Introduction¶

The purpose of this project is to provide a cross-platform library to parse, modify, and abstract the ELF, PE, and Mach-O formats.

From a technical standpoint, the library is written in C++ with a C++11 public interface and exposes bindings for Python and Rust.

As a result, you can use LIEF through an idiomatic API in these languages:

import lief

elf: lief.ELF.Binary = lief.ELF.parse("libc.so")

for symbol in elf.symbols:
    print(symbol.address, symbol.name)

print(elf.header)

for entry in elf.dynamic_entries:

  if isinstance(entry, lief.ELF.DynamicEntryLibrary):
      entry.name = "libhello.so"

elf.write("modified.elf")

#include <LIEF/LIEF.hpp>

std::unique_ptr<LIEF::MachO::FatBinary> fat =
  LIEF::MachO::Parser::parse("libobjc.dylib");

for (const LIEF::MachO::Binary& macho : fat) {
  for (const LIEF::MachO::BindingInfo& binding : macho.bindings()) {
    std::cout << binding.address() << ' ' << binding.symbol()->name() << '\n';
  }

  if (macho.is_ios()) {
    if (const LIEF::MachO::EncryptionInfo* info = macho.encryption_info())
    {
      std::cout << info->crypt_id() << '\n';
    }
  }
}

let mut file = std::fs::File::open(path).expect("Can't open the file");

if let Some(lief::Binary::PE(pe)) = lief::Binary::from(&mut file) {
    let rich_header = pe.rich_header().unwrap_or_else(|| {
        println!("Rich header not found!");
        process::exit(0);
    });

    println!("Rich header key: 0x{:x}", rich_header.key());
    for entry in rich_header.entries() {
        println!("id: 0x{:04x} build_id: 0x{:04x} count: #{}",
                 entry.id(), entry.build_id(), entry.count());
    }

    let result = pe.verify_signature(pe::signature::VerificationChecks::DEFAULT);
    if result.is_ok() {
        println!("Valid signature!");
    } else {
        println!("Signature not valid: {}", result);
    }
}

The project is also dedicated to providing comprehensive documentation and maintaining strong development standards, including:

• A test suite with code coverage and non-regression testing

• Address Sanitizer checks (ASAN)

• Continuous Integration for testing and releasing packages

• Dockerization of various CI steps

• A comprehensive changelog

• Nightly builds

To get started with LIEF’s features, you can check the documentation for specific formats: ELF, PE, or Mach-O. Integrating LIEF into your project is also straightforward:

$ pip install lief

lief==0.17.5

$ clang++ -lLIEF -I<LIEF_INSTALL>/include/ ...

find_package(LIEF)

target_link_libraries(my-project LIEF::LIEF)

# For nightly build
[dependencies]
lief = { git = "https://github.com/lief-project/LIEF", branch = "main" }

# For a tagged release
[dependencies]
lief = "0.17.5"

You can find additional content, including release notes, on the LIEF blog:

• LIEF 0.17.0 release info

• LIEF 0.16.0 release info

• LIEF 0.15.0 release info

• LIEF 0.14.0 release info

• LIEF 0.13.0 release info

• LIEF 0.12.0 release info

• LIEF 0.11.1 release info

• LIEF 0.11.0 release info

• LIEF 0.9.0 release info

Additional practical examples are available in the examples/ directory.