dir() const rsrc_dir inline DataDirectory *rsrc_dir() Return the data directory associated with the resources tree. rsrc_dir inline const DataDirectory *rsrc_dir() const exceptions_dir inline DataDirectory *exceptions_dir() Return the data directory associated with the exceptions. exceptions_dir inline const DataDirectory *exceptions_dir() const cert_dir inline DataDirectory *cert_dir() Return the data directory associated with the certificate table (authenticode). cert_dir inline const DataDirectory *cert_dir() const relocation_dir inline DataDirectory *relocation_dir() Return the data directory associated with the relocation table. relocation_dir inline const DataDirectory *relocation_dir() const debug_dir inline DataDirectory *debug_dir() Return the data directory associated with the debug table. debug_dir inline const DataDirectory *debug_dir() const tls_dir inline DataDirectory *tls_dir() Return the data directory associated with TLS . tls_dir inline const DataDirectory *tls_dir() const load_config_dir inline DataDirectory *load_config_dir() Return the data directory associated with the load config. load_config_dir inline const DataDirectory *load_config_dir() const iat_dir inline DataDirectory *iat_dir() Return the data directory associated with the IAT. iat_dir inline const DataDirectory *iat_dir() const delay_dir inline DataDirectory *delay_dir() Return the data directory associated with delayed imports. delay_dir inline const DataDirectory *delay_dir() const ctor_functions virtual LIEF:: Binary :: functions_t ctor_functions() const override Return the list of the binary constructors. In a PE file, we consider a constructors as a callback in the TLS object functions LIEF:: Binary :: functions_t functions() const All functions found in the binary exception_functions LIEF:: Binary :: functions_t exception_functions() const Functions found in the Exception table directory. exceptions inline it_exceptions exceptions() Iterator over the exception ( _RUNTIME_FUNCTION ) functions. Warning This function requires that the option LIEF::PE::ParserConfig::parse_exceptions was turned on (default is false) when parsing the binary exceptions inline it_const_exceptions exceptions() const find_exception_at ExceptionInfo *find_exception_at(uint32_t rva) Try to find the exception info at the given RVA. Warning This function requires that the option LIEF::PE::ParserConfig::parse_exceptions was turned on (default is false) when parsing the binary find_exception_at inline const ExceptionInfo *find_exception_at(uint32_t rva) const is_arm64ec bool is_arm64ec() const True if this binary is compiled in ARM64EC mode (emulation compatible). is_arm64x bool is_arm64x() const True if this binary is compiled in ARM64X mode (contains both ARM64 and ARM64EC code). nested_pe_binary inline const Binary *nested_pe_binary() const If the current binary contains dynamic relocations (e.g. LIEF::PE::DynamicFixupARM64X ), this function returns the relocated view of the current PE. This can be used to get the alternative PE binary, targeting a different architectures. Warning This function requires that the option LIEF::PE::ParserConfig::parse_arm64x_binary was turned on (default is false) when parsing the binary nested_pe_binary inline Binary *nested_pe_binary() get_function_address virtual result get_function_address(const std::string &name) const override Attempt to resolve the address of the function specified by name . print virtual std::ostream &print(std::ostream &os) const override Public Static Functions classof static inline bool classof(const LIEF:: Binary *bin) Dos Header DosHeader class DosHeader : public LIEF::Object Class which represents the DosHeader , the first structure present at the beginning of a PE file. Most of the attributes of this structures are no longer relevant. Public Types reserved_t using reserved_t = std::array reserved2_t using reserved2_t = std::array Public Functions DosHeader DosHeader(const details::pe_dos_header &header) DosHeader DosHeader(const DosHeader &) = default operator= DosHeader &operator=(const DosHeader &) = default DosHeader DosHeader( DosHeader &&) = default operator= DosHeader &operator=( DosHeader &&) = default ~DosHeader ~DosHeader() override = default magic inline uint16_t magic() const Magic bytes identifying a DOS/PE binary. used_bytes_in_last_page inline uint16_t used_bytes_in_last_page() const file_size_in_pages inline uint16_t file_size_in_pages() const numberof_relocation inline uint16_t numberof_relocation() const header_size_in_paragraphs inline uint16_t header_size_in_paragraphs() const minimum_extra_paragraphs inline uint16_t minimum_extra_paragraphs() const maximum_extra_paragraphs inline uint16_t maximum_extra_paragraphs() const initial_relative_ss inline uint16_t initial_relative_ss() const initial_sp inline uint16_t initial_sp() const checksum inline uint16_t checksum() const initial_ip inline uint16_t initial_ip() const initial_relative_cs inline uint16_t initial_relative_cs() const addressof_relocation_table inline uint16_t addressof_relocation_table() const overlay_number inline uint16_t overlay_number() const reserved inline const reserved_t &reserved() const oem_id inline uint16_t oem_id() const oem_info inline uint16_t oem_info() const reserved2 inline const reserved2_t &reserved2() const addressof_new_exeheader inline uint32_t addressof_new_exeheader() const Return the offset to the PE::Header structure. magic inline void magic(uint16_t magic) used_bytes_in_last_page inline void used_bytes_in_last_page(uint16_t value) file_size_in_pages inline void file_size_in_pages(uint16_t value) numberof_relocation inline void numberof_relocation(uint16_t value) header_size_in_paragraphs inline void header_size_in_paragraphs(uint16_t value) minimum_extra_paragraphs inline void minimum_extra_paragraphs(uint16_t value) maximum_extra_paragraphs inline void maximum_extra_paragraphs(uint16_t value) initial_relative_ss inline void initial_relative_ss(uint16_t value) initial_sp inline void initial_sp(uint16_t value) checksum inline void checksum(uint16_t value) initial_ip inline void initial_ip(uint16_t value) initial_relative_cs inline void initial_relative_cs(uint16_t value) addressof_relocation_table inline void addressof_relocation_table(uint16_t value) overlay_number inline void overlay_number(uint16_t value) reserved inline void reserved(const reserved_t &reserved) oem_id inline void oem_id(uint16_t value) oem_info inline void oem_info(uint16_t value) reserved2 inline void reserved2(const reserved2_t &reserved2) addressof_new_exeheader inline void addressof_new_exeheader(uint32_t value) accept virtual void accept(Visitor &visitor) const override Public Static Functions create static DosHeader create( PE_TYPE type) Public Static Attributes MAGIC static uint16_t MAGIC = 0x5a4d Friends operator<< friend std::ostream &operator<<(std::ostream &os, const DosHeader &entry) Header Header class Header : public LIEF::Object Class that represents the PE header (which follows the DosHeader ). Public Types MACHINE_TYPES enum class MACHINE_TYPES Values: UNKNOWN enumerator UNKNOWN = 0x0 ALPHA enumerator ALPHA = 0x184 Alpha AXP, 32-bit address space ALPHA64 enumerator ALPHA64 = 0x284 Alpha AXP, 64-bit address space AM33 enumerator AM33 = 0x1D3 Matsushita AM33 AMD64 enumerator AMD64 = 0x8664 AMD x64 ARM enumerator ARM = 0x1C0 ARM little endian ARMNT enumerator ARMNT = 0x1C4 ARMv7 Thumb mode only ARM64 enumerator ARM64 = 0xAA64 ARMv8 in 64-bits mode EBC enumerator EBC = 0xEBC EFI byte code I386 enumerator I386 = 0x14C Intel 386 or later IA64 enumerator IA64 = 0x200 Intel Itanium processor family LOONGARCH32 enumerator LOONGARCH32 = 0x6232 LoongArch 32-bit processor family LOONGARCH64 enumerator LOONGARCH64 = 0x6264 LoongArch 64-bit processor family M32R enumerator M32R = 0x9041 Mitsubishi M32R little endian MIPS16 enumerator MIPS16 = 0x266 MIPS16 MIPSFPU enumerator MIPSFPU = 0x366 MIPS with FPU MIPSFPU16 enumerator MIPSFPU16 = 0x466 MIPS16 with FPU POWERPC enumerator POWERPC = 0x1F0 Power PC little endian POWERPCFP enumerator POWERPCFP = 0x1F1 Power PC with floating point POWERPCBE enumerator POWERPCBE = 0x1F2 Power PC big endian R4000 enumerator R4000 = 0x166 MIPS with little endian RISCV32 enumerator RISCV32 = 0x5032 RISC-V 32-bit address space RISCV64 enumerator RISCV64 = 0x5064 RISC-V 64-bit address space RISCV128 enumerator RISCV128 = 0x5128 RISC-V 128-bit address space SH3 enumerator SH3 = 0x1A2 Hitachi SH3 SH3DSP enumerator SH3DSP = 0x1A3 Hitachi SH3 DSP SH4 enumerator SH4 = 0x1A6 Hitachi SH4 SH5 enumerator SH5 = 0x1A8 Hitachi SH5 THUMB enumerator THUMB = 0x1C2 ARM or Thumb WCEMIPSV2 enumerator WCEMIPSV2 = 0x169 MIPS little-endian WCE v2 ARM64EC enumerator ARM64EC = 0xa641 ARM64X enumerator ARM64X = 0xa64e CHPE_X86 enumerator CHPE_X86 = 0x3a64 CHARACTERISTICS enum class CHARACTERISTICS Values: NONE enumerator NONE = 0x0000 RELOCS_STRIPPED enumerator RELOCS_STRIPPED = 0x0001 The file does not contain base relocations and must be loaded at its preferred base. If this cannot be done, the loader will error. EXECUTABLE_IMAGE enumerator EXECUTABLE_IMAGE = 0x0002 File is executable (i.e. no unresolved external references). LINE_NUMS_STRIPPED enumerator LINE_NUMS_STRIPPED = 0x0004 COFF line numbers have been stripped. This is deprecated and should be 0. LOCAL_SYMS_STRIPPED enumerator LOCAL_SYMS_STRIPPED = 0x0008 COFF symbol table entries for local symbols have been removed. This is deprecated and should be 0. AGGRESSIVE_WS_TRIM enumerator AGGRESSIVE_WS_TRIM = 0x0010 Aggressively trim working set. This is deprecated and must be 0. LARGE_ADDRESS_AWARE enumerator LARGE_ADDRESS_AWARE = 0x0020 Image can handle > 2GiB addresses. BYTES_REVERSED_LO enumerator BYTES_REVERSED_LO = 0x0080 Little endian: the LSB precedes the MSB in memory. This is deprecated and should be 0. NEED_32BIT_MACHINE enumerator NEED_32BIT_MACHINE = 0x0100 Machine is based on a 32bit word architecture. DEBUG_STRIPPED enumerator DEBUG_STRIPPED = 0x0200 Debugging info has been removed. REMOVABLE_RUN_FROM_SWAP enumerator REMOVABLE_RUN_FROM_SWAP = 0x0400 If the image is on removable media, fully load it and copy it to swap. NET_RUN_FROM_SWAP enumerator NET_RUN_FROM_SWAP = 0x0800 If the image is on network media, fully load it and copy it to swap. SYSTEM enumerator SYSTEM = 0x1000 The image file is a system file, not a user program. DLL enumerator DLL = 0x2000 The image file is a DLL. UP_SYSTEM_ONLY enumerator UP_SYSTEM_ONLY = 0x4000 This file should only be run on a uniprocessor machine. BYTES_REVERSED_HI enumerator BYTES_REVERSED_HI = 0x8000 Big endian: the MSB precedes the LSB in memory. This is deprecated. signature_t using signature_t = std::array Public Functions Header Header(const details::pe_header &header) ~Header ~Header() override = default operator= Header &operator=(const Header &) = default Header Header(const Header &) = default signature inline const signature_t &signature() const Signature (or magic byte) of the header. It must be: PE\\0\\0 . machine inline MACHINE_TYPES machine() const The targeted machine architecture like ARM, x86, AMD64, … numberof_sections inline uint16_t numberof_sections() const The number of sections in the binary. time_date_stamp inline uint32_t time_date_stamp() const The low 32 bits of the number of seconds since January 1, 1970. It indicates when the file was created. pointerto_symbol_table inline uint32_t pointerto_symbol_table() const The offset of the COFF symbol table. This value should be zero for an image because COFF debugging information is deprecated. numberof_symbols inline uint32_t numberof_symbols() const The number of entries in the symbol table. This data can be used to locate the string table which immediately follows the symbol table. This value should be zero for an image because COFF debugging information is deprecated. sizeof_optional_header inline uint16_t sizeof_optional_header() const Size of the OptionalHeader AND the data directories which follows this header. This value is equivalent to: sizeof(pe_optional_header) + NB_DATA_DIR * sizeof(data_directory) This size should be either: 0xE0 (224) for a PE32 (32 bits) 0xF0 (240) for a PE32+ (64 bits) characteristics inline uint32_t characteristics() const Characteristics of the binary like whether it is a DLL or an executable. has_characteristic inline bool has_characteristic( CHARACTERISTICS c) const Check if the given CHARACTERISTICS is present. characteristics_list std::vector< CHARACTERISTICS > characteristics_list() const The list of the CHARACTERISTICS . machine inline void machine( MACHINE_TYPES type) numberof_sections inline void numberof_sections(uint16_t nb) time_date_stamp inline void time_date_stamp(uint32_t timestamp) pointerto_symbol_table inline void pointerto_symbol_table(uint32_t ptr) numberof_symbols inline void numberof_symbols(uint32_t nb) sizeof_optional_header inline void sizeof_optional_header(uint16_t size) characteristics inline void characteristics(uint32_t characteristics) signature inline void signature(const signature_t &sig) add_characteristic inline void add_characteristic( CHARACTERISTICS c) remove_characteristic inline void remove_characteristic( CHARACTERISTICS c) accept virtual void accept(Visitor &visitor) const override Public Static Functions is_known_machine static bool is_known_machine(uint16_t machine) is_arm static inline bool is_arm( MACHINE_TYPES ty) is_riscv static inline bool is_riscv( MACHINE_TYPES ty) is_loonarch static inline bool is_loonarch( MACHINE_TYPES ty) is_arm64 static inline bool is_arm64( MACHINE_TYPES ty) is_thumb static inline bool is_thumb( MACHINE_TYPES ty) x86 static inline bool x86( MACHINE_TYPES ty) x86_64 static inline bool x86_64( MACHINE_TYPES ty) is_mips static inline bool is_mips( MACHINE_TYPES ty) is_ppc static inline bool is_ppc( MACHINE_TYPES ty) create static Header create( PE_TYPE type) Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Header &entry) Optional Header OptionalHeader class OptionalHeader : public LIEF::Object Class which represents the PE OptionalHeader structure. Note that the term optional comes from the COFF specifications but this header is mandatory for a PE binary. Public Types DLL_CHARACTERISTICS enum class DLL_CHARACTERISTICS : size_t Values: HIGH_ENTROPY_VA enumerator HIGH_ENTROPY_VA = 0x0020 ASLR with 64 bit address space. DYNAMIC_BASE enumerator DYNAMIC_BASE = 0x0040 DLL can be relocated at load time. FORCE_INTEGRITY enumerator FORCE_INTEGRITY = 0x0080 Code integrity checks are enforced. NX_COMPAT enumerator NX_COMPAT = 0x0100 Image is NX compatible. NO_ISOLATION enumerator NO_ISOLATION = 0x0200 Isolation aware, but do not isolate the image. NO_SEH enumerator NO_SEH = 0x0400 Does not use structured exception handling (SEH). No SEH handler may be called in this image. NO_BIND enumerator NO_BIND = 0x0800 Do not bind the image. APPCONTAINER enumerator APPCONTAINER = 0x1000 Image should execute in an AppContainer. WDM_DRIVER enumerator WDM_DRIVER = 0x2000 A WDM driver. GUARD_CF enumerator GUARD_CF = 0x4000 Image supports Control Flow Guard. TERMINAL_SERVER_AWARE enumerator TERMINAL_SERVER_AWARE = 0x8000 Terminal Server aware. SUBSYSTEM enum class SUBSYSTEM : size_t Values: UNKNOWN enumerator UNKNOWN = 0 An unknown subsystem. NATIVE enumerator NATIVE = 1 Device drivers and native Windows processes. WINDOWS_GUI enumerator WINDOWS_GUI = 2 The Windows GUI subsystem. WINDOWS_CUI enumerator WINDOWS_CUI = 3 The Windows character subsystem. OS2_CUI enumerator OS2_CUI = 5 The OS/2 character subsystem. POSIX_CUI enumerator POSIX_CUI = 7 The POSIX character subsystem. NATIVE_WINDOWS enumerator NATIVE_WINDOWS = 8 Native Windows 9x driver. WINDOWS_CE_GUI enumerator WINDOWS_CE_GUI = 9 Windows CE. EFI_APPLICATION enumerator EFI_APPLICATION = 10 An EFI application. EFI_BOOT_SERVICE_DRIVER enumerator EFI_BOOT_SERVICE_DRIVER = 11 An EFI driver with boot services. EFI_RUNTIME_DRIVER enumerator EFI_RUNTIME_DRIVER = 12 An EFI driver with run-time services. EFI_ROM enumerator EFI_ROM = 13 An EFI ROM image. XBOX enumerator XBOX = 14 XBOX. WINDOWS_BOOT_APPLICATION enumerator WINDOWS_BOOT_APPLICATION = 16 A BCD application. XBOX_CODE_CATALOG enumerator XBOX_CODE_CATALOG = 17 Security Metadata Containers. Public Functions OptionalHeader OptionalHeader(const details::pe32_optional_header &header) OptionalHeader OptionalHeader(const details::pe64_optional_header &header) ~OptionalHeader ~OptionalHeader() override = default operator= OptionalHeader &operator=(const OptionalHeader &) = default OptionalHeader OptionalHeader(const OptionalHeader &) = default magic inline PE_TYPE magic() const Magic bytes: either PE32 or PE32+ for 64-bits PE files. major_linker_version inline uint8_t major_linker_version() const The linker major version. minor_linker_version inline uint8_t minor_linker_version() const The linker minor version. sizeof_code inline uint32_t sizeof_code() const The size of the code .text section or the sum of all the sections that contain code (i.e. PE::Section with the flag Section::CHARACTERISTICS::CNT_CODE ). sizeof_initialized_data inline uint32_t sizeof_initialized_data() const The size of the initialized data which are usually located in the .data section. If the initialized data are split across multiple sections, it is the sum of the sections. The sections associated with the initialized data are usually identified with the flag Section::CHARACTERISTICS::CNT_INITIALIZED_DATA sizeof_uninitialized_data inline uint32_t sizeof_uninitialized_data() const The size of the uninitialized data which are usually located in the .bss section. If the uninitialized data are split across multiple sections, it is the sum of the sections. The sections associated with the uninitialized data are usually identified with the flag Section::CHARACTERISTICS::CNT_UNINITIALIZED_DATA addressof_entrypoint inline uint32_t addressof_entrypoint() const The address of the entry point relative to the image base when the executable file is loaded into memory. For program images, this is the starting address. For device drivers, this is the address of the initialization function. An entry point is optional for DLLs. When no entry point is present, this field must be zero. baseof_code inline uint32_t baseof_code() const Address relative to the imagebase where the binary’s code starts. baseof_data inline uint32_t baseof_data() const Address relative to the imagebase where the binary’s data starts. Warning This value is not present for PE64 files imagebase inline uint64_t imagebase() const The preferred base address when mapping the binary in memory. section_alignment inline uint32_t section_alignment() const The alignment (in bytes) of sections when they are loaded into memory. It must be greater than or equal to file_alignment and the default is the page size for the architecture. file_alignment inline uint32_t file_alignment() const The section’s file alignment. This value must be a power of 2 between 512 and 64K. The default value is usually 512. major_operating_system_version inline uint16_t major_operating_system_version() const The major version number of the required operating system. minor_operating_system_version inline uint16_t minor_operating_system_version() const The minor version number of the required operating system. major_image_version inline uint16_t major_image_version() const The major version number of the image. minor_image_version inline uint16_t minor_image_version() const The minor version number of the image. major_subsystem_version inline uint16_t major_subsystem_version() const The major version number of the subsystem. minor_subsystem_version inline uint16_t minor_subsystem_version() const The minor version number of the subsystem. win32_version_value inline uint32_t win32_version_value() const According to the official PE specifications, this value is reserved and should be 0. sizeof_image inline uint32_t sizeof_image() const The size (in bytes) of the image, including all headers, as the image is loaded in memory. It must be a multiple of section_alignment and should match Binary::virtual_size sizeof_headers inline uint32_t sizeof_headers() const Size of the DosHeader + PE Header + Section headers rounded up to a multiple of the file_alignment. checksum inline uint32_t checksum() const The image file checksum. The algorithm for computing the checksum is incorporated into IMAGHELP.DLL . The following are checked for validation at load time all drivers , any DLL loaded at boot time, and any DLL that is loaded into a critical Windows process. subsystem inline SUBSYSTEM subsystem() const Target subsystem like Driver, XBox, Windows GUI, … dll_characteristics inline uint32_t dll_characteristics() const Some characteristics of the underlying binary like the support of the PIE. The prefix dll comes from the official PE specifications but these characteristics are also used for executables . sizeof_stack_reserve inline uint64_t sizeof_stack_reserve() const Size of the stack to reserve when loading the PE binary. Only OptionalHeader::sizeof_stack_commit is committed, the rest is made available one page at a time until the reserve size is reached. sizeof_stack_commit inline uint64_t sizeof_stack_commit() const Size of the stack to commit. sizeof_heap_reserve inline uint64_t sizeof_heap_reserve() const Size of the heap to reserve when loading the PE binary. sizeof_heap_commit inline uint64_t sizeof_heap_commit() const Size of the heap to commit. loader_flags inline uint32_t loader_flags() const According to the PE specifications, this value is reserved and should be 0. numberof_rva_and_size inline uint32_t numberof_rva_and_size() const The number of DataDirectory that follow this header. has inline bool has( DLL_CHARACTERISTICS c) const Check if the given DLL_CHARACTERISTICS is included in the dll_characteristics. dll_characteristics_list std::vector< DLL_CHARACTERISTICS > dll_characteristics_list() const Return the list of the dll_characteristics as an std::set of DLL_CHARACTERISTICS . add inline void add( DLL_CHARACTERISTICS c) Add a DLL_CHARACTERISTICS to the current characteristics. remove inline void remove( DLL_CHARACTERISTICS c) Remove a DLL_CHARACTERISTICS from the current characteristics. magic inline void magic( PE_TYPE magic) major_linker_version inline void major_linker_version(uint8_t value) minor_linker_version inline void minor_linker_version(uint8_t value) sizeof_code inline void sizeof_code(uint32_t value) sizeof_initialized_data inline void sizeof_initialized_data(uint32_t value) sizeof_uninitialized_data inline void sizeof_uninitialized_data(uint32_t value) addressof_entrypoint inline void addressof_entrypoint(uint32_t value) baseof_code inline void baseof_code(uint32_t value) baseof_data inline void baseof_data(uint32_t value) imagebase inline void imagebase(uint64_t value) section_alignment inline void section_alignment(uint32_t value) file_alignment inline void file_alignment(uint32_t value) major_operating_system_version inline void major_operating_system_version(uint16_t value) minor_operating_system_version inline void minor_operating_system_version(uint16_t value) major_image_version inline void major_image_version(uint16_t value) minor_image_version inline void minor_image_version(uint16_t value) major_subsystem_version inline void major_subsystem_version(uint16_t value) minor_subsystem_version inline void minor_subsystem_version(uint16_t value) win32_version_value inline void win32_version_value(uint32_t value) sizeof_image inline void sizeof_image(uint32_t value) sizeof_headers inline void sizeof_headers(uint32_t value) checksum inline void checksum(uint32_t value) subsystem inline void subsystem( SUBSYSTEM value) dll_characteristics inline void dll_characteristics(uint32_t value) sizeof_stack_reserve inline void sizeof_stack_reserve(uint64_t value) sizeof_stack_commit inline void sizeof_stack_commit(uint64_t value) sizeof_heap_reserve inline void sizeof_heap_reserve(uint64_t value) sizeof_heap_commit inline void sizeof_heap_commit(uint64_t value) loader_flags inline void loader_flags(uint32_t value) numberof_rva_and_size inline void numberof_rva_and_size(uint32_t value) accept virtual void accept(Visitor &visitor) const override operator+= inline OptionalHeader &operator+=( DLL_CHARACTERISTICS c) operator-= inline OptionalHeader &operator-=( DLL_CHARACTERISTICS c) Public Static Functions create static OptionalHeader create( PE_TYPE type) Friends operator<< friend std::ostream &operator<<(std::ostream &os, const OptionalHeader &entry) Data Directory DataDirectory class DataDirectory : public LIEF::Object Class that represents a PE data directory entry. Public Types TYPES enum class TYPES : uint32_t Values: EXPORT_TABLE enumerator EXPORT_TABLE = 0 IMPORT_TABLE enumerator IMPORT_TABLE RESOURCE_TABLE enumerator RESOURCE_TABLE EXCEPTION_TABLE enumerator EXCEPTION_TABLE CERTIFICATE_TABLE enumerator CERTIFICATE_TABLE BASE_RELOCATION_TABLE enumerator BASE_RELOCATION_TABLE DEBUG_DIR enumerator DEBUG_DIR ARCHITECTURE enumerator ARCHITECTURE GLOBAL_PTR enumerator GLOBAL_PTR TLS_TABLE enumerator TLS_TABLE LOAD_CONFIG_TABLE enumerator LOAD_CONFIG_TABLE BOUND_IMPORT enumerator BOUND_IMPORT IAT enumerator IAT DELAY_IMPORT_DESCRIPTOR enumerator DELAY_IMPORT_DESCRIPTOR CLR_RUNTIME_HEADER enumerator CLR_RUNTIME_HEADER RESERVED enumerator RESERVED UNKNOWN enumerator UNKNOWN Public Functions DataDirectory DataDirectory() = default DataDirectory inline DataDirectory( TYPES type) DataDirectory DataDirectory(const details::pe_data_directory &header, TYPES type) DataDirectory DataDirectory(const DataDirectory &other) = default operator= DataDirectory &operator=(const DataDirectory &other) = default DataDirectory DataDirectory( DataDirectory &&other) noexcept = default operator= DataDirectory &operator=( DataDirectory &&other) noexcept = default ~DataDirectory ~DataDirectory() override = default RVA inline uint32_t RVA() const The relative virtual address of the content of this data directory. size inline uint32_t size() const The size of the content. has_section inline bool has_section() const Check if the content of this data directory is associated with a PE Section . content inline span content() const Raw content (bytes) referenced by this data directory. content span content() section inline Section *section() Section associated with the DataDirectory . section inline const Section *section() const type inline TYPES type() const Type of the data directory. size inline void size(uint32_t size) RVA inline void RVA(uint32_t rva) accept virtual void accept(Visitor &visitor) const override Public Static Attributes DEFAULT_NB static size_t DEFAULT_NB = 16 Friends operator<< friend std::ostream &operator<<(std::ostream &os, const DataDirectory &entry) Section Section class Section : public LIEF:: Section Class which represents a PE section. Public Types CHARACTERISTICS enum class CHARACTERISTICS : uint64_t Values: TYPE_NO_PAD enumerator TYPE_NO_PAD = 0x00000008 CNT_CODE enumerator CNT_CODE = 0x00000020 CNT_INITIALIZED_DATA enumerator CNT_INITIALIZED_DATA = 0x00000040 CNT_UNINITIALIZED_DATA enumerator CNT_UNINITIALIZED_DATA = 0x00000080 LNK_OTHER enumerator LNK_OTHER = 0x00000100 LNK_INFO enumerator LNK_INFO = 0x00000200 LNK_REMOVE enumerator LNK_REMOVE = 0x00000800 LNK_COMDAT enumerator LNK_COMDAT = 0x00001000 GPREL enumerator GPREL = 0x00008000 MEM_PURGEABLE enumerator MEM_PURGEABLE = 0x00010000 MEM_16BIT enumerator MEM_16BIT = 0x00020000 MEM_LOCKED enumerator MEM_LOCKED = 0x00040000 MEM_PRELOAD enumerator MEM_PRELOAD = 0x00080000 ALIGN_1BYTES enumerator ALIGN_1BYTES = 0x00100000 ALIGN_2BYTES enumerator ALIGN_2BYTES = 0x00200000 ALIGN_4BYTES enumerator ALIGN_4BYTES = 0x00300000 ALIGN_8BYTES enumerator ALIGN_8BYTES = 0x00400000 ALIGN_16BYTES enumerator ALIGN_16BYTES = 0x00500000 ALIGN_32BYTES enumerator ALIGN_32BYTES = 0x00600000 ALIGN_64BYTES enumerator ALIGN_64BYTES = 0x00700000 ALIGN_128BYTES enumerator ALIGN_128BYTES = 0x00800000 ALIGN_256BYTES enumerator ALIGN_256BYTES = 0x00900000 ALIGN_512BYTES enumerator ALIGN_512BYTES = 0x00A00000 ALIGN_1024BYTES enumerator ALIGN_1024BYTES = 0x00B00000 ALIGN_2048BYTES enumerator ALIGN_2048BYTES = 0x00C00000 ALIGN_4096BYTES enumerator ALIGN_4096BYTES = 0x00D00000 ALIGN_8192BYTES enumerator ALIGN_8192BYTES = 0x00E00000 LNK_NRELOC_OVFL enumerator LNK_NRELOC_OVFL = 0x01000000 MEM_DISCARDABLE enumerator MEM_DISCARDABLE = 0x02000000 MEM_NOT_CACHED enumerator MEM_NOT_CACHED = 0x04000000 MEM_NOT_PAGED enumerator MEM_NOT_PAGED = 0x08000000 MEM_SHARED enumerator MEM_SHARED = 0x10000000 MEM_EXECUTE enumerator MEM_EXECUTE = 0x20000000 MEM_READ enumerator MEM_READ = 0x40000000 MEM_WRITE enumerator MEM_WRITE = 0x80000000 Public Functions Section Section(const details::pe_section &header) Section Section() = default Section inline Section(std::string name) Section inline Section(std::string name, std::vector content) operator= Section &operator=(const Section &) = default Section Section(const Section &) = default ~Section ~Section() override = default sizeof_raw_data uint32_t sizeof_raw_data() const Return the size of the data in the section. virtual_size inline uint32_t virtual_size() const Return the size of the data when mapped in memory. If this value is greater than sizeof_raw_data, the section is zero-padded. content inline virtual span content() const override The actual content of the section. padding inline span padding() const Content of the section’s padding area. pointerto_raw_data uint32_t pointerto_raw_data() const The offset of the section data in the PE file. pointerto_relocation inline uint32_t pointerto_relocation() const The file pointer to the beginning of the COFF relocation entries for the section. This is set to zero for executable images or if there are no relocations. For modern PE binaries, this value is usually set to 0 as the relocations are managed by PE::Relocation . pointerto_line_numbers inline uint32_t pointerto_line_numbers() const The file pointer to the beginning of line-number entries for the section. This is set to zero if there are no COFF line numbers. This value should be zero for an image because COFF debugging information is deprecated and modern debug information relies on the PDB files. numberof_relocations inline uint16_t numberof_relocations() const No longer used in recent PE binaries produced by Visual Studio. numberof_line_numbers inline uint16_t numberof_line_numbers() const No longer used in recent PE binaries produced by Visual Studio. characteristics inline uint32_t characteristics() const Characteristics of the section: it provides information about the permissions of the section when mapped. It can also provide information about the purpose of the section (contain code, BSS-like, …). has_characteristic inline bool has_characteristic( CHARACTERISTICS c) const Check if the section has the given CHARACTERISTICS . characteristics_list inline std::vector< CHARACTERISTICS > characteristics_list() const List of the section characteristics. is_discardable inline bool is_discardable() const True if the section can be discarded as needed. This is typically the case for debug-related sections clear void clear(uint8_t c) Fill the content of the section with the given char . content virtual void content(const std::vector &data) override Change section content. name virtual void name(std::string name) override Change the section’s name. virtual_size inline void virtual_size(uint32_t virtual_sz) pointerto_raw_data inline void pointerto_raw_data(uint32_t ptr) pointerto_relocation inline void pointerto_relocation(uint32_t ptr) pointerto_line_numbers inline void pointerto_line_numbers(uint32_t ptr) numberof_relocations inline void numberof_relocations(uint16_t nb) numberof_line_numbers inline void numberof_line_numbers(uint16_t nb) sizeof_raw_data inline void sizeof_raw_data(uint32_t size) characteristics inline void characteristics(uint32_t characteristics) coff_string inline COFF:: String *coff_string() Return the COFF string associated with the section’s name (or a nullptr). This coff string is usually present for long section names whose length does not fit in the 8 bytes allocated by the PE format. coff_string inline const COFF:: String *coff_string() const remove_characteristic inline Section &remove_characteristic( CHARACTERISTICS characteristic) add_characteristic inline Section &add_characteristic( CHARACTERISTICS characteristic) stream std::unique_ptr< SpanStream > stream() const writable_content inline span writable_content() accept virtual void accept(Visitor &visitor) const override name inline virtual std::string_view name() const Section ’s name. Public Static Functions characteristics_to_list static std::vector< CHARACTERISTICS > characteristics_to_list(uint32_t value) Public Static Attributes MAX_SECTION_NAME static size_t MAX_SECTION_NAME = 8 Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Section §ion) Import Import class Import : public LIEF::Object Class that represents a PE import. Public Types entries_t using entries_t = std::vector> it_entries using it_entries = ref_iterator < entries_t &, ImportEntry *> it_const_entries using it_const_entries = const_ref_iterator Public Functions Import Import(const details::pe_import &import) Import inline Import(std::string name) Import Import() = default ~Import ~Import() override = default Import Import(const Import &other) operator= Import &operator=(const Import &other) Import Import( Import &&other) noexcept = default operator= Import &operator=( Import &&other) noexcept = default forwarder_chain inline uint32_t forwarder_chain() const The index of the first forwarder reference. timedatestamp inline uint32_t timedatestamp() const The stamp that is set to zero until the image is bound. After the image is bound, this field is set to the time/data stamp of the DLL. entries inline it_const_entries entries() const Iterator over the PE::ImportEntry . entries inline it_entries entries() import_address_table_rva inline uint32_t import_address_table_rva() const The RVA of the import address table ( IAT ). The content of this table is identical to the content of the Import Lookup Table ( ILT ) until the image is bound. Warning This address could change when re-building the binary import_lookup_table_rva inline uint32_t import_lookup_table_rva() const Return the relative virtual address of the import lookup table. Warning This address could change when re-building the binary get_function_rva_from_iat result get_function_rva_from_iat(const std::string &function) const Return the Function ’s RVA from the import address table ( IAT ). Warning This address could change when re-building the binary get_entry inline ImportEntry *get_entry(const std::string &name) Return the imported function with the given name. get_entry const ImportEntry *get_entry(const std::string &name) const name inline std::string_view name() const Return the library’s name (e.g. kernel32.dll ). name inline void name(std::string name) Change the current import name. name_rva inline uint32_t name_rva() const The original name rva. directory inline DataDirectory *directory() Return the PE::DataDirectory associated with this import. It should be the one at index PE::DataDirectory::TYPES::IMPORT_TABLE . If the data directory can’t be found, return a nullptr directory inline const DataDirectory *directory() const iat_directory inline DataDirectory *iat_directory() Return the PE::DataDirectory associated with the IAT. It should be the one at index PE::DataDirectory::TYPES::IAT . If the data directory can’t be found, return a nullptr iat_directory inline const DataDirectory *iat_directory() const add_entry inline ImportEntry &add_entry(const ImportEntry &entry) Add a new import entry (i.e. an imported function). add_entry inline ImportEntry &add_entry(const std::string &name) Add a new import entry with the given name (i.e. an imported function). remove_entry bool remove_entry(const std::string &name) Remove the import entry with the given name. Return true if the deletion succeeded, false otherwise remove_entry bool remove_entry(uint32_t ordinal) Remove the import entry with the given ordinal number. Return true if the deletion succeeded, false otherwise import_lookup_table_rva inline void import_lookup_table_rva(uint32_t rva) import_address_table_rva inline void import_address_table_rva(uint32_t rva) accept virtual void accept(Visitor &visitor) const override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Import &entry) Import Entry ImportEntry class ImportEntry : public LIEF:: Symbol Class that represents an entry (i.e. an import) in the import table ( Import ). It extends the LIEF::Symbol generic class that exposes the LIEF::Symbol::name and LIEF::Symbol::value API Public Functions ImportEntry ImportEntry() = default ImportEntry inline ImportEntry(uint64_t data, PE_TYPE type) ImportEntry inline ImportEntry(std::string name) ImportEntry ImportEntry(const ImportEntry &) = default operator= ImportEntry &operator=(const ImportEntry &) = default ~ImportEntry ~ImportEntry() override = default demangled_name std::string demangled_name() const Demangled representation of the symbol or an empty string if it can’t be demangled. is_ordinal bool is_ordinal() const True if it is an import by ordinal ordinal inline uint16_t ordinal() const The ordinal value. hint_name_rva inline uint64_t hint_name_rva() const See also ImportEntry::data hint inline uint16_t hint() const Index into the Export::entries that is used to speed-up the symbol resolution. iat_value inline uint64_t iat_value() const Value of the current entry in the Import Address Table. It should match the lookup table value. iat_value inline void iat_value(uint64_t value) ilt_value inline uint64_t ilt_value() const Original value in the import lookup table. This value should match the iat_value() . ilt_value inline void ilt_value(uint64_t value) data inline uint64_t data() const Raw value. iat_address inline uint64_t iat_address() const Original address of the entry in the Import Address Table data inline void data(uint64_t data) accept virtual void accept(Visitor &visitor) const override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const ImportEntry &entry) Delay Import DelayImport class DelayImport : public LIEF::Object Class that represents a PE delayed import. Public Types entries_t using entries_t = std::vector> it_entries using it_entries = ref_iterator < entries_t &, DelayImportEntry *> it_const_entries using it_const_entries = const_ref_iterator Public Functions DelayImport DelayImport() = default DelayImport DelayImport(const details::delay_imports &import, PE_TYPE type) DelayImport inline DelayImport(std::string name) ~DelayImport ~DelayImport() override = default DelayImport DelayImport(const DelayImport &other) operator= inline DelayImport &operator=( DelayImport other) DelayImport DelayImport( DelayImport &&) noexcept = default operator= DelayImport &operator=( DelayImport &&) noexcept = default swap void swap( DelayImport &other) attribute inline uint32_t attribute() const According to the official PE specifications, this value is reserved and should be set to 0. attribute inline void attribute(uint32_t hdl) name inline std::string_view name() const Return the library’s name (e.g. kernel32.dll ). name inline void name(std::string name) handle inline uint32_t handle() const The RVA of the module handle (in the .data section) It is used for storage by the routine that is supplied to manage delay-loading. handle inline void handle(uint32_t hdl) iat inline uint32_t iat() const RVA of the delay-load import address table. iat inline void iat(uint32_t iat) names_table inline uint32_t names_table() const RVA of the delay-load import names table. The content of this table has the layout as the Import lookup table. names_table inline void names_table(uint32_t value) biat inline uint32_t biat() const RVA of the bound delay-load import address table or 0 if the table does not exist. biat inline void biat(uint32_t value) uiat inline uint32_t uiat() const RVA of the unload delay-load import address table or 0 if the table does not exist. According to the PE specifications, this table is an exact copy of the delay import address table that can be used to restore the original IAT in the case of unloading. uiat inline void uiat(uint32_t value) timestamp inline uint32_t timestamp() const The timestamp of the DLL to which this image has been bound. timestamp inline void timestamp(uint32_t value) entries inline it_entries entries() Iterator over the DelayImport ’s entries ( DelayImportEntry ). entries inline it_const_entries entries() const Iterator over the DelayImport ’s entries ( DelayImportEntry ). accept virtual void accept(Visitor &visitor) const override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const DelayImport &entry) Delay Import Entry DelayImportEntry class DelayImportEntry : public LIEF:: Symbol Class that represents an entry (i.e. an import) in the delay import table ( DelayImport ). It extends the LIEF::Symbol generic class that exposes the LIEF::Symbol::name and LIEF::Symbol::value API. The meaning of LIEF::Symbol::value for this PE object is the address (as an RVA) in the IAT where the resolution should take place. Public Functions DelayImportEntry DelayImportEntry() = default DelayImportEntry inline DelayImportEntry(uint64_t data, PE_TYPE type) DelayImportEntry DelayImportEntry(const DelayImportEntry &) = default operator= DelayImportEntry &operator=(const DelayImportEntry &) = default DelayImportEntry DelayImportEntry( DelayImportEntry &&) noexcept = default operator= DelayImportEntry &operator=( DelayImportEntry &&) noexcept = default ~DelayImportEntry ~DelayImportEntry() override = default demangled_name std::string demangled_name() const Demangled representation of the symbol or an empty string if it can’t be demangled. is_ordinal bool is_ordinal() const True if it is an import by ordinal ordinal inline uint16_t ordinal() const The ordinal value. hint_name_rva inline uint64_t hint_name_rva() const See also DelayImportEntry::data hint inline uint16_t hint() const Index into the Export::entries that is used to speed-up the symbol resolution. iat_value inline uint64_t iat_value() const Value of the current entry in the Import Address Table. data inline uint64_t data() const Raw value. data inline void data(uint64_t data) accept virtual void accept(Visitor &visitor) const override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const DelayImportEntry &entry) TLS TLS class TLS : public LIEF::Object Class which represents the PE Thread Local Storage. This PE structure is also used to implement binary/library constructors. Public Functions TLS TLS() = default TLS TLS(const details::pe32_tls &header) TLS TLS(const details::pe64_tls &header) ~TLS ~TLS() override = default TLS TLS(const TLS ©) = default operator= TLS &operator=(const TLS ©) = default TLS TLS( TLS &&other) noexcept = default operator= TLS &operator=( TLS &&other) noexcept = default callbacks inline const std::vector &callbacks() const List of the callbacks associated with the current TLS . These functions are called before any other functions. add_callback inline TLS &add_callback(uint64_t addr) Add a new TLS callback. addressof_raw_data inline const std::pair &addressof_raw_data() const Pair (start address, end address) of the TLS template. The template is a block of data that is used to initialize TLS data. The system copies all of this data each time a thread is created, so it must not be corrupted. Note These addresses are not RVA. They are addresses for which there should be a rebase relocation in the .reloc section. addressof_index inline uint64_t addressof_index() const The location to receive the TLS index assigned by the loader. This location should be located in a writable section like .data . addressof_callbacks inline uint64_t addressof_callbacks() const Pointer to an array of TLS callback functions. The array is null-terminated, so if there is no callback function this field points to 4 bytes set to zero. sizeof_zero_fill inline uint32_t sizeof_zero_fill() const Size in bytes of the zero to be padded after the data specified by data_template. characteristics inline uint32_t characteristics() const The four bits [23:20] describe alignment info. Possible values are those defined as IMAGE_SCN_ALIGN_* , which are also used to describe alignment of section in object files. The other 28 bits are reserved for future use. data_template inline span data_template() const The initial content used to initialize TLS data. has_data_directory inline bool has_data_directory() const True if there is a data directory associated with this entry. directory inline DataDirectory *directory() Return the DataDirectory associated with this object or a nullptr If it exists, its type should be DataDirectory::TYPES::TLS_TABLE . directory inline const DataDirectory *directory() const has_section inline bool has_section() const Check if there is a section associated with this entry. section inline Section *section() The section associated with the entry (or a nullptr). section inline const Section *section() const callbacks inline void callbacks(std::vector callbacks) addressof_raw_data inline void addressof_raw_data(std::pair addresses) addressof_index inline void addressof_index(uint64_t addr_idx) addressof_callbacks inline void addressof_callbacks(uint64_t addr) sizeof_zero_fill inline void sizeof_zero_fill(uint32_t size) characteristics inline void characteristics(uint32_t characteristics) data_template inline void data_template(std::vector data_template) accept virtual void accept(Visitor &visitor) const override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const TLS &entry) Debug Debug class Debug : public LIEF::Object This class represents a generic entry in the debug data directory. For known types, this class is extended to provide a dedicated API (see: CodeView ). Subclassed by LIEF::PE::CodeView , LIEF::PE::ExDllCharacteristics , LIEF::PE::FPO , LIEF::PE::PDBChecksum , LIEF::PE::Pogo , LIEF::PE::Repro , LIEF::PE::VCFeature Public Types TYPES enum class TYPES The entry types. Values: UNKNOWN enumerator UNKNOWN = 0 COFF enumerator COFF = 1 COFF Debug information. CODEVIEW enumerator CODEVIEW = 2 CodeView debug information that is used to store PDB info. FPO enumerator FPO = 3 Frame pointer omission information. MISC enumerator MISC = 4 Miscellaneous debug information. EXCEPTION enumerator EXCEPTION = 5 Debug information that is a copy of the .pdata section. FIXUP enumerator FIXUP = 6 (Reserved) Debug information used for fixup relocations OMAP_TO_SRC enumerator OMAP_TO_SRC = 7 The mapping from an RVA in image to an RVA in source image. OMAP_FROM_SRC enumerator OMAP_FROM_SRC = 8 The mapping from an RVA in source image to an RVA in image. BORLAND enumerator BORLAND = 9 Reserved for Borland. RESERVED10 enumerator RESERVED10 = 10 Reserved. CLSID enumerator CLSID = 11 Reserved. VC_FEATURE enumerator VC_FEATURE = 12 Visual C++ feature information. POGO enumerator POGO = 13 Profile Guided Optimization metadata. ILTCG enumerator ILTCG = 14 Incremental Link Time Code Generation metadata. MPX enumerator MPX = 15 REPRO enumerator REPRO = 16 PE determinism or reproducibility information. PDBCHECKSUM enumerator PDBCHECKSUM = 19 Checksum of the PDB file. EX_DLLCHARACTERISTICS enumerator EX_DLLCHARACTERISTICS = 20 Extended DLL characteristics. Public Functions Debug Debug() = default Debug inline Debug( TYPES type) Debug Debug(const details::pe_debug &debug_s, Section *section) Debug Debug(const Debug &other) = default operator= Debug &operator=(const Debug &other) = default Debug Debug( Debug &&) = default operator= Debug &operator=( Debug &&) = default ~Debug ~Debug() override = default clone inline virtual std::unique_ptr< Debug > clone() const characteristics inline uint32_t characteristics() const Reserved should be 0. timestamp inline uint32_t timestamp() const The time and date when the debug data was created. major_version inline uint16_t major_version() const The major version number of the debug data format. minor_version inline uint16_t minor_version() const The minor version number of the debug data format. type inline TYPES type() const The format DEBUG_TYPES of the debugging information. sizeof_data inline uint32_t sizeof_data() const Size of the debug data. addressof_rawdata inline uint32_t addressof_rawdata() const Address of the debug data relative to the image base. pointerto_rawdata inline uint32_t pointerto_rawdata() const File offset of the debug data. section inline const Section *section() const The section where debug data is located. section inline Section *section() payload span payload() Debug data associated with this entry. payload inline span payload() const characteristics inline void characteristics(uint32_t characteristics) timestamp inline void timestamp(uint32_t timestamp) major_version inline void major_version(uint16_t major_version) minor_version inline void minor_version(uint16_t minor_version) sizeof_data inline void sizeof_data(uint32_t sizeof_data) addressof_rawdata inline void addressof_rawdata(uint32_t addressof_rawdata) pointerto_rawdata inline void pointerto_rawdata(uint32_t pointerto_rawdata) Tas template inline const T *as() const Tas template inline T *as() accept virtual void accept(Visitor &visitor) const override to_string virtual std::string to_string() const Public Static Functions get_payload static span get_payload( Section §ion, uint32_t rva, uint32_t offset, uint32_t size) get_payload static span get_payload( Section §ion, const details::pe_debug &hdr) get_payload static inline span get_payload( Section §ion, const Debug &dbg) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Debug &entry) Code View CodeView class CodeView : public LIEF::PE:: Debug Interface for the (generic) Debug CodeView ( IMAGE_DEBUG_TYPE_CODEVIEW ). Subclassed by LIEF::PE::CodeViewPDB Public Types SIGNATURES enum class SIGNATURES Code view signatures. See also : http://llvm.org/doxygen/CVDebugRecord_8h_source.html Values: UNKNOWN enumerator UNKNOWN = 0 PDB_70 enumerator PDB_70 = 0x53445352 PDB_20 enumerator PDB_20 = 0x3031424e CV_50 enumerator CV_50 = 0x3131424e CV_41 enumerator CV_41 = 0x3930424e Public Functions CodeView inline CodeView() CodeView inline CodeView( SIGNATURES sig) CodeView inline CodeView(const details::pe_debug &debug, SIGNATURES sig, Section *sec) CodeView CodeView(const CodeView &other) = default operator= CodeView &operator=(const CodeView &other) = default CodeView CodeView( CodeView &&other) = default operator= CodeView &operator=( CodeView &&other) = default ~CodeView ~CodeView() override = default signature inline SIGNATURES signature() const The signature that defines the underlying type of the payload. clone inline virtual std::unique_ptr< Debug > clone() const override to_string virtual std::string to_string() const override accept virtual void accept(Visitor &visitor) const override Public Static Functions classof static inline bool classof(const Debug *debug) Code View PDB CodeViewPDB class CodeViewPDB : public LIEF::PE:: CodeView CodeView PDB specialization. Public Types signature_t using signature_t = std::array Public Functions CodeViewPDB inline CodeViewPDB() CodeViewPDB inline CodeViewPDB(std::string filename) CodeViewPDB CodeViewPDB(const details::pe_debug &debug_info, const details::pe_pdb_70 &pdb_70, Section *sec) CodeViewPDB CodeViewPDB(const details::pe_debug &debug_info, const details::pe_pdb_20 &pdb_70, Section *sec) CodeViewPDB CodeViewPDB(const CodeViewPDB &other) = default operator= CodeViewPDB &operator=(const CodeViewPDB &other) = default CodeViewPDB CodeViewPDB( CodeViewPDB &&other) = default operator= CodeViewPDB &operator=( CodeViewPDB &&other) = default guid std::string guid() const The GUID signature to verify against the .pdb file signature. This attribute might be used to lookup remote PDB file on a symbol server. age inline uint32_t age() const Age value to verify. The age does not necessarily correspond to any known time value, it is used to determine if a .pdb file is out of sync with corresponding .exe file. signature inline const signature_t &signature() const The 32-bit signature to verify against the .pdb file signature. filename inline std::string_view filename() const The path to the .pdb file. age inline void age(uint32_t age) signature inline void signature(const signature_t &sig) filename inline void filename(std::string filename) clone inline virtual std::unique_ptr< Debug > clone() const override accept virtual void accept(Visitor &visitor) const override to_string virtual std::string to_string() const override ~CodeViewPDB ~CodeViewPDB() override = default Public Static Functions classof static inline bool classof(const Debug *debug) Relocation Relocation class Relocation : public LIEF::Object Class which represents the Base Relocation Block We usually find this structure in the .reloc section. Public Types entries_t using entries_t = std::vector> it_entries using it_entries = ref_iterator < entries_t &, RelocationEntry *> it_const_entries using it_const_entries = const_ref_iterator relocations_t using relocations_t = std::vector> Public Functions Relocation Relocation() Relocation Relocation(uint32_t base, uint32_t block_size) Relocation Relocation(uint32_t base) Relocation Relocation(const Relocation &other) operator= Relocation &operator=( Relocation other) Relocation Relocation( Relocation &&) operator= Relocation &operator=( Relocation &&other) Relocation Relocation(const details::pe_base_relocation_block &header) ~Relocation ~Relocation() override swap void swap( Relocation &other) virtual_address inline uint32_t virtual_address() const The RVA for which the offset of the relocation entries ( RelocationEntry ) is added. block_size inline uint32_t block_size() const The total number of bytes in the base relocation block. block_size = sizeof(BaseRelocationBlock) + nb_of_relocs * sizeof(uint16_t = RelocationEntry) entries inline it_const_entries entries() const Iterator over the RelocationEntry . entries inline it_entries entries() virtual_address inline void virtual_address(uint32_t virtual_address) block_size inline void block_size(uint32_t block_size) add_entry RelocationEntry &add_entry(const RelocationEntry &entry) accept virtual void accept(Visitor &visitor) const override Public Static Functions parse static relocations_t parse( Parser &ctx, BinaryStream &stream) Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Relocation &relocation) Relocation Entry RelocationEntry class RelocationEntry : public LIEF:: Relocation Class which represents an entry of the PE relocation table. It extends the LIEF::Relocation object to provide a uniform API across the file formats Public Types BASE_TYPES enum class BASE_TYPES Relocation type as described in https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#base-relocation-types . Values: UNKNOWN enumerator UNKNOWN = -1 ABS enumerator ABS = 0 This value matches: IMAGE_REL_BASED_ABSOLUTE The base relocation is skipped. This type can be used to pad a block. HIGH enumerator HIGH = 1 This value matches: IMAGE_REL_BASED_HIGH The base relocation adds the high 16 bits of the difference to the 16-bit field at offset. The 16-bit field represents the high value of a 32-bit word. Operation: write(ADDR, ((read(ADDR) << 16) + DELTA) >> 16) LOW enumerator LOW = 2 The base relocation adds the low 16 bits of the difference to the 16-bit field at offset. The 16-bit field represents the low half of a 32-bit word. Operation: write(ADDR, ((int32_t_t)read(ADDR) + DELTA)) HIGHLOW enumerator HIGHLOW = 3 This value matches IMAGE_REL_BASED_HIGHLOW . The base relocation applies all 32 bits of the difference to the 32-bit field at offset. Operation: write(ADDR, read(ADDR) + DELTA) HIGHADJ enumerator HIGHADJ = 4 This value matches IMAGE_REL_BASED_HIGHADJ . The base relocation adds the high 16 bits of the difference to the 16-bit field at offset. The 16-bit field represents the high value of a 32-bit word. The low 16 bits of the 32-bit value are stored in the 16-bit word that follows this base relocation. This means that this base relocation occupies two slots. MIPS_JMPADDR enumerator MIPS_JMPADDR = 5 | (1 << 8) ARM_MOV32 enumerator ARM_MOV32 = 5 | (1 << 9) RISCV_HI20 enumerator RISCV_HI20 = 5 | (1 << 10) SECTION enumerator SECTION = 6 THUMB_MOV32 enumerator THUMB_MOV32 = 7 | (1 << 11) RISCV_LOW12I enumerator RISCV_LOW12I = 7 | (1 << 12) RISCV_LOW12S enumerator RISCV_LOW12S = 8 | (1 << 13) LOONARCH_MARK_LA enumerator LOONARCH_MARK_LA = 8 | (1 << 14) MIPS_JMPADDR16 enumerator MIPS_JMPADDR16 = 9 DIR64 enumerator DIR64 = 10 This value matches IMAGE_REL_BASED_DIR64 . The base relocation applies the difference to the 64-bit field at offset. Operation: write(ADDR, read(ADDR) + DELTA) HIGH3ADJ enumerator HIGH3ADJ = 11 Public Functions RelocationEntry RelocationEntry() = default RelocationEntry inline RelocationEntry(const RelocationEntry &other) operator= inline RelocationEntry &operator=( RelocationEntry other) RelocationEntry RelocationEntry( RelocationEntry &&other) = default operator= RelocationEntry &operator=( RelocationEntry &&other) = default RelocationEntry inline RelocationEntry(uint16_t position, BASE_TYPES type) ~RelocationEntry ~RelocationEntry() override = default swap inline void swap( RelocationEntry &other) address virtual uint64_t address() const override The address of the relocation. address virtual void address(uint64_t address) override size virtual size_t size() const override The size of the relocatable pointer. size virtual void size(size_t size) override data inline uint16_t data() const Raw data of the relocation: The high 4 bits store the relocation type The low 12 bits store the relocation offset position inline uint16_t position() const Offset relative to Relocation::virtual_address where the relocation occurs. type inline BASE_TYPES type() const Type of the relocation. position inline void position(uint16_t position) type inline void type( BASE_TYPES type) accept virtual void accept(Visitor &visitor) const override Method so that the visitor can visit us. Public Static Functions get_position static inline uint16_t get_position(uint16_t data) get_type static inline uint16_t get_type(uint16_t data) type_from_data static BASE_TYPES type_from_data( Header :: MACHINE_TYPES arch, uint16_t data) Public Static Attributes MAX_ADDR static auto MAX_ADDR = 1 << 12 Friends friend class PE::Relocation operator<< friend std::ostream &operator<<(std::ostream &os, const RelocationEntry &entry) Export Export class Export : public LIEF::Object Class which represents a PE Export . Public Types entries_t using entries_t = std::vector> it_entries using it_entries = ref_iterator < entries_t &, ExportEntry *> it_const_entries using it_const_entries = const_ref_iterator Public Functions Export Export() = default Export inline Export(std::string name, const std::vector< ExportEntry > &entries) Export inline Export(std::string name) Export Export(const details::pe_export_directory_table &header) Export Export(const Export &) operator= Export &operator=(const Export &) Export Export( Export &&) = default operator= Export &operator=( Export &&) = default ~Export ~Export() override = default export_flags inline uint32_t export_flags() const According to the PE specifications this value is reserved and should be set to 0. timestamp inline uint32_t timestamp() const The time and date that the export data was created. major_version inline uint16_t major_version() const The major version number (can be user-defined). minor_version inline uint16_t minor_version() const The minor version number (can be user-defined). ordinal_base inline uint32_t ordinal_base() const The starting number for the exports. Usually this value is set to 1. name inline std::string_view name() const The name of the library exported (e.g. KERNEL32.dll ). entries inline it_entries entries() Iterator over the ExportEntry . entries inline it_const_entries entries() const name_rva inline uint32_t name_rva() const Address of the ASCII DLL’s name (RVA). export_addr_table_rva inline uint32_t export_addr_table_rva() const RVA of the export address table. export_addr_table_cnt inline uint32_t export_addr_table_cnt() const Number of entries in the export address table. names_addr_table_rva inline uint32_t names_addr_table_rva() const RVA to the list of exported names. names_addr_table_cnt inline uint32_t names_addr_table_cnt() const Number of exports by name. ord_addr_table_rva inline uint32_t ord_addr_table_rva() const RVA to the list of exported ordinals. export_flags inline void export_flags(uint32_t flags) timestamp inline void timestamp(uint32_t timestamp) major_version inline void major_version(uint16_t major_version) minor_version inline void minor_version(uint16_t minor_version) ordinal_base inline void ordinal_base(uint32_t ordinal_base) name inline void name(std::string name) find_entry const ExportEntry *find_entry(const std::string &name) const Find the export entry with the given name. find_entry inline ExportEntry *find_entry(const std::string &name) find_entry const ExportEntry *find_entry(uint32_t ordinal) const Find the export entry with the given ordinal number. find_entry inline ExportEntry *find_entry(uint32_t ordinal) find_entry_at const ExportEntry *find_entry_at(uint32_t rva) const Find the export entry at the provided RVA. find_entry_at inline ExportEntry *find_entry_at(uint32_t rva) add_entry ExportEntry &add_entry(const ExportEntry &exp) Add the given export and return the newly created and added export. add_entry inline ExportEntry &add_entry(std::string name, uint32_t rva) remove_entry bool remove_entry(const ExportEntry &exp) Remove the given export entry. remove_entry inline bool remove_entry(const std::string &name) Remove the export entry with the given name. remove_entry inline bool remove_entry(uint32_t rva) Remove the export entry with the given RVA. accept virtual void accept(Visitor &visitor) const override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Export &exp) Export Entry ExportEntry class ExportEntry : public LIEF:: Symbol Class which represents a PE Export entry (cf. PE::Export ). Public Functions ExportEntry ExportEntry() = default ExportEntry inline ExportEntry(uint32_t address, bool is_extern, uint16_t ordinal, uint32_t function_rva) ExportEntry inline ExportEntry(std::string name, uint32_t rva) ExportEntry ExportEntry(const ExportEntry &) = default operator= ExportEntry &operator=(const ExportEntry &) = default ExportEntry ExportEntry( ExportEntry &&) = default operator= ExportEntry &operator=( ExportEntry &&) = default ~ExportEntry ~ExportEntry() override = default demangled_name std::string demangled_name() const Demangled representation of the symbol or an empty string if it can’t be demangled. ordinal inline uint16_t ordinal() const Ordinal value associated with this exported entry. This value is computed as the index of this entry in the address table plus the ordinal base ( Export::ordinal_base ) address inline uint32_t address() const Address of the current exported function in the DLL. Warning If this entry is external to the DLL then it returns 0 and the external address is returned by function_rva() is_extern inline bool is_extern() const is_forwarded inline bool is_forwarded() const forward_information inline forward_information_t forward_information() const function_rva inline uint32_t function_rva() const ordinal inline void ordinal(uint16_t ordinal) address inline void address(uint32_t address) is_extern inline void is_extern(bool is_extern) value inline virtual uint64_t value() const override Symbol ’s value which is usually the address of the symbol. value inline virtual void value(uint64_t value) override set_forward_info inline void set_forward_info(std::string lib, std::string function) accept virtual void accept(Visitor &visitor) const override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const ExportEntry &exportEntry) forward_information_t struct forward_information_t Public Functions operator bool inline operator bool() const key inline std::string key() const Public Members library std::string library function std::string function Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const forward_information_t &info) Signature Signature class Signature : public LIEF::Object Main interface for the PKCS #7 signature scheme. Public Types VERIFICATION_FLAGS enum class VERIFICATION_FLAGS : uint32_t Flags returned by the verification functions. Values: OK enumerator OK = 0 INVALID_SIGNER enumerator INVALID_SIGNER = 1 << 0 UNSUPPORTED_ALGORITHM enumerator UNSUPPORTED_ALGORITHM = 1 << 1 INCONSISTENT_DIGEST_ALGORITHM enumerator INCONSISTENT_DIGEST_ALGORITHM = 1 << 2 CERT_NOT_FOUND enumerator CERT_NOT_FOUND = 1 << 3 CORRUPTED_CONTENT_INFO enumerator CORRUPTED_CONTENT_INFO = 1 << 4 CORRUPTED_AUTH_DATA enumerator CORRUPTED_AUTH_DATA = 1 << 5 MISSING_PKCS9_MESSAGE_DIGEST enumerator MISSING_PKCS9_MESSAGE_DIGEST = 1 << 6 BAD_DIGEST enumerator BAD_DIGEST = 1 << 7 BAD_SIGNATURE enumerator BAD_SIGNATURE = 1 << 8 NO_SIGNATURE enumerator NO_SIGNATURE = 1 << 9 CERT_EXPIRED enumerator CERT_EXPIRED = 1 << 10 CERT_FUTURE enumerator CERT_FUTURE = 1 << 11 VERIFICATION_CHECKS enum class VERIFICATION_CHECKS : uint32_t Flags to tweak the verification process of the signature. See Signature::check and LIEF::PE::Binary::verify_signature Values: DEFAULT enumerator DEFAULT = 1 << 0 Default behavior that tries to follow the Microsoft verification process as close as possible. HASH_ONLY enumerator HASH_ONLY = 1 << 1 Only check that Binary::authentihash matches ContentInfo::digest regardless of the signature’s validity. LIFETIME_SIGNING enumerator LIFETIME_SIGNING = 1 << 2 Same semantic as WTD_LIFETIME_SIGNING_FLAG . SKIP_CERT_TIME enumerator SKIP_CERT_TIME = 1 << 3 Skip the verification of the certificate validity periods so that even though a certificate expired, it returns VERIFICATION_FLAGS::OK . it_const_crt using it_const_crt = const_ref_iterator &> Iterator which outputs const x509 & certificates. it_crt using it_crt = ref_iterator &> Iterator which outputs x509 & certificates. it_const_signers_t using it_const_signers_t = const_ref_iterator &> Iterator which outputs const SignerInfo &. it_signers_t using it_signers_t = ref_iterator &> Iterator which outputs SignerInfo &. Public Functions Signature Signature() Signature Signature(const Signature &) operator= Signature &operator=(const Signature &) Signature Signature( Signature &&) operator= Signature &operator=( Signature &&) version inline uint32_t version() const Should be 1. digest_algorithm inline ALGORITHMS digest_algorithm() const Algorithm used to digest the file. It should match SignerInfo::digest_algorithm content_info inline const ContentInfo &content_info() const Return the ContentInfo . certificates inline it_const_crt certificates() const Return an iterator over x509 certificates. certificates inline it_crt certificates() signers inline it_const_signers_t signers() const Return an iterator over the signers ( SignerInfo ) defined in the PKCS #7 signature. signers inline it_signers_t signers() raw_der inline span raw_der() const Return the raw original PKCS7 signature. find_crt const x509 *find_crt(const std::vector &serialno) const Find x509 certificate according to its serial number. find_crt_subject const x509 *find_crt_subject(std::string_view subject) const Find x509 certificate according to its subject. find_crt_subject const x509 *find_crt_subject(std::string_view subject, const std::vector &serialno) const Find x509 certificate according to its subject AND serial number. find_crt_issuer const x509 *find_crt_issuer(std::string_view issuer) const Find x509 certificate according to its issuer. find_crt_issuer const x509 *find_crt_issuer(std::string_view issuer, const std::vector &serialno) const Find x509 certificate according to its issuer AND serial number. check VERIFICATION_FLAGS check( VERIFICATION_CHECKS checks = VERIFICATION_CHECKS :: DEFAULT ) const Check if this signature is valid according to the Authenticode/PKCS #7 verification scheme. By default, it performs the following verifications: It must contain only one signer info Signature::digest_algorithm must match: ContentInfo::digest_algorithm SignerInfo::digest_algorithm The x509 certificate specified by SignerInfo::serial_number and SignerInfo::issuer must exist within Signature::certificates Given the x509 certificate, compare SignerInfo::encrypted_digest against either: hash of authenticated attributes if present hash of ContentInfo If authenticated attributes are present, check that a PKCS9_MESSAGE_DIGEST attribute exists and that its value matches hash of ContentInfo Check the validity of the PKCS #9 counter signature if present If the signature doesn’t embed a signing-time in the counter signature, check the certificate validity. (See LIEF::PE::Signature::VERIFICATION_CHECKS::LIFETIME_SIGNING and LIEF::PE::Signature::VERIFICATION_CHECKS::SKIP_CERT_TIME ) See: LIEF::PE::Signature::VERIFICATION_CHECKS to tweak the behavior accept virtual void accept(Visitor &visitor) const override ~Signature ~Signature() override Public Static Functions hash static inline std::vector hash(const std::vector &input, ALGORITHMS algo) Hash the input given the algorithm. hash static std::vector hash(const uint8_t *buffer, size_t size, ALGORITHMS algo) flag_to_string static std::string flag_to_string( VERIFICATION_FLAGS flag) Convert a verification flag into a human-readable representation. e.g VERIFICATION_FLAGS.BAD_DIGEST | VERIFICATION_FLAGS.BAD_SIGNATURE | VERIFICATION_FLAGS.CERT_EXPIRED . Friends operator<< friend std::ostream &operator<<(std::ostream &os, const Signature &signature) Signature Attribute Attribute class Attribute : public LIEF::Object Interface over PKCS #7 attribute. Subclassed by LIEF::PE::ContentType , LIEF::PE::GenericType , LIEF::PE::MsCounterSign , LIEF::PE::MsManifestBinaryID , LIEF::PE::MsSpcNestedSignature , LIEF::PE::MsSpcStatementType , LIEF::PE::PKCS9AtSequenceNumber , LIEF::PE::PKCS9CounterSignature , LIEF::PE::PKCS9MessageDigest , LIEF::PE::PKCS9SigningTime , LIEF::PE::SigningCertificateV2 , LIEF::PE::SpcRelaxedPeMarkerCheck , LIEF::PE::SpcSpOpusInfo Public Types TYPE enum class TYPE Values: UNKNOWN enumerator UNKNOWN = 0 CONTENT_TYPE enumerator CONTENT_TYPE GENERIC_TYPE enumerator GENERIC_TYPE SIGNING_CERTIFICATE_V2 enumerator SIGNING_CERTIFICATE_V2 SPC_SP_OPUS_INFO enumerator SPC_SP_OPUS_INFO SPC_RELAXED_PE_MARKER_CHECK enumerator SPC_RELAXED_PE_MARKER_CHECK MS_COUNTER_SIGN enumerator MS_COUNTER_SIGN MS_SPC_NESTED_SIGN enumerator MS_SPC_NESTED_SIGN MS_SPC_STATEMENT_TYPE enumerator MS_SPC_STATEMENT_TYPE MS_PLATFORM_MANIFEST_BINARY_ID enumerator MS_PLATFORM_MANIFEST_BINARY_ID PKCS9_AT_SEQUENCE_NUMBER enumerator PKCS9_AT_SEQUENCE_NUMBER PKCS9_COUNTER_SIGNATURE enumerator PKCS9_COUNTER_SIGNATURE PKCS9_MESSAGE_DIGEST enumerator PKCS9_MESSAGE_DIGEST PKCS9_SIGNING_TIME enumerator PKCS9_SIGNING_TIME Public Functions Attribute Attribute() = delete Attribute Attribute(const Attribute &) = default operator= Attribute &operator=(const Attribute &) = default clone virtual std::unique_ptr< Attribute > clone() const = 0 type inline virtual TYPE type() const Concrete type of the attribute. print virtual std::string print() const = 0 Print information about the underlying attribute. accept virtual void accept(Visitor &visitor) const override ~Attribute ~Attribute() override = default Tcast template inline const T *cast() const Tcast template inline T *cast() Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Attribute &attribute) Signature ContentType ContentType class ContentType : public LIEF::PE:: Attribute Interface over the structure described by the OID 1.2.840.113549.1.9.3 (PKCS #9). The internal structure is described in the RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0 ContentType ::= OBJECT IDENTIFIER Public Functions ContentType inline ContentType() ContentType inline ContentType(oid_t oid) ContentType ContentType(const ContentType &) = default operator= ContentType &operator=(const ContentType &) = default oid inline const oid_t &oid() const OID as described in RFC #2985. print virtual std::string print() const override Print information about the attribute. clone inline virtual std::unique_ptr< Attribute > clone() const override accept virtual void accept(Visitor &visitor) const override ~ContentType ~ContentType() override = default Public Static Functions classof static inline bool classof(const Attribute *attr) Signature GenericType GenericType class GenericType : public LIEF::PE:: Attribute Interface over an attribute for which the internal structure is not supported by LIEF. Public Functions GenericType inline GenericType() GenericType inline GenericType(oid_t oid, std::vector raw) GenericType GenericType(const GenericType &) = default operator= GenericType &operator=(const GenericType &) = default clone inline virtual std::unique_ptr< Attribute > clone() const override oid inline const oid_t &oid() const OID of the original attribute. raw_content inline span raw_content() const Original DER blob of the attribute. print virtual std::string print() const override Print information about the attribute. accept virtual void accept(Visitor &visitor) const override ~GenericType ~GenericType() override = default Public Static Functions classof static inline bool classof(const Attribute *attr) Signature MsSpcNestedSignature MsSpcNestedSignature class MsSpcNestedSignature : public LIEF::PE:: Attribute Interface over the structure described by the OID 1.3.6.1.4.1.311.2.4.1 . The internal structure is not documented but we can infer the following structure: MsSpcNestedSignature ::= SET OF SignedData SignedData is the structure described in PKCS #7 RFC ( LIEF::PE::Signature ) Public Functions MsSpcNestedSignature MsSpcNestedSignature() = delete MsSpcNestedSignature inline MsSpcNestedSignature( Signature sig) MsSpcNestedSignature MsSpcNestedSignature(const MsSpcNestedSignature &) = default operator= MsSpcNestedSignature &operator=(const MsSpcNestedSignature &) = default clone inline virtual std::unique_ptr< Attribute > clone() const override sig inline const Signature &sig() const Underlying Signature object. print virtual std::string print() const override Print information about the attribute. accept virtual void accept(Visitor &visitor) const override ~MsSpcNestedSignature ~MsSpcNestedSignature() override = default Public Static Functions classof static inline bool classof(const Attribute *attr) Signature MsSpcStatementType MsSpcStatementType class MsSpcStatementType : public LIEF::PE:: Attribute Interface over the structure described by the OID 1.3.6.1.4.1.311.2.1.11 . The internal structure is described in the official document: Windows Authenticode Portable Executable Signature Format SpcStatementType ::= SEQUENCE of OBJECT IDENTIFIER Public Functions MsSpcStatementType MsSpcStatementType() = delete MsSpcStatementType inline MsSpcStatementType(oid_t oid) MsSpcStatementType MsSpcStatementType(const MsSpcStatementType &) = default operator= MsSpcStatementType &operator=(const MsSpcStatementType &) = default clone inline virtual std::unique_ptr< Attribute > clone() const override oid inline const oid_t &oid() const According to the documentation: The SpcStatementType MUST contain one Object Identifier with either the value 1.3.6.1.4.1.311.2.1.21 (SPC_INDIVIDUAL_SP_KEY_PURPOSE_OBJID) or > 1.3.6.1.4.1.311.2.1.22 (SPC_COMMERCIAL_SP_KEY_PURPOSE_OBJID) . print virtual std::string print() const override Print information about the attribute. accept virtual void accept(Visitor &visitor) const override ~MsSpcStatementType ~MsSpcStatementType() override = default Public Static Functions classof static inline bool classof(const Attribute *attr) Signature PKCS9AtSequenceNumber PKCS9AtSequenceNumber class PKCS9AtSequenceNumber : public LIEF::PE:: Attribute Interface over the structure described by the OID 1.2.840.113549.1.9.25.4 (PKCS #9). The internal structure is described in the RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0 sequenceNumber ATTRIBUTE ::= { WITH SYNTAX SequenceNumber EQUALITY MATCHING RULE integerMatch SINGLE VALUE TRUE ID pkcs-9-at-sequenceNumber } SequenceNumber ::= INTEGER (1..MAX) Public Functions PKCS9AtSequenceNumber PKCS9AtSequenceNumber() = delete PKCS9AtSequenceNumber inline PKCS9AtSequenceNumber(uint32_t num) PKCS9AtSequenceNumber PKCS9AtSequenceNumber(const PKCS9AtSequenceNumber &) = default operator= PKCS9AtSequenceNumber &operator=(const PKCS9AtSequenceNumber &) = default clone inline virtual std::unique_ptr< Attribute > clone() const override number inline uint32_t number() const Number as described in the RFC. print virtual std::string print() const override Print information about the attribute. accept virtual void accept(Visitor &visitor) const override ~PKCS9AtSequenceNumber ~PKCS9AtSequenceNumber() override = default Public Static Functions classof static inline bool classof(const Attribute *attr) Signature PKCS9CounterSignature PKCS9CounterSignature class PKCS9CounterSignature : public LIEF::PE:: Attribute Interface over the structure described by the OID 1.2.840.113549.1.9.6 (PKCS #9). The internal structure is described in the RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0 counterSignature ATTRIBUTE ::= { WITH SYNTAX SignerInfo ID pkcs-9-at-counterSignature } Public Functions PKCS9CounterSignature PKCS9CounterSignature() = delete PKCS9CounterSignature inline PKCS9CounterSignature( SignerInfo signer) PKCS9CounterSignature PKCS9CounterSignature(const PKCS9CounterSignature &) = default operator= PKCS9CounterSignature &operator=(const PKCS9CounterSignature &) = default clone inline virtual std::unique_ptr< Attribute > clone() const override signer inline const SignerInfo &signer() const SignerInfo as described in the RFC #2985. print virtual std::string print() const override Print information about the attribute. accept virtual void accept(Visitor &visitor) const override ~PKCS9CounterSignature ~PKCS9CounterSignature() override = default Public Static Functions classof static inline bool classof(const Attribute *attr) Signature PKCS9MessageDigest PKCS9MessageDigest class PKCS9MessageDigest : public LIEF::PE:: Attribute Interface over the structure described by the OID 1.2.840.113549.1.9.4 (PKCS #9). The internal structure is described in the RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0 messageDigest ATTRIBUTE ::= { WITH SYNTAX MessageDigest EQUALITY MATCHING RULE octetStringMatch SINGLE VALUE TRUE ID pkcs-9-at-messageDigest } MessageDigest ::= OCTET STRING Public Functions PKCS9MessageDigest PKCS9MessageDigest() = delete PKCS9MessageDigest inline PKCS9MessageDigest(std::vector digest) PKCS9MessageDigest PKCS9MessageDigest(const PKCS9MessageDigest &) = default operator= PKCS9MessageDigest &operator=(const PKCS9MessageDigest &) = default clone inline virtual std::unique_ptr< Attribute > clone() const override digest inline span digest() const Message digest as a blob of bytes as described in the RFC. print virtual std::string print() const override Print information about the attribute. accept virtual void accept(Visitor &visitor) const override ~PKCS9MessageDigest ~PKCS9MessageDigest() override = default Public Static Functions classof static inline bool classof(const Attribute *attr) Signature PKCS9SigningTime PKCS9SigningTime class PKCS9SigningTime : public LIEF::PE:: Attribute Interface over the structure described by the OID 1.2.840.113549.1.9.5 (PKCS #9). The internal structure is described in the RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0 signingTime ATTRIBUTE ::= { WITH SYNTAX SigningTime EQUALITY MATCHING RULE signingTimeMatch SINGLE VALUE TRUE ID pkcs-9-at-signingTime } SigningTime ::= Time -- imported from ISO/IEC 9594-8 Public Types time_t using time_t = std::array Time as an array [year, month, day, hour, min, sec]. Public Functions PKCS9SigningTime PKCS9SigningTime() = delete PKCS9SigningTime inline PKCS9SigningTime( time_t time) PKCS9SigningTime PKCS9SigningTime(const PKCS9SigningTime &) = default operator= PKCS9SigningTime &operator=(const PKCS9SigningTime &) = default time inline const time_t &time() const Time as an array [year, month, day, hour, min, sec]. print virtual std::string print() const override Print information about the attribute. clone inline virtual std::unique_ptr< Attribute > clone() const override accept virtual void accept(Visitor &visitor) const override ~PKCS9SigningTime ~PKCS9SigningTime() override = default Public Static Functions classof static inline bool classof(const Attribute *attr) Signature SpcSpOpusInfo SpcSpOpusInfo class SpcSpOpusInfo : public LIEF::PE:: Attribute Interface over the structure described by the OID 1.3.6.1.4.1.311.2.1.12 . The internal structure is described in the official document: Windows Authenticode Portable Executable Signature Format SpcSpOpusInfo ::= SEQUENCE { programName [0] EXPLICIT SpcString OPTIONAL, moreInfo [1] EXPLICIT SpcLink OPTIONAL } Public Functions SpcSpOpusInfo inline SpcSpOpusInfo(std::string program_name, std::string more_info) SpcSpOpusInfo inline SpcSpOpusInfo() SpcSpOpusInfo SpcSpOpusInfo(const SpcSpOpusInfo &) = default operator= SpcSpOpusInfo &operator=(const SpcSpOpusInfo &) = default clone inline virtual std::unique_ptr< Attribute > clone() const override program_name inline std::string_view program_name() const Program description provided by the publisher. more_info inline std::string_view more_info() const Other information such as a URL. print virtual std::string print() const override Print information about the attribute. accept virtual void accept(Visitor &visitor) const override ~SpcSpOpusInfo ~SpcSpOpusInfo() override = default Public Static Functions classof static inline bool classof(const Attribute *attr) Signature SpcIndirectData SpcIndirectData class SpcIndirectData : public LIEF::PE:: ContentInfo :: Content Public Functions SpcIndirectData inline SpcIndirectData() SpcIndirectData SpcIndirectData(const SpcIndirectData &) = default operator= SpcIndirectData &operator=(const SpcIndirectData &) = default clone inline virtual std::unique_ptr clone() const override digest_algorithm inline ALGORITHMS digest_algorithm() const Digest used to hash the file. It should match LIEF::PE::SignerInfo::digest_algorithm digest inline span digest() const PE’s authentihash. See also LIEF::PE::Binary::authentihash file inline std::string_view file() const url inline std::string_view url() const print virtual void print(std::ostream &os) const override accept virtual void accept(Visitor &visitor) const override ~SpcIndirectData ~SpcIndirectData() override = default Public Static Functions classof static inline bool classof(const ContentInfo :: Content *content) Public Static Attributes SPC_INDIRECT_DATA_OBJID static auto SPC_INDIRECT_DATA_OBJID = \"1.3.6.1.4.1.311.2.1.4\" Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const SpcIndirectData &content) Signature GenericContent GenericContent class GenericContent : public LIEF::PE:: ContentInfo :: Content Public Functions GenericContent GenericContent() GenericContent GenericContent(oid_t oid) GenericContent GenericContent(const GenericContent &) = default operator= GenericContent &operator=(const GenericContent &) = default clone inline virtual std::unique_ptr clone() const override oid inline const oid_t &oid() const raw inline span raw() const raw inline span raw() ~GenericContent ~GenericContent() override print virtual void print(std::ostream &os) const override accept virtual void accept(Visitor &visitor) const override Public Static Functions classof static bool classof(const ContentInfo :: Content *content) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const GenericContent &content) RsaInfo RsaInfo class RsaInfo Object that wraps a RSA key. Public Types rsa_ctx_handle using rsa_ctx_handle = void* bignum_wrapper_t using bignum_wrapper_t = std::vector Container for BigInt. Public Functions RsaInfo RsaInfo(const RsaInfo &other) RsaInfo RsaInfo( RsaInfo &&other) operator= RsaInfo &operator=( RsaInfo other) has_public_key bool has_public_key() const True if it embeds a public key. has_private_key bool has_private_key() const True if it embeds a private key. N bignum_wrapper_t N() const RSA public modulus. E bignum_wrapper_t E() const RSA public exponent. D bignum_wrapper_t D() const RSA private exponent. P bignum_wrapper_t P() const First prime factor. Q bignum_wrapper_t Q() const Second prime factor. key_size size_t key_size() const Size of the public modulus (in bits). swap void swap( RsaInfo &other) operator bool operator bool() const ~RsaInfo ~RsaInfo() Friends operator<< friend std::ostream &operator<<(std::ostream &os, const RsaInfo &info) x509 x509 class x509 : public LIEF::Object Interface over a x509 certificate. Public Types KEY_TYPES enum class KEY_TYPES : uint32_t Public key scheme. Values: NONE enumerator NONE = 0 Unknown scheme. RSA enumerator RSA RSA Scheme. ECKEY enumerator ECKEY Elliptic-curve scheme. ECKEY_DH enumerator ECKEY_DH Elliptic-curve Diffie-Hellman. ECDSA enumerator ECDSA Elliptic-curve Digital Signature Algorithm. RSA_ALT enumerator RSA_ALT RSA scheme with an alternative implementation for signing and decrypting. RSASSA_PSS enumerator RSASSA_PSS RSA Probabilistic signature scheme. VERIFICATION_FLAGS enum class VERIFICATION_FLAGS : uint32_t Mirror of mbedtls’s X509 Verify codes: MBEDTLS_X509_XX. It must be sync with include/mbedtls/x509.h Values: OK enumerator OK = 0 The verification succeed. BADCERT_EXPIRED enumerator BADCERT_EXPIRED = 1 << 0 The certificate validity has expired. BADCERT_REVOKED enumerator BADCERT_REVOKED = 1 << 1 The certificate has been revoked (is on a CRL). BADCERT_CN_MISMATCH enumerator BADCERT_CN_MISMATCH = 1 << 2 The certificate Common Name (CN) does not match with the expected CN. BADCERT_NOT_TRUSTED enumerator BADCERT_NOT_TRUSTED = 1 << 3 The certificate is not correctly signed by the trusted CA. BADCRL_NOT_TRUSTED enumerator BADCRL_NOT_TRUSTED = 1 << 4 The CRL is not correctly signed by the trusted CA. BADCRL_EXPIRED enumerator BADCRL_EXPIRED = 1 << 5 The CRL is expired. BADCERT_MISSING enumerator BADCERT_MISSING = 1 << 6 Certificate was missing. BADCERT_SKIP_VERIFY enumerator BADCERT_SKIP_VERIFY = 1 << 7 Certificate verification was skipped. BADCERT_OTHER enumerator BADCERT_OTHER = 1 << 8 Other reason (can be used by verify callback). BADCERT_FUTURE enumerator BADCERT_FUTURE = 1 << 9 The certificate validity starts in the future. BADCRL_FUTURE enumerator BADCRL_FUTURE = 1 << 10 The CRL is from the future. BADCERT_KEY_USAGE enumerator BADCERT_KEY_USAGE = 1 << 11 Usage does not match the keyUsage extension. BADCERT_EXT_KEY_USAGE enumerator BADCERT_EXT_KEY_USAGE = 1 << 12 Usage does not match the extendedKeyUsage extension. BADCERT_NS_CERT_TYPE enumerator BADCERT_NS_CERT_TYPE = 1 << 13 Usage does not match the nsCertType extension. BADCERT_BAD_MD enumerator BADCERT_BAD_MD = 1 << 14 The certificate is signed with an unacceptable hash. BADCERT_BAD_PK enumerator BADCERT_BAD_PK = 1 << 15 The certificate is signed with an unacceptable PK alg (e.g. RSA vs ECDSA). BADCERT_BAD_KEY enumerator BADCERT_BAD_KEY = 1 << 16 The certificate is signed with an unacceptable key (e.g. bad curve, RSA too short). BADCRL_BAD_MD enumerator BADCRL_BAD_MD = 1 << 17 The CRL is signed with an unacceptable hash. BADCRL_BAD_PK enumerator BADCRL_BAD_PK = 1 << 18 The CRL is signed with an unacceptable PK alg (e.g. RSA vs ECDSA). BADCRL_BAD_KEY enumerator BADCRL_BAD_KEY = 1 << 19 The CRL is signed with an unacceptable key (e.g. bad curve, RSA too short). KEY_USAGE enum class KEY_USAGE : uint32_t Key usage as defined in RFC #5280 - section-4.2.1.3 . Values: DIGITAL_SIGNATURE enumerator DIGITAL_SIGNATURE = 0 The key is used for digital signature. NON_REPUDIATION enumerator NON_REPUDIATION The key is used for digital signature AND to protect against falsely denying some action. KEY_ENCIPHERMENT enumerator KEY_ENCIPHERMENT The key is used for enciphering private or secret keys. DATA_ENCIPHERMENT enumerator DATA_ENCIPHERMENT The key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher. KEY_AGREEMENT enumerator KEY_AGREEMENT The Key is used for key agreement. (e.g. with Diffie-Hellman). KEY_CERT_SIGN enumerator KEY_CERT_SIGN The key is used for verifying signatures on public key certificates. CRL_SIGN enumerator CRL_SIGN The key is used for verifying signatures on certificate revocation lists. ENCIPHER_ONLY enumerator ENCIPHER_ONLY In association with KEY_AGREEMENT (otherwise the meaning is undefined), the key is only used for enciphering data while performing key agreement. DECIPHER_ONLY enumerator DECIPHER_ONLY In association with KEY_AGREEMENT (otherwise the meaning is undefined), the key is only used for deciphering data while performing key agreement. date_t using date_t = std::array Tuple (Year, Month, Day, Hour, Minute, Second). certificates_t using certificates_t = std::vector< x509 > Public Functions x509 x509(mbedtls_x509_crt *ca) x509 x509(const x509 &other) operator= x509 &operator=( x509 other) swap void swap( x509 &other) version uint32_t version() const X.509 version. (1=v1, 2=v2, 3=v3). serial_number std::vector serial_number() const Unique id for certificate issued by a specific CA. signature_algorithm oid_t signature_algorithm() const Signature algorithm (OID). valid_from date_t valid_from() const Start time of certificate validity. valid_to date_t valid_to() const End time of certificate validity. issuer std::string issuer() const Issuer information. subject std::string subject() const Subject information. check_signature bool check_signature(const std::vector &hash, const std::vector &signature, ALGORITHMS digest) const Try to decrypt the given signature and check if it matches the given hash according to the hash algorithm provided. raw std::vector raw() const The raw x509 bytes (DER encoded). key_type KEY_TYPES key_type() const Return the underlying public-key scheme. rsa_info std::unique_ptr< RsaInfo > rsa_info() const If the underlying public-key scheme is RSA, return the RSA information. Otherwise, return a nullptr verify VERIFICATION_FLAGS verify(const x509 &ca) const Verify that this certificate has been used to trust the given certificate. is_trusted_by VERIFICATION_FLAGS is_trusted_by(const std::vector< x509 > &ca) const Verify that this certificate is trusted by the given CA list. certificate_policies std::vector certificate_policies() const Policy information terms as OID (see RFC #5280). key_usage std::vector< KEY_USAGE > key_usage() const Purpose of the key contained in the certificate. ext_key_usage std::vector ext_key_usage() const Indicates one or more purposes for which the certified public key may be used (OID types). is_ca bool is_ca() const signature std::vector signature() const The signature of the certificate. accept virtual void accept(Visitor &visitor) const override ~x509 ~x509() override Public Static Functions parse static certificates_t parse(const std::string &path) Parse x509 certificate(s) from file path. parse static certificates_t parse(const std::vector &content) Parse x509 certificate(s) from raw blob. check_time static bool check_time(const date_t &before, const date_t &after) Return True if before is before than after . False otherwise. time_is_past static bool time_is_past(const date_t &to) True if the given time is in the past according to the clock’s system. time_is_future static bool time_is_future(const date_t &from) True if the given time is in the future according to the clock’s system. Friends operator<< friend std::ostream &operator<<(std::ostream &os, const x509 &x509_cert) ContentInfo ContentInfo class ContentInfo : public LIEF::Object ContentInfo as described in the RFC2315 ( https://tools.ietf.org/html/rfc2315#section-7 ) ContentInfo ::= SEQUENCE { contentType ContentType, content [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL } ContentType ::= OBJECT IDENTIFIER In the case of PE signature, ContentType must be set to SPC_INDIRECT_DATA_OBJID OID: 1.3.6.1.4.1.311.2.1.4 and content is defined by the structure: SpcIndirectDataContent SpcIndirectDataContent ::= SEQUENCE { data SpcAttributeTypeAndOptionalValue, messageDigest DigestInfo } SpcAttributeTypeAndOptionalValue ::= SEQUENCE { type ObjectID, value [0] EXPLICIT ANY OPTIONAL } For PE signature, SpcAttributeTypeAndOptionalValue.type is set to SPC_PE_IMAGE_DATAOBJ (OID: 1.3.6.1.4.1.311.2.1.15 ) and the value is defined by SpcPeImageData DigestInfo ::= SEQUENCE { digestAlgorithm AlgorithmIdentifier, digest OCTETSTRING } AlgorithmIdentifier ::= SEQUENCE { algorithm ObjectID, parameters [0] EXPLICIT ANY OPTIONAL } Public Functions ContentInfo ContentInfo() ContentInfo ContentInfo(const ContentInfo &other) ContentInfo ContentInfo( ContentInfo &&other) noexcept = default operator= ContentInfo &operator=( ContentInfo other) swap void swap( ContentInfo &other) noexcept content_type inline oid_t content_type() const Return the OID that describes the content wrapped by this object. It should match SPC_INDIRECT_DATA_OBJID (1.3.6.1.4.1.311.2.1.4). value inline Content &value() value inline const Content &value() const digest std::vector digest() const Return the digest (authentihash) if the underlying content type is SPC_INDIRECT_DATA_OBJID Otherwise, return an empty vector. digest_algorithm ALGORITHMS digest_algorithm() const Return the digest used to hash the file. accept virtual void accept(Visitor &visitor) const override ~ContentInfo ~ContentInfo() override = default Friends operator<< friend std::ostream &operator<<(std::ostream &os, const ContentInfo &content_info) Content class Content : public LIEF::Object Subclassed by LIEF::PE::GenericContent , LIEF::PE::PKCS9TSTInfo , LIEF::PE::SpcIndirectData Public Functions Content inline Content(oid_t oid) content_type inline const oid_t &content_type() const clone virtual std::unique_ptr< Content > clone() const = 0 print virtual void print(std::ostream &os) const = 0 Tcast template inline const T *cast() const Tcast template inline T *cast() ~Content ~Content() override = default Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Content &content) SignerInfo SignerInfo class SignerInfo : public LIEF::Object SignerInfo as described in the RFC 2315 SignerInfo ::= SEQUENCE { version Version, issuerAndSerialNumber IssuerAndSerialNumber, digestAlgorithm DigestAlgorithmIdentifier, authenticatedAttributes [0] IMPLICIT Attributes OPTIONAL, digestEncryptionAlgorithm DigestEncryptionAlgorithmIdentifier, encryptedDigest EncryptedDigest, unauthenticatedAttributes [1] IMPLICIT Attributes OPTIONAL } EncryptedDigest ::= OCTET STRING Public Types encrypted_digest_t using encrypted_digest_t = std::vector attributes_t using attributes_t = std::vector> Internal container used to store both authenticated and unauthenticated attributes. it_const_attributes_t using it_const_attributes_t = const_ref_iterator Iterator which outputs const Attribute &. Public Functions SignerInfo SignerInfo() SignerInfo SignerInfo(const SignerInfo &other) operator= SignerInfo &operator=( SignerInfo other) SignerInfo SignerInfo( SignerInfo &&) operator= SignerInfo &operator=( SignerInfo &&) swap void swap( SignerInfo &other) version inline uint32_t version() const Should be 1. serial_number inline span serial_number() const Return the serial number associated with the x509 certificate used by this signer. See also LIEF::PE::x509::serial_number SignerInfo::issuer issuer inline std::string_view issuer() const Return the x509::issuer used by this signer. digest_algorithm inline ALGORITHMS digest_algorithm() const Algorithm (OID) used to hash the file. This value should match LIEF::PE::ContentInfo::digest_algorithm and LIEF::PE::Signature::digest_algorithm encryption_algorithm inline ALGORITHMS encryption_algorithm() const Return the (public-key) algorithm used to encrypt the signature. encrypted_digest inline const encrypted_digest_t &encrypted_digest() const Return the signature created by the signing certificate’s private key. authenticated_attributes inline it_const_attributes_t authenticated_attributes() const Iterator over LIEF::PE::Attribute for authenticated attributes. unauthenticated_attributes inline it_const_attributes_t unauthenticated_attributes() const Iterator over LIEF::PE::Attribute for unauthenticated attributes. get_attribute const Attribute *get_attribute( Attribute :: TYPE type) const Return the authenticated or unauthenticated attribute matching the given PE::SIG_ATTRIBUTE_TYPES. It returns the first entry that matches the given type. If it can’t be found, it returns a nullptr. get_auth_attribute const Attribute *get_auth_attribute( Attribute :: TYPE type) const Return the authenticated attribute matching the given PE::SIG_ATTRIBUTE_TYPES. It returns the first entry that matches the given type. If it can’t be found, it returns a nullptr. get_unauth_attribute const Attribute *get_unauth_attribute( Attribute :: TYPE type) const Return the unauthenticated attribute matching the given PE::SIG_ATTRIBUTE_TYPES. It returns the first entry that matches the given type. If it can’t be found, it returns a nullptr. cert inline const x509 *cert() const x509 certificate used by this signer. If it can’t be found, it returns a nullptr cert inline x509 *cert() x509 certificate used by this signer. If it can’t be found, it returns a nullptr raw_auth_data inline span raw_auth_data() const Raw blob that is signed by the signer certificate. accept virtual void accept(Visitor &visitor) const override ~SignerInfo ~SignerInfo() override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const SignerInfo &signer_info) MsCounterSign MsCounterSign class MsCounterSign : public LIEF::PE:: Attribute This class exposes the MS Counter Signature attribute. Public Types certificates_t using certificates_t = std::vector< x509 > it_const_certificates using it_const_certificates = const_ref_iterator it_certificates using it_certificates = ref_iterator < certificates_t &> signers_t using signers_t = std::vector< SignerInfo > it_const_signers using it_const_signers = const_ref_iterator it_signers using it_signers = ref_iterator < signers_t &> Public Functions MsCounterSign inline MsCounterSign() MsCounterSign MsCounterSign(const MsCounterSign &) = default operator= MsCounterSign &operator=(const MsCounterSign &) = default clone inline virtual std::unique_ptr< Attribute > clone() const override version inline uint32_t version() const certificates inline it_const_certificates certificates() const Iterator over the LIEF::PE::x509 certificates of this counter signature. certificates inline it_certificates certificates() signers inline it_const_signers signers() const Signer iterator (same as LIEF::PE::SignerInfo ). signers inline it_signers signers() digest_algorithm inline ALGORITHMS digest_algorithm() const content_info inline const ContentInfo &content_info() const print virtual std::string print() const override Print information about the underlying attribute. accept virtual void accept(Visitor &visitor) const override ~MsCounterSign ~MsCounterSign() override = default Public Static Functions classof static inline bool classof(const Attribute *attr) PKCS9TSTInfo PKCS9TSTInfo class PKCS9TSTInfo : public LIEF::PE:: ContentInfo :: Content Interface over the structure described by the OID 1.2.840.113549.1.9.16.1.4 (PKCS #9). The internal structure is described in the RFC #3161 TSTInfo ::= SEQUENCE { version INTEGER { v1(1) }, policy TSAPolicyId, messageImprint MessageImprint, serialNumber INTEGER, genTime GeneralizedTime, accuracy Accuracy OPTIONAL, ordering BOOLEAN DEFAULT FALSE, nonce INTEGER OPTIONAL, tsa [0] GeneralName OPTIONAL, extensions [1] IMPLICIT Extensions OPTIONAL } TSAPolicyId ::= OBJECT IDENTIFIER MessageImprint ::= SEQUENCE { hashAlgorithm AlgorithmIdentifier, hashedMessage OCTET STRING } Accuracy ::= SEQUENCE { seconds INTEGER OPTIONAL, millis [0] INTEGER (1..999) OPTIONAL, micros [1] INTEGER (1..999) OPTIONAL } Public Functions PKCS9TSTInfo inline PKCS9TSTInfo() PKCS9TSTInfo PKCS9TSTInfo(const PKCS9TSTInfo &) = default operator= PKCS9TSTInfo &operator=(const PKCS9TSTInfo &) = default clone inline virtual std::unique_ptr clone() const override print inline virtual void print(std::ostream&) const override accept virtual void accept(Visitor &visitor) const override ~PKCS9TSTInfo ~PKCS9TSTInfo() override = default Public Static Functions classof static inline bool classof(const ContentInfo :: Content *content) Public Static Attributes PKCS9_TSTINFO_OBJID static auto PKCS9_TSTINFO_OBJID = \"1.2.840.113549.1.9.16.1.4\" MsManifestBinaryID MsManifestBinaryID class MsManifestBinaryID : public LIEF::PE:: Attribute Interface over the structure described by the OID 1.3.6.1.4.1.311.10.3.28 (szOID_PLATFORM_MANIFEST_BINARY_ID). The internal structure is not documented but we can infer the following structure: szOID_PLATFORM_MANIFEST_BINARY_ID ::= SET OF BinaryID BinaryID being an alias of UTF8STRING Public Functions MsManifestBinaryID MsManifestBinaryID() = delete MsManifestBinaryID inline MsManifestBinaryID(std::string binid) MsManifestBinaryID MsManifestBinaryID(const MsManifestBinaryID &) = default operator= MsManifestBinaryID &operator=(const MsManifestBinaryID &) = default print inline virtual std::string print() const override Print information about the attribute. manifest_id inline std::string_view manifest_id() const The manifest id as a string. manifest_id inline void manifest_id(const std::string &id) clone inline virtual std::unique_ptr< Attribute > clone() const override accept virtual void accept(Visitor &visitor) const override ~MsManifestBinaryID ~MsManifestBinaryID() override = default Public Static Functions classof static inline bool classof(const Attribute *attr) SpcRelaxedPeMarkerCheck SpcRelaxedPeMarkerCheck class SpcRelaxedPeMarkerCheck : public LIEF::PE:: Attribute Public Functions SpcRelaxedPeMarkerCheck inline SpcRelaxedPeMarkerCheck() SpcRelaxedPeMarkerCheck inline SpcRelaxedPeMarkerCheck(uint32_t value) SpcRelaxedPeMarkerCheck SpcRelaxedPeMarkerCheck(const SpcRelaxedPeMarkerCheck &) = default operator= SpcRelaxedPeMarkerCheck &operator=(const SpcRelaxedPeMarkerCheck &) = default value inline uint32_t value() const value inline void value(uint32_t v) clone inline virtual std::unique_ptr< Attribute > clone() const override print inline virtual std::string print() const override Print information about the underlying attribute. accept virtual void accept(Visitor &visitor) const override ~SpcRelaxedPeMarkerCheck ~SpcRelaxedPeMarkerCheck() override = default Public Static Functions classof static inline bool classof(const Attribute *attr) SigningCertificateV2 SigningCertificateV2 class SigningCertificateV2 : public LIEF::PE:: Attribute SigningCertificateV2 ::= SEQUENCE { certs SEQUENCE OF ESSCertIDv2, policies SEQUENCE OF PolicyInformation OPTIONAL }. ESSCertIDv2 ::= SEQUENCE { hashAlgorithm AlgorithmIdentifier DEFAULT {algorithm id-sha256}, certHash OCTET STRING, issuerSerial IssuerSerial OPTIONAL } IssuerSerial ::= SEQUENCE { issuer GeneralNames, serialNumber CertificateSerialNumber } PolicyInformation ::= SEQUENCE { policyIdentifier OBJECT IDENTIFIER, policyQualifiers SEQUENCE SIZE (1..MAX) OF PolicyQualifierInfo OPTIONAL } Public Functions SigningCertificateV2 inline SigningCertificateV2() SigningCertificateV2 SigningCertificateV2(const SigningCertificateV2 &) = default operator= SigningCertificateV2 &operator=(const SigningCertificateV2 &) = default clone inline virtual std::unique_ptr< Attribute > clone() const override print virtual std::string print() const override Print information about the underlying attribute. accept virtual void accept(Visitor &visitor) const override ~SigningCertificateV2 ~SigningCertificateV2() override = default Public Static Functions classof static inline bool classof(const Attribute *attr) Builder Builder class Builder Class that is used to rebuild a raw PE binary from a PE::Binary object. Public Functions Builder Builder() = delete Builder inline Builder( Binary &binary, config_t config) ~Builder ~Builder() build ok_error_t build() Perform the build process. get_build inline const std::vector &get_build() Return the build result. write void write(const std::string &filename) const Write the build result into the output file. write void write(std::ostream &os) const Write the build result into the os stream. build ok_error_t build(const DosHeader &dos_header) build ok_error_t build(const Header &header) build ok_error_t build(const OptionalHeader &optional_header) build ok_error_t build(const DataDirectory &data_directory) build ok_error_t build(const Section §ion) build_overlay ok_error_t build_overlay() build_relocations ok_error_t build_relocations() build_resources ok_error_t build_resources() build_debug_info ok_error_t build_debug_info() build_exports ok_error_t build_exports() PE_Tbuild_imports template ok_error_t build_imports() PE_Tbuild_tls template ok_error_t build_tls() PE_Tbuild_load_config template ok_error_t build_load_config() rsrc_data inline const std::vector &rsrc_data() const config_t struct config_t This structure is used to configure the build operation. The default value of these attributes is set to false if the operation modifies the binary layout even though nothing changed. For instance, building the import table always requires relocating the table to another place. Thus, the default value is false and must be explicitly set to true. Public Types resolved_iat_cbk_t using resolved_iat_cbk_t = std::function Public Members imports bool imports = false Whether the builder should reconstruct the imports table. This option should be turned on if you modify imports. Please check LIEF website for more details exports bool exports = false Whether the builder should reconstruct the export table This option should be turned on if you modify exports. Please check LIEF website for more details resources bool resources = true Whether the builder should regenerate the resources tree. relocations bool relocations = true Whether the builder should regenerate relocations. load_configuration bool load_configuration = true Whether the builder should regenerate the load config. tls bool tls = true Whether the builder should regenerate the TLS info. overlay bool overlay = true Whether the builder should write back any overlay data. debug bool debug = true Whether the builder should regenerate debug entries. dos_stub bool dos_stub = true Whether the builder should write back dos stub (including the rich header). rsrc_section std::string rsrc_section = \".rsrc\" If the resources tree needs to be relocated, this defines the name of the new section that contains the relocated tree. idata_section std::string idata_section = \".idata\" Section that holds the relocated import table (IAT/ILT). tls_section std::string tls_section = \".tls\" Section that holds the relocated TLS info. reloc_section std::string reloc_section = \".reloc\" Section that holds the relocated relocations. export_section std::string export_section = \".edata\" Section that holds the export table. debug_section std::string debug_section = \".debug\" Section that holds the debug entries. resolved_iat_cbk resolved_iat_cbk_t resolved_iat_cbk = nullptr Resources Manager ResourcesManager class ResourcesManager : public LIEF::Object The Resource Manager provides an enhanced API to manipulate the resource tree. Public Types TYPE enum class TYPE The different types of resources From https://learn.microsoft.com/en-us/windows/win32/menurc/resource-types . Values: CURSOR enumerator CURSOR = 1 BITMAP enumerator BITMAP = 2 ICON enumerator ICON = 3 MENU enumerator MENU = 4 DIALOG enumerator DIALOG = 5 STRING enumerator STRING = 6 FONTDIR enumerator FONTDIR = 7 FONT enumerator FONT = 8 ACCELERATOR enumerator ACCELERATOR = 9 RCDATA enumerator RCDATA = 10 MESSAGETABLE enumerator MESSAGETABLE = 11 GROUP_CURSOR enumerator GROUP_CURSOR = 12 GROUP_ICON enumerator GROUP_ICON = 14 VERSION enumerator VERSION = 16 DLGINCLUDE enumerator DLGINCLUDE = 17 PLUGPLAY enumerator PLUGPLAY = 19 VXD enumerator VXD = 20 ANICURSOR enumerator ANICURSOR = 21 ANIICON enumerator ANIICON = 22 HTML enumerator HTML = 23 MANIFEST enumerator MANIFEST = 24 dialogs_t using dialogs_t = ResourceDialog :: dialogs_t it_const_dialogs using it_const_dialogs = const_ref_iterator icons_t using icons_t = std::vector< ResourceIcon > it_const_icons using it_const_icons = const_ref_iterator < icons_t > accelerators_t using accelerators_t = std::vector< ResourceAccelerator > it_const_accelerators using it_const_accelerators = const_ref_iterator < accelerators_t > strings_table_t using strings_table_t = std::vector< string_entry_t > Public Functions ResourcesManager ResourcesManager() = delete ResourcesManager inline ResourcesManager( ResourceNode &rsrc) ResourcesManager inline ResourcesManager(const ResourcesManager &other) operator= inline ResourcesManager &operator=(const ResourcesManager &other) ResourcesManager ResourcesManager( ResourcesManager &&) = default operator= ResourcesManager &operator=( ResourcesManager &&) = default ~ResourcesManager ~ResourcesManager() override = default get_node_type inline ResourceNode *get_node_type( TYPE type) Return the ResourceNode associated with the given TYPE or a nullptr if not found;. get_node_type const ResourceNode *get_node_type( TYPE type) const get_types std::vector< TYPE > get_types() const List of TYPE present in the resources. has_type inline bool has_type( TYPE type) const true if the resource has the given TYPE node has_manifest inline bool has_manifest() const true if resources contain the Manifest element manifest std::string manifest() const Return the manifest as a std::string or an empty string if not found or corrupted. manifest void manifest(const std::string &manifest) Change or set the manifest. If the manifest node path does not exist, all required nodes are created. has_version inline bool has_version() const true if resources contain a LIEF::PE::ResourceVersion version std::vector< ResourceVersion > version() const Return a list of version info ( VS_VERSIONINFO ). has_icons inline bool has_icons() const true if resources contain a LIEF::PE::ResourceIcon icons it_const_icons icons() const Return the list of the icons present in the resources. add_icon void add_icon(const ResourceIcon &icon) Add an icon to the resources. change_icon void change_icon(const ResourceIcon &original, const ResourceIcon &newone) has_dialogs inline bool has_dialogs() const true if resources contain dialogs dialogs it_const_dialogs dialogs() const Return the list of the dialogs present in the resource. has_string_table inline bool has_string_table() const true if the resources contain a string table string_table strings_table_t string_table() const Return the list of the strings embedded in the string table ( RT_STRING ). has_html inline bool has_html() const true if the resources contain html html std::vector html() const Return the list of the html resources. has_accelerator inline bool has_accelerator() const true if the resources contain accelerator info accelerator it_const_accelerators accelerator() const Return the list of the accelerator in the resource. print std::string print(uint32_t depth = 0) const Print the resource tree to the given depth. accept virtual void accept(Visitor &visitor) const override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const ResourcesManager &m) string_entry_t struct string_entry_t This structure represent an entry in the string table ( RT_STRING ). Public Functions string_u8 std::string string_u8() const is_defined inline bool is_defined() const operator bool inline operator bool() const Public Members string std::u16string string id uint32_t id = 0 Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const string_entry_t &str) Resource Node ResourceNode class ResourceNode : public LIEF::Object Class which represents a Node in the resource tree. Subclassed by LIEF::PE::ResourceData , LIEF::PE::ResourceDirectory Public Types TYPE enum class TYPE Enum that identifies the type of a node in the resource tree. Values: UNKNOWN enumerator UNKNOWN = 0 DATA enumerator DATA DIRECTORY enumerator DIRECTORY childs_t using childs_t = std::vector> it_childs using it_childs = ref_iterator < childs_t &, ResourceNode *> it_const_childs using it_const_childs = const_ref_iterator Public Functions ResourceNode ResourceNode(const ResourceNode &other) operator= ResourceNode &operator=(const ResourceNode &other) ResourceNode ResourceNode( ResourceNode &&other) = default operator= ResourceNode &operator=( ResourceNode &&other) = default swap void swap( ResourceNode &other) ~ResourceNode ~ResourceNode() override clone virtual std::unique_ptr< ResourceNode > clone() const = 0 id inline uint32_t id() const Integer that identifies the Type, Name, or Language ID of the entry depending on its depth in the tree. name inline const std::u16string &name() const Name of the entry (if any). utf8_name std::string utf8_name() const UTF-8 representation of the name() . childs inline it_childs childs() Iterator on node’s children. childs inline it_const_childs childs() const has_name inline bool has_name() const True if the entry uses a name as ID depth inline uint32_t depth() const Current depth of the Node in the resource tree. is_directory inline bool is_directory() const True if the current entry is a ResourceDirectory . It can be safely cast with: const auto* dir_node = node.cast(); is_data inline bool is_data() const True if the current entry is a ResourceData . It can be safely cast with: const auto* data_node = node.cast(); id inline void id(uint32_t id) name void name(const std::string &name) name inline void name(std::u16string name) add_child ResourceNode &add_child(std::unique_ptr< ResourceNode > child) Add a new child to the current node, taking the ownership of the provided unique_ptr . add_child inline ResourceNode &add_child(const ResourceNode &child) Add a new child to the current node. delete_child void delete_child(uint32_t id) Delete the node with the given id . delete_child void delete_child(const ResourceNode &node) Delete the given node from the node’s children. accept virtual void accept(Visitor &visitor) const override Tcast template inline const T *cast() const Tcast template inline T *cast() to_string inline std::string to_string() const push_child inline void push_child(std::unique_ptr< ResourceNode > node) Public Static Functions parse static std::unique_ptr< ResourceNode > parse( BinaryStream &stream, uint64_t rva) Parse the resource tree from the provided BinaryStream stream and with the original RVA provided in the second parameter. The RVA value should come from the DataDirectory::RVA associated with the resource tree. parse static std::unique_ptr< ResourceNode > parse(const uint8_t *buffer, size_t size, uint64_t rva) Parse the resource tree from the provided buffer referenced by a pointer and the size. The second parameter is the RVA where the resource is (or was) located. parse static inline std::unique_ptr< ResourceNode > parse(const std::vector &buffer, uint64_t rva) See doc from other parse functions. parse static inline std::unique_ptr< ResourceNode > parse(span buffer, uint64_t rva) See doc from other parse functions. parse static std::unique_ptr< ResourceNode > parse( BinaryStream &stream, const Binary &bin) Friends operator<< friend std::ostream &operator<<(std::ostream &os, const ResourceNode &node) operator== friend bool operator==(const ResourceNode &LHS, const ResourceNode &RHS) operator!= inline friend bool operator!=(const ResourceNode &LHS, const ResourceNode &RHS) Resource Directory ResourceDirectory class ResourceDirectory : public LIEF::PE:: ResourceNode Public Functions ResourceDirectory inline ResourceDirectory() ResourceDirectory inline ResourceDirectory(uint32_t id) ResourceDirectory ResourceDirectory(const details::pe_resource_directory_table &header) ResourceDirectory ResourceDirectory(const ResourceDirectory &other) = default operator= ResourceDirectory &operator=(const ResourceDirectory &other) = default swap void swap( ResourceDirectory &other) noexcept ~ResourceDirectory ~ResourceDirectory() override = default clone inline virtual std::unique_ptr< ResourceNode > clone() const override characteristics inline uint32_t characteristics() const Resource characteristics. This field is reserved for future use. It is currently set to zero. time_date_stamp inline uint32_t time_date_stamp() const The time that the resource data was created by the resource compiler. major_version inline uint16_t major_version() const The major version number, set by the user. minor_version inline uint16_t minor_version() const The minor version number, set by the user. numberof_name_entries inline uint16_t numberof_name_entries() const The number of directory entries immediately following the table that use strings to identify Type, Name, or Language entries (depending on the level of the table). numberof_id_entries inline uint16_t numberof_id_entries() const The number of directory entries immediately following the Name entries that use numeric IDs for Type, Name, or Language entries. characteristics inline void characteristics(uint32_t characteristics) time_date_stamp inline void time_date_stamp(uint32_t time_date_stamp) major_version inline void major_version(uint16_t major_version) minor_version inline void minor_version(uint16_t minor_version) numberof_name_entries inline void numberof_name_entries(uint16_t numberof_name_entries) numberof_id_entries inline void numberof_id_entries(uint16_t numberof_id_entries) accept virtual void accept(Visitor &visitor) const override Public Static Functions classof static inline bool classof(const ResourceNode *node) Resource Data ResourceData class ResourceData : public LIEF::PE:: ResourceNode Class which represents a Data Node in the PE resources tree. Public Functions ResourceData inline ResourceData() ResourceData inline ResourceData(std::vector content, uint32_t code_page = 0) ResourceData inline ResourceData(const std::string &str, uint32_t code_page = 0) ResourceData ResourceData(const ResourceData &other) = default operator= ResourceData &operator=(const ResourceData &other) = default swap void swap( ResourceData &other) noexcept ~ResourceData ~ResourceData() override = default clone inline virtual std::unique_ptr< ResourceNode > clone() const override code_page inline uint32_t code_page() const Return the code page that is used to decode code point values within the resource data. Typically, the code page is the unicode code page. content inline span content() const Resource content. content inline span content() reserved inline uint32_t reserved() const Reserved value. Should be 0 . offset inline uint32_t offset() const Offset of the content within the resource. Warning This value may change when rebuilding resource table code_page inline void code_page(uint32_t code_page) content inline void content(std::vector content) content inline void content(const std::string &string) content inline void content(const uint8_t *buffer, size_t size) reserved inline void reserved(uint32_t value) accept virtual void accept(Visitor &visitor) const override Public Static Functions classof static inline bool classof(const ResourceNode *node) Resource Icon ResourceIcon class ResourceIcon : public LIEF::Object Public Functions ResourceIcon ResourceIcon() = default ResourceIcon ResourceIcon(const details::pe_resource_icon_group &header) ResourceIcon ResourceIcon(const details::pe_icon_header &header) ResourceIcon ResourceIcon(const ResourceIcon &) = default operator= ResourceIcon &operator=(const ResourceIcon &) = default ResourceIcon ResourceIcon( ResourceIcon &&) = default operator= ResourceIcon &operator=( ResourceIcon &&) = default ~ResourceIcon ~ResourceIcon() override = default id inline uint32_t id() const Id associated with the icon. lang inline uint32_t lang() const Language associated with the icon. sublang inline uint32_t sublang() const Sub language associated with the icon. width inline uint8_t width() const Width in pixels of the image. height inline uint8_t height() const Height in pixels of the image. color_count inline uint8_t color_count() const Number of colors in image (0 if >=8bpp). reserved inline uint8_t reserved() const Reserved (must be 0). planes inline uint16_t planes() const Color Planes. bit_count inline uint16_t bit_count() const Bits per pixel. size inline uint32_t size() const Size in bytes of the image. pixels inline span pixels() const Pixels of the image (as bytes). id inline void id(uint32_t id) lang inline void lang(uint32_t lang) sublang inline void sublang(uint32_t sublang) width inline void width(uint8_t width) height inline void height(uint8_t height) color_count inline void color_count(uint8_t color_count) reserved inline void reserved(uint8_t reserved) planes inline void planes(uint16_t planes) bit_count inline void bit_count(uint16_t bit_count) pixels inline void pixels(std::vector pixels) save void save(const std::string &filename) const Save the icon to the given filename. Parameters: filename – [in] Path to file in which the icon will be saved serialize std::vector serialize() const accept virtual void accept(Visitor &visitor) const override Public Static Functions from_serialization static result < ResourceIcon > from_serialization(const uint8_t *buffer, size_t size) from_serialization static inline result < ResourceIcon > from_serialization(const std::vector &bytes) from_bytes static inline result < ResourceIcon > from_bytes(LIEF::span bytes) Friends operator<< friend std::ostream &operator<<(std::ostream &os, const ResourceIcon &entry) Resource Dialog ResourceDialog class ResourceDialog : public LIEF::Object This class is the base class for either a regular (legacy) Dialog or an extended Dialog. These different kinds of Dialogs are documented by MS at the following addresses: https://learn.microsoft.com/en-us/windows/win32/api/winuser/ns-winuser-dlgtemplate https://learn.microsoft.com/fr-fr/windows/win32/dlgbox/dlgitemtemplateex Subclassed by LIEF::PE::ResourceDialogExtended , LIEF::PE::ResourceDialogRegular Public Types TYPE enum class TYPE Enum for discriminating the kind of the Dialog (regular vs extended). Values: UNKNOWN enumerator UNKNOWN = 0 REGULAR enumerator REGULAR EXTENDED enumerator EXTENDED DIALOG_STYLES enum class DIALOG_STYLES : uint32_t From: https://learn.microsoft.com/en-us/windows/win32/dlgbox/dialog-box-styles . Values: ABSALIGN enumerator ABSALIGN = 0x0001 SYSMODAL enumerator SYSMODAL = 0x0002 LOCALEDIT enumerator LOCALEDIT = 0x0020 SETFONT enumerator SETFONT = 0x0040 MODALFRAME enumerator MODALFRAME = 0x0080 NOIDLEMSG enumerator NOIDLEMSG = 0x0100 SETFOREGROUND enumerator SETFOREGROUND = 0x0200 S3DLOOK enumerator S3DLOOK = 0x0004 FIXEDSYS enumerator FIXEDSYS = 0x0008 NOFAILCREATE enumerator NOFAILCREATE = 0x0010 CONTROL enumerator CONTROL = 0x0400 CENTER enumerator CENTER = 0x0800 CENTERMOUSE enumerator CENTERMOUSE = 0x1000 CONTEXTHELP enumerator CONTEXTHELP = 0x2000 SHELLFONT enumerator SHELLFONT = SETFONT | FIXEDSYS WINDOW_STYLES enum class WINDOW_STYLES : uint32_t From: https://docs.microsoft.com/en-us/windows/win32/winmsg/window-styles . Values: OVERLAPPED enumerator OVERLAPPED = 0x00000000 POPUP enumerator POPUP = 0x80000000 CHILD enumerator CHILD = 0x40000000 MINIMIZE enumerator MINIMIZE = 0x20000000 VISIBLE enumerator VISIBLE = 0x10000000 DISABLED enumerator DISABLED = 0x08000000 CLIPSIBLINGS enumerator CLIPSIBLINGS = 0x04000000 CLIPCHILDREN enumerator CLIPCHILDREN = 0x02000000 MAXIMIZE enumerator MAXIMIZE = 0x01000000 CAPTION enumerator CAPTION = 0x00C00000 BORDER enumerator BORDER = 0x00800000 DLGFRAME enumerator DLGFRAME = 0x00400000 VSCROLL enumerator VSCROLL = 0x00200000 HSCROLL enumerator HSCROLL = 0x00100000 SYSMENU enumerator SYSMENU = 0x00080000 THICKFRAME enumerator THICKFRAME = 0x00040000 GROUP enumerator GROUP = 0x00020000 TABSTOP enumerator TABSTOP = 0x00010000 WINDOW_EXTENDED_STYLES enum class WINDOW_EXTENDED_STYLES : uint32_t From https://docs.microsoft.com/en-us/windows/win32/winmsg/extended-window-styles . Values: DLGMODALFRAME enumerator DLGMODALFRAME = 0x00000001 NOPARENTNOTIFY enumerator NOPARENTNOTIFY = 0x00000004 TOPMOST enumerator TOPMOST = 0x00000008 ACCEPTFILES enumerator ACCEPTFILES = 0x00000010 TRANSPARENT_STY enumerator TRANSPARENT_STY = 0x00000020 MDICHILD enumerator MDICHILD = 0x00000040 TOOLWINDOW enumerator TOOLWINDOW = 0x00000080 WINDOWEDGE enumerator WINDOWEDGE = 0x00000100 CLIENTEDGE enumerator CLIENTEDGE = 0x00000200 CONTEXTHELP enumerator CONTEXTHELP = 0x00000400 RIGHT enumerator RIGHT = 0x00001000 LEFT enumerator LEFT = 0x00000000 RTLREADING enumerator RTLREADING = 0x00002000 LEFTSCROLLBAR enumerator LEFTSCROLLBAR = 0x00004000 CONTROLPARENT enumerator CONTROLPARENT = 0x00010000 STATICEDGE enumerator STATICEDGE = 0x00020000 APPWINDOW enumerator APPWINDOW = 0x00040000 CONTROL_STYLES enum class CONTROL_STYLES : uint32_t From: https://learn.microsoft.com/en-us/windows/win32/controls/common-control-styles . Values: TOP enumerator TOP = 0x00000001 NOMOVEY enumerator NOMOVEY = 0x00000002 BOTTOM enumerator BOTTOM = 0x00000003 NORESIZE enumerator NORESIZE = 0x00000004 NOPARENTALIGN enumerator NOPARENTALIGN = 0x00000008 ADJUSTABLE enumerator ADJUSTABLE = 0x00000020 NODIVIDER enumerator NODIVIDER = 0x00000040 VERT enumerator VERT = 0x00000080 LEFT enumerator LEFT = VERT | TOP RIGHT enumerator RIGHT = VERT | BOTTOM NOMOVEX enumerator NOMOVEX = VERT | NOMOVEY dialogs_t using dialogs_t = std::vector> Public Functions ResourceDialog ResourceDialog() = default ResourceDialog ResourceDialog(const ResourceDialog &) = default operator= ResourceDialog &operator=(const ResourceDialog &) = default ResourceDialog ResourceDialog( ResourceDialog &&) = default operator= ResourceDialog &operator=( ResourceDialog &&) = default ResourceDialog inline ResourceDialog( TYPE ty) clone virtual std::unique_ptr< ResourceDialog > clone() const = 0 type inline TYPE type() const style inline uint32_t style() const The style of the dialog box. This member can be a combination of window style values (such as WINDOW_STYLES::CAPTION and WINDOW_STYLES::SYSMENU ) and dialog box style values (such as DIALOG_STYLES::CENTER ). extended_style inline uint32_t extended_style() const The extended styles for a window. This member is not used to create dialog boxes, but applications that use dialog box templates can use it to create other types of windows. For a list of values, see WINDOW_EXTENDED_STYLES . x inline int16_t x() const The x-coordinate, in dialog box units, of the upper-left corner of the dialog box. y inline int16_t y() const The y-coordinate, in dialog box units, of the upper-left corner of the dialog box. cx inline int16_t cx() const The width, in dialog box units, of the dialog box. cy inline int16_t cy() const The height, in dialog box units, of the dialog box. style inline ResourceDialog &style(uint32_t value) extended_style inline ResourceDialog &extended_style(uint32_t value) x inline ResourceDialog &x(int16_t value) y inline ResourceDialog &y(int16_t value) cx inline ResourceDialog &cx(int16_t value) cy inline ResourceDialog &cy(int16_t value) menu inline ResourceDialog &menu(std::u16string title) menu inline ResourceDialog &menu(uint16_t ord) window_class inline ResourceDialog &window_class(std::u16string title) window_class inline ResourceDialog &window_class(uint16_t ord) title inline ResourceDialog &title(std::u16string value) title ResourceDialog &title(const std::string &title) has inline bool has( DIALOG_STYLES style) const Check if the dialog uses the given dialog style. has inline bool has( WINDOW_STYLES style) const Check if the dialog uses the given window style. has inline bool has( WINDOW_EXTENDED_STYLES style) const Check if the dialog uses the given extended window style. styles_list std::vector< DIALOG_STYLES > styles_list() const List of DIALOG_STYLES used by this dialog. windows_styles_list std::vector< WINDOW_STYLES > windows_styles_list() const List of WINDOW_STYLES used by this dialog. windows_ext_styles_list std::vector< WINDOW_EXTENDED_STYLES > windows_ext_styles_list() const List of WINDOW_EXTENDED_STYLES used by this dialog. title inline const std::u16string &title() const title of the dialog box title_utf8 std::string title_utf8() const title of the dialog box menu inline const ordinal_or_str_t &menu() const ordinal or name value of a menu resource. window_class inline const ordinal_or_str_t &window_class() const ordinal of a predefined system window class or name of a registered window class to_string virtual std::string to_string() const = 0 ~ResourceDialog ~ResourceDialog() override = default Tas template inline const T *as() const Helper to downcast a ResourceDialog into a ResourceDialogRegular or a ResourceDialogExtended . Public Static Functions parse static dialogs_t parse(const ResourceData &node) Parse dialogs from the given resource data node. parse static dialogs_t parse(const uint8_t *buffer, size_t size) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const ResourceDialog &dialog) ordinal_or_str_t struct ordinal_or_str_t This structure wraps either an ordinal value ( uint16_t ) or a string. The ordinal value should refer to an existing resource id in the resource tree. Public Functions is_defined inline bool is_defined() const operator bool inline operator bool() const to_string std::string to_string() const Public Members ordinal result ordinal = make_error_code( lief_errors :: not_found ) string std::u16string string Item class Item This class represents an element of the dialog. It can be for instance, a button, or a caption. This class is inherited by the regular or extended dialog’s item: ResourceDialogRegular::Item ResourceDialogExtended::Item Subclassed by LIEF::PE::ResourceDialogExtended::Item , LIEF::PE::ResourceDialogRegular::Item Public Types WINDOW_CLASS enum class WINDOW_CLASS : uint32_t Values: BUTTON enumerator BUTTON = 0x0080 EDIT enumerator EDIT = 0x0081 STATIC enumerator STATIC = 0x0082 LIST_BOX enumerator LIST_BOX = 0x0083 SCROLL_BAR enumerator SCROLL_BAR = 0x0084 COMBO_BOX enumerator COMBO_BOX = 0x0085 Public Functions Item Item() = default Item Item(const Item &) = default operator= Item &operator=(const Item &) = default Item Item( Item &&) = default operator= Item &operator=( Item &&) = default style inline uint32_t style() const The style of the control. This can be a combination of WINDOW_STYLES or CONTROL_STYLES . extended_style inline uint32_t extended_style() const The extended styles for a window. This member is not used to create controls in dialog boxes, but applications that use dialog box templates can use it to create other types of windows. It can take a combination of WINDOW_EXTENDED_STYLES id inline int32_t id() const The control identifier. has inline bool has( WINDOW_STYLES style) const Check if this item has the given WINDOW_STYLES . has inline bool has( CONTROL_STYLES style) const Check if this item has the given CONTROL_STYLES . window_styles std::vector< WINDOW_STYLES > window_styles() const List of WINDOW_STYLES used by this item. control_styles std::vector< CONTROL_STYLES > control_styles() const List of CONTROL_STYLES used by this item. x inline int16_t x() const The x-coordinate, in dialog box units, of the upper-left corner of the control. This coordinate is always relative to the upper-left corner of the dialog box’s client area. y inline int16_t y() const The y-coordinate, in dialog box units, of the upper-left corner of the control. This coordinate is always relative to the upper-left corner of the dialog box’s client area. cx inline int16_t cx() const The width, in dialog box units, of the control. cy inline int16_t cy() const The height, in dialog box units, of the control. style inline Item &style(uint32_t value) extended_style inline Item &extended_style(uint32_t value) x inline Item &x(int16_t value) y inline Item &y(int16_t value) cx inline Item &cx(int16_t value) cy inline Item &cy(int16_t value) id inline Item &id(int32_t value) data inline Item &data(std::vector creation_data) clazz inline Item &clazz(std::u16string title) clazz inline Item &clazz(uint16_t ord) title inline Item &title(std::u16string value) title inline Item &title(uint16_t ord) clazz inline const ordinal_or_str_t &clazz() const Window class of the control. This can be either: a string that specifies the name of a registered window class or an ordinal value of a predefined system class. title inline const ordinal_or_str_t &title() const Title of the item which can be either: a string that specifies the initial text or an ordinal value of a resource, such as an icon, in an executable file. creation_data inline span creation_data() const Creation data that is passed to the control’s window procedure. creation_data inline span creation_data() ~Item virtual ~Item() = default to_string virtual std::string to_string() const = 0 Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Item &item) Resource Dialog – Regular ResourceDialogRegular class ResourceDialogRegular : public LIEF::PE:: ResourceDialog Implementation for a regular/legacy dialog box. See: https://learn.microsoft.com/en-us/windows/win32/api/winuser/ns-winuser-dlgtemplate Public Types items_t using items_t = std::vector< Item > it_items using it_items = ref_iterator < items_t &> it_const_items using it_const_items = const_ref_iterator Public Functions ResourceDialogRegular inline ResourceDialogRegular() ResourceDialogRegular ResourceDialogRegular(const ResourceDialogRegular &) = default operator= ResourceDialogRegular &operator=(const ResourceDialogRegular &) = default ResourceDialogRegular ResourceDialogRegular( ResourceDialogRegular &&) = default operator= ResourceDialogRegular &operator=( ResourceDialogRegular &&) = default clone inline virtual std::unique_ptr< ResourceDialog > clone() const override to_string virtual std::string to_string() const override nb_items inline uint32_t nb_items() const Number of control items. items inline it_items items() Iterator over the different control items. items inline it_const_items items() const add_item inline void add_item(const Item &item) Add a new control item to the dialog. font inline const font_t &font() const Additional font information. font inline ResourceDialogRegular &font(uint16_t pointsize, std::u16string name) font inline ResourceDialogRegular &font( font_t f) accept virtual void accept(Visitor &visitor) const override ~ResourceDialogRegular ~ResourceDialogRegular() override = default Public Static Functions create static std::unique_ptr< ResourceDialogRegular > create( BinaryStream &stream) classof static inline bool classof(const ResourceDialog *dialog) Item class Item : public LIEF::PE:: ResourceDialog :: Item This class represents a DLGTEMPLATE item: DLGITEMTEMPLATE . See: https://learn.microsoft.com/en-us/windows/win32/api/winuser/ns-winuser-dlgitemtemplate Public Functions Item Item() = default Item Item(const Item &) = default operator= Item &operator=(const Item &) = default Item Item( Item &&) = default operator= Item &operator=( Item &&) = default to_string virtual std::string to_string() const override ~Item virtual ~Item() override = default Public Static Functions parse static result < Item > parse( BinaryStream &stream) font_t struct font_t This structure represents additional font information that might be embedded at the end of the DLGTEMPLATE stream. Public Functions is_defined inline bool is_defined() const operator bool inline operator bool() const to_string std::string to_string() const Public Members point_size uint16_t point_size = 0 name std::u16string name Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const font_t &font) Resource Dialog – Extended ResourceDialogExtended class ResourceDialogExtended : public LIEF::PE:: ResourceDialog Implementation for the new extended dialogbox format. See: https://learn.microsoft.com/en-us/windows/win32/dlgbox/dlgtemplateex Public Types items_t using items_t = std::vector< Item > it_items using it_items = ref_iterator < items_t &> it_const_items using it_const_items = const_ref_iterator Public Functions ResourceDialogExtended inline ResourceDialogExtended() ResourceDialogExtended ResourceDialogExtended(const ResourceDialogExtended &) = default operator= ResourceDialogExtended &operator=(const ResourceDialogExtended &) = default ResourceDialogExtended ResourceDialogExtended( ResourceDialogExtended &&) = default operator= ResourceDialogExtended &operator=( ResourceDialogExtended &&) = default clone inline virtual std::unique_ptr< ResourceDialog > clone() const override accept virtual void accept(Visitor &visitor) const override to_string virtual std::string to_string() const override ~ResourceDialogExtended ~ResourceDialogExtended() override = default version inline uint16_t version() const The version number of the extended dialog box template. This member must be set to 1. signature inline uint16_t signature() const Indicates whether a template is an extended dialog box template. If signature is 0xFFFF, this is an extended dialog box template. In this case, the dlgVer member specifies the template version number. help_id inline uint32_t help_id() const The help context identifier for the dialog box window. When the system sends a WM_HELP message, it passes the helpID value in the dwContextId member of the HELPINFO structure. items inline it_items items() Iterator over the control items of this dialog box. items inline it_const_items items() const add_item inline void add_item(const Item &item) Add a new control item to the dialog. version inline ResourceDialogExtended &version(uint16_t value) signature inline ResourceDialogExtended &signature(uint16_t value) help_id inline ResourceDialogExtended &help_id(uint32_t value) font inline const font_t &font() const Additional font information. font inline ResourceDialogExtended &font(uint16_t point_size, uint16_t weight, bool italic, uint8_t charset, std::u16string typeface) font inline ResourceDialogExtended &font( font_t f) Public Static Functions create static std::unique_ptr< ResourceDialogExtended > create( BinaryStream &stream) classof static inline bool classof(const ResourceDialog *dialog) Item class Item : public LIEF::PE:: ResourceDialog :: Item This class represents a DLGTEMPLATEEX item ( DLGITEMTEMPLATEEX ). See: https://learn.microsoft.com/en-us/windows/win32/dlgbox/dlgitemtemplateex Public Functions Item Item() = default Item Item(const Item &) = default operator= Item &operator=(const Item &) = default Item Item( Item &&) = default operator= Item &operator=( Item &&) = default to_string virtual std::string to_string() const override help_id inline uint32_t help_id() const The help context identifier for the control. When the system sends a WM_HELP message, it passes the helpID value in the dwContextId member of the HELPINFO structure. help_id inline Item &help_id(uint32_t value) ~Item virtual ~Item() override = default Public Static Functions parse static result < Item > parse( BinaryStream &stream) font_t struct font_t Font information for the font to use for the text in the dialog box and its controls. Public Functions is_defined inline bool is_defined() const operator bool inline operator bool() const to_string std::string to_string() const Public Members point_size uint16_t point_size = 0 The point size of the font. weight uint16_t weight = 0 The weight of the font. italic bool italic = false Indicates whether the font is italic. charset uint8_t charset = false The character set to be used. typeface std::u16string typeface The name of the typeface for the font. Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const font_t &font) Resource Version ResourceVersion class ResourceVersion : public LIEF::Object Representation of the data associated with the RT_VERSION entry. See: VS_VERSIONINFO at https://learn.microsoft.com/en-us/windows/win32/menurc/vs-versioninfo Public Functions ResourceVersion ResourceVersion(const ResourceVersion &) = default operator= ResourceVersion &operator=(const ResourceVersion &) = default ResourceVersion ResourceVersion( ResourceVersion &&) = default operator= ResourceVersion &operator=( ResourceVersion &&) = default ~ResourceVersion ~ResourceVersion() override = default file_info inline const fixed_file_info_t &file_info() const Return the fixed file info ( VS_FIXEDFILEINFO ). file_info inline fixed_file_info_t &file_info() string_file_info inline ResourceStringFileInfo *string_file_info() Return the StringFileInfo element. string_file_info inline const ResourceStringFileInfo *string_file_info() const var_file_info inline ResourceVarFileInfo *var_file_info() Return the VarFileInfo element. type inline uint16_t type() const The type of data in the version resource. 1 if it contains text data 0 if it contains binary data key inline const std::u16string &key() const The Unicode string L\"VS_VERSION_INFO\" . key_u8 std::string key_u8() const The key as an utf8 string. type inline ResourceVersion &type(uint16_t value) key inline ResourceVersion &key(std::u16string value) var_file_info inline const ResourceVarFileInfo *var_file_info() const var_file_info inline ResourceVersion &var_file_info( ResourceVarFileInfo info) string_file_info inline ResourceVersion &string_file_info( ResourceStringFileInfo info) accept virtual void accept(Visitor &visitor) const override Public Static Functions parse static result < ResourceVersion > parse(const ResourceData &node) parse static result < ResourceVersion > parse(const uint8_t *p, size_t sz) parse static result < ResourceVersion > parse( BinaryStream &stream) Friends operator<< friend std::ostream &operator<<(std::ostream &os, const ResourceVersion &version) fixed_file_info_t struct fixed_file_info_t This structure represents the VS_FIXEDFILEINFO structure defined in verrsrc.h . Public Types VERSION_OS enum class VERSION_OS : uint32_t Values: UNKNOWN enumerator UNKNOWN = 0x00000000 The operating system for which the file was designed is unknown to the system. DOS enumerator DOS = 0x00010000 The file was designed for MS-DOS. OS216 enumerator OS216 = 0x00020000 The file was designed for 16-bit OS/2. OS232 enumerator OS232 = 0x00030000 The file was designed for 32-bit OS/2. NT enumerator NT = 0x00040000 The file was designed for Windows NT. WINCE enumerator WINCE = 0x00050000 The file was designed for Windows CE (Windows Embedded Compact). WINDOWS16 enumerator WINDOWS16 = 0x00000001 The file was designed for 16-bit Windows. PM16 enumerator PM16 = 0x00000002 The file was designed for 16-bit Presentation Manager. PM32 enumerator PM32 = 0x00000003 The file was designed for 32-bit Presentation Manager. WINDOWS32 enumerator WINDOWS32 = 0x00000004 The file was designed for 32-bit Windows. DOS_WINDOWS16 enumerator DOS_WINDOWS16 = DOS | WINDOWS16 The file was designed for 16-bit Windows running on MS-DOS. DOS_WINDOWS32 enumerator DOS_WINDOWS32 = DOS | WINDOWS32 The file was designed for 32-bit Windows running on MS-DOS. OS216_PM16 enumerator OS216_PM16 = OS216 | PM16 The file was designed for 16-bit Presentation Manager running on 16-bit OS/2. OS232_PM32 enumerator OS232_PM32 = OS232 | PM32 The file was designed for 32-bit Presentation Manager running on 32-bit OS/2. NT_WINDOWS32 enumerator NT_WINDOWS32 = NT | WINDOWS32 The file was designed for Windows NT. FILE_TYPE enum class FILE_TYPE : uint32_t Values: UNKNOWN enumerator UNKNOWN = 0x00000000 The file type is unknown to the system. APP enumerator APP = 0x00000001 The file contains an application. DLL enumerator DLL = 0x00000002 The file contains a DLL. DRV enumerator DRV = 0x00000003 The file contains a device driver. If dwFileType is VFT_DRV, dwFileSubtype contains a more specific description of the driver. FONT enumerator FONT = 0x00000004 The file contains a font. If dwFileType is VFT_FONT, dwFileSubtype contains a more specific description of the font file. VXD enumerator VXD = 0x00000005 The file contains a virtual device. STATIC_LIB enumerator STATIC_LIB = 0x00000007 The file contains a static-link library. FILE_TYPE_DETAILS enum class FILE_TYPE_DETAILS : uint64_t Values: UNKNOWN enumerator UNKNOWN = 0x00000000 The type is unknown by the system. DRV_PRINTER enumerator DRV_PRINTER = 0x00000001 | DRV_K The file contains a printer driver. DRV_KEYBOARD enumerator DRV_KEYBOARD = 0x00000002 | DRV_K The file contains a keyboard driver. DRV_LANGUAGE enumerator DRV_LANGUAGE = 0x00000003 | DRV_K The file contains a language driver. DRV_DISPLAY enumerator DRV_DISPLAY = 0x00000004 | DRV_K The file contains a display driver. DRV_MOUSE enumerator DRV_MOUSE = 0x00000005 | DRV_K The file contains a mouse driver. DRV_NETWORK enumerator DRV_NETWORK = 0x00000006 | DRV_K The file contains a network driver. DRV_SYSTEM enumerator DRV_SYSTEM = 0x00000007 | DRV_K The file contains a system driver. DRV_INSTALLABLE enumerator DRV_INSTALLABLE = 0x00000008 | DRV_K The file contains an installable driver. DRV_SOUND enumerator DRV_SOUND = 0x00000009 | DRV_K The file contains a sound driver. DRV_COMM enumerator DRV_COMM = 0x0000000A | DRV_K The file contains a communications driver. DRV_INPUTMETHOD enumerator DRV_INPUTMETHOD = 0x0000000B | DRV_K DRV_VERSIONED_PRINTER enumerator DRV_VERSIONED_PRINTER = 0x0000000C The file contains a versioned printer driver. FONT_RASTER enumerator FONT_RASTER = 0x00000001 | FONT_K The file contains a raster font. FONT_VECTOR enumerator FONT_VECTOR = 0x00000002 | FONT_K The file contains a vector font. FONT_TRUETYPE enumerator FONT_TRUETYPE = 0x00000003 | FONT_K The file contains a TrueType font. FILE_FLAGS enum class FILE_FLAGS : uint32_t Values: DEBUG enumerator DEBUG = 0x00000001 The file contains debugging information or is compiled with debugging features enabled. INFO_INFERRED enumerator INFO_INFERRED = 0x00000010 The file’s version structure was created dynamically; therefore, some of the members in this structure may be empty or incorrect. This flag should never be set in a file’s VS_VERSIONINFO data. PATCHED enumerator PATCHED = 0x00000004 The file has been modified and is not identical to the original shipping file of the same version number. PRERELEASE enumerator PRERELEASE = 0x00000002 The file is a development version, not a commercially released product. PRIVATEBUILD enumerator PRIVATEBUILD = 0x00000008 The file was not built using standard release procedures. If this flag is set, the StringFileInfo structure should contain a PrivateBuild entry. SPECIALBUILD enumerator SPECIALBUILD = 0x00000020 The file was built by the original company using standard release procedures but is a variation of the normal file of the same version number. If this flag is set, the StringFileInfo structure should contain a SpecialBuild entry. Public Functions has inline bool has( FILE_FLAGS f) const Check if the given FILE_FLAGS is present. flags std::vector< FILE_FLAGS > flags() const List of FILE_FLAGS . file_type_details inline FILE_TYPE_DETAILS file_type_details() const to_string std::string to_string() const Public Members signature uint32_t signature = 0 Contains the value 0xFEEF04BD . This is used with the szKey member of the VS_VERSIONINFO structure when searching a file for the VS_FIXEDFILEINFO structure. struct_version uint32_t struct_version = 0 The binary version number of this structure. The high-order word of this member contains the major version number, and the low-order word contains the minor version number. file_version_ms uint32_t file_version_ms = 0 The most significant 32 bits of the file’s binary version number. This member is used with file_version_ls to form a 64-bit value used for numeric comparisons. file_version_ls uint32_t file_version_ls = 0 The least significant 32 bits of the file’s binary version number. This member is used with file_version_ms to form a 64-bit value used for numeric comparisons. product_version_ms uint32_t product_version_ms = 0 The most significant 32 bits of the binary version number of the product with which this file was distributed. This member is used with product_version_ls to form a 64-bit value used for numeric comparisons. product_version_ls uint32_t product_version_ls = 0 The least significant 32 bits of the binary version number of the product with which this file was distributed. This member is used with product_version_ms to form a 64-bit value used for numeric comparisons. file_flags_mask uint32_t file_flags_mask = 0 Contains a bitmask that specifies the valid bits in file_flags. A bit is valid only if it was defined when the file was created. file_flags uint32_t file_flags = 0 Contains a bitmask that specifies the Boolean attributes of the file. This member can include one or more of the values specified in FILE_FLAGS . file_os uint32_t file_os = 0 The operating system for which this file was designed. This member can be one of the values specified in VERSION_OS . file_type uint32_t file_type = 0 The general type of file. This member can be one of the values specified in FILE_TYPE . All other values are reserved. file_subtype uint32_t file_subtype = 0 The function of the file. The possible values depend on the value of file_type. file_date_ms uint32_t file_date_ms = 0 The most significant 32 bits of the file’s 64-bit binary creation date and time stamp. file_date_ls uint32_t file_date_ls = 0 The least significant 32 bits of the file’s 64-bit binary creation date and time stamp. Public Static Attributes DRV_K static auto DRV_K = uint64_t(1) << 33 FONT_K static auto FONT_K = uint64_t(1) << 34 SIGNATURE_VALUE static auto SIGNATURE_VALUE = 0xFEEF04BD Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const fixed_file_info_t &info) Resource Var File Info ResourceVarFileInfo class ResourceVarFileInfo : public LIEF::Object Representation of the VarFileInfo structure. This structure represents the organization of data in a file-version resource. It contains version information not dependent on a particular language and code page combination. See: https://learn.microsoft.com/en-us/windows/win32/menurc/varfileinfo Public Types vars_t using vars_t = std::vector< ResourceVar > it_vars using it_vars = ref_iterator < vars_t &> it_const_vars using it_const_vars = const_ref_iterator Public Functions ResourceVarFileInfo ResourceVarFileInfo() = default ResourceVarFileInfo ResourceVarFileInfo(const ResourceVarFileInfo &) = default operator= ResourceVarFileInfo &operator=(const ResourceVarFileInfo &) = default ResourceVarFileInfo ResourceVarFileInfo( ResourceVarFileInfo &&) = default operator= ResourceVarFileInfo &operator=( ResourceVarFileInfo &&) = default ~ResourceVarFileInfo ~ResourceVarFileInfo() override = default type inline uint16_t type() const The type of data in the version resource. 1 if it contains text data 0 if it contains binary data key inline const std::u16string &key() const Signature of the structure. Must be the unicode string “VarFileInfo”. key_u8 std::string key_u8() const Key as an utf8 string. vars inline it_vars vars() Iterator over the embedded variables associated to the structure. vars inline it_const_vars vars() const type inline ResourceVarFileInfo &type(uint16_t type) key inline ResourceVarFileInfo &key(std::u16string key) add_var inline void add_var( ResourceVar var) accept virtual void accept(Visitor &visitor) const override Public Static Functions parse static result < ResourceVarFileInfo > parse( BinaryStream &stream) Friends operator<< friend std::ostream &operator<<(std::ostream &os, const ResourceVarFileInfo &entry) Resource Var ResourceVar class ResourceVar This class represents an element of the ResourceVarFileInfo structure It typically contains a list of language and code page identifier pairs that the version of the application or DLL supports. See: https://learn.microsoft.com/en-us/windows/win32/menurc/var-str Public Types values_t using values_t = std::vector Translation values as a vector of uint32_t . Public Functions ResourceVar ResourceVar() = default ResourceVar ResourceVar(const ResourceVar &) = default operator= ResourceVar &operator=(const ResourceVar &) = default ResourceVar ResourceVar( ResourceVar &&) = default operator= ResourceVar &operator=( ResourceVar &&) = default ~ResourceVar ~ResourceVar() = default key inline const std::u16string &key() const The Unicode string L\"Translation\" . type inline uint16_t type() const The type of data in the version resource: 1 if it contains text data 0 if it contains binary key_u8 std::string key_u8() const The key as an utf8 string. values inline const values_t &values() const Return the translation values. The low-order word of each uint32_t must contain a Microsoft language identifier, and the high-order word must contain the IBM code page number. Either high-order or low-order word can be zero, indicating that the file is language or code page independent values inline values_t &values() key inline ResourceVar &key(std::u16string key) type inline ResourceVar &type(uint16_t ty) add_value inline void add_value(uint32_t val) Public Static Functions parse static result < ResourceVar > parse( BinaryStream &stream) Friends operator<< friend std::ostream &operator<<(std::ostream &os, const ResourceVar &entry) Resource String File Info ResourceStringFileInfo class ResourceStringFileInfo : public LIEF::Object Representation of the StringFileInfo structure. It contains version information that can be displayed for a particular language and code page. See: https://learn.microsoft.com/en-us/windows/win32/menurc/stringfileinfo Public Types elements_t using elements_t = std::vector< ResourceStringTable > it_const_elements using it_const_elements = const_ref_iterator it_elements using it_elements = ref_iterator < elements_t &> Public Functions ResourceStringFileInfo ResourceStringFileInfo() = default ResourceStringFileInfo ResourceStringFileInfo(const ResourceStringFileInfo &) = default operator= ResourceStringFileInfo &operator=(const ResourceStringFileInfo &) = default ResourceStringFileInfo ResourceStringFileInfo( ResourceStringFileInfo &&) = default operator= ResourceStringFileInfo &operator=( ResourceStringFileInfo &&) = default ~ResourceStringFileInfo ~ResourceStringFileInfo() override = default type inline uint16_t type() const The type of data in the version resource. 1 if it contains text data 0 if it contains binary data key inline const std::u16string &key() const Signature of the structure. Must be the unicode string “StringFileInfo”. children inline it_const_elements children() const Iterator over the children values. children inline it_elements children() key_u8 std::string key_u8() const The key as an utf8 string. type inline ResourceStringFileInfo &type(uint16_t type) key inline ResourceStringFileInfo &key(std::u16string key) add_child inline void add_child( ResourceStringTable table) accept virtual void accept(Visitor &visitor) const override Public Static Functions parse static result < ResourceStringFileInfo > parse( BinaryStream &stream) Friends operator<< friend std::ostream &operator<<(std::ostream &os, const ResourceStringFileInfo &info) Resource String Table ResourceStringTable class ResourceStringTable : public LIEF::Object This class represents the StringTable structure. This structure can be seen as a dictionary of key-value pairs with keys and values defined as UTF-16 strings. Public Types entries_t using entries_t = std::vector< entry_t > it_entries using it_entries = ref_iterator < entries_t &> it_const_entries using it_const_entries = const_ref_iterator Public Functions ResourceStringTable ResourceStringTable() = default ResourceStringTable ResourceStringTable(const ResourceStringTable &) = default operator= ResourceStringTable &operator=(const ResourceStringTable &) = default ResourceStringTable ResourceStringTable( ResourceStringTable &&) = default operator= ResourceStringTable &operator=( ResourceStringTable &&) = default ~ResourceStringTable ~ResourceStringTable() override = default key inline const std::u16string &key() const An 8-digit hexadecimal number stored as a Unicode string. The four most significant digits represent the language identifier. The four least significant digits represent the code page for which the data is formatted. Each Microsoft Standard Language identifier contains two parts: the low-order 10 bits specify the major language, and the high-order 6 bits specify the sublanguage. type inline uint16_t type() const The type of data in the version resource: 1 if it contains text data 0 if it contains binary key_u8 std::string key_u8() const The key as an utf8 string. entries inline it_entries entries() Iterator over the different entry_t element of this table. entries inline it_const_entries entries() const get inline std::optional get(const std::u16string &key) const get std::optional get(const std::string &key) const key inline ResourceStringTable &key(std::u16string value) type inline ResourceStringTable &type(uint16_t value) add_entry inline void add_entry( entry_t entry) add_entry inline void add_entry(std::u16string key, std::u16string value) accept virtual void accept(Visitor &visitor) const override operator[] inline std::optional operator[](const std::string &str) const operator[] inline std::optional operator[](const std::u16string &str) const Public Static Functions parse static result < ResourceStringTable > parse( BinaryStream &stream) Friends operator<< friend std::ostream &operator<<(std::ostream &os, const ResourceStringTable &table) entry_t struct entry_t An entry in this table which is composed of an UTF-16 key and an UTF-16 value. Public Functions key_u8 std::string key_u8() const Key in utf8 representation. value_u8 std::string value_u8() const Value in utf8 representation. is_defined inline bool is_defined() const operator bool inline operator bool() const to_string inline std::string to_string() const Public Members key std::u16string key value std::u16string value Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const entry_t &entry) Resource Accelerator ResourceAccelerator class ResourceAccelerator : public LIEF::Object Public Types FLAGS enum class FLAGS : uint32_t From: https://docs.microsoft.com/en-us/windows/win32/menurc/acceltableentry . Values: VIRTKEY enumerator VIRTKEY = 0x01 The accelerator key is a virtual-key code. If this flag is not specified, the accelerator key is assumed to specify an ASCII character code. NOINVERT enumerator NOINVERT = 0x02 A menu item on the menu bar is not highlighted when an accelerator is used. This attribute is obsolete and retained only for backward compatibility with resource files designed for 16-bit Windows. SHIFT enumerator SHIFT = 0x04 The accelerator is activated only if the user presses the SHIFT key. This flag applies only to virtual keys. CONTROL enumerator CONTROL = 0x08 The accelerator is activated only if the user presses the CTRL key. This flag applies only to virtual keys. ALT enumerator ALT = 0x10 The accelerator is activated only if the user presses the ALT key. This flag applies only to virtual keys. END enumerator END = 0x80 The entry is last in an accelerator table. Public Functions ResourceAccelerator ResourceAccelerator() = default ResourceAccelerator explicit ResourceAccelerator(const details::pe_resource_acceltableentry&) ResourceAccelerator ResourceAccelerator(const ResourceAccelerator &) = default operator= ResourceAccelerator &operator=(const ResourceAccelerator &) = default ResourceAccelerator ResourceAccelerator( ResourceAccelerator &&) = default operator= ResourceAccelerator &operator=( ResourceAccelerator &&) = default ~ResourceAccelerator ~ResourceAccelerator() override = default flags_list std::vector< FLAGS > flags_list() const ansi_str inline const char *ansi_str() const flags inline int16_t flags() const Describe the keyboard accelerator characteristics. ansi inline int16_t ansi() const An ANSI character value or a virtual-key code that identifies the accelerator key. id inline uint16_t id() const An identifier for the keyboard accelerator. padding inline int16_t padding() const The number of bytes inserted to ensure that the structure is aligned on a DWORD boundary. has inline bool has( FLAGS flag) const Whether the entry has the given flag. add inline ResourceAccelerator &add( FLAGS flag) remove inline ResourceAccelerator &remove( FLAGS flag) accept virtual void accept(Visitor &visitor) const override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const ResourceAccelerator &acc) Rich Header RichHeader class RichHeader : public LIEF::Object Class which represents the not-so-documented rich header. This structure is usually located at the end of the Binary::dos_stub and contains information about the build environment. It is generated by the Microsoft linker link.exe and there are no options to disable or remove this information. Public Types entries_t using entries_t = std::vector< RichEntry > it_entries using it_entries = ref_iterator < entries_t &> it_const_entries using it_const_entries = const_ref_iterator Public Functions RichHeader RichHeader() = default RichHeader RichHeader(const RichHeader &) = default operator= RichHeader &operator=(const RichHeader &) = default ~RichHeader ~RichHeader() override = default key inline uint32_t key() const Key used to encode the header (xor operation). entries inline it_entries entries() Return an iterator over the PE::RichEntry within the header. entries inline it_const_entries entries() const key inline void key(uint32_t key) add_entry inline void add_entry( RichEntry entry) Add a new PE::RichEntry . add_entry inline void add_entry(uint16_t id, uint16_t build_id, uint32_t count) Add a new entry given the id, build_id and count. raw inline std::vector raw() const The raw structure of the Rich header without xor-encoding. This function is equivalent as calling RichHeader::raw(uint32_t) with a xor_key set to 0 raw std::vector raw(uint32_t xor_key) const Given this rich header, this function re-computes the raw bytes of the structure with the provided xor-key. You can access the decoded data’s structure with the xor_key set to 0 Parameters: xor_key – [in] The key to use for the xor-encoding (can be 0) hash inline std::vector hash( ALGORITHMS algo) const Compute the hash of the decoded rich header structure with the given hash algorithm. hash std::vector hash( ALGORITHMS algo, uint32_t xor_key) const Compute the hash of the rich header structure encoded with the provided key. accept virtual void accept(Visitor &visitor) const override Public Static Attributes RICH_MAGIC static uint8_t RICH_MAGIC[] = {'R', 'i', 'c', 'h'} RICH_MAGIC_INT static uint32_t RICH_MAGIC_INT = 0x68636952 DANS_MAGIC_NUMBER static uint32_t DANS_MAGIC_NUMBER = 0x536E6144 Friends operator<< friend std::ostream &operator<<(std::ostream &os, const RichHeader &rich_header) Rich Entry RichEntry class RichEntry : public LIEF::Object Class which represents an entry associated to the RichHeader . Public Functions RichEntry RichEntry() = default RichEntry inline RichEntry(uint16_t id, uint16_t build_id, uint32_t count) RichEntry RichEntry(const RichEntry &) = default operator= RichEntry &operator=(const RichEntry &) = default ~RichEntry ~RichEntry() override = default id inline uint16_t id() const Entry type. build_id inline uint16_t build_id() const Build number of the tool (if any). count inline uint32_t count() const Occurrence count. id inline void id(uint16_t id) build_id inline void build_id(uint16_t build_id) count inline void count(uint32_t count) accept virtual void accept(Visitor &visitor) const override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const RichEntry &rich_entry) Code Integrity CodeIntegrity class CodeIntegrity : public LIEF::Object Public Functions CodeIntegrity CodeIntegrity() = default ~CodeIntegrity ~CodeIntegrity() override = default operator= CodeIntegrity &operator=(const CodeIntegrity &) = default CodeIntegrity CodeIntegrity(const CodeIntegrity &) = default operator= CodeIntegrity &operator=( CodeIntegrity &&) = default CodeIntegrity CodeIntegrity( CodeIntegrity &&) = default flags inline uint16_t flags() const Flags to indicate if CI information is available, etc. catalog inline uint16_t catalog() const 0xFFFF means not available catalog_offset inline uint32_t catalog_offset() const reserved inline uint32_t reserved() const Additional bitmask to be defined later. flags inline CodeIntegrity &flags(uint16_t flags) catalog inline CodeIntegrity &catalog(uint16_t catalog) catalog_offset inline CodeIntegrity &catalog_offset(uint32_t catalog_offset) reserved inline CodeIntegrity &reserved(uint32_t reserved) accept virtual void accept(Visitor &visitor) const override Public Static Functions parse static result < CodeIntegrity > parse( Parser &ctx, BinaryStream &stream) Friends operator<< friend std::ostream &operator<<(std::ostream &os, const CodeIntegrity &entry) Pogo Pogo class Pogo : public LIEF::PE:: Debug This class represents a Profile Guided Optimization entry from the debug directory ( IMAGE_DEBUG_TYPE_POGO ). Public Types SIGNATURES enum class SIGNATURES Values: UNKNOWN enumerator UNKNOWN = 0x0fffffff ZERO enumerator ZERO = 0x00000000 LCTG enumerator LCTG = 0x4C544347 PGI enumerator PGI = 0x50474900 PGO enumerator PGO = 0x50474F00 PGU enumerator PGU = 0x50475500 SPGO enumerator SPGO = 0x5350474f entries_t using entries_t = std::vector< PogoEntry > it_entries using it_entries = ref_iterator < entries_t &> it_const_entries using it_const_entries = const_ref_iterator Public Functions Pogo inline Pogo() Pogo inline Pogo( SIGNATURES sig) Pogo inline Pogo(const details::pe_debug &debug, SIGNATURES sig, Section *sec) Pogo Pogo(const Pogo &) = default operator= Pogo &operator=(const Pogo &) = default Pogo Pogo( Pogo &&) = default operator= Pogo &operator=( Pogo &&) = default clone inline virtual std::unique_ptr< Debug > clone() const override signature inline SIGNATURES signature() const entries inline it_entries entries() An iterator over the different POGO elements. entries inline it_const_entries entries() const add inline void add( PogoEntry entry) accept virtual void accept(Visitor &visitor) const override to_string virtual std::string to_string() const override ~Pogo ~Pogo() override = default Public Static Functions classof static inline bool classof(const Debug *debug) Pogo Entry PogoEntry class PogoEntry : public LIEF::Object Public Functions PogoEntry PogoEntry() = default PogoEntry PogoEntry( PogoEntry &&other) = default operator= PogoEntry &operator=( PogoEntry &&other) = default PogoEntry PogoEntry(const PogoEntry &) = default PogoEntry inline PogoEntry(uint32_t start_rva, uint32_t size, std::string name) PogoEntry inline PogoEntry(uint32_t start_rva, uint32_t size) operator= PogoEntry &operator=(const PogoEntry &) = default ~PogoEntry ~PogoEntry() override = default start_rva inline uint32_t start_rva() const size inline uint32_t size() const name inline std::string_view name() const start_rva inline void start_rva(uint32_t start_rva) size inline void size(uint32_t size) name inline void name(std::string name) accept virtual void accept(Visitor &visitor) const override Friends operator<< friend std::ostream &operator<<(std::ostream &os, const PogoEntry &entry) Repro Repro class Repro : public LIEF::PE:: Debug This class represents a reproducible build entry from the debug directory. ( IMAGE_DEBUG_TYPE_REPRO ). This entry is usually generated with the undocumented /Brepro linker flag. See: https://nikhilism.com/post/2020/windows-deterministic-builds/ Public Functions Repro inline Repro() Repro inline Repro(std::vector hash) Repro inline Repro(const details::pe_debug &dbg, std::vector hash, Section *sec) Repro inline Repro(const details::pe_debug &dbg, Section *sec) Repro Repro(const Repro &other) = default operator= Repro &operator=(const Repro &other) = default Repro Repro( Repro &&) = default operator= Repro &operator=( Repro &&other) = default hash inline span hash() const The hash associated with the reproducible build. hash inline span hash() hash inline void hash(std::vector h) clone inline virtual std::unique_ptr< Debug > clone() const override accept virtual void accept(Visitor &visitor) const override to_string virtual std::string to_string() const override ~Repro ~Repro() override = default Public Static Functions classof static inline bool classof(const Debug *debug) PDBChecksum PDBChecksum class PDBChecksum : public LIEF::PE:: Debug This class represents the PDB Checksum debug entry which is essentially an array of bytes representing the checksum of the PDB content. Public Types HASH_ALGO enum class HASH_ALGO : uint32_t Values: UNKNOWN enumerator UNKNOWN = 0 SHA256 enumerator SHA256 Public Functions PDBChecksum inline PDBChecksum( HASH_ALGO algo, std::vector hash) PDBChecksum inline PDBChecksum(const details::pe_debug &dbg, Section *sec, HASH_ALGO algo, std::vector hash) PDBChecksum PDBChecksum(const PDBChecksum &other) = default operator= PDBChecksum &operator=(const PDBChecksum &other) = default PDBChecksum PDBChecksum( PDBChecksum &&) = default operator= PDBChecksum &operator=( PDBChecksum &&other) = default clone inline virtual std::unique_ptr< Debug > clone() const override hash inline span hash() const Hash of the PDB content. hash inline span hash() hash inline void hash(std::vector h) algorithm inline HASH_ALGO algorithm() const Algorithm used for hashing the PDB content. algorithm inline void algorithm( HASH_ALGO algo) ~PDBChecksum ~PDBChecksum() override = default to_string virtual std::string to_string() const override Public Static Functions parse static std::unique_ptr< PDBChecksum > parse(const details::pe_debug &hdr, Section *section, span payload) classof static inline bool classof(const Debug *debug) VCFeature VCFeature class VCFeature : public LIEF::PE:: Debug This class represents the IMAGE_DEBUG_TYPE_VC_FEATURE debug entry. Public Functions VCFeature inline VCFeature(const details::pe_debug &debug, Section *sec, uint32_t pre_vc, uint32_t c_cpp, uint32_t gs, uint32_t sdl, uint32_t guards) VCFeature VCFeature(const VCFeature &other) = default operator= VCFeature &operator=(const VCFeature &other) = default VCFeature VCFeature( VCFeature &&) = default operator= VCFeature &operator=( VCFeature &&other) = default clone inline virtual std::unique_ptr< Debug > clone() const override pre_vcpp inline uint32_t pre_vcpp() const Count for Pre-VC++ 11.00 . c_cpp inline uint32_t c_cpp() const Count for C/C++ . gs inline uint32_t gs() const Count for /GS (number of guard stack). sdl inline uint32_t sdl() const Whether /sdl was enabled for this binary. sdl stands for Security Development Lifecycle and provides enhanced security features like changing security-relevant warnings into errors or enforcing guard stack. guards inline uint32_t guards() const Count for /guardN . pre_vcpp inline VCFeature &pre_vcpp(uint32_t value) c_cpp inline VCFeature &c_cpp(uint32_t value) gs inline VCFeature &gs(uint32_t value) sdl inline VCFeature &sdl(uint32_t value) guards inline VCFeature &guards(uint32_t value) ~VCFeature ~VCFeature() override = default to_string virtual std::string to_string() const override Public Static Functions parse static std::unique_ptr< VCFeature > parse(const details::pe_debug &hdr, Section *section, span payload) classof static inline bool classof(const Debug *debug) ExDllCharacteristics ExDllCharacteristics class ExDllCharacteristics : public LIEF::PE:: Debug This class represents the IMAGE_DEBUG_TYPE_EX_DLLCHARACTERISTICS debug entry. Public Types CHARACTERISTICS enum class CHARACTERISTICS : uint32_t Extended DLL Characteristics. Values: CET_COMPAT enumerator CET_COMPAT = 0x01 CET_COMPAT_STRICT_MODE enumerator CET_COMPAT_STRICT_MODE = 0x02 CET_SET_CONTEXT_IP_VALIDATION_RELAXED_MODE enumerator CET_SET_CONTEXT_IP_VALIDATION_RELAXED_MODE = 0x04 CET_DYNAMIC_APIS_ALLOW_IN_PROC enumerator CET_DYNAMIC_APIS_ALLOW_IN_PROC = 0x08 CET_RESERVED_1 enumerator CET_RESERVED_1 = 0x10 CET_RESERVED_2 enumerator CET_RESERVED_2 = 0x20 FORWARD_CFI_COMPAT enumerator FORWARD_CFI_COMPAT = 0x40 HOTPATCH_COMPATIBLE enumerator HOTPATCH_COMPATIBLE = 0x80 Public Functions ExDllCharacteristics inline ExDllCharacteristics(const details::pe_debug &debug, Section *sec, uint32_t characteristics) ExDllCharacteristics ExDllCharacteristics(const ExDllCharacteristics &other) = default operator= ExDllCharacteristics &operator=(const ExDllCharacteristics &other) = default ExDllCharacteristics ExDllCharacteristics( ExDllCharacteristics &&) = default operator= ExDllCharacteristics &operator=( ExDllCharacteristics &&other) = default clone inline virtual std::unique_ptr< Debug > clone() const override characteristics inline CHARACTERISTICS characteristics() const Return the characteristics. characteristics_list std::vector< CHARACTERISTICS > characteristics_list() const Characteristics as a vector. has inline bool has( CHARACTERISTICS c) const Check if the given CHARACTERISTICS is used. ~ExDllCharacteristics ~ExDllCharacteristics() override = default to_string virtual std::string to_string() const override Public Static Functions parse static std::unique_ptr< ExDllCharacteristics > parse(const details::pe_debug &hdr, Section *section, span payload) classof static inline bool classof(const Debug *debug) Frame Pointer Omission (FPO) FPO class FPO : public LIEF::PE:: Debug This class represents the IMAGE_DEBUG_TYPE_FPO debug entry. Public Types FRAME_TYPE enum class FRAME_TYPE Values: FPO enumerator FPO = 0 TRAP enumerator TRAP = 1 TSS enumerator TSS = 2 NON_FPO enumerator NON_FPO = 3 entries_t using entries_t = std::vector< entry_t > it_entries using it_entries = ref_iterator < entries_t &> it_const_entries using it_const_entries = const_ref_iterator Public Functions FPO inline FPO(const details::pe_debug &hdr, Section *section) FPO FPO(const FPO &other) = default operator= FPO &operator=(const FPO &other) = default FPO FPO( FPO &&) = default operator= FPO &operator=( FPO &&other) = default clone inline virtual std::unique_ptr< Debug > clone() const override entries inline it_const_entries entries() const Iterator over the FPO entries. entries inline it_entries entries() ~FPO ~FPO() override = default to_string virtual std::string to_string() const override Public Static Functions parse static std::unique_ptr< FPO > parse(const details::pe_debug &hdr, Section *section, span payload) classof static inline bool classof(const Debug *debug) entry_t struct entry_t Represents the stack frame layout for a x86 function when frame pointer omission ( FPO ) optimization is used. Public Functions to_string std::string to_string() const Public Members rva uint32_t rva = 0 The function RVA. proc_size uint32_t proc_size = 0 The number of bytes in the function. nb_locals uint32_t nb_locals = 0 The number of local variables. parameters_size uint32_t parameters_size = 0 The size of the parameters. prolog_size uint16_t prolog_size = 0 The number of bytes in the function prologue code. nb_saved_regs uint16_t nb_saved_regs = 0 Number of registers saved. use_seh bool use_seh = false Whether the function uses structured exception handling. use_bp bool use_bp = false Whether the EBP register has been allocated. reserved uint16_t reserved = 0 Reserved for future use. type FRAME_TYPE type = FRAME_TYPE :: FPO Variable that indicates the frame type. Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const entry_t &entry) Exception Info ExceptionInfo class ExceptionInfo This class is the base class for any exception or runtime function entry. Subclassed by LIEF::PE::RuntimeFunctionAArch64 , LIEF::PE::RuntimeFunctionX64 Public Types ARCH enum class ARCH Arch discriminator for the subclasses. Values: UNKNOWN enumerator UNKNOWN = 0 ARM64 enumerator ARM64 X86_64 enumerator X86_64 Public Functions ExceptionInfo ExceptionInfo() = delete ExceptionInfo ExceptionInfo(const ExceptionInfo &) = default operator= ExceptionInfo &operator=(const ExceptionInfo &) = default ExceptionInfo ExceptionInfo( ExceptionInfo &&) = default operator= ExceptionInfo &operator=( ExceptionInfo &&) = default clone virtual std::unique_ptr< ExceptionInfo > clone() const = 0 ExceptionInfo inline ExceptionInfo( ARCH arch, uint64_t rva) ExceptionInfo inline ExceptionInfo( ARCH arch) arch inline ARCH arch() const Target architecture of this exception. rva_start inline uint32_t rva_start() const Function start address. offset inline uint64_t offset() const Offset in the binary where the raw exception information associated with this entry is defined. to_string virtual std::string to_string() const = 0 ~ExceptionInfo virtual ~ExceptionInfo() = default Tas template inline T *as() Helper to downcast an ExceptionInfo into a concrete implementation. Tas template inline const T *as() const Public Static Functions parse static std::unique_ptr< ExceptionInfo > parse( Parser &ctx, BinaryStream &strm) parse static std::unique_ptr< ExceptionInfo > parse( Parser &ctx, BinaryStream &strm, Header :: MACHINE_TYPES arch) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const ExceptionInfo &info) RuntimeFunctionX64 RuntimeFunctionX64 class RuntimeFunctionX64 : public LIEF::PE:: ExceptionInfo This class represents an entry in the exception table ( .pdata section) for the x86-64 architecture. Reference: https://learn.microsoft.com/en-us/cpp/build/exception-handling-x64 Public Types UNWIND_FLAGS enum class UNWIND_FLAGS : uint8_t Values: EXCEPTION_HANDLER enumerator EXCEPTION_HANDLER = 1 The function has an exception handler that should be called when looking for functions that need to examine exceptions. TERMINATE_HANDLER enumerator TERMINATE_HANDLER = 2 The function has a termination handler that should be called when unwinding an exception. CHAIN_INFO enumerator CHAIN_INFO = 4 The chained info payload references a previous RUNTIME_FUNCTION . UNWIND_OPCODES enum class UNWIND_OPCODES : uint32_t Values: PUSH_NONVOL enumerator PUSH_NONVOL = 0 Push a nonvolatile integer register, decrementing RSP by 8. The operation info is the number of the register. Because of the constraints on epilogs, PUSH_NONVOL unwind codes must appear first in the prolog and correspondingly, last in the unwind code array. This relative ordering applies to all other unwind codes except UNWIND_OPCODES::PUSH_MACHFRAME . ALLOC_LARGE enumerator ALLOC_LARGE = 1 Allocate a large-sized area on the stack. There are two forms. If the operation info equals 0, then the size of the allocation divided by 8 is recorded in the next slot, allowing an allocation up to 512K - 8. If the operation info equals 1, then the unscaled size of the allocation is recorded in the next two slots in little-endian format, allowing allocations up to 4GB - 8. ALLOC_SMALL enumerator ALLOC_SMALL = 2 Allocate a small-sized area on the stack. The size of the allocation is the operation info field * 8 + 8, allowing allocations from 8 to 128 bytes. SET_FPREG enumerator SET_FPREG = 3 Establish the frame pointer register by setting the register to some offset of the current RSP. The offset is equal to the Frame Register offset (scaled) field in the UNWIND_INFO * 16, allowing offsets from 0 to 240. The use of an offset permits establishing a frame pointer that points to the middle of the fixed stack allocation, helping code density by allowing more accesses to use short instruction forms. The operation info field is reserved and shouldn’t be used. SAVE_NONVOL enumerator SAVE_NONVOL = 4 Save a nonvolatile integer register on the stack using a MOV instead of a PUSH. This code is primarily used for shrink-wrapping, where a nonvolatile register is saved to the stack in a position that was previously allocated. The operation info is the number of the register. The scaled-by-8 stack offset is recorded in the next unwind operation code slot, as described in the note above. SAVE_NONVOL_FAR enumerator SAVE_NONVOL_FAR = 5 Save a nonvolatile integer register on the stack with a long offset, using a MOV instead of a PUSH. This code is primarily used for shrink-wrapping, where a nonvolatile register is saved to the stack in a position that was previously allocated. The operation info is the number of the register. The unscaled stack offset is recorded in the next two unwind operation code slots, as described in the note above. EPILOG enumerator EPILOG = 6 This entry is only relevant for version 2. It describes the function epilog. SPARE enumerator SPARE = 7 Reserved Originally SAVE_XMM128_FAR in version 1, but deprecated and removed. SAVE_XMM128 enumerator SAVE_XMM128 = 8 Save all 128 bits of a nonvolatile XMM register on the stack. The operation info is the number of the register. The scaled-by-16 stack offset is recorded in the next slot. SAVE_XMM128_FAR enumerator SAVE_XMM128_FAR = 9 Save all 128 bits of a nonvolatile XMM register on the stack with a long offset. The operation info is the number of the register. The unscaled stack offset is recorded in the next two slots. PUSH_MACHFRAME enumerator PUSH_MACHFRAME = 10 Push a machine frame. This unwind code is used to record the effect of a hardware interrupt or exception. UNWIND_REG enum class UNWIND_REG : uint32_t Values: RAX enumerator RAX = 0 RCX enumerator RCX RDX enumerator RDX RBX enumerator RBX RSP enumerator RSP RBP enumerator RBP RSI enumerator RSI RDI enumerator RDI R8 enumerator R8 R9 enumerator R9 R10 enumerator R10 R11 enumerator R11 R12 enumerator R12 R13 enumerator R13 R14 enumerator R14 R15 enumerator R15 Public Functions RuntimeFunctionX64 inline RuntimeFunctionX64(uint32_t rva_start, uint32_t rva_end, uint32_t unwind_rva) RuntimeFunctionX64 RuntimeFunctionX64(const RuntimeFunctionX64 &) = default operator= RuntimeFunctionX64 &operator=(const RuntimeFunctionX64 &) = default RuntimeFunctionX64 RuntimeFunctionX64( RuntimeFunctionX64 &&) = default operator= RuntimeFunctionX64 &operator=( RuntimeFunctionX64 &&) = default clone inline virtual std::unique_ptr< ExceptionInfo > clone() const override to_string virtual std::string to_string() const override rva_end inline uint32_t rva_end() const Function end address. unwind_rva inline uint32_t unwind_rva() const Unwind info address. size inline uint32_t size() const Size of the function (in bytes). unwind_info inline const unwind_info_t *unwind_info() const Detailed unwind information. unwind_info inline unwind_info_t *unwind_info() unwind_info inline void unwind_info( unwind_info_t info) ~RuntimeFunctionX64 ~RuntimeFunctionX64() override = default Public Static Functions classof static inline bool classof(const ExceptionInfo *info) unwind_info_t struct unwind_info_t This structure represents the UNWIND_INFO which records the effects a function has on the stack pointer, and where the nonvolatile registers are saved on the stack. Public Types opcodes_t using opcodes_t = std::vector> Public Functions has inline bool has( UNWIND_FLAGS flag) const Check if the given flag is used. opcodes opcodes_t opcodes() const Enhanced representation of the unwind code. to_string std::string to_string() const Pretty representation of this structure as a string. Public Members version uint8_t version = 0 Version number of the unwind data, currently 1 or 2. flags uint8_t flags = 0 See: UNWIND_FLAGS . sizeof_prologue uint8_t sizeof_prologue = 0 Length of the function prolog in bytes. count_opcodes uint8_t count_opcodes = 0 The number of slots in the unwind codes array. Some unwind codes, for example, UNWIND_OPCODES::SAVE_NONVOL , require more than one slot in the array. frame_reg uint8_t frame_reg = 0 If nonzero, then the function uses a frame pointer (FP), and this field is the number of the nonvolatile register used as the frame pointer, using the same encoding for the operation info field of UNWIND_OPCODES nodes. frame_reg_offset uint8_t frame_reg_offset = 0 If the frame register field is nonzero, this field is the scaled offset from RSP that is applied to the FP register when it’s established. raw_opcodes std::vector raw_opcodes An array of items that explains the effect of the prolog on the nonvolatile registers and RSP. handler std::optional handler An image-relative pointer to either the function’s language-specific exception or termination handler. This value is set if one of these flags is set: UNWIND_FLAGS::EXCEPTION_HANDLER , UNWIND_FLAGS::TERMINATE_HANDLER . chained RuntimeFunctionX64 *chained = nullptr If UNWIND_FLAGS::CHAIN_INFO is set, this attributes references the chained runtime function. Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const unwind_info_t &info) unwind_x64 - Code Code class Code Base class for all unwind operations. Subclassed by LIEF::PE::unwind_x64::Alloc , LIEF::PE::unwind_x64::Epilog , LIEF::PE::unwind_x64::PushMachFrame , LIEF::PE::unwind_x64::PushNonVol , LIEF::PE::unwind_x64::SaveNonVolatile , LIEF::PE::unwind_x64::SaveXMM128 , LIEF::PE::unwind_x64::SetFPReg , LIEF::PE::unwind_x64::Spare Public Types OPCODE using OPCODE = RuntimeFunctionX64 :: UNWIND_OPCODES REG using REG = RuntimeFunctionX64 :: UNWIND_REG Public Functions Code Code() = delete Code Code(const Code &) = default operator= Code &operator=(const Code &) = default Code Code( Code &&) = default operator= Code &operator=( Code &&) = default ~Code virtual ~Code() = default Code inline Code( OPCODE opcode, uint32_t pos) Code inline Code( OPCODE opcode) opcode inline OPCODE opcode() const The original opcode. position inline uint32_t position() const Offset in the prolog. to_string virtual std::string to_string() const Pretty representation. Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Code &code) unwind_x64 - Alloc Alloc class Alloc : public LIEF::PE::unwind_x64:: Code This class represents a stack-allocation operation (UNWIND_OPCODES::ALLOC_SMALL or UNWIND_OPCODES::ALLOC_LARGE). Public Functions Alloc inline Alloc(OPCODE op, size_t pos, uint32_t size) size inline uint32_t size() const The size allocated. to_string virtual std::string to_string() const override Pretty representation. ~Alloc ~Alloc() override = default Public Static Functions classof static inline bool classof(const Code *code) unwind_x64 - PushNonVol PushNonVol class PushNonVol : public LIEF::PE::unwind_x64:: Code Push a nonvolatile integer register, decrementing RSP by 8. Public Functions PushNonVol PushNonVol() = delete PushNonVol inline PushNonVol(REG reg, size_t pos) to_string virtual std::string to_string() const override Pretty representation. reg inline REG reg() const The register pushed. ~PushNonVol ~PushNonVol() override = default Public Static Functions classof static inline bool classof(const Code *code) unwind_x64 - PushMachFrame PushMachFrame class PushMachFrame : public LIEF::PE::unwind_x64:: Code Push a machine frame. Public Functions PushMachFrame PushMachFrame() = delete PushMachFrame inline PushMachFrame(uint8_t value, size_t pos) value inline uint8_t value() const 0 or 1 to_string virtual std::string to_string() const override Pretty representation. ~PushMachFrame ~PushMachFrame() override = default Public Static Functions classof static inline bool classof(const Code *code) unwind_x64 - SetFPReg SetFPReg class SetFPReg : public LIEF::PE::unwind_x64:: Code Establish the frame pointer register by setting the register to some offset of the current RSP. Public Functions SetFPReg SetFPReg() = delete SetFPReg inline SetFPReg(REG value, size_t pos) reg inline REG reg() const Frame pointer register. to_string virtual std::string to_string() const override Pretty representation. ~SetFPReg ~SetFPReg() override = default Public Static Functions classof static inline bool classof(const Code *code) unwind_x64 - SaveNonVolatile SaveNonVolatile class SaveNonVolatile : public LIEF::PE::unwind_x64:: Code Save a nonvolatile integer register on the stack using a MOV instead of a PUSH . Public Functions SaveNonVolatile SaveNonVolatile() = delete SaveNonVolatile inline SaveNonVolatile(OPCODE op, REG value, size_t pos, uint32_t offset) reg inline REG reg() const offset inline uint32_t offset() const to_string virtual std::string to_string() const override Pretty representation. ~SaveNonVolatile ~SaveNonVolatile() override = default Public Static Functions classof static inline bool classof(const Code *code) unwind_x64 - SaveXMM128 SaveXMM128 class SaveXMM128 : public LIEF::PE::unwind_x64:: Code Public Functions SaveXMM128 SaveXMM128() = delete SaveXMM128 inline SaveXMM128(OPCODE op, uint8_t num, size_t pos, uint32_t offset) num inline uint8_t num() const offset inline uint32_t offset() const to_string virtual std::string to_string() const override Pretty representation. ~SaveXMM128 ~SaveXMM128() override = default Public Static Functions classof static inline bool classof(const Code *code) unwind_x64 - Epilog Epilog class Epilog : public LIEF::PE::unwind_x64:: Code Describes the function’s epilog. Public Functions Epilog Epilog() = delete Epilog inline Epilog(uint8_t flags, uint8_t size) flags inline uint8_t flags() const size inline uint32_t size() const Size of the epilog. to_string virtual std::string to_string() const override Pretty representation. ~Epilog ~Epilog() override = default Public Static Functions classof static inline bool classof(const Code *code) unwind_x64 - Spare Spare class Spare : public LIEF::PE::unwind_x64:: Code Public Functions Spare inline Spare() to_string inline virtual std::string to_string() const override Pretty representation. ~Spare ~Spare() override = default Public Static Functions classof static inline bool classof(const Code *code) RuntimeFunctionAArch64 RuntimeFunctionAArch64 class RuntimeFunctionAArch64 : public LIEF::PE:: ExceptionInfo This class represents an entry in the exception table ( .pdata section) for the AArch64 architecture. Since the ARM64 unwinding info can be encoded in a packed and unpacked format, this class is inherited by LIEF::PE::unwind_aarch64::PackedFunction and LIEF::PE::unwind_aarch64::UnpackedFunction Reference: https://learn.microsoft.com/en-us/cpp/build/arm64-exception-handling#arm64-exception-handling-information Subclassed by LIEF::PE::unwind_aarch64::PackedFunction , LIEF::PE::unwind_aarch64::UnpackedFunction Public Types PACKED_FLAGS enum class PACKED_FLAGS Values: UNPACKED enumerator UNPACKED = 0 PACKED enumerator PACKED = 1 PACKED_FRAGMENT enumerator PACKED_FRAGMENT = 2 RESERVED enumerator RESERVED = 3 Public Functions RuntimeFunctionAArch64 inline RuntimeFunctionAArch64(uint64_t RVA, uint32_t length, PACKED_FLAGS flag) RuntimeFunctionAArch64 RuntimeFunctionAArch64(const RuntimeFunctionAArch64 &) = default operator= RuntimeFunctionAArch64 &operator=(const RuntimeFunctionAArch64 &) = default RuntimeFunctionAArch64 RuntimeFunctionAArch64( RuntimeFunctionAArch64 &&) = default operator= RuntimeFunctionAArch64 &operator=( RuntimeFunctionAArch64 &&) = default clone inline virtual std::unique_ptr< ExceptionInfo > clone() const override length inline uint32_t length() const Length of the function in bytes. flag inline PACKED_FLAGS flag() const Flag describing the format the unwind data. rva_end inline uint32_t rva_end() const Function end address. to_string virtual std::string to_string() const override ~RuntimeFunctionAArch64 ~RuntimeFunctionAArch64() override = default Public Static Functions parse static std::unique_ptr< RuntimeFunctionAArch64 > parse( Parser &ctx, BinaryStream &strm) classof static inline bool classof(const ExceptionInfo *info) Runtime AArch64 (Packed) Function PackedFunction class PackedFunction : public LIEF::PE:: RuntimeFunctionAArch64 This class represents a packed AArch64 exception entry. An excepted entry can be packed if the unwind data fit in 30 bits Reference: https://learn.microsoft.com/en-us/cpp/build/arm64-exception-handling?view=msvc-170#packed-unwind-data Public Functions PackedFunction PackedFunction(const PackedFunction &) = default operator= PackedFunction &operator=(const PackedFunction &) = default PackedFunction PackedFunction( PackedFunction &&) = default operator= PackedFunction &operator=( PackedFunction &&) = default ~PackedFunction ~PackedFunction() override = default clone inline virtual std::unique_ptr< ExceptionInfo > clone() const override to_string virtual std::string to_string() const override frame_size inline uint8_t frame_size() const Size of the allocated stack. reg_I inline uint8_t reg_I() const Number of non-volatile INT registers (x19-x28) saved in the canonical stack location. reg_F inline uint8_t reg_F() const Number of non-volatile FP registers (d8-d15) saved in the canonical stack location. H inline uint8_t H() const 1-bit flag indicating whether the function homes the integer parameter registers (x0-x7) by storing them at the very start of the function. (0 = doesn’t home registers, 1 = homes registers). CR inline uint8_t CR() const Flag indicating whether the function includes extra instructions to set up a frame chain and return link. frame_size inline PackedFunction &frame_size(uint8_t value) reg_I inline PackedFunction ®_I(uint8_t value) reg_F inline PackedFunction ®_F(uint8_t value) H inline PackedFunction &H(uint8_t value) CR inline PackedFunction &CR(uint8_t value) RuntimeFunctionAArch64 inline RuntimeFunctionAArch64(uint64_t RVA, uint32_t length, PACKED_FLAGS flag) RuntimeFunctionAArch64 RuntimeFunctionAArch64(const RuntimeFunctionAArch64 &) = default RuntimeFunctionAArch64 RuntimeFunctionAArch64( RuntimeFunctionAArch64 &&) = default Public Static Functions parse static std::unique_ptr< PackedFunction > parse( Parser &ctx, BinaryStream &strm, uint32_t rva, uint32_t unwind_data) classof static inline bool classof(const ExceptionInfo *info) Runtime AArch64 (UnpackedFunction) Function UnpackedFunction class UnpackedFunction : public LIEF::PE:: RuntimeFunctionAArch64 This class represents an unpacked AArch64 exception entry. Reference: https://learn.microsoft.com/en-us/cpp/build/arm64-exception-handling?view=msvc-170#xdata-records Public Types epilog_scopes_t using epilog_scopes_t = std::vector< epilog_scope_t > it_epilog_scopes using it_epilog_scopes = ref_iterator < epilog_scopes_t &> it_const_epilog_scopes using it_const_epilog_scopes = const_ref_iterator Public Functions UnpackedFunction inline UnpackedFunction(uint32_t rva, uint32_t length) UnpackedFunction UnpackedFunction(const UnpackedFunction &) = default operator= UnpackedFunction &operator=(const UnpackedFunction &) = default UnpackedFunction UnpackedFunction( UnpackedFunction &&) = default operator= UnpackedFunction &operator=( UnpackedFunction &&) = default ~UnpackedFunction ~UnpackedFunction() override = default clone inline virtual std::unique_ptr< ExceptionInfo > clone() const override to_string virtual std::string to_string() const override xdata_rva inline uint32_t xdata_rva() const RVA where this unpacked data is located (usually pointing in .xdata ). version inline uint32_t version() const Describes the version of the remaining .xdata . Currently (2025-01-04), only version 0 is defined, so values of 1-3 aren’t permitted. X inline uint8_t X() const 1-bit field that indicates the presence (1) or absence (0) of exception data. E inline uint8_t E() const 1-bit field that indicates that information describing a single epilog is packed into the header (1) rather than requiring more scope words later (0). epilog_count inline uint16_t epilog_count() const If E() == 0 , specifies the count of the total number of epilog scopes. Otherwise, return 0 epilog_offset inline uint16_t epilog_offset() const If E() == 1 , index of the first unwind code that describes the one and only epilog. code_words inline uint32_t code_words() const Number of 32-bit words needed to contain all the unwind codes. exception_handler inline uint32_t exception_handler() const Exception handler RVA (if any). unwind_code inline span unwind_code() const Bytes that contain the unwind codes. unwind_code inline span unwind_code() is_extended inline bool is_extended() const Whether it uses 2-words encoding. epilog_scopes_offset inline uint64_t epilog_scopes_offset() const unwind_code_offset inline uint64_t unwind_code_offset() const exception_handler_offset inline uint64_t exception_handler_offset() const epilog_scopes inline it_epilog_scopes epilog_scopes() Iterator over the epilog scopes. epilog_scopes inline it_const_epilog_scopes epilog_scopes() const xdata_rva inline UnpackedFunction &xdata_rva(uint32_t value) version inline UnpackedFunction &version(uint32_t value) X inline UnpackedFunction &X(uint8_t value) E inline UnpackedFunction &E(uint8_t value) epilog_cnt_offset inline UnpackedFunction &epilog_cnt_offset(uint16_t value) code_words inline UnpackedFunction &code_words(uint32_t value) exception_handler inline UnpackedFunction &exception_handler(uint32_t value) epilog_scopes inline UnpackedFunction &epilog_scopes( epilog_scopes_t scopes) unwind_code inline UnpackedFunction &unwind_code(std::vector code) is_extended inline UnpackedFunction &is_extended(bool value) Public Static Functions parse static std::unique_ptr< UnpackedFunction > parse( Parser &ctx, BinaryStream &strm, uint32_t xdata_rva, uint32_t rva) classof static inline bool classof(const ExceptionInfo *info) epilog_scope_t struct epilog_scope_t This structure describes an epilog scope. Public Members start_offset uint32_t start_offset = 0 Offset of the epilog relatives to the start of the function. start_index uint16_t start_index = 0 Byte index of the first unwind code that describes this epilog. reserved uint8_t reserved = 0 Reserved for future expansion. Should be 0. Public Static Functions from_raw static epilog_scope_t from_raw(uint32_t raw) Load Configuration LoadConfiguration class LoadConfiguration : public LIEF::Object This class represents the load configuration data associated with the IMAGE_LOAD_CONFIG_DIRECTORY . This structure is frequently updated by Microsoft to add new metadata. Reference: https://github.com/MicrosoftDocs/sdk-api/blob/cbeab4d371e8bc7e352c4d3a4c5819caa08c6a1c/sdk-api-src/content/winnt/ns-winnt-image_load_config_directory64.md#L2 Public Types IMAGE_GUARD enum class IMAGE_GUARD : uint32_t Values: NONE enumerator NONE = 0x00000000 CF_INSTRUMENTED enumerator CF_INSTRUMENTED = 0x100 Module performs control flow integrity checks using system-supplied support. CFW_INSTRUMENTED enumerator CFW_INSTRUMENTED = 0x200 Module performs control flow and write integrity checks. CF_FUNCTION_TABLE_PRESENT enumerator CF_FUNCTION_TABLE_PRESENT = 0x400 Module contains valid control flow target metadata. SECURITY_COOKIE_UNUSED enumerator SECURITY_COOKIE_UNUSED = 0x800 Module does not make use of the /GS security cookie. PROTECT_DELAYLOAD_IAT enumerator PROTECT_DELAYLOAD_IAT = 0x1000 Module supports read only delay load IAT. DELAYLOAD_IAT_IN_ITS_OWN_SECTION enumerator DELAYLOAD_IAT_IN_ITS_OWN_SECTION = 0x2000 Delayload import table in its own .didat section (with nothing else in it) that can be freely reprotected. CF_EXPORT_SUPPRESSION_INFO_PRESENT enumerator CF_EXPORT_SUPPRESSION_INFO_PRESENT = 0x4000 Module contains suppressed export information. This also infers that the address taken IAT table is also present in the load config. CF_ENABLE_EXPORT_SUPPRESSION enumerator CF_ENABLE_EXPORT_SUPPRESSION = 0x8000 Module enables suppression of exports. CF_LONGJUMP_TABLE_PRESENT enumerator CF_LONGJUMP_TABLE_PRESENT = 0x10000 Module contains longjmp target information. RF_INSTRUMENTED enumerator RF_INSTRUMENTED = 0x00020000 Module contains return flow instrumentation and metadata. RF_ENABLE enumerator RF_ENABLE = 0x00040000 Module requests that the OS enable return flow protection. RF_STRICT enumerator RF_STRICT = 0x00080000 Module requests that the OS enable return flow protection in strict mode. RETPOLINE_PRESENT enumerator RETPOLINE_PRESENT = 0x00100000 Module was built with retpoline support. EH_CONTINUATION_TABLE_PRESENT enumerator EH_CONTINUATION_TABLE_PRESENT = 0x400000 Module contains EH continuation target information. XFG_ENABLED enumerator XFG_ENABLED = 0x00800000 Module was built with xfg (deprecated). CASTGUARD_PRESENT enumerator CASTGUARD_PRESENT = 0x01000000 Module has CastGuard instrumentation present. MEMCPY_PRESENT enumerator MEMCPY_PRESENT = 0x02000000 Module has Guarded Memcpy instrumentation present. guard_functions_t using guard_functions_t = std::vector< guard_function_t > it_guard_functions using it_guard_functions = ref_iterator < guard_functions_t &> it_const_guard_functions using it_const_guard_functions = const_ref_iterator dynamic_relocations_t using dynamic_relocations_t = std::vector> it_dynamic_relocations_t using it_dynamic_relocations_t = ref_iterator < dynamic_relocations_t &, DynamicRelocation *> it_const_dynamic_relocations_t using it_const_dynamic_relocations_t = const_ref_iterator Public Functions LoadConfiguration LoadConfiguration() operator= LoadConfiguration &operator=(const LoadConfiguration &) LoadConfiguration LoadConfiguration(const LoadConfiguration &) LoadConfiguration LoadConfiguration( LoadConfiguration &&) operator= LoadConfiguration &operator=( LoadConfiguration &&) characteristics inline uint32_t characteristics() const Characteristics of the structure which is defined by its size. size inline uint32_t size() const Size of the current structure. timedatestamp inline uint32_t timedatestamp() const The date and time stamp value. major_version inline uint16_t major_version() const Major version. minor_version inline uint16_t minor_version() const Minor version. global_flags_clear inline uint32_t global_flags_clear() const The global flags that control system behavior. For more information, see Gflags.exe . global_flags_set inline uint32_t global_flags_set() const The global flags that control system behavior. For more information, see Gflags.exe . critical_section_default_timeout inline uint32_t critical_section_default_timeout() const The critical section default time-out value. decommit_free_block_threshold inline uint64_t decommit_free_block_threshold() const The size of the minimum block that must be freed before it is freed (de-committed), in bytes. This value is advisory. decommit_total_free_threshold inline uint64_t decommit_total_free_threshold() const The size of the minimum total memory that must be freed in the process heap before it is freed (de-committed), in bytes. This value is advisory. lock_prefix_table inline uint64_t lock_prefix_table() const The VA of a list of addresses where the LOCK prefix is used. These will be replaced by NOP on single-processor systems. This member is available only for x86. maximum_allocation_size inline uint64_t maximum_allocation_size() const The maximum allocation size, in bytes. This member is obsolete and is used only for debugging purposes. virtual_memory_threshold inline uint64_t virtual_memory_threshold() const The maximum block size that can be allocated from heap segments, in bytes. process_affinity_mask inline uint64_t process_affinity_mask() const The process affinity mask. For more information, see GetProcessAffinityMask . This member is available only for .exe files. process_heap_flags inline uint32_t process_heap_flags() const The process heap flags. For more information, see HeapCreate . csd_version inline uint16_t csd_version() const The service pack version. reserved1 inline uint16_t reserved1() const See: dependent_load_flags() . dependent_load_flags inline uint16_t dependent_load_flags() const Alias for reserved1() . The default load flags used when the operating system resolves the statically linked imports of a module. For more information, see LoadLibraryEx . editlist inline uint64_t editlist() const Reserved for use by the system. security_cookie inline uint64_t security_cookie() const A pointer to a cookie that is used by Visual C++ or GS implementation. se_handler_table inline std::optional se_handler_table() const The VA of the sorted table of RVAs of each valid, unique handler in the image. This member is available only for x86. se_handler_count inline std::optional se_handler_count() const The count of unique handlers in the table. This member is available only for x86. seh_functions inline const std::vector &seh_functions() const Return the list of the function RVA in the SEH table (if any). guard_cf_check_function_pointer inline std::optional guard_cf_check_function_pointer() const The VA where Control Flow Guard check-function pointer is stored. guard_cf_dispatch_function_pointer inline std::optional guard_cf_dispatch_function_pointer() const The VA where Control Flow Guard dispatch-function pointer is stored. guard_cf_function_table inline std::optional guard_cf_function_table() const The VA of the sorted table of RVAs of each Control Flow Guard function in the image. guard_cf_function_count inline std::optional guard_cf_function_count() const The count of unique RVAs in the guard_cf_function_table() table. guard_cf_functions inline it_const_guard_functions guard_cf_functions() const Iterator over the Control Flow Guard functions referenced by guard_cf_function_table() . guard_cf_functions inline it_guard_functions guard_cf_functions() guard_flags inline std::optional guard_flags() const Control Flow Guard related flags. has inline bool has( IMAGE_GUARD flag) const Check if the given flag is present. guard_cf_flags_list std::vector< IMAGE_GUARD > guard_cf_flags_list() const List of flags. code_integrity inline const CodeIntegrity *code_integrity() const Code integrity information. code_integrity inline CodeIntegrity *code_integrity() guard_address_taken_iat_entry_table inline std::optional guard_address_taken_iat_entry_table() const The VA where Control Flow Guard address taken IAT table is stored. guard_address_taken_iat_entry_count inline std::optional guard_address_taken_iat_entry_count() const The count of unique RVAs in the table pointed by guard_address_taken_iat_entry_table() . guard_address_taken_iat_entries inline it_const_guard_functions guard_address_taken_iat_entries() const List of RVA pointed by guard_address_taken_iat_entry_table() . guard_address_taken_iat_entries inline it_guard_functions guard_address_taken_iat_entries() guard_long_jump_target_table inline std::optional guard_long_jump_target_table() const The VA where Control Flow Guard long jump target table is stored. guard_long_jump_target_count inline std::optional guard_long_jump_target_count() const The count of unique RVAs in the table pointed by guard_long_jump_target_table. guard_long_jump_targets inline it_const_guard_functions guard_long_jump_targets() const List of RVA pointed by guard_address_taken_iat_entry_table() . guard_long_jump_targets inline it_guard_functions guard_long_jump_targets() dynamic_value_reloc_table inline std::optional dynamic_value_reloc_table() const VA pointing to a IMAGE_DYNAMIC_RELOCATION_TABLE . dynamic_relocations inline it_dynamic_relocations_t dynamic_relocations() Return an iterator over the Dynamic relocations (DVRT). dynamic_relocations inline it_const_dynamic_relocations_t dynamic_relocations() const hybrid_metadata_pointer inline std::optional hybrid_metadata_pointer() const Alias for chpe_metadata_pointer() . chpe_metadata_pointer inline std::optional chpe_metadata_pointer() const VA to the extra Compiled Hybrid Portable Executable (CHPE) metadata. chpe_metadata inline const CHPEMetadata *chpe_metadata() const Compiled Hybrid Portable Executable (CHPE) metadata (if any). chpe_metadata inline CHPEMetadata *chpe_metadata() guard_rf_failure_routine inline std::optional guard_rf_failure_routine() const VA of the failure routine. guard_rf_failure_routine_function_pointer inline std::optional guard_rf_failure_routine_function_pointer() const VA of the failure routine fptr . dynamic_value_reloctable_offset inline std::optional dynamic_value_reloctable_offset() const Offset of dynamic relocation table relative to the relocation table. dynamic_value_reloctable_section inline std::optional dynamic_value_reloctable_section() const The section index of the dynamic value relocation table. reserved2 inline std::optional reserved2() const Must be zero. guard_rf_verify_stackpointer_function_pointer inline std::optional guard_rf_verify_stackpointer_function_pointer() const VA of the Function verifying the stack pointer. hotpatch_table_offset inline std::optional hotpatch_table_offset() const Offset to the hotpatch table. reserved3 inline std::optional reserved3() const enclave_configuration_ptr inline std::optional enclave_configuration_ptr() const enclave_config inline const EnclaveConfiguration *enclave_config() const enclave_config inline EnclaveConfiguration *enclave_config() volatile_metadata_pointer inline std::optional volatile_metadata_pointer() const volatile_metadata inline const VolatileMetadata *volatile_metadata() const volatile_metadata inline VolatileMetadata *volatile_metadata() guard_eh_continuation_table inline std::optional guard_eh_continuation_table() const guard_eh_continuation_count inline std::optional guard_eh_continuation_count() const guard_eh_continuation_functions inline it_const_guard_functions guard_eh_continuation_functions() const guard_eh_continuation_functions inline it_guard_functions guard_eh_continuation_functions() guard_xfg_check_function_pointer inline std::optional guard_xfg_check_function_pointer() const guard_xfg_dispatch_function_pointer inline std::optional guard_xfg_dispatch_function_pointer() const guard_xfg_table_dispatch_function_pointer inline std::optional guard_xfg_table_dispatch_function_pointer() const cast_guard_os_determined_failure_mode inline std::optional cast_guard_os_determined_failure_mode() const guard_memcpy_function_pointer inline std::optional guard_memcpy_function_pointer() const uma_function_pointers inline std::optional uma_function_pointers() const characteristics inline LoadConfiguration &characteristics(uint32_t characteristics) size inline LoadConfiguration &size(uint32_t value) timedatestamp inline LoadConfiguration &timedatestamp(uint32_t timedatestamp) major_version inline LoadConfiguration &major_version(uint16_t major_version) minor_version inline LoadConfiguration &minor_version(uint16_t minor_version) global_flags_clear inline LoadConfiguration &global_flags_clear(uint32_t global_flags_clear) global_flags_set inline LoadConfiguration &global_flags_set(uint32_t global_flags_set) critical_section_default_timeout inline LoadConfiguration &critical_section_default_timeout(uint32_t critical_section_default_timeout) decommit_free_block_threshold inline LoadConfiguration &decommit_free_block_threshold(uint64_t decommit_free_block_threshold) decommit_total_free_threshold inline LoadConfiguration &decommit_total_free_threshold(uint64_t decommit_total_free_threshold) lock_prefix_table inline LoadConfiguration &lock_prefix_table(uint64_t lock_prefix_table) maximum_allocation_size inline LoadConfiguration &maximum_allocation_size(uint64_t maximum_allocation_size) virtual_memory_threshold inline LoadConfiguration &virtual_memory_threshold(uint64_t virtual_memory_threshold) process_affinity_mask inline LoadConfiguration &process_affinity_mask(uint64_t process_affinity_mask) process_heap_flags inline LoadConfiguration &process_heap_flags(uint32_t process_heap_flagsid) csd_version inline LoadConfiguration &csd_version(uint16_t csd_version) reserved1 inline LoadConfiguration &reserved1(uint16_t reserved1) dependent_load_flags inline LoadConfiguration &dependent_load_flags(uint16_t flags) editlist inline LoadConfiguration &editlist(uint64_t editlist) security_cookie inline LoadConfiguration &security_cookie(uint64_t security_cookie) se_handler_table inline LoadConfiguration &se_handler_table(uint64_t se_handler_table) se_handler_count inline LoadConfiguration &se_handler_count(uint64_t se_handler_count) guard_cf_check_function_pointer inline LoadConfiguration &guard_cf_check_function_pointer(uint64_t check_pointer) guard_cf_dispatch_function_pointer inline LoadConfiguration &guard_cf_dispatch_function_pointer(uint64_t dispatch_pointer) guard_cf_function_table inline LoadConfiguration &guard_cf_function_table(uint64_t guard_cf_function_table) guard_cf_function_count inline LoadConfiguration &guard_cf_function_count(uint64_t guard_cf_function_count) guard_flags inline LoadConfiguration &guard_flags( IMAGE_GUARD flags) guard_flags inline LoadConfiguration &guard_flags(uint32_t flags) code_integrity inline LoadConfiguration &code_integrity( CodeIntegrity CI) guard_address_taken_iat_entry_table inline LoadConfiguration &guard_address_taken_iat_entry_table(uint64_t value) guard_address_taken_iat_entry_count inline LoadConfiguration &guard_address_taken_iat_entry_count(uint64_t value) guard_long_jump_target_table inline LoadConfiguration &guard_long_jump_target_table(uint64_t value) guard_long_jump_target_count inline LoadConfiguration &guard_long_jump_target_count(uint64_t value) dynamic_value_reloc_table inline LoadConfiguration &dynamic_value_reloc_table(uint64_t value) hybrid_metadata_pointer inline LoadConfiguration &hybrid_metadata_pointer(uint64_t value) guard_rf_failure_routine inline LoadConfiguration &guard_rf_failure_routine(uint64_t value) guard_rf_failure_routine_function_pointer inline LoadConfiguration &guard_rf_failure_routine_function_pointer(uint64_t value) dynamic_value_reloctable_offset inline LoadConfiguration &dynamic_value_reloctable_offset(uint32_t value) dynamic_value_reloctable_section inline LoadConfiguration &dynamic_value_reloctable_section(uint16_t value) reserved2 inline LoadConfiguration &reserved2(uint16_t value) guard_rf_verify_stackpointer_function_pointer inline LoadConfiguration &guard_rf_verify_stackpointer_function_pointer(uint64_t value) hotpatch_table_offset inline LoadConfiguration &hotpatch_table_offset(uint32_t value) reserved3 inline LoadConfiguration &reserved3(uint32_t value) enclave_configuration_ptr inline LoadConfiguration &enclave_configuration_ptr(uint64_t value) volatile_metadata_pointer inline LoadConfiguration &volatile_metadata_pointer(uint64_t value) guard_eh_continuation_table inline LoadConfiguration &guard_eh_continuation_table(uint64_t value) guard_eh_continuation_count inline LoadConfiguration &guard_eh_continuation_count(uint64_t value) guard_xfg_check_function_pointer inline LoadConfiguration &guard_xfg_check_function_pointer(uint64_t value) guard_xfg_dispatch_function_pointer inline LoadConfiguration &guard_xfg_dispatch_function_pointer(uint64_t value) guard_xfg_table_dispatch_function_pointer inline LoadConfiguration &guard_xfg_table_dispatch_function_pointer(uint64_t value) cast_guard_os_determined_failure_mode inline LoadConfiguration &cast_guard_os_determined_failure_mode(uint64_t value) guard_memcpy_function_pointer inline LoadConfiguration &guard_memcpy_function_pointer(uint64_t value) uma_function_pointers inline LoadConfiguration &uma_function_pointers(uint64_t value) ~LoadConfiguration ~LoadConfiguration() override accept virtual void accept(Visitor &visitor) const override to_string std::string to_string() const Public Static Functions PE_Tparse template static std::unique_ptr< LoadConfiguration > parse( Parser &ctx, BinaryStream &stream) Friends friend class Parser operator<< inline friend std::ostream &operator<<(std::ostream &os, const LoadConfiguration &config) guard_function_t struct guard_function_t Public Members rva uint32_t rva = 0 extra uint32_t extra = 0 CHPEMetadata CHPEMetadata class CHPEMetadata Base class for any Compiled Hybrid Portable Executable (CHPE) metadata. This class is inherited by architecture-specific implementation. Subclassed by LIEF::PE::CHPEMetadataARM64 , LIEF::PE::CHPEMetadataX86 Public Types KIND enum class KIND Discriminator for the subclasses. Values: UNKNOWN enumerator UNKNOWN = 0 ARM64 enumerator ARM64 X86 enumerator X86 Public Functions CHPEMetadata CHPEMetadata() = default CHPEMetadata inline CHPEMetadata( KIND kind, uint32_t version) CHPEMetadata CHPEMetadata(const CHPEMetadata &) = default operator= CHPEMetadata &operator=(const CHPEMetadata &) = default CHPEMetadata CHPEMetadata( CHPEMetadata &&) = default operator= CHPEMetadata &operator=( CHPEMetadata &&) = default clone inline virtual std::unique_ptr< CHPEMetadata > clone() const kind inline KIND kind() const Determine the type of the concrete implementation. version inline uint32_t version() const Version of the structure. to_string inline virtual std::string to_string() const Tas template inline T *as() Tas template inline const T *as() const ~CHPEMetadata virtual ~CHPEMetadata() = default Public Static Functions parse static std::unique_ptr< CHPEMetadata > parse( Parser &ctx, BinaryStream &stream) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const CHPEMetadata &meta) CHPEMetadata (ARM64) CHPEMetadataARM64 class CHPEMetadataARM64 : public LIEF::PE:: CHPEMetadata This class represents ARM64-specific metadata used in CHPE (Compatible Hybrid PE) binaries, particularly for hybrid architectures like ARM64EC and ARM64X. It extends the CHPEMetadata base class and provides access to metadata describing code ranges, redirections, entry points, and other hybrid-specific information relevant for binary analysis or instrumentation. Public Types range_entries_t using range_entries_t = std::vector< range_entry_t > it_range_entries using it_range_entries = ref_iterator < range_entries_t &> it_const_range_entries using it_const_range_entries = const_ref_iterator redirection_entries_t using redirection_entries_t = std::vector< redirection_entry_t > it_redirection_entries using it_redirection_entries = ref_iterator < redirection_entries_t &> it_const_redirection_entries using it_const_redirection_entries = const_ref_iterator code_range_entry_point_entries using code_range_entry_point_entries = std::vector< code_range_entry_point_t > it_code_range_entry_point using it_code_range_entry_point = ref_iterator < code_range_entry_point_entries &> it_const_code_range_entry_point using it_const_code_range_entry_point = const_ref_iterator Public Functions CHPEMetadataARM64 inline CHPEMetadataARM64(uint32_t version) CHPEMetadataARM64 CHPEMetadataARM64(const CHPEMetadataARM64 &) = default operator= CHPEMetadataARM64 &operator=(const CHPEMetadataARM64 &) = default CHPEMetadataARM64 CHPEMetadataARM64( CHPEMetadataARM64 &&) = default operator= CHPEMetadataARM64 &operator=( CHPEMetadataARM64 &&) = default clone inline virtual std::unique_ptr< CHPEMetadata > clone() const override code_map inline uint32_t code_map() const RVA to the array that describes architecture-specific ranges. code_map_count inline uint32_t code_map_count() const Number of entries in the code map. code_ranges_to_entrypoints inline uint32_t code_ranges_to_entrypoints() const redirection_metadata inline uint32_t redirection_metadata() const os_arm64x_dispatch_call_no_redirect inline uint32_t os_arm64x_dispatch_call_no_redirect() const os_arm64x_dispatch_ret inline uint32_t os_arm64x_dispatch_ret() const os_arm64x_dispatch_call inline uint32_t os_arm64x_dispatch_call() const os_arm64x_dispatch_icall inline uint32_t os_arm64x_dispatch_icall() const os_arm64x_dispatch_icall_cfg inline uint32_t os_arm64x_dispatch_icall_cfg() const alternate_entry_point inline uint32_t alternate_entry_point() const auxiliary_iat inline uint32_t auxiliary_iat() const code_ranges_to_entry_points_count inline uint32_t code_ranges_to_entry_points_count() const redirection_metadata_count inline uint32_t redirection_metadata_count() const get_x64_information_function_pointer inline uint32_t get_x64_information_function_pointer() const set_x64_information_function_pointer inline uint32_t set_x64_information_function_pointer() const extra_rfe_table inline uint32_t extra_rfe_table() const RVA to this architecture-specific exception table. extra_rfe_table_size inline uint32_t extra_rfe_table_size() const architecture-specific exception table size os_arm64x_dispatch_fptr inline uint32_t os_arm64x_dispatch_fptr() const auxiliary_iat_copy inline uint32_t auxiliary_iat_copy() const auxiliary_delay_import inline uint32_t auxiliary_delay_import() const auxiliary_delay_import_copy inline uint32_t auxiliary_delay_import_copy() const bitfield_info inline uint32_t bitfield_info() const code_ranges inline it_range_entries code_ranges() code_ranges inline it_const_range_entries code_ranges() const redirections inline it_redirection_entries redirections() redirections inline it_const_redirection_entries redirections() const code_range_entry_point inline it_code_range_entry_point code_range_entry_point() code_range_entry_point inline it_const_code_range_entry_point code_range_entry_point() const code_map inline CHPEMetadataARM64 &code_map(uint32_t value) code_map_count inline CHPEMetadataARM64 &code_map_count(uint32_t value) code_ranges_to_entrypoints inline CHPEMetadataARM64 &code_ranges_to_entrypoints(uint32_t value) redirection_metadata inline CHPEMetadataARM64 &redirection_metadata(uint32_t value) os_arm64x_dispatch_call_no_redirect inline CHPEMetadataARM64 &os_arm64x_dispatch_call_no_redirect(uint32_t value) os_arm64x_dispatch_ret inline CHPEMetadataARM64 &os_arm64x_dispatch_ret(uint32_t value) os_arm64x_dispatch_call inline CHPEMetadataARM64 &os_arm64x_dispatch_call(uint32_t value) os_arm64x_dispatch_icall inline CHPEMetadataARM64 &os_arm64x_dispatch_icall(uint32_t value) os_arm64x_dispatch_icall_cfg inline CHPEMetadataARM64 &os_arm64x_dispatch_icall_cfg(uint32_t value) alternate_entry_point inline CHPEMetadataARM64 &alternate_entry_point(uint32_t value) auxiliary_iat inline CHPEMetadataARM64 &auxiliary_iat(uint32_t value) code_ranges_to_entry_points_count inline CHPEMetadataARM64 &code_ranges_to_entry_points_count(uint32_t value) redirection_metadata_count inline CHPEMetadataARM64 &redirection_metadata_count(uint32_t value) get_x64_information_function_pointer inline CHPEMetadataARM64 &get_x64_information_function_pointer(uint32_t value) set_x64_information_function_pointer inline CHPEMetadataARM64 &set_x64_information_function_pointer(uint32_t value) extra_rfe_table inline CHPEMetadataARM64 &extra_rfe_table(uint32_t value) extra_rfe_table_size inline CHPEMetadataARM64 &extra_rfe_table_size(uint32_t value) os_arm64x_dispatch_fptr inline CHPEMetadataARM64 &os_arm64x_dispatch_fptr(uint32_t value) auxiliary_iat_copy inline CHPEMetadataARM64 &auxiliary_iat_copy(uint32_t value) auxiliary_delay_import inline CHPEMetadataARM64 &auxiliary_delay_import(uint32_t value) auxiliary_delay_import_copy inline CHPEMetadataARM64 &auxiliary_delay_import_copy(uint32_t value) bitfield_info inline CHPEMetadataARM64 &bitfield_info(uint32_t value) to_string virtual std::string to_string() const override ~CHPEMetadataARM64 ~CHPEMetadataARM64() override = default Public Static Functions parse static std::unique_ptr< CHPEMetadataARM64 > parse( Parser &ctx, BinaryStream &stream, uint32_t version) parse_code_map static ok_error_t parse_code_map( Parser &ctx, CHPEMetadataARM64 &metadata) parse_redirections static ok_error_t parse_redirections( Parser &ctx, CHPEMetadataARM64 &metadata) parse_code_ranges_to_entry_points static ok_error_t parse_code_ranges_to_entry_points( Parser &ctx, CHPEMetadataARM64 &metadata) classof static inline bool classof(const CHPEMetadata *meta) range_entry_t struct range_entry_t Structure that describes architecture-specific ranges. Public Types TYPE enum class TYPE Values: ARM64 enumerator ARM64 = 0 Pure ARM64 code. ARM64EC enumerator ARM64EC = 1 ARM64EC hybrid code (compatible with x64). AMD64 enumerator AMD64 = 2 x64 code. Public Functions start inline uint32_t start() const Start of the range (RVA). type inline TYPE type() const Architecture for this range. end inline uint32_t end() const End of the range (RVA). Public Members start_offset uint32_t start_offset = 0 Raw data (include start RVA and type). length uint32_t length = 0 Range’s length. Public Static Attributes TYPE_MASK static uint32_t TYPE_MASK = 3 redirection_entry_t struct redirection_entry_t Structure that describes a redirection. Public Members src uint32_t src = 0 dst uint32_t dst = 0 code_range_entry_point_t struct code_range_entry_point_t Mirror of IMAGE_ARM64EC_CODE_RANGE_ENTRY_POINT : Represents a mapping between code range and its entry point. Public Members start_rva uint32_t start_rva = 0 Start of the code range. end_rva uint32_t end_rva = 0 End of the code range (RVA). entrypoint uint32_t entrypoint = 0 RVA of the entry point for this range. CHPEMetadata (X86) CHPEMetadataX86 class CHPEMetadataX86 : public LIEF::PE:: CHPEMetadata This class represents hybrid metadata for X86. Public Functions CHPEMetadataX86 inline CHPEMetadataX86(uint32_t version) CHPEMetadataX86 CHPEMetadataX86(const CHPEMetadataX86 &) = default operator= CHPEMetadataX86 &operator=(const CHPEMetadataX86 &) = default CHPEMetadataX86 CHPEMetadataX86( CHPEMetadataX86 &&) = default operator= CHPEMetadataX86 &operator=( CHPEMetadataX86 &&) = default clone inline virtual std::unique_ptr< CHPEMetadata > clone() const override chpe_code_address_range_offset inline uint32_t chpe_code_address_range_offset() const chpe_code_address_range_count inline uint32_t chpe_code_address_range_count() const wowa64_exception_handler_function_pointer inline uint32_t wowa64_exception_handler_function_pointer() const wowa64_dispatch_call_function_pointer inline uint32_t wowa64_dispatch_call_function_pointer() const wowa64_dispatch_indirect_call_function_pointer inline uint32_t wowa64_dispatch_indirect_call_function_pointer() const wowa64_dispatch_indirect_call_cfg_function_pointer inline uint32_t wowa64_dispatch_indirect_call_cfg_function_pointer() const wowa64_dispatch_ret_function_pointer inline uint32_t wowa64_dispatch_ret_function_pointer() const wowa64_dispatch_ret_leaf_function_pointer inline uint32_t wowa64_dispatch_ret_leaf_function_pointer() const wowa64_dispatch_jump_function_pointer inline uint32_t wowa64_dispatch_jump_function_pointer() const compiler_iat_pointer inline std::optional compiler_iat_pointer() const wowa64_rdtsc_function_pointer inline std::optional wowa64_rdtsc_function_pointer() const chpe_code_address_range_offset inline CHPEMetadataX86 &chpe_code_address_range_offset(uint32_t value) chpe_code_address_range_count inline CHPEMetadataX86 &chpe_code_address_range_count(uint32_t value) wowa64_exception_handler_function_pointer inline CHPEMetadataX86 &wowa64_exception_handler_function_pointer(uint32_t value) wowa64_dispatch_call_function_pointer inline CHPEMetadataX86 &wowa64_dispatch_call_function_pointer(uint32_t value) wowa64_dispatch_indirect_call_function_pointer inline CHPEMetadataX86 &wowa64_dispatch_indirect_call_function_pointer(uint32_t value) wowa64_dispatch_indirect_call_cfg_function_pointer inline CHPEMetadataX86 &wowa64_dispatch_indirect_call_cfg_function_pointer(uint32_t value) wowa64_dispatch_ret_function_pointer inline CHPEMetadataX86 &wowa64_dispatch_ret_function_pointer(uint32_t value) wowa64_dispatch_ret_leaf_function_pointer inline CHPEMetadataX86 &wowa64_dispatch_ret_leaf_function_pointer(uint32_t value) wowa64_dispatch_jump_function_pointer inline CHPEMetadataX86 &wowa64_dispatch_jump_function_pointer(uint32_t value) compiler_iat_pointer inline CHPEMetadataX86 &compiler_iat_pointer(uint32_t value) wowa64_rdtsc_function_pointer inline CHPEMetadataX86 &wowa64_rdtsc_function_pointer(uint32_t value) to_string virtual std::string to_string() const override ~CHPEMetadataX86 ~CHPEMetadataX86() override = default Public Static Functions parse static std::unique_ptr< CHPEMetadataX86 > parse( Parser &ctx, BinaryStream &stream, uint32_t version) classof static inline bool classof(const CHPEMetadata *meta) DynamicRelocation DynamicRelocation class DynamicRelocation This is the base class for any IMAGE_DYNAMIC_RELOCATION32 , IMAGE_DYNAMIC_RELOCATION32_V2 , IMAGE_DYNAMIC_RELOCATION64 , IMAGE_DYNAMIC_RELOCATION64_V2 dynamic relocations. Subclassed by LIEF::PE::DynamicRelocationV1 , LIEF::PE::DynamicRelocationV2 Public Types IMAGE_DYNAMIC_RELOCATION enum IMAGE_DYNAMIC_RELOCATION Special symbol values as defined in link.exe - GetDVRTSpecialSymbolName . Values: RELOCATION_GUARD_RF_PROLOGUE enumerator RELOCATION_GUARD_RF_PROLOGUE = 1 Mirror IMAGE_DYNAMIC_RELOCATION_GUARD_RF_PROLOGUE . RELOCATION_GUARD_RF_EPILOGUE enumerator RELOCATION_GUARD_RF_EPILOGUE = 2 Mirror IMAGE_DYNAMIC_RELOCATION_GUARD_RF_EPILOGUE . RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER enumerator RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER = 3 Mirror IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER . RELOCATION_GUARD_INDIR_CONTROL_TRANSFER enumerator RELOCATION_GUARD_INDIR_CONTROL_TRANSFER = 4 Mirror IMAGE_DYNAMIC_RELOCATION_GUARD_INDIR_CONTROL_TRANSFER . RELOCATION_GUARD_SWITCHTABLE_BRANCH enumerator RELOCATION_GUARD_SWITCHTABLE_BRANCH = 5 Mirror IMAGE_DYNAMIC_RELOCATION_GUARD_SWITCHTABLE_BRANCH . RELOCATION_ARM64X enumerator RELOCATION_ARM64X = 6 Mirror IMAGE_DYNAMIC_RELOCATION_ARM64X . RELOCATION_FUNCTION_OVERRIDE enumerator RELOCATION_FUNCTION_OVERRIDE = 7 Mirror IMAGE_DYNAMIC_RELOCATION_FUNCTION_OVERRIDE . RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER enumerator RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER = 8 Mirror IMAGE_DYNAMIC_RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER . _RELOC_LAST_ENTRY enumerator _RELOC_LAST_ENTRY Public Functions DynamicRelocation DynamicRelocation() = delete DynamicRelocation DynamicRelocation(uint32_t version) DynamicRelocation DynamicRelocation(const DynamicRelocation &) operator= DynamicRelocation &operator=(const DynamicRelocation &) DynamicRelocation DynamicRelocation( DynamicRelocation &&) operator= DynamicRelocation &operator=( DynamicRelocation &&) clone virtual std::unique_ptr< DynamicRelocation > clone() const = 0 version inline uint32_t version() const Version of the structure. symbol inline uint64_t symbol() const Symbol address. Some values have a special meaning (c.f. IMAGE_DYNAMIC_RELOCATION ) and define how fixups are encoded. fixups inline const DynamicFixup *fixups() const fixups inline DynamicFixup *fixups() Return fixups information, where the interpretation may depend on the symbol’s value. symbol inline DynamicRelocation &symbol(uint64_t value) fixups DynamicRelocation &fixups(std::unique_ptr< DynamicFixup > F) to_string virtual std::string to_string() const = 0 Tas template inline T *as() Tas template inline const T *as() const ~DynamicRelocation virtual ~DynamicRelocation() Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const DynamicRelocation &reloc) DynamicRelocationV1 DynamicRelocationV1 class DynamicRelocationV1 : public LIEF::PE:: DynamicRelocation This class represents a dynamic relocation ( IMAGE_DYNAMIC_RELOCATION32 or IMAGE_DYNAMIC_RELOCATION64 ). Public Functions DynamicRelocationV1 inline DynamicRelocationV1() DynamicRelocationV1 DynamicRelocationV1(const DynamicRelocationV1 &) = default operator= DynamicRelocationV1 &operator=(const DynamicRelocationV1 &) = default DynamicRelocationV1 DynamicRelocationV1( DynamicRelocationV1 &&) = default operator= DynamicRelocationV1 &operator=( DynamicRelocationV1 &&) = default clone inline virtual std::unique_ptr< DynamicRelocation > clone() const override to_string virtual std::string to_string() const override ~DynamicRelocationV1 ~DynamicRelocationV1() override = default Public Static Functions classof static inline bool classof(const DynamicRelocation *reloc) DynamicRelocationV2 DynamicRelocationV2 class DynamicRelocationV2 : public LIEF::PE:: DynamicRelocation This class represents a dynamic relocation ( IMAGE_DYNAMIC_RELOCATION64_V2 or IMAGE_DYNAMIC_RELOCATION32_V2 ). Public Functions DynamicRelocationV2 inline DynamicRelocationV2() DynamicRelocationV2 DynamicRelocationV2(const DynamicRelocationV2 &) = default operator= DynamicRelocationV2 &operator=(const DynamicRelocationV2 &) = default DynamicRelocationV2 DynamicRelocationV2( DynamicRelocationV2 &&) = default operator= DynamicRelocationV2 &operator=( DynamicRelocationV2 &&) = default clone inline virtual std::unique_ptr< DynamicRelocation > clone() const override to_string virtual std::string to_string() const override ~DynamicRelocationV2 ~DynamicRelocationV2() override = default Public Static Functions classof static inline bool classof(const DynamicRelocation *reloc) DynamicFixup DynamicFixup class DynamicFixup This is the base class for any fixups located in DynamicRelocation . Subclassed by LIEF::PE::DynamicFixupARM64Kernel , LIEF::PE::DynamicFixupARM64X , LIEF::PE::DynamicFixupControlTransfer , LIEF::PE::DynamicFixupGeneric , LIEF::PE::DynamicFixupUnknown , LIEF::PE::FunctionOverride Public Types KIND enum KIND Values: UNKNOWN enumerator UNKNOWN = 0 If DynamicRelocation::symbol is a special value that is not supported by LIEF. GENERIC enumerator GENERIC If DynamicRelocation::symbol is not a special value. ARM64X enumerator ARM64X If DynamicRelocation::symbol is set to IMAGE_DYNAMIC_RELOCATION_ARM64X . FUNCTION_OVERRIDE enumerator FUNCTION_OVERRIDE If DynamicRelocation::symbol is set to IMAGE_DYNAMIC_RELOCATION_FUNCTION_OVERRIDE . ARM64_KERNEL_IMPORT_CALL_TRANSFER enumerator ARM64_KERNEL_IMPORT_CALL_TRANSFER If DynamicRelocation::symbol is set to IMAGE_DYNAMIC_RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER . GUARD_IMPORT_CONTROL_TRANSFER enumerator GUARD_IMPORT_CONTROL_TRANSFER If DynamicRelocation::symbol is set to IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER . Public Functions DynamicFixup DynamicFixup() = delete DynamicFixup inline DynamicFixup( KIND kind) DynamicFixup DynamicFixup(const DynamicFixup &) = default operator= DynamicFixup &operator=(const DynamicFixup &) = default DynamicFixup DynamicFixup( DynamicFixup &&) = default operator= DynamicFixup &operator=( DynamicFixup &&) = default clone virtual std::unique_ptr< DynamicFixup > clone() const = 0 to_string virtual std::string to_string() const = 0 kind inline KIND kind() const Encoding of the fixups. Tas template inline T *as() Tas template inline const T *as() const ~DynamicFixup virtual ~DynamicFixup() = default Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const DynamicFixup &fixup) DynamicFixupControlTransfer DynamicFixupControlTransfer class DynamicFixupControlTransfer : public LIEF::PE:: DynamicFixup This class wraps fixups associated with the (special) symbol value: IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER (3) . Public Types reloc_entries_t using reloc_entries_t = std::vector< reloc_entry_t > it_relocations using it_relocations = ref_iterator < reloc_entries_t &> it_const_relocations using it_const_relocations = const_ref_iterator Public Functions DynamicFixupControlTransfer inline DynamicFixupControlTransfer() DynamicFixupControlTransfer DynamicFixupControlTransfer(const DynamicFixupControlTransfer &) = default operator= DynamicFixupControlTransfer &operator=(const DynamicFixupControlTransfer &) = default DynamicFixupControlTransfer DynamicFixupControlTransfer( DynamicFixupControlTransfer &&) = default operator= DynamicFixupControlTransfer &operator=( DynamicFixupControlTransfer &&) = default clone inline virtual std::unique_ptr< DynamicFixup > clone() const override to_string virtual std::string to_string() const override relocations inline it_relocations relocations() Iterator over the relocations. relocations inline it_const_relocations relocations() const ~DynamicFixupControlTransfer ~DynamicFixupControlTransfer() override = default Public Static Functions classof static inline bool classof(const DynamicFixup *fixup) Public Static Attributes NO_IAT_INDEX static auto NO_IAT_INDEX = 0x7fff reloc_entry_t struct reloc_entry_t Mirror IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION . Public Functions to_string std::string to_string() const Public Members rva uint32_t rva = 0 RVA to the call instruction. is_call bool is_call = false True if target instruction is a call , false otherwise. iat_index uint16_t iat_index = NO_IAT_INDEX IAT index of the corresponding import. 0x7FFF is a special value indicating no index. Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const reloc_entry_t &entry) DynamicFixupARM64Kernel DynamicFixupARM64Kernel class DynamicFixupARM64Kernel : public LIEF::PE:: DynamicFixup This class wraps fixups associated with the (special) symbol value: IMAGE_DYNAMIC_RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER (8) . Public Types IMPORT_TYPE enum class IMPORT_TYPE : uint8_t Values: STATIC enumerator STATIC = 0 DELAYED enumerator DELAYED = 1 reloc_entries_t using reloc_entries_t = std::vector< reloc_entry_t > it_relocations using it_relocations = ref_iterator < reloc_entries_t &> it_const_relocations using it_const_relocations = const_ref_iterator Public Functions DynamicFixupARM64Kernel inline DynamicFixupARM64Kernel() DynamicFixupARM64Kernel DynamicFixupARM64Kernel(const DynamicFixupARM64Kernel &) = default operator= DynamicFixupARM64Kernel &operator=(const DynamicFixupARM64Kernel &) = default DynamicFixupARM64Kernel DynamicFixupARM64Kernel( DynamicFixupARM64Kernel &&) = default operator= DynamicFixupARM64Kernel &operator=( DynamicFixupARM64Kernel &&) = default clone inline virtual std::unique_ptr< DynamicFixup > clone() const override to_string virtual std::string to_string() const override relocations inline it_relocations relocations() Iterator over the relocations. relocations inline it_const_relocations relocations() const ~DynamicFixupARM64Kernel ~DynamicFixupARM64Kernel() override = default Public Static Functions classof static inline bool classof(const DynamicFixup *fixup) Public Static Attributes NO_IAT_INDEX static auto NO_IAT_INDEX = 0x7fff reloc_entry_t struct reloc_entry_t Mirror IMAGE_IMPORT_CONTROL_TRANSFER_ARM64_RELOCATION . Public Functions to_string std::string to_string() const Public Members rva uint32_t rva = 0 RVA to the call instruction. indirect_call bool indirect_call = false True if target instruction is a blr , false if it’s a br . register_index uint8_t register_index = 0 Register index used for the indirect call/jump. For instance, if the instruction is br x3 , this index is set to 3 . import_type IMPORT_TYPE import_type = IMPORT_TYPE :: STATIC See IMPORT_TYPE . iat_index uint16_t iat_index = NO_IAT_INDEX IAT index of the corresponding import. 0x7FFF is a special value indicating no index. Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const reloc_entry_t &entry) DynamicFixupARM64X DynamicFixupARM64X class DynamicFixupARM64X : public LIEF::PE:: DynamicFixup This class represents IMAGE_DYNAMIC_RELOCATION_ARM64X . Public Types FIXUP_TYPE enum class FIXUP_TYPE Values: ZEROFILL enumerator ZEROFILL = 0 VALUE enumerator VALUE = 1 DELTA enumerator DELTA = 2 reloc_entries_t using reloc_entries_t = std::vector< reloc_entry_t > it_relocations using it_relocations = ref_iterator < reloc_entries_t &> it_const_relocations using it_const_relocations = const_ref_iterator Public Functions DynamicFixupARM64X inline DynamicFixupARM64X() DynamicFixupARM64X DynamicFixupARM64X(const DynamicFixupARM64X &) = default operator= DynamicFixupARM64X &operator=(const DynamicFixupARM64X &) = default DynamicFixupARM64X DynamicFixupARM64X( DynamicFixupARM64X &&) = default operator= DynamicFixupARM64X &operator=( DynamicFixupARM64X &&) = default clone inline virtual std::unique_ptr< DynamicFixup > clone() const override to_string virtual std::string to_string() const override relocations inline it_relocations relocations() Iterator over the different fixup entries. relocations inline it_const_relocations relocations() const ~DynamicFixupARM64X ~DynamicFixupARM64X() override = default Public Static Functions classof static inline bool classof(const DynamicFixup *fixup) reloc_entry_t struct reloc_entry_t Public Functions to_string std::string to_string() const Public Members rva uint32_t rva = 0 RVA where the fixup takes place. type FIXUP_TYPE type = FIXUP_TYPE :: ZEROFILL Fixup’s kind. size size_t size = 0 Size of the value to patch. bytes std::vector bytes If the type is FIXUP_TYPE::VALUE , the bytes associated to the fixup entry. value int64_t value = 0 If the type is FIXUP_TYPE::DELTA , the (signed) value. Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const reloc_entry_t &entry) DynamicFixupGeneric DynamicFixupGeneric class DynamicFixupGeneric : public LIEF::PE:: DynamicFixup This class represents a generic entry where fixups are regular relocations ( LIEF::PE::Relocation ). Public Types relocations_t using relocations_t = std::vector> it_relocations using it_relocations = ref_iterator < relocations_t &, Relocation *> it_const_relocations using it_const_relocations = const_ref_iterator Public Functions DynamicFixupGeneric DynamicFixupGeneric() DynamicFixupGeneric DynamicFixupGeneric(const DynamicFixupGeneric &) operator= DynamicFixupGeneric &operator=(const DynamicFixupGeneric &) DynamicFixupGeneric DynamicFixupGeneric( DynamicFixupGeneric &&) operator= DynamicFixupGeneric &operator=( DynamicFixupGeneric &&) clone inline virtual std::unique_ptr< DynamicFixup > clone() const override relocations inline it_relocations relocations() Iterator over the relocations. relocations inline it_const_relocations relocations() const to_string virtual std::string to_string() const override ~DynamicFixupGeneric ~DynamicFixupGeneric() override Public Static Functions classof static inline bool classof(const DynamicFixup *fixup) DynamicFixupUnknown DynamicFixupUnknown class DynamicFixupUnknown : public LIEF::PE:: DynamicFixup This class represents a special dynamic relocation where the format of the fixups is not supported by LIEF. Public Functions DynamicFixupUnknown inline DynamicFixupUnknown(std::vector payload) DynamicFixupUnknown DynamicFixupUnknown(const DynamicFixupUnknown &) = default operator= DynamicFixupUnknown &operator=(const DynamicFixupUnknown &) = default DynamicFixupUnknown DynamicFixupUnknown( DynamicFixupUnknown &&) = default operator= DynamicFixupUnknown &operator=( DynamicFixupUnknown &&) = default clone inline virtual std::unique_ptr< DynamicFixup > clone() const override to_string inline virtual std::string to_string() const override payload inline span payload() const Raw fixups. payload inline span payload() ~DynamicFixupUnknown ~DynamicFixupUnknown() override = default Public Static Functions classof static inline bool classof(const DynamicFixup *fixup) FunctionOverride FunctionOverride class FunctionOverride : public LIEF::PE:: DynamicFixup This class represents IMAGE_DYNAMIC_RELOCATION_FUNCTION_OVERRIDE . Public Types func_overriding_info_t using func_overriding_info_t = std::vector> it_func_overriding_info using it_func_overriding_info = ref_iterator < func_overriding_info_t &, FunctionOverrideInfo *> it_const_func_overriding_info using it_const_func_overriding_info = const_ref_iterator bdd_info_list_t using bdd_info_list_t = std::vector< image_bdd_info_t > it_bdd_info using it_bdd_info = ref_iterator < bdd_info_list_t &> it_const_bdd_info using it_const_bdd_info = const_ref_iterator Public Functions FunctionOverride FunctionOverride() FunctionOverride FunctionOverride(const FunctionOverride &) operator= FunctionOverride &operator=(const FunctionOverride &) FunctionOverride FunctionOverride( FunctionOverride &&) operator= FunctionOverride &operator=( FunctionOverride &&) clone inline virtual std::unique_ptr< DynamicFixup > clone() const override func_overriding_info inline it_func_overriding_info func_overriding_info() Iterator over the overriding info. func_overriding_info inline it_const_func_overriding_info func_overriding_info() const bdd_info inline it_bdd_info bdd_info() Iterator over the BDD info. bdd_info inline it_const_bdd_info bdd_info() const find_bdd_info image_bdd_info_t *find_bdd_info(uint32_t offset) Find the IMAGE_BDD_INFO at the given offset. find_bdd_info image_bdd_info_t *find_bdd_info(const FunctionOverrideInfo &info) Find the IMAGE_BDD_INFO associated with the given info. find_bdd_info inline const image_bdd_info_t *find_bdd_info(uint32_t offset) const find_bdd_info inline const image_bdd_info_t *find_bdd_info(const FunctionOverrideInfo &info) const to_string virtual std::string to_string() const override ~FunctionOverride ~FunctionOverride() override Public Static Functions classof static inline bool classof(const DynamicFixup *fixup) image_bdd_dynamic_relocation_t struct image_bdd_dynamic_relocation_t Mirror IMAGE_BDD_DYNAMIC_RELOCATION . Public Members left uint16_t left = 0 right uint16_t right = 0 value uint32_t value = 0 image_bdd_info_t struct image_bdd_info_t Mirror IMAGE_BDD_INFO . Public Members version uint32_t version = 0 original_size uint32_t original_size = 0 original_offset uint32_t original_offset = 0 relocations std::vector< image_bdd_dynamic_relocation_t > relocations If version == 1. payload std::vector payload If version != 1. FunctionOverrideInfo FunctionOverrideInfo class FunctionOverrideInfo Public Types relocations_t using relocations_t = std::vector> it_relocations using it_relocations = ref_iterator < relocations_t &, Relocation *> it_const_relocations using it_const_relocations = const_ref_iterator Public Functions FunctionOverrideInfo FunctionOverrideInfo() = default FunctionOverrideInfo FunctionOverrideInfo(uint32_t original_rva, uint32_t bdd_offset, uint32_t base_reloc_size) FunctionOverrideInfo FunctionOverrideInfo(const FunctionOverrideInfo &) operator= FunctionOverrideInfo &operator=(const FunctionOverrideInfo &) FunctionOverrideInfo FunctionOverrideInfo( FunctionOverrideInfo &&) operator= FunctionOverrideInfo &operator=( FunctionOverrideInfo &&) to_string std::string to_string() const original_rva inline uint32_t original_rva() const RVA of the original function. bdd_offset inline uint32_t bdd_offset() const Offset into the BDD region. rva_size inline uint32_t rva_size() const Size in bytes taken by RVAs. base_reloc_size inline uint32_t base_reloc_size() const Size in bytes taken by BaseRelocs. functions_rva inline const std::vector &functions_rva() const relocations inline it_relocations relocations() relocations inline it_const_relocations relocations() const original_rva inline FunctionOverrideInfo &original_rva(uint32_t value) bdd_offset inline FunctionOverrideInfo &bdd_offset(uint32_t value) base_reloc_size inline FunctionOverrideInfo &base_reloc_size(uint32_t value) overriding_funcs inline FunctionOverrideInfo &overriding_funcs(std::vector funcs) ~FunctionOverrideInfo ~FunctionOverrideInfo() Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const FunctionOverrideInfo &info) EnclaveConfiguration EnclaveConfiguration class EnclaveConfiguration This class represents the enclave configuration. Public Types id_array_t using id_array_t = std::array imports_t using imports_t = std::vector< EnclaveImport > it_imports using it_imports = ref_iterator < imports_t &> it_const_imports using it_const_imports = const_ref_iterator Public Functions EnclaveConfiguration EnclaveConfiguration() = default EnclaveConfiguration EnclaveConfiguration(const EnclaveConfiguration &) = default operator= EnclaveConfiguration &operator=(const EnclaveConfiguration &) = default EnclaveConfiguration EnclaveConfiguration( EnclaveConfiguration &&) = default operator= EnclaveConfiguration &operator=( EnclaveConfiguration &&) = default clone inline std::unique_ptr< EnclaveConfiguration > clone() const size inline uint32_t size() const The size of the IMAGE_ENCLAVE_CONFIG64/IMAGE_ENCLAVE_CONFIG32 structure, in bytes. min_required_config_size inline uint32_t min_required_config_size() const The minimum size of the IMAGE_ENCLAVE_CONFIG(32,64) structure that the image loader must be able to process in order for the enclave to be usable. This member allows an enclave to inform an earlier version of the image loader that the image loader can safely load the enclave and ignore optional members added to IMAGE_ENCLAVE_CONFIG(32,64) for later versions of the enclave. If the size of IMAGE_ENCLAVE_CONFIG(32,64) that the image loader can process is less than MinimumRequiredConfigSize , the enclave cannot be run securely. If MinimumRequiredConfigSize is zero, the minimum size of the IMAGE_ENCLAVE_CONFIG(32,64) structure that the image loader must be able to process in order for the enclave to be usable is assumed to be the size of the structure through and including the MinimumRequiredConfigSize member. policy_flags inline uint32_t policy_flags() const A flag that indicates whether the enclave permits debugging. is_debuggable inline bool is_debuggable() const Whether this enclave can be debugged. import_list_rva inline uint32_t import_list_rva() const The RVA of the array of images that the enclave image may import, with identity information for each image. import_entry_size inline uint32_t import_entry_size() const The size of each image in the array of images that the import_list_rva() member points to. nb_imports inline size_t nb_imports() const The number of images in the array of images that the import_list_rva() member points to. imports inline it_imports imports() Return an iterator over the enclave’s imports. imports inline it_const_imports imports() const family_id inline const id_array_t &family_id() const The family identifier that the author of the enclave assigned to the enclave. image_id inline const id_array_t &image_id() const The image identifier that the author of the enclave assigned to the enclave. image_version inline uint32_t image_version() const The version number that the author of the enclave assigned to the enclave. security_version inline uint32_t security_version() const The security version number that the author of the enclave assigned to the enclave. enclave_size inline uint64_t enclave_size() const The expected virtual size of the private address range for the enclave, in bytes. nb_threads inline uint32_t nb_threads() const The maximum number of threads that can be created within the enclave. enclave_flags inline uint32_t enclave_flags() const A flag that indicates whether the image is suitable for use as the primary image in the enclave. size inline EnclaveConfiguration &size(uint32_t value) min_required_config_size inline EnclaveConfiguration &min_required_config_size(uint32_t value) policy_flags inline EnclaveConfiguration &policy_flags(uint32_t value) import_list_rva inline EnclaveConfiguration &import_list_rva(uint32_t value) import_entry_size inline EnclaveConfiguration &import_entry_size(uint32_t value) family_id inline EnclaveConfiguration &family_id(const id_array_t &value) image_id inline EnclaveConfiguration &image_id(const id_array_t &value) image_version inline EnclaveConfiguration &image_version(uint32_t value) security_version inline EnclaveConfiguration &security_version(uint32_t value) enclave_size inline EnclaveConfiguration &enclave_size(uint64_t value) nb_threads inline EnclaveConfiguration &nb_threads(uint32_t value) enclave_flags inline EnclaveConfiguration &enclave_flags(uint32_t value) to_string std::string to_string() const Public Static Attributes MIN_SIZE static auto MIN_SIZE = 0x4C POLICY_DEBUGGABLE static auto POLICY_DEBUGGABLE = 0x00000001 POLICY_STRICT_MEMORY static auto POLICY_STRICT_MEMORY = 0x00000002 Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const EnclaveConfiguration &meta) EnclaveImport EnclaveImport class EnclaveImport Defines an entry in the array of images that an enclave can import. Public Types TYPE enum class TYPE : uint32_t Values: NONE enumerator NONE = 0x00000000 None of the identifiers of the image need to match the value in the import record. UNIQUE_ID enumerator UNIQUE_ID = 0x00000001 The value of the enclave unique identifier of the image must match the value in the import record. Otherwise, loading of the image fails. AUTHOR_ID enumerator AUTHOR_ID = 0x00000002 The value of the enclave author identifier of the image must match the value in the import record. Otherwise, loading of the image fails. If this flag is set and the import record indicates an author identifier of all zeros, the imported image must be part of the Windows installation. FAMILY_ID enumerator FAMILY_ID = 0x00000003 The value of the enclave family identifier of the image must match the value in the import record. Otherwise, loading of the image fails. IMAGE_ID enumerator IMAGE_ID = 0x00000004 The value of the enclave image identifier of the image must match the value in the import record. Otherwise, loading of the image fails. short_id_t using short_id_t = std::array long_id_t using long_id_t = std::array Public Functions EnclaveImport EnclaveImport() = default EnclaveImport EnclaveImport(const EnclaveImport &) = default operator= EnclaveImport &operator=(const EnclaveImport &) = default EnclaveImport EnclaveImport( EnclaveImport &&) = default operator= EnclaveImport &operator=( EnclaveImport &&) = default type inline TYPE type() const The type of identifier of the image that must match the value in the import record. min_security_version inline uint32_t min_security_version() const The minimum enclave security version that each image must have for the image to be imported successfully. The image is rejected unless its enclave security version is equal to or greater than the minimum value in the import record. Set the value in the import record to zero to turn off the security version check. id inline const long_id_t &id() const The unique identifier of the primary module for the enclave, if the type() is TYPE::UNIQUE_ID . Otherwise, the author identifier of the primary module for the enclave. family_id inline const short_id_t &family_id() const The family identifier of the primary module for the enclave. image_id inline const short_id_t &image_id() const The image identifier of the primary module for the enclave. import_name_rva inline uint32_t import_name_rva() const The relative virtual address of a NULL-terminated string that contains the same value found in the import directory for the image. import_name inline std::string_view import_name() const Resolved import name. reserved inline uint32_t reserved() const Reserved. Should be 0. type inline EnclaveImport &type( TYPE ty) min_security_version inline EnclaveImport &min_security_version(uint32_t value) id inline EnclaveImport &id(const long_id_t &value) family_id inline EnclaveImport &family_id(const short_id_t &value) image_id inline EnclaveImport &image_id(const short_id_t &value) import_name_rva inline EnclaveImport &import_name_rva(uint32_t value) reserved inline EnclaveImport &reserved(uint32_t value) import_name inline EnclaveImport &import_name(std::string name) to_string std::string to_string() const Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const EnclaveImport &meta) Volatile Metadata VolatileMetadata class VolatileMetadata This class represents volatile metadata which can be enabled at link time with /volatileMetadata . This metadata aims to improve performances when running x64 code on ARM64. Public Types access_table_t using access_table_t = std::vector info_ranges_t using info_ranges_t = std::vector< range_t > it_info_ranges_t using it_info_ranges_t = ref_iterator < info_ranges_t &> it_const_info_ranges_t using it_const_info_ranges_t = const_ref_iterator Public Functions VolatileMetadata VolatileMetadata() = default VolatileMetadata VolatileMetadata(const VolatileMetadata &) = default operator= VolatileMetadata &operator=(const VolatileMetadata &) = default VolatileMetadata VolatileMetadata( VolatileMetadata &&) = default operator= VolatileMetadata &operator=( VolatileMetadata &&) = default clone inline std::unique_ptr< VolatileMetadata > clone() const size inline uint32_t size() const Size (in bytes) of the current raw structure. min_version inline uint16_t min_version() const max_version inline uint16_t max_version() const access_table_rva inline uint32_t access_table_rva() const access_table inline const access_table_t &access_table() const access_table_size inline uint32_t access_table_size() const info_range_rva inline uint32_t info_range_rva() const info_ranges_size inline uint32_t info_ranges_size() const info_ranges inline it_const_info_ranges_t info_ranges() const info_ranges inline it_info_ranges_t info_ranges() size inline VolatileMetadata &size(uint32_t value) min_version inline VolatileMetadata &min_version(uint16_t min) max_version inline VolatileMetadata &max_version(uint16_t max) access_table_rva inline VolatileMetadata &access_table_rva(uint32_t value) info_range_rva inline VolatileMetadata &info_range_rva(uint32_t value) to_string std::string to_string() const Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const VolatileMetadata &meta) range_t struct range_t Public Functions end inline uint32_t end() const Public Members start uint32_t start = 0 size uint32_t size = 0 Utilities LIEF::PE::check_layout bool LIEF::PE::check_layout(const Binary &bin, std::string *error_info = nullptr) Check that the layout of the given Binary is correct from the Windows loader perspective. LIEF::PE::get_type result < PE_TYPE > LIEF::PE::get_type(std::string_view file) if the input file is a PE one, return PE32 or PE32+ LIEF::PE::get_type result < PE_TYPE > LIEF::PE::get_type(const std::vector &raw) Return PE32 or PE32+ . LIEF::PE::is_pe bool LIEF::PE::is_pe(std::string_view file) check if the file is a PE file LIEF::PE::is_pe bool LIEF::PE::is_pe(const std::vector &raw) check if the raw data is a PE file LIEF::PE::get_imphash std::string LIEF::PE::get_imphash(const Binary &binary, IMPHASH_MODE mode = IMPHASH_MODE :: DEFAULT ) Compute the hash of imported functions. By default, it generates a hash with the following properties: Order agnostic Case agnostic Ordinal ( in some extent ) agnostic If one needs the same output as Virus Total (i.e. pefile), you can pass IMPHASH_MODE::PEFILE as second parameter. See also https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html Warning The default algorithm used to compute the imphash value has some variations compared to Yara, pefile, VT implementation LIEF::PE::IMPHASH_MODE enum class LIEF ::PE::IMPHASH_MODE Enum to define the behavior of LIEF::PE::get_imphash . Values: DEFAULT enumerator DEFAULT = 0 Default implementation. LIEF enumerator LIEF = DEFAULT Same as IMPHASH_MODE::DEFAULT . PEFILE enumerator PEFILE Use pefile algorithm. VT enumerator VT = PEFILE Same as IMPHASH_MODE::PEFILE since Virus Total is using pefile. LIEF::PE::resolve_ordinals result < Import > LIEF::PE::resolve_ordinals(const Import &import, bool strict = false, bool use_std = false) Take a PE::Import as entry and try to resolve imports by ordinal. The strict boolean parameter enables to throw an LIEF::not_found exception if the ordinal can’t be resolved. Otherwise, it skips the entry. Parameters: import – [in] Import to resolve strict – [in] If set to true , throw an exception if the import can’t be resolved use_std – [in] If true , it will use the pefile look-up table for resolving imports Returns: The PE::import resolved with PE::ImportEntry::name set LIEF::PE::oid_to_string const char *LIEF::PE::oid_to_string(const oid_t &oid) Convert an OID to a human-readable string. Enums LIEF::PE::PE_TYPE enum class LIEF::PE::PE_TYPE : uint16_t Values: PE32 enumerator PE32 = 0x10b 32bits PE32_PLUS enumerator PE32_PLUS = 0x20b 64 bits LIEF::PE::CODE_PAGES enum class LIEF::PE::CODE_PAGES : uint32_t Code page from https://docs.microsoft.com/en-us/windows/win32/intl/code-page-identifiers . Values: IBM037 enumerator IBM037 = 37 IBM EBCDIC US-Canada IBM437 enumerator IBM437 = 437 OEM United States IBM500 enumerator IBM500 = 500 IBM EBCDIC International ASMO_708 enumerator ASMO_708 = 708 Arabic (ASMO 708) DOS_720 enumerator DOS_720 = 720 Arabic (Transparent ASMO); Arabic (DOS) IBM737 enumerator IBM737 = 737 OEM Greek (formerly 437G); Greek (DOS) IBM775 enumerator IBM775 = 775 OEM Baltic; Baltic (DOS) IBM850 enumerator IBM850 = 850 OEM Multilingual Latin 1; Western European (DOS) IBM852 enumerator IBM852 = 852 OEM Latin 2; Central European (DOS) IBM855 enumerator IBM855 = 855 OEM Cyrillic (primarily Russian) IBM857 enumerator IBM857 = 857 OEM Turkish; Turkish (DOS) IBM00858 enumerator IBM00858 = 858 OEM Multilingual Latin 1 + Euro symbol IBM860 enumerator IBM860 = 860 OEM Portuguese; Portuguese (DOS) IBM861 enumerator IBM861 = 861 OEM Icelandic; Icelandic (DOS) DOS_862 enumerator DOS_862 = 862 OEM Hebrew; Hebrew (DOS) IBM863 enumerator IBM863 = 863 OEM French Canadian; French Canadian (DOS) IBM864 enumerator IBM864 = 864 OEM Arabic; Arabic (864) IBM865 enumerator IBM865 = 865 OEM Nordic; Nordic (DOS) CP866 enumerator CP866 = 866 OEM Russian; Cyrillic (DOS) IBM869 enumerator IBM869 = 869 OEM Modern Greek; Greek, Modern (DOS) IBM870 enumerator IBM870 = 870 IBM EBCDIC Multilingual/ROECE (Latin 2); IBM EBCDIC Multilingual Latin 2 WINDOWS_874 enumerator WINDOWS_874 = 874 ANSI/OEM Thai (same as 28605, ISO 8859-15); Thai (Windows) CP875 enumerator CP875 = 875 IBM EBCDIC Greek Modern SHIFT_JIS enumerator SHIFT_JIS = 932 ANSI/OEM Japanese; Japanese (Shift-JIS) GB2312 enumerator GB2312 = 936 ANSI/OEM Simplified Chinese (PRC, Singapore); Chinese Simplified (GB2312) KS_C_5601_1987 enumerator KS_C_5601_1987 = 949 ANSI/OEM Korean (Unified Hangul Code) BIG5 enumerator BIG5 = 950 ANSI/OEM Traditional Chinese (Taiwan; Hong Kong SAR, PRC); Chinese Traditional (Big5) IBM1026 enumerator IBM1026 = 1026 IBM EBCDIC Turkish (Latin 5) IBM01047 enumerator IBM01047 = 1047 IBM EBCDIC Latin 1/Open System IBM01140 enumerator IBM01140 = 1140 IBM EBCDIC US-Canada (037 + Euro symbol); IBM EBCDIC (US-Canada-Euro) IBM01141 enumerator IBM01141 = 1141 IBM EBCDIC Germany (20273 + Euro symbol); IBM EBCDIC (Germany-Euro) IBM01142 enumerator IBM01142 = 1142 IBM EBCDIC Denmark-Norway (20277 + Euro symbol); IBM EBCDIC (Denmark-Norway-Euro) IBM01143 enumerator IBM01143 = 1143 IBM EBCDIC Finland-Sweden (20278 + Euro symbol); IBM EBCDIC (Finland-Sweden-Euro) IBM01144 enumerator IBM01144 = 1144 IBM EBCDIC Italy (20280 + Euro symbol); IBM EBCDIC (Italy-Euro) IBM01145 enumerator IBM01145 = 1145 IBM EBCDIC Latin America-Spain (20284 + Euro symbol); IBM EBCDIC (Spain-Euro) IBM01146 enumerator IBM01146 = 1146 IBM EBCDIC United Kingdom (20285 + Euro symbol); IBM EBCDIC (UK-Euro) IBM01147 enumerator IBM01147 = 1147 IBM EBCDIC France (20297 + Euro symbol); IBM EBCDIC (France-Euro) IBM01148 enumerator IBM01148 = 1148 IBM EBCDIC International (500 + Euro symbol); IBM EBCDIC (International-Euro) IBM01149 enumerator IBM01149 = 1149 IBM EBCDIC Icelandic (20871 + Euro symbol); IBM EBCDIC (Icelandic-Euro) UTF_16 enumerator UTF_16 = 1200 Unicode UTF-16, little endian byte order (BMP of ISO 10646); available only to managed applications UNICODEFFFE enumerator UNICODEFFFE = 1201 Unicode UTF-16, big endian byte order; available only to managed applications WINDOWS_1250 enumerator WINDOWS_1250 = 1250 ANSI Central European; Central European (Windows) WINDOWS_1251 enumerator WINDOWS_1251 = 1251 ANSI Cyrillic; Cyrillic (Windows) WINDOWS_1252 enumerator WINDOWS_1252 = 1252 ANSI Latin 1; Western European (Windows) WINDOWS_1253 enumerator WINDOWS_1253 = 1253 ANSI Greek; Greek (Windows) WINDOWS_1254 enumerator WINDOWS_1254 = 1254 ANSI Turkish; Turkish (Windows) WINDOWS_1255 enumerator WINDOWS_1255 = 1255 ANSI Hebrew; Hebrew (Windows) WINDOWS_1256 enumerator WINDOWS_1256 = 1256 ANSI Arabic; Arabic (Windows) WINDOWS_1257 enumerator WINDOWS_1257 = 1257 ANSI Baltic; Baltic (Windows) WINDOWS_1258 enumerator WINDOWS_1258 = 1258 ANSI/OEM Vietnamese; Vietnamese (Windows) JOHAB enumerator JOHAB = 1361 Korean (Johab) MACINTOSH enumerator MACINTOSH = 10000 MAC Roman; Western European (Mac) X_MAC_JAPANESE enumerator X_MAC_JAPANESE = 10001 Japanese (Mac) X_MAC_CHINESETRAD enumerator X_MAC_CHINESETRAD = 10002 MAC Traditional Chinese (Big5); Chinese Traditional (Mac) X_MAC_KOREAN enumerator X_MAC_KOREAN = 10003 Korean (Mac) X_MAC_ARABIC enumerator X_MAC_ARABIC = 10004 Arabic (Mac) X_MAC_HEBREW enumerator X_MAC_HEBREW = 10005 Hebrew (Mac) X_MAC_GREEK enumerator X_MAC_GREEK = 10006 Greek (Mac) X_MAC_CYRILLIC enumerator X_MAC_CYRILLIC = 10007 Cyrillic (Mac) X_MAC_CHINESESIMP enumerator X_MAC_CHINESESIMP = 10008 MAC Simplified Chinese (GB 2312); Chinese Simplified (Mac) X_MAC_ROMANIAN enumerator X_MAC_ROMANIAN = 10010 Romanian (Mac) X_MAC_UKRAINIAN enumerator X_MAC_UKRAINIAN = 10017 Ukrainian (Mac) X_MAC_THAI enumerator X_MAC_THAI = 10021 Thai (Mac) X_MAC_CE enumerator X_MAC_CE = 10029 MAC Latin 2; Central European (Mac) X_MAC_ICELANDIC enumerator X_MAC_ICELANDIC = 10079 Icelandic (Mac) X_MAC_TURKISH enumerator X_MAC_TURKISH = 10081 Turkish (Mac) X_MAC_CROATIAN enumerator X_MAC_CROATIAN = 10082 Croatian (Mac) UTF_32 enumerator UTF_32 = 12000 Unicode UTF-32, little endian byte order; available only to managed applications UTF_32BE enumerator UTF_32BE = 12001 Unicode UTF-32, big endian byte order; available only to managed applications X_CHINESE_CNS enumerator X_CHINESE_CNS = 20000 CNS Taiwan; Chinese Traditional (CNS) X_CP20001 enumerator X_CP20001 = 20001 TCA Taiwan X_CHINESE_ETEN enumerator X_CHINESE_ETEN = 20002 Eten Taiwan; Chinese Traditional (Eten) X_CP20003 enumerator X_CP20003 = 20003 IBM5550 Taiwan X_CP20004 enumerator X_CP20004 = 20004 TeleText Taiwan X_CP20005 enumerator X_CP20005 = 20005 Wang Taiwan X_IA5 enumerator X_IA5 = 20105 IA5 (IRV International Alphabet No. 5, 7-bit); Western European (IA5) X_IA5_GERMAN enumerator X_IA5_GERMAN = 20106 IA5 German (7-bit) X_IA5_SWEDISH enumerator X_IA5_SWEDISH = 20107 IA5 Swedish (7-bit) X_IA5_NORWEGIAN enumerator X_IA5_NORWEGIAN = 20108 IA5 Norwegian (7-bit) US_ASCII enumerator US_ASCII = 20127 US-ASCII (7-bit) X_CP20261 enumerator X_CP20261 = 20261 T.61 X_CP20269 enumerator X_CP20269 = 20269 ISO 6937 Non-Spacing Accent IBM273 enumerator IBM273 = 20273 IBM EBCDIC Germany IBM277 enumerator IBM277 = 20277 IBM EBCDIC Denmark-Norway IBM278 enumerator IBM278 = 20278 IBM EBCDIC Finland-Sweden IBM280 enumerator IBM280 = 20280 IBM EBCDIC Italy IBM284 enumerator IBM284 = 20284 IBM EBCDIC Latin America-Spain IBM285 enumerator IBM285 = 20285 IBM EBCDIC United Kingdom IBM290 enumerator IBM290 = 20290 IBM EBCDIC Japanese Katakana Extended IBM297 enumerator IBM297 = 20297 IBM EBCDIC France IBM420 enumerator IBM420 = 20420 IBM EBCDIC Arabic IBM423 enumerator IBM423 = 20423 IBM EBCDIC Greek IBM424 enumerator IBM424 = 20424 IBM EBCDIC Hebrew X_EBCDIC_KOREANEXTENDED enumerator X_EBCDIC_KOREANEXTENDED = 20833 IBM EBCDIC Korean Extended IBM_THAI enumerator IBM_THAI = 20838 IBM EBCDIC Thai KOI8_R enumerator KOI8_R = 20866 Russian (KOI8-R); Cyrillic (KOI8-R) IBM871 enumerator IBM871 = 20871 IBM EBCDIC Icelandic IBM880 enumerator IBM880 = 20880 IBM EBCDIC Cyrillic Russian IBM905 enumerator IBM905 = 20905 IBM EBCDIC Turkish IBM00924 enumerator IBM00924 = 20924 IBM EBCDIC Latin 1/Open System (1047 + Euro symbol) EUC_JP_JIS enumerator EUC_JP_JIS = 20932 Japanese (JIS 0208-1990 and 0121-1990) X_CP20936 enumerator X_CP20936 = 20936 Simplified Chinese (GB2312); Chinese Simplified (GB2312-80) X_CP20949 enumerator X_CP20949 = 20949 Korean Wansung CP1025 enumerator CP1025 = 21025 IBM EBCDIC Cyrillic Serbian-Bulgarian KOI8_U enumerator KOI8_U = 21866 Ukrainian (KOI8-U); Cyrillic (KOI8-U) ISO_8859_1 enumerator ISO_8859_1 = 28591 ISO 8859-1 Latin 1; Western European (ISO) ISO_8859_2 enumerator ISO_8859_2 = 28592 ISO 8859-2 Central European; Central European (ISO) ISO_8859_3 enumerator ISO_8859_3 = 28593 ISO 8859-3 Latin 3 ISO_8859_4 enumerator ISO_8859_4 = 28594 ISO 8859-4 Baltic ISO_8859_5 enumerator ISO_8859_5 = 28595 ISO 8859-5 Cyrillic ISO_8859_6 enumerator ISO_8859_6 = 28596 ISO 8859-6 Arabic ISO_8859_7 enumerator ISO_8859_7 = 28597 ISO 8859-7 Greek ISO_8859_8 enumerator ISO_8859_8 = 28598 ISO 8859-8 Hebrew; Hebrew (ISO-Visual) ISO_8859_9 enumerator ISO_8859_9 = 28599 ISO 8859-9 Turkish ISO_8859_13 enumerator ISO_8859_13 = 28603 ISO 8859-13 Estonian ISO_8859_15 enumerator ISO_8859_15 = 28605 ISO 8859-15 Latin 9 X_EUROPA enumerator X_EUROPA = 29001 Europa 3 ISO_8859_8_I enumerator ISO_8859_8_I = 38598 ISO 8859-8 Hebrew; Hebrew (ISO-Logical) ISO_2022_JP enumerator ISO_2022_JP = 50220 ISO 2022 Japanese with no halfwidth Katakana; Japanese (JIS) CSISO2022JP enumerator CSISO2022JP = 50221 ISO 2022 Japanese with halfwidth Katakana; Japanese (JIS-Allow 1 byte Kana) ISO_2022_JP_JIS enumerator ISO_2022_JP_JIS = 50222 ISO 2022 Japanese JIS X 0201-1989; Japanese (JIS-Allow 1 byte Kana - SO/SI) ISO_2022_KR enumerator ISO_2022_KR = 50225 ISO 2022 Korean X_CP50227 enumerator X_CP50227 = 50227 ISO 2022 Simplified Chinese; Chinese Simplified (ISO 2022) EUC_JP enumerator EUC_JP = 51932 EUC Japanese EUC_CN enumerator EUC_CN = 51936 EUC Simplified Chinese; Chinese Simplified (EUC) EUC_KR enumerator EUC_KR = 51949 EUC Korean HZ_GB_2312 enumerator HZ_GB_2312 = 52936 HZ-GB2312 Simplified Chinese; Chinese Simplified (HZ) GB18030 enumerator GB18030 = 54936 Windows XP and later: GB18030 Simplified Chinese (4 byte); Chinese Simplified (GB18030) X_ISCII_DE enumerator X_ISCII_DE = 57002 ISCII Devanagari X_ISCII_BE enumerator X_ISCII_BE = 57003 ISCII Bengali X_ISCII_TA enumerator X_ISCII_TA = 57004 ISCII Tamil X_ISCII_TE enumerator X_ISCII_TE = 57005 ISCII Telugu X_ISCII_AS enumerator X_ISCII_AS = 57006 ISCII Assamese X_ISCII_OR enumerator X_ISCII_OR = 57007 ISCII Oriya X_ISCII_KA enumerator X_ISCII_KA = 57008 ISCII Kannada X_ISCII_MA enumerator X_ISCII_MA = 57009 ISCII Malayalam X_ISCII_GU enumerator X_ISCII_GU = 57010 ISCII Gujarati X_ISCII_PA enumerator X_ISCII_PA = 57011 ISCII Punjabi UTF_7 enumerator UTF_7 = 65000 Unicode (UTF-7) UTF_8 enumerator UTF_8 = 65001 Unicode (UTF-8) LIEF::PE::ALGORITHMS enum class LIEF::PE::ALGORITHMS : uint32_t Cryptography algorithms. Values: UNKNOWN enumerator UNKNOWN = 0 SHA_512 enumerator SHA_512 SHA_384 enumerator SHA_384 SHA_256 enumerator SHA_256 SHA_1 enumerator SHA_1 MD5 enumerator MD5 MD4 enumerator MD4 MD2 enumerator MD2 RSA enumerator RSA EC enumerator EC MD5_RSA enumerator MD5_RSA SHA1_DSA enumerator SHA1_DSA SHA1_RSA enumerator SHA1_RSA SHA_256_RSA enumerator SHA_256_RSA SHA_384_RSA enumerator SHA_384_RSA SHA_512_RSA enumerator SHA_512_RSA SHA1_ECDSA enumerator SHA1_ECDSA SHA_256_ECDSA enumerator SHA_256_ECDSA SHA_384_ECDSA enumerator SHA_384_ECDSA SHA_512_ECDSA enumerator SHA_512_ECDSA LIEF::PE::ACCELERATOR_CODES enum class LIEF::PE::ACCELERATOR_CODES : uint32_t From https://docs.microsoft.com/en-us/windows/win32/inputdev/virtual-key-codes . Values: LBUTTON enumerator LBUTTON = 0x01 RBUTTON enumerator RBUTTON = 0x02 CANCEL enumerator CANCEL = 0x03 MBUTTON enumerator MBUTTON = 0x04 XBUTTON1_K enumerator XBUTTON1_K = 0x05 XBUTTON2_K enumerator XBUTTON2_K = 0x06 BACK enumerator BACK = 0x08 TAB enumerator TAB = 0x09 CLEAR enumerator CLEAR = 0x0C RETURN enumerator RETURN = 0x0D SHIFT enumerator SHIFT = 0x10 CONTROL enumerator CONTROL = 0x11 MENU enumerator MENU = 0x12 PAUSE enumerator PAUSE = 0x13 CAPITAL enumerator CAPITAL = 0x14 KANA enumerator KANA = 0x15 IME_ON enumerator IME_ON = 0x16 JUNJA enumerator JUNJA = 0x17 FINAL enumerator FINAL = 0x18 KANJI enumerator KANJI = 0x19 IME_OFF enumerator IME_OFF = 0x1A ESCAPE enumerator ESCAPE = 0x1B CONVERT enumerator CONVERT = 0x1C NONCONVERT enumerator NONCONVERT = 0x1D ACCEPT enumerator ACCEPT = 0x1E MODECHANGE enumerator MODECHANGE = 0x1F SPACE enumerator SPACE = 0x20 PRIOR enumerator PRIOR = 0x21 NEXT enumerator NEXT = 0x22 END enumerator END = 0x23 HOME enumerator HOME = 0x24 LEFT enumerator LEFT = 0x25 UP enumerator UP = 0x26 RIGHT enumerator RIGHT = 0x27 DOWN enumerator DOWN = 0x28 SELECT enumerator SELECT = 0x29 PRINT enumerator PRINT = 0x2A EXECUTE enumerator EXECUTE = 0x2B SNAPSHOT enumerator SNAPSHOT = 0x2C INSERT enumerator INSERT = 0x2D DELETE_K enumerator DELETE_K = 0x2E HELP enumerator HELP = 0x2F NUM_0 enumerator NUM_0 = 0x30 NUM_1 enumerator NUM_1 = 0x31 NUM_2 enumerator NUM_2 = 0x32 NUM_3 enumerator NUM_3 = 0x33 NUM_4 enumerator NUM_4 = 0x34 NUM_5 enumerator NUM_5 = 0x35 NUM_6 enumerator NUM_6 = 0x36 NUM_7 enumerator NUM_7 = 0x37 NUM_8 enumerator NUM_8 = 0x38 NUM_9 enumerator NUM_9 = 0x39 A enumerator A = 0x41 B enumerator B = 0x42 C enumerator C = 0x43 D enumerator D = 0x44 E enumerator E = 0x45 F enumerator F = 0x46 G enumerator G = 0x47 H enumerator H = 0x48 I enumerator I = 0x49 J enumerator J = 0x4A K enumerator K = 0x4B L enumerator L = 0x4C M enumerator M = 0x4D N enumerator N = 0x4E O enumerator O = 0x4F P enumerator P = 0x50 Q enumerator Q = 0x51 R enumerator R = 0x52 S enumerator S = 0x53 T enumerator T = 0x54 U enumerator U = 0x55 V enumerator V = 0x56 W enumerator W = 0x57 X enumerator X = 0x58 Y enumerator Y = 0x59 Z enumerator Z = 0x5A LWIN enumerator LWIN = 0x5B RWIN enumerator RWIN = 0x5C APPS enumerator APPS = 0x5D SLEEP enumerator SLEEP = 0x5F NUMPAD0 enumerator NUMPAD0 = 0x60 NUMPAD1 enumerator NUMPAD1 = 0x61 NUMPAD2 enumerator NUMPAD2 = 0x62 NUMPAD3 enumerator NUMPAD3 = 0x63 NUMPAD4 enumerator NUMPAD4 = 0x64 NUMPAD5 enumerator NUMPAD5 = 0x65 NUMPAD6 enumerator NUMPAD6 = 0x66 NUMPAD7 enumerator NUMPAD7 = 0x67 NUMPAD8 enumerator NUMPAD8 = 0x68 NUMPAD9 enumerator NUMPAD9 = 0x69 MULTIPLY enumerator MULTIPLY = 0x6A ADD enumerator ADD = 0x6B SEPARATOR enumerator SEPARATOR = 0x6C SUBTRACT enumerator SUBTRACT = 0x6D DECIMAL enumerator DECIMAL = 0x6E DIVIDE enumerator DIVIDE = 0x6F F1 enumerator F1 = 0x70 F2 enumerator F2 = 0x71 F3 enumerator F3 = 0x72 F4 enumerator F4 = 0x73 F5 enumerator F5 = 0x74 F6 enumerator F6 = 0x75 F7 enumerator F7 = 0x76 F8 enumerator F8 = 0x77 F9 enumerator F9 = 0x78 F10 enumerator F10 = 0x79 F11 enumerator F11 = 0x7A F12 enumerator F12 = 0x7B F13 enumerator F13 = 0x7C F14 enumerator F14 = 0x7D F15 enumerator F15 = 0x7E F16 enumerator F16 = 0x7F F17 enumerator F17 = 0x80 F18 enumerator F18 = 0x81 F19 enumerator F19 = 0x82 F20 enumerator F20 = 0x83 F21 enumerator F21 = 0x84 F22 enumerator F22 = 0x85 F23 enumerator F23 = 0x86 F24 enumerator F24 = 0x87 NUMLOCK enumerator NUMLOCK = 0x90 SCROLL enumerator SCROLL = 0x91 LSHIFT enumerator LSHIFT = 0xA0 RSHIFT enumerator RSHIFT = 0xA1 LCONTROL enumerator LCONTROL = 0xA2 RCONTROL enumerator RCONTROL = 0xA3 LMENU enumerator LMENU = 0xA4 RMENU enumerator RMENU = 0xA5 BROWSER_BACK enumerator BROWSER_BACK = 0xA6 BROWSER_FORWARD enumerator BROWSER_FORWARD = 0xA7 BROWSER_REFRESH enumerator BROWSER_REFRESH = 0xA8 BROWSER_STOP enumerator BROWSER_STOP = 0xA9 BROWSER_SEARCH enumerator BROWSER_SEARCH = 0xAA BROWSER_FAVORITES enumerator BROWSER_FAVORITES = 0xAB BROWSER_HOME enumerator BROWSER_HOME = 0xAC VOLUME_MUTE enumerator VOLUME_MUTE = 0xAD VOLUME_DOWN enumerator VOLUME_DOWN = 0xAE VOLUME_UP enumerator VOLUME_UP = 0xAF MEDIA_NEXT_TRACK enumerator MEDIA_NEXT_TRACK = 0xB0 MEDIA_PREV_TRACK enumerator MEDIA_PREV_TRACK = 0xB1 MEDIA_STOP enumerator MEDIA_STOP = 0xB2 MEDIA_PLAY_PAUSE enumerator MEDIA_PLAY_PAUSE = 0xB3 LAUNCH_MAIL enumerator LAUNCH_MAIL = 0xB4 LAUNCH_MEDIA_SELECT enumerator LAUNCH_MEDIA_SELECT = 0xB5 LAUNCH_APP1 enumerator LAUNCH_APP1 = 0xB6 LAUNCH_APP2 enumerator LAUNCH_APP2 = 0xB7 OEM_1 enumerator OEM_1 = 0xBA OEM_PLUS enumerator OEM_PLUS = 0xBB OEM_COMMA enumerator OEM_COMMA = 0xBC OEM_MINUS enumerator OEM_MINUS = 0xBD OEM_PERIOD enumerator OEM_PERIOD = 0xBE OEM_2 enumerator OEM_2 = 0xBF OEM_4 enumerator OEM_4 = 0xDB OEM_5 enumerator OEM_5 = 0xDC OEM_6 enumerator OEM_6 = 0xDD OEM_7 enumerator OEM_7 = 0xDE OEM_8 enumerator OEM_8 = 0xDF OEM_102 enumerator OEM_102 = 0xE2 PROCESSKEY enumerator PROCESSKEY = 0xE5 PACKET enumerator PACKET = 0xE7 ATTN enumerator ATTN = 0xF6 CRSEL enumerator CRSEL = 0xF7 EXSEL enumerator EXSEL = 0xF8 EREOF enumerator EREOF = 0xF9 PLAY enumerator PLAY = 0xFA ZOOM enumerator ZOOM = 0xFB NONAME enumerator NONAME = 0xFC PA1 enumerator PA1 = 0xFD OEM_CLEAR enumerator OEM_CLEAR = 0xFE", "contentHash": "58de60546f782310df4050f4f47b0d0aba0f5b04a1b01949e50ab60a72b82757", "description": "PE C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "formats/pe/cpp", "documentID": "022ea70514310c02b0dca00aca48908628e5f3ae01f867a7242d83eb9fa9953e", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/pe/cpp.md", "title": "PE C++ API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/pe/index.html", "content": "PE API C++ Python Rust Modifications Imports Modification Resources Modification TLS Modification Debug Modification Exports Modification Introduction PE binaries can be parsed using the lief.PE.parse() ( lief::pe::Binary::parse ; lief.PE.parse() ; LIEF::PE::Parser::parse() ) function. Python import lief # Using filepath pe: lief.PE.Binary | None = lief.PE.parse(r\"C:\\Users\\test.exe\") # Using a Path from pathlib pe: lief.PE.Binary | None = lief.PE.parse(pathlib.Path(r\"C:\\Users\\test.exe\")) # Using an io object with open(r\"C:\\Users\\test.exe\", \"rb\") as f: pe: lief.PE.Binary | None = lief.PE.parse(f) C++ #include // Using a file path as a std::string std::unique_ptr pe = LIEF::PE::Parser::parse(\"some.exe\"); // Using a vector std::vector my_raw_pe; pe = LIEF::PE::Parser::parse(my_raw_pe); Rust let pe: lief::pe::Binary = lief::pe::Binary::parse(\"/bin/ls\").unwrap(); Note In Python, you can also use the generic lief.parse() , which returns a lief.PE.Binary object. With the parsed PE binary, you can use the lief.PE.Binary ( lief::pe::Binary ; lief.PE.Binary ; LIEF::PE::Binary ) API to inspect or modify the binary itself. Python pe: lief.PE.Binary print(pe.rich_header) print(pe.authentihash_md5.hex(\":\")) for section in pe.sections: print(section.name, len(section.content)) C++ std::unique_ptr pe; if (const LIEF::PE::RichHeader* rich = pe->rich_header()) { std::cout << *rich << '\\n'; } for (const LIEF::PE::Section& section : pe->sections()) { std::cout << section.name() << section.content().size() << '\\n'; } Rust let pe: &lief::pe::Binary = some_pe; println!(\"{:?}\", pe.rich_header().expect(\"Missing Rich header\")); for section in pe.sections() { println!(\"{} {}\", section.name(), section.content().len()); } After modifying a lief.PE.Binary ( lief::pe::Binary ; lief.PE.Binary ; LIEF::PE::Binary ) object, you can use lief.PE.Binary.write() ( lief::pe::Binary::write ; lief.PE.Binary.write() ; LIEF::PE::Binary::write() ) to write the changes back to a raw PE file. Python pe: lief.PE.Binary section = lief.PE.Section(\".hello\") section.content = [0xCC] * 0x100 pe.add_section(section) pe.write(\"new.exe\") C++ std::unique_ptr pe; LIEF::PE::Section section(\".hello\"); section.content(std::vector(0x100, 0xCC)); pe->add_section(section); pe->write(\"new.exe\"); Rust let mut pe = lief::pe::Binary::parse(\"some.exe\").unwrap(); let mut section = lief::pe::Section::new_with_name(\".hello\"); section.set_content(&[0xCC; 0x100]); pe.add_section(section); pe.write(\"new.exe\"); See also Binary Abstraction Dump Analysis LIEF has the support to process PE memory dump with lief.PE.parse_from_dump() ( lief::pe::Binary::parse_from_dump ; lief.PE.parse_from_dump() ; LIEF::PE::Parser::parse_from_dump() ). This function translates the file offsets referenced by the PE structures into their location inside the dump, using the base address passed as the second parameter: Python # 0x7ffd21b80000 is the (absolute) address at which the dump was mapped pe = lief.PE.parse_from_dump(\"module.dump\", 0x7FFD21B80000) assert isinstance(pe, lief.PE.Binary) for imp in pe.imports: print(imp.name) C++ auto pe = LIEF::PE::Parser::parse_from_dump(\"module.dump\", 0x7ffd21b80000); for (const LIEF::PE::Import& imp : pe->imports()) { std::cout << imp.name() << '\\n'; } Rust let pe = lief::pe::Binary::parse_from_dump(\"module.dump\", 0x7ffd_21b8_0000).unwrap(); for imp in pe.imports() { println!(\"{}\", imp.name()); } Note The second parameter must be the (absolute) virtual address at which the dump was mapped. It is used to convert the RVAs found in the PE structures back into an offset within the dump. Producing a dump with the runtime API Such a dump can be produced from a live process thanks to the LIEF runtime and, more precisely, the Module API . lief.runtime.Module.dump() ( lief::runtime::module::Module::dump ; lief.runtime.Module.dump() ; LIEF::runtime::Module::dump() ) captures the memory of a loaded module (from its imagebase over its virtual size): Python # Find the module to dump in the current process mod = lief.runtime.module_from_name(\"target.dll\") assert isinstance(mod, lief.runtime.windows.Module) # Dump the module's memory into a file (the raw bytes are also returned) ... data: bytes = mod.dump(\"module.dump\") # ... and parse it back using the same imagebase: pe = lief.PE.parse_from_dump(data, mod.imagebase) C++ // Find the module to dump in the current process auto mod = LIEF::runtime::module_from_name(\"target.dll\"); // Dump the module's memory into a file (the raw bytes are also returned) std::vector data = mod->dump(\"module.dump\"); auto pe = LIEF::PE::Parser::parse_from_dump(\"module.dump\", mod->imagebase()); Rust use lief::runtime::Module; let module = lief::runtime::module_from_name(\"target.dll\").unwrap(); // Dump the module's memory into a file (the raw bytes are also returned) let data = module.dump_to_file(\"module.dump\"); let pe = lief::pe::Binary::parse_from_dump(\"module.dump\", module.imagebase()).unwrap(); Advanced Parsing/Writing Modifications Imports Modification Resources Modification TLS Modification lief.PE.parse() ( lief::pe::Binary::parse ; lief.PE.parse() ; LIEF::PE::Parser::parse() ) can take an extra lief.PE.ParserConfig ( lief::pe::ParserConfig ; lief.PE.ParserConfig ; LIEF::PE::ParserConfig ) parameter to specify parts of the PE format to ignore during parsing. Warning Generally, lief.PE.Binary.write() ( lief::pe::Binary::write ; lief.PE.Binary.write() ; LIEF::PE::Binary::write() ) requires a complete initial parsing of the PE file. Similarly, lief.PE.Binary.write() ( lief::pe::Binary::write ; lief.PE.Binary.write() ; LIEF::PE::Binary::write() ) can take an extra lief.PE.Builder.config_t ( lief::pe::::builder::Config ; lief.PE.Builder.config_t ; LIEF::PE::Builder::config_t ) parameter to include or ignore parts of the PE binary during the build process. Python parser_config = lief.PE.ParserConfig() parser_config.parse_signature = False pe = lief.PE.parse(\"some.exe\", parser_config) assert isinstance(pe, lief.PE.Binary) builder_config = lief.PE.Builder.config_t() builder_config.imports = True pe.write(\"new.exe\", builder_config) C++ LIEF::PE::ParserConfig parser_config; parser_config.parse_signature = false; auto pe = LIEF::PE::Parser::parse(\"some.exe\", parser_config); LIEF::PE::Builder::config_t builder_config; builder_config.imports = true; pe->write(\"new.exe\", builder_config); Rust let mut parser_config = lief::pe::parser_config::Config::default(); parser_config.parse_signature = false; let mut pe = lief::pe::parse_with_config(\"some.exe\", &parser_config).unwrap(); let mut config = lief::pe::builder::Config::default(); config.imports = true; pe.write_with_config(\"new.exe\", config); You can also use lief.PE.Binary.write_to_bytes() ( lief::pe::Binary::write_to_bytes ; lief::pe::Binary::write_to_bytes_with_config ; lief.PE.Binary.write_to_bytes() ; std::unique_ptr LIEF::PE::Binary::write(std::ostream &) ; std::unique_ptr LIEF::PE::Binary::write(std::ostream &, const Builder::config_t &) ) to get the new PE binary as a buffer of bytes: Note This API can also take an extra lief.PE.Builder.config_t ( lief::pe::::builder::Config ; lief.PE.Builder.config_t ; LIEF::PE::Builder::config_t ) parameter. Python pe: lief.PE.Binary new_pe: bytes = pe.write_to_bytes() C++ std::unique_ptr pe; std::ostringstream os; pe->write(os); std::string buffer = os.str(); const auto* start = reinterpret_cast(buffer.data()); size_t size = buffer.size(); Rust let pe: &mut lief::pe::Binary = some_pe; let bytes: Vec = pe.write_to_bytes(); PDB Support Using LIEF Extended , you can access PDB debug information ( lief.pdb.DebugInfo ( lief::pdb::DebugInfo ; lief.pdb.DebugInfo ; LIEF::pdb::DebugInfo )) using the lief.Binary.debug_info() ( lief::pe::Binary::debug_info ; lief.Binary.debug_info ; LIEF::Binary::debug_info() ) function. For more details regarding PDB support, please refer to the PDB section . Authenticode LIEF supports PE Authenticode by providing an API for inspecting and verifying PE executable signatures. PE Authenticode signatures can be accessed by iterating over lief.PE.Binary.signatures() ( lief::pe::Binary::signatures ; lief.PE.Binary.signatures ; LIEF::PE::Binary::signatures() ). The lief.PE.Binary.verify_signature() ( lief::pe::Binary::verify_signature ; lief.PE.Binary.verify_signature() ; LIEF::PE::Binary::verify_signature() ) function can be used to verify that a PE binary is correctly signed. Note Typically, a signed PE executable contains a single signature, but the format allows for multiple signatures. Consequently, lief.PE.Binary.signatures() ( lief::pe::Binary::signatures ; lief.PE.Binary.signatures ; LIEF::PE::Binary::signatures() ) returns an iterator rather than a single signature object. Python pe = lief.PE.parse(\"signed.exe\") assert isinstance(pe, lief.PE.Binary) for signature in pe.signatures: for crt in signature.certificates: print(crt) assert pe.verify_signature() == lief.PE.Signature.VERIFICATION_FLAGS.OK C++ auto pe = LIEF::PE::Parser::parse(\"signed.exe\"); for (const LIEF::PE::Signature& sig : pe->signatures()) { for (const LIEF::PE::x509& crt : sig.certificates()) { std::cout << crt << '\\n'; } } std::cout << (pe->verify_signature() == LIEF::PE::Signature::VERIFICATION_FLAGS::OK) << '\\n'; Rust if let Some(lief::Binary::PE(pe)) = lief::Binary::parse(\"signed.exe\") { for sig in pe.signatures() { for crt in sig.certificates() { println!(\"{:?}\", crt); } } assert!( pe.verify_signature(lief::pe::signature::VerificationChecks::DEFAULT) == lief::pe::signature::VerificationFlags::OK ); } You can find additional details about Authenticode support in this tutorial: PE Authenticode", "contentHash": "69210fc49b148d62c568557b381776ff684310af1572a25f5b78c4cb10b00163", "description": "PE binaries can be parsed using the lief.PE.parse() function.", "docname": "formats/pe/index", "documentID": "85b1a75d1f46fecf3727285bb326e2e96bdb0244f38375f18118f73bebd1de51", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/pe/index.md", "title": "PE - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/pe/modifications/debug.html", "content": "Debug Modification LIEF can create, modify, or delete PE debug information entries. This debug information is located in the IMAGE_DIRECTORY_ENTRY_DEBUG and is represented in LIEF through the lief.PE.Debug ( lief::pe::debug::Entries ; lief.PE.Debug ; LIEF::PE::Debug ) class. These entries can be modified using the API exposed by these structures. For example, the PDB path referenced in a lief.PE.CodeViewPDB ( lief::pe::debug::CodeViewPDB ; lief.PE.CodeViewPDB ; LIEF::PE::CodeViewPDB ) entry can be changed as follows: Python pe: lief.PE.Binary assert isinstance(pe.codeview_pdb, lief.PE.CodeViewPDB) pe.codeview_pdb.filename = r\"C:\\A\\B\\C\\path.pdb\" pe.write(\"out.dll\") C++ std::unique_ptr pe; pe->codeview_pdb()->filename(R\"(C:\\A\\B\\C\\path.pdb)\"); pe->write(\"out.dll\"); Rust let pe: &mut lief::pe::Binary = some_pe; pe.codeview_pdb() .unwrap() .set_filename(r#\"C:\\A\\B\\C\\path.pdb\"#); pe.write(\"out.exe\"); The lief.PE.Binary.remove_debug ( lief::pe::Binary::remove_debug ; lief.PE.Binary.remove_debug() ; LIEF::PE::Binary::remove_debug() ) function can be used to remove a specific entry, whereas the lief.PE.Binary.clear_debug ( lief::pe::Binary::clear_debug ; lief.PE.Binary.clear_debug() ; LIEF::PE::Binary::clear_debug() ) function removes all debug entries: Python # Remove a single CodeViewPDB entry assert pe.codeview_pdb is not None pe.remove_debug(pe.codeview_pdb) # Remove all entries pe.clear_debug() pe.write(\"out.dll\") C++ std::unique_ptr pe; // Remove a single CodeViewPDB entry pe->remove_debug(*pe->codeview_pdb()); // Remove all entries pe->clear_debug(); pe->write(\"out.dll\"); Rust let pe: &mut lief::pe::Binary = some_pe; // Remove a single CodeViewPDB entry if let Some(cv_pdb) = pe.codeview_pdb() { todo!(\"Not Implemented yet\"); //pe.remove_debug(cv_pdb); } // Remove all entries pe.clear_debug(); pe.write(\"out.exe\"); Finally, lief.PE.Binary.add_debug_info ( lief::pe::Binary::add_debug_info ; lief.PE.Binary.add_debug_info() ; LIEF::PE::Binary::add_debug_info() ) can be used to add a crafted debug entry to an existing PE. For example, a custom lief.PE.CodeViewPDB ( lief::pe::debug::CodeViewPDB ; lief.PE.CodeViewPDB ; LIEF::PE::CodeViewPDB ) can be created as follows: Python cv = lief.PE.CodeViewPDB(\"MyCustom.pdb\") pe.add_debug_info(cv) pe.write(\"out.dll\") C++ std::unique_ptr pe; LIEF::PE::CodeViewPDB cv(\"MyCustom.pdb\"); pe->add_debug_info(cv); pe->write(\"out.dll\"); Rust let pe: &mut lief::pe::Binary = some_pe; let cv = lief::pe::debug::CodeViewPDB::with_filename(\"MyCustom.pdb\"); pe.add_debug_info(&cv); pe.write(\"out.exe\");", "contentHash": "79870878b1ccf01b6b455bf36266ee14a4d4df3a39c6bdee9d1ccd4c337cf708", "description": "Debug Modification in PE. LIEF can create, modify, or delete PE debug information entries.", "docname": "formats/pe/modifications/debug", "documentID": "63b14fb0ad0a376b396c25b8679576269df77f4b1a2a886e6249816a0936667e", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/pe/modifications/debug.md", "title": "Debug Modification - PE - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/pe/modifications/exports.html", "content": "Exports Modification LIEF provides extensive support for modifying the PE export table, enabling you to add, remove, or modify export entries, or create an entire export table for a PE binary. This functionality requires enabling lief.PE.Builder.config_t.exports ( lief::pe::builder::Config::exports ; lief.PE.Builder.config_t.exports ; LIEF::PE::Builder::config_t::exports ), as the modified export table is relocated to a new section. The section name can be controlled with lief.PE.Builder.config_t.export_section ( lief::pe::builder::Config::export_section ; lief.PE.Builder.config_t.export_section ; LIEF::PE::Builder::config_t::export_section ). Creating Export Entries Creating a lief.PE.ExportEntry ( lief::pe::export::Entry ; lief.PE.ExportEntry ; LIEF::PE::ExportEntry ) is useful for exposing a “hidden” function by its address, allowing it to be used like a standard linker-generated export. This could be used for code lifting or fuzzing. Python pe: lief.PE.Binary exp = pe.get_export() assert isinstance(exp, lief.PE.Export) # Remove an entry exp.remove_entry(\"my_exported_name\") # Add a new export exp.add_entry(\"fuzz_me\", 0x10010) config = lief.PE.Builder.config_t() config.exports = True config.export_section = \".myedata\" # optional pe.write(\"out.dll\", config) C++ std::unique_ptr pe; LIEF::PE::Export* exp = pe->get_export(); // Remove an entry exp->remove_entry(\"my_exported_name\"); // Add a new export exp->add_entry(\"fuzz_me\", 0x10010); LIEF::PE::Builder::config_t config; config.exports = true; config.export_section = \".myedata\"; pe->write(\"out.dll\", config); Rust let pe: &mut lief::pe::Binary = some_pe; let mut exp: lief::pe::Export = pe.export().unwrap(); // Remove an entry exp.remove_entry_by_name(\"my_exported_name\"); // Add a new export exp.add_entry_by_name(\"fuzz_me\", 0x10010); let mut config = lief::pe::builder::Config::default(); config.exports = true; config.export_section = \".myedata\".to_string(); pe.write_with_config(\"out.dll\", config); Creating an Export Table This section introduces the API for creating an export table. We’ll explore a scenario where we want to convert a PE executable into a DLL. Note The process of converting an executable to a library is also detailed for ELF binaries in the tutorial: 08 - Transforming an ELF executable into a library . First, we must update the PE headers to ensure they are compliant with the DLL format: Python pe: lief.PE.Binary pe.header.add_characteristic(lief.PE.Header.CHARACTERISTICS.DLL) pe.optional_header.addressof_entrypoint = 0 C++ std::unique_ptr pe; pe->header().add_characteristic(LIEF::PE::Header::CHARACTERISTICS::DLL); pe->optional_header().addressof_entrypoint(0); Rust let pe: &mut lief::pe::Binary = some_pe; pe.header() .add_characteristic(lief::pe::headers::Characteristics::DLL); pe.optional_header().set_addressof_entrypoint(0); Then, we can start creating and populating a new export table: Python pe: lief.PE.Binary exp = lief.PE.Export( \"lib_exe2dll.dll\", [ lief.PE.ExportEntry(\"cbk1\", 0x0001000), lief.PE.ExportEntry(\"cbk2\", 0x0001010), ], ) pe.set_export(exp) config = lief.PE.Builder.config_t() config.exports = True pe.write(\"lib_exe2dll.dll\") C++ std::unique_ptr pe; LIEF::PE::Export exp(\"lib_exe2dll.dll\", { LIEF::PE::ExportEntry(\"cbk1\", 0x0001000), LIEF::PE::ExportEntry(\"cbk2\", 0x0001010), }); pe->set_export(exp); LIEF::PE::Builder::config_t config; config.exports = true; pe->write(\"lib_exe2dll.dll\", config); Rust let pe: &mut lief::pe::Binary = some_pe; let mut exp = lief::pe::Export::new(); exp.set_name(\"lib_exe2dll.dll\"); exp.add_entry_by_name(\"cbk1\", 0x0001000); exp.add_entry_by_name(\"cbk2\", 0x0001010); pe.set_export(&exp); let mut config = lief::pe::builder::Config::default(); config.exports = true; pe.write_with_config(\"lib_exe2dll.dll\", config); Limitations This binary-to-library example assumes that the original executable was compiled to be position-independent, meaning it contains relocations. Within a Python environment, we can verify that lib_exe2dll.dll can be loaded as a DLL and that we can call cbk1 and cbk2 : import ctypes lib = ctypes.windll.LoadLibrary(\"lib_exe2dll.dll\") assert lib.cbk1() >= 0 assert lib.cbk2() >= 0", "contentHash": "7431a17d5b683e099977e49f16dd66c990f2e1c7f7230a316641fdbfdb5696b6", "description": "Exports Modification in PE. LIEF provides extensive support for modifying the PE export table, enabling you to add, remove, or modify export entries, or…", "docname": "formats/pe/modifications/exports", "documentID": "392bb02258cc448fdd80b5a65eb2e71c884109303322044ccc28967cb59bac81", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/pe/modifications/exports.md", "title": "Exports Modification - PE - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/pe/modifications/imports.html", "content": "Imports Modification This section describes the different operations supported by LIEF to modify the PE import table. Please note that any operation not mentioned on this page should be considered unsupported or might lead to a corrupted binary. Operation Supported Add new import Add an imported function Remove an import Remove an imported function Extend original IAT Extend original ILT Implementation Update Compared to previous versions of LIEF, import table modification has been completely redesigned to be more reliable when modifying or rebuilding a PE binary. Introduction Modifying the PE import table generically and reliably can be challenging due to its flexible layout and strong dependency on the assembly code. To better understand these challenges and how LIEF addresses them, let’s start with the layout of the import table generated by the MSVC linker ( link.exe ): Import Table Layout ( MSVC/link.exe ) First, the import table is referenced by the lief.PE.DataDirectory ( lief::pe::DataDirectory ; lief.PE.DataDirectory ; LIEF::PE::DataDirectory ) indexed by the IMPORT_TABLE value. The RVA of this data directory points to the beginning of the raw structure describing the import table, while the size of the data directory provides the length of this table. For each imported library (e.g., kernel32.dll ), the import header references three locations: Address (RVA) of the import lookup table ( ILT ) RVA of the imported library name (e.g., RVA of the string kernel32.dll ) Address (RVA) of the import address table ( IAT ) The IAT and the ILT point to an array of integers (pointer width) ending with a zero. In the on-disk PE binary, both tables are filled with an RVA referencing the imported function name (or an ordinal value). For example, if the binary imports kernel32.dll!GetCurrentProcess and kernel32.dll!TerminateProcess , we would have the following ILT/IAT: uintptr_t IAT[3] = { RVA(\"GetCurrentProcess\"), RVA(\"TerminateProcess\"), 0 }; uintptr_t ILT[3] = { RVA(\"GetCurrentProcess\"), RVA(\"TerminateProcess\"), 0 }; When Windows loads the binary and resolves its imports, it fills the IAT with the resolved addresses of the imported functions: uintptr_t IAT[3] = { - RVA(\"GetCurrentProcess\"), - RVA(\"TerminateProcess\"), + 0x7ff7bfdb3f00, // GetCurrentProcess resolved address + 0x7ff7ceab4f00, // TerminateProcess resolved address 0 }; On the other hand, the ILT is left unchanged when the binary is loaded (according to Microsoft documentation). While the import header references three RVAs, the PE format (and the Windows loader) does not enforce any specific ordering between them. This means the ILT can appear before the IAT or vice versa. Figure Import Table Layout (MSVC/link.exe) shows the layout when linking a PE binary with MSVC link.exe . As shown in this figure, the IATs come first, followed by the import headers, then the ILT, and finally the strings (DLL names and imported function names). This layout can vary depending on the linker used to generate the final PE file. In Figure Import Table Layout (LLVM/ld-link.exe) , we can see that the IAT follows the ILT, which is the default order for PE binaries generated by LLVM ld-link.exe . Import Table Layout ( LLVM/ld-link.exe ) Since we cannot assume any predefined layout or ordering of import table elements, we cannot safely recreate a new table at the same locations as the original without risking overwriting important data. Additionally, if we add new imports or imported functions, the modified import table would no longer fit in the original location. To address these constraints, a generic solution involves relocating the import table elsewhere within the binary. Builder Config As this modification is not conservative (i.e., it impacts the layout of the binary even if the import table remains unchanged), it must be explicitly enabled using the builder’s config attribute: lief.PE.Builder.config_t.imports ( lief::pe::builder::Config::imports ; lief.PE.Builder.config_t.imports ; LIEF::PE::Builder::config_t::imports ) We can relocate the import headers, the ILTs, and the strings (DLL names and import names), but we cannot relocate the IAT arbitrarily within the binary. The import table informs the Windows loader about the functions required by the program. When the loader resolves an imported function, its address is written to the IAT, and the assembly code accesses this IAT using stubbing instructions like these: jmp [rip + #IAT_FIXUP]; // e.g. jmp *IAT[3]; or mov rax, [rip + #IAT_FIXUP]; call rax; If we relocate the IAT elsewhere in the binary without taking other factors into account, the instructions referencing the IAT become invalid. Several solutions exist for this problem, one of which involves creating trampolines between the original IAT and the new IAT location. This approach was used in former versions of LIEF; you can read the blog post Washi’s Injecting Code using Imported Functions into Native PE Files for more details. The new approach used by LIEF relocates most elements of the import table (headers, ILTs, and strings) but keeps the original IATs in their original locations . LIEF import table relocation By keeping the original IATs in place, we avoid creating trampolines that require generating assembly. However, this approach introduces constraints on how imports can be modified. Specifically, we must ensure that the untouched IAT remains consistent with the assembly code that uses it. Removing Import You can remove an imported library using the lief.PE.Binary.remove_import() ( lief::pe::Binary::remove_import ; lief.PE.Binary.remove_import() ; LIEF::PE::Binary::remove_import() ) function, or remove all libraries with lief.PE.Binary.remove_all_imports() ( lief::pe::Binary::remove_all_imports ; lief.PE.Binary.remove_all_imports() ; LIEF::PE::Binary::remove_all_imports() ): Python pe: lief.PE.Binary pe.remove_import(\"kernel32.dll\") config = lief.PE.Builder.config_t() config.imports = True pe.write(\"new.exe\", config) C++ std::unique_ptr pe; pe->remove_import(\"kernel32.dll\"); LIEF::PE::Builder::config_t config; config.imports = true; pe->write(\"new.exe\", config); Rust let pe: &mut lief::pe::Binary = some_pe; pe.remove_import(\"kernel32.dll\"); let mut config = lief::pe::builder::Config::default(); config.imports = true; pe.write_with_config(\"new.exe\", config); Removing an imported function To remove an imported function, use lief.PE.Import.remove_entry ( lief::pe::import::Import::remove_entry_by_name ; lief::pe::import::Import::remove_entry_by_ordinal ; lief.PE.Import.remove_entry() ; LIEF::PE::Import::remove_entry() ) on an lief.PE.Import ( lief::pe::import::Import ; lief.PE.Import ; LIEF::PE::Import ) instance. Python pe: lief.PE.Binary kernel32 = pe.get_import(\"kernel32.dll\") assert kernel32 is not None kernel32.remove_entry(\"IsDebuggerPresent\") config = lief.PE.Builder.config_t() config.imports = True pe.write(\"new.exe\", config) C++ std::unique_ptr pe; LIEF::PE::Import* kernel32 = pe->get_import(\"kernel32.dll\"); kernel32->remove_entry(\"IsDebuggerPresent\"); LIEF::PE::Builder::config_t config; config.imports = true; pe->write(\"new.exe\", config); Rust let pe: &mut lief::pe::Binary = some_pe; if let Some(mut kernel32) = pe.import_by_name(\"kernel32.dll\") { kernel32.remove_entry_by_name(\"IsDebuggerPresent\"); } let mut config = lief::pe::builder::Config::default(); config.imports = true; pe.write_with_config(\"new.exe\", config); Since this operation removes an entry from the IAT, and we cannot shrink the table without patching the assembly (or using trampolines), the workaround involves replacing the removed entry with another existing entry. For example, if we remove IsDebuggerPresent from Kernel32.dll , the IAT changes as follows: Before: // Import Address Table of Kernel32.dll uintptr_t IAT[] = { RVA(\"GetCurrentProcess\"), RVA(\"IsDebuggerPresent\"), RVA(\"TerminateProcess\"), 0 }; After: // Import Address Table of Kernel32.dll uintptr_t IAT[] = { RVA(\"GetCurrentProcess\"), RVA(\"GetCurrentProcess\"), RVA(\"TerminateProcess\"), 0 }; Implicit Operation LIEF implicitly performs this padding during the build process. This works because we can reuse the IAT entry associated with the deleted function as a placeholder for any other imported function. Windows allows duplicate symbols for a given import, so duplicating an import is perfectly valid and maintains the IAT’s original length. Creating a new import LIEF allows you to create and add new imports using the lief.PE.Binary.add_import() ( lief::pe::Binary::add_import ; lief::pe::Binary::add_import_at_pos ; lief.PE.Binary.add_import() ; LIEF::PE::Binary::add_import() ) and lief.PE.Import.add_entry() ( lief::pe::import::Import::add_entry_by_name ; lief.PE.Import.add_entry() ; LIEF::PE::Import::add_entry() ) functions: Python pe: lief.PE.Binary stdio = pe.add_import(\"api-ms-win-crt-stdio-l1-1-0.dll\") stdio.add_entry(\"puts\") config = lief.PE.Builder.config_t() config.imports = True pe.write(\"new.exe\", config) C++ std::unique_ptr pe; LIEF::PE::Import& stdio = pe->add_import(\"api-ms-win-crt-stdio-l1-1-0.dll\"); LIEF::PE::ImportEntry& _puts = stdio.add_entry(\"puts\"); LIEF::PE::Builder::config_t config; config.imports = true; pe->write(\"new.exe\", config); Rust let pe: &mut lief::pe::Binary = some_pe; let mut stdio = pe.add_import(\"api-ms-win-crt-stdio-l1-1-0.dll\"); let _puts = stdio.add_entry_by_name(\"puts\"); let mut config = lief::pe::builder::Config::default(); config.imports = true; pe.write_with_config(\"new.exe\", config); As shown in Figure LIEF import table relocation , this modification introduces a new IAT located near the relocated import table. This new IAT contains values for the newly imported functions ( puts in this example). Consequently, the Windows loader will resolve the imported functions in this table. When crafting new imports and adding functions, you may need to determine the IAT address ( lief.PE.ImportEntry.iat_address() ( lief::pe::import::ImportEntry::iat_address ; lief.PE.ImportEntry.iat_address ; LIEF::PE::ImportEntry::iat_address() )) associated with these new functions. The new IAT containing user-created imports is generated during the LIEF write operation. Notably, there is no reliable way to determine the address of the new IAT before the write operation . To address this limitation and allow for modifications after the new IAT is created, lief.PE.Builder.config_t ( lief::pe::::builder::Config ; lief.PE.Builder.config_t ; LIEF::PE::Builder::config_t ) accepts a callback via its lief.PE.Builder.config_t.resolved_iat_cbk ( lief.PE.Builder.config_t.resolved_iat_cbk ; LIEF::PE::Builder::config_t::resolved_iat_cbk ) attribute: Python pe: lief.PE.Binary def iat_resolution_cbk( pe: lief.PE.Binary, imp: lief.PE.Import, entry: lief.PE.ImportEntry, rva: int ): # Process return stdio = pe.add_import(\"api-ms-win-crt-stdio-l1-1-0.dll\") stdio.add_entry(\"puts\") config = lief.PE.Builder.config_t() config.imports = True config.resolved_iat_cbk = iat_resolution_cbk pe.write(\"new.exe\", config) C++ std::unique_ptr pe; LIEF::PE::Import& stdio = pe->add_import(\"api-ms-win-crt-stdio-l1-1-0.dll\"); LIEF::PE::ImportEntry& _puts = stdio.add_entry(\"puts\"); LIEF::PE::Builder::config_t config; config.imports = true; config.resolved_iat_cbk = [](LIEF::PE::Binary* pe, const LIEF::PE::Import* imp, const LIEF::PE::ImportEntry* entry, uint32_t RVA) -> void { // Process return; }; pe->write(\"new.exe\", config); Rust Bindings This callback is not yet available in Rust. Nanobind Leaks Due to Python’s reference counting, you might encounter Nanobind warnings about leaked objects. You can disable these warnings using lief.disable_leak_warning() . The fourth parameter of this callback, uint32_t RVA , is the address in the IAT where the address of the resolved function ( lief.PE.ImportEntry ( lief::pe::import::ImportEntry ; lief.PE.ImportEntry ; LIEF::PE::ImportEntry )) will be stored by the loader. For example, these addresses can be traced as follows: def iat_resolution_cbk(pe: lief.PE.Binary, imp: lief.PE.Import, entry: lief.PE.ImportEntry, rva: int): print(f\"{imp.name}!{entry.name}: 0x{rva:010x}\") # [...] stdio = dll.add_import(\"api-ms-win-crt-stdio-l1-1-0.dll\") stdio.add_entry(\"puts\") stdio.add_entry(\"__p__commode\") stdio.add_entry(\"_set_fmode\") # [...] Which can result in the following output: api-ms-win-crt-stdio-l1-1-0.dll!puts: 0x000046c9e2 api-ms-win-crt-stdio-l1-1-0.dll!__p__commode: 0x000046c9ea api-ms-win-crt-stdio-l1-1-0.dll!_set_fmode: 0x000046c9f2 Given this output, the IAT address of puts is at RVA 0x000046c9e2 . This information can be used to patch sections that need this address: def iat_resolution_cbk(pe: lief.PE.Binary, imp: lief.PE.Import, entry: lief.PE.ImportEntry, rva: int): code = pe.get_section(\".injected\") patch(code, rva) Adding a new imported function LIEF can also be used to add a function to an existing import, but this must be done carefully to avoid corrupting the binary. Since we cannot extend the original IAT of the import where we want to add the new function, the workaround involves adding a new import with the same name as the existing one and adding the function to this duplicate import. // Original Import * kernel32.dll │ ├── GetCurrentProcessId IAT[0] │ ├── GetCurrentThreadId IAT[1] │ └── GetModuleHandleW IAT[2] // Duplicated import * kernel32.dll │ └── GetStartupInfoW NEW IAT[0] │ └────────-> New Import The code is very similar to that in Creating a new import . Python pe: lief.PE.Binary kernel32 = pe.add_import(\"kernel32.dll\") kernel32.add_entry(\"GetStartupInfoW\") config = lief.PE.Builder.config_t() config.imports = True pe.write(\"new.exe\", config) C++ std::unique_ptr pe; LIEF::PE::Import& kernel32 = pe->add_import(\"kernel32.dll\"); LIEF::PE::ImportEntry& _GetStartupInfoW = kernel32.add_entry(\"GetStartupInfoW\"); LIEF::PE::Builder::config_t config; config.imports = true; pe->write(\"new.exe\", config); Rust let pe: &mut lief::pe::Binary = some_pe; let mut kernel32 = pe.add_import(\"kernel32.dll\"); let _get_startup_info = kernel32.add_entry_by_name(\"GetStartupInfoW\"); let mut config = lief::pe::builder::Config::default(); config.imports = true; pe.write_with_config(\"new.exe\", config);", "contentHash": "86a8572acad04e59d47b87b2b0ad6cd0ed2f87c355951a4a1006ad0691ea5b97", "description": "Imports Modification in PE. This section describes the different operations supported by LIEF to modify the PE import table. Please note that any operation…", "docname": "formats/pe/modifications/imports", "documentID": "455bea748adb327b19f0db4f74a1e08d0ed93c0b65b3d02b7e2df8472c809386", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/pe/modifications/imports.md", "title": "Imports Modification - PE - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/pe/modifications/resources.html", "content": "Resources Modification LIEF allows you to modify (or create) PE resources at different levels: Directly on the binary tree ( lief.PE.ResourceNode ( lief::pe::resources::Node ; lief.PE.ResourceNode ; LIEF::PE::ResourceNode )) Using the lief.PE.ResourcesManager ( lief::pe::resources::Manager ; lief.PE.ResourcesManager ; LIEF::PE::ResourcesManager ). Binary Tree Modifications The resource root node can be accessed using the lief.PE.Binary.resources() ( lief::pe::Binary::resources ; lief.PE.Binary.resources ; LIEF::PE::Binary::resources() ) function: Python pe: lief.PE.Binary rsrc = pe.resources print(rsrc) C++ std::unique_ptr pe; LIEF::PE::ResourceNode* rsrc = pe->resources(); std::cout << *rsrc << '\\n'; Rust let pe: &lief::pe::Binary = some_pe; let rsrc = pe.resources().unwrap(); println!(\"{}\", &rsrc as &dyn NodeBase); From this lief.PE.ResourceNode ( lief::pe::resources::Node ; lief.PE.ResourceNode ; LIEF::PE::ResourceNode ) instance, you can use the lief.PE.ResourceNode.add_child() ( lief::pe::resources::NodeBase::add_child ; lief.PE.ResourceNode.add_child() ; LIEF::PE::ResourceNode::add_child() ) or lief.PE.ResourceNode.delete_child() ( lief::pe::resources::NodeBase::delete_child ; lief.PE.ResourceNode.delete_child() ; LIEF::PE::ResourceNode::delete_child() ) functions to add or delete nodes: Python pe: lief.PE.Binary rsrc = pe.resources assert isinstance(rsrc, lief.PE.ResourceNode) dir_node = lief.PE.ResourceDirectory(100) data_node = lief.PE.ResourceData([1, 2, 3]) rsrc.add_child(dir_node).add_child(data_node) C++ std::unique_ptr pe; LIEF::PE::ResourceNode* root = pe->resources(); LIEF::PE::ResourceDirectory dir_node(/*id=*/100); LIEF::PE::ResourceData data_node(std::vector{1, 2, 3}); (*root).add_child(dir_node).add_child(data_node); pe->write(\"new.exe\"); Rust let pe: &mut lief::pe::Binary = some_pe; let mut root = pe.resources().unwrap(); let mut dir_node = lief::pe::resources::Directory::with_id(100); let data_node = lief::pe::resources::Data::with_buffer(&[1, 2, 3]); dir_node.add_child(&Node::Data(data_node)); root.add_child(&Node::Directory(dir_node)); pe.write(\"new.exe\"); This low-level API can be used to modify the tree or change the data of a specific node. Pretty Printing You can also print a node to get a formatted representation of the resource tree: pe: lief.PE.Binary tree = pe.resources print(tree) ├── Directory ID: 0000 (0x0000) │ ├── Directory ID: 0016 (0x0010) type: VERSION │ │ └── Directory ID: 0001 (0x0001) │ │ └── Data ID: 0000 (0x0000) Lang: 0x00 / Sublang: 0x00 length=772 (0x000304), offset: 0x1ca0 │ │ ├── Hex: 04:03:34:00:00:00:56:00:53:00:5f:00:56:00:45:00:52:00:53:00 │ │ └── Str: ..4...V.S._.V.E.R.S. │ └── Directory ID: 0024 (0x0018) type: MANIFEST │ └── Directory ID: 0001 (0x0001) │ └── Data ID: 1033 (0x0409) Lang: 0x09 / Sublang: 0x01 length=1900 (0x00076c), offset: 0x1fa4 │ ├── Hex: 3c:61:73:73:65:6d:62:6c:79:20:78:6d:6c:6e:73:3d:22:75:72:6e │ └── Str: \"\"\" pe.write(\"new.exe\") C++ std::unique_ptr pe; result manager = pe->resources_manager(); manager->manifest(R\"manifest( )manifest\"); pe->write(\"new.exe\"); Rust let pe: &mut lief::pe::Binary = some_pe; let mut manager = pe.resources_manager().unwrap(); manager.set_manifest( r#\" \"#, ); pe.write(\"new.exe\"); Resource Tree Transfer between Binaries LIEF can transfer the resource tree from one binary to another. This operation can be performed using the lief.PE.Binary.set_resources() ( lief::pe::Binary::set_resources ; lief.PE.Binary.set_resources() ; LIEF::PE::Binary::set_resources() ) function: Python from_pe: lief.PE.Binary to_pe: lief.PE.Binary resources = from_pe.resources assert isinstance(resources, lief.PE.ResourceNode) to_pe.set_resources(resources) to_pe.write(\"new.exe\") C++ std::unique_ptr from; std::unique_ptr to; to->set_resources(*from->resources()); to->write(\"new.exe\"); Rust to_pe.set_resources(&from_pe.resources().unwrap());", "contentHash": "88c716cf91ee72635e23e012c2368905b76b463ad33d35818033c9a7010384be", "description": "Resources Modification in PE. LIEF allows you to modify (or create) PE resources at different levels:", "docname": "formats/pe/modifications/resources", "documentID": "a0971aaf5247b06ebf642a5185d5b0355760c4355c113f5f0215ec0f42e3d7f7", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/pe/modifications/resources.md", "title": "Resources Modification - PE - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/pe/modifications/tls.html", "content": "TLS Modification LIEF can be used to modify , create , or remove Thread Local Storage (TLS) information. TLS Modifications All attributes of the lief.PE.TLS ( lief::pe::TLS ; lief.PE.TLS ; LIEF::PE::TLS ) interface can be modified as long as the changes are consistent with the layout of the PE binary. For instance, you can adjust the TLS callbacks by removing, reordering, or adding addresses: Python pe: lief.PE.Binary tls = pe.tls assert isinstance(tls, lief.PE.TLS) callbacks: list[int] = tls.callbacks # Remove the last entry callbacks.pop() # Add an address callbacks.append(0x140001010) tls.callbacks = callbacks pe.write(\"tls_modified.exe\") C++ std::unique_ptr pe; TLS* tls = pe->tls(); std::vector callbacks = tls->callbacks(); // Remove the last entry callbacks.pop_back(); // Add an address callbacks.push_back(0x140001010); tls->callbacks(std::move(callbacks)); pe->write(\"tls_modified.exe\"); Rust let pe: &mut lief::pe::Binary = some_pe; let mut tls = pe.tls().unwrap(); let mut callbacks: Vec = tls.callbacks(); // Remove the last entry callbacks.pop(); // Add an address callbacks.push(0x140001010); tls.set_callbacks(&callbacks); pe.write(\"tls_modified.exe\"); Relocations Note that LIEF automatically manages the relocations that must be created or removed when modifying the TLS callbacks. TLS Creation If a PE binary does not contain TLS metadata, LIEF can be used to create this structure. First, we can create and initialize a TLS instance: Python tls = lief.PE.TLS() tls.callbacks = [ 0x140001000, 0x140001010, ] C++ LIEF::PE::TLS tls; tls.callbacks(std::vector{ 0x140001000, 0x140001010, }); Rust let mut tls = lief::pe::TLS::new(); tls.set_callbacks(&[0x140001000, 0x140001010]); And then, we can add this instance to a lief.PE.Binary ( lief::pe::Binary ; lief.PE.Binary ; LIEF::PE::Binary ): Python pe.tls = tls # `tls` defined previously pe.write(\"tls_demo.exe\") C++ pe->tls(tls); // `tls` defined previously pe->write(\"tls_demo.exe\"); Rust pe.set_tls(&tls); // `tls` defined previously pe.write(\"tls_demo.exe\"); Relocations Similar to TLS callback modifications, LIEF automatically manages relocations. In addition, it automatically initializes (if not set by the user) AddressOfIndex , which is required when setting up TLS metadata.", "contentHash": "c7f97062a240e011360ed0bf34ebbf407932463c1df22d965a2f3f85ba82e50c", "description": "TLS Modification in PE. LIEF can be used to modify, create, or remove Thread Local Storage (TLS) information.", "docname": "formats/pe/modifications/tls", "documentID": "048c732da6998b2fa773a35f776bc0d68f8a1af302351f8eeffad529e2f0c94f", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/pe/modifications/tls.md", "title": "TLS Modification - PE - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/pe/python.html", "content": "Python Parser lief.PE.parse lief.PE.parse( obj: str | io.IOBase | os.PathLike | bytes | list[int] , config: lief.PE.ParserConfig ) → lief.PE.Binary | None Parse the PE binary from the given parameter and return a lief.PE.Binary object lief.PE.ParserConfig class lief.PE.ParserConfig( self ) Bases: object This class is used to configure the behavior of the PE Parser ( lief.PE.parse() ) all all = default_conf default_conf = parse_arm64x_binary property parse_arm64x_binary → bool Whether to parse nested ARM64X binaries. This option is disabled by default because it can introduce significant parsing overhead. parse_exceptions property parse_exceptions → bool Whether to parse in-depth exception metadata. This option is disabled by default because it can introduce significant parsing overhead. parse_exports property parse_exports → bool Whether to parse the PE Export Directory. parse_imports property parse_imports → bool Whether to parse the PE Import Directory. parse_reloc property parse_reloc → bool Whether to parse PE relocations. parse_rsrc property parse_rsrc → bool Whether to parse the PE resources tree. parse_signature property parse_signature → bool Whether to parse the PE Authenticode signature. rebase property rebase → int | None If set, this value holds the original image base from which the binary should be rebased. This is used to undo relocations and IAT bindings when parsing a PE loaded in memory. Binary lief.PE.Binary class lief.PE.Binary Bases: Binary Class which represents a PE binary which is the main interface to manage and modify a PE executable. This object can be instantiated through lief.parse() or lief.PE.parse() while the constructor of this object can be used to craft a binary from scratch (see: 02 - Create a PE from scratch (Deprecated) ) add_debug_info add_debug_info( self , entry: lief._lief.PE.Debug ) → lief._lief.PE.Debug | None Add a new debug entry add_import add_import( self , import_name: str , pos: int = -1 ) → lief._lief.PE.Import Add an imported library (i.e. DLL ) to the binary. The second parameter pos defines where to insert the import. If negative (default), the import is appended to the end of the list. add_relocation add_relocation( self , relocation: lief._lief.PE.Relocation ) → lief._lief.PE.Relocation Add a Relocation to the binary add_section add_section( self , section: lief._lief.PE.Section ) → lief._lief.PE.Section | None Add a Section to the binary. authentihash authentihash( self , algorithm: lief._lief.PE.ALGORITHMS ) → bytes Compute the authentihash according to the ALGORITHMS given in the first parameter authentihash_md5 property authentihash_md5 → bytes Authentihash MD5 value authentihash_sha1 property authentihash_sha1 → bytes Authentihash SHA1 value authentihash_sha256 property authentihash_sha256 → bytes Authentihash SHA-256 value authentihash_sha512 property authentihash_sha512 → bytes Authentihash SHA-512 value cert_dir property cert_dir → lief.PE.DataDirectory | None Return the data directory associated with the certificate table (authenticode). clear_debug clear_debug( self ) → bool Remove all debug info from the binary codeview_pdb property codeview_pdb → lief.PE.CodeViewPDB | None Return the CodeViewPDB if present coff_string_table property coff_string_table → lief.PE.Binary.it_strings_table Iterator over the strings located in the COFF string table compute_checksum compute_checksum( self ) → int Re-compute the value of checksum . If both values do not match, it could mean that the binary has been modified after the compilation. This value is computed by LIEF for the current binary object. data_directories property data_directories → lief.PE.Binary.it_data_directories Return an iterator over the DataDirectory data_directory data_directory( self , type: lief._lief.PE.DataDirectory.TYPES ) → lief._lief.PE.DataDirectory | None Return the DataDirectory object from the given TYPES type debug property debug → lief.PE.Binary.it_debug Return the Debug debug_dir property debug_dir → lief.PE.DataDirectory | None Return the data directory associated with the debug table delay_dir property delay_dir → lief.PE.DataDirectory | None Return the data directory associated with delayed imports delay_imports property delay_imports → lief.PE.Binary.it_delay_imports Return an iterator over the DelayImport dos_header property dos_header → lief.PE.DosHeader Return the DosHeader dos_stub property dos_stub → memoryview DOS stub content as a list of bytes exception_functions property exception_functions → list[ lief.Function ] Function found in the Exception directory exceptions property exceptions → lief.PE.Binary.it_exceptions Iterator over the exception ( _RUNTIME_FUNCTION ) functions. Warning This property requires that the option lief.PE.ParserConfig.parse_exceptions was turned on (default is False ) when parsing the binary. exceptions_dir property exceptions_dir → lief.PE.DataDirectory | None Return the data directory associated with the exceptions export_dir property export_dir → lief.PE.DataDirectory | None Return the data directory associated with the export table fill_address fill_address( self , address: int , size: int , value: int = 0 , addr_type: lief._lief.Binary.VA_TYPES = VA_TYPES.AUTO ) → None Fill the content at the provided address with a fixed value find_coff_string find_coff_string( self , offset: int ) → lief._lief.COFF.String | None Try to find the COFF string at the given offset in the COFF string table. Warning This offset must include the first 4 bytes holding the size of the table. Hence, the first string starts a the offset 4. find_exception_at find_exception_at( self , rva: int ) → lief._lief.PE.ExceptionInfo | None Try to find the exception info at the given RVA. Warning This property requires that the option lief.PE.ParserConfig.parse_exceptions was turned on (default is False ) when parsing the binary. functions property functions → list[ lief.Function ] All Function found in the binary get_delay_import get_delay_import( self , import_name: str ) → lief._lief.PE.DelayImport | None Return the DelayImport from the given name or None if not found get_export get_export( self ) → lief._lief.PE.Export | None Return the Export object get_import get_import( self , import_name: str ) → lief._lief.PE.Import | None Return the Import from the given name or None if it can’t be found get_section get_section( self , section_name: str ) → lief._lief.PE.Section | None Return the Section object from the given name or None if not found has_configuration property has_configuration → bool True if the current binary has LoadConfiguration has_debug property has_debug → bool True if the current binary has a Debug object has_delay_import has_delay_import( self , import_name: str ) → bool True if the binary imports the given library name has_delay_imports property has_delay_imports → bool True if the current binary has delay imports ( DelayImport ) has_exceptions property has_exceptions → bool True if the current binary uses Exceptions has_exports property has_exports → bool True if the current binary has a Export object has_import has_import( self , import_name: str ) → bool True if the binary imports the given library name has_imports property has_imports → bool True if the current binary has imports ( Import ) has_relocations property has_relocations → bool True if the current binary uses Relocation has_resources property has_resources → bool True if the current binary has a Resources object has_rich_header property has_rich_header → bool True if the current binary has a RichHeader object has_signatures property has_signatures → bool True if the binary is signed with the PE authenticode ( Signature ) has_tls property has_tls → bool True if the current binary has a TLS object header property header → lief.PE.Header Return the Header iat_dir property iat_dir → lief.PE.DataDirectory | None Return the data directory associated with the IAT import_dir property import_dir → lief.PE.DataDirectory | None Return the data directory associated with the import table imports property imports → lief.PE.Binary.it_imports Return an iterator over the Import libraries is_arm64ec property is_arm64ec → bool True if this binary is compiled in ARM64EC mode (emulation compatible) is_arm64x property is_arm64x → bool True if this binary is compiled in ARM64X mode (contains both ARM64 and ARM64EC is_reproducible_build property is_reproducible_build → bool True if the binary was compiled with a reproducible build directive ( Debug ) load_config_dir property load_config_dir → lief.PE.DataDirectory | None Return the data directory associated with the load config load_configuration property load_configuration → lief.PE.LoadConfiguration | None Return the LoadConfiguration object or None if not present nested_pe_binary property nested_pe_binary → lief.PE.Binary | None If the current binary contains dynamic relocations (e.g. lief.PE.DynamicFixupARM64X ), this function returns the relocated view of the current PE. This can be used to get the alternative PE binary, targeting a different architecture. Warning This property requires that the option lief.PE.ParserConfig.parse_arm64x_binary was turned on (default is False ) when parsing the binary. offset_to_rva offset_to_rva( self , offset: int ) → int Convert the given offset into a relative virtual address (RVA). optional_header property optional_header → lief.PE.OptionalHeader Header that follows the header . It is named optional from the COFF specifications but it is mandatory in a PE file. overlay property overlay → memoryview Return the overlay content as a list of bytes overlay_offset property overlay_offset → int Return the original overlay offset relocation_dir property relocation_dir → lief.PE.DataDirectory | None Return the data directory associated with the relocation table relocations property relocations → lief.PE.DynamicFixupGeneric.it_relocations Return an iterator over the Relocation remove remove( self , section: lief._lief.PE.Section , clear: bool = False ) → None Remove the Section given in first parameter remove_all_imports remove_all_imports( self ) → None Remove all imported libraries remove_all_relocations remove_all_relocations( self ) → None remove_debug remove_debug( self , entry: lief._lief.PE.Debug ) → bool Remove a specific debug entry remove_import remove_import( self , name: str ) → bool Remove the imported library with the given name remove_tls remove_tls( self ) → None Remove the TLS from the binary resources property resources → lief.PE.ResourceNode | None Return the ResourceNode tree or None if not present resources_manager property resources_manager → lief.PE.ResourcesManager | lief.lief_errors Return the ResourcesManager to manage resources rich_header property rich_header → lief.PE.RichHeader | None RichHeader object (if present) rsrc_dir property rsrc_dir → lief.PE.DataDirectory | None Return the data directory associated with the resources tree rva_to_offset rva_to_offset( self , rva_address: int ) → int Convert a relative virtual address to an offset The conversion is performed by looking for the section that encompasses the provided RVA. section_from_offset section_from_offset( self , offset: int ) → lief._lief.PE.Section | None Return the Section which encompasses the provided offset. It returns None if a section can’t be found. section_from_rva section_from_rva( self , rva: int ) → lief._lief.PE.Section | None Return the Section which encompasses the provided relative virtual address. If a section can’t be found, it returns None. sections property sections → lief.PE.Binary.it_section Return an iterator over the PE’s Section set_export set_export( self , arg: lief._lief.PE.Export , / ) → lief._lief.PE.Export Add or replace the export table set_resources set_resources( self , new_tree: lief._lief.PE.ResourceNode ) → lief._lief.PE.ResourceNode | None Change or set the current resource tree with the new one provided in parameter. signatures property signatures → lief.PE.Binary.it_const_signatures Return an iterator over the Signature objects sizeof_headers property sizeof_headers → int Size of all the PE headers symbols property symbols → lief.PE.Binary.it_symbols Return binary’s Symbol tls property tls → lief.PE.TLS | None TLS object (if present) tls_dir property tls_dir → lief.PE.DataDirectory | None Return the data directory associated with TLS va_to_offset va_to_offset( self , va_address: int ) → int Convert an absolute virtual address into an offset See: rva_to_offset() verify_signatureverify_signature verify_signature( self , checks: lief._lief.PE.Signature.VERIFICATION_CHECKS = VERIFICATION_CHECKS.DEFAULT ) → lief._lief.PE.Signature.VERIFICATION_FLAGS verify_signature( self , signature: lief._lief.PE.Signature , checks: lief._lief.PE.Signature.VERIFICATION_CHECKS = VERIFICATION_CHECKS.DEFAULT ) → lief._lief.PE.Signature.VERIFICATION_FLAGS Overloaded function. verify_signature(self, checks: lief._lief.PE.Signature.VERIFICATION_CHECKS = VERIFICATION_CHECKS.DEFAULT) -> lief._lief.PE.Signature.VERIFICATION_FLAGS Verify the binary against the embedded signature(s) (if any) First off, it checks that the embedded signatures are correct (c.f. lief.PE.Signature.check() ) and then it checks that the authentihash matches lief.PE.ContentInfo.digest One can tweak the verification process with the lief.PE.Signature.VERIFICATION_CHECKS flags See also lief.PE.Signature.check() verify_signature(self, signature: lief._lief.PE.Signature, checks: lief._lief.PE.Signature.VERIFICATION_CHECKS = VERIFICATION_CHECKS.DEFAULT) -> lief._lief.PE.Signature.VERIFICATION_FLAGS Verify the binary with the Signature object provided in the first parameter It can be used to verify a detached signature: detached = lief.PE.Signature.parse(\"sig.pkcs7\") binary.verify_signature(detached) virtual_size property virtual_size → int Return the binary’s virtual size. This value should match sizeof_image writewrite write( self , output_path: str | os.PathLike ) → None write( self , output_path: str | os.PathLike , config: lief._lief.PE.Builder.config_t ) → None Overloaded function. write(self, output_path: Union[str | os.PathLike]) -> None Build the binary and write the result in the given output file write(self, output_path: Union[str | os.PathLike], config: lief._lief.PE.Builder.config_t) -> None Build the binary with the given config and write the result in the given output file write_to_byteswrite_to_bytes write_to_bytes( self , config: lief._lief.PE.Builder.config_t ) → bytes write_to_bytes( self ) → bytes Dos Header lief.PE.DosHeader class lief.PE.DosHeader Bases: Object Class which represents the DosHeader, the first structure present at the beginning of a PE file. Most of the attributes of this structures are not relevant, except addressof_new_exeheader addressof_new_exeheader property addressof_new_exeheader → int addressof_relocation_table property addressof_relocation_table → int checksum property checksum → int copy copy( self ) → lief._lief.PE.DosHeader Duplicate the current instance of this object create create( arg: lief.PE.PE_TYPE ) → lief.PE.DosHeader = file_size_in_pages property file_size_in_pages → int header_size_in_paragraphs property header_size_in_paragraphs → int initial_ip property initial_ip → int initial_relative_cs property initial_relative_cs → int initial_relative_ss property initial_relative_ss → int initial_sp property initial_sp → int magic property magic → int maximum_extra_paragraphs property maximum_extra_paragraphs → int minimum_extra_paragraphs property minimum_extra_paragraphs → int numberof_relocation property numberof_relocation → int oem_id property oem_id → int oem_info property oem_info → int overlay_number property overlay_number → int used_bytes_in_last_page property used_bytes_in_last_page → int Header lief.PE.Header class lief.PE.Header Bases: Object Class that represents the PE header (which follows the lief.PE.DosHeader ) CHARACTERISTICS class CHARACTERISTICS( *values ) Bases: Flag AGGRESSIVE_WS_TRIM AGGRESSIVE_WS_TRIM = 16 BYTES_REVERSED_HI BYTES_REVERSED_HI = 32768 BYTES_REVERSED_LO BYTES_REVERSED_LO = 128 DEBUG_STRIPPED DEBUG_STRIPPED = 512 DLL DLL = 8192 EXECUTABLE_IMAGE EXECUTABLE_IMAGE = 2 LARGE_ADDRESS_AWARE LARGE_ADDRESS_AWARE = 32 LINE_NUMS_STRIPPED LINE_NUMS_STRIPPED = 4 LOCAL_SYMS_STRIPPED LOCAL_SYMS_STRIPPED = 8 NEED_32BIT_MACHINE NEED_32BIT_MACHINE = 256 NET_RUN_FROM_SWAP NET_RUN_FROM_SWAP = 2048 RELOCS_STRIPPED RELOCS_STRIPPED = 1 REMOVABLE_RUN_FROM_SWAP REMOVABLE_RUN_FROM_SWAP = 1024 SYSTEM SYSTEM = 4096 UP_SYSTEM_ONLY UP_SYSTEM_ONLY = 16384 from_value from_value( arg: int ) → lief.PE.Header.CHARACTERISTICS = MACHINE_TYPES class MACHINE_TYPES( *values ) Bases: Enum ALPHA ALPHA = 388 ALPHA64 ALPHA64 = 644 AM33 AM33 = 467 AMD64 AMD64 = 34404 ARM ARM = 448 ARM64 ARM64 = 43620 ARM64EC ARM64EC = 42561 ARM64X ARM64X = 42574 ARMNT ARMNT = 452 CHPE_X86 CHPE_X86 = 14948 EBC EBC = 3772 I386 I386 = 332 IA64 IA64 = 512 LOONGARCH32 LOONGARCH32 = 25138 LOONGARCH64 LOONGARCH64 = 25188 M32R M32R = 36929 MIPS16 MIPS16 = 614 MIPSFPU MIPSFPU = 870 MIPSFPU16 MIPSFPU16 = 1126 POWERPC POWERPC = 496 POWERPCBE POWERPCBE = 498 POWERPCFP POWERPCFP = 497 R4000 R4000 = 358 SH3 SH3 = 418 SH3DSP SH3DSP = 419 SH4 SH4 = 422 SH5 SH5 = 424 THUMB THUMB = 450 UNKNOWN UNKNOWN = 0 WCEMIPSV2 WCEMIPSV2 = 361 from_value from_value( arg: int ) → lief.PE.Header.MACHINE_TYPES = add_characteristic add_characteristic( self , characteristic: lief._lief.PE.Header.CHARACTERISTICS ) → None Add the given CHARACTERISTICS to the header characteristics property characteristics → int The CHARACTERISTICS that indicate the attributes of the file. characteristics_list property characteristics_list → list[ lief.PE.Header.CHARACTERISTICS ] Return the CHARACTERISTICS as a list copy copy( self ) → lief._lief.PE.Header Duplicate the current instance of this object create create( type: lief.PE.PE_TYPE ) → lief.PE.Header = has_characteristic has_characteristic( self , characteristic: lief._lief.PE.Header.CHARACTERISTICS ) → bool True if the header has the given CHARACTERISTICS machine property machine → lief.PE.Header.MACHINE_TYPES The target machine architecture ( MACHINE_TYPES ) numberof_sections property numberof_sections → int Number of sections in the binary numberof_symbols property numberof_symbols → int The number of entries in the symbol table. This data can be used to locate the string table which immediately follows the symbol table. This value should be zero for an image because COFF debugging information is deprecated. pointerto_symbol_table property pointerto_symbol_table → int The file offset of the COFF symbol table, or zero if no COFF symbol table is present. This value should be zero for an image because COFF debugging information is deprecated. remove_characteristic remove_characteristic( self , characteristic: lief._lief.PE.Header.CHARACTERISTICS ) → None Remove the given CHARACTERISTICS from the header signature property signature → list[int] Signature (or magic byte) of the header. It must be: PE\\0\\0 sizeof_optional_header property sizeof_optional_header → int Size of the OptionalHeader AND the data directories which follows this header. This value is equivalent to: sizeof(pe_optional_header) + NB_DATA_DIR * sizeof(data_directory) This size should be either: 0xE0 (224) for a PE32 (32 bits) 0xF0 (240) for a PE32+ (64 bits) time_date_stamps property time_date_stamps → int The low 32 bits of the number of seconds since 00:00 January 1, 1970 that indicates when the file was created. Optional Header lief.PE.OptionalHeader class lief.PE.OptionalHeader Bases: Object Class which represents the PE OptionalHeader structure. DLL_CHARACTERISTICS class DLL_CHARACTERISTICS( *values ) Bases: IntFlag APPCONTAINER APPCONTAINER = 4096 DYNAMIC_BASE DYNAMIC_BASE = 64 FORCE_INTEGRITY FORCE_INTEGRITY = 128 GUARD_CF GUARD_CF = 16384 HIGH_ENTROPY_VA HIGH_ENTROPY_VA = 32 NO_BIND NO_BIND = 2048 NO_ISOLATION NO_ISOLATION = 512 NO_SEH NO_SEH = 1024 NX_COMPAT NX_COMPAT = 256 TERMINAL_SERVER_AWARE TERMINAL_SERVER_AWARE = 32768 WDM_DRIVER WDM_DRIVER = 8192 from_value from_value( arg: int ) → lief.PE.OptionalHeader.DLL_CHARACTERISTICS = SUBSYSTEM class SUBSYSTEM( *values ) Bases: Enum EFI_APPLICATION EFI_APPLICATION = 10 EFI_BOOT_SERVICE_DRIVER EFI_BOOT_SERVICE_DRIVER = 11 EFI_ROM EFI_ROM = 13 EFI_RUNTIME_DRIVER EFI_RUNTIME_DRIVER = 12 NATIVE NATIVE = 1 NATIVE_WINDOWS NATIVE_WINDOWS = 8 OS2_CUI OS2_CUI = 5 POSIX_CUI POSIX_CUI = 7 UNKNOWN UNKNOWN = 0 WINDOWS_BOOT_APPLICATION WINDOWS_BOOT_APPLICATION = 16 WINDOWS_CE_GUI WINDOWS_CE_GUI = 9 WINDOWS_CUI WINDOWS_CUI = 3 WINDOWS_GUI WINDOWS_GUI = 2 XBOX XBOX = 14 XBOX_CODE_CATALOG XBOX_CODE_CATALOG = 17 from_value from_value( arg: int ) → lief.PE.OptionalHeader.SUBSYSTEM = add add( self , characteristic: lief._lief.PE.OptionalHeader.DLL_CHARACTERISTICS ) → None Add the given DLL_CHARACTERISTICS addressof_entrypoint property addressof_entrypoint → int The address of the entry point relative to the image base when the executable file is loaded into memory. For program images, this is the starting address. For device drivers, this is the address of the initialization function. An entry point is optional for DLLs. When no entry point is present, this field must be zero. baseof_code property baseof_code → int Address relative to the imagebase where the binary’s code starts baseof_data property baseof_data → int Address relative to the imagebase where the binary’s data starts. Warning This value is not present for PE64 files checksum property checksum → int The image file checksum. The algorithm for computing the checksum is incorporated into IMAGHELP.DLL . The following are checked for validation at load time all drivers , any DLL loaded at boot time, and any DLL that is loaded into a critical Windows process. copy copy( self ) → lief._lief.PE.OptionalHeader Duplicate the current instance of this object create create( type: lief.PE.PE_TYPE ) → lief.PE.OptionalHeader = dll_characteristics property dll_characteristics → int Some characteristics ( DLL_CHARACTERISTICS ) of the underlying binary like the support of the PIE. The prefix dll comes from the official PE specifications but these characteristics are also used for executables dll_characteristics_lists property dll_characteristics_lists → list[ lief.PE.OptionalHeader.DLL_CHARACTERISTICS ] dll_characteristics as a list of DLL_CHARACTERISTICS file_alignment property file_alignment → int The alignment factor (in bytes) that is used to align the raw data of sections in the image file. The value should be a power of 2 between 512 and 64K, inclusive. The default value is 512. If the section_alignment is less than the architecture’s page size, then file_alignment must match section_alignment . has has( self , characteristics: lief._lief.PE.OptionalHeader.DLL_CHARACTERISTICS ) → bool True if the given DLL_CHARACTERISTICS is in the dll_characteristics imagebase property imagebase → int The preferred base address when mapping the binary in memory loader_flags property loader_flags → int According to the PE specifications, this value is reserved and should be 0. magic property magic → lief.PE.PE_TYPE Magic value ( PE_TYPE ) that identifies a PE32 from a PE64 major_image_version property major_image_version → int The major version number of the image. major_linker_version property major_linker_version → int The linker major version number major_operating_system_version property major_operating_system_version → int The major version number of the required operating system. major_subsystem_version property major_subsystem_version → int The major version number of the subsystem. minor_image_version property minor_image_version → int The minor version number of the image. minor_linker_version property minor_linker_version → int The linker minor version number minor_operating_system_version property minor_operating_system_version → int The minor version number of the required operating system. minor_subsystem_version property minor_subsystem_version → int The minor version number of the subsystem numberof_rva_and_size property numberof_rva_and_size → int The number of DataDirectory that follow this header remove remove( self , characteristic: lief._lief.PE.OptionalHeader.DLL_CHARACTERISTICS ) → None Remove the given DLL_CHARACTERISTICS section_alignment property section_alignment → int The alignment (in bytes) of sections when they are loaded into memory. It must be greater than or equal to file_alignment and the default is the page size for the architecture. sizeof_code property sizeof_code → int The size of the code .text section or the sum of all the sections that contain code (ie. Section with the flag CNT_CODE ) sizeof_headers property sizeof_headers → int The combined size of an MS-DOS stub, PE header, and section headers rounded up to a multiple of file_alignment . sizeof_heap_commit property sizeof_heap_commit → int The size of the local heap space to commit. sizeof_heap_reserve property sizeof_heap_reserve → int The size of the local heap space to reserve. Only sizeof_heap_commit is available one page at a time until the reserve size is reached. sizeof_image property sizeof_image → int The size (in bytes) of the image, including all headers, as the image is loaded in memory. It must be a multiple of section_alignment and should match virtual_size . sizeof_initialized_data property sizeof_initialized_data → int The size of the initialized data which are usually located in the .data section. If the initialized data are split across multiple sections, it is the sum of the sections. The sections associated with the initialized data are usually identified with the flag CNT_INITIALIZED_DATA sizeof_stack_commit property sizeof_stack_commit → int The size of the stack to commit. sizeof_stack_reserve property sizeof_stack_reserve → int The size of the stack to reserve. Only sizeof_stack_commit is committed, the rest is made available one page at a time until the reserve size is reached. sizeof_uninitialized_data property sizeof_uninitialized_data → int The size of the uninitialized data which are usually located in the .bss section. If the uninitialized data are split across multiple sections, it is the sum of the sections. The sections associated with the uninitialized data are usually identified with the flag CNT_UNINITIALIZED_DATA subsystem property subsystem → lief.PE.OptionalHeader.SUBSYSTEM Target subsystem ( SUBSYSTEM ) like Driver, XBox, Windows GUI, .. win32_version_value property win32_version_value → int Reserved, must be zero. Data Directory lief.PE.DataDirectory class lief.PE.DataDirectory( self ) Bases: Object Class that represents a PE data directory entry TYPES class TYPES( *values ) Bases: Enum ARCHITECTURE ARCHITECTURE = 7 BASE_RELOCATION_TABLE BASE_RELOCATION_TABLE = 5 BOUND_IMPORT BOUND_IMPORT = 11 CERTIFICATE_TABLE CERTIFICATE_TABLE = 4 CLR_RUNTIME_HEADER CLR_RUNTIME_HEADER = 14 DEBUG_DIR DEBUG_DIR = 6 DELAY_IMPORT_DESCRIPTOR DELAY_IMPORT_DESCRIPTOR = 13 EXCEPTION_TABLE EXCEPTION_TABLE = 3 EXPORT_TABLE EXPORT_TABLE = 0 GLOBAL_PTR GLOBAL_PTR = 8 IAT IAT = 12 IMPORT_TABLE IMPORT_TABLE = 1 LOAD_CONFIG_TABLE LOAD_CONFIG_TABLE = 10 RESERVED RESERVED = 15 RESOURCE_TABLE RESOURCE_TABLE = 2 TLS_TABLE TLS_TABLE = 9 UNKNOWN UNKNOWN = 16 from_value from_value( arg: int ) → lief.PE.DataDirectory.TYPES = content property content → memoryview Raw content (bytes) referenced by this data directory copy copy( self ) → lief._lief.PE.DataDirectory Duplicate the current instance of this object has_section property has_section → bool True if the current data directory is tied to a Section rva property rva → int Relative virtual address of the content associated with the current data directory section property section → lief.PE.Section | None Section associated with the current data directory or None if not linked size property size → int Size in bytes of the content associated with the current data directory type property type → lief.PE.DataDirectory.TYPES Type ( TYPES ) of the current data directory Section lief.PE.Sectionlief.PE.Sectionlief.PE.Section class lief.PE.Section( self ) **class lief.PE.Section( self , name: str , content: collections.abc.Sequence[int] ) class lief.PE.Section( self , name: str ) ** Bases: Section Class which represents a PE section. It extends the base class lief.Section CHARACTERISTICS class CHARACTERISTICS( *values ) Bases: Flag ALIGN_1024BYTES ALIGN_1024BYTES = 11534336 ALIGN_128BYTES ALIGN_128BYTES = 8388608 ALIGN_16BYTES ALIGN_16BYTES = 5242880 ALIGN_1BYTES ALIGN_1BYTES = 1048576 ALIGN_2048BYTES ALIGN_2048BYTES = 12582912 ALIGN_256BYTES ALIGN_256BYTES = 9437184 ALIGN_2BYTES ALIGN_2BYTES = 2097152 ALIGN_32BYTES ALIGN_32BYTES = 6291456 ALIGN_4096BYTES ALIGN_4096BYTES = 13631488 ALIGN_4BYTES ALIGN_4BYTES = 3145728 ALIGN_512BYTES ALIGN_512BYTES = 10485760 ALIGN_64BYTES ALIGN_64BYTES = 7340032 ALIGN_8192BYTES ALIGN_8192BYTES = 14680064 ALIGN_8BYTES ALIGN_8BYTES = 4194304 CNT_CODE CNT_CODE = 32 CNT_INITIALIZED_DATA CNT_INITIALIZED_DATA = 64 CNT_UNINITIALIZED_DATA CNT_UNINITIALIZED_DATA = 128 GPREL GPREL = 32768 LNK_COMDAT LNK_COMDAT = 4096 LNK_INFO LNK_INFO = 512 LNK_NRELOC_OVFL LNK_NRELOC_OVFL = 16777216 LNK_OTHER LNK_OTHER = 256 LNK_REMOVE LNK_REMOVE = 2048 MEM_16BIT MEM_16BIT = 131072 MEM_DISCARDABLE MEM_DISCARDABLE = 33554432 MEM_EXECUTE MEM_EXECUTE = 536870912 MEM_LOCKED MEM_LOCKED = 262144 MEM_NOT_CACHED MEM_NOT_CACHED = 67108864 MEM_NOT_PAGED MEM_NOT_PAGED = 134217728 MEM_PRELOAD MEM_PRELOAD = 524288 MEM_PURGEABLE MEM_PURGEABLE = 65536 MEM_READ MEM_READ = 1073741824 MEM_SHARED MEM_SHARED = 268435456 MEM_WRITE MEM_WRITE = 2147483648 TYPE_NO_PAD TYPE_NO_PAD = 8 from_value from_value( arg: int ) → lief.PE.Section.CHARACTERISTICS = characteristics property characteristics → int The CHARACTERISTICS that describe the characteristics of the section characteristics_lists property characteristics_lists → list[ lief.PE.Section.CHARACTERISTICS ] characteristics as a list coff_string property coff_string → lief.COFF.String | None Return the COFF string associated with the section’s name (or None) This coff string is usually present for long section names whose length does not fit in the 8 bytes allocated by the PE format. copy copy( self ) → lief._lief.PE.Section Duplicate the current instance of this object has_characteristic has_characteristic( self , characteristic: lief._lief.PE.Section.CHARACTERISTICS ) → bool True if the section has the given CHARACTERISTICS is_discardable property is_discardable → bool True if the section can be discarded as needed. This is typically the case for debug-related sections. numberof_line_numbers property numberof_line_numbers → int The number of line-number entries for the section. This value should be zero for an image because COFF debugging information is deprecated. See: pointerto_line_numbers numberof_relocations property numberof_relocations → int The number of relocation entries for the section. See: pointerto_relocation padding property padding → bytes Section padding content as bytes pointerto_line_numbers property pointerto_line_numbers → int The file pointer to the beginning of line-number entries for the section. This is set to zero if there are no COFF line numbers. This value should be zero for an image because COFF debugging information is deprecated and modern debug information relies on the PDB files. pointerto_raw_data property pointerto_raw_data → int The offset of the section data in the PE file. Alias of offset pointerto_relocation property pointerto_relocation → int The file pointer to the beginning of the COFF relocation entries for the section. This is set to zero for executable images or if there are no relocations. For modern PE binaries, this value is usually set to 0 as the relocations are managed by Relocation . sizeof_raw_data property sizeof_raw_data → int Alias of size (size of the data in the section) virtual_size property virtual_size → int The total size of the section when loaded into memory. If this value is greater than sizeof_raw_data , the section is zero-padded. Import lief.PE.Importlief.PE.Import class lief.PE.Import( self ) class lief.PE.Import( self , library_name: str ) Bases: Object Class that represents a PE import Overloaded function. __init__(self) -> None Default constructor __init__(self, library_name: str) -> None Constructor from a library name add_entryadd_entry add_entry( self , entry: lief._lief.PE.ImportEntry ) → lief._lief.PE.ImportEntry add_entry( self , function_name: str ) → lief._lief.PE.ImportEntry Add an ImportEntry (function) to the current import directory property directory → lief.PE.DataDirectory | None Return the DataDirectory associated with this import. It should be the one at index lief.PE.DataDirectory.TYPES.IMPORT_TABLE . It can return None if the Import directory can’t be resolved. entries property entries → lief.PE.Import.it_entries Iterator over the ImportEntry (functions) forwarder_chain property forwarder_chain → int The index of the first forwarder reference get_entry get_entry( self , function_name: str ) → lief._lief.PE.ImportEntry | None Return the ImportEntry with the given name or None if not found get_function_rva_from_iat get_function_rva_from_iat( self , function_name: str ) → int | lief._lief.lief_errors Return the relative virtual address of the given function within the Import Address Table iat_directory property iat_directory → lief.PE.DataDirectory | None Return the DataDirectory associated with the IAT table. It should be the one at index lief.PE.DataDirectory.TYPES.IAT . It can return None if the IAT directory can’t be resolved. import_address_table_rva property import_address_table_rva → int The RVA of the import address table ( IAT ). The content of this table is identical to the content of the Import Lookup Table ( ILT ) until the image is bound. Warning This address could change when re-building the binary import_lookup_table_rva property import_lookup_table_rva → int The RVA of the import lookup table. This table contains the name or the ordinal for all the imports. name property name → str | bytes Library name (e.g. kernel32.dll ) name_rva property name_rva → int The original name rva remove_entryremove_entry remove_entry( self , name: str ) → bool remove_entry( self , ord: int ) → bool Overloaded function. remove_entry(self, name: str) -> bool Remove the import entry with the given name. Return True if the deletion succeeds, False otherwise remove_entry(self, ord: int) -> bool Remove the import entry with the given ordinal number Return True if the deletion succeeds, False otherwise timedatestamp property timedatestamp → int The stamp that is set to zero until the image is bound. After the image is bound, this field is set to the time/data stamp of the DLL Import Entry lief.PE.ImportEntrylief.PE.ImportEntrylief.PE.ImportEntry class lief.PE.ImportEntry( self ) **class lief.PE.ImportEntry( self , import_name: str ) class lief.PE.ImportEntry( self , data: int , type: lief._lief.PE.PE_TYPE ) ** Bases: Symbol Class that represents an entry (i.e. an import) in the import table ( Import ). It extends the lief.Symbol generic class that provides the lief.Symbol.name and lief.Symbol.value Overloaded function. __init__(self) -> None __init__(self, import_name: str) -> None Constructor from a name __init__(self, data: int, type: lief._lief.PE.PE_TYPE) -> None copy copy( self ) → lief._lief.PE.ImportEntry Duplicate the current instance of this object data property data → int Raw value demangled_name property demangled_name → str Demangled representation of the symbol or an empty string if it can’t be demangled. hint property hint → int Index into the lief.PE.Export.entries that is used to speed-up the symbol resolution iat_address property iat_address → int Original address of the entry in the Import Address Table iat_value property iat_value → int Value of the current entry in the Import Address Table. It should match the lookup table value. ilt_value property ilt_value → int Original value in the import lookup table. This value should match the iat_value is_ordinal property is_ordinal → bool True if it is an import by ordinal name property name → str | bytes Import name if not ordinal ordinal property ordinal → int Ordinal value (if any). See: is_ordinal Delay Import lief.PE.DelayImport class lief.PE.DelayImport( self , library_name: str ) Bases: Object Class that represents a PE delay import Constructor from a library name attribute property attribute → int Reserved and should be zero according to the PE specifications biat property biat → int RVA of the bound delay-load import address table or 0 if the table does not exist. copy copy( self ) → lief._lief.PE.DelayImport Duplicate the current instance of this object entries property entries → lief.PE.DelayImport.it_entries Iterator over the DelayImportEntry (functions) handle property handle → int The RVA of the module handle (in the .data section) It is used for storage by the routine that is supplied to manage delay-loading. iat property iat → int RVA of the delay-load import address table. name property name → str | bytes Library name (e.g. kernel32.dll ) names_table property names_table → int RVA of the delay-load import names table. The content of this table has the same layout as the Import lookup table timestamp property timestamp → int The timestamp of the DLL to which this image has been bound. uiat property uiat → int RVA of the unload delay-load import address table or 0 if the table does not exist. According to the PE specifications, this table is an exact copy of the delay import address table that can be used to restore the original IAT in the case of unloading. Delay Import Entry lief.PE.DelayImportEntry class lief.PE.DelayImportEntry( self ) Bases: Symbol Class that represents an entry (i.e. a delay import) in the delay import table ( DelayImport ). It extends the lief.Symbol generic class that provides the lief.Symbol.name and lief.Symbol.value The meaning of lief.Symbol.value for this PE object is the address (as an RVA) in the IAT where the resolution should take place copy copy( self ) → lief._lief.PE.DelayImportEntry Duplicate the current instance of this object data property data → int Raw value demangled_name property demangled_name → str Demangled representation of the symbol or an empty string if it can’t be demangled. hint property hint → int Index into the lief.PE.Export.entries that is used to speed-up the symbol resolution iat_value property iat_value → int Value of the current entry in the delay-loaded import address table. See: iat is_ordinal property is_ordinal → bool True if it is an import by ordinal name property name → str | bytes Delay import name if not ordinal ordinal property ordinal → int Ordinal value (if any). See: is_ordinal TLS lief.PE.TLS class lief.PE.TLS( self ) Bases: Object Class which represents the PE Thread Local Storage. This PE structure is also used to implement binary/library constructors. Default constructor add_callback add_callback( self , addr: int ) → lief._lief.PE.TLS Add a new TLS callback addressof_callbacks property addressof_callbacks → int Pointer to an array of TLS callback functions. The array is null-terminated, so if there is no callback, this field points to 4 bytes set to zero. See: callbacks addressof_index property addressof_index → int The location to receive the TLS index assigned by the loader. This location should be located in a writable section like .data . addressof_raw_data property addressof_raw_data → tuple[int, int] Tuple (start address, end address) of the TLS template. The template is a block of data that is used to initialize TLS data. The system copies all of this data each time a thread is created, so it must not be corrupted. Note These addresses are not RVA. It is addresses for which there should be a base relocation in the .reloc section. callbacks property callbacks → list[int] List of the callbacks associated with the current TLS. These functions are called before any other functions. characteristics property characteristics → int The four bits [23:20] describe alignment info. Possible values are those defined as IMAGE_SCN_ALIGN_* , which are also used to describe alignment of section in object files. The other 28 bits are reserved for future use. copy copy( self ) → lief._lief.PE.TLS Duplicate the current instance of this object data_template property data_template → memoryview The initial content used to initialize TLS data. directory property directory → lief.PE.DataDirectory | None DataDirectory associated with the TLS object (or None if not linked) has_data_directory property has_data_directory → bool True if there is a DataDirectory associated with the TLS object has_section property has_section → bool True if there is a Section associated with the TLS object section property section → lief.PE.Section | None Section associated with the TLS object (or None if not linked) sizeof_zero_fill property sizeof_zero_fill → int Size in bytes of the zeros to be padded after the data specified by data_template . Relocation lief.PE.Relocation class lief.PE.Relocation( self ) Bases: Object Class which represents the Base Relocation Block Usually, we find this structure in the .reloc section add_entry add_entry( self , new_entry: lief._lief.PE.RelocationEntry ) → lief._lief.PE.RelocationEntry Add a new RelocationEntry block_size property block_size → int The total number of bytes in the base relocation block. block_size = sizeof(BaseRelocationBlock) + nb_of_relocs * sizeof(uint16_t = RelocationEntry) copy copy( self ) → lief._lief.PE.Relocation Duplicate the current instance of this object entries property entries → lief.PE.Relocation.it_entries Iterator over the RelocationEntry virtual_address property virtual_address → int The RVA for which the offset of the relocation entries (RelocationEntry) is added Relocation Entry lief.PE.RelocationEntrylief.PE.RelocationEntry class lief.PE.RelocationEntry( self ) class lief.PE.RelocationEntry( self , arg0: int , arg1: lief._lief.PE.RelocationEntry.BASE_TYPES , / ) Bases: Relocation Class which represents an entry of the PE relocation table. It extends the lief.Relocation object to provide an uniform API across the file formats. BASE_TYPES class BASE_TYPES( *values ) Bases: Enum ABS ABS = 0 ARM_MOV32 ARM_MOV32 = 517 DIR64 DIR64 = 10 HIGH HIGH = 1 HIGH3ADJ HIGH3ADJ = 11 HIGHADJ HIGHADJ = 4 HIGHLOW HIGHLOW = 3 LOW LOW = 2 MIPS_JMPADDR MIPS_JMPADDR = 261 MIPS_JMPADDR16 MIPS_JMPADDR16 = 9 RISCV_HI20 RISCV_HI20 = 1029 RISCV_LOW12I RISCV_LOW12I = 4103 RISCV_LOW12S RISCV_LOW12S = 8200 SECTION SECTION = 6 THUMB_MOV32 THUMB_MOV32 = 2055 UNKNOWN UNKNOWN = -1 from_value from_value( arg: int ) → lief.PE.RelocationEntry.BASE_TYPES = data property data → int Raw data of the relocation: The high 4 bits store the relocation type The low 12 bits store the relocation offset ( position ) position property position → int Offset - relative to virtual_address - where the relocation occurs type property type → lief.PE.RelocationEntry.BASE_TYPES Type of the relocation Export lief.PE.Exportlief.PE.Export class lief.PE.Export( self ) class lief.PE.Export( self , name: str , entries: collections.abc.Sequence[ lief._lief.PE.ExportEntry ] ) Bases: Object Class which represents a PE Export Overloaded function. __init__(self) -> None Default constructor __init__(self, name: str, entries: collections.abc.Sequence[lief._lief.PE.ExportEntry]) -> None Constructor from DLL name and its exports add_entryadd_entry add_entry( self , exp: lief._lief.PE.ExportEntry ) → lief._lief.PE.ExportEntry add_entry( self , name: str , addr: int ) → lief._lief.PE.ExportEntry Add the given export and return the newly created and added entry copy copy( self ) → lief._lief.PE.Export Duplicate the current instance of this object entries property entries → lief.PE.Export.it_entries Iterator over the ExportEntry export_addr_table_cnt property export_addr_table_cnt → int Number of entries in the export address table export_addr_table_rva property export_addr_table_rva → int RVA of the export address table export_flags property export_flags → int According to the PE specifications this value is reserved and should be set to 0 find_entryfind_entry find_entry( self , name: str ) → lief._lief.PE.ExportEntry | None find_entry( self , ordinal: int ) → lief._lief.PE.ExportEntry | None Overloaded function. find_entry(self, name: str) -> lief._lief.PE.ExportEntry | None Find the export with the given name find_entry(self, ordinal: int) -> lief._lief.PE.ExportEntry | None Find the export entry with the given ordinal number find_entry_at find_entry_at( self , rva_addr: int ) → lief._lief.PE.ExportEntry | None Find the export entry at the provided RVA major_version property major_version → int The major version number (can be user-defined) minor_version property minor_version → int The minor version number (can be user-defined) name property name → str | bytes The name of the library exported (e.g. KERNEL32.dll ) name_rva property name_rva → int Address of the ASCII DLL’s name (RVA) names_addr_table_cnt property names_addr_table_cnt → int Number of exports by name names_addr_table_rva property names_addr_table_rva → int RVA to the list of exported names ord_addr_table_rva property ord_addr_table_rva → int RVA to the list of exported ordinals ordinal_base property ordinal_base → int The starting number for the exports. Usually this value is set to 1 remove_entryremove_entryremove_entry remove_entry( self , entry: lief._lief.PE.ExportEntry ) → bool **remove_entry( self , name: str ) → bool remove_entry( self , rva: int ) → bool ** Overloaded function. remove_entry(self, entry: lief._lief.PE.ExportEntry) -> bool Remove the given export entry remove_entry(self, name: str) -> bool Remove the export entry with the given name remove_entry(self, rva: int) -> bool Remove the export entry with the given RVA timestamp property timestamp → int The time and date that the export data was created Export Entry lief.PE.ExportEntrylief.PE.ExportEntry class lief.PE.ExportEntry( self ) class lief.PE.ExportEntry( self , name: str , addr: int ) Bases: Symbol Class which represents a PE Export entry (cf. lief.PE.Export ) Overloaded function. __init__(self) -> None Default constructor __init__(self, name: str, addr: int) -> None Constructor with export name and address address property address → int demangled_name property demangled_name → str Demangled representation of the symbol or an empty string if it can’t be demangled. forward_information property forward_information → lief.PE.ExportEntry.forward_information_t forward_information_t class forward_information_t Bases: object function property function → str library property library → str function_rva property function_rva → int is_extern property is_extern → bool is_forwarded property is_forwarded → bool name property name → str | bytes ordinal property ordinal → int set_forward_info set_forward_info( self , lib: str , function: str ) → None Signature lief.PE.Signature class lief.PE.Signature Bases: Object VERIFICATION_CHECKS class VERIFICATION_CHECKS( *values ) Bases: Flag Flags to tweak the verification process of the signature See lief.PE.Signature.check() and lief.PE.Binary.verify_signature() DEFAULT DEFAULT = 1 HASH_ONLY HASH_ONLY = 2 LIFETIME_SIGNING LIFETIME_SIGNING = 4 SKIP_CERT_TIME SKIP_CERT_TIME = 8 from_value from_value( arg: int ) → lief.PE.Signature.VERIFICATION_CHECKS = VERIFICATION_FLAGS class VERIFICATION_FLAGS( *values ) Bases: Flag BAD_DIGEST BAD_DIGEST = 128 BAD_SIGNATURE BAD_SIGNATURE = 256 CERT_EXPIRED CERT_EXPIRED = 1024 CERT_FUTURE CERT_FUTURE = 2048 CERT_NOT_FOUND CERT_NOT_FOUND = 8 CORRUPTED_AUTH_DATA CORRUPTED_AUTH_DATA = 32 CORRUPTED_CONTENT_INFO CORRUPTED_CONTENT_INFO = 16 INCONSISTENT_DIGEST_ALGORITHM INCONSISTENT_DIGEST_ALGORITHM = 4 INVALID_SIGNER INVALID_SIGNER = 1 MISSING_PKCS9_MESSAGE_DIGEST MISSING_PKCS9_MESSAGE_DIGEST = 64 NO_SIGNATURE NO_SIGNATURE = 512 OK OK = 0 UNSUPPORTED_ALGORITHM UNSUPPORTED_ALGORITHM = 2 from_value from_value( arg: int ) → lief.PE.Signature.VERIFICATION_FLAGS = certificates property certificates → lief.PE.Signature.it_const_crt Return an iterator over x509 certificates check check( self , checks: lief._lief.PE.Signature.VERIFICATION_CHECKS = VERIFICATION_CHECKS.DEFAULT ) → lief._lief.PE.Signature.VERIFICATION_FLAGS Check the integrity of the signature and return a lief.PE.Signature.VERIFICATION_FLAGS By default, it performs the following verifications: It must contain only one signer info ( signers ) lief.PE.Signature.digest_algorithm must match: lief.PE.ContentInfo.digest_algorithm lief.PE.SignerInfo.digest_algorithm The x509 certificate specified by lief.PE.SignerInfo.serial_number and lief.PE.SignerInfo.issuer must exist within lief.PE.Signature.certificates Given the x509 certificate, compare lief.PE.SignerInfo.encrypted_digest against either: hash of authenticated attributes ( authenticated_attributes ) if present hash of ContentInfo If they are Authenticated attributes, check that a PKCS9_MESSAGE_DIGEST ( lief.PE.PKCS9MessageDigest ) attribute exists and that its value matches hash of ContentInfo Check the validity of the PKCS #9 counter signature if present If the signature doesn’t embed a signing-time in the counter signature, check the certificate validity. (See lief.PE.Signature.VERIFICATION_CHECKS.LIFETIME_SIGNING and lief.PE.Signature.VERIFICATION_CHECKS.SKIP_CERT_TIME ) See: lief.PE.Signature.VERIFICATION_CHECKS to tweak the behavior content_info property content_info → lief.PE.ContentInfo Return the ContentInfo digest_algorithm property digest_algorithm → lief.PE.ALGORITHMS Return the algorithm ( ALGORITHMS ) used to sign the content of ContentInfo find_crt find_crt( self , serialno: collections.abc.Sequence[int] ) → lief._lief.PE.x509 | None Find the x509 certificate according to its serial number find_crt_issuerfind_crt_issuer find_crt_issuer( self , issuer: str ) → lief._lief.PE.x509 | None find_crt_issuer( self , issuer: str , serialno: collections.abc.Sequence[int] ) → lief._lief.PE.x509 | None Overloaded function. find_crt_issuer(self, issuer: str) -> lief._lief.PE.x509 | None Find the x509 certificate according to its issuer find_crt_issuer(self, issuer: str, serialno: collections.abc.Sequence[int]) -> lief._lief.PE.x509 | None Find the x509 certificate according to its issuer AND its serial number find_crt_subjectfind_crt_subject find_crt_subject( self , subject: str ) → lief._lief.PE.x509 | None find_crt_subject( self , subject: str , serialno: collections.abc.Sequence[int] ) → lief._lief.PE.x509 | None Overloaded function. find_crt_subject(self, subject: str) -> lief._lief.PE.x509 | None Find the x509 certificate according to its subject find_crt_subject(self, subject: str, serialno: collections.abc.Sequence[int]) -> lief._lief.PE.x509 | None Find the x509 certificate according to its subject AND its serial number parse parse( *args ) → lief.PE.Signature | None = raw_der property raw_der → memoryview Return the raw original signature as a byte object signers property signers → lief.PE.Signature.it_const_signers_t Return an iterator over the signers ( SignerInfo ) version property version → int Version of the signature. It should be 1 Signature Attribute lief.PE.Attribute class lief.PE.Attribute Bases: Object Interface over PKCS #7 attribute TYPE class TYPE( *values ) Bases: Enum CONTENT_TYPE CONTENT_TYPE = 1 GENERIC_TYPE GENERIC_TYPE = 2 MS_COUNTER_SIGN MS_COUNTER_SIGN = 6 MS_PLATFORM_MANIFEST_BINARY_ID MS_PLATFORM_MANIFEST_BINARY_ID = 9 MS_SPC_NESTED_SIGN MS_SPC_NESTED_SIGN = 7 MS_SPC_STATEMENT_TYPE MS_SPC_STATEMENT_TYPE = 8 PKCS9_AT_SEQUENCE_NUMBER PKCS9_AT_SEQUENCE_NUMBER = 10 PKCS9_COUNTER_SIGNATURE PKCS9_COUNTER_SIGNATURE = 11 PKCS9_MESSAGE_DIGEST PKCS9_MESSAGE_DIGEST = 12 PKCS9_SIGNING_TIME PKCS9_SIGNING_TIME = 13 SIGNING_CERTIFICATE_V2 SIGNING_CERTIFICATE_V2 = 3 SPC_RELAXED_PE_MARKER_CHECK SPC_RELAXED_PE_MARKER_CHECK = 5 SPC_SP_OPUS_INFO SPC_SP_OPUS_INFO = 4 UNKNOWN UNKNOWN = 0 from_value from_value( arg: int ) → lief.PE.Attribute.TYPE = type property type → lief.PE.Attribute.TYPE Concrete type of the attribute Signature ContentType lief.PE.ContentType class lief.PE.ContentType Bases: Attribute Interface over the structure described by the OID 1.2.840.113549.1.9.3 (PKCS #9) The internal structure is described in the: RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0 ContentType ::= OBJECT IDENTIFIER oid property oid → str OID as described in RFC #2985 (string object) Signature GenericType lief.PE.GenericType class lief.PE.GenericType Bases: Attribute Interface over an attribute for which the internal structure is not supported by LIEF oid property oid → str OID of the original attribute raw_content property raw_content → memoryview Original DER blob of the attribute Signature MsSpcNestedSignature lief.PE.MsSpcNestedSignature class lief.PE.MsSpcNestedSignature Bases: Attribute Interface over the structure described by the OID 1.3.6.1.4.1.311.2.4.1 The internal structure is not documented but we can infer the following structure: MsSpcNestedSignature ::= SET OF SignedData With SignedData , the structure described in PKCS #7 RFC (See: lief.PE.Signature ) signature property signature → lief.PE.Signature Underlying Signature object Signature MsSpcStatementType lief.PE.MsSpcStatementType class lief.PE.MsSpcStatementType Bases: Attribute Interface over the structure described by the OID 1.3.6.1.4.1.311.2.1.11 The internal structure is described in the official document: Windows Authenticode Portable Executable Signature Format SpcStatementType ::= SEQUENCE of OBJECT IDENTIFIER oid property oid → str According to the documentation: The SpcStatementType MUST contain one Object Identifier with either the value ``1.3.6.1.4.1.311.2.1.21 (SPC_INDIVIDUAL_SP_KEY_PURPOSE_OBJID)`` or ``1.3.6.1.4.1.311.2.1.22 (SPC_COMMERCIAL_SP_KEY_PURPOSE_OBJID)``. Signature PKCS9AtSequenceNumber lief.PE.PKCS9AtSequenceNumber class lief.PE.PKCS9AtSequenceNumber Bases: Attribute Interface over the structure described by the OID 1.2.840.113549.1.9.25.4 (PKCS #9) The internal structure is described in the RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0 sequenceNumber ATTRIBUTE ::= { WITH SYNTAX SequenceNumber EQUALITY MATCHING RULE integerMat SINGLE VALUE TRUE ID pkcs-9-at-sequenceNumber } SequenceNumber ::= INTEGER (1..MAX) number property number → int Number as described in the RFC Signature PKCS9CounterSignature lief.PE.PKCS9CounterSignature class lief.PE.PKCS9CounterSignature Bases: Attribute Interface over the structure described by the OID 1.2.840.113549.1.9.6 (PKCS #9) The internal structure is described in the RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0 counterSignature ATTRIBUTE ::= { WITH SYNTAX SignerInfo ID pkcs-9-at-counterSignature } signer property signer → lief.PE.SignerInfo Return the SignerInfo as described in the RFC #2985 Signature PKCS9MessageDigest lief.PE.PKCS9MessageDigest class lief.PE.PKCS9MessageDigest Bases: Attribute Interface over the structure described by the OID 1.2.840.113549.1.9.4 (PKCS #9) The internal structure is described in the RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0 messageDigest ATTRIBUTE ::= { WITH SYNTAX MessageDigest EQUALITY MATCHING RULE octet SINGLE VALUE TRUE ID pkcs-9-at-messageDigest } MessageDigest ::= OCTET STRING digest property digest → bytes Message digest as a blob of bytes as described in the RFC Signature PKCS9SigningTime lief.PE.PKCS9SigningTime class lief.PE.PKCS9SigningTime Bases: Attribute Interface over the structure described by the OID 1.2.840.113549.1.9.5 (PKCS #9) The internal structure is described in the RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0 signingTime ATTRIBUTE ::= { WITH SYNTAX SigningTime EQUALITY MATCHING RULE signingTimeMatch SINGLE VALUE TRUE ID pkcs-9-at-signingTime } SigningTime ::= Time -- imported from ISO/IEC 9594-8 time property time → list[int] Time as a list [year, month, day, hour, min, sec] Signature SpcSpOpusInfo lief.PE.SpcSpOpusInfo class lief.PE.SpcSpOpusInfo Bases: Attribute Interface over the structure described by the OID 1.3.6.1.4.1.311.2.1.12 The internal structure is described in the official document: Windows Authenticode Portable Executable Signature Format SpcSpOpusInfo ::= SEQUENCE { programName [0] EXPLICIT SpcString OPTIONAL, moreInfo [1] EXPLICIT SpcLink OPTIONAL } more_info property more_info → str | bytes Other information such as an URL program_name property program_name → str | bytes Program description provided by the publisher Signature SpcIndirectData lief.PE.SpcIndirectData class lief.PE.SpcIndirectData Bases: Content digest property digest → memoryview digest_algorithm property digest_algorithm → lief.PE.ALGORITHMS Digest used to hash the file. This should match digest_algorithm file property file → str url property url → str GenericContent lief.PE.GenericContent class lief.PE.GenericContent Bases: Content RsaInfo lief.PE.RsaInfo class lief.PE.RsaInfo Bases: object Object representing a RSA key D property D → bytes RSA private exponent (in bytes) E property E → bytes RSA public exponent (in bytes) N property N → bytes RSA public modulus (in bytes) P property P → bytes First prime factor (in bytes) Q property Q → bytes Second prime factor (in bytes) has_private_key property has_private_key → bool True if it embeds a private key has_public_key property has_public_key → bool True if it embeds a public key key_size property key_size → int Size of the public modulus in bits x509 lief.PE.x509 class lief.PE.x509 Bases: Object Interface over a x509 certificate KEY_TYPES class KEY_TYPES( *values ) Bases: Enum Public key scheme used by the x509 certificate ECDSA ECDSA = 4 ECKEY ECKEY = 2 ECKEY_DH ECKEY_DH = 3 NONE NONE = 0 RSA RSA = 1 RSASSA_PSS RSASSA_PSS = 6 RSA_ALT RSA_ALT = 5 from_value from_value( arg: int ) → lief.PE.x509.KEY_TYPES = KEY_USAGE class KEY_USAGE( *values ) Bases: Enum Key usage as defined in RFC #5280 - section-4.2.1.3 CRL_SIGN CRL_SIGN = 6 DATA_ENCIPHERMENT DATA_ENCIPHERMENT = 3 DECIPHER_ONLY DECIPHER_ONLY = 8 DIGITAL_SIGNATURE DIGITAL_SIGNATURE = 0 ENCIPHER_ONLY ENCIPHER_ONLY = 7 KEY_AGREEMENT KEY_AGREEMENT = 4 KEY_CERT_SIGN KEY_CERT_SIGN = 5 KEY_ENCIPHERMENT KEY_ENCIPHERMENT = 2 NON_REPUDIATION NON_REPUDIATION = 1 from_value from_value( arg: int ) → lief.PE.x509.KEY_USAGE = VERIFICATION_FLAGS class VERIFICATION_FLAGS( *values ) Bases: Flag Verification flags associated with verify BADCERT_BAD_KEY BADCERT_BAD_KEY = 65536 BADCERT_BAD_MD BADCERT_BAD_MD = 16384 BADCERT_BAD_PK BADCERT_BAD_PK = 32768 BADCERT_CN_MISMATCH BADCERT_CN_MISMATCH = 4 BADCERT_EXPIRED BADCERT_EXPIRED = 1 BADCERT_EXT_KEY_USAGE BADCERT_EXT_KEY_USAGE = 4096 BADCERT_FUTURE BADCERT_FUTURE = 512 BADCERT_KEY_USAGE BADCERT_KEY_USAGE = 2048 BADCERT_MISSING BADCERT_MISSING = 64 BADCERT_NOT_TRUSTED BADCERT_NOT_TRUSTED = 8 BADCERT_NS_CERT_TYPE BADCERT_NS_CERT_TYPE = 8192 BADCERT_OTHERNATURE BADCERT_OTHERNATURE = 256 BADCERT_REVOKED BADCERT_REVOKED = 2 BADCERT_SKIP_VERIFY BADCERT_SKIP_VERIFY = 128 BADCRL_BAD_KEY BADCRL_BAD_KEY = 524288 BADCRL_BAD_MD BADCRL_BAD_MD = 131072 BADCRL_BAD_PK BADCRL_BAD_PK = 262144 BADCRL_EXPIRED BADCRL_EXPIRED = 32 BADCRL_FUTURE BADCRL_FUTURE = 1024 BADCRL_NOT_TRUSTED BADCRL_NOT_TRUSTED = 16 OK OK = 0 from_value from_value( arg: int ) → lief.PE.x509.VERIFICATION_FLAGS = certificate_policies property certificate_policies → list[str] Policy information terms as list of OID (see RFC #5280) ext_key_usage property ext_key_usage → list[str] Indicates one or more purposes for which the certified public key may be used (list of OID) is_ca property is_ca → bool is_trusted_by is_trusted_by( self , ca_list: collections.abc.Sequence[ lief._lief.PE.x509 ] ) → lief._lief.PE.x509.VERIFICATION_FLAGS Verify this certificate against a list of root CA (list of x509 objects) It returns a set of flags defined by VERIFICATION_FLAGS Example: signer = binary.signatures[0].signers[0] microsoft_ca_bundle = lief.PE.x509.parse(\"bundle.pem\") print(signer.cert.is_trusted_by(microsoft_ca_bundle)) issuer property issuer → str | bytes Issuer of the certificate key_type property key_type → lief.PE.x509.KEY_TYPES Return the underlying public-key scheme ( KEY_TYPES ) key_usage property key_usage → list[ lief.PE.x509.KEY_USAGE ] Purpose of the key contained in the certificate (see KEY_USAGE ) parse parse( *args ) → list[ lief.PE.x509 ] = raw property raw → bytes The raw bytes associated with this x509 cert (DER encoded) rsa_info property rsa_info → lief.PE.RsaInfo | None If the underlying public-key scheme is RSA, return the RsaInfo associated with this certificate. Otherwise, return None serial_number property serial_number → bytes Unique id for certificate issued by a specific CA. signature property signature → bytes The signature of the certificate signature_algorithm property signature_algorithm → str Signature algorithm (OID) subject property subject → str | bytes Subject of the certificate valid_from property valid_from → list[int] Start time of certificate validity valid_to property valid_to → list[int] End time of certificate validity verify verify( self , ca: lief._lief.PE.x509 ) → lief._lief.PE.x509.VERIFICATION_FLAGS Verify that this certificate has been used to trust the given x509 certificate It returns a set of flags defined by VERIFICATION_FLAGS Example: ca = lief.PE.x509.parse(\"ca.crt\")[0] signer = lief.PE.x509.parse(\"signer.crt\")[0] print(ca.verify(signer)) # lief.PE.x509.VERIFICATION_FLAGS.OK version property version → int X.509 version. (1=v1, 2=v2, 3=v3) ContentInfo lief.PE.ContentInfo class lief.PE.ContentInfo Bases: Object ContentInfo as described in the RFC 2315 ContentInfo ::= SEQUENCE { contentType ContentType, content [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL } ContentType ::= OBJECT IDENTIFIER In the case of PE signature, ContentType must be set to SPC_INDIRECT_DATA_OBJID OID: 1.3.6.1.4.1.311.2.1.4 and content is defined by the structure: SpcIndirectDataContent SpcIndirectDataContent ::= SEQUENCE { data SpcAttributeTypeAndOptionalValue, messageDigest DigestInfo } SpcAttributeTypeAndOptionalValue ::= SEQUENCE { type ObjectID, value [0] EXPLICIT ANY OPTIONAL } For PE signature, SpcAttributeTypeAndOptionalValue.type is set to SPC_PE_IMAGE_DATAOBJ (OID: 1.3.6.1.4.1.311.2.1.15 ) and the value is defined by SpcPeImageData DigestInfo ::= SEQUENCE { digestAlgorithm AlgorithmIdentifier, digest OCTETSTRING } AlgorithmIdentifier ::= SEQUENCE { algorithm ObjectID, parameters [0] EXPLICIT ANY OPTIONAL } Content class Content Bases: Object content_type property content_type → str OID of the content type. This value should match SPC_INDIRECT_DATA_OBJID copy copy( self ) → lief._lief.PE.ContentInfo.Content | None Duplicate the current instance of this object content_type property content_type → str An alias for content_type copy copy( self ) → lief._lief.PE.ContentInfo Duplicate the current instance of this object digest property digest → bytes Return the digest (authentihash) if the underlying content type is SPC_INDIRECT_DATA_OBJID . Return empty bytes otherwise. digest_algorithm property digest_algorithm → lief.PE.ALGORITHMS Return the hash algorithm used to generate the digest value property value → lief.PE.ContentInfo.Content SignerInfo lief.PE.SignerInfo class lief.PE.SignerInfo Bases: Object SignerInfo as described in the RFC 2315 #Section 9.2 SignerInfo ::= SEQUENCE { version Version, issuerAndSerialNumber IssuerAndSerialNumber, digestAlgorithm DigestAlgorithmIdentifier, authenticatedAttributes [0] IMPLICIT Attributes OPTIONAL, digestEncryptionAlgorithm DigestEncryptionAlgorithmIdentifier, encryptedDigest EncryptedDigest, unauthenticatedAttributes [1] IMPLICIT Attributes OPTIONAL } EncryptedDigest ::= OCTET STRING authenticated_attributes property authenticated_attributes → lief.PE.SignerInfo.it_const_attributes_t Return an iterator over the authenticated attributes ( Attribute ) cert property cert → lief.PE.x509 | None x509 certificate used by this signer. If it can’t be found, it returns None digest_algorithm property digest_algorithm → lief.PE.ALGORITHMS Algorithm ( ALGORITHMS ) used to hash the file. This value should match ContentInfo.digest_algorithm and Signature.digest_algorithm encrypted_digest property encrypted_digest → bytes Return the signature created by the signing certificate’s private key encryption_algorithm property encryption_algorithm → lief.PE.ALGORITHMS Return algorithm ( ALGORITHMS ) used to encrypt the digest get_attribute get_attribute( self , type: lief._lief.PE.Attribute.TYPE ) → lief._lief.PE.Attribute | None Return the authenticated or un-authenticated attribute matching the given lief.PE.SIG_ATTRIBUTE_TYPES It returns the first entry that matches the given type. If it can’t be found, it returns None get_auth_attribute get_auth_attribute( self , type: lief._lief.PE.Attribute.TYPE ) → lief._lief.PE.Attribute | None Return the authenticated attribute matching the given lief.PE.SIG_ATTRIBUTE_TYPES It returns the first entry that matches the given type. If it can’t be found, it returns None get_unauth_attribute get_unauth_attribute( self , type: lief._lief.PE.Attribute.TYPE ) → lief._lief.PE.Attribute | None Return the un-authenticated attribute matching the given lief.PE.SIG_ATTRIBUTE_TYPES It returns the first entry that matches the given type. If it can’t be found, it returns None issuer property issuer → str | bytes The X509 issuer used to sign the signed-data (see: lief.PE.x509.issuer ) serial_number property serial_number → bytes The X509 serial number used to sign the signed-data (see: lief.PE.x509.serial_number ) unauthenticated_attributes property unauthenticated_attributes → lief.PE.SignerInfo.it_const_attributes_t Return an iterator over the unauthenticated attributes ( Attribute ) version property version → int Should be 1 MsCounterSign lief.PE.MsCounterSign class lief.PE.MsCounterSign Bases: Attribute This class exposes the ms-counter-signature. certificates property certificates → lief.PE.MsCounterSign.it_const_crt Return an iterator over x509 certificates content_info property content_info → lief.PE.ContentInfo digest_algorithm property digest_algorithm → lief.PE.ALGORITHMS signers property signers → lief.PE.MsCounterSign.it_const_signers_t Return an iterator over the signers ( SignerInfo ) version property version → int PKCS9TSTInfo lief.PE.PKCS9TSTInfo class lief.PE.PKCS9TSTInfo Bases: Content Interface over the structure described by the OID 1.2.840.113549.1.9.16.1.4 (PKCS #9) The internal structure is described in the RFC #3161 TSTInfo ::= SEQUENCE { version INTEGER { v1(1) }, policy TSAPolicyId, messageImprint MessageImprint, serialNumber INTEGER, genTime GeneralizedTime, accuracy Accuracy OPTIONAL, ordering BOOLEAN DEFAULT FALSE, nonce INTEGER OPTIONAL, tsa [0] GeneralName OPTIONAL, extensions [1] IMPLICIT Extensions OPTIONAL } TSAPolicyId ::= OBJECT IDENTIFIER MessageImprint ::= SEQUENCE { hashAlgorithm AlgorithmIdentifier, hashedMessage OCTET STRING } Accuracy ::= SEQUENCE { seconds INTEGER OPTIONAL, millis [0] INTEGER (1..999) OPTIONAL, micros [1] INTEGER (1..999) OPTIONAL } MsManifestBinaryID lief.PE.MsManifestBinaryID class lief.PE.MsManifestBinaryID Bases: Attribute Interface over the structure described by the OID 1.3.6.1.4.1.311.10.3.28 ( szOID_PLATFORM_MANIFEST_BINARY_ID ) The internal structure is not documented but we can infer the following structure: szOID_PLATFORM_MANIFEST_BINARY_ID ::= SET OF BinaryID BinaryID ::= UTF8STRING manifest_id property manifest_id → str The manifest id SpcRelaxedPeMarkerCheck lief.PE.SpcRelaxedPeMarkerCheck class lief.PE.SpcRelaxedPeMarkerCheck Bases: Attribute value property value → int SigningCertificateV2 lief.PE.SigningCertificateV2 class lief.PE.SigningCertificateV2 Bases: Attribute SigningCertificateV2 ::= SEQUENCE { certs SEQUENCE OF ESSCertIDv2, policies SEQUENCE OF PolicyInformation OPTIONAL } ESSCertIDv2 ::= SEQUENCE { hashAlgorithm AlgorithmIdentifier DEFAULT {algorithm id-sha256}, certHash OCTET STRING, issuerSerial IssuerSerial OPTIONAL } IssuerSerial ::= SEQUENCE { issuer GeneralNames, serialNumber CertificateSerialNumber } PolicyInformation ::= SEQUENCE { policyIdentifier OBJECT IDENTIFIER, policyQualifiers SEQUENCE SIZE (1..MAX) OF PolicyQualifierInfo OPTIONAL } Builder lief.PE.Builder class lief.PE.Builder( self , binary: lief._lief.PE.Binary , config: lief._lief.PE.Builder.config_t ) Bases: object build build( self ) → lief._lief.ok_t | lief._lief.lief_errors Perform the build process config_t class config_t( self ) Bases: object This structure is used to configure the build operation. The default value of these attributes is set to False if the operation modifies the binary layout even though nothing changed. For instance, building the import table always requires relocating the table to another place. Thus, the default value is false and must be explicitly set to true. debug property debug → bool Whether the builder should regenerate debug entries debug_section property debug_section → str Section that holds the debug entries dos_stub property dos_stub → bool Whether the builder should write back dos stub (including the rich header) export_section property export_section → str Section that holds the export table exports property exports → bool Whether the builder should reconstruct the export table This option should be turned on if you modify exports. Please check LIEF website for more details force_relocating property force_relocating → bool idata_section property idata_section → str Section that holds the relocated import table (IAT/ILT) imports property imports → bool Whether the builder should reconstruct the imports table. This option should be turned on if you modify imports. Please check LIEF website for more details load_configuration property load_configuration → bool Whether the builder should regenerate the load configuration overlay property overlay → bool Whether the builder should write back any overlay data reloc_section property reloc_section → str Section that holds the relocated relocations relocations property relocations → bool Whether the builder should regenerate relocations resolved_iat_cbk property resolved_iat_cbk → collections.abc.Callable[[ lief.PE.Binary , lief.PE.Import , lief.PE.ImportEntry , int], None] resources property resources → bool Whether the builder should regenerate the resources tree rsrc_section property rsrc_section → str If the resources tree needs to be relocated, this attribute defines the name of the new section that contains the relocated tree. tls property tls → bool Whether the builder should regenerate the TLS info tls_section property tls_section → str Section that holds the relocated TLS info raw_bytes raw_bytes( self ) → bytes rsrc_data property rsrc_data → memoryview write write( self , output: str ) → None Write the build result into the output file Resource Node lief.PE.ResourceNode class lief.PE.ResourceNode Bases: Object Class which represents a Node in the resource tree. It is extended by lief.PE.ResourceData and lief.PE.ResourceDirectory add_child add_child( self , node: lief._lief.PE.ResourceNode ) → lief._lief.PE.ResourceNode Add a new child to the current node childs property childs → lief.PE.ResourceNode.it_childs Node’s children copy copy( self ) → lief._lief.PE.ResourceNode | None Duplicate the current instance of this object delete_childdelete_child delete_child( self , node: lief._lief.PE.ResourceNode ) → None delete_child( self , id: int ) → None Overloaded function. delete_child(self, node: lief._lief.PE.ResourceNode) -> None Delete the given ResourceNode from the current children delete_child(self, id: int) -> None Delete the ResourceNode with the given id from the current children depth property depth → int Current depth of the node in the resource tree has_name property has_name → bool True if the current node uses a name id property id → int Integer that identifies the Type, Name, or Language ID entry. is_data property is_data → bool True if the current node is a ResourceData is_directory property is_directory → bool True if the current node is a ResourceDirectory name property name → str Resource’s name parse parse( bytes: bytes , rva: int ) → lief.PE.ResourceNode | None = Resource Directory lief.PE.ResourceDirectorylief.PE.ResourceDirectory class lief.PE.ResourceDirectory( self ) class lief.PE.ResourceDirectory( self , arg: int , / ) Bases: ResourceNode Overloaded function. __init__(self) -> None Default constructor __init__(self, arg: int, /) -> None Constructor from an ID characteristics property characteristics → int Resource characteristics. This field is reserved for future use. It is currently set to zero. major_version property major_version → int The major version number, set by the user. minor_version property minor_version → int The minor version number, set by the user. numberof_id_entries property numberof_id_entries → int The number of directory entries immediately following the Name entries that use numeric IDs for Type, Name, or Language entries. numberof_name_entries property numberof_name_entries → int The number of directory entries immediately following the table that use strings to identify Type, Name, or Language entries (depending on the level of the table time_date_stamp property time_date_stamp → int The time that the resource data was created by the resource compiler. Resource Data lief.PE.ResourceDatalief.PE.ResourceData class lief.PE.ResourceData( self ) class lief.PE.ResourceData( self , content: collections.abc.Sequence[int] , code_page: int = 0 ) Bases: ResourceNode Class which represents a Data Node in the PE resources tree Overloaded function. __init__(self) -> None Default constructor __init__(self, content: collections.abc.Sequence[int], code_page: int = 0) -> None code_page property code_page → int Return the code page that is used to decode code point values within the resource data. Typically, the code page is the Unicode code page. content property content → memoryview Resource content offset property offset → int Offset of the content within the resource Warning This value can change when re-building the resource table reserved property reserved → int Reserved value. Should be 0 Resources Manager lief.PE.ResourcesManager class lief.PE.ResourcesManager( self , node: lief._lief.PE.ResourceNode ) Bases: Object The Resource Manager provides an enhanced API to manipulate the resource tree TYPE class TYPE( *values ) Bases: Enum ACCELERATOR ACCELERATOR = 9 ANICURSOR ANICURSOR = 21 ANIICON ANIICON = 22 BITMAP BITMAP = 2 CURSOR CURSOR = 1 DIALOG DIALOG = 5 DLGINCLUDE DLGINCLUDE = 17 FONT FONT = 8 FONTDIR FONTDIR = 7 GROUP_CURSOR GROUP_CURSOR = 12 GROUP_ICON GROUP_ICON = 14 HTML HTML = 23 ICON ICON = 3 MANIFEST MANIFEST = 24 MENU MENU = 4 MESSAGETABLE MESSAGETABLE = 11 PLUGPLAY PLUGPLAY = 19 RCDATA RCDATA = 10 STRING STRING = 6 VERSION VERSION = 16 VXD VXD = 20 from_value from_value( arg: int ) → lief.PE.ResourcesManager.TYPE = accelerator property accelerator → lief.PE.ResourcesManager.it_const_accelerators Return list of ResourceAccelerator present in the resource add_icon add_icon( self , icon: lief._lief.PE.ResourceIcon ) → None Add an icon to the resources change_icon change_icon( self , old_one: lief._lief.PE.ResourceIcon , new_one: lief._lief.PE.ResourceIcon ) → None Switch the given icons dialogs property dialogs → lief.PE.ResourcesManager.it_const_dialogs Return the list of the ResourceDialog present in the resource get_node_type get_node_type( self , type: lief._lief.PE.ResourcesManager.TYPE ) → lief._lief.PE.ResourceNode | None Return ResourceNode with the given TYPE or None if not found. has_accelerator property has_accelerator → bool True if resources contain ResourceAccelerator has_dialogs property has_dialogs → bool True if the resources contain ResourceDialog has_html property has_html → bool True if resources contain HTML resource has_icons property has_icons → bool True if the resources contain ResourceIcon has_manifest property has_manifest → bool True if the resources contain a Manifest element has_string_table property has_string_table → bool True if resources contain ResourceStringTable has_type has_type( self , type: lief._lief.PE.ResourcesManager.TYPE ) → bool True if the resource has the given TYPE has_version property has_version → bool True if the resources contain a ResourceVersion html property html → list[str] HTML resource as the list of string icons property icons → lief.PE.ResourcesManager.it_const_icons Return the list of the ResourceIcon present in the resource manifest property manifest → str | bytes Manifest as a string print print( self , max_depth: int = 0 ) → str Print the current resource tree string_entry_t class string_entry_t Bases: object id property id → int string property string → str string_table property string_table → list[ lief.PE.ResourcesManager.string_entry_t ] Return the list of the strings embedded in the string table ( RT_STRING ) types property types → list[ lief.PE.ResourcesManager.TYPE ] Return list of TYPE present in the resources version property version → list[ lief.PE.ResourceVersion ] Return a list of version info ( VS_VERSIONINFO ). Resource Icon lief.PE.ResourceIcon class lief.PE.ResourceIcon Bases: Object bit_count property bit_count → int Bits per pixel color_count property color_count → int Number of colors in image (0 if >=8bpp) from_serialization from_serialization( arg: bytes ) → lief.PE.ResourceIcon | lief.lief_errors = height property height → int Height in pixels of the image id property id → int Id associated with the icon lang property lang → int Language associated with the icon pixels property pixels → memoryview planes property planes → int Color Planes reserved property reserved → int Reserved (must be 0) save save( self , filepath: str ) → None Save the icon to the given filepath serialize serialize( self ) → bytes Serialize the current icon into bytes sublang property sublang → int Sublanguage associated with the icon width property width → int Width in pixels of the image Resource Dialog lief.PE.ResourceDialog class lief.PE.ResourceDialog Bases: Object This class is the base class for either a regular (legacy) Dialog or an extended Dialog. These different kinds of Dialogs are documented by MS at the following addresses: https://learn.microsoft.com/en-us/windows/win32/api/winuser/ns-winuser-dlgtemplate https://learn.microsoft.com/fr-fr/windows/win32/dlgbox/dlgitemtemplateex CONTROL_STYLES class CONTROL_STYLES( *values ) Bases: Flag From: https://learn.microsoft.com/en-us/windows/win32/controls/common-control-styles ADJUSTABLE ADJUSTABLE = 32 BOTTOM BOTTOM = 3 LEFT LEFT = 129 NODIVIDER NODIVIDER = 64 NOMOVEX NOMOVEX = 130 NOMOVEY NOMOVEY = 2 NOPARENTALIGN NOPARENTALIGN = 8 NORESIZE NORESIZE = 4 RIGHT RIGHT = 131 TOP TOP = 1 VERT VERT = 128 from_value from_value( arg: int ) → lief.PE.ResourceDialog.CONTROL_STYLES = DIALOG_STYLES class DIALOG_STYLES( *values ) Bases: Flag From: https://learn.microsoft.com/en-us/windows/win32/dlgbox/dialog-box-styles ABSALIGN ABSALIGN = 1 CENTER CENTER = 2048 CENTERMOUSE CENTERMOUSE = 4096 CONTEXTHELP CONTEXTHELP = 8192 CONTROL CONTROL = 1024 FIXEDSYS FIXEDSYS = 8 LOCALEDIT LOCALEDIT = 32 MODALFRAME MODALFRAME = 128 NOFAILCREATE NOFAILCREATE = 16 NOIDLEMSG NOIDLEMSG = 256 S3DLOOK S3DLOOK = 4 SETFONT SETFONT = 64 SETFOREGROUND SETFOREGROUND = 512 SHELLFONT SHELLFONT = 72 SYSMODAL SYSMODAL = 2 from_value from_value( arg: int ) → lief.PE.ResourceDialog.DIALOG_STYLES = Item class Item Bases: object clazz property clazz → int | str | None Window class of the control. This can be either: a string that specifies the name of a registered window class or an ordinal value of a predefined system class. control_styles property control_styles → list[ lief.PE.ResourceDialog.CONTROL_STYLES ] List of CONTROL_STYLES used by this item creation_data property creation_data → memoryview Creation data that is passed to the control’s window procedure cx property cx → int The width, in dialog box units, of the control. cy property cy → int The height, in dialog box units, of the control. extended_style property extended_style → int The extended styles for a window. This member is not used to create controls in dialog boxes, but applications that use dialog box templates can use it to create other types of windows. It can take a combination of WINDOW_EXTENDED_STYLES hashas has( self , style: lief._lief.PE.ResourceDialog.WINDOW_STYLES ) → bool has( self , style: lief._lief.PE.ResourceDialog.CONTROL_STYLES ) → bool Overloaded function. has(self, style: lief._lief.PE.ResourceDialog.WINDOW_STYLES) -> bool Check if this item has the given WINDOW_STYLES has(self, style: lief._lief.PE.ResourceDialog.CONTROL_STYLES) -> bool Check if this item has the given CONTROL_STYLES id property id → int The control identifier. style property style → int The style of the control. This can be a combination of WINDOW_STYLES or CONTROL_STYLES . title property title → int | str | None Title of the item which can be either: a string that specifies the initial text or an ordinal value of a resource, such as an icon, in an executable file window_styles property window_styles → list[ lief.PE.ResourceDialog.WINDOW_STYLES ] List of WINDOW_STYLES used by this item x property x → int The x-coordinate, in dialog box units, of the upper-left corner of the control. This coordinate is always relative to the upper-left corner of the dialog box’s client area. y property y → int The y-coordinate, in dialog box units, of the upper-left corner of the control. This coordinate is always relative to the upper-left corner of the dialog box’s client area. TYPE class TYPE( *values ) Bases: Enum Enum for discriminating the kind of the Dialog (regular vs extended) EXTENDED EXTENDED = 2 REGULAR REGULAR = 1 UNKNOWN UNKNOWN = 0 WINDOW_EXTENDED_STYLES class WINDOW_EXTENDED_STYLES( *values ) Bases: Flag From: https://docs.microsoft.com/en-us/windows/win32/winmsg/extended-window-styles ACCEPTFILES ACCEPTFILES = 16 APPWINDOW APPWINDOW = 262144 CLIENTEDGE CLIENTEDGE = 512 CONTEXTHELP CONTEXTHELP = 1024 CONTROLPARENT CONTROLPARENT = 65536 DLGMODALFRAME DLGMODALFRAME = 1 LEFT LEFT = 0 LEFTSCROLLBAR LEFTSCROLLBAR = 16384 MDICHILD MDICHILD = 64 NOPARENTNOTIFY NOPARENTNOTIFY = 4 RIGHT RIGHT = 4096 RTLREADING RTLREADING = 8192 STATICEDGE STATICEDGE = 131072 TOOLWINDOW TOOLWINDOW = 128 TOPMOST TOPMOST = 8 TRANSPARENT_STY TRANSPARENT_STY = 32 WINDOWEDGE WINDOWEDGE = 256 from_value from_value( arg: int ) → lief.PE.ResourceDialog.WINDOW_EXTENDED_STYLES = WINDOW_STYLES class WINDOW_STYLES( *values ) Bases: Flag From: https://docs.microsoft.com/en-us/windows/win32/winmsg/window-styles BORDER BORDER = 8388608 CAPTION CAPTION = 12582912 CHILD CHILD = 1073741824 CLIPCHILDREN CLIPCHILDREN = 33554432 CLIPSIBLINGS CLIPSIBLINGS = 67108864 DISABLED DISABLED = 134217728 DLGFRAME DLGFRAME = 4194304 GROUP GROUP = 131072 HSCROLL HSCROLL = 1048576 MAXIMIZE MAXIMIZE = 16777216 MINIMIZE MINIMIZE = 536870912 OVERLAPPED OVERLAPPED = 0 POPUP POPUP = 2147483648 SYSMENU SYSMENU = 524288 TABSTOP TABSTOP = 65536 THICKFRAME THICKFRAME = 262144 VISIBLE VISIBLE = 268435456 VSCROLL VSCROLL = 2097152 from_value from_value( arg: int ) → lief.PE.ResourceDialog.WINDOW_STYLES = copy copy( self ) → lief._lief.PE.ResourceDialog | None Duplicate the current instance of this object cx property cx → int The width, in dialog box units, of the dialog box. cy property cy → int The height, in dialog box units, of the dialog box extended_style property extended_style → int The extended styles for a window. This member is not used to create dialog boxes, but applications that use dialog box templates can use it to create other types of windows. For a list of values, see WINDOW_EXTENDED_STYLES hashashas has( self , arg: lief._lief.PE.ResourceDialog.DIALOG_STYLES , / ) → bool **has( self , arg: lief._lief.PE.ResourceDialog.WINDOW_STYLES , / ) → bool has( self , arg: lief._lief.PE.ResourceDialog.WINDOW_EXTENDED_STYLES , / ) → bool ** Overloaded function. has(self, arg: lief._lief.PE.ResourceDialog.DIALOG_STYLES, /) -> bool Check if the dialog uses the given dialog style has(self, arg: lief._lief.PE.ResourceDialog.WINDOW_STYLES, /) -> bool Check if the dialog uses the given window style has(self, arg: lief._lief.PE.ResourceDialog.WINDOW_EXTENDED_STYLES, /) -> bool Check if the dialog uses the given extended window style menu property menu → int | str | None ordinal or name value of a menu resource style property style → int The style of the dialog box. This member can be a combination of window style values (such as CAPTION and SYSMENU ) and dialog box style values (such as CENTER ). styles_list property styles_list → list[ lief.PE.ResourceDialog.DIALOG_STYLES ] List of DIALOG_STYLES used by this dialog title property title → str title of the dialog box type property type → lief.PE.ResourceDialog.TYPE window_class property window_class → int | str | None ordinal of a predefined system window class or name of a registered window class windows_ext_styles_list property windows_ext_styles_list → list[ lief.PE.ResourceDialog.WINDOW_EXTENDED_STYLES ] List of WINDOW_EXTENDED_STYLES used by this dialog windows_styles_list property windows_styles_list → list[ lief.PE.ResourceDialog.WINDOW_STYLES ] List of WINDOW_STYLES used by this dialog x property x → int The x-coordinate, in dialog box units, of the upper-left corner of the dialog box. y property y → int The y-coordinate, in dialog box units, of the upper-left corner of the dialog box. Resource Dialog – Regular lief.PE.ResourceDialogRegular class lief.PE.ResourceDialogRegular( self ) Bases: ResourceDialog Implementation for a regular/legacy dialog box. See: https://learn.microsoft.com/en-us/windows/win32/api/winuser/ns-winuser-dlgtemplate Item class Item( self ) Bases: Item This class represents a DLGTEMPLATE item ( DLGITEMTEMPLATE ) See: https://learn.microsoft.com/en-us/windows/win32/api/winuser/ns-winuser-dlgitemtemplate add_item add_item( self , item: lief._lief.PE.ResourceDialogRegular.Item ) → None Add a new control item to the dialog font property font → lief.PE.ResourceDialogRegular.font_t Additional font information font_t class font_t Bases: object This structure represents additional font information that might be embedded at the end of the DLGTEMPLATE stream name property name → str point_size property point_size → int items property items → lief.PE.ResourceDialogRegular.it_items Iterator over the different control items nb_items property nb_items → int Number of control items Resource Dialog – Extended lief.PE.ResourceDialogExtended class lief.PE.ResourceDialogExtended( self ) Bases: ResourceDialog Implementation for the new extended dialogbox format. See: https://learn.microsoft.com/en-us/windows/win32/dlgbox/dlgtemplateex Item class Item( self ) Bases: Item This class represents a DLGTEMPLATEEX item ( DLGITEMTEMPLATEEX ). See: https://learn.microsoft.com/en-us/windows/win32/dlgbox/dlgitemtemplateex help_id property help_id → int The help context identifier for the control. When the system sends a WM_HELP message, it passes the helpID value in the dwContextId member of the HELPINFO structure. add_item add_item( self , item: lief._lief.PE.ResourceDialogExtended.Item ) → None Add a new control item to the dialog font property font → lief.PE.ResourceDialogExtended.font_t Additional font information font_t class font_t Bases: object Font information for the font to use for the text in the dialog box and its controls charset property charset → int The character set to be used italic property italic → bool Indicates whether the font is italic point_size property point_size → int The point size of the font typeface property typeface → str The name of the typeface for the font. weight property weight → int The weight of the font help_id property help_id → int The help context identifier for the dialog box window. When the system sends a WM_HELP message, it passes the helpID value in the dwContextId member of the HELPINFO structure. items property items → lief.PE.ResourceDialogExtended.it_items Iterator over the different control items signature property signature → int Indicates whether a template is an extended dialog box template. If signature is 0xFFFF, this is an extended dialog box template. In this case, the dlgVer member specifies the template version number. version property version → int The version number of the extended dialog box template. This member must be set to 1. Resource Version lief.PE.ResourceVersion class lief.PE.ResourceVersion Bases: Object Class that represents the data associated with the RT_VERSION entry See: VS_VERSIONINFO – https://docs.microsoft.com/en-us/windows/win32/menurc/vs-versioninfo file_info property file_info → lief.PE.ResourceVersion.fixed_file_info_t Return the fixed file info ( VS_FIXEDFILEINFO ) fixed_file_info_t class fixed_file_info_t Bases: object This structure represents the VS_FIXEDFILEINFO structure defined in verrsrc.h . FILE_FLAGS class FILE_FLAGS( *values ) Bases: Enum DEBUG DEBUG = 1 INFO_INFERRED INFO_INFERRED = 16 PATCHED PATCHED = 4 PRERELEASE PRERELEASE = 2 PRIVATEBUILD PRIVATEBUILD = 8 SPECIALBUILD SPECIALBUILD = 32 FILE_TYPE class FILE_TYPE( *values ) Bases: Enum APP APP = 1 DLL DLL = 2 DRV DRV = 3 FONT FONT = 4 STATIC_LIB STATIC_LIB = 7 UNKNOWN UNKNOWN = 0 VXD VXD = 5 FILE_TYPE_DETAILS class FILE_TYPE_DETAILS( *values ) Bases: Enum DRV_COMM DRV_COMM = 8589934602 DRV_DISPLAY DRV_DISPLAY = 8589934596 DRV_INPUTMETHOD DRV_INPUTMETHOD = 8589934603 DRV_INSTALLABLE DRV_INSTALLABLE = 8589934600 DRV_KEYBOARD DRV_KEYBOARD = 8589934594 DRV_LANGUAGE DRV_LANGUAGE = 8589934595 DRV_MOUSE DRV_MOUSE = 8589934597 DRV_NETWORK DRV_NETWORK = 8589934598 DRV_PRINTER DRV_PRINTER = 8589934593 DRV_SOUND DRV_SOUND = 8589934601 DRV_SYSTEM DRV_SYSTEM = 8589934599 DRV_VERSIONED_PRINTER DRV_VERSIONED_PRINTER = 12 FONT_RASTER FONT_RASTER = 17179869185 FONT_TRUETYPE FONT_TRUETYPE = 17179869187 FONT_VECTOR FONT_VECTOR = 17179869186 UNKNOWN UNKNOWN = 0 VERSION_OS class VERSION_OS( *values ) Bases: Enum DOS_WINDOWS16 DOS_WINDOWS16 = 65537 DOS_WINDOWS32 DOS_WINDOWS32 = 65540 NT NT = 262144 NT_WINDOWS32 NT_WINDOWS32 = 262148 OS216 OS216 = 131072 OS216_PM16 OS216_PM16 = 131074 OS232 OS232 = 196608 OS232_PM32 OS232_PM32 = 196611 PM16 PM16 = 2 PM32 PM32 = 3 UNKNOWN UNKNOWN = 0 WINCE WINCE = 327680 WINDOWS16 WINDOWS16 = 1 WINDOWS32 WINDOWS32 = 4 file_date_ls property file_date_ls → int The least significant 32 bits of the file’s 64-bit binary creation date and time stamp. file_date_ms property file_date_ms → int The most significant 32 bits of the file’s 64-bit binary creation date and time stamp. file_flags property file_flags → int Contains a bitmask that specifies the Boolean attributes of the file. This member can include one or more of the values specified in FILE_FLAGS . file_flags_mask property file_flags_mask → int Contains a bitmask that specifies the valid bits in file_flags. A bit is valid only if it was defined when the file was created. file_os property file_os → int The operating system for which this file was designed. This member can be one of the values specified in VERSION_OS . file_subtype property file_subtype → int The function of the file. The possible values depend on the value of file_type. file_type property file_type → int The general type of file. This member can be one of the values specified in FILE_TYPE . All other values are reserved. file_type_details property file_type_details → lief.PE.ResourceVersion.fixed_file_info_t.FILE_TYPE_DETAILS file_version_ls property file_version_ls → int The least significant 32 bits of the file’s binary version number. This member is used with file_version_ms to form a 64-bit value used for numeric comparisons. file_version_ms property file_version_ms → int The most significant 32 bits of the file’s binary version number. This member is used with file_version_ls to form a 64-bit value used for numeric comparisons. flags property flags → list[ lief.PE.ResourceVersion.fixed_file_info_t.FILE_FLAGS ] List of flags has has( self , flag: lief._lief.PE.ResourceVersion.fixed_file_info_t.FILE_FLAGS ) → bool Check if the given flag is present product_version_ls property product_version_ls → int The least significant 32 bits of the binary version number of the product with which this file was distributed. This member is used with product_version_ms to form a 64-bit value used for numeric comparisons. product_version_ms property product_version_ms → int The most significant 32 bits of the binary version number of the product with which this file was distributed. This member is used with product_version_ls to form a 64-bit value used for numeric comparisons. signature property signature → int Contains the value 0xFEEF04BD . This is used with the szKey member of the VS_VERSIONINFO structure when searching a file for the VS_FIXEDFILEINFO structure. struct_version property struct_version → int The binary version number of this structure. The high-order word of this member contains the major version number, and the low-order word contains the minor version number. key property key → str The Unicode string L”VS_VERSION_INFO”” string_file_info property string_file_info → lief.PE.ResourceStringFileInfo | None Return the StringFileInfo element type property type → int The type of data in the version resource: * 1 if it contains text data * 0 if it contains binary data var_file_info property var_file_info → lief.PE.ResourceVarFileInfo | None Return the VarFileInfo element Resource Var File Info lief.PE.ResourceVarFileInfo class lief.PE.ResourceVarFileInfo Bases: Object Representation of the VarFileInfo structure This structure represents the organization of data in a file-version resource. It contains version information not dependent on a particular language and code page combination. See: https://learn.microsoft.com/en-us/windows/win32/menurc/varfileinfo key property key → str Signature of the structure. Must be the unicode string “VarFileInfo” type property type → int The type of data in the version resource: * 1 if it contains text data * 0 if it contains binary data vars property vars → lief.PE.ResourceVarFileInfo.it_vars Iterator over the embedded variables associated to the structure Resource String File Info lief.PE.ResourceStringFileInfo class lief.PE.ResourceStringFileInfo Bases: Object Representation of the StringFileInfo structure See: https://docs.microsoft.com/en-us/windows/win32/menurc/stringfileinfo children property children → lief.PE.ResourceStringFileInfo.it_elements Iterator over the children values key property key → str Signature of the structure. Must be the unicode string “StringFileInfo” type property type → int The type of data in the version resource: * 1 if it contains text data * 0 if it contains binary data Resource Var lief.PE.ResourceVar class lief.PE.ResourceVar Bases: object This class represents an element of the ResourceVarFileInfo structure It typically contains a list of language and code page identifier pairs that the version of the application or DLL supports. See: https://learn.microsoft.com/en-us/windows/win32/menurc/var-str key property key → str Signature of the structure. Must be the unicode string “Translation” type property type → int The type of data in the version resource: * 1 if it contains text data * 0 if it contains binary data values property values → list[int] Return the translation values. The low-order word of each uint32_t must contain a Microsoft language identifier, and the high-order word must contain the IBM code page number. Either high-order or low-order word can be zero, indicating that the file is language or code page independent Resource String Table lief.PE.ResourceStringTable class lief.PE.ResourceStringTable Bases: Object This class represents the StringTable structure. This structure can be seen as a dictionary of key, values with key and values defined as utf-16 strings. entries property entries → lief.PE.ResourceStringTable.it_entries Iterator over the different entry_t in this table entry_t class entry_t Bases: object An entry in this table which is composed of an UTF-16 key and an UTF-16 value. key property key → str value property value → str get get( self , key: str ) → str | None key property key → str An 8-digit hexadecimal number stored as a Unicode string. The four most significant digits represent the language identifier. The four least significant digits represent the code page for which the data is formatted. Each Microsoft Standard Language identifier contains two parts: the low-order 10 bits specify the major language, and the high-order 6 bits specify the sublanguage. type property type → int The type of data in the version resource: * 1 if it contains text data * 0 if it contains binary data Resource Accelerator lief.PE.ResourceAccelerator class lief.PE.ResourceAccelerator Bases: Object FLAGS class FLAGS( *values ) Bases: Flag From: https://docs.microsoft.com/en-us/windows/win32/menurc/acceltableentry ALT ALT = 16 CONTROL CONTROL = 8 END END = 128 NOINVERT NOINVERT = 2 SHIFT SHIFT = 4 VIRTKEY VIRTKEY = 1 from_value from_value( arg: int ) → lief.PE.ResourceAccelerator.FLAGS = add add( self , arg: lief._lief.PE.ResourceAccelerator.FLAGS , / ) → lief._lief.PE.ResourceAccelerator Append the given flag ansi property ansi → int An ANSI character value or a virtual-key code that identifies the accelerator key. ansi_str property ansi_str → str flags property flags → int Describe the keyboard accelerator characteristics. has has( self , arg: lief._lief.PE.ResourceAccelerator.FLAGS , / ) → bool Whether the entry has the given flag id property id → int An identifier for the keyboard accelerator. padding property padding → int The number of bytes inserted to ensure that the structure is aligned on a DWORD boundary. remove remove( self , arg: lief._lief.PE.ResourceAccelerator.FLAGS , / ) → lief._lief.PE.ResourceAccelerator Remove the given flag Rich Header lief.PE.RichHeader class lief.PE.RichHeader( self ) Bases: Object Class which represents the not-so-documented rich header This structure is usually located at the end of the dos_stub and contains information about the build environment. It is generated by the Microsoft linker link.exe and there are no options to disable or remove this information. add_entryadd_entry add_entry( self , entry: lief._lief.PE.RichEntry ) → None add_entry( self , id: int , build_id: int , count: int ) → None Overloaded function. add_entry(self, entry: lief._lief.PE.RichEntry) -> None Add a new RichEntry add_entry(self, id: int, build_id: int, count: int) -> None Add a new RichEntry given its id , build_id , count copy copy( self ) → lief._lief.PE.RichHeader Duplicate the current instance of this object entries property entries → lief.PE.RichHeader.it_entries Return an iterator over the RichEntry within the header hashhash hash( self , algo: lief._lief.PE.ALGORITHMS ) → list[int] hash( self , algo: lief._lief.PE.ALGORITHMS , xor_key: int ) → list[int] Overloaded function. hash(self, algo: lief._lief.PE.ALGORITHMS) -> list[int] Compute the hash of the decoded rich header structure with the given hash ALGORITHMS hash(self, algo: lief._lief.PE.ALGORITHMS, xor_key: int) -> list[int] Compute the hash of the rich header structure encoded with the provided key and the given hash ALGORITHMS key property key → int Key used to encode the header (xor operation) rawraw raw( self ) → list[int] raw( self , xor_key: int ) → list[int] Overloaded function. raw(self) -> list[int] The raw structure of the Rich header without xor-encoding. This function is equivalent as calling the other raw function with a xor_key set to 0 raw(self, xor_key: int) -> list[int] Given this rich header, this function re-computes the raw bytes of the structure with the provided xor-key. You can access the decoded data’s structure with the xor_key set to 0 Rich Entry lief.PE.RichEntrylief.PE.RichEntry class lief.PE.RichEntry( self ) class lief.PE.RichEntry( self , id: int , build_id: int , count: int ) Bases: Object Class which represents an entry associated to the RichHeader Overloaded function. __init__(self) -> None __init__(self, id: int, build_id: int, count: int) -> None Constructor from id , build_id and count build_id property build_id → int Builder number of the tool (if any) copy copy( self ) → lief._lief.PE.RichEntry Duplicate the current instance of this object count property count → int Occurrence count id property id → int Type of the entry Debug lief.PE.Debug class lief.PE.Debug( self ) Bases: Object This class represents a generic entry in the debug data directory. For known types, this class is extended to provide a dedicated API (see: CodeView ) TYPES class TYPES( *values ) Bases: Enum The entry types BORLAND BORLAND = 9 CLSID CLSID = 11 CODEVIEW CODEVIEW = 2 COFF COFF = 1 EXCEPTION EXCEPTION = 5 EX_DLLCHARACTERISTICS EX_DLLCHARACTERISTICS = 20 FIXUP FIXUP = 6 FPO FPO = 3 ILTCG ILTCG = 14 MISC MISC = 4 MPX MPX = 15 OMAP_FROM_SRC OMAP_FROM_SRC = 8 OMAP_TO_SRC OMAP_TO_SRC = 7 PDBCHECKSUM PDBCHECKSUM = 19 POGO POGO = 13 REPRO REPRO = 16 RESERVED10 RESERVED10 = 10 UNKNOWN UNKNOWN = 0 VC_FEATURE VC_FEATURE = 12 from_value from_value( arg: int ) → lief.PE.Debug.TYPES = addressof_rawdata property addressof_rawdata → int Address of the debug data relative to the image base characteristics property characteristics → int Reserved should be 0 copy copy( self ) → lief._lief.PE.Debug | None Duplicate the current instance of this object major_version property major_version → int The major version number of the debug data format. minor_version property minor_version → int The minor version number of the debug data format. payload property payload → memoryview Debug data associated with this entry pointerto_rawdata property pointerto_rawdata → int File offset of the debug data section property section → lief.PE.Section | None The section where debug data is located sizeof_data property sizeof_data → int Size of the debug data timestamp property timestamp → int The time and date when the debug data was created. type property type → lief.PE.Debug.TYPES The format ( TYPES ) of the debugging information Code View lief.PE.CodeViewlief.PE.CodeView class lief.PE.CodeView( self ) class lief.PE.CodeView( self , arg: lief._lief.PE.CodeView.SIGNATURES , / ) Bases: Debug SIGNATURES class SIGNATURES( *values ) Bases: Enum CV_41 CV_41 = 959464014 CV_50 CV_50 = 825311822 PDB_20 PDB_20 = 808534606 PDB_70 PDB_70 = 1396986706 UNKNOWN UNKNOWN = 0 from_value from_value( arg: int ) → lief.PE.CodeView.SIGNATURES = cv_signature property cv_signature → lief.PE.CodeView.SIGNATURES Type of the code view ( SIGNATURES ) Code View PDB lief.PE.CodeViewPDBlief.PE.CodeViewPDB class lief.PE.CodeViewPDB( self ) class lief.PE.CodeViewPDB( self , filename: str ) Bases: CodeView CodeView PDB specialization Overloaded function. __init__(self) -> None Default constructor __init__(self, filename: str) -> None Filename-based constructor age property age → int Age value to verify. The age does not necessarily correspond to any known time value, it is used to determine if a .pdb file is out of sync with a corresponding .exe file. filename property filename → str | bytes The path to the .pdb file guid property guid → str The GUID signature to verify against the .pdb file signature. This attribute might be used to lookup remote PDB file on a symbol server parent property parent → lief.PE.CodeView Return a reference to the parent lief.PE.CodeView signature property signature → list[int] The 32-bit signature to verify against the .pdb file signature. Code Integrity lief.PE.CodeIntegrity class lief.PE.CodeIntegrity( self ) Bases: Object catalog property catalog → int 0xFFFF means not available catalog_offset property catalog_offset → int flags property flags → int Flags to indicate if CI information is available, etc. reserved property reserved → int Additional bitmask to be defined later Pogo lief.PE.Pogo class lief.PE.Pogo( self ) Bases: Debug SIGNATURES class SIGNATURES( *values ) Bases: Enum LCTG LCTG = 1280590663 PGI PGI = 1346849024 PGO PGO = 1346850560 PGU PGU = 1346852096 SPGO SPGO = 1397770063 UNKNOWN UNKNOWN = 268435455 ZERO ZERO = 0 from_value from_value( arg: int ) → lief.PE.Pogo.SIGNATURES = entries property entries → lief.PE.Pogo.it_entries signature property signature → lief.PE.Pogo.SIGNATURES Type of the pogo ( SIGNATURES ) Pogo Entry lief.PE.PogoEntry class lief.PE.PogoEntry( self ) Bases: Object copy copy( self ) → lief._lief.PE.PogoEntry Duplicate the current instance of this object name property name → str | bytes size property size → int start_rva property start_rva → int Repro lief.PE.Repro class lief.PE.Repro Bases: Debug This class represents a reproducible build entry from the debug directory. ( IMAGE_DEBUG_TYPE_REPRO ). This entry is usually generated with the undocumented /Brepro linker flag. See: https://nikhilism.com/post/2020/windows-deterministic-builds/ hash property hash → memoryview The hash associated with the reproducible build PDBChecksum lief.PE.PDBChecksum class lief.PE.PDBChecksum( self , algo: lief._lief.PE.PDBChecksum.HASH_ALGO , hash: collections.abc.Sequence[int] ) Bases: Debug This class represents the PDB Checksum debug entry which is essentially an array of bytes representing the checksum of the PDB content. HASH_ALGO class HASH_ALGO( *values ) Bases: Enum SHA256 SHA256 = 1 UNKNOWN UNKNOWN = 0 algorithm property algorithm → lief.PE.PDBChecksum.HASH_ALGO Algorithm used for hashing the PDB content hash property hash → memoryview Hash of the PDB content VCFeature lief.PE.VCFeature class lief.PE.VCFeature Bases: Debug This class represents the IMAGE_DEBUG_TYPE_VC_FEATURE debug entry c_cpp property c_cpp → int Count for C/C++ gs property gs → int Count for /GS (number of guard stack) guards property guards → int Count for /guardN pre_vcpp property pre_vcpp → int Count for Pre-VC++ 11.00 sdl property sdl → int Whether /sdl was enabled for this binary. sdl stands for Security Development Lifecycle and provides enhanced security features like changing security-relevant warnings into errors or enforcing guard stack. ExDllCharacteristics lief.PE.ExDllCharacteristics class lief.PE.ExDllCharacteristics Bases: Debug This class represents the IMAGE_DEBUG_TYPE_EX_DLLCHARACTERISTICS debug entry CHARACTERISTICS class CHARACTERISTICS( *values ) Bases: Flag Extended DLL Characteristics CET_COMPAT CET_COMPAT = 1 CET_COMPAT_STRICT_MODE CET_COMPAT_STRICT_MODE = 2 CET_DYNAMIC_APIS_ALLOW_IN_PROC CET_DYNAMIC_APIS_ALLOW_IN_PROC = 8 CET_RESERVED_1 CET_RESERVED_1 = 16 CET_RESERVED_2 CET_RESERVED_2 = 32 CET_SET_CONTEXT_IP_VALIDATION_RELAXED_MODE CET_SET_CONTEXT_IP_VALIDATION_RELAXED_MODE = 4 FORWARD_CFI_COMPAT FORWARD_CFI_COMPAT = 64 HOTPATCH_COMPATIBLE HOTPATCH_COMPATIBLE = 128 from_value from_value( arg: int ) → lief.PE.ExDllCharacteristics.CHARACTERISTICS = ex_characteristics property ex_characteristics → lief.PE.ExDllCharacteristics.CHARACTERISTICS The extended characteristics ex_characteristics_list property ex_characteristics_list → list[ lief.PE.ExDllCharacteristics.CHARACTERISTICS ] Characteristics as a vector has has( self , characteristic: lief._lief.PE.ExDllCharacteristics.CHARACTERISTICS ) → bool Check if the given CHARACTERISTICS is used Frame Pointer Omission (FPO) lief.PE.FPO class lief.PE.FPO Bases: Debug This class represents the IMAGE_DEBUG_TYPE_FPO debug entry FRAME_TYPE class FRAME_TYPE( *values ) Bases: Enum FPO_ FPO_ = 0 NON_FPO NON_FPO = 3 TRAP TRAP = 1 TSS TSS = 2 from_value from_value( arg: int ) → lief.PE.FPO.FRAME_TYPE = entries property entries → lief.PE.FPO.it_entries Iterator over the different FPO entries entry_t class entry_t Bases: object Represents the stack frame layout for a x86 function when frame pointer omission (FPO) optimization is used. nb_locals property nb_locals → int The number of local variables. nb_saved_regs property nb_saved_regs → int Number of registers saved. parameters_size property parameters_size → int The size of the parameters. proc_size property proc_size → int The number of bytes in the function. prolog_size property prolog_size → int The number of bytes in the function prolog code. reserved property reserved → int reserved for future use rva property rva → int The function RVA type property type → lief.PE.FPO.FRAME_TYPE Variable that indicates the frame type. use_bp property use_bp → bool Whether the EBP register has been allocated. use_seh property use_seh → bool Whether the function uses structured exception handling. Exception Info lief.PE.ExceptionInfo class lief.PE.ExceptionInfo Bases: object This class is the base class for any exception or runtime function entry ARCH class ARCH( *values ) Bases: Enum Arch discriminator for the subclasses ARM64 ARM64 = 1 UNKNOWN UNKNOWN = 0 X86_64 X86_64 = 2 arch property arch → lief.PE.ExceptionInfo.ARCH Target architecture of this exception copy copy( self ) → lief._lief.PE.ExceptionInfo | None Duplicate the current instance of this object offset property offset → int Offset in the binary where the raw exception information associated with this entry is defined rva_start property rva_start → int Function start address RuntimeFunctionX64 lief.PE.RuntimeFunctionX64 class lief.PE.RuntimeFunctionX64 Bases: ExceptionInfo This class represents an entry in the exception table ( .pdata section) for the x86-64 architecture. Reference: https://learn.microsoft.com/en-us/cpp/build/exception-handling-x64 UNWIND_FLAGS class UNWIND_FLAGS( *values ) Bases: Flag CHAIN_INFO CHAIN_INFO = 4 EXCEPTION_HANDLER EXCEPTION_HANDLER = 1 TERMINATE_HANDLER TERMINATE_HANDLER = 2 from_value from_value( arg: int ) → lief.PE.RuntimeFunctionX64.UNWIND_FLAGS = UNWIND_OPCODES class UNWIND_OPCODES( *values ) Bases: Enum ALLOC_LARGE ALLOC_LARGE = 1 ALLOC_SMALL ALLOC_SMALL = 2 EPILOG EPILOG = 6 PUSH_MACHFRAME PUSH_MACHFRAME = 10 PUSH_NONVOL PUSH_NONVOL = 0 SAVE_NONVOL SAVE_NONVOL = 4 SAVE_NONVOL_FAR SAVE_NONVOL_FAR = 5 SAVE_XMM128 SAVE_XMM128 = 8 SAVE_XMM128_FAR SAVE_XMM128_FAR = 9 SET_FPREG SET_FPREG = 3 SPARE SPARE = 7 from_value from_value( arg: int ) → lief.PE.RuntimeFunctionX64.UNWIND_OPCODES = UNWIND_REG class UNWIND_REG( *values ) Bases: Enum R10 R10 = 10 R11 R11 = 11 R12 R12 = 12 R13 R13 = 13 R14 R14 = 14 R15 R15 = 15 R8 R8 = 8 R9 R9 = 9 RAX RAX = 0 RBP RBP = 5 RBX RBX = 3 RCX RCX = 1 RDI RDI = 7 RDX RDX = 2 RSI RSI = 6 RSP RSP = 4 from_value from_value( arg: int ) → lief.PE.RuntimeFunctionX64.UNWIND_REG = rva_end property rva_end → int Function end address size property size → int Size of the function (in bytes) unwind_info property unwind_info → lief.PE.RuntimeFunctionX64.unwind_info_t | None Detailed unwind information unwind_info_t class unwind_info_t Bases: object chained property chained → lief.PE.RuntimeFunctionX64 If lief.PE.RuntimeFunctionX64.UNWIND_FLAGS.CHAIN_INFO is set, this attribute references the chained runtime function. count_opcodes property count_opcodes → int The number of slots in the unwind codes array. Some unwind codes, for example, lief.PE.RuntimeFunctionX64.UNWIND_OPCODES.SAVE_NONVOL , require more than one slot in the array. flags property flags → int See: lief.PE.RuntimeFunctionX64.UNWIND_FLAGS frame_reg property frame_reg → int If nonzero, then the function uses a frame pointer (FP), and this field is the number of the nonvolatile register used as the frame pointer, using the same encoding for the operation info field of UNWIND_OPCODES node frame_reg_offset property frame_reg_offset → int If the frame register field is nonzero, this field is the scaled offset from RSP that is applied to the FP register when it’s established handler property handler → int | None An image-relative pointer to either the function’s language-specific exception or termination handler. This value is set if one of these flags is set: lief.PE.RuntimeFunctionX64.UNWIND_FLAGS.EXCEPTION_HANDLER , lief.PE.RuntimeFunctionX64.UNWIND_FLAGS.TERMINATE_HANDLER . has has( self , arg: lief._lief.PE.RuntimeFunctionX64.UNWIND_FLAGS , / ) → bool Check if the given flag is used opcodes property opcodes → list[ lief.PE.unwind_x64.Code | None] Enhanced representation of the unwind code raw_opcodes property raw_opcodes → list[int] An array of items that explains the effect of the prolog on the nonvolatile registers and RSP sizeof_prologue property sizeof_prologue → int Length of the function prolog in bytes. version property version → int Version number of the unwind data, currently 1 or 2. unwind_rva property unwind_rva → int Unwind info address unwind_x64 - Code lief.PE.unwind_x64.Code class lief.PE.unwind_x64.Code Bases: object Base class for all unwind operations opcode property opcode → lief.PE.RuntimeFunctionX64.UNWIND_OPCODES The original opcode position property position → int Offset in the prolog unwind_x64 - Alloc lief.PE.unwind_x64.Alloc class lief.PE.unwind_x64.Alloc Bases: Code This class represents a stack-allocation operation ( lief.PE.RuntimeFunctionX64.UNWIND_OPCODES.ALLOC_SMALL , lief.PE.RuntimeFunctionX64.UNWIND_OPCODES.ALLOC_LARGE ) size property size → int The size allocated unwind_x64 - PushNonVol lief.PE.unwind_x64.PushNonVol class lief.PE.unwind_x64.PushNonVol Bases: Code Push a nonvolatile integer register, decrementing RSP by 8 reg property reg → lief.PE.RuntimeFunctionX64.UNWIND_REG The register pushed unwind_x64 - PushMachFrame lief.PE.unwind_x64.PushMachFrame class lief.PE.unwind_x64.PushMachFrame Bases: Code Push a machine frame value property value → int 0 or 1 unwind_x64 - SetFPReg lief.PE.unwind_x64.SetFPReg class lief.PE.unwind_x64.SetFPReg Bases: Code Establish the frame pointer register by setting the register to some offset of the current RSP reg property reg → lief.PE.RuntimeFunctionX64.UNWIND_REG Frame pointer register unwind_x64 - SaveNonVolatile lief.PE.unwind_x64.SaveNonVolatile class lief.PE.unwind_x64.SaveNonVolatile Bases: Code Save a nonvolatile integer register on the stack using a MOV instead of a PUSH. offset property offset → int The offset where to save the register reg property reg → lief.PE.RuntimeFunctionX64.UNWIND_REG The register to save unwind_x64 - SaveXMM128 lief.PE.unwind_x64.SaveXMM128 class lief.PE.unwind_x64.SaveXMM128 Bases: Code Save all 128 bits of a nonvolatile XMM register on the stack num property num → int XMM register number offset property offset → int The offset where to save the register unwind_x64 - Epilog lief.PE.unwind_x64.Epilog class lief.PE.unwind_x64.Epilog Bases: Code Describes the function’s epilog flags property flags → int size property size → int Size of the epilog unwind_x64 - Spare lief.PE.unwind_x64.Spare class lief.PE.unwind_x64.Spare Bases: Code RuntimeFunctionAArch64 lief.PE.RuntimeFunctionAArch64 class lief.PE.RuntimeFunctionAArch64 Bases: ExceptionInfo This class represents an entry in the exception table ( .pdata section) for the AArch64 architecture. Since the ARM64 unwinding info can be encoded in a packed and unpacked format, this class is inherited by lief.PE.unwind_aarch64.PackedFunction and lief.PE.unwind_aarch64.UnpackedFunction Reference: https://learn.microsoft.com/en-us/cpp/build/arm64-exception-handling#arm64-exception-handling-information PACKED_FLAGS class PACKED_FLAGS( *values ) Bases: Enum PACKED PACKED = 1 PACKED_FRAGMENT PACKED_FRAGMENT = 2 RESERVED RESERVED = 3 UNPACKED UNPACKED = 0 flag property flag → lief.PE.RuntimeFunctionAArch64.PACKED_FLAGS Flag describing the format the unwind data length property length → int Length of the function in bytes rva_end property rva_end → int Function end address Runtime AArch64 (Packed) Function lief.PE.unwind_aarch64.PackedFunction class lief.PE.unwind_aarch64.PackedFunction Bases: RuntimeFunctionAArch64 This class represents a packed AArch64 exception entry. An exception entry can be packed if the unwind data fit in 30 bits Reference: https://learn.microsoft.com/en-us/cpp/build/arm64-exception-handling?view=msvc-170#packed-unwind-data CR property CR → int Flag indicating whether the function includes extra instructions to set up a frame chain and return link. H property H → int 1-bit flag indicating whether the function homes the integer parameter registers (x0-x7) by storing them at the very start of the function. (0 = doesn’t home registers, 1 = homes registers). frame_size property frame_size → int Size of the allocated stack reg_F property reg_F → int Number of non-volatile FP registers (d8-d15) saved in the canonical stack location reg_I property reg_I → int Number of non-volatile INT registers (x19-x28) saved in the canonical stack location. Runtime AArch64 (UnpackedFunction) Function lief.PE.unwind_aarch64.UnpackedFunction class lief.PE.unwind_aarch64.UnpackedFunction Bases: RuntimeFunctionAArch64 This class represents an unpacked AArch64 exception entry Reference: https://learn.microsoft.com/en-us/cpp/build/arm64-exception-handling?view=msvc-170#xdata-records E property E → int 1-bit field that indicates that information describing a single epilog is packed into the header (1) rather than requiring more scope words later (0). X property X → int 1-bit field that indicates the presence (1) or absence (0) of exception data. code_words property code_words → int Number of 32-bit words needed to contain all of the unwind codes epilog_count property epilog_count → int If E == 0 , specifies the count of the total number of epilog scopes. Otherwise, return 0. epilog_offset property epilog_offset → int If E() == 1 , index of the first unwind code that describes the one and only epilog. epilog_scope_t class epilog_scope_t Bases: object This structure describes an epilog scope. reserved property reserved → int Reserved for future expansion. Should be 0. start_index property start_index → int Byte index of the first unwind code that describes this epilog start_offset property start_offset → int Offset of the epilog relative to the start of the function epilog_scopes property epilog_scopes → lief.PE.unwind_aarch64.UnpackedFunction.it_epilog_scopes Iterator over the epilog scopes exception_handler property exception_handler → int Exception handler RVA (if any) is_extended property is_extended → bool Whether it uses 2-words encoding unwind_code property unwind_code → memoryview Bytes that contain unwind codes version property version → int Describes the version of the remaining .xdata . Currently (2025-01-04), only version 0 is defined, so values of 1-3 aren’t permitted. xdata_rva property xdata_rva → int RVA where this unpacked data is located (usually pointing in .xdata ) Load Configuration lief.PE.LoadConfiguration class lief.PE.LoadConfiguration Bases: Object This class represents the load configuration data associated with the IMAGE_LOAD_CONFIG_DIRECTORY . This structure is frequently updated by Microsoft to add new metadata. Reference: https://github.com/MicrosoftDocs/sdk-api/blob/cbeab4d371e8bc7e352c4d3a4c5819caa08c6a1c/sdk-api-src/content/winnt/ns-winnt-image_load_config_directory64.md#L2 IMAGE_GUARD class IMAGE_GUARD( *values ) Bases: Flag CASTGUARD_PRESENT CASTGUARD_PRESENT = 16777216 CFW_INSTRUMENTED CFW_INSTRUMENTED = 512 CF_ENABLE_EXPORT_SUPPRESSION CF_ENABLE_EXPORT_SUPPRESSION = 32768 CF_EXPORT_SUPPRESSION_INFO_PRESENT CF_EXPORT_SUPPRESSION_INFO_PRESENT = 16384 CF_FUNCTION_TABLE_PRESENT CF_FUNCTION_TABLE_PRESENT = 1024 CF_INSTRUMENTED CF_INSTRUMENTED = 256 CF_LONGJUMP_TABLE_PRESENT CF_LONGJUMP_TABLE_PRESENT = 65536 DELAYLOAD_IAT_IN_ITS_OWN_SECTION DELAYLOAD_IAT_IN_ITS_OWN_SECTION = 8192 EH_CONTINUATION_TABLE_PRESENT EH_CONTINUATION_TABLE_PRESENT = 4194304 MEMCPY_PRESENT MEMCPY_PRESENT = 33554432 NONE NONE = 0 PROTECT_DELAYLOAD_IAT PROTECT_DELAYLOAD_IAT = 4096 RETPOLINE_PRESENT RETPOLINE_PRESENT = 1048576 RF_ENABLE RF_ENABLE = 262144 RF_INSTRUMENTED RF_INSTRUMENTED = 131072 RF_STRICT RF_STRICT = 524288 SECURITY_COOKIE_UNUSED SECURITY_COOKIE_UNUSED = 2048 XFG_ENABLED XFG_ENABLED = 8388608 from_value from_value( arg: int ) → lief.PE.LoadConfiguration.IMAGE_GUARD = cast_guard_os_determined_failure_mode property cast_guard_os_determined_failure_mode → int | None characteristics property characteristics → int Characteristics of the structure which is defined by its size chpe_metadata property chpe_metadata → lief.PE.CHPEMetadata | None Compiled Hybrid Portable Executable (CHPE) metadata (if any) chpe_metadata_pointer property chpe_metadata_pointer → int | None VA to the extra Compiled Hybrid Portable Executable (CHPE) metadata. code_integrity property code_integrity → lief.PE.CodeIntegrity | None Code integrity information. copy copy( self ) → lief._lief.PE.LoadConfiguration Duplicate the current instance of this object critical_section_default_timeout property critical_section_default_timeout → int The critical section default time-out value. csd_version property csd_version → int The service pack version. decommit_free_block_threshold property decommit_free_block_threshold → int The size of the minimum block that must be freed before it is freed (de-committed), in bytes. This value is advisory. decommit_total_free_threshold property decommit_total_free_threshold → int The size of the minimum total memory that must be freed in the process heap before it is freed (de-committed), in bytes. This value is advisory. dependent_load_flags property dependent_load_flags → int Alias for reserved1 . The default load flags used when the operating system resolves the statically linked imports of a module. For more information, see LoadLibraryEx . dynamic_relocations property dynamic_relocations → lief.PE.LoadConfiguration.it_dynamic_relocations_t dynamic_value_reloc_table property dynamic_value_reloc_table → int | None VA pointing to a IMAGE_DYNAMIC_RELOCATION_TABLE dynamic_value_reloctable_offset property dynamic_value_reloctable_offset → int | None Offset of dynamic relocation table relative to the relocation table dynamic_value_reloctable_section property dynamic_value_reloctable_section → int | None The section index of the dynamic value relocation table editlist property editlist → int Reserved for use by the system. enclave_config property enclave_config → lief.PE.EnclaveConfiguration | None enclave_configuration_ptr property enclave_configuration_ptr → int | None global_flags_clear property global_flags_clear → int The global flags that control system behavior. For more information, see Gflags.exe . global_flags_set property global_flags_set → int The global flags that control system behavior. For more information, see Gflags.exe . guard_address_taken_iat_entries property guard_address_taken_iat_entries → lief.PE.LoadConfiguration.it_guard_functions List of RVA pointed by guard_address_taken_iat_entry_table guard_address_taken_iat_entry_count property guard_address_taken_iat_entry_count → int | None The count of unique RVAs in the table pointed by guard_address_taken_iat_entry_table . guard_address_taken_iat_entry_table property guard_address_taken_iat_entry_table → int | None The VA where Control Flow Guard address taken IAT table is stored. guard_cf_check_function_pointer property guard_cf_check_function_pointer → int | None The VA where Control Flow Guard check-function pointer is stored. guard_cf_dispatch_function_pointer property guard_cf_dispatch_function_pointer → int | None The VA where Control Flow Guard dispatch-function pointer is stored. guard_cf_flags_list property guard_cf_flags_list → list[ lief.PE.LoadConfiguration.IMAGE_GUARD ] List of flags guard_cf_function_count property guard_cf_function_count → int | None The count of unique RVAs in the guard_cf_function_table table. guard_cf_function_table property guard_cf_function_table → int | None The VA of the sorted table of RVAs of each Control Flow Guard function in the image. guard_cf_functions property guard_cf_functions → lief.PE.LoadConfiguration.it_guard_functions Iterator over the Control Flow Guard functions referenced by guard_cf_function_table guard_eh_continuation_count property guard_eh_continuation_count → int | None guard_eh_continuation_functions property guard_eh_continuation_functions → lief.PE.LoadConfiguration.it_guard_functions List of RVA pointed by guard_eh_continuation_table guard_eh_continuation_table property guard_eh_continuation_table → int | None guard_flags property guard_flags → int | None Control Flow Guard related flags. guard_function_t class guard_function_t Bases: object extra property extra → int rva property rva → int guard_long_jump_target_count property guard_long_jump_target_count → int | None The count of unique RVAs in the table pointed by guard_long_jump_target_table . guard_long_jump_target_table property guard_long_jump_target_table → int | None The VA where Control Flow Guard long jump target table is stored. guard_long_jump_targets property guard_long_jump_targets → lief.PE.LoadConfiguration.it_guard_functions List of RVA pointed by guard_long_jump_target_table guard_memcpy_function_pointer property guard_memcpy_function_pointer → int | None guard_rf_failure_routine property guard_rf_failure_routine → int | None VA of the failure routine guard_rf_failure_routine_function_pointer property guard_rf_failure_routine_function_pointer → int | None VA of the failure routine fptr . guard_rf_verify_stackpointer_function_pointer property guard_rf_verify_stackpointer_function_pointer → int | None VA of the Function verifying the stack pointer guard_xfg_check_function_pointer property guard_xfg_check_function_pointer → int | None guard_xfg_dispatch_function_pointer property guard_xfg_dispatch_function_pointer → int | None guard_xfg_table_dispatch_function_pointer property guard_xfg_table_dispatch_function_pointer → int | None has has( self , arg: lief._lief.PE.LoadConfiguration.IMAGE_GUARD , / ) → bool Check if the given flag is present hotpatch_table_offset property hotpatch_table_offset → int | None Offset to the hotpatch table hybrid_metadata_pointer property hybrid_metadata_pointer → int | None Alias for chpe_metadata_pointer . lock_prefix_table property lock_prefix_table → int The VA of a list of addresses where the LOCK prefix is used. These will be replaced by NOP on single-processor systems. This member is available only for x86 . major_version property major_version → int Major version maximum_allocation_size property maximum_allocation_size → int The maximum allocation size, in bytes. This member is obsolete and is used only for debugging purposes. minor_version property minor_version → int Minor version process_affinity_mask property process_affinity_mask → int The process affinity mask. For more information, see GetProcessAffinityMask . This member is available only for .exe files. process_heap_flags property process_heap_flags → int The process heap flags. For more information, see HeapCreate . reserved1 property reserved1 → int See: dependent_load_flags reserved2 property reserved2 → int | None Must be 0 reserved3 property reserved3 → int | None se_handler_count property se_handler_count → int | None The count of unique handlers in the table. This member is available only for x86. se_handler_table property se_handler_table → int | None The VA of the sorted table of RVAs of each valid, unique handler in the image. This member is available only for x86. security_cookie property security_cookie → int A pointer to a cookie that is used by Visual C++ or GS implementation. seh_functions property seh_functions → list[int] Return the list of the function RVA in the SEH table (if any) size property size → int Size of the current structure timedatestamp property timedatestamp → int The date and time stamp value uma_function_pointers property uma_function_pointers → int | None virtual_memory_threshold property virtual_memory_threshold → int The maximum block size that can be allocated from heap segments, in bytes. volatile_metadata property volatile_metadata → lief.PE.VolatileMetadata | None volatile_metadata_pointer property volatile_metadata_pointer → int | None CHPEMetadata lief.PE.CHPEMetadata class lief.PE.CHPEMetadata Bases: object Base class for any Compiled Hybrid Portable Executable (CHPE) metadata. This class is inherited by architecture-specific implementation. KIND class KIND( *values ) Bases: Enum Discriminator for the subclasses ARM64 ARM64 = 1 UNKNOWN UNKNOWN = 0 X86 X86 = 2 copy copy( self ) → lief._lief.PE.CHPEMetadata | None Duplicate the current instance of this object kind property kind → lief.PE.CHPEMetadata.KIND Determine the type of the concrete implementation version property version → int Version of the structure CHPEMetadata (ARM64) lief.PE.CHPEMetadataARM64 class lief.PE.CHPEMetadataARM64 Bases: CHPEMetadata This class represents ARM64-specific metadata used in CHPE (Compatible Hybrid PE) binaries, particularly for hybrid architectures like ARM64EC and ARM64X. It extends the CHPEMetadata base class and provides access to metadata describing code ranges, redirections, entry points, and other hybrid-specific information relevant for binary analysis. alternate_entry_point property alternate_entry_point → int auxiliary_delay_import property auxiliary_delay_import → int auxiliary_delay_import_copy property auxiliary_delay_import_copy → int auxiliary_iat property auxiliary_iat → int auxiliary_iat_copy property auxiliary_iat_copy → int bitfield_info property bitfield_info → int code_map property code_map → int code_map_count property code_map_count → int code_range_entry_point property code_range_entry_point → lief.PE.CHPEMetadataARM64.it_code_range_entry_point code_range_entry_point_t class code_range_entry_point_t Bases: object Mirror of IMAGE_ARM64EC_CODE_RANGE_ENTRY_POINT: Represents a mapping between code range and its entry point. end_rva property end_rva → int End of the code range (RVA). entrypoint property entrypoint → int RVA of the entry point for this range. start_rva property start_rva → int Start of the code range. code_ranges property code_ranges → lief.PE.CHPEMetadataARM64.it_range_entries code_ranges_to_entry_points_count property code_ranges_to_entry_points_count → int code_ranges_to_entrypoints property code_ranges_to_entrypoints → int extra_rfe_table property extra_rfe_table → int extra_rfe_table_size property extra_rfe_table_size → int get_x64_information_function_pointer property get_x64_information_function_pointer → int os_arm64x_dispatch_call property os_arm64x_dispatch_call → int os_arm64x_dispatch_call_no_redirect property os_arm64x_dispatch_call_no_redirect → int os_arm64x_dispatch_fptr property os_arm64x_dispatch_fptr → int os_arm64x_dispatch_icall property os_arm64x_dispatch_icall → int os_arm64x_dispatch_icall_cfg property os_arm64x_dispatch_icall_cfg → int os_arm64x_dispatch_ret property os_arm64x_dispatch_ret → int range_entry_t class range_entry_t Bases: object Structure that describes architecture-specific ranges TYPE class TYPE( *values ) Bases: Enum AMD64 AMD64 = 2 ARM64 ARM64 = 0 ARM64EC ARM64EC = 1 end property end → int End of the range (RVA) length property length → int Range’s length start property start → int Start of the range (RVA) start_offset property start_offset → int Raw data (includes start RVA and type) type property type → lief.PE.CHPEMetadataARM64.range_entry_t.TYPE Architecture for this range redirection_entry_t class redirection_entry_t Bases: object Structure that describes a redirection dst property dst → int src property src → int redirection_metadata property redirection_metadata → int redirection_metadata_count property redirection_metadata_count → int redirections property redirections → lief.PE.CHPEMetadataARM64.it_redirection_entries set_x64_information_function_pointer property set_x64_information_function_pointer → int CHPEMetadata (X86) lief.PE.CHPEMetadataX86 class lief.PE.CHPEMetadataX86 Bases: CHPEMetadata This class represents hybrid metadata for X86. chpe_code_address_range_count property chpe_code_address_range_count → int chpe_code_address_range_offset property chpe_code_address_range_offset → int compiler_iat_pointer property compiler_iat_pointer → int | None wowa64_dispatch_call_function_pointer property wowa64_dispatch_call_function_pointer → int wowa64_dispatch_indirect_call_cfg_function_pointer property wowa64_dispatch_indirect_call_cfg_function_pointer → int wowa64_dispatch_indirect_call_function_pointer property wowa64_dispatch_indirect_call_function_pointer → int wowa64_dispatch_jump_function_pointer property wowa64_dispatch_jump_function_pointer → int wowa64_dispatch_ret_function_pointer property wowa64_dispatch_ret_function_pointer → int wowa64_dispatch_ret_leaf_function_pointer property wowa64_dispatch_ret_leaf_function_pointer → int wowa64_exception_handler_function_pointer property wowa64_exception_handler_function_pointer → int wowa64_rdtsc_function_pointer property wowa64_rdtsc_function_pointer → int | None DynamicRelocation lief.PE.DynamicRelocation class lief.PE.DynamicRelocation Bases: object This is the base class for any IMAGE_DYNAMIC_RELOCATION32 , IMAGE_DYNAMIC_RELOCATION32_V2 , IMAGE_DYNAMIC_RELOCATION64 , IMAGE_DYNAMIC_RELOCATION64_V2 dynamic relocations. IMAGE_DYNAMIC_RELOCATION class IMAGE_DYNAMIC_RELOCATION( *values ) Bases: Enum Special symbol values as defined in link.exe - GetDVRTSpecialSymbolName RELOCATION_ARM64X RELOCATION_ARM64X = 6 RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER = 8 RELOCATION_FUNCTION_OVERRIDE RELOCATION_FUNCTION_OVERRIDE = 7 RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER = 3 RELOCATION_GUARD_INDIR_CONTROL_TRANSFER RELOCATION_GUARD_INDIR_CONTROL_TRANSFER = 4 RELOCATION_GUARD_RF_EPILOGUE RELOCATION_GUARD_RF_EPILOGUE = 2 RELOCATION_GUARD_RF_PROLOGUE RELOCATION_GUARD_RF_PROLOGUE = 1 RELOCATION_GUARD_SWITCHTABLE_BRANCH RELOCATION_GUARD_SWITCHTABLE_BRANCH = 5 from_value from_value( arg: int ) → lief.PE.DynamicRelocation.IMAGE_DYNAMIC_RELOCATION = copy copy( self ) → lief._lief.PE.DynamicRelocation | None Duplicate the current instance of this object fixups property fixups → lief.PE.DynamicFixup | None Return fixups information, where the interpretation may depend on the symbol’s value symbol property symbol → int Symbol address. Some values have a special meaning (c.f. IMAGE_DYNAMIC_RELOCATION ) and define how fixups are encoded. version property version → int Version of the structure DynamicRelocationV1 lief.PE.DynamicRelocationV1 class lief.PE.DynamicRelocationV1 Bases: DynamicRelocation This class represents a dynamic relocation ( IMAGE_DYNAMIC_RELOCATION32 or IMAGE_DYNAMIC_RELOCATION64 ). DynamicRelocationV2 lief.PE.DynamicRelocationV2 class lief.PE.DynamicRelocationV2 Bases: DynamicRelocation This class represents a dynamic relocation ( IMAGE_DYNAMIC_RELOCATION64_V2 or IMAGE_DYNAMIC_RELOCATION32_V2 ) DynamicFixup lief.PE.DynamicFixup class lief.PE.DynamicFixup Bases: object This is the base class for any fixups located in DynamicRelocation KIND class KIND( *values ) Bases: Enum ARM64X ARM64X = 2 ARM64_KERNEL_IMPORT_CALL_TRANSFER ARM64_KERNEL_IMPORT_CALL_TRANSFER = 4 FUNCTION_OVERRIDE FUNCTION_OVERRIDE = 3 GENERIC GENERIC = 1 UNKNOWN UNKNOWN = 0 from_value from_value( arg: int ) → lief.PE.DynamicFixup.KIND = copy copy( self ) → lief._lief.PE.DynamicFixup | None Duplicate the current instance of this object kind property kind → lief.PE.DynamicFixup.KIND Encoding of the fixups DynamicFixupControlTransfer lief.PE.DynamicFixupControlTransfer class lief.PE.DynamicFixupControlTransfer Bases: DynamicFixup This class wraps fixups associated with the (special) symbol value: IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER (3) . NO_IAT_INDEX NO_IAT_INDEX = 32767 reloc_entry_t class reloc_entry_t Bases: object Mirror IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION iat_index property iat_index → int IAT index of the corresponding import. 0x7FFF is a special value indicating no index. is_call property is_call → bool True if target instruction is a call , false otherwise rva property rva → int RVA to the instruction relocations property relocations → lief.PE.DynamicFixupControlTransfer.it_relocations Iterator over the relocations DynamicFixupARM64Kernel lief.PE.DynamicFixupARM64Kernel class lief.PE.DynamicFixupARM64Kernel Bases: DynamicFixup This class wraps fixups associated with the (special) symbol value: IMAGE_DYNAMIC_RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER (8) . IMPORT_TYPE class IMPORT_TYPE( *values ) Bases: Enum DELAYED DELAYED = 1 STATIC STATIC = 0 NO_IAT_INDEX NO_IAT_INDEX = 32767 reloc_entry_t class reloc_entry_t Bases: object Mirror IMAGE_IMPORT_CONTROL_TRANSFER_ARM64_RELOCATION iat_index property iat_index → int IAT index of the corresponding import. 0x7FFF is a special value indicating no index. import_type property import_type → lief.PE.DynamicFixupARM64Kernel.IMPORT_TYPE See: IMPORT_TYPE indirect_call property indirect_call → bool True if target instruction is a blr , false if it’s a br . register_index property register_index → int Register index used for the indirect call/jump. For instance, if the instruction is br x3 , this index is set to 3 rva property rva → int RVA to the call instruction relocations property relocations → lief.PE.DynamicFixupARM64Kernel.it_relocations Iterator over the relocations DynamicFixupARM64X lief.PE.DynamicFixupARM64X class lief.PE.DynamicFixupARM64X Bases: DynamicFixup This class represents IMAGE_DYNAMIC_RELOCATION_ARM64X FIXUP_TYPE class FIXUP_TYPE( *values ) Bases: Enum DELTA DELTA = 2 VALUE VALUE = 1 ZEROFILL ZEROFILL = 0 from_value from_value( arg: int ) → lief.PE.DynamicFixupARM64X.FIXUP_TYPE = reloc_entry_t class reloc_entry_t Bases: object raw_bytes property raw_bytes → list[int] If the type is class:~.FIXUP_TYPE.VALUE, the bytes associated with the fixup. rva property rva → int RVA where the fixup takes place size property size → int Size of the value to patch type property type → lief.PE.DynamicFixupARM64X.FIXUP_TYPE Fixup’s kind value property value → int If the type is class:~.FIXUP_TYPE.DELTA, the (signed) value relocations property relocations → lief.PE.DynamicFixupARM64X.it_relocations Iterator over the different fixup entries DynamicFixupGeneric lief.PE.DynamicFixupGeneric class lief.PE.DynamicFixupGeneric Bases: DynamicFixup This class represents a generic entry where the fixups are regular relocations ( lief.PE.Relocation ) relocations property relocations → lief.PE.DynamicFixupGeneric.it_relocations Iterator over the relocations DynamicFixupUnknown lief.PE.DynamicFixupUnknown class lief.PE.DynamicFixupUnknown Bases: DynamicFixup This class represents a special dynamic relocation where the format of the fixups is not supported by LIEF. payload property payload → memoryview Raw fixups FunctionOverride lief.PE.FunctionOverride class lief.PE.FunctionOverride Bases: DynamicFixup This class represents IMAGE_DYNAMIC_RELOCATION_FUNCTION_OVERRIDE bdd_info property bdd_info → lief.PE.FunctionOverride.it_bdd_info Iterator over the BDD info find_bdd_infofind_bdd_info find_bdd_info( self , arg: int , / ) → lief._lief.PE.FunctionOverride.image_bdd_info_t | None find_bdd_info( self , arg: lief._lief.PE.FunctionOverrideInfo , / ) → lief._lief.PE.FunctionOverride.image_bdd_info_t | None Overloaded function. find_bdd_info(self, arg: int, /) -> lief._lief.PE.FunctionOverride.image_bdd_info_t | None Find the IMAGE_BDD_INFO at the given offset find_bdd_info(self, arg: lief._lief.PE.FunctionOverrideInfo, /) -> lief._lief.PE.FunctionOverride.image_bdd_info_t | None Find the IMAGE_BDD_INFO associated with the given function override info func_overriding_info property func_overriding_info → lief.PE.FunctionOverride.it_func_overriding_info Iterator over the overriding info image_bdd_dynamic_relocation_t class image_bdd_dynamic_relocation_t Bases: object Mirror IMAGE_BDD_DYNAMIC_RELOCATION left property left → int right property right → int value property value → int image_bdd_info_t class image_bdd_info_t Bases: object Mirror IMAGE_BDD_INFO original_offset property original_offset → int original_size property original_size → int payload property payload → list[int] relocations property relocations → list[ lief.PE.FunctionOverride.image_bdd_dynamic_relocation_t ] version property version → int FunctionOverrideInfo lief.PE.FunctionOverrideInfo class lief.PE.FunctionOverrideInfo Bases: object base_reloc_size property base_reloc_size → int Size in bytes taken by BaseRelocs bdd_offset property bdd_offset → int Offset into the BDD region functions_rva property functions_rva → list[int] original_rva property original_rva → int RVA of original function relocations property relocations → lief.PE.DynamicFixupGeneric.it_relocations rva_size property rva_size → int Size in bytes taken by RVAs EnclaveConfiguration lief.PE.EnclaveConfiguration class lief.PE.EnclaveConfiguration Bases: object This class represents the enclave configuration enclave_flags property enclave_flags → int A flag that indicates whether the image is suitable for use as the primary image in the enclave. enclave_size property enclave_size → int The expected virtual size of the private address range for the enclave, in bytes. family_id property family_id → list[int] The family identifier that the author of the enclave assigned to the enclave. image_id property image_id → list[int] The image identifier that the author of the enclave assigned to the enclave. image_version property image_version → int The version number that the author of the enclave assigned to the enclave. import_entry_size property import_entry_size → int The size of each image in the array of images that the import_list_rva member points to. import_list_rva property import_list_rva → int The RVA of the array of images that the enclave image may import, with identity information for each image. imports property imports → lief.PE.EnclaveConfiguration.it_imports Iterator over the enclave’s imports is_debuggable property is_debuggable → bool Whether this enclave can be debugged min_required_config_size property min_required_config_size → int The minimum size of the IMAGE_ENCLAVE_CONFIG(32,64) structure that the image loader must be able to process in order for the enclave to be usable. This member allows an enclave to inform an earlier version of the image loader that the image loader can safely load the enclave and ignore optional members added to IMAGE_ENCLAVE_CONFIG(32,64) for later versions of the enclave. If the size of IMAGE_ENCLAVE_CONFIG(32,64) that the image loader can process is less than MinimumRequiredConfigSize , the enclave cannot be run securely. If MinimumRequiredConfigSize is zero, the minimum size of the IMAGE_ENCLAVE_CONFIG(32,64) structure that the image loader must be able to process in order for the enclave to be usable is assumed to be the size of the structure through and including the MinimumRequiredConfigSize member. nb_imports property nb_imports → int The number of images in the array of images that the import_list_rva member points to. nb_threads property nb_threads → int The maximum number of threads that can be created within the enclave. policy_flags property policy_flags → int A flag that indicates whether the enclave permits debugging. security_version property security_version → int The security version number that the author of the enclave assigned to the enclave. size property size → int The size of the IMAGE_ENCLAVE_CONFIG64/IMAGE_ENCLAVE_CONFIG32 structure, in bytes. EnclaveImport lief.PE.EnclaveImport class lief.PE.EnclaveImport Bases: object Defines an entry in the array of images that an enclave can import. TYPE class TYPE( *values ) Bases: Enum AUTHOR_ID AUTHOR_ID = 2 FAMILY_ID FAMILY_ID = 3 IMAGE_ID IMAGE_ID = 4 NONE NONE = 0 UNIQUE_ID UNIQUE_ID = 1 family_id property family_id → list[int] The family identifier of the primary module for the enclave. id property id → list[int] The unique identifier of the primary module for the enclave, if the type is UNIQUE_ID . Otherwise, the author identifier of the primary module for the enclave. image_id property image_id → list[int] The image identifier of the primary module for the enclave. import_name property import_name → str Resolved import name import_name_rva property import_name_rva → int The relative virtual address of a NULL-terminated string that contains the same value found in the import directory for the image. min_security_version property min_security_version → int The minimum enclave security version that each image must have for the image to be imported successfully. The image is rejected unless its enclave security version is equal to or greater than the minimum value in the import record. Set the value in the import record to zero to turn off the security version check. reserved property reserved → int Reserved. Should be 0 type property type → lief.PE.EnclaveImport.TYPE The type of identifier of the image that must match the value in the import record. Volatile Metadata lief.PE.VolatileMetadata class lief.PE.VolatileMetadata Bases: object This class represents volatile metadata which can be enabled at link time with /volatileMetadata . This metadata aims to improve performances when running x64 code on ARM64. access_table property access_table → list[int] access_table_rva property access_table_rva → int access_table_size property access_table_size → int info_range_rva property info_range_rva → int info_ranges property info_ranges → lief.PE.VolatileMetadata.it_info_ranges_t info_ranges_size property info_ranges_size → int max_version property max_version → int min_version property min_version → int range_t class range_t Bases: object end property end → int size property size → int start property start → int size property size → int Utilities lief.PE.check_layout lief.PE.check_layout( binary: lief.PE.Binary ) → tuple[bool, str] Check that the layout of the given binary is correct from the Windows loader perspective. lief.is_pelief.is_pe lief.is_pe( *args ) → bool lief.is_pe( raw: collections.abc.Sequence[int] ) → bool Overloaded function. is_pe(file: Union[str | os.PathLike]) -> bool Check if the given file is a PE is_pe(raw: collections.abc.Sequence[int]) -> bool Check if the given raw data is a PE lief.PE.get_typelief.PE.get_type lief.PE.get_type( *args ) → lief.PE.PE_TYPE | lief.lief_errors lief.PE.get_type( raw: collections.abc.Sequence[int] ) → lief._lief.PE.PE_TYPE | lief._lief.lief_errors Overloaded function. get_type(file: Union[str | os.PathLike]) -> Union[lief._lief.PE.PE_TYPE, lief._lief.lief_errors] If the input file is a valid PE , return the PE_TYPE . Otherwise, return a lief.lief_errors . get_type(raw: collections.abc.Sequence[int]) -> Union[lief._lief.PE.PE_TYPE, lief._lief.lief_errors] lief.PE.get_imphash lief.PE.get_imphash( binary: lief.PE.Binary , mode: lief.PE.IMPHASH_MODE ) → str Compute the hash of imported functions Properties of the hash generated: Order agnostic Case agnostic Ordinal ( in some extent ) agnostic If one needs the same output as Virus Total (i.e. pefile), you can use PEFILE as second parameter. Warning The algorithm used to compute the imphash value has some variations compared to Yara, pefile, VT implementation See also https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html lief.PE.IMPHASH_MODE class lief.PE.IMPHASH_MODE( *values ) Bases: Enum Enum to define the behavior of get_imphash() DEFAULT DEFAULT = 0 LIEF LIEF = 0 PEFILE PEFILE = 1 VT VT = 1 lief.PE.resolve_ordinals lief.PE.resolve_ordinals( imp: lief.PE.Import , strict: bool , use_std: bool ) → lief.PE.Import | lief.lief_errors Take a Import as input and try to resolve its ordinal imports. If the strict boolean parameter is set, a lief.lief_errors.not_found error is returned upon the first non-resolvable ordinal. Enums PE_TYPE lief.PE.PE_TYPE class lief.PE.PE_TYPE( *values ) Bases: Enum PE32 PE32 = 267 PE32_PLUS PE32_PLUS = 523 from_value from_value( arg: int ) → lief.PE.PE_TYPE = RESOURCE_LANGS lief.PE.RESOURCE_LANGS class lief.PE.RESOURCE_LANGS( *values ) Bases: Enum AFRIKAANS AFRIKAANS = 54 ALBANIAN ALBANIAN = 28 ARABIC ARABIC = 1 ARMENIAN ARMENIAN = 43 ASSAMESE ASSAMESE = 77 AZERI AZERI = 44 BANGLA BANGLA = 69 BASQUE BASQUE = 45 BELARUSIAN BELARUSIAN = 35 BOSNIAN BOSNIAN = 26 BRETON BRETON = 147 BULGARIAN BULGARIAN = 2 CATALAN CATALAN = 3 CHINESE CHINESE = 4 CORNISH CORNISH = 145 CROATIAN CROATIAN = 26 CZECH CZECH = 5 DANISH DANISH = 6 DIVEHI DIVEHI = 101 DUTCH DUTCH = 19 ENGLISH ENGLISH = 9 ESPERANTO ESPERANTO = 143 ESTONIAN ESTONIAN = 37 FAEROESE FAEROESE = 56 FARSI FARSI = 41 FINNISH FINNISH = 11 FRENCH FRENCH = 12 GAELIC GAELIC = 60 GALICIAN GALICIAN = 86 GEORGIAN GEORGIAN = 55 GERMAN GERMAN = 7 GREEK GREEK = 8 GUJARATI GUJARATI = 71 HEBREW HEBREW = 13 HINDI HINDI = 57 HUNGARIAN HUNGARIAN = 14 ICELANDIC ICELANDIC = 15 INDONESIAN INDONESIAN = 33 INUKTITUT INUKTITUT = 93 INVARIANT INVARIANT = 127 IRISH IRISH = 60 ITALIAN ITALIAN = 16 JAPANESE JAPANESE = 17 KANNADA KANNADA = 75 KASHMIRI KASHMIRI = 96 KAZAK KAZAK = 63 KONKANI KONKANI = 87 KOREAN KOREAN = 18 KYRGYZ KYRGYZ = 64 LATVIAN LATVIAN = 38 LITHUANIAN LITHUANIAN = 39 LOWER_SORBIAN LOWER_SORBIAN = 46 MACEDONIAN MACEDONIAN = 47 MALAY MALAY = 62 MALAYALAM MALAYALAM = 76 MALTESE MALTESE = 58 MANIPURI MANIPURI = 88 MAORI MAORI = 40 MARATHI MARATHI = 78 MONGOLIAN MONGOLIAN = 80 NEPALI NEPALI = 97 NEUTRAL NEUTRAL = 0 NORWEGIAN NORWEGIAN = 20 ORIYA ORIYA = 72 POLISH POLISH = 21 PORTUGUESE PORTUGUESE = 22 PULAR PULAR = 103 PUNJABI PUNJABI = 70 QUECHUA QUECHUA = 107 RHAETO_ROMANCE RHAETO_ROMANCE = 23 ROMANIAN ROMANIAN = 24 RUSSIAN RUSSIAN = 25 SAMI SAMI = 59 SANSKRIT SANSKRIT = 79 SERBIAN SERBIAN = 26 SINDHI SINDHI = 89 SLOVAK SLOVAK = 27 SLOVENIAN SLOVENIAN = 36 SORBIAN SORBIAN = 46 SPANISH SPANISH = 10 SUTU SUTU = 48 SWAHILI SWAHILI = 65 SWEDISH SWEDISH = 29 SYRIAC SYRIAC = 90 TAMAZIGHT TAMAZIGHT = 95 TAMIL TAMIL = 73 TATAR TATAR = 68 TELUGU TELUGU = 74 THAI THAI = 30 TIGRINYA TIGRINYA = 115 TSONGA TSONGA = 49 TSWANA TSWANA = 50 TURKISH TURKISH = 31 UKRAINIAN UKRAINIAN = 34 URDU URDU = 32 UZBEK UZBEK = 67 VALENCIAN VALENCIAN = 3 VENDA VENDA = 51 VIETNAMESE VIETNAMESE = 42 WALON WALON = 144 WELSH WELSH = 146 XHOSA XHOSA = 52 ZULU ZULU = 53 from_value from_value( arg: int ) → lief.PE.RESOURCE_LANGS = ACCELERATOR_CODES lief.PE.ACCELERATOR_CODES class lief.PE.ACCELERATOR_CODES( *values ) Bases: Enum A A = 65 ACCEPT ACCEPT = 30 ADD ADD = 107 APPS APPS = 93 ATTN ATTN = 246 B B = 66 BACK BACK = 8 BROWSER_BACK BROWSER_BACK = 166 BROWSER_FAVORITES BROWSER_FAVORITES = 171 BROWSER_FORWARD BROWSER_FORWARD = 167 BROWSER_HOME BROWSER_HOME = 172 BROWSER_REFRESH BROWSER_REFRESH = 168 BROWSER_SEARCH BROWSER_SEARCH = 170 BROWSER_STOP BROWSER_STOP = 169 C C = 67 CANCEL CANCEL = 3 CAPITAL CAPITAL = 20 CLEAR CLEAR = 12 CONTROL CONTROL = 17 CONVERT CONVERT = 28 CRSEL CRSEL = 247 D D = 68 DECIMAL DECIMAL = 110 DELETE_K DELETE_K = 46 DIVIDE DIVIDE = 111 DOWN DOWN = 40 E E = 69 END END = 35 EREOF EREOF = 249 ESCAPE ESCAPE = 27 EXECUTE EXECUTE = 43 EXSEL EXSEL = 248 F F = 70 F1 F1 = 112 F10 F10 = 121 F11 F11 = 122 F12 F12 = 123 F13 F13 = 124 F14 F14 = 125 F15 F15 = 126 F16 F16 = 127 F17 F17 = 128 F18 F18 = 129 F19 F19 = 130 F2 F2 = 113 F20 F20 = 131 F21 F21 = 132 F22 F22 = 133 F23 F23 = 134 F24 F24 = 135 F3 F3 = 114 F4 F4 = 115 F5 F5 = 116 F6 F6 = 117 F7 F7 = 118 F8 F8 = 119 F9 F9 = 120 FINAL FINAL = 24 G G = 71 H H = 72 HELP HELP = 47 HOME HOME = 36 I I = 73 IME_OFF IME_OFF = 26 IME_ON IME_ON = 22 INSERT INSERT = 45 J J = 74 JUNJA JUNJA = 23 K K = 75 KANA KANA = 21 KANJI KANJI = 25 L L = 76 LAUNCH_APP1 LAUNCH_APP1 = 182 LAUNCH_APP2 LAUNCH_APP2 = 183 LAUNCH_MAIL LAUNCH_MAIL = 180 LAUNCH_MEDIA_SELECT LAUNCH_MEDIA_SELECT = 181 LBUTTON LBUTTON = 1 LCONTROL LCONTROL = 162 LEFT LEFT = 37 LMENU LMENU = 164 LSHIFT LSHIFT = 160 LWIN LWIN = 91 M M = 77 MBUTTON MBUTTON = 4 MEDIA_NEXT_TRACK MEDIA_NEXT_TRACK = 176 MEDIA_PLAY_PAUSE MEDIA_PLAY_PAUSE = 179 MEDIA_PREV_TRACK MEDIA_PREV_TRACK = 177 MEDIA_STOP MEDIA_STOP = 178 MENU MENU = 18 MODECHANGE MODECHANGE = 31 MULTIPLY MULTIPLY = 106 N N = 78 NEXT NEXT = 34 NONAME NONAME = 252 NONCONVERT NONCONVERT = 29 NUMLOCK NUMLOCK = 144 NUMPAD0 NUMPAD0 = 96 NUMPAD1 NUMPAD1 = 97 NUMPAD2 NUMPAD2 = 98 NUMPAD3 NUMPAD3 = 99 NUMPAD4 NUMPAD4 = 100 NUMPAD5 NUMPAD5 = 101 NUMPAD6 NUMPAD6 = 102 NUMPAD7 NUMPAD7 = 103 NUMPAD8 NUMPAD8 = 104 NUMPAD9 NUMPAD9 = 105 NUM_0 NUM_0 = 48 NUM_1 NUM_1 = 49 NUM_2 NUM_2 = 50 NUM_3 NUM_3 = 51 NUM_4 NUM_4 = 52 NUM_5 NUM_5 = 53 NUM_6 NUM_6 = 54 NUM_7 NUM_7 = 55 NUM_8 NUM_8 = 56 NUM_9 NUM_9 = 57 O O = 79 OEM_1 OEM_1 = 186 OEM_102 OEM_102 = 226 OEM_2 OEM_2 = 191 OEM_4 OEM_4 = 219 OEM_5 OEM_5 = 220 OEM_6 OEM_6 = 221 OEM_7 OEM_7 = 222 OEM_8 OEM_8 = 223 OEM_CLEAR OEM_CLEAR = 254 OEM_COMMA OEM_COMMA = 188 OEM_MINUS OEM_MINUS = 189 OEM_PERIOD OEM_PERIOD = 190 OEM_PLUS OEM_PLUS = 187 P P = 80 PA1 PA1 = 253 PACKET PACKET = 231 PAUSE PAUSE = 19 PLAY PLAY = 250 PRINT PRINT = 42 PRIOR PRIOR = 33 PROCESSKEY PROCESSKEY = 229 Q Q = 81 R R = 82 RBUTTON RBUTTON = 2 RCONTROL RCONTROL = 163 RETURN RETURN = 13 RIGHT RIGHT = 39 RMENU RMENU = 165 RSHIFT RSHIFT = 161 RWIN RWIN = 92 S S = 83 SCROLL SCROLL = 145 SELECT SELECT = 41 SEPARATOR SEPARATOR = 108 SHIFT SHIFT = 16 SLEEP SLEEP = 95 SNAPSHOT SNAPSHOT = 44 SPACE SPACE = 32 SUBTRACT SUBTRACT = 109 T T = 84 TAB TAB = 9 U U = 85 UP UP = 38 V V = 86 VOLUME_DOWN VOLUME_DOWN = 174 VOLUME_MUTE VOLUME_MUTE = 173 VOLUME_UP VOLUME_UP = 175 W W = 87 X X = 88 XBUTTON1_K XBUTTON1_K = 5 XBUTTON2_K XBUTTON2_K = 6 Y Y = 89 Z Z = 90 ZOOM ZOOM = 251 from_value from_value( arg: int ) → lief.PE.ACCELERATOR_CODES = ALGORITHMS lief.PE.ALGORITHMS class lief.PE.ALGORITHMS( *values ) Bases: Enum EC EC = 9 MD2 MD2 = 7 MD4 MD4 = 6 MD5 MD5 = 5 MD5_RSA MD5_RSA = 10 RSA RSA = 8 SHA1_DSA SHA1_DSA = 11 SHA1_ECDSA SHA1_ECDSA = 16 SHA1_RSA SHA1_RSA = 12 SHA_1 SHA_1 = 4 SHA_256 SHA_256 = 3 SHA_256_ECDSA SHA_256_ECDSA = 17 SHA_256_RSA SHA_256_RSA = 13 SHA_384 SHA_384 = 2 SHA_384_ECDSA SHA_384_ECDSA = 18 SHA_384_RSA SHA_384_RSA = 14 SHA_512 SHA_512 = 1 SHA_512_ECDSA SHA_512_ECDSA = 19 SHA_512_RSA SHA_512_RSA = 15 UNKNOWN UNKNOWN = 0 from_value from_value( arg: int ) → lief.PE.ALGORITHMS = ", "contentHash": "576863a830cdca9641ff6aca29f1fdd18d5f9dfe6c897f8a574cc10e925a7299", "description": "PE Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "formats/pe/python", "documentID": "f5ee3f490aed9a938733d2e80f209a0ab905430aaf59a382cabd61a646248a41", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/pe/python.md", "title": "PE Python API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/formats/pe/rust.html", "content": "Rust Note Please check: lief::pe", "contentHash": "6b3331b1c71f872997248972064e1c1c9611b2509c791a65ce6e265854da3131", "description": "PE Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "formats/pe/rust", "documentID": "b2a4d0035b479928c014eb6f65106306b8ad260eaea64c7e38b3f0d805f190d2", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/formats/pe/rust.md", "title": "PE Rust API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/index.html", "content": "LIEF Documentation LIEF is a cross-platform library for parsing, inspecting, modifying, and writing executable formats. Explore guides, tutorials, and API references for ELF, PE, Mach-O, COFF, Android formats, and more in C++, Python, and Rust. Introduction Extended Version Runtime Additional Documentation Installation and Integration SDK Python Rust CMake Integration Visual Studio Integration Xcode Integration Compilation Libraries only (SDK) Python bindings Runtime features Debugging Third Party Continuous Integration CMake Options Docker Formats ELF C++ Python Rust Introduction Adding a Section/Segment Dump Analysis Advanced Parsing/Writing DWARF Support R[UN]PATH Modification Symbol Versions Mach-O C++ Python Rust Introduction Advanced Parsing/Writing Dump Analysis RPath and Library Path Modification Objective-C Support PE C++ Python Rust Imports Modification Resources Modification TLS Modification Debug Modification Exports Modification Introduction Dump Analysis Advanced Parsing/Writing PDB Support Authenticode COFF C++ Python Rust Introduction Disassembler Android OAT DEX VDEX ART API Binary Abstraction Utilities Error Handling Logging C++ Rust Runtime LIEF Extended What is LIEF Extended? Debug Information DWARF PDB Objective-C Dyld Shared Cache Disassembler Assembler Plugins Ghidra BinaryNinja Tools lief-patchelf Tutorials 01 - Parse and manipulate formats 02 - Create a PE from scratch (Deprecated) 03 - Play with ELF symbols 04 - ELF Hooking 05 - Infecting the PLT/GOT 06 - PE Hooking (Deprecated) 07 - PE Resources 08 - Transforming an ELF executable into a library 09 - How to use Frida on a non-rooted device 10 - Android formats 11 - Mach-O Modification 12 - ELF Coredump 13 - PE Authenticode Extra Information References Changelog", "contentHash": "48733290a518de52f42f74825c54090fdb51e3490843543570a40bea11ceaff5", "description": "LIEF documentation for parsing, inspecting, modifying, and writing ELF, PE, Mach-O, COFF, Android, and other executable formats in C++, Python, and Rust.", "docname": "index", "documentID": "7665567d92c0fa54e62a140e760be87689b8323be197404993d0e0842b189fb0", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/index.md", "title": "LIEF Documentation - ELF, PE, Mach-O and Binary Analysis"}, {"canonical": "https://lief.re/doc/latest/installation.html", "content": "Installation and Integration SDK For each platform supported by LIEF, the SDK packages contain: static and shared libraries headers compiled examples Nightly builds can be downloaded at: https://lief.s3-website.fr-par.scw.cloud/latest/sdk , while official releases are available on the GitHub releases page: https://github.com/lief-project/LIEF/releases . Python Nightly Python wheels are uploaded to an S3 bucket for each commit on the main branch. They can be installed using: $ pip install [--user] --index-url https://lief.s3-website.fr-par.scw.cloud/latest lief For tagged releases, the wheels are uploaded to PyPI and can be installed using: $ pip install lief You can also compile and install from source as follows: $ git clone https://github.com/lief-project/LIEF $ pip install LIEF/api/python # Or pip+git: $ pip install git+https://github.com/lief-project/LIEF.git#subdirectory=api/python For more details about the compilation options, see the Compilation section. Rust You can add LIEF as a dependency in a Rust project as follows: # For nightly build [dependencies] lief = { git = \"https://github.com/lief-project/LIEF\", branch = \"main\" } # For a tagged release [dependencies] lief = \"1.0.0\" You can find more details in the Rust API section . CMake Integration There are several ways to integrate LIEF as a dependency into another project. The following methods are listed in order of preference according to CMake best practices. These snippets show basic examples; please refer to the official CMake documentation for questions related to more complex project setups. find_package() Using CMake find_package() : # Use LIEF with 'find_package()' # ============================== # Find LIEF. If LIEF was not installed into a default system directory then # specify the following option during CMake configuration: # -DLIEF_DIR=/share/LIEF/cmake find_package(LIEF REQUIRED COMPONENTS STATIC) # COMPONENTS: - Default: STATIC To integrate this within a project: # Add our executable # ================== add_executable(HelloLIEF main.cpp) # Enable C++11 set_property(TARGET HelloLIEF PROPERTY CXX_STANDARD 17 PROPERTY CXX_STANDARD_REQUIRED ON) # Link the executable with LIEF target_link_libraries(HelloLIEF PRIVATE LIEF::LIEF) For the compilation: $ mkdir build $ cd build $ cmake -DLIEF_DIR=/lib/cmake/LIEF/ .. $ make $ HelloLIEF /bin/ls # or explorer.exe or whatever A full example is available in the examples/cmake/find_package directory. add_subdirectory() or FetchContent First, configure the options you want to use as defaults for the LIEF project: # LIEF build config. Set the default options for LIEF's project setup option(LIEF_DOC \"Build LIEF docs\" OFF) option(LIEF_PYTHON_API \"Build LIEF Python API\" OFF) option(LIEF_EXAMPLES \"Build LIEF examples\" OFF) option(LIEF_TESTS \"Build LIEF tests\" OFF) if(MSVC) set(CMAKE_MSVC_RUNTIME_LIBRARY \"MultiThreaded\" CACHE STRING \"CRT option\") endif() # If you have LIEF as a submodule in a directory, then you can add it to this Using CMake add_subdirectory() to add LIEF as a submodule from a source directory: # NOTE: This submodule does not exist for this example, but it does the same # thing as FetchContent without the download part set(vendorLIEF_submodule_dir \"${CMAKE_CURRENT_LIST_DIR}/LIEF\") if(EXISTS \"${vendorLIEF_submodule_dir}\") add_subdirectory(\"${vendorLIEF_submodule_dir}\") # Else, we'll specify how to obtain LIEF another way (downloading) else() You can also use the CMake FetchContent module to download or specify a LIEF source directory outside the current directory: # URL of the LIEF repo (Can be your fork) set(LIEF_GIT_URL \"https://github.com/lief-project/LIEF.git\") # LIEF's version to be used (can be 'main') set(LIEF_VERSION 1.0.0) include(FetchContent) FetchContent_Declare(LIEF GIT_REPOSITORY \"${LIEF_GIT_URL}\" GIT_TAG ${LIEF_VERSION} # You may specify an existing LIEF source directory if you don't want to # download. Just comment out the above ``GIT_*`` commands and uncoment the # following ``SOURCE_DIR`` line #SOURCE_DIR \"${CMAKE_CURRENT_LIST_DIR}/../../..\" ) if(${CMAKE_VERSION} VERSION_LESS \"3.14.0\") # CMake 3.11 to 3.13 needs more verbose method to make LIEF available FetchContent_GetProperties(LIEF) if(NOT LIEF_POPULATED) FetchContent_Populate(LIEF) add_subdirectory(${LIEF_SOURCE_DIR} ${LIEF_BINARY_DIR}) endif() else() # CMake 3.14+ has single function to make LIEF available (recommended) FetchContent_MakeAvailable(LIEF) endif() endif() To integrate this within a project: add_executable(HelloLIEF main.cpp) # Enable C++11 set_property(TARGET HelloLIEF PROPERTY CXX_STANDARD 17 PROPERTY CXX_STANDARD_REQUIRED ON) # Link the executable with LIEF target_link_libraries(HelloLIEF PUBLIC LIEF::LIEF) For the compilation: $ mkdir build $ cd build $ cmake .. $ make $ HelloLIEF /bin/ls # or explorer.exe or whatever A full example is available in the examples/cmake/add_subdirectory directory. External Project If you don’t want to use LIEF as a submodule, you can use CMake External Project to set up your project as a *superbuild* : cmake_minimum_required(VERSION 3.21) project(CMakeLIEF LANGUAGES NONE) include(ExternalProject) # LIEF integration as an External Project # =========================== set(LIEF_PREFIX \"${CMAKE_CURRENT_BINARY_DIR}/LIEF\") set(LIEF_INSTALL_DIR \"${LIEF_PREFIX}/install\") # URL of the LIEF repo (Can be your fork) set(LIEF_GIT_URL \"https://github.com/lief-project/LIEF.git\") # LIEF's version to be used (can be 'main') set(LIEF_VERSION 0.13.0) # LIEF compilation config set(LIEF_CMAKE_ARGS -DCMAKE_INSTALL_PREFIX= -DCMAKE_BUILD_TYPE=RelWithDebInfo -DLIEF_DOC=OFF -DLIEF_PYTHON_API=OFF -DLIEF_EXAMPLES=OFF -DLIEF_TESTS=OFF ) if(MSVC) list(APPEND ${LIEF_CMAKE_ARGS} -DCMAKE_MSVC_RUNTIME_LIBRARY=MultiThreaded) endif() ExternalProject_Add(LIEF PREFIX \"${LIEF_PREFIX}\" GIT_REPOSITORY \"${LIEF_GIT_URL}\" GIT_TAG ${LIEF_VERSION} # You may specify an existing LIEF source directory if you don't want to # download. Just comment out the above ``GIT_*`` commands and uncoment the # following ``SOURCE_DIR`` line #SOURCE_DIR \"${CMAKE_CURRENT_LIST_DIR}/../../..\" INSTALL_DIR \"${LIEF_INSTALL_DIR}\" CMAKE_ARGS ${LIEF_CMAKE_ARGS} To integrate this with a main HelloLIEF project located in a subdirectory (which looks exactly like the find_package() example shown earlier): # User project # ============ ExternalProject_Add(HelloLIEF DEPENDS LIEF SOURCE_DIR \"${CMAKE_CURRENT_LIST_DIR}/HelloLIEF\" BINARY_DIR \"${CMAKE_CURRENT_BUILD_DIR}\" INSTALL_COMMAND \"\" CMAKE_ARGS \"-DLIEF_DIR=${LIEF_INSTALL_DIR}/lib/cmake/LIEF\" -DCMAKE_BUILD_TYPE=RelWithDebInfo ) For the compilation: $ mkdir build $ cd build $ cmake .. $ make $ HelloLIEF /bin/ls # or explorer.exe or what ever A full example is available in the examples/cmake/external_project directory. Visual Studio Integration Given a pre-compiled version of the LIEF SDK (e.g., LIEF-1.0.0-win64.zip ): . ├── bin │ ├── pe_reader.exe │ └── vdex_reader.exe ├── include │ └── LIEF ├── lib │ ├── LIEF.dll │ ├── LIEF.lib │ └── pkgconfig └── share └── LIEF Add the include/ directory to the compiler search path: Configuration Properties > C/C++ > General > Additional Include Directories and include either LIEF.lib or LIEF.dll during the linking step: Configuration Properties > Linker > Input > Additional Dependencies Warning LIEF.dll is compiled with the /MD flag ( MultiThreadedDLL ), while LIEF.lib is compiled with the /MT flag ( MultiThreaded ). If this configuration is not suitable for your project, you can compile LIEF with your required runtime. Xcode Integration Similar to Visual Studio, you should configure the Xcode project to include LIEF’s include/ and lib/ directories: include/ : Build Settings > Search Paths > Header Search Paths lib/ : Build Settings > Search Paths > Library Search Paths Then, you can add libLIEF.a or libLIEF.dylib to the list of libraries to link against: Build Phases > Link Binary With Libraries", "contentHash": "b190788e5af25621e1814ba41b6a198a2025e3dd3fc0e358aeeb507a3288f401", "description": "Installation and Integration. For each platform supported by LIEF, the SDK packages contain:", "docname": "installation", "documentID": "86544ce82684f44ba6e1c8119634564567ff4f85efd32dda021ce908c47c3255", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/installation.md", "title": "Installation and Integration - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/intro.html", "content": "Introduction The purpose of this project is to provide a cross-platform library to parse, modify, and abstract the ELF , PE , and Mach-O formats. From a technical standpoint, the library is written in C++ with a C++17 public interface and exposes bindings for Python and Rust. As a result, you can use LIEF through an idiomatic API in these languages: Python import lief elf: lief.ELF.Binary | None = lief.ELF.parse(\"libc.so\") assert elf is not None for symbol in elf.symbols: print(symbol.address, symbol.name) print(elf.header) for entry in elf.dynamic_entries: if isinstance(entry, lief.ELF.DynamicEntryLibrary): entry.name = \"libhello.so\" elf.write(\"modified.elf\") C++ #include std::unique_ptr fat = LIEF::MachO::Parser::parse(\"libobjc.dylib\"); for (const LIEF::MachO::Binary& macho : *fat) { for (const LIEF::MachO::BindingInfo& binding : macho.bindings()) { std::cout << binding.address() << ' ' << binding.symbol()->name() << '\\n'; } if (macho.is_ios()) { if (const LIEF::MachO::EncryptionInfo* info = macho.encryption_info()) { std::cout << info->crypt_id() << '\\n'; } } } Rust let mut file = std::fs::File::open(path).expect(\"Can't open the file\"); if let Some(lief::Binary::PE(pe)) = lief::Binary::from(&mut file) { let rich_header = pe.rich_header().unwrap_or_else(|| { println!(\"Rich header not found!\"); process::exit(0); }); println!(\"Rich header key: 0x{:x}\", rich_header.key()); for entry in rich_header.entries() { println!( \"id: 0x{:04x} build_id: 0x{:04x} count: #{}\", entry.id(), entry.build_id(), entry.count() ); } let result = pe.verify_signature(lief::pe::signature::VerificationChecks::DEFAULT); if result == lief::pe::signature::VerificationFlags::OK { println!(\"Valid signature!\"); } else { println!(\"Signature not valid: {:?}\", result); } } The project is also dedicated to providing comprehensive documentation and maintaining strong development standards, including: A test suite with code coverage and non-regression testing Address Sanitizer checks ( ASAN ) Continuous Integration for testing and releasing packages Dockerization of various CI steps A comprehensive changelog Nightly builds To get started with LIEF’s features, you can check the documentation for specific formats: ELF , PE , or Mach-O . Integrating LIEF into your project is also straightforward: Python With pip $ pip install lief Using a requirements.txt file lief==1.0.0 C++ Compiler command line $ clang++ -lLIEF -I/include/ ... CMake find_package(LIEF) target_link_libraries(my-project LIEF::LIEF) Rust Nightly version # For nightly build [dependencies] lief = { git = \"https://github.com/lief-project/LIEF\", branch = \"main\" } Released version # For a tagged release [dependencies] lief = \"1.0.0\" You can find additional content, including release notes, on the LIEF blog : LIEF 1.0.0 release info LIEF 0.17.0 release info LIEF 0.16.0 release info LIEF 0.15.0 release info LIEF 0.14.0 release info LIEF 0.13.0 release info LIEF 0.12.0 release info LIEF 0.11.1 release info LIEF 0.11.0 release info LIEF 0.9.0 release info Additional practical examples are available in the examples/ directory. Extended Version LIEF Extended adds PDB and DWARF analysis, Objective-C metadata , Dyld shared caches , and assembly / disassembly . Runtime The optional runtime API inspects the process running LIEF: its host, loaded modules, and memory. Start with the Additional Documentation Doxygen Rust documentation: Stable: https://lief.re/doc/stable/rust/lief Nightly: https://lief-rs.s3.fr-par.scw.cloud/doc/latest/lief/index.html", "contentHash": "2ea1280e1eec00a7e974500872b42b848ff6d9fbfce1fae1fbc7a7910d383d94", "description": "Introduction. The purpose of this project is to provide a cross-platform library to parse, modify, and abstract the ELF, PE, and Mach-O formats.", "docname": "intro", "documentID": "f5fbe9a681bb8fdf775af0ba1e8def08abe388d58037dfad7b9f3296f792c800", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/intro.md", "title": "Introduction - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/plugins/binaryninja/analyzers/elf/android-jni/index.html", "content": "Android JNI This analyzer improves support for JNI functions in Android native libraries. It works by providing a BinaryNinja type library android-jni.bntl , which is placed next to the plugin’s shared library: . ├── lief-analysis-plugin-linux-x86_64.so ├── lief-dwarf-plugin-linux-x86_64.so └── typelib └── aarch64 └── android-jni.bntl This type library should be installed in one of the following locations: Linux: ~/.binaryninja/typelib/aarch64/android-jni.bntl Windows: C:\\Users\\romain\\AppData\\Roaming\\Binary Ninja\\typelib\\aarch64\\android-jni.bntl macOS: ~/Library/Application Support/Binary Ninja/typelib/aarch64/android-jni.bntl After installation, select Plugins > LIEF > Enhance Analysis . The plugin will then import all types related to Android JNI. In addition, it will automatically define the type for the JNI_OnLoad function: uint64_t JNI_OnLoad(int64_t* arg1)00401270 uint64_t x21 = _ReadMSR(tpidr_el0)00401284 int64_t var_48 = *(x21 + 0x28)0040129c int64_t* var_2d80040129c uint64_t result0040129c bool cond:10040129c 0040129c if ((*(*arg1 + 0x30))(arg1, &var_2d8, 0x10004) == 0)004012a8 int64_t* x19_1 = var_2d8004012c0 void var_e0004012c0 sub_401138(&data_400b5c, &var_e0, 0x41)004012d4 void* var_90 = &var_e00040129c else004012a0 result = 0xffffe0c0004012a0 jint JNI_OnLoad(JavaVM* vm, void* reserved)00401270 uint64_t x21 = _ReadMSR(tpidr_el0)00401284 int64_t var_48 = *(x21 + 0x28)0040129c JNIEnv* env0040129c int32_t result0040129c bool cond:10040129c 0040129c if ((*vm)->GetEnv(vm, &env, 0x10004) == 0)004012a8 JNIEnv* env_1 = env004012c0 void var_e0004012c0 sub_401138(&data_400b5c, &var_e0, 0x41)004012d4 JNINativeMethod var_900040129c else004012a0 result = -0x1f40004012a0 Functions tagged [1] with \"LIEF - Android JNI Function\" are also updated to expose the correct type in the first two arguments: int64_t Java_com_bytedance_sdk_component_embedapplog_PangleEncryptUtils_ttEncrypt(int64_t* arg1, int64_t arg2, int64_t arg3, int32_t arg4)0000108c uint64_t x26 = _ReadMSR(tpidr_el0)00001090 int64_t x8 = *(x26 + 0x28)00001094 int64_t result = 000001094 000010a8 if (arg3 != 0 && arg4 s>= 1)000010b0 int128_t v0 = *\"UK*@3oKpFlVVnads\"000010d4 __builtin_strncpy(&data_9830, \"UK*@3oKpFlVVnadsTfdA\", 0x14)000010d8 int32_t x0_1 = ss_encrypted_size(zx.q(arg4), v0)000010e4 int64_t x0_3 = malloc(zx.q(arg4))000010f0 int64_t x0_5 = malloc(sx.q(x0_1))00001114 (*(*arg1 + 0x640))(arg1, arg3, 0, zx.q(arg4), x0_3) {\"ed_size\"}00001114 00001138 if ((ss_encrypt(x0_3, zx.q(arg4), &data_9830, strlen(&data_9830), x0_5) & 0x80000000)00001138 != 0)00001190 result = 000001138 else00001154 result = (*(*arg1 + 0x580))(arg1, zx.q(x0_1))00001170 (*(*arg1 + 0x680))(arg1, result, 0, zx.q(x0_1), x0_5) {\"ptUtils_ttDecrypt\"}00001170 00001174 if (x0_3 != 0)0000117c free(x0_3)0000117c 00001180 if (x0_5 != 0)00001188 free(x0_5)00001188 000011a0 if (*(x26 + 0x28) == x8)000011c0 return result000011c0 000011c4 __stack_chk_fail()000011c4 noreturn jbyteArray Java_com_bytedance_sdk_component_embedapplog_PangleEncryptUtils_ttEncrypt(JNIEnv* env, jobject thiz, jbyteArray arg3, jsize arg4)0000108c uint64_t x26 = _ReadMSR(tpidr_el0)00001090 int64_t x8 = *(x26 + 0x28)00001094 jbyteArray result = nullptr00001094 000010a8 if (arg3 != 0 && arg4 s>= 1)000010b0 int128_t v0 = *\"UK*@3oKpFlVVnads\"000010d4 __builtin_strncpy(&data_9830, \"UK*@3oKpFlVVnadsTfdA\", 0x14)000010d8 jsize x0_1 = ss_encrypted_size(zx.q(arg4), v0)000010e4 jbyte* x0_3 = malloc(zx.q(arg4))000010f0 jbyte* x0_5 = malloc(sx.q(x0_1))00001114 (*env)->GetByteArrayRegion(env, arg3, 0, arg4, x0_3)00001114 00001138 if ((ss_encrypt(x0_3, zx.q(arg4), &data_9830, strlen(&data_9830), x0_5) & 0x80000000)00001138 != 0)00001190 result = nullptr00001138 else00001154 result = (*env)->NewByteArray(env, x0_1)00001170 (*env)->SetByteArrayRegion(env, result, 0, x0_1, x0_5)00001170 00001174 if (x0_3 != 0)0000117c free(x0_3)0000117c 00001180 if (x0_5 != 0)00001188 free(x0_5)00001188 000011a0 if (*(x26 + 0x28) == x8)000011c0 return result000011c0 000011c4 __stack_chk_fail()000011c4 noreturn [ 1 ] On a given function, right-click: Tags and Bookmarks > Add Tag ... > LIEF - Android JNI Function", "contentHash": "9fe7885d5b3cb992c2084a0709a228be4d89149e22552bc1f28c979e12c3811a", "description": "Android JNI in ELF Analyzers. This analyzer improves support for JNI functions in Android native libraries. It works by providing a BinaryNinja type library…", "docname": "plugins/binaryninja/analyzers/elf/android-jni/index", "documentID": "35ca88fafa538d0586b9ca425fa8483fba5658293083920b4bcab7be43e166b2", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/plugins/binaryninja/analyzers/elf/android-jni/index.md", "title": "Android JNI - ELF Analyzers - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/plugins/binaryninja/analyzers/elf/android-packed-relocations/index.html", "content": "Android Packed Relocations This analyzer enhances the type definition of Android-specific relocation data ( DT_ANDROID_RELA ) .rela.dyn section started {0x40a950-0x40a9b6}0040a950 41 50 53 32 0b 00 0b 08 88 b5 10 81 82 80 80 e0 APS2............0040a960 2f 00 e0 0c 81 88 80 80 a0 02 00 08 81 88 80 80 /...............0040a970 c0 03 00 08 81 88 80 80 e0 3b 00 08 81 88 80 80 .........;......0040a980 80 3b 00 08 81 88 80 80 b0 31 00 08 81 88 80 80 .;.......1......0040a990 e0 2f 00 08 81 88 80 80 b0 15 00 08 81 88 80 80 ./..............0040a9a0 c0 08 00 80 c4 00 81 82 80 80 80 3b 00 88 13 81 ...........;....0040a9b0 82 80 80 b0 15 00 .......rela.dyn section ended {0x40a950-0x40a9b6} .rela.dyn section started {0x40a950-0x40a9b6}0040a950 char format[0x4] = \"APS2\"0040a954 sleb128 nb_relocs = 0xb0040a955 sleb128 reloc_offset = 0x00040a956 sleb128 group_size = 0xb0040a957 sleb128 group_flags = 0x80040a958 sleb128 reloc_offset_0 = ...0040a95b ....rela.dyn section ended {0x40a950-0x40a9b6} Relocation Please note that the processing of these relocations is part of the Relocations analyzer.", "contentHash": "cb7bff37e494f66975247908a6f19c218f40c5fd4236ebe3015c95a53334a480", "description": "Android Packed Relocations in ELF Analyzers. This analyzer enhances the type definition of Android-specific relocation data (DT_ANDROID_RELA)", "docname": "plugins/binaryninja/analyzers/elf/android-packed-relocations/index", "documentID": "d2111340022e03750bfd6aee4f262162f500a7e73f34d4acda035f0e243c1e8b", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/plugins/binaryninja/analyzers/elf/android-packed-relocations/index.md", "title": "Android Packed Relocations - ELF Analyzers - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/plugins/binaryninja/analyzers/elf/index.html", "content": "ELF Analyzers ELF Android Packed Relocations Relative Relocations Relocations Android JNI", "contentHash": "552fe09556cc8fd65c109c47f23ba869a5849342326afa612d09cd2723245763", "description": "ELF Analyzers in BinaryNinja reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "plugins/binaryninja/analyzers/elf/index", "documentID": "c32e2b9c46805e1628a51ce8222bca085a2f6ff87f3e9df11f95129113bde207", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/plugins/binaryninja/analyzers/elf/index.md", "title": "ELF Analyzers - BinaryNinja - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/plugins/binaryninja/analyzers/elf/relative-relocations/index.html", "content": "Relative Relocations This analyzer enhances the type definition of relative relocation data ( DT_RELR ) .relr.dyn section started {0x40a9b8-0x40aa88}0040a9b8 00 00 04 00 00 00 00 00 ........0040a9c0 55 55 55 55 55 55 55 55 ab aa fe ff ff ff df c8 UUUUUUUU........0040a9d0 11 11 19 00 98 aa aa aa 55 55 55 55 55 55 55 55 ........UUUUUUUU0040a9e0 ab aa aa aa aa aa aa aa 55 55 55 55 55 55 55 55 ........UUUUUUUU0040a9f0 ab aa aa aa aa aa aa aa 55 55 55 55 55 55 55 55 ........UUUUUUUU0040aa00 ab aa aa aa aa aa aa aa 55 55 55 55 55 55 55 55 ........UUUUUUUU0040aa10 ab aa aa aa aa aa aa aa 55 55 55 55 55 55 55 55 ........UUUUUUUU0040aa20 ab aa aa aa aa aa aa ea 55 55 55 ad 8a 00 54 55 ........UUU...TU0040aa30 ab aa aa aa aa aa aa aa 55 55 d5 ff ff ff 00 00 ........UU......0040aa40 60 40 04 00 00 00 00 00 f1 42 10 80 90 18 01 00 `@.......B......0040aa50 11 21 00 50 b4 10 42 20 ff 70 fe 8c 38 00 a1 02 .!.P..B .p..8...0040aa60 01 00 00 00 00 00 00 f1 37 00 71 00 42 95 7b 0f ........7.q.B.{.0040aa70 01 00 00 a0 77 00 1f 20 1d 00 50 c9 ff 01 00 00 ....w.. ..P.....0040aa80 3d 00 00 00 00 00 00 00 =........relr.dyn section ended {0x40a9b8-0x40aa88} .relr.dyn section started {0x40a9b8-0x40aa88}0040a9b8 uintptr_t r_relr[0x1a] =0040a9b8 {0040a9b8 [0x00] = 0x00000000000400000040a9c0 [0x01] = 0x55555555555555550040a9c8 [0x02] = 0xc8dffffffffeaaab0040a9d0 [0x03] = 0xaaaaaa98001911110040a9d8 [0x04] = 0x55555555555555550040a9e0 [0x05] = 0xaaaaaaaaaaaaaaab0040a9e8 [0x06] = 0x55555555555555550040a9f0 [0x07] = 0xaaaaaaaaaaaaaaab0040a9f8 [0x08] = 0x55555555555555550040aa00 [0x09] = 0xaaaaaaaaaaaaaaab0040aa08 [0x0a] = 0x55555555555555550040aa10 .....relr.dyn section ended {0x40a9b8-0x40aa88} Relocation Please note that the processing of these relocations is part of the Relocations analyzer.", "contentHash": "d3001badfef6396d558b876dfb3cd283eb93c502d52154763c9b7545af523d53", "description": "Relative Relocations in ELF Analyzers. This analyzer enhances the type definition of relative relocation data (DT_RELR)", "docname": "plugins/binaryninja/analyzers/elf/relative-relocations/index", "documentID": "615ea66dc1631ddef98442ced26f038145f7e2b575ac26778fbf9c2d9e9aa068", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/plugins/binaryninja/analyzers/elf/relative-relocations/index.md", "title": "Relative Relocations - ELF Analyzers - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/plugins/binaryninja/analyzers/elf/relocations/index.html", "content": "Relocations This analyzer enhances support for binaries that use recent relocation formats not recognized by BinaryNinja (e.g., DT_ANDROID_RELA , DT_RELR ). For instance, here is LIEF-based processing of DT_ANDROID_RELA relocations: .fini_array section started {0x441e40-0x441e98}00441e40 void (* fini_array[0xb])() =00441e40 {00441e40 [0x0] = 0x1c02000441e48 [0x1] = 0x1c00000441e50 [0x2] = 0x2bd8000441e58 [0x3] = 0x2c78000441e60 [0x4] = 0x2ef5000441e68 [0x5] = 0x3269000441e70 [0x6] = 0x3441000441e78 [0x7] = 0x3862000441e80 [0x8] = 0x3a60000441e88 [0x9] = 0x3d43000441e90 [0xa] = 0x3d53000441e98 }.fini_array section ended {0x441e40-0x441e98}.init_array section started {0x441e98-0x441f08}00441e98 void (* init_array[0xe])() =00441e98 {00441e98 [0x0] = 0x1c30c00441ea0 [0x1] = 0x1c65000441ea8 [0x2] = 0x246f000441eb0 [0x3] = 0x284c000441eb8 [0x4] = 0x2981000441ec0 [0x5] = 0x2bd7000441ec8 [0x6] = 0x2c77000441ed0 [0x7] = 0x2ef4000441ed8 [0x8] = 0x3268000441ee0 [0x9] = 0x3440000441ee8 [0xa] = 0x3861000441ef0 [0xb] = 0x3a5f000441ef8 [0xc] = 0x3d3a000441f00 [0xd] = 0x3d4a000441f08 }.init_array section ended {0x441e98-0x441f08} .fini_array section started {0x441e40-0x441e98}00441e40 void (* fini_array[0xb])() =00441e40 {00441e40 void (* fini_array)() = __on_dlclose_late00441e48 void (* data_441e48)() = __on_dlclose00441e50 void (* data_441e50)() = fib_lookup_exit00441e58 void (* data_441e58)() = ctrl_exit00441e60 void (* data_441e60)() = addr_exit00441e68 void (* data_441e68)() = link_exit00441e70 void (* data_441e70)() = macsec_exit00441e78 void (* data_441e78)() = vlan_exit00441e80 void (* data_441e80)() = route_exit00441e88 void (* data_441e88)() = release_routing_table_names00441e90 void (* data_441e90)() = release_proto_names00441e98 }.fini_array section ended {0x441e40-0x441e98}.init_array section started {0x441e98-0x441f08}00441e98 void (* init_array[0xe])() =00441e98 {00441e98 void (* init_array)() = init_have_lse_atomics00441ea0 void (* data_441ea0)() = __init_cpu_features00441ea8 void (* data_441ea8)() = init_msg_size00441eb0 void (* data_441eb0)() = init_default_cb00441eb8 void (* data_441eb8)() = nl_debug_init00441ec0 void (* data_441ec0)() = fib_lookup_init00441ec8 void (* data_441ec8)() = ctrl_init00441ed0 void (* data_441ed0)() = addr_init00441ed8 void (* data_441ed8)() = link_init00441ee0 void (* data_441ee0)() = macsec_init00441ee8 void (* data_441ee8)() = vlan_init00441ef0 void (* data_441ef0)() = route_init00441ef8 void (* data_441ef8)() = init_routing_table_names00441f00 void (* data_441f00)() = init_proto_names00441f08 }.init_array section ended {0x441e98-0x441f08} Here is one for DT_RELR relocations: .data.rel.ro (PROGBITS) section started {0x421010-0x422310}00421020 00 00 00 00 00 00 00 00 6c 2c 01 00 00 00 00 00 ........l,......00421030 98 2c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 .,..............00421040 d4 28 01 00 00 00 00 00 fc 2a 01 00 00 00 00 00 .(.......*......00421050 fc 2a 01 00 00 00 00 00 00 2b 01 00 00 00 00 00 .*.......+......00421060 60 00 00 00 00 00 00 00 d8 ff ff ff ff ff ff ff `...............00421070 00 00 00 00 00 00 00 00 cc 2c 01 00 00 00 00 00 .........,......00421080 fc 2c 01 00 00 00 00 00 78 2b 01 00 00 00 00 00 .,......x+......00421090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .................data.rel.ro (PROGBITS) section ended {0x421010-0x422310} .data.rel.ro (PROGBITS) section started {0x421010-0x422310}00421020 void* data_421038 = 0x000421028 void* data_421028 = android::Choreographer::~Choreographer()00421030 void* data_421030 = android::Choreographer::~Choreographer()00421038 void* data_421038 = 0x000421040 void* data_421040 = android::Choreographer::dispatchVsync(int64_t, uint64_t, uint32_t)00421048 void* data_421048 = android::Choreographer::dispatchHotplug(int64_t, uint64_t, bool)00421050 void* data_421050 = android::Choreographer::dispatchHotplug(int64_t, uint64_t, bool)00421058 void* data_421058 = android::Choreographer::handleMessage(android::Message const&).data.rel.ro (PROGBITS) section ended {0x421010-0x422310} See also Android Packed Relocations Relative Relocations", "contentHash": "78a4ad0cdb3dc2ef77ca4e0aa9893e1cbdfc7c1118acd7685766ea528acbd909", "description": "Relocations in ELF Analyzers. This analyzer enhances support for binaries that use recent relocation formats not recognized by BinaryNinja (e.g.…", "docname": "plugins/binaryninja/analyzers/elf/relocations/index", "documentID": "e929c54aa22e4b2da49f0ba82466edb21fdaab095753ac0b94b6dc5a2e6895e0", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/plugins/binaryninja/analyzers/elf/relocations/index.md", "title": "Relocations - ELF Analyzers - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/plugins/binaryninja/analyzers/pe/exceptions-analyzer/index.html", "content": "Exceptions This analyzer improves the representation and underlying data of PE exceptions metadata, primarily for ARM64 and ARM64EC binaries. .pdata section started {0x140017000-0x140017d50}140017000 00 10 00 00 40 27 01 00 20 10 00 00 4c 27 01 00 ....@'.. ...L'..140017010 60 10 00 00 5c 27 01 00 80 10 00 00 6c 27 01 00 ...\\'......l'..140017020 e0 10 00 00 18 29 01 00 00 11 00 00 c0 2a 01 00 .....).......\\*..140017030 18 11 00 00 cc 2a 01 00 50 11 00 00 e4 2c 01 00 .....\\*..P....,..140017040 80 11 00 00 ec 2c 01 00 00 12 00 00 f4 2c 01 00 .....,.......,..140017050 80 12 00 00 fc 2c 01 00 00 13 00 00 04 2d 01 00 .....,.......-..140017060 80 13 00 00 0c 2d 01 00 f0 13 00 00 14 2d 01 00 .....-.......-..140017070 60 14 00 00 1c 2d 01 00 d0 14 00 00 24 2d 01 00 ....-......$-..140017080 40 15 00 00 2c 2d 01 00 b0 15 00 00 34 2d 01 00 @...,-......4-..140017090 20 16 00 00 3c 2d 01 00 90 16 00 00 44 2d 01 00 ...<-......D-..1400170a0 00 17 00 00 4c 2d 01 00 50 17 00 00 54 2d 01 00 ....L-..P...T-..1400170b0 a0 17 00 00 5c 2d 01 00 f0 17 00 00 64 2d 01 00 ....-......d-..1400170c0 40 18 00 00 6c 2d 01 00 b0 18 00 00 74 2d 01 00 @...l-......t-..1400170d0 20 19 00 00 7c 2d 01 00 90 19 00 00 84 2d 01 00 ...|-.......-..1400170e0 00 1a 00 00 8c 2d 01 00 70 1a 00 00 94 2d 01 00 .....-..p....-..1400170f0 e0 1a 00 00 9c 2d 01 00 50 1b 00 00 a4 2d 01 00 .....-..P....-..140017100 c0 1b 00 00 ac 2d 01 00 30 1c 00 00 b4 2d 01 00 .....-..0....-..140017110 a0 1c 00 00 bc 2d 01 00 10 1d 00 00 c4 2d 01 00 .....-.......-..140017120 80 1d 00 00 cc 2d 01 00 d0 1d 00 00 d4 2d 01 00 .....-.......-..140017130 20 1e 00 00 dc 2d 01 00 70 1e 00 00 e4 2d 01 00 ....-..p....-.. .pdata section started {0x140017000-0x140017d50}140017000 struct _LIEF_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY __arm64_runtime_function_entry =140017000 {140017000 uint32_t BeginAddress = 0x1000140017004 uint32_t UnwindData = 0x12740140017008 }140017008 struct _LIEF_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY __arm64_runtime_function_entry =140017008 {140017008 uint32_t BeginAddress = 0x102014001700c uint32_t UnwindData = 0x1274c140017010 }140017010 struct _LIEF_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY __arm64_runtime_function_entry =140017010 {140017010 uint32_t BeginAddress = 0x1060140017014 uint32_t UnwindData = 0x1275c140017018 }140017018 struct _LIEF_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY __arm64_runtime_function_entry =140017018 {140017018 uint32_t BeginAddress = 0x108014001701c uint32_t UnwindData = 0x1276c140017020 }140017020 struct _LIEF_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY __arm64_runtime_function_entry = .rdata section started {0x140010000-0x1400152d8}140012710 0b 00 20 08 81 e4 e3 e3 14 00 40 40 0a 00 c0 02 .. .......@@....140012720 e1 81 e6 e6 e6 e6 e7 66 89 fc e4 81 e7 4e 88 e7 .......f.....N..140012730 4c 86 e7 4a 84 e7 48 82 e7 66 89 fc e3 e3 e4 e3 L..J..H..f......140012740 06 00 40 08 05 00 80 00 01 e4 e4 00 0b 00 40 10 ..@...........@. .rdata section started {0x140010000-0x1400152d8}140012710 struct LIEF_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA __arm64_runtime_function_entry_xdata =140012710 {140012710 uint32_t HeaderData = 0x820000b140012714 }140012714 uint8_t __arm64_unwind_code[0x4] =140012714 {140012714 [0x0] = 0x81140012715 [0x1] = 0xe4140012716 [0x2] = 0xe3140012717 [0x3] = 0xe3140012718 }140012718 struct LIEF_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA __arm64_runtime_function_entry_xdata =140012718 {140012718 uint32_t HeaderData = 0x4040001414001271c }14001271c uint32_t __arm64_epilog_scopes[0x1] =14001271c {14001271c [0x0] = 0x02c0000a140012720 }140012720 uint8_t __arm64_unwind_code[0x20] =140012720 {140012720 [0x00] = 0xe1140012721 [0x01] = 0x81140012722 [0x02] = 0xe6140012723 [0x03] = 0xe6140012724 [0x04] = 0xe6140012725 [0x05] = 0xe6 [....]140012740 } Additionally, it defines functions automatically based on the metadata of exceptions. This results in a more accurate representation of the binary, as illustrated in this feature map: See also See also this blog post: https://lief.re/blog/2025-02-16-arm64ec-pe-support/#binaryninja-arm64ec-support", "contentHash": "c7e10df783f93738e065476ceca55828f9fce887d220163dcdcb59c98ec1b80b", "description": "Exceptions in PE Analyzers. This analyzer improves the representation and underlying data of PE exceptions metadata, primarily for ARM64 and ARM64EC binaries.", "docname": "plugins/binaryninja/analyzers/pe/exceptions-analyzer/index", "documentID": "9a5961c219e908b88fbf05faa2d23cb2c1ac87b64094180c92789cdc362656a3", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/plugins/binaryninja/analyzers/pe/exceptions-analyzer/index.md", "title": "Exceptions - PE Analyzers - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/plugins/binaryninja/analyzers/pe/index.html", "content": "PE Analyzers PE LoadConfiguration Exceptions", "contentHash": "8a5a93f98a11c0875ac591f1158421e70dbf787d723ab5d3ffe68427e0d6073d", "description": "PE Analyzers in BinaryNinja reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "plugins/binaryninja/analyzers/pe/index", "documentID": "b221488e4d9d8165847aad18ec12d727d0fd9d2844fb7bfdbd2be68483e0bf9f", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/plugins/binaryninja/analyzers/pe/index.md", "title": "PE Analyzers - BinaryNinja - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/plugins/binaryninja/analyzers/pe/loadconfig-analyzer/index.html", "content": "LoadConfiguration This analyzer enhances the representation and underlying data of the PE LoadConfiguration structure within BinaryNinja. 140011b20 struct Load_Configuration_Directory_Table __load_configuration_directory_table =140011b20 {140011b20 uint32_t characteristics = 0x140140011b24 uint32_t timeDateStamp = 0x0140011b28 uint16_t majorVersion = 0x0140011b2a uint16_t minorVersion = 0x0140011b2c uint32_t globalFlagsClear = 0x0140011b30 uint32_t globalFlagsSet = 0x0140011b34 uint32_t criticalSectionDefaultTimeout = 0x0140011b38 uint64_t deCommitFreeBlockThreshold = 0x0140011b40 uint64_t deCommitTotalFreeThreshold = 0x0140011b48 uint64_t lockPrefixTable = 0x0140011b50 uint64_t maximumAllocationSize = 0x0140011b58 uint64_t virtualMemoryThreshold = 0x0140011b60 uint64_t processAffinityMask = 0x0140011b68 uint32_t processHeapFlags = 0x0140011b6c uint16_t csdVersion = 0x0140011b6e uint16_t reserved = 0x0140011b70 uint64_t editList = 0x0140011b78 uint64_t securityCookie = 0x140016040140011b80 uint64_t seHandlerTable = 0x0140011b88 uint64_t seHandlerCount = 0x0140011b90 uint64_t guardCFCheckFunctionPointer = 0x140011070140011b98 uint64_t guardCFDispatchFunctionPointer = 0x140011080140011ba0 uint64_t guardCFFunctionTable = 0x0140011ba8 uint64_t guardCFFunctionCount = 0x0140011bb0 uint32_t guardFlags = 0x100140011bb4 uint16_t Flags = 0x0140011bb6 uint16_t Catalog = 0x0140011bb8 uint32_t CatalogOffset = 0x0140011bbc uint32_t Reserved = 0x0140011bc0 uint64_t guardAddressTakenIatEntryTable = 0x0140011bc8 uint64_t guardAddressTakenIatEntryCount = 0x0140011bd0 uint64_t guardLongJumpTargetTable = 0x0140011bd8 uint64_t guardLongJumpTargetCount = 0x0140011be0 uint64_t dynamicValueRelocTable = 0x0140011be8 uint64_t CHPEMetadataPointer = 0x1400111f8140011bf0 uint64_t guardRFFailureRoutine = 0x0140011bf8 uint64_t guardRFFailureRoutineFunctionPointer = 0x0140011c00 uint32_t dynamicValueRelocTableOffset = 0x0140011c04 uint16_t dynamicValueRelocTableSection = 0x0140011c06 uint16_t reserved2 = 0x0140011c08 uint64_t guardRFVerifyStackPointerFunctionPointer = 0x0140011c10 uint32_t hotPatchTableOffset = 0x0140011c14 uint32_t reserved3 = 0x0140011c18 uint64_t enclaveConfigurationPointer = 0x0140011c20 uint64_t volatileMetadataPointer = 0x0140011c28 uint64_t guardEHContinuationTable = 0x0140011c30 uint64_t guardEHContinuationCount = 0x0140011c38 uint64_t guardXFGCheckFunctionPointer = 0x140011078140011c40 uint64_t guardXFGDispatchFunctionPointer = 0x140011088140011c48 uint64_t guardXFGTableDispatchFunctionPointer = 0x140011090140011c50 } 140011b20 struct _LIEF_IMAGE_LOAD_CONFIG_DIRECTORY64 __load_configuration_directory_table =140011b20 {140011b20 uint32_t Size = 0x140140011b24 uint32_t TimeDateStamp = 0x0140011b28 uint16_t MajorVersion = 0x0140011b2a uint16_t MinorVersion = 0x0140011b2c uint32_t GlobalFlagsClear = 0x0140011b30 uint32_t GlobalFlagsSet = 0x0140011b34 uint32_t CriticalSectionDefaultTimeout = 0x0140011b38 uintptr_t DeCommitFreeBlockThreshold = 0x0140011b40 uintptr_t DeCommitTotalFreeThreshold = 0x0140011b48 void* LockPrefixTable = 0x0140011b50 uintptr_t MaximumAllocationSize = 0x0140011b58 uintptr_t VirtualMemoryThreshold = 0x0140011b60 uintptr_t ProcessHeapFlags = 0x0140011b68 uint32_t ProcessAffinityMask = 0x0140011b6c uint16_t CSDVersion = 0x0140011b6e uint16_t DependentLoadFlags = 0x0140011b70 void* EditList = 0x0140011b78 void* SecurityCookie = __security_cookie140011b80 uintptr_t* SEHandlerTable = 0x0140011b88 uintptr_t SEHandlerCount = 0x0140011b90 void (** GuardCFCheckFunctionPointer)() = __guard_check_icall_fptr140011b98 void (** GuardCFDispatchFunctionPointer)() = __guard_dispatch_icall_fptr140011ba0 uint32_t* SEHandlerTable = 0x0140011ba8 uintptr_t GuardCFFunctionCount = 0x0140011bb0 enum GuardFlags = IMAGE_GUARD_CF_INSTRUMENTED140011bb4 struct CodeIntegrity =140011bb4 {140011bb4 uint16_t Flags = 0x0140011bb6 uint16_t Catalog = 0x0140011bb8 uint32_t CatalogOffset = 0x0140011bbc uint32_t Reserved = 0x0140011bc0 }140011bc0 void* GuardAddressTakenIatEntryTable = 0x0140011bc8 uintptr_t GuardAddressTakenIatEntryCount = 0x0140011bd0 void* GuardLongJumpTargetTable = 0x0140011bd8 uintptr_t GuardLongJumpTargetCount = 0x0140011be0 void* DynamicValueRelocTable = 0x0140011be8 struct _LIEF_IMAGE_ARM64EC_METADATA_V2* const CHPEMetadataPointer = __image_arm64ec_metadata140011bf0 void (** GuardRFFailureRoutine)() = 0x0140011bf8 void (** GuardRFFailureRoutineFunctionPointer)() = 0x0140011c00 uint32_t DynamicValueRelocTableOffset = 0x0140011c04 uint16_t DynamicValueRelocTableSection = 0x0140011c06 uint16_t Reserved2 = 0x0140011c08 void (** GuardRFVerifyStackPointerFunctionPointer)() = 0x0140011c10 uint32_t HotPatchTableOffset = 0x0140011c14 uint32_t Reserved3 = 0x0140011c18 void* EnclaveConfigurationPointer = 0x0140011c20 void* VolatileMetadataPointer = 0x0140011c28 void* GuardEHContinuationTable = 0x0140011c30 void* GuardEHContinuationCount = 0x0140011c38 void (** GuardXFGCheckFunctionPointer)() = data_140011078140011c40 void (** GuardXFGDispatchFunctionPointer)() = data_140011088140011c48 void (** GuardXFGTableDispatchFunctionPointer)() = data_140011090140011c50 void (** CastGuardOsDeterminedFailureMode)() = 0x140011098140011c58 void (** GuardMemcpyFunctionPointer)() = data_1400110a0140011c60 } The layout of this structure – exposed in LIEF through the lief.PE.LoadConfiguration ( lief::pe::LoadConfiguration ; lief.PE.LoadConfiguration ; LIEF::PE::LoadConfiguration ) interface – evolves frequently across new Windows releases. By running this analyzer, you obtain a more complete and accurate representation of these attributes along with their correct data types. Beyond the Load Configuration, the analyzer also defines additional structures, such as lief.PE.CHPEMetadataARM64 ( lief::pe::chpe_metadata_arm64::CHPEMetadata ; lief.PE.CHPEMetadataARM64 ; LIEF::PE::CHPEMetadataARM64 ), which provide valuable context for analyzing ARM64EC binaries. These definitions make it easier to interpret the purpose of certain functions and pointers, leading to deeper insights during reverse engineering. 1400111e0 00 00 00 00 01 00 00 00 48 65 6c 6c 6f 20 57 6f 72 6c 64 21 0a 00 00 00 02 00 00 00 00 1e 01 00 ........Hello World!............140011200 02 00 00 00 b4 1c 01 00 00 90 01 00 00 10 01 00 08 10 01 00 18 10 01 00 10 10 01 00 20 10 01 00 ............................ ...140011220 00 00 00 00 00 50 01 00 01 00 00 00 01 00 00 00 28 10 01 00 30 10 01 00 00 70 01 00 38 0d 00 00 .....P..........(...0....p..8...140011240 38 10 01 00 48 3e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 10 01 00 48 10 01 00 50 10 01 00 8...H>..............@...H...P...140011260 58 10 01 00 60 10 01 00 68 10 01 00 00 00 00 00 X...`...h....... 1400111e8 char const data_1400111e8[0xe] = \"Hello World!\\n\", 01400111f6 00 00 ..1400111f8 struct _LIEF_IMAGE_ARM64EC_METADATA_V2 __image_arm64ec_metadata =1400111f8 {1400111f8 uint32_t Version = 0x21400111fc uint32_t CodeMap = 0x11e00140011200 uint32_t CodeMapCount = 0x2140011204 uint32_t CodeRangesToEntryPoints = 0x11cb4140011208 uint32_t RedirectionMetadata = 0x1900014001120c uint32_t __os_arm64x_dispatch_call_no_redirect = 0x11000140011210 uint32_t __os_arm64x_dispatch_ret = 0x11008140011214 uint32_t __os_arm64x_dispatch_call = 0x11018140011218 uint32_t __os_arm64x_dispatch_icall = 0x1101014001121c uint32_t __os_arm64x_dispatch_icall_cfg = 0x11020140011220 uint32_t AlternateEntryPoint = 0x0140011224 uint32_t AuxiliaryIAT = 0x15000140011228 uint32_t CodeRangesToEntryPointsCount = 0x114001122c uint32_t RedirectionMetadataCount = 0x1140011230 uint32_t GetX64InformationFunctionPointer = 0x11028140011234 uint32_t SetX64InformationFunctionPointer = 0x11030140011238 uint32_t ExtraRFETable = 0x1700014001123c uint32_t ExtraRFETableSize = 0xd38140011240 uint32_t __os_arm64x_dispatch_fptr = 0x11038140011244 uint32_t AuxiliaryIATCopy = 0x13e48140011248 uint32_t AuxDelayloadIAT = 0x014001124c uint32_t AuxDelayloadIATCopy = 0x0140011250 uint32_t ReservedBitField = 0x0140011254 }", "contentHash": "c0819ed70b02bcfdb186ab536d0a91e5ce1e683b63d56785c33c6dd14a5ac2d8", "description": "LoadConfiguration in PE Analyzers. This analyzer enhances the representation and underlying data of the PE LoadConfiguration structure within BinaryNinja.", "docname": "plugins/binaryninja/analyzers/pe/loadconfig-analyzer/index", "documentID": "6f11167a8cb160da7e9003a88d302f3b95e4e86a5834dbdaac272e9d25341860", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/plugins/binaryninja/analyzers/pe/loadconfig-analyzer/index.md", "title": "LoadConfiguration - PE Analyzers - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/plugins/binaryninja/dwarf/index.html", "content": "BinaryNinja - DWARF Plugin Export as DWARF BinaryNinja builtin plugin Binary Ninja already embeds a DWARF export plugin that exposes most of the functionality provided by this plugin. However, this plugin exports additional information, such as stack variables and basic blocks. To export DWARF information from a BinaryNinja BinaryView representation, use the menu: Plugins > LIEF > Export as DWARF Support & Limitations This extension tries to convert most of the information registered in a BinaryView into DWARF structures, but this support is not exhaustive; here is an overview of what is and is not exported. BinaryNinja::BinaryView Function Data Variables Types Comments BinaryNinja::Function Name Address range Parameters Type of parameters Return type Stack variables Types of stack variables Basic Blocks Comments BinaryNinja::DataVariable Name Type Address Comments BinaryNinja::Type BNTypeClass::VoidTypeClass BNTypeClass::BoolTypeClass BNTypeClass::IntegerTypeClass BNTypeClass::FloatTypeClass BNTypeClass::PointerTypeClass BNTypeClass::PointerTypeClass BNTypeClass::StructureTypeClass BNTypeClass::ClassStructureType BNTypeClass::UnionStructureType BNTypeClass::StructStructureType BNTypeClass::EnumerationTypeClass BNTypeClass::NamedTypeReferenceClass BNTypeClass::ArrayTypeClass BNTypeClass::WideCharTypeClass BNTypeClass::FunctionTypeClass BNTypeClass::VarArgsTypeClass BNTypeClass::ValueTypeClass Any types not mentioned here are not supported.", "contentHash": "062b297536c6442449b9f076aa2479cfa5d52ae83c991bce8c40b7fac356d6fd", "description": "BinaryNinja - DWARF Plugin. To export DWARF information from a BinaryNinja BinaryView representation, use the menu: Plugins > LIEF > Export as DWARF", "docname": "plugins/binaryninja/dwarf/index", "documentID": "51dae1e1c8f06af3d99df3dc330b381c451df9209525fb03ee5331f3ada1583e", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/plugins/binaryninja/dwarf/index.md", "title": "BinaryNinja - DWARF Plugin - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/plugins/binaryninja/index.html", "content": "BinaryNinja Similar to the Ghidra plugin , LIEF can be used as a BinaryNinja plugin. Features BinaryNinja - DWARF Plugin Export as DWARF ELF Analyzers Android Packed Relocations Relative Relocations Relocations Android JNI PE Analyzers LoadConfiguration Exceptions Downloads lief-binaryninja-plugins-5.0.7290.zip lief-binaryninja-plugins-5.0.7486.zip lief-binaryninja-plugins-5.1.8005.zip lief-binaryninja-plugins-5.1.8104.zip lief-binaryninja-plugins-5.2.8614.zip lief-binaryninja-plugins-5.2.8722.zip lief-binaryninja-plugins-5.3.9434.zip lief-binaryninja-plugins-6.0.10601.zip lief-binaryninja-plugins-dev.zip First, download the LIEF plugin package from https://lief.s3.fr-par.scw.cloud/latest/plugins/index.html or from the packages listed above. Then, follow the official procedure to install plugins: https://docs.binary.ninja/guide/plugins.html For instance, if you install the DWARF Plugin , you should have this file installed: Linux: ~/.binaryninja/plugins/lief-dwarf-plugin-linux-x86_64.so Windows: C:\\Users\\romain\\AppData\\Roaming\\Binary Ninja\\plugins\\lief-dwarf-plugin-windows-x86_64.dll macOS: ~/Library/Application Support/Binary Ninja/plugins/lief-dwarf-plugin-darwin-arm64.dylib Shared Library In addition to the previously installed library, the plugins require the installation of LIEF.dll , libLIEF.dylib , or libLIEF.so next to the plugin directory. You can download this library from the following list: SDK LIEF-1.0.0-Darwin-arm64.tar.gz LIEF-1.0.0-Darwin-x86_64.tar.gz LIEF-1.0.0-Linux-x86_64.tar.gz LIEF-1.0.0-win64.zip LIEF-2.0.0-Darwin-arm64.tar.gz LIEF-2.0.0-Darwin-x86_64.tar.gz LIEF-2.0.0-Linux-x86_64.tar.gz LIEF-2.0.0-win64.zip or from here: https://lief.s3.fr-par.scw.cloud/latest/sdk/index.html . Some plugins (like the DWARF Plugin ) require the extended version, which can be downloaded from https://extended.lief.re/ . Given this shared library, you must copy it into the plugin directory (or its parent for Linux and macOS). macOS : ~/Library/Application Support/Binary Ninja/plugins/libLIEF.dylib ~/Library/Application Support/Binary Ninja/libLIEF.dylib Linux : ~/.binaryninja/plugins/libLIEF.so ~/.binaryninja/libLIEF.so Windows : C:\\Users\\romain\\AppData\\Roaming\\Binary Ninja\\plugins\\LIEF.dll %APPDATA%\\Binary Ninja\\plugins\\LIEF.dll Troubleshooting Plugin module failed to load [:0 Default] Plugin module '~/.binaryninja/plugins/lief-dwarf-plugin-linux-x86_64.so' failed to load [:0 Default] dlerror() reports: libLIEF.so: cannot open shared object file: No such file or directory This means that libLIEF.so , libLIEF.dylib , or LIEF.dll is not correctly installed in the plugins/ directory. Make sure that the LIEF shared library is next to the plugin that failed to load. This feature requires LIEF extended This error means that you need to install the extended version of the shared library. See the extended section for more information. libLIEF.dylib can’t be opened because Apple cannot check it for malicious software libLIEF.dylib is self-signed and does not use an Apple certificate; therefore, it is considered as coming from an unknown developer . You can address this issue in different ways: You can compile libLIEF.dylib yourself and sign the compiled library with your certificate. You can add a security exception as described here: https://support.apple.com/guide/mac-help/apple-cant-check-app-for-malicious-software-mchleab3a043/mac", "contentHash": "8669496fcf4a0a0273012fca500b8901398512d7685cb3d894b61accf4d8c8ce", "description": "Similar to the Ghidra plugin, LIEF can be used as a BinaryNinja plugin.", "docname": "plugins/binaryninja/index", "documentID": "02e012ddee20b983d9d3d3779ae581c90babb9a5411955dff17b8be9cb68f390", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/plugins/binaryninja/index.md", "title": "BinaryNinja - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/plugins/ghidra/analyzers/exceptions-analyzer/index.html", "content": "Ghidra - Analyzers - Exceptions This analyzer improves the representation and underlying data of PE exceptions metadata, primarily for ARM64 and ARM64EC binaries. 140017000 00 ?? 00h140017001 10 ?? 10h140017002 00 ?? 00h140017003 00 ?? 00h140017004 40 ?? 40h @140017005 27 ?? 27h '140017006 01 ?? 01h140017007 00 ?? 00h140017008 20 ?? 20h140017009 10 ?? 10h14001700a 00 ?? 00h14001700b 00 ?? 00h14001700c 4c ?? 4Ch L14001700d 27 ?? 27h '14001700e 01 ?? 01h14001700f 00 ?? 00h140017010 60 ?? 60h `140017011 10 ?? 10h140017012 00 ?? 00h140017013 00 ?? 00h140017014 5c ?? 5Ch \\140017015 27 ?? 27h '140017016 01 ?? 01h140017017 00 ?? 00h140017018 80 ?? 80h140017019 10 ?? 10h14001701a 00 ?? 00h14001701b 00 ?? 00h14001701c 6c ?? 6Ch l14001701d 27 ?? 27h '14001701e 01 ?? 01h14001701f 00 ?? 00h140017020 e0 ?? E0h 140017000 00 10 00 00 40 27 01 00 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY 140017000 00 10 00 00 ibo32 __aarch64_function@140001000 BeginAddress XREF[2]: 14000029c(*), 140011238(*) 140017004 40 27 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_140012740 ExceptionInfoRVA140017008 20 10 00 00 4c 27 01 00 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY 140017008 20 10 00 00 ibo32 __aarch64_function@140001020 BeginAddress 14001700c 4c 27 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_14001274c ExceptionInfoRVA140017010 60 10 00 00 5c 27 01 00 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY 140017010 60 10 00 00 ibo32 __aarch64_function@140001060 BeginAddress 140017014 5c 27 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_14001275c ExceptionInfoRVA140017018 80 10 00 00 6c 27 01 00 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY 140017018 80 10 00 00 ibo32 __aarch64_function@140001080 BeginAddress 14001701c 6c 27 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_14001276c ExceptionInfoRVA140017020 e0 10 00 00 18 29 01 00 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY 140017020 e0 10 00 00 ibo32 __aarch64_function@1400010e0 BeginAddress 140017024 18 29 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_140012918 ExceptionInfoRVA140017028 00 11 00 00 c0 2a 01 00 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY 140017028 00 11 00 00 ibo32 __aarch64_function@140001100 BeginAddress 14001702c c0 2a 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_140012ac0 ExceptionInfoRVA140017030 18 11 00 00 cc 2a 01 00 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY 140017030 18 11 00 00 ibo32 __aarch64_function@140001118 BeginAddress 140017034 cc 2a 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_140012acc ExceptionInfoRVA140017038 50 11 00 00 e4 2c 01 00 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY 140017038 50 11 00 00 ibo32 __aarch64_function@140001150 BeginAddress 14001703c e4 2c 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_140012ce4 ExceptionInfoRVA140017040 80 11 00 00 ec 2c 01 00 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY 140017040 80 11 00 00 ibo32 __aarch64_function@140001180 BeginAddress 140017044 ec 2c 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_140012cec ExceptionInfoRVA140017048 00 12 00 00 f4 2c 01 00 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY 140017048 00 12 00 00 ibo32 __aarch64_function@140001200 BeginAddress 14001704c f4 2c 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_140012cf4 ExceptionInfoRVA140017050 80 12 00 00 fc 2c 01 00 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY 140017050 80 12 00 00 ibo32 __aarch64_function@140001280 BeginAddress 140017054 fc 2c 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_140012cfc ExceptionInfoRVA 140012710 0b ?? 0Bh140012711 00 ?? 00h140012712 20 ?? 20h140012713 08 ?? 08h140012714 81 ?? 81h140012715 e4 ?? E4h140012716 e3 ?? E3h140012717 e3 ?? E3h140012718 14 ?? 14h140012719 00 ?? 00h14001271a 40 ?? 40h @14001271b 40 ?? 40h @14001271c 0a ?? 0Ah14001271d 00 ?? 00h14001271e c0 ?? C0h14001271f 02 ?? 02h140012720 e1 ?? E1h140012721 81 ?? 81h140012722 e6 ?? E6h140012723 e6 ?? E6h140012724 e6 ?? E6h140012725 e6 ?? E6h140012726 e7 ?? E7h140012727 66 ?? 66h f140012728 89 ?? 89h140012729 fc ?? FCh14001272a e4 ?? E4h14001272b 81 ?? 81h14001272c e7 ?? E7h14001272d 4e ?? 4Eh N14001272e 88 ?? 88h14001272f e7 ?? E7h140012730 4c ?? 4Ch L140012731 86 ?? 86h140012732 e7 ?? E7h140012733 4a ?? 4Ah J140012734 84 ?? 84h 140012710 0b 00 20 08 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA 140012710 0b 00 20 dword:18 Bh FunctionLength XREF[1]: 140017a14(*) 140012712 20 dword:2 0h Version 140012712 20 dword:1 0h ExceptionDataPresent 140012712 20 dword:1 1h EpilogInHeader 140012712 20 08 dword:5 0h EpilogCount 140012713 08 dword:5 1h CodeWords __arm64_unwind_code@140012714140012714 81 e4 e3 e3 db[4] 140012714 [0] 81h, E4h, E3h, E3h IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA XREF[1]: 140017a1c(*)140012718 14 00 40 40 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA 140012718 14 00 40 dword:18 14h FunctionLength XREF[1]: 140017a1c(*) 14001271a 40 dword:2 0h Version 14001271a 40 dword:1 0h ExceptionDataPresent 14001271a 40 dword:1 0h EpilogInHeader 14001271a 40 40 dword:5 1h EpilogCount 14001271b 40 dword:5 8h CodeWords __arm64_epilog_scopes@14001271c14001271c 0a 00 c0 02 EpilogScope[1] 14001271c 0a 00 c0 02 EpilogScope [0] 14001271c 0a 00 c0 dword:18 Ah StartOffset 14001271e c0 dword:4 0h Res 14001271e c0 02 dword:10 Bh ExceptionDataPresent __arm64_unwind_code@140012720140012720 e1 81 e6 e6 e6 e6 e7 66 89 fc e4 81 e7 db[32] 4e 88 e7 4c 86 e7 4a 84 e7 48 82 e7 66 89 fc e3 e3 e4 e3 140012720 [0] E1h, 81h, E6h, E6h, 140012724 [4] E6h, E6h, E7h, 66h, 140012728 [8] 89h, FCh, E4h, 81h, 14001272c [12] E7h, 4Eh, 88h, E7h, 140012730 [16] 4Ch, 86h, E7h, 4Ah, 140012734 [20] 84h, E7h, 48h, 82h, 140012738 [24] E7h, 66h, 89h, FCh, 14001273c [28] E3h, E3h, E4h, E3h IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA XREF[1]: 140017004(*)", "contentHash": "514a7a9d15e62d275d7dd096cd708e83bc0486865aaaa86479ea60f9590a3d27", "description": "Ghidra - Analyzers - Exceptions. This analyzer improves the representation and underlying data of PE exceptions metadata, primarily for ARM64 and ARM64EC…", "docname": "plugins/ghidra/analyzers/exceptions-analyzer/index", "documentID": "3d244d0ef870f19f55b90e737fef43a4a935da37856945c28717eedb764a30be", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/plugins/ghidra/analyzers/exceptions-analyzer/index.md", "title": "Ghidra - Analyzers - Exceptions - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/plugins/ghidra/analyzers/loadconfig-analyzer/index.html", "content": "Ghidra - Analyzers - IMAGE_LOAD_CONFIG_DIRECTORY This analyzer enhances the representation and underlying data of the PE LoadConfiguration structure within Ghidra. IMAGE_LOAD_CONFIG_DIRECTORY64_140011b20 XREF[1]: 1400001c0(*)140011b20 40 01 00 00 00 00 00 00 00 00 00 00 00 IMAGE_LOAD_CONFIG_DIRECTORY64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 140011b20 40 01 00 00 ddw 140h Size XREF[1]: 1400001c0(*) 140011b24 00 00 00 00 ddw 0h TimeDateStamp 140011b28 00 00 dw 0h MajorVersion 140011b2a 00 00 dw 0h MinorVersion 140011b2c 00 00 00 00 ddw 0h GlobalFlagsClear 140011b30 00 00 00 00 ddw 0h GlobalFlagsSet 140011b34 00 00 00 00 ddw 0h CriticalSectionDefaultTimeout 140011b38 00 00 00 00 00 00 00 00 dq 0h DeCommitFreeBlockThreshold 140011b40 00 00 00 00 00 00 00 00 dq 0h DeCommitTotalFreeThreshold 140011b48 00 00 00 00 00 00 00 00 addr 00000000 LockPrefixTable 140011b50 00 00 00 00 00 00 00 00 dq 0h MaximumAllocationSize 140011b58 00 00 00 00 00 00 00 00 dq 0h VirtualMemoryThreshold 140011b60 00 00 00 00 00 00 00 00 dq 0h ProcessAffinityMask 140011b68 00 00 00 00 ddw 0h ProcessHeapFlags 140011b6c 00 00 dw 0h CsdVersion 140011b6e 00 00 dw 0h DependentLoadFlags 140011b70 00 00 00 00 00 00 00 00 addr 00000000 EditList 140011b78 40 60 01 40 01 00 00 00 addr DAT_140016040 SecurityCookie = 32h 2 140011b80 00 00 00 00 00 00 00 00 addr 00000000 SEHandlerTable 140011b88 00 00 00 00 00 00 00 00 dq 0h SEHandlerCount 140011b90 70 10 01 40 01 00 00 00 addr PTR__guard_check_icall_140011070 GuardCFCCheckFunctionPointer = 14000b8d8 140011b98 80 10 01 40 01 00 00 00 addr PTR__guard_dispatch_icall_140011080 GuardCFDispatchFunctionPointer = 14000e2c0 140011ba0 00 00 00 00 00 00 00 00 addr 00000000 GuardCFFunctionTable 140011ba8 00 00 00 00 00 00 00 00 dq 0h GuardCFFunctionCount 140011bb0 00 01 00 00 IMAGE_GUARD_FLAGS IMAGE_GUARD_CF_INSTRUMENTED GuardFlags 140011bb4 00 00 00 00 00 00 00 00 00 00 00 00 IMAGE_LOAD_CONFIG_CODE_I CodeIntegrity 140011bc0 00 00 00 00 00 00 00 00 addr 00000000 GuardAddressTakenIatEntryTable 140011bc8 00 00 00 00 00 00 00 00 dq 0h GuardAddressTakenIatEntryCount 140011bd0 00 00 00 00 00 00 00 00 addr 00000000 GuardLongJumpTargetTable 140011bd8 00 00 00 00 00 00 00 00 dq 0h GuardLongJumpTargetCount 140011be0 00 00 00 00 00 00 00 00 addr 00000000 DynamicValueRelocTable 140011be8 f8 11 01 40 01 00 00 00 addr DAT_1400111f8 CHPEMetadataPointer = 02h 140011bf0 00 00 00 00 00 00 00 00 addr 00000000 GuardRFFailureRoutine 140011bf8 00 00 00 00 00 00 00 00 addr 00000000 GuardRFFailureRoutineFunctionPointer 140011c00 00 00 00 00 ddw 0h DynamicValueRelocTableOffset 140011c04 00 00 dw 0h DynamicValueRelocTableSection 140011c06 00 00 dw 0h Reserved1 140011c08 00 00 00 00 00 00 00 00 addr 00000000 GuardRFVerifyStackPointerFunctionPoin 140011c10 00 00 00 00 ddw 0h HotPatchTableOffset 140011c14 00 00 00 00 ddw 0h Reserved2 140011c18 00 00 00 00 00 00 00 00 dq 0h Reserved3 IMAGE_LOAD_CONFIG_DIRECTORY64_140011b20 XREF[1]: 1400001c0(*)140011b20 40 01 00 00 00 00 00 00 00 00 00 00 00 IMAGE_LOAD_CONFIG_DIRECTORY64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 140011b20 40 01 00 00 ddw 140h Size XREF[1]: 1400001c0(*) 140011b24 00 00 00 00 ddw 0h TimeDateStamp 140011b28 00 00 dw 0h MajorVersion 140011b2a 00 00 dw 0h MinorVersion 140011b2c 00 00 00 00 ddw 0h GlobalFlagsClear 140011b30 00 00 00 00 ddw 0h GlobalFlagsSet 140011b34 00 00 00 00 ddw 0h CriticalSectionDefaultTimeout 140011b38 00 00 00 00 00 00 00 00 dq 0h DeCommitFreeBlockThreshold 140011b40 00 00 00 00 00 00 00 00 dq 0h DeCommitTotalFreeThreshold 140011b48 00 00 00 00 00 00 00 00 addr 00000000 LockPrefixTable 140011b50 00 00 00 00 00 00 00 00 dq 0h MaximumAllocationSize 140011b58 00 00 00 00 00 00 00 00 dq 0h VirtualMemoryThreshold 140011b60 00 00 00 00 00 00 00 00 dq 0h ProcessAffinityMask 140011b68 00 00 00 00 ddw 0h ProcessHeapFlags 140011b6c 00 00 dw 0h CSDVersion 140011b6e 00 00 dw 0h DependentLoadFlags 140011b70 00 00 00 00 00 00 00 00 addr 00000000 EditList 140011b78 40 60 01 40 01 00 00 00 addr DAT_140016040 SecurityCookie = 32h 2 140011b80 00 00 00 00 00 00 00 00 dq * 00000000 SEHandlerTable 140011b88 00 00 00 00 00 00 00 00 dq 0h SEHandlerCount 140011b90 70 10 01 40 01 00 00 00 addr PTR__guard_check_icall_140011070 GuardCFCheckFunctionPointer = 14000b8d8 140011b98 80 10 01 40 01 00 00 00 addr PTR__guard_dispatch_icall_140011080 GuardCFDispatchFunctionPointer = 14000e2c0 140011ba0 00 00 00 00 00 00 00 00 ddw * 00000000 GuardCFFunctionTable 140011ba8 00 00 00 00 00 00 00 00 dq 0h GuardCFFunctionCount 140011bb0 00 01 00 00 IMAGE_GUARD_FLAGS IMAGE_GUARD_CF_INSTRUMENTED GuardFlags 140011bb4 00 00 00 00 00 00 00 00 00 00 00 00 IMAGE_LOAD_CONFIG_CODE_I CodeIntegrity 140011bc0 00 00 00 00 00 00 00 00 addr 00000000 GuardAddressTakenIatEntryTable 140011bc8 00 00 00 00 00 00 00 00 dq 0h GuardAddressTakenIatEntryCount 140011bd0 00 00 00 00 00 00 00 00 addr 00000000 GuardLongJumpTargetTable 140011bd8 00 00 00 00 00 00 00 00 dq 0h GuardLongJumpTargetCount 140011be0 00 00 00 00 00 00 00 00 addr 00000000 DynamicValueRelocTable 140011be8 f8 11 01 40 01 00 00 00 IMAGE_ARM64EC_METADATA_V IMAGE_ARM64EC_METADATA_V2_1400111f8 CHPEMetadataPointer 140011bf0 00 00 00 00 00 00 00 00 addr 00000000 GuardRFFailureRoutine 140011bf8 00 00 00 00 00 00 00 00 addr 00000000 GuardRFFailureRoutineFunctionPointer 140011c00 00 00 00 00 ibo32 NaP DynamicValueRelocTableOffset 140011c04 00 00 dw 0h DynamicValueRelocTableSection 140011c06 00 00 dw 0h Reserved2 140011c08 00 00 00 00 00 00 00 00 addr 00000000 GuardRFVerifyStackPointerFunctionPoin 140011c10 00 00 00 00 ibo32 NaP HotPatchTableOffset 140011c14 00 00 00 00 ddw 0h Reserved3 140011c18 00 00 00 00 00 00 00 00 addr 00000000 EnclaveConfigurationPointer 140011c20 00 00 00 00 00 00 00 00 addr 00000000 VolatileMetadataPointer 140011c28 00 00 00 00 00 00 00 00 addr 00000000 GuardEHContinuationTable 140011c30 00 00 00 00 00 00 00 00 dq 0h GuardEHContinuationCount 140011c38 78 10 01 40 01 00 00 00 addr PTR__guard_check_icall_140011078 GuardXFGCheckFunctionPointer = 14000b8d8 140011c40 88 10 01 40 01 00 00 00 addr PTR_LAB_140011088 GuardXFGDispatchFunctionPointer = 14000e2e0 140011c48 90 10 01 40 01 00 00 00 addr PTR_LAB_140011090 GuardXFGTableDispatchFunctionPointer = 14000e2e0 140011c50 98 10 01 40 01 00 00 00 addr DAT_140011098 CastGuardOsDeterminedFailureMode 140011c58 a0 10 01 40 01 00 00 00 addr PTR_LAB_1400110a0 GuardMemcpyFunctionPointer = 14000e080 The layout of this structure – exposed in LIEF through the lief.PE.LoadConfiguration ( lief::pe::LoadConfiguration ; lief.PE.LoadConfiguration ; LIEF::PE::LoadConfiguration ) interface – evolves frequently across new Windows releases. As of today, Ghidra does not natively recognize many of the newer attributes introduced in recent versions. By running this analyzer, you obtain a more complete and accurate representation of these attributes along with their correct data types. Beyond the Load Configuration, the analyzer also defines additional structures, such as lief.PE.CHPEMetadataARM64 ( lief::pe::chpe_metadata_arm64::CHPEMetadata ; lief.PE.CHPEMetadataARM64 ; LIEF::PE::CHPEMetadataARM64 ), which provide valuable context for analyzing ARM64EC binaries. These definitions make it easier to interpret the purpose of certain functions and pointers, leading to deeper insights during reverse engineering. DAT_1400111f8 XREF[1]: 140011be8(*)1400111f8 02 ?? 02h1400111f9 00 ?? 00h1400111fa 00 ?? 00h1400111fb 00 ?? 00h1400111fc 00 ?? 00h1400111fd 1e ?? 1Eh1400111fe 01 ?? 01h1400111ff 00 ?? 00h140011200 02 ?? 02h140011201 00 ?? 00h140011202 00 ?? 00h140011203 00 ?? 00h140011204 b4 ?? B4h140011205 1c ?? 1Ch140011206 01 ?? 01h140011207 00 ?? 00h140011208 00 ?? 00h140011209 90 ?? 90h14001120a 01 ?? 01h14001120b 00 ?? 00h14001120c 00 ?? 00h14001120d 10 ?? 10h14001120e 01 ?? 01h14001120f 00 ?? 00h140011210 08 ?? 08h140011211 10 ?? 10h140011212 01 ?? 01h140011213 00 ?? 00h140011214 18 ?? 18h IMAGE_ARM64EC_METADATA_V2_1400111f8 XREF[1]: 140011be8(*)1400111f8 02 00 00 00 00 1e 01 00 02 00 00 00 b4 IMAGE_ARM64EC_METADATA_V2 1c 01 00 00 90 01 00 00 10 01 00 08 10 01 00 18 10 01 00 10 10 01 00 20 10 01 1400111f8 02 00 00 00 00 1e 01 00 02 00 00 00 b4 IMAGE_ARM64EC_METADATA V1 1c 01 00 00 90 01 00 00 10 01 00 08 10 01 00 18 10 01 00 10 10 01 00 20 10 01 1400111f8 02 00 00 00 ddw 2h Version 1400111fc 00 1e 01 00 ibo32 IMAGE_ARM64EC_METADATA_CODE_RANGE_ARRAY_140011e00 CodeMap 140011200 02 00 00 00 ddw 2h CodeMapCount 140011204 b4 1c 01 00 ibo32 IMAGE_ARM64EC_CODE_RANGE_ENTRY_POINT_ARRAY_140011cb4 CodeRangesToEntryPoints 140011208 00 90 01 00 ibo32 IMAGE_ARM64EC_METADATA_REDIRECTION_ARRAY_140019000 RedirectionMetadata 14001120c 00 10 01 00 ibo32 DAT_140011000 __os_arm64x_dispatch_call_no_redirect 140011210 08 10 01 00 ibo32 DAT_140011008 __os_arm64x_dispatch_ret 140011214 18 10 01 00 ibo32 DAT_140011018 __os_arm64x_dispatch_call 140011218 10 10 01 00 ibo32 PTR_DAT_140011010 __os_arm64x_dispatch_icall 14001121c 20 10 01 00 ibo32 PTR_DAT_140011020 __os_arm64x_dispatch_icall_cfg 140011220 00 00 00 00 ibo32 NaP AlternateEntryPoint 140011224 00 50 01 00 ibo32 PTR_DAT_140015000 AuxiliaryIAT 140011228 01 00 00 00 ddw 1h CodeRangesToEntryPointsCount 14001122c 01 00 00 00 ddw 1h RedirectionMetadataCount 140011230 28 10 01 00 ibo32 DAT_140011028 GetX64InformationFunctionPointer 140011234 30 10 01 00 ibo32 DAT_140011030 SetX64InformationFunctionPointer 140011238 00 70 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY_140017000 ExtraRFETable 14001123c 38 0d 00 00 ddw D38h ExtraRFETableSize 140011240 38 10 01 00 ibo32 DAT_140011038 __os_arm64x_dispatch_fptr 140011244 48 3e 01 00 ibo32 PTR_DAT_140013e48 AuxiliaryIATCopy 140011248 00 00 00 00 ibo32 NaP AuxDelayloadIAT 14001124c 00 00 00 00 ibo32 NaP AuxDelayloadIATCopy 140011250 00 00 00 00 ddw 0h ReservedBitField BinaryNinja BinaryNinja’s LIEF plugin also provides this support: LoadConfiguration", "contentHash": "73de6dfd8d8d86758ad6451b93047072b9ca4c5da5d1f48a083a4e0abd32fc87", "description": "Ghidra - Analyzers - IMAGE_LOAD_CONFIG_DIRECTORY. This analyzer enhances the representation and underlying data of the PE LoadConfiguration structure within…", "docname": "plugins/ghidra/analyzers/loadconfig-analyzer/index", "documentID": "daf35630badf0501c819bd0e64ed12f9ca3e858eb2e6cf7c8e8973151a334e36", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/plugins/ghidra/analyzers/loadconfig-analyzer/index.md", "title": "Ghidra - Analyzers - IMAGE_LOAD_CONFIG_DIRECTORY - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/plugins/ghidra/dwarf/index.html", "content": "Ghidra - DWARF Plugin Export as DWARF This functionality exports Ghidra’s program information into a DWARF file. This exported information includes function names, types, stack variables, etc. You can use this extension in different ways as documented below: Project Manager This extension provides a DWARF exporter that can be used by right-clicking on the binary to export, then: Export > Format > DWARF : CodeBrowser From the CodeBrowser tool, you can left-click on the LIEF menu and select Export as DWARF : Scripts You can also use the Java API from a (headless) script to export a given Ghidra program: import lief.ghidra.core.dwarf.export.Manager; import lief.ghidra.core.NativeBridge; public class LiefDwarfExportScript extends GhidraScript { @Override protected void run() throws Exception { NativeBridge.init(); Manager manager = new Manager(currentProgram); File output = new File(\"/home/romain/output.dwarf\"); manager.export(output); } } Support & Limitations This extension tries to convert as much as possible of Ghidra’s internal binary representation into DWARF structures, but this support is not exhaustive; here is an overview of what is and is not exported. ghidra.program.model.listing.Program Function Data Variables Types Comments ghidra.program.model.listing.Function Name Address range Parameters Type of parameters Return type Stack variables Types of stack variables Comments CodeUnits ghidra.program.model.listing.Data Name Type Address Comments ghidra.program.model.data.DataType ghidra.program.model.data.VoidDataType ghidra.program.model.data.AbstractIntegerDataType ghidra.program.model.data.Array ghidra.program.model.data.TypeDef ghidra.program.model.data.Composite ghidra.program.model.data.Enum ghidra.program.model.data.FunctionDefinition ghidra.program.model.data.Pointer Any types not mentioned here are not supported. References https://github.com/NationalSecurityAgency/ghidra/issues/2687", "contentHash": "daf42e004e40e15856e6516aa5aa2cb831cad63e81ed563c7547707bc5acf99b", "description": "Ghidra - DWARF Plugin. This functionality exports Ghidra’s program information into a DWARF file. This exported information includes function names, types…", "docname": "plugins/ghidra/dwarf/index", "documentID": "01cf8dd1873b0e85aef074f4e924dd6358b738d556322084c63dfea1123eb354", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/plugins/ghidra/dwarf/index.md", "title": "Ghidra - DWARF Plugin - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/plugins/ghidra/index.html", "content": "Ghidra Similar to the BinaryNinja plugin , LIEF can be used as a Ghidra plugin. Features Ghidra - DWARF Plugin Ghidra - Analyzers - IMAGE_LOAD_CONFIG_DIRECTORY Ghidra - Analyzers - Exceptions Downloads ghidra_11.3.2_PUBLIC_LIEF.zip ghidra_11.4.2_PUBLIC_LIEF.zip ghidra_11.4_PUBLIC_LIEF.zip ghidra_12.0_PUBLIC_LIEF.zip Installation First, download the LIEF plugin package from https://lief.s3.fr-par.scw.cloud/latest/plugins/index.html or from the packages listed above. Then, follow the official procedure to install extensions: GhidraDocs/GettingStarted.md Shared Library In addition to the previously installed package, the plugins require the installation of LIEF.dll , libLIEF.dylib , or libLIEF.so next to the extension directory. You can download this library from the following list: SDK LIEF-1.0.0-Darwin-arm64.tar.gz LIEF-1.0.0-Darwin-x86_64.tar.gz LIEF-1.0.0-Linux-x86_64.tar.gz LIEF-1.0.0-win64.zip LIEF-2.0.0-Darwin-arm64.tar.gz LIEF-2.0.0-Darwin-x86_64.tar.gz LIEF-2.0.0-Linux-x86_64.tar.gz LIEF-2.0.0-win64.zip or from here: https://lief.s3.fr-par.scw.cloud/latest/sdk/index.html . Some plugins (like the DWARF Plugin ) require the extended version, which can be downloaded from https://extended.lief.re/ . Given this shared library, you must copy it into the Ghidra settings directory. For instance: macOS: ~/Library/ghidra/ghidra_11.3.2_PUBLIC/Extensions/libLIEF.dylib Linux: ~/.config/ghidra/ghidra_11.3.2_PUBLIC/Extensions/libLIEF.so Windows: C:\\Users\\romain\\AppData\\Roaming\\ghidra\\ghidra_11.3.2_PUBLIC\\Extensions\\LIEF.dll Windows: %APPDATA%\\ghidra\\ghidra_11.3.2_PUBLIC\\Extensions\\LIEF.dll You can verify that the plugin is correctly installed by opening the CodeBrowser tool on a binary and ensuring that you can see the LIEF configuration in File > Configure ( from the CodeBrowser, not the projects window ). Alternatively, you can try running the headless script: LiefVersionInfoScript.java , which should output information about the installed version. Troubleshooting Couldn’t find the native library This means that libLIEF.so , libLIEF.dylib , or LIEF.dll is not correctly installed in the Extensions/ directory. The details of the error provide the expected path(s). This feature requires LIEF extended This error means that you need to install the extended version of the shared library. See the extended section for more information. libLIEF.dylib can’t be opened because Apple cannot check it for malicious software libLIEF.dylib is self-signed and does not use an Apple certificate. Therefore, it is considered as coming from an unknown developer . You can address this issue in different ways: You can compile libLIEF.dylib yourself and sign the compiled library with your certificate. You can add a security exception as described here: https://support.apple.com/guide/mac-help/apple-cant-check-app-for-malicious-software-mchleab3a043/mac", "contentHash": "c9172ae37226989126ebac5ea0ba4ecce9baf29b194618c96092f74c55059115", "description": "Similar to the BinaryNinja plugin, LIEF can be used as a Ghidra plugin.", "docname": "plugins/ghidra/index", "documentID": "349548b961a1ec298a7a64f8f93fb90e02c7306ba2c6923e054d2d69a6ee7b85", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/plugins/ghidra/index.md", "title": "Ghidra - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/references.html", "content": "References Blog Posts & White Papers 2021-06-03: QBDL: Quarkslab Dynamic Loader 2021-04-27: An Empirical Evaluation of Automated Machine Learning Techniques for Malware Detection - IWSPA 21 2021-01-25: Static PE antimalware evasion - Francisco Javier Gomez Galvez 2020-10-23: [Write-up] Using a PIE binary as a Shared Library: HCSC-2020 CTF Writeup by István Tóth 2020-02-04: x0rro: A PE/ELF/MachO Crypter for x86 and x86_64 Based on Radare2 by phra 2019-11-01: Isolating the logic of an encrypted protocol with LIEF and kaitai by @TheXC3LL 2018-10-26: [Write-up] HITCON 2018 - Unexecutable by Andrew Wesie 2018-10-06: [Write-up] Flare-on Challenge (Level 3) 2018-09-30: [Write-up] DragonCTF-Teaser-Brutal Oldskull by z3r0s 2018-09-07: Using a non-system glibc by Ayrx 2018-07-02: PWN problem patch method commonly used in competition 2018-05-03: When SideChannelMarvels meet LIEF 2018-03-11: Fuzzing Arbitrary Functions in ELF Binaries 2018-02-01: Dissecting Mobile Native Code Packers Case Study 2017-11-02: Have Fun With LIEF and Executable Formats 2017-04-04: LIEF Library to Instrument Executable Formats Projects using LIEF Name Language Link Topic Summary shrinkwrap Python https://github.com/fzakaria/shrinkwrap ELF A tool that embeds required dependencies into top-level executables sqlelf Python https://github.com/fzakaria/sqlelf ELF Analysis Explore ELF objects through the power of SQL Maat Python/C++ https://maat.re/ Symbolic Execution Symbolic Execution Framework based on Ghidra’s sleigh QBDL Python/C++ https://github.com/quarkslab/QBDL Binary Loader QBDI aims to provide a modular and portable way to dynamically load and link binaries. BLint Python https://git.sr.ht/~prabhu/blint Static Analysis A binary linter for checking security properties and capabilities in executables Datalog Disassembly C++ https://github.com/GrammaTech/ddisasm Binary Analysis DDisasm is a fast disassembler which is accurate enough for the resulting assembly code to be reassembled. DDisasm is implemented using the datalog (souffle) declarative logic programming language to compile disassembly rules and heuristics Mobile-Security-Framework-MobSF Python https://github.com/MobSF/Mobile-Security-Framework-MobSF Mobile Analysis Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. checksec.py Python https://github.com/Wenzel/checksec.py Static Analysis A simple tool to verify the security properties of your binaries. These properties can be enabled by your compiler to enforce the security of your executables, and mitigate exploitation youarespecial Python https://github.com/endgameinc/youarespecial Machine Learning Machine learning models on malware gym-malware Python https://github.com/endgameinc/gym-malware Machine Learning Learn how to bypass AV through machine learning. MISP Python https://github.com/MISP/MISP Malware Malware Information Sharing Platform and Threat Sharing Virus Disinfector KIT Python https://github.com/Fare9/Virus_Disinfector_KIT Malware A tool for disinfecting PE files lief-sys Rust https://github.com/tathanhdinh/lief-sys Binding Rust binding for LIEF Ledger-Donjon/rainbow Python https://github.com/Ledger-Donjon/rainbow Dynamic Analysis Trace generator based on Unicorn and LIEF as loader. smda Python https://github.com/danielplohmann/smda Static Analysis Recursive disassembler using LIEF as ELF and PE loader conan-io/hooks Python binary-linter.py Static Analysis Binary linter Wiggle Python https://github.com/ChiChou/wiggle Binary search engine An executable binary metadata search engine. ANBU C++ https://github.com/Fare9/ANBU Unpacking Automatic New Binary Unpacker with PIN DBI Framework Similar Projects Name Language Link filebytes Python https://github.com/sashs/filebytes angr/cle Python https://github.com/angr/cle pypeelf Python https://github.com/crackinglandia/pypeelf object Rust https://github.com/gimli-rs/object Goblin Rust https://github.com/m4b/goblin Parsers/Modifiers ELF Name Language Link pyelftools Python https://github.com/eliben/pyelftools pylibelf Python https://github.com/crackinglandia/pylibelf pydevtools Python https://github.com/arowser/pydevtools elfparser C++ ? http://elfparser.com/index.html libelf C hxxp://www.mr511.de/software/ elfio C++ http://elfio.sourceforge.net/ radare2 C/Python https://github.com/radare/radare2/tree/master/libr/bin/format/elf node-elf node.js https://github.com/sifteo/node-elf readelf C https://github.com/bminor/binutils-gdb/blob/master/binutils/readelf.c elfesteem Python https://github.com/LRGH/elfesteem elfsharp C# hxxp://elfsharp.hellsgate.pl/index.shtml metasm Ruby https://github.com/jjyg/metasm amoco Python https://github.com/bdcht/amoco Goblin Rust https://github.com/m4b/goblin Mithril Ruby https://github.com/jbangert/mithril ELFkickers C http://www.muppetlabs.com/~breadbox/software/elfkickers.html libelfmaster C https://github.com/elfmaster/libelfmaster libelf.js JS https://github.com/AlexAltea/libelf.js elfy.io JS ? https://elfy.io/ elfhash C https://github.com/cjacker/elfhash PE Name Language Link pefiles Python https://github.com/erocarrera/pefile radare2 C https://github.com/radare/radare2/tree/master/libr/bin/format/pe PE.Explorer C++/C# ? http://www.pe-explorer.com/ CFF Explorer C++/C# ? http://www.ntcore.com/exsuite.php PE Browser 64 C++/C# ? http://www.smidgeonsoft.prohosting.com/pebrowse-pro-file-viewer.html PE View C++/C# ? http://wjradburn.com/software/ FileAlyzer C++/C# ? https://www.safer-networking.org/products/filealyzer/ PE Studio C++/C# ? https://www.winitor.com/ PEDumper C https://github.com/maldevel/PEdumper PE Parse C++/Python https://github.com/trailofbits/pe-parse PEParse C# https://github.com/DKorablin/PEReader PE Bliss C++ https://github.com/BackupGGCode/portable-executable-library PE Net .NET https://github.com/secana/PeNet libpe C++ https://github.com/evilsocket/libpe/tree/master/libpe elfesteem Python https://github.com/LRGH/elfesteem pelook C ? http://bytepointer.com/tools/index.htm#pelook PortEx Java https://github.com/struppigel/PortEx metasm Ruby https://github.com/jjyg/metasm amoco Python https://github.com/bdcht/amoco Goblin Rust https://github.com/m4b/goblin Mach-O Name Language Link radare2 C https://github.com/radare/radare2/tree/master/libr/bin/format/mach0 MachO-Kit C/ObjC https://github.com/DeVaukz/MachO-Kit optool ObjC https://github.com/alexzielenski/optool macho_edit C++ https://github.com/Tyilo/macho_edit macholib Python https://pypi.org/project/macholib/ elfsharp C# http://elfsharp.hellsgate.pl/index.shtml elfesteem Python https://github.com/LRGH/elfesteem metasm Ruby https://github.com/jjyg/metasm Goblin Rust https://github.com/m4b/goblin MachOView ObjC https://github.com/gdbinit/MachOView XMachOViewer C++ https://github.com/horsicq/XMachOViewer Tools Name Language Link Format Summary Dress Python https://github.com/docileninja/dress ELF Adds static symbols objconv C++ https://www.agner.org/optimize/#objconv ELF/PE/MachO Format converter PEDetour C++ https://github.com/chen-charles/PEDetour PE Hook exported functions python-elf Python https://github.com/tbursztyka/python-elf ELF ELF binary format manipulation tool PEDetour C++ https://github.com/chen-charles/PEDetour PE Hook exported functions libmaelf C https://github.com/tiago4orion/libmalelf ELF A library for dissecting and infecting ELF binaries. peinjector C https://github.com/JonDoNym/peinjector PE MITM PE file infector backdoor factory C++ https://github.com/secretsquirrel/the-backdoor-factory ELF/PE/MachO Patch PE, ELF, Mach-O binaries with shellcode RePEconstruct C https://github.com/DavidKorczynski/RePEconstruct PE PE Unpacker patchkit Python https://github.com/lunixbochs/patchkit ELF Patch binary unstrip Python https://github.com/pzread/unstrip ELF Unstrip static binary sym2elf Python https://github.com/danigargu/syms2elf ELF Exports IDA symbols to the original binary elfhash C https://github.com/cjacker/elfhash ELF Manipulate ELF’s hash recomposer Python https://github.com/secretsquirrel/recomposer PE Modifies parts of a PE file to bypass antivirus software bearparser C++ https://github.com/hasherezade/bearparser PE Portable Executable parsing library with a GUI IAT patcher C++ http://hasherezade.github.io/IAT_patcher PE IAT hooking application PEframe Python https://github.com/guelfoweb/peframe PE PE Static analyzer Manalyze C++ https://github.com/JusticeRage/Manalyze PE PE Static analyzer elf-dissector C++ https://github.com/KDE/elf-dissector ELF Tool to inspect ELF files InfectPE C++ https://github.com/secrary/InfectPE PE Inject code into PE file termux-elf-cleaner C++ https://github.com/termux/termux-elf-cleaner ELF Utility to remove unused ELF sections causing warnings. vdexExtractor C https://github.com/anestisb/vdexExtractor VDEX Extract DEX from VDEX insert_dylib C https://github.com/Tyilo/insert_dylib Mach-O Insert a dylib load command optool Obj-C https://github.com/alexzielenski/optool Mach-O Modify Mach-O commands: Resign, insert commands, … reflective- polymorphism C https://github.com/zeroSteiner/reflective-polymorphism PE Transform PE files between EXE and DLL XELFViewer C++/Qt https://github.com/horsicq/XELFViewer ELF ELF file viewer/editor for Windows, Linux and macOS. strongarm Python https://github.com/datatheorem/strongarm Mach-O Cross-platform ARM64 Mach-O analysis library", "contentHash": "b9eb8d06b0924e9e15b6bbb6115403c233241ba2356c3de7efa8faab2297d7dd", "description": "References reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "references", "documentID": "2a820abed77a29731856683ed7295df4bb2470c90a40b8a1873cb5529a286191", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/references.md", "title": "References - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/runtime/components/host.html", "content": "Host The lief.runtime.Host ( lief::runtime::Host ; lief.runtime.Host ; LIEF::runtime::Host ) interface exposes an API to query information about the host on which LIEF is running. It provides a cross-platform API for common values like the hostname and user directories for configuration, cache, and temporary files. Use Process for process-specific information such as the PID and page size. Cross-platform The following snippet illustrates how to retrieve the generic host information that is available on every supported platform: Python print(f\" Hostname: {lief.runtime.Host.name}\") print(f\" Home: {lief.runtime.Host.home_dir}\") print(f\" cache: {lief.runtime.Host.cache_dir}\") print(f\" temp: {lief.runtime.Host.tmp_dir}\") print(f\" config: {lief.runtime.Host.config_dir}\") C++ info(\" Hostname: {}\", LIEF::runtime::Host::name()); info(\" Home: {}\", LIEF::runtime::Host::home_dir()); info(\" Cache: {}\", LIEF::runtime::Host::cache_dir()); info(\" Temp: {}\", LIEF::runtime::Host::tmp_dir()); info(\" Config: {}\", LIEF::runtime::Host::config_dir()); Rust println!(\" Hostname: {}\", runtime::Host::name()); println!(\" Home: {}\", runtime::Host::home_dir()); println!(\" Cache: {}\", runtime::Host::cache_dir()); println!(\" Temp: {}\", runtime::Host::tmp_dir()); println!(\" Config: {}\", runtime::Host::config_dir()); Linux The lief.runtime.linux.Host ( lief::runtime::linux::Host ; lief.runtime.linux.Host ; LIEF::runtime::Linux::Host ) interface exposes Linux-specific host information: Python print(f\" sys_name: {lief.runtime.linux.Host.sys_name}\") print(f\" sys_release: {lief.runtime.linux.Host.sys_release}\") print(f\" sys_version: {lief.runtime.linux.Host.sys_version}\") print(f\" hardware: {lief.runtime.linux.Host.hardware}\") C++ info(\" sys_name: {}\", LIEF::runtime::Linux::Host::sys_name()); info(\" sys_release: {}\", LIEF::runtime::Linux::Host::sys_release()); info(\" sys_version: {}\", LIEF::runtime::Linux::Host::sys_version()); info(\" hardware: {}\", LIEF::runtime::Linux::Host::hardware()); Rust println!(\" sys_name: {}\", runtime::linux::Host::sys_name()); println!(\" sys_release: {}\", runtime::linux::Host::sys_release()); println!(\" sys_version: {}\", runtime::linux::Host::sys_version()); println!(\" hardware: {}\", runtime::linux::Host::hardware()); Windows The lief.runtime.windows.Host ( lief::runtime::windows::Host ; lief.runtime.windows.Host ; LIEF::runtime::windows::Host ) interface exposes Windows-specific host information such as the operating system version ( lief.runtime.windows.Host.version() ( lief::runtime::windows::Host::version ; lief.runtime.windows.Host.version ; LIEF::runtime::windows::Host::version() )): Python print(f\" Version: {lief.runtime.windows.Host.version}\") C++ info(\" Version: {}\", LIEF::runtime::windows::Host::version().to_string()); Rust if let Some(version) = runtime::windows::Host::version() { println!(\" Version: {}\", version); } macOS The lief.runtime.osx.Host ( lief::runtime::osx::Host ; lief.runtime.osx.Host ; LIEF::runtime::osx::Host ) interface exposes macOS-specific host information such as whether System Integrity Protection is enabled ( lief.runtime.osx.Host.is_sip_enabled ( lief::runtime::osx::Host::is_sip_enabled ; lief.runtime.osx.Host.is_sip_enabled ; LIEF::runtime::osx::Host::is_sip_enabled() )): Python print(f\" Version: {lief.runtime.osx.Host.os_version_name}\") sip = \"enabled\" if lief.runtime.osx.Host.is_sip_enabled else \"disabled\" print(f\" SIP: {sip}\") C++ info(\" Version: {}\", LIEF::runtime::osx::Host::os_version_name()); info(\" SIP: {}\", LIEF::runtime::osx::Host::is_sip_enabled() ? \"enabled\" : \"disabled\"); Rust println!(\" Version: {}\", runtime::osx::Host::os_version_name()); println!( \" SIP: {}\", if runtime::osx::Host::is_sip_enabled() { \"enabled\" } else { \"disabled\" } ); Android The lief.runtime.android.Host ( lief::runtime::android::Host ; lief.runtime.android.Host ; LIEF::runtime::android::Host ) interface exposes Android-specific host information such as the device’s SDK/API level ( lief.runtime.android.Host.sdk_version() ( lief::runtime::android::Host::sdk_version ; lief.runtime.android.Host.sdk_version ; LIEF::runtime::android::Host::sdk_version() )): Python if (sdk := lief.runtime.android.Host.sdk_version) is not None: print(f\" SDK: {sdk}\") C++ if (auto sdk = LIEF::runtime::android::Host::sdk_version()) { info(\" SDK: {}\", std::to_string(*sdk)); } Rust if let Some(sdk) = runtime::android::Host::sdk_version() { println!(\" SDK: {}\", sdk); }", "contentHash": "f33eac6c41ce365ab1a851ea6f167c54691ce497d05974b420c92cd1bc5ebb73", "description": "Query the hostname, user directories, and platform-specific host information with the LIEF runtime API.", "docname": "runtime/components/host", "documentID": "c90d16332011753cba6aa033d11d168f06a93834fe38b200999652c405d286d2", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/runtime/components/host.md", "title": "Host - Runtime - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/runtime/components/memory.html", "content": "Memory The lief.runtime.Memory ( lief::runtime::Memory ; lief.runtime.Memory ; LIEF::runtime::Memory ) interface exposes an API to allocate, inspect and manipulate memory in the current process. It can be used to map anonymous pages, change their protection, and read or write bytes at valid mapped addresses. Allocate, write, and read memory Start with a writable allocation and release it when finished. This Python example uses the process’s page size and checks whether allocation succeeded: import lief from lief.runtime import Memory, Process if not lief.runtime.enabled: raise RuntimeError(\"Install or build LIEF with runtime support\") chunk = Memory.mmap( Process.page_size, Memory.ANONYMOUS | Memory.PRIVATE, Memory.READ | Memory.WRITE, ) if chunk is None: raise RuntimeError(\"Memory allocation failed\") try: message = b\"LIEF runtime\" Memory.write(message, chunk.addr) print(Memory.read(chunk.addr, len(message))) finally: chunk.deallocate() The allocation is represented by a lief.runtime.Memory.Chunk ( lief::runtime::memory::Chunk ; lief.runtime.Memory.Chunk ; LIEF::runtime::Memory::Chunk ). If placement matters, lief.runtime.Memory.mmap_hint() ( lief::runtime::Memory::mmap_hint ; lief.runtime.Memory.mmap_hint() ; LIEF::runtime::Memory::mmap_hint() ) accepts a preferred address. Always use the address in the returned chunk: a hint does not guarantee the requested location. Generate and inspect code Combined with lief.runtime.assemble() ( lief::runtime::assemble ; lief::runtime::assemble_with_config ; lief.runtime.assemble() ; LIEF::runtime::assemble() ), it enables lightweight JIT code generation directly from LIEF, while lief.runtime.disassemble() ( lief::runtime::disassemble ; lief.runtime.disassemble() ; LIEF::runtime::disassemble() ) can be used to disassemble code directly from memory. Linux x86-64 The following snippet allocates a writable and executable page, assembles a small x86-64 stub inside it that prints LIEF Runtime Extended Demo , calls the resulting function, and rewrites part of the buffer before invoking it again: Python chunk = lief.runtime.Memory.mmap( lief.runtime.Process.page_size, lief.runtime.Memory.ANONYMOUS | lief.runtime.Memory.PRIVATE, lief.runtime.Memory.READ | lief.runtime.Memory.WRITE | lief.runtime.Memory.EXEC, ) raw_inst = lief.runtime.assemble( chunk.addr, r\"\"\" .global _start .text _start: push 1 pop rax mov edi, eax lea rsi, [rip + msg] mov rdx, 28 syscall ret msg: .ascii \"LIEF Runtime Extended Demo\\n\" \"\"\", ) # Ensure the assembly is correctly JITed at the beginning of the allocated # memory for inst in islice(lief.runtime.disassemble(chunk.addr), 7): print(inst) # Dump as raw bytes raw_bytes = lief.runtime.Memory.read(chunk.addr, len(raw_inst)) print(raw_bytes.hex(\":\")) # Change the permission to R-X chunk.make_rx() VoidVoidFunc = ctypes.CFUNCTYPE(None) # void(*)() hello_jit = VoidVoidFunc(chunk.addr) hello_jit() # Change the message pos = raw_bytes.find(b\"LIEF Runtime\") chunk.make_rw() lief.runtime.Memory.write(b\"Hello Python ctypes World!\\n\", chunk.addr + pos) chunk.make_rx() # Print again hello_jit() # Don't miss good practices! chunk.deallocate() C++ using Mem = LIEF::runtime::Memory; auto chunk = Mem::mmap(LIEF::runtime::Process::page_size(), Mem::MP_ANONYMOUS | Mem::MP_PRIVATE, Mem::P_READ | Mem::P_WRITE | Mem::P_EXEC); if (!chunk) { return; } std::vector raw_inst = LIEF::runtime::assemble(chunk->addr(), R\"asm( .global _start .text _start: push 1 pop rax mov edi, eax lea rsi, [rip + msg] mov rdx, 28 syscall ret msg: .ascii \"LIEF Runtime Extended Demo\\n\" )asm\"); // Change the permission to R-X and invoke the JITed function chunk->make_rx(); using shellcode_t = void (*)(); auto hello_jit = reinterpret_cast(chunk->addr()); hello_jit(); const char new_msg[] = \"Hello C++ runtime World!\\n\\0\"; std::string_view view_inst(reinterpret_cast(raw_inst.data()), raw_inst.size()); size_t pos = view_inst.find(\"LIEF Runtime Extended\"); assert(pos != std::string_view::npos); chunk->make_rw(); Mem::write(reinterpret_cast(new_msg), sizeof(new_msg) - 1, chunk->addr() + pos); chunk->make_rx(); hello_jit(); // Don't miss good practices! (void)chunk->deallocate(); Rust let mut chunk = match runtime::Memory::mmap( runtime::Process::page_size() as u64, MmapFlags::ANONYMOUS | MmapFlags::PRIVATE, Perm::READ | Perm::WRITE | Perm::EXEC, ) { Some(c) => c, None => return, }; let raw_inst = runtime::assemble( chunk.addr(), r#\" .global _start .text _start: push 1 pop rax mov edi, eax lea rsi, [rip + msg] mov rdx, 28 syscall ret msg: .ascii \"LIEF Runtime Extended Demo\\n\" \"#, ); // Dump the generated instruction bytes println!( \"{} bytes assembled at {:#010x}\", raw_inst.len(), chunk.addr() ); // Change the permission to R-X and invoke the JITed function chunk.make_rx(); let hello_jit: unsafe extern \"C\" fn() = unsafe { std::mem::transmute(chunk.addr() as usize) }; unsafe { hello_jit() }; // Locate the message in the generated bytes and rewrite it. let needle = b\"LIEF Runtime\"; if let Some(msg_off) = raw_inst.windows(needle.len()).position(|w| w == needle) { let new_msg = b\"Hello Rust runtime World!\\n\\0\"; chunk.make_rw(); unsafe { let dst = (chunk.addr() as usize + msg_off) as *mut u8; std::ptr::copy_nonoverlapping(new_msg.as_ptr(), dst, new_msg.len() - 1); } chunk.make_rx(); unsafe { hello_jit() }; } // Don't miss good practices! let _ = chunk.deallocate(); Windows ARM64 x86-64 This part focuses on the ARM64 architecture but it works in the exact same way for Windows x86-64. Similarly, we can JIT a Hello World shellcode on Windows ARM64 with the following snippet: Python chunk = lief.runtime.Memory.mmap( lief.runtime.Process.page_size, lief.runtime.Memory.ANONYMOUS | lief.runtime.Memory.PRIVATE, lief.runtime.Memory.READ | lief.runtime.Memory.WRITE | lief.runtime.Memory.EXEC, ) # The message printed by the shellcode. It must stay alive while the JITed # function runs, so we keep a reference for the whole function. MSG = b\"Hello World\\n\" msg = ctypes.create_string_buffer(MSG) # The assembler resolves the symbols referenced by the shellcode through # this config, mirroring the C++ ``AssemblerConfig::resolve_symbol`` override. class Config(lief.assembly.AssemblerConfig): def resolve_symbol(self, name: str) -> int | None: kernel32 = lief.runtime.windows.dlopen(\"kernel32.dll\") if kernel32 is None: print(\"Failed to dlopen kernel32.dll\", file=sys.stderr) return None # Resolve the symbols that are used by the shellcode if name == \"GetStdHandle\": return lief.to_int(kernel32.dlsym(\"GetStdHandle\")) if name == \"WriteFile\": return lief.to_int(kernel32.dlsym(\"WriteFile\")) if name == \"var_msg\": return ctypes.addressof(msg) if name == \"var_msg_len\": return len(MSG) return None config = Config() # Shellcode dynamically compiled and whose referenced symbols are resolved # at runtime by the provided config lief.runtime.assemble( chunk.addr, r\"\"\" .text .global main .align 2 main: stp x29, x30, [sp, -64]! mov x29, sp stp x19, x20, [sp, 16] stp x21, x22, [sp, 32] // Here we use symbols that are **dynamically** resolved by the // AssemblerConfig ldr x19, =GetStdHandle ldr x20, =WriteFile ldr x21, =var_msg ldr w22, =var_msg_len // Call GetStdHandle(STD_OUTPUT_HANDLE) // STD_OUTPUT_HANDLE = -11 // GetStdHandle is stored in x19 mov w0, -11 blr x19 // Call ---> bool WriteFile( // HANDLE hConsoleOutput, // x0: from GetStdHandle (already set) // const VOID *lpBuffer, // x1: pointer to string // DWORD nNumberOfCharsToWrite, // w2: length of string // LPDWORD lpNumberOfCharsWritten,// x3: pointer to written count // LPVOID lpReserved // x4: NULL // ); mov x1, x21 mov w2, w22 add x3, sp, 48 mov x4, xzr blr x20 mov x0, xzr ldp x21, x22, [sp, 32] ldp x19, x20, [sp, 16] ldp x29, x30, [sp], 64 ret \"\"\", config, ) # Flush the instruction cache chunk.cache_flush() # Change the permission to R-X and invoke the JITed function chunk.make_rx() void_void_func = ctypes.CFUNCTYPE(None) # void(*)() hello_jit = void_void_func(chunk.addr) # This call prints the message \"Hello World\" on the console hello_jit() # Don't miss good practices! chunk.deallocate() C++ using Mem = LIEF::runtime::Memory; auto chunk = Mem::mmap(LIEF::runtime::Process::page_size(), Mem::MP_ANONYMOUS | Mem::MP_PRIVATE, Mem::P_READ | Mem::P_WRITE | Mem::P_EXEC); if (!chunk) { return; } class Config : public LIEF::assembly::AssemblerConfig { public: std::optional resolve_symbol(const std::string& name) override { // The message to print static constexpr char HELLO[] = \"Hello World\\n\"; static constexpr uint32_t HELLO_LEN = sizeof(HELLO) - 1; static auto kernel32 = LIEF::runtime::windows::dlopen(\"kernel32.dll\"); if (kernel32 == nullptr) { err(\"Failed to dlopen kernel32.dll\"); return std::nullopt; } // Resolve the symbols that are used by the shellcode if (name == \"GetStdHandle\") { return reinterpret_cast(kernel32->dlsym(\"GetStdHandle\")); } if (name == \"WriteFile\") { return reinterpret_cast(kernel32->dlsym(\"WriteFile\")); } if (name == \"var_msg\") { return reinterpret_cast(HELLO); } if (name == \"var_msg_len\") { return HELLO_LEN; } return std::nullopt; } }; Config config; // clang-format off // Shellcode dynamically compiled and whose referenced symbols are resolved // at runtime by the provided Config std::vector raw_inst = LIEF::runtime::assemble(chunk->addr(), R\"asm( .text .global main .align 2 main: stp x29, x30, [sp, -64]! mov x29, sp stp x19, x20, [sp, 16] stp x21, x22, [sp, 32] // Here we use symbols that are **dynamically** resolved by the // AssemblerConfig ldr x19, =GetStdHandle ldr x20, =WriteFile ldr x21, =var_msg ldr w22, =var_msg_len // Call GetStdHandle(STD_OUTPUT_HANDLE) // STD_OUTPUT_HANDLE = -11 // GetStdHandle is stored in x19 mov w0, -11 blr x19 // Call ---> bool WriteFile( // HANDLE hConsoleOutput, // x0: from GetStdHandle (already set) // const VOID *lpBuffer, // x1: pointer to string // DWORD nNumberOfCharsToWrite, // w2: length of string // LPDWORD lpNumberOfCharsWritten,// x3: pointer to written count // LPVOID lpReserved // x4: NULL // ); mov x1, x21 mov w2, w22 add x3, sp, 48 mov x4, xzr blr x20 mov x0, xzr ldp x21, x22, [sp, 32] ldp x19, x20, [sp, 16] ldp x29, x30, [sp], 64 ret )asm\", config); // clang-format on // Flush the instruction cache chunk->cache_flush(); // Change the permission to R-X and invoke the JITed function. chunk->make_rx(); using shellcode_t = void (*)(); auto hello_jit = reinterpret_cast(chunk->addr()); // This call prints the message \"Hello World\" on the console hello_jit(); // Don't miss good practices! (void)chunk->deallocate(); Rust let mut chunk = match runtime::Memory::mmap( runtime::Process::page_size() as u64, MmapFlags::ANONYMOUS | MmapFlags::PRIVATE, Perm::READ | Perm::WRITE | Perm::EXEC, ) { Some(c) => c, None => return, }; // Resolve kernel32 (loaded in every Windows process) let kernel32 = match runtime::windows::dlopen(\"kernel32.dll\") { Some(m) => m, None => { eprintln!(\"Failed to dlopen kernel32.dll\"); let _ = chunk.deallocate(); return; } }; let p_get_std_handle = kernel32.dlsym(\"GetStdHandle\".to_string()); let p_write_file = kernel32.dlsym(\"WriteFile\".to_string()); if p_get_std_handle.is_null() || p_write_file.is_null() { eprintln!(\"Failed to resolve kernel32 symbols\"); let _ = chunk.deallocate(); return; } let p_get_std_handle = p_get_std_handle as u64; let p_write_file = p_write_file as u64; // The message printed by the shellcode. const HELLO: &[u8] = b\"Hello World\\n\"; let msg_ptr = HELLO.as_ptr() as u64; let msg_len = HELLO.len() as u64; let mut config = AssemblerConfig::default(); config.symbol_resolver = Some(Arc::new(move |name: &str| -> Option { match name { \"GetStdHandle\" => Some(p_get_std_handle), \"WriteFile\" => Some(p_write_file), \"var_msg\" => Some(msg_ptr), \"var_msg_len\" => Some(msg_len), _ => None, } })); // Shellcode dynamically compiled and whose referenced symbols are resolved // at runtime by the provided config let raw_inst = runtime::assemble_with_config( chunk.addr(), r#\" .text .global main .align 2 main: stp x29, x30, [sp, -64]! mov x29, sp stp x19, x20, [sp, 16] stp x21, x22, [sp, 32] // Here we use symbols that are **dynamically** resolved by the // AssemblerConfig ldr x19, =GetStdHandle ldr x20, =WriteFile ldr x21, =var_msg ldr w22, =var_msg_len // Call GetStdHandle(STD_OUTPUT_HANDLE) // STD_OUTPUT_HANDLE = -11 // GetStdHandle is stored in x19 mov w0, -11 blr x19 // Call ---> bool WriteFile( // HANDLE hConsoleOutput, // x0: from GetStdHandle (already set) // const VOID *lpBuffer, // x1: pointer to string // DWORD nNumberOfCharsToWrite, // w2: length of string // LPDWORD lpNumberOfCharsWritten,// x3: pointer to written count // LPVOID lpReserved // x4: NULL // ); mov x1, x21 mov w2, w22 add x3, sp, 48 mov x4, xzr blr x20 mov x0, xzr ldp x21, x22, [sp, 32] ldp x19, x20, [sp, 16] ldp x29, x30, [sp], 64 ret \"#, &config, ); println!( \"{} bytes assembled at {:#010x}\", raw_inst.len(), chunk.addr() ); // Flush the instruction cache chunk.cache_flush(); // Change the permission to R-X and invoke the JITed function chunk.make_rx(); let hello_jit: unsafe extern \"C\" fn() = unsafe { std::mem::transmute(chunk.addr() as usize) }; // This call prints the message \"Hello World\" on the console unsafe { hello_jit() }; // Don't miss good practices! let _ = chunk.deallocate(); Note that this shellcode uses the external functions GetStdHandle and WriteFile that are dynamically resolved and injected into the shellcode at runtime . The shellcode is thus generated with dynamic information that would otherwise have been tedious to resolve at the assembly level. macOS ARM64 SIP Allocating and executing JIT memory on macOS requires System Integrity Protection (SIP) to be disabled. The snippet below therefore only runs the JIT part when lief.runtime.osx.Host.is_sip_enabled ( lief::runtime::osx::Host::is_sip_enabled ; lief.runtime.osx.Host.is_sip_enabled ; LIEF::runtime::osx::Host::is_sip_enabled() ) reports that SIP is disabled. Similarly, we can JIT a Hello World shellcode on macOS ARM64. The shellcode calls write , which is dynamically resolved from libSystem at runtime: Python # The JIT below allocates and executes RWX memory. On macOS this is only # permitted when SIP is disabled, so we check it before. if lief.runtime.osx.Host.is_sip_enabled: print(\"SIP is enabled: skipping the JIT memory example\", file=sys.stderr) return # Note the `JIT` flag here that is used to switch the allocated chunk into # R-X once the shellcode is committed. chunk = lief.runtime.Memory.mmap( lief.runtime.Process.page_size, lief.runtime.Memory.ANONYMOUS | lief.runtime.Memory.PRIVATE | lief.runtime.Memory.JIT, lief.runtime.Memory.READ | lief.runtime.Memory.WRITE, ) # The message printed by the shellcode. It must stay alive while the JITed # function runs, so we keep a reference for the whole function. MSG = b\"Hello World\\n\" msg = ctypes.create_string_buffer(MSG) # libSystem re-exports the libc symbols (write, ...) libsystem = lief.runtime.osx.dlopen(\"libSystem.B.dylib\") # The assembler resolves the symbols referenced by the shellcode through # this config, mirroring the C++ ``AssemblerConfig::resolve_symbol`` override. class Config(lief.assembly.AssemblerConfig): def resolve_symbol(self, name: str) -> int | None: if libsystem is None: print(\"Failed to dlopen libSystem.B.dylib\", file=sys.stderr) return None # Resolve the symbols that are used by the shellcode if name == \"write\": return lief.to_int(libsystem.dlsym(\"write\")) if name == \"var_msg\": return ctypes.addressof(msg) if name == \"var_msg_len\": return len(MSG) return None config = Config() # Shellcode dynamically compiled and whose referenced symbols are resolved # at runtime by the provided config lief.runtime.assemble( chunk.addr, r\"\"\" .text .global main .align 2 main: stp x29, x30, [sp, -16]! mov x29, sp // Here we use symbols that are **dynamically** resolved by the // AssemblerConfig ldr x8, =write // write(2) libc wrapper ldr x1, =var_msg // buffer ldr w2, =var_msg_len // length // write(STDOUT_FILENO, msg, len) mov x0, 1 blr x8 mov x0, xzr ldp x29, x30, [sp], 16 ret \"\"\", config, ) # Flush the instruction cache chunk.cache_flush() # Change the permission to R-X and invoke the JITed function chunk.make_rx() void_void_func = ctypes.CFUNCTYPE(None) # void(*)() hello_jit = void_void_func(chunk.addr) # This call prints the message \"Hello World\" on the console hello_jit() # Don't miss good practices! chunk.deallocate() C++ // The JIT below allocates and executes RWX memory. On macOS this is only // permitted when SIP is disabled. if (LIEF::runtime::osx::Host::is_sip_enabled()) { warn(\"SIP is enabled: skipping the JIT memory example\"); return; } using Mem = LIEF::runtime::Memory; // Note the `MP_JIT` here that is used to switch the allocated chunk into R-X // once the shellcode is committed. auto chunk = Mem::mmap(LIEF::runtime::Process::page_size(), Mem::MP_ANONYMOUS | Mem::MP_PRIVATE | Mem::MP_JIT, Mem::P_READ | Mem::P_WRITE); if (!chunk) { return; } class Config : public LIEF::assembly::AssemblerConfig { public: std::optional resolve_symbol(const std::string& name) override { // The message to print static constexpr char HELLO[] = \"Hello World\\n\"; static constexpr uint32_t HELLO_LEN = sizeof(HELLO) - 1; // libSystem re-exports the libc symbols (write, ...) static auto libsystem = LIEF::runtime::osx::dlopen(\"libSystem.B.dylib\"); if (libsystem == nullptr) { err(\"Failed to dlopen libSystem.B.dylib\"); return std::nullopt; } // Resolve the symbols that are used by the shellcode if (name == \"write\") { return reinterpret_cast(libsystem->dlsym(\"write\")); } if (name == \"var_msg\") { return reinterpret_cast(HELLO); } if (name == \"var_msg_len\") { return HELLO_LEN; } return std::nullopt; } }; Config config; // clang-format off // Shellcode dynamically compiled and whose referenced symbols are resolved // at runtime by the provided Config std::vector raw_inst = LIEF::runtime::assemble(chunk->addr(), R\"asm( .text .global main .align 2 main: stp x29, x30, [sp, -16]! mov x29, sp // Here we use symbols that are **dynamically** resolved by the // AssemblerConfig ldr x8, =write // write(2) libc wrapper ldr x1, =var_msg // buffer ldr w2, =var_msg_len // length // write(STDOUT_FILENO, msg, len) mov x0, 1 blr x8 mov x0, xzr ldp x29, x30, [sp], 16 ret )asm\", config); // clang-format on // Flush the instruction cache chunk->cache_flush(); // Change the permission to R-X and invoke the JITed function. chunk->make_rx(); using shellcode_t = void (*)(); auto hello_jit = reinterpret_cast(chunk->addr()); // This call prints the message \"Hello World\" on the console hello_jit(); // Don't miss good practices! (void)chunk->deallocate(); Rust // The JIT below allocates and executes RWX memory. On macOS this is only // permitted when System Integrity Protection (SIP) is disabled, so gate the // example on it. if runtime::osx::Host::is_sip_enabled() { eprintln!(\"SIP is enabled: skipping the JIT memory example\"); return; } // Note the `JIT` flag here that is used to switch the allocated chunk into // R-X once the shellcode is committed. let mut chunk = match runtime::Memory::mmap( runtime::Process::page_size() as u64, MmapFlags::ANONYMOUS | MmapFlags::PRIVATE | MmapFlags::JIT, Perm::READ | Perm::WRITE, ) { Some(c) => c, None => return, }; // libSystem re-exports the libc symbols (write, ...) let libsystem = match runtime::osx::dlopen(\"libSystem.B.dylib\") { Some(m) => m, None => { eprintln!(\"Failed to dlopen libSystem.B.dylib\"); let _ = chunk.deallocate(); return; } }; let p_write = libsystem.dlsym(\"write\".to_string()); if p_write.is_null() { eprintln!(\"Failed to resolve write\"); let _ = chunk.deallocate(); return; } let p_write = p_write as u64; // The message printed by the shellcode. const HELLO: &[u8] = b\"Hello World\\n\"; let msg_ptr = HELLO.as_ptr() as u64; let msg_len = HELLO.len() as u64; let mut config = AssemblerConfig::default(); config.symbol_resolver = Some(Arc::new(move |name: &str| -> Option { match name { \"write\" => Some(p_write), \"var_msg\" => Some(msg_ptr), \"var_msg_len\" => Some(msg_len), _ => None, } })); // Shellcode dynamically compiled and whose referenced symbols are resolved // at runtime by the provided config let raw_inst = runtime::assemble_with_config( chunk.addr(), r#\" .text .global main .align 2 main: stp x29, x30, [sp, -16]! mov x29, sp // Here we use symbols that are **dynamically** resolved by the // AssemblerConfig ldr x8, =write // write(2) libc wrapper ldr x1, =var_msg // buffer ldr w2, =var_msg_len // length // write(STDOUT_FILENO, msg, len) mov x0, 1 blr x8 mov x0, xzr ldp x29, x30, [sp], 16 ret \"#, &config, ); println!( \"{} bytes assembled at {:#010x}\", raw_inst.len(), chunk.addr() ); // Flush the instruction cache chunk.cache_flush(); // Change the permission to R-X and invoke the JITed function chunk.make_rx(); let hello_jit: unsafe extern \"C\" fn() = unsafe { std::mem::transmute(chunk.addr() as usize) }; // This call prints the message \"Hello World\" on the console unsafe { hello_jit() }; // Don't miss good practices! let _ = chunk.deallocate(); Android ARM64 Similarly, we can JIT a small AArch64 stub on Android to print LIEF Runtime Extended Demo . The Python tab calls write , which is dynamically resolved from Bionic libc at runtime: Python chunk = lief.runtime.Memory.mmap( lief.runtime.Process.page_size, lief.runtime.Memory.ANONYMOUS | lief.runtime.Memory.PRIVATE, lief.runtime.Memory.READ | lief.runtime.Memory.WRITE | lief.runtime.Memory.EXEC, ) class Config(lief.assembly.AssemblerConfig): def resolve_symbol(self, name: str) -> int | None: libc = lief.runtime.android.dlopen(\"libc.so\") if libc is None: print(\"Failed to dlopen libc.so\", file=sys.stderr) return None if name == \"write\": return lief.to_int(libc.dlsym(\"write\")) return None config = Config() raw_inst = lief.runtime.assemble( chunk.addr, r\"\"\" .text .global main .align 2 main: stp x29, x30, [sp, -16]! mov x29, sp ldr x8, =write mov x0, 1 // STDOUT_FILENO adr x1, msg // buf = &msg mov x2, 27 // len = len(\"LIEF Runtime Extended Demo\\n\") blr x8 // write(STDOUT_FILENO, msg, 27) ldp x29, x30, [sp], 16 ret msg: .ascii \"LIEF Runtime Extended Demo\\n\" \"\"\", config, ) # Disassemble the JITed stub from memory for inst in islice(lief.runtime.disassemble(chunk.addr), 9): print(inst) # Dump as raw bytes raw_bytes = lief.runtime.Memory.read(chunk.addr, len(raw_inst)) print(raw_bytes.hex(\":\")) # Flush the instruction cache before executing the freshly written code # (this is required on AArch64). chunk.cache_flush() # Change the permission to R-X chunk.make_rx() VoidVoidFunc = ctypes.CFUNCTYPE(None) # void(*)() hello_jit = VoidVoidFunc(chunk.addr) hello_jit() # Change the message pos = raw_bytes.find(b\"LIEF Runtime\") chunk.make_rw() lief.runtime.Memory.write(b\"Hello Python ctypes World!\\n\", chunk.addr + pos) chunk.make_rx() chunk.cache_flush() # Print again hello_jit() # Don't miss good practices! chunk.deallocate() C++ using Mem = LIEF::runtime::Memory; auto chunk = Mem::mmap(LIEF::runtime::Process::page_size(), Mem::MP_ANONYMOUS | Mem::MP_PRIVATE, Mem::P_READ | Mem::P_WRITE | Mem::P_EXEC); if (!chunk) { return; } struct Config : LIEF::assembly::AssemblerConfig { std::optional resolve_symbol(const std::string& name) override { std::unique_ptr libc = LIEF::runtime::android::dlopen(\"libc.so\"); if (libc == nullptr) { err(\"Failed to dlopen libc.so\"); return std::nullopt; } if (name == \"write\") { return reinterpret_cast(libc->dlsym(\"write\")); } return std::nullopt; } } config; std::vector raw_inst = LIEF::runtime::assemble(chunk->addr(), R\"asm( .text .global main .align 2 main: stp x29, x30, [sp, -16]! mov x29, sp ldr x8, =write mov x0, 1 // STDOUT_FILENO adr x1, msg // buf = &msg mov x2, 27 // len(\"LIEF Runtime Extended Demo\\n\") blr x8 // write(STDOUT_FILENO, msg, 27) ldp x29, x30, [sp], 16 ret msg: .ascii \"LIEF Runtime Extended Demo\\n\" )asm\", config); // Disassemble the JITed stub from memory auto instructions = LIEF::runtime::disassemble(chunk->addr()); for (const LIEF::assembly::Instruction& inst : instructions | std::views::take(9)) { info(\"{}\", inst.to_string()); } // Dump as raw bytes std::vector raw_bytes; Mem::read(chunk->addr(), raw_bytes, raw_inst.size()); std::string hex_bytes; for (uint8_t byte : raw_bytes) { if (!hex_bytes.empty()) { hex_bytes += ':'; } hex_bytes += std::format(\"{:02x}\", static_cast(byte)); } info(\"{}\", hex_bytes); // Flush the instruction cache before executing the freshly written code. // This is required on AArch64. chunk->cache_flush(); // Change the permission to R-X and invoke the JITed function chunk->make_rx(); using shellcode_t = void (*)(); auto hello_jit = reinterpret_cast(chunk->addr()); hello_jit(); // Change the message const char new_msg[] = \"Hello C++ runtime World!\\n\"; std::string_view view_inst(reinterpret_cast(raw_inst.data()), raw_inst.size()); size_t pos = view_inst.find(\"LIEF Runtime\"); assert(pos != std::string_view::npos); chunk->make_rw(); Mem::write(reinterpret_cast(new_msg), sizeof(new_msg) - 1, chunk->addr() + pos); chunk->make_rx(); chunk->cache_flush(); hello_jit(); // Don't miss good practices! (void)chunk->deallocate(); Rust let mut chunk = match runtime::Memory::mmap( runtime::Process::page_size() as u64, MmapFlags::ANONYMOUS | MmapFlags::PRIVATE, Perm::READ | Perm::WRITE | Perm::EXEC, ) { Some(c) => c, None => return, }; let mut config = AssemblerConfig::default(); config.symbol_resolver = Some(Arc::new(|name: &str| -> Option { let libc = match runtime::android::dlopen(\"libc.so\") { Some(lib) => lib, None => { eprintln!(\"Failed to dlopen libc.so\"); return None; } }; if name == \"write\" { return Some(libc.dlsym(\"write\".to_string()) as usize as u64); } None })); let raw_inst = runtime::assemble_with_config( chunk.addr(), r#\" .text .global main .align 2 main: stp x29, x30, [sp, -16]! mov x29, sp ldr x8, =write mov x0, 1 // STDOUT_FILENO adr x1, msg // buf = &msg mov x2, 27 // len(\"LIEF Runtime Extended Demo\\n\") blr x8 // write(STDOUT_FILENO, msg, 27) ldp x29, x30, [sp], 16 ret msg: .ascii \"LIEF Runtime Extended Demo\\n\" \"#, &config, ); // Disassemble the JITed stub from memory for inst in runtime::disassemble(chunk.addr()).take(9) { println!(\"{}\", inst); } // Dump the JITed stub as raw bytes let hex_bytes: Vec = raw_inst.iter().map(|&b| format!(\"{:02x}\", b)).collect(); println!(\"{}\", hex_bytes.join(\":\")); // Flush the instruction cache before executing the freshly written code // (this is required on AArch64). chunk.cache_flush(); // Change the permission to R-X and invoke the JITed function chunk.make_rx(); let hello_jit: unsafe extern \"C\" fn() = unsafe { std::mem::transmute(chunk.addr() as usize) }; unsafe { hello_jit() }; // Change the message: locate it in the generated bytes and rewrite it. let needle = b\"LIEF Runtime\"; if let Some(msg_off) = raw_inst.windows(needle.len()).position(|w| w == needle) { let new_msg = b\"Hello Rust runtime World!\\n\"; chunk.make_rw(); unsafe { let dst = (chunk.addr() as usize + msg_off) as *mut u8; std::ptr::copy_nonoverlapping(new_msg.as_ptr(), dst, new_msg.len()); } chunk.make_rx(); chunk.cache_flush(); unsafe { hello_jit() }; } // Don't miss good practices! let _ = chunk.deallocate();", "contentHash": "d6899b5ee6de81122fe70ea176f4af441dd38887daedfc202d8c7e22bb2af10f", "description": "Allocate, read, write, and release process memory with LIEF, then explore platform-specific assembly and disassembly examples.", "docname": "runtime/components/memory", "documentID": "baf3482e620831c80bc16a442923dd32905c8a97813042559b3f9b23106b79e0", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/runtime/components/memory.md", "title": "Memory - Runtime - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/runtime/components/memory_layout.html", "content": "Memory Layout The lief.runtime.MemoryLayout ( lief.runtime.MemoryLayout ; LIEF::runtime::MemoryLayout ) interface exposes the memory layout of the current process: the regions that are mapped in its address space. Enumerate mapped regions lief.runtime.memory_layout() ( lief::runtime::memory_layout ; lief.runtime.memory_layout() ; LIEF::runtime::memory_layout() ) returns an iterator over these regions, ordered by address: Python for region in lief.runtime.memory_layout(): print(f\"{region.addr:#014x}-{region.end_addr:#014x} {region.name}\") C++ for (const LIEF::runtime::MemoryLayout::Region& region : LIEF::runtime::memory_layout()) { std::cout << region.addr() << '-' << region.end_addr() << ' ' << region.name() << '\\n'; } Rust for region in lief::runtime::memory_layout() { println!( \"{:#014x}-{:#014x} {}\", region.addr(), region.end_addr(), region.name() ); } For illustration, a Linux process running /usr/bin/cat could have this layout: 0x563668f9d000-0x563668f9f000 /usr/bin/cat 0x563668f9f000-0x563668fa6000 /usr/bin/cat 0x563668fa6000-0x563668fa9000 /usr/bin/cat 0x563668fa9000-0x563668faa000 /usr/bin/cat 0x563668faa000-0x563668fab000 /usr/bin/cat 0x56367cb52000-0x56367cb73000 [heap] 0x7f2d28e00000-0x7f2d29196000 /usr/lib/locale/locale-archive 0x7f2d291be000-0x7f2d29200000 0x7f2d29200000-0x7f2d29224000 /usr/lib/libc.so.6 [...] 0x7f2d29478000-0x7f2d2947a000 [vdso] 0x7f2d2947a000-0x7f2d2947b000 /lib64/ld-linux-x86-64.so.2 [...] 0x7ffd162f1000-0x7ffd16312000 [stack] 0xffffffffff600000-0xffffffffff601000 [vsyscall] A lief.runtime.MemoryLayout.Region ( lief::runtime::Region ; lief.runtime.MemoryLayout.Region ; LIEF::runtime::MemoryLayout::Region ) describes a half-open address range: the start address is included, and the end address is excluded. Its name can be: the name or the path of the module mapped at this address (e.g. /usr/lib/libc.so.6 ); the identifier of a region that is not backed by a file (e.g. [stack] , [heap] , [vdso] ); empty , for anonymous regions. As shown in the output above, a module is not mapped as a single region: it usually gets one region per set of permissions. Names and mappings depend on the operating system and can change as the process allocates memory or loads libraries. A region describes a mapping: it does not own the mapped memory. Inspecting the layout The following snippet iterates over the memory layout to: Compute the total mapped size Group that size by region name Locate the region containing a given address These totals measure virtual address space. They are not resident-memory (RSS) measurements, and grouping anonymous regions combines unrelated allocations. Python address: int count = 0 mapped = 0 footprint: defaultdict[str, int] = defaultdict(int) enclosing: lief.runtime.MemoryLayout.Region | None = None for region in lief.runtime.memory_layout(): count += 1 mapped += region.size name = region.name if region.name else \"\" footprint[name] += region.size if region.contains(address): enclosing = region print(f\"{count} regions, {mapped // 1024} KB mapped\") for name, size in footprint.items(): print(f\"{size:#010x} {name}\") if enclosing is not None: print(f\"{address:#x}: {enclosing.name}+{address - enclosing.addr:#x}\") C++ size_t count = 0; uint64_t mapped = 0; std::unordered_map footprint; LIEF::runtime::MemoryLayout::Region enclosing; for (const LIEF::runtime::MemoryLayout::Region& region : LIEF::runtime::memory_layout()) { ++count; mapped += region.size(); std::string name = region.name().empty() ? \"\" : std::string(region.name()); footprint[name] += region.size(); if (region.contains(address)) { enclosing = region; } } std::cout << count << \" regions, \" << (mapped / 1024) << \" KB mapped\\n\"; for (const auto& [name, size] : footprint) { std::cout << size << ' ' << name << '\\n'; } if (enclosing.size() > 0) { std::cout << address << \": \" << enclosing.name() << '+' << (address - enclosing.addr()) << '\\n'; } Rust let mut count = 0usize; let mut mapped = 0u64; let mut footprint: BTreeMap = BTreeMap::new(); let mut enclosing: Option = None; for region in lief::runtime::memory_layout() { count += 1; mapped += region.size(); let mut name = region.name(); if name.is_empty() { name = String::from(\"\"); } *footprint.entry(name).or_insert(0) += region.size(); if region.contains(address) { enclosing = Some(region); } } println!(\"{count} regions, {} KB mapped\", mapped / 1024); for (name, size) in &footprint { println!(\"{size:#010x} {name}\"); } if let Some(region) = enclosing { println!( \"{address:#x}: {}+{:#x}\", region.name(), address - region.addr() ); } Linux / Android On Linux and Android, named mappings such as [stack] and [heap] can be located when present. They do not account for every thread stack or allocator-managed allocation: Python for region in lief.runtime.memory_layout(): # On Linux and Android, the kernel names the regions that back the # stack and the heap of the process. if region.name in (\"[stack]\", \"[heap]\"): print(f\"{region.name}: {region.addr:#014x}-{region.end_addr:#014x}\") C++ for (const LIEF::runtime::MemoryLayout::Region& region : LIEF::runtime::memory_layout()) { // On Linux and Android, the kernel names the regions that back the stack // and the heap of the process. if (region.name() == \"[stack]\" || region.name() == \"[heap]\") { std::cout << region.name() << \": \" << region.addr() << '-' << region.end_addr() << '\\n'; } } Rust for region in lief::runtime::memory_layout() { // On Linux and Android, the kernel names the regions that back the // stack and the heap of the process. let name = region.name(); if name == \"[stack]\" || name == \"[heap]\" { println!( \"{name}: {:#014x}-{:#014x}\", region.addr(), region.end_addr() ); } } [heap]: 0x56367cb52000-0x56367cb73000 [stack]: 0x7ffd162f1000-0x7ffd16312000", "contentHash": "360b8e9ca782ef50b84028739bc7f499f60446851765f5fab48b1f8c93da50e7", "description": "Inspect mapped memory regions with LIEF Extended, calculate virtual address-space usage, and locate mappings by address or name.", "docname": "runtime/components/memory_layout", "documentID": "02781b3390637c965f23066c46cc3d594310c30a032d12e92f3ec9ff8231c345", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/runtime/components/memory_layout.md", "title": "Memory Layout - Runtime - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/runtime/components/modules.html", "content": "Modules The lief.runtime.Module ( lief::runtime::module::Module ; lief.runtime.Module ; LIEF::runtime::Module ) interface exposes the different modules (executables and shared libraries) that are loaded in the current process. It is a cross-platform API and is extended on each supported platform with OS-specific helpers (e.g. lief.runtime.linux.Module ( lief::runtime::linux::Module ; lief.runtime.linux.Module ; LIEF::runtime::Linux::Module ), lief.runtime.windows.Module ( lief::runtime::windows::Module ; lief.runtime.windows.Module ; LIEF::runtime::windows::Module ), lief.runtime.osx.Module ( lief::runtime::osx::Module ; lief.runtime.osx.Module ; LIEF::runtime::osx::Module )). Enumerate and locate modules The following Linux example enumerates the loaded modules, prints their attributes, and selects libc for later inspection. The enumeration API is shared by all supported platforms: Python for mod in lief.runtime.modules(): print(mod) # Look for the libc if mod.name.startswith(\"libc.so\"): print( f\"libc.so found: {mod.path} ([{mod.imagebase:#010x}, {mod.end:#010x}])\" ) assert isinstance(mod, lief.runtime.linux.Module) libc = mod C++ for (const LIEF::runtime::Module& mod : LIEF::runtime::modules()) { info(\"{}\", mod.to_string()); // Look for the libc if (mod.name().ends_with(\"libc.so\")) { info(\"libc.so found: {} ([{}, {}])\", mod.path(), hex(mod.imagebase()), hex(mod.end())); libc.reset(mod.clone().release()->as()); } } Rust for module in runtime::modules() { println!( \"{} ({:#010x} - {:#010x})\", module.name(), module.imagebase(), module.end() ); if let runtime::Modules::Linux(linux_mod) = module { if linux_mod.name().starts_with(\"libc.so\") { println!( \"libc.so found: {} ([{:#010x}, {:#010x}])\", linux_mod.path(), linux_mod.imagebase(), linux_mod.end() ); libc = Some(linux_mod); } } } For a direct lookup, use lief.runtime.module_from_name() ( lief::runtime::module_from_name ; lief.runtime.module_from_name() ; LIEF::runtime::module_from_name() ), lief.runtime.module_from_path() ( lief::runtime::module_from_path ; lief.runtime.module_from_path() ; LIEF::runtime::module_from_path() ), or lief.runtime.module_from_addr() ( lief::runtime::module_from_addr ; lief.runtime.module_from_addr() ; LIEF::runtime::module_from_addr() ). Name and path lookups use exact matches. Address lookup expects an absolute address in the current process. The platform-specific module interfaces let you parse an image from its path on disk or from its current mapping: Operation Result Parse from the module’s path The executable file as stored on disk, using its file layout Parse from memory The loaded image, which may contain relocations and runtime changes lief.runtime.Module.dump() ( lief::runtime::module::Module::dump ; lief.runtime.Module.dump() ; LIEF::runtime::Module::dump() ) Raw bytes from the module’s mapped address range Parsing produces a LIEF binary object for analysis. Modifying that object does not automatically patch the running module. You should use the memory API when you intend to write to the process’s memory. A raw memory dump is not necessarily a valid on-disk executable. For offline analysis, use the dump-parsing APIs documented for ELF , PE , and Mach-O . Linux On Linux, lief.runtime.linux.Module ( lief::runtime::linux::Module ; lief.runtime.linux.Module ; LIEF::runtime::Linux::Module ) extends the generic interface with platform-specific helpers. In particular, it exposes the lief.runtime.linux.dlopen() ( lief::runtime::linux::dlopen ; lief.runtime.linux.dlopen() ; LIEF::runtime::Linux::dlopen() ) & lief.runtime.linux.Module.dlsym() ( lief::runtime::linux::Module::dlsym ; lief.runtime.linux.Module.dlsym() ; LIEF::runtime::Linux::Module::dlsym() ) and can parse the module directly from its path on disk or from its in-memory representation. The following snippet demonstrates these operations on the libc module: Python print(f\"libc path: {libc.path}\") if __cxa_finalize := libc.dlsym(\"__cxa_finalize\"): __cxa_finalize_addr = lief.to_int(__cxa_finalize) print(f\"{libc.name}!__cxa_finalize: {__cxa_finalize_addr:#010x}\") if malloc := libc.dlsym(\"malloc\"): malloc_addr = lief.to_int(malloc) # lief.to_int is used to convert an opaque pointer (void*) into a # regular Python int print(f\"{libc.name}!malloc: {malloc_addr:#010x}\") # With LIEF extended, we can disassemble the function from its # absolute memory address: if lief.__extended__: for inst in islice(lief.runtime.disassemble(malloc_addr), 4): print(\" \", inst) # This parses the ELF from its path on the disk if (elf_on_disk := libc.parse_from_path()) is not None and ( __cxa_finalize := elf_on_disk.get_symbol(\"__cxa_finalize\") ) is not None: print(f\"__cxa_finalize: {__cxa_finalize.value:#010x}\") # This code loads 'librt.so' and wrap the dlopen handler in a Module. if librt := lief.runtime.linux.dlopen(\"librt.so.1\"): print( f\"librt loaded: {librt.path} (dlopen handler={lief.to_int(librt.handle):#010x})\" ) # Parse the ELF directly from memory. if librt_mem := librt.parse_from_memory(): # This code looks for the relocation associated with the # **imported** symbol `__cxa_finalize` that is defined in the libc. # The relocation holds the address where the function is resolved. # Therefore, by reading this relocation address we can access the # resolved address of `__cxa_finalize`. This address should match # the value previously returned by dlsym __cxa_finalize_reloc = next( ( reloc for reloc in librt_mem.relocations if reloc.symbol is not None and reloc.symbol.name == \"__cxa_finalize\" ), None, ) if __cxa_finalize_reloc is not None: abs_reloc_addr = librt.imagebase + __cxa_finalize_reloc.address # We assume a 64-bit architecture __cxa_finalize_addr = lief.runtime.Memory.read_u64(abs_reloc_addr) print( f\"{librt.name} -> {abs_reloc_addr:#010x} -> {__cxa_finalize_addr:#010x}\" ) C++ info(\"libc path: {}\", libc->path()); if (void* cxa_finalize = libc->dlsym(\"__cxa_finalize\")) { info(\"{}!__cxa_finalize: {}\", libc->name(), hex(reinterpret_cast(cxa_finalize))); } if (void* malloc_fn = libc->dlsym(\"malloc\")) { auto malloc_ptr = reinterpret_cast(malloc_fn); info(\"{}!malloc: {}\", libc->name(), hex(reinterpret_cast(malloc_fn))); auto malloc_instructions = LIEF::runtime::disassemble(malloc_ptr); // Dump the first instructions of malloc for (const LIEF::assembly::Instruction& inst : malloc_instructions | std::views::take(4)) { info(\" {}\", inst.to_string()); } } // This parses the ELF from its path on the disk if (std::unique_ptr elf_on_disk = libc->parse_from_path()) { if (const LIEF::Symbol* sym = elf_on_disk->get_symbol(\"__cxa_finalize\")) { info(\"__cxa_finalize: {}\", hex(sym->value())); } } // This code loads 'librt.so' and wraps the dlopen handle in a Module. if (std::unique_ptr librt = LIEF::runtime::Linux::dlopen(\"librt.so.1\")) { info(\"librt loaded: {} (dlopen handle={})\", librt->path(), hex(reinterpret_cast(librt->handle()))); // Alternately you could do this: { void* handle = dlopen(\"librt.so.1\", RTLD_NOW); auto librt_alt = LIEF::runtime::Linux::Module::from_handle(handle); } // Parse the ELF directly from memory. if (std::unique_ptr librt_mem = librt->parse_from_memory()) { // Look for the relocation associated with the **imported** symbol // `__cxa_finalize` that is defined in the libc. The relocation holds // the address where the function is resolved. Reading this address // gives back the same value previously returned by dlsym. for (const auto& reloc : librt_mem->relocations()) { const auto* sym = reloc.symbol(); if (sym == nullptr || sym->name() != \"__cxa_finalize\") { continue; } uintptr_t abs_reloc_addr = librt->imagebase() + reloc.address(); auto resolved = LIEF::runtime::Memory::read(abs_reloc_addr); info(\"{} -> {} -> {}\", librt->name(), hex(abs_reloc_addr), hex(resolved)); break; } } } Rust println!(\"libc path: {}\", libc.path()); let cxa_finalize = libc.dlsym(\"__cxa_finalize\".to_string()); if !cxa_finalize.is_null() { println!( \"{}!__cxa_finalize: {:#010x}\", libc.name(), cxa_finalize as usize ); } let malloc = libc.dlsym(\"malloc\".to_string()); if !malloc.is_null() { println!(\"{}!malloc: {:#010x}\", libc.name(), malloc as usize); } // Parse the ELF from its path on the disk if let Some(elf_on_disk) = libc.parse_from_path() { for sym in elf_on_disk.dynamic_symbols() { if sym.name() == \"__cxa_finalize\" { println!(\"__cxa_finalize: {:#010x}\", sym.value()); break; } } } // Load 'librt.so' and wrap the dlopen handle in a Module. if let Some(librt) = runtime::linux::dlopen(\"librt.so.1\") { println!( \"librt loaded: {} (dlopen handle={:#010x})\", librt.path(), librt.handle() as usize ); // Parse the ELF directly from memory. if let Some(librt_mem) = librt.parse_from_memory() { // Find the relocation for the imported symbol `__cxa_finalize` // defined in libc. Reading the relocation address returns the // resolved address, which should match what dlsym returned. for reloc in librt_mem.relocations() { let sym = match reloc.symbol() { Some(s) => s, None => continue, }; if sym.name() != \"__cxa_finalize\" { continue; } let abs_reloc_addr = librt.imagebase() + reloc.address(); // Assume a 64-bit architecture let resolved: u64 = unsafe { runtime::Memory::read(abs_reloc_addr) }; println!( \"{} -> {:#010x} -> {:#010x}\", librt.name(), abs_reloc_addr, resolved ); break; } } } Windows On Windows, you can perform similar operations such as in-memory parsing, accessing the HMODULE handle, and resolving functions through a dlsym-like helper: Python print(f\"ntdll path: {ntdll.path}\") if nt_query := ntdll.dlsym(\"NtQueryInformationProcess\"): # lief.to_int converts an opaque pointer (void*) into a regular Python int nt_query_addr = lief.to_int(nt_query) print(f\"{ntdll.name}!NtQueryInformationProcess: {nt_query_addr:#010x}\") # This parses the PE from its path on the disk if pe_on_disk := ntdll.parse_from_path(): print(f\"on-disk imagebase: {pe_on_disk.optional_header.imagebase:#010x}\") if sym := pe_on_disk.get_symbol(\"NtQueryInformationProcess\"): print(f\"NtQueryInformationProcess: {sym.value:#010x}\") # This parses the PE directly from memory if pe_memory := ntdll.parse_from_memory(): imagebase = pe_memory.optional_header.imagebase print(f\"in-memory imagebase: {imagebase:#010x}\") if sym := pe_memory.get_symbol(\"RtlFreeHeap\"): print(f\"RtlFreeHeap: {sym.value:#010x}\") # With LIEF extended, we can disassemble the function directly from # its absolute memory address: if lief.__extended__: for inst in islice(lief.runtime.disassemble(imagebase + sym.value), 4): print(\" \", inst) C++ info(\"ntdll path: {}\", ntdll->path()); if (void* _NtQueryInformationProcess = ntdll->dlsym(\"NtQueryInformationProcess\")) { info(\"{}!NtQueryInformationProcess: {}\", ntdll->name(), hex(reinterpret_cast(_NtQueryInformationProcess))); } if (std::unique_ptr pe_on_disk = ntdll->parse_from_path()) { info(\"on-disk imagebase: {}\", hex(pe_on_disk->optional_header().imagebase())); if (const LIEF::Symbol* sym = pe_on_disk->get_symbol(\"NtQueryInformationProcess\")) { info(\"NtQueryInformationProcess: {}\", hex(sym->value())); } } if (std::unique_ptr pe_memory = ntdll->parse_from_memory()) { const uintptr_t imagebase = pe_memory->optional_header().imagebase(); info(\"in-memory imagebase: {}\", hex(imagebase)); if (const LIEF::Symbol* sym = pe_memory->get_symbol(\"RtlFreeHeap\")) { info(\"RtlFreeHeap: {}\", hex(sym->value())); // Disassemble RtlFreeHeap from memory auto instructions = LIEF::runtime::disassemble(imagebase + sym->value()); auto first_instructions = instructions | std::views::take(4); for (const LIEF::assembly::Instruction& inst : first_instructions) { info(\" {}\", inst.to_string()); } } } Rust println!(\"ntdll path: {}\", ntdll.path()); let nt_query = ntdll.dlsym(\"NtQueryInformationProcess\".to_string()); if !nt_query.is_null() { println!( \"{}!NtQueryInformationProcess: {:#010x}\", ntdll.name(), nt_query as usize ); } // Parse the PE from its path on the disk if let Some(pe_on_disk) = ntdll.parse_from_path() { println!( \"on-disk imagebase: {:#010x}\", pe_on_disk.optional_header().imagebase() ); if let Some(export) = pe_on_disk.export() { if let Some(entry) = export.entry_by_name(\"NtQueryInformationProcess\") { println!(\"NtQueryInformationProcess: {:#010x}\", entry.address()); } } } // Parse the PE directly from memory if let Some(pe_memory) = ntdll.parse_from_memory() { let imagebase = pe_memory.optional_header().imagebase(); println!(\"in-memory imagebase: {:#010x}\", imagebase); if let Some(export) = pe_memory.export() { if let Some(entry) = export.entry_by_name(\"RtlFreeHeap\") { let rva = entry.address() as u64; println!(\"RtlFreeHeap: {:#010x}\", rva); // Disassemble the first instructions of RtlFreeHeap from memory for inst in runtime::disassemble(imagebase + rva).take(4) { println!(\" {}\", inst.to_string()); } } } } macOS System libraries can be located in the Dyld shared cache even when their module paths look like ordinary files. In that case, parsing from the path can fail. The example below parses the mapped library from memory and lists its exported symbols: Python print(f\"libsystem_c path: {libsystem.path}\") if arc4_init := libsystem.dlsym(\"arc4_init\"): # lief.to_int converts an opaque pointer (void*) into a regular Python int arc4_init_addr = lief.to_int(arc4_init) print(f\"{libsystem.name}!arc4_init: {arc4_init_addr:#010x}\") # With LIEF extended, we can disassemble the function directly from its # absolute memory address: if lief.__extended__: for inst in islice(lief.runtime.disassemble(arc4_init_addr), 4): print(\" \", inst) # libsystem.path looks like a valid path but libsystem_c.dylib lives in the # dyld-shared-cache. Therefore, it's pointless to try to parse the library # from its filepath as the library does not exist on the disk. macho_on_disk: lief.MachO.Binary | None = None with lief.logging.level_scope(lief.logging.Level.Off): macho_on_disk = libsystem.parse_from_path() if macho_on_disk is None: print(f\"As expected, {libsystem.path} is not present in the filesystem\") # But we can parse it from memory: if macho_memory := libsystem.parse_from_memory(): print(f\"in-memory imagebase: {macho_memory.imagebase:#010x}\") # List 'exported' symbols for sym in macho_memory.exported_symbols: print(f\"{sym.name:10}: {sym.value:#010x}\") C++ info(\"libsystem_c path: {}\", libsystem->path()); if (void* p_arc4_init = libsystem->dlsym(\"arc4_init\")) { info(\"{}!arc4_init: {}\", libsystem->name(), hex(reinterpret_cast(p_arc4_init))); // Disassemble malloc directly from its resolved memory address auto instructions = LIEF::runtime::disassemble(reinterpret_cast(p_arc4_init)); for (const LIEF::assembly::Instruction& inst : instructions | std::views::take(4)) { info(\" {}\", inst.to_string()); } } // libsystem->path() looks like a valid path but libsystem_c.dylib lives // in the dyld-shared-cache. Therefore, it's pointless to try to parse the // library from its filepath as the library does not exist on the disk std::unique_ptr macho_on_disk; { LIEF::logging::Scoped disable_logger(LIEF::logging::Level::Off); macho_on_disk = libsystem->parse_from_path(); } if (macho_on_disk == nullptr) { info(\"As expected, {} is not present in the filesystem\", libsystem->path()); } // But we can parse it from memory: if (std::unique_ptr macho_memory = libsystem->parse_from_memory()) { info(\"in-memory imagebase: {}\", hex(macho_memory->imagebase())); for (const LIEF::MachO::Symbol& S : macho_memory->exported_symbols()) { info(std::format(\"{:10}: {:#010x}\", S.name(), S.value())); } } Rust println!(\"libsystem_c path: {}\", libsystem.path()); let arc4_init = libsystem.dlsym(\"arc4_init\".to_string()); if !arc4_init.is_null() { println!( \"{}!arc4_init: {:#010x}\", libsystem.name(), arc4_init as usize ); // Disassemble arc4_init directly from its resolved memory address for inst in runtime::disassemble(arc4_init as u64).take(4) { println!(\" {}\", inst.to_string()); } } // libsystem.path() looks like a valid path but libsystem_c.dylib lives in // the dyld-shared-cache. Therefore, it's pointless to try to parse the // library from its filepath as the library does not exist on the disk. let macho_on_disk = { let _scoped = lief::logging::Scoped::new(lief::logging::Level::Off); libsystem.parse_from_path() }; if macho_on_disk.is_none() { println!( \"As expected, {} is not present in the filesystem\", libsystem.path() ); } // But we can parse it from memory: if let Some(macho_memory) = libsystem.parse_from_memory() { println!(\"in-memory imagebase: {:#010x}\", macho_memory.imagebase()); // List 'exported' symbols for sym in macho_memory.exported_symbols() { println!(\"{:10}: {:#010x}\", sym.name(), sym.value()); } } Android On Android, lief.runtime.android.Module ( lief::runtime::android::Module ; lief.runtime.android.Module ; LIEF::runtime::android::Module ) extends the generic interface with the same helpers as on Linux: loading a library with lief.runtime.android.dlopen() ( lief::runtime::android::dlopen ; lief.runtime.android.dlopen() ; LIEF::runtime::android::dlopen() ), resolving symbols with lief.runtime.android.Module.dlsym() ( lief::runtime::android::Module::dlsym ; lief.runtime.android.Module.dlsym() ; LIEF::runtime::android::Module::dlsym() ) and parsing modules from their path on disk. The following snippet demonstrates these operations on the Bionic libc and liblog modules: Python print(f\"libc path: {libc.path}\") if __cxa_finalize := libc.dlsym(\"__cxa_finalize\"): __cxa_finalize_addr = lief.to_int(__cxa_finalize) print(f\"{libc.name}!__cxa_finalize: {__cxa_finalize_addr:#010x}\") if malloc := libc.dlsym(\"malloc\"): malloc_addr = lief.to_int(malloc) print(f\"{libc.name}!malloc: {malloc_addr:#010x}\") # With LIEF extended, we can disassemble the function from its # absolute memory address: if lief.__extended__: for inst in islice(lief.runtime.disassemble(malloc_addr), 4): print(\" \", inst) if (elf_on_disk := libc.parse_from_path()) is not None and ( __cxa_finalize := elf_on_disk.get_symbol(\"__cxa_finalize\") ) is not None: print(f\"__cxa_finalize: {__cxa_finalize.value:#010x}\") if liblog := lief.runtime.android.dlopen(\"liblog.so\"): print( f\"liblog loaded: {liblog.path} \" f\"(dlopen handler={lief.to_int(liblog.handle):#010x})\" ) if log_print := liblog.dlsym(\"__android_log_print\"): log_print_addr = lief.to_int(log_print) print(f\"{liblog.name}!__android_log_print: {log_print_addr:#010x}\") C++ info(\"libc path: {}\", libc->path()); if (void* cxa_finalize = libc->dlsym(\"__cxa_finalize\")) { info(\"{}!__cxa_finalize: {}\", libc->name(), hex(reinterpret_cast(cxa_finalize))); } if (void* malloc_fn = libc->dlsym(\"malloc\")) { auto malloc_ptr = reinterpret_cast(malloc_fn); info(\"{}!malloc: {}\", libc->name(), hex(malloc_ptr)); auto malloc_instructions = LIEF::runtime::disassemble(malloc_ptr); // Dump the first instructions of malloc for (const LIEF::assembly::Instruction& inst : malloc_instructions | std::views::take(4)) { info(\" {}\", inst.to_string()); } } if (std::unique_ptr elf_on_disk = libc->parse_from_path()) { if (const LIEF::Symbol* sym = elf_on_disk->get_symbol(\"__cxa_finalize\")) { info(\"__cxa_finalize: {}\", hex(sym->value())); } } if (std::unique_ptr liblog = LIEF::runtime::android::dlopen(\"liblog.so\")) { info(\"liblog loaded: {} (dlopen handle={})\", liblog->path(), hex(reinterpret_cast(liblog->handle()))); if (void* log_print = liblog->dlsym(\"__android_log_print\")) { info(\"{}!__android_log_print: {}\", liblog->name(), hex(reinterpret_cast(log_print))); } } Rust println!(\"libc path: {}\", libc.path()); let cxa_finalize = libc.dlsym(\"__cxa_finalize\".to_string()); if !cxa_finalize.is_null() { println!( \"{}!__cxa_finalize: {:#010x}\", libc.name(), cxa_finalize as usize ); } let malloc = libc.dlsym(\"malloc\".to_string()); if !malloc.is_null() { println!(\"{}!malloc: {:#010x}\", libc.name(), malloc as usize); } // Parse the ELF from its path on the disk if let Some(elf_on_disk) = libc.parse_from_path() { for sym in elf_on_disk.dynamic_symbols() { if sym.name() == \"__cxa_finalize\" { println!(\"__cxa_finalize: {:#010x}\", sym.value()); break; } } } if let Some(liblog) = runtime::android::dlopen(\"liblog.so\") { println!( \"liblog loaded: {} (dlopen handle={:#010x})\", liblog.path(), liblog.handle() as usize ); let log_print = liblog.dlsym(\"__android_log_print\".to_string()); if !log_print.is_null() { println!( \"{}!__android_log_print: {:#010x}\", liblog.name(), log_print as usize ); } }", "contentHash": "b3020c5f9e9d259f7cd89666fc4651676d52786eafc0875f70f2ee830b5ef487", "description": "Enumerate loaded modules, resolve symbols, parse files and in-memory images, and interpret live addresses with the LIEF runtime API.", "docname": "runtime/components/modules", "documentID": "82f4e7d34cddf7c3de706983e32deb4f87f889f0ee3d53e7f094b51d78362aad", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/runtime/components/modules.md", "title": "Modules - Runtime - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/runtime/components/process.html", "content": "Process The lief.runtime.Process ( lief::runtime::Process ; lief.runtime.Process ; LIEF::runtime::Process ) interface exposes an API to query information about the current process. It provides cross-platform API and is extended on each platform with additional OS-specific helpers. Query the current process Python print(f\" PID: {lief.runtime.Process.pid}\") print(f\" TID: {lief.runtime.Process.tid}\") print(f\" Page size: {lief.runtime.Process.page_size:#06x}\") print(f\" Arch: {lief.runtime.Process.arch}\") print(f\" Platform: {lief.runtime.Process.platform}\") print(f\" TERM: {lief.runtime.Process.get_env('TERM')}\") C++ info(\" PID: {}\", std::to_string(LIEF::runtime::Process::pid())); info(\" TID: {}\", std::to_string(LIEF::runtime::Process::tid())); info(\" Page size: {}\", hex(LIEF::runtime::Process::page_size())); info(\" Arch: {}\", std::to_string((uint32_t)LIEF::runtime::Process::arch())); info(\" Platform: {}\", std::to_string((uint32_t)LIEF::runtime::Process::platform())); if (auto term = LIEF::runtime::Process::get_env(\"TERM\")) { info(\" TERM: {}\", *term); } Rust println!(\" PID: {}\", runtime::Process::pid()); println!(\" TID: {}\", runtime::Process::tid()); println!(\" Page size: {:#06x}\", runtime::Process::page_size()); println!(\" Arch: {:?}\", runtime::Process::arch()); println!(\" Platform: {:?}\", runtime::Process::platform()); Linux On Linux, lief.runtime.linux.Process ( lief::runtime::linux::Process ; lief.runtime.linux.Process ; LIEF::runtime::Linux::Process ) extends the generic interface with platform-specific helpers. For instance, lief.runtime.linux.Process.glibc_version() ( lief::runtime::linux::Process::glibc_version ; lief.runtime.linux.Process.glibc_version ; LIEF::runtime::Linux::Process::glibc_version() ) returns the version of the GNU C Library loaded in the current process: Python print(f\" glibc: {lief.runtime.linux.Process.glibc_version}\") C++ info(\" glibc: {}\", LIEF::runtime::Linux::Process::glibc_version()); Rust if let Some(version) = runtime::linux::Process::glibc_version() { println!(\" glibc: {}\", version); } Windows On Windows, the process interface is extended with lief.runtime.windows.Process ( lief::runtime::windows::Process ; lief.runtime.windows.Process ; LIEF::runtime::windows::Process ) which exposes the Process Environment Block (PEB) of the current process. The returned lief.runtime.windows.PEB ( lief::runtime::windows::PEB ; lief.runtime.windows.PEB ; LIEF::runtime::windows::PEB ) object provides access to some fields of the structure (whether the process is being debugged, the loader data, the process parameters, …): Python if (peb := lief.runtime.windows.Process.peb) is not None: print(f\" PEB.BeingDebugged: {peb.being_debugged}\") print(f\" PEB.Ldr: {peb.ldr:#06x}\") print(f\" PEB.ProcessParameters: {peb.process_parameters:#06x}\") print(f\" PEB.AtlThunkSListPtr: {peb.atl_thunk_slist_ptr:#06x}\") print(f\" PEB.AtlThunkSListPtr32: {peb.atl_thunk_slist_ptr32:#06x}\") print(f\" PEB.PostProcessInitRoutine: {peb.post_process_init_routine:#06x}\") print(f\" PEB.SessionId: {peb.session_id:#06x}\") C++ if (auto peb = LIEF::runtime::windows::Process::peb()) { info(\" PEB.BeingDebugged: {}\", peb->being_debugged() ? \"true\" : \"false\"); info(\" PEB.Ldr: {}\", hex(peb->ldr())); info(\" PEB.ProcessParameters: {}\", hex(peb->process_parameters())); info(\" PEB.AtlThunkSListPtr: {}\", hex(peb->atl_thunk_slist_ptr())); info(\" PEB.AtlThunkSListPtr32: {}\", hex(peb->atl_thunk_slist_ptr32())); info(\" PEB.PostProcessInitRoutine: {}\", hex(peb->post_process_init_routine())); info(\" PEB.SessionId: {}\", hex(peb->session_id())); } Rust if let Some(peb) = runtime::windows::Process::peb() { println!(\" PEB.BeingDebugged: {}\", peb.being_debugged()); println!(\" PEB.Ldr: {:#06x}\", peb.ldr()); println!( \" PEB.ProcessParameters: {:#06x}\", peb.process_parameters() ); println!( \" PEB.AtlThunkSListPtr: {:#06x}\", peb.atl_thunk_slist_ptr() ); println!( \" PEB.AtlThunkSListPtr32: {:#06x}\", peb.atl_thunk_slist_ptr32() ); println!( \" PEB.PostProcessInitRoutine: {:#06x}\", peb.post_process_init_routine() ); println!(\" PEB.SessionId: {:#06x}\", peb.session_id()); } The loader’s module list is exposed through lief.runtime.windows.PEB.entries ( lief::runtime::windows::PEB::entries ; lief.runtime.windows.PEB.entries ; LIEF::runtime::windows::PEB::entries() ), which yields lief.runtime.windows.LdrDataTableEntry ( lief::runtime::windows::LdrDataTableEntry ; lief.runtime.windows.LdrDataTableEntry ; LIEF::runtime::windows::LdrDataTableEntry ) objects. In addition to the base name and image base, each entry exposes the extended LDR_DATA_TABLE_ENTRY fields. Python if (peb := lief.runtime.windows.Process.peb) is not None: first = next(iter(peb.entries), None) if first is not None: print(f\" {first.base_dll_name} extended LDR_DATA_TABLE_ENTRY fields:\") # Always available across the supported Windows versions: print(f\" Flags: {first.flags:#06x}\") print(f\" ObsoleteLoadCount: {first.obsolete_load_count}\") print(f\" TlsIndex: {first.tls_index:#06x}\") print(f\" TimeDateStamp: {first.time_date_stamp:#06x}\") # Attributes that are available only from certain version: if (v := first.ddag_node) is not None: # Windows 8+ print(f\" DdagNode: {v:#06x}\") if (v := first.original_base) is not None: # Windows 8+ print(f\" OriginalBase: {v:#06x}\") if (v := first.load_reason) is not None: # Windows 8+ print(f\" LoadReason: {v}\") if (v := first.signing_level) is not None: # Windows 10+ print(f\" SigningLevel: {v}\") if (v := first.check_sum) is not None: # Windows 10+ print(f\" CheckSum: {v:#06x}\") if (v := first.hot_patch_state) is not None: # Windows 11+ print(f\" HotPatchState: {v}\") C++ if (auto peb = LIEF::runtime::windows::Process::peb()) { auto entries = peb->entries(); auto it = entries.begin(); if (it != entries.end()) { info(\" {} extended LDR_DATA_TABLE_ENTRY fields:\", it->base_dll_name()); // Always available across the supported Windows versions: info(\" Flags: {}\", hex(it->flags())); info(\" ObsoleteLoadCount: {}\", std::to_string(it->obsolete_load_count())); info(\" TlsIndex: {}\", hex(it->tls_index())); info(\" TimeDateStamp: {}\", hex(it->time_date_stamp())); // Version-gated fields: each optional is empty when the host kernel // predates the field, so the OS version drives what gets printed. if (auto v = it->ddag_node()) { // Windows 8+ info(\" DdagNode: {}\", hex(*v)); } if (auto v = it->original_base()) { // Windows 8+ info(\" OriginalBase: {}\", hex(*v)); } if (auto v = it->load_reason()) { // Windows 8+ info(\" LoadReason: {}\", std::to_string(*v)); } if (auto v = it->signing_level()) { // Windows 10+ info(\" SigningLevel: {}\", std::to_string((uint32_t)*v)); } if (auto v = it->check_sum()) { // Windows 10+ info(\" CheckSum: {}\", hex(*v)); } if (auto v = it->hot_patch_state()) { // Windows 11+ info(\" HotPatchState: {}\", std::to_string(*v)); } } } Rust if let Some(peb) = runtime::windows::Process::peb() { if let Some(first) = peb.entries().next() { println!( \" {} extended LDR_DATA_TABLE_ENTRY fields:\", first.base_dll_name() ); // Always available across the supported Windows versions: println!(\" Flags: {:#06x}\", first.flags()); println!(\" ObsoleteLoadCount: {}\", first.obsolete_load_count()); println!(\" TlsIndex: {:#06x}\", first.tls_index()); println!(\" TimeDateStamp: {:#06x}\", first.time_date_stamp()); // Version-gated fields are None when the host kernel predates them: if let Some(v) = first.ddag_node() { println!(\" DdagNode: {:#06x}\", v); // Windows 8+ } if let Some(v) = first.original_base() { println!(\" OriginalBase: {:#06x}\", v); // Windows 8+ } if let Some(v) = first.load_reason() { println!(\" LoadReason: {}\", v); // Windows 8+ } if let Some(v) = first.signing_level() { println!(\" SigningLevel: {}\", v); // Windows 10+ } if let Some(v) = first.check_sum() { println!(\" CheckSum: {:#06x}\", v); // Windows 10+ } if let Some(v) = first.hot_patch_state() { println!(\" HotPatchState: {}\", v); // Windows 11+ } } } macOS On macOS, lief.runtime.osx.Process ( lief::runtime::osx::Process ; lief.runtime.osx.Process ; LIEF::runtime::osx::Process ) extends the generic interface with platform-specific helpers. For instance, lief.runtime.osx.Process.dyld_version() ( lief::runtime::osx::Process::dyld_version ; lief.runtime.osx.Process.dyld_version ; LIEF::runtime::osx::Process::dyld_version() ) returns the version of dyld (the dynamic loader) in the current process: Python print(f\" dyld: {lief.runtime.osx.Process.dyld_version}\") C++ info(\" dyld: {}\", LIEF::runtime::osx::Process::dyld_version()); Rust println!(\" dyld: {}\", runtime::osx::Process::dyld_version()); Android On Android, lief.runtime.android.Process ( lief::runtime::android::Process ; lief.runtime.android.Process ; LIEF::runtime::android::Process ) extends the generic interface. Here are some examples of the API: Python # Access a named property sdk = lief.runtime.android.Process.get_system_property(\"ro.build.version.sdk\") if sdk is not None: print(f\" {sdk.name}: {sdk.value} (serial: {sdk.serial})\") # Iterate over all properties for prop in lief.runtime.android.Process.properties: print(f\" {prop.name}: {prop.value} (serial: {prop.serial})\") C++ if (auto prop = LIEF::runtime::android::Process::get_system_property( \"ro.build.version.sdk\" )) { info(\" {}: {} (serial: {})\", prop->name(), prop->value(), std::to_string(prop->serial())); } for (const auto& prop : LIEF::runtime::android::Process::properties()) { info(\" {}: {} (serial: {})\", prop.name(), prop.value(), std::to_string(prop.serial())); } Rust // Query a single system property by name if let Some(prop) = runtime::android::Process::get_system_property(\"ro.build.version.sdk\") { println!( \" {}: {} (serial: {})\", prop.name(), prop.value(), prop.serial() ); } // Iterate over all properties for prop in runtime::android::Process::properties() { println!( \" {}: {} (serial: {})\", prop.name(), prop.value(), prop.serial() ); }", "contentHash": "5558dd53e3de444cff6c9a5610d5c3b4184e496158788c736dbba9712a71a6d8", "description": "Inspect the current process and thread IDs, page size, environment variables, and platform-specific loader information with LIEF.", "docname": "runtime/components/process", "documentID": "10c31e2eb505c3421202aea5ddcf9e2667feeafc79f9dcbca1db39e6728b0e6e", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/runtime/components/process.md", "title": "Process - Runtime - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/runtime/cpp.html", "content": "C++ Utilities LIEF::runtime::is_enabled static bool LIEF::runtime::is_enabled() Whether the runtime features are enabled. LIEF::runtime::platform static PLATFORMS LIEF::runtime::platform() Platform for which the runtime is compiled. LIEF::runtime::arch static ARCH LIEF::runtime::arch() Architecture for which the runtime is compiled. LIEF::runtime::modules modules_t LIEF::runtime::modules() Return an iterator over the different modules loaded in the current process. LIEF::runtime::assemble std::vector LIEF::runtime::assemble(uint64_t addr, const std::string &Asm, assembly:: AssemblerConfig &config = assembly:: AssemblerConfig :: default_config ()) Assemble the provided assembly code at the specified (absolute) virtual address. The function returns the generated assembly bytes. #include auto code = LIEF::runtime::assemble(0x7f0011223344, R\"( xor rax, rbx; mov rcx, rax; )\"); If you need to configure the assembly engine or to define addresses for symbols, you can provide your own assembly::AssemblerConfig instance. LIEF::runtime::disassemble instructions_it LIEF::runtime::disassemble(uintptr_t addr) Start disassembling instructions at the given absolute virtual address. for (const auto& inst : disassemble(0x7f0011223344)) { std::cout << inst.to_string() << '\\n'; } Process Process class Process This structure represents the current process and provides functions to query process-level information. Subclassed by LIEF::runtime::Linux::Process , LIEF::runtime::android::Process , LIEF::runtime::osx::Process , LIEF::runtime::windows::Process Public Static Functions pid static int32_t pid() Get the Process ID of the current process. tid static uint32_t tid() Get the Thread ID of the current thread. arch static inline ARCH arch() Return the target architecture of the current process. platform static inline PLATFORMS platform() Return the target platform of the current process. page_size static uint32_t page_size() Return the number of bytes in a memory page. For instance: 0x1000 (4096 bytes) for x86_64 0x4000 (16384 bytes) for ARM64 get_env static std::optional get_env(const std::string &key) Return the environment variable associated with the given key. get_envs static EnvVars get_envs() Return the environment variables present in the current process. default_engine static assembly:: Engine *default_engine() Return the assembler/disassembler for the current process. EnvVars struct EnvVars This structure wraps environment variables. Public Functions empty inline bool empty() const Public Members vars std::unordered_map vars Host Host class Host This class represents the current host. Public Static Functions name static std::string name() The machine hostname. home_dir static std::string home_dir() The user home dir (e.g. /home/romain or C:\\Users\\romain ). tmp_dir static std::string tmp_dir() Temporary directory. This function looks at the environment variables to determine the suitable temp directory (e.g. TEMP , TMPDIR ) config_dir static std::string config_dir() The directory to store user-specific configuration. cache_dir static std::string cache_dir() The directory where software should store their cache files (e.g. $HOME/.cache ). Module Module class Module This class represents an in-memory module which can be an executable or a library. Subclassed by LIEF::runtime::Linux::Module , LIEF::runtime::android::Module , LIEF::runtime::osx::Module , LIEF::runtime::windows::Module Public Functions Module Module() = delete Module Module(std::unique_ptr impl) Module Module(const Module &) = delete operator= Module &operator=(const Module &) = delete Module Module( Module &&) noexcept operator= Module &operator=( Module &&) noexcept clone virtual std::unique_ptr< Module > clone() const imagebase uint64_t imagebase() const Base address where the module is loaded in memory. size uint64_t size() const Virtual size of the current module. end inline uint64_t end() const End address of the module. name std::string name() const Name of the module (e.g. libc.so.6, kernel32.dll, libsystem_c.dylib ). path std::string path() const Path of the module. contains inline bool contains(uintptr_t addr) const Check if the current module contains the given address. dump inline std::vector dump() const Return the content of the module as it is currently mapped in memory. The returned buffer spans imagebase() over size() bytes. An empty buffer is returned if the imagebase or the size is null. dump inline std::vector dump(const std::string &filepath) const Same as dump() but also writes the content into the file located at filepath . dump inline std::vector dump(std::ostream &os) const Same as dump() but also writes the content into the given output stream. to_string std::string to_string() const Tas template inline const T *as() const This function can be used to downcast a Module instance. Tas template inline T *as() ~Module virtual ~Module() Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Module &M) Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::forward_iterator_tag, Module , std::ptrdiff_t, const Module *, const Module &> Public Types implementation using implementation = details::ModuleIt Public Functions Iterator Iterator() Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept Iterator Iterator(std::unique_ptr impl) ~Iterator ~Iterator() operator++ Iterator &operator++() operator* const Module &operator*() const operator-> const Module *operator->() const yield std::unique_ptr< Module > yield() Transfer ownership of the module at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) LIEF::runtime::module_from_name inline std::unique_ptr< Module > LIEF::runtime::module_from_name(const std::string &name) Find the module with the given name. LIEF::runtime::module_from_path inline std::unique_ptr< Module > LIEF::runtime::module_from_path(const std::string &path) Find the module with the given path. LIEF::runtime::module_from_addr inline std::unique_ptr< Module > LIEF::runtime::module_from_addr(uintptr_t addr) Find the module that encompasses the given virtual address (absolute). Memory Memory class Memory This class exposes API to access and manage memory. Public Types MMAP_FLAGS enum MMAP_FLAGS Flags used when creating a memory map (mmap). Values: MP_NONE enumerator MP_NONE = 0 MP_PRIVATE enumerator MP_PRIVATE = 1 << 0 Changes are private to this process (copy-on-write). MP_ANONYMOUS enumerator MP_ANONYMOUS = 1 << 1 The mapping is not backed by any file. MP_SHARED enumerator MP_SHARED = 1 << 2 Changes are shared. MP_FIXED enumerator MP_FIXED = 1 << 3 Interpret the address as a fixed requirement. MP_JIT enumerator MP_JIT = 1 << 4 Map for Just-In-Time code generation. PERM enum PERM Values: P_NONE enumerator P_NONE = 0 P_READ enumerator P_READ = 1 << 0 P_WRITE enumerator P_WRITE = 1 << 1 P_EXEC enumerator P_EXEC = 1 << 2 Public Static Functions mmap static std::optional< Chunk > mmap(size_t size, uint32_t flags, uint32_t permissions = P_NONE ) Allocate a memory chunk through mmap-like function. mmap_hint static std::optional< Chunk > mmap_hint(uint64_t hint, size_t size, uint32_t flags, uint32_t permissions = P_NONE ) Allocate a memory chunk through mmap-like function and place the allocation at or near the address given in the first parameter. This address is a hint : it is rounded up to the next page boundary (next allocation granularity on Windows) and the system remains free to return a chunk located somewhere else. munmap static ok_error_t munmap( Chunk &C) Deallocate a mmaped memory chunk. mprotect static ok_error_t mprotect( Chunk &C, uint32_t flags) Sets the permission of the given memory chunk. write static inline ok_error_t write(const uint8_t *buffer, size_t size, uintptr_t addr) Write the buffer at the address given in the third parameter. This function assumes that the memory pointed by addr has the correct permission to write this buffer. write static inline ok_error_t write(const std::vector &buffer, uintptr_t addr) Write the buffer at the address given in the third parameter. This function assumes that the memory pointed by addr has the correct permission to write this buffer. Twrite template && std::is_trivial_v< T >>> static inline ok_error_t write(const T &value, uintptr_t addr) Generic function to write a typed value. Tread template static inline T read(uintptr_t addr) Generic function to read a typed value. read static inline void read(uintptr_t addr, std::vector &out, size_t size) Read the content at the address pointed by the first parameter and write the result in the std::vector provided in the second parameter. read static inline void read(uintptr_t addr, uint8_t *out, size_t size) Read the content at the address pointed by the first parameter and write the result in the buffer provided in the second parameter. This function assumes that the buffer in the second parameter is large enough to contain the data being read. perm_str static std::string perm_str(uint32_t flags) support_rwx static inline bool support_rwx() Chunk class Chunk Represents a contiguous chunk of memory allocated or inspected by the runtime. Public Functions Chunk inline Chunk(void *addr, size_t size, uint32_t permissions) Chunk inline Chunk(void *addr, size_t size) Chunk inline Chunk(void *addr) addr_ptr inline void *addr_ptr() Returns the start address of the memory chunk as an opaque pointer. addr_ptr inline const void *addr_ptr() const addr inline uintptr_t addr() const Returns the start address of the memory chunk. size inline size_t size() const Returns the size of the memory chunk in bytes. permissions inline uint32_t permissions() const Returns the current permissions of the memory chunk. page_start uintptr_t page_start() const Returns the address of the start of the page containing this chunk. page_end uintptr_t page_end() const Returns the address of the end of the page containing this chunk. change_permissions inline Chunk &change_permissions(uint32_t p) Changes the permissions of the memory chunk. make_x inline Chunk &make_x() Sets the permissions to Execute only. make_rw inline Chunk &make_rw() Sets the permissions to Read and Write. make_rx inline Chunk &make_rx() Sets the permissions to Read and Execute. make_rwx inline Chunk &make_rwx() Sets the permissions to Read, Write, and Execute. make_ro inline Chunk &make_ro() Sets the permissions to Read Only. cache_flush Chunk &cache_flush() Flushes the instruction cache for this memory chunk. This should be used when modifying code in memory (e.g., hooking, JIT). is_valid inline bool is_valid() const Check if this chunk is valid. operator bool inline operator bool() const deallocate inline ok_error_t deallocate() to_string std::string to_string() const Friends friend class Memory operator<< inline friend std::ostream &operator<<(std::ostream &os, const Chunk &C) ScopedPermissions class ScopedPermissions RAII interface to change the permission within a determined scope. Public Functions ScopedPermissions inline explicit ScopedPermissions( Chunk &chunk, uint32_t perms) ~ScopedPermissions inline ~ScopedPermissions() MemoryLayout MemoryLayout class MemoryLayout This class exposes the memory layout of the current process. Region class Region A contiguous range of memory mapped in the current process. Public Functions Region Region() = default Region inline Region(std::string name, uint64_t addr, uint64_t size) Region Region(const Region &) = default operator= Region &operator=(const Region &) = default Region Region( Region &&) noexcept = default operator= Region &operator=( Region &&) noexcept = default ~Region ~Region() = default name inline std::string_view name() const Name associated with the region: name/path of the module mapped at this address (e.g. libc.so.6 ) or the identifier of a region that is not backed by a file (e.g. [stack] , [heap] ). It can be empty for anonymous regions. addr inline uint64_t addr() const Address at which the region starts. size inline uint64_t size() const Size of the region. end_addr inline uint64_t end_addr() const Address at which the region ends. contains inline bool contains(uint64_t addr) const Whether the given address is within this region. to_string std::string to_string() const Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Region ®ion) Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::forward_iterator_tag, Region , std::ptrdiff_t, const Region *, const Region &> Forward iterator over the regions of the memory layout. Public Types implementation using implementation = details::MemoryLayoutIt Public Functions Iterator Iterator() Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept Iterator Iterator(std::unique_ptr impl) ~Iterator ~Iterator() operator++ Iterator &operator++() operator* const Region &operator*() const operator-> const Region *operator->() const yield std::unique_ptr< Region > yield() Transfer ownership of the region at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) LIEF::runtime::memory_layout memory_layout_it LIEF::runtime::memory_layout() Return an iterator over the memory layout of the current process. Linux Module Module class Module : public LIEF::runtime:: Module This class exposes a Linux-specific API for a module. Public Functions handle void *handle() const Return the dlopen handle for this library. Return a nullptr if the function fails or if the handler can’t be found dlsym void *dlsym(const std::string &name) const Resolve the symbol with the given name for the current module. parse_from_path std::unique_ptr parse_from_path() const Parse the ELF module from its path on the filesystem. parse_from_path std::unique_ptr parse_from_path(const ELF:: ParserConfig &config) const Parse the ELF module from its path on the filesystem and given the parser configuration. parse_from_memory std::unique_ptr parse_from_memory(const ELF:: ParserConfig &config) const Parse the ELF module from memory with the given configuration. parse_from_memory std::unique_ptr parse_from_memory() const Parse the ELF module from memory. ~Module virtual ~Module() override = default Module Module() = delete Module Module(std::unique_ptr impl) Module Module(const Module &) = delete Module Module( Module &&) noexcept Public Static Functions from_handle static std::unique_ptr< Module > from_handle(void *H) Instantiate a Module from the given dlopen handle. classof static inline bool classof(const runtime:: Module *) LIEF::runtime::Linux::dlopen std::unique_ptr< Module > LIEF::runtime::Linux::dlopen(const std::string &name) Load the library with the given path/name. Host Host class Host This class exposes Linux-specific host information. Public Static Functions sys_name static std::string sys_name() Operating system name (e.g., Linux ). sys_release static std::string sys_release() Operating system release (e.g., 2.6.28 ). sys_version static std::string sys_version() Operating system version. hardware static std::string hardware() Hardware type identifier (e.g., x86_64 ). Process Process class Process : public LIEF::runtime:: Process This class exposes Linux-specific API for the current process. Public Static Functions cmdline static std::string cmdline() Return the content of /proc/cmdline . glibc_version static std::string glibc_version() Return the version of the GNU C Library (glibc) loaded in the current process (e.g. 2.39 ). Return an empty string if the version cannot be determined. classof static inline bool classof(const runtime:: Process *) Android Module Module class Module : public LIEF::runtime:: Module This class exposes Android-specific API for a module. Public Functions handle void *handle() const Return the dlopen handle for this library. Return a nullptr if the function fails or if the handler can’t be found dlsym void *dlsym(const std::string &name) const Resolve the symbol from with the given name for the current module. parse_from_path std::unique_ptr parse_from_path() const Parse the ELF module from its path on the filesystem. parse_from_path std::unique_ptr parse_from_path(const ELF:: ParserConfig &config) const Parse the ELF module from its path on the filesystem and given the parser configuration. parse_from_memory std::unique_ptr parse_from_memory(const ELF:: ParserConfig &config) const Parse the ELF module from memory with the given configuration. parse_from_memory std::unique_ptr parse_from_memory() const Parse the ELF module from memory. ~Module virtual ~Module() override = default Module Module() = delete Module Module(std::unique_ptr impl) Module Module(const Module &) = delete Module Module( Module &&) noexcept Public Static Functions from_handle static std::unique_ptr< Module > from_handle(void *H) Instantiate a Module from the given dlopen handle. classof static inline bool classof(const runtime:: Module *) LIEF::runtime::android::dlopen std::unique_ptr< Module > LIEF::runtime::android::dlopen(const std::string &name) Load the library with the given path/name. Host Host class Host This class exposes Android-specific host information. Public Static Functions sdk_version static std::optional sdk_version() Return the Android SDK/API level of the device (e.g. 34 for Android 14). Process Process class Process : public LIEF::runtime:: Process This class exposes Android-specific API for the current process. Public Types properties_t using properties_t = std::vector< Property > Public Static Functions cmdline static std::string cmdline() Return the content of /proc/cmdline . get_system_property static std::optional< Property > get_system_property(const std::string &name) Return the value of the Android system property with the given name (e.g. ro.build.version.sdk ). properties static properties_t properties() Get all the system properties. classof static inline bool classof(const runtime:: Process *) Property Property class Property This class represents an Android property such as ro.boot.hardware . Public Functions Property Property() = default Property inline Property(std::string name, std::string value, uint32_t serial) Property Property(const Property &) = default operator= Property &operator=(const Property &) = default Property Property( Property &&) noexcept = default operator= Property &operator=( Property &&) noexcept = default ~Property ~Property() = default name inline std::string_view name() const Name of the property (e.g. ro.boot.hardware ). value inline std::string_view value() const Value associated with the property. serial inline uint32_t serial() const Serial number of the property. It is incremented each time the property is updated and can therefore be used to detect changes. to_string std::string to_string() const Pretty representation of the property. Public Static Functions create_from static Property create_from(const prop_info &pi) Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const Property &prop) macOS Module Module class Module : public LIEF::runtime:: Module This class exposes an OSX-specific API for a module. Public Functions handle void *handle() const Return the dlopen handle for this library. Return a nullptr if the function fails or if the handler can’t be found dlsym void *dlsym(const std::string &name) const Resolve the symbol with the given name for the current module. parse_from_path std::unique_ptr parse_from_path() const Parse the Mach-O module from its path on the filesystem. parse_from_path std::unique_ptr parse_from_path(const MachO:: ParserConfig &config) const Parse the Mach-O module from its path on the filesystem with the given parser configuration. parse_from_memory std::unique_ptr parse_from_memory() const Parse the Mach-O module from memory. parse_from_memory std::unique_ptr parse_from_memory(const MachO:: ParserConfig &config) const Parse the Mach-O module from memory with the given configuration. ~Module virtual ~Module() override = default Module Module() = delete Module Module(std::unique_ptr impl) Module Module(const Module &) = delete Module Module( Module &&) noexcept Public Static Functions from_handle static std::unique_ptr< Module > from_handle(void *handle) Instantiate a Module from the given dlopen handle. classof static inline bool classof(const runtime:: Module *) LIEF::runtime::osx::dlopen std::unique_ptr< Module > LIEF::runtime::osx::dlopen(const std::string &name) Load the library with the given path or name. Host Host class Host Public Static Functions os_version_name static std::string os_version_name() The OS version string (e.g. Version 26.2 (Build 25C56) ). os_version static version_t os_version() The OS version (e.g. 13.0.0 ). is_sip_enabled static bool is_sip_enabled() Whether System Integrity Protection (SIP) is enabled on this host. This conservatively returns true when the status can’t be determined (including on a non-macOS build). version_t struct version_t Public Functions version_t inline version_t(uint32_t major, uint32_t minor, uint32_t patch) operator<= bool operator<=(const version_t &rhs) const operator> inline bool operator>(const version_t &rhs) const operator>= bool operator>=(const version_t &rhs) const operator< inline bool operator<(const version_t &rhs) const operator== bool operator==(const version_t &other) const operator!= inline bool operator!=(const version_t &other) const to_string std::string to_string() const Public Members major uint32_t major = 0 minor uint32_t minor = 0 patch uint32_t patch = 0 Public Static Functions BigSur static const version_t &BigSur() Monterey static const version_t &Monterey() Ventura static const version_t &Ventura() Sonoma static const version_t &Sonoma() Sequoia static const version_t &Sequoia() Tahoe static const version_t &Tahoe() Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const version_t version) Process Process class Process : public LIEF::runtime:: Process This class exposes OSX-specific API for the current process. Public Static Functions dyld_version static std::string dyld_version() Return the version of dyld for the current process. classof static inline bool classof(const runtime:: Process *) Windows Module Module class Module : public LIEF::runtime:: Module This class exposes a Windows-specific API for a module. Public Functions handle void *handle() const Return the HMODULE handle as an opaque pointer. Return a nullptr if the function fails or if the handler can’t be found dlsym void *dlsym(const std::string &name) const Resolve the symbol with the given name for the current module. parse_from_path std::unique_ptr parse_from_path() const Parse the PE module from its path on the filesystem. parse_from_path std::unique_ptr parse_from_path(const PE:: ParserConfig &config) const Parse the PE module from its path on the filesystem and given the parser configuration. parse_from_memory std::unique_ptr parse_from_memory(const PE:: ParserConfig &config) const Parse the PE module from memory with the given configuration. parse_from_memory std::unique_ptr parse_from_memory() const Parse the PE module from memory. ~Module virtual ~Module() override = default Module Module() = delete Module Module(std::unique_ptr impl) Module Module(const Module &) = delete Module Module( Module &&) noexcept Public Static Functions from_handle static std::unique_ptr< Module > from_handle(void *H) classof static inline bool classof(const runtime:: Module *) LIEF::runtime::windows::dlopen std::unique_ptr< Module > LIEF::runtime::windows::dlopen(const std::string &name) Load the windows library with the given path or name. LIEF::runtime::windows::find_module std::unique_ptr< Module > LIEF::runtime::windows::find_module(const std::string &name) Try to get the Module with the given name. Return a nullptr if the module is not found if (auto ntdll = find_module(\"ntdll.dll\")) { std::cout << ntdll->path() << '\\n'; } Note This function relies on the Windows API GetModuleHandle which is more efficient than the generic implementation LIEF::runtime::module_from_name Host Host class Host This class exposes Windows-specific host information. Public Static Functions version static version_t version() Return the Windows version (e.g., 10.0.26200 ). version_t struct version_t Public Functions version_t version_t() = default version_t inline version_t(uint32_t major, uint32_t minor, uint32_t build_number) operator<= bool operator<=(const version_t &rhs) const operator> inline bool operator>(const version_t &rhs) const operator>= bool operator>=(const version_t &rhs) const operator< inline bool operator<(const version_t &rhs) const operator== bool operator==(const version_t &other) const operator!= inline bool operator!=(const version_t &other) const to_string std::string to_string() const Public Members major uint32_t major = 0 minor uint32_t minor = 0 build_number uint32_t build_number = 0 Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const version_t &version) Injector injection_context_t struct injection_context_t Describes how to spawn a new process and inject a library into it. Public Functions validate bool validate() const Check whether the context is consistent (required paths filled-in and readable). operator bool inline operator bool() const to_string std::string to_string() const Public Members target_path std::string target_path Absolute path to the target executable to spawn. args std::string args Command-line arguments passed to the spawned process. library std::string library Absolute path to the library (DLL) that should be injected. env std::unordered_map env Environment variables to set in the spawned process. If left empty, the current process environment is inherited. Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const injection_context_t &ctx) LIEF::runtime::windows::inject_spawn ok_error_t LIEF::runtime::windows::inject_spawn(const injection_context_t &ctx) Spawn the target described by the given injection context and inject the associated library before the main thread starts executing. This is the Windows equivalent of a “create suspended + remote LoadLibrary” approach. Process Process class Process : public LIEF::runtime:: Process This class exposes Windows-specific API for the current process. Public Static Functions peb static std::unique_ptr< PEB > peb() Return an interface over the internal Process Environment Block ( PEB ). classof static inline bool classof(const runtime:: Process *) PEB PEB class PEB This class exposes a user-friendly interface over the Process Environment Block ( PEB ) of the current process. An instance can be created through LIEF::runtime::windows::Process::peb() . if (auto peb = LIEF::runtime::windows::Process::peb()) { if (peb->being_debugged()) { // A debugger is attached to the current process } } Public Types entries_it using entries_it = iterator_range < LdrDataTableEntry :: Iterator > Iterator over the LdrDataTableEntry referenced by the loader data. Public Functions PEB PEB() = delete PEB PEB(const PEB &) = delete operator= PEB &operator=(const PEB &) = delete PEB PEB( PEB &&) noexcept operator= PEB &operator=( PEB &&) noexcept being_debugged bool being_debugged() const Whether the current process is being debugged. ldr uintptr_t ldr() const Address of the loader data structure ( PEB_LDR_DATA ). process_parameters uintptr_t process_parameters() const Address of the process parameters ( RTL_USER_PROCESS_PARAMETERS ). atl_thunk_slist_ptr uintptr_t atl_thunk_slist_ptr() const Address of the per-process ATL thunk SList (single-linked list). atl_thunk_slist_ptr32 uint32_t atl_thunk_slist_ptr32() const 32-bit value of the ATL thunk SList pointer. post_process_init_routine uintptr_t post_process_init_routine() const Address of the routine called once the process completed its initialization ( PostProcessInitRoutine ). session_id uint32_t session_id() const Session ID associated with the current process. entries entries_it entries() const Return a bidirectional iterator over the modules referenced by the loader data ( Ldr ). if (auto peb = LIEF::runtime::windows::Process::peb()) { for (const LdrDataTableEntry& entry : peb->entries()) { // entry.base_dll_name(), entry.dll_base(), ... } } ~PEB ~PEB() Friends friend class Process LdrDataTableEntry LdrDataTableEntry class LdrDataTableEntry This class exposes a user-friendly interface over a LDR_DATA_TABLE_ENTRY , the structure used by the Windows loader to describe a module loaded in the current process. Public Functions LdrDataTableEntry LdrDataTableEntry() = delete LdrDataTableEntry LdrDataTableEntry(std::unique_ptr impl) LdrDataTableEntry LdrDataTableEntry(const LdrDataTableEntry &) = delete operator= LdrDataTableEntry &operator=(const LdrDataTableEntry &) = delete LdrDataTableEntry LdrDataTableEntry( LdrDataTableEntry &&) noexcept operator= LdrDataTableEntry &operator=( LdrDataTableEntry &&) noexcept dll_base uintptr_t dll_base() const Base address at which the module is mapped in memory ( DllBase ). entry_point uintptr_t entry_point() const Address of the entry point of the module ( EntryPoint ). size_of_image uint32_t size_of_image() const Size (in bytes) of the module’s image in memory ( SizeOfImage ). full_dll_name std::string full_dll_name() const Full path of the module ( FullDllName ), e.g. C:\\Windows\\System32\\ntdll.dll . base_dll_name std::string base_dll_name() const Base name of the module ( BaseDllName ), e.g. ntdll.dll . flags uint32_t flags() const Loader flags describing the state of the module ( Flags ). obsolete_load_count uint16_t obsolete_load_count() const Legacy load count of the module ( ObsoleteLoadCount ). Superseded by reference_count() on Windows 8 and later. tls_index uint16_t tls_index() const TLS slot index assigned to the module, or 0 when it has no TLS ( TlsIndex ). time_date_stamp uint32_t time_date_stamp() const TimeDateStamp of the module as cached by the loader. entry_point_activation_context uintptr_t entry_point_activation_context() const Address of the activation context associated with the module’s entry point. lock uintptr_t lock() const Address of the per-entry loader lock. ddag_node std::optional ddag_node() const Address of the dependency-graph node of the module ( DdagNode ). Note Available on Windows 8 and later. load_context std::optional load_context() const Address of the loader context used while the module is being snapped. Note Available on Windows 8 and later. parent_dll_base std::optional parent_dll_base() const Base address of the module that triggered the load of this one. Note Available on Windows 8 and later. switch_back_context std::optional switch_back_context() const Address of the CHPE switch-back context. Note Available on Windows 8 and later. original_base std::optional original_base() const Preferred base address recorded in the PE headers. Note Available on Windows 8 and later. load_time std::optional load_time() const Time at which the module was loaded. Note Available on Windows 8 and later. base_name_hash_value std::optional base_name_hash_value() const Hash of the module’s base name used to index the loader tables. Note Available on Windows 8 and later. load_reason std::optional load_reason() const Reason why the module was loaded, as a LDR_DLL_LOAD_REASON value. Note Available on Windows 8 and later. implicit_path_options std::optional implicit_path_options() const Path-search options implied when the module was resolved. Note Available on Windows 8 and later. reference_count std::optional reference_count() const Number of references currently held on the module. Note Available on Windows 8 and later. dependent_load_flags std::optional dependent_load_flags() const Flags controlling how the statically-linked dependencies of the module are loaded. Note Available on Windows 8 and later. signing_level std::optional signing_level() const Signing level of the module’s image, as a SE_SIGNING_LEVEL value. Note Available on Windows 10 and later. check_sum std::optional check_sum() const Image checksum cached by the loader. Note Available on Windows 10 and later. active_patch_image_base std::optional active_patch_image_base() const Base address of the active hot-patch image, if any. Note Available on Windows 11 and later. hot_patch_state std::optional hot_patch_state() const State of the hot-patch engine for this module, as a LDR_HOT_PATCH_STATE value. Note Available on Windows 11 and later. to_string std::string to_string() const Pretty-printed representation of this entry. ~LdrDataTableEntry ~LdrDataTableEntry() Friends operator<< inline friend std::ostream &operator<<(std::ostream &os, const LdrDataTableEntry &entry) Iterator class Iterator : public LIEF::iterator_facade_base< Iterator , std::bidirectional_iterator_tag, LdrDataTableEntry , std::ptrdiff_t, const LdrDataTableEntry *, const LdrDataTableEntry &> Bidirectional iterator over the LdrDataTableEntry mirroring the doubly-linked list used by Windows. Public Types implementation using implementation = details::ldr_entry_it Public Functions Iterator Iterator() Iterator Iterator(std::unique_ptr impl) Iterator Iterator(const Iterator &) operator= Iterator &operator=(const Iterator &) Iterator Iterator( Iterator &&) noexcept operator= Iterator &operator=( Iterator &&) noexcept ~Iterator ~Iterator() operator++ Iterator &operator++() operator-- Iterator &operator--() operator* const LdrDataTableEntry &operator*() const operator-> const LdrDataTableEntry *operator->() const yield std::unique_ptr< LdrDataTableEntry > yield() Transfer ownership of the entry at the current position to the caller. Returns nullptr if the iterator is past-the-end. operator++ inline DerivedT operator++(int) operator-- inline DerivedT operator--(int) Friends operator== friend bool operator==(const Iterator &LHS, const Iterator &RHS) operator!= inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS) ARCH LIEF::runtime::ARCH enum class LIEF::runtime::ARCH : uint32_t Values: NONE enumerator NONE X86_64 enumerator X86_64 ARM64 enumerator ARM64 RISCV64 enumerator RISCV64 PLATFORMS LIEF::runtime::PLATFORMS enum class LIEF::runtime::PLATFORMS : uint32_t Values: NONE enumerator NONE = 0 LINUX enumerator LINUX WINDOWS enumerator WINDOWS ANDROID_ enumerator ANDROID_ OSX enumerator OSX IOS enumerator IOS", "contentHash": "3b45de75576df48592fc359b2e26271b8e640d413bc1e68d403ed9fe480991c0", "description": "Runtime C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "runtime/cpp", "documentID": "dcb21aea2e98b1d6911a096db20ecfc07520ef1f2b4596ea86a4c337b8492e63", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/runtime/cpp.md", "title": "Runtime C++ API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/runtime/intro.html", "content": "Runtime Components Host Process Memory Memory Layout Modules API C++ Python Rust Introduction LIEF’s runtime module provides facilities to inspect and interact with the current process in which the API is used. You can, for instance, list modules loaded in memory or read the content at a specific memory address. These runtime features are not enabled by default and must be explicitly turned on when compiling LIEF. When using CMake, you must enable the LIEF_RUNTIME option ( -DLIEF_RUNTIME=ON ) followed by the target platform and the architecture for which you want to use the runtime API: $ cmake [...] \\ -DLIEF_RUNTIME=ON \\ -DLIEF_RUNTIME_PLATFORM=windows \\ -DLIEF_RUNTIME_ARCH=arm64 Note Only arm64 , x86_64 and riscv64 are currently supported for LIEF_RUNTIME_ARCH . The supported values for LIEF_RUNTIME_PLATFORM are linux , windows , android and osx . To compile the Python bindings with the runtime features, you must enable the lief.features.runtime option and specify the target platform and architecture within the [lief.runtime] block: [lief.build] type = \"Release\" cache = true ninja = true parallel-jobs = 0 [lief.formats] elf = true pe = true macho = true android = true art = true vdex = true oat = true dex = true [lief.features] json = true frozen = true runtime = true [lief.runtime] platform = 'linux' architecture = 'x86_64' The runtime features are split in the following components: Components Host Process Memory Memory Layout Modules API reference C++ Python Rust", "contentHash": "34c7a81fad53c9cb9915e8bf0db6a4c35ba99b29ee8acadb3f425cf0d118e9c7", "description": "Enable LIEF's runtime API and inspect the current process, loaded modules, host information, and memory in Python, C++, and Rust.", "docname": "runtime/intro", "documentID": "95d19b36095de51590ca6f781d05ba08be951212840a3881ee2a21fe6a13ae20", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/runtime/intro.md", "title": "Runtime - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/runtime/python.html", "content": "Python Python void* The Python bindings manage opaque void* pointers as Capsules . Given a Capsule, there is no easy way to convert it into a raw address and vice versa. To address this limitation, LIEF exposes lief.to_int() and lief.to_ptr() to convert back and forth between raw addresses and pointers. Utilities lief.to_int lief.to_int( ptr: typing_extensions.CapsuleType ) → int Convert an opaque pointer into an address (int) lief.to_ptr lief.to_ptr( ptr: int ) → typing_extensions.CapsuleType Convert an integer into an opaque pointer ( void* ) runtime.enabled runtime.enabled = False runtime.platform runtime.platform = 0 runtime.arch runtime.arch = 0 lief.runtime.modules lief.runtime.modules() → Iterator[ lief.runtime.Module | None] Return an iterator over the different modules loaded in the current process lief.runtime.assemble lief.runtime.assemble( address: int , assembly: str , config: lief.assembly.AssemblerConfig ) → bytes Assemble the provided assembly code at the specified (absolute) virtual address. The function returns the generated assembly bytes. from lief import runtime code = runtime.assemble(0x7f0011223344, \"\"\" xor rax, rbx; mov rcx, rax; \"\"\") If you need to configure the assembly engine or to define addresses for symbols, you can provide your own AssemblerConfig instance. lief.runtime.disassemble lief.runtime.disassemble( addr: int ) → Iterator[ lief.assembly.Instruction | None] Start disassembling instructions at the given absolute virtual address. from lief import runtime for inst in runtime.disassemble(0x7f0011223344): print(inst) See also lief.assembly.Instruction Host lief.runtime.Host class lief.runtime.Host Bases: object This class represents the current host. cache_dir cache_dir = '' config_dir config_dir = '' home_dir home_dir = '' name name = '' tmp_dir tmp_dir = '' Process lief.runtime.Process class lief.runtime.Process Bases: object This class represents the current process and provides functions to query process-level information. EnvVars class EnvVars Bases: object This structure wraps environment variables vars property vars → dict[str, str] arch arch = 0 envs envs = get_env get_env( key: str ) → str | None = page_size page_size = 0 pid pid = -1 platform platform = 0 tid tid = 0 Module lief.runtime.Module class lief.runtime.Module Bases: object This class represents an in-memory module which can be an executable or a library contains contains( self , addr: int ) → bool Check if the current module contains the given address dumpdump dump( self ) → bytes dump( self , filepath: str ) → bytes Overloaded function. dump(self) -> bytes Return the content of the module as it is currently mapped in memory dump(self, filepath: str) -> bytes Same as dump() but also write the content into the file given in parameter end property end → int End address of the module imagebase property imagebase → int Imagebase of the module name property name → str Name of the module (e.g. libc.so.6, kernel32.dll, libsystem_c.dylib ) path property path → str Path of the module size property size → int Virtual size of the current module lief.runtime.module_from_name lief.runtime.module_from_name( name: str ) → lief.runtime.Module | None Find the module with the given name lief.runtime.module_from_path lief.runtime.module_from_path( path: str ) → lief.runtime.Module | None Find the module with the given path lief.runtime.module_from_addr lief.runtime.module_from_addr( addr: int ) → lief.runtime.Module | None Find the module that encompasses the given virtual address (absolute) Memory lief.runtime.Memory class lief.runtime.Memory Bases: object This class exposes API to access and manage memory ANONYMOUS ANONYMOUS = 2 ChunkChunkChunk class Chunk( self , addr: typing_extensions.CapsuleType , size: int , permissions: int ) **class Chunk( self , addr: typing_extensions.CapsuleType , size: int ) class Chunk( self , addr: typing_extensions.CapsuleType ) ** Bases: object Represents a contiguous chunk of memory allocated or inspected by the runtime. addr property addr → int Returns the start address of the memory chunk addr_ptr property addr_ptr → typing_extensions.CapsuleType Returns the start address of the memory chunk as an opaque pointer cache_flush cache_flush( self ) → lief._lief.runtime.Memory.Chunk Flushes the instruction cache for this memory chunk. This should be used when modifying code in memory (e.g., hooking, JIT). change_permissions change_permissions( self , permission: int ) → lief._lief.runtime.Memory.Chunk Changes the permissions of the memory chunk. deallocate deallocate( self ) → lief._lief.ok_error_t is_valid is_valid( self ) → bool make_ro make_ro( self ) → lief._lief.runtime.Memory.Chunk Sets the permissions to Read Only. make_rw make_rw( self ) → lief._lief.runtime.Memory.Chunk Sets the permissions to Read and Write. make_rwx make_rwx( self ) → lief._lief.runtime.Memory.Chunk Sets the permissions to read/write/exec make_rx make_rx( self ) → lief._lief.runtime.Memory.Chunk Sets the permissions to Read and Execute. make_x make_x( self ) → lief._lief.runtime.Memory.Chunk Sets the permissions to Execute only. page_end property page_end → int Returns the address of the end of the page containing this chunk. page_start property page_start → int Returns the address of the start of the page containing this chunk. permissions property permissions → int Returns the current permissions of the memory chunk. size property size → int Returns the size of the memory chunk in bytes. EXEC EXEC = 4 FIXED FIXED = 8 JIT JIT = 16 MMAP_FLAGS class MMAP_FLAGS( *values ) Bases: IntFlag Flags used when creating a memory map (mmap). ANONYMOUS ANONYMOUS = 2 FIXED FIXED = 8 JIT JIT = 16 NONE NONE = 0 PRIVATE PRIVATE = 1 SHARED SHARED = 4 NONE NONE = 0 PERM class PERM( *values ) Bases: IntFlag EXEC EXEC = 4 NONE NONE = 0 READ READ = 1 WRITE WRITE = 2 PRIVATE PRIVATE = 1 READ READ = 1 SHARED SHARED = 4 WRITE WRITE = 2 mmap mmap( size: int , flags: int , permissions: int ) → lief.runtime.Memory.Chunk | None = mmap_hint mmap_hint( hint: int , size: int , flags: int , permissions: int ) → lief.runtime.Memory.Chunk | None = mprotect mprotect( chunk: lief.runtime.Memory.Chunk , flags: int ) → lief.ok_error_t = munmap munmap( chunk: lief.runtime.Memory.Chunk ) → lief.ok_error_t = perm_str perm_str( flags: int ) → str = read read( addr: int , out: typing_extensions.CapsuleType , size: int ) → None | bytes = read_i16 read_i16( addr: int ) → int = read_i32 read_i32( addr: int ) → int = read_i64 read_i64( addr: int ) → int = read_i8 read_i8( addr: int ) → int = read_u16 read_u16( addr: int ) → int = read_u32 read_u32( addr: int ) → int = read_u64 read_u64( addr: int ) → int = read_u8 read_u8( addr: int ) → int = write write( buffer: bytes , addr: int ) → lief.ok_error_t = write_i16 write_i16( value: int , addr: int ) → lief.ok_error_t = write_i32 write_i32( value: int , addr: int ) → lief.ok_error_t = write_i64 write_i64( value: int , addr: int ) → lief.ok_error_t = write_i8 write_i8( value: int , addr: int ) → lief.ok_error_t = write_u16 write_u16( value: int , addr: int ) → lief.ok_error_t = write_u32 write_u32( value: int , addr: int ) → lief.ok_error_t = write_u64 write_u64( value: int , addr: int ) → lief.ok_error_t = write_u8 write_u8( value: int , addr: int ) → lief.ok_error_t = MemoryLayout lief.runtime.MemoryLayout class lief.runtime.MemoryLayout Bases: object This class exposes the memory layout of the current process. Region class Region Bases: object A contiguous range of memory mapped in the current process. addr property addr → int Address at which the region starts contains contains( self , addr: int ) → bool Whether the given address is within this region end_addr property end_addr → int Address at which the region ends name property name → str Name associated with the region: the name or the path of the module mapped at this address (e.g. libc.so.6 ) or the identifier of a region that is not backed by a file (e.g. [stack] , [heap] ). It can be empty for anonymous regions. size property size → int Size of the region lief.runtime.memory_layout lief.runtime.memory_layout() → Iterator[ lief.runtime.MemoryLayout.Region | None] Return an iterator over the memory layout of the current process Linux Module lief.runtime.linux.Module class lief.runtime.linux.Module Bases: Module This class exposes a Linux-specific API for a module dlsym dlsym( self , name: str ) → typing_extensions.CapsuleType Resolve the symbol with the given name for the current module from_handle from_handle( handle: typing_extensions.CapsuleType ) → lief.runtime.linux.Module | None = handle property handle → typing_extensions.CapsuleType Return the dlopen handle for this library as an opaque pointer. Return None if the function fails or if the handler can’t be found parse_from_memoryparse_from_memory parse_from_memory( self ) → lief._lief.ELF.Binary | None parse_from_memory( self , config: lief._lief.ELF.ParserConfig ) → lief._lief.ELF.Binary | None Overloaded function. parse_from_memory(self) -> Optional[lief._lief.ELF.Binary] Parse the ELF module from memory parse_from_memory(self, config: lief._lief.ELF.ParserConfig) -> Optional[lief._lief.ELF.Binary] Parse the ELF module from memory with the given configuration parse_from_pathparse_from_path parse_from_path( self ) → lief._lief.ELF.Binary | None parse_from_path( self , config: lief._lief.ELF.ParserConfig ) → lief._lief.ELF.Binary | None Overloaded function. parse_from_path(self) -> Optional[lief._lief.ELF.Binary] Parse the ELF module from its path on the filesystem parse_from_path(self, config: lief._lief.ELF.ParserConfig) -> Optional[lief._lief.ELF.Binary] Parse the ELF module from its path on the filesystem and given the parser configuration lief.runtime.linux.dlopen lief.runtime.linux.dlopen( name: str | os.PathLike ) → lief.runtime.linux.Module | None Load the library with the given path or name. Host lief.runtime.linux.Host class lief.runtime.linux.Host Bases: object This class exposes Linux-specific host information. hardware hardware = '' sys_name sys_name = '' sys_release sys_release = '' sys_version sys_version = '' Process lief.runtime.linux.Process class lief.runtime.linux.Process Bases: Process This class exposes Linux-specific API for the current process. cmdline cmdline = '' glibc_version glibc_version = '' Android Module lief.runtime.android.Module class lief.runtime.android.Module Bases: Module This class exposes an Android-specific API for a module dlsym dlsym( self , name: str ) → typing_extensions.CapsuleType Resolve the symbol with the given name for the current module from_handle from_handle( handle: typing_extensions.CapsuleType ) → lief.runtime.android.Module | None = handle property handle → typing_extensions.CapsuleType Return the dlopen handle for this library. Return a nullptr if the function fails or if the handler can’t be found parse_from_memoryparse_from_memory parse_from_memory( self ) → lief._lief.ELF.Binary | None parse_from_memory( self , config: lief._lief.ELF.ParserConfig ) → lief._lief.ELF.Binary | None Overloaded function. parse_from_memory(self) -> Optional[lief._lief.ELF.Binary] Parse the ELF module from memory parse_from_memory(self, config: lief._lief.ELF.ParserConfig) -> Optional[lief._lief.ELF.Binary] Parse the ELF module from memory with the given configuration parse_from_pathparse_from_path parse_from_path( self ) → lief._lief.ELF.Binary | None parse_from_path( self , config: lief._lief.ELF.ParserConfig ) → lief._lief.ELF.Binary | None Overloaded function. parse_from_path(self) -> Optional[lief._lief.ELF.Binary] Parse the ELF module from its path on the filesystem parse_from_path(self, config: lief._lief.ELF.ParserConfig) -> Optional[lief._lief.ELF.Binary] Parse the ELF module from its path on the filesystem and given the parser configuration lief.runtime.android.dlopen lief.runtime.android.dlopen( name: str | os.PathLike ) → lief.runtime.android.Module | None Load the library with the given path/name Host lief.runtime.android.Host class lief.runtime.android.Host Bases: object This class exposes Android-specific host information. sdk_version sdk_version = None Process lief.runtime.android.Process class lief.runtime.android.Process Bases: Process This class exposes Android-specific API for the current process. cmdline cmdline = '' get_system_property get_system_property( name: str ) → lief.runtime.android.Property | None = properties properties = [] Property lief.runtime.android.Property class lief.runtime.android.Property Bases: object This class represents an Android system property such as ro.boot.hardware . name property name → str Name of the property (e.g. ro.boot.hardware ) serial property serial → int Serial number of the property. value property value → str Value associated with the property macOS Module lief.runtime.osx.Module class lief.runtime.osx.Module Bases: Module This class exposes an OSX-specific API for a module dlsym dlsym( self , name: str ) → typing_extensions.CapsuleType Resolve the symbol with the given name for the current module from_handle from_handle( handle: typing_extensions.CapsuleType ) → lief.runtime.osx.Module | None = handle property handle → typing_extensions.CapsuleType Return the dlopen handle for this library as an opaque pointer. Return None if the function fails or if the handler can’t be found parse_from_memoryparse_from_memory parse_from_memory( self ) → lief._lief.MachO.Binary | None parse_from_memory( self , config: lief._lief.MachO.ParserConfig ) → lief._lief.MachO.Binary | None Overloaded function. parse_from_memory(self) -> Optional[lief._lief.MachO.Binary] Parse the Mach-O module from memory parse_from_memory(self, config: lief._lief.MachO.ParserConfig) -> Optional[lief._lief.MachO.Binary] Parse the Mach-O module from memory with the given configuration parse_from_pathparse_from_path parse_from_path( self ) → lief._lief.MachO.Binary | None parse_from_path( self , config: lief._lief.MachO.ParserConfig ) → lief._lief.MachO.Binary | None Overloaded function. parse_from_path(self) -> Optional[lief._lief.MachO.Binary] Parse the Mach-O module from its path on the filesystem parse_from_path(self, config: lief._lief.MachO.ParserConfig) -> Optional[lief._lief.MachO.Binary] Parse the Mach-O module from its path on the filesystem and given the parser configuration Host lief.runtime.osx.Host class lief.runtime.osx.Host Bases: object This class exposes OSX-specific host information. is_sip_enabled is_sip_enabled = True os_version os_version = os_version_name os_version_name = '' version_t class version_t( self , major: int , minor: int , patch: int ) Bases: object This class represents a macOS version number (major.minor.patch). big_sur big_sur → lief.runtime.osx.Host.version_t = major property major → int Major version number minor property minor → int Minor version number monterey monterey → lief.runtime.osx.Host.version_t = patch property patch → int Patch version number sequoia sequoia → lief.runtime.osx.Host.version_t = sonoma sonoma → lief.runtime.osx.Host.version_t = tahoe tahoe → lief.runtime.osx.Host.version_t = ventura ventura → lief.runtime.osx.Host.version_t = Process lief.runtime.osx.Process class lief.runtime.osx.Process Bases: Process This class exposes OSX-specific API for the current process. dyld_version dyld_version = '' Windows Module lief.runtime.windows.Module class lief.runtime.windows.Module Bases: Module This class exposes a Windows-specific API for a module dlsym dlsym( self , name: str ) → typing_extensions.CapsuleType Resolve the symbol with the given name for the current module from_handle from_handle( handle: typing_extensions.CapsuleType ) → lief.runtime.windows.Module | None = handle property handle → typing_extensions.CapsuleType Return the HMODULE handle as an opaque pointer. Return None if the function fails or if the handler can’t be found parse_from_memoryparse_from_memory parse_from_memory( self ) → lief._lief.PE.Binary | None parse_from_memory( self , config: lief._lief.PE.ParserConfig ) → lief._lief.PE.Binary | None Overloaded function. parse_from_memory(self) -> Optional[lief._lief.PE.Binary] Parse the PE module from memory parse_from_memory(self, config: lief._lief.PE.ParserConfig) -> Optional[lief._lief.PE.Binary] Parse the PE module from memory with the given configuration parse_from_pathparse_from_path parse_from_path( self ) → lief._lief.PE.Binary | None parse_from_path( self , config: lief._lief.PE.ParserConfig ) → lief._lief.PE.Binary | None Overloaded function. parse_from_path(self) -> Optional[lief._lief.PE.Binary] Parse the PE module from its path on the filesystem parse_from_path(self, config: lief._lief.PE.ParserConfig) -> Optional[lief._lief.PE.Binary] Parse the PE module from its path on the filesystem and given the parser configuration lief.runtime.windows.dlopen lief.runtime.windows.dlopen( name: str | os.PathLike ) → lief.runtime.windows.Module | None Load the windows library with the given path or name. lief.runtime.windows.find_module lief.runtime.windows.find_module( name: str ) → lief.runtime.windows.Module | None Try to get the Module with the given name. Return None if the module is not found. if ntdll := lief.runtime.windows.find_module(\"ntdll.dll\"): print(ntdll.path) Note This function relies on the Windows API GetModuleHandle which is more efficient than the generic implementation lief.runtime.module_from_name() . Host lief.runtime.windows.Host class lief.runtime.windows.Host Bases: object This class exposes Windows-specific host information. version version = version_tversion_t class version_t( self ) class version_t( self , major: int , minor: int , build_number: int ) Bases: object This class represents a Windows version number. build_number property build_number → int Build number major property major → int Major version number minor property minor → int Minor version number Injector lief.runtime.windows.injection_context_t class lief.runtime.windows.injection_context_t( self ) Bases: object Describes how to spawn a new process and inject a library into it. args property args → str Command-line arguments passed to the spawned process. env property env → dict[str, str] Environment variables to set in the spawned process. If left empty, the current process environment is inherited. library property library → str Absolute path to the library (DLL) that should be injected. target_path property target_path → str Absolute path to the target executable to spawn. lief.runtime.windows.inject_spawn lief.runtime.windows.inject_spawn( ctx: lief.runtime.windows.injection_context_t ) → lief.ok_t | lief.lief_errors Spawn the target described by the given injection context and inject the associated library before the main thread starts executing. Process lief.runtime.windows.Process class lief.runtime.windows.Process Bases: Process This class exposes Windows-specific API for the current process. peb peb = None PEB lief.runtime.windows.PEB class lief.runtime.windows.PEB Bases: object This class exposes a user-friendly interface over the Process Environment Block (PEB) of the current process. It can be accessed through lief.runtime.windows.Process.peb . atl_thunk_slist_ptr property atl_thunk_slist_ptr → int Address of the per-process ATL thunk SList (single-linked list). atl_thunk_slist_ptr32 property atl_thunk_slist_ptr32 → int 32-bit value of the ATL thunk SList pointer. being_debugged property being_debugged → bool Whether the current process is being debugged. entries property entries → Iterator[ lief.runtime.windows.LdrDataTableEntry | None] Iterate over the modules referenced by the loader data of the PEB, in load order, yielding LdrDataTableEntry objects. ldr property ldr → int Address of the loader data structure ( PEB_LDR_DATA ) which holds the list of the modules loaded in the current process. post_process_init_routine property post_process_init_routine → int Address of the routine called once the process completed its initialization ( PostProcessInitRoutine ). process_parameters property process_parameters → int Address of the process parameters ( RTL_USER_PROCESS_PARAMETERS ) which holds information such as the command line or the current directory. session_id property session_id → int Session ID associated with the current process. LdrDataTableEntry lief.runtime.windows.LdrDataTableEntry class lief.runtime.windows.LdrDataTableEntry Bases: object This class exposes a user-friendly interface over a LDR_DATA_TABLE_ENTRY , the structure used by the Windows loader to describe a module loaded in the current process. These entries can be enumerated through lief.runtime.windows.PEB.entries() . active_patch_image_base property active_patch_image_base → int | None Base address of the active hot-patch image, if any. Note Available on Windows 11 and later. base_dll_name property base_dll_name → str Base name of the module ( BaseDllName ), e.g. ntdll.dll . base_name_hash_value property base_name_hash_value → int | None Hash of the module’s base name used to index the loader tables Note Available on Windows 8 and later. check_sum property check_sum → int | None Image checksum cached by the loader Note Available on Windows 10 and later. ddag_node property ddag_node → int | None Address of the dependency-graph node of the module ( DdagNode ). Note Available on Windows 8 and later. dependent_load_flags property dependent_load_flags → int | None Flags controlling how the statically-linked dependencies of the module are loaded. Note Available on Windows 8 and later. dll_base property dll_base → int Base address at which the module is mapped in memory ( DllBase ). entry_point property entry_point → int Address of the entry point of the module ( EntryPoint ). entry_point_activation_context property entry_point_activation_context → int Address of the activation context associated with the module’s entry point. flags property flags → int Loader flags describing the state of the module ( Flags ). full_dll_name property full_dll_name → str Full path of the module ( FullDllName ), e.g. C:\\Windows\\System32\\ntdll.dll . hot_patch_state property hot_patch_state → int | None State of the hot-patch engine for this module, as a LDR_HOT_PATCH_STATE value. Note Available on Windows 11 and later. implicit_path_options property implicit_path_options → int | None Path-search options implied when the module was resolved Note Available on Windows 8 and later. load_context property load_context → int | None Address of the loader context used while the module is being snapped Note Available on Windows 8 and later. load_reason property load_reason → int | None Reason why the module was loaded, as a LDR_DLL_LOAD_REASON value Note Available on Windows 8 and later. load_time property load_time → int | None Time at which the module was loaded. Note Available on Windows 8 and later. lock property lock → int Address of the per-entry loader lock. obsolete_load_count property obsolete_load_count → int Legacy load count of the module ( ObsoleteLoadCount ). Superseded by reference_count on Windows 8 and later. original_base property original_base → int | None Preferred base address recorded in the PE headers Note Available on Windows 8 and later. parent_dll_base property parent_dll_base → int | None Base address of the module that triggered the load of this one. Note Available on Windows 8 and later. reference_count property reference_count → int | None Number of references currently held on the module. Note Available on Windows 8 and later. signing_level property signing_level → int | None Signing level of the module’s image, as a SE_SIGNING_LEVEL value Note Available on Windows 10 and later. size_of_image property size_of_image → int Size (in bytes) of the module’s image in memory ( SizeOfImage ). switch_back_context property switch_back_context → int | None Address of the CHPE switch-back context. Note Available on Windows 8 and later. time_date_stamp property time_date_stamp → int TimeDateStamp of the module as cached by the loader. tls_index property tls_index → int TLS slot index assigned to the module, or 0 when it has no TLS ( TlsIndex ). ARCH lief.runtime.ARCH class lief.runtime.ARCH( *values ) Bases: Enum ARM64 ARM64 = 2 NONE NONE = 0 RISCV64 RISCV64 = 3 X86_64 X86_64 = 1 PLATFORMS lief.runtime.PLATFORMS class lief.runtime.PLATFORMS( *values ) Bases: Enum ANDROID ANDROID = 3 IOS IOS = 5 LINUX LINUX = 1 NONE NONE = 0 OSX OSX = 4 WINDOWS WINDOWS = 2", "contentHash": "9fa82d305b90ec7a6c9095bd6c21dc88393c7940839a31deb074887e1650e99d", "description": "Runtime Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "runtime/python", "documentID": "814d8cef7b0f368b469607f5929feeabdd9081b37722c78dc04c6d1d216b0e73", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/runtime/python.md", "title": "Runtime Python API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/runtime/rust.html", "content": "Rust Note Please check: lief::runtime", "contentHash": "ea4d43d5fad5dc55e6a108e798b4edcb5ef387eab630598d9ddbca5fe85d8071", "description": "Runtime Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats.", "docname": "runtime/rust", "documentID": "dcebb284791c9d25dd3502359d9e5bfb13760d591cccf6ada156a0c579286d1d", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/runtime/rust.md", "title": "Runtime Rust API - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/tools/lief-patchelf/index.html", "content": "lief-patchelf lief-patchelf is an implementation of the original patchelf created by NixOS ( NixOS/patchelf ), based on LIEF. This LIEF-based version is written in Rust, offering a more robust, modern, and maintainable implementation compared to the original project. CLI It is worth mentioning that lief-patchelf maintains the same command-line interface as the original NixOS implementation, allowing for a seamless transition between the two versions. Compilation You can build lief-patchelf using cargo from the src/tools/lief-patchelf directory with the following commands: $ cargo build [--release] $ ./target/{release,debug}/lief-patchelf --version Since LIEF is a cross-platform library that supports various platforms and architectures, you can compile (or cross-compile) this tool for other platforms. For example, you can generate a Windows ARM64 executable as follows: rustup.exe target add $RUST_TARGET (optional) $env:RUSTFLAGS=\"-Ctarget-feature=+crt-static\" cargo build --target=aarch64-pc-windows-msvc ./target/{release,debug}/lief-patchelf.exe --version For more information about the supported platforms, please refer to the Rust Bindings section. Man Page Given the lief-patchelf binary, you can generate a man page using the following command: $ lief-patchelf --generate-manpage ./lief-patchelf.1 This functionality is provided by the clap_mangen crate. Shell Completion Thanks to clap and its clap_complete extension, which generates auto-completion for various shells, you can generate completion stubs for lief-patchelf with: $ ./lief-patchelf --generate {bash, elvish, fish, powershell, zsh}", "contentHash": "b53f6c019f3f8fd0dff85a1db929a4fa7435595e6ad409d58f623737a733443a", "description": "lief-patchelf is an implementation of the original patchelf created by NixOS (NixOS/patchelf), based on LIEF.", "docname": "tools/lief-patchelf/index", "documentID": "0a88d4c55f99c080210e0aa33a2c913e577dd4598335e39156d6a09286708555", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/tools/lief-patchelf/index.md", "title": "lief-patchelf - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/tutorials/01_play_with_formats.html", "content": "01 - Parse and manipulate formats The objective of this tutorial is to provide an overview of LIEF’s API for parsing and manipulating formats. ELF We’ll start with the ELF format. To create an ELF.Binary from a file, simply pass its path to the lief.abstract.parse ( lief.parse() ; LIEF::Parser::parse() ) or lief.ELF.parse() ( lief::elf::Binary::parse ; lief.ELF.parse() ; LIEF::ELF::Parser::parse() ) functions. Note With the Python API, these functions exhibit the same behavior, but in C++, lief.abstract.parse ( lief.parse() ; LIEF::Parser::parse() ) will return a pointer to a lief.abstract.Binary ( lief::generic::Binary ; lief.Binary ; LIEF::Binary ) object, whereas lief.ELF.parse() ( lief::elf::Binary::parse ; lief.ELF.parse() ; LIEF::ELF::Parser::parse() ) will return a lief.ELF.Binary ( lief::elf::Binary ; lief.ELF.Binary ; LIEF::ELF::Binary ) object. import lief binary = lief.parse(\"/bin/ls\") Once the ELF file has been parsed, we can access its Header : binary: lief.ELF.Binary header = binary.header To change the entry point and the target architecture ( ARCH ): header: lief.ELF.Header header.entrypoint = 0x123 header.machine_type = lief.ELF.ARCH.AARCH64 Then, write these changes to a new ELF binary: binary: lief.ELF.Binary binary.write(\"ls.modified\") We can also iterate over the Section entries as follows: binary: lief.ELF.Binary for section in binary.sections: print(section.name) # section name print(section.size) # section size print(len(section.content)) # Should match the previous print To modify the content of the .text section: binary: lief.ELF.Binary text = binary.get_section(\".text\") assert text is not None text.content = bytes([0x33] * text.size) PE As with the ELF section, you can use the lief.abstract.parse ( lief.parse() ; LIEF::Parser::parse() ) or lief.PE.parse() ( lief::pe::Binary::parse ; lief.PE.parse() ; LIEF::PE::Parser::parse() ) functions to create a PE.Binary import lief binary = lief.parse(\"C:\\\\Windows\\\\explorer.exe\") To access the various PE headers ( DosHeader , Header , and OptionalHeader ): binary: lief.PE.Binary print(binary.dos_header) print(binary.header) print(binary.optional_header) You can also access imported functions in two ways: Using the abstract layer Using the PE definition # Using the abstract layer binary: lief.PE.Binary for func in binary.imported_functions: print(func) # Using the PE definition for func in binary.imports: print(func) For finer granularity regarding the location of imported functions in libraries, or to access other fields of the PE imports, we can process the imports as follows: binary: lief.PE.Binary for imported_library in binary.imports: print(\"Library name: \" + imported_library.name) for func in imported_library.entries: if not func.is_ordinal: print(func.name) print(func.iat_address)", "contentHash": "2330f4f08d5092518796b2e2a61662dfc8667d204873faf0d065ee66e4a723cf", "description": "01 - Parse and manipulate formats. The objective of this tutorial is to provide an overview of LIEF’s API for parsing and manipulating formats.", "docname": "tutorials/01_play_with_formats", "documentID": "08a137e7afa75ba28d26f104d7eaa53231f09351b4996f6c3f55719ddf0220d4", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/tutorials/01_play_with_formats.md", "title": "01 - Parse and manipulate formats - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/tutorials/02_pe_from_scratch.html", "content": "02 - Create a PE from scratch (Deprecated) Warning This tutorial is no longer functional or accurate for LIEF version >= 0.17.0 . In this tutorial, we introduce the LIEF API for creating a simple PE executable from scratch. LIEF enables the creation of a simple PE from scratch. The aim of this tutorial is to create an executable that shows a “Hello World” MessageBoxA . First, we must create a Binary : from lief import PE binary32 = PE.Binary(\"pe_from_scratch\", PE.PE_TYPE.PE32) The first parameter is the binary name, and the second is the binary type: PE32 or PE32_PLUS (see PE_TYPE ). The Binary constructor automatically creates DosHeader , Header , OptionalHeader , and an empty DataDirectory . Now that we have a minimal binary, we must add sections. We will have a first section holding assembly code ( .text ) and a second one containing strings ( .data ): section_text = PE.Section(\".text\") section_text.content = code section_text.virtual_address = 0x1000 section_data = PE.Section(\".data\") section_data.content = data section_data.virtual_address = 0x2000 A MessageBoxA is composed of a title and a message. These two strings can be stored in the .data section as follows: title = \"LIEF is awesome\\0\" message = \"Hello World\\0\" data = list(map(ord, title)) data += list(map(ord, message)) The pseudo assembly code of the .text section is provided in the following listing: push 0x00 ; uType push \"LIEF is awesome\" ; Title push \"Hello World\" ; Message push 0 ; hWnd call MessageBoxA ; push 0 ; uExitCode call ExitProcess ; Instead of pushing strings, we must push the virtual addresses of these strings. In the PE format, a section’s virtual address is actually a relative virtual address (relative to OptionalHeader.imagebase when ASLR is not enabled). By default, the Binary constructor sets the imagebase to 0x400000 . As a result, the virtual addresses of the strings are: title : imagebase + virtual_address + 0 = 0x402000 message : imagebase + virtual_address + len(title) = 0x402010 push 0x00 ; uType push 0x402000 ; Title push 0x402010 ; Message push 0 ; hWnd call MessageBoxA ; push 0 ; uExitCode call ExitProcess ; As the code uses MessageBoxA , we need to import user32.dll into the binary’s Import entries and add the MessageBoxA ImportEntry . To do so, we can use the add_library() method combined with add_entry() : user32 = binary32.add_library(\"user32.dll\") user32.add_entry(\"MessageBoxA\") The same applies to ExitProcess ( kernel32.dll ): kernel32 = binary32.add_library(\"kernel32.dll\") kernel32.add_entry(\"ExitProcess\") Once the necessary libraries and functions have been added to the binary, we must determine their addresses ( I mport A ddress T able). To do so, we can use the lief.PE.Binary.predict_function_rva method, which returns the IAT address set by the Builder : ExitProcess_addr = binary32.predict_function_rva(\"kernel32.dll\", \"ExitProcess\") MessageBoxA_addr = binary32.predict_function_rva(\"user32.dll\", \"MessageBoxA\") print(\"Address of 'ExitProcess': 0x{:06x} \".format(ExitProcess_addr)) print(\"Address of 'MessageBoxA': 0x{:06x} \".format(MessageBoxA_addr)) Address of 'ExitProcess': 0x00306a Address of 'MessageBoxA': 0x00305c Thus, the absolute virtual addresses of MessageBoxA and ExitProcess are: MessageBoxA : imagebase + 0x306a = 0x40306a ExitProcess : imagebase + 0x305c = 0x40305c And the associated assembly code: push 0x00 ; uType push 0x402000 ; Title push 0x402010 ; Message push 0 ; hWnd call 0x40306a ; push 0 ; uExitCode call 0x40305c ; The transformation of the Binary into an executable is performed by the Builder class. By default, the import table is not rebuilt, so we must configure the builder to rebuild it: builder = lief.PE.Builder(binary32) builder.build_imports(True) builder.build() builder.write(\"pe_from_scratch.exe\") You can now use the newly created binary.", "contentHash": "624399baaec0ba136041a8e88f5ad845f523eccbafa18de7f477da1f12272bc4", "description": "02 - Create a PE from scratch (Deprecated). In this tutorial, we introduce the LIEF API for creating a simple PE executable from scratch.", "docname": "tutorials/02_pe_from_scratch", "documentID": "187b83be6545a1c1d470544442537f6e2d318348b6f7c9fed50ab6982e940da0", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/tutorials/02_pe_from_scratch.md", "title": "02 - Create a PE from scratch (Deprecated) - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/tutorials/03_elf_change_symbols.html", "content": "03 - Play with ELF symbols In this tutorial, we will see how to modify dynamic symbols in both an executable and a library. When a library is dynamically linked to an executable, the required libraries are referenced in the DT_NEEDED entries within the dynamic table ( PT_DYNAMIC ). Additionally, functions imported from this library are referenced in the dynamic symbols table with the following attributes: value set to 0 type set to FUNC Similarly, when a library exports functions, they are registered in the dynamic symbols table with the following attributes: value set to the address of the function in the library type set to FUNC Imported and exported functions are abstracted in LIEF, and you can iterate over these elements using the following properties: exported_functions and imported_functions binary: lief.Binary library: lief.Binary print(binary.imported_functions) print(library.exported_functions) When analyzing a binary, imported functions can reveal information about its underlying functionality. To avoid revealing these symbols, one solution could be to statically link the library with the executable. Another solution is to confuse the reverse engineer by swapping these symbols, which is the purpose of this tutorial. Consider the following code: #include #include #include double hashme(double input) { return pow(input, 4) + log(input + 3); } int main(int argc, char** argv) { if (argc != 2) { printf(\"Usage: %s N\\n\", argv[0]); return EXIT_FAILURE; } double N = (double)atoi(argv[1]); double hash = hashme(N); printf(\"%f\\n\", hash); return EXIT_SUCCESS; } Basically, this program takes an integer as a parameter and performs a computation on this value. $ hashme 123 228886645.836282 The pow and log functions are located in the libm.so.6 library. Using LIEF, we can swap these function names with other function names . For example, let’s swap pow and log with cos and sin : First, we must load both the library and the executable: import lief hashme = lief.parse(\"hashme\") libm = lief.parse(\"/usr/lib/libm.so.6\") # Note: the path to libm.so.6 might be different on your system. Then, we can change the names of the two imported functions in the executable : hashme: lief.ELF.Binary hashme_pow_sym = next(i for i in hashme.imported_symbols if i.name == \"pow\") hashme_log_sym = next(i for i in hashme.imported_symbols if i.name == \"log\") hashme_pow_sym.name = \"cos\" hashme_log_sym.name = \"sin\" And we must do the same in the library: the log symbol name is swapped with sin , and pow with cos : def swap(obj, a, b): symbol_a = next(i for i in obj.dynamic_symbols if i.name == a) symbol_b = next(i for i in obj.dynamic_symbols if i.name == b) b_name = symbol_b.name symbol_b.name = symbol_a.name symbol_a.name = b_name hashme: lief.ELF.Binary libm: lief.ELF.Binary hashme_pow_sym = next(i for i in hashme.imported_symbols if i.name == \"pow\") hashme_log_sym = next(i for i in hashme.imported_symbols if i.name == \"log\") hashme_pow_sym.name = \"cos\" hashme_log_sym.name = \"sin\" swap(libm, \"log\", \"sin\") swap(libm, \"pow\", \"cos\") hashme.write(\"hashme.obf\") libm.write(\"libm.so.6\") At this point, we have a modified version of libm.so in the same directory as hashme.obf . To force the loading of this modified version of libm.so , we can set the LD_LIBRARY_PATH environment variable: $ LD_LIBRARY_PATH=. hashme.obf 123 228886645.836282 Without this environment variable, the Linux loader would resolve libm.so using the original path, and the computation would be performed using sin and cos : $ hashme.obf 123 -0.557978 Another more realistic use case could involve swapping symbols in cryptographic libraries like OpenSSL. For example, EVP_DecryptInit and EVP_EncryptInit have the same prototype and could be swapped.", "contentHash": "3f7952719da0d58bc9b7d4b5a1b2e56257faf4a3f83b04fd33dbd31e2a3f37d5", "description": "03 - Play with ELF symbols. In this tutorial, we will see how to modify dynamic symbols in both an executable and a library.", "docname": "tutorials/03_elf_change_symbols", "documentID": "bdb463e2daa2fb6c31c7a5976102187ebc0cc8400692f276ae5bf1ae37d6832a", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/tutorials/03_elf_change_symbols.md", "title": "03 - Play with ELF symbols - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/tutorials/04_elf_hooking.html", "content": "04 - ELF Hooking The objective of this tutorial is to hook a library function. In the previous tutorial, we saw how to swap symbol names in a shared library. We will now see the mechanism for hooking a function in a shared library. The targeted library is the standard math library ( libm.so ), and we will insert a hook on the exp function so that (\\exp(x) = x + 1). The source code of the sample that uses this function is provided in the following listing: #include #include #include int main(int argc, char **argv) { if (argc != 2) { printf(\"Usage: %s \\n\", argv[0]); exit(-1); } int a = atoi(argv[1]); printf(\"exp(%d) = %f\\n\", a, exp(a)); return 0; } The hook function is as follows: double hook(double x) { return x + 1; } Compiled with gcc -Os -nostdlib -nodefaultlibs -fPIC -Wl,-shared hook.c -o hook . To inject this hook into the library, we use the add() (segment) method: **Binary.add( self , arg: lief._lief.ELF.DynamicEntry , / ) → lief._lief.ELF.DynamicEntry **Binary.add( self , section: lief._lief.ELF.Section , loaded: bool = True , pos: lief._lief.ELF.Binary.SEC_INSERT_POS = SEC_INSERT_POS.AUTO ) → lief._lief.ELF.Section | None **Binary.add( self , segment: lief._lief.ELF.Segment , base: int = 0 ) → lief._lief.ELF.Segment | None Binary.add( self , note: lief._lief.ELF.Note ) → lief._lief.ELF.Note ****** Overloaded function. add(self, arg: lief._lief.ELF.DynamicEntry, /) -> lief._lief.ELF.DynamicEntry dynamic_entry add(self, section: lief._lief.ELF.Section, loaded: bool = True, pos: lief._lief.ELF.Binary.SEC_INSERT_POS = SEC_INSERT_POS.AUTO) -> lief._lief.ELF.Section | None Add the given Section to the binary. If the section does not aim at being loaded in memory, the loaded parameter has to be set to False (default: True ) add(self, segment: lief._lief.ELF.Segment, base: int = 0) -> lief._lief.ELF.Segment | None Add a new Segment in the binary add(self, note: lief._lief.ELF.Note) -> lief._lief.ELF.Note Add a new Note in the binary First, we find the code for our hook function and add it to the library: libm: lief.ELF.Binary hook: lief.ELF.Binary exp_symbol = libm.get_symbol(\"exp\") hook_symbol = hook.get_symbol(\"hook\") assert hook_symbol is not None code_segment = hook.segment_from_virtual_address(hook_symbol.value) assert code_segment is not None segment_added = libm.add(code_segment) Once the stub is injected, we must calculate the new address for the exp symbol and update it: new_address = ( segment_added.virtual_address + hook_symbol.value - code_segment.virtual_address ) exp_symbol.value = new_address exp_symbol.type = lief.ELF.Symbol.TYPE.FUNC # it might have been GNU_IFUNC Note that we must update the symbol type to a regular FUNC because, on many distributions, libm.so is built with automatic hardware detection and exposes symbols as GNU_IFUNC , which uses a different dynamic binding protocol compared to regular functions. Finally, we write the patched library to a file in the current directory: libm.write(\"libm.so.6\") To test the patched library: $ ./do_math.bin 1 exp(1) = 2.718282 $ LD_LIBRARY_PATH=. ./do_math.bin 1 exp(1) = 2.000000", "contentHash": "cbb83f8adce49e1d43af860a0ac1b216fea6b02252aeed048ece4e657690dd24", "description": "04 - ELF Hooking. The objective of this tutorial is to hook a library function.", "docname": "tutorials/04_elf_hooking", "documentID": "2ae40ca2da2738c29f0d4267ec9b59b051672abfd8b2216fa6d934761496068c", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/tutorials/04_elf_hooking.md", "title": "04 - ELF Hooking - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/tutorials/05_elf_infect_plt_got.html", "content": "05 - Infecting the PLT/GOT The objective of this tutorial is to hook an imported function in an ELF binary. Hooking imported functions by infecting the .got section is a well-known technique [1] [2] , and this tutorial focuses on its implementation using LIEF. These figures illustrate the PLT/GOT mechanism: With lazy binding, the first time the function is called, the got entry redirects to the PLT instruction. The second time, the got entry holds the address in the shared library. Basically, the infection is done in two steps: First, we inject our hook. Second, we redirect the targeted function to our hook by patching the got . This can be summarized by the following figure: As an example, we will use a basic crackme that performs a memcmp(3) on the flag and user input. #include #include #include // Damn_YoU_Got_The_Flag char password[] = \"\\x18\\x3d\\x31\\x32\\x03\\x05\\x33\\x09\\x03\\x1b\\x33\\x28\\x03\\x08\\x34\\x39\\x03\\x1a\\x30\\x3d\\x3b\"; inline int check(char* input); int check(char* input) { for (int i = 0; i < sizeof(password) - 1; ++i) { password[i] ^= 0x5c; } return memcmp(password, input, sizeof(password) - 1); } int main(int argc, char **argv) { if (argc != 2) { printf(\"Usage: %s \\n\", argv[0]); return EXIT_FAILURE; } if (strlen(argv[1]) == (sizeof(password) - 1) && check(argv[1]) == 0) { puts(\"You got it !!\"); return EXIT_SUCCESS; } puts(\"Wrong\"); return EXIT_FAILURE; } The flag is XORed with 0x5C . To validate the crackme , the user must enter Damn_YoU_Got_The_Flag : $ crackme.bin foo Wrong $ crackme.bin Damn_YoU_Got_The_Flag You got it !! The hook will consist of printing the arguments of memcmp and returning 0 : #include \"arch/x86_64/syscall.c\" #define stdout 1 int my_memcmp(const void* lhs, const void* rhs, int n) { const char msg[] = \"Hook memcmp\\n\"; _write(stdout, msg, sizeof(msg)); _write(stdout, (const char*)lhs, n); _write(stdout, \"\\n\", 2); _write(stdout, (const char*)rhs, n); _write(stdout, \"\\n\", 2); return 0; } Since the hook will be injected into the crackme, it must meet the following requirements: Assembly code must be position-independent (compiled with -fPIC or -pie/-fPIE flags). It must not use external libraries such as libc.so ( -nostdlib -nodefaultlibs flags). Due to these requirements, the hook is compiled with: gcc -nostdlib -nodefaultlibs -fPIC -Wl,-shared hook.c -o hook . Injecting the hook The first step is to inject the hook into the binary. To do so, we will add a Segment : import lief crackme = lief.parse(\"crackme.bin\") assert isinstance(crackme, lief.ELF.Binary) hook = lief.parse(\"hook\") assert isinstance(hook, lief.ELF.Binary) segment_added = crackme.add(hook.segments[0]) All assembly code for the hook is contained in the first LOAD segment of hook . Once the hook is added, its virtual address will be the virtual_address of segment_added , and we can proceed with the got patching. Patching the got LIEF provides a function to easily patch the got entry associated with a Symbol : **Binary.patch_pltgot( self , symbol_name: str , address: int ) → None Binary.patch_pltgot( self , symbol: lief._lief.ELF.Symbol , address: int ) → None ** Overloaded function. patch_pltgot(self, symbol_name: str, address: int) -> None Patch the imported symbol’s name with the address patch_pltgot(self, symbol: lief._lief.ELF.Symbol, address: int) -> None Patch the imported Symbol with the address The offset of the memcmp function is stored in the value attribute of the associated dynamic symbol. Thus, its virtual address will be: my_memcmp : value + segment_added.virtual_address hook: lief.ELF.Binary segment_added: lief.ELF.Segment my_memcmp = hook.get_symbol(\"my_memcmp\") assert my_memcmp is not None my_memcmp_addr = segment_added.virtual_address + my_memcmp.value Finally, we can patch memcmp from the crackme with this value: crackme.patch_pltgot(\"memcmp\", my_memcmp_addr) And rebuild it: crackme.write(\"crackme.hooked\") Run Since a check on the input size is performed before checking the flag value, we must provide an input with the correct length (regardless of its content): $ crackme.hooked XXXXXXXXXXXXXXXXXXXXX Hook memcmp Damn_YoU_Got_The_Flag XXXXXXXXXXXXXXXXXXXXX You got it !! References[ 1 ] hxxp://vxheaven.org/lib/vrn00.html [ 2 ] http://phrack.org/issues/56/7.html", "contentHash": "3b7456c0e04033747d9fc47adec504489b9de583b3b2c27de5d252fbdbaefed9", "description": "05 - Infecting the PLT/GOT. The objective of this tutorial is to hook an imported function in an ELF binary.", "docname": "tutorials/05_elf_infect_plt_got", "documentID": "de604cc070551f92e9c54a9b226bb9617b773b0ea0a47073ee6e15e9dbd1c812", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/tutorials/05_elf_infect_plt_got.md", "title": "05 - Infecting the PLT/GOT - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/tutorials/06_pe_hooking.html", "content": "06 - PE Hooking (Deprecated) Warning This tutorial is no longer functional as the PE hooking functions have been removed from LIEF. The objective of this tutorial is to show how to hook imported functions. The targeted binary is a simple PE64 HelloWorld that prints the first argument to the console: #include \"stdafx.h\" #include int main(int argc, char** argv) { printf(\"Hello: %s\\n\", argv[1]); return 0; } $ PE64_x86-64_binary_HelloWorld.exe World $ Hello: World Using LIEF, we will replace the function that prints the message to the console with a MessageBox . By disassembling the binary, we can see that the print occurs in the function sub_140001030 , which uses two external functions: __acrt_iob_func and __stdio_common_vfprintf . According to the Microsoft x64 calling convention, the format string is located in the rcx register, and the input message is in the rdx register. Basically, the hooking code replaces the __acrt_iob_func function and displays a MessageBox with the rdx message. hooking code add rsp, 0x48 ; Stack unwind xor rcx, rcx ; hWnd mov rdx, rdx ; Message mov r8, 0x0140009000 ; Title xor r9, r9 ; MB_OK mov rax, 0x014000A3E4 ; MessageBoxA address call [rax] ; MessageBoxA(hWnd, Message, Title, MB_OK) xor rcx, rcx ; exit value mov rax, 0x014000A3d4 ; ExitProcess address call [rax] ; ExitProcess(0) ret ; Never reached Note As in tutorial 02 - Create a PE from scratch (Deprecated) , the addresses of MessageBoxA and ExitProcess can be found using the function: First, we create the .htext section, which will hold the hooking code: section_text = lief.PE.Section(\".htext\") section_text.content = code section_text.virtual_address = 0x7000 section_text.characteristics = lief.PE.Section.CHARACTERISTICS.CNT_CODE | lief.PE.Section.CHARACTERISTICS.MEM_READ | lief.PE.Section.CHARACTERISTICS.MEM_EXECUTE section_text = pe.add_section(section_text) Next, we create the .hdata section for the MessageBox title: title = \"LIEF is awesome\\0\" data = list(map(ord, title)) section_data = lief.PE.Section(\".hdata\") section_data.content = data section_data.virtual_address = 0x8000 section_data.characteristics = lief.PE.Section.CHARACTERISTICS.CNT_INITIALIZED_DATA | lief.PE.Section.CHARACTERISTICS.MEM_READ section_data = pe.add_section(section_data) Since ASLR is enabled, we will disable it to avoid dealing with relocations: binary: lief.PE.Binary binary.optional_header.dll_characteristics &= ( ~lief.PE.OptionalHeader.DLL_CHARACTERISTICS.DYNAMIC_BASE ) We will also disable NX protection: binary: lief.PE.Binary binary.optional_header.dll_characteristics &= ( ~lief.PE.OptionalHeader.DLL_CHARACTERISTICS.NX_COMPAT ) As ExitProcess is not imported in KERNEL32.dll , we need to add it: binary: lief.PE.Binary kernel32 = binary.get_import(\"KERNEL32.dll\") kernel32.add_entry(\"ExitProcess\") The MessageBoxA function is located in user32.dll , so we must add it: user32 = binary.add_library(\"user32.dll\") user32.add_entry(\"MessageBoxA\") Then, we proceed to hook the __acrt_iob_func function: pe.hook_function(\"__acrt_iob_func\", binary.optional_header.imagebase + section_text.virtual_address) Finally, we configure the Builder to create a new import table and patch the original one with trampolines. builder = lief.PE.Builder(binary) builder.build_imports(True).patch_imports(True) builder.build() builder.write(\"lief_pe_hooking.exe\") Now we can run the final executable: $ lief_pe_hooking.exe \"Hooking World\"", "contentHash": "e01415c0cd8cb98491ce78241faacff1b789e6544716d919acca30f50b85f384", "description": "06 - PE Hooking (Deprecated). The objective of this tutorial is to show how to hook imported functions.", "docname": "tutorials/06_pe_hooking", "documentID": "b4a6b91e04613ef19bf10bbd51ed0c91820c881bc21c65e215e734deb729716c", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/tutorials/06_pe_hooking.md", "title": "06 - PE Hooking (Deprecated) - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/tutorials/07_pe_resource.html", "content": "07 - PE Resources This tutorial provides an overview of the resource structure in a PE file and explains how to manipulate it using LIEF. Unlike the ELF and Mach-O formats, PE enables embedding resources (icons, images, dialogs, etc.) within an executable or a DLL. These resources are usually located in the .rsrc section, but this is not an absolute rule. To retrieve the section where resources are located, you can use the section attribute of the associated DataDirectory : binary: lief.PE.Binary if binary.has_resources: rsrc_directory = binary.data_directory( lief.PE.DataDirectory.TYPES.RESOURCE_TABLE ) assert rsrc_directory is not None if rsrc_directory.has_section: print(rsrc_directory.section) .rsrc 22e0d8 23f000 22e200 236c00 0 4.3596 CNT_INITIALIZED_DATA - MEM_READ Resource Structure The underlying structure used to represent resources is a tree: In the resource tree, there are basically two kinds of nodes: ResourceDirectory : Contains information about the subtree. ResourceData : Used to store raw data. These nodes are the leaves of the tree. The first three levels of the tree have a special meaning: Level 1: The id represents the TYPE . Level 2: The id represents an ID for accessing the resource. Level 3: The id represents the RESOURCE_LANGS / SUBLANG of the resource. You can check if a given binary embeds resources using the has_resources property. You can then access this structure through the resources property, which returns a ResourceDirectory representing the root of the tree. Given a ResourceDirectory , the childs property returns an iterator (similar to a list ) over the subtree associated with the node. The following snippet retrieves the MANIFEST element and prints it: filezilla: lief.PE.Binary root = filezilla.resources assert root is not None # First level => Type (ResourceDirectory node) manifest_node = next( i for i in root.childs if i.id == lief.PE.ResourcesManager.TYPE.MANIFEST ) print(manifest_node) # Second level => ID (ResourceDirectory node) id_node = manifest_node.childs[0] print(id_node) # Third level => Lang (ResourceData node) lang_node = id_node.childs[0] print(lang_node) manifest = bytes(lang_node.content).decode(\"utf8\") print(manifest) [DIRECTORY] - ID: 0x18 - Depth: 1 - Childs : 1 Characteristics : 0 Time/Date stamp : 0 Major version : 0 Minor version : 0 Number of name entries : 0 Number of id entries : 1 [DIRECTORY] - ID: 0x01 - Depth: 2 - Childs : 1 Characteristics : 0 Time/Date stamp : 0 Major version : 0 Minor version : 0 Number of name entries : 0 Number of id entries : 1 [DATA] - ID: 0x409 - Depth: 3 - Childs : 0 Code page : 0 Reserved : 0 Size : 1666 Hash : ffffffffb00b5419 FileZilla FTP client true Version ======= type: 0 key: VS_VERSION_INFO Fixed file info =============== Signature: feef04bd Struct version: 10000 File version: 3 - 25 - 2 - 0 Product version: 3 - 25 - 2 - 0 File OS: WINDOWS32 File type: APP String file info ================ type: 1 key: StringFileInfo type: 1 key: 000004b0: (NEUTRAL - NEUTRAL - UTF_16) Items: 'Comments': 'Version 3.25.2' 'CompanyName': 'FileZilla Project' 'FileDescription': 'FileZilla FTP Client' 'FileVersion': '3, 25, 2, 0' 'InternalName': 'FileZilla 3' 'LegalCopyright': 'Copyright (C) 2006-2016' 'OriginalFilename': 'filezilla.exe' 'ProductName': 'FileZilla' 'ProductVersion': '3, 25, 2, 0' Var file info ============= type: 1 key: VarFileInfo Translations: UTF_16/NEUTRAL/NEUTRAL Icon #0 : Size: 16x16 pixels Color count: 0 Reserved: 0 Planes: 1 Bit count: 8 Hash: ffffffffca4fbb2f Icon #1 : Size: 32x32 pixels Color count: 0 Reserved: 0 Planes: 1 Bit count: 8 Hash: 79eaa8a1 Icon #2 : Size: 48x48 pixels Color count: 0 Reserved: 0 Planes: 1 Bit count: 8 Hash: 1b38942 Icon #3 : Size: 48x48 pixels Color count: 0 Reserved: 0 Planes: 1 Bit count: 20 Hash: 281bc584 Icon #4 : Size: 0x0 pixels Color count: 0 Reserved: 0 Planes: 1 Bit count: 20 Hash: 13a82f1 FileZilla FTP client true Similar to the previous example, accessing the MANIFEST element is as simple as: resources_manager = filezilla.resources_manager manifest = resources_manager.manifest print(manifest) Playing with the Manifest Now we will see how to use the ResourcesManager to grant Administrator privileges to an executable using the MANIFEST element. The application manifest is implemented as an XML document; its documentation is available here: MSDN Among these tags, the requestedExecutionLevel tag “describes the minimum security permissions required for the application to run on the client computer.” [1] This tag has the following options: Level : Indicates the security level the application is requesting. asInvoker : Same permissions as the process that started it. highestAvailable : The application will run with the highest permission level possible. requireAdministrator : The application will run with administrator permissions. uiAccess (Optional): Indicates whether the application requires access to protected user interface elements. true false Using ResourcesManager , replacing the asInvoker value with requireAdministrator is straightforward: filezilla: lief.PE.Binary resources_manager = filezilla.resources_manager assert isinstance(resources_manager, lief.PE.ResourcesManager) manifest = resources_manager.manifest assert isinstance(manifest, str) manifest = manifest.replace(\"asInvoker\", \"requireAdministrator\") resources_manager.manifest = manifest The PE Builder can be configured to rebuild the resource tree. To apply the modifications, we must rebuild it: Warning By default, the Builder does not rebuild the resource tree. builder = lief.PE.Builder(filezilla) builder.build_resources(True) builder.build() builder.write(\"filezilla_rsrc.exe\") Playing with Icons The change_icon() method switches icons between two applications. As in the previous section, obtain the ResourcesManager as follows: mfc = lief.parse(\"mfc.exe\") cmd = lief.parse(\"cmd.exe\") mfc_rsrc_manager = mfc.resources_manager cmd_rsrc_manager = cmd.resources_manager Then, switch the first icons of the applications: mfc_rsrc_manager: lief.PE.ResourcesManager cmd_rsrc_manager: lief.PE.ResourcesManager mfc_icons = mfc_rsrc_manager.icons cmd_icons = cmd_rsrc_manager.icons for i in range(min(len(mfc_icons), len(cmd_icons))): mfc_rsrc_manager.change_icon(mfc_icons[i], cmd_icons[i]) The MFC icons before switching: After the switch: References[ 1 ] https://docs.microsoft.com/en-us/previous-versions/visualstudio/visual-studio-2015/deployment/trustinfo-element-clickonce-application", "contentHash": "c32e93c32dbf8ada81287e6b220e0588e75ee140883fcce96781d27f216d99a2", "description": "07 - PE Resources. This tutorial provides an overview of the resource structure in a PE file and explains how to manipulate it using LIEF.", "docname": "tutorials/07_pe_resource", "documentID": "346c33f33a6fcbdbd66a3b2745bfba1fc1cc961bd017bef0ea065abed3d43414", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/tutorials/07_pe_resource.md", "title": "07 - PE Resources - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/tutorials/08_elf_bin2lib.html", "content": "08 - Transforming an ELF executable into a library In this tutorial, we will see how to convert a PIE executable into a library. Introduction Examining the header of an ELF PIE executable reveals that it has the same type as a shared object (i.e., a library): $ readelf -h /usr/bin/ssh|grep Type Type: DYN (Shared object file) $ readelf -h /usr/lib/libm.so|grep Type Type: DYN (Shared object file) Using LIEF, we can access this information through the file_type attribute: >>> libm = lief.parse(\"/usr/lib/libm.so.6\") >>> print(libm.header.file_type) FILE_TYPE.DYN >>> ssh = lief.parse(\"/usr/bin/ssh\") >>> print(ssh.header.file_type) FILE_TYPE.DYN The main difference between PIE binaries and shared libraries is how symbols are exported. A shared library is designed to expose functions so that executables can bind to it, whereas executables should not expose functions [1] . This is confirmed by the number of exported functions in the two different objects: >>> print(len(libm.exported_functions)) 572 >>> print(len(ssh.exported_functions)) 10 In this tutorial, we will see how to transform raw function addresses into exported functions associated with a symbol, thus exposing internal functions of the executable. Exporting functions Such a transformation can be useful if we find a function at a given address and want to instrument it (using dlopen / dlsym , for example). Once the target function is exported, we can link it as we would for a normal library. For example, in a fuzzing scenario, if one identifies a parser function, we can export it and then feed its inputs using AFL. This allows us to bypass the normal entry point to reach the function directly. Let’s see how it works on a basic crackme : #include #include #include #define NOINLINE __attribute__ ((noinline)) NOINLINE int check_found(char* input) { if (strcmp(input, \"easy\") == 0) { return 1; } return 0; } int main(int argc, char** argv) { if (argc != 2) { printf(\"Usage: %s flag\\n\", argv[0]); return -1; } if (check_found(argv[1])) { printf(\"Well done!\\n\"); } else { printf(\"Wrong!\\n\"); } return 0; } This code takes a string as input and calls the check_found function on this string. It returns 1 if the input is easy , and 0 otherwise. The __attribute__ ((noinline)) is used to ensure the check_found function is not inlined by the compiler. If the function is inlined, there will be no address associated with it. The following figure summarizes the execution flow: The crackme can be compiled with: $ gcc crackme101.c -O0 -fPIE -pie -Wl,-strip-all,--hash-style=sysv -o crackme101.bin -fvisibility=hidden $ ./crackme101.bin foo Wrong! $ ./crackme101.bin easy Well done! Note the use of the -fvisibility=hidden flag. It prevents the compiler from automatically exporting functions, such as check_found . Opening crackme101.bin with LIEF confirms that no functions are exported: >>> import lief >>> crackme101 = lief.parse(\"./crackme101.bin\") >>> print(len(crackme101.exported_functions)) 0 Using a disassembler, we can quickly identify the address of the check function: In this case, the check function is located at address: 0x72A [2] . Now that we have identified the address, we can export it as a named function: check_found . crackme101: lief.ELF.Binary addr = crackme101.get_function_address(\"check_found\") # 0x72A assert isinstance(addr, int) crackme101.add_exported_function(addr, \"check_found\") crackme101.write(\"libcrackme101.so\") And that’s all! libcrackme101.so is now a library that exports one function: check_found . >>> import lief >>> libcrackme101 = lief.parse(\"./libcrackme101.so\") >>> print(len(libcrackme101.exported_functions)) 1 >>> print(libcrackme101.exported_functions[0]) check_found Notably, libcrackme101.so remains an executable: $ ./libcrackme101.so foo Wrong! $ ./libcrackme101.so easy Well done! Since we have exported a function, we can now use dlopen on libcrackme101.so and dlsym on check_found : #include #include #include typedef int(*check_t)(char*); int main (int argc, char** argv) { void* handler = dlopen(\"./libcrackme101.so\", RTLD_LAZY); if (!handler) { fprintf(stderr, \"dlopen error: %s\\n\", dlerror()); return 1; } check_t check_found = (check_t)dlsym(handler, \"check_found\"); int output = check_found(argv[1]); printf(\"Output of check_found('%s'): %d\\n\", argv[1], output); return 0; } Running the code above should yield a similar output: $ gcc instrument.c -O0 -fPIE -pie -o instrument.bin -ldl $ ./instrument.bin test Output of check_found('test'): 0 $ ./instrument.bin easy Output of check_found('easy'): 1 If dlopen returns an error, please read the following section about glibc >= 2.29 . The transformation of the execution flow can be represented as follows: Warning for glibc >= 2.29 users If you are using glibc >= 2.29 (or a similar version depending on your Linux distribution), you might have encountered this error while using the dlopen function: dlopen error: cannot dynamically load position-independent executable Loading PIE binaries as shared libraries was not really an intended use case for dlopen , and it used to work without being properly supported. One reason is that it does not seem trivial to support all possible use cases (issues with certain relocations and ELF constructors). These glibc versions now implement a check to deny dlopen calls with PIE binaries. This is done by verifying that the DF_1_PIE flag is not present in the dynamic information flags. To circumvent this check, LIEF can be used to remove the DF_1_PIE flag: import lief path = sys.argv[1] bin_ = lief.parse(path) assert isinstance(bin_, lief.ELF.Binary) bin_[lief.ELF.DynamicEntry.TAG.FLAGS_1].remove(lief.ELF.DynamicEntryFlags.FLAG.PIE) bin_.write(path + \".patched\") Conclusion Because PIE executables are designed to be mapped at a random base address, they generally behave like a library. We only need to export the relevant functions. For non-PIE executables, such a transformation would be very difficult because it requires first transforming the executable into a relocatable executable. This involves creating relocations, patching absolute jumps, etc. LIEF currently only supports this transformation for ELF, and we need to investigate the PE and Mach-O cases [3] . Notes[ 1 ] Some functions can be exported by the linker, such as _init . [ 2 ] The mapped virtual address will be BASE + 0x72A , where BASE is randomly chosen by ASLR. [ 3 ] In macOS, all executables are compiled with the PIE flag. API: lief.ELF.Binary.add_exported_function() lief.ELF.Binary.export_symbol() lief.ELF.Symbol.visibility lief.ELF.Symbol.name lief.ELF.Symbol.value", "contentHash": "a4238007cc90b8d943eb199c46fa1fe0a48a4e8a1abd261759c81a26b6817aa5", "description": "08 - Transforming an ELF executable into a library. In this tutorial, we will see how to convert a PIE executable into a library.", "docname": "tutorials/08_elf_bin2lib", "documentID": "9158eb241f4babd596abdb71ba63019f298072f234cf17d76fdc1835efb07443", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/tutorials/08_elf_bin2lib.md", "title": "08 - Transforming an ELF executable into a library - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/tutorials/09_frida_lief.html", "content": "09 - How to use Frida on a non-rooted device In this tutorial, we will see how to use the Frida gadget on a non-rooted device. In recent years, Frida has become the standard tool for performing hooking. It supports various platforms and enables writing hooks quickly and dynamically. Most of the time, there are no constraints on using Frida on a rooted device, but in some scenarios, the application being analyzed might check its environment. A technique based on modifying the Dalvik bytecode has been well-described by @ikoz in the post “ Using Frida on Android without root ”. In this tutorial, we propose a new technique that does not require modifying the Dalvik bytecode (i.e., classes.dex ). Frida Gadget In its default mode, Frida first needs to inject an agent into the targeted application so that it resides in the process’s memory space. On Android and Linux, this injection is typically performed with ptrace by attaching to or spawning a process and then injecting the agent. Once the agent is injected, it communicates with its server through a pipe. Some types of injection require privileges. For example, a normal user cannot use ptrace . To address this constraint, Frida provides another mode of operation called “embedded”. In this mode, the user is responsible for injecting the frida-gadget library. Such injection can be performed using: Environment variables: LD_PRELOAD , DYLD_INSERT_LIBRARIES , etc. Using dlopen . In an open-source target, using the linker to link with the Frida gadget. … For more information about the Frida gadget, refer to the documentation: frida-gadget Frida & LIEF One less-known but established injection technique is based on modifying the ELF format. This was well-explained by Mayhem in Phrack [1] , and LIEF provides a user-friendly API [2] to perform it. To summarize, executable formats include libraries that are linked with the executable. We can obtain a list of linked libraries using ldd or readelf (Unix) or with elf_reader.py (Linux, Windows, OSX): $ python ./elf_reader.py -d /bin/ls == Dynamic entries == |Tag | Value | Info | |NEEDED | 0x1 | libcap.so.2 | |NEEDED | 0x80 | libc.so.6 | Here, /bin/ls has two dependencies: libcap.so.2 libc.so.6 During the loading phase of the executable, the loader iterates over these libraries and maps them into the process’s memory space. Once mapped, it calls their constructors [3] . The idea is to add frida-agent.so as a dependency of native libraries embedded in the APK. Adding such a dependency is as simple as: import lief libnative = lief.parse(\"libnative.so\") assert isinstance(libnative, lief.ELF.Binary) libnative.add_library(\"libgadget.so\") # Injection! libnative.write(\"libnative.so\") Telegram To illustrate the process, we will inject the Frida gadget into the Telegram application. It is an interesting target because: It contains only one native library, so the library will be loaded early. It demonstrates LIEF’s reliability in modifying ELF files. It is a real-world application. Regarding the environment, we will use Telegram version 4.8.4-12207 (February 18, 2018) on an Android 6.0.1 device with an AArch64 architecture (Samsung Galaxy S6). Injection with LIEF As explained above, the injection is simply a call to lief.ELF.Binary.add_library() on the libtmessages.28.so library. Prior to injection, libtmessages.28.so is linked against the following libraries: $ readelf -d ./libtmessages.28.so|grep NEEDED 0x0000000000000001 (NEEDED) Shared library: [libjnigraphics.so] 0x0000000000000001 (NEEDED) Shared library: [liblog.so] 0x0000000000000001 (NEEDED) Shared library: [libz.so] 0x0000000000000001 (NEEDED) Shared library: [libOpenSLES.so] 0x0000000000000001 (NEEDED) Shared library: [libEGL.so] 0x0000000000000001 (NEEDED) Shared library: [libGLESv2.so] 0x0000000000000001 (NEEDED) Shared library: [libdl.so] 0x0000000000000001 (NEEDED) Shared library: [libstdc++.so] 0x0000000000000001 (NEEDED) Shared library: [libm.so] 0x0000000000000001 (NEEDED) Shared library: [libc.so] After telegram.add_library(\"libgadget.so\") , the new dependency is at the first position: $ readelf -d ./libtmessages.28.so|grep NEEDED 0x0000000000000001 (NEEDED) Shared library: [libgadget.so] 0x0000000000000001 (NEEDED) Shared library: [libjnigraphics.so] 0x0000000000000001 (NEEDED) Shared library: [liblog.so] 0x0000000000000001 (NEEDED) Shared library: [libz.so] 0x0000000000000001 (NEEDED) Shared library: [libOpenSLES.so] 0x0000000000000001 (NEEDED) Shared library: [libEGL.so] 0x0000000000000001 (NEEDED) Shared library: [libGLESv2.so] 0x0000000000000001 (NEEDED) Shared library: [libdl.so] 0x0000000000000001 (NEEDED) Shared library: [libstdc++.so] 0x0000000000000001 (NEEDED) Shared library: [libm.so] 0x0000000000000001 (NEEDED) Shared library: [libc.so] Configuring the Frida Gadget According to the documentation, the Frida gadget allows the use of a configuration file to parameterize interaction: Listing : Interaction is the same as frida-server. Script : Direct interaction with a JS script at a specified path. ScriptDirectory : Same as Script , but for multiple applications and scripts. The Listing interaction would require the android.permission.INTERNET permission. While we could add this permission by modifying the manifest, we will use the Script interaction instead, as it does not require additional permissions. The Frida payload will be located in the /data/local/tmp/myscript.js file. The gadget configuration for this context is provided below: { \"interaction\": { \"type\": \"script\", \"path\": \"/data/local/tmp/myscript.js\", \"on_change\": \"reload\" } } Using a configuration file must follow two requirements: The file must have the same name as the gadget library (e.g., libgadget.so and libgadget.conf ). The configuration file must be located in the same directory as the gadget library. The second requirement means that after installation on the device, the gadget library will look for the configuration file in the /data/app/org.telegram.messenger-1/lib directory. When installing an application, the Android package manager copies files from the lib/ directory of the APK only if [4] : They start with the prefix lib . They end with the suffix .so . It is gdbserver . Frida is aware of these requirements, as illustrated in the listing below. Hence, we can simply add the .so suffix to libgadget.conf : #if ANDROID if (!FileUtils.test (config_path, FileTest.EXISTS)) { var ext_index = config_path.last_index_of_char ('.'); if (ext_index != -1) { config_path = config_path[0:ext_index] + \".config.so\"; } else { config_path = config_path + \".config.so\"; } } #endif lib/gadget/gadget.vala Finally, the lib directory of the new Telegram .apk has the following structure: $ tree lib . └── arm64-v8a ├── libgadget.config.so ├── libgadget.so └── libtmessages.28.so With libtmessages.28.so linked against libgadget.so : $ readelf -d ./arm64-v8a/libtmessages.28.so 0x0000000000000001 (NEEDED) Shared library: [libgadget.so] ... Run Once: The injection is performed in libtmessages.28.so . The gadget library and its configuration are placed in the /lib/ABI directory. The application is resigned. We can install the repackaged APK ( new.apk ) and push myscript.js to /data/local/tmp : $ adb shell install new.apk $ adb push myscript.js /data/local/tmp $ adb shell chmod 777 /data/local/tmp/myscript.js The Frida script myscript.js used in this tutorial simply calls the Android log function: 'use strict'; console.log(\"Waiting for Java..\"); Java.perform(function () { var Log = Java.use(\"android.util.Log\"); Log.v(\"frida-lief\", \"Have fun!\"); }); myscript.js Lastly, we can run the Telegram application and observe the Android logs: $ adb logcat -s \"frida-lief:V\" --------- beginning of system --------- beginning of main 03-24 17:23:51.908 10243 10243 V frida-lief: Have fun! Conclusion This tutorial demonstrated how static format instrumentation and dynamic instrumentation can be combined. Here is a quick summary of the advantages and disadvantages of this technique: Advantages: Does not require a rooted device. Does not depend on frida-server. Can be used to bypass some anti-Frida protections. Does not modify AndroidManifest.xml or DEX files. Disadvantages: Requires adding files to the APK. Requires the application to have at least one native library. Relies on the library being loaded early in the application execution. Notes[ 1 ] Note that LIEF does not modify the DEBUG entry … [ 2 ] Modifying the ELF Dynamic section is not as simple as the API might suggest. [ 3 ] In the ELF format, these are located in the INIT_ARRAY or INIT entries. [ 4 ] For those interested, checks are performed in the framework_base/core/jni/com_android_internal_content_NativeLibraryHelper.cpp file. Notably, these checks on the prefix and suffix are only performed if the application is not debuggable . API lief.ELF.Binary.add_library()", "contentHash": "dfb56067d8f65008a1ec78bc2e7e5bc5d880e38030fdcbc0cd5df76ce49588e4", "description": "09 - How to use Frida on a non-rooted device. In this tutorial, we will see how to use the Frida gadget on a non-rooted device.", "docname": "tutorials/09_frida_lief", "documentID": "0906a2fb68c71cd23b046497439b47e5f2de091f71fc4f1eafbed1fa6124824b", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/tutorials/09_frida_lief.md", "title": "09 - How to use Frida on a non-rooted device - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/tutorials/10_android_formats.html", "content": "10 - Android formats This tutorial introduces Android formats and the API for using them. This includes DEX, OAT, VDEX, and ART. Introduction Let’s start with a quick overview of the compilation, installation, and execution of Android applications. When developing applications, the main part of the code is usually written in Java. Developers can also write native code ( C/C++ ) through the Java Native Interface (JNI). In the APK building process, Java code is eventually transformed into Dalvik bytecode, which is interpreted by the Android Java virtual machine. The Android JVM differs from Oracle’s implementation; among other differences, it is register-based, whereas Oracle’s implementation is stack-based. To produce Dalvik bytecode, Java sources are first compiled with javac into Java bytecode, which Android then transforms into Dalvik bytecode using the dx compiler (or the newer D8 ). This bytecode is finally wrapped in DEX files, such as classes.dex . The DEX format is specific to Android, and its documentation is available here . During APK installation, the system applies optimizations to the DEX file to speed up execution. Interpreting bytecode is not as efficient as executing native code, and the Dalvik virtual machine is based on 32-bit registers, whereas most recent CPUs are 64-bit. To address this issue, and prior to Android 4.4 (KitKat), the runtime used JIT compilation to transform Dalvik bytecode into assembly. JIT occurred during execution each time the application was run. Since Android 4.4, Android has used a new runtime that performs optimizations during installation . Consequently, installation takes more time, but the transformation to native code is performed only once. To optimize Dalvik bytecode, the original DEX file (e.g., classes.dex ) is transformed into another file containing the native code. This new file typically has the .odex or .oat extension and is wrapped in the ELF format. Using the ELF format makes sense for two main reasons: It is the default format used by Linux and Android to package assembly code. It enables the use of the same loader: /system/bin/linker{64} . OAT files are actually ELF files, which is why we chose to add support for this format in LIEF. The ELF format acts as a wrapper around the Android-specific OAT format. Basically, the associated ELF exports a few symbols: oat = lief.OAT.parse(\"SomeOAT\") assert oat is not None for s in oat.dynamic_symbols: print(s) oatdata OBJECT GLOBAL 1000 1262000 oatexec OBJECT GLOBAL 1263000 10d4060 oatlastword OBJECT GLOBAL 233705c 4 oatbss OBJECT GLOBAL 2338000 f5050 oatbsslastword OBJECT GLOBAL 242d04c 4 These symbols serve as pointers to specific parts of the OAT format. For example, oatdata points to the beginning of the underlying OAT format, while oatexec points to the native code. For a deeper understanding of OAT internal structures, see: Hiding Behind ART - Black Hat 2015 Dalvik and ART OAT internal structures These different formats can be a bit confusing. To summarize: DEX files are transformed into .odex files, which are primarily ELF files wrapping a custom OAT format. OAT structure is poorly documented, and its internal structures change with each version of Android without backward compatibility. This means OAT files produced on Android 6.0.1 can only be used on that version. In the Android framework, the dex2oat executable is responsible for converting and optimizing APK DEX files into OATs. This executable is located in the /system/bin/ directory, and its output can be viewed via logcat: $ adb logcat -s \"dex2oat:I\" ... 05-04 10:16:37.218 1987 1987 I dex2oat : /system/bin/dex2oat --compiler-filter=speed --dex-file=/data/user/0/com.google.android.gms/snet/installed/snet.jar --oat-file=/data/user/0/com.google.android.gms/snet/dalvik-cache/snet.dex 05-04 10:16:37.688 1987 1998 W dex2oat : Compilation of void com.google.android.snet.Snet.enterSnetIdle(android.content.Context, android.os.Bundle) took 116.995ms 05-04 10:16:37.768 1987 1987 I dex2oat : ---------------------------------------------------- 05-04 10:16:37.768 1987 1987 I dex2oat : : S T A R T I N G . . . 05-04 10:16:37.768 1987 1987 E dex2oat : : oat location is not valid /data/user/0/com.google.android.gms/snet/dalvik-cache/snet.dex 05-04 10:16:37.768 1987 1987 I dex2oat : dex2oat took 552.045ms (threads: 8) arena alloc=3MB java alloc=1150KB native alloc=8MB free=3MB 05-04 12:25:50.878 10460 10460 I dex2oat : /system/bin/dex2oat --compiler-filter=speed ... The output above shows the transformation of SafetyNet DEX files, located in /data/user/0/com.google.android.gms/snet/installed/snet.jar , into an OAT saved in /data/user/0/com.google.android.gms/snet/dalvik-cache/snet.dex . One can see that the extension is .dex , which suggests a DEX file rather than an OAT. However, checking the file type reveals: $ file snet.dex snet.dex: ELF 64-bit LSB shared object, ARM aarch64, version 1 (GNU/Linux), dynamically linked, stripped It is an ELF file. Warning Do not trust extensions: .dex can be DEX or OAT , .odex files are OAT , .oat files are OAT , etc. The process of converting Java sources into OAT can be simplified with the following diagram: The Missing DEX When analyzing applications from the Google Play Store, the APK usually contains classes.dex files. Since these files contain the Dalvik bytecode, most tools rely on them for analysis (decompilation, static analysis, etc.). However, when analyzing manufacturer firmware (or ROMs), these DEX files might be missing. For example, the Samsung com.android.settings application is associated with the /system/priv-app/SecSettings2 directory, which has the following structure: $ tree system/priv-app/SecSettings2 ├── oat │ └── arm64 │ └── SecSettings2.odex └── SecSettings2.apk 2 directories, 2 files The SecSettings2.apk file does not contain any .dex files: $ unzip -l ./SecSettings2.apk|grep -c \"classes.dex\" 0 Next to SecSettings2.apk is SecSettings2.odex , which is the OAT file resulting from the optimization of the missing DEX file. Since ROM developers control the Android version and target architecture, they only need to provide the OAT file. This “feature” can also be used to hinder analysis and reverse engineering. Since the Dalvik bytecode resides in the DEX file, analysis is quite limited without it. Fortunately, a copy of the original DEX is included within the OAT! While it is not an exact copy (as dex2oat replaces some Dalvik instructions, such as invoke-virtual , with optimized ones [1] ), starting with Android N , the original instructions can also be recovered. Prior to Android Oreo (8.0.0), DEX files were embedded in the OAT itself. After Oreo, the transformation performed by dex2oat generates two files: classes.odex : OAT containing native code classes.vdex : VDEX file containing a copy of the original DEX files The DEX files originally located in the OAT have been exported to a new file with a new format : VDEX. This format is completely different from OAT; specifically, it is not an ELF file. Similar to the OAT format, VDEX internal structures change with each version of Android without backward compatibility. There also exist tools [4] [5] [6] to extract DEX files from OAT/VDEX files, but extraction [3] is either limited to OAT [4] or VDEX [5] . LIEF aims to provide a single framework for dealing with these formats. OAT and VDEX As explained previously, the internal structures of these formats change with each version of Android. LIEF provides an abstraction of these modifications, allowing users to work with OAT or VDEX without worrying about the underlying version. LIEF currently supports OAT files from Android 6.0 Marshmallow (OAT v64) to Android 8.0.1 Oreo (OAT v131). The OAT version can be obtained using the lief.OAT.version() function: >>> import lief >>> lief.OAT.version(\"classes.odex\") # From Android 6 64 >>> lief.OAT.version(\"classes.odex\") # From Android 7 88 The associated Android version can be accessed using lief.OAT.android_version() : >>> lief.OAT.android_version(64) ANDROID_VERSIONS.VERSION_601 >>> lief.OAT.android_version(124) ANDROID_VERSIONS.VERSION_800 >>> lief.Android.code_name(lief.Android.ANDROID_VERSIONS.VERSION_800) 'Oreo' >>> lief.Android.version_string(lief.Android.ANDROID_VERSIONS.VERSION_800) \"8.0.0\" To reflect the fact that OAT files are first and foremost ELF files, the lief.OAT.Binary class extends lief.ELF.Binary ( lief::elf::Binary ; lief.ELF.Binary ; LIEF::ELF::Binary ): >>> import lief >>> oat = lief.OAT.parse(\"classes.odex\") >>> type(oat) _pylief.OAT.Binary >>> isinstance(oat, lief.ELF.Binary) True Thus, the same ELF API is available (adding sections, modifying dynamic entries, etc.), and the lief.OAT.Binary object adds the following methods: class lief.OAT.Binary Bases: Binary OAT binary representation property classes → lief.OAT.Binary.it_classes Return an iterator over Class property dex2dex_json_info → str property dex_files → lief.OAT.Binary.it_dex_files Return an iterator over File **get_class( self , class_name: str ) → lief._lief.OAT.Class | None get_class( self , class_index: int ) → lief._lief.OAT.Class | None ** Overloaded function. get_class(self, class_name: str) -> lief._lief.OAT.Class | None Return the Class from its name get_class(self, class_index: int) -> lief._lief.OAT.Class | None Return the Class from its index has_class( self , arg: str , / ) → bool Check if the class with the given name is present in the current OAT binary property header → lief.OAT.Header Return the OAT Header property methods → lief.OAT.Binary.it_methods Return an iterator over Method property oat_dex_files → lief.OAT.Binary.it_oat_dex_files Return an iterator over DexFile If the OAT targets Android Marshmallow or Nougat (6 or 7), DEX files can be retrieved via the lief.OAT.Binary.dex_files attribute: oat: lief.OAT.Binary dex = oat.dex_files[0] dex.save(\"/tmp/classes.dex\") In the code above, the lief.DEX.File has been extracted to /tmp/classes.dex (with de-optimization). If the OAT targets Android Oreo or above, extraction uses the VDEX file. The lief.OAT.parse() function accepts an OAT file, or both an OAT and a VDEX file. Providing the VDEX file allows the lief.OAT.Binary object to offer the same functionality as it does for pre-Oreo OAT files. If the VDEX file is not provided, the lief.OAT.Binary will have limited information: # Without VDEX file >>> oat_oreo = lief.OAT.parse(\"KeyChain.odex\") >>> len(oat_oreo.dex_files) 0 >>> len(oat_oreo.classes) 0 >>> len(oat_oreo.oat_dex_files) 1 >>> oat_dex_file = oat_oreo.oat_dex_files[0] >>> print(oat_dex_file) /system/app/KeyChain/KeyChain.apk - (Checksum: 0x206c8ab1) # With VDEX file >>> oat_oreo = lief.OAT.parse(\"KeyChain.odex\", \"KeyChain.vdex\") >>> len(oat_oreo.dex_files) 1 >>> len(oat_oreo.classes) 17 >>> oat_oreo.dex_files[0].save(\"/tmp/classes.dex\") The LIEF VDEX module can also be used directly: >>> vdex = lief.VDEX.parse(\"KeyChain.vdex\") Because the VDEX format is completely different from OAT, ELF, PE, and Mach-O, the VDEX parser creates a lief.VDEX.File object rather than a Binary . DEX files can be extracted using the lief.VDEX.File.dex_files attribute: >>> len(vdex.dex_files) 1 >>> vdex.dex_files[0].save(\"/tmp/KeyChain.dex\") # With de-optimization DEX The previous section covered the OAT and VDEX formats and how to access the underlying DEX. This section introduces the primary API for the lief.DEX.File object. The LIEF DEX module allows you to obtain information about Java code, such as strings, class names, Dalvik bytecode, etc. Note Since the LIEF project focuses solely on formats, the DEX module does not include a Dalvik disassembler. The primary API for a DEX file is in the lief.DEX.File object. This object can be generated using: lief.OAT.Binary.dex_files lief.VDEX.File.dex_files lief.DEX.parse() >>> oat = lief.OAT.parse(\"SecSettings2.odex\") >>> type(oat.dex_files[0]) _pylief.DEX.File >>> vdex = lief.VDEX.parse(\"SecSettings2.odex\") >>> type(vdex.dex_files[0]) _pylief.DEX.File >>> dex = lief.DEX.parse(\"classes.dex\") >>> type(dex) _pylief.DEX.File Once created, strings can be accessed via the lief.DEX.File.strings attribute: dex: lief.DEX.File for s in dex.strings: if \"http\" in s: print(s) https://analytics.mopub.com/i/jot/exchange_client_event https://app-measurement.com/a https://mobilecrashreporting.googleapis.com/v1/crashes:batchCreate?key= https://pagead2.googlesyndication.com/pagead/gen_204?id=gmob-apps https://plus.google.com/ https://ssl.google-analytics.com https://support.google.com/dfp_premium/answer/7160685#push https://www.google.com ... Similarly, methods and classes are available via the lief.DEX.File.classes and lief.DEX.File.methods attributes: dex: lief.DEX.File for cls in dex.classes: if cls.source_filename: print(cls) com.avast.android.sdk.antitheft.internal.protection.wipe.a - CalendarWiper.java - 3 Methods com.avast.android.account.internal.identity.a - AvastIdentityProvider.java - 17 Methods com.avast.android.account.internal.identity.d - FacebookIdentityProvider.java - 19 Methods com.avast.android.lib.wifiscanner.internal.b$a - WifiScannerComponentFactory.java - 1 Methods In the DEX file format, a special attribute for classes records the original source filename: source_file_idx . Some obfuscators mangle class names but preserve this attribute! Since Java source filenames are associated with class names, the deobfuscated name can often be recovered using: lief.DEX.Class.source_filename lief.DEX.Class.pretty_name dex: lief.DEX.File for cls in dex.classes: if cls.source_filename: print(cls.pretty_name + \": ---> \" + cls.source_filename) com.avast.android.sdk.antitheft.internal.protection.wipe.a: ---> CalendarWiper.java com.avast.android.account.internal.identity.a ---> AvastIdentityProvider.java com.avast.android.account.internal.identity.d ---> FacebookIdentityProvider.java com.avast.android.lib.wifiscanner.internal.b$a ---> WifiScannerComponentFactory.java DEX methods are represented by the :class:`~lief.DEX.Method` object, and raw Dalvik bytecode can be accessed via :attr:`lief.DEX.Method.bytecode`. ART ART is the name of the Android Runtime , but it is also a format ! This format is used for optimization by the Android framework . As discussed previously, Android has its own implementation of the Java virtual machine based on Dalvik bytecode. This JVM is implemented in C++, and Java primitives ( java.lang.String , java.lang.Object , etc.) are mirrored with C++ objects: java.lang.Class : art::mirror::Class java.lang.String : art::mirror::String java.lang.reflect.Method : art::mirror::Method … When a new Java class is instantiated, a mirrored C++ object is created (memory allocation, constructor calls, etc.), and the JVM maintains a reference to this C++ object. To speed up the boot process and avoid re-instantiating well-known classes [2] at each boot, Android uses the ART format to store instances of C++ objects. It can be thought of as a heap dump of C++ objects. As with OAT and VDEX, the internal structures of this format change with each version of Android. LIEF 0.9 provides basic support for this format and exposes the ART lief.ART.Header . The primary API is available in the lief.ART.File object. art = lief.ART.parse(\"boot.art\") assert isinstance(art, lief.ART.File) print(art.header) Version: 46 Image Begin: 0x70000000 Image Size: 0x238ac8 Checksum: 0x997c0fb0 OAT File Begin: 0x70a5b000 OAT File End: 0x71272000 OAT Data Begin: 0x70a5c000 OAT Data End: 0x7126df70 Patch Delta: 0 Pointer Size: 8 Compile pic: true Number of sections: 10 Number of methods: 7 Boot Image Begin: 0 Boot Image Size: 0 Boot OAT Begin: 0 Boot OAT Size: 0 Storage Mode: UNCOMPRESSED Data Size: 0x2389f0 Conclusion LIEF 0.9 provides read-only access to these formats, but future versions should allow for modification (adding methods, changing names, patching checksums, etc.). Enjoy! Notes[ 1 ] http://mylifewithandroid.blogspot.com/2009/05/about-quick-method-invocation.html https://github.com/JesusFreke/smali/wiki/UnresolvableOdexInstruction [ 2 ] Usually those from the Android Framework. [ 3 ] Other tools may have additional features like a disassembler or pseudo-code generation that are not covered in LIEF. 4 Dextra by Jonathan Levin: http://newandroidbook.com/tools/dextra.html 5 vdexExtractor by Anestis Bechtsoudis: https://github.com/anestisb/vdexExtractor [ 6 ] smali by JesusFreke: https://github.com/JesusFreke/smali/wiki/DeodexInstructions API lief.OAT.Binary lief.VDEX.File lief.DEX.File lief.ART.File", "contentHash": "c1b8e20f8d284cc96fac1d30ede78295b62d0ec3b5ec7714afb8097ecdc25a4a", "description": "10 - Android formats. This tutorial introduces Android formats and the API for using them. This includes DEX, OAT, VDEX, and ART.", "docname": "tutorials/10_android_formats", "documentID": "f7c489749b5faa1b0ca4306bfcd9b2e7ab8ef63c6a09c0f04bfcd040a89845ef", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/tutorials/10_android_formats.md", "title": "10 - Android formats - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/tutorials/11_macho_modification.html", "content": "11 - Mach-O Modification This tutorial covers Mach-O format modification and introduces some internal aspects of the format. Files and scripts used in this tutorial are available in the tutorials repository . Introduction A basic Mach-O binary (i.e., not FAT) can be represented in four parts, as described in this diagram: The first part begins with a header that can be accessed through the lief.MachO.Binary.header attribute. The second part contains the load commands table, which can be iterated over using lief.MachO.Binary.load_commands . This is optionally followed by padding or free space. Finally, the fourth part contains the raw data (assembly code, rebase bytecode, signatures, etc.). Load commands such as SegmentCommand or DyldInfo can be associated with raw data located after the load command table and the padding section. The padding section is used by macOS to sign the binary after compilation by adding a custom command. The codesign utility extends the raw data area with the signature and adds an LC_CODE_SIGNATURE or LC_DYLIB_CODE_SIGN_DRS command in the padding area. Since load commands are the base unit of the Mach-O format (segments, shared libraries, entry points, etc., are all commands ), the ability to add arbitrary commands to a binary enables interesting possibilities such as code injection, anti-analysis, etc. Different techniques exist for adding new commands to a Mach-O binary: Replacing an existing load command that is not mandatory for execution, such as UUIDCommand or CodeSignature . Using the padding area to expand the command header. The main limitation of these techniques is that the size and number of commands that can be added are tied to the padding section size or the size of the command replaced. If the padding size is small, we cannot add a LOAD_DYLIB command with a very long library path. Moreover, codesign may complain if there is insufficient space to add the LC_CODE_SIGNATURE because we are using space that was reserved for it. The following sections discuss format modifications and how LIEF addresses these limitations. When PIE Makes Things Easier macOS and iOS executables are typically compiled with flags that make them position-independent. Instructions generated by the compiler use relative addressing associated with rebase information. To simplify, PIE binaries allow the raw data section to be mapped at a random base address. LIEF leverages this by shifting the raw data section within the format. Such a transformation also requires maintaining consistent format metadata. Specifically, when we shift the raw data, we must update relocations, segment offsets, virtual addresses, etc. Once the raw data is shifted and the metadata updated, we have arbitrary space between the load command table and the raw data section. Thus, we can extend the load command table as shown in the figure below: Warning The size of the shift must be aligned with the page size to avoid issues with section and segment alignment. Maintaining format consistency after a shift transformation is complex. The next section presents parts of the Mach-O format that must be updated to maintain consistency. When Mach-O Makes Things Harder After the shift operation, we must update several load commands: lief.MachO.SymbolCommand.symbol_offset / lief.MachO.SymbolCommand.strings_offset lief.MachO.DataInCode.data_offset , lief.MachO.CodeSignature.data_offset , lief.MachO.SegmentSplitInfo.data_offset lief.MachO.MainCommand.entrypoint lief.MachO.FunctionStarts.data_offset / lief.MachO.FunctionStarts.functions DynamicSymbolCommand lief.MachO.Section.offset / lief.MachO.Section.virtual_address lief.MachO.SegmentCommand.offset / lief.MachO.SegmentCommand.virtual_address … We also need to update: Relocations Binding information Export information While the ELF and PE formats use structures for internal storage of relocations and exports, the Mach-O format uses bytecode to rebase the binary. Export information is stored in a trie data structure. The use of tries and bytecode reduces binary size but makes updates more difficult, as we must interpret and regenerate the bytecode. Rebase Bytecode As mentioned previously, recent Mach-O loaders use bytecode to relocate (or rebase) the binary. The offset and size of the bytecode are specified in the lief.MachO.DyldInfo.rebase attribute. Basically, the bytecode is composed of REBASE_OPCODES that define addresses to relocate. Warning Note that the Section object has a relocation_offset attribute. This appears to be used only for Mach-O object files ( lief.MachO.Header.FILE_TYPE.OBJECT ) or executables using an old version of the Mach-O loader. This offset points to a list of relocation structures (not bytecode), the number of which is defined by numberof_relocations . To determine which addresses must be relocated, we must interpret the bytecode. The lief.MachO.DyldInfo.show_rebases_opcodes attribute returns the bytecode as pseudo-code : import lief app = lief.parse(\"MachO64_x86-64_binary_id.bin\") print(app.dyld_info.show_rebases_opcodes) [SET_TYPE_IMM] Type: POINTER [SET_SEGMENT_AND_OFFSET_ULEB] Segment Index := 2 (__DATA) Segment Offset := 0x20 [DO_REBASE_ULEB_TIMES] for i in range(26): rebase(POINTER, __DATA, 0x20) Segment Offset += 0x8 (0x28) rebase(POINTER, __DATA, 0x28) Segment Offset += 0x8 (0x30) rebase(POINTER, __DATA, 0x30) Segment Offset += 0x8 (0x38) rebase(POINTER, __DATA, 0x38) Segment Offset += 0x8 (0x40) rebase(POINTER, __DATA, 0x40) Segment Offset += 0x8 (0x48) ... [DONE] From the output above, we can see that the loader will rebase pointers in the __DATA segment at offsets 0x20, 0x28, 0x38, ... . For those who only care about the exact addresses being relocated, this output is not very user-friendly. LIEF also provides a representation of this bytecode by creating lief.MachO.Relocation objects, which are the result of interpreting the bytecode. The lief.MachO.Binary.relocations attribute returns an iterator over lief.MachO.Relocation objects that model a relocation, similar to lief.ELF.Relocation and lief.PE.Relocation . app: lief.MachO.Binary for relocation in app.relocations: print(relocation) 100002020 POINTER 64 DYLDINFO __DATA.__la_symbol_ptr _err 100002028 POINTER 64 DYLDINFO __DATA.__la_symbol_ptr _errx 100002030 POINTER 64 DYLDINFO __DATA.__la_symbol_ptr _exit 100002038 POINTER 64 DYLDINFO __DATA.__la_symbol_ptr _fprintf 100002040 POINTER 64 DYLDINFO __DATA.__la_symbol_ptr _free 100002048 POINTER 64 DYLDINFO __DATA.__la_symbol_ptr _fwrite ... Using this representation, we can update relocations by adding the shift size to the lief.MachO.Relocation.address attribute. When the Mach-O builder reconstructs the final binary, it regenerates and optimizes the rebase bytecode according to the current state of the relocations. The process can be summarized by the following diagram: Binding Bytecode The Mach-O loader also uses bytecode to bind imported functions or symbols. This bytecode is used in three different binding methods: Normal binding Weak binding (used when the same symbol is defined multiple times) Lazy binding (bound only when the symbol is accessed) The bytecode can be pretty-printed with show_bind_opcodes , show_weak_bind_opcodes , and show_lazy_bind_opcodes : app: lief.MachO.Binary print(app.dyld_info.show_bind_opcodes) [SET_DYLIB_ORDINAL_IMM] Library Ordinal := 1 [SET_SYMBOL_TRAILING_FLAGS_IMM] Symbol name := ___stderrp Is Weak ? false [SET_TYPE_IMM] Type := POINTER [SET_SEGMENT_AND_OFFSET_ULEB] Segment := __DATA Segment Offset := 0x10 [DO_BIND] bind(POINTER, __DATA, 0x10, ___stderrp, library_ordinal=/usr/lib/libSystem.B.dylib, addend=0, is_weak_import=false) Segment Offset += 0x8 (0x18) The representation and update process are identical to those described in the Rebase Bytecode section. Export Trie For exported functions and symbols, the Mach-O format uses a trie structure to store export information. The trie offset and size are specified in the export_trie attribute. Once parsed, trie entries are represented via the ExportInfo object and can be retrieved using the export_info attribute. app = lief.parse(\"FAT_MachO_x86_x86-64_library_libdyld.dylib\") print(app.dyld_info.show_export_trie) ... _@off.0x17 _N@off.0x21 _NS@off.0x50 _NSI@off.0x5d _NSInstallLinkEditErrorHandlers@off.0x11d _NSInstallLinkEditErrorHandlers{addr: 0x126b, flags: 0} ... app: lief.MachO.Binary for s in app.symbols: if s.has_export_info: print(s.export_info) Node Offset: 128 Flags: 0 Address: 126b Symbol: _NSInstallLinkEditErrorHandlers Node Offset: 5f6 Flags: 0 Address: 2168 Symbol: _NSIsSymbolDefinedInObjectFileImage Node Offset: 1a0 Flags: 0 Address: 1391 Symbol: _NSIsSymbolNameDefined ... After the shift operation, export information is patched by updating the address attribute, and a new export trie is generated from the updated data. Removing the Signature Removing the LC_CODE_SIGNATURE command is a basic modification that is very useful when modifying Mach-O files. Since the signature verifies the integrity of the binary, this command typically needs to be removed after modifying the file. The binary can be re-signed once all modifications are finished. LIEF provides the lief.MachO.Binary.remove_signature() function to remove this command: ssh: lief.MachO.Binary ssh.remove_signature() ssh.write(\"ssh.nosigned\") Code Injection with Shared Libraries As explained in the talk on format modification [1] , one way to inject code into a program’s memory space is to force the loader to load a library (previously unlinked) that contains a constructor function. For a Mach-O binary, this can be achieved by adding one of these load commands: ID_DYLIB LOAD_DYLIB … Consider an example using clang . First, we create a small library that defines a constructor: #include #include __attribute__((constructor)) void my_constructor(void) { printf(\"Hello World\\n\"); } This is compiled with: $ clang -fPIC -shared libexample.c -o libexample.dylib Then, we add a new LOAD_DYLIB using the lief.MachO.Binary.add_library() function: clang: lief.MachO.Binary clang.add_library(\"/Users/romain/libexample.dylib\") clang.write(\"/tmp/clang.new\") Finally, we run clang.new and observe that Hello World is printed before the main execution of clang : $ chmod u+x /tmp/clang.new $ /tmp/clang.new Hello World clang: error: no input files We can also see the new LOAD_DYLIB command using otool : $ otool -l /tmp/clang.new|grep -C4 LOAD_DYLIB ... cmdsize 16 dataoff 73864 datasize 0 Load command 16 cmd LC_LOAD_DYLIB cmdsize 56 name /Users/romain/libexample.dylib (offset 24) time stamp 2 Thu Jan 1 01:00:02 1970 current version 0.0.0 Adding a Section/Segment Since we can allocate arbitrary space between the load command table and the raw data, we can also extend an existing LoadCommand . In particular, Mach-O segments are commands associated with the LIEF object lief.MachO.SegmentCommand . To add a new section to the __TEXT segment, we must extend the load command associated with that segment to accommodate a new section structure. We must also reserve space for the section’s content. Since the content of the __TEXT segment begins at offset 0 and ends somewhere in the raw data, the appropriate place to insert the new content is between the end of the load command table and the beginning of the raw data: The process described above is implemented via the lief.MachO.Binary.add_section() method. In this example, we will inject assembly code that executes /bin/sh : app: lief.MachO.Binary raw_shell: list[int] section = lief.MachO.Section.create(\"__shell\", raw_shell) assert isinstance(section, lief.MachO.Section) section.alignment = 2 section += lief.MachO.Section.FLAGS.SOME_INSTRUCTIONS section += lief.MachO.Section.FLAGS.PURE_INSTRUCTIONS section = app.add_section(section) print(section) We can then change the entry point by setting the lief.MachO.MainCommand.entrypoint attribute: app: lief.MachO.Binary section: lief.MachO.Section __TEXT = app.get_segment(\"__TEXT\") assert __TEXT is not None main = app.main_command assert main is not None main.entrypoint = section.virtual_address - __TEXT.virtual_address Finally, we remove the signature and reconstruct the binary: app: lief.MachO.Binary app.remove_signature() app.write(\"./id.modified\") The execution of id.modified should yield a similar output: Mac-mini:tmp romain$ ./id.modified tmp @ [romain] $ You can also check other tools such as optool [2] or insert_dylib [3] . References[ 1 ] https://www.romainthomas.fr/publication/static-instrumentation/ [ 2 ] https://github.com/alexzielenski/optool [ 3 ] https://github.com/Tyilo/insert_dylib API lief.MachO.Binary.add_section() lief.MachO.Binary.add_library()", "contentHash": "60f0f716f85b46221af442fbbc6b4358aa8f36eb09a56fb4278edab6d088e77f", "description": "11 - Mach-O Modification. This tutorial covers Mach-O format modification and introduces some internal aspects of the format.", "docname": "tutorials/11_macho_modification", "documentID": "4db01f98ac6622c305e0d3b5235318f57e369850cc33d0ba0f21e88ca8ba349e", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/tutorials/11_macho_modification.md", "title": "11 - Mach-O Modification - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/tutorials/12_elf_coredump.html", "content": "12 - ELF Coredump This tutorial introduces the API for analyzing and manipulating ELF coredumps. Introduction ELF core [1] files provide information about the CPU state and memory state of a program at the time the coredump was generated. The memory state includes a snapshot of all segments mapped into the process’s memory space. The CPU state contains register values from when the core dump was generated. Coredump files use a subset of ELF structures to store this information. Segments are used for the memory state of the process, while ELF notes ( lief.ELF.Note ) are used for process metadata (PID, signal, etc.). Notably, the CPU state is stored in a note with a specific type. Here is an overview of the coredump layout: For more details about coredump internal structures, refer to the following blog post: Anatomy of an ELF core file . Coredump Analysis Since core files are effectively ELF files, they can be opened using the lief.abstract.parse ( lief.parse() ; LIEF::Parser::parse() ) function: import lief core = lief.parse(\"ELF64_AArch64_core_hello.core\") We can iterate over the Segment objects to inspect the memory state of the program: core: lief.ELF.Binary segments = core.segments print(f\"Number of segments {len(segments)}\") for segment in segments: print(hex(segment.virtual_address)) To resolve the relationship between libraries and segments, we can examine the special note lief.ELF.CoreFile : core: lief.ELF.Binary nt_core_file = core.get(lief.ELF.Note.TYPE.CORE_FILE) ELF notes are represented via the main lief.ELF.Note interface. Some notes, such as lief.ELF.CoreFile , expose additional APIs by extending the original lief.ELF.Note . Note All note details inherit from the base class lief.ELF.Note (or LIEF::ELF::Note ). Specifically, in C++, we must downcast using the classof function: for (const Note& note : binary->notes()) { if (CoreFile::classof(¬e)) { const auto& nt_core_file = static_cast(note); } } This is roughly equivalent in Python to: binary: lief.ELF.Binary for note in binary.notes: if isinstance(note, lief.ELF.CoreFile): print(\"This is a CoreFile note\") We can use the lief.ELF.CoreFile.files attribute or iterate directly over the lief.ELF.CoreFile object. Both provide access to lief.ELF.CoreFileEntry objects: nt_core_file: lief.ELF.CoreFile for file_entry in nt_core_file: print(file_entry) /data/local/tmp/hello-exe: [0x5580b86000, 0x5580b88000]@0 /data/local/tmp/hello-exe: [0x5580b97000, 0x5580b98000]@0x1000 /data/local/tmp/hello-exe: [0x5580b98000, 0x5580b99000]@0x2000 /system/lib64/libcutils.so: [0x7fb7593000, 0x7fb7595000]@0xf000 /system/lib64/libcutils.so: [0x7fb7595000, 0x7fb7596000]@0x11000 /system/lib64/libnetd_client.so: [0x7fb75fb000, 0x7fb75fc000]@0x2000 /system/lib64/libnetd_client.so: [0x7fb75fc000, 0x7fb75fd000]@0x3000 /system/lib64/libdl.so: [0x7fb7a2e000, 0x7fb7a2f000]@0x1000 /system/lib64/libdl.so: [0x7fb7a2f000, 0x7fb7a30000]@0x2000 /data/local/tmp/liblibhello.so: [0x7fb7b22000, 0x7fb7b2a000]@0xcb000 /data/local/tmp/liblibhello.so: [0x7fb7b2a000, 0x7fb7b2b000]@0xd3000 /system/lib64/libc.so: [0x7fb7c0e000, 0x7fb7c14000]@0xc5000 /system/lib64/libc.so: [0x7fb7c14000, 0x7fb7c16000]@0xcb000 /system/lib64/liblog.so: [0x7fb7c6c000, 0x7fb7c6d000]@0x16000 /system/lib64/liblog.so: [0x7fb7c6d000, 0x7fb7c6e000]@0x17000 /system/lib64/libc++.so: [0x7fb7d6f000, 0x7fb7d77000]@0xe2000 /system/lib64/libc++.so: [0x7fb7d77000, 0x7fb7d78000]@0xea000 /system/lib64/libm.so: [0x7fb7db8000, 0x7fb7db9000]@0x36000 /system/lib64/libm.so: [0x7fb7db9000, 0x7fb7dba000]@0x37000 /system/bin/linker64: [0x7fb7e93000, 0x7fb7f87000]@0 /system/bin/linker64: [0x7fb7f88000, 0x7fb7f8c000]@0xf4000 /system/bin/linker64: [0x7fb7f8c000, 0x7fb7f8d000]@0xf8000 From this output, we can see that the Segment entries of the main executable ( /data/local/tmp/hello-exe ) are mapped from address 0x5580b86000 to 0x5580b99000 . The register state can also be accessed by looking for the lief.ELF.CorePrStatus note: core: lief.ELF.Binary for note in core.notes: if not isinstance(note, lief.ELF.CorePrStatus): continue # Both are equivalent print(note.pc) reg_values = note.register_values print(reg_values[lief.ELF.CorePrStatus.Registers.AARCH64.PC.value]) 0x5580b86f50 0x5580b86f50 Coredump Manipulation To a certain extent, LIEF enables the modification of coredumps. For instance, we can update register values as follows: core: lief.ELF.Binary prstatus = core.get(lief.ELF.Note.TYPE.CORE_PRSTATUS) assert isinstance(prstatus, lief.ELF.CorePrStatus) prstatus.set(lief.ELF.CorePrStatus.Registers.AARCH64.PC, 0xDEADC0DE) core.write(\"/tmp/new.core\") When opening /tmp/new.core in GDB, we can observe the modification: Final word One advantage of a coredump over a raw binary is that relocations and dependencies are already resolved within the coredump. This API can be used in conjunction with other tools. For example, we could use the Triton API: AArch64Cpu::setConcreteRegisterValue() AArch64Cpu::setConcreteMemoryAreaValue() to map the coredump into Triton and then use its engines for taint analysis and symbolic execution. References[ 1 ] https://www.gabriel.urdhr.fr/2015/05/29/core-file/ API lief.parse() lief.ELF.Note lief.ELF.CorePrPsInfo lief.ELF.CorePrStatus lief.ELF.CoreFile lief.ELF.CoreFileEntry lief.ELF.CoreSigInfo lief.ELF.CoreAuxv", "contentHash": "63405ca42d98d3f44dba2776e3da33e6acf7bec2927d6ed65621478fa4a8a7aa", "description": "12 - ELF Coredump. This tutorial introduces the API for analyzing and manipulating ELF coredumps.", "docname": "tutorials/12_elf_coredump", "documentID": "c0a1d1ed22afa1356d76b86193d0ef29b5627784077415da26e29e8041bb9cde", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/tutorials/12_elf_coredump.md", "title": "12 - ELF Coredump - LIEF Documentation"}, {"canonical": "https://lief.re/doc/latest/tutorials/13_pe_authenticode.html", "content": "13 - PE Authenticode This tutorial explains how to process and verify PE Authenticode with LIEF. Introduction PE Authenticode is the signature scheme used by Windows to sign and verify the integrity of PE executables. The signature is associated with the CERTIFICATE_TABLE data directory, which is not always tied to a section (implying that the signature is not necessarily mapped into memory). In fact, the data directory entry points to a file offset, not an RVA. This signature is wrapped in a PKCS #7 container with custom object types, as defined in the official documentation [1] . Parsing these signatures has been a goal since LIEF’s inception. Before version v0.11.0 , the implementation was incomplete and sometimes inaccurate. Since version v0.11.0 , and thanks to sponsorship from the CERT Gouvernemental of Luxembourg , we have refactored the Authenticode parser [2] and implemented signature verification functions. Exploring the PKCS #7 Signature The LIEF API exposes most internal components of the PKCS #7 container associated with Authenticode. First, we can access the PE signatures through the lief.PE.Binary.signatures() ( lief::pe::Binary::signatures ; lief.PE.Binary.signatures ; LIEF::PE::Binary::signatures() ) attribute [3] : pe: lief.PE.Binary print(len(pe.signatures)) signature = pe.signatures[0] Although we usually find only one signature, PE executables can embed multiple signatures using the /as command of signtool.exe . This is why the signatures attribute returns an iterator over the signatures parsed by LIEF. The signature variable is a lief.PE.Signature ( lief::pe::Signature ; lief.PE.Signature ; LIEF::PE::Signature ) object, which mirrors the PKCS #7 container and includes methods for verifying its integrity. Within this object, we can access the following attributes: x509 certificates used to sign the executable: lief.PE.Signature.certificates The ContentInfo object containing the authentihash: lief.PE.ContentInfo.digest The SignerInfo structures: lief.PE.Signature.signers Note While the PKCS #7 standard supports multiple signers, Microsoft specifications require exactly one signer. The __str__() methods of these objects are overloaded to facilitate pretty-printing their content: signature: lief.PE.Signature # Print certificate information for crt in signature.certificates: print(crt) # Print the authentihash value embedded in the signature print(signature.content_info.digest.hex()) # Print signer information print(signature.signers[0]) cert. version : 3 serial number : 04:09:18:1B:5F:D5:BB:66:75:53:43:B5:6F:95:50:08 issuer name : C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA subject name : C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA issued on : 2013-10-22 12:00:00 expires on : 2028-10-22 12:00:00 signed using : RSA with SHA-256 RSA key size : 2048 bits basic constraints : CA=true, max_pathlen=0 key usage : Digital Signature, Key Cert Sign, CRL Sign ext key usage : Code Signing cert. version : 3 serial number : 09:70:EF:4B:AD:5C:C4:4A:1C:2B:C3:D9:64:01:67:4C issuer name : C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA subject name : C=CZ, L=Praha, O=Avast Software s.r.o., OU=RE stapler cistodc, CN=Avast Software s.r.o. issued on : 2020-04-02 00:00:00 expires on : 2023-03-09 12:00:00 signed using : RSA with SHA-256 RSA key size : 2048 bits basic constraints : CA=false key usage : Digital Signature ext key usage : Code Signing a738da4446a4e78ab647db7e53427eb07961c994317f4c59d7edbea5cc786d80 SHA_256/RSA - C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA - 4 auth attr - 1 unauth attr For PE files, the authentihash is computed using the lief.PE.Binary.authentihash() function, which takes a lief.PE.ALGORITHMS enum as a parameter to define the hash algorithm. For instance, to compute the SHA-256 authentihash, pass lief.PE.ALGORITHMS.SHA_256 : pe: lief.PE.Binary print(pe.authentihash(lief.PE.ALGORITHMS.SHA_256).hex()) a738da4446a4e78ab647db7e53427eb07961c994317f4c59d7edbea5cc786d80 Note To compare the lief.PE.Binary.authentihash() value with the signed one (i.e., lief.PE.ContentInfo.digest ), you must use the same hash algorithm as defined by lief.PE.Signature.digest_algorithm . We also provide shortcut attributes in the Python API to compute authentihash values: Hash Algorithm Binary Attribute MD5 authentihash_md5 SHA1 authentihash_sha1 SHA-256 authentihash_sha256 SHA-512 authentihash_sha512 LIEF also exposes the original raw signature blob via the lief.PE.Signature.raw_der property, which allows for exporting the signature: from pathlib import Path signature: lief.PE.Signature Path(\"/tmp/extracted.p7b\").write_bytes(signature.raw_der) Then, you can use openssl to process its content: $ openssl pkcs7 -inform der -print -in /tmp/extracted.p7b -noout -text ... sig_alg: algorithm: sha256WithRSAEncryption (1.2.840.113549.1.1.11) parameter: NULL signature: (0 unused bits) 0000 - 31 c3 a7 f3 70 e3 2c 49-15 bd f4 09 6c 27 4e 1...p.,I....l'N 000f - 00 a9 23 df cb ea 7f 99-55 cb 24 88 75 e8 c4 ..#.....U.$.u.. 001e - de 48 4f 70 dd 2a 27 5c-df be 36 f6 84 0d ad .HOp.*'\\..6.... 002d - 35 5e 65 f7 af 55 01 7a-2d 01 18 a0 d6 98 a4 5^e..U.z-...... 003c - d1 bd 19 e9 a4 03 f4 a3-4d 12 6e 72 5f 6b 3a ........M.nr_k: 004b - b8 de 45 f1 63 80 b0 47-42 f6 38 b8 e7 5b dd ..E.c..GB.8..[. 005a - cf f2 f8 c2 61 4b 2c 19-b7 7d 78 8f 2e 0c b0 ....aK,..}x.... 0069 - 7c f2 d9 8e 9f 65 4e 21-63 19 6a 5b 0c 91 12 |....eN!c.j[... 0078 - 44 29 fe 91 d5 6f 5d 9c-4d 7b a1 74 c6 69 d9 D)...o].M{.t.i. 0087 - e7 23 26 54 35 5c 38 33-c5 a7 92 0d 70 a5 2a .#&T5\\83....p.* 0096 - 33 77 4a fc 86 b0 fa 59-2f 24 f6 a1 45 b2 09 3wJ....Y/$..E.. 00a5 - 75 2d a1 81 68 e4 67 11-46 e3 fb bf 0c c5 d5 u-..h.g.F...... 00b4 - d7 7b 7b 35 fb d6 e8 4a-c9 13 82 82 a7 0c 3e .{{5...J......> 00c3 - 6f 61 e0 37 15 e0 37 5d-b8 22 14 ad 54 58 0e oa.7..7].\"..TX. 00d2 - 95 6c 2b b1 d2 c7 6c 86-a1 9f fa d8 37 ca f7 .l+...l.....7.. 00e1 - 56 75 b0 9d df 7c 46 43-20 87 8a a3 81 47 82 Vu...|FC ....G. 00f0 - 99 57 87 12 46 96 02 7c-a7 77 b9 42 4d c8 05 .W..F..|.w.BM.. 00ff - 0a . crl: signer_info: version: 1 issuer_and_serial: issuer: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA serial: 12549442701880659695003200114191853388 digest_alg: algorithm: sha256 (2.16.840.1.101.3.4.2.1) parameter: NULL auth_attr: object: contentType (1.2.840.113549.1.9.3) set: OBJECT:undefined (1.3.6.1.4.1.311.2.1.4) object: undefined (1.3.6.1.4.1.311.2.1.11) The pe_authenticode_reader.py script in the examples/ directory can also be used to inspect the signature: $ python pe_authenticode_reader.py --all avast_free_antivirus_setup_online.exe Signature version : 1 Digest Algorithm : ALGORITHMS.SHA_256 Content Info: Content Type : 1.3.6.1.4.1.311.2.1.4 (SPC_INDIRECT_DATA_CONTENT) Digest Algorithm: ALGORITHMS.SHA_256 Digest : a738da4446a4e78ab647db7e53427eb07961c994317f4c59d7edbea5cc786d80 Certificates Version : 3 Issuer : C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA Subject : C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA Serial Number : 0409181b5fd5bb66755343b56f955008 Signature Algorithm: SHA256_WITH_RSA_ENCRYPTION Valid from : 2013/10/22 - 12:00:00 Valid to : 2028/10/22 - 12:00:00 Key usage : CRL_SIGN - KEY_CERT_SIGN - DIGITAL_SIGNATURE Ext key usage : CODE_SIGNING RSA key size : 2048 =========================================== Version : 3 Issuer : C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA Subject : C=CZ, L=Praha, O=Avast Software s.r.o., OU=RE stapler cistodc, CN=Avast Software s.r.o. Serial Number : 0970ef4bad5cc44a1c2bc3d96401674c Signature Algorithm: SHA256_WITH_RSA_ENCRYPTION Valid from : 2020/04/02 - 00:00:00 Valid to : 2023/03/09 - 12:00:00 Key usage : DIGITAL_SIGNATURE Ext key usage : CODE_SIGNING RSA key size : 2048 =========================================== Signer(s) Version : 1 Serial Number : 0970ef4bad5cc44a1c2bc3d96401674c Issuer : C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA Digest Algorithm : ALGORITHMS.SHA_256 Encryption Algorithm: ALGORITHMS.RSA Encrypted Digest : 758db1f480eb25bada6c ... Authenticated attributes: Content Type OID: 1.3.6.1.4.1.311.2.1.4 (SPC_INDIRECT_DATA_CONTENT) MS Statement type OID: 1.3.6.1.4.1.311.2.1.21 (INDIVIDUAL_CODE_SIGNING) Info: http://www.avast.com PKCS9 Message Digest: 3983816a7d1c62962540ec66fa8790fa45d1063cb23e933677de459f0b73c577 Un-authenticated attributes: Generic Type 1.3.6.1.4.1.311.3.3.1 (MS_COUNTER_SIGN) Verifying the Signature In addition to parsing Authenticode signatures, LIEF can also verify the integrity of the authentihash using the lief.PE.Binary.verify_signature() ( lief::pe::Binary::verify_signature ; lief.PE.Binary.verify_signature() ; LIEF::PE::Binary::verify_signature() ) method. This method returns lief.PE.Signature.VERIFICATION_FLAGS.OK if the signature is valid, or another enum value if it is invalid (see: lief.PE.Signature.VERIFICATION_FLAGS ): pe: lief.PE.Binary print(pe.verify_signature()) # lief.PE.Signature.VERIFICATION_FLAGS.OK You can also verify a PE binary with a detached signature by providing a signature object to verify_signature() : pe: lief.PE.Binary detached_sig = lief.PE.Signature.parse(\"/tmp/detached.p7b\") assert isinstance(detached_sig, lief.PE.Signature) print(pe.verify_signature(detached_sig)) The verification process does not rely on external components (i.e., neither OpenSSL nor the WinTrust API). Instead, we attempt to reproduce the same checks described in the RFCs and official Authenticode documentation [4] . These checks include: Verifying the integrity of the signature ( lief.PE.Signature.check() ): Ensuring there is exactly one SignerInfo structure. Confirming that digest algorithms are consistent ( Signature.digest_algorithm == ContentInfo.digest_algorithm == SignerInfo.digest_algorithm ). If SignerInfo has authenticated attributes, verifying their integrity. Otherwise, verifying the integrity of the ContentInfo against the signer’s certificate. If authenticated attributes exist, confirming the presence of a lief.PE.PKCS9MessageDigest attribute whose digest matches the hash of the ContentInfo . If a countersignature exists in the unauthenticated attributes , verifying its integrity and ensuring it includes a valid timestamp . Checking certificate expiration relative to any timestamp . If the signature is valid, confirming that lief.PE.ContentInfo.digest matches the computed authentihash() . These checks represent the default behavior of verify_signature() . You can, however, pass lief.PE.Signature.VERIFICATION_CHECKS flags to customize this behavior: Hash Only: Using VERIFICATION_CHECKS.HASH_ONLY only performs step B) (i.e., checks the authentihash values regardless of signature integrity). pe: lief.PE.Binary pe.verify_signature(lief.PE.Signature.VERIFICATION_CHECKS.HASH_ONLY) Lifetime Signing: Using VERIFICATION_CHECKS.LIFETIME_SIGNING allows timestamped signatures to expire if their certificate has expired. This corresponds to WTD_LIFETIME_SIGNING_FLAG . pe: lief.PE.Binary signature: lief.PE.Signature pe.verify_signature(lief.PE.Signature.VERIFICATION_CHECKS.LIFETIME_SIGNING) signature.check(lief.PE.Signature.VERIFICATION_CHECKS.LIFETIME_SIGNING) Skip Certificate Time Check: Using VERIFICATION_CHECKS.SKIP_CERT_TIME prevents LIEF from raising an error if certificates have expired. pe: lief.PE.Binary signature: lief.PE.Signature # Returns lief.PE.Signature.VERIFICATION_FLAGS.OK even if # the certificates have expired pe.verify_signature(lief.PE.Signature.VERIFICATION_CHECKS.SKIP_CERT_TIME) signature.check(lief.PE.Signature.VERIFICATION_CHECKS.SKIP_CERT_TIME) Note To verify the integrity of a Signature object, you can use lief.PE.Signature.check() ( lief::pe::Signature::check ; lief.PE.Signature.check() ; LIEF::PE::Signature::check() ). Certificate Chain of Trust Finally, the certificate chain can be verified using: lief.PE.x509.verify() lief.PE.x509.is_trusted_by() verify() is used to verify a signed certificate against its CA. Given a CA x509 certificate, CA.verify(signed) confirms that the signed parameter was indeed signed by CA . Alternatively, is_trusted_by() checks whether a given x509 certificate can be verified against a list of certificates : signature: lief.PE.Signature CA_BUNDLE = lief.PE.x509.parse(\"ms_bundle.pem\") signer = signature.signers[0] print(signer.cert.is_trusted_by(CA_BUNDLE)) signer: lief.PE.SignerInfo cert1 = lief.PE.x509.parse(\"ca1.crt\")[0] cert2 = lief.PE.x509.parse(\"ca2.crt\")[0] print(signer.cert.is_trusted_by([cert1, cert2])) Limitations Regarding the PKCS #7 structure, LIEF can parse and process most of its elements. However, the lief.PE.SignerInfo structure can embed attributes (authenticated or otherwise) whose ASN.1 structure may or may not be public. As of LIEF v0.11.0, the following OIDs are not yet supported: OID Description 1.3.6.1.4.1.311.3.3.1 Ms-CounterSign (undocumented, supported in LIEF 0.15.0) 1.2.840.113549.1.9.16.2.12 S/MIME Signing certificate (id-aa-signingCertificate) 1.3.6.1.4.1.311.2.6.1 SPC_COMMERCIAL_SP_KEY_PURPOSE_OBJID 1.3.6.1.4.1.311.10.3.28 szOID_PLATFORM_MANIFEST_BINARY_ID (supported in LIEF 0.15.0) These unsupported attributes are wrapped in the lief.PE.GenericType , which exposes the raw ASN.1 blob via the raw_content property. Conclusion Under the hood, most of the work is performed by mbedtls , which provides the following primitives used by LIEF: ASN.1 decoder x509 certificate processing (parsing AND verification) Hash algorithms Public key algorithms A small C++ snippet can also be cross-compiled for iOS: #include int main(int argc, char** argv) { std::unique_ptr pe = LIEF::PE::Parser::parse(argv[1]); if (pe->verify_signature() == LIEF::PE::Signature::VERIFICATION_FLAGS::OK) { std::cout << \"Signature ok!\" << \"\\n\"; return 0; } std::cout << \"Error!\" << \"\\n\"; return 1; } This allows for verifying the integrity of a PE executable on an iPhone: iPhone:~ root# file PE32_x86-64_binary_avast-free-antivirus-setup-online.exe PE32_x86-64_binary_avast-free-antivirus-setup-online.exe: PE32 executable (GUI) Intel 80386, for MS Windows iPhone:~ root# file ./pe_authenticode_check ./pe_authenticode_check: Mach-O 64-bit arm64 executable, flags: iPhone:~ root# ./pe_authenticode_check PE32_x86-64_binary_avast-free-antivirus-setup-online.exe Signature ok! iPhone:~ root# While this example may seem niche, it highlights the project’s purpose: Providing a cross-platform and cross-format library. Exposing both a high-level API (Python) and a low-level API (C++). Minimizing dependencies so that the static version of LIEF does not require external libraries [5] . $ otool -L pe_authenticode_check /System/Library/Frameworks/Foundation.framework/Foundation (compatibility version 300.0.0, current version 1770.255.0) /usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0) /usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 904.4.0) /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1292.60.1) In addition to LIEF, you may be interested in other projects that handle Authenticode: Project URL signify https://github.com/ralphje/signify winsign https://github.com/mozilla-releng/winsign uthenticode https://github.com/trailofbits/uthenticode AuthenticodeLint https://github.com/vcsjones/AuthenticodeLint osslsigncode https://github.com/mtrojnar/osslsigncode yara-x https://github.com/VirusTotal/yara-x (which has support for PE Authenticode) Finally, additional information about Authenticode can be found in the Trail of Bits blog post [6] . For Authenticode techniques used by Dropbox, refer to the Microsoft website [7] . If you are interested in how PKCS #7 integrity works, refer to Manually verify PKCS#7 signed data with OpenSSL [8] . References[ 1 ] http://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/Authenticode_PE.docx [ 2 ] Which is now exception-free. [ 3 ] This tutorial uses the Python API, but the C++ API is very similar. [ 4 ] See src/PE/signature/Signature.cpp - check() for the implementation. [ 5 ] Except for the C/C++ STL. [ 6 ] https://blog.trailofbits.com/2020/05/27/verifying-windows-binaries-without-windows/ [ 7 ] https://docs.microsoft.com/en-us/archive/blogs/ieinternals/caveats-for-authenticode-code-signing [ 8 ] http://qistoph.blogspot.com/2012/01/manual-verify-pkcs7-signed-data-with.html API lief.PE.Binary.verify_signature() ( lief::pe::Binary::verify_signature ; lief.PE.Binary.verify_signature() ; LIEF::PE::Binary::verify_signature() ) lief.PE.Binary.authentihash() lief.PE.Binary.authentihash_md5 lief.PE.Binary.authentihash_sha1 lief.PE.Binary.authentihash_sha256 lief.PE.Binary.authentihash_sha512 lief.PE.Binary.signatures() ( lief::pe::Binary::signatures ; lief.PE.Binary.signatures ; LIEF::PE::Binary::signatures() ) lief.PE.Signature ( lief::pe::Signature ; lief.PE.Signature ; LIEF::PE::Signature ) lief.PE.x509 lief.PE.ContentInfo lief.PE.SignerInfo lief.PE.Attribute lief.PE.ContentType lief.PE.GenericType lief.PE.MsSpcNestedSignature lief.PE.MsSpcStatementType lief.PE.PKCS9AtSequenceNumber lief.PE.PKCS9CounterSignature lief.PE.PKCS9MessageDigest lief.PE.PKCS9SigningTime lief.PE.SpcSpOpusInfo", "contentHash": "149be128246a0d638f5ad5cc87db98250ba859107dee5a4d1e299ed863735da3", "description": "13 - PE Authenticode. This tutorial explains how to process and verify PE Authenticode with LIEF.", "docname": "tutorials/13_pe_authenticode", "documentID": "e8586e304ce4758986b5865d38eeb79c0a3b3c864919ec66363a2ea95cea74be", "documentationChannel": "latest", "documentationVersion": "2.0.0", "language": "en", "markdownURL": "https://lief.re/doc/latest/tutorials/13_pe_authenticode.md", "title": "13 - PE Authenticode - LIEF Documentation"}], "schemaVersion": "1.0"}