--- documentID: "41dfaff050b253cfc068916df602d7c202b24f5299d00597859cfe69e9ba8264" docname: "ai" title: "Documentation for AI - LIEF Documentation" description: "Read LIEF documentation as resolved Markdown or retrieve guides and API symbols from versioned JSON indexes with canonical links and content hashes." canonical: "https://lief.re/doc/latest/ai.html" markdownURL: "https://lief.re/doc/latest/ai.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "a1c14c0ee97acfbc9246df376f8f958edb2f9cb11def599651e0cc89f821436e" --- # [Documentation for AI]() Every documentation page has a Markdown copy at the same path with `.html` replaced by `.md`. For example, `runtime/intro.html` has a `runtime/intro.md` copy. The HTML page advertises this copy with an alternate link in its head, following the [llms.txt proposal](). The Markdown contains the rendered documentation: code included from example files, every language tab, API signatures, tables, and notes. Links and image URLs are absolute, so content remains usable when read outside this website. Section and API headings link to their original HTML anchors for citation. ## [Choose a resource]() These files are generated alongside each version of the documentation: | Resource | Use it to | | --- | --- | | [`llms.txt`]() | Find the relevant guide or API page, with a description of each page | | [`index.json`]() | Search document titles, descriptions, and full text, then fetch a Markdown page | | [`index.chunks.json`]() | Retrieve individual sections or API symbols with their heading context and citation URLs | | [`llms-full.txt`]() | Download all Markdown pages, including API references, for local indexing | | [`objects.inv`]() | Look up documented symbols by name | | [`sitemap.xml`]() | Enumerate canonical HTML pages | Start with `llms.txt` and fetch the pages relevant to the task. The full corpus includes large API references; it may exceed an assistant’s context window. The exported corpus covers the Sphinx documentation. The API guides also link to the separate Rust and Doxygen references. ## [Match the documentation to the installation]() Markdown metadata and JSON records carry `documentationVersion`, `documentationChannel`, `canonical`, and `markdownURL`. The `latest` channel tracks development; `stable` tracks the latest release. Match API usage to the installed LIEF version, platform, architecture, and enabled features. Use the [Installation and Integration]() guide to choose a build. Read [What is LIEF Extended?]() for Extended features and [Runtime]() for runtime availability. Basic runtime support is an independent build option. Memory-layout enumeration, assembly, and disassembly require Extended. ## [Retrieve and update chunks]() Both JSON indexes declare a `schemaVersion`. Each chunk contains Markdown and plain text, its document title and description, a `headingPath`, and a `url` pointing to the canonical HTML section or API symbol. Chunk sizes follow the documentation structure; code blocks stay intact. `documentID` identifies a canonical page, including its version channel. `chunkID` identifies a section within that page. These IDs remain stable across builds when the page URL and section anchor stay the same. `position`, `documentChunkCount`, `previousChunkID`, and `nextChunkID` allow retrieval of surrounding context. Positions start at zero; neighbors are empty strings at document boundaries. Compare the index’s `corpusHash` to detect changes to content or metadata, then compare individual `contentHash` values to find changed Markdown bodies. Both use SHA-256. The chunk index describes the hash inputs and ordering. Build timestamps are excluded so unchanged content produces the same indexes. --- documentID: "33678d82524e3a7e956d6497286b9c4f7228723cbf832139d7e479105006cda3" docname: "api/binary_abstraction/cpp" title: "Binary Abstraction C++ API - LIEF Documentation" description: "Binary Abstraction C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/api/binary_abstraction/cpp.html" markdownURL: "https://lief.re/doc/latest/api/binary_abstraction/cpp.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "878139aff75e096fc2a6d7b7e1464741fe07d20375526e95ea06a2fc6cd41dc9" --- # [C++]() ## [Parser]() ### [` Parser `]() class Parser Main interface to parse an executable regardless of its format. Subclassed by [LIEF::ELF::Parser](), [LIEF::MachO::BinaryParser](), [LIEF::MachO::Parser](), [LIEF::PE::Parser]() Public Static Functions #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::Binary")> parse(std::string\_view filename) Construct an [LIEF::Binary]() from the given filename. > **See also** > > [LIEF::MachO::Parser::parse]() > **Warning** > > If the target file is a FAT Mach-O, it will return the **last** one #### [` PathTparse `]() template<class PathT, enable\_if\_path\_t<[PathT]( "LIEF::Parser::parse::PathT")> = 0> static inline std::unique\_ptr<[Binary]( "LIEF::Binary")> parse(const [PathT]( "LIEF::Parser::parse::PathT") &filename) Same as [parse(std::string\_view)]() but the file is given as a `std::filesystem::path`. #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::Binary")> parse(const std::vector<uint8\_t> &raw) Construct an [LIEF::Binary]() from the given raw data. > **See also** > > [LIEF::MachO::Parser::parse]() > **Warning** > > If the target file is a FAT Mach-O, it will return the **last** one #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::Binary")> parse(std::unique\_ptr<[BinaryStream]( "LIEF::BinaryStream")> stream) Construct an [LIEF::Binary]() from the given stream. > **See also** > > [LIEF::MachO::Parser::parse]() > **Warning** > > If the target file is a FAT Mach-O, it will return the **last** one --- ## [Header]() ### [` Header `]() class Header : public LIEF::Object Public Types #### [` ARCHITECTURES `]() enum class ARCHITECTURES *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` ARM `]() enumerator ARM ##### [` ARM64 `]() enumerator ARM64 ##### [` MIPS `]() enumerator MIPS ##### [` X86 `]() enumerator X86 ##### [` X86_64 `]() enumerator X86\_64 ##### [` PPC `]() enumerator PPC ##### [` SPARC `]() enumerator SPARC ##### [` SYSZ `]() enumerator SYSZ ##### [` XCORE `]() enumerator XCORE ##### [` RISCV `]() enumerator RISCV ##### [` LOONGARCH `]() enumerator LOONGARCH ##### [` PPC64 `]() enumerator PPC64 #### [` ENDIANNESS `]() enum class ENDIANNESS *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` BIG `]() enumerator BIG ##### [` LITTLE `]() enumerator LITTLE #### [` MODES `]() enum MODES *Values:* ##### [` NONE `]() enumerator NONE = 0 ##### [` BITS_16 `]() enumerator BITS\_16 = 1LLU << 0 ##### [` BITS_32 `]() enumerator BITS\_32 = 1LLU << 1 16-bits architecture ##### [` BITS_64 `]() enumerator BITS\_64 = 1LLU << 2 32-bits architecture ##### [` THUMB `]() enumerator THUMB = 1LLU << 3 64-bits architecture ##### [` ARM64E `]() enumerator ARM64E = 1LLU << 4 Support ARM Thumb mode. #### [` OBJECT_TYPES `]() enum class OBJECT\_TYPES *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` EXECUTABLE `]() enumerator EXECUTABLE ##### [` LIBRARY `]() enumerator LIBRARY ##### [` OBJECT `]() enumerator OBJECT Public Functions #### [` Header `]() Header() = default #### [` Header `]() Header(const [Header]( "LIEF::Header::Header")&) = default #### [` operator= `]() [Header]( "LIEF::Header") &operator=(const [Header]( "LIEF::Header")&) = default #### [` ~Header `]() ~Header() override = default #### [` architecture `]() inline [ARCHITECTURES]( "LIEF::Header::ARCHITECTURES") architecture() const Target architecture. #### [` modes `]() inline [MODES]( "LIEF::Header::MODES") modes() const Optional features for the given architecture. #### [` modes_list `]() std::vector<[MODES]( "LIEF::Header::MODES")> modes\_list() const [MODES]() as a vector. #### [` is `]() inline bool is([MODES]( "LIEF::Header::MODES") m) const #### [` object_type `]() inline [OBJECT\_TYPES]( "LIEF::Header::OBJECT_TYPES") object\_type() const #### [` entrypoint `]() inline uint64\_t entrypoint() const #### [` endianness `]() inline [ENDIANNESS]( "LIEF::Header::ENDIANNESS") endianness() const #### [` is_32 `]() inline bool is\_32() const #### [` is_64 `]() inline bool is\_64() const #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` from `]() static [Header]( "LIEF::Header") from(const LIEF::ELF::[Binary]( "LIEF::ELF::Binary") &elf) #### [` from `]() static [Header]( "LIEF::Header") from(const LIEF::PE::[Binary]( "LIEF::PE::Binary") &pe) #### [` from `]() static [Header]( "LIEF::Header") from(const LIEF::MachO::[Binary]( "LIEF::MachO::Binary") &macho) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Header]( "LIEF::Header") &hdr) --- ## [Binary]() ### [` Binary `]() class Binary : public LIEF::Object Generic interface representing a binary executable. This class provides a unified interface across multiple binary formats such as ELF, PE, Mach-O, and others. It enables users to access binary components like headers, sections, symbols, relocations, and functions in a format-agnostic way. Subclasses like [LIEF::PE::Binary]() implement format-specific API Subclassed by [LIEF::ELF::Binary](), [LIEF::MachO::Binary](), [LIEF::PE::Binary]() Public Types #### [` VA_TYPES `]() enum class VA\_TYPES Enumeration of virtual address types used for patching and memory access. *Values:* ##### [` AUTO `]() enumerator AUTO = 0 Automatically determine if the address is absolute or relative (default behavior). ##### [` RVA `]() enumerator RVA = 1 Relative Virtual Address (RVA), offset from image base. ##### [` VA `]() enumerator VA = 2 Absolute Virtual Address. #### [` FORMATS `]() enum FORMATS *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` ELF `]() enumerator ELF ##### [` PE `]() enumerator PE ##### [` MACHO `]() enumerator MACHO ##### [` OAT `]() enumerator OAT #### [` functions_t `]() using functions\_t = std::vector<[Function]( "LIEF::Function")> #### [` sections_t `]() using sections\_t = std::vector<[Section]( "LIEF::Section")\*> Internal container. #### [` it_sections `]() using it\_sections = [ref\_iterator]( "LIEF::ref_iterator")<[sections\_t]( "LIEF::Binary::sections_t")> Iterator that outputs [LIEF::Section]()&. #### [` it_const_sections `]() using it\_const\_sections = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<[sections\_t]( "LIEF::Binary::sections_t")> Iterator that outputs const [LIEF::Section]()&. #### [` symbols_t `]() using symbols\_t = std::vector<[Symbol]( "LIEF::Symbol")\*> Internal container. #### [` it_symbols `]() using it\_symbols = [ref\_iterator]( "LIEF::ref_iterator")<[symbols\_t]( "LIEF::Binary::symbols_t")> Iterator that outputs [LIEF::Symbol]()&. #### [` it_const_symbols `]() using it\_const\_symbols = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<[symbols\_t]( "LIEF::Binary::symbols_t")> Iterator that outputs const [LIEF::Symbol]()&. #### [` relocations_t `]() using relocations\_t = std::vector<[Relocation]( "LIEF::Relocation")\*> Internal container. #### [` it_relocations `]() using it\_relocations = [ref\_iterator]( "LIEF::ref_iterator")<[relocations\_t]( "LIEF::Binary::relocations_t")> Iterator that outputs [LIEF::Relocation]()&. #### [` it_const_relocations `]() using it\_const\_relocations = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<[relocations\_t]( "LIEF::Binary::relocations_t")> Iterator that outputs const [LIEF::Relocation]()&. #### [` instructions_it `]() using instructions\_it = [iterator\_range]( "LIEF::iterator_range")<assembly::[Instruction]( "LIEF::assembly::Instruction")::[Iterator]( "LIEF::assembly::Instruction::Iterator")> Instruction iterator. Public Functions #### [` Binary `]() Binary() #### [` Binary `]() Binary([FORMATS]( "LIEF::Binary::FORMATS") fmt) #### [` ~Binary `]() ~Binary() override #### [` operator= `]() [Binary]( "LIEF::Binary") &operator=(const [Binary]( "LIEF::Binary")&) = delete #### [` Binary `]() Binary(const [Binary]( "LIEF::Binary::Binary")&) = delete #### [` format `]() inline [FORMATS]( "LIEF::Binary::FORMATS") format() const Executable format (ELF, PE, Mach-O) of the underlying binary. #### [` header `]() inline [Header]( "LIEF::Header") header() const Return the abstract header of the binary. #### [` symbols `]() inline [it\_symbols]( "LIEF::Binary::it_symbols") symbols() Return an iterator over the abstracted symbols in which the elements **can** be modified. #### [` symbols `]() inline [it\_const\_symbols]( "LIEF::Binary::it_const_symbols") symbols() const Return an iterator over the abstracted symbols in which the elements **can’t** be modified. #### [` has_symbol `]() inline bool has\_symbol(const std::string &name) const Check if a [Symbol]() with the given name exists. #### [` get_symbol `]() const [Symbol]( "LIEF::Symbol") \*get\_symbol(const std::string &name) const Return the [Symbol]() with the given name If the symbol does not exist, return a nullptr. #### [` get_symbol `]() inline [Symbol]( "LIEF::Symbol") \*get\_symbol(const std::string &name) #### [` sections `]() inline [it\_sections]( "LIEF::Binary::it_sections") sections() Return an iterator over the binary’s sections ([LIEF::Section]()). #### [` sections `]() inline [it\_const\_sections]( "LIEF::Binary::it_const_sections") sections() const #### [` remove_section `]() virtual void remove\_section(const std::string &name, bool clear = false) = 0 Remove **all** the sections in the underlying binary. #### [` relocations `]() inline [it\_relocations]( "LIEF::Binary::it_relocations") relocations() Return an iterator over the binary relocations ([LIEF::Relocation]()). #### [` relocations `]() inline [it\_const\_relocations]( "LIEF::Binary::it_const_relocations") relocations() const #### [` entrypoint `]() virtual uint64\_t entrypoint() const = 0 [Binary]()’s entrypoint (if any). #### [` original_size `]() inline uint64\_t original\_size() const [Binary]()’s original size. #### [` exported_functions `]() inline [functions\_t]( "LIEF::Binary::functions_t") exported\_functions() const Return the functions exported by the binary. #### [` imported_libraries `]() inline std::vector<std::string> imported\_libraries() const Return libraries which are imported by the binary. #### [` imported_functions `]() inline [functions\_t]( "LIEF::Binary::functions_t") imported\_functions() const Return functions imported by the binary. #### [` get_function_address `]() virtual [result]( "LIEF::result")<uint64\_t> get\_function\_address(const std::string &func\_name) const Return the address of the given function name. #### [` accept `]() virtual void accept(Visitor &visitor) const override Method so that a `visitor` can visit us. #### [` xref `]() std::vector<uint64\_t> xref(uint64\_t address) const #### [` patch_address `]() virtual void patch\_address(uint64\_t address, const std::vector<uint8\_t> &patch\_value, [VA\_TYPES]( "LIEF::Binary::VA_TYPES") addr\_type = [VA\_TYPES]( "LIEF::Binary::VA_TYPES")::[AUTO]( "LIEF::Binary::VA_TYPES::AUTO")) = 0 Patch the content at virtual address `address` with `patch_value`. **Parameters:** - **address** – **[in]** Address to patch - **patch\_value** – **[in]** Patch to apply - **addr\_type** – **[in]** Specify if the address should be used as an absolute virtual address or a RVA #### [` patch_address `]() virtual void patch\_address(uint64\_t address, uint64\_t patch\_value, size\_t size = sizeof(uint64\_t), [VA\_TYPES]( "LIEF::Binary::VA_TYPES") addr\_type = [VA\_TYPES]( "LIEF::Binary::VA_TYPES")::[AUTO]( "LIEF::Binary::VA_TYPES::AUTO")) = 0 Patch the address with the given value. **Parameters:** - **address** – **[in]** Address to patch - **patch\_value** – **[in]** Patch to apply - **size** – **[in]** Size of the value in **bytes** (1, 2, … 8) - **addr\_type** – **[in]** Specify if the address should be used as an absolute virtual address or an RVA #### [` get_content_from_virtual_address `]() virtual span<const uint8\_t> get\_content\_from\_virtual\_address(uint64\_t virtual\_address, uint64\_t size, [VA\_TYPES]( "LIEF::Binary::VA_TYPES") addr\_type = [VA\_TYPES]( "LIEF::Binary::VA_TYPES")::[AUTO]( "LIEF::Binary::VA_TYPES::AUTO")) const = 0 Return the content located at the given virtual address. #### [` Tget_int_from_virtual_address `]() template<class T> inline LIEF::[result]( "LIEF::result")<[T]( "LIEF::Binary::get_int_from_virtual_address::T")> get\_int\_from\_virtual\_address(uint64\_t va, [VA\_TYPES]( "LIEF::Binary::VA_TYPES") addr\_type = [VA\_TYPES]( "LIEF::Binary::VA_TYPES")::[AUTO]( "LIEF::Binary::VA_TYPES::AUTO")) const Get the integer value at the given virtual address. #### [` original_size `]() inline void original\_size(uint64\_t size) Change binary’s original size. > **Warning** > > This function should be used carefully as some optimizations can be performed with this value #### [` is_pie `]() virtual bool is\_pie() const = 0 Check if the binary is position independent. #### [` has_nx `]() virtual bool has\_nx() const = 0 Check if the binary uses `NX` protection. #### [` imagebase `]() virtual uint64\_t imagebase() const = 0 Default image base address if the ASLR is not enabled. #### [` ctor_functions `]() virtual [functions\_t]( "LIEF::Binary::functions_t") ctor\_functions() const = 0 Constructor functions that are called prior any other functions. #### [` offset_to_virtual_address `]() virtual [result]( "LIEF::result")<uint64\_t> offset\_to\_virtual\_address(uint64\_t offset, uint64\_t slide = 0) const = 0 Convert the given offset into a virtual address. **Parameters:** - **offset** – **[in]** The offset to convert. - **slide** – **[in]** If not 0, it will replace the default base address (if any) #### [` print `]() inline virtual std::ostream &print(std::ostream &os) const #### [` debug_info `]() [DebugInfo]( "LIEF::DebugInfo") \*debug\_info() const Return the debug info if present. It can be either a [LIEF::dwarf::DebugInfo]() or a [LIEF::pdb::DebugInfo](). For ELF and Mach-O binaries, it returns the given [DebugInfo]() object **only** if the binary embeds the DWARF debug info in the binary itself. For PE file, this function tries to find the **external** PDB using the [LIEF::PE::CodeViewPDB::filename()]() output (if present). One can also use [LIEF::pdb::load()]() or [LIEF::pdb::DebugInfo::from\_file()]() to get PDB debug info. > **Warning** > > This function requires LIEF’s extended version otherwise it **always** returns a nullptr #### [` disassemble `]() [instructions\_it]( "LIEF::Binary::instructions_it") disassemble(uint64\_t address, size\_t size) const Disassemble code starting at the given virtual address and with the given size. ```cpp auto insts = binary->disassemble(0xacde, 100); for (std::unique_ptr inst : insts) { std::cout << inst->to_string() << '\n'; } ``` > **See also** > > [LIEF::assembly::Instruction]() #### [` disassemble `]() [instructions\_it]( "LIEF::Binary::instructions_it") disassemble(uint64\_t address) const Disassemble code starting at the given virtual address. ```cpp auto insts = binary->disassemble(0xacde); for (std::unique_ptr inst : insts) { std::cout << inst->to_string() << '\n'; } ``` > **See also** > > [LIEF::assembly::Instruction]() #### [` disassemble `]() [instructions\_it]( "LIEF::Binary::instructions_it") disassemble(const std::string &function) const Disassemble code for the given symbol name. ```cpp auto insts = binary->disassemble("__libc_start_main"); for (std::unique_ptr inst : insts) { std::cout << inst->to_string() << '\n'; } ``` > **See also** > > [LIEF::assembly::Instruction]() #### [` disassemble `]() [instructions\_it]( "LIEF::Binary::instructions_it") disassemble(const uint8\_t \*buffer, size\_t size, uint64\_t address = 0) const Disassemble code provided by the given buffer at the specified `address` parameter. > **See also** > > [LIEF::assembly::Instruction]() #### [` disassemble `]() inline [instructions\_it]( "LIEF::Binary::instructions_it") disassemble(const std::vector<uint8\_t> &buffer, uint64\_t address = 0) const Disassemble code provided by the given vector of bytes at the specified `address` parameter. > **See also** > > [LIEF::assembly::Instruction]() #### [` disassemble `]() inline [instructions\_it]( "LIEF::Binary::instructions_it") disassemble(LIEF::span<const uint8\_t> buffer, uint64\_t address = 0) const #### [` disassemble `]() inline [instructions\_it]( "LIEF::Binary::instructions_it") disassemble(LIEF::span<uint8\_t> buffer, uint64\_t address = 0) const #### [` assemble `]() std::vector<uint8\_t> assemble(uint64\_t address, const std::string &Asm, assembly::[AssemblerConfig]( "LIEF::assembly::AssemblerConfig") &config = assembly::[AssemblerConfig]( "LIEF::assembly::AssemblerConfig")::[default\_config]( "LIEF::assembly::AssemblerConfig::default_config")()) Assemble **and patch** the provided assembly code at the specified address. The function returns the generated assembly bytes ```cpp bin->assemble(0x12000440, R"asm( xor rax, rbx; mov rcx, rax; )asm"); ``` If you need to configure the assembly engine or to define addresses for symbols, you can provide your own [assembly::AssemblerConfig](). #### [` assemble `]() std::vector<uint8\_t> assemble(uint64\_t address, const llvm::MCInst &inst) Assemble **and patch** the address with the given LLVM MCInst. > **Warning** > > Because of ABI compatibility, this MCInst can **only be used** with the **same** version of LLVM used by LIEF (see documentation) #### [` assemble `]() std::vector<uint8\_t> assemble(uint64\_t address, const std::vector<llvm::MCInst> &insts) Assemble **and patch** the address with the given LLVM MCInst. > **Warning** > > Because of ABI compatibility, this MCInst can **only be used** with the **same** version of LLVM used by LIEF (see documentation) #### [` page_size `]() virtual uint64\_t page\_size() const Get the default memory page size according to the architecture and the format of the current binary. #### [` load_debug_info `]() [DebugInfo]( "LIEF::DebugInfo") \*load\_debug\_info(const std::string &path) Load and associate an external debug file (e.g., DWARF or PDB) with this binary. This method attempts to load the debug information from the file located at the given path, and binds it to the current binary instance. If successful, it returns a pointer to the loaded [DebugInfo]() object. > **Note** > > This function does not verify that the debug file matches the binary’s unique identifier (e.g., build ID, GUID). > **Warning** > > It is the caller’s responsibility to ensure that the debug file is compatible with the binary. Incorrect associations may lead to inconsistent or invalid results. **Parameters:** **path** – Path to the external debug file (e.g., `.dwarf`, `.pdb`) **Returns:** Pointer to the loaded [DebugInfo]() object on success, or `nullptr` on failure. #### [` virtual_size `]() inline virtual uint64\_t virtual\_size() const Size of the binary when mapped in memory. Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Binary]( "LIEF::Binary") &binary) --- ## [Section]() ### [` Section `]() class Section : public LIEF::Object Class which represents an abstracted section. Subclassed by [LIEF::COFF::Section](), [LIEF::ELF::Section](), [LIEF::MachO::Section](), [LIEF::PE::Section]() Public Functions #### [` Section `]() Section() = default #### [` Section `]() inline Section(std::string name) #### [` ~Section `]() ~Section() override = default #### [` operator= `]() [Section]( "LIEF::Section") &operator=(const [Section]( "LIEF::Section")&) = default #### [` Section `]() Section(const [Section]( "LIEF::Section::Section")&) = default #### [` name `]() inline virtual std::string\_view name() const [Section]()’s name. #### [` fullname `]() inline virtual std::string\_view fullname() const Return the **complete** section’s name which might include trailing (`0`) bytes. #### [` content `]() inline virtual span<const uint8\_t> content() const [Section]()’s content. #### [` size `]() inline virtual void size(uint64\_t size) Change the section size. #### [` size `]() inline virtual uint64\_t size() const [Section]()’s size (size in the binary, not the virtual size). #### [` offset `]() inline virtual uint64\_t offset() const Offset in the binary. #### [` virtual_address `]() inline virtual uint64\_t virtual\_address() const Address where the section should be mapped. #### [` virtual_address `]() inline virtual void virtual\_address(uint64\_t virtual\_address) #### [` name `]() inline virtual void name(std::string name) Change the section’s name. #### [` content `]() inline virtual void content(const std::vector<uint8\_t>&) Change section content. #### [` offset `]() inline virtual void offset(uint64\_t offset) #### [` entropy `]() double entropy() const [Section]()’s entropy. #### [` search `]() size\_t search(uint64\_t integer, size\_t pos, size\_t size) const #### [` search `]() size\_t search(const std::vector<uint8\_t> &pattern, size\_t pos = 0) const #### [` search `]() size\_t search(const std::string &pattern, size\_t pos = 0) const #### [` search `]() size\_t search(uint64\_t integer, size\_t pos = 0) const #### [` search_all `]() std::vector<size\_t> search\_all(uint64\_t v, size\_t size) const #### [` search_all `]() std::vector<size\_t> search\_all(uint64\_t v) const #### [` search_all `]() std::vector<size\_t> search\_all(const std::string &v) const #### [` accept `]() virtual void accept(Visitor &visitor) const override Method so that the `visitor` can visit us. Public Static Attributes #### [` npos `]() static size\_t npos = -1 Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Section]( "LIEF::Section") &entry) --- ## [Symbol]() ### [` Symbol `]() class Symbol : public LIEF::Object This class represents a symbol in an executable format. Subclassed by [LIEF::COFF::Symbol](), [LIEF::ELF::Symbol](), [LIEF::Function](), [LIEF::MachO::Symbol](), [LIEF::PE::DelayImportEntry](), [LIEF::PE::ExportEntry](), [LIEF::PE::ImportEntry]() Public Functions #### [` Symbol `]() Symbol() = default #### [` Symbol `]() inline Symbol(std::string name) #### [` Symbol `]() inline Symbol(std::string name, uint64\_t value) #### [` Symbol `]() inline Symbol(std::string name, uint64\_t value, uint64\_t size) #### [` Symbol `]() Symbol(const [Symbol]( "LIEF::Symbol::Symbol")&) = default #### [` operator= `]() [Symbol]( "LIEF::Symbol") &operator=(const [Symbol]( "LIEF::Symbol")&) = default #### [` Symbol `]() Symbol([Symbol]( "LIEF::Symbol::Symbol")&&) = default #### [` operator= `]() [Symbol]( "LIEF::Symbol") &operator=([Symbol]( "LIEF::Symbol")&&) = default #### [` ~Symbol `]() ~Symbol() override = default #### [` swap `]() void swap([Symbol]( "LIEF::Symbol") &other) noexcept #### [` name `]() inline virtual std::string\_view name() const Return the symbol’s name. #### [` name `]() inline virtual std::string &name() #### [` name `]() inline virtual void name(std::string name) Set symbol name. #### [` value `]() inline virtual uint64\_t value() const [Symbol]()’s value which is usually the **address** of the symbol. #### [` value `]() inline virtual void value(uint64\_t value) #### [` size `]() inline virtual uint64\_t size() const The size of the symbol (when applicable). #### [` size `]() inline virtual void size(uint64\_t value) #### [` accept `]() virtual void accept(Visitor &visitor) const override Method so that the `visitor` can visit us. Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Symbol]( "LIEF::Symbol") &entry) --- ## [Relocation]() ### [` Relocation `]() class Relocation : public LIEF::Object Class which represents an abstracted [Relocation](). Subclassed by [LIEF::COFF::Relocation](), [LIEF::ELF::Relocation](), [LIEF::MachO::Relocation](), [LIEF::PE::RelocationEntry]() Public Functions #### [` Relocation `]() Relocation() = default #### [` Relocation `]() inline Relocation(uint64\_t address, uint8\_t size) Constructor from a relocation’s address and size. #### [` ~Relocation `]() ~Relocation() override = default #### [` operator= `]() [Relocation]( "LIEF::Relocation") &operator=(const [Relocation]( "LIEF::Relocation")&) = default #### [` Relocation `]() Relocation(const [Relocation]( "LIEF::Relocation::Relocation")&) = default #### [` swap `]() inline void swap([Relocation]( "LIEF::Relocation") &other) #### [` address `]() inline virtual uint64\_t address() const [Relocation]()’s address. #### [` size `]() inline virtual size\_t size() const [Relocation]() size in **bits**. #### [` address `]() inline virtual void address(uint64\_t address) #### [` size `]() inline virtual void size(size\_t size) #### [` accept `]() virtual void accept(Visitor &visitor) const override Method so that the `visitor` can visit us. #### [` operator< `]() inline virtual bool operator<(const [Relocation]( "LIEF::Relocation") &rhs) const Comparison based on the [Relocation]()’s **address**. #### [` operator<= `]() inline virtual bool operator<=(const [Relocation]( "LIEF::Relocation") &rhs) const Comparison based on the [Relocation]()’s **address**. #### [` operator> `]() inline virtual bool operator>(const [Relocation]( "LIEF::Relocation") &rhs) const Comparison based on the [Relocation]()’s **address**. #### [` operator>= `]() inline virtual bool operator>=(const [Relocation]( "LIEF::Relocation") &rhs) const Comparison based on the [Relocation]()’s **address**. Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Relocation]( "LIEF::Relocation") &entry) --- ## [Function]() ### [` Function `]() class Function : public LIEF::[Symbol]( "LIEF::Symbol") Class that represents a function in the binary. Public Types #### [` FLAGS `]() enum class FLAGS : uint32\_t Flags used to characterize the semantics of the function. *Values:* ##### [` NONE `]() enumerator NONE = 0 ##### [` CONSTRUCTOR `]() enumerator CONSTRUCTOR = 1 << 0 The function acts as a constructor. Usually this flag is associated with functions that are located in the `.init_array`, `__mod_init_func` or `.tls` sections ##### [` DESTRUCTOR `]() enumerator DESTRUCTOR = 1 << 1 The function acts as a destructor. Usually this flag is associated with functions that are located in the `.fini_array` or `__mod_term_func` sections ##### [` DEBUG_INFO `]() enumerator DEBUG\_INFO = 1 << 2 The function is associated with Debug information. ##### [` EXPORTED `]() enumerator EXPORTED = 1 << 3 The function is exported by the binary and the [address()]() method returns its virtual address in the binary. ##### [` IMPORTED `]() enumerator IMPORTED = 1 << 4 The function is **imported** by the binary and the [address()]() should return 0. Public Functions #### [` Function `]() Function() = default #### [` Function `]() inline Function(const std::string &name) #### [` Function `]() inline Function(uint64\_t address) #### [` Function `]() inline Function(const std::string &name, uint64\_t address) #### [` Function `]() inline Function(const std::string &name, uint64\_t address, [FLAGS]( "LIEF::Function::FLAGS") flags) #### [` Function `]() Function(const [Function]( "LIEF::Function::Function")&) = default #### [` operator= `]() [Function]( "LIEF::Function") &operator=(const [Function]( "LIEF::Function")&) = default #### [` ~Function `]() ~Function() override = default #### [` flags_list `]() std::vector<[FLAGS]( "LIEF::Function::FLAGS")> flags\_list() const List of [FLAGS](). #### [` flags `]() inline [FLAGS]( "LIEF::Function::FLAGS") flags() const #### [` add `]() inline [Function]( "LIEF::Function") &add([FLAGS]( "LIEF::Function::FLAGS") f) Add a flag to the current function. #### [` has `]() inline bool has([FLAGS]( "LIEF::Function::FLAGS") f) const Check if the function has the given flag. #### [` address `]() inline uint64\_t address() const Address of the current function. For functions that are set with the [FLAGS::IMPORTED]() flag, this value is likely 0. #### [` address `]() inline void address(uint64\_t address) #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Function]( "LIEF::Function") &entry) --- documentID: "eaec95ccf9c76f730f93fe5ccf7b39f3dfcf28d2c79721cd6a73a2f4d6450915" docname: "api/binary_abstraction/index" title: "Binary Abstraction - LIEF Documentation" description: "Binary Abstraction. ELF, PE, Mach-O binaries share similar characteristics, such as an entry point, imported/exported functions, etc." canonical: "https://lief.re/doc/latest/api/binary_abstraction/index.html" markdownURL: "https://lief.re/doc/latest/api/binary_abstraction/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "d447feee82bd78a238a2aecb490e9440b5c0d7971efee5e2ee18f039b3ab96c9" --- # [Binary Abstraction]() API - [C++]() - [Python]() - [Rust]() ## [Introduction]() [ELF](), [PE](), [Mach-O]() binaries share similar characteristics, such as an entry point, imported/exported functions, etc. These shared characteristics are represented in an *abstract* layer, which is defined by an inheritance relationship in C++/Python and by a trait in Rust. Specifically, `lief.ELF.Binary` ( [`lief::elf::Binary`]() ; [`lief.ELF.Binary`]() ; [`LIEF::ELF::Binary`]() ), `lief.PE.Binary` ( [`lief::pe::Binary`]() ; [`lief.PE.Binary`]() ; [`LIEF::PE::Binary`]() ), and `lief.MachO.Binary` ( [`lief::macho::Binary`]() ; [`lief.MachO.Binary`]() ; [`LIEF::MachO::Binary`]() ) either inherit or implement the trait: `lief.abstract.Binary` ( [`lief::generic::Binary`]() ; [`lief.Binary`]() ; [`LIEF::Binary`]() ). In Python/C++, one can access an *abstract* binary object by using the generic `lief.abstract.parse` ( [`lief.parse()`]() ; [`LIEF::Parser::parse()`]() ) function: **Python** ```python target = lief.parse("/tmp/some.elf") target = lief.parse("/Users/demo/some.macho") target = lief.parse(r"C:\some.pe.exe") ``` **C++** ```cpp std::unique_ptr target = LIEF::Parser::parse("some.elf"); target = LIEF::Parser::parse("some.macho"); target = LIEF::Parser::parse("some.exe"); ``` Due to Python’s dynamic polymorphism, the return value of [`lief.parse()`]( "lief.parse") is automatically cast into either: [`lief.ELF.Binary`]( "lief.ELF.Binary"), [`lief.PE.Binary`]( "lief.PE.Binary"), or [`lief.MachO.Binary`]( "lief.MachO.Binary"). To **upcast** this object into a [`lief.Binary`]( "lief.Binary") object, one can use the [`lief.Binary.abstract`]( "lief.Binary.abstract") attribute, which returns a [`lief.Binary`]( "lief.Binary") instance: ```python target = lief.parse("some.elf") assert type(target) is lief.ELF.Binary abstract = target.abstract assert type(abstract) is lief.Binary ``` In C++, a [`LIEF::Binary`]( "LIEF::Binary") instance can be **downcast** to its underlying type using the `classof` idiom: ```cpp std::unique_ptr target = LIEF::Parser::parse("some.elf"); if (LIEF::ELF::Binary::classof(target.get())) { auto& elf = static_cast(*target); } ``` > **See also** > > - [`LIEF::ELF::Binary::classof()`]( "LIEF::ELF::Binary::classof") > - [`LIEF::PE::Binary::classof()`]( "LIEF::PE::Binary::classof") > - [`LIEF::MachO::Binary::classof()`]( "LIEF::MachO::Binary::classof") --- documentID: "1c128f7d90e890100e819351b175f8106c10f998539753b85aedc52368f0490d" docname: "api/binary_abstraction/python" title: "Binary Abstraction Python API - LIEF Documentation" description: "Binary Abstraction Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/api/binary_abstraction/python.html" markdownURL: "https://lief.re/doc/latest/api/binary_abstraction/python.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "62aec87edd78b6b4afd2b431c2c058b46a00fc2a89bc37f6991bba1fa6233aa2" --- # [Python]() ## [Parser]() ### [` lief.parse `]() lief.parse(*obj: str | io.IOBase | os.PathLike | bytes | list[int]*) → [PE.Binary]( "lief.PE.Binary") | [OAT.Binary]( "lief.OAT.Binary") | [ELF.Binary]( "lief.ELF.Binary") | [MachO.Binary]( "lief.MachO.Binary") | [COFF.Binary]( "lief.COFF.Binary") | None Parse a binary supported by LIEF (ELF, PE, Mach-O, …) from the given Python object and return the corresponding [`Binary`]( "lief.Binary") object. --- ## [Binary]() ![Inheritance diagram of lief._lief.Binary, lief._lief.OAT.Binary, lief._lief.PE.Binary, lief._lief.MachO.Binary, lief._lief.ELF.Binary, lief.Binary](https://lief.re/doc/latest/_images/inheritance-4635d2b939127f258fc2d93cec3430a0f490b079.png) ### [` lief.Binary `]() class lief.Binary Bases: `Object` Generic interface representing a binary executable. This class provides a unified interface across multiple binary formats such as ELF, PE, Mach-O, and others. It enables users to access binary components like headers, sections, symbols, relocations, and functions in a format-agnostic way. Subclasses (like [`lief.PE.Binary`]( "lief.PE.Binary")) implement format-specific API #### [` FORMATS `]() class FORMATS(*\*values*) Bases: `Enum` ##### [` ELF `]() ELF = 1 ##### [` MACHO `]() MACHO = 3 ##### [` OAT `]() OAT = 4 ##### [` PE `]() PE = 2 ##### [` UNKNOWN `]() UNKNOWN = 0 #### [` VA_TYPES `]() class VA\_TYPES(*\*values*) Bases: `Enum` Enumeration of virtual address types used for patching and memory access. ##### [` AUTO `]() AUTO = 0 ##### [` RVA `]() RVA = 1 ##### [` VA `]() VA = 2 #### [` abstract `]() property abstract → [lief.Binary]( "lief.Binary") Return the abstract representation of the current binary ([`lief.Binary`]( "lief.Binary")) #### [` assemble `]() assemble(*self*, *address: int*, *assembly: str*, *config: [lief.\_lief.assembly.AssemblerConfig]( "lief._lief.assembly.AssemblerConfig") = <lief.\_lief.assembly.AssemblerConfig object at 0x7f13c43e34e0>*) → bytes Assemble **and patch** the provided assembly code at the specified address. The function returns the generated assembly bytes. Example: ```python bin.assemble(0x12000440, """ xor rax, rbx; mov rcx, rax; """) ``` If you need to configure the assembly engine or to define addresses for symbols, you can provide your own [`AssemblerConfig`]( "lief.assembly.AssemblerConfig") instance. #### [` concrete `]() property concrete → [lief.ELF.Binary]( "lief.ELF.Binary") | [lief.PE.Binary]( "lief.PE.Binary") | [lief.MachO.Binary]( "lief.MachO.Binary") The *concrete* representation of the binary. Basically, this property casts a [`lief.Binary`]( "lief.Binary") into a [`lief.PE.Binary`]( "lief.PE.Binary"), [`lief.ELF.Binary`]( "lief.ELF.Binary") or [`lief.MachO.Binary`]( "lief.MachO.Binary"). See also: [`lief.Binary.abstract`]( "lief.Binary.abstract") #### [` ctor_functions `]() property ctor\_functions → list[[lief.Function]( "lief.Function")] Constructor functions that are called prior to any other functions #### [` debug_info `]() property debug\_info → [lief.DebugInfo]( "lief.DebugInfo") | None Return debug info if present. It can be either a [`lief.dwarf.DebugInfo`]( "lief.dwarf.DebugInfo") or a [`lief.pdb.DebugInfo`]( "lief.pdb.DebugInfo") For ELF and Mach-O binaries, it returns the given DebugInfo object **only** if the binary embeds the DWARF debug info in the binary itself. For PE file, this function tries to find the **external** PDB using the [`lief.PE.CodeViewPDB.filename`]( "lief.PE.CodeViewPDB.filename") output (if present). One can also use [`lief.pdb.load()`]( "lief.pdb.load") to manually load a PDB. > **Warning** > > This function requires LIEF’s extended version otherwise it **always** returns `None` #### [` disassembledisassembledisassemble `]() disassemble(*self*, *address: int*) → Iterator[[lief.\_lief.assembly.Instruction]( "lief._lief.assembly.Instruction") | None] **disassemble(*self*, *address: int*, *size: int*) → Iterator[[lief.\_lief.assembly.Instruction]( "lief._lief.assembly.Instruction") | None] **disassemble(*self*, *function\_name: str*) → Iterator[[lief.\_lief.assembly.Instruction]( "lief._lief.assembly.Instruction") | None]**** Overloaded function. 1. `disassemble(self, address: int) -> Iterator[Optional[lief._lief.assembly.Instruction]]` > Disassemble code starting at the given virtual address. > > ```python > insts = binary.disassemble(0xacde, 100); > for inst in insts: > print(inst) > ``` > > > **See also** > > > > [`lief.assembly.Instruction`]( "lief.assembly.Instruction") 2. `disassemble(self, address: int, size: int) -> Iterator[Optional[lief._lief.assembly.Instruction]]` > Disassemble code starting at the given virtual address and with the given size. > > ```python > insts = binary.disassemble(0xacde, 100); > for inst in insts: > print(inst) > ``` > > > **See also** > > > > [`lief.assembly.Instruction`]( "lief.assembly.Instruction") 3. `disassemble(self, function_name: str) -> Iterator[Optional[lief._lief.assembly.Instruction]]` > Disassemble code for the given symbol name > > ```python > insts = binary.disassemble("__libc_start_main"); > for inst in insts: > print(inst) > ``` > > > **See also** > > > > [`lief.assembly.Instruction`]( "lief.assembly.Instruction") #### [` disassemble_from_bytes `]() disassemble\_from\_bytes(*self*, *buffer: bytes*, *address: int = 0*) → Iterator[[lief.\_lief.assembly.Instruction]( "lief._lief.assembly.Instruction") | None] Disassemble code from the provided bytes ```python raw = bytes(binary.get_section(".text").content) insts = binary.disassemble_from_bytes(raw); for inst in insts: print(inst) ``` > **See also** > > [`lief.assembly.Instruction`]( "lief.assembly.Instruction") #### [` entrypoint `]() property entrypoint → int Binary’s entrypoint #### [` exported_functions `]() property exported\_functions → list[[lief.Function]( "lief.Function")] Return the binary’s exported [`Function`]( "lief.Function") #### [` format `]() property format → [lief.Binary.FORMATS]( "lief.Binary.FORMATS") File format ([`FORMATS`]( "lief.Binary.FORMATS")) of the underlying binary. #### [` get_content_from_virtual_address `]() get\_content\_from\_virtual\_address(*self*, *virtual\_address: int*, *size: int*, *va\_type: [lief.\_lief.Binary.VA\_TYPES]( "lief._lief.Binary.VA_TYPES") = VA\_TYPES.AUTO*) → memoryview Return the content located at the provided virtual address. The virtual address is specified in the first argument and size to read (in bytes) in the second. If the underlying binary is a PE, one can specify if the virtual address is a [`RVA`]( "lief.Binary.VA_TYPES.RVA") or a [`VA`]( "lief.Binary.VA_TYPES.VA"). By default, it is set to [`AUTO`]( "lief.Binary.VA_TYPES.AUTO"). #### [` get_function_address `]() get\_function\_address(*self*, *function\_name: str*) → int | [lief.\_lief.lief\_errors]( "lief._lief.lief_errors") Return the address of the given function name #### [` get_int_from_virtual_address `]() get\_int\_from\_virtual\_address(*self*, *address: int*, *interger\_size: int*, *type: [lief.\_lief.Binary.VA\_TYPES]( "lief._lief.Binary.VA_TYPES") = VA\_TYPES.AUTO*) → int | None Get an integer representation of the data at the given address #### [` get_symbol `]() get\_symbol(*self*, *symbol\_name: str*) → [lief.\_lief.Symbol]( "lief._lief.Symbol") | None Return the [`Symbol`]( "lief.Symbol") from the given `name`. If the symbol can’t be found, it returns None. #### [` has_nx `]() property has\_nx → bool Check if the binary has `NX` protection (non executable stack) #### [` has_symbol `]() has\_symbol(*self*, *symbol\_name: str*) → bool Check if a [`Symbol`]( "lief.Symbol") with the given name exists #### [` header `]() property header → [lief.Header]( "lief.Header") Binary’s abstract header ([`Header`]( "lief.Header")) #### [` imagebase `]() property imagebase → int Default image base (i.e. if the ASLR is not enabled) #### [` imported_functions `]() property imported\_functions → list[[lief.Function]( "lief.Function")] Return the binary’s imported [`Function`]( "lief.Function") (name) #### [` is_pie `]() property is\_pie → bool Check if the binary is position independent #### [` libraries `]() property libraries → list[str | bytes] Return binary’s imported libraries (name) #### [` load_debug_info `]() load\_debug\_info(*self*, *path: str | os.PathLike*) → [lief.\_lief.DebugInfo]( "lief._lief.DebugInfo") | None Load and associate an external debug file (e.g., DWARF or PDB) with this binary. This method attempts to load the debug information from the file located at the given path, and binds it to the current binary instance. If successful, it returns the loaded [`DebugInfo`]( "lief.DebugInfo") object. > **Warning** > > It is the caller’s responsibility to ensure that the debug file is compatible with the binary. Incorrect associations may lead to inconsistent or invalid results. > **Note** > > This function does not verify that the debug file matches the binary’s unique identifier (e.g., build ID, GUID). #### [` offset_to_virtual_address `]() offset\_to\_virtual\_address(*self*, *offset: int*, *slide: int = 0*) → int | [lief.\_lief.lief\_errors]( "lief._lief.lief_errors") Convert an offset into a virtual address. #### [` original_size `]() property original\_size → int Original size of the binary #### [` page_size `]() property page\_size → int Get the default memory page size according to the architecture and the format of the current binary #### [` patch_addresspatch_address `]() patch\_address(*self*, *address: int*, *patch\_value: collections.abc.Sequence[int]*, *va\_type: [lief.\_lief.Binary.VA\_TYPES]( "lief._lief.Binary.VA_TYPES") = VA\_TYPES.AUTO*) → None **patch\_address(*self*, *address: int*, *patch\_value: int*, *size: int = 8*, *va\_type: [lief.\_lief.Binary.VA\_TYPES]( "lief._lief.Binary.VA_TYPES") = VA\_TYPES.AUTO*) → None** Overloaded function. 1. `patch_address(self, address: int, patch_value: collections.abc.Sequence[int], va_type: lief._lief.Binary.VA_TYPES = VA_TYPES.AUTO) -> None` > Patch the address with the given list of bytes. The virtual address is specified in the first argument and the content in the second (as a list of bytes). > > If the underlying binary is a PE, one can specify if the virtual address is a [`RVA`]( "lief.Binary.VA_TYPES.RVA") or a [`VA`]( "lief.Binary.VA_TYPES.VA"). By default, it is set to [`AUTO`]( "lief.Binary.VA_TYPES.AUTO"). 2. `patch_address(self, address: int, patch_value: int, size: int = 8, va_type: lief._lief.Binary.VA_TYPES = VA_TYPES.AUTO) -> None` > Patch the address with the given integer value. The virtual address is specified in the first argument, the integer in the second and the integer’s size in the third one. > > If the underlying binary is a PE, one can specify if the virtual address is a [`RVA`]( "lief.Binary.VA_TYPES.RVA") or a [`VA`]( "lief.Binary.VA_TYPES.VA"). By default, it is set to [`AUTO`]( "lief.Binary.VA_TYPES.AUTO"). #### [` relocations `]() property relocations → lief.Binary.it\_relocations Return an iterator over abstract [`Relocation`]( "lief.Relocation") #### [` remove_section `]() remove\_section(*self*, *name: str*, *clear: bool = False*) → None Remove the section with the given name #### [` sections `]() property sections → lief.Binary.it\_sections Return an iterator over the binary’s abstract sections ([`Section`]( "lief.Section")) #### [` symbols `]() property symbols → lief.Binary.it\_symbols Return an iterator over the binary’s abstract [`Symbol`]( "lief.Symbol") #### [` virtual_size `]() property virtual\_size → int #### [` xref `]() xref(*self*, *virtual\_address: int*) → list[int] Return all **virtual addresses** that *use* the `address` given in parameter --- ## [Header]() ### [` lief.Header `]() class lief.Header Bases: `Object` Class which represents an abstracted Header #### [` ARCHITECTURES `]() class ARCHITECTURES(*\*values*) Bases: `Enum` ##### [` ARM `]() ARM = 1 ##### [` ARM64 `]() ARM64 = 2 ##### [` LOONGARCH `]() LOONGARCH = 11 ##### [` MIPS `]() MIPS = 3 ##### [` PPC `]() PPC = 6 ##### [` PPC64 `]() PPC64 = 12 ##### [` RISCV `]() RISCV = 10 ##### [` SPARC `]() SPARC = 7 ##### [` SYSZ `]() SYSZ = 8 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` X86 `]() X86 = 4 ##### [` X86_64 `]() X86\_64 = 5 ##### [` XCORE `]() XCORE = 9 ##### [` from_value `]() from\_value(*arg: int*) → [lief.Header.ARCHITECTURES]( "lief.Header.ARCHITECTURES") = <nanobind.nb\_func object> #### [` ENDIANNESS `]() class ENDIANNESS(*\*values*) Bases: `Enum` ##### [` BIG `]() BIG = 1 ##### [` LITTLE `]() LITTLE = 2 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.Header.ENDIANNESS]( "lief.Header.ENDIANNESS") = <nanobind.nb\_func object> #### [` MODES `]() class MODES(*\*values*) Bases: `Enum` ##### [` ARM64E `]() ARM64E = 16 ##### [` BITS_16 `]() BITS\_16 = 1 ##### [` BITS_32 `]() BITS\_32 = 2 ##### [` BITS_64 `]() BITS\_64 = 4 ##### [` NONE `]() NONE = 0 ##### [` THUMB `]() THUMB = 8 ##### [` from_value `]() from\_value(*arg: int*) → [lief.Header.MODES]( "lief.Header.MODES") = <nanobind.nb\_func object> #### [` OBJECT_TYPES `]() class OBJECT\_TYPES(*\*values*) Bases: `Enum` ##### [` EXECUTABLE `]() EXECUTABLE = 1 ##### [` LIBRARY `]() LIBRARY = 2 ##### [` OBJECT `]() OBJECT = 3 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.Header.OBJECT\_TYPES]( "lief.Header.OBJECT_TYPES") = <nanobind.nb\_func object> #### [` architecture `]() property architecture → [lief.Header.ARCHITECTURES]( "lief.Header.ARCHITECTURES") Target architecture #### [` endianness `]() property endianness → [lief.Header.ENDIANNESS]( "lief.Header.ENDIANNESS") Binary endianness #### [` entrypoint `]() property entrypoint → int Binary entrypoint #### [` is_32 `]() property is\_32 → bool `True` if the binary targets a `32-bits` architecture #### [` is_64 `]() property is\_64 → bool `True` if the binary targets a `64-bits` architecture #### [` modes `]() property modes → [lief.Header.MODES]( "lief.Header.MODES") Architecture details #### [` modes_list `]() property modes\_list → list[[lief.Header.MODES]( "lief.Header.MODES")] *Modes* as a list #### [` object_type `]() property object\_type → [lief.Header.OBJECT\_TYPES]( "lief.Header.OBJECT_TYPES") Type of the binary (executable, library…) --- ## [Section]() ![Inheritance diagram of lief._lief.MachO.Section, lief._lief.ELF.Section, lief.Section, lief._lief.MachO.ThreadLocalVariables, lief._lief.COFF.Section, lief._lief.PE.Section, lief._lief.Section](https://lief.re/doc/latest/_images/inheritance-cf8370ae9c3ecfcda965bc93e984bcd2122e3c8c.png) ### [` lief.Section `]() class lief.Section Bases: `Object` Class which represents an abstracted section #### [` content `]() property content → memoryview Section’s content #### [` entropy `]() property entropy → float Section’s entropy #### [` fullname `]() property fullname → bytes Return the **fullname** of the section including the trailing bytes #### [` name `]() property name → str | bytes Section’s name #### [` offset `]() property offset → int Section’s file offset #### [` searchsearchsearch `]() search(*self*, *number: int*, *pos: int = 0*, *size: int = 0*) → int | None **search(*self*, *str: str*, *pos: int = 0*) → int | None **search(*self*, *bytes: bytes*, *pos: int = 0*) → int | None**** Overloaded function. 1. `search(self, number: int, pos: int = 0, size: int = 0) -> Optional[int]` Look for **integer** within the current section 2. `search(self, str: str, pos: int = 0) -> Optional[int]` Look for **string** within the current section 3. `search(self, bytes: bytes, pos: int = 0) -> Optional[int]` Look for the given bytes within the current section #### [` search_allsearch_all `]() search\_all(*self*, *number: int*, *size: int = 0*) → list[int] **search\_all(*self*, *str: str*) → list[int]** Overloaded function. 1. `search_all(self, number: int, size: int = 0) -> list[int]` Look for **all** integers within the current section 2. `search_all(self, str: str) -> list[int]` Look for all **strings** within the current section #### [` size `]() property size → int Section’s size #### [` virtual_address `]() property virtual\_address → int Section’s virtual address --- ## [Symbol]() ![Inheritance diagram of lief._lief.MachO.Symbol, lief._lief.PE.ExportEntry, lief.Symbol, lief._lief.Function, lief._lief.Symbol, lief._lief.COFF.Symbol, lief._lief.PE.ImportEntry, lief.Function, lief._lief.PE.DelayImportEntry, lief._lief.ELF.Symbol](https://lief.re/doc/latest/_images/inheritance-b1f8e02e97aed8f7c6553d7001629d3b21f123d7.png) ### [` lief.Symbol `]() class lief.Symbol Bases: `Object` This class represents a symbol in an executable format. #### [` name `]() property name → str | bytes Symbol’s name #### [` size `]() property size → int Symbol’s size #### [` value `]() property value → int Symbol’s value --- ## [Relocation]() ![Inheritance diagram of lief._lief.PE.RelocationEntry, lief._lief.ELF.Relocation, lief._lief.MachO.RelocationFixup, lief._lief.MachO.Relocation, lief._lief.MachO.RelocationObject, lief._lief.COFF.Relocation, lief.Relocation, lief._lief.Relocation, lief._lief.MachO.RelocationDyld](https://lief.re/doc/latest/_images/inheritance-4d34126a14c488f6364bfcd4a4599739baf0afe0.png) ### [` lief.Relocation `]() class lief.Relocation Bases: `Object` Class which represents an abstracted Relocation #### [` address `]() property address → int Relocation’s address #### [` size `]() property size → int Relocation’s size (in **bits**) --- ## [Function]() ### [` lief.Functionlief.Functionlief.Functionlief.Function `]() class lief.Function(*self*) **class lief.Function(*self*, *arg: str*, */*) **class lief.Function(*self*, *arg: int*, */*) **class lief.Function(*self*, *arg0: str*, *arg1: int*, */*)****** Bases: [`Symbol`]( "lief._lief.Symbol") Class which represents a Function in an executable file format. #### [` FLAGS `]() class FLAGS(*\*values*) Bases: `Flag` ##### [` CONSTRUCTOR `]() CONSTRUCTOR = 1 ##### [` DEBUG_INFO `]() DEBUG\_INFO = 4 ##### [` DESTRUCTOR `]() DESTRUCTOR = 2 ##### [` EXPORTED `]() EXPORTED = 8 ##### [` IMPORTED `]() IMPORTED = 16 ##### [` NONE `]() NONE = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.Function.FLAGS]( "lief.Function.FLAGS") = <nanobind.nb\_func object> #### [` add `]() add(*self*, *flag: [lief.\_lief.Function.FLAGS]( "lief._lief.Function.FLAGS")*) → [lief.\_lief.Function]( "lief._lief.Function") Add the given [`FLAGS`]( "lief.Function.FLAGS") #### [` address `]() property address → int Function’s address #### [` flags `]() property flags → [lief.Function.FLAGS]( "lief.Function.FLAGS") Function flags #### [` flags_list `]() property flags\_list → list[[lief.Function.FLAGS]( "lief.Function.FLAGS")] Function flags as a list of [`FLAGS`]( "lief.Function.FLAGS") #### [` has `]() has(*self*, *flag: [lief.\_lief.Function.FLAGS]( "lief._lief.Function.FLAGS")*) → bool Check if the function has the given flag --- documentID: "1ec5e14ecbc5d658a34a1398fdfd4f4172d9eafdab81400d267f8caf77f27e62" docname: "api/binary_abstraction/rust" title: "Binary Abstraction Rust API - LIEF Documentation" description: "Binary Abstraction Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/api/binary_abstraction/rust.html" markdownURL: "https://lief.re/doc/latest/api/binary_abstraction/rust.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "4a24d46b3ea2abcdb516547a66d5c8d681fe156c49877c0e6e2a4866943deb53" --- # [Rust]() > **Note** > > Please check the module [`lief::generic`]() which contains all the abstracted traits --- documentID: "e1bf9750dd3d1fce566257b8893bb4844f89677b8d9bf4e0e73697b33407eb83" docname: "api/cpp/index" title: "C++ - LIEF Documentation" description: "C++ reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/api/cpp/index.html" markdownURL: "https://lief.re/doc/latest/api/cpp/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "23ea3e162d56acb62d24513e45e84d4e2853cd69db43c727d517d1aa01277c27" --- # [C++]() > **Note** > > You can also find the Doxygen documentation [here]() ## [Iterators]() ### [` TUITERATOR_Tref_iterator `]() template<class T, typename U = typename decay\_t<[T]( "LIEF::ref_iterator::T")>::value\_type, class ITERATOR\_T = typename decay\_t<[T]( "LIEF::ref_iterator::T")>::iterator> class ref\_iterator Iterator which returns reference on container’s values. Public Types #### [` iterator_category `]() using iterator\_category = std::bidirectional\_iterator\_tag #### [` value_type `]() using value\_type = decay\_t<[U]( "LIEF::ref_iterator::U")> #### [` difference_type `]() using difference\_type = ptrdiff\_t #### [` pointer `]() using pointer = std::remove\_pointer\_t<[U]( "LIEF::ref_iterator::U")>\* #### [` reference `]() using reference = std::remove\_pointer\_t<[U]( "LIEF::ref_iterator::U")>& #### [` container_type `]() using container\_type = [T]( "LIEF::ref_iterator::T") #### [` DT_VAL `]() using DT\_VAL = [U]( "LIEF::ref_iterator::U") #### [` DT `]() using DT = decay\_t<[T]( "LIEF::ref_iterator::T")> #### [` ref_t `]() using ref\_t = typename [ref\_iterator]( "LIEF::ref_iterator")::[reference]( "LIEF::ref_iterator::reference") #### [` pointer_t `]() using pointer\_t = typename [ref\_iterator]( "LIEF::ref_iterator")::[pointer]( "LIEF::ref_iterator::pointer") Public Functions #### [` ref_iterator `]() inline ref\_iterator([ref\_iterator]( "LIEF::ref_iterator::ref_iterator") &&other) noexcept #### [` operator= `]() inline [ref\_iterator]( "LIEF::ref_iterator") &operator=([ref\_iterator]( "LIEF::ref_iterator") &&other) noexcept #### [` T2U2IT2ref_iterator `]() template<class T2, typename U2, class IT2, typename = std::enable\_if\_t<!std::is\_same\_v<[ref\_iterator]( "LIEF::ref_iterator::ref_iterator"), [ref\_iterator]( "LIEF::ref_iterator::ref_iterator")<[T2]( "LIEF::ref_iterator::ref_iterator::T2"), [U2]( "LIEF::ref_iterator::ref_iterator::U2"), [IT2]( "LIEF::ref_iterator::ref_iterator::IT2")>> && std::is\_same\_v<decay\_t<[T]( "LIEF::ref_iterator::T")>, decay\_t<[T2]( "LIEF::ref_iterator::ref_iterator::T2")>>>> inline ref\_iterator(const [ref\_iterator]( "LIEF::ref_iterator::ref_iterator")<[T2]( "LIEF::ref_iterator::ref_iterator::T2"), [U2]( "LIEF::ref_iterator::ref_iterator::U2"), [IT2]( "LIEF::ref_iterator::ref_iterator::IT2")> &other) #### [` T2U2IT2ref_iterator `]() template<class T2, typename U2, class IT2, typename = std::enable\_if\_t<!std::is\_same\_v<[ref\_iterator]( "LIEF::ref_iterator::ref_iterator"), [ref\_iterator]( "LIEF::ref_iterator::ref_iterator")<[T2]( "LIEF::ref_iterator::ref_iterator::T2"), [U2]( "LIEF::ref_iterator::ref_iterator::U2"), [IT2]( "LIEF::ref_iterator::ref_iterator::IT2")>> && std::is\_same\_v<decay\_t<[T]( "LIEF::ref_iterator::T")>, decay\_t<[T2]( "LIEF::ref_iterator::ref_iterator::T2")>>>> inline ref\_iterator([ref\_iterator]( "LIEF::ref_iterator::ref_iterator")<[T2]( "LIEF::ref_iterator::ref_iterator::T2"), [U2]( "LIEF::ref_iterator::ref_iterator::U2"), [IT2]( "LIEF::ref_iterator::ref_iterator::IT2")> &&other) noexcept #### [` ~ref_iterator `]() ~ref\_iterator() = default #### [` ref_iterator `]() inline ref\_iterator([T]( "LIEF::ref_iterator::T") container) #### [` ref_iterator `]() inline ref\_iterator(const [ref\_iterator]( "LIEF::ref_iterator::ref_iterator") &copy) #### [` operator= `]() inline [ref\_iterator]( "LIEF::ref_iterator") &operator=([ref\_iterator]( "LIEF::ref_iterator") other) #### [` swap `]() inline void swap([ref\_iterator]( "LIEF::ref_iterator") &other) noexcept #### [` operator++ `]() inline [ref\_iterator]( "LIEF::ref_iterator") &operator++() #### [` operator++ `]() inline [ref\_iterator]( "LIEF::ref_iterator") operator++(int) #### [` operator-- `]() inline [ref\_iterator]( "LIEF::ref_iterator") &operator--() #### [` operator-- `]() inline [ref\_iterator]( "LIEF::ref_iterator") operator--(int) #### [` operator+= `]() inline [ref\_iterator]( "LIEF::ref_iterator") &operator+=(const typename [ref\_iterator]( "LIEF::ref_iterator")::[difference\_type]( "LIEF::ref_iterator::difference_type") &movement) #### [` operator-= `]() inline [ref\_iterator]( "LIEF::ref_iterator") &operator-=(const typename [ref\_iterator]( "LIEF::ref_iterator")::[difference\_type]( "LIEF::ref_iterator::difference_type") &movement) #### [` operator[] `]() inline std::enable\_if\_t<!std::is\_const\_v<[ref\_t]( "LIEF::ref_iterator::ref_t")>, remove\_const\_t<[ref\_t]( "LIEF::ref_iterator::ref_t")>> operator[](size\_t n) #### [` operator[] `]() inline add\_const\_t<[ref\_t]( "LIEF::ref_iterator::ref_t")> operator[](size\_t n) const #### [` operator+ `]() inline [ref\_iterator]( "LIEF::ref_iterator") operator+(typename [ref\_iterator]( "LIEF::ref_iterator")::[difference\_type]( "LIEF::ref_iterator::difference_type") n) const #### [` operator- `]() inline [ref\_iterator]( "LIEF::ref_iterator") operator-(typename [ref\_iterator]( "LIEF::ref_iterator")::[difference\_type]( "LIEF::ref_iterator::difference_type") n) const #### [` operator- `]() inline [ref\_iterator]( "LIEF::ref_iterator")::[difference\_type]( "LIEF::ref_iterator::difference_type") operator-(const [ref\_iterator]( "LIEF::ref_iterator") &rhs) const #### [` operator< `]() inline bool operator<(const [ref\_iterator]( "LIEF::ref_iterator") &rhs) const #### [` operator> `]() inline bool operator>(const [ref\_iterator]( "LIEF::ref_iterator") &rhs) const #### [` operator>= `]() inline bool operator>=(const [ref\_iterator]( "LIEF::ref_iterator") &rhs) const #### [` operator<= `]() inline bool operator<=(const [ref\_iterator]( "LIEF::ref_iterator") &rhs) const #### [` begin `]() inline [ref\_iterator]( "LIEF::ref_iterator") begin() const #### [` cbegin `]() inline [ref\_iterator]( "LIEF::ref_iterator") cbegin() const #### [` end `]() inline [ref\_iterator]( "LIEF::ref_iterator") end() const #### [` cend `]() inline [ref\_iterator]( "LIEF::ref_iterator") cend() const #### [` operator== `]() inline bool operator==(const [ref\_iterator]( "LIEF::ref_iterator") &other) const #### [` operator!= `]() inline bool operator!=(const [ref\_iterator]( "LIEF::ref_iterator") &other) const #### [` size `]() inline size\_t size() const #### [` empty `]() inline bool empty() const #### [` operator* `]() inline std::enable\_if\_t<!std::is\_const\_v<[ref\_t]( "LIEF::ref_iterator::ref_t")>, remove\_const\_t<[ref\_t]( "LIEF::ref_iterator::ref_t")>> operator\*() #### [` Voperator* `]() template<typename V = [DT\_VAL]( "LIEF::ref_iterator::DT_VAL")> inline std::enable\_if\_t<std::is\_pointer\_v<[V]( "LIEF::ref_iterator::operator*::V")>, add\_const\_t<[ref\_t]( "LIEF::ref_iterator::ref_t")>> operator\*() const #### [` Voperator* `]() template<typename V = [DT\_VAL]( "LIEF::ref_iterator::DT_VAL")> inline std::enable\_if\_t<!std::is\_pointer\_v<[V]( "LIEF::ref_iterator::operator*::V")>, add\_const\_t<[ref\_t]( "LIEF::ref_iterator::ref_t")>> operator\*() const #### [` operator-> `]() inline std::enable\_if\_t<!std::is\_const\_v<[pointer\_t]( "LIEF::ref_iterator::pointer_t")>, [pointer\_t]( "LIEF::ref_iterator::pointer_t")> operator->() #### [` operator-> `]() inline add\_const\_t<[pointer\_t]( "LIEF::ref_iterator::pointer_t")> operator->() const ### [` TUCTLIEF::const_ref_iterator `]() template<class T, typename U = typename decay\_t<[T]( "LIEF::const_ref_iterator::T")>::value\_type, class CT = std::add\_const\_t<[T]( "LIEF::const_ref_iterator::T")>> using LIEF::const\_ref\_iterator = [ref\_iterator]( "LIEF::ref_iterator")<[CT]( "LIEF::const_ref_iterator::CT"), [U]( "LIEF::const_ref_iterator::U"), typename decay\_t<[CT]( "LIEF::const_ref_iterator::CT")>::const\_iterator> Iterator which returns a const ref on container’s values. ### [` TUITERATOR_Tfilter_iterator `]() template<class T, typename U = typename decay\_t<[T]( "LIEF::filter_iterator::T")>::value\_type, class ITERATOR\_T = typename decay\_t<[T]( "LIEF::filter_iterator::T")>::iterator> class filter\_iterator Iterator which returns a ref on container’s values given predicates. Public Types #### [` iterator_category `]() using iterator\_category = std::forward\_iterator\_tag #### [` value_type `]() using value\_type = decay\_t<[U]( "LIEF::filter_iterator::U")> #### [` difference_type `]() using difference\_type = ptrdiff\_t #### [` pointer `]() using pointer = std::remove\_pointer\_t<[U]( "LIEF::filter_iterator::U")>\* #### [` reference `]() using reference = std::remove\_pointer\_t<[U]( "LIEF::filter_iterator::U")>& #### [` container_type `]() using container\_type = [T]( "LIEF::filter_iterator::T") #### [` DT_VAL `]() using DT\_VAL = [U]( "LIEF::filter_iterator::U") #### [` DT `]() using DT = decay\_t<[T]( "LIEF::filter_iterator::T")> #### [` ref_t `]() using ref\_t = typename [filter\_iterator]( "LIEF::filter_iterator")::[reference]( "LIEF::filter_iterator::reference") #### [` pointer_t `]() using pointer\_t = typename [filter\_iterator]( "LIEF::filter_iterator")::[pointer]( "LIEF::filter_iterator::pointer") #### [` filter_t `]() using filter\_t = std::function<bool(const typename [DT]( "LIEF::filter_iterator::DT")::value\_type&)> Public Functions #### [` filter_iterator `]() inline filter\_iterator([filter\_iterator]( "LIEF::filter_iterator::filter_iterator") &&other) noexcept #### [` operator= `]() inline [filter\_iterator]( "LIEF::filter_iterator") &operator=([filter\_iterator]( "LIEF::filter_iterator") &&other) noexcept #### [` ~filter_iterator `]() ~filter\_iterator() = default #### [` filter_iterator `]() inline filter\_iterator([T]( "LIEF::filter_iterator::T") container, [filter\_t]( "LIEF::filter_iterator::filter_t") filter) #### [` filter_iterator `]() inline filter\_iterator([T]( "LIEF::filter_iterator::T") container, const std::vector<[filter\_t]( "LIEF::filter_iterator::filter_t")> &filters) #### [` filter_iterator `]() inline filter\_iterator([T]( "LIEF::filter_iterator::T") container) #### [` filter_iterator `]() inline filter\_iterator(const [filter\_iterator]( "LIEF::filter_iterator::filter_iterator") &copy) #### [` operator= `]() inline [filter\_iterator]( "LIEF::filter_iterator") &operator=([filter\_iterator]( "LIEF::filter_iterator") other) #### [` swap `]() inline void swap([filter\_iterator]( "LIEF::filter_iterator") &other) noexcept #### [` def `]() inline [filter\_iterator]( "LIEF::filter_iterator") &def([filter\_t]( "LIEF::filter_iterator::filter_t") func) #### [` operator++ `]() inline [filter\_iterator]( "LIEF::filter_iterator") &operator++() #### [` operator++ `]() inline [filter\_iterator]( "LIEF::filter_iterator") operator++(int) #### [` begin `]() inline [filter\_iterator]( "LIEF::filter_iterator") begin() const #### [` cbegin `]() inline [filter\_iterator]( "LIEF::filter_iterator") cbegin() const #### [` end `]() inline [filter\_iterator]( "LIEF::filter_iterator") end() const #### [` cend `]() inline [filter\_iterator]( "LIEF::filter_iterator") cend() const #### [` operator* `]() inline std::enable\_if\_t<!std::is\_const\_v<[ref\_t]( "LIEF::filter_iterator::ref_t")>, remove\_const\_t<[ref\_t]( "LIEF::filter_iterator::ref_t")>> operator\*() #### [` Voperator* `]() template<typename V = [DT\_VAL]( "LIEF::filter_iterator::DT_VAL")> inline std::enable\_if\_t<std::is\_pointer\_v<[V]( "LIEF::filter_iterator::operator*::V")>, add\_const\_t<[ref\_t]( "LIEF::filter_iterator::ref_t")>> operator\*() const #### [` Voperator* `]() template<typename V = [DT\_VAL]( "LIEF::filter_iterator::DT_VAL")> inline std::enable\_if\_t<!std::is\_pointer\_v<[V]( "LIEF::filter_iterator::operator*::V")>, add\_const\_t<[ref\_t]( "LIEF::filter_iterator::ref_t")>> operator\*() const #### [` operator[] `]() inline std::enable\_if\_t<!std::is\_const\_v<[ref\_t]( "LIEF::filter_iterator::ref_t")>, remove\_const\_t<[ref\_t]( "LIEF::filter_iterator::ref_t")>> operator[](size\_t n) #### [` operator[] `]() inline add\_const\_t<[ref\_t]( "LIEF::filter_iterator::ref_t")> operator[](size\_t n) const #### [` operator-> `]() inline std::enable\_if\_t<!std::is\_const\_v<[pointer\_t]( "LIEF::filter_iterator::pointer_t")>, [pointer\_t]( "LIEF::filter_iterator::pointer_t")> operator->() #### [` operator-> `]() inline add\_const\_t<[pointer\_t]( "LIEF::filter_iterator::pointer_t")> operator->() const #### [` size `]() inline size\_t size() const #### [` empty `]() inline bool empty() const #### [` operator== `]() inline bool operator==(const [filter\_iterator]( "LIEF::filter_iterator") &other) const #### [` operator!= `]() inline bool operator!=(const [filter\_iterator]( "LIEF::filter_iterator") &other) const ### [` TUCTLIEF::const_filter_iterator `]() template<class T, typename U = typename decay\_t<[T]( "LIEF::const_filter_iterator::T")>::value\_type, class CT = std::add\_const\_t<[T]( "LIEF::const_filter_iterator::T")>> using LIEF::const\_filter\_iterator = [filter\_iterator]( "LIEF::filter_iterator")<[CT]( "LIEF::const_filter_iterator::CT"), [U]( "LIEF::const_filter_iterator::U"), typename decay\_t<[CT]( "LIEF::const_filter_iterator::CT")>::const\_iterator> Iterator which returns a const ref on container’s values given predicates. ### [` IteratorTiterator_range `]() template<typename IteratorT> class iterator\_range Public Types #### [` IteratorTy `]() using IteratorTy = [IteratorT]( "LIEF::iterator_range::IteratorT") #### [` IteratorDecayTy `]() using IteratorDecayTy = std::decay\_t<[IteratorT]( "LIEF::iterator_range::IteratorT")> Public Functions #### [` Titerator_range `]() template<class T> inline iterator\_range([T]( "LIEF::iterator_range::iterator_range::T") &&it\_begin, [T]( "LIEF::iterator_range::iterator_range::T") &&it\_end) #### [` begin `]() inline [IteratorT]( "LIEF::iterator_range::IteratorT") begin() const #### [` end `]() inline [IteratorT]( "LIEF::iterator_range::IteratorT") end() const #### [` empty `]() inline bool empty() const #### [` at `]() inline [ReferenceProxy]( "LIEF::iterator_range::ReferenceProxy") at(typename [IteratorDecayTy]( "LIEF::iterator_range::IteratorDecayTy")::difference\_type pos) const #### [` operator[] `]() inline [ReferenceProxy]( "LIEF::iterator_range::ReferenceProxy") operator[](typename [IteratorDecayTy]( "LIEF::iterator_range::IteratorDecayTy")::difference\_type pos) const #### [` size `]() inline std::ptrdiff\_t size() const #### [` ReferenceProxy `]() class ReferenceProxy Public Types ##### [` reference `]() using reference = decltype(\*std::declval<const [IteratorDecayTy]( "LIEF::iterator_range::IteratorDecayTy")&>()) Public Functions ##### [` operator reference `]() inline operator [reference]( "LIEF::iterator_range::ReferenceProxy::reference")() const ##### [` Itoperator-> `]() template<class It = [IteratorDecayTy]( "LIEF::iterator_range::IteratorDecayTy")> inline decltype(&\*std::declval<const [It]( "LIEF::iterator_range::ReferenceProxy::operator->::It")&>()) operator->() const ## [BinaryStream]() ### [` BinaryStream `]() class BinaryStream Class that is used to a read stream of data from different sources. Subclassed by LIEF::DumpStream, [LIEF::FileStream](), [LIEF::MemoryStream](), [LIEF::SpanStream](), [LIEF::VectorStream]() Public Types #### [` STREAM_TYPE `]() enum class STREAM\_TYPE *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` VECTOR `]() enumerator VECTOR ##### [` MEMORY `]() enumerator MEMORY ##### [` SPAN `]() enumerator SPAN ##### [` FILE `]() enumerator FILE ##### [` DUMP `]() enumerator DUMP ##### [` ELF_DATA_HANDLER `]() enumerator ELF\_DATA\_HANDLER Public Functions #### [` BinaryStream `]() inline BinaryStream([STREAM\_TYPE]( "LIEF::BinaryStream::STREAM_TYPE") type) #### [` ~BinaryStream `]() virtual ~BinaryStream() = default #### [` size `]() virtual uint64\_t size() const = 0 #### [` type `]() inline [STREAM\_TYPE]( "LIEF::BinaryStream::STREAM_TYPE") type() const #### [` is_memory_stream `]() inline bool is\_memory\_stream() const #### [` is_dump_stream `]() inline bool is\_dump\_stream() const #### [` is_memory_view `]() inline bool is\_memory\_view() const #### [` skip_uleb128 `]() inline const [BinaryStream]( "LIEF::BinaryStream") &skip\_uleb128() const #### [` skip_sleb128 `]() inline const [BinaryStream]( "LIEF::BinaryStream") &skip\_sleb128() const #### [` read_uleb128 `]() [result]( "LIEF::result")<uint64\_t> read\_uleb128(size\_t \*size = nullptr) const #### [` read_sleb128 `]() [result]( "LIEF::result")<uint64\_t> read\_sleb128(size\_t \*size = nullptr) const #### [` read_dwarf_encoded `]() [result]( "LIEF::result")<int64\_t> read\_dwarf\_encoded(uint8\_t encoding) const #### [` read_string `]() [result]( "LIEF::result")<std::string> read\_string(size\_t maxsize = ~size\_t{0}) const #### [` peek_string `]() [result]( "LIEF::result")<std::string> peek\_string(size\_t maxsize = ~size\_t{0}) const #### [` peek_string_at `]() [result]( "LIEF::result")<std::string> peek\_string\_at(size\_t offset, size\_t maxsize = ~size\_t{0}) const #### [` read_u16string `]() [result]( "LIEF::result")<std::u16string> read\_u16string() const #### [` peek_u16string `]() [result]( "LIEF::result")<std::u16string> peek\_u16string() const #### [` read_mutf8 `]() [result]( "LIEF::result")<std::string> read\_mutf8(size\_t maxsize = ~size\_t{0}) const #### [` read_u16string `]() [result]( "LIEF::result")<std::u16string> read\_u16string(size\_t length) const #### [` peek_u16string `]() [result]( "LIEF::result")<std::u16string> peek\_u16string(size\_t length) const #### [` peek_u16string_at `]() [result]( "LIEF::result")<std::u16string> peek\_u16string\_at(size\_t offset, size\_t length) const #### [` peek_data `]() inline virtual [ok\_error\_t]( "LIEF::ok_error_t") peek\_data(std::vector<uint8\_t> &container, uint64\_t offset, uint64\_t size, uint64\_t virtual\_address = 0) #### [` read_data `]() inline virtual [ok\_error\_t]( "LIEF::ok_error_t") read\_data(std::vector<uint8\_t> &container, uint64\_t size) #### [` read_data `]() inline [ok\_error\_t]( "LIEF::ok_error_t") read\_data(std::vector<uint8\_t> &container) #### [` Tread_objects `]() template<class T> inline [ok\_error\_t]( "LIEF::ok_error_t") read\_objects(std::vector<[T]( "LIEF::BinaryStream::read_objects::T")> &container, uint64\_t count) #### [` Tpeek_objects `]() template<class T> inline [ok\_error\_t]( "LIEF::ok_error_t") peek\_objects(std::vector<[T]( "LIEF::BinaryStream::peek_objects::T")> &container, uint64\_t count) #### [` Tpeek_objects_at `]() template<class T> inline [ok\_error\_t]( "LIEF::ok_error_t") peek\_objects\_at(uint64\_t offset, std::vector<[T]( "LIEF::BinaryStream::peek_objects_at::T")> &container, uint64\_t count) #### [` setpos `]() inline void setpos(size\_t pos) const #### [` increment_pos `]() inline const [BinaryStream]( "LIEF::BinaryStream") &increment\_pos(size\_t value) const #### [` decrement_pos `]() inline void decrement\_pos(size\_t value) const #### [` pos `]() inline size\_t pos() const #### [` is_valid `]() inline bool is\_valid() const #### [` operator bool `]() inline operator bool() const #### [` Tread_array `]() template<class T> const [T]( "LIEF::BinaryStream::read_array::T") \*read\_array(size\_t size) const #### [` TNpeek_array `]() template<class T, size\_t N> inline [ok\_error\_t]( "LIEF::ok_error_t") peek\_array(std::array<[T]( "LIEF::BinaryStream::peek_array::T"), [N]( "LIEF::BinaryStream::peek_array::N")> &dst) const #### [` TNread_array `]() template<class T, size\_t N> inline [ok\_error\_t]( "LIEF::ok_error_t") read\_array(std::array<[T]( "LIEF::BinaryStream::read_array::T"), [N]( "LIEF::BinaryStream::read_array::N")> &dst) const #### [` Tpeek `]() template<class T> [result]( "LIEF::result")<[T]( "LIEF::BinaryStream::peek::T")> peek() const #### [` Tpeek `]() template<class T> [result]( "LIEF::result")<[T]( "LIEF::BinaryStream::peek::T")> peek(size\_t offset) const #### [` Tpeek_array `]() template<class T> const [T]( "LIEF::BinaryStream::peek_array::T") \*peek\_array(size\_t size) const #### [` Tpeek_array `]() template<class T> const [T]( "LIEF::BinaryStream::peek_array::T") \*peek\_array(size\_t offset, size\_t size) const #### [` Tread `]() template<class T> [result]( "LIEF::result")<[T]( "LIEF::BinaryStream::read::T")> read() const #### [` Tskip `]() template<class T> inline const [BinaryStream]( "LIEF::BinaryStream") &skip() const #### [` Tcan_read `]() template<typename T> bool can\_read() const #### [` Tcan_read `]() template<typename T> bool can\_read(size\_t offset) const #### [` can_read `]() inline bool can\_read(int64\_t offset, int64\_t size) const #### [` align `]() size\_t align(size\_t align\_on) const #### [` set_endian_swap `]() inline void set\_endian\_swap(bool swap) #### [` should_swap `]() inline bool should\_swap() const #### [` p `]() inline virtual const uint8\_t \*p() const #### [` start `]() inline virtual uint8\_t \*start() #### [` p `]() inline virtual uint8\_t \*p() #### [` end `]() inline virtual uint8\_t \*end() #### [` start `]() inline virtual const uint8\_t \*start() const #### [` end `]() inline virtual const uint8\_t \*end() const #### [` read_at `]() virtual [result]( "LIEF::result")<const void\*> read\_at(uint64\_t offset, uint64\_t size, uint64\_t virtual\_address = 0) const = 0 #### [` peek_in `]() inline virtual [ok\_error\_t]( "LIEF::ok_error_t") peek\_in(void \*dst, uint64\_t offset, uint64\_t size, uint64\_t virtual\_address = 0) const #### [` Tcast `]() template<class T> inline const [T]( "LIEF::BinaryStream::cast::T") \*cast() const #### [` Tcast `]() template<class T> inline [T]( "LIEF::BinaryStream::cast::T") \*cast() #### [` bind_binary `]() inline virtual bool bind\_binary([Binary]( "LIEF::Binary")&) Public Static Functions #### [` Tis_all_zero `]() template<class T> static inline bool is\_all\_zero(const [T]( "LIEF::BinaryStream::is_all_zero::T") &buffer) Friends **friend class ASN1Reader** ### [` FileStream `]() class FileStream : public LIEF::[BinaryStream]( "LIEF::BinaryStream") Stream interface over a `std::ifstream`. Public Functions #### [` FileStream `]() inline FileStream(std::ifstream fs, uint64\_t size) #### [` FileStream `]() FileStream() = delete #### [` FileStream `]() FileStream(const [FileStream]( "LIEF::FileStream::FileStream")&) = delete #### [` operator= `]() [FileStream]( "LIEF::FileStream") &operator=(const [FileStream]( "LIEF::FileStream")&) = delete #### [` FileStream `]() FileStream([FileStream]( "LIEF::FileStream::FileStream") &&other) noexcept = default #### [` operator= `]() [FileStream]( "LIEF::FileStream") &operator=([FileStream]( "LIEF::FileStream") &&other) noexcept = default #### [` size `]() inline virtual uint64\_t size() const override #### [` content `]() std::vector<uint8\_t> content() const #### [` ~FileStream `]() ~FileStream() override = default #### [` peek_in `]() inline virtual [ok\_error\_t]( "LIEF::ok_error_t") peek\_in(void \*dst, uint64\_t offset, uint64\_t size, uint64\_t = 0) const override #### [` read_at `]() inline virtual [result]( "LIEF::result")<const void\*> read\_at(uint64\_t, uint64\_t, uint64\_t) const override Public Static Functions #### [` from_file `]() static [result]( "LIEF::result")<[FileStream]( "LIEF::FileStream")> from\_file(std::string\_view file) #### [` classof `]() static inline bool classof(const [BinaryStream]( "LIEF::BinaryStream") &stream) ### [` SpanStream `]() class SpanStream : public LIEF::[BinaryStream]( "LIEF::BinaryStream") Public Functions #### [` SpanStream `]() inline SpanStream(span<const uint8\_t> data) #### [` SpanStream `]() inline SpanStream(span<uint8\_t> data) #### [` SpanStream `]() inline SpanStream(const uint8\_t \*p, size\_t size) #### [` SpanStream `]() inline SpanStream(const std::vector<uint8\_t> &data) #### [` clone `]() inline std::unique\_ptr<[SpanStream]( "LIEF::SpanStream")> clone() const #### [` SpanStream `]() SpanStream() = delete #### [` SpanStream `]() SpanStream(const [SpanStream]( "LIEF::SpanStream::SpanStream") &other) = default #### [` operator= `]() [SpanStream]( "LIEF::SpanStream") &operator=(const [SpanStream]( "LIEF::SpanStream") &other) = default #### [` SpanStream `]() SpanStream([SpanStream]( "LIEF::SpanStream::SpanStream") &&other) noexcept = default #### [` operator= `]() [SpanStream]( "LIEF::SpanStream") &operator=([SpanStream]( "LIEF::SpanStream") &&other) noexcept = default #### [` size `]() inline virtual uint64\_t size() const override #### [` p `]() inline virtual const uint8\_t \*p() const override #### [` start `]() inline virtual const uint8\_t \*start() const override #### [` end `]() inline virtual const uint8\_t \*end() const override #### [` content `]() inline std::vector<uint8\_t> content() const #### [` slice `]() inline [result]( "LIEF::result")<[SpanStream]( "LIEF::SpanStream")> slice(size\_t offset, size\_t size) const #### [` slice `]() inline [result]( "LIEF::result")<[SpanStream]( "LIEF::SpanStream")> slice(size\_t offset) const #### [` to_vector `]() std::unique\_ptr<[VectorStream]( "LIEF::VectorStream")> to\_vector() const #### [` ~SpanStream `]() ~SpanStream() override = default #### [` end `]() inline virtual uint8\_t \*end() #### [` p `]() inline virtual uint8\_t \*p() #### [` start `]() inline virtual uint8\_t \*start() Public Static Functions #### [` from_vector `]() static inline [result]( "LIEF::result")<[SpanStream]( "LIEF::SpanStream")> from\_vector(const std::vector<uint8\_t> &data) #### [` Nfrom_array `]() template<size\_t N> static inline [result]( "LIEF::result")<[SpanStream]( "LIEF::SpanStream")> from\_array(const std::array<uint8\_t, [N]( "LIEF::SpanStream::from_array::N")> &data) #### [` classof `]() static inline bool classof(const [BinaryStream]( "LIEF::BinaryStream") &stream) ### [` VectorStream `]() class VectorStream : public LIEF::[BinaryStream]( "LIEF::BinaryStream") Public Functions #### [` VectorStream `]() inline VectorStream(std::vector<uint8\_t> data) #### [` VectorStream `]() VectorStream() = delete #### [` VectorStream `]() VectorStream(const [VectorStream]( "LIEF::VectorStream::VectorStream")&) = delete #### [` operator= `]() [VectorStream]( "LIEF::VectorStream") &operator=(const [VectorStream]( "LIEF::VectorStream")&) = delete #### [` VectorStream `]() VectorStream([VectorStream]( "LIEF::VectorStream::VectorStream") &&other) noexcept = default #### [` operator= `]() [VectorStream]( "LIEF::VectorStream") &operator=([VectorStream]( "LIEF::VectorStream") &&other) noexcept = default #### [` size `]() inline virtual uint64\_t size() const override #### [` content `]() inline const std::vector<uint8\_t> &content() const #### [` move_content `]() inline std::vector<uint8\_t> &&move\_content() #### [` p `]() inline virtual const uint8\_t \*p() const override #### [` start `]() inline virtual const uint8\_t \*start() const override #### [` end `]() inline virtual const uint8\_t \*end() const override #### [` slice `]() std::unique\_ptr<[SpanStream]( "LIEF::SpanStream")> slice(uint32\_t offset, size\_t size) const #### [` slice `]() std::unique\_ptr<[SpanStream]( "LIEF::SpanStream")> slice(uint32\_t offset) const #### [` end `]() inline virtual uint8\_t \*end() #### [` p `]() inline virtual uint8\_t \*p() #### [` start `]() inline virtual uint8\_t \*start() Public Static Functions #### [` from_file `]() static [result]( "LIEF::result")<[VectorStream]( "LIEF::VectorStream")> from\_file(std::string\_view file) #### [` classof `]() static inline bool classof(const [BinaryStream]( "LIEF::BinaryStream") &stream) ### [` MemoryStream `]() class MemoryStream : public LIEF::[BinaryStream]( "LIEF::BinaryStream") Public Functions #### [` MemoryStream `]() MemoryStream() = delete #### [` MemoryStream `]() MemoryStream(uintptr\_t base\_address) #### [` MemoryStream `]() inline MemoryStream(uintptr\_t base\_address, uint64\_t size) #### [` MemoryStream `]() MemoryStream(const [MemoryStream]( "LIEF::MemoryStream::MemoryStream")&) = delete #### [` operator= `]() [MemoryStream]( "LIEF::MemoryStream") &operator=(const [MemoryStream]( "LIEF::MemoryStream")&) = delete #### [` MemoryStream `]() MemoryStream([MemoryStream]( "LIEF::MemoryStream::MemoryStream")&&) noexcept = default #### [` operator= `]() [MemoryStream]( "LIEF::MemoryStream") &operator=([MemoryStream]( "LIEF::MemoryStream")&&) noexcept = default #### [` base_address `]() inline uintptr\_t base\_address() const #### [` p `]() inline virtual const uint8\_t \*p() const override #### [` start `]() inline virtual const uint8\_t \*start() const override #### [` end `]() inline virtual const uint8\_t \*end() const override #### [` binary `]() inline [Binary]( "LIEF::Binary") \*binary() #### [` size `]() inline virtual uint64\_t size() const override #### [` bind_binary `]() inline virtual bool bind\_binary([Binary]( "LIEF::Binary") &bin) override #### [` ~MemoryStream `]() ~MemoryStream() override = default #### [` end `]() inline virtual uint8\_t \*end() #### [` p `]() inline virtual uint8\_t \*p() #### [` start `]() inline virtual uint8\_t \*start() Public Static Functions #### [` classof `]() static inline bool classof(const [BinaryStream]( "LIEF::BinaryStream") &stream) --- documentID: "c10f09fce52a0c164dd8375d680a57107c5be62156543e7de81185ba40013ec7" docname: "api/error_handling/index" title: "Error Handling - LIEF Documentation" description: "Error Handling reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/api/error_handling/index.html" markdownURL: "https://lief.re/doc/latest/api/error_handling/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "24e460caaee932038c92deb9e36615861780167d32d8b64c07a1bb95f8bc34f3" --- # [Error Handling]() ## [Introduction]() LIEF manages errors using: 1. Exceptions (deprecated and removed since LIEF 0.13.0) 2. [std::expected (tl::expected)]() It turns out that using C++ exceptions (and RTTI) was not the best design choice, as LIEF, as a library, can be used in a `-fno-exceptions` context. Consequently, we moved to a mechanism based on the `ResultOrError` idiom. This idiom is similar to those found in LLVM with [llvm::ErrorOr]() and in Rust with [std::result](). LIEF uses a std::expected-like interface to handle errors. Since this interface is only available in C++23, we rely on [TartanLlama/expected](), which provides this interface for C++11/C++17. Functions using this idiom return a [`LIEF::result`]( "LIEF::result"), which wraps either the successful result or an error. The user can process this result as follows: ```cpp result pe_type = PE::get_type("/tmp/NotPE.elf"); if (pe_type) { PE_TYPE effective_type = pe_type.value(); } else { lief_errors err = as_lief_err(pe_type); } ``` In the case of Python, we leverage the *dynamic* features of the language to return either the expected value or an error if the function fails. For instance, in previous versions of [`lief.PE.get_type()`]( "lief.PE.get_type"), the implementation raised an exception to inform the user: ```python try: pe_type = lief.PE.get_type("/tmp/NotPE.elf") # If it does not fail, pe_type handles a lief.PE.PE_TYPE object except Exception as e: print(f"Error: {e}") ``` With the new implementation that relies on the `ResultOrError` idiom, the function returns the [`lief.PE.PE_TYPE`]( "lief.PE.PE_TYPE") value if everything is correct, and returns a [`lief.lief_errors`]( "lief.lief_errors") in case of a processing error. The user can handle this new interface by using the `isinstance()` function or by comparing the value with a [`lief.lief_errors`]( "lief.lief_errors") attribute: ```python pe_type = lief.PE.get_type("/tmp/NotPE.elf") if pe_type == lief.lief_errors.file_error: print("File error") elif isinstance(pe_type, lief.lief_errors): print("Another kind of error") else: print(f"No error, type is: {pe_type}") ``` ## [API]() ### [C++]() #### [` Tresult `]() template<typename T> class result : public tl::expected<[T]( "LIEF::result::T"), [lief\_errors]( "lief_errors")> Wrapper that contains an Object (`T`) or an error. The tl/expected implementation exposes the method `value()` to access the underlying object (if no error) Typical usage is: ```cpp result intval = my_function(); if (intval) { int val = intval.value(); } else { // There is an error std::cout << get_error(intval).message() << "\n"; } ``` See [https://tl.tartanllama.xyz/en/latest/api/expected.html]() for more details Public Types ##### [` ExpectedType `]() using ExpectedType = [T]( "LIEF::result::T") Public Functions ##### [` result `]() inline result(tl::expected<[T]( "LIEF::result::T"), [lief\_errors]( "lief_errors")> e) #### [` TLIEF::as_lief_err `]() template<class T> [lief\_errors]( "lief_errors") LIEF::as\_lief\_err([result]( "LIEF::result")<[T]( "LIEF::as_lief_err::T")> &err) Return the [lief\_errors]() when the provided `result` is an error. #### [` lief_errors `]() enum class lief\_errors : uint32\_t LIEF error codes definition. *Values:* ##### [` read_error `]() enumerator read\_error = 1 ##### [` not_found `]() enumerator not\_found ##### [` not_implemented `]() enumerator not\_implemented ##### [` not_supported `]() enumerator not\_supported ##### [` corrupted `]() enumerator corrupted ##### [` conversion_error `]() enumerator conversion\_error ##### [` read_out_of_bound `]() enumerator read\_out\_of\_bound ##### [` asn1_bad_tag `]() enumerator asn1\_bad\_tag ##### [` file_error `]() enumerator file\_error ##### [` file_format_error `]() enumerator file\_format\_error ##### [` parsing_error `]() enumerator parsing\_error ##### [` build_error `]() enumerator build\_error ##### [` data_too_large `]() enumerator data\_too\_large ##### [` require_extended_version `]() enumerator require\_extended\_version ##### [` inconsistent `]() enumerator inconsistent ##### [` runtime_error `]() enumerator runtime\_error #### [` ok_error_t `]() class ok\_error\_t : public LIEF::[result]( "LIEF::result")<[ok\_t]( "LIEF::ok_t")> Opaque structure that is used by LIEF to avoid writing `result f(...)`. Instead, it makes the output explicit such as: ```cpp ok_error_t process() { if (fail) { return make_error_code(...); } return ok(); } ``` #### [` LIEF::ok `]() inline [ok\_t]( "LIEF::ok_t") LIEF::ok() Return success for function with return type [ok\_error\_t](). #### [` ok_t `]() struct ok\_t Opaque structure used by [ok\_error\_t](). ### [Python]() #### [` lief.lief_errors `]() class lief.lief\_errors(*\*values*) Bases: `Enum` Enum class which represents an error generated by LIEF’s functions ##### [` asn1_bad_tag `]() asn1\_bad\_tag = 8 ##### [` build_error `]() build\_error = 12 ##### [` conversion_error `]() conversion\_error = 6 ##### [` corrupted `]() corrupted = 5 ##### [` data_too_large `]() data\_too\_large = 13 ##### [` file_error `]() file\_error = 9 ##### [` file_format_error `]() file\_format\_error = 10 ##### [` inconsistent `]() inconsistent = 15 ##### [` not_found `]() not\_found = 2 ##### [` not_implemented `]() not\_implemented = 3 ##### [` not_supported `]() not\_supported = 4 ##### [` parsing_error `]() parsing\_error = 11 ##### [` read_error `]() read\_error = 1 ##### [` read_out_of_bound `]() read\_out\_of\_bound = 7 ##### [` require_extended_version `]() require\_extended\_version = 14 ##### [` runtime_error `]() runtime\_error = 16 #### [` lief.ok_t `]() class lief.ok\_t Bases: `object` Opaque value returned when a **void** function is executed successfully. #### [` lief.ok_error_t `]() class lief.ok\_error\_t Bases: `object` Return either: [`ok_t`]( "lief.ok_t") (success) or [`lief_errors`]( "lief.lief_errors") (error) ##### [` error `]() property error → [lief.lief\_errors]( "lief.lief_errors") ##### [` is_error `]() property is\_error → bool ##### [` is_value `]() property is\_value → bool ##### [` value `]() property value → [lief.ok\_t]( "lief.ok_t") --- documentID: "f650521a704e8a834c98e634f3d3b98668d79902fe83f626ec34ecff083d19dd" docname: "api/logging/index" title: "Logging - LIEF Documentation" description: "This section details the API for interacting with LIEF’s logging engine." canonical: "https://lief.re/doc/latest/api/logging/index.html" markdownURL: "https://lief.re/doc/latest/api/logging/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "5a56f6df33e0d2db8e7f1f1ea3f09614cd1ded39fb2590e66370797b07b3c229" --- # [Logging]() This section details the API for interacting with LIEF’s logging engine. LIEF uses [spdlog]() for its logging mechanism, and this API provides an abstraction over that implementation. ## [API]() ### [C++]() #### [` LIEF::logging::disable `]() void LIEF::logging::disable() Globally disable the logging module. #### [` LIEF::logging::enable `]() void LIEF::logging::enable() Globally enable the logging module. #### [` LIEF::logging::set_level `]() void LIEF::logging::set\_level([Level]( "LIEF::logging::Level") level) Change the logging level (**hierarchical**). #### [` LIEF::logging::set_path `]() void LIEF::logging::set\_path(const std::string &path) Change the logger to a file-based logging and set its path. #### [` ArgsLIEF::logging::log `]() template<typename ...Args> void LIEF::logging::log([Level]( "LIEF::logging::Level") level, const std::string &fmt, const [Args]( "LIEF::logging::log::Args")&... args) #### [` LIEF::logging::log `]() void LIEF::logging::log([Level]( "LIEF::logging::Level") level, const std::string &fmt, const std::vector<std::string> &args) #### [` LIEF::logging::log `]() void LIEF::logging::log([Level]( "LIEF::logging::Level") level, const std::string &msg) Log a message with the LIEF’s logger. #### [` LIEF::logging::reset `]() void LIEF::logging::reset() #### [` LIEF::logging::Level `]() enum class LIEF::logging::Level : uint32\_t **Hierarchical** logging level From a given level set, all levels below this level are enabled For example, if [Level::Info]() is enabled then [Level::Warn](), [Level::Err]() are also enabled *Values:* ##### [` Off `]() enumerator Off = 0 ##### [` Trace `]() enumerator Trace ##### [` Debug `]() enumerator Debug ##### [` Info `]() enumerator Info ##### [` Warn `]() enumerator Warn ##### [` Err `]() enumerator Err ##### [` Critical `]() enumerator Critical #### [` Scoped `]() class Scoped Public Functions ##### [` Scoped `]() Scoped(const [Scoped]( "LIEF::logging::Scoped::Scoped")&) = delete ##### [` operator= `]() [Scoped]( "LIEF::logging::Scoped") &operator=(const [Scoped]( "LIEF::logging::Scoped")&) = delete ##### [` Scoped `]() Scoped([Scoped]( "LIEF::logging::Scoped::Scoped")&&) = delete ##### [` operator= `]() [Scoped]( "LIEF::logging::Scoped") &operator=([Scoped]( "LIEF::logging::Scoped")&&) = delete ##### [` Scoped `]() inline explicit Scoped([Level]( "LIEF::logging::Level") level) ##### [` Scoped `]() inline explicit Scoped([Level]( "LIEF::logging::Level") level, std::string name) ##### [` set_level `]() inline const [Scoped]( "LIEF::logging::Scoped") &set\_level([Level]( "LIEF::logging::Level") lvl) const ##### [` reset `]() inline void reset() ##### [` ~Scoped `]() inline ~Scoped() ## [Example]() ```cpp // Set global level to Err LIEF::logging::set_level(LIEF::logging::Level::Err); { // Temporarily set global level to Debug (RAII) LIEF::logging::Scoped _(LIEF::logging::Level::Debug); LIEF::logging::log(LIEF::logging::Level::Debug, "This is a debug message"); } ``` ### [Python]() #### [` lief.logging.set_level `]() lief.logging.set\_level(*level: [lief.logging.Level]( "lief.logging.Level")*) → None Change logging level #### [` lief.logging.enable `]() lief.logging.enable() → None Enable the logger globally #### [` lief.logging.disable `]() lief.logging.disable() → None Disable the logger globally #### [` lief.logging.set_path `]() lief.logging.set\_path(*path: str | os.PathLike*) → None Change the logger as a file-base logging and set its path #### [` lief.logging.log `]() lief.logging.log(*level: [lief.logging.Level]( "lief.logging.Level")*, *msg: str*) → None Log a message with the LIEF’s logger #### [` lief.logging.level_scopelief.logging.level_scope `]() lief.logging.level\_scope(*name: str*, *lvl: [Level]( "lief.logging.Level")*) → [Scoped]( "lief.logging.Scoped") **lief.logging.level\_scope(*name: str*, *lvl: [Level]( "lief.logging.Level")*) → [Scoped]( "lief.logging.Scoped")** #### [` lief.logging.Scoped `]() class lief.logging.Scoped Bases: `object` #### [` lief.logging.Level `]() class lief.logging.Level(*\*values*) Bases: `Enum` ##### [` Critical `]() Critical = 6 ##### [` Debug `]() Debug = 2 ##### [` Err `]() Err = 5 ##### [` Info `]() Info = 3 ##### [` Off `]() Off = 0 ##### [` Trace `]() Trace = 1 ##### [` Warn `]() Warn = 4 ## [Example]() ```python # Set global level to Err lief.logging.set_level(lief.logging.Level.Err) # Temporarily set global level to Debug with lief.logging.level_scope(lief.logging.Level.Debug): lief.logging.log(lief.logging.Level.Debug, "This is a debug message") ``` ### [Rust]() - [`lief::logging::disable`]() - [`lief::logging::enable`]() - [`lief::logging::set_level`]() - [`lief::logging::set_path`]() - [`lief::logging::log`]() - [`lief::logging::reset`]() - [`lief::logging::Level`]() - [`lief::logging::Scoped`]() ## [Example]() ```rust // Set global level to Err lief::logging::set_level(lief::logging::Level::Err); { // Temporarily set global level to Debug (RAII) let _scoped = lief::logging::Scoped::new(lief::logging::Level::Debug); lief::logging::log(lief::logging::Level::Debug, "This is a debug message"); } ``` --- documentID: "db6231dac8cfd495b1c205b0e8a32bb2ca1ade49051a78b165cdde3b8e0eb307" docname: "api/rust/index" title: "Rust - LIEF Documentation" description: "Rust reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/api/rust/index.html" markdownURL: "https://lief.re/doc/latest/api/rust/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "d3429e99afcbc26a1a56ff50f95e262635b44627aa0b62ad32230ea262cc8bf2" --- # [Rust]() > **Note** > > The API is documented here [https://lief.re/doc/stable/rust/lief]() and the nightly doc is here: [https://lief-rs.s3.fr-par.scw.cloud/doc/latest/lief/index.html](). ```toml [package] name = "my-awesome-project" version = "0.0.1" edition = "2024" [dependencies] lief = { git = "https://github.com/lief-project/LIEF", branch = "main" } ``` > **Warning** > > LIEF rust bindings are not on `docs.rs` because of network restrictions: [https://github.com/rust-lang/docs.rs/issues/2563]() ## [Precompiled FFI Bindings]() LIEF’s Rust bindings are split into two parts: 1. `lief`: the high-level, idiomatic Rust API. 2. `lief-ffi`: the low-level FFI API based on [cxx](). Two additional crates support the build process: - `lief-build`: build-script helper used by `lief-ffi` to fetch the pre-compiled artifacts and emit the `cargo` link directives. - `lief-ffigen`: standalone CLI that generates the C++ side of the `cxx` bridge from the `#[cxx::bridge]` modules declared in `lief-ffi`. Building `lief-ffi` requires generating the C++ bridge files with `lief-ffigen` and then compiling them alongside `libLIEF`. Both steps can take several minutes. To save time, LIEF provides pre-compiled versions of these artifacts, which are downloaded from GitHub (for releases) or an S3 bucket (for nightly builds). ### [LIEF\_RUST\_PRECOMPILED]() If you need to avoid downloading these pre-compiled files, set `LIEF_RUST_PRECOMPILED` to point to the directory that contains these files: ```text /home/romain/out └── lib     ├── libLIEF.a     └── liblief-sys.a 1 directory, 2 files LIEF_RUST_PRECOMPILED=/home/romain/out cargo build [...] ``` This variable can also be used when building in **offline** mode (e.g., `cargo --offline`). As of now, the following targets are supported with pre-compilation: | Target | Description | | --- | --- | | `x86_64-unknown-linux-gnu` | Regular Linux x86-64 (Ubuntu 21.10+, Debian 12+, …) | | `i686-unknown-linux-gnu` | Regular Linux i686 (Ubuntu 19.10, Debian 10, …) | | `x86_64-unknown-linux-musl` | Musl target that allows full static build | | `i686-unknown-linux-musl` | Linux i686 with Musl | | `aarch64-unknown-linux-gnu` | Linux aarch64 (Debian 12+) | | `aarch64-unknown-linux-musl` | Linux aarch64 with Musl | | `aarch64-linux-android` | Android aarch64 (API 30+) | | `x86_64-linux-android` | Android x86\_64 (API 30+) | | `x86_64-apple-darwin` | macOS 11+ x86-64 | | `aarch64-apple-darwin` | macOS 11+ arm64 (Apple Silicon) | | `aarch64-apple-ios` | iOS 12+ | | `x86_64-pc-windows-msvc[MT]` | Regular Windows x86-64 (static UCRT runtime) | | `x86_64-pc-windows-msvc[MD]` | Regular Windows x86-64 (dynamic UCRT runtime `.dll`) | | `aarch64-pc-windows-msvc[MT]` | Regular Windows arm64 (static UCRT runtime) | | `aarch64-pc-windows-msvc[MD]` | Regular Windows arm64 (dynamic UCRT runtime `.dll`) | ### [Precompilation]() The assets of the pre-compiled output are: 1. LIEF static library: `LIEF.{a,lib}` 2. `liefsys.{a,lib}`: bridge between C++ and Rust The LIEF static library must be compiled as described in the [Compilation]() section using the CMake option: `-DLIEF_RUST_API=ON`. `liefsys.{a,lib}` is built in two steps. First, generate the C++ bridge files with `lief-ffigen`: ```console $ cargo build [--profile release] -p lief-ffigen $ target/{release,debug}/lief-ffigen \ --output-dir cxx-bridge/ \ --source-dir lief-ffi/ ``` Then compile them as a regular CMake-based library: ```console $ cmake -GNinja \ -S api/rust/cmake-ffi/ \ -B cxx-bridge-build/ \ -DLIEF_DIR=$INSTALL_DIR/lib/cmake/LIEF \ -DLIEF_RUST_FFI_SRC=cxx-bridge/ \ -DCMAKE_INSTALL_PREFIX=cxx-bridge-out/ $ ninja -C cxx-bridge-build/ ``` --- documentID: "6924d829b0dd6852baf34b6441ea5606133b947c530c38bd5c3238311b2a5b28" docname: "api/utilities/index" title: "Utilities - LIEF Documentation" description: "Utilities. LIEF exposes a demangling API for the following formats:" canonical: "https://lief.re/doc/latest/api/utilities/index.html" markdownURL: "https://lief.re/doc/latest/api/utilities/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "70b78fc27af63d06ef9f4f404a4e9c0cf05b647854f0fcb5476a00f59afe76d1" --- # [Utilities]() ## [Demangling]() LIEF exposes a demangling API for the following formats: **MSVC** **Input** ```python lief.demangle("?h@@YAXH@Z") ``` **Result** ```text void __cdecl h(int) ``` **Rust** **Input** ```python lief.demangle("_RNvCskwGfYPst2Cb_3foo16example_function") ``` **Result** ```text foo::example_function ``` **Itanium C++** **Input** ```python lief.demangle("_ZTSN3lld13SpecificAllocINS_4coff9TpiSourceEEE") ``` **Result** ```text typeinfo name for lld::SpecificAlloc ``` **Swift/Obj-C** **Input** ```python lief.demangle("_$s10Foundation4DataV15_RepresentationON") ``` **Result** ```text type metadata for Foundation.Data._Representation ``` ### [` LIEF::demangle `]() [result]( "LIEF::result")<std::string> LIEF::demangle(std::string\_view mangled) Demangle the given input. This function only works with the extended version of LIEF ### [` lief.demangle `]() lief.demangle(*mangled: str*) → str | None Demangle the given input. > **Warning** > > This function only works with the extended version of LIEF [`lief::demangle`]() ## [Extended Version]() To check if the current build is an [extended]() version, you can use: ### [` LIEF::is_extended `]() bool LIEF::is\_extended() Whether this version of LIEF includes extended features. ### [` lief._lief.__extended__ `]() lief.\_lief.\_\_extended\_\_ = False Returns True when the argument is true, False otherwise. The builtins True and False are the only two instances of the class bool. The class bool is a subclass of the class int, and cannot be subclassed. [`lief::is_extended`]() In C++, you can also check if `LIEF_EXTENDED` is defined: ```cpp #include #if defined(LIEF_EXTENDED) // Extended version #else // Regular version #endif ``` To get details about the version of the current extended build: ### [` LIEF::extended_version_info `]() std::string LIEF::extended\_version\_info() Details about the extended version. ## [Android Platform]() ### [` lief.Android.code_name `]() lief.Android.code\_name(*version: [lief.Android.ANDROID\_VERSIONS]( "lief.Android.ANDROID_VERSIONS")*) → str Return the Android code associated with a [`ANDROID_VERSIONS`]( "lief.Android.ANDROID_VERSIONS"). For example: `Nougat` ### [` lief.Android.version_string `]() lief.Android.version\_string(*version: [lief.Android.ANDROID\_VERSIONS]( "lief.Android.ANDROID_VERSIONS")*) → str Return the [`ANDROID_VERSIONS`]( "lief.Android.ANDROID_VERSIONS") as a string. For example: `7.0.1` ### [` lief.Android.ANDROID_VERSIONS `]() class lief.Android.ANDROID\_VERSIONS(*\*values*) Bases: `Enum` #### [` UNKNOWN `]() UNKNOWN = 0 #### [` VERSION_601 `]() VERSION\_601 = 1 #### [` VERSION_700 `]() VERSION\_700 = 2 #### [` VERSION_710 `]() VERSION\_710 = 3 #### [` VERSION_712 `]() VERSION\_712 = 4 #### [` VERSION_800 `]() VERSION\_800 = 5 #### [` VERSION_810 `]() VERSION\_810 = 6 #### [` VERSION_900 `]() VERSION\_900 = 7 #### [` from_value `]() from\_value(*arg: int*) → [lief.Android.ANDROID\_VERSIONS]( "lief.Android.ANDROID_VERSIONS") = <nanobind.nb\_func object> ### [` LIEF::Android::code_name `]() const char \*LIEF::Android::code\_name([ANDROID\_VERSIONS]( "LIEF::Android::ANDROID_VERSIONS") version) ### [` LIEF::Android::version_string `]() const char \*LIEF::Android::version\_string([ANDROID\_VERSIONS]( "LIEF::Android::ANDROID_VERSIONS") version) ### [` LIEF::Android::ANDROID_VERSIONS `]() enum class LIEF::Android::ANDROID\_VERSIONS *Values:* #### [` VERSION_UNKNOWN `]() enumerator VERSION\_UNKNOWN = 0 #### [` VERSION_601 `]() enumerator VERSION\_601 = 1 #### [` VERSION_700 `]() enumerator VERSION\_700 = 2 #### [` VERSION_710 `]() enumerator VERSION\_710 = 3 #### [` VERSION_712 `]() enumerator VERSION\_712 = 4 #### [` VERSION_800 `]() enumerator VERSION\_800 = 5 #### [` VERSION_810 `]() enumerator VERSION\_810 = 6 #### [` VERSION_900 `]() enumerator VERSION\_900 = 7 ## [Python Leaks]() ### [` lief.disable_leak_warning `]() lief.disable\_leak\_warning() → None Disable nanobind warnings about leaked objects. For instance: ```text nanobind: leaked 45 instances! nanobind: leaked 25 types! - leaked type "lief._lief.FORMATS" - ... skipped remainder nanobind: leaked 201 functions! - leaked function "" - leaked function "export_symbol" - ... skipped remainder nanobind: this is likely caused by a reference counting issue in the binding code. ``` ## [Helpers]() The `lief.dump()` utility can be used to pretty-print a buffer. For example: ```python pe = lief.PE.parse("some.exe") assert isinstance(pe, lief.PE.Binary) text = pe.get_section(".text") assert isinstance(pe, lief.PE.Section) print(lief.dump(text.content)) ``` ### [` lief.dumplief.dump `]() lief.dump(*\*args*) → str **lief.dump(*buffer: bytes*, *title: str = ''*, *prefix: str = ''*, *limit: int = 0*) → str** Hexdump the provided buffer: ```text +---------------------------------------------------------------------+ | 88 56 05 00 00 00 00 00 00 00 00 00 22 58 05 00 | .V.........."X.. | | 10 71 02 00 78 55 05 00 00 00 00 00 00 00 00 00 | .q..xU.......... | | 68 5c 05 00 00 70 02 00 00 00 00 00 00 00 00 00 | h\...p.......... | | 00 00 00 00 00 00 00 00 00 00 00 00 | ............ | +---------------------------------------------------------------------+ ``` ### [` LIEF::dump `]() inline std::string LIEF::dump(const std::vector<uint8\_t> &data, const std::string &title = "", const std::string &prefix = "", size\_t limit = 0) ### [` LIEF::dump `]() std::string LIEF::dump(const uint8\_t \*buffer, size\_t size, const std::string &title = "", const std::string &prefix = "", size\_t limit = 0) Hexdump the provided buffer. For instance: ```text +---------------------------------------------------------------------+ | 88 56 05 00 00 00 00 00 00 00 00 00 22 58 05 00 | .V.........."X.. | | 10 71 02 00 78 55 05 00 00 00 00 00 00 00 00 00 | .q..xU.......... | | 68 5c 05 00 00 70 02 00 00 00 00 00 00 00 00 00 | h\...p.......... | | 00 00 00 00 00 00 00 00 00 00 00 00 | ............ | +---------------------------------------------------------------------+ ``` ### [` LIEF::dump `]() inline std::string LIEF::dump(span<const uint8\_t> data, const std::string &title = "", const std::string &prefix = "", size\_t limit = 0) - [`lief::dump`]() - [`lief::dump_with_limit`]() --- documentID: "eed632b369270a2ddd5a79c4c2c3c0d8219b00a8f249614e9bf89f5316126282" docname: "changelog" title: "Changelog - LIEF Documentation" description: "Changelog. This release contains several security fixes:" canonical: "https://lief.re/doc/latest/changelog.html" markdownURL: "https://lief.re/doc/latest/changelog.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "b5b84d2868da1323f9995610f5af2ca58e2574b8731e9fa5ef9470cd1ecb9ce8" --- # [Changelog]() ## [2.0.0 - Not Released Yet]() > **Breaking Changes** > > - **C++17 Migration**: LIEF public headers, public API, and STL have been bumped from C++11 to **C++17**. > - **C API Removal**: The legacy C API has been completely removed. > - **Logging Level Renaming**: `lief.logging.Level` ( [`lief::logging::Level`]() ; [`lief.logging.Level`]() ; [`LIEF::logging::Level`]() ) and its enumerators are now written in `CamelCase` **Assembly:** - Add API to inspect and rewrite the `LOCK` prefix of x86 instructions: - `lief.assembly.x86.Instruction.has_lock_prefix()` ( [`lief::assembly::x86::Instruction::has_lock_prefix`]() ; [`lief.assembly.x86.Instruction.has_lock_prefix`]() ; [`LIEF::assembly::x86::Instruction::has_lock_prefix()`]() ) - `lief.assembly.x86.Instruction.is_lockable()` ( [`lief::assembly::x86::Instruction::is_lockable`]() ; [`lief.assembly.x86.Instruction.is_lockable`]() ; [`LIEF::assembly::x86::Instruction::is_lockable()`]() ) - `lief.assembly.x86.Instruction.is_atomic()` ( [`lief::assembly::x86::Instruction::is_atomic`]() ; [`lief.assembly.x86.Instruction.is_atomic`]() ; [`LIEF::assembly::x86::Instruction::is_atomic()`]() ) - `lief.assembly.x86.Instruction.lock()` ( [`lief::assembly::x86::Instruction::lock`]() ; [`lief.assembly.x86.Instruction.lock()`]() ; [`LIEF::assembly::x86::Instruction::lock()`]() ) - `lief.assembly.x86.Instruction.unlock()` ( [`lief::assembly::x86::Instruction::unlock`]() ; [`lief.assembly.x86.Instruction.unlock()`]() ; [`LIEF::assembly::x86::Instruction::unlock()`]() ) **ELF:** - Fix the layout of the segments added by LIEF for the architectures that can use pages larger than 4K ([#1366]()) - Fix the modification of binaries that have already been modified by LIEF. The segment table was relocated a second time which, for the non-PIE binaries, shifted the sections without shifting the segments nor the dynamic entries. It resulted in a `DT_STRTAB` that was no longer pointing to `.dynstr` (i.e. garbage `DT_NEEDED`/`DT_RUNPATH` names) and in a `PT_PHDR` that was not wrapped by a `PT_LOAD` segment ([#1366]()). - `lief.ELF.check_layout()` ( [`lief.ELF.check_layout()`]() ; [`LIEF::ELF::check_layout()`]() ; [`lief::elf::check_layout`]() ) now reports the `PT_LOAD` segments that can’t be mapped independently because they share the same page. It also report mismatch between `.dynstr` virtual address and `DT_STRTAB`. - Add support for the MIPS n64 relocation encoding ([#1367]() by [plusls]()). - Add `lief.ELF.Header.is_mips_n64` ( [`lief::elf::Header::is_mips_n64`]() ; [`lief.ELF.Header.is_mips_n64`]() ; [`LIEF::ELF::Header::is_mips_n64()`]() ) to check whether a binary uses this encoding. - `lief.ELF.Relocation.resolve()` ( [`lief::elf::Relocation::resolve`]() ; [`lief::elf::Relocation::resolve_with_base_address`]() ; [`lief.ELF.Relocation.resolve()`]() ; [`LIEF::ELF::Relocation::resolve()`]() ) now supports `R_MIPS_REL32`. **COFF:** - Add `lief.COFF.Binary.get_section()` ( [`lief::coff::Binary::section_by_name`]() ; [`lief.COFF.Binary.get_section()`]() ; [`LIEF::COFF::Binary::get_section()`]() ) to look up a section by its name. Names that are stored in the COFF string table (i.e. longer than 8 bytes) can be resolved either from their regular value or from their `/` placeholder: ```python import lief coff = lief.COFF.parse("dwarf.obj") section = coff.get_section(".debug_rnglists") section.name # '/18' section.coff_string.string # '.debug_rnglists' ``` **Runtime:** - Add `lief.runtime.Memory.mmap_hint()` ( [`lief::runtime::Memory::mmap_hint`]() ; [`lief.runtime.Memory.mmap_hint()`]() ; [`LIEF::runtime::Memory::mmap_hint()`]() ) to allocate memory close to a given address. - Add `lief.runtime.MemoryLayout` ( [`lief.runtime.MemoryLayout`]() ; [`LIEF::runtime::MemoryLayout`]() ) to inspect the memory layout of the current process. `lief.runtime.memory_layout()` ( [`lief::runtime::memory_layout`]() ; [`lief.runtime.memory_layout()`]() ; [`LIEF::runtime::memory_layout()`]() ) iterates over the mapped `lief.runtime.MemoryLayout.Region` ( [`lief::runtime::Region`]() ; [`lief.runtime.MemoryLayout.Region`]() ; [`LIEF::runtime::MemoryLayout::Region`]() ) ([documentation]()): ```python import lief for region in lief.runtime.memory_layout(): print(f"{region.addr:#014x}-{region.end_addr:#014x} {region.name}") ``` **C++:** - The parsers now take the file path as a `std::string_view` and they also accept a `std::filesystem::path`: ```cpp #include #include std::filesystem::path path = "/bin/ls"; std::unique_ptr elf = LIEF::ELF::Parser::parse(path); ``` **Dependencies:** - Update nanobind to version `3.0.1` **Python:** - Python 3.9 is no longer supported. nanobind 3 requires Python 3.10 or newer. ## [1.0.0 - July 12th, 2026]() > **Runtime** > > LIEF now provides runtime features as described here: [Runtime]() **BinaryNinja:** - Add [Android JNI Analyzer]() - The DWARF import plugin now supports comments **Ghidra:** - Add support for generating DWARF from firmware or binaries without a precise format or architecture ([#1249]()) **DWARF:** - Add support for accessing the bit size of bit-field declarations ([#1265]()) - Add support for accessing Enum entries: `lief.dwarf.types.Enum.entries()` ( [`lief::dwarf::types::Enum::entries`]() ; [`LIEF::dwarf::types::Enum::entries()`]() ; [`lief.dwarf.types.Enum.entries`]() ) - Add support for reading from or assigning a register to a function parameter - Add support for reading from or assigning a description (`DW_AT_description`) to a `lief.dwarf.Function` ( [`lief::dwarf::Function`]() ; [`lief.dwarf.Function`]() ; [`LIEF::dwarf::Function`]() ), `lief.dwarf.Variable` ( [`lief::dwarf::Variable`]() ; [`lief.dwarf.Variable`]() ; [`LIEF::dwarf::Variable`]() ), or `lief.dwarf.LexicalBlock` ( [`lief::dwarf::LexicalBlock`]() ; [`lief.dwarf.LexicalBlock`]() ; [`LIEF::dwarf::LexicalBlock`]() ): - `lief.dwarf.Function.description()` ( [`lief::dwarf::Function::description`]() ; [`LIEF::dwarf::Function::description()`]() ; [`lief.dwarf.Function.description`]() ) - `lief.dwarf.Variable.description()` ( [`lief::dwarf::Variable::description`]() ; [`LIEF::dwarf::Variable::description()`]() ; [`lief.dwarf.Variable.description`]() ) - `lief.dwarf.LexicalBlock.description()` ( [`lief::dwarf::LexicalBlock::description`]() ; [`LIEF::dwarf::LexicalBlock::description()`]() ; [`lief.dwarf.LexicalBlock.description`]() ) - Enable the creation of nested `lief.dwarf.editor.Function.LexicalBlock` ( [`lief::dwarf::editor::function::LexicalBlock`]() ; [`lief.dwarf.editor.Function.LexicalBlock`]() ; [`LIEF::dwarf::editor::Function::LexicalBlock`]() ) - Add support for generating a C/C++ definition for a whole `lief.dwarf.CompilationUnit` ( [`lief::dwarf::CompilationUnit`]() ; [`lief.dwarf.CompilationUnit`]() ; [`LIEF::dwarf::CompilationUnit`]() ) ( `lief.dwarf.CompilationUnit.to_decl()` ( [`lief::dwarf::CompilationUnit::to_decl`]() ; [`lief::dwarf::CompilationUnit::to_decl_with_opt`]() ; [`lief.dwarf.CompilationUnit.to_decl()`]() ; [`LIEF::dwarf::CompilationUnit::to_decl()`]() )). The output of the following `to_decl()` functions can now be configured through the new `lief.DeclOpt` ( [`lief::DeclOpt`]() ; [`lief.DeclOpt`]() ; [`LIEF::DeclOpt`]() ) structure: - `lief.dwarf.Function.to_decl()` ( [`lief::dwarf::Function::to_decl`]() ; [`lief::dwarf::Function::to_decl_with_opt`]() ; [`lief.dwarf.Function.to_decl()`]() ; [`LIEF::dwarf::Function::to_decl()`]() ) - `lief.dwarf.Variable.to_decl()` ( [`lief::dwarf::Variable::to_decl`]() ; [`lief::dwarf::Variable::to_decl_with_opt`]() ; [`lief.dwarf.Variable.to_decl()`]() ; [`LIEF::dwarf::Variable::to_decl()`]() ) - `lief.dwarf.Type.to_decl()` ( [`lief::dwarf::Type::to_decl`]() ; [`lief::dwarf::Type::to_decl_with_opt`]() ; [`lief.dwarf.Type.to_decl()`]() ; [`LIEF::dwarf::Type::to_decl()`]() ) - `lief.dwarf.CompilationUnit.to_decl()` ( [`lief::dwarf::CompilationUnit::to_decl`]() ; [`lief::dwarf::CompilationUnit::to_decl_with_opt`]() ; [`lief.dwarf.CompilationUnit.to_decl()`]() ; [`LIEF::dwarf::CompilationUnit::to_decl()`]() ) ```python import lief dbg = lief.dwarf.load("/bin/with_debug") opt = lief.DeclOpt() opt.is_cpp = True opt.indentation = 4 for cu in dbg.compilation_units: print(cu.to_decl(opt)) ``` **PDB:** - Improve support and the API for `LF_ENUM`: `lief.pdb.types.Enum` ( [`lief::pdb::types::Enum`]() ; [`lief.pdb.types.Enum`]() ; [`LIEF::pdb::types::Enum`]() ) - Improve support and the API for `LF_PROCEDURE`: `lief.pdb.types.Function` ( [`lief::pdb::types::Function`]() ; [`lief.pdb.types.Function`]() ; [`LIEF::pdb::types::Function`]() ) - Improve support and the API for `LF_ARRAY`: `lief.pdb.types.Array` ( [`lief::pdb::types::Array`]() ; [`lief.pdb.types.Array`]() ; [`LIEF::pdb::types::Array`]() ) - Improve support and the API for *simple* types: `lief.pdb.types.Simple` ( [`lief::pdb::types::Simple`]() ; [`lief.pdb.types.Simple`]() ; [`LIEF::pdb::types::Simple`]() ) - Improve support and the API for `LF_ONEMETHOD`: `lief.pdb.types.Method` ( [`lief::pdb::types::Method`]() ; [`lief.pdb.types.Method`]() ; [`LIEF::pdb::types::Method`]() ) - Add support for generating a C/C++ definition for a `lief.pdb.Function` ( [`lief::pdb::Function`]() ; [`lief.pdb.Function`]() ; [`LIEF::pdb::Function`]() ) ( `lief.pdb.Function.to_decl()` ( [`lief::pdb::Function::to_decl`]() ; [`lief::pdb::Function::to_decl_with_opt`]() ; [`lief.pdb.Function.to_decl()`]() ; [`LIEF::pdb::Function::to_decl()`]() )) and a `lief.pdb.CompilationUnit` ( [`lief::pdb::CompilationUnit`]() ; [`lief.pdb.CompilationUnit`]() ; [`LIEF::pdb::CompilationUnit`]() ) ( `lief.pdb.CompilationUnit.to_decl()` ( [`lief::pdb::CompilationUnit::to_decl`]() ; [`lief::pdb::CompilationUnit::to_decl_with_opt`]() ; [`lief.pdb.CompilationUnit.to_decl()`]() ; [`LIEF::pdb::CompilationUnit::to_decl()`]() )), configurable with the new `lief.DeclOpt` ( [`lief::DeclOpt`]() ; [`lief.DeclOpt`]() ; [`LIEF::DeclOpt`]() ) structure. **ELF:** - Add support for `DT_AUXILIARY` tag: `lief.ELF.DynamicEntryAuxiliary` ( [`lief.ELF.DynamicEntryAuxiliary`]() ; [`LIEF::ELF::DynamicEntryAuxiliary`]() ; [`lief::elf::dynamic::Auxiliary`]() ) ([#1159]()). - Add support for `DT_FILTER` tag: `lief.ELF.DynamicEntryFilter` ( [`lief.ELF.DynamicEntryFilter`]() ; [`LIEF::ELF::DynamicEntryFilter`]() ; [`lief::elf::dynamic::Filter`]() ) - Add `lief.ELF.parse_from_dump()` ( [`lief::elf::Binary::parse_from_dump`]() ; [`lief.ELF.parse_from_dump()`]() ; [`LIEF::ELF::Parser::parse_from_dump()`]() ) to parse an ELF binary from a memory dump **COFF:** - Add `lief.COFF.Section.coff_string` ( [`lief::coff::Section::coff_string`]() ; [`lief.COFF.Section.coff_string`]() ; [`LIEF::COFF::Section::coff_string()`]() ) for accessing the full section name when this name does not fit in 8 bytes. **Mach-O:** - Add support for writing big-endian Mach-O binaries ([#1236]()) - Introduce an API for selecting a specific Mach-O binary by architecture from a FAT binary ([#1283]()) - Add `lief.MachO.FatBinary.create()` ( [`lief.MachO.FatBinary.create()`]() ; [`LIEF::MachO::FatBinary::create()`]() ) to create a FAT binary from a list of `lief.MachO.Binary` ( [`lief::macho::Binary`]() ; [`lief.MachO.Binary`]() ; [`LIEF::MachO::Binary`]() ) objects targeting different architectures - Add support for `lief.MachO.ThreadLocalVariables` ( [`lief::macho::ThreadLocalVariables`]() ; [`lief.MachO.ThreadLocalVariables`]() ; [`LIEF::MachO::ThreadLocalVariables`]() ) - Fix an extra byte being written after the thread state of an `LC_UNIXTHREAD`/`LC_THREAD` command, which shifted the following load commands by one byte ([#1344]()) - Add support for editing the runtime tables of the `LC_FUNCTION_VARIANTS` command and committing the changes on write: `lief.MachO.FunctionVariants` ( [`lief::macho::commands::FunctionVariants`]() ; [`lief.MachO.FunctionVariants`]() ; [`LIEF::MachO::FunctionVariants`]() ) - Add a structured parser, editing API and writer for the `LC_FUNCTION_VARIANT_FIXUPS` command: `lief.MachO.FunctionVariantFixups` ( [`lief::macho::commands::FunctionVariantFixups`]() ; [`lief.MachO.FunctionVariantFixups`]() ; [`LIEF::MachO::FunctionVariantFixups`]() ) - Add support for the `LC_LAZY_LOAD_DYLIB_INFO` command: `lief.MachO.LazyLoadDylibInfo` ( [`lief::macho::commands::LazyLoadDylibInfo`]() ; [`lief.MachO.LazyLoadDylibInfo`]() ; [`LIEF::MachO::LazyLoadDylibInfo`]() ) - Add `lief.MachO.parse_from_dump()` ( [`lief::macho::FatBinary::parse_from_dump`]() ; [`lief.MachO.parse_from_dump()`]() ; [`LIEF::MachO::Parser::parse_from_dump()`]() ) to parse a Mach-O binary from a memory dump **PE:** - Add setters for `lief.PE.ImportEntry.iat_value` ( [`lief::pe::import::ImportEntry::iat_value`]() ; [`lief.PE.ImportEntry.iat_value`]() ; [`LIEF::PE::ImportEntry::iat_value()`]() ) and `lief.PE.ImportEntry.ilt_value` ( [`lief::pe::import::ImportEntry::ilt_value`]() ; [`lief.PE.ImportEntry.ilt_value`]() ; [`LIEF::PE::ImportEntry::ilt_value()`]() ) - Add `lief.PE.Binary.offset_to_rva()` ( [`lief::pe::Binary::offset_to_rva`]() ; [`lief.PE.Binary.offset_to_rva()`]() ; [`LIEF::PE::Binary::offset_to_rva()`]() ) to convert a raw offset into a RVA - Add `lief.PE.parse_from_dump()` ( [`lief::pe::Binary::parse_from_dump`]() ; [`lief.PE.parse_from_dump()`]() ; [`LIEF::PE::Parser::parse_from_dump()`]() ) to parse a PE binary from a memory dump - Update `lief.Binary.offset_to_virtual_address()` ( [`lief::generic::Binary::offset_to_virtual_address`]() ; [`lief.Binary.offset_to_virtual_address()`]() ; [`LIEF::Binary::offset_to_virtual_address()`]() ) for PE binaries to return an **absolute** virtual address instead of a RVA ([#1318]()) - Add support for adding an `lief.PE.Import` ( [`lief::pe::import::Import`]() ; [`lief.PE.Import`]() ; [`LIEF::PE::Import`]() ) at a specific position: `lief.PE.Binary.add_import()` ( [`lief::pe::Binary::add_import`]() ; [`lief::pe::Binary::add_import_at_pos`]() ; [`lief.PE.Binary.add_import()`]() ; [`LIEF::PE::Binary::add_import()`]() ) ([#1298]()) - Improve support for EFI binaries, such as `bzImage` ([#1293]()) **ObjC:** - Add support for Objective-C categories ([#1353]()): `lief.ObjC.Category` ( [`lief::objc::Category`]() ; [`lief.objc.Category`]() ; [`LIEF::objc::Category`]() ), accessible through `lief.ObjC.Metadata.categories` ( [`lief::objc::Metadata::categories`]() ; [`lief.objc.Metadata.categories`]() ; [`LIEF::objc::Metadata::categories()`]() ) **Assembly:** - Add support for iterating over the operands of MIPS, PowerPC, eBPF and RISC-V instructions (`Register`, `Immediate`, `Memory` and `PCRelative`): - `lief.assembly.mips.Instruction.operands()` ( [`lief::assembly::mips::Instruction::operands`]() ; [`lief.assembly.mips.Instruction.operands`]() ; [`LIEF::assembly::mips::Instruction::operands()`]() ) - `lief.assembly.powerpc.Instruction.operands()` ( [`lief::assembly::powerpc::Instruction::operands`]() ; [`lief.assembly.powerpc.Instruction.operands`]() ; [`LIEF::assembly::powerpc::Instruction::operands()`]() ) - `lief.assembly.ebpf.Instruction.operands()` ( [`lief::assembly::ebpf::Instruction::operands`]() ; [`lief.assembly.ebpf.Instruction.operands`]() ; [`LIEF::assembly::ebpf::Instruction::operands()`]() ) - `lief.assembly.riscv.Instruction.operands()` ( [`lief::assembly::riscv::Instruction::operands`]() ; [`lief.assembly.riscv.Instruction.operands`]() ; [`LIEF::assembly::riscv::Instruction::operands()`]() ) **Rust:** > **Warning** > > The Minimum Supported Rust Version (MSRV) is now `1.85.0` (previously `1.74.0`). - The Rust FFI no longer relies on `autocxx` and `bindgen`. It is now built on top of plain `cxx`, which simplifies the bindings and reduces the iteration time - The Rust bindings directory has been renamed from `api/rust/cargo/` to `api/rust/crates/` - Add support for the `aarch64-linux-android` and `x86_64-linux-android` targets **C++:** - Add `LIEF_LIFETIMEBOUND` annotations wrapping `[[clang::lifetimebound]]` to leverage Clang’s [lifetime analysis](). This helps detect dangling references at compile time for methods that return references or iterators tied to an object’s lifetime: ```cpp // Clang can now warn about this dangling reference: auto& hdr = LIEF::ELF::Parser::parse("a.out")->header(); LIEF_INFO("{}", hdr.header_size()); // /src/src/ELF/Binary.cpp:63:15: error: object whose reference is captured // does not live long enough [-Werror,-Wlifetime-safety-use-after-scope] // 63 | auto& hdr = LIEF::ELF::Parser::parse("a.out")->header(); // | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ // /src/src/ELF/Binary.cpp:63:47: note: destroyed here // 63 | auto& hdr = LIEF::ELF::Parser::parse("a.out")->header(); // | ^ // /src/src/ELF/Binary.cpp:64:19: note: later used here // 64 | LIEF_INFO("{}", hdr.header_size()); ``` **Dependencies:** - Update nanobind to version `v2.13.x` - Update tl-expected to version `1.3.1` - Update utfcpp to version `4.0.9` - Update frozen to commit `61dce5a` - Update spdlog to version `1.17.0` - Update mbedtls to version `4.0.0` **Extended:** - Use LLVM `22.x` - Add support to directly download a package from the **History**: [![_images/lief-extended-history-link.webp](https://lief.re/doc/latest/_images/lief-extended-history-link.webp)]() **Python:** - Python 3.8 is no longer supported - Add support for the free-threaded Python builds. The C++ core is now thread-safe with respect to its few static variables, and can be used when the GIL is disabled ([#1255]()): ```python from concurrent.futures import ThreadPoolExecutor import lief def strip(path: str) -> None: binary = lief.ELF.parse(path) binary.strip() binary.write(f"{path}.stripped") with ThreadPoolExecutor() as pool: pool.map(strip, ["/bin/ls", "/bin/cat", "/bin/echo"]) ``` ## [0.17.6 - March 18th, 2026]() **ELF:** - Fix alignment for `PHDR/SHDR` and improve `TLS/RELR` handling ([#1315]()) - Skip `NOBITS` sections in layout calculations and improve index retrieval (related to [#1315]()) **PE:** - Fix IAT parsing issue by [itamarga]() in PR [#1314]()) ## [0.17.5 - March 8th, 2026]() **ELF:** - Add missing segments in X86\_64 coredump parser ([#1278]()) - Add TLSDESC\_PLT and TLSDESC\_GOT to ELF dynamic tags ([#1311]()) - Fix dynamic entry shifting for Android relocations ([#1309]()) **MachO:** - Fix `DyldInfo::show_bindings` integer overflow ([#1313]()) ## [0.17.4 - February 21st, 2026]() **PE:** - Fixed the address type in the TLS builder (by [Immortalety]() in PR [#1296]()) **MachO:** - Fixed `lief.MachO.Binary.virtual_address_to_offset()` ( [`lief::macho::Binary::virtual_address_to_offset`]() ; [`lief.MachO.Binary.virtual_address_to_offset()`]() ; [`LIEF::MachO::Binary::virtual_address_to_offset()`]() ) to properly handle non-file-backed segments, such as `__DATA` segments containing only `ZEROFILL` sections like `__bss` (by [jalopezg-git]() in PR [#1301](), fixing [#1299]()). - Fixed `patch_relocation()` to correctly process tagged pointers (by [jalopezg-git]() in PR [#1302](), fixing [#1300]()). **COFF:** - Resolved a compilation conflict with the Windows `minwindef.h` macro `#define max`. **CMake:** - Fixed compiler flag issues on Windows when compiling with `clang-cl` (by [sigewinnefish]() in PR [#1306]()). **Python:** - Bumped various Python backend build dependencies in `api/python/build-requirements.txt` to support Python `3.14` when compiling from sources ([#1304]()). ## [0.17.3 - January 24th, 2026]() **PE:** - Fixed bug with resources ([#1281]()). - Fixed VA/RVA confusion in the PE builder ([#1284]()). ## [0.17.2 - January 3rd, 2026]() **Mach-O:** - Differentiate Mach-O FAT magic bytes and Java classes (by [wangmot](), [#1215]()). **Compilation:** - Fixed MinGW compilation for some configurations (by [TheBrokenRail](), [dabbb72]()). **PE:** - Fixed alignment issue when rebuilding PE relocations ([#1261]()). - Fixed infinite loop when processing v2 dynamic relocations (by [chengyongru](), fixing [#1273]()). **ELF:** - Ensure that added DYN ELF sections are properly aligned (by [schmchrt](), fixing [#1261]()). - Fixed GnuHash null dereference ([#1277]()). **Mach-O:** - Fixed major performance issue when parsing certain Mach-O files (by [trevor-e](), fixing [#1262]()). ## [0.17.1 - October 25th, 2025]() **ELF:** - Fixed [#1251](). **Compilation:** - Fixed missing visibility ([#1254]()). - Fixed incorrect paging computations that occurred when only a subset of formats was enabled. - Fixed include issue with the COFF format. ## [0.17.0 - September 14th, 2025]() > **BinaryNinja & Ghidra Plugins** > > LIEF-based plugins for Binary Ninja and Ghidra have been bootstrapped here: > > - [Ghidra plugin]() > - [BinaryNinja plugin]() > **LIEF Tools** > > I initiated a `Tools` section which aims at providing utilities based on LIEF (mostly CLI): > > - [lief-patchelf]() **Assembler:** - Add support for [Contextual Assembly Patching]() **DSC:** - Add enum for the latest dyld shared cache version introducing changes in the header layout (`dyld-1284.13 - 2025-04-25`) ```diff uint64_t dynamicDataOffset; uint64_t dynamicDataMaxSize; uint32_t tproMappingsOffset; uint32_t tproMappingsCount; + uint64_t functionVariantInfoAddr; + uint64_t functionVariantInfoSize; + uint64_t prewarmingDataOffset; + uint64_t prewarmingDataSize; }; ``` - Add enum for the latest dyld shared cache version introducing changes in the header layout (`dyld-1231.3 - 2024-09-24`) ```diff uint64_t dynamicDataOffset; uint64_t dynamicDataMaxSize; + uint32_t tproMappingsOffset; + uint32_t tproMappingsCount; }; ``` - Fix symbol resolution issue: [#1127]() **PE:** - Please check [LIEF 0.17.0 - PE changelog]() - [luadebug]() added support for pretty printing OID value and non-roman characters in X509 certificates (see: [#1226](), [#1219]()) **COFF:** - Initial support for the COFF format: see the [COFF section]() **Mach-O:** - Initial support for `lief.MachO.FunctionVariants` ( [`lief::macho::commands::FunctionVariants`]() ; [`lief.MachO.FunctionVariants`]() ; [`LIEF::MachO::FunctionVariants`]() ) and `lief.MachO.FunctionVariantFixups` ( [`lief::macho::commands::FunctionVariantFixups`]() ; [`lief.MachO.FunctionVariantFixups`]() ; [`LIEF::MachO::FunctionVariantFixups`]() ) commands (`LC_FUNCTION_VARIANTS, LC_FUNCTION_VARIANT_FIXUPS`) - Add support for `lief.MachO.Note` ( [`lief::macho::commands::Note`]() ; [`lief.MachO.NoteCommand`]() ; [`LIEF::MachO::NoteCommand`]() ) command (`LC_NOTE`) - Add support for `lief.MachO.AtomInfo` ( [`lief::macho::commands::AtomInfo`]() ; [`lief.MachO.AtomInfo`]() ; [`LIEF::MachO::AtomInfo`]() ) command (`LC_ATOM_INFO`) - Add support for modifying Mach-O commands that embed variable-length data ([#1204](), [#1125]()). See: [RPath and Library Path Modification](). ```python # Change library name for lib in macho.libraries: lib.name += "/some/path/lib.dylib" # Change rpath for rpath in macho.rpaths: rpath.path += '/a/very/long/path/that/needs/expansion' ``` - Add `lief.MachO.Binary.find_library()` ( [`lief::macho::Binary::find_library`]() ; [`lief.MachO.Binary.find_library()`]() ; [`LIEF::MachO::Binary::find_library()`]() ) - To void `#define` conflicts with Apple SDK, the following enums have been renamed: **Python** ```diff - lief.MachO.FAT_MAGIC + lief.MachO.MAGIC_FAT - lief.MachO.FAT_CIGAM + lief.MachO.CIGAM_FAT - lief.MachO.Symbol.ORIGIN.LC_SYMTAB + lief.MachO.Symbol.ORIGIN.SYMTAB - lief.MachO.Section.TYPE.S_4BYTE_LITERALS + lief.MachO.Section.TYPE.IS_4BYTE_LITERALS - lief.MachO.Section.TYPE.S_8BYTE_LITERALS + lief.MachO.Section.TYPE.IS_8BYTE_LITERALS - lief.MachO.Section.TYPE.S_16BYTE_LITERALS + lief.MachO.Section.TYPE.IS_16BYTE_LITERALS ``` **C++** ```diff - MACHO_TYPES::MH_MAGIC - MACHO_TYPES::MH_CIGAM - MACHO_TYPES::MH_MAGIC_64 - MACHO_TYPES::MH_CIGAM_64 - MACHO_TYPES::FAT_MAGIC - MACHO_TYPES::FAT_CIGAM + MACHO_TYPES::MAGIC + MACHO_TYPES::CIGAM + MACHO_TYPES::MAGIC_64 + MACHO_TYPES::CIGAM_64 + MACHO_TYPES::MAGIC_FAT + MACHO_TYPES::CIGAM_FAT - Section::TYPE::S_16BYTE_LITERALS + Section::TYPE::IS_16BYTE_LITERALS - Section::TYPE::S_4BYTE_LITERALS + Section::TYPE::IS_4BYTE_LITERALS - Section::TYPE::S_8BYTE_LITERALS + Section::TYPE::IS_8BYTE_LITERALS - Symbol::ORIGIN::LC_SYMTAB + Symbol::ORIGIN::SYMTAB ``` **ELF:** - LIEF newly-inserted sections are now compatible with a `strip` after the modification of the binary (see: [Adding a section/segment]()) - Enhance support for IA64 architecture. - Introduce [`lief.ELF.Segment.raw_flags`]( "lief.ELF.Segment.raw_flags") to access the raw (integer) value of the flag - If an ELF binary uses a custom page size, its value can be defined in the parser configuration: `lief.ELF.ParserConfig.page_size` ( [`lief::elf::ParserConfig::page_size`]() ; [`lief.ELF.ParserConfig.page_size`]() ; [`LIEF::ELF::ParserConfig::page_size`]() ). - Add support for SH4 - Add suport for x32/ILP32 ELF binaries ([#1225]()) - Add support for S390x - Better endianess support when writing back a binary. - Enhance support for removing segments ([#1233]()): `lief.ELF.Binary.remove_segment()` ( [`lief::elf::Binary::remove_segment`]() ; [`lief::elf::Binary::remove_segments_by_type`]() ; [`lief.ELF.Binary.remove()`]() ; [`void LIEF::ELF::Binary::remove(const Segment &, bool)`]() ; [`void LIEF::ELF::Binary::remove(Segment::TYPE, bool)`]() ) - Enhance support for removing or modifying symbol versions (related to the [lief-patchelf]() initiative) - New doc section: [Symbol Versions]() - New doc section: [R[UN]PATH Modification]() **DWARF:** - LIEF extended can now process DWARF debug info in PE binaries - Add support for creating DWARF: [DWARF Editor]() (require extended version `>= 0.17.0.2623`) **PDB:** - Add `lief.pdb.is_pdb` ( [`lief::pdb::is_pdb`]() ; [`lief.is_pdb()`]() ; [`bool LIEF::pdb::is_pdb(const std::std::string &)()`]() ) - Add support for CodeView symbols: `S_COMPILE3, S_COMPILE2, S_BUILDINFO, S_ENVBLOCK`. These symbols are exposed through the interface `lief.pdb.BuildMetadata` ( [`lief::pdb::BuildMetadata`]() ; [`lief.pdb.BuildMetadata`]() ; [`LIEF::pdb::BuildMetadata`]() ), which can be accessed using `lief.pdb.CompilationUnit.build_metadata()` ( [`lief::pdb::CompilationUnit::build_metadata`]() ; [`lief.pdb.CompilationUnit.build_metadata`]() ; [`LIEF::pdb::CompilationUnit::build_metadata()`]() ). This metadata provides build time information such as: ```text Module Name : * Linker * Build Metadata: Frontend Version: 0.0.0.0 Backend Version : 14.37.32825.0 Tool Version : Microsoft (R) LINK Language : LINK Target : X64 Environment: cwd: C:\Users\romai\dev\rust\ast-grep exe: C:\Program Files\Microsoft Visual Studio\2022\Community\[...] pdb: C:\Users\romai\dev\rust\ast-grep\target\debug\deps\ast_grep.pdb cmd: /NOLOGO /LIBPATH:C:\Users\romai\dev\rust\ast-grep\target\[...] Module Name : std-4ee9ee8805e6ac55.std.ddad90bab7781587-cgu.0.rcgu.o Object : C:\Users\romai\scoop\persist\rustup\.rustup\toolchains\[...] Build Metadata: Frontend Version: 1.74.0.0 Backend Version : 17004.0.0.0 Tool Version : clang LLVM (rustc version 1.74.0 (79e9716c9 2023-11-13)) Language : RUST Target : X64 Build Info: Current directory: /rustc/79e9716c980570bfd1f666e3b16ac583f0168962 Build tool : C:\a\rust\rust\build\x86_64-pc-windows-msvc\stage1\bin\rustc.exe Source file : library\std\src\lib.rs\@\std.ddad90bab7781587-cgu.0 Command line : "-cc1" "--crate-name" "std" "--edition=2021" [...] ``` **OAT:** - Parsing Android OAT files requires to **explicitly** use [`lief.OAT.parse()`]( "lief.OAT.parse") ```python import lief # Before LIEF 0.17.0 this function returned a lief.OAT.Binary object lief.parse("CallDeviceId.oat") # Since LIEF 0.17.0 this function returns a lief.ELF.Binary object lief.parse("CallDeviceId.oat") # Return a lief.OAT.Binary object lief.OAT.parse("CallDeviceId.oat") ``` **Abstraction:** - Expose `lief.abstract.Binary.page_size()` ( [`lief::generic::Binary::page_size`]() ; [`lief.Binary.page_size`]() ; [`LIEF::Binary::page_size()`]() ) - Add `lief.abstract.Binary.load_debug_info()` ( [`lief::generic::Binary::load_debug_info`]() ; [`lief.Binary.load_debug_info()`]() ; [`LIEF::Binary::load_debug_info()`]() ) to attach an external debug file to a `lief.abstract.Binary` ( [`lief::generic::Binary`]() ; [`lief.Binary`]() ; [`LIEF::Binary`]() ). See these sections for more details: [DWARF: Loading an external debug file]()[PDB: Loading an external debug file]() - Add `lief.DebugInfo.find_function_address()` ( [`lief::generic::DebugInfo::find_function_address`]() ; [`lief.DebugInfo.find_function_address()`]() ; [`LIEF::DebugInfo::find_function_address()`]() ) **Extended:** - Fix issue in the Python bindings while trying to access `lief.__LIEF_MAIN_COMMIT__` - Fix CMake issue with `find_package(lief-extended)` - Use LLVM `21.1.x` **Build System:** - LIEF is now available in [vcpkg](). Many thanks to [luadebug]() for this support. **Dependencies:** - Move to tl-expected `1.2.0` - Move to utfcpp `4.0.6` - Move to mbedtls `3.6.4` - Move to spdlog `1.15.3` - Move to `nlohmann/json` `3.12.0` - Upgrade nanobind to version `v2.8.x` **Utilities:** - Add `LIEF.dump()` ( [`lief::dump`]() ; [`lief::dump_with_limit`]() ; [`lief.dump()`]() ; [`LIEF::dump()`]() ) ## [0.16.7 - October 5th, 2025]() **Python:** - Add wheels for Python 3.14 **Mach-O:** - Fix `has_nx` ([#1218]()) - Fix [#1228]() **ELF:** - Fix [#1241]() **Other:** - [#1220]() ## [0.16.6 - May 29th, 2025]() **Compilation:** - Fix missing header ([#1192]()) - Fix GCC 15 issue ([#1203]()) - Fix [#1210]() **Mach-O:** - Fix use-after-move ([#1212]()) - Fix [#1206]() **Python:** - Fix Python logger warning **Other:** - [#1217]() - [#1216]() ## [0.16.5 - April 19th, 2025]() **ELF:** - Relax the condition over the `DT_SYMENT` entry ([#1177]()) **Mach-O:** - Modifications on `lief.MachO.EncryptionInfo` ( [`lief::macho::commands::EncryptionInfo`]() ; [`lief.MachO.EncryptionInfo`]() ; [`LIEF::MachO::EncryptionInfo`]() ) are now committed when doing a `write()`. See: [#1173]() **Compilation:** - Fix compilation issue when targeting Linux i386/i686 ([#1189]()) - Better support for external `fmt` library - Fix `fmt` unicode issue - Fix missing `cstdio` ([#1184]()) **Packages:** - Add Python, Rust, SDK packages for Windows ARM64 (`aarch64-pc-windows-msvc`) - Add Python, Rust, SDK packages for Linux Musl ARM64 (`aarch64-unknown-linux-musl`) - Add Python, Rust, SDK packages for Linux Musl i686 (`i686-unknown-linux-musl`) ## [0.16.4 - February 23rd, 2025]() **Python:** - Relax checks on the enum verification. As described in [#1170]() and [#1172](), an invalid enum led to an unrecoverable error. The new behavior now returns the raw `int` value if it can’t be converted into the given enum. - Upgrade nanobind to version `v2.5.0` **PE:** - Fix export forwarding issue ([#1168]()) **MachO:** - Fix truncated `nlist_t.n_type` when rewriting a Mach-O binary ## [0.16.3 - February 1st, 2025]() **ELF:** - Fix issue when parsing the dynamic table with an invalid offset (bug found by [lebr0nli]()) - Fix endianness issue with `IA64` binaries ([#1164]()) **PE:** - Fix missing original forwarded function name ([#1166]()) **Misc:** - Add support for spdlog compiled with `SPDLOG_WCHAR_FILENAMES` ([#1147]()) ## [0.16.2 - January 1st, 2025]() **Compilation:** - Fix broken `aarch64` Python wheel which is related to a toolchain issue ([#1146]()) ## [0.16.1 - December 26th, 2024]() **MachO:** - Various fixes from [DzenIsRich]() & [peledins-zimperium]() Thanks to them, Mach-O modification is more reliable. - Fix issue when building with `-DLIEF_MACHO=ON` (see: [#1138]()) **Rust:** - Fix min-rustc version issue (see: [75a27f0]()) **Compilation:** - Fix missing `LIEF_API` visibility ([e01f92a](), [#1140]()) ## [0.16.0 - December 10th, 2024]() **Abstraction:** - Add `LIEF.get_int_from_virtual_address()` ( [`lief::elf::Binary::get_int_from_virtual_address`]() ; [`lief.Binary.get_int_from_virtual_address()`]() ; [`LIEF::Binary::get_int_from_virtual_address()`]() ) to read an **integer** value at a specific virtual address **C++** ```cpp LIEF::Binary& bin; uint16_t short_value = bin.get_int_from_virtual_address(0x140002CC8); ``` **Python** ```python some_bin: lief.Binary = ... long_value = some_bin.get_int_from_virtual_address(0x140002CC8, 4) # or long_value = some_bin.get_int_from_virtual_address(0x140002CC8, ctypes.sizeof(ctypes.c_uint32)) ``` **Rust** ```rust elf: &lief::elf::Binary let value: i16 = elf.get_int_from_virtual_address::(0x401126).unwrap(); ``` - Global code cleaning (especially, `lief.Header.ARCHITECTURES` ( [`lief.Header.ARCHITECTURES`]() ; [`LIEF::Header::ARCHITECTURES`]() ) and `lief.Header.MODES` ( [`lief.Header.MODES`]() ; [`LIEF::Header::MODES`]() ) is now more meaningful) - Re-scope `lief.ARCHITECTURES` into `lief.Header.ARCHITECTURES` ( [`lief.Header.ARCHITECTURES`]() ; [`LIEF::Header::ARCHITECTURES`]() ) - Re-scope `lief.MODES` into `lief.Header.MODES` ( [`lief.Header.MODES`]() ; [`LIEF::Header::MODES`]() ) - Re-scope `lief.OBJECT_TYPES` into `lief.Header.OBJECT_TYPES` ( [`lief.Header.OBJECT_TYPES`]() ; [`LIEF::Header::OBJECT_TYPES`]() ) - Re-scope `lief.ENDIANNESS` into `lief.Header.ENDIANNESS` ( [`lief.Header.ENDIANNESS`]() ; [`LIEF::Header::ENDIANNESS`]() ) **MachO:** - Fix endianness support ([#1110]()) - Add helpers to determine the platform targeted by a Mach-O binary: - `lief.MachO.Binary.is_ios()` ( [`lief::macho::Binary::is_ios`]() ; [`lief.MachO.Binary.is_ios`]() ; [`LIEF::MachO::Binary::is_ios()`]() ) - `lief.MachO.Binary.is_macos()` ( [`lief::macho::Binary::is_macos`]() ; [`lief.MachO.Binary.is_macos`]() ; [`LIEF::MachO::Binary::is_macos()`]() ) - `lief.MachO.Binary.platform()` ( [`lief::macho::Binary::platform`]() ; [`lief.MachO.Binary.platform`]() ; [`LIEF::MachO::Binary::platform()`]() ) - Expose an iterator over the stub entries located in `__stubs,__auth_stubs,__symbol_stub,__picsymbolstub4`: `lief.MachO.Binary.symbol_stubs()` ( [`lief::macho::Binary::symbol_stubs`]() ; [`lief.MachO.Binary.symbol_stubs`]() ; [`LIEF::MachO::Binary::symbol_stubs()`]() ) - `lief.MachO.Stub` ( [`lief::macho::Stub`]() ; [`lief.MachO.Stub`]() ; [`LIEF::MachO::Stub`]() ) - Add support for the `LC_SUBCLIENT` command: `lief.MachO.SubClient` ( [`lief::macho::commands::SubClient`]() ; [`lief.MachO.SubClient`]() ; [`LIEF::MachO::SubClient`]() ) - Add support for the `LC_ROUTINE/LC_ROUTINE64` command: `lief.MachO.Routine` ( [`lief::macho::commands::Routine`]() ; [`lief.MachO.Routine`]() ; [`LIEF::MachO::Routine`]() ) - Expose an iterator for the indirect symbols in `lief.MachO.DynamicSymbolCommand` ( [`lief::macho::commands::DynamicSymbolCommand`]() ; [`lief.MachO.DynamicSymbolCommand`]() ; [`LIEF::MachO::DynamicSymbolCommand`]() ) - Add `lief.MachO.Binary.bindings()` ( [`lief::macho::Binary::bindings`]() ; [`lief.MachO.Binary.bindings`]() ; [`LIEF::MachO::Binary::bindings()`]() ) to iterate over the bindings info located in `lief.MachO.DyldInfo` ( [`lief::macho::commands::DyldInfo`]() ; [`lief.MachO.DyldInfo`]() ; [`LIEF::MachO::DyldInfo`]() ) or `lief.MachO.ChainedBindingInfo` ( [`lief::macho::binding_info::Chained`]() ; [`lief.MachO.ChainedBindingInfo`]() ; [`LIEF::MachO::ChainedBindingInfo`]() ) - Add `lief.MachO.IndirectBindingInfo` ( [`lief::macho::binding_info::Indirect`]() ; [`lief.MachO.IndirectBindingInfo`]() ; [`LIEF::MachO::IndirectBindingInfo`]() ) to represent a binding operation inferred from the indirect symbol table. This can be handy if a Mach-O does not have the commands `lief.MachO.DyldInfo` ( [`lief::macho::commands::DyldInfo`]() ; [`lief.MachO.DyldInfo`]() ; [`LIEF::MachO::DyldInfo`]() ) or `lief.MachO.ChainedBindingInfo` ( [`lief::macho::binding_info::Chained`]() ; [`lief.MachO.ChainedBindingInfo`]() ; [`LIEF::MachO::ChainedBindingInfo`]() ) (e.g. extracted shared cache library) **PE:** - Fix authenticode error while reading RSA PKCS#1 1.5 padding **ELF:** - Fix issue when multiple empty strings are present in the `.symtab` section ([#1124]()) - Add `lief.ELF.Relocation.resolve()` ( [`lief::elf::Relocation::resolve`]() ; [`lief::elf::Relocation::resolve_with_base_address`]() ; [`lief.ELF.Relocation.resolve()`]() ; [`LIEF::ELF::Relocation::resolve()`]() ) to resolve the value of relocations - Add support for eBPF relocations. - Add support for `GNU_PROPERTY_AARCH64_FEATURE_PAUTH` GNU property note: `lief.ELF.AArch64PAuth` ( [`lief.ELF.AArch64PAuth`]() ; [`LIEF::ELF::AArch64PAuth`]() ). - Add `lief.ELF.Binary.is_targeting_android` ( [`lief::elf::Binary::is_targeting_android`]() ; [`lief.ELF.Binary.is_targeting_android`]() ; [`LIEF::ELF::Binary::is_targeting_android()`]() ) to check if an ELF targets Android - Fix a critical error when rewriting ELF file with `DT_RELR` relocations. This error leads to a crash of the modified binary. - Fix error while (re)generating ELF’s RELR relocations ([#1097]()) - Add support for RISC-V architecture - Fix bug when trying to remove a dynamic symbol that is associated with multiple relocations ([#1089]()) **Rust:** - Mutable API are progressively introduced: - ELF: - [`lief::elf::Binary::write`]() - [`lief::elf::Binary::write_with_config`]() - [`lief::elf::Binary::add_library`]() - PE: - [`lief::pe::Binary::write`]() - MachO: - [`lief::macho::Binary::write`]() - [`lief::macho::Binary::write_with_config`]() - [`lief::macho::Binary::add_library`]() - Thanks to [Huntragon]() Rust bindings can be used without openssl (see: [#1105]()) - Rust precompiled Linux packages are now supported for Debian 10 & Ubuntu 19.10. Before, they require at least Debian 11 & Ubuntu 20.04 - Add support for the `x86_64-unknown-linux-musl` target which allows to generate full static executable. - Add [`lief::elf::header::Arch`]() - Add [`lief::elf::dynamic::Flags`]() **ObjC:** - The header-like generation ( `lief.ObjC.Metadata.to_decl()` ( [`lief::objc::Metadata::to_decl`]() ; [`lief.objc.Metadata.to_decl()`]() ; [`LIEF::objc::Metadata::to_decl()`]() )) is now including method’s address as a comment: **Before** ```objc @interface GCKUIImageHints { long long _imageType; NSObject * _customData; struct CGSize _imageSize; } + (bool)supportsSecureCoding:(GCKUIImageHints *)self :(SEL)id; - (bool)isEqual:(GCKUIImageHints *)self :(SEL)id :(NSObject *)arg2; ``` **After** ```objc @interface GCKUIImageHints { long long _imageType; NSObject * _customData; struct CGSize _imageSize; } // Address: 0x00001aa448 + (bool)supportsSecureCoding:(GCKUIImageHints *)self :(SEL)id; // Address: 0x00001aa5ec - (bool)isEqual:(GCKUIImageHints *)self :(SEL)id :(NSObject *)arg2; ``` - Fix `lief.ObjC.Method.address()` ( [`lief::objc::Method::address`]() ; [`lief.objc.Method.address`]() ; [`LIEF::objc::Method::address()`]() ) for *small* methods. - The output of `lief.ObjC.Metadata.to_decl()` ( [`lief::objc::Metadata::to_decl_with_opt`]() ; [`lief.objc.Metadata.to_decl()`]() ; [`LIEF::objc::Metadata::to_decl()`]() ) can now be configured with `lief.ObjC.DeclOpt` ( [`lief::objc::DeclOpt`]() ; [`lief.objc.DeclOpt`]() ; [`LIEF::objc::DeclOpt`]() ). **DWARF:** - Add `lief.dwarf.Function.is_external()` ( [`lief::dwarf::Function::is_external`]() ; [`lief.dwarf.Function.is_external`]() ; [`LIEF::dwarf::Function::is_external()`]() ) - Add `lief.dwarf.CompilationUnit.imported_functions()` ( [`lief::dwarf::CompilationUnit::imported_functions`]() ; [`lief.dwarf.CompilationUnit.imported_functions`]() ; [`LIEF::dwarf::CompilationUnit::imported_functions()`]() ) - Add `DW_TAG_typedef` support **Extended:** > **Note** > > - [LIEF extended]() is now open to everyone > - C++ SDK is now available > - Rust package is now available - Initial assembler support: [Assembler]() - Initial disassembler support: [Disassembler]() - Linux Python wheels are now `manylinux_2_27` compliants. In other words, they are working with a glibc from at least 2018. - Support for [Dyld shared cache]() - `lief.ELF.Symbol.demangled_name()` ( [`lief::elf::Symbol::demangled_name`]() ; [`lief.ELF.Symbol.demangled_name`]() ; [`LIEF::ELF::Symbol::demangled_name()`]() ) is working on **all** platforms (not only unix-based builds) - `lief.MachO.Symbol.demangled_name()` ( [`lief::macho::Symbol::demangled_name`]() ; [`lief.MachO.Symbol.demangled_name`]() ; [`LIEF::MachO::Symbol::demangled_name()`]() ) is working on **all** platforms (not only unix-based builds) - `lief.PE.DelayImportEntry.demangled_name()` ( [`lief::pe::delay_import::DelayImportEntry::demangled_name`]() ; [`lief.PE.DelayImportEntry.demangled_name`]() ; [`LIEF::PE::DelayImportEntry::demangled_name()`]() ) - `lief.PE.ImportEntry.demangled_name()` ( [`lief::pe::import::ImportEntry::demangled_name`]() ; [`lief.PE.ImportEntry.demangled_name`]() ; [`LIEF::PE::ImportEntry::demangled_name()`]() ) - `lief.PE.ExportEntry.demangled_name()` ( [`lief::pe::export::Entry::demangled_name`]() ; [`lief.PE.ExportEntry.demangled_name`]() ; [`LIEF::PE::ExportEntry::demangled_name()`]() ) ```python pe = lief.PE.parse("some.exe") if exp := pe.get_export(): for entry in exp.entries: # e.g.void __cdecl Platform::Details::EventSourceUninitialize(void **) print(entry.demangled_name) for imp in pe.imports: for entry in imp.entries: # e.g. void __cdecl std::_Xlength_error(char const *) print(entry.demangled_name) ``` - Add `LIEF.demangle()` ( [`lief::demangle`]() ; [`lief.demangle()`]() ; [`LIEF::demangle()`]() ) to demangle symbols (c.f. [#1054]()) - The extended version is now using a versioning matching LIEF regular version **Python Bindings:** - Upgrade nanobind from `1.8.0` to `2.4.0` - `*.pyi` stubs are now generated by nanobind (replacing mypy’s stugen) **Dependencies:** - Upgrade MbedTLS from `3.2.1` to `3.6.1` **doc:** - Global restructuring of the documentation - Add Sphinx cross-reference support for Rust. For instance, this link: [`lief::elf::Binary::debug_info`]() references the documentation of `debug_info` in the Rust documentation page. - Add cross-api menu directive. For instance, this *link*: `lief.dwarf.DebugInfo` ( [`lief::dwarf::DebugInfo`]() ; [`lief.dwarf.DebugInfo`]() ; [`LIEF::dwarf::DebugInfo`]() ) toggles a menu to access the documentation of DWARF’s debug info for Rust, Python & C++. ## [0.15.1 - July 23th, 2024]() **MachO:** - Fix missing commit for `.hwx` support ## [0.15.0 - July 21th, 2024]() **Extended:** > **Note** > > See: [https://extended.lief.re]() and [What is LIEF Extended?]() - Add support for DWARF: [DWARF]() - Add support for PDB: [PDB]() - Add support for Objective-C: [Objective-C]() **Repo:** - `master` branch has been renamed `main` **Rust:** - First (beta) release of the bindings (c.f. [Rust]()) **ELF:** - Add support to create custom notes ([#1026]()): ```python elf: lief.ELF.Binary = ... elf += lief.ELF.Note.create( name="my-custom-note", original_type=lief.ELF.Note.TYPE.UNKNOWN, description=list(b"Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed"), section_name=".lief.note.custom" ) config = lief.ELF.Builder.config_t() config.notes = True elf.write("/tmp/new-binary.elf", config) ``` - Add [`lief.ELF.Binary.get_relocated_dynamic_array()`]( "lief.ELF.Binary.get_relocated_dynamic_array") which allows to get a **relocated** view of the of init/fini entries. This function can handy ELF init array/fini array functions are defined through relocations. See: [#1058](), [#626]() - Add support for QNX Stack note ([#1065]()) - The `static_symbols` API functions has been renamed in `symtab_symbols`. LIEF was naming symbols located in the `.symtab` sections as **static symbols** in opposition to the `.dynsym` symbols. This naming can be confusing since the concept of **static symbol** in a program is well defined (i.e. `static bool my_var`) and not applicable in this case. **Therefore, the ``xxx\_static\_symbols`` API is has been renamed ``xxx\_symtab\_symbol``.** - Re-scope `DYNAMIC_TAGS` into [`lief.ELF.DynamicEntry.TAG`]( "lief.ELF.DynamicEntry.TAG") - Re-scope `E_TYPE` into [`lief.ELF.Header.FILE_TYPE`]( "lief.ELF.Header.FILE_TYPE") - Re-scope `VERSION` into [`lief.ELF.Header.VERSION`]( "lief.ELF.Header.VERSION") - Re-scope `ELF_CLASS` into [`lief.ELF.Header.CLASS`]( "lief.ELF.Header.CLASS") - Re-scope `ELF_DATA` into [`lief.ELF.Header.ELF_DATA`]( "lief.ELF.Header.ELF_DATA") - Re-scope `OS_ABI` into [`lief.ELF.Header.OS_ABI`]( "lief.ELF.Header.OS_ABI") - Re-scope `ELF_SECTION_TYPES` into [`lief.ELF.Section.TYPE`]( "lief.ELF.Section.TYPE") - Re-scope `ELF_SECTION_FLAGS` into [`lief.ELF.Section.FLAGS`]( "lief.ELF.Section.FLAGS") - Re-scope `SYMBOL_BINDINGS` into [`lief.ELF.Symbol.BINDING`]( "lief.ELF.Symbol.BINDING") - Re-scope `ELF_SYMBOL_TYPES` into [`lief.ELF.Symbol.TYPE`]( "lief.ELF.Symbol.TYPE") - Re-scope `ELF_SYMBOL_VISIBILITY` into [`lief.ELF.Symbol.VISIBILITY`]( "lief.ELF.Symbol.VISIBILITY") - Re-scope `SEGMENT_TYPES` into [`lief.ELF.Segment.TYPE`]( "lief.ELF.Segment.TYPE") - Re-scope `ELF_SEGMENT_FLAGS` into `lief.ELF.Segment.FLAG` - Re-scope `DYNAMIC_FLAGS_1` into [`lief.ELF.DynamicEntryFlags.FLAG`]( "lief.ELF.DynamicEntryFlags.FLAG") - Re-scope `DYNAMIC_FLAGS` into [`lief.ELF.DynamicEntryFlags.FLAG`]( "lief.ELF.DynamicEntryFlags.FLAG") - Re-scope `DYNSYM_COUNT_METHODS` into [`lief.ELF.ParserConfig.DYNSYM_COUNT`]( "lief.ELF.ParserConfig.DYNSYM_COUNT") - Re-scope `RELOCATION_PURPOSES` into [`lief.ELF.Relocation.PURPOSE`]( "lief.ELF.Relocation.PURPOSE") - `RELOC_x86_64`, `RELOC_i386`, … have been re-scoped **and merged** into [`lief.ELF.Relocation.TYPE`]( "lief.ELF.Relocation.TYPE") - Add support for Android packed relocation format (`DT_ANDROID_REL{A}`) - Add support for relative relocation format (`DT_RELR`) **PE:** - Authenticode: Add partial support for the following PKCS #7 attributes: > - `1.3.6.1.4.1.311.3.3.1 - Ms-CounterSign` ([`lief.PE.MsCounterSign`]( "lief.PE.MsCounterSign")) > - `1.3.6.1.4.1.311.10.3.28 - Ms-ManifestBinaryID` ([`lief.PE.MsManifestBinaryID`]( "lief.PE.MsManifestBinaryID")) > - `1.3.6.1.4.1.311.2.6.1 - SPC_RELAXED_PE_MARKER_CHECK_OBJID` ([`lief.PE.SpcRelaxedPeMarkerCheck`]( "lief.PE.SpcRelaxedPeMarkerCheck")) > - `1.2.840.113549.1.9.16.2.47 - SIGNING_CERTIFICATE_V2` ([`lief.PE.SigningCertificateV2`]( "lief.PE.SigningCertificateV2")) - `1.2.840.113549.1.9.16.1.4 - PKCS#9 TSTInfo` ([`lief.PE.PKCS9TSTInfo`]( "lief.PE.PKCS9TSTInfo")) - Add [`lief.PE.CodeViewPDB.guid`]( "lief.PE.CodeViewPDB.guid") attribute ([#480]()) - Move `lief.PE.OptionalHeader.computed_checksum` to [`lief.PE.Binary.compute_checksum()`]( "lief.PE.Binary.compute_checksum") In previous versions of LIEF, [`lief.PE.OptionalHeader.checksum`]( "lief.PE.OptionalHeader.checksum") was re-computed (on purpose) in the parsing phase. On large binaries, this re-computation can have a **strong impact** on the performances. Thus, this computation has been deferred to a dedicated method [`lief.PE.Binary.compute_checksum()`]( "lief.PE.Binary.compute_checksum") ```python pe = lief.PE.parse("...") # Before: computed = pe.optional_header.computed_checksum # Now: computed = pe.compute_checksum() ``` **MachO:** - Add support to modify Mach-O rpath (see: [#1074]()) - Add helper [`lief.MachO.Binary.support_arm64_ptr_auth`]( "lief.MachO.Binary.support_arm64_ptr_auth") to check if a Mach-O binary is supporting ARM64 pointer authentication (arm64e) - Fix **major performance issue when processing Mach-O binaries on Windows & macOS** - Add generic [`lief.MachO.UnknownCommand`]( "lief.MachO.UnknownCommand") to support Apple private Load commands not officially supported by LIEF. - Re-scope `LOAD_COMMAND_TYPES` into [`lief.MachO.LoadCommand.TYPE`]( "lief.MachO.LoadCommand.TYPE") - Re-scope `FILE_TYPES` into [`lief.MachO.Header.FILE_TYPE`]( "lief.MachO.Header.FILE_TYPE") - Re-scope `HEADER_FLAGS` into [`lief.MachO.Header.FLAGS`]( "lief.MachO.Header.FLAGS") - Re-scope `MACHO_SEGMENTS_FLAGS` into [`lief.MachO.SegmentCommand.FLAGS`]( "lief.MachO.SegmentCommand.FLAGS") - Re-scope `MACHO_SECTION_TYPES` into [`lief.MachO.Section.TYPE`]( "lief.MachO.Section.TYPE") - Re-scope `MACHO_SECTION_FLAGS` into [`lief.MachO.Section.FLAGS`]( "lief.MachO.Section.FLAGS") - Re-scope `REBASE_TYPES` into [`lief.MachO.DyldInfo.REBASE_TYPE`]( "lief.MachO.DyldInfo.REBASE_TYPE") - Re-scope `REBASE_OPCODES` into [`lief.MachO.DyldInfo.REBASE_OPCODES`]( "lief.MachO.DyldInfo.REBASE_OPCODES") - Re-scope `BIND_OPCODES` into [`lief.MachO.DyldInfo.BIND_OPCODES`]( "lief.MachO.DyldInfo.BIND_OPCODES") - Re-scope `BINDING_CLASS` into [`lief.MachO.DyldBindingInfo.CLASS`]( "lief.MachO.DyldBindingInfo.CLASS") - Re-scope `BIND_TYPES` into [`lief.MachO.DyldBindingInfo.TYPE`]( "lief.MachO.DyldBindingInfo.TYPE") - Re-scope `EXPORT_SYMBOL_FLAGS` into [`lief.MachO.ExportInfo.FLAGS`]( "lief.MachO.ExportInfo.FLAGS") - Re-scope `EXPORT_SYMBOL_KINDS` into [`lief.MachO.ExportInfo.KIND`]( "lief.MachO.ExportInfo.KIND") - Re-scope `RELOCATION_ORIGINS` into [`lief.MachO.Relocation.ORIGIN`]( "lief.MachO.Relocation.ORIGIN") - Re-scope `SYMBOL_ORIGINS` into [`lief.MachO.Symbol.ORIGIN`]( "lief.MachO.Symbol.ORIGIN") - Re-scope `VM_PROTECTIONS` into [`lief.MachO.SegmentCommand.VM_PROTECTIONS`]( "lief.MachO.SegmentCommand.VM_PROTECTIONS") - Re-scope `CPU_TYPES` into [`lief.MachO.Header.CPU_TYPE`]( "lief.MachO.Header.CPU_TYPE") **CMake:** - `LIEFConfig.cmake` is now installed in `/lib/cmake/LIEF/` instead of `/share/LIEF/cmake/` **Python Bindings:** - Add [`lief.disable_leak_warning()`]( "lief.disable_leak_warning") to disable Nanobind warning about “leaks”. > **Warning** > > These warnings does not necessarily mean that LIEF leak objects. These warnings might happen in [Cyclic garbage collection](). **Documentation:** - Add icons - Include inheritance diagram for Python API (e.g. [`lief.ELF.Note`]( "lief.ELF.Note")) ## [0.14.1 - February 11th, 2024]() **ELF:** - Fix regression in Symbol Version Definition processing ([#1014]()) **PE:** - Address [#1016]() by creating aliases: - [`lief.PE.ContentInfo.digest`]( "lief.PE.ContentInfo.digest") to [`lief.PE.SpcIndirectData.digest`]( "lief.PE.SpcIndirectData.digest") - [`lief.PE.ContentInfo.digest_algorithm`]( "lief.PE.ContentInfo.digest_algorithm") to [`lief.PE.SpcIndirectData.digest_algorithm`]( "lief.PE.SpcIndirectData.digest_algorithm") **Python:** - Fix regression in iterator’s performances ## [0.14.0 - January 20, 2024]() **ELF:** - Add support for the GNU note properies ([#975]()). **Example:** ```python elf = lief.ELF.parse("...") note = elf.get(lief.ELF.Note.TYPE.GNU_PROPERTY_TYPE_0) aarch64_feat: lief.ELF.AArch64Feature = note.find(lief.ELF.NoteGnuProperty.Property.TYPE.AARCH64_FEATURES) if lief.ELF.AArch64Feature.FEATURE.BTI in aarch64_feat.features: print("BTI supported") ``` See: - [`lief.ELF.NoteGnuProperty`]( "lief.ELF.NoteGnuProperty") - [`lief.ELF.AArch64Feature`]( "lief.ELF.AArch64Feature") - [`lief.ELF.NoteNoCopyOnProtected`]( "lief.ELF.NoteNoCopyOnProtected") - [`lief.ELF.StackSize`]( "lief.ELF.StackSize") - [`lief.ELF.X86Features`]( "lief.ELF.X86Features") - [`lief.ELF.X86ISA`]( "lief.ELF.X86ISA") - Refactoring of the ELF note processing - Fix relocation issue when using `-Wl,--emit-relocs` (c.f. [#897]() / [#898]() by [adamjseitz]()) - Improve the computation of the dynamic symbols thanks to [adamjseitz]() (c.f. [#922]()) - Add support for the LoongArch architecture thanks to [loongson-zn]() (c.f. [#921]()) - Add a [`lief.ELF.ParserConfig`]( "lief.ELF.ParserConfig") interface that can be used to tweak which parts of the ELF format should be parsed. **Example:** ```python config = lief.ELF.ParserConfig() # Skip parsing static and dynamic symbols config.parse_static_symbols = False config.parse_dyn_symbols = False elf = lief.ELF.parse("target.elf", config) ``` **MachO:** - The *fileset name* is now stored in [`lief.MachO.Binary.fileset_name`]( "lief.MachO.Binary.fileset_name") (instead of lief.MachO.Binary.name) **PE:** - `RESOURCE_SUBLANGS` has been removed - `RESOURCE_LANGS` is now defined in a dedicated header: `LIEF/PE/resources/langs.hpp` - `RESOURCE_TYPES` is now scoped in `ResourcesManager::TYPE` - `GUARD_CF_FLAGS` is now scoped as `IMAGE_GUARD` in `lief.PE.LoadConfigurationV1` - `SECTION_CHARACTERISTICS` is now scoped within the [`Section`]( "lief.PE.Section") class instead of being globally defined: ```python # Before lief.PE.SECTION_CHARACTERISTICS.CNT_CODE # Now: lief.PE.Section.CHARACTERISTICS.CNT_CODE ``` - `DATA_DIRECTORY` is now scoped within the [`DataDirectory`]( "lief.PE.DataDirectory") class instead of being globally defined: ```python # Before lief.PE.DATA_DIRECTORY.IAT # Now: lief.PE.DataDirectory.TYPES.IAT ``` - `MACHINE_TYPES` and `HEADER_CHARACTERISTICS` are now scoped within the [`Header`]( "lief.PE.Header") class instead of being globally defined: ```python # Before lief.PE.MACHINE_TYPES.AMD64 # Now: lief.PE.Header.MACHINE_TYPES.AMD64 ``` - [`lief.PE.Header.characteristics`]( "lief.PE.Header.characteristics") now returns a list/std::vector instead of a `set`. - [`lief.PE.OptionalHeader.dll_characteristics_lists`]( "lief.PE.OptionalHeader.dll_characteristics_lists") now returns a `list`/`std::vector` instead of a `set`. - `SUBSYSTEM` and `DLL_CHARACTERISTICS` are now scoped within the [`OptionalHeader`]( "lief.PE.OptionalHeader") class instead of being globally defined: ```python # Before lief.PE.SUBSYSTEM.NATIVE # Now: lief.PE.OptionalHeader.SUBSYSTEM.NATIVE ``` - `lief.PE.DosHeader.used_bytes_in_the_last_page` has been renamed in [`lief.PE.DosHeader.used_bytes_in_last_page`]( "lief.PE.DosHeader.used_bytes_in_last_page") - Refactoring of the Debug directory processing: [`lief.PE.Debug`]( "lief.PE.Debug") is now the root class of: [`lief.PE.CodeView`]( "lief.PE.CodeView") / [`lief.PE.CodeView`]( "lief.PE.CodeView"), [`lief.PE.Pogo`]( "lief.PE.Pogo"), [`lief.PE.Repro`]( "lief.PE.Repro"). The parsing logic has been cleaned and the tests updated. - Add a [`lief.PE.ParserConfig`]( "lief.PE.ParserConfig") interface that can be used to tweak which parts of the PE format should be parsed ([#839]()). **Example:** ```python config = lief.PE.ParserConfig() # Skip parsing PE authenticode config.parse_signature = False pe = lief.PE.parse("pe.exe", config) ``` **Abstraction:** - `LIEF::EXE_FORMATS` is now scoped in `LIEF::Binary::FORMATS` - All the Binary classes now implement classof: ```cpp std::unique_ptr bin = LIEF::Parser::parse("..."); if (LIEF::PE::Binary::classof(bin.get())) { auto& pe_file = static_cast(*bin); } ``` **General Design:** - Python parser functions (like: [`lief.PE.parse()`]( "lief.PE.parse")) now accept os.PathLike arguments like pathlib.Path ([#974]()). - Remove the lief.Binary.name attribute - LIEF is now compiled with C++17 (the API remains C++11 compliant) - Switch to [nanobind]() for the Python bindings. - CI are now more efficient. - The Python documentation for properties now contains the type of the property. ## [0.13.2 - June 17, 2023]() **PE:** Fix authenticode inconsitency ([#932]()) **ELF:** Fix missing undef ([#929]()) ## [0.13.1 - May 28, 2023]() **PE:** - Fix PE authenticode verification issue in the case of special characters ([#912]()) **Misc:** - Fix mypy stubs ([#909]()) - Fix missing include ([#918]()) - Fix C99 comments ([#916]()) - Fix AArch64 docker image ([#904]()) ## [0.13.0 - April 9, 2023]() **ELF:** - Fix overflow issue in segments (c.f. [#845]() found by [liyansong2018]()) - Fix missing relationship between symbols and sections (c.f. [#841]()) - Fix coredump parsing issue (c.f. [#830]() found by [Lan1keA]()) - Fix and (re)enable removing dynamic symbols (c.f. [#828]()) - Add support for NT\_GNU\_BUILD\_ATTRIBUTE\_OPEN and NT\_GNU\_BUILD\_ATTRIBUTE\_FUNC (c.f. [#816]()) - [CVE-2022-38497] Fix ELF core parsing issue ([#766]() found by [CCWANG19]()) - [CVE-2022-38306] Fix a heap overflow found by [CCWANG19]() ([#763]()) - [aeflores]() fixed an issue when there are multiple versions associated with a symbol (see: [#749]() for the details). - Handle binaries compiled with the -static-pie flag correctly (see: [#747]()) - Add support for modifying section-less binaries. The ELF [`Section`]( "lief.ELF.Section") objects gain the [`lief.ELF.Section.as_frame()`]( "lief.ELF.Section.as_frame") method which defines the section as a *framed* section. A framed section is a section that concretely does not wraps data and can be corrupted. **Example:** ```python elf = lief.parse("/bin/ssh") text = elf.get_section(".text").as_frame() # We can now corrupt all the fields of the section text.offset = 0xdeadc0de text.size = 0xffffff text.address = 0x123 elf.write("/tmp/out") ``` - Add API to precisely define how the segments table should be relocated. One might want to enforce a certain ELF layout while adding sections/ segments. It is now possible to call the method: [`relocate_phdr_table()`]( "lief.ELF.Binary.relocate_phdr_table") to define how the segments table should be relocated for welcoming the new sections/segments: ```python elf = lief.parse("...") # Enforce a specific relocation type: # The new segments table will be shift at the end # of the file elf.relocate_phdr_table(Binary.PHDR_RELOC.FILE_END) # Add sections/segments # [...] elf.write("out.elf") ``` See: > - [`lief.ELF.Binary.relocate_phdr_table()`]( "lief.ELF.Binary.relocate_phdr_table") > - [`lief.ELF.Binary.PHDR_RELOC`]( "lief.ELF.Binary.PHDR_RELOC") **MachO:** - Add [`rpaths`]( "lief.MachO.Binary.rpaths") iterator ([#291]()) - Add support for parsing Mach-O in memory - Fix a memory issue (found by [bladchan]() via [#806]()) - [CVE-2022-40923] Fix parsing issue ([#784]() found by [bladchan]()) - [CVE-2022-40922] Fix parsing issue ([#781]() found by [bladchan]()) - [CVE-2022-38307] Fix a segfault when the Mach-O binary does not have segments (found by [CCWANG19]() via [#764]()) - Enable to create exports - Fix the layout of the binaries modified by LIEF such as they can be (re)signed. - Add support for LC\_DYLD\_CHAINED\_FIXUPS and LC\_DYLD\_EXPORTS\_TRIE - Global enhancement when modifying the \_\_LINKEDIT content - Add API to get a [`Section`]( "lief.MachO.Section") from a specified segment’s name and section’s name. **Example:** ```python sec = bin.get_section("__DATA", "__objc_metadata") ``` - Add API to remove a [`Section`]( "lief.MachO.Section") from a specified segment’s name and section’s name. **Example:** ```python sec = bin.remove_section("__DATA", "__objc_metadata") ``` - Add `lief.MachO.Binary.page_size` **PE:** - The Python API now returns bytes objects instead of List[int] - Remove `lief.PE.ResourceNode.sort_by_id()` - Fix the ordering of children of [`ResourceNode`]( "lief.PE.ResourceNode") - Remove deprecated functions related to PE hooking. - Add support for new PE LoadConfiguration structures. **DEX:** - Fix multiple parsing issues raised by [bladchan]() **Other:** - [CVE-2022-38497]: [#765]() found by [CCWANG19]() - [CVE-2022-38495]: [#767]() found by [CCWANG19]() **General Design:** - [ZehMatt]() added the support to write LIEF binaries object through a std::ostream interface ([9d55f53]()) - Remove the exceptions - The library contains less static initializers which should improve the loading time. **Python Bindings:** - Move to a build system compliant with `pyproject.toml` - Provide typing stubs: [#650]() - PyPI releases no longer provide source distribution (sdist) **Dependencies:** - Move to spdlog 1.11.0 - Move to [Pybind11 - 2.10.1]() - Move to nlohmann/json 3.11.2 - Move to MbedTLS 3.2.1 - Move to utfcpp 3.2.1 ## [0.12.3 - November 1, 2022]() This release contains several security fixes: > - [CVE-2022-38497] Fix ELF core parsing issue ([#766]() found by [CCWANG19]()) > - [CVE-2022-38306] Fix a heap overflow found by [CCWANG19]() ([#763]()) > - Fix a memory issue (found by [bladchan]() via [#806]()) > - [CVE-2022-40923] Fix parsing issue ([#784]() found by [bladchan]()) > - [CVE-2022-40922] Fix parsing issue ([#781]() found by [bladchan]()) > - [CVE-2022-38307] Fix a segfault when the Mach-O binary does not have segments (found by [CCWANG19]() via [#764]()) ## [0.12.1 - April 08, 2022]() **ELF:** - Fix section inclusion calculations ([#692]()) **PE:** - Fix parsing regressions ([#689](), [#687](), [#686](), [#685](), [#691](), [#693]()) **Compilation:** - Nightly builds are now upload to Saleway’s S3 server: - [https://lief.s3-website.fr-par.scw.cloud/latest/lief]() - [https://lief.s3-website.fr-par.scw.cloud/latest/sdk]() - Fix GLIBCXX\_USE\_CXX11\_ABI=1 ABI issue (see: [#683]()) ## [0.12.0 - March 25, 2022]() **ELF:** - [ahaensler]() added the support to insert and assign a [`lief.ELF.SymbolVersionAuxRequirement`]( "lief.ELF.SymbolVersionAuxRequirement") (see: [#670]()) - Enhance the ELF parser to support corner cases described by [netspooky]() in : - [https://tmpout.sh/2/14.html]() (*84 byte aarch64 ELF*) - [https://tmpout.sh/2/3.html]() (*Some ELF Parser Bugs*) - New ELF Builder which is more efficient in terms of speed and in terms of number of segments added when modifying binaries (see: [https://lief-project.github.io/blog/2022-01-23-new-elf-builder/]()) - [Clcanny]() improved (see [#507]() and [#509]()) the reconstruction of the dynamic symbol table by sorting local symbols and non-exported symbols. It fixes the following warning when parsing a modified binary with `readelf` ```text Warning: local symbol 29 found at index >= .dynsym's sh_info value of 1 ``` **MachO:** - Change the layout of the binaries generated by LIEF such as they are compliant with `codesign` checks - The API to configure the MachO parser has been redesigned to provide a better granularity ```python config = lief.MachO.ParserConfig() config.parse_dyld_bindings = False config.parse_dyld_exports = True config.parse_dyld_rebases = False lief.MachO.parse("/tmp/big.macho", config) ``` - [LucaMoroSyn]() added the support for the `LC_FILESET_ENTRY`. This command is usually found in kernel cache files - `LIEF::MachO::Binary::get_symbol` now returns a pointer (instead of a reference). If the symbol can’t be found, it returns a nullptr. - Add API to select a [`Binary`]( "lief.MachO.Binary") from a [`FatBinary`]( "lief.MachO.FatBinary") by its architecture. See: [`lief.MachO.FatBinary.take()`]( "lief.MachO.FatBinary.take"). ```python fat = lief.MachO.parse("/bin/ls") fit = fat.take(lief.MachO.CPU_TYPES.x86_64) ``` - Handle the 0x0D binding opcode (see: [#524]()) - [xhochy]() fixed performances issues in the Mach-O parser (see [#579]()) **PE:** - Adding `lief.PE.OptionalHeader.computed_checksum` that re-computes the [`lief.PE.OptionalHeader.checksum`]( "lief.PE.OptionalHeader.checksum") (c.f. issue [#660]()) - Enable to recompute the [`RichHeader`]( "lief.PE.RichHeader") (issue: [#587]()) - [`raw()`]( "lief.PE.RichHeader.raw") - [`hash()`]( "lief.PE.RichHeader.hash") - Add support for PE’s delayed imports. see: - [`DelayImport`]( "lief.PE.DelayImport") / [`DelayImportEntry`]( "lief.PE.DelayImportEntry") - [`delay_imports`]( "lief.PE.Binary.delay_imports") - [`lief.PE.LoadConfiguration.reserved1`]( "lief.PE.LoadConfiguration.reserved1") has been aliased to [`lief.PE.LoadConfiguration.dependent_load_flags`]( "lief.PE.LoadConfiguration.dependent_load_flags") - [`lief.PE.LoadConfiguration.characteristics`]( "lief.PE.LoadConfiguration.characteristics") has been aliased to [`lief.PE.LoadConfiguration.size`]( "lief.PE.LoadConfiguration.size") - Thanks to [gdesmar](), we updated the PE checks to support PE files that have a corrupted [`lief.PE.OptionalHeader.magic`]( "lief.PE.OptionalHeader.magic") (cf. [#644]()) **DEX:** - [DanielFi]() added support for DEX’s fields (see: [#547]()) **Abstraction:** - Abstract binary imagebase for PE, ELF and Mach-O ([`lief.Binary.imagebase`]( "lief.Binary.imagebase")) - Add [`lief.Binary.offset_to_virtual_address()`]( "lief.Binary.offset_to_virtual_address") - Add PE imports/exports as *abstracted* symbols **Compilation & Integration:** - [ekilmer]() updated and modernized the CMake integration files through the PR: [#674]() - Enable to use a pre-compiled version of spdlog. This feature aims at improving compilation time when developing on LIEF. One can provide path to spdlog install through: ```console $ python ./setup.py --spdlog-dir=path/to/lib/cmake/spdlog [...] # or $ cmake -DLIEF_EXTERNAL_SPDLOG=ON -Dspdlog_DIR=path/to/lib/cmake/spdlog ... ``` - Enable to feed LIEF’s dependencies externally (c.f. [Third Party]()) - Replace the keywords `and`, `or`, `not` with `&&`, `||` and `!`. **Dependencies:** - Upgrade to MbedTLS 3.1.0 - Upgrade Catch2 to 2.13.8 - The different dependencies can be *linked* externally (cf. above and [Third Party]()) **Documentation:** - New section about the errors handling ( [Error Handling]()) and the upcoming deprecation of the exceptions. - New section about how to compile LIEF for debugging/developing. See: [Debugging]() **General Design:** **span:** LIEF now exposes Section/Segment’s data through a span interface. As std::span is available in the STL from C++20 and the LIEF public API aims at being C++11 compliant, we expose this span thanks to [tcbrindle/span](). This new interface enables to avoid copies of `std::vector` which can be costly. With this new interface, the original `std::vector` can be retrieved as follows: ```cpp auto bin = LIEF::ELF::Parser::parse("/bin/ls"); if (const auto* section = bin->get_section(".text")) { LIEF::span text_ref = section->content(); std::vector copy = {std::begin(text_ref), std::end(text_ref)}; } ``` In Python, span are wrapped by a **read-only** [memory view](). The original *list of bytes* can be retrieved as follows: ```python bin = lief.parse("/bin/ls") section = bin.get_section(".text") if section is not None: memory_view = section.content list_of_bytes = list(memory_view) ``` **Exceptions:** > **Warning** > > We started to refactor the API and the internal design to remove C++ exceptions. These changes are described a the dedicated blog ([LIEF RTTI & Exceptions]()) > > To highlighting the content of the blog for the end users, functions that returned a **reference and which threw an exception** in the case of a failure are now returning a **pointer that is set to nullptr** in the case of a failure. > > If we consider this original code: > > ```cpp > LIEF::MachO::Binary& bin = ...; > > try { > LIEF::MachO::UUIDCommand& cmd = bin.uuid(); > std::cout << cmd << "\n"; > } catch (const LIEF::not_found&) { > // ... dedicated processing > } > > // Other option with has_uuid() > if (bin.has_uuid()) { > LIEF::MachO::UUIDCommand& cmd = bin.uuid(); > std::cout << cmd << "\n"; > } > ``` > > It can now be written as: > > ```cpp > LIEF::MachO::Binary& bin = ...; > > if (LIEF::MachO::UUIDCommand* cmd = bin.uuid();) { > std::cout << *cmd << "\n"; > } else { > // ... dedicated processing as it is a nullptr > } > > // Other option with has_uuid() > if (bin.has_uuid()) { // It ensures that it is not a nullptr > LIEF::MachO::UUIDCommand& cmd = *bin.uuid(); > std::cout << cmd << "\n"; > } > ``` > **See also** > > - [Error Handling section]() > - [List of the functions that changed]() ## [0.11.X - Patch Releases]() ### [0.11.5 - May 22, 2021]() - Remove usage of `not` in public headers ([b8e825b]()) **ELF:** - [pdreiter]() fixed the issue [#418]() **PE:** - Fix issue when computing [`lief.PE.Binary.sizeof_headers`]( "lief.PE.Binary.sizeof_headers") ([ab3f073]()) **MachO:** - Fix error on property [`lief.MachO.BuildVersion.sdk`]( "lief.MachO.BuildVersion.sdk") (see [#533]()) ### [0.11.4 - March 09, 2021]() **PE:** - Fix missing bound check when computing the authentihash ### [0.11.3 - March 03, 2021]() **PE:** - Add sanity check on the signature’s length that could lead to a `std::bad_alloc` exception ### [0.11.2 - February 24, 2021]() **PE:** - Fix regression in the behavior of the PE section’s name. One can now access the full section’s name (with trailing bytes) through `lief.PE.Section.fullname` (see: [#551]()) ### [0.11.1 - February 22, 2021]() **PE:** - [`lief.PE.x509.is_trusted_by()`]( "lief.PE.x509.is_trusted_by") and [`lief.PE.x509.verify()`]( "lief.PE.x509.verify") now return a better [`lief.PE.x509.VERIFICATION_FLAGS`]( "lief.PE.x509.VERIFICATION_FLAGS") instead of just [`lief.PE.x509.VERIFICATION_FLAGS.BADCERT_NOT_TRUSTED`]( "lief.PE.x509.VERIFICATION_FLAGS.BADCERT_NOT_TRUSTED") (see: [#532]()) - Fix errors in the computation of the Authentihash ## [0.11.0 - January 19, 2021]() **ELF:** - [mkomet]() updated enums related to Android (see: [9dd641d]()) - [aeflores]() added MIPS relocations support in the ELF parser - Fix [`extend()`]( "lief.ELF.Binary.extend") on a ELF section (cf. issue [#477]()) - Fix issue when exporting symbols on empty-gnu-hash ELF binary ([1381f9a]()) - Fix reconstruction issue when the binary is prelinked (cf. issue [#466]()) - Add `DF_1_PIE` flag - Fix parsing issue of the `.eh_frame` section when the base address is not 0. - [JanuszL]() enhanced the algorithm that computes the string table. It moves from a `N^2` algorithm to a `Nlog(N)` ([1e0c4e8]()). - Fix `.eh_frame` parsing issue ([b57f323]()) - [aeflores]() fixed parsing issue in ELF relocations ([6c53646]()) - Add `PT_GNU_PROPERTY` enum - Bug fix in the symbols table reconstruction (ELF) **PE:** - Enhance PE Authenticode. See [PE Authenticode]() - [`get_imphash()`]( "lief.PE.get_imphash") can now generate the same value as pefile and Virus Total ([#299]()) ```python pe = lief.parse("example.exe") vt_imphash = lief.PE.get_imphash(pe, lief.PE.IMPHASH_MODE.PEFILE) lief_imphash = lief.PE.get_imphash(pe, lief.PE.IMPHASH_MODE.DEFAULT) ``` > **See also** > > [`lief.PE.IMPHASH_MODE`]( "lief.PE.IMPHASH_MODE") and [`lief.PE.get_imphash()`]( "lief.PE.get_imphash") - Remove the padding entry (0) from the rich header - `lief.PE.LangCodeItem.items` now returns a dictionary for which the values are **bytes** (instead of `str` object). This change is related to `utf-16` support. - [kohnakagawa]() fixed wrong enums values: [c031250](), [6ee808a](), [cd05f34]() - [kohnakagawa]() fixed a bug in the PE resources parser ([a7254d1]()) - Handle PE forwarded exports (issue [#307]()) **Mach-O:** - Add API to access either `LC_CODE_SIGNATURE` or `DYLIB_CODE_SIGN_DRS` (issue [#476]()) - Fix issue when parsing twice a Mach-O file (issue [#479]()) **Dependencies:** - Replace `easyloggingpp` with [spdlog 1.8.1]() - Upgrade `frozen` to 1.0.0 - Upgrade `json` to 3.7.3 - Upgrade `pybind11` to 2.6.0 - Upgrade `mbedtls` to 2.16.6 **Documentation:** - [aguinet]() updated the [bin2lib tutorial]() with the support of the new glibc versions ([7884e57]()) - Global update and enable to build the documentation out-of-tree - Changing the theme **Misc:** - Add Python 3.9 support - `FindLIEF.cmake` deprecates `LIEF_ROOT`. You should use `LIEF_DIR` instead. **Logging:** We changed the logging interface. The following log levels have been removed: - LOG\_GLOBAL - LOG\_FATAL - LOG\_VERBOSE - LOG\_UNKNOWN We also moved from an class-interface based to functions. Example: ```python lief.logging.disable() lief.logging.enable() lief.logging.set_level(lief.logging.LEVEL.INFO) ``` See: [`lief.logging.set_level()`]( "lief.logging.set_level") > **Note** > > The log functions now output on `stderr` instead of `stdout` ## [0.10.1 - November 29, 2019]() - Fix regression in parsing Python `bytes` - Add Python API to demangle strings: `lief.demangle` ## [0.10.0 - November 24, 2019]() **ELF:** - Add build support for ELF notes - Add coredump support ([9fc3a8a]()) - Enable to bind a relocation with a symbol ([a9f3cb8]()) **Example:** ```python relocation = "..." symbol = lief.ELF.Symbol() symbol.name = "printf123" relocation.symbol = symbol ``` - Add constructors ([67d924a]()) - Expose ELF destructors ([957384c]()) - Add `remove_static_symbol` ([c677970]()) - Add support for static relocation writing ([d1b98d6]()) - Expose function to get strings located in the `.rodata` section ([02f4851]()) - Export ELF ABI version ([8d7ec26]()) **PE:** - Improve PE Authenticode parsing ([535623d]()) - Fix alignment issue when removing a PE section ([04dddd3]()) - Parse PE debug data directory as a list of debug entries (by [1orenz0]() - [fcc75dd]()) - Add support to parse POGO debug entries (by [1orenz0]() - [3537440]()) **Mach-O:** - Enhance Mach-O modifications by exposing an API to: - Add load commands - Add sections - Add segments See: [406115c]() - Enable `write()` on FAT Mach-O ([1659531]()) - Introduce Mach-O Build Version command ([6f96723]()) - Enable to remove Mach-O symbols ([616d739]()) - Add support for adding `LC_UNIXTHREAD` commands in a MachO (by [nezetic]() - [64d2597]()) **Abstract Layer:** - Expose `remove_section()` in the abstract layer ([918438c]()) - Expose `write()` in the abstract layer ([af4d48e]()) - Expose API to list functions found in a binary ([b5a0846]()) **Android:** - Add partial support for Android 9 ([bce9ebe]()) **Misc:** - [lkollar]() added support for Python 3.8 in CI (Linux & OSX only) - Update Pybind11 dependency to `v2.4.3` - Enhance Python install - Thanks to [lkollar](), Linux CI now produces **manylinux1-compliant wheels** Many thanks to the contributors: [recvfrom](), [pbrunet](), [mackncheesiest](), [wisk](), [nezetic](), [lkollar](), [jbremer](), [DaLynX](), [1orenz0](), [breadchris](), [0xbf00](), [unratito](), [strazzere](), [aguinetqb](), [mingwandroid](), [serge-sans-paille-qb](), [yrp604](), [majin42](), [KOLANICH]() ## [0.9.0 - June 11, 2018]() LIEF 0.9 comes with new formats related to Android: OAT, DEX, VDEX and ART. It also fixes bugs and thanks to [yd0b0N](), ELF parser now supports big and little endian binaries. We also completed the JSON serialization of LIEF objects. ### [Features]() **MachO:** - Enable to configure the Mach-O parser for quick parsing: [880b99a]() - Add [`lief.MachO.EncryptionInfo`]( "lief.MachO.EncryptionInfo") command: [f4e2d81]() - Add [`lief.MachO.RPathCommand`]( "lief.MachO.RPathCommand") command: [196994d]() - Add [`lief.MachO.DataInCode`]( "lief.MachO.DataInCode") command: [a16e1c4]() - Add [`lief.MachO.SubFramework`]( "lief.MachO.SubFramework") command: [9e3b5b4]() - Add [`lief.MachO.SegmentSplitInfo`]( "lief.MachO.SegmentSplitInfo") command: [9e3b5b4]() - Add [`lief.MachO.DyldEnvironment`]( "lief.MachO.DyldEnvironment") command: [9e3b5b4]() - API to show export-trie, rebase and binding opcodes: [5d56141]() **PE:** - Add PE Code View: [eab4a76]() **ELF:** - Add support for `.note.android.ident` section: [d13db18]() - Enable to add unlimited number of dynamic entries: [a40da3e]() - Add support for PPC relocations: [08b5141]() - Endianness support: [e794ac1]() ### [API]() > - `lief.breakp()` and `lief.shell()` > - [`lief.parse()`]( "lief.parse") now support `io` streams as input > - Parser now returns a `std::unique_ptr` instead of a raw pointer: [cd1cc45]() ### [Misc]() - Use [frozen]() for some internal `std::map` (If C++14 is supported by the compiler) ### [Acknowledgments]() - [yd0b0N]() for [#162]() and [#166]() (Endianness support and PPC relocations) - [0xbf00]() for [#128]() (`LC_RPATH` command) - [illera88]() for [#118]() ## [0.8.3]() - [Mach-O] Fix typo on comparison operator - [abbc264]() ## [0.8.2]() - [ELF] Increase the upper limit of relocation number - [077bc32]() ## [0.8.1 - October 18, 2017]() - Fix an alignment issue in the ELF builder. See [8db199c]() - Add assertion on the setuptools version: [62e5825]() ## [0.8.0 - October 16, 2017]() LIEF 0.8.0 mainly improves the MachO parser and the ELF builder. It comes with [Dockerfiles]() for [CentOS]() and [Android](). [LibFuzzer]() has also been integrated in the project to enhance the parsers ### [Features]() **Abstract Layer:** - [`Relocation`]( "lief.Relocation") are now abstracted from the 3 formats - [9503f2f]() - `PIE` and `NX` are abstracted through the [`is_pie`]( "lief.Binary.is_pie") and [`has_nx`]( "lief.Binary.has_nx") properties - Add the [`lief.Section.search()`]( "lief.Section.search") and [`lief.Section.search_all()`]( "lief.Section.search_all") methods to look for patterns in the section’s content. **ELF:** - `DT_FLAGS` and `DT_FLAGS_1` are now parsed into [`DynamicEntryFlags`]( "lief.ELF.DynamicEntryFlags") - [754b8af]() - Handle relocations of object files (`.o`) - [483b8dc]() - Global enhancement of the ELF builder: One can now add **multiple** [`Section`]( "lief.ELF.Section") or [`Segment`]( "lief.ELF.Segment") into an ELF: ```python elf = lief.parse("/bin/cat") for i in range(3): segment = Segment() segment.type = SEGMENT_TYPES.LOAD segment.content = [i & 0xFF] * 0x1000 elf += segment for i in range(3): section = Section("lief_{:02d}".format(i)) section.content = [i & 0xFF] * 0x1000 elf += section elf.write("foo") ``` ```console $ readelf -l ./foo PHDR 0x0000000000000040 0x0000000000000040 0x0000000000000040 0x00000000000061f8 0x00000000000061f8 R E 0x8 INTERP 0x0000000000006238 0x0000000000006238 0x0000000000006238 0x000000000000001c 0x000000000000001c R 0x1 [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2] LOAD 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x000000000000d6d4 0x000000000000d6d4 R E 0x200000 LOAD 0x000000000000da90 0x000000000020da90 0x000000000020da90 0x0000000000000630 0x00000000000007d0 RW 0x200000 LOAD 0x000000000000f000 0x000000000040f000 0x000000000040f000 0x0000000000001000 0x0000000000001000 0x1000 LOAD 0x0000000000010000 0x0000000000810000 0x0000000000810000 0x0000000000001000 0x0000000000001000 0x1000 LOAD 0x0000000000011000 0x0000000001011000 0x0000000001011000 0x0000000000001000 0x0000000000001000 0x1000 .... $ readelf -S ./foo ... [27] lief_00 PROGBITS 0000000002012000 00012000 0000000000001000 0000000000000000 0 0 4096 [28] lief_01 PROGBITS 0000000004013000 00013000 0000000000001000 0000000000000000 0 0 4096 [29] lief_02 PROGBITS 0000000008014000 00014000 0000000000001000 0000000000000000 0 0 4096 ``` > **Warning** > > There are issues with executables statically linked with libraries that use `TLS` > > See: [#98]() One can now add **multiple** entries in the dynamic table: ```python elf = lief.parse("/bin/cat") elf.add_library("libfoo.so") elf.add(DynamicEntryRunPath("$ORIGIN")) elf.add(DynamicEntry(DYNAMIC_TAGS.INIT, 123)) elf.add(DynamicSharedObject("libbar.so")) elf.write("foo") ``` ```console $ readelf -d foo 0x0000000000000001 (NEEDED) Shared library: [libfoo.so] 0x0000000000000001 (NEEDED) Shared library: [libc.so.6] 0x000000000000000c (INIT) 0x7b 0x000000000000000c (INIT) 0x3600 ... 0x000000000000001d (RUNPATH) Bibliothèque runpath:[$ORIGIN] 0x000000000000000e (SONAME) Bibliothèque soname: [libbar.so] ``` See [b94900c](), [1e410e6]() for details. - [b2d3694]() enables modification of the ELF interpreter without **length restriction** ```python elf = lief.parse("/bin/cat") elf.interpreter = "/a/very/long/path/to/another/interpreter" elf.write("foo") ``` ```console $ readelf -l foo Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align PHDR 0x0000000000000040 0x0000000000000040 0x0000000000000040 0x00000000000011f8 0x00000000000011f8 R E 0x8 INTERP 0x000000000000a000 0x000000000040a000 0x000000000040a000 0x0000000000001000 0x0000000000001000 R 0x1 [Requesting program interpreter: /a/very/long/path/to/another/interpreter] .... ``` - Enhancement of the dynamic symbols counting - [985d124]() - Enable editing ELF’s notes: ```python elf = lief.parse("/bin/ls") build_id = elf[NOTE_TYPES.BUILD_ID] build_id.description = [0xFF] * 20 elf.write("foo") ``` ```console $ readelf -n foo Displaying notes found in: .note.gnu.build-id Owner Data size Description GNU 0x00000014 NT_GNU_BUILD_ID (unique build ID bitstring) Build ID: ffffffffffffffffffffffffffffffffffffffff ``` See commit [3be9dd0]() for more details **PE:** - Add [`get_imphash()`]( "lief.PE.get_imphash") and [`resolve_ordinals()`]( "lief.PE.resolve_ordinals") functions - [a89bc6d](), [dfa8e98]() - Parse the *Load Config Table* into [`LoadConfiguration`]( "lief.PE.LoadConfiguration") (up to Windows 10 SDK 15002 with *hotpatch\_table\_offset*) ```python from lief import to_json import json pe = lief.parse("some.exe") loadconfig = to_json(pe.load_configuration)) # Using the lief.to_json function pprint(json.loads(to_json(loadconfig))) ``` ```javascript {'characteristics': 248, 'code_integrity': {'catalog': 0, 'catalog_offset': 0, 'flags': 0, 'reserved': 0}, 'critical_section_default_timeout': 0, 'csd_version': 0, 'editlist': 0, ... 'guard_cf_check_function_pointer': 5368782848, 'guard_cf_dispatch_function_pointer': 5368782864, 'guard_cf_function_count': 15, 'guard_cf_function_table': 5368778752, 'guard_flags': 66816, 'guard_long_jump_target_count': 0, 'guard_long_jump_target_table': 0, 'guard_rf_failure_routine': 5368713280, 'guard_rf_failure_routine_function_pointer': 5368782880, ... ``` For details, see commit: [0234e3b]() **MachO:** - The `dyld` structure is parsed (deeply) into [`DyldInfo`]( "lief.MachO.DyldInfo"). It includes: - Binding opcodes - Rebases opcodes - Export trie See: [e2b81e0](), [0e972d6](), [f7cc518](), [782295b](), [#67]() - Section relocations are now parsed into [`lief.MachO.Section.relocations`]( "lief.MachO.Section.relocations") - [29c8157]() - `LC_FUNCTION_STARTS` is parsed into [`FunctionStarts`]( "lief.MachO.FunctionStarts") ([18d8919]()) - `LC_SOURCE_VERSION`, `LC_VERSION_MIN_MACOSX` and `LC_VERSION_MIN_IPHONEOS` are parsed into [`SourceVersion`]( "lief.MachO.SourceVersion") and [`VersionMin`]( "lief.MachO.VersionMin") ([c359778](), [0b4bb7d](), [5b99311](), [#45]()) - `LC_THREAD` and `LC_UNIXTHREAD` are now parsed into [`ThreadCommand`]( "lief.MachO.ThreadCommand") - [2325783]() ### [Fixes]() Fix enums conflicts([#32]()) - [66b4cd4]() Fix most of the memory leaks: [88dafa8](), [d9b1436](), [554fa15](), [3602643]() **ELF:** - Bug Fix when counting dynamic symbols from the GnuHash Table - [9036a24]() **PE:** - Fix nullptr dereference in resources - [e90fe1b]() - Handle encoding issues in the Python API - [8c7ceaf]() - Sanitize DLL names **MachO:** - Fix [#87](), [#92]() - Fix memory leaks and *some* performance issues: [#94]() ### [API]() In the C++ API `get_XXX()` getters have been renamed into `XXX()` (e.g. `get_header()` becomes `header()`) - [a4c69f7](), [e805669]() **Abstract:** - [`lief.Binary`]( "lief.Binary") gains the [`format`]( "lief.Binary.format") property - [9391238]() - [`lief.parse()`]( "lief.parse") can now takes a list of integers - [f330fa8]() - Add [`has_symbol()`]( "lief.Binary.has_symbol") and [`get_symbol()`]( "lief.Binary.get_symbol") to [`lief.Binary`]( "lief.Binary") - [f121af5]() - [Python API] Enhance the access to the abstract layer through the [`abstract`]( "lief.Binary.abstract") attribute - [0713854]() One can now do: ```python elf = lief.ELF.parse("/bin/ls") # Could be lief.MachO / lief.PE abstract = elf.abstract # Return the lief.Binary object ``` **ELF:** - Relocation gains the [`purpose`]( "lief.ELF.Relocation.purpose") property - [b7b0bde]() - Add [`lief.ELF.Binary.symbols`]( "lief.ELF.Binary.symbols") which return an iterator over **all** symbols (static and dynamic) - [af6ab65]() - `Header.sizeof_section_header` has been renamed into [`section_header_size`]( "lief.ELF.Header.section_header_size") - [d96971b]() - `Segment.flag` has been renamed into [`flags`]( "lief.ELF.Segment.flags") - [20a5f66]() - Add: - `arm_flags_list`, - `mips_flags_list` - `ppc64_flags_list` - `hexagon_flags_list` to [`Header`]( "lief.ELF.Header") - [730d045]() To check if a given flag is set, one can do: ```python >>> if lief.ELF.ARM_EFLAGS.EABI_VER5 in lief.ELF.Header "yes" else "no" ``` - [Python] Segment flags: `PF_X`, `PF_W`, `PF_X` has been renamed into `X`, `W`, `X` - [d70ef9e]() - Add [`lief.ELF.Section.flags_list`]( "lief.ELF.Section.flags_list") - [4937b71]() - Enhancement for [`DynamicEntryRpath`]( "lief.ELF.DynamicEntryRpath") and [`DynamicEntryRunPath`]( "lief.ELF.DynamicEntryRunPath"): [c375a47]() - Enhancement for [`DynamicEntryArray`]( "lief.ELF.DynamicEntryArray"): [81440ce]() - Add some *operators* [3b200b3](), [43bd06f]() **PE:** - Add some *operators* [5666351]() **MachO:** - [`lief.MachO.parse()`]( "lief.MachO.parse") can now takes a list of integers - [f330fa8]() - [`lief.MachO.parse()`]( "lief.MachO.parse") now returns a [`FatBinary`]( "lief.MachO.FatBinary") instead of a `list` of [`Binary`]( "lief.MachO.Binary"). [`FatBinary`]( "lief.MachO.FatBinary") has a similar API as a list - [3602643]() - Add some *operators*: [cbe8354]() **Logging:** Add an API to configure the logger - [4600c2b]() Example: ```python from lief import Logger Logger.disable() Logger.enable() Logger.set_level(lief.LEVEL.INFO) ``` See: `lief.Logger` ### [Build system]() - Add [`FindLIEF.cmake`]() - [6dd8b10]() - Add ASAN, TSAN, USAN, LSAN - [7f6aeb0]() - Add LibFuzzer - [7a0dc28]() ### [Documentation]() **References:** - recomposer, bearparser, IAT\_patcher, PEframe, Manalyze, MachOView, elf-dissector ### [Acknowledgments]() - [alvarofe]() for [#47]() - [aguinet]() for [#55](), [#61](), [#65](), [#77]() - [jevinskie]() for [#75]() - [liumuqing]() for [#80]() - [Manouchehri]() for [#106]() ## [0.7.0 - July 3, 2017]() ### [Features]() **Abstract Layer:** - Add bitness (32bits / 64bits) - [78d1adb]() - Add object type (Library, executable etc) - [78d1adb]() - Add *mode* Thumbs, 16bits etc - [78d1adb]() - Add endianness - [7ea08f7](), [#29]() **ELF:** - Enable dynamic symbols permutation - [2dea7cb]() - Fully handle section-less binaries - [de40c06]() - Parse ELF notes - [241aac7]() - Parse SYSV hash table - [afa74ce](), [#36]() - Add relocation size - [f1766f2]() **PE:** - Parse PE Overlay - [e0634c1]() - Enable PE Hooking - [24f6b72]() - Parse and rebuilt dos stub - [3f06397]() - Add a *resources manager* to provide an enhanced API over the resources - [8473c8e]() - Serialize PE objects into JSON - [673f5a3](), [#18]() - Parse Rich Header - [0893bd9](), [#15]() ### [Bug Fixes]() **ELF:** - Bug fix when a GNU hash has empty buckets - [21a6c30]() **PE:** - Bug fix in the signature parser: [#30](), [4af0256]() - Bug fix in the resources parser: Infinite loop - [a569cc1]() - Add more *out-of-bounds* checks on relocations and exports - [9364f64]() - Use `min(SizeOfRawData, VirtualSize)` for the section’s size and truncate the size to the file size - [61bf14b]() **MachO:** - Bug fix when a binary hasn’t a `LC_MAIN` command - [957501f]() ### [API]() **Abstract Layer:** - [`lief.Header.is_32`]( "lief.Header.is_32") and [`lief.Header.is_64`]( "lief.Header.is_64") - [`lief.Header.object_type`]( "lief.Header.object_type") - [`lief.Header.modes`]( "lief.Header.modes") - [`lief.Header.endianness`]( "lief.Header.endianness") **ELF:** - [`lief.ELF.Binary.permute_dynamic_symbols()`]( "lief.ELF.Binary.permute_dynamic_symbols") - `lief.ELF.Segment.data` has been renamed to [`lief.ELF.Segment.content`]( "lief.ELF.Segment.content") - [`lief.ELF.parse()`]( "lief.ELF.parse") takes an optional parameters: symbol counting - `lief.ELF.DYNSYM_COUNT_METHODS` - `lief.ELF.Relocation.size` **Notes:** - [`lief.ELF.Note`]( "lief.ELF.Note") - [`lief.ELF.Binary.has_notes`]( "lief.ELF.Binary.has_notes") - [`lief.ELF.Binary.notes`]( "lief.ELF.Binary.notes") **Hash Tables:** - [`lief.ELF.SysvHash`]( "lief.ELF.SysvHash") - [`lief.ELF.Binary.use_gnu_hash`]( "lief.ELF.Binary.use_gnu_hash") - [`lief.ELF.Binary.use_sysv_hash`]( "lief.ELF.Binary.use_sysv_hash") - [`lief.ELF.Binary.sysv_hash`]( "lief.ELF.Binary.sysv_hash") **PE:** - `lief.PE.Symbol.has_section` - `lief.PE.Binary.hook_function()` - `lief.PE.Binary.get_content_from_virtual_address()` takes either an **Absolute** virtual address or a **Relative** virtual address - `lief.PE.Binary.section_from_virtual_address` has been renamed to [`lief.PE.Binary.section_from_rva()`]( "lief.PE.Binary.section_from_rva"). - `lief.PE.parse_from_raw` has been removed. One can use [`lief.PE.parse()`]( "lief.PE.parse"). - `lief.PE.Section.data` has been **removed**. Please use `lief.PE.Section.content` **Dos Stub:** - [`lief.PE.Binary.dos_stub`]( "lief.PE.Binary.dos_stub") - `lief.PE.Builder.build_dos_stub` **Rich Header:** - [`lief.PE.Binary.rich_header`]( "lief.PE.Binary.rich_header") - [`lief.PE.Binary.has_rich_header`]( "lief.PE.Binary.has_rich_header") - [`lief.PE.RichHeader`]( "lief.PE.RichHeader") - [`lief.PE.RichEntry`]( "lief.PE.RichEntry") **Overlay:** - [`lief.PE.Binary.overlay`]( "lief.PE.Binary.overlay") - `lief.PE.Builder.build_overlay` **Imports:** - [`lief.PE.Binary.has_import`]( "lief.PE.Binary.has_import") - [`lief.PE.Binary.get_import()`]( "lief.PE.Binary.get_import") **Resources:** - [`lief.PE.Binary.resources`]( "lief.PE.Binary.resources") - [`lief.PE.ResourceData`]( "lief.PE.ResourceData") - [`lief.PE.ResourceDirectory`]( "lief.PE.ResourceDirectory") - [`lief.PE.ResourceNode`]( "lief.PE.ResourceNode") - `lief.PE.LangCodeItem` - [`lief.PE.ResourceDialog`]( "lief.PE.ResourceDialog") - `lief.PE.ResourceDialogItem` - `lief.PE.ResourceFixedFileInfo` - [`lief.PE.ResourceIcon`]( "lief.PE.ResourceIcon") - [`lief.PE.ResourceStringFileInfo`]( "lief.PE.ResourceStringFileInfo") - [`lief.PE.ResourceVarFileInfo`]( "lief.PE.ResourceVarFileInfo") - [`lief.PE.ResourceVersion`]( "lief.PE.ResourceVersion") **MachO:** - [`lief.MachO.Binary.has_entrypoint`]( "lief.MachO.Binary.has_entrypoint") - [`lief.MachO.Symbol.demangled_name`]( "lief.MachO.Symbol.demangled_name") **UUID:** - [`lief.MachO.Binary.has_uuid`]( "lief.MachO.Binary.has_uuid") - [`lief.MachO.Binary.uuid`]( "lief.MachO.Binary.uuid") - [`lief.MachO.UUIDCommand`]( "lief.MachO.UUIDCommand") **Main Command:** - [`lief.MachO.Binary.has_main_command`]( "lief.MachO.Binary.has_main_command") - [`lief.MachO.Binary.main_command`]( "lief.MachO.Binary.main_command") - [`lief.MachO.MainCommand`]( "lief.MachO.MainCommand") **Dylinker:** - [`lief.MachO.Binary.has_dylinker`]( "lief.MachO.Binary.has_dylinker") - [`lief.MachO.Binary.dylinker`]( "lief.MachO.Binary.dylinker") - [`lief.MachO.DylinkerCommand`]( "lief.MachO.DylinkerCommand") ### [Documentation]() **References:** - elfsteem, pelook, PortEx, elfsharp, metasm, amoco, Goblin **Tutorials:** - [PE Hooking](), [Resources Manipulation]() **Integration:** - [XCode](), [CMake]() ### [Acknowledgments]() - [ek0](): [#24]() - [ACSC-CyberLab](): [#33](), [#34](), [#37](), [#39]() - Hyrum Anderson who pointed bugs in the PE parser - My colleagues for the feedback and suggestions (Adrien, SebK, Pierrick) ## [0.6.1 - April 6, 2017]() ### [Bug Fixes]() **ELF:** - Don’t rely on [`lief.ELF.Section.entry_size`]( "lief.ELF.Section.entry_size") to count symbols - [004c676]() ### [API]() **PE:** - [`lief.PE.TLS.has_section`]( "lief.PE.TLS.has_section") - [`lief.PE.TLS.has_data_directory`]( "lief.PE.TLS.has_data_directory") ### [Documentation]() **Integration:** - [Visual Studio]() ### [Acknowledgments]() - [Philippe]() for the proofreading. ## [0.6.0 - March 30, 2017]() First public release --- documentID: "7ba08b30511fc562a90edcc95b2b926281cabafc34807b1977c6e038151201f6" docname: "changelog/pe-0-17-0" title: "PE Changelog for LIEF 0.17.0 - LIEF Documentation" description: "PE Changelog for LIEF 0.17.0. Compared to LIEF v0.16.x, version 0.17.0 includes a significant refactoring of the PE parser and builder. These changes were…" canonical: "https://lief.re/doc/latest/changelog/pe-0-17-0.html" markdownURL: "https://lief.re/doc/latest/changelog/pe-0-17-0.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "12ff98b83fd096f93e49557274dc301e026c835f167a6f760c2f64cf6bf1f61f" --- # [PE Changelog for LIEF 0.17.0]() Compared to LIEF v0.16.x, version 0.17.0 includes a significant refactoring of the PE parser and builder. These changes were necessary to align LIEF’s PE functionality with its ELF and Mach-O counterparts. If your codebase uses LIEF to process PE binaries, you may encounter issues when upgrading to LIEF 0.17.0. This page provides a comprehensive overview of the various changes, but it cannot cover every detail. If you encounter an API issue that is not described here, you can: 1. Join our Discord server and ask your questions: [https://discord.gg/jGQtyAYChJ]() 2. Review the git diff of the tests. Most of these changes are covered by tests, so you should be able to find a relevant example. 3. Email me at: `me[at]romainthomas.fr` ## [PE Modifications]() To explore the new modification features, you can check the following pages: - [Imports Modification]() - [Resources Modification]() - [TLS Modification]() - [Debug Modification]() - [Exports Modification]() ## [COFF String & COFF Symbol]() As described in issue [#1043](), if a section name exceeds 8 bytes, the linker may allocate a longer name in the COFF string pool while setting the section’s name with the offset in the COFF string pool. You can access this COFF string using `lief.PE.Section.coff_string` ( [`lief::pe::Section::coff_string`]() ; [`lief.PE.Section.coff_string`]() ; [`LIEF::PE::Section::coff_string()`]() ), while the string representing the offset (e.g., `/230`) remains in the section’s name. Additionally, optional COFF symbols, along with any auxiliary symbols, are now processed correctly by LIEF: ```python import lief pe = lief.PE.parse("libLIEF.dll") section = pe.sections[10] print(section.name) # --> '/19' print(section.coff_string) # --> '.debug_info' for symbol in pe.symbols: print(symbol.name) for aux in symbol.auxiliary_symbols: print(aux) ``` Although this example is written in Python, the API is also available in C++ and Rust. ## [Load Configuration]() The `IMAGE_LOAD_CONFIG_DIRECTORY` structures, represented in LIEF by `lief.PE.LoadConfiguration` ( [`lief::pe::LoadConfiguration`]() ; [`lief.PE.LoadConfiguration`]() ; [`LIEF::PE::LoadConfiguration`]() ), regularly evolve with new Windows releases. New Windows versions may introduce attributes for additional functionality, such as Control Flow Guard. To manage these changes, `lief.PE.LoadConfiguration` ( [`lief::pe::LoadConfiguration`]() ; [`lief.PE.LoadConfiguration`]() ; [`LIEF::PE::LoadConfiguration`]() ) previously used a form of inheritance. For each new attribute, a new class, such as `LoadConfigurationV12`, would inherit from `LoadConfigurationV11`. This approach, though systematic, resulted in numerous modifications – especially in Rust – raising questions about the decision to use inheritance. Starting with LIEF v0.17.0, `lief.PE.LoadConfiguration` ( [`lief::pe::LoadConfiguration`]() ; [`lief.PE.LoadConfiguration`]() ; [`LIEF::PE::LoadConfiguration`]() ) has adopted a **flat** representation. In this new model, version-dependent attributes are represented with an `option<>`-like container. **Python** ```python import lief pe = lief.PE.parse("demo.exe") offset: Optional[int] = pe.load_configuration.hotpatch_table_offset ``` **C++** ```cpp auto pe = LIEF::PE::Parser::parse("demo.exe"); if (const LoadConfiguration* lconf = pe->load_configuration()) { LIEF::optional offset = lconf->hotpatch_table_offset(); } ``` **Rust** ```rust if let Some(lief::Binary::PE(pe)) = lief::Binary::parse("demo.exe") { if let Some(lconf) = pe.load_configuration() { let offset: Option = lconf.hotpatch_table_offset(); } } ``` Additionally, `lief.PE.LoadConfiguration` ( [`lief::pe::LoadConfiguration`]() ; [`lief.PE.LoadConfiguration`]() ; [`LIEF::PE::LoadConfiguration`]() ) now provides an API that allows access to the internal data associated with this structure: - `lief.PE.CHPEMetadata` ( [`lief::pe::CHPEMetadata`]() ; [`lief.PE.CHPEMetadata`]() ; [`LIEF::PE::CHPEMetadata`]() ) - `lief.PE.DynamicRelocation` ( [`lief::pe::DynamicRelocation`]() ; [`lief.PE.DynamicRelocation`]() ; [`LIEF::PE::DynamicRelocation`]() ) - `lief.PE.EnclaveConfiguration` ( [`lief::pe::EnclaveConfiguration`]() ; [`lief.PE.EnclaveConfiguration`]() ; [`LIEF::PE::EnclaveConfiguration`]() ) - `lief.PE.VolatileMetadata` ( [`lief::pe::VolatileMetadata`]() ; [`lief.PE.VolatileMetadata`]() ; [`LIEF::PE::VolatileMetadata`]() ) Some of these structures are important to correctly support ARM64EC/ARM64X PE binaries (#teasing). ## [Debug Information]() LIEF version 0.17.0 supports more types of debug entries and provides a user-friendly API: - `lief.PE.VCFeature` ( [`lief::pe::debug::VCFeature`]() ; [`lief.PE.VCFeature`]() ; [`LIEF::PE::VCFeature`]() ) - `lief.PE.FPO` ( [`lief::pe::debug::FPO`]() ; [`lief.PE.FPO`]() ; [`LIEF::PE::FPO`]() ) - `lief.PE.ExDllCharacteristics` ( [`lief::pe::debug::ExDllCharacteristics`]() ; [`lief.PE.ExDllCharacteristics`]() ; [`LIEF::PE::ExDllCharacteristics`]() ) - `lief.PE.PDBChecksum` ( [`lief::pe::debug::PDBChecksum`]() ; [`lief.PE.PDBChecksum`]() ; [`LIEF::PE::PDBChecksum`]() ) As described in the [Debug Modification]() section, you can modify debug entries to perform various actions: ```python pe = lief.PE.parse("some.dll") # Changing the PDB file path to a URL pe.codeview_pdb.filename = "https://lief.re/" pe.write("out.dll") ``` ## [Resources]() Some interfaces exposed by the `lief.PE.ResourcesManager` ( [`lief::pe::resources::Manager`]() ; [`lief.PE.ResourcesManager`]() ; [`LIEF::PE::ResourcesManager`]() ) have been redesigned to make them more consistent with their underlying representation in the PE format. For example, `lief.PE.LangCodeItem` has been renamed and refactored into `lief.PE.ResourceStringTable` ( [`lief.PE.ResourceStringTable`]() ; [`LIEF::PE::ResourceStringTable`]() ). Resource-related enums have been re-scoped to avoid definition conflicts between Windows headers and LIEF: | `lief.PE.EXTENDED_WINDOW_STYLES` | [`lief.PE.ResourceDialog.WINDOW_EXTENDED_STYLES`]( "lief.PE.ResourceDialog.WINDOW_EXTENDED_STYLES") | | --- | --- | | `lief.PE.WINDOW_STYLES` | [`lief.PE.ResourceDialog.WINDOW_STYLES`]( "lief.PE.ResourceDialog.WINDOW_STYLES") | | `lief.PE.DIALOG_BOX_STYLES` | [`lief.PE.ResourceDialog.DIALOG_STYLES`]( "lief.PE.ResourceDialog.DIALOG_STYLES") | | `lief.PE.FIXED_VERSION_OS` | [`lief.PE.ResourceVersion.fixed_file_info_t.VERSION_OS`]( "lief.PE.ResourceVersion.fixed_file_info_t.VERSION_OS") | | `lief.PE.FIXED_VERSION_FILE_FLAGS` | [`lief.PE.ResourceVersion.fixed_file_info_t.FILE_FLAGS`]( "lief.PE.ResourceVersion.fixed_file_info_t.FILE_FLAGS") | | `lief.PE.FIXED_VERSION_FILE_SUB_TYPES` | [`lief.PE.ResourceVersion.fixed_file_info_t.FILE_TYPE_DETAILS`]( "lief.PE.ResourceVersion.fixed_file_info_t.FILE_TYPE_DETAILS") | | `lief.PE.ACCELERATOR_FLAGS` | [`lief.PE.ResourceAccelerator.FLAGS`]( "lief.PE.ResourceAccelerator.FLAGS") | | `lief.PE.ACCELERATOR_VK_CODES` | [`lief.PE.ACCELERATOR_CODES`]( "lief.PE.ACCELERATOR_CODES") | ## [Exception Info]() For x86-64 and ARM64 PE binaries, stack unwinding information is referenced by the data directory: `IMAGE_DIRECTORY_ENTRY_EXCEPTION`. Even if your code is compiled without exception support, this information may still be generated by the linker. The entries of this data directory are represented by the `lief.PE.ExceptionInfo` ( [`lief::pe::exception::RuntimeExceptionFunction`]() ; [`lief.PE.ExceptionInfo`]() ; [`LIEF::PE::ExceptionInfo`]() ) structure, which is specialized for x64 and ARM64 functions. Regardless of the underlying architecture, each entry in this table exposes a function RVA. From a reverse engineering perspective, these RVAs offer a valuable set of function start addresses that can be used to begin disassembling the binary. Given a `lief.PE.Binary` ( [`lief::pe::Binary`]() ; [`lief.PE.Binary`]() ; [`LIEF::PE::Binary`]() ) instance, one can iterate over these `lief.PE.ExceptionInfo` ( [`lief::pe::exception::RuntimeExceptionFunction`]() ; [`lief.PE.ExceptionInfo`]() ; [`LIEF::PE::ExceptionInfo`]() ) entries using `lief.PE.Binary` ( [`lief::pe::Binary::exceptions`]() ; [`lief.PE.Binary.exceptions`]() ; [`LIEF::PE::Binary::exceptions()`]() ): ```python pe = lief.PE.parse("Windows.Media.Protection.PlayReady.dll", lief.PE.ParserConfgi.all) print(pe.exceptions[10]) ``` ```text RuntimeFunctionX64 { RVA: [0x0c9350, 0x0c9382] (50 bytes) Unwind info RVA: 0x68eb5c unwind_info_t { Version: 1 Flags: 0 Size of prologue: 20 Nb opcodes: 8 (6) Opcodes: [ 0x14 SAVE_NONVOL reg=RDI, offset=0x000078 0x14 SAVE_NONVOL reg=RBX, offset=0x000070 0x14 ALLOC_SMALL size=64 0x10 PUSH_NONVOL reg=R15 0x0e PUSH_NONVOL reg=R14 0x0c PUSH_NONVOL reg=R12 ]; } } ``` ```python pe = lief.PE.parse("win11_arm64x_Windows.Media.Protection.PlayReady.dll", lief.PE.ParserConfgi.all) print(pe.exceptions[10]) ``` ```text Runtime Unpacked AArch64 Function { Range(RVA): 0x00822bb8 - 0x00822c08 Unwind location (RVA): 0x00d63838 Length=80 Vers=0 X=0 E=0, CodeWords=8 Epilogs=1 Prolog unwind: 0x0000 e1...... mov fp, sp 0x0001 81...... stp x29, x30, [sp, #-16]! 0x0002 e6...... save next 0x0003 e6...... save next 0x0004 e6...... save next 0x0005 e6...... save next 0x0006 e76689.. stp q6, q7, [sp, #-160]! 0x0009 fc...... pacibsp 0x000a e4...... end Epilog #1 unwind: (Offset=10, Index=11, Reserved=0) 0x0000 81...... ldp x29, x30, [sp], #16 0x0001 e74e88.. ldp q14, q15, [sp, #128] 0x0004 e74c86.. ldp q12, q13, [sp, #96] 0x0007 e74a84.. ldp q10, q11, [sp, #64] 0x000a e74882.. ldp q8, q9, [sp, #32] 0x000d e76689.. ldp q6, q7, [sp], #160 0x0010 fc...... autibsp 0x0011 e3...... nop 0x0012 e3...... nop 0x0013 e4...... end } ``` > **ARM64 - `SAVE_ANY_REG`** > > Thank you to [Eli Friedman]() and [Martin Storsjö]() for their work on reverse engineering this undocumented unwind opcode. LIEF provides a detailed API for the structures involved in PE exceptions and stack unwinding. > **Performance Considerations** > > In-depth analysis of exception metadata can introduce significant overhead. Therefore, `lief.PE.ParserConfig.parse_exceptions` ( [`lief::pe::ParserConfig::parse_exceptions`]() ; [`lief.PE.ParserConfig.parse_exceptions`]() ; [`LIEF::PE::ParserConfig::parse_exceptions`]() ) must be **explicitly** enabled. ## [ARM64EC / ARM64X]() With the recent release of Snapdragon X, ARM64-based Windows computers are becoming increasingly popular. This shift introduces some changes to the PE format. One notable change is the introduction of ARM64X binaries, which can be compared to the Mach-O FAT concept, where a single binary contains multiple architectures. In the case of ARM64X, a single PE file encapsulates ARM64 and ARM64EC architectures. LIEF v0.17.0 exposes the following helpers to determine whether the binary is ARM64X or ARM64EC: `lief.PE.Binary.is_arm64ec()` ( [`lief::pe::Binary::is_arm64ec`]() ; [`lief.PE.Binary.is_arm64ec`]() ; [`LIEF::PE::Binary::is_arm64ec()`]() ), `lief.PE.Binary.is_arm64x()` ( [`lief::pe::Binary::is_arm64x`]() ; [`lief.PE.Binary.is_arm64x`]() ; [`LIEF::PE::Binary::is_arm64x()`]() ). For an ARM64X binary, you can use `lief.PE.Binary.nested_pe_binary()` ( [`lief::pe::Binary::nested_pe_binary`]() ; [`lief.PE.Binary.nested_pe_binary`]() ; [`LIEF::PE::Binary::nested_pe_binary()`]() ) to access the embedded ARM64EC **representation** of the binary. > **Performance Considerations** > > Parsing a nested ARM64EC binary can introduce additional overhead compared to the 0.16.x version. Therefore, `lief.PE.ParserConfig.parse_arm64x_binary` ( [`lief::pe::ParserConfig::parse_arm64x_binary`]() ; [`lief.PE.ParserConfig.parse_arm64x_binary`]() ; [`LIEF::PE::ParserConfig::parse_arm64x_binary`]() ) must be **explicitly** enabled. ## [Other Changes]() The workaround involving `undef.h` has been removed. This file was used to `#undef` certain Windows defines that conflicted with LIEF enum definitions. You can now safely include Windows headers alongside LIEF headers. If you encounter any conflicts, please report the issue. The *builder* engine has been refactored to resolve numerous errors and bugs associated with PE modifications. It now uses a more conservative approach. For more details, please refer to the [PE]() page. The *“PE from Scratch”* feature has been removed, as it had significant bugs that often resulted in corrupted binaries. This feature will be reintroduced in a future release. If you rely on this feature, please reach out. **List of changes:** - Fixed missing original forwarded function name ([#1166]()) - `lief.PE.DataDirectory` ( [`lief::pe::DataDirectory`]() ; [`lief.PE.DataDirectory`]() ; [`LIEF::PE::DataDirectory`]() ) now exposes `lief.PE.DataDirectory.content()` ( [`lief::pe::DataDirectory::content`]() ; [`lief.PE.DataDirectory.content`]() ; [`LIEF::PE::DataDirectory::content()`]() ) to access the raw bytes wrapped by the data directory - PE’s resource tree can now be parsed in a standalone way using `lief.PE.ResourceNode.parse()` ( [`lief::pe::ResourceNode::from_slice`]() ; [`lief.PE.ResourceNode.parse()`]() ; [`LIEF::PE::ResourceNode::parse()`]() ). ```python resource_tree = bytes("....") original_rva = 0x20000 tree: lief.PE.ResourceNode = lief.PE.ResourceNode.parse(resource_tree, original_rva) ``` --- documentID: "aae98ef7eba7d7c35725bc1aa4bb954daca08d44231bca326640218c42ee65cd" docname: "compilation" title: "Compilation - LIEF Documentation" description: "Compilation. To compile LIEF, you need at least the following:" canonical: "https://lief.re/doc/latest/compilation.html" markdownURL: "https://lief.re/doc/latest/compilation.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "d56bf622ebd71a76e5c68e26004de6c287c3e72f138e916d090311865fe1a5aa" --- # [Compilation]() To compile **LIEF**, you need at least the following: - C++17 compiler (GCC, Clang, MSVC, etc.) - CMake - Python >= 3.10 (for the bindings) > **Note** > > Compiling from scratch with all options enabled can take approximately 20 minutes on a standard laptop. ## [Libraries only (SDK)]() ```console $ git clone https://github.com/lief-project/LIEF.git $ cd LIEF $ mkdir build $ cd build $ cmake -DCMAKE_BUILD_TYPE=Release .. $ cmake --build . --target LIB_LIEF --config Release ``` > **Warning** > > On Windows, you can choose which CRT to use by setting the `CMAKE_MSVC_RUNTIME_LIBRARY` variable: > > ```console > $ cmake -DCMAKE_BUILD_TYPE=Release -DCMAKE_MSVC_RUNTIME_LIBRARY=MultiThreaded .. > ``` > > For Debug, you should set the CRT to **MTd**: > > ```console > $ cmake -DCMAKE_BUILD_TYPE=Debug -DCMAKE_MSVC_RUNTIME_LIBRARY=MultiThreadedDebug .. > $ cmake --build . --target LIB_LIEF --config Debug > ``` ## [Python bindings]() The Python bindings are built from the `api/python` directory, which uses a [PEP 517]() build backend based on [scikit-build-core](): ```console $ git clone https://github.com/lief-project/LIEF.git $ cd LIEF/api/python $ pip install [-e] [--user] . # Or $ pip install [-e] api/python ``` > **Note** > > You can speed up the compilation by installing [ccache]() or [sccache](). You can customize the compilation by setting the `PYLIEF_CONF` environment variable to the path of a TOML configuration file. By default, the Python bindings use `config-default.toml` in the Python binding directory: ```toml [lief.build] type = "Release" cache = true ninja = true parallel-jobs = 0 [lief.formats] elf = true pe = false macho = true ... ``` ```console $ PYLIEF_CONF=/tmp/my-custom.toml pip install . ``` ### [Free-threaded Python]() Since LIEF 1.0.0, the Python bindings can be compiled against the free-threaded Python builds. This is controlled through the `free-threaded` flag of the `[lief.build]` section of the configuration: ```toml [lief.build] type = "Release" free-threaded = true ``` > **Warning** > > When MbedTLS is resolved externally (`LIEF_OPT_MBEDTLS_EXTERNAL=ON`), you must make sure that the provided build enables threading support. LIEF cannot tweak the threading configuration in that case. At runtime, you can check whether the currently loaded extension was compiled with free-threading support through `lief.__free_threaded__`. ## [Runtime features]() The [runtime features]() are **not** enabled by default and must be explicitly turned on. See [Runtime]() for the CMake options and TOML configuration used to enable the runtime module. ## [Debugging]() By default, LIEF is compiled with `CMAKE_BUILD_TYPE` set to `Release`. You can change this behavior by setting it to either `RelWithDebInfo` or `Debug` during CMake’s configuration step: ```console $ cmake -DCMAKE_BUILD_TYPE=RelWithDebInfo [...] .. ``` Alternatively, the Python bindings can also be compiled with debug information by changing the `type` in the `[lief.build]` section of `config-default.toml`: ```toml [lief.build] type = "RelWithDebInfo" ``` > **Note** > > When developing LIEF, you can use: > > ```console > $ PYLIEF_CONF=~/lief-debug.toml pip install [-e] api/python > ``` > > With `lief-debug.toml` set to: > > ```toml > [lief.build] > type = "RelWithDebInfo" > ... > > [lief.logging] > enabled = true > debug = true > ``` ## [Third Party]() LIEF relies on several external projects, and we aim to limit dependencies in the public headers as much as possible. The following table summarizes these dependencies and their scopes. `internal` means that it is required to compile LIEF but not to use it. `external` means that it is required for both. | Dependency | Scope | Purpose | | --- | --- | --- | | [tcbrindle/span]() | `external` | C++11 span interface | | [TartanLlama/expected]() | `external` | Error handling (see: [Error Handling]() ) | | [gabime/spdlog]() | `internal` | Logging | | [Mbed-TLS/mbedtls]() | `internal` | ASN.1 parser / Hash functions | | [nemtrif/utfcpp]() | `internal` | Unicode support (for PE and DEX files) | | [nlohmann/json]() | `internal` | Serialize LIEF objects into JSON | | [wjakob/nanobind]() | `internal` | Python bindings | | [serge-sans-paille/frozen]() | `internal` | `constexpr` containers | | [IOActive/Melkor\_ELF\_Fuzzer]() | `internal` | ELF Fuzzing | | [catchorg/Catch2]() | `internal` | Unit Testing | With the exception of MbedTLS, all of these dependencies are header-only. By default, they are embedded and managed by LIEF to simplify compilation and integration. Nevertheless, package managers often require linking against system libraries rather than using vendored dependencies [[1]]() [[2]](). To address this requirement, you can control the integration of LIEF’s dependencies using the following CMake options: > - `LIEF_OPT_NLOHMANN_JSON_EXTERNAL` > - `LIEF_OPT_UTFCPP_EXTERNAL` > - `LIEF_OPT_MBEDTLS_EXTERNAL` > - `LIEF_EXTERNAL_SPDLOG` > - `LIEF_OPT_FROZEN_EXTERNAL` > - `LIEF_OPT_EXTERNAL_SPAN/LIEF_EXTERNAL_SPAN_DIR` > - `LIEF_OPT_EXTERNAL_EXPECTED` > - `LIEF_OPT_NANOBIND_EXTERNAL` By setting these flags, LIEF will resolve dependencies using CMake’s `find_package(...)`, which relies on `_DIR` to locate the package. For example, LIEF can be compiled using the following configuration: ```console $ cmake .. -GNinja \ -DLIEF_OPT_NLOHMANN_JSON_EXTERNAL=ON \ -Dnlohmann_json_DIR=/lief-third-party/json/install/lib/cmake/nlohmann_json \ -DLIEF_OPT_MBEDTLS_EXTERNAL=on \ -DMbedTLS_DIR=/lief-third-party/mbedtls/install/cmake ``` > **Warning** > > As mentioned previously, MbedTLS is not header-only. This means that if it is *externalized*, the static version of LIEF will not include the MbedTLS object files, and the end user will have to manually link `LIEF.a` with a provided version of MbedTLS. [[1]()] [https://github.com/lief-project/LIEF/issues/605]() [[2]()] [https://learn.microsoft.com/en-us/vcpkg/contributing/maintainer-guide#do-not-use-vendored-dependencies]() ## [Continuous Integration]() LIEF uses GitHub Actions to test and release nightly builds. The configuration of this CI can also be a good source of information for the compilation process. In particular, [scripts/docker/linux-sdk-x64]() contains the build process to generate the **Linux x86-64 SDK**. On Windows, the SDK is built with the following Python script: [scripts/windows/package\_sdk.py]() For **OSX**, refer to the CI config [.github/workflows/osx.yml](), and for **iOS**, see the [scripts/osx/package\_ios.sh]() script, to see how LIEF is compiled (and cross-compiled) for these platforms. ## [CMake Options]() ```default include_guard(GLOBAL) include(CMakeDependentOption) option(LIEF_TESTS "Enable tests" OFF) option(LIEF_PYTHON_API "Enable Python Bindings" OFF) option(LIEF_EXAMPLES "Build LIEF C++ examples" ON) option(LIEF_FORCE32 "Force build LIEF 32 bits version" OFF) option(LIEF_USE_CCACHE "Use ccache to speed up compilation" ON) option(LIEF_EXTRA_WARNINGS "Enable extra warning from the compiler" OFF) option(LIEF_LOGGING "Enable logging" ON) option(LIEF_LOGGING_DEBUG "Enable debug logging" ON) option(LIEF_ENABLE_JSON "Enable JSON-related APIs" ON) option(LIEF_OPT_NLOHMANN_JSON_EXTERNAL "Use nlohmann/json externally" OFF) option(LIEF_FORCE_API_EXPORTS "Force exports of API symbols" OFF) option(LIEF_PY_LIEF_EXT "Use a pre-installed version of LIEF for the bindings" OFF) option(LIEF_PRECOMPILED "Use a pre-compiled version of LIEF" OFF) option(LIEF_RUST_API "Generate the C++ bridge for Rust's cxx" OFF) option(LIEF_DISABLE_EXCEPTIONS "Disable C++ exceptions on the core library" ON) option(LIEF_SO_VERSION "Embed versioning for LIEF shared library target" OFF) option(LIEF_COMPILE_DOC_EXAMPLES "Compile C++ examples in doc/code/" OFF) option(LIEF_DISABLE_FROZEN "Disable Frozen even if it is supported" OFF) option(LIEF_RUNTIME "Enable runtime features" OFF) option(LIEF_ELF "Build LIEF with ELF module" ON) option(LIEF_PE "Build LIEF with PE module" ON) option(LIEF_COFF "Build LIEF with COFF module" ON) option(LIEF_MACHO "Build LIEF with MachO module" ON) option(LIEF_DEX "Build LIEF with DEX module" ON) option(LIEF_ART "Build LIEF with ART module" ON) # Extended features option(LIEF_DEBUG_INFO "Build LIEF with DWARF/PDB support" OFF) option(LIEF_OBJC "Build LIEF with ObjC metadata support" OFF) option(LIEF_DYLD_SHARED_CACHE "Build LIEF with Dyld shared cache support" OFF) option(LIEF_ASM "Build LIEF with assembler/disassembler support" OFF) option(LIEF_RUNTIME_EXTENDED "Build LIEF with assembler/disassembler support" OFF) if (LIEF_COFF AND NOT LIEF_PE) message(FATAL_ERROR "COFF module requires LIEF_PE enabled") endif() if (LIEF_PE AND NOT LIEF_COFF) message(FATAL_ERROR "PE module requires LIEF_COFF enabled") endif() if (LIEF_PY_LIEF_EXT) set(LIEF_PRECOMPILED ON) endif() cmake_dependent_option(LIEF_PYTHON_EDITABLE "Make an editable build " OFF "LIEF_PYTHON_API" OFF) cmake_dependent_option(LIEF_PY_LIEF_EXT_SHARED "Use a 'SHARED' version of LIEF instead of a static one" OFF "LIEF_PY_LIEF_EXT" OFF) cmake_dependent_option(LIEF_PYTHON_STATIC "Internal usage" OFF "LIEF_PYTHON_API" OFF) cmake_dependent_option(LIEF_PYTHON_STABLE_ABI "Compile LIEF Python bindings with the stable ABI" OFF "LIEF_PYTHON_API" OFF) cmake_dependent_option(LIEF_PYTHON_FREE_THREADED "Compile LIEF Python bindings with free-threading enabled" OFF "LIEF_PYTHON_API" OFF) # OAT support relies on the ELF and DEX format. # Therefore, these options must be enabled to support this format cmake_dependent_option(LIEF_OAT "Build LIEF with OAT module" ON "LIEF_ELF;LIEF_DEX" OFF) # VDEX format depends on the DEX module cmake_dependent_option(LIEF_VDEX "Build LIEF with VDEX module" ON "LIEF_DEX" OFF) # Sanitizer option(LIEF_ASAN "Enable Address sanitizer" OFF) option(LIEF_LSAN "Enable Leak sanitizer" OFF) option(LIEF_TSAN "Enable Thread sanitizer" OFF) option(LIEF_USAN "Enable undefined sanitizer" OFF) # Fuzzer option(LIEF_FUZZING "Fuzz LIEF" OFF) # Profiling option(LIEF_PROFILING "Enable performance profiling" OFF) # QA / Linters option(LIEF_CLANG_TIDY "Enable clang-tidy checks" OFF) cmake_dependent_option(LIEF_CLANG_TIDY_WARN_ERR "Enable WarningsAsErrors when running clang-tidy" OFF "LIEF_CLANG_TIDY" OFF) # Install options cmake_dependent_option(LIEF_INSTALL_COMPILED_EXAMPLES "Install LIEF Compiled examples" OFF "LIEF_EXAMPLES" OFF) # Use a user-provided version of spdlog # It can be useful to reduce compile time option(LIEF_EXTERNAL_SPDLOG OFF) # This option enables to provide an external # version of TartanLlama/expected (e.g. present on the system) option(LIEF_OPT_EXTERNAL_EXPECTED OFF) # This option enables to provide an external version of utf8cpp option(LIEF_OPT_UTFCPP_EXTERNAL OFF) # This option enables to provide an external version of MbedTLS option(LIEF_OPT_MBEDTLS_EXTERNAL OFF) # This option enables to provide an external version of nanobind option(LIEF_OPT_NANOBIND_EXTERNAL OFF) # This option enables to provide an external # version of https://github.com/tcbrindle/span (e.g. present on the system) option(LIEF_OPT_EXTERNAL_SPAN OFF) set(LIEF_EXTERNAL_SPAN_DIR ) # This option enables to provide an external version of Frozen set(_LIEF_USE_FROZEN ON) if(LIEF_DISABLE_FROZEN) set(_LIEF_USE_FROZEN OFF) endif() cmake_dependent_option(LIEF_OPT_FROZEN_EXTERNAL "Use an external provided version of Frozen" OFF "_LIEF_USE_FROZEN" OFF) option(LIEF_USE_MELKOR "Build Melkor for testing" ON) # This option enables the install target in the cmake option(LIEF_INSTALL "Generate the install target." ON) set(LIEF_RUNTIME_SUPPORT 0) set(LIEF_ELF_SUPPORT 0) set(LIEF_PE_SUPPORT 0) set(LIEF_MACHO_SUPPORT 0) set(LIEF_COFF_SUPPORT 0) set(LIEF_OAT_SUPPORT 0) set(LIEF_DEX_SUPPORT 0) set(LIEF_VDEX_SUPPORT 0) set(LIEF_ART_SUPPORT 0) set(LIEF_JSON_SUPPORT 0) set(LIEF_NLOHMANN_JSON_EXTERNAL 0) set(LIEF_LOGGING_SUPPORT 0) set(LIEF_LOGGING_DEBUG_SUPPORT 0) set(LIEF_FROZEN_ENABLED 0) set(LIEF_EXTERNAL_FROZEN 0) set(LIEF_EXTERNAL_EXPECTED 0) set(LIEF_EXTERNAL_UTF8CPP 0) set(LIEF_EXTERNAL_MBEDTLS 0) set(LIEF_EXTERNAL_SPAN 0) set(LIEF_DEBUG_INFO_SUPPORT 0) set(LIEF_OBJC_SUPPORT 0) set(LIEF_DYLD_SHARED_CACHE_SUPPORT 0) set(LIEF_ASM_SUPPORT 0) set(LIEF_EXTENDED 0) if(LIEF_RUNTIME) set(LIEF_RUNTIME_SUPPORT 1) endif() if(LIEF_ELF) set(LIEF_ELF_SUPPORT 1) endif() if(LIEF_PE) set(LIEF_PE_SUPPORT 1) endif() if(LIEF_MACHO) set(LIEF_MACHO_SUPPORT 1) endif() if(LIEF_COFF) set(LIEF_COFF_SUPPORT 1) endif() if(LIEF_OAT) set(LIEF_OAT_SUPPORT 1) endif() if(LIEF_DEX) set(LIEF_DEX_SUPPORT 1) endif() if(LIEF_VDEX) set(LIEF_VDEX_SUPPORT 1) endif() if(LIEF_ART) set(LIEF_ART_SUPPORT 1) endif() if(LIEF_ENABLE_JSON) set(LIEF_JSON_SUPPORT 1) if(LIEF_OPT_NLOHMANN_JSON_EXTERNAL) set(LIEF_NLOHMANN_JSON_EXTERNAL 1) endif() endif() if(LIEF_LOGGING) set(LIEF_LOGGING_SUPPORT 1) if(LIEF_LOGGING_DEBUG) set(LIEF_LOGGING_DEBUG_SUPPORT 1) else() set(LIEF_LOGGING_DEBUG_SUPPORT 0) endif() endif() if(NOT LIEF_DISABLE_FROZEN) set(LIEF_FROZEN_ENABLED 1) if(LIEF_OPT_FROZEN_EXTERNAL) set(LIEF_EXTERNAL_FROZEN 1) endif() endif() if(LIEF_OPT_EXTERNAL_EXPECTED) set(LIEF_EXTERNAL_EXPECTED 1) endif() if(LIEF_OPT_UTFCPP_EXTERNAL) set(LIEF_EXTERNAL_UTF8CPP 1) endif() if(LIEF_OPT_MBEDTLS_EXTERNAL) set(LIEF_EXTERNAL_MBEDTLS 1) endif() if(LIEF_OPT_EXTERNAL_SPAN) set(LIEF_EXTERNAL_SPAN 1) endif() if(LIEF_PYTHON_API) if(LIEF_OPT_NANOBIND_EXTERNAL) set(LIEF_EXTERNAL_NANOBIND 1) endif() endif() # ------------------------------------------------------------------------------ # Extended features # ------------------------------------------------------------------------------ if (LIEF_DEBUG_INFO) set(LIEF_DEBUG_INFO_SUPPORT 1) endif() if (LIEF_OBJC) set(LIEF_OBJC_SUPPORT 1) endif() if (LIEF_DYLD_SHARED_CACHE) set(LIEF_DYLD_SHARED_CACHE_SUPPORT 1) endif() if (LIEF_ASM) set(LIEF_ASM_SUPPORT 1) endif() if (LIEF_RUNTIME_EXTENDED) set(LIEF_RUNTIME_EXTENDED_SUPPORT 1) endif() if (LIEF_DEBUG_INFO OR LIEF_OBJC OR LIEF_DYLD_SHARED_CACHE OR LIEF_ASM OR LIEF_RUNTIME_EXTENDED) # or any other extended feature set(LIEF_EXTENDED 1) endif() if (LIEF_RUNTIME) include(LIEFRuntime) endif() ``` ## [Docker]() See [liefproject]() on Docker Hub --- documentID: "6b3782f431df89f4fb9b6765277a317fc6f9af94fcad633f927d89ff793de218" docname: "extended/assembler/cpp" title: "Assembler C++ API - LIEF Documentation" description: "Assembler C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/extended/assembler/cpp.html" markdownURL: "https://lief.re/doc/latest/extended/assembler/cpp.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "80aa192870bd18696d66ca0287e64094f01736fb9e783c80d853f11027c13b87" --- # [C++]() - [`LIEF::Binary::assemble()`]( "LIEF::Binary::assemble") - [`LIEF::assembly::Engine`]( "LIEF::assembly::Engine") ## [AssemblerConfig]() ### [` AssemblerConfig `]() class AssemblerConfig This class exposes the different elements that can be configured to assemble code. Public Types #### [` DIALECT `]() enum class DIALECT The different supported dialects. *Values:* ##### [` DEFAULT_DIALECT `]() enumerator DEFAULT\_DIALECT = 0 ##### [` X86_INTEL `]() enumerator X86\_INTEL Intel syntax. ##### [` X86_ATT `]() enumerator X86\_ATT AT&T syntax. Public Functions #### [` AssemblerConfig `]() AssemblerConfig() = default #### [` AssemblerConfig `]() AssemblerConfig(const [AssemblerConfig]( "LIEF::assembly::AssemblerConfig::AssemblerConfig")&) = default #### [` operator= `]() [AssemblerConfig]( "LIEF::assembly::AssemblerConfig") &operator=(const [AssemblerConfig]( "LIEF::assembly::AssemblerConfig")&) = default #### [` AssemblerConfig `]() AssemblerConfig([AssemblerConfig]( "LIEF::assembly::AssemblerConfig::AssemblerConfig")&&) = default #### [` operator= `]() [AssemblerConfig]( "LIEF::assembly::AssemblerConfig") &operator=([AssemblerConfig]( "LIEF::assembly::AssemblerConfig")&&) = default #### [` resolve_symbol `]() inline virtual std::optional<uint64\_t> resolve\_symbol(const std::string&) This function aims to be overloaded in order to resolve symbols used in the assembly listing. For instance, given this assembly code: ```text 0x1000: mov rdi, rbx 0x1003: call _my_function ``` The function `_my_function` will remain undefined unless we return its address in `resolve_symbol()`: ```cpp class MyConfig : public AssemblerConfig { public: std::optional resolve_symbol(const std::string& name) { if (name == "_my_function") { return 0x4000; } return std::nullopt; // or AssemblerConfig::resolve_symbol(name) } }; ``` #### [` ~AssemblerConfig `]() virtual ~AssemblerConfig() = default Public Members #### [` dialect `]() [DIALECT]( "LIEF::assembly::AssemblerConfig::DIALECT") dialect = [DIALECT]( "LIEF::assembly::AssemblerConfig::DIALECT")::[DEFAULT\_DIALECT]( "LIEF::assembly::AssemblerConfig::DIALECT::DEFAULT_DIALECT") The dialect of the input assembly code. Public Static Functions #### [` default_config `]() static inline [AssemblerConfig]( "LIEF::assembly::AssemblerConfig") &default\_config() Default configuration. --- documentID: "ce4def58194691d52ba5d885d5285c10ec7e272e16d656397f3f1cc2620deb88" docname: "extended/assembler/index" title: "Assembler - LIEF Documentation" description: "Patch executable code with LIEF Extended, choose virtual addresses and patch sizes, and resolve symbols through an assembler configuration." canonical: "https://lief.re/doc/latest/extended/assembler/index.html" markdownURL: "https://lief.re/doc/latest/extended/assembler/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "6bd6bc0bb47a7fc6be5bbc69decb11ea6f7f6c6ae822be97507495c558a489cf" --- # [Assembler]() API - [C++]() - [Python]() - [Rust]() ## [Introduction]() LIEF Extended can assemble instructions and patch them into a parsed binary with `lief.Binary.assemble()` ( [`lief::generic::Binary::assemble`]() ; [`LIEF::Binary::assemble()`]() ; [`lief.Binary.assemble()`]() ). ## [Patch a binary]() Pass a virtual address in the binary and assembly text for its architecture. The following example assumes an AArch64 ELF binary: **Python** ```python elf: lief.ELF.Binary syscall_addresses = [ inst.address for inst in elf.disassemble(0x400090) if inst.is_syscall ] for syscall_addr in syscall_addresses: elf.assemble( syscall_addr, """ mov x1, x0; str x1, [x2, #8]; """, ) ``` **C++** ```cpp std::unique_ptr elf; std::vector syscall_addresses; for (const auto& inst : elf->disassemble(0x400090)) { if (inst.is_syscall()) { syscall_addresses.push_back(inst.address()); } } for (uint64_t addr : syscall_addresses) { elf->assemble(addr, R"asm( mov x1, x0; str x1, [x2, #8]; )asm"); } ``` **Rust** ```rust let elf: &mut lief::elf::Binary = some_elf; let syscall_addresses: Vec = elf .disassemble_address(0x400090) .filter(|inst| inst.is_syscall()) .map(|inst| inst.address()) .collect(); for addr in syscall_addresses { elf.assemble( addr, r#" mov x1, x0; str x1, [x2, #8]; "#, ); } ``` The call returns the generated bytes and patches the binary object. Save the result with the format’s write API, such as `lief.ELF.Binary.write()` ( [`lief::elf::Binary::write`]() ; [`lief::elf::Binary::write_with_config`]() ; [`lief.ELF.Binary.write()`]() ; [`LIEF::ELF::Binary::write()`]() ), `lief.PE.Binary.write()` ( [`lief::pe::Binary::write`]() ; [`lief.PE.Binary.write()`]() ; [`LIEF::PE::Binary::write()`]() ), or `lief.MachO.Binary.write()` ( [`lief::macho::Binary::write`]() ; [`lief::macho::Binary::write_with_config`]() ; [`lief.MachO.Binary.write()`]() ; [`LIEF::MachO::Binary::write()`]() ). > **Warning** > > The assembler works well for `AArch64/ARM64E`, `x86/x86-64`, and `RISC-V` but support for other architectures is currently limited. ## [Technical Details]() Similar to the [disassembler](), this assembler is based on the LLVM MC layer. The assembly text is consumed by the `llvm::MCAsmParser` object, and we *intercept* the raw generated assembly bytes from the `llvm::MCObjectWriter`. We also resolve `llvm::MCFixup` for a vast majority of the generated fixups. An important feature introduced in LIEF 0.17.0 is support for resolving symbols or labels **on the fly**. ## [Contextual Assembly Patching]() Given assembly code and a target address, we might want to use a **context** to resolve symbols referenced in the assembly listing. For example, consider the following x86-64 patch: **Python** ```python elf: lief.ELF.Binary elf.assemble( elf.entrypoint, """ mov rdi, rax; call a_custom_function; """, ) ``` **C++** ```cpp std::unique_ptr elf; elf->assemble(elf->entrypoint(), R"asm( mov rdi, rax; call a_custom_function; )asm"); ``` **Rust** ```rust let elf: &mut lief::elf::Binary = some_elf; elf.assemble( elf.entrypoint(), r#" mov rdi, rax; call a_custom_function; "#, ); ``` In this example, `a_custom_function` is undefined, so the assembler engine cannot resolve it and reports an unresolved fixup: ```text warning: Fixup not resolved: call a_custom_function ``` LIEF exposes a `lief.assembly.AssemblerConfig` ( [`lief::assembly::AssemblerConfig`]() ; [`LIEF::assembly::AssemblerConfig`]() ; [`lief.assembly.AssemblerConfig`]() ) interface that can be used to configure the engine and to **dynamically** resolve symbols used in the assembly listing: **Python** ```python class MyConfig(lief.assembly.AssemblerConfig): def __init__(self): super().__init__() # Important! @override def resolve_symbol(self, name: str) -> int | None: if name == "a_custom_function": return 0x1000 return None elf: lief.ELF.Binary elf.assemble( elf.entrypoint, """ mov rdi, rax; call a_custom_function; """, MyConfig(), ) ``` **C++** ```cpp class MyConfig : public LIEF::assembly::AssemblerConfig { public: std::optional resolve_symbol(const std::string& name) override { if (name == "a_custom_function") { return 0x1000; } return std::nullopt; } }; MyConfig myconfig; std::unique_ptr elf; elf->assemble(elf->entrypoint(), R"asm( mov rdi, rax; call a_custom_function; )asm", myconfig); ``` **Rust** ```rust let elf: &mut lief::elf::Binary = some_elf; let mut config = lief::assembly::AssemblerConfig::default(); let resolver = Arc::new(|symbol: &str| { if symbol == "a_custom_function" { return Some(0x1000); } None }); config.symbol_resolver = Some(resolver); elf.assemble_with_config( elf.entrypoint(), r#" mov rdi, rax; call a_custom_function; "#, &config, ); ``` Return the symbol’s address in the same address space as the patch, or no value when it cannot be resolved. An unresolved symbol diagnostic needs to be handled before using the resulting patch. This interface can be used to wrap a context, such as a generic `lief.abstract.Binary` ( [`lief::generic::Binary`]() ; [`lief.Binary`]() ; [`LIEF::Binary`]() ): **Python** ```python import lief class MyConfig(lief.assembly.AssemblerConfig): def __init__(self, target: lief.Binary): super().__init__() # Important! self._target = target @override def resolve_symbol(self, name: str) -> int | None: addr = self._target.get_function_address(name) if isinstance(addr, lief.lief_errors): return None return addr elf: lief.ELF.Binary config = MyConfig(elf) elf.assemble( elf.entrypoint, """ mov rdi, rax; call a_custom_function; """, config, ) ``` **C++** ```cpp class MyConfig : public LIEF::assembly::AssemblerConfig { public: MyConfig() = delete; MyConfig(LIEF::Binary& target) : LIEF::assembly::AssemblerConfig(), target_(&target) {} std::optional resolve_symbol(const std::string& name) override { if (auto addr = target_->get_function_address(name)) { return *addr; } return std::nullopt; } ~MyConfig() override = default; private: LIEF::Binary* target_ = nullptr; }; std::unique_ptr elf; MyConfig myconfig(*elf); elf->assemble(elf->entrypoint(), R"asm( mov rdi, rax; call a_custom_function; )asm", myconfig); ``` The Rust bindings do not offer the same flexibility to capture the `lief.abstract.Binary` ( [`lief::generic::Binary`]() ; [`lief.Binary`]() ; [`LIEF::Binary`]() ). Nevertheless, the closure associated with the [`lief::assembly::AssemblerConfig::symbol_resolver`]() can capture most of its context: **Rust** ```rust let elf: &mut lief::elf::Binary = some_elf; let mut config = lief::assembly::AssemblerConfig::default(); let sym_map: HashMap = elf .exported_symbols() .map(|sym| (sym.name(), sym.value())) .collect(); let resolver = Arc::new(move |symbol: &str| sym_map.get(symbol).copied()); config.symbol_resolver = Some(resolver); elf.assemble_with_config( elf.entrypoint(), r#" mov rdi, rax; call a_custom_function; "#, &config, ); ``` ## [Use Cases]() Patching code with the assembler is a fast alternative to editing raw bytes by hand: it is useful for bypassing a check while reverse engineering, hot-patching a bug in a shipped executable, or inserting instrumentation. ### [Disabling an Instruction]() To strip a single instruction like a call to a telemetry or anti-debugging routine *without* shifting the rest of the function we can overwrite it with as many `nop` bytes as it occupied. Pairing the [disassembler]() with `lief.Binary.assemble()` ( [`lief::generic::Binary::assemble`]() ; [`LIEF::Binary::assemble()`]() ; [`lief.Binary.assemble()`]() ) lets you do this: **Python** ```python elf: lief.ELF.Binary # Overwrite the first call in the region (e.g. a call to an anti-debugging # routine) with nops for inst in elf.disassemble(0x401200): if inst.is_call: elf.assemble(inst.address, "nop\n" * inst.size) break elf.write("patched.bin") ``` **C++** ```cpp std::unique_ptr elf; // Overwrite the first call in the region (e.g. a call to an anti-debugging // routine) with nops for (const auto& inst : elf->disassemble(0x401200)) { if (inst.is_call()) { std::string nops; for (size_t i = 0; i < inst.size(); ++i) { nops += "nop\n"; } elf->assemble(inst.address(), nops); break; } } elf->write("patched.bin"); ``` **Rust** ```rust let elf: &mut lief::elf::Binary = some_elf; // Overwrite the first call in the region (e.g. a call to an anti-debugging // routine) with nops let target = elf .disassemble_address(0x401200) .find(|inst| inst.is_call()) .map(|inst| (inst.address(), inst.size())); if let Some((address, size)) = target { elf.assemble(address, &"nop\n".repeat(size as usize)); } elf.write("patched.bin"); ``` > **Note** > > The snippets above assume `x86/x86-64`, where a `nop` is a single byte, so `inst.size` of them fill the slot exactly. On a fixed-width instruction set such as `AArch64` every instruction is 4 bytes, so we would emit `inst.size / 4` instead. ## [In-Memory Assembler]() In addition to patching binaries on disk or within standard file formats, the assembly engine is also available for JIT compilation and in-memory operations. This is exposed through the runtime API `lief.runtime.assemble()` ( [`lief::runtime::assemble`]() ; [`lief::runtime::assemble_with_config`]() ; [`lief.runtime.assemble()`]() ; [`LIEF::runtime::assemble()`]() ), as detailed in the [Runtime Memory]() documentation. ## [API]() [Python API]() [C++ API]() [Rust API]() --- documentID: "bfd73052ed524448859f36b751ba1ce18589cfc8e3657b722c9a5bdbbdb7b1ee" docname: "extended/assembler/python" title: "Assembler Python API - LIEF Documentation" description: "Assembler Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/extended/assembler/python.html" markdownURL: "https://lief.re/doc/latest/extended/assembler/python.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "424117067121d041f79defa4ccda0047f8e5ef38933bbe42c4a6e9a473809e45" --- # [Python]() - [`lief.Binary.assemble()`]( "lief.Binary.assemble") - [`lief.assembly.Engine`]( "lief.assembly.Engine") ## [AssemblerConfig]() ### [` lief.assembly.AssemblerConfig `]() class lief.assembly.AssemblerConfig(*self*) Bases: `object` This class exposes the different elements that can be configured to assemble code. #### [` DIALECT `]() class DIALECT(*\*values*) Bases: `Enum` The different supported dialects ##### [` DEFAULT_DIALECT `]() DEFAULT\_DIALECT = 0 ##### [` X86_ATT `]() X86\_ATT = 2 ##### [` X86_INTEL `]() X86\_INTEL = 1 #### [` default_config `]() default\_config → [lief.assembly.AssemblerConfig]( "lief.assembly.AssemblerConfig") = <nanobind.nb\_func object> #### [` dialect `]() property dialect → [lief.assembly.AssemblerConfig.DIALECT]( "lief.assembly.AssemblerConfig.DIALECT") The dialect of the input assembly code #### [` resolve_symbol `]() resolve\_symbol(*self*, *name: str*) → int | None This function aims to be overloaded in order to resolve symbols used in the assembly listing. For instance, given this assembly code: ```text 0x1000: mov rdi, rbx 0x1003: call _my_function ``` The function `_my_function` will remain undefined unless we return its address in [`resolve_symbol()`]( "lief.assembly.AssemblerConfig.resolve_symbol"): ```python class MyConfig(lief.assembly.AssemblerConfig): def __init__(self): super().__init__() # This is important @override def resolve_symbol(self, name: str) -> int | None: if name == '_my_function': return 0x4000 return None # Or super().resolve_symbol(name) ``` --- documentID: "d09616b3b3fbf63ee80176d2fc3dfbd05fe276ffe9648158d677f948309a950d" docname: "extended/assembler/rust" title: "Assembler Rust API - LIEF Documentation" description: "Assembler Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/extended/assembler/rust.html" markdownURL: "https://lief.re/doc/latest/extended/assembler/rust.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "4c8b79bfa9998f7ffa90a87da83798cbc2451ff48bc3aa96a158c0bcc84adbe3" --- # [Rust]() - [`lief::generic::Binary::assemble`]() --- documentID: "56fb1685892b85202d6c176a1e22d939201f0c0a79f93e53993ff05aeeb82c35" docname: "extended/debug_info/index" title: "Debug Information - LIEF Documentation" description: "Load DWARF and PDB debug information, attach matching debug files to binaries, and navigate the shared Python, C++, and Rust APIs." canonical: "https://lief.re/doc/latest/extended/debug_info/index.html" markdownURL: "https://lief.re/doc/latest/extended/debug_info/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "df58ab23032cad6658ee4e6ef7397e2cdcf48631bf38e4d0beaf4a239f2fd348" --- # [Debug Information]() Debug information connects machine code with source-level names, types, functions, variables, and locations. [LIEF Extended]() reads [DWARF]() and [PDB]() through format-specific APIs and the common interfaces documented below. ## [Choose how to load debug information]() | Input | Starting point | | --- | --- | | A binary containing DWARF sections | Parse the binary and access `lief.Binary.debug_info()` ( [`lief::elf::Binary::debug_info`]() ; [`lief.Binary.debug_info`]() ; [`LIEF::Binary::debug_info()`]() ) | | A separate DWARF file or a Mach-O debug companion | Load it with `lief.dwarf.load()` ( [`lief::dwarf::load`]() ; [`lief.dwarf.load()`]() ; [`LIEF::dwarf::load()`]() ) | | A PDB file | Load it with `lief.pdb.load()` ( [`lief::pdb::load`]() ; [`lief.pdb.load()`]() ; [`LIEF::pdb::load()`]() ) | | A parsed binary and its matching external debug file | Attach the file with `lief.abstract.Binary.load_debug_info()` ( [`lief::generic::Binary::load_debug_info`]() ; [`lief.Binary.load_debug_info()`]() ; [`LIEF::Binary::load_debug_info()`]() ) | Attaching an external file makes its information available to the parsed binary. The `lief.Binary.disassemble()` ( [`lief::generic::Binary::disassemble`]() ; [`lief::generic::Binary::disassemble_symbol`]() ; [`lief::generic::Binary::disassemble_address`]() ; [`lief::generic::Binary::disassemble_slice`]() ; [`LIEF::Binary::disassemble()`]() ; [`lief.Binary.disassemble()`]() ; [`lief.Binary.disassemble_from_bytes()`]() ) API can then disassemble functions by name. Attaching the file does not embed it into the executable. Use the debug file from the same build: `lief.abstract.Binary.load_debug_info()` ( [`lief::generic::Binary::load_debug_info`]() ; [`lief.Binary.load_debug_info()`]() ; [`LIEF::Binary::load_debug_info()`]() ) does not verify build IDs or PDB identifiers for you. The [DWARF]() and [PDB]() guides show how to iterate over compilation units, find functions and types, and generate C/C++ declarations. ## [Shared API reference]() ### [C++]() #### [DebugInfo]() ##### [` DebugInfo `]() class DebugInfo This class provides a generic interface for accessing debug information from different formats such as DWARF and PDB. Users can use this interface to access high-level debug features like resolving function addresses. > **See also** > > [LIEF::pdb::DebugInfo](), [LIEF::dwarf::DebugInfo]() Subclassed by [LIEF::dwarf::DebugInfo](), [LIEF::pdb::DebugInfo]() Public Types ###### [` FORMAT `]() enum class FORMAT *Values:* ###### [` UNKNOWN `]() enumerator UNKNOWN = 0 ###### [` DWARF `]() enumerator DWARF ###### [` PDB `]() enumerator PDB Public Functions ###### [` DebugInfo `]() DebugInfo(std::unique\_ptr<details::DebugInfo> impl) ###### [` ~DebugInfo `]() virtual ~DebugInfo() ###### [` format `]() inline virtual [FORMAT]( "LIEF::DebugInfo::FORMAT") format() const ###### [` Tas `]() template<class T> inline const [T]( "LIEF::DebugInfo::as::T") \*as() const This function can be used to **down cast** a [DebugInfo]() instance: ```cpp std::unique_ptr dbg = bin->debug_info(); if (const auto* dwarf = inst->as()) { dwarf->find_function("main"); } ``` ###### [` find_function_address `]() virtual std::optional<uint64\_t> find\_function\_address(const std::string &name) const = 0 Attempt to resolve the address of the function specified by `name`. Friends **friend class Binary** #### [debug\_location\_t]() ##### [` debug_location_t `]() struct debug\_location\_t This structure holds a debug location (source filename & line). Public Members ###### [` file `]() std::string file ###### [` line `]() uint64\_t line = 0 #### [DeclOpt]() ##### [` DeclOpt `]() class DeclOpt Configuration options for generated code from debug info. This structure configures how the debug information (DWARF/PDB) translated into an AST is generated. You can use it to configure the indentation, and the information to generate when translating DWARF/PDB into C++-like definitions Public Types ###### [` type_aliases_t `]() using type\_aliases\_t = std::unordered\_map<std::string, std::string> Mapping between a type name and a user-friendly aliases. (e.g. `std::basic_string,std::allocator>` -> `std::string`). Public Functions ###### [` DeclOpt `]() DeclOpt() ###### [` DeclOpt `]() DeclOpt(const [DeclOpt]( "LIEF::DeclOpt::DeclOpt") &other) ###### [` operator= `]() [DeclOpt]( "LIEF::DeclOpt") &operator=(const [DeclOpt]( "LIEF::DeclOpt") &other) ###### [` DeclOpt `]() DeclOpt([DeclOpt]( "LIEF::DeclOpt::DeclOpt") &&other) noexcept ###### [` operator= `]() [DeclOpt]( "LIEF::DeclOpt") &operator=([DeclOpt]( "LIEF::DeclOpt") &&other) noexcept ###### [` ~DeclOpt `]() ~DeclOpt() ###### [` indentation `]() uint32\_t indentation() const The number of spaces for indentation. ###### [` indentation `]() [DeclOpt]( "LIEF::DeclOpt") &indentation(uint32\_t value) ###### [` is_cpp `]() bool is\_cpp() const Prefer C++ syntax over C syntax. If true, the output will use C++ features (e.g. `bool` keyword) ###### [` is_cpp `]() [DeclOpt]( "LIEF::DeclOpt") &is\_cpp(bool value) ###### [` show_extended_annotations `]() bool show\_extended\_annotations() const Enable extended comments and annotations. If true, the generated code will include comments containing low-level details such as memory addresses, offsets, type sizes, and original source locations. ###### [` show_extended_annotations `]() [DeclOpt]( "LIEF::DeclOpt") &show\_extended\_annotations(bool value) ###### [` include_types `]() bool include\_types() const Include full type definitions. If true, the output will contain the full definition of types (structs, enums, unions). ###### [` include_types `]() [DeclOpt]( "LIEF::DeclOpt") &include\_types(bool value) ###### [` include_locals `]() bool include\_locals() const Emit a function body listing its local / stack variables. ###### [` include_locals `]() [DeclOpt]( "LIEF::DeclOpt") &include\_locals(bool value) ###### [` desugar `]() bool desugar() const Resolve type aliases (sugar). If true, typedef and type aliases are replaced by their underlying canonical types (e.g., `uint32_t` might become `unsigned int`). ###### [` desugar `]() [DeclOpt]( "LIEF::DeclOpt") &desugar(bool value) ###### [` show_field_offsets `]() bool show\_field\_offsets() const Show the relative offset of each field/attribute in structures. If true, every member of a structure is prefixed with its byte offset, ```cpp struct Foo { /* 0x00 *‍/ int A; /* 0x04 *‍/ int B; }; ``` ###### [` show_field_offsets `]() [DeclOpt]( "LIEF::DeclOpt") &show\_field\_offsets(bool value) ###### [` type_aliases `]() const [type\_aliases\_t]( "LIEF::DeclOpt::type_aliases_t") &type\_aliases() const Mapping of type names to user-friendly aliases. ###### [` type_aliases `]() [DeclOpt]( "LIEF::DeclOpt") &type\_aliases([type\_aliases\_t]( "LIEF::DeclOpt::type_aliases_t") aliases) ###### [` add_type_alias `]() [DeclOpt]( "LIEF::DeclOpt") &add\_type\_alias(std::string name, std::string alias) Register a single type alias. --- ### [Python]() #### [DebugInfo]() ##### [` lief.DebugInfo `]() class lief.DebugInfo Bases: `object` This class provides a generic interface for accessing debug information from different formats such as DWARF and PDB. Users can use this interface to access high-level debug features like resolving function addresses. See: [`DebugInfo`]( "lief.pdb.DebugInfo"), [`lief.dwarf.DebugInfo`]( "lief.dwarf.DebugInfo") ###### [` FORMAT `]() class FORMAT(*\*values*) Bases: `Enum` ###### [` DWARF `]() DWARF = 1 ###### [` PDB `]() PDB = 2 ###### [` UNKNOWN `]() UNKNOWN = 0 ###### [` from_value `]() from\_value(*arg: int*) → [lief.DebugInfo.FORMAT]( "lief.DebugInfo.FORMAT") = <nanobind.nb\_func object> ###### [` find_function_address `]() find\_function\_address(*self*, *name: str*) → int | None Attempt to resolve the address of the function specified by `name`. ###### [` format `]() property format → [lief.DebugInfo.FORMAT]( "lief.DebugInfo.FORMAT") The actual debug format (PDB/DWARF) #### [debug\_location\_t]() ##### [` lief.debug_location_t `]() class lief.debug\_location\_t Bases: `object` ###### [` file `]() property file → str ###### [` line `]() property line → int #### [DeclOpt]() ##### [` lief.DeclOpt `]() class lief.DeclOpt(*self*) Bases: `object` Configuration options for generated code from debug info. This structure configures how the debug information (DWARF/PDB) translated into an AST is generated. You can use it to configure the indentation, and the information to generate when translating DWARF/PDB into C++-like definitions ###### [` add_type_alias `]() add\_type\_alias(*self*, *name: str*, *alias: str*) → [lief.\_lief.DeclOpt]( "lief._lief.DeclOpt") Register a single type alias (see [`type_aliases`]( "lief.DeclOpt.type_aliases")). ###### [` desugar `]() property desugar → bool Resolve type aliases (sugar). If true, typedef and type aliases are replaced by their underlying canonical types (e.g., `uint32_t` might become `unsigned int`). ###### [` include_locals `]() property include\_locals → bool Emit a function body listing its local / stack variables. ###### [` include_types `]() property include\_types → bool Include full type definitions. If true, the output will contain the full definition of types (structs, enums, unions). ###### [` indentation `]() property indentation → int The number of spaces for indentation. ###### [` is_cpp `]() property is\_cpp → bool Prefer C++ syntax over C syntax. If true, the output will use C++ features (e.g., `bool` keyword) ###### [` show_extended_annotations `]() property show\_extended\_annotations → bool Enable extended comments and annotations. If true, the generated code will include comments containing low-level details such as memory addresses, offsets, type sizes, and original source locations. ###### [` show_field_offsets `]() property show\_field\_offsets → bool Show the relative offset of each field/attribute in structures. If true, every member of a structure is prefixed with its byte offset (e.g. `/* 0x04 */`). ###### [` type_aliases `]() property type\_aliases → dict[str, str] Mapping of type names to user-friendly aliases used while rendering types (e.g. `std::basic_string` -> `std::string`). --- ### [Rust]() - [`lief::generic::DebugInfo`]() - [`lief::DebugLocation`]() - [`lief::DeclOpt`]() --- documentID: "03505adf58bbae96640ed2364838a7da4718662c60d2b39210435d8c1e06290f" docname: "extended/disassembler/cpp/arch/aarch64" title: "AArch64 - C++ Disassembler - LIEF Documentation" description: "AArch64 C++ Disassembler. See LIEF::assembly::aarch64::OPCODE in include/asm/aarch64/opcodes.hpp" canonical: "https://lief.re/doc/latest/extended/disassembler/cpp/arch/aarch64.html" markdownURL: "https://lief.re/doc/latest/extended/disassembler/cpp/arch/aarch64.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "4ce859202cec9539e552681d230711bdb89dd0274deb7fc61ee6eed87d2c2dca" --- # [AArch64]() ## [Instruction]() ### [` Instruction `]() class Instruction : public LIEF::assembly::[Instruction]( "LIEF::assembly::Instruction") This class represents an AArch64 instruction. Public Types #### [` operands_it `]() using operands\_it = [iterator\_range]( "LIEF::iterator_range")<[Operand]( "LIEF::assembly::aarch64::Operand")::[Iterator]( "LIEF::assembly::aarch64::Operand::Iterator")> Public Functions #### [` opcode `]() OPCODE opcode() const The instruction opcode as defined in LLVM. #### [` operands `]() [operands\_it]( "LIEF::assembly::aarch64::Instruction::operands_it") operands() const [Iterator]() over the operands of the current instruction. #### [` ~Instruction `]() virtual ~Instruction() override = default Public Static Functions #### [` classof `]() static bool classof(const assembly::[Instruction]( "LIEF::assembly::Instruction") \*inst) True if `inst` is an **effective** instance of [aarch64::Instruction](). ## [Opcodes]() See `LIEF::assembly::aarch64::OPCODE` in `include/asm/aarch64/opcodes.hpp` ## [Operands]() ### [` Operand `]() class Operand This class represents an operand for an AArch64 instruction. Subclassed by [LIEF::assembly::aarch64::operands::Immediate](), [LIEF::assembly::aarch64::operands::Memory](), [LIEF::assembly::aarch64::operands::PCRelative](), [LIEF::assembly::aarch64::operands::Register]() Public Functions #### [` to_string `]() std::string to\_string() const Pretty representation of the operand. #### [` Tas `]() template<class T> inline const [T]( "LIEF::assembly::aarch64::Operand::as::T") \*as() const This function can be used to **down cast** an [Operand]() instance: ```cpp std::unique_ptr op = ...; if (const auto* imm = inst->as()) { const int64_t value = imm->value(); } ``` #### [` ~Operand `]() virtual ~Operand() Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Operand]( "LIEF::assembly::aarch64::Operand") &op) #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::assembly::aarch64::Operand::Iterator"), std::forward\_iterator\_tag, [Operand]( "LIEF::assembly::aarch64::Operand"), std::ptrdiff\_t, const [Operand]( "LIEF::assembly::aarch64::Operand")\*, const [Operand]( "LIEF::assembly::aarch64::Operand")&> **Forward** iterator that lazily disassembles aarch64 [Operand](). Public Types ##### [` implementation `]() using implementation = details::OperandIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::OperandIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::assembly::aarch64::Operand::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::assembly::aarch64::Operand::Iterator") &operator=(const [Iterator]( "LIEF::assembly::aarch64::Operand::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::assembly::aarch64::Operand::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::assembly::aarch64::Operand::Iterator") &operator=([Iterator]( "LIEF::assembly::aarch64::Operand::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::assembly::aarch64::Operand::Iterator") &operator++() ##### [` operator* `]() const [Operand]( "LIEF::assembly::aarch64::Operand") &operator\*() const ##### [` operator-> `]() const [Operand]( "LIEF::assembly::aarch64::Operand") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Operand]( "LIEF::assembly::aarch64::Operand")> yield() Transfer ownership of the operand at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::assembly::aarch64::Operand::Iterator") &LHS, const [Iterator]( "LIEF::assembly::aarch64::Operand::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::assembly::aarch64::Operand::Iterator") &LHS, const [Iterator]( "LIEF::assembly::aarch64::Operand::Iterator") &RHS) ### [Immediate]() #### [` Immediate `]() class Immediate : public LIEF::assembly::aarch64::[Operand]( "LIEF::assembly::aarch64::Operand") This class represents an immediate operand (i.e. a constant). For instance: ```text mov x0, #8; | +---> Immediate(8) ``` Public Functions ##### [` value `]() int64\_t value() const The constant value wrapped by this operand. ##### [` ~Immediate `]() ~Immediate() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::aarch64::Operand") \*op) ### [Register]() #### [` Register `]() class Register : public LIEF::assembly::aarch64::[Operand]( "LIEF::assembly::aarch64::Operand") This class represents a register operand. ```text mrs x0, TPIDR_EL0 | | +------+ +-------+ | | v v REG SYSREG ``` Public Functions ##### [` value `]() [reg\_t]( "LIEF::assembly::aarch64::operands::Register::reg_t") value() const The effective register as either: a REG or a SYSREG. ##### [` ~Register `]() ~Register() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::aarch64::Operand") \*op) ##### [` reg_t `]() struct reg\_t Public Types ###### [` TYPE `]() enum class TYPE Enum type used to discriminate the anonymous union. *Values:* ###### [` NONE `]() enumerator NONE = 0 ###### [` SYSREG `]() enumerator SYSREG The union holds a sysreg attribute. ###### [` REG `]() enumerator REG The union holds the reg attribute. Public Members ###### [` [anonymous] `]() union LIEF::assembly::aarch64::operands::[Register]( "LIEF::assembly::aarch64::operands::Register")::[reg\_t]( "LIEF::assembly::aarch64::operands::Register::reg_t")::[anonymous] [anonymous] ###### [` type `]() [TYPE]( "LIEF::assembly::aarch64::operands::Register::reg_t::TYPE") type = [TYPE]( "LIEF::assembly::aarch64::operands::Register::reg_t::TYPE")::[NONE]( "LIEF::assembly::aarch64::operands::Register::reg_t::TYPE::NONE") **[union].\_\_unnamed0\_\_** Public Members ###### [` reg `]() REG reg ###### [` sysreg `]() SYSREG sysreg ### [Memory]() #### [` Memory `]() class Memory : public LIEF::assembly::aarch64::[Operand]( "LIEF::assembly::aarch64::Operand") This class represents a memory operand. ```text ldr x0, [x1, x2, lsl #3] | | | +------------+ | +--------+ | | | v v v Base Reg Offset Shift ``` Public Types ##### [` SHIFT `]() enum class SHIFT : int32\_t *Values:* ###### [` UNKNOWN `]() enumerator UNKNOWN = 0 ###### [` LSL `]() enumerator LSL ###### [` UXTX `]() enumerator UXTX ###### [` UXTW `]() enumerator UXTW ###### [` SXTX `]() enumerator SXTX ###### [` SXTW `]() enumerator SXTW Public Functions ##### [` base `]() REG base() const The base register. For `str x3, [x8, #8]` it would return `x8`. ##### [` offset `]() [offset\_t]( "LIEF::assembly::aarch64::operands::Memory::offset_t") offset() const The addressing offset. It can be either: - A register (e.g. `ldr x0, [x1, x3]`) - An offset (e.g. `ldr x0, [x1, #8]`) ##### [` shift `]() [shift\_info\_t]( "LIEF::assembly::aarch64::operands::Memory::shift_info_t") shift() const Shift information. For instance, for `ldr x1, [x2, x3, lsl #3]` it would return a [SHIFT::LSL]() with a [shift\_info\_t::value]() set to `3`. ##### [` ~Memory `]() ~Memory() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::aarch64::Operand") \*op) ##### [` shift_info_t `]() struct shift\_info\_t This structure holds shift info (type + value). Public Members ###### [` type `]() [SHIFT]( "LIEF::assembly::aarch64::operands::Memory::SHIFT") type = [SHIFT]( "LIEF::assembly::aarch64::operands::Memory::SHIFT")::[UNKNOWN]( "LIEF::assembly::aarch64::operands::Memory::SHIFT::UNKNOWN") ###### [` value `]() int8\_t value = -1 ##### [` offset_t `]() struct offset\_t Wraps a memory offset as an integer offset or as a register offset. Public Types ###### [` TYPE `]() enum class TYPE Enum type used to discriminate the anonymous union. *Values:* ###### [` NONE `]() enumerator NONE = 0 ###### [` REG `]() enumerator REG The *union* holds the REG attribute. ###### [` DISP `]() enumerator DISP The *union* holds the `displacement` attribute (`int64_t`). Public Members ###### [` [anonymous] `]() union LIEF::assembly::aarch64::operands::[Memory]( "LIEF::assembly::aarch64::operands::Memory")::[offset\_t]( "LIEF::assembly::aarch64::operands::Memory::offset_t")::[anonymous] [anonymous] ###### [` type `]() [TYPE]( "LIEF::assembly::aarch64::operands::Memory::offset_t::TYPE") type = [TYPE]( "LIEF::assembly::aarch64::operands::Memory::offset_t::TYPE")::[NONE]( "LIEF::assembly::aarch64::operands::Memory::offset_t::TYPE::NONE") **[union].\_\_unnamed0\_\_** Public Members ###### [` reg `]() REG reg [Register]() offset. ###### [` displacement `]() int64\_t displacement Integer offset. ### [PCRelative]() #### [` PCRelative `]() class PCRelative : public LIEF::assembly::aarch64::[Operand]( "LIEF::assembly::aarch64::Operand") This class represents a PC-relative operand. ```text ldr x0, #8 | v PC Relative operand ``` Public Functions ##### [` value `]() int64\_t value() const The effective value that is relative to the current `pc` register. ##### [` ~PCRelative `]() ~PCRelative() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::aarch64::Operand") \*op) --- documentID: "3c525601b912f19deaf722c137d2cd1decf635e3a1f38b74199950a61ed333b9" docname: "extended/disassembler/cpp/arch/arm" title: "ARM - C++ Disassembler - LIEF Documentation" description: "ARM C++ Disassembler. See LIEF::assembly::arm::OPCODE in include/asm/arm/opcodes.hpp" canonical: "https://lief.re/doc/latest/extended/disassembler/cpp/arch/arm.html" markdownURL: "https://lief.re/doc/latest/extended/disassembler/cpp/arch/arm.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "d1bf21eab8063f94553a25ce8530d8e8c42e32f00ab8dec798f460a8e8a0ba7e" --- # [ARM]() ## [Instruction]() ### [` Instruction `]() class Instruction : public LIEF::assembly::[Instruction]( "LIEF::assembly::Instruction") This class represents an ARM/Thumb instruction. Public Functions #### [` opcode `]() OPCODE opcode() const The instruction opcode as defined in LLVM. #### [` ~Instruction `]() virtual ~Instruction() override = default Public Static Functions #### [` classof `]() static bool classof(const assembly::[Instruction]( "LIEF::assembly::Instruction") \*inst) True if `inst` is an **effective** instance of [arm::Instruction](). ## [Opcodes]() See `LIEF::assembly::arm::OPCODE` in `include/asm/arm/opcodes.hpp` --- documentID: "8d62d614620115bc4ecb1efefd78a8dd8d2129f2840272382827ad1f0c213220" docname: "extended/disassembler/cpp/arch/ebpf" title: "eBPF - C++ Disassembler - LIEF Documentation" description: "eBPF C++ Disassembler. See LIEF::assembly::ebpf::OPCODE in include/asm/ebpf/opcodes.hpp" canonical: "https://lief.re/doc/latest/extended/disassembler/cpp/arch/ebpf.html" markdownURL: "https://lief.re/doc/latest/extended/disassembler/cpp/arch/ebpf.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "98c4eefa87aff1cef09e7731500234a6b3d111d160e1f5e3242ed1867208ed9b" --- # [eBPF]() ## [Instruction]() ### [` Instruction `]() class Instruction : public LIEF::assembly::[Instruction]( "LIEF::assembly::Instruction") This class represents an eBPF instruction. Public Types #### [` operands_it `]() using operands\_it = [iterator\_range]( "LIEF::iterator_range")<[Operand]( "LIEF::assembly::ebpf::Operand")::[Iterator]( "LIEF::assembly::ebpf::Operand::Iterator")> Public Functions #### [` opcode `]() OPCODE opcode() const The instruction opcode as defined in LLVM. #### [` operands `]() [operands\_it]( "LIEF::assembly::ebpf::Instruction::operands_it") operands() const [Iterator]() over the operands of the current instruction. #### [` ~Instruction `]() virtual ~Instruction() override = default Public Static Functions #### [` classof `]() static bool classof(const assembly::[Instruction]( "LIEF::assembly::Instruction") \*inst) True if `inst` is an **effective** instance of [ebpf::Instruction](). ## [Opcodes]() See `LIEF::assembly::ebpf::OPCODE` in `include/asm/ebpf/opcodes.hpp` ## [Operands]() ### [` Operand `]() class Operand This class represents an operand for an eBPF instruction. Subclassed by [LIEF::assembly::ebpf::operands::Immediate](), [LIEF::assembly::ebpf::operands::Memory](), [LIEF::assembly::ebpf::operands::PCRelative](), [LIEF::assembly::ebpf::operands::Register]() Public Functions #### [` to_string `]() std::string to\_string() const Pretty representation of the operand. #### [` Tas `]() template<class T> inline const [T]( "LIEF::assembly::ebpf::Operand::as::T") \*as() const This function can be used to **down cast** an [Operand]() instance: ```cpp std::unique_ptr op = ...; if (const auto* imm = inst->as()) { const int64_t value = imm->value(); } ``` #### [` ~Operand `]() virtual ~Operand() Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Operand]( "LIEF::assembly::ebpf::Operand") &op) #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::assembly::ebpf::Operand::Iterator"), std::forward\_iterator\_tag, [Operand]( "LIEF::assembly::ebpf::Operand"), std::ptrdiff\_t, const [Operand]( "LIEF::assembly::ebpf::Operand")\*, const [Operand]( "LIEF::assembly::ebpf::Operand")&> **Forward** iterator that lazily disassembles ebpf [Operand](). Public Types ##### [` implementation `]() using implementation = details::OperandIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::OperandIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::assembly::ebpf::Operand::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::assembly::ebpf::Operand::Iterator") &operator=(const [Iterator]( "LIEF::assembly::ebpf::Operand::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::assembly::ebpf::Operand::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::assembly::ebpf::Operand::Iterator") &operator=([Iterator]( "LIEF::assembly::ebpf::Operand::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::assembly::ebpf::Operand::Iterator") &operator++() ##### [` operator* `]() const [Operand]( "LIEF::assembly::ebpf::Operand") &operator\*() const ##### [` operator-> `]() const [Operand]( "LIEF::assembly::ebpf::Operand") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Operand]( "LIEF::assembly::ebpf::Operand")> yield() Transfer ownership of the operand at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::assembly::ebpf::Operand::Iterator") &LHS, const [Iterator]( "LIEF::assembly::ebpf::Operand::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::assembly::ebpf::Operand::Iterator") &LHS, const [Iterator]( "LIEF::assembly::ebpf::Operand::Iterator") &RHS) ### [Immediate]() #### [` Immediate `]() class Immediate : public LIEF::assembly::ebpf::[Operand]( "LIEF::assembly::ebpf::Operand") This class represents an immediate operand (i.e. a constant). For instance: ```text r1 = 8 | +---> Immediate(8) ``` Public Functions ##### [` value `]() int64\_t value() const The constant value wrapped by this operand. ##### [` ~Immediate `]() ~Immediate() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::ebpf::Operand") \*op) ### [Register]() #### [` Register `]() class Register : public LIEF::assembly::ebpf::[Operand]( "LIEF::assembly::ebpf::Operand") This class represents a register operand. For instance: ```text r0 = r1 | | | +---------> Register(r1) | +--------------> Register(r0) ``` Public Functions ##### [` value `]() REG value() const The effective REG wrapped by this operand. ##### [` ~Register `]() ~Register() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::ebpf::Operand") \*op) ### [Memory]() #### [` Memory `]() class Memory : public LIEF::assembly::ebpf::[Operand]( "LIEF::assembly::ebpf::Operand") This class represents a memory operand. ```text *(u64 *)(r1 + 8) = r2 | | | +-----> Displacement: 8 | +----------> Base: r1 ``` Public Functions ##### [` base `]() REG base() const The base register. For `*(u64 *)(r1 + 8)` it would return `r1`. ##### [` displacement `]() int64\_t displacement() const The displacement value. For `*(u64 *)(r1 + 8)` it would return `8`. ##### [` ~Memory `]() ~Memory() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::ebpf::Operand") \*op) ### [PCRelative]() #### [` PCRelative `]() class PCRelative : public LIEF::assembly::ebpf::[Operand]( "LIEF::assembly::ebpf::Operand") This class represents a PC-relative operand. ```text if r1 == 0 goto +5 | v PC Relative operand ``` Public Functions ##### [` value `]() int64\_t value() const The effective value that is relative to the current `pc` register. ##### [` ~PCRelative `]() ~PCRelative() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::ebpf::Operand") \*op) --- documentID: "d91f8bcf149c799357bf8cc1485239911af3900df958b68df10820c6f771916d" docname: "extended/disassembler/cpp/arch/mips" title: "Mips - C++ Disassembler - LIEF Documentation" description: "Mips C++ Disassembler. See LIEF::assembly::mips::OPCODE in include/asm/mips/opcodes.hpp" canonical: "https://lief.re/doc/latest/extended/disassembler/cpp/arch/mips.html" markdownURL: "https://lief.re/doc/latest/extended/disassembler/cpp/arch/mips.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "5c4cd36fcc3764dcc7d35e8889134ffce140e3ba1777ed90b607205b852b540f" --- # [Mips]() ## [Instruction]() ### [` Instruction `]() class Instruction : public LIEF::assembly::[Instruction]( "LIEF::assembly::Instruction") This class represents a Mips instruction (including mips64, mips32). Public Types #### [` operands_it `]() using operands\_it = [iterator\_range]( "LIEF::iterator_range")<[Operand]( "LIEF::assembly::mips::Operand")::[Iterator]( "LIEF::assembly::mips::Operand::Iterator")> Public Functions #### [` opcode `]() OPCODE opcode() const The instruction opcode as defined in LLVM. #### [` operands `]() [operands\_it]( "LIEF::assembly::mips::Instruction::operands_it") operands() const [Iterator]() over the operands of the current instruction. #### [` ~Instruction `]() virtual ~Instruction() override = default Public Static Functions #### [` classof `]() static bool classof(const assembly::[Instruction]( "LIEF::assembly::Instruction") \*inst) True if `inst` is an **effective** instance of [mips::Instruction](). ## [Opcodes]() See `LIEF::assembly::mips::OPCODE` in `include/asm/mips/opcodes.hpp` ## [Operands]() ### [` Operand `]() class Operand This class represents an operand for a Mips instruction. Subclassed by [LIEF::assembly::mips::operands::Immediate](), [LIEF::assembly::mips::operands::Memory](), [LIEF::assembly::mips::operands::PCRelative](), [LIEF::assembly::mips::operands::Register]() Public Functions #### [` to_string `]() std::string to\_string() const Pretty representation of the operand. #### [` Tas `]() template<class T> inline const [T]( "LIEF::assembly::mips::Operand::as::T") \*as() const This function can be used to **down cast** an [Operand]() instance: ```cpp std::unique_ptr op = ...; if (const auto* imm = inst->as()) { const int64_t value = imm->value(); } ``` #### [` ~Operand `]() virtual ~Operand() Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Operand]( "LIEF::assembly::mips::Operand") &op) #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::assembly::mips::Operand::Iterator"), std::forward\_iterator\_tag, [Operand]( "LIEF::assembly::mips::Operand"), std::ptrdiff\_t, const [Operand]( "LIEF::assembly::mips::Operand")\*, const [Operand]( "LIEF::assembly::mips::Operand")&> **Forward** iterator that lazily disassembles mips [Operand](). Public Types ##### [` implementation `]() using implementation = details::OperandIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::OperandIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::assembly::mips::Operand::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::assembly::mips::Operand::Iterator") &operator=(const [Iterator]( "LIEF::assembly::mips::Operand::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::assembly::mips::Operand::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::assembly::mips::Operand::Iterator") &operator=([Iterator]( "LIEF::assembly::mips::Operand::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::assembly::mips::Operand::Iterator") &operator++() ##### [` operator* `]() const [Operand]( "LIEF::assembly::mips::Operand") &operator\*() const ##### [` operator-> `]() const [Operand]( "LIEF::assembly::mips::Operand") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Operand]( "LIEF::assembly::mips::Operand")> yield() Transfer ownership of the operand at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::assembly::mips::Operand::Iterator") &LHS, const [Iterator]( "LIEF::assembly::mips::Operand::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::assembly::mips::Operand::Iterator") &LHS, const [Iterator]( "LIEF::assembly::mips::Operand::Iterator") &RHS) ### [Immediate]() #### [` Immediate `]() class Immediate : public LIEF::assembly::mips::[Operand]( "LIEF::assembly::mips::Operand") This class represents an immediate operand (i.e. a constant). For instance: ```text addiu $4, $5, 8 | +---> Immediate(8) ``` Public Functions ##### [` value `]() int64\_t value() const The constant value wrapped by this operand. ##### [` ~Immediate `]() ~Immediate() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::mips::Operand") \*op) ### [Register]() #### [` Register `]() class Register : public LIEF::assembly::mips::[Operand]( "LIEF::assembly::mips::Operand") This class represents a register operand. For instance: ```text move $4, $5 | | | +---------> Register($5) | +-------------> Register($4) ``` Public Functions ##### [` value `]() REG value() const The effective REG wrapped by this operand. ##### [` ~Register `]() ~Register() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::mips::Operand") \*op) ### [Memory]() #### [` Memory `]() class Memory : public LIEF::assembly::mips::[Operand]( "LIEF::assembly::mips::Operand") This class represents a memory operand. MIPS has two addressing forms: ```text lw $4, 8($5) ldxc1 $f2, $4($7) | | | | | | +------+ | +---+ +-------+ | +-----+ | | | | | | v v v v v v Reg Disp Base Reg Index Base ``` Public Functions ##### [` base `]() REG base() const The base register. For `lw $4, 8($5)` it would return `$5`. ##### [` offset `]() [offset\_t]( "LIEF::assembly::mips::operands::Memory::offset_t") offset() const The addressing offset. It can be either: - A register (e.g. `ldxc1 $f2, $4($7)`) - A displacement (e.g. `lw $4, 8($5)`) ##### [` ~Memory `]() ~Memory() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::mips::Operand") \*op) ##### [` offset_t `]() struct offset\_t Wraps the memory offset as either an integer displacement or an index register. Public Types ###### [` TYPE `]() enum class TYPE Enum type used to discriminate the anonymous union. *Values:* ###### [` NONE `]() enumerator NONE = 0 ###### [` REG `]() enumerator REG The *union* holds the REG attribute. ###### [` DISP `]() enumerator DISP The *union* holds the `displacement` attribute (`int64_t`). Public Members ###### [` [anonymous] `]() union LIEF::assembly::mips::operands::[Memory]( "LIEF::assembly::mips::operands::Memory")::[offset\_t]( "LIEF::assembly::mips::operands::Memory::offset_t")::[anonymous] [anonymous] ###### [` type `]() [TYPE]( "LIEF::assembly::mips::operands::Memory::offset_t::TYPE") type = [TYPE]( "LIEF::assembly::mips::operands::Memory::offset_t::TYPE")::[NONE]( "LIEF::assembly::mips::operands::Memory::offset_t::TYPE::NONE") **[union].\_\_unnamed0\_\_** Public Members ###### [` reg `]() REG reg [Register]() offset (index register). ###### [` displacement `]() int64\_t displacement Integer offset. ### [PCRelative]() #### [` PCRelative `]() class PCRelative : public LIEF::assembly::mips::[Operand]( "LIEF::assembly::mips::Operand") This class represents a PC-relative operand. ```text bal 0x100 | v PC Relative operand ``` Public Functions ##### [` value `]() int64\_t value() const The effective value that is relative to the current `pc` register. ##### [` ~PCRelative `]() ~PCRelative() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::mips::Operand") \*op) --- documentID: "b1129caa73e5671e3361306b29d1802870aa782fc8c521e98d4a806fde1c28b7" docname: "extended/disassembler/cpp/arch/powerpc" title: "PowerPC - C++ Disassembler - LIEF Documentation" description: "PowerPC C++ Disassembler. See LIEF::assembly::powerpc::OPCODE in include/asm/powerpc/opcodes.hpp" canonical: "https://lief.re/doc/latest/extended/disassembler/cpp/arch/powerpc.html" markdownURL: "https://lief.re/doc/latest/extended/disassembler/cpp/arch/powerpc.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "6d0d5e88e6fabea53d910c739a19a0daf12a9f3326dbfa2591bd6b94c2c765ae" --- # [PowerPC]() ## [Instruction]() ### [` Instruction `]() class Instruction : public LIEF::assembly::[Instruction]( "LIEF::assembly::Instruction") Public Types #### [` operands_it `]() using operands\_it = [iterator\_range]( "LIEF::iterator_range")<[Operand]( "LIEF::assembly::powerpc::Operand")::[Iterator]( "LIEF::assembly::powerpc::Operand::Iterator")> Public Functions #### [` opcode `]() OPCODE opcode() const The instruction opcode as defined in LLVM. #### [` operands `]() [operands\_it]( "LIEF::assembly::powerpc::Instruction::operands_it") operands() const [Iterator]() over the operands of the current instruction. #### [` ~Instruction `]() virtual ~Instruction() override = default Public Static Functions #### [` classof `]() static bool classof(const assembly::[Instruction]( "LIEF::assembly::Instruction") \*inst) True if `inst` is an **effective** instance of [powerpc::Instruction](). ## [Opcodes]() See `LIEF::assembly::powerpc::OPCODE` in `include/asm/powerpc/opcodes.hpp` ## [Operands]() ### [` Operand `]() class Operand This class represents an operand for a PowerPC instruction. Subclassed by [LIEF::assembly::powerpc::operands::Immediate](), [LIEF::assembly::powerpc::operands::Memory](), [LIEF::assembly::powerpc::operands::PCRelative](), [LIEF::assembly::powerpc::operands::Register]() Public Functions #### [` to_string `]() std::string to\_string() const Pretty representation of the operand. #### [` Tas `]() template<class T> inline const [T]( "LIEF::assembly::powerpc::Operand::as::T") \*as() const This function can be used to **down cast** an [Operand]() instance: ```cpp std::unique_ptr op = ...; if (const auto* imm = inst->as()) { const int64_t value = imm->value(); } ``` #### [` ~Operand `]() virtual ~Operand() Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Operand]( "LIEF::assembly::powerpc::Operand") &op) #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::assembly::powerpc::Operand::Iterator"), std::forward\_iterator\_tag, [Operand]( "LIEF::assembly::powerpc::Operand"), std::ptrdiff\_t, const [Operand]( "LIEF::assembly::powerpc::Operand")\*, const [Operand]( "LIEF::assembly::powerpc::Operand")&> **Forward** iterator that lazily disassembles powerpc [Operand](). Public Types ##### [` implementation `]() using implementation = details::OperandIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::OperandIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::assembly::powerpc::Operand::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::assembly::powerpc::Operand::Iterator") &operator=(const [Iterator]( "LIEF::assembly::powerpc::Operand::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::assembly::powerpc::Operand::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::assembly::powerpc::Operand::Iterator") &operator=([Iterator]( "LIEF::assembly::powerpc::Operand::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::assembly::powerpc::Operand::Iterator") &operator++() ##### [` operator* `]() const [Operand]( "LIEF::assembly::powerpc::Operand") &operator\*() const ##### [` operator-> `]() const [Operand]( "LIEF::assembly::powerpc::Operand") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Operand]( "LIEF::assembly::powerpc::Operand")> yield() Transfer ownership of the operand at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::assembly::powerpc::Operand::Iterator") &LHS, const [Iterator]( "LIEF::assembly::powerpc::Operand::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::assembly::powerpc::Operand::Iterator") &LHS, const [Iterator]( "LIEF::assembly::powerpc::Operand::Iterator") &RHS) ### [Immediate]() #### [` Immediate `]() class Immediate : public LIEF::assembly::powerpc::[Operand]( "LIEF::assembly::powerpc::Operand") This class represents an immediate operand (i.e. a constant). For instance: ```text li 3, 8 | +---> Immediate(8) ``` Public Functions ##### [` value `]() int64\_t value() const The constant value wrapped by this operand. ##### [` ~Immediate `]() ~Immediate() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::powerpc::Operand") \*op) ### [Register]() #### [` Register `]() class Register : public LIEF::assembly::powerpc::[Operand]( "LIEF::assembly::powerpc::Operand") This class represents a register operand. For instance: ```text add 3, 4, 5 | | | | | +---------> Register(5) | +------------> Register(4) +---------------> Register(3) ``` Public Functions ##### [` value `]() REG value() const The effective REG wrapped by this operand. ##### [` ~Register `]() ~Register() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::powerpc::Operand") \*op) ### [Memory]() #### [` Memory `]() class Memory : public LIEF::assembly::powerpc::[Operand]( "LIEF::assembly::powerpc::Operand") This class represents a memory operand. PowerPC has two addressing forms: ```text lwz 3, 8(4) lwzx 3, 4, 5 | | | | | +------+ +---+ +------+ | +---+ | | | | | v v v v v Disp Base Reg Base Index ``` Public Functions ##### [` base `]() REG base() const The base register. For `lwz 3, 8(4)` it would return `4`. ##### [` offset `]() [offset\_t]( "LIEF::assembly::powerpc::operands::Memory::offset_t") offset() const The addressing offset. It can be either: - An index register (e.g. `lwzx 3, 4, 5`) - A displacement (e.g. `lwz 3, 8(4)`) ##### [` ~Memory `]() ~Memory() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::powerpc::Operand") \*op) ##### [` offset_t `]() struct offset\_t Wraps the memory offset as either an integer displacement or an index register. Public Types ###### [` TYPE `]() enum class TYPE Enum type used to discriminate the anonymous union. *Values:* ###### [` NONE `]() enumerator NONE = 0 ###### [` REG `]() enumerator REG The *union* holds the REG attribute. ###### [` DISP `]() enumerator DISP The *union* holds the `displacement` attribute (`int64_t`). Public Members ###### [` [anonymous] `]() union LIEF::assembly::powerpc::operands::[Memory]( "LIEF::assembly::powerpc::operands::Memory")::[offset\_t]( "LIEF::assembly::powerpc::operands::Memory::offset_t")::[anonymous] [anonymous] ###### [` type `]() [TYPE]( "LIEF::assembly::powerpc::operands::Memory::offset_t::TYPE") type = [TYPE]( "LIEF::assembly::powerpc::operands::Memory::offset_t::TYPE")::[NONE]( "LIEF::assembly::powerpc::operands::Memory::offset_t::TYPE::NONE") **[union].\_\_unnamed0\_\_** Public Members ###### [` reg `]() REG reg [Register]() offset (index register). ###### [` displacement `]() int64\_t displacement Integer offset. ### [PCRelative]() #### [` PCRelative `]() class PCRelative : public LIEF::assembly::powerpc::[Operand]( "LIEF::assembly::powerpc::Operand") This class represents a PC-relative operand. ```text bl 0x100 | v PC Relative operand ``` Public Functions ##### [` value `]() int64\_t value() const The effective value that is relative to the current `pc` register. ##### [` ~PCRelative `]() ~PCRelative() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::powerpc::Operand") \*op) --- documentID: "c47f722d47efba5f635ff0ff517f9b452bc679bb3b0c426d3b61285a3d7bb05e" docname: "extended/disassembler/cpp/arch/riscv" title: "RISC-V - C++ Disassembler - LIEF Documentation" description: "RISC-V C++ Disassembler. See LIEF::assembly::riscv::OPCODE in include/asm/riscv/opcodes.hpp" canonical: "https://lief.re/doc/latest/extended/disassembler/cpp/arch/riscv.html" markdownURL: "https://lief.re/doc/latest/extended/disassembler/cpp/arch/riscv.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "62d1e1503bee3adbc40aee68760b1fbb7446373d80d7371fd0b3fc53357eec0a" --- # [RISC-V]() ## [Instruction]() ### [` Instruction `]() class Instruction : public LIEF::assembly::[Instruction]( "LIEF::assembly::Instruction") This class represents a RISC-V (32 or 64 bit) instruction. Public Types #### [` operands_it `]() using operands\_it = [iterator\_range]( "LIEF::iterator_range")<[Operand]( "LIEF::assembly::riscv::Operand")::[Iterator]( "LIEF::assembly::riscv::Operand::Iterator")> Public Functions #### [` opcode `]() OPCODE opcode() const The instruction opcode as defined in LLVM. #### [` operands `]() [operands\_it]( "LIEF::assembly::riscv::Instruction::operands_it") operands() const [Iterator]() over the operands of the current instruction. #### [` ~Instruction `]() virtual ~Instruction() override = default Public Static Functions #### [` classof `]() static bool classof(const assembly::[Instruction]( "LIEF::assembly::Instruction") \*inst) True if `inst` is an **effective** instance of [riscv::Instruction](). ## [Opcodes]() See `LIEF::assembly::riscv::OPCODE` in `include/asm/riscv/opcodes.hpp` ## [Operands]() ### [` Operand `]() class Operand This class represents an operand for a RISC-V instruction. Subclassed by [LIEF::assembly::riscv::operands::Immediate](), [LIEF::assembly::riscv::operands::Memory](), [LIEF::assembly::riscv::operands::PCRelative](), [LIEF::assembly::riscv::operands::Register]() Public Functions #### [` to_string `]() std::string to\_string() const Pretty representation of the operand. #### [` Tas `]() template<class T> inline const [T]( "LIEF::assembly::riscv::Operand::as::T") \*as() const This function can be used to **down cast** an [Operand]() instance: ```cpp std::unique_ptr op = ...; if (const auto* imm = inst->as()) { const int64_t value = imm->value(); } ``` #### [` ~Operand `]() virtual ~Operand() Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Operand]( "LIEF::assembly::riscv::Operand") &op) #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::assembly::riscv::Operand::Iterator"), std::forward\_iterator\_tag, [Operand]( "LIEF::assembly::riscv::Operand"), std::ptrdiff\_t, const [Operand]( "LIEF::assembly::riscv::Operand")\*, const [Operand]( "LIEF::assembly::riscv::Operand")&> **Forward** iterator that lazily disassembles riscv [Operand](). Public Types ##### [` implementation `]() using implementation = details::OperandIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::OperandIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::assembly::riscv::Operand::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::assembly::riscv::Operand::Iterator") &operator=(const [Iterator]( "LIEF::assembly::riscv::Operand::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::assembly::riscv::Operand::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::assembly::riscv::Operand::Iterator") &operator=([Iterator]( "LIEF::assembly::riscv::Operand::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::assembly::riscv::Operand::Iterator") &operator++() ##### [` operator* `]() const [Operand]( "LIEF::assembly::riscv::Operand") &operator\*() const ##### [` operator-> `]() const [Operand]( "LIEF::assembly::riscv::Operand") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Operand]( "LIEF::assembly::riscv::Operand")> yield() Transfer ownership of the operand at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::assembly::riscv::Operand::Iterator") &LHS, const [Iterator]( "LIEF::assembly::riscv::Operand::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::assembly::riscv::Operand::Iterator") &LHS, const [Iterator]( "LIEF::assembly::riscv::Operand::Iterator") &RHS) ### [Immediate]() #### [` Immediate `]() class Immediate : public LIEF::assembly::riscv::[Operand]( "LIEF::assembly::riscv::Operand") This class represents an immediate operand (i.e. a constant). For instance: ```text addi a0, a1, 8 | +---> Immediate(8) ``` Public Functions ##### [` value `]() int64\_t value() const The constant value wrapped by this operand. ##### [` ~Immediate `]() ~Immediate() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::riscv::Operand") \*op) ### [Register]() #### [` Register `]() class Register : public LIEF::assembly::riscv::[Operand]( "LIEF::assembly::riscv::Operand") This class represents a register operand. RISC-V exposes two kinds of registers: regular registers (GPR, FPR, vector, …) and control and status registers (CSR / system registers). ```text csrr a0, mstatus | | +------+ +-------+ | | v v REG SYSREG ``` Public Functions ##### [` value `]() [reg\_t]( "LIEF::assembly::riscv::operands::Register::reg_t") value() const The effective register as either: a REG or a SYSREG. ##### [` ~Register `]() ~Register() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::riscv::Operand") \*op) ##### [` reg_t `]() struct reg\_t Public Types ###### [` TYPE `]() enum class TYPE Enum type used to discriminate the anonymous union. *Values:* ###### [` NONE `]() enumerator NONE = 0 ###### [` SYSREG `]() enumerator SYSREG The union holds a sysreg attribute. ###### [` REG `]() enumerator REG The union holds the reg attribute. Public Members ###### [` [anonymous] `]() union LIEF::assembly::riscv::operands::[Register]( "LIEF::assembly::riscv::operands::Register")::[reg\_t]( "LIEF::assembly::riscv::operands::Register::reg_t")::[anonymous] [anonymous] ###### [` type `]() [TYPE]( "LIEF::assembly::riscv::operands::Register::reg_t::TYPE") type = [TYPE]( "LIEF::assembly::riscv::operands::Register::reg_t::TYPE")::[NONE]( "LIEF::assembly::riscv::operands::Register::reg_t::TYPE::NONE") **[union].\_\_unnamed0\_\_** Public Members ###### [` reg `]() REG reg ###### [` sysreg `]() SYSREG sysreg ### [Memory]() #### [` Memory `]() class Memory : public LIEF::assembly::riscv::[Operand]( "LIEF::assembly::riscv::Operand") This class represents a memory operand. ```text lw a0, 8(sp) | | | +----> Base: sp | +-------> Displacement: 8 ``` Public Functions ##### [` base `]() REG base() const The base register. For `lw a0, 8(sp)` it would return `sp`. ##### [` displacement `]() int64\_t displacement() const The displacement value. For `lw a0, 8(sp)` it would return `8`. ##### [` ~Memory `]() ~Memory() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::riscv::Operand") \*op) ### [PCRelative]() #### [` PCRelative `]() class PCRelative : public LIEF::assembly::riscv::[Operand]( "LIEF::assembly::riscv::Operand") This class represents a PC-relative operand. ```text auipc a0, 0x1 | v PC Relative operand ``` Public Functions ##### [` value `]() int64\_t value() const The effective value that is relative to the current `pc` register. ##### [` ~PCRelative `]() ~PCRelative() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::riscv::Operand") \*op) --- documentID: "0450de3562891c41ae9e6729cf3225141d77dd1e4530db18b0411f4e5e5b48da" docname: "extended/disassembler/cpp/arch/x86" title: "X86/x86-64 - C++ Disassembler - LIEF Documentation" description: "X86/x86-64 C++ Disassembler. See LIEF::assembly::x86::OPCODE in include/asm/x86/opcodes.hpp" canonical: "https://lief.re/doc/latest/extended/disassembler/cpp/arch/x86.html" markdownURL: "https://lief.re/doc/latest/extended/disassembler/cpp/arch/x86.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "10d987bf8cb4e8e3ae5ad2b97421c95dec068a83af03f425a1c4d15b1af89f06" --- # [X86/x86-64]() ## [Instruction]() ### [` Instruction `]() class Instruction : public LIEF::assembly::[Instruction]( "LIEF::assembly::Instruction") This class represents a x86/x86-64 instruction. Public Types #### [` operands_it `]() using operands\_it = [iterator\_range]( "LIEF::iterator_range")<[Operand]( "LIEF::assembly::x86::Operand")::[Iterator]( "LIEF::assembly::x86::Operand::Iterator")> Public Functions #### [` opcode `]() OPCODE opcode() const The instruction opcode as defined in LLVM. #### [` operands `]() [operands\_it]( "LIEF::assembly::x86::Instruction::operands_it") operands() const [Iterator]() over the operands of the current instruction. #### [` has_lock_prefix `]() bool has\_lock\_prefix() const True if this instruction has a `LOCK` prefix. #### [` is_lockable `]() bool is\_lockable() const True if the `LOCK` prefix is architecturally valid on this instruction. #### [` is_atomic `]() bool is\_atomic() const True if this instruction executes as an atomic read-modify-write. #### [` lock `]() std::unique\_ptr<[Instruction]( "LIEF::assembly::x86::Instruction")> lock() const Re-encoded copy of this instruction with a `LOCK` prefix added. If the instruction already has a `LOCK` prefix, it returns a plain copy. #### [` unlock `]() std::unique\_ptr<[Instruction]( "LIEF::assembly::x86::Instruction")> unlock() const Re-encoded copy of this instruction with the `LOCK` prefix removed. If the instruction does not have a `LOCK` prefix, it returns a plain copy or a nullptr if the `LOCK` semantic can’t be removed. #### [` ~Instruction `]() virtual ~Instruction() override = default Public Static Functions #### [` classof `]() static bool classof(const assembly::[Instruction]( "LIEF::assembly::Instruction") \*inst) True if `inst` is an **effective** instance of [x86::Instruction](). ## [Opcodes]() See `LIEF::assembly::x86::OPCODE` in `include/asm/x86/opcodes.hpp` ## [Operands]() ### [` Operand `]() class Operand This class represents an operand for an x86/x86-64 instruction. Subclassed by [LIEF::assembly::x86::operands::Immediate](), [LIEF::assembly::x86::operands::Memory](), [LIEF::assembly::x86::operands::PCRelative](), [LIEF::assembly::x86::operands::Register]() Public Functions #### [` to_string `]() std::string to\_string() const Pretty representation of the operand. #### [` Tas `]() template<class T> inline const [T]( "LIEF::assembly::x86::Operand::as::T") \*as() const This function can be used to **down cast** an [Operand]() instance: ```cpp std::unique_ptr op = ...; if (const auto* memory = inst->as()) { const assembly::x86::REG base = memory->base(); } ``` #### [` ~Operand `]() virtual ~Operand() Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Operand]( "LIEF::assembly::x86::Operand") &op) #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::assembly::x86::Operand::Iterator"), std::forward\_iterator\_tag, [Operand]( "LIEF::assembly::x86::Operand"), std::ptrdiff\_t, const [Operand]( "LIEF::assembly::x86::Operand")\*, const [Operand]( "LIEF::assembly::x86::Operand")&> **Forward** iterator that lazily disassembles x86 [Operand](). Public Types ##### [` implementation `]() using implementation = details::OperandIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::OperandIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::assembly::x86::Operand::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::assembly::x86::Operand::Iterator") &operator=(const [Iterator]( "LIEF::assembly::x86::Operand::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::assembly::x86::Operand::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::assembly::x86::Operand::Iterator") &operator=([Iterator]( "LIEF::assembly::x86::Operand::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::assembly::x86::Operand::Iterator") &operator++() ##### [` operator* `]() const [Operand]( "LIEF::assembly::x86::Operand") &operator\*() const ##### [` operator-> `]() const [Operand]( "LIEF::assembly::x86::Operand") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Operand]( "LIEF::assembly::x86::Operand")> yield() Transfer ownership of the operand at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::assembly::x86::Operand::Iterator") &LHS, const [Iterator]( "LIEF::assembly::x86::Operand::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::assembly::x86::Operand::Iterator") &LHS, const [Iterator]( "LIEF::assembly::x86::Operand::Iterator") &RHS) ### [Immediate]() #### [` Immediate `]() class Immediate : public LIEF::assembly::x86::[Operand]( "LIEF::assembly::x86::Operand") This class represents an immediate operand (i.e. a constant). For instance: ```text mov edi, 1; | +---> Immediate(1) ``` Public Functions ##### [` value `]() int64\_t value() const The constant value wrapped by this operand. ##### [` ~Immediate `]() ~Immediate() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::x86::Operand") \*op) ### [Register]() #### [` Register `]() class Register : public LIEF::assembly::x86::[Operand]( "LIEF::assembly::x86::Operand") This class represents a register operand. For instance: ```text mov r15d, edi | | | +---------> Register(EDI) | +---------------> Register(R15D) ``` Public Functions ##### [` value `]() REG value() const The effective REG wrapped by this operand. ##### [` ~Register `]() ~Register() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::x86::Operand") \*op) ### [Memory]() #### [` Memory `]() class Memory : public LIEF::assembly::x86::[Operand]( "LIEF::assembly::x86::Operand") This class represents a memory operand. For instance: ```text movq xmm3, qword ptr [rip + 823864]; | | Memory | +-----------+-----------+ | | | Base: rip Scale: 1 Displacement: 823864 ``` Public Functions ##### [` base `]() REG base() const The base register. For `lea rdx, [rip + 244634]` it would return `rip` ##### [` scaled_register `]() REG scaled\_register() const The scaled register. For `mov rdi, qword ptr [r13 + 8*r14]` it would return `r14` ##### [` segment_register `]() REG segment\_register() const The segment register associated with the memory operation. For `mov eax, dword ptr gs:[0]` is would return `gs` ##### [` scale `]() uint64\_t scale() const The scale value associated with the [scaled\_register()](): For `mov rdi, qword ptr [r13 + 8*r14]` it would return `8` ##### [` displacement `]() int64\_t displacement() const The displacement value. For `call qword ptr [rip + 248779]` it would return `248779` ##### [` ~Memory `]() ~Memory() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::x86::Operand") \*op) ### [PCRelative]() #### [` PCRelative `]() class PCRelative : public LIEF::assembly::x86::[Operand]( "LIEF::assembly::x86::Operand") This class represents a RIP/EIP-relative operand. For instance: ```text jmp 67633; | +----------> PCRelative(67633) ``` Public Functions ##### [` value `]() int64\_t value() const The effective value that is relative to the current `rip/eip` register. ##### [` ~PCRelative `]() ~PCRelative() override = default Public Static Functions ##### [` classof `]() static bool classof(const [Operand]( "LIEF::assembly::x86::Operand") \*op) --- documentID: "516146c596309920f673ad4ce0f0ee2f1faa47bc05ab40f2521a6dadf7e05176" docname: "extended/disassembler/cpp/index" title: "Disassembler C++ API - LIEF Documentation" description: "Disassembler C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/extended/disassembler/cpp/index.html" markdownURL: "https://lief.re/doc/latest/extended/disassembler/cpp/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "aa200159dd6bc4d86d57e222cc00118b1797c10082aac23fd47616e6d006e8ae" --- # [C++]() ## [Architectures]() Architectures - [X86/x86-64]() - [AArch64]() - [RISC-V]() - [ARM]() - [eBPF]() - [Mips]() - [PowerPC]() ## [Engine]() ### [` Engine `]() class Engine This class interfaces the assembler/disassembler support. Public Types #### [` instructions_it `]() using instructions\_it = [iterator\_range]( "LIEF::iterator_range")<[Instruction]( "LIEF::assembly::Instruction")::[Iterator]( "LIEF::assembly::Instruction::Iterator")> Disassembly instruction iterator. Public Functions #### [` Engine `]() Engine() = delete #### [` Engine `]() Engine(std::unique\_ptr<details::Engine> impl) #### [` Engine `]() Engine(const [Engine]( "LIEF::assembly::Engine::Engine")&) = delete #### [` operator= `]() [Engine]( "LIEF::assembly::Engine") &operator=(const [Engine]( "LIEF::assembly::Engine")&) = delete #### [` Engine `]() Engine([Engine]( "LIEF::assembly::Engine::Engine")&&) noexcept #### [` operator= `]() [Engine]( "LIEF::assembly::Engine") &operator=([Engine]( "LIEF::assembly::Engine")&&) noexcept #### [` disassemble `]() [instructions\_it]( "LIEF::assembly::Engine::instructions_it") disassemble(const uint8\_t \*buffer, size\_t size, uint64\_t addr) Disassemble the provided buffer with the address specified in the second parameter. #### [` disassemble `]() inline [instructions\_it]( "LIEF::assembly::Engine::instructions_it") disassemble(const std::vector<uint8\_t> &bytes, uint64\_t addr) Disassemble the given vector of bytes with the address specified in the second parameter. #### [` assemble `]() std::vector<uint8\_t> assemble(uint64\_t address, const std::string &Asm, [AssemblerConfig]( "LIEF::assembly::AssemblerConfig") &config = [AssemblerConfig]( "LIEF::assembly::AssemblerConfig")::[default\_config]( "LIEF::assembly::AssemblerConfig::default_config")()) #### [` assemble `]() std::vector<uint8\_t> assemble(uint64\_t address, const std::string &Asm, LIEF::[Binary]( "LIEF::Binary") &bin, [AssemblerConfig]( "LIEF::assembly::AssemblerConfig") &config = [AssemblerConfig]( "LIEF::assembly::AssemblerConfig")::[default\_config]( "LIEF::assembly::AssemblerConfig::default_config")()) #### [` assemble `]() std::vector<uint8\_t> assemble(const llvm::MCInst &inst) #### [` assemble `]() std::vector<uint8\_t> assemble(const std::vector<llvm::MCInst> &inst) #### [` ~Engine `]() ~Engine() ## [Instruction]() ### [` Instruction `]() class Instruction This class represents an assembly instruction. Subclassed by [LIEF::assembly::aarch64::Instruction](), [LIEF::assembly::arm::Instruction](), [LIEF::assembly::ebpf::Instruction](), [LIEF::assembly::mips::Instruction](), [LIEF::assembly::powerpc::Instruction](), [LIEF::assembly::riscv::Instruction](), [LIEF::assembly::x86::Instruction]() Public Types #### [` MemoryAccess `]() enum class MemoryAccess : uint8\_t Memory operation flags. *Values:* ##### [` NONE `]() enumerator NONE = 0 ##### [` READ `]() enumerator READ = 1 << 0 ##### [` WRITE `]() enumerator WRITE = 1 << 1 ##### [` READ_WRITE `]() enumerator READ\_WRITE = [READ]( "LIEF::assembly::Instruction::MemoryAccess::READ") | [WRITE]( "LIEF::assembly::Instruction::MemoryAccess::WRITE") Public Functions #### [` address `]() uint64\_t address() const Address of the instruction. #### [` size `]() size\_t size() const Size of the instruction in bytes. #### [` raw `]() const std::vector<uint8\_t> &raw() const Raw bytes of the current instruction. #### [` mnemonic `]() std::string mnemonic() const [Instruction]() mnemonic (e.g. `br`). #### [` to_string `]() std::string to\_string(bool with\_address = true) const Representation of the current instruction in a pretty assembly way. #### [` is_call `]() bool is\_call() const True if the instruction is a call. #### [` is_terminator `]() bool is\_terminator() const True if the instruction marks the end of a basic block. #### [` is_branch `]() bool is\_branch() const True if the instruction is a branch. #### [` is_syscall `]() bool is\_syscall() const True if the instruction is a syscall. #### [` is_memory_access `]() bool is\_memory\_access() const True if the instruction performs a memory access. #### [` is_move_reg `]() bool is\_move\_reg() const True if the instruction is a register to register move. #### [` is_add `]() bool is\_add() const True if the instruction performs an arithmetic addition. #### [` is_trap `]() bool is\_trap() const True if the instruction is a trap. - On `x86/x86-64` this includes the `ud1/ud2` instructions - On `AArch64` this includes the `brk/udf` instructions #### [` is_barrier `]() bool is\_barrier() const True if the instruction prevents executing the instruction that immediately follows the current. This includes return or unconditional branch instructions. #### [` is_return `]() bool is\_return() const True if the instruction is a return. #### [` is_indirect_branch `]() bool is\_indirect\_branch() const True if the instruction is an indirect branch. This includes instructions that branch through a register (e.g. `jmp rax`, `br x1`). #### [` is_conditional_branch `]() bool is\_conditional\_branch() const True if the instruction is **conditionally** jumping to the next instruction **or** an instruction into some other basic block. #### [` is_unconditional_branch `]() bool is\_unconditional\_branch() const True if the instruction is jumping (**unconditionally**) to some other basic block. #### [` is_compare `]() bool is\_compare() const True if the instruction is a comparison. #### [` is_move_immediate `]() bool is\_move\_immediate() const True if the instruction is moving an immediate. #### [` is_bitcast `]() bool is\_bitcast() const True if the instruction is doing a bitcast. #### [` memory_access `]() [MemoryAccess]( "LIEF::assembly::Instruction::MemoryAccess") memory\_access() const Memory access flags. #### [` branch_target `]() [result]( "LIEF::result")<uint64\_t> branch\_target() const Given a [is\_branch()]() instruction, try to evaluate the address of the destination. #### [` mcinst `]() const llvm::MCInst &mcinst() const Return the underlying llvm::MCInst implementation. > **Warning** > > Because of ABI compatibility, this MCInst can **only be used** with the **same** version of LLVM used by LIEF (see documentation) #### [` Tas `]() template<class T> inline const [T]( "LIEF::assembly::Instruction::as::T") \*as() const This function can be used to **down cast** an [Instruction]() instance: ```cpp std::unique_ptr inst = get_inst(); if (const auto* arm = inst->as()) { const arm::OPCODE op = arm->opcode(); } ``` #### [` ~Instruction `]() virtual ~Instruction() Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Instruction]( "LIEF::assembly::Instruction") &inst) #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::assembly::Instruction::Iterator"), std::forward\_iterator\_tag, [Instruction]( "LIEF::assembly::Instruction"), std::ptrdiff\_t, const [Instruction]( "LIEF::assembly::Instruction")\*, const [Instruction]( "LIEF::assembly::Instruction")&> **Lazy-forward** iterator that disassembles instructions on demand. Public Types ##### [` implementation `]() using implementation = details::InstructionIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::InstructionIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::assembly::Instruction::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::assembly::Instruction::Iterator") &operator=(const [Iterator]( "LIEF::assembly::Instruction::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::assembly::Instruction::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::assembly::Instruction::Iterator") &operator=([Iterator]( "LIEF::assembly::Instruction::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::assembly::Instruction::Iterator") &operator++() ##### [` operator* `]() const [Instruction]( "LIEF::assembly::Instruction") &operator\*() const ##### [` operator-> `]() const [Instruction]( "LIEF::assembly::Instruction") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Instruction]( "LIEF::assembly::Instruction")> yield() Transfer ownership of the instruction at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::assembly::Instruction::Iterator") &LHS, const [Iterator]( "LIEF::assembly::Instruction::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::assembly::Instruction::Iterator") &LHS, const [Iterator]( "LIEF::assembly::Instruction::Iterator") &RHS) --- documentID: "58d5fd6e1134d2e86c817f3d11f8b88f41ff38774180629490d702ac48628f78" docname: "extended/disassembler/index" title: "Disassembler - LIEF Documentation" description: "Disassemble executable code with LIEF Extended, inspect architecture-specific instructions and operands, and use debug information or live memory." canonical: "https://lief.re/doc/latest/extended/disassembler/index.html" markdownURL: "https://lief.re/doc/latest/extended/disassembler/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "cc344f87759e569f51eb17bc87542aa1280db04c53f5ac73e9b26b2502bade62" --- # [Disassembler]() API - [C++]() - [Python]() - [Rust]() ## [Introduction]() LIEF Extended provides a user-friendly API for disassembling code within various parts of executable formats for the following architectures: x86/x86-64, ARM, AArch64, RISC-V, MIPS, PowerPC, and eBPF. ## [Disassemble a binary]() You can begin disassembling code within a binary using the `lief.Binary.disassemble()` ( [`lief::generic::Binary::disassemble`]() ; [`lief::generic::Binary::disassemble_symbol`]() ; [`lief::generic::Binary::disassemble_address`]() ; [`lief::generic::Binary::disassemble_slice`]() ; [`LIEF::Binary::disassemble()`]() ; [`lief.Binary.disassemble()`]() ; [`lief.Binary.disassemble_from_bytes()`]() ) function, which is exposed in the abstraction layer: **Python** ```python elf: lief.ELF.Binary for inst in elf.disassemble(0x400120): print(inst) ``` **C++** ```cpp std::unique_ptr pe; for (const auto& inst : pe->disassemble("_WinRT")) { std::cout << inst.to_string() << '\n'; } ``` **Rust** ```rust let elf: &lief::elf::Binary = some_elf; for inst in elf.disassemble_address(0x400) { println!("{}", inst); } ``` From a design perspective, the disassembler returns a *lazy* iterator, yielding a `lief.assembly.Instruction` ( [`lief::assembly::Instructions`]() ; [`LIEF::assembly::Instruction`]() ; [`lief.assembly.Instruction`]() ) instance as it evaluates the instruction at each address. Consequently, when calling `elf.disassemble_address(0x400)`, no disassembly occurs until the iterator is advanced. ## [Inspect instructions and operands]() Instructions are represented by the `lief.assembly.Instruction` ( [`lief::assembly::Instructions`]() ; [`LIEF::assembly::Instruction`]() ; [`lief.assembly.Instruction`]() ) object, which is extended by architecture-specific objects: - `lief.assembly.x86.Instruction` ( [`lief::assembly::x86::Instruction`]() ; [`LIEF::assembly::x86::Instruction`]() ; [`lief.assembly.x86.Instruction`]() ) - `lief.assembly.arm.Instruction` ( [`lief::assembly::arm::Instruction`]() ; [`LIEF::assembly::arm::Instruction`]() ; [`lief.assembly.arm.Instruction`]() ) - `lief.assembly.aarch64.Instruction` ( [`lief::assembly::aarch64::Instruction`]() ; [`LIEF::assembly::aarch64::Instruction`]() ; [`lief.assembly.aarch64.Instruction`]() ) - `lief.assembly.powerpc.Instruction` ( [`lief::assembly::powerpc::Instruction`]() ; [`LIEF::assembly::powerpc::Instruction`]() ; [`lief.assembly.powerpc.Instruction`]() ) - `lief.assembly.mips.Instruction` ( [`lief::assembly::mips::Instruction`]() ; [`LIEF::assembly::mips::Instruction`]() ; [`lief.assembly.mips.Instruction`]() ) - `lief.assembly.riscv.Instruction` ( [`lief::assembly::riscv::Instruction`]() ; [`LIEF::assembly::riscv::Instruction`]() ; [`lief.assembly.riscv.Instruction`]() ) - `lief.assembly.ebpf.Instruction` ( [`lief::assembly::ebpf::Instruction`]() ; [`LIEF::assembly::ebpf::Instruction`]() ; [`lief.assembly.ebpf.Instruction`]() ) In Python, use pattern matching or `isinstance(...)` to select an architecture-specific `lief.assembly.Instruction` ( [`lief::assembly::Instructions`]() ; [`LIEF::assembly::Instruction`]() ; [`lief.assembly.Instruction`]() ): ```python inst: lief.assembly.Instruction match inst: case lief.assembly.riscv.Instruction(): opcode: lief.assembly.riscv.OPCODE = inst.opcode ``` In C++, use `LIEF::assembly::Instruction::as()` ( [`LIEF::assembly::Instruction::as()`]() ) to access the architecture-specific instruction: ```cpp std::unique_ptr inst; if (const auto* riscv_inst = inst->as()) { LIEF::assembly::riscv::OPCODE opcode = riscv_inst->opcode(); } ``` In Rust, match the architecture variant of `lief.assembly.Instruction` ( [`lief::assembly::Instructions`]() ; [`LIEF::assembly::Instruction`]() ; [`lief.assembly.Instruction`]() ): ```rust pub fn check_opcode(some_inst: &lief::assembly::Instructions) { let inst: &lief::assembly::Instructions = some_inst; if let lief::assembly::Instructions::RiscV(riscv) = inst { println!("{:?}", riscv.opcode()); } } ``` > **Note** > > You can also check the assembler documentation here: [Assembler]() For the `x86/x86-64` and `AArch64` architectures, you can also iterate over an instruction’s operands: **AArch64** ```python import lief macho: lief.MachO.Binary for inst in macho.disassemble(0x400120): print(inst) # Check inst properties if inst.is_branch: print(f"Resolved: {inst.branch_target}") for idx, operand in enumerate(inst.operands): match operand: case lief.assembly.aarch64.operands.Register(): print(f"op[{idx}]: REG - {operand.value}") case lief.assembly.aarch64.operands.Memory(): print(f"op[{idx}]: MEM - {operand.base}") case lief.assembly.aarch64.operands.PCRelative(): print(f"op[{idx}]: PCR - {operand.value}") case lief.assembly.aarch64.operands.Immediate(): print(f"op[{idx}]: IMM - {operand.value}") ``` **x86/x86-64** ```python import lief elf: lief.ELF.Binary for inst in elf.disassemble(0x1000200): print(inst) # Check inst properties if inst.is_branch: print(f"Resolved: {inst.branch_target}") for idx, operand in enumerate(inst.operands): match operand: case lief.assembly.x86.operands.Register(): print(f"op[{idx}]: REG - {operand.value}") case lief.assembly.x86.operands.Memory(): print(f"op[{idx}]: MEM - {operand.base}") case lief.assembly.x86.operands.PCRelative(): print(f"op[{idx}]: PCR - {operand.value}") case lief.assembly.x86.operands.Immediate(): print(f"op[{idx}]: IMM - {operand.value}") ``` See the architecture-specific [Python]() and [C++]() references for operand types and instruction properties. To write a patch using assembly text, continue with the [assembler guide](). ## [x86/x86-64]() On x86/x86-64, `lief.assembly.x86.Instruction` ( [`lief::assembly::x86::Instruction`]() ; [`LIEF::assembly::x86::Instruction`]() ; [`lief.assembly.x86.Instruction`]() ) also exposes an API to inspect and rewrite the `LOCK` prefix of an instruction: - `lief.assembly.x86.Instruction.has_lock_prefix()` ( [`lief::assembly::x86::Instruction::has_lock_prefix`]() ; [`lief.assembly.x86.Instruction.has_lock_prefix`]() ; [`LIEF::assembly::x86::Instruction::has_lock_prefix()`]() ) - `lief.assembly.x86.Instruction.is_lockable()` ( [`lief::assembly::x86::Instruction::is_lockable`]() ; [`lief.assembly.x86.Instruction.is_lockable`]() ; [`LIEF::assembly::x86::Instruction::is_lockable()`]() ) - `lief.assembly.x86.Instruction.is_atomic()` ( [`lief::assembly::x86::Instruction::is_atomic`]() ; [`lief.assembly.x86.Instruction.is_atomic`]() ; [`LIEF::assembly::x86::Instruction::is_atomic()`]() ) - `lief.assembly.x86.Instruction.lock()` ( [`lief::assembly::x86::Instruction::lock`]() ; [`lief.assembly.x86.Instruction.lock()`]() ; [`LIEF::assembly::x86::Instruction::lock()`]() ) - `lief.assembly.x86.Instruction.unlock()` ( [`lief::assembly::x86::Instruction::unlock`]() ; [`lief.assembly.x86.Instruction.unlock()`]() ; [`LIEF::assembly::x86::Instruction::unlock()`]() ) **Python** ```python import lief inst: lief.assembly.x86.Instruction if inst.has_lock_prefix or inst.is_atomic: print(f"{inst} is atomic") elif inst.is_lockable and (locked := inst.lock()) is not None: print(f"atomic version of {inst}: {locked}") ``` **C++** ```cpp std::unique_ptr inst; if (inst->has_lock_prefix() || inst->is_atomic()) { std::cout << inst->to_string() << " is atomic\n"; } else if (inst->is_lockable()) { if (auto locked = inst->lock()) { std::cout << "atomic version: " << locked->to_string() << '\n'; } } ``` **Rust** ```rust let inst: &lief::assembly::x86::Instruction = some_inst; if inst.has_lock_prefix() || inst.is_atomic() { println!("{} is atomic", inst); } else if inst.is_lockable() && let Some(locked) = inst.lock() { println!("atomic version: {}", locked); } ``` ## [Use Cases]() ### [DWARF Function]() In addition to the regular `lief.Binary.disassemble()` ( [`lief::generic::Binary::disassemble`]() ; [`lief::generic::Binary::disassemble_symbol`]() ; [`lief::generic::Binary::disassemble_address`]() ; [`lief::generic::Binary::disassemble_slice`]() ; [`LIEF::Binary::disassemble()`]() ; [`lief.Binary.disassemble()`]() ; [`lief.Binary.disassemble_from_bytes()`]() ) API, you can use `lief.dwarf.Function.instructions()` ( [`lief::dwarf::Function::instructions`]() ; [`LIEF::dwarf::Function::instructions()`]() ; [`lief.dwarf.Function.instructions`]() ) to disassemble a [DWARF]() function. > **Warning** > > `lief.dwarf.Function.instructions()` ( [`lief::dwarf::Function::instructions`]() ; [`LIEF::dwarf::Function::instructions()`]() ; [`lief.dwarf.Function.instructions`]() ) only works if the DWARF debug info is **embedded** in the binary. This is the default behavior for [ELF]() binaries, but this is not the case for Mach-O `.dSYM` files. **Python** ```python import lief elf = lief.ELF.parse("/bin/hello") main = elf.debug_info.find_function("main") for inst in main.instructions: print(inst) ``` **C++** ```cpp auto elf = LIEF::ELF::Parser::parse("/bin/hello"); if (const auto* dwarf = elf->debug_info()->as()) { std::unique_ptr _main = dwarf->find_function("main"); for (const auto& inst : _main->instructions()) { std::cout << inst.to_string() << '\n'; } } ``` **Rust** ```rust let elf = lief::elf::Binary::parse("/bin/ls").unwrap(); if let Some(lief::DebugInfo::Dwarf(dwarf)) = elf.debug_info() && let Some(func) = dwarf.function_by_name("main") { for inst in func.instructions() { println!("{}", inst); } } ``` ### [Dyld Shared Cache]() A disassembly API is also provided for the `lief.dsc.DyldSharedCache` ( [`lief::dsc::DyldSharedCache`]() ; [`lief.dsc.DyldSharedCache`]() ; [`LIEF::dsc::DyldSharedCache`]() ) object via `lief.dsc.DyldSharedCache.disassemble()` ( [`lief::dsc::DyldSharedCache::disassemble`]() ; [`lief.dsc.DyldSharedCache.disassemble()`]() ; [`LIEF::dsc::DyldSharedCache::disassemble()`]() ): **Python** ```python dyld_cache: lief.dsc.DyldSharedCache for inst in dyld_cache.disassemble(0x1886F4A44): print(inst) ``` **C++** ```cpp std::unique_ptr dyld_cache; for (const auto& inst : dyld_cache->disassemble(0x1886f4a44)) { std::cout << inst.to_string() << '\n'; } ``` **Rust** ```rust let dyld_cache: &lief::dsc::DyldSharedCache = some_dyld_cache; for inst in dyld_cache.disassemble(0x1886f4a44) { println!("{}", inst); } ``` ### [COFF Support]() The `lief.COFF.Binary` ( [`lief::coff::Binary`]() ; [`lief.COFF.Binary`]() ; [`LIEF::COFF::Binary`]() ) interface does not inherit from the generic `lief.abstract.Binary` ( [`lief::generic::Binary`]() ; [`lief.Binary`]() ; [`LIEF::Binary`]() ), but it also exposes an API to disassemble code in COFF object files: `lief.COFF.Binary.disassemble()` ( [`lief::coff::Binary::disassemble_slice`]() ; [`lief::coff::Binary::disassemble_function`]() ; [`lief::coff::Binary::disassemble_symbol`]() ; [`lief.COFF.Binary.disassemble()`]() ; [`lief.COFF.Binary.disassemble_from_bytes()`]() ; [`LIEF::COFF::Binary::disassemble()`]() ). For more details, please check the [COFF Disassembler]() section ### [In-Memory Disassembler]() The disassembler is also available for analyzing code directly in the memory of the running process. This functionality is exposed through the runtime API `lief.runtime.disassemble()` ( [`lief::runtime::disassemble`]() ; [`lief.runtime.disassemble()`]() ; [`LIEF::runtime::disassemble()`]() ), as detailed in the [Runtime Memory]() documentation. ## [Technical Details]() The disassembler is based on LLVM’s MC layer, which is known to be efficient and accurate for disassembling code. This LLVM MC layer is already used by other projects like [capstone]() or, more recently, [Nyxstone](). Compared to Capstone, LIEF uses a mainstream LLVM version with limited modifications to the MC layer. On the other hand, it does not expose a C API, supports fewer architectures than Capstone, and does not expose a standalone API. > **Note** > > The current LLVM version is 22.x. Unlike Nyxstone’s disassembler, LIEF hides LLVM from the public API, meaning that LLVM does not need to be installed on the system. On the other hand, it does not expose a standalone API. The major difference between LIEF’s disassembler and other projects is that it **does not expose a standalone API** for disassembling arbitrary code. The disassembler is bound to the object from which the API is exposed ( `lief.abstract.Binary` ( [`lief::generic::Binary`]() ; [`lief.Binary`]() ; [`LIEF::Binary`]() ), `lief.dwarf.Function` ( [`lief::dwarf::Function`]() ; [`lief.dwarf.Function`]() ; [`LIEF::dwarf::Function`]() ), `lief.dsc.DyldSharedCache.disassemble()` ( [`lief::dsc::DyldSharedCache::disassemble`]() ; [`lief.dsc.DyldSharedCache.disassemble()`]() ; [`LIEF::dsc::DyldSharedCache::disassemble()`]() ), etc.). ## [API]() [Python API]() [C++ API]() Rust API: [`lief::assembly`]() --- documentID: "cc7a3c7c1e2b129e669f94b62ca4fb25fe6a1aa68e86734d8ce38d052d4bf113" docname: "extended/disassembler/python/arch/aarch64" title: "AArch64 - Python Disassembler - LIEF Documentation" description: "AArch64 Python Disassembler. See: lief.assembly.aarch64.OPCODE" canonical: "https://lief.re/doc/latest/extended/disassembler/python/arch/aarch64.html" markdownURL: "https://lief.re/doc/latest/extended/disassembler/python/arch/aarch64.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "6db05a76287a7a8f8c79ad5c665f819a51cea4dd9eee409dd3bf55b25d4a75de" --- # [AArch64]() ## [Instruction]() ![Inheritance diagram of lief._lief.assembly.aarch64.Instruction](https://lief.re/doc/latest/_images/inheritance-caf7ab0549f0f0eeda0ad1eac984b1f5d17d8106.png) ### [` lief.assembly.aarch64.Instruction `]() class lief.assembly.aarch64.Instruction Bases: [`Instruction`]( "lief._lief.assembly.Instruction") This class represents an AArch64 instruction #### [` opcode `]() property opcode → lief.assembly.aarch64.OPCODE The instruction opcode as defined in LLVM #### [` operands `]() property operands → Iterator[[lief.assembly.aarch64.Operand]( "lief.assembly.aarch64.Operand") | None] Iterator over the operands of the current instruction ## [Opcodes]() See: `lief.assembly.aarch64.OPCODE` ## [Operands]() ![Inheritance diagram of lief._lief.assembly.aarch64.operands.Immediate, lief._lief.assembly.aarch64.operands.Memory, lief._lief.assembly.aarch64.operands.Register, lief._lief.assembly.aarch64.Operand, lief._lief.assembly.aarch64.operands.PCRelative](https://lief.re/doc/latest/_images/inheritance-b09c45a1ec1d2e0fa89d6dcda9b95953fa4d8388.png) ### [` lief.assembly.aarch64.Operand `]() class lief.assembly.aarch64.Operand Bases: `object` This class represents an operand for an AArch64 instruction #### [` to_string `]() property to\_string → str Pretty representation of the operand ### [Immediate]() ![Inheritance diagram of lief._lief.assembly.aarch64.operands.Immediate](https://lief.re/doc/latest/_images/inheritance-830e4da462faa621cf984e14cc9341e728c271d5.png) #### [` lief.assembly.aarch64.operands.Immediate `]() class lief.assembly.aarch64.operands.Immediate Bases: [`Operand`]( "lief._lief.assembly.aarch64.Operand") This class represents an immediate operand (i.e. a constant) For instance: ```text mov x0, #8; | +---> Immediate(8) ``` ##### [` value `]() property value → int The constant value wrapped by this operand ### [Register]() ![Inheritance diagram of lief._lief.assembly.aarch64.operands.Register](https://lief.re/doc/latest/_images/inheritance-a34f6bbb80153e6510b17851ca56925cc9330090.png) #### [` lief.assembly.aarch64.operands.Register `]() class lief.assembly.aarch64.operands.Register Bases: [`Operand`]( "lief._lief.assembly.aarch64.Operand") This class represents a register operand. ```text mrs x0, TPIDR_EL0 | | +------+ +-------+ | | v v REG SYSREG ``` ##### [` value `]() property value → lief.assembly.aarch64.REG | lief.assembly.aarch64.SYSREG | None The effective register as either: a `lief.assembly.aarch64.REG` or a `lief.assembly.aarch64.SYSREG`. ### [Memory]() ![Inheritance diagram of lief._lief.assembly.aarch64.operands.Memory](https://lief.re/doc/latest/_images/inheritance-71f7277aed1eb2081476f0d0caeb7896e7807d3b.png) #### [` lief.assembly.aarch64.operands.Memory `]() class lief.assembly.aarch64.operands.Memory Bases: [`Operand`]( "lief._lief.assembly.aarch64.Operand") This class represents a memory operand. ```text ldr x0, [x1, x2, lsl #3] | | | +------------+ | +--------+ | | | v v v Base Reg Offset Shift ``` ##### [` SHIFT `]() class SHIFT(*\*values*) Bases: `Enum` ###### [` LSL `]() LSL = 1 ###### [` SXTW `]() SXTW = 5 ###### [` SXTX `]() SXTX = 4 ###### [` UNKNOWN `]() UNKNOWN = 0 ###### [` UXTW `]() UXTW = 3 ###### [` UXTX `]() UXTX = 2 ##### [` base `]() property base → lief.assembly.aarch64.REG The base register. For `str x3, [x8, #8]` it would return `x8`. ##### [` offset `]() property offset → lief.assembly.aarch64.REG | int | None The addressing offset. It can be either: - A register (e.g. `ldr x0, [x1, x3]`) - An offset (e.g. `ldr x0, [x1, #8]`) ##### [` shift `]() property shift → [lief.assembly.aarch64.operands.Memory.shift\_info\_t]( "lief.assembly.aarch64.operands.Memory.shift_info_t") Shift information. For instance, for `ldr x1, [x2, x3, lsl #3]` it would return a [`LSL`]( "lief.assembly.aarch64.operands.Memory.SHIFT.LSL") with a [`value`]( "lief.assembly.aarch64.operands.Memory.shift_info_t.value") set to `3`. ##### [` shift_info_t `]() class shift\_info\_t Bases: `object` This structure holds shift info (type + value) ###### [` type `]() property type → [lief.assembly.aarch64.operands.Memory.SHIFT]( "lief.assembly.aarch64.operands.Memory.SHIFT") ###### [` value `]() property value → int ### [PCRelative]() ![Inheritance diagram of lief._lief.assembly.aarch64.operands.PCRelative](https://lief.re/doc/latest/_images/inheritance-ceeee5807cd77cba3ffa4fb62a497f1147047f4c.png) #### [` lief.assembly.aarch64.operands.PCRelative `]() class lief.assembly.aarch64.operands.PCRelative Bases: [`Operand`]( "lief._lief.assembly.aarch64.Operand") This class represents a PC-relative operand. ```text ldr x0, #8 | v PC Relative operand ``` ##### [` value `]() property value → int The effective value that is relative to the current `pc` register --- documentID: "53cfadccb05891b1bd353b350116db8873230738dfd9f5ade046cc450cec4740" docname: "extended/disassembler/python/arch/arm" title: "ARM - Python Disassembler - LIEF Documentation" description: "ARM Python Disassembler. See: lief.assembly.arm.OPCODE" canonical: "https://lief.re/doc/latest/extended/disassembler/python/arch/arm.html" markdownURL: "https://lief.re/doc/latest/extended/disassembler/python/arch/arm.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "f5c990c5aa0fededae330f333871bd5a7f52f4f44eea3328c773dcf0dadd1b52" --- # [ARM]() ## [Instruction]() ![Inheritance diagram of lief._lief.assembly.arm.Instruction](https://lief.re/doc/latest/_images/inheritance-ad862b0706b3c4290ce1c0d80b45044d6b362509.png) ### [` lief.assembly.arm.Instruction `]() class lief.assembly.arm.Instruction Bases: [`Instruction`]( "lief._lief.assembly.Instruction") This class represents an ARM/Thumb instruction #### [` opcode `]() property opcode → lief.assembly.arm.OPCODE The instruction opcode as defined in LLVM ## [Opcodes]() See: `lief.assembly.arm.OPCODE` --- documentID: "1d1dcc92425a51af98aae586c37f79195e5f3a1b67743df467796115fc7d922a" docname: "extended/disassembler/python/arch/ebpf" title: "eBPF - Python Disassembler - LIEF Documentation" description: "eBPF Python Disassembler. See: lief.assembly.ebpf.OPCODE" canonical: "https://lief.re/doc/latest/extended/disassembler/python/arch/ebpf.html" markdownURL: "https://lief.re/doc/latest/extended/disassembler/python/arch/ebpf.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "05c0fa4a2253df73f2f8c5ac131b670b0620cce7c45f197377a48a2cd2c95195" --- # [eBPF]() ## [Instruction]() ![Inheritance diagram of lief._lief.assembly.ebpf.Instruction](https://lief.re/doc/latest/_images/inheritance-34fd3565e342c5a7e2d57a67163739c82f74319b.png) ### [` lief.assembly.ebpf.Instruction `]() class lief.assembly.ebpf.Instruction Bases: [`Instruction`]( "lief._lief.assembly.Instruction") This class represents an eBPF instruction #### [` opcode `]() property opcode → lief.assembly.ebpf.OPCODE The instruction opcode as defined in LLVM #### [` operands `]() property operands → Iterator[[lief.assembly.ebpf.Operand]( "lief.assembly.ebpf.Operand") | None] Iterator over the operands of the current instruction ## [Opcodes]() See: `lief.assembly.ebpf.OPCODE` ## [Operands]() ![Inheritance diagram of lief._lief.assembly.ebpf.operands.Immediate, lief._lief.assembly.ebpf.operands.PCRelative, lief._lief.assembly.ebpf.operands.Memory, lief._lief.assembly.ebpf.operands.Register, lief._lief.assembly.ebpf.Operand](https://lief.re/doc/latest/_images/inheritance-9fb6f7ef3a8069d7f33736a0f868cbf88ae87090.png) ### [` lief.assembly.ebpf.Operand `]() class lief.assembly.ebpf.Operand Bases: `object` This class represents an operand for an eBPF instruction #### [` to_string `]() property to\_string → str Pretty representation of the operand ### [Immediate]() ![Inheritance diagram of lief._lief.assembly.ebpf.operands.Immediate](https://lief.re/doc/latest/_images/inheritance-175b46a0202adda78dcfc164d859a48964e16b16.png) #### [` lief.assembly.ebpf.operands.Immediate `]() class lief.assembly.ebpf.operands.Immediate Bases: [`Operand`]( "lief._lief.assembly.ebpf.Operand") This class represents an immediate operand (i.e. a constant) For instance: ```text r1 = 8 | +---> Immediate(8) ``` ##### [` value `]() property value → int The constant value wrapped by this operand ### [Register]() ![Inheritance diagram of lief._lief.assembly.ebpf.operands.Register](https://lief.re/doc/latest/_images/inheritance-d1ba855c0bdd3c4146c4487e3733dc84748e8669.png) #### [` lief.assembly.ebpf.operands.Register `]() class lief.assembly.ebpf.operands.Register Bases: [`Operand`]( "lief._lief.assembly.ebpf.Operand") This class represents a register operand. For instance: ```text r0 = r1 | | | +---------> Register(r1) | +--------------> Register(r0) ``` ##### [` value `]() property value → lief.assembly.ebpf.REG The effective `lief.assembly.ebpf.REG` wrapped by this operand ### [Memory]() ![Inheritance diagram of lief._lief.assembly.ebpf.operands.Memory](https://lief.re/doc/latest/_images/inheritance-a009623e42357879d774dc11e03709bd268d6aa7.png) #### [` lief.assembly.ebpf.operands.Memory `]() class lief.assembly.ebpf.operands.Memory Bases: [`Operand`]( "lief._lief.assembly.ebpf.Operand") This class represents a memory operand. ```text *(u64 *)(r1 + 8) = r2 | | | +-----> Displacement: 8 | +----------> Base: r1 ``` ##### [` base `]() property base → lief.assembly.ebpf.REG The base register. For `*(u64 *)(r1 + 8)` it would return `r1`. ##### [` displacement `]() property displacement → int The displacement value. For `*(u64 *)(r1 + 8)` it would return `8`. ### [PCRelative]() ![Inheritance diagram of lief._lief.assembly.ebpf.operands.PCRelative](https://lief.re/doc/latest/_images/inheritance-fd7c79e49682d34d7940392b25c91ad0fff7fccd.png) #### [` lief.assembly.ebpf.operands.PCRelative `]() class lief.assembly.ebpf.operands.PCRelative Bases: [`Operand`]( "lief._lief.assembly.ebpf.Operand") This class represents a PC-relative operand. ```text if r1 == 0 goto +5 | v PC Relative operand ``` ##### [` value `]() property value → int The effective value that is relative to the current `pc` register --- documentID: "cb6c5798255800b24f516705a8fe59ff38b3f5989d7a1f855d5cabca41152488" docname: "extended/disassembler/python/arch/mips" title: "Mips - Python Disassembler - LIEF Documentation" description: "Mips Python Disassembler. See: lief.assembly.mips.OPCODE" canonical: "https://lief.re/doc/latest/extended/disassembler/python/arch/mips.html" markdownURL: "https://lief.re/doc/latest/extended/disassembler/python/arch/mips.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "6702a5d9a8273903b8f72676cf6989d90fe8c8ff70e7add97a10a0a0ee9beb83" --- # [Mips]() ## [Instruction]() ![Inheritance diagram of lief._lief.assembly.mips.Instruction](https://lief.re/doc/latest/_images/inheritance-e78ec6ad94eec7bece0fd4d676cf2b5c941bd33d.png) ### [` lief.assembly.mips.Instruction `]() class lief.assembly.mips.Instruction Bases: [`Instruction`]( "lief._lief.assembly.Instruction") This class represents a Mips instruction (including mips64, mips32) #### [` opcode `]() property opcode → lief.assembly.mips.OPCODE The instruction opcode as defined in LLVM #### [` operands `]() property operands → Iterator[[lief.assembly.mips.Operand]( "lief.assembly.mips.Operand") | None] Iterator over the operands of the current instruction ## [Opcodes]() See: `lief.assembly.mips.OPCODE` ## [Operands]() ![Inheritance diagram of lief._lief.assembly.mips.operands.Immediate, lief._lief.assembly.mips.operands.Memory, lief._lief.assembly.mips.operands.PCRelative, lief._lief.assembly.mips.operands.Register, lief._lief.assembly.mips.Operand](https://lief.re/doc/latest/_images/inheritance-a0338d7e4ad5f8ca3e077b7155846cff05f2179a.png) ### [` lief.assembly.mips.Operand `]() class lief.assembly.mips.Operand Bases: `object` This class represents an operand for a Mips instruction #### [` to_string `]() property to\_string → str Pretty representation of the operand ### [Immediate]() ![Inheritance diagram of lief._lief.assembly.mips.operands.Immediate](https://lief.re/doc/latest/_images/inheritance-37e9043c5783d6e86c6294e15cdcd976a0f7a0c6.png) #### [` lief.assembly.mips.operands.Immediate `]() class lief.assembly.mips.operands.Immediate Bases: [`Operand`]( "lief._lief.assembly.mips.Operand") This class represents an immediate operand (i.e. a constant) For instance: ```text addiu $4, $5, 8 | +---> Immediate(8) ``` ##### [` value `]() property value → int The constant value wrapped by this operand ### [Register]() ![Inheritance diagram of lief._lief.assembly.mips.operands.Register](https://lief.re/doc/latest/_images/inheritance-30b1a484589a9681e1c14f4f9f29e10cb2174bef.png) #### [` lief.assembly.mips.operands.Register `]() class lief.assembly.mips.operands.Register Bases: [`Operand`]( "lief._lief.assembly.mips.Operand") This class represents a register operand. For instance: ```text move $4, $5 | | | +---------> Register($5) | +-------------> Register($4) ``` ##### [` value `]() property value → lief.assembly.mips.REG The effective `lief.assembly.mips.REG` wrapped by this operand ### [Memory]() ![Inheritance diagram of lief._lief.assembly.mips.operands.Memory](https://lief.re/doc/latest/_images/inheritance-5c81c5be92129966bb7a29ca710b5dd2e936a41c.png) #### [` lief.assembly.mips.operands.Memory `]() class lief.assembly.mips.operands.Memory Bases: [`Operand`]( "lief._lief.assembly.mips.Operand") This class represents a memory operand. ```text lw $4, 8($5) ldxc1 $f2, $4($7) | | | | | | +------+ | +---+ +-------+ | +-----+ | | | | | | v v v v v v Reg Disp Base Reg Index Base ``` ##### [` base `]() property base → lief.assembly.mips.REG The base register. For `lw $4, 8($5)` it would return `$5`. ##### [` offset `]() property offset → lief.assembly.mips.REG | int | None The addressing offset. It can be either: - A register (e.g. `ldxc1 $f2, $4($7)`) - A displacement (e.g. `lw $4, 8($5)`) ### [PCRelative]() ![Inheritance diagram of lief._lief.assembly.mips.operands.PCRelative](https://lief.re/doc/latest/_images/inheritance-5534e42d172cf61f28a7bc279d12a5fe5bde5bda.png) #### [` lief.assembly.mips.operands.PCRelative `]() class lief.assembly.mips.operands.PCRelative Bases: [`Operand`]( "lief._lief.assembly.mips.Operand") This class represents a PC-relative operand. ```text bal 0x100 | v PC Relative operand ``` ##### [` value `]() property value → int The effective value that is relative to the current `pc` register --- documentID: "bbad85ae06f6c21d37813c61721b1878411ef700c318098ec4e9f4274f859d94" docname: "extended/disassembler/python/arch/powerpc" title: "PowerPC - Python Disassembler - LIEF Documentation" description: "PowerPC Python Disassembler. See: lief.assembly.powerpc.OPCODE" canonical: "https://lief.re/doc/latest/extended/disassembler/python/arch/powerpc.html" markdownURL: "https://lief.re/doc/latest/extended/disassembler/python/arch/powerpc.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "9ae7a6b08b59ca0b081de396acd3af2d15436a6f0f6e90586960e82391f5e08f" --- # [PowerPC]() ## [Instruction]() ![Inheritance diagram of lief._lief.assembly.powerpc.Instruction](https://lief.re/doc/latest/_images/inheritance-1cf67e8078addc75f1332b7c877f100b3902b09c.png) ### [` lief.assembly.powerpc.Instruction `]() class lief.assembly.powerpc.Instruction Bases: [`Instruction`]( "lief._lief.assembly.Instruction") This class represents a PowerPC (ppc64/ppc32) instruction #### [` opcode `]() property opcode → lief.assembly.powerpc.OPCODE The instruction opcode as defined in LLVM #### [` operands `]() property operands → Iterator[[lief.assembly.powerpc.Operand]( "lief.assembly.powerpc.Operand") | None] Iterator over the operands of the current instruction ## [Opcodes]() See: `lief.assembly.powerpc.OPCODE` ## [Operands]() ![Inheritance diagram of lief._lief.assembly.powerpc.operands.Immediate, lief._lief.assembly.powerpc.Operand, lief._lief.assembly.powerpc.operands.PCRelative, lief._lief.assembly.powerpc.operands.Register, lief._lief.assembly.powerpc.operands.Memory](https://lief.re/doc/latest/_images/inheritance-4c7f97f90b63b9d4cbfa9dd8ac2a860cb6249130.png) ### [` lief.assembly.powerpc.Operand `]() class lief.assembly.powerpc.Operand Bases: `object` This class represents an operand for a PowerPC instruction #### [` to_string `]() property to\_string → str Pretty representation of the operand ### [Immediate]() ![Inheritance diagram of lief._lief.assembly.powerpc.operands.Immediate](https://lief.re/doc/latest/_images/inheritance-9006ef1f47a270d20517f90edbbc1ab88cf7a4ca.png) #### [` lief.assembly.powerpc.operands.Immediate `]() class lief.assembly.powerpc.operands.Immediate Bases: [`Operand`]( "lief._lief.assembly.powerpc.Operand") This class represents an immediate operand (i.e. a constant) For instance: ```text li 3, 8 | +---> Immediate(8) ``` ##### [` value `]() property value → int The constant value wrapped by this operand ### [Register]() ![Inheritance diagram of lief._lief.assembly.powerpc.operands.Register](https://lief.re/doc/latest/_images/inheritance-9c98ab6c4332b2d62d6334eeffeb68503505ed47.png) #### [` lief.assembly.powerpc.operands.Register `]() class lief.assembly.powerpc.operands.Register Bases: [`Operand`]( "lief._lief.assembly.powerpc.Operand") This class represents a register operand. For instance: ```text add 3, 4, 5 | | | | | +---------> Register(5) | +------------> Register(4) +---------------> Register(3) ``` ##### [` value `]() property value → lief.assembly.powerpc.REG The effective `lief.assembly.powerpc.REG` wrapped by this operand ### [Memory]() ![Inheritance diagram of lief._lief.assembly.powerpc.operands.Memory](https://lief.re/doc/latest/_images/inheritance-01cc9e5dc1eba927ff9c3ec2d9691186a1300a95.png) #### [` lief.assembly.powerpc.operands.Memory `]() class lief.assembly.powerpc.operands.Memory Bases: [`Operand`]( "lief._lief.assembly.powerpc.Operand") This class represents a memory operand. ```text lwz 3, 8(4) lwzx 3, 4, 5 | | | | | +------+ +---+ +------+ | +---+ | | | | | v v v v v Disp Base Reg Base Index ``` ##### [` base `]() property base → lief.assembly.powerpc.REG The base register. For `lwz 3, 8(4)` it would return `4`. ##### [` offset `]() property offset → lief.assembly.powerpc.REG | int | None The addressing offset. It can be either: - An index register (e.g. `lwzx 3, 4, 5`) - A displacement (e.g. `lwz 3, 8(4)`) ### [PCRelative]() ![Inheritance diagram of lief._lief.assembly.powerpc.operands.PCRelative](https://lief.re/doc/latest/_images/inheritance-6ecd9d1483155c2c08def9ccd9e64eceab0e6688.png) #### [` lief.assembly.powerpc.operands.PCRelative `]() class lief.assembly.powerpc.operands.PCRelative Bases: [`Operand`]( "lief._lief.assembly.powerpc.Operand") This class represents a PC-relative operand. ```text bl 0x100 | v PC Relative operand ``` ##### [` value `]() property value → int The effective value that is relative to the current `pc` register --- documentID: "46b9dc425d6956638c07ced520f8d8946c1a4433775a52f8b1d1d69d5cf42137" docname: "extended/disassembler/python/arch/riscv" title: "RISC-V - Python Disassembler - LIEF Documentation" description: "RISC-V Python Disassembler. See: lief.assembly.riscv.OPCODE" canonical: "https://lief.re/doc/latest/extended/disassembler/python/arch/riscv.html" markdownURL: "https://lief.re/doc/latest/extended/disassembler/python/arch/riscv.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "4ea25fe0f0fc059cbe96fd5a0b3ffe727a78579d447c365274e7772228d19bd8" --- # [RISC-V]() ## [Instruction]() ![Inheritance diagram of lief._lief.assembly.riscv.Instruction](https://lief.re/doc/latest/_images/inheritance-57287a1f2d9c1f7cf0b8c596c93edf974afb9096.png) ### [` lief.assembly.riscv.Instruction `]() class lief.assembly.riscv.Instruction Bases: [`Instruction`]( "lief._lief.assembly.Instruction") This class represents a RISC-V (32 or 64 bit) instruction #### [` opcode `]() property opcode → lief.assembly.riscv.OPCODE The instruction opcode as defined in LLVM #### [` operands `]() property operands → Iterator[[lief.assembly.riscv.Operand]( "lief.assembly.riscv.Operand") | None] Iterator over the operands of the current instruction ## [Opcodes]() See: `lief.assembly.riscv.OPCODE` ## [Operands]() ![Inheritance diagram of lief._lief.assembly.riscv.operands.Memory, lief._lief.assembly.riscv.operands.PCRelative, lief._lief.assembly.riscv.Operand, lief._lief.assembly.riscv.operands.Register, lief._lief.assembly.riscv.operands.Immediate](https://lief.re/doc/latest/_images/inheritance-fe743a741d7f5714f3f622d845010e6e1b13daf0.png) ### [` lief.assembly.riscv.Operand `]() class lief.assembly.riscv.Operand Bases: `object` This class represents an operand for a RISC-V instruction #### [` to_string `]() property to\_string → str Pretty representation of the operand ### [Immediate]() ![Inheritance diagram of lief._lief.assembly.riscv.operands.Immediate](https://lief.re/doc/latest/_images/inheritance-399762e71ac5227317119948b03747aee76931c0.png) #### [` lief.assembly.riscv.operands.Immediate `]() class lief.assembly.riscv.operands.Immediate Bases: [`Operand`]( "lief._lief.assembly.riscv.Operand") This class represents an immediate operand (i.e. a constant) For instance: ```text addi a0, a1, 8 | +---> Immediate(8) ``` ##### [` value `]() property value → int The constant value wrapped by this operand ### [Register]() ![Inheritance diagram of lief._lief.assembly.riscv.operands.Register](https://lief.re/doc/latest/_images/inheritance-c43b70c31bd97734b7c05913a86be66470d0426d.png) #### [` lief.assembly.riscv.operands.Register `]() class lief.assembly.riscv.operands.Register Bases: [`Operand`]( "lief._lief.assembly.riscv.Operand") This class represents a register operand. ```text csrr a0, mstatus | | +------+ +-------+ | | v v REG SYSREG ``` ##### [` value `]() property value → lief.assembly.riscv.REG | lief.assembly.riscv.SYSREG | None The effective register as either: a `lief.assembly.riscv.REG` or a `lief.assembly.riscv.SYSREG`. ### [Memory]() ![Inheritance diagram of lief._lief.assembly.riscv.operands.Memory](https://lief.re/doc/latest/_images/inheritance-fd18558f2548db91e12d3f0a40f5066cd77065b4.png) #### [` lief.assembly.riscv.operands.Memory `]() class lief.assembly.riscv.operands.Memory Bases: [`Operand`]( "lief._lief.assembly.riscv.Operand") This class represents a memory operand. ```text lw a0, 8(sp) | | | +----> Base: sp | +-------> Displacement: 8 ``` ##### [` base `]() property base → lief.assembly.riscv.REG The base register. For `lw a0, 8(sp)` it would return `sp`. ##### [` displacement `]() property displacement → int The displacement value. For `lw a0, 8(sp)` it would return `8`. ### [PCRelative]() ![Inheritance diagram of lief._lief.assembly.riscv.operands.PCRelative](https://lief.re/doc/latest/_images/inheritance-268a02d8a8e9db451a4e6f9182ea1f9b98d61f2d.png) #### [` lief.assembly.riscv.operands.PCRelative `]() class lief.assembly.riscv.operands.PCRelative Bases: [`Operand`]( "lief._lief.assembly.riscv.Operand") This class represents a PC-relative operand. ```text auipc a0, 0x1 | v PC Relative operand ``` ##### [` value `]() property value → int The effective value that is relative to the current `pc` register --- documentID: "f71a2b4d7dee613bef0c375fd7fbf8f49ce2bb954525270333626c48d70322ec" docname: "extended/disassembler/python/arch/x86" title: "x86/x86-64 - Python Disassembler - LIEF Documentation" description: "x86/x86-64 Python Disassembler. See: lief.assembly.x86.OPCODE" canonical: "https://lief.re/doc/latest/extended/disassembler/python/arch/x86.html" markdownURL: "https://lief.re/doc/latest/extended/disassembler/python/arch/x86.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "671a15857ef6d1134d074bc8e189d5a95fc13ff9be6fe3832bff6e993c82d187" --- # [x86/x86-64]() ## [Instruction]() ![Inheritance diagram of lief._lief.assembly.x86.Instruction](https://lief.re/doc/latest/_images/inheritance-d12d9319acedc4858e638f1faa8a3021b9ec4229.png) ### [` lief.assembly.x86.Instruction `]() class lief.assembly.x86.Instruction Bases: [`Instruction`]( "lief._lief.assembly.Instruction") This class represents a x86/x86-64 instruction #### [` has_lock_prefix `]() property has\_lock\_prefix → bool True if this instruction has a `LOCK` prefix #### [` is_atomic `]() property is\_atomic → bool True if this instruction executes as an atomic read-modify-write #### [` is_lockable `]() property is\_lockable → bool True if the `LOCK` prefix is architecturally valid on this instruction #### [` lock `]() lock(*self*) → [lief.\_lief.assembly.x86.Instruction]( "lief._lief.assembly.x86.Instruction") | None Re-encoded copy of this instruction with a `LOCK` prefix added. If the instruction already has a `LOCK` prefix, it returns a plain copy. #### [` opcode `]() property opcode → lief.assembly.x86.OPCODE The instruction opcode as defined in LLVM #### [` operands `]() property operands → Iterator[[lief.assembly.x86.Operand]( "lief.assembly.x86.Operand") | None] Iterator over the operands of the current instruction #### [` unlock `]() unlock(*self*) → [lief.\_lief.assembly.x86.Instruction]( "lief._lief.assembly.x86.Instruction") | None Re-encoded copy of this instruction with the `LOCK` prefix removed. If the instruction does not have a `LOCK` prefix, it returns a plain copy or `None` if the `LOCK` semantic can’t be removed. ## [Opcodes]() See: `lief.assembly.x86.OPCODE` ## [Operands]() ![Inheritance diagram of lief._lief.assembly.x86.Operand, lief._lief.assembly.x86.operands.Register, lief._lief.assembly.x86.operands.Immediate, lief._lief.assembly.x86.operands.Memory, lief._lief.assembly.x86.operands.PCRelative](https://lief.re/doc/latest/_images/inheritance-ddd280ef5216fa25409e1ebc8394abd2ac39a95e.png) ### [` lief.assembly.x86.Operand `]() class lief.assembly.x86.Operand Bases: `object` This class represents an operand for an x86/x86-64 instruction #### [` to_string `]() property to\_string → str Pretty representation of the operand ### [Immediate]() ![Inheritance diagram of lief._lief.assembly.x86.operands.Immediate](https://lief.re/doc/latest/_images/inheritance-b1482de3d93c84677df3546912e10d7c891160a7.png) #### [` lief.assembly.x86.operands.Immediate `]() class lief.assembly.x86.operands.Immediate Bases: [`Operand`]( "lief._lief.assembly.x86.Operand") This class represents an immediate operand (i.e. a constant) For instance: ```text mov edi, 1; | +---> Immediate(1) ``` ##### [` value `]() property value → int The constant value wrapped by this operand ### [Register]() ![Inheritance diagram of lief._lief.assembly.x86.operands.Register](https://lief.re/doc/latest/_images/inheritance-fed19cbfb5412844851cfcb8d04c6406ab1b09c4.png) #### [` lief.assembly.x86.operands.Register `]() class lief.assembly.x86.operands.Register Bases: [`Operand`]( "lief._lief.assembly.x86.Operand") This class represents a register operand. For instance: ```text mov r15d, edi | | | +---------> Register(EDI) | +---------------> Register(R15D) ``` ##### [` value `]() property value → lief.assembly.x86.REG The effective `lief.assembly.x86.REG` wrapped by this operand ### [Memory]() ![Inheritance diagram of lief._lief.assembly.x86.operands.Memory](https://lief.re/doc/latest/_images/inheritance-c2d749f6d3db7401e86b4b70e0d84b4d2775e998.png) #### [` lief.assembly.x86.operands.Memory `]() class lief.assembly.x86.operands.Memory Bases: [`Operand`]( "lief._lief.assembly.x86.Operand") This class represents a memory operand. For instance: ```text movq xmm3, qword ptr [rip + 823864]; | | Memory | +-----------+-----------+ | | | Base: rip Scale: 1 Displacement: 823864 ``` ##### [` base `]() property base → lief.assembly.x86.REG The base register. For `lea rdx, [rip + 244634]` it would return `rip` ##### [` displacement `]() property displacement → int The displacement value. For `call qword ptr [rip + 248779]` it would return `248779` ##### [` scale `]() property scale → int The scale value associated with the [`scaled_register`]( "lief.assembly.x86.operands.Memory.scaled_register"): For `mov rdi, qword ptr [r13 + 8*r14]` it would return `8` ##### [` scaled_register `]() property scaled\_register → lief.assembly.x86.REG The scaled register. For `mov rdi, qword ptr [r13 + 8*r14]` it would return `r14` ##### [` segment_register `]() property segment\_register → lief.assembly.x86.REG The segment register associated with the memory operation. For `mov eax, dword ptr gs:[0]` it would return `gs` ### [PCRelative]() ![Inheritance diagram of lief._lief.assembly.x86.operands.PCRelative](https://lief.re/doc/latest/_images/inheritance-d75f438477a603803dd0331b2a934c3c72f4ca6f.png) #### [` lief.assembly.x86.operands.PCRelative `]() class lief.assembly.x86.operands.PCRelative Bases: [`Operand`]( "lief._lief.assembly.x86.Operand") This class represents a RIP/EIP-relative operand. For instance: ```text jmp 67633; | +----------> PCRelative(67633) ``` ##### [` value `]() property value → int The effective value that is relative to the current `rip/eip` register --- documentID: "8191668a8a6dfa2b2fb6f4967c98282ea3d810ec6c8b16a343d44f54f2c78ff9" docname: "extended/disassembler/python/index" title: "Disassembler Python API - LIEF Documentation" description: "Disassembler Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/extended/disassembler/python/index.html" markdownURL: "https://lief.re/doc/latest/extended/disassembler/python/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "8e0935c3daab1e0f5128d659d512c181d3b8a24d9da35fdbca49947f0adaca53" --- # [Python]() ## [Architectures]() Architectures - [x86/x86-64]() - [AArch64]() - [ARM]() - [eBPF]() - [RISC-V]() - [Mips]() - [PowerPC]() ## [Engine]() ### [` lief.assembly.Engine `]() class lief.assembly.Engine Bases: `object` This class interfaces the assembler/disassembler support ## [Instruction]() ![Inheritance diagram of lief._lief.assembly.powerpc.Instruction, lief._lief.assembly.ebpf.Instruction, lief._lief.assembly.x86.Instruction, lief._lief.assembly.aarch64.Instruction, lief._lief.assembly.riscv.Instruction, lief._lief.assembly.Instruction, lief._lief.assembly.arm.Instruction, lief._lief.assembly.mips.Instruction](https://lief.re/doc/latest/_images/inheritance-552ea90e449cb9c7a39af3476c7ee10ac71c8f42.png) ### [` lief.assembly.Instruction `]() class lief.assembly.Instruction Bases: `object` This class represents an assembly instruction #### [` MemoryAccess `]() class MemoryAccess(*\*values*) Bases: `Flag` ##### [` NONE `]() NONE = 0 ##### [` READ `]() READ = 1 ##### [` WRITE `]() WRITE = 2 ##### [` from_value `]() from\_value(*arg: int*) → [lief.assembly.Instruction.MemoryAccess]( "lief.assembly.Instruction.MemoryAccess") = <nanobind.nb\_func object> #### [` address `]() property address → int Address of the instruction #### [` branch_target `]() property branch\_target → int | [lief.lief\_errors]( "lief.lief_errors") Given a [`is_branch`]( "lief.assembly.Instruction.is_branch") instruction, try to evaluate the address of the destination. #### [` is_add `]() property is\_add → bool True if the instruction performs an arithmetic addition. #### [` is_barrier `]() property is\_barrier → bool True if the instruction prevents executing the instruction that immediately follows the current. This includes return or unconditional branch instructions #### [` is_bitcast `]() property is\_bitcast → bool True if the instruction is doing a bitcast #### [` is_branch `]() property is\_branch → bool True if the instruction is a branch #### [` is_call `]() property is\_call → bool True if the instruction is a call #### [` is_compare `]() property is\_compare → bool True if the instruction is a comparison #### [` is_conditional_branch `]() property is\_conditional\_branch → bool True if the instruction is **conditionally** jumping to the next instruction **or** an instruction into some other basic block. #### [` is_indirect_branch `]() property is\_indirect\_branch → bool True if the instruction is an indirect branch. This includes instructions that branch through a register (e.g. `jmp rax`, `br x1`). #### [` is_memory_access `]() property is\_memory\_access → bool True if the instruction performs a memory access #### [` is_move_immediate `]() property is\_move\_immediate → bool True if the instruction is moving an immediate #### [` is_move_reg `]() property is\_move\_reg → bool True if the instruction is a register to register move. #### [` is_return `]() property is\_return → bool True if the instruction is a return #### [` is_syscall `]() property is\_syscall → bool True if the instruction is a syscall #### [` is_terminator `]() property is\_terminator → bool True if the instruction marks the end of a basic block #### [` is_trap `]() property is\_trap → bool True if the instruction is a trap. - On `x86/x86-64` this includes the `ud1/ud2` instructions - On `AArch64` this includes the `brk/udf` instructions #### [` is_unconditional_branch `]() property is\_unconditional\_branch → bool True if the instruction is jumping (**unconditionally**) to some other basic block. #### [` memory_access `]() property memory\_access → [lief.assembly.Instruction.MemoryAccess]( "lief.assembly.Instruction.MemoryAccess") Memory access flags #### [` mnemonic `]() property mnemonic → str Instruction mnemonic (e.g. `br`) #### [` raw `]() property raw → bytes Raw bytes of the current instruction #### [` size `]() property size → int Size of the instruction in bytes #### [` to_string `]() to\_string(*self*, *with\_address: bool = True*) → str Representation of the current instruction in a pretty assembly way --- documentID: "0b45cd91842bdc1926045aa36b1ffffc184c288641f1a48bb85d9ccc75dd6cc4" docname: "extended/disassembler/rust" title: "Disassembler Rust API - LIEF Documentation" description: "Disassembler Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/extended/disassembler/rust.html" markdownURL: "https://lief.re/doc/latest/extended/disassembler/rust.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "439f59c03386cfbb4a9ca9d28c4c246c31fa2a6308ac02be6069cf6b5a542a14" --- # [Rust]() > **Note** > > Please check: [`lief::assembly`]() --- documentID: "1dacedc968429ba2ba47e5b9daf0ed1d492bdd2c414696821647ea1c1cb87f32" docname: "extended/dsc/cpp" title: "Dyld Shared Cache C++ API - LIEF Documentation" description: "Dyld Shared Cache C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/extended/dsc/cpp.html" markdownURL: "https://lief.re/doc/latest/extended/dsc/cpp.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "ea526a360d569fa63b7d9af9cb9022d314617c8401c1feb9c9f8e4305d7d9e43" --- # [C++]() > **Note** > > You can also find the Doxygen documentation here: [here]() ## [` LIEF::dsc::load `]() inline std::unique\_ptr<[DyldSharedCache]( "LIEF::dsc::DyldSharedCache")> LIEF::dsc::load(const std::string &path, const std::string &arch = "") Load a shared cache from a single file or from a directory specified by the `path` parameter. In the case where multiple architectures are available in the `path` directory, the `arch` parameter can be used to define which architecture should be preferred. **Example:** ```cpp // From a directory (split caches) auto cache = LIEF::dsc::load("vision-pro-2.0/"); // From a single cache file auto cache = LIEF::dsc::load("ios-14.2/dyld_shared_cache_arm64"); // From a directory with multiple architectures auto cache = LIEF::dsc::load("macos-12.6/", /*arch=*‍/"x86_64h"); ``` ## [` LIEF::dsc::load `]() inline std::unique\_ptr<[DyldSharedCache]( "LIEF::dsc::DyldSharedCache")> LIEF::dsc::load(const std::vector<std::string> &files) Load a shared cache from a list of files. ```cpp std::vector files = { "/tmp/dsc/dyld_shared_cache_arm64e", "/tmp/dsc/dyld_shared_cache_arm64e.1" }; auto cache = LIEF::dsc::load(files); ``` ## [Cache Processing]() > **Warning** > > If you aim at extracting several libraries from a dyld shared cache, it is **highly** recommended to enable caching. Otherwise, performances can be impacted. ### [` LIEF::dsc::enable_cache `]() bool LIEF::dsc::enable\_cache() Enable globally cache/memoization. One can also leverage this function by setting the environment variable `DYLDSC_ENABLE_CACHE` to `1`. By default, LIEF will use the directory specified by the environment variable `DYLDSC_CACHE_DIR` as its cache-root directory: ```bash DYLDSC_ENABLE_CACHE=1 DYLDSC_CACHE_DIR=/tmp/my_dir ./my-program ``` Otherwise, if `DYLDSC_CACHE_DIR` is not set, LIEF will use the following directory (in this priority): 1. System or user cache directory - macOS: `DARWIN_USER_TEMP_DIR` / `DARWIN_USER_CACHE_DIR` + `/dyld_shared_cache` - Linux: `${XDG_CACHE_HOME}/dyld_shared_cache` - Windows: `LOCALAPPDATA%\dyld_shared_cache` 2. Home directory - macOS/Linux: `$HOME/.dyld_shared_cache` - Windows: `USERPROFILE%\.dyld_shared_cache` > **See also** > > [LIEF::dsc::DyldSharedCache::enable\_caching]() for a finer granularity ### [` LIEF::dsc::enable_cache `]() bool LIEF::dsc::enable\_cache(const std::string &dir) Same behavior as [enable\_cache()]() but with a user-provided cache directory. ## [DyldSharedCache]() ### [` DyldSharedCache `]() class DyldSharedCache This class represents a dyld shared cache file. Public Types #### [` VERSION `]() enum class VERSION : uint32\_t This enum wraps the dyld’s git tags for which the structure of dyld shared cache evolved. *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` DYLD_95_3 `]() enumerator DYLD\_95\_3 dyld-95.3 (2007-10-30) ##### [` DYLD_195_5 `]() enumerator DYLD\_195\_5 dyld-195.5 (2011-07-13) ##### [` DYLD_239_3 `]() enumerator DYLD\_239\_3 dyld-239.3 (2013-10-29) ##### [` DYLD_360_14 `]() enumerator DYLD\_360\_14 dyld-360.14 (2015-09-04) ##### [` DYLD_421_1 `]() enumerator DYLD\_421\_1 dyld-421.1 (2016-09-22) ##### [` DYLD_832_7_1 `]() enumerator DYLD\_832\_7\_1 dyld-832.7.1 (2020-11-19) ##### [` DYLD_940 `]() enumerator DYLD\_940 dyld-940 (2021-02-09) ##### [` DYLD_1042_1 `]() enumerator DYLD\_1042\_1 dyld-1042.1 (2022-10-19) ##### [` DYLD_1231_3 `]() enumerator DYLD\_1231\_3 dyld-1231.3 (2024-09-24) ##### [` DYLD_1284_13 `]() enumerator DYLD\_1284\_13 dyld-1284.13 (2025-04-25) ##### [` UNRELEASED `]() enumerator UNRELEASED This value is used for versions of dyld not publicly released or not yet supported by LIEF. #### [` DYLD_TARGET_PLATFORM `]() enum class DYLD\_TARGET\_PLATFORM : uint32\_t Platforms supported by the dyld shared cache. *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` MACOS `]() enumerator MACOS = 1 ##### [` IOS `]() enumerator IOS = 2 ##### [` TVOS `]() enumerator TVOS = 3 ##### [` WATCHOS `]() enumerator WATCHOS = 4 ##### [` BRIDGEOS `]() enumerator BRIDGEOS = 5 ##### [` IOSMAC `]() enumerator IOSMAC = 6 ##### [` IOS_SIMULATOR `]() enumerator IOS\_SIMULATOR = 7 ##### [` TVOS_SIMULATOR `]() enumerator TVOS\_SIMULATOR = 8 ##### [` WATCHOS_SIMULATOR `]() enumerator WATCHOS\_SIMULATOR = 9 ##### [` DRIVERKIT `]() enumerator DRIVERKIT = 10 ##### [` VISIONOS `]() enumerator VISIONOS = 11 ##### [` VISIONOS_SIMULATOR `]() enumerator VISIONOS\_SIMULATOR = 12 ##### [` FIRMWARE `]() enumerator FIRMWARE = 13 ##### [` SEPOS `]() enumerator SEPOS = 14 ##### [` ANY `]() enumerator ANY = 0xFFFFFFFF #### [` DYLD_TARGET_ARCH `]() enum class DYLD\_TARGET\_ARCH Architecture supported by the dyld shared cache. *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` I386 `]() enumerator I386 ##### [` X86_64 `]() enumerator X86\_64 ##### [` X86_64H `]() enumerator X86\_64H ##### [` ARMV5 `]() enumerator ARMV5 ##### [` ARMV6 `]() enumerator ARMV6 ##### [` ARMV7 `]() enumerator ARMV7 ##### [` ARM64 `]() enumerator ARM64 ##### [` ARM64E `]() enumerator ARM64E #### [` dylib_iterator `]() using dylib\_iterator = [iterator\_range]( "LIEF::iterator_range")<[Dylib]( "LIEF::dsc::Dylib")::[Iterator]( "LIEF::dsc::Dylib::Iterator")> Iterator over the libraries in the shared cache. #### [` mapping_info_iterator `]() using mapping\_info\_iterator = [iterator\_range]( "LIEF::iterator_range")<[MappingInfo]( "LIEF::dsc::MappingInfo")::[Iterator]( "LIEF::dsc::MappingInfo::Iterator")> Iterator over the mapping info in the shared cache. #### [` subcache_iterator `]() using subcache\_iterator = [iterator\_range]( "LIEF::iterator_range")<[SubCache]( "LIEF::dsc::SubCache")::[Iterator]( "LIEF::dsc::SubCache::Iterator")> Iterator over the split/sub-cache in this **main** shared cache. #### [` instructions_iterator `]() using instructions\_iterator = [iterator\_range]( "LIEF::iterator_range")<assembly::[Instruction]( "LIEF::assembly::Instruction")::[Iterator]( "LIEF::assembly::Instruction::Iterator")> Public Functions #### [` DyldSharedCache `]() DyldSharedCache(std::unique\_ptr<details::DyldSharedCache> impl) #### [` ~DyldSharedCache `]() ~DyldSharedCache() #### [` filename `]() std::string filename() const Filename of the dyld shared file associated with this object. For instance: `dyld_shared_cache_arm64e, dyld_shared_cache_arm64e.62.dyldlinkedit` #### [` version `]() [VERSION]( "LIEF::dsc::DyldSharedCache::VERSION") version() const Version of dyld used by this cache. #### [` filepath `]() std::string filepath() const Full path to the original dyld shared cache file associated with object (e.g. `/home/lief/downloads/visionos/dyld_shared_cache_arm64e.42`). #### [` load_address `]() uint64\_t load\_address() const Based address of this cache. #### [` arch_name `]() std::string arch\_name() const Name of the architecture targeted by this cache (`x86_64h`). #### [` platform `]() [DYLD\_TARGET\_PLATFORM]( "LIEF::dsc::DyldSharedCache::DYLD_TARGET_PLATFORM") platform() const Platform targeted by this cache (e.g. visionOS). #### [` arch `]() [DYLD\_TARGET\_ARCH]( "LIEF::dsc::DyldSharedCache::DYLD_TARGET_ARCH") arch() const Architecture targeted by this cache. #### [` find_lib_from_va `]() std::unique\_ptr<[Dylib]( "LIEF::dsc::Dylib")> find\_lib\_from\_va(uint64\_t va) const Find the [Dylib]() that encompasses the given virtual address. It returns a nullptr if a [Dylib]() can’t be found. #### [` find_lib_from_path `]() std::unique\_ptr<[Dylib]( "LIEF::dsc::Dylib")> find\_lib\_from\_path(const std::string &path) const Find the [Dylib]() whose [Dylib::path]() matches the provided path. #### [` find_lib_from_name `]() std::unique\_ptr<[Dylib]( "LIEF::dsc::Dylib")> find\_lib\_from\_name(const std::string &name) const Find the [Dylib]() whose filename of [Dylib::path]() matches the provided name. If multiple libraries have the same name (but with a different path), the **first one** matching the provided name is returned. #### [` has_subcaches `]() bool has\_subcaches() const True if the subcaches are associated with this cache. #### [` libraries `]() [dylib\_iterator]( "LIEF::dsc::DyldSharedCache::dylib_iterator") libraries() const Return an iterator over the libraries embedded in this dyld shared cache. This iterator implements the *random access* trait. Thus, one can use [iterator\_range::size](), [iterator\_range::at](), [iterator\_range::operator[]]() to access [Dylib]() at an arbitrary index: ```cpp auto libraries = cache.libaries(); for (size_t i = 0; i < libraries.size(); ++i) { std::string path = libaries[i]->path(); } ``` #### [` mapping_info `]() [mapping\_info\_iterator]( "LIEF::dsc::DyldSharedCache::mapping_info_iterator") mapping\_info() const Return an iterator over the mapping information of this dyld shared cache. This iterator implements the *random access* trait. Thus, one can use [iterator\_range::size](), [iterator\_range::at](), [iterator\_range::operator[]]() to access a [MappingInfo]() at an arbitrary index: ```cpp auto mapping = cache.mapping_info(); for (size_t i = 0; i < mapping.size(); ++i) { const uint64_t addr = mapping[i]->address(); } ``` #### [` subcaches `]() [subcache\_iterator]( "LIEF::dsc::DyldSharedCache::subcache_iterator") subcaches() const Return an iterator over the subcaches associated with this (main) dyld shared cache. This iterator implements the *random access* trait. Thus, one can use [iterator\_range::size](), [iterator\_range::at](), [iterator\_range::operator[]]() to access a [SubCache]() at an arbitrary index: ```cpp auto subcaches = cache.subcaches(); for (size_t i = 0; i < subcaches.size(); ++i) { std::unique_ptr impl = subcaches[i]->cache(); } ``` #### [` disassemble `]() [instructions\_iterator]( "LIEF::dsc::DyldSharedCache::instructions_iterator") disassemble(uint64\_t va) const Disassemble instructions at the provided virtual address. This function returns an iterator over [assembly::Instruction](). #### [` get_content_from_va `]() std::vector<uint8\_t> get\_content\_from\_va(uint64\_t va, uint64\_t size) const Return the content at the specified virtual address. #### [` cache_for_address `]() std::unique\_ptr<[DyldSharedCache]( "LIEF::dsc::DyldSharedCache")> cache\_for\_address(uint64\_t va) const Find the sub-DyldSharedCache that wraps the given virtual address. #### [` main_cache `]() std::unique\_ptr<[DyldSharedCache]( "LIEF::dsc::DyldSharedCache")> main\_cache() const Return the principal dyld shared cache in the case of multiple subcaches. #### [` find_subcache `]() std::unique\_ptr<[DyldSharedCache]( "LIEF::dsc::DyldSharedCache")> find\_subcache(const std::string &filename) const Try to find the [DyldSharedCache]() associated with the filename given in the first parameter. #### [` va_to_offset `]() [result]( "LIEF::result")<uint64\_t> va\_to\_offset(uint64\_t va) const Convert the given virtual address into an offset. > **Warning** > > If the shared cache contains multiple subcaches, this function needs to be called on the targeted subcache. See [cache\_for\_address()]() to find the associated subcache. #### [` stream `]() [FileStream]( "LIEF::FileStream") &stream() const Return the stream associated with this dyld shared cache. #### [` stream `]() [FileStream]( "LIEF::FileStream") &stream() Return the stream associated with this dyld shared cache. #### [` enable_caching `]() void enable\_caching(const std::string &target\_cache\_dir) const When enabled, this function records and keeps in *cache* the dyld shared cache information that is costly to access. For instance, GOT symbols, rebases information, stub symbols, … It is **highly** recommended to enable this function when processing a dyld shared cache several times or when extracting a large number of [LIEF::dsc::Dylib]() with enhanced extraction options (e.g. [Dylib::extract\_opt\_t::fix\_branches]()) One can enable caching by calling this function: ```cpp auto dyld_cache = LIEF::dsc::load("macos-15.0.1/"); dyld_cache->enable_caching("/home/user/.cache/lief-dsc"); ``` One can also enable this cache optimization **globally** using the function: [LIEF::dsc::enable\_cache]() or by setting the environment variable `DYLDSC_ENABLE_CACHE` to 1. #### [` flush_cache `]() void flush\_cache() const Flush internal information into the on-disk cache (see: enable\_caching). Public Static Functions #### [` from_path `]() static std::unique\_ptr<[DyldSharedCache]( "LIEF::dsc::DyldSharedCache")> from\_path(const std::string &path, const std::string &arch = "") See the [load]() functions for the details. #### [` from_files `]() static std::unique\_ptr<[DyldSharedCache]( "LIEF::dsc::DyldSharedCache")> from\_files(const std::vector<std::string> &path) See the [load]() functions for the details. ## [Dylib]() ### [` Dylib `]() class Dylib This class represents a library embedded in a dyld shared cache. It mirrors the original `dyld_cache_image_info` structure. Public Functions #### [` Dylib `]() Dylib(std::unique\_ptr<details::Dylib> impl) #### [` ~Dylib `]() ~Dylib() #### [` path `]() std::string path() const Original path of the library (e.g. `/usr/lib/libcryptex.dylib`). #### [` address `]() uint64\_t address() const In-memory address of the library. #### [` modtime `]() uint64\_t modtime() const Modification time of the library matching `stat.st_mtime`, or 0. #### [` inode `]() uint64\_t inode() const File serial number matching `stat.st_ino` or 0. Note that for shared cache targeting iOS, this value can hold a hash of the path (if modtime is set to 0) #### [` padding `]() uint64\_t padding() const Padding alignment value (should be 0). #### [` get `]() std::unique\_ptr<LIEF::MachO::[Binary]( "LIEF::MachO::Binary")> get(const [extract\_opt\_t]( "LIEF::dsc::Dylib::extract_opt_t") &opt = [extract\_opt\_t]( "LIEF::dsc::Dylib::extract_opt_t")()) const Get a [MachO::Binary]() representation for this [Dylib](). One can use this function to write back the Mach-O binary on the disk: ```cpp dyld_cache->libraries()[12]->get()->write("liblockdown.dylib"); ``` #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::dsc::Dylib::Iterator"), std::random\_access\_iterator\_tag, [Dylib]( "LIEF::dsc::Dylib"), std::ptrdiff\_t, const [Dylib]( "LIEF::dsc::Dylib")\*, const [Dylib]( "LIEF::dsc::Dylib")&> [Dylib]() [Iterator](). Public Types ##### [` implementation `]() using implementation = details::DylibIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::DylibIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::dsc::Dylib::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::dsc::Dylib::Iterator") &operator=(const [Iterator]( "LIEF::dsc::Dylib::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::dsc::Dylib::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::dsc::Dylib::Iterator") &operator=([Iterator]( "LIEF::dsc::Dylib::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator< `]() bool operator<(const [Iterator]( "LIEF::dsc::Dylib::Iterator") &rhs) const ##### [` operator- `]() std::ptrdiff\_t operator-(const [Iterator]( "LIEF::dsc::Dylib::Iterator") &R) const ##### [` operator+= `]() [Iterator]( "LIEF::dsc::Dylib::Iterator") &operator+=(std::ptrdiff\_t n) ##### [` operator-= `]() [Iterator]( "LIEF::dsc::Dylib::Iterator") &operator-=(std::ptrdiff\_t n) ##### [` operator* `]() const [Dylib]( "LIEF::dsc::Dylib") &operator\*() const ##### [` operator-> `]() const [Dylib]( "LIEF::dsc::Dylib") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Dylib]( "LIEF::dsc::Dylib")> yield() Transfer ownership of the dylib at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::dsc::Dylib::Iterator") &LHS, const [Iterator]( "LIEF::dsc::Dylib::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::dsc::Dylib::Iterator") &LHS, const [Iterator]( "LIEF::dsc::Dylib::Iterator") &RHS) #### [` extract_opt_t `]() struct extract\_opt\_t This structure is used to tweak the extraction process while calling [Dylib::get](). These options allow deoptimizing the dylib to get an accurate representation of the origin Mach-O binary. Public Functions ##### [` extract_opt_t `]() extract\_opt\_t() Public Members ##### [` pack `]() bool pack = true Whether the segment’s offsets should be packed to avoid an in-memory size while writing back the binary. > **Note** > > This option does not have an impact on the performances ##### [` fix_branches `]() bool fix\_branches = false Fix call instructions that target addresses outside the current dylib virtual space. > **Warning** > > Enabling this option can have a significant impact on the performances. Make sure to enable the internal cache mechanism: [LIEF::dsc::enable\_cache]() or [LIEF::dsc::DyldSharedCache::enable\_caching]() ##### [` fix_memory `]() bool fix\_memory = false Fix memory accesses performed outside the dylib’s virtual space. > **Warning** > > Enabling this option can have a significant impact on the performances. Make sure to enable the internal cache mechanism: [LIEF::dsc::enable\_cache]() or [LIEF::dsc::DyldSharedCache::enable\_caching]() ##### [` fix_relocations `]() bool fix\_relocations = false Recover and fix relocations. > **Warning** > > Enabling this option can have a significant impact on the performances. Make sure to enable the internal cache mechanism: [LIEF::dsc::enable\_cache]() or [LIEF::dsc::DyldSharedCache::enable\_caching]() ##### [` fix_objc `]() bool fix\_objc = false Fix Objective-C information. ##### [` create_dyld_chained_fixup_cmd `]() LIEF::[result]( "LIEF::result")<bool> create\_dyld\_chained\_fixup\_cmd Whether the `LC_DYLD_CHAINED_FIXUPS` command should be (re)created. If this value is not set, LIEF will add the command only if it’s meaningful regarding the other options ## [MappingInfo]() ### [` MappingInfo `]() class MappingInfo This class represents a `dyld_cache_mapping_info` entry. It provides information about the relationship between on-disk shared cache and in-memory shared cache. Public Functions #### [` MappingInfo `]() MappingInfo(std::unique\_ptr<details::MappingInfo> impl) #### [` ~MappingInfo `]() ~MappingInfo() #### [` address `]() uint64\_t address() const The in-memory address where this dyld shared cache region is mapped. #### [` size `]() uint64\_t size() const Size of the region being mapped. #### [` end_address `]() inline uint64\_t end\_address() const End virtual address of the region. #### [` file_offset `]() uint64\_t file\_offset() const On-disk file offset. #### [` max_prot `]() uint32\_t max\_prot() const Max memory protection. #### [` init_prot `]() uint32\_t init\_prot() const Initial memory protection. #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::dsc::MappingInfo::Iterator"), std::random\_access\_iterator\_tag, [MappingInfo]( "LIEF::dsc::MappingInfo"), std::ptrdiff\_t, const [MappingInfo]( "LIEF::dsc::MappingInfo")\*, const [MappingInfo]( "LIEF::dsc::MappingInfo")&> [MappingInfo]() [Iterator](). Public Types ##### [` implementation `]() using implementation = details::MappingInfoIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::MappingInfoIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::dsc::MappingInfo::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::dsc::MappingInfo::Iterator") &operator=(const [Iterator]( "LIEF::dsc::MappingInfo::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::dsc::MappingInfo::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::dsc::MappingInfo::Iterator") &operator=([Iterator]( "LIEF::dsc::MappingInfo::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator< `]() bool operator<(const [Iterator]( "LIEF::dsc::MappingInfo::Iterator") &rhs) const ##### [` operator- `]() std::ptrdiff\_t operator-(const [Iterator]( "LIEF::dsc::MappingInfo::Iterator") &R) const ##### [` operator+= `]() [Iterator]( "LIEF::dsc::MappingInfo::Iterator") &operator+=(std::ptrdiff\_t n) ##### [` operator-= `]() [Iterator]( "LIEF::dsc::MappingInfo::Iterator") &operator-=(std::ptrdiff\_t n) ##### [` operator* `]() const [MappingInfo]( "LIEF::dsc::MappingInfo") &operator\*() const ##### [` operator-> `]() const [MappingInfo]( "LIEF::dsc::MappingInfo") \*operator->() const ##### [` yield `]() std::unique\_ptr<[MappingInfo]( "LIEF::dsc::MappingInfo")> yield() Transfer ownership of the mapping info at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::dsc::MappingInfo::Iterator") &LHS, const [Iterator]( "LIEF::dsc::MappingInfo::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::dsc::MappingInfo::Iterator") &LHS, const [Iterator]( "LIEF::dsc::MappingInfo::Iterator") &RHS) ## [SubCache]() ### [` SubCache `]() class SubCache This class represents a subcache in the case of large/split dyld shared cache. It mirrors (and abstracts) the original `dyld_subcache_entry` / `dyld_subcache_entry_v1` Public Functions #### [` SubCache `]() SubCache(std::unique\_ptr<details::SubCache> impl) #### [` ~SubCache `]() ~SubCache() #### [` uuid `]() sc\_uuid\_t uuid() const The uuid of the subcache file. #### [` vm_offset `]() uint64\_t vm\_offset() const The offset of this subcache from the main cache base address. #### [` suffix `]() std::string suffix() const The file name suffix of the subCache file (e.g. `.25.data`, `.03.development`). #### [` cache `]() std::unique\_ptr<const [DyldSharedCache]( "LIEF::dsc::DyldSharedCache")> cache() const The associated [DyldSharedCache]() object for this subcache. Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [SubCache]( "LIEF::dsc::SubCache") &subcache) #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::dsc::SubCache::Iterator"), std::random\_access\_iterator\_tag, [SubCache]( "LIEF::dsc::SubCache"), std::ptrdiff\_t, const [SubCache]( "LIEF::dsc::SubCache")\*, const [SubCache]( "LIEF::dsc::SubCache")&> [SubCache]() [Iterator](). Public Types ##### [` implementation `]() using implementation = details::SubCacheIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::SubCacheIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::dsc::SubCache::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::dsc::SubCache::Iterator") &operator=(const [Iterator]( "LIEF::dsc::SubCache::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::dsc::SubCache::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::dsc::SubCache::Iterator") &operator=([Iterator]( "LIEF::dsc::SubCache::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator< `]() bool operator<(const [Iterator]( "LIEF::dsc::SubCache::Iterator") &rhs) const ##### [` operator- `]() std::ptrdiff\_t operator-(const [Iterator]( "LIEF::dsc::SubCache::Iterator") &R) const ##### [` operator+= `]() [Iterator]( "LIEF::dsc::SubCache::Iterator") &operator+=(std::ptrdiff\_t n) ##### [` operator-= `]() [Iterator]( "LIEF::dsc::SubCache::Iterator") &operator-=(std::ptrdiff\_t n) ##### [` operator* `]() const [SubCache]( "LIEF::dsc::SubCache") &operator\*() const ##### [` operator-> `]() const [SubCache]( "LIEF::dsc::SubCache") \*operator->() const ##### [` yield `]() std::unique\_ptr<[SubCache]( "LIEF::dsc::SubCache")> yield() Transfer ownership of the subcache at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::dsc::SubCache::Iterator") &LHS, const [Iterator]( "LIEF::dsc::SubCache::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::dsc::SubCache::Iterator") &LHS, const [Iterator]( "LIEF::dsc::SubCache::Iterator") &RHS) ## [Utilities]() ### [` LIEF::dsc::is_shared_cache `]() bool LIEF::dsc::is\_shared\_cache([BinaryStream]( "LIEF::BinaryStream") &stream) Check if the given stream wraps a Dyld Shared Cache. ### [` LIEF::dsc::is_shared_cache `]() inline bool LIEF::dsc::is\_shared\_cache(const std::vector<uint8\_t> &buffer) Check if the given buffer points to a dyld shared cache file. ### [` LIEF::dsc::is_shared_cache `]() inline bool LIEF::dsc::is\_shared\_cache(const uint8\_t \*buffer, size\_t size) Check if the given buffer points to a dyld shared cache file. --- documentID: "b2e20ca344aa12515d073b90c420faecee7d27d73bddf73463741419d87afd9c" docname: "extended/dsc/index" title: "Dyld Shared Cache - LIEF Documentation" description: "Load Apple Dyld shared caches, inspect and extract libraries as Mach-O files, and configure extraction and caching with LIEF Extended." canonical: "https://lief.re/doc/latest/extended/dsc/index.html" markdownURL: "https://lief.re/doc/latest/extended/dsc/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "c9c38604da64cb6db368a7b2531c08c4a62982a627a35aa205bcd58f1c85c30e" --- # [Dyld Shared Cache]() API - [C++]() - [Python]() - [Rust]() ## [Introduction]() LIEF Extended can inspect Apple’s Dyld shared cache, enumerate its libraries, and extract them as Mach-O binaries. ## [Load a cache and list its libraries]() One can load a shared cache using the `lief.dsc.load()` ( [`lief::dsc::load_from_path`]() ; [`lief::dsc::load_from_files`]() ; [`lief.dsc.load()`]() ; [`LIEF::dsc::load()`]() ) function: **Python** ```python import lief dyld_cache: lief.dsc.DyldSharedCache | None = lief.dsc.load("macos-15.0.1/") ``` **C++** ```cpp #include std::unique_ptr dyld_cache = LIEF::dsc::load("macos-15.0.1/"); ``` **Rust** ```rust let dyld_cache = lief::dsc::load_from_path("macos-15.0.1/", ""); ``` > **Note** > > Pass a directory to `lief.dsc.load()` ( [`lief::dsc::load_from_path`]() ; [`lief::dsc::load_from_files`]() ; [`lief.dsc.load()`]() ; [`LIEF::dsc::load()`]() ) to load the whole cache, or an explicit set of files to load a subset. Keep the main cache and its matching subcache files together: an extraction may need data from more than one file. From this `lief.dsc.DyldSharedCache` ( [`lief::dsc::DyldSharedCache`]() ; [`lief.dsc.DyldSharedCache`]() ; [`LIEF::dsc::DyldSharedCache`]() ) object, we can inspect the embedded `lief.dsc.Dylib` ( [`lief::dsc::Dylib`]() ; [`lief.dsc.Dylib`]() ; [`LIEF::dsc::Dylib`]() ) as follows: **Python** ```python dyld_cache: lief.dsc.DyldSharedCache for dylib in dyld_cache.libraries: print(f"{dylib.address:#016x}: {dylib.path}") ``` **C++** ```cpp std::unique_ptr dyld_cache; for (const LIEF::dsc::Dylib& dylib : dyld_cache->libraries()) { std::cout << dylib.address() << ' ' << dylib.path() << '\n'; } ``` **Rust** ```rust let dyld_cache: &lief::dsc::DyldSharedCache = some_dyld_cache; for dylib in dyld_cache.libraries() { println!("0x{:016x}: {}", dylib.address(), dylib.path()); } ``` ## [Extract a library]() Find a `lief.dsc.Dylib` ( [`lief::dsc::Dylib`]() ; [`lief.dsc.Dylib`]() ; [`LIEF::dsc::Dylib`]() ), then use `lief.dsc.Dylib.get()` ( [`lief::dsc::Dylib::get`]() ; [`lief.dsc.Dylib.get()`]() ; [`LIEF::dsc::Dylib::get()`]() ) to extract a `lief.MachO.Binary` ( [`lief::macho::Binary`]() ; [`lief.MachO.Binary`]() ; [`LIEF::MachO::Binary`]() ) for analysis. Check both the library lookup and the extraction result before using the Mach-O object: **Python** ```python dyld_cache: lief.dsc.DyldSharedCache liblockdown = dyld_cache.find_lib_from_name("liblockdown.dylib") macho = liblockdown.get() for segment in macho.segments: print(segment.name) ``` **C++** ```cpp std::unique_ptr dyld_cache; std::unique_ptr liblockdown = dyld_cache->find_lib_from_name("liblockdown.dylib"); std::unique_ptr macho = liblockdown->get(); for (const LIEF::MachO::SegmentCommand& segment : macho->segments()) { std::cout << segment.name() << '\n'; } ``` **Rust** ```rust let dyld_cache: &lief::dsc::DyldSharedCache = some_dyld_cache; let liblockdown = dyld_cache.find_lib_from_name("liblockdown.dylib").unwrap(); let macho = liblockdown.get().unwrap(); for segment in macho.segments() { println!("{}", segment.name()); } ``` Use `lief.MachO.Binary.write()` ( [`lief::macho::Binary::write`]() ; [`lief::macho::Binary::write_with_config`]() ; [`lief.MachO.Binary.write()`]() ; [`LIEF::MachO::Binary::write()`]() ) to save the extracted object to a file: **Python** ```python dyld_cache: lief.dsc.DyldSharedCache liblockdown = dyld_cache.find_lib_from_name("liblockdown.dylib") macho = liblockdown.get() macho.write("on-disk-liblockdown.dylib") ``` **C++** ```cpp std::unique_ptr dyld_cache; std::unique_ptr liblockdown = dyld_cache->find_lib_from_name("liblockdown.dylib"); std::unique_ptr macho = liblockdown->get(); macho->write("on-disk-liblockdown.dylib"); ``` **Rust** ```rust let dyld_cache: &lief::dsc::DyldSharedCache = some_dyld_cache; let liblockdown = dyld_cache.find_lib_from_name("liblockdown.dylib").unwrap(); let mut macho = liblockdown.get().unwrap(); macho.write("on-disk-liblockdown.dylib"); ``` > **Warning** > > By default, LIEF retains Dyld shared cache optimizations. Review `lief.dsc.Dylib.extract_opt_t` ( [`lief::dsc::dylib::ExtractOpt`]() ; [`lief.dsc.Dylib.extract_opt_t`]() ; [`LIEF::dsc::Dylib::extract_opt_t`]() ) when the extracted library needs references and other cache-specific structures recovered. Writing a Mach-O file alone does not guarantee it can be loaded independently of the cache. ## [Performance Considerations]() Dyld shared cache files are quite large, meaning they cannot be processed in the same way as standard `lief.MachO.Binary` ( [`lief::macho::Binary`]() ; [`lief.MachO.Binary`]() ; [`LIEF::MachO::Binary`]() ) or `lief.ELF.Binary` ( [`lief::elf::Binary`]() ; [`lief.ELF.Binary`]() ; [`LIEF::ELF::Binary`]() ) binaries. The Dyld shared cache support in LIEF follows the principle: *don’t pay overhead for what you don’t access*. This is the opposite of the implementation of `lief.PE.parse()` ( [`lief::pe::Binary::parse`]() ; [`lief.PE.parse()`]() ; [`LIEF::PE::Parser::parse()`]() ), `lief.MachO.parse()` ( [`lief::macho::FatBinary::parse`]() ; [`lief.MachO.parse()`]() ; [`LIEF::MachO::Parser::parse()`]() ), and `lief.ELF.parse()` ( [`lief::elf::Binary::parse`]() ; [`lief.ELF.parse()`]() ; [`LIEF::ELF::Parser::parse()`]() ). > **Note** > > These functions parse all format structures (with decent performance) because: > > 1. Most binary sizes are less than one gigabyte. > 2. A complete representation is required for modifying binaries. From a technical perspective, LIEF uses a [`LIEF::FileStream`]( "LIEF::FileStream") to access Dyld shared cache structures on demand. Thus, in-memory consumption is limited to the size of the structures being accessed. The drawback of using [`FileStream`]( "LIEF::FileStream") is that because it uses file-based access, it takes more time compared to a [`LIEF::VectorStream`]( "LIEF::VectorStream"). Additionally, LIEF’s Dyld shared cache implementation **heavily** relies on the iterator pattern to follow the principle: *don’t pay overhead for what you don’t access*. For instance, `lief.dsc.DyldSharedCache.libraries()` ( [`lief::dsc::DyldSharedCache::libraries`]() ; [`lief.dsc.DyldSharedCache.libraries`]() ; [`LIEF::dsc::DyldSharedCache::libraries()`]() ) returns an **iterator** over the `lief.dsc.Dylib` ( [`lief::dsc::Dylib`]() ; [`lief.dsc.Dylib`]() ; [`LIEF::dsc::Dylib`]() ). Therefore, if you don’t iterate, you don’t pay for the access and parsing of the `lief.dsc.Dylib` ( [`lief::dsc::Dylib`]() ; [`lief.dsc.Dylib`]() ; [`LIEF::dsc::Dylib`]() ) objects. Where possible, LIEF implements the random access iterator trait [[1]]() so that we can programmatically do: **Python** ```python dyld_cache: lief.dsc.DyldSharedCache # No cost libraries = dyld_cache.libraries # O(1) cost first_lib = libraries[0] # O(len(libraries)) cost for lib in libraries: print(lib.path) ``` **C++** ```cpp std::unique_ptr dyld_cache; // No cost auto libraries = dyld_cache->libraries(); // O(1) cost: the iterator is random access, so an arbitrary library can be // reached by index without materializing the ones before it. std::cout << "First library: " << libraries[0]->path() << '\n'; // O(libraries.size()) cost for (const Dylib& dylib : libraries) { std::cout << dylib.path() << '\n'; } ``` When extracting a `lief.MachO.Binary` ( [`lief::macho::Binary`]() ; [`lief.MachO.Binary`]() ; [`LIEF::MachO::Binary`]() ) from a `lief.dsc.Dylib` ( [`lief::dsc::Dylib`]() ; [`lief.dsc.Dylib`]() ; [`LIEF::dsc::Dylib`]() ) object using `lief.dsc.Dylib.get()` ( [`lief::dsc::Dylib::get`]() ; [`lief.dsc.Dylib.get()`]() ; [`LIEF::dsc::Dylib::get()`]() ), **the extraction can take a substantial amount of time**, especially if certain deoptimizations are enabled (c.f. `lief.dsc.Dylib.extract_opt_t` ( [`lief::dsc::dylib::ExtractOpt`]() ; [`lief.dsc.Dylib.extract_opt_t`]() ; [`LIEF::dsc::Dylib::extract_opt_t`]() )). For instance, `lief.dsc.Dylib.extract_opt_t.fix_branches` ( [`lief::dsc::dylib::ExtractOpt::fix_branches`]() ; [`lief.dsc.Dylib.extract_opt_t.fix_branches`]() ; [`LIEF::dsc::Dylib::extract_opt_t::fix_branches`]() ) may require iterating over the Dyld shared cache’s stub islands several times. To improve overall performance, LIEF provides a cache-based optimization that can be enabled and configured with: - `lief.dsc.enable_cache()` ( [`lief::dsc::enable_cache`]() ; [`lief.dsc.enable_cache()`]() ; [`LIEF::dsc::enable_cache()`]() ) - `lief.dsc.DyldSharedCache.enable_caching` ( [`lief::dsc::DyldSharedCache::enable_caching`]() ; [`lief.dsc.DyldSharedCache.enable_caching()`]() ; [`LIEF::dsc::DyldSharedCache::enable_caching()`]() ) > **When should you turn caching on?** > > You can **skip** LIEF’s caching if: > > - You don’t plan to extract libraries from the shared cache. > - You plan to extract only one library from the shared cache and **only once** > - You don’t want to have LIEF cache artifacts on your system. > > For all other situations, you should turn on `lief.dsc.enable_cache()` ( [`lief::dsc::enable_cache`]() ; [`lief.dsc.enable_cache()`]() ; [`LIEF::dsc::enable_cache()`]() ). > > **By default, the cache mechanism is not enabled.** [[1]()] [https://en.cppreference.com/w/cpp/iterator/random\_access\_iterator]() ## [References]() - [arandomdev/DyldExtractor]() - [blacktop/ipsw]() - [apple-oss-distributions/dyld]() - [https://www.romainthomas.fr/post/24-09-apple-lockdown-dbi-lifting/]() [Python API]() [C++ API]() Rust API: [`lief::dsc`]() --- documentID: "8526e79645ff813633df72e443e8ec7b697331f8c7d9511401e5e0d19a9f05eb" docname: "extended/dsc/python" title: "Dyld Shared Cache Python API - LIEF Documentation" description: "Dyld Shared Cache Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/extended/dsc/python.html" markdownURL: "https://lief.re/doc/latest/extended/dsc/python.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "00c117c5d0ff01ffaf990a6ead3fbd35ba67ff0a51a045df024ed13448f1b079" --- # [Python]() ## [` lief.dsc.loadlief.dsc.load `]() lief.dsc.load(*\*args*) → [lief.dsc.DyldSharedCache]( "lief.dsc.DyldSharedCache") | None **lief.dsc.load(*path: str | os.PathLike*, *arch: str = ''*) → [lief.\_lief.dsc.DyldSharedCache]( "lief._lief.dsc.DyldSharedCache") | None** Overloaded function. 1. `load(files: collections.abc.Sequence[str]) -> Optional[lief._lief.dsc.DyldSharedCache]` > Load a shared cache from a list of files. > > ```python > files = [ > "/tmp/dsc/dyld_shared_cache_arm64e", > "/tmp/dsc/dyld_shared_cache_arm64e.1" > ] > cache = lief.dsc.load(files) > ``` 2. `load(path: Union[str | os.PathLike], arch: str = '') -> Optional[lief._lief.dsc.DyldSharedCache]` > Load a shared cache from a single file or from a directory specified by the `path` parameter. > > In the case where multiple architectures are available in the `path` directory, the `arch` parameter can be used to define which architecture should be preferred. > > **Example:** > > ```python > # From a directory (split caches) > cache = lief.dsc.load("vision-pro-2.0/") > > # From a single cache file > cache = lief.dsc.load("ios-14.2/dyld_shared_cache_arm64") > > # From a directory with multiple architectures > cache = lief.dsc.load("macos-12.6/", "x86_64h") > ``` ## [Cache Processing]() > **Warning** > > If you aim at extracting several libraries from a dyld shared cache, it is **highly** recommended to enable caching. Otherwise, performances can be impacted. ### [` lief.dsc.enable_cachelief.dsc.enable_cache `]() lief.dsc.enable\_cache(*\*args*) → bool **lief.dsc.enable\_cache(*target\_cache\_dir: str | os.PathLike*) → bool** Overloaded function. 1. `enable_cache() -> bool` > Enable globally cache/memoization. One can also leverage this function by setting the environment variable `DYLDSC_ENABLE_CACHE` to `1` > > By default, LIEF will use the directory specified by the environment variable `DYLDSC_CACHE_DIR` as its cache-root directory: > > ```console > DYLDSC_ENABLE_CACHE=1 DYLDSC_CACHE_DIR=/tmp/my_dir python ./my-script.py > ``` > > Otherwise, if `DYLDSC_CACHE_DIR` is not set, LIEF will use the following directory (in this priority): > > 1. System or user cache directory > > - macOS: `DARWIN_USER_TEMP_DIR` / `DARWIN_USER_CACHE_DIR` + `/dyld_shared_cache` > > - Linux: `${XDG_CACHE_HOME}/dyld_shared_cache` > > - Windows: `%LOCALAPPDATA%\dyld_shared_cache` > > 2. Home directory > > - macOS/Linux: `$HOME/.dyld_shared_cache` > > - Windows: `%USERPROFILE%\.dyld_shared_cache` > > See [`lief.dsc.DyldSharedCache.enable_caching()`]( "lief.dsc.DyldSharedCache.enable_caching") for a finer granularity 2. `enable_cache(target_cache_dir: Union[str | os.PathLike]) -> bool` > Same behavior as the other `enable_cache()` function but using a user-provided cache directory instead of an inferred one. ## [DyldSharedCache]() ### [` lief.dsc.DyldSharedCache `]() class lief.dsc.DyldSharedCache Bases: `object` This class represents a dyld shared cache file. #### [` ARCH `]() class ARCH(*\*values*) Bases: `Enum` Architecture supported by the dyld shared cache ##### [` ARM64 `]() ARM64 = 7 ##### [` ARM64E `]() ARM64E = 8 ##### [` ARMV5 `]() ARMV5 = 4 ##### [` ARMV6 `]() ARMV6 = 5 ##### [` ARMV7 `]() ARMV7 = 6 ##### [` I386 `]() I386 = 1 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` X86_64 `]() X86\_64 = 2 ##### [` X86_64H `]() X86\_64H = 3 #### [` PLATFORM `]() class PLATFORM(*\*values*) Bases: `Enum` Platforms supported by the dyld shared cache ##### [` ANY `]() ANY = 4294967295 ##### [` BRIDGEOS `]() BRIDGEOS = 5 ##### [` DRIVERKIT `]() DRIVERKIT = 10 ##### [` FIRMWARE `]() FIRMWARE = 13 ##### [` IOS `]() IOS = 2 ##### [` IOSMAC `]() IOSMAC = 6 ##### [` IOS_SIMULATOR `]() IOS\_SIMULATOR = 7 ##### [` MACOS `]() MACOS = 1 ##### [` SEPOS `]() SEPOS = 14 ##### [` TVOS `]() TVOS = 3 ##### [` TVOS_SIMULATOR `]() TVOS\_SIMULATOR = 8 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` VISIONOS `]() VISIONOS = 11 ##### [` VISIONOS_SIMULATOR `]() VISIONOS\_SIMULATOR = 12 ##### [` WATCHOS `]() WATCHOS = 4 ##### [` WATCHOS_SIMULATOR `]() WATCHOS\_SIMULATOR = 9 #### [` VERSION `]() class VERSION(*\*values*) Bases: `Enum` ##### [` DYLD_1042_1 `]() DYLD\_1042\_1 = 8 ##### [` DYLD_1231_3 `]() DYLD\_1231\_3 = 9 ##### [` DYLD_1284_13 `]() DYLD\_1284\_13 = 10 ##### [` DYLD_195_5 `]() DYLD\_195\_5 = 2 ##### [` DYLD_239_3 `]() DYLD\_239\_3 = 3 ##### [` DYLD_360_14 `]() DYLD\_360\_14 = 4 ##### [` DYLD_421_1 `]() DYLD\_421\_1 = 5 ##### [` DYLD_832_7_1 `]() DYLD\_832\_7\_1 = 6 ##### [` DYLD_940 `]() DYLD\_940 = 7 ##### [` DYLD_95_3 `]() DYLD\_95\_3 = 1 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` UNRELEASED `]() UNRELEASED = 11 #### [` arch `]() property arch → [lief.dsc.DyldSharedCache.ARCH]( "lief.dsc.DyldSharedCache.ARCH") Architecture targeted by this cache #### [` arch_name `]() property arch\_name → str Name of the architecture targeted by this cache (`x86_64h`) #### [` cache_for_address `]() cache\_for\_address(*self*, *address: int*) → [lief.\_lief.dsc.DyldSharedCache]( "lief._lief.dsc.DyldSharedCache") | None Find the sub-DyldSharedCache that wraps the given virtual address #### [` disassemble `]() disassemble(*self*, *arg: int*, */*) → Iterator[[lief.\_lief.assembly.Instruction]( "lief._lief.assembly.Instruction") | None] Disassemble instructions at the provided virtual address. This function returns an iterator over [`lief.assembly.Instruction`]( "lief.assembly.Instruction"). #### [` enable_caching `]() enable\_caching(*self*, *target\_dir: str*) → None When enabled, this function allows to record and to keep in *cache*, dyld shared cache information that are costly to access. For instance, GOT symbols, rebases information, stub symbols, … It is **highly** recommended to enable this function when processing a dyld shared cache several times or when extracting a large number of [`lief.dsc.Dylib`]( "lief.dsc.Dylib") with enhanced extraction options (e.g. [`lief.dsc.Dylib.extract_opt_t.fix_branches`]( "lief.dsc.Dylib.extract_opt_t.fix_branches")) One can enable caching by calling this function: ```python dyld_cache = lief.dsc.load("macos-15.0.1/"); dyld_cache.enable_caching("~/.cache/lief-dsc"); ``` One can also enable this cache optimization **globally** using the function: [`lief.dsc.enable_cache()`]( "lief.dsc.enable_cache") or by setting the environment variable `DYLDSC_ENABLE_CACHE` to 1. #### [` filename `]() property filename → str Filename of the dyld shared file associated with this object. For instance: `dyld_shared_cache_arm64e, dyld_shared_cache_arm64e.62.dyldlinkedit` #### [` filepath `]() property filepath → str Full path to the original dyld shared cache file associated with object (e.g. `/cache/visionos/dyld_shared_cache_arm64e.42`) #### [` find_lib_from_name `]() find\_lib\_from\_name(*self*, *name: str*) → [lief.\_lief.dsc.Dylib]( "lief._lief.dsc.Dylib") | None Find the Dylib whose filename of [`lief.dsc.Dylib.path`]( "lief.dsc.Dylib.path") matches the provided name. If multiple libraries have the same name (but with a different path), the **first one** matching the provided name is returned. #### [` find_lib_from_path `]() find\_lib\_from\_path(*self*, *path: str*) → [lief.\_lief.dsc.Dylib]( "lief._lief.dsc.Dylib") | None Find the Dylib whose [`lief.dsc.Dylib.path`]( "lief.dsc.Dylib.path") matches the provided path. #### [` find_lib_from_va `]() find\_lib\_from\_va(*self*, *virtual\_address: int*) → [lief.\_lief.dsc.Dylib]( "lief._lief.dsc.Dylib") | None Find the [`lief.dsc.Dylib`]( "lief.dsc.Dylib") that encompasses the given virtual address. It returns `None` if a Dylib can’t be found. #### [` find_subcache `]() find\_subcache(*self*, *filename: str*) → [lief.\_lief.dsc.DyldSharedCache]( "lief._lief.dsc.DyldSharedCache") | None Try to find the DyldSharedCache associated with the filename given in the first parameter. #### [` flush_cache `]() flush\_cache(*self*) → None Flush internal information into the on-disk cache (see: [`enable_caching()`]( "lief.dsc.DyldSharedCache.enable_caching")) #### [` from_files `]() from\_files(*files: collections.abc.Sequence[str]*) → [lief.dsc.DyldSharedCache]( "lief.dsc.DyldSharedCache") | None = <nanobind.nb\_func object> #### [` from_path `]() from\_path(*path: str*, *arch: str*) → [lief.dsc.DyldSharedCache]( "lief.dsc.DyldSharedCache") | None = <nanobind.nb\_func object> #### [` get_content_from_va `]() get\_content\_from\_va(*self*, *addr: int*, *size: int*) → bytes Return the content at the specified virtual address #### [` has_subcaches `]() property has\_subcaches → bool True if the subcaches are associated with this cache #### [` libraries `]() property libraries → collections.abc.Sequence[[lief.dsc.Dylib]( "lief.dsc.Dylib") | None] Return a list-like of the [`Dylib`]( "lief.dsc.Dylib") embedded in this dyld shared cache #### [` load_address `]() property load\_address → int Base address of this cache #### [` main_cache `]() property main\_cache → [lief.dsc.DyldSharedCache]( "lief.dsc.DyldSharedCache") | None Return the principal dyld shared cache in the case of multiple subcaches #### [` mapping_info `]() property mapping\_info → collections.abc.Sequence[[lief.dsc.MappingInfo]( "lief.dsc.MappingInfo") | None] Return a list-like of the [`MappingInfo`]( "lief.dsc.MappingInfo") embedded in this dyld shared cache #### [` platform `]() property platform → [lief.dsc.DyldSharedCache.PLATFORM]( "lief.dsc.DyldSharedCache.PLATFORM") Platform targeted by this cache (e.g. vision-os) #### [` subcaches `]() property subcaches → collections.abc.Sequence[[lief.dsc.SubCache]( "lief.dsc.SubCache") | None] Return a list-like of [`SubCache`]( "lief.dsc.SubCache") embedded in this (main) dyld shared cache #### [` va_to_offset `]() va\_to\_offset(*self*, *virtual\_address: int*) → int | [lief.\_lief.lief\_errors]( "lief._lief.lief_errors") Convert the given virtual address into an offset. > **Warning** > > If the shared cache contains multiple subcaches, this function needs to be called on the targeted subcache. See `cache_for_address()` to find the associated subcache. #### [` version `]() property version → [lief.dsc.DyldSharedCache.VERSION]( "lief.dsc.DyldSharedCache.VERSION") Version of dyld used by this cache ## [Dylib]() ### [` lief.dsc.Dylib `]() class lief.dsc.Dylib Bases: `object` This class represents a library embedded in a dyld shared cache. It mirrors the original `dyld_cache_image_info` structure. #### [` address `]() property address → int In-memory address of the library #### [` extract_opt_t `]() class extract\_opt\_t(*self*) Bases: `object` This structure is used to tweak the extraction process while calling [`lief.dsc.Dylib.get()`]( "lief.dsc.Dylib.get"). These options allow to deoptimize the dylib and get an accurate representation of the original Mach-O binary. ##### [` create_dyld_chained_fixup_cmd `]() property create\_dyld\_chained\_fixup\_cmd → bool Whether the `LC_DYLD_CHAINED_FIXUPS` command should be (re)created. If this value is not set, LIEF will add the command only if it’s meaningful regarding the other options ##### [` fix_branches `]() property fix\_branches → bool Fix call instructions that target addresses outside the current dylib virtual space. > **Warning** > > Enabling this option can have a significant impact on the performances. Make sure to enable the internal cache mechanism: [`lief.dsc.enable_cache()`]( "lief.dsc.enable_cache") or [`lief.dsc.DyldSharedCache.enable_caching()`]( "lief.dsc.DyldSharedCache.enable_caching") ##### [` fix_memory `]() property fix\_memory → bool Fix memory accesses performed outside the dylib’s virtual space > **Warning** > > Enabling this option can have a significant impact on the performances. Make sure to enable the internal cache mechanism: [`lief.dsc.enable_cache()`]( "lief.dsc.enable_cache") or [`lief.dsc.DyldSharedCache.enable_caching()`]( "lief.dsc.DyldSharedCache.enable_caching") ##### [` fix_objc `]() property fix\_objc → bool Fix Objective-C information > **Warning** > > Enabling this option can have a significant impact on the performances. Make sure to enable the internal cache mechanism: [`lief.dsc.enable_cache()`]( "lief.dsc.enable_cache") or [`lief.dsc.DyldSharedCache.enable_caching()`]( "lief.dsc.DyldSharedCache.enable_caching") ##### [` fix_relocations `]() property fix\_relocations → bool Recover and fix relocations > **Warning** > > Enabling this option can have a significant impact on the performances. Make sure to enable the internal cache mechanism: [`lief.dsc.enable_cache()`]( "lief.dsc.enable_cache") or [`lief.dsc.DyldSharedCache.enable_caching()`]( "lief.dsc.DyldSharedCache.enable_caching") ##### [` pack `]() property pack → bool Whether the segment’s offsets should be packed to avoid an in-memory size while writing back the binary. > **Note** > > This option does not have an impact on the performances #### [` get `]() get(*self*, *opt: [lief.\_lief.dsc.Dylib.extract\_opt\_t]( "lief._lief.dsc.Dylib.extract_opt_t") = <lief.\_lief.dsc.Dylib.extract\_opt\_t object at 0x7f13c4460f60>*) → [lief.\_lief.MachO.Binary]( "lief._lief.MachO.Binary") | None Get a [`lief.MachO.Binary`]( "lief.MachO.Binary") representation for this Dylib. One can use this function to write back the Mach-O binary on the disk: ```python dyld_cache: lief.dsc.DyldSharedCache = ... dyld_cache.libraries[10].get().write("libsystem.dylib") ``` #### [` inode `]() property inode → int File serial number matching `stat.st_ino` or 0 Note that for shared cache targeting iOS, this value can hold a hash of the path (if modtime is set to 0) #### [` modtime `]() property modtime → int Modification time of the library matching `stat.st_mtime`, or 0 #### [` padding `]() property padding → int Padding alignment value (should be 0) #### [` path `]() property path → str Original path of the library (e.g. `/usr/lib/libcryptex.dylib`) ## [MappingInfo]() ### [` lief.dsc.MappingInfo `]() class lief.dsc.MappingInfo Bases: `object` This class represents a `dyld_cache_mapping_info` entry. It provides information about the relationship between on-disk shared cache and in-memory shared cache. #### [` address `]() property address → int The in-memory address where this dyld shared cache region is mapped #### [` end_address `]() property end\_address → int End virtual address of the region #### [` file_offset `]() property file\_offset → int On-disk file offset #### [` init_prot `]() property init\_prot → int Initial memory protection #### [` max_prot `]() property max\_prot → int Max memory protection #### [` size `]() property size → int Size of the region being mapped ## [SubCache]() ### [` lief.dsc.SubCache `]() class lief.dsc.SubCache Bases: `object` This class represents a subcache in the case of large/split dyld shared cache. It mirror (and abstracts) the original `dyld_subcache_entry` / `dyld_subcache_entry_v1` #### [` cache `]() property cache → [lief.dsc.DyldSharedCache]( "lief.dsc.DyldSharedCache") | None The associated [`DyldSharedCache`]( "lief.dsc.DyldSharedCache") object for this subcache #### [` suffix `]() property suffix → str The file name suffix of the subCache file (e.g. `.25.data`, `.03.development`) #### [` uuid `]() property uuid → list[int] The uuid of the subcache file #### [` vm_offset `]() property vm\_offset → int The offset of this subcache from the main cache base address ## [Utilities]() ### [` lief.is_shared_cache `]() lief.is\_shared\_cache(*file: str | os.PathLike*) → bool Check if the given file is a dyld shared cache --- documentID: "9af2475628e60fd16392811f30e9da364307572c880fe69bdc8750a25cd4e501" docname: "extended/dsc/rust" title: "Dyld Shared Cache Rust API - LIEF Documentation" description: "Dyld Shared Cache Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/extended/dsc/rust.html" markdownURL: "https://lief.re/doc/latest/extended/dsc/rust.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "727e584e83baf1de4e837f0a5265c91a82c8fc238d9d66fbef2379cbc76abcfe" --- # [Rust]() > **Note** > > Please check: [`lief::dsc`]() --- documentID: "97df546bf02b908886d651fe6e934050dbee923b4228827a1a017f2af1b18117" docname: "extended/dwarf/cpp" title: "DWARF C++ API - LIEF Documentation" description: "DWARF C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/extended/dwarf/cpp.html" markdownURL: "https://lief.re/doc/latest/extended/dwarf/cpp.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "c2c73cbab50486b66d0114509bee2fab89d21a848b51a755fedc6efc50eb6bdf" --- # [C++]() > **Note** > > You can also find the Doxygen documentation here: [here]() ## [` LIEF::dwarf::load `]() inline std::unique\_ptr<[DebugInfo]( "LIEF::dwarf::DebugInfo")> LIEF::dwarf::load(const std::string &dwarf\_path) Load DWARF file from the given path. ## [DebugInfo]() ### [` DebugInfo `]() class DebugInfo : public LIEF::[DebugInfo]( "LIEF::DebugInfo") This class represents a DWARF debug information. It can embed different compilation units which can be accessed through [compilation\_units()]() . This class can be instantiated from [LIEF::Binary::debug\_info()]() or [load()]() Public Types #### [` compilation_units_it `]() using compilation\_units\_it = [iterator\_range]( "LIEF::iterator_range")<[CompilationUnit]( "LIEF::dwarf::CompilationUnit")::[Iterator]( "LIEF::dwarf::CompilationUnit::Iterator")> Iterator over the [CompilationUnit](). Public Functions #### [` find_function `]() std::unique\_ptr<[Function]( "LIEF::dwarf::Function")> find\_function(const std::string &name) const Try to find the function with the given name (mangled or not). ```cpp const DebugInfo& info = ...; if (auto func = info.find_function("_ZNSt6localeD1Ev")) { // Found } if (auto func = info.find_function("std::locale::~locale()")) { // Found } ``` #### [` find_function `]() std::unique\_ptr<[Function]( "LIEF::dwarf::Function")> find\_function(uint64\_t addr) const Try to find the function at the given **virtual** address. #### [` find_variable `]() std::unique\_ptr<[Variable]( "LIEF::dwarf::Variable")> find\_variable(const std::string &name) const Try to find the variable with the given name. This name can be mangled or not. #### [` find_variable `]() std::unique\_ptr<[Variable]( "LIEF::dwarf::Variable")> find\_variable(uint64\_t addr) const Try to find the variable at the given **virtual** address. #### [` find_type `]() std::unique\_ptr<[Type]( "LIEF::dwarf::Type")> find\_type(const std::string &name) const Try to find the type with the given name. #### [` compilation_units `]() [compilation\_units\_it]( "LIEF::dwarf::DebugInfo::compilation_units_it") compilation\_units() const Iterator on the [CompilationUnit]() embedded in this dwarf. #### [` find_function_address `]() virtual std::optional<uint64\_t> find\_function\_address(const std::string &name) const override Attempt to resolve the address of the function specified by `name`. #### [` format `]() inline virtual FORMAT format() const override #### [` ~DebugInfo `]() virtual ~DebugInfo() override = default #### [` DebugInfo `]() DebugInfo(std::unique\_ptr<details::DebugInfo> impl) Public Static Functions #### [` from_file `]() static std::unique\_ptr<[DebugInfo]( "LIEF::dwarf::DebugInfo")> from\_file(const std::string &path) #### [` classof `]() static inline bool classof(const LIEF::[DebugInfo]( "LIEF::DebugInfo") \*info) --- ## [CompilationUnit]() ### [` CompilationUnit `]() class CompilationUnit This class represents a DWARF compilation unit. Public Types #### [` functions_it `]() using functions\_it = [iterator\_range]( "LIEF::iterator_range")<[Function]( "LIEF::dwarf::Function")::[Iterator]( "LIEF::dwarf::Function::Iterator")> [Iterator]() over the [dwarf::Function](). #### [` types_it `]() using types\_it = [iterator\_range]( "LIEF::iterator_range")<[Type]( "LIEF::dwarf::Type")::[Iterator]( "LIEF::dwarf::Type::Iterator")> [Iterator]() over the [dwarf::Type](). #### [` vars_it `]() using vars\_it = [iterator\_range]( "LIEF::iterator_range")<[Variable]( "LIEF::dwarf::Variable")::[Iterator]( "LIEF::dwarf::Variable::Iterator")> [Iterator]() over the [CompilationUnit]()’s variables. Public Functions #### [` CompilationUnit `]() CompilationUnit(std::unique\_ptr<details::CompilationUnit> impl) #### [` ~CompilationUnit `]() ~CompilationUnit() #### [` name `]() std::string name() const Name of the file associated with this compilation unit (e.g. `test.cpp`) Return an **empty** string if the name is not found or can’t be resolved. This value matches the `DW_AT_name` attribute #### [` producer `]() std::string producer() const Information about the program (or library) that generated this compilation unit. For instance, it can output: `Debian clang version 17.0.6`. It returns an **empty** string if the producer is not present or can’t be resolved This value matches the `DW_AT_producer` attribute #### [` compilation_dir `]() std::string compilation\_dir() const Return the path to the directory in which the compilation took place for compiling this compilation unit (e.g. `/workdir/build`). It returns an **empty** string if the entry is not present or can’t be resolved This value matches the `DW_AT_comp_dir` attribute #### [` language `]() [Language]( "LIEF::dwarf::CompilationUnit::Language") language() const Original language of this compilation unit. This value matches the `DW_AT_language` attribute. #### [` low_address `]() uint64\_t low\_address() const Return the lowest virtual address owned by this compilation unit. #### [` high_address `]() uint64\_t high\_address() const Return the highest virtual address owned by this compilation unit. #### [` size `]() uint64\_t size() const Return the size of the compilation unit according to its range of address. If the compilation is fragmented (i.e. there are some address ranges between the lowest address and the highest that are not owned by the CU), then it returns the sum of **all** the address ranges owned by this CU. If the compilation unit is **not** fragmented, then it basically returns `high_address - low_address`. #### [` ranges `]() std::vector<range\_t> ranges() const Return a list of address ranges owned by this compilation unit. If the compilation unit owns a contiguous range, it should return **a single** range. #### [` find_function `]() std::unique\_ptr<[Function]( "LIEF::dwarf::Function")> find\_function(const std::string &name) const Try to find the function whose name is given in parameter. The provided name can be demangled #### [` find_function `]() std::unique\_ptr<[Function]( "LIEF::dwarf::Function")> find\_function(uint64\_t addr) const Try to find the function at the given address. #### [` find_variable `]() std::unique\_ptr<[Variable]( "LIEF::dwarf::Variable")> find\_variable(uint64\_t addr) const Try to find the [Variable]() at the given address. #### [` find_variable `]() std::unique\_ptr<[Variable]( "LIEF::dwarf::Variable")> find\_variable(const std::string &name) const Try to find the [Variable]() with the given name. #### [` functions `]() [functions\_it]( "LIEF::dwarf::CompilationUnit::functions_it") functions() const Return an iterator over the functions implemented in this compilation unit. Note that this iterator only iterates over the functions that have a **concrete** implementation in the compilation unit. For instance with this code: ```cpp inline const char* get_secret_env() { return getenv("MY_SECRET_ENV"); } int main() { printf("%s", get_secret_env()); return 0; } ``` The iterator will only return **one function** for `main` since `get_secret_env` is inlined and thus, its implementation is located in `main`. #### [` imported_functions `]() [functions\_it]( "LIEF::dwarf::CompilationUnit::functions_it") imported\_functions() const Return an iterator over the functions **imported** in this compilation unit **but not** implemented. For instance with this code: ```cpp #include int main() { printf("Hello\n"); return 0; } ``` `printf` is imported from the standard libc so the function is returned by the iterator. On the other hand, `main()` is implemented in this compilation unit so it is not returned by imported\_function() but [functions()](). #### [` types `]() [types\_it]( "LIEF::dwarf::CompilationUnit::types_it") types() const Return an iterator over the different types defined in this compilation unit. #### [` variables `]() [vars\_it]( "LIEF::dwarf::CompilationUnit::vars_it") variables() const Return an iterator over all the variables defined in this compilation unit: ```cpp static int A = 1; // Returned by the iterator static const char* B = "Hello"; // Returned by the iterator int get() { static int C = 2; // Returned by the iterator return C; } ``` #### [` to_decl `]() std::string to\_decl(const [DeclOpt]( "LIEF::DeclOpt") &opt = [DeclOpt]( "LIEF::DeclOpt")()) const Generate a C/C++ definition for the functions defined in this compilation unit. #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::dwarf::CompilationUnit::Iterator"), std::bidirectional\_iterator\_tag, [CompilationUnit]( "LIEF::dwarf::CompilationUnit"), std::ptrdiff\_t, const [CompilationUnit]( "LIEF::dwarf::CompilationUnit")\*, const [CompilationUnit]( "LIEF::dwarf::CompilationUnit")&> Public Types ##### [` implementation `]() using implementation = details::CompilationUnitIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::CompilationUnitIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::dwarf::CompilationUnit::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::dwarf::CompilationUnit::Iterator") &operator=(const [Iterator]( "LIEF::dwarf::CompilationUnit::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::dwarf::CompilationUnit::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::dwarf::CompilationUnit::Iterator") &operator=([Iterator]( "LIEF::dwarf::CompilationUnit::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::dwarf::CompilationUnit::Iterator") &operator++() ##### [` operator-- `]() [Iterator]( "LIEF::dwarf::CompilationUnit::Iterator") &operator--() ##### [` operator* `]() const [CompilationUnit]( "LIEF::dwarf::CompilationUnit") &operator\*() const ##### [` operator-> `]() const [CompilationUnit]( "LIEF::dwarf::CompilationUnit") \*operator->() const ##### [` yield `]() std::unique\_ptr<[CompilationUnit]( "LIEF::dwarf::CompilationUnit")> yield() Transfer ownership of the compilation unit at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) ##### [` operator-- `]() inline DerivedT operator--(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::dwarf::CompilationUnit::Iterator") &LHS, const [Iterator]( "LIEF::dwarf::CompilationUnit::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::dwarf::CompilationUnit::Iterator") &LHS, const [Iterator]( "LIEF::dwarf::CompilationUnit::Iterator") &RHS) #### [` Language `]() class Language Languages supported by the DWARF (v5) format. See: [https://dwarfstd.org/languages.html](). Some languages (like C++11, C++17, ..) have a version (11, 17, …) which is stored in a dedicated attribute: [version]() Public Types ##### [` LANG `]() enum LANG *Values:* ###### [` UNKNOWN `]() enumerator UNKNOWN = 0 ###### [` C `]() enumerator C ###### [` CPP `]() enumerator CPP ###### [` RUST `]() enumerator RUST ###### [` DART `]() enumerator DART ###### [` MODULA `]() enumerator MODULA ###### [` FORTRAN `]() enumerator FORTRAN ###### [` SWIFT `]() enumerator SWIFT ###### [` D `]() enumerator D ###### [` JAVA `]() enumerator JAVA ###### [` COBOL `]() enumerator COBOL Public Functions ##### [` Language `]() Language() = default ##### [` Language `]() inline Language([LANG]( "LIEF::dwarf::CompilationUnit::Language::LANG") lang, uint32\_t version) ##### [` Language `]() inline Language([LANG]( "LIEF::dwarf::CompilationUnit::Language::LANG") lang) ##### [` Language `]() Language(const [Language]( "LIEF::dwarf::CompilationUnit::Language::Language")&) = default ##### [` operator= `]() [Language]( "LIEF::dwarf::CompilationUnit::Language") &operator=(const [Language]( "LIEF::dwarf::CompilationUnit::Language")&) = default ##### [` Language `]() Language([Language]( "LIEF::dwarf::CompilationUnit::Language::Language")&&) = default ##### [` operator= `]() [Language]( "LIEF::dwarf::CompilationUnit::Language") &operator=([Language]( "LIEF::dwarf::CompilationUnit::Language")&&) = default ##### [` ~Language `]() ~Language() = default Public Members ##### [` lang `]() [LANG]( "LIEF::dwarf::CompilationUnit::Language::LANG") lang = [UNKNOWN]( "LIEF::dwarf::CompilationUnit::Language::UNKNOWN") The language itself. ##### [` version `]() uint32\_t version = 0 Version of the language (e.g. 17 for C++17). --- ## [Function]() ### [` Function `]() class Function This class represents a DWARF function which can be associated with either: `DW_TAG_subprogram` or `DW_TAG_inlined_subroutine`. Public Types #### [` vars_it `]() using vars\_it = [iterator\_range]( "LIEF::iterator_range")<[Variable]( "LIEF::dwarf::Variable")::[Iterator]( "LIEF::dwarf::Variable::Iterator")> [Iterator]() over the variables defined in the scope of this function. #### [` parameters_t `]() using parameters\_t = std::vector<std::unique\_ptr<[Parameter]( "LIEF::dwarf::Parameter")>> #### [` thrown_types_t `]() using thrown\_types\_t = std::vector<std::unique\_ptr<[Type]( "LIEF::dwarf::Type")>> #### [` lexical_blocks_it `]() using lexical\_blocks\_it = [iterator\_range]( "LIEF::iterator_range")<[LexicalBlock]( "LIEF::dwarf::LexicalBlock")::[Iterator]( "LIEF::dwarf::LexicalBlock::Iterator")> #### [` instructions_it `]() using instructions\_it = [iterator\_range]( "LIEF::iterator_range")<assembly::[Instruction]( "LIEF::assembly::Instruction")::[Iterator]( "LIEF::assembly::Instruction::Iterator")> Public Functions #### [` Function `]() Function(std::unique\_ptr<details::Function> impl) #### [` name `]() std::string name() const The name of the function (`DW_AT_name`). #### [` linkage_name `]() std::string linkage\_name() const The name of the function which is used for linking (`DW_AT_linkage_name`). This name differs from [name()]() as it is usually mangled. The function returns an empty string if the linkage name is not available. #### [` address `]() [result]( "LIEF::result")<uint64\_t> address() const Return the address of the function (`DW_AT_entry_pc` or `DW_AT_low_pc`). #### [` variables `]() [vars\_it]( "LIEF::dwarf::Function::vars_it") variables() const Return an iterator of variables (`DW_TAG_variable`) defined within the scope of this function. This includes regular stack-based variables as well as static ones. #### [` is_artificial `]() bool is\_artificial() const Whether this function is created by the compiler and not present in the original source code. #### [` is_external `]() bool is\_external() const Whether the function is defined **outside** the current compilation unit (`DW_AT_external`). #### [` size `]() uint64\_t size() const Return the size taken by this function in the binary. #### [` ranges `]() std::vector<range\_t> ranges() const Ranges of virtual addresses owned by this function. #### [` debug_location `]() [debug\_location\_t]( "LIEF::debug_location_t") debug\_location() const Original source code location. #### [` type `]() std::unique\_ptr<[Type]( "LIEF::dwarf::Type")> type() const Return the [dwarf::Type]() associated with the **return type** of this function. #### [` parameters `]() [parameters\_t]( "LIEF::dwarf::Function::parameters_t") parameters() const Return the function’s parameters (including any template parameter). #### [` thrown_types `]() [thrown\_types\_t]( "LIEF::dwarf::Function::thrown_types_t") thrown\_types() const List of exceptions (types) that can be thrown by the function. For instance, given this Swift code: ```swift func summarize(_ ratings: [Int]) throws(StatisticsError) { // ... } ``` [thrown\_types()]() returns one element associated with the [Type](): `StatisticsError`. #### [` scope `]() std::unique\_ptr<[Scope]( "LIEF::dwarf::Scope")> scope() const Return the scope in which this function is defined. #### [` instructions `]() [instructions\_it]( "LIEF::dwarf::Function::instructions_it") instructions() const Disassemble the current function by returning an iterator over the [assembly::Instruction](). #### [` lexical_blocks `]() [lexical\_blocks\_it]( "LIEF::dwarf::Function::lexical_blocks_it") lexical\_blocks() const [Iterator]() over the [LexicalBlock]() owned by this function. #### [` description `]() std::string description() const Description (`DW_AT_description`) of this function or an empty string. #### [` to_decl `]() std::string to\_decl(const [DeclOpt]( "LIEF::DeclOpt") &opt = [DeclOpt]( "LIEF::DeclOpt")()) const Generates a C/C++ definition for this function. #### [` ~Function `]() ~Function() #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::dwarf::Function::Iterator"), std::bidirectional\_iterator\_tag, [Function]( "LIEF::dwarf::Function"), std::ptrdiff\_t, const [Function]( "LIEF::dwarf::Function")\*, const [Function]( "LIEF::dwarf::Function")&> Public Types ##### [` implementation `]() using implementation = details::FunctionIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::FunctionIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::dwarf::Function::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::dwarf::Function::Iterator") &operator=(const [Iterator]( "LIEF::dwarf::Function::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::dwarf::Function::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::dwarf::Function::Iterator") &operator=([Iterator]( "LIEF::dwarf::Function::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::dwarf::Function::Iterator") &operator++() ##### [` operator-- `]() [Iterator]( "LIEF::dwarf::Function::Iterator") &operator--() ##### [` operator* `]() const [Function]( "LIEF::dwarf::Function") &operator\*() const ##### [` operator-> `]() const [Function]( "LIEF::dwarf::Function") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Function]( "LIEF::dwarf::Function")> yield() Transfer ownership of the function at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) ##### [` operator-- `]() inline DerivedT operator--(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::dwarf::Function::Iterator") &LHS, const [Iterator]( "LIEF::dwarf::Function::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::dwarf::Function::Iterator") &LHS, const [Iterator]( "LIEF::dwarf::Function::Iterator") &RHS) --- ## [Parameter]() ### [` Parameter `]() class Parameter This class represents a DWARF parameter which can be either: - A regular function parameter (see: [parameters::Formal]()) - A template type parameter (see: [parameters::TemplateType]()) - A template value parameter (see: [parameters::TemplateValue]()) Subclassed by [LIEF::dwarf::parameters::Formal](), [LIEF::dwarf::parameters::TemplateType](), [LIEF::dwarf::parameters::TemplateValue]() Public Types #### [` KIND `]() enum class KIND *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` TEMPLATE_TYPE `]() enumerator TEMPLATE\_TYPE DW\_TAG\_template\_type\_parameter. ##### [` TEMPLATE_VALUE `]() enumerator TEMPLATE\_VALUE DW\_TAG\_template\_value\_parameter. ##### [` FORMAL `]() enumerator FORMAL DW\_TAG\_formal\_parameter. Public Functions #### [` Parameter `]() Parameter() = delete #### [` Parameter `]() Parameter([Parameter]( "LIEF::dwarf::Parameter::Parameter") &&other) noexcept #### [` operator= `]() [Parameter]( "LIEF::dwarf::Parameter") &operator=([Parameter]( "LIEF::dwarf::Parameter") &&other) noexcept #### [` operator= `]() [Parameter]( "LIEF::dwarf::Parameter") &operator=(const [Parameter]( "LIEF::dwarf::Parameter")&) = delete #### [` Parameter `]() Parameter(const [Parameter]( "LIEF::dwarf::Parameter::Parameter")&) = delete #### [` kind `]() [KIND]( "LIEF::dwarf::Parameter::KIND") kind() const #### [` name `]() std::string name() const Name of the parameter. #### [` type `]() std::unique\_ptr<[Type]( "LIEF::dwarf::Type")> type() const [Type]() of this parameter. #### [` location `]() std::unique\_ptr<[Location]( "LIEF::dwarf::Parameter::Location")> location() const [Location]() of this parameter. For instance it can be a specific register that is not following the calling convention. #### [` Tas `]() template<class T> inline const [T]( "LIEF::dwarf::Parameter::as::T") \*as() const #### [` ~Parameter `]() virtual ~Parameter() Public Static Functions #### [` create `]() static std::unique\_ptr<[Parameter]( "LIEF::dwarf::Parameter")> create(std::unique\_ptr<details::Parameter> impl) #### [` Location `]() class Location This class exposes information about the location of a parameter. Subclassed by [LIEF::dwarf::Parameter::RegisterLoc]() Public Types ##### [` Type `]() enum class Type : uint8\_t *Values:* ###### [` UNKNOWN `]() enumerator UNKNOWN = 0 ###### [` REG `]() enumerator REG Public Functions ##### [` Location `]() inline Location([Type]( "LIEF::dwarf::Parameter::Location::Type") ty) ##### [` Tas `]() template<class T> inline const [T]( "LIEF::dwarf::Parameter::Location::as::T") \*as() const Public Members ##### [` type `]() [Type]( "LIEF::dwarf::Parameter::Location::Type") type = [Type]( "LIEF::dwarf::Parameter::Location::Type")::[UNKNOWN]( "LIEF::dwarf::Parameter::Location::Type::UNKNOWN") #### [` RegisterLoc `]() class RegisterLoc : public LIEF::dwarf::[Parameter]( "LIEF::dwarf::Parameter")::[Location]( "LIEF::dwarf::Parameter::Location") This class represents a register location. Public Functions ##### [` RegisterLoc `]() inline RegisterLoc(uint64\_t reg\_id) Public Members ##### [` id `]() uint64\_t id = 0 DWARF id of the register. Public Static Functions ##### [` classof `]() static inline bool classof(const [Location]( "LIEF::dwarf::Parameter::Location") \*loc) --- ## [Formal Parameter]() ### [` Formal `]() class Formal : public LIEF::dwarf::[Parameter]( "LIEF::dwarf::Parameter") This class represents a regular function parameter. For instance, given this prototype: ```cpp int main(int argc, const char** argv); ``` The function `main` has two [parameters::Formal]() parameters: 1. `argc` ([Parameter::name]()) typed as `int` ([types::Base]() from [Parameter::type]()) 2. `argv` ([Parameter::name]()) typed as `const char**` ([types::Const]() from [Parameter::type]()) Public Functions #### [` ~Formal `]() ~Formal() override = default #### [` Parameter `]() Parameter() = delete #### [` Parameter `]() Parameter([Parameter]( "LIEF::dwarf::parameters::Formal::Parameter") &&other) noexcept #### [` Parameter `]() Parameter(const [Parameter]( "LIEF::dwarf::parameters::Formal::Parameter")&) = delete Public Static Functions #### [` classof `]() static inline bool classof(const [Parameter]( "LIEF::dwarf::parameters::Formal::Parameter") \*P) --- ## [Template Value Parameter]() ### [` TemplateValue `]() class TemplateValue : public LIEF::dwarf::[Parameter]( "LIEF::dwarf::Parameter") This class represents a template **value** parameter. For instance, given this prototype: ```cpp template void generic(); ``` The function `generic` has one [parameters::TemplateValue]() parameter: `X`. Public Functions #### [` ~TemplateValue `]() ~TemplateValue() override = default #### [` Parameter `]() Parameter() = delete #### [` Parameter `]() Parameter([Parameter]( "LIEF::dwarf::parameters::TemplateValue::Parameter") &&other) noexcept #### [` Parameter `]() Parameter(const [Parameter]( "LIEF::dwarf::parameters::TemplateValue::Parameter")&) = delete Public Static Functions #### [` classof `]() static inline bool classof(const [Parameter]( "LIEF::dwarf::parameters::TemplateValue::Parameter") \*P) --- ## [Template Type Parameter]() ### [` TemplateType `]() class TemplateType : public LIEF::dwarf::[Parameter]( "LIEF::dwarf::Parameter") This class represents a template **type** parameter. For instance, given this prototype: ```cpp template void generic(); ``` The function `generic` has one [parameters::TemplateType]() parameter: `Y`. Public Functions #### [` ~TemplateType `]() ~TemplateType() override = default #### [` Parameter `]() Parameter() = delete #### [` Parameter `]() Parameter([Parameter]( "LIEF::dwarf::parameters::TemplateType::Parameter") &&other) noexcept #### [` Parameter `]() Parameter(const [Parameter]( "LIEF::dwarf::parameters::TemplateType::Parameter")&) = delete Public Static Functions #### [` classof `]() static inline bool classof(const [Parameter]( "LIEF::dwarf::parameters::TemplateType::Parameter") \*P) --- ## [Scope]() ### [` Scope `]() class Scope This class materializes a scope in which [Function](), [Variable](), [Type](), … can be defined. Public Types #### [` TYPE `]() enum class TYPE : uint32\_t *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` UNION `]() enumerator UNION ##### [` CLASS `]() enumerator CLASS ##### [` STRUCT `]() enumerator STRUCT ##### [` NAMESPACE `]() enumerator NAMESPACE ##### [` FUNCTION `]() enumerator FUNCTION ##### [` COMPILATION_UNIT `]() enumerator COMPILATION\_UNIT Public Functions #### [` Scope `]() Scope(std::unique\_ptr<details::Scope> impl) #### [` name `]() std::string name() const Name of the scope. For instance namespace’s name or function’s name. #### [` parent `]() std::unique\_ptr<[Scope]( "LIEF::dwarf::Scope")> parent() const Parent scope (if any). #### [` type `]() [TYPE]( "LIEF::dwarf::Scope::TYPE") type() const The current scope type. #### [` chained `]() std::string chained(const std::string &sep = "::") const Represent the whole chain of all (parent) scopes using the provided separator. E.g. `ns1::ns2::Class1::Struct2::Type`. #### [` ~Scope `]() ~Scope() --- ## [Variable]() ### [` Variable `]() class Variable This class represents a DWARF variable which can be owned by a [dwarf::Function]() or a [dwarf::CompilationUnit](). Public Functions #### [` Variable `]() Variable(std::unique\_ptr<details::Variable> impl) #### [` name `]() std::string name() const Name of the variable (usually demangled). #### [` linkage_name `]() std::string linkage\_name() const The name of the variable which is used for linking (`DW_AT_linkage_name`). This name differs from [name()]() as it is usually mangled. The function returns an empty string if the linkage name is not available. #### [` address `]() [result]( "LIEF::result")<int64\_t> address() const Address of the variable. If the variable is **static**, it returns the **virtual address** where it is defined. If the variable is stack-based, it returns the **relative offset** from the frame based register. If the address can’t be resolved, it returns a [lief\_errors](). #### [` size `]() [result]( "LIEF::result")<uint64\_t> size() const Return the size of the variable (or a [lief\_errors]() if it can’t be resolved). This size is defined by its type. #### [` is_constexpr `]() bool is\_constexpr() const Whether it’s a `constexpr` variable. #### [` is_stack_based `]() bool is\_stack\_based() const Whether this variable is allocated on the stack. #### [` debug_location `]() [debug\_location\_t]( "LIEF::debug_location_t") debug\_location() const The original source location where the variable is defined. #### [` type `]() std::unique\_ptr<[Type]( "LIEF::dwarf::Type")> type() const Return the type of this variable. #### [` scope `]() std::unique\_ptr<[Scope]( "LIEF::dwarf::Scope")> scope() const Return the scope in which this variable is defined. #### [` description `]() std::string description() const Description (`DW_AT_description`) of the variable or an empty string. #### [` to_decl `]() std::string to\_decl(const [DeclOpt]( "LIEF::DeclOpt") &opt = [DeclOpt]( "LIEF::DeclOpt")()) const Generates a C/C++ definition for this variable. #### [` ~Variable `]() ~Variable() #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::dwarf::Variable::Iterator"), std::bidirectional\_iterator\_tag, [Variable]( "LIEF::dwarf::Variable"), std::ptrdiff\_t, const [Variable]( "LIEF::dwarf::Variable")\*, const [Variable]( "LIEF::dwarf::Variable")&> Public Types ##### [` implementation `]() using implementation = details::VariableIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::VariableIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::dwarf::Variable::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::dwarf::Variable::Iterator") &operator=(const [Iterator]( "LIEF::dwarf::Variable::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::dwarf::Variable::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::dwarf::Variable::Iterator") &operator=([Iterator]( "LIEF::dwarf::Variable::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::dwarf::Variable::Iterator") &operator++() ##### [` operator-- `]() [Iterator]( "LIEF::dwarf::Variable::Iterator") &operator--() ##### [` operator* `]() const [Variable]( "LIEF::dwarf::Variable") &operator\*() const ##### [` operator-> `]() const [Variable]( "LIEF::dwarf::Variable") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Variable]( "LIEF::dwarf::Variable")> yield() Transfer ownership of the variable at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) ##### [` operator-- `]() inline DerivedT operator--(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::dwarf::Variable::Iterator") &LHS, const [Iterator]( "LIEF::dwarf::Variable::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::dwarf::Variable::Iterator") &LHS, const [Iterator]( "LIEF::dwarf::Variable::Iterator") &RHS) --- ## [LexicalBlock]() ### [` LexicalBlock `]() class LexicalBlock This class represents a DWARF lexical block (`DW_TAG_lexical_block`). Public Types #### [` sub_blocks_it `]() using sub\_blocks\_it = [iterator\_range]( "LIEF::iterator_range")<[Iterator]( "LIEF::dwarf::LexicalBlock::Iterator")> Public Functions #### [` LexicalBlock `]() LexicalBlock(std::unique\_ptr<details::LexicalBlock> impl) #### [` LexicalBlock `]() LexicalBlock() = delete #### [` operator= `]() [LexicalBlock]( "LIEF::dwarf::LexicalBlock") &operator=(const [LexicalBlock]( "LIEF::dwarf::LexicalBlock")&) = delete #### [` LexicalBlock `]() LexicalBlock(const [LexicalBlock]( "LIEF::dwarf::LexicalBlock::LexicalBlock")&) = delete #### [` name `]() std::string name() const Return the *name* associated with this lexical block or an empty string. #### [` description `]() std::string description() const Return the description associated with this lexical block or an empty string. #### [` sub_blocks `]() [sub\_blocks\_it]( "LIEF::dwarf::LexicalBlock::sub_blocks_it") sub\_blocks() const Return an iterator over the sub-LexicalBlock owned by this block. #### [` addr `]() std::optional<uint64\_t> addr() const Return the start address of this block. #### [` size `]() uint64\_t size() const Return the size of this block as the difference of the highest address and the lowest address. #### [` low_pc `]() std::optional<uint64\_t> low\_pc() const Return the lowest virtual address owned by this block. #### [` high_pc `]() std::optional<uint64\_t> high\_pc() const Return the highest virtual address owned by this block. #### [` ranges `]() std::vector<range\_t> ranges() const Return a list of address ranges owned by this block. If the lexical block owns a contiguous range, it should return **a single** range. #### [` ~LexicalBlock `]() ~LexicalBlock() Public Static Functions #### [` create `]() static std::unique\_ptr<[LexicalBlock]( "LIEF::dwarf::LexicalBlock")> create(std::unique\_ptr<details::LexicalBlock> impl) #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::dwarf::LexicalBlock::Iterator"), std::bidirectional\_iterator\_tag, [LexicalBlock]( "LIEF::dwarf::LexicalBlock"), std::ptrdiff\_t, const [LexicalBlock]( "LIEF::dwarf::LexicalBlock")\*, const [LexicalBlock]( "LIEF::dwarf::LexicalBlock")&> Public Types ##### [` implementation `]() using implementation = details::LexicalBlockIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::LexicalBlockIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::dwarf::LexicalBlock::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::dwarf::LexicalBlock::Iterator") &operator=(const [Iterator]( "LIEF::dwarf::LexicalBlock::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::dwarf::LexicalBlock::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::dwarf::LexicalBlock::Iterator") &operator=([Iterator]( "LIEF::dwarf::LexicalBlock::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::dwarf::LexicalBlock::Iterator") &operator++() ##### [` operator-- `]() [Iterator]( "LIEF::dwarf::LexicalBlock::Iterator") &operator--() ##### [` operator* `]() const [LexicalBlock]( "LIEF::dwarf::LexicalBlock") &operator\*() const ##### [` operator-> `]() const [LexicalBlock]( "LIEF::dwarf::LexicalBlock") \*operator->() const ##### [` yield `]() std::unique\_ptr<[LexicalBlock]( "LIEF::dwarf::LexicalBlock")> yield() Transfer ownership of the lexical block at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) ##### [` operator-- `]() inline DerivedT operator--(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::dwarf::LexicalBlock::Iterator") &LHS, const [Iterator]( "LIEF::dwarf::LexicalBlock::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::dwarf::LexicalBlock::Iterator") &LHS, const [Iterator]( "LIEF::dwarf::LexicalBlock::Iterator") &RHS) --- ## [Type]() ### [` Type `]() class Type This class represents a DWARF [Type]() which includes: - `DW_TAG_array_type` - `DW_TAG_atomic_type` - `DW_TAG_base_type` - `DW_TAG_class_type` - `DW_TAG_coarray_type` - `DW_TAG_const_type` - `DW_TAG_dynamic_type` - `DW_TAG_enumeration_type` - `DW_TAG_file_type` - `DW_TAG_immutable_type` - `DW_TAG_interface_type` - `DW_TAG_packed_type` - `DW_TAG_pointer_type` - `DW_TAG_ptr_to_member_type` - `DW_TAG_reference_type` - `DW_TAG_restrict_type` - `DW_TAG_rvalue_reference_type` - `DW_TAG_set_type` - `DW_TAG_shared_type` - `DW_TAG_string_type` - `DW_TAG_structure_type` - `DW_TAG_subroutine_type` - `DW_TAG_template_alias` - `DW_TAG_thrown_type` - `DW_TAG_typedef` - `DW_TAG_union_type` - `DW_TAG_unspecified_type` - `DW_TAG_volatile_type` Subclassed by [LIEF::dwarf::types::Array](), [LIEF::dwarf::types::Atomic](), [LIEF::dwarf::types::Base](), [LIEF::dwarf::types::ClassLike](), [LIEF::dwarf::types::Coarray](), [LIEF::dwarf::types::Const](), [LIEF::dwarf::types::Dynamic](), [LIEF::dwarf::types::Enum](), [LIEF::dwarf::types::File](), [LIEF::dwarf::types::Immutable](), [LIEF::dwarf::types::Interface](), [LIEF::dwarf::types::Pointer](), [LIEF::dwarf::types::PointerToMember](), [LIEF::dwarf::types::RValueReference](), [LIEF::dwarf::types::Reference](), [LIEF::dwarf::types::Restrict](), [LIEF::dwarf::types::SetTy](), [LIEF::dwarf::types::Shared](), [LIEF::dwarf::types::StringTy](), [LIEF::dwarf::types::Subroutine](), [LIEF::dwarf::types::TemplateAlias](), [LIEF::dwarf::types::Thrown](), [LIEF::dwarf::types::Typedef](), [LIEF::dwarf::types::Volatile]() Public Types #### [` KIND `]() enum class KIND *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` UNSPECIFIED `]() enumerator UNSPECIFIED ##### [` BASE `]() enumerator BASE ##### [` CONST_KIND `]() enumerator CONST\_KIND ##### [` CLASS `]() enumerator CLASS ##### [` ARRAY `]() enumerator ARRAY ##### [` POINTER `]() enumerator POINTER ##### [` STRUCT `]() enumerator STRUCT ##### [` UNION `]() enumerator UNION ##### [` TYPEDEF `]() enumerator TYPEDEF ##### [` REF `]() enumerator REF ##### [` SET_TYPE `]() enumerator SET\_TYPE ##### [` STRING `]() enumerator STRING ##### [` SUBROUTINE `]() enumerator SUBROUTINE ##### [` POINTER_MEMBER `]() enumerator POINTER\_MEMBER ##### [` PACKED `]() enumerator PACKED ##### [` FILE `]() enumerator FILE ##### [` THROWN `]() enumerator THROWN ##### [` VOLATILE `]() enumerator VOLATILE ##### [` RESTRICT `]() enumerator RESTRICT ##### [` INTERFACE `]() enumerator INTERFACE ##### [` SHARED `]() enumerator SHARED ##### [` RVALREF `]() enumerator RVALREF ##### [` TEMPLATE_ALIAS `]() enumerator TEMPLATE\_ALIAS ##### [` COARRAY `]() enumerator COARRAY ##### [` DYNAMIC `]() enumerator DYNAMIC ##### [` ATOMIC `]() enumerator ATOMIC ##### [` IMMUTABLE `]() enumerator IMMUTABLE ##### [` ENUM `]() enumerator ENUM Public Functions #### [` Type `]() Type(std::unique\_ptr<details::Type> impl) #### [` Type `]() Type(details::Type &impl) #### [` Type `]() Type(const [Type]( "LIEF::dwarf::Type::Type")&) = delete #### [` operator= `]() [Type]( "LIEF::dwarf::Type") &operator=(const [Type]( "LIEF::dwarf::Type")&) = delete #### [` Type `]() Type([Type]( "LIEF::dwarf::Type::Type")&&) noexcept #### [` operator= `]() [Type]( "LIEF::dwarf::Type") &operator=([Type]( "LIEF::dwarf::Type")&&) noexcept #### [` ~Type `]() virtual ~Type() #### [` kind `]() [KIND]( "LIEF::dwarf::Type::KIND") kind() const #### [` is_unspecified `]() inline bool is\_unspecified() const Whether this type is a `DW_TAG_unspecified_type`. #### [` name `]() [result]( "LIEF::result")<std::string> name() const Return the type’s name using either `DW_AT_name` or `DW_AT_picture_string` (if any). #### [` size `]() [result]( "LIEF::result")<uint64\_t> size() const Return the size of the type or an error if it can’t be computed. This size should match the equivalent of `sizeof(Type)`. #### [` location `]() [debug\_location\_t]( "LIEF::debug_location_t") location() const Return the debug location where this type is defined. #### [` scope `]() std::unique\_ptr<[Scope]( "LIEF::dwarf::Scope")> scope() const Return the scope in which this type is defined. #### [` to_decl `]() std::string to\_decl(const [DeclOpt]( "LIEF::DeclOpt") &opt = [DeclOpt]( "LIEF::DeclOpt")()) const Generates a C/C++ definition for this type. #### [` Tas `]() template<class T> inline const [T]( "LIEF::dwarf::Type::as::T") \*as() const Public Static Functions #### [` create `]() static std::unique\_ptr<[Type]( "LIEF::dwarf::Type")> create(std::unique\_ptr<details::Type> impl) #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::dwarf::Type::Iterator"), std::bidirectional\_iterator\_tag, [Type]( "LIEF::dwarf::Type"), std::ptrdiff\_t, const [Type]( "LIEF::dwarf::Type")\*, const [Type]( "LIEF::dwarf::Type")&> Public Types ##### [` implementation `]() using implementation = details::TypeIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::TypeIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::dwarf::Type::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::dwarf::Type::Iterator") &operator=(const [Iterator]( "LIEF::dwarf::Type::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::dwarf::Type::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::dwarf::Type::Iterator") &operator=([Iterator]( "LIEF::dwarf::Type::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::dwarf::Type::Iterator") &operator++() ##### [` operator-- `]() [Iterator]( "LIEF::dwarf::Type::Iterator") &operator--() ##### [` operator* `]() const [Type]( "LIEF::dwarf::Type") &operator\*() const ##### [` operator-> `]() const [Type]( "LIEF::dwarf::Type") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Type]( "LIEF::dwarf::Type")> yield() Transfer ownership of the type at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) ##### [` operator-- `]() inline DerivedT operator--(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::dwarf::Type::Iterator") &LHS, const [Iterator]( "LIEF::dwarf::Type::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::dwarf::Type::Iterator") &LHS, const [Iterator]( "LIEF::dwarf::Type::Iterator") &RHS) --- ## [Array]() ### [` Array `]() class Array : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class represents a `DW_TAG_array_type`. Public Functions #### [` ArgsArray `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::Array::Array::Args")&&...>>> inline Array([Args]( "LIEF::dwarf::types::Array::Array::Args")&&... args) #### [` Array `]() Array(const [Array]( "LIEF::dwarf::types::Array::Array")&) = delete #### [` operator= `]() [Array]( "LIEF::dwarf::types::Array") &operator=(const [Array]( "LIEF::dwarf::types::Array")&) = delete #### [` Array `]() Array([Array]( "LIEF::dwarf::types::Array::Array")&&) noexcept = default #### [` operator= `]() [Array]( "LIEF::dwarf::types::Array") &operator=([Array]( "LIEF::dwarf::types::Array")&&) noexcept = default #### [` underlying_type `]() const [Type]( "LIEF::dwarf::Type") \*underlying\_type() const The underlying type of this array. #### [` operator-> `]() inline const [Type]( "LIEF::dwarf::Type") \*operator->() const #### [` operator* `]() inline const [Type]( "LIEF::dwarf::Type") &operator\*() const #### [` size_info `]() [size\_info\_t]( "LIEF::dwarf::types::Array::size_info_t") size\_info() const Return information about the size of this array. This size info is usually embedded in a `DW_TAG_subrange_type` DIE which is represented by the [size\_info\_t]() structure. #### [` ~Array `]() ~Array() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) #### [` size_info_t `]() struct size\_info\_t [Structure]() that wraps information about the dimension of this array. Public Functions ##### [` operator bool `]() inline operator bool() const Public Members ##### [` type `]() std::unique\_ptr<[Type]( "LIEF::dwarf::Type")> type = nullptr [Type]() of the **index** for this array. For instance in `uint8_t[3]` the index type could be set to a `size_t`. ##### [` name `]() std::string name Name of the index (usually not relevant like `__ARRAY_SIZE_TYPE__`). ##### [` size `]() size\_t size = 0 Size of the array. For instance in `uint8_t[3]`, it returns 3. --- ## [Base]() ### [` Base `]() class Base : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class wraps the `DW_TAG_base_type` type which can be used &#8212; for instance &#8212; to represent integers or primitive types. Public Types #### [` ENCODING `]() enum class ENCODING *Values:* ##### [` NONE `]() enumerator NONE = 0 ##### [` SIGNED `]() enumerator SIGNED Mirror `DW_ATE_signed`. ##### [` SIGNED_CHAR `]() enumerator SIGNED\_CHAR Mirror `DW_ATE_signed_char`. ##### [` UNSIGNED `]() enumerator UNSIGNED Mirror `DW_ATE_unsigned`. ##### [` UNSIGNED_CHAR `]() enumerator UNSIGNED\_CHAR Mirror `DW_ATE_unsigned_char`. ##### [` FLOAT `]() enumerator FLOAT Mirror `DW_ATE_float`. ##### [` BOOLEAN `]() enumerator BOOLEAN Mirror `DW_ATE_boolean`. ##### [` ADDRESS `]() enumerator ADDRESS Mirror `DW_ATE_address`. Public Functions #### [` ArgsBase `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::Base::Base::Args")&&...>>> inline Base([Args]( "LIEF::dwarf::types::Base::Base::Args")&&... args) #### [` Base `]() Base(const [Base]( "LIEF::dwarf::types::Base::Base")&) = delete #### [` operator= `]() [Base]( "LIEF::dwarf::types::Base") &operator=(const [Base]( "LIEF::dwarf::types::Base")&) = delete #### [` Base `]() Base([Base]( "LIEF::dwarf::types::Base::Base")&&) noexcept = default #### [` operator= `]() [Base]( "LIEF::dwarf::types::Base") &operator=([Base]( "LIEF::dwarf::types::Base")&&) noexcept = default #### [` encoding `]() [ENCODING]( "LIEF::dwarf::types::Base::ENCODING") encoding() const Describe how the base type is encoded and should be interpreted. #### [` ~Base `]() ~Base() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [ClassLike]() ### [` ClassLike `]() class ClassLike : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class abstracts a DWARF aggregate: `DW_TAG_structure_type`, `DW_TAG_class_type`, `DW_TAG_union_type`. Subclassed by [LIEF::dwarf::types::Class](), [LIEF::dwarf::types::Packed](), [LIEF::dwarf::types::Structure](), [LIEF::dwarf::types::Union]() Public Types #### [` functions_it `]() using functions\_it = [iterator\_range]( "LIEF::iterator_range")<[Function]( "LIEF::dwarf::Function")::[Iterator]( "LIEF::dwarf::Function::Iterator")> Public Functions #### [` ArgsClassLike `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::ClassLike::ClassLike::Args")&&...>>> inline ClassLike([Args]( "LIEF::dwarf::types::ClassLike::ClassLike::Args")&&... args) #### [` ClassLike `]() ClassLike(const [ClassLike]( "LIEF::dwarf::types::ClassLike::ClassLike")&) = delete #### [` operator= `]() [ClassLike]( "LIEF::dwarf::types::ClassLike") &operator=(const [ClassLike]( "LIEF::dwarf::types::ClassLike")&) = delete #### [` ClassLike `]() ClassLike([ClassLike]( "LIEF::dwarf::types::ClassLike::ClassLike")&&) noexcept = default #### [` operator= `]() [ClassLike]( "LIEF::dwarf::types::ClassLike") &operator=([ClassLike]( "LIEF::dwarf::types::ClassLike")&&) noexcept = default #### [` members `]() std::vector<[Member]( "LIEF::dwarf::types::ClassLike::Member")> members() const Return the list of all the attributes defined in this class-like type. #### [` find_member `]() std::unique\_ptr<[Member]( "LIEF::dwarf::types::ClassLike::Member")> find\_member(uint64\_t offset) const Try to find the attribute at the given offset. #### [` functions `]() [functions\_it]( "LIEF::dwarf::types::ClassLike::functions_it") functions() const [Iterator]() over the functions defined by the class-like. #### [` ~ClassLike `]() ~ClassLike() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) #### [` Member `]() class Member This represents a class/struct/union attribute. Public Functions ##### [` Member `]() Member(std::unique\_ptr<details::Member> impl) ##### [` Member `]() Member([Member]( "LIEF::dwarf::types::ClassLike::Member::Member") &&other) noexcept ##### [` operator= `]() [Member]( "LIEF::dwarf::types::ClassLike::Member") &operator=([Member]( "LIEF::dwarf::types::ClassLike::Member") &&other) noexcept ##### [` Member `]() Member(const [Member]( "LIEF::dwarf::types::ClassLike::Member::Member")&) = delete ##### [` operator= `]() [Member]( "LIEF::dwarf::types::ClassLike::Member") &operator=(const [Member]( "LIEF::dwarf::types::ClassLike::Member")&) = delete ##### [` name `]() std::string name() const Name of the member. ##### [` offset `]() [result]( "LIEF::result")<uint64\_t> offset() const Offset of the current member in the struct/union/class. If the offset can’t be resolved it returns a [lief\_errors]() ##### [` bit_offset `]() [result]( "LIEF::result")<uint64\_t> bit\_offset() const Offset of the current member in **bits** in the struct/union/class. This function differs from [offset()]() for aggregates using bit-field declaration: ```cpp struct S { int flag : 4; int opt : 1 }; ``` Usually, `offset() * 8 == bit_offset()` If the offset can’t be resolved it returns a [lief\_errors]() ##### [` bit_size `]() [result]( "LIEF::result")<uint64\_t> bit\_size() const If the current member is a bit-field, this function returns its size in bits. ##### [` type `]() std::unique\_ptr<[Type]( "LIEF::dwarf::Type")> type() const [Type]() of the current member. ##### [` is_external `]() bool is\_external() const ##### [` is_declaration `]() bool is\_declaration() const ##### [` ~Member `]() ~Member() --- ## [Structure]() ### [` Structure `]() class Structure : public LIEF::dwarf::types::[ClassLike]( "LIEF::dwarf::types::ClassLike") This class represents a DWARF `struct` type (`DW_TAG_structure_type`). Public Functions #### [` ArgsStructure `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[ClassLike]( "LIEF::dwarf::types::ClassLike"), [Args]( "LIEF::dwarf::types::Structure::Structure::Args")&&...>>> inline Structure([Args]( "LIEF::dwarf::types::Structure::Structure::Args")&&... args) #### [` Structure `]() Structure(const [Structure]( "LIEF::dwarf::types::Structure::Structure")&) = delete #### [` operator= `]() [Structure]( "LIEF::dwarf::types::Structure") &operator=(const [Structure]( "LIEF::dwarf::types::Structure")&) = delete #### [` Structure `]() Structure([Structure]( "LIEF::dwarf::types::Structure::Structure")&&) noexcept = default #### [` operator= `]() [Structure]( "LIEF::dwarf::types::Structure") &operator=([Structure]( "LIEF::dwarf::types::Structure")&&) noexcept = default #### [` ~Structure `]() ~Structure() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [Class]() ### [` Class `]() class Class : public LIEF::dwarf::types::[ClassLike]( "LIEF::dwarf::types::ClassLike") This class represents a DWARF `class` type (`DW_TAG_class_type`). Public Functions #### [` ArgsClass `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[ClassLike]( "LIEF::dwarf::types::ClassLike"), [Args]( "LIEF::dwarf::types::Class::Class::Args")&&...>>> inline Class([Args]( "LIEF::dwarf::types::Class::Class::Args")&&... args) #### [` Class `]() Class(const [Class]( "LIEF::dwarf::types::Class::Class")&) = delete #### [` operator= `]() [Class]( "LIEF::dwarf::types::Class") &operator=(const [Class]( "LIEF::dwarf::types::Class")&) = delete #### [` Class `]() Class([Class]( "LIEF::dwarf::types::Class::Class")&&) noexcept = default #### [` operator= `]() [Class]( "LIEF::dwarf::types::Class") &operator=([Class]( "LIEF::dwarf::types::Class")&&) noexcept = default #### [` ~Class `]() ~Class() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [Union]() ### [` Union `]() class Union : public LIEF::dwarf::types::[ClassLike]( "LIEF::dwarf::types::ClassLike") This class represents a DWARF `union` type (`DW_TAG_union_type`). Public Functions #### [` ArgsUnion `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[ClassLike]( "LIEF::dwarf::types::ClassLike"), [Args]( "LIEF::dwarf::types::Union::Union::Args")&&...>>> inline Union([Args]( "LIEF::dwarf::types::Union::Union::Args")&&... args) #### [` Union `]() Union(const [Union]( "LIEF::dwarf::types::Union::Union")&) = delete #### [` operator= `]() [Union]( "LIEF::dwarf::types::Union") &operator=(const [Union]( "LIEF::dwarf::types::Union")&) = delete #### [` Union `]() Union([Union]( "LIEF::dwarf::types::Union::Union")&&) noexcept = default #### [` operator= `]() [Union]( "LIEF::dwarf::types::Union") &operator=([Union]( "LIEF::dwarf::types::Union")&&) noexcept = default #### [` ~Union `]() ~Union() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [Packed]() ### [` Packed `]() class Packed : public LIEF::dwarf::types::[ClassLike]( "LIEF::dwarf::types::ClassLike") This class represents a DWARF `packed` type (`DW_TAG_packed_type`). Public Functions #### [` ArgsPacked `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[ClassLike]( "LIEF::dwarf::types::ClassLike"), [Args]( "LIEF::dwarf::types::Packed::Packed::Args")&&...>>> inline Packed([Args]( "LIEF::dwarf::types::Packed::Packed::Args")&&... args) #### [` Packed `]() Packed(const [Packed]( "LIEF::dwarf::types::Packed::Packed")&) = delete #### [` operator= `]() [Packed]( "LIEF::dwarf::types::Packed") &operator=(const [Packed]( "LIEF::dwarf::types::Packed")&) = delete #### [` Packed `]() Packed([Packed]( "LIEF::dwarf::types::Packed::Packed")&&) noexcept = default #### [` operator= `]() [Packed]( "LIEF::dwarf::types::Packed") &operator=([Packed]( "LIEF::dwarf::types::Packed")&&) noexcept = default #### [` ~Packed `]() ~Packed() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [Const]() ### [` Const `]() class Const : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class represents a `DW_TAG_const_type`. Public Functions #### [` ArgsConst `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::Const::Const::Args")&&...>>> inline Const([Args]( "LIEF::dwarf::types::Const::Const::Args")&&... args) #### [` Const `]() Const(const [Const]( "LIEF::dwarf::types::Const::Const")&) = delete #### [` operator= `]() [Const]( "LIEF::dwarf::types::Const") &operator=(const [Const]( "LIEF::dwarf::types::Const")&) = delete #### [` Const `]() Const([Const]( "LIEF::dwarf::types::Const::Const")&&) noexcept = default #### [` operator= `]() [Const]( "LIEF::dwarf::types::Const") &operator=([Const]( "LIEF::dwarf::types::Const")&&) noexcept = default #### [` underlying_type `]() const [Type]( "LIEF::dwarf::Type") \*underlying\_type() const The underlying type being const-ed. #### [` operator-> `]() inline const [Type]( "LIEF::dwarf::Type") \*operator->() const #### [` operator* `]() inline const [Type]( "LIEF::dwarf::Type") &operator\*() const #### [` ~Const `]() ~Const() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [Pointer]() ### [` Pointer `]() class Pointer : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class represents a `DW_TAG_pointer_type` DWARF type. Public Functions #### [` ArgsPointer `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::Pointer::Pointer::Args")&&...>>> inline Pointer([Args]( "LIEF::dwarf::types::Pointer::Pointer::Args")&&... args) #### [` Pointer `]() Pointer(const [Pointer]( "LIEF::dwarf::types::Pointer::Pointer")&) = delete #### [` operator= `]() [Pointer]( "LIEF::dwarf::types::Pointer") &operator=(const [Pointer]( "LIEF::dwarf::types::Pointer")&) = delete #### [` Pointer `]() Pointer([Pointer]( "LIEF::dwarf::types::Pointer::Pointer")&&) noexcept = default #### [` operator= `]() [Pointer]( "LIEF::dwarf::types::Pointer") &operator=([Pointer]( "LIEF::dwarf::types::Pointer")&&) noexcept = default #### [` underlying_type `]() const [Type]( "LIEF::dwarf::Type") \*underlying\_type() const The type pointed by this pointer. #### [` operator-> `]() inline const [Type]( "LIEF::dwarf::Type") \*operator->() const #### [` operator* `]() inline const [Type]( "LIEF::dwarf::Type") &operator\*() const #### [` ~Pointer `]() ~Pointer() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [Typedef]() ### [` Typedef `]() class Typedef : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class represents a `DW_TAG_typedef` type. Public Functions #### [` ArgsTypedef `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::Typedef::Typedef::Args")&&...>>> inline Typedef([Args]( "LIEF::dwarf::types::Typedef::Typedef::Args")&&... args) #### [` Typedef `]() Typedef(const [Typedef]( "LIEF::dwarf::types::Typedef::Typedef")&) = delete #### [` operator= `]() [Typedef]( "LIEF::dwarf::types::Typedef") &operator=(const [Typedef]( "LIEF::dwarf::types::Typedef")&) = delete #### [` Typedef `]() Typedef([Typedef]( "LIEF::dwarf::types::Typedef::Typedef")&&) noexcept = default #### [` operator= `]() [Typedef]( "LIEF::dwarf::types::Typedef") &operator=([Typedef]( "LIEF::dwarf::types::Typedef")&&) noexcept = default #### [` underlying_type `]() const [Type]( "LIEF::dwarf::Type") \*underlying\_type() const The type aliased by this typedef. #### [` operator-> `]() inline const [Type]( "LIEF::dwarf::Type") \*operator->() const #### [` operator* `]() inline const [Type]( "LIEF::dwarf::Type") &operator\*() const #### [` ~Typedef `]() ~Typedef() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [Atomic]() ### [` Atomic `]() class Atomic : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class represents a `DW_TAG_atomic_type`. Public Functions #### [` ArgsAtomic `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::Atomic::Atomic::Args")&&...>>> inline Atomic([Args]( "LIEF::dwarf::types::Atomic::Atomic::Args")&&... args) #### [` Atomic `]() Atomic(const [Atomic]( "LIEF::dwarf::types::Atomic::Atomic")&) = delete #### [` operator= `]() [Atomic]( "LIEF::dwarf::types::Atomic") &operator=(const [Atomic]( "LIEF::dwarf::types::Atomic")&) = delete #### [` Atomic `]() Atomic([Atomic]( "LIEF::dwarf::types::Atomic::Atomic")&&) noexcept = default #### [` operator= `]() [Atomic]( "LIEF::dwarf::types::Atomic") &operator=([Atomic]( "LIEF::dwarf::types::Atomic")&&) noexcept = default #### [` underlying_type `]() const [Type]( "LIEF::dwarf::Type") \*underlying\_type() const The underlying type being atomic. #### [` operator-> `]() inline const [Type]( "LIEF::dwarf::Type") \*operator->() const #### [` operator* `]() inline const [Type]( "LIEF::dwarf::Type") &operator\*() const #### [` ~Atomic `]() ~Atomic() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [Coarray]() ### [` Coarray `]() class Coarray : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class represents a `DW_TAG_coarray_type`. Public Functions #### [` ArgsCoarray `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::Coarray::Coarray::Args")&&...>>> inline Coarray([Args]( "LIEF::dwarf::types::Coarray::Coarray::Args")&&... args) #### [` Coarray `]() Coarray(const [Coarray]( "LIEF::dwarf::types::Coarray::Coarray")&) = delete #### [` operator= `]() [Coarray]( "LIEF::dwarf::types::Coarray") &operator=(const [Coarray]( "LIEF::dwarf::types::Coarray")&) = delete #### [` Coarray `]() Coarray([Coarray]( "LIEF::dwarf::types::Coarray::Coarray")&&) noexcept = default #### [` operator= `]() [Coarray]( "LIEF::dwarf::types::Coarray") &operator=([Coarray]( "LIEF::dwarf::types::Coarray")&&) noexcept = default #### [` ~Coarray `]() ~Coarray() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [Dynamic]() ### [` Dynamic `]() class Dynamic : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class represents a `DW_TAG_dynamic_type`. Public Functions #### [` ArgsDynamic `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::Dynamic::Dynamic::Args")&&...>>> inline Dynamic([Args]( "LIEF::dwarf::types::Dynamic::Dynamic::Args")&&... args) #### [` Dynamic `]() Dynamic(const [Dynamic]( "LIEF::dwarf::types::Dynamic::Dynamic")&) = delete #### [` operator= `]() [Dynamic]( "LIEF::dwarf::types::Dynamic") &operator=(const [Dynamic]( "LIEF::dwarf::types::Dynamic")&) = delete #### [` Dynamic `]() Dynamic([Dynamic]( "LIEF::dwarf::types::Dynamic::Dynamic")&&) noexcept = default #### [` operator= `]() [Dynamic]( "LIEF::dwarf::types::Dynamic") &operator=([Dynamic]( "LIEF::dwarf::types::Dynamic")&&) noexcept = default #### [` ~Dynamic `]() ~Dynamic() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [Enum]() ### [` Enum `]() class Enum : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class represents a `DW_TAG_enumeration_type`. Public Functions #### [` ArgsEnum `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::Enum::Enum::Args")&&...>>> inline Enum([Args]( "LIEF::dwarf::types::Enum::Enum::Args")&&... args) #### [` Enum `]() Enum(const [Enum]( "LIEF::dwarf::types::Enum::Enum")&) = delete #### [` operator= `]() [Enum]( "LIEF::dwarf::types::Enum") &operator=(const [Enum]( "LIEF::dwarf::types::Enum")&) = delete #### [` Enum `]() Enum([Enum]( "LIEF::dwarf::types::Enum::Enum")&&) noexcept = default #### [` operator= `]() [Enum]( "LIEF::dwarf::types::Enum") &operator=([Enum]( "LIEF::dwarf::types::Enum")&&) noexcept = default #### [` entries `]() std::vector<[Entry]( "LIEF::dwarf::types::Enum::Entry")> entries() const Return the different entries associated with this enum. #### [` underlying_type `]() const [Type]( "LIEF::dwarf::Type") \*underlying\_type() const The underlying type that is used to encode this enum. #### [` find_entry `]() std::optional<[Entry]( "LIEF::dwarf::types::Enum::Entry")> find\_entry(int64\_t value) const Try to find the enum matching the given value. #### [` ~Enum `]() ~Enum() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) #### [` Entry `]() class Entry This class represents an enum entry which is essentially composed of a name and its value (integer). Public Functions ##### [` Entry `]() Entry(std::unique\_ptr<details::EnumEntry> impl) ##### [` Entry `]() Entry([Entry]( "LIEF::dwarf::types::Enum::Entry::Entry") &&other) noexcept ##### [` operator= `]() [Entry]( "LIEF::dwarf::types::Enum::Entry") &operator=([Entry]( "LIEF::dwarf::types::Enum::Entry") &&other) noexcept ##### [` Entry `]() Entry(const [Entry]( "LIEF::dwarf::types::Enum::Entry::Entry")&) = delete ##### [` operator= `]() [Entry]( "LIEF::dwarf::types::Enum::Entry") &operator=(const [Entry]( "LIEF::dwarf::types::Enum::Entry")&) = delete ##### [` name `]() std::string name() const [Enum]() entry’s name. ##### [` value `]() std::optional<int64\_t> value() const [Enum]() entry’s value (if any). ##### [` ~Entry `]() ~Entry() --- ## [File]() ### [` File `]() class File : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class represents a `DW_TAG_file_type`. Public Functions #### [` ArgsFile `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::File::File::Args")&&...>>> inline File([Args]( "LIEF::dwarf::types::File::File::Args")&&... args) #### [` File `]() File(const [File]( "LIEF::dwarf::types::File::File")&) = delete #### [` operator= `]() [File]( "LIEF::dwarf::types::File") &operator=(const [File]( "LIEF::dwarf::types::File")&) = delete #### [` File `]() File([File]( "LIEF::dwarf::types::File::File")&&) noexcept = default #### [` operator= `]() [File]( "LIEF::dwarf::types::File") &operator=([File]( "LIEF::dwarf::types::File")&&) noexcept = default #### [` ~File `]() ~File() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [Immutable]() ### [` Immutable `]() class Immutable : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class represents a `DW_TAG_immutable_type`. Public Functions #### [` ArgsImmutable `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::Immutable::Immutable::Args")&&...>>> inline Immutable([Args]( "LIEF::dwarf::types::Immutable::Immutable::Args")&&... args) #### [` Immutable `]() Immutable(const [Immutable]( "LIEF::dwarf::types::Immutable::Immutable")&) = delete #### [` operator= `]() [Immutable]( "LIEF::dwarf::types::Immutable") &operator=(const [Immutable]( "LIEF::dwarf::types::Immutable")&) = delete #### [` Immutable `]() Immutable([Immutable]( "LIEF::dwarf::types::Immutable::Immutable")&&) noexcept = default #### [` operator= `]() [Immutable]( "LIEF::dwarf::types::Immutable") &operator=([Immutable]( "LIEF::dwarf::types::Immutable")&&) noexcept = default #### [` underlying_type `]() const [Type]( "LIEF::dwarf::Type") \*underlying\_type() const The underlying type. #### [` operator-> `]() inline const [Type]( "LIEF::dwarf::Type") \*operator->() const #### [` operator* `]() inline const [Type]( "LIEF::dwarf::Type") &operator\*() const #### [` ~Immutable `]() ~Immutable() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [Interface]() ### [` Interface `]() class Interface : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class represents a `DW_TAG_interface_type`. Public Functions #### [` ArgsInterface `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::Interface::Interface::Args")&&...>>> inline Interface([Args]( "LIEF::dwarf::types::Interface::Interface::Args")&&... args) #### [` Interface `]() Interface(const [Interface]( "LIEF::dwarf::types::Interface::Interface")&) = delete #### [` operator= `]() [Interface]( "LIEF::dwarf::types::Interface") &operator=(const [Interface]( "LIEF::dwarf::types::Interface")&) = delete #### [` Interface `]() Interface([Interface]( "LIEF::dwarf::types::Interface::Interface")&&) noexcept = default #### [` operator= `]() [Interface]( "LIEF::dwarf::types::Interface") &operator=([Interface]( "LIEF::dwarf::types::Interface")&&) noexcept = default #### [` ~Interface `]() ~Interface() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [PointerToMember]() ### [` PointerToMember `]() class PointerToMember : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class represents a `DW_TAG_ptr_to_member_type`. Public Functions #### [` ArgsPointerToMember `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::PointerToMember::PointerToMember::Args")&&...>>> inline PointerToMember([Args]( "LIEF::dwarf::types::PointerToMember::PointerToMember::Args")&&... args) #### [` PointerToMember `]() PointerToMember(const [PointerToMember]( "LIEF::dwarf::types::PointerToMember::PointerToMember")&) = delete #### [` operator= `]() [PointerToMember]( "LIEF::dwarf::types::PointerToMember") &operator=(const [PointerToMember]( "LIEF::dwarf::types::PointerToMember")&) = delete #### [` PointerToMember `]() PointerToMember([PointerToMember]( "LIEF::dwarf::types::PointerToMember::PointerToMember")&&) noexcept = default #### [` operator= `]() [PointerToMember]( "LIEF::dwarf::types::PointerToMember") &operator=([PointerToMember]( "LIEF::dwarf::types::PointerToMember")&&) noexcept = default #### [` underlying_type `]() const [Type]( "LIEF::dwarf::Type") \*underlying\_type() const The type of the member referenced by this pointer. #### [` operator-> `]() inline const [Type]( "LIEF::dwarf::Type") \*operator->() const #### [` operator* `]() inline const [Type]( "LIEF::dwarf::Type") \*operator\*() const #### [` containing_type `]() std::unique\_ptr<[Type]( "LIEF::dwarf::Type")> containing\_type() const The type that embeds this member. #### [` ~PointerToMember `]() ~PointerToMember() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [RValueReference]() ### [` RValueReference `]() class RValueReference : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class represents a `DW_TAG_rvalue_reference_type`. Public Functions #### [` ArgsRValueReference `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::RValueReference::RValueReference::Args")&&...>>> inline RValueReference([Args]( "LIEF::dwarf::types::RValueReference::RValueReference::Args")&&... args) #### [` RValueReference `]() RValueReference(const [RValueReference]( "LIEF::dwarf::types::RValueReference::RValueReference")&) = delete #### [` operator= `]() [RValueReference]( "LIEF::dwarf::types::RValueReference") &operator=(const [RValueReference]( "LIEF::dwarf::types::RValueReference")&) = delete #### [` RValueReference `]() RValueReference([RValueReference]( "LIEF::dwarf::types::RValueReference::RValueReference")&&) noexcept = default #### [` operator= `]() [RValueReference]( "LIEF::dwarf::types::RValueReference") &operator=([RValueReference]( "LIEF::dwarf::types::RValueReference")&&) noexcept = default #### [` underlying_type `]() const [Type]( "LIEF::dwarf::Type") \*underlying\_type() const The underlying type referenced by this rvalue-type. #### [` operator-> `]() inline const [Type]( "LIEF::dwarf::Type") \*operator->() const #### [` operator* `]() inline const [Type]( "LIEF::dwarf::Type") \*operator\*() const #### [` ~RValueReference `]() ~RValueReference() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [Reference]() ### [` Reference `]() class Reference : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class represents a `DW_TAG_reference_type`. Public Functions #### [` ArgsReference `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::Reference::Reference::Args")&&...>>> inline Reference([Args]( "LIEF::dwarf::types::Reference::Reference::Args")&&... args) #### [` Reference `]() Reference(const [Reference]( "LIEF::dwarf::types::Reference::Reference")&) = delete #### [` operator= `]() [Reference]( "LIEF::dwarf::types::Reference") &operator=(const [Reference]( "LIEF::dwarf::types::Reference")&) = delete #### [` Reference `]() Reference([Reference]( "LIEF::dwarf::types::Reference::Reference")&&) noexcept = default #### [` operator= `]() [Reference]( "LIEF::dwarf::types::Reference") &operator=([Reference]( "LIEF::dwarf::types::Reference")&&) noexcept = default #### [` underlying_type `]() const [Type]( "LIEF::dwarf::Type") \*underlying\_type() const The underlying type referenced by this ref-type. #### [` operator-> `]() inline const [Type]( "LIEF::dwarf::Type") \*operator->() const #### [` operator* `]() inline const [Type]( "LIEF::dwarf::Type") \*operator\*() const #### [` ~Reference `]() ~Reference() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [Restrict]() ### [` Restrict `]() class Restrict : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class represents a `DW_TAG_restrict_type`. Public Functions #### [` ArgsRestrict `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::Restrict::Restrict::Args")&&...>>> inline Restrict([Args]( "LIEF::dwarf::types::Restrict::Restrict::Args")&&... args) #### [` Restrict `]() Restrict(const [Restrict]( "LIEF::dwarf::types::Restrict::Restrict")&) = delete #### [` operator= `]() [Restrict]( "LIEF::dwarf::types::Restrict") &operator=(const [Restrict]( "LIEF::dwarf::types::Restrict")&) = delete #### [` Restrict `]() Restrict([Restrict]( "LIEF::dwarf::types::Restrict::Restrict")&&) noexcept = default #### [` operator= `]() [Restrict]( "LIEF::dwarf::types::Restrict") &operator=([Restrict]( "LIEF::dwarf::types::Restrict")&&) noexcept = default #### [` underlying_type `]() const [Type]( "LIEF::dwarf::Type") \*underlying\_type() const The underlying type referenced by this restrict-type. #### [` operator-> `]() inline const [Type]( "LIEF::dwarf::Type") \*operator->() const #### [` operator* `]() inline const [Type]( "LIEF::dwarf::Type") \*operator\*() const #### [` ~Restrict `]() ~Restrict() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [SetTy]() ### [` SetTy `]() class SetTy : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class represents a `DW_TAG_set_type`. Public Functions #### [` ArgsSetTy `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::SetTy::SetTy::Args")&&...>>> inline SetTy([Args]( "LIEF::dwarf::types::SetTy::SetTy::Args")&&... args) #### [` SetTy `]() SetTy(const [SetTy]( "LIEF::dwarf::types::SetTy::SetTy")&) = delete #### [` operator= `]() [SetTy]( "LIEF::dwarf::types::SetTy") &operator=(const [SetTy]( "LIEF::dwarf::types::SetTy")&) = delete #### [` SetTy `]() SetTy([SetTy]( "LIEF::dwarf::types::SetTy::SetTy")&&) noexcept = default #### [` operator= `]() [SetTy]( "LIEF::dwarf::types::SetTy") &operator=([SetTy]( "LIEF::dwarf::types::SetTy")&&) noexcept = default #### [` underlying_type `]() const [Type]( "LIEF::dwarf::Type") \*underlying\_type() const The underlying type referenced by this set-type. #### [` operator-> `]() inline const [Type]( "LIEF::dwarf::Type") \*operator->() const #### [` operator* `]() inline const [Type]( "LIEF::dwarf::Type") \*operator\*() const #### [` ~SetTy `]() ~SetTy() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [Shared]() ### [` Shared `]() class Shared : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class represents a `DW_TAG_shared_type`. Public Functions #### [` ArgsShared `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::Shared::Shared::Args")&&...>>> inline Shared([Args]( "LIEF::dwarf::types::Shared::Shared::Args")&&... args) #### [` Shared `]() Shared(const [Shared]( "LIEF::dwarf::types::Shared::Shared")&) = delete #### [` operator= `]() [Shared]( "LIEF::dwarf::types::Shared") &operator=(const [Shared]( "LIEF::dwarf::types::Shared")&) = delete #### [` Shared `]() Shared([Shared]( "LIEF::dwarf::types::Shared::Shared")&&) noexcept = default #### [` operator= `]() [Shared]( "LIEF::dwarf::types::Shared") &operator=([Shared]( "LIEF::dwarf::types::Shared")&&) noexcept = default #### [` underlying_type `]() const [Type]( "LIEF::dwarf::Type") \*underlying\_type() const The underlying type referenced by this shared-type. #### [` operator-> `]() inline const [Type]( "LIEF::dwarf::Type") \*operator->() const #### [` operator* `]() inline const [Type]( "LIEF::dwarf::Type") \*operator\*() const #### [` ~Shared `]() ~Shared() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [StringTy]() ### [` StringTy `]() class StringTy : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class represents a `DW_TAG_string_type`. Public Functions #### [` ArgsStringTy `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::StringTy::StringTy::Args")&&...>>> inline StringTy([Args]( "LIEF::dwarf::types::StringTy::StringTy::Args")&&... args) #### [` StringTy `]() StringTy(const [StringTy]( "LIEF::dwarf::types::StringTy::StringTy")&) = delete #### [` operator= `]() [StringTy]( "LIEF::dwarf::types::StringTy") &operator=(const [StringTy]( "LIEF::dwarf::types::StringTy")&) = delete #### [` StringTy `]() StringTy([StringTy]( "LIEF::dwarf::types::StringTy::StringTy")&&) noexcept = default #### [` operator= `]() [StringTy]( "LIEF::dwarf::types::StringTy") &operator=([StringTy]( "LIEF::dwarf::types::StringTy")&&) noexcept = default #### [` ~StringTy `]() ~StringTy() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [Subroutine]() ### [` Subroutine `]() class Subroutine : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class represents a `DW_TAG_subroutine_type`. Public Types #### [` parameters_t `]() using parameters\_t = std::vector<std::unique\_ptr<[Parameter]( "LIEF::dwarf::Parameter")>> Public Functions #### [` ArgsSubroutine `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::Subroutine::Subroutine::Args")&&...>>> inline Subroutine([Args]( "LIEF::dwarf::types::Subroutine::Subroutine::Args")&&... args) #### [` Subroutine `]() Subroutine(const [Subroutine]( "LIEF::dwarf::types::Subroutine::Subroutine")&) = delete #### [` operator= `]() [Subroutine]( "LIEF::dwarf::types::Subroutine") &operator=(const [Subroutine]( "LIEF::dwarf::types::Subroutine")&) = delete #### [` Subroutine `]() Subroutine([Subroutine]( "LIEF::dwarf::types::Subroutine::Subroutine")&&) noexcept = default #### [` operator= `]() [Subroutine]( "LIEF::dwarf::types::Subroutine") &operator=([Subroutine]( "LIEF::dwarf::types::Subroutine")&&) noexcept = default #### [` return_type `]() std::unique\_ptr<[Type]( "LIEF::dwarf::Type")> return\_type() const Return the [dwarf::Type]() associated with the **return type** of this function. #### [` parameters `]() [parameters\_t]( "LIEF::dwarf::types::Subroutine::parameters_t") parameters() const Parameters of this subroutine. #### [` ~Subroutine `]() ~Subroutine() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [TemplateAlias]() ### [` TemplateAlias `]() class TemplateAlias : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class represents a `DW_TAG_template_alias`. Public Types #### [` parameters_t `]() using parameters\_t = std::vector<std::unique\_ptr<[Parameter]( "LIEF::dwarf::Parameter")>> Public Functions #### [` ArgsTemplateAlias `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::TemplateAlias::TemplateAlias::Args")&&...>>> inline TemplateAlias([Args]( "LIEF::dwarf::types::TemplateAlias::TemplateAlias::Args")&&... args) #### [` TemplateAlias `]() TemplateAlias(const [TemplateAlias]( "LIEF::dwarf::types::TemplateAlias::TemplateAlias")&) = delete #### [` operator= `]() [TemplateAlias]( "LIEF::dwarf::types::TemplateAlias") &operator=(const [TemplateAlias]( "LIEF::dwarf::types::TemplateAlias")&) = delete #### [` TemplateAlias `]() TemplateAlias([TemplateAlias]( "LIEF::dwarf::types::TemplateAlias::TemplateAlias")&&) noexcept = default #### [` operator= `]() [TemplateAlias]( "LIEF::dwarf::types::TemplateAlias") &operator=([TemplateAlias]( "LIEF::dwarf::types::TemplateAlias")&&) noexcept = default #### [` underlying_type `]() const [Type]( "LIEF::dwarf::Type") \*underlying\_type() const The underlying type aliased by this type. #### [` operator-> `]() inline const [Type]( "LIEF::dwarf::Type") \*operator->() const #### [` operator* `]() inline const [Type]( "LIEF::dwarf::Type") &operator\*() const #### [` parameters `]() [parameters\_t]( "LIEF::dwarf::types::TemplateAlias::parameters_t") parameters() const Parameters associated with the underlying template. #### [` ~TemplateAlias `]() ~TemplateAlias() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [Thrown]() ### [` Thrown `]() class Thrown : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class represents a `DW_TAG_thrown_type`. Public Functions #### [` ArgsThrown `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::Thrown::Thrown::Args")&&...>>> inline Thrown([Args]( "LIEF::dwarf::types::Thrown::Thrown::Args")&&... args) #### [` Thrown `]() Thrown(const [Thrown]( "LIEF::dwarf::types::Thrown::Thrown")&) = delete #### [` operator= `]() [Thrown]( "LIEF::dwarf::types::Thrown") &operator=(const [Thrown]( "LIEF::dwarf::types::Thrown")&) = delete #### [` Thrown `]() Thrown([Thrown]( "LIEF::dwarf::types::Thrown::Thrown")&&) noexcept = default #### [` operator= `]() [Thrown]( "LIEF::dwarf::types::Thrown") &operator=([Thrown]( "LIEF::dwarf::types::Thrown")&&) noexcept = default #### [` underlying_type `]() const [Type]( "LIEF::dwarf::Type") \*underlying\_type() const The underlying type being thrown. #### [` operator-> `]() inline const [Type]( "LIEF::dwarf::Type") \*operator->() const #### [` operator* `]() inline const [Type]( "LIEF::dwarf::Type") &operator\*() const #### [` ~Thrown `]() ~Thrown() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [Volatile]() ### [` Volatile `]() class Volatile : public LIEF::dwarf::[Type]( "LIEF::dwarf::Type") This class represents a `DW_TAG_volatile_type`. Public Functions #### [` ArgsVolatile `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::Type"), [Args]( "LIEF::dwarf::types::Volatile::Volatile::Args")&&...>>> inline Volatile([Args]( "LIEF::dwarf::types::Volatile::Volatile::Args")&&... args) #### [` Volatile `]() Volatile(const [Volatile]( "LIEF::dwarf::types::Volatile::Volatile")&) = delete #### [` operator= `]() [Volatile]( "LIEF::dwarf::types::Volatile") &operator=(const [Volatile]( "LIEF::dwarf::types::Volatile")&) = delete #### [` Volatile `]() Volatile([Volatile]( "LIEF::dwarf::types::Volatile::Volatile")&&) noexcept = default #### [` operator= `]() [Volatile]( "LIEF::dwarf::types::Volatile") &operator=([Volatile]( "LIEF::dwarf::types::Volatile")&&) noexcept = default #### [` underlying_type `]() const [Type]( "LIEF::dwarf::Type") \*underlying\_type() const The underlying type. #### [` operator-> `]() inline const [Type]( "LIEF::dwarf::Type") \*operator->() const #### [` operator* `]() inline const [Type]( "LIEF::dwarf::Type") &operator\*() const #### [` ~Volatile `]() ~Volatile() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::dwarf::Type") \*type) --- ## [Editor]() ### [` Editor `]() class Editor This class exposes the main API to create DWARF information. Public Types #### [` FORMAT `]() enum class FORMAT : uint32\_t *Values:* ##### [` ELF `]() enumerator ELF ##### [` MACHO `]() enumerator MACHO ##### [` PE `]() enumerator PE #### [` ARCH `]() enum class ARCH : uint32\_t *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN ##### [` X64 `]() enumerator X64 ##### [` X86 `]() enumerator X86 ##### [` AARCH64 `]() enumerator AARCH64 ##### [` ARM `]() enumerator ARM Public Functions #### [` Editor `]() Editor() = delete #### [` Editor `]() Editor(std::unique\_ptr<details::Editor> impl) #### [` create_compilation_unit `]() std::unique\_ptr<editor::[CompilationUnit]( "LIEF::dwarf::editor::CompilationUnit")> create\_compilation\_unit() Create a new compilation unit. #### [` write `]() void write(const std::string &output) Write the DWARF file to the specified output. #### [` ~Editor `]() ~Editor() Public Static Functions #### [` from_binary `]() static std::unique\_ptr<[Editor]( "LIEF::dwarf::Editor")> from\_binary(LIEF::[Binary]( "LIEF::Binary") &bin) Instantiate an editor for the given binary object. #### [` create `]() static std::unique\_ptr<[Editor]( "LIEF::dwarf::Editor")> create([FORMAT]( "LIEF::dwarf::Editor::FORMAT") fmt, [ARCH]( "LIEF::dwarf::Editor::ARCH") arch) Instantiate an editor for the given format and arch. --- ## [Editor - CompilationUnit]() ### [` CompilationUnit `]() class CompilationUnit This class represents an **editable** DWARF compilation unit. Public Functions #### [` CompilationUnit `]() CompilationUnit() = delete #### [` CompilationUnit `]() CompilationUnit(std::unique\_ptr<details::CompilationUnit> impl) #### [` set_producer `]() [CompilationUnit]( "LIEF::dwarf::editor::CompilationUnit") &set\_producer(const std::string &producer) Set the `DW_AT_producer` producer attribute. This attribute aims to inform about the program that generated this compilation unit (e.g. `LIEF Extended`) #### [` create_function `]() std::unique\_ptr<[Function]( "LIEF::dwarf::editor::Function")> create\_function(const std::string &name) Create a new function owned by this compilation unit. #### [` create_variable `]() std::unique\_ptr<[Variable]( "LIEF::dwarf::editor::Variable")> create\_variable(const std::string &name) Create a new **global** variable owned by this compilation unit. #### [` create_generic_type `]() std::unique\_ptr<[Type]( "LIEF::dwarf::editor::Type")> create\_generic\_type(const std::string &name) Create a `DW_TAG_unspecified_type` type with the given name. #### [` create_enum `]() std::unique\_ptr<[EnumType]( "LIEF::dwarf::editor::EnumType")> create\_enum(const std::string &name) Create an enum type (`DW_TAG_enumeration_type`). #### [` create_typedef `]() std::unique\_ptr<[TypeDef]( "LIEF::dwarf::editor::TypeDef")> create\_typedef(const std::string &name, const [Type]( "LIEF::dwarf::editor::Type") &type) Create a typedef with the name provided in the first parameter which aliases the type provided in the second parameter. #### [` create_structure `]() std::unique\_ptr<[StructType]( "LIEF::dwarf::editor::StructType")> create\_structure(const std::string &name, [StructType]( "LIEF::dwarf::editor::StructType")::[TYPE]( "LIEF::dwarf::editor::StructType::TYPE") kind = [StructType]( "LIEF::dwarf::editor::StructType")::[TYPE]( "LIEF::dwarf::editor::StructType::TYPE")::[STRUCT]( "LIEF::dwarf::editor::StructType::TYPE::STRUCT")) Create a struct-like type (struct, class, union) with the given name. #### [` create_base_type `]() std::unique\_ptr<[BaseType]( "LIEF::dwarf::editor::BaseType")> create\_base\_type(const std::string &name, size\_t size, [BaseType]( "LIEF::dwarf::editor::BaseType")::[ENCODING]( "LIEF::dwarf::editor::BaseType::ENCODING") encoding = [BaseType]( "LIEF::dwarf::editor::BaseType")::[ENCODING]( "LIEF::dwarf::editor::BaseType::ENCODING")::[NONE]( "LIEF::dwarf::editor::BaseType::ENCODING::NONE")) Create a primitive type with the given name and size. #### [` create_function_type `]() std::unique\_ptr<[FunctionType]( "LIEF::dwarf::editor::FunctionType")> create\_function\_type(const std::string &name) Create a function type with the given name. #### [` create_pointer_type `]() inline std::unique\_ptr<[PointerType]( "LIEF::dwarf::editor::PointerType")> create\_pointer\_type(const [Type]( "LIEF::dwarf::editor::Type") &ty) Create a pointer on the provided type. #### [` create_void_type `]() std::unique\_ptr<[Type]( "LIEF::dwarf::editor::Type")> create\_void\_type() Create a `void` type. #### [` create_array `]() std::unique\_ptr<[ArrayType]( "LIEF::dwarf::editor::ArrayType")> create\_array(const std::string &name, const [Type]( "LIEF::dwarf::editor::Type") &type, size\_t count) Create an array type with the given name, type and size. #### [` ~CompilationUnit `]() ~CompilationUnit() --- ## [Editor - Function]() ### [` Function `]() class Function This class represents an **editable** DWARF function (`DW_TAG_subprogram`). Public Functions #### [` Function `]() Function() = delete #### [` Function `]() Function(std::unique\_ptr<details::Function> impl) #### [` set_address `]() [Function]( "LIEF::dwarf::editor::Function") &set\_address(uint64\_t addr) Set the address of this function by defining `DW_AT_entry_pc`. #### [` set_low_high `]() [Function]( "LIEF::dwarf::editor::Function") &set\_low\_high(uint64\_t low, uint64\_t high) Set the upper and lower bound addresses for this function. This assumes that the function is contiguous between `low` and `high`. Underneath, the function defines `DW_AT_low_pc` and `DW_AT_high_pc` #### [` set_ranges `]() [Function]( "LIEF::dwarf::editor::Function") &set\_ranges(const std::vector<[range\_t]( "LIEF::dwarf::editor::Function::range_t")> &ranges) Set the ranges of addresses owned by the implementation of this function by setting the `DW_AT_ranges` attribute. This setter should be used for non-contiguous functions. #### [` set_external `]() [Function]( "LIEF::dwarf::editor::Function") &set\_external() Set the function as external by defining `DW_AT_external` to true. This means that the function is **imported** by the current compilation unit. #### [` set_return_type `]() [Function]( "LIEF::dwarf::editor::Function") &set\_return\_type(const [Type]( "LIEF::dwarf::editor::Type") &type) Set the return type of this function. #### [` add_parameter `]() std::unique\_ptr<[Parameter]( "LIEF::dwarf::editor::Function::Parameter")> add\_parameter(const std::string &name, const [Type]( "LIEF::dwarf::editor::Type") &type) Add a parameter to the current function. #### [` create_stack_variable `]() std::unique\_ptr<[Variable]( "LIEF::dwarf::editor::Variable")> create\_stack\_variable(const std::string &name) Create a stack-based variable owned by the current function. #### [` add_lexical_block `]() std::unique\_ptr<[LexicalBlock]( "LIEF::dwarf::editor::Function::LexicalBlock")> add\_lexical\_block(uint64\_t start, uint64\_t end) Add a lexical block with the given range. #### [` add_label `]() std::unique\_ptr<[Label]( "LIEF::dwarf::editor::Function::Label")> add\_label(uint64\_t addr, const std::string &label) Add a label at the given address. #### [` add_description `]() [Function]( "LIEF::dwarf::editor::Function") &add\_description(const std::string &description) Create a `DW_AT_description` entry with the description provided in parameter. #### [` ~Function `]() ~Function() #### [` range_t `]() struct range\_t Public Functions ##### [` range_t `]() range\_t() = default ##### [` range_t `]() inline range\_t(uint64\_t start, uint64\_t end) Public Members ##### [` start `]() uint64\_t start = 0 ##### [` end `]() uint64\_t end = 0 #### [` Parameter `]() class Parameter This class represents a parameter of the current function (`DW_TAG_formal_parameter`). Public Functions ##### [` Parameter `]() Parameter() = delete ##### [` Parameter `]() Parameter(std::unique\_ptr<details::FunctionParameter> impl) ##### [` ~Parameter `]() ~Parameter() ##### [` assign_register `]() [Parameter]( "LIEF::dwarf::editor::Function::Parameter") &assign\_register(const std::string &name) Assign this parameter to a specific named register. ##### [` assign_register `]() [Parameter]( "LIEF::dwarf::editor::Function::Parameter") &assign\_register(uint64\_t reg) Assign this parameter to the given DWARF register id (e.g. `DW_OP_reg0`). #### [` LexicalBlock `]() class LexicalBlock This class mirrors the `DW_TAG_lexical_block` DWARF tag. Public Functions ##### [` LexicalBlock `]() LexicalBlock() = delete ##### [` LexicalBlock `]() LexicalBlock(std::unique\_ptr<details::FunctionLexicalBlock> impl) ##### [` add_block `]() std::unique\_ptr<[LexicalBlock]( "LIEF::dwarf::editor::Function::LexicalBlock")> add\_block(uint64\_t start, uint64\_t end) Create a sub-block with the given low/high addresses. ##### [` add_block `]() std::unique\_ptr<[LexicalBlock]( "LIEF::dwarf::editor::Function::LexicalBlock")> add\_block(const std::vector<[range\_t]( "LIEF::dwarf::editor::Function::range_t")> &range) Create a sub-block with the given range of addresses. ##### [` add_description `]() [LexicalBlock]( "LIEF::dwarf::editor::Function::LexicalBlock") &add\_description(const std::string &description) Create a `DW_AT_description` entry with the description provided in parameter. ##### [` add_name `]() [LexicalBlock]( "LIEF::dwarf::editor::Function::LexicalBlock") &add\_name(const std::string &name) Create a `DW_AT_name` entry to associate a name to this entry. ##### [` ~LexicalBlock `]() ~LexicalBlock() #### [` Label `]() class Label This class mirrors the `DW_TAG_label` DWARF tag. Public Functions ##### [` Label `]() Label() = delete ##### [` Label `]() Label(std::unique\_ptr<details::FunctionLabel> impl) ##### [` ~Label `]() ~Label() --- ## [Editor - Variable]() ### [` Variable `]() class Variable This class represents an **editable** DWARF variable which can be scoped by a function or a compilation unit (`DW_TAG_variable`). Public Functions #### [` Variable `]() Variable() = delete #### [` Variable `]() Variable(std::unique\_ptr<details::Variable> impl) #### [` set_addr `]() [Variable]( "LIEF::dwarf::editor::Variable") &set\_addr(uint64\_t address) Set the global address of this variable. Setting this address is only relevant in the case of a static global variable. For stack variable, you should use set\_stack\_offset. This function sets the `DW_AT_location` attribute #### [` set_stack_offset `]() [Variable]( "LIEF::dwarf::editor::Variable") &set\_stack\_offset(uint64\_t offset) Set the stack offset of this variable. This function sets the `DW_AT_location` attribute #### [` set_external `]() [Variable]( "LIEF::dwarf::editor::Variable") &set\_external() Mark this variable as **imported**. #### [` set_type `]() [Variable]( "LIEF::dwarf::editor::Variable") &set\_type(const [Type]( "LIEF::dwarf::editor::Type") &type) Set the type of the current variable. #### [` add_description `]() [Variable]( "LIEF::dwarf::editor::Variable") &add\_description(const std::string &description) Create a `DW_AT_description` entry with the description provided in parameter. #### [` ~Variable `]() ~Variable() --- ## [Editor - Type]() ### [` Type `]() class Type This class is the base class for any types created when editing DWARF debug info. A type is owned by a [LIEF::dwarf::editor::CompilationUnit]() and should be created from this class. Subclassed by [LIEF::dwarf::editor::ArrayType](), [LIEF::dwarf::editor::BaseType](), [LIEF::dwarf::editor::EnumType](), [LIEF::dwarf::editor::FunctionType](), [LIEF::dwarf::editor::PointerType](), [LIEF::dwarf::editor::StructType](), [LIEF::dwarf::editor::TypeDef]() Public Functions #### [` Type `]() Type() = delete #### [` Type `]() Type(std::unique\_ptr<details::Type> impl) #### [` pointer_to `]() std::unique\_ptr<[PointerType]( "LIEF::dwarf::editor::PointerType")> pointer\_to() const Create a pointer type pointing to this type. #### [` ~Type `]() virtual ~Type() #### [` impl `]() inline const details::Type &impl() const --- ## [Editor - PointerType]() ### [` PointerType `]() class PointerType : public LIEF::dwarf::editor::[Type]( "LIEF::dwarf::editor::Type") This class represents a pointer to another type. Public Functions #### [` ArgsPointerType `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::editor::Type"), [Args]( "LIEF::dwarf::editor::PointerType::PointerType::Args")&&...>>> inline PointerType([Args]( "LIEF::dwarf::editor::PointerType::PointerType::Args")&&... args) #### [` ~PointerType `]() ~PointerType() override = default Public Static Functions #### [` classof `]() static bool classof(const [Type]( "LIEF::dwarf::editor::Type") \*type) --- ## [Editor - EnumType]() ### [` EnumType `]() class EnumType : public LIEF::dwarf::editor::[Type]( "LIEF::dwarf::editor::Type") This class represents an editable enum type (`DW_TAG_enumeration_type`). Public Functions #### [` ArgsEnumType `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::editor::Type"), [Args]( "LIEF::dwarf::editor::EnumType::EnumType::Args")&&...>>> inline EnumType([Args]( "LIEF::dwarf::editor::EnumType::EnumType::Args")&&... args) #### [` set_size `]() [EnumType]( "LIEF::dwarf::editor::EnumType") &set\_size(uint64\_t size) Define the number of bytes required to hold an instance of the enumeration (`DW_AT_byte_size`). #### [` set_underlying_type `]() [EnumType]( "LIEF::dwarf::editor::EnumType") &set\_underlying\_type(const [Type]( "LIEF::dwarf::editor::Type") &type) Set the underlying type that is used to encode this enum. #### [` add_value `]() std::unique\_ptr<[Value]( "LIEF::dwarf::editor::EnumType::Value")> add\_value(const std::string &name, int64\_t value) Add an enum value by specifying its name and its integer value. #### [` ~EnumType `]() ~EnumType() override = default Public Static Functions #### [` classof `]() static bool classof(const [Type]( "LIEF::dwarf::editor::Type") \*type) #### [` Value `]() class Value This class represents an enum value. Public Functions ##### [` Value `]() Value() = delete ##### [` Value `]() Value(std::unique\_ptr<details::EnumValue> impl) ##### [` ~Value `]() ~Value() --- ## [Editor - BaseType]() ### [` BaseType `]() class BaseType : public LIEF::dwarf::editor::[Type]( "LIEF::dwarf::editor::Type") This class represents a primitive type like `int, char`. Public Types #### [` ENCODING `]() enum class ENCODING : uint32\_t *Values:* ##### [` NONE `]() enumerator NONE = 0 ##### [` ADDRESS `]() enumerator ADDRESS ##### [` SIGNED `]() enumerator SIGNED ##### [` SIGNED_CHAR `]() enumerator SIGNED\_CHAR ##### [` UNSIGNED `]() enumerator UNSIGNED ##### [` UNSIGNED_CHAR `]() enumerator UNSIGNED\_CHAR ##### [` BOOLEAN `]() enumerator BOOLEAN ##### [` FLOAT `]() enumerator FLOAT Public Functions #### [` ArgsBaseType `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::editor::Type"), [Args]( "LIEF::dwarf::editor::BaseType::BaseType::Args")&&...>>> inline BaseType([Args]( "LIEF::dwarf::editor::BaseType::BaseType::Args")&&... args) #### [` ~BaseType `]() ~BaseType() override = default Public Static Functions #### [` classof `]() static bool classof(const [Type]( "LIEF::dwarf::editor::Type") \*type) --- ## [Editor - ArrayType]() ### [` ArrayType `]() class ArrayType : public LIEF::dwarf::editor::[Type]( "LIEF::dwarf::editor::Type") This class represents an array type (`DW_TAG_array_type`). Public Functions #### [` ArgsArrayType `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::editor::Type"), [Args]( "LIEF::dwarf::editor::ArrayType::ArrayType::Args")&&...>>> inline ArrayType([Args]( "LIEF::dwarf::editor::ArrayType::ArrayType::Args")&&... args) #### [` ~ArrayType `]() ~ArrayType() override = default Public Static Functions #### [` classof `]() static bool classof(const [Type]( "LIEF::dwarf::editor::Type") \*type) --- ## [Editor - FunctionType]() ### [` FunctionType `]() class FunctionType : public LIEF::dwarf::editor::[Type]( "LIEF::dwarf::editor::Type") This class represents a function type (`DW_TAG_subroutine_type`). Public Functions #### [` ArgsFunctionType `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::editor::Type"), [Args]( "LIEF::dwarf::editor::FunctionType::FunctionType::Args")&&...>>> inline FunctionType([Args]( "LIEF::dwarf::editor::FunctionType::FunctionType::Args")&&... args) #### [` set_return_type `]() [FunctionType]( "LIEF::dwarf::editor::FunctionType") &set\_return\_type(const [Type]( "LIEF::dwarf::editor::Type") &type) Set the return type of this function. #### [` add_parameter `]() std::unique\_ptr<[Parameter]( "LIEF::dwarf::editor::FunctionType::Parameter")> add\_parameter(const [Type]( "LIEF::dwarf::editor::Type") &type) Add a parameter. #### [` ~FunctionType `]() ~FunctionType() override = default Public Static Functions #### [` classof `]() static bool classof(const [Type]( "LIEF::dwarf::editor::Type") \*type) #### [` Parameter `]() class Parameter This class represents a function’s parameter. Public Functions ##### [` Parameter `]() Parameter() = delete ##### [` Parameter `]() Parameter(std::unique\_ptr<details::FunctionTyParameter> impl) ##### [` ~Parameter `]() ~Parameter() --- ## [Editor - TypeDef]() ### [` TypeDef `]() class TypeDef : public LIEF::dwarf::editor::[Type]( "LIEF::dwarf::editor::Type") This class represents a typedef (`DW_TAG_typedef`). Public Functions #### [` ArgsTypeDef `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::editor::Type"), [Args]( "LIEF::dwarf::editor::TypeDef::TypeDef::Args")&&...>>> inline TypeDef([Args]( "LIEF::dwarf::editor::TypeDef::TypeDef::Args")&&... args) #### [` ~TypeDef `]() ~TypeDef() override = default Public Static Functions #### [` classof `]() static bool classof(const [Type]( "LIEF::dwarf::editor::Type") \*type) --- ## [Editor - StructType]() ### [` StructType `]() class StructType : public LIEF::dwarf::editor::[Type]( "LIEF::dwarf::editor::Type") This class represents a struct-like type which can be: - `DW_TAG_class_type` - `DW_TAG_structure_type` - `DW_TAG_union_type` Public Types #### [` TYPE `]() enum class TYPE : uint32\_t *Values:* ##### [` CLASS `]() enumerator CLASS ##### [` STRUCT `]() enumerator STRUCT Discriminant for `DW_TAG_class_type`. ##### [` UNION `]() enumerator UNION Discriminant for `DW_TAG_structure_type`. Public Functions #### [` ArgsStructType `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::dwarf::editor::Type"), [Args]( "LIEF::dwarf::editor::StructType::StructType::Args")&&...>>> inline StructType([Args]( "LIEF::dwarf::editor::StructType::StructType::Args")&&... args) #### [` set_size `]() [StructType]( "LIEF::dwarf::editor::StructType") &set\_size(uint64\_t size) Define the overall size which is equivalent to the `sizeof` of the current type. This function defines the `DW_AT_byte_size` attribute #### [` add_member `]() std::unique\_ptr<[Member]( "LIEF::dwarf::editor::StructType::Member")> add\_member(const std::string &name, const [Type]( "LIEF::dwarf::editor::Type") &type, int64\_t offset = -1) Adds a member to the current struct-like. #### [` add_bitfield `]() std::unique\_ptr<[Member]( "LIEF::dwarf::editor::StructType::Member")> add\_bitfield(const std::string &name, const [Type]( "LIEF::dwarf::editor::Type") &type, uint64\_t bitsize, int64\_t bitoffset = -1) Adds a bitfield member to the current structure. #### [` ~StructType `]() ~StructType() override = default Public Static Functions #### [` classof `]() static bool classof(const [Type]( "LIEF::dwarf::editor::Type") \*type) #### [` Member `]() class Member This class represents a member of the struct-like. Public Functions ##### [` Member `]() Member() = delete ##### [` Member `]() Member(std::unique\_ptr<details::StructMember> impl) ##### [` ~Member `]() ~Member() --- documentID: "d2dc67f9f86c5bb7c87fd836dc62abba63943066801fe3a19ccdbfcf55739c93" docname: "extended/dwarf/index" title: "DWARF - LIEF Documentation" description: "Read DWARF functions, types, and variables, attach external debug files, generate declarations, and create new DWARF files with LIEF Extended." canonical: "https://lief.re/doc/latest/extended/dwarf/index.html" markdownURL: "https://lief.re/doc/latest/extended/dwarf/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "f0da595676a3dfd37893771704221931388714de01a4889dab140800095932cd" --- # [DWARF]() API - [C++]() - [Python]() - [Rust]() ## [Introduction]() LIEF Extended can read DWARF functions, variables, types, and source locations, generate C/C++ declarations, and create new debug files. DWARF debug information can be embedded in a binary or stored in a separate file. To inspect compiler-generated DWARF, build with debug information and preserve it when stripping the binary. Debug files can also be generated from analysis results with the [DWARF editor](). For an overview of loading and associating debug files, see [Debug Information](). ## [Load and inspect DWARF]() When DWARF debug information is embedded within the binary, you can access it using the `lief.Binary.debug_info()` ( [`lief::elf::Binary::debug_info`]() ; [`lief.Binary.debug_info`]() ; [`LIEF::Binary::debug_info()`]() ) attribute. This attribute returns a `lief.dwarf.DebugInfo` ( [`lief::dwarf::DebugInfo`]() ; [`lief.dwarf.DebugInfo`]() ; [`LIEF::dwarf::DebugInfo`]() ) object: **Python** ```python import lief elf = lief.ELF.parse("/bin/with_debug") if debug_info := elf.debug_info: assert isinstance(debug_info, lief.dwarf.DebugInfo) print(f"DWARF Debug handler: {debug_info}") ``` **C++** ```cpp auto elf = LIEF::ELF::Parser::parse("/bin/with_debug"); if (const LIEF::DebugInfo* info = elf->debug_info()) { assert(LIEF::dwarf::DebugInfo::classof(info) && "Wrong debug type"); const auto& dwarf_dbg = static_cast(*info); } ``` **Rust** ```rust let elf = lief::elf::Binary::parse("/bin/ls").unwrap(); if let Some(lief::DebugInfo::Dwarf(dwarf)) = elf.debug_info() { // DWARF debug info } ``` Additionally, the `lief.dwarf.load()` ( [`lief::dwarf::load`]() ; [`lief.dwarf.load()`]() ; [`LIEF::dwarf::load()`]() ) function can be used to load a DWARF file, whether it is embedded or standalone: **Python** ```python import lief dbg: lief.dwarf.DebugInfo | None = lief.dwarf.load("/bin/with_debug") dbg: lief.dwarf.DebugInfo | None = lief.dwarf.load("external_dwarf") dbg: lief.dwarf.DebugInfo | None = lief.dwarf.load("debug.dwo") ``` **C++** ```cpp auto dbg = LIEF::dwarf::load("/bin/with_debug"); dbg = LIEF::dwarf::load("external_dwarf"); dbg = LIEF::dwarf::load("debug.dwo"); ``` **Rust** ```rust let dbg = lief::dwarf::load("/bin/with_debug"); let dbg = lief::dwarf::load("external_dwarf"); let dbg = lief::dwarf::load("debug.dwo"); ``` For a macOS `.dSYM` bundle, pass the path to the DWARF object inside `Contents/Resources/DWARF/`. Check the loader’s return value before accessing compilation units or searching for a function or type. Once loaded, you can use the `lief.dwarf.DebugInfo` ( [`lief::dwarf::DebugInfo`]() ; [`lief.dwarf.DebugInfo`]() ; [`LIEF::dwarf::DebugInfo`]() ) API to interact with the debug information: **Python** ```python dbg: lief.dwarf.DebugInfo for compilation_unit in dbg.compilation_units: print(compilation_unit.producer) for func in compilation_unit.functions: print(func.name, func.linkage_name, func.address) for var in compilation_unit.variables: print(var.name, var.address) for ty in compilation_unit.types: print(ty.name, ty.size) dbg.find_function("_ZNSi4peekEv") dbg.find_function("std::basic_istream >::peek()") dbg.find_function(0x137A70) dbg.find_variable("_ZNSt12out_of_rangeC1EPKc") dbg.find_variable("std::out_of_range::out_of_range(char const*)") dbg.find_variable(0x2773A0) dbg.find_type("my_type_t") ``` **C++** ```cpp std::unique_ptr dbg; for (const LIEF::dwarf::CompilationUnit& CU : dbg->compilation_units()) { log(Level::Info, "Producer: {}", CU.producer()); for (const LIEF::dwarf::Function& func : CU.functions()) { log(Level::Info, "name={}, linkage={}, address={}", func.name(), func.linkage_name(), std::to_string(func.address().value_or(0))); } for (const LIEF::dwarf::Variable& var : CU.variables()) { log(Level::Info, "name={}, address={}", var.name(), std::to_string(var.address().value_or(0))); } for (const LIEF::dwarf::Type& ty : CU.types()) { log(Level::Info, "name={}, size={}", ty.name().value_or(""), std::to_string(ty.size().value_or(0))); } } dbg->find_function("_ZNSi4peekEv"); dbg->find_function("std::basic_istream >::peek()"); dbg->find_function(0x137a70); dbg->find_variable("_ZNSt12out_of_rangeC1EPKc"); dbg->find_variable("std::out_of_range::out_of_range(char const*)"); dbg->find_variable(0x2773a0); ``` **Rust** ```rust let path: &Path = some_path; let dbg = lief::dwarf::load(path).unwrap_or_else(|| { process::exit(1); }); for cu in dbg.compilation_units() { println!("Producer: {}", cu.producer()); for func in cu.functions() { println!( "name={}, linkage={}, address={}", func.name(), func.linkage_name(), func.address().unwrap_or(0) ); } for var in cu.variables() { println!( "name={}, address={}", var.name(), var.address().unwrap_or(0) ); } for ty in cu.types() { println!( "name={}, size={}", ty.name().unwrap_or("".to_string()), ty.size().unwrap_or(0) ); } } dbg.function_by_name("_ZNSi4peekEv"); dbg.function_by_name("std::basic_istream >::peek()"); dbg.function_by_addr(0x137a70); dbg.variable_by_name("_ZNSt12out_of_rangeC1EPKc"); dbg.variable_by_name("std::out_of_range::out_of_range(char const*)"); dbg.variable_by_addr(0x137a70); ``` ## [Attach an external debug file]() In the case of an external DWARF file, you can bind this debug file to a `lief.abstract.Binary` ( [`lief::generic::Binary`]() ; [`lief.Binary`]() ; [`LIEF::Binary`]() ) using the `lief.abstract.Binary.load_debug_info()` ( [`lief::generic::Binary::load_debug_info`]() ; [`lief.Binary.load_debug_info()`]() ; [`LIEF::Binary::load_debug_info()`]() ) function. Here’s an example: **Python** ```python binary: lief.Binary dbg = binary.load_debug_info("/home/romain/dev/LIEF/some.dwo") ``` **C++** ```cpp std::unique_ptr binary; binary->load_debug_info("/home/romain/dev/LIEF/some.dwo"); ``` **Rust** ```rust let bin: &mut dyn lief::generic::Binary = some_bin; let path = PathBuf::from("/home/romain/dev/LIEF/some.dwo"); bin.load_debug_info(&path); ``` Use a debug file produced by the same build as the binary. Attaching it updates LIEF’s analysis object. It does not insert DWARF sections into the executable. The `lief.Binary.disassemble()` ( [`lief::generic::Binary::disassemble`]() ; [`lief::generic::Binary::disassemble_symbol`]() ; [`lief::generic::Binary::disassemble_address`]() ; [`lief::generic::Binary::disassemble_slice`]() ; [`LIEF::Binary::disassemble()`]() ; [`lief.Binary.disassemble()`]() ; [`lief.Binary.disassemble_from_bytes()`]() ) function can then resolve functions defined by that debug file while reading their machine code from the binary: **Python** ```python binary: lief.Binary binary.load_debug_info("/home/romain/dev/LIEF/some.dwo") # The location (address/size) of `my_function` is defined in some.dwo for inst in binary.disassemble("my_function"): print(inst) ``` **C++** ```cpp std::unique_ptr binary; binary->load_debug_info("/home/romain/dev/LIEF/some.dwo"); // The location (address/size) of `my_function` is defined in some.dwo for (const LIEF::assembly::Instruction& inst : binary->disassemble("my_function")) { std::cout << inst << '\n'; } ``` **Rust** ```rust let bin: &mut dyn lief::generic::Binary = some_bin; let path = PathBuf::from("/home/romain/dev/LIEF/some.dwo"); bin.load_debug_info(&path); // The location (address/size) of `my_function` is defined in some.dwo for inst in bin.disassemble_symbol("my_function") { println!("{inst}"); } ``` Additionally, you may also want to explore the [BinaryNinja]() and [Ghidra]() DWARF export plugins, which generate debug information based on the analysis performed by these frameworks. ## [Generating C/C++ Definitions]() DWARF functions, variables, types, and compilation units can be rendered as C/C++ declarations using: - `lief.dwarf.Function.to_decl()` ( [`lief::dwarf::Function::to_decl`]() ; [`lief::dwarf::Function::to_decl_with_opt`]() ; [`lief.dwarf.Function.to_decl()`]() ; [`LIEF::dwarf::Function::to_decl()`]() ) - `lief.dwarf.Variable.to_decl()` ( [`lief::dwarf::Variable::to_decl`]() ; [`lief::dwarf::Variable::to_decl_with_opt`]() ; [`lief.dwarf.Variable.to_decl()`]() ; [`LIEF::dwarf::Variable::to_decl()`]() ) - `lief.dwarf.Type.to_decl()` ( [`lief::dwarf::Type::to_decl`]() ; [`lief::dwarf::Type::to_decl_with_opt`]() ; [`lief.dwarf.Type.to_decl()`]() ; [`LIEF::dwarf::Type::to_decl()`]() ) - `lief.dwarf.CompilationUnit.to_decl()` ( [`lief::dwarf::CompilationUnit::to_decl`]() ; [`lief::dwarf::CompilationUnit::to_decl_with_opt`]() ; [`lief.dwarf.CompilationUnit.to_decl()`]() ; [`LIEF::dwarf::CompilationUnit::to_decl()`]() ) The generated output can be configured with a `lief.DeclOpt` ( [`lief::DeclOpt`]() ; [`lief.DeclOpt`]() ; [`LIEF::DeclOpt`]() ) structure (e.g. to prefer C++ syntax or change the indentation): **Python** ```python dbg = lief.dwarf.load("/bin/with_debug") func = dbg.find_function("main") print(func.to_decl()) opt = lief.DeclOpt() opt.is_cpp = True opt.indentation = 4 for cu in dbg.compilation_units: # Emit the definition of the functions of the compilation unit print(cu.to_decl(opt)) ``` **C++** ```cpp auto dbg = LIEF::dwarf::load("/bin/with_debug"); std::unique_ptr func = dbg->find_function("main"); std::cout << func->to_decl() << '\n'; LIEF::DeclOpt opt; opt.is_cpp(true).indentation(4); for (const LIEF::dwarf::CompilationUnit& CU : dbg->compilation_units()) { std::cout << CU.to_decl(opt) << '\n'; } ``` **Rust** ```rust let dbg = lief::dwarf::load("/bin/with_debug").unwrap(); if let Some(func) = dbg.function_by_name("main") { println!("{}", func.to_decl()); } let opt = lief::DeclOpt { is_cpp: true, indentation: 4, ..Default::default() }; for cu in dbg.compilation_units() { println!("{}", cu.to_decl_with_opt(&opt)); } ``` ## [DWARF Editor]() > **Editing Existing DWARF** > > LIEF does not currently support modifying an **existing** DWARF file. LIEF provides a comprehensive high-level API for programmatically creating DWARF files. This works by using the `lief.dwarf.Editor` ( [`lief::dwarf::Editor`]() ; [`lief.dwarf.Editor`]() ; [`LIEF::dwarf::Editor`]() ) interface, which can be instantiated using `lief.dwarf.Editor.from_binary()` ( [`lief::dwarf::Editor::from_binary`]() ; [`LIEF::dwarf::Editor::from_binary()`]() ; [`lief.dwarf.Editor.from_binary()`]() ): **Python** ```python pe = lief.PE.parse("demo.exe") assert isinstance(pe, lief.PE.Binary) editor = lief.dwarf.Editor.from_binary(pe) ``` **C++** ```cpp std::unique_ptr pe = LIEF::PE::Parser::parse("demo.exe"); std::unique_ptr editor = LIEF::dwarf::Editor::from_binary(*pe); ``` **Rust** ```rust let path: &Path = some_path; let mut bin = lief::pe::Binary::parse(path).unwrap(); let editor = lief::dwarf::Editor::from_binary(&mut bin); ``` Given this `lief.dwarf.Editor` ( [`lief::dwarf::Editor`]() ; [`lief.dwarf.Editor`]() ; [`LIEF::dwarf::Editor`]() ), you can create one or more `lief.dwarf.editor.CompilationUnit` ( [`lief::dwarf::editor::CompilationUnit`]() ; [`lief.dwarf.editor.CompilationUnit`]() ; [`LIEF::dwarf::editor::CompilationUnit`]() ) entries, which own various `lief.dwarf.editor.Function` ( [`lief::dwarf::editor::Function`]() ; [`lief.dwarf.editor.Function`]() ; [`LIEF::dwarf::editor::Function`]() ), `lief.dwarf.editor.Variable` ( [`lief::dwarf::editor::Variable`]() ; [`lief.dwarf.editor.Variable`]() ; [`LIEF::dwarf::editor::Variable`]() ), and `lief.dwarf.editor.Type` ( [`lief::dwarf::editor::Type`]() ; [`lief.dwarf.editor.Type`]() ; [`LIEF::dwarf::editor::Type`]() ) objects. **Python** ```python editor: lief.dwarf.Editor unit = editor.create_compilation_unit() unit.set_producer("LIEF") func = unit.create_function("hello") func.set_address(0x123) struct_ptr = unit.create_structure("my_struct_t").pointer_to() assert isinstance(struct_ptr, lief.dwarf.editor.PointerType) func.set_return_type(struct_ptr) var = func.create_stack_variable("local_var") var.set_stack_offset(8) editor.write("/tmp/out.debug") ``` **C++** ```cpp std::unique_ptr editor; std::unique_ptr unit = editor->create_compilation_unit(); unit->set_producer("LIEF"); std::unique_ptr func = unit->create_function("hello"); func->set_address(0x123); func->set_return_type(*unit->create_structure("my_struct_t")->pointer_to()); std::unique_ptr var = func->create_stack_variable("local_var"); var->set_stack_offset(8); editor->write("/tmp/out.debug"); ``` **Rust** ```rust let editor: &mut lief::dwarf::Editor = some_editor; let mut unit = editor.create_compile_unit().unwrap(); unit.set_producer("LIEF"); let mut func = unit.create_function("hello").unwrap(); func.set_address(0x123); func.set_return_type(&unit.create_structure("my_struct_t").pointer_to()); let mut var = func.create_stack_variable("local_var"); var.set_stack_offset(8); editor.write("/tmp/out.debug"); ``` > **BinaryNinja & Ghidra** > > This feature is provided as a plugin for [BinaryNinja]() and [Ghidra](). --- ## [API]() You can find the documentation of the API for the different languages here: [Python API]() [C++ API]() Rust API: [`lief::dwarf`]() --- documentID: "da6eee04e1a735b125dea00ef9639aaeafe6ea2128dc67d67a23cb81f31e6e6d" docname: "extended/dwarf/python" title: "DWARF Python API - LIEF Documentation" description: "DWARF Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/extended/dwarf/python.html" markdownURL: "https://lief.re/doc/latest/extended/dwarf/python.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "a1e6fa1cdd743d6f5c202b1a915d581c68046c546175e976204bb8f1ef6eddef" --- # [Python]() ## [` lief.dwarf.load `]() lief.dwarf.load(*path: str | os.PathLike*) → [lief.dwarf.DebugInfo]( "lief.dwarf.DebugInfo") | None Load the DWARF from the given path ## [DebugInfo]() ### [` lief.dwarf.DebugInfo `]() class lief.dwarf.DebugInfo Bases: [`DebugInfo`]( "lief._lief.DebugInfo") This class represents a DWARF debug information. It can embed different compilation units which can be accessed through [`compilation_units`]( "lief.dwarf.DebugInfo.compilation_units"). This class can be instantiated from [`lief.Binary.debug_info`]( "lief.Binary.debug_info") or [`lief.dwarf.load()`]( "lief.dwarf.load") #### [` compilation_units `]() property compilation\_units → Iterator[[lief.dwarf.CompilationUnit]( "lief.dwarf.CompilationUnit") | None] Iterator on the CompilationUnit embedded in this dwarf #### [` find_functionfind_function `]() find\_function(*self*, *name: str*) → [lief.\_lief.dwarf.Function]( "lief._lief.dwarf.Function") | None **find\_function(*self*, *addr: int*) → [lief.\_lief.dwarf.Function]( "lief._lief.dwarf.Function") | None** Overloaded function. 1. `find_function(self, name: str) -> Optional[lief._lief.dwarf.Function]` > Try to find the function with the given name (mangled or not) > > ```python > info: lief.dwarf.DebugInfo = ... > if func := info.find_function("_ZNSt6localeD1Ev"): > print("Found") > if func := info.find_function("std::locale::~locale()"): > print("Found") > ``` 2. `find_function(self, addr: int) -> Optional[lief._lief.dwarf.Function]` > Try to find the function at the given **virtual** address. #### [` find_type `]() find\_type(*self*, *name: str*) → [lief.\_lief.dwarf.Type]( "lief._lief.dwarf.Type") | None Try to find the type with the given name. #### [` find_variablefind_variable `]() find\_variable(*self*, *addr: int*) → [lief.\_lief.dwarf.Variable]( "lief._lief.dwarf.Variable") | None **find\_variable(*self*, *name: str*) → [lief.\_lief.dwarf.Variable]( "lief._lief.dwarf.Variable") | None** Overloaded function. 1. `find_variable(self, addr: int) -> Optional[lief._lief.dwarf.Variable]` > Try to find the (static) variable at the given virtual address. 2. `find_variable(self, name: str) -> Optional[lief._lief.dwarf.Variable]` > Try to find the variable with the given name. This name can be mangled or not. --- ## [CompilationUnit]() ### [` lief.dwarf.CompilationUnit `]() class lief.dwarf.CompilationUnit Bases: `object` This class represents a DWARF compilation unit #### [` Language `]() class Language Bases: `object` Languages supported by the DWARF (v5) format. See: [https://dwarfstd.org/languages.html]() Some languages (like C++11, C++17, ..) have a version (11, 17, …) which is stored in a dedicated attribute: [`version`]( "lief.dwarf.CompilationUnit.Language.version") ##### [` LANG `]() class LANG(*\*values*) Bases: `Enum` ###### [` C `]() C = 1 ###### [` COBOL `]() COBOL = 10 ###### [` CPP `]() CPP = 2 ###### [` D `]() D = 8 ###### [` DART `]() DART = 4 ###### [` FORTRAN `]() FORTRAN = 6 ###### [` JAVA `]() JAVA = 9 ###### [` MODULA `]() MODULA = 5 ###### [` RUST `]() RUST = 3 ###### [` SWIFT `]() SWIFT = 7 ###### [` UNKNOWN `]() UNKNOWN = 0 ###### [` from_value `]() from\_value(*arg: int*) → [lief.dwarf.CompilationUnit.Language.LANG]( "lief.dwarf.CompilationUnit.Language.LANG") = <nanobind.nb\_func object> ##### [` lang `]() property lang → [lief.dwarf.CompilationUnit.Language.LANG]( "lief.dwarf.CompilationUnit.Language.LANG") The language itself ##### [` version `]() property version → int Version of the language (e.g. 17 for C++17) #### [` compilation_dir `]() property compilation\_dir → str Return the path to the directory in which the compilation took place for compiling this compilation unit (e.g. `/workdir/build`) It returns an **empty** string if the entry is not present or can’t be resolved. This value matches the `DW_AT_comp_dir` attribute. #### [` find_functionfind_function `]() find\_function(*self*, *name: str*) → [lief.\_lief.dwarf.Function]( "lief._lief.dwarf.Function") | None **find\_function(*self*, *addr: int*) → [lief.\_lief.dwarf.Function]( "lief._lief.dwarf.Function") | None** Overloaded function. 1. `find_function(self, name: str) -> Optional[lief._lief.dwarf.Function]` > Try to find the function whose name is given in parameter. > > The provided name can be demangled. 2. `find_function(self, addr: int) -> Optional[lief._lief.dwarf.Function]` > Try to find the function at the given address #### [` find_variablefind_variable `]() find\_variable(*self*, *addr: int*) → [lief.\_lief.dwarf.Variable]( "lief._lief.dwarf.Variable") | None **find\_variable(*self*, *name: str*) → [lief.\_lief.dwarf.Variable]( "lief._lief.dwarf.Variable") | None** Overloaded function. 1. `find_variable(self, addr: int) -> Optional[lief._lief.dwarf.Variable]` > Try to find the variable at the given address 2. `find_variable(self, name: str) -> Optional[lief._lief.dwarf.Variable]` > Try to find the variable with the given name (mangled or not) #### [` functions `]() property functions → Iterator[[lief.dwarf.Function]( "lief.dwarf.Function") | None] Return an iterator over the functions implemented in this compilation unit. Note that this iterator only iterates over the functions that have a **concrete** implementation in the compilation unit. For instance with this code: ```cpp inline const char* get_secret_env() { return getenv("MY_SECRET_ENV"); } int main() { printf("%s", get_secret_env()); return 0; } ``` The iterator will only return **one function** for `main` since `get_secret_env` is inlined and thus, its implementation is located in `main`. #### [` high_address `]() property high\_address → int Return the highest virtual address owned by this compilation unit #### [` imported_functions `]() property imported\_functions → Iterator[[lief.dwarf.Function]( "lief.dwarf.Function") | None] Return an iterator over the functions **imported** in this compilation unit **but not** implemented. For instance with this code: ```cpp #include int main() { printf("Hello\n"); return 0; } ``` `printf` is imported from the standard libc so the function is returned by the iterator. On the other hand, `main()` is implemented in this compilation unit so it is not returned by [`imported_functions`]( "lief.dwarf.CompilationUnit.imported_functions") but [`functions`]( "lief.dwarf.CompilationUnit.functions"). #### [` language `]() property language → [lief.dwarf.CompilationUnit.Language]( "lief.dwarf.CompilationUnit.Language") Original language of this compilation unit. This value matches the `DW_AT_language` attribute. #### [` low_address `]() property low\_address → int Return the lowest virtual address owned by this compilation unit. #### [` name `]() property name → str Name of the file associated with this compilation unit (e.g. `test.cpp`) Return an **empty** string if the name is not found or can’t be resolved This value matches the `DW_AT_name` attribute. #### [` producer `]() property producer → str Information about the program (or library) that generated this compilation unit. For instance, it can output: `Debian clang version 17.0.6`. It returns an **empty** string if the producer is not present or can’t be resolved. This value matches the `DW_AT_producer` attribute. #### [` ranges `]() property ranges → list[lief.range\_t] Return a list of address ranges owned by this compilation unit. If the compilation unit owns a contiguous range, it returns **a single** range. #### [` size `]() property size → int Return the size of the compilation unit according to its range of address. If the compilation is fragmented (i.e. there are some address ranges between the lowest address and the highest that are not owned by the CU), then it returns the sum of **all** the address ranges owned by this CU. If the compilation unit is **not** fragmented, then it basically returns `high_address - low_address`. #### [` to_decl `]() to\_decl(*self*, *opt: [lief.\_lief.DeclOpt]( "lief._lief.DeclOpt") | None = None*) → str Generates a C/C++ definition for the functions defined in this compilation unit #### [` types `]() property types → Iterator[[lief.dwarf.Type]( "lief.dwarf.Type") | None] Return an iterator over the different types defined in this compilation unit. #### [` variables `]() property variables → Iterator[[lief.dwarf.Variable]( "lief.dwarf.Variable") | None] Return an iterator over the variables defined in any scope of this compilation unit: ```cpp static int A = 1; // Returned by the iterator static const char* B = "Hello"; // Returned by the iterator int get() { static int C = 2; // Returned by the iterator return C; } ``` --- ## [Function]() ### [` lief.dwarf.Function `]() class lief.dwarf.Function Bases: `object` This class represents a DWARF function which can be associated with either: `DW_TAG_subprogram` or `DW_TAG_inlined_subroutine`. #### [` address `]() property address → int | None Return the address of the function (`DW_AT_entry_pc` or `DW_AT_low_pc`) or `None` if it’s not available. #### [` debug_location `]() property debug\_location → [lief.debug\_location\_t]( "lief.debug_location_t") Original source code location. #### [` description `]() property description → str Description (`DW_AT_description`) of this function or an empty string #### [` instructions `]() property instructions → Iterator[[lief.assembly.Instruction]( "lief.assembly.Instruction") | None] Disassemble the current function by returning an iterator over the [`lief.assembly.Instruction`]( "lief.assembly.Instruction"). #### [` is_artificial `]() property is\_artificial → bool Whether this function is created by the compiler and not present in the original source code. #### [` is_external `]() property is\_external → bool Whether the function is defined **outside** the current compilation unit (`DW_AT_external`). #### [` lexical_blocks `]() property lexical\_blocks → Iterator[[lief.dwarf.LexicalBlock]( "lief.dwarf.LexicalBlock") | None] Iterator over the [`LexicalBlock`]( "lief.dwarf.LexicalBlock") owned by this function #### [` linkage_name `]() property linkage\_name → str The name of the function which is used for linking (DW\_AT\_linkage\_name). This name differs from [`name`]( "lief.dwarf.Function.name") as it is usually mangled. The function returns an empty string if the linkage name is not available. #### [` name `]() property name → str The name of the function (`DW_AT_name`) #### [` parameters `]() property parameters → list[[lief.dwarf.Parameter]( "lief.dwarf.Parameter") | None] Return the list of parameters used by this function (including template parameters) #### [` ranges `]() property ranges → list[lief.range\_t] Ranges of virtual addresses owned by this function. #### [` scope `]() property scope → [lief.dwarf.Scope]( "lief.dwarf.Scope") | None Scope in which this function is defined #### [` size `]() property size → int Return the size taken by this function in the binary. #### [` thrown_types `]() property thrown\_types → list[[lief.dwarf.Type]( "lief.dwarf.Type") | None] List of exceptions (types) that can be thrown by the function. For instance, given this Swift code: ```swift func summarize(_ ratings: [Int]) throws(StatisticsError) { // ... } ``` [`thrown_types`]( "lief.dwarf.Function.thrown_types") returns one element associated with the [`Type`]( "lief.dwarf.Type"): `StatisticsError`. #### [` to_decl `]() to\_decl(*self*, *opt: [lief.\_lief.DeclOpt]( "lief._lief.DeclOpt") | None = None*) → str Generates a C/C++ definition for this function #### [` type `]() property type → [lief.dwarf.Type]( "lief.dwarf.Type") | None Return the [`Type`]( "lief.dwarf.Type") associated with the **return type** of this function #### [` variables `]() property variables → Iterator[[lief.dwarf.Variable]( "lief.dwarf.Variable") | None] Return an iterator over the variables (`DW_TAG_variable`) defined within the scope of this function. This includes regular stack-based variables as well as static ones. --- ## [Parameter]() ### [` lief.dwarf.Parameter `]() class lief.dwarf.Parameter Bases: `object` This class represents a DWARF parameter which can be either: - A regular function parameter (see: [`parameters.Formal`]( "lief.dwarf.parameters.Formal")) - A template type parameter (see: [`parameters.TemplateType`]( "lief.dwarf.parameters.TemplateType")) - A template value parameter (see: [`parameters.TemplateValue`]( "lief.dwarf.parameters.TemplateValue")) #### [` Location `]() class Location Bases: `object` This class exposes information about the location of a parameter ##### [` Type `]() class Type(*\*values*) Bases: `Enum` ###### [` REGISTER `]() REGISTER = 1 ###### [` UNKNOWN `]() UNKNOWN = 0 ##### [` type `]() property type → [lief.dwarf.Parameter.Location.Type]( "lief.dwarf.Parameter.Location.Type") #### [` RegisterLoc `]() class RegisterLoc Bases: [`Location`]( "lief._lief.dwarf.Parameter.Location") This class represents a register location ##### [` id `]() property id → int DWARF id of the register #### [` location `]() property location → [lief.dwarf.Parameter.Location]( "lief.dwarf.Parameter.Location") | None Location of this parameter. For instance it can be a specific register that is not following the calling convention. #### [` name `]() property name → str Name of the parameter #### [` type `]() property type → [lief.dwarf.Type]( "lief.dwarf.Type") | None Type of this parameter --- ## [Formal Parameter]() ![Inheritance diagram of lief._lief.dwarf.parameters.Formal](https://lief.re/doc/latest/_images/inheritance-f2e016eb1fc821dd8b3ed0b2ac536c59c0383f58.png) ### [` lief.dwarf.parameters.Formal `]() class lief.dwarf.parameters.Formal Bases: [`Parameter`]( "lief._lief.dwarf.Parameter") This class represents a regular function parameter. For instance, given this prototype: ```cpp int main(int argc, const char** argv); ``` The function `main` has two [`Formal`]( "lief.dwarf.parameters.Formal") parameters: 1. **`argc` ([`lief.dwarf.Parameter.name`]( "lief.dwarf.Parameter.name")) typed as `int`** ([`Base`]( "lief.dwarf.types.Base") from [`lief.dwarf.Parameter.type`]( "lief.dwarf.Parameter.type")) 2. **`argv` ([`lief.dwarf.Parameter.name`]( "lief.dwarf.Parameter.name")) typed as `const char**`** ([`Const`]( "lief.dwarf.types.Const")) #### [` type `]() property type → [lief.dwarf.Type]( "lief.dwarf.Type") | None --- ## [Template Value Parameter]() ![Inheritance diagram of lief._lief.dwarf.parameters.TemplateValue](https://lief.re/doc/latest/_images/inheritance-554b5ae50cf5fec8695b5288da12d03646ac2044.png) ### [` lief.dwarf.parameters.TemplateValue `]() class lief.dwarf.parameters.TemplateValue Bases: [`Parameter`]( "lief._lief.dwarf.Parameter") This class represents a template **value** parameter. For instance, given this prototype: ```cpp template void generic(); ``` The function `generic` has one [`TemplateValue`]( "lief.dwarf.parameters.TemplateValue") parameter: `X` --- ## [Template Type Parameter]() ![Inheritance diagram of lief._lief.dwarf.parameters.TemplateType](https://lief.re/doc/latest/_images/inheritance-d671e662130bbccc372641660cb71797cb7ac4de.png) ### [` lief.dwarf.parameters.TemplateType `]() class lief.dwarf.parameters.TemplateType Bases: [`Parameter`]( "lief._lief.dwarf.Parameter") This class represents a template **type** parameter. For instance, given this prototype: ```cpp template void generic(); ``` The function `generic` has one [`TemplateType`]( "lief.dwarf.parameters.TemplateType") parameter: `Y` --- ## [Scope]() ### [` lief.dwarf.Scope `]() class lief.dwarf.Scope Bases: `object` This class materializes a scope in which [`Function`]( "lief.dwarf.Function"), [`Variable`]( "lief.dwarf.Variable"), [`Type`]( "lief.dwarf.Type"), … can be defined. #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` ##### [` CLASS `]() CLASS = 2 ##### [` COMPILATION_UNIT `]() COMPILATION\_UNIT = 6 ##### [` FUNCTION `]() FUNCTION = 5 ##### [` NAMESPACE `]() NAMESPACE = 4 ##### [` STRUCT `]() STRUCT = 3 ##### [` UNION `]() UNION = 1 ##### [` UNKNOWN `]() UNKNOWN = 0 #### [` chained `]() chained(*self*, *sep: str = '::'*) → str Represent the whole chain of all (parent) scopes using the provided separator. E.g. `ns1::ns2::Class1::Struct2::Type`. #### [` name `]() property name → str Name of the scope. For instance namespace’s name or function’s name. #### [` parent `]() property parent → [lief.dwarf.Scope]( "lief.dwarf.Scope") | None Parent scope (if any). #### [` type `]() property type → [lief.dwarf.Scope.TYPE]( "lief.dwarf.Scope.TYPE") The current scope type. --- ## [Variable]() ### [` lief.dwarf.Variable `]() class lief.dwarf.Variable Bases: `object` This class represents a DWARF variable which can be owned by a [`Function`]( "lief.dwarf.Function") or a [`CompilationUnit`]( "lief.dwarf.CompilationUnit"). #### [` address `]() property address → int | None Address of the variable. If the variable is **static**, it returns the **virtual address** where it is defined. If the variable is stack-based, it returns the **relative offset** from the frame-base register. If the address can’t be resolved, it returns `None`. #### [` debug_location `]() property debug\_location → [lief.debug\_location\_t]( "lief.debug_location_t") The original source location where the variable is defined. #### [` description `]() property description → str Description (`DW_AT_description`) of the variable or an empty string. #### [` is_constexpr `]() property is\_constexpr → bool Whether it’s a `constexpr` variable. #### [` is_stack_based `]() property is\_stack\_based → bool Whether this variable is allocated on the stack #### [` linkage_name `]() property linkage\_name → str The name of the variable which is used for linking (`DW_AT_linkage_name`). This name differs from [`name`]( "lief.dwarf.Variable.name") as it is usually mangled. The function returns an empty string if the linkage name is not available. #### [` name `]() property name → str Name of the variable (usually demangled) #### [` scope `]() property scope → [lief.dwarf.Scope]( "lief.dwarf.Scope") | None Scope in which this variable is defined #### [` size `]() property size → int | None Return the size of the variable (or a lief\_errors if it can’t be resolved). This size is defined by the type of the variable. #### [` to_decl `]() to\_decl(*self*, *opt: [lief.\_lief.DeclOpt]( "lief._lief.DeclOpt") | None = None*) → str Generates a C/C++ definition for this variable #### [` type `]() property type → [lief.dwarf.Type]( "lief.dwarf.Type") | None Return the type of this variable. --- ## [LexicalBlock]() ### [` lief.dwarf.LexicalBlock `]() class lief.dwarf.LexicalBlock Bases: `object` This class represents a DWARF lexical block (`DW_TAG_lexical_block`) #### [` addr `]() property addr → int | None Return the start address of this block #### [` description `]() property description → str Return the description associated with this lexical block or an empty string #### [` high_pc `]() property high\_pc → int | None Return the highest virtual address owned by this block. #### [` low_pc `]() property low\_pc → int | None Return the lowest virtual address owned by this block. #### [` name `]() property name → str Return the *name* associated with this lexical block or an empty string #### [` ranges `]() property ranges → list[lief.range\_t] Return a list of address ranges owned by this block. If the lexical block owns a contiguous range, it should return **a single** range. #### [` size `]() property size → int Return the size of this block as the difference of the highest address and the lowest address. #### [` sub_blocks `]() property sub\_blocks → Iterator[[lief.dwarf.LexicalBlock]( "lief.dwarf.LexicalBlock") | None] Return an iterator over the sub-LexicalBlock owned by this block. --- ## [Type]() ![Inheritance diagram of lief._lief.dwarf.types.SetTy, lief._lief.dwarf.types.Immutable, lief._lief.dwarf.types.Restrict, lief._lief.dwarf.types.Volatile, lief._lief.dwarf.types.Typedef, lief._lief.dwarf.types.Shared, lief._lief.dwarf.types.StringTy, lief._lief.dwarf.types.Packed, lief._lief.dwarf.types.Const, lief._lief.dwarf.types.File, lief._lief.dwarf.types.Atomic, lief._lief.dwarf.types.Dynamic, lief._lief.dwarf.types.Subroutine, lief._lief.dwarf.types.Array, lief._lief.dwarf.types.TemplateAlias, lief._lief.dwarf.types.Coarray, lief._lief.dwarf.types.Union, lief._lief.dwarf.types.RValueReference, lief._lief.dwarf.types.ClassLike, lief._lief.dwarf.types.Pointer, lief._lief.dwarf.types.Base, lief._lief.dwarf.Type, lief._lief.dwarf.types.PointerToMember, lief._lief.dwarf.types.Class, lief._lief.dwarf.types.Interface, lief._lief.dwarf.types.Structure, lief._lief.dwarf.types.Reference, lief._lief.dwarf.types.Enum, lief._lief.dwarf.types.Thrown](https://lief.re/doc/latest/_images/inheritance-10bd68f7520cc6eff508dc4ef4bacd6398de6767.png) ### [` lief.dwarf.Type `]() class lief.dwarf.Type Bases: `object` This class represents a DWARF Type which includes: - `DW_TAG_array_type` - `DW_TAG_const_type` - `DW_TAG_pointer_type` - `DW_TAG_structure_type` - `DW_TAG_base_type` - `DW_TAG_class_type` - `DW_TAG_enumeration_type` - `DW_TAG_string_type` - `DW_TAG_union_type` - `DW_TAG_volatile_type` - `DW_TAG_unspecified_type` - `DW_TAG_typedef` - `DW_TAG_reference_type` - `DW_TAG_subroutine_type` - `DW_TAG_ptr_to_member_type` - `DW_TAG_set_type` - `DW_TAG_packed_type` - `DW_TAG_file_type` - `DW_TAG_thrown_type` - `DW_TAG_restrict_type` - `DW_TAG_interface_type` - `DW_TAG_shared_type` - `DW_TAG_rvalue_reference_type` - `DW_TAG_template_alias` - `DW_TAG_coarray_type` - `DW_TAG_dynamic_type` - `DW_TAG_atomic_type` - `DW_TAG_immutable_type` #### [` KIND `]() class KIND(*\*values*) Bases: `Enum` ##### [` ARRAY `]() ARRAY = 5 ##### [` ATOMIC `]() ATOMIC = 26 ##### [` BASE `]() BASE = 2 ##### [` CLASS `]() CLASS = 4 ##### [` COARRAY `]() COARRAY = 24 ##### [` CONST_KIND `]() CONST\_KIND = 3 ##### [` DYNAMIC `]() DYNAMIC = 25 ##### [` ENUM `]() ENUM = 28 ##### [` FILE `]() FILE = 16 ##### [` IMMUTABLE `]() IMMUTABLE = 27 ##### [` INTERFACE `]() INTERFACE = 20 ##### [` PACKED `]() PACKED = 15 ##### [` POINTER `]() POINTER = 6 ##### [` POINTER_MEMBER `]() POINTER\_MEMBER = 14 ##### [` REF `]() REF = 10 ##### [` RESTRICT `]() RESTRICT = 19 ##### [` RVALREF `]() RVALREF = 22 ##### [` SET_TYPE `]() SET\_TYPE = 11 ##### [` SHARED `]() SHARED = 21 ##### [` STRING `]() STRING = 12 ##### [` STRUCT `]() STRUCT = 7 ##### [` SUBROUTINE `]() SUBROUTINE = 13 ##### [` TEMPLATE_ALIAS `]() TEMPLATE\_ALIAS = 23 ##### [` THROWN `]() THROWN = 17 ##### [` TYPEDEF `]() TYPEDEF = 9 ##### [` UNION `]() UNION = 8 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` UNSPECIFIED `]() UNSPECIFIED = 1 ##### [` VOLATILE `]() VOLATILE = 18 #### [` is_unspecified `]() property is\_unspecified → bool Whether this type is a `DW_TAG_unspecified_type` #### [` kind `]() property kind → [lief.dwarf.Type.KIND]( "lief.dwarf.Type.KIND") Discriminator for the type’s subclasses #### [` location `]() property location → [lief.debug\_location\_t]( "lief.debug_location_t") Return the debug location where this type is defined. #### [` name `]() property name → str | None Return the type’s name or `None` if it can’t be resolved. The name is resolved using either `DW_AT_name` or `DW_AT_picture_string`. #### [` scope `]() property scope → [lief.dwarf.Scope]( "lief.dwarf.Scope") | None Scope in which this type is defined #### [` size `]() property size → int | None Return the size of the type or `None` if it can’t be computed. This size should match the equivalent of `sizeof(Type)`. #### [` to_decl `]() to\_decl(*self*, *opt: [lief.\_lief.DeclOpt]( "lief._lief.DeclOpt") | None = None*) → str Generates a C/C++ definition for this type --- ## [Array]() ![Inheritance diagram of lief._lief.dwarf.types.Array](https://lief.re/doc/latest/_images/inheritance-6ce922b1fe3dff2a7e8e9070b451e76187cd784f.png) ### [` lief.dwarf.types.Array `]() class lief.dwarf.types.Array Bases: [`Type`]( "lief._lief.dwarf.Type") This class represents a `DW_TAG_array_type` #### [` size_info `]() property size\_info → [lief.dwarf.types.Array.size\_info\_t]( "lief.dwarf.types.Array.size_info_t") Return information about the size of this array. This size info is usually embedded in a `DW_TAG_subrange_type` DIE which is represented by the [`Array.size_info_t`]( "lief.dwarf.types.Array.size_info_t") class. #### [` size_info_t `]() class size\_info\_t Bases: `object` Class that wraps information about the dimension of this array ##### [` name `]() property name → str Name of the index (usually not relevant like `__ARRAY_SIZE_TYPE__`) ##### [` size `]() property size → int Size of the array. For instance in `uint8_t[3]`, it returns 3. ##### [` type `]() property type → [lief.dwarf.Type]( "lief.dwarf.Type") | None Type of the **index** for this array. For instance in `uint8_t[3]` the index type could be set to a `size_t`. #### [` underlying_type `]() property underlying\_type → [lief.dwarf.Type]( "lief.dwarf.Type") | None The underlying type of this array. --- ## [Base]() ![Inheritance diagram of lief._lief.dwarf.types.Base](https://lief.re/doc/latest/_images/inheritance-d8ffdbf34eb597bcaa9671ecd7dbcdd3d26003e3.png) ### [` lief.dwarf.types.Base `]() class lief.dwarf.types.Base Bases: [`Type`]( "lief._lief.dwarf.Type") This class wraps the `DW_TAG_base_type` type which can be used – for instance – to represent integers or primitive types. #### [` ENCODING `]() class ENCODING(*\*values*) Bases: `Enum` ##### [` ADDRESS `]() ADDRESS = 7 ##### [` BOOLEAN `]() BOOLEAN = 6 ##### [` FLOAT `]() FLOAT = 5 ##### [` NONE `]() NONE = 0 ##### [` SIGNED `]() SIGNED = 1 ##### [` SIGNED_CHAR `]() SIGNED\_CHAR = 2 ##### [` UNSIGNED `]() UNSIGNED = 3 ##### [` UNSIGNED_CHAR `]() UNSIGNED\_CHAR = 4 #### [` encoding `]() property encoding → [lief.dwarf.types.Base.ENCODING]( "lief.dwarf.types.Base.ENCODING") Describe how the base type is encoded and should be interpreted. --- ## [ClassLike]() ![Inheritance diagram of lief._lief.dwarf.types.Packed, lief._lief.dwarf.types.Class, lief._lief.dwarf.types.Union, lief._lief.dwarf.types.Structure, lief._lief.dwarf.types.ClassLike](https://lief.re/doc/latest/_images/inheritance-901bf25f0f9d7f342b11b3cf750780bb19e0fd60.png) ### [` lief.dwarf.types.ClassLike `]() class lief.dwarf.types.ClassLike Bases: [`Type`]( "lief._lief.dwarf.Type") This class abstracts a DWARF aggregate (`DW_TAG_structure_type`, `DW_TAG_class_type`, `DW_TAG_union_type`). #### [` Member `]() class Member Bases: `object` This class represents a class/struct/union attribute. ##### [` bit_offset `]() property bit\_offset → int | None Offset of the current member in **bits** in the current struct/union/class This function differs from [`offset`]( "lief.dwarf.types.ClassLike.Member.offset") for aggregates using bit-field declaration: ```cpp struct S { int flag : 4; int opt : 1 }; ``` Usually, `offset * 8 == bit_offset` If the offset can’t be resolved it returns None ##### [` bit_size `]() property bit\_size → int | None If the current member is a bit-field, this function returns its size in bits. ##### [` is_declaration `]() property is\_declaration → bool ##### [` is_external `]() property is\_external → bool ##### [` name `]() property name → str Name of the member ##### [` offset `]() property offset → int | None Offset of the current member in the struct/union/class If the offset can’t be resolved it returns None ##### [` type `]() property type → [lief.dwarf.Type]( "lief.dwarf.Type") | None Type of the current member #### [` find_member `]() find\_member(*self*, *offset: int*) → [lief.\_lief.dwarf.types.ClassLike.Member]( "lief._lief.dwarf.types.ClassLike.Member") | None Try to find the attribute at the given offset #### [` functions `]() property functions → Iterator[[lief.dwarf.Function]( "lief.dwarf.Function") | None] Iterator over the functions defined by the class-like. #### [` members `]() property members → list[[lief.dwarf.types.ClassLike.Member]( "lief.dwarf.types.ClassLike.Member")] Return a list of all the members defined in this class-like type. --- ## [Structure]() ![Inheritance diagram of lief._lief.dwarf.types.Structure](https://lief.re/doc/latest/_images/inheritance-999c0fffa7219a6e4e48b9dcbc9b54df8f20ba47.png) ### [` lief.dwarf.types.Structure `]() class lief.dwarf.types.Structure Bases: [`ClassLike`]( "lief._lief.dwarf.types.ClassLike") This class represents a DWARF `struct` type (`DW_TAG_structure_type`) --- ## [Class]() ![Inheritance diagram of lief._lief.dwarf.types.Class](https://lief.re/doc/latest/_images/inheritance-41b3c31bd88fba7aeaba6b9486fc804ad3932b7b.png) ### [` lief.dwarf.types.Class `]() class lief.dwarf.types.Class Bases: [`ClassLike`]( "lief._lief.dwarf.types.ClassLike") This class represents a DWARF `class` type (`DW_TAG_class_type`) --- ## [Union]() ![Inheritance diagram of lief._lief.dwarf.types.Union](https://lief.re/doc/latest/_images/inheritance-1aa355fea5427ba4b7af7328ca66a1c294dc6002.png) ### [` lief.dwarf.types.Union `]() class lief.dwarf.types.Union Bases: [`ClassLike`]( "lief._lief.dwarf.types.ClassLike") This class represents a DWARF `union` type (`DW_TAG_union_type`) --- ## [Packed]() ![Inheritance diagram of lief._lief.dwarf.types.Packed](https://lief.re/doc/latest/_images/inheritance-27ec89795bb2bd753ba45a94b84fc978574cfd9f.png) ### [` lief.dwarf.types.Packed `]() class lief.dwarf.types.Packed Bases: [`ClassLike`]( "lief._lief.dwarf.types.ClassLike") This class represents a DWARF `packed` type (`DW_TAG_packed_type`) --- ## [Const]() ![Inheritance diagram of lief._lief.dwarf.types.Const](https://lief.re/doc/latest/_images/inheritance-cd0a938f02d947de77366d24eb8ef87888c22cec.png) ### [` lief.dwarf.types.Const `]() class lief.dwarf.types.Const Bases: [`Type`]( "lief._lief.dwarf.Type") This class represents a `DW_TAG_const_type` modifier #### [` underlying_type `]() property underlying\_type → [lief.dwarf.Type]( "lief.dwarf.Type") | None The underlying type being const-ed by this type. --- ## [Pointer]() ![Inheritance diagram of lief._lief.dwarf.types.Pointer](https://lief.re/doc/latest/_images/inheritance-1fd3b7512c007f6e93252cb7427326e903b132ea.png) ### [` lief.dwarf.types.Pointer `]() class lief.dwarf.types.Pointer Bases: [`Type`]( "lief._lief.dwarf.Type") This class represents a `DW_TAG_pointer_type` DWARF type. #### [` underlying_type `]() property underlying\_type → [lief.dwarf.Type]( "lief.dwarf.Type") | None The type pointed by this pointer --- ## [Typedef]() ![Inheritance diagram of lief._lief.dwarf.types.Typedef](https://lief.re/doc/latest/_images/inheritance-9a42caeec18099b5af355aac81e0cc204a80b314.png) ### [` lief.dwarf.types.Typedef `]() class lief.dwarf.types.Typedef Bases: [`Type`]( "lief._lief.dwarf.Type") This class represents a `DW_TAG_typedef` type #### [` underlying_type `]() property underlying\_type → [lief.dwarf.Type]( "lief.dwarf.Type") | None The type aliased by this typedef --- ## [Atomic]() ![Inheritance diagram of lief._lief.dwarf.types.Atomic](https://lief.re/doc/latest/_images/inheritance-7668e1b8e85b1386f056aa57394047453e7f0f0f.png) ### [` lief.dwarf.types.Atomic `]() class lief.dwarf.types.Atomic Bases: [`Type`]( "lief._lief.dwarf.Type") This class represents the `DW_TAG_atomic_type` type #### [` underlying_type `]() property underlying\_type → [lief.dwarf.Type]( "lief.dwarf.Type") | None The underlying type being atomized by this type. --- ## [Coarray]() ![Inheritance diagram of lief._lief.dwarf.types.Coarray](https://lief.re/doc/latest/_images/inheritance-269543660c3651e327c68884334be53f8011b799.png) ### [` lief.dwarf.types.Coarray `]() class lief.dwarf.types.Coarray Bases: [`Type`]( "lief._lief.dwarf.Type") This class represents the `DW_TAG_coarray_type` type --- ## [Dynamic]() ![Inheritance diagram of lief._lief.dwarf.types.Dynamic](https://lief.re/doc/latest/_images/inheritance-7d57654c41fa79a4cfb8d9c06fd8ccb6fd8d8c43.png) ### [` lief.dwarf.types.Dynamic `]() class lief.dwarf.types.Dynamic Bases: [`Type`]( "lief._lief.dwarf.Type") This class represents the `DW_TAG_dynamic_type` type --- ## [Enum]() ![Inheritance diagram of lief._lief.dwarf.types.Enum](https://lief.re/doc/latest/_images/inheritance-aa88704fc5855a26549755e96298c266c831d712.png) ### [` lief.dwarf.types.Enum `]() class lief.dwarf.types.Enum Bases: [`Type`]( "lief._lief.dwarf.Type") This class represents the `DW_TAG_enumeration_type` type #### [` Entry `]() class Entry Bases: `object` This class represents an enum entry which is essentially composed of a name and its value (integer). ##### [` name `]() property name → str Enum entry’s name ##### [` value `]() property value → int | None Enum entry’s value #### [` entries `]() property entries → list[[lief.dwarf.types.Enum.Entry]( "lief.dwarf.types.Enum.Entry")] Entries associated with this enum #### [` find_entry `]() find\_entry(*self*, *value: int*) → [lief.\_lief.dwarf.types.Enum.Entry]( "lief._lief.dwarf.types.Enum.Entry") | None Try to find the entry matching the given value #### [` underlying_type `]() property underlying\_type → [lief.dwarf.Type]( "lief.dwarf.Type") | None The underlying type that is used to encode this enum --- ## [File]() ![Inheritance diagram of lief._lief.dwarf.types.File](https://lief.re/doc/latest/_images/inheritance-af2a798dfa780c5d533d14e56cf06f1d0ff25bc7.png) ### [` lief.dwarf.types.File `]() class lief.dwarf.types.File Bases: [`Type`]( "lief._lief.dwarf.Type") This class represents the `DW_TAG_file_type` type --- ## [Immutable]() ![Inheritance diagram of lief._lief.dwarf.types.Immutable](https://lief.re/doc/latest/_images/inheritance-ff920a83ae3204da861287023bf8c0ae373f047f.png) ### [` lief.dwarf.types.Immutable `]() class lief.dwarf.types.Immutable Bases: [`Type`]( "lief._lief.dwarf.Type") This class represents the `DW_TAG_immutable_type` type #### [` underlying_type `]() property underlying\_type → [lief.dwarf.Type]( "lief.dwarf.Type") | None The underlying type. --- ## [Interface]() ![Inheritance diagram of lief._lief.dwarf.types.Interface](https://lief.re/doc/latest/_images/inheritance-c762b00b8e57002c42592f0d4ab5babe91144ca6.png) ### [` lief.dwarf.types.Interface `]() class lief.dwarf.types.Interface Bases: [`Type`]( "lief._lief.dwarf.Type") This class represents the `DW_TAG_interface_type` type --- ## [PointerToMember]() ![Inheritance diagram of lief._lief.dwarf.types.PointerToMember](https://lief.re/doc/latest/_images/inheritance-bbf9a1be06d59cba9a90c0721ff1a31f03199884.png) ### [` lief.dwarf.types.PointerToMember `]() class lief.dwarf.types.PointerToMember Bases: [`Type`]( "lief._lief.dwarf.Type") This class represents the `DW_TAG_ptr_to_member_type` type #### [` containing_type `]() property containing\_type → [lief.dwarf.Type]( "lief.dwarf.Type") | None The type that embeds this member. #### [` underlying_type `]() property underlying\_type → [lief.dwarf.Type]( "lief.dwarf.Type") | None The type of the member referenced by this pointer. --- ## [RValueReference]() ![Inheritance diagram of lief._lief.dwarf.types.RValueReference](https://lief.re/doc/latest/_images/inheritance-21da2b079d5e3ebc5d6a097c90bd2bba85faf8a4.png) ### [` lief.dwarf.types.RValueReference `]() class lief.dwarf.types.RValueReference Bases: [`Type`]( "lief._lief.dwarf.Type") This class represents the `DW_TAG_rvalue_reference_type` type #### [` underlying_type `]() property underlying\_type → [lief.dwarf.Type]( "lief.dwarf.Type") | None The underlying type referenced by this rvalue-type. --- ## [Reference]() ![Inheritance diagram of lief._lief.dwarf.types.Reference](https://lief.re/doc/latest/_images/inheritance-7157d01982f302f46b9dae20d1220c9c71dbb33d.png) ### [` lief.dwarf.types.Reference `]() class lief.dwarf.types.Reference Bases: [`Type`]( "lief._lief.dwarf.Type") This class represents the `DW_TAG_reference_type` type #### [` underlying_type `]() property underlying\_type → [lief.dwarf.Type]( "lief.dwarf.Type") | None The underlying type referenced by this ref-type. --- ## [Restrict]() ![Inheritance diagram of lief._lief.dwarf.types.Restrict](https://lief.re/doc/latest/_images/inheritance-7e0ad1f08140f78c942bc7d6cf19b6dc4915941d.png) ### [` lief.dwarf.types.Restrict `]() class lief.dwarf.types.Restrict Bases: [`Type`]( "lief._lief.dwarf.Type") This class represents the `DW_TAG_restrict_type` type #### [` underlying_type `]() property underlying\_type → [lief.dwarf.Type]( "lief.dwarf.Type") | None The underlying type referenced by this restrict-type. --- ## [SetTy]() ![Inheritance diagram of lief._lief.dwarf.types.SetTy](https://lief.re/doc/latest/_images/inheritance-dbf89b14c90b21285de5b22cb8ebf0a19c578dec.png) ### [` lief.dwarf.types.SetTy `]() class lief.dwarf.types.SetTy Bases: [`Type`]( "lief._lief.dwarf.Type") This class represents the `DW_TAG_set_type` type #### [` underlying_type `]() property underlying\_type → [lief.dwarf.Type]( "lief.dwarf.Type") | None The underlying type referenced by this set-type. --- ## [Shared]() ![Inheritance diagram of lief._lief.dwarf.types.Shared](https://lief.re/doc/latest/_images/inheritance-01d6ce3c3378ef60b6360547990052b05623fdd8.png) ### [` lief.dwarf.types.Shared `]() class lief.dwarf.types.Shared Bases: [`Type`]( "lief._lief.dwarf.Type") This class represents the `DW_TAG_shared_type` type #### [` underlying_type `]() property underlying\_type → [lief.dwarf.Type]( "lief.dwarf.Type") | None The underlying type referenced by this shared-type. --- ## [StringTy]() ![Inheritance diagram of lief._lief.dwarf.types.StringTy](https://lief.re/doc/latest/_images/inheritance-8f6224ba15016ce2d7a480920be6acd8b64752a2.png) ### [` lief.dwarf.types.StringTy `]() class lief.dwarf.types.StringTy Bases: [`Type`]( "lief._lief.dwarf.Type") This class represents the `DW_TAG_string_type` type --- ## [Subroutine]() ![Inheritance diagram of lief._lief.dwarf.types.Subroutine](https://lief.re/doc/latest/_images/inheritance-410dbf21b69ec1842f13d80503e6082fe82f39e9.png) ### [` lief.dwarf.types.Subroutine `]() class lief.dwarf.types.Subroutine Bases: [`Type`]( "lief._lief.dwarf.Type") This class represents the `DW_TAG_subroutine_type` type #### [` parameters `]() property parameters → list[[lief.dwarf.Parameter]( "lief.dwarf.Parameter") | None] Parameters of this subroutine #### [` return_type `]() property return\_type → [lief.dwarf.Type]( "lief.dwarf.Type") | None Return the [`Type`]( "lief.dwarf.Type") associated with the **return type** of this function --- ## [TemplateAlias]() ![Inheritance diagram of lief._lief.dwarf.types.TemplateAlias](https://lief.re/doc/latest/_images/inheritance-bf90b7a9e6da29dfc8b0c2a1277194049c8c9646.png) ### [` lief.dwarf.types.TemplateAlias `]() class lief.dwarf.types.TemplateAlias Bases: [`Type`]( "lief._lief.dwarf.Type") This class represents the `DW_TAG_template_alias` type #### [` parameters `]() property parameters → list[[lief.dwarf.Parameter]( "lief.dwarf.Parameter") | None] Parameters associated with the underlying template #### [` underlying_type `]() property underlying\_type → [lief.dwarf.Type]( "lief.dwarf.Type") | None The underlying type aliased by this type. --- ## [Thrown]() ![Inheritance diagram of lief._lief.dwarf.types.Thrown](https://lief.re/doc/latest/_images/inheritance-9326ac8be9be28084d0a85ea250bbdfa41ea69d6.png) ### [` lief.dwarf.types.Thrown `]() class lief.dwarf.types.Thrown Bases: [`Type`]( "lief._lief.dwarf.Type") This class represents a `DW_TAG_thrown_type` #### [` underlying_type `]() property underlying\_type → [lief.dwarf.Type]( "lief.dwarf.Type") | None The underlying type being thrown --- ## [Volatile]() ![Inheritance diagram of lief._lief.dwarf.types.Volatile](https://lief.re/doc/latest/_images/inheritance-dfc25b7752375a26e42309275c9a1d87c5e64107.png) ### [` lief.dwarf.types.Volatile `]() class lief.dwarf.types.Volatile Bases: [`Type`]( "lief._lief.dwarf.Type") This class represents a `DW_TAG_volatile_type` #### [` underlying_type `]() property underlying\_type → [lief.dwarf.Type]( "lief.dwarf.Type") | None The underlying type. --- ## [Editor]() ### [` lief.dwarf.Editor `]() class lief.dwarf.Editor Bases: `object` This class exposes the main API to create DWARF information #### [` ARCH `]() class ARCH(*\*values*) Bases: `Enum` ##### [` AARCH64 `]() AARCH64 = 3 ##### [` ARM `]() ARM = 4 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` X64 `]() X64 = 1 ##### [` X86 `]() X86 = 2 #### [` FORMAT `]() class FORMAT(*\*values*) Bases: `Enum` ##### [` ELF `]() ELF = 0 ##### [` MACHO `]() MACHO = 1 ##### [` PE `]() PE = 2 #### [` create `]() create(*fmt: [lief.dwarf.Editor.FORMAT]( "lief.dwarf.Editor.FORMAT")*, *arch: [lief.dwarf.Editor.ARCH]( "lief.dwarf.Editor.ARCH")*) → [lief.dwarf.Editor]( "lief.dwarf.Editor") | None = <nanobind.nb\_func object> #### [` create_compilation_unit `]() create\_compilation\_unit(*self*) → [lief.\_lief.dwarf.editor.CompilationUnit]( "lief._lief.dwarf.editor.CompilationUnit") | None Create a new compilation unit #### [` from_binary `]() from\_binary(*bin: [lief.Binary]( "lief.Binary")*) → [lief.dwarf.Editor]( "lief.dwarf.Editor") | None = <nanobind.nb\_func object> #### [` write `]() write(*self*, *output: str | os.PathLike*) → None Write the DWARF file to the specified output --- ## [Editor - CompilationUnit]() ### [` lief.dwarf.editor.CompilationUnit `]() class lief.dwarf.editor.CompilationUnit Bases: `object` This class represents an **editable** DWARF compilation unit #### [` create_array `]() create\_array(*self*, *name: str*, *ty: [lief.\_lief.dwarf.editor.Type]( "lief._lief.dwarf.editor.Type")*, *count: int*) → [lief.\_lief.dwarf.editor.ArrayType]( "lief._lief.dwarf.editor.ArrayType") | None Create an array type with the given name, type and size. #### [` create_base_type `]() create\_base\_type(*self*, *name: str*, *size: int*, *encoding: [lief.\_lief.dwarf.editor.BaseType.ENCODING]( "lief._lief.dwarf.editor.BaseType.ENCODING") = ENCODING.NONE*) → [lief.\_lief.dwarf.editor.BaseType]( "lief._lief.dwarf.editor.BaseType") | None Create a primitive type with the given name and size. #### [` create_enum `]() create\_enum(*self*, *name: str*) → [lief.\_lief.dwarf.editor.EnumType]( "lief._lief.dwarf.editor.EnumType") | None Create an enum type (`DW_TAG_enumeration_type`) #### [` create_function `]() create\_function(*self*, *name: str*) → [lief.\_lief.dwarf.editor.Function]( "lief._lief.dwarf.editor.Function") | None Create a new function owned by this compilation unit #### [` create_function_type `]() create\_function\_type(*self*, *name: str*) → [lief.\_lief.dwarf.editor.FunctionType]( "lief._lief.dwarf.editor.FunctionType") | None Create a function type with the given name. #### [` create_generic_type `]() create\_generic\_type(*self*, *name: str*) → [lief.\_lief.dwarf.editor.Type]( "lief._lief.dwarf.editor.Type") | None Create a `DW_TAG_unspecified_type` type with the given name #### [` create_pointer_type `]() create\_pointer\_type(*self*, *ty: [lief.\_lief.dwarf.editor.Type]( "lief._lief.dwarf.editor.Type")*) → [lief.\_lief.dwarf.editor.PointerType]( "lief._lief.dwarf.editor.PointerType") | None Create a pointer on the provided type. #### [` create_structure `]() create\_structure(*self*, *name: str*, *kind: [lief.\_lief.dwarf.editor.StructType.TYPE]( "lief._lief.dwarf.editor.StructType.TYPE") = TYPE.STRUCT*) → [lief.\_lief.dwarf.editor.StructType]( "lief._lief.dwarf.editor.StructType") | None Create a struct-like type (struct, class, union) with the given name #### [` create_typedef `]() create\_typedef(*self*, *name: str*, *ty: [lief.\_lief.dwarf.editor.Type]( "lief._lief.dwarf.editor.Type")*) → [lief.\_lief.dwarf.editor.TypeDef]( "lief._lief.dwarf.editor.TypeDef") | None Create a typedef with the name provided in the first parameter which aliases the type provided in the second parameter #### [` create_variable `]() create\_variable(*self*, *name: str*) → [lief.\_lief.dwarf.editor.Variable]( "lief._lief.dwarf.editor.Variable") | None Create a new **global** variable owned by this compilation unit #### [` create_void_type `]() create\_void\_type(*self*) → [lief.\_lief.dwarf.editor.Type]( "lief._lief.dwarf.editor.Type") | None Create a `void` type #### [` set_producer `]() set\_producer(*self*, *arg: str*, */*) → [lief.\_lief.dwarf.editor.CompilationUnit]( "lief._lief.dwarf.editor.CompilationUnit") Set the `DW_AT_producer` producer attribute. This attribute aims to inform about the program that generated this compilation unit (e.g. `LIEF Extended`) --- ## [Editor - Function]() ### [` lief.dwarf.editor.Function `]() class lief.dwarf.editor.Function Bases: `object` This class represents an **editable** DWARF function (`DW_TAG_subprogram`) #### [` Label `]() class Label Bases: `object` This class mirrors the `DW_TAG_label` DWARF tag #### [` LexicalBlock `]() class LexicalBlock Bases: `object` This class mirrors the `DW_TAG_lexical_block` DWARF tag ##### [` add_blockadd_block `]() add\_block(*self*, *start: int*, *end: int*) → [lief.\_lief.dwarf.editor.Function.LexicalBlock]( "lief._lief.dwarf.editor.Function.LexicalBlock") | None **add\_block(*self*, *range: collections.abc.Sequence[[lief.\_lief.dwarf.editor.Function.range\_t]( "lief._lief.dwarf.editor.Function.range_t")]*) → [lief.\_lief.dwarf.editor.Function.LexicalBlock]( "lief._lief.dwarf.editor.Function.LexicalBlock") | None** Overloaded function. 1. `add_block(self, start: int, end: int) -> Optional[lief._lief.dwarf.editor.Function.LexicalBlock]` > Create a sub-block with the given low/high addresses. > > If the function managed to create the new block, it returns the newly created block, otherwise it returns the current block 2. `add_block(self, range: collections.abc.Sequence[lief._lief.dwarf.editor.Function.range_t]) -> Optional[lief._lief.dwarf.editor.Function.LexicalBlock]` > Create a sub-block with the given range of addresses. > > If the function managed to create the new block, it returns the newly created block, otherwise it returns the current block ##### [` add_description `]() add\_description(*self*, *description: str*) → [lief.\_lief.dwarf.editor.Function.LexicalBlock]( "lief._lief.dwarf.editor.Function.LexicalBlock") Create a `DW_AT_description` entry with the description provided in parameter. ##### [` add_name `]() add\_name(*self*, *name: str*) → [lief.\_lief.dwarf.editor.Function.LexicalBlock]( "lief._lief.dwarf.editor.Function.LexicalBlock") Create a `DW_AT_name` entry to associate a name to this entry #### [` Parameter `]() class Parameter Bases: `object` This class represents a parameter of the current function (`DW_TAG_formal_parameter`) ##### [` assign_registerassign_register `]() assign\_register(*self*, *arg: str*, */*) → [lief.\_lief.dwarf.editor.Function.Parameter]( "lief._lief.dwarf.editor.Function.Parameter") **assign\_register(*self*, *arg: int*, */*) → [lief.\_lief.dwarf.editor.Function.Parameter]( "lief._lief.dwarf.editor.Function.Parameter")** Overloaded function. 1. `assign_register(self, arg: str, /) -> lief._lief.dwarf.editor.Function.Parameter` Assign this parameter to a specific named register. 2. `assign_register(self, arg: int, /) -> lief._lief.dwarf.editor.Function.Parameter` Assign this parameter to the given DWARF register id (e.g. `DW_OP_reg0`) #### [` add_description `]() add\_description(*self*, *description: str*) → [lief.\_lief.dwarf.editor.Function]( "lief._lief.dwarf.editor.Function") Create a DW\_AT\_description entry with the description provided in parameter. #### [` add_label `]() add\_label(*self*, *addr: int*, *label: str*) → [lief.\_lief.dwarf.editor.Function.Label]( "lief._lief.dwarf.editor.Function.Label") | None Add a label at the given address #### [` add_lexical_block `]() add\_lexical\_block(*self*, *start: int*, *end: int*) → [lief.\_lief.dwarf.editor.Function.LexicalBlock]( "lief._lief.dwarf.editor.Function.LexicalBlock") | None Add a lexical block with the given range #### [` add_parameter `]() add\_parameter(*self*, *name: str*, *type: [lief.\_lief.dwarf.editor.Type]( "lief._lief.dwarf.editor.Type")*) → [lief.\_lief.dwarf.editor.Function.Parameter]( "lief._lief.dwarf.editor.Function.Parameter") | None Add a parameter to the current function #### [` create_stack_variable `]() create\_stack\_variable(*self*, *name: str*) → [lief.\_lief.dwarf.editor.Variable]( "lief._lief.dwarf.editor.Variable") | None Create a stack-based variable owned by the current function #### [` range_trange_t `]() class range\_t(*self*) **class range\_t(*self*, *start: int*, *end: int*)** Bases: `object` ##### [` end `]() property end → int ##### [` start `]() property start → int #### [` set_address `]() set\_address(*self*, *addr: int*) → [lief.\_lief.dwarf.editor.Function]( "lief._lief.dwarf.editor.Function") Set the address of this function by defining `DW_AT_entry_pc` #### [` set_external `]() set\_external(*self*) → [lief.\_lief.dwarf.editor.Function]( "lief._lief.dwarf.editor.Function") Set the function as external by defining `DW_AT_external` to true. This means that the function is **imported** by the current compilation unit. #### [` set_low_high `]() set\_low\_high(*self*, *low: int*, *high: int*) → [lief.\_lief.dwarf.editor.Function]( "lief._lief.dwarf.editor.Function") Set the upper and lower bound addresses for this function. This assumes that the function is contiguous between `low` and `high`. Underneath, the function defines `DW_AT_low_pc` and `DW_AT_high_pc` #### [` set_ranges `]() set\_ranges(*self*, *ranges: collections.abc.Sequence[[lief.\_lief.dwarf.editor.Function.range\_t]( "lief._lief.dwarf.editor.Function.range_t")]*) → [lief.\_lief.dwarf.editor.Function]( "lief._lief.dwarf.editor.Function") Set the ranges of addresses owned by the implementation of this function by setting the `DW_AT_ranges` attribute. This setter should be used for non-contiguous functions. #### [` set_return_type `]() set\_return\_type(*self*, *type: [lief.\_lief.dwarf.editor.Type]( "lief._lief.dwarf.editor.Type")*) → [lief.\_lief.dwarf.editor.Function]( "lief._lief.dwarf.editor.Function") Set the return type of this function --- ## [Editor - Variable]() ### [` lief.dwarf.editor.Variable `]() class lief.dwarf.editor.Variable Bases: `object` This class represents an **editable** DWARF variable which can be scoped by a function or a compilation unit (`DW_TAG_variable`) #### [` add_description `]() add\_description(*self*, *description: str*) → [lief.\_lief.dwarf.editor.Variable]( "lief._lief.dwarf.editor.Variable") Create a `DW_AT_description` entry with the description provided in parameter. #### [` set_addr `]() set\_addr(*self*, *addr: int*) → [lief.\_lief.dwarf.editor.Variable]( "lief._lief.dwarf.editor.Variable") Set the global address of this variable. Setting this address is only relevant in the case of a static global variable. For stack variable, you should use [`set_stack_offset()`]( "lief.dwarf.editor.Variable.set_stack_offset"). This function sets the `DW_AT_location` attribute #### [` set_external `]() set\_external(*self*) → [lief.\_lief.dwarf.editor.Variable]( "lief._lief.dwarf.editor.Variable") Mark this variable as **imported** #### [` set_stack_offset `]() set\_stack\_offset(*self*, *offset: int*) → [lief.\_lief.dwarf.editor.Variable]( "lief._lief.dwarf.editor.Variable") Set the stack offset of this variable. This function sets the `DW_AT_location` attribute #### [` set_type `]() set\_type(*self*, *type: [lief.\_lief.dwarf.editor.Type]( "lief._lief.dwarf.editor.Type")*) → [lief.\_lief.dwarf.editor.Variable]( "lief._lief.dwarf.editor.Variable") Set the type of the current variable --- ## [Editor - Type]() ![Inheritance diagram of lief._lief.dwarf.editor.TypeDef, lief._lief.dwarf.editor.PointerType, lief._lief.dwarf.editor.ArrayType, lief._lief.dwarf.editor.BaseType, lief._lief.dwarf.editor.Type, lief._lief.dwarf.editor.StructType, lief._lief.dwarf.editor.EnumType, lief._lief.dwarf.editor.FunctionType](https://lief.re/doc/latest/_images/inheritance-39e677ff46516e48de357c88e65c89a08b8729b5.png) ### [` lief.dwarf.editor.Type `]() class lief.dwarf.editor.Type Bases: `object` This class is the base class for any types created when editing DWARF debug info. A type is owned by a [`lief.dwarf.editor.CompilationUnit`]( "lief.dwarf.editor.CompilationUnit") and should be created from this class. #### [` pointer_to `]() pointer\_to(*self*) → [lief.\_lief.dwarf.editor.PointerType]( "lief._lief.dwarf.editor.PointerType") | None Create a pointer type pointing to this type --- ## [Editor - PointerType]() ![Inheritance diagram of lief._lief.dwarf.editor.PointerType](https://lief.re/doc/latest/_images/inheritance-ce1dd7b1cb8b04ead5f0ce1bdbd71aa160f8ba9a.png) ### [` lief.dwarf.editor.PointerType `]() class lief.dwarf.editor.PointerType Bases: [`Type`]( "lief._lief.dwarf.editor.Type") This class represents a pointer to another type. --- ## [Editor - EnumType]() ![Inheritance diagram of lief._lief.dwarf.editor.EnumType](https://lief.re/doc/latest/_images/inheritance-bbb4f7a814cd8cc5c586d22c490afa2fbdd1eae3.png) ### [` lief.dwarf.editor.EnumType `]() class lief.dwarf.editor.EnumType Bases: [`Type`]( "lief._lief.dwarf.editor.Type") This class represents an editable enum type (`DW_TAG_enumeration_type`) #### [` Value `]() class Value Bases: `object` This class represents an enum value #### [` add_value `]() add\_value(*self*, *name: str*, *value: int*) → [lief.\_lief.dwarf.editor.EnumType.Value]( "lief._lief.dwarf.editor.EnumType.Value") | None Add an enum value by specifying its name and its integer value. #### [` set_size `]() set\_size(*self*, *size: int*) → [lief.\_lief.dwarf.editor.EnumType]( "lief._lief.dwarf.editor.EnumType") Define the number of bytes required to hold an instance of the enumeration (`DW_AT_byte_size`). #### [` set_underlying_type `]() set\_underlying\_type(*self*, *type: [lief.\_lief.dwarf.editor.Type]( "lief._lief.dwarf.editor.Type")*) → [lief.\_lief.dwarf.editor.EnumType]( "lief._lief.dwarf.editor.EnumType") Set the underlying type that is used to encode this enum --- ## [Editor - BaseType]() ![Inheritance diagram of lief._lief.dwarf.editor.BaseType](https://lief.re/doc/latest/_images/inheritance-a4e5ad00b431fcf83beda98de36dc078ab146d4e.png) ### [` lief.dwarf.editor.BaseType `]() class lief.dwarf.editor.BaseType Bases: [`Type`]( "lief._lief.dwarf.editor.Type") This class represents a primitive type like `int, char`. #### [` ENCODING `]() class ENCODING(*\*values*) Bases: `Enum` ##### [` ADDRESS `]() ADDRESS = 1 ##### [` BOOLEAN `]() BOOLEAN = 6 ##### [` FLOAT `]() FLOAT = 7 ##### [` NONE `]() NONE = 0 ##### [` SIGNED `]() SIGNED = 2 ##### [` SIGNED_CHAR `]() SIGNED\_CHAR = 3 ##### [` UNSIGNED `]() UNSIGNED = 4 ##### [` UNSIGNED_CHAR `]() UNSIGNED\_CHAR = 5 --- ## [Editor - ArrayType]() ![Inheritance diagram of lief._lief.dwarf.editor.ArrayType](https://lief.re/doc/latest/_images/inheritance-e6359324e7bd09fc52483d91c6477ff4321b8dbd.png) ### [` lief.dwarf.editor.ArrayType `]() class lief.dwarf.editor.ArrayType Bases: [`Type`]( "lief._lief.dwarf.editor.Type") This class represents an array type. --- ## [Editor - FunctionType]() ![Inheritance diagram of lief._lief.dwarf.editor.FunctionType](https://lief.re/doc/latest/_images/inheritance-a15d85bb5a4fbf211cf5310c2577804ba283c621.png) ### [` lief.dwarf.editor.FunctionType `]() class lief.dwarf.editor.FunctionType Bases: [`Type`]( "lief._lief.dwarf.editor.Type") This class represents a function type (`DW_TAG_subroutine_type`) #### [` Parameter `]() class Parameter Bases: `object` This class represents a function’s parameter #### [` add_parameter `]() add\_parameter(*self*, *type: [lief.\_lief.dwarf.editor.Type]( "lief._lief.dwarf.editor.Type")*) → [lief.\_lief.dwarf.editor.FunctionType.Parameter]( "lief._lief.dwarf.editor.FunctionType.Parameter") | None Add a parameter #### [` set_return_type `]() set\_return\_type(*self*, *type: [lief.\_lief.dwarf.editor.Type]( "lief._lief.dwarf.editor.Type")*) → [lief.\_lief.dwarf.editor.FunctionType]( "lief._lief.dwarf.editor.FunctionType") Set the return type of this function --- ## [Editor - TypeDef]() ![Inheritance diagram of lief._lief.dwarf.editor.TypeDef](https://lief.re/doc/latest/_images/inheritance-eef5b5e73235a44d49efb692d0b1ae2375356611.png) ### [` lief.dwarf.editor.TypeDef `]() class lief.dwarf.editor.TypeDef Bases: [`Type`]( "lief._lief.dwarf.editor.Type") This class represents a typedef (`DW_TAG_typedef`). --- ## [Editor - StructType]() ![Inheritance diagram of lief._lief.dwarf.editor.StructType](https://lief.re/doc/latest/_images/inheritance-59fd60314e659b417dd38c36382d003b3a9e4478.png) ### [` lief.dwarf.editor.StructType `]() class lief.dwarf.editor.StructType Bases: [`Type`]( "lief._lief.dwarf.editor.Type") This class represents a struct-like type which can be: - `DW_TAG_class_type` - `DW_TAG_structure_type` - `DW_TAG_union_type` #### [` Member `]() class Member Bases: `object` This class represents a member of the struct-like #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` ##### [` CLASS `]() CLASS = 0 ##### [` STRUCT `]() STRUCT = 1 ##### [` UNION `]() UNION = 2 #### [` add_bitfield `]() add\_bitfield(*self*, *name: str*, *type: [lief.\_lief.dwarf.editor.Type]( "lief._lief.dwarf.editor.Type")*, *bitsize: int*, *bitoffset: int = -1*) → [lief.\_lief.dwarf.editor.StructType.Member]( "lief._lief.dwarf.editor.StructType.Member") | None Adds a member to the current struct-like #### [` add_member `]() add\_member(*self*, *name: str*, *type: [lief.\_lief.dwarf.editor.Type]( "lief._lief.dwarf.editor.Type")*, *offset: int = -1*) → [lief.\_lief.dwarf.editor.StructType.Member]( "lief._lief.dwarf.editor.StructType.Member") | None Adds a member to the current struct-like #### [` set_size `]() set\_size(*self*, *size: int*) → [lief.\_lief.dwarf.editor.StructType]( "lief._lief.dwarf.editor.StructType") Define the overall size which is equivalent to the `sizeof` of the current type. This function defines the `DW_AT_byte_size` attribute --- documentID: "0d2b4827bd40ecb8a439a603354bfdf03f91943200ed2a128d3f8a44fc129584" docname: "extended/dwarf/rust" title: "DWARF Rust API - LIEF Documentation" description: "DWARF Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/extended/dwarf/rust.html" markdownURL: "https://lief.re/doc/latest/extended/dwarf/rust.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "0f00069a1fda51b559541dbe34aeccb889f39e9ada7dd717c164f3f369e69db7" --- # [Rust]() > **Note** > > Please check: [`lief::dwarf`]() --- documentID: "b2bdbcdf4d3e225feb7736c9f519912601c61438f3419a6affa874db012cd09d" docname: "extended/intro" title: "What is LIEF Extended? - LIEF Documentation" description: "LIEF Extended features, install Python wheels or C++ and Rust SDKs, verify your build, and find guides for debug information, assembly, Apple metadata, and…" canonical: "https://lief.re/doc/latest/extended/intro.html" markdownURL: "https://lief.re/doc/latest/extended/intro.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "8f6aa4ffd2bd1c78a1954623ef68629bf6b08d3e64f73c10dc18d3828eb082ca" --- # [What is LIEF Extended?]() ## [Introduction]() *LIEF Extended* is an enhanced version of LIEF, providing additional features such as support for the Dyld shared cache, Objective-C metadata, PDB, and DWARF. While the main version of LIEF focuses on providing support for ELF, PE, and Mach-O, LIEF Extended aims to provide functionality that was not originally intended for integration into the core LIEF project. You can find the differences between the two versions in this table: | Module | Regular Version | Extended Version | Note | | --- | --- | --- | --- | | [ELF]() | | | | | [PE]() | | | | | [Mach-O]() | | | | | [COFF]() | | | | | [DEX]() | | | | | [OAT]() | | | | | [VDEX]() | | | | | [ART]() | | | | | [Runtime]() | | | Only enabled in LIEF extended wheels | | [PDB]() | | | Support based on LLVM [[1]]() | | [DWARF]() | | | Support based on LLVM [[1]]() | | [ObjC]() | | | Support based on [romainthomas/iCDump]() | | [Dyld Shared Cache]() | | | | | [Disassembler]() | | | Support based on LLVM [[1]]() | | [Assembler]() | | | Support based on LLVM [[1]]() | ### [Get Access]() To access the extended version, you must **oauth-login** with **GitHub** here: [LIEF Extended]() To access the extended version, you must **oauth-login** with **GitHub** here: [https://extended.lief.re/](). Once logged in, you can download the package of your choice (e.g., LIEF Extended - Python 3.10 for macOS arm64). > **Email** > > If you don’t receive the download email, you can download the package directly from your **History** section. ## [Versioning]() LIEF Extended uses a slightly different versioning scheme than regular LIEF packages. First, **every extended package** is based on the current `main` branch of LIEF. If you need an (extended) build for a specific commit or tag, please contact extended@lief.re. In Python, you can check the commit of LIEF being used in the extended version with: ```bash # Make sure it's the extended version $ python -c "import lief;print(lief.__extended__)" # Print LIEF's main commit $ python -c "import lief;print(lief.__LIEF_MAIN_COMMIT__)" ``` With the C++/Rust SDK, you can call `lief.extended_version_info()` ( [`lief::extended_version_info`]() ; [`LIEF::extended_version_info()`]() ) to get details about the current version. Additional features exposed by LIEF Extended are not always represented in a public commit while still being git-versioned. An incremental build number is used to represent internal changes not associated with a public commit. For example, version `0.16.0.2380` includes 10 more commits than version `0.16.0.2370`. ## [Python Wheels]() Python packages are delivered as a wheel for the required platform/version (e.g., `lief_extended-0.16.0.post2370-cp312-cp312-win_amd64.whl`). You can install this wheel using pip in one of the following ways: ```console $ venv\Scripts\python.exe -m pip install C:\Users\tmp\lief_extended-0.16.0.post2370-cp312-cp312-win_amd64.whl ``` Or ```console $ venv\Scripts\python.exe -m pip install --find-links C:\Users\tmp\ lief_extended ``` You can verify that LIEF Extended is correctly installed with: ```console $ python -c "import lief;print(lief.__extended__)" True ``` ## [C++ SDK]() The C++ SDK is delivered as a `.zip/.tar.gz` archive containing: - A compiled shared library (`libLIEF.so`, `LIEF.dll`, `libLIEF.dylib`) - Header files - CMake helper files Compared to the regular version, this SDK **does not** ship a static version of LIEF, and the shared library is compiled with all extended features. Here is the layout for the macOS arm64 SDK, for example: ```text LIEF-extended-sdk-0.16.0.2378-Darwin-arm64/ lib/libLIEF.dylib lib/cmake/LIEF/lief-extended-config-version.cmake include/[...] ``` ## [Rust SDK]() The Rust SDK is also delivered as a `.zip/.tar.gz` archive containing all the files needed for use with the `LIEF_RUST_PRECOMPILED` environment variable, as described in the [Rust]() section. Once the archive is extracted, you just have to set the `LIEF_RUST_PRECOMPILED` environment variable to the extracted path: ```console $ tar xzvf LIEF-extended-rust-0.16.0.2378-Linux-x86_64.tar.gz LIEF-extended-rust-0.16.0.2378-Linux-x86_64/lib/ LIEF-extended-rust-0.16.0.2378-Linux-x86_64/lib/libLIEF.so LIEF-extended-rust-0.16.0.2378-Linux-x86_64/lib/liblief-sys.a $ export LIEF_RUST_PRECOMPILED=$(pwd)/LIEF-extended-rust-0.16.0.2378-Linux-x86_64 ``` You can then use all the extended features in Rust: ```console $ cargo build my-lief-extended-project ``` ## [LIEF Extended & LLVM]() LIEF Extended relies on LLVM for certain features, such as the [disassembler]() and [DWARF]()/[PDB]() support. The LLVM version used by LIEF is based on the upstream version and integrated into LIEF Extended so that users do not have to handle LLVM compilation or integration. > **Note** > > LIEF is currently using LLVM 22.x. Whenever possible and appropriate, bug fixes and enhancements have been submitted as PRs to the LLVM project: - [llvm/llvm-project#119057]() - [llvm/llvm-project#119056]() - [llvm/llvm-project#116480]() - [llvm/llvm-project#116479]() - [llvm/llvm-project#97954]() --- documentID: "5e66d3f1b9f06f5c521f61daf9e0bbbea2e8ac0a1b7cd0b308d792f08e75c9fb" docname: "extended/objc/cpp" title: "Objective-C C++ API - LIEF Documentation" description: "Objective-C C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/extended/objc/cpp.html" markdownURL: "https://lief.re/doc/latest/extended/objc/cpp.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "011917b265dbc8e50837f3d5a34b077c666a09448714d542cf2fbccf8389ba43" --- # [C++]() > **Note** > > You can also find the Doxygen documentation here: [here]() ## [Metadata]() ### [` Metadata `]() class Metadata This class is the main interface to inspect Objective-C metadata. It can be instantiated using the function [LIEF::MachO::Binary::objc\_metadata]() Public Types #### [` classes_it `]() using classes\_it = [iterator\_range]( "LIEF::iterator_range")<[Class]( "LIEF::objc::Class")::[Iterator]( "LIEF::objc::Class::Iterator")> #### [` protocols_it `]() using protocols\_it = [iterator\_range]( "LIEF::iterator_range")<[Protocol]( "LIEF::objc::Protocol")::[Iterator]( "LIEF::objc::Protocol::Iterator")> #### [` categories_it `]() using categories\_it = [iterator\_range]( "LIEF::iterator_range")<[Category]( "LIEF::objc::Category")::[Iterator]( "LIEF::objc::Category::Iterator")> Public Functions #### [` Metadata `]() Metadata(std::unique\_ptr<details::Metadata> impl) #### [` classes `]() [classes\_it]( "LIEF::objc::Metadata::classes_it") classes() const Return an iterator over the different Objective-C classes (`@interface`). #### [` protocols `]() [protocols\_it]( "LIEF::objc::Metadata::protocols_it") protocols() const Return an iterator over the Objective-C protocols declared in this binary (`@protocol`). #### [` categories `]() [categories\_it]( "LIEF::objc::Metadata::categories_it") categories() const Return an iterator over the Objective-C categories declared in this binary (e.g. `@interface NSString (MyAdditions)`). #### [` get_class `]() std::unique\_ptr<[Class]( "LIEF::objc::Class")> get\_class(const std::string &name) const Try to find the Objective-C class with the given **mangled** name. #### [` get_protocol `]() std::unique\_ptr<[Protocol]( "LIEF::objc::Protocol")> get\_protocol(const std::string &name) const Try to find the Objective-C protocol with the given **mangled** name. #### [` to_decl `]() std::string to\_decl(const [DeclOpt]( "LIEF::objc::DeclOpt") &opt = [DeclOpt]( "LIEF::objc::DeclOpt")()) const Generate a header-like of all the Objective-C metadata identified in the binary. The generated output can be configured with the [DeclOpt](). #### [` ~Metadata `]() ~Metadata() --- ## [Class]() ### [` Class `]() class Class This class represents an Objective-C class (`@interface`). Public Types #### [` methods_t `]() using methods\_t = [iterator\_range]( "LIEF::iterator_range")<[Method]( "LIEF::objc::Method")::[Iterator]( "LIEF::objc::Method::Iterator")> [Iterator]() for the class’s methods. #### [` protocols_t `]() using protocols\_t = [iterator\_range]( "LIEF::iterator_range")<[Protocol]( "LIEF::objc::Protocol")::[Iterator]( "LIEF::objc::Protocol::Iterator")> [Iterator]() for the protocols implemented by this class. #### [` properties_t `]() using properties\_t = [iterator\_range]( "LIEF::iterator_range")<[Property]( "LIEF::objc::Property")::[Iterator]( "LIEF::objc::Property::Iterator")> [Iterator]() for the properties declared by this class. #### [` ivars_t `]() using ivars\_t = [iterator\_range]( "LIEF::iterator_range")<[IVar]( "LIEF::objc::IVar")::[Iterator]( "LIEF::objc::IVar::Iterator")> [Iterator]() for the instance variables defined by this class. Public Functions #### [` Class `]() Class(std::unique\_ptr<details::Class> impl) #### [` name `]() std::string name() const Name of the class. #### [` demangled_name `]() std::string demangled\_name() const Demangled name of the class. #### [` super_class `]() std::unique\_ptr<[Class]( "LIEF::objc::Class")> super\_class() const Parent class in case of inheritance. This returns the superclass object **only** when it is defined in the same binary. For root classes (e.g. `NSObject`) or superclasses imported from another image, it returns a null pointer even though the name can still be resolved through [super\_name()]() / [demangled\_super\_name()](). #### [` super_name `]() std::string super\_name() const (raw) name of the superclass (empty for root classes or when it could not be resolved). #### [` demangled_super_name `]() std::string demangled\_super\_name() const Demangled name of the superclass. #### [` is_meta `]() bool is\_meta() const #### [` methods `]() [methods\_t]( "LIEF::objc::Class::methods_t") methods() const [Iterator]() over the different methods defined by this class. #### [` protocols `]() [protocols\_t]( "LIEF::objc::Class::protocols_t") protocols() const [Iterator]() over the different protocols implemented by this class. #### [` properties `]() [properties\_t]( "LIEF::objc::Class::properties_t") properties() const [Iterator]() over the properties of this class. #### [` ivars `]() [ivars\_t]( "LIEF::objc::Class::ivars_t") ivars() const [Iterator]() over the different instance variables defined in this class. #### [` to_decl `]() std::string to\_decl(const [DeclOpt]( "LIEF::objc::DeclOpt") &opt = [DeclOpt]( "LIEF::objc::DeclOpt")()) const Generate a header-like string for this specific class. The generated output can be configured with [DeclOpt]() #### [` ~Class `]() ~Class() #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::objc::Class::Iterator"), std::bidirectional\_iterator\_tag, [Class]( "LIEF::objc::Class"), std::ptrdiff\_t, const [Class]( "LIEF::objc::Class")\*, const [Class]( "LIEF::objc::Class")&> Public Types ##### [` implementation `]() using implementation = details::ClassIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::ClassIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::objc::Class::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::objc::Class::Iterator") &operator=(const [Iterator]( "LIEF::objc::Class::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::objc::Class::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::objc::Class::Iterator") &operator=([Iterator]( "LIEF::objc::Class::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::objc::Class::Iterator") &operator++() ##### [` operator-- `]() [Iterator]( "LIEF::objc::Class::Iterator") &operator--() ##### [` operator* `]() const [Class]( "LIEF::objc::Class") &operator\*() const ##### [` operator-> `]() const [Class]( "LIEF::objc::Class") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Class]( "LIEF::objc::Class")> yield() Transfer ownership of the class at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) ##### [` operator-- `]() inline DerivedT operator--(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::objc::Class::Iterator") &LHS, const [Iterator]( "LIEF::objc::Class::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::objc::Class::Iterator") &LHS, const [Iterator]( "LIEF::objc::Class::Iterator") &RHS) --- ## [Category]() ### [` Category `]() class Category This class represents an Objective-C category (e.g. `@interface NSString (MyAdditions)`). Public Types #### [` methods_t `]() using methods\_t = [iterator\_range]( "LIEF::iterator_range")<[Method]( "LIEF::objc::Method")::[Iterator]( "LIEF::objc::Method::Iterator")> [Iterator]() for the category’s methods. #### [` protocols_t `]() using protocols\_t = [iterator\_range]( "LIEF::iterator_range")<[Protocol]( "LIEF::objc::Protocol")::[Iterator]( "LIEF::objc::Protocol::Iterator")> [Iterator]() for the protocols adopted by this category. #### [` properties_t `]() using properties\_t = [iterator\_range]( "LIEF::iterator_range")<[Property]( "LIEF::objc::Property")::[Iterator]( "LIEF::objc::Property::Iterator")> [Iterator]() for the properties declared by this category. Public Functions #### [` Category `]() Category(std::unique\_ptr<details::Category> impl) #### [` name `]() std::string name() const Name of the category. #### [` class_name `]() std::string class\_name() const (demangled) name of the class extended by this category #### [` methods `]() [methods\_t]( "LIEF::objc::Category::methods_t") methods() const [Iterator]() over the different methods defined by this category. #### [` protocols `]() [protocols\_t]( "LIEF::objc::Category::protocols_t") protocols() const [Iterator]() over the different protocols adopted by this category. #### [` properties `]() [properties\_t]( "LIEF::objc::Category::properties_t") properties() const [Iterator]() over the properties of this category. #### [` to_decl `]() std::string to\_decl(const [DeclOpt]( "LIEF::objc::DeclOpt") &opt = [DeclOpt]( "LIEF::objc::DeclOpt")()) const Generate a header-like string for this specific category. The generated output can be configured with [DeclOpt]() #### [` ~Category `]() ~Category() #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::objc::Category::Iterator"), std::bidirectional\_iterator\_tag, [Category]( "LIEF::objc::Category"), std::ptrdiff\_t, const [Category]( "LIEF::objc::Category")\*, const [Category]( "LIEF::objc::Category")&> Public Types ##### [` implementation `]() using implementation = details::CategoryIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::CategoryIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::objc::Category::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::objc::Category::Iterator") &operator=(const [Iterator]( "LIEF::objc::Category::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::objc::Category::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::objc::Category::Iterator") &operator=([Iterator]( "LIEF::objc::Category::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::objc::Category::Iterator") &operator++() ##### [` operator-- `]() [Iterator]( "LIEF::objc::Category::Iterator") &operator--() ##### [` operator* `]() const [Category]( "LIEF::objc::Category") &operator\*() const ##### [` operator-> `]() const [Category]( "LIEF::objc::Category") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Category]( "LIEF::objc::Category")> yield() Transfer ownership of the category at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) ##### [` operator-- `]() inline DerivedT operator--(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::objc::Category::Iterator") &LHS, const [Iterator]( "LIEF::objc::Category::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::objc::Category::Iterator") &LHS, const [Iterator]( "LIEF::objc::Category::Iterator") &RHS) --- ## [Protocol]() ### [` Protocol `]() class Protocol This class represents an Objective-C `@protocol`. Public Types #### [` methods_it `]() using methods\_it = [iterator\_range]( "LIEF::iterator_range")<[Method]( "LIEF::objc::Method")::[Iterator]( "LIEF::objc::Method::Iterator")> #### [` properties_it `]() using properties\_it = [iterator\_range]( "LIEF::iterator_range")<[Property]( "LIEF::objc::Property")::[Iterator]( "LIEF::objc::Property::Iterator")> #### [` protocols_it `]() using protocols\_it = [iterator\_range]( "LIEF::iterator_range")<[Iterator]( "LIEF::objc::Protocol::Iterator")> Public Functions #### [` Protocol `]() Protocol(std::unique\_ptr<details::Protocol> impl) #### [` mangled_name `]() std::string mangled\_name() const Mangled name of the protocol. #### [` protocols `]() [protocols\_it]( "LIEF::objc::Protocol::protocols_it") protocols() const [Iterator]() over the protocols adopted by this protocol (e.g. the `` in `@protocol Foo `). #### [` optional_methods `]() [methods\_it]( "LIEF::objc::Protocol::methods_it") optional\_methods() const [Iterator]() over the methods that could be overridden. #### [` required_methods `]() [methods\_it]( "LIEF::objc::Protocol::methods_it") required\_methods() const [Iterator]() over the methods of this protocol that must be implemented. #### [` properties `]() [properties\_it]( "LIEF::objc::Protocol::properties_it") properties() const [Iterator]() over the properties defined in this protocol. #### [` to_decl `]() std::string to\_decl(const [DeclOpt]( "LIEF::objc::DeclOpt") &opt = [DeclOpt]( "LIEF::objc::DeclOpt")()) const Generate a header-like string for this specific protocol. The generated output can be configured with [DeclOpt]() #### [` ~Protocol `]() ~Protocol() #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::objc::Protocol::Iterator"), std::bidirectional\_iterator\_tag, [Protocol]( "LIEF::objc::Protocol"), std::ptrdiff\_t, const [Protocol]( "LIEF::objc::Protocol")\*, const [Protocol]( "LIEF::objc::Protocol")&> Public Types ##### [` implementation `]() using implementation = details::ProtocolIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::ProtocolIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::objc::Protocol::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::objc::Protocol::Iterator") &operator=(const [Iterator]( "LIEF::objc::Protocol::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::objc::Protocol::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::objc::Protocol::Iterator") &operator=([Iterator]( "LIEF::objc::Protocol::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::objc::Protocol::Iterator") &operator++() ##### [` operator-- `]() [Iterator]( "LIEF::objc::Protocol::Iterator") &operator--() ##### [` operator* `]() const [Protocol]( "LIEF::objc::Protocol") &operator\*() const ##### [` operator-> `]() const [Protocol]( "LIEF::objc::Protocol") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Protocol]( "LIEF::objc::Protocol")> yield() Transfer ownership of the protocol at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) ##### [` operator-- `]() inline DerivedT operator--(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::objc::Protocol::Iterator") &LHS, const [Iterator]( "LIEF::objc::Protocol::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::objc::Protocol::Iterator") &LHS, const [Iterator]( "LIEF::objc::Protocol::Iterator") &RHS) --- ## [Instance Variable (IVar)]() ### [` IVar `]() class IVar This class represents an instance variable (ivar). Public Functions #### [` IVar `]() IVar(std::unique\_ptr<details::IVar> impl) #### [` name `]() std::string name() const Name of the instance variable. #### [` mangled_type `]() std::string mangled\_type() const Type of the instance var in its mangled representation (`[29i]`). #### [` ~IVar `]() ~IVar() #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::objc::IVar::Iterator"), std::bidirectional\_iterator\_tag, [IVar]( "LIEF::objc::IVar"), std::ptrdiff\_t, const [IVar]( "LIEF::objc::IVar")\*, const [IVar]( "LIEF::objc::IVar")&> Public Types ##### [` implementation `]() using implementation = details::IVarIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::IVarIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::objc::IVar::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::objc::IVar::Iterator") &operator=(const [Iterator]( "LIEF::objc::IVar::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::objc::IVar::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::objc::IVar::Iterator") &operator=([Iterator]( "LIEF::objc::IVar::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::objc::IVar::Iterator") &operator++() ##### [` operator-- `]() [Iterator]( "LIEF::objc::IVar::Iterator") &operator--() ##### [` operator* `]() const [IVar]( "LIEF::objc::IVar") &operator\*() const ##### [` operator-> `]() const [IVar]( "LIEF::objc::IVar") \*operator->() const ##### [` yield `]() std::unique\_ptr<[IVar]( "LIEF::objc::IVar")> yield() Transfer ownership of the ivar at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) ##### [` operator-- `]() inline DerivedT operator--(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::objc::IVar::Iterator") &LHS, const [Iterator]( "LIEF::objc::IVar::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::objc::IVar::Iterator") &LHS, const [Iterator]( "LIEF::objc::IVar::Iterator") &RHS) --- ## [Method]() ### [` Method `]() class Method This class represents an Objective-C [Method](). Public Functions #### [` Method `]() Method(std::unique\_ptr<details::Method> impl) #### [` name `]() std::string name() const Name of the method. #### [` mangled_type `]() std::string mangled\_type() const Prototype of the method in its mangled representation (e.g. `@16@0:8`). #### [` address `]() uintptr\_t address() const Virtual address where this method is implemented in the binary. #### [` is_instance `]() bool is\_instance() const Whether it’s an instance method. #### [` ~Method `]() ~Method() #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::objc::Method::Iterator"), std::bidirectional\_iterator\_tag, [Method]( "LIEF::objc::Method"), std::ptrdiff\_t, const [Method]( "LIEF::objc::Method")\*, const [Method]( "LIEF::objc::Method")&> Public Types ##### [` implementation `]() using implementation = details::MethodIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::MethodIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::objc::Method::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::objc::Method::Iterator") &operator=(const [Iterator]( "LIEF::objc::Method::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::objc::Method::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::objc::Method::Iterator") &operator=([Iterator]( "LIEF::objc::Method::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::objc::Method::Iterator") &operator++() ##### [` operator-- `]() [Iterator]( "LIEF::objc::Method::Iterator") &operator--() ##### [` operator* `]() const [Method]( "LIEF::objc::Method") &operator\*() const ##### [` operator-> `]() const [Method]( "LIEF::objc::Method") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Method]( "LIEF::objc::Method")> yield() Transfer ownership of the method at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) ##### [` operator-- `]() inline DerivedT operator--(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::objc::Method::Iterator") &LHS, const [Iterator]( "LIEF::objc::Method::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::objc::Method::Iterator") &LHS, const [Iterator]( "LIEF::objc::Method::Iterator") &RHS) --- ## [Property]() ### [` Property `]() class Property This class represents a `@property` in Objective-C. Public Functions #### [` Property `]() Property(std::unique\_ptr<details::Property> impl) #### [` name `]() std::string name() const Name of the property. #### [` attribute `]() std::string attribute() const (raw) property’s attributes (e.g. `T@"NSString",C,D,N`) #### [` ~Property `]() ~Property() #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::objc::Property::Iterator"), std::bidirectional\_iterator\_tag, [Property]( "LIEF::objc::Property"), std::ptrdiff\_t, const [Property]( "LIEF::objc::Property")\*, const [Property]( "LIEF::objc::Property")&> Public Types ##### [` implementation `]() using implementation = details::PropertyIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::PropertyIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::objc::Property::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::objc::Property::Iterator") &operator=(const [Iterator]( "LIEF::objc::Property::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::objc::Property::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::objc::Property::Iterator") &operator=([Iterator]( "LIEF::objc::Property::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::objc::Property::Iterator") &operator++() ##### [` operator-- `]() [Iterator]( "LIEF::objc::Property::Iterator") &operator--() ##### [` operator* `]() const [Property]( "LIEF::objc::Property") &operator\*() const ##### [` operator-> `]() const [Property]( "LIEF::objc::Property") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Property]( "LIEF::objc::Property")> yield() Transfer ownership of the property at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) ##### [` operator-- `]() inline DerivedT operator--(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::objc::Property::Iterator") &LHS, const [Iterator]( "LIEF::objc::Property::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::objc::Property::Iterator") &LHS, const [Iterator]( "LIEF::objc::Property::Iterator") &RHS) --- ## [DeclOpt]() ### [` DeclOpt `]() struct DeclOpt This structure wraps options to tweak the generated output of functions like [LIEF::objc::Metadata::to\_decl](). Public Members #### [` show_annotations `]() bool show\_annotations = true Whether annotations like method’s address should be printed. --- documentID: "f89a23b58e22d1d6c1677fdf240bdafb678c8242dbc5981ad12d512bab4a9b02" docname: "extended/objc/index" title: "Objective-C - LIEF Documentation" description: "Inspect Objective-C classes, methods, properties, and protocols in Mach-O files and generate header-like declarations with LIEF Extended." canonical: "https://lief.re/doc/latest/extended/objc/index.html" markdownURL: "https://lief.re/doc/latest/extended/objc/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "ecaaea19b7ab1f22f0889cddc0e98977c2a9718b9cb7047ea10cd92b9cca25e4" --- # [Objective-C]() API - [C++]() - [Metadata]() - [Class]() - [Category]() - [Protocol]() - [Instance Variable (IVar)]() - [Method]() - [Property]() - [DeclOpt]() - [Python]() - [Metadata]() - [Class]() - [Category]() - [Protocol]() - [Method]() - [IVar]() - [Property]() - [DeclOpt]() - [Rust]() ## [Introduction]() LIEF Extended reads Objective-C classes, methods, properties, and protocols from Mach-O metadata. It can also generate header-like declarations. This information comes from Objective-C runtime metadata in the file, so it can be present even when source-level debug information is unavailable. ## [Inspect metadata]() If a Mach-O binary embeds Objective-C metadata, it can be accessed through `lief.MachO.Binary.objc_metadata` ( [`lief::macho::Binary::objc_metadata`]() ; [`lief.MachO.Binary.objc_metadata`]() ; [`LIEF::MachO::Binary::objc_metadata()`]() ): **Python** ```python macho: lief.MachO.Binary metadata = macho.objc_metadata if metadata is not None: print("Objective-C metadata found") ``` **C++** ```cpp std::unique_ptr macho; std::unique_ptr metadata = macho->objc_metadata(); if (metadata != nullptr) { std::cout << "Objective metadata found\n"; } ``` **Rust** ```rust let macho: &lief::macho::Binary = some_macho; if let Some(metadata) = macho.objc_metadata() { println!("Objective-C metadata found"); } ``` When metadata is present, use `lief.ObjC.Metadata` ( [`lief::objc::Metadata`]() ; [`lief.objc.Metadata`]() ; [`LIEF::objc::Metadata`]() ) to inspect it. In particular, the `lief.ObjC.Metadata.to_decl()` ( [`lief::objc::Metadata::to_decl`]() ; [`lief.objc.Metadata.to_decl()`]() ; [`LIEF::objc::Metadata::to_decl()`]() ) function can be used to generate a header-like output of all the Objective-C metadata found in the binary. **Python** ```python macho: lief.MachO.Binary metadata = macho.objc_metadata for clazz in metadata.classes: print(f"name={clazz.name}") for meth in clazz.methods: print(f" method.name={meth.name}") print(metadata.to_decl()) ``` **C++** ```cpp std::unique_ptr bin; std::unique_ptr metadata = bin->objc_metadata(); for (const LIEF::objc::Class& clazz : metadata->classes()) { std::cout << "name=" << clazz.name() << '\n'; for (const LIEF::objc::Method& meth : clazz.methods()) { std::cout << " method.name=" << meth.name() << '\n'; } } std::cout << metadata->to_decl(); ``` **Rust** ```rust let macho: &lief::macho::Binary = some_macho; let Some(metadata) = macho.objc_metadata() else { process::exit(1); }; for class in metadata.classes() { println!("name={}", class.name()); for method in class.methods() { println!(" method.name={}", method.name()); } } println!("{}", metadata.to_decl()); ``` ## [Class Dump]() Generate header-like declarations to review the classes and protocols found in the binary. The output describes the recorded metadata, including method signatures. It does not recover method implementations or the original headers. ![Objective-C class dump based on LIEF & LLVM](https://lief.re/doc/latest/_images/objc-class-dump.webp) LIEF provides a way to generate this header-like information at various levels: - `lief.ObjC.Metadata.to_decl()` ( [`lief::objc::Metadata::to_decl_with_opt`]() ; [`lief.objc.Metadata.to_decl()`]() ; [`LIEF::objc::Metadata::to_decl()`]() ) - `lief.ObjC.Class.to_decl()` ( [`lief::objc::Class::to_decl_with_opt`]() ; [`lief.objc.Class.to_decl()`]() ; [`LIEF::objc::Class::to_decl()`]() ) - `lief.ObjC.Protocol.to_decl()` ( [`lief::objc::Protocol::to_decl_with_opt`]() ; [`lief.objc.Protocol.to_decl()`]() ; [`LIEF::objc::Protocol::to_decl()`]() ) Technically, this output is created by generating a Clang AST and applying the LLVM printer visitor to it. **Code** ```rust fn classdump(macho: &lief::macho::Binary) { let metadata = macho.objc_metadata().expect("Missing Objective-C info"); for class in metadata.classes() { println!("{}", class.to_decl()); } } ``` **Result** ```objc @interface APMEventFilter { bool _sessionScoped; bool _dynamic; bool _sequence; int _audienceID; int _filterID; NSString * _eventName; NSData * _data; } // Address: 0x0101859ee0 - (NSObject *)initWithAudienceID:(APMEventFilter *)self filterID:(SEL)id eventName:(int)arg2 data:(int)arg3 sessionScoped:(NSObject *)arg4 dynamic:(NSObject *)arg5 sequence:(bool)arg6 :(bool)arg7 :(bool)arg8; // Address: 0x0101682590 - (int)audienceID:(APMEventFilter *)self :(SEL)id; // Address: 0x01017b6d98 - (int)filterID:(APMEventFilter *)self :(SEL)id; // Address: 0x01018a4a6c - (bool)isSessionScoped:(APMEventFilter *)self :(SEL)id; // Address: 0x01017630d4 - (bool)isDynamic:(APMEventFilter *)self :(SEL)id; // Address: 0x01016adbb4 - (bool)isSequence:(APMEventFilter *)self :(SEL)id; // Address: 0x010187a5f8 - (NSObject *)eventName:(APMEventFilter *)self :(SEL)id; // Address: 0x0101581bfc - (NSObject *)data:(APMEventFilter *)self :(SEL)id; // Address: 0x01018e1f3c - (void).cxx_destruct:(APMEventFilter *)self :(SEL)id; @property void eventName; @property void data; @property void audienceID; @property void filterID; @property void sessionScoped; @property void dynamic; @property void sequence; @property void hash; @property void superclass; @property void description; @property void debugDescription; @end ``` The `lief.ObjC.DeclOpt` ( [`lief::objc::DeclOpt`]() ; [`lief.objc.DeclOpt`]() ; [`LIEF::objc::DeclOpt`]() ) can be used to customize the generated output. For example, we can remove the commented addresses associated with Objective-C methods using this option: ```python def print_without_address(macho: lief.MachO.Binary): metadata = macho.objc_metadata config = lief.objc.DeclOpt() config.show_annotations = False for cls in metadata.classes: print(cls.to_decl(config)) ``` ## [References]() - [romainthomas/iCDump]() - [nygard/class-dump]() - [https://www.romainthomas.fr/post/23-01-icdump/]() ## [API]() You can find the documentation of the API for the different languages here: [Python API]() [C++ API]() Rust API: [`lief::objc`]() --- documentID: "9186404652aeb90b8f55ea845e1c5db781e7633ff11a50e72497cdba4700ff4a" docname: "extended/objc/python" title: "Objective-C Python API - LIEF Documentation" description: "Objective-C Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/extended/objc/python.html" markdownURL: "https://lief.re/doc/latest/extended/objc/python.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "a9e84b90719e80c6234a7fead9970839ad306999132c24cb9a9d4750b292312d" --- # [Python]() ## [Metadata]() ### [` lief.objc.Metadata `]() class lief.objc.Metadata Bases: `object` This class is the main interface to inspect Objective-C metadata It can be instantiated using the function [`lief.MachO.Binary.objc_metadata`]( "lief.MachO.Binary.objc_metadata") #### [` categories `]() property categories → Iterator[[lief.objc.Category]( "lief.objc.Category") | None] Return an iterator over the Objective-C categories declared in this binary (e.g. `@interface NSString (MyAdditions)`). #### [` classes `]() property classes → Iterator[[lief.objc.Class]( "lief.objc.Class") | None] Return an iterator over the different Objective-C classes (`@interface`). #### [` get_class `]() get\_class(*self*, *name: str*) → [lief.\_lief.objc.Class]( "lief._lief.objc.Class") | None Try to find the Objective-C class with the given **mangled** name. #### [` get_protocol `]() get\_protocol(*self*, *name: str*) → [lief.\_lief.objc.Protocol]( "lief._lief.objc.Protocol") | None Try to find the Objective-C protocol with the given **mangled** name. #### [` protocols `]() property protocols → Iterator[[lief.objc.Protocol]( "lief.objc.Protocol") | None] Return an iterator over the Objective-C protocols declared in this binary (`@protocol`). #### [` to_decl `]() to\_decl(*self*, *opt: [lief.\_lief.objc.DeclOpt]( "lief._lief.objc.DeclOpt") = <lief.\_lief.objc.DeclOpt object at 0x7f13c4411990>*) → str Generate a header-like of all the Objective-C metadata identified in the binary. The generated output can be configured with the provided [`DeclOpt`]( "lief.objc.DeclOpt") parameter. --- ## [Class]() ### [` lief.objc.Class `]() class lief.objc.Class Bases: `object` This class represents an Objective-C class (`@interface`) #### [` demangled_name `]() property demangled\_name → str Demangled name of the class #### [` demangled_super_name `]() property demangled\_super\_name → str Demangled name of the superclass. #### [` is_meta `]() property is\_meta → bool #### [` ivars `]() property ivars → Iterator[[lief.objc.IVar]( "lief.objc.IVar") | None] Iterator over the different instance variables defined in this class. #### [` methods `]() property methods → Iterator[[lief.objc.Method]( "lief.objc.Method") | None] Iterator over the different methods defined by this class. #### [` name `]() property name → str Name of the class #### [` properties `]() property properties → Iterator[[lief.objc.Property]( "lief.objc.Property") | None] Iterator over the properties of this class. #### [` protocols `]() property protocols → Iterator[[lief.objc.Protocol]( "lief.objc.Protocol") | None] Iterator over the different protocols implemented by this class. #### [` super_class `]() property super\_class → [lief.objc.Class]( "lief.objc.Class") | None Parent class in case of inheritance. This is set **only** when the superclass is defined in the same binary. For root classes (e.g. `NSObject`) or superclasses imported from another image, it is `None` even though [`super_name`]( "lief.objc.Class.super_name") / [`demangled_super_name`]( "lief.objc.Class.demangled_super_name") may still be resolved. #### [` super_name `]() property super\_name → str (raw) name of the superclass (empty for root classes or when it could not be resolved). #### [` to_decl `]() to\_decl(*self*, *opt: [lief.\_lief.objc.DeclOpt]( "lief._lief.objc.DeclOpt") = <lief.\_lief.objc.DeclOpt object at 0x7f13c44119f0>*) → str Generate a header-like string for this specific class. The generated output can be configured with the provided [`DeclOpt`]( "lief.objc.DeclOpt") parameter. --- ## [Category]() ### [` lief.objc.Category `]() class lief.objc.Category Bases: `object` This class represents an Objective-C category (e.g. `@interface NSString (MyAdditions)`) #### [` class_name `]() property class\_name → str (demangled) name of the class extended by this category #### [` methods `]() property methods → Iterator[[lief.objc.Method]( "lief.objc.Method") | None] Iterator over the different methods defined by this category. #### [` name `]() property name → str Name of the category #### [` properties `]() property properties → Iterator[[lief.objc.Property]( "lief.objc.Property") | None] Iterator over the properties of this category. #### [` protocols `]() property protocols → Iterator[[lief.objc.Protocol]( "lief.objc.Protocol") | None] Iterator over the different protocols adopted by this category. #### [` to_decl `]() to\_decl(*self*, *opt: [lief.\_lief.objc.DeclOpt]( "lief._lief.objc.DeclOpt") = <lief.\_lief.objc.DeclOpt object at 0x7f13c4411a50>*) → str Generate a header-like string for this specific category. The generated output can be configured with the provided [`DeclOpt`]( "lief.objc.DeclOpt") parameter. --- ## [Protocol]() ### [` lief.objc.Protocol `]() class lief.objc.Protocol Bases: `object` This class represents an Objective-C `@protocol` #### [` mangled_name `]() property mangled\_name → str Mangled name of the protocol #### [` optional_methods `]() property optional\_methods → Iterator[[lief.objc.Method]( "lief.objc.Method") | None] Iterator over the methods that could be overridden #### [` properties `]() property properties → Iterator[[lief.objc.Property]( "lief.objc.Property") | None] Iterator over the properties defined in this protocol #### [` protocols `]() property protocols → Iterator[[lief.objc.Protocol]( "lief.objc.Protocol") | None] Iterator over the protocols adopted by this protocol (e.g. the `` in `@protocol Foo `). #### [` required_methods `]() property required\_methods → Iterator[[lief.objc.Method]( "lief.objc.Method") | None] Iterator over the methods of this protocol that must be implemented #### [` to_decl `]() to\_decl(*self*, *opt: [lief.\_lief.objc.DeclOpt]( "lief._lief.objc.DeclOpt") = <lief.\_lief.objc.DeclOpt object at 0x7f13c4411af0>*) → str Generate a header-like string for this specific protocol. The generated output can be configured with the provided [`DeclOpt`]( "lief.objc.DeclOpt") parameter. --- ## [Method]() ### [` lief.objc.Method `]() class lief.objc.Method Bases: `object` This class represents an Objective-C Method. #### [` address `]() property address → int Virtual address where this method is implemented in the binary #### [` is_instance `]() property is\_instance → bool Whether it’s an instance method or not. #### [` mangled_type `]() property mangled\_type → str Prototype of the method in its mangled representation (e.g. `@16@0:8`) #### [` name `]() property name → str Name of the method --- ## [IVar]() ### [` lief.objc.IVar `]() class lief.objc.IVar Bases: `object` This class represents an instance variable (ivar) #### [` mangled_type `]() property mangled\_type → str Type of the instance var in its mangled representation (e.g. `[29i]`) #### [` name `]() property name → str Name of the instance variable --- ## [Property]() ### [` lief.objc.Property `]() class lief.objc.Property Bases: `object` This class represents a `@property` in Objective-C #### [` attribute `]() property attribute → str (raw) property’s attributes (e.g. `T@"NSString",C,D,N`) #### [` name `]() property name → str Name of the property --- ## [DeclOpt]() ### [` lief.objc.DeclOpt `]() class lief.objc.DeclOpt(*self*) Bases: `object` This structure wraps options to tweak the generated output of functions like [`lief.objc.Metadata.to_decl()`]( "lief.objc.Metadata.to_decl") #### [` show_annotations `]() property show\_annotations → bool Whether annotations like method’s address should be printed. --- documentID: "9f32d22fd0385fe603d6f1eac5bb71cc7bd366072e49d436e13454cac4abf9f3" docname: "extended/objc/rust" title: "Objective-C Rust API - LIEF Documentation" description: "Objective-C Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/extended/objc/rust.html" markdownURL: "https://lief.re/doc/latest/extended/objc/rust.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "5de9384197910fc298bcc06387992fbda328a85d292c4fb4fcfb364ff3c572ac" --- # [Rust]() > **Note** > > Please check: [`lief::objc`]() --- documentID: "f9ecd9575abf7930cc73d9203870d4426629bb62508511b10066da37ce533cfe" docname: "extended/pdb/cpp" title: "PDB C++ API - LIEF Documentation" description: "PDB C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/extended/pdb/cpp.html" markdownURL: "https://lief.re/doc/latest/extended/pdb/cpp.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "550c4650c53aaa2ff383b51278f41b83fead207d19200ad65468d43a167192c8" --- # [C++]() > **Note** > > You can also find the Doxygen documentation here: [here]() ## [` LIEF::pdb::load `]() inline std::unique\_ptr<[DebugInfo]( "LIEF::pdb::DebugInfo")> LIEF::pdb::load(const std::string &pdb\_path) Load the PDB file from the given path. ## [DebugInfo]() ### [` DebugInfo `]() class DebugInfo : public LIEF::[DebugInfo]( "LIEF::DebugInfo") This class provides an interface for PDB files. One can instantiate this class using [LIEF::pdb::load()]() or [LIEF::pdb::DebugInfo::from\_file](). Public Types #### [` compilation_units_it `]() using compilation\_units\_it = [iterator\_range]( "LIEF::iterator_range")<[CompilationUnit]( "LIEF::pdb::CompilationUnit")::[Iterator]( "LIEF::pdb::CompilationUnit::Iterator")> Iterator over the [CompilationUnit](). #### [` public_symbols_it `]() using public\_symbols\_it = [iterator\_range]( "LIEF::iterator_range")<[PublicSymbol]( "LIEF::pdb::PublicSymbol")::[Iterator]( "LIEF::pdb::PublicSymbol::Iterator")> Iterator over the symbols located in the PDB public symbol stream. #### [` types_it `]() using types\_it = [iterator\_range]( "LIEF::iterator_range")<[Type]( "LIEF::pdb::Type")::[Iterator]( "LIEF::pdb::Type::Iterator")> Iterator over the PDB’s types. Public Functions #### [` format `]() inline virtual FORMAT format() const override #### [` compilation_units `]() [compilation\_units\_it]( "LIEF::pdb::DebugInfo::compilation_units_it") compilation\_units() const Iterator over the [CompilationUnit]() from the PDB’s DBI stream. [CompilationUnit]() are also named “Module” in the PDB’s official documentation. #### [` public_symbols `]() [public\_symbols\_it]( "LIEF::pdb::DebugInfo::public_symbols_it") public\_symbols() const Return an iterator over the public symbol stream. #### [` types `]() [types\_it]( "LIEF::pdb::DebugInfo::types_it") types() const Return an iterator over the different types registered in this PDB. #### [` find_type `]() std::unique\_ptr<[Type]( "LIEF::pdb::Type")> find\_type(const std::string &name) const Find the type with the given name. #### [` find_type `]() std::unique\_ptr<[Type]( "LIEF::pdb::Type")> find\_type(uint32\_t index) const Find the type at the given index. #### [` find_public_symbol `]() std::unique\_ptr<[PublicSymbol]( "LIEF::pdb::PublicSymbol")> find\_public\_symbol(const std::string &name) const Try to find the [PublicSymbol]() from the given name (based on the public symbol stream). The function returns a nullptr if the symbol can’t be found ```cpp const DebugInfo& info = ...; if (auto found = info.find_public_symbol("MiSyncSystemPdes")) { // FOUND! } ``` #### [` find_function_address `]() virtual std::optional<uint64\_t> find\_function\_address(const std::string &name) const override Attempt to resolve the address of the function specified by `name`. #### [` age `]() uint32\_t age() const The number of times the PDB file has been written. #### [` guid `]() std::string guid() const Unique identifier of the PDB file. #### [` to_string `]() std::string to\_string() const Pretty representation. #### [` ~DebugInfo `]() virtual ~DebugInfo() override = default #### [` DebugInfo `]() DebugInfo(std::unique\_ptr<details::DebugInfo> impl) Public Static Functions #### [` from_file `]() static std::unique\_ptr<[DebugInfo]( "LIEF::pdb::DebugInfo")> from\_file(const std::string &pdb\_path) Instantiate this class from the given PDB file. It returns a nullptr if the PDB can’t be processed. #### [` classof `]() static inline bool classof(const LIEF::[DebugInfo]( "LIEF::DebugInfo") \*info) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [DebugInfo]( "LIEF::pdb::DebugInfo") &dbg) --- ## [PublicSymbol]() ### [` PublicSymbol `]() class PublicSymbol This class provides general information (RVA, name) about a symbol from the PDB’s public symbol stream (or Public symbol hash stream). Public Types #### [` FLAGS `]() enum class FLAGS : uint32\_t *Values:* ##### [` NONE `]() enumerator NONE = 0 ##### [` CODE `]() enumerator CODE = 1 << 0 ##### [` FUNCTION `]() enumerator FUNCTION = 1 << 1 ##### [` MANAGED `]() enumerator MANAGED = 1 << 2 ##### [` MSIL `]() enumerator MSIL = 1 << 3 Public Functions #### [` PublicSymbol `]() PublicSymbol(std::unique\_ptr<details::PublicSymbol> impl) #### [` ~PublicSymbol `]() ~PublicSymbol() #### [` name `]() std::string name() const Name of the symbol. #### [` demangled_name `]() std::string demangled\_name() const Demangled representation of the symbol. #### [` section_name `]() std::string section\_name() const Name of the section in which this symbol is defined (e.g. `.text`). This function returns an empty string if the section’s name can’t be found #### [` RVA `]() uint32\_t RVA() const **Relative** Virtual Address of this symbol. This function returns 0 if the RVA can’t be computed. #### [` to_string `]() std::string to\_string() const Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [PublicSymbol]( "LIEF::pdb::PublicSymbol") &sym) #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::pdb::PublicSymbol::Iterator"), std::forward\_iterator\_tag, [PublicSymbol]( "LIEF::pdb::PublicSymbol"), std::ptrdiff\_t, const [PublicSymbol]( "LIEF::pdb::PublicSymbol")\*, const [PublicSymbol]( "LIEF::pdb::PublicSymbol")&> Public Types ##### [` implementation `]() using implementation = details::PublicSymbolIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::PublicSymbolIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::pdb::PublicSymbol::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::pdb::PublicSymbol::Iterator") &operator=(const [Iterator]( "LIEF::pdb::PublicSymbol::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::pdb::PublicSymbol::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::pdb::PublicSymbol::Iterator") &operator=([Iterator]( "LIEF::pdb::PublicSymbol::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::pdb::PublicSymbol::Iterator") &operator++() ##### [` operator* `]() const [PublicSymbol]( "LIEF::pdb::PublicSymbol") &operator\*() const ##### [` operator-> `]() const [PublicSymbol]( "LIEF::pdb::PublicSymbol") \*operator->() const ##### [` yield `]() std::unique\_ptr<[PublicSymbol]( "LIEF::pdb::PublicSymbol")> yield() Transfer ownership of the public symbol at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::pdb::PublicSymbol::Iterator") &LHS, const [Iterator]( "LIEF::pdb::PublicSymbol::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::pdb::PublicSymbol::Iterator") &LHS, const [Iterator]( "LIEF::pdb::PublicSymbol::Iterator") &RHS) --- ## [CompilationUnit]() ### [` CompilationUnit `]() class CompilationUnit This class represents a [CompilationUnit]() (or Module) in a PDB file. Public Types #### [` sources_iterator `]() using sources\_iterator = [iterator\_range]( "LIEF::iterator_range")<std::vector<std::string>::const\_iterator> [Iterator]() over the source files (std::string). #### [` function_iterator `]() using function\_iterator = [iterator\_range]( "LIEF::iterator_range")<[Function]( "LIEF::pdb::Function")::[Iterator]( "LIEF::pdb::Function::Iterator")> Public Functions #### [` CompilationUnit `]() CompilationUnit(std::unique\_ptr<details::CompilationUnit> impl) #### [` ~CompilationUnit `]() ~CompilationUnit() #### [` module_name `]() std::string module\_name() const Name (or path) to the COFF object (`.obj`) associated with this compilation unit (e.g. `e:\obj.amd64fre\minkernel\ntos\hvl\mp\objfre\amd64\hvlp.obj`). #### [` object_filename `]() std::string object\_filename() const Name or path to the original binary object (COFF, Archive) in which the compilation unit was located before being linked. e.g. `e:\obj.amd64fre\minkernel\ntos\hvl\mp\objfre\amd64\hvl.lib`. #### [` sources `]() [sources\_iterator]( "LIEF::pdb::CompilationUnit::sources_iterator") sources() const [Iterator]() over the sources files that compose this compilation unit. These files also include **headers** (`.h, .hpp`, …). #### [` functions `]() [function\_iterator]( "LIEF::pdb::CompilationUnit::function_iterator") functions() const Return an iterator over the function defined in this compilation unit. If the PDB does not contain or has an empty DBI stream, it returns an empty iterator. #### [` build_metadata `]() std::unique\_ptr<[BuildMetadata]( "LIEF::pdb::BuildMetadata")> build\_metadata() const Return build metadata such as the version of the compiler or the original source language of this compilation unit. #### [` to_decl `]() std::string to\_decl(const [DeclOpt]( "LIEF::DeclOpt") &opt = [DeclOpt]( "LIEF::DeclOpt")()) const Generate a C/C++ definition for the functions defined in this compilation unit. #### [` to_string `]() std::string to\_string() const Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [CompilationUnit]( "LIEF::pdb::CompilationUnit") &CU) #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::pdb::CompilationUnit::Iterator"), std::bidirectional\_iterator\_tag, [CompilationUnit]( "LIEF::pdb::CompilationUnit"), std::ptrdiff\_t, const [CompilationUnit]( "LIEF::pdb::CompilationUnit")\*, const [CompilationUnit]( "LIEF::pdb::CompilationUnit")&> Public Types ##### [` implementation `]() using implementation = details::CompilationUnitIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::CompilationUnitIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::pdb::CompilationUnit::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::pdb::CompilationUnit::Iterator") &operator=(const [Iterator]( "LIEF::pdb::CompilationUnit::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::pdb::CompilationUnit::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::pdb::CompilationUnit::Iterator") &operator=([Iterator]( "LIEF::pdb::CompilationUnit::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::pdb::CompilationUnit::Iterator") &operator++() ##### [` operator-- `]() [Iterator]( "LIEF::pdb::CompilationUnit::Iterator") &operator--() ##### [` operator* `]() const [CompilationUnit]( "LIEF::pdb::CompilationUnit") &operator\*() const ##### [` operator-> `]() const [CompilationUnit]( "LIEF::pdb::CompilationUnit") \*operator->() const ##### [` yield `]() std::unique\_ptr<[CompilationUnit]( "LIEF::pdb::CompilationUnit")> yield() Transfer ownership of the compilation unit at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) ##### [` operator-- `]() inline DerivedT operator--(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::pdb::CompilationUnit::Iterator") &LHS, const [Iterator]( "LIEF::pdb::CompilationUnit::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::pdb::CompilationUnit::Iterator") &LHS, const [Iterator]( "LIEF::pdb::CompilationUnit::Iterator") &RHS) --- ## [BuildMetadata]() ### [` BuildMetadata `]() class BuildMetadata This class wraps build metadata represented by the codeview symbols: `S_COMPILE3, S_COMPILE2, S_BUILDINFO, S_ENVBLOCK`. Public Types #### [` LANG `]() enum class LANG : uint8\_t *Values:* ##### [` C `]() enumerator C = 0x00 ##### [` CPP `]() enumerator CPP = 0x01 ##### [` FORTRAN `]() enumerator FORTRAN = 0x02 ##### [` MASM `]() enumerator MASM = 0x03 ##### [` PASCAL_LANG `]() enumerator PASCAL\_LANG = 0x04 ##### [` BASIC `]() enumerator BASIC = 0x05 ##### [` COBOL `]() enumerator COBOL = 0x06 ##### [` LINK `]() enumerator LINK = 0x07 ##### [` CVTRES `]() enumerator CVTRES = 0x08 ##### [` CVTPGD `]() enumerator CVTPGD = 0x09 ##### [` CSHARP `]() enumerator CSHARP = 0x0a ##### [` VB `]() enumerator VB = 0x0b ##### [` ILASM `]() enumerator ILASM = 0x0c ##### [` JAVA `]() enumerator JAVA = 0x0d ##### [` JSCRIPT `]() enumerator JSCRIPT = 0x0e ##### [` MSIL `]() enumerator MSIL = 0x0f ##### [` HLSL `]() enumerator HLSL = 0x10 ##### [` OBJC `]() enumerator OBJC = 0x11 ##### [` OBJCPP `]() enumerator OBJCPP = 0x12 ##### [` SWIFT `]() enumerator SWIFT = 0x13 ##### [` ALIASOBJ `]() enumerator ALIASOBJ = 0x14 ##### [` RUST `]() enumerator RUST = 0x15 ##### [` GO `]() enumerator GO = 0x16 ##### [` UNKNOWN `]() enumerator UNKNOWN = 0xFF #### [` CPU `]() enum class CPU : uint16\_t *Values:* ##### [` INTEL_8080 `]() enumerator INTEL\_8080 = 0x0 ##### [` INTEL_8086 `]() enumerator INTEL\_8086 = 0x1 ##### [` INTEL_80286 `]() enumerator INTEL\_80286 = 0x2 ##### [` INTEL_80386 `]() enumerator INTEL\_80386 = 0x3 ##### [` INTEL_80486 `]() enumerator INTEL\_80486 = 0x4 ##### [` PENTIUM `]() enumerator PENTIUM = 0x5 ##### [` PENTIUMPRO `]() enumerator PENTIUMPRO = 0x6 ##### [` PENTIUM3 `]() enumerator PENTIUM3 = 0x7 ##### [` MIPS `]() enumerator MIPS = 0x10 ##### [` MIPS16 `]() enumerator MIPS16 = 0x11 ##### [` MIPS32 `]() enumerator MIPS32 = 0x12 ##### [` MIPS64 `]() enumerator MIPS64 = 0x13 ##### [` MIPSI `]() enumerator MIPSI = 0x14 ##### [` MIPSII `]() enumerator MIPSII = 0x15 ##### [` MIPSIII `]() enumerator MIPSIII = 0x16 ##### [` MIPSIV `]() enumerator MIPSIV = 0x17 ##### [` MIPSV `]() enumerator MIPSV = 0x18 ##### [` M68000 `]() enumerator M68000 = 0x20 ##### [` M68010 `]() enumerator M68010 = 0x21 ##### [` M68020 `]() enumerator M68020 = 0x22 ##### [` M68030 `]() enumerator M68030 = 0x23 ##### [` M68040 `]() enumerator M68040 = 0x24 ##### [` ALPHA `]() enumerator ALPHA = 0x30 ##### [` ALPHA_21164 `]() enumerator ALPHA\_21164 = 0x31 ##### [` ALPHA_21164A `]() enumerator ALPHA\_21164A = 0x32 ##### [` ALPHA_21264 `]() enumerator ALPHA\_21264 = 0x33 ##### [` ALPHA_21364 `]() enumerator ALPHA\_21364 = 0x34 ##### [` PPC601 `]() enumerator PPC601 = 0x40 ##### [` PPC603 `]() enumerator PPC603 = 0x41 ##### [` PPC604 `]() enumerator PPC604 = 0x42 ##### [` PPC620 `]() enumerator PPC620 = 0x43 ##### [` PPCFP `]() enumerator PPCFP = 0x44 ##### [` PPCBE `]() enumerator PPCBE = 0x45 ##### [` SH3 `]() enumerator SH3 = 0x50 ##### [` SH3E `]() enumerator SH3E = 0x51 ##### [` SH3DSP `]() enumerator SH3DSP = 0x52 ##### [` SH4 `]() enumerator SH4 = 0x53 ##### [` SHMEDIA `]() enumerator SHMEDIA = 0x54 ##### [` ARM3 `]() enumerator ARM3 = 0x60 ##### [` ARM4 `]() enumerator ARM4 = 0x61 ##### [` ARM4T `]() enumerator ARM4T = 0x62 ##### [` ARM5 `]() enumerator ARM5 = 0x63 ##### [` ARM5T `]() enumerator ARM5T = 0x64 ##### [` ARM6 `]() enumerator ARM6 = 0x65 ##### [` ARM_XMAC `]() enumerator ARM\_XMAC = 0x66 ##### [` ARM_WMMX `]() enumerator ARM\_WMMX = 0x67 ##### [` ARM7 `]() enumerator ARM7 = 0x68 ##### [` OMNI `]() enumerator OMNI = 0x70 ##### [` IA64 `]() enumerator IA64 = 0x80 ##### [` IA64_2 `]() enumerator IA64\_2 = 0x81 ##### [` CEE `]() enumerator CEE = 0x90 ##### [` AM33 `]() enumerator AM33 = 0xa0 ##### [` M32R `]() enumerator M32R = 0xb0 ##### [` TRICORE `]() enumerator TRICORE = 0xc0 ##### [` X64 `]() enumerator X64 = 0xd0 ##### [` EBC `]() enumerator EBC = 0xe0 ##### [` THUMB `]() enumerator THUMB = 0xf0 ##### [` ARMNT `]() enumerator ARMNT = 0xf4 ##### [` ARM64 `]() enumerator ARM64 = 0xf6 ##### [` HYBRID_X86ARM64 `]() enumerator HYBRID\_X86ARM64 = 0xf7 ##### [` ARM64EC `]() enumerator ARM64EC = 0xf8 ##### [` ARM64X `]() enumerator ARM64X = 0xf9 ##### [` D3D11_SHADER `]() enumerator D3D11\_SHADER = 0x100 ##### [` UNKNOWN `]() enumerator UNKNOWN = 0xff Public Functions #### [` BuildMetadata `]() BuildMetadata(std::unique\_ptr<details::BuildMetadata> impl) #### [` ~BuildMetadata `]() ~BuildMetadata() #### [` frontend_version `]() [version\_t]( "LIEF::pdb::BuildMetadata::version_t") frontend\_version() const Version of the frontend (e.g. `19.36.32537`). #### [` backend_version `]() [version\_t]( "LIEF::pdb::BuildMetadata::version_t") backend\_version() const Version of the backend (e.g. `14.36.32537`). #### [` version `]() std::string version() const Version of the *tool* as a string. For instance, `Microsoft (R) CVTRES`, `Microsoft (R) LINK`. #### [` language `]() [LANG]( "LIEF::pdb::BuildMetadata::LANG") language() const Source language. #### [` target_cpu `]() [CPU]( "LIEF::pdb::BuildMetadata::CPU") target\_cpu() const Target [CPU](). #### [` build_info `]() std::optional<[build\_info\_t]( "LIEF::pdb::BuildMetadata::build_info_t")> build\_info() const Build information represented by the `S_BUILDINFO` symbol. #### [` env `]() std::vector<std::string> env() const Environment information represented by the `S_ENVBLOCK` symbol. #### [` to_string `]() std::string to\_string() const Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [BuildMetadata]( "LIEF::pdb::BuildMetadata") &meta) #### [` version_t `]() struct version\_t This structure represents a version for the backend or the frontend. Public Members ##### [` major `]() uint16\_t major = 0 Major version. ##### [` minor `]() uint16\_t minor = 0 Minor version. ##### [` build `]() uint16\_t build = 0 Build version. ##### [` qfe `]() uint16\_t qfe = 0 Quick Fix Engineering version. #### [` build_info_t `]() struct build\_info\_t This structure represents information wrapped by the `S_BUILDINFO` symbol. Public Members ##### [` cwd `]() std::string cwd Working directory where the *build tool* was invoked. ##### [` build_tool `]() std::string build\_tool Path to the build tool (e.g. `C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX64\x64\CL.exe`). ##### [` source_file `]() std::string source\_file Source file consumed by the *build tool*. ##### [` pdb `]() std::string pdb PDB path. ##### [` command_line `]() std::string command\_line Command line arguments used to invoke the *build tool*. --- ## [Function]() ### [` Function `]() class Function Public Functions #### [` Function `]() Function(std::unique\_ptr<details::Function> impl) #### [` ~Function `]() ~Function() #### [` name `]() std::string name() const The name of the function (this name is usually demangled). #### [` RVA `]() uint32\_t RVA() const The **Relative** Virtual Address of the function. #### [` code_size `]() uint32\_t code\_size() const The size of the function. #### [` section_name `]() std::string section\_name() const The name of the section in which this function is defined. #### [` debug_location `]() [debug\_location\_t]( "LIEF::debug_location_t") debug\_location() const Original source code location. #### [` to_decl `]() std::string to\_decl(const [DeclOpt]( "LIEF::DeclOpt") &opt = [DeclOpt]( "LIEF::DeclOpt")()) const Generate a C/C++ definition for this function. #### [` to_string `]() std::string to\_string() const Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Function]( "LIEF::pdb::Function") &F) #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::pdb::Function::Iterator"), std::forward\_iterator\_tag, [Function]( "LIEF::pdb::Function"), std::ptrdiff\_t, const [Function]( "LIEF::pdb::Function")\*, const [Function]( "LIEF::pdb::Function")&> Public Types ##### [` implementation `]() using implementation = details::FunctionIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::FunctionIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::pdb::Function::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::pdb::Function::Iterator") &operator=(const [Iterator]( "LIEF::pdb::Function::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::pdb::Function::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::pdb::Function::Iterator") &operator=([Iterator]( "LIEF::pdb::Function::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::pdb::Function::Iterator") &operator++() ##### [` operator* `]() const [Function]( "LIEF::pdb::Function") &operator\*() const ##### [` operator-> `]() const [Function]( "LIEF::pdb::Function") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Function]( "LIEF::pdb::Function")> yield() Transfer ownership of the function at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::pdb::Function::Iterator") &LHS, const [Iterator]( "LIEF::pdb::Function::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::pdb::Function::Iterator") &LHS, const [Iterator]( "LIEF::pdb::Function::Iterator") &RHS) --- ## [Type]() ### [` Type `]() class Type This is the base class for any PDB type. Subclassed by [LIEF::pdb::types::Array](), [LIEF::pdb::types::BitField](), [LIEF::pdb::types::ClassLike](), [LIEF::pdb::types::Enum](), [LIEF::pdb::types::Function](), [LIEF::pdb::types::Modifier](), [LIEF::pdb::types::Pointer](), [LIEF::pdb::types::Simple]() Public Types #### [` KIND `]() enum class KIND *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` CLASS `]() enumerator CLASS ##### [` POINTER `]() enumerator POINTER ##### [` SIMPLE `]() enumerator SIMPLE ##### [` ENUM `]() enumerator ENUM ##### [` FUNCTION `]() enumerator FUNCTION ##### [` MODIFIER `]() enumerator MODIFIER ##### [` BITFIELD `]() enumerator BITFIELD ##### [` ARRAY `]() enumerator ARRAY ##### [` UNION `]() enumerator UNION ##### [` STRUCTURE `]() enumerator STRUCTURE ##### [` INTERFACE `]() enumerator INTERFACE Public Functions #### [` Type `]() Type(std::unique\_ptr<details::Type> impl) #### [` kind `]() [KIND]( "LIEF::pdb::Type::KIND") kind() const #### [` size `]() std::optional<uint64\_t> size() const Size of the type. This size should match the value of `sizeof(...)` applied to this type. #### [` name `]() std::optional<std::string> name() const [Type]()’s name (if present). #### [` to_decl `]() std::string to\_decl(const [DeclOpt]( "LIEF::DeclOpt") &opt = [DeclOpt]( "LIEF::DeclOpt")()) const Generates a C/C++ definition for this type. #### [` Tas `]() template<class T> inline const [T]( "LIEF::pdb::Type::as::T") \*as() const #### [` ~Type `]() virtual ~Type() Public Static Functions #### [` create `]() static std::unique\_ptr<[Type]( "LIEF::pdb::Type")> create(std::unique\_ptr<details::Type> impl) #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::pdb::Type::Iterator"), std::forward\_iterator\_tag, [Type]( "LIEF::pdb::Type"), std::ptrdiff\_t, const [Type]( "LIEF::pdb::Type")\*, const [Type]( "LIEF::pdb::Type")&> Public Types ##### [` implementation `]() using implementation = details::TypeIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::TypeIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::pdb::Type::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::pdb::Type::Iterator") &operator=(const [Iterator]( "LIEF::pdb::Type::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::pdb::Type::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::pdb::Type::Iterator") &operator=([Iterator]( "LIEF::pdb::Type::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::pdb::Type::Iterator") &operator++() ##### [` operator* `]() const [Type]( "LIEF::pdb::Type") &operator\*() const ##### [` operator-> `]() const [Type]( "LIEF::pdb::Type") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Type]( "LIEF::pdb::Type")> yield() Transfer ownership of the type at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::pdb::Type::Iterator") &LHS, const [Iterator]( "LIEF::pdb::Type::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::pdb::Type::Iterator") &LHS, const [Iterator]( "LIEF::pdb::Type::Iterator") &RHS) --- ## [Array]() ### [` Array `]() class Array : public LIEF::pdb::[Type]( "LIEF::pdb::Type") This class represents a `LF_ARRAY` PDB type. Public Functions #### [` ArgsArray `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::pdb::Type"), [Args]( "LIEF::pdb::types::Array::Array::Args")&&...>>> inline Array([Args]( "LIEF::pdb::types::Array::Array::Args")&&... args) #### [` numberof_elements `]() size\_t numberof\_elements() const The number of elements in this array. #### [` element_type `]() std::unique\_ptr<[Type]( "LIEF::pdb::Type")> element\_type() const [Type]() of the elements. #### [` index_type `]() std::unique\_ptr<[Type]( "LIEF::pdb::Type")> index\_type() const [Type]() of the index. #### [` ~Array `]() ~Array() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::pdb::Type") \*type) --- ## [Attribute (type)]() ### [` Attribute `]() class Attribute This class represents an attribute (`LF_MEMBER`) in an aggregate (class, struct, union, …). Public Functions #### [` Attribute `]() Attribute(std::unique\_ptr<details::Attribute> impl) #### [` name `]() std::string name() const Name of the attribute. #### [` type `]() std::unique\_ptr<[Type]( "LIEF::pdb::Type")> type() const [Type]() of this attribute. #### [` field_offset `]() uint64\_t field\_offset() const Offset of this attribute in the aggregate. #### [` ~Attribute `]() ~Attribute() #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::pdb::types::Attribute::Iterator"), std::forward\_iterator\_tag, [Attribute]( "LIEF::pdb::types::Attribute"), std::ptrdiff\_t, const [Attribute]( "LIEF::pdb::types::Attribute")\*, const [Attribute]( "LIEF::pdb::types::Attribute")&> Public Types ##### [` implementation `]() using implementation = details::AttributeIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::AttributeIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::pdb::types::Attribute::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::pdb::types::Attribute::Iterator") &operator=(const [Iterator]( "LIEF::pdb::types::Attribute::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::pdb::types::Attribute::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::pdb::types::Attribute::Iterator") &operator=([Iterator]( "LIEF::pdb::types::Attribute::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::pdb::types::Attribute::Iterator") &operator++() ##### [` operator* `]() const [Attribute]( "LIEF::pdb::types::Attribute") &operator\*() const ##### [` operator-> `]() const [Attribute]( "LIEF::pdb::types::Attribute") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Attribute]( "LIEF::pdb::types::Attribute")> yield() Transfer ownership of the attribute at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::pdb::types::Attribute::Iterator") &LHS, const [Iterator]( "LIEF::pdb::types::Attribute::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::pdb::types::Attribute::Iterator") &LHS, const [Iterator]( "LIEF::pdb::types::Attribute::Iterator") &RHS) --- ## [BitField]() ### [` BitField `]() class BitField : public LIEF::pdb::[Type]( "LIEF::pdb::Type") This class represents a `LF_BITFIELD` PDB type. Public Functions #### [` ArgsBitField `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::pdb::Type"), [Args]( "LIEF::pdb::types::BitField::BitField::Args")&&...>>> inline BitField([Args]( "LIEF::pdb::types::BitField::BitField::Args")&&... args) #### [` ~BitField `]() ~BitField() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::pdb::Type") \*type) --- ## [ClassLike]() ### [` ClassLike `]() class ClassLike : public LIEF::pdb::[Type]( "LIEF::pdb::Type") This class abstracts the following PDB types: `LF_STRUCTURE`, `LF_INTERFACE`, `LF_CLASS` or `LF_UNION`. Subclassed by [LIEF::pdb::types::Class](), [LIEF::pdb::types::Interface](), [LIEF::pdb::types::Structure](), [LIEF::pdb::types::Union]() Public Types #### [` attributes_iterator `]() using attributes\_iterator = [iterator\_range]( "LIEF::iterator_range")<[Attribute]( "LIEF::pdb::types::Attribute")::[Iterator]( "LIEF::pdb::types::Attribute::Iterator")> Attributes iterator. #### [` methods_iterator `]() using methods\_iterator = [iterator\_range]( "LIEF::iterator_range")<[Method]( "LIEF::pdb::types::Method")::[Iterator]( "LIEF::pdb::types::Method::Iterator")> Methods iterator. Public Functions #### [` ArgsClassLike `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::pdb::Type"), [Args]( "LIEF::pdb::types::ClassLike::ClassLike::Args")&&...>>> inline ClassLike([Args]( "LIEF::pdb::types::ClassLike::ClassLike::Args")&&... args) #### [` unique_name `]() std::string unique\_name() const Mangled type name. #### [` attributes `]() [attributes\_iterator]( "LIEF::pdb::types::ClassLike::attributes_iterator") attributes() const [Iterator]() over the different attributes defined in this class-like type. #### [` methods `]() [methods\_iterator]( "LIEF::pdb::types::ClassLike::methods_iterator") methods() const [Iterator]() over the different methods implemented in this class-type type. #### [` ~ClassLike `]() ~ClassLike() override Public Static Functions #### [` Tclassof `]() template<class T> static inline bool classof(const [T]( "LIEF::pdb::types::ClassLike::classof::T")\*, std::enable\_if\_t<std::is\_base\_of\_v<[ClassLike]( "LIEF::pdb::types::ClassLike"), [T]( "LIEF::pdb::types::ClassLike::classof::T")>>\* = 0) --- ## [Structure]() ### [` Structure `]() class Structure : public LIEF::pdb::types::[ClassLike]( "LIEF::pdb::types::ClassLike") [Interface]() for the `LF_STRUCTURE` PDB type. Public Functions #### [` ArgsStructure `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[ClassLike]( "LIEF::pdb::types::ClassLike"), [Args]( "LIEF::pdb::types::Structure::Structure::Args")&&...>>> inline Structure([Args]( "LIEF::pdb::types::Structure::Structure::Args")&&... args) #### [` ~Structure `]() ~Structure() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::pdb::Type") \*type) --- ## [Class]() ### [` Class `]() class Class : public LIEF::pdb::types::[ClassLike]( "LIEF::pdb::types::ClassLike") [Interface]() for the `LF_CLASS` PDB type. Public Functions #### [` ArgsClass `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[ClassLike]( "LIEF::pdb::types::ClassLike"), [Args]( "LIEF::pdb::types::Class::Class::Args")&&...>>> inline Class([Args]( "LIEF::pdb::types::Class::Class::Args")&&... args) #### [` ~Class `]() ~Class() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::pdb::Type") \*type) --- ## [Interface]() ### [` Interface `]() class Interface : public LIEF::pdb::types::[ClassLike]( "LIEF::pdb::types::ClassLike") [Interface]() for the `LF_INTERFACE` PDB type. Public Functions #### [` ArgsInterface `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[ClassLike]( "LIEF::pdb::types::ClassLike"), [Args]( "LIEF::pdb::types::Interface::Interface::Args")&&...>>> inline Interface([Args]( "LIEF::pdb::types::Interface::Interface::Args")&&... args) #### [` ~Interface `]() ~Interface() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::pdb::Type") \*type) --- ## [Enum]() ### [` Enum `]() class Enum : public LIEF::pdb::[Type]( "LIEF::pdb::Type") This class represents a `LF_ENUM` PDB type. Public Functions #### [` ArgsEnum `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::pdb::Type"), [Args]( "LIEF::pdb::types::Enum::Enum::Args")&&...>>> inline Enum([Args]( "LIEF::pdb::types::Enum::Enum::Args")&&... args) #### [` unique_name `]() std::string unique\_name() const [Enum]()’s mangled name. #### [` entries `]() std::vector<[Entry]( "LIEF::pdb::types::Enum::Entry")> entries() const Return the different entries associated with this enum. #### [` underlying_type `]() const [Type]( "LIEF::pdb::Type") \*underlying\_type() const The underlying type that is used to encode this enum. #### [` find_entry `]() std::optional<[Entry]( "LIEF::pdb::types::Enum::Entry")> find\_entry(int64\_t value) const Try to find the enum matching the given value. #### [` ~Enum `]() ~Enum() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::pdb::Type") \*type) #### [` Entry `]() class Entry This class represents an enum entry which is essentially composed of a name and its value (integer). Public Functions ##### [` Entry `]() Entry(std::unique\_ptr<details::EnumEntry> impl) ##### [` Entry `]() Entry([Entry]( "LIEF::pdb::types::Enum::Entry::Entry") &&other) noexcept ##### [` operator= `]() [Entry]( "LIEF::pdb::types::Enum::Entry") &operator=([Entry]( "LIEF::pdb::types::Enum::Entry") &&other) noexcept ##### [` name `]() std::string name() const [Enum]() entry’s name. ##### [` value `]() int64\_t value() const [Enum]() entry’s value (if any). ##### [` ~Entry `]() ~Entry() --- ## [Function (type)]() ### [` Function `]() class Function : public LIEF::pdb::[Type]( "LIEF::pdb::Type") This class represents a `LF_PROCEDURE` PDB type. Public Types #### [` parameters_t `]() using parameters\_t = std::vector<std::unique\_ptr<[Type]( "LIEF::pdb::Type")>> Public Functions #### [` ArgsFunction `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::pdb::Type"), [Args]( "LIEF::pdb::types::Function::Function::Args")&&...>>> inline Function([Args]( "LIEF::pdb::types::Function::Function::Args")&&... args) #### [` return_type `]() std::unique\_ptr<[Type]( "LIEF::pdb::Type")> return\_type() const [Type]() returned by the function. #### [` parameters `]() [parameters\_t]( "LIEF::pdb::types::Function::parameters_t") parameters() const Types of the function’s parameters. #### [` ~Function `]() ~Function() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::pdb::Type") \*type) --- ## [Method (type)]() ### [` Method `]() class Method This class represents a [Method]() (`LF_ONEMETHOD`) that can be defined in a [ClassLike]() PDB type ([Class](), [Structure](), [Union](), [Interface]()). Public Types #### [` TYPE `]() enum class TYPE The type (or property) of the method. *Values:* ##### [` VANILLA `]() enumerator VANILLA = 0x00 Regular instance method. ##### [` VIRTUAL `]() enumerator VIRTUAL = 0x01 Virtual method. ##### [` STATIC `]() enumerator STATIC = 0x02 Static method. ##### [` FRIEND `]() enumerator FRIEND = 0x03 Friend method. ##### [` INTRODUCING_VIRTUAL `]() enumerator INTRODUCING\_VIRTUAL = 0x04 Virtual method that introduces a new vtable slot. ##### [` PURE_VIRTUAL `]() enumerator PURE\_VIRTUAL = 0x05 Pure virtual method (abstract). ##### [` PURE_INTRODUCING_VIRTUAL `]() enumerator PURE\_INTRODUCING\_VIRTUAL = 0x06 Pure virtual method that introduces a new vtable slot. #### [` ACCESS `]() enum class ACCESS : uint8\_t Visibility access for the method. *Values:* ##### [` NONE `]() enumerator NONE = 0 ##### [` PRIVATE `]() enumerator PRIVATE = 1 No access specifier (or unknown). ##### [` PROTECTED `]() enumerator PROTECTED = 2 Private access. ##### [` PUBLIC `]() enumerator PUBLIC = 3 Protected access. Public Functions #### [` Method `]() Method(std::unique\_ptr<details::Method> impl) #### [` name `]() std::string name() const Name of the method. #### [` type `]() [TYPE]( "LIEF::pdb::types::Method::TYPE") type() const Type/Properties of the method (virtual, static, etc.). #### [` access `]() [ACCESS]( "LIEF::pdb::types::Method::ACCESS") access() const Visibility access (public, private, …). #### [` ~Method `]() ~Method() #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::pdb::types::Method::Iterator"), std::forward\_iterator\_tag, [Method]( "LIEF::pdb::types::Method"), std::ptrdiff\_t, const [Method]( "LIEF::pdb::types::Method")\*, const [Method]( "LIEF::pdb::types::Method")&> Public Types ##### [` implementation `]() using implementation = details::MethodIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(std::unique\_ptr<details::MethodIt> impl) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::pdb::types::Method::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::pdb::types::Method::Iterator") &operator=(const [Iterator]( "LIEF::pdb::types::Method::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::pdb::types::Method::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::pdb::types::Method::Iterator") &operator=([Iterator]( "LIEF::pdb::types::Method::Iterator")&&) noexcept ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::pdb::types::Method::Iterator") &operator++() ##### [` operator* `]() const [Method]( "LIEF::pdb::types::Method") &operator\*() const ##### [` operator-> `]() const [Method]( "LIEF::pdb::types::Method") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Method]( "LIEF::pdb::types::Method")> yield() Transfer ownership of the method at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::pdb::types::Method::Iterator") &LHS, const [Iterator]( "LIEF::pdb::types::Method::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::pdb::types::Method::Iterator") &LHS, const [Iterator]( "LIEF::pdb::types::Method::Iterator") &RHS) --- ## [Modifier]() ### [` Modifier `]() class Modifier : public LIEF::pdb::[Type]( "LIEF::pdb::Type") This class represents a `LF_MODIFIER` PDB type. Public Functions #### [` ArgsModifier `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::pdb::Type"), [Args]( "LIEF::pdb::types::Modifier::Modifier::Args")&&...>>> inline Modifier([Args]( "LIEF::pdb::types::Modifier::Modifier::Args")&&... args) #### [` underlying_type `]() std::unique\_ptr<[Type]( "LIEF::pdb::Type")> underlying\_type() const Underlying type targeted by this modifier. #### [` ~Modifier `]() ~Modifier() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::pdb::Type") \*type) --- ## [Pointer]() ### [` Pointer `]() class Pointer : public LIEF::pdb::[Type]( "LIEF::pdb::Type") This class represents a `LF_POINTER` PDB type. Public Functions #### [` ArgsPointer `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::pdb::Type"), [Args]( "LIEF::pdb::types::Pointer::Pointer::Args")&&...>>> inline Pointer([Args]( "LIEF::pdb::types::Pointer::Pointer::Args")&&... args) #### [` underlying_type `]() std::unique\_ptr<[Type]( "LIEF::pdb::Type")> underlying\_type() const The underlying type pointed by this pointer. #### [` ~Pointer `]() ~Pointer() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::pdb::Type") \*type) --- ## [Simple]() ### [` Simple `]() class Simple : public LIEF::pdb::[Type]( "LIEF::pdb::Type") This class represents primitive types (int, float, …) which are also named *simple* types in the PDB format. Public Types #### [` TYPES `]() enum class TYPES Identifier of the primitive type. These values correspond to the low bits of the CodeView [Type]() Index. *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` VOID_ `]() enumerator VOID\_ = 0x0003 ##### [` SCHAR `]() enumerator SCHAR = 0x0010 Signed Character. ##### [` UCHAR `]() enumerator UCHAR = 0x0020 Unsigned Character. ##### [` RCHAR `]() enumerator RCHAR = 0x0070 “Real” Character (char) ##### [` WCHAR `]() enumerator WCHAR = 0x0071 Wide Character (wchar\_t). ##### [` CHAR16 `]() enumerator CHAR16 = 0x007a 16-bit Character (char16\_t) ##### [` CHAR32 `]() enumerator CHAR32 = 0x007b 32-bit Character (char32\_t) ##### [` CHAR8 `]() enumerator CHAR8 = 0x007c 8-bit Character (char8\_t) ##### [` SBYTE `]() enumerator SBYTE = 0x0068 Signed Byte. ##### [` UBYTE `]() enumerator UBYTE = 0x0069 Unsigned Byte. ##### [` SSHORT `]() enumerator SSHORT = 0x0011 Signed Short. ##### [` USHORT `]() enumerator USHORT = 0x0021 Unsigned Short. ##### [` SINT16 `]() enumerator SINT16 = 0x0072 Explicit Signed 16-bit Integer. ##### [` UINT16 `]() enumerator UINT16 = 0x0073 Explicit Unsigned 16-bit Integer. ##### [` SLONG `]() enumerator SLONG = 0x0012 Signed Long. ##### [` ULONG `]() enumerator ULONG = 0x0022 Unsigned Long. ##### [` SINT32 `]() enumerator SINT32 = 0x0074 Explicit Signed 32-bit Integer. ##### [` UINT32 `]() enumerator UINT32 = 0x0075 Explicit Unsigned 32-bit Integer. ##### [` SQUAD `]() enumerator SQUAD = 0x0013 Signed Quadword. ##### [` UQUAD `]() enumerator UQUAD = 0x0023 Unsigned Quadword. ##### [` SINT64 `]() enumerator SINT64 = 0x0076 Explicit Signed 64-bit Integer. ##### [` UINT64 `]() enumerator UINT64 = 0x0077 Explicit Unsigned 64-bit Integer. ##### [` SOCTA `]() enumerator SOCTA = 0x0014 Signed Octaword. ##### [` UOCTA `]() enumerator UOCTA = 0x0024 Unsigned Octaword. ##### [` SINT128 `]() enumerator SINT128 = 0x0078 Explicit Signed 128-bit Integer. ##### [` UINT128 `]() enumerator UINT128 = 0x0079 Explicit Unsigned 128-bit Integer. ##### [` FLOAT16 `]() enumerator FLOAT16 = 0x0046 16-bit Floating point ##### [` FLOAT32 `]() enumerator FLOAT32 = 0x0040 32-bit Floating point (float) ##### [` FLOAT32_PARTIAL_PRECISION `]() enumerator FLOAT32\_PARTIAL\_PRECISION = 0x45 ##### [` FLOAT48 `]() enumerator FLOAT48 = 0x0044 48-bit Floating point ##### [` FLOAT64 `]() enumerator FLOAT64 = 0x0041 64-bit Floating point (double) ##### [` FLOAT80 `]() enumerator FLOAT80 = 0x0042 80-bit Floating point ##### [` FLOAT128 `]() enumerator FLOAT128 = 0x0043 128-bit Floating point ##### [` COMPLEX16 `]() enumerator COMPLEX16 = 0x0056 ##### [` COMPLEX32 `]() enumerator COMPLEX32 = 0x0050 ##### [` COMPLEX32_PARTIAL_PRECISION `]() enumerator COMPLEX32\_PARTIAL\_PRECISION = 0x0055 ##### [` COMPLEX48 `]() enumerator COMPLEX48 = 0x0054 ##### [` COMPLEX64 `]() enumerator COMPLEX64 = 0x0051 ##### [` COMPLEX80 `]() enumerator COMPLEX80 = 0x0052 ##### [` COMPLEX128 `]() enumerator COMPLEX128 = 0x0053 ##### [` BOOL8 `]() enumerator BOOL8 = 0x0030 8-bit Boolean ##### [` BOOL16 `]() enumerator BOOL16 = 0x0031 16-bit Boolean ##### [` BOOL32 `]() enumerator BOOL32 = 0x0032 32-bit Boolean ##### [` BOOL64 `]() enumerator BOOL64 = 0x0033 64-bit Boolean ##### [` BOOL128 `]() enumerator BOOL128 = 0x0034 128-bit Boolean #### [` MODES `]() enum class MODES : uint32\_t [Modifier]() applied to the underlying type. In the PDB [Simple]() [Type]() encoding, these represent pointer attributes. *Values:* ##### [` DIRECT `]() enumerator DIRECT = 0x00000000 Not a pointer (direct access). ##### [` FAR_POINTER `]() enumerator FAR\_POINTER = 0x00000200 Far pointer. ##### [` HUGE_POINTER `]() enumerator HUGE\_POINTER = 0x00000300 Huge pointer. ##### [` NEAR_POINTER32 `]() enumerator NEAR\_POINTER32 = 0x00000400 32-bit Near pointer ##### [` FAR_POINTER32 `]() enumerator FAR\_POINTER32 = 0x00000500 32-bit Far pointer ##### [` NEAR_POINTER64 `]() enumerator NEAR\_POINTER64 = 0x00000600 64-bit Near pointer ##### [` NEAR_POINTER128 `]() enumerator NEAR\_POINTER128 = 0x00000700 128-bit Near pointer Public Functions #### [` ArgsSimple `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[Type]( "LIEF::pdb::Type"), [Args]( "LIEF::pdb::types::Simple::Simple::Args")&&...>>> inline Simple([Args]( "LIEF::pdb::types::Simple::Simple::Args")&&... args) #### [` type `]() [TYPES]( "LIEF::pdb::types::Simple::TYPES") type() const Returns the underlying primitive type. #### [` modes `]() [MODES]( "LIEF::pdb::types::Simple::MODES") modes() const Returns the mode (pointer type) of this [Simple]() type. #### [` is_pointer `]() inline bool is\_pointer() const Check if this simple type is a pointer. #### [` is_signed `]() inline bool is\_signed() const Check if the underlying type is signed. #### [` ~Simple `]() ~Simple() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::pdb::Type") \*type) --- ## [Union]() ### [` Union `]() class Union : public LIEF::pdb::types::[ClassLike]( "LIEF::pdb::types::ClassLike") This class represents a `LF_UNION` PDB type. Public Functions #### [` ArgsUnion `]() template<typename ...Args, typename = std::enable\_if\_t<std::is\_constructible\_v<[ClassLike]( "LIEF::pdb::types::ClassLike"), [Args]( "LIEF::pdb::types::Union::Union::Args")&&...>>> inline Union([Args]( "LIEF::pdb::types::Union::Union::Args")&&... args) #### [` ~Union `]() ~Union() override Public Static Functions #### [` classof `]() static inline bool classof(const [Type]( "LIEF::pdb::Type") \*type) ## [Utilities]() ### [` LIEF::pdb::is_pdb `]() bool LIEF::pdb::is\_pdb(const std::string &pdb\_path) Check if the file given in parameter points to a PDB file. --- documentID: "8fde65b34ef071cf986043126072ebc822d99a8148416f7a669512d67f88be6c" docname: "extended/pdb/index" title: "PDB - LIEF Documentation" description: "Locate and load PDB debug information, associate it with a PE binary, inspect symbols and types, and generate C++ declarations with LIEF Extended." canonical: "https://lief.re/doc/latest/extended/pdb/index.html" markdownURL: "https://lief.re/doc/latest/extended/pdb/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "98cb9d75b8cf00ddb5de464213b530a766a0bc28cfa69f610da733676e00b03b" --- # [PDB]() API - [C++]() - [Python]() - [Rust]() ## [Introduction]() Unlike DWARF debug information, PDB debug information is always stored externally from the original binary. Nevertheless, the original binary keeps the path of the PDB file in the `lief.PE.CodeViewPDB.filename()` ( [`lief::pe::debug::CodeViewPDB::filename`]() ; [`lief.PE.CodeViewPDB.filename`]() ; [`LIEF::PE::CodeViewPDB::filename()`]() ) attribute. Based on this fact, `lief.Binary.debug_info()` ( [`lief::pe::Binary::debug_info`]() ; [`lief.Binary.debug_info`]() ; [`LIEF::Binary::debug_info()`]() ) tries to instantiate a `lief.pdb.DebugInfo` ( [`lief::pdb::DebugInfo`]() ; [`lief.pdb.DebugInfo`]() ; [`LIEF::pdb::DebugInfo`]() ) object using this file path. If it fails, it returns `nullptr` or `None`. You can also instantiate a `lief.pdb.DebugInfo` ( [`lief::pdb::DebugInfo`]() ; [`lief.pdb.DebugInfo`]() ; [`LIEF::pdb::DebugInfo`]() ) object using `lief.pdb.load()` ( [`lief::pdb::load`]() ; [`lief.pdb.load()`]() ; [`LIEF::pdb::load()`]() ): **Python** ```python pe: lief.PE.Binary if (debug_info := pe.debug_info) is not None: assert isinstance(debug_info, lief.pdb.DebugInfo) print(f"PDB Debug handler: {debug_info}") # Or you can load the PDB directly: pdb = lief.pdb.load("some.pdb") ``` **C++** ```cpp std::unique_ptr pe; if (const LIEF::DebugInfo* info = pe->debug_info()) { assert(LIEF::pdb::DebugInfo::classof(info) && "Wrong DebugInfo type"); const auto& pdb = static_cast(*info); } // Or loading directly the pdb file std::unique_ptr pdb = LIEF::pdb::load("some.pdb"); ``` **Rust** ```rust let pe: &lief::pe::Binary = some_pe; if let Some(lief::DebugInfo::Pdb(pdb)) = pe.debug_info() { // PDB debug info } let pdb = lief::pdb::load("some.pdb"); ``` At this point, the PDB instance ( `lief.pdb.DebugInfo` ( [`lief::pdb::DebugInfo`]() ; [`lief.pdb.DebugInfo`]() ; [`LIEF::pdb::DebugInfo`]() )) can be used to explore the PDB debug information: **Python** ```python pdb: lief.pdb.DebugInfo print(f"arg={pdb.age}, guid={pdb.guid}") for sym in pdb.public_symbols: print(f"name={sym.name}, section={sym.section_name}, RVA={sym.RVA}") for ty in pdb.types: if isinstance(ty, lief.pdb.types.Class): print(f"Class[name]={ty.name}") for cu in pdb.compilation_units: print(f"module={cu.module_name}") for src in cu.sources: print(f" - {src}") for func in cu.functions: print( f"name={func.name}, section={func.section_name}, RVA={func.RVA}, code_size={func.code_size}" ) ``` **C++** ```cpp std::unique_ptr pdb; log(Level::Info, "age={}, guid={}", std::to_string(pdb->age()), pdb->guid()); for (const LIEF::pdb::PublicSymbol& symbol : pdb->public_symbols()) { log(Level::Info, "name={}, section={}, RVA={}", symbol.name(), symbol.section_name(), std::to_string(symbol.RVA())); } for (const LIEF::pdb::Type& ty : pdb->types()) { if (LIEF::pdb::types::Class::classof(&ty)) { const auto* clazz = ty.as(); log(Level::Info, "Class[name]={}", clazz->name().value_or("")); } } for (const LIEF::pdb::CompilationUnit& CU : pdb->compilation_units()) { log(Level::Info, "module={}", CU.module_name()); for (const std::string& src : CU.sources()) { log(Level::Info, " - {}", src); } for (const LIEF::pdb::Function& func : CU.functions()) { log(Level::Info, "name={}, section={}, RVA={}, code size={}", func.name(), func.section_name(), std::to_string(func.RVA()), std::to_string(func.code_size())); } } ``` **Rust** ```rust let pdb = lief::pdb::load(path).unwrap_or_else(|| { process::exit(1); }); println!("age={}, guid={}", pdb.age(), pdb.guid()); for symbol in pdb.public_symbols() { println!( "name={}, section={}, RVA={}", symbol.name(), symbol.section_name().unwrap_or("".to_string()), symbol.rva() ); } for ty in pdb.types() { if let lief::pdb::Type::Class(clazz) = ty { println!("Class[name]={}", clazz.name().unwrap_or_default()); } } for cu in pdb.compilation_units() { println!("module={}", cu.module_name()); for src in cu.sources() { println!(" - {}", src); } for func in cu.functions() { println!( "name={}, section={}, RVA={}, code_size={}", func.name(), func.section_name(), func.rva(), func.code_size() ); } } ``` ## [Attach a PDB to a binary]() You can also use the `lief.abstract.Binary.load_debug_info()` ( [`lief::generic::Binary::load_debug_info`]() ; [`lief.Binary.load_debug_info()`]() ; [`LIEF::Binary::load_debug_info()`]() ) function to bind a PDB file to an existing `lief.abstract.Binary` ( [`lief::generic::Binary`]() ; [`lief.Binary`]() ; [`LIEF::Binary`]() ): **Python** ```python binary: lief.Binary dbg = binary.load_debug_info(r"C:\Users\romain\LIEF.pdb") ``` **C++** ```cpp std::unique_ptr binary; binary->load_debug_info(R"(C:\Users\romain\LIEF.pdb)"); ``` **Rust** ```rust let bin: &mut dyn lief::generic::Binary = some_bin; let path = PathBuf::from("C:\\Users\\romain\\LIEF.pdb"); bin.load_debug_info(&path); ``` Note that `lief.abstract.Binary.load_debug_info()` ( [`lief::generic::Binary::load_debug_info`]() ; [`lief.Binary.load_debug_info()`]() ; [`LIEF::Binary::load_debug_info()`]() ) can also attach an external DWARF file to a PE binary, even though this is not a typical use case. For instance, the [BinaryNinja]() and [Ghidra]() DWARF export plugins can generate a DWARF file for a PE binary based on analysis performed by these frameworks. This external loading API is useful for adding debug information that might not already be present in the binary. For instance, the `lief.Binary.disassemble()` ( [`lief::generic::Binary::disassemble`]() ; [`lief::generic::Binary::disassemble_symbol`]() ; [`lief::generic::Binary::disassemble_address`]() ; [`lief::generic::Binary::disassemble_slice`]() ; [`LIEF::Binary::disassemble()`]() ; [`lief.Binary.disassemble()`]() ; [`lief.Binary.disassemble_from_bytes()`]() ) function can leverage this additional debug information to disassemble functions defined in the debug file previously loaded: **Python** ```python binary: lief.Binary dbg = binary.load_debug_info(r"C:\Users\romain\LIEF.pdb") # The location (address/size) of `my_function` is defined in LIEF.pdb for inst in binary.disassemble("my_function"): print(inst) ``` **C++** ```cpp std::unique_ptr binary; binary->load_debug_info(R"(C:\Users\romain\LIEF.pdb)"); // The location (address/size) of `my_function` is defined in LIEF.pdb for (const LIEF::assembly::Instruction& inst : binary->disassemble("my_function")) { std::cout << inst << '\n'; } ``` **Rust** ```rust let bin: &mut dyn lief::generic::Binary = some_bin; let path = PathBuf::from("C:\\Users\\romain\\LIEF.pdb"); bin.load_debug_info(&path); // The location (address/size) of `my_function` is defined in LIEF.pdb for inst in bin.disassemble_symbol("my_function") { println!("{inst}"); } ``` ## [Generating C/C++ Definitions]() PDB types, functions and compilation units can be turned into C/C++ definitions using the `to_decl()` function: - `lief.pdb.Type.to_decl()` ( [`lief::pdb::Type::to_decl`]() ; [`lief::pdb::Type::to_decl_with_opt`]() ; [`lief.pdb.Type.to_decl()`]() ; [`LIEF::pdb::Type::to_decl()`]() ) - `lief.pdb.Function.to_decl()` ( [`lief::pdb::Function::to_decl`]() ; [`lief::pdb::Function::to_decl_with_opt`]() ; [`lief.pdb.Function.to_decl()`]() ; [`LIEF::pdb::Function::to_decl()`]() ) - `lief.pdb.CompilationUnit.to_decl()` ( [`lief::pdb::CompilationUnit::to_decl`]() ; [`lief::pdb::CompilationUnit::to_decl_with_opt`]() ; [`lief.pdb.CompilationUnit.to_decl()`]() ; [`LIEF::pdb::CompilationUnit::to_decl()`]() ) The generated output can be configured with a `lief.DeclOpt` ( [`lief::DeclOpt`]() ; [`lief.DeclOpt`]() ; [`LIEF::DeclOpt`]() ) structure: **Python** ```python pdb: lief.pdb.DebugInfo opt = lief.DeclOpt() opt.is_cpp = True for ty in pdb.types: print(ty.to_decl(opt)) for cu in pdb.compilation_units: # Emit the definition of the functions of the compilation unit print(cu.to_decl(opt)) for func in cu.functions: print(func.to_decl(opt)) ``` **C++** ```cpp std::unique_ptr pdb; LIEF::DeclOpt opt; opt.is_cpp(true); for (const LIEF::pdb::Type& ty : pdb->types()) { std::cout << ty.to_decl(opt) << '\n'; } for (const LIEF::pdb::CompilationUnit& CU : pdb->compilation_units()) { std::cout << CU.to_decl(opt) << '\n'; for (const LIEF::pdb::Function& func : CU.functions()) { std::cout << func.to_decl(opt) << '\n'; } } ``` **Rust** ```rust let pdb: &lief::pdb::DebugInfo = some_pdb; let opt = lief::DeclOpt { is_cpp: true, ..Default::default() }; for ty in pdb.types() { println!("{}", ty.to_decl_with_opt(&opt)); } for cu in pdb.compilation_units() { println!("{}", cu.to_decl_with_opt(&opt)); for func in cu.functions() { println!("{}", func.to_decl_with_opt(&opt)); } } ``` --- ## [API]() You can find the documentation of the API for the different languages here: [Python API]() [C++ API]() Rust API: [`lief::pdb`]() --- documentID: "88121a5f381e7fbef87bbb8127d3dbcd61a1d2e84ba88a9801ccd72dbb538e80" docname: "extended/pdb/python" title: "PDB Python API - LIEF Documentation" description: "PDB Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/extended/pdb/python.html" markdownURL: "https://lief.re/doc/latest/extended/pdb/python.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "43b8ccd61271994ae2acf504b5661d65b37a46a5d8ea466dd4c79326cc4f82bf" --- # [Python]() ## [` lief.pdb.load `]() lief.pdb.load(*path: str*) → [lief.pdb.DebugInfo]( "lief.pdb.DebugInfo") | None Load the PDB from the given path ## [DebugInfo]() ### [` lief.pdb.DebugInfo `]() class lief.pdb.DebugInfo Bases: [`DebugInfo`]( "lief._lief.DebugInfo") This class provides an interface for PDB files. One can instantiate this class using [`lief.pdb.load()`]( "lief.pdb.load") or [`lief.pdb.DebugInfo.from_file()`]( "lief.pdb.DebugInfo.from_file") #### [` age `]() property age → int The number of times the PDB file has been written. #### [` compilation_units `]() property compilation\_units → Iterator[[lief.pdb.CompilationUnit]( "lief.pdb.CompilationUnit") | None] Iterator over the [`CompilationUnit`]( "lief.pdb.CompilationUnit") from the PDB’s DBI stream. CompilationUnit are also named “Module” in the PDB’s official documentation #### [` find_public_symbol `]() find\_public\_symbol(*self*, *name: str*) → [lief.\_lief.pdb.PublicSymbol]( "lief._lief.pdb.PublicSymbol") | None Try to find the PublicSymbol from the given name (based on the public symbol stream) The function returns `None` if the symbol can’t be found. ```python debug_info: lief.pdb.DebugInfo = ... if sym := debug_info.find_public_symbol("MiSyncSystemPdes"): print("found") ``` #### [` find_typefind_type `]() find\_type(*self*, *name: str*) → [lief.\_lief.pdb.Type]( "lief._lief.pdb.Type") | None **find\_type(*self*, *index: int*) → [lief.\_lief.pdb.Type]( "lief._lief.pdb.Type") | None** Overloaded function. 1. `find_type(self, name: str) -> Optional[lief._lief.pdb.Type]` Find the type with the given name 2. `find_type(self, index: int) -> Optional[lief._lief.pdb.Type]` Find type at the given index #### [` from_file `]() from\_file(*filepath: str | os.PathLike*) → [lief.pdb.DebugInfo]( "lief.pdb.DebugInfo") | None = <nanobind.nb\_func object> #### [` guid `]() property guid → str Unique identifier of the PDB file. #### [` public_symbols `]() property public\_symbols → Iterator[[lief.pdb.PublicSymbol]( "lief.pdb.PublicSymbol") | None] Return an iterator over the public symbol stream. #### [` types `]() property types → Iterator[[lief.pdb.Type]( "lief.pdb.Type") | None] Return an iterator over the different types registered in this PDB file --- ## [CompilationUnit]() ### [` lief.pdb.CompilationUnit `]() class lief.pdb.CompilationUnit Bases: `object` This class represents a Compilation Unit (or Module) in a PDB file #### [` build_metadata `]() property build\_metadata → [lief.pdb.BuildMetadata]( "lief.pdb.BuildMetadata") | None #### [` functions `]() property functions → Iterator[[lief.pdb.Function]( "lief.pdb.Function") | None] Return an iterator over the functions defined in this compilation unit. If the PDB does not contain or has an empty DBI stream, it returns an empty iterator. #### [` module_name `]() property module\_name → str Name (or path) to the COFF object (`.obj`) associated with this compilation unit (e.g. `e:\obj.amd64fre\minkernel\ntos\hvl\mp\objfre\amd64\hvlp.obj`) #### [` object_filename `]() property object\_filename → str Name of path to the original binary object (COFF, Archive) in which the compilation unit was located before being linked. e.g. `e:\obj.amd64fre\minkernel\ntos\hvl\mp\objfre\amd64\hvl.lib` #### [` sources `]() property sources → Iterator[str] Iterator over the sources files that compose this compilation unit. These files include **headers** (`.h, .hpp`, …). #### [` to_decl `]() to\_decl(*self*, *opt: [lief.\_lief.DeclOpt]( "lief._lief.DeclOpt") | None = None*) → str Generates a C/C++ definition for the functions defined in this compilation unit --- ## [BuildMetadata]() ### [` lief.pdb.BuildMetadata `]() class lief.pdb.BuildMetadata Bases: `object` This class wraps build metadata represented by the codeview symbols: `S_COMPILE3, S_COMPILE2, S_BUILDINFO` #### [` CPU `]() class CPU(*\*values*) Bases: `Enum` ##### [` ALPHA `]() ALPHA = 48 ##### [` ALPHA_21164 `]() ALPHA\_21164 = 49 ##### [` ALPHA_21164A `]() ALPHA\_21164A = 50 ##### [` ALPHA_21264 `]() ALPHA\_21264 = 51 ##### [` ALPHA_21364 `]() ALPHA\_21364 = 52 ##### [` AM33 `]() AM33 = 160 ##### [` ARM3 `]() ARM3 = 96 ##### [` ARM4 `]() ARM4 = 97 ##### [` ARM4T `]() ARM4T = 98 ##### [` ARM5 `]() ARM5 = 99 ##### [` ARM5T `]() ARM5T = 100 ##### [` ARM6 `]() ARM6 = 101 ##### [` ARM64 `]() ARM64 = 246 ##### [` ARM64EC `]() ARM64EC = 248 ##### [` ARM64X `]() ARM64X = 249 ##### [` ARM7 `]() ARM7 = 104 ##### [` ARMNT `]() ARMNT = 244 ##### [` ARM_WMMX `]() ARM\_WMMX = 103 ##### [` ARM_XMAC `]() ARM\_XMAC = 102 ##### [` CEE `]() CEE = 144 ##### [` D3D11_SHADER `]() D3D11\_SHADER = 256 ##### [` EBC `]() EBC = 224 ##### [` HYBRID_X86ARM64 `]() HYBRID\_X86ARM64 = 247 ##### [` IA64 `]() IA64 = 128 ##### [` IA64_2 `]() IA64\_2 = 129 ##### [` INTEL_80286 `]() INTEL\_80286 = 2 ##### [` INTEL_80386 `]() INTEL\_80386 = 3 ##### [` INTEL_80486 `]() INTEL\_80486 = 4 ##### [` INTEL_8080 `]() INTEL\_8080 = 0 ##### [` INTEL_8086 `]() INTEL\_8086 = 1 ##### [` M32R `]() M32R = 176 ##### [` M68000 `]() M68000 = 32 ##### [` M68010 `]() M68010 = 33 ##### [` M68020 `]() M68020 = 34 ##### [` M68030 `]() M68030 = 35 ##### [` M68040 `]() M68040 = 36 ##### [` MIPS `]() MIPS = 16 ##### [` MIPS16 `]() MIPS16 = 17 ##### [` MIPS32 `]() MIPS32 = 18 ##### [` MIPS64 `]() MIPS64 = 19 ##### [` MIPSI `]() MIPSI = 20 ##### [` MIPSII `]() MIPSII = 21 ##### [` MIPSIII `]() MIPSIII = 22 ##### [` MIPSIV `]() MIPSIV = 23 ##### [` MIPSV `]() MIPSV = 24 ##### [` OMNI `]() OMNI = 112 ##### [` PENTIUM `]() PENTIUM = 5 ##### [` PENTIUM3 `]() PENTIUM3 = 7 ##### [` PENTIUMPRO `]() PENTIUMPRO = 6 ##### [` PPC601 `]() PPC601 = 64 ##### [` PPC603 `]() PPC603 = 65 ##### [` PPC604 `]() PPC604 = 66 ##### [` PPC620 `]() PPC620 = 67 ##### [` PPCBE `]() PPCBE = 69 ##### [` PPCFP `]() PPCFP = 68 ##### [` SH3 `]() SH3 = 80 ##### [` SH3DSP `]() SH3DSP = 82 ##### [` SH3E `]() SH3E = 81 ##### [` SH4 `]() SH4 = 83 ##### [` SHMEDIA `]() SHMEDIA = 84 ##### [` THUMB `]() THUMB = 240 ##### [` TRICORE `]() TRICORE = 192 ##### [` UNKNOWN `]() UNKNOWN = 255 ##### [` X64 `]() X64 = 208 #### [` LANG `]() class LANG(*\*values*) Bases: `Enum` ##### [` ALIASOBJ `]() ALIASOBJ = 20 ##### [` BASIC `]() BASIC = 5 ##### [` C `]() C = 0 ##### [` COBOL `]() COBOL = 6 ##### [` CPP `]() CPP = 1 ##### [` CSHARP `]() CSHARP = 10 ##### [` CVTPGD `]() CVTPGD = 9 ##### [` CVTRES `]() CVTRES = 8 ##### [` FORTRAN `]() FORTRAN = 2 ##### [` GO `]() GO = 22 ##### [` HLSL `]() HLSL = 16 ##### [` ILASM `]() ILASM = 12 ##### [` JAVA `]() JAVA = 13 ##### [` JSCRIPT `]() JSCRIPT = 14 ##### [` LINK `]() LINK = 7 ##### [` MASM `]() MASM = 3 ##### [` MSIL `]() MSIL = 15 ##### [` OBJC `]() OBJC = 17 ##### [` OBJCPP `]() OBJCPP = 18 ##### [` PASCAL_LANG `]() PASCAL\_LANG = 4 ##### [` RUST `]() RUST = 21 ##### [` SWIFT `]() SWIFT = 19 ##### [` UNKNOWN `]() UNKNOWN = 255 ##### [` VB `]() VB = 11 #### [` backend_version `]() property backend\_version → [lief.pdb.BuildMetadata.version\_t]( "lief.pdb.BuildMetadata.version_t") Version of the backend (e.g. `14.36.32537`) #### [` build_info `]() property build\_info → [lief.pdb.BuildMetadata.build\_info\_t]( "lief.pdb.BuildMetadata.build_info_t") | None Build information represented by the `S_BUILDINFO` symbol #### [` build_info_t `]() class build\_info\_t Bases: `object` Build information represented by the `S_BUILDINFO` symbol ##### [` build_tool `]() property build\_tool → str Path to the build tool (e.g. `C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX64\x64\CL.exe` ##### [` command_line `]() property command\_line → str Command line arguments used to invoke the *build tool* ##### [` cwd `]() property cwd → str Working directory where the *build tool* was invoked ##### [` pdb `]() property pdb → str PDB path ##### [` source_file `]() property source\_file → str Source file consumed by the *build tool* #### [` env `]() property env → list[str] Environment information represented by the `S_ENVBLOCK` symbol #### [` frontend_version `]() property frontend\_version → [lief.pdb.BuildMetadata.version\_t]( "lief.pdb.BuildMetadata.version_t") Version of the frontend (e.g. `19.36.32537`) #### [` language `]() property language → [lief.pdb.BuildMetadata.LANG]( "lief.pdb.BuildMetadata.LANG") Source language #### [` target_cpu `]() property target\_cpu → [lief.pdb.BuildMetadata.CPU]( "lief.pdb.BuildMetadata.CPU") Target CPU #### [` version `]() property version → str Version of the *tool* as a string. For instance, `Microsoft (R) CVTRES`, `Microsoft (R) LINK`. #### [` version_t `]() class version\_t Bases: `object` This structure represents a version for the backend or the frontend ##### [` build `]() property build → int Build version ##### [` major `]() property major → int Major version ##### [` minor `]() property minor → int Minor version ##### [` qfe `]() property qfe → int Quick Fix Engineering version --- ## [PublicSymbol]() ### [` lief.pdb.PublicSymbol `]() class lief.pdb.PublicSymbol Bases: `object` This class provides general information (RVA, name) about a symbol from the PDB’s public symbol stream (or Public symbol hash stream) #### [` RVA `]() property RVA → int **Relative** Virtual Address of this symbol. This function returns 0 if the RVA can’t be computed. #### [` demangled_name `]() property demangled\_name → str Demangled representation of the symbol #### [` name `]() property name → str Name of the symbol #### [` section_name `]() property section\_name → str Name of the section in which this symbol is defined (e.g. `.text`). This function returns an empty string if the section’s name can’t be found --- ## [Function]() ### [` lief.pdb.Function `]() class lief.pdb.Function Bases: `object` #### [` RVA `]() property RVA → int The **Relative** Virtual Address of the function #### [` code_size `]() property code\_size → int The size of the function #### [` debug_location `]() property debug\_location → [lief.debug\_location\_t]( "lief.debug_location_t") Original source code location. #### [` name `]() property name → str Name of the function #### [` section_name `]() property section\_name → str The name of the section in which this function is defined #### [` to_decl `]() to\_decl(*self*, *opt: [lief.\_lief.DeclOpt]( "lief._lief.DeclOpt") | None = None*) → str Generates a C/C++ definition for this function --- ## [Type]() ![Inheritance diagram of lief._lief.pdb.types.BitField, lief._lief.pdb.types.Simple, lief._lief.pdb.types.Pointer, lief._lief.pdb.types.Enum, lief._lief.pdb.types.Function, lief._lief.pdb.types.Modifier, lief._lief.pdb.types.Structure, lief._lief.pdb.Type, lief._lief.pdb.types.Union, lief._lief.pdb.types.ClassLike, lief._lief.pdb.types.Class, lief._lief.pdb.types.Array, lief._lief.pdb.types.Interface](https://lief.re/doc/latest/_images/inheritance-952ae3e355a822cae902cbc68085c5c37fbc5a6b.png) ### [` lief.pdb.Type `]() class lief.pdb.Type Bases: `object` #### [` KIND `]() class KIND(*\*values*) Bases: `Enum` ##### [` ARRAY `]() ARRAY = 8 ##### [` BITFIELD `]() BITFIELD = 7 ##### [` CLASS `]() CLASS = 1 ##### [` ENUM `]() ENUM = 4 ##### [` FUNCTION `]() FUNCTION = 5 ##### [` INTERFACE `]() INTERFACE = 11 ##### [` MODIFIER `]() MODIFIER = 6 ##### [` POINTER `]() POINTER = 2 ##### [` SIMPLE `]() SIMPLE = 3 ##### [` STRUCTURE `]() STRUCTURE = 10 ##### [` UNION `]() UNION = 9 ##### [` UNKNOWN `]() UNKNOWN = 0 #### [` kind `]() property kind → [lief.pdb.Type.KIND]( "lief.pdb.Type.KIND") Discriminator for the type’s subclasses #### [` name `]() property name → str | None Type’s name (if present) #### [` size `]() property size → int | None Size of the type. This size should match the value of `sizeof(...)` applied to this type. #### [` to_decl `]() to\_decl(*self*, *opt: [lief.\_lief.DeclOpt]( "lief._lief.DeclOpt") | None = None*) → str Generates a C/C++ definition for this type --- ## [Array]() ![Inheritance diagram of lief._lief.pdb.types.Array](https://lief.re/doc/latest/_images/inheritance-f28b4e63a5cc76efa09eb7a07662c4040aa4f599.png) ### [` lief.pdb.types.Array `]() class lief.pdb.types.Array Bases: [`Type`]( "lief._lief.pdb.Type") This class represents a `LF_ARRAY` PDB type. #### [` element_type `]() property element\_type → [lief.pdb.Type]( "lief.pdb.Type") | None Type of the elements #### [` index_type `]() property index\_type → [lief.pdb.Type]( "lief.pdb.Type") | None Type of the index #### [` numberof_elements `]() property numberof\_elements → int Number of elements in this array --- ## [Attribute (type)]() ![Inheritance diagram of lief._lief.pdb.types.Attribute](https://lief.re/doc/latest/_images/inheritance-18ad895604bc4d1f2a96839805427a4727c8431d.png) ### [` lief.pdb.types.Attribute `]() class lief.pdb.types.Attribute Bases: `object` This class represents an attribute (`LF_MEMBER`) in an aggregate (class, struct, union, …) #### [` field_offset `]() property field\_offset → int Offset of this attribute in the aggregate #### [` name `]() property name → str Name of this attribute. #### [` type `]() property type → [lief.pdb.Type]( "lief.pdb.Type") | None Type of this attribute --- ## [BitField]() ![Inheritance diagram of lief._lief.pdb.types.BitField](https://lief.re/doc/latest/_images/inheritance-9423dff1cb3550ecb3d8ee0bda40c8e3c9c36387.png) ### [` lief.pdb.types.BitField `]() class lief.pdb.types.BitField Bases: [`Type`]( "lief._lief.pdb.Type") This class represents a `LF_BITFIELD` PDB type --- ## [ClassLike]() ![Inheritance diagram of lief._lief.pdb.types.Structure, lief._lief.pdb.types.Union, lief._lief.pdb.types.ClassLike, lief._lief.pdb.types.Class, lief._lief.pdb.types.Interface](https://lief.re/doc/latest/_images/inheritance-e440677ae6c6d988abba1229bb8d8bd2131bdf8c.png) ### [` lief.pdb.types.ClassLike `]() class lief.pdb.types.ClassLike Bases: [`Type`]( "lief._lief.pdb.Type") This class abstracts the following PDB types: `LF_STRUCTURE`, `LF_INTERFACE`, `LF_CLASS` or `LF_UNION`. #### [` attributes `]() property attributes → Iterator[[lief.pdb.types.Attribute]( "lief.pdb.types.Attribute") | None] Return an iterator over the different attributes defined in this class-like type #### [` methods `]() property methods → Iterator[[lief.pdb.types.Method]( "lief.pdb.types.Method") | None] Return an iterator over the different methods implemented in this class-like type #### [` unique_name `]() property unique\_name → str Mangled type name. --- ## [Structure]() ![Inheritance diagram of lief._lief.pdb.types.Structure](https://lief.re/doc/latest/_images/inheritance-a55383dbcbe04781941ab91864294d2a19da711c.png) ### [` lief.pdb.types.Structure `]() class lief.pdb.types.Structure Bases: [`ClassLike`]( "lief._lief.pdb.types.ClassLike") Interface for the `LF_STRUCTURE` PDB type --- ## [Class]() ![Inheritance diagram of lief._lief.pdb.types.Class](https://lief.re/doc/latest/_images/inheritance-36d5c26476207384120f5440567745912dbc095b.png) ### [` lief.pdb.types.Class `]() class lief.pdb.types.Class Bases: [`ClassLike`]( "lief._lief.pdb.types.ClassLike") Interface for the `LF_CLASS` PDB type --- ## [Interface]() ![Inheritance diagram of lief._lief.pdb.types.Interface](https://lief.re/doc/latest/_images/inheritance-df00a7ddc3983d22da9ed8ee3573169d8fce81fc.png) ### [` lief.pdb.types.Interface `]() class lief.pdb.types.Interface Bases: [`ClassLike`]( "lief._lief.pdb.types.ClassLike") Interface for the `LF_INTERFACE` PDB type --- ## [Enum]() ![Inheritance diagram of lief._lief.pdb.types.Enum](https://lief.re/doc/latest/_images/inheritance-37663d898db687270e874e20a112296b59beaeb8.png) ### [` lief.pdb.types.Enum `]() class lief.pdb.types.Enum Bases: [`Type`]( "lief._lief.pdb.Type") This class represents a `LF_ENUM` PDB type #### [` Entry `]() class Entry Bases: `object` This class represents an enum entry which is essentially composed of a name and its value (integer). ##### [` name `]() property name → str Enum entry’s name ##### [` value `]() property value → int Enum entry’s value (if any) #### [` entries `]() property entries → list[[lief.pdb.types.Enum.Entry]( "lief.pdb.types.Enum.Entry")] Return the different entries associated with this enum #### [` find_entry `]() find\_entry(*self*, *value: int*) → [lief.\_lief.pdb.types.Enum.Entry]( "lief._lief.pdb.types.Enum.Entry") | None Try to find the enum matching the given value #### [` underlying_type `]() property underlying\_type → [lief.pdb.Type]( "lief.pdb.Type") | None The underlying type that is used to encode this enum #### [` unique_name `]() property unique\_name → str Enum’s mangled name --- ## [Function (type)]() ![Inheritance diagram of lief._lief.pdb.types.Function](https://lief.re/doc/latest/_images/inheritance-8b2f0995ae649d99cd7c17491db3b63f136c2b1f.png) ### [` lief.pdb.types.Function `]() class lief.pdb.types.Function Bases: [`Type`]( "lief._lief.pdb.Type") This class represents a `LF_PROCEDURE` PDB type #### [` parameters `]() property parameters → list[[lief.pdb.Type]( "lief.pdb.Type") | None] Types of the function’s parameters #### [` return_type `]() property return\_type → [lief.pdb.Type]( "lief.pdb.Type") | None Type returned by this function --- ## [Method (type)]() ![Inheritance diagram of lief._lief.pdb.types.Method](https://lief.re/doc/latest/_images/inheritance-ad5e28f993a95276d902f69f13f26e23717b0569.png) ### [` lief.pdb.types.Method `]() class lief.pdb.types.Method Bases: `object` This class represents a Method (`LF_ONEMETHOD`) that can be defined in ClassLike PDB type #### [` ACCESS `]() class ACCESS(*\*values*) Bases: `Enum` ##### [` NONE `]() NONE = 0 ##### [` PRIVATE `]() PRIVATE = 1 ##### [` PROTECTED `]() PROTECTED = 2 ##### [` PUBLIC `]() PUBLIC = 3 #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` ##### [` FRIEND `]() FRIEND = 3 ##### [` INTRODUCING_VIRTUAL `]() INTRODUCING\_VIRTUAL = 4 ##### [` PURE_INTRODUCING_VIRTUAL `]() PURE\_INTRODUCING\_VIRTUAL = 6 ##### [` PURE_VIRTUAL `]() PURE\_VIRTUAL = 5 ##### [` STATIC `]() STATIC = 2 ##### [` VANILLA `]() VANILLA = 0 ##### [` VIRTUAL `]() VIRTUAL = 1 #### [` access `]() property access → [lief.pdb.types.Method.ACCESS]( "lief.pdb.types.Method.ACCESS") Visibility access (public, private, …) #### [` name `]() property name → str Name of the method #### [` type `]() property type → [lief.pdb.types.Method.TYPE]( "lief.pdb.types.Method.TYPE") Type/Properties of the method (virtual, static, etc.) --- ## [Modifier]() ![Inheritance diagram of lief._lief.pdb.types.Modifier](https://lief.re/doc/latest/_images/inheritance-2a89d31d739249b115cc5185f7ff09e90a9123ab.png) ### [` lief.pdb.types.Modifier `]() class lief.pdb.types.Modifier Bases: [`Type`]( "lief._lief.pdb.Type") This class represents a `LF_MODIFIER` PDB type #### [` underlying_type `]() property underlying\_type → [lief.pdb.Type]( "lief.pdb.Type") | None Underlying type targeted by this modifier --- ## [Pointer]() ![Inheritance diagram of lief._lief.pdb.types.Pointer](https://lief.re/doc/latest/_images/inheritance-7d5ea3a7eb75fb6ed4804d594b4e97d638bfbb6a.png) ### [` lief.pdb.types.Pointer `]() class lief.pdb.types.Pointer Bases: [`Type`]( "lief._lief.pdb.Type") This class represents a `LF_POINTER` PDB type #### [` underlying_type `]() property underlying\_type → [lief.pdb.Type]( "lief.pdb.Type") | None The underlying type pointed to by this pointer --- ## [Simple]() ![Inheritance diagram of lief._lief.pdb.types.Simple](https://lief.re/doc/latest/_images/inheritance-1eb91166d02bffb1db870e7ec6e0607b6b085367.png) ### [` lief.pdb.types.Simple `]() class lief.pdb.types.Simple Bases: [`Type`]( "lief._lief.pdb.Type") This class represents primitive types (int, float, …) which are also named *simple* types in the PDB format. #### [` MODES `]() class MODES(*\*values*) Bases: `Enum` ##### [` DIRECT `]() DIRECT = 0 ##### [` FAR_POINTER `]() FAR\_POINTER = 512 ##### [` FAR_POINTER32 `]() FAR\_POINTER32 = 1280 ##### [` HUGE_POINTER `]() HUGE\_POINTER = 768 ##### [` NEAR_POINTER128 `]() NEAR\_POINTER128 = 1792 ##### [` NEAR_POINTER32 `]() NEAR\_POINTER32 = 1024 ##### [` NEAR_POINTER64 `]() NEAR\_POINTER64 = 1536 #### [` TYPES `]() class TYPES(*\*values*) Bases: `Enum` ##### [` BOOL128 `]() BOOL128 = 52 ##### [` BOOL16 `]() BOOL16 = 49 ##### [` BOOL32 `]() BOOL32 = 50 ##### [` BOOL64 `]() BOOL64 = 51 ##### [` BOOL8 `]() BOOL8 = 48 ##### [` CHAR16 `]() CHAR16 = 122 ##### [` CHAR32 `]() CHAR32 = 123 ##### [` CHAR8 `]() CHAR8 = 124 ##### [` COMPLEX128 `]() COMPLEX128 = 83 ##### [` COMPLEX16 `]() COMPLEX16 = 86 ##### [` COMPLEX32 `]() COMPLEX32 = 80 ##### [` COMPLEX32_PARTIAL_PRECISION `]() COMPLEX32\_PARTIAL\_PRECISION = 85 ##### [` COMPLEX48 `]() COMPLEX48 = 84 ##### [` COMPLEX64 `]() COMPLEX64 = 81 ##### [` COMPLEX80 `]() COMPLEX80 = 82 ##### [` FLOAT128 `]() FLOAT128 = 67 ##### [` FLOAT16 `]() FLOAT16 = 70 ##### [` FLOAT32 `]() FLOAT32 = 64 ##### [` FLOAT32_PARTIAL_PRECISION `]() FLOAT32\_PARTIAL\_PRECISION = 69 ##### [` FLOAT48 `]() FLOAT48 = 68 ##### [` FLOAT64 `]() FLOAT64 = 65 ##### [` FLOAT80 `]() FLOAT80 = 66 ##### [` RCHAR `]() RCHAR = 112 ##### [` SBYTE `]() SBYTE = 104 ##### [` SCHAR `]() SCHAR = 16 ##### [` SINT128 `]() SINT128 = 120 ##### [` SINT16 `]() SINT16 = 114 ##### [` SINT32 `]() SINT32 = 116 ##### [` SINT64 `]() SINT64 = 118 ##### [` SLONG `]() SLONG = 18 ##### [` SOCTA `]() SOCTA = 20 ##### [` SQUAD `]() SQUAD = 19 ##### [` SSHORT `]() SSHORT = 17 ##### [` UBYTE `]() UBYTE = 105 ##### [` UCHAR `]() UCHAR = 32 ##### [` UINT128 `]() UINT128 = 121 ##### [` UINT16 `]() UINT16 = 115 ##### [` UINT32 `]() UINT32 = 117 ##### [` UINT64 `]() UINT64 = 119 ##### [` ULONG `]() ULONG = 34 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` UOCTA `]() UOCTA = 36 ##### [` UQUAD `]() UQUAD = 35 ##### [` USHORT `]() USHORT = 33 ##### [` VOID `]() VOID = 3 ##### [` WCHAR `]() WCHAR = 113 #### [` is_pointer `]() property is\_pointer → bool Check if this simple type is a pointer. #### [` is_signed `]() property is\_signed → bool Check if the underlying type is signed. #### [` modes `]() property modes → [lief.pdb.types.Simple.MODES]( "lief.pdb.types.Simple.MODES") Returns the mode (pointer type) of this Simple type. #### [` type `]() property type → [lief.pdb.types.Simple.TYPES]( "lief.pdb.types.Simple.TYPES") Returns the underlying primitive type. --- ## [Union]() ![Inheritance diagram of lief._lief.pdb.types.Union](https://lief.re/doc/latest/_images/inheritance-e59b025963759e65a0c034cf06decd200411719e.png) ### [` lief.pdb.types.Union `]() class lief.pdb.types.Union Bases: [`ClassLike`]( "lief._lief.pdb.types.ClassLike") This class represents a `LF_UNION` PDB type --- ## [Utilities]() ### [` lief.is_pdb `]() lief.is\_pdb(*file: str | os.PathLike*) → bool Check if the given file is a `PDB` --- documentID: "d7ccefb715b985f9711912b177aa384d23258889d6b22b1b9fe4d61c98a59c6e" docname: "extended/pdb/rust" title: "PDB Rust API - LIEF Documentation" description: "PDB Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/extended/pdb/rust.html" markdownURL: "https://lief.re/doc/latest/extended/pdb/rust.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "a69d3630c5ec87847ea570b81116a1afc40ad3582d730edc28be970d0a70af5f" --- # [Rust]() > **Note** > > Please check: [`lief::pdb`]() --- documentID: "0c9c18912be25a6405c7b94c0d74ecb4491d3a51311de386ed4a80acbc9986bd" docname: "formats/android/art/cpp" title: "ART C++ API - LIEF Documentation" description: "ART C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/android/art/cpp.html" markdownURL: "https://lief.re/doc/latest/formats/android/art/cpp.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "a2a7eaff96486e530b8aa263396eb0f1b61d5f383161021cbae9ca06af8a74aa" --- # [C++]() ## [Utilities]() ### [` LIEF::ART::is_art `]() bool LIEF::ART::is\_art(std::string\_view file) Check if the given file is an ART one. ### [` LIEF::ART::is_art `]() bool LIEF::ART::is\_art(const std::vector<uint8\_t> &raw) Check if the given raw data is an ART one. ### [` LIEF::ART::version `]() art\_version\_t LIEF::ART::version(std::string\_view file) Return the ART version of the given file. ### [` LIEF::ART::version `]() art\_version\_t LIEF::ART::version(const std::vector<uint8\_t> &raw) Return the ART version of the raw data. ### [` LIEF::ART::android_version `]() LIEF::Android::[ANDROID\_VERSIONS]( "LIEF::Android::ANDROID_VERSIONS") LIEF::ART::android\_version(art\_version\_t version) Return the ANDROID\_VERSIONS associated with the given ART version. --- ## [Parser]() ### [` Parser `]() class Parser Class which parses an ART file and transforms it into an [ART::File]() object. Public Functions #### [` operator= `]() [Parser]( "LIEF::ART::Parser") &operator=(const [Parser]( "LIEF::ART::Parser") &copy) = delete #### [` Parser `]() Parser(const [Parser]( "LIEF::ART::Parser::Parser") &copy) = delete Public Static Functions #### [` parse `]() static std::unique\_ptr<[File]( "LIEF::ART::File")> parse(std::string\_view file) #### [` PathTparse `]() template<class PathT, enable\_if\_path\_t<[PathT]( "LIEF::ART::Parser::parse::PathT")> = 0> static inline std::unique\_ptr<[File]( "LIEF::ART::File")> parse(const [PathT]( "LIEF::ART::Parser::parse::PathT") &file) Same as [parse(std::string\_view)]() but the file is given as a `std::filesystem::path`. #### [` parse `]() static std::unique\_ptr<[File]( "LIEF::ART::File")> parse(std::vector<uint8\_t> data, std::string\_view name = "") --- ## [File]() ### [` File `]() class File : public LIEF::Object Public Functions #### [` operator= `]() [File]( "LIEF::ART::File") &operator=(const [File]( "LIEF::ART::File") &copy) = delete #### [` File `]() File(const [File]( "LIEF::ART::File::File") &copy) = delete #### [` header `]() const [Header]( "LIEF::ART::Header") &header() const #### [` header `]() [Header]( "LIEF::ART::Header") &header() #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~File `]() ~File() override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [File]( "LIEF::ART::File") &art\_file) --- ## [Header]() ### [` Header `]() class Header : public LIEF::Object Public Types #### [` magic_t `]() using magic\_t = std::array<uint8\_t, 4> Public Functions #### [` Header `]() Header() #### [` THeader `]() template<class T> Header(const [T]( "LIEF::ART::Header::Header::T") \*header) #### [` Header `]() Header(const [Header]( "LIEF::ART::Header::Header")&) #### [` operator= `]() [Header]( "LIEF::ART::Header") &operator=(const [Header]( "LIEF::ART::Header")&) #### [` magic `]() [magic\_t]( "LIEF::ART::Header::magic_t") magic() const #### [` version `]() art\_version\_t version() const #### [` image_begin `]() uint32\_t image\_begin() const #### [` image_size `]() uint32\_t image\_size() const #### [` oat_checksum `]() uint32\_t oat\_checksum() const #### [` oat_file_begin `]() uint32\_t oat\_file\_begin() const #### [` oat_file_end `]() uint32\_t oat\_file\_end() const #### [` oat_data_begin `]() uint32\_t oat\_data\_begin() const #### [` oat_data_end `]() uint32\_t oat\_data\_end() const #### [` patch_delta `]() int32\_t patch\_delta() const #### [` image_roots `]() uint32\_t image\_roots() const #### [` pointer_size `]() uint32\_t pointer\_size() const #### [` compile_pic `]() bool compile\_pic() const #### [` nb_sections `]() uint32\_t nb\_sections() const #### [` nb_methods `]() uint32\_t nb\_methods() const #### [` boot_image_begin `]() uint32\_t boot\_image\_begin() const #### [` boot_image_size `]() uint32\_t boot\_image\_size() const #### [` boot_oat_begin `]() uint32\_t boot\_oat\_begin() const #### [` boot_oat_size `]() uint32\_t boot\_oat\_size() const #### [` storage_mode `]() STORAGE\_MODES storage\_mode() const #### [` data_size `]() uint32\_t data\_size() const #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~Header `]() ~Header() override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Header]( "LIEF::ART::Header") &hdr) --- documentID: "ef58a17741ed7b1cfc52ec4a778094d04f9fffabca3ada04ad7437ac2d910df6" docname: "formats/android/art/index" title: "ART - Android - LIEF Documentation" description: "ART in Android. LIEF provides basic support for Android’s ART files. For details about this format, please refer to the Android Formats tutorial." canonical: "https://lief.re/doc/latest/formats/android/art/index.html" markdownURL: "https://lief.re/doc/latest/formats/android/art/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "4e2fd0bb1e578395068bad92c1f97fd3a098480c9729984dccf54737255b6fb8" --- # [ART]() API - [C++]() - [Python]() LIEF provides **basic** support for Android’s ART files. For details about this format, please refer to the [Android Formats]() tutorial. --- documentID: "2143a597977c7c2186fed2f4ea4444ef4d333c9504d1a90a46c10a9e56d8b7c9" docname: "formats/android/art/python" title: "ART Python API - LIEF Documentation" description: "ART Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/android/art/python.html" markdownURL: "https://lief.re/doc/latest/formats/android/art/python.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "68037f5852582fefea05bcb9a7f599285c6c7923de4bbb8f74e25f8576d0c2e2" --- # [Python]() ## [Utilities]() ### [` lief.is_artlief.is_art `]() lief.is\_art(*\*args*) → bool **lief.is\_art(*raw: collections.abc.Sequence[int]*) → bool** Overloaded function. 1. `is_art(path: str) -> bool` Check if the **file** given in parameter is an ART 2. `is_art(raw: collections.abc.Sequence[int]) -> bool` Check if the **raw data** given in parameter is an ART ### [` lief.ART.versionlief.ART.version `]() lief.ART.version(*\*args*) → int **lief.ART.version(*raw: collections.abc.Sequence[int]*) → int** Overloaded function. 1. `version(file: str) -> int` Return the ART version of the **file** given in parameter 2. `version(raw: collections.abc.Sequence[int]) -> int` Return the ART version of the **raw data** given in parameter ### [` lief.ART.android_version `]() lief.ART.android\_version(*art\_version: int*) → [lief.Android.ANDROID\_VERSIONS]( "lief.Android.ANDROID_VERSIONS") Return the [`ANDROID_VERSIONS`]( "lief.Android.ANDROID_VERSIONS") associated with the given ART version --- ## [Parser]() ### [` lief.ART.parselief.ART.parselief.ART.parse `]() lief.ART.parse(*\*args*) → [lief.ART.File]( "lief.ART.File") | None **lief.ART.parse(*raw: collections.abc.Sequence[int]*, *name: str = ''*) → [lief.\_lief.ART.File]( "lief._lief.ART.File") | None **lief.ART.parse(*obj: str | io.IOBase | os.PathLike | bytes | list[int]*, *name: str = ''*) → [lief.\_lief.ART.File]( "lief._lief.ART.File") | None**** Overloaded function. 1. `parse(filename: str) -> Optional[lief._lief.ART.File]` Parse the given filename and return an [`File`]( "lief.ART.File") object 2. `parse(raw: collections.abc.Sequence[int], name: str = '') -> Optional[lief._lief.ART.File]` Parse the given raw data and return an [`File`]( "lief.ART.File") object 3. `parse(obj: Union[str | io.IOBase | os.PathLike | bytes | list[int]], name: str = '') -> Optional[lief._lief.ART.File]` --- ## [File]() ### [` lief.ART.File `]() class lief.ART.File Bases: `Object` ART File representation #### [` header `]() property header → [lief.ART.Header]( "lief.ART.Header") Return the ART [`Header`]( "lief.ART.Header") --- ## [Header]() ### [` lief.ART.Header `]() class lief.ART.Header Bases: `Object` ART Header representation #### [` boot_image_begin `]() property boot\_image\_begin → int #### [` boot_image_size `]() property boot\_image\_size → int #### [` boot_oat_begin `]() property boot\_oat\_begin → int #### [` boot_oat_size `]() property boot\_oat\_size → int #### [` compile_pic `]() property compile\_pic → bool #### [` data_size `]() property data\_size → int #### [` image_begin `]() property image\_begin → int #### [` image_roots `]() property image\_roots → int #### [` image_size `]() property image\_size → int #### [` magic `]() property magic → list[int] #### [` nb_methods `]() property nb\_methods → int #### [` nb_sections `]() property nb\_sections → int #### [` oat_checksum `]() property oat\_checksum → int #### [` oat_data_end `]() property oat\_data\_end → int #### [` oat_file_begin `]() property oat\_file\_begin → int #### [` oat_file_end `]() property oat\_file\_end → int #### [` patch_delta `]() property patch\_delta → int #### [` pointer_size `]() property pointer\_size → int #### [` storage_mode `]() property storage\_mode → lief.ART.STORAGE\_MODES #### [` version `]() property version → int --- documentID: "927c7ba0e7bbb2c21da71165301a12d204827fe193e2ad685dcfeffeb63e0599" docname: "formats/android/dex/cpp" title: "DEX C++ API - LIEF Documentation" description: "DEX C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/android/dex/cpp.html" markdownURL: "https://lief.re/doc/latest/formats/android/dex/cpp.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "d97c8a328018cc60cf286fe21a68d5c86ee099dcfebe008b7b12374ff030945b" --- # [C++]() ## [Utilities]() ### [` LIEF::DEX::is_dex `]() bool LIEF::DEX::is\_dex(std::string\_view file) Check if the given file is a DEX. ### [` LIEF::DEX::is_dex `]() bool LIEF::DEX::is\_dex(const std::vector<uint8\_t> &raw) Check if the given raw data is a DEX. ### [` LIEF::DEX::version `]() dex\_version\_t LIEF::DEX::version(std::string\_view file) Return the DEX version of the given file. ### [` LIEF::DEX::version `]() dex\_version\_t LIEF::DEX::version(const std::vector<uint8\_t> &raw) Return the DEX version of the raw data. --- ## [Parser]() ### [` Parser `]() class Parser [Class]() which parses a DEX file to produce a [DEX::File]() object. Public Functions #### [` operator= `]() [Parser]( "LIEF::DEX::Parser") &operator=(const [Parser]( "LIEF::DEX::Parser") &copy) = delete #### [` Parser `]() Parser(const [Parser]( "LIEF::DEX::Parser::Parser") &copy) = delete Public Static Functions #### [` parse `]() static std::unique\_ptr<[File]( "LIEF::DEX::File")> parse(std::string\_view file) Parse the DEX file from the file path given in parameter. #### [` PathTparse `]() template<class PathT, enable\_if\_path\_t<[PathT]( "LIEF::DEX::Parser::parse::PathT")> = 0> static inline std::unique\_ptr<[File]( "LIEF::DEX::File")> parse(const [PathT]( "LIEF::DEX::Parser::parse::PathT") &file) Same as [parse(std::string\_view)]() but the file is given as a `std::filesystem::path`. #### [` parse `]() static std::unique\_ptr<[File]( "LIEF::DEX::File")> parse(std::vector<uint8\_t> data, std::string\_view name = "") --- ## [File]() ### [` File `]() class File : public LIEF::Object [Class]() that represents a DEX file. Public Types #### [` classes_t `]() using classes\_t = std::unordered\_map<std::string, [Class]( "LIEF::DEX::Class")\*> #### [` classes_list_t `]() using classes\_list\_t = std::vector<std::unique\_ptr<[Class]( "LIEF::DEX::Class")>> #### [` it_classes `]() using it\_classes = [ref\_iterator]( "LIEF::ref_iterator")<[classes\_list\_t]( "LIEF::DEX::File::classes_list_t")&, [Class]( "LIEF::DEX::Class")\*> #### [` it_const_classes `]() using it\_const\_classes = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [classes\_list\_t]( "LIEF::DEX::File::classes_list_t")&, const [Class]( "LIEF::DEX::Class")\*> #### [` methods_t `]() using methods\_t = std::vector<std::unique\_ptr<[Method]( "LIEF::DEX::Method")>> #### [` it_methods `]() using it\_methods = [ref\_iterator]( "LIEF::ref_iterator")<[methods\_t]( "LIEF::DEX::File::methods_t")&, [Method]( "LIEF::DEX::Method")\*> #### [` it_const_methods `]() using it\_const\_methods = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [methods\_t]( "LIEF::DEX::File::methods_t")&, const [Method]( "LIEF::DEX::Method")\*> #### [` strings_t `]() using strings\_t = std::vector<std::unique\_ptr<std::string>> #### [` it_strings `]() using it\_strings = [ref\_iterator]( "LIEF::ref_iterator")<[strings\_t]( "LIEF::DEX::File::strings_t")&, std::string\*> #### [` it_const_strings `]() using it\_const\_strings = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [strings\_t]( "LIEF::DEX::File::strings_t")&, const std::string\*> #### [` types_t `]() using types\_t = std::vector<std::unique\_ptr<[Type]( "LIEF::DEX::Type")>> #### [` it_types `]() using it\_types = [ref\_iterator]( "LIEF::ref_iterator")<[types\_t]( "LIEF::DEX::File::types_t")&, [Type]( "LIEF::DEX::Type")\*> #### [` it_const_types `]() using it\_const\_types = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [types\_t]( "LIEF::DEX::File::types_t")&, const [Type]( "LIEF::DEX::Type")\*> #### [` prototypes_t `]() using prototypes\_t = std::vector<std::unique\_ptr<[Prototype]( "LIEF::DEX::Prototype")>> #### [` it_prototypes `]() using it\_prototypes = [ref\_iterator]( "LIEF::ref_iterator")<[prototypes\_t]( "LIEF::DEX::File::prototypes_t")&, [Prototype]( "LIEF::DEX::Prototype")\*> #### [` it_const_prototypes `]() using it\_const\_prototypes = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [prototypes\_t]( "LIEF::DEX::File::prototypes_t")&, const [Prototype]( "LIEF::DEX::Prototype")\*> #### [` fields_t `]() using fields\_t = std::vector<std::unique\_ptr<[Field]( "LIEF::DEX::Field")>> #### [` it_fields `]() using it\_fields = [ref\_iterator]( "LIEF::ref_iterator")<[fields\_t]( "LIEF::DEX::File::fields_t")&, [Field]( "LIEF::DEX::Field")\*> #### [` it_const_fields `]() using it\_const\_fields = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [fields\_t]( "LIEF::DEX::File::fields_t")&, const [Field]( "LIEF::DEX::Field")\*> Public Functions #### [` operator= `]() [File]( "LIEF::DEX::File") &operator=(const [File]( "LIEF::DEX::File") &copy) = delete #### [` File `]() File(const [File]( "LIEF::DEX::File::File") &copy) = delete #### [` version `]() dex\_version\_t version() const Version of the current DEX file. #### [` name `]() std::string\_view name() const Name of this file. #### [` name `]() void name(const std::string &name) #### [` location `]() std::string\_view location() const Location of this file. #### [` location `]() void location(const std::string &location) #### [` header `]() const [Header]( "LIEF::DEX::Header") &header() const DEX header. #### [` header `]() [Header]( "LIEF::DEX::Header") &header() #### [` classes `]() [it\_const\_classes]( "LIEF::DEX::File::it_const_classes") classes() const **All** classes used in the DEX file #### [` classes `]() [it\_classes]( "LIEF::DEX::File::it_classes") classes() #### [` has_class `]() bool has\_class(const std::string &class\_name) const Check if the given class name exists. #### [` get_class `]() const [Class]( "LIEF::DEX::Class") \*get\_class(const std::string &class\_name) const Return the [DEX::Class]() object associated with the given name. #### [` get_class `]() [Class]( "LIEF::DEX::Class") \*get\_class(const std::string &class\_name) #### [` get_class `]() const [Class]( "LIEF::DEX::Class") \*get\_class(size\_t index) const Return the [DEX::Class]() object associated with the given index. #### [` get_class `]() [Class]( "LIEF::DEX::Class") \*get\_class(size\_t index) #### [` dex2dex_info `]() dex2dex\_info\_t dex2dex\_info() const De-optimize information. #### [` dex2dex_json_info `]() std::string dex2dex\_json\_info() const De-optimize information as JSON. #### [` methods `]() [it\_const\_methods]( "LIEF::DEX::File::it_const_methods") methods() const Return an iterator over **all** the [DEX::Method]() used in this DEX file. #### [` methods `]() [it\_methods]( "LIEF::DEX::File::it_methods") methods() #### [` fields `]() [it\_const\_fields]( "LIEF::DEX::File::it_const_fields") fields() const Return an iterator over **all** the [DEX::Field]() used in this DEX file. #### [` fields `]() [it\_fields]( "LIEF::DEX::File::it_fields") fields() #### [` strings `]() [it\_const\_strings]( "LIEF::DEX::File::it_const_strings") strings() const String pool. #### [` strings `]() [it\_strings]( "LIEF::DEX::File::it_strings") strings() #### [` types `]() [it\_const\_types]( "LIEF::DEX::File::it_const_types") types() const [Type]() pool. #### [` types `]() [it\_types]( "LIEF::DEX::File::it_types") types() #### [` prototypes `]() [it\_prototypes]( "LIEF::DEX::File::it_prototypes") prototypes() [Prototype]() pool. #### [` prototypes `]() [it\_const\_prototypes]( "LIEF::DEX::File::it_const_prototypes") prototypes() const #### [` map `]() const [MapList]( "LIEF::DEX::MapList") &map() const DEX Map. #### [` map `]() [MapList]( "LIEF::DEX::MapList") &map() #### [` save `]() std::string save(const std::string &path = "", bool deoptimize = true) const Extract the current dex file and deoptimize it. #### [` raw `]() std::vector<uint8\_t> raw(bool deoptimize = true) const #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~File `]() ~File() override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [File]( "LIEF::DEX::File") &file) --- ## [Header]() ### [` Header `]() class Header : public LIEF::Object [Class]() which represents the DEX header. This is the first structure that begins the DEX format. The official documentation is provided here: [https://source.android.com/devices/tech/dalvik/dex-format#header-item]() Public Types #### [` location_t `]() using location\_t = std::pair<uint32\_t, uint32\_t> #### [` magic_t `]() using magic\_t = std::array<uint8\_t, 8> #### [` signature_t `]() using signature\_t = std::array<uint8\_t, 20> Public Functions #### [` Header `]() Header() #### [` Header `]() Header(const [Header]( "LIEF::DEX::Header::Header")&) #### [` operator= `]() [Header]( "LIEF::DEX::Header") &operator=(const [Header]( "LIEF::DEX::Header")&) #### [` THeader `]() template<class T> Header(const [T]( "LIEF::DEX::Header::Header::T") &header) #### [` magic `]() [magic\_t]( "LIEF::DEX::Header::magic_t") magic() const The DEX magic bytes (`DEX\n` followed by the DEX version). #### [` checksum `]() uint32\_t checksum() const The file checksum. #### [` signature `]() [signature\_t]( "LIEF::DEX::Header::signature_t") signature() const SHA-1 DEX signature (which is not really used as a signature). #### [` file_size `]() uint32\_t file\_size() const Size of the entire file (including the current the header). #### [` header_size `]() uint32\_t header\_size() const Size of this header. It should be 0x70. #### [` endian_tag `]() uint32\_t endian\_tag() const [File]() endianness of the file. #### [` map `]() uint32\_t map() const Offset from the start of the file to the map list (see: [DEX::MapList]()). #### [` strings `]() [location\_t]( "LIEF::DEX::Header::location_t") strings() const Offset and size of the string pool. #### [` link `]() [location\_t]( "LIEF::DEX::Header::location_t") link() const #### [` types `]() [location\_t]( "LIEF::DEX::Header::location_t") types() const #### [` prototypes `]() [location\_t]( "LIEF::DEX::Header::location_t") prototypes() const #### [` fields `]() [location\_t]( "LIEF::DEX::Header::location_t") fields() const #### [` methods `]() [location\_t]( "LIEF::DEX::Header::location_t") methods() const #### [` classes `]() [location\_t]( "LIEF::DEX::Header::location_t") classes() const #### [` data `]() [location\_t]( "LIEF::DEX::Header::location_t") data() const #### [` nb_classes `]() uint32\_t nb\_classes() const #### [` nb_methods `]() uint32\_t nb\_methods() const #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~Header `]() ~Header() override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Header]( "LIEF::DEX::Header") &hdr) --- ## [Method]() ### [` Method `]() class Method : public LIEF::Object [Class]() which represents a [DEX::Method](). Public Types #### [` access_flags_list_t `]() using access\_flags\_list\_t = std::vector<ACCESS\_FLAGS> #### [` bytecode_t `]() using bytecode\_t = std::vector<uint8\_t> Public Functions #### [` Method `]() Method() #### [` Method `]() Method(std::string name, [Class]( "LIEF::DEX::Class") \*parent = nullptr) #### [` Method `]() Method(const [Method]( "LIEF::DEX::Method::Method")&) #### [` operator= `]() [Method]( "LIEF::DEX::Method") &operator=(const [Method]( "LIEF::DEX::Method")&) #### [` name `]() std::string\_view name() const Name of the [Method](). #### [` has_class `]() bool has\_class() const True if a class is associated with this method. #### [` cls `]() const [Class]( "LIEF::DEX::Class") \*cls() const [DEX::Class]() associated with this [Method]() or a nullptr if not resolved. #### [` cls `]() [Class]( "LIEF::DEX::Class") \*cls() #### [` code_offset `]() uint64\_t code\_offset() const Offset to the Dalvik Bytecode. #### [` bytecode `]() const [bytecode\_t]( "LIEF::DEX::Method::bytecode_t") &bytecode() const Dalvik Bytecode as bytes. #### [` index `]() size\_t index() const Index in the DEX Methods pool. #### [` is_virtual `]() bool is\_virtual() const True if this method is a virtual one. i.e. not **static**, **private**, **final** or constructor. #### [` prototype `]() const [Prototype]( "LIEF::DEX::Prototype") \*prototype() const [Method]()’s prototype or a nullptr if it is not resolved. #### [` prototype `]() [Prototype]( "LIEF::DEX::Prototype") \*prototype() #### [` insert_dex2dex_info `]() void insert\_dex2dex\_info(uint32\_t pc, uint32\_t index) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` dex2dex_info `]() const dex2dex\_method\_info\_t &dex2dex\_info() const #### [` has `]() bool has(ACCESS\_FLAGS f) const Check if the current method has the given ACCESS\_FLAGS. #### [` access_flags `]() [access\_flags\_list\_t]( "LIEF::DEX::Method::access_flags_list_t") access\_flags() const ACCESS\_FLAGS as an std::set. #### [` code_info `]() const [CodeInfo]( "LIEF::DEX::CodeInfo") &code\_info() const #### [` ~Method `]() ~Method() override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Method]( "LIEF::DEX::Method") &mtd) --- ## [Class]() ### [` Class `]() class Class : public LIEF::Object [Class]() which represents a DEX [Class]() (i.e. a Java/Kotlin class). Public Types #### [` access_flags_list_t `]() using access\_flags\_list\_t = std::vector<ACCESS\_FLAGS> #### [` methods_t `]() using methods\_t = std::vector<[Method]( "LIEF::DEX::Method")\*> #### [` it_methods `]() using it\_methods = [ref\_iterator]( "LIEF::ref_iterator")<[methods\_t]( "LIEF::DEX::Class::methods_t")&> #### [` it_const_methods `]() using it\_const\_methods = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [methods\_t]( "LIEF::DEX::Class::methods_t")&> #### [` fields_t `]() using fields\_t = std::vector<[Field]( "LIEF::DEX::Field")\*> #### [` it_fields `]() using it\_fields = [ref\_iterator]( "LIEF::ref_iterator")<[fields\_t]( "LIEF::DEX::Class::fields_t")&> #### [` it_const_fields `]() using it\_const\_fields = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [fields\_t]( "LIEF::DEX::Class::fields_t")&> #### [` it_named_methods `]() using it\_named\_methods = [filter\_iterator]( "LIEF::filter_iterator")<[methods\_t]( "LIEF::DEX::Class::methods_t")&> #### [` it_const_named_methods `]() using it\_const\_named\_methods = [const\_filter\_iterator]( "LIEF::const_filter_iterator")<const [methods\_t]( "LIEF::DEX::Class::methods_t")&> #### [` it_named_fields `]() using it\_named\_fields = [filter\_iterator]( "LIEF::filter_iterator")<[fields\_t]( "LIEF::DEX::Class::fields_t")&> #### [` it_const_named_fields `]() using it\_const\_named\_fields = [const\_filter\_iterator]( "LIEF::const_filter_iterator")<const [fields\_t]( "LIEF::DEX::Class::fields_t")&> Public Functions #### [` Class `]() Class() #### [` Class `]() Class(const [Class]( "LIEF::DEX::Class::Class")&) = delete #### [` operator= `]() [Class]( "LIEF::DEX::Class") &operator=(const [Class]( "LIEF::DEX::Class")&) = delete #### [` Class `]() Class(std::string fullname, uint32\_t access\_flags = ACCESS\_FLAGS::ACC\_UNKNOWN, [Class]( "LIEF::DEX::Class::Class") \*parent = nullptr, std::string source\_filename = "") #### [` fullname `]() std::string\_view fullname() const Mangled class name (e.g. `Lcom/example/android/MyActivity;`). #### [` package_name `]() std::string package\_name() const Package Name. #### [` name `]() std::string name() const [Class]() name. #### [` pretty_name `]() std::string pretty\_name() const Demangled class name. #### [` has `]() bool has(ACCESS\_FLAGS f) const Check if the class has the given access flag. #### [` access_flags `]() [access\_flags\_list\_t]( "LIEF::DEX::Class::access_flags_list_t") access\_flags() const Access flags used by this class. #### [` source_filename `]() std::string\_view source\_filename() const Filename associated with this class (if any). #### [` has_parent `]() bool has\_parent() const True if the current class extends another one. #### [` parent `]() const [Class]( "LIEF::DEX::Class") \*parent() const Parent class. #### [` parent `]() [Class]( "LIEF::DEX::Class") \*parent() #### [` methods `]() [it\_const\_methods]( "LIEF::DEX::Class::it_const_methods") methods() const Methods implemented in this class. #### [` methods `]() [it\_methods]( "LIEF::DEX::Class::it_methods") methods() #### [` methods `]() [it\_named\_methods]( "LIEF::DEX::Class::it_named_methods") methods(const std::string &name) Return Methods having the given name. #### [` methods `]() [it\_const\_named\_methods]( "LIEF::DEX::Class::it_const_named_methods") methods(const std::string &name) const #### [` fields `]() [it\_const\_fields]( "LIEF::DEX::Class::it_const_fields") fields() const Fields implemented in this class. #### [` fields `]() [it\_fields]( "LIEF::DEX::Class::it_fields") fields() #### [` fields `]() [it\_named\_fields]( "LIEF::DEX::Class::it_named_fields") fields(const std::string &name) Return Fields having the given name. #### [` fields `]() [it\_const\_named\_fields]( "LIEF::DEX::Class::it_const_named_fields") fields(const std::string &name) const #### [` dex2dex_info `]() dex2dex\_class\_info\_t dex2dex\_info() const De-optimize information. #### [` index `]() size\_t index() const Original index in the DEX class pool. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~Class `]() ~Class() override Public Static Functions #### [` package_normalized `]() static std::string package\_normalized(const std::string &pkg\_name) #### [` fullname_normalized `]() static std::string fullname\_normalized(const std::string &pkg\_cls) #### [` fullname_normalized `]() static std::string fullname\_normalized(const std::string &pkg, const std::string &cls\_name) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Class]( "LIEF::DEX::Class") &cls) --- ## [Field]() ### [` Field `]() class Field : public LIEF::Object [Class]() which represents a DEX [Field](). Public Types #### [` access_flags_list_t `]() using access\_flags\_list\_t = std::vector<ACCESS\_FLAGS> Public Functions #### [` Field `]() Field() #### [` Field `]() Field(std::string name, [Class]( "LIEF::DEX::Class") \*parent = nullptr) #### [` Field `]() Field(const [Field]( "LIEF::DEX::Field::Field")&) #### [` operator= `]() [Field]( "LIEF::DEX::Field") &operator=(const [Field]( "LIEF::DEX::Field")&) #### [` name `]() std::string\_view name() const Name of the [Field](). #### [` has_class `]() bool has\_class() const True if a class is associated with this field (which should be the case). #### [` cls `]() const [Class]( "LIEF::DEX::Class") \*cls() const [Class]() associated with this [Field](). #### [` cls `]() [Class]( "LIEF::DEX::Class") \*cls() #### [` index `]() size\_t index() const Index in the DEX Fields pool. #### [` is_static `]() bool is\_static() const True if this field is a static one. #### [` type `]() const [Type]( "LIEF::DEX::Type") \*type() const [Field]()’s prototype. #### [` type `]() [Type]( "LIEF::DEX::Type") \*type() #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` has `]() bool has(ACCESS\_FLAGS f) const Check if the field has the given ACCESS\_FLAGS. #### [` access_flags `]() [access\_flags\_list\_t]( "LIEF::DEX::Field::access_flags_list_t") access\_flags() const ACCESS\_FLAGS as a list. #### [` ~Field `]() ~Field() override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Field]( "LIEF::DEX::Field") &mtd) --- ## [Code Info]() ### [` CodeInfo `]() class CodeInfo : public LIEF::Object Public Functions #### [` CodeInfo `]() CodeInfo() #### [` CodeInfo `]() CodeInfo(const details::code\_item &codeitem) #### [` CodeInfo `]() CodeInfo(const [CodeInfo]( "LIEF::DEX::CodeInfo::CodeInfo")&) #### [` operator= `]() [CodeInfo]( "LIEF::DEX::CodeInfo") &operator=(const [CodeInfo]( "LIEF::DEX::CodeInfo")&) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` nb_registers `]() uint16\_t nb\_registers() const #### [` ~CodeInfo `]() ~CodeInfo() override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [CodeInfo]( "LIEF::DEX::CodeInfo") &cinfo) --- ## [Prototype]() ### [` Prototype `]() class Prototype : public LIEF::Object [Class]() which represents a DEX method prototype. Public Types #### [` parameters_type_t `]() using parameters\_type\_t = std::vector<[Type]( "LIEF::DEX::Type")\*> #### [` it_params `]() using it\_params = [ref\_iterator]( "LIEF::ref_iterator")<[parameters\_type\_t]( "LIEF::DEX::Prototype::parameters_type_t")> #### [` it_const_params `]() using it\_const\_params = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [parameters\_type\_t]( "LIEF::DEX::Prototype::parameters_type_t")> Public Functions #### [` Prototype `]() Prototype() #### [` Prototype `]() Prototype(const [Prototype]( "LIEF::DEX::Prototype::Prototype") &other) #### [` return_type `]() const [Type]( "LIEF::DEX::Type") \*return\_type() const [Type]() returned or a nullptr if not resolved. #### [` return_type `]() [Type]( "LIEF::DEX::Type") \*return\_type() #### [` parameters_type `]() [it\_const\_params]( "LIEF::DEX::Prototype::it_const_params") parameters\_type() const Types of the parameters. #### [` parameters_type `]() [it\_params]( "LIEF::DEX::Prototype::it_params") parameters\_type() #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~Prototype `]() ~Prototype() override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Prototype]( "LIEF::DEX::Prototype") &type) --- ## [Type]() ### [` Type `]() class Type : public LIEF::Object [Class]() which represents a DEX type as described in the format specifications: [https://source.android.com/devices/tech/dalvik/dex-format#typedescriptor](). Public Types #### [` TYPES `]() enum class TYPES *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` PRIMITIVE `]() enumerator PRIMITIVE = 1 ##### [` CLASS `]() enumerator CLASS = 2 ##### [` ARRAY `]() enumerator ARRAY = 3 #### [` PRIMITIVES `]() enum class PRIMITIVES *Values:* ##### [` VOID_T `]() enumerator VOID\_T = 0x01 ##### [` BOOLEAN `]() enumerator BOOLEAN = 0x02 ##### [` BYTE `]() enumerator BYTE = 0x03 ##### [` SHORT `]() enumerator SHORT = 0x04 ##### [` CHAR `]() enumerator CHAR = 0x05 ##### [` INT `]() enumerator INT = 0x06 ##### [` LONG `]() enumerator LONG = 0x07 ##### [` FLOAT `]() enumerator FLOAT = 0x08 ##### [` DOUBLE `]() enumerator DOUBLE = 0x09 #### [` array_t `]() using array\_t = std::vector<[Type]( "LIEF::DEX::Type")> Public Functions #### [` Type `]() Type() #### [` Type `]() Type(const std::string &mangled) #### [` Type `]() Type(const [Type]( "LIEF::DEX::Type::Type") &other) #### [` type `]() [TYPES]( "LIEF::DEX::Type::TYPES") type() const Whether it is a primitive type, a class, … #### [` cls `]() const [Class]( "LIEF::DEX::Class") &cls() const #### [` array `]() const [array\_t]( "LIEF::DEX::Type::array_t") &array() const #### [` primitive `]() const [PRIMITIVES]( "LIEF::DEX::Type::PRIMITIVES") &primitive() const #### [` cls `]() [Class]( "LIEF::DEX::Class") &cls() **IF** the current type is a [TYPES::CLASS](), return the associated DEX::CLASS. Otherwise, the returned value is **undefined**. #### [` array `]() [array\_t]( "LIEF::DEX::Type::array_t") &array() **IF** the current type is a [TYPES::ARRAY](), return the associated array. Otherwise, the returned value is **undefined**. #### [` primitive `]() [PRIMITIVES]( "LIEF::DEX::Type::PRIMITIVES") &primitive() **IF** the current type is a [TYPES::PRIMITIVE](), return the associated [PRIMITIVES](). Otherwise, the returned value is **undefined**. #### [` dim `]() size\_t dim() const Return the array dimension if the current type is an array. Otherwise, it returns 0. #### [` underlying_array_type `]() const [Type]( "LIEF::DEX::Type") &underlying\_array\_type() const In the case of a [TYPES::ARRAY](), return the array’s type. #### [` underlying_array_type `]() [Type]( "LIEF::DEX::Type") &underlying\_array\_type() #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~Type `]() ~Type() override Public Static Functions #### [` pretty_name `]() static std::string pretty\_name([PRIMITIVES]( "LIEF::DEX::Type::PRIMITIVES") p) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Type]( "LIEF::DEX::Type") &type) --- ## [MapList]() ### [` MapList `]() class MapList : public LIEF::Object [Class]() which represents the `map_list` structure that follows the main DEX header. This [MapList]() aims at referencing the location of other DEX structures as described in [https://source.android.com/devices/tech/dalvik/dex-format#map-item]() Public Types #### [` items_t `]() using items\_t = std::map<[MapItem]( "LIEF::DEX::MapItem")::[TYPES]( "LIEF::DEX::MapItem::TYPES"), [MapItem]( "LIEF::DEX::MapItem")> #### [` it_items_t `]() using it\_items\_t = [ref\_iterator]( "LIEF::ref_iterator")<std::vector<[MapItem]( "LIEF::DEX::MapItem")\*>> #### [` it_const_items_t `]() using it\_const\_items\_t = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<std::vector<[MapItem]( "LIEF::DEX::MapItem")\*>> Public Functions #### [` MapList `]() MapList() #### [` MapList `]() MapList(const [MapList]( "LIEF::DEX::MapList::MapList")&) #### [` operator= `]() [MapList]( "LIEF::DEX::MapList") &operator=(const [MapList]( "LIEF::DEX::MapList")&) #### [` items `]() [it\_items\_t]( "LIEF::DEX::MapList::it_items_t") items() Iterator over [LIEF::DEX::MapItem](). #### [` items `]() [it\_const\_items\_t]( "LIEF::DEX::MapList::it_const_items_t") items() const #### [` has `]() bool has([MapItem]( "LIEF::DEX::MapItem")::[TYPES]( "LIEF::DEX::MapItem::TYPES") type) const Check if the given type exists. #### [` get `]() const [MapItem]( "LIEF::DEX::MapItem") &get([MapItem]( "LIEF::DEX::MapItem")::[TYPES]( "LIEF::DEX::MapItem::TYPES") type) const Return the [LIEF::DEX::MapItem]() associated with the given type. #### [` get `]() [MapItem]( "LIEF::DEX::MapItem") &get([MapItem]( "LIEF::DEX::MapItem")::[TYPES]( "LIEF::DEX::MapItem::TYPES") type) Return the [LIEF::DEX::MapItem]() associated with the given type. #### [` operator[] `]() const [MapItem]( "LIEF::DEX::MapItem") &operator[]([MapItem]( "LIEF::DEX::MapItem")::[TYPES]( "LIEF::DEX::MapItem::TYPES") type) const Return the [LIEF::DEX::MapItem]() associated with the given type. #### [` operator[] `]() [MapItem]( "LIEF::DEX::MapItem") &operator[]([MapItem]( "LIEF::DEX::MapItem")::[TYPES]( "LIEF::DEX::MapItem::TYPES") type) Return the [LIEF::DEX::MapItem]() associated with the given type. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~MapList `]() ~MapList() override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [MapList]( "LIEF::DEX::MapList") &mtd) --- ## [MapItem]() ### [` MapItem `]() class MapItem : public LIEF::Object [Class]() which represents an element of the [MapList]() object. Public Types #### [` TYPES `]() enum class TYPES : uint16\_t *Values:* ##### [` HEADER `]() enumerator HEADER = 0x0000 ##### [` STRING_ID `]() enumerator STRING\_ID = 0x0001 ##### [` TYPE_ID `]() enumerator TYPE\_ID = 0x0002 ##### [` PROTO_ID `]() enumerator PROTO\_ID = 0x0003 ##### [` FIELD_ID `]() enumerator FIELD\_ID = 0x0004 ##### [` METHOD_ID `]() enumerator METHOD\_ID = 0x0005 ##### [` CLASS_DEF `]() enumerator CLASS\_DEF = 0x0006 ##### [` CALL_SITE_ID `]() enumerator CALL\_SITE\_ID = 0x0007 ##### [` METHOD_HANDLE `]() enumerator METHOD\_HANDLE = 0x0008 ##### [` MAP_LIST `]() enumerator MAP\_LIST = 0x1000 ##### [` TYPE_LIST `]() enumerator TYPE\_LIST = 0x1001 ##### [` ANNOTATION_SET_REF_LIST `]() enumerator ANNOTATION\_SET\_REF\_LIST = 0x1002 ##### [` ANNOTATION_SET `]() enumerator ANNOTATION\_SET = 0x1003 ##### [` CLASS_DATA `]() enumerator CLASS\_DATA = 0x2000 ##### [` CODE `]() enumerator CODE = 0x2001 ##### [` STRING_DATA `]() enumerator STRING\_DATA = 0x2002 ##### [` DEBUG_INFO `]() enumerator DEBUG\_INFO = 0x2003 ##### [` ANNOTATION `]() enumerator ANNOTATION = 0x2004 ##### [` ENCODED_ARRAY `]() enumerator ENCODED\_ARRAY = 0x2005 ##### [` ANNOTATIONS_DIRECTORY `]() enumerator ANNOTATIONS\_DIRECTORY = 0x2006 Public Functions #### [` MapItem `]() MapItem() #### [` MapItem `]() MapItem([TYPES]( "LIEF::DEX::MapItem::TYPES") type, uint32\_t offset, uint32\_t size, uint16\_t reserved = 0) #### [` MapItem `]() MapItem(const [MapItem]( "LIEF::DEX::MapItem::MapItem")&) #### [` operator= `]() [MapItem]( "LIEF::DEX::MapItem") &operator=(const [MapItem]( "LIEF::DEX::MapItem")&) #### [` type `]() [TYPES]( "LIEF::DEX::MapItem::TYPES") type() const The type of the item. #### [` reserved `]() uint16\_t reserved() const Reserved value (likely for alignment purpose). #### [` size `]() uint32\_t size() const The number of elements (the real meaning depends on the type). #### [` offset `]() uint32\_t offset() const Offset from the start of the DEX file to the items associated with the underlying [TYPES](). #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~MapItem `]() ~MapItem() override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [MapItem]( "LIEF::DEX::MapItem") &item) --- documentID: "0d19e87d2984f9f006a6f7f2d560ed69e04325de10895b8b767a5175cb818ce4" docname: "formats/android/dex/index" title: "DEX - Android - LIEF Documentation" description: "DEX in Android. LIEF enables parsing Android DEX files as detailed in the tutorial: Android Formats." canonical: "https://lief.re/doc/latest/formats/android/dex/index.html" markdownURL: "https://lief.re/doc/latest/formats/android/dex/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "68ab11185dec7c87af34ba00951effe1372224c670d9d616788c1d6c80316e23" --- # [DEX]() API - [C++]() - [Python]() LIEF enables parsing Android DEX files as detailed in the tutorial: [Android Formats](). --- documentID: "e1ad0509ee4ca2b145a1b828aeb8a68a6a879459a56983f88fceb7aa17a26740" docname: "formats/android/dex/python" title: "DEX Python API - LIEF Documentation" description: "DEX Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/android/dex/python.html" markdownURL: "https://lief.re/doc/latest/formats/android/dex/python.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "809c8d7d3356323ef7225e8dd5e7bc460cf983fc2e084e9506b9be9e62a38e6d" --- # [Python]() ## [Utilities]() ### [` lief.is_dexlief.is_dex `]() lief.is\_dex(*\*args*) → bool **lief.is\_dex(*raw: collections.abc.Sequence[int]*) → bool** Overloaded function. 1. `is_dex(path: str) -> bool` Check if the **file** given in parameter is a DEX 2. `is_dex(raw: collections.abc.Sequence[int]) -> bool` Check if the **raw data** given in parameter is a DEX ### [` lief.DEX.versionlief.DEX.version `]() lief.DEX.version(*\*args*) → int **lief.DEX.version(*raw: collections.abc.Sequence[int]*) → int** Overloaded function. 1. `version(file: str) -> int` Return the DEX version of the **file** given in parameter 2. `version(raw: collections.abc.Sequence[int]) -> int` Return the DEX version of the **raw data** given in parameter --- ## [Parser]() ### [` lief.DEX.parselief.DEX.parselief.DEX.parse `]() lief.DEX.parse(*\*args*) → [lief.DEX.File]( "lief.DEX.File") | None **lief.DEX.parse(*raw: collections.abc.Sequence[int]*, *name: str = ''*) → [lief.\_lief.DEX.File]( "lief._lief.DEX.File") | None **lief.DEX.parse(*obj: str | io.IOBase | os.PathLike | bytes | list[int]*, *name: str = ''*) → [lief.\_lief.DEX.File]( "lief._lief.DEX.File") | None**** Overloaded function. 1. `parse(filename: str) -> Optional[lief._lief.DEX.File]` Parse the given filename and return a [`File`]( "lief.DEX.File") object 2. `parse(raw: collections.abc.Sequence[int], name: str = '') -> Optional[lief._lief.DEX.File]` Parse the given raw data and return a [`File`]( "lief.DEX.File") object 3. `parse(obj: Union[str | io.IOBase | os.PathLike | bytes | list[int]], name: str = '') -> Optional[lief._lief.DEX.File]` --- ## [File]() ### [` lief.DEX.File `]() class lief.DEX.File Bases: `Object` DEX File representation #### [` classes `]() property classes → lief.DEX.File.it\_classes Iterator over Dex [`Class`]( "lief.DEX.Class") #### [` dex2dex_json_info `]() property dex2dex\_json\_info → str #### [` fields `]() property fields → lief.DEX.File.it\_fields Iterator over Dex [`Field`]( "lief.DEX.Field") #### [` get_classget_class `]() get\_class(*self*, *classname: str*) → [lief.\_lief.DEX.Class]( "lief._lief.DEX.Class") | None **get\_class(*self*, *classname: int*) → [lief.\_lief.DEX.Class]( "lief._lief.DEX.Class") | None** #### [` has_class `]() has\_class(*self*, *classname: str*) → bool Check if a class with a name given in parameter exists #### [` header `]() property header → [lief.DEX.Header]( "lief.DEX.Header") Dex File [`Header`]( "lief.DEX.Header") #### [` location `]() property location → str Original location of the dex file #### [` map `]() property map → [lief.DEX.MapList]( "lief.DEX.MapList") Dex [`MapList`]( "lief.DEX.MapList") #### [` methods `]() property methods → lief.DEX.File.it\_methods Iterator over Dex [`Method`]( "lief.DEX.Method") #### [` name `]() property name → str Name of the dex file #### [` prototypes `]() property prototypes → lief.DEX.File.it\_prototypes Iterator over Dex [`Prototype`]( "lief.DEX.Prototype") #### [` raw `]() raw(*self*, *deoptimize: bool = True*) → list[int] Original raw file #### [` save `]() save(*self*, *output: str = ''*, *deoptimize: bool = True*) → str Save the **original** file into the file given in first parameter #### [` strings `]() property strings → lief.DEX.File.it\_strings Iterator over Dex strings #### [` types `]() property types → lief.DEX.File.it\_types Iterator over Dex [`Type`]( "lief.DEX.Type") #### [` version `]() property version → int Dex version --- ## [Header]() ### [` lief.DEX.Header `]() class lief.DEX.Header Bases: `Object` DEX Header #### [` checksum `]() property checksum → int Checksum value of the rest of the file (without [`magic`]( "lief.DEX.Header.magic")) #### [` classes `]() property classes → tuple[int, int] Classes identifiers #### [` data `]() property data → tuple[int, int] Raw data. Should be align on 32-bits #### [` endian_tag `]() property endian\_tag → int Endianness tag. Should be `ENDIAN_CONSTANT` #### [` fields `]() property fields → tuple[int, int] Fields identifiers #### [` file_size `]() property file\_size → int Size of the current DEX file #### [` header_size `]() property header\_size → int Size of this header. Should be `0x70` #### [` link `]() property link → tuple[int, int] Link (raw data) #### [` magic `]() property magic → list[int] Magic value #### [` map_offset `]() property map\_offset → int Offset from the start of the file to the map item #### [` methods `]() property methods → tuple[int, int] Methods identifiers #### [` nb_classes `]() property nb\_classes → int Number of classes in the current DEX #### [` nb_methods `]() property nb\_methods → int Number of methods in the current DEX #### [` prototypes `]() property prototypes → tuple[int, int] Prototypes identifiers #### [` signature `]() property signature → list[int] SHA-1 signature of the rest of the file (without [`magic`]( "lief.DEX.Header.magic") and [`checksum`]( "lief.DEX.Header.checksum")). #### [` strings `]() property strings → tuple[int, int] String identifiers #### [` types `]() property types → tuple[int, int] Type identifiers --- ## [Method]() ### [` lief.DEX.Method `]() class lief.DEX.Method Bases: `Object` DEX Method representation #### [` access_flags `]() property access\_flags → list[[lief.DEX.ACCESS\_FLAGS]( "lief.DEX.ACCESS_FLAGS")] List of [`ACCESS_FLAGS`]( "lief.DEX.ACCESS_FLAGS") #### [` bytecode `]() property bytecode → list[int] Dalvik Bytecode as a list of bytes #### [` cls `]() property cls → [lief.DEX.Class]( "lief.DEX.Class") | None [`Class`]( "lief.DEX.Class") associated with this method #### [` code_info `]() property code\_info → [lief.DEX.CodeInfo]( "lief.DEX.CodeInfo") [`CodeInfo`]( "lief.DEX.CodeInfo") associated with this method #### [` code_offset `]() property code\_offset → int Offset to the Dalvik Bytecode #### [` has `]() has(*self*, *flag: [lief.\_lief.DEX.ACCESS\_FLAGS]( "lief._lief.DEX.ACCESS_FLAGS")*) → bool Check if the given [`ACCESS_FLAGS`]( "lief.DEX.ACCESS_FLAGS") is present #### [` has_class `]() property has\_class → bool True if a class is associated with this method #### [` index `]() property index → int Original DEX file index of the method #### [` insert_dex2dex_info `]() insert\_dex2dex\_info(*self*, *pc: int*, *index: int*) → None Insert de-optimization information #### [` is_virtual `]() property is\_virtual → bool True if the method is a virtual (not **private**, **static**, **final**, **constructor**) #### [` name `]() property name → str Method’s name #### [` prototype `]() property prototype → [lief.DEX.Prototype]( "lief.DEX.Prototype") | None [`Prototype`]( "lief.DEX.Prototype") of this method --- ## [Field]() ### [` lief.DEX.Field `]() class lief.DEX.Field Bases: `Object` DEX Field representation #### [` access_flags `]() property access\_flags → list[[lief.DEX.ACCESS\_FLAGS]( "lief.DEX.ACCESS_FLAGS")] List of [`ACCESS_FLAGS`]( "lief.DEX.ACCESS_FLAGS") #### [` cls `]() property cls → [lief.DEX.Class]( "lief.DEX.Class") | None [`Class`]( "lief.DEX.Class") associated with this field #### [` has `]() has(*self*, *flag: [lief.\_lief.DEX.ACCESS\_FLAGS]( "lief._lief.DEX.ACCESS_FLAGS")*) → bool Check if the given [`ACCESS_FLAGS`]( "lief.DEX.ACCESS_FLAGS") is present #### [` has_class `]() property has\_class → bool True if a class is associated with this field #### [` index `]() property index → int Original DEX file index of the field #### [` is_static `]() property is\_static → bool True if the field is static #### [` name `]() property name → str Field’s name #### [` type `]() property type → [lief.DEX.Type]( "lief.DEX.Type") | None [`Type`]( "lief.DEX.Type") of this field --- ## [Class]() ### [` lief.DEX.Class `]() class lief.DEX.Class Bases: `Object` DEX Class representation #### [` access_flags `]() property access\_flags → list[[lief.DEX.ACCESS\_FLAGS]( "lief.DEX.ACCESS_FLAGS")] List of [`ACCESS_FLAGS`]( "lief.DEX.ACCESS_FLAGS") #### [` dex2dex_info `]() property dex2dex\_info → dict[[lief.DEX.Method]( "lief.DEX.Method"), dict[int, int]] De-optimize information #### [` fields `]() property fields → lief.DEX.Class.it\_fields Iterator over [`Field`]( "lief.DEX.Field") in this class #### [` fullname `]() property fullname → str Mangled class name (e.g. `Lcom/example/android/MyActivity;`) #### [` get_field `]() get\_field(*self*, *name: str*) → lief.\_lief.DEX.Class.it\_named\_fields Iterator over [`Field`]( "lief.DEX.Field") (s) having the given name #### [` get_method `]() get\_method(*self*, *name: str*) → lief.\_lief.DEX.Class.it\_named\_methods Iterator over [`Method`]( "lief.DEX.Method") (s) having the given name #### [` has `]() has(*self*, *flag: [lief.\_lief.DEX.ACCESS\_FLAGS]( "lief._lief.DEX.ACCESS_FLAGS")*) → bool Check if the given [`ACCESS_FLAGS`]( "lief.DEX.ACCESS_FLAGS") is present #### [` has_parent `]() property has\_parent → bool True if the current class extends another one #### [` index `]() property index → int Original index in the DEX class pool #### [` methods `]() property methods → lief.DEX.Class.it\_methods Iterator over [`Method`]( "lief.DEX.Method") implemented in this class #### [` name `]() property name → str Class name (e.g. `MyActivity`) #### [` package_name `]() property package\_name → str Package Name (e.g. `com.example.android`) #### [` parent `]() property parent → [lief.DEX.Class]( "lief.DEX.Class") | None [`Class`]( "lief.DEX.Class") parent class #### [` pretty_name `]() property pretty\_name → str Demangled class name (e.g. `com.example.android.MyActivity`) #### [` source_filename `]() property source\_filename → str Original filename --- ## [Code Info]() ### [` lief.DEX.CodeInfo `]() class lief.DEX.CodeInfo Bases: `Object` DEX CodeInfo representation #### [` nb_registers `]() property nb\_registers → int Number of registers used by the method --- ## [Prototype]() ### [` lief.DEX.Prototype `]() class lief.DEX.Prototype Bases: `Object` DEX Prototype representation #### [` parameters_type `]() property parameters\_type → lief.DEX.Prototype.it\_params Iterator over parameters [`Type`]( "lief.DEX.Type") #### [` return_type `]() property return\_type → [lief.DEX.Type]( "lief.DEX.Type") | None [`Type`]( "lief.DEX.Type") returned --- ## [Type]() ### [` lief.DEX.Type `]() class lief.DEX.Type Bases: `Object` DEX Type representation #### [` PRIMITIVES `]() class PRIMITIVES(*\*values*) Bases: `Enum` ##### [` BOOLEAN `]() BOOLEAN = 2 ##### [` BYTE `]() BYTE = 3 ##### [` CHAR `]() CHAR = 5 ##### [` DOUBLE `]() DOUBLE = 9 ##### [` FLOAT `]() FLOAT = 8 ##### [` INT `]() INT = 6 ##### [` LONG `]() LONG = 7 ##### [` SHORT `]() SHORT = 4 ##### [` VOID_T `]() VOID\_T = 1 #### [` TYPES `]() class TYPES(*\*values*) Bases: `Enum` ##### [` ARRAY `]() ARRAY = 3 ##### [` CLASS `]() CLASS = 2 ##### [` PRIMITIVE `]() PRIMITIVE = 1 ##### [` UNKNOWN `]() UNKNOWN = 0 #### [` dim `]() property dim → int If the current type is an array, return its dimension otherwise 0 #### [` pretty_name `]() pretty\_name(*primitive: [lief.DEX.Type.PRIMITIVES]( "lief.DEX.Type.PRIMITIVES")*) → str = <nanobind.nb\_func object> #### [` type `]() property type → [lief.DEX.Type.TYPES]( "lief.DEX.Type.TYPES") [`TYPES`]( "lief.DEX.Type.TYPES") of this object #### [` underlying_array_type `]() property underlying\_array\_type → [lief.DEX.Type]( "lief.DEX.Type") Underlying type of the array #### [` value `]() property value → object Depending on the [`TYPES`]( "lief.DEX.Type.TYPES"), return [`Class`]( "lief.DEX.Class") or [`PRIMITIVES`]( "lief.DEX.Type.PRIMITIVES") or array --- ## [MapList]() ### [` lief.DEX.MapList `]() class lief.DEX.MapList Bases: `Object` DEX MapList representation #### [` get `]() get(*self*, *type: [lief.\_lief.DEX.MapItem.TYPES]( "lief._lief.DEX.MapItem.TYPES")*) → [lief.\_lief.DEX.MapItem]( "lief._lief.DEX.MapItem") Return the [`MapItem`]( "lief.DEX.MapItem") from the given [`TYPES`]( "lief.DEX.MapItem.TYPES") #### [` has `]() has(*self*, *type: [lief.\_lief.DEX.MapItem.TYPES]( "lief._lief.DEX.MapItem.TYPES")*) → bool Check if the given [`TYPES`]( "lief.DEX.MapItem.TYPES") is present #### [` items `]() property items → lief.DEX.MapList.it\_items\_t Iterator over [`MapItem`]( "lief.DEX.MapItem") --- ## [MapItem]() ### [` lief.DEX.MapItem `]() class lief.DEX.MapItem Bases: `Object` DEX MapItem representation #### [` TYPES `]() class TYPES(*\*values*) Bases: `Enum` ##### [` ANNOTATION `]() ANNOTATION = 8196 ##### [` ANNOTATIONS_DIRECTORY `]() ANNOTATIONS\_DIRECTORY = 8198 ##### [` ANNOTATION_SET `]() ANNOTATION\_SET = 4099 ##### [` ANNOTATION_SET_REF_LIST `]() ANNOTATION\_SET\_REF\_LIST = 4098 ##### [` CALL_SITE_ID `]() CALL\_SITE\_ID = 7 ##### [` CLASS_DATA `]() CLASS\_DATA = 8192 ##### [` CLASS_DEF `]() CLASS\_DEF = 6 ##### [` CODE `]() CODE = 8193 ##### [` DEBUG_INFO `]() DEBUG\_INFO = 8195 ##### [` ENCODED_ARRAY `]() ENCODED\_ARRAY = 8197 ##### [` FIELD_ID `]() FIELD\_ID = 4 ##### [` HEADER `]() HEADER = 0 ##### [` MAP_LIST `]() MAP\_LIST = 4096 ##### [` METHOD_HANDLE `]() METHOD\_HANDLE = 8 ##### [` METHOD_ID `]() METHOD\_ID = 5 ##### [` PROTO_ID `]() PROTO\_ID = 3 ##### [` STRING_DATA `]() STRING\_DATA = 8194 ##### [` STRING_ID `]() STRING\_ID = 1 ##### [` TYPE_ID `]() TYPE\_ID = 2 ##### [` TYPE_LIST `]() TYPE\_LIST = 4097 ##### [` from_value `]() from\_value(*arg: int*) → [lief.DEX.MapItem.TYPES]( "lief.DEX.MapItem.TYPES") = <nanobind.nb\_func object> #### [` offset `]() property offset → int Offset from the start of the file to the items in question #### [` size `]() property size → int Count of the number of items to be found at the indicated offset #### [` type `]() property type → [lief.DEX.MapItem.TYPES]( "lief.DEX.MapItem.TYPES") [`TYPES`]( "lief.DEX.MapItem.TYPES") of the item --- ## [Enums]() ### [Access Flags]() #### [` lief.DEX.ACCESS_FLAGS `]() class lief.DEX.ACCESS\_FLAGS(*\*values*) Bases: `Enum` ##### [` ABSTRACT `]() ABSTRACT = 1024 ##### [` ANNOTATION `]() ANNOTATION = 8192 ##### [` BRIDGE `]() BRIDGE = 64 ##### [` CONSTRUCTOR `]() CONSTRUCTOR = 65536 ##### [` DECLARED_SYNCHRONIZED `]() DECLARED\_SYNCHRONIZED = 131072 ##### [` ENUM `]() ENUM = 16384 ##### [` FINAL `]() FINAL = 16 ##### [` INTERFACE `]() INTERFACE = 512 ##### [` NATIVE `]() NATIVE = 256 ##### [` PRIVATE `]() PRIVATE = 2 ##### [` PROTECTED `]() PROTECTED = 4 ##### [` PUBLIC `]() PUBLIC = 1 ##### [` STATIC `]() STATIC = 8 ##### [` STRICT `]() STRICT = 2048 ##### [` SYNCHRONIZED `]() SYNCHRONIZED = 32 ##### [` SYNTHETIC `]() SYNTHETIC = 4096 ##### [` TRANSIENT `]() TRANSIENT = 128 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` VARARGS `]() VARARGS = 128 ##### [` VOLATILE `]() VOLATILE = 64 --- documentID: "058a04915fdc3e2a3d7a6d35703c3547523c166582d495d293b48c13f39fb177" docname: "formats/android/index" title: "Android - LIEF Documentation" description: "Android reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/android/index.html" markdownURL: "https://lief.re/doc/latest/formats/android/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "f163c99c842d961ee365b17a9afede273a11fe457e1f75f4c9ae1173e8809ba9" --- # [Android]() - [OAT]() - [DEX]() - [VDEX]() - [ART]() --- documentID: "014463d46dac604d0d15d4b84e40268f42129871b21722dfcf3d703e81ee736a" docname: "formats/android/oat/cpp" title: "OAT C++ API - LIEF Documentation" description: "OAT C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/android/oat/cpp.html" markdownURL: "https://lief.re/doc/latest/formats/android/oat/cpp.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "8e5d5fb053af47139582956764d6493c33f41327574ca003189aac94d536b6da" --- # [C++]() ## [Utilities]() ### [` LIEF::OAT::is_oat `]() bool LIEF::OAT::is\_oat(const LIEF::ELF::[Binary]( "LIEF::ELF::Binary") &elf\_binary) Check if the given [LIEF::ELF::Binary]() is an OAT one. ### [` LIEF::OAT::is_oat `]() bool LIEF::OAT::is\_oat(std::string\_view file) Check if the given file is an OAT one. ### [` LIEF::OAT::is_oat `]() bool LIEF::OAT::is\_oat(const std::vector<uint8\_t> &raw) Check if the given raw data is an OAT one. ### [` LIEF::OAT::version `]() oat\_version\_t LIEF::OAT::version(const LIEF::ELF::[Binary]( "LIEF::ELF::Binary") &elf\_binary) Return the OAT version of the given [LIEF::ELF::Binary](). ### [` LIEF::OAT::version `]() oat\_version\_t LIEF::OAT::version(std::string\_view file) Return the OAT version of the given file. ### [` LIEF::OAT::version `]() oat\_version\_t LIEF::OAT::version(const std::vector<uint8\_t> &raw) Return the OAT version of the raw data. ### [` LIEF::OAT::android_version `]() LIEF::Android::[ANDROID\_VERSIONS]( "LIEF::Android::ANDROID_VERSIONS") LIEF::OAT::android\_version(oat\_version\_t version) Return the ANDROID\_VERSIONS associated with the given OAT version. --- ## [Parser]() ### [` Parser `]() class Parser : public LIEF::ELF::[Parser]( "LIEF::ELF::Parser") [Class]() to parse an OAT file to produce an [OAT::Binary](). Public Functions #### [` operator= `]() [Parser]( "LIEF::OAT::Parser") &operator=(const [Parser]( "LIEF::OAT::Parser") &copy) = delete #### [` Parser `]() Parser(const [Parser]( "LIEF::OAT::Parser::Parser") &copy) = delete Public Static Functions #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::OAT::Binary")> parse(std::string\_view oat\_file) Parse an OAT file. #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::OAT::Binary")> parse(std::string\_view oat\_file, std::string\_view vdex\_file) #### [` PathTparse `]() template<class PathT, enable\_if\_path\_t<[PathT]( "LIEF::OAT::Parser::parse::PathT")> = 0> static inline std::unique\_ptr<[Binary]( "LIEF::OAT::Binary")> parse(const [PathT]( "LIEF::OAT::Parser::parse::PathT") &oat\_file) Same as [parse(std::string\_view)]() but the file is given as a `std::filesystem::path`. #### [` OatTVdexTparse `]() template<class OatT, class VdexT, enable\_if\_path\_t<[OatT]( "LIEF::OAT::Parser::parse::OatT"), [VdexT]( "LIEF::OAT::Parser::parse::VdexT")> = 0> static inline std::unique\_ptr<[Binary]( "LIEF::OAT::Binary")> parse(const [OatT]( "LIEF::OAT::Parser::parse::OatT") &oat\_file, const [VdexT]( "LIEF::OAT::Parser::parse::VdexT") &vdex\_file) Same as [parse(std::string\_view, std::string\_view)]() but at least one of the files is given as a `std::filesystem::path`. #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::OAT::Binary")> parse(std::vector<uint8\_t> data) --- ## [Binary]() ### [` Binary `]() class Binary : public LIEF::ELF::[Binary]( "LIEF::ELF::Binary") Public Types #### [` dex_files_t `]() using dex\_files\_t = std::vector<std::unique\_ptr<DEX::[File]( "LIEF::DEX::File")>> #### [` it_dex_files `]() using it\_dex\_files = [ref\_iterator]( "LIEF::ref_iterator")<[dex\_files\_t]( "LIEF::OAT::Binary::dex_files_t")&, DEX::[File]( "LIEF::DEX::File")\*> #### [` it_const_dex_files `]() using it\_const\_dex\_files = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [dex\_files\_t]( "LIEF::OAT::Binary::dex_files_t")&, const DEX::[File]( "LIEF::DEX::File")\*> #### [` classes_t `]() using classes\_t = std::unordered\_map<std::string, [Class]( "LIEF::OAT::Class")\*> #### [` classes_list_t `]() using classes\_list\_t = std::vector<std::unique\_ptr<[Class]( "LIEF::OAT::Class")>> #### [` it_classes `]() using it\_classes = [ref\_iterator]( "LIEF::ref_iterator")<[classes\_list\_t]( "LIEF::OAT::Binary::classes_list_t")&, [Class]( "LIEF::OAT::Class")\*> #### [` it_const_classes `]() using it\_const\_classes = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [classes\_list\_t]( "LIEF::OAT::Binary::classes_list_t")&, const [Class]( "LIEF::OAT::Class")\*> #### [` oat_dex_files_t `]() using oat\_dex\_files\_t = std::vector<std::unique\_ptr<[DexFile]( "LIEF::OAT::DexFile")>> #### [` it_oat_dex_files `]() using it\_oat\_dex\_files = [ref\_iterator]( "LIEF::ref_iterator")<[oat\_dex\_files\_t]( "LIEF::OAT::Binary::oat_dex_files_t")&, [DexFile]( "LIEF::OAT::DexFile")\*> #### [` it_const_oat_dex_files `]() using it\_const\_oat\_dex\_files = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [oat\_dex\_files\_t]( "LIEF::OAT::Binary::oat_dex_files_t")&, const [DexFile]( "LIEF::OAT::DexFile")\*> #### [` methods_t `]() using methods\_t = std::vector<std::unique\_ptr<[Method]( "LIEF::OAT::Method")>> #### [` it_methods `]() using it\_methods = [ref\_iterator]( "LIEF::ref_iterator")<[methods\_t]( "LIEF::OAT::Binary::methods_t")&, [Method]( "LIEF::OAT::Method")\*> #### [` it_const_methods `]() using it\_const\_methods = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [methods\_t]( "LIEF::OAT::Binary::methods_t")&, const [Method]( "LIEF::OAT::Method")\*> #### [` dex2dex_info_t `]() using dex2dex\_info\_t = std::unordered\_map<const DEX::[File]( "LIEF::DEX::File")\*, DEX::dex2dex\_info\_t> Public Functions #### [` operator= `]() [Binary]( "LIEF::OAT::Binary") &operator=(const [Binary]( "LIEF::OAT::Binary") &copy) = delete #### [` Binary `]() Binary(const [Binary]( "LIEF::OAT::Binary::Binary") &copy) = delete #### [` header `]() const [Header]( "LIEF::OAT::Header") &header() const OAT [Header](). #### [` header `]() [Header]( "LIEF::OAT::Header") &header() #### [` dex_files `]() [it\_dex\_files]( "LIEF::OAT::Binary::it_dex_files") dex\_files() Iterator over [LIEF::DEX::File](). #### [` dex_files `]() [it\_const\_dex\_files]( "LIEF::OAT::Binary::it_const_dex_files") dex\_files() const #### [` oat_dex_files `]() [it\_oat\_dex\_files]( "LIEF::OAT::Binary::it_oat_dex_files") oat\_dex\_files() Iterator over [LIEF::OAT::DexFile](). #### [` oat_dex_files `]() [it\_const\_oat\_dex\_files]( "LIEF::OAT::Binary::it_const_oat_dex_files") oat\_dex\_files() const #### [` classes `]() [it\_const\_classes]( "LIEF::OAT::Binary::it_const_classes") classes() const Iterator over [LIEF::OAT::Class](). #### [` classes `]() [it\_classes]( "LIEF::OAT::Binary::it_classes") classes() #### [` has_class `]() bool has\_class(const std::string &class\_name) const Check if the current OAT has the given class. #### [` get_class `]() const [Class]( "LIEF::OAT::Class") \*get\_class(const std::string &class\_name) const Return the [LIEF::OAT::Class]() with the given name or a nullptr if the class can’t be found. #### [` get_class `]() [Class]( "LIEF::OAT::Class") \*get\_class(const std::string &class\_name) #### [` get_class `]() const [Class]( "LIEF::OAT::Class") \*get\_class(size\_t index) const Return the [LIEF::OAT::Class]() at the given index or a nullptr if it does not exist. #### [` get_class `]() [Class]( "LIEF::OAT::Class") \*get\_class(size\_t index) #### [` methods `]() [it\_const\_methods]( "LIEF::OAT::Binary::it_const_methods") methods() const Iterator over [LIEF::OAT::Method](). #### [` methods `]() [it\_methods]( "LIEF::OAT::Binary::it_methods") methods() #### [` dex2dex_info `]() [dex2dex\_info\_t]( "LIEF::OAT::Binary::dex2dex_info_t") dex2dex\_info() const #### [` dex2dex_json_info `]() std::string dex2dex\_json\_info() #### [` has_vdex `]() inline bool has\_vdex() const #### [` accept `]() virtual void accept(Visitor &visitor) const override [Method]() associated with the visitor pattern. #### [` ~Binary `]() ~Binary() override Public Static Functions #### [` classof `]() static inline bool classof(const LIEF::[Binary]( "LIEF::Binary") \*bin) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Binary]( "LIEF::OAT::Binary") &binary) --- ## [Header]() ### [` Header `]() class Header : public LIEF::Object Public Types #### [` magic_t `]() using magic\_t = std::array<uint8\_t, 4> #### [` key_values_t `]() using key\_values\_t = std::map<[HEADER\_KEYS]( "LIEF::OAT::HEADER_KEYS"), std::string> #### [` it_key_values_t `]() using it\_key\_values\_t = [ref\_iterator]( "LIEF::ref_iterator")<std::vector<[element\_t]( "LIEF::OAT::Header::element_t")>> #### [` it_const_key_values_t `]() using it\_const\_key\_values\_t = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<std::vector<[element\_t]( "LIEF::OAT::Header::element_t")>> #### [` keys_t `]() using keys\_t = std::vector<[HEADER\_KEYS]( "LIEF::OAT::HEADER_KEYS")> Iterator type over. #### [` values_t `]() using values\_t = std::vector<std::string> Public Functions #### [` Header `]() Header() #### [` Header `]() Header(const [Header]( "LIEF::OAT::Header::Header")&) #### [` operator= `]() [Header]( "LIEF::OAT::Header") &operator=(const [Header]( "LIEF::OAT::Header")&) #### [` THeader `]() template<class T> Header(const [T]( "LIEF::OAT::Header::Header::T") \*header) #### [` magic `]() [Header]( "LIEF::OAT::Header")::[magic\_t]( "LIEF::OAT::Header::magic_t") magic() const Magic value: `oat`. #### [` version `]() oat\_version\_t version() const OAT version. #### [` checksum `]() uint32\_t checksum() const #### [` instruction_set `]() [INSTRUCTION\_SETS]( "LIEF::OAT::INSTRUCTION_SETS") instruction\_set() const #### [` nb_dex_files `]() uint32\_t nb\_dex\_files() const #### [` oat_dex_files_offset `]() uint32\_t oat\_dex\_files\_offset() const #### [` executable_offset `]() uint32\_t executable\_offset() const #### [` i2i_bridge_offset `]() uint32\_t i2i\_bridge\_offset() const #### [` i2c_code_bridge_offset `]() uint32\_t i2c\_code\_bridge\_offset() const #### [` jni_dlsym_lookup_offset `]() uint32\_t jni\_dlsym\_lookup\_offset() const #### [` quick_generic_jni_trampoline_offset `]() uint32\_t quick\_generic\_jni\_trampoline\_offset() const #### [` quick_imt_conflict_trampoline_offset `]() uint32\_t quick\_imt\_conflict\_trampoline\_offset() const #### [` quick_resolution_trampoline_offset `]() uint32\_t quick\_resolution\_trampoline\_offset() const #### [` quick_to_interpreter_bridge_offset `]() uint32\_t quick\_to\_interpreter\_bridge\_offset() const #### [` image_patch_delta `]() int32\_t image\_patch\_delta() const #### [` image_file_location_oat_checksum `]() uint32\_t image\_file\_location\_oat\_checksum() const #### [` image_file_location_oat_data_begin `]() uint32\_t image\_file\_location\_oat\_data\_begin() const #### [` key_value_size `]() uint32\_t key\_value\_size() const #### [` key_values `]() [it\_key\_values\_t]( "LIEF::OAT::Header::it_key_values_t") key\_values() #### [` key_values `]() [it\_const\_key\_values\_t]( "LIEF::OAT::Header::it_const_key_values_t") key\_values() const #### [` keys `]() [keys\_t]( "LIEF::OAT::Header::keys_t") keys() const #### [` values `]() [values\_t]( "LIEF::OAT::Header::values_t") values() const #### [` get `]() const std::string \*get([HEADER\_KEYS]( "LIEF::OAT::HEADER_KEYS") key) const #### [` get `]() std::string \*get([HEADER\_KEYS]( "LIEF::OAT::HEADER_KEYS") key) #### [` set `]() [Header]( "LIEF::OAT::Header") &set([HEADER\_KEYS]( "LIEF::OAT::HEADER_KEYS") key, const std::string &value) #### [` operator[] `]() const std::string \*operator[]([HEADER\_KEYS]( "LIEF::OAT::HEADER_KEYS") key) const #### [` operator[] `]() std::string \*operator[]([HEADER\_KEYS]( "LIEF::OAT::HEADER_KEYS") key) #### [` magic `]() void magic(const [magic\_t]( "LIEF::OAT::Header::magic_t") &magic) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` key_to_string `]() static std::string key\_to\_string([HEADER\_KEYS]( "LIEF::OAT::HEADER_KEYS") key) Return the string value associated with the given key. Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Header]( "LIEF::OAT::Header") &hdr) #### [` element_t `]() struct element\_t Public Functions ##### [` element_t `]() inline element\_t([HEADER\_KEYS]( "LIEF::OAT::HEADER_KEYS") key, const std::string &value) Public Members ##### [` key `]() [HEADER\_KEYS]( "LIEF::OAT::HEADER_KEYS") key ##### [` value `]() std::string \*value = nullptr --- ## [DexFile]() ### [` DexFile `]() class DexFile : public LIEF::Object Public Functions #### [` DexFile `]() DexFile() #### [` DexFile `]() DexFile(const [DexFile]( "LIEF::OAT::DexFile::DexFile")&) #### [` operator= `]() [DexFile]( "LIEF::OAT::DexFile") &operator=(const [DexFile]( "LIEF::OAT::DexFile")&) #### [` location `]() std::string\_view location() const #### [` checksum `]() uint32\_t checksum() const #### [` dex_offset `]() uint32\_t dex\_offset() const #### [` has_dex_file `]() bool has\_dex\_file() const #### [` dex_file `]() const DEX::[File]( "LIEF::DEX::File") \*dex\_file() const #### [` dex_file `]() DEX::[File]( "LIEF::DEX::File") \*dex\_file() #### [` location `]() void location(const std::string &location) #### [` checksum `]() void checksum(uint32\_t checksum) #### [` dex_offset `]() void dex\_offset(uint32\_t dex\_offset) #### [` classes_offsets `]() const std::vector<uint32\_t> &classes\_offsets() const #### [` lookup_table_offset `]() uint32\_t lookup\_table\_offset() const #### [` class_offsets_offset `]() void class\_offsets\_offset(uint32\_t offset) #### [` lookup_table_offset `]() void lookup\_table\_offset(uint32\_t offset) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~DexFile `]() ~DexFile() override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [DexFile]( "LIEF::OAT::DexFile") &dex\_file) --- ## [Class]() ### [` Class `]() class Class : public LIEF::Object Public Types #### [` methods_t `]() using methods\_t = std::vector<[Method]( "LIEF::OAT::Method")\*> #### [` it_methods `]() using it\_methods = [ref\_iterator]( "LIEF::ref_iterator")<[methods\_t]( "LIEF::OAT::Class::methods_t")&> #### [` it_const_methods `]() using it\_const\_methods = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [methods\_t]( "LIEF::OAT::Class::methods_t")&> Public Functions #### [` Class `]() Class() #### [` Class `]() Class([OAT\_CLASS\_STATUS]( "LIEF::OAT::OAT_CLASS_STATUS") status, [OAT\_CLASS\_TYPES]( "LIEF::OAT::OAT_CLASS_TYPES") type, DEX::[Class]( "LIEF::DEX::Class") \*dex\_class, std::vector<uint32\_t> bitmap = {}) #### [` Class `]() Class(const [Class]( "LIEF::OAT::Class::Class")&) #### [` operator= `]() [Class]( "LIEF::OAT::Class") &operator=(const [Class]( "LIEF::OAT::Class")&) #### [` has_dex_class `]() bool has\_dex\_class() const #### [` dex_class `]() const DEX::[Class]( "LIEF::DEX::Class") \*dex\_class() const #### [` dex_class `]() DEX::[Class]( "LIEF::DEX::Class") \*dex\_class() #### [` status `]() [OAT\_CLASS\_STATUS]( "LIEF::OAT::OAT_CLASS_STATUS") status() const #### [` type `]() [OAT\_CLASS\_TYPES]( "LIEF::OAT::OAT_CLASS_TYPES") type() const #### [` fullname `]() std::string\_view fullname() const #### [` index `]() size\_t index() const #### [` methods `]() [it\_methods]( "LIEF::OAT::Class::it_methods") methods() #### [` methods `]() [it\_const\_methods]( "LIEF::OAT::Class::it_const_methods") methods() const #### [` bitmap `]() const std::vector<uint32\_t> &bitmap() const #### [` is_quickened `]() bool is\_quickened(const DEX::[Method]( "LIEF::DEX::Method") &m) const #### [` is_quickened `]() bool is\_quickened(uint32\_t relative\_index) const #### [` method_offsets_index `]() uint32\_t method\_offsets\_index(const DEX::[Method]( "LIEF::DEX::Method") &m) const #### [` method_offsets_index `]() uint32\_t method\_offsets\_index(uint32\_t relative\_index) const #### [` relative_index `]() uint32\_t relative\_index(const DEX::[Method]( "LIEF::DEX::Method") &m) const #### [` relative_index `]() uint32\_t relative\_index(uint32\_t method\_absolute\_index) const #### [` dex2dex_info `]() DEX::dex2dex\_class\_info\_t dex2dex\_info() const #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~Class `]() ~Class() override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Class]( "LIEF::OAT::Class") &cls) --- ## [Method]() ### [` Method `]() class Method : public LIEF::Object Public Types #### [` quick_code_t `]() using quick\_code\_t = std::vector<uint8\_t> Container for the Quick Code. Public Functions #### [` Method `]() Method() #### [` Method `]() Method(DEX::[Method]( "LIEF::DEX::Method") \*method, [Class]( "LIEF::OAT::Class") \*oat\_class, std::vector<uint8\_t> code = {}) #### [` Method `]() Method(const [Method]( "LIEF::OAT::Method::Method")&) #### [` operator= `]() [Method]( "LIEF::OAT::Method") &operator=(const [Method]( "LIEF::OAT::Method")&) #### [` name `]() std::string name() const [Method]()’s name. #### [` oat_class `]() const [Class]( "LIEF::OAT::Class") \*oat\_class() const OAT [Class]() associated with this [Method](). #### [` oat_class `]() [Class]( "LIEF::OAT::Class") \*oat\_class() #### [` has_dex_method `]() bool has\_dex\_method() const Check if a [LIEF::DEX::Method]() is associated with this [Method](). #### [` dex_method `]() const DEX::[Method]( "LIEF::DEX::Method") \*dex\_method() const [LIEF::DEX::Method]() associated (if any). #### [` dex_method `]() DEX::[Method]( "LIEF::DEX::Method") \*dex\_method() #### [` is_dex2dex_optimized `]() bool is\_dex2dex\_optimized() const True if the optimization is DEX. #### [` is_compiled `]() bool is\_compiled() const #### [` dex2dex_info `]() const DEX::dex2dex\_method\_info\_t &dex2dex\_info() const #### [` quick_code `]() const [quick\_code\_t]( "LIEF::OAT::Method::quick_code_t") &quick\_code() const Quick code associated with the method. #### [` quick_code `]() void quick\_code(const [quick\_code\_t]( "LIEF::OAT::Method::quick_code_t") &code) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~Method `]() ~Method() override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Method]( "LIEF::OAT::Method") &meth) --- ## [Enums]() ### [OAT Class types]() #### [` LIEF::OAT::OAT_CLASS_TYPES `]() enum LIEF::OAT::OAT\_CLASS\_TYPES *Values:* ##### [` OAT_CLASS_ALL_COMPILED `]() enumerator OAT\_CLASS\_ALL\_COMPILED = 0 ##### [` OAT_CLASS_SOME_COMPILED `]() enumerator OAT\_CLASS\_SOME\_COMPILED = 1 OatClass is followed by an OatMethodOffsets for each method. ##### [` OAT_CLASS_NONE_COMPILED `]() enumerator OAT\_CLASS\_NONE\_COMPILED = 2 A bitmap of which OatMethodOffsets are present follows the OatClass. --- ### [OAT Class Status]() #### [` LIEF::OAT::OAT_CLASS_STATUS `]() enum LIEF::OAT::OAT\_CLASS\_STATUS *Values:* ##### [` STATUS_RETIRED `]() enumerator STATUS\_RETIRED = -2 ##### [` STATUS_ERROR `]() enumerator STATUS\_ERROR = -1 ##### [` STATUS_NOTREADY `]() enumerator STATUS\_NOTREADY = 0 ##### [` STATUS_IDX `]() enumerator STATUS\_IDX = 1 ##### [` STATUS_LOADED `]() enumerator STATUS\_LOADED = 2 ##### [` STATUS_RESOLVING `]() enumerator STATUS\_RESOLVING = 3 ##### [` STATUS_RESOLVED `]() enumerator STATUS\_RESOLVED = 4 ##### [` STATUS_VERIFYING `]() enumerator STATUS\_VERIFYING = 5 ##### [` STATUS_RETRY_VERIFICATION_AT_RUNTIME `]() enumerator STATUS\_RETRY\_VERIFICATION\_AT\_RUNTIME = 6 ##### [` STATUS_VERIFYING_AT_RUNTIME `]() enumerator STATUS\_VERIFYING\_AT\_RUNTIME = 7 ##### [` STATUS_VERIFIED `]() enumerator STATUS\_VERIFIED = 8 ##### [` STATUS_INITIALIZING `]() enumerator STATUS\_INITIALIZING = 9 ##### [` STATUS_INITIALIZED `]() enumerator STATUS\_INITIALIZED = 10 --- ### [Header Keys]() #### [` LIEF::OAT::HEADER_KEYS `]() enum LIEF::OAT::HEADER\_KEYS *Values:* ##### [` KEY_IMAGE_LOCATION `]() enumerator KEY\_IMAGE\_LOCATION = 0 ##### [` KEY_DEX2OAT_CMD_LINE `]() enumerator KEY\_DEX2OAT\_CMD\_LINE = 1 ##### [` KEY_DEX2OAT_HOST `]() enumerator KEY\_DEX2OAT\_HOST = 2 ##### [` KEY_PIC `]() enumerator KEY\_PIC = 3 ##### [` KEY_HAS_PATCH_INFO `]() enumerator KEY\_HAS\_PATCH\_INFO = 4 ##### [` KEY_DEBUGGABLE `]() enumerator KEY\_DEBUGGABLE = 5 ##### [` KEY_NATIVE_DEBUGGABLE `]() enumerator KEY\_NATIVE\_DEBUGGABLE = 6 ##### [` KEY_COMPILER_FILTER `]() enumerator KEY\_COMPILER\_FILTER = 7 ##### [` KEY_CLASS_PATH `]() enumerator KEY\_CLASS\_PATH = 8 ##### [` KEY_BOOT_CLASS_PATH `]() enumerator KEY\_BOOT\_CLASS\_PATH = 9 ##### [` KEY_CONCURRENT_COPYING `]() enumerator KEY\_CONCURRENT\_COPYING = 10 ##### [` KE_COMPILATION_REASON `]() enumerator KE\_COMPILATION\_REASON = 11 --- ### [Instruction sets]() #### [` LIEF::OAT::INSTRUCTION_SETS `]() enum LIEF::OAT::INSTRUCTION\_SETS *Values:* ##### [` INST_SET_NONE `]() enumerator INST\_SET\_NONE = 0 ##### [` INST_SET_ARM `]() enumerator INST\_SET\_ARM = 1 ##### [` INST_SET_ARM_64 `]() enumerator INST\_SET\_ARM\_64 = 2 ##### [` INST_SET_THUMB2 `]() enumerator INST\_SET\_THUMB2 = 3 ##### [` INST_SET_X86 `]() enumerator INST\_SET\_X86 = 4 ##### [` INST_SET_X86_64 `]() enumerator INST\_SET\_X86\_64 = 5 ##### [` INST_SET_MIPS `]() enumerator INST\_SET\_MIPS = 6 ##### [` INST_SET_MIPS_64 `]() enumerator INST\_SET\_MIPS\_64 = 7 --- documentID: "a62a4541758459d5eed03b4624509f0331510199fec0b4e088235caf8a988ebe" docname: "formats/android/oat/index" title: "OAT - Android - LIEF Documentation" description: "OAT in Android. Android OAT files are essentially ELF files, and LIEF exposes a specific API for them. You can check out the Android Formats tutorial for more…" canonical: "https://lief.re/doc/latest/formats/android/oat/index.html" markdownURL: "https://lief.re/doc/latest/formats/android/oat/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "547061a036e1f56c2892ff4acf8377e7b746102ed17654f0ac1691adf8ecca75" --- # [OAT]() API - [C++]() - [Python]() Android OAT files are essentially ELF files, and LIEF exposes a specific API for them. You can check out the [Android Formats]() tutorial for more details. --- documentID: "d517a05bb56f618f6d904bfd3eaa720986cb60ae327907dc70a117c97788098e" docname: "formats/android/oat/python" title: "OAT Python API - LIEF Documentation" description: "OAT Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/android/oat/python.html" markdownURL: "https://lief.re/doc/latest/formats/android/oat/python.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "99e3d7554395d63dc8051c0ed3e24606345970b2c21b8a1fd251a547aeaf2174" --- # [Python]() ## [Utilities]() ### [` lief.is_oatlief.is_oatlief.is_oat `]() lief.is\_oat(*\*args*) → bool **lief.is\_oat(*path: str*) → bool **lief.is\_oat(*raw: collections.abc.Sequence[int]*) → bool**** Overloaded function. 1. `is_oat(binary: lief._lief.ELF.Binary) -> bool` Check if the [`Binary`]( "lief.ELF.Binary") given in parameter is an OAT 2. `is_oat(path: str) -> bool` Check if the **file** given in parameter is an OAT 3. `is_oat(raw: collections.abc.Sequence[int]) -> bool` Check if the **raw data** given in parameter is an OAT ### [` lief.OAT.versionlief.OAT.versionlief.OAT.version `]() lief.OAT.version(*\*args*) → int **lief.OAT.version(*file: str*) → int **lief.OAT.version(*raw: collections.abc.Sequence[int]*) → int**** Overloaded function. 1. `version(binary: lief._lief.ELF.Binary) -> int` Return the OAT version of the [`Binary`]( "lief.ELF.Binary") given in parameter 2. `version(file: str) -> int` Return the OAT version of the **file** given in parameter 3. `version(raw: collections.abc.Sequence[int]) -> int` Return the OAT version of the **raw data** given in parameter ### [` lief.OAT.android_version `]() lief.OAT.android\_version(*arg: int*) → [lief.Android.ANDROID\_VERSIONS]( "lief.Android.ANDROID_VERSIONS") Return the [`ANDROID_VERSIONS`]( "lief.Android.ANDROID_VERSIONS") associated with the given OAT version --- ## [Parser]() ### [` lief.OAT.parselief.OAT.parselief.OAT.parselief.OAT.parse `]() lief.OAT.parse(*\*args*) → [lief.OAT.Binary]( "lief.OAT.Binary") | None **lief.OAT.parse(*oat\_file: str*, *vdex\_file: str*) → [lief.\_lief.OAT.Binary]( "lief._lief.OAT.Binary") | None **lief.OAT.parse(*raw: collections.abc.Sequence[int]*) → [lief.\_lief.OAT.Binary]( "lief._lief.OAT.Binary") | None **lief.OAT.parse(*obj: str | io.IOBase | os.PathLike | bytes | list[int]*) → [lief.\_lief.OAT.Binary]( "lief._lief.OAT.Binary") | None****** Overloaded function. 1. `parse(oat_file: str) -> Optional[lief._lief.OAT.Binary]` Parse the given OAT file and return a [`Binary`]( "lief.OAT.Binary") object 2. `parse(oat_file: str, vdex_file: str) -> Optional[lief._lief.OAT.Binary]` Parse the given OAT with its VDEX file and return a [`Binary`]( "lief.OAT.Binary") object 3. `parse(raw: collections.abc.Sequence[int]) -> Optional[lief._lief.OAT.Binary]` Parse the given raw data and return a [`Binary`]( "lief.OAT.Binary") object 4. `parse(obj: Union[str | io.IOBase | os.PathLike | bytes | list[int]]) -> Optional[lief._lief.OAT.Binary]` --- ## [Binary]() ### [` lief.OAT.Binary `]() class lief.OAT.Binary Bases: [`Binary`]( "lief._lief.ELF.Binary") OAT binary representation #### [` classes `]() property classes → lief.OAT.Binary.it\_classes Return an iterator over [`Class`]( "lief.OAT.Class") #### [` dex2dex_json_info `]() property dex2dex\_json\_info → str #### [` dex_files `]() property dex\_files → lief.OAT.Binary.it\_dex\_files Return an iterator over [`File`]( "lief.DEX.File") #### [` get_classget_class `]() get\_class(*self*, *class\_name: str*) → [lief.\_lief.OAT.Class]( "lief._lief.OAT.Class") | None **get\_class(*self*, *class\_index: int*) → [lief.\_lief.OAT.Class]( "lief._lief.OAT.Class") | None** Overloaded function. 1. `get_class(self, class_name: str) -> lief._lief.OAT.Class | None` Return the [`Class`]( "lief.OAT.Class") from its name 2. `get_class(self, class_index: int) -> lief._lief.OAT.Class | None` Return the [`Class`]( "lief.OAT.Class") from its **index** #### [` has_class `]() has\_class(*self*, *arg: str*, */*) → bool Check if the class with the given name is present in the current OAT binary #### [` header `]() property header → [lief.OAT.Header]( "lief.OAT.Header") Return the OAT [`Header`]( "lief.OAT.Header") #### [` methods `]() property methods → lief.OAT.Binary.it\_methods Return an iterator over [`Method`]( "lief.OAT.Method") #### [` oat_dex_files `]() property oat\_dex\_files → lief.OAT.Binary.it\_oat\_dex\_files Return an iterator over [`DexFile`]( "lief.OAT.DexFile") --- ## [Header]() ### [` lief.OAT.Header `]() class lief.OAT.Header(*self*) Bases: `Object` OAT Header representation #### [` checksum `]() property checksum → int Checksum of the OAT file #### [` element_t `]() class element\_t Bases: `object` ##### [` key `]() property key → [lief.OAT.HEADER\_KEYS]( "lief.OAT.HEADER_KEYS") ##### [` value `]() property value → str #### [` executable_offset `]() property executable\_offset → int #### [` get `]() get(*self*, *key: [lief.\_lief.OAT.HEADER\_KEYS]( "lief._lief.OAT.HEADER_KEYS")*) → str #### [` i2c_code_bridge_offset `]() property i2c\_code\_bridge\_offset → int #### [` i2i_bridge_offset `]() property i2i\_bridge\_offset → int #### [` image_file_location_oat_checksum `]() property image\_file\_location\_oat\_checksum → int #### [` image_file_location_oat_data_begin `]() property image\_file\_location\_oat\_data\_begin → int #### [` image_patch_delta `]() property image\_patch\_delta → int #### [` instruction_set `]() property instruction\_set → [lief.OAT.INSTRUCTION\_SETS]( "lief.OAT.INSTRUCTION_SETS") List of [`INSTRUCTION_SETS`]( "lief.OAT.INSTRUCTION_SETS") #### [` jni_dlsym_lookup_offset `]() property jni\_dlsym\_lookup\_offset → int #### [` key_value_size `]() property key\_value\_size → int #### [` key_values `]() property key\_values → lief.OAT.Header.it\_key\_values\_t Configuration used for the `dex2oat` transformation #### [` keys `]() property keys → list[[lief.OAT.HEADER\_KEYS]( "lief.OAT.HEADER_KEYS")] List of [`HEADER_KEYS`]( "lief.OAT.HEADER_KEYS") present #### [` magic `]() property magic → list[int] Magic number which shoud be `oat\x0A` #### [` nb_dex_files `]() property nb\_dex\_files → int Number of [`lief.DEX.File`]( "lief.DEX.File") registered in the current OAT #### [` oat_dex_files_offset `]() property oat\_dex\_files\_offset → int Offset to the raw `lief.OAT.Dexfile` > **Warning** > > This attribute is only relevant for OAT for which the version is above 131 #### [` quick_generic_jni_trampoline_offset `]() property quick\_generic\_jni\_trampoline\_offset → int #### [` quick_imt_conflict_trampoline_offset `]() property quick\_imt\_conflict\_trampoline\_offset → int #### [` quick_resolution_trampoline_offset `]() property quick\_resolution\_trampoline\_offset → int #### [` quick_to_interpreter_bridge_offset `]() property quick\_to\_interpreter\_bridge\_offset → int #### [` set `]() set(*self*, *key: [lief.\_lief.OAT.HEADER\_KEYS]( "lief._lief.OAT.HEADER_KEYS")*, *value: str*) → [lief.\_lief.OAT.Header]( "lief._lief.OAT.Header") #### [` values `]() property values → list[str] List of values associated with [`keys`]( "lief.OAT.Header.keys") #### [` version `]() property version → int Underlying version of the OAT file --- ## [DexFile]() ### [` lief.OAT.DexFile `]() class lief.OAT.DexFile(*self*) Bases: `Object` OAT DexFile representation #### [` checksum `]() property checksum → int Checksum of the underlying DEX file #### [` dex_file `]() property dex\_file → [lief.DEX.File]( "lief.DEX.File") | None Associated [`lief.DEX.File`]( "lief.DEX.File") #### [` dex_offset `]() property dex\_offset → int Offset to the raw [`lief.DEX.File`]( "lief.DEX.File") #### [` has_dex_file `]() property has\_dex\_file → bool Check if the [`lief.DEX.File`]( "lief.DEX.File") is present #### [` location `]() property location → str Original location of the DEX file --- ## [Class]() ### [` lief.OAT.Class `]() class lief.OAT.Class(*self*) Bases: `Object` OAT Class representation #### [` bitmap `]() property bitmap → list[int] Bitmap information used to quickly find which methods are optimized #### [` fullname `]() property fullname → str Class mangled name (e.g. `Lcom/android/MyActivity;`) #### [` has_dex_class `]() has\_dex\_class(*self*) → bool True if a [`lief.DEX.Class`]( "lief.DEX.Class") object is associated with this **OAT** Class #### [` index `]() property index → int Index the **DEX** classes pool ([`lief.DEX.File.classes`]( "lief.DEX.File.classes")) #### [` is_quickenedis_quickened `]() is\_quickened(*self*, *dex\_method: [lief.\_lief.DEX.Method]( "lief._lief.DEX.Method")*) → bool **is\_quickened(*self*, *method\_index: int*) → bool** Overloaded function. 1. `is_quickened(self, dex_method: lief._lief.DEX.Method) -> bool` Check if the given [`lief.DEX.Method`]( "lief.DEX.Method") is compiled into native code 2. `is_quickened(self, method_index: int) -> bool` Check if the Method at the given index is compiled into native code #### [` method_offsets_indexmethod_offsets_index `]() method\_offsets\_index(*self*, *arg: [lief.\_lief.DEX.Method]( "lief._lief.DEX.Method")*, */*) → int **method\_offsets\_index(*self*, *arg: int*, */*) → int** #### [` methods `]() property methods → lief.OAT.Class.it\_methods Iterator over [`lief.OAT.Method`]( "lief.OAT.Method") #### [` status `]() property status → [lief.OAT.OAT\_CLASS\_STATUS]( "lief.OAT.OAT_CLASS_STATUS") Class [`OAT_CLASS_STATUS`]( "lief.OAT.OAT_CLASS_STATUS") #### [` type `]() property type → [lief.OAT.OAT\_CLASS\_TYPES]( "lief.OAT.OAT_CLASS_TYPES") Information ([`OAT_CLASS_TYPES`]( "lief.OAT.OAT_CLASS_TYPES")) about how methods are optimized --- ## [Method]() ### [` lief.OAT.Method `]() class lief.OAT.Method(*self*) Bases: `Object` OAT Method representation #### [` dex_method `]() property dex\_method → [lief.DEX.Method]( "lief.DEX.Method") | None Mirrored [`Method`]( "lief.DEX.Method") associated with the OAT method (or None) #### [` has_dex_method `]() property has\_dex\_method → bool Check if a [`Method`]( "lief.DEX.Method") is associated with the OAT method #### [` is_compiled `]() property is\_compiled → bool True if the optimization is **native** #### [` is_dex2dex_optimized `]() property is\_dex2dex\_optimized → bool True if the optimization is **DEX** #### [` name `]() property name → str Method’s name #### [` oat_class `]() property oat\_class → [lief.OAT.Class]( "lief.OAT.Class") | None [`Class`]( "lief.OAT.Class") associated with the method (or None) #### [` quick_code `]() property quick\_code → list[int] Quick code associated with the method --- ## [Enums]() ### [OAT Class types]() #### [` lief.OAT.OAT_CLASS_TYPES `]() class lief.OAT.OAT\_CLASS\_TYPES(*\*values*) Bases: `Enum` ##### [` ALL_COMPILED `]() ALL\_COMPILED = 0 ##### [` NONE_COMPILED `]() NONE\_COMPILED = 2 ##### [` SOME_COMPILED `]() SOME\_COMPILED = 1 --- ### [OAT Class Status]() #### [` lief.OAT.OAT_CLASS_STATUS `]() class lief.OAT.OAT\_CLASS\_STATUS(*\*values*) Bases: `Enum` ##### [` ERROR `]() ERROR = -1 ##### [` IDX `]() IDX = 1 ##### [` INITIALIZED `]() INITIALIZED = 10 ##### [` INITIALIZING `]() INITIALIZING = 9 ##### [` LOADED `]() LOADED = 2 ##### [` NOTREADY `]() NOTREADY = 0 ##### [` RESOLVED `]() RESOLVED = 4 ##### [` RESOLVING `]() RESOLVING = 3 ##### [` RETIRED `]() RETIRED = -2 ##### [` VERIFICATION_AT_RUNTIME `]() VERIFICATION\_AT\_RUNTIME = 6 ##### [` VERIFIED `]() VERIFIED = 8 ##### [` VERIFYING `]() VERIFYING = 5 ##### [` VERIFYING_AT_RUNTIME `]() VERIFYING\_AT\_RUNTIME = 7 --- ### [Header Keys]() #### [` lief.OAT.HEADER_KEYS `]() class lief.OAT.HEADER\_KEYS(*\*values*) Bases: `Enum` ##### [` BOOT_CLASS_PATH `]() BOOT\_CLASS\_PATH = 9 ##### [` CLASS_PATH `]() CLASS\_PATH = 8 ##### [` COMPILER_FILTER `]() COMPILER\_FILTER = 7 ##### [` CONCURRENT_COPYING `]() CONCURRENT\_COPYING = 10 ##### [` DEBUGGABLE `]() DEBUGGABLE = 5 ##### [` DEX2OAT_CMD_LINE `]() DEX2OAT\_CMD\_LINE = 1 ##### [` DEX2OAT_HOST `]() DEX2OAT\_HOST = 2 ##### [` HAS_PATCH_INFO `]() HAS\_PATCH\_INFO = 4 ##### [` IMAGE_LOCATION `]() IMAGE\_LOCATION = 0 ##### [` NATIVE_DEBUGGABLE `]() NATIVE\_DEBUGGABLE = 6 ##### [` PIC `]() PIC = 3 --- ### [Instruction sets]() #### [` lief.OAT.INSTRUCTION_SETS `]() class lief.OAT.INSTRUCTION\_SETS(*\*values*) Bases: `Enum` ##### [` ARM `]() ARM = 1 ##### [` ARM_64 `]() ARM\_64 = 2 ##### [` MIPS `]() MIPS = 6 ##### [` MIPS_64 `]() MIPS\_64 = 7 ##### [` NONE `]() NONE = 0 ##### [` THUMB2 `]() THUMB2 = 3 ##### [` X86 `]() X86 = 4 ##### [` X86_64 `]() X86\_64 = 5 --- documentID: "f2f3ce2eb971b174d3a0d6cb40267b80c0814cc758235b7b4dbcf426178573fc" docname: "formats/android/vdex/cpp" title: "VDEX C++ API - LIEF Documentation" description: "VDEX C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/android/vdex/cpp.html" markdownURL: "https://lief.re/doc/latest/formats/android/vdex/cpp.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "4a32ea3c4015a20566e2a02b50f880813e8e79afb5ca7baf9947f0d1378aed70" --- # [C++]() ## [Utilities]() ### [` LIEF::VDEX::is_vdex `]() bool LIEF::VDEX::is\_vdex(std::string\_view file) Check if the given file is a VDEX one. ### [` LIEF::VDEX::is_vdex `]() bool LIEF::VDEX::is\_vdex(const std::vector<uint8\_t> &raw) Check if the given raw data is a VDEX one. ### [` LIEF::VDEX::version `]() vdex\_version\_t LIEF::VDEX::version(std::string\_view file) Return the VDEX version of the given file. ### [` LIEF::VDEX::version `]() vdex\_version\_t LIEF::VDEX::version(const std::vector<uint8\_t> &raw) Return the VDEX version of the raw data. ### [` LIEF::VDEX::android_version `]() Android::[ANDROID\_VERSIONS]( "LIEF::Android::ANDROID_VERSIONS") LIEF::VDEX::android\_version(vdex\_version\_t version) Return the ANDROID\_VERSIONS associated with the given VDEX version. --- ## [Parser]() ### [` Parser `]() class Parser Class which parses a VDEX file and transforms it into a [VDEX::File]() object. Public Functions #### [` operator= `]() [Parser]( "LIEF::VDEX::Parser") &operator=(const [Parser]( "LIEF::VDEX::Parser") &copy) = delete #### [` Parser `]() Parser(const [Parser]( "LIEF::VDEX::Parser::Parser") &copy) = delete Public Static Functions #### [` parse `]() static std::unique\_ptr<[File]( "LIEF::VDEX::File")> parse(std::string\_view file) #### [` PathTparse `]() template<class PathT, enable\_if\_path\_t<[PathT]( "LIEF::VDEX::Parser::parse::PathT")> = 0> static inline std::unique\_ptr<[File]( "LIEF::VDEX::File")> parse(const [PathT]( "LIEF::VDEX::Parser::parse::PathT") &file) Same as [parse(std::string\_view)]() but the file is given as a `std::filesystem::path`. #### [` parse `]() static std::unique\_ptr<[File]( "LIEF::VDEX::File")> parse(const std::vector<uint8\_t> &data, std::string\_view name = "") --- ## [File]() ### [` File `]() class File : public LIEF::Object Main class for the VDEX module which represents a VDEX file. Public Types #### [` dex_files_t `]() using dex\_files\_t = std::vector<std::unique\_ptr<DEX::[File]( "LIEF::DEX::File")>> #### [` it_dex_files `]() using it\_dex\_files = [ref\_iterator]( "LIEF::ref_iterator")<[dex\_files\_t]( "LIEF::VDEX::File::dex_files_t")&, DEX::[File]( "LIEF::DEX::File")\*> #### [` it_const_dex_files `]() using it\_const\_dex\_files = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [dex\_files\_t]( "LIEF::VDEX::File::dex_files_t")&, const DEX::[File]( "LIEF::DEX::File")\*> Public Functions #### [` operator= `]() [File]( "LIEF::VDEX::File") &operator=(const [File]( "LIEF::VDEX::File") &copy) = delete #### [` File `]() File(const [File]( "LIEF::VDEX::File::File") &copy) = delete #### [` header `]() const [Header]( "LIEF::VDEX::Header") &header() const VDEX [Header](). #### [` header `]() [Header]( "LIEF::VDEX::Header") &header() #### [` dex_files `]() [it\_dex\_files]( "LIEF::VDEX::File::it_dex_files") dex\_files() Iterator over LIEF::DEX::Files registered. #### [` dex_files `]() [it\_const\_dex\_files]( "LIEF::VDEX::File::it_const_dex_files") dex\_files() const #### [` dex2dex_info `]() dex2dex\_info\_t dex2dex\_info() const #### [` dex2dex_json_info `]() std::string dex2dex\_json\_info() #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~File `]() ~File() override Friends **friend class OAT::Binary** #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [File]( "LIEF::VDEX::File") &vdex\_file) --- ## [Header]() ### [` Header `]() class Header : public LIEF::Object Public Types #### [` magic_t `]() using magic\_t = std::array<uint8\_t, 4> Public Functions #### [` Header `]() Header() #### [` THeader `]() template<class T> Header(const [T]( "LIEF::VDEX::Header::Header::T") \*header) #### [` Header `]() Header(const [Header]( "LIEF::VDEX::Header::Header")&) #### [` operator= `]() [Header]( "LIEF::VDEX::Header") &operator=(const [Header]( "LIEF::VDEX::Header")&) #### [` magic `]() [magic\_t]( "LIEF::VDEX::Header::magic_t") magic() const Magic value used to identify VDEX. #### [` version `]() vdex\_version\_t version() const VDEX version number. #### [` nb_dex_files `]() uint32\_t nb\_dex\_files() const Number of [LIEF::DEX::File]() files registered. #### [` dex_size `]() uint32\_t dex\_size() const Size of **all** [LIEF::DEX::File](). #### [` verifier_deps_size `]() uint32\_t verifier\_deps\_size() const Size of verifier deps section. #### [` quickening_info_size `]() uint32\_t quickening\_info\_size() const Size of quickening info section. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~Header `]() ~Header() override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Header]( "LIEF::VDEX::Header") &header) --- documentID: "c0dd34746be54f8f61180cb1adeec2d5aafce1f1bac934b467b510f7f32d57ca" docname: "formats/android/vdex/index" title: "VDEX - Android - LIEF Documentation" description: "VDEX in Android. Android VDEX files are partially supported by LIEF, and you can refer to the Android Formats tutorial for details." canonical: "https://lief.re/doc/latest/formats/android/vdex/index.html" markdownURL: "https://lief.re/doc/latest/formats/android/vdex/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "64cd06efe4703b96bab19f046084f9e1da3e248222d33b2f64659a8a16a4f4a2" --- # [VDEX]() API - [C++]() - [Python]() Android VDEX files are *partially* supported by LIEF, and you can refer to the [Android Formats]() tutorial for details. --- documentID: "1d84ffc4a58e840bb9c603fac05854a7e375bbbf90079bccf5eeaeef294fb56e" docname: "formats/android/vdex/python" title: "VDEX Python API - LIEF Documentation" description: "VDEX Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/android/vdex/python.html" markdownURL: "https://lief.re/doc/latest/formats/android/vdex/python.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "eb7d3600c3d88944bb973ef2fa4dc028c335b83e73fcbcee9c7a9eabf44c7a3d" --- # [Python]() ## [Utilities]() ### [` lief.is_vdexlief.is_vdex `]() lief.is\_vdex(*\*args*) → bool **lief.is\_vdex(*raw: collections.abc.Sequence[int]*) → bool** Overloaded function. 1. `is_vdex(path: str) -> bool` Check if the **file** given in parameter is a VDEX 2. `is_vdex(raw: collections.abc.Sequence[int]) -> bool` Check if the **raw data** given in parameter is a VDEX ### [` lief.VDEX.versionlief.VDEX.version `]() lief.VDEX.version(*\*args*) → int **lief.VDEX.version(*raw: collections.abc.Sequence[int]*) → int** Overloaded function. 1. `version(file: str) -> int` Return the VDEX version of the **file** given in parameter 2. `version(raw: collections.abc.Sequence[int]) -> int` Return the VDEX version of the **raw data** given in parameter ### [` lief.VDEX.android_version `]() lief.VDEX.android\_version(*vdex\_version: int*) → [lief.Android.ANDROID\_VERSIONS]( "lief.Android.ANDROID_VERSIONS") Return the [`ANDROID_VERSIONS`]( "lief.Android.ANDROID_VERSIONS") associated with the given VDEX version --- ## [Parser]() ### [` lief.VDEX.parselief.VDEX.parse `]() lief.VDEX.parse(*\*args*) → [lief.VDEX.File]( "lief.VDEX.File") | None **lief.VDEX.parse(*obj: str | io.IOBase | os.PathLike | bytes | list[int]*, *name: str = ''*) → [lief.\_lief.VDEX.File]( "lief._lief.VDEX.File") | None** Overloaded function. 1. `parse(filename: str) -> Optional[lief._lief.VDEX.File]` Parse the given filename and return a [`File`]( "lief.VDEX.File") object 2. `parse(obj: Union[str | io.IOBase | os.PathLike | bytes | list[int]], name: str = '') -> Optional[lief._lief.VDEX.File]` --- ## [File]() ### [` lief.VDEX.File `]() class lief.VDEX.File Bases: `Object` VDEX File representation #### [` dex2dex_json_info `]() property dex2dex\_json\_info → str #### [` dex_files `]() property dex\_files → lief.OAT.Binary.it\_dex\_files Return an iterator over [`File`]( "lief.DEX.File") #### [` header `]() property header → [lief.VDEX.Header]( "lief.VDEX.Header") Return the VDEX [`Header`]( "lief.VDEX.Header") --- ## [Header]() ### [` lief.VDEX.Header `]() class lief.VDEX.Header Bases: `Object` VDEX Header representation #### [` dex_size `]() property dex\_size → int Size of **all** [`File`]( "lief.DEX.File") #### [` magic `]() property magic → list[int] Magic value used to identify VDEX #### [` nb_dex_files `]() property nb\_dex\_files → int Number of [`File`]( "lief.DEX.File") files registered #### [` quickening_info_size `]() property quickening\_info\_size → int Size of quickening info section #### [` verifier_deps_size `]() property verifier\_deps\_size → int Size of verifier deps section #### [` version `]() property version → int VDEX version number --- documentID: "320f29aa44638993d5c4981ca7c8e9414475e7571248480b0cb32e03563c1c10" docname: "formats/coff/cpp" title: "COFF C++ API - LIEF Documentation" description: "COFF C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/coff/cpp.html" markdownURL: "https://lief.re/doc/latest/formats/coff/cpp.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "faad5f74a22dae3caa7ac3cbcd17db434d1f9da1dbd9ee6f375880907bc474b7" --- # [C++]() ## [Parser]() ### [` Parser `]() class Parser Public Types #### [` SymSecMap `]() using SymSecMap = std::vector<SymSec> <=> std::unordered\_multimap<section index, Symbol\*> Public Functions #### [` ~Parser `]() ~Parser() Public Static Functions #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::COFF::Binary")> parse(std::unique\_ptr<[BinaryStream]( "LIEF::BinaryStream")> stream, const [ParserConfig]( "LIEF::COFF::ParserConfig") &config = [ParserConfig]( "LIEF::COFF::ParserConfig")::[default\_conf]( "LIEF::COFF::ParserConfig::default_conf")()) Parse the COFF binary referenced by the `stream` argument with the given config. #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::COFF::Binary")> parse(std::string\_view file, const [ParserConfig]( "LIEF::COFF::ParserConfig") &config = [ParserConfig]( "LIEF::COFF::ParserConfig")::[default\_conf]( "LIEF::COFF::ParserConfig::default_conf")()) Parse the COFF binary pointed by the `file` argument with the given config. #### [` PathTparse `]() template<class PathT, enable\_if\_path\_t<[PathT]( "LIEF::COFF::Parser::parse::PathT")> = 0> static inline std::unique\_ptr<[Binary]( "LIEF::COFF::Binary")> parse(const [PathT]( "LIEF::COFF::Parser::parse::PathT") &file, const [ParserConfig]( "LIEF::COFF::ParserConfig") &config = [ParserConfig]( "LIEF::COFF::ParserConfig")::[default\_conf]( "LIEF::COFF::ParserConfig::default_conf")()) Same as [parse(std::string\_view, const ParserConfig&)]() but the file is given as a `std::filesystem::path`. Public Static Attributes #### [` MAX_NB_SECTIONS `]() static size\_t MAX\_NB\_SECTIONS = 1 << 20 ### [` ParserConfig `]() class ParserConfig Class used to configure the COFF parser. Public Static Functions #### [` default_conf `]() static inline const [ParserConfig]( "LIEF::COFF::ParserConfig") &default\_conf() #### [` all `]() static inline const [ParserConfig]( "LIEF::COFF::ParserConfig") &all() --- ## [Binary]() ### [` Binary `]() class Binary Class that represents a COFF [Binary](). Public Types #### [` sections_t `]() using sections\_t = std::vector<std::unique\_ptr<[Section]( "LIEF::COFF::Section")>> Internal container used to store COFF’s section. #### [` it_sections `]() using it\_sections = [ref\_iterator]( "LIEF::ref_iterator")<[sections\_t]( "LIEF::COFF::Binary::sections_t")&, [Section]( "LIEF::COFF::Section")\*> Iterator that outputs [Section]()& object. #### [` it_const_sections `]() using it\_const\_sections = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [sections\_t]( "LIEF::COFF::Binary::sections_t")&, const [Section]( "LIEF::COFF::Section")\*> Iterator that outputs const [Section]()& object. #### [` relocations_t `]() using relocations\_t = std::vector<std::unique\_ptr<[Relocation]( "LIEF::COFF::Relocation")>> Internal container used to store COFF’s relocations. #### [` it_relocations `]() using it\_relocations = [ref\_iterator]( "LIEF::ref_iterator")<[relocations\_t]( "LIEF::COFF::Binary::relocations_t")&, [Relocation]( "LIEF::COFF::Relocation")\*> Iterator that outputs [Relocation]()& object. #### [` it_const_relocations `]() using it\_const\_relocations = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [relocations\_t]( "LIEF::COFF::Binary::relocations_t")&, const [Relocation]( "LIEF::COFF::Relocation")\*> Iterator that outputs const [Relocation]()& object. #### [` strings_table_t `]() using strings\_table\_t = std::vector<[String]( "LIEF::COFF::String")> Internal container used to store COFF’s strings. #### [` it_strings_table `]() using it\_strings\_table = [ref\_iterator]( "LIEF::ref_iterator")<[strings\_table\_t]( "LIEF::COFF::Binary::strings_table_t")&> Iterator that outputs [String]()& object. #### [` it_const_strings_table `]() using it\_const\_strings\_table = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [strings\_table\_t]( "LIEF::COFF::Binary::strings_table_t")&> Iterator that outputs const [String]()& object. #### [` symbols_t `]() using symbols\_t = std::vector<std::unique\_ptr<[Symbol]( "LIEF::COFF::Symbol")>> Internal container used to store COFF’s symbols. #### [` it_symbols `]() using it\_symbols = [ref\_iterator]( "LIEF::ref_iterator")<[symbols\_t]( "LIEF::COFF::Binary::symbols_t")&, [Symbol]( "LIEF::COFF::Symbol")\*> Iterator that outputs [Symbol]()& object. #### [` it_const_symbols `]() using it\_const\_symbols = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [symbols\_t]( "LIEF::COFF::Binary::symbols_t")&, const [Symbol]( "LIEF::COFF::Symbol")\*> Iterator that outputs [Symbol]()& object. #### [` instructions_it `]() using instructions\_it = [iterator\_range]( "LIEF::iterator_range")<assembly::[Instruction]( "LIEF::assembly::Instruction")::[Iterator]( "LIEF::assembly::Instruction::Iterator")> Instruction iterator. #### [` it_functions `]() using it\_functions = [filter\_iterator]( "LIEF::filter_iterator")<[symbols\_t]( "LIEF::COFF::Binary::symbols_t")&, [Symbol]( "LIEF::COFF::Symbol")\*> Iterator which outputs COFF symbols representing functions. #### [` it_const_function `]() using it\_const\_function = [const\_filter\_iterator]( "LIEF::const_filter_iterator")<const [symbols\_t]( "LIEF::COFF::Binary::symbols_t")&, const [Symbol]( "LIEF::COFF::Symbol")\*> Iterator which outputs COFF symbols representing functions. Public Functions #### [` header `]() inline const [Header]( "LIEF::COFF::Header") &header() const The COFF header. #### [` header `]() inline [Header]( "LIEF::COFF::Header") &header() #### [` sections `]() inline [it\_sections]( "LIEF::COFF::Binary::it_sections") sections() Iterator over the different sections located in this COFF binary. #### [` sections `]() inline [it\_const\_sections]( "LIEF::COFF::Binary::it_const_sections") sections() const #### [` relocations `]() inline [it\_relocations]( "LIEF::COFF::Binary::it_relocations") relocations() Iterator over **all** the relocations used by this COFF binary. #### [` relocations `]() inline [it\_const\_relocations]( "LIEF::COFF::Binary::it_const_relocations") relocations() const #### [` symbols `]() inline [it\_symbols]( "LIEF::COFF::Binary::it_symbols") symbols() Iterator over the COFF’s symbols. #### [` symbols `]() inline [it\_const\_symbols]( "LIEF::COFF::Binary::it_const_symbols") symbols() const #### [` string_table `]() inline [it\_const\_strings\_table]( "LIEF::COFF::Binary::it_const_strings_table") string\_table() const Iterator over the COFF’s strings. #### [` string_table `]() inline [it\_strings\_table]( "LIEF::COFF::Binary::it_strings_table") string\_table() #### [` find_string `]() inline [String]( "LIEF::COFF::String") \*find\_string(uint32\_t offset) Try to find the COFF string at the given offset in the COFF string table. > **Warning** > > This offset must include the first 4 bytes holding the size of the table. Hence, the first string starts a the offset 4. #### [` find_string `]() inline const [String]( "LIEF::COFF::String") \*find\_string(uint32\_t offset) const #### [` functions `]() [it\_const\_function]( "LIEF::COFF::Binary::it_const_function") functions() const Iterator over the functions implemented in this COFF. #### [` functions `]() [it\_functions]( "LIEF::COFF::Binary::it_functions") functions() #### [` find_function `]() const [Symbol]( "LIEF::COFF::Symbol") \*find\_function(const std::string &name) const Try to find the function (symbol) with the given name. #### [` find_function `]() inline [Symbol]( "LIEF::COFF::Symbol") \*find\_function(const std::string &name) #### [` find_demangled_function `]() const [Symbol]( "LIEF::COFF::Symbol") \*find\_demangled\_function(const std::string &name) const Try to find the function (symbol) with the given **demangled** name. #### [` find_demangled_function `]() inline [Symbol]( "LIEF::COFF::Symbol") \*find\_demangled\_function(const std::string &name) #### [` disassemble `]() [instructions\_it]( "LIEF::COFF::Binary::instructions_it") disassemble(const [Symbol]( "LIEF::COFF::Symbol") &symbol) const Disassemble code for the given symbol. ```cpp const Symbol* func = binary->find_demangled_function("int __cdecl my_function(int, int)"); auto insts = binary->disassemble(*func); for (std::unique_ptr inst : insts) { std::cout << inst->to_string() << '\n'; } ``` > **See also** > > [LIEF::assembly::Instruction]() #### [` disassemble `]() [instructions\_it]( "LIEF::COFF::Binary::instructions_it") disassemble(const std::string &symbol) const Disassemble code for the given symbol name. ```cpp auto insts = binary->disassemble("main"); for (std::unique_ptr inst : insts) { std::cout << inst->to_string() << '\n'; } ``` > **See also** > > [LIEF::assembly::Instruction]() #### [` disassemble `]() [instructions\_it]( "LIEF::COFF::Binary::instructions_it") disassemble(const uint8\_t \*buffer, size\_t size, uint64\_t address = 0) const Disassemble code provided by the given buffer at the specified `address` parameter. > **See also** > > [LIEF::assembly::Instruction]() #### [` disassemble `]() inline [instructions\_it]( "LIEF::COFF::Binary::instructions_it") disassemble(const std::vector<uint8\_t> &buffer, uint64\_t address = 0) const Disassemble code provided by the given vector of bytes at the specified `address` parameter. > **See also** > > [LIEF::assembly::Instruction]() #### [` disassemble `]() inline [instructions\_it]( "LIEF::COFF::Binary::instructions_it") disassemble(LIEF::span<const uint8\_t> buffer, uint64\_t address = 0) const #### [` disassemble `]() inline [instructions\_it]( "LIEF::COFF::Binary::instructions_it") disassemble(LIEF::span<uint8\_t> buffer, uint64\_t address = 0) const #### [` get_section `]() inline [Section]( "LIEF::COFF::Section") \*get\_section(std::string\_view name) Return the section matching the given name or a nullptr if it can’t be found. [Section]() names that do not fit in the 8 bytes allocated by the COFF format are stored in the COFF string table while the section itself only holds a `/` placeholder. This function transparently resolves both forms, so a long name can be looked up with its **regular** value: ```cpp const Section* sec = binary->get_section(".debug_rnglists"); sec->name(); // "/18" sec->coff_string()->str(); // ".debug_rnglists" ``` **Parameters:** **name** – **[in]** Name of the section #### [` get_section `]() const [Section]( "LIEF::COFF::Section") \*get\_section(std::string\_view name) const #### [` to_string `]() std::string to\_string() const #### [` ~Binary `]() ~Binary() Friends **friend class Parser** #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Binary]( "LIEF::COFF::Binary") &bin) --- ## [Header]() ### [` Header `]() class Header Class that represents the COFF header. It is subclassed by [LIEF::COFF::RegularHeader]() and [LIEF::COFF::BigObjHeader]() for normal vs `/bigobj` files. Subclassed by [LIEF::COFF::BigObjHeader](), [LIEF::COFF::RegularHeader]() Public Types #### [` KIND `]() enum class KIND *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` REGULAR `]() enumerator REGULAR ##### [` BIGOBJ `]() enumerator BIGOBJ #### [` MACHINE_TYPES `]() using MACHINE\_TYPES = LIEF::PE::[Header]( "LIEF::PE::Header")::[MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") The different architectures (mirrored from PE). Public Functions #### [` Header `]() Header() = default #### [` Header `]() inline Header([KIND]( "LIEF::COFF::Header::KIND") kind) #### [` operator= `]() [Header]( "LIEF::COFF::Header") &operator=(const [Header]( "LIEF::COFF::Header")&) = default #### [` Header `]() Header(const [Header]( "LIEF::COFF::Header::Header")&) = default #### [` operator= `]() [Header]( "LIEF::COFF::Header") &operator=([Header]( "LIEF::COFF::Header")&&) = default #### [` Header `]() Header([Header]( "LIEF::COFF::Header::Header")&&) = default #### [` clone `]() virtual std::unique\_ptr<[Header]( "LIEF::COFF::Header")> clone() const = 0 #### [` kind `]() inline [KIND]( "LIEF::COFF::Header::KIND") kind() const The type of this header: whether it is regular or using the `/bigobj` format. #### [` machine `]() inline [MACHINE\_TYPES]( "LIEF::COFF::Header::MACHINE_TYPES") machine() const The machine type targeted by this COFF. #### [` nb_sections `]() inline uint32\_t nb\_sections() const The number of sections. #### [` pointerto_symbol_table `]() inline uint32\_t pointerto\_symbol\_table() const Offset of the symbols table. #### [` nb_symbols `]() inline uint32\_t nb\_symbols() const Number of symbols (including auxiliary symbols). #### [` timedatestamp `]() inline uint32\_t timedatestamp() const Timestamp when the COFF has been generated. #### [` machine `]() inline void machine([MACHINE\_TYPES]( "LIEF::COFF::Header::MACHINE_TYPES") machine) #### [` nb_sections `]() inline void nb\_sections(uint32\_t value) #### [` pointerto_symbol_table `]() inline void pointerto\_symbol\_table(uint32\_t value) #### [` nb_symbols `]() inline void nb\_symbols(uint32\_t value) #### [` timedatestamp `]() inline void timedatestamp(uint32\_t value) #### [` to_string `]() virtual std::string to\_string() const #### [` Tas `]() template<class T> inline const [T]( "LIEF::COFF::Header::as::T") \*as() const #### [` ~Header `]() virtual ~Header() = default Public Static Functions #### [` create `]() static std::unique\_ptr<[Header]( "LIEF::COFF::Header")> create([BinaryStream]( "LIEF::BinaryStream") &stream) Create a header from the given stream. #### [` create `]() static std::unique\_ptr<[Header]( "LIEF::COFF::Header")> create([BinaryStream]( "LIEF::BinaryStream") &stream, [KIND]( "LIEF::COFF::Header::KIND") kind) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Header]( "LIEF::COFF::Header") &hdr) --- ## [Regular Header]() ### [` RegularHeader `]() class RegularHeader : public LIEF::COFF::[Header]( "LIEF::COFF::Header") This class represents the COFF header for non-bigobj. Public Functions #### [` RegularHeader `]() inline RegularHeader() #### [` operator= `]() [RegularHeader]( "LIEF::COFF::RegularHeader") &operator=(const [RegularHeader]( "LIEF::COFF::RegularHeader")&) = default #### [` RegularHeader `]() RegularHeader(const [RegularHeader]( "LIEF::COFF::RegularHeader::RegularHeader")&) = default #### [` operator= `]() [RegularHeader]( "LIEF::COFF::RegularHeader") &operator=([RegularHeader]( "LIEF::COFF::RegularHeader")&&) = default #### [` RegularHeader `]() RegularHeader([RegularHeader]( "LIEF::COFF::RegularHeader::RegularHeader")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[Header]( "LIEF::COFF::Header")> clone() const override #### [` sizeof_optionalheader `]() inline uint16\_t sizeof\_optionalheader() const The size of the optional header which follows this header (should be 0). #### [` characteristics `]() inline uint16\_t characteristics() const Characteristics. #### [` sizeof_optionalheader `]() inline void sizeof\_optionalheader(uint16\_t value) #### [` characteristics `]() inline void characteristics(uint16\_t value) #### [` ~RegularHeader `]() ~RegularHeader() override = default #### [` to_string `]() virtual std::string to\_string() const override Public Static Functions #### [` create `]() static std::unique\_ptr<[RegularHeader]( "LIEF::COFF::RegularHeader")> create([BinaryStream]( "LIEF::BinaryStream") &stream) Create a [RegularHeader]() from the given stream. #### [` classof `]() static inline bool classof(const [Header]( "LIEF::COFF::Header") \*header) --- ## [BigObj Header]() ### [` BigObjHeader `]() class BigObjHeader : public LIEF::COFF::[Header]( "LIEF::COFF::Header") This class represents the header for a COFF object compiled with `/bigobj` support (i.e. the number of sections can exceed 65536). The raw definition of the bigobj header is located in `winnt.h` and named `ANON_OBJECT_HEADER_BIGOBJ` Public Functions #### [` BigObjHeader `]() inline BigObjHeader() #### [` operator= `]() [BigObjHeader]( "LIEF::COFF::BigObjHeader") &operator=(const [BigObjHeader]( "LIEF::COFF::BigObjHeader")&) = default #### [` BigObjHeader `]() BigObjHeader(const [BigObjHeader]( "LIEF::COFF::BigObjHeader::BigObjHeader")&) = default #### [` operator= `]() [BigObjHeader]( "LIEF::COFF::BigObjHeader") &operator=([BigObjHeader]( "LIEF::COFF::BigObjHeader")&&) = default #### [` BigObjHeader `]() BigObjHeader([BigObjHeader]( "LIEF::COFF::BigObjHeader::BigObjHeader")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[Header]( "LIEF::COFF::Header")> clone() const override #### [` version `]() inline uint16\_t version() const The version of this header which must be >= 2. #### [` uuid `]() inline span<const uint8\_t> uuid() const Originally named `ClassID`, this uuid should match: `{D1BAA1C7-BAEE-4ba9-AF20-FAF66AA4DCB8}`. #### [` sizeof_data `]() inline uint32\_t sizeof\_data() const Size of data that follows the header. #### [` flags `]() inline uint32\_t flags() const 1 means that it contains metadata #### [` metadata_size `]() inline uint32\_t metadata\_size() const Size of CLR metadata. #### [` metadata_offset `]() inline uint32\_t metadata\_offset() const Offset of CLR metadata. #### [` version `]() inline void version(uint16\_t value) #### [` sizeof_data `]() inline void sizeof\_data(uint32\_t value) #### [` flags `]() inline void flags(uint32\_t value) #### [` metadata_size `]() inline void metadata\_size(uint32\_t value) #### [` metadata_offset `]() inline void metadata\_offset(uint32\_t value) #### [` ~BigObjHeader `]() ~BigObjHeader() override = default #### [` to_string `]() virtual std::string to\_string() const override Public Static Functions #### [` create `]() static std::unique\_ptr<[BigObjHeader]( "LIEF::COFF::BigObjHeader")> create([BinaryStream]( "LIEF::BinaryStream") &stream) #### [` classof `]() static inline bool classof(const [Header]( "LIEF::COFF::Header") \*header) Public Static Attributes #### [` UUID_SZ `]() static auto UUID\_SZ = 16 --- ## [Section]() ### [` Section `]() class Section : public LIEF::[Section]( "LIEF::Section") This class represents a COFF section. Public Types #### [` COMDAT_SELECTION `]() using COMDAT\_SELECTION = [AuxiliarySectionDefinition]( "LIEF::COFF::AuxiliarySectionDefinition")::[COMDAT\_SELECTION]( "LIEF::COFF::AuxiliarySectionDefinition::COMDAT_SELECTION") #### [` CHARACTERISTICS `]() using CHARACTERISTICS = LIEF::PE::[Section]( "LIEF::PE::Section")::[CHARACTERISTICS]( "LIEF::PE::Section::CHARACTERISTICS") Mirror Characteristics from PE. #### [` relocations_t `]() using relocations\_t = std::vector<[Relocation]( "LIEF::COFF::Relocation")\*> Container for the relocations in this section (owned by the [Binary]() object). #### [` it_relocations `]() using it\_relocations = [ref\_iterator]( "LIEF::ref_iterator")<[relocations\_t]( "LIEF::COFF::Section::relocations_t")&, [Relocation]( "LIEF::COFF::Relocation")\*> Iterator that outputs [Relocation]()&. #### [` it_const_relocations `]() using it\_const\_relocations = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [relocations\_t]( "LIEF::COFF::Section::relocations_t")&, const [Relocation]( "LIEF::COFF::Relocation")\*> Iterator that outputs const [Relocation]()&. #### [` symbols_t `]() using symbols\_t = std::vector<[Symbol]( "LIEF::COFF::Symbol")\*> Container for the symbols associated with this section (owned by the [Binary]() object). #### [` it_symbols `]() using it\_symbols = [ref\_iterator]( "LIEF::ref_iterator")<[symbols\_t]( "LIEF::COFF::Section::symbols_t")&, [Symbol]( "LIEF::COFF::Symbol")\*> Iterator that outputs [Symbol]()&. #### [` it_const_symbols `]() using it\_const\_symbols = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [symbols\_t]( "LIEF::COFF::Section::symbols_t")&, const [Symbol]( "LIEF::COFF::Symbol")\*> Iterator that outputs const [Symbol]()&. Public Functions #### [` sizeof_raw_data `]() inline uint32\_t sizeof\_raw\_data() const Return the size of the data in the section. #### [` virtual_size `]() inline uint32\_t virtual\_size() const Virtual size of the section (should be 0). #### [` content `]() inline virtual span<const uint8\_t> content() const override Content wrapped by this section. #### [` pointerto_raw_data `]() inline uint32\_t pointerto\_raw\_data() const Offset to the section’s content. #### [` pointerto_relocation `]() inline uint32\_t pointerto\_relocation() const Offset to the relocation table. #### [` pointerto_line_numbers `]() inline uint32\_t pointerto\_line\_numbers() const The file pointer to the beginning of line-number entries for the section. This is set to zero if there are no COFF line numbers. This value should be zero for an image because COFF debugging information is deprecated and modern debug information relies on the PDB files. #### [` numberof_relocations `]() inline uint16\_t numberof\_relocations() const Number of relocations. > **Warning** > > If the number of relocations is greater than 0xFFFF (maximum value for 16-bits integer), then the number of relocations is stored in the virtual address of the **first** relocation. #### [` numberof_line_numbers `]() inline uint16\_t numberof\_line\_numbers() const Number of line number entries (if any). #### [` characteristics `]() inline uint32\_t characteristics() const Characteristics of the section: it provides information about the permissions of the section when mapped. It can also provide information about the *purpose* of the section (contain code, BSS-like, …). #### [` has_characteristic `]() inline bool has\_characteristic([CHARACTERISTICS]( "LIEF::COFF::Section::CHARACTERISTICS") c) const Check if the section has the given [CHARACTERISTICS](). #### [` characteristics_list `]() inline std::vector<[CHARACTERISTICS]( "LIEF::COFF::Section::CHARACTERISTICS")> characteristics\_list() const List of the section characteristics. #### [` is_discardable `]() inline bool is\_discardable() const True if the section can be discarded as needed. This is typically the case for debug-related sections #### [` clear `]() inline void clear(uint8\_t c) #### [` relocations `]() inline [it\_relocations]( "LIEF::COFF::Section::it_relocations") relocations() Iterator over the relocations associated with this section. #### [` relocations `]() inline [it\_const\_relocations]( "LIEF::COFF::Section::it_const_relocations") relocations() const #### [` symbols `]() inline [it\_symbols]( "LIEF::COFF::Section::it_symbols") symbols() Iterator over the symbols associated with this section. #### [` symbols `]() inline [it\_const\_symbols]( "LIEF::COFF::Section::it_const_symbols") symbols() const #### [` comdat_info `]() std::optional<[ComdatInfo]( "LIEF::COFF::Section::ComdatInfo")> comdat\_info() const Return comdat information (only if the section has the CHARACTERISTICS::LNK\_COMDAT characteristic). #### [` has_extended_relocations `]() inline bool has\_extended\_relocations() const Whether there is a large number of relocations whose number need to be stored in the virtual address attribute. #### [` content `]() inline virtual void content(const std::vector<uint8\_t> &data) override Change section content. #### [` name `]() virtual void name(std::string name) override Change the section’s name. #### [` virtual_size `]() inline void virtual\_size(uint32\_t virtual\_sz) #### [` pointerto_raw_data `]() inline void pointerto\_raw\_data(uint32\_t ptr) #### [` pointerto_relocation `]() inline void pointerto\_relocation(uint32\_t ptr) #### [` pointerto_line_numbers `]() inline void pointerto\_line\_numbers(uint32\_t ptr) #### [` numberof_relocations `]() inline void numberof\_relocations(uint16\_t nb) #### [` numberof_line_numbers `]() inline void numberof\_line\_numbers(uint16\_t nb) #### [` sizeof_raw_data `]() inline void sizeof\_raw\_data(uint32\_t size) #### [` characteristics `]() inline void characteristics(uint32\_t characteristics) #### [` coff_string `]() inline [String]( "LIEF::COFF::String") \*coff\_string() Return the COFF string associated with the section’s name (or a nullptr). This coff string is usually present for long section names whose length does not fit in the 8 bytes allocated by the COFF format. #### [` coff_string `]() inline const [String]( "LIEF::COFF::String") \*coff\_string() const #### [` to_string `]() std::string to\_string() const #### [` ~Section `]() ~Section() override = default #### [` name `]() inline virtual std::string\_view name() const [Section]()’s name. Public Static Functions #### [` parse `]() static std::unique\_ptr<[Section]( "LIEF::COFF::Section")> parse([BinaryStream]( "LIEF::BinaryStream") &stream) Parse a section from the given stream. Friends **friend class Parser** #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Section]( "LIEF::COFF::Section") &sec) #### [` ComdatInfo `]() struct ComdatInfo This structure wraps comdat information which is composed of the symbol associated with the comdat section and its selection flag. Public Members ##### [` symbol `]() [Symbol]( "LIEF::COFF::Symbol") \*symbol = nullptr ##### [` kind `]() [COMDAT\_SELECTION]( "LIEF::COFF::Section::COMDAT_SELECTION") kind = [COMDAT\_SELECTION]( "LIEF::COFF::Section::COMDAT_SELECTION")::NONE --- ## [Relocation]() ### [` Relocation `]() class Relocation : public LIEF::[Relocation]( "LIEF::Relocation") This class represents a COFF relocation. Public Types #### [` TYPE `]() enum class TYPE : uint32\_t The different relocation types. Please note that the original type is encoded on 16 bits but we encode the type on 32-bits by adding a discriminator from the 17th bit *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = uint32\_t(-1) ##### [` I386_ABSOLUTE `]() enumerator I386\_ABSOLUTE = [I386]( "LIEF::COFF::Relocation::I386") + 0x0000 ##### [` I386_DIR16 `]() enumerator I386\_DIR16 = [I386]( "LIEF::COFF::Relocation::I386") + 0x0001 ##### [` I386_REL16 `]() enumerator I386\_REL16 = [I386]( "LIEF::COFF::Relocation::I386") + 0x0002 ##### [` I386_DIR32 `]() enumerator I386\_DIR32 = [I386]( "LIEF::COFF::Relocation::I386") + 0x0006 ##### [` I386_DIR32NB `]() enumerator I386\_DIR32NB = [I386]( "LIEF::COFF::Relocation::I386") + 0x0007 ##### [` I386_SEG12 `]() enumerator I386\_SEG12 = [I386]( "LIEF::COFF::Relocation::I386") + 0x0009 ##### [` I386_SECTION `]() enumerator I386\_SECTION = [I386]( "LIEF::COFF::Relocation::I386") + 0x000A ##### [` I386_SECREL `]() enumerator I386\_SECREL = [I386]( "LIEF::COFF::Relocation::I386") + 0x000B ##### [` I386_TOKEN `]() enumerator I386\_TOKEN = [I386]( "LIEF::COFF::Relocation::I386") + 0x000C ##### [` I386_SECREL7 `]() enumerator I386\_SECREL7 = [I386]( "LIEF::COFF::Relocation::I386") + 0x000D ##### [` I386_REL32 `]() enumerator I386\_REL32 = [I386]( "LIEF::COFF::Relocation::I386") + 0x0014 ##### [` AMD64_ABSOLUTE `]() enumerator AMD64\_ABSOLUTE = [X64]( "LIEF::COFF::Relocation::X64") + 0x0000 ##### [` AMD64_ADDR64 `]() enumerator AMD64\_ADDR64 = [X64]( "LIEF::COFF::Relocation::X64") + 0x0001 ##### [` AMD64_ADDR32 `]() enumerator AMD64\_ADDR32 = [X64]( "LIEF::COFF::Relocation::X64") + 0x0002 ##### [` AMD64_ADDR32NB `]() enumerator AMD64\_ADDR32NB = [X64]( "LIEF::COFF::Relocation::X64") + 0x0003 ##### [` AMD64_REL32 `]() enumerator AMD64\_REL32 = [X64]( "LIEF::COFF::Relocation::X64") + 0x0004 ##### [` AMD64_REL32_1 `]() enumerator AMD64\_REL32\_1 = [X64]( "LIEF::COFF::Relocation::X64") + 0x0005 ##### [` AMD64_REL32_2 `]() enumerator AMD64\_REL32\_2 = [X64]( "LIEF::COFF::Relocation::X64") + 0x0006 ##### [` AMD64_REL32_3 `]() enumerator AMD64\_REL32\_3 = [X64]( "LIEF::COFF::Relocation::X64") + 0x0007 ##### [` AMD64_REL32_4 `]() enumerator AMD64\_REL32\_4 = [X64]( "LIEF::COFF::Relocation::X64") + 0x0008 ##### [` AMD64_REL32_5 `]() enumerator AMD64\_REL32\_5 = [X64]( "LIEF::COFF::Relocation::X64") + 0x0009 ##### [` AMD64_SECTION `]() enumerator AMD64\_SECTION = [X64]( "LIEF::COFF::Relocation::X64") + 0x000A ##### [` AMD64_SECREL `]() enumerator AMD64\_SECREL = [X64]( "LIEF::COFF::Relocation::X64") + 0x000B ##### [` AMD64_SECREL7 `]() enumerator AMD64\_SECREL7 = [X64]( "LIEF::COFF::Relocation::X64") + 0x000C ##### [` AMD64_TOKEN `]() enumerator AMD64\_TOKEN = [X64]( "LIEF::COFF::Relocation::X64") + 0x000D ##### [` AMD64_SREL32 `]() enumerator AMD64\_SREL32 = [X64]( "LIEF::COFF::Relocation::X64") + 0x000E ##### [` AMD64_PAIR `]() enumerator AMD64\_PAIR = [X64]( "LIEF::COFF::Relocation::X64") + 0x000F ##### [` AMD64_SSPAN32 `]() enumerator AMD64\_SSPAN32 = [X64]( "LIEF::COFF::Relocation::X64") + 0x0010 ##### [` ARM_ABSOLUTE `]() enumerator ARM\_ABSOLUTE = [ARM]( "LIEF::COFF::Relocation::ARM") + 0x0000 ##### [` ARM_ADDR32 `]() enumerator ARM\_ADDR32 = [ARM]( "LIEF::COFF::Relocation::ARM") + 0x0001 ##### [` ARM_ADDR32NB `]() enumerator ARM\_ADDR32NB = [ARM]( "LIEF::COFF::Relocation::ARM") + 0x0002 ##### [` ARM_BRANCH24 `]() enumerator ARM\_BRANCH24 = [ARM]( "LIEF::COFF::Relocation::ARM") + 0x0003 ##### [` ARM_BRANCH11 `]() enumerator ARM\_BRANCH11 = [ARM]( "LIEF::COFF::Relocation::ARM") + 0x0004 ##### [` ARM_TOKEN `]() enumerator ARM\_TOKEN = [ARM]( "LIEF::COFF::Relocation::ARM") + 0x0005 ##### [` ARM_BLX24 `]() enumerator ARM\_BLX24 = [ARM]( "LIEF::COFF::Relocation::ARM") + 0x0008 ##### [` ARM_BLX11 `]() enumerator ARM\_BLX11 = [ARM]( "LIEF::COFF::Relocation::ARM") + 0x0009 ##### [` ARM_REL32 `]() enumerator ARM\_REL32 = [ARM]( "LIEF::COFF::Relocation::ARM") + 0x000A ##### [` ARM_SECTION `]() enumerator ARM\_SECTION = [ARM]( "LIEF::COFF::Relocation::ARM") + 0x000E ##### [` ARM_SECREL `]() enumerator ARM\_SECREL = [ARM]( "LIEF::COFF::Relocation::ARM") + 0x000F ##### [` ARM_MOV32A `]() enumerator ARM\_MOV32A = [ARM]( "LIEF::COFF::Relocation::ARM") + 0x0010 ##### [` ARM_MOV32T `]() enumerator ARM\_MOV32T = [ARM]( "LIEF::COFF::Relocation::ARM") + 0x0011 ##### [` ARM_BRANCH20T `]() enumerator ARM\_BRANCH20T = [ARM]( "LIEF::COFF::Relocation::ARM") + 0x0012 ##### [` ARM_BRANCH24T `]() enumerator ARM\_BRANCH24T = [ARM]( "LIEF::COFF::Relocation::ARM") + 0x0014 ##### [` ARM_BLX23T `]() enumerator ARM\_BLX23T = [ARM]( "LIEF::COFF::Relocation::ARM") + 0x0015 ##### [` ARM_PAIR `]() enumerator ARM\_PAIR = [ARM]( "LIEF::COFF::Relocation::ARM") + 0x0016 ##### [` ARM64_ABSOLUTE `]() enumerator ARM64\_ABSOLUTE = [ARM64]( "LIEF::COFF::Relocation::ARM64") + 0x0000 ##### [` ARM64_ADDR32 `]() enumerator ARM64\_ADDR32 = [ARM64]( "LIEF::COFF::Relocation::ARM64") + 0x0001 ##### [` ARM64_ADDR32NB `]() enumerator ARM64\_ADDR32NB = [ARM64]( "LIEF::COFF::Relocation::ARM64") + 0x0002 ##### [` ARM64_BRANCH26 `]() enumerator ARM64\_BRANCH26 = [ARM64]( "LIEF::COFF::Relocation::ARM64") + 0x0003 ##### [` ARM64_PAGEBASE_REL21 `]() enumerator ARM64\_PAGEBASE\_REL21 = [ARM64]( "LIEF::COFF::Relocation::ARM64") + 0x0004 ##### [` ARM64_REL21 `]() enumerator ARM64\_REL21 = [ARM64]( "LIEF::COFF::Relocation::ARM64") + 0x0005 ##### [` ARM64_PAGEOFFSET_12A `]() enumerator ARM64\_PAGEOFFSET\_12A = [ARM64]( "LIEF::COFF::Relocation::ARM64") + 0x0006 ##### [` ARM64_PAGEOFFSET_12L `]() enumerator ARM64\_PAGEOFFSET\_12L = [ARM64]( "LIEF::COFF::Relocation::ARM64") + 0x0007 ##### [` ARM64_SECREL `]() enumerator ARM64\_SECREL = [ARM64]( "LIEF::COFF::Relocation::ARM64") + 0x0008 ##### [` ARM64_SECREL_LOW12A `]() enumerator ARM64\_SECREL\_LOW12A = [ARM64]( "LIEF::COFF::Relocation::ARM64") + 0x0009 ##### [` ARM64_SECREL_HIGH12A `]() enumerator ARM64\_SECREL\_HIGH12A = [ARM64]( "LIEF::COFF::Relocation::ARM64") + 0x000A ##### [` ARM64_SECREL_LOW12L `]() enumerator ARM64\_SECREL\_LOW12L = [ARM64]( "LIEF::COFF::Relocation::ARM64") + 0x000B ##### [` ARM64_TOKEN `]() enumerator ARM64\_TOKEN = [ARM64]( "LIEF::COFF::Relocation::ARM64") + 0x000C ##### [` ARM64_SECTION `]() enumerator ARM64\_SECTION = [ARM64]( "LIEF::COFF::Relocation::ARM64") + 0x000D ##### [` ARM64_ADDR64 `]() enumerator ARM64\_ADDR64 = [ARM64]( "LIEF::COFF::Relocation::ARM64") + 0x000E ##### [` ARM64_BRANCH19 `]() enumerator ARM64\_BRANCH19 = [ARM64]( "LIEF::COFF::Relocation::ARM64") + 0x000F ##### [` ARM64_BRANCH14 `]() enumerator ARM64\_BRANCH14 = [ARM64]( "LIEF::COFF::Relocation::ARM64") + 0x0010 ##### [` ARM64_REL32 `]() enumerator ARM64\_REL32 = [ARM64]( "LIEF::COFF::Relocation::ARM64") + 0x0011 ##### [` MIPS_ABSOLUTE `]() enumerator MIPS\_ABSOLUTE = [MIPS]( "LIEF::COFF::Relocation::MIPS") + 0x0000 ##### [` MIPS_REFHALF `]() enumerator MIPS\_REFHALF = [MIPS]( "LIEF::COFF::Relocation::MIPS") + 0x0001 ##### [` MIPS_REFWORD `]() enumerator MIPS\_REFWORD = [MIPS]( "LIEF::COFF::Relocation::MIPS") + 0x0002 ##### [` MIPS_JMPADDR `]() enumerator MIPS\_JMPADDR = [MIPS]( "LIEF::COFF::Relocation::MIPS") + 0x0003 ##### [` MIPS_REFHI `]() enumerator MIPS\_REFHI = [MIPS]( "LIEF::COFF::Relocation::MIPS") + 0x0004 ##### [` MIPS_REFLO `]() enumerator MIPS\_REFLO = [MIPS]( "LIEF::COFF::Relocation::MIPS") + 0x0005 ##### [` MIPS_GPREL `]() enumerator MIPS\_GPREL = [MIPS]( "LIEF::COFF::Relocation::MIPS") + 0x0006 ##### [` MIPS_LITERAL `]() enumerator MIPS\_LITERAL = [MIPS]( "LIEF::COFF::Relocation::MIPS") + 0x0007 ##### [` MIPS_SECTION `]() enumerator MIPS\_SECTION = [MIPS]( "LIEF::COFF::Relocation::MIPS") + 0x000A ##### [` MIPS_SECREL `]() enumerator MIPS\_SECREL = [MIPS]( "LIEF::COFF::Relocation::MIPS") + 0x000B ##### [` MIPS_SECRELLO `]() enumerator MIPS\_SECRELLO = [MIPS]( "LIEF::COFF::Relocation::MIPS") + 0x000C ##### [` MIPS_SECRELHI `]() enumerator MIPS\_SECRELHI = [MIPS]( "LIEF::COFF::Relocation::MIPS") + 0x000D ##### [` MIPS_JMPADDR16 `]() enumerator MIPS\_JMPADDR16 = [MIPS]( "LIEF::COFF::Relocation::MIPS") + 0x0010 ##### [` MIPS_REFWORDNB `]() enumerator MIPS\_REFWORDNB = [MIPS]( "LIEF::COFF::Relocation::MIPS") + 0x0022 ##### [` MIPS_PAIR `]() enumerator MIPS\_PAIR = [MIPS]( "LIEF::COFF::Relocation::MIPS") + 0x0025 Public Functions #### [` symbol_idx `]() inline uint32\_t symbol\_idx() const [Symbol]() index associated with this relocation. #### [` symbol `]() inline [Symbol]( "LIEF::COFF::Symbol") \*symbol() [Symbol]() associated with the relocation (if any). #### [` symbol `]() inline const [Symbol]( "LIEF::COFF::Symbol") \*symbol() const #### [` type `]() inline [TYPE]( "LIEF::COFF::Relocation::TYPE") type() const Type of the relocation. #### [` section `]() inline [Section]( "LIEF::COFF::Section") \*section() [Section]() in which the relocation takes place. #### [` section `]() inline const [Section]( "LIEF::COFF::Section") \*section() const #### [` to_string `]() std::string to\_string() const #### [` ~Relocation `]() ~Relocation() override = default Public Static Functions #### [` to_value `]() static inline uint16\_t to\_value([TYPE]( "LIEF::COFF::Relocation::TYPE") rtype) Convert a relocation enum type into a 16-bits value. #### [` from_value `]() static inline [TYPE]( "LIEF::COFF::Relocation::TYPE") from\_value(uint16\_t value, [Header]( "LIEF::COFF::Header")::[MACHINE\_TYPES]( "LIEF::COFF::Header::MACHINE_TYPES") arch) Create a relocation type from its raw value and the architecture. #### [` parse `]() static std::unique\_ptr<[Relocation]( "LIEF::COFF::Relocation")> parse([BinaryStream]( "LIEF::BinaryStream") &stream, [Header]( "LIEF::COFF::Header")::[MACHINE\_TYPES]( "LIEF::COFF::Header::MACHINE_TYPES") arch) Create a relocation from the given stream. Public Static Attributes #### [` I386 `]() static uint32\_t I386 = 1 << 17 #### [` X64 `]() static uint32\_t X64 = 1 << 18 #### [` ARM `]() static uint32\_t ARM = 1 << 19 #### [` ARM64 `]() static uint32\_t ARM64 = 1 << 20 #### [` MIPS `]() static uint32\_t MIPS = 1 << 21 Friends **friend class Parser** #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Relocation]( "LIEF::COFF::Relocation") &R) --- ## [String]() ### [` String `]() class String This class represents a string located in the COFF string table. Some of these strings can be used for section names that are greater than 8 bytes. See: [LIEF::PE::Section::coff\_string()]() Reference: [https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#coff-string-table]() Public Functions #### [` String `]() String() = default #### [` String `]() inline String(uint32\_t offset, std::string str) #### [` String `]() String(const [String]( "LIEF::COFF::String::String")&) = default #### [` operator= `]() [String]( "LIEF::COFF::String") &operator=(const [String]( "LIEF::COFF::String")&) = default #### [` String `]() String([String]( "LIEF::COFF::String::String")&&) = default #### [` operator= `]() [String]( "LIEF::COFF::String") &operator=([String]( "LIEF::COFF::String")&&) = default #### [` ~String `]() ~String() = default #### [` str `]() inline std::string\_view str() const The actual string. #### [` str `]() inline std::string &str() Mutable access to the underlying string storage. #### [` offset `]() inline uint32\_t offset() const The offset of this string the in the COFF string table. This offset includes the first 4-bytes that holds the table size. #### [` str `]() inline [String]( "LIEF::COFF::String") &str(std::string str) #### [` offset `]() inline [String]( "LIEF::COFF::String") &offset(uint32\_t value) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [String]( "LIEF::COFF::String") &str) --- ## [Symbol]() ### [` Symbol `]() class Symbol : public LIEF::[Symbol]( "LIEF::Symbol") This class represents a COFF symbol. Public Types #### [` STORAGE_CLASS `]() enum class STORAGE\_CLASS : int32\_t Reference: [https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#storage-class](). *Values:* ##### [` INVALID `]() enumerator INVALID = 0xFF ##### [` END_OF_FUNCTION `]() enumerator END\_OF\_FUNCTION = -1 Physical end of function. ##### [` NONE `]() enumerator NONE = 0 No symbol. ##### [` AUTOMATIC `]() enumerator AUTOMATIC = 1 Stack variable. ##### [` EXTERNAL `]() enumerator EXTERNAL = 2 External symbol. ##### [` STATIC `]() enumerator STATIC = 3 Static. ##### [` REGISTER `]() enumerator REGISTER = 4 Register variable. ##### [` EXTERNAL_DEF `]() enumerator EXTERNAL\_DEF = 5 External definition. ##### [` LABEL `]() enumerator LABEL = 6 Label. ##### [` UNDEFINED_LABEL `]() enumerator UNDEFINED\_LABEL = 7 Undefined label. ##### [` MEMBER_OF_STRUCT `]() enumerator MEMBER\_OF\_STRUCT = 8 Member of structure. ##### [` ARGUMENT `]() enumerator ARGUMENT = 9 [Function]() argument. ##### [` STRUCT_TAG `]() enumerator STRUCT\_TAG = 10 Structure tag. ##### [` MEMBER_OF_UNION `]() enumerator MEMBER\_OF\_UNION = 11 Member of union. ##### [` UNION_TAG `]() enumerator UNION\_TAG = 12 Union tag. ##### [` TYPE_DEFINITION `]() enumerator TYPE\_DEFINITION = 13 Type definition. ##### [` UNDEFINED_STATIC `]() enumerator UNDEFINED\_STATIC = 14 Undefined static. ##### [` ENUM_TAG `]() enumerator ENUM\_TAG = 15 Enumeration tag. ##### [` MEMBER_OF_ENUM `]() enumerator MEMBER\_OF\_ENUM = 16 Member of enumeration. ##### [` REGISTER_PARAM `]() enumerator REGISTER\_PARAM = 17 Register parameter. ##### [` BIT_FIELD `]() enumerator BIT\_FIELD = 18 Bit field. ##### [` BLOCK `]() enumerator BLOCK = 100 ##### [` FUNCTION `]() enumerator FUNCTION = 101 ##### [` END_OF_STRUCT `]() enumerator END\_OF\_STRUCT = 102 End of structure. ##### [` FILE `]() enumerator FILE = 103 File name. ##### [` SECTION `]() enumerator SECTION = 104 ##### [` WEAK_EXTERNAL `]() enumerator WEAK\_EXTERNAL = 105 Duplicate tag. ##### [` CLR_TOKEN `]() enumerator CLR\_TOKEN = 107 #### [` BASE_TYPE `]() enum class BASE\_TYPE : uint32\_t *Values:* ##### [` TY_NULL `]() enumerator TY\_NULL = 0 No type information or unknown base type. ##### [` TY_VOID `]() enumerator TY\_VOID = 1 Used with void pointers and functions. ##### [` TY_CHAR `]() enumerator TY\_CHAR = 2 A character (signed byte). ##### [` TY_SHORT `]() enumerator TY\_SHORT = 3 A 2-byte signed integer. ##### [` TY_INT `]() enumerator TY\_INT = 4 A natural integer type on the target. ##### [` TY_LONG `]() enumerator TY\_LONG = 5 A 4-byte signed integer. ##### [` TY_FLOAT `]() enumerator TY\_FLOAT = 6 A 4-byte floating-point number. ##### [` TY_DOUBLE `]() enumerator TY\_DOUBLE = 7 An 8-byte floating-point number. ##### [` TY_STRUCT `]() enumerator TY\_STRUCT = 8 A structure. ##### [` TY_UNION `]() enumerator TY\_UNION = 9 A union. ##### [` TY_ENUM `]() enumerator TY\_ENUM = 10 An enumerated type. ##### [` TY_MOE `]() enumerator TY\_MOE = 11 A member of enumeration (a specific value). ##### [` TY_BYTE `]() enumerator TY\_BYTE = 12 A byte; unsigned 1-byte integer. ##### [` TY_WORD `]() enumerator TY\_WORD = 13 A word; unsigned 2-byte integer. ##### [` TY_UINT `]() enumerator TY\_UINT = 14 An unsigned integer of natural size. ##### [` TY_DWORD `]() enumerator TY\_DWORD = 15 An unsigned 4-byte integer. #### [` COMPLEX_TYPE `]() enum class COMPLEX\_TYPE : uint32\_t *Values:* ##### [` TY_NULL `]() enumerator TY\_NULL = 0 No complex type; simple scalar variable. ##### [` TY_POINTER `]() enumerator TY\_POINTER = 1 A pointer to base type. ##### [` TY_FUNCTION `]() enumerator TY\_FUNCTION = 2 A function that returns a base type. ##### [` TY_ARRAY `]() enumerator TY\_ARRAY = 3 An array of base type. #### [` auxiliary_symbols_t `]() using auxiliary\_symbols\_t = std::vector<std::unique\_ptr<[AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol")>> #### [` it_auxiliary_symbols_t `]() using it\_auxiliary\_symbols\_t = [ref\_iterator]( "LIEF::ref_iterator")<[auxiliary\_symbols\_t]( "LIEF::COFF::Symbol::auxiliary_symbols_t")&, [AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol")\*> #### [` it_const_auxiliary_symbols_t `]() using it\_const\_auxiliary\_symbols\_t = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [auxiliary\_symbols\_t]( "LIEF::COFF::Symbol::auxiliary_symbols_t")&, [AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol")\*> Public Functions #### [` Symbol `]() Symbol() #### [` Symbol `]() Symbol(const [Symbol]( "LIEF::COFF::Symbol::Symbol")&) #### [` operator= `]() [Symbol]( "LIEF::COFF::Symbol") &operator=(const [Symbol]( "LIEF::COFF::Symbol")&) #### [` Symbol `]() Symbol([Symbol]( "LIEF::COFF::Symbol::Symbol")&&) noexcept #### [` operator= `]() [Symbol]( "LIEF::COFF::Symbol") &operator=([Symbol]( "LIEF::COFF::Symbol")&&) noexcept #### [` type `]() inline uint16\_t type() const The symbol type. The first byte represents the base type (see: [base\_type()]()) while the upper byte represents the complex type, if any (see: [complex\_type()]()). #### [` storage_class `]() inline [STORAGE\_CLASS]( "LIEF::COFF::Symbol::STORAGE_CLASS") storage\_class() const Storage class of the symbol which indicates what kind of definition a symbol represents. #### [` base_type `]() inline [BASE\_TYPE]( "LIEF::COFF::Symbol::BASE_TYPE") base\_type() const The simple (base) data type. #### [` complex_type `]() inline [COMPLEX\_TYPE]( "LIEF::COFF::Symbol::COMPLEX_TYPE") complex\_type() const The complex type (if any). #### [` section_idx `]() inline int16\_t section\_idx() const The signed integer that identifies the section, using a one-based index into the section table. Some values have special meaning: - 0: The symbol record is not yet assigned a section. A value of zero indicates that a reference to an external symbol is defined elsewhere. A value of non-zero is a common symbol with a size that is specified by the value. - -1: The symbol has an absolute (non-relocatable) value and is not an address. - -2: The symbol provides general type or debugging information but does not correspond to a section. Microsoft tools use this setting along with `.file` records #### [` section `]() inline [Section]( "LIEF::COFF::Section") \*section() [Section]() associated with this symbol (if any). #### [` section `]() inline const [Section]( "LIEF::COFF::Section") \*section() const #### [` is_external `]() inline bool is\_external() const #### [` is_weak_external `]() inline bool is\_weak\_external() const #### [` is_absolute `]() inline bool is\_absolute() const #### [` is_undefined `]() inline bool is\_undefined() const #### [` is_function_line_info `]() inline bool is\_function\_line\_info() const #### [` is_function `]() inline bool is\_function() const #### [` is_file_record `]() inline bool is\_file\_record() const #### [` auxiliary_symbols `]() inline [it\_auxiliary\_symbols\_t]( "LIEF::COFF::Symbol::it_auxiliary_symbols_t") auxiliary\_symbols() Auxiliary symbols associated with this symbol. #### [` auxiliary_symbols `]() inline [it\_const\_auxiliary\_symbols\_t]( "LIEF::COFF::Symbol::it_const_auxiliary_symbols_t") auxiliary\_symbols() const #### [` name `]() virtual std::string\_view name() const override Name of the symbol. If the symbol does not use a short name, it returns the string pointed by the COFF string offset. #### [` name `]() virtual std::string &name() override #### [` coff_name `]() inline const [String]( "LIEF::COFF::String") \*coff\_name() const COFF string used to represent the (long) symbol name. #### [` coff_name `]() inline [String]( "LIEF::COFF::String") \*coff\_name() #### [` demangled_name `]() std::string demangled\_name() const Demangled representation of the symbol or an empty string if it can’t be demangled. #### [` type `]() inline [Symbol]( "LIEF::COFF::Symbol") &type(uint16\_t ty) #### [` storage_class `]() inline [Symbol]( "LIEF::COFF::Symbol") &storage\_class(uint8\_t value) #### [` section_idx `]() inline [Symbol]( "LIEF::COFF::Symbol") &section\_idx(int16\_t idx) #### [` add_aux `]() [AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol") &add\_aux(std::unique\_ptr<[AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol")> sym) Add a new auxiliary record. #### [` to_string `]() std::string to\_string() const #### [` ~Symbol `]() ~Symbol() override Public Static Functions #### [` parse `]() static std::unique\_ptr<[Symbol]( "LIEF::COFF::Symbol")> parse([parsing\_context\_t]( "LIEF::COFF::Symbol::parsing_context_t") &ctx, [BinaryStream]( "LIEF::BinaryStream") &stream, size\_t \*idx) #### [` is_reversed_sec_idx `]() static inline bool is\_reversed\_sec\_idx(int16\_t idx) Check if the given section index is a reserved value. Public Static Attributes #### [` SYM_SEC_IDX_DEBUG `]() static auto SYM\_SEC\_IDX\_DEBUG = -2 The symbol provides general type or debugging information but does not correspond to a section. Microsoft tools use this setting along with `.file` records. #### [` SYM_SEC_IDX_ABS `]() static auto SYM\_SEC\_IDX\_ABS = -1 The symbol has an absolute (non-relocatable) value and is not an address. #### [` SYM_SEC_IDX_UNDEF `]() static auto SYM\_SEC\_IDX\_UNDEF = 0 The symbol record is not yet assigned a section. A value of zero indicates that a reference to an external symbol is defined elsewhere. A value of non-zero is a common symbol with a size that is specified by the value. #### [` SYM_COMPLEX_TYPE_SHIFT `]() static auto SYM\_COMPLEX\_TYPE\_SHIFT = 4 Friends **friend class Parser** #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Symbol]( "LIEF::COFF::Symbol") &entry) #### [` parsing_context_t `]() struct parsing\_context\_t Public Members ##### [` find_string `]() std::function<[String]( "LIEF::COFF::String")\*(uint32\_t)> find\_string ##### [` is_bigobj `]() bool is\_bigobj --- ## [AuxiliarySymbol]() ### [` AuxiliarySymbol `]() class AuxiliarySymbol Class that represents an auxiliary symbol. An auxiliary symbol has the same size as a regular LIEF::PE::Symbol (18 bytes) but its content depends on the parent symbol. Subclassed by [LIEF::COFF::AuxiliaryCLRToken](), [LIEF::COFF::AuxiliaryFile](), [LIEF::COFF::AuxiliaryFunctionDefinition](), [LIEF::COFF::AuxiliarySectionDefinition](), [LIEF::COFF::AuxiliaryWeakExternal](), [LIEF::COFF::AuxiliarybfAndefSymbol]() Public Types #### [` TYPE `]() enum class TYPE Type discriminator for the subclasses. *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` CLR_TOKEN `]() enumerator CLR\_TOKEN ##### [` FUNC_DEF `]() enumerator FUNC\_DEF Auxiliary Format 1 from the PE-COFF documentation. ##### [` BF_AND_EF `]() enumerator BF\_AND\_EF Auxiliary Format 2: .bf and .ef Symbols from the PE-COFF documentation. ##### [` WEAK_EXTERNAL `]() enumerator WEAK\_EXTERNAL Auxiliary Format 3: Weak Externals from the PE-COFF documentation. ##### [` FILE `]() enumerator FILE Auxiliary Format 4: Files from the PE-COFF documentation. ##### [` SEC_DEF `]() enumerator SEC\_DEF Auxiliary Format 5: [Section]() Definitions from the PE-COFF documentation. Public Functions #### [` AuxiliarySymbol `]() AuxiliarySymbol() = default #### [` AuxiliarySymbol `]() inline AuxiliarySymbol(std::vector<uint8\_t> payload) #### [` AuxiliarySymbol `]() AuxiliarySymbol(const [AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol::AuxiliarySymbol")&) = default #### [` operator= `]() [AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol") &operator=(const [AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol")&) = default #### [` AuxiliarySymbol `]() AuxiliarySymbol([AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol::AuxiliarySymbol")&&) = default #### [` operator= `]() [AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol") &operator=([AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol")> clone() const #### [` AuxiliarySymbol `]() inline AuxiliarySymbol([TYPE]( "LIEF::COFF::AuxiliarySymbol::TYPE") ty) #### [` type `]() inline [TYPE]( "LIEF::COFF::AuxiliarySymbol::TYPE") type() const #### [` payload `]() inline span<const uint8\_t> payload() const For unknown type **only**, return the raw representation of this symbol. #### [` payload `]() inline span<uint8\_t> payload() #### [` to_string `]() virtual std::string to\_string() const #### [` ~AuxiliarySymbol `]() virtual ~AuxiliarySymbol() = default #### [` Tas `]() template<class T> inline const [T]( "LIEF::COFF::AuxiliarySymbol::as::T") \*as() const Helper to **downcast** an [AuxiliarySymbol]() into a concrete implementation. #### [` Tas `]() template<class T> inline [T]( "LIEF::COFF::AuxiliarySymbol::as::T") \*as() Public Static Functions #### [` parse `]() static std::unique\_ptr<[AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol")> parse([Symbol]( "LIEF::COFF::Symbol") &sym, std::vector<uint8\_t> payload) #### [` get_aux_type `]() static [TYPE]( "LIEF::COFF::AuxiliarySymbol::TYPE") get\_aux\_type(const [Symbol]( "LIEF::COFF::Symbol") &sym) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol") &aux) --- ## [AuxiliaryCLRToken]() ### [` AuxiliaryCLRToken `]() class AuxiliaryCLRToken : public LIEF::COFF::[AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol") Auxiliary symbol associated with the `CLR_TOKEN` storage class. Public Functions #### [` AuxiliaryCLRToken `]() inline AuxiliaryCLRToken() #### [` AuxiliaryCLRToken `]() inline AuxiliaryCLRToken(uint8\_t aux\_type, uint8\_t reserved, uint32\_t symbol\_idx, std::vector<uint8\_t> rgb\_reserved) #### [` AuxiliaryCLRToken `]() AuxiliaryCLRToken(const [AuxiliaryCLRToken]( "LIEF::COFF::AuxiliaryCLRToken::AuxiliaryCLRToken")&) = default #### [` operator= `]() [AuxiliaryCLRToken]( "LIEF::COFF::AuxiliaryCLRToken") &operator=(const [AuxiliaryCLRToken]( "LIEF::COFF::AuxiliaryCLRToken")&) = default #### [` AuxiliaryCLRToken `]() AuxiliaryCLRToken([AuxiliaryCLRToken]( "LIEF::COFF::AuxiliaryCLRToken::AuxiliaryCLRToken")&&) = default #### [` operator= `]() [AuxiliaryCLRToken]( "LIEF::COFF::AuxiliaryCLRToken") &operator=([AuxiliaryCLRToken]( "LIEF::COFF::AuxiliaryCLRToken")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol")> clone() const override #### [` aux_type `]() inline uint8\_t aux\_type() const `IMAGE_AUX_SYMBOL_TYPE` which should be `IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF` (1) #### [` reserved `]() inline uint8\_t reserved() const Reserved value (should be 0). #### [` symbol_idx `]() inline uint32\_t symbol\_idx() const Index in the symbol table. #### [` symbol `]() inline const [Symbol]( "LIEF::COFF::Symbol") \*symbol() const [Symbol]() referenced by [symbol\_idx()]() (if resolved). #### [` symbol `]() inline [Symbol]( "LIEF::COFF::Symbol") \*symbol() #### [` rgb_reserved `]() inline span<const uint8\_t> rgb\_reserved() const Reserved (padding) values. Should be 0. #### [` to_string `]() virtual std::string to\_string() const override #### [` ~AuxiliaryCLRToken `]() ~AuxiliaryCLRToken() override = default Public Static Functions #### [` parse `]() static std::unique\_ptr<[AuxiliaryCLRToken]( "LIEF::COFF::AuxiliaryCLRToken")> parse(const std::vector<uint8\_t> &payload) #### [` classof `]() static inline bool classof(const [AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol") \*sym) Friends **friend class Parser** --- ## [AuxiliaryFunctionDefinition]() ### [` AuxiliaryFunctionDefinition `]() class AuxiliaryFunctionDefinition : public LIEF::COFF::[AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol") This auxiliary symbols marks the beginning of a function definition. Reference: [https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#auxiliary-format-1-function-definitions]() Public Functions #### [` AuxiliaryFunctionDefinition `]() inline AuxiliaryFunctionDefinition() #### [` AuxiliaryFunctionDefinition `]() inline AuxiliaryFunctionDefinition(uint32\_t tagidx, uint32\_t totalsz, uint32\_t ptr\_line, uint32\_t ptr\_next\_func, uint16\_t padding) #### [` AuxiliaryFunctionDefinition `]() AuxiliaryFunctionDefinition(const [AuxiliaryFunctionDefinition]( "LIEF::COFF::AuxiliaryFunctionDefinition::AuxiliaryFunctionDefinition")&) = default #### [` operator= `]() [AuxiliaryFunctionDefinition]( "LIEF::COFF::AuxiliaryFunctionDefinition") &operator=(const [AuxiliaryFunctionDefinition]( "LIEF::COFF::AuxiliaryFunctionDefinition")&) = default #### [` AuxiliaryFunctionDefinition `]() AuxiliaryFunctionDefinition([AuxiliaryFunctionDefinition]( "LIEF::COFF::AuxiliaryFunctionDefinition::AuxiliaryFunctionDefinition")&&) = default #### [` operator= `]() [AuxiliaryFunctionDefinition]( "LIEF::COFF::AuxiliaryFunctionDefinition") &operator=([AuxiliaryFunctionDefinition]( "LIEF::COFF::AuxiliaryFunctionDefinition")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol")> clone() const override #### [` tag_index `]() inline uint32\_t tag\_index() const The symbol-table index of the corresponding `.bf` (begin function) symbol record. #### [` total_size `]() inline uint32\_t total\_size() const The size of the executable code for the function itself. If the function is in its own section, the `SizeOfRawData` in the section header is greater or equal to this field, depending on alignment considerations. #### [` ptr_to_line_number `]() inline uint32\_t ptr\_to\_line\_number() const The file offset of the first COFF line-number entry for the function, or zero if none exists (deprecated). #### [` ptr_to_next_func `]() inline uint32\_t ptr\_to\_next\_func() const The symbol-table index of the record for the next function. If the function is the last in the symbol table, this field is set to zero. #### [` padding `]() inline uint16\_t padding() const Padding value (should be 0). #### [` to_string `]() virtual std::string to\_string() const override #### [` ~AuxiliaryFunctionDefinition `]() ~AuxiliaryFunctionDefinition() override = default Public Static Functions #### [` parse `]() static std::unique\_ptr<[AuxiliaryFunctionDefinition]( "LIEF::COFF::AuxiliaryFunctionDefinition")> parse(const std::vector<uint8\_t> &payload) #### [` classof `]() static inline bool classof(const [AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol") \*sym) --- ## [AuxiliaryWeakExternal]() ### [` AuxiliaryWeakExternal `]() class AuxiliaryWeakExternal : public LIEF::COFF::[AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol") “Weak externals” are a mechanism for object files that allows flexibility at link time. A module can contain an unresolved external symbol (`sym1`), but it can also include an auxiliary record that indicates that if `sym1` is not present at link time, another external symbol (`sym2`) is used to resolve references instead. If a definition of `sym1` is linked, then an external reference to the symbol is resolved normally. If a definition of `sym1` is not linked, then all references to the weak external for `sym1` refer to `sym2` instead. The external symbol, `sym2`, must always be linked; typically, it is defined in the module that contains the weak reference to `sym1`. Reference: [https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#auxiliary-format-3-weak-externals]() Public Types #### [` CHARACTERISTICS `]() enum class CHARACTERISTICS : uint32\_t *Values:* ##### [` SEARCH_NOLIBRARY `]() enumerator SEARCH\_NOLIBRARY = 1 No library search for `sym1` should be performed. ##### [` SEARCH_LIBRARY `]() enumerator SEARCH\_LIBRARY = 2 A library search for `sym1` should be performed. ##### [` SEARCH_ALIAS `]() enumerator SEARCH\_ALIAS = 3 `sym1` is an alias for sym2 ##### [` ANTI_DEPENDENCY `]() enumerator ANTI\_DEPENDENCY = 4 Public Functions #### [` AuxiliaryWeakExternal `]() inline AuxiliaryWeakExternal() #### [` AuxiliaryWeakExternal `]() inline AuxiliaryWeakExternal(uint32\_t sym\_idx, uint32\_t characteristics, std::vector<uint8\_t> padding) #### [` AuxiliaryWeakExternal `]() AuxiliaryWeakExternal(const [AuxiliaryWeakExternal]( "LIEF::COFF::AuxiliaryWeakExternal::AuxiliaryWeakExternal")&) = default #### [` operator= `]() [AuxiliaryWeakExternal]( "LIEF::COFF::AuxiliaryWeakExternal") &operator=(const [AuxiliaryWeakExternal]( "LIEF::COFF::AuxiliaryWeakExternal")&) = default #### [` AuxiliaryWeakExternal `]() AuxiliaryWeakExternal([AuxiliaryWeakExternal]( "LIEF::COFF::AuxiliaryWeakExternal::AuxiliaryWeakExternal")&&) = default #### [` operator= `]() [AuxiliaryWeakExternal]( "LIEF::COFF::AuxiliaryWeakExternal") &operator=([AuxiliaryWeakExternal]( "LIEF::COFF::AuxiliaryWeakExternal")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol")> clone() const override #### [` sym_idx `]() inline uint32\_t sym\_idx() const The symbol-table index of `sym2`, the symbol to be linked if `sym1` is not found. #### [` characteristics `]() inline [CHARACTERISTICS]( "LIEF::COFF::AuxiliaryWeakExternal::CHARACTERISTICS") characteristics() const #### [` padding `]() inline span<const uint8\_t> padding() const #### [` to_string `]() virtual std::string to\_string() const override #### [` ~AuxiliaryWeakExternal `]() ~AuxiliaryWeakExternal() override = default Public Static Functions #### [` parse `]() static std::unique\_ptr<[AuxiliaryWeakExternal]( "LIEF::COFF::AuxiliaryWeakExternal")> parse(const std::vector<uint8\_t> &payload) #### [` classof `]() static inline bool classof(const [AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol") \*sym) --- ## [AuxiliarybfAndefSymbol]() ### [` AuxiliarybfAndefSymbol `]() class AuxiliarybfAndefSymbol : public LIEF::COFF::[AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol") Public Functions #### [` AuxiliarybfAndefSymbol `]() inline AuxiliarybfAndefSymbol() #### [` AuxiliarybfAndefSymbol `]() AuxiliarybfAndefSymbol(const [AuxiliarybfAndefSymbol]( "LIEF::COFF::AuxiliarybfAndefSymbol::AuxiliarybfAndefSymbol")&) = default #### [` operator= `]() [AuxiliarybfAndefSymbol]( "LIEF::COFF::AuxiliarybfAndefSymbol") &operator=(const [AuxiliarybfAndefSymbol]( "LIEF::COFF::AuxiliarybfAndefSymbol")&) = default #### [` AuxiliarybfAndefSymbol `]() AuxiliarybfAndefSymbol([AuxiliarybfAndefSymbol]( "LIEF::COFF::AuxiliarybfAndefSymbol::AuxiliarybfAndefSymbol")&&) = default #### [` operator= `]() [AuxiliarybfAndefSymbol]( "LIEF::COFF::AuxiliarybfAndefSymbol") &operator=([AuxiliarybfAndefSymbol]( "LIEF::COFF::AuxiliarybfAndefSymbol")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol")> clone() const override #### [` to_string `]() inline virtual std::string to\_string() const override #### [` ~AuxiliarybfAndefSymbol `]() ~AuxiliarybfAndefSymbol() override = default Public Static Functions #### [` parse `]() static std::unique\_ptr<[AuxiliarybfAndefSymbol]( "LIEF::COFF::AuxiliarybfAndefSymbol")> parse([Symbol]( "LIEF::COFF::Symbol") &sym, const std::vector<uint8\_t> &payload) #### [` classof `]() static inline bool classof(const [AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol") \*sym) --- ## [AuxiliarySectionDefinition]() ### [` AuxiliarySectionDefinition `]() class AuxiliarySectionDefinition : public LIEF::COFF::[AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol") This auxiliary symbol exposes information about the associated section. It **duplicates** some information that are provided in the section header Public Types #### [` COMDAT_SELECTION `]() enum class COMDAT\_SELECTION : uint8\_t Values for the [AuxiliarySectionDefinition::selection]() attribute. See: [https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#comdat-sections-object-only]() *Values:* ##### [` NONE `]() enumerator NONE = 0 ##### [` NODUPLICATES `]() enumerator NODUPLICATES = 1 If this symbol is already defined, the linker issues a `multiply defined symbol` error. ##### [` ANY `]() enumerator ANY Any section that defines the same COMDAT symbol can be linked; the rest are removed. ##### [` SAME_SIZE `]() enumerator SAME\_SIZE The linker chooses an arbitrary section among the definitions for this symbol. If all definitions are not the same size, a `multiply defined symbol` error is issued. ##### [` EXACT_MATCH `]() enumerator EXACT\_MATCH The linker chooses an arbitrary section among the definitions for this symbol. If all definitions do not match exactly, a `multiply defined symbol` error is issued. ##### [` ASSOCIATIVE `]() enumerator ASSOCIATIVE The section is linked if a certain other COMDAT section is linked. This other section is indicated by the Number field of the auxiliary symbol record for the section definition. This setting is useful for definitions that have components in multiple sections (for example, code in one and data in another), but where all must be linked or discarded as a set. The other section this section is associated with must be a COMDAT section, which can be another associative COMDAT section. An associative COMDAT section’s section association chain can’t form a loop. The section association chain must eventually come to a COMDAT section that doesn’t have [COMDAT\_SELECTION::ASSOCIATIVE]() set. ##### [` LARGEST `]() enumerator LARGEST The linker chooses the largest definition from among all the definitions for this symbol. If multiple definitions have this size, the choice between them is arbitrary. Public Functions #### [` AuxiliarySectionDefinition `]() inline AuxiliarySectionDefinition() #### [` AuxiliarySectionDefinition `]() inline AuxiliarySectionDefinition(uint32\_t length, uint16\_t nb\_relocs, uint16\_t nb\_lines, uint32\_t checksum, uint32\_t sec\_idx, uint8\_t selection, uint8\_t reserved) #### [` AuxiliarySectionDefinition `]() AuxiliarySectionDefinition(const [AuxiliarySectionDefinition]( "LIEF::COFF::AuxiliarySectionDefinition::AuxiliarySectionDefinition")&) = default #### [` operator= `]() [AuxiliarySectionDefinition]( "LIEF::COFF::AuxiliarySectionDefinition") &operator=(const [AuxiliarySectionDefinition]( "LIEF::COFF::AuxiliarySectionDefinition")&) = default #### [` AuxiliarySectionDefinition `]() AuxiliarySectionDefinition([AuxiliarySectionDefinition]( "LIEF::COFF::AuxiliarySectionDefinition::AuxiliarySectionDefinition")&&) = default #### [` operator= `]() [AuxiliarySectionDefinition]( "LIEF::COFF::AuxiliarySectionDefinition") &operator=([AuxiliarySectionDefinition]( "LIEF::COFF::AuxiliarySectionDefinition")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol")> clone() const override #### [` length `]() inline uint32\_t length() const The size of section data. The same as `SizeOfRawData` in the section header. #### [` nb_relocs `]() inline uint16\_t nb\_relocs() const The number of relocation entries for the section. #### [` nb_line_numbers `]() inline uint16\_t nb\_line\_numbers() const The number of line-number entries for the section. #### [` checksum `]() inline uint32\_t checksum() const The checksum for communal data. It is applicable if the `IMAGE_SCN_LNK_COMDAT` flag is set in the section header. #### [` section_idx `]() inline uint32\_t section\_idx() const One-based index into the section table for the associated section. This is used when the COMDAT selection setting is 5. #### [` selection `]() inline [COMDAT\_SELECTION]( "LIEF::COFF::AuxiliarySectionDefinition::COMDAT_SELECTION") selection() const The COMDAT selection number. This is applicable if the section is a COMDAT section. #### [` reserved `]() inline uint8\_t reserved() const Reserved value (should be 0). #### [` to_string `]() virtual std::string to\_string() const override #### [` ~AuxiliarySectionDefinition `]() ~AuxiliarySectionDefinition() override = default Public Static Functions #### [` parse `]() static std::unique\_ptr<[AuxiliarySectionDefinition]( "LIEF::COFF::AuxiliarySectionDefinition")> parse(const std::vector<uint8\_t> &payload) #### [` classof `]() static inline bool classof(const [AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol") \*sym) --- ## [AuxiliaryFile]() ### [` AuxiliaryFile `]() class AuxiliaryFile : public LIEF::COFF::[AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol") This auxiliary symbol represents a filename (auxiliary format 4). The [Symbol::name]() itself should start with `.file`, and this auxiliary record gives the name of a source-code file. Reference: [https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#auxiliary-format-4-files]() Public Functions #### [` AuxiliaryFile `]() inline AuxiliaryFile() #### [` AuxiliaryFile `]() inline AuxiliaryFile(std::string file) #### [` AuxiliaryFile `]() AuxiliaryFile(const [AuxiliaryFile]( "LIEF::COFF::AuxiliaryFile::AuxiliaryFile")&) = default #### [` operator= `]() [AuxiliaryFile]( "LIEF::COFF::AuxiliaryFile") &operator=(const [AuxiliaryFile]( "LIEF::COFF::AuxiliaryFile")&) = default #### [` AuxiliaryFile `]() AuxiliaryFile([AuxiliaryFile]( "LIEF::COFF::AuxiliaryFile::AuxiliaryFile")&&) = default #### [` operator= `]() [AuxiliaryFile]( "LIEF::COFF::AuxiliaryFile") &operator=([AuxiliaryFile]( "LIEF::COFF::AuxiliaryFile")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol")> clone() const override #### [` filename `]() inline std::string\_view filename() const The associated filename. #### [` filename `]() inline [AuxiliaryFile]( "LIEF::COFF::AuxiliaryFile") &filename(std::string file) #### [` to_string `]() inline virtual std::string to\_string() const override #### [` ~AuxiliaryFile `]() ~AuxiliaryFile() override = default Public Static Functions #### [` parse `]() static std::unique\_ptr<[AuxiliaryFile]( "LIEF::COFF::AuxiliaryFile")> parse(const std::vector<uint8\_t> &payload) #### [` classof `]() static inline bool classof(const [AuxiliarySymbol]( "LIEF::COFF::AuxiliarySymbol") \*sym) --- ## [Utilities]() ### [` LIEF::COFF::get_kind `]() [Header]( "LIEF::COFF::Header")::[KIND]( "LIEF::COFF::Header::KIND") LIEF::COFF::get\_kind([BinaryStream]( "LIEF::BinaryStream") &stream) This function determines if the given stream wraps a COFF binary and if so, whether it’s a regular or bigobj COFF. ### [` LIEF::COFF::is_coff `]() inline bool LIEF::COFF::is\_coff([BinaryStream]( "LIEF::BinaryStream") &stream) Check if the given stream wraps a COFF file. ### [` LIEF::COFF::is_coff `]() bool LIEF::COFF::is\_coff(std::string\_view file) Check if the `file` is a COFF. ### [` LIEF::COFF::is_coff `]() inline bool LIEF::COFF::is\_coff(const std::vector<uint8\_t> &buffer) Check if the given buffer points to a COFF file. ### [` LIEF::COFF::is_coff `]() inline bool LIEF::COFF::is\_coff(const uint8\_t \*buffer, size\_t size) Check if the given buffer points to a COFF file. ### [` LIEF::COFF::is_bigobj `]() inline bool LIEF::COFF::is\_bigobj([BinaryStream]( "LIEF::BinaryStream") &stream) Check if the COFF file wrapped by the given stream is a `bigobj`. ### [` LIEF::COFF::is_regular `]() inline bool LIEF::COFF::is\_regular([BinaryStream]( "LIEF::BinaryStream") &stream) Check if the COFF file wrapped by the given stream is regular (i.e. not a bigobj). --- documentID: "81188adcf5169a4cfb22825c82f8c2767f17a43f79506a601158d257417bd56b" docname: "formats/coff/index" title: "COFF - LIEF Documentation" description: "COFF object files can be parsed using lief.COFF.parse() or the generic lief.parse() function:" canonical: "https://lief.re/doc/latest/formats/coff/index.html" markdownURL: "https://lief.re/doc/latest/formats/coff/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "0f56fe4e0bda30344f2c5a1d1bc790a28258f13c9178756de5e1714de77c7636" --- # [COFF]() API - [C++]() - [Python]() - [Rust]() ## [Introduction]() COFF object files can be parsed using `lief.COFF.parse()` ( [`lief::coff::Binary::parse`]() ; [`lief.COFF.parse()`]() ; [`LIEF::COFF::Parser::parse()`]() ) or the generic `lief.parse()` ( [`lief::Binary::parse`]() ; [`lief::Binary::from`]() ; [`lief.parse()`]() ) function: **Python** ```python import lief # Using a filepath as a string coff: lief.COFF.Binary | None = lief.COFF.parse("hello.obj") # Using a Path from pathlib coff: lief.COFF.Binary | None = lief.COFF.parse( pathlib.Path(r"C:\Users\romain\test.obj") ) # Using an io object with open("/tmp/test.ob", "rb") as f: coff: lief.COFF.Binary | None = lief.COFF.parse(f) ``` **C++** ```cpp #include // Using a file path as a std::string std::unique_ptr coff = LIEF::COFF::Parser::parse("test.obj"); ``` **Rust** ```rust let coff: lief::coff::Binary = lief::coff::Binary::parse("test.obj").unwrap(); ``` These functions return a `lief.COFF.Binary` ( [`lief::coff::Binary`]() ; [`lief.COFF.Binary`]() ; [`LIEF::COFF::Binary`]() ) instance that exposes the main API for processing and accessing COFF information: **Python** ```python coff: lief.COFF.Binary for section in coff.sections: print(section.name) ``` **C++** ```cpp std::unique_ptr coff; for (const LIEF::COFF::Section& section : coff->sections()) { std::cout << section.name() << '\n'; } ``` **Rust** ```rust let coff: &lief::coff::Binary = some_coff; for section in coff.sections() { println!("{section:?} {section}"); } ``` ## [Disassembler]() The `lief.COFF.Binary` ( [`lief::coff::Binary`]() ; [`lief.COFF.Binary`]() ; [`LIEF::COFF::Binary`]() ) object exposes a disassembler API for iterating over the instructions of a COFF binary. One can disassemble a function using `lief.COFF.Binary.disassemble()` ( [`lief::coff::Binary::disassemble_slice`]() ; [`lief::coff::Binary::disassemble_function`]() ; [`lief::coff::Binary::disassemble_symbol`]() ; [`lief.COFF.Binary.disassemble()`]() ; [`lief.COFF.Binary.disassemble_from_bytes()`]() ; [`LIEF::COFF::Binary::disassemble()`]() ): **Python** ```python coff: lief.COFF.Binary for inst in coff.disassemble("?foo@@YAHHH@Z"): print(inst) # Using demangled representation for inst in coff.disassemble("int __cdecl bar(int, int)"): print(inst) ``` **C++** ```cpp std::unique_ptr coff; for (const auto& inst : coff->disassemble("?foo@@YAHHH@Z")) { std::cout << inst.to_string() << '\n'; } // Using demangled representation for (const auto& inst : coff->disassemble("int __cdecl bar(int, int)")) { std::cout << inst.to_string() << '\n'; } ``` **Rust** ```rust let coff: &lief::coff::Binary = some_coff; for inst in coff.disassemble_function("?foo@@YAHHH@Z") { println!("{}", inst); } // Using demangled representation for inst in coff.disassemble_function("int __cdecl bar(int, int)") { println!("{}", inst); } ``` For more details about the disassembler and the `lief.assembly.Instruction` ( [`lief::assembly::Instructions`]() ; [`LIEF::assembly::Instruction`]() ; [`lief.assembly.Instruction`]() ) API, please refer to the [Disassembler section](). --- documentID: "dd20c0d10e2c8801b8f9496039ba559719eafdefc0e4e58238824986442b7370" docname: "formats/coff/python" title: "COFF Python API - LIEF Documentation" description: "COFF Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/coff/python.html" markdownURL: "https://lief.re/doc/latest/formats/coff/python.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "465320e5077eb1babdf911625138458f793e33176df4d133cbc5cab3c2b9f435" --- # [Python]() ## [Parser]() ### [` lief.COFF.parse `]() lief.COFF.parse(*obj: str | io.IOBase | os.PathLike | bytes | list[int]*, *config: [lief.COFF.ParserConfig]( "lief.COFF.ParserConfig")*) → [lief.COFF.Binary]( "lief.COFF.Binary") | None Parse the COFF binary specified in the first parameter and return a [`lief.COFF.Binary`]( "lief.COFF.Binary") object The second argument is an optional configuration that can be used to define which part(s) of the COFF should be parsed or skipped. ### [` lief.COFF.ParserConfig `]() class lief.COFF.ParserConfig(*self*) Bases: `object` #### [` all `]() all = <lief.\_lief.COFF.ParserConfig object> #### [` default_conf `]() default\_conf = <lief.\_lief.COFF.ParserConfig object> ## [Binary]() ### [` lief.COFF.Binary `]() class lief.COFF.Binary Bases: `object` Class that represents a COFF Binary #### [` disassembledisassemble `]() disassemble(*self*, *function: [lief.\_lief.COFF.Symbol]( "lief._lief.COFF.Symbol")*) → Iterator[[lief.\_lief.assembly.Instruction]( "lief._lief.assembly.Instruction") | None] **disassemble(*self*, *function\_name: str*) → Iterator[[lief.\_lief.assembly.Instruction]( "lief._lief.assembly.Instruction") | None]** Overloaded function. 1. `disassemble(self, function: lief._lief.COFF.Symbol) -> Iterator[Optional[lief._lief.assembly.Instruction]]` > Disassemble code for the given symbol > > ```python > func = binary.find_demangled_function("int __cdecl my_function(int, int)"); > insts = binary.disassemble("main"); > for inst in insts: > print(inst) > ``` > > > **See also** > > > > [`lief.assembly.Instruction`]( "lief.assembly.Instruction") 2. `disassemble(self, function_name: str) -> Iterator[Optional[lief._lief.assembly.Instruction]]` > Disassemble code for the given symbol name > > ```python > insts = binary.disassemble("main"); > for inst in insts: > print(inst) > ``` > > > **See also** > > > > [`lief.assembly.Instruction`]( "lief.assembly.Instruction") #### [` disassemble_from_bytes `]() disassemble\_from\_bytes(*self*, *buffer: bytes*, *address: int = 0*) → Iterator[[lief.\_lief.assembly.Instruction]( "lief._lief.assembly.Instruction") | None] Disassemble code from the provided bytes ```python raw = bytes(binary.get_section(".text").content) insts = binary.disassemble_from_bytes(raw); for inst in insts: print(inst) ``` > **See also** > > [`lief.assembly.Instruction`]( "lief.assembly.Instruction") #### [` find_demangled_function `]() find\_demangled\_function(*self*, *name: str*) → [lief.\_lief.COFF.Symbol]( "lief._lief.COFF.Symbol") | None Try to find the function (symbol) with the given **demangled** name #### [` find_function `]() find\_function(*self*, *name: str*) → [lief.\_lief.COFF.Symbol]( "lief._lief.COFF.Symbol") | None Try to find the function (symbol) with the given name #### [` find_string `]() find\_string(*self*, *offset: int*) → [lief.\_lief.COFF.String]( "lief._lief.COFF.String") | None Try to find the COFF string at the given offset in the COFF string table. > **Warning** > > This offset must include the first 4 bytes holding the size of the table. Hence, the first string starts a the offset 4. #### [` functions `]() property functions → lief.COFF.Binary.it\_functions Iterator over the functions implemented in this COFF #### [` get_section `]() get\_section(*self*, *name: str*) → [lief.\_lief.COFF.Section]( "lief._lief.COFF.Section") | None Return the [`Section`]( "lief.COFF.Section") matching the given name. Section names that do not fit in the 8 bytes allocated by the COFF format are stored in the COFF string table while the section itself only holds a `/` placeholder. This function transparently resolves both forms, so a long name can be looked up with its **regular** value: ```python sec = binary.get_section(".debug_rnglists") sec.name # '/18' sec.coff_string.string # '.debug_rnglists' ``` #### [` header `]() property header → [lief.COFF.Header]( "lief.COFF.Header") The COFF header #### [` relocations `]() property relocations → lief.COFF.Binary.it\_relocations Iterator over **all** the relocations used by this COFF binary #### [` sections `]() property sections → lief.COFF.Binary.it\_section Iterator over the different sections located in this COFF binary #### [` string_table `]() property string\_table → lief.PE.Binary.it\_strings\_table Iterator over the COFF’s strings #### [` symbols `]() property symbols → lief.PE.Binary.it\_symbols Iterator over the COFF’s symbols --- ## [Header]() ![Inheritance diagram of lief._lief.COFF.RegularHeader, lief._lief.COFF.BigObjHeader, lief._lief.COFF.Header](https://lief.re/doc/latest/_images/inheritance-bcc7c9a46cad46f6f918721633e6ebeeafe05264.png) ### [` lief.COFF.Header `]() class lief.COFF.Header Bases: `object` Class that represents the COFF header. It is subclassed by [`RegularHeader`]( "lief.COFF.RegularHeader") and [`BigObjHeader`]( "lief.COFF.BigObjHeader") for normal vs `/bigobj` files #### [` KIND `]() class KIND(*\*values*) Bases: `Enum` ##### [` BIGOBJ `]() BIGOBJ = 2 ##### [` REGULAR `]() REGULAR = 1 ##### [` UNKNOWN `]() UNKNOWN = 0 #### [` copy `]() copy(*self*) → [lief.\_lief.COFF.Header]( "lief._lief.COFF.Header") | None Duplicate the current instance of this object #### [` kind `]() property kind → [lief.COFF.Header.KIND]( "lief.COFF.Header.KIND") The type of this header: whether it is regular or using the `/bigobj` format #### [` machine `]() property machine → [lief.PE.Header.MACHINE\_TYPES]( "lief.PE.Header.MACHINE_TYPES") The machine type targeted by this COFF #### [` nb_sections `]() property nb\_sections → int The number of sections #### [` nb_symbols `]() property nb\_symbols → int Number of symbols (including auxiliary symbols) #### [` pointerto_symbol_table `]() property pointerto\_symbol\_table → int Offset of the symbols table #### [` timedatestamp `]() property timedatestamp → int Timestamp when the COFF has been generated --- ## [RegularHeader]() ![Inheritance diagram of lief._lief.COFF.RegularHeader](https://lief.re/doc/latest/_images/inheritance-efbbeab203b9492525f3a5698a1ab46c30433e4e.png) ### [` lief.COFF.RegularHeader `]() class lief.COFF.RegularHeader Bases: [`Header`]( "lief._lief.COFF.Header") This class represents the COFF header for non-bigobj #### [` characteristics `]() property characteristics → int Characteristics #### [` sizeof_optionalheader `]() property sizeof\_optionalheader → int The size of the optional header that follows this header (should be 0) --- ## [BigObjHeader]() ![Inheritance diagram of lief._lief.COFF.BigObjHeader](https://lief.re/doc/latest/_images/inheritance-9504af83e30cea430ca4ca7378a35e6ad7910fc0.png) ### [` lief.COFF.BigObjHeader `]() class lief.COFF.BigObjHeader Bases: [`Header`]( "lief._lief.COFF.Header") This class represents the header for a COFF object compiled with `/bigobj` support (i.e. the number of sections can exceed 65536). The raw definition of the bigobj header is located in `winnt.h` and named `ANON_OBJECT_HEADER_BIGOBJ` #### [` flags `]() property flags → int 1 means that it contains metadata #### [` metadata_offset `]() property metadata\_offset → int Offset of CLR metadata #### [` metadata_size `]() property metadata\_size → int Size of CLR metadata #### [` sizeof_data `]() property sizeof\_data → int Size of data that follows the header #### [` uuid `]() property uuid → memoryview Originally named `ClassID`, this uuid should match: `{D1BAA1C7-BAEE-4ba9-AF20-FAF66AA4DCB8}`. #### [` version `]() property version → int The version of this header which must be >= 2 --- ## [Section]() ### [` lief.COFF.Section `]() class lief.COFF.Section Bases: [`Section`]( "lief._lief.Section") This class represents a COFF section #### [` ComdatInfo `]() class ComdatInfo Bases: `object` This class wraps comdat information which is composed of the symbol associated with the comdat section and its selection flag ##### [` kind `]() property kind → [lief.COFF.AuxiliarySectionDefinition.COMDAT\_SELECTION]( "lief.COFF.AuxiliarySectionDefinition.COMDAT_SELECTION") ##### [` symbol `]() property symbol → [lief.COFF.Symbol]( "lief.COFF.Symbol") #### [` characteristics `]() property characteristics → int The characteristics that describe the purpose of the section #### [` characteristics_lists `]() property characteristics\_lists → list[[lief.PE.Section.CHARACTERISTICS]( "lief.PE.Section.CHARACTERISTICS")] characteristics as a `list` #### [` coff_string `]() property coff\_string → [lief.COFF.String]( "lief.COFF.String") | None Return the COFF string associated with the section’s name (or None) This coff string is usually present for long section names whose length does not fit in the 8 bytes allocated by the COFF format. #### [` comdat_info `]() property comdat\_info → [lief.COFF.Section.ComdatInfo]( "lief.COFF.Section.ComdatInfo") | None Return comdat information (only if the section has the [`lief.PE.Section.CHARACTERISTICS.LNK_COMDAT`]( "lief.PE.Section.CHARACTERISTICS.LNK_COMDAT") characteristic) #### [` has_characteristic `]() has\_characteristic(*self*, *characteristic: [lief.\_lief.PE.Section.CHARACTERISTICS]( "lief._lief.PE.Section.CHARACTERISTICS")*) → bool `True` if the section has the given characteristic #### [` has_extended_relocations `]() property has\_extended\_relocations → bool Whether there is a large number of relocations whose number need to be stored in the virtual address attribute #### [` is_discardable `]() property is\_discardable → bool True if the section can be discarded as needed. This is typically the case for debug-related sections. #### [` numberof_line_numbers `]() property numberof\_line\_numbers → int The number of line-number entries for the section. This value should be zero for an image because COFF debugging information is deprecated. See: [`pointerto_line_numbers`]( "lief.COFF.Section.pointerto_line_numbers") #### [` numberof_relocations `]() property numberof\_relocations → int Number of relocations. > **Warning** > > If the number of relocations is greater than 0xFFFF (maximum value for 16-bits integer), then the number of relocations is stored in the virtual address attribute. #### [` pointerto_line_numbers `]() property pointerto\_line\_numbers → int The file pointer to the beginning of line-number entries for the section. This is set to zero if there are no COFF line numbers. This value should be zero for an image because COFF debugging information is deprecated and modern debug information relies on the PDB files. #### [` pointerto_raw_data `]() property pointerto\_raw\_data → int Offset to the section’s content #### [` pointerto_relocation `]() property pointerto\_relocation → int Offset to the relocation table #### [` relocations `]() property relocations → lief.COFF.Section.it\_relocations Iterator over the relocations performed in this section #### [` sizeof_raw_data `]() property sizeof\_raw\_data → int Return the size of the data in the section. #### [` symbols `]() property symbols → lief.COFF.Section.it\_symbols Iterator over the symbols associated with this section #### [` virtual_size `]() property virtual\_size → int Virtual size of the section (should be 0) --- ## [Relocation]() ### [` lief.COFF.Relocation `]() class lief.COFF.Relocation Bases: [`Relocation`]( "lief._lief.Relocation") #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` ##### [` AMD64_ABSOLUTE `]() AMD64\_ABSOLUTE = 262144 ##### [` AMD64_ADDR32 `]() AMD64\_ADDR32 = 262146 ##### [` AMD64_ADDR32NB `]() AMD64\_ADDR32NB = 262147 ##### [` AMD64_ADDR64 `]() AMD64\_ADDR64 = 262145 ##### [` AMD64_PAIR `]() AMD64\_PAIR = 262159 ##### [` AMD64_REL32 `]() AMD64\_REL32 = 262148 ##### [` AMD64_REL32_1 `]() AMD64\_REL32\_1 = 262149 ##### [` AMD64_REL32_2 `]() AMD64\_REL32\_2 = 262150 ##### [` AMD64_REL32_3 `]() AMD64\_REL32\_3 = 262151 ##### [` AMD64_REL32_4 `]() AMD64\_REL32\_4 = 262152 ##### [` AMD64_REL32_5 `]() AMD64\_REL32\_5 = 262153 ##### [` AMD64_SECREL `]() AMD64\_SECREL = 262155 ##### [` AMD64_SECREL7 `]() AMD64\_SECREL7 = 262156 ##### [` AMD64_SECTION `]() AMD64\_SECTION = 262154 ##### [` AMD64_SREL32 `]() AMD64\_SREL32 = 262158 ##### [` AMD64_SSPAN32 `]() AMD64\_SSPAN32 = 262160 ##### [` AMD64_TOKEN `]() AMD64\_TOKEN = 262157 ##### [` ARM64_ABSOLUTE `]() ARM64\_ABSOLUTE = 1048576 ##### [` ARM64_ADDR32 `]() ARM64\_ADDR32 = 1048577 ##### [` ARM64_ADDR32NB `]() ARM64\_ADDR32NB = 1048578 ##### [` ARM64_ADDR64 `]() ARM64\_ADDR64 = 1048590 ##### [` ARM64_BRANCH14 `]() ARM64\_BRANCH14 = 1048592 ##### [` ARM64_BRANCH19 `]() ARM64\_BRANCH19 = 1048591 ##### [` ARM64_BRANCH26 `]() ARM64\_BRANCH26 = 1048579 ##### [` ARM64_PAGEBASE_REL21 `]() ARM64\_PAGEBASE\_REL21 = 1048580 ##### [` ARM64_PAGEOFFSET_12A `]() ARM64\_PAGEOFFSET\_12A = 1048582 ##### [` ARM64_PAGEOFFSET_12L `]() ARM64\_PAGEOFFSET\_12L = 1048583 ##### [` ARM64_REL21 `]() ARM64\_REL21 = 1048581 ##### [` ARM64_REL32 `]() ARM64\_REL32 = 1048593 ##### [` ARM64_SECREL `]() ARM64\_SECREL = 1048584 ##### [` ARM64_SECREL_HIGH12A `]() ARM64\_SECREL\_HIGH12A = 1048586 ##### [` ARM64_SECREL_LOW12A `]() ARM64\_SECREL\_LOW12A = 1048585 ##### [` ARM64_SECREL_LOW12L `]() ARM64\_SECREL\_LOW12L = 1048587 ##### [` ARM64_SECTION `]() ARM64\_SECTION = 1048589 ##### [` ARM64_TOKEN `]() ARM64\_TOKEN = 1048588 ##### [` ARM_ABSOLUTE `]() ARM\_ABSOLUTE = 524288 ##### [` ARM_ADDR32 `]() ARM\_ADDR32 = 524289 ##### [` ARM_ADDR32NB `]() ARM\_ADDR32NB = 524290 ##### [` ARM_BLX11 `]() ARM\_BLX11 = 524297 ##### [` ARM_BLX23T `]() ARM\_BLX23T = 524309 ##### [` ARM_BLX24 `]() ARM\_BLX24 = 524296 ##### [` ARM_BRANCH11 `]() ARM\_BRANCH11 = 524292 ##### [` ARM_BRANCH20T `]() ARM\_BRANCH20T = 524306 ##### [` ARM_BRANCH24 `]() ARM\_BRANCH24 = 524291 ##### [` ARM_BRANCH24T `]() ARM\_BRANCH24T = 524308 ##### [` ARM_MOV32A `]() ARM\_MOV32A = 524304 ##### [` ARM_MOV32T `]() ARM\_MOV32T = 524305 ##### [` ARM_PAIR `]() ARM\_PAIR = 524310 ##### [` ARM_REL32 `]() ARM\_REL32 = 524298 ##### [` ARM_SECREL `]() ARM\_SECREL = 524303 ##### [` ARM_SECTION `]() ARM\_SECTION = 524302 ##### [` ARM_TOKEN `]() ARM\_TOKEN = 524293 ##### [` I386_ABSOLUTE `]() I386\_ABSOLUTE = 131072 ##### [` I386_DIR16 `]() I386\_DIR16 = 131073 ##### [` I386_DIR32 `]() I386\_DIR32 = 131078 ##### [` I386_DIR32NB `]() I386\_DIR32NB = 131079 ##### [` I386_REL16 `]() I386\_REL16 = 131074 ##### [` I386_REL32 `]() I386\_REL32 = 131092 ##### [` I386_SECREL `]() I386\_SECREL = 131083 ##### [` I386_SECREL7 `]() I386\_SECREL7 = 131085 ##### [` I386_SECTION `]() I386\_SECTION = 131082 ##### [` I386_SEG12 `]() I386\_SEG12 = 131081 ##### [` I386_TOKEN `]() I386\_TOKEN = 131084 ##### [` MIPS_ABSOLUTE `]() MIPS\_ABSOLUTE = 2097152 ##### [` MIPS_GPREL `]() MIPS\_GPREL = 2097158 ##### [` MIPS_JMPADDR `]() MIPS\_JMPADDR = 2097155 ##### [` MIPS_JMPADDR16 `]() MIPS\_JMPADDR16 = 2097168 ##### [` MIPS_LITERAL `]() MIPS\_LITERAL = 2097159 ##### [` MIPS_PAIR `]() MIPS\_PAIR = 2097189 ##### [` MIPS_REFHALF `]() MIPS\_REFHALF = 2097153 ##### [` MIPS_REFHI `]() MIPS\_REFHI = 2097156 ##### [` MIPS_REFLO `]() MIPS\_REFLO = 2097157 ##### [` MIPS_REFWORD `]() MIPS\_REFWORD = 2097154 ##### [` MIPS_REFWORDNB `]() MIPS\_REFWORDNB = 2097186 ##### [` MIPS_SECREL `]() MIPS\_SECREL = 2097163 ##### [` MIPS_SECRELHI `]() MIPS\_SECRELHI = 2097165 ##### [` MIPS_SECRELLO `]() MIPS\_SECRELLO = 2097164 ##### [` MIPS_SECTION `]() MIPS\_SECTION = 2097162 ##### [` UNKNOWN `]() UNKNOWN = 4294967295 ##### [` from_value `]() from\_value(*arg: int*) → [lief.COFF.Relocation.TYPE]( "lief.COFF.Relocation.TYPE") = <nanobind.nb\_func object> #### [` section `]() property section → [lief.COFF.Section]( "lief.COFF.Section") | None Section in which the relocation takes place #### [` symbol `]() property symbol → [lief.COFF.Symbol]( "lief.COFF.Symbol") | None Symbol associated with the relocation (if any) #### [` symbol_idx `]() property symbol\_idx → int Symbol index associated with this relocation #### [` type `]() property type → [lief.COFF.Relocation.TYPE]( "lief.COFF.Relocation.TYPE") Type of the relocation --- ## [String]() ### [` lief.COFF.String `]() class lief.COFF.String Bases: `object` This class represents a string located in the COFF string table. Some of these strings can be used for section’s name where its length is greater than 8 bytes. See: [`coff_string`]( "lief.COFF.Section.coff_string"). Reference: [https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#coff-string-table]() #### [` offset `]() property offset → int The offset of this string the in the COFF string table. This offset includes the first 4-bytes that holds the table size #### [` string `]() property string → str The actual string --- ## [Symbol]() ![Inheritance diagram of lief._lief.COFF.Symbol](https://lief.re/doc/latest/_images/inheritance-9d6e46f60b50057c5307ec849919b9ff37e737a8.png) ### [` lief.COFF.Symbol `]() class lief.COFF.Symbol Bases: [`Symbol`]( "lief._lief.Symbol") Class that represents a COFF symbol. > **Warning** > > The [`lief.Symbol.value`]( "lief.Symbol.value") should be interpreted in perspective of the [`storage_class`]( "lief.COFF.Symbol.storage_class") Reference: [https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#coff-symbol-table]() #### [` BASE_TYPE `]() class BASE\_TYPE(*\*values*) Bases: `Enum` ##### [` BYTE `]() BYTE = 12 ##### [` CHAR `]() CHAR = 2 ##### [` DOUBLE `]() DOUBLE = 7 ##### [` DWORD `]() DWORD = 15 ##### [` ENUM `]() ENUM = 10 ##### [` FLOAT `]() FLOAT = 6 ##### [` INT `]() INT = 4 ##### [` LONG `]() LONG = 5 ##### [` MOE `]() MOE = 11 ##### [` NULL `]() NULL = 0 ##### [` SHORT `]() SHORT = 3 ##### [` STRUCT `]() STRUCT = 8 ##### [` UINT `]() UINT = 14 ##### [` UNION `]() UNION = 9 ##### [` VOID `]() VOID = 1 ##### [` WORD `]() WORD = 13 ##### [` from_value `]() from\_value(*arg: int*) → [lief.COFF.Symbol.BASE\_TYPE]( "lief.COFF.Symbol.BASE_TYPE") = <nanobind.nb\_func object> #### [` COMPLEX_TYPE `]() class COMPLEX\_TYPE(*\*values*) Bases: `Enum` ##### [` ARRAY `]() ARRAY = 3 ##### [` FUNCTION `]() FUNCTION = 2 ##### [` NULL `]() NULL = 0 ##### [` POINTER `]() POINTER = 1 ##### [` from_value `]() from\_value(*arg: int*) → [lief.COFF.Symbol.COMPLEX\_TYPE]( "lief.COFF.Symbol.COMPLEX_TYPE") = <nanobind.nb\_func object> #### [` STORAGE_CLASS `]() class STORAGE\_CLASS(*\*values*) Bases: `Enum` Reference: [https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#storage-class]() ##### [` ARGUMENT `]() ARGUMENT = 9 ##### [` AUTOMATIC `]() AUTOMATIC = 1 ##### [` BIT_FIELD `]() BIT\_FIELD = 18 ##### [` BLOCK `]() BLOCK = 100 ##### [` CLR_TOKEN `]() CLR\_TOKEN = 107 ##### [` END_OF_FUNCTION `]() END\_OF\_FUNCTION = -1 ##### [` END_OF_STRUCT `]() END\_OF\_STRUCT = 102 ##### [` ENUM_TAG `]() ENUM\_TAG = 15 ##### [` EXTERNAL `]() EXTERNAL = 2 ##### [` EXTERNAL_DEF `]() EXTERNAL\_DEF = 5 ##### [` FILE `]() FILE = 103 ##### [` FUNCTION `]() FUNCTION = 101 ##### [` LABEL `]() LABEL = 6 ##### [` MEMBER_OF_ENUM `]() MEMBER\_OF\_ENUM = 16 ##### [` MEMBER_OF_STRUCT `]() MEMBER\_OF\_STRUCT = 8 ##### [` MEMBER_OF_UNION `]() MEMBER\_OF\_UNION = 11 ##### [` NONE `]() NONE = 0 ##### [` REGISTER `]() REGISTER = 4 ##### [` REGISTER_PARAM `]() REGISTER\_PARAM = 17 ##### [` SECTION `]() SECTION = 104 ##### [` STATIC `]() STATIC = 3 ##### [` STRUCT_TAG `]() STRUCT\_TAG = 10 ##### [` TYPE_DEFINITION `]() TYPE\_DEFINITION = 13 ##### [` UNDEFINED_LABEL `]() UNDEFINED\_LABEL = 7 ##### [` UNDEFINED_STATIC `]() UNDEFINED\_STATIC = 14 ##### [` UNION_TAG `]() UNION\_TAG = 12 ##### [` WEAK_EXTERNAL `]() WEAK\_EXTERNAL = 105 ##### [` from_value `]() from\_value(*arg: int*) → [lief.COFF.Symbol.STORAGE\_CLASS]( "lief.COFF.Symbol.STORAGE_CLASS") = <nanobind.nb\_func object> #### [` auxiliary_symbols `]() property auxiliary\_symbols → lief.COFF.Symbol.it\_auxiliary\_symbols\_t Auxiliary symbols associated with this symbol. #### [` base_type `]() property base\_type → [lief.COFF.Symbol.BASE\_TYPE]( "lief.COFF.Symbol.BASE_TYPE") The simple (base) data type #### [` coff_name `]() property coff\_name → [lief.COFF.String]( "lief.COFF.String") | None COFF string used to represents the (long) symbol name #### [` complex_type `]() property complex\_type → [lief.COFF.Symbol.COMPLEX\_TYPE]( "lief.COFF.Symbol.COMPLEX_TYPE") The complex type (if any) #### [` demangled_name `]() property demangled\_name → str Demangled representation of the symbol or an empty string if it can’t be demangled #### [` is_absolute `]() property is\_absolute → bool #### [` is_external `]() property is\_external → bool #### [` is_file_record `]() property is\_file\_record → bool #### [` is_function `]() property is\_function → bool #### [` is_function_line_info `]() property is\_function\_line\_info → bool #### [` is_undefined `]() property is\_undefined → bool #### [` is_weak_external `]() property is\_weak\_external → bool #### [` section `]() property section → [lief.COFF.Section]( "lief.COFF.Section") | None Section associated with this symbol (if any) #### [` section_idx `]() property section\_idx → int The signed integer that identifies the section, using a one-based index into the section table. Some values have special meaning: - **0: The symbol record is not yet assigned a section. A value of zero** indicates that a reference to an external symbol is defined elsewhere. A value of non-zero is a common symbol with a size that is specified by the value. - **-1: The symbol has an absolute (non-relocatable) value and is not an** address. - **-2: The symbol provides general type or debugging information but does** not correspond to a section. Microsoft tools use this setting along with `.file` records #### [` storage_class `]() property storage\_class → [lief.COFF.Symbol.STORAGE\_CLASS]( "lief.COFF.Symbol.STORAGE_CLASS") Storage class of the symbol which indicates what kind of definition a symbol represents. #### [` type `]() property type → int The symbol type. The first byte represents the base type (see: [`base_type`]( "lief.COFF.Symbol.base_type")) while the upper byte represents the complex type, if any (see: [`complex_type`]( "lief.COFF.Symbol.complex_type")). --- ## [AuxiliarySymbol]() ![Inheritance diagram of lief._lief.COFF.AuxiliaryFunctionDefinition, lief._lief.COFF.AuxiliarySectionDefinition, lief._lief.COFF.AuxiliaryWeakExternal, lief._lief.COFF.AuxiliarySymbol, lief._lief.COFF.AuxiliaryCLRToken, lief._lief.COFF.AuxiliaryFile, lief._lief.COFF.AuxiliarybfAndefSymbol](https://lief.re/doc/latest/_images/inheritance-ae6ddf56b3107b0b66ff879432aaaee072c6176e.png) ### [` lief.COFF.AuxiliarySymbol `]() class lief.COFF.AuxiliarySymbol Bases: `object` Class that represents an auxiliary symbol. An auxiliary symbol has the same size as a regular `lief.PE.Symbol` (18 bytes) but its content depends on the parent symbol. #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` Type discriminator for the subclasses ##### [` BF_AND_EF `]() BF\_AND\_EF = 3 ##### [` CLR_TOKEN `]() CLR\_TOKEN = 1 ##### [` FILE `]() FILE = 5 ##### [` FUNC_DEF `]() FUNC\_DEF = 2 ##### [` SEC_DEF `]() SEC\_DEF = 6 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` WEAK_EXTERNAL `]() WEAK\_EXTERNAL = 4 ##### [` from_value `]() from\_value(*arg: int*) → [lief.COFF.AuxiliarySymbol.TYPE]( "lief.COFF.AuxiliarySymbol.TYPE") = <nanobind.nb\_func object> #### [` copy `]() copy(*self*) → [lief.\_lief.COFF.AuxiliarySymbol]( "lief._lief.COFF.AuxiliarySymbol") | None Duplicate the current instance of this object #### [` payload `]() property payload → memoryview For unknown type **only**, return the raw representation of this symbol #### [` type `]() property type → [lief.COFF.AuxiliarySymbol.TYPE]( "lief.COFF.AuxiliarySymbol.TYPE") --- ## [AuxiliaryCLRToken]() ![Inheritance diagram of lief._lief.COFF.AuxiliaryCLRToken](https://lief.re/doc/latest/_images/inheritance-79a9cfc9c89e3e02ed132fc4fe0455073bba85e6.png) ### [` lief.COFF.AuxiliaryCLRToken `]() class lief.COFF.AuxiliaryCLRToken Bases: [`AuxiliarySymbol`]( "lief._lief.COFF.AuxiliarySymbol") Auxiliary symbol associated with the `CLR_TOKEN` storage class #### [` aux_type `]() property aux\_type → int `IMAGE_AUX_SYMBOL_TYPE` which should be `IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF` (1) #### [` reserved `]() property reserved → int Reserved value (should be 0) #### [` rgb_reserved `]() property rgb\_reserved → memoryview Reserved (padding) values. Should be 0 #### [` symbol `]() property symbol → [lief.COFF.Symbol]( "lief.COFF.Symbol") | None Symbol referenced by [`symbol_idx`]( "lief.COFF.AuxiliaryCLRToken.symbol_idx") (if resolved) #### [` symbol_idx `]() property symbol\_idx → int Index in the symbol table --- ## [AuxiliaryFunctionDefinition]() ![Inheritance diagram of lief._lief.COFF.AuxiliaryFunctionDefinition](https://lief.re/doc/latest/_images/inheritance-4f13b18f2f4088db5189525dd98410c14c698e70.png) ### [` lief.COFF.AuxiliaryFunctionDefinition `]() class lief.COFF.AuxiliaryFunctionDefinition Bases: [`AuxiliarySymbol`]( "lief._lief.COFF.AuxiliarySymbol") This auxiliary symbol marks the beginning of a function definition. Reference: [https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#auxiliary-format-1-function-definitions]() #### [` padding `]() property padding → int Padding value (should be 0) #### [` ptr_to_line_number `]() property ptr\_to\_line\_number → int The file offset of the first COFF line-number entry for the function, or zero if none exists (deprecated) #### [` ptr_to_next_func `]() property ptr\_to\_next\_func → int The symbol-table index of the record for the next function. If the function is the last in the symbol table, this field is set to zero #### [` tag_index `]() property tag\_index → int The symbol-table index of the corresponding `.bf` (begin function) symbol record. #### [` total_size `]() property total\_size → int The size of the executable code for the function itself. If the function is in its own section, the `SizeOfRawData` in the section header is greater or equal to this field, depending on alignment considerations --- ## [AuxiliaryWeakExternal]() ![Inheritance diagram of lief._lief.COFF.AuxiliaryWeakExternal](https://lief.re/doc/latest/_images/inheritance-1e262467ebc197517ae14329cfad93486ed89018.png) ### [` lief.COFF.AuxiliaryWeakExternal `]() class lief.COFF.AuxiliaryWeakExternal Bases: [`AuxiliarySymbol`]( "lief._lief.COFF.AuxiliarySymbol") “Weak externals” are a mechanism for object files that allows flexibility at link time. A module can contain an unresolved external symbol (`sym1`), but it can also include an auxiliary record that indicates that if `sym1` is not present at link time, another external symbol (`sym2`) is used to resolve references instead. If a definition of `sym1` is linked, then an external reference to the symbol is resolved normally. If a definition of `sym1` is not linked, then all references to the weak external for `sym1` refer to `sym2` instead. The external symbol, `sym2`, must always be linked; typically, it is defined in the module that contains the weak reference to `sym1`. Reference: [https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#auxiliary-format-3-weak-externals]() #### [` CHARACTERISTICS `]() class CHARACTERISTICS(*\*values*) Bases: `Enum` ##### [` ANTI_DEPENDENCY `]() ANTI\_DEPENDENCY = 4 ##### [` SEARCH_ALIAS `]() SEARCH\_ALIAS = 3 ##### [` SEARCH_LIBRARY `]() SEARCH\_LIBRARY = 2 ##### [` SEARCH_NOLIBRARY `]() SEARCH\_NOLIBRARY = 1 #### [` characteristics `]() property characteristics → [lief.COFF.AuxiliaryWeakExternal.CHARACTERISTICS]( "lief.COFF.AuxiliaryWeakExternal.CHARACTERISTICS") #### [` padding `]() property padding → memoryview #### [` sym_idx `]() property sym\_idx → int The symbol-table index of sym2, the symbol to be linked if `sym1` is not found. --- ## [AuxiliarybfAndefSymbol]() ![Inheritance diagram of lief._lief.COFF.AuxiliarybfAndefSymbol](https://lief.re/doc/latest/_images/inheritance-02d299e259eec33163ad7d484ccd5b4974128ebd.png) ### [` lief.COFF.AuxiliarybfAndefSymbol `]() class lief.COFF.AuxiliarybfAndefSymbol Bases: [`AuxiliarySymbol`]( "lief._lief.COFF.AuxiliarySymbol") --- ## [AuxiliarySectionDefinition]() ![Inheritance diagram of lief._lief.COFF.AuxiliarySectionDefinition](https://lief.re/doc/latest/_images/inheritance-d628fe9cece3a9e4d30978150d56af8fc6bb8d58.png) ### [` lief.COFF.AuxiliarySectionDefinition `]() class lief.COFF.AuxiliarySectionDefinition Bases: [`AuxiliarySymbol`]( "lief._lief.COFF.AuxiliarySymbol") This auxiliary symbol exposes information about the associated section. It **duplicates** some information that are provided in the section header #### [` COMDAT_SELECTION `]() class COMDAT\_SELECTION(*\*values*) Bases: `Enum` Values for the AuxiliarySectionDefinition::selection attribute See: [https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#comdat-sections-object-only]() ##### [` ANY `]() ANY = 2 ##### [` ASSOCIATIVE `]() ASSOCIATIVE = 5 ##### [` EXACT_MATCH `]() EXACT\_MATCH = 4 ##### [` LARGEST `]() LARGEST = 6 ##### [` NODUPLICATES `]() NODUPLICATES = 1 ##### [` NONE `]() NONE = 0 ##### [` SAME_SIZE `]() SAME\_SIZE = 3 #### [` checksum `]() property checksum → int The checksum for communal data. It is applicable if the `IMAGE_SCN_LNK_COMDAT` flag is set in the section header. #### [` length `]() property length → int The size of section data. The same as `SizeOfRawData` in the section header. #### [` nb_line_numbers `]() property nb\_line\_numbers → int The number of line-number entries for the section. #### [` nb_relocs `]() property nb\_relocs → int The number of relocation entries for the section. #### [` reserved `]() property reserved → int Reserved value (should be 0) #### [` section_idx `]() property section\_idx → int One-based index into the section table for the associated section. This is used when the COMDAT selection setting is 5. #### [` selection `]() property selection → [lief.COFF.AuxiliarySectionDefinition.COMDAT\_SELECTION]( "lief.COFF.AuxiliarySectionDefinition.COMDAT_SELECTION") The COMDAT selection number. This is applicable if the section is a COMDAT section. --- ## [AuxiliaryFile]() ![Inheritance diagram of lief._lief.COFF.AuxiliaryFile](https://lief.re/doc/latest/_images/inheritance-b0e9cc4ccf4c91f256bb4605d707ac99bd9e14d6.png) ### [` lief.COFF.AuxiliaryFile `]() class lief.COFF.AuxiliaryFile Bases: [`AuxiliarySymbol`]( "lief._lief.COFF.AuxiliarySymbol") This auxiliary symbol represents a filename (auxiliary format 4) The [`lief.Symbol.name`]( "lief.Symbol.name") itself should start with `.file`, and this auxiliary record gives the name of a source-code file. Reference: [https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#auxiliary-format-4-files]() #### [` filename `]() property filename → str The associated filename ## [Utilities]() ### [` lief.is_coff `]() lief.is\_coff(*file: str | os.PathLike*) → bool Check if the given file is a COFF --- documentID: "e94d5580fee88fc2c065033f6b37dfe2227c4589ca8bf5435d65fec47cf3b2e6" docname: "formats/coff/rust" title: "COFF Rust API - LIEF Documentation" description: "COFF Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/coff/rust.html" markdownURL: "https://lief.re/doc/latest/formats/coff/rust.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "9180a30aea0bc7d1a05d37a5323dc2b79d41c50cbd0de16d25aa4d0ec00f59a4" --- # [Rust]() > **Note** > > Please check: [`lief::coff`]() --- documentID: "642673de815b64d38a0a1a7280e50b797af4f9dd6e295635511d53b418a4af3f" docname: "formats/elf/cpp" title: "ELF C++ API - LIEF Documentation" description: "ELF C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/elf/cpp.html" markdownURL: "https://lief.re/doc/latest/formats/elf/cpp.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "f5343f7f1c69aeb1fef0f40e77f8f311741f6313bf9d42bd3934dc4fc885ba07" --- # [C++]() ## [Parser]() ### [` Parser `]() class Parser : public LIEF::[Parser]( "LIEF::Parser") Class which parses and transforms an ELF file into a [ELF::Binary]() object. Subclassed by [LIEF::OAT::Parser]() Public Types #### [` ELF_TYPE `]() enum ELF\_TYPE *Values:* ##### [` ELF_UNKNOWN `]() enumerator ELF\_UNKNOWN ##### [` ELF32 `]() enumerator ELF32 ##### [` ELF64 `]() enumerator ELF64 Public Functions #### [` operator= `]() [Parser]( "LIEF::ELF::Parser") &operator=(const [Parser]( "LIEF::ELF::Parser")&) = delete #### [` Parser `]() Parser(const [Parser]( "LIEF::ELF::Parser::Parser")&) = delete #### [` ~Parser `]() ~Parser() Public Static Functions #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::ELF::Binary")> parse(std::string\_view file, const [ParserConfig]( "LIEF::ELF::ParserConfig") &conf = [ParserConfig]( "LIEF::ELF::ParserConfig")::[all]( "LIEF::ELF::ParserConfig::all")()) Parse an ELF file and return a [LIEF::ELF::Binary]() object. For weird binaries (e.g. sectionless) you can choose which method to use for counting dynamic symbols **Parameters:** - **file** – **[in]** Path to the ELF binary - **conf** – **[in]** Optional configuration for the parser **Returns:** [LIEF::ELF::Binary]() as a `unique_ptr` #### [` PathTparse `]() template<class PathT, enable\_if\_path\_t<[PathT]( "LIEF::ELF::Parser::parse::PathT")> = 0> static inline std::unique\_ptr<[Binary]( "LIEF::ELF::Binary")> parse(const [PathT]( "LIEF::ELF::Parser::parse::PathT") &file, const [ParserConfig]( "LIEF::ELF::ParserConfig") &conf = [ParserConfig]( "LIEF::ELF::ParserConfig")::[all]( "LIEF::ELF::ParserConfig::all")()) Same as [parse(std::string\_view, const ParserConfig&)]() but the file is given as a `std::filesystem::path`. #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::ELF::Binary")> parse(const std::vector<uint8\_t> &data, const [ParserConfig]( "LIEF::ELF::ParserConfig") &conf = [ParserConfig]( "LIEF::ELF::ParserConfig")::[all]( "LIEF::ELF::ParserConfig::all")()) Parse the given raw data as an ELF binary and return a [LIEF::ELF::Binary]() object. For weird binaries (e.g. sectionless) you can choose which method to use to count dynamic symbols **Parameters:** - **data** – **[in]** Raw ELF as a std::vector of uint8\_t - **conf** – **[in]** Optional configuration for the parser **Returns:** [LIEF::ELF::Binary]() #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::ELF::Binary")> parse(std::unique\_ptr<[BinaryStream]( "LIEF::BinaryStream")> stream, const [ParserConfig]( "LIEF::ELF::ParserConfig") &conf = [ParserConfig]( "LIEF::ELF::ParserConfig")::[all]( "LIEF::ELF::ParserConfig::all")()) Parse the ELF binary from the given stream and return a [LIEF::ELF::Binary]() object. For weird binaries (e.g. sectionless) you can choose which method to use to count dynamic symbols **Parameters:** - **stream** – **[in]** The stream which wraps the ELF binary - **conf** – **[in]** Optional configuration for the parser **Returns:** [LIEF::ELF::Binary]() #### [` parse_from_memory `]() static std::unique\_ptr<[Binary]( "LIEF::ELF::Binary")> parse\_from\_memory(uintptr\_t address, const [ParserConfig]( "LIEF::ELF::ParserConfig") &conf = [ParserConfig]( "LIEF::ELF::ParserConfig")::[all]( "LIEF::ELF::ParserConfig::all")()) Parse the ELF binary from the given memory address. **Parameters:** - **address** – **[in]** Base address of the ELF binary in memory - **conf** – **[in]** Optional configuration for the parser **Returns:** [LIEF::ELF::Binary]() #### [` parse_from_memory `]() static std::unique\_ptr<[Binary]( "LIEF::ELF::Binary")> parse\_from\_memory(uintptr\_t address, size\_t size, const [ParserConfig]( "LIEF::ELF::ParserConfig") &conf = [ParserConfig]( "LIEF::ELF::ParserConfig")::[all]( "LIEF::ELF::ParserConfig::all")()) Parse the ELF binary from the given memory address with the given size. **Parameters:** - **address** – **[in]** Base address of the ELF binary in memory - **size** – **[in]** Size of the memory region - **conf** – **[in]** Optional configuration for the parser **Returns:** [LIEF::ELF::Binary]() #### [` parse_from_dump `]() static std::unique\_ptr<[Binary]( "LIEF::ELF::Binary")> parse\_from\_dump(std::string\_view filepath, uint64\_t addr, const [ParserConfig]( "LIEF::ELF::ParserConfig") &conf = [ParserConfig]( "LIEF::ELF::ParserConfig")::[all]( "LIEF::ELF::ParserConfig::all")()) Parse an ELF binary from a memory dump located on disk. A dump is a raw capture of the process memory that was mapped starting at the virtual address `addr`. This is typically used to parse an ELF image that has been dumped from memory (e.g. from a debugger or a runtime hook). **Parameters:** - **filepath** – **[in]** Path to the file that contains the memory dump - **addr** – **[in]** Virtual address at which the dump was mapped - **conf** – **[in]** Optional configuration for the parser #### [` PathTparse_from_dump `]() template<class PathT, enable\_if\_path\_t<[PathT]( "LIEF::ELF::Parser::parse_from_dump::PathT")> = 0> static inline std::unique\_ptr<[Binary]( "LIEF::ELF::Binary")> parse\_from\_dump(const [PathT]( "LIEF::ELF::Parser::parse_from_dump::PathT") &filepath, uint64\_t addr, const [ParserConfig]( "LIEF::ELF::ParserConfig") &conf = [ParserConfig]( "LIEF::ELF::ParserConfig")::[all]( "LIEF::ELF::ParserConfig::all")()) Same as [parse\_from\_dump(std::string\_view, uint64\_t, const ParserConfig&)]() but the dump file is given as a `std::filesystem::path`. #### [` parse_from_dump `]() static std::unique\_ptr<[Binary]( "LIEF::ELF::Binary")> parse\_from\_dump([BinaryStream]( "LIEF::BinaryStream") &stream, uint64\_t addr, const [ParserConfig]( "LIEF::ELF::ParserConfig") &conf = [ParserConfig]( "LIEF::ELF::ParserConfig")::[all]( "LIEF::ELF::ParserConfig::all")()) Same as [parse\_from\_dump(std::string\_view, uint64\_t, const ParserConfig&)]() but the dump is wrapped in the given **non-owned** stream. #### [` parse_from_dump `]() static std::unique\_ptr<[Binary]( "LIEF::ELF::Binary")> parse\_from\_dump(std::unique\_ptr<[BinaryStream]( "LIEF::BinaryStream")> stream, uint64\_t addr, const [ParserConfig]( "LIEF::ELF::ParserConfig") &conf = [ParserConfig]( "LIEF::ELF::ParserConfig")::[all]( "LIEF::ELF::ParserConfig::all")()) Same as [parse\_from\_dump(std::string\_view, uint64\_t, const ParserConfig&)]() but the dump is wrapped in the given **owned** stream. Public Static Attributes #### [` NB_MAX_SYMBOLS `]() static uint32\_t NB\_MAX\_SYMBOLS = 1000000 #### [` DELTA_NB_SYMBOLS `]() static uint32\_t DELTA\_NB\_SYMBOLS = 3000 #### [` NB_MAX_BUCKETS `]() static uint32\_t NB\_MAX\_BUCKETS = [NB\_MAX\_SYMBOLS]( "LIEF::ELF::Parser::NB_MAX_SYMBOLS") #### [` NB_MAX_CHAINS `]() static uint32\_t NB\_MAX\_CHAINS = 1000000 #### [` NB_MAX_SEGMENTS `]() static uint32\_t NB\_MAX\_SEGMENTS = 10000 #### [` NB_MAX_RELOCATIONS `]() static uint32\_t NB\_MAX\_RELOCATIONS = 3000000 #### [` NB_MAX_DYNAMIC_ENTRIES `]() static uint32\_t NB\_MAX\_DYNAMIC\_ENTRIES = 1000 #### [` MAX_SEGMENT_SIZE `]() static uint32\_t MAX\_SEGMENT\_SIZE = 3\_GB Friends **friend class OAT::Parser** ### [` ParserConfig `]() struct ParserConfig This structure is used to tweak the ELF [Parser]() ([ELF::Parser]()). Public Types #### [` DYNSYM_COUNT `]() enum class DYNSYM\_COUNT Methods that can be used by the [LIEF::ELF::Parser]() to count the number of dynamic symbols. *Values:* ##### [` AUTO `]() enumerator AUTO = 0 Automatic detection. ##### [` SECTION `]() enumerator SECTION Count based on sections (not very reliable). ##### [` HASH `]() enumerator HASH Count based on hash table (reliable). ##### [` RELOCATIONS `]() enumerator RELOCATIONS Count based on PLT/GOT relocations (very reliable but not accurate). Public Members #### [` parse_relocations `]() bool parse\_relocations = true Whether relocations (including plt-like relocations) should be parsed. #### [` parse_dyn_symbols `]() bool parse\_dyn\_symbols = true Whether dynamic symbols (those from `.dynsym`) should be parsed. #### [` parse_symtab_symbols `]() bool parse\_symtab\_symbols = true Whether debug symbols (those from `.symtab`) should be parsed. #### [` parse_symbol_versions `]() bool parse\_symbol\_versions = true Whether versioning symbols should be parsed. #### [` parse_notes `]() bool parse\_notes = true Whether ELF notes information should be parsed. #### [` parse_overlay `]() bool parse\_overlay = true Whether the overlay data should be parsed. #### [` count_mtd `]() [DYNSYM\_COUNT]( "LIEF::ELF::ParserConfig::DYNSYM_COUNT") count\_mtd = [DYNSYM\_COUNT]( "LIEF::ELF::ParserConfig::DYNSYM_COUNT")::[AUTO]( "LIEF::ELF::ParserConfig::DYNSYM_COUNT::AUTO") The method used to count the number of dynamic symbols. #### [` page_size `]() uint64\_t page\_size = 0 Memory page size if the binary uses a non-standard value. For instance, SPARCV9 binary can use page size from 0x2000 to 0x100000. Public Static Functions #### [` all `]() static inline [ParserConfig]( "LIEF::ELF::ParserConfig") all() This returns a [ParserConfig]() object configured to process all the ELF elements. --- ## [Binary]() ### [` Binary `]() class Binary : public LIEF::[Binary]( "LIEF::Binary") Class which represents an ELF binary. Subclassed by [LIEF::OAT::Binary]() Public Types #### [` PHDR_RELOC `]() enum PHDR\_RELOC This enum describes the different ways to relocate the segments table. *Values:* ##### [` AUTO `]() enumerator AUTO = 0 Defer the choice of the layout to LIEF. ##### [` PIE_SHIFT `]() enumerator PIE\_SHIFT The content of the binary right after the segments table is shifted and the relocations are updated accordingly. This kind of shift only works with PIE binaries. ##### [` BSS_END `]() enumerator BSS\_END The new segments table is relocated right after the first bss-like segment. ##### [` BINARY_END `]() enumerator BINARY\_END The new segments table is relocated at the end of the binary. ##### [` SEGMENT_GAP `]() enumerator SEGMENT\_GAP The new segments table is relocated between two LOAD segments. This kind of relocation is only doable when there is an alignment enforcement. #### [` SEC_INSERT_POS `]() enum class SEC\_INSERT\_POS This enum defines where the content of a newly added section should be inserted. *Values:* ##### [` AUTO `]() enumerator AUTO = 0 Defer the choice to LIEF. ##### [` POST_SEGMENT `]() enumerator POST\_SEGMENT Insert the section after the last valid offset in the **segments** table. With this choice, the section is inserted after the loaded content but before any debug information. ##### [` POST_SECTION `]() enumerator POST\_SECTION Insert the section after the last valid offset in the **section** table. With this choice, the section is inserted at the very end of the binary. #### [` string_list_t `]() using string\_list\_t = std::vector<std::string> #### [` notes_t `]() using notes\_t = std::vector<std::unique\_ptr<[Note]( "LIEF::ELF::Note")>> Internal container for storing notes. #### [` it_notes `]() using it\_notes = [ref\_iterator]( "LIEF::ref_iterator")<[notes\_t]( "LIEF::ELF::Binary::notes_t")&, [Note]( "LIEF::ELF::Note")\*> Iterator which outputs [Note]()& object. #### [` it_const_notes `]() using it\_const\_notes = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [notes\_t]( "LIEF::ELF::Binary::notes_t")&, const [Note]( "LIEF::ELF::Note")\*> Iterator which outputs const [Note]()& object. #### [` symbols_version_requirement_t `]() using symbols\_version\_requirement\_t = std::vector<std::unique\_ptr<[SymbolVersionRequirement]( "LIEF::ELF::SymbolVersionRequirement")>> Internal container for storing [SymbolVersionRequirement](). #### [` it_symbols_version_requirement `]() using it\_symbols\_version\_requirement = [ref\_iterator]( "LIEF::ref_iterator")<[symbols\_version\_requirement\_t]( "LIEF::ELF::Binary::symbols_version_requirement_t")&, [SymbolVersionRequirement]( "LIEF::ELF::SymbolVersionRequirement")\*> Iterator which outputs [SymbolVersionRequirement]()& object. #### [` it_const_symbols_version_requirement `]() using it\_const\_symbols\_version\_requirement = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [symbols\_version\_requirement\_t]( "LIEF::ELF::Binary::symbols_version_requirement_t")&, const [SymbolVersionRequirement]( "LIEF::ELF::SymbolVersionRequirement")\*> Iterator which outputs const [SymbolVersionRequirement]()& object. #### [` symbols_version_definition_t `]() using symbols\_version\_definition\_t = std::vector<std::unique\_ptr<[SymbolVersionDefinition]( "LIEF::ELF::SymbolVersionDefinition")>> Internal container for storing [SymbolVersionDefinition](). #### [` it_symbols_version_definition `]() using it\_symbols\_version\_definition = [ref\_iterator]( "LIEF::ref_iterator")<[symbols\_version\_definition\_t]( "LIEF::ELF::Binary::symbols_version_definition_t")&, [SymbolVersionDefinition]( "LIEF::ELF::SymbolVersionDefinition")\*> Iterator which outputs [SymbolVersionDefinition]()& object. #### [` it_const_symbols_version_definition `]() using it\_const\_symbols\_version\_definition = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [symbols\_version\_definition\_t]( "LIEF::ELF::Binary::symbols_version_definition_t")&, const [SymbolVersionDefinition]( "LIEF::ELF::SymbolVersionDefinition")\*> Iterator which outputs const [SymbolVersionDefinition]()& object. #### [` segments_t `]() using segments\_t = std::vector<std::unique\_ptr<[Segment]( "LIEF::ELF::Segment")>> Internal container for storing ELF’s [Segment](). #### [` it_segments `]() using it\_segments = [ref\_iterator]( "LIEF::ref_iterator")<[segments\_t]( "LIEF::ELF::Binary::segments_t")&, [Segment]( "LIEF::ELF::Segment")\*> Iterator which outputs [Segment]()& object. #### [` it_const_segments `]() using it\_const\_segments = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [segments\_t]( "LIEF::ELF::Binary::segments_t")&, const [Segment]( "LIEF::ELF::Segment")\*> Iterator which outputs const [Segment]()& object. #### [` dynamic_entries_t `]() using dynamic\_entries\_t = std::vector<std::unique\_ptr<[DynamicEntry]( "LIEF::ELF::DynamicEntry")>> Internal container for storing ELF’s [DynamicEntry](). #### [` it_dynamic_entries `]() using it\_dynamic\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[dynamic\_entries\_t]( "LIEF::ELF::Binary::dynamic_entries_t")&, [DynamicEntry]( "LIEF::ELF::DynamicEntry")\*> Iterator which outputs [DynamicEntry]()& object. #### [` it_const_dynamic_entries `]() using it\_const\_dynamic\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [dynamic\_entries\_t]( "LIEF::ELF::Binary::dynamic_entries_t")&, const [DynamicEntry]( "LIEF::ELF::DynamicEntry")\*> Iterator which outputs const [DynamicEntry]()& object. #### [` symbols_version_t `]() using symbols\_version\_t = std::vector<std::unique\_ptr<[SymbolVersion]( "LIEF::ELF::SymbolVersion")>> Internal container for storing ELF’s [SymbolVersion](). #### [` it_symbols_version `]() using it\_symbols\_version = [ref\_iterator]( "LIEF::ref_iterator")<[symbols\_version\_t]( "LIEF::ELF::Binary::symbols_version_t")&, [SymbolVersion]( "LIEF::ELF::SymbolVersion")\*> Iterator which outputs [SymbolVersion]()& object. #### [` it_const_symbols_version `]() using it\_const\_symbols\_version = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [symbols\_version\_t]( "LIEF::ELF::Binary::symbols_version_t")&, const [SymbolVersion]( "LIEF::ELF::SymbolVersion")\*> Iterator which outputs const [SymbolVersion]()& object. #### [` relocations_t `]() using relocations\_t = std::vector<std::unique\_ptr<[Relocation]( "LIEF::ELF::Relocation")>> Internal container for storing ELF’s [Relocation](). #### [` it_pltgot_relocations `]() using it\_pltgot\_relocations = [filter\_iterator]( "LIEF::filter_iterator")<[relocations\_t]( "LIEF::ELF::Binary::relocations_t")&, [Relocation]( "LIEF::ELF::Relocation")\*> Iterator which outputs plt/got [Relocation]()& object. #### [` it_const_pltgot_relocations `]() using it\_const\_pltgot\_relocations = [const\_filter\_iterator]( "LIEF::const_filter_iterator")<const [relocations\_t]( "LIEF::ELF::Binary::relocations_t")&, const [Relocation]( "LIEF::ELF::Relocation")\*> Iterator which outputs plt/got const [Relocation]()& object. #### [` it_dynamic_relocations `]() using it\_dynamic\_relocations = [filter\_iterator]( "LIEF::filter_iterator")<[relocations\_t]( "LIEF::ELF::Binary::relocations_t")&, [Relocation]( "LIEF::ELF::Relocation")\*> Iterator which outputs dynamic [Relocation]()& object (not related to the PLT/GOT mechanism). #### [` it_const_dynamic_relocations `]() using it\_const\_dynamic\_relocations = [const\_filter\_iterator]( "LIEF::const_filter_iterator")<const [relocations\_t]( "LIEF::ELF::Binary::relocations_t")&, const [Relocation]( "LIEF::ELF::Relocation")\*> Iterator which outputs dynamic const [Relocation]()& object (not related to the PLT/GOT mechanism). #### [` it_object_relocations `]() using it\_object\_relocations = [filter\_iterator]( "LIEF::filter_iterator")<[relocations\_t]( "LIEF::ELF::Binary::relocations_t")&, [Relocation]( "LIEF::ELF::Relocation")\*> Iterator which outputs [Relocation]()& object found in object files (.o). #### [` it_const_object_relocations `]() using it\_const\_object\_relocations = [const\_filter\_iterator]( "LIEF::const_filter_iterator")<const [relocations\_t]( "LIEF::ELF::Binary::relocations_t")&, const [Relocation]( "LIEF::ELF::Relocation")\*> Iterator which outputs const [Relocation]()& object found in object files (.o). #### [` it_relocations `]() using it\_relocations = [ref\_iterator]( "LIEF::ref_iterator")<[relocations\_t]( "LIEF::ELF::Binary::relocations_t")&, [Relocation]( "LIEF::ELF::Relocation")\*> Iterator which outputs [Relocation]()& object. #### [` it_const_relocations `]() using it\_const\_relocations = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [relocations\_t]( "LIEF::ELF::Binary::relocations_t")&, const [Relocation]( "LIEF::ELF::Relocation")\*> Iterator which outputs const [Relocation]()& object. #### [` symbols_t `]() using symbols\_t = std::vector<std::unique\_ptr<[Symbol]( "LIEF::ELF::Symbol")>> Internal container for storing ELF’s [Symbol](). #### [` it_dynamic_symbols `]() using it\_dynamic\_symbols = [ref\_iterator]( "LIEF::ref_iterator")<[symbols\_t]( "LIEF::ELF::Binary::symbols_t")&, [Symbol]( "LIEF::ELF::Symbol")\*> Iterator which outputs the Dynamic [Symbol]()& object. #### [` it_const_dynamic_symbols `]() using it\_const\_dynamic\_symbols = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [symbols\_t]( "LIEF::ELF::Binary::symbols_t")&, const [Symbol]( "LIEF::ELF::Symbol")\*> Iterator which outputs the Dynamic const [Symbol]()& object. #### [` it_symtab_symbols `]() using it\_symtab\_symbols = [ref\_iterator]( "LIEF::ref_iterator")<[symbols\_t]( "LIEF::ELF::Binary::symbols_t")&, [Symbol]( "LIEF::ELF::Symbol")\*> Iterator which outputs the static/debug [Symbol]()& object. #### [` it_const_symtab_symbols `]() using it\_const\_symtab\_symbols = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [symbols\_t]( "LIEF::ELF::Binary::symbols_t")&, const [Symbol]( "LIEF::ELF::Symbol")\*> Iterator which outputs the static/debug const [Symbol]()& object. #### [` it_symbols `]() using it\_symbols = [ref\_iterator]( "LIEF::ref_iterator")<std::vector<[Symbol]( "LIEF::ELF::Symbol")\*>> Iterator which outputs static and dynamic [Symbol]()& object. #### [` it_const_symbols `]() using it\_const\_symbols = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<std::vector<[Symbol]( "LIEF::ELF::Symbol")\*>> Iterator which outputs static and dynamic const [Symbol]()& object. #### [` it_exported_symbols `]() using it\_exported\_symbols = [filter\_iterator]( "LIEF::filter_iterator")<std::vector<[Symbol]( "LIEF::ELF::Symbol")\*>> Iterator which outputs exported [Symbol]()& object. #### [` it_const_exported_symbols `]() using it\_const\_exported\_symbols = [const\_filter\_iterator]( "LIEF::const_filter_iterator")<std::vector<[Symbol]( "LIEF::ELF::Symbol")\*>> Iterator which outputs exported const [Symbol]()& object. #### [` it_imported_symbols `]() using it\_imported\_symbols = [filter\_iterator]( "LIEF::filter_iterator")<std::vector<[Symbol]( "LIEF::ELF::Symbol")\*>> Iterator which outputs imported [Symbol]()& object. #### [` it_const_imported_symbols `]() using it\_const\_imported\_symbols = [const\_filter\_iterator]( "LIEF::const_filter_iterator")<std::vector<[Symbol]( "LIEF::ELF::Symbol")\*>> Iterator which outputs imported const [Symbol]()& object. #### [` sections_t `]() using sections\_t = std::vector<std::unique\_ptr<[Section]( "LIEF::ELF::Section")>> Internal container for storing ELF’s [Section](). #### [` it_sections `]() using it\_sections = [ref\_iterator]( "LIEF::ref_iterator")<[sections\_t]( "LIEF::ELF::Binary::sections_t")&, [Section]( "LIEF::ELF::Section")\*> Iterator which outputs [Section]()& object. #### [` it_const_sections `]() using it\_const\_sections = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [sections\_t]( "LIEF::ELF::Binary::sections_t")&, const [Section]( "LIEF::ELF::Section")\*> Iterator which outputs const [Section]()& object. Public Functions #### [` operator= `]() [Binary]( "LIEF::ELF::Binary") &operator=(const [Binary]( "LIEF::ELF::Binary")&) = delete #### [` Binary `]() Binary(const [Binary]( "LIEF::ELF::Binary::Binary") &copy) = delete #### [` type `]() inline [Header]( "LIEF::ELF::Header")::[CLASS]( "LIEF::ELF::Header::CLASS") type() const Return binary’s class (ELF32 or ELF64). #### [` header `]() inline [Header]( "LIEF::ELF::Header") &header() Return [Elf header]() . #### [` header `]() inline const [Header]( "LIEF::ELF::Header") &header() const #### [` last_offset_section `]() uint64\_t last\_offset\_section() const Return the last offset used in binary according to sections table. #### [` last_offset_segment `]() uint64\_t last\_offset\_segment() const Return the last offset used in binary according to segments table. #### [` next_virtual_address `]() uint64\_t next\_virtual\_address() const Return the next virtual address available. #### [` sections `]() inline [it\_sections]( "LIEF::ELF::Binary::it_sections") sections() Return an iterator over the binary’s sections. #### [` sections `]() inline [it\_const\_sections]( "LIEF::ELF::Binary::it_const_sections") sections() const #### [` entrypoint `]() inline virtual uint64\_t entrypoint() const override Return the binary’s entrypoint. #### [` segments `]() inline [it\_segments]( "LIEF::ELF::Binary::it_segments") segments() Return binary’s segments. #### [` segments `]() inline [it\_const\_segments]( "LIEF::ELF::Binary::it_const_segments") segments() const #### [` dynamic_entries `]() inline [it\_dynamic\_entries]( "LIEF::ELF::Binary::it_dynamic_entries") dynamic\_entries() Return binary’s dynamic entries. #### [` dynamic_entries `]() inline [it\_const\_dynamic\_entries]( "LIEF::ELF::Binary::it_const_dynamic_entries") dynamic\_entries() const #### [` add `]() [DynamicEntry]( "LIEF::ELF::DynamicEntry") &add(const [DynamicEntry]( "LIEF::ELF::DynamicEntry") &entry) Add the given dynamic entry and return the new entry. #### [` add `]() [Note]( "LIEF::ELF::Note") &add(const [Note]( "LIEF::ELF::Note") &note) Add the given note and return the created entry. #### [` remove `]() void remove(const [DynamicEntry]( "LIEF::ELF::DynamicEntry") &entry) Remove the given dynamic entry. #### [` remove `]() void remove([DynamicEntry]( "LIEF::ELF::DynamicEntry")::[TAG]( "LIEF::ELF::DynamicEntry::TAG") tag) Remove **all** dynamic entries with the given tag. #### [` remove `]() void remove(const [Section]( "LIEF::ELF::Section") &section, bool clear = false) Remove the given section. The `clear` parameter can be used to zeroize the original content beforehand. **Parameters:** - **section** – **[in]** The section to remove - **clear** – **[in]** Whether zeroize the original content #### [` remove `]() void remove(const [Note]( "LIEF::ELF::Note") &note) Remove the given note. #### [` remove `]() void remove([Note]( "LIEF::ELF::Note")::[TYPE]( "LIEF::ELF::Note::TYPE") type) Remove **all** notes with the given type. #### [` remove `]() void remove(const [Segment]( "LIEF::ELF::Segment") &seg, bool clear = false) Remove the given segment. If `clear` is set, the original content of the segment will be filled with zeros before removal. #### [` remove `]() void remove([Segment]( "LIEF::ELF::Segment")::[TYPE]( "LIEF::ELF::Segment::TYPE") type, bool clear = false) Remove all segments associated with the given type. If `clear` is set, the original content of the segment will be filled with zeros before removal. #### [` dynamic_symbols `]() inline [it\_dynamic\_symbols]( "LIEF::ELF::Binary::it_dynamic_symbols") dynamic\_symbols() Return an iterator over the binary’s dynamic symbols The dynamic symbols are those located in the `.dynsym` section. #### [` dynamic_symbols `]() inline [it\_const\_dynamic\_symbols]( "LIEF::ELF::Binary::it_const_dynamic_symbols") dynamic\_symbols() const #### [` exported_symbols `]() [it\_exported\_symbols]( "LIEF::ELF::Binary::it_exported_symbols") exported\_symbols() Return symbols which are exported by the binary. #### [` exported_symbols `]() [it\_const\_exported\_symbols]( "LIEF::ELF::Binary::it_const_exported_symbols") exported\_symbols() const #### [` imported_symbols `]() [it\_imported\_symbols]( "LIEF::ELF::Binary::it_imported_symbols") imported\_symbols() Return symbols which are imported by the binary. #### [` imported_symbols `]() [it\_const\_imported\_symbols]( "LIEF::ELF::Binary::it_const_imported_symbols") imported\_symbols() const #### [` symtab_symbols `]() inline [it\_symtab\_symbols]( "LIEF::ELF::Binary::it_symtab_symbols") symtab\_symbols() Return the debug symbols from the `.symtab` section. #### [` symtab_symbols `]() inline [it\_const\_symtab\_symbols]( "LIEF::ELF::Binary::it_const_symtab_symbols") symtab\_symbols() const #### [` symbols_version `]() inline [it\_symbols\_version]( "LIEF::ELF::Binary::it_symbols_version") symbols\_version() Return the symbol versions. #### [` symbols_version `]() inline [it\_const\_symbols\_version]( "LIEF::ELF::Binary::it_const_symbols_version") symbols\_version() const #### [` symbols_version_definition `]() inline [it\_symbols\_version\_definition]( "LIEF::ELF::Binary::it_symbols_version_definition") symbols\_version\_definition() Return symbols version definition. #### [` symbols_version_definition `]() inline [it\_const\_symbols\_version\_definition]( "LIEF::ELF::Binary::it_const_symbols_version_definition") symbols\_version\_definition() const #### [` symbols_version_requirement `]() inline [it\_symbols\_version\_requirement]( "LIEF::ELF::Binary::it_symbols_version_requirement") symbols\_version\_requirement() Return [Symbol]() version requirement. #### [` symbols_version_requirement `]() inline [it\_const\_symbols\_version\_requirement]( "LIEF::ELF::Binary::it_const_symbols_version_requirement") symbols\_version\_requirement() const #### [` dynamic_relocations `]() [it\_dynamic\_relocations]( "LIEF::ELF::Binary::it_dynamic_relocations") dynamic\_relocations() Return dynamic relocations. #### [` dynamic_relocations `]() [it\_const\_dynamic\_relocations]( "LIEF::ELF::Binary::it_const_dynamic_relocations") dynamic\_relocations() const #### [` add_dynamic_relocation `]() [Relocation]( "LIEF::ELF::Relocation") &add\_dynamic\_relocation(const [Relocation]( "LIEF::ELF::Relocation") &relocation) Add a new *dynamic* relocation. We consider a dynamic relocation as a relocation which is not plt-related See: add\_pltgot\_relocation #### [` add_pltgot_relocation `]() [Relocation]( "LIEF::ELF::Relocation") &add\_pltgot\_relocation(const [Relocation]( "LIEF::ELF::Relocation") &relocation) Add a .plt.got relocation. This kind of relocation is usually associated with a PLT stub that aims at resolving the underlying symbol. See also: add\_dynamic\_relocation #### [` add_object_relocation `]() [Relocation]( "LIEF::ELF::Relocation") \*add\_object\_relocation(const [Relocation]( "LIEF::ELF::Relocation") &relocation, const [Section]( "LIEF::ELF::Section") &section) Add relocation for object file (.o). The first parameter is the section to add while the second parameter is the [LIEF::ELF::Section]() associated with the relocation. If there is an error, this function returns a `nullptr`. Otherwise, it returns the relocation added. #### [` pltgot_relocations `]() [it\_pltgot\_relocations]( "LIEF::ELF::Binary::it_pltgot_relocations") pltgot\_relocations() Return `plt.got` relocations. #### [` pltgot_relocations `]() [it\_const\_pltgot\_relocations]( "LIEF::ELF::Binary::it_const_pltgot_relocations") pltgot\_relocations() const #### [` object_relocations `]() [it\_object\_relocations]( "LIEF::ELF::Binary::it_object_relocations") object\_relocations() Return relocations used in an object file (`*.o`). #### [` object_relocations `]() [it\_const\_object\_relocations]( "LIEF::ELF::Binary::it_const_object_relocations") object\_relocations() const #### [` relocations `]() inline [it\_relocations]( "LIEF::ELF::Binary::it_relocations") relocations() Return **all** relocations present in the binary. #### [` relocations `]() inline [it\_const\_relocations]( "LIEF::ELF::Binary::it_const_relocations") relocations() const #### [` get_relocation `]() const [Relocation]( "LIEF::ELF::Relocation") \*get\_relocation(uint64\_t address) const Return relocation associated with the given address. It returns a `nullptr` if it is not found. #### [` get_relocation `]() inline [Relocation]( "LIEF::ELF::Relocation") \*get\_relocation(uint64\_t address) #### [` get_relocation `]() const [Relocation]( "LIEF::ELF::Relocation") \*get\_relocation(const [Symbol]( "LIEF::ELF::Symbol") &symbol) const Return relocation associated with the given [Symbol]() It returns a `nullptr` if it is not found. #### [` get_relocation `]() inline [Relocation]( "LIEF::ELF::Relocation") \*get\_relocation(const [Symbol]( "LIEF::ELF::Symbol") &symbol) #### [` get_relocation `]() const [Relocation]( "LIEF::ELF::Relocation") \*get\_relocation(const std::string &symbol\_name) const Return relocation associated with the given [Symbol]() name It returns a `nullptr` if it is not found. #### [` get_relocation `]() inline [Relocation]( "LIEF::ELF::Relocation") \*get\_relocation(const std::string &symbol\_name) #### [` use_gnu_hash `]() inline bool use\_gnu\_hash() const `true` if GNU hash is used > **See also** > > [gnu\_hash]() and [use\_sysv\_hash]() #### [` gnu_hash `]() inline const [GnuHash]( "LIEF::ELF::GnuHash") \*gnu\_hash() const Return the [GnuHash]() object in **readonly** If the ELF binary does not use the GNU hash table, return a nullptr. #### [` use_sysv_hash `]() inline bool use\_sysv\_hash() const `true` if SYSV hash is used > **See also** > > [sysv\_hash]() and [use\_gnu\_hash]() #### [` sysv_hash `]() inline const [SysvHash]( "LIEF::ELF::SysvHash") \*sysv\_hash() const Return the [SysvHash]() object as a **read-only** object If the ELF binary does not use the legacy sysv hash table, return a nullptr. #### [` has_section `]() inline bool has\_section(const std::string &name) const Check if a section with the given name exists in the binary. #### [` has_section_with_offset `]() bool has\_section\_with\_offset(uint64\_t offset) const Check if a section that handles the given offset exists. #### [` has_section_with_va `]() bool has\_section\_with\_va(uint64\_t va) const Check if a section that handles the given virtual address exists. #### [` get_section `]() inline [Section]( "LIEF::ELF::Section") \*get\_section(std::string\_view name) Return [Section]() with the given `name`. If the section can’t be found, it returns a nullptr. #### [` get_section `]() const [Section]( "LIEF::ELF::Section") \*get\_section(std::string\_view name) const #### [` text_section `]() inline [Section]( "LIEF::ELF::Section") \*text\_section() Return the `.text` section. If the section can’t be found, it returns a nullptr. #### [` dynamic_section `]() [Section]( "LIEF::ELF::Section") \*dynamic\_section() Return the `.dynamic` section. If the section can’t be found, it returns a nullptr. #### [` hash_section `]() [Section]( "LIEF::ELF::Section") \*hash\_section() Return the hash section. If the section can’t be found, it returns a nullptr. #### [` symtab_symbols_section `]() [Section]( "LIEF::ELF::Section") \*symtab\_symbols\_section() Return section which holds the symtab symbols. If the section can’t be found, it returns a nullptr. #### [` imagebase `]() virtual uint64\_t imagebase() const override Return program image base. For instance `0x40000`. To compute the image base, we look for the PT\_PHDR segment header (phdr), and we return `phdr->p_vaddr - phdr->p_offset` #### [` virtual_size `]() virtual uint64\_t virtual\_size() const override Return the size of the mapped binary. #### [` has_interpreter `]() bool has\_interpreter() const Check if the binary uses a loader (also named linker or interpreter). > **See also** > > [interpreter]() #### [` interpreter `]() inline std::string\_view interpreter() const Return the ELF interpreter if any. (e.g. `/lib64/ld-linux-x86-64.so.2`) If the binary does not have an interpreter, it returns an empty string. > **See also** > > [has\_interpreter]() #### [` interpreter `]() inline void interpreter(const std::string &interpreter) Change the interpreter. #### [` symbols `]() inline [it\_symbols]( "LIEF::ELF::Binary::it_symbols") symbols() Return an iterator on both static and dynamic symbols. #### [` symbols `]() inline [it\_const\_symbols]( "LIEF::ELF::Binary::it_const_symbols") symbols() const #### [` export_symbol `]() [Symbol]( "LIEF::ELF::Symbol") &export\_symbol(const [Symbol]( "LIEF::ELF::Symbol") &symbol) Export the given symbol and create it if it doesn’t exist. #### [` export_symbol `]() [Symbol]( "LIEF::ELF::Symbol") &export\_symbol(const std::string &symbol\_name, uint64\_t value = 0) Export the symbol with the given name and create it if it doesn’t exist. #### [` has_dynamic_symbol `]() inline bool has\_dynamic\_symbol(const std::string &name) const Check if the symbol with the given `name` exists in the dynamic symbols table. #### [` get_dynamic_symbol `]() const [Symbol]( "LIEF::ELF::Symbol") \*get\_dynamic\_symbol(const std::string &name) const Get the dynamic symbol from the given name. Return a nullptr if it can’t be found. #### [` get_dynamic_symbol `]() inline [Symbol]( "LIEF::ELF::Symbol") \*get\_dynamic\_symbol(const std::string &name) #### [` has_symtab_symbol `]() inline bool has\_symtab\_symbol(const std::string &name) const Check if the symbol with the given `name` exists in the symtab symbol table. #### [` get_symtab_symbol `]() const [Symbol]( "LIEF::ELF::Symbol") \*get\_symtab\_symbol(const std::string &name) const Get the symtab symbol from the given name Return a nullptr if it can’t be found. #### [` get_symtab_symbol `]() inline [Symbol]( "LIEF::ELF::Symbol") \*get\_symtab\_symbol(const std::string &name) #### [` strings `]() [string\_list\_t]( "LIEF::ELF::Binary::string_list_t") strings(size\_t min\_size = 5) const Return list of the strings used by the ELF binary. Basically, this function looks for strings in the `.rodata` section #### [` remove_symbol `]() void remove\_symbol(const std::string &name) Remove symbols with the given name in both: - dynamic symbols - symtab symbols > **See also** > > [remove\_symtab\_symbol](), [remove\_dynamic\_symbol]() #### [` remove_symtab_symbol `]() void remove\_symtab\_symbol(const std::string &name) Remove symtab symbols with the given name. #### [` remove_symtab_symbol `]() void remove\_symtab\_symbol([Symbol]( "LIEF::ELF::Symbol") \*symbol) #### [` remove_dynamic_symbol `]() void remove\_dynamic\_symbol(const std::string &name) Remove dynamic symbols with the given name. #### [` remove_dynamic_symbol `]() void remove\_dynamic\_symbol([Symbol]( "LIEF::ELF::Symbol") \*symbol) Remove the given symbol from the dynamic symbols table. As a side effect, it will remove any [ELF::Relocation]() that refers to this symbol and the [SymbolVersion]() (if any) associated with this symbol #### [` get_function_address `]() virtual [result]( "LIEF::result")<uint64\_t> get\_function\_address(const std::string &func\_name) const override Return the address of the given function name. #### [` get_function_address `]() [result]( "LIEF::result")<uint64\_t> get\_function\_address(const std::string &func\_name, bool demangled) const Return the address of the given function name. **Parameters:** - **func\_name** – **[in]** The function’s name target - **demangled** – **[in]** Use the demangled name #### [` add `]() [Section]( "LIEF::ELF::Section") \*add(const [Section]( "LIEF::ELF::Section") &section, bool loaded = true, [SEC\_INSERT\_POS]( "LIEF::ELF::Binary::SEC_INSERT_POS") pos = [SEC\_INSERT\_POS]( "LIEF::ELF::Binary::SEC_INSERT_POS")::[AUTO]( "LIEF::ELF::Binary::SEC_INSERT_POS::AUTO")) Add a new section in the binary. This function requires a well-formed ELF binary **Parameters:** - **section** – **[in]** The section object to insert - **loaded** – **[in]** Boolean value to indicate that section’s data must be loaded by a PT\_LOAD segment - **pos** – **[in]** Position where to insert the data in the sections table **Returns:** The section added. The `size` and the `virtual address` might change. #### [` extend `]() [Section]( "LIEF::ELF::Section") \*extend(const [Section]( "LIEF::ELF::Section") &section, uint64\_t size) #### [` add_symtab_symbol `]() [Symbol]( "LIEF::ELF::Symbol") &add\_symtab\_symbol(const [Symbol]( "LIEF::ELF::Symbol") &symbol) Add a symtab symbol. #### [` add_dynamic_symbol `]() [Symbol]( "LIEF::ELF::Symbol") &add\_dynamic\_symbol(const [Symbol]( "LIEF::ELF::Symbol") &symbol, const [SymbolVersion]( "LIEF::ELF::SymbolVersion") \*version = nullptr) Add a dynamic symbol with the associated [SymbolVersion](). #### [` add_exported_function `]() [Symbol]( "LIEF::ELF::Symbol") &add\_exported\_function(uint64\_t address, const std::string &name = "") Create a symbol for the function at the given address and export it. #### [` add_library `]() [DynamicEntryLibrary]( "LIEF::ELF::DynamicEntryLibrary") &add\_library(const std::string &library\_name) Add a library as dependency. #### [` remove_library `]() void remove\_library(const std::string &library\_name) Remove the given library from the dependencies. #### [` get_library `]() inline [DynamicEntryLibrary]( "LIEF::ELF::DynamicEntryLibrary") \*get\_library(const std::string &library\_name) Get the library object ([DynamicEntryLibrary]()) from the given name If the library can’t be found, it returns a nullptr. #### [` get_library `]() const [DynamicEntryLibrary]( "LIEF::ELF::DynamicEntryLibrary") \*get\_library(const std::string &library\_name) const Get the library object ([DynamicEntryLibrary]()) from the given name If the library can’t be found, it returns a nullptr. #### [` has_library `]() inline bool has\_library(const std::string &name) const Check if the given library name exists in the current binary. #### [` add `]() [Segment]( "LIEF::ELF::Segment") \*add(const [Segment]( "LIEF::ELF::Segment") &segment, uint64\_t base = 0) Add a new segment in the binary. The segment is inserted at the end This function requires a well-formed ELF binary **Returns:** The segment added. `Virtual address` and `File Offset` might change. #### [` replace `]() [Segment]( "LIEF::ELF::Segment") \*replace(const [Segment]( "LIEF::ELF::Segment") &new\_segment, const [Segment]( "LIEF::ELF::Segment") &original\_segment, uint64\_t base = 0) Replace the segment given in 2nd parameter with the segment given in the first one and return the updated segment. > **Warning** > > The `original_segment` is no longer valid after this function #### [` extend `]() [Segment]( "LIEF::ELF::Segment") \*extend(const [Segment]( "LIEF::ELF::Segment") &segment, uint64\_t size) #### [` patch_address `]() virtual void patch\_address(uint64\_t address, const std::vector<uint8\_t> &patch\_value, LIEF::[Binary]( "LIEF::Binary")::[VA\_TYPES]( "LIEF::Binary::VA_TYPES") addr\_type = LIEF::[Binary]( "LIEF::Binary")::[VA\_TYPES]( "LIEF::Binary::VA_TYPES")::[AUTO]( "LIEF::Binary::VA_TYPES::AUTO")) override Patch the content at virtual address `address` with `patch_value`. **Parameters:** - **address** – **[in]** Address to patch - **patch\_value** – **[in]** Patch to apply - **addr\_type** – **[in]** Specify if the address should be used as an absolute virtual address or an RVA #### [` patch_address `]() virtual void patch\_address(uint64\_t address, uint64\_t patch\_value, size\_t size = sizeof(uint64\_t), LIEF::[Binary]( "LIEF::Binary")::[VA\_TYPES]( "LIEF::Binary::VA_TYPES") addr\_type = LIEF::[Binary]( "LIEF::Binary")::[VA\_TYPES]( "LIEF::Binary::VA_TYPES")::[AUTO]( "LIEF::Binary::VA_TYPES::AUTO")) override Patch the address with the given value. **Parameters:** - **address** – **[in]** Address to patch - **patch\_value** – **[in]** Patch to apply - **size** – **[in]** Size of the value in **bytes** (1, 2, … 8) - **addr\_type** – **[in]** Specify if the address should be used as an absolute virtual address or an RVA #### [` patch_pltgot `]() void patch\_pltgot(const [Symbol]( "LIEF::ELF::Symbol") &symbol, uint64\_t address) Patch the imported symbol with the `address`. **Parameters:** - **symbol** – **[in]** Imported symbol to patch - **address** – **[in]** New address #### [` patch_pltgot `]() void patch\_pltgot(const std::string &symbol\_name, uint64\_t address) Patch the imported symbol’s name with the `address`. **Parameters:** - **symbol\_name** – **[in]** Imported symbol’s name to patch - **address** – **[in]** New address #### [` strip `]() void strip() Strip the binary by removing symtab symbols. #### [` remove_section `]() virtual void remove\_section(const std::string &name, bool clear = false) override Remove a binary’s section. **Parameters:** - **name** – **[in]** The name of the section to remove - **clear** – **[in]** Whether zeroize the original content #### [` write `]() inline void write(const std::string &filename) Reconstruct the binary object and write it in `filename`. This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run). **Parameters:** **filename** – Path for the written ELF binary #### [` write `]() void write(const std::string &filename, const [Builder]( "LIEF::ELF::Builder")::[config\_t]( "LIEF::ELF::Builder::config_t") &config) Reconstruct the binary object with the given config and write it in `filename`. This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run). **Parameters:** - **filename** – Path for the written ELF binary - **config** – [Builder]() configuration #### [` write `]() inline void write(std::ostream &os) Reconstruct the binary object and write it in `os` stream. This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run). **Parameters:** **os** – Output stream for the written ELF binary #### [` write `]() void write(std::ostream &os, const [Builder]( "LIEF::ELF::Builder")::[config\_t]( "LIEF::ELF::Builder::config_t") &config) Reconstruct the binary object with the given config and write it in `os` stream. **Parameters:** - **os** – Output stream for the written ELF binary - **config** – [Builder]() configuration #### [` raw `]() std::vector<uint8\_t> raw() Reconstruct the binary object and return its content as a byte vector. #### [` virtual_address_to_offset `]() [result]( "LIEF::result")<uint64\_t> virtual\_address\_to\_offset(uint64\_t virtual\_address) const Convert a virtual address to a file offset. #### [` offset_to_virtual_address `]() virtual [result]( "LIEF::result")<uint64\_t> offset\_to\_virtual\_address(uint64\_t offset, uint64\_t slide = 0) const override Convert the given offset into a virtual address. **Parameters:** - **offset** – **[in]** The offset to convert. - **slide** – **[in]** If not 0, it will replace the default base address (if any) #### [` is_pie `]() virtual bool is\_pie() const override Check if the binary has been compiled with `-fpie -pie` flags. To do so we check if there is a `PT_INTERP` segment and if the binary type is `ET_DYN` (Shared object) #### [` has_nx `]() virtual bool has\_nx() const override Check if the binary uses the `NX` protection (Non executable stack). #### [` dynsym_idx `]() int64\_t dynsym\_idx(const std::string &name) const [Symbol]() index in the dynamic symbol table or -1 if the symbol does not exist. #### [` dynsym_idx `]() int64\_t dynsym\_idx(const [Symbol]( "LIEF::ELF::Symbol") &sym) const #### [` symtab_idx `]() int64\_t symtab\_idx(const std::string &name) const [Symbol]() index from the `.symtab` section or -1 if the symbol is not present. #### [` symtab_idx `]() int64\_t symtab\_idx(const [Symbol]( "LIEF::ELF::Symbol") &sym) const #### [` section_from_offset `]() const [Section]( "LIEF::ELF::Section") \*section\_from\_offset(uint64\_t offset, bool skip\_nobits = true) const Return the [ELF::Section]() from the given `offset`. Return a nullptr if a section can’t be found. If `skip_nobits` is set (which is the case by default), this function won’t consider section for which the type is `SHT_NOBITS` (like `.bss, .tbss, ...`) #### [` section_from_offset `]() inline [Section]( "LIEF::ELF::Section") \*section\_from\_offset(uint64\_t offset, bool skip\_nobits = true) #### [` section_from_virtual_address `]() const [Section]( "LIEF::ELF::Section") \*section\_from\_virtual\_address(uint64\_t address, bool skip\_nobits = true) const Return the [ELF::Section]() from the given `address`. Return a nullptr if a section can’t be found. If `skip_nobits` is set (which is the case by default), this function won’t consider section for which type is `SHT_NOBITS` (like `.bss, .tbss, ...`) #### [` section_from_virtual_address `]() inline [Section]( "LIEF::ELF::Section") \*section\_from\_virtual\_address(uint64\_t address, bool skip\_nobits = true) #### [` segment_from_virtual_address `]() const [Segment]( "LIEF::ELF::Segment") \*segment\_from\_virtual\_address(uint64\_t address) const Return the [ELF::Segment]() from the given `address`. Return a nullptr if a segment can’t be found. #### [` segment_from_virtual_address `]() inline [Segment]( "LIEF::ELF::Segment") \*segment\_from\_virtual\_address(uint64\_t address) #### [` segment_from_virtual_address `]() const [Segment]( "LIEF::ELF::Segment") \*segment\_from\_virtual\_address([Segment]( "LIEF::ELF::Segment")::[TYPE]( "LIEF::ELF::Segment::TYPE") type, uint64\_t address) const #### [` segment_from_virtual_address `]() inline [Segment]( "LIEF::ELF::Segment") \*segment\_from\_virtual\_address([Segment]( "LIEF::ELF::Segment")::[TYPE]( "LIEF::ELF::Segment::TYPE") type, uint64\_t address) #### [` segment_from_offset `]() const [Segment]( "LIEF::ELF::Segment") \*segment\_from\_offset(uint64\_t offset) const Return the [ELF::Segment]() from the `offset`. Return a nullptr if a segment can’t be found. #### [` segment_from_offset `]() inline [Segment]( "LIEF::ELF::Segment") \*segment\_from\_offset(uint64\_t offset) #### [` get `]() const [DynamicEntry]( "LIEF::ELF::DynamicEntry") \*get([DynamicEntry]( "LIEF::ELF::DynamicEntry")::[TAG]( "LIEF::ELF::DynamicEntry::TAG") tag) const Return the **first** [ELF::DynamicEntry]() associated with the given tag If the tag can’t be found, it returns a nullptr. #### [` get `]() inline [DynamicEntry]( "LIEF::ELF::DynamicEntry") \*get([DynamicEntry]( "LIEF::ELF::DynamicEntry")::[TAG]( "LIEF::ELF::DynamicEntry::TAG") tag) #### [` get `]() const [Segment]( "LIEF::ELF::Segment") \*get([Segment]( "LIEF::ELF::Segment")::[TYPE]( "LIEF::ELF::Segment::TYPE") type) const Return the **first** [ELF::Segment]() associated with the given type. If a segment can’t be found, it returns a nullptr. #### [` get `]() inline [Segment]( "LIEF::ELF::Segment") \*get([Segment]( "LIEF::ELF::Segment")::[TYPE]( "LIEF::ELF::Segment::TYPE") type) #### [` get `]() const [Note]( "LIEF::ELF::Note") \*get([Note]( "LIEF::ELF::Note")::[TYPE]( "LIEF::ELF::Note::TYPE") type) const Return the **first** [ELF::Note]() associated with the given type If a note can’t be found, it returns a nullptr. #### [` get `]() inline [Note]( "LIEF::ELF::Note") \*get([Note]( "LIEF::ELF::Note")::[TYPE]( "LIEF::ELF::Note::TYPE") type) #### [` get `]() const [Section]( "LIEF::ELF::Section") \*get([Section]( "LIEF::ELF::Section")::[TYPE]( "LIEF::ELF::Section::TYPE") type) const Return the **first** [ELF::Section]() associated with the given type If a section can’t be found, it returns a nullptr. #### [` get `]() inline [Section]( "LIEF::ELF::Section") \*get([Section]( "LIEF::ELF::Section")::[TYPE]( "LIEF::ELF::Section::TYPE") type) #### [` has `]() inline bool has([DynamicEntry]( "LIEF::ELF::DynamicEntry")::[TAG]( "LIEF::ELF::DynamicEntry::TAG") tag) const Check if an [ELF::DynamicEntry]() associated with the given tag exists. #### [` has `]() inline bool has([Segment]( "LIEF::ELF::Segment")::[TYPE]( "LIEF::ELF::Segment::TYPE") type) const Check if [ELF::Segment]() associated with the given type exists. #### [` has `]() inline bool has([Note]( "LIEF::ELF::Note")::[TYPE]( "LIEF::ELF::Note::TYPE") type) const Check if a [ELF::Note]() associated with the given type exists. #### [` has `]() inline bool has([Section]( "LIEF::ELF::Section")::[TYPE]( "LIEF::ELF::Section::TYPE") type) const Check if a [ELF::Section]() associated with the given type exists. #### [` get_content_from_virtual_address `]() virtual span<const uint8\_t> get\_content\_from\_virtual\_address(uint64\_t virtual\_address, uint64\_t size, [Binary]( "LIEF::ELF::Binary")::VA\_TYPES addr\_type = [Binary]( "LIEF::ELF::Binary")::VA\_TYPES::AUTO) const override Return the content located at virtual address. #### [` accept `]() virtual void accept(LIEF::Visitor &visitor) const override Method associated with the visitor pattern. #### [` permute_dynamic_symbols `]() void permute\_dynamic\_symbols(const std::vector<size\_t> &permutation) Apply the given permutation on the dynamic symbols table. #### [` ctor_functions `]() virtual LIEF::[Binary]( "LIEF::Binary")::[functions\_t]( "LIEF::Binary::functions_t") ctor\_functions() const override List of binary constructors (typically, the functions located in the `.init_array`). #### [` dtor_functions `]() LIEF::[Binary]( "LIEF::Binary")::[functions\_t]( "LIEF::Binary::functions_t") dtor\_functions() const List of the binary destructors (typically, the functions located in the `.fini_array`). #### [` functions `]() LIEF::[Binary]( "LIEF::Binary")::[functions\_t]( "LIEF::Binary::functions_t") functions() const List of the functions found in the binary. #### [` has_notes `]() bool has\_notes() const `true` if the binary embeds notes #### [` notes `]() inline [it\_const\_notes]( "LIEF::ELF::Binary::it_const_notes") notes() const Return an iterator over the ELF’s [LIEF::ELF::Note](). > **See also** > > has\_note #### [` notes `]() inline [it\_notes]( "LIEF::ELF::Binary::it_notes") notes() #### [` eof_offset `]() uint64\_t eof\_offset() const Return the last offset used by the ELF binary according to both: the sections table and the segments table. #### [` has_overlay `]() inline bool has\_overlay() const True if data are present at the end of the binary. #### [` overlay `]() inline span<const uint8\_t> overlay() const Overlay data (if any). #### [` overlay `]() inline void overlay(std::vector<uint8\_t> overlay) [Function]() to set the overlay. #### [` relocate_phdr_table `]() uint64\_t relocate\_phdr\_table([PHDR\_RELOC]( "LIEF::ELF::Binary::PHDR_RELOC") type) Force relocating the segments table in a specific way. This function can be used to enforce a specific relocation of the segments table. **Parameters:** **type** – **[in]** The relocation type to apply **Returns:** The offset of the new segments table or 0 if it fails with the given method. #### [` get_relocated_dynamic_array `]() std::vector<uint64\_t> get\_relocated\_dynamic\_array([DynamicEntry]( "LIEF::ELF::DynamicEntry")::[TAG]( "LIEF::ELF::DynamicEntry::TAG") tag) const Return the array defined by the given tag (e.g. [DynamicEntry::TAG::INIT\_ARRAY]()) with relocations applied (if any). #### [` is_targeting_android `]() bool is\_targeting\_android() const True if the current ELF is targeting Android. #### [` get_section_idx `]() inline [result]( "LIEF::result")<size\_t> get\_section\_idx(const [Section]( "LIEF::ELF::Section") &section) const Find the index of the section given in the first parameter. #### [` get_section_idx `]() inline [result]( "LIEF::result")<size\_t> get\_section\_idx(const std::string &name) const Find the index of the section with the name given in the first parameter. #### [` find_version_requirement `]() const [SymbolVersionRequirement]( "LIEF::ELF::SymbolVersionRequirement") \*find\_version\_requirement(const std::string &libname) const Try to find the [SymbolVersionRequirement]() associated with the given library name (e.g. `libc.so.6`). #### [` find_version_requirement `]() inline [SymbolVersionRequirement]( "LIEF::ELF::SymbolVersionRequirement") \*find\_version\_requirement(const std::string &name) #### [` remove_version_requirement `]() bool remove\_version\_requirement(const std::string &libname) Deletes all required symbol versions linked to the specified library name. The function returns true if the operation succeed, false otherwise. > **Warning** > > To maintain consistency, this function also removes versions associated with dynamic symbols that are linked to the specified library name. #### [` ptr_size `]() inline uint8\_t ptr\_size() const #### [` page_size `]() virtual uint64\_t page\_size() const override Get the default memory page size according to the architecture and the format of the current binary. #### [` layout_pagesize `]() uint64\_t layout\_pagesize() const #### [` hash `]() size\_t hash(const std::string &name) #### [` ~Binary `]() ~Binary() override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override #### [` operator+= `]() inline [Binary]( "LIEF::ELF::Binary") &operator+=(const [DynamicEntry]( "LIEF::ELF::DynamicEntry") &entry) #### [` operator+= `]() inline [Binary]( "LIEF::ELF::Binary") &operator+=(const [Section]( "LIEF::ELF::Section") &section) #### [` operator+= `]() inline [Binary]( "LIEF::ELF::Binary") &operator+=(const [Segment]( "LIEF::ELF::Segment") &segment) #### [` operator+= `]() inline [Binary]( "LIEF::ELF::Binary") &operator+=(const [Note]( "LIEF::ELF::Note") &note) #### [` operator-= `]() inline [Binary]( "LIEF::ELF::Binary") &operator-=(const [DynamicEntry]( "LIEF::ELF::DynamicEntry") &entry) #### [` operator-= `]() inline [Binary]( "LIEF::ELF::Binary") &operator-=([DynamicEntry]( "LIEF::ELF::DynamicEntry")::[TAG]( "LIEF::ELF::DynamicEntry::TAG") tag) #### [` operator-= `]() inline [Binary]( "LIEF::ELF::Binary") &operator-=(const [Note]( "LIEF::ELF::Note") &note) #### [` operator-= `]() inline [Binary]( "LIEF::ELF::Binary") &operator-=([Note]( "LIEF::ELF::Note")::[TYPE]( "LIEF::ELF::Note::TYPE") type) #### [` operator[] `]() inline [Segment]( "LIEF::ELF::Segment") \*operator[]([Segment]( "LIEF::ELF::Segment")::[TYPE]( "LIEF::ELF::Segment::TYPE") type) #### [` operator[] `]() inline const [Segment]( "LIEF::ELF::Segment") \*operator[]([Segment]( "LIEF::ELF::Segment")::[TYPE]( "LIEF::ELF::Segment::TYPE") type) const #### [` operator[] `]() inline [DynamicEntry]( "LIEF::ELF::DynamicEntry") \*operator[]([DynamicEntry]( "LIEF::ELF::DynamicEntry")::[TAG]( "LIEF::ELF::DynamicEntry::TAG") tag) #### [` operator[] `]() inline const [DynamicEntry]( "LIEF::ELF::DynamicEntry") \*operator[]([DynamicEntry]( "LIEF::ELF::DynamicEntry")::[TAG]( "LIEF::ELF::DynamicEntry::TAG") tag) const #### [` operator[] `]() inline [Note]( "LIEF::ELF::Note") \*operator[]([Note]( "LIEF::ELF::Note")::[TYPE]( "LIEF::ELF::Note::TYPE") type) #### [` operator[] `]() inline const [Note]( "LIEF::ELF::Note") \*operator[]([Note]( "LIEF::ELF::Note")::[TYPE]( "LIEF::ELF::Note::TYPE") type) const #### [` operator[] `]() inline [Section]( "LIEF::ELF::Section") \*operator[]([Section]( "LIEF::ELF::Section")::[TYPE]( "LIEF::ELF::Section::TYPE") type) #### [` operator[] `]() inline const [Section]( "LIEF::ELF::Section") \*operator[]([Section]( "LIEF::ELF::Section")::[TYPE]( "LIEF::ELF::Section::TYPE") type) const #### [` should_swap `]() inline bool should\_swap() const Public Static Functions #### [` classof `]() static inline bool classof(const LIEF::[Binary]( "LIEF::Binary") \*bin) --- ## [Header]() ### [` Header `]() class Header : public LIEF::Object Class which represents the ELF’s header. This class mirrors the raw ELF `Elfxx_Ehdr` structure. Public Types #### [` ELF_INDENT `]() enum ELF\_INDENT e\_ident size and indices. *Values:* ##### [` ELI_MAG0 `]() enumerator ELI\_MAG0 = 0 File identification index. ##### [` ELI_MAG1 `]() enumerator ELI\_MAG1 = 1 File identification index. ##### [` ELI_MAG2 `]() enumerator ELI\_MAG2 = 2 File identification index. ##### [` ELI_MAG3 `]() enumerator ELI\_MAG3 = 3 File identification index. ##### [` ELI_CLASS `]() enumerator ELI\_CLASS = 4 File class. ##### [` ELI_DATA `]() enumerator ELI\_DATA = 5 Data encoding. ##### [` ELI_VERSION `]() enumerator ELI\_VERSION = 6 File version. ##### [` ELI_OSABI `]() enumerator ELI\_OSABI = 7 OS/ABI identification. ##### [` ELI_ABIVERSION `]() enumerator ELI\_ABIVERSION = 8 ABI version. ##### [` ELI_PAD `]() enumerator ELI\_PAD = 9 Start of padding bytes. ##### [` ELI_NIDENT `]() enumerator ELI\_NIDENT = 16 Number of bytes in e\_ident. #### [` FILE_TYPE `]() enum class FILE\_TYPE The type of the underlying ELF file. This enum matches the semantic of `ET_NONE`, `ET_REL`, … *Values:* ##### [` NONE `]() enumerator NONE = 0 Can’t be determined. ##### [` REL `]() enumerator REL = 1 Relocatable file (or object file). ##### [` EXEC `]() enumerator EXEC = 2 non-pie executable ##### [` DYN `]() enumerator DYN = 3 Shared library **or** a pie-executable. ##### [` CORE `]() enumerator CORE = 4 Core dump file. #### [` VERSION `]() enum class VERSION Match the result of `Elfxx_Ehdr.e_version`. *Values:* ##### [` NONE `]() enumerator NONE = 0 Invalid ELF version. ##### [` CURRENT `]() enumerator CURRENT = 1 Current version (default). #### [` CLASS `]() enum class CLASS Match the result of `Elfxx_Ehdr.e_ident[EI_CLASS]`. *Values:* ##### [` NONE `]() enumerator NONE = 0 Invalid class. ##### [` ELF32 `]() enumerator ELF32 32-bit objects ##### [` ELF64 `]() enumerator ELF64 64-bit objects #### [` OS_ABI `]() enum class OS\_ABI Match the result `Elfxx_Ehdr.e_ident[EI_OSABI]`. *Values:* ##### [` SYSTEMV `]() enumerator SYSTEMV = 0 UNIX System V ABI. ##### [` HPUX `]() enumerator HPUX = 1 HP-UX operating system. ##### [` NETBSD `]() enumerator NETBSD = 2 NetBSD. ##### [` GNU `]() enumerator GNU = 3 GNU/Linux. ##### [` LINUX `]() enumerator LINUX = 3 Historical alias for ELFOSABI\_GNU. ##### [` HURD `]() enumerator HURD = 4 GNU/Hurd. ##### [` SOLARIS `]() enumerator SOLARIS = 6 Solaris. ##### [` AIX `]() enumerator AIX = 7 AIX. ##### [` IRIX `]() enumerator IRIX = 8 IRIX. ##### [` FREEBSD `]() enumerator FREEBSD = 9 FreeBSD. ##### [` TRU64 `]() enumerator TRU64 = 10 TRU64 UNIX. ##### [` MODESTO `]() enumerator MODESTO = 11 Novell Modesto. ##### [` OPENBSD `]() enumerator OPENBSD = 12 OpenBSD. ##### [` OPENVMS `]() enumerator OPENVMS = 13 OpenVMS. ##### [` NSK `]() enumerator NSK = 14 Hewlett-Packard Non-Stop Kernel. ##### [` AROS `]() enumerator AROS = 15 AROS. ##### [` FENIXOS `]() enumerator FENIXOS = 16 FenixOS. ##### [` CLOUDABI `]() enumerator CLOUDABI = 17 Nuxi CloudABI. ##### [` C6000_ELFABI `]() enumerator C6000\_ELFABI = 64 Bare-metal TMS320C6000. ##### [` AMDGPU_HSA `]() enumerator AMDGPU\_HSA = 64 AMD HSA runtime. ##### [` C6000_LINUX `]() enumerator C6000\_LINUX = 65 Linux TMS320C6000. ##### [` ARM `]() enumerator ARM = 97 ARM. ##### [` STANDALONE `]() enumerator STANDALONE = 255 Standalone (embedded) application. #### [` ELF_DATA `]() enum class ELF\_DATA Match the result `Elfxx_Ehdr.e_ident[EI_DATA]`. *Values:* ##### [` NONE `]() enumerator NONE = 0 Invalid data encoding. ##### [` LSB `]() enumerator LSB = 1 2’s complement, little endian ##### [` MSB `]() enumerator MSB = 2 2’s complement, big endian #### [` identity_t `]() using identity\_t = std::array<uint8\_t, 16> Public Functions #### [` Header `]() Header() = default #### [` operator= `]() [Header]( "LIEF::ELF::Header") &operator=(const [Header]( "LIEF::ELF::Header")&) = default #### [` Header `]() Header(const [Header]( "LIEF::ELF::Header::Header")&) = default #### [` ~Header `]() ~Header() override = default #### [` file_type `]() inline [FILE\_TYPE]( "LIEF::ELF::Header::FILE_TYPE") file\_type() const Define the object file type. (e.g. executable, library…). #### [` machine_type `]() inline [ARCH]( "LIEF::ELF::ARCH") machine\_type() const Target architecture. #### [` object_file_version `]() inline [VERSION]( "LIEF::ELF::Header::VERSION") object\_file\_version() const Version of the object file format. #### [` entrypoint `]() inline uint64\_t entrypoint() const Executable entrypoint. #### [` program_headers_offset `]() inline uint64\_t program\_headers\_offset() const Offset of the programs table (also known as segments table). #### [` section_headers_offset `]() inline uint64\_t section\_headers\_offset() const Offset of the sections table. #### [` processor_flag `]() inline uint32\_t processor\_flag() const Processor-specific flags. #### [` header_size `]() inline uint32\_t header\_size() const Size of the current header (i.e. `sizeof(Elfxx_Ehdr)`) This size should be 64 for an `ELF64` binary and 52 for an `ELF32`. #### [` program_header_size `]() inline uint32\_t program\_header\_size() const Return the size of a program header (i.e. `sizeof(Elfxx_Phdr)`) This size should be 56 for an `ELF64` binary and 32 for an `ELF32`. #### [` numberof_segments `]() inline uint32\_t numberof\_segments() const Return the number of segments. #### [` section_header_size `]() inline uint32\_t section\_header\_size() const Return the size of a section header (i.e. `sizeof(Elfxx_Shdr)`) This size should be 64 for a `ELF64` binary and 40 for an `ELF32`. #### [` numberof_sections `]() inline uint32\_t numberof\_sections() const Return the number of sections. > **Warning** > > This value could differ from the real number of sections present in the binary. It must be taken as an *indication* #### [` section_name_table_idx `]() inline uint32\_t section\_name\_table\_idx() const Return the section’s index which contains sections’ names. #### [` identity `]() inline [identity\_t]( "LIEF::ELF::Header::identity_t") &identity() Return the ELF identity as an `std::array`. #### [` identity `]() inline const [identity\_t]( "LIEF::ELF::Header::identity_t") &identity() const #### [` identity_class `]() inline [CLASS]( "LIEF::ELF::Header::CLASS") identity\_class() const Return the object’s class. `ELF64` or `ELF32`. #### [` identity_data `]() inline [ELF\_DATA]( "LIEF::ELF::Header::ELF_DATA") identity\_data() const Specify the data encoding. #### [` identity_version `]() inline [VERSION]( "LIEF::ELF::Header::VERSION") identity\_version() const > **See also** > > [object\_file\_version]() #### [` identity_os_abi `]() inline [OS\_ABI]( "LIEF::ELF::Header::OS_ABI") identity\_os\_abi() const Identifies the version of the ABI for which the object is prepared. #### [` identity_abi_version `]() inline uint32\_t identity\_abi\_version() const ABI Version. #### [` is_mips_n64 `]() inline bool is\_mips\_n64() const Check whether this header identifies a 64-bit MIPS ELF file whose relocations use the MIPS-specific n64 encoding. #### [` has `]() bool has([PROCESSOR\_FLAGS]( "LIEF::ELF::PROCESSOR_FLAGS") flag) const #### [` flags_list `]() std::vector<[PROCESSOR\_FLAGS]( "LIEF::ELF::PROCESSOR_FLAGS")> flags\_list() const #### [` file_type `]() inline void file\_type([FILE\_TYPE]( "LIEF::ELF::Header::FILE_TYPE") type) #### [` machine_type `]() inline void machine\_type([ARCH]( "LIEF::ELF::ARCH") arch) #### [` object_file_version `]() inline void object\_file\_version([VERSION]( "LIEF::ELF::Header::VERSION") version) #### [` entrypoint `]() inline void entrypoint(uint64\_t entry) #### [` program_headers_offset `]() inline void program\_headers\_offset(uint64\_t offset) #### [` section_headers_offset `]() inline void section\_headers\_offset(uint64\_t offset) #### [` processor_flag `]() inline void processor\_flag(uint32\_t flags) #### [` header_size `]() inline void header\_size(uint32\_t size) #### [` program_header_size `]() inline void program\_header\_size(uint32\_t size) #### [` numberof_segments `]() inline void numberof\_segments(uint32\_t n) #### [` section_header_size `]() inline void section\_header\_size(uint32\_t size) #### [` numberof_sections `]() inline void numberof\_sections(uint32\_t n) #### [` section_name_table_idx `]() inline void section\_name\_table\_idx(uint32\_t idx) #### [` identity `]() void identity(const std::string &identity) #### [` identity `]() void identity(const [identity\_t]( "LIEF::ELF::Header::identity_t") &identity) #### [` identity_class `]() inline void identity\_class([CLASS]( "LIEF::ELF::Header::CLASS") cls) #### [` identity_data `]() inline void identity\_data([ELF\_DATA]( "LIEF::ELF::Header::ELF_DATA") data) #### [` identity_version `]() inline void identity\_version([VERSION]( "LIEF::ELF::Header::VERSION") version) #### [` identity_os_abi `]() inline void identity\_os\_abi([OS\_ABI]( "LIEF::ELF::Header::OS_ABI") osabi) #### [` identity_abi_version `]() inline void identity\_abi\_version(uint8\_t version) #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Header]( "LIEF::ELF::Header") &hdr) --- ## [Section]() ### [` Section `]() class Section : public LIEF::[Section]( "LIEF::Section") Class which represents an ELF [Section](). Public Types #### [` TYPE `]() enum class TYPE : uint64\_t *Values:* ##### [` SHT_NULL_ `]() enumerator SHT\_NULL\_ = 0 No associated section (inactive entry). ##### [` PROGBITS `]() enumerator PROGBITS = 1 Program-defined contents. ##### [` SYMTAB `]() enumerator SYMTAB = 2 [Symbol]() table. ##### [` STRTAB `]() enumerator STRTAB = 3 String table. ##### [` RELA `]() enumerator RELA = 4 [Relocation]() entries; explicit addends. ##### [` HASH `]() enumerator HASH = 5 [Symbol]() hash table. ##### [` DYNAMIC `]() enumerator DYNAMIC = 6 Information for dynamic linking. ##### [` NOTE `]() enumerator NOTE = 7 Information about the file. ##### [` NOBITS `]() enumerator NOBITS = 8 Data occupies no space in the file. ##### [` REL `]() enumerator REL = 9 [Relocation]() entries; no explicit addends. ##### [` SHLIB `]() enumerator SHLIB = 10 Reserved. ##### [` DYNSYM `]() enumerator DYNSYM = 11 [Symbol]() table. ##### [` INIT_ARRAY `]() enumerator INIT\_ARRAY = 14 Pointers to initialization functions. ##### [` FINI_ARRAY `]() enumerator FINI\_ARRAY = 15 Pointers to termination functions. ##### [` PREINIT_ARRAY `]() enumerator PREINIT\_ARRAY = 16 Pointers to pre-init functions. ##### [` GROUP `]() enumerator GROUP = 17 [Section]() group. ##### [` SYMTAB_SHNDX `]() enumerator SYMTAB\_SHNDX = 18 Indices for SHN\_XINDEX entries. ##### [` RELR `]() enumerator RELR = 19 [Relocation]() entries; only offsets. ##### [` ANDROID_REL `]() enumerator ANDROID\_REL = 0x60000001 Packed relocations (Android specific). ##### [` ANDROID_RELA `]() enumerator ANDROID\_RELA = 0x60000002 Packed relocations (Android specific). ##### [` LLVM_ADDRSIG `]() enumerator LLVM\_ADDRSIG = 0x6fff4c03 This section is used to mark symbols as address-significant. ##### [` ANDROID_RELR `]() enumerator ANDROID\_RELR = 0x6fffff00 New relr relocations (Android specific). ##### [` GNU_ATTRIBUTES `]() enumerator GNU\_ATTRIBUTES = 0x6ffffff5 Object attributes. ##### [` GNU_HASH `]() enumerator GNU\_HASH = 0x6ffffff6 GNU-style hash table. ##### [` GNU_VERDEF `]() enumerator GNU\_VERDEF = 0x6ffffffd GNU version definitions. ##### [` GNU_VERNEED `]() enumerator GNU\_VERNEED = 0x6ffffffe GNU version references. ##### [` GNU_VERSYM `]() enumerator GNU\_VERSYM = 0x6fffffff GNU symbol versions table. ##### [` _ID_SHIFT_ `]() enumerator \_ID\_SHIFT\_ = 32 ##### [` _ARM_ID_ `]() enumerator \_ARM\_ID\_ = 1LLU ##### [` _HEX_ID_ `]() enumerator \_HEX\_ID\_ = 2LLU ##### [` _X86_64_ID_ `]() enumerator \_X86\_64\_ID\_ = 2LLU ##### [` _MIPS_ID_ `]() enumerator \_MIPS\_ID\_ = 3LLU ##### [` _RISCV_ID_ `]() enumerator \_RISCV\_ID\_ = 4LLU ##### [` _AARCH64_ID_ `]() enumerator \_AARCH64\_ID\_ = 5LLU ##### [` ARM_EXIDX `]() enumerator ARM\_EXIDX = 0x70000001U + ([\_ARM\_ID\_]( "LIEF::ELF::Section::TYPE::_ARM_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) Exception Index table ##### [` ARM_PREEMPTMAP `]() enumerator ARM\_PREEMPTMAP = 0x70000002U + ([\_ARM\_ID\_]( "LIEF::ELF::Section::TYPE::_ARM_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) BPABI DLL dynamic linking preemption map ##### [` ARM_ATTRIBUTES `]() enumerator ARM\_ATTRIBUTES = 0x70000003U + ([\_ARM\_ID\_]( "LIEF::ELF::Section::TYPE::_ARM_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) Object file compatibility attributes ##### [` ARM_DEBUGOVERLAY `]() enumerator ARM\_DEBUGOVERLAY = 0x70000004U + ([\_ARM\_ID\_]( "LIEF::ELF::Section::TYPE::_ARM_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` ARM_OVERLAYSECTION `]() enumerator ARM\_OVERLAYSECTION = 0x70000005U + ([\_ARM\_ID\_]( "LIEF::ELF::Section::TYPE::_ARM_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` HEX_ORDERED `]() enumerator HEX\_ORDERED = 0x70000000 + ([\_HEX\_ID\_]( "LIEF::ELF::Section::TYPE::_HEX_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) Link editor is to sort the entries in this section based on their sizes ##### [` X86_64_UNWIND `]() enumerator X86\_64\_UNWIND = 0x70000001 + ([\_X86\_64\_ID\_]( "LIEF::ELF::Section::TYPE::_X86_64_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) Unwind information ##### [` MIPS_LIBLIST `]() enumerator MIPS\_LIBLIST = 0x70000000 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_MSYM `]() enumerator MIPS\_MSYM = 0x70000001 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_CONFLICT `]() enumerator MIPS\_CONFLICT = 0x70000002 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_GPTAB `]() enumerator MIPS\_GPTAB = 0x70000003 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_UCODE `]() enumerator MIPS\_UCODE = 0x70000004 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_DEBUG `]() enumerator MIPS\_DEBUG = 0x70000005 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_REGINFO `]() enumerator MIPS\_REGINFO = 0x70000006 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_PACKAGE `]() enumerator MIPS\_PACKAGE = 0x70000007 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_PACKSYM `]() enumerator MIPS\_PACKSYM = 0x70000008 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_RELD `]() enumerator MIPS\_RELD = 0x70000009 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_IFACE `]() enumerator MIPS\_IFACE = 0x7000000b + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_CONTENT `]() enumerator MIPS\_CONTENT = 0x7000000c + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_OPTIONS `]() enumerator MIPS\_OPTIONS = 0x7000000d + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_SHDR `]() enumerator MIPS\_SHDR = 0x70000010 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_FDESC `]() enumerator MIPS\_FDESC = 0x70000011 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_EXTSYM `]() enumerator MIPS\_EXTSYM = 0x70000012 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_DENSE `]() enumerator MIPS\_DENSE = 0x70000013 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_PDESC `]() enumerator MIPS\_PDESC = 0x70000014 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_LOCSYM `]() enumerator MIPS\_LOCSYM = 0x70000015 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_AUXSYM `]() enumerator MIPS\_AUXSYM = 0x70000016 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_OPTSYM `]() enumerator MIPS\_OPTSYM = 0x70000017 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_LOCSTR `]() enumerator MIPS\_LOCSTR = 0x70000018 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_LINE `]() enumerator MIPS\_LINE = 0x70000019 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_RFDESC `]() enumerator MIPS\_RFDESC = 0x7000001a + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_DELTASYM `]() enumerator MIPS\_DELTASYM = 0x7000001b + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_DELTAINST `]() enumerator MIPS\_DELTAINST = 0x7000001c + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_DELTACLASS `]() enumerator MIPS\_DELTACLASS = 0x7000001d + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_DWARF `]() enumerator MIPS\_DWARF = 0x7000001e + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_DELTADECL `]() enumerator MIPS\_DELTADECL = 0x7000001f + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_SYMBOL_LIB `]() enumerator MIPS\_SYMBOL\_LIB = 0x70000020 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_EVENTS `]() enumerator MIPS\_EVENTS = 0x70000021 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_TRANSLATE `]() enumerator MIPS\_TRANSLATE = 0x70000022 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_PIXIE `]() enumerator MIPS\_PIXIE = 0x70000023 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_XLATE `]() enumerator MIPS\_XLATE = 0x70000024 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_XLATE_DEBUG `]() enumerator MIPS\_XLATE\_DEBUG = 0x70000025 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_WHIRL `]() enumerator MIPS\_WHIRL = 0x70000026 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_EH_REGION `]() enumerator MIPS\_EH\_REGION = 0x70000027 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_XLATE_OLD `]() enumerator MIPS\_XLATE\_OLD = 0x70000028 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_PDR_EXCEPTION `]() enumerator MIPS\_PDR\_EXCEPTION = 0x70000029 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_ABIFLAGS `]() enumerator MIPS\_ABIFLAGS = 0x7000002a + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` MIPS_XHASH `]() enumerator MIPS\_XHASH = 0x7000002b + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::TYPE::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` RISCV_ATTRIBUTES `]() enumerator RISCV\_ATTRIBUTES = 0x70000003 + ([\_RISCV\_ID\_]( "LIEF::ELF::Section::TYPE::_RISCV_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` AARCH64_ATTRIBUTES `]() enumerator AARCH64\_ATTRIBUTES = 0x70000003 + ([\_AARCH64\_ID\_]( "LIEF::ELF::Section::TYPE::_AARCH64_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` AARCH64_AUTH_RELR `]() enumerator AARCH64\_AUTH\_RELR = 0x70000004 + ([\_AARCH64\_ID\_]( "LIEF::ELF::Section::TYPE::_AARCH64_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` AARCH64_MEMTAG_GLOBALS_STATIC `]() enumerator AARCH64\_MEMTAG\_GLOBALS\_STATIC = 0x70000007 + ([\_AARCH64\_ID\_]( "LIEF::ELF::Section::TYPE::_AARCH64_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) ##### [` AARCH64_MEMTAG_GLOBALS_DYNAMIC `]() enumerator AARCH64\_MEMTAG\_GLOBALS\_DYNAMIC = 0x70000008 + ([\_AARCH64\_ID\_]( "LIEF::ELF::Section::TYPE::_AARCH64_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_")) #### [` FLAGS `]() enum class FLAGS : uint64\_t *Values:* ##### [` NONE `]() enumerator NONE = 0x000000000 ##### [` WRITE `]() enumerator WRITE = 0x000000001 [Section]() data should be writable during execution. ##### [` ALLOC `]() enumerator ALLOC = 0x000000002 [Section]() occupies memory during program execution. ##### [` EXECINSTR `]() enumerator EXECINSTR = 0x000000004 [Section]() contains executable machine instructions. ##### [` MERGE `]() enumerator MERGE = 0x000000010 The data in this section may be merged. ##### [` STRINGS `]() enumerator STRINGS = 0x000000020 The data in this section is null-terminated strings. ##### [` INFO_LINK `]() enumerator INFO\_LINK = 0x000000040 A field in this section holds a section header table index. ##### [` LINK_ORDER `]() enumerator LINK\_ORDER = 0x000000080 Adds special ordering requirements for link editors. ##### [` OS_NONCONFORMING `]() enumerator OS\_NONCONFORMING = 0x000000100 This section requires special OS-specific processing to avoid incorrect behavior ##### [` GROUP `]() enumerator GROUP = 0x000000200 This section is a member of a section group. ##### [` TLS `]() enumerator TLS = 0x000000400 This section holds Thread-Local Storage. ##### [` COMPRESSED `]() enumerator COMPRESSED = 0x000000800 ##### [` GNU_RETAIN `]() enumerator GNU\_RETAIN = 0x000200000 ##### [` EXCLUDE `]() enumerator EXCLUDE = 0x080000000 ##### [` _ID_SHIFT_ `]() enumerator \_ID\_SHIFT\_ = 32 ##### [` _XCORE_ID_ `]() enumerator \_XCORE\_ID\_ = 1LLU ##### [` _HEX_ID_ `]() enumerator \_HEX\_ID\_ = 3LLU ##### [` _X86_64_ID_ `]() enumerator \_X86\_64\_ID\_ = 2LLU ##### [` _MIPS_ID_ `]() enumerator \_MIPS\_ID\_ = 4LLU ##### [` _ARM_ID_ `]() enumerator \_ARM\_ID\_ = 5LLU ##### [` _AARCH64_ID_ `]() enumerator \_AARCH64\_ID\_ = 6LLU ##### [` XCORE_SHF_DP_SECTION `]() enumerator XCORE\_SHF\_DP\_SECTION = 0x010000000 + ([\_XCORE\_ID\_]( "LIEF::ELF::Section::FLAGS::_XCORE_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::FLAGS::_ID_SHIFT_")) ##### [` XCORE_SHF_CP_SECTION `]() enumerator XCORE\_SHF\_CP\_SECTION = 0x020000000 + ([\_XCORE\_ID\_]( "LIEF::ELF::Section::FLAGS::_XCORE_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::FLAGS::_ID_SHIFT_")) ##### [` X86_64_LARGE `]() enumerator X86\_64\_LARGE = 0x010000000 + ([\_X86\_64\_ID\_]( "LIEF::ELF::Section::FLAGS::_X86_64_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::FLAGS::_ID_SHIFT_")) ##### [` HEX_GPREL `]() enumerator HEX\_GPREL = 0x010000000 + ([\_HEX\_ID\_]( "LIEF::ELF::Section::FLAGS::_HEX_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::FLAGS::_ID_SHIFT_")) ##### [` MIPS_NODUPES `]() enumerator MIPS\_NODUPES = 0x001000000 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::FLAGS::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::FLAGS::_ID_SHIFT_")) ##### [` MIPS_NAMES `]() enumerator MIPS\_NAMES = 0x002000000 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::FLAGS::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::FLAGS::_ID_SHIFT_")) ##### [` MIPS_LOCAL `]() enumerator MIPS\_LOCAL = 0x004000000 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::FLAGS::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::FLAGS::_ID_SHIFT_")) ##### [` MIPS_NOSTRIP `]() enumerator MIPS\_NOSTRIP = 0x008000000 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::FLAGS::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::FLAGS::_ID_SHIFT_")) ##### [` MIPS_GPREL `]() enumerator MIPS\_GPREL = 0x010000000 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::FLAGS::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::FLAGS::_ID_SHIFT_")) ##### [` MIPS_MERGE `]() enumerator MIPS\_MERGE = 0x020000000 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::FLAGS::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::FLAGS::_ID_SHIFT_")) ##### [` MIPS_ADDR `]() enumerator MIPS\_ADDR = 0x040000000 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::FLAGS::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::FLAGS::_ID_SHIFT_")) ##### [` MIPS_STRING `]() enumerator MIPS\_STRING = 0x080000000 + ([\_MIPS\_ID\_]( "LIEF::ELF::Section::FLAGS::_MIPS_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::FLAGS::_ID_SHIFT_")) ##### [` ARM_PURECODE `]() enumerator ARM\_PURECODE = 0x020000000 + ([\_ARM\_ID\_]( "LIEF::ELF::Section::FLAGS::_ARM_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::FLAGS::_ID_SHIFT_")) ##### [` AARCH64_PURECODE `]() enumerator AARCH64\_PURECODE = 0x020000000 + ([\_AARCH64\_ID\_]( "LIEF::ELF::Section::FLAGS::_AARCH64_ID_") << [\_ID\_SHIFT\_]( "LIEF::ELF::Section::FLAGS::_ID_SHIFT_")) #### [` segments_t `]() using segments\_t = std::vector<[Segment]( "LIEF::ELF::Segment")\*> #### [` it_segments `]() using it\_segments = [ref\_iterator]( "LIEF::ref_iterator")<[segments\_t]( "LIEF::ELF::Section::segments_t")&> #### [` it_const_segments `]() using it\_const\_segments = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [segments\_t]( "LIEF::ELF::Section::segments_t")&> Public Functions #### [` Section `]() inline Section(const std::string &name, [TYPE]( "LIEF::ELF::Section::TYPE") type = [TYPE]( "LIEF::ELF::Section::TYPE")::[PROGBITS]( "LIEF::ELF::Section::TYPE::PROGBITS")) #### [` Section `]() Section() = default #### [` ~Section `]() ~Section() override = default #### [` operator= `]() inline [Section]( "LIEF::ELF::Section") &operator=([Section]( "LIEF::ELF::Section") other) #### [` Section `]() Section(const [Section]( "LIEF::ELF::Section::Section") &other) #### [` swap `]() void swap([Section]( "LIEF::ELF::Section") &other) noexcept #### [` type `]() inline [TYPE]( "LIEF::ELF::Section::TYPE") type() const #### [` content `]() virtual span<const uint8\_t> content() const override [Section]()’s content. #### [` content `]() virtual void content(const std::vector<uint8\_t> &data) override Set section content. #### [` content `]() void content(std::vector<uint8\_t> &&data) #### [` flags `]() inline uint64\_t flags() const [Section]() flags. #### [` has `]() bool has([FLAGS]( "LIEF::ELF::Section::FLAGS") flag) const `True` if the section has the given flag #### [` has `]() bool has(const [Segment]( "LIEF::ELF::Segment") &segment) const `True` if the section is wrapped by the given [Segment]() #### [` flags_list `]() std::vector<[FLAGS]( "LIEF::ELF::Section::FLAGS")> flags\_list() const Return section flags as a `std::set`. #### [` size `]() inline virtual uint64\_t size() const override [Section]()’s size (size in the binary, not the virtual size). #### [` size `]() virtual void size(uint64\_t size) override Change the section size. #### [` offset `]() virtual void offset(uint64\_t offset) override #### [` offset `]() inline virtual uint64\_t offset() const override Offset in the binary. #### [` file_offset `]() inline uint64\_t file\_offset() const > **See also** > > [offset]() #### [` original_size `]() inline uint64\_t original\_size() const Original size of the section’s data. This value is used by the [ELF::Builder]() to determine if it needs to be relocated to avoid an override of the data #### [` alignment `]() inline uint64\_t alignment() const [Section]() file alignment. #### [` information `]() inline uint64\_t information() const [Section]() information. The meaning of this value depends on the section’s type. #### [` entry_size `]() inline uint64\_t entry\_size() const This function returns the size of an element in the case of a section that contains an array. For instance, the `.dynamic` section contains an array of [DynamicEntry](). As the size of the raw C structure of this entry is 0x10 (`sizeof(Elf64_Dyn)`) in an ELF64, the `entry_size` is set to this value. #### [` link `]() inline uint32\_t link() const Index to another section. #### [` clear `]() [Section]( "LIEF::ELF::Section") &clear(uint8\_t value = 0) Clear the content of the section with the given `value`. #### [` add `]() void add([FLAGS]( "LIEF::ELF::Section::FLAGS") flag) Add the given ELF\_SECTION\_FLAGS. #### [` remove `]() void remove([FLAGS]( "LIEF::ELF::Section::FLAGS") flag) Remove the given ELF\_SECTION\_FLAGS. #### [` type `]() inline void type([TYPE]( "LIEF::ELF::Section::TYPE") type) #### [` flags `]() inline void flags(uint64\_t flags) #### [` clear_flags `]() inline void clear\_flags() #### [` file_offset `]() inline void file\_offset(uint64\_t offset) #### [` link `]() inline void link(uint32\_t link) #### [` information `]() inline void information(uint32\_t info) #### [` alignment `]() inline void alignment(uint64\_t alignment) #### [` entry_size `]() inline void entry\_size(uint64\_t entry\_size) #### [` segments `]() inline [it\_segments]( "LIEF::ELF::Section::it_segments") segments() #### [` segments `]() inline [it\_const\_segments]( "LIEF::ELF::Section::it_const_segments") segments() const #### [` as_frame `]() inline [Section]( "LIEF::ELF::Section") &as\_frame() #### [` is_frame `]() inline bool is\_frame() const #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` operator+= `]() inline [Section]( "LIEF::ELF::Section") &operator+=([FLAGS]( "LIEF::ELF::Section::FLAGS") c) #### [` operator-= `]() inline [Section]( "LIEF::ELF::Section") &operator-=([FLAGS]( "LIEF::ELF::Section::FLAGS") c) #### [` stream `]() std::unique\_ptr<[SpanStream]( "LIEF::SpanStream")> stream() const Return a stream over the content of this section. Public Static Functions #### [` type_from `]() static [TYPE]( "LIEF::ELF::Section::TYPE") type\_from(uint32\_t value, [ARCH]( "LIEF::ELF::ARCH") arch) #### [` to_value `]() static inline uint32\_t to\_value([TYPE]( "LIEF::ELF::Section::TYPE") type) Public Static Attributes #### [` MAX_SECTION_SIZE `]() static uint32\_t MAX\_SECTION\_SIZE = 2\_GB #### [` FLAG_MASK `]() static uint64\_t FLAG\_MASK = (uint64\_t(1) << uint8\_t([FLAGS]( "LIEF::ELF::Section::FLAGS")::[\_ID\_SHIFT\_]( "LIEF::ELF::Section::FLAGS::_ID_SHIFT_"))) - 1 #### [` TYPE_MASK `]() static uint64\_t TYPE\_MASK = (uint64\_t(1) << uint8\_t([TYPE]( "LIEF::ELF::Section::TYPE")::[\_ID\_SHIFT\_]( "LIEF::ELF::Section::TYPE::_ID_SHIFT_"))) - 1 Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Section]( "LIEF::ELF::Section") &section) --- ## [Segment]() ### [` Segment `]() class Segment : public LIEF::Object Class which represents the ELF segments. Public Types #### [` TYPE `]() enum class TYPE : uint64\_t *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = uint64\_t(-1) ##### [` PT_NULL_ `]() enumerator PT\_NULL\_ = 0 Unused segment. ##### [` LOAD `]() enumerator LOAD = 1 Loadable segment. ##### [` DYNAMIC `]() enumerator DYNAMIC = 2 Dynamic linking information. ##### [` INTERP `]() enumerator INTERP = 3 Interpreter pathname. ##### [` NOTE `]() enumerator NOTE = 4 Auxiliary information. ##### [` SHLIB `]() enumerator SHLIB = 5 Reserved. ##### [` PHDR `]() enumerator PHDR = 6 The program header table itself. ##### [` TLS `]() enumerator TLS = 7 The thread-local storage template. ##### [` GNU_EH_FRAME `]() enumerator GNU\_EH\_FRAME = 0x6474e550 ##### [` GNU_STACK `]() enumerator GNU\_STACK = 0x6474e551 Indicates stack executability. ##### [` GNU_PROPERTY `]() enumerator GNU\_PROPERTY = 0x6474e553 GNU property ##### [` GNU_RELRO `]() enumerator GNU\_RELRO = 0x6474e552 Read-only after relocation. ##### [` PAX_FLAGS `]() enumerator PAX\_FLAGS = 0x65041580 ##### [` ARM_ARCHEXT `]() enumerator ARM\_ARCHEXT = 0x70000000 | [PT\_ARM]( "LIEF::ELF::Segment::PT_ARM") Platform architecture compatibility info ##### [` ARM_EXIDX `]() enumerator ARM\_EXIDX = 0x70000001 | [PT\_ARM]( "LIEF::ELF::Segment::PT_ARM") ##### [` AARCH64_MEMTAG_MTE `]() enumerator AARCH64\_MEMTAG\_MTE = 0x70000002 | [PT\_AARCH64]( "LIEF::ELF::Segment::PT_AARCH64") ##### [` MIPS_REGINFO `]() enumerator MIPS\_REGINFO = 0x70000000 | [PT\_MIPS]( "LIEF::ELF::Segment::PT_MIPS") Register usage information. ##### [` MIPS_RTPROC `]() enumerator MIPS\_RTPROC = 0x70000001 | [PT\_MIPS]( "LIEF::ELF::Segment::PT_MIPS") Runtime procedure table. ##### [` MIPS_OPTIONS `]() enumerator MIPS\_OPTIONS = 0x70000002 | [PT\_MIPS]( "LIEF::ELF::Segment::PT_MIPS") Options segment. ##### [` MIPS_ABIFLAGS `]() enumerator MIPS\_ABIFLAGS = 0x70000003 | [PT\_MIPS]( "LIEF::ELF::Segment::PT_MIPS") Abiflags segment. ##### [` RISCV_ATTRIBUTES `]() enumerator RISCV\_ATTRIBUTES = 0x70000003 | [PT\_RISCV]( "LIEF::ELF::Segment::PT_RISCV") ##### [` IA_64_EXT `]() enumerator IA\_64\_EXT = (0x70000000 + 0x0) | [PT\_IA\_64]( "LIEF::ELF::Segment::PT_IA_64") ##### [` IA_64_UNWIND `]() enumerator IA\_64\_UNWIND = (0x70000000 + 0x1) | [PT\_IA\_64]( "LIEF::ELF::Segment::PT_IA_64") ##### [` HP_TLS `]() enumerator HP\_TLS = (0x60000000 + 0x00) | [PT\_HPUX]( "LIEF::ELF::Segment::PT_HPUX") ##### [` HP_CORE_NONE `]() enumerator HP\_CORE\_NONE = (0x60000000 + 0x01) | [PT\_HPUX]( "LIEF::ELF::Segment::PT_HPUX") ##### [` HP_CORE_VERSION `]() enumerator HP\_CORE\_VERSION = (0x60000000 + 0x02) | [PT\_HPUX]( "LIEF::ELF::Segment::PT_HPUX") ##### [` HP_CORE_KERNEL `]() enumerator HP\_CORE\_KERNEL = (0x60000000 + 0x03) | [PT\_HPUX]( "LIEF::ELF::Segment::PT_HPUX") ##### [` HP_CORE_COMM `]() enumerator HP\_CORE\_COMM = (0x60000000 + 0x04) | [PT\_HPUX]( "LIEF::ELF::Segment::PT_HPUX") ##### [` HP_CORE_PROC `]() enumerator HP\_CORE\_PROC = (0x60000000 + 0x05) | [PT\_HPUX]( "LIEF::ELF::Segment::PT_HPUX") ##### [` HP_CORE_LOADABLE `]() enumerator HP\_CORE\_LOADABLE = (0x60000000 + 0x06) | [PT\_HPUX]( "LIEF::ELF::Segment::PT_HPUX") ##### [` HP_CORE_STACK `]() enumerator HP\_CORE\_STACK = (0x60000000 + 0x07) | [PT\_HPUX]( "LIEF::ELF::Segment::PT_HPUX") ##### [` HP_CORE_SHM `]() enumerator HP\_CORE\_SHM = (0x60000000 + 0x08) | [PT\_HPUX]( "LIEF::ELF::Segment::PT_HPUX") ##### [` HP_CORE_MMF `]() enumerator HP\_CORE\_MMF = (0x60000000 + 0x09) | [PT\_HPUX]( "LIEF::ELF::Segment::PT_HPUX") ##### [` HP_PARALLEL `]() enumerator HP\_PARALLEL = (0x60000000 + 0x10) | [PT\_HPUX]( "LIEF::ELF::Segment::PT_HPUX") ##### [` HP_FASTBIND `]() enumerator HP\_FASTBIND = (0x60000000 + 0x11) | [PT\_HPUX]( "LIEF::ELF::Segment::PT_HPUX") ##### [` HP_OPT_ANNOT `]() enumerator HP\_OPT\_ANNOT = (0x60000000 + 0x12) | [PT\_HPUX]( "LIEF::ELF::Segment::PT_HPUX") ##### [` HP_HSL_ANNOT `]() enumerator HP\_HSL\_ANNOT = (0x60000000 + 0x13) | [PT\_HPUX]( "LIEF::ELF::Segment::PT_HPUX") ##### [` HP_STACK `]() enumerator HP\_STACK = (0x60000000 + 0x14) | [PT\_HPUX]( "LIEF::ELF::Segment::PT_HPUX") ##### [` HP_CORE_UTSNAME `]() enumerator HP\_CORE\_UTSNAME = (0x60000000 + 0x15) | [PT\_HPUX]( "LIEF::ELF::Segment::PT_HPUX") #### [` FLAGS `]() enum class FLAGS *Values:* ##### [` NONE `]() enumerator NONE = 0 ##### [` X `]() enumerator X = 1 ##### [` W `]() enumerator W = 2 ##### [` R `]() enumerator R = 4 #### [` sections_t `]() using sections\_t = std::vector<[Section]( "LIEF::ELF::Section")\*> #### [` it_sections `]() using it\_sections = [ref\_iterator]( "LIEF::ref_iterator")<[sections\_t]( "LIEF::ELF::Segment::sections_t")&> #### [` it_const_sections `]() using it\_const\_sections = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [sections\_t]( "LIEF::ELF::Segment::sections_t")&> Public Functions #### [` Segment `]() Segment() = default #### [` ~Segment `]() ~Segment() override = default #### [` operator= `]() [Segment]( "LIEF::ELF::Segment") &operator=([Segment]( "LIEF::ELF::Segment") other) #### [` Segment `]() Segment(const [Segment]( "LIEF::ELF::Segment::Segment") &other) #### [` operator= `]() [Segment]( "LIEF::ELF::Segment") &operator=([Segment]( "LIEF::ELF::Segment")&&) = default #### [` Segment `]() Segment([Segment]( "LIEF::ELF::Segment::Segment")&&) = default #### [` swap `]() void swap([Segment]( "LIEF::ELF::Segment") &other) #### [` is_load `]() inline bool is\_load() const #### [` is_interpreter `]() inline bool is\_interpreter() const #### [` is_phdr `]() inline bool is\_phdr() const #### [` type `]() inline [TYPE]( "LIEF::ELF::Segment::TYPE") type() const The segment’s type (LOAD, DYNAMIC, …). #### [` flags `]() inline [FLAGS]( "LIEF::ELF::Segment::FLAGS") flags() const The flag permissions associated with this segment. #### [` file_offset `]() inline uint64\_t file\_offset() const The file offset of the data associated with this segment. #### [` virtual_address `]() inline uint64\_t virtual\_address() const The virtual address of the segment. #### [` physical_address `]() inline uint64\_t physical\_address() const The physical address of the segment. This value is not really relevant on systems like Linux or Android. On the other hand, Qualcomm trustlets might use this value. Usually this value matches virtual\_address #### [` physical_size `]() inline uint64\_t physical\_size() const The **file** size of the data associated with this segment. #### [` virtual_size `]() inline uint64\_t virtual\_size() const The in-memory size of this segment. Usually, if the `.bss` segment is wrapped by this segment then, virtual\_size is larger than physical\_size. #### [` alignment `]() inline uint64\_t alignment() const The offset alignment of the segment. #### [` content `]() span<const uint8\_t> content() const The raw data associated with this segment. #### [` has `]() inline bool has([FLAGS]( "LIEF::ELF::Segment::FLAGS") flag) const Check if the current segment has the given flag. #### [` has `]() bool has(const [Section]( "LIEF::ELF::Section") &section) const Check if the current segment wraps the given [ELF::Section](). #### [` has `]() bool has(const std::string &section\_name) const Check if the current segment wraps the given section’s name. #### [` add `]() void add([FLAGS]( "LIEF::ELF::Segment::FLAGS") flag) Append the given ELF\_SEGMENT\_FLAGS. #### [` remove `]() void remove([FLAGS]( "LIEF::ELF::Segment::FLAGS") flag) Remove the given ELF\_SEGMENT\_FLAGS. #### [` type `]() inline void type([TYPE]( "LIEF::ELF::Segment::TYPE") type) #### [` flags `]() inline void flags([FLAGS]( "LIEF::ELF::Segment::FLAGS") flags) #### [` flags `]() inline void flags(uint32\_t flags) #### [` clear_flags `]() inline void clear\_flags() #### [` file_offset `]() void file\_offset(uint64\_t file\_offset) #### [` virtual_address `]() inline void virtual\_address(uint64\_t virtual\_address) #### [` physical_address `]() inline void physical\_address(uint64\_t physical\_address) #### [` physical_size `]() void physical\_size(uint64\_t physical\_size) #### [` virtual_size `]() inline void virtual\_size(uint64\_t virtual\_size) #### [` alignment `]() inline void alignment(uint64\_t alignment) #### [` content `]() void content(std::vector<uint8\_t> content) #### [` fill `]() inline void fill(char c) Fill the content of this segment with the value provided in parameter. #### [` clear `]() inline void clear() Clear the content of this segment. #### [` Tget_content_value `]() template<typename T> [T]( "LIEF::ELF::Segment::get_content_value::T") get\_content\_value(size\_t offset) const #### [` Tset_content_value `]() template<typename T> void set\_content\_value(size\_t offset, [T]( "LIEF::ELF::Segment::set_content_value::T") value) #### [` get_content_size `]() size\_t get\_content\_size() const #### [` sections `]() inline [it\_sections]( "LIEF::ELF::Segment::it_sections") sections() Iterator over the sections wrapped by this segment. #### [` sections `]() inline [it\_const\_sections]( "LIEF::ELF::Segment::it_const_sections") sections() const #### [` stream `]() std::unique\_ptr<[SpanStream]( "LIEF::SpanStream")> stream() const #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` operator+= `]() inline [Segment]( "LIEF::ELF::Segment") &operator+=([FLAGS]( "LIEF::ELF::Segment::FLAGS") flag) #### [` operator-= `]() inline [Segment]( "LIEF::ELF::Segment") &operator-=([FLAGS]( "LIEF::ELF::Segment::FLAGS") flag) Public Static Functions #### [` type_from `]() static [TYPE]( "LIEF::ELF::Segment::TYPE") type\_from(uint64\_t value, [ARCH]( "LIEF::ELF::ARCH") arch, [Header]( "LIEF::ELF::Header")::[OS\_ABI]( "LIEF::ELF::Header::OS_ABI") os) #### [` to_value `]() static inline uint64\_t to\_value([TYPE]( "LIEF::ELF::Segment::TYPE") type) #### [` from_raw `]() static [result]( "LIEF::result")<[Segment]( "LIEF::ELF::Segment")> from\_raw(const uint8\_t \*ptr, size\_t size) #### [` from_raw `]() static inline [result]( "LIEF::result")<[Segment]( "LIEF::ELF::Segment")> from\_raw(const std::vector<uint8\_t> &raw) Public Static Attributes #### [` PT_BIT `]() static uint64\_t PT\_BIT = 33 #### [` PT_OS_BIT `]() static uint64\_t PT\_OS\_BIT = 53 #### [` PT_MASK `]() static uint64\_t PT\_MASK = (uint64\_t(1) << [PT\_BIT]( "LIEF::ELF::Segment::PT_BIT")) - 1 #### [` PT_ARM `]() static uint64\_t PT\_ARM = uint64\_t(1) << [PT\_BIT]( "LIEF::ELF::Segment::PT_BIT") #### [` PT_AARCH64 `]() static uint64\_t PT\_AARCH64 = uint64\_t(2) << [PT\_BIT]( "LIEF::ELF::Segment::PT_BIT") #### [` PT_MIPS `]() static uint64\_t PT\_MIPS = uint64\_t(3) << [PT\_BIT]( "LIEF::ELF::Segment::PT_BIT") #### [` PT_RISCV `]() static uint64\_t PT\_RISCV = uint64\_t(4) << [PT\_BIT]( "LIEF::ELF::Segment::PT_BIT") #### [` PT_IA_64 `]() static uint64\_t PT\_IA\_64 = uint64\_t(5) << [PT\_BIT]( "LIEF::ELF::Segment::PT_BIT") #### [` PT_HPUX `]() static uint64\_t PT\_HPUX = uint64\_t(1) << [PT\_OS\_BIT]( "LIEF::ELF::Segment::PT_OS_BIT") Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Segment]( "LIEF::ELF::Segment") &segment) --- ## [Dynamic Entry]() ### [` DynamicEntry `]() class DynamicEntry : public LIEF::Object Class which represents an entry in the dynamic table These entries are located in the `.dynamic` section or the `PT_DYNAMIC` segment. Subclassed by [LIEF::ELF::DynamicEntryArray](), [LIEF::ELF::DynamicEntryAuxiliary](), [LIEF::ELF::DynamicEntryFilter](), [LIEF::ELF::DynamicEntryFlags](), [LIEF::ELF::DynamicEntryLibrary](), [LIEF::ELF::DynamicEntryRpath](), [LIEF::ELF::DynamicEntryRunPath](), [LIEF::ELF::DynamicSharedObject]() Public Types #### [` TAG `]() enum class TAG : uint64\_t *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = uint64\_t(-1) ##### [` DT_NULL_ `]() enumerator DT\_NULL\_ = 0 Marks end of dynamic array. ##### [` NEEDED `]() enumerator NEEDED = 1 String table offset of needed library. ##### [` PLTRELSZ `]() enumerator PLTRELSZ = 2 Size of relocation entries in PLT. ##### [` PLTGOT `]() enumerator PLTGOT = 3 Address associated with linkage table. ##### [` HASH `]() enumerator HASH = 4 Address of symbolic hash table. ##### [` STRTAB `]() enumerator STRTAB = 5 Address of dynamic string table. ##### [` SYMTAB `]() enumerator SYMTAB = 6 Address of dynamic symbol table. ##### [` RELA `]() enumerator RELA = 7 Address of relocation table (Rela entries). ##### [` RELASZ `]() enumerator RELASZ = 8 Size of Rela relocation table. ##### [` RELAENT `]() enumerator RELAENT = 9 Size of a Rela relocation entry. ##### [` STRSZ `]() enumerator STRSZ = 10 Total size of the string table. ##### [` SYMENT `]() enumerator SYMENT = 11 Size of a symbol table entry. ##### [` INIT `]() enumerator INIT = 12 Address of initialization function. ##### [` FINI `]() enumerator FINI = 13 Address of termination function. ##### [` SONAME `]() enumerator SONAME = 14 String table offset of a shared objects name. ##### [` RPATH `]() enumerator RPATH = 15 String table offset of library search path. ##### [` SYMBOLIC `]() enumerator SYMBOLIC = 16 Changes symbol resolution algorithm. ##### [` REL `]() enumerator REL = 17 Address of relocation table (Rel entries). ##### [` RELSZ `]() enumerator RELSZ = 18 Size of Rel relocation table. ##### [` RELENT `]() enumerator RELENT = 19 Size of a Rel relocation entry. ##### [` PLTREL `]() enumerator PLTREL = 20 Type of relocation entry used for linking. ##### [` DEBUG_TAG `]() enumerator DEBUG\_TAG = 21 Reserved for debugger. ##### [` TEXTREL `]() enumerator TEXTREL = 22 Relocations exist for non-writable segments. ##### [` JMPREL `]() enumerator JMPREL = 23 Address of relocations associated with PLT. ##### [` BIND_NOW `]() enumerator BIND\_NOW = 24 Process all relocations before execution. ##### [` INIT_ARRAY `]() enumerator INIT\_ARRAY = 25 Pointer to array of initialization functions. ##### [` FINI_ARRAY `]() enumerator FINI\_ARRAY = 26 Pointer to array of termination functions. ##### [` INIT_ARRAYSZ `]() enumerator INIT\_ARRAYSZ = 27 Size of DT\_INIT\_ARRAY. ##### [` FINI_ARRAYSZ `]() enumerator FINI\_ARRAYSZ = 28 Size of DT\_FINI\_ARRAY. ##### [` RUNPATH `]() enumerator RUNPATH = 29 String table offset of lib search path. ##### [` FLAGS `]() enumerator FLAGS = 30 Flags. ##### [` PREINIT_ARRAY `]() enumerator PREINIT\_ARRAY = 32 Pointer to array of preinit functions. ##### [` PREINIT_ARRAYSZ `]() enumerator PREINIT\_ARRAYSZ = 33 Size of the DT\_PREINIT\_ARRAY array. ##### [` SYMTAB_SHNDX `]() enumerator SYMTAB\_SHNDX = 34 Address of SYMTAB\_SHNDX section ##### [` RELRSZ `]() enumerator RELRSZ = 35 Total size of RELR relative relocations ##### [` RELR `]() enumerator RELR = 36 Address of RELR relative relocations ##### [` RELRENT `]() enumerator RELRENT = 37 Size of one RELR relative relocation ##### [` GNU_HASH `]() enumerator GNU\_HASH = 0x6FFFFEF5 Reference to the GNU hash table. ##### [` TLSDESC_PLT `]() enumerator TLSDESC\_PLT = 0x6FFFFEF6 Location of PLT entry for TLS descriptor resolver calls. ##### [` TLSDESC_GOT `]() enumerator TLSDESC\_GOT = 0x6FFFFEF7 Location of GOT entry for TLS descriptor resolver PLT entry. ##### [` RELACOUNT `]() enumerator RELACOUNT = 0x6FFFFFF9 ELF32\_Rela count. ##### [` RELCOUNT `]() enumerator RELCOUNT = 0x6FFFFFFA ELF32\_Rel count. ##### [` FLAGS_1 `]() enumerator FLAGS\_1 = 0x6FFFFFFB Flags\_1. ##### [` VERSYM `]() enumerator VERSYM = 0x6FFFFFF0 The address of .gnu.version section. ##### [` VERDEF `]() enumerator VERDEF = 0x6FFFFFFC The address of the version definition table. ##### [` VERDEFNUM `]() enumerator VERDEFNUM = 0x6FFFFFFD The number of entries in DT\_VERDEF. ##### [` VERNEED `]() enumerator VERNEED = 0x6FFFFFFE The address of the version Dependency table. ##### [` VERNEEDNUM `]() enumerator VERNEEDNUM = 0x6FFFFFFF The number of entries in DT\_VERNEED. ##### [` AUXILIARY `]() enumerator AUXILIARY = 0x7ffffffd Shared object to load before self ##### [` FILTER `]() enumerator FILTER = 0x7fffffff Shared object to filter from ##### [` ANDROID_REL_OFFSET `]() enumerator ANDROID\_REL\_OFFSET = 0x6000000D The offset of packed relocation data (older version < M) (Android specific). ##### [` ANDROID_REL_SIZE `]() enumerator ANDROID\_REL\_SIZE = 0x6000000E The size of packed relocation data in bytes (older version < M) (Android specific). ##### [` ANDROID_REL `]() enumerator ANDROID\_REL = 0x6000000F The offset of packed relocation data (Android specific). ##### [` ANDROID_RELSZ `]() enumerator ANDROID\_RELSZ = 0x60000010 The size of packed relocation data in bytes (Android specific). ##### [` ANDROID_RELA `]() enumerator ANDROID\_RELA = 0x60000011 The offset of packed relocation data (Android specific). ##### [` ANDROID_RELASZ `]() enumerator ANDROID\_RELASZ = 0x60000012 The size of packed relocation data in bytes (Android specific). ##### [` ANDROID_RELR `]() enumerator ANDROID\_RELR = 0x6FFFE000 The offset of new relr relocation data (Android specific). ##### [` ANDROID_RELRSZ `]() enumerator ANDROID\_RELRSZ = 0x6FFFE001 The size of new relr relocation data in bytes (Android specific). ##### [` ANDROID_RELRENT `]() enumerator ANDROID\_RELRENT = 0x6FFFE003 The size of a new relr relocation entry (Android specific). ##### [` ANDROID_RELRCOUNT `]() enumerator ANDROID\_RELRCOUNT = 0x6FFFE005 Specifies the relative count of new relr relocation entries (Android specific). ##### [` MIPS_RLD_VERSION `]() enumerator MIPS\_RLD\_VERSION = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000001 32 bit version number for runtime linker interface. ##### [` MIPS_TIME_STAMP `]() enumerator MIPS\_TIME\_STAMP = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000002 Time stamp. ##### [` MIPS_ICHECKSUM `]() enumerator MIPS\_ICHECKSUM = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000003 Checksum of external strings and common sizes. ##### [` MIPS_IVERSION `]() enumerator MIPS\_IVERSION = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000004 Index of version string in string table. ##### [` MIPS_FLAGS `]() enumerator MIPS\_FLAGS = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000005 32 bits of flags. ##### [` MIPS_BASE_ADDRESS `]() enumerator MIPS\_BASE\_ADDRESS = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000006 Base address of the segment. ##### [` MIPS_MSYM `]() enumerator MIPS\_MSYM = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000007 Address of .msym section. ##### [` MIPS_CONFLICT `]() enumerator MIPS\_CONFLICT = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000008 Address of .conflict section. ##### [` MIPS_LIBLIST `]() enumerator MIPS\_LIBLIST = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000009 Address of .liblist section. ##### [` MIPS_LOCAL_GOTNO `]() enumerator MIPS\_LOCAL\_GOTNO = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x7000000a Number of local global offset table entries. ##### [` MIPS_CONFLICTNO `]() enumerator MIPS\_CONFLICTNO = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x7000000b Number of entries in the .conflict section. ##### [` MIPS_LIBLISTNO `]() enumerator MIPS\_LIBLISTNO = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000010 Number of entries in the .liblist section. ##### [` MIPS_SYMTABNO `]() enumerator MIPS\_SYMTABNO = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000011 Number of entries in the .dynsym section. ##### [` MIPS_UNREFEXTNO `]() enumerator MIPS\_UNREFEXTNO = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000012 Index of first external dynamic symbol not referenced locally. ##### [` MIPS_GOTSYM `]() enumerator MIPS\_GOTSYM = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000013 Index of first dynamic symbol in global offset table. ##### [` MIPS_HIPAGENO `]() enumerator MIPS\_HIPAGENO = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000014 Number of page table entries in global offset table. ##### [` MIPS_RLD_MAP `]() enumerator MIPS\_RLD\_MAP = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000016 Address of run time loader map, used for debugging. ##### [` MIPS_DELTA_CLASS `]() enumerator MIPS\_DELTA\_CLASS = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000017 Delta C++ class definition. ##### [` MIPS_DELTA_CLASS_NO `]() enumerator MIPS\_DELTA\_CLASS\_NO = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000018 Number of entries in DT\_MIPS\_DELTA\_CLASS. ##### [` MIPS_DELTA_INSTANCE `]() enumerator MIPS\_DELTA\_INSTANCE = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000019 Delta C++ class instances. ##### [` MIPS_DELTA_INSTANCE_NO `]() enumerator MIPS\_DELTA\_INSTANCE\_NO = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x7000001A Number of entries in DT\_MIPS\_DELTA\_INSTANCE. ##### [` MIPS_DELTA_RELOC `]() enumerator MIPS\_DELTA\_RELOC = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x7000001B Delta relocations. ##### [` MIPS_DELTA_RELOC_NO `]() enumerator MIPS\_DELTA\_RELOC\_NO = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x7000001C Number of entries in DT\_MIPS\_DELTA\_RELOC. ##### [` MIPS_DELTA_SYM `]() enumerator MIPS\_DELTA\_SYM = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x7000001D Delta symbols that Delta relocations refer to. ##### [` MIPS_DELTA_SYM_NO `]() enumerator MIPS\_DELTA\_SYM\_NO = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x7000001E Number of entries in DT\_MIPS\_DELTA\_SYM. ##### [` MIPS_DELTA_CLASSSYM `]() enumerator MIPS\_DELTA\_CLASSSYM = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000020 Delta symbols that hold class declarations. ##### [` MIPS_DELTA_CLASSSYM_NO `]() enumerator MIPS\_DELTA\_CLASSSYM\_NO = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000021 Number of entries in DT\_MIPS\_DELTA\_CLASSSYM. ##### [` MIPS_CXX_FLAGS `]() enumerator MIPS\_CXX\_FLAGS = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000022 Flags indicating information about C++ flavor. ##### [` MIPS_PIXIE_INIT `]() enumerator MIPS\_PIXIE\_INIT = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000023 Pixie information. ##### [` MIPS_SYMBOL_LIB `]() enumerator MIPS\_SYMBOL\_LIB = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000024 Address of .MIPS.symlib ##### [` MIPS_LOCALPAGE_GOTIDX `]() enumerator MIPS\_LOCALPAGE\_GOTIDX = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000025 The GOT index of the first PTE for a segment ##### [` MIPS_LOCAL_GOTIDX `]() enumerator MIPS\_LOCAL\_GOTIDX = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000026 The GOT index of the first PTE for a local symbol ##### [` MIPS_HIDDEN_GOTIDX `]() enumerator MIPS\_HIDDEN\_GOTIDX = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000027 The GOT index of the first PTE for a hidden symbol ##### [` MIPS_PROTECTED_GOTIDX `]() enumerator MIPS\_PROTECTED\_GOTIDX = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000028 The GOT index of the first PTE for a protected symbol ##### [` MIPS_OPTIONS `]() enumerator MIPS\_OPTIONS = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000029 Address of `.MIPS.options'. */ MIPS_INTERFACE = MIPS_DISC + 0x7000002A, /**< Address of` .interface’. \*/ MIPS\_DYNSTR\_ALIGN = MIPS\_DISC + 0x7000002B, /\*\*< Unknown. ##### [` MIPS_INTERFACE_SIZE `]() enumerator MIPS\_INTERFACE\_SIZE = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x7000002C Size of the .interface section. ##### [` MIPS_RLD_TEXT_RESOLVE_ADDR `]() enumerator MIPS\_RLD\_TEXT\_RESOLVE\_ADDR = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x7000002D Size of rld\_text\_resolve function stored in the GOT. ##### [` MIPS_PERF_SUFFIX `]() enumerator MIPS\_PERF\_SUFFIX = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x7000002E Default suffix of DSO to be added by rld on dlopen() calls. ##### [` MIPS_COMPACT_SIZE `]() enumerator MIPS\_COMPACT\_SIZE = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x7000002F Size of compact relocation section (O32). ##### [` MIPS_GP_VALUE `]() enumerator MIPS\_GP\_VALUE = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000030 GP value for auxiliary GOTs. ##### [` MIPS_AUX_DYNAMIC `]() enumerator MIPS\_AUX\_DYNAMIC = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000031 Address of auxiliary .dynamic. ##### [` MIPS_PLTGOT `]() enumerator MIPS\_PLTGOT = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000032 Address of the base of the PLTGOT. ##### [` MIPS_RWPLT `]() enumerator MIPS\_RWPLT = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000034 ##### [` MIPS_RLD_MAP_REL `]() enumerator MIPS\_RLD\_MAP\_REL = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000035 ##### [` MIPS_XHASH `]() enumerator MIPS\_XHASH = [MIPS\_DISC]( "LIEF::ELF::DynamicEntry::MIPS_DISC") + 0x70000036 ##### [` AARCH64_BTI_PLT `]() enumerator AARCH64\_BTI\_PLT = [AARCH64\_DISC]( "LIEF::ELF::DynamicEntry::AARCH64_DISC") + 0x70000001 ##### [` AARCH64_PAC_PLT `]() enumerator AARCH64\_PAC\_PLT = [AARCH64\_DISC]( "LIEF::ELF::DynamicEntry::AARCH64_DISC") + 0x70000003 ##### [` AARCH64_VARIANT_PCS `]() enumerator AARCH64\_VARIANT\_PCS = [AARCH64\_DISC]( "LIEF::ELF::DynamicEntry::AARCH64_DISC") + 0x70000005 ##### [` AARCH64_MEMTAG_MODE `]() enumerator AARCH64\_MEMTAG\_MODE = [AARCH64\_DISC]( "LIEF::ELF::DynamicEntry::AARCH64_DISC") + 0x70000009 ##### [` AARCH64_MEMTAG_HEAP `]() enumerator AARCH64\_MEMTAG\_HEAP = [AARCH64\_DISC]( "LIEF::ELF::DynamicEntry::AARCH64_DISC") + 0x7000000b ##### [` AARCH64_MEMTAG_STACK `]() enumerator AARCH64\_MEMTAG\_STACK = [AARCH64\_DISC]( "LIEF::ELF::DynamicEntry::AARCH64_DISC") + 0x7000000c ##### [` AARCH64_MEMTAG_GLOBALS `]() enumerator AARCH64\_MEMTAG\_GLOBALS = [AARCH64\_DISC]( "LIEF::ELF::DynamicEntry::AARCH64_DISC") + 0x7000000d ##### [` AARCH64_MEMTAG_GLOBALSSZ `]() enumerator AARCH64\_MEMTAG\_GLOBALSSZ = [AARCH64\_DISC]( "LIEF::ELF::DynamicEntry::AARCH64_DISC") + 0x7000000f ##### [` HEXAGON_SYMSZ `]() enumerator HEXAGON\_SYMSZ = [HEXAGON\_DISC]( "LIEF::ELF::DynamicEntry::HEXAGON_DISC") + 0x70000000 ##### [` HEXAGON_VER `]() enumerator HEXAGON\_VER = [HEXAGON\_DISC]( "LIEF::ELF::DynamicEntry::HEXAGON_DISC") + 0x70000001 ##### [` HEXAGON_PLT `]() enumerator HEXAGON\_PLT = [HEXAGON\_DISC]( "LIEF::ELF::DynamicEntry::HEXAGON_DISC") + 0x70000002 ##### [` PPC_GOT `]() enumerator PPC\_GOT = [PPC\_DISC]( "LIEF::ELF::DynamicEntry::PPC_DISC") + 0x70000000 ##### [` PPC_OPT `]() enumerator PPC\_OPT = [PPC\_DISC]( "LIEF::ELF::DynamicEntry::PPC_DISC") + 0x70000001 ##### [` PPC64_GLINK `]() enumerator PPC64\_GLINK = [PPC64\_DISC]( "LIEF::ELF::DynamicEntry::PPC64_DISC") + 0x70000000 ##### [` PPC64_OPT `]() enumerator PPC64\_OPT = [PPC64\_DISC]( "LIEF::ELF::DynamicEntry::PPC64_DISC") + 0x70000003 ##### [` RISCV_VARIANT_CC `]() enumerator RISCV\_VARIANT\_CC = [RISCV\_DISC]( "LIEF::ELF::DynamicEntry::RISCV_DISC") + 0x70000003 ##### [` X86_64_PLT `]() enumerator X86\_64\_PLT = [X86\_64\_DISC]( "LIEF::ELF::DynamicEntry::X86_64_DISC") + 0x70000000 ##### [` X86_64_PLTSZ `]() enumerator X86\_64\_PLTSZ = [X86\_64\_DISC]( "LIEF::ELF::DynamicEntry::X86_64_DISC") + 0x70000001 ##### [` X86_64_PLTENT `]() enumerator X86\_64\_PLTENT = [X86\_64\_DISC]( "LIEF::ELF::DynamicEntry::X86_64_DISC") + 0x70000003 ##### [` IA_64_PLT_RESERVE `]() enumerator IA\_64\_PLT\_RESERVE = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x70000000 + 0) ##### [` IA_64_VMS_SUBTYPE `]() enumerator IA\_64\_VMS\_SUBTYPE = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 0) ##### [` IA_64_VMS_IMGIOCNT `]() enumerator IA\_64\_VMS\_IMGIOCNT = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 2) ##### [` IA_64_VMS_LNKFLAGS `]() enumerator IA\_64\_VMS\_LNKFLAGS = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 8) ##### [` IA_64_VMS_VIR_MEM_BLK_SIZ `]() enumerator IA\_64\_VMS\_VIR\_MEM\_BLK\_SIZ = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 10) ##### [` IA_64_VMS_IDENT `]() enumerator IA\_64\_VMS\_IDENT = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 12) ##### [` IA_64_VMS_NEEDED_IDENT `]() enumerator IA\_64\_VMS\_NEEDED\_IDENT = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 16) ##### [` IA_64_VMS_IMG_RELA_CNT `]() enumerator IA\_64\_VMS\_IMG\_RELA\_CNT = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 18) ##### [` IA_64_VMS_SEG_RELA_CNT `]() enumerator IA\_64\_VMS\_SEG\_RELA\_CNT = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 20) ##### [` IA_64_VMS_FIXUP_RELA_CNT `]() enumerator IA\_64\_VMS\_FIXUP\_RELA\_CNT = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 22) ##### [` IA_64_VMS_FIXUP_NEEDED `]() enumerator IA\_64\_VMS\_FIXUP\_NEEDED = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 24) ##### [` IA_64_VMS_SYMVEC_CNT `]() enumerator IA\_64\_VMS\_SYMVEC\_CNT = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 26) ##### [` IA_64_VMS_XLATED `]() enumerator IA\_64\_VMS\_XLATED = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 30) ##### [` IA_64_VMS_STACKSIZE `]() enumerator IA\_64\_VMS\_STACKSIZE = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 32) ##### [` IA_64_VMS_UNWINDSZ `]() enumerator IA\_64\_VMS\_UNWINDSZ = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 34) ##### [` IA_64_VMS_UNWIND_CODSEG `]() enumerator IA\_64\_VMS\_UNWIND\_CODSEG = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 36) ##### [` IA_64_VMS_UNWIND_INFOSEG `]() enumerator IA\_64\_VMS\_UNWIND\_INFOSEG = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 38) ##### [` IA_64_VMS_LINKTIME `]() enumerator IA\_64\_VMS\_LINKTIME = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 40) ##### [` IA_64_VMS_SEG_NO `]() enumerator IA\_64\_VMS\_SEG\_NO = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 42) ##### [` IA_64_VMS_SYMVEC_OFFSET `]() enumerator IA\_64\_VMS\_SYMVEC\_OFFSET = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 44) ##### [` IA_64_VMS_SYMVEC_SEG `]() enumerator IA\_64\_VMS\_SYMVEC\_SEG = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 46) ##### [` IA_64_VMS_UNWIND_OFFSET `]() enumerator IA\_64\_VMS\_UNWIND\_OFFSET = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 48) ##### [` IA_64_VMS_UNWIND_SEG `]() enumerator IA\_64\_VMS\_UNWIND\_SEG = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 50) ##### [` IA_64_VMS_STRTAB_OFFSET `]() enumerator IA\_64\_VMS\_STRTAB\_OFFSET = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 52) ##### [` IA_64_VMS_SYSVER_OFFSET `]() enumerator IA\_64\_VMS\_SYSVER\_OFFSET = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 54) ##### [` IA_64_VMS_IMG_RELA_OFF `]() enumerator IA\_64\_VMS\_IMG\_RELA\_OFF = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 56) ##### [` IA_64_VMS_SEG_RELA_OFF `]() enumerator IA\_64\_VMS\_SEG\_RELA\_OFF = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 58) ##### [` IA_64_VMS_FIXUP_RELA_OFF `]() enumerator IA\_64\_VMS\_FIXUP\_RELA\_OFF = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 60) ##### [` IA_64_VMS_PLTGOT_OFFSET `]() enumerator IA\_64\_VMS\_PLTGOT\_OFFSET = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 62) ##### [` IA_64_VMS_PLTGOT_SEG `]() enumerator IA\_64\_VMS\_PLTGOT\_SEG = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 64) ##### [` IA_64_VMS_FPMODE `]() enumerator IA\_64\_VMS\_FPMODE = [IA\_64\_DISC]( "LIEF::ELF::DynamicEntry::IA_64_DISC") + (0x60000000 + 66) Public Functions #### [` DynamicEntry `]() DynamicEntry() = default #### [` DynamicEntry `]() DynamicEntry(const details::Elf64\_Dyn &header, [ARCH]( "LIEF::ELF::ARCH") arch) #### [` DynamicEntry `]() DynamicEntry(const details::Elf32\_Dyn &header, [ARCH]( "LIEF::ELF::ARCH") arch) #### [` DynamicEntry `]() inline DynamicEntry([TAG]( "LIEF::ELF::DynamicEntry::TAG") tag, uint64\_t value) #### [` operator= `]() [DynamicEntry]( "LIEF::ELF::DynamicEntry") &operator=(const [DynamicEntry]( "LIEF::ELF::DynamicEntry")&) = default #### [` DynamicEntry `]() DynamicEntry(const [DynamicEntry]( "LIEF::ELF::DynamicEntry::DynamicEntry")&) = default #### [` ~DynamicEntry `]() ~DynamicEntry() override = default #### [` clone `]() inline virtual std::unique\_ptr<[DynamicEntry]( "LIEF::ELF::DynamicEntry")> clone() const #### [` tag `]() inline [TAG]( "LIEF::ELF::DynamicEntry::TAG") tag() const Tag of the current entry. The most common tags are: DT\_NEEDED, DT\_INIT, … #### [` value `]() inline uint64\_t value() const Return the entry’s value. The meaning of the value strongly depends on the tag. It can be an offset, an index, a flag, … #### [` tag `]() inline void tag([TAG]( "LIEF::ELF::DynamicEntry::TAG") tag) #### [` value `]() inline void value(uint64\_t value) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const #### [` to_string `]() std::string to\_string() const #### [` Tcast `]() template<class T> inline const [T]( "LIEF::ELF::DynamicEntry::cast::T") \*cast() const #### [` Tcast `]() template<class T> inline [T]( "LIEF::ELF::DynamicEntry::cast::T") \*cast() Public Static Functions #### [` from_value `]() static [TAG]( "LIEF::ELF::DynamicEntry::TAG") from\_value(uint64\_t value, [ARCH]( "LIEF::ELF::ARCH") arch) #### [` to_value `]() static uint64\_t to\_value([TAG]( "LIEF::ELF::DynamicEntry::TAG") tag) #### [` create `]() static std::unique\_ptr<[DynamicEntry]( "LIEF::ELF::DynamicEntry")> create([TAG]( "LIEF::ELF::DynamicEntry::TAG") tag, uint64\_t value) #### [` create `]() static inline std::unique\_ptr<[DynamicEntry]( "LIEF::ELF::DynamicEntry")> create([TAG]( "LIEF::ELF::DynamicEntry::TAG") tag) Public Static Attributes #### [` MIPS_DISC `]() static uint64\_t MIPS\_DISC = 0x100000000 #### [` AARCH64_DISC `]() static uint64\_t AARCH64\_DISC = 0x200000000 #### [` HEXAGON_DISC `]() static uint64\_t HEXAGON\_DISC = 0x300000000 #### [` PPC_DISC `]() static uint64\_t PPC\_DISC = 0x400000000 #### [` PPC64_DISC `]() static uint64\_t PPC64\_DISC = 0x500000000 #### [` RISCV_DISC `]() static uint64\_t RISCV\_DISC = 0x600000000 #### [` X86_64_DISC `]() static uint64\_t X86\_64\_DISC = 0x700000000 #### [` IA_64_DISC `]() static uint64\_t IA\_64\_DISC = 0x800000000 Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [DynamicEntry]( "LIEF::ELF::DynamicEntry") &entry) --- ## [Dynamic Entry Library]() ### [` DynamicEntryLibrary `]() class DynamicEntryLibrary : public LIEF::ELF::[DynamicEntry]( "LIEF::ELF::DynamicEntry") Class which represents a `DT_NEEDED` entry in the dynamic table. This kind of entry is usually used to create library dependency. Public Functions #### [` DynamicEntryLibrary `]() inline DynamicEntryLibrary() #### [` DynamicEntryLibrary `]() inline DynamicEntryLibrary(std::string name) #### [` operator= `]() [DynamicEntryLibrary]( "LIEF::ELF::DynamicEntryLibrary") &operator=(const [DynamicEntryLibrary]( "LIEF::ELF::DynamicEntryLibrary")&) = default #### [` DynamicEntryLibrary `]() DynamicEntryLibrary(const [DynamicEntryLibrary]( "LIEF::ELF::DynamicEntryLibrary::DynamicEntryLibrary")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[DynamicEntry]( "LIEF::ELF::DynamicEntryLibrary::DynamicEntry")> clone() const override #### [` name `]() inline std::string\_view name() const Return the library associated with this entry (e.g. `libc.so.6`). #### [` name `]() inline void name(std::string name) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override #### [` DynamicEntry `]() DynamicEntry() = default #### [` DynamicEntry `]() DynamicEntry(const details::Elf64\_Dyn &header, [ARCH]( "LIEF::ELF::ARCH") arch) #### [` DynamicEntry `]() DynamicEntry(const details::Elf32\_Dyn &header, [ARCH]( "LIEF::ELF::ARCH") arch) #### [` DynamicEntry `]() inline DynamicEntry(TAG tag, uint64\_t value) #### [` DynamicEntry `]() DynamicEntry(const [DynamicEntry]( "LIEF::ELF::DynamicEntryLibrary::DynamicEntry")&) = default Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicEntry]( "LIEF::ELF::DynamicEntryLibrary::DynamicEntry") \*entry) --- ## [Dynamic Shared Object]() ### [` DynamicSharedObject `]() class DynamicSharedObject : public LIEF::ELF::[DynamicEntry]( "LIEF::ELF::DynamicEntry") Class which represents a `DT_SONAME` entry in the dynamic table This kind of entry is usually used to name the original library. This entry is not present for executables. Public Functions #### [` DynamicSharedObject `]() inline DynamicSharedObject() #### [` DynamicSharedObject `]() inline DynamicSharedObject(std::string name) #### [` operator= `]() [DynamicSharedObject]( "LIEF::ELF::DynamicSharedObject") &operator=(const [DynamicSharedObject]( "LIEF::ELF::DynamicSharedObject")&) = default #### [` DynamicSharedObject `]() DynamicSharedObject(const [DynamicSharedObject]( "LIEF::ELF::DynamicSharedObject::DynamicSharedObject")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[DynamicEntry]( "LIEF::ELF::DynamicSharedObject::DynamicEntry")> clone() const override #### [` name `]() inline std::string\_view name() const The actual name (e.g. `libMyLib.so`). #### [` name `]() inline void name(std::string name) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override #### [` ~DynamicSharedObject `]() ~DynamicSharedObject() override = default #### [` DynamicEntry `]() DynamicEntry() = default #### [` DynamicEntry `]() DynamicEntry(const details::Elf64\_Dyn &header, [ARCH]( "LIEF::ELF::ARCH") arch) #### [` DynamicEntry `]() DynamicEntry(const details::Elf32\_Dyn &header, [ARCH]( "LIEF::ELF::ARCH") arch) #### [` DynamicEntry `]() inline DynamicEntry(TAG tag, uint64\_t value) #### [` DynamicEntry `]() DynamicEntry(const [DynamicEntry]( "LIEF::ELF::DynamicSharedObject::DynamicEntry")&) = default Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicEntry]( "LIEF::ELF::DynamicSharedObject::DynamicEntry") \*entry) --- ## [Dynamic Entry Run Path]() ### [` DynamicEntryRunPath `]() class DynamicEntryRunPath : public LIEF::ELF::[DynamicEntry]( "LIEF::ELF::DynamicEntry") Class that represents a `DT_RUNPATH` which is used by the loader to resolve libraries ([DynamicEntryLibrary]()). Public Functions #### [` DynamicEntryRunPath `]() inline DynamicEntryRunPath() #### [` DynamicEntryRunPath `]() inline DynamicEntryRunPath(std::string runpath) Constructor from (run)path. #### [` DynamicEntryRunPath `]() inline DynamicEntryRunPath(const std::vector<std::string> &paths) Constructor from a list of paths. #### [` operator= `]() [DynamicEntryRunPath]( "LIEF::ELF::DynamicEntryRunPath") &operator=(const [DynamicEntryRunPath]( "LIEF::ELF::DynamicEntryRunPath")&) = default #### [` DynamicEntryRunPath `]() DynamicEntryRunPath(const [DynamicEntryRunPath]( "LIEF::ELF::DynamicEntryRunPath::DynamicEntryRunPath")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[DynamicEntry]( "LIEF::ELF::DynamicEntryRunPath::DynamicEntry")> clone() const override #### [` runpath `]() inline std::string\_view runpath() const Runpath raw value. #### [` runpath `]() inline void runpath(std::string runpath) #### [` paths `]() std::vector<std::string> paths() const Paths as a list. #### [` paths `]() void paths(const std::vector<std::string> &paths) #### [` insert `]() [DynamicEntryRunPath]( "LIEF::ELF::DynamicEntryRunPath") &insert(size\_t pos, const std::string &path) Insert a `path` at the given `position`. #### [` append `]() [DynamicEntryRunPath]( "LIEF::ELF::DynamicEntryRunPath") &append(const std::string &path) Append the given `path`. #### [` remove `]() [DynamicEntryRunPath]( "LIEF::ELF::DynamicEntryRunPath") &remove(const std::string &path) Remove the given `path`. #### [` operator+= `]() inline [DynamicEntryRunPath]( "LIEF::ELF::DynamicEntryRunPath") &operator+=(const std::string &path) #### [` operator-= `]() inline [DynamicEntryRunPath]( "LIEF::ELF::DynamicEntryRunPath") &operator-=(const std::string &path) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override #### [` ~DynamicEntryRunPath `]() ~DynamicEntryRunPath() override = default #### [` DynamicEntry `]() DynamicEntry() = default #### [` DynamicEntry `]() DynamicEntry(const details::Elf64\_Dyn &header, [ARCH]( "LIEF::ELF::ARCH") arch) #### [` DynamicEntry `]() DynamicEntry(const details::Elf32\_Dyn &header, [ARCH]( "LIEF::ELF::ARCH") arch) #### [` DynamicEntry `]() inline DynamicEntry(TAG tag, uint64\_t value) #### [` DynamicEntry `]() DynamicEntry(const [DynamicEntry]( "LIEF::ELF::DynamicEntryRunPath::DynamicEntry")&) = default Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicEntry]( "LIEF::ELF::DynamicEntryRunPath::DynamicEntry") \*entry) Public Static Attributes #### [` delimiter `]() static char delimiter = ':' --- ## [Dynamic Entry RPath]() ### [` DynamicEntryRpath `]() class DynamicEntryRpath : public LIEF::ELF::[DynamicEntry]( "LIEF::ELF::DynamicEntry") Class which represents a `DT_RPATH` entry. This attribute is deprecated (cf. `man ld`) in favor of `DT_RUNPATH` (See [DynamicEntryRunPath]()). Public Functions #### [` DynamicEntryRpath `]() inline DynamicEntryRpath() #### [` DynamicEntryRpath `]() inline DynamicEntryRpath(std::string rpath) #### [` DynamicEntryRpath `]() inline DynamicEntryRpath(const std::vector<std::string> &paths) Constructor from a list of paths. #### [` operator= `]() [DynamicEntryRpath]( "LIEF::ELF::DynamicEntryRpath") &operator=(const [DynamicEntryRpath]( "LIEF::ELF::DynamicEntryRpath")&) = default #### [` DynamicEntryRpath `]() DynamicEntryRpath(const [DynamicEntryRpath]( "LIEF::ELF::DynamicEntryRpath::DynamicEntryRpath")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[DynamicEntry]( "LIEF::ELF::DynamicEntryRpath::DynamicEntry")> clone() const override #### [` rpath `]() inline std::string\_view rpath() const The actual rpath as a string. #### [` rpath `]() inline void rpath(std::string name) #### [` paths `]() std::vector<std::string> paths() const Paths as a list. #### [` paths `]() void paths(const std::vector<std::string> &paths) #### [` insert `]() [DynamicEntryRpath]( "LIEF::ELF::DynamicEntryRpath") &insert(size\_t pos, const std::string &path) Insert a `path` at the given `position`. #### [` append `]() [DynamicEntryRpath]( "LIEF::ELF::DynamicEntryRpath") &append(std::string path) Append the given `path`. #### [` remove `]() [DynamicEntryRpath]( "LIEF::ELF::DynamicEntryRpath") &remove(const std::string &path) Remove the given `path`. #### [` operator+= `]() inline [DynamicEntryRpath]( "LIEF::ELF::DynamicEntryRpath") &operator+=(std::string path) #### [` operator-= `]() inline [DynamicEntryRpath]( "LIEF::ELF::DynamicEntryRpath") &operator-=(const std::string &path) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override #### [` ~DynamicEntryRpath `]() ~DynamicEntryRpath() override = default #### [` DynamicEntry `]() DynamicEntry() = default #### [` DynamicEntry `]() DynamicEntry(const details::Elf64\_Dyn &header, [ARCH]( "LIEF::ELF::ARCH") arch) #### [` DynamicEntry `]() DynamicEntry(const details::Elf32\_Dyn &header, [ARCH]( "LIEF::ELF::ARCH") arch) #### [` DynamicEntry `]() inline DynamicEntry(TAG tag, uint64\_t value) #### [` DynamicEntry `]() DynamicEntry(const [DynamicEntry]( "LIEF::ELF::DynamicEntryRpath::DynamicEntry")&) = default Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicEntry]( "LIEF::ELF::DynamicEntryRpath::DynamicEntry") \*entry) Public Static Attributes #### [` delimiter `]() static char delimiter = ':' --- ## [Dynamic Entry Array]() ### [` DynamicEntryArray `]() class DynamicEntryArray : public LIEF::ELF::[DynamicEntry]( "LIEF::ELF::DynamicEntry") Class that represent an Array in the dynamic table. This entry is associated with constructors: - `DT_PREINIT_ARRAY` - `DT_INIT_ARRAY` - `DT_FINI_ARRAY` The underlying values are 64-bits integers to cover both: ELF32 and ELF64 binaries. Public Types #### [` array_t `]() using array\_t = std::vector<uint64\_t> Public Functions #### [` DynamicEntryArray `]() DynamicEntryArray() = delete #### [` DynamicEntryArray `]() inline DynamicEntryArray([DynamicEntry]( "LIEF::ELF::DynamicEntryArray::DynamicEntry")::TAG tag, [array\_t]( "LIEF::ELF::DynamicEntryArray::array_t") array) #### [` operator= `]() [DynamicEntryArray]( "LIEF::ELF::DynamicEntryArray") &operator=(const [DynamicEntryArray]( "LIEF::ELF::DynamicEntryArray")&) = default #### [` DynamicEntryArray `]() DynamicEntryArray(const [DynamicEntryArray]( "LIEF::ELF::DynamicEntryArray::DynamicEntryArray")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[DynamicEntry]( "LIEF::ELF::DynamicEntryArray::DynamicEntry")> clone() const override #### [` array `]() inline [array\_t]( "LIEF::ELF::DynamicEntryArray::array_t") &array() Return the array values (list of pointers). #### [` array `]() inline const [array\_t]( "LIEF::ELF::DynamicEntryArray::array_t") &array() const #### [` array `]() inline void array(const [array\_t]( "LIEF::ELF::DynamicEntryArray::array_t") &array) #### [` insert `]() [DynamicEntryArray]( "LIEF::ELF::DynamicEntryArray") &insert(size\_t pos, uint64\_t function) Insert the given function at `pos`. #### [` append `]() inline [DynamicEntryArray]( "LIEF::ELF::DynamicEntryArray") &append(uint64\_t function) Append the given function. #### [` remove `]() [DynamicEntryArray]( "LIEF::ELF::DynamicEntryArray") &remove(uint64\_t function) Remove the given function. #### [` size `]() inline size\_t size() const Number of functions registered in this array. #### [` operator+= `]() inline [DynamicEntryArray]( "LIEF::ELF::DynamicEntryArray") &operator+=(uint64\_t value) #### [` operator-= `]() inline [DynamicEntryArray]( "LIEF::ELF::DynamicEntryArray") &operator-=(uint64\_t value) #### [` operator[] `]() const uint64\_t &operator[](size\_t idx) const #### [` operator[] `]() uint64\_t &operator[](size\_t idx) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override #### [` ~DynamicEntryArray `]() ~DynamicEntryArray() override = default #### [` DynamicEntry `]() DynamicEntry() = default #### [` DynamicEntry `]() DynamicEntry(const details::Elf64\_Dyn &header, [ARCH]( "LIEF::ELF::ARCH") arch) #### [` DynamicEntry `]() DynamicEntry(const details::Elf32\_Dyn &header, [ARCH]( "LIEF::ELF::ARCH") arch) #### [` DynamicEntry `]() inline DynamicEntry(TAG tag, uint64\_t value) #### [` DynamicEntry `]() DynamicEntry(const [DynamicEntry]( "LIEF::ELF::DynamicEntryArray::DynamicEntry")&) = default Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicEntry]( "LIEF::ELF::DynamicEntryArray::DynamicEntry") \*entry) --- ## [Dynamic Entry Flags]() ### [` DynamicEntryFlags `]() class DynamicEntryFlags : public LIEF::ELF::[DynamicEntry]( "LIEF::ELF::DynamicEntry") Public Types #### [` FLAG `]() enum class FLAG : uint64\_t *Values:* ##### [` ORIGIN `]() enumerator ORIGIN = 0x00000001 The object may reference $ORIGIN. ##### [` SYMBOLIC `]() enumerator SYMBOLIC = 0x00000002 Search the shared lib before searching the exe. ##### [` TEXTREL `]() enumerator TEXTREL = 0x00000004 Relocations may modify a non-writable segment. ##### [` BIND_NOW `]() enumerator BIND\_NOW = 0x00000008 Process all relocations on load. ##### [` STATIC_TLS `]() enumerator STATIC\_TLS = 0x00000010 Reject attempts to load dynamically. ##### [` NOW `]() enumerator NOW = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000000001 Set RTLD\_NOW for this object. ##### [` GLOBAL `]() enumerator GLOBAL = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000000002 Set RTLD\_GLOBAL for this object. ##### [` GROUP `]() enumerator GROUP = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000000004 Set RTLD\_GROUP for this object. ##### [` NODELETE `]() enumerator NODELETE = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000000008 Set RTLD\_NODELETE for this object. ##### [` LOADFLTR `]() enumerator LOADFLTR = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000000010 Trigger filtee loading at runtime. ##### [` INITFIRST `]() enumerator INITFIRST = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000000020 Set RTLD\_INITFIRST for this object. ##### [` NOOPEN `]() enumerator NOOPEN = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000000040 Set RTLD\_NOOPEN for this object. ##### [` HANDLE_ORIGIN `]() enumerator HANDLE\_ORIGIN = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000000080 $ORIGIN must be handled. ##### [` DIRECT `]() enumerator DIRECT = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000000100 Direct binding enabled. ##### [` TRANS `]() enumerator TRANS = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000000200 ##### [` INTERPOSE `]() enumerator INTERPOSE = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000000400 Object is used to interpose. ##### [` NODEFLIB `]() enumerator NODEFLIB = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000000800 Ignore default lib search path. ##### [` NODUMP `]() enumerator NODUMP = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000001000 Object can’t be dumped with dldump(). ##### [` CONFALT `]() enumerator CONFALT = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000002000 Configuration alternative created. ##### [` ENDFILTEE `]() enumerator ENDFILTEE = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000004000 Filtee terminates filters search. ##### [` DISPRELDNE `]() enumerator DISPRELDNE = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000008000 Disp reloc applied at build time. ##### [` DISPRELPND `]() enumerator DISPRELPND = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000010000 Disp reloc applied at run-time. ##### [` NODIRECT `]() enumerator NODIRECT = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000020000 Object has no-direct binding. ##### [` IGNMULDEF `]() enumerator IGNMULDEF = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000040000 ##### [` NOKSYMS `]() enumerator NOKSYMS = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000080000 ##### [` NOHDR `]() enumerator NOHDR = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000100000 ##### [` EDITED `]() enumerator EDITED = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000200000 Object is modified after built. ##### [` NORELOC `]() enumerator NORELOC = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000400000 ##### [` SYMINTPOSE `]() enumerator SYMINTPOSE = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x000800000 Object has individual interposers. ##### [` GLOBAUDIT `]() enumerator GLOBAUDIT = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x001000000 Global auditing required. ##### [` SINGLETON `]() enumerator SINGLETON = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x002000000 Singleton symbols are used. ##### [` PIE `]() enumerator PIE = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x008000000 Singleton symbols are used. ##### [` KMOD `]() enumerator KMOD = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x010000000 ##### [` WEAKFILTER `]() enumerator WEAKFILTER = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x020000000 ##### [` NOCOMMON `]() enumerator NOCOMMON = [BASE]( "LIEF::ELF::DynamicEntryFlags::BASE") + 0x040000000 #### [` flags_list_t `]() using flags\_list\_t = std::vector<[FLAG]( "LIEF::ELF::DynamicEntryFlags::FLAG")> Public Functions #### [` DynamicEntryFlags `]() DynamicEntryFlags() = delete #### [` operator= `]() [DynamicEntryFlags]( "LIEF::ELF::DynamicEntryFlags") &operator=(const [DynamicEntryFlags]( "LIEF::ELF::DynamicEntryFlags")&) = default #### [` DynamicEntryFlags `]() DynamicEntryFlags(const [DynamicEntryFlags]( "LIEF::ELF::DynamicEntryFlags::DynamicEntryFlags")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[DynamicEntry]( "LIEF::ELF::DynamicEntryFlags::DynamicEntry")> clone() const override #### [` has `]() bool has([FLAG]( "LIEF::ELF::DynamicEntryFlags::FLAG") f) const If the current entry has the given [FLAG](). #### [` flags `]() [flags\_list\_t]( "LIEF::ELF::DynamicEntryFlags::flags_list_t") flags() const Return flags as a list of integers. #### [` raw_flags `]() inline uint64\_t raw\_flags() const #### [` add `]() void add([FLAG]( "LIEF::ELF::DynamicEntryFlags::FLAG") f) Add the given [FLAG](). #### [` remove `]() void remove([FLAG]( "LIEF::ELF::DynamicEntryFlags::FLAG") f) Remove the given [FLAG](). #### [` operator+= `]() inline [DynamicEntryFlags]( "LIEF::ELF::DynamicEntryFlags") &operator+=([FLAG]( "LIEF::ELF::DynamicEntryFlags::FLAG") f) #### [` operator-= `]() inline [DynamicEntryFlags]( "LIEF::ELF::DynamicEntryFlags") &operator-=([FLAG]( "LIEF::ELF::DynamicEntryFlags::FLAG") f) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~DynamicEntryFlags `]() ~DynamicEntryFlags() override = default #### [` print `]() virtual std::ostream &print(std::ostream &os) const override #### [` DynamicEntry `]() DynamicEntry() = default #### [` DynamicEntry `]() DynamicEntry(const details::Elf64\_Dyn &header, [ARCH]( "LIEF::ELF::ARCH") arch) #### [` DynamicEntry `]() DynamicEntry(const details::Elf32\_Dyn &header, [ARCH]( "LIEF::ELF::ARCH") arch) #### [` DynamicEntry `]() inline DynamicEntry(TAG tag, uint64\_t value) #### [` DynamicEntry `]() DynamicEntry(const [DynamicEntry]( "LIEF::ELF::DynamicEntryFlags::DynamicEntry")&) = default Public Static Functions #### [` create_dt_flag `]() static inline [DynamicEntryFlags]( "LIEF::ELF::DynamicEntryFlags") create\_dt\_flag(uint64\_t value) #### [` create_dt_flag_1 `]() static inline [DynamicEntryFlags]( "LIEF::ELF::DynamicEntryFlags") create\_dt\_flag\_1(uint64\_t value) #### [` classof `]() static inline bool classof(const [DynamicEntry]( "LIEF::ELF::DynamicEntryFlags::DynamicEntry") \*entry) Public Static Attributes #### [` BASE `]() static uint64\_t BASE = 0x100000000 --- ## [Dynamic Entry Auxiliary]() ### [` DynamicEntryAuxiliary `]() class DynamicEntryAuxiliary : public LIEF::ELF::[DynamicEntry]( "LIEF::ELF::DynamicEntry") Class which represents a `DT_AUXILIARY` entry in the dynamic table This kind of entry is used to specify a shared object that should be loaded before the current one. Public Functions #### [` DynamicEntryAuxiliary `]() inline DynamicEntryAuxiliary() #### [` DynamicEntryAuxiliary `]() inline DynamicEntryAuxiliary(std::string name) #### [` operator= `]() [DynamicEntryAuxiliary]( "LIEF::ELF::DynamicEntryAuxiliary") &operator=(const [DynamicEntryAuxiliary]( "LIEF::ELF::DynamicEntryAuxiliary")&) = default #### [` DynamicEntryAuxiliary `]() DynamicEntryAuxiliary(const [DynamicEntryAuxiliary]( "LIEF::ELF::DynamicEntryAuxiliary::DynamicEntryAuxiliary")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[DynamicEntry]( "LIEF::ELF::DynamicEntryAuxiliary::DynamicEntry")> clone() const override #### [` name `]() inline std::string\_view name() const The actual name (e.g. `libaux.so`). #### [` name `]() inline void name(std::string name) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override #### [` ~DynamicEntryAuxiliary `]() ~DynamicEntryAuxiliary() override = default #### [` DynamicEntry `]() DynamicEntry() = default #### [` DynamicEntry `]() DynamicEntry(const details::Elf64\_Dyn &header, [ARCH]( "LIEF::ELF::ARCH") arch) #### [` DynamicEntry `]() DynamicEntry(const details::Elf32\_Dyn &header, [ARCH]( "LIEF::ELF::ARCH") arch) #### [` DynamicEntry `]() inline DynamicEntry(TAG tag, uint64\_t value) #### [` DynamicEntry `]() DynamicEntry(const [DynamicEntry]( "LIEF::ELF::DynamicEntryAuxiliary::DynamicEntry")&) = default Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicEntry]( "LIEF::ELF::DynamicEntryAuxiliary::DynamicEntry") \*entry) --- ## [Dynamic Entry Filter]() ### [` DynamicEntryFilter `]() class DynamicEntryFilter : public LIEF::ELF::[DynamicEntry]( "LIEF::ELF::DynamicEntry") Class which represents a `DT_FILTER` entry in the dynamic table This kind of entry is used to specify a shared object for which the current one is a filter. Public Functions #### [` DynamicEntryFilter `]() inline DynamicEntryFilter() #### [` DynamicEntryFilter `]() inline DynamicEntryFilter(std::string name) #### [` operator= `]() [DynamicEntryFilter]( "LIEF::ELF::DynamicEntryFilter") &operator=(const [DynamicEntryFilter]( "LIEF::ELF::DynamicEntryFilter")&) = default #### [` DynamicEntryFilter `]() DynamicEntryFilter(const [DynamicEntryFilter]( "LIEF::ELF::DynamicEntryFilter::DynamicEntryFilter")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[DynamicEntry]( "LIEF::ELF::DynamicEntryFilter::DynamicEntry")> clone() const override #### [` name `]() inline std::string\_view name() const The actual name (e.g. `libfilter.so`). #### [` name `]() inline void name(std::string name) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override #### [` ~DynamicEntryFilter `]() ~DynamicEntryFilter() override = default #### [` DynamicEntry `]() DynamicEntry() = default #### [` DynamicEntry `]() DynamicEntry(const details::Elf64\_Dyn &header, [ARCH]( "LIEF::ELF::ARCH") arch) #### [` DynamicEntry `]() DynamicEntry(const details::Elf32\_Dyn &header, [ARCH]( "LIEF::ELF::ARCH") arch) #### [` DynamicEntry `]() inline DynamicEntry(TAG tag, uint64\_t value) #### [` DynamicEntry `]() DynamicEntry(const [DynamicEntry]( "LIEF::ELF::DynamicEntryFilter::DynamicEntry")&) = default Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicEntry]( "LIEF::ELF::DynamicEntryFilter::DynamicEntry") \*entry) --- ## [Relocations]() ### [` Relocation `]() class Relocation : public LIEF::[Relocation]( "LIEF::Relocation") Class that represents an ELF relocation. Public Types #### [` PURPOSE `]() enum class PURPOSE The *purpose* of a relocation defines how this relocation is used by the loader. *Values:* ##### [` NONE `]() enumerator NONE = 0 ##### [` PLTGOT `]() enumerator PLTGOT The relocation is associated with the PLT/GOT resolution. ##### [` DYNAMIC `]() enumerator DYNAMIC The relocation is used for regular data/code relocation. ##### [` OBJECT `]() enumerator OBJECT The relocation is used in an object file. #### [` ENCODING `]() enum class ENCODING *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` REL `]() enumerator REL The relocation is using the regular Elf\_Rel structure. ##### [` RELA `]() enumerator RELA The relocation is using the regular Elf\_Rela structure. ##### [` RELR `]() enumerator RELR The relocation is using the relative relocation format. ##### [` ANDROID_SLEB `]() enumerator ANDROID\_SLEB The relocation is using the packed Android-SLEB128 format. #### [` TYPE `]() enum class TYPE : uint32\_t The different types of the relocation. *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = uint32\_t(-1) ##### [` X86_64_NONE `]() enumerator X86\_64\_NONE = (0 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_64 `]() enumerator X86\_64\_64 = (1 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_PC32 `]() enumerator X86\_64\_PC32 = (2 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_GOT32 `]() enumerator X86\_64\_GOT32 = (3 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_PLT32 `]() enumerator X86\_64\_PLT32 = (4 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_COPY `]() enumerator X86\_64\_COPY = (5 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_GLOB_DAT `]() enumerator X86\_64\_GLOB\_DAT = (6 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_JUMP_SLOT `]() enumerator X86\_64\_JUMP\_SLOT = (7 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_RELATIVE `]() enumerator X86\_64\_RELATIVE = (8 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_GOTPCREL `]() enumerator X86\_64\_GOTPCREL = (9 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_32 `]() enumerator X86\_64\_32 = (10 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_32S `]() enumerator X86\_64\_32S = (11 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_16 `]() enumerator X86\_64\_16 = (12 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_PC16 `]() enumerator X86\_64\_PC16 = (13 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_8 `]() enumerator X86\_64\_8 = (14 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_PC8 `]() enumerator X86\_64\_PC8 = (15 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_DTPMOD64 `]() enumerator X86\_64\_DTPMOD64 = (16 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_DTPOFF64 `]() enumerator X86\_64\_DTPOFF64 = (17 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_TPOFF64 `]() enumerator X86\_64\_TPOFF64 = (18 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_TLSGD `]() enumerator X86\_64\_TLSGD = (19 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_TLSLD `]() enumerator X86\_64\_TLSLD = (20 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_DTPOFF32 `]() enumerator X86\_64\_DTPOFF32 = (21 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_GOTTPOFF `]() enumerator X86\_64\_GOTTPOFF = (22 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_TPOFF32 `]() enumerator X86\_64\_TPOFF32 = (23 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_PC64 `]() enumerator X86\_64\_PC64 = (24 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_GOTOFF64 `]() enumerator X86\_64\_GOTOFF64 = (25 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_GOTPC32 `]() enumerator X86\_64\_GOTPC32 = (26 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_GOT64 `]() enumerator X86\_64\_GOT64 = (27 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_GOTPCREL64 `]() enumerator X86\_64\_GOTPCREL64 = (28 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_GOTPC64 `]() enumerator X86\_64\_GOTPC64 = (29 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_GOTPLT64 `]() enumerator X86\_64\_GOTPLT64 = (30 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_PLTOFF64 `]() enumerator X86\_64\_PLTOFF64 = (31 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_SIZE32 `]() enumerator X86\_64\_SIZE32 = (32 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_SIZE64 `]() enumerator X86\_64\_SIZE64 = (33 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_GOTPC32_TLSDESC `]() enumerator X86\_64\_GOTPC32\_TLSDESC = (34 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_TLSDESC_CALL `]() enumerator X86\_64\_TLSDESC\_CALL = (35 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_TLSDESC `]() enumerator X86\_64\_TLSDESC = (36 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_IRELATIVE `]() enumerator X86\_64\_IRELATIVE = (37 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_RELATIVE64 `]() enumerator X86\_64\_RELATIVE64 = (38 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_PC32_BND `]() enumerator X86\_64\_PC32\_BND = (39 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_PLT32_BND `]() enumerator X86\_64\_PLT32\_BND = (40 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_GOTPCRELX `]() enumerator X86\_64\_GOTPCRELX = (41 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` X86_64_REX_GOTPCRELX `]() enumerator X86\_64\_REX\_GOTPCRELX = (42 | [R\_X64]( "LIEF::ELF::Relocation::R_X64")) ##### [` AARCH64_NONE `]() enumerator AARCH64\_NONE = (0 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_ABS64 `]() enumerator AARCH64\_ABS64 = (0x101 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_ABS32 `]() enumerator AARCH64\_ABS32 = (0x102 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_ABS16 `]() enumerator AARCH64\_ABS16 = (0x103 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_PREL64 `]() enumerator AARCH64\_PREL64 = (0x104 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_PREL32 `]() enumerator AARCH64\_PREL32 = (0x105 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_PREL16 `]() enumerator AARCH64\_PREL16 = (0x106 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_UABS_G0 `]() enumerator AARCH64\_MOVW\_UABS\_G0 = (0x107 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_UABS_G0_NC `]() enumerator AARCH64\_MOVW\_UABS\_G0\_NC = (0x108 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_UABS_G1 `]() enumerator AARCH64\_MOVW\_UABS\_G1 = (0x109 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_UABS_G1_NC `]() enumerator AARCH64\_MOVW\_UABS\_G1\_NC = (0x10a | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_UABS_G2 `]() enumerator AARCH64\_MOVW\_UABS\_G2 = (0x10b | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_UABS_G2_NC `]() enumerator AARCH64\_MOVW\_UABS\_G2\_NC = (0x10c | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_UABS_G3 `]() enumerator AARCH64\_MOVW\_UABS\_G3 = (0x10d | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_SABS_G0 `]() enumerator AARCH64\_MOVW\_SABS\_G0 = (0x10e | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_SABS_G1 `]() enumerator AARCH64\_MOVW\_SABS\_G1 = (0x10f | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_SABS_G2 `]() enumerator AARCH64\_MOVW\_SABS\_G2 = (0x110 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_LD_PREL_LO19 `]() enumerator AARCH64\_LD\_PREL\_LO19 = (0x111 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_ADR_PREL_LO21 `]() enumerator AARCH64\_ADR\_PREL\_LO21 = (0x112 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_ADR_PREL_PG_HI21 `]() enumerator AARCH64\_ADR\_PREL\_PG\_HI21 = (0x113 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_ADR_PREL_PG_HI21_NC `]() enumerator AARCH64\_ADR\_PREL\_PG\_HI21\_NC = (0x114 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_ADD_ABS_LO12_NC `]() enumerator AARCH64\_ADD\_ABS\_LO12\_NC = (0x115 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_LDST8_ABS_LO12_NC `]() enumerator AARCH64\_LDST8\_ABS\_LO12\_NC = (0x116 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TSTBR14 `]() enumerator AARCH64\_TSTBR14 = (0x117 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_CONDBR19 `]() enumerator AARCH64\_CONDBR19 = (0x118 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_JUMP26 `]() enumerator AARCH64\_JUMP26 = (0x11a | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_CALL26 `]() enumerator AARCH64\_CALL26 = (0x11b | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_LDST16_ABS_LO12_NC `]() enumerator AARCH64\_LDST16\_ABS\_LO12\_NC = (0x11c | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_LDST32_ABS_LO12_NC `]() enumerator AARCH64\_LDST32\_ABS\_LO12\_NC = (0x11d | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_LDST64_ABS_LO12_NC `]() enumerator AARCH64\_LDST64\_ABS\_LO12\_NC = (0x11e | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_PREL_G0 `]() enumerator AARCH64\_MOVW\_PREL\_G0 = (0x11f | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_PREL_G0_NC `]() enumerator AARCH64\_MOVW\_PREL\_G0\_NC = (0x120 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_PREL_G1 `]() enumerator AARCH64\_MOVW\_PREL\_G1 = (0x121 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_PREL_G1_NC `]() enumerator AARCH64\_MOVW\_PREL\_G1\_NC = (0x122 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_PREL_G2 `]() enumerator AARCH64\_MOVW\_PREL\_G2 = (0x123 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_PREL_G2_NC `]() enumerator AARCH64\_MOVW\_PREL\_G2\_NC = (0x124 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_PREL_G3 `]() enumerator AARCH64\_MOVW\_PREL\_G3 = (0x125 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_LDST128_ABS_LO12_NC `]() enumerator AARCH64\_LDST128\_ABS\_LO12\_NC = (0x12b | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_GOTOFF_G0 `]() enumerator AARCH64\_MOVW\_GOTOFF\_G0 = (0x12c | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_GOTOFF_G0_NC `]() enumerator AARCH64\_MOVW\_GOTOFF\_G0\_NC = (0x12d | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_GOTOFF_G1 `]() enumerator AARCH64\_MOVW\_GOTOFF\_G1 = (0x12e | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_GOTOFF_G1_NC `]() enumerator AARCH64\_MOVW\_GOTOFF\_G1\_NC = (0x12f | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_GOTOFF_G2 `]() enumerator AARCH64\_MOVW\_GOTOFF\_G2 = (0x130 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_GOTOFF_G2_NC `]() enumerator AARCH64\_MOVW\_GOTOFF\_G2\_NC = (0x131 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_MOVW_GOTOFF_G3 `]() enumerator AARCH64\_MOVW\_GOTOFF\_G3 = (0x132 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_GOTREL64 `]() enumerator AARCH64\_GOTREL64 = (0x133 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_GOTREL32 `]() enumerator AARCH64\_GOTREL32 = (0x134 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_GOT_LD_PREL19 `]() enumerator AARCH64\_GOT\_LD\_PREL19 = (0x135 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_LD64_GOTOFF_LO15 `]() enumerator AARCH64\_LD64\_GOTOFF\_LO15 = (0x136 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_ADR_GOT_PAGE `]() enumerator AARCH64\_ADR\_GOT\_PAGE = (0x137 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_LD64_GOT_LO12_NC `]() enumerator AARCH64\_LD64\_GOT\_LO12\_NC = (0x138 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_LD64_GOTPAGE_LO15 `]() enumerator AARCH64\_LD64\_GOTPAGE\_LO15 = (0x139 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSGD_ADR_PREL21 `]() enumerator AARCH64\_TLSGD\_ADR\_PREL21 = (0x200 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSGD_ADR_PAGE21 `]() enumerator AARCH64\_TLSGD\_ADR\_PAGE21 = (0x201 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSGD_ADD_LO12_NC `]() enumerator AARCH64\_TLSGD\_ADD\_LO12\_NC = (0x202 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSGD_MOVW_G1 `]() enumerator AARCH64\_TLSGD\_MOVW\_G1 = (0x203 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSGD_MOVW_G0_NC `]() enumerator AARCH64\_TLSGD\_MOVW\_G0\_NC = (0x204 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_ADR_PREL21 `]() enumerator AARCH64\_TLSLD\_ADR\_PREL21 = (0x205 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_ADR_PAGE21 `]() enumerator AARCH64\_TLSLD\_ADR\_PAGE21 = (0x206 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_ADD_LO12_NC `]() enumerator AARCH64\_TLSLD\_ADD\_LO12\_NC = (0x207 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_MOVW_G1 `]() enumerator AARCH64\_TLSLD\_MOVW\_G1 = (0x208 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_MOVW_G0_NC `]() enumerator AARCH64\_TLSLD\_MOVW\_G0\_NC = (0x209 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_LD_PREL19 `]() enumerator AARCH64\_TLSLD\_LD\_PREL19 = (0x20a | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_MOVW_DTPREL_G2 `]() enumerator AARCH64\_TLSLD\_MOVW\_DTPREL\_G2 = (0x20b | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_MOVW_DTPREL_G1 `]() enumerator AARCH64\_TLSLD\_MOVW\_DTPREL\_G1 = (0x20c | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_MOVW_DTPREL_G1_NC `]() enumerator AARCH64\_TLSLD\_MOVW\_DTPREL\_G1\_NC = (0x20d | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_MOVW_DTPREL_G0 `]() enumerator AARCH64\_TLSLD\_MOVW\_DTPREL\_G0 = (0x20e | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_MOVW_DTPREL_G0_NC `]() enumerator AARCH64\_TLSLD\_MOVW\_DTPREL\_G0\_NC = (0x20f | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_ADD_DTPREL_HI12 `]() enumerator AARCH64\_TLSLD\_ADD\_DTPREL\_HI12 = (0x210 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_ADD_DTPREL_LO12 `]() enumerator AARCH64\_TLSLD\_ADD\_DTPREL\_LO12 = (0x211 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_ADD_DTPREL_LO12_NC `]() enumerator AARCH64\_TLSLD\_ADD\_DTPREL\_LO12\_NC = (0x212 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_LDST8_DTPREL_LO12 `]() enumerator AARCH64\_TLSLD\_LDST8\_DTPREL\_LO12 = (0x213 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_LDST8_DTPREL_LO12_NC `]() enumerator AARCH64\_TLSLD\_LDST8\_DTPREL\_LO12\_NC = (0x214 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_LDST16_DTPREL_LO12 `]() enumerator AARCH64\_TLSLD\_LDST16\_DTPREL\_LO12 = (0x215 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_LDST16_DTPREL_LO12_NC `]() enumerator AARCH64\_TLSLD\_LDST16\_DTPREL\_LO12\_NC = (0x216 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_LDST32_DTPREL_LO12 `]() enumerator AARCH64\_TLSLD\_LDST32\_DTPREL\_LO12 = (0x217 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_LDST32_DTPREL_LO12_NC `]() enumerator AARCH64\_TLSLD\_LDST32\_DTPREL\_LO12\_NC = (0x218 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_LDST64_DTPREL_LO12 `]() enumerator AARCH64\_TLSLD\_LDST64\_DTPREL\_LO12 = (0x219 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_LDST64_DTPREL_LO12_NC `]() enumerator AARCH64\_TLSLD\_LDST64\_DTPREL\_LO12\_NC = (0x21a | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSIE_MOVW_GOTTPREL_G1 `]() enumerator AARCH64\_TLSIE\_MOVW\_GOTTPREL\_G1 = (0x21b | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSIE_MOVW_GOTTPREL_G0_NC `]() enumerator AARCH64\_TLSIE\_MOVW\_GOTTPREL\_G0\_NC = (0x21c | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSIE_ADR_GOTTPREL_PAGE21 `]() enumerator AARCH64\_TLSIE\_ADR\_GOTTPREL\_PAGE21 = (0x21d | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC `]() enumerator AARCH64\_TLSIE\_LD64\_GOTTPREL\_LO12\_NC = (0x21e | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSIE_LD_GOTTPREL_PREL19 `]() enumerator AARCH64\_TLSIE\_LD\_GOTTPREL\_PREL19 = (0x21f | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLE_MOVW_TPREL_G2 `]() enumerator AARCH64\_TLSLE\_MOVW\_TPREL\_G2 = (0x220 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLE_MOVW_TPREL_G1 `]() enumerator AARCH64\_TLSLE\_MOVW\_TPREL\_G1 = (0x221 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLE_MOVW_TPREL_G1_NC `]() enumerator AARCH64\_TLSLE\_MOVW\_TPREL\_G1\_NC = (0x222 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLE_MOVW_TPREL_G0 `]() enumerator AARCH64\_TLSLE\_MOVW\_TPREL\_G0 = (0x223 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLE_MOVW_TPREL_G0_NC `]() enumerator AARCH64\_TLSLE\_MOVW\_TPREL\_G0\_NC = (0x224 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLE_ADD_TPREL_HI12 `]() enumerator AARCH64\_TLSLE\_ADD\_TPREL\_HI12 = (0x225 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLE_ADD_TPREL_LO12 `]() enumerator AARCH64\_TLSLE\_ADD\_TPREL\_LO12 = (0x226 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLE_ADD_TPREL_LO12_NC `]() enumerator AARCH64\_TLSLE\_ADD\_TPREL\_LO12\_NC = (0x227 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLE_LDST8_TPREL_LO12 `]() enumerator AARCH64\_TLSLE\_LDST8\_TPREL\_LO12 = (0x228 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLE_LDST8_TPREL_LO12_NC `]() enumerator AARCH64\_TLSLE\_LDST8\_TPREL\_LO12\_NC = (0x229 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLE_LDST16_TPREL_LO12 `]() enumerator AARCH64\_TLSLE\_LDST16\_TPREL\_LO12 = (0x22a | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLE_LDST16_TPREL_LO12_NC `]() enumerator AARCH64\_TLSLE\_LDST16\_TPREL\_LO12\_NC = (0x22b | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLE_LDST32_TPREL_LO12 `]() enumerator AARCH64\_TLSLE\_LDST32\_TPREL\_LO12 = (0x22c | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLE_LDST32_TPREL_LO12_NC `]() enumerator AARCH64\_TLSLE\_LDST32\_TPREL\_LO12\_NC = (0x22d | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLE_LDST64_TPREL_LO12 `]() enumerator AARCH64\_TLSLE\_LDST64\_TPREL\_LO12 = (0x22e | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLE_LDST64_TPREL_LO12_NC `]() enumerator AARCH64\_TLSLE\_LDST64\_TPREL\_LO12\_NC = (0x22f | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSDESC_LD_PREL19 `]() enumerator AARCH64\_TLSDESC\_LD\_PREL19 = (0x230 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSDESC_ADR_PREL21 `]() enumerator AARCH64\_TLSDESC\_ADR\_PREL21 = (0x231 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSDESC_ADR_PAGE21 `]() enumerator AARCH64\_TLSDESC\_ADR\_PAGE21 = (0x232 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSDESC_LD64_LO12_NC `]() enumerator AARCH64\_TLSDESC\_LD64\_LO12\_NC = (0x233 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSDESC_ADD_LO12_NC `]() enumerator AARCH64\_TLSDESC\_ADD\_LO12\_NC = (0x234 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSDESC_OFF_G1 `]() enumerator AARCH64\_TLSDESC\_OFF\_G1 = (0x235 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSDESC_OFF_G0_NC `]() enumerator AARCH64\_TLSDESC\_OFF\_G0\_NC = (0x236 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSDESC_LDR `]() enumerator AARCH64\_TLSDESC\_LDR = (0x237 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSDESC_ADD `]() enumerator AARCH64\_TLSDESC\_ADD = (0x238 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSDESC_CALL `]() enumerator AARCH64\_TLSDESC\_CALL = (0x239 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLE_LDST128_TPREL_LO12 `]() enumerator AARCH64\_TLSLE\_LDST128\_TPREL\_LO12 = (0x23a | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLE_LDST128_TPREL_LO12_NC `]() enumerator AARCH64\_TLSLE\_LDST128\_TPREL\_LO12\_NC = (0x23b | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_LDST128_DTPREL_LO12 `]() enumerator AARCH64\_TLSLD\_LDST128\_DTPREL\_LO12 = (0x23c | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSLD_LDST128_DTPREL_LO12_NC `]() enumerator AARCH64\_TLSLD\_LDST128\_DTPREL\_LO12\_NC = (0x23d | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_COPY `]() enumerator AARCH64\_COPY = (0x400 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_GLOB_DAT `]() enumerator AARCH64\_GLOB\_DAT = (0x401 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_JUMP_SLOT `]() enumerator AARCH64\_JUMP\_SLOT = (0x402 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_RELATIVE `]() enumerator AARCH64\_RELATIVE = (0x403 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLS_DTPREL64 `]() enumerator AARCH64\_TLS\_DTPREL64 = (0x404 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLS_DTPMOD64 `]() enumerator AARCH64\_TLS\_DTPMOD64 = (0x405 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLS_TPREL64 `]() enumerator AARCH64\_TLS\_TPREL64 = (0x406 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_TLSDESC `]() enumerator AARCH64\_TLSDESC = (0x407 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` AARCH64_IRELATIVE `]() enumerator AARCH64\_IRELATIVE = (0x408 | [R\_AARCH64]( "LIEF::ELF::Relocation::R_AARCH64")) ##### [` ARM_NONE `]() enumerator ARM\_NONE = (0x00 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_PC24 `]() enumerator ARM\_PC24 = (0x01 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_ABS32 `]() enumerator ARM\_ABS32 = (0x02 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_REL32 `]() enumerator ARM\_REL32 = (0x03 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_LDR_PC_G0 `]() enumerator ARM\_LDR\_PC\_G0 = (0x04 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_ABS16 `]() enumerator ARM\_ABS16 = (0x05 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_ABS12 `]() enumerator ARM\_ABS12 = (0x06 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_ABS5 `]() enumerator ARM\_THM\_ABS5 = (0x07 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_ABS8 `]() enumerator ARM\_ABS8 = (0x08 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_SBREL32 `]() enumerator ARM\_SBREL32 = (0x09 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_CALL `]() enumerator ARM\_THM\_CALL = (0x0a | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_PC8 `]() enumerator ARM\_THM\_PC8 = (0x0b | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_BREL_ADJ `]() enumerator ARM\_BREL\_ADJ = (0x0c | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_TLS_DESC `]() enumerator ARM\_TLS\_DESC = (0x0d | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_SWI8 `]() enumerator ARM\_THM\_SWI8 = (0x0e | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_XPC25 `]() enumerator ARM\_XPC25 = (0x0f | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_XPC22 `]() enumerator ARM\_THM\_XPC22 = (0x10 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_TLS_DTPMOD32 `]() enumerator ARM\_TLS\_DTPMOD32 = (0x11 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_TLS_DTPOFF32 `]() enumerator ARM\_TLS\_DTPOFF32 = (0x12 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_TLS_TPOFF32 `]() enumerator ARM\_TLS\_TPOFF32 = (0x13 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_COPY `]() enumerator ARM\_COPY = (0x14 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_GLOB_DAT `]() enumerator ARM\_GLOB\_DAT = (0x15 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_JUMP_SLOT `]() enumerator ARM\_JUMP\_SLOT = (0x16 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_RELATIVE `]() enumerator ARM\_RELATIVE = (0x17 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_GOTOFF32 `]() enumerator ARM\_GOTOFF32 = (0x18 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_BASE_PREL `]() enumerator ARM\_BASE\_PREL = (0x19 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_GOT_BREL `]() enumerator ARM\_GOT\_BREL = (0x1a | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_PLT32 `]() enumerator ARM\_PLT32 = (0x1b | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_CALL `]() enumerator ARM\_CALL = (0x1c | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_JUMP24 `]() enumerator ARM\_JUMP24 = (0x1d | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_JUMP24 `]() enumerator ARM\_THM\_JUMP24 = (0x1e | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_BASE_ABS `]() enumerator ARM\_BASE\_ABS = (0x1f | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_ALU_PCREL_7_0 `]() enumerator ARM\_ALU\_PCREL\_7\_0 = (0x20 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_ALU_PCREL_15_8 `]() enumerator ARM\_ALU\_PCREL\_15\_8 = (0x21 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_ALU_PCREL_23_15 `]() enumerator ARM\_ALU\_PCREL\_23\_15 = (0x22 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_LDR_SBREL_11_0_NC `]() enumerator ARM\_LDR\_SBREL\_11\_0\_NC = (0x23 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_ALU_SBREL_19_12_NC `]() enumerator ARM\_ALU\_SBREL\_19\_12\_NC = (0x24 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_ALU_SBREL_27_20_CK `]() enumerator ARM\_ALU\_SBREL\_27\_20\_CK = (0x25 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_TARGET1 `]() enumerator ARM\_TARGET1 = (0x26 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_SBREL31 `]() enumerator ARM\_SBREL31 = (0x27 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_V4BX `]() enumerator ARM\_V4BX = (0x28 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_TARGET2 `]() enumerator ARM\_TARGET2 = (0x29 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_PREL31 `]() enumerator ARM\_PREL31 = (0x2a | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_MOVW_ABS_NC `]() enumerator ARM\_MOVW\_ABS\_NC = (0x2b | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_MOVT_ABS `]() enumerator ARM\_MOVT\_ABS = (0x2c | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_MOVW_PREL_NC `]() enumerator ARM\_MOVW\_PREL\_NC = (0x2d | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_MOVT_PREL `]() enumerator ARM\_MOVT\_PREL = (0x2e | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_MOVW_ABS_NC `]() enumerator ARM\_THM\_MOVW\_ABS\_NC = (0x2f | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_MOVT_ABS `]() enumerator ARM\_THM\_MOVT\_ABS = (0x30 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_MOVW_PREL_NC `]() enumerator ARM\_THM\_MOVW\_PREL\_NC = (0x31 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_MOVT_PREL `]() enumerator ARM\_THM\_MOVT\_PREL = (0x32 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_JUMP19 `]() enumerator ARM\_THM\_JUMP19 = (0x33 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_JUMP6 `]() enumerator ARM\_THM\_JUMP6 = (0x34 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_ALU_PREL_11_0 `]() enumerator ARM\_THM\_ALU\_PREL\_11\_0 = (0x35 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_PC12 `]() enumerator ARM\_THM\_PC12 = (0x36 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_ABS32_NOI `]() enumerator ARM\_ABS32\_NOI = (0x37 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_REL32_NOI `]() enumerator ARM\_REL32\_NOI = (0x38 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_ALU_PC_G0_NC `]() enumerator ARM\_ALU\_PC\_G0\_NC = (0x39 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_ALU_PC_G0 `]() enumerator ARM\_ALU\_PC\_G0 = (0x3a | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_ALU_PC_G1_NC `]() enumerator ARM\_ALU\_PC\_G1\_NC = (0x3b | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_ALU_PC_G1 `]() enumerator ARM\_ALU\_PC\_G1 = (0x3c | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_ALU_PC_G2 `]() enumerator ARM\_ALU\_PC\_G2 = (0x3d | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_LDR_PC_G1 `]() enumerator ARM\_LDR\_PC\_G1 = (0x3e | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_LDR_PC_G2 `]() enumerator ARM\_LDR\_PC\_G2 = (0x3f | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_LDRS_PC_G0 `]() enumerator ARM\_LDRS\_PC\_G0 = (0x40 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_LDRS_PC_G1 `]() enumerator ARM\_LDRS\_PC\_G1 = (0x41 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_LDRS_PC_G2 `]() enumerator ARM\_LDRS\_PC\_G2 = (0x42 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_LDC_PC_G0 `]() enumerator ARM\_LDC\_PC\_G0 = (0x43 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_LDC_PC_G1 `]() enumerator ARM\_LDC\_PC\_G1 = (0x44 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_LDC_PC_G2 `]() enumerator ARM\_LDC\_PC\_G2 = (0x45 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_ALU_SB_G0_NC `]() enumerator ARM\_ALU\_SB\_G0\_NC = (0x46 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_ALU_SB_G0 `]() enumerator ARM\_ALU\_SB\_G0 = (0x47 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_ALU_SB_G1_NC `]() enumerator ARM\_ALU\_SB\_G1\_NC = (0x48 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_ALU_SB_G1 `]() enumerator ARM\_ALU\_SB\_G1 = (0x49 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_ALU_SB_G2 `]() enumerator ARM\_ALU\_SB\_G2 = (0x4a | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_LDR_SB_G0 `]() enumerator ARM\_LDR\_SB\_G0 = (0x4b | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_LDR_SB_G1 `]() enumerator ARM\_LDR\_SB\_G1 = (0x4c | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_LDR_SB_G2 `]() enumerator ARM\_LDR\_SB\_G2 = (0x4d | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_LDRS_SB_G0 `]() enumerator ARM\_LDRS\_SB\_G0 = (0x4e | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_LDRS_SB_G1 `]() enumerator ARM\_LDRS\_SB\_G1 = (0x4f | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_LDRS_SB_G2 `]() enumerator ARM\_LDRS\_SB\_G2 = (0x50 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_LDC_SB_G0 `]() enumerator ARM\_LDC\_SB\_G0 = (0x51 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_LDC_SB_G1 `]() enumerator ARM\_LDC\_SB\_G1 = (0x52 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_LDC_SB_G2 `]() enumerator ARM\_LDC\_SB\_G2 = (0x53 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_MOVW_BREL_NC `]() enumerator ARM\_MOVW\_BREL\_NC = (0x54 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_MOVT_BREL `]() enumerator ARM\_MOVT\_BREL = (0x55 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_MOVW_BREL `]() enumerator ARM\_MOVW\_BREL = (0x56 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_MOVW_BREL_NC `]() enumerator ARM\_THM\_MOVW\_BREL\_NC = (0x57 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_MOVT_BREL `]() enumerator ARM\_THM\_MOVT\_BREL = (0x58 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_MOVW_BREL `]() enumerator ARM\_THM\_MOVW\_BREL = (0x59 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_TLS_GOTDESC `]() enumerator ARM\_TLS\_GOTDESC = (0x5a | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_TLS_CALL `]() enumerator ARM\_TLS\_CALL = (0x5b | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_TLS_DESCSEQ `]() enumerator ARM\_TLS\_DESCSEQ = (0x5c | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_TLS_CALL `]() enumerator ARM\_THM\_TLS\_CALL = (0x5d | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_PLT32_ABS `]() enumerator ARM\_PLT32\_ABS = (0x5e | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_GOT_ABS `]() enumerator ARM\_GOT\_ABS = (0x5f | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_GOT_PREL `]() enumerator ARM\_GOT\_PREL = (0x60 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_GOT_BREL12 `]() enumerator ARM\_GOT\_BREL12 = (0x61 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_GOTOFF12 `]() enumerator ARM\_GOTOFF12 = (0x62 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_GOTRELAX `]() enumerator ARM\_GOTRELAX = (0x63 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_GNU_VTENTRY `]() enumerator ARM\_GNU\_VTENTRY = (0x64 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_GNU_VTINHERIT `]() enumerator ARM\_GNU\_VTINHERIT = (0x65 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_JUMP11 `]() enumerator ARM\_THM\_JUMP11 = (0x66 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_JUMP8 `]() enumerator ARM\_THM\_JUMP8 = (0x67 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_TLS_GD32 `]() enumerator ARM\_TLS\_GD32 = (0x68 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_TLS_LDM32 `]() enumerator ARM\_TLS\_LDM32 = (0x69 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_TLS_LDO32 `]() enumerator ARM\_TLS\_LDO32 = (0x6a | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_TLS_IE32 `]() enumerator ARM\_TLS\_IE32 = (0x6b | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_TLS_LE32 `]() enumerator ARM\_TLS\_LE32 = (0x6c | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_TLS_LDO12 `]() enumerator ARM\_TLS\_LDO12 = (0x6d | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_TLS_LE12 `]() enumerator ARM\_TLS\_LE12 = (0x6e | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_TLS_IE12GP `]() enumerator ARM\_TLS\_IE12GP = (0x6f | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_PRIVATE_0 `]() enumerator ARM\_PRIVATE\_0 = (0x70 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_PRIVATE_1 `]() enumerator ARM\_PRIVATE\_1 = (0x71 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_PRIVATE_2 `]() enumerator ARM\_PRIVATE\_2 = (0x72 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_PRIVATE_3 `]() enumerator ARM\_PRIVATE\_3 = (0x73 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_PRIVATE_4 `]() enumerator ARM\_PRIVATE\_4 = (0x74 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_PRIVATE_5 `]() enumerator ARM\_PRIVATE\_5 = (0x75 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_PRIVATE_6 `]() enumerator ARM\_PRIVATE\_6 = (0x76 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_PRIVATE_7 `]() enumerator ARM\_PRIVATE\_7 = (0x77 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_PRIVATE_8 `]() enumerator ARM\_PRIVATE\_8 = (0x78 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_PRIVATE_9 `]() enumerator ARM\_PRIVATE\_9 = (0x79 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_PRIVATE_10 `]() enumerator ARM\_PRIVATE\_10 = (0x7a | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_PRIVATE_11 `]() enumerator ARM\_PRIVATE\_11 = (0x7b | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_PRIVATE_12 `]() enumerator ARM\_PRIVATE\_12 = (0x7c | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_PRIVATE_13 `]() enumerator ARM\_PRIVATE\_13 = (0x7d | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_PRIVATE_14 `]() enumerator ARM\_PRIVATE\_14 = (0x7e | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_PRIVATE_15 `]() enumerator ARM\_PRIVATE\_15 = (0x7f | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_ME_TOO `]() enumerator ARM\_ME\_TOO = (0x80 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_TLS_DESCSEQ16 `]() enumerator ARM\_THM\_TLS\_DESCSEQ16 = (0x81 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_TLS_DESCSEQ32 `]() enumerator ARM\_THM\_TLS\_DESCSEQ32 = (0x82 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_IRELATIVE `]() enumerator ARM\_IRELATIVE = (0xa0 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_RXPC25 `]() enumerator ARM\_RXPC25 = (0xF9 | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_RSBREL32 `]() enumerator ARM\_RSBREL32 = (0xFA | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_THM_RPC22 `]() enumerator ARM\_THM\_RPC22 = (0xFB | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_RREL32 `]() enumerator ARM\_RREL32 = (0xFC | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_RPC24 `]() enumerator ARM\_RPC24 = (0xFD | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` ARM_RBASE `]() enumerator ARM\_RBASE = (0xFE | [R\_ARM]( "LIEF::ELF::Relocation::R_ARM")) ##### [` HEX_NONE `]() enumerator HEX\_NONE = (0 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_B22_PCREL `]() enumerator HEX\_B22\_PCREL = (1 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_B15_PCREL `]() enumerator HEX\_B15\_PCREL = (2 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_B7_PCREL `]() enumerator HEX\_B7\_PCREL = (3 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_LO16 `]() enumerator HEX\_LO16 = (4 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_HI16 `]() enumerator HEX\_HI16 = (5 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_32 `]() enumerator HEX\_32 = (6 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_16 `]() enumerator HEX\_16 = (7 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_8 `]() enumerator HEX\_8 = (8 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GPREL16_0 `]() enumerator HEX\_GPREL16\_0 = (9 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GPREL16_1 `]() enumerator HEX\_GPREL16\_1 = (10 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GPREL16_2 `]() enumerator HEX\_GPREL16\_2 = (11 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GPREL16_3 `]() enumerator HEX\_GPREL16\_3 = (12 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_HL16 `]() enumerator HEX\_HL16 = (13 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_B13_PCREL `]() enumerator HEX\_B13\_PCREL = (14 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_B9_PCREL `]() enumerator HEX\_B9\_PCREL = (15 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_B32_PCREL_X `]() enumerator HEX\_B32\_PCREL\_X = (16 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_32_6_X `]() enumerator HEX\_32\_6\_X = (17 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_B22_PCREL_X `]() enumerator HEX\_B22\_PCREL\_X = (18 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_B15_PCREL_X `]() enumerator HEX\_B15\_PCREL\_X = (19 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_B13_PCREL_X `]() enumerator HEX\_B13\_PCREL\_X = (20 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_B9_PCREL_X `]() enumerator HEX\_B9\_PCREL\_X = (21 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_B7_PCREL_X `]() enumerator HEX\_B7\_PCREL\_X = (22 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_16_X `]() enumerator HEX\_16\_X = (23 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_12_X `]() enumerator HEX\_12\_X = (24 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_11_X `]() enumerator HEX\_11\_X = (25 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_10_X `]() enumerator HEX\_10\_X = (26 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_9_X `]() enumerator HEX\_9\_X = (27 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_8_X `]() enumerator HEX\_8\_X = (28 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_7_X `]() enumerator HEX\_7\_X = (29 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_6_X `]() enumerator HEX\_6\_X = (30 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_32_PCREL `]() enumerator HEX\_32\_PCREL = (31 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_COPY `]() enumerator HEX\_COPY = (32 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GLOB_DAT `]() enumerator HEX\_GLOB\_DAT = (33 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_JMP_SLOT `]() enumerator HEX\_JMP\_SLOT = (34 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_RELATIVE `]() enumerator HEX\_RELATIVE = (35 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_PLT_B22_PCREL `]() enumerator HEX\_PLT\_B22\_PCREL = (36 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GOTREL_LO16 `]() enumerator HEX\_GOTREL\_LO16 = (37 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GOTREL_HI16 `]() enumerator HEX\_GOTREL\_HI16 = (38 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GOTREL_32 `]() enumerator HEX\_GOTREL\_32 = (39 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GOT_LO16 `]() enumerator HEX\_GOT\_LO16 = (40 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GOT_HI16 `]() enumerator HEX\_GOT\_HI16 = (41 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GOT_32 `]() enumerator HEX\_GOT\_32 = (42 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GOT_16 `]() enumerator HEX\_GOT\_16 = (43 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_DTPMOD_32 `]() enumerator HEX\_DTPMOD\_32 = (44 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_DTPREL_LO16 `]() enumerator HEX\_DTPREL\_LO16 = (45 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_DTPREL_HI16 `]() enumerator HEX\_DTPREL\_HI16 = (46 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_DTPREL_32 `]() enumerator HEX\_DTPREL\_32 = (47 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_DTPREL_16 `]() enumerator HEX\_DTPREL\_16 = (48 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GD_PLT_B22_PCREL `]() enumerator HEX\_GD\_PLT\_B22\_PCREL = (49 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GD_GOT_LO16 `]() enumerator HEX\_GD\_GOT\_LO16 = (50 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GD_GOT_HI16 `]() enumerator HEX\_GD\_GOT\_HI16 = (51 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GD_GOT_32 `]() enumerator HEX\_GD\_GOT\_32 = (52 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GD_GOT_16 `]() enumerator HEX\_GD\_GOT\_16 = (53 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_IE_LO16 `]() enumerator HEX\_IE\_LO16 = (54 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_IE_HI16 `]() enumerator HEX\_IE\_HI16 = (55 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_IE_32 `]() enumerator HEX\_IE\_32 = (56 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_IE_GOT_LO16 `]() enumerator HEX\_IE\_GOT\_LO16 = (57 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_IE_GOT_HI16 `]() enumerator HEX\_IE\_GOT\_HI16 = (58 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_IE_GOT_32 `]() enumerator HEX\_IE\_GOT\_32 = (59 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_IE_GOT_16 `]() enumerator HEX\_IE\_GOT\_16 = (60 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_TPREL_LO16 `]() enumerator HEX\_TPREL\_LO16 = (61 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_TPREL_HI16 `]() enumerator HEX\_TPREL\_HI16 = (62 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_TPREL_32 `]() enumerator HEX\_TPREL\_32 = (63 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_TPREL_16 `]() enumerator HEX\_TPREL\_16 = (64 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_6_PCREL_X `]() enumerator HEX\_6\_PCREL\_X = (65 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GOTREL_32_6_X `]() enumerator HEX\_GOTREL\_32\_6\_X = (66 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GOTREL_16_X `]() enumerator HEX\_GOTREL\_16\_X = (67 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GOTREL_11_X `]() enumerator HEX\_GOTREL\_11\_X = (68 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GOT_32_6_X `]() enumerator HEX\_GOT\_32\_6\_X = (69 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GOT_16_X `]() enumerator HEX\_GOT\_16\_X = (70 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GOT_11_X `]() enumerator HEX\_GOT\_11\_X = (71 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_DTPREL_32_6_X `]() enumerator HEX\_DTPREL\_32\_6\_X = (72 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_DTPREL_16_X `]() enumerator HEX\_DTPREL\_16\_X = (73 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_DTPREL_11_X `]() enumerator HEX\_DTPREL\_11\_X = (74 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GD_GOT_32_6_X `]() enumerator HEX\_GD\_GOT\_32\_6\_X = (75 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GD_GOT_16_X `]() enumerator HEX\_GD\_GOT\_16\_X = (76 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_GD_GOT_11_X `]() enumerator HEX\_GD\_GOT\_11\_X = (77 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_IE_32_6_X `]() enumerator HEX\_IE\_32\_6\_X = (78 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_IE_16_X `]() enumerator HEX\_IE\_16\_X = (79 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_IE_GOT_32_6_X `]() enumerator HEX\_IE\_GOT\_32\_6\_X = (80 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_IE_GOT_16_X `]() enumerator HEX\_IE\_GOT\_16\_X = (81 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_IE_GOT_11_X `]() enumerator HEX\_IE\_GOT\_11\_X = (82 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_TPREL_32_6_X `]() enumerator HEX\_TPREL\_32\_6\_X = (83 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_TPREL_16_X `]() enumerator HEX\_TPREL\_16\_X = (84 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_TPREL_11_X `]() enumerator HEX\_TPREL\_11\_X = (85 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_LD_PLT_B22_PCREL `]() enumerator HEX\_LD\_PLT\_B22\_PCREL = (86 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_LD_GOT_LO16 `]() enumerator HEX\_LD\_GOT\_LO16 = (87 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_LD_GOT_HI16 `]() enumerator HEX\_LD\_GOT\_HI16 = (88 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_LD_GOT_32 `]() enumerator HEX\_LD\_GOT\_32 = (89 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_LD_GOT_16 `]() enumerator HEX\_LD\_GOT\_16 = (90 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_LD_GOT_32_6_X `]() enumerator HEX\_LD\_GOT\_32\_6\_X = (91 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_LD_GOT_16_X `]() enumerator HEX\_LD\_GOT\_16\_X = (92 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` HEX_LD_GOT_11_X `]() enumerator HEX\_LD\_GOT\_11\_X = (93 | [R\_HEXAGON]( "LIEF::ELF::Relocation::R_HEXAGON")) ##### [` X86_NONE `]() enumerator X86\_NONE = (0 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_32 `]() enumerator X86\_32 = (1 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_PC32 `]() enumerator X86\_PC32 = (2 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_GOT32 `]() enumerator X86\_GOT32 = (3 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_PLT32 `]() enumerator X86\_PLT32 = (4 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_COPY `]() enumerator X86\_COPY = (5 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_GLOB_DAT `]() enumerator X86\_GLOB\_DAT = (6 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_JUMP_SLOT `]() enumerator X86\_JUMP\_SLOT = (7 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_RELATIVE `]() enumerator X86\_RELATIVE = (8 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_GOTOFF `]() enumerator X86\_GOTOFF = (9 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_GOTPC `]() enumerator X86\_GOTPC = (10 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_32PLT `]() enumerator X86\_32PLT = (11 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_TPOFF `]() enumerator X86\_TLS\_TPOFF = (14 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_IE `]() enumerator X86\_TLS\_IE = (15 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_GOTIE `]() enumerator X86\_TLS\_GOTIE = (16 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_LE `]() enumerator X86\_TLS\_LE = (17 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_GD `]() enumerator X86\_TLS\_GD = (18 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_LDM `]() enumerator X86\_TLS\_LDM = (19 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_16 `]() enumerator X86\_16 = (20 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_PC16 `]() enumerator X86\_PC16 = (21 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_8 `]() enumerator X86\_8 = (22 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_PC8 `]() enumerator X86\_PC8 = (23 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_GD_32 `]() enumerator X86\_TLS\_GD\_32 = (24 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_GD_PUSH `]() enumerator X86\_TLS\_GD\_PUSH = (25 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_GD_CALL `]() enumerator X86\_TLS\_GD\_CALL = (26 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_GD_POP `]() enumerator X86\_TLS\_GD\_POP = (27 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_LDM_32 `]() enumerator X86\_TLS\_LDM\_32 = (28 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_LDM_PUSH `]() enumerator X86\_TLS\_LDM\_PUSH = (29 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_LDM_CALL `]() enumerator X86\_TLS\_LDM\_CALL = (30 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_LDM_POP `]() enumerator X86\_TLS\_LDM\_POP = (31 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_LDO_32 `]() enumerator X86\_TLS\_LDO\_32 = (32 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_IE_32 `]() enumerator X86\_TLS\_IE\_32 = (33 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_LE_32 `]() enumerator X86\_TLS\_LE\_32 = (34 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_DTPMOD32 `]() enumerator X86\_TLS\_DTPMOD32 = (35 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_DTPOFF32 `]() enumerator X86\_TLS\_DTPOFF32 = (36 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_TPOFF32 `]() enumerator X86\_TLS\_TPOFF32 = (37 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_GOTDESC `]() enumerator X86\_TLS\_GOTDESC = (39 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_DESC_CALL `]() enumerator X86\_TLS\_DESC\_CALL = (40 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_TLS_DESC `]() enumerator X86\_TLS\_DESC = (41 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` X86_IRELATIVE `]() enumerator X86\_IRELATIVE = (42 | [R\_X86]( "LIEF::ELF::Relocation::R_X86")) ##### [` LARCH_NONE `]() enumerator LARCH\_NONE = (0 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_32 `]() enumerator LARCH\_32 = (1 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_64 `]() enumerator LARCH\_64 = (2 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_RELATIVE `]() enumerator LARCH\_RELATIVE = (3 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_COPY `]() enumerator LARCH\_COPY = (4 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_JUMP_SLOT `]() enumerator LARCH\_JUMP\_SLOT = (5 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_DTPMOD32 `]() enumerator LARCH\_TLS\_DTPMOD32 = (6 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_DTPMOD64 `]() enumerator LARCH\_TLS\_DTPMOD64 = (7 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_DTPREL32 `]() enumerator LARCH\_TLS\_DTPREL32 = (8 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_DTPREL64 `]() enumerator LARCH\_TLS\_DTPREL64 = (9 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_TPREL32 `]() enumerator LARCH\_TLS\_TPREL32 = (10 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_TPREL64 `]() enumerator LARCH\_TLS\_TPREL64 = (11 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_IRELATIVE `]() enumerator LARCH\_IRELATIVE = (12 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_MARK_LA `]() enumerator LARCH\_MARK\_LA = (20 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_MARK_PCREL `]() enumerator LARCH\_MARK\_PCREL = (21 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_PUSH_PCREL `]() enumerator LARCH\_SOP\_PUSH\_PCREL = (22 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_PUSH_ABSOLUTE `]() enumerator LARCH\_SOP\_PUSH\_ABSOLUTE = (23 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_PUSH_DUP `]() enumerator LARCH\_SOP\_PUSH\_DUP = (24 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_PUSH_GPREL `]() enumerator LARCH\_SOP\_PUSH\_GPREL = (25 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_PUSH_TLS_TPREL `]() enumerator LARCH\_SOP\_PUSH\_TLS\_TPREL = (26 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_PUSH_TLS_GOT `]() enumerator LARCH\_SOP\_PUSH\_TLS\_GOT = (27 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_PUSH_TLS_GD `]() enumerator LARCH\_SOP\_PUSH\_TLS\_GD = (28 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_PUSH_PLT_PCREL `]() enumerator LARCH\_SOP\_PUSH\_PLT\_PCREL = (29 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_ASSERT `]() enumerator LARCH\_SOP\_ASSERT = (30 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_NOT `]() enumerator LARCH\_SOP\_NOT = (31 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_SUB `]() enumerator LARCH\_SOP\_SUB = (32 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_SL `]() enumerator LARCH\_SOP\_SL = (33 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_SR `]() enumerator LARCH\_SOP\_SR = (34 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_ADD `]() enumerator LARCH\_SOP\_ADD = (35 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_AND `]() enumerator LARCH\_SOP\_AND = (36 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_IF_ELSE `]() enumerator LARCH\_SOP\_IF\_ELSE = (37 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_POP_32_S_10_5 `]() enumerator LARCH\_SOP\_POP\_32\_S\_10\_5 = (38 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_POP_32_U_10_12 `]() enumerator LARCH\_SOP\_POP\_32\_U\_10\_12 = (39 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_POP_32_S_10_12 `]() enumerator LARCH\_SOP\_POP\_32\_S\_10\_12 = (40 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_POP_32_S_10_16 `]() enumerator LARCH\_SOP\_POP\_32\_S\_10\_16 = (41 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_POP_32_S_10_16_S2 `]() enumerator LARCH\_SOP\_POP\_32\_S\_10\_16\_S2 = (42 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_POP_32_S_5_20 `]() enumerator LARCH\_SOP\_POP\_32\_S\_5\_20 = (43 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_POP_32_S_0_5_10_16_S2 `]() enumerator LARCH\_SOP\_POP\_32\_S\_0\_5\_10\_16\_S2 = (44 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_POP_32_S_0_10_10_16_S2 `]() enumerator LARCH\_SOP\_POP\_32\_S\_0\_10\_10\_16\_S2 = (45 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SOP_POP_32_U `]() enumerator LARCH\_SOP\_POP\_32\_U = (46 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_ADD8 `]() enumerator LARCH\_ADD8 = (47 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_ADD16 `]() enumerator LARCH\_ADD16 = (48 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_ADD24 `]() enumerator LARCH\_ADD24 = (49 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_ADD32 `]() enumerator LARCH\_ADD32 = (50 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_ADD64 `]() enumerator LARCH\_ADD64 = (51 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SUB8 `]() enumerator LARCH\_SUB8 = (52 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SUB16 `]() enumerator LARCH\_SUB16 = (53 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SUB24 `]() enumerator LARCH\_SUB24 = (54 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SUB32 `]() enumerator LARCH\_SUB32 = (55 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SUB64 `]() enumerator LARCH\_SUB64 = (56 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_GNU_VTINHERIT `]() enumerator LARCH\_GNU\_VTINHERIT = (57 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_GNU_VTENTRY `]() enumerator LARCH\_GNU\_VTENTRY = (58 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_B16 `]() enumerator LARCH\_B16 = (64 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_B21 `]() enumerator LARCH\_B21 = (65 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_B26 `]() enumerator LARCH\_B26 = (66 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_ABS_HI20 `]() enumerator LARCH\_ABS\_HI20 = (67 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_ABS_LO12 `]() enumerator LARCH\_ABS\_LO12 = (68 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_ABS64_LO20 `]() enumerator LARCH\_ABS64\_LO20 = (69 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_ABS64_HI12 `]() enumerator LARCH\_ABS64\_HI12 = (70 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_PCALA_HI20 `]() enumerator LARCH\_PCALA\_HI20 = (71 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_PCALA_LO12 `]() enumerator LARCH\_PCALA\_LO12 = (72 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_PCALA64_LO20 `]() enumerator LARCH\_PCALA64\_LO20 = (73 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_PCALA64_HI12 `]() enumerator LARCH\_PCALA64\_HI12 = (74 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_GOT_PC_HI20 `]() enumerator LARCH\_GOT\_PC\_HI20 = (75 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_GOT_PC_LO12 `]() enumerator LARCH\_GOT\_PC\_LO12 = (76 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_GOT64_PC_LO20 `]() enumerator LARCH\_GOT64\_PC\_LO20 = (77 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_GOT64_PC_HI12 `]() enumerator LARCH\_GOT64\_PC\_HI12 = (78 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_GOT_HI20 `]() enumerator LARCH\_GOT\_HI20 = (79 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_GOT_LO12 `]() enumerator LARCH\_GOT\_LO12 = (80 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_GOT64_LO20 `]() enumerator LARCH\_GOT64\_LO20 = (81 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_GOT64_HI12 `]() enumerator LARCH\_GOT64\_HI12 = (82 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_LE_HI20 `]() enumerator LARCH\_TLS\_LE\_HI20 = (83 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_LE_LO12 `]() enumerator LARCH\_TLS\_LE\_LO12 = (84 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_LE64_LO20 `]() enumerator LARCH\_TLS\_LE64\_LO20 = (85 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_LE64_HI12 `]() enumerator LARCH\_TLS\_LE64\_HI12 = (86 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_IE_PC_HI20 `]() enumerator LARCH\_TLS\_IE\_PC\_HI20 = (87 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_IE_PC_LO12 `]() enumerator LARCH\_TLS\_IE\_PC\_LO12 = (88 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_IE64_PC_LO20 `]() enumerator LARCH\_TLS\_IE64\_PC\_LO20 = (89 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_IE64_PC_HI12 `]() enumerator LARCH\_TLS\_IE64\_PC\_HI12 = (90 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_IE_HI20 `]() enumerator LARCH\_TLS\_IE\_HI20 = (91 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_IE_LO12 `]() enumerator LARCH\_TLS\_IE\_LO12 = (92 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_IE64_LO20 `]() enumerator LARCH\_TLS\_IE64\_LO20 = (93 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_IE64_HI12 `]() enumerator LARCH\_TLS\_IE64\_HI12 = (94 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_LD_PC_HI20 `]() enumerator LARCH\_TLS\_LD\_PC\_HI20 = (95 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_LD_HI20 `]() enumerator LARCH\_TLS\_LD\_HI20 = (96 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_GD_PC_HI20 `]() enumerator LARCH\_TLS\_GD\_PC\_HI20 = (97 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_GD_HI20 `]() enumerator LARCH\_TLS\_GD\_HI20 = (98 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_32_PCREL `]() enumerator LARCH\_32\_PCREL = (99 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_RELAX `]() enumerator LARCH\_RELAX = (100 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_ALIGN `]() enumerator LARCH\_ALIGN = (102 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_PCREL20_S2 `]() enumerator LARCH\_PCREL20\_S2 = (103 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_ADD6 `]() enumerator LARCH\_ADD6 = (105 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SUB6 `]() enumerator LARCH\_SUB6 = (106 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_ADD_ULEB128 `]() enumerator LARCH\_ADD\_ULEB128 = (107 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_SUB_ULEB128 `]() enumerator LARCH\_SUB\_ULEB128 = (108 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_64_PCREL `]() enumerator LARCH\_64\_PCREL = (109 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_CALL36 `]() enumerator LARCH\_CALL36 = (110 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_DESC32 `]() enumerator LARCH\_TLS\_DESC32 = (13 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_DESC64 `]() enumerator LARCH\_TLS\_DESC64 = (14 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_DESC_PC_HI20 `]() enumerator LARCH\_TLS\_DESC\_PC\_HI20 = (111 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_DESC_PC_LO12 `]() enumerator LARCH\_TLS\_DESC\_PC\_LO12 = (112 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_DESC64_PC_LO20 `]() enumerator LARCH\_TLS\_DESC64\_PC\_LO20 = (113 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_DESC64_PC_HI12 `]() enumerator LARCH\_TLS\_DESC64\_PC\_HI12 = (114 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_DESC_HI20 `]() enumerator LARCH\_TLS\_DESC\_HI20 = (115 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_DESC_LO12 `]() enumerator LARCH\_TLS\_DESC\_LO12 = (116 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_DESC64_LO20 `]() enumerator LARCH\_TLS\_DESC64\_LO20 = (117 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_DESC64_HI12 `]() enumerator LARCH\_TLS\_DESC64\_HI12 = (118 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_DESC_LD `]() enumerator LARCH\_TLS\_DESC\_LD = (119 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_DESC_CALL `]() enumerator LARCH\_TLS\_DESC\_CALL = (120 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_LE_HI20_R `]() enumerator LARCH\_TLS\_LE\_HI20\_R = (121 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_LE_ADD_R `]() enumerator LARCH\_TLS\_LE\_ADD\_R = (122 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_LE_LO12_R `]() enumerator LARCH\_TLS\_LE\_LO12\_R = (123 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_LD_PCREL20_S2 `]() enumerator LARCH\_TLS\_LD\_PCREL20\_S2 = (124 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_GD_PCREL20_S2 `]() enumerator LARCH\_TLS\_GD\_PCREL20\_S2 = (125 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` LARCH_TLS_DESC_PCREL20_S2 `]() enumerator LARCH\_TLS\_DESC\_PCREL20\_S2 = (126 | [R\_LARCH]( "LIEF::ELF::Relocation::R_LARCH")) ##### [` MIPS_NONE `]() enumerator MIPS\_NONE = (0 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_16 `]() enumerator MIPS\_16 = (1 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_32 `]() enumerator MIPS\_32 = (2 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_REL32 `]() enumerator MIPS\_REL32 = (3 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_26 `]() enumerator MIPS\_26 = (4 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_HI16 `]() enumerator MIPS\_HI16 = (5 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_LO16 `]() enumerator MIPS\_LO16 = (6 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_GPREL16 `]() enumerator MIPS\_GPREL16 = (7 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_LITERAL `]() enumerator MIPS\_LITERAL = (8 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_GOT16 `]() enumerator MIPS\_GOT16 = (9 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_PC16 `]() enumerator MIPS\_PC16 = (10 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_CALL16 `]() enumerator MIPS\_CALL16 = (11 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_GPREL32 `]() enumerator MIPS\_GPREL32 = (12 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_UNUSED1 `]() enumerator MIPS\_UNUSED1 = (13 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_UNUSED2 `]() enumerator MIPS\_UNUSED2 = (14 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_UNUSED3 `]() enumerator MIPS\_UNUSED3 = (15 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_SHIFT5 `]() enumerator MIPS\_SHIFT5 = (16 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_SHIFT6 `]() enumerator MIPS\_SHIFT6 = (17 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_64 `]() enumerator MIPS\_64 = (18 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_GOT_DISP `]() enumerator MIPS\_GOT\_DISP = (19 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_GOT_PAGE `]() enumerator MIPS\_GOT\_PAGE = (20 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_GOT_OFST `]() enumerator MIPS\_GOT\_OFST = (21 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_GOT_HI16 `]() enumerator MIPS\_GOT\_HI16 = (22 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_GOT_LO16 `]() enumerator MIPS\_GOT\_LO16 = (23 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_SUB `]() enumerator MIPS\_SUB = (24 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_INSERT_A `]() enumerator MIPS\_INSERT\_A = (25 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_INSERT_B `]() enumerator MIPS\_INSERT\_B = (26 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_DELETE `]() enumerator MIPS\_DELETE = (27 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_HIGHER `]() enumerator MIPS\_HIGHER = (28 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_HIGHEST `]() enumerator MIPS\_HIGHEST = (29 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_CALL_HI16 `]() enumerator MIPS\_CALL\_HI16 = (30 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_CALL_LO16 `]() enumerator MIPS\_CALL\_LO16 = (31 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_SCN_DISP `]() enumerator MIPS\_SCN\_DISP = (32 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_REL16 `]() enumerator MIPS\_REL16 = (33 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_ADD_IMMEDIATE `]() enumerator MIPS\_ADD\_IMMEDIATE = (34 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_PJUMP `]() enumerator MIPS\_PJUMP = (35 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_RELGOT `]() enumerator MIPS\_RELGOT = (36 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_JALR `]() enumerator MIPS\_JALR = (37 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_TLS_DTPMOD32 `]() enumerator MIPS\_TLS\_DTPMOD32 = (38 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_TLS_DTPREL32 `]() enumerator MIPS\_TLS\_DTPREL32 = (39 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_TLS_DTPMOD64 `]() enumerator MIPS\_TLS\_DTPMOD64 = (40 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_TLS_DTPREL64 `]() enumerator MIPS\_TLS\_DTPREL64 = (41 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_TLS_GD `]() enumerator MIPS\_TLS\_GD = (42 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_TLS_LDM `]() enumerator MIPS\_TLS\_LDM = (43 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_TLS_DTPREL_HI16 `]() enumerator MIPS\_TLS\_DTPREL\_HI16 = (44 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_TLS_DTPREL_LO16 `]() enumerator MIPS\_TLS\_DTPREL\_LO16 = (45 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_TLS_GOTTPREL `]() enumerator MIPS\_TLS\_GOTTPREL = (46 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_TLS_TPREL32 `]() enumerator MIPS\_TLS\_TPREL32 = (47 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_TLS_TPREL64 `]() enumerator MIPS\_TLS\_TPREL64 = (48 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_TLS_TPREL_HI16 `]() enumerator MIPS\_TLS\_TPREL\_HI16 = (49 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_TLS_TPREL_LO16 `]() enumerator MIPS\_TLS\_TPREL\_LO16 = (50 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_GLOB_DAT `]() enumerator MIPS\_GLOB\_DAT = (51 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_PC21_S2 `]() enumerator MIPS\_PC21\_S2 = (60 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_PC26_S2 `]() enumerator MIPS\_PC26\_S2 = (61 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_PC18_S3 `]() enumerator MIPS\_PC18\_S3 = (62 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_PC19_S2 `]() enumerator MIPS\_PC19\_S2 = (63 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_PCHI16 `]() enumerator MIPS\_PCHI16 = (64 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_PCLO16 `]() enumerator MIPS\_PCLO16 = (65 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS16_26 `]() enumerator MIPS16\_26 = (100 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS16_GPREL `]() enumerator MIPS16\_GPREL = (101 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS16_GOT16 `]() enumerator MIPS16\_GOT16 = (102 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS16_CALL16 `]() enumerator MIPS16\_CALL16 = (103 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS16_HI16 `]() enumerator MIPS16\_HI16 = (104 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS16_LO16 `]() enumerator MIPS16\_LO16 = (105 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS16_TLS_GD `]() enumerator MIPS16\_TLS\_GD = (106 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS16_TLS_LDM `]() enumerator MIPS16\_TLS\_LDM = (107 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS16_TLS_DTPREL_HI16 `]() enumerator MIPS16\_TLS\_DTPREL\_HI16 = (108 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS16_TLS_DTPREL_LO16 `]() enumerator MIPS16\_TLS\_DTPREL\_LO16 = (109 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS16_TLS_GOTTPREL `]() enumerator MIPS16\_TLS\_GOTTPREL = (110 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS16_TLS_TPREL_HI16 `]() enumerator MIPS16\_TLS\_TPREL\_HI16 = (111 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS16_TLS_TPREL_LO16 `]() enumerator MIPS16\_TLS\_TPREL\_LO16 = (112 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_COPY `]() enumerator MIPS\_COPY = (126 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_JUMP_SLOT `]() enumerator MIPS\_JUMP\_SLOT = (127 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_26_S1 `]() enumerator MICROMIPS\_26\_S1 = (133 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_HI16 `]() enumerator MICROMIPS\_HI16 = (134 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_LO16 `]() enumerator MICROMIPS\_LO16 = (135 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_GPREL16 `]() enumerator MICROMIPS\_GPREL16 = (136 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_LITERAL `]() enumerator MICROMIPS\_LITERAL = (137 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_GOT16 `]() enumerator MICROMIPS\_GOT16 = (138 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_PC7_S1 `]() enumerator MICROMIPS\_PC7\_S1 = (139 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_PC10_S1 `]() enumerator MICROMIPS\_PC10\_S1 = (140 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_PC16_S1 `]() enumerator MICROMIPS\_PC16\_S1 = (141 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_CALL16 `]() enumerator MICROMIPS\_CALL16 = (142 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_GOT_DISP `]() enumerator MICROMIPS\_GOT\_DISP = (145 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_GOT_PAGE `]() enumerator MICROMIPS\_GOT\_PAGE = (146 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_GOT_OFST `]() enumerator MICROMIPS\_GOT\_OFST = (147 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_GOT_HI16 `]() enumerator MICROMIPS\_GOT\_HI16 = (148 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_GOT_LO16 `]() enumerator MICROMIPS\_GOT\_LO16 = (149 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_SUB `]() enumerator MICROMIPS\_SUB = (150 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_HIGHER `]() enumerator MICROMIPS\_HIGHER = (151 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_HIGHEST `]() enumerator MICROMIPS\_HIGHEST = (152 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_CALL_HI16 `]() enumerator MICROMIPS\_CALL\_HI16 = (153 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_CALL_LO16 `]() enumerator MICROMIPS\_CALL\_LO16 = (154 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_SCN_DISP `]() enumerator MICROMIPS\_SCN\_DISP = (155 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_JALR `]() enumerator MICROMIPS\_JALR = (156 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_HI0_LO16 `]() enumerator MICROMIPS\_HI0\_LO16 = (157 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_TLS_GD `]() enumerator MICROMIPS\_TLS\_GD = (162 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_TLS_LDM `]() enumerator MICROMIPS\_TLS\_LDM = (163 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_TLS_DTPREL_HI16 `]() enumerator MICROMIPS\_TLS\_DTPREL\_HI16 = (164 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_TLS_DTPREL_LO16 `]() enumerator MICROMIPS\_TLS\_DTPREL\_LO16 = (165 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_TLS_GOTTPREL `]() enumerator MICROMIPS\_TLS\_GOTTPREL = (166 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_TLS_TPREL_HI16 `]() enumerator MICROMIPS\_TLS\_TPREL\_HI16 = (169 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_TLS_TPREL_LO16 `]() enumerator MICROMIPS\_TLS\_TPREL\_LO16 = (170 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_GPREL7_S2 `]() enumerator MICROMIPS\_GPREL7\_S2 = (172 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_PC23_S2 `]() enumerator MICROMIPS\_PC23\_S2 = (173 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_PC21_S2 `]() enumerator MICROMIPS\_PC21\_S2 = (174 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_PC26_S2 `]() enumerator MICROMIPS\_PC26\_S2 = (175 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_PC18_S3 `]() enumerator MICROMIPS\_PC18\_S3 = (176 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MICROMIPS_PC19_S2 `]() enumerator MICROMIPS\_PC19\_S2 = (177 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_NUM `]() enumerator MIPS\_NUM = (218 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_PC32 `]() enumerator MIPS\_PC32 = (248 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` MIPS_EH `]() enumerator MIPS\_EH = (249 | [R\_MIPS]( "LIEF::ELF::Relocation::R_MIPS")) ##### [` PPC_NONE `]() enumerator PPC\_NONE = (0 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_ADDR32 `]() enumerator PPC\_ADDR32 = (1 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_ADDR24 `]() enumerator PPC\_ADDR24 = (2 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_ADDR16 `]() enumerator PPC\_ADDR16 = (3 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_ADDR16_LO `]() enumerator PPC\_ADDR16\_LO = (4 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_ADDR16_HI `]() enumerator PPC\_ADDR16\_HI = (5 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_ADDR16_HA `]() enumerator PPC\_ADDR16\_HA = (6 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_ADDR14 `]() enumerator PPC\_ADDR14 = (7 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_ADDR14_BRTAKEN `]() enumerator PPC\_ADDR14\_BRTAKEN = (8 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_ADDR14_BRNTAKEN `]() enumerator PPC\_ADDR14\_BRNTAKEN = (9 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_REL24 `]() enumerator PPC\_REL24 = (10 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_REL14 `]() enumerator PPC\_REL14 = (11 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_REL14_BRTAKEN `]() enumerator PPC\_REL14\_BRTAKEN = (12 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_REL14_BRNTAKEN `]() enumerator PPC\_REL14\_BRNTAKEN = (13 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_GOT16 `]() enumerator PPC\_GOT16 = (14 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_GOT16_LO `]() enumerator PPC\_GOT16\_LO = (15 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_GOT16_HI `]() enumerator PPC\_GOT16\_HI = (16 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_GOT16_HA `]() enumerator PPC\_GOT16\_HA = (17 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_PLTREL24 `]() enumerator PPC\_PLTREL24 = (18 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_JMP_SLOT `]() enumerator PPC\_JMP\_SLOT = (21 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_RELATIVE `]() enumerator PPC\_RELATIVE = (22 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_LOCAL24PC `]() enumerator PPC\_LOCAL24PC = (23 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_REL32 `]() enumerator PPC\_REL32 = (26 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_TLS `]() enumerator PPC\_TLS = (67 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_DTPMOD32 `]() enumerator PPC\_DTPMOD32 = (68 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_TPREL16 `]() enumerator PPC\_TPREL16 = (69 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_TPREL16_LO `]() enumerator PPC\_TPREL16\_LO = (70 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_TPREL16_HI `]() enumerator PPC\_TPREL16\_HI = (71 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_TPREL16_HA `]() enumerator PPC\_TPREL16\_HA = (72 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_TPREL32 `]() enumerator PPC\_TPREL32 = (73 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_DTPREL16 `]() enumerator PPC\_DTPREL16 = (74 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_DTPREL16_LO `]() enumerator PPC\_DTPREL16\_LO = (75 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_DTPREL16_HI `]() enumerator PPC\_DTPREL16\_HI = (76 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_DTPREL16_HA `]() enumerator PPC\_DTPREL16\_HA = (77 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_DTPREL32 `]() enumerator PPC\_DTPREL32 = (78 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_GOT_TLSGD16 `]() enumerator PPC\_GOT\_TLSGD16 = (79 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_GOT_TLSGD16_LO `]() enumerator PPC\_GOT\_TLSGD16\_LO = (80 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_GOT_TLSGD16_HI `]() enumerator PPC\_GOT\_TLSGD16\_HI = (81 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_GOT_TLSGD16_HA `]() enumerator PPC\_GOT\_TLSGD16\_HA = (82 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_GOT_TLSLD16 `]() enumerator PPC\_GOT\_TLSLD16 = (83 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_GOT_TLSLD16_LO `]() enumerator PPC\_GOT\_TLSLD16\_LO = (84 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_GOT_TLSLD16_HI `]() enumerator PPC\_GOT\_TLSLD16\_HI = (85 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_GOT_TLSLD16_HA `]() enumerator PPC\_GOT\_TLSLD16\_HA = (86 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_GOT_TPREL16 `]() enumerator PPC\_GOT\_TPREL16 = (87 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_GOT_TPREL16_LO `]() enumerator PPC\_GOT\_TPREL16\_LO = (88 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_GOT_TPREL16_HI `]() enumerator PPC\_GOT\_TPREL16\_HI = (89 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_GOT_TPREL16_HA `]() enumerator PPC\_GOT\_TPREL16\_HA = (90 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_GOT_DTPREL16 `]() enumerator PPC\_GOT\_DTPREL16 = (91 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_GOT_DTPREL16_LO `]() enumerator PPC\_GOT\_DTPREL16\_LO = (92 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_GOT_DTPREL16_HI `]() enumerator PPC\_GOT\_DTPREL16\_HI = (93 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_GOT_DTPREL16_HA `]() enumerator PPC\_GOT\_DTPREL16\_HA = (94 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_TLSGD `]() enumerator PPC\_TLSGD = (95 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_TLSLD `]() enumerator PPC\_TLSLD = (96 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_REL16 `]() enumerator PPC\_REL16 = (249 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_REL16_LO `]() enumerator PPC\_REL16\_LO = (250 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_REL16_HI `]() enumerator PPC\_REL16\_HI = (251 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC_REL16_HA `]() enumerator PPC\_REL16\_HA = (252 | [R\_PPC]( "LIEF::ELF::Relocation::R_PPC")) ##### [` PPC64_NONE `]() enumerator PPC64\_NONE = (0 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_ADDR32 `]() enumerator PPC64\_ADDR32 = (1 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_ADDR24 `]() enumerator PPC64\_ADDR24 = (2 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_ADDR16 `]() enumerator PPC64\_ADDR16 = (3 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_ADDR16_LO `]() enumerator PPC64\_ADDR16\_LO = (4 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_ADDR16_HI `]() enumerator PPC64\_ADDR16\_HI = (5 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_ADDR16_HA `]() enumerator PPC64\_ADDR16\_HA = (6 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_ADDR14 `]() enumerator PPC64\_ADDR14 = (7 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_ADDR14_BRTAKEN `]() enumerator PPC64\_ADDR14\_BRTAKEN = (8 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_ADDR14_BRNTAKEN `]() enumerator PPC64\_ADDR14\_BRNTAKEN = (9 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_REL24 `]() enumerator PPC64\_REL24 = (10 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_REL14 `]() enumerator PPC64\_REL14 = (11 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_REL14_BRTAKEN `]() enumerator PPC64\_REL14\_BRTAKEN = (12 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_REL14_BRNTAKEN `]() enumerator PPC64\_REL14\_BRNTAKEN = (13 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_GOT16 `]() enumerator PPC64\_GOT16 = (14 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_GOT16_LO `]() enumerator PPC64\_GOT16\_LO = (15 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_GOT16_HI `]() enumerator PPC64\_GOT16\_HI = (16 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_GOT16_HA `]() enumerator PPC64\_GOT16\_HA = (17 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_JMP_SLOT `]() enumerator PPC64\_JMP\_SLOT = (21 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_RELATIVE `]() enumerator PPC64\_RELATIVE = (22 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_REL32 `]() enumerator PPC64\_REL32 = (26 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_ADDR64 `]() enumerator PPC64\_ADDR64 = (38 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_ADDR16_HIGHER `]() enumerator PPC64\_ADDR16\_HIGHER = (39 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_ADDR16_HIGHERA `]() enumerator PPC64\_ADDR16\_HIGHERA = (40 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_ADDR16_HIGHEST `]() enumerator PPC64\_ADDR16\_HIGHEST = (41 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_ADDR16_HIGHESTA `]() enumerator PPC64\_ADDR16\_HIGHESTA = (42 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_REL64 `]() enumerator PPC64\_REL64 = (44 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_TOC16 `]() enumerator PPC64\_TOC16 = (47 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_TOC16_LO `]() enumerator PPC64\_TOC16\_LO = (48 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_TOC16_HI `]() enumerator PPC64\_TOC16\_HI = (49 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_TOC16_HA `]() enumerator PPC64\_TOC16\_HA = (50 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_TOC `]() enumerator PPC64\_TOC = (51 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_ADDR16_DS `]() enumerator PPC64\_ADDR16\_DS = (56 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_ADDR16_LO_DS `]() enumerator PPC64\_ADDR16\_LO\_DS = (57 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_GOT16_DS `]() enumerator PPC64\_GOT16\_DS = (58 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_GOT16_LO_DS `]() enumerator PPC64\_GOT16\_LO\_DS = (59 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_TOC16_DS `]() enumerator PPC64\_TOC16\_DS = (63 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_TOC16_LO_DS `]() enumerator PPC64\_TOC16\_LO\_DS = (64 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_TLS `]() enumerator PPC64\_TLS = (67 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_DTPMOD64 `]() enumerator PPC64\_DTPMOD64 = (68 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_TPREL16 `]() enumerator PPC64\_TPREL16 = (69 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_TPREL16_LO `]() enumerator PPC64\_TPREL16\_LO = (70 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_TPREL16_HI `]() enumerator PPC64\_TPREL16\_HI = (71 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_TPREL16_HA `]() enumerator PPC64\_TPREL16\_HA = (72 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_TPREL64 `]() enumerator PPC64\_TPREL64 = (73 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_DTPREL16 `]() enumerator PPC64\_DTPREL16 = (74 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_DTPREL16_LO `]() enumerator PPC64\_DTPREL16\_LO = (75 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_DTPREL16_HI `]() enumerator PPC64\_DTPREL16\_HI = (76 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_DTPREL16_HA `]() enumerator PPC64\_DTPREL16\_HA = (77 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_DTPREL64 `]() enumerator PPC64\_DTPREL64 = (78 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_GOT_TLSGD16 `]() enumerator PPC64\_GOT\_TLSGD16 = (79 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_GOT_TLSGD16_LO `]() enumerator PPC64\_GOT\_TLSGD16\_LO = (80 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_GOT_TLSGD16_HI `]() enumerator PPC64\_GOT\_TLSGD16\_HI = (81 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_GOT_TLSGD16_HA `]() enumerator PPC64\_GOT\_TLSGD16\_HA = (82 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_GOT_TLSLD16 `]() enumerator PPC64\_GOT\_TLSLD16 = (83 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_GOT_TLSLD16_LO `]() enumerator PPC64\_GOT\_TLSLD16\_LO = (84 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_GOT_TLSLD16_HI `]() enumerator PPC64\_GOT\_TLSLD16\_HI = (85 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_GOT_TLSLD16_HA `]() enumerator PPC64\_GOT\_TLSLD16\_HA = (86 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_GOT_TPREL16_DS `]() enumerator PPC64\_GOT\_TPREL16\_DS = (87 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_GOT_TPREL16_LO_DS `]() enumerator PPC64\_GOT\_TPREL16\_LO\_DS = (88 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_GOT_TPREL16_HI `]() enumerator PPC64\_GOT\_TPREL16\_HI = (89 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_GOT_TPREL16_HA `]() enumerator PPC64\_GOT\_TPREL16\_HA = (90 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_GOT_DTPREL16_DS `]() enumerator PPC64\_GOT\_DTPREL16\_DS = (91 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_GOT_DTPREL16_LO_DS `]() enumerator PPC64\_GOT\_DTPREL16\_LO\_DS = (92 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_GOT_DTPREL16_HI `]() enumerator PPC64\_GOT\_DTPREL16\_HI = (93 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_GOT_DTPREL16_HA `]() enumerator PPC64\_GOT\_DTPREL16\_HA = (94 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_TPREL16_DS `]() enumerator PPC64\_TPREL16\_DS = (95 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_TPREL16_LO_DS `]() enumerator PPC64\_TPREL16\_LO\_DS = (96 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_TPREL16_HIGHER `]() enumerator PPC64\_TPREL16\_HIGHER = (97 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_TPREL16_HIGHERA `]() enumerator PPC64\_TPREL16\_HIGHERA = (98 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_TPREL16_HIGHEST `]() enumerator PPC64\_TPREL16\_HIGHEST = (99 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_TPREL16_HIGHESTA `]() enumerator PPC64\_TPREL16\_HIGHESTA = (100 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_DTPREL16_DS `]() enumerator PPC64\_DTPREL16\_DS = (101 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_DTPREL16_LO_DS `]() enumerator PPC64\_DTPREL16\_LO\_DS = (102 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_DTPREL16_HIGHER `]() enumerator PPC64\_DTPREL16\_HIGHER = (103 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_DTPREL16_HIGHERA `]() enumerator PPC64\_DTPREL16\_HIGHERA = (104 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_DTPREL16_HIGHEST `]() enumerator PPC64\_DTPREL16\_HIGHEST = (105 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_DTPREL16_HIGHESTA `]() enumerator PPC64\_DTPREL16\_HIGHESTA = (106 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_TLSGD `]() enumerator PPC64\_TLSGD = (107 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_TLSLD `]() enumerator PPC64\_TLSLD = (108 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_REL16 `]() enumerator PPC64\_REL16 = (249 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_REL16_LO `]() enumerator PPC64\_REL16\_LO = (250 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_REL16_HI `]() enumerator PPC64\_REL16\_HI = (251 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` PPC64_REL16_HA `]() enumerator PPC64\_REL16\_HA = (252 | [R\_PPC64]( "LIEF::ELF::Relocation::R_PPC64")) ##### [` SPARC_NONE `]() enumerator SPARC\_NONE = (0 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_8 `]() enumerator SPARC\_8 = (1 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_16 `]() enumerator SPARC\_16 = (2 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_32 `]() enumerator SPARC\_32 = (3 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_DISP8 `]() enumerator SPARC\_DISP8 = (4 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_DISP16 `]() enumerator SPARC\_DISP16 = (5 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_DISP32 `]() enumerator SPARC\_DISP32 = (6 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_WDISP30 `]() enumerator SPARC\_WDISP30 = (7 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_WDISP22 `]() enumerator SPARC\_WDISP22 = (8 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_HI22 `]() enumerator SPARC\_HI22 = (9 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_22 `]() enumerator SPARC\_22 = (10 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_13 `]() enumerator SPARC\_13 = (11 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_LO10 `]() enumerator SPARC\_LO10 = (12 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_GOT10 `]() enumerator SPARC\_GOT10 = (13 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_GOT13 `]() enumerator SPARC\_GOT13 = (14 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_GOT22 `]() enumerator SPARC\_GOT22 = (15 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_PC10 `]() enumerator SPARC\_PC10 = (16 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_PC22 `]() enumerator SPARC\_PC22 = (17 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_WPLT30 `]() enumerator SPARC\_WPLT30 = (18 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_COPY `]() enumerator SPARC\_COPY = (19 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_GLOB_DAT `]() enumerator SPARC\_GLOB\_DAT = (20 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_JMP_SLOT `]() enumerator SPARC\_JMP\_SLOT = (21 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_RELATIVE `]() enumerator SPARC\_RELATIVE = (22 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_UA32 `]() enumerator SPARC\_UA32 = (23 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_PLT32 `]() enumerator SPARC\_PLT32 = (24 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_HIPLT22 `]() enumerator SPARC\_HIPLT22 = (25 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_LOPLT10 `]() enumerator SPARC\_LOPLT10 = (26 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_PCPLT32 `]() enumerator SPARC\_PCPLT32 = (27 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_PCPLT22 `]() enumerator SPARC\_PCPLT22 = (28 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_PCPLT10 `]() enumerator SPARC\_PCPLT10 = (29 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_10 `]() enumerator SPARC\_10 = (30 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_11 `]() enumerator SPARC\_11 = (31 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_64 `]() enumerator SPARC\_64 = (32 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_OLO10 `]() enumerator SPARC\_OLO10 = (33 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_HH22 `]() enumerator SPARC\_HH22 = (34 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_HM10 `]() enumerator SPARC\_HM10 = (35 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_LM22 `]() enumerator SPARC\_LM22 = (36 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_PC_HH22 `]() enumerator SPARC\_PC\_HH22 = (37 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_PC_HM10 `]() enumerator SPARC\_PC\_HM10 = (38 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_PC_LM22 `]() enumerator SPARC\_PC\_LM22 = (39 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_WDISP16 `]() enumerator SPARC\_WDISP16 = (40 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_WDISP19 `]() enumerator SPARC\_WDISP19 = (41 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_7 `]() enumerator SPARC\_7 = (43 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_5 `]() enumerator SPARC\_5 = (44 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_6 `]() enumerator SPARC\_6 = (45 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_DISP64 `]() enumerator SPARC\_DISP64 = (46 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_PLT64 `]() enumerator SPARC\_PLT64 = (47 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_HIX22 `]() enumerator SPARC\_HIX22 = (48 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_LOX10 `]() enumerator SPARC\_LOX10 = (49 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_H44 `]() enumerator SPARC\_H44 = (50 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_M44 `]() enumerator SPARC\_M44 = (51 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_L44 `]() enumerator SPARC\_L44 = (52 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_REGISTER `]() enumerator SPARC\_REGISTER = (53 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_UA64 `]() enumerator SPARC\_UA64 = (54 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_UA16 `]() enumerator SPARC\_UA16 = (55 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_GD_HI22 `]() enumerator SPARC\_TLS\_GD\_HI22 = (56 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_GD_LO10 `]() enumerator SPARC\_TLS\_GD\_LO10 = (57 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_GD_ADD `]() enumerator SPARC\_TLS\_GD\_ADD = (58 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_GD_CALL `]() enumerator SPARC\_TLS\_GD\_CALL = (59 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_LDM_HI22 `]() enumerator SPARC\_TLS\_LDM\_HI22 = (60 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_LDM_LO10 `]() enumerator SPARC\_TLS\_LDM\_LO10 = (61 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_LDM_ADD `]() enumerator SPARC\_TLS\_LDM\_ADD = (62 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_LDM_CALL `]() enumerator SPARC\_TLS\_LDM\_CALL = (63 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_LDO_HIX22 `]() enumerator SPARC\_TLS\_LDO\_HIX22 = (64 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_LDO_LOX10 `]() enumerator SPARC\_TLS\_LDO\_LOX10 = (65 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_LDO_ADD `]() enumerator SPARC\_TLS\_LDO\_ADD = (66 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_IE_HI22 `]() enumerator SPARC\_TLS\_IE\_HI22 = (67 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_IE_LO10 `]() enumerator SPARC\_TLS\_IE\_LO10 = (68 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_IE_LD `]() enumerator SPARC\_TLS\_IE\_LD = (69 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_IE_LDX `]() enumerator SPARC\_TLS\_IE\_LDX = (70 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_IE_ADD `]() enumerator SPARC\_TLS\_IE\_ADD = (71 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_LE_HIX22 `]() enumerator SPARC\_TLS\_LE\_HIX22 = (72 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_LE_LOX10 `]() enumerator SPARC\_TLS\_LE\_LOX10 = (73 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_DTPMOD32 `]() enumerator SPARC\_TLS\_DTPMOD32 = (74 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_DTPMOD64 `]() enumerator SPARC\_TLS\_DTPMOD64 = (75 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_DTPOFF32 `]() enumerator SPARC\_TLS\_DTPOFF32 = (76 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_DTPOFF64 `]() enumerator SPARC\_TLS\_DTPOFF64 = (77 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_TPOFF32 `]() enumerator SPARC\_TLS\_TPOFF32 = (78 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_TLS_TPOFF64 `]() enumerator SPARC\_TLS\_TPOFF64 = (79 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_GOTDATA_HIX22 `]() enumerator SPARC\_GOTDATA\_HIX22 = (80 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_GOTDATA_LOX10 `]() enumerator SPARC\_GOTDATA\_LOX10 = (81 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_GOTDATA_OP_HIX22 `]() enumerator SPARC\_GOTDATA\_OP\_HIX22 = (82 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_GOTDATA_OP_LOX10 `]() enumerator SPARC\_GOTDATA\_OP\_LOX10 = (83 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SPARC_GOTDATA_OP `]() enumerator SPARC\_GOTDATA\_OP = (84 | [R\_SPARC]( "LIEF::ELF::Relocation::R_SPARC")) ##### [` SYSZ_NONE `]() enumerator SYSZ\_NONE = (0 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_8 `]() enumerator SYSZ\_8 = (1 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_12 `]() enumerator SYSZ\_12 = (2 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_16 `]() enumerator SYSZ\_16 = (3 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_32 `]() enumerator SYSZ\_32 = (4 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_PC32 `]() enumerator SYSZ\_PC32 = (5 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_GOT12 `]() enumerator SYSZ\_GOT12 = (6 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_GOT32 `]() enumerator SYSZ\_GOT32 = (7 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_PLT32 `]() enumerator SYSZ\_PLT32 = (8 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_COPY `]() enumerator SYSZ\_COPY = (9 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_GLOB_DAT `]() enumerator SYSZ\_GLOB\_DAT = (10 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_JMP_SLOT `]() enumerator SYSZ\_JMP\_SLOT = (11 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_RELATIVE `]() enumerator SYSZ\_RELATIVE = (12 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_GOTOFF `]() enumerator SYSZ\_GOTOFF = (13 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_GOTPC `]() enumerator SYSZ\_GOTPC = (14 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_GOT16 `]() enumerator SYSZ\_GOT16 = (15 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_PC16 `]() enumerator SYSZ\_PC16 = (16 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_PC16DBL `]() enumerator SYSZ\_PC16DBL = (17 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_PLT16DBL `]() enumerator SYSZ\_PLT16DBL = (18 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_PC32DBL `]() enumerator SYSZ\_PC32DBL = (19 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_PLT32DBL `]() enumerator SYSZ\_PLT32DBL = (20 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_GOTPCDBL `]() enumerator SYSZ\_GOTPCDBL = (21 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_64 `]() enumerator SYSZ\_64 = (22 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_PC64 `]() enumerator SYSZ\_PC64 = (23 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_GOT64 `]() enumerator SYSZ\_GOT64 = (24 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_PLT64 `]() enumerator SYSZ\_PLT64 = (25 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_GOTENT `]() enumerator SYSZ\_GOTENT = (26 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_GOTOFF16 `]() enumerator SYSZ\_GOTOFF16 = (27 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_GOTOFF64 `]() enumerator SYSZ\_GOTOFF64 = (28 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_GOTPLT12 `]() enumerator SYSZ\_GOTPLT12 = (29 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_GOTPLT16 `]() enumerator SYSZ\_GOTPLT16 = (30 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_GOTPLT32 `]() enumerator SYSZ\_GOTPLT32 = (31 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_GOTPLT64 `]() enumerator SYSZ\_GOTPLT64 = (32 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_GOTPLTENT `]() enumerator SYSZ\_GOTPLTENT = (33 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_PLTOFF16 `]() enumerator SYSZ\_PLTOFF16 = (34 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_PLTOFF32 `]() enumerator SYSZ\_PLTOFF32 = (35 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_PLTOFF64 `]() enumerator SYSZ\_PLTOFF64 = (36 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_TLS_LOAD `]() enumerator SYSZ\_TLS\_LOAD = (37 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_TLS_GDCALL `]() enumerator SYSZ\_TLS\_GDCALL = (38 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_TLS_LDCALL `]() enumerator SYSZ\_TLS\_LDCALL = (39 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_TLS_GD32 `]() enumerator SYSZ\_TLS\_GD32 = (40 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_TLS_GD64 `]() enumerator SYSZ\_TLS\_GD64 = (41 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_TLS_GOTIE12 `]() enumerator SYSZ\_TLS\_GOTIE12 = (42 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_TLS_GOTIE32 `]() enumerator SYSZ\_TLS\_GOTIE32 = (43 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_TLS_GOTIE64 `]() enumerator SYSZ\_TLS\_GOTIE64 = (44 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_TLS_LDM32 `]() enumerator SYSZ\_TLS\_LDM32 = (45 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_TLS_LDM64 `]() enumerator SYSZ\_TLS\_LDM64 = (46 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_TLS_IE32 `]() enumerator SYSZ\_TLS\_IE32 = (47 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_TLS_IE64 `]() enumerator SYSZ\_TLS\_IE64 = (48 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_TLS_IEENT `]() enumerator SYSZ\_TLS\_IEENT = (49 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_TLS_LE32 `]() enumerator SYSZ\_TLS\_LE32 = (50 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_TLS_LE64 `]() enumerator SYSZ\_TLS\_LE64 = (51 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_TLS_LDO32 `]() enumerator SYSZ\_TLS\_LDO32 = (52 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_TLS_LDO64 `]() enumerator SYSZ\_TLS\_LDO64 = (53 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_TLS_DTPMOD `]() enumerator SYSZ\_TLS\_DTPMOD = (54 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_TLS_DTPOFF `]() enumerator SYSZ\_TLS\_DTPOFF = (55 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_TLS_TPOFF `]() enumerator SYSZ\_TLS\_TPOFF = (56 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_20 `]() enumerator SYSZ\_20 = (57 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_GOT20 `]() enumerator SYSZ\_GOT20 = (58 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_GOTPLT20 `]() enumerator SYSZ\_GOTPLT20 = (59 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_TLS_GOTIE20 `]() enumerator SYSZ\_TLS\_GOTIE20 = (60 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_IRELATIVE `]() enumerator SYSZ\_IRELATIVE = (61 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_PC12DBL `]() enumerator SYSZ\_PC12DBL = (62 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_PLT12DBL `]() enumerator SYSZ\_PLT12DBL = (63 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_PC24DBL `]() enumerator SYSZ\_PC24DBL = (64 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` SYSZ_PLT24DBL `]() enumerator SYSZ\_PLT24DBL = (65 | [R\_SYSZ]( "LIEF::ELF::Relocation::R_SYSZ")) ##### [` RISCV_NONE `]() enumerator RISCV\_NONE = (0 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_32 `]() enumerator RISCV\_32 = (1 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_64 `]() enumerator RISCV\_64 = (2 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_RELATIVE `]() enumerator RISCV\_RELATIVE = (3 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_COPY `]() enumerator RISCV\_COPY = (4 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_JUMP_SLOT `]() enumerator RISCV\_JUMP\_SLOT = (5 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_TLS_DTPMOD32 `]() enumerator RISCV\_TLS\_DTPMOD32 = (6 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_TLS_DTPMOD64 `]() enumerator RISCV\_TLS\_DTPMOD64 = (7 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_TLS_DTPREL32 `]() enumerator RISCV\_TLS\_DTPREL32 = (8 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_TLS_DTPREL64 `]() enumerator RISCV\_TLS\_DTPREL64 = (9 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_TLS_TPREL32 `]() enumerator RISCV\_TLS\_TPREL32 = (10 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_TLS_TPREL64 `]() enumerator RISCV\_TLS\_TPREL64 = (11 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_TLSDESC `]() enumerator RISCV\_TLSDESC = (12 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_BRANCH `]() enumerator RISCV\_BRANCH = (16 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_JAL `]() enumerator RISCV\_JAL = (17 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_CALL `]() enumerator RISCV\_CALL = (18 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_CALL_PLT `]() enumerator RISCV\_CALL\_PLT = (19 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_GOT_HI20 `]() enumerator RISCV\_GOT\_HI20 = (20 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_TLS_GOT_HI20 `]() enumerator RISCV\_TLS\_GOT\_HI20 = (21 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_TLS_GD_HI20 `]() enumerator RISCV\_TLS\_GD\_HI20 = (22 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_PCREL_HI20 `]() enumerator RISCV\_PCREL\_HI20 = (23 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_PCREL_LO12_I `]() enumerator RISCV\_PCREL\_LO12\_I = (24 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_PCREL_LO12_S `]() enumerator RISCV\_PCREL\_LO12\_S = (25 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_HI20 `]() enumerator RISCV\_HI20 = (26 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_LO12_I `]() enumerator RISCV\_LO12\_I = (27 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_LO12_S `]() enumerator RISCV\_LO12\_S = (28 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_TPREL_HI20 `]() enumerator RISCV\_TPREL\_HI20 = (29 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_TPREL_LO12_I `]() enumerator RISCV\_TPREL\_LO12\_I = (30 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_TPREL_LO12_S `]() enumerator RISCV\_TPREL\_LO12\_S = (31 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_TPREL_ADD `]() enumerator RISCV\_TPREL\_ADD = (32 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_ADD8 `]() enumerator RISCV\_ADD8 = (33 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_ADD16 `]() enumerator RISCV\_ADD16 = (34 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_ADD32 `]() enumerator RISCV\_ADD32 = (35 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_ADD64 `]() enumerator RISCV\_ADD64 = (36 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_SUB8 `]() enumerator RISCV\_SUB8 = (37 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_SUB16 `]() enumerator RISCV\_SUB16 = (38 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_SUB32 `]() enumerator RISCV\_SUB32 = (39 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_SUB64 `]() enumerator RISCV\_SUB64 = (40 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_GOT32_PCREL `]() enumerator RISCV\_GOT32\_PCREL = (41 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_ALIGN `]() enumerator RISCV\_ALIGN = (43 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_RVC_BRANCH `]() enumerator RISCV\_RVC\_BRANCH = (44 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_RVC_JUMP `]() enumerator RISCV\_RVC\_JUMP = (45 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_RVC_LUI `]() enumerator RISCV\_RVC\_LUI = (46 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_RELAX `]() enumerator RISCV\_RELAX = (51 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_SUB6 `]() enumerator RISCV\_SUB6 = (52 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_SET6 `]() enumerator RISCV\_SET6 = (53 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_SET8 `]() enumerator RISCV\_SET8 = (54 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_SET16 `]() enumerator RISCV\_SET16 = (55 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_SET32 `]() enumerator RISCV\_SET32 = (56 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_32_PCREL `]() enumerator RISCV\_32\_PCREL = (57 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_IRELATIVE `]() enumerator RISCV\_IRELATIVE = (58 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_PLT32 `]() enumerator RISCV\_PLT32 = (59 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_SET_ULEB128 `]() enumerator RISCV\_SET\_ULEB128 = (60 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_SUB_ULEB128 `]() enumerator RISCV\_SUB\_ULEB128 = (61 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_TLSDESC_HI20 `]() enumerator RISCV\_TLSDESC\_HI20 = (62 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_TLSDESC_LOAD_LO12 `]() enumerator RISCV\_TLSDESC\_LOAD\_LO12 = (63 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_TLSDESC_ADD_LO12 `]() enumerator RISCV\_TLSDESC\_ADD\_LO12 = (64 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` RISCV_TLSDESC_CALL `]() enumerator RISCV\_TLSDESC\_CALL = (65 | [R\_RISCV]( "LIEF::ELF::Relocation::R_RISCV")) ##### [` BPF_NONE `]() enumerator BPF\_NONE = (0 | [R\_BPF]( "LIEF::ELF::Relocation::R_BPF")) ##### [` BPF_64_64 `]() enumerator BPF\_64\_64 = (1 | [R\_BPF]( "LIEF::ELF::Relocation::R_BPF")) ##### [` BPF_64_ABS64 `]() enumerator BPF\_64\_ABS64 = (2 | [R\_BPF]( "LIEF::ELF::Relocation::R_BPF")) ##### [` BPF_64_ABS32 `]() enumerator BPF\_64\_ABS32 = (3 | [R\_BPF]( "LIEF::ELF::Relocation::R_BPF")) ##### [` BPF_64_NODYLD32 `]() enumerator BPF\_64\_NODYLD32 = (4 | [R\_BPF]( "LIEF::ELF::Relocation::R_BPF")) ##### [` BPF_64_32 `]() enumerator BPF\_64\_32 = (10 | [R\_BPF]( "LIEF::ELF::Relocation::R_BPF")) ##### [` SH_NONE `]() enumerator SH\_NONE = (0 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR32 `]() enumerator SH\_DIR32 = (1 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_REL32 `]() enumerator SH\_REL32 = (2 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR8WPN `]() enumerator SH\_DIR8WPN = (3 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_IND12W `]() enumerator SH\_IND12W = (4 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR8WPL `]() enumerator SH\_DIR8WPL = (5 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR8WPZ `]() enumerator SH\_DIR8WPZ = (6 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR8BP `]() enumerator SH\_DIR8BP = (7 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR8W `]() enumerator SH\_DIR8W = (8 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR8L `]() enumerator SH\_DIR8L = (9 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_LOOP_START `]() enumerator SH\_LOOP\_START = (10 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_LOOP_END `]() enumerator SH\_LOOP\_END = (11 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GNU_VTINHERIT `]() enumerator SH\_GNU\_VTINHERIT = (22 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GNU_VTENTRY `]() enumerator SH\_GNU\_VTENTRY = (23 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_SWITCH8 `]() enumerator SH\_SWITCH8 = (24 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_SWITCH16 `]() enumerator SH\_SWITCH16 = (25 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_SWITCH32 `]() enumerator SH\_SWITCH32 = (26 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_USES `]() enumerator SH\_USES = (27 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_COUNT `]() enumerator SH\_COUNT = (28 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_ALIGN `]() enumerator SH\_ALIGN = (29 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_CODE `]() enumerator SH\_CODE = (30 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DATA `]() enumerator SH\_DATA = (31 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_LABEL `]() enumerator SH\_LABEL = (32 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR16 `]() enumerator SH\_DIR16 = (33 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR8 `]() enumerator SH\_DIR8 = (34 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR8UL `]() enumerator SH\_DIR8UL = (35 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR8UW `]() enumerator SH\_DIR8UW = (36 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR8U `]() enumerator SH\_DIR8U = (37 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR8SW `]() enumerator SH\_DIR8SW = (38 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR8S `]() enumerator SH\_DIR8S = (39 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR4UL `]() enumerator SH\_DIR4UL = (40 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR4UW `]() enumerator SH\_DIR4UW = (41 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR4U `]() enumerator SH\_DIR4U = (42 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_PSHA `]() enumerator SH\_PSHA = (43 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_PSHL `]() enumerator SH\_PSHL = (44 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR5U `]() enumerator SH\_DIR5U = (45 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR6U `]() enumerator SH\_DIR6U = (46 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR6S `]() enumerator SH\_DIR6S = (47 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR10S `]() enumerator SH\_DIR10S = (48 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR10SW `]() enumerator SH\_DIR10SW = (49 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR10SL `]() enumerator SH\_DIR10SL = (50 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR10SQ `]() enumerator SH\_DIR10SQ = (51 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_DIR16S `]() enumerator SH\_DIR16S = (53 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_TLS_GD_32 `]() enumerator SH\_TLS\_GD\_32 = (144 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_TLS_LD_32 `]() enumerator SH\_TLS\_LD\_32 = (145 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_TLS_LDO_32 `]() enumerator SH\_TLS\_LDO\_32 = (146 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_TLS_IE_32 `]() enumerator SH\_TLS\_IE\_32 = (147 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_TLS_LE_32 `]() enumerator SH\_TLS\_LE\_32 = (148 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_TLS_DTPMOD32 `]() enumerator SH\_TLS\_DTPMOD32 = (149 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_TLS_DTPOFF32 `]() enumerator SH\_TLS\_DTPOFF32 = (150 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_TLS_TPOFF32 `]() enumerator SH\_TLS\_TPOFF32 = (151 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOT32 `]() enumerator SH\_GOT32 = (160 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_PLT32 `]() enumerator SH\_PLT32 = (161 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_COPY `]() enumerator SH\_COPY = (162 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GLOB_DAT `]() enumerator SH\_GLOB\_DAT = (163 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_JMP_SLOT `]() enumerator SH\_JMP\_SLOT = (164 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_RELATIVE `]() enumerator SH\_RELATIVE = (165 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOTOFF `]() enumerator SH\_GOTOFF = (166 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOTPC `]() enumerator SH\_GOTPC = (167 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOTPLT32 `]() enumerator SH\_GOTPLT32 = (168 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOT_LOW16 `]() enumerator SH\_GOT\_LOW16 = (169 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOT_MEDLOW16 `]() enumerator SH\_GOT\_MEDLOW16 = (170 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOT_MEDHI16 `]() enumerator SH\_GOT\_MEDHI16 = (171 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOT_HI16 `]() enumerator SH\_GOT\_HI16 = (172 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOTPLT_LOW16 `]() enumerator SH\_GOTPLT\_LOW16 = (173 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOTPLT_MEDLOW16 `]() enumerator SH\_GOTPLT\_MEDLOW16 = (174 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOTPLT_MEDHI16 `]() enumerator SH\_GOTPLT\_MEDHI16 = (175 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOTPLT_HI16 `]() enumerator SH\_GOTPLT\_HI16 = (176 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_PLT_LOW16 `]() enumerator SH\_PLT\_LOW16 = (177 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_PLT_MEDLOW16 `]() enumerator SH\_PLT\_MEDLOW16 = (178 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_PLT_MEDHI16 `]() enumerator SH\_PLT\_MEDHI16 = (179 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_PLT_HI16 `]() enumerator SH\_PLT\_HI16 = (180 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOTOFF_LOW16 `]() enumerator SH\_GOTOFF\_LOW16 = (181 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOTOFF_MEDLOW16 `]() enumerator SH\_GOTOFF\_MEDLOW16 = (182 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOTOFF_MEDHI16 `]() enumerator SH\_GOTOFF\_MEDHI16 = (183 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOTOFF_HI16 `]() enumerator SH\_GOTOFF\_HI16 = (184 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOTPC_LOW16 `]() enumerator SH\_GOTPC\_LOW16 = (185 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOTPC_MEDLOW16 `]() enumerator SH\_GOTPC\_MEDLOW16 = (186 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOTPC_MEDHI16 `]() enumerator SH\_GOTPC\_MEDHI16 = (187 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOTPC_HI16 `]() enumerator SH\_GOTPC\_HI16 = (188 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOT10BY4 `]() enumerator SH\_GOT10BY4 = (189 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOTPLT10BY4 `]() enumerator SH\_GOTPLT10BY4 = (190 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOT10BY8 `]() enumerator SH\_GOT10BY8 = (191 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOTPLT10BY8 `]() enumerator SH\_GOTPLT10BY8 = (192 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_COPY64 `]() enumerator SH\_COPY64 = (193 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GLOB_DAT64 `]() enumerator SH\_GLOB\_DAT64 = (194 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_JMP_SLOT64 `]() enumerator SH\_JMP\_SLOT64 = (195 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_RELATIVE64 `]() enumerator SH\_RELATIVE64 = (196 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOT20 `]() enumerator SH\_GOT20 = (201 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOTOFF20 `]() enumerator SH\_GOTOFF20 = (202 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOTFUNCDESC `]() enumerator SH\_GOTFUNCDESC = (203 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOTFUNCDESC20 `]() enumerator SH\_GOTFUNCDESC20 = (204 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOTOFFFUNCDESC `]() enumerator SH\_GOTOFFFUNCDESC = (205 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_GOTOFFFUNCDESC20 `]() enumerator SH\_GOTOFFFUNCDESC20 = (206 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_FUNCDESC `]() enumerator SH\_FUNCDESC = (207 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_FUNCDESC_VALUE `]() enumerator SH\_FUNCDESC\_VALUE = (208 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_SHMEDIA_CODE `]() enumerator SH\_SHMEDIA\_CODE = (242 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_PT_16 `]() enumerator SH\_PT\_16 = (243 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_IMMS16 `]() enumerator SH\_IMMS16 = (244 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_IMMU16 `]() enumerator SH\_IMMU16 = (245 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_IMM_LOW16 `]() enumerator SH\_IMM\_LOW16 = (246 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_IMM_LOW16_PCREL `]() enumerator SH\_IMM\_LOW16\_PCREL = (247 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_IMM_MEDLOW16 `]() enumerator SH\_IMM\_MEDLOW16 = (248 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_IMM_MEDLOW16_PCREL `]() enumerator SH\_IMM\_MEDLOW16\_PCREL = (249 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_IMM_MEDHI16 `]() enumerator SH\_IMM\_MEDHI16 = (250 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_IMM_MEDHI16_PCREL `]() enumerator SH\_IMM\_MEDHI16\_PCREL = (251 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_IMM_HI16 `]() enumerator SH\_IMM\_HI16 = (252 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_IMM_HI16_PCREL `]() enumerator SH\_IMM\_HI16\_PCREL = (253 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_64 `]() enumerator SH\_64 = (254 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) ##### [` SH_64_PCREL `]() enumerator SH\_64\_PCREL = (255 | [R\_SH4]( "LIEF::ELF::Relocation::R_SH4")) Public Functions #### [` Relocation `]() Relocation(uint64\_t address, [TYPE]( "LIEF::ELF::Relocation::TYPE") type, [ENCODING]( "LIEF::ELF::Relocation::ENCODING") enc) #### [` Relocation `]() Relocation() = default #### [` Relocation `]() inline Relocation([ARCH]( "LIEF::ELF::ARCH") arch) #### [` ~Relocation `]() ~Relocation() override = default #### [` Relocation `]() inline Relocation(const [Relocation]( "LIEF::ELF::Relocation::Relocation") &other) Copy constructor. > **Warning** > > When this constructor is invoked, referenced sections or symbols are discarded. This means that on the copied [Relocation](), [Relocation::section](), [Relocation::symbol]() and [Relocation::symbol\_table]() are set to a nullptr. #### [` operator= `]() inline [Relocation]( "LIEF::ELF::Relocation") &operator=([Relocation]( "LIEF::ELF::Relocation") other) Copy assignment operator. Please read the notice of the copy constructor #### [` swap `]() inline void swap([Relocation]( "LIEF::ELF::Relocation") &other) #### [` addend `]() inline int64\_t addend() const Additional value that can be involved in the relocation processing. #### [` type `]() inline [TYPE]( "LIEF::ELF::Relocation::TYPE") type() const Type of the relocation. #### [` is_rela `]() inline bool is\_rela() const Check if the relocation uses the explicit [addend()]() field (this is usually the case for 64 bits binaries). #### [` is_rel `]() inline bool is\_rel() const Check if the relocation uses the implicit addend (i.e. not present in the ELF structure). #### [` is_relatively_encoded `]() inline bool is\_relatively\_encoded() const True if the relocation is using the relative encoding. #### [` is_android_packed `]() inline bool is\_android\_packed() const True if the relocation is using the Android packed relocation format. #### [` info `]() inline uint32\_t info() const [Relocation]() info which contains, for instance, the symbol index. #### [` r_info `]() inline uint64\_t r\_info([Header]( "LIEF::ELF::Header")::[CLASS]( "LIEF::ELF::Header::CLASS") clazz, [Header]( "LIEF::ELF::Header")::[ELF\_DATA]( "LIEF::ELF::Header::ELF_DATA") data) const (re)Compute the *raw* `r_info` attribute based on the given ELF class and endianness. #### [` r_info `]() inline uint64\_t r\_info(const [Header]( "LIEF::ELF::Header") &hdr) const (re)Compute the raw `r_info` attribute from the given ELF header. #### [` architecture `]() inline [ARCH]( "LIEF::ELF::ARCH") architecture() const Target architecture for this relocation. #### [` purpose `]() inline [PURPOSE]( "LIEF::ELF::Relocation::PURPOSE") purpose() const #### [` encoding `]() inline [ENCODING]( "LIEF::ELF::Relocation::ENCODING") encoding() const The encoding of the relocation. #### [` is_relative `]() inline bool is\_relative() const True if the semantic of the relocation is `_RELATIVE`. #### [` size `]() virtual size\_t size() const override Return the size (in **bits**) of the value associated with this relocation Return -1 if the size can’t be determined. #### [` has_symbol `]() inline bool has\_symbol() const True if the current relocation is associated with a symbol. #### [` symbol `]() inline [Symbol]( "LIEF::ELF::Symbol") \*symbol() [Symbol]() associated with the relocation (or a nullptr). #### [` symbol `]() inline const [Symbol]( "LIEF::ELF::Symbol") \*symbol() const #### [` has_section `]() inline bool has\_section() const True if the relocation has an associated section. #### [` section `]() inline [Section]( "LIEF::ELF::Section") \*section() The section in which the relocation is applied (or a nullptr). #### [` section `]() inline const [Section]( "LIEF::ELF::Section") \*section() const #### [` symbol_table `]() inline [Section]( "LIEF::ELF::Section") \*symbol\_table() The associated symbol table (or a nullptr). #### [` symbol_table `]() inline const [Section]( "LIEF::ELF::Section") \*symbol\_table() const #### [` addend `]() inline void addend(int64\_t addend) #### [` type `]() inline void type([TYPE]( "LIEF::ELF::Relocation::TYPE") type) #### [` purpose `]() inline void purpose([PURPOSE]( "LIEF::ELF::Relocation::PURPOSE") purpose) #### [` info `]() inline void info(uint32\_t v) #### [` symbol `]() inline void symbol([Symbol]( "LIEF::ELF::Symbol") \*symbol) #### [` section `]() inline void section([Section]( "LIEF::ELF::Section") \*section) #### [` symbol_table `]() inline void symbol\_table([Section]( "LIEF::ELF::Section") \*section) #### [` resolve `]() [result]( "LIEF::result")<uint64\_t> resolve(uint64\_t base\_address = 0) const Try to resolve the value of the relocation such as `*address() = resolve()`. #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` decode_mips_n64 `]() static inline [DecodedMipsN64]( "LIEF::ELF::Relocation::DecodedMipsN64") decode\_mips\_n64(uint64\_t r\_info, [Header]( "LIEF::ELF::Header")::[ELF\_DATA]( "LIEF::ELF::Header::ELF_DATA") data) Decode `r_info` for MIPS n64. #### [` encode_mips_n64 `]() static inline uint64\_t encode\_mips\_n64([DecodedMipsN64]( "LIEF::ELF::Relocation::DecodedMipsN64") decoded, [Header]( "LIEF::ELF::Header")::[ELF\_DATA]( "LIEF::ELF::Header::ELF_DATA") data) Encode all the fields of a MIPS n64 relocation into a `r_info` value. #### [` encode_mips_n64 `]() static inline uint64\_t encode\_mips\_n64(uint32\_t type\_value, uint32\_t sym\_idx, [Header]( "LIEF::ELF::Header")::[ELF\_DATA]( "LIEF::ELF::Header::ELF_DATA") data) #### [` type_from `]() static [TYPE]( "LIEF::ELF::Relocation::TYPE") type\_from(uint32\_t value, [ARCH]( "LIEF::ELF::ARCH") arch) #### [` to_value `]() static inline uint32\_t to\_value([TYPE]( "LIEF::ELF::Relocation::TYPE") type) #### [` Tcreate `]() template<class T> static std::unique\_ptr<[Relocation]( "LIEF::ELF::Relocation")> create(const [T]( "LIEF::ELF::Relocation::create::T") &header, [PURPOSE]( "LIEF::ELF::Relocation::PURPOSE") purpose, [ENCODING]( "LIEF::ELF::Relocation::ENCODING") enc, const [Header]( "LIEF::ELF::Header") &elf\_hdr) Public Static Attributes #### [` R_BIT `]() static uint64\_t R\_BIT = 27 #### [` R_MASK `]() static uint64\_t R\_MASK = (uint64\_t(1) << [R\_BIT]( "LIEF::ELF::Relocation::R_BIT")) - 1 #### [` R_X64 `]() static uint64\_t R\_X64 = uint64\_t(1) << [R\_BIT]( "LIEF::ELF::Relocation::R_BIT") #### [` R_AARCH64 `]() static uint64\_t R\_AARCH64 = uint64\_t(2) << [R\_BIT]( "LIEF::ELF::Relocation::R_BIT") #### [` R_ARM `]() static uint64\_t R\_ARM = uint64\_t(3) << [R\_BIT]( "LIEF::ELF::Relocation::R_BIT") #### [` R_HEXAGON `]() static uint64\_t R\_HEXAGON = uint64\_t(4) << [R\_BIT]( "LIEF::ELF::Relocation::R_BIT") #### [` R_X86 `]() static uint64\_t R\_X86 = uint64\_t(5) << [R\_BIT]( "LIEF::ELF::Relocation::R_BIT") #### [` R_LARCH `]() static uint64\_t R\_LARCH = uint64\_t(6) << [R\_BIT]( "LIEF::ELF::Relocation::R_BIT") #### [` R_MIPS `]() static uint64\_t R\_MIPS = uint64\_t(7) << [R\_BIT]( "LIEF::ELF::Relocation::R_BIT") #### [` R_PPC `]() static uint64\_t R\_PPC = uint64\_t(8) << [R\_BIT]( "LIEF::ELF::Relocation::R_BIT") #### [` R_PPC64 `]() static uint64\_t R\_PPC64 = uint64\_t(9) << [R\_BIT]( "LIEF::ELF::Relocation::R_BIT") #### [` R_SPARC `]() static uint64\_t R\_SPARC = uint64\_t(10) << [R\_BIT]( "LIEF::ELF::Relocation::R_BIT") #### [` R_SYSZ `]() static uint64\_t R\_SYSZ = uint64\_t(11) << [R\_BIT]( "LIEF::ELF::Relocation::R_BIT") #### [` R_RISCV `]() static uint64\_t R\_RISCV = uint64\_t(12) << [R\_BIT]( "LIEF::ELF::Relocation::R_BIT") #### [` R_BPF `]() static uint64\_t R\_BPF = uint64\_t(13) << [R\_BIT]( "LIEF::ELF::Relocation::R_BIT") #### [` R_SH4 `]() static uint64\_t R\_SH4 = uint64\_t(14) << [R\_BIT]( "LIEF::ELF::Relocation::R_BIT") Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Relocation]( "LIEF::ELF::Relocation") &entry) #### [` DecodedMipsN64 `]() struct DecodedMipsN64 Fields decoded from the MIPS-specific n64 `r_info` layout. Public Members ##### [` type_value `]() uint32\_t type\_value = 0 Primary relocation type. ##### [` sym_idx `]() uint32\_t sym\_idx = 0 Index of the symbol associated with the relocation. ##### [` special_symbol `]() uint8\_t special\_symbol = 0 Special symbol used by the second relocation operation. ##### [` type2 `]() uint8\_t type2 = 0 Second relocation type. ##### [` type3 `]() uint8\_t type3 = 0 Third relocation type. --- ## [Symbol]() ### [` Symbol `]() class Symbol : public LIEF::[Symbol]( "LIEF::Symbol") Class which represents an ELF symbol. Public Types #### [` BINDING `]() enum class BINDING *Values:* ##### [` LOCAL `]() enumerator LOCAL = 0 Local symbol. ##### [` GLOBAL `]() enumerator GLOBAL Global symbol. ##### [` WEAK `]() enumerator WEAK Weak symbol. ##### [` GNU_UNIQUE `]() enumerator GNU\_UNIQUE = 10 Unique symbol. #### [` TYPE `]() enum class TYPE Type of the symbol. This enum matches the `STT_xxx` values of the ELF specs. *Values:* ##### [` NOTYPE `]() enumerator NOTYPE = 0 [Symbol]()’s type is not specified. ##### [` OBJECT `]() enumerator OBJECT [Symbol]() is a data object (variable, array, etc.). ##### [` FUNC `]() enumerator FUNC [Symbol]() is executable code (function, etc.). ##### [` SECTION `]() enumerator SECTION [Symbol]() refers to a section. ##### [` FILE `]() enumerator FILE Local, absolute symbol that refers to a file. ##### [` COMMON `]() enumerator COMMON An uninitialized common block. ##### [` TLS `]() enumerator TLS Thread local data object. ##### [` GNU_IFUNC `]() enumerator GNU\_IFUNC = 10 GNU indirect function. #### [` VISIBILITY `]() enum class VISIBILITY Visibility of the symbol. This enum matches the `STV_xxx` values of the official ELF specs. *Values:* ##### [` DEFAULT `]() enumerator DEFAULT = 0 Visibility is specified by binding type. ##### [` INTERNAL `]() enumerator INTERNAL Defined by processor supplements. ##### [` HIDDEN `]() enumerator HIDDEN Not visible to other components. ##### [` PROTECTED `]() enumerator PROTECTED Visible in other components but not preemptable. #### [` SECTION_INDEX `]() enum SECTION\_INDEX Special section indices. *Values:* ##### [` UNDEF `]() enumerator UNDEF = 0 Undefined section. ##### [` ABS `]() enumerator ABS = 0xfff1 Associated symbol is absolute. ##### [` COMMON `]() enumerator COMMON = 0xfff2 Associated symbol is common. Public Functions #### [` Symbol `]() inline Symbol(std::string name) #### [` Symbol `]() Symbol() = default #### [` ~Symbol `]() ~Symbol() override = default #### [` operator= `]() [Symbol]( "LIEF::ELF::Symbol") &operator=([Symbol]( "LIEF::ELF::Symbol") other) #### [` Symbol `]() Symbol(const [Symbol]( "LIEF::ELF::Symbol::Symbol") &other) #### [` swap `]() void swap([Symbol]( "LIEF::ELF::Symbol") &other) #### [` type `]() inline [TYPE]( "LIEF::ELF::Symbol::TYPE") type() const The symbol’s type provides a general classification for the associated entity. #### [` binding `]() inline [BINDING]( "LIEF::ELF::Symbol::BINDING") binding() const The symbol’s binding determines the linkage visibility and behavior. #### [` information `]() uint8\_t information() const This member specifies the symbol’s type and binding attributes. #### [` other `]() inline uint8\_t other() const Alias for [visibility()](). #### [` section_idx `]() inline uint16\_t section\_idx() const [ELF::Section]() index associated with the symbol. #### [` visibility `]() inline [VISIBILITY]( "LIEF::ELF::Symbol::VISIBILITY") visibility() const [Symbol]() visibility. #### [` section `]() inline [Section]( "LIEF::ELF::Section") \*section() [Section]() associated with the symbol or a nullptr if it does not exist. #### [` section `]() inline const [Section]( "LIEF::ELF::Section") \*section() const #### [` value `]() inline virtual uint64\_t value() const override This member has slightly different interpretations: - In relocatable files, `value` holds alignment constraints for a symbol for which section index is SHN\_COMMON - In relocatable files, `value` holds a section offset for a defined symbol. That is, `value` is an offset from the beginning of the section associated with this symbol. - In executable and shared object files, `value` holds a virtual address. To make these files’ symbols more useful for the dynamic linker, the section offset (file interpretation) gives way to a virtual address (memory interpretation) for which the section number is irrelevant. #### [` size `]() inline virtual uint64\_t size() const override [Symbol]() size. Many symbols have associated sizes. For example, a data object’s size is the number of bytes contained in the object. This member holds `0` if the symbol has no size or an unknown size. #### [` shndx `]() inline uint16\_t shndx() const > **See also** > > [Symbol::section\_idx]() #### [` has_version `]() inline bool has\_version() const Check if this symbols has a [symbol version]() . #### [` symbol_version `]() inline [SymbolVersion]( "LIEF::ELF::SymbolVersion") \*symbol\_version() Return the [SymbolVersion]() associated with this symbol. If there is no symbol version, return a nullptr. #### [` symbol_version `]() inline const [SymbolVersion]( "LIEF::ELF::SymbolVersion") \*symbol\_version() const #### [` is_local `]() inline bool is\_local() const #### [` is_global `]() inline bool is\_global() const #### [` is_weak `]() inline bool is\_weak() const #### [` demangled_name `]() std::string demangled\_name() const [Symbol]()’s unmangled name. If not available, it returns an empty string. #### [` type `]() inline void type([TYPE]( "LIEF::ELF::Symbol::TYPE") type) #### [` binding `]() inline void binding([BINDING]( "LIEF::ELF::Symbol::BINDING") binding) #### [` other `]() inline void other(uint8\_t other) #### [` visibility `]() inline void visibility([VISIBILITY]( "LIEF::ELF::Symbol::VISIBILITY") visibility) #### [` information `]() void information(uint8\_t info) #### [` shndx `]() inline void shndx(uint16\_t idx) #### [` value `]() inline virtual void value(uint64\_t value) override #### [` size `]() inline virtual void size(uint64\_t size) override #### [` is_exported `]() bool is\_exported() const Check if the current symbol is exported. #### [` set_exported `]() void set\_exported(bool flag = true) Set whether or not the symbol is exported. #### [` is_imported `]() bool is\_imported() const Check if the current symbol is imported. #### [` set_imported `]() void set\_imported(bool flag = true) Set whether or not the symbol is imported. #### [` is_static `]() inline bool is\_static() const True if the symbol is a static one. #### [` is_function `]() inline bool is\_function() const True if the symbol represents a function. #### [` is_variable `]() inline bool is\_variable() const True if the symbol represents a variable. #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` binding_from `]() static inline [BINDING]( "LIEF::ELF::Symbol::BINDING") binding\_from(uint32\_t value, [ARCH]( "LIEF::ELF::ARCH")) #### [` type_from `]() static inline [TYPE]( "LIEF::ELF::Symbol::TYPE") type\_from(uint32\_t value, [ARCH]( "LIEF::ELF::ARCH")) #### [` to_value `]() static inline uint8\_t to\_value([BINDING]( "LIEF::ELF::Symbol::BINDING") binding) #### [` to_value `]() static inline uint8\_t to\_value([TYPE]( "LIEF::ELF::Symbol::TYPE") type) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Symbol]( "LIEF::ELF::Symbol") &entry) --- ## [Symbol Version]() ### [` SymbolVersion `]() class SymbolVersion : public LIEF::Object Class which represents an entry defined in the `DT_VERSYM` dynamic entry. Public Functions #### [` SymbolVersion `]() inline SymbolVersion(uint16\_t value) #### [` SymbolVersion `]() SymbolVersion() = default #### [` ~SymbolVersion `]() ~SymbolVersion() override = default #### [` operator= `]() [SymbolVersion]( "LIEF::ELF::SymbolVersion") &operator=(const [SymbolVersion]( "LIEF::ELF::SymbolVersion")&) = default #### [` SymbolVersion `]() SymbolVersion(const [SymbolVersion]( "LIEF::ELF::SymbolVersion::SymbolVersion")&) = default #### [` value `]() inline uint16\_t value() const Value associated with the symbol. If the given [SymbolVersion]() hasn’t Auxiliary version: - `0` means **Local** - `1` means **Global** #### [` has_auxiliary_version `]() inline bool has\_auxiliary\_version() const Whether the current [SymbolVersion]() has an auxiliary one. #### [` symbol_version_auxiliary `]() inline [SymbolVersionAux]( "LIEF::ELF::SymbolVersionAux") \*symbol\_version\_auxiliary() [SymbolVersionAux]() associated with the current Version if any, or a nullptr. #### [` symbol_version_auxiliary `]() inline const [SymbolVersionAux]( "LIEF::ELF::SymbolVersionAux") \*symbol\_version\_auxiliary() const #### [` symbol_version_auxiliary `]() void symbol\_version\_auxiliary([SymbolVersionAuxRequirement]( "LIEF::ELF::SymbolVersionAuxRequirement") &svauxr) Set the version’s auxiliary requirement The given [SymbolVersionAuxRequirement]() must be an existing reference in the [ELF::Binary](). On can add a new [SymbolVersionAuxRequirement]() by using [SymbolVersionRequirement::add\_aux\_requirement]() #### [` drop_version `]() inline void drop\_version(uint16\_t value) Drop the versioning requirement and replace the value (local/global). #### [` as_global `]() inline void as\_global() Redefine this version as global by dropping its auxiliary version. > **See also** > > [as\_local()]() [drop\_version()]() #### [` as_local `]() inline void as\_local() Redefine this version as local by dropping its auxiliary version. > **See also** > > [as\_global()]() [drop\_version()]() #### [` value `]() inline void value(uint16\_t v) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` local `]() static inline [SymbolVersion]( "LIEF::ELF::SymbolVersion") local() Generate a *local* [SymbolVersion](). #### [` global `]() static inline [SymbolVersion]( "LIEF::ELF::SymbolVersion") global() Generate a *global* [SymbolVersion](). Public Static Attributes #### [` LOCAL_VERSION `]() static auto LOCAL\_VERSION = 0 #### [` GLOBAL_VERSION `]() static auto GLOBAL\_VERSION = 1 Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [SymbolVersion]( "LIEF::ELF::SymbolVersion") &symv) --- ## [Symbol Version Auxiliary]() ### [` SymbolVersionAux `]() class SymbolVersionAux : public LIEF::Object Class which represents an Auxiliary [Symbol]() version. Subclassed by [LIEF::ELF::SymbolVersionAuxRequirement]() Public Functions #### [` SymbolVersionAux `]() inline SymbolVersionAux(std::string name) #### [` SymbolVersionAux `]() SymbolVersionAux() = default #### [` ~SymbolVersionAux `]() ~SymbolVersionAux() override = default #### [` operator= `]() [SymbolVersionAux]( "LIEF::ELF::SymbolVersionAux") &operator=(const [SymbolVersionAux]( "LIEF::ELF::SymbolVersionAux")&) = default #### [` SymbolVersionAux `]() SymbolVersionAux(const [SymbolVersionAux]( "LIEF::ELF::SymbolVersionAux::SymbolVersionAux")&) = default #### [` name `]() inline std::string\_view name() const [Symbol]()’s aux name (e.g. `GLIBC_2.2.5`). #### [` name `]() inline void name(std::string name) #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [SymbolVersionAux]( "LIEF::ELF::SymbolVersionAux") &aux) --- ## [Symbol Version Definition]() ### [` SymbolVersionDefinition `]() class SymbolVersionDefinition : public LIEF::Object Class which represents an entry defined in `DT_VERDEF` or `.gnu.version_d`. Public Types #### [` version_aux_t `]() using version\_aux\_t = std::vector<std::unique\_ptr<[SymbolVersionAux]( "LIEF::ELF::SymbolVersionAux")>> #### [` it_version_aux `]() using it\_version\_aux = [ref\_iterator]( "LIEF::ref_iterator")<[version\_aux\_t]( "LIEF::ELF::SymbolVersionDefinition::version_aux_t")&, [SymbolVersionAux]( "LIEF::ELF::SymbolVersionAux")\*> #### [` it_const_version_aux `]() using it\_const\_version\_aux = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [version\_aux\_t]( "LIEF::ELF::SymbolVersionDefinition::version_aux_t")&, const [SymbolVersionAux]( "LIEF::ELF::SymbolVersionAux")\*> Public Functions #### [` SymbolVersionDefinition `]() SymbolVersionDefinition() = default #### [` SymbolVersionDefinition `]() SymbolVersionDefinition(const details::Elf64\_Verdef &header) #### [` SymbolVersionDefinition `]() SymbolVersionDefinition(const details::Elf32\_Verdef &header) #### [` ~SymbolVersionDefinition `]() ~SymbolVersionDefinition() override #### [` operator= `]() [SymbolVersionDefinition]( "LIEF::ELF::SymbolVersionDefinition") &operator=([SymbolVersionDefinition]( "LIEF::ELF::SymbolVersionDefinition") other) #### [` SymbolVersionDefinition `]() SymbolVersionDefinition(const [SymbolVersionDefinition]( "LIEF::ELF::SymbolVersionDefinition::SymbolVersionDefinition") &other) #### [` swap `]() void swap([SymbolVersionDefinition]( "LIEF::ELF::SymbolVersionDefinition") &other) #### [` version `]() inline uint16\_t version() const Version revision. This field should always have the value `1`. It will be changed if the versioning implementation has to be changed in an incompatible way. #### [` flags `]() inline uint16\_t flags() const Version information. #### [` ndx `]() inline uint16\_t ndx() const Version index. Numeric value used as an index in the [LIEF::ELF::SymbolVersion]() table #### [` hash `]() inline uint32\_t hash() const Hash value of the symbol’s name (using ELF hash function). #### [` symbols_aux `]() inline [it\_version\_aux]( "LIEF::ELF::SymbolVersionDefinition::it_version_aux") symbols\_aux() [SymbolVersionAux]() entries. #### [` symbols_aux `]() inline [it\_const\_version\_aux]( "LIEF::ELF::SymbolVersionDefinition::it_const_version_aux") symbols\_aux() const #### [` version `]() inline void version(uint16\_t version) #### [` flags `]() inline void flags(uint16\_t flags) #### [` hash `]() inline void hash(uint32\_t hash) #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [SymbolVersionDefinition]( "LIEF::ELF::SymbolVersionDefinition") &sym) --- ## [Symbol Version Requirement]() ### [` SymbolVersionRequirement `]() class SymbolVersionRequirement : public LIEF::Object Class which represents an entry in the `DT_VERNEED` or `.gnu.version_r` table. Public Types #### [` aux_requirement_t `]() using aux\_requirement\_t = std::vector<std::unique\_ptr<[SymbolVersionAuxRequirement]( "LIEF::ELF::SymbolVersionAuxRequirement")>> #### [` it_aux_requirement `]() using it\_aux\_requirement = [ref\_iterator]( "LIEF::ref_iterator")<[aux\_requirement\_t]( "LIEF::ELF::SymbolVersionRequirement::aux_requirement_t")&, [SymbolVersionAuxRequirement]( "LIEF::ELF::SymbolVersionAuxRequirement")\*> #### [` it_const_aux_requirement `]() using it\_const\_aux\_requirement = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [aux\_requirement\_t]( "LIEF::ELF::SymbolVersionRequirement::aux_requirement_t")&, const [SymbolVersionAuxRequirement]( "LIEF::ELF::SymbolVersionAuxRequirement")\*> Public Functions #### [` SymbolVersionRequirement `]() SymbolVersionRequirement() = default #### [` SymbolVersionRequirement `]() SymbolVersionRequirement(const details::Elf64\_Verneed &header) #### [` SymbolVersionRequirement `]() SymbolVersionRequirement(const details::Elf32\_Verneed &header) #### [` ~SymbolVersionRequirement `]() ~SymbolVersionRequirement() override = default #### [` operator= `]() [SymbolVersionRequirement]( "LIEF::ELF::SymbolVersionRequirement") &operator=([SymbolVersionRequirement]( "LIEF::ELF::SymbolVersionRequirement") other) #### [` SymbolVersionRequirement `]() SymbolVersionRequirement(const [SymbolVersionRequirement]( "LIEF::ELF::SymbolVersionRequirement::SymbolVersionRequirement") &other) #### [` swap `]() void swap([SymbolVersionRequirement]( "LIEF::ELF::SymbolVersionRequirement") &other) #### [` version `]() inline uint16\_t version() const Version revision. This field should always have the value `1`. It will be changed if the versioning implementation has to be changed in an incompatible way. #### [` cnt `]() inline size\_t cnt() const Number of auxiliary entries. #### [` auxiliary_symbols `]() inline [it\_aux\_requirement]( "LIEF::ELF::SymbolVersionRequirement::it_aux_requirement") auxiliary\_symbols() Auxiliary entries as an iterator over [SymbolVersionAuxRequirement](). #### [` auxiliary_symbols `]() inline [it\_const\_aux\_requirement]( "LIEF::ELF::SymbolVersionRequirement::it_const_aux_requirement") auxiliary\_symbols() const #### [` name `]() inline std::string\_view name() const Return the library name associated with this requirement (e.g. `libc.so.6`). #### [` version `]() inline void version(uint16\_t version) #### [` name `]() inline void name(const std::string &name) #### [` add_aux_requirement `]() [SymbolVersionAuxRequirement]( "LIEF::ELF::SymbolVersionAuxRequirement") &add\_aux\_requirement(const [SymbolVersionAuxRequirement]( "LIEF::ELF::SymbolVersionAuxRequirement") &aux\_requirement) Add a version auxiliary requirement to the existing list. #### [` find_aux `]() const [SymbolVersionAuxRequirement]( "LIEF::ELF::SymbolVersionAuxRequirement") \*find\_aux(const std::string &name) const Try to find the [SymbolVersionAuxRequirement]() with the given name (e.g. `GLIBC_2.27`). #### [` find_aux `]() inline [SymbolVersionAuxRequirement]( "LIEF::ELF::SymbolVersionAuxRequirement") \*find\_aux(const std::string &name) #### [` remove_aux_requirement `]() inline bool remove\_aux\_requirement(const std::string &name) Try to remove the auxiliary requirement symbol with the given name. The function returns true if the operation succeed, false otherwise. > **Warning** > > this function invalidates all the references (pointers) of [SymbolVersionAuxRequirement](). Therefore, the user is responsible to ensure that the auxiliary requirement is no longer used in the ELF binary (e.g. in [SymbolVersion]()) #### [` remove_aux_requirement `]() bool remove\_aux\_requirement([SymbolVersionAuxRequirement]( "LIEF::ELF::SymbolVersionAuxRequirement") &aux) Try to remove the given auxiliary requirement symbol. The function returns true if the operation succeed, false otherwise. > **Warning** > > this function invalidates all the references (pointers) of [SymbolVersionAuxRequirement](). Therefore, the user is responsible to ensure that the auxiliary requirement is no longer used in the ELF binary (e.g. in [SymbolVersion]()) #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [SymbolVersionRequirement]( "LIEF::ELF::SymbolVersionRequirement") &symr) --- ## [Symbol Version Auxiliary Requirement]() ### [` SymbolVersionAuxRequirement `]() class SymbolVersionAuxRequirement : public LIEF::ELF::[SymbolVersionAux]( "LIEF::ELF::SymbolVersionAux") Public Functions #### [` SymbolVersionAuxRequirement `]() SymbolVersionAuxRequirement(const details::Elf64\_Vernaux &header) #### [` SymbolVersionAuxRequirement `]() SymbolVersionAuxRequirement(const details::Elf32\_Vernaux &header) #### [` SymbolVersionAuxRequirement `]() SymbolVersionAuxRequirement() = default #### [` operator= `]() [SymbolVersionAuxRequirement]( "LIEF::ELF::SymbolVersionAuxRequirement") &operator=(const [SymbolVersionAuxRequirement]( "LIEF::ELF::SymbolVersionAuxRequirement")&) = default #### [` SymbolVersionAuxRequirement `]() SymbolVersionAuxRequirement(const [SymbolVersionAuxRequirement]( "LIEF::ELF::SymbolVersionAuxRequirement::SymbolVersionAuxRequirement")&) = default #### [` ~SymbolVersionAuxRequirement `]() ~SymbolVersionAuxRequirement() override = default #### [` hash `]() inline uint32\_t hash() const Hash value of the dependency name (use ELF hashing function). #### [` flags `]() inline uint16\_t flags() const Bitmask of flags. #### [` other `]() inline uint16\_t other() const It returns the unique version index for the file which is used in the version symbol table. If the highest bit (bit 15) is set this is a hidden symbol which cannot be referenced from outside the object. #### [` hash `]() inline void hash(uint32\_t hash) #### [` flags `]() inline void flags(uint16\_t flags) #### [` other `]() inline void other(uint16\_t other) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` name `]() inline std::string\_view name() const [Symbol]()’s aux name (e.g. `GLIBC_2.2.5`). #### [` name `]() inline void name(std::string name) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [SymbolVersionAuxRequirement]( "LIEF::ELF::SymbolVersionAuxRequirement") &aux) --- ## [GNU Hash table]() ### [` GnuHash `]() class GnuHash : public LIEF::Object Class which provides a view over the GNU Hash implementation. Most of the fields are read-only since the values are re-computed by the [LIEF::ELF::Builder](). Public Functions #### [` GnuHash `]() GnuHash() = default #### [` GnuHash `]() inline GnuHash(uint32\_t symbol\_idx, uint32\_t shift2, std::vector<uint64\_t> bloom\_filters, std::vector<uint32\_t> buckets, std::vector<uint32\_t> hash\_values = {}) #### [` operator= `]() [GnuHash]( "LIEF::ELF::GnuHash") &operator=(const [GnuHash]( "LIEF::ELF::GnuHash") &copy) = default #### [` GnuHash `]() GnuHash(const [GnuHash]( "LIEF::ELF::GnuHash::GnuHash") &copy) = default #### [` GnuHash `]() GnuHash([GnuHash]( "LIEF::ELF::GnuHash::GnuHash")&&) = default #### [` operator= `]() [GnuHash]( "LIEF::ELF::GnuHash") &operator=([GnuHash]( "LIEF::ELF::GnuHash")&&) = default #### [` ~GnuHash `]() ~GnuHash() override = default #### [` nb_buckets `]() inline uint32\_t nb\_buckets() const Return the number of buckets. > **See also** > > [GnuHash::buckets]() #### [` symbol_index `]() inline uint32\_t symbol\_index() const Index of the first symbol in the dynamic symbols table which is accessible with the hash table. #### [` shift2 `]() inline uint32\_t shift2() const Shift count used in the bloom filter. #### [` maskwords `]() inline uint32\_t maskwords() const Number of bloom filters used. It must be a power of 2. #### [` bloom_filters `]() inline const std::vector<uint64\_t> &bloom\_filters() const Bloom filters. #### [` buckets `]() inline const std::vector<uint32\_t> &buckets() const Hash buckets. #### [` hash_values `]() inline const std::vector<uint32\_t> &hash\_values() const Hash values. #### [` check_bloom_filter `]() bool check\_bloom\_filter(uint32\_t hash) const Check if the given hash passes the bloom filter. #### [` check_bucket `]() inline bool check\_bucket(uint32\_t hash) const Check if the given hash passes the bucket filter. #### [` check `]() bool check(const std::string &symbol\_name) const Check if the symbol *probably* exists. If the returned value is `false` you can assume at `100%` that the symbol with the given name doesn’t exist. If `true`, you can’t do any assumption. #### [` check `]() bool check(uint32\_t hash) const Check if the symbol associated with the given hash *probably* exists. If the returned value is `false` you can assume at `100%` that the symbol doesn’t exist. If `true` you can’t do any assumption. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` original_size `]() inline uint64\_t original\_size() const Public Static Functions #### [` ELF_Tparse `]() template<class ELF\_T> static std::unique\_ptr<[GnuHash]( "LIEF::ELF::GnuHash")> parse([SpanStream]( "LIEF::SpanStream") &strm, uint64\_t dynsymcount) #### [` ELF_Tnb_symbols `]() template<class ELF\_T> static [result]( "LIEF::result")<uint32\_t> nb\_symbols([SpanStream]( "LIEF::SpanStream") &strm) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [GnuHash]( "LIEF::ELF::GnuHash") &gnuhash) --- ## [SYSV Hash table]() ### [` SysvHash `]() class SysvHash : public LIEF::Object Class which represents the SYSV hash for the symbols resolution. References: - [http://www.linker-aliens.org/blogs/ali/entry/gnu\_hash\_elf\_sections/]() - [https://docs.oracle.com/cd/E23824\_01/html/819-0690/chapter6-48031.html]() Public Functions #### [` SysvHash `]() SysvHash() = default #### [` operator= `]() [SysvHash]( "LIEF::ELF::SysvHash") &operator=(const [SysvHash]( "LIEF::ELF::SysvHash") &copy) = default #### [` SysvHash `]() SysvHash(const [SysvHash]( "LIEF::ELF::SysvHash::SysvHash") &copy) = default #### [` operator= `]() [SysvHash]( "LIEF::ELF::SysvHash") &operator=([SysvHash]( "LIEF::ELF::SysvHash")&&) = default #### [` SysvHash `]() SysvHash([SysvHash]( "LIEF::ELF::SysvHash::SysvHash")&&) = default #### [` ~SysvHash `]() ~SysvHash() override = default #### [` nbucket `]() inline uint32\_t nbucket() const Return the number of buckets used. #### [` nchain `]() inline uint32\_t nchain() const Return the number of chain used. #### [` buckets `]() inline const std::vector<uint32\_t> &buckets() const Buckets values. #### [` chains `]() inline const std::vector<uint32\_t> &chains() const Chains values. #### [` nchain `]() inline void nchain(uint32\_t nb) #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [SysvHash]( "LIEF::ELF::SysvHash") &sysvhash) --- ## [Note]() ### [` Note `]() class Note : public LIEF::Object Class which represents an ELF note. This class can be instantiated using the static [Note::create]() functions. Subclassed by [LIEF::ELF::AndroidIdent](), [LIEF::ELF::CoreAuxv](), [LIEF::ELF::CoreFile](), [LIEF::ELF::CorePrPsInfo](), [LIEF::ELF::CorePrStatus](), [LIEF::ELF::CoreSigInfo](), [LIEF::ELF::NoteAbi](), [LIEF::ELF::NoteGnuProperty](), [LIEF::ELF::QNXStack]() Public Types #### [` TYPE `]() enum class TYPE LIEF representation of the ELF `NT_` values. *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` GNU_ABI_TAG `]() enumerator GNU\_ABI\_TAG Match `NT_GNU_ABI_TAG`: Operating system (OS) ABI information. See: [NoteAbi]() ##### [` GNU_HWCAP `]() enumerator GNU\_HWCAP Match `NT_HWCAP`: Synthetic hardware capabilities information. ##### [` GNU_BUILD_ID `]() enumerator GNU\_BUILD\_ID Match `NT_GNU_BUILD_ID`: Unique build ID as generated by the GNU ld. ##### [` GNU_GOLD_VERSION `]() enumerator GNU\_GOLD\_VERSION Match `NT_GNU_GOLD_VERSION`: The version of gold used to link. ##### [` GNU_PROPERTY_TYPE_0 `]() enumerator GNU\_PROPERTY\_TYPE\_0 Match `NT_GNU_PROPERTY_TYPE_0`: Program property note, as described in “Linux Extensions to the gABI”. ##### [` GNU_BUILD_ATTRIBUTE_OPEN `]() enumerator GNU\_BUILD\_ATTRIBUTE\_OPEN ##### [` GNU_BUILD_ATTRIBUTE_FUNC `]() enumerator GNU\_BUILD\_ATTRIBUTE\_FUNC ##### [` CRASHPAD `]() enumerator CRASHPAD Crashpad note used by the Chromium project. ##### [` CORE_PRSTATUS `]() enumerator CORE\_PRSTATUS Coredump that wraps the `elf_prstatus` structure. ##### [` CORE_FPREGSET `]() enumerator CORE\_FPREGSET ##### [` CORE_PRPSINFO `]() enumerator CORE\_PRPSINFO Coredump that wraps the `elf_prpsinfo` structure. See: [CorePrPsInfo]() ##### [` CORE_TASKSTRUCT `]() enumerator CORE\_TASKSTRUCT ##### [` CORE_AUXV `]() enumerator CORE\_AUXV Coredump that contains a copy of all the auxiliary vectors (auxv). See: [CoreAuxv]() ##### [` CORE_PSTATUS `]() enumerator CORE\_PSTATUS ##### [` CORE_FPREGS `]() enumerator CORE\_FPREGS Coredump that wraps the `fpregset` structure. ##### [` CORE_PSINFO `]() enumerator CORE\_PSINFO Coredump that wraps the `psinfo` structure. ##### [` CORE_LWPSTATUS `]() enumerator CORE\_LWPSTATUS ##### [` CORE_LWPSINFO `]() enumerator CORE\_LWPSINFO ##### [` CORE_WIN32PSTATUS `]() enumerator CORE\_WIN32PSTATUS ##### [` CORE_FILE `]() enumerator CORE\_FILE ##### [` CORE_PRXFPREG `]() enumerator CORE\_PRXFPREG ##### [` CORE_SIGINFO `]() enumerator CORE\_SIGINFO ##### [` CORE_ARM_VFP `]() enumerator CORE\_ARM\_VFP ##### [` CORE_ARM_TLS `]() enumerator CORE\_ARM\_TLS ##### [` CORE_ARM_HW_BREAK `]() enumerator CORE\_ARM\_HW\_BREAK ##### [` CORE_ARM_HW_WATCH `]() enumerator CORE\_ARM\_HW\_WATCH ##### [` CORE_ARM_SYSTEM_CALL `]() enumerator CORE\_ARM\_SYSTEM\_CALL ##### [` CORE_ARM_SVE `]() enumerator CORE\_ARM\_SVE ##### [` CORE_ARM_PAC_MASK `]() enumerator CORE\_ARM\_PAC\_MASK ##### [` CORE_ARM_PACA_KEYS `]() enumerator CORE\_ARM\_PACA\_KEYS ##### [` CORE_ARM_PACG_KEYS `]() enumerator CORE\_ARM\_PACG\_KEYS ##### [` CORE_TAGGED_ADDR_CTRL `]() enumerator CORE\_TAGGED\_ADDR\_CTRL ##### [` CORE_PAC_ENABLED_KEYS `]() enumerator CORE\_PAC\_ENABLED\_KEYS ##### [` CORE_X86_TLS `]() enumerator CORE\_X86\_TLS ##### [` CORE_X86_IOPERM `]() enumerator CORE\_X86\_IOPERM ##### [` CORE_X86_XSTATE `]() enumerator CORE\_X86\_XSTATE ##### [` CORE_X86_CET `]() enumerator CORE\_X86\_CET ##### [` ANDROID_IDENT `]() enumerator ANDROID\_IDENT [Note]() that is specific to Android and that describes information such as the NDK version or the SDK build number. See [AndroidIdent]() ##### [` ANDROID_MEMTAG `]() enumerator ANDROID\_MEMTAG ##### [` ANDROID_KUSER `]() enumerator ANDROID\_KUSER ##### [` GO_BUILDID `]() enumerator GO\_BUILDID [Note]() specific to Go binaries. ##### [` STAPSDT `]() enumerator STAPSDT [Note]() for SystemTap probes. ##### [` QNX_STACK `]() enumerator QNX\_STACK QNX [Note](). #### [` description_t `]() using description\_t = std::vector<uint8\_t> Container used to handle the description data. Public Functions #### [` operator= `]() [Note]( "LIEF::ELF::Note") &operator=(const [Note]( "LIEF::ELF::Note") &copy) = default #### [` Note `]() Note(const [Note]( "LIEF::ELF::Note::Note") &copy) = default #### [` ~Note `]() ~Note() override = default #### [` clone `]() inline virtual std::unique\_ptr<[Note]( "LIEF::ELF::Note")> clone() const Clone the current note and keep its polymorphic type. #### [` name `]() inline std::string\_view name() const Return the *name* of the note (also known as ‘owner’ ). #### [` section_name `]() inline std::string\_view section\_name() const Return the section name in which the note is or should be stored. #### [` type `]() inline [TYPE]( "LIEF::ELF::Note::TYPE") type() const Return the type of the note. This type does not match the `NT_` type value. For accessing the original `NT_` value, check [original\_type()](). #### [` original_type `]() inline uint32\_t original\_type() const The original `NT_xxx` integer value. The meaning of this value likely depends on the owner of the note. #### [` description `]() inline span<const uint8\_t> description() const Return the description associated with the note. #### [` description `]() inline span<uint8\_t> description() #### [` name `]() inline void name(std::string name) #### [` description `]() inline void description([description\_t]( "LIEF::ELF::Note::description_t") description) Change the description of the note. #### [` size `]() uint64\_t size() const Size of the **raw** note which includes padding. #### [` dump `]() virtual void dump(std::ostream &os) const #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` Tcast `]() template<class T> inline const [T]( "LIEF::ELF::Note::cast::T") \*cast() const #### [` Tcast `]() template<class T> inline [T]( "LIEF::ELF::Note::cast::T") \*cast() Public Static Functions #### [` convert_type `]() static [result]( "LIEF::result")<[TYPE]( "LIEF::ELF::Note::TYPE")> convert\_type([Header]( "LIEF::ELF::Header")::[FILE\_TYPE]( "LIEF::ELF::Header::FILE_TYPE") ftype, uint32\_t type, const std::string &name) Convert the raw integer note type into a [TYPE]() according to the owner. #### [` type_to_section `]() static [result]( "LIEF::result")<const char\*> type\_to\_section([TYPE]( "LIEF::ELF::Note::TYPE") type) Try to determine the ELF section name associated with the [TYPE]() provided in parameter. #### [` note_to_section `]() static inline [result]( "LIEF::result")<std::string> note\_to\_section(const [Note]( "LIEF::ELF::Note") &note) #### [` type_owner `]() static [result]( "LIEF::result")<const char\*> type\_owner([TYPE]( "LIEF::ELF::Note::TYPE") type) Try to determine the owner’s name of the [TYPE]() provided in parameter. #### [` create `]() static std::unique\_ptr<[Note]( "LIEF::ELF::Note")> create(const std::string &name, uint32\_t type, [description\_t]( "LIEF::ELF::Note::description_t") description, std::string section\_name, [Header]( "LIEF::ELF::Header")::[FILE\_TYPE]( "LIEF::ELF::Header::FILE_TYPE") ftype = [Header]( "LIEF::ELF::Header")::[FILE\_TYPE]( "LIEF::ELF::Header::FILE_TYPE")::[NONE]( "LIEF::ELF::Header::FILE_TYPE::NONE"), [ARCH]( "LIEF::ELF::ARCH") arch = [ARCH]( "LIEF::ELF::ARCH")::[NONE]( "LIEF::ELF::ARCH::NONE"), [Header]( "LIEF::ELF::Header")::[CLASS]( "LIEF::ELF::Header::CLASS") cls = [Header]( "LIEF::ELF::Header")::[CLASS]( "LIEF::ELF::Header::CLASS")::[NONE]( "LIEF::ELF::Header::CLASS::NONE")) Create a new note from the given parameters. Additional information such as the architecture or the ELF class could be required for creating notes like Coredump notes. #### [` create `]() static std::unique\_ptr<[Note]( "LIEF::ELF::Note")> create(const std::string &name, [TYPE]( "LIEF::ELF::Note::TYPE") type, [description\_t]( "LIEF::ELF::Note::description_t") description, std::string section\_name, [ARCH]( "LIEF::ELF::ARCH") arch = [ARCH]( "LIEF::ELF::ARCH")::[NONE]( "LIEF::ELF::ARCH::NONE"), [Header]( "LIEF::ELF::Header")::[CLASS]( "LIEF::ELF::Header::CLASS") cls = [Header]( "LIEF::ELF::Header")::[CLASS]( "LIEF::ELF::Header::CLASS")::[NONE]( "LIEF::ELF::Header::CLASS::NONE")) Create a new note from the given parameters. Additional information such as the architecture or the ELF class could be required for creating notes like Coredump notes. #### [` create `]() static std::unique\_ptr<[Note]( "LIEF::ELF::Note")> create([BinaryStream]( "LIEF::BinaryStream") &stream, std::string section\_name, [Header]( "LIEF::ELF::Header")::[FILE\_TYPE]( "LIEF::ELF::Header::FILE_TYPE") ftype = [Header]( "LIEF::ELF::Header")::[FILE\_TYPE]( "LIEF::ELF::Header::FILE_TYPE")::[NONE]( "LIEF::ELF::Header::FILE_TYPE::NONE"), [ARCH]( "LIEF::ELF::ARCH") arch = [ARCH]( "LIEF::ELF::ARCH")::[NONE]( "LIEF::ELF::ARCH::NONE"), [Header]( "LIEF::ELF::Header")::[CLASS]( "LIEF::ELF::Header::CLASS") cls = [Header]( "LIEF::ELF::Header")::[CLASS]( "LIEF::ELF::Header::CLASS")::[NONE]( "LIEF::ELF::Header::CLASS::NONE")) Create a new note from the given stream. Additional information such as the architecture or the ELF class could be required for creating notes like Coredump notes. Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Note]( "LIEF::ELF::Note") &note) --- ## [Core PrPsInfo]() ### [` CorePrPsInfo `]() class CorePrPsInfo : public LIEF::ELF::[Note]( "LIEF::ELF::Note") Class representing the NT\_PRPSINFO core note. This kind of note represents general information about the process. Public Functions #### [` CorePrPsInfo `]() inline CorePrPsInfo([ARCH]( "LIEF::ELF::ARCH") arch, [Header]( "LIEF::ELF::Header")::[CLASS]( "LIEF::ELF::Header::CLASS") cls, std::string name, uint32\_t type, description\_t description) #### [` clone `]() inline virtual std::unique\_ptr<[Note]( "LIEF::ELF::Note")> clone() const override Clone the current note and keep its polymorphic type. #### [` info `]() [result]( "LIEF::result")<[info\_t]( "LIEF::ELF::CorePrPsInfo::info_t")> info() const Return a `elf_prpsinfo`-like structure or an error if it can’t be parsed. #### [` info `]() void info(const [info\_t]( "LIEF::ELF::CorePrPsInfo::info_t") &info) #### [` dump `]() virtual void dump(std::ostream &os) const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~CorePrPsInfo `]() ~CorePrPsInfo() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Note]( "LIEF::ELF::Note") \*note) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [CorePrPsInfo]( "LIEF::ELF::CorePrPsInfo") &note) #### [` info_t `]() struct info\_t Public Functions ##### [` filename_stripped `]() inline std::string filename\_stripped() const Return the filename without the ending `\x00`. ##### [` args_stripped `]() inline std::string args\_stripped() const Return the args without the ending `\x00`. Public Members ##### [` state `]() uint8\_t state = 0 Numeric process state. ##### [` sname `]() char sname = ' ' Printable character representing state. ##### [` zombie `]() bool zombie = false Whether the process is a zombie. ##### [` nice `]() uint8\_t nice = 0 Nice value. ##### [` flag `]() uint64\_t flag = 0 Process flag. ##### [` uid `]() uint32\_t uid = 0 Process user ID. ##### [` gid `]() uint32\_t gid = 0 Process group ID. ##### [` pid `]() uint32\_t pid = 0 Process ID. ##### [` ppid `]() uint32\_t ppid = 0 Process parent ID. ##### [` pgrp `]() uint32\_t pgrp = 0 Process group. ##### [` sid `]() uint32\_t sid = 0 Process session ID. ##### [` filename `]() std::string filename Filename of the executable. ##### [` args `]() std::string args Initial part of the arguments. --- ## [Core File]() ### [` CoreFile `]() class CoreFile : public LIEF::ELF::[Note]( "LIEF::ELF::Note") Class representing a core `NT_FILE` which describes the mapped files of the process. Public Types #### [` files_t `]() using files\_t = std::vector<[entry\_t]( "LIEF::ELF::CoreFile::entry_t")> #### [` iterator `]() using iterator = [files\_t]( "LIEF::ELF::CoreFile::files_t")::iterator #### [` const_iterator `]() using const\_iterator = [files\_t]( "LIEF::ELF::CoreFile::files_t")::const\_iterator Public Functions #### [` CoreFile `]() CoreFile([ARCH]( "LIEF::ELF::ARCH") arch, [Header]( "LIEF::ELF::Header")::[CLASS]( "LIEF::ELF::Header::CLASS") cls, std::string name, uint32\_t type, [Note]( "LIEF::ELF::Note")::[description\_t]( "LIEF::ELF::Note::description_t") description) #### [` clone `]() inline virtual std::unique\_ptr<[Note]( "LIEF::ELF::Note")> clone() const override Clone the current note and keep its polymorphic type. #### [` count `]() inline uint64\_t count() const Number of coredump file entries. #### [` files `]() inline const [files\_t]( "LIEF::ELF::CoreFile::files_t") &files() const Coredump file entries. #### [` begin `]() inline [iterator]( "LIEF::ELF::CoreFile::iterator") begin() #### [` end `]() inline [iterator]( "LIEF::ELF::CoreFile::iterator") end() #### [` begin `]() inline [const\_iterator]( "LIEF::ELF::CoreFile::const_iterator") begin() const #### [` end `]() inline [const\_iterator]( "LIEF::ELF::CoreFile::const_iterator") end() const #### [` files `]() void files(const [files\_t]( "LIEF::ELF::CoreFile::files_t") &file) #### [` dump `]() virtual void dump(std::ostream &os) const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~CoreFile `]() ~CoreFile() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Note]( "LIEF::ELF::Note") \*note) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [CoreFile]( "LIEF::ELF::CoreFile") &note) #### [` entry_t `]() struct entry\_t Core file entry. Public Members ##### [` start `]() uint64\_t start = 0 Start address of mapped file. ##### [` end `]() uint64\_t end = 0 End address of mapped file. ##### [` file_ofs `]() uint64\_t file\_ofs = 0 Offset (in core) of mapped file. ##### [` path `]() std::string path Path of mapped file. Friends ##### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [entry\_t]( "LIEF::ELF::CoreFile::entry_t") &entry) --- ## [Core PrStatus]() ### [` CorePrStatus `]() class CorePrStatus : public LIEF::ELF::[Note]( "LIEF::ELF::Note") Class representing core PrPsInfo object. Public Functions #### [` CorePrStatus `]() inline CorePrStatus([ARCH]( "LIEF::ELF::ARCH") arch, [Header]( "LIEF::ELF::Header")::[CLASS]( "LIEF::ELF::Header::CLASS") cls, std::string name, uint32\_t type, description\_t description) #### [` clone `]() inline virtual std::unique\_ptr<[Note]( "LIEF::ELF::Note")> clone() const override Clone the current note and keep its polymorphic type. #### [` status `]() [pr\_status\_t]( "LIEF::ELF::CorePrStatus::pr_status_t") status() const Return the [pr\_status\_t]() structure. #### [` status `]() void status(const [pr\_status\_t]( "LIEF::ELF::CorePrStatus::pr_status_t") &status) #### [` architecture `]() inline [ARCH]( "LIEF::ELF::ARCH") architecture() const #### [` pc `]() [result]( "LIEF::result")<uint64\_t> pc() const The program counter or an error if not found. #### [` sp `]() [result]( "LIEF::result")<uint64\_t> sp() const The stack pointer or an error if not found. #### [` return_value `]() [result]( "LIEF::result")<uint64\_t> return\_value() const The value of the register that holds the return value according to the calling convention. #### [` get `]() [result]( "LIEF::result")<uint64\_t> get([Registers]( "LIEF::ELF::CorePrStatus::Registers")::[X86]( "LIEF::ELF::CorePrStatus::Registers::X86") reg) const Get the value for the given X86 register or return an error. #### [` get `]() [result]( "LIEF::result")<uint64\_t> get([Registers]( "LIEF::ELF::CorePrStatus::Registers")::[X86\_64]( "LIEF::ELF::CorePrStatus::Registers::X86_64") reg) const Get the value for the given X86\_64 register or return an error. #### [` get `]() [result]( "LIEF::result")<uint64\_t> get([Registers]( "LIEF::ELF::CorePrStatus::Registers")::[ARM]( "LIEF::ELF::CorePrStatus::Registers::ARM") reg) const Get the value for the given ARM register or return an error. #### [` get `]() [result]( "LIEF::result")<uint64\_t> get([Registers]( "LIEF::ELF::CorePrStatus::Registers")::[AARCH64]( "LIEF::ELF::CorePrStatus::Registers::AARCH64") reg) const Get the value for the given AARCH64 register or return an error. #### [` set `]() [ok\_error\_t]( "LIEF::ok_error_t") set([Registers]( "LIEF::ELF::CorePrStatus::Registers")::[X86]( "LIEF::ELF::CorePrStatus::Registers::X86") reg, uint64\_t value) #### [` set `]() [ok\_error\_t]( "LIEF::ok_error_t") set([Registers]( "LIEF::ELF::CorePrStatus::Registers")::[X86\_64]( "LIEF::ELF::CorePrStatus::Registers::X86_64") reg, uint64\_t value) #### [` set `]() [ok\_error\_t]( "LIEF::ok_error_t") set([Registers]( "LIEF::ELF::CorePrStatus::Registers")::[ARM]( "LIEF::ELF::CorePrStatus::Registers::ARM") reg, uint64\_t value) #### [` set `]() [ok\_error\_t]( "LIEF::ok_error_t") set([Registers]( "LIEF::ELF::CorePrStatus::Registers")::[AARCH64]( "LIEF::ELF::CorePrStatus::Registers::AARCH64") reg, uint64\_t value) #### [` register_values `]() std::vector<uint64\_t> register\_values() const A list of the register values. This list is **guarantee** to be as long as the [Registers::ARM::\_COUNT]() or empty if it can’t be resolved. Thus, one can access a specific register with: ```cpp if (architecture() == ARCH::AARCH64) { auto reg_vals = register_values() if (!reg_vals.empty()) { auto x20 = reg_vals[static_cast(Register::AARCH64::X20)] } } ``` #### [` operator[] `]() inline [result]( "LIEF::result")<uint64\_t> operator[]([Registers]( "LIEF::ELF::CorePrStatus::Registers")::[X86]( "LIEF::ELF::CorePrStatus::Registers::X86") reg) const #### [` operator[] `]() inline [result]( "LIEF::result")<uint64\_t> operator[]([Registers]( "LIEF::ELF::CorePrStatus::Registers")::[X86\_64]( "LIEF::ELF::CorePrStatus::Registers::X86_64") reg) const #### [` operator[] `]() inline [result]( "LIEF::result")<uint64\_t> operator[]([Registers]( "LIEF::ELF::CorePrStatus::Registers")::[ARM]( "LIEF::ELF::CorePrStatus::Registers::ARM") reg) const #### [` operator[] `]() inline [result]( "LIEF::result")<uint64\_t> operator[]([Registers]( "LIEF::ELF::CorePrStatus::Registers")::[AARCH64]( "LIEF::ELF::CorePrStatus::Registers::AARCH64") reg) const #### [` dump `]() virtual void dump(std::ostream &os) const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~CorePrStatus `]() ~CorePrStatus() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Note]( "LIEF::ELF::Note") \*note) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [CorePrStatus]( "LIEF::ELF::CorePrStatus") &note) #### [` siginfo_t `]() struct siginfo\_t Public Members ##### [` signo `]() int32\_t signo = 0 ##### [` code `]() int32\_t code = 0 ##### [` err `]() int32\_t err = 0 #### [` timeval_t `]() struct timeval\_t Public Members ##### [` sec `]() uint64\_t sec = 0 ##### [` usec `]() uint64\_t usec = 0 #### [` pr_status_t `]() struct pr\_status\_t Status information from a core dump. This structure mirrors the kernel’s `prstatus` data embedded in `NT_PRSTATUS` core-dump notes and exposes signal state, process identifiers, and CPU-time accounting. Public Members ##### [` info `]() [siginfo\_t]( "LIEF::ELF::CorePrStatus::siginfo_t") info ##### [` cursig `]() uint16\_t cursig = 0 ##### [` reserved `]() uint16\_t reserved = 0 ##### [` sigpend `]() uint64\_t sigpend = 0 ##### [` sighold `]() uint64\_t sighold = 0 ##### [` pid `]() int32\_t pid = 0 ##### [` ppid `]() int32\_t ppid = 0 ##### [` pgrp `]() int32\_t pgrp = 0 ##### [` sid `]() int32\_t sid = 0 ##### [` utime `]() [timeval\_t]( "LIEF::ELF::CorePrStatus::timeval_t") utime ##### [` stime `]() [timeval\_t]( "LIEF::ELF::CorePrStatus::timeval_t") stime ##### [` cutime `]() [timeval\_t]( "LIEF::ELF::CorePrStatus::timeval_t") cutime ##### [` cstime `]() [timeval\_t]( "LIEF::ELF::CorePrStatus::timeval_t") cstime #### [` Registers `]() struct Registers Public Types ##### [` X86 `]() enum class X86 Register for the x86 architecture ([ARCH::I386]()). *Values:* ###### [` EBX `]() enumerator EBX = 0 ###### [` ECX `]() enumerator ECX ###### [` EDX `]() enumerator EDX ###### [` ESI `]() enumerator ESI ###### [` EDI `]() enumerator EDI ###### [` EBP `]() enumerator EBP ###### [` EAX `]() enumerator EAX ###### [` DS `]() enumerator DS ###### [` ES `]() enumerator ES ###### [` FS `]() enumerator FS ###### [` GS `]() enumerator GS ###### [` ORIG_EAX `]() enumerator ORIG\_EAX ###### [` EIP `]() enumerator EIP ###### [` CS `]() enumerator CS ###### [` EFLAGS `]() enumerator EFLAGS ###### [` ESP `]() enumerator ESP ###### [` SS `]() enumerator SS ###### [` _COUNT `]() enumerator \_COUNT ##### [` X86_64 `]() enum class X86\_64 Register for the x86-64 architecture ([ARCH::X86\_64]()). *Values:* ###### [` R15 `]() enumerator R15 = 0 ###### [` R14 `]() enumerator R14 ###### [` R13 `]() enumerator R13 ###### [` R12 `]() enumerator R12 ###### [` RBP `]() enumerator RBP ###### [` RBX `]() enumerator RBX ###### [` R11 `]() enumerator R11 ###### [` R10 `]() enumerator R10 ###### [` R9 `]() enumerator R9 ###### [` R8 `]() enumerator R8 ###### [` RAX `]() enumerator RAX ###### [` RCX `]() enumerator RCX ###### [` RDX `]() enumerator RDX ###### [` RSI `]() enumerator RSI ###### [` RDI `]() enumerator RDI ###### [` ORIG_RAX `]() enumerator ORIG\_RAX ###### [` RIP `]() enumerator RIP ###### [` CS `]() enumerator CS ###### [` EFLAGS `]() enumerator EFLAGS ###### [` RSP `]() enumerator RSP ###### [` SS `]() enumerator SS ###### [` FS_BASE `]() enumerator FS\_BASE ###### [` GS_BASE `]() enumerator GS\_BASE ###### [` DS `]() enumerator DS ###### [` ES `]() enumerator ES ###### [` _COUNT `]() enumerator \_COUNT ##### [` ARM `]() enum class ARM Register for the [ARM]() architecture ([ARCH::ARM]()). *Values:* ###### [` R0 `]() enumerator R0 = 0 ###### [` R1 `]() enumerator R1 ###### [` R2 `]() enumerator R2 ###### [` R3 `]() enumerator R3 ###### [` R4 `]() enumerator R4 ###### [` R5 `]() enumerator R5 ###### [` R6 `]() enumerator R6 ###### [` R7 `]() enumerator R7 ###### [` R8 `]() enumerator R8 ###### [` R9 `]() enumerator R9 ###### [` R10 `]() enumerator R10 ###### [` R11 `]() enumerator R11 ###### [` R12 `]() enumerator R12 ###### [` R13 `]() enumerator R13 ###### [` R14 `]() enumerator R14 ###### [` R15 `]() enumerator R15 ###### [` CPSR `]() enumerator CPSR ###### [` _COUNT `]() enumerator \_COUNT ##### [` AARCH64 `]() enum class AARCH64 Register for the [AARCH64]() architecture ([ARCH::AARCH64]()). *Values:* ###### [` X0 `]() enumerator X0 = 0 ###### [` X1 `]() enumerator X1 ###### [` X2 `]() enumerator X2 ###### [` X3 `]() enumerator X3 ###### [` X4 `]() enumerator X4 ###### [` X5 `]() enumerator X5 ###### [` X6 `]() enumerator X6 ###### [` X7 `]() enumerator X7 ###### [` X8 `]() enumerator X8 ###### [` X9 `]() enumerator X9 ###### [` X10 `]() enumerator X10 ###### [` X11 `]() enumerator X11 ###### [` X12 `]() enumerator X12 ###### [` X13 `]() enumerator X13 ###### [` X14 `]() enumerator X14 ###### [` X15 `]() enumerator X15 ###### [` X16 `]() enumerator X16 ###### [` X17 `]() enumerator X17 ###### [` X18 `]() enumerator X18 ###### [` X19 `]() enumerator X19 ###### [` X20 `]() enumerator X20 ###### [` X21 `]() enumerator X21 ###### [` X22 `]() enumerator X22 ###### [` X23 `]() enumerator X23 ###### [` X24 `]() enumerator X24 ###### [` X25 `]() enumerator X25 ###### [` X26 `]() enumerator X26 ###### [` X27 `]() enumerator X27 ###### [` X28 `]() enumerator X28 ###### [` X29 `]() enumerator X29 ###### [` X30 `]() enumerator X30 ###### [` X31 `]() enumerator X31 ###### [` PC `]() enumerator PC ###### [` PSTATE `]() enumerator PSTATE ###### [` _COUNT `]() enumerator \_COUNT --- ## [Core Siginfo]() ### [` CoreSigInfo `]() class CoreSigInfo : public LIEF::ELF::[Note]( "LIEF::ELF::Note") Class representing a core siginfo object. Public Functions #### [` clone `]() inline virtual std::unique\_ptr<[Note]( "LIEF::ELF::Note")> clone() const override Clone the current note and keep its polymorphic type. #### [` signo `]() [result]( "LIEF::result")<int32\_t> signo() const Signal number or an error if it can’t be resolved. #### [` sigcode `]() [result]( "LIEF::result")<int32\_t> sigcode() const Signal code or an error if it can’t be resolved. #### [` sigerrno `]() [result]( "LIEF::result")<int32\_t> sigerrno() const Signal error number or an error if it can’t be resolved. #### [` signo `]() void signo(uint32\_t value) #### [` sigcode `]() void sigcode(uint32\_t value) #### [` sigerrno `]() void sigerrno(uint32\_t value) #### [` dump `]() virtual void dump(std::ostream &os) const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~CoreSigInfo `]() ~CoreSigInfo() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Note]( "LIEF::ELF::Note") \*note) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [CoreSigInfo]( "LIEF::ELF::CoreSigInfo") &note) --- ## [Core Auxiliary Vector]() ### [` CoreAuxv `]() class CoreAuxv : public LIEF::ELF::[Note]( "LIEF::ELF::Note") Class representing core auxv object. Public Types #### [` TYPE `]() enum class TYPE *Values:* ##### [` END `]() enumerator END = 0 End of vector ##### [` IGNORE_TY `]() enumerator IGNORE\_TY Entry should be ignored ##### [` EXECFD `]() enumerator EXECFD File descriptor of program ##### [` PHDR `]() enumerator PHDR Program headers for program ##### [` PHENT `]() enumerator PHENT Size of program header entry ##### [` PHNUM `]() enumerator PHNUM Number of program headers ##### [` PAGESZ `]() enumerator PAGESZ System page size ##### [` BASE `]() enumerator BASE Base address of interpreter ##### [` FLAGS `]() enumerator FLAGS Flags ##### [` ENTRY `]() enumerator ENTRY Entry point of program ##### [` NOTELF `]() enumerator NOTELF Program is not ELF ##### [` UID `]() enumerator UID Real uid ##### [` EUID `]() enumerator EUID Effective uid ##### [` GID `]() enumerator GID Real gid ##### [` EGID `]() enumerator EGID Effective gid ##### [` TGT_PLATFORM `]() enumerator TGT\_PLATFORM String identifying platform. ##### [` HWCAP `]() enumerator HWCAP Machine dependent hints about processor capabilities. ##### [` CLKTCK `]() enumerator CLKTCK Frequency of times() ##### [` FPUCW `]() enumerator FPUCW Used FPU control word. ##### [` DCACHEBSIZE `]() enumerator DCACHEBSIZE Data cache block size. ##### [` ICACHEBSIZE `]() enumerator ICACHEBSIZE Instruction cache block size. ##### [` UCACHEBSIZE `]() enumerator UCACHEBSIZE Unified cache block size. ##### [` IGNOREPPC `]() enumerator IGNOREPPC Entry should be ignored. ##### [` SECURE `]() enumerator SECURE Boolean, was exec setuid-like?. ##### [` BASE_PLATFORM `]() enumerator BASE\_PLATFORM String identifying real platform ##### [` RANDOM `]() enumerator RANDOM Address of 16 random bytes ##### [` HWCAP2 `]() enumerator HWCAP2 Extension of AT\_HWCAP ##### [` EXECFN `]() enumerator EXECFN = 31 Filename of executable ##### [` SYSINFO `]() enumerator SYSINFO Filename of executable ##### [` SYSINFO_EHDR `]() enumerator SYSINFO\_EHDR Pointer to ELF header of system-supplied DSO. Public Functions #### [` CoreAuxv `]() inline CoreAuxv([ARCH]( "LIEF::ELF::ARCH") arch, [Header]( "LIEF::ELF::Header")::[CLASS]( "LIEF::ELF::Header::CLASS") cls, std::string name, uint32\_t type, description\_t description) #### [` clone `]() inline virtual std::unique\_ptr<[Note]( "LIEF::ELF::Note")> clone() const override Clone the current note and keep its polymorphic type. #### [` values `]() std::map<[TYPE]( "LIEF::ELF::CoreAuxv::TYPE"), uint64\_t> values() const A map of [CoreAuxv::TYPE]() and the value. #### [` get `]() [result]( "LIEF::result")<uint64\_t> get([TYPE]( "LIEF::ELF::CoreAuxv::TYPE") type) const Return the value associated with the provided [TYPE]() or a [lief\_errors::not\_found]() if the type is not present. #### [` operator[] `]() inline [result]( "LIEF::result")<uint64\_t> operator[]([TYPE]( "LIEF::ELF::CoreAuxv::TYPE") type) const #### [` set `]() bool set([TYPE]( "LIEF::ELF::CoreAuxv::TYPE") type, uint64\_t value) #### [` set `]() bool set(const std::map<[TYPE]( "LIEF::ELF::CoreAuxv::TYPE"), uint64\_t> &values) #### [` dump `]() virtual void dump(std::ostream &os) const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~CoreAuxv `]() ~CoreAuxv() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Note]( "LIEF::ELF::Note") \*note) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [CoreAuxv]( "LIEF::ELF::CoreAuxv") &note) --- ## [Android Identity]() ### [` AndroidIdent `]() class AndroidIdent : public LIEF::ELF::[Note]( "LIEF::ELF::Note") Class representing the “.note.android.ident” section. > **See also** > > [https://android.googlesource.com/platform/ndk/+/ndk-release-r16/sources/crt/crtbrand.S#39]() Public Functions #### [` clone `]() inline virtual std::unique\_ptr<[Note]( "LIEF::ELF::Note")> clone() const override Clone the current note and keep its polymorphic type. #### [` sdk_version `]() uint32\_t sdk\_version() const Target SDK version (or 0 if it can’t be resolved). #### [` ndk_version `]() std::string ndk\_version() const NDK version used (or an empty string if it can’t be parsed). #### [` ndk_build_number `]() std::string ndk\_build\_number() const NDK build number (or an empty string if it can’t be parsed). #### [` sdk_version `]() void sdk\_version(uint32\_t version) #### [` ndk_version `]() void ndk\_version(const std::string &ndk\_version) #### [` ndk_build_number `]() void ndk\_build\_number(const std::string &ndk\_build\_number) #### [` dump `]() virtual void dump(std::ostream &os) const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~AndroidIdent `]() ~AndroidIdent() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Note]( "LIEF::ELF::Note") \*note) #### [` description_size `]() static inline size\_t description\_size() Public Static Attributes #### [` sdk_version_size `]() static size\_t sdk\_version\_size = sizeof(uint32\_t) #### [` ndk_version_size `]() static size\_t ndk\_version\_size = 64 \* sizeof(char) #### [` ndk_build_number_size `]() static size\_t ndk\_build\_number\_size = 64 \* sizeof(char) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [AndroidIdent]( "LIEF::ELF::AndroidIdent") &note) --- ## [QNX Stack]() ### [` QNXStack `]() class QNXStack : public LIEF::ELF::[Note]( "LIEF::ELF::Note") Class representing the QNX `QNT_STACK` note. Public Functions #### [` clone `]() inline virtual std::unique\_ptr<[Note]( "LIEF::ELF::Note")> clone() const override Clone the current note and keep its polymorphic type. #### [` stack_size `]() uint32\_t stack\_size() const Size of the stack. #### [` stack_allocated `]() uint32\_t stack\_allocated() const Size of the stack pre-allocated (upfront). #### [` is_executable `]() bool is\_executable() const Whether the stack is executable. #### [` stack_size `]() void stack\_size(uint32\_t value) #### [` stack_allocated `]() void stack\_allocated(uint32\_t value) #### [` set_is_executable `]() void set\_is\_executable(bool value) #### [` dump `]() virtual void dump(std::ostream &os) const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~QNXStack `]() ~QNXStack() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Note]( "LIEF::ELF::Note") \*note) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [QNXStack]( "LIEF::ELF::QNXStack") &note) --- ## [Note ABI]() ### [` NoteAbi `]() class NoteAbi : public LIEF::ELF::[Note]( "LIEF::ELF::Note") Class that wraps the `NT_GNU_ABI_TAG` note. Public Types #### [` ABI `]() enum class ABI [ABI]() recognized by this note. *Values:* ##### [` LINUX `]() enumerator LINUX = 0 ##### [` GNU `]() enumerator GNU ##### [` SOLARIS2 `]() enumerator SOLARIS2 ##### [` FREEBSD `]() enumerator FREEBSD ##### [` NETBSD `]() enumerator NETBSD ##### [` SYLLABLE `]() enumerator SYLLABLE ##### [` NACL `]() enumerator NACL #### [` version_t `]() using version\_t = std::array<uint32\_t, 3> Version type: (Major, Minor, Patch). Public Functions #### [` clone `]() inline virtual std::unique\_ptr<[Note]( "LIEF::ELF::NoteAbi::Note")> clone() const override Clone the current note and keep its polymorphic type. #### [` version `]() [result]( "LIEF::result")<[version\_t]( "LIEF::ELF::NoteAbi::version_t")> version() const Return the version or an error if it can’t be parsed. #### [` abi `]() [result]( "LIEF::result")<[ABI]( "LIEF::ELF::NoteAbi::ABI")> abi() const Return the [ABI]() or an error if it can’t be parsed. #### [` version `]() void version(const [version\_t]( "LIEF::ELF::NoteAbi::version_t") &version) #### [` version `]() void version([ABI]( "LIEF::ELF::NoteAbi::ABI") abi) #### [` dump `]() virtual void dump(std::ostream &os) const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~NoteAbi `]() ~NoteAbi() override = default #### [` Note `]() Note(const [Note]( "LIEF::ELF::NoteAbi::Note") &copy) = default Public Static Functions #### [` classof `]() static inline bool classof(const [Note]( "LIEF::ELF::NoteAbi::Note") \*note) #### [` description_size `]() static inline uint8\_t description\_size() Size of the description content. Public Static Attributes #### [` abi_offset `]() static size\_t abi\_offset = 0 #### [` abi_size `]() static size\_t abi\_size = sizeof(uint32\_t) #### [` version_offset `]() static size\_t version\_offset = [abi\_size]( "LIEF::ELF::NoteAbi::abi_size") #### [` version_size `]() static size\_t version\_size = 3 \* sizeof(uint32\_t) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [NoteAbi]( "LIEF::ELF::NoteAbi") &note) --- ## [Note Gnu Property]() ### [` NoteGnuProperty `]() class NoteGnuProperty : public LIEF::ELF::[Note]( "LIEF::ELF::Note") Class that wraps the `NT_GNU_PROPERTY_TYPE_0` note. Public Types #### [` properties_t `]() using properties\_t = std::vector<std::unique\_ptr<[NoteGnuProperty]( "LIEF::ELF::NoteGnuProperty")::[Property]( "LIEF::ELF::NoteGnuProperty::Property")>> Public Functions #### [` NoteGnuProperty `]() inline NoteGnuProperty([ARCH]( "LIEF::ELF::ARCH") arch, [Header]( "LIEF::ELF::Header")::[CLASS]( "LIEF::ELF::Header::CLASS") cls, std::string name, uint32\_t type, description\_t description, std::string secname) #### [` clone `]() inline virtual std::unique\_ptr<[Note]( "LIEF::ELF::Note")> clone() const override Clone the current note and keep its polymorphic type. #### [` find `]() std::unique\_ptr<[NoteGnuProperty]( "LIEF::ELF::NoteGnuProperty")::[Property]( "LIEF::ELF::NoteGnuProperty::Property")> find([Property]( "LIEF::ELF::NoteGnuProperty::Property")::[TYPE]( "LIEF::ELF::NoteGnuProperty::Property::TYPE") type) const Find the property with the given type or return a `nullptr`. #### [` properties `]() [properties\_t]( "LIEF::ELF::NoteGnuProperty::properties_t") properties() const Return the properties as a list of [Property](). #### [` dump `]() virtual void dump(std::ostream &os) const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~NoteGnuProperty `]() ~NoteGnuProperty() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Note]( "LIEF::ELF::Note") \*note) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [NoteGnuProperty]( "LIEF::ELF::NoteGnuProperty") &note) #### [` Property `]() class Property This class wraps the different properties that can be used in a `NT_GNU_PROPERTY_TYPE_0` note. Subclassed by [LIEF::ELF::AArch64Feature](), [LIEF::ELF::AArch64PAuth](), [LIEF::ELF::Generic](), [LIEF::ELF::Needed](), [LIEF::ELF::NoteNoCopyOnProtected](), [LIEF::ELF::StackSize](), [LIEF::ELF::X86Features](), [LIEF::ELF::X86ISA]() Public Types ##### [` TYPE `]() enum class TYPE LIEF’s mirror types of the original `GNU_PROPERTY_` values. *Values:* ###### [` UNKNOWN `]() enumerator UNKNOWN = 0 ###### [` GENERIC `]() enumerator GENERIC [Property]() that doesn’t have a special implementation. ###### [` AARCH64_FEATURES `]() enumerator AARCH64\_FEATURES Mirror of `GNU_PROPERTY_AARCH64_FEATURE_1_AND`. ###### [` AARCH64_PAUTH `]() enumerator AARCH64\_PAUTH Mirror of `GNU_PROPERTY_AARCH64_FEATURE_PAUTH`. ###### [` STACK_SIZE `]() enumerator STACK\_SIZE Mirror of `GNU_PROPERTY_STACK_SIZE`. ###### [` NO_COPY_ON_PROTECTED `]() enumerator NO\_COPY\_ON\_PROTECTED Mirror of `GNU_PROPERTY_NO_COPY_ON_PROTECTED`. ###### [` X86_ISA `]() enumerator X86\_ISA Mirror of `GNU_PROPERTY_X86_ISA_1_*` and `GNU_PROPERTY_X86_COMPAT_*`. Mirror of `GNU_PROPERTY_X86_FEATURE_*` ###### [` X86_FEATURE `]() enumerator X86\_FEATURE ###### [` NEEDED `]() enumerator NEEDED Public Functions ##### [` Property `]() Property() = delete ##### [` type `]() inline [TYPE]( "LIEF::ELF::NoteGnuProperty::Property::TYPE") type() const Return the LIEF’s mirror type of the note. ##### [` dump `]() virtual void dump(std::ostream &os) const ##### [` ~Property `]() virtual ~Property() = default Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Property]( "LIEF::ELF::NoteGnuProperty::Property") &prop) --- ## [Generic]() ### [` Generic `]() class Generic : public LIEF::ELF::[NoteGnuProperty]( "LIEF::ELF::NoteGnuProperty")::[Property]( "LIEF::ELF::NoteGnuProperty::Property") This class represents a property which doesn’t have a concrete LIEF implementation. Public Functions #### [` type `]() inline uint32\_t type() const The original raw type as an integer. This value might depends on the architecture and/or the file type. #### [` ~Generic `]() ~Generic() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [NoteGnuProperty]( "LIEF::ELF::NoteGnuProperty")::[Property]( "LIEF::ELF::NoteGnuProperty::Property") \*prop) #### [` create `]() static inline std::unique\_ptr<[Generic]( "LIEF::ELF::Generic")> create(uint32\_t raw\_type) --- ## [AArch64 Feature]() ### [` AArch64Feature `]() class AArch64Feature : public LIEF::ELF::[NoteGnuProperty]( "LIEF::ELF::NoteGnuProperty")::[Property]( "LIEF::ELF::NoteGnuProperty::Property") This class represents the `GNU_PROPERTY_AARCH64_FEATURE_1_AND` property. Public Types #### [` FEATURE `]() enum class FEATURE *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` BTI `]() enumerator BTI Support Branch Target Identification (BTI). ##### [` PAC `]() enumerator PAC Support Pointer authentication (PAC). ##### [` GCS `]() enumerator GCS Guarded Control Stack. Public Functions #### [` features `]() inline const std::vector<[FEATURE]( "LIEF::ELF::AArch64Feature::FEATURE")> &features() const Return the list of the supported features. #### [` dump `]() virtual void dump(std::ostream &os) const override #### [` ~AArch64Feature `]() ~AArch64Feature() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [NoteGnuProperty]( "LIEF::ELF::NoteGnuProperty")::[Property]( "LIEF::ELF::NoteGnuProperty::Property") \*prop) #### [` create `]() static std::unique\_ptr<[AArch64Feature]( "LIEF::ELF::AArch64Feature")> create([BinaryStream]( "LIEF::BinaryStream") &stream) --- ## [AArch64 PAuth]() ### [` AArch64PAuth `]() class AArch64PAuth : public LIEF::ELF::[NoteGnuProperty]( "LIEF::ELF::NoteGnuProperty")::[Property]( "LIEF::ELF::NoteGnuProperty::Property") This class represents the `GNU_PROPERTY_AARCH64_FEATURE_PAUTH` property. > **Note** > > If both [AArch64PAuth::platform]() and [AArch64PAuth::version]() are set to 0, this means that the binary is incompatible with PAuth ABI extension. Public Functions #### [` platform `]() inline uint64\_t platform() const 64-bit value that specifies the platform vendor. A `0` value is associated with an *invalid* platform while the value `1` is associated with a baremetal platform. #### [` version `]() inline uint64\_t version() const 64-bit value that identifies the signing schema used by the ELF file. #### [` dump `]() virtual void dump(std::ostream &os) const override #### [` ~AArch64PAuth `]() ~AArch64PAuth() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [NoteGnuProperty]( "LIEF::ELF::NoteGnuProperty")::[Property]( "LIEF::ELF::NoteGnuProperty::Property") \*prop) #### [` create `]() static std::unique\_ptr<[AArch64PAuth]( "LIEF::ELF::AArch64PAuth")> create([BinaryStream]( "LIEF::BinaryStream") &stream) --- ## [Needed]() ### [` Needed `]() class Needed : public LIEF::ELF::[NoteGnuProperty]( "LIEF::ELF::NoteGnuProperty")::[Property]( "LIEF::ELF::NoteGnuProperty::Property") This class represents the `GNU_PROPERTY_1_NEEDED` note property. This property provides information about additional features that the object file needs at runtime (e.g. indirect external access). Public Types #### [` NEED `]() enum class NEED *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` INDIRECT_EXTERN_ACCESS `]() enumerator INDIRECT\_EXTERN\_ACCESS The object needs indirect external access. Public Functions #### [` needs `]() inline const std::vector<[NEED]( "LIEF::ELF::Needed::NEED")> &needs() const Return the list of needed features. #### [` dump `]() virtual void dump(std::ostream &os) const override #### [` ~Needed `]() ~Needed() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [NoteGnuProperty]( "LIEF::ELF::NoteGnuProperty")::[Property]( "LIEF::ELF::NoteGnuProperty::Property") \*prop) #### [` create `]() static std::unique\_ptr<[Needed]( "LIEF::ELF::Needed")> create([BinaryStream]( "LIEF::BinaryStream") &stream) --- ## [No Copy on Protected]() ### [` NoteNoCopyOnProtected `]() class NoteNoCopyOnProtected : public LIEF::ELF::[NoteGnuProperty]( "LIEF::ELF::NoteGnuProperty")::[Property]( "LIEF::ELF::NoteGnuProperty::Property") This class provides an interface over the `GNU_PROPERTY_NO_COPY_ON_PROTECTED` property. This property indicates that the linker shouldn’t copy relocations against protected symbols. Public Functions #### [` ~NoteNoCopyOnProtected `]() ~NoteNoCopyOnProtected() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [NoteGnuProperty]( "LIEF::ELF::NoteGnuProperty")::[Property]( "LIEF::ELF::NoteGnuProperty::Property") \*prop) #### [` create `]() static inline std::unique\_ptr<[NoteNoCopyOnProtected]( "LIEF::ELF::NoteNoCopyOnProtected")> create() --- ## [Stack Size]() ### [` StackSize `]() class StackSize : public LIEF::ELF::[NoteGnuProperty]( "LIEF::ELF::NoteGnuProperty")::[Property]( "LIEF::ELF::NoteGnuProperty::Property") This class provides an interface over the `GNU_PROPERTY_STACK_SIZE` property. This property can be used by the loader to raise the stack limit. Public Functions #### [` stack_size `]() inline uint64\_t stack\_size() const The indicated stack size. #### [` dump `]() virtual void dump(std::ostream &os) const override #### [` ~StackSize `]() ~StackSize() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [NoteGnuProperty]( "LIEF::ELF::NoteGnuProperty")::[Property]( "LIEF::ELF::NoteGnuProperty::Property") \*prop) #### [` create `]() static inline std::unique\_ptr<[StackSize]( "LIEF::ELF::StackSize")> create(uint64\_t stack\_size) --- ## [X86 Feature]() ### [` X86Features `]() class X86Features : public LIEF::ELF::[NoteGnuProperty]( "LIEF::ELF::NoteGnuProperty")::[Property]( "LIEF::ELF::NoteGnuProperty::Property") This class interfaces the different `GNU_PROPERTY_X86_FEATURE_*` properties which includes: - `GNU_PROPERTY_X86_FEATURE_1_AND` - `GNU_PROPERTY_X86_FEATURE_2_USED` - `GNU_PROPERTY_X86_FEATURE_2_NEEDED` Public Types #### [` FLAG `]() enum class FLAG Flag according to the `_AND`, `_USED` or `_NEEDED` suffixes. *Values:* ##### [` NONE `]() enumerator NONE = 0 For the original `GNU_PROPERTY_X86_FEATURE_1_AND` property. ##### [` USED `]() enumerator USED For the original `GNU_PROPERTY_X86_FEATURE_2_USED` property. ##### [` NEEDED `]() enumerator NEEDED For the original `GNU_PROPERTY_X86_FEATURE_2_NEEDED` property. #### [` FEATURE `]() enum class FEATURE Features provided by these different properties. *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` IBT `]() enumerator IBT ##### [` SHSTK `]() enumerator SHSTK ##### [` LAM_U48 `]() enumerator LAM\_U48 ##### [` LAM_U57 `]() enumerator LAM\_U57 ##### [` X86 `]() enumerator X86 ##### [` X87 `]() enumerator X87 ##### [` MMX `]() enumerator MMX ##### [` XMM `]() enumerator XMM ##### [` YMM `]() enumerator YMM ##### [` ZMM `]() enumerator ZMM ##### [` FXSR `]() enumerator FXSR ##### [` XSAVE `]() enumerator XSAVE ##### [` XSAVEOPT `]() enumerator XSAVEOPT ##### [` XSAVEC `]() enumerator XSAVEC ##### [` TMM `]() enumerator TMM ##### [` MASK `]() enumerator MASK #### [` features_t `]() using features\_t = std::vector<std::pair<[FLAG]( "LIEF::ELF::X86Features::FLAG"), [FEATURE]( "LIEF::ELF::X86Features::FEATURE")>> List of the features as a pair of [FLAG](), [FEATURE](). For instance, if the raw property is `GNU_PROPERTY_X86_FEATURE_2_USED` with a bitmask set to `GNU_PROPERTY_X86_FEATURE_2_XSAVE`, it generates the pair: [FLAG::USED](), [FEATURE::XSAVE]() Public Functions #### [` features `]() inline const [features\_t]( "LIEF::ELF::X86Features::features_t") &features() const List of the features. #### [` dump `]() virtual void dump(std::ostream &os) const override #### [` ~X86Features `]() ~X86Features() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [NoteGnuProperty]( "LIEF::ELF::NoteGnuProperty")::[Property]( "LIEF::ELF::NoteGnuProperty::Property") \*prop) #### [` create `]() static std::unique\_ptr<[X86Features]( "LIEF::ELF::X86Features")> create(uint32\_t type, [BinaryStream]( "LIEF::BinaryStream") &stream) --- ## [X86 ISA]() ### [` X86ISA `]() class X86ISA : public LIEF::ELF::[NoteGnuProperty]( "LIEF::ELF::NoteGnuProperty")::[Property]( "LIEF::ELF::NoteGnuProperty::Property") This class interfaces the different `GNU_PROPERTY_X86_ISA_*` properties which includes: - `GNU_PROPERTY_X86_ISA_1_USED` - `GNU_PROPERTY_X86_ISA_1_NEEDED` - `GNU_PROPERTY_X86_COMPAT_ISA_1_USED` - `GNU_PROPERTY_X86_COMPAT_ISA_1_NEEDED` - `GNU_PROPERTY_X86_COMPAT_2_ISA_1_USED` - `GNU_PROPERTY_X86_COMPAT_2_ISA_1_NEEDED` Public Types #### [` FLAG `]() enum class FLAG *Values:* ##### [` NONE `]() enumerator NONE = 0 ##### [` USED `]() enumerator USED ##### [` NEEDED `]() enumerator NEEDED #### [` ISA `]() enum class ISA *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` BASELINE `]() enumerator BASELINE ##### [` V2 `]() enumerator V2 ##### [` V3 `]() enumerator V3 ##### [` V4 `]() enumerator V4 ##### [` CMOV `]() enumerator CMOV ##### [` FMA `]() enumerator FMA ##### [` I486 `]() enumerator I486 ##### [` I586 `]() enumerator I586 ##### [` I686 `]() enumerator I686 ##### [` SSE `]() enumerator SSE ##### [` SSE2 `]() enumerator SSE2 ##### [` SSE3 `]() enumerator SSE3 ##### [` SSSE3 `]() enumerator SSSE3 ##### [` SSE4_1 `]() enumerator SSE4\_1 ##### [` SSE4_2 `]() enumerator SSE4\_2 ##### [` AVX `]() enumerator AVX ##### [` AVX2 `]() enumerator AVX2 ##### [` AVX512F `]() enumerator AVX512F ##### [` AVX512CD `]() enumerator AVX512CD ##### [` AVX512ER `]() enumerator AVX512ER ##### [` AVX512PF `]() enumerator AVX512PF ##### [` AVX512VL `]() enumerator AVX512VL ##### [` AVX512DQ `]() enumerator AVX512DQ ##### [` AVX512BW `]() enumerator AVX512BW ##### [` AVX512_4FMAPS `]() enumerator AVX512\_4FMAPS ##### [` AVX512_4VNNIW `]() enumerator AVX512\_4VNNIW ##### [` AVX512_BITALG `]() enumerator AVX512\_BITALG ##### [` AVX512_IFMA `]() enumerator AVX512\_IFMA ##### [` AVX512_VBMI `]() enumerator AVX512\_VBMI ##### [` AVX512_VBMI2 `]() enumerator AVX512\_VBMI2 ##### [` AVX512_VNNI `]() enumerator AVX512\_VNNI ##### [` AVX512_BF16 `]() enumerator AVX512\_BF16 #### [` values_t `]() using values\_t = std::vector<std::pair<[FLAG]( "LIEF::ELF::X86ISA::FLAG"), [ISA]( "LIEF::ELF::X86ISA::ISA")>> Public Functions #### [` values `]() inline const [values\_t]( "LIEF::ELF::X86ISA::values_t") &values() const List of the [ISA]() values in this property. #### [` ~X86ISA `]() ~X86ISA() override = default #### [` dump `]() virtual void dump(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [NoteGnuProperty]( "LIEF::ELF::NoteGnuProperty")::[Property]( "LIEF::ELF::NoteGnuProperty::Property") \*prop) #### [` create `]() static std::unique\_ptr<[X86ISA]( "LIEF::ELF::X86ISA")> create(uint32\_t type, [BinaryStream]( "LIEF::BinaryStream") &stream) --- ## [Builder]() ### [` Builder `]() class Builder Class which takes an [ELF::Binary]() object and reconstructs a valid binary. This interface assumes that the layout of input ELF binary is correct (i.e. the binary can run). Public Functions #### [` Builder `]() Builder([Binary]( "LIEF::ELF::Binary") &binary, const [config\_t]( "LIEF::ELF::Builder::config_t") &config) #### [` Builder `]() inline Builder([Binary]( "LIEF::ELF::Binary") &binary) #### [` Builder `]() Builder() = delete #### [` ~Builder `]() ~Builder() #### [` build `]() void build() Perform the build of the provided ELF binary. #### [` config `]() inline [config\_t]( "LIEF::ELF::Builder::config_t") &config() #### [` get_build `]() const std::vector<uint8\_t> &get\_build() Return the built ELF binary as a byte vector. #### [` write `]() void write(const std::string &filename) const Write the built ELF binary in the `filename` given in parameter. #### [` write `]() void write(std::ostream &os) const Write the built ELF binary in the stream `os` given in parameter. #### [` config_t `]() struct config\_t Configuration options to tweak the building process. Public Members ##### [` dt_hash `]() bool dt\_hash = true Rebuild DT\_HASH. ##### [` dyn_str `]() bool dyn\_str = true Rebuild DT\_STRTAB. ##### [` dynamic_section `]() bool dynamic\_section = true Rebuild PT\_DYNAMIC segment. ##### [` fini_array `]() bool fini\_array = true Rebuild DT\_FINI\_ARRAY. ##### [` gnu_hash `]() bool gnu\_hash = true Rebuild DT\_GNU\_HASH. ##### [` init_array `]() bool init\_array = true Rebuild DT\_INIT\_ARRAY. ##### [` interpreter `]() bool interpreter = true Rebuild PT\_INTERPRETER. ##### [` jmprel `]() bool jmprel = true Rebuild DT\_JMPREL. ##### [` notes `]() bool notes = false Disable note building since it can break the default layout. ##### [` preinit_array `]() bool preinit\_array = true Rebuild DT\_PREINIT\_ARRAY. ##### [` relr `]() bool relr = true Rebuild DT\_RELR. ##### [` android_rela `]() bool android\_rela = true Rebuild DT\_ANDROID\_REL[A]. ##### [` rela `]() bool rela = true Rebuild DT\_REL[A]. ##### [` static_symtab `]() bool static\_symtab = true Rebuild `.symtab`. ##### [` sym_verdef `]() bool sym\_verdef = true Rebuild DT\_VERDEF. ##### [` sym_verneed `]() bool sym\_verneed = true Rebuild DT\_VERNEED. ##### [` sym_versym `]() bool sym\_versym = true Rebuild DT\_VERSYM. ##### [` symtab `]() bool symtab = true Rebuild DT\_SYMTAB. ##### [` coredump_notes `]() bool coredump\_notes = true Rebuild the Coredump notes. ##### [` force_relocate `]() bool force\_relocate = false Force to relocating all the ELF structures that are supported by LIEF (mostly for testing). ##### [` skip_dynamic `]() bool skip\_dynamic = false Skip relocating the PT\_DYNAMIC segment (only relevant if force\_relocate is set. ##### [` keep_empty_version_requirement `]() bool keep\_empty\_version\_requirement = false Remove entries in `.gnu.version_r` if they are not associated with at least one version. --- ## [Utilities]() ### [` LIEF::ELF::check_layout `]() bool LIEF::ELF::check\_layout(const [Binary]( "LIEF::ELF::Binary") &bin, std::string \*error\_info = nullptr) Check that the layout of the given [Binary]() is correct. ### [` LIEF::ELF::is_elf `]() bool LIEF::ELF::is\_elf(std::string\_view file) Check if the given file is an ELF one. ### [` LIEF::ELF::is_elf `]() bool LIEF::ELF::is\_elf(const std::vector<uint8\_t> &raw) Check if the raw data is an ELF file. --- ## [Enums]() ### [Architectures]() #### [` LIEF::ELF::ARCH `]() enum class LIEF::ELF::ARCH Machine architectures See current registered ELF machine architectures at: [http://www.sco.com/developers/gabi/latest/ch4.eheader.html]() *Values:* ##### [` NONE `]() enumerator NONE = 0 No machine ##### [` M32 `]() enumerator M32 = 1 AT&T WE 32100 ##### [` SPARC `]() enumerator SPARC = 2 SPARC ##### [` I386 `]() enumerator I386 = 3 Intel 386 ##### [` M68K `]() enumerator M68K = 4 Motorola 68000 ##### [` M88K `]() enumerator M88K = 5 Motorola 88000 ##### [` IAMCU `]() enumerator IAMCU = 6 Intel MCU ##### [` I860 `]() enumerator I860 = 7 Intel 80860 ##### [` MIPS `]() enumerator MIPS = 8 MIPS R3000 ##### [` S370 `]() enumerator S370 = 9 IBM System/370 ##### [` MIPS_RS3_LE `]() enumerator MIPS\_RS3\_LE = 10 MIPS RS3000 Little-endian ##### [` PARISC `]() enumerator PARISC = 15 Hewlett-Packard PA-RISC ##### [` VPP500 `]() enumerator VPP500 = 17 Fujitsu VPP500 ##### [` SPARC32PLUS `]() enumerator SPARC32PLUS = 18 Enhanced instruction set SPARC ##### [` I60 `]() enumerator I60 = 19 Intel 80960 ##### [` PPC `]() enumerator PPC = 20 PowerPC ##### [` PPC64 `]() enumerator PPC64 = 21 PowerPC64 ##### [` S390 `]() enumerator S390 = 22 IBM System/390 ##### [` SPU `]() enumerator SPU = 23 IBM SPU/SPC ##### [` V800 `]() enumerator V800 = 36 NEC V800 ##### [` FR20 `]() enumerator FR20 = 37 Fujitsu FR20 ##### [` RH32 `]() enumerator RH32 = 38 TRW RH-32 ##### [` RCE `]() enumerator RCE = 39 Motorola RCE ##### [` ARM `]() enumerator ARM = 40 ARM ##### [` ALPHA `]() enumerator ALPHA = 41 DEC Alpha ##### [` SH `]() enumerator SH = 42 Hitachi SH ##### [` SPARCV9 `]() enumerator SPARCV9 = 43 SPARC V9 ##### [` TRICORE `]() enumerator TRICORE = 44 Siemens TriCore ##### [` ARC `]() enumerator ARC = 45 Argonaut RISC Core ##### [` H8_300 `]() enumerator H8\_300 = 46 Hitachi H8/300 ##### [` H8_300H `]() enumerator H8\_300H = 47 Hitachi H8/300H ##### [` H8S `]() enumerator H8S = 48 Hitachi H8S ##### [` H8_500 `]() enumerator H8\_500 = 49 Hitachi H8/500 ##### [` IA_64 `]() enumerator IA\_64 = 50 Intel IA-64 processor architecture ##### [` MIPS_X `]() enumerator MIPS\_X = 51 Stanford MIPS-X ##### [` COLDFIRE `]() enumerator COLDFIRE = 52 Motorola ColdFire ##### [` M68HC12 `]() enumerator M68HC12 = 53 Motorola M68HC12 ##### [` MMA `]() enumerator MMA = 54 Fujitsu MMA Multimedia Accelerator ##### [` PCP `]() enumerator PCP = 55 Siemens PCP ##### [` NCPU `]() enumerator NCPU = 56 Sony nCPU embedded RISC processor ##### [` NDR1 `]() enumerator NDR1 = 57 Denso NDR1 microprocessor ##### [` STARCORE `]() enumerator STARCORE = 58 Motorola Star\*Core processor ##### [` ME16 `]() enumerator ME16 = 59 Toyota ME16 processor ##### [` ST100 `]() enumerator ST100 = 60 STMicroelectronics ST100 processor ##### [` TINYJ `]() enumerator TINYJ = 61 Advanced Logic Corp. TinyJ embedded processor family ##### [` X86_64 `]() enumerator X86\_64 = 62 AMD x86-64 architecture ##### [` PDSP `]() enumerator PDSP = 63 Sony DSP Processor ##### [` PDP10 `]() enumerator PDP10 = 64 Digital Equipment Corp. PDP-10 ##### [` PDP11 `]() enumerator PDP11 = 65 Digital Equipment Corp. PDP-11 ##### [` FX66 `]() enumerator FX66 = 66 Siemens FX66 microcontroller ##### [` ST9PLUS `]() enumerator ST9PLUS = 67 STMicroelectronics ST9+ 8/16 bit microcontroller ##### [` ST7 `]() enumerator ST7 = 68 STMicroelectronics ST7 8-bit microcontroller ##### [` M68HC16 `]() enumerator M68HC16 = 69 Motorola MC68HC16 Microcontroller ##### [` M68HC11 `]() enumerator M68HC11 = 70 Motorola MC68HC11 Microcontroller ##### [` M68HC08 `]() enumerator M68HC08 = 71 Motorola MC68HC08 Microcontroller ##### [` M68HC05 `]() enumerator M68HC05 = 72 Motorola MC68HC05 Microcontroller ##### [` SVX `]() enumerator SVX = 73 Silicon Graphics SVx ##### [` ST19 `]() enumerator ST19 = 74 STMicroelectronics ST19 8-bit microcontroller ##### [` VAX `]() enumerator VAX = 75 Digital VAX ##### [` CRIS `]() enumerator CRIS = 76 Axis Communications 32-bit embedded processor ##### [` JAVELIN `]() enumerator JAVELIN = 77 Infineon Technologies 32-bit embedded processor ##### [` FIREPATH `]() enumerator FIREPATH = 78 Element 14 64-bit DSP Processor ##### [` ZSP `]() enumerator ZSP = 79 LSI Logic 16-bit DSP Processor ##### [` MMIX `]() enumerator MMIX = 80 Donald Knuth’s educational 64-bit processor ##### [` HUANY `]() enumerator HUANY = 81 Harvard University machine-independent object files ##### [` PRISM `]() enumerator PRISM = 82 SiTera Prism ##### [` AVR `]() enumerator AVR = 83 Atmel AVR 8-bit microcontroller ##### [` FR30 `]() enumerator FR30 = 84 Fujitsu FR30 ##### [` D10V `]() enumerator D10V = 85 Mitsubishi D10V ##### [` D30V `]() enumerator D30V = 86 Mitsubishi D30V ##### [` V850 `]() enumerator V850 = 87 NEC v850 ##### [` M32R `]() enumerator M32R = 88 Mitsubishi M32R ##### [` MN10300 `]() enumerator MN10300 = 89 Matsushita MN10300 ##### [` MN10200 `]() enumerator MN10200 = 90 Matsushita MN10200 ##### [` PJ `]() enumerator PJ = 91 picoJava ##### [` OPENRISC `]() enumerator OPENRISC = 92 OpenRISC 32-bit embedded processor ##### [` ARC_COMPACT `]() enumerator ARC\_COMPACT = 93 ARC International ARCompact processor (old spelling/synonym: EM\_ARC\_A5) ##### [` XTENSA `]() enumerator XTENSA = 94 Tensilica Xtensa Architecture ##### [` VIDEOCORE `]() enumerator VIDEOCORE = 95 Alphamosaic VideoCore processor ##### [` TMM_GPP `]() enumerator TMM\_GPP = 96 Thompson Multimedia General Purpose Processor ##### [` NS32K `]() enumerator NS32K = 97 National Semiconductor 32000 series ##### [` TPC `]() enumerator TPC = 98 Tenor Network TPC processor ##### [` SNP1K `]() enumerator SNP1K = 99 Trebia SNP 1000 processor ##### [` ST200 `]() enumerator ST200 = 100 STMicroelectronics (www.st.com) ST200 ##### [` IP2K `]() enumerator IP2K = 101 Ubicom IP2xxx microcontroller family ##### [` MAX `]() enumerator MAX = 102 MAX Processor ##### [` CR `]() enumerator CR = 103 National Semiconductor CompactRISC microprocessor ##### [` F2MC16 `]() enumerator F2MC16 = 104 Fujitsu F2MC16 ##### [` MSP430 `]() enumerator MSP430 = 105 Texas Instruments embedded microcontroller msp430 ##### [` BLACKFIN `]() enumerator BLACKFIN = 106 Analog Devices Blackfin (DSP) processor ##### [` SE_C33 `]() enumerator SE\_C33 = 107 S1C33 Family of Seiko Epson processors ##### [` SEP `]() enumerator SEP = 108 Sharp embedded microprocessor ##### [` ARCA `]() enumerator ARCA = 109 Arca RISC Microprocessor ##### [` UNICORE `]() enumerator UNICORE = 110 Microprocessor series from PKU-Unity Ltd. and MPRC of Peking University ##### [` EXCESS `]() enumerator EXCESS = 111 eXcess: 16/32/64-bit configurable embedded CPU ##### [` DXP `]() enumerator DXP = 112 Icera Semiconductor Inc. Deep Execution Processor ##### [` ALTERA_NIOS2 `]() enumerator ALTERA\_NIOS2 = 113 Altera Nios II soft-core processor ##### [` CRX `]() enumerator CRX = 114 National Semiconductor CompactRISC CRX ##### [` XGATE `]() enumerator XGATE = 115 Motorola XGATE embedded processor ##### [` C166 `]() enumerator C166 = 116 Infineon C16x/XC16x processor ##### [` M16C `]() enumerator M16C = 117 Renesas M16C series microprocessors ##### [` DSPIC30F `]() enumerator DSPIC30F = 118 Microchip Technology dsPIC30F Digital Signal ##### [` CE `]() enumerator CE = 119 Freescale Communication Engine RISC core ##### [` M32C `]() enumerator M32C = 120 Renesas M32C series microprocessors ##### [` TSK3000 `]() enumerator TSK3000 = 131 Altium TSK3000 core ##### [` RS08 `]() enumerator RS08 = 132 Freescale RS08 embedded processor ##### [` SHARC `]() enumerator SHARC = 133 Analog Devices SHARC family of 32-bit DSP ##### [` ECOG2 `]() enumerator ECOG2 = 134 Cyan Technology eCOG2 microprocessor ##### [` SCORE7 `]() enumerator SCORE7 = 135 Sunplus S+core7 RISC processor ##### [` DSP24 `]() enumerator DSP24 = 136 New Japan Radio (NJR) 24-bit DSP Processor ##### [` VIDEOCORE3 `]() enumerator VIDEOCORE3 = 137 Broadcom VideoCore III processor ##### [` LATTICEMICO32 `]() enumerator LATTICEMICO32 = 138 RISC processor for Lattice FPGA architecture ##### [` SE_C17 `]() enumerator SE\_C17 = 139 Seiko Epson C17 family ##### [` TI_C6000 `]() enumerator TI\_C6000 = 140 The Texas Instruments TMS320C6000 DSP family ##### [` TI_C2000 `]() enumerator TI\_C2000 = 141 The Texas Instruments TMS320C2000 DSP family ##### [` TI_C5500 `]() enumerator TI\_C5500 = 142 The Texas Instruments TMS320C55x DSP family ##### [` MMDSP_PLUS `]() enumerator MMDSP\_PLUS = 160 STMicroelectronics 64bit VLIW Data Signal Processor ##### [` CYPRESS_M8C `]() enumerator CYPRESS\_M8C = 161 Cypress M8C microprocessor ##### [` R32C `]() enumerator R32C = 162 Renesas R32C series microprocessors ##### [` TRIMEDIA `]() enumerator TRIMEDIA = 163 NXP Semiconductors TriMedia architecture family ##### [` HEXAGON `]() enumerator HEXAGON = 164 Qualcomm Hexagon processor ##### [` M8051 `]() enumerator M8051 = 165 Intel 8051 and variants ##### [` STXP7X `]() enumerator STXP7X = 166 STMicroelectronics STxP7x family of configurable ##### [` NDS32 `]() enumerator NDS32 = 167 ##### [` ECOG1 `]() enumerator ECOG1 = 168 Cyan Technology eCOG1X family ##### [` ECOG1X `]() enumerator ECOG1X = 168 Cyan Technology eCOG1X family ##### [` MAXQ30 `]() enumerator MAXQ30 = 169 Dallas Semiconductor MAXQ30 Core Micro-controllers ##### [` XIMO16 `]() enumerator XIMO16 = 170 New Japan Radio (NJR) 16-bit DSP Processor ##### [` MANIK `]() enumerator MANIK = 171 M2000 Reconfigurable RISC Microprocessor ##### [` CRAYNV2 `]() enumerator CRAYNV2 = 172 Cray Inc. NV2 vector architecture ##### [` RX `]() enumerator RX = 173 Renesas RX family ##### [` METAG `]() enumerator METAG = 174 Imagination Technologies META processor ##### [` MCST_ELBRUS `]() enumerator MCST\_ELBRUS = 175 MCST Elbrus general purpose hardware architecture ##### [` ECOG16 `]() enumerator ECOG16 = 176 Cyan Technology eCOG16 family ##### [` CR16 `]() enumerator CR16 = 177 National Semiconductor CompactRISC CR16 16-bit ##### [` ETPU `]() enumerator ETPU = 178 Freescale Extended Time Processing Unit ##### [` SLE9X `]() enumerator SLE9X = 179 Infineon Technologies SLE9X core ##### [` L10M `]() enumerator L10M = 180 Intel L10M ##### [` K10M `]() enumerator K10M = 181 Intel K10M ##### [` AARCH64 `]() enumerator AARCH64 = 183 ARM AArch64 ##### [` AVR32 `]() enumerator AVR32 = 185 Atmel Corporation 32-bit microprocessor family ##### [` STM8 `]() enumerator STM8 = 186 STMicroeletronics STM8 8-bit microcontroller ##### [` TILE64 `]() enumerator TILE64 = 187 Tilera TILE64 multicore architecture family ##### [` TILEPRO `]() enumerator TILEPRO = 188 Tilera TILEPro multicore architecture family ##### [` CUDA `]() enumerator CUDA = 190 NVIDIA CUDA architecture ##### [` TILEGX `]() enumerator TILEGX = 191 Tilera TILE-Gx multicore architecture family ##### [` CLOUDSHIELD `]() enumerator CLOUDSHIELD = 192 CloudShield architecture family ##### [` COREA_1ST `]() enumerator COREA\_1ST = 193 KIPO-KAIST Core-A 1st generation processor family ##### [` COREA_2ND `]() enumerator COREA\_2ND = 194 KIPO-KAIST Core-A 2nd generation processor family ##### [` ARC_COMPACT2 `]() enumerator ARC\_COMPACT2 = 195 Synopsys ARCompact V2 ##### [` OPEN8 `]() enumerator OPEN8 = 196 Open8 8-bit RISC soft processor core ##### [` RL78 `]() enumerator RL78 = 197 Renesas RL78 family ##### [` VIDEOCORE5 `]() enumerator VIDEOCORE5 = 198 Broadcom VideoCore V processor ##### [` M78KOR `]() enumerator M78KOR = 199 Renesas 78KOR family ##### [` M56800EX `]() enumerator M56800EX = 200 Freescale 56800EX Digital Signal Controller (DSC) ##### [` BA1 `]() enumerator BA1 = 201 Beyond BA1 CPU architecture ##### [` BA2 `]() enumerator BA2 = 202 Beyond BA2 CPU architecture ##### [` XCORE `]() enumerator XCORE = 203 XMOS xCORE processor family ##### [` MCHP_PIC `]() enumerator MCHP\_PIC = 204 Microchip 8-bit PIC(r) family ##### [` INTEL205 `]() enumerator INTEL205 = 205 Reserved by Intel ##### [` INTEL206 `]() enumerator INTEL206 = 206 Reserved by Intel ##### [` INTEL207 `]() enumerator INTEL207 = 207 Reserved by Intel ##### [` INTEL208 `]() enumerator INTEL208 = 208 Reserved by Intel ##### [` INTEL209 `]() enumerator INTEL209 = 209 Reserved by Intel ##### [` KM32 `]() enumerator KM32 = 210 KM211 KM32 32-bit processor ##### [` KMX32 `]() enumerator KMX32 = 211 KM211 KMX32 32-bit processor ##### [` KMX16 `]() enumerator KMX16 = 212 KM211 KMX16 16-bit processor ##### [` KMX8 `]() enumerator KMX8 = 213 KM211 KMX8 8-bit processor ##### [` KVARC `]() enumerator KVARC = 214 KM211 KVARC processor ##### [` CDP `]() enumerator CDP = 215 Paneve CDP architecture family ##### [` COGE `]() enumerator COGE = 216 Cognitive Smart Memory Processor ##### [` COOL `]() enumerator COOL = 217 iCelero CoolEngine ##### [` NORC `]() enumerator NORC = 218 Nanoradio Optimized RISC ##### [` CSR_KALIMBA `]() enumerator CSR\_KALIMBA = 219 CSR Kalimba architecture family ##### [` AMDGPU `]() enumerator AMDGPU = 224 AMD GPU architecture ##### [` RISCV `]() enumerator RISCV = 243 RISC-V ##### [` BPF `]() enumerator BPF = 247 eBPF Filter ##### [` CSKY `]() enumerator CSKY = 252 C-SKY ##### [` LOONGARCH `]() enumerator LOONGARCH = 258 LoongArch ##### [` ALPHA_ALT `]() enumerator ALPHA\_ALT = 0x9026 ### [Processor Flags]() #### [` LIEF::ELF::PROCESSOR_FLAGS `]() enum class LIEF::ELF::PROCESSOR\_FLAGS : uint64\_t *Values:* ##### [` ARM_EABI_UNKNOWN `]() enumerator ARM\_EABI\_UNKNOWN = 0x00000000 | (PF\_ARM\_ID << PFLAGS\_BIT) ##### [` ARM_SOFT_FLOAT `]() enumerator ARM\_SOFT\_FLOAT = 0x00000200 | (PF\_ARM\_ID << PFLAGS\_BIT) ##### [` ARM_VFP_FLOAT `]() enumerator ARM\_VFP\_FLOAT = 0x00000400 | (PF\_ARM\_ID << PFLAGS\_BIT) ##### [` ARM_EABI_VER1 `]() enumerator ARM\_EABI\_VER1 = 0x01000000 | (PF\_ARM\_ID << PFLAGS\_BIT) ##### [` ARM_EABI_VER2 `]() enumerator ARM\_EABI\_VER2 = 0x02000000 | (PF\_ARM\_ID << PFLAGS\_BIT) ##### [` ARM_EABI_VER3 `]() enumerator ARM\_EABI\_VER3 = 0x03000000 | (PF\_ARM\_ID << PFLAGS\_BIT) ##### [` ARM_EABI_VER4 `]() enumerator ARM\_EABI\_VER4 = 0x04000000 | (PF\_ARM\_ID << PFLAGS\_BIT) ##### [` ARM_EABI_VER5 `]() enumerator ARM\_EABI\_VER5 = 0x05000000 | (PF\_ARM\_ID << PFLAGS\_BIT) ##### [` HEXAGON_MACH_V2 `]() enumerator HEXAGON\_MACH\_V2 = 0x00000001 | (PF\_HEX\_ID << PFLAGS\_BIT) ##### [` HEXAGON_MACH_V3 `]() enumerator HEXAGON\_MACH\_V3 = 0x00000002 | (PF\_HEX\_ID << PFLAGS\_BIT) ##### [` HEXAGON_MACH_V4 `]() enumerator HEXAGON\_MACH\_V4 = 0x00000003 | (PF\_HEX\_ID << PFLAGS\_BIT) ##### [` HEXAGON_MACH_V5 `]() enumerator HEXAGON\_MACH\_V5 = 0x00000004 | (PF\_HEX\_ID << PFLAGS\_BIT) ##### [` HEXAGON_ISA_V2 `]() enumerator HEXAGON\_ISA\_V2 = 0x00000010 | (PF\_HEX\_ID << PFLAGS\_BIT) ##### [` HEXAGON_ISA_V3 `]() enumerator HEXAGON\_ISA\_V3 = 0x00000020 | (PF\_HEX\_ID << PFLAGS\_BIT) ##### [` HEXAGON_ISA_V4 `]() enumerator HEXAGON\_ISA\_V4 = 0x00000030 | (PF\_HEX\_ID << PFLAGS\_BIT) ##### [` HEXAGON_ISA_V5 `]() enumerator HEXAGON\_ISA\_V5 = 0x00000040 | (PF\_HEX\_ID << PFLAGS\_BIT) ##### [` LOONGARCH_ABI_SOFT_FLOAT `]() enumerator LOONGARCH\_ABI\_SOFT\_FLOAT = 0x1 | (PF\_LOONGARCH\_ID << PFLAGS\_BIT) ##### [` LOONGARCH_ABI_SINGLE_FLOAT `]() enumerator LOONGARCH\_ABI\_SINGLE\_FLOAT = 0x2 | (PF\_LOONGARCH\_ID << PFLAGS\_BIT) ##### [` LOONGARCH_ABI_DOUBLE_FLOAT `]() enumerator LOONGARCH\_ABI\_DOUBLE\_FLOAT = 0x3 | (PF\_LOONGARCH\_ID << PFLAGS\_BIT) ##### [` MIPS_NOREORDER `]() enumerator MIPS\_NOREORDER = 0x00000001 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_PIC `]() enumerator MIPS\_PIC = 0x00000002 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_CPIC `]() enumerator MIPS\_CPIC = 0x00000004 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_ABI2 `]() enumerator MIPS\_ABI2 = 0x00000020 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_32BITMODE `]() enumerator MIPS\_32BITMODE = 0x00000100 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_FP64 `]() enumerator MIPS\_FP64 = 0x00000200 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_NAN2008 `]() enumerator MIPS\_NAN2008 = 0x00000400 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_ABI_O32 `]() enumerator MIPS\_ABI\_O32 = 0x00001000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_ABI_O64 `]() enumerator MIPS\_ABI\_O64 = 0x00002000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_ABI_EABI32 `]() enumerator MIPS\_ABI\_EABI32 = 0x00003000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_ABI_EABI64 `]() enumerator MIPS\_ABI\_EABI64 = 0x00004000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_MACH_3900 `]() enumerator MIPS\_MACH\_3900 = 0x00810000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_MACH_4010 `]() enumerator MIPS\_MACH\_4010 = 0x00820000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_MACH_4100 `]() enumerator MIPS\_MACH\_4100 = 0x00830000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_MACH_4650 `]() enumerator MIPS\_MACH\_4650 = 0x00850000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_MACH_4120 `]() enumerator MIPS\_MACH\_4120 = 0x00870000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_MACH_4111 `]() enumerator MIPS\_MACH\_4111 = 0x00880000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_MACH_SB1 `]() enumerator MIPS\_MACH\_SB1 = 0x008a0000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_MACH_OCTEON `]() enumerator MIPS\_MACH\_OCTEON = 0x008b0000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_MACH_XLR `]() enumerator MIPS\_MACH\_XLR = 0x008c0000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_MACH_OCTEON2 `]() enumerator MIPS\_MACH\_OCTEON2 = 0x008d0000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_MACH_OCTEON3 `]() enumerator MIPS\_MACH\_OCTEON3 = 0x008e0000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_MACH_5400 `]() enumerator MIPS\_MACH\_5400 = 0x00910000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_MACH_5900 `]() enumerator MIPS\_MACH\_5900 = 0x00920000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_MACH_5500 `]() enumerator MIPS\_MACH\_5500 = 0x00980000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_MACH_9000 `]() enumerator MIPS\_MACH\_9000 = 0x00990000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_MACH_LS2E `]() enumerator MIPS\_MACH\_LS2E = 0x00a00000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_MACH_LS2F `]() enumerator MIPS\_MACH\_LS2F = 0x00a10000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_MACH_LS3A `]() enumerator MIPS\_MACH\_LS3A = 0x00a20000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_MICROMIPS `]() enumerator MIPS\_MICROMIPS = 0x02000000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_ARCH_ASE_M16 `]() enumerator MIPS\_ARCH\_ASE\_M16 = 0x04000000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_ARCH_ASE_MDMX `]() enumerator MIPS\_ARCH\_ASE\_MDMX = 0x08000000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_ARCH_1 `]() enumerator MIPS\_ARCH\_1 = 0x00000000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_ARCH_2 `]() enumerator MIPS\_ARCH\_2 = 0x10000000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_ARCH_3 `]() enumerator MIPS\_ARCH\_3 = 0x20000000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_ARCH_4 `]() enumerator MIPS\_ARCH\_4 = 0x30000000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_ARCH_5 `]() enumerator MIPS\_ARCH\_5 = 0x40000000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_ARCH_32 `]() enumerator MIPS\_ARCH\_32 = 0x50000000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_ARCH_64 `]() enumerator MIPS\_ARCH\_64 = 0x60000000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_ARCH_32R2 `]() enumerator MIPS\_ARCH\_32R2 = 0x70000000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_ARCH_64R2 `]() enumerator MIPS\_ARCH\_64R2 = 0x80000000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_ARCH_32R6 `]() enumerator MIPS\_ARCH\_32R6 = 0x90000000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` MIPS_ARCH_64R6 `]() enumerator MIPS\_ARCH\_64R6 = 0xa0000000 | (PF\_MIPS\_ID << PFLAGS\_BIT) ##### [` RISCV_RVC `]() enumerator RISCV\_RVC = 0x00000001 | (PF\_RISCV\_ID << PFLAGS\_BIT) ##### [` RISCV_FLOAT_ABI_SOFT `]() enumerator RISCV\_FLOAT\_ABI\_SOFT = 0x00000000 | (PF\_RISCV\_ID << PFLAGS\_BIT) ##### [` RISCV_FLOAT_ABI_SINGLE `]() enumerator RISCV\_FLOAT\_ABI\_SINGLE = 0x00000002 | (PF\_RISCV\_ID << PFLAGS\_BIT) ##### [` RISCV_FLOAT_ABI_DOUBLE `]() enumerator RISCV\_FLOAT\_ABI\_DOUBLE = 0x00000004 | (PF\_RISCV\_ID << PFLAGS\_BIT) ##### [` RISCV_FLOAT_ABI_QUAD `]() enumerator RISCV\_FLOAT\_ABI\_QUAD = 0x00000006 | (PF\_RISCV\_ID << PFLAGS\_BIT) ##### [` RISCV_FLOAT_ABI_RVE `]() enumerator RISCV\_FLOAT\_ABI\_RVE = 0x00000008 | (PF\_RISCV\_ID << PFLAGS\_BIT) ##### [` RISCV_FLOAT_ABI_TSO `]() enumerator RISCV\_FLOAT\_ABI\_TSO = 0x00000010 | (PF\_RISCV\_ID << PFLAGS\_BIT) --- documentID: "b9cfec9b8fbd73cb490900a3da4fdbe3735d0443354fe1eb32b4e0a18ae34a0d" docname: "formats/elf/index" title: "ELF - LIEF Documentation" description: "ELF binaries can be parsed with LIEF using the lief.ELF.parse() function:" canonical: "https://lief.re/doc/latest/formats/elf/index.html" markdownURL: "https://lief.re/doc/latest/formats/elf/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "23a05b3b71003f15aa07da62983219d705a6377441e807280a58371f860f373e" --- # [ELF]() API - [C++]() - [Python]() - [Rust]() ## [Introduction]() ELF binaries can be parsed with LIEF using the `lief.ELF.parse()` ( [`lief::elf::Binary::parse`]() ; [`lief.ELF.parse()`]() ; [`LIEF::ELF::Parser::parse()`]() ) function: **Python** ```python import lief # Using filepath elf: lief.ELF.Binary | None = lief.ELF.parse("/bin/ls") # Using a Path from pathlib elf: lief.ELF.Binary | None = lief.ELF.parse(pathlib.Path(r"C:\Users\test.elf")) # Using an io object with open("/bin/ssh", "rb") as f: elf: lief.ELF.Binary | None = lief.ELF.parse(f) ``` **C++** ```cpp #include // Using a file path as a std::string std::unique_ptr elf = LIEF::ELF::Parser::parse("/bin/ls"); // Using a vector std::vector my_raw_elf; elf = LIEF::ELF::Parser::parse(my_raw_elf); ``` **Rust** ```rust let elf: lief::elf::Binary = lief::elf::Binary::parse("/bin/ls").unwrap(); ``` > **Note** > > In Python, you can also use [`lief.parse()`]( "lief.parse"), which returns a [`lief.ELF.Binary`]( "lief.ELF.Binary") object. With the parsed ELF binary, you can use the `lief.ELF.Binary` ( [`lief::elf::Binary`]() ; [`lief.ELF.Binary`]() ; [`LIEF::ELF::Binary`]() ) API to inspect or modify the binary itself. **Python** ```python elf: lief.ELF.Binary print(elf.header.entrypoint) for section in elf.sections: print(section.name, len(section.content)) ``` **C++** ```cpp std::unique_ptr elf; std::cout << elf->header().entrypoint(); for (const LIEF::ELF::Section& section : elf->sections()) { std::cout << section.name() << section.content().size() << '\n'; } ``` **Rust** ```rust let elf: &lief::elf::Binary = some_elf; println!("{}", elf.header().entrypoint()); for section in elf.sections() { println!("{} {}", section.name(), section.content().len()); } ``` After modifying a `lief.ELF.Binary` ( [`lief::elf::Binary`]() ; [`lief.ELF.Binary`]() ; [`LIEF::ELF::Binary`]() ) object, you can use the `lief.ELF.Binary.write()` ( [`lief::elf::Binary::write`]() ; [`lief::elf::Binary::write_with_config`]() ; [`lief.ELF.Binary.write()`]() ; [`LIEF::ELF::Binary::write()`]() ) method to write it back to a raw ELF file. **Python** ```python elf: lief.ELF.Binary elf.add_library("libdemo.so") elf.write("new.elf") ``` **C++** ```cpp std::unique_ptr elf; elf->add_library("libdemo.so"); elf->write("new.elf"); ``` **Rust** ```rust let elf: &mut lief::elf::Binary = some_elf; elf.add_library("libdemo.so"); elf.write("new.elf"); ``` > **See also** > > [Binary Abstraction]() You can also use `lief.ELF.Binary.write_to_bytes()` ( [`lief::elf::Binary::write_to_bytes`]() ; [`lief::elf::Binary::write_to_bytes_with_config`]() ; [`lief.ELF.Binary.write_to_bytes()`]() ; [`std::unique_ptr LIEF::ELF::Binary::write(std::ostream &)`]() ; [`std::unique_ptr LIEF::ELF::Binary::write(std::ostream &, const Builder::config_t &)`]() ) to get the new ELF binary as a buffer of bytes: > **Note** > > This API can also take an extra `lief.ELF.Builder.config_t` ( [`lief.ELF.Builder.config_t`]() ; [`LIEF::ELF::Builder::config_t`]() ) parameter. **Python** ```python elf: lief.ELF.Binary new_elf: bytes = elf.write_to_bytes() ``` **C++** ```cpp std::unique_ptr elf; std::ostringstream os; elf->write(os); std::string buffer = os.str(); const auto* start = reinterpret_cast(buffer.data()); size_t size = buffer.size(); ``` **Rust** ```rust let elf: &mut lief::elf::Binary = some_elf; let bytes: Vec = elf.write_to_bytes(); ``` ## [Adding a Section/Segment]() The ELF format uses two tables to represent different slices of the binary: 1. The sections table 2. The segments table While the sections table offers a detailed view of the binary, it is primarily used by the **compiler** and the **linker**. In particular, this table is not required for **loading** and **executing** an ELF file. While the Android loader enforces the presence of a sections table and requires specific sections, this table is not used during the actual loading process. To modify an ELF file to load additional content into memory (e.g., code or data), adding a `lief.ELF.Segment` ( [`lief::elf::Segment`]() ; [`lief.ELF.Segment`]() ; [`LIEF::ELF::Segment`]() ) is recommended over adding a section: **Python** ```python elf: lief.ELF.Binary segment = lief.ELF.Segment() segment.type = lief.ELF.Segment.TYPES.LOAD segment.content = list(b"Hello World") new_segment = elf.add(segment) elf.write("new.elf") ``` **C++** ```cpp std::unique_ptr elf; LIEF::ELF::Segment segment; segment.type(LIEF::ELF::Segment::TYPE::LOAD); segment.content({1, 2, 3}); LIEF::ELF::Segment* new_segment = elf->add(segment); elf->write("new.elf"); ``` **Rust** ```rust let elf: &mut lief::elf::Binary = some_elf; let mut segment = lief::elf::Segment::new(); segment.set_type(lief::elf::segment::Type::LOAD); segment.set_content(&[1, 2, 3]); elf.add_segment(&segment); elf.write("new.elf"); ``` Alternatively, you can create a `lief.ELF.Section` ( [`lief::elf::Section`]() ; [`lief.ELF.Section`]() ; [`LIEF::ELF::Section`]() ), which will **implicitly** create an associated `PT_LOAD` segment: **Python** ```python elf: lief.ELF.Binary section = lief.ELF.Section(".lief_demo") section.content = list(b"Hello World") new_section = elf.add(section, loaded=True) elf.write("new.elf") ``` **C++** ```cpp std::unique_ptr elf; LIEF::ELF::Section section(".lief_demo"); section.content({1, 2, 3}); LIEF::ELF::Section* new_section = elf->add(section, /*loaded=*/true); elf->write("new.elf"); ``` **Rust** ```rust let elf: &mut lief::elf::Binary = some_elf; let section = lief::elf::Section::new_with_content(".lief_demo", &[1, 2, 3]); elf.add_section( §ion, /* loaded= */ true, lief::elf::binary::SecInsertPos::AUTO, ); elf.write("new.elf"); ``` As mentioned above, the segments table is more critical than the sections table from a loading perspective. Therefore, it is more appropriate to explicitly add a new segment rather than adding a section that implicitly adds a segment. On the other hand, for debugging purposes or specialized tools, you might want to add a **non-loaded** section. In this case, the section data is inserted at the end of the binary, immediately after the data wrapped by the segments: **Python** ```python elf: lief.ELF.Binary section = lief.ELF.Section(".metadata") section.content = list(b"version: 1.2.3") # /!\ Note that loaded is set to False here # ------------------------------------------ new_section = elf.add(section, loaded=False) elf.write("new.elf") ``` **C++** ```cpp std::unique_ptr elf; LIEF::ELF::Section section(".metadata"); section.content({1, 2, 3}); LIEF::ELF::Section* new_section = elf->add(section, /*loaded=*/false); elf->write("new.elf"); ``` **Rust** ```rust let elf: &mut lief::elf::Binary = some_elf; let section = lief::elf::Section::new_with_content(".metadata", b"version: 1.2.3"); // /!\ Note that loaded is set to false here // ----------------------------------------- elf.add_section( §ion, /* loaded= */ false, lief::elf::binary::SecInsertPos::AUTO, ); elf.write("new.elf"); ``` See: `lief.ELF.Binary.add()` ( [`lief::elf::Binary::add_section`]() ; [`lief::elf::Binary::add_segment`]() ; [`lief.ELF.Binary.add()`]() ; [`LIEF::ELF::Binary::add()`]() ) for detailed API information. ## [Dump Analysis]() LIEF has the support to process ELF memory dump with `lief.ELF.parse_from_dump()` ( [`lief::elf::Binary::parse_from_dump`]() ; [`lief.ELF.parse_from_dump()`]() ; [`LIEF::ELF::Parser::parse_from_dump()`]() ). This function translates the file offsets referenced by the ELF structures into their location inside the dump, using the base address passed as the second parameter: **Python** ```python # 0x7f9b98e00000 is the (absolute) address at which the dump was mapped elf = lief.ELF.parse_from_dump("module.dump", 0x7F9B98E00000) assert elf is not None for segment in elf.segments: print(segment.type, hex(segment.virtual_address)) ``` **C++** ```cpp auto elf = LIEF::ELF::Parser::parse_from_dump("module.dump", 0x7f9b98e00000); for (const LIEF::ELF::Segment& segment : elf->segments()) { std::cout << to_string(segment.type()) << '\n'; } ``` **Rust** ```rust let elf = lief::elf::Binary::parse_from_dump("module.dump", 0x7f9b_98e0_0000).unwrap(); for segment in elf.segments() { println!("{:?} {:#x}", segment.p_type(), segment.virtual_address()); } ``` > **Note** > > The second parameter **must** be the (absolute) virtual address at which the dump was mapped. It is used to convert the virtual addresses found in the ELF structures back into an offset within the dump. > **Warning** > > Parsing an ELF from a dump is subject to the same limitations as parsing it from memory: the segments (`PT_LOAD`) and the program headers are reliable, but the **section header table is generally not mapped** and the content of the dynamic table (dynamic entries, dynamic symbols and relocations) reflects its *runtime* state and may not be recoverable. Prefer working with the segments when analyzing a dump. ### [Producing a dump with the runtime API]() Such a dump can be produced from a live process thanks to the LIEF [runtime]() and, more precisely, the [Module API](). `lief.runtime.Module.dump()` ( [`lief::runtime::module::Module::dump`]() ; [`lief.runtime.Module.dump()`]() ; [`LIEF::runtime::Module::dump()`]() ) captures the memory of a loaded module (from its imagebase over its virtual size): **Python** ```python # Find the module to dump in the current process mod = lief.runtime.module_from_name("libc.so.6") assert mod is not None # Dump the module's memory into a file (the raw bytes are also returned) data: bytes = mod.dump("module.dump") # and parse it back using the same imagebase: elf = lief.ELF.parse_from_dump(data, mod.imagebase) ``` **C++** ```cpp // Find the module to dump in the current process auto mod = LIEF::runtime::module_from_name("libc.so.6"); // Dump the module's memory into a file (the raw bytes are also returned) std::vector data = mod->dump("module.dump"); auto elf = LIEF::ELF::Parser::parse_from_dump("module.dump", mod->imagebase()); ``` **Rust** ```rust use lief::runtime::Module; let module = lief::runtime::module_from_name("libc.so.6").unwrap(); // Dump the module's memory into a file (the raw bytes are also returned) let data = module.dump_to_file("module.dump"); let elf = lief::elf::Binary::parse_from_dump("module.dump", module.imagebase()).unwrap(); ``` ## [Advanced Parsing/Writing]() `lief.ELF.parse()` ( [`lief::elf::Binary::parse`]() ; [`lief.ELF.parse()`]() ; [`LIEF::ELF::Parser::parse()`]() ) can take an extra `lief.ELF.ParserConfig` ( [`lief.ELF.ParserConfig`]() ; [`LIEF::ELF::ParserConfig`]() ) parameter to specify parts of the ELF format to skip during parsing. > **Warning** > > Generally, `lief.ELF.Binary.write()` ( [`lief::elf::Binary::write`]() ; [`lief::elf::Binary::write_with_config`]() ; [`lief.ELF.Binary.write()`]() ; [`LIEF::ELF::Binary::write()`]() ) requires a **complete** initial parsing of the ELF file. Similarly, `lief.ELF.Binary.write()` ( [`lief::elf::Binary::write`]() ; [`lief::elf::Binary::write_with_config`]() ; [`lief.ELF.Binary.write()`]() ; [`LIEF::ELF::Binary::write()`]() ) can also take an extra `lief.ELF.Builder.config_t` ( [`lief.ELF.Builder.config_t`]() ; [`LIEF::ELF::Builder::config_t`]() ) to specify which parts of the ELF should be rebuilt. **Python** ```python parser_config = lief.ELF.ParserConfig() parser_config.parse_overlay = False elf = lief.ELF.parse("my.elf", parser_config) assert isinstance(elf, lief.ELF.Binary) builder_config = lief.ELF.Builder.config_t() builder_config.gnu_hash = False elf.write("new.elf", builder_config) ``` **C++** ```cpp LIEF::ELF::ParserConfig parser_config; parser_config.parse_overlay = false; auto elf = LIEF::ELF::Parser::parse("my.elf", parser_config); LIEF::ELF::Builder::config_t builder_config; builder_config.gnu_hash = false; elf->write("new.elf", builder_config); ``` **Rust** ```rust let mut parser_config = lief::elf::ParserConfig::default(); parser_config.parse_overlay = false; let mut elf = lief::elf::parse_with_config("my.elf", &parser_config).unwrap(); let mut builder_config = lief::elf::builder::Config::default(); builder_config.gnu_hash = false; elf.write_with_config("new.elf", builder_config); ``` ## [DWARF Support]() If the binary embeds DWARF debug information, you can use `lief.Binary.debug_info()` ( [`lief::elf::Binary::debug_info`]() ; [`lief.Binary.debug_info`]() ; [`LIEF::Binary::debug_info()`]() ) to access the underlying `lief.dwarf.DebugInfo` ( [`lief::dwarf::DebugInfo`]() ; [`lief.dwarf.DebugInfo`]() ; [`LIEF::dwarf::DebugInfo`]() ) object. Note that this support is only available in the [Extended]() version of LIEF. ## [R\[UN\]PATH Modification]() LIEF provides comprehensive facilities for manipulating a binary’s RPATH/RUNPATH. > **DT\_RPATH vs DT\_RUNPATH** > > `DT_RPATH` and `DT_RUNPATH` are both dynamic tags used to specify runtime library search paths. > > `DT_RPATH` is now considered legacy because it does not respect the precedence of the `LD_LIBRARY_PATH` environment variable. This means that if `LD_LIBRARY_PATH` is set to a valid directory where the library can be found, it will be ignored in favor of the `DT_RPATH` value. Therefore, the `DT_RUNPATH` tag should be preferred over `DT_RPATH`. > > Note that if both tags are present, the loader will use the `DT_RUNPATH` entry over the legacy `DT_RPATH`. The `DT_RPATH` tag is represented by the `lief.ELF.DynamicEntryRpath` ( [`lief::elf::dynamic::Rpath`]() ; [`lief.ELF.DynamicEntryRpath`]() ; [`LIEF::ELF::DynamicEntryRpath`]() ) interface, and the `DT_RUNPATH` tag by `lief.ELF.DynamicEntryRunPath` ( [`lief::elf::dynamic::RunPath`]() ; [`lief.ELF.DynamicEntryRunPath`]() ; [`LIEF::ELF::DynamicEntryRunPath`]() ). The RPATH/RUNPATH modifications supported by LIEF include: **Adding a new entry** **Python** ```python elf: lief.ELF.Binary runpath = lief.ELF.DynamicEntryRunPath("$ORIGIN:/opt/lib64") elf.add(runpath) other_runpath = lief.ELF.DynamicEntryRunPath(["$ORIGIN", "/opt/lib64"]) elf.add(other_runpath) elf.write("updated.elf") ``` **C++** ```cpp std::unique_ptr elf; LIEF::ELF::DynamicEntryRunPath runpath("$ORIGIN:/opt/lib64"); elf->add(runpath); LIEF::ELF::DynamicEntryRunPath other_runpath( std::vector{"$ORIGIN", "/opt/lib64"} ); elf->add(other_runpath); elf->write("updated.elf"); ``` **Rust** ```rust let elf: &mut lief::elf::Binary = some_elf; let runpath = lief::elf::dynamic::RunPath::new("$ORIGIN:/opt/lib64"); elf.add_dynamic_entry(&runpath); let other_runpath = lief::elf::dynamic::RunPath::with_paths(&["$ORIGIN", "/opt/lib64"]); elf.add_dynamic_entry(&other_runpath); let output = PathBuf::from("updated.elf"); elf.write(output.as_path()); ``` **Changing an entry** **Python** ```python elf: lief.ELF.Binary runpath = elf.get(lief.ELF.DynamicEntry.TAG.RUNPATH) assert runpath is not None runpath.runpath = "$ORIGIN:/opt/lib64" runpath.append("lib-x86_64-gnu") elf.write("updated.elf") ``` **C++** ```cpp std::unique_ptr elf; auto* runpath = elf->get(LIEF::ELF::DynamicEntry::TAG::RUNPATH) ->cast(); assert(runpath != nullptr); runpath->runpath("$ORIGIN:/opt/lib64"); runpath->append("lib-x86_64-gnu"); elf->write("updated.elf"); ``` **Rust** ```rust let elf: &mut lief::elf::Binary = some_elf; if let Some(dynamic::Entries::RunPath(mut runpath)) = elf.dynamic_entry_by_tag(dynamic::Tag::RUNPATH) { runpath.set_runpath("$ORIGIN:/opt/lib64"); runpath.append("lib-x86_64-gnu"); } let output = PathBuf::from("updated.elf"); elf.write(output.as_path()); ``` **Removing entries** **Python** ```python elf: lief.ELF.Binary # Remove **all** DT_RUNPATH entries elf.remove(lief.ELF.DynamicEntry.TAG.RUNPATH) # Remove all entries that contain '$ORIGIN' to_remove: list[lief.ELF.DynamicEntryRunPath] = [] for dt_entry in elf.dynamic_entries: if not isinstance(dt_entry, lief.ELF.DynamicEntryRunPath): continue if "$ORIGIN" in dt_entry.runpath: to_remove.append(dt_entry) for entry in to_remove: elf.remove(entry) elf.write("updated.elf") ``` **C++** ```cpp std::unique_ptr elf; // Remove **all** DT_RUNPATH entries elf->remove(LIEF::ELF::DynamicEntry::TAG::RUNPATH); // Remove all entries that contain '$ORIGIN' std::vector to_remove; for (DynamicEntry& entry : elf->dynamic_entries()) { if (auto* dt_entry = entry.cast()) { if (dt_entry->runpath().find("$ORIGIN") != std::string::npos) { to_remove.push_back(dt_entry); } } } for (LIEF::ELF::DynamicEntryRunPath* entry : to_remove) { elf->remove(*entry); } elf->write("updated.elf"); ``` **Rust** ```rust let elf: &mut lief::elf::Binary = some_elf; // Remove **all** DT_RUNPATH entries elf.remove_dynamic_entries_by_tag(dynamic::Tag::RUNPATH); // Remove all entries that contain '$ORIGIN' elf.remove_dynamic_entry_if(|e| { if let dynamic::Entries::RunPath(runpath) = e { return runpath.runpath().contains("$ORIGIN"); } false }); let output = PathBuf::from("updated.elf"); elf.write(output.as_path()); ``` You can also check the [lief-patchelf]() section for a command-line interface. ## [Symbol Versions]() The ELF format supports symbol versioning, allowing multiple versions of the same function or variable to coexist within a single shared object. During compilation, the linker selects the appropriate symbols and versions based on the libraries provided as input. For example, if a program uses the `printf` function and is linked with a version of `libc.so` that exposes `printf@@GLIBC_2.40`, the compiled executable will require at least that version of the `libc` to run. These versioning requirements can be problematic when creating executables or libraries intended for a wide range of Linux distributions. The **best way** to ensure maximum compatibility is to target the minimum supported version of glibc. For instance, if you aim to support Linux distributions with at least glibc version `2.28` (released in 2018), you should specifically provide that version of `libc.so` during linking: ```console $ ld --sysroot=/sysroot/glibc-2.28/ my_program.o -o my_program.elf $ ld -L /sysroot/glibc-2.28/lib64/ my_program.o -o my_program.elf -lc ``` In situations where you lack control over the link step, you may want to change the versioning **post-compilation**. LIEF can be used in these situations to perform the following modifications on symbol versions. **Remove the version for a specific symbol** In this example, we remove the version attached to the `printf` symbol by setting the versioning as global (the default setting for imported functions). **Python** ```python elf: lief.ELF.Binary sym = elf.get_dynamic_symbol("printf") assert sym is not None and sym.symbol_version is not None sym.symbol_version.as_global() elf.write("updated.elf") ``` **C++** ```cpp std::unique_ptr elf; LIEF::ELF::Symbol* sym = elf->get_dynamic_symbol("printf"); assert(sym != nullptr); sym->symbol_version()->as_global(); elf->write("updated.elf"); ``` **Rust** ```rust let elf: &mut lief::elf::Binary = some_elf; if let Some(sym) = elf.dynamic_symbol_by_name("printf") && let Some(mut symver) = sym.symbol_version() { symver.as_global(); } let output = PathBuf::from("updated.elf"); elf.write(output.as_path()); ``` **Remove all the versions for a specific library** In this example, we remove all the symbol versions associated with an imported library (`libm.so.6`): **Python** ```python elf: lief.ELF.Binary elf.remove_version_requirement("libm.so.6") elf.write("updated.elf") ``` **C++** ```cpp std::unique_ptr elf; elf->remove_version_requirement("libm.so.6"); elf->write("updated.elf"); ``` **Rust** ```rust let elf: &mut lief::elf::Binary = some_elf; elf.remove_version_requirement("libm.so.6"); let output = PathBuf::from("updated.elf"); elf.write(output.as_path()); ``` **Before** ```console $ readelf -V input.elf Version symbols section '.gnu.version' contains 48 entries: Addr: 00000000000009bc Offset: 0x0009bc Link: 6 (.dynsym) 000: 0 (*local*) 2 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 2 (GLIBC_2.2.5) 004: 2 (GLIBC_2.2.5) 0 (*local*) 4 (GLIBC_2.17) 3 (GLIBC_2.2.5) 008: 2 (GLIBC_2.2.5) 5 (GLIBC_2.27) 2 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 00c: 3 (GLIBC_2.2.5) 2 (GLIBC_2.2.5) 6 (GLIBC_2.4) 2 (GLIBC_2.2.5) 010: 3 (GLIBC_2.2.5) 2 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 014: 2 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 0 (*local*) 018: 3 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 2 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 01c: 3 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 2 (GLIBC_2.2.5) 2 (GLIBC_2.2.5) 020: 2 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 2 (GLIBC_2.2.5) 2 (GLIBC_2.2.5) 024: 3 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 2 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 028: 3 (GLIBC_2.2.5) 0 (*local*) 3 (GLIBC_2.2.5) 3 (GLIBC_2.2.5) 02c: 3 (GLIBC_2.2.5) 7 (GLIBC_2.29) 2 (GLIBC_2.2.5) 2 (GLIBC_2.2.5) Version needs section '.gnu.version_r' contains 2 entries: Addr: 0000000000000a20 Offset: 0x000a20 Link: 7 (.dynstr) 0x0000: Version: 1 File: libm.so.6 Cnt: 3 0x0010: Name: GLIBC_2.29 Flags: none Version: 7 0x0020: Name: GLIBC_2.27 Flags: none Version: 5 0x0030: Name: GLIBC_2.2.5 Flags: none Version: 3 0x0040: Version: 1 File: libc.so.6 Cnt: 3 0x0050: Name: GLIBC_2.4 Flags: none Version: 6 0x0060: Name: GLIBC_2.17 Flags: none Version: 4 0x0070: Name: GLIBC_2.2.5 Flags: none Version: 2 ``` **After** ```console $ readelf -V updated.elf Version symbols section '.gnu.version' contains 48 entries: Addr: 00000000000009bc Offset: 0x0009bc Link: 6 (.dynsym) 000: 0 (*local*) 1 (*global*) 1 (*global*) 1 (*global*) 004: 1 (*global*) 0 (*local*) 4 (GLIBC_2.17) 1 (*global*) 008: 1 (*global*) 1 (*global*) 1 (*global*) 1 (*global*) 00c: 1 (*global*) 1 (*global*) 6 (GLIBC_2.4) 1 (*global*) 010: 1 (*global*) 1 (*global*) 1 (*global*) 1 (*global*) 014: 1 (*global*) 1 (*global*) 1 (*global*) 0 (*local*) 018: 1 (*global*) 1 (*global*) 1 (*global*) 1 (*global*) 01c: 1 (*global*) 1 (*global*) 1 (*global*) 1 (*global*) 020: 1 (*global*) 1 (*global*) 1 (*global*) 1 (*global*) 024: 1 (*global*) 1 (*global*) 1 (*global*) 1 (*global*) 028: 1 (*global*) 0 (*local*) 1 (*global*) 1 (*global*) 02c: 1 (*global*) 1 (*global*) 1 (*global*) 1 (*global*) Version needs section '.gnu.version_r' contains 1 entries: Addr: 0000000000000a20 Offset: 0x000a20 Link: 7 (.dynstr) 0x0000: Version: 1 File: libc.so.6 Cnt: 3 0x0010: Name: GLIBC_2.4 Flags: none Version: 6 0x0020: Name: GLIBC_2.17 Flags: none Version: 4 0x0030: Name: GLIBC_2.2.5 Flags: none Version: 2 ``` --- documentID: "287ebd41de445d5debb713a6e2e1b79005802c3b5e9e74b251bcf63a8791463b" docname: "formats/elf/python" title: "ELF Python API - LIEF Documentation" description: "ELF Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/elf/python.html" markdownURL: "https://lief.re/doc/latest/formats/elf/python.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "f30b5be9fb304898df4412ea4647f7c9b6a19ca335ea8ec7cd869b5385fd5410" --- # [Python]() ## [Parser]() ### [` lief.ELF.parse `]() lief.ELF.parse(*obj: str | io.IOBase | os.PathLike | bytes | list[int]*, *config: [lief.ELF.ParserConfig]( "lief.ELF.ParserConfig")*) → [lief.ELF.Binary]( "lief.ELF.Binary") | None Parse the ELF binary from the given Python object and return a [`lief.ELF.Binary`]( "lief.ELF.Binary") object The second argument is an optional configuration ([`ParserConfig`]( "lief.ELF.ParserConfig")) that can be used to define which part(s) of the ELF should be parsed or skipped. ### [` lief.ELF.ParserConfig `]() class lief.ELF.ParserConfig(*self*) Bases: `object` This class is used to tweak the ELF Parser #### [` DYNSYM_COUNT `]() class DYNSYM\_COUNT(*\*values*) Bases: `Enum` ##### [` AUTO `]() AUTO = 0 ##### [` HASH `]() HASH = 2 ##### [` RELOCATIONS `]() RELOCATIONS = 3 ##### [` SECTION `]() SECTION = 1 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.ParserConfig.DYNSYM\_COUNT]( "lief.ELF.ParserConfig.DYNSYM_COUNT") = <nanobind.nb\_func object> #### [` all `]() all = <lief.\_lief.ELF.ParserConfig object> #### [` count_mtd `]() property count\_mtd → [lief.ELF.ParserConfig.DYNSYM\_COUNT]( "lief.ELF.ParserConfig.DYNSYM_COUNT") The `DYNSYM_COUNT_METHODS` to use for counting the dynamic symbols For *weird* binaries (e.g sectionless) you can choose the method for counting dynamic symbols (`lief.ELF.DYNSYM_COUNT_METHODS`). By default, the value is set to `lief.ELF.DYNSYM_COUNT_METHODS.COUNT_AUTO` #### [` page_size `]() property page\_size → int Memory page size if the binary uses a non-standard value. For instance, SPARCV9 binary can use a page size from 0x2000 to 0x100000. #### [` parse_dyn_symbols `]() property parse\_dyn\_symbols → bool Whether dynamic symbols (those from .dynsym) should be parsed #### [` parse_notes `]() property parse\_notes → bool Whether ELF notes information should be parsed #### [` parse_overlay `]() property parse\_overlay → bool Whether the overlay data should be parsed #### [` parse_relocations `]() property parse\_relocations → bool Whether relocations (including plt-like relocations) should be parsed. #### [` parse_symbol_versions `]() property parse\_symbol\_versions → bool Whether versioning symbols should be parsed #### [` parse_symtab_symbols `]() property parse\_symtab\_symbols → bool Whether debug symbols (those from .symtab) should be parsed --- ## [Binary]() ### [` lief.ELF.Binary `]() class lief.ELF.Binary Bases: [`Binary`]( "lief._lief.Binary") Class which represents an ELF binary #### [` PHDR_RELOC `]() class PHDR\_RELOC(*\*values*) Bases: `Enum` This enum describes the different ways to relocate the segments table. ##### [` AUTO `]() AUTO = 0 ##### [` BSS_END `]() BSS\_END = 2 ##### [` FILE_END `]() FILE\_END = 3 ##### [` PIE_SHIFT `]() PIE\_SHIFT = 1 ##### [` SEGMENT_GAP `]() SEGMENT\_GAP = 4 #### [` SEC_INSERT_POS `]() class SEC\_INSERT\_POS(*\*values*) Bases: `Enum` This enum defines where the content of a newly added section should be inserted. ##### [` AUTO `]() AUTO = 0 ##### [` POST_SECTION `]() POST\_SECTION = 2 ##### [` POST_SEGMENT `]() POST\_SEGMENT = 1 #### [` addaddaddadd `]() add(*self*, *arg: [lief.\_lief.ELF.DynamicEntry]( "lief._lief.ELF.DynamicEntry")*, */*) → [lief.\_lief.ELF.DynamicEntry]( "lief._lief.ELF.DynamicEntry") **add(*self*, *section: [lief.\_lief.ELF.Section]( "lief._lief.ELF.Section")*, *loaded: bool = True*, *pos: [lief.\_lief.ELF.Binary.SEC\_INSERT\_POS]( "lief._lief.ELF.Binary.SEC_INSERT_POS") = SEC\_INSERT\_POS.AUTO*) → [lief.\_lief.ELF.Section]( "lief._lief.ELF.Section") | None **add(*self*, *segment: [lief.\_lief.ELF.Segment]( "lief._lief.ELF.Segment")*, *base: int = 0*) → [lief.\_lief.ELF.Segment]( "lief._lief.ELF.Segment") | None **add(*self*, *note: [lief.\_lief.ELF.Note]( "lief._lief.ELF.Note")*) → [lief.\_lief.ELF.Note]( "lief._lief.ELF.Note")****** Overloaded function. 1. `add(self, arg: lief._lief.ELF.DynamicEntry, /) -> lief._lief.ELF.DynamicEntry` dynamic\_entry 2. `add(self, section: lief._lief.ELF.Section, loaded: bool = True, pos: lief._lief.ELF.Binary.SEC_INSERT_POS = SEC_INSERT_POS.AUTO) -> lief._lief.ELF.Section | None` > Add the given [`Section`]( "lief.ELF.Section") to the binary. > > If the section does not aim at being loaded in memory, the `loaded` parameter has to be set to `False` (default: `True`) 3. `add(self, segment: lief._lief.ELF.Segment, base: int = 0) -> lief._lief.ELF.Segment | None` Add a new [`Segment`]( "lief.ELF.Segment") in the binary 4. `add(self, note: lief._lief.ELF.Note) -> lief._lief.ELF.Note` Add a new [`Note`]( "lief.ELF.Note") in the binary #### [` add_dynamic_relocation `]() add\_dynamic\_relocation(*self*, *relocation: [lief.\_lief.ELF.Relocation]( "lief._lief.ELF.Relocation")*) → [lief.\_lief.ELF.Relocation]( "lief._lief.ELF.Relocation") Add a new *dynamic* relocation. We consider a dynamic relocation as a relocation which is not plt-related. See: [`lief.ELF.Binary.add_pltgot_relocation()`]( "lief.ELF.Binary.add_pltgot_relocation") #### [` add_dynamic_symbol `]() add\_dynamic\_symbol(*self*, *symbol: [lief.\_lief.ELF.Symbol]( "lief._lief.ELF.Symbol")*, *symbol\_version: [lief.\_lief.ELF.SymbolVersion]( "lief._lief.ELF.SymbolVersion") | None = None*) → [lief.\_lief.ELF.Symbol]( "lief._lief.ELF.Symbol") Add a **dynamic** [`Symbol`]( "lief.ELF.Symbol") to the binary The function also takes an optional [`lief.ELF.SymbolVersion`]( "lief.ELF.SymbolVersion") #### [` add_exported_function `]() add\_exported\_function(*self*, *address: int*, *name: str = ''*) → [lief.\_lief.ELF.Symbol]( "lief._lief.ELF.Symbol") Create a symbol for the function at the given `address` and create an export #### [` add_library `]() add\_library(*self*, *library\_name: str*) → [lief.\_lief.ELF.DynamicEntryLibrary]( "lief._lief.ELF.DynamicEntryLibrary") Add a library with the given name as dependency #### [` add_object_relocation `]() add\_object\_relocation(*self*, *relocation: [lief.\_lief.ELF.Relocation]( "lief._lief.ELF.Relocation")*, *section: [lief.\_lief.ELF.Section]( "lief._lief.ELF.Section")*) → [lief.\_lief.ELF.Relocation]( "lief._lief.ELF.Relocation") | None Add relocation for object file (.o) The first parameter is the relocation to add while the second parameter is the [`Section`]( "lief.ELF.Section") associated with the relocation. If there is an error, this function returns a nullptr. Otherwise, it returns the relocation added. #### [` add_pltgot_relocation `]() add\_pltgot\_relocation(*self*, *relocation: [lief.\_lief.ELF.Relocation]( "lief._lief.ELF.Relocation")*) → [lief.\_lief.ELF.Relocation]( "lief._lief.ELF.Relocation") Add a .plt.got relocation. This kind of relocation is usually associated with a PLT stub that aims at resolving the underlying symbol. See: [`lief.ELF.Binary.add_dynamic_relocation()`]( "lief.ELF.Binary.add_dynamic_relocation") #### [` add_symtab_symbol `]() add\_symtab\_symbol(*self*, *symbol: [lief.\_lief.ELF.Symbol]( "lief._lief.ELF.Symbol")*) → [lief.\_lief.ELF.Symbol]( "lief._lief.ELF.Symbol") Add a **static** [`Symbol`]( "lief.ELF.Symbol") to the binary #### [` dtor_functions `]() property dtor\_functions → list[[lief.Function]( "lief.Function")] List of the binary destructors (typically, the functions located in the `.fini_array`) #### [` dynamic_entries `]() property dynamic\_entries → lief.ELF.Binary.it\_dynamic\_entries Return an iterator to [`DynamicEntry`]( "lief.ELF.DynamicEntry") entries #### [` dynamic_relocations `]() property dynamic\_relocations → lief.ELF.Binary.it\_filter\_relocation Return an iterator over dynamic [`Relocation`]( "lief.ELF.Relocation") #### [` dynamic_symbols `]() property dynamic\_symbols → lief.ELF.Binary.it\_symbols Return an iterator to dynamic [`Symbol`]( "lief.ELF.Symbol") #### [` dynsym_idxdynsym_idx `]() dynsym\_idx(*self*, *name: str*) → int **dynsym\_idx(*self*, *symbol: [lief.\_lief.ELF.Symbol]( "lief._lief.ELF.Symbol")*) → int** Overloaded function. 1. `dynsym_idx(self, name: str) -> int` > Get the symbol index in the **dynamic** symbol from the given name or return -1 if the symbol does not exist. 2. `dynsym_idx(self, symbol: lief._lief.ELF.Symbol) -> int` > Get the symbol index in the **dynamic** symbol table for the given symbol or return -1 if the symbol does not exist #### [` eof_offset `]() property eof\_offset → int Return the last offset used by the ELF binary according to both, the sections table and the segments table. #### [` export_symbolexport_symbol `]() export\_symbol(*self*, *symbol: [lief.\_lief.ELF.Symbol]( "lief._lief.ELF.Symbol")*) → [lief.\_lief.ELF.Symbol]( "lief._lief.ELF.Symbol") **export\_symbol(*self*, *symbol\_name: str*, *value: int = 0*) → [lief.\_lief.ELF.Symbol]( "lief._lief.ELF.Symbol")** Overloaded function. 1. `export_symbol(self, symbol: lief._lief.ELF.Symbol) -> lief._lief.ELF.Symbol` Export the given symbol and create an entry if it doesn’t exist 2. `export_symbol(self, symbol_name: str, value: int = 0) -> lief._lief.ELF.Symbol` Export the symbol with the given name and create an entry if it doesn’t exist #### [` exported_symbols `]() property exported\_symbols → lief.ELF.Binary.it\_filter\_symbols Return dynamic [`Symbol`]( "lief.ELF.Symbol") which are exported #### [` extendextend `]() extend(*self*, *segment: [lief.\_lief.ELF.Segment]( "lief._lief.ELF.Segment")*, *size: int*) → [lief.\_lief.ELF.Segment]( "lief._lief.ELF.Segment") | None **extend(*self*, *segment: [lief.\_lief.ELF.Section]( "lief._lief.ELF.Section")*, *size: int*) → [lief.\_lief.ELF.Section]( "lief._lief.ELF.Section") | None** Overloaded function. 1. `extend(self, segment: lief._lief.ELF.Segment, size: int) -> lief._lief.ELF.Segment | None` Extend the given [`Segment`]( "lief.ELF.Segment") by the given size 2. `extend(self, segment: lief._lief.ELF.Section, size: int) -> lief._lief.ELF.Section | None` Extend the given [`Section`]( "lief.ELF.Section") by the given size #### [` find_version_requirement `]() find\_version\_requirement(*self*, *libname: str*) → [lief.\_lief.ELF.SymbolVersionRequirement]( "lief._lief.ELF.SymbolVersionRequirement") | None Try to find the [`SymbolVersionRequirement`]( "lief.ELF.SymbolVersionRequirement") associated with the given library name (e.g. `libc.so.6`) #### [` functions `]() property functions → list[[lief.Function]( "lief.Function")] List of the functions found in the binary #### [` getgetgetget `]() get(*self*, *tag: [lief.\_lief.ELF.DynamicEntry.TAG]( "lief._lief.ELF.DynamicEntry.TAG")*) → [lief.\_lief.ELF.DynamicEntry]( "lief._lief.ELF.DynamicEntry") | None **get(*self*, *type: [lief.\_lief.ELF.Segment.TYPE]( "lief._lief.ELF.Segment.TYPE")*) → [lief.\_lief.ELF.Segment]( "lief._lief.ELF.Segment") | None **get(*self*, *type: [lief.\_lief.ELF.Note.TYPE]( "lief._lief.ELF.Note.TYPE")*) → [lief.\_lief.ELF.Note]( "lief._lief.ELF.Note") | None **get(*self*, *type: [lief.\_lief.ELF.Section.TYPE]( "lief._lief.ELF.Section.TYPE")*) → [lief.\_lief.ELF.Section]( "lief._lief.ELF.Section") | None****** Overloaded function. 1. `get(self, tag: lief._lief.ELF.DynamicEntry.TAG) -> lief._lief.ELF.DynamicEntry | None` > Return the first binary’s [`DynamicEntry`]( "lief.ELF.DynamicEntry") from the given [`TAG`]( "lief.ELF.DynamicEntry.TAG"). > > It returns None if the dynamic entry can’t be found. 2. `get(self, type: lief._lief.ELF.Segment.TYPE) -> lief._lief.ELF.Segment | None` > Return the first binary’s [`Segment`]( "lief.ELF.Segment") from the given `SEGMENT_TYPES` > > It returns None if the segment can’t be found. 3. `get(self, type: lief._lief.ELF.Note.TYPE) -> lief._lief.ELF.Note | None` > Return the first binary’s [`Note`]( "lief.ELF.Note") from the given [`TYPE`]( "lief.ELF.Note.TYPE"). > > It returns None if the note can’t be found. 4. `get(self, type: lief._lief.ELF.Section.TYPE) -> lief._lief.ELF.Section | None` > Return the first binary’s [`Section`]( "lief.ELF.Section") from the given `ELF_SECTION_TYPES` > > It returns None if the section can’t be found. #### [` get_dynamic_symbol `]() get\_dynamic\_symbol(*self*, *symbol\_name: str*) → [lief.\_lief.ELF.Symbol]( "lief._lief.ELF.Symbol") | None Get the dynamic symbol from the given name. It returns None if it can’t be found. #### [` get_library `]() get\_library(*self*, *library\_name: str*) → [lief.\_lief.ELF.DynamicEntryLibrary]( "lief._lief.ELF.DynamicEntryLibrary") | None Return the [`DynamicEntryLibrary`]( "lief.ELF.DynamicEntryLibrary") with the given `name` It returns None if the library can’t be found. #### [` get_relocated_dynamic_array `]() get\_relocated\_dynamic\_array(*self*, *array\_tag: [lief.\_lief.ELF.DynamicEntry.TAG]( "lief._lief.ELF.DynamicEntry.TAG")*) → list[int] Return the array defined by the given tag (e.g. [`INIT_ARRAY`]( "lief.ELF.DynamicEntry.TAG.INIT_ARRAY")) with relocations applied (if any) #### [` get_relocationget_relocationget_relocation `]() get\_relocation(*self*, *symbol\_name: str*) → [lief.\_lief.ELF.Relocation]( "lief._lief.ELF.Relocation") | None **get\_relocation(*self*, *symbol: [lief.\_lief.ELF.Symbol]( "lief._lief.ELF.Symbol")*) → [lief.\_lief.ELF.Relocation]( "lief._lief.ELF.Relocation") | None **get\_relocation(*self*, *address: int*) → [lief.\_lief.ELF.Relocation]( "lief._lief.ELF.Relocation") | None**** Overloaded function. 1. `get_relocation(self, symbol_name: str) -> lief._lief.ELF.Relocation | None` Return the [`Relocation`]( "lief.ELF.Relocation") associated with the given symbol name 2. `get_relocation(self, symbol: lief._lief.ELF.Symbol) -> lief._lief.ELF.Relocation | None` Return the [`Relocation`]( "lief.ELF.Relocation") associated with the given [`Symbol`]( "lief.ELF.Symbol") 3. `get_relocation(self, address: int) -> lief._lief.ELF.Relocation | None` Return the [`Relocation`]( "lief.ELF.Relocation") associated with the given address #### [` get_section `]() get\_section(*self*, *section\_name: str*) → [lief.\_lief.ELF.Section]( "lief._lief.ELF.Section") | None Return the [`Section`]( "lief.ELF.Section") with the given `name` It returns None if the section can’t be found. #### [` get_section_idxget_section_idx `]() get\_section\_idx(*self*, *arg: [lief.\_lief.ELF.Section]( "lief._lief.ELF.Section")*, */*) → int | [lief.\_lief.lief\_errors]( "lief._lief.lief_errors") **get\_section\_idx(*self*, *arg: str*, */*) → int | [lief.\_lief.lief\_errors]( "lief._lief.lief_errors")** Overloaded function. 1. `get_section_idx(self, arg: lief._lief.ELF.Section, /) -> Union[int, lief._lief.lief_errors]` Find the index of the section given in the first parameter 2. `get_section_idx(self, arg: str, /) -> Union[int, lief._lief.lief_errors]` Find the index of the section with the name given in the first parameter #### [` get_strings `]() get\_strings(*self*, *min\_size: int = 5*) → list[str] Return list of strings used in the current ELF file with a minimal size given in first parameter (Default: 5) It looks for strings in the `.rodata` section #### [` get_symtab_symbol `]() get\_symtab\_symbol(*self*, *symbol\_name: str*) → [lief.\_lief.ELF.Symbol]( "lief._lief.ELF.Symbol") | None Get the **static** symbol from the given `name`. It returns None if it can’t be found. #### [` gnu_hash `]() property gnu\_hash → [lief.ELF.GnuHash]( "lief.ELF.GnuHash") | None Return the [`GnuHash`]( "lief.ELF.GnuHash") object Hashes are used by the loader to speed up symbol resolution (GNU Version) #### [` hashashashas `]() has(*self*, *tag: [lief.\_lief.ELF.DynamicEntry.TAG]( "lief._lief.ELF.DynamicEntry.TAG")*) → bool **has(*self*, *type: [lief.\_lief.ELF.Segment.TYPE]( "lief._lief.ELF.Segment.TYPE")*) → bool **has(*self*, *type: [lief.\_lief.ELF.Note.TYPE]( "lief._lief.ELF.Note.TYPE")*) → bool **has(*self*, *type: [lief.\_lief.ELF.Section.TYPE]( "lief._lief.ELF.Section.TYPE")*) → bool****** Overloaded function. 1. `has(self, tag: lief._lief.ELF.DynamicEntry.TAG) -> bool` > Check if there exists a [`DynamicEntry`]( "lief.ELF.DynamicEntry") with the given [`TAG`]( "lief.ELF.DynamicEntry.TAG") 2. `has(self, type: lief._lief.ELF.Segment.TYPE) -> bool` Check if a [`Segment`]( "lief.ELF.Segment") of *type* (`SEGMENT_TYPES`) exists 3. `has(self, type: lief._lief.ELF.Note.TYPE) -> bool` Check if a [`Note`]( "lief.ELF.Note") of *type* ([`TYPE`]( "lief.ELF.Note.TYPE")) exists 4. `has(self, type: lief._lief.ELF.Section.TYPE) -> bool` Check if a [`Section`]( "lief.ELF.Section") of *type* (`SECTION_TYPES`) exists #### [` has_dynamic_symbol `]() has\_dynamic\_symbol(*self*, *symbol\_name: str*) → bool Check if the symbol with the given `name` exists in the **dynamic** symbol table #### [` has_interpreter `]() property has\_interpreter → bool Check if the binary uses a loader (also named linker or interpreter) #### [` has_library `]() has\_library(*self*, *library\_name: str*) → bool Check if the given library name exists in the current binary #### [` has_notes `]() property has\_notes → bool `True` if the binary contains notes #### [` has_overlay `]() property has\_overlay → bool True if data are appended to the end of the binary #### [` has_section `]() has\_section(*self*, *section\_name: str*) → bool Check if a [`Section`]( "lief.ELF.Section") with the given name exists in the binary #### [` has_section_with_offset `]() has\_section\_with\_offset(*self*, *offset: int*) → bool Check if a [`Section`]( "lief.ELF.Section") that encompasses the given offset exists #### [` has_section_with_va `]() has\_section\_with\_va(*self*, *virtual\_address: int*) → bool Check if a [`Section`]( "lief.ELF.Section") that encompasses the given virtual address exists #### [` has_symtab_symbol `]() has\_symtab\_symbol(*self*, *symbol\_name: str*) → bool Check if the symbol with the given `name` exists in the **static** symbol table #### [` header `]() property header → [lief.ELF.Header]( "lief.ELF.Header") Return [`Header`]( "lief.ELF.Header") object #### [` imagebase `]() property imagebase → int Return the program image base. (e.g. `0x400000`) #### [` imported_symbols `]() property imported\_symbols → lief.ELF.Binary.it\_filter\_symbols Return dynamic [`Symbol`]( "lief.ELF.Symbol") which are imported #### [` interpreter `]() property interpreter → str ELF interpreter (loader) if any. (e.g. `/lib64/ld-linux-x86-64.so.2`) #### [` is_pie `]() property is\_pie → bool Check if the binary has been compiled with -fpie -pie flags To do so we check if there is a PT\_INTERP segment and if the binary type is ET\_DYN (Shared object) #### [` is_targeting_android `]() property is\_targeting\_android → bool True if the current binary is targeting Android #### [` last_offset_section `]() property last\_offset\_section → int Return the last offset used in binary according to **sections table** #### [` last_offset_segment `]() property last\_offset\_segment → int Return the last offset used in binary according to **segments table** #### [` next_virtual_address `]() property next\_virtual\_address → int Return the next virtual address available #### [` notes `]() property notes → lief.ELF.Binary.it\_notes Return an iterator over the [`Note`]( "lief.ELF.Note") entries #### [` object_relocations `]() property object\_relocations → lief.ELF.Binary.it\_filter\_relocation Return an iterator over object [`Relocation`]( "lief.ELF.Relocation") #### [` overlay `]() property overlay → memoryview Overlay data that is not part of the ELF format #### [` patch_pltgotpatch_pltgot `]() patch\_pltgot(*self*, *symbol\_name: str*, *address: int*) → None **patch\_pltgot(*self*, *symbol: [lief.\_lief.ELF.Symbol]( "lief._lief.ELF.Symbol")*, *address: int*) → None** Overloaded function. 1. `patch_pltgot(self, symbol_name: str, address: int) -> None` Patch the imported symbol’s name with the `address` 2. `patch_pltgot(self, symbol: lief._lief.ELF.Symbol, address: int) -> None` Patch the imported [`Symbol`]( "lief.ELF.Symbol") with the `address` #### [` permute_dynamic_symbols `]() permute\_dynamic\_symbols(*self*, *permutation: collections.abc.Sequence[int]*) → None Apply the given permutation on the dynamic symbols table #### [` pltgot_relocations `]() property pltgot\_relocations → lief.ELF.Binary.it\_filter\_relocation Return an iterator over PLT/GOT [`Relocation`]( "lief.ELF.Relocation") #### [` relocate_phdr_table `]() relocate\_phdr\_table(*self*, *type: [lief.\_lief.ELF.Binary.PHDR\_RELOC]( "lief._lief.ELF.Binary.PHDR_RELOC") = PHDR\_RELOC.AUTO*) → int Force relocating the segments table in a specific way (see: [`PHDR_RELOC`]( "lief.ELF.Binary.PHDR_RELOC")). This function can be used to enforce a specific relocation of the segments table. Upon successful relocation, the function returns the offset of the relocated segments table. Otherwise, if the function fails, it returns 0 #### [` relocations `]() property relocations → lief.ELF.Binary.it\_relocations Return an iterator over **all** [`Relocation`]( "lief.ELF.Relocation") #### [` removeremoveremoveremoveremoveremoveremove `]() remove(*self*, *dynamic\_entry: [lief.\_lief.ELF.DynamicEntry]( "lief._lief.ELF.DynamicEntry")*) → None **remove(*self*, *tag: [lief.\_lief.ELF.DynamicEntry.TAG]( "lief._lief.ELF.DynamicEntry.TAG")*) → None **remove(*self*, *section: [lief.\_lief.ELF.Section]( "lief._lief.ELF.Section")*, *clear: bool = False*) → None **remove(*self*, *segment: [lief.\_lief.ELF.Segment]( "lief._lief.ELF.Segment")*, *clear: bool = False*) → None **remove(*self*, *type: [lief.\_lief.ELF.Segment.TYPE]( "lief._lief.ELF.Segment.TYPE")*, *clear: bool = False*) → None **remove(*self*, *note: [lief.\_lief.ELF.Note]( "lief._lief.ELF.Note")*) → None **remove(*self*, *type: [lief.\_lief.ELF.Note.TYPE]( "lief._lief.ELF.Note.TYPE")*) → None************ Overloaded function. 1. `remove(self, dynamic_entry: lief._lief.ELF.DynamicEntry) -> None` Remove the given [`DynamicEntry`]( "lief.ELF.DynamicEntry") from the dynamic table 2. `remove(self, tag: lief._lief.ELF.DynamicEntry.TAG) -> None` Remove **all** the [`DynamicEntry`]( "lief.ELF.DynamicEntry") with the given [`TAG`]( "lief.ELF.DynamicEntry.TAG") 3. `remove(self, section: lief._lief.ELF.Section, clear: bool = False) -> None` Remove the given [`Section`]( "lief.ELF.Section"). The `clear` parameter specifies whether or not we must fill its content with `0` before removing 4. `remove(self, segment: lief._lief.ELF.Segment, clear: bool = False) -> None` > Remove the segment provided in parameter. If `clear` is set, the original content of the segment will be filled with zeros before removal. 5. `remove(self, type: lief._lief.ELF.Segment.TYPE, clear: bool = False) -> None` > Remove **all** segments with the given type. If `clear` is set, the original content of the segment will be filled with zeros before removal. 6. `remove(self, note: lief._lief.ELF.Note) -> None` Remove the given [`Note`]( "lief.ELF.Note") 7. `remove(self, type: lief._lief.ELF.Note.TYPE) -> None` Remove **all** the [`Note`]( "lief.ELF.Note") with the given [`TYPE`]( "lief.ELF.Note.TYPE") #### [` remove_dynamic_symbolremove_dynamic_symbol `]() remove\_dynamic\_symbol(*self*, *arg: [lief.\_lief.ELF.Symbol]( "lief._lief.ELF.Symbol")*, */*) → None **remove\_dynamic\_symbol(*self*, *arg: str*, */*) → None** Overloaded function. 1. `remove_dynamic_symbol(self, arg: lief._lief.ELF.Symbol, /) -> None` Remove the given [`Symbol`]( "lief.ELF.Symbol") from the `.dynsym` section 2. `remove_dynamic_symbol(self, arg: str, /) -> None` Remove the [`Symbol`]( "lief.ELF.Symbol") with the name given in parameter from the `.dynsym` section #### [` remove_library `]() remove\_library(*self*, *library\_name: str*) → None Remove the given library #### [` remove_symtab_symbol `]() remove\_symtab\_symbol(*self*, *arg: [lief.\_lief.ELF.Symbol]( "lief._lief.ELF.Symbol")*, */*) → None Remove the given [`Symbol`]( "lief.ELF.Symbol") from the `.symtab` section #### [` remove_version_requirement `]() remove\_version\_requirement(*self*, *libname: str*) → bool Deletes all required symbol versions linked to the specified library name. The function returns true if the operation succeeds, false otherwise. > **Warning** > > To maintain consistency, this function also removes versions associated with dynamic symbols that are linked to the specified library name. #### [` replace `]() replace(*self*, *new\_segment: [lief.\_lief.ELF.Segment]( "lief._lief.ELF.Segment")*, *original\_segment: [lief.\_lief.ELF.Segment]( "lief._lief.ELF.Segment")*, *base: int = 0*) → [lief.\_lief.ELF.Segment]( "lief._lief.ELF.Segment") | None Replace the [`Segment`]( "lief.ELF.Segment") given in 2nd parameter with the [`Segment`]( "lief.ELF.Segment") given in the first parameter and return the updated segment. > **Warning** > > The `original_segment` is no longer valid after this function #### [` section_from_offset `]() section\_from\_offset(*self*, *offset: int*, *skip\_nobits: bool = True*) → [lief.\_lief.ELF.Section]( "lief._lief.ELF.Section") | None Return the [`Section`]( "lief.ELF.Section") which encompasses the given offset. It returns None if a section can’t be found. If `skip_nobits` is set (which is the case by default), this function won’t consider sections for which the type is `SHT_NOBITS` (like `.bss, .tbss, ...`) #### [` section_from_virtual_address `]() section\_from\_virtual\_address(*self*, *address: int*, *skip\_nobits: bool = True*) → [lief.\_lief.ELF.Section]( "lief._lief.ELF.Section") | None Return the [`Section`]( "lief.ELF.Section") which encompasses the given virtual address. It returns None if a section can’t be found. If `skip_nobits` is set (which is the case by default), this function won’t consider sections for which the type is `SHT_NOBITS` (like `.bss, .tbss, ...`) #### [` sections `]() property sections → lief.ELF.Binary.it\_sections Return an iterator over binary’s [`Section`]( "lief.ELF.Section") #### [` segment_from_offset `]() segment\_from\_offset(*self*, *offset: int*) → [lief.\_lief.ELF.Segment]( "lief._lief.ELF.Segment") | None Return the [`Segment`]( "lief.ELF.Segment") which encompasses the given offset. It returns None if a segment can’t be found. #### [` segment_from_virtual_address `]() segment\_from\_virtual\_address(*self*, *address: int*) → [lief.\_lief.ELF.Segment]( "lief._lief.ELF.Segment") | None Return the [`Segment`]( "lief.ELF.Segment") which encompasses the given virtual address. It returns None if a segment can’t be found. #### [` segments `]() property segments → lief.ELF.Binary.it\_segments Return an iterator to binary’s [`Segment`]( "lief.ELF.Segment") #### [` strings `]() property strings → list[str | bytes] Return list of strings used in the current ELF file. Basically this function looks for strings in the `.rodata` section #### [` strip `]() strip(*self*) → None Strip the binary #### [` symbols `]() property symbols → lief.ELF.Binary.it\_dyn\_symtab\_symbols Return an iterator over both **static** and **dynamic** [`Symbol`]( "lief.ELF.Symbol") #### [` symbols_version `]() property symbols\_version → lief.ELF.Binary.it\_symbols\_version Return an iterator over [`SymbolVersion`]( "lief.ELF.SymbolVersion") #### [` symbols_version_definition `]() property symbols\_version\_definition → lief.ELF.Binary.it\_symbols\_version\_definition Return an iterator to [`SymbolVersionDefinition`]( "lief.ELF.SymbolVersionDefinition") #### [` symbols_version_requirement `]() property symbols\_version\_requirement → lief.ELF.Binary.it\_symbols\_version\_requirement Return an iterator to [`SymbolVersionRequirement`]( "lief.ELF.SymbolVersionRequirement") #### [` symtab_idxsymtab_idx `]() symtab\_idx(*self*, *name: str*) → int **symtab\_idx(*self*, *symbol: [lief.\_lief.ELF.Symbol]( "lief._lief.ELF.Symbol")*) → int** Overloaded function. 1. `symtab_idx(self, name: str) -> int` > Get the symbol index in the `.symtab` section from the given name or return -1 if the symbol does not exist. 2. `symtab_idx(self, symbol: lief._lief.ELF.Symbol) -> int` > Get the symbol index in the `.symtab` section or return -1 if the symbol does not exist #### [` symtab_symbols `]() property symtab\_symbols → lief.ELF.Binary.it\_symbols Return an iterator to static [`Symbol`]( "lief.ELF.Symbol") #### [` sysv_hash `]() property sysv\_hash → [lief.ELF.SysvHash]( "lief.ELF.SysvHash") | None Return the [`SysvHash`]( "lief.ELF.SysvHash") object Hashes are used by the loader to speed up symbol resolution (SYSV version) #### [` type `]() property type → [lief.ELF.Header.CLASS]( "lief.ELF.Header.CLASS") Return the binary’s `ELF_CLASS` #### [` use_gnu_hash `]() property use\_gnu\_hash → bool `True` if GNU hash is used #### [` use_sysv_hash `]() property use\_sysv\_hash → bool `True` if SYSV hash is used #### [` virtual_address_to_offset `]() virtual\_address\_to\_offset(*self*, *virtual\_address: int*) → int | [lief.\_lief.lief\_errors]( "lief._lief.lief_errors") Convert the virtual address to a file offset #### [` virtual_size `]() property virtual\_size → int Return the size of the mapped binary #### [` writewrite `]() write(*self*, *output: str | os.PathLike*) → None **write(*self*, *output: str | os.PathLike*, *config: [lief.\_lief.ELF.Builder.config\_t]( "lief._lief.ELF.Builder.config_t")*) → None** Overloaded function. 1. `write(self, output: Union[str | os.PathLike]) -> None` Rebuild the binary and write it in a file 2. `write(self, output: Union[str | os.PathLike], config: lief._lief.ELF.Builder.config_t) -> None` Rebuild the binary with the given configuration and write it in a file #### [` write_to_byteswrite_to_bytes `]() write\_to\_bytes(*self*, *config: [lief.\_lief.ELF.Builder.config\_t]( "lief._lief.ELF.Builder.config_t")*) → bytes **write\_to\_bytes(*self*) → bytes** --- ## [Header]() ### [` lief.ELF.Header `]() class lief.ELF.Header(*self*) Bases: `Object` Class which represents the ELF’s header. This class mirrors the raw ELF `Elfxx_Ehdr` structure. #### [` CLASS `]() class CLASS(*\*values*) Bases: `Enum` Matches the result of `Elfxx_Ehdr.e_ident[EI_CLASS]` ##### [` ELF32 `]() ELF32 = 1 ##### [` ELF64 `]() ELF64 = 2 ##### [` NONE `]() NONE = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.Header.CLASS]( "lief.ELF.Header.CLASS") = <nanobind.nb\_func object> #### [` ELF_DATA `]() class ELF\_DATA(*\*values*) Bases: `Enum` Matches the result of `Elfxx_Ehdr.e_ident[EI_DATA]` ##### [` LSB `]() LSB = 1 ##### [` MSB `]() MSB = 2 ##### [` NONE `]() NONE = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.Header.ELF\_DATA]( "lief.ELF.Header.ELF_DATA") = <nanobind.nb\_func object> #### [` FILE_TYPE `]() class FILE\_TYPE(*\*values*) Bases: `Enum` The type of the underlying ELF file. This enum matches the semantic of `ET_NONE`, `ET_REL`, … ##### [` CORE `]() CORE = 4 ##### [` DYN `]() DYN = 3 ##### [` EXEC `]() EXEC = 2 ##### [` NONE `]() NONE = 0 ##### [` REL `]() REL = 1 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.Header.FILE\_TYPE]( "lief.ELF.Header.FILE_TYPE") = <nanobind.nb\_func object> #### [` OS_ABI `]() class OS\_ABI(*\*values*) Bases: `Enum` ##### [` AIX `]() AIX = 7 ##### [` AMDGPU_HSA `]() AMDGPU\_HSA = 64 ##### [` ARM `]() ARM = 97 ##### [` AROS `]() AROS = 15 ##### [` C6000_LINUX `]() C6000\_LINUX = 65 ##### [` CLOUDABI `]() CLOUDABI = 17 ##### [` FENIXOS `]() FENIXOS = 16 ##### [` FREEBSD `]() FREEBSD = 9 ##### [` HPUX `]() HPUX = 1 ##### [` HURD `]() HURD = 4 ##### [` IRIX `]() IRIX = 8 ##### [` LINUX `]() LINUX = 3 ##### [` MODESTO `]() MODESTO = 11 ##### [` NETBSD `]() NETBSD = 2 ##### [` NSK `]() NSK = 14 ##### [` OPENBSD `]() OPENBSD = 12 ##### [` OPENVMS `]() OPENVMS = 13 ##### [` SOLARIS `]() SOLARIS = 6 ##### [` STANDALONE `]() STANDALONE = 255 ##### [` SYSTEMV `]() SYSTEMV = 0 ##### [` TRU64 `]() TRU64 = 10 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.Header.OS\_ABI]( "lief.ELF.Header.OS_ABI") = <nanobind.nb\_func object> #### [` VERSION `]() class VERSION(*\*values*) Bases: `Enum` Matches the result of `Elfxx_Ehdr.e_version` ##### [` CURRENT `]() CURRENT = 1 ##### [` NONE `]() NONE = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.Header.VERSION]( "lief.ELF.Header.VERSION") = <nanobind.nb\_func object> #### [` entrypoint `]() property entrypoint → int Return the binary entry point #### [` file_type `]() property file\_type → [lief.ELF.Header.FILE\_TYPE]( "lief.ELF.Header.FILE_TYPE") Return binary’s type. This field determines if the binary is an executable, a library… #### [` flags_list `]() property flags\_list → list[[lief.ELF.PROCESSOR\_FLAGS]( "lief.ELF.PROCESSOR_FLAGS")] Processor flags as a list #### [` has `]() has(*self*, *arg: [lief.\_lief.ELF.PROCESSOR\_FLAGS]( "lief._lief.ELF.PROCESSOR_FLAGS")*, */*) → bool Check if the given processor flag is present #### [` header_size `]() property header\_size → int Return the size of the ELF header This size should be 64 for an `ELF64` binary and 52 for an `ELF32`. #### [` identity `]() property identity → list[int] Header’s identity. #### [` identity_abi_version `]() property identity\_abi\_version → int Return the ABI version (integer). #### [` identity_class `]() property identity\_class → [lief.ELF.Header.CLASS]( "lief.ELF.Header.CLASS") Header’s class. #### [` identity_data `]() property identity\_data → [lief.ELF.Header.ELF\_DATA]( "lief.ELF.Header.ELF_DATA") Specify the data encoding #### [` identity_os_abi `]() property identity\_os\_abi → [lief.ELF.Header.OS\_ABI]( "lief.ELF.Header.OS_ABI") Identifies the version of the ABI for which the object is prepared. #### [` identity_version `]() property identity\_version → [lief.ELF.Header.VERSION]( "lief.ELF.Header.VERSION") #### [` is_mips_n64 `]() property is\_mips\_n64 → bool Whether this header uses the MIPS n64 ELF encoding #### [` machine_type `]() property machine\_type → [lief.ELF.ARCH]( "lief.ELF.ARCH") Return the target architecture #### [` numberof_sections `]() property numberof\_sections → int Return the number of sections #### [` numberof_segments `]() property numberof\_segments → int Return the number of program headers (segments) #### [` object_file_version `]() property object\_file\_version → [lief.ELF.Header.VERSION]( "lief.ELF.Header.VERSION") Return the version #### [` processor_flag `]() property processor\_flag → int Processor-specific flags #### [` program_header_offset `]() property program\_header\_offset → int Offset of program table (also known as segments table) #### [` program_header_size `]() property program\_header\_size → int Return the size of the raw `Elfxx_Phdr` structure (see [`lief.ELF.Segment`]( "lief.ELF.Segment")) This size should be 56 for an `ELF64` binary and 32 for an `ELF32`. #### [` section_header_offset `]() property section\_header\_offset → int Offset of section table #### [` section_header_size `]() property section\_header\_size → int Return the size of the raw `Elfxx_Shdr` ([`lief.ELF.Section`]( "lief.ELF.Section")) This size should be 64 for an `ELF64` binary and 40 for an `ELF32`. #### [` section_name_table_idx `]() property section\_name\_table\_idx → int Return the section index which contains sections’ names --- ## [Section]() ![Inheritance diagram of lief._lief.ELF.Section](https://lief.re/doc/latest/_images/inheritance-6fafd2b22f5754171cd64a3e425543272ae6ff11.png) ### [` lief.ELF.Sectionlief.ELF.Section `]() class lief.ELF.Section(*self*) **class lief.ELF.Section(*self*, *name: str*, *type: [lief.\_lief.ELF.Section.TYPE]( "lief._lief.ELF.Section.TYPE") = TYPE.PROGBITS*)** Bases: [`Section`]( "lief._lief.Section") Class which represents an ELF section. Overloaded function. 1. `__init__(self) -> None` Default constructor 2. `__init__(self, name: str, type: lief._lief.ELF.Section.TYPE = TYPE.PROGBITS) -> None` Constructor from a name and a section type #### [` FLAGS `]() class FLAGS(*\*values*) Bases: `Flag` ##### [` AARCH64_PURECODE `]() AARCH64\_PURECODE = 26306674688 ##### [` ALLOC `]() ALLOC = 2 ##### [` ARM_PURECODE `]() ARM\_PURECODE = 22011707392 ##### [` COMPRESSED `]() COMPRESSED = 2048 ##### [` EXCLUDE `]() EXCLUDE = 2147483648 ##### [` EXECINSTR `]() EXECINSTR = 4 ##### [` GNU_RETAIN `]() GNU\_RETAIN = 2097152 ##### [` GROUP `]() GROUP = 512 ##### [` HEX_GPREL `]() HEX\_GPREL = 13153337344 ##### [` INFO_LINK `]() INFO\_LINK = 64 ##### [` LINK_ORDER `]() LINK\_ORDER = 128 ##### [` MERGE `]() MERGE = 16 ##### [` MIPS_ADDR `]() MIPS\_ADDR = 18253611008 ##### [` MIPS_GPREL `]() MIPS\_GPREL = 17448304640 ##### [` MIPS_LOCAL `]() MIPS\_LOCAL = 17246978048 ##### [` MIPS_MERGE `]() MIPS\_MERGE = 17716740096 ##### [` MIPS_NAMES `]() MIPS\_NAMES = 17213423616 ##### [` MIPS_NODUPES `]() MIPS\_NODUPES = 17196646400 ##### [` MIPS_NOSTRIP `]() MIPS\_NOSTRIP = 17314086912 ##### [` MIPS_STRING `]() MIPS\_STRING = 19327352832 ##### [` NONE `]() NONE = 0 ##### [` OS_NONCONFORMING `]() OS\_NONCONFORMING = 256 ##### [` STRINGS `]() STRINGS = 32 ##### [` TLS `]() TLS = 1024 ##### [` WRITE `]() WRITE = 1 ##### [` X86_64_LARGE `]() X86\_64\_LARGE = 8858370048 ##### [` XCORE_SHF_CP_SECTION `]() XCORE\_SHF\_CP\_SECTION = 4831838208 ##### [` XCORE_SHF_DP_SECTION `]() XCORE\_SHF\_DP\_SECTION = 4563402752 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.Section.FLAGS]( "lief.ELF.Section.FLAGS") = <nanobind.nb\_func object> #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` ##### [` AARCH64_ATTRIBUTES `]() AARCH64\_ATTRIBUTES = 23353884675 ##### [` AARCH64_AUTH_RELR `]() AARCH64\_AUTH\_RELR = 23353884676 ##### [` AARCH64_MEMTAG_GLOBALS_DYNAMIC `]() AARCH64\_MEMTAG\_GLOBALS\_DYNAMIC = 23353884680 ##### [` AARCH64_MEMTAG_GLOBALS_STATIC `]() AARCH64\_MEMTAG\_GLOBALS\_STATIC = 23353884679 ##### [` ANDROID_REL `]() ANDROID\_REL = 1610612737 ##### [` ANDROID_RELA `]() ANDROID\_RELA = 1610612738 ##### [` ANDROID_RELR `]() ANDROID\_RELR = 1879047936 ##### [` ARM_ATTRIBUTES `]() ARM\_ATTRIBUTES = 6174015491 ##### [` ARM_DEBUGOVERLAY `]() ARM\_DEBUGOVERLAY = 6174015492 ##### [` ARM_EXIDX `]() ARM\_EXIDX = 6174015489 ##### [` ARM_OVERLAYSECTION `]() ARM\_OVERLAYSECTION = 6174015493 ##### [` ARM_PREEMPTMAP `]() ARM\_PREEMPTMAP = 6174015490 ##### [` DYNAMIC `]() DYNAMIC = 6 ##### [` DYNSYM `]() DYNSYM = 11 ##### [` FINI_ARRAY `]() FINI\_ARRAY = 15 ##### [` GNU_ATTRIBUTES `]() GNU\_ATTRIBUTES = 1879048181 ##### [` GNU_HASH `]() GNU\_HASH = 1879048182 ##### [` GNU_VERDEF `]() GNU\_VERDEF = 1879048189 ##### [` GNU_VERNEED `]() GNU\_VERNEED = 1879048190 ##### [` GNU_VERSYM `]() GNU\_VERSYM = 1879048191 ##### [` GROUP `]() GROUP = 17 ##### [` HASH `]() HASH = 5 ##### [` HEX_ORDERED `]() HEX\_ORDERED = 10468982784 ##### [` INIT_ARRAY `]() INIT\_ARRAY = 14 ##### [` LLVM_ADDRSIG `]() LLVM\_ADDRSIG = 1879002115 ##### [` MIPS_ABIFLAGS `]() MIPS\_ABIFLAGS = 14763950122 ##### [` MIPS_AUXSYM `]() MIPS\_AUXSYM = 14763950102 ##### [` MIPS_CONFLICT `]() MIPS\_CONFLICT = 14763950082 ##### [` MIPS_CONTENT `]() MIPS\_CONTENT = 14763950092 ##### [` MIPS_DEBUG `]() MIPS\_DEBUG = 14763950085 ##### [` MIPS_DELTACLASS `]() MIPS\_DELTACLASS = 14763950109 ##### [` MIPS_DELTADECL `]() MIPS\_DELTADECL = 14763950111 ##### [` MIPS_DELTAINST `]() MIPS\_DELTAINST = 14763950108 ##### [` MIPS_DELTASYM `]() MIPS\_DELTASYM = 14763950107 ##### [` MIPS_DENSE `]() MIPS\_DENSE = 14763950099 ##### [` MIPS_DWARF `]() MIPS\_DWARF = 14763950110 ##### [` MIPS_EH_REGION `]() MIPS\_EH\_REGION = 14763950119 ##### [` MIPS_EVENTS `]() MIPS\_EVENTS = 14763950113 ##### [` MIPS_EXTSYM `]() MIPS\_EXTSYM = 14763950098 ##### [` MIPS_FDESC `]() MIPS\_FDESC = 14763950097 ##### [` MIPS_GPTAB `]() MIPS\_GPTAB = 14763950083 ##### [` MIPS_IFACE `]() MIPS\_IFACE = 14763950091 ##### [` MIPS_LIBLIST `]() MIPS\_LIBLIST = 14763950080 ##### [` MIPS_LINE `]() MIPS\_LINE = 14763950105 ##### [` MIPS_LOCSTR `]() MIPS\_LOCSTR = 14763950104 ##### [` MIPS_LOCSYM `]() MIPS\_LOCSYM = 14763950101 ##### [` MIPS_MSYM `]() MIPS\_MSYM = 14763950081 ##### [` MIPS_OPTIONS `]() MIPS\_OPTIONS = 14763950093 ##### [` MIPS_OPTSYM `]() MIPS\_OPTSYM = 14763950103 ##### [` MIPS_PACKAGE `]() MIPS\_PACKAGE = 14763950087 ##### [` MIPS_PACKSYM `]() MIPS\_PACKSYM = 14763950088 ##### [` MIPS_PDESC `]() MIPS\_PDESC = 14763950100 ##### [` MIPS_PDR_EXCEPTION `]() MIPS\_PDR\_EXCEPTION = 14763950121 ##### [` MIPS_PIXIE `]() MIPS\_PIXIE = 14763950115 ##### [` MIPS_REGINFO `]() MIPS\_REGINFO = 14763950086 ##### [` MIPS_RELD `]() MIPS\_RELD = 14763950089 ##### [` MIPS_RFDESC `]() MIPS\_RFDESC = 14763950106 ##### [` MIPS_SHDR `]() MIPS\_SHDR = 14763950096 ##### [` MIPS_SYMBOL_LIB `]() MIPS\_SYMBOL\_LIB = 14763950112 ##### [` MIPS_TRANSLATE `]() MIPS\_TRANSLATE = 14763950114 ##### [` MIPS_UCODE `]() MIPS\_UCODE = 14763950084 ##### [` MIPS_WHIRL `]() MIPS\_WHIRL = 14763950118 ##### [` MIPS_XHASH `]() MIPS\_XHASH = 14763950123 ##### [` MIPS_XLATE `]() MIPS\_XLATE = 14763950116 ##### [` MIPS_XLATE_DEBUG `]() MIPS\_XLATE\_DEBUG = 14763950117 ##### [` MIPS_XLATE_OLD `]() MIPS\_XLATE\_OLD = 14763950120 ##### [` NOBITS `]() NOBITS = 8 ##### [` NOTE `]() NOTE = 7 ##### [` PREINIT_ARRAY `]() PREINIT\_ARRAY = 16 ##### [` PROGBITS `]() PROGBITS = 1 ##### [` REL `]() REL = 9 ##### [` RELA `]() RELA = 4 ##### [` RELR `]() RELR = 19 ##### [` RISCV_ATTRIBUTES `]() RISCV\_ATTRIBUTES = 19058917379 ##### [` SHLIB `]() SHLIB = 10 ##### [` SHT_NULL_ `]() SHT\_NULL\_ = 0 ##### [` STRTAB `]() STRTAB = 3 ##### [` SYMTAB `]() SYMTAB = 2 ##### [` SYMTAB_SHNDX `]() SYMTAB\_SHNDX = 18 ##### [` X86_64_UNWIND `]() X86\_64\_UNWIND = 10468982785 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.Section.TYPE]( "lief.ELF.Section.TYPE") = <nanobind.nb\_func object> #### [` add `]() add(*self*, *flag: [lief.\_lief.ELF.Section.FLAGS]( "lief._lief.ELF.Section.FLAGS")*) → None Add the given flag to the list of [`flags`]( "lief.ELF.Section.flags") #### [` alignment `]() property alignment → int Section alignment #### [` as_frame `]() as\_frame(*self*) → [lief.\_lief.ELF.Section]( "lief._lief.ELF.Section") #### [` clear `]() clear(*self*, *value: int = 0*) → [lief.\_lief.ELF.Section]( "lief._lief.ELF.Section") Clear the content of the section with the given `value` #### [` entry_size `]() property entry\_size → int This property returns the size of an element in the case of a section that contains an array. **Example:** The .dynamic section contains an array of [`DynamicEntry`]( "lief.ELF.DynamicEntry"). As the size of the raw C structure of this entry is 0x10 (`sizeof(Elf64_Dyn)`) in a ELF64, the [`entry_size`]( "lief.ELF.Section.entry_size"), is set to this value. #### [` file_offset `]() property file\_offset → int Offset of the section’s content #### [` flags `]() property flags → int Return the section’s flags as an integer #### [` flags_list `]() property flags\_list → list[[lief.ELF.Section.FLAGS]( "lief.ELF.Section.FLAGS")] Return section’s flags as a list #### [` hashas `]() has(*self*, *flag: [lief.\_lief.ELF.Section.FLAGS]( "lief._lief.ELF.Section.FLAGS")*) → bool **has(*self*, *segment: [lief.\_lief.ELF.Segment]( "lief._lief.ELF.Segment")*) → bool** Overloaded function. 1. `has(self, flag: lief._lief.ELF.Section.FLAGS) -> bool` Check if the given flag is present 2. `has(self, segment: lief._lief.ELF.Segment) -> bool` Check if the given [`Segment`]( "lief.ELF.Segment") is present in [`segments`]( "lief.ELF.Section.segments") #### [` information `]() property information → int Section information (this value depends on the section) #### [` is_frame `]() property is\_frame → bool #### [` link `]() property link → int Index to another section #### [` original_size `]() property original\_size → int Original size of the section’s data. This value is used by the [`Builder`]( "lief.ELF.Builder") to determine if it needs to be relocated to avoid an overwrite of the data #### [` remove `]() remove(*self*, *flag: [lief.\_lief.ELF.Section.FLAGS]( "lief._lief.ELF.Section.FLAGS")*) → None Remove the given flag from the list of [`flags`]( "lief.ELF.Section.flags") #### [` segments `]() property segments → lief.ELF.Section.it\_segments Return segment(s) associated with the given section #### [` type `]() property type → [lief.ELF.Section.TYPE]( "lief.ELF.Section.TYPE") Return the type of the section --- ## [Segment]() ### [` lief.ELF.Segment `]() class lief.ELF.Segment(*self*) Bases: `Object` Class which represents the ELF segments #### [` FLAGS `]() class FLAGS(*\*values*) Bases: `Flag` ##### [` NONE `]() NONE = 0 ##### [` R `]() R = 4 ##### [` W `]() W = 2 ##### [` X `]() X = 1 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.Segment.FLAGS]( "lief.ELF.Segment.FLAGS") = <nanobind.nb\_func object> #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` ##### [` AARCH64_MEMTAG_MTE `]() AARCH64\_MEMTAG\_MTE = 19058917378 ##### [` ARM_ARCHEXT `]() ARM\_ARCHEXT = 10468982784 ##### [` ARM_EXIDX `]() ARM\_EXIDX = 10468982785 ##### [` DYNAMIC `]() DYNAMIC = 2 ##### [` GNU_EH_FRAME `]() GNU\_EH\_FRAME = 1685382480 ##### [` GNU_PROPERTY `]() GNU\_PROPERTY = 1685382483 ##### [` GNU_RELRO `]() GNU\_RELRO = 1685382482 ##### [` GNU_STACK `]() GNU\_STACK = 1685382481 ##### [` HP_CORE_COMM `]() HP\_CORE\_COMM = 9007200865353732 ##### [` HP_CORE_KERNEL `]() HP\_CORE\_KERNEL = 9007200865353731 ##### [` HP_CORE_LOADABLE `]() HP\_CORE\_LOADABLE = 9007200865353734 ##### [` HP_CORE_MMF `]() HP\_CORE\_MMF = 9007200865353737 ##### [` HP_CORE_NONE `]() HP\_CORE\_NONE = 9007200865353729 ##### [` HP_CORE_PROC `]() HP\_CORE\_PROC = 9007200865353733 ##### [` HP_CORE_SHM `]() HP\_CORE\_SHM = 9007200865353736 ##### [` HP_CORE_STACK `]() HP\_CORE\_STACK = 9007200865353735 ##### [` HP_CORE_UTSNAME `]() HP\_CORE\_UTSNAME = 9007200865353749 ##### [` HP_CORE_VERSION `]() HP\_CORE\_VERSION = 9007200865353730 ##### [` HP_FASTBIND `]() HP\_FASTBIND = 9007200865353745 ##### [` HP_HSL_ANNOT `]() HP\_HSL\_ANNOT = 9007200865353747 ##### [` HP_OPT_ANNOT `]() HP\_OPT\_ANNOT = 9007200865353746 ##### [` HP_PARALLEL `]() HP\_PARALLEL = 9007200865353744 ##### [` HP_STACK `]() HP\_STACK = 9007200865353748 ##### [` HP_TLS `]() HP\_TLS = 9007200865353728 ##### [` IA_64_EXT `]() IA\_64\_EXT = 44828721152 ##### [` IA_64_UNWIND `]() IA\_64\_UNWIND = 44828721153 ##### [` INTERP `]() INTERP = 3 ##### [` LOAD `]() LOAD = 1 ##### [` MIPS_ABIFLAGS `]() MIPS\_ABIFLAGS = 27648851971 ##### [` MIPS_OPTIONS `]() MIPS\_OPTIONS = 27648851970 ##### [` MIPS_REGINFO `]() MIPS\_REGINFO = 27648851968 ##### [` MIPS_RTPROC `]() MIPS\_RTPROC = 27648851969 ##### [` NOTE `]() NOTE = 4 ##### [` PAX_FLAGS `]() PAX\_FLAGS = 1694766464 ##### [` PHDR `]() PHDR = 6 ##### [` PT_NULL_ `]() PT\_NULL\_ = 0 ##### [` RISCV_ATTRIBUTES `]() RISCV\_ATTRIBUTES = 36238786563 ##### [` SHLIB `]() SHLIB = 5 ##### [` TLS `]() TLS = 7 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.Segment.TYPE]( "lief.ELF.Segment.TYPE") = <nanobind.nb\_func object> #### [` add `]() add(*self*, *flag: [lief.\_lief.ELF.Segment.FLAGS]( "lief._lief.ELF.Segment.FLAGS")*) → None Add the given flag to the list of [`flags`]( "lief.ELF.Segment.flags") #### [` alignment `]() property alignment → int The offset alignment of the segment #### [` clear `]() clear(*self*) → None Clear the content of this segment #### [` content `]() property content → memoryview The raw data associated with this segment. #### [` file_offset `]() property file\_offset → int The file offset of the data associated with this segment #### [` fill `]() fill(*self*, *value: str*) → None Fill the content of this segment with the value provided in parameter #### [` flags `]() property flags → [lief.ELF.Segment.FLAGS]( "lief.ELF.Segment.FLAGS") The flag permissions associated with this segment #### [` from_raw `]() from\_raw(*arg: bytes*) → [lief.ELF.Segment]( "lief.ELF.Segment") | [lief.lief\_errors]( "lief.lief_errors") = <nanobind.nb\_func object> #### [` hashashas `]() has(*self*, *flag: [lief.\_lief.ELF.Segment.FLAGS]( "lief._lief.ELF.Segment.FLAGS")*) → bool **has(*self*, *section: [lief.\_lief.ELF.Section]( "lief._lief.ELF.Section")*) → bool **has(*self*, *section\_name: str*) → bool**** Overloaded function. 1. `has(self, flag: lief._lief.ELF.Segment.FLAGS) -> bool` Check if the given flag is present 2. `has(self, section: lief._lief.ELF.Section) -> bool` Check if the given [`Section`]( "lief.ELF.Section") is present in [`sections`]( "lief.ELF.Segment.sections") 3. `has(self, section_name: str) -> bool` Check if the given [`Section`]( "lief.ELF.Section") ‘s name is present in [`sections`]( "lief.ELF.Segment.sections") #### [` physical_address `]() property physical\_address → int The physical address of the segment. This value is not really relevant on systems like Linux or Android. On the other hand, Qualcomm trustlets might use this value. Usually this value matches [`virtual_address`]( "lief.ELF.Segment.virtual_address") #### [` physical_size `]() property physical\_size → int The **file** size of the data associated with this segment #### [` raw_flags `]() property raw\_flags → int The flag permissions as an integer #### [` remove `]() remove(*self*, *flag: [lief.\_lief.ELF.Segment.FLAGS]( "lief._lief.ELF.Segment.FLAGS")*) → None Remove the given flag from the list of [`flags`]( "lief.ELF.Segment.flags") #### [` sections `]() property sections → lief.ELF.Segment.it\_sections Iterator over the [`Section`]( "lief.ELF.Section") wrapped by this segment #### [` type `]() property type → [lief.ELF.Segment.TYPE]( "lief.ELF.Segment.TYPE") Segment’s type #### [` virtual_address `]() property virtual\_address → int The virtual address of the segment. > **Warning** > > The ELF format specifications require the following relationship: > > \[\text{virtual address} \equiv \text{file offset} \pmod{\text{page size}} \text{virtual address} \equiv \text{file offset} \pmod{\text{alignment}}\] #### [` virtual_size `]() property virtual\_size → int The in-memory size of this segment. Usually, if the `.bss` segment is wrapped by this segment then, virtual\_size is larger than physical\_size --- ## [Dynamic Entry]() ![Inheritance diagram of lief._lief.ELF.DynamicSharedObject, lief._lief.ELF.DynamicEntryFlags, lief._lief.ELF.DynamicEntryAuxiliary, lief._lief.ELF.DynamicEntryRpath, lief._lief.ELF.DynamicEntryArray, lief._lief.ELF.DynamicEntry, lief._lief.ELF.DynamicEntryLibrary, lief._lief.ELF.DynamicEntryRunPath, lief._lief.ELF.DynamicEntryFilter](https://lief.re/doc/latest/_images/inheritance-3a085483594f6a742020da3027c7b3010686564c.png) ### [` lief.ELF.DynamicEntrylief.ELF.DynamicEntry `]() class lief.ELF.DynamicEntry(*self*) **class lief.ELF.DynamicEntry(*self*, *tag: [lief.\_lief.ELF.DynamicEntry.TAG]( "lief._lief.ELF.DynamicEntry.TAG")*, *value: int*)** Bases: `Object` Class which represents an entry in the dynamic table These entries are located in the `.dynamic` section or the `PT_DYNAMIC` segment Overloaded function. 1. `__init__(self) -> None` Default constructor 2. `__init__(self, tag: lief._lief.ELF.DynamicEntry.TAG, value: int) -> None` Constructor from a [`TAG`]( "lief.ELF.DynamicEntry.TAG") and value #### [` TAG `]() class TAG(*\*values*) Bases: `Enum` ##### [` AARCH64_BTI_PLT `]() AARCH64\_BTI\_PLT = 10468982785 ##### [` AARCH64_MEMTAG_GLOBALS `]() AARCH64\_MEMTAG\_GLOBALS = 10468982797 ##### [` AARCH64_MEMTAG_GLOBALSSZ `]() AARCH64\_MEMTAG\_GLOBALSSZ = 10468982799 ##### [` AARCH64_MEMTAG_HEAP `]() AARCH64\_MEMTAG\_HEAP = 10468982795 ##### [` AARCH64_MEMTAG_MODE `]() AARCH64\_MEMTAG\_MODE = 10468982793 ##### [` AARCH64_MEMTAG_STACK `]() AARCH64\_MEMTAG\_STACK = 10468982796 ##### [` AARCH64_PAC_PLT `]() AARCH64\_PAC\_PLT = 10468982787 ##### [` AARCH64_VARIANT_PCS `]() AARCH64\_VARIANT\_PCS = 10468982789 ##### [` ANDROID_REL `]() ANDROID\_REL = 1610612751 ##### [` ANDROID_RELA `]() ANDROID\_RELA = 1610612753 ##### [` ANDROID_RELASZ `]() ANDROID\_RELASZ = 1610612754 ##### [` ANDROID_RELR `]() ANDROID\_RELR = 1879040000 ##### [` ANDROID_RELRCOUNT `]() ANDROID\_RELRCOUNT = 1879040005 ##### [` ANDROID_RELRENT `]() ANDROID\_RELRENT = 1879040003 ##### [` ANDROID_RELRSZ `]() ANDROID\_RELRSZ = 1879040001 ##### [` ANDROID_RELSZ `]() ANDROID\_RELSZ = 1610612752 ##### [` ANDROID_REL_OFFSET `]() ANDROID\_REL\_OFFSET = 1610612749 ##### [` ANDROID_REL_SIZE `]() ANDROID\_REL\_SIZE = 1610612750 ##### [` AUXILIARY `]() AUXILIARY = 2147483645 ##### [` BIND_NOW `]() BIND\_NOW = 24 ##### [` DEBUG_TAG `]() DEBUG\_TAG = 21 ##### [` FILTER `]() FILTER = 2147483647 ##### [` FINI `]() FINI = 13 ##### [` FINI_ARRAY `]() FINI\_ARRAY = 26 ##### [` FINI_ARRAYSZ `]() FINI\_ARRAYSZ = 28 ##### [` FLAGS `]() FLAGS = 30 ##### [` FLAGS_1 `]() FLAGS\_1 = 1879048187 ##### [` GNU_HASH `]() GNU\_HASH = 1879047925 ##### [` HASH `]() HASH = 4 ##### [` HEXAGON_PLT `]() HEXAGON\_PLT = 14763950082 ##### [` HEXAGON_SYMSZ `]() HEXAGON\_SYMSZ = 14763950080 ##### [` HEXAGON_VER `]() HEXAGON\_VER = 14763950081 ##### [` IA_64_PLT_RESERVE `]() IA\_64\_PLT\_RESERVE = 36238786560 ##### [` IA_64_VMS_FIXUP_NEEDED `]() IA\_64\_VMS\_FIXUP\_NEEDED = 35970351128 ##### [` IA_64_VMS_FIXUP_RELA_CNT `]() IA\_64\_VMS\_FIXUP\_RELA\_CNT = 35970351126 ##### [` IA_64_VMS_FIXUP_RELA_OFF `]() IA\_64\_VMS\_FIXUP\_RELA\_OFF = 35970351164 ##### [` IA_64_VMS_FPMODE `]() IA\_64\_VMS\_FPMODE = 35970351170 ##### [` IA_64_VMS_IDENT `]() IA\_64\_VMS\_IDENT = 35970351116 ##### [` IA_64_VMS_IMGIOCNT `]() IA\_64\_VMS\_IMGIOCNT = 35970351106 ##### [` IA_64_VMS_IMG_RELA_CNT `]() IA\_64\_VMS\_IMG\_RELA\_CNT = 35970351122 ##### [` IA_64_VMS_IMG_RELA_OFF `]() IA\_64\_VMS\_IMG\_RELA\_OFF = 35970351160 ##### [` IA_64_VMS_LINKTIME `]() IA\_64\_VMS\_LINKTIME = 35970351144 ##### [` IA_64_VMS_LNKFLAGS `]() IA\_64\_VMS\_LNKFLAGS = 35970351112 ##### [` IA_64_VMS_NEEDED_IDENT `]() IA\_64\_VMS\_NEEDED\_IDENT = 35970351120 ##### [` IA_64_VMS_PLTGOT_OFFSET `]() IA\_64\_VMS\_PLTGOT\_OFFSET = 35970351166 ##### [` IA_64_VMS_PLTGOT_SEG `]() IA\_64\_VMS\_PLTGOT\_SEG = 35970351168 ##### [` IA_64_VMS_SEG_NO `]() IA\_64\_VMS\_SEG\_NO = 35970351146 ##### [` IA_64_VMS_SEG_RELA_CNT `]() IA\_64\_VMS\_SEG\_RELA\_CNT = 35970351124 ##### [` IA_64_VMS_SEG_RELA_OFF `]() IA\_64\_VMS\_SEG\_RELA\_OFF = 35970351162 ##### [` IA_64_VMS_STACKSIZE `]() IA\_64\_VMS\_STACKSIZE = 35970351136 ##### [` IA_64_VMS_STRTAB_OFFSET `]() IA\_64\_VMS\_STRTAB\_OFFSET = 35970351156 ##### [` IA_64_VMS_SUBTYPE `]() IA\_64\_VMS\_SUBTYPE = 35970351104 ##### [` IA_64_VMS_SYMVEC_CNT `]() IA\_64\_VMS\_SYMVEC\_CNT = 35970351130 ##### [` IA_64_VMS_SYMVEC_OFFSET `]() IA\_64\_VMS\_SYMVEC\_OFFSET = 35970351148 ##### [` IA_64_VMS_SYMVEC_SEG `]() IA\_64\_VMS\_SYMVEC\_SEG = 35970351150 ##### [` IA_64_VMS_SYSVER_OFFSET `]() IA\_64\_VMS\_SYSVER\_OFFSET = 35970351158 ##### [` IA_64_VMS_UNWINDSZ `]() IA\_64\_VMS\_UNWINDSZ = 35970351138 ##### [` IA_64_VMS_UNWIND_CODSEG `]() IA\_64\_VMS\_UNWIND\_CODSEG = 35970351140 ##### [` IA_64_VMS_UNWIND_INFOSEG `]() IA\_64\_VMS\_UNWIND\_INFOSEG = 35970351142 ##### [` IA_64_VMS_UNWIND_OFFSET `]() IA\_64\_VMS\_UNWIND\_OFFSET = 35970351152 ##### [` IA_64_VMS_UNWIND_SEG `]() IA\_64\_VMS\_UNWIND\_SEG = 35970351154 ##### [` IA_64_VMS_VIR_MEM_BLK_SIZ `]() IA\_64\_VMS\_VIR\_MEM\_BLK\_SIZ = 35970351114 ##### [` IA_64_VMS_XLATED `]() IA\_64\_VMS\_XLATED = 35970351134 ##### [` INIT `]() INIT = 12 ##### [` INIT_ARRAY `]() INIT\_ARRAY = 25 ##### [` INIT_ARRAYSZ `]() INIT\_ARRAYSZ = 27 ##### [` JMPREL `]() JMPREL = 23 ##### [` MIPS_AUX_DYNAMIC `]() MIPS\_AUX\_DYNAMIC = 6174015537 ##### [` MIPS_BASE_ADDRESS `]() MIPS\_BASE\_ADDRESS = 6174015494 ##### [` MIPS_COMPACT_SIZE `]() MIPS\_COMPACT\_SIZE = 6174015535 ##### [` MIPS_CONFLICT `]() MIPS\_CONFLICT = 6174015496 ##### [` MIPS_CONFLICTNO `]() MIPS\_CONFLICTNO = 6174015499 ##### [` MIPS_CXX_FLAGS `]() MIPS\_CXX\_FLAGS = 6174015522 ##### [` MIPS_DELTA_CLASS `]() MIPS\_DELTA\_CLASS = 6174015511 ##### [` MIPS_DELTA_CLASSSYM `]() MIPS\_DELTA\_CLASSSYM = 6174015520 ##### [` MIPS_DELTA_CLASSSYM_NO `]() MIPS\_DELTA\_CLASSSYM\_NO = 6174015521 ##### [` MIPS_DELTA_CLASS_NO `]() MIPS\_DELTA\_CLASS\_NO = 6174015512 ##### [` MIPS_DELTA_INSTANCE `]() MIPS\_DELTA\_INSTANCE = 6174015513 ##### [` MIPS_DELTA_INSTANCE_NO `]() MIPS\_DELTA\_INSTANCE\_NO = 6174015514 ##### [` MIPS_DELTA_RELOC `]() MIPS\_DELTA\_RELOC = 6174015515 ##### [` MIPS_DELTA_RELOC_NO `]() MIPS\_DELTA\_RELOC\_NO = 6174015516 ##### [` MIPS_DELTA_SYM `]() MIPS\_DELTA\_SYM = 6174015517 ##### [` MIPS_DELTA_SYM_NO `]() MIPS\_DELTA\_SYM\_NO = 6174015518 ##### [` MIPS_DYNSTR_ALIGN `]() MIPS\_DYNSTR\_ALIGN = 6174015531 ##### [` MIPS_FLAGS `]() MIPS\_FLAGS = 6174015493 ##### [` MIPS_GOTSYM `]() MIPS\_GOTSYM = 6174015507 ##### [` MIPS_GP_VALUE `]() MIPS\_GP\_VALUE = 6174015536 ##### [` MIPS_HIDDEN_GOTIDX `]() MIPS\_HIDDEN\_GOTIDX = 6174015527 ##### [` MIPS_HIPAGENO `]() MIPS\_HIPAGENO = 6174015508 ##### [` MIPS_ICHECKSUM `]() MIPS\_ICHECKSUM = 6174015491 ##### [` MIPS_INTERFACE `]() MIPS\_INTERFACE = 6174015530 ##### [` MIPS_INTERFACE_SIZE `]() MIPS\_INTERFACE\_SIZE = 6174015532 ##### [` MIPS_IVERSION `]() MIPS\_IVERSION = 6174015492 ##### [` MIPS_LIBLIST `]() MIPS\_LIBLIST = 6174015497 ##### [` MIPS_LIBLISTNO `]() MIPS\_LIBLISTNO = 6174015504 ##### [` MIPS_LOCALPAGE_GOTIDX `]() MIPS\_LOCALPAGE\_GOTIDX = 6174015525 ##### [` MIPS_LOCAL_GOTIDX `]() MIPS\_LOCAL\_GOTIDX = 6174015526 ##### [` MIPS_LOCAL_GOTNO `]() MIPS\_LOCAL\_GOTNO = 6174015498 ##### [` MIPS_MSYM `]() MIPS\_MSYM = 6174015495 ##### [` MIPS_OPTIONS `]() MIPS\_OPTIONS = 6174015529 ##### [` MIPS_PERF_SUFFIX `]() MIPS\_PERF\_SUFFIX = 6174015534 ##### [` MIPS_PIXIE_INIT `]() MIPS\_PIXIE\_INIT = 6174015523 ##### [` MIPS_PLTGOT `]() MIPS\_PLTGOT = 6174015538 ##### [` MIPS_PROTECTED_GOTIDX `]() MIPS\_PROTECTED\_GOTIDX = 6174015528 ##### [` MIPS_RLD_MAP `]() MIPS\_RLD\_MAP = 6174015510 ##### [` MIPS_RLD_MAP_REL `]() MIPS\_RLD\_MAP\_REL = 6174015541 ##### [` MIPS_RLD_TEXT_RESOLVE_ADDR `]() MIPS\_RLD\_TEXT\_RESOLVE\_ADDR = 6174015533 ##### [` MIPS_RLD_VERSION `]() MIPS\_RLD\_VERSION = 6174015489 ##### [` MIPS_RWPLT `]() MIPS\_RWPLT = 6174015540 ##### [` MIPS_SYMBOL_LIB `]() MIPS\_SYMBOL\_LIB = 6174015524 ##### [` MIPS_SYMTABNO `]() MIPS\_SYMTABNO = 6174015505 ##### [` MIPS_TIME_STAMP `]() MIPS\_TIME\_STAMP = 6174015490 ##### [` MIPS_UNREFEXTNO `]() MIPS\_UNREFEXTNO = 6174015506 ##### [` MIPS_XHASH `]() MIPS\_XHASH = 6174015542 ##### [` NEEDED `]() NEEDED = 1 ##### [` NULL `]() NULL = 0 ##### [` PLTGOT `]() PLTGOT = 3 ##### [` PLTREL `]() PLTREL = 20 ##### [` PLTRELSZ `]() PLTRELSZ = 2 ##### [` PPC64_GLINK `]() PPC64\_GLINK = 23353884672 ##### [` PPC64_OPT `]() PPC64\_OPT = 23353884675 ##### [` PPC_GOT `]() PPC\_GOT = 19058917376 ##### [` PPC_OPT `]() PPC\_OPT = 19058917377 ##### [` PREINIT_ARRAY `]() PREINIT\_ARRAY = 32 ##### [` PREINIT_ARRAYSZ `]() PREINIT\_ARRAYSZ = 33 ##### [` REL `]() REL = 17 ##### [` RELA `]() RELA = 7 ##### [` RELACOUNT `]() RELACOUNT = 1879048185 ##### [` RELAENT `]() RELAENT = 9 ##### [` RELASZ `]() RELASZ = 8 ##### [` RELCOUNT `]() RELCOUNT = 1879048186 ##### [` RELENT `]() RELENT = 19 ##### [` RELR `]() RELR = 36 ##### [` RELRENT `]() RELRENT = 37 ##### [` RELRSZ `]() RELRSZ = 35 ##### [` RELSZ `]() RELSZ = 18 ##### [` RISCV_VARIANT_CC `]() RISCV\_VARIANT\_CC = 27648851971 ##### [` RPATH `]() RPATH = 15 ##### [` RUNPATH `]() RUNPATH = 29 ##### [` SONAME `]() SONAME = 14 ##### [` STRSZ `]() STRSZ = 10 ##### [` STRTAB `]() STRTAB = 5 ##### [` SYMBOLIC `]() SYMBOLIC = 16 ##### [` SYMENT `]() SYMENT = 11 ##### [` SYMTAB `]() SYMTAB = 6 ##### [` SYMTAB_SHNDX `]() SYMTAB\_SHNDX = 34 ##### [` TEXTREL `]() TEXTREL = 22 ##### [` TLSDESC_GOT `]() TLSDESC\_GOT = 1879047927 ##### [` TLSDESC_PLT `]() TLSDESC\_PLT = 1879047926 ##### [` UNKNOWN `]() UNKNOWN = 18446744073709551615 ##### [` VERDEF `]() VERDEF = 1879048188 ##### [` VERDEFNUM `]() VERDEFNUM = 1879048189 ##### [` VERNEED `]() VERNEED = 1879048190 ##### [` VERNEEDNUM `]() VERNEEDNUM = 1879048191 ##### [` VERSYM `]() VERSYM = 1879048176 ##### [` X86_64_PLT `]() X86\_64\_PLT = 31943819264 ##### [` X86_64_PLTENT `]() X86\_64\_PLTENT = 31943819267 ##### [` X86_64_PLTSZ `]() X86\_64\_PLTSZ = 31943819265 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.DynamicEntry.TAG]( "lief.ELF.DynamicEntry.TAG") = <nanobind.nb\_func object> #### [` tag `]() property tag → [lief.ELF.DynamicEntry.TAG]( "lief.ELF.DynamicEntry.TAG") Return the entry’s [`TAG`]( "lief.ELF.DynamicEntry.TAG") which represent the entry type #### [` value `]() property value → int Return the entry’s value The meaning of the value strongly depends on the tag. It can be an offset, an index, a flag, … --- ## [Dynamic Entry Library]() ![Inheritance diagram of lief._lief.ELF.DynamicEntryLibrary](https://lief.re/doc/latest/_images/inheritance-1bd0604041d79e8ea23112a9f4b8c82b9ad1278c.png) ### [` lief.ELF.DynamicEntryLibrary `]() class lief.ELF.DynamicEntryLibrary(*self*, *library\_name: str*) Bases: [`DynamicEntry`]( "lief._lief.ELF.DynamicEntry") Class which represents a `DT_NEEDED` entry in the dynamic table. This kind of entry is usually used to create library dependency. Constructor from a library name #### [` name `]() property name → str | bytes Library associated with this entry (e.g. `libc.so.6`) --- ## [Dynamic Shared Object]() ![Inheritance diagram of lief._lief.ELF.DynamicSharedObject](https://lief.re/doc/latest/_images/inheritance-2b0107d2aadabec9fc248e4084062be88be369ce.png) ### [` lief.ELF.DynamicSharedObject `]() class lief.ELF.DynamicSharedObject(*self*, *library\_name: str*) Bases: [`DynamicEntry`]( "lief._lief.ELF.DynamicEntry") Class which represents a `DT_SONAME` entry in the dynamic table This kind of entry is usually used to name the original library. This entry is not present for executables. Constructor from library name #### [` name `]() property name → str | bytes Return the library name --- ## [Dynamic Entry Run Path]() ![Inheritance diagram of lief._lief.ELF.DynamicEntryRunPath](https://lief.re/doc/latest/_images/inheritance-597d7e1d797216811ecccf22f20289066df3b15e.png) ### [` lief.ELF.DynamicEntryRunPathlief.ELF.DynamicEntryRunPath `]() class lief.ELF.DynamicEntryRunPath(*self*, *path: str = ''*) **class lief.ELF.DynamicEntryRunPath(*self*, *paths: collections.abc.Sequence[str]*)** Bases: [`DynamicEntry`]( "lief._lief.ELF.DynamicEntry") Class that represents a `DT_RUNPATH` which is used by the loader to resolve libraries ([`DynamicEntryLibrary`]( "lief.ELF.DynamicEntryLibrary")). Overloaded function. 1. `__init__(self, path: str = '') -> None` Constructor from a (run)path 2. `__init__(self, paths: collections.abc.Sequence[str]) -> None` Constructor from a list of paths #### [` append `]() append(*self*, *path: str*) → [lief.\_lief.ELF.DynamicEntryRunPath]( "lief._lief.ELF.DynamicEntryRunPath") Append the given `path` #### [` insert `]() insert(*self*, *position: int*, *path: str*) → [lief.\_lief.ELF.DynamicEntryRunPath]( "lief._lief.ELF.DynamicEntryRunPath") Insert a `path` at the given `position` #### [` paths `]() property paths → list[str] Paths as a list #### [` remove `]() remove(*self*, *path: str*) → [lief.\_lief.ELF.DynamicEntryRunPath]( "lief._lief.ELF.DynamicEntryRunPath") Remove the given `path` #### [` runpath `]() property runpath → str | bytes Runpath raw value --- ## [Dynamic Entry RPath]() ![Inheritance diagram of lief._lief.ELF.DynamicEntryRpath](https://lief.re/doc/latest/_images/inheritance-a2f66ba2721a87ecdfe99a39990b91953cbc0cdb.png) ### [` lief.ELF.DynamicEntryRpathlief.ELF.DynamicEntryRpath `]() class lief.ELF.DynamicEntryRpath(*self*, *path: str = ''*) **class lief.ELF.DynamicEntryRpath(*self*, *paths: collections.abc.Sequence[str]*)** Bases: [`DynamicEntry`]( "lief._lief.ELF.DynamicEntry") Class which represents a `DT_RPATH` entry. This attribute is deprecated (cf. `man ld`) in favour of `DT_RUNPATH` (See [`DynamicEntryRunPath`]( "lief.ELF.DynamicEntryRunPath")) Overloaded function. 1. `__init__(self, path: str = '') -> None` Constructor from (r)path 2. `__init__(self, paths: collections.abc.Sequence[str]) -> None` Constructor from a list of paths #### [` append `]() append(*self*, *path: str*) → [lief.\_lief.ELF.DynamicEntryRpath]( "lief._lief.ELF.DynamicEntryRpath") Append the given `path` #### [` insert `]() insert(*self*, *position: int*, *path: str*) → [lief.\_lief.ELF.DynamicEntryRpath]( "lief._lief.ELF.DynamicEntryRpath") Insert a `path` at the given `position` #### [` paths `]() property paths → list[str] Paths as a list #### [` remove `]() remove(*self*, *path: str*) → [lief.\_lief.ELF.DynamicEntryRpath]( "lief._lief.ELF.DynamicEntryRpath") Remove the given `path` #### [` rpath `]() property rpath → str | bytes The actual rpath as a string --- ## [Dynamic Entry Array]() ![Inheritance diagram of lief._lief.ELF.DynamicEntryArray](https://lief.re/doc/latest/_images/inheritance-611e7a8dd68b0fc158a61f101c5f76fa04c4eb72.png) ### [` lief.ELF.DynamicEntryArray `]() class lief.ELF.DynamicEntryArray(*self*, *tag: [lief.\_lief.ELF.DynamicEntry.TAG]( "lief._lief.ELF.DynamicEntry.TAG")*, *array: collections.abc.Sequence[int]*) Bases: [`DynamicEntry`]( "lief._lief.ELF.DynamicEntry") Class that represents an array in the dynamic table. This entry is associated with constructors: - `DT_PREINIT_ARRAY` - `DT_INIT_ARRAY` - `DT_FINI_ARRAY` The underlying values are 64-bits integers to cover both: ELF32 and ELF64 binaries. #### [` append `]() append(*self*, *function: int*) → [lief.\_lief.ELF.DynamicEntryArray]( "lief._lief.ELF.DynamicEntryArray") Append the given `function` #### [` array `]() property array → list[int] Return the array as a list of integers #### [` insert `]() insert(*self*, *pos: int*, *function: int*) → [lief.\_lief.ELF.DynamicEntryArray]( "lief._lief.ELF.DynamicEntryArray") Insert the given `function` at `pos` #### [` remove `]() remove(*self*, *function: int*) → [lief.\_lief.ELF.DynamicEntryArray]( "lief._lief.ELF.DynamicEntryArray") Remove the given `function` --- ## [Dynamic Entry Flags]() ![Inheritance diagram of lief._lief.ELF.DynamicEntryFlags](https://lief.re/doc/latest/_images/inheritance-526be50f6f6f926f78b3819456615e24dccd4d49.png) ### [` lief.ELF.DynamicEntryFlags `]() class lief.ELF.DynamicEntryFlags Bases: [`DynamicEntry`]( "lief._lief.ELF.DynamicEntry") #### [` FLAG `]() class FLAG(*\*values*) Bases: `Enum` ##### [` BIND_NOW `]() BIND\_NOW = 8 ##### [` CONFALT `]() CONFALT = 4294975488 ##### [` DIRECT `]() DIRECT = 4294967552 ##### [` DISPRELDNE `]() DISPRELDNE = 4295000064 ##### [` DISPRELPND `]() DISPRELPND = 4295032832 ##### [` EDITED `]() EDITED = 4297064448 ##### [` ENDFILTEE `]() ENDFILTEE = 4294983680 ##### [` GLOBAL `]() GLOBAL = 4294967298 ##### [` GLOBAUDIT `]() GLOBAUDIT = 4311744512 ##### [` GROUP `]() GROUP = 4294967300 ##### [` HANDLE_ORIGIN `]() HANDLE\_ORIGIN = 4294967424 ##### [` IGNMULDEF `]() IGNMULDEF = 4295229440 ##### [` INITFIRST `]() INITFIRST = 4294967328 ##### [` INTERPOSE `]() INTERPOSE = 4294968320 ##### [` KMOD `]() KMOD = 4563402752 ##### [` LOADFLTR `]() LOADFLTR = 4294967312 ##### [` NOCOMMON `]() NOCOMMON = 5368709120 ##### [` NODEFLIB `]() NODEFLIB = 4294969344 ##### [` NODELETE `]() NODELETE = 4294967304 ##### [` NODIRECT `]() NODIRECT = 4295098368 ##### [` NODUMP `]() NODUMP = 4294971392 ##### [` NOHDR `]() NOHDR = 4296015872 ##### [` NOKSYMS `]() NOKSYMS = 4295491584 ##### [` NOOPEN `]() NOOPEN = 4294967360 ##### [` NORELOC `]() NORELOC = 4299161600 ##### [` NOW `]() NOW = 4294967297 ##### [` ORIGIN `]() ORIGIN = 1 ##### [` PIE `]() PIE = 4429185024 ##### [` SINGLETON `]() SINGLETON = 4328521728 ##### [` STATIC_TLS `]() STATIC\_TLS = 16 ##### [` SYMBOLIC `]() SYMBOLIC = 2 ##### [` SYMINTPOSE `]() SYMINTPOSE = 4303355904 ##### [` TEXTREL `]() TEXTREL = 4 ##### [` TRANS `]() TRANS = 4294967808 ##### [` WEAKFILTER `]() WEAKFILTER = 4831838208 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.DynamicEntryFlags.FLAG]( "lief.ELF.DynamicEntryFlags.FLAG") = <nanobind.nb\_func object> #### [` add `]() add(*self*, *flag: [lief.\_lief.ELF.DynamicEntryFlags.FLAG]( "lief._lief.ELF.DynamicEntryFlags.FLAG")*) → None Add the given [`FLAG`]( "lief.ELF.DynamicEntryFlags.FLAG") #### [` flags `]() property flags → list[[lief.ELF.DynamicEntryFlags.FLAG]( "lief.ELF.DynamicEntryFlags.FLAG")] Return list of [`FLAG`]( "lief.ELF.DynamicEntryFlags.FLAG") #### [` has `]() has(*self*, *flag: [lief.\_lief.ELF.DynamicEntryFlags.FLAG]( "lief._lief.ELF.DynamicEntryFlags.FLAG")*) → bool Check if this entry contains the given [`FLAG`]( "lief.ELF.DynamicEntryFlags.FLAG") #### [` remove `]() remove(*self*, *flag: [lief.\_lief.ELF.DynamicEntryFlags.FLAG]( "lief._lief.ELF.DynamicEntryFlags.FLAG")*) → None Remove the given [`FLAG`]( "lief.ELF.DynamicEntryFlags.FLAG") --- ## [Dynamic Entry Auxiliary]() ![Inheritance diagram of lief._lief.ELF.DynamicEntryAuxiliary](https://lief.re/doc/latest/_images/inheritance-d61812c05c4a7befcde071368abd9c8324139dfa.png) ### [` lief.ELF.DynamicEntryAuxiliary `]() class lief.ELF.DynamicEntryAuxiliary(*self*, *library\_name: str*) Bases: [`DynamicEntry`]( "lief._lief.ELF.DynamicEntry") Class which represents a `DT_AUXILIARY` entry in the dynamic table. This kind of entry is used to specify a shared object that should be loaded before the current one. Constructor from library name #### [` name `]() property name → str | bytes Return the library name --- ## [Dynamic Entry Filter]() ![Inheritance diagram of lief._lief.ELF.DynamicEntryFilter](https://lief.re/doc/latest/_images/inheritance-fdf9e1aa570f4dd50642309209f67acfb2d6599d.png) ### [` lief.ELF.DynamicEntryFilter `]() class lief.ELF.DynamicEntryFilter(*self*, *library\_name: str*) Bases: [`DynamicEntry`]( "lief._lief.ELF.DynamicEntry") Class which represents a `DT_FILTER` entry in the dynamic table. This kind of entry is used to specify a shared object for which the current one is a filter. Constructor from library name #### [` name `]() property name → str | bytes Return the library name --- ## [Relocations]() ### [` lief.ELF.Relocationlief.ELF.Relocationlief.ELF.Relocation `]() class lief.ELF.Relocation(*self*) **class lief.ELF.Relocation(*self*, *arch: [lief.\_lief.ELF.ARCH]( "lief._lief.ELF.ARCH")*) **class lief.ELF.Relocation(*self*, *address: int*, *type: [lief.\_lief.ELF.Relocation.TYPE]( "lief._lief.ELF.Relocation.TYPE")*, *encoding: [lief.\_lief.ELF.Relocation.ENCODING]( "lief._lief.ELF.Relocation.ENCODING")*)**** Bases: [`Relocation`]( "lief._lief.Relocation") Class that represents an ELF relocation. #### [` ENCODING `]() class ENCODING(*\*values*) Bases: `Enum` ##### [` ANDROID_SLEB `]() ANDROID\_SLEB = 4 ##### [` REL `]() REL = 1 ##### [` RELA `]() RELA = 2 ##### [` RELR `]() RELR = 3 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.Relocation.ENCODING]( "lief.ELF.Relocation.ENCODING") = <nanobind.nb\_func object> #### [` PURPOSE `]() class PURPOSE(*\*values*) Bases: `Enum` ##### [` DYNAMIC `]() DYNAMIC = 2 ##### [` NONE `]() NONE = 0 ##### [` OBJECT `]() OBJECT = 3 ##### [` PLTGOT `]() PLTGOT = 1 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.Relocation.PURPOSE]( "lief.ELF.Relocation.PURPOSE") = <nanobind.nb\_func object> #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` ##### [` AARCH64_ABS16 `]() AARCH64\_ABS16 = 268435715 ##### [` AARCH64_ABS32 `]() AARCH64\_ABS32 = 268435714 ##### [` AARCH64_ABS64 `]() AARCH64\_ABS64 = 268435713 ##### [` AARCH64_ADD_ABS_LO12_NC `]() AARCH64\_ADD\_ABS\_LO12\_NC = 268435733 ##### [` AARCH64_ADR_GOT_PAGE `]() AARCH64\_ADR\_GOT\_PAGE = 268435767 ##### [` AARCH64_ADR_PREL_LO21 `]() AARCH64\_ADR\_PREL\_LO21 = 268435730 ##### [` AARCH64_ADR_PREL_PG_HI21 `]() AARCH64\_ADR\_PREL\_PG\_HI21 = 268435731 ##### [` AARCH64_ADR_PREL_PG_HI21_NC `]() AARCH64\_ADR\_PREL\_PG\_HI21\_NC = 268435732 ##### [` AARCH64_CALL26 `]() AARCH64\_CALL26 = 268435739 ##### [` AARCH64_CONDBR19 `]() AARCH64\_CONDBR19 = 268435736 ##### [` AARCH64_COPY `]() AARCH64\_COPY = 268436480 ##### [` AARCH64_GLOB_DAT `]() AARCH64\_GLOB\_DAT = 268436481 ##### [` AARCH64_GOTREL32 `]() AARCH64\_GOTREL32 = 268435764 ##### [` AARCH64_GOTREL64 `]() AARCH64\_GOTREL64 = 268435763 ##### [` AARCH64_GOT_LD_PREL19 `]() AARCH64\_GOT\_LD\_PREL19 = 268435765 ##### [` AARCH64_IRELATIVE `]() AARCH64\_IRELATIVE = 268436488 ##### [` AARCH64_JUMP26 `]() AARCH64\_JUMP26 = 268435738 ##### [` AARCH64_JUMP_SLOT `]() AARCH64\_JUMP\_SLOT = 268436482 ##### [` AARCH64_LD64_GOTOFF_LO15 `]() AARCH64\_LD64\_GOTOFF\_LO15 = 268435766 ##### [` AARCH64_LD64_GOTPAGE_LO15 `]() AARCH64\_LD64\_GOTPAGE\_LO15 = 268435769 ##### [` AARCH64_LD64_GOT_LO12_NC `]() AARCH64\_LD64\_GOT\_LO12\_NC = 268435768 ##### [` AARCH64_LDST128_ABS_LO12_NC `]() AARCH64\_LDST128\_ABS\_LO12\_NC = 268435755 ##### [` AARCH64_LDST16_ABS_LO12_NC `]() AARCH64\_LDST16\_ABS\_LO12\_NC = 268435740 ##### [` AARCH64_LDST32_ABS_LO12_NC `]() AARCH64\_LDST32\_ABS\_LO12\_NC = 268435741 ##### [` AARCH64_LDST64_ABS_LO12_NC `]() AARCH64\_LDST64\_ABS\_LO12\_NC = 268435742 ##### [` AARCH64_LDST8_ABS_LO12_NC `]() AARCH64\_LDST8\_ABS\_LO12\_NC = 268435734 ##### [` AARCH64_LD_PREL_LO19 `]() AARCH64\_LD\_PREL\_LO19 = 268435729 ##### [` AARCH64_MOVW_GOTOFF_G0 `]() AARCH64\_MOVW\_GOTOFF\_G0 = 268435756 ##### [` AARCH64_MOVW_GOTOFF_G0_NC `]() AARCH64\_MOVW\_GOTOFF\_G0\_NC = 268435757 ##### [` AARCH64_MOVW_GOTOFF_G1 `]() AARCH64\_MOVW\_GOTOFF\_G1 = 268435758 ##### [` AARCH64_MOVW_GOTOFF_G1_NC `]() AARCH64\_MOVW\_GOTOFF\_G1\_NC = 268435759 ##### [` AARCH64_MOVW_GOTOFF_G2 `]() AARCH64\_MOVW\_GOTOFF\_G2 = 268435760 ##### [` AARCH64_MOVW_GOTOFF_G2_NC `]() AARCH64\_MOVW\_GOTOFF\_G2\_NC = 268435761 ##### [` AARCH64_MOVW_GOTOFF_G3 `]() AARCH64\_MOVW\_GOTOFF\_G3 = 268435762 ##### [` AARCH64_MOVW_PREL_G0 `]() AARCH64\_MOVW\_PREL\_G0 = 268435743 ##### [` AARCH64_MOVW_PREL_G0_NC `]() AARCH64\_MOVW\_PREL\_G0\_NC = 268435744 ##### [` AARCH64_MOVW_PREL_G1 `]() AARCH64\_MOVW\_PREL\_G1 = 268435745 ##### [` AARCH64_MOVW_PREL_G1_NC `]() AARCH64\_MOVW\_PREL\_G1\_NC = 268435746 ##### [` AARCH64_MOVW_PREL_G2 `]() AARCH64\_MOVW\_PREL\_G2 = 268435747 ##### [` AARCH64_MOVW_PREL_G2_NC `]() AARCH64\_MOVW\_PREL\_G2\_NC = 268435748 ##### [` AARCH64_MOVW_PREL_G3 `]() AARCH64\_MOVW\_PREL\_G3 = 268435749 ##### [` AARCH64_MOVW_SABS_G0 `]() AARCH64\_MOVW\_SABS\_G0 = 268435726 ##### [` AARCH64_MOVW_SABS_G1 `]() AARCH64\_MOVW\_SABS\_G1 = 268435727 ##### [` AARCH64_MOVW_SABS_G2 `]() AARCH64\_MOVW\_SABS\_G2 = 268435728 ##### [` AARCH64_MOVW_UABS_G0 `]() AARCH64\_MOVW\_UABS\_G0 = 268435719 ##### [` AARCH64_MOVW_UABS_G0_NC `]() AARCH64\_MOVW\_UABS\_G0\_NC = 268435720 ##### [` AARCH64_MOVW_UABS_G1 `]() AARCH64\_MOVW\_UABS\_G1 = 268435721 ##### [` AARCH64_MOVW_UABS_G1_NC `]() AARCH64\_MOVW\_UABS\_G1\_NC = 268435722 ##### [` AARCH64_MOVW_UABS_G2 `]() AARCH64\_MOVW\_UABS\_G2 = 268435723 ##### [` AARCH64_MOVW_UABS_G2_NC `]() AARCH64\_MOVW\_UABS\_G2\_NC = 268435724 ##### [` AARCH64_MOVW_UABS_G3 `]() AARCH64\_MOVW\_UABS\_G3 = 268435725 ##### [` AARCH64_NONE `]() AARCH64\_NONE = 268435456 ##### [` AARCH64_PREL16 `]() AARCH64\_PREL16 = 268435718 ##### [` AARCH64_PREL32 `]() AARCH64\_PREL32 = 268435717 ##### [` AARCH64_PREL64 `]() AARCH64\_PREL64 = 268435716 ##### [` AARCH64_RELATIVE `]() AARCH64\_RELATIVE = 268436483 ##### [` AARCH64_TLSDESC `]() AARCH64\_TLSDESC = 268436487 ##### [` AARCH64_TLSDESC_ADD `]() AARCH64\_TLSDESC\_ADD = 268436024 ##### [` AARCH64_TLSDESC_ADD_LO12_NC `]() AARCH64\_TLSDESC\_ADD\_LO12\_NC = 268436020 ##### [` AARCH64_TLSDESC_ADR_PAGE21 `]() AARCH64\_TLSDESC\_ADR\_PAGE21 = 268436018 ##### [` AARCH64_TLSDESC_ADR_PREL21 `]() AARCH64\_TLSDESC\_ADR\_PREL21 = 268436017 ##### [` AARCH64_TLSDESC_CALL `]() AARCH64\_TLSDESC\_CALL = 268436025 ##### [` AARCH64_TLSDESC_LD64_LO12_NC `]() AARCH64\_TLSDESC\_LD64\_LO12\_NC = 268436019 ##### [` AARCH64_TLSDESC_LDR `]() AARCH64\_TLSDESC\_LDR = 268436023 ##### [` AARCH64_TLSDESC_LD_PREL19 `]() AARCH64\_TLSDESC\_LD\_PREL19 = 268436016 ##### [` AARCH64_TLSDESC_OFF_G0_NC `]() AARCH64\_TLSDESC\_OFF\_G0\_NC = 268436022 ##### [` AARCH64_TLSDESC_OFF_G1 `]() AARCH64\_TLSDESC\_OFF\_G1 = 268436021 ##### [` AARCH64_TLSGD_ADD_LO12_NC `]() AARCH64\_TLSGD\_ADD\_LO12\_NC = 268435970 ##### [` AARCH64_TLSGD_ADR_PAGE21 `]() AARCH64\_TLSGD\_ADR\_PAGE21 = 268435969 ##### [` AARCH64_TLSGD_ADR_PREL21 `]() AARCH64\_TLSGD\_ADR\_PREL21 = 268435968 ##### [` AARCH64_TLSGD_MOVW_G0_NC `]() AARCH64\_TLSGD\_MOVW\_G0\_NC = 268435972 ##### [` AARCH64_TLSGD_MOVW_G1 `]() AARCH64\_TLSGD\_MOVW\_G1 = 268435971 ##### [` AARCH64_TLSIE_ADR_GOTTPREL_PAGE21 `]() AARCH64\_TLSIE\_ADR\_GOTTPREL\_PAGE21 = 268435997 ##### [` AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC `]() AARCH64\_TLSIE\_LD64\_GOTTPREL\_LO12\_NC = 268435998 ##### [` AARCH64_TLSIE_LD_GOTTPREL_PREL19 `]() AARCH64\_TLSIE\_LD\_GOTTPREL\_PREL19 = 268435999 ##### [` AARCH64_TLSIE_MOVW_GOTTPREL_G0_NC `]() AARCH64\_TLSIE\_MOVW\_GOTTPREL\_G0\_NC = 268435996 ##### [` AARCH64_TLSIE_MOVW_GOTTPREL_G1 `]() AARCH64\_TLSIE\_MOVW\_GOTTPREL\_G1 = 268435995 ##### [` AARCH64_TLSLD_ADD_DTPREL_HI12 `]() AARCH64\_TLSLD\_ADD\_DTPREL\_HI12 = 268435984 ##### [` AARCH64_TLSLD_ADD_DTPREL_LO12 `]() AARCH64\_TLSLD\_ADD\_DTPREL\_LO12 = 268435985 ##### [` AARCH64_TLSLD_ADD_DTPREL_LO12_NC `]() AARCH64\_TLSLD\_ADD\_DTPREL\_LO12\_NC = 268435986 ##### [` AARCH64_TLSLD_ADD_LO12_NC `]() AARCH64\_TLSLD\_ADD\_LO12\_NC = 268435975 ##### [` AARCH64_TLSLD_ADR_PAGE21 `]() AARCH64\_TLSLD\_ADR\_PAGE21 = 268435974 ##### [` AARCH64_TLSLD_ADR_PREL21 `]() AARCH64\_TLSLD\_ADR\_PREL21 = 268435973 ##### [` AARCH64_TLSLD_LDST128_DTPREL_LO12 `]() AARCH64\_TLSLD\_LDST128\_DTPREL\_LO12 = 268436028 ##### [` AARCH64_TLSLD_LDST128_DTPREL_LO12_NC `]() AARCH64\_TLSLD\_LDST128\_DTPREL\_LO12\_NC = 268436029 ##### [` AARCH64_TLSLD_LDST16_DTPREL_LO12 `]() AARCH64\_TLSLD\_LDST16\_DTPREL\_LO12 = 268435989 ##### [` AARCH64_TLSLD_LDST16_DTPREL_LO12_NC `]() AARCH64\_TLSLD\_LDST16\_DTPREL\_LO12\_NC = 268435990 ##### [` AARCH64_TLSLD_LDST32_DTPREL_LO12 `]() AARCH64\_TLSLD\_LDST32\_DTPREL\_LO12 = 268435991 ##### [` AARCH64_TLSLD_LDST32_DTPREL_LO12_NC `]() AARCH64\_TLSLD\_LDST32\_DTPREL\_LO12\_NC = 268435992 ##### [` AARCH64_TLSLD_LDST64_DTPREL_LO12 `]() AARCH64\_TLSLD\_LDST64\_DTPREL\_LO12 = 268435993 ##### [` AARCH64_TLSLD_LDST64_DTPREL_LO12_NC `]() AARCH64\_TLSLD\_LDST64\_DTPREL\_LO12\_NC = 268435994 ##### [` AARCH64_TLSLD_LDST8_DTPREL_LO12 `]() AARCH64\_TLSLD\_LDST8\_DTPREL\_LO12 = 268435987 ##### [` AARCH64_TLSLD_LDST8_DTPREL_LO12_NC `]() AARCH64\_TLSLD\_LDST8\_DTPREL\_LO12\_NC = 268435988 ##### [` AARCH64_TLSLD_LD_PREL19 `]() AARCH64\_TLSLD\_LD\_PREL19 = 268435978 ##### [` AARCH64_TLSLD_MOVW_DTPREL_G0 `]() AARCH64\_TLSLD\_MOVW\_DTPREL\_G0 = 268435982 ##### [` AARCH64_TLSLD_MOVW_DTPREL_G0_NC `]() AARCH64\_TLSLD\_MOVW\_DTPREL\_G0\_NC = 268435983 ##### [` AARCH64_TLSLD_MOVW_DTPREL_G1 `]() AARCH64\_TLSLD\_MOVW\_DTPREL\_G1 = 268435980 ##### [` AARCH64_TLSLD_MOVW_DTPREL_G1_NC `]() AARCH64\_TLSLD\_MOVW\_DTPREL\_G1\_NC = 268435981 ##### [` AARCH64_TLSLD_MOVW_DTPREL_G2 `]() AARCH64\_TLSLD\_MOVW\_DTPREL\_G2 = 268435979 ##### [` AARCH64_TLSLD_MOVW_G0_NC `]() AARCH64\_TLSLD\_MOVW\_G0\_NC = 268435977 ##### [` AARCH64_TLSLD_MOVW_G1 `]() AARCH64\_TLSLD\_MOVW\_G1 = 268435976 ##### [` AARCH64_TLSLE_ADD_TPREL_HI12 `]() AARCH64\_TLSLE\_ADD\_TPREL\_HI12 = 268436005 ##### [` AARCH64_TLSLE_ADD_TPREL_LO12 `]() AARCH64\_TLSLE\_ADD\_TPREL\_LO12 = 268436006 ##### [` AARCH64_TLSLE_ADD_TPREL_LO12_NC `]() AARCH64\_TLSLE\_ADD\_TPREL\_LO12\_NC = 268436007 ##### [` AARCH64_TLSLE_LDST128_TPREL_LO12 `]() AARCH64\_TLSLE\_LDST128\_TPREL\_LO12 = 268436026 ##### [` AARCH64_TLSLE_LDST128_TPREL_LO12_NC `]() AARCH64\_TLSLE\_LDST128\_TPREL\_LO12\_NC = 268436027 ##### [` AARCH64_TLSLE_LDST16_TPREL_LO12 `]() AARCH64\_TLSLE\_LDST16\_TPREL\_LO12 = 268436010 ##### [` AARCH64_TLSLE_LDST16_TPREL_LO12_NC `]() AARCH64\_TLSLE\_LDST16\_TPREL\_LO12\_NC = 268436011 ##### [` AARCH64_TLSLE_LDST32_TPREL_LO12 `]() AARCH64\_TLSLE\_LDST32\_TPREL\_LO12 = 268436012 ##### [` AARCH64_TLSLE_LDST32_TPREL_LO12_NC `]() AARCH64\_TLSLE\_LDST32\_TPREL\_LO12\_NC = 268436013 ##### [` AARCH64_TLSLE_LDST64_TPREL_LO12 `]() AARCH64\_TLSLE\_LDST64\_TPREL\_LO12 = 268436014 ##### [` AARCH64_TLSLE_LDST64_TPREL_LO12_NC `]() AARCH64\_TLSLE\_LDST64\_TPREL\_LO12\_NC = 268436015 ##### [` AARCH64_TLSLE_LDST8_TPREL_LO12 `]() AARCH64\_TLSLE\_LDST8\_TPREL\_LO12 = 268436008 ##### [` AARCH64_TLSLE_LDST8_TPREL_LO12_NC `]() AARCH64\_TLSLE\_LDST8\_TPREL\_LO12\_NC = 268436009 ##### [` AARCH64_TLSLE_MOVW_TPREL_G0 `]() AARCH64\_TLSLE\_MOVW\_TPREL\_G0 = 268436003 ##### [` AARCH64_TLSLE_MOVW_TPREL_G0_NC `]() AARCH64\_TLSLE\_MOVW\_TPREL\_G0\_NC = 268436004 ##### [` AARCH64_TLSLE_MOVW_TPREL_G1 `]() AARCH64\_TLSLE\_MOVW\_TPREL\_G1 = 268436001 ##### [` AARCH64_TLSLE_MOVW_TPREL_G1_NC `]() AARCH64\_TLSLE\_MOVW\_TPREL\_G1\_NC = 268436002 ##### [` AARCH64_TLSLE_MOVW_TPREL_G2 `]() AARCH64\_TLSLE\_MOVW\_TPREL\_G2 = 268436000 ##### [` AARCH64_TLS_DTPMOD64 `]() AARCH64\_TLS\_DTPMOD64 = 268436485 ##### [` AARCH64_TLS_DTPREL64 `]() AARCH64\_TLS\_DTPREL64 = 268436484 ##### [` AARCH64_TLS_TPREL64 `]() AARCH64\_TLS\_TPREL64 = 268436486 ##### [` AARCH64_TSTBR14 `]() AARCH64\_TSTBR14 = 268435735 ##### [` ARM_ABS12 `]() ARM\_ABS12 = 402653190 ##### [` ARM_ABS16 `]() ARM\_ABS16 = 402653189 ##### [` ARM_ABS32 `]() ARM\_ABS32 = 402653186 ##### [` ARM_ABS32_NOI `]() ARM\_ABS32\_NOI = 402653239 ##### [` ARM_ABS8 `]() ARM\_ABS8 = 402653192 ##### [` ARM_ALU_PCREL_15_8 `]() ARM\_ALU\_PCREL\_15\_8 = 402653217 ##### [` ARM_ALU_PCREL_23_15 `]() ARM\_ALU\_PCREL\_23\_15 = 402653218 ##### [` ARM_ALU_PCREL_7_0 `]() ARM\_ALU\_PCREL\_7\_0 = 402653216 ##### [` ARM_ALU_PC_G0 `]() ARM\_ALU\_PC\_G0 = 402653242 ##### [` ARM_ALU_PC_G0_NC `]() ARM\_ALU\_PC\_G0\_NC = 402653241 ##### [` ARM_ALU_PC_G1 `]() ARM\_ALU\_PC\_G1 = 402653244 ##### [` ARM_ALU_PC_G1_NC `]() ARM\_ALU\_PC\_G1\_NC = 402653243 ##### [` ARM_ALU_PC_G2 `]() ARM\_ALU\_PC\_G2 = 402653245 ##### [` ARM_ALU_SBREL_19_12_NC `]() ARM\_ALU\_SBREL\_19\_12\_NC = 402653220 ##### [` ARM_ALU_SBREL_27_20_CK `]() ARM\_ALU\_SBREL\_27\_20\_CK = 402653221 ##### [` ARM_ALU_SB_G0 `]() ARM\_ALU\_SB\_G0 = 402653255 ##### [` ARM_ALU_SB_G0_NC `]() ARM\_ALU\_SB\_G0\_NC = 402653254 ##### [` ARM_ALU_SB_G1 `]() ARM\_ALU\_SB\_G1 = 402653257 ##### [` ARM_ALU_SB_G1_NC `]() ARM\_ALU\_SB\_G1\_NC = 402653256 ##### [` ARM_ALU_SB_G2 `]() ARM\_ALU\_SB\_G2 = 402653258 ##### [` ARM_BASE_ABS `]() ARM\_BASE\_ABS = 402653215 ##### [` ARM_BASE_PREL `]() ARM\_BASE\_PREL = 402653209 ##### [` ARM_BREL_ADJ `]() ARM\_BREL\_ADJ = 402653196 ##### [` ARM_CALL `]() ARM\_CALL = 402653212 ##### [` ARM_COPY `]() ARM\_COPY = 402653204 ##### [` ARM_GLOB_DAT `]() ARM\_GLOB\_DAT = 402653205 ##### [` ARM_GNU_VTENTRY `]() ARM\_GNU\_VTENTRY = 402653284 ##### [` ARM_GNU_VTINHERIT `]() ARM\_GNU\_VTINHERIT = 402653285 ##### [` ARM_GOTOFF12 `]() ARM\_GOTOFF12 = 402653282 ##### [` ARM_GOTOFF32 `]() ARM\_GOTOFF32 = 402653208 ##### [` ARM_GOTRELAX `]() ARM\_GOTRELAX = 402653283 ##### [` ARM_GOT_ABS `]() ARM\_GOT\_ABS = 402653279 ##### [` ARM_GOT_BREL `]() ARM\_GOT\_BREL = 402653210 ##### [` ARM_GOT_BREL12 `]() ARM\_GOT\_BREL12 = 402653281 ##### [` ARM_GOT_PREL `]() ARM\_GOT\_PREL = 402653280 ##### [` ARM_IRELATIVE `]() ARM\_IRELATIVE = 402653344 ##### [` ARM_JUMP24 `]() ARM\_JUMP24 = 402653213 ##### [` ARM_JUMP_SLOT `]() ARM\_JUMP\_SLOT = 402653206 ##### [` ARM_LDC_PC_G0 `]() ARM\_LDC\_PC\_G0 = 402653251 ##### [` ARM_LDC_PC_G1 `]() ARM\_LDC\_PC\_G1 = 402653252 ##### [` ARM_LDC_PC_G2 `]() ARM\_LDC\_PC\_G2 = 402653253 ##### [` ARM_LDC_SB_G0 `]() ARM\_LDC\_SB\_G0 = 402653265 ##### [` ARM_LDC_SB_G1 `]() ARM\_LDC\_SB\_G1 = 402653266 ##### [` ARM_LDC_SB_G2 `]() ARM\_LDC\_SB\_G2 = 402653267 ##### [` ARM_LDRS_PC_G0 `]() ARM\_LDRS\_PC\_G0 = 402653248 ##### [` ARM_LDRS_PC_G1 `]() ARM\_LDRS\_PC\_G1 = 402653249 ##### [` ARM_LDRS_PC_G2 `]() ARM\_LDRS\_PC\_G2 = 402653250 ##### [` ARM_LDRS_SB_G0 `]() ARM\_LDRS\_SB\_G0 = 402653262 ##### [` ARM_LDRS_SB_G1 `]() ARM\_LDRS\_SB\_G1 = 402653263 ##### [` ARM_LDRS_SB_G2 `]() ARM\_LDRS\_SB\_G2 = 402653264 ##### [` ARM_LDR_PC_G0 `]() ARM\_LDR\_PC\_G0 = 402653188 ##### [` ARM_LDR_PC_G1 `]() ARM\_LDR\_PC\_G1 = 402653246 ##### [` ARM_LDR_PC_G2 `]() ARM\_LDR\_PC\_G2 = 402653247 ##### [` ARM_LDR_SBREL_11_0_NC `]() ARM\_LDR\_SBREL\_11\_0\_NC = 402653219 ##### [` ARM_LDR_SB_G0 `]() ARM\_LDR\_SB\_G0 = 402653259 ##### [` ARM_LDR_SB_G1 `]() ARM\_LDR\_SB\_G1 = 402653260 ##### [` ARM_LDR_SB_G2 `]() ARM\_LDR\_SB\_G2 = 402653261 ##### [` ARM_ME_TOO `]() ARM\_ME\_TOO = 402653312 ##### [` ARM_MOVT_ABS `]() ARM\_MOVT\_ABS = 402653228 ##### [` ARM_MOVT_BREL `]() ARM\_MOVT\_BREL = 402653269 ##### [` ARM_MOVT_PREL `]() ARM\_MOVT\_PREL = 402653230 ##### [` ARM_MOVW_ABS_NC `]() ARM\_MOVW\_ABS\_NC = 402653227 ##### [` ARM_MOVW_BREL `]() ARM\_MOVW\_BREL = 402653270 ##### [` ARM_MOVW_BREL_NC `]() ARM\_MOVW\_BREL\_NC = 402653268 ##### [` ARM_MOVW_PREL_NC `]() ARM\_MOVW\_PREL\_NC = 402653229 ##### [` ARM_NONE `]() ARM\_NONE = 402653184 ##### [` ARM_PC24 `]() ARM\_PC24 = 402653185 ##### [` ARM_PLT32 `]() ARM\_PLT32 = 402653211 ##### [` ARM_PLT32_ABS `]() ARM\_PLT32\_ABS = 402653278 ##### [` ARM_PREL31 `]() ARM\_PREL31 = 402653226 ##### [` ARM_PRIVATE_0 `]() ARM\_PRIVATE\_0 = 402653296 ##### [` ARM_PRIVATE_1 `]() ARM\_PRIVATE\_1 = 402653297 ##### [` ARM_PRIVATE_10 `]() ARM\_PRIVATE\_10 = 402653306 ##### [` ARM_PRIVATE_11 `]() ARM\_PRIVATE\_11 = 402653307 ##### [` ARM_PRIVATE_12 `]() ARM\_PRIVATE\_12 = 402653308 ##### [` ARM_PRIVATE_13 `]() ARM\_PRIVATE\_13 = 402653309 ##### [` ARM_PRIVATE_14 `]() ARM\_PRIVATE\_14 = 402653310 ##### [` ARM_PRIVATE_15 `]() ARM\_PRIVATE\_15 = 402653311 ##### [` ARM_PRIVATE_2 `]() ARM\_PRIVATE\_2 = 402653298 ##### [` ARM_PRIVATE_3 `]() ARM\_PRIVATE\_3 = 402653299 ##### [` ARM_PRIVATE_4 `]() ARM\_PRIVATE\_4 = 402653300 ##### [` ARM_PRIVATE_5 `]() ARM\_PRIVATE\_5 = 402653301 ##### [` ARM_PRIVATE_6 `]() ARM\_PRIVATE\_6 = 402653302 ##### [` ARM_PRIVATE_7 `]() ARM\_PRIVATE\_7 = 402653303 ##### [` ARM_PRIVATE_8 `]() ARM\_PRIVATE\_8 = 402653304 ##### [` ARM_PRIVATE_9 `]() ARM\_PRIVATE\_9 = 402653305 ##### [` ARM_RBASE `]() ARM\_RBASE = 402653438 ##### [` ARM_REL32 `]() ARM\_REL32 = 402653187 ##### [` ARM_REL32_NOI `]() ARM\_REL32\_NOI = 402653240 ##### [` ARM_RELATIVE `]() ARM\_RELATIVE = 402653207 ##### [` ARM_RPC24 `]() ARM\_RPC24 = 402653437 ##### [` ARM_RREL32 `]() ARM\_RREL32 = 402653436 ##### [` ARM_RSBREL32 `]() ARM\_RSBREL32 = 402653434 ##### [` ARM_RXPC25 `]() ARM\_RXPC25 = 402653433 ##### [` ARM_SBREL31 `]() ARM\_SBREL31 = 402653223 ##### [` ARM_SBREL32 `]() ARM\_SBREL32 = 402653193 ##### [` ARM_TARGET1 `]() ARM\_TARGET1 = 402653222 ##### [` ARM_TARGET2 `]() ARM\_TARGET2 = 402653225 ##### [` ARM_THM_ABS5 `]() ARM\_THM\_ABS5 = 402653191 ##### [` ARM_THM_ALU_PREL_11_0 `]() ARM\_THM\_ALU\_PREL\_11\_0 = 402653237 ##### [` ARM_THM_CALL `]() ARM\_THM\_CALL = 402653194 ##### [` ARM_THM_JUMP11 `]() ARM\_THM\_JUMP11 = 402653286 ##### [` ARM_THM_JUMP19 `]() ARM\_THM\_JUMP19 = 402653235 ##### [` ARM_THM_JUMP24 `]() ARM\_THM\_JUMP24 = 402653214 ##### [` ARM_THM_JUMP6 `]() ARM\_THM\_JUMP6 = 402653236 ##### [` ARM_THM_JUMP8 `]() ARM\_THM\_JUMP8 = 402653287 ##### [` ARM_THM_MOVT_ABS `]() ARM\_THM\_MOVT\_ABS = 402653232 ##### [` ARM_THM_MOVT_BREL `]() ARM\_THM\_MOVT\_BREL = 402653272 ##### [` ARM_THM_MOVT_PREL `]() ARM\_THM\_MOVT\_PREL = 402653234 ##### [` ARM_THM_MOVW_ABS_NC `]() ARM\_THM\_MOVW\_ABS\_NC = 402653231 ##### [` ARM_THM_MOVW_BREL `]() ARM\_THM\_MOVW\_BREL = 402653273 ##### [` ARM_THM_MOVW_BREL_NC `]() ARM\_THM\_MOVW\_BREL\_NC = 402653271 ##### [` ARM_THM_MOVW_PREL_NC `]() ARM\_THM\_MOVW\_PREL\_NC = 402653233 ##### [` ARM_THM_PC12 `]() ARM\_THM\_PC12 = 402653238 ##### [` ARM_THM_PC8 `]() ARM\_THM\_PC8 = 402653195 ##### [` ARM_THM_RPC22 `]() ARM\_THM\_RPC22 = 402653435 ##### [` ARM_THM_SWI8 `]() ARM\_THM\_SWI8 = 402653198 ##### [` ARM_THM_TLS_CALL `]() ARM\_THM\_TLS\_CALL = 402653277 ##### [` ARM_THM_TLS_DESCSEQ16 `]() ARM\_THM\_TLS\_DESCSEQ16 = 402653313 ##### [` ARM_THM_TLS_DESCSEQ32 `]() ARM\_THM\_TLS\_DESCSEQ32 = 402653314 ##### [` ARM_THM_XPC22 `]() ARM\_THM\_XPC22 = 402653200 ##### [` ARM_TLS_CALL `]() ARM\_TLS\_CALL = 402653275 ##### [` ARM_TLS_DESC `]() ARM\_TLS\_DESC = 402653197 ##### [` ARM_TLS_DESCSEQ `]() ARM\_TLS\_DESCSEQ = 402653276 ##### [` ARM_TLS_DTPMOD32 `]() ARM\_TLS\_DTPMOD32 = 402653201 ##### [` ARM_TLS_DTPOFF32 `]() ARM\_TLS\_DTPOFF32 = 402653202 ##### [` ARM_TLS_GD32 `]() ARM\_TLS\_GD32 = 402653288 ##### [` ARM_TLS_GOTDESC `]() ARM\_TLS\_GOTDESC = 402653274 ##### [` ARM_TLS_IE12GP `]() ARM\_TLS\_IE12GP = 402653295 ##### [` ARM_TLS_IE32 `]() ARM\_TLS\_IE32 = 402653291 ##### [` ARM_TLS_LDM32 `]() ARM\_TLS\_LDM32 = 402653289 ##### [` ARM_TLS_LDO12 `]() ARM\_TLS\_LDO12 = 402653293 ##### [` ARM_TLS_LDO32 `]() ARM\_TLS\_LDO32 = 402653290 ##### [` ARM_TLS_LE12 `]() ARM\_TLS\_LE12 = 402653294 ##### [` ARM_TLS_LE32 `]() ARM\_TLS\_LE32 = 402653292 ##### [` ARM_TLS_TPOFF32 `]() ARM\_TLS\_TPOFF32 = 402653203 ##### [` ARM_V4BX `]() ARM\_V4BX = 402653224 ##### [` ARM_XPC25 `]() ARM\_XPC25 = 402653199 ##### [` BPF_64_32 `]() BPF\_64\_32 = 1744830474 ##### [` BPF_64_64 `]() BPF\_64\_64 = 1744830465 ##### [` BPF_64_ABS32 `]() BPF\_64\_ABS32 = 1744830467 ##### [` BPF_64_ABS64 `]() BPF\_64\_ABS64 = 1744830466 ##### [` BPF_64_NODYLD32 `]() BPF\_64\_NODYLD32 = 1744830468 ##### [` BPF_NONE `]() BPF\_NONE = 1744830464 ##### [` HEX_10_X `]() HEX\_10\_X = 536870938 ##### [` HEX_11_X `]() HEX\_11\_X = 536870937 ##### [` HEX_12_X `]() HEX\_12\_X = 536870936 ##### [` HEX_16 `]() HEX\_16 = 536870919 ##### [` HEX_16_X `]() HEX\_16\_X = 536870935 ##### [` HEX_32 `]() HEX\_32 = 536870918 ##### [` HEX_32_6_X `]() HEX\_32\_6\_X = 536870929 ##### [` HEX_32_PCREL `]() HEX\_32\_PCREL = 536870943 ##### [` HEX_6_PCREL_X `]() HEX\_6\_PCREL\_X = 536870977 ##### [` HEX_6_X `]() HEX\_6\_X = 536870942 ##### [` HEX_7_X `]() HEX\_7\_X = 536870941 ##### [` HEX_8 `]() HEX\_8 = 536870920 ##### [` HEX_8_X `]() HEX\_8\_X = 536870940 ##### [` HEX_9_X `]() HEX\_9\_X = 536870939 ##### [` HEX_B13_PCREL `]() HEX\_B13\_PCREL = 536870926 ##### [` HEX_B13_PCREL_X `]() HEX\_B13\_PCREL\_X = 536870932 ##### [` HEX_B15_PCREL `]() HEX\_B15\_PCREL = 536870914 ##### [` HEX_B15_PCREL_X `]() HEX\_B15\_PCREL\_X = 536870931 ##### [` HEX_B22_PCREL `]() HEX\_B22\_PCREL = 536870913 ##### [` HEX_B22_PCREL_X `]() HEX\_B22\_PCREL\_X = 536870930 ##### [` HEX_B32_PCREL_X `]() HEX\_B32\_PCREL\_X = 536870928 ##### [` HEX_B7_PCREL `]() HEX\_B7\_PCREL = 536870915 ##### [` HEX_B7_PCREL_X `]() HEX\_B7\_PCREL\_X = 536870934 ##### [` HEX_B9_PCREL `]() HEX\_B9\_PCREL = 536870927 ##### [` HEX_B9_PCREL_X `]() HEX\_B9\_PCREL\_X = 536870933 ##### [` HEX_COPY `]() HEX\_COPY = 536870944 ##### [` HEX_DTPMOD_32 `]() HEX\_DTPMOD\_32 = 536870956 ##### [` HEX_DTPREL_11_X `]() HEX\_DTPREL\_11\_X = 536870986 ##### [` HEX_DTPREL_16 `]() HEX\_DTPREL\_16 = 536870960 ##### [` HEX_DTPREL_16_X `]() HEX\_DTPREL\_16\_X = 536870985 ##### [` HEX_DTPREL_32 `]() HEX\_DTPREL\_32 = 536870959 ##### [` HEX_DTPREL_32_6_X `]() HEX\_DTPREL\_32\_6\_X = 536870984 ##### [` HEX_DTPREL_HI16 `]() HEX\_DTPREL\_HI16 = 536870958 ##### [` HEX_DTPREL_LO16 `]() HEX\_DTPREL\_LO16 = 536870957 ##### [` HEX_GD_GOT_11_X `]() HEX\_GD\_GOT\_11\_X = 536870989 ##### [` HEX_GD_GOT_16 `]() HEX\_GD\_GOT\_16 = 536870965 ##### [` HEX_GD_GOT_16_X `]() HEX\_GD\_GOT\_16\_X = 536870988 ##### [` HEX_GD_GOT_32 `]() HEX\_GD\_GOT\_32 = 536870964 ##### [` HEX_GD_GOT_32_6_X `]() HEX\_GD\_GOT\_32\_6\_X = 536870987 ##### [` HEX_GD_GOT_HI16 `]() HEX\_GD\_GOT\_HI16 = 536870963 ##### [` HEX_GD_GOT_LO16 `]() HEX\_GD\_GOT\_LO16 = 536870962 ##### [` HEX_GD_PLT_B22_PCREL `]() HEX\_GD\_PLT\_B22\_PCREL = 536870961 ##### [` HEX_GLOB_DAT `]() HEX\_GLOB\_DAT = 536870945 ##### [` HEX_GOTREL_11_X `]() HEX\_GOTREL\_11\_X = 536870980 ##### [` HEX_GOTREL_16_X `]() HEX\_GOTREL\_16\_X = 536870979 ##### [` HEX_GOTREL_32 `]() HEX\_GOTREL\_32 = 536870951 ##### [` HEX_GOTREL_32_6_X `]() HEX\_GOTREL\_32\_6\_X = 536870978 ##### [` HEX_GOTREL_HI16 `]() HEX\_GOTREL\_HI16 = 536870950 ##### [` HEX_GOTREL_LO16 `]() HEX\_GOTREL\_LO16 = 536870949 ##### [` HEX_GOT_11_X `]() HEX\_GOT\_11\_X = 536870983 ##### [` HEX_GOT_16 `]() HEX\_GOT\_16 = 536870955 ##### [` HEX_GOT_16_X `]() HEX\_GOT\_16\_X = 536870982 ##### [` HEX_GOT_32 `]() HEX\_GOT\_32 = 536870954 ##### [` HEX_GOT_32_6_X `]() HEX\_GOT\_32\_6\_X = 536870981 ##### [` HEX_GOT_HI16 `]() HEX\_GOT\_HI16 = 536870953 ##### [` HEX_GOT_LO16 `]() HEX\_GOT\_LO16 = 536870952 ##### [` HEX_GPREL16_0 `]() HEX\_GPREL16\_0 = 536870921 ##### [` HEX_GPREL16_1 `]() HEX\_GPREL16\_1 = 536870922 ##### [` HEX_GPREL16_2 `]() HEX\_GPREL16\_2 = 536870923 ##### [` HEX_GPREL16_3 `]() HEX\_GPREL16\_3 = 536870924 ##### [` HEX_HI16 `]() HEX\_HI16 = 536870917 ##### [` HEX_HL16 `]() HEX\_HL16 = 536870925 ##### [` HEX_IE_16_X `]() HEX\_IE\_16\_X = 536870991 ##### [` HEX_IE_32 `]() HEX\_IE\_32 = 536870968 ##### [` HEX_IE_32_6_X `]() HEX\_IE\_32\_6\_X = 536870990 ##### [` HEX_IE_GOT_11_X `]() HEX\_IE\_GOT\_11\_X = 536870994 ##### [` HEX_IE_GOT_16 `]() HEX\_IE\_GOT\_16 = 536870972 ##### [` HEX_IE_GOT_16_X `]() HEX\_IE\_GOT\_16\_X = 536870993 ##### [` HEX_IE_GOT_32 `]() HEX\_IE\_GOT\_32 = 536870971 ##### [` HEX_IE_GOT_32_6_X `]() HEX\_IE\_GOT\_32\_6\_X = 536870992 ##### [` HEX_IE_GOT_HI16 `]() HEX\_IE\_GOT\_HI16 = 536870970 ##### [` HEX_IE_GOT_LO16 `]() HEX\_IE\_GOT\_LO16 = 536870969 ##### [` HEX_IE_HI16 `]() HEX\_IE\_HI16 = 536870967 ##### [` HEX_IE_LO16 `]() HEX\_IE\_LO16 = 536870966 ##### [` HEX_JMP_SLOT `]() HEX\_JMP\_SLOT = 536870946 ##### [` HEX_LD_GOT_11_X `]() HEX\_LD\_GOT\_11\_X = 536871005 ##### [` HEX_LD_GOT_16 `]() HEX\_LD\_GOT\_16 = 536871002 ##### [` HEX_LD_GOT_16_X `]() HEX\_LD\_GOT\_16\_X = 536871004 ##### [` HEX_LD_GOT_32 `]() HEX\_LD\_GOT\_32 = 536871001 ##### [` HEX_LD_GOT_32_6_X `]() HEX\_LD\_GOT\_32\_6\_X = 536871003 ##### [` HEX_LD_GOT_HI16 `]() HEX\_LD\_GOT\_HI16 = 536871000 ##### [` HEX_LD_GOT_LO16 `]() HEX\_LD\_GOT\_LO16 = 536870999 ##### [` HEX_LD_PLT_B22_PCREL `]() HEX\_LD\_PLT\_B22\_PCREL = 536870998 ##### [` HEX_LO16 `]() HEX\_LO16 = 536870916 ##### [` HEX_NONE `]() HEX\_NONE = 536870912 ##### [` HEX_PLT_B22_PCREL `]() HEX\_PLT\_B22\_PCREL = 536870948 ##### [` HEX_RELATIVE `]() HEX\_RELATIVE = 536870947 ##### [` HEX_TPREL_11_X `]() HEX\_TPREL\_11\_X = 536870997 ##### [` HEX_TPREL_16 `]() HEX\_TPREL\_16 = 536870976 ##### [` HEX_TPREL_16_X `]() HEX\_TPREL\_16\_X = 536870996 ##### [` HEX_TPREL_32 `]() HEX\_TPREL\_32 = 536870975 ##### [` HEX_TPREL_32_6_X `]() HEX\_TPREL\_32\_6\_X = 536870995 ##### [` HEX_TPREL_HI16 `]() HEX\_TPREL\_HI16 = 536870974 ##### [` HEX_TPREL_LO16 `]() HEX\_TPREL\_LO16 = 536870973 ##### [` LARCH_32 `]() LARCH\_32 = 805306369 ##### [` LARCH_32_PCREL `]() LARCH\_32\_PCREL = 805306467 ##### [` LARCH_64 `]() LARCH\_64 = 805306370 ##### [` LARCH_64_PCREL `]() LARCH\_64\_PCREL = 805306477 ##### [` LARCH_ABS64_HI12 `]() LARCH\_ABS64\_HI12 = 805306438 ##### [` LARCH_ABS64_LO20 `]() LARCH\_ABS64\_LO20 = 805306437 ##### [` LARCH_ABS_HI20 `]() LARCH\_ABS\_HI20 = 805306435 ##### [` LARCH_ABS_LO12 `]() LARCH\_ABS\_LO12 = 805306436 ##### [` LARCH_ADD16 `]() LARCH\_ADD16 = 805306416 ##### [` LARCH_ADD24 `]() LARCH\_ADD24 = 805306417 ##### [` LARCH_ADD32 `]() LARCH\_ADD32 = 805306418 ##### [` LARCH_ADD6 `]() LARCH\_ADD6 = 805306473 ##### [` LARCH_ADD64 `]() LARCH\_ADD64 = 805306419 ##### [` LARCH_ADD8 `]() LARCH\_ADD8 = 805306415 ##### [` LARCH_ADD_ULEB128 `]() LARCH\_ADD\_ULEB128 = 805306475 ##### [` LARCH_ALIGN `]() LARCH\_ALIGN = 805306470 ##### [` LARCH_B16 `]() LARCH\_B16 = 805306432 ##### [` LARCH_B21 `]() LARCH\_B21 = 805306433 ##### [` LARCH_B26 `]() LARCH\_B26 = 805306434 ##### [` LARCH_CALL36 `]() LARCH\_CALL36 = 805306478 ##### [` LARCH_COPY `]() LARCH\_COPY = 805306372 ##### [` LARCH_GNU_VTENTRY `]() LARCH\_GNU\_VTENTRY = 805306426 ##### [` LARCH_GNU_VTINHERIT `]() LARCH\_GNU\_VTINHERIT = 805306425 ##### [` LARCH_GOT64_HI12 `]() LARCH\_GOT64\_HI12 = 805306450 ##### [` LARCH_GOT64_LO20 `]() LARCH\_GOT64\_LO20 = 805306449 ##### [` LARCH_GOT64_PC_HI12 `]() LARCH\_GOT64\_PC\_HI12 = 805306446 ##### [` LARCH_GOT64_PC_LO20 `]() LARCH\_GOT64\_PC\_LO20 = 805306445 ##### [` LARCH_GOT_HI20 `]() LARCH\_GOT\_HI20 = 805306447 ##### [` LARCH_GOT_LO12 `]() LARCH\_GOT\_LO12 = 805306448 ##### [` LARCH_GOT_PC_HI20 `]() LARCH\_GOT\_PC\_HI20 = 805306443 ##### [` LARCH_GOT_PC_LO12 `]() LARCH\_GOT\_PC\_LO12 = 805306444 ##### [` LARCH_IRELATIVE `]() LARCH\_IRELATIVE = 805306380 ##### [` LARCH_JUMP_SLOT `]() LARCH\_JUMP\_SLOT = 805306373 ##### [` LARCH_MARK_LA `]() LARCH\_MARK\_LA = 805306388 ##### [` LARCH_MARK_PCREL `]() LARCH\_MARK\_PCREL = 805306389 ##### [` LARCH_NONE `]() LARCH\_NONE = 805306368 ##### [` LARCH_PCALA64_HI12 `]() LARCH\_PCALA64\_HI12 = 805306442 ##### [` LARCH_PCALA64_LO20 `]() LARCH\_PCALA64\_LO20 = 805306441 ##### [` LARCH_PCALA_HI20 `]() LARCH\_PCALA\_HI20 = 805306439 ##### [` LARCH_PCALA_LO12 `]() LARCH\_PCALA\_LO12 = 805306440 ##### [` LARCH_PCREL20_S2 `]() LARCH\_PCREL20\_S2 = 805306471 ##### [` LARCH_RELATIVE `]() LARCH\_RELATIVE = 805306371 ##### [` LARCH_RELAX `]() LARCH\_RELAX = 805306468 ##### [` LARCH_SOP_ADD `]() LARCH\_SOP\_ADD = 805306403 ##### [` LARCH_SOP_AND `]() LARCH\_SOP\_AND = 805306404 ##### [` LARCH_SOP_ASSERT `]() LARCH\_SOP\_ASSERT = 805306398 ##### [` LARCH_SOP_IF_ELSE `]() LARCH\_SOP\_IF\_ELSE = 805306405 ##### [` LARCH_SOP_NOT `]() LARCH\_SOP\_NOT = 805306399 ##### [` LARCH_SOP_POP_32_S_0_10_10_16_S2 `]() LARCH\_SOP\_POP\_32\_S\_0\_10\_10\_16\_S2 = 805306413 ##### [` LARCH_SOP_POP_32_S_0_5_10_16_S2 `]() LARCH\_SOP\_POP\_32\_S\_0\_5\_10\_16\_S2 = 805306412 ##### [` LARCH_SOP_POP_32_S_10_12 `]() LARCH\_SOP\_POP\_32\_S\_10\_12 = 805306408 ##### [` LARCH_SOP_POP_32_S_10_16 `]() LARCH\_SOP\_POP\_32\_S\_10\_16 = 805306409 ##### [` LARCH_SOP_POP_32_S_10_16_S2 `]() LARCH\_SOP\_POP\_32\_S\_10\_16\_S2 = 805306410 ##### [` LARCH_SOP_POP_32_S_10_5 `]() LARCH\_SOP\_POP\_32\_S\_10\_5 = 805306406 ##### [` LARCH_SOP_POP_32_S_5_20 `]() LARCH\_SOP\_POP\_32\_S\_5\_20 = 805306411 ##### [` LARCH_SOP_POP_32_U `]() LARCH\_SOP\_POP\_32\_U = 805306414 ##### [` LARCH_SOP_POP_32_U_10_12 `]() LARCH\_SOP\_POP\_32\_U\_10\_12 = 805306407 ##### [` LARCH_SOP_PUSH_ABSOLUTE `]() LARCH\_SOP\_PUSH\_ABSOLUTE = 805306391 ##### [` LARCH_SOP_PUSH_DUP `]() LARCH\_SOP\_PUSH\_DUP = 805306392 ##### [` LARCH_SOP_PUSH_GPREL `]() LARCH\_SOP\_PUSH\_GPREL = 805306393 ##### [` LARCH_SOP_PUSH_PCREL `]() LARCH\_SOP\_PUSH\_PCREL = 805306390 ##### [` LARCH_SOP_PUSH_PLT_PCREL `]() LARCH\_SOP\_PUSH\_PLT\_PCREL = 805306397 ##### [` LARCH_SOP_PUSH_TLS_GD `]() LARCH\_SOP\_PUSH\_TLS\_GD = 805306396 ##### [` LARCH_SOP_PUSH_TLS_GOT `]() LARCH\_SOP\_PUSH\_TLS\_GOT = 805306395 ##### [` LARCH_SOP_PUSH_TLS_TPREL `]() LARCH\_SOP\_PUSH\_TLS\_TPREL = 805306394 ##### [` LARCH_SOP_SL `]() LARCH\_SOP\_SL = 805306401 ##### [` LARCH_SOP_SR `]() LARCH\_SOP\_SR = 805306402 ##### [` LARCH_SOP_SUB `]() LARCH\_SOP\_SUB = 805306400 ##### [` LARCH_SUB16 `]() LARCH\_SUB16 = 805306421 ##### [` LARCH_SUB24 `]() LARCH\_SUB24 = 805306422 ##### [` LARCH_SUB32 `]() LARCH\_SUB32 = 805306423 ##### [` LARCH_SUB6 `]() LARCH\_SUB6 = 805306474 ##### [` LARCH_SUB64 `]() LARCH\_SUB64 = 805306424 ##### [` LARCH_SUB8 `]() LARCH\_SUB8 = 805306420 ##### [` LARCH_SUB_ULEB128 `]() LARCH\_SUB\_ULEB128 = 805306476 ##### [` LARCH_TLS_DESC32 `]() LARCH\_TLS\_DESC32 = 805306381 ##### [` LARCH_TLS_DESC64 `]() LARCH\_TLS\_DESC64 = 805306382 ##### [` LARCH_TLS_DESC64_HI12 `]() LARCH\_TLS\_DESC64\_HI12 = 805306486 ##### [` LARCH_TLS_DESC64_LO20 `]() LARCH\_TLS\_DESC64\_LO20 = 805306485 ##### [` LARCH_TLS_DESC64_PC_HI12 `]() LARCH\_TLS\_DESC64\_PC\_HI12 = 805306482 ##### [` LARCH_TLS_DESC64_PC_LO20 `]() LARCH\_TLS\_DESC64\_PC\_LO20 = 805306481 ##### [` LARCH_TLS_DESC_CALL `]() LARCH\_TLS\_DESC\_CALL = 805306488 ##### [` LARCH_TLS_DESC_HI20 `]() LARCH\_TLS\_DESC\_HI20 = 805306483 ##### [` LARCH_TLS_DESC_LD `]() LARCH\_TLS\_DESC\_LD = 805306487 ##### [` LARCH_TLS_DESC_LO12 `]() LARCH\_TLS\_DESC\_LO12 = 805306484 ##### [` LARCH_TLS_DESC_PCREL20_S2 `]() LARCH\_TLS\_DESC\_PCREL20\_S2 = 805306494 ##### [` LARCH_TLS_DESC_PC_HI20 `]() LARCH\_TLS\_DESC\_PC\_HI20 = 805306479 ##### [` LARCH_TLS_DESC_PC_LO12 `]() LARCH\_TLS\_DESC\_PC\_LO12 = 805306480 ##### [` LARCH_TLS_DTPMOD32 `]() LARCH\_TLS\_DTPMOD32 = 805306374 ##### [` LARCH_TLS_DTPMOD64 `]() LARCH\_TLS\_DTPMOD64 = 805306375 ##### [` LARCH_TLS_DTPREL32 `]() LARCH\_TLS\_DTPREL32 = 805306376 ##### [` LARCH_TLS_DTPREL64 `]() LARCH\_TLS\_DTPREL64 = 805306377 ##### [` LARCH_TLS_GD_HI20 `]() LARCH\_TLS\_GD\_HI20 = 805306466 ##### [` LARCH_TLS_GD_PCREL20_S2 `]() LARCH\_TLS\_GD\_PCREL20\_S2 = 805306493 ##### [` LARCH_TLS_GD_PC_HI20 `]() LARCH\_TLS\_GD\_PC\_HI20 = 805306465 ##### [` LARCH_TLS_IE64_HI12 `]() LARCH\_TLS\_IE64\_HI12 = 805306462 ##### [` LARCH_TLS_IE64_LO20 `]() LARCH\_TLS\_IE64\_LO20 = 805306461 ##### [` LARCH_TLS_IE64_PC_HI12 `]() LARCH\_TLS\_IE64\_PC\_HI12 = 805306458 ##### [` LARCH_TLS_IE64_PC_LO20 `]() LARCH\_TLS\_IE64\_PC\_LO20 = 805306457 ##### [` LARCH_TLS_IE_HI20 `]() LARCH\_TLS\_IE\_HI20 = 805306459 ##### [` LARCH_TLS_IE_LO12 `]() LARCH\_TLS\_IE\_LO12 = 805306460 ##### [` LARCH_TLS_IE_PC_HI20 `]() LARCH\_TLS\_IE\_PC\_HI20 = 805306455 ##### [` LARCH_TLS_IE_PC_LO12 `]() LARCH\_TLS\_IE\_PC\_LO12 = 805306456 ##### [` LARCH_TLS_LD_HI20 `]() LARCH\_TLS\_LD\_HI20 = 805306464 ##### [` LARCH_TLS_LD_PCREL20_S2 `]() LARCH\_TLS\_LD\_PCREL20\_S2 = 805306492 ##### [` LARCH_TLS_LD_PC_HI20 `]() LARCH\_TLS\_LD\_PC\_HI20 = 805306463 ##### [` LARCH_TLS_LE64_HI12 `]() LARCH\_TLS\_LE64\_HI12 = 805306454 ##### [` LARCH_TLS_LE64_LO20 `]() LARCH\_TLS\_LE64\_LO20 = 805306453 ##### [` LARCH_TLS_LE_ADD_R `]() LARCH\_TLS\_LE\_ADD\_R = 805306490 ##### [` LARCH_TLS_LE_HI20 `]() LARCH\_TLS\_LE\_HI20 = 805306451 ##### [` LARCH_TLS_LE_HI20_R `]() LARCH\_TLS\_LE\_HI20\_R = 805306489 ##### [` LARCH_TLS_LE_LO12 `]() LARCH\_TLS\_LE\_LO12 = 805306452 ##### [` LARCH_TLS_LE_LO12_R `]() LARCH\_TLS\_LE\_LO12\_R = 805306491 ##### [` LARCH_TLS_TPREL32 `]() LARCH\_TLS\_TPREL32 = 805306378 ##### [` LARCH_TLS_TPREL64 `]() LARCH\_TLS\_TPREL64 = 805306379 ##### [` MICROMIPS_26_S1 `]() MICROMIPS\_26\_S1 = 939524229 ##### [` MICROMIPS_CALL16 `]() MICROMIPS\_CALL16 = 939524238 ##### [` MICROMIPS_CALL_HI16 `]() MICROMIPS\_CALL\_HI16 = 939524249 ##### [` MICROMIPS_CALL_LO16 `]() MICROMIPS\_CALL\_LO16 = 939524250 ##### [` MICROMIPS_GOT16 `]() MICROMIPS\_GOT16 = 939524234 ##### [` MICROMIPS_GOT_DISP `]() MICROMIPS\_GOT\_DISP = 939524241 ##### [` MICROMIPS_GOT_HI16 `]() MICROMIPS\_GOT\_HI16 = 939524244 ##### [` MICROMIPS_GOT_LO16 `]() MICROMIPS\_GOT\_LO16 = 939524245 ##### [` MICROMIPS_GOT_OFST `]() MICROMIPS\_GOT\_OFST = 939524243 ##### [` MICROMIPS_GOT_PAGE `]() MICROMIPS\_GOT\_PAGE = 939524242 ##### [` MICROMIPS_GPREL16 `]() MICROMIPS\_GPREL16 = 939524232 ##### [` MICROMIPS_GPREL7_S2 `]() MICROMIPS\_GPREL7\_S2 = 939524268 ##### [` MICROMIPS_HI0_LO16 `]() MICROMIPS\_HI0\_LO16 = 939524253 ##### [` MICROMIPS_HI16 `]() MICROMIPS\_HI16 = 939524230 ##### [` MICROMIPS_HIGHER `]() MICROMIPS\_HIGHER = 939524247 ##### [` MICROMIPS_HIGHEST `]() MICROMIPS\_HIGHEST = 939524248 ##### [` MICROMIPS_JALR `]() MICROMIPS\_JALR = 939524252 ##### [` MICROMIPS_LITERAL `]() MICROMIPS\_LITERAL = 939524233 ##### [` MICROMIPS_LO16 `]() MICROMIPS\_LO16 = 939524231 ##### [` MICROMIPS_PC10_S1 `]() MICROMIPS\_PC10\_S1 = 939524236 ##### [` MICROMIPS_PC16_S1 `]() MICROMIPS\_PC16\_S1 = 939524237 ##### [` MICROMIPS_PC18_S3 `]() MICROMIPS\_PC18\_S3 = 939524272 ##### [` MICROMIPS_PC19_S2 `]() MICROMIPS\_PC19\_S2 = 939524273 ##### [` MICROMIPS_PC21_S2 `]() MICROMIPS\_PC21\_S2 = 939524270 ##### [` MICROMIPS_PC23_S2 `]() MICROMIPS\_PC23\_S2 = 939524269 ##### [` MICROMIPS_PC26_S2 `]() MICROMIPS\_PC26\_S2 = 939524271 ##### [` MICROMIPS_PC7_S1 `]() MICROMIPS\_PC7\_S1 = 939524235 ##### [` MICROMIPS_SCN_DISP `]() MICROMIPS\_SCN\_DISP = 939524251 ##### [` MICROMIPS_SUB `]() MICROMIPS\_SUB = 939524246 ##### [` MICROMIPS_TLS_DTPREL_HI16 `]() MICROMIPS\_TLS\_DTPREL\_HI16 = 939524260 ##### [` MICROMIPS_TLS_DTPREL_LO16 `]() MICROMIPS\_TLS\_DTPREL\_LO16 = 939524261 ##### [` MICROMIPS_TLS_GD `]() MICROMIPS\_TLS\_GD = 939524258 ##### [` MICROMIPS_TLS_GOTTPREL `]() MICROMIPS\_TLS\_GOTTPREL = 939524262 ##### [` MICROMIPS_TLS_LDM `]() MICROMIPS\_TLS\_LDM = 939524259 ##### [` MICROMIPS_TLS_TPREL_HI16 `]() MICROMIPS\_TLS\_TPREL\_HI16 = 939524265 ##### [` MICROMIPS_TLS_TPREL_LO16 `]() MICROMIPS\_TLS\_TPREL\_LO16 = 939524266 ##### [` MIPS16_26 `]() MIPS16\_26 = 939524196 ##### [` MIPS16_CALL16 `]() MIPS16\_CALL16 = 939524199 ##### [` MIPS16_GOT16 `]() MIPS16\_GOT16 = 939524198 ##### [` MIPS16_GPREL `]() MIPS16\_GPREL = 939524197 ##### [` MIPS16_HI16 `]() MIPS16\_HI16 = 939524200 ##### [` MIPS16_LO16 `]() MIPS16\_LO16 = 939524201 ##### [` MIPS16_TLS_DTPREL_HI16 `]() MIPS16\_TLS\_DTPREL\_HI16 = 939524204 ##### [` MIPS16_TLS_DTPREL_LO16 `]() MIPS16\_TLS\_DTPREL\_LO16 = 939524205 ##### [` MIPS16_TLS_GD `]() MIPS16\_TLS\_GD = 939524202 ##### [` MIPS16_TLS_GOTTPREL `]() MIPS16\_TLS\_GOTTPREL = 939524206 ##### [` MIPS16_TLS_LDM `]() MIPS16\_TLS\_LDM = 939524203 ##### [` MIPS16_TLS_TPREL_HI16 `]() MIPS16\_TLS\_TPREL\_HI16 = 939524207 ##### [` MIPS16_TLS_TPREL_LO16 `]() MIPS16\_TLS\_TPREL\_LO16 = 939524208 ##### [` MIPS_16 `]() MIPS\_16 = 939524097 ##### [` MIPS_26 `]() MIPS\_26 = 939524100 ##### [` MIPS_32 `]() MIPS\_32 = 939524098 ##### [` MIPS_64 `]() MIPS\_64 = 939524114 ##### [` MIPS_ADD_IMMEDIATE `]() MIPS\_ADD\_IMMEDIATE = 939524130 ##### [` MIPS_CALL16 `]() MIPS\_CALL16 = 939524107 ##### [` MIPS_CALL_HI16 `]() MIPS\_CALL\_HI16 = 939524126 ##### [` MIPS_CALL_LO16 `]() MIPS\_CALL\_LO16 = 939524127 ##### [` MIPS_COPY `]() MIPS\_COPY = 939524222 ##### [` MIPS_DELETE `]() MIPS\_DELETE = 939524123 ##### [` MIPS_EH `]() MIPS\_EH = 939524345 ##### [` MIPS_GLOB_DAT `]() MIPS\_GLOB\_DAT = 939524147 ##### [` MIPS_GOT16 `]() MIPS\_GOT16 = 939524105 ##### [` MIPS_GOT_DISP `]() MIPS\_GOT\_DISP = 939524115 ##### [` MIPS_GOT_HI16 `]() MIPS\_GOT\_HI16 = 939524118 ##### [` MIPS_GOT_LO16 `]() MIPS\_GOT\_LO16 = 939524119 ##### [` MIPS_GOT_OFST `]() MIPS\_GOT\_OFST = 939524117 ##### [` MIPS_GOT_PAGE `]() MIPS\_GOT\_PAGE = 939524116 ##### [` MIPS_GPREL16 `]() MIPS\_GPREL16 = 939524103 ##### [` MIPS_GPREL32 `]() MIPS\_GPREL32 = 939524108 ##### [` MIPS_HI16 `]() MIPS\_HI16 = 939524101 ##### [` MIPS_HIGHER `]() MIPS\_HIGHER = 939524124 ##### [` MIPS_HIGHEST `]() MIPS\_HIGHEST = 939524125 ##### [` MIPS_INSERT_A `]() MIPS\_INSERT\_A = 939524121 ##### [` MIPS_INSERT_B `]() MIPS\_INSERT\_B = 939524122 ##### [` MIPS_JALR `]() MIPS\_JALR = 939524133 ##### [` MIPS_JUMP_SLOT `]() MIPS\_JUMP\_SLOT = 939524223 ##### [` MIPS_LITERAL `]() MIPS\_LITERAL = 939524104 ##### [` MIPS_LO16 `]() MIPS\_LO16 = 939524102 ##### [` MIPS_NONE `]() MIPS\_NONE = 939524096 ##### [` MIPS_NUM `]() MIPS\_NUM = 939524314 ##### [` MIPS_PC16 `]() MIPS\_PC16 = 939524106 ##### [` MIPS_PC18_S3 `]() MIPS\_PC18\_S3 = 939524158 ##### [` MIPS_PC19_S2 `]() MIPS\_PC19\_S2 = 939524159 ##### [` MIPS_PC21_S2 `]() MIPS\_PC21\_S2 = 939524156 ##### [` MIPS_PC26_S2 `]() MIPS\_PC26\_S2 = 939524157 ##### [` MIPS_PC32 `]() MIPS\_PC32 = 939524344 ##### [` MIPS_PCHI16 `]() MIPS\_PCHI16 = 939524160 ##### [` MIPS_PCLO16 `]() MIPS\_PCLO16 = 939524161 ##### [` MIPS_PJUMP `]() MIPS\_PJUMP = 939524131 ##### [` MIPS_REL16 `]() MIPS\_REL16 = 939524129 ##### [` MIPS_REL32 `]() MIPS\_REL32 = 939524099 ##### [` MIPS_RELGOT `]() MIPS\_RELGOT = 939524132 ##### [` MIPS_SCN_DISP `]() MIPS\_SCN\_DISP = 939524128 ##### [` MIPS_SHIFT5 `]() MIPS\_SHIFT5 = 939524112 ##### [` MIPS_SHIFT6 `]() MIPS\_SHIFT6 = 939524113 ##### [` MIPS_SUB `]() MIPS\_SUB = 939524120 ##### [` MIPS_TLS_DTPMOD32 `]() MIPS\_TLS\_DTPMOD32 = 939524134 ##### [` MIPS_TLS_DTPMOD64 `]() MIPS\_TLS\_DTPMOD64 = 939524136 ##### [` MIPS_TLS_DTPREL32 `]() MIPS\_TLS\_DTPREL32 = 939524135 ##### [` MIPS_TLS_DTPREL64 `]() MIPS\_TLS\_DTPREL64 = 939524137 ##### [` MIPS_TLS_DTPREL_HI16 `]() MIPS\_TLS\_DTPREL\_HI16 = 939524140 ##### [` MIPS_TLS_DTPREL_LO16 `]() MIPS\_TLS\_DTPREL\_LO16 = 939524141 ##### [` MIPS_TLS_GD `]() MIPS\_TLS\_GD = 939524138 ##### [` MIPS_TLS_GOTTPREL `]() MIPS\_TLS\_GOTTPREL = 939524142 ##### [` MIPS_TLS_LDM `]() MIPS\_TLS\_LDM = 939524139 ##### [` MIPS_TLS_TPREL32 `]() MIPS\_TLS\_TPREL32 = 939524143 ##### [` MIPS_TLS_TPREL64 `]() MIPS\_TLS\_TPREL64 = 939524144 ##### [` MIPS_TLS_TPREL_HI16 `]() MIPS\_TLS\_TPREL\_HI16 = 939524145 ##### [` MIPS_TLS_TPREL_LO16 `]() MIPS\_TLS\_TPREL\_LO16 = 939524146 ##### [` MIPS_UNUSED1 `]() MIPS\_UNUSED1 = 939524109 ##### [` MIPS_UNUSED2 `]() MIPS\_UNUSED2 = 939524110 ##### [` MIPS_UNUSED3 `]() MIPS\_UNUSED3 = 939524111 ##### [` PPC64_ADDR14 `]() PPC64\_ADDR14 = 1207959559 ##### [` PPC64_ADDR14_BRNTAKEN `]() PPC64\_ADDR14\_BRNTAKEN = 1207959561 ##### [` PPC64_ADDR14_BRTAKEN `]() PPC64\_ADDR14\_BRTAKEN = 1207959560 ##### [` PPC64_ADDR16 `]() PPC64\_ADDR16 = 1207959555 ##### [` PPC64_ADDR16_DS `]() PPC64\_ADDR16\_DS = 1207959608 ##### [` PPC64_ADDR16_HA `]() PPC64\_ADDR16\_HA = 1207959558 ##### [` PPC64_ADDR16_HI `]() PPC64\_ADDR16\_HI = 1207959557 ##### [` PPC64_ADDR16_HIGHER `]() PPC64\_ADDR16\_HIGHER = 1207959591 ##### [` PPC64_ADDR16_HIGHERA `]() PPC64\_ADDR16\_HIGHERA = 1207959592 ##### [` PPC64_ADDR16_HIGHEST `]() PPC64\_ADDR16\_HIGHEST = 1207959593 ##### [` PPC64_ADDR16_HIGHESTA `]() PPC64\_ADDR16\_HIGHESTA = 1207959594 ##### [` PPC64_ADDR16_LO `]() PPC64\_ADDR16\_LO = 1207959556 ##### [` PPC64_ADDR16_LO_DS `]() PPC64\_ADDR16\_LO\_DS = 1207959609 ##### [` PPC64_ADDR24 `]() PPC64\_ADDR24 = 1207959554 ##### [` PPC64_ADDR32 `]() PPC64\_ADDR32 = 1207959553 ##### [` PPC64_ADDR64 `]() PPC64\_ADDR64 = 1207959590 ##### [` PPC64_DTPMOD64 `]() PPC64\_DTPMOD64 = 1207959620 ##### [` PPC64_DTPREL16 `]() PPC64\_DTPREL16 = 1207959626 ##### [` PPC64_DTPREL16_DS `]() PPC64\_DTPREL16\_DS = 1207959653 ##### [` PPC64_DTPREL16_HA `]() PPC64\_DTPREL16\_HA = 1207959629 ##### [` PPC64_DTPREL16_HI `]() PPC64\_DTPREL16\_HI = 1207959628 ##### [` PPC64_DTPREL16_HIGHER `]() PPC64\_DTPREL16\_HIGHER = 1207959655 ##### [` PPC64_DTPREL16_HIGHERA `]() PPC64\_DTPREL16\_HIGHERA = 1207959656 ##### [` PPC64_DTPREL16_HIGHEST `]() PPC64\_DTPREL16\_HIGHEST = 1207959657 ##### [` PPC64_DTPREL16_HIGHESTA `]() PPC64\_DTPREL16\_HIGHESTA = 1207959658 ##### [` PPC64_DTPREL16_LO `]() PPC64\_DTPREL16\_LO = 1207959627 ##### [` PPC64_DTPREL16_LO_DS `]() PPC64\_DTPREL16\_LO\_DS = 1207959654 ##### [` PPC64_DTPREL64 `]() PPC64\_DTPREL64 = 1207959630 ##### [` PPC64_GOT16 `]() PPC64\_GOT16 = 1207959566 ##### [` PPC64_GOT16_DS `]() PPC64\_GOT16\_DS = 1207959610 ##### [` PPC64_GOT16_HA `]() PPC64\_GOT16\_HA = 1207959569 ##### [` PPC64_GOT16_HI `]() PPC64\_GOT16\_HI = 1207959568 ##### [` PPC64_GOT16_LO `]() PPC64\_GOT16\_LO = 1207959567 ##### [` PPC64_GOT16_LO_DS `]() PPC64\_GOT16\_LO\_DS = 1207959611 ##### [` PPC64_GOT_DTPREL16_DS `]() PPC64\_GOT\_DTPREL16\_DS = 1207959643 ##### [` PPC64_GOT_DTPREL16_HA `]() PPC64\_GOT\_DTPREL16\_HA = 1207959646 ##### [` PPC64_GOT_DTPREL16_HI `]() PPC64\_GOT\_DTPREL16\_HI = 1207959645 ##### [` PPC64_GOT_DTPREL16_LO_DS `]() PPC64\_GOT\_DTPREL16\_LO\_DS = 1207959644 ##### [` PPC64_GOT_TLSGD16 `]() PPC64\_GOT\_TLSGD16 = 1207959631 ##### [` PPC64_GOT_TLSGD16_HA `]() PPC64\_GOT\_TLSGD16\_HA = 1207959634 ##### [` PPC64_GOT_TLSGD16_HI `]() PPC64\_GOT\_TLSGD16\_HI = 1207959633 ##### [` PPC64_GOT_TLSGD16_LO `]() PPC64\_GOT\_TLSGD16\_LO = 1207959632 ##### [` PPC64_GOT_TLSLD16 `]() PPC64\_GOT\_TLSLD16 = 1207959635 ##### [` PPC64_GOT_TLSLD16_HA `]() PPC64\_GOT\_TLSLD16\_HA = 1207959638 ##### [` PPC64_GOT_TLSLD16_HI `]() PPC64\_GOT\_TLSLD16\_HI = 1207959637 ##### [` PPC64_GOT_TLSLD16_LO `]() PPC64\_GOT\_TLSLD16\_LO = 1207959636 ##### [` PPC64_GOT_TPREL16_DS `]() PPC64\_GOT\_TPREL16\_DS = 1207959639 ##### [` PPC64_GOT_TPREL16_HA `]() PPC64\_GOT\_TPREL16\_HA = 1207959642 ##### [` PPC64_GOT_TPREL16_HI `]() PPC64\_GOT\_TPREL16\_HI = 1207959641 ##### [` PPC64_GOT_TPREL16_LO_DS `]() PPC64\_GOT\_TPREL16\_LO\_DS = 1207959640 ##### [` PPC64_JMP_SLOT `]() PPC64\_JMP\_SLOT = 1207959573 ##### [` PPC64_NONE `]() PPC64\_NONE = 1207959552 ##### [` PPC64_REL14 `]() PPC64\_REL14 = 1207959563 ##### [` PPC64_REL14_BRNTAKEN `]() PPC64\_REL14\_BRNTAKEN = 1207959565 ##### [` PPC64_REL14_BRTAKEN `]() PPC64\_REL14\_BRTAKEN = 1207959564 ##### [` PPC64_REL16 `]() PPC64\_REL16 = 1207959801 ##### [` PPC64_REL16_HA `]() PPC64\_REL16\_HA = 1207959804 ##### [` PPC64_REL16_HI `]() PPC64\_REL16\_HI = 1207959803 ##### [` PPC64_REL16_LO `]() PPC64\_REL16\_LO = 1207959802 ##### [` PPC64_REL24 `]() PPC64\_REL24 = 1207959562 ##### [` PPC64_REL32 `]() PPC64\_REL32 = 1207959578 ##### [` PPC64_REL64 `]() PPC64\_REL64 = 1207959596 ##### [` PPC64_RELATIVE `]() PPC64\_RELATIVE = 1207959574 ##### [` PPC64_TLS `]() PPC64\_TLS = 1207959619 ##### [` PPC64_TLSGD `]() PPC64\_TLSGD = 1207959659 ##### [` PPC64_TLSLD `]() PPC64\_TLSLD = 1207959660 ##### [` PPC64_TOC `]() PPC64\_TOC = 1207959603 ##### [` PPC64_TOC16 `]() PPC64\_TOC16 = 1207959599 ##### [` PPC64_TOC16_DS `]() PPC64\_TOC16\_DS = 1207959615 ##### [` PPC64_TOC16_HA `]() PPC64\_TOC16\_HA = 1207959602 ##### [` PPC64_TOC16_HI `]() PPC64\_TOC16\_HI = 1207959601 ##### [` PPC64_TOC16_LO `]() PPC64\_TOC16\_LO = 1207959600 ##### [` PPC64_TOC16_LO_DS `]() PPC64\_TOC16\_LO\_DS = 1207959616 ##### [` PPC64_TPREL16 `]() PPC64\_TPREL16 = 1207959621 ##### [` PPC64_TPREL16_DS `]() PPC64\_TPREL16\_DS = 1207959647 ##### [` PPC64_TPREL16_HA `]() PPC64\_TPREL16\_HA = 1207959624 ##### [` PPC64_TPREL16_HI `]() PPC64\_TPREL16\_HI = 1207959623 ##### [` PPC64_TPREL16_HIGHER `]() PPC64\_TPREL16\_HIGHER = 1207959649 ##### [` PPC64_TPREL16_HIGHERA `]() PPC64\_TPREL16\_HIGHERA = 1207959650 ##### [` PPC64_TPREL16_HIGHEST `]() PPC64\_TPREL16\_HIGHEST = 1207959651 ##### [` PPC64_TPREL16_HIGHESTA `]() PPC64\_TPREL16\_HIGHESTA = 1207959652 ##### [` PPC64_TPREL16_LO `]() PPC64\_TPREL16\_LO = 1207959622 ##### [` PPC64_TPREL16_LO_DS `]() PPC64\_TPREL16\_LO\_DS = 1207959648 ##### [` PPC64_TPREL64 `]() PPC64\_TPREL64 = 1207959625 ##### [` PPC_ADDR14 `]() PPC\_ADDR14 = 1073741831 ##### [` PPC_ADDR14_BRNTAKEN `]() PPC\_ADDR14\_BRNTAKEN = 1073741833 ##### [` PPC_ADDR14_BRTAKEN `]() PPC\_ADDR14\_BRTAKEN = 1073741832 ##### [` PPC_ADDR16 `]() PPC\_ADDR16 = 1073741827 ##### [` PPC_ADDR16_HA `]() PPC\_ADDR16\_HA = 1073741830 ##### [` PPC_ADDR16_HI `]() PPC\_ADDR16\_HI = 1073741829 ##### [` PPC_ADDR16_LO `]() PPC\_ADDR16\_LO = 1073741828 ##### [` PPC_ADDR24 `]() PPC\_ADDR24 = 1073741826 ##### [` PPC_ADDR32 `]() PPC\_ADDR32 = 1073741825 ##### [` PPC_DTPMOD32 `]() PPC\_DTPMOD32 = 1073741892 ##### [` PPC_DTPREL16 `]() PPC\_DTPREL16 = 1073741898 ##### [` PPC_DTPREL16_HA `]() PPC\_DTPREL16\_HA = 1073741901 ##### [` PPC_DTPREL16_HI `]() PPC\_DTPREL16\_HI = 1073741900 ##### [` PPC_DTPREL16_LO `]() PPC\_DTPREL16\_LO = 1073741899 ##### [` PPC_DTPREL32 `]() PPC\_DTPREL32 = 1073741902 ##### [` PPC_GOT16 `]() PPC\_GOT16 = 1073741838 ##### [` PPC_GOT16_HA `]() PPC\_GOT16\_HA = 1073741841 ##### [` PPC_GOT16_HI `]() PPC\_GOT16\_HI = 1073741840 ##### [` PPC_GOT16_LO `]() PPC\_GOT16\_LO = 1073741839 ##### [` PPC_GOT_DTPREL16 `]() PPC\_GOT\_DTPREL16 = 1073741915 ##### [` PPC_GOT_DTPREL16_HA `]() PPC\_GOT\_DTPREL16\_HA = 1073741918 ##### [` PPC_GOT_DTPREL16_HI `]() PPC\_GOT\_DTPREL16\_HI = 1073741917 ##### [` PPC_GOT_DTPREL16_LO `]() PPC\_GOT\_DTPREL16\_LO = 1073741916 ##### [` PPC_GOT_TLSGD16 `]() PPC\_GOT\_TLSGD16 = 1073741903 ##### [` PPC_GOT_TLSGD16_HA `]() PPC\_GOT\_TLSGD16\_HA = 1073741906 ##### [` PPC_GOT_TLSGD16_HI `]() PPC\_GOT\_TLSGD16\_HI = 1073741905 ##### [` PPC_GOT_TLSGD16_LO `]() PPC\_GOT\_TLSGD16\_LO = 1073741904 ##### [` PPC_GOT_TLSLD16 `]() PPC\_GOT\_TLSLD16 = 1073741907 ##### [` PPC_GOT_TLSLD16_HA `]() PPC\_GOT\_TLSLD16\_HA = 1073741910 ##### [` PPC_GOT_TLSLD16_HI `]() PPC\_GOT\_TLSLD16\_HI = 1073741909 ##### [` PPC_GOT_TLSLD16_LO `]() PPC\_GOT\_TLSLD16\_LO = 1073741908 ##### [` PPC_GOT_TPREL16 `]() PPC\_GOT\_TPREL16 = 1073741911 ##### [` PPC_GOT_TPREL16_HA `]() PPC\_GOT\_TPREL16\_HA = 1073741914 ##### [` PPC_GOT_TPREL16_HI `]() PPC\_GOT\_TPREL16\_HI = 1073741913 ##### [` PPC_GOT_TPREL16_LO `]() PPC\_GOT\_TPREL16\_LO = 1073741912 ##### [` PPC_JMP_SLOT `]() PPC\_JMP\_SLOT = 1073741845 ##### [` PPC_LOCAL24PC `]() PPC\_LOCAL24PC = 1073741847 ##### [` PPC_NONE `]() PPC\_NONE = 1073741824 ##### [` PPC_PLTREL24 `]() PPC\_PLTREL24 = 1073741842 ##### [` PPC_REL14 `]() PPC\_REL14 = 1073741835 ##### [` PPC_REL14_BRNTAKEN `]() PPC\_REL14\_BRNTAKEN = 1073741837 ##### [` PPC_REL14_BRTAKEN `]() PPC\_REL14\_BRTAKEN = 1073741836 ##### [` PPC_REL16 `]() PPC\_REL16 = 1073742073 ##### [` PPC_REL16_HA `]() PPC\_REL16\_HA = 1073742076 ##### [` PPC_REL16_HI `]() PPC\_REL16\_HI = 1073742075 ##### [` PPC_REL16_LO `]() PPC\_REL16\_LO = 1073742074 ##### [` PPC_REL24 `]() PPC\_REL24 = 1073741834 ##### [` PPC_REL32 `]() PPC\_REL32 = 1073741850 ##### [` PPC_RELATIVE `]() PPC\_RELATIVE = 1073741846 ##### [` PPC_TLS `]() PPC\_TLS = 1073741891 ##### [` PPC_TLSGD `]() PPC\_TLSGD = 1073741919 ##### [` PPC_TLSLD `]() PPC\_TLSLD = 1073741920 ##### [` PPC_TPREL16 `]() PPC\_TPREL16 = 1073741893 ##### [` PPC_TPREL16_HA `]() PPC\_TPREL16\_HA = 1073741896 ##### [` PPC_TPREL16_HI `]() PPC\_TPREL16\_HI = 1073741895 ##### [` PPC_TPREL16_LO `]() PPC\_TPREL16\_LO = 1073741894 ##### [` PPC_TPREL32 `]() PPC\_TPREL32 = 1073741897 ##### [` RISCV_32 `]() RISCV\_32 = 1610612737 ##### [` RISCV_32_PCREL `]() RISCV\_32\_PCREL = 1610612793 ##### [` RISCV_64 `]() RISCV\_64 = 1610612738 ##### [` RISCV_ADD16 `]() RISCV\_ADD16 = 1610612770 ##### [` RISCV_ADD32 `]() RISCV\_ADD32 = 1610612771 ##### [` RISCV_ADD64 `]() RISCV\_ADD64 = 1610612772 ##### [` RISCV_ADD8 `]() RISCV\_ADD8 = 1610612769 ##### [` RISCV_ALIGN `]() RISCV\_ALIGN = 1610612779 ##### [` RISCV_BRANCH `]() RISCV\_BRANCH = 1610612752 ##### [` RISCV_CALL `]() RISCV\_CALL = 1610612754 ##### [` RISCV_CALL_PLT `]() RISCV\_CALL\_PLT = 1610612755 ##### [` RISCV_COPY `]() RISCV\_COPY = 1610612740 ##### [` RISCV_GOT32_PCREL `]() RISCV\_GOT32\_PCREL = 1610612777 ##### [` RISCV_GOT_HI20 `]() RISCV\_GOT\_HI20 = 1610612756 ##### [` RISCV_HI20 `]() RISCV\_HI20 = 1610612762 ##### [` RISCV_IRELATIVE `]() RISCV\_IRELATIVE = 1610612794 ##### [` RISCV_JAL `]() RISCV\_JAL = 1610612753 ##### [` RISCV_JUMP_SLOT `]() RISCV\_JUMP\_SLOT = 1610612741 ##### [` RISCV_LO12_I `]() RISCV\_LO12\_I = 1610612763 ##### [` RISCV_LO12_S `]() RISCV\_LO12\_S = 1610612764 ##### [` RISCV_NONE `]() RISCV\_NONE = 1610612736 ##### [` RISCV_PCREL_HI20 `]() RISCV\_PCREL\_HI20 = 1610612759 ##### [` RISCV_PCREL_LO12_I `]() RISCV\_PCREL\_LO12\_I = 1610612760 ##### [` RISCV_PCREL_LO12_S `]() RISCV\_PCREL\_LO12\_S = 1610612761 ##### [` RISCV_PLT32 `]() RISCV\_PLT32 = 1610612795 ##### [` RISCV_RELATIVE `]() RISCV\_RELATIVE = 1610612739 ##### [` RISCV_RELAX `]() RISCV\_RELAX = 1610612787 ##### [` RISCV_RVC_BRANCH `]() RISCV\_RVC\_BRANCH = 1610612780 ##### [` RISCV_RVC_JUMP `]() RISCV\_RVC\_JUMP = 1610612781 ##### [` RISCV_RVC_LUI `]() RISCV\_RVC\_LUI = 1610612782 ##### [` RISCV_SET16 `]() RISCV\_SET16 = 1610612791 ##### [` RISCV_SET32 `]() RISCV\_SET32 = 1610612792 ##### [` RISCV_SET6 `]() RISCV\_SET6 = 1610612789 ##### [` RISCV_SET8 `]() RISCV\_SET8 = 1610612790 ##### [` RISCV_SET_ULEB128 `]() RISCV\_SET\_ULEB128 = 1610612796 ##### [` RISCV_SUB16 `]() RISCV\_SUB16 = 1610612774 ##### [` RISCV_SUB32 `]() RISCV\_SUB32 = 1610612775 ##### [` RISCV_SUB6 `]() RISCV\_SUB6 = 1610612788 ##### [` RISCV_SUB64 `]() RISCV\_SUB64 = 1610612776 ##### [` RISCV_SUB8 `]() RISCV\_SUB8 = 1610612773 ##### [` RISCV_SUB_ULEB128 `]() RISCV\_SUB\_ULEB128 = 1610612797 ##### [` RISCV_TLSDESC `]() RISCV\_TLSDESC = 1610612748 ##### [` RISCV_TLSDESC_ADD_LO12 `]() RISCV\_TLSDESC\_ADD\_LO12 = 1610612800 ##### [` RISCV_TLSDESC_CALL `]() RISCV\_TLSDESC\_CALL = 1610612801 ##### [` RISCV_TLSDESC_HI20 `]() RISCV\_TLSDESC\_HI20 = 1610612798 ##### [` RISCV_TLSDESC_LOAD_LO12 `]() RISCV\_TLSDESC\_LOAD\_LO12 = 1610612799 ##### [` RISCV_TLS_DTPMOD32 `]() RISCV\_TLS\_DTPMOD32 = 1610612742 ##### [` RISCV_TLS_DTPMOD64 `]() RISCV\_TLS\_DTPMOD64 = 1610612743 ##### [` RISCV_TLS_DTPREL32 `]() RISCV\_TLS\_DTPREL32 = 1610612744 ##### [` RISCV_TLS_DTPREL64 `]() RISCV\_TLS\_DTPREL64 = 1610612745 ##### [` RISCV_TLS_GD_HI20 `]() RISCV\_TLS\_GD\_HI20 = 1610612758 ##### [` RISCV_TLS_GOT_HI20 `]() RISCV\_TLS\_GOT\_HI20 = 1610612757 ##### [` RISCV_TLS_TPREL32 `]() RISCV\_TLS\_TPREL32 = 1610612746 ##### [` RISCV_TLS_TPREL64 `]() RISCV\_TLS\_TPREL64 = 1610612747 ##### [` RISCV_TPREL_ADD `]() RISCV\_TPREL\_ADD = 1610612768 ##### [` RISCV_TPREL_HI20 `]() RISCV\_TPREL\_HI20 = 1610612765 ##### [` RISCV_TPREL_LO12_I `]() RISCV\_TPREL\_LO12\_I = 1610612766 ##### [` RISCV_TPREL_LO12_S `]() RISCV\_TPREL\_LO12\_S = 1610612767 ##### [` SH_64 `]() SH\_64 = 1879048446 ##### [` SH_64_PCREL `]() SH\_64\_PCREL = 1879048447 ##### [` SH_ALIGN `]() SH\_ALIGN = 1879048221 ##### [` SH_CODE `]() SH\_CODE = 1879048222 ##### [` SH_COPY `]() SH\_COPY = 1879048354 ##### [` SH_COPY64 `]() SH\_COPY64 = 1879048385 ##### [` SH_COUNT `]() SH\_COUNT = 1879048220 ##### [` SH_DATA `]() SH\_DATA = 1879048223 ##### [` SH_DIR10S `]() SH\_DIR10S = 1879048240 ##### [` SH_DIR10SL `]() SH\_DIR10SL = 1879048242 ##### [` SH_DIR10SQ `]() SH\_DIR10SQ = 1879048243 ##### [` SH_DIR10SW `]() SH\_DIR10SW = 1879048241 ##### [` SH_DIR16 `]() SH\_DIR16 = 1879048225 ##### [` SH_DIR16S `]() SH\_DIR16S = 1879048245 ##### [` SH_DIR32 `]() SH\_DIR32 = 1879048193 ##### [` SH_DIR4U `]() SH\_DIR4U = 1879048234 ##### [` SH_DIR4UL `]() SH\_DIR4UL = 1879048232 ##### [` SH_DIR4UW `]() SH\_DIR4UW = 1879048233 ##### [` SH_DIR5U `]() SH\_DIR5U = 1879048237 ##### [` SH_DIR6S `]() SH\_DIR6S = 1879048239 ##### [` SH_DIR6U `]() SH\_DIR6U = 1879048238 ##### [` SH_DIR8 `]() SH\_DIR8 = 1879048226 ##### [` SH_DIR8BP `]() SH\_DIR8BP = 1879048199 ##### [` SH_DIR8L `]() SH\_DIR8L = 1879048201 ##### [` SH_DIR8S `]() SH\_DIR8S = 1879048231 ##### [` SH_DIR8SW `]() SH\_DIR8SW = 1879048230 ##### [` SH_DIR8U `]() SH\_DIR8U = 1879048229 ##### [` SH_DIR8UL `]() SH\_DIR8UL = 1879048227 ##### [` SH_DIR8UW `]() SH\_DIR8UW = 1879048228 ##### [` SH_DIR8W `]() SH\_DIR8W = 1879048200 ##### [` SH_DIR8WPL `]() SH\_DIR8WPL = 1879048197 ##### [` SH_DIR8WPN `]() SH\_DIR8WPN = 1879048195 ##### [` SH_DIR8WPZ `]() SH\_DIR8WPZ = 1879048198 ##### [` SH_FUNCDESC `]() SH\_FUNCDESC = 1879048399 ##### [` SH_FUNCDESC_VALUE `]() SH\_FUNCDESC\_VALUE = 1879048400 ##### [` SH_GLOB_DAT `]() SH\_GLOB\_DAT = 1879048355 ##### [` SH_GLOB_DAT64 `]() SH\_GLOB\_DAT64 = 1879048386 ##### [` SH_GNU_VTENTRY `]() SH\_GNU\_VTENTRY = 1879048215 ##### [` SH_GNU_VTINHERIT `]() SH\_GNU\_VTINHERIT = 1879048214 ##### [` SH_GOT10BY4 `]() SH\_GOT10BY4 = 1879048381 ##### [` SH_GOT10BY8 `]() SH\_GOT10BY8 = 1879048383 ##### [` SH_GOT20 `]() SH\_GOT20 = 1879048393 ##### [` SH_GOT32 `]() SH\_GOT32 = 1879048352 ##### [` SH_GOTFUNCDESC `]() SH\_GOTFUNCDESC = 1879048395 ##### [` SH_GOTFUNCDESC20 `]() SH\_GOTFUNCDESC20 = 1879048396 ##### [` SH_GOTOFF `]() SH\_GOTOFF = 1879048358 ##### [` SH_GOTOFF20 `]() SH\_GOTOFF20 = 1879048394 ##### [` SH_GOTOFFFUNCDESC `]() SH\_GOTOFFFUNCDESC = 1879048397 ##### [` SH_GOTOFFFUNCDESC20 `]() SH\_GOTOFFFUNCDESC20 = 1879048398 ##### [` SH_GOTOFF_HI16 `]() SH\_GOTOFF\_HI16 = 1879048376 ##### [` SH_GOTOFF_LOW16 `]() SH\_GOTOFF\_LOW16 = 1879048373 ##### [` SH_GOTOFF_MEDHI16 `]() SH\_GOTOFF\_MEDHI16 = 1879048375 ##### [` SH_GOTOFF_MEDLOW16 `]() SH\_GOTOFF\_MEDLOW16 = 1879048374 ##### [` SH_GOTPC `]() SH\_GOTPC = 1879048359 ##### [` SH_GOTPC_HI16 `]() SH\_GOTPC\_HI16 = 1879048380 ##### [` SH_GOTPC_LOW16 `]() SH\_GOTPC\_LOW16 = 1879048377 ##### [` SH_GOTPC_MEDHI16 `]() SH\_GOTPC\_MEDHI16 = 1879048379 ##### [` SH_GOTPC_MEDLOW16 `]() SH\_GOTPC\_MEDLOW16 = 1879048378 ##### [` SH_GOTPLT10BY4 `]() SH\_GOTPLT10BY4 = 1879048382 ##### [` SH_GOTPLT10BY8 `]() SH\_GOTPLT10BY8 = 1879048384 ##### [` SH_GOTPLT32 `]() SH\_GOTPLT32 = 1879048360 ##### [` SH_GOTPLT_HI16 `]() SH\_GOTPLT\_HI16 = 1879048368 ##### [` SH_GOTPLT_LOW16 `]() SH\_GOTPLT\_LOW16 = 1879048365 ##### [` SH_GOTPLT_MEDHI16 `]() SH\_GOTPLT\_MEDHI16 = 1879048367 ##### [` SH_GOTPLT_MEDLOW16 `]() SH\_GOTPLT\_MEDLOW16 = 1879048366 ##### [` SH_GOT_HI16 `]() SH\_GOT\_HI16 = 1879048364 ##### [` SH_GOT_LOW16 `]() SH\_GOT\_LOW16 = 1879048361 ##### [` SH_GOT_MEDHI16 `]() SH\_GOT\_MEDHI16 = 1879048363 ##### [` SH_GOT_MEDLOW16 `]() SH\_GOT\_MEDLOW16 = 1879048362 ##### [` SH_IMMS16 `]() SH\_IMMS16 = 1879048436 ##### [` SH_IMMU16 `]() SH\_IMMU16 = 1879048437 ##### [` SH_IMM_HI16 `]() SH\_IMM\_HI16 = 1879048444 ##### [` SH_IMM_HI16_PCREL `]() SH\_IMM\_HI16\_PCREL = 1879048445 ##### [` SH_IMM_LOW16 `]() SH\_IMM\_LOW16 = 1879048438 ##### [` SH_IMM_LOW16_PCREL `]() SH\_IMM\_LOW16\_PCREL = 1879048439 ##### [` SH_IMM_MEDHI16 `]() SH\_IMM\_MEDHI16 = 1879048442 ##### [` SH_IMM_MEDHI16_PCREL `]() SH\_IMM\_MEDHI16\_PCREL = 1879048443 ##### [` SH_IMM_MEDLOW16 `]() SH\_IMM\_MEDLOW16 = 1879048440 ##### [` SH_IMM_MEDLOW16_PCREL `]() SH\_IMM\_MEDLOW16\_PCREL = 1879048441 ##### [` SH_IND12W `]() SH\_IND12W = 1879048196 ##### [` SH_JMP_SLOT `]() SH\_JMP\_SLOT = 1879048356 ##### [` SH_JMP_SLOT64 `]() SH\_JMP\_SLOT64 = 1879048387 ##### [` SH_LABEL `]() SH\_LABEL = 1879048224 ##### [` SH_LOOP_END `]() SH\_LOOP\_END = 1879048203 ##### [` SH_LOOP_START `]() SH\_LOOP\_START = 1879048202 ##### [` SH_NONE `]() SH\_NONE = 1879048192 ##### [` SH_PLT32 `]() SH\_PLT32 = 1879048353 ##### [` SH_PLT_HI16 `]() SH\_PLT\_HI16 = 1879048372 ##### [` SH_PLT_LOW16 `]() SH\_PLT\_LOW16 = 1879048369 ##### [` SH_PLT_MEDHI16 `]() SH\_PLT\_MEDHI16 = 1879048371 ##### [` SH_PLT_MEDLOW16 `]() SH\_PLT\_MEDLOW16 = 1879048370 ##### [` SH_PSHA `]() SH\_PSHA = 1879048235 ##### [` SH_PSHL `]() SH\_PSHL = 1879048236 ##### [` SH_PT_16 `]() SH\_PT\_16 = 1879048435 ##### [` SH_REL32 `]() SH\_REL32 = 1879048194 ##### [` SH_RELATIVE `]() SH\_RELATIVE = 1879048357 ##### [` SH_RELATIVE64 `]() SH\_RELATIVE64 = 1879048388 ##### [` SH_SHMEDIA_CODE `]() SH\_SHMEDIA\_CODE = 1879048434 ##### [` SH_SWITCH16 `]() SH\_SWITCH16 = 1879048217 ##### [` SH_SWITCH32 `]() SH\_SWITCH32 = 1879048218 ##### [` SH_SWITCH8 `]() SH\_SWITCH8 = 1879048216 ##### [` SH_TLS_DTPMOD32 `]() SH\_TLS\_DTPMOD32 = 1879048341 ##### [` SH_TLS_DTPOFF32 `]() SH\_TLS\_DTPOFF32 = 1879048342 ##### [` SH_TLS_GD_32 `]() SH\_TLS\_GD\_32 = 1879048336 ##### [` SH_TLS_IE_32 `]() SH\_TLS\_IE\_32 = 1879048339 ##### [` SH_TLS_LDO_32 `]() SH\_TLS\_LDO\_32 = 1879048338 ##### [` SH_TLS_LD_32 `]() SH\_TLS\_LD\_32 = 1879048337 ##### [` SH_TLS_LE_32 `]() SH\_TLS\_LE\_32 = 1879048340 ##### [` SH_TLS_TPOFF32 `]() SH\_TLS\_TPOFF32 = 1879048343 ##### [` SH_USES `]() SH\_USES = 1879048219 ##### [` SPARC_10 `]() SPARC\_10 = 1342177310 ##### [` SPARC_11 `]() SPARC\_11 = 1342177311 ##### [` SPARC_13 `]() SPARC\_13 = 1342177291 ##### [` SPARC_16 `]() SPARC\_16 = 1342177282 ##### [` SPARC_22 `]() SPARC\_22 = 1342177290 ##### [` SPARC_32 `]() SPARC\_32 = 1342177283 ##### [` SPARC_5 `]() SPARC\_5 = 1342177324 ##### [` SPARC_6 `]() SPARC\_6 = 1342177325 ##### [` SPARC_64 `]() SPARC\_64 = 1342177312 ##### [` SPARC_7 `]() SPARC\_7 = 1342177323 ##### [` SPARC_8 `]() SPARC\_8 = 1342177281 ##### [` SPARC_COPY `]() SPARC\_COPY = 1342177299 ##### [` SPARC_DISP16 `]() SPARC\_DISP16 = 1342177285 ##### [` SPARC_DISP32 `]() SPARC\_DISP32 = 1342177286 ##### [` SPARC_DISP64 `]() SPARC\_DISP64 = 1342177326 ##### [` SPARC_DISP8 `]() SPARC\_DISP8 = 1342177284 ##### [` SPARC_GLOB_DAT `]() SPARC\_GLOB\_DAT = 1342177300 ##### [` SPARC_GOT10 `]() SPARC\_GOT10 = 1342177293 ##### [` SPARC_GOT13 `]() SPARC\_GOT13 = 1342177294 ##### [` SPARC_GOT22 `]() SPARC\_GOT22 = 1342177295 ##### [` SPARC_GOTDATA_HIX22 `]() SPARC\_GOTDATA\_HIX22 = 1342177360 ##### [` SPARC_GOTDATA_LOX10 `]() SPARC\_GOTDATA\_LOX10 = 1342177361 ##### [` SPARC_GOTDATA_OP `]() SPARC\_GOTDATA\_OP = 1342177364 ##### [` SPARC_GOTDATA_OP_HIX22 `]() SPARC\_GOTDATA\_OP\_HIX22 = 1342177362 ##### [` SPARC_GOTDATA_OP_LOX10 `]() SPARC\_GOTDATA\_OP\_LOX10 = 1342177363 ##### [` SPARC_H44 `]() SPARC\_H44 = 1342177330 ##### [` SPARC_HH22 `]() SPARC\_HH22 = 1342177314 ##### [` SPARC_HI22 `]() SPARC\_HI22 = 1342177289 ##### [` SPARC_HIPLT22 `]() SPARC\_HIPLT22 = 1342177305 ##### [` SPARC_HIX22 `]() SPARC\_HIX22 = 1342177328 ##### [` SPARC_HM10 `]() SPARC\_HM10 = 1342177315 ##### [` SPARC_JMP_SLOT `]() SPARC\_JMP\_SLOT = 1342177301 ##### [` SPARC_L44 `]() SPARC\_L44 = 1342177332 ##### [` SPARC_LM22 `]() SPARC\_LM22 = 1342177316 ##### [` SPARC_LO10 `]() SPARC\_LO10 = 1342177292 ##### [` SPARC_LOPLT10 `]() SPARC\_LOPLT10 = 1342177306 ##### [` SPARC_LOX10 `]() SPARC\_LOX10 = 1342177329 ##### [` SPARC_M44 `]() SPARC\_M44 = 1342177331 ##### [` SPARC_NONE `]() SPARC\_NONE = 1342177280 ##### [` SPARC_OLO10 `]() SPARC\_OLO10 = 1342177313 ##### [` SPARC_PC10 `]() SPARC\_PC10 = 1342177296 ##### [` SPARC_PC22 `]() SPARC\_PC22 = 1342177297 ##### [` SPARC_PCPLT10 `]() SPARC\_PCPLT10 = 1342177309 ##### [` SPARC_PCPLT22 `]() SPARC\_PCPLT22 = 1342177308 ##### [` SPARC_PCPLT32 `]() SPARC\_PCPLT32 = 1342177307 ##### [` SPARC_PC_HH22 `]() SPARC\_PC\_HH22 = 1342177317 ##### [` SPARC_PC_HM10 `]() SPARC\_PC\_HM10 = 1342177318 ##### [` SPARC_PC_LM22 `]() SPARC\_PC\_LM22 = 1342177319 ##### [` SPARC_PLT32 `]() SPARC\_PLT32 = 1342177304 ##### [` SPARC_PLT64 `]() SPARC\_PLT64 = 1342177327 ##### [` SPARC_REGISTER `]() SPARC\_REGISTER = 1342177333 ##### [` SPARC_RELATIVE `]() SPARC\_RELATIVE = 1342177302 ##### [` SPARC_TLS_DTPMOD32 `]() SPARC\_TLS\_DTPMOD32 = 1342177354 ##### [` SPARC_TLS_DTPMOD64 `]() SPARC\_TLS\_DTPMOD64 = 1342177355 ##### [` SPARC_TLS_DTPOFF32 `]() SPARC\_TLS\_DTPOFF32 = 1342177356 ##### [` SPARC_TLS_DTPOFF64 `]() SPARC\_TLS\_DTPOFF64 = 1342177357 ##### [` SPARC_TLS_GD_ADD `]() SPARC\_TLS\_GD\_ADD = 1342177338 ##### [` SPARC_TLS_GD_CALL `]() SPARC\_TLS\_GD\_CALL = 1342177339 ##### [` SPARC_TLS_GD_HI22 `]() SPARC\_TLS\_GD\_HI22 = 1342177336 ##### [` SPARC_TLS_GD_LO10 `]() SPARC\_TLS\_GD\_LO10 = 1342177337 ##### [` SPARC_TLS_IE_ADD `]() SPARC\_TLS\_IE\_ADD = 1342177351 ##### [` SPARC_TLS_IE_HI22 `]() SPARC\_TLS\_IE\_HI22 = 1342177347 ##### [` SPARC_TLS_IE_LD `]() SPARC\_TLS\_IE\_LD = 1342177349 ##### [` SPARC_TLS_IE_LDX `]() SPARC\_TLS\_IE\_LDX = 1342177350 ##### [` SPARC_TLS_IE_LO10 `]() SPARC\_TLS\_IE\_LO10 = 1342177348 ##### [` SPARC_TLS_LDM_ADD `]() SPARC\_TLS\_LDM\_ADD = 1342177342 ##### [` SPARC_TLS_LDM_CALL `]() SPARC\_TLS\_LDM\_CALL = 1342177343 ##### [` SPARC_TLS_LDM_HI22 `]() SPARC\_TLS\_LDM\_HI22 = 1342177340 ##### [` SPARC_TLS_LDM_LO10 `]() SPARC\_TLS\_LDM\_LO10 = 1342177341 ##### [` SPARC_TLS_LDO_ADD `]() SPARC\_TLS\_LDO\_ADD = 1342177346 ##### [` SPARC_TLS_LDO_HIX22 `]() SPARC\_TLS\_LDO\_HIX22 = 1342177344 ##### [` SPARC_TLS_LDO_LOX10 `]() SPARC\_TLS\_LDO\_LOX10 = 1342177345 ##### [` SPARC_TLS_LE_HIX22 `]() SPARC\_TLS\_LE\_HIX22 = 1342177352 ##### [` SPARC_TLS_LE_LOX10 `]() SPARC\_TLS\_LE\_LOX10 = 1342177353 ##### [` SPARC_TLS_TPOFF32 `]() SPARC\_TLS\_TPOFF32 = 1342177358 ##### [` SPARC_TLS_TPOFF64 `]() SPARC\_TLS\_TPOFF64 = 1342177359 ##### [` SPARC_UA16 `]() SPARC\_UA16 = 1342177335 ##### [` SPARC_UA32 `]() SPARC\_UA32 = 1342177303 ##### [` SPARC_UA64 `]() SPARC\_UA64 = 1342177334 ##### [` SPARC_WDISP16 `]() SPARC\_WDISP16 = 1342177320 ##### [` SPARC_WDISP19 `]() SPARC\_WDISP19 = 1342177321 ##### [` SPARC_WDISP22 `]() SPARC\_WDISP22 = 1342177288 ##### [` SPARC_WDISP30 `]() SPARC\_WDISP30 = 1342177287 ##### [` SPARC_WPLT30 `]() SPARC\_WPLT30 = 1342177298 ##### [` SYSZ_12 `]() SYSZ\_12 = 1476395010 ##### [` SYSZ_16 `]() SYSZ\_16 = 1476395011 ##### [` SYSZ_20 `]() SYSZ\_20 = 1476395065 ##### [` SYSZ_32 `]() SYSZ\_32 = 1476395012 ##### [` SYSZ_64 `]() SYSZ\_64 = 1476395030 ##### [` SYSZ_8 `]() SYSZ\_8 = 1476395009 ##### [` SYSZ_COPY `]() SYSZ\_COPY = 1476395017 ##### [` SYSZ_GLOB_DAT `]() SYSZ\_GLOB\_DAT = 1476395018 ##### [` SYSZ_GOT12 `]() SYSZ\_GOT12 = 1476395014 ##### [` SYSZ_GOT16 `]() SYSZ\_GOT16 = 1476395023 ##### [` SYSZ_GOT20 `]() SYSZ\_GOT20 = 1476395066 ##### [` SYSZ_GOT32 `]() SYSZ\_GOT32 = 1476395015 ##### [` SYSZ_GOT64 `]() SYSZ\_GOT64 = 1476395032 ##### [` SYSZ_GOTENT `]() SYSZ\_GOTENT = 1476395034 ##### [` SYSZ_GOTOFF `]() SYSZ\_GOTOFF = 1476395021 ##### [` SYSZ_GOTOFF16 `]() SYSZ\_GOTOFF16 = 1476395035 ##### [` SYSZ_GOTOFF64 `]() SYSZ\_GOTOFF64 = 1476395036 ##### [` SYSZ_GOTPC `]() SYSZ\_GOTPC = 1476395022 ##### [` SYSZ_GOTPCDBL `]() SYSZ\_GOTPCDBL = 1476395029 ##### [` SYSZ_GOTPLT12 `]() SYSZ\_GOTPLT12 = 1476395037 ##### [` SYSZ_GOTPLT16 `]() SYSZ\_GOTPLT16 = 1476395038 ##### [` SYSZ_GOTPLT20 `]() SYSZ\_GOTPLT20 = 1476395067 ##### [` SYSZ_GOTPLT32 `]() SYSZ\_GOTPLT32 = 1476395039 ##### [` SYSZ_GOTPLT64 `]() SYSZ\_GOTPLT64 = 1476395040 ##### [` SYSZ_GOTPLTENT `]() SYSZ\_GOTPLTENT = 1476395041 ##### [` SYSZ_IRELATIVE `]() SYSZ\_IRELATIVE = 1476395069 ##### [` SYSZ_JMP_SLOT `]() SYSZ\_JMP\_SLOT = 1476395019 ##### [` SYSZ_NONE `]() SYSZ\_NONE = 1476395008 ##### [` SYSZ_PC12DBL `]() SYSZ\_PC12DBL = 1476395070 ##### [` SYSZ_PC16 `]() SYSZ\_PC16 = 1476395024 ##### [` SYSZ_PC16DBL `]() SYSZ\_PC16DBL = 1476395025 ##### [` SYSZ_PC24DBL `]() SYSZ\_PC24DBL = 1476395072 ##### [` SYSZ_PC32 `]() SYSZ\_PC32 = 1476395013 ##### [` SYSZ_PC32DBL `]() SYSZ\_PC32DBL = 1476395027 ##### [` SYSZ_PC64 `]() SYSZ\_PC64 = 1476395031 ##### [` SYSZ_PLT12DBL `]() SYSZ\_PLT12DBL = 1476395071 ##### [` SYSZ_PLT16DBL `]() SYSZ\_PLT16DBL = 1476395026 ##### [` SYSZ_PLT24DBL `]() SYSZ\_PLT24DBL = 1476395073 ##### [` SYSZ_PLT32 `]() SYSZ\_PLT32 = 1476395016 ##### [` SYSZ_PLT32DBL `]() SYSZ\_PLT32DBL = 1476395028 ##### [` SYSZ_PLT64 `]() SYSZ\_PLT64 = 1476395033 ##### [` SYSZ_PLTOFF16 `]() SYSZ\_PLTOFF16 = 1476395042 ##### [` SYSZ_PLTOFF32 `]() SYSZ\_PLTOFF32 = 1476395043 ##### [` SYSZ_PLTOFF64 `]() SYSZ\_PLTOFF64 = 1476395044 ##### [` SYSZ_RELATIVE `]() SYSZ\_RELATIVE = 1476395020 ##### [` SYSZ_TLS_DTPMOD `]() SYSZ\_TLS\_DTPMOD = 1476395062 ##### [` SYSZ_TLS_DTPOFF `]() SYSZ\_TLS\_DTPOFF = 1476395063 ##### [` SYSZ_TLS_GD32 `]() SYSZ\_TLS\_GD32 = 1476395048 ##### [` SYSZ_TLS_GD64 `]() SYSZ\_TLS\_GD64 = 1476395049 ##### [` SYSZ_TLS_GDCALL `]() SYSZ\_TLS\_GDCALL = 1476395046 ##### [` SYSZ_TLS_GOTIE12 `]() SYSZ\_TLS\_GOTIE12 = 1476395050 ##### [` SYSZ_TLS_GOTIE20 `]() SYSZ\_TLS\_GOTIE20 = 1476395068 ##### [` SYSZ_TLS_GOTIE32 `]() SYSZ\_TLS\_GOTIE32 = 1476395051 ##### [` SYSZ_TLS_GOTIE64 `]() SYSZ\_TLS\_GOTIE64 = 1476395052 ##### [` SYSZ_TLS_IE32 `]() SYSZ\_TLS\_IE32 = 1476395055 ##### [` SYSZ_TLS_IE64 `]() SYSZ\_TLS\_IE64 = 1476395056 ##### [` SYSZ_TLS_IEENT `]() SYSZ\_TLS\_IEENT = 1476395057 ##### [` SYSZ_TLS_LDCALL `]() SYSZ\_TLS\_LDCALL = 1476395047 ##### [` SYSZ_TLS_LDM32 `]() SYSZ\_TLS\_LDM32 = 1476395053 ##### [` SYSZ_TLS_LDM64 `]() SYSZ\_TLS\_LDM64 = 1476395054 ##### [` SYSZ_TLS_LDO32 `]() SYSZ\_TLS\_LDO32 = 1476395060 ##### [` SYSZ_TLS_LDO64 `]() SYSZ\_TLS\_LDO64 = 1476395061 ##### [` SYSZ_TLS_LE32 `]() SYSZ\_TLS\_LE32 = 1476395058 ##### [` SYSZ_TLS_LE64 `]() SYSZ\_TLS\_LE64 = 1476395059 ##### [` SYSZ_TLS_LOAD `]() SYSZ\_TLS\_LOAD = 1476395045 ##### [` SYSZ_TLS_TPOFF `]() SYSZ\_TLS\_TPOFF = 1476395064 ##### [` X86_16 `]() X86\_16 = 671088660 ##### [` X86_32 `]() X86\_32 = 671088641 ##### [` X86_32PLT `]() X86\_32PLT = 671088651 ##### [` X86_64_16 `]() X86\_64\_16 = 134217740 ##### [` X86_64_32 `]() X86\_64\_32 = 134217738 ##### [` X86_64_32S `]() X86\_64\_32S = 134217739 ##### [` X86_64_64 `]() X86\_64\_64 = 134217729 ##### [` X86_64_8 `]() X86\_64\_8 = 134217742 ##### [` X86_64_COPY `]() X86\_64\_COPY = 134217733 ##### [` X86_64_DTPMOD64 `]() X86\_64\_DTPMOD64 = 134217744 ##### [` X86_64_DTPOFF32 `]() X86\_64\_DTPOFF32 = 134217749 ##### [` X86_64_DTPOFF64 `]() X86\_64\_DTPOFF64 = 134217745 ##### [` X86_64_GLOB_DAT `]() X86\_64\_GLOB\_DAT = 134217734 ##### [` X86_64_GOT32 `]() X86\_64\_GOT32 = 134217731 ##### [` X86_64_GOT64 `]() X86\_64\_GOT64 = 134217755 ##### [` X86_64_GOTOFF64 `]() X86\_64\_GOTOFF64 = 134217753 ##### [` X86_64_GOTPC32 `]() X86\_64\_GOTPC32 = 134217754 ##### [` X86_64_GOTPC32_TLSDESC `]() X86\_64\_GOTPC32\_TLSDESC = 134217762 ##### [` X86_64_GOTPC64 `]() X86\_64\_GOTPC64 = 134217757 ##### [` X86_64_GOTPCREL `]() X86\_64\_GOTPCREL = 134217737 ##### [` X86_64_GOTPCREL64 `]() X86\_64\_GOTPCREL64 = 134217756 ##### [` X86_64_GOTPCRELX `]() X86\_64\_GOTPCRELX = 134217769 ##### [` X86_64_GOTPLT64 `]() X86\_64\_GOTPLT64 = 134217758 ##### [` X86_64_GOTTPOFF `]() X86\_64\_GOTTPOFF = 134217750 ##### [` X86_64_IRELATIVE `]() X86\_64\_IRELATIVE = 134217765 ##### [` X86_64_JUMP_SLOT `]() X86\_64\_JUMP\_SLOT = 134217735 ##### [` X86_64_NONE `]() X86\_64\_NONE = 134217728 ##### [` X86_64_PC16 `]() X86\_64\_PC16 = 134217741 ##### [` X86_64_PC32 `]() X86\_64\_PC32 = 134217730 ##### [` X86_64_PC32_BND `]() X86\_64\_PC32\_BND = 134217767 ##### [` X86_64_PC64 `]() X86\_64\_PC64 = 134217752 ##### [` X86_64_PC8 `]() X86\_64\_PC8 = 134217743 ##### [` X86_64_PLT32 `]() X86\_64\_PLT32 = 134217732 ##### [` X86_64_PLT32_BND `]() X86\_64\_PLT32\_BND = 134217768 ##### [` X86_64_PLTOFF64 `]() X86\_64\_PLTOFF64 = 134217759 ##### [` X86_64_RELATIVE `]() X86\_64\_RELATIVE = 134217736 ##### [` X86_64_RELATIVE64 `]() X86\_64\_RELATIVE64 = 134217766 ##### [` X86_64_REX_GOTPCRELX `]() X86\_64\_REX\_GOTPCRELX = 134217770 ##### [` X86_64_SIZE32 `]() X86\_64\_SIZE32 = 134217760 ##### [` X86_64_SIZE64 `]() X86\_64\_SIZE64 = 134217761 ##### [` X86_64_TLSDESC `]() X86\_64\_TLSDESC = 134217764 ##### [` X86_64_TLSDESC_CALL `]() X86\_64\_TLSDESC\_CALL = 134217763 ##### [` X86_64_TLSGD `]() X86\_64\_TLSGD = 134217747 ##### [` X86_64_TLSLD `]() X86\_64\_TLSLD = 134217748 ##### [` X86_64_TPOFF32 `]() X86\_64\_TPOFF32 = 134217751 ##### [` X86_64_TPOFF64 `]() X86\_64\_TPOFF64 = 134217746 ##### [` X86_8 `]() X86\_8 = 671088662 ##### [` X86_COPY `]() X86\_COPY = 671088645 ##### [` X86_GLOB_DAT `]() X86\_GLOB\_DAT = 671088646 ##### [` X86_GOT32 `]() X86\_GOT32 = 671088643 ##### [` X86_GOTOFF `]() X86\_GOTOFF = 671088649 ##### [` X86_GOTPC `]() X86\_GOTPC = 671088650 ##### [` X86_IRELATIVE `]() X86\_IRELATIVE = 671088682 ##### [` X86_JUMP_SLOT `]() X86\_JUMP\_SLOT = 671088647 ##### [` X86_NONE `]() X86\_NONE = 671088640 ##### [` X86_PC16 `]() X86\_PC16 = 671088661 ##### [` X86_PC32 `]() X86\_PC32 = 671088642 ##### [` X86_PC8 `]() X86\_PC8 = 671088663 ##### [` X86_PLT32 `]() X86\_PLT32 = 671088644 ##### [` X86_RELATIVE `]() X86\_RELATIVE = 671088648 ##### [` X86_TLS_DESC `]() X86\_TLS\_DESC = 671088681 ##### [` X86_TLS_DESC_CALL `]() X86\_TLS\_DESC\_CALL = 671088680 ##### [` X86_TLS_DTPMOD32 `]() X86\_TLS\_DTPMOD32 = 671088675 ##### [` X86_TLS_DTPOFF32 `]() X86\_TLS\_DTPOFF32 = 671088676 ##### [` X86_TLS_GD `]() X86\_TLS\_GD = 671088658 ##### [` X86_TLS_GD_32 `]() X86\_TLS\_GD\_32 = 671088664 ##### [` X86_TLS_GD_CALL `]() X86\_TLS\_GD\_CALL = 671088666 ##### [` X86_TLS_GD_POP `]() X86\_TLS\_GD\_POP = 671088667 ##### [` X86_TLS_GD_PUSH `]() X86\_TLS\_GD\_PUSH = 671088665 ##### [` X86_TLS_GOTDESC `]() X86\_TLS\_GOTDESC = 671088679 ##### [` X86_TLS_GOTIE `]() X86\_TLS\_GOTIE = 671088656 ##### [` X86_TLS_IE `]() X86\_TLS\_IE = 671088655 ##### [` X86_TLS_IE_32 `]() X86\_TLS\_IE\_32 = 671088673 ##### [` X86_TLS_LDM `]() X86\_TLS\_LDM = 671088659 ##### [` X86_TLS_LDM_32 `]() X86\_TLS\_LDM\_32 = 671088668 ##### [` X86_TLS_LDM_CALL `]() X86\_TLS\_LDM\_CALL = 671088670 ##### [` X86_TLS_LDM_POP `]() X86\_TLS\_LDM\_POP = 671088671 ##### [` X86_TLS_LDM_PUSH `]() X86\_TLS\_LDM\_PUSH = 671088669 ##### [` X86_TLS_LDO_32 `]() X86\_TLS\_LDO\_32 = 671088672 ##### [` X86_TLS_LE `]() X86\_TLS\_LE = 671088657 ##### [` X86_TLS_LE_32 `]() X86\_TLS\_LE\_32 = 671088674 ##### [` X86_TLS_TPOFF `]() X86\_TLS\_TPOFF = 671088654 ##### [` X86_TLS_TPOFF32 `]() X86\_TLS\_TPOFF32 = 671088677 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.Relocation.TYPE]( "lief.ELF.Relocation.TYPE") = <nanobind.nb\_func object> #### [` addend `]() property addend → int Additional value #### [` encoding `]() property encoding → [lief.ELF.Relocation.ENCODING]( "lief.ELF.Relocation.ENCODING") The encoding of the relocation #### [` has_section `]() property has\_section → bool `True` if this relocation has a [`lief.ELF.Section`]( "lief.ELF.Section") associated with. This is usually the case for object files (`.o`) #### [` has_symbol `]() property has\_symbol → bool `True` if a [`Symbol`]( "lief.ELF.Symbol") is associated with the relocation #### [` info `]() property info → int Extra information like the symbol index #### [` is_android_packed `]() property is\_android\_packed → bool True if the relocation is using the Android packed relocation format #### [` is_rel `]() property is\_rel → bool Check if the relocation uses the implicit addend (i.e. not present in the ELF structure) #### [` is_rela `]() property is\_rela → bool `True` if the relocation **uses** the [`addend`]( "lief.ELF.Relocation.addend") property #### [` is_relatively_encoded `]() property is\_relatively\_encoded → bool True if the relocation is using the relative encoding #### [` purpose `]() property purpose → [lief.ELF.Relocation.PURPOSE]( "lief.ELF.Relocation.PURPOSE") Purpose of the relocation. This value provides the information about how the relocation is used (PLT/GOT resolution, `.o` file, …) #### [` r_infor_info `]() r\_info(*self*, *clazz: [lief.\_lief.ELF.Header.CLASS]( "lief._lief.ELF.Header.CLASS")*, *data: [lief.\_lief.ELF.Header.ELF\_DATA]( "lief._lief.ELF.Header.ELF_DATA")*) → int **r\_info(*self*, *header: [lief.\_lief.ELF.Header]( "lief._lief.ELF.Header")*) → int** Overloaded function. 1. `r_info(self, clazz: lief._lief.ELF.Header.CLASS, data: lief._lief.ELF.Header.ELF_DATA) -> int` > (re)Compute the raw `r_info` attribute based on the given ELF class and endianness 2. `r_info(self, header: lief._lief.ELF.Header) -> int` > (re)Compute the raw `r_info` attribute based on the ELF Header #### [` resolve `]() resolve(*self*, *base\_address: int = 0*) → int | [lief.\_lief.lief\_errors]( "lief._lief.lief_errors") Try to resolve the value of the relocation such as `*address() = resolve()` #### [` section `]() property section → [lief.ELF.Section]( "lief.ELF.Section") | None [`Section`]( "lief.ELF.Section") in which the relocation is applied or None if not relevant #### [` symbol `]() property symbol → [lief.ELF.Symbol]( "lief.ELF.Symbol") | None [`Symbol`]( "lief.ELF.Symbol") associated with the relocation or None if no symbol is associated with this relocation. #### [` symbol_table `]() property symbol\_table → [lief.ELF.Section]( "lief.ELF.Section") | None The symbol table [`Section`]( "lief.ELF.Section") which the relocation references #### [` type `]() property type → [lief.ELF.Relocation.TYPE]( "lief.ELF.Relocation.TYPE") Relocation type. --- ## [Symbol]() ### [` lief.ELF.Symbol `]() class lief.ELF.Symbol(*self*) Bases: [`Symbol`]( "lief._lief.Symbol") Class which represents an ELF symbol #### [` BINDING `]() class BINDING(*\*values*) Bases: `Enum` ##### [` GLOBAL `]() GLOBAL = 1 ##### [` GNU_UNIQUE `]() GNU\_UNIQUE = 10 ##### [` LOCAL `]() LOCAL = 0 ##### [` WEAK `]() WEAK = 2 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.Symbol.BINDING]( "lief.ELF.Symbol.BINDING") = <nanobind.nb\_func object> #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` ##### [` COMMON `]() COMMON = 5 ##### [` FILE `]() FILE = 4 ##### [` FUNC `]() FUNC = 2 ##### [` GNU_IFUNC `]() GNU\_IFUNC = 10 ##### [` NOTYPE `]() NOTYPE = 0 ##### [` OBJECT `]() OBJECT = 1 ##### [` SECTION `]() SECTION = 3 ##### [` TLS `]() TLS = 6 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.Symbol.TYPE]( "lief.ELF.Symbol.TYPE") = <nanobind.nb\_func object> #### [` VISIBILITY `]() class VISIBILITY(*\*values*) Bases: `Enum` ##### [` DEFAULT `]() DEFAULT = 0 ##### [` HIDDEN `]() HIDDEN = 2 ##### [` INTERNAL `]() INTERNAL = 1 ##### [` PROTECTED `]() PROTECTED = 3 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.Symbol.VISIBILITY]( "lief.ELF.Symbol.VISIBILITY") = <nanobind.nb\_func object> #### [` binding `]() property binding → [lief.ELF.Symbol.BINDING]( "lief.ELF.Symbol.BINDING") A symbol’s binding determines the linkage visibility and behavior. #### [` demangled_name `]() property demangled\_name → str Symbol’s name demangled or an empty string if the demangling is not possible/failed #### [` exported `]() property exported → bool Whether the symbol is **exported** #### [` has_version `]() property has\_version → bool Check if this symbols has a [`SymbolVersion`]( "lief.ELF.SymbolVersion") #### [` imported `]() property imported → bool Whether the symbol is **imported** #### [` information `]() property information → int This property specifies the symbol’s type and binding attributes #### [` is_function `]() property is\_function → bool True if the symbol is a function #### [` is_static `]() property is\_static → bool True if the symbol has static visibility #### [` is_variable `]() property is\_variable → bool True if the symbol is a variable #### [` other `]() property other → int Alias for [`visibility`]( "lief.ELF.Symbol.visibility") #### [` section `]() property section → [lief.ELF.Section]( "lief.ELF.Section") | None Return the section ([`Section`]( "lief.ELF.Section")) associated with this symbol if any. Otherwise, return None. #### [` shndx `]() property shndx → int Section index associated with the symbol #### [` size `]() property size → int Many symbols have associated sizes. For example, a data object’s size is the number of bytes contained in the object. This member holds 0 if the symbol has no size or an unknown size. #### [` symbol_version `]() property symbol\_version → [lief.ELF.SymbolVersion]( "lief.ELF.SymbolVersion") | None Return the [`SymbolVersion`]( "lief.ELF.SymbolVersion") associated with this symbol It returns None if no version is tied to this symbol. #### [` type `]() property type → [lief.ELF.Symbol.TYPE]( "lief.ELF.Symbol.TYPE") The symbol’s type provides a general classification for the associated entity. #### [` value `]() property value → int This member has different meaning depending on the symbol’s type and the type of the ELF file (library, object, …) - In relocatable files, this property contains the alignment constraints of the symbol for which the section index is SHN\_COMMON. - In relocatable files, can also contain a section’s offset for a defined symbol. That is, value is an offset from the beginning of the section associated with this symbol. - In executable and libraries, this property contains a virtual address. #### [` visibility `]() property visibility → [lief.ELF.Symbol.VISIBILITY]( "lief.ELF.Symbol.VISIBILITY") Symbol visibility. It’s basically an alias on [`other`]( "lief.ELF.Symbol.other") --- ## [Symbol Version]() ### [` lief.ELF.SymbolVersionlief.ELF.SymbolVersion `]() class lief.ELF.SymbolVersion(*self*) **class lief.ELF.SymbolVersion(*self*, *arg: int*, */*)** Bases: `Object` Overloaded function. 1. `__init__(self) -> None` Default constructor 2. `__init__(self, arg: int, /) -> None` Constructor from `value` #### [` as_global `]() as\_global(*self*) → None Redefine this version as global by dropping its auxiliary version #### [` as_local `]() as\_local(*self*) → None Redefine this version as local by dropping its auxiliary version #### [` drop_version `]() drop\_version(*self*, *value: int*) → None Drop the versioning requirement and replace the value (local/global) #### [` global_ `]() global\_ = <lief.\_lief.ELF.SymbolVersion object> #### [` has_auxiliary_version `]() property has\_auxiliary\_version → bool Check if this symbols has a [`SymbolVersionAux`]( "lief.ELF.SymbolVersionAux") #### [` local `]() local = <lief.\_lief.ELF.SymbolVersion object> #### [` symbol_version_auxiliary `]() property symbol\_version\_auxiliary → [lief.ELF.SymbolVersionAux]( "lief.ELF.SymbolVersionAux") | None Return the [`SymbolVersionAux`]( "lief.ELF.SymbolVersionAux") associated with this version or None if not present. The value can be changed by assigning a [`SymbolVersionAuxRequirement`]( "lief.ELF.SymbolVersionAuxRequirement") which must already exist in the [`SymbolVersionRequirement`]( "lief.ELF.SymbolVersionRequirement"). One can use `add_aux_requirement()` to add a new [`SymbolVersionAuxRequirement`]( "lief.ELF.SymbolVersionAuxRequirement"). #### [` value `]() property value → int Value associated with the symbol. If the given SymbolVersion has no auxiliary version: - 0 : The symbol is local - 1 : The symbol is global All other values are used for versions in the own object or in any of the dependencies. This is the version the symbol is tied to. --- ## [Symbol Version Auxiliary]() ![Inheritance diagram of lief._lief.ELF.SymbolVersionAux, lief._lief.ELF.SymbolVersionAuxRequirement](https://lief.re/doc/latest/_images/inheritance-96220983250d142a31842db3c0ad367f968c549d.png) ### [` lief.ELF.SymbolVersionAux `]() class lief.ELF.SymbolVersionAux Bases: `Object` Class which represents an Auxiliary Symbol version #### [` name `]() property name → str | bytes Symbol’s name (e.g. `GLIBC_2.2.5`) --- ## [Symbol Version Definition]() ### [` lief.ELF.SymbolVersionDefinition `]() class lief.ELF.SymbolVersionDefinition Bases: `Object` Class which represents an entry defined in `DT_VERDEF` or `.gnu.version_d` #### [` auxiliary_symbols `]() property auxiliary\_symbols → lief.ELF.SymbolVersionDefinition.it\_version\_aux #### [` flags `]() property flags → int Version information #### [` hash `]() property hash → int Hash value of the symbol’s name (using ELF hash function) #### [` ndx `]() property ndx → int Numeric value used as an index in the [`SymbolVersion`]( "lief.ELF.SymbolVersion") table #### [` version `]() property version → int Version revision. Should be 1 This field should always have the value `1`. It will be changed if the versioning implementation has to be changed in an incompatible way. --- ## [Symbol Version Requirement]() ### [` lief.ELF.SymbolVersionRequirement `]() class lief.ELF.SymbolVersionRequirement Bases: `Object` Class which represents an entry in the `DT_VERNEED` or `.gnu.version_r` table #### [` add_auxiliary_requirement `]() add\_auxiliary\_requirement(*self*, *arg: [lief.\_lief.ELF.SymbolVersionAuxRequirement]( "lief._lief.ELF.SymbolVersionAuxRequirement")*, */*) → [lief.\_lief.ELF.SymbolVersionAuxRequirement]( "lief._lief.ELF.SymbolVersionAuxRequirement") Add an auxiliary version requirement to the existing entries #### [` find_aux `]() find\_aux(*self*, *name: str*) → [lief.\_lief.ELF.SymbolVersionAuxRequirement]( "lief._lief.ELF.SymbolVersionAuxRequirement") | None Try to find the [`SymbolVersionAuxRequirement`]( "lief.ELF.SymbolVersionAuxRequirement") with the given name (e.g. `GLIBC_2.27`) #### [` get_auxiliary_symbols `]() get\_auxiliary\_symbols(*self*) → lief.\_lief.ELF.SymbolVersionRequirement.it\_aux\_requirement Auxiliary entries (iterator over [`SymbolVersionAuxRequirement`]( "lief.ELF.SymbolVersionAuxRequirement")) #### [` name `]() property name → str Library’s name associated with this requirement (e.g. `libc.so.6`) #### [` remove_aux_requirementremove_aux_requirement `]() remove\_aux\_requirement(*self*, *name: str*) → bool **remove\_aux\_requirement(*self*, *aux: [lief.\_lief.ELF.SymbolVersionAuxRequirement]( "lief._lief.ELF.SymbolVersionAuxRequirement")*) → bool** Overloaded function. 1. `remove_aux_requirement(self, name: str) -> bool` > Try to remove the auxiliary requirement symbol with the given name. The function returns true if the operation succeeds, false otherwise. > > > **Warning** > > > > This function invalidates all the references (pointers) of [`SymbolVersionAuxRequirement`]( "lief.ELF.SymbolVersionAuxRequirement"). Therefore, the user is responsible to ensure that the auxiliary requirement is no longer used in the ELF binary (e.g. in [`SymbolVersion`]( "lief.ELF.SymbolVersion")) 2. `remove_aux_requirement(self, aux: lief._lief.ELF.SymbolVersionAuxRequirement) -> bool` > Try to remove the given auxiliary requirement symbol. The function returns true if the operation succeeds, false otherwise. > > > **Warning** > > > > This function invalidates all the references (pointers) of [`SymbolVersionAuxRequirement`]( "lief.ELF.SymbolVersionAuxRequirement"). Therefore, the user is responsible to ensure that the auxiliary requirement is no longer used in the ELF binary (e.g. in [`SymbolVersion`]( "lief.ELF.SymbolVersion")) #### [` version `]() property version → int Version revision. Should be 1 --- ## [Symbol Version Auxiliary Requirement]() ### [` lief.ELF.SymbolVersionAuxRequirement `]() class lief.ELF.SymbolVersionAuxRequirement(*self*) Bases: [`SymbolVersionAux`]( "lief._lief.ELF.SymbolVersionAux") Default constructor #### [` flags `]() property flags → int Bitmask of flags #### [` hash `]() property hash → int Hash value of the dependency name (use ELF hashing function) #### [` other `]() property other → int It returns the unique version index for the file which is used in the version symbol table. If the highest bit (bit 15) is set this is a hidden symbol which cannot be referenced from outside the object. --- ## [GNU Hash table]() ### [` lief.ELF.GnuHash `]() class lief.ELF.GnuHash(*self*) Bases: `Object` Class which provides a view over the GNU Hash implementation. Most of the fields are read-only since the values are re-computed by the [`lief.ELF.Builder`]( "lief.ELF.Builder"). #### [` bloom_filters `]() property bloom\_filters → list[int] Bloom filters #### [` buckets `]() property buckets → list[int] hash buckets #### [` checkcheck `]() check(*self*, *symbol\_name: str*) → bool **check(*self*, *hash\_value: int*) → bool** Overloaded function. 1. `check(self, symbol_name: str) -> bool` Check if the symbol *probably* exists. If the returned value is `false` you can assume at `100%` that the symbol with the given name doesn’t exist. If `true` you can’t do any assumption 2. `check(self, hash_value: int) -> bool` Check if the symbol associated with the given hash *probably* exists. If the returned value is `false` you can assume at `100%` that the symbol doesn’t exist. If `true` you can’t do any assumption #### [` check_bloom_filter `]() check\_bloom\_filter(*self*, *hash: int*) → bool Check if the given hash passes the bloom filter #### [` check_bucket `]() check\_bucket(*self*, *hash: int*) → bool Check if the given hash passes the bucket filter #### [` hash_values `]() property hash\_values → list[int] Hash values #### [` nb_buckets `]() property nb\_buckets → int Return the number of buckets #### [` shift2 `]() property shift2 → int Shift count used in the bloom filter #### [` symbol_index `]() property symbol\_index → int Index of the first symbol in the dynamic symbols table which is accessible with the hash table --- ## [SYSV Hash table]() ### [` lief.ELF.SysvHash `]() class lief.ELF.SysvHash(*self*) Bases: `Object` Class which represents the SYSV hash for the symbols resolution References: > - [http://www.linker-aliens.org/blogs/ali/entry/gnu\_hash\_elf\_sections/]() > - [https://docs.oracle.com/cd/E23824\_01/html/819-0690/chapter6-48031.html]() #### [` buckets `]() property buckets → list[int] Buckets values #### [` chains `]() property chains → list[int] Chains values #### [` nbucket `]() property nbucket → int Return the number of buckets #### [` nchain `]() property nchain → int Return the number of *chains* (symbol table index) --- ## [Note]() ![Inheritance diagram of lief._lief.ELF.Note, lief._lief.ELF.QNXStack, lief._lief.ELF.AndroidIdent, lief._lief.ELF.CoreFile, lief._lief.ELF.CorePrPsInfo, lief._lief.ELF.CoreSigInfo, lief._lief.ELF.CoreAuxv, lief._lief.ELF.NoteAbi, lief._lief.ELF.NoteGnuProperty, lief._lief.ELF.CorePrStatus](https://lief.re/doc/latest/_images/inheritance-b32bc0253f1e81a0f3b2d44d3f1c83b87c855914.png) ### [` lief.ELF.Note `]() class lief.ELF.Note Bases: `Object` Class which represents an ELF note. #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` LIEF representation of the ELF NT\_ values. ##### [` ANDROID_IDENT `]() ANDROID\_IDENT = 38 ##### [` ANDROID_KUSER `]() ANDROID\_KUSER = 40 ##### [` ANDROID_MEMTAG `]() ANDROID\_MEMTAG = 39 ##### [` CORE_ARM_HW_BREAK `]() CORE\_ARM\_HW\_BREAK = 25 ##### [` CORE_ARM_HW_WATCH `]() CORE\_ARM\_HW\_WATCH = 26 ##### [` CORE_ARM_PACA_KEYS `]() CORE\_ARM\_PACA\_KEYS = 30 ##### [` CORE_ARM_PACG_KEYS `]() CORE\_ARM\_PACG\_KEYS = 31 ##### [` CORE_ARM_PAC_MASK `]() CORE\_ARM\_PAC\_MASK = 29 ##### [` CORE_ARM_SVE `]() CORE\_ARM\_SVE = 28 ##### [` CORE_ARM_SYSTEM_CALL `]() CORE\_ARM\_SYSTEM\_CALL = 27 ##### [` CORE_ARM_TLS `]() CORE\_ARM\_TLS = 24 ##### [` CORE_ARM_VFP `]() CORE\_ARM\_VFP = 23 ##### [` CORE_AUXV `]() CORE\_AUXV = 13 ##### [` CORE_FILE `]() CORE\_FILE = 20 ##### [` CORE_FPREGS `]() CORE\_FPREGS = 15 ##### [` CORE_FPREGSET `]() CORE\_FPREGSET = 10 ##### [` CORE_LWPSINFO `]() CORE\_LWPSINFO = 18 ##### [` CORE_LWPSTATUS `]() CORE\_LWPSTATUS = 17 ##### [` CORE_PAC_ENABLED_KEYS `]() CORE\_PAC\_ENABLED\_KEYS = 33 ##### [` CORE_PRPSINFO `]() CORE\_PRPSINFO = 11 ##### [` CORE_PRSTATUS `]() CORE\_PRSTATUS = 9 ##### [` CORE_PRXFPREG `]() CORE\_PRXFPREG = 21 ##### [` CORE_PSINFO `]() CORE\_PSINFO = 16 ##### [` CORE_PSTATUS `]() CORE\_PSTATUS = 14 ##### [` CORE_SIGINFO `]() CORE\_SIGINFO = 22 ##### [` CORE_TAGGED_ADDR_CTRL `]() CORE\_TAGGED\_ADDR\_CTRL = 32 ##### [` CORE_TASKSTRUCT `]() CORE\_TASKSTRUCT = 12 ##### [` CORE_WIN32PSTATUS `]() CORE\_WIN32PSTATUS = 19 ##### [` CORE_X86_CET `]() CORE\_X86\_CET = 37 ##### [` CORE_X86_IOPERM `]() CORE\_X86\_IOPERM = 35 ##### [` CORE_X86_TLS `]() CORE\_X86\_TLS = 34 ##### [` CORE_X86_XSTATE `]() CORE\_X86\_XSTATE = 36 ##### [` CRASHPAD `]() CRASHPAD = 8 ##### [` GNU_ABI_TAG `]() GNU\_ABI\_TAG = 1 ##### [` GNU_BUILD_ATTRIBUTE_FUNC `]() GNU\_BUILD\_ATTRIBUTE\_FUNC = 7 ##### [` GNU_BUILD_ATTRIBUTE_OPEN `]() GNU\_BUILD\_ATTRIBUTE\_OPEN = 6 ##### [` GNU_BUILD_ID `]() GNU\_BUILD\_ID = 3 ##### [` GNU_GOLD_VERSION `]() GNU\_GOLD\_VERSION = 4 ##### [` GNU_HWCAP `]() GNU\_HWCAP = 2 ##### [` GNU_PROPERTY_TYPE_0 `]() GNU\_PROPERTY\_TYPE\_0 = 5 ##### [` GO_BUILDID `]() GO\_BUILDID = 41 ##### [` QNX_STACK `]() QNX\_STACK = 43 ##### [` STAPSDT `]() STAPSDT = 42 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.Note.TYPE]( "lief.ELF.Note.TYPE") = <nanobind.nb\_func object> #### [` copy `]() copy(*self*) → [lief.\_lief.ELF.Note]( "lief._lief.ELF.Note") | None Duplicate the current instance of this object #### [` create `]() create(*\*args*) → [lief.ELF.Note]( "lief.ELF.Note") | None = <nanobind.nb\_func object> #### [` description `]() property description → memoryview Return the description associated with the note #### [` name `]() property name → str Return the *name* of the note also known as the owner. #### [` original_type `]() property original\_type → int Return the original NT\_ value of the note. This value should be interpreted according the [`name`]( "lief.ELF.Note.name") of the note. #### [` size `]() property size → int Size of the **raw** note #### [` type `]() property type → [lief.ELF.Note.TYPE]( "lief.ELF.Note.TYPE") Return the LIEF type representation of the note. --- ## [Core PrPsInfo]() ![Inheritance diagram of lief._lief.ELF.CorePrPsInfo](https://lief.re/doc/latest/_images/inheritance-99a7b257188512d60a075a08dc134ef1411ceb87.png) ### [` lief.ELF.CorePrPsInfo `]() class lief.ELF.CorePrPsInfo Bases: [`Note`]( "lief._lief.ELF.Note") #### [` info `]() property info → [lief.ELF.CorePrPsInfo.info\_t]( "lief.ELF.CorePrPsInfo.info_t") | None #### [` info_t `]() class info\_t Bases: `object` ##### [` args `]() property args → str ##### [` args_stripped `]() property args\_stripped → str ##### [` filename `]() property filename → str ##### [` filename_stripped `]() property filename\_stripped → str ##### [` flag `]() property flag → int ##### [` gid `]() property gid → int ##### [` nice `]() property nice → int ##### [` pgrp `]() property pgrp → int ##### [` pid `]() property pid → int ##### [` ppid `]() property ppid → int ##### [` sid `]() property sid → int ##### [` sname `]() property sname → str ##### [` state `]() property state → int ##### [` uid `]() property uid → int ##### [` zombie `]() property zombie → bool --- ## [Core PrStatus]() ![Inheritance diagram of lief._lief.ELF.CorePrStatus](https://lief.re/doc/latest/_images/inheritance-c465363f40592632de3933ff0933a27cd3807cd1.png) ### [` lief.ELF.CorePrStatus `]() class lief.ELF.CorePrStatus Bases: [`Note`]( "lief._lief.ELF.Note") #### [` Registers `]() class Registers Bases: `object` ##### [` AARCH64 `]() class AARCH64(*\*values*) Bases: `Enum` Registers for the AARCH64 architecture ([`AARCH64`]( "lief.ELF.ARCH.AARCH64")) ###### [` PC `]() PC = 32 ###### [` PSTATE `]() PSTATE = 33 ###### [` X0 `]() X0 = 0 ###### [` X1 `]() X1 = 1 ###### [` X10 `]() X10 = 10 ###### [` X11 `]() X11 = 11 ###### [` X12 `]() X12 = 12 ###### [` X13 `]() X13 = 13 ###### [` X14 `]() X14 = 14 ###### [` X15 `]() X15 = 15 ###### [` X16 `]() X16 = 16 ###### [` X17 `]() X17 = 17 ###### [` X18 `]() X18 = 18 ###### [` X19 `]() X19 = 19 ###### [` X2 `]() X2 = 2 ###### [` X20 `]() X20 = 20 ###### [` X21 `]() X21 = 21 ###### [` X22 `]() X22 = 22 ###### [` X23 `]() X23 = 23 ###### [` X24 `]() X24 = 24 ###### [` X25 `]() X25 = 25 ###### [` X26 `]() X26 = 26 ###### [` X27 `]() X27 = 27 ###### [` X28 `]() X28 = 28 ###### [` X29 `]() X29 = 29 ###### [` X3 `]() X3 = 3 ###### [` X30 `]() X30 = 30 ###### [` X31 `]() X31 = 31 ###### [` X4 `]() X4 = 4 ###### [` X5 `]() X5 = 5 ###### [` X6 `]() X6 = 6 ###### [` X7 `]() X7 = 7 ###### [` X8 `]() X8 = 8 ###### [` X9 `]() X9 = 9 ###### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.CorePrStatus.Registers.AARCH64]( "lief.ELF.CorePrStatus.Registers.AARCH64") = <nanobind.nb\_func object> ##### [` ARM `]() class ARM(*\*values*) Bases: `Enum` Registers for the ARM architecture ([`ARM`]( "lief.ELF.ARCH.ARM")) ###### [` CPSR `]() CPSR = 16 ###### [` R0 `]() R0 = 0 ###### [` R1 `]() R1 = 1 ###### [` R10 `]() R10 = 10 ###### [` R11 `]() R11 = 11 ###### [` R12 `]() R12 = 12 ###### [` R13 `]() R13 = 13 ###### [` R14 `]() R14 = 14 ###### [` R15 `]() R15 = 15 ###### [` R2 `]() R2 = 2 ###### [` R3 `]() R3 = 3 ###### [` R4 `]() R4 = 4 ###### [` R5 `]() R5 = 5 ###### [` R6 `]() R6 = 6 ###### [` R7 `]() R7 = 7 ###### [` R8 `]() R8 = 8 ###### [` R9 `]() R9 = 9 ###### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.CorePrStatus.Registers.ARM]( "lief.ELF.CorePrStatus.Registers.ARM") = <nanobind.nb\_func object> ##### [` X86 `]() class X86(*\*values*) Bases: `Enum` Registers for the x86 architecture (`i386`) ###### [` CS `]() CS = 13 ###### [` DS `]() DS = 7 ###### [` EAX `]() EAX = 6 ###### [` EBP `]() EBP = 5 ###### [` EBX `]() EBX = 0 ###### [` ECX `]() ECX = 1 ###### [` EDI `]() EDI = 4 ###### [` EDX `]() EDX = 2 ###### [` EFLAGS `]() EFLAGS = 14 ###### [` EIP `]() EIP = 12 ###### [` ES `]() ES = 8 ###### [` ESI `]() ESI = 3 ###### [` ESP `]() ESP = 15 ###### [` FS `]() FS = 9 ###### [` GS `]() GS = 10 ###### [` ORIG_EAX `]() ORIG\_EAX = 11 ###### [` SS `]() SS = 16 ###### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.CorePrStatus.Registers.X86]( "lief.ELF.CorePrStatus.Registers.X86") = <nanobind.nb\_func object> ##### [` X86_64 `]() class X86\_64(*\*values*) Bases: `Enum` Registers for the x86-64 architecture (`x86_64`) ###### [` CS `]() CS = 17 ###### [` DS `]() DS = 23 ###### [` EFLAGS `]() EFLAGS = 18 ###### [` ES `]() ES = 24 ###### [` FS_BASE `]() FS\_BASE = 21 ###### [` GS_BASE `]() GS\_BASE = 22 ###### [` ORIG_RAX `]() ORIG\_RAX = 15 ###### [` R10 `]() R10 = 7 ###### [` R11 `]() R11 = 6 ###### [` R12 `]() R12 = 3 ###### [` R13 `]() R13 = 2 ###### [` R14 `]() R14 = 1 ###### [` R15 `]() R15 = 0 ###### [` R8 `]() R8 = 9 ###### [` R9 `]() R9 = 8 ###### [` RAX `]() RAX = 10 ###### [` RBP `]() RBP = 4 ###### [` RBX `]() RBX = 5 ###### [` RCX `]() RCX = 11 ###### [` RDI `]() RDI = 14 ###### [` RDX `]() RDX = 12 ###### [` RIP `]() RIP = 16 ###### [` RSI `]() RSI = 13 ###### [` RSP `]() RSP = 19 ###### [` SS `]() SS = 20 ###### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.CorePrStatus.Registers.X86\_64]( "lief.ELF.CorePrStatus.Registers.X86_64") = <nanobind.nb\_func object> #### [` architecture `]() property architecture → [lief.ELF.ARCH]( "lief.ELF.ARCH") Original target architecture. #### [` getgetgetget `]() get(*self*, *reg: [lief.\_lief.ELF.CorePrStatus.Registers.X86]( "lief._lief.ELF.CorePrStatus.Registers.X86")*) → int | None **get(*self*, *reg: [lief.\_lief.ELF.CorePrStatus.Registers.X86\_64]( "lief._lief.ELF.CorePrStatus.Registers.X86_64")*) → int | None **get(*self*, *reg: [lief.\_lief.ELF.CorePrStatus.Registers.ARM]( "lief._lief.ELF.CorePrStatus.Registers.ARM")*) → int | None **get(*self*, *reg: [lief.\_lief.ELF.CorePrStatus.Registers.AARCH64]( "lief._lief.ELF.CorePrStatus.Registers.AARCH64")*) → int | None****** Get the register value or non if it is not present #### [` pc `]() property pc → int | None Return the program counter value (rip, pc, eip etc) #### [` pr_status_t `]() class pr\_status\_t Bases: `object` ##### [` cstime `]() property cstime → [lief.ELF.CorePrStatus.timeval\_t]( "lief.ELF.CorePrStatus.timeval_t") ##### [` cursig `]() property cursig → int ##### [` cutime `]() property cutime → [lief.ELF.CorePrStatus.timeval\_t]( "lief.ELF.CorePrStatus.timeval_t") ##### [` info `]() property info → [lief.ELF.CorePrStatus.siginfo\_t]( "lief.ELF.CorePrStatus.siginfo_t") ##### [` pgrp `]() property pgrp → int ##### [` pid `]() property pid → int ##### [` ppid `]() property ppid → int ##### [` reserved `]() property reserved → int ##### [` sid `]() property sid → int ##### [` sighold `]() property sighold → int ##### [` sigpend `]() property sigpend → int ##### [` stime `]() property stime → [lief.ELF.CorePrStatus.timeval\_t]( "lief.ELF.CorePrStatus.timeval_t") ##### [` utime `]() property utime → [lief.ELF.CorePrStatus.timeval\_t]( "lief.ELF.CorePrStatus.timeval_t") #### [` register_values `]() property register\_values → list[int] List of the register values. This list is **guaranteed** to be as long as the number of registers defined in the [`Registers`]( "lief.ELF.CorePrStatus.Registers") or empty if it can’t be resolved. Thus, one can access a specific register through: ```python reg_vals: list[int] = note.register_values() x20 = reg_vals[CorePrStatus.Registers.AARCH64.X20.value] ``` #### [` return_value `]() property return\_value → int | None The value of the register that holds the return value according to the calling convention. #### [` setsetsetset `]() set(*self*, *reg: [lief.\_lief.ELF.CorePrStatus.Registers.X86]( "lief._lief.ELF.CorePrStatus.Registers.X86")*, *value: int*) → [lief.\_lief.ok\_error\_t]( "lief._lief.ok_error_t") **set(*self*, *reg: [lief.\_lief.ELF.CorePrStatus.Registers.X86\_64]( "lief._lief.ELF.CorePrStatus.Registers.X86_64")*, *value: int*) → [lief.\_lief.ok\_error\_t]( "lief._lief.ok_error_t") **set(*self*, *reg: [lief.\_lief.ELF.CorePrStatus.Registers.ARM]( "lief._lief.ELF.CorePrStatus.Registers.ARM")*, *value: int*) → [lief.\_lief.ok\_error\_t]( "lief._lief.ok_error_t") **set(*self*, *reg: [lief.\_lief.ELF.CorePrStatus.Registers.AARCH64]( "lief._lief.ELF.CorePrStatus.Registers.AARCH64")*, *value: int*) → [lief.\_lief.ok\_error\_t]( "lief._lief.ok_error_t")****** Change the register value #### [` siginfo_t `]() class siginfo\_t Bases: `object` ##### [` errno `]() property errno → int ##### [` sicode `]() property sicode → int ##### [` signo `]() property signo → int #### [` sp `]() property sp → int | None Return the stack pointer value #### [` status `]() property status → [lief.ELF.CorePrStatus.pr\_status\_t]( "lief.ELF.CorePrStatus.pr_status_t") Status information from a core dump This structure mirrors the kernel’s `prstatus` data embedded in `NT_PRSTATUS` core-dump notes and exposes signal state, process identifiers, and CPU-time accounting. #### [` timeval_t `]() class timeval\_t Bases: `object` ##### [` sec `]() property sec → int ##### [` usec `]() property usec → int --- ## [Core File]() ![Inheritance diagram of lief._lief.ELF.CoreFile](https://lief.re/doc/latest/_images/inheritance-91254947d10646a724ec8f290a70220fc6216fbe.png) ### [` lief.ELF.CoreFile `]() class lief.ELF.CoreFile Bases: [`Note`]( "lief._lief.ELF.Note") #### [` entry_t `]() class entry\_t Bases: `object` ##### [` end `]() property end → int End address of mapped file ##### [` file_ofs `]() property file\_ofs → int Offset (in core) of mapped file ##### [` path `]() property path → str Path of mapped file ##### [` start `]() property start → int Start address of mapped file #### [` files `]() property files → [lief.ELF.CoreFile.files\_t]( "lief.ELF.CoreFile.files_t") List of files mapped in core. (list of `CoreFileEntry`) #### [` files_tfiles_tfiles_t `]() class files\_t(*self*) **class files\_t(*self*, *arg: [lief.\_lief.ELF.CoreFile.files\_t]( "lief._lief.ELF.CoreFile.files_t")*, */*) **class files\_t(*self*, *arg: collections.abc.Iterable[[lief.\_lief.ELF.CoreFile.entry\_t]( "lief._lief.ELF.CoreFile.entry_t")]*, */*)**** Bases: `object` Overloaded function. 1. `__init__(self) -> None` Default constructor 2. `__init__(self, arg: lief._lief.ELF.CoreFile.files_t, /) -> None` Copy constructor 3. `__init__(self, arg: collections.abc.Iterable[lief._lief.ELF.CoreFile.entry_t], /) -> None` Construct from an iterable object ##### [` append `]() append(*self*, *arg: [lief.\_lief.ELF.CoreFile.entry\_t]( "lief._lief.ELF.CoreFile.entry_t")*, */*) → None Append `arg` to the end of the list. ##### [` clear `]() clear(*self*) → None Remove all items from list. ##### [` extend `]() extend(*self*, *arg: [lief.\_lief.ELF.CoreFile.files\_t]( "lief._lief.ELF.CoreFile.files_t")*, */*) → None Extend `self` by appending elements from `arg`. ##### [` insert `]() insert(*self*, *arg0: int*, *arg1: [lief.\_lief.ELF.CoreFile.entry\_t]( "lief._lief.ELF.CoreFile.entry_t")*, */*) → None Insert object `arg1` before index `arg0`. ##### [` pop `]() pop(*self*, *index: int = -1*) → [lief.\_lief.ELF.CoreFile.entry\_t]( "lief._lief.ELF.CoreFile.entry_t") Remove and return item at `index` (default last). --- ## [Core Siginfo]() ![Inheritance diagram of lief._lief.ELF.CoreSigInfo](https://lief.re/doc/latest/_images/inheritance-990ce32c9bb08f734383f8b0501424fa23a2599f.png) ### [` lief.ELF.CoreSigInfo `]() class lief.ELF.CoreSigInfo Bases: [`Note`]( "lief._lief.ELF.Note") #### [` sigcode `]() property sigcode → int | None Signal code #### [` sigerrno `]() property sigerrno → int | None If non-zero, an errno value associated with this signal #### [` signo `]() property signo → int | None Signal number --- ## [Core Auxiliary Vector]() ![Inheritance diagram of lief._lief.ELF.CoreAuxv](https://lief.re/doc/latest/_images/inheritance-30fa7f18ac6e7a56ba42fd63d4f557891ea800e0.png) ### [` lief.ELF.CoreAuxv `]() class lief.ELF.CoreAuxv Bases: [`Note`]( "lief._lief.ELF.Note") #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` ##### [` BASE `]() BASE = 7 ##### [` BASE_PLATFORM `]() BASE\_PLATFORM = 24 ##### [` CLKTCK `]() CLKTCK = 17 ##### [` DCACHEBSIZE `]() DCACHEBSIZE = 19 ##### [` EGID `]() EGID = 14 ##### [` END `]() END = 0 ##### [` ENTRY `]() ENTRY = 9 ##### [` EUID `]() EUID = 12 ##### [` EXECFD `]() EXECFD = 2 ##### [` EXECFN `]() EXECFN = 31 ##### [` FLAGS `]() FLAGS = 8 ##### [` FPUCW `]() FPUCW = 18 ##### [` GID `]() GID = 13 ##### [` HWCAP `]() HWCAP = 16 ##### [` HWCAP2 `]() HWCAP2 = 26 ##### [` ICACHEBSIZE `]() ICACHEBSIZE = 20 ##### [` IGNOREPPC `]() IGNOREPPC = 22 ##### [` IGNORE_TY `]() IGNORE\_TY = 1 ##### [` NOTELF `]() NOTELF = 10 ##### [` PAGESZ `]() PAGESZ = 6 ##### [` PHDR `]() PHDR = 3 ##### [` PHENT `]() PHENT = 4 ##### [` PHNUM `]() PHNUM = 5 ##### [` RANDOM `]() RANDOM = 25 ##### [` SECURE `]() SECURE = 23 ##### [` SYSINFO `]() SYSINFO = 32 ##### [` SYSINFO_EHDR `]() SYSINFO\_EHDR = 33 ##### [` TGT_PLATFORM `]() TGT\_PLATFORM = 15 ##### [` UCACHEBSIZE `]() UCACHEBSIZE = 21 ##### [` UID `]() UID = 11 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.CoreAuxv.TYPE]( "lief.ELF.CoreAuxv.TYPE") = <nanobind.nb\_func object> #### [` get `]() get(*self*, *type: [lief.\_lief.ELF.CoreAuxv.TYPE]( "lief._lief.ELF.CoreAuxv.TYPE")*) → int | None Get the auxv value from the provided type. Return None if it is not present. #### [` setset `]() set(*self*, *type: [lief.\_lief.ELF.CoreAuxv.TYPE]( "lief._lief.ELF.CoreAuxv.TYPE")*, *value: int*) → bool **set(*self*, *arg: collections.abc.Mapping[[lief.\_lief.ELF.CoreAuxv.TYPE]( "lief._lief.ELF.CoreAuxv.TYPE"), int]*, */*) → bool** Overloaded function. 1. `set(self, type: lief._lief.ELF.CoreAuxv.TYPE, value: int) -> bool` > Change the value for the given type. 2. `set(self, arg: collections.abc.Mapping[lief._lief.ELF.CoreAuxv.TYPE, int], /) -> bool` > Replace **all** the values by the given dictionary. #### [` values `]() property values → dict[[lief.ELF.CoreAuxv.TYPE]( "lief.ELF.CoreAuxv.TYPE"), int] Return the auxiliary vector as a dictionary of [`TYPE`]( "lief.ELF.CoreAuxv.TYPE") / int --- ## [Android Ident]() ![Inheritance diagram of lief._lief.ELF.AndroidIdent](https://lief.re/doc/latest/_images/inheritance-1c6b7873a95a617ca09efa7f71d24e98e39cd9cd.png) ### [` lief.ELF.AndroidIdent `]() class lief.ELF.AndroidIdent Bases: [`Note`]( "lief._lief.ELF.Note") #### [` ndk_build_number `]() property ndk\_build\_number → str Android NDK build number #### [` ndk_version `]() property ndk\_version → str Android NDK version used to build the current binary #### [` sdk_version `]() property sdk\_version → int Target SDK platform --- ## [QNX Stack]() ![Inheritance diagram of lief._lief.ELF.QNXStack](https://lief.re/doc/latest/_images/inheritance-cf49135148eebaffd6763b45d5ff7f3a3ed7c737.png) ### [` lief.ELF.QNXStack `]() class lief.ELF.QNXStack Bases: [`Note`]( "lief._lief.ELF.Note") #### [` is_executable `]() property is\_executable → bool Whether the stack is executable #### [` stack_allocated `]() property stack\_allocated → int Size of the stack pre-allocated (upfront) #### [` stack_size `]() property stack\_size → int Size of the stack --- ## [Note ABI]() ![Inheritance diagram of lief._lief.ELF.NoteAbi](https://lief.re/doc/latest/_images/inheritance-4a88dcff8d1b450371553cc79b6a36810fd79c50.png) ### [` lief.ELF.NoteAbi `]() class lief.ELF.NoteAbi Bases: [`Note`]( "lief._lief.ELF.Note") Class that wraps the NT\_GNU\_ABI\_TAG note #### [` ABI `]() class ABI(*\*values*) Bases: `Enum` ABI recognized by this note ##### [` FREEBSD `]() FREEBSD = 3 ##### [` GNU `]() GNU = 1 ##### [` LINUX `]() LINUX = 0 ##### [` NACL `]() NACL = 6 ##### [` NETBSD `]() NETBSD = 4 ##### [` SOLARIS2 `]() SOLARIS2 = 2 ##### [` SYLLABLE `]() SYLLABLE = 5 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.NoteAbi.ABI]( "lief.ELF.NoteAbi.ABI") = <nanobind.nb\_func object> #### [` abi `]() property abi → [lief.ELF.NoteAbi.ABI]( "lief.ELF.NoteAbi.ABI") | None Return the target [`ABI`]( "lief.ELF.NoteAbi.ABI") #### [` version `]() property version → list[int] | None Return the target version as `(Major, Minor, Patch)` --- ## [Note Gnu Property]() ![Inheritance diagram of lief._lief.ELF.NoteGnuProperty](https://lief.re/doc/latest/_images/inheritance-139dd895fd72aa278c07185ebc39d005fca759c4.png) ![Inheritance diagram of lief._lief.ELF.NoteNoCopyOnProtected, lief._lief.ELF.X86ISA, lief._lief.ELF.AArch64Feature, lief._lief.ELF.StackSize, lief._lief.ELF.Needed, lief._lief.ELF.Generic, lief._lief.ELF.X86Features, lief._lief.ELF.AArch64PAuth](https://lief.re/doc/latest/_images/inheritance-a2014024f1ead3a694f42d574cf91cb0b35b2ceb.png) ### [` lief.ELF.NoteGnuProperty `]() class lief.ELF.NoteGnuProperty Bases: [`Note`]( "lief._lief.ELF.Note") This object represents the NT\_GNU\_PROPERTY\_TYPE\_0 note. #### [` Property `]() class Property Bases: `object` This class wraps the different properties that can be used in a NT\_GNU\_PROPERTY\_TYPE\_0 note ##### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` LIEF’s mirror types of the original GNU\_PROPERTY\_ values ###### [` AARCH64_FEATURES `]() AARCH64\_FEATURES = 2 ###### [` AARCH64_PAUTH `]() AARCH64\_PAUTH = 3 ###### [` GENERIC `]() GENERIC = 1 ###### [` NEEDED `]() NEEDED = 8 ###### [` NO_COPY_ON_PROTECTED `]() NO\_COPY\_ON\_PROTECTED = 5 ###### [` STACK_SIZE `]() STACK\_SIZE = 4 ###### [` UNKNOWN `]() UNKNOWN = 0 ###### [` X86_FEATURE `]() X86\_FEATURE = 7 ###### [` X86_ISA `]() X86\_ISA = 6 ###### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.NoteGnuProperty.Property.TYPE]( "lief.ELF.NoteGnuProperty.Property.TYPE") = <nanobind.nb\_func object> ##### [` type `]() property type → [lief.ELF.NoteGnuProperty.Property.TYPE]( "lief.ELF.NoteGnuProperty.Property.TYPE") #### [` find `]() find(*self*, *arg: [lief.\_lief.ELF.NoteGnuProperty.Property.TYPE]( "lief._lief.ELF.NoteGnuProperty.Property.TYPE")*, */*) → [lief.\_lief.ELF.NoteGnuProperty.Property]( "lief._lief.ELF.NoteGnuProperty.Property") | None Find the property with the given type or return None #### [` properties `]() property properties → list[[lief.ELF.NoteGnuProperty.Property]( "lief.ELF.NoteGnuProperty.Property") | None] Return the properties as a list of Property --- ## [Generic]() ![Inheritance diagram of lief._lief.ELF.Generic](https://lief.re/doc/latest/_images/inheritance-7ce1c240e8cc05bebd4f47c40020aa47f3b8aed0.png) ### [` lief.ELF.Generic `]() class lief.ELF.Generic Bases: [`Property`]( "lief._lief.ELF.NoteGnuProperty.Property") This class represents a property which doesn’t have a concrete LIEF implementation. #### [` raw_type `]() property raw\_type → int The original raw type as an integer. This value might depend on the architecture and/or the file type. --- ## [AArch64 Feature]() ![Inheritance diagram of lief._lief.ELF.AArch64Feature](https://lief.re/doc/latest/_images/inheritance-86edb50aebb41ea6293e15debc675ba458a2d2bb.png) ### [` lief.ELF.AArch64Feature `]() class lief.ELF.AArch64Feature Bases: [`Property`]( "lief._lief.ELF.NoteGnuProperty.Property") This class represents the `GNU_PROPERTY_AARCH64_FEATURE_1_AND` note. #### [` FEATURE `]() class FEATURE(*\*values*) Bases: `Enum` ##### [` BTI `]() BTI = 1 ##### [` GCS `]() GCS = 3 ##### [` PAC `]() PAC = 2 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.AArch64Feature.FEATURE]( "lief.ELF.AArch64Feature.FEATURE") = <nanobind.nb\_func object> #### [` features `]() property features → list[[lief.ELF.AArch64Feature.FEATURE]( "lief.ELF.AArch64Feature.FEATURE")] Return the list of the supported features. --- ## [AArch64 PAuth]() ![Inheritance diagram of lief._lief.ELF.AArch64PAuth](https://lief.re/doc/latest/_images/inheritance-2996f24a94abf7d7c40a6ae8c0ae4c484d35c693.png) ### [` lief.ELF.AArch64PAuth `]() class lief.ELF.AArch64PAuth Bases: [`Property`]( "lief._lief.ELF.NoteGnuProperty.Property") This class represents the `GNU_PROPERTY_AARCH64_FEATURE_PAUTH` note. > **Note** > > If both: [`AArch64PAuth.platform`]( "lief.ELF.AArch64PAuth.platform") and [`AArch64PAuth.version`]( "lief.ELF.AArch64PAuth.version") are set to 0, this means that the binary is incompatible with PAuth ABI extension. #### [` platform `]() property platform → int 64-bit value that specifies the platform vendor. A `0` value is associated with an *invalid* platform while the value `1` is associated with a baremetal platform. #### [` version `]() property version → int 64-bit value that identifies the signing schema used by the ELF file. --- ## [Needed]() ![Inheritance diagram of lief._lief.ELF.Needed](https://lief.re/doc/latest/_images/inheritance-b12946921fde9a32bdf792e7b80f07a92f2af86a.png) ### [` lief.ELF.Needed `]() class lief.ELF.Needed Bases: [`Property`]( "lief._lief.ELF.NoteGnuProperty.Property") This class represents the `GNU_PROPERTY_1_NEEDED` note property which provides information about additional features the object file needs at runtime. #### [` NEED `]() class NEED(*\*values*) Bases: `Enum` ##### [` INDIRECT_EXTERN_ACCESS `]() INDIRECT\_EXTERN\_ACCESS = 1 ##### [` NEED `]() NEED = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.Needed.NEED]( "lief.ELF.Needed.NEED") = <nanobind.nb\_func object> #### [` needs `]() property needs → list[[lief.ELF.Needed.NEED]( "lief.ELF.Needed.NEED")] Return the list of the needed features. --- ## [No Copy on Protected]() ![Inheritance diagram of lief._lief.ELF.NoteNoCopyOnProtected](https://lief.re/doc/latest/_images/inheritance-8c54ce878d82ef046faba6a15aca1da42d4da6eb.png) ### [` lief.ELF.NoteNoCopyOnProtected `]() class lief.ELF.NoteNoCopyOnProtected Bases: [`Property`]( "lief._lief.ELF.NoteGnuProperty.Property") This class provides an interface over the `GNU_PROPERTY_NO_COPY_ON_PROTECTED` property. This property indicates that the linker shouldn’t copy relocations against protected symbols. --- ## [Stack Size]() ![Inheritance diagram of lief._lief.ELF.StackSize](https://lief.re/doc/latest/_images/inheritance-3b48490567df24ad744b2f66ded30d0f6fe03edb.png) ### [` lief.ELF.StackSize `]() class lief.ELF.StackSize Bases: [`Property`]( "lief._lief.ELF.NoteGnuProperty.Property") This class provides an interface over the `GNU_PROPERTY_STACK_SIZE` property This property can be used by the loader to raise the stack limit. #### [` stack_size `]() property stack\_size → int --- ## [X86 Feature]() ![Inheritance diagram of lief._lief.ELF.X86Features](https://lief.re/doc/latest/_images/inheritance-92f5f2cbd8694eb209cab9f7973cd744cc4cfb2f.png) ### [` lief.ELF.X86Features `]() class lief.ELF.X86Features Bases: [`Property`]( "lief._lief.ELF.NoteGnuProperty.Property") This class interfaces the different `GNU_PROPERTY_X86_FEATURE_*` properties which includes: - `GNU_PROPERTY_X86_FEATURE_1_AND` - `GNU_PROPERTY_X86_FEATURE_2_USED` - `GNU_PROPERTY_X86_FEATURE_2_NEEDED` #### [` FEATURE `]() class FEATURE(*\*values*) Bases: `Enum` Features provided by these different properties ##### [` FXSR `]() FXSR = 11 ##### [` IBT `]() IBT = 1 ##### [` LAM_U48 `]() LAM\_U48 = 3 ##### [` LAM_U57 `]() LAM\_U57 = 4 ##### [` MASK `]() MASK = 16 ##### [` MMX `]() MMX = 7 ##### [` SHSTK `]() SHSTK = 2 ##### [` TMM `]() TMM = 15 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` X86 `]() X86 = 5 ##### [` X87 `]() X87 = 6 ##### [` XMM `]() XMM = 8 ##### [` XSAVE `]() XSAVE = 12 ##### [` XSAVEC `]() XSAVEC = 14 ##### [` XSAVEOPT `]() XSAVEOPT = 13 ##### [` YMM `]() YMM = 9 ##### [` ZMM `]() ZMM = 10 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.X86Features.FEATURE]( "lief.ELF.X86Features.FEATURE") = <nanobind.nb\_func object> #### [` FLAG `]() class FLAG(*\*values*) Bases: `Enum` Flag according to the `_AND`, `_USED` or `_NEEDED` suffixes ##### [` NEEDED `]() NEEDED = 2 ##### [` NONE `]() NONE = 0 ##### [` USED `]() USED = 1 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.X86Features.FLAG]( "lief.ELF.X86Features.FLAG") = <nanobind.nb\_func object> #### [` features `]() property features → list[tuple[[lief.ELF.X86Features.FLAG]( "lief.ELF.X86Features.FLAG"), [lief.ELF.X86Features.FEATURE]( "lief.ELF.X86Features.FEATURE")]] List of the features as a pair of ([`FLAG`]( "lief.ELF.X86Features.FLAG"), [`FEATURE`]( "lief.ELF.X86Features.FEATURE")). --- ## [X86 ISA]() ![Inheritance diagram of lief._lief.ELF.X86ISA](https://lief.re/doc/latest/_images/inheritance-a59888900c7c2953dfad9d578813f250a8cd4834.png) ### [` lief.ELF.X86ISA `]() class lief.ELF.X86ISA Bases: [`Property`]( "lief._lief.ELF.NoteGnuProperty.Property") This class interfaces the different `GNU_PROPERTY_X86_ISA_*` properties which includes: - `GNU_PROPERTY_X86_ISA_1_USED` - `GNU_PROPERTY_X86_ISA_1_NEEDED` - `GNU_PROPERTY_X86_COMPAT_ISA_1_USED` - `GNU_PROPERTY_X86_COMPAT_ISA_1_NEEDED` - `GNU_PROPERTY_X86_COMPAT_2_ISA_1_USED` - `GNU_PROPERTY_X86_COMPAT_2_ISA_1_NEEDED` #### [` FLAG `]() class FLAG(*\*values*) Bases: `Enum` ##### [` NEEDED `]() NEEDED = 2 ##### [` NONE `]() NONE = 0 ##### [` USED `]() USED = 1 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.X86ISA.FLAG]( "lief.ELF.X86ISA.FLAG") = <nanobind.nb\_func object> #### [` ISA `]() class ISA(*\*values*) Bases: `Enum` ##### [` AVX `]() AVX = 16 ##### [` AVX2 `]() AVX2 = 17 ##### [` AVX512BW `]() AVX512BW = 24 ##### [` AVX512CD `]() AVX512CD = 19 ##### [` AVX512DQ `]() AVX512DQ = 23 ##### [` AVX512ER `]() AVX512ER = 20 ##### [` AVX512F `]() AVX512F = 18 ##### [` AVX512PF `]() AVX512PF = 21 ##### [` AVX512VL `]() AVX512VL = 22 ##### [` AVX512_4FMAPS `]() AVX512\_4FMAPS = 25 ##### [` AVX512_4VNNIW `]() AVX512\_4VNNIW = 26 ##### [` AVX512_BF16 `]() AVX512\_BF16 = 32 ##### [` AVX512_BITALG `]() AVX512\_BITALG = 27 ##### [` AVX512_IFMA `]() AVX512\_IFMA = 28 ##### [` AVX512_VBMI `]() AVX512\_VBMI = 29 ##### [` AVX512_VBMI2 `]() AVX512\_VBMI2 = 30 ##### [` AVX512_VNNI `]() AVX512\_VNNI = 31 ##### [` BASELINE `]() BASELINE = 1 ##### [` CMOV `]() CMOV = 5 ##### [` FMA `]() FMA = 6 ##### [` I486 `]() I486 = 7 ##### [` I586 `]() I586 = 8 ##### [` I686 `]() I686 = 9 ##### [` SSE `]() SSE = 10 ##### [` SSE2 `]() SSE2 = 11 ##### [` SSE3 `]() SSE3 = 12 ##### [` SSE4_1 `]() SSE4\_1 = 14 ##### [` SSE4_2 `]() SSE4\_2 = 15 ##### [` SSSE3 `]() SSSE3 = 13 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` V2 `]() V2 = 2 ##### [` V3 `]() V3 = 3 ##### [` V4 `]() V4 = 4 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.X86ISA.ISA]( "lief.ELF.X86ISA.ISA") = <nanobind.nb\_func object> #### [` values `]() property values → list[tuple[[lief.ELF.X86ISA.FLAG]( "lief.ELF.X86ISA.FLAG"), [lief.ELF.X86ISA.ISA]( "lief.ELF.X86ISA.ISA")]] List of the ISA values in this property --- ## [Builder]() ### [` lief.ELF.Builderlief.ELF.Builder `]() class lief.ELF.Builder(*self*, *elf: [lief.\_lief.ELF.Binary]( "lief._lief.ELF.Binary")*) **class lief.ELF.Builder(*self*, *elf: [lief.\_lief.ELF.Binary]( "lief._lief.ELF.Binary")*, *config: [lief.\_lief.ELF.Builder.config\_t]( "lief._lief.ELF.Builder.config_t")*)** Bases: `object` Class which takes an [`lief.ELF.Binary`]( "lief.ELF.Binary") object and reconstructs a valid binary #### [` build `]() build(*self*) → None Perform the build of the provided ELF binary #### [` config `]() property config → [lief.ELF.Builder.config\_t]( "lief.ELF.Builder.config_t") Configuration of the builder #### [` config_t `]() class config\_t(*self*) Bases: `object` Interface to tweak the [`Builder`]( "lief.ELF.Builder") ##### [` android_rela `]() property android\_rela → bool Rebuild [`ANDROID_RELA`]( "lief.ELF.DynamicEntry.TAG.ANDROID_RELA") ##### [` coredump_notes `]() property coredump\_notes → bool Rebuild the Coredump notes ##### [` dt_hash `]() property dt\_hash → bool Rebuild [`HASH`]( "lief.ELF.DynamicEntry.TAG.HASH") ##### [` dyn_str `]() property dyn\_str → bool Rebuild [`STRTAB`]( "lief.ELF.DynamicEntry.TAG.STRTAB") ##### [` dynamic_section `]() property dynamic\_section → bool Rebuild the PT\_DYNAMIC segment ##### [` fini_array `]() property fini\_array → bool Rebuild [`FINI_ARRAY`]( "lief.ELF.DynamicEntry.TAG.FINI_ARRAY") ##### [` force_relocate `]() property force\_relocate → bool Force to relocate all the ELF structures that can be relocated (mostly for testing) ##### [` init_array `]() property init\_array → bool Rebuild [`INIT_ARRAY`]( "lief.ELF.DynamicEntry.TAG.INIT_ARRAY") ##### [` interpreter `]() property interpreter → bool Rebuild the PT\_INTERP segment ##### [` jmprel `]() property jmprel → bool Rebuild [`JMPREL`]( "lief.ELF.DynamicEntry.TAG.JMPREL") ##### [` keep_empty_version_requirement `]() property keep\_empty\_version\_requirement → bool Remove entries in `.gnu.version_r` if they are not associated with at least one version ##### [` notes `]() property notes → bool Rebuild PT\_NOTES segment(s) ##### [` preinit_array `]() property preinit\_array → bool Rebuild [`PREINIT_ARRAY`]( "lief.ELF.DynamicEntry.TAG.PREINIT_ARRAY") ##### [` rela `]() property rela → bool Rebuild [`RELA`]( "lief.ELF.DynamicEntry.TAG.RELA") ##### [` relr `]() property relr → bool Rebuild [`RELR`]( "lief.ELF.DynamicEntry.TAG.RELR") ##### [` skip_dynamic `]() property skip\_dynamic → bool Skip relocating the PT\_DYNAMIC segment (only relevant if [`force_relocate`]( "lief.ELF.Builder.config_t.force_relocate") is set) ##### [` static_symtab `]() property static\_symtab → bool Rebuild .symtab section ##### [` sym_verdef `]() property sym\_verdef → bool Rebuild [`VERDEF`]( "lief.ELF.DynamicEntry.TAG.VERDEF") ##### [` sym_verneed `]() property sym\_verneed → bool Rebuild [`VERNEED`]( "lief.ELF.DynamicEntry.TAG.VERNEED") ##### [` sym_versym `]() property sym\_versym → bool Rebuild [`VERSYM`]( "lief.ELF.DynamicEntry.TAG.VERSYM") ##### [` symtab `]() property symtab → bool Rebuild [`SYMTAB`]( "lief.ELF.DynamicEntry.TAG.SYMTAB") #### [` get_build `]() get\_build(*self*) → list[int] Return the build result as a `list` of bytes #### [` write `]() write(*self*, *output: str*) → None Write the build result into the `output` file ## [Enums]() ### [Architectures]() #### [` lief.ELF.ARCH `]() class lief.ELF.ARCH(*\*values*) Bases: `Enum` ##### [` AARCH64 `]() AARCH64 = 183 ##### [` ALPHA `]() ALPHA = 41 ##### [` ALPHA_ALT `]() ALPHA\_ALT = 36902 ##### [` ALTERA_NIOS2 `]() ALTERA\_NIOS2 = 113 ##### [` AMDGPU `]() AMDGPU = 224 ##### [` ARC `]() ARC = 45 ##### [` ARCA `]() ARCA = 109 ##### [` ARC_COMPACT `]() ARC\_COMPACT = 93 ##### [` ARC_COMPACT2 `]() ARC\_COMPACT2 = 195 ##### [` ARM `]() ARM = 40 ##### [` AVR `]() AVR = 83 ##### [` AVR32 `]() AVR32 = 185 ##### [` BA1 `]() BA1 = 201 ##### [` BA2 `]() BA2 = 202 ##### [` BLACKFIN `]() BLACKFIN = 106 ##### [` BPF `]() BPF = 247 ##### [` C166 `]() C166 = 116 ##### [` CDP `]() CDP = 215 ##### [` CE `]() CE = 119 ##### [` CLOUDSHIELD `]() CLOUDSHIELD = 192 ##### [` COGE `]() COGE = 216 ##### [` COLDFIRE `]() COLDFIRE = 52 ##### [` COOL `]() COOL = 217 ##### [` COREA_1ST `]() COREA\_1ST = 193 ##### [` COREA_2ND `]() COREA\_2ND = 194 ##### [` CR `]() CR = 103 ##### [` CR16 `]() CR16 = 177 ##### [` CRAYNV2 `]() CRAYNV2 = 172 ##### [` CRIS `]() CRIS = 76 ##### [` CRX `]() CRX = 114 ##### [` CSKY `]() CSKY = 252 ##### [` CSR_KALIMBA `]() CSR\_KALIMBA = 219 ##### [` CUDA `]() CUDA = 190 ##### [` CYPRESS_M8C `]() CYPRESS\_M8C = 161 ##### [` D10V `]() D10V = 85 ##### [` D30V `]() D30V = 86 ##### [` DSP24 `]() DSP24 = 136 ##### [` DSPIC30F `]() DSPIC30F = 118 ##### [` DXP `]() DXP = 112 ##### [` ECOG16 `]() ECOG16 = 176 ##### [` ECOG1X `]() ECOG1X = 168 ##### [` ECOG2 `]() ECOG2 = 134 ##### [` ETPU `]() ETPU = 178 ##### [` EXCESS `]() EXCESS = 111 ##### [` F2MC16 `]() F2MC16 = 104 ##### [` FIREPATH `]() FIREPATH = 78 ##### [` FR20 `]() FR20 = 37 ##### [` FR30 `]() FR30 = 84 ##### [` FX66 `]() FX66 = 66 ##### [` H8S `]() H8S = 48 ##### [` H8_300 `]() H8\_300 = 46 ##### [` H8_300H `]() H8\_300H = 47 ##### [` H8_500 `]() H8\_500 = 49 ##### [` HEXAGON `]() HEXAGON = 164 ##### [` HUANY `]() HUANY = 81 ##### [` I386 `]() I386 = 3 ##### [` I60 `]() I60 = 19 ##### [` I860 `]() I860 = 7 ##### [` IAMCU `]() IAMCU = 6 ##### [` IA_64 `]() IA\_64 = 50 ##### [` INTEL205 `]() INTEL205 = 205 ##### [` INTEL206 `]() INTEL206 = 206 ##### [` INTEL207 `]() INTEL207 = 207 ##### [` INTEL208 `]() INTEL208 = 208 ##### [` INTEL209 `]() INTEL209 = 209 ##### [` IP2K `]() IP2K = 101 ##### [` JAVELIN `]() JAVELIN = 77 ##### [` K10M `]() K10M = 181 ##### [` KM32 `]() KM32 = 210 ##### [` KMX16 `]() KMX16 = 212 ##### [` KMX32 `]() KMX32 = 211 ##### [` KMX8 `]() KMX8 = 213 ##### [` KVARC `]() KVARC = 214 ##### [` L10M `]() L10M = 180 ##### [` LATTICEMICO32 `]() LATTICEMICO32 = 138 ##### [` LOONGARCH `]() LOONGARCH = 258 ##### [` M16C `]() M16C = 117 ##### [` M32 `]() M32 = 1 ##### [` M32C `]() M32C = 120 ##### [` M32R `]() M32R = 88 ##### [` M56800EX `]() M56800EX = 200 ##### [` M68HC05 `]() M68HC05 = 72 ##### [` M68HC08 `]() M68HC08 = 71 ##### [` M68HC11 `]() M68HC11 = 70 ##### [` M68HC12 `]() M68HC12 = 53 ##### [` M68HC16 `]() M68HC16 = 69 ##### [` M68K `]() M68K = 4 ##### [` M78KOR `]() M78KOR = 199 ##### [` M8051 `]() M8051 = 165 ##### [` M88K `]() M88K = 5 ##### [` MANIK `]() MANIK = 171 ##### [` MAX `]() MAX = 102 ##### [` MAXQ30 `]() MAXQ30 = 169 ##### [` MCHP_PIC `]() MCHP\_PIC = 204 ##### [` MCST_ELBRUS `]() MCST\_ELBRUS = 175 ##### [` ME16 `]() ME16 = 59 ##### [` METAG `]() METAG = 174 ##### [` MIPS `]() MIPS = 8 ##### [` MIPS_RS3_LE `]() MIPS\_RS3\_LE = 10 ##### [` MIPS_X `]() MIPS\_X = 51 ##### [` MMA `]() MMA = 54 ##### [` MMDSP_PLUS `]() MMDSP\_PLUS = 160 ##### [` MMIX `]() MMIX = 80 ##### [` MN10200 `]() MN10200 = 90 ##### [` MN10300 `]() MN10300 = 89 ##### [` MSP430 `]() MSP430 = 105 ##### [` NCPU `]() NCPU = 56 ##### [` NDR1 `]() NDR1 = 57 ##### [` NDS32 `]() NDS32 = 167 ##### [` NONE `]() NONE = 0 ##### [` NORC `]() NORC = 218 ##### [` NS32K `]() NS32K = 97 ##### [` OPEN8 `]() OPEN8 = 196 ##### [` OPENRISC `]() OPENRISC = 92 ##### [` PARISC `]() PARISC = 15 ##### [` PCP `]() PCP = 55 ##### [` PDP10 `]() PDP10 = 64 ##### [` PDP11 `]() PDP11 = 65 ##### [` PDSP `]() PDSP = 63 ##### [` PJ `]() PJ = 91 ##### [` PPC `]() PPC = 20 ##### [` PPC64 `]() PPC64 = 21 ##### [` PRISM `]() PRISM = 82 ##### [` R32C `]() R32C = 162 ##### [` RCE `]() RCE = 39 ##### [` RH32 `]() RH32 = 38 ##### [` RISCV `]() RISCV = 243 ##### [` RL78 `]() RL78 = 197 ##### [` RS08 `]() RS08 = 132 ##### [` RX `]() RX = 173 ##### [` S370 `]() S370 = 9 ##### [` S390 `]() S390 = 22 ##### [` SCORE7 `]() SCORE7 = 135 ##### [` SEP `]() SEP = 108 ##### [` SE_C17 `]() SE\_C17 = 139 ##### [` SE_C33 `]() SE\_C33 = 107 ##### [` SH `]() SH = 42 ##### [` SHARC `]() SHARC = 133 ##### [` SLE9X `]() SLE9X = 179 ##### [` SNP1K `]() SNP1K = 99 ##### [` SPARC `]() SPARC = 2 ##### [` SPARC32PLUS `]() SPARC32PLUS = 18 ##### [` SPARCV9 `]() SPARCV9 = 43 ##### [` SPU `]() SPU = 23 ##### [` ST100 `]() ST100 = 60 ##### [` ST19 `]() ST19 = 74 ##### [` ST200 `]() ST200 = 100 ##### [` ST7 `]() ST7 = 68 ##### [` ST9PLUS `]() ST9PLUS = 67 ##### [` STARCORE `]() STARCORE = 58 ##### [` STM8 `]() STM8 = 186 ##### [` STXP7X `]() STXP7X = 166 ##### [` SVX `]() SVX = 73 ##### [` TILE64 `]() TILE64 = 187 ##### [` TILEGX `]() TILEGX = 191 ##### [` TILEPRO `]() TILEPRO = 188 ##### [` TINYJ `]() TINYJ = 61 ##### [` TI_C2000 `]() TI\_C2000 = 141 ##### [` TI_C5500 `]() TI\_C5500 = 142 ##### [` TI_C6000 `]() TI\_C6000 = 140 ##### [` TMM_GPP `]() TMM\_GPP = 96 ##### [` TPC `]() TPC = 98 ##### [` TRICORE `]() TRICORE = 44 ##### [` TRIMEDIA `]() TRIMEDIA = 163 ##### [` TSK3000 `]() TSK3000 = 131 ##### [` UNICORE `]() UNICORE = 110 ##### [` V800 `]() V800 = 36 ##### [` V850 `]() V850 = 87 ##### [` VAX `]() VAX = 75 ##### [` VIDEOCORE `]() VIDEOCORE = 95 ##### [` VIDEOCORE3 `]() VIDEOCORE3 = 137 ##### [` VIDEOCORE5 `]() VIDEOCORE5 = 198 ##### [` VPP500 `]() VPP500 = 17 ##### [` X86_64 `]() X86\_64 = 62 ##### [` XCORE `]() XCORE = 203 ##### [` XGATE `]() XGATE = 115 ##### [` XIMO16 `]() XIMO16 = 170 ##### [` XTENSA `]() XTENSA = 94 ##### [` ZSP `]() ZSP = 79 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.ARCH]( "lief.ELF.ARCH") = <nanobind.nb\_func object> ### [Processor Flags]() #### [` lief.ELF.PROCESSOR_FLAGS `]() class lief.ELF.PROCESSOR\_FLAGS(*\*values*) Bases: `Enum` ##### [` ARM_EABI_UNKNOWN `]() ARM\_EABI\_UNKNOWN = 8796093022208 ##### [` ARM_EABI_VER1 `]() ARM\_EABI\_VER1 = 8796109799424 ##### [` ARM_EABI_VER2 `]() ARM\_EABI\_VER2 = 8796126576640 ##### [` ARM_EABI_VER3 `]() ARM\_EABI\_VER3 = 8796143353856 ##### [` ARM_EABI_VER4 `]() ARM\_EABI\_VER4 = 8796160131072 ##### [` ARM_EABI_VER5 `]() ARM\_EABI\_VER5 = 8796176908288 ##### [` ARM_SOFT_FLOAT `]() ARM\_SOFT\_FLOAT = 8796093022720 ##### [` ARM_VFP_FLOAT `]() ARM\_VFP\_FLOAT = 8796093023232 ##### [` HEXAGON_ISA_V2 `]() HEXAGON\_ISA\_V2 = 17592186044432 ##### [` HEXAGON_ISA_V3 `]() HEXAGON\_ISA\_V3 = 17592186044448 ##### [` HEXAGON_ISA_V4 `]() HEXAGON\_ISA\_V4 = 17592186044464 ##### [` HEXAGON_ISA_V5 `]() HEXAGON\_ISA\_V5 = 17592186044480 ##### [` HEXAGON_MACH_V2 `]() HEXAGON\_MACH\_V2 = 17592186044417 ##### [` HEXAGON_MACH_V3 `]() HEXAGON\_MACH\_V3 = 17592186044418 ##### [` HEXAGON_MACH_V4 `]() HEXAGON\_MACH\_V4 = 17592186044419 ##### [` HEXAGON_MACH_V5 `]() HEXAGON\_MACH\_V5 = 17592186044420 ##### [` LOONGARCH_ABI_DOUBLE_FLOAT `]() LOONGARCH\_ABI\_DOUBLE\_FLOAT = 26388279066627 ##### [` LOONGARCH_ABI_SINGLE_FLOAT `]() LOONGARCH\_ABI\_SINGLE\_FLOAT = 26388279066626 ##### [` LOONGARCH_ABI_SOFT_FLOAT `]() LOONGARCH\_ABI\_SOFT\_FLOAT = 26388279066625 ##### [` MIPS_32BITMODE `]() MIPS\_32BITMODE = 35184372089088 ##### [` MIPS_ABI2 `]() MIPS\_ABI2 = 35184372088864 ##### [` MIPS_ABI_EABI32 `]() MIPS\_ABI\_EABI32 = 35184372101120 ##### [` MIPS_ABI_EABI64 `]() MIPS\_ABI\_EABI64 = 35184372105216 ##### [` MIPS_ABI_O32 `]() MIPS\_ABI\_O32 = 35184372092928 ##### [` MIPS_ABI_O64 `]() MIPS\_ABI\_O64 = 35184372097024 ##### [` MIPS_ARCH_1 `]() MIPS\_ARCH\_1 = 35184372088832 ##### [` MIPS_ARCH_2 `]() MIPS\_ARCH\_2 = 35184640524288 ##### [` MIPS_ARCH_3 `]() MIPS\_ARCH\_3 = 35184908959744 ##### [` MIPS_ARCH_32 `]() MIPS\_ARCH\_32 = 35185714266112 ##### [` MIPS_ARCH_32R2 `]() MIPS\_ARCH\_32R2 = 35186251137024 ##### [` MIPS_ARCH_32R6 `]() MIPS\_ARCH\_32R6 = 35186788007936 ##### [` MIPS_ARCH_4 `]() MIPS\_ARCH\_4 = 35185177395200 ##### [` MIPS_ARCH_5 `]() MIPS\_ARCH\_5 = 35185445830656 ##### [` MIPS_ARCH_64 `]() MIPS\_ARCH\_64 = 35185982701568 ##### [` MIPS_ARCH_64R2 `]() MIPS\_ARCH\_64R2 = 35186519572480 ##### [` MIPS_ARCH_64R6 `]() MIPS\_ARCH\_64R6 = 35187056443392 ##### [` MIPS_ARCH_ASE_M16 `]() MIPS\_ARCH\_ASE\_M16 = 35184439197696 ##### [` MIPS_ARCH_ASE_MDMX `]() MIPS\_ARCH\_ASE\_MDMX = 35184506306560 ##### [` MIPS_CPIC `]() MIPS\_CPIC = 35184372088836 ##### [` MIPS_FP64 `]() MIPS\_FP64 = 35184372089344 ##### [` MIPS_MACH_3900 `]() MIPS\_MACH\_3900 = 35184380542976 ##### [` MIPS_MACH_4010 `]() MIPS\_MACH\_4010 = 35184380608512 ##### [` MIPS_MACH_4100 `]() MIPS\_MACH\_4100 = 35184380674048 ##### [` MIPS_MACH_4111 `]() MIPS\_MACH\_4111 = 35184381001728 ##### [` MIPS_MACH_4120 `]() MIPS\_MACH\_4120 = 35184380936192 ##### [` MIPS_MACH_4650 `]() MIPS\_MACH\_4650 = 35184380805120 ##### [` MIPS_MACH_5400 `]() MIPS\_MACH\_5400 = 35184381591552 ##### [` MIPS_MACH_5500 `]() MIPS\_MACH\_5500 = 35184382050304 ##### [` MIPS_MACH_5900 `]() MIPS\_MACH\_5900 = 35184381657088 ##### [` MIPS_MACH_9000 `]() MIPS\_MACH\_9000 = 35184382115840 ##### [` MIPS_MACH_LS2E `]() MIPS\_MACH\_LS2E = 35184382574592 ##### [` MIPS_MACH_LS2F `]() MIPS\_MACH\_LS2F = 35184382640128 ##### [` MIPS_MACH_LS3A `]() MIPS\_MACH\_LS3A = 35184382705664 ##### [` MIPS_MACH_OCTEON `]() MIPS\_MACH\_OCTEON = 35184381198336 ##### [` MIPS_MACH_OCTEON2 `]() MIPS\_MACH\_OCTEON2 = 35184381329408 ##### [` MIPS_MACH_OCTEON3 `]() MIPS\_MACH\_OCTEON3 = 35184381394944 ##### [` MIPS_MACH_SB1 `]() MIPS\_MACH\_SB1 = 35184381132800 ##### [` MIPS_MACH_XLR `]() MIPS\_MACH\_XLR = 35184381263872 ##### [` MIPS_MICROMIPS `]() MIPS\_MICROMIPS = 35184405643264 ##### [` MIPS_NAN2008 `]() MIPS\_NAN2008 = 35184372089856 ##### [` MIPS_NOREORDER `]() MIPS\_NOREORDER = 35184372088833 ##### [` MIPS_PIC `]() MIPS\_PIC = 35184372088834 ##### [` RISCV_FLOAT_ABI_DOUBLE `]() RISCV\_FLOAT\_ABI\_DOUBLE = 43980465111044 ##### [` RISCV_FLOAT_ABI_QUAD `]() RISCV\_FLOAT\_ABI\_QUAD = 43980465111046 ##### [` RISCV_FLOAT_ABI_RVE `]() RISCV\_FLOAT\_ABI\_RVE = 43980465111048 ##### [` RISCV_FLOAT_ABI_SINGLE `]() RISCV\_FLOAT\_ABI\_SINGLE = 43980465111042 ##### [` RISCV_FLOAT_ABI_SOFT `]() RISCV\_FLOAT\_ABI\_SOFT = 43980465111040 ##### [` RISCV_FLOAT_ABI_TSO `]() RISCV\_FLOAT\_ABI\_TSO = 43980465111056 ##### [` RISCV_RVC `]() RISCV\_RVC = 43980465111041 ##### [` from_value `]() from\_value(*arg: int*) → [lief.ELF.PROCESSOR\_FLAGS]( "lief.ELF.PROCESSOR_FLAGS") = <nanobind.nb\_func object> ## [Utilities]() ### [` lief.ELF.check_layout `]() lief.ELF.check\_layout(*binary: [lief.ELF.Binary]( "lief.ELF.Binary")*) → tuple[bool, str] Check that the layout of the given binary is correct. ### [` lief.is_elflief.is_elf `]() lief.is\_elf(*\*args*) → bool **lief.is\_elf(*raw: collections.abc.Sequence[int]*) → bool** Overloaded function. 1. `is_elf(filename: Union[str | os.PathLike]) -> bool` Check if the given file is an `ELF` 2. `is_elf(raw: collections.abc.Sequence[int]) -> bool` Check if the given raw data is an `ELF` --- documentID: "44445ac13b53f42af6232705417a74e4afc2e635a5937b7ad8daa1bfade0285d" docname: "formats/elf/rust" title: "ELF Rust API - LIEF Documentation" description: "ELF Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/elf/rust.html" markdownURL: "https://lief.re/doc/latest/formats/elf/rust.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "b6c7e4e7e599949e5a107cbab12d5d276c9543573718ea32546ebc3afc62e15c" --- # [Rust]() > **Note** > > Please check: [`lief::elf`]() --- documentID: "9234e6bbacb2f0d3db307e70152f1335b633e161a06198ed452a3a25cb9454b3" docname: "formats/macho/cpp" title: "Mach-O C++ API - LIEF Documentation" description: "Mach-O C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/macho/cpp.html" markdownURL: "https://lief.re/doc/latest/formats/macho/cpp.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "5c75e9781c7028c0a49dca1f1b95183e23f6e33e8f28483b7dc941bd8bf50ac9" --- # [C++]() ## [Parser]() ### [` Parser `]() class Parser : public LIEF::[Parser]( "LIEF::Parser") The main interface to parse a Mach-O binary. This class is used to parse both Fat & non-Fat binary. Non-fat binaries are considered as a **fat** with only one architecture. This is why [MachO::Parser::parse]() outputs a [FatBinary]() object. Public Functions #### [` operator= `]() [Parser]( "LIEF::MachO::Parser") &operator=(const [Parser]( "LIEF::MachO::Parser") &copy) = delete #### [` Parser `]() Parser(const [Parser]( "LIEF::MachO::Parser::Parser") &copy) = delete #### [` ~Parser `]() ~Parser() Public Static Functions #### [` parse `]() static std::unique\_ptr<[FatBinary]( "LIEF::MachO::FatBinary")> parse(std::string\_view filename, const [ParserConfig]( "LIEF::MachO::ParserConfig") &conf = [ParserConfig]( "LIEF::MachO::ParserConfig")::[deep]( "LIEF::MachO::ParserConfig::deep")()) Parse a Mach-O file from the path provided by the `filename` parameter. The `conf` parameter can be used to tweak the configuration of the parser **Parameters:** - **filename** – **[in]** Path to the Mach-O file - **conf** – **[in]** [Parser]() configuration (Default: [ParserConfig::deep]()) #### [` PathTparse `]() template<class PathT, enable\_if\_path\_t<[PathT]( "LIEF::MachO::Parser::parse::PathT")> = 0> static inline std::unique\_ptr<[FatBinary]( "LIEF::MachO::FatBinary")> parse(const [PathT]( "LIEF::MachO::Parser::parse::PathT") &filename, const [ParserConfig]( "LIEF::MachO::ParserConfig") &conf = [ParserConfig]( "LIEF::MachO::ParserConfig")::[deep]( "LIEF::MachO::ParserConfig::deep")()) Same as [parse(std::string\_view, const ParserConfig&)]() but the file is given as a `std::filesystem::path`. #### [` parse `]() static std::unique\_ptr<[FatBinary]( "LIEF::MachO::FatBinary")> parse(const std::vector<uint8\_t> &data, const [ParserConfig]( "LIEF::MachO::ParserConfig") &conf = [ParserConfig]( "LIEF::MachO::ParserConfig")::[deep]( "LIEF::MachO::ParserConfig::deep")()) Parse a Mach-O file from the raw content provided by the `data` parameter. The `conf` parameter can be used to tweak the configuration of the parser **Parameters:** - **data** – **[in]** Mach-O file as a vector of bytes - **conf** – **[in]** [Parser]() configuration (Default: [ParserConfig::deep]()) #### [` parse `]() static std::unique\_ptr<[FatBinary]( "LIEF::MachO::FatBinary")> parse(std::unique\_ptr<[BinaryStream]( "LIEF::BinaryStream")> stream, const [ParserConfig]( "LIEF::MachO::ParserConfig") &conf = [ParserConfig]( "LIEF::MachO::ParserConfig")::[deep]( "LIEF::MachO::ParserConfig::deep")()) Parse a Mach-O binary from the provided [BinaryStream](). #### [` parse_from_memory `]() static std::unique\_ptr<[FatBinary]( "LIEF::MachO::FatBinary")> parse\_from\_memory(uintptr\_t address, const [ParserConfig]( "LIEF::MachO::ParserConfig") &conf = [ParserConfig]( "LIEF::MachO::ParserConfig")::[deep]( "LIEF::MachO::ParserConfig::deep")()) Parse the Mach-O binary from the address given in the first parameter. #### [` parse_from_memory `]() static std::unique\_ptr<[FatBinary]( "LIEF::MachO::FatBinary")> parse\_from\_memory(uintptr\_t address, size\_t size, const [ParserConfig]( "LIEF::MachO::ParserConfig") &conf = [ParserConfig]( "LIEF::MachO::ParserConfig")::[deep]( "LIEF::MachO::ParserConfig::deep")()) Parse the Mach-O binary from the address given in the first parameter and the size given in the second parameter. #### [` parse_from_dump `]() static std::unique\_ptr<[FatBinary]( "LIEF::MachO::FatBinary")> parse\_from\_dump(std::string\_view filepath, uint64\_t addr, const [ParserConfig]( "LIEF::MachO::ParserConfig") &conf = [ParserConfig]( "LIEF::MachO::ParserConfig")::[deep]( "LIEF::MachO::ParserConfig::deep")()) Parse a Mach-O binary from a memory dump located on disk. A dump is a raw capture of the process memory that was mapped starting at the virtual address `addr`. This is typically used to parse a Mach-O image that has been dumped from memory (e.g. from a debugger or a runtime hook). **Parameters:** - **filepath** – **[in]** Path to the file that contains the memory dump - **addr** – **[in]** Virtual address at which the dump was mapped - **conf** – **[in]** Optional configuration for the parser #### [` PathTparse_from_dump `]() template<class PathT, enable\_if\_path\_t<[PathT]( "LIEF::MachO::Parser::parse_from_dump::PathT")> = 0> static inline std::unique\_ptr<[FatBinary]( "LIEF::MachO::FatBinary")> parse\_from\_dump(const [PathT]( "LIEF::MachO::Parser::parse_from_dump::PathT") &filepath, uint64\_t addr, const [ParserConfig]( "LIEF::MachO::ParserConfig") &conf = [ParserConfig]( "LIEF::MachO::ParserConfig")::[deep]( "LIEF::MachO::ParserConfig::deep")()) Same as [parse\_from\_dump(std::string\_view, uint64\_t, const ParserConfig&)]() but the dump file is given as a `std::filesystem::path`. #### [` parse_from_dump `]() static std::unique\_ptr<[FatBinary]( "LIEF::MachO::FatBinary")> parse\_from\_dump([BinaryStream]( "LIEF::BinaryStream") &stream, uint64\_t addr, const [ParserConfig]( "LIEF::MachO::ParserConfig") &conf = [ParserConfig]( "LIEF::MachO::ParserConfig")::[deep]( "LIEF::MachO::ParserConfig::deep")()) Same as [parse\_from\_dump(std::string\_view, uint64\_t, const ParserConfig&)]() but the dump is wrapped in the given **non-owned** stream. #### [` parse_from_dump `]() static std::unique\_ptr<[FatBinary]( "LIEF::MachO::FatBinary")> parse\_from\_dump(std::unique\_ptr<[BinaryStream]( "LIEF::BinaryStream")> stream, uint64\_t addr, const [ParserConfig]( "LIEF::MachO::ParserConfig") &conf = [ParserConfig]( "LIEF::MachO::ParserConfig")::[deep]( "LIEF::MachO::ParserConfig::deep")()) Same as [parse\_from\_dump(std::string\_view, uint64\_t, const ParserConfig&)]() but the dump is wrapped in the given **owned** stream. ### [` BinaryParser `]() class BinaryParser : public LIEF::[Parser]( "LIEF::Parser") Class used to parse a **single** binary (i.e. non-FAT). > **See also** > > [MachO::Parser]() > **Warning** > > This class should not be used directly. Public Functions #### [` operator= `]() [BinaryParser]( "LIEF::MachO::BinaryParser") &operator=(const [BinaryParser]( "LIEF::MachO::BinaryParser") &copy) = delete #### [` BinaryParser `]() BinaryParser(const [BinaryParser]( "LIEF::MachO::BinaryParser::BinaryParser") &copy) = delete #### [` ~BinaryParser `]() ~BinaryParser() Public Static Functions #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::MachO::Binary")> parse(std::string\_view file) #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::MachO::Binary")> parse(std::string\_view file, const [ParserConfig]( "LIEF::MachO::ParserConfig") &conf) #### [` PathTparse `]() template<class PathT, enable\_if\_path\_t<[PathT]( "LIEF::MachO::BinaryParser::parse::PathT")> = 0> static inline std::unique\_ptr<[Binary]( "LIEF::MachO::Binary")> parse(const [PathT]( "LIEF::MachO::BinaryParser::parse::PathT") &file, const [ParserConfig]( "LIEF::MachO::ParserConfig") &conf = [ParserConfig]( "LIEF::MachO::ParserConfig")::[deep]( "LIEF::MachO::ParserConfig::deep")()) Same as [parse(std::string\_view, const ParserConfig&)]() but the file is given as a `std::filesystem::path`. #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::MachO::Binary")> parse(const std::vector<uint8\_t> &data, const [ParserConfig]( "LIEF::MachO::ParserConfig") &conf = [ParserConfig]( "LIEF::MachO::ParserConfig")::[deep]( "LIEF::MachO::ParserConfig::deep")()) #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::MachO::Binary")> parse(const std::vector<uint8\_t> &data, uint64\_t fat\_offset, const [ParserConfig]( "LIEF::MachO::ParserConfig") &conf = [ParserConfig]( "LIEF::MachO::ParserConfig")::[deep]( "LIEF::MachO::ParserConfig::deep")()) #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::MachO::Binary")> parse(std::unique\_ptr<[BinaryStream]( "LIEF::BinaryStream")> stream, uint64\_t fat\_offset, const [ParserConfig]( "LIEF::MachO::ParserConfig") &conf) Friends **friend class MachO::Parser** ### [` ParserConfig `]() struct ParserConfig This structure is used to tweak the MachO [Parser]() ([MachO::Parser]()). Public Functions #### [` full_dyldinfo `]() [ParserConfig]( "LIEF::MachO::ParserConfig") &full\_dyldinfo(bool flag) If `flag` is set to `true`, Exports, Bindings and Rebases opcodes are parsed. > **Warning** > > Enabling this flag can slow down the parsing Public Members #### [` parse_dyld_exports `]() bool parse\_dyld\_exports = true Parse the Dyld export trie. #### [` parse_dyld_bindings `]() bool parse\_dyld\_bindings = true Parse the Dyld binding opcodes. #### [` parse_dyld_rebases `]() bool parse\_dyld\_rebases = true Parse the Dyld rebase opcodes. #### [` parse_overlay `]() bool parse\_overlay = true Whether the overlay data should be parsed. #### [` fix_from_memory `]() bool fix\_from\_memory = false When parsing Mach-O from memory, this option can be used to *undo* relocations and symbols bindings. When activated, this option requires parse\_dyld\_bindings and parse\_dyld\_rebases to be enabled. #### [` from_dyld_shared_cache `]() bool from\_dyld\_shared\_cache = false Whether the binary is coming/extracted from Dyld shared cache. Public Static Functions #### [` deep `]() static [ParserConfig]( "LIEF::MachO::ParserConfig") deep() Return a parser configuration such as all the objects supported by LIEF are parsed. #### [` quick `]() static [ParserConfig]( "LIEF::MachO::ParserConfig") quick() Return a configuration to parse the most important MachO structures. --- ## [FatBinary]() ### [` FatBinary `]() class FatBinary Class which represents a Mach-O (fat) binary This object is also used for representing Mach-O binaries that are **NOT FAT**. Public Types #### [` binaries_t `]() using binaries\_t = std::vector<std::unique\_ptr<[Binary]( "LIEF::MachO::Binary")>> Internal container used to store [Binary]() objects within a Fat Mach-O. #### [` it_binaries `]() using it\_binaries = [ref\_iterator]( "LIEF::ref_iterator")<[binaries\_t]( "LIEF::MachO::FatBinary::binaries_t")&, [Binary]( "LIEF::MachO::Binary")\*> Iterator that outputs [Binary]()&. #### [` it_const_binaries `]() using it\_const\_binaries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [binaries\_t]( "LIEF::MachO::FatBinary::binaries_t")&, [Binary]( "LIEF::MachO::Binary")\*> Iterator that outputs const [Binary]()&. Public Functions #### [` FatBinary `]() FatBinary(const [FatBinary]( "LIEF::MachO::FatBinary::FatBinary")&) = delete #### [` operator= `]() [FatBinary]( "LIEF::MachO::FatBinary") &operator=(const [FatBinary]( "LIEF::MachO::FatBinary")&) = delete #### [` ~FatBinary `]() virtual ~FatBinary() #### [` size `]() inline size\_t size() const Number of [MachO::Binary]() wrapped by this object. #### [` empty `]() inline bool empty() const Checks whether this object contains [MachO::Binary](). #### [` begin `]() inline [it\_binaries]( "LIEF::MachO::FatBinary::it_binaries") begin() #### [` begin `]() inline [it\_const\_binaries]( "LIEF::MachO::FatBinary::it_const_binaries") begin() const #### [` end `]() inline [it\_binaries]( "LIEF::MachO::FatBinary::it_binaries") end() #### [` end `]() inline [it\_const\_binaries]( "LIEF::MachO::FatBinary::it_const_binaries") end() const #### [` release_all_binaries `]() inline void release\_all\_binaries() #### [` pop_back `]() std::unique\_ptr<[Binary]( "LIEF::MachO::Binary")> pop\_back() Get a pointer to the last [MachO::Binary]() object present in this Fat [Binary](). It returns a nullptr if no binaries are present. #### [` at `]() inline [Binary]( "LIEF::MachO::Binary") \*at(size\_t index) Get a pointer to the [MachO::Binary]() specified by the `index`. It returns a nullptr if the binary does not exist at the given index. #### [` at `]() inline const [Binary]( "LIEF::MachO::Binary") \*at(size\_t index) const #### [` back `]() inline [Binary]( "LIEF::MachO::Binary") \*back() #### [` back `]() inline const [Binary]( "LIEF::MachO::Binary") \*back() const #### [` front `]() inline [Binary]( "LIEF::MachO::Binary") \*front() #### [` front `]() inline const [Binary]( "LIEF::MachO::Binary") \*front() const #### [` operator[] `]() inline [Binary]( "LIEF::MachO::Binary") \*operator[](size\_t index) #### [` operator[] `]() inline const [Binary]( "LIEF::MachO::Binary") \*operator[](size\_t index) const #### [` take `]() std::unique\_ptr<[Binary]( "LIEF::MachO::Binary")> take(size\_t index) Extract a [MachO::Binary]() object. Gives ownership to the caller, and remove it from this [FatBinary]() object. > **Warning** > > This invalidates any previously held iterator! #### [` take `]() std::unique\_ptr<[Binary]( "LIEF::MachO::Binary")> take([Header]( "LIEF::MachO::Header")::[CPU\_TYPE]( "LIEF::MachO::Header::CPU_TYPE") cpu) Take the underlying [MachO::Binary]() that matches the given architecture If no binary with the architecture can be found, return a nullptr. #### [` write `]() void write(const std::string &filename) Reconstruct the Fat binary object and write it in `filename`. **Parameters:** **filename** – Path to write the reconstructed binary #### [` raw `]() std::vector<uint8\_t> raw() Reconstruct the Fat binary object and return its content as bytes. #### [` get `]() inline [Binary]( "LIEF::MachO::Binary") \*get([Header]( "LIEF::MachO::Header")::[CPU\_TYPE]( "LIEF::MachO::Header::CPU_TYPE") cpu) #### [` get `]() const [Binary]( "LIEF::MachO::Binary") \*get([Header]( "LIEF::MachO::Header")::[CPU\_TYPE]( "LIEF::MachO::Header::CPU_TYPE") cpu) const Gets a pointer to the [MachO::Binary]() that matches the given architecture. #### [` operator[] `]() inline [Binary]( "LIEF::MachO::Binary") \*operator[]([Header]( "LIEF::MachO::Header")::[CPU\_TYPE]( "LIEF::MachO::Header::CPU_TYPE") cpu) #### [` operator[] `]() inline const [Binary]( "LIEF::MachO::Binary") \*operator[]([Header]( "LIEF::MachO::Header")::[CPU\_TYPE]( "LIEF::MachO::Header::CPU_TYPE") cpu) const Public Static Functions #### [` create `]() static std::unique\_ptr<[FatBinary]( "LIEF::MachO::FatBinary")> create([binaries\_t]( "LIEF::MachO::FatBinary::binaries_t") binaries) Create a [FatBinary]() object from the provided list of [Binary]() objects. The binaries **must** target different architectures (i.e. unique CPU type and subtype). If a duplicate architecture is detected, this function returns a nullptr. Friends **friend class LIEF::Parser** #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [FatBinary]( "LIEF::MachO::FatBinary") &fatbinary) --- ## [Binary]() ### [` Binary `]() class Binary : public LIEF::[Binary]( "LIEF::Binary") Class which represents a MachO binary. Public Types #### [` commands_t `]() using commands\_t = std::vector<std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")>> Internal container for storing Mach-O [LoadCommand](). #### [` it_commands `]() using it\_commands = [ref\_iterator]( "LIEF::ref_iterator")<[commands\_t]( "LIEF::MachO::Binary::commands_t")&, [LoadCommand]( "LIEF::MachO::LoadCommand")\*> Iterator that outputs [LoadCommand]()&. #### [` it_const_commands `]() using it\_const\_commands = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [commands\_t]( "LIEF::MachO::Binary::commands_t")&, [LoadCommand]( "LIEF::MachO::LoadCommand")\*> Iterator that outputs const [LoadCommand]()&. #### [` symbols_t `]() using symbols\_t = std::vector<std::unique\_ptr<[Symbol]( "LIEF::MachO::Symbol")>> Internal container for storing Mach-O [Symbol](). #### [` it_symbols `]() using it\_symbols = [ref\_iterator]( "LIEF::ref_iterator")<[symbols\_t]( "LIEF::MachO::Binary::symbols_t")&, [Symbol]( "LIEF::MachO::Symbol")\*> Iterator that outputs [Symbol]()&. #### [` it_const_symbols `]() using it\_const\_symbols = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [symbols\_t]( "LIEF::MachO::Binary::symbols_t")&, const [Symbol]( "LIEF::MachO::Symbol")\*> Iterator that outputs const [Symbol]()&. #### [` it_exported_symbols `]() using it\_exported\_symbols = [filter\_iterator]( "LIEF::filter_iterator")<[symbols\_t]( "LIEF::MachO::Binary::symbols_t")&, [Symbol]( "LIEF::MachO::Symbol")\*> Iterator that outputs exported [Symbol]()&. #### [` it_const_exported_symbols `]() using it\_const\_exported\_symbols = [const\_filter\_iterator]( "LIEF::const_filter_iterator")<const [symbols\_t]( "LIEF::MachO::Binary::symbols_t")&, const [Symbol]( "LIEF::MachO::Symbol")\*> Iterator that outputs exported const [Symbol]()&. #### [` it_imported_symbols `]() using it\_imported\_symbols = [filter\_iterator]( "LIEF::filter_iterator")<[symbols\_t]( "LIEF::MachO::Binary::symbols_t")&, [Symbol]( "LIEF::MachO::Symbol")\*> Iterator that outputs imported [Symbol]()&. #### [` it_const_imported_symbols `]() using it\_const\_imported\_symbols = [const\_filter\_iterator]( "LIEF::const_filter_iterator")<const [symbols\_t]( "LIEF::MachO::Binary::symbols_t")&, const [Symbol]( "LIEF::MachO::Symbol")\*> Iterator that outputs imported const [Symbol]()&. #### [` sections_cache_t `]() using sections\_cache\_t = std::vector<[Section]( "LIEF::MachO::Section")\*> Internal container for caching Mach-O [Section](). #### [` it_sections `]() using it\_sections = [ref\_iterator]( "LIEF::ref_iterator")<[sections\_cache\_t]( "LIEF::MachO::Binary::sections_cache_t")&> Iterator that outputs [Section]()&. #### [` it_const_sections `]() using it\_const\_sections = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [sections\_cache\_t]( "LIEF::MachO::Binary::sections_cache_t")&> Iterator that outputs const [Section]()&. #### [` segments_cache_t `]() using segments\_cache\_t = std::vector<[SegmentCommand]( "LIEF::MachO::SegmentCommand")\*> Internal container for storing Mach-O [SegmentCommand](). #### [` it_segments `]() using it\_segments = [ref\_iterator]( "LIEF::ref_iterator")<[segments\_cache\_t]( "LIEF::MachO::Binary::segments_cache_t")&> Iterator that outputs [SegmentCommand]()&. #### [` it_const_segments `]() using it\_const\_segments = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [segments\_cache\_t]( "LIEF::MachO::Binary::segments_cache_t")&> Iterator that outputs const [SegmentCommand]()&. #### [` libraries_cache_t `]() using libraries\_cache\_t = std::vector<[DylibCommand]( "LIEF::MachO::DylibCommand")\*> Internal container for storing Mach-O [DylibCommand](). #### [` it_libraries `]() using it\_libraries = [ref\_iterator]( "LIEF::ref_iterator")<[libraries\_cache\_t]( "LIEF::MachO::Binary::libraries_cache_t")&> Iterator that outputs [DylibCommand]()&. #### [` it_const_libraries `]() using it\_const\_libraries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [libraries\_cache\_t]( "LIEF::MachO::Binary::libraries_cache_t")&> Iterator that outputs const [DylibCommand]()&. #### [` lazy_load_dylib_info_cache_t `]() using lazy\_load\_dylib\_info\_cache\_t = std::vector<[LazyLoadDylibInfo]( "LIEF::MachO::LazyLoadDylibInfo")\*> Internal container for storing Mach-O [LazyLoadDylibInfo](). #### [` it_lazy_load_dylib_info `]() using it\_lazy\_load\_dylib\_info = [ref\_iterator]( "LIEF::ref_iterator")<[lazy\_load\_dylib\_info\_cache\_t]( "LIEF::MachO::Binary::lazy_load_dylib_info_cache_t")&> Iterator that outputs [LazyLoadDylibInfo]()&. #### [` it_const_lazy_load_dylib_info `]() using it\_const\_lazy\_load\_dylib\_info = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [lazy\_load\_dylib\_info\_cache\_t]( "LIEF::MachO::Binary::lazy_load_dylib_info_cache_t")&> Iterator that outputs const [LazyLoadDylibInfo]()&. #### [` fileset_binaries_t `]() using fileset\_binaries\_t = std::vector<std::unique\_ptr<[Binary]( "LIEF::MachO::Binary")>> Internal container for storing Mach-O Fileset [Binary](). #### [` it_fileset_binaries `]() using it\_fileset\_binaries = [ref\_iterator]( "LIEF::ref_iterator")<[fileset\_binaries\_t]( "LIEF::MachO::Binary::fileset_binaries_t")&, [Binary]( "LIEF::MachO::Binary")\*> Iterator that outputs [Binary]()&. #### [` it_const_fileset_binaries `]() using it\_const\_fileset\_binaries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [fileset\_binaries\_t]( "LIEF::MachO::Binary::fileset_binaries_t")&, [Binary]( "LIEF::MachO::Binary")\*> Iterator that outputs const [Binary]()&. #### [` relocations_t `]() using relocations\_t = std::set<[Relocation]( "LIEF::MachO::Relocation")\*, [KeyCmp]( "LIEF::MachO::Binary::KeyCmp")> Internal container that store all the relocations found in a Mach-O. The relocations are actually owned by [Section]() & [SegmentCommand]() and these references are used for convenience. #### [` it_relocations `]() using it\_relocations = [ref\_iterator]( "LIEF::ref_iterator")<[relocations\_t]( "LIEF::MachO::Binary::relocations_t")&, [Relocation]( "LIEF::MachO::Relocation")\*> Iterator which outputs [Relocation]()&. #### [` it_const_relocations `]() using it\_const\_relocations = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [relocations\_t]( "LIEF::MachO::Binary::relocations_t")&, const [Relocation]( "LIEF::MachO::Relocation")\*> Iterator which outputs const [Relocation]()&. #### [` it_rpaths `]() using it\_rpaths = [filter\_iterator]( "LIEF::filter_iterator")<[commands\_t]( "LIEF::MachO::Binary::commands_t")&, [RPathCommand]( "LIEF::MachO::RPathCommand")\*> Iterator which outputs [RPathCommand]()&. #### [` it_const_rpaths `]() using it\_const\_rpaths = [const\_filter\_iterator]( "LIEF::const_filter_iterator")<const [commands\_t]( "LIEF::MachO::Binary::commands_t")&, const [RPathCommand]( "LIEF::MachO::RPathCommand")\*> Iterator which outputs const [RPathCommand]()&. #### [` it_sub_clients `]() using it\_sub\_clients = [filter\_iterator]( "LIEF::filter_iterator")<[commands\_t]( "LIEF::MachO::Binary::commands_t")&, [SubClient]( "LIEF::MachO::SubClient")\*> Iterator which outputs [SubClient]()&. #### [` it_const_sub_clients `]() using it\_const\_sub\_clients = [const\_filter\_iterator]( "LIEF::const_filter_iterator")<const [commands\_t]( "LIEF::MachO::Binary::commands_t")&, const [SubClient]( "LIEF::MachO::SubClient")\*> Iterator which outputs const [SubClient]()&. #### [` it_bindings `]() using it\_bindings = [iterator\_range]( "LIEF::iterator_range")<BindingInfoIterator> #### [` stub_iterator `]() using stub\_iterator = [iterator\_range]( "LIEF::iterator_range")<[Stub]( "LIEF::MachO::Stub")::[Iterator]( "LIEF::MachO::Stub::Iterator")> Iterator type for [Symbol]()’s stub. #### [` it_notes `]() using it\_notes = [filter\_iterator]( "LIEF::filter_iterator")<[commands\_t]( "LIEF::MachO::Binary::commands_t")&, [NoteCommand]( "LIEF::MachO::NoteCommand")\*> Iterator which outputs [NoteCommand]()&. #### [` it_const_notes `]() using it\_const\_notes = [const\_filter\_iterator]( "LIEF::const_filter_iterator")<const [commands\_t]( "LIEF::MachO::Binary::commands_t")&, const [NoteCommand]( "LIEF::MachO::NoteCommand")\*> Iterator which outputs const [NoteCommand]()&. Public Functions #### [` Binary `]() Binary(const [Binary]( "LIEF::MachO::Binary::Binary")&) = delete #### [` operator= `]() [Binary]( "LIEF::MachO::Binary") &operator=(const [Binary]( "LIEF::MachO::Binary")&) = delete #### [` header `]() inline [Header]( "LIEF::MachO::Header") &header() Return a reference to the [MachO::Header](). #### [` header `]() inline const [Header]( "LIEF::MachO::Header") &header() const #### [` commands `]() inline [it\_commands]( "LIEF::MachO::Binary::it_commands") commands() Return an iterator over the MachO [LoadCommand]() present in the binary. #### [` commands `]() inline [it\_const\_commands]( "LIEF::MachO::Binary::it_const_commands") commands() const #### [` filesets `]() inline [it\_fileset\_binaries]( "LIEF::MachO::Binary::it_fileset_binaries") filesets() Return an iterator over the [MachO::Binary]() associated with the [LoadCommand::TYPE::FILESET\_ENTRY]() commands. #### [` filesets `]() inline [it\_const\_fileset\_binaries]( "LIEF::MachO::Binary::it_const_fileset_binaries") filesets() const #### [` symbols `]() inline [it\_symbols]( "LIEF::MachO::Binary::it_symbols") symbols() Return binary’s [symbols]() . #### [` symbols `]() inline [it\_const\_symbols]( "LIEF::MachO::Binary::it_const_symbols") symbols() const #### [` has_symbol `]() inline bool has\_symbol(const std::string &name) const Check if a symbol with the given name exists. #### [` get_symbol `]() const [Symbol]( "LIEF::MachO::Symbol") \*get\_symbol(const std::string &name) const Return [Symbol]() from the given name. If the symbol does not exist, it returns a null pointer. #### [` get_symbol `]() inline [Symbol]( "LIEF::MachO::Symbol") \*get\_symbol(const std::string &name) #### [` exported_symbols `]() inline [it\_exported\_symbols]( "LIEF::MachO::Binary::it_exported_symbols") exported\_symbols() Return binary’s exported symbols (iterator over [LIEF::MachO::Symbol]()). #### [` exported_symbols `]() inline [it\_const\_exported\_symbols]( "LIEF::MachO::Binary::it_const_exported_symbols") exported\_symbols() const #### [` imported_symbols `]() inline [it\_imported\_symbols]( "LIEF::MachO::Binary::it_imported_symbols") imported\_symbols() Return binary’s imported symbols (iterator over [LIEF::MachO::Symbol]()). #### [` imported_symbols `]() inline [it\_const\_imported\_symbols]( "LIEF::MachO::Binary::it_const_imported_symbols") imported\_symbols() const #### [` libraries `]() inline [it\_libraries]( "LIEF::MachO::Binary::it_libraries") libraries() Return binary imported libraries ([MachO::DylibCommand]()). #### [` libraries `]() inline [it\_const\_libraries]( "LIEF::MachO::Binary::it_const_libraries") libraries() const #### [` lazy_load_dylib_infos `]() inline [it\_lazy\_load\_dylib\_info]( "LIEF::MachO::Binary::it_lazy_load_dylib_info") lazy\_load\_dylib\_infos() Return an iterator over the binary’s [LazyLoadDylibInfo]() commands (`LC_LAZY_LOAD_DYLIB_INFO`). #### [` lazy_load_dylib_infos `]() inline [it\_const\_lazy\_load\_dylib\_info]( "LIEF::MachO::Binary::it_const_lazy_load_dylib_info") lazy\_load\_dylib\_infos() const #### [` segments `]() inline [it\_segments]( "LIEF::MachO::Binary::it_segments") segments() Return an iterator over the [SegmentCommand](). #### [` segments `]() inline [it\_const\_segments]( "LIEF::MachO::Binary::it_const_segments") segments() const #### [` sections `]() inline [it\_sections]( "LIEF::MachO::Binary::it_sections") sections() Return an iterator over the [MachO::Section](). #### [` sections `]() inline [it\_const\_sections]( "LIEF::MachO::Binary::it_const_sections") sections() const #### [` relocations `]() inline [it\_relocations]( "LIEF::MachO::Binary::it_relocations") relocations() Return an iterator over the [MachO::Relocation](). #### [` relocations `]() [it\_const\_relocations]( "LIEF::MachO::Binary::it_const_relocations") relocations() const #### [` write `]() void write(const std::string &filename) Reconstruct the binary object and write the result in the given `filename`. **Parameters:** **filename** – Path to write the reconstructed binary #### [` write `]() void write(const std::string &filename, [Builder]( "LIEF::MachO::Builder")::[config\_t]( "LIEF::MachO::Builder::config_t") config) Reconstruct the binary object and write the result in the given `filename`. The second `config` parameter is used to tweak the building process **Parameters:** - **filename** – Path to write the reconstructed binary - **config** – [Builder]() configuration #### [` write `]() void write(std::ostream &os) Reconstruct the binary object and write the result in the given `os` stream. **Parameters:** **os** – Output stream to write the reconstructed binary #### [` write `]() void write(std::ostream &os, [Builder]( "LIEF::MachO::Builder")::[config\_t]( "LIEF::MachO::Builder::config_t") config) Reconstruct the binary object and write the result in the given `os` stream for the given configuration. **Parameters:** - **os** – Output stream to write the reconstructed binary - **config** – [Builder]() configuration #### [` raw `]() std::vector<uint8\_t> raw() Reconstruct the binary object and return its content as bytes. #### [` has `]() bool has([LoadCommand]( "LIEF::MachO::LoadCommand")::[TYPE]( "LIEF::MachO::LoadCommand::TYPE") type) const Check if the current binary has the given [MachO::LoadCommand::TYPE](). #### [` get `]() const [LoadCommand]( "LIEF::MachO::LoadCommand") \*get([LoadCommand]( "LIEF::MachO::LoadCommand")::[TYPE]( "LIEF::MachO::LoadCommand::TYPE") type) const Return the [LoadCommand]() associated with the given [LoadCommand::TYPE]() or a nullptr if the command can’t be found. #### [` get `]() inline [LoadCommand]( "LIEF::MachO::LoadCommand") \*get([LoadCommand]( "LIEF::MachO::LoadCommand")::[TYPE]( "LIEF::MachO::LoadCommand::TYPE") type) #### [` add `]() [LoadCommand]( "LIEF::MachO::LoadCommand") \*add(std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> command) #### [` add `]() inline [LoadCommand]( "LIEF::MachO::LoadCommand") \*add(const [LoadCommand]( "LIEF::MachO::LoadCommand") &command) Insert a new [LoadCommand](). #### [` add `]() [LoadCommand]( "LIEF::MachO::LoadCommand") \*add(const [LoadCommand]( "LIEF::MachO::LoadCommand") &command, size\_t index) Insert a new [LoadCommand]() at the specified `index`. #### [` add `]() [LoadCommand]( "LIEF::MachO::LoadCommand") \*add(const [DylibCommand]( "LIEF::MachO::DylibCommand") &library) Insert the given [DylibCommand](). #### [` add `]() [LoadCommand]( "LIEF::MachO::LoadCommand") \*add(const [SegmentCommand]( "LIEF::MachO::SegmentCommand") &segment) Add a new LC\_SEGMENT command from the given [SegmentCommand](). #### [` add_library `]() [LoadCommand]( "LIEF::MachO::LoadCommand") \*add\_library(const std::string &name) Insert a new shared library through a `LC_LOAD_DYLIB` command. #### [` add_section `]() [Section]( "LIEF::MachO::Section") \*add\_section(const [Section]( "LIEF::MachO::Section") &section) Add a new [MachO::Section]() in the \_\_TEXT segment. #### [` find_library `]() const [DylibCommand]( "LIEF::MachO::DylibCommand") \*find\_library(const std::string &name) const Try to find the library with the given library name. This function tries to match the fullpath of the [DylibCommand]() or the library name suffix. #### [` find_library `]() inline [DylibCommand]( "LIEF::MachO::DylibCommand") \*find\_library(const std::string &name) #### [` add_section `]() [Section]( "LIEF::MachO::Section") \*add\_section(const [SegmentCommand]( "LIEF::MachO::SegmentCommand") &segment, const [Section]( "LIEF::MachO::Section") &section) Add a section in the given [MachO::SegmentCommand](). > **Warning** > > This method may corrupt the file if the segment is not the first one nor the last one #### [` remove_section `]() virtual void remove\_section(const std::string &name, bool clear = false) override Remove the section with the name provided in the first parameter. **Parameters:** - **name** – Name of the [MachO::Section]() to remove - **clear** – If `true` clear the content of the section before removing #### [` remove_section `]() void remove\_section(const std::string &segname, const std::string &secname, bool clear = false) Remove the section from the segment with the name given in the first parameter and with the section’s name provided in the second parameter. **Parameters:** - **segname** – Name of the MachO::Segment - **secname** – Name of the [MachO::Section]() to remove - **clear** – If `true` clear the content of the section before removing #### [` remove `]() bool remove(const [LoadCommand]( "LIEF::MachO::LoadCommand") &command) Remove the given [LoadCommand](). #### [` remove `]() bool remove([LoadCommand]( "LIEF::MachO::LoadCommand")::[TYPE]( "LIEF::MachO::LoadCommand::TYPE") type) Remove **all** [LoadCommand]() with the given type ([MachO::LoadCommand::TYPE]()). #### [` remove_command `]() bool remove\_command(size\_t index) Remove the Load Command at the provided `index`. #### [` remove_signature `]() bool remove\_signature() Remove the LC\_SIGNATURE command. #### [` extend `]() bool extend(const [LoadCommand]( "LIEF::MachO::LoadCommand") &command, uint64\_t size) Extend the **size** of the given [LoadCommand](). #### [` extend_segment `]() bool extend\_segment(const [SegmentCommand]( "LIEF::MachO::SegmentCommand") &segment, size\_t size) Extend the **content** of the given [SegmentCommand](). #### [` extend_section `]() bool extend\_section([Section]( "LIEF::MachO::Section") &section, size\_t size) Extend the **content** of the given [Section](). > **Note** > > This method may extend the section more than `size` preventing creation a gap between the current section and the next one. This may happen trying to satisfy alignment requirement of sections. > **Note** > > This method works only with sections that belong to the first segment. #### [` disable_pie `]() bool disable\_pie() Remove the `PIE` flag. #### [` imagebase `]() virtual uint64\_t imagebase() const override Return the binary’s imagebase. `0` if not relevant. #### [` virtual_size `]() inline virtual uint64\_t virtual\_size() const override Size of the binary in memory when mapped by the loader (`dyld`). #### [` loader `]() std::string\_view loader() const Return the binary’s loader (e.g. `/usr/lib/dyld`) or an empty string if the binary does not use a loader/linker. #### [` has_section `]() inline bool has\_section(const std::string &name) const Check if a section with the given name exists. #### [` get_section `]() inline [Section]( "LIEF::MachO::Section") \*get\_section(const std::string &name) Return the section from the given name or a nullptr if the section can’t be found. #### [` get_section `]() const [Section]( "LIEF::MachO::Section") \*get\_section(const std::string &name) const Return the section from the given name or a nullptr if the section can’t be found. #### [` get_section `]() inline [Section]( "LIEF::MachO::Section") \*get\_section(const std::string &segname, const std::string &secname) Return the section from the segment with the name given in the first parameter and with the section’s name provided in the second parameter. If the section cannot be found, it returns a nullptr. #### [` get_section `]() const [Section]( "LIEF::MachO::Section") \*get\_section(const std::string &segname, const std::string &secname) const #### [` has_segment `]() inline bool has\_segment(const std::string &name) const Check if a segment with the given name exists. #### [` get_segment `]() const [SegmentCommand]( "LIEF::MachO::SegmentCommand") \*get\_segment(const std::string &name) const Return the segment from the given name. #### [` get_segment `]() inline [SegmentCommand]( "LIEF::MachO::SegmentCommand") \*get\_segment(const std::string &name) Return the segment from the given name. #### [` remove_symbol `]() bool remove\_symbol(const std::string &name) Remove the symbol with the given name. #### [` remove `]() bool remove(const [Symbol]( "LIEF::MachO::Symbol") &sym) Remove the given symbol. #### [` can_remove `]() bool can\_remove(const [Symbol]( "LIEF::MachO::Symbol") &sym) const Check if the given symbol can be safely removed. #### [` can_remove_symbol `]() bool can\_remove\_symbol(const std::string &name) const Check if the [MachO::Symbol]() with the given name can be safely removed. #### [` unexport `]() bool unexport(const std::string &name) Remove the given [MachO::Symbol]() with the given name from the export table. #### [` unexport `]() bool unexport(const [Symbol]( "LIEF::MachO::Symbol") &sym) Remove the given symbol from the export table. #### [` section_from_offset `]() inline [Section]( "LIEF::MachO::Section") \*section\_from\_offset(uint64\_t offset) Return the [MachO::Section]() that encompasses the provided offset. If a section can’t be found, it returns a null pointer (`nullptr`). #### [` section_from_offset `]() const [Section]( "LIEF::MachO::Section") \*section\_from\_offset(uint64\_t offset) const #### [` section_from_virtual_address `]() inline [Section]( "LIEF::MachO::Section") \*section\_from\_virtual\_address(uint64\_t virtual\_address) Return the [MachO::Section]() that encompasses the provided virtual address. If a section can’t be found, it returns a null pointer (`nullptr`). #### [` section_from_virtual_address `]() const [Section]( "LIEF::MachO::Section") \*section\_from\_virtual\_address(uint64\_t virtual\_address) const #### [` virtual_address_to_offset `]() [result]( "LIEF::result")<uint64\_t> virtual\_address\_to\_offset(uint64\_t virtual\_address) const Convert a virtual address to an offset in the file. #### [` offset_to_virtual_address `]() virtual [result]( "LIEF::result")<uint64\_t> offset\_to\_virtual\_address(uint64\_t offset, uint64\_t slide = 0) const override Convert the given offset into a virtual address. **Parameters:** - **offset** – **[in]** The offset to convert. - **slide** – **[in]** If not 0, it will replace the default base address (if any) #### [` segment_from_offset `]() inline [SegmentCommand]( "LIEF::MachO::SegmentCommand") \*segment\_from\_offset(uint64\_t offset) Return the binary’s [SegmentCommand]() that encompasses the provided offset. If a [SegmentCommand]() can’t be found it returns a null pointer (`nullptr`). #### [` segment_from_offset `]() const [SegmentCommand]( "LIEF::MachO::SegmentCommand") \*segment\_from\_offset(uint64\_t offset) const #### [` segment_index `]() size\_t segment\_index(const [SegmentCommand]( "LIEF::MachO::SegmentCommand") &segment) const Return the index of the given [SegmentCommand](). #### [` fat_offset `]() inline uint64\_t fat\_offset() const Return binary’s *fat offset*. `0` if not relevant. #### [` segment_from_virtual_address `]() inline [SegmentCommand]( "LIEF::MachO::SegmentCommand") \*segment\_from\_virtual\_address(uint64\_t virtual\_address) Return the binary’s [SegmentCommand]() which encompasses the given virtual address or a nullptr if not found. #### [` segment_from_virtual_address `]() const [SegmentCommand]( "LIEF::MachO::SegmentCommand") \*segment\_from\_virtual\_address(uint64\_t virtual\_address) const #### [` va_ranges `]() [range\_t]( "LIEF::MachO::Binary::range_t") va\_ranges() const Return the range of virtual addresses. #### [` off_ranges `]() [range\_t]( "LIEF::MachO::Binary::range_t") off\_ranges() const Return the range of offsets. #### [` tlv_initial_content_range `]() [range\_t]( "LIEF::MachO::Binary::range_t") tlv\_initial\_content\_range() const Return the TLV initial content range. #### [` is_valid_addr `]() inline bool is\_valid\_addr(uint64\_t address) const Check if the given address is encompassed in the binary’s virtual addresses range. #### [` accept `]() virtual void accept(LIEF::Visitor &visitor) const override Method so that the `visitor` can visit us. #### [` print `]() virtual std::ostream &print(std::ostream &os) const override #### [` patch_address `]() virtual void patch\_address(uint64\_t address, const std::vector<uint8\_t> &patch\_value, LIEF::[Binary]( "LIEF::Binary")::[VA\_TYPES]( "LIEF::Binary::VA_TYPES") addr\_type = LIEF::[Binary]( "LIEF::Binary")::[VA\_TYPES]( "LIEF::Binary::VA_TYPES")::[AUTO]( "LIEF::Binary::VA_TYPES::AUTO")) override Patch the content at virtual address `address` with `patch_value`. **Parameters:** - **address** – **[in]** Address to patch - **patch\_value** – **[in]** Patch to apply - **addr\_type** – **[in]** Specify if the address should be used as an absolute virtual address or an RVA #### [` patch_address `]() virtual void patch\_address(uint64\_t address, uint64\_t patch\_value, size\_t size = sizeof(uint64\_t), LIEF::[Binary]( "LIEF::Binary")::[VA\_TYPES]( "LIEF::Binary::VA_TYPES") addr\_type = LIEF::[Binary]( "LIEF::Binary")::[VA\_TYPES]( "LIEF::Binary::VA_TYPES")::[AUTO]( "LIEF::Binary::VA_TYPES::AUTO")) override Patch the address with the given value. **Parameters:** - **address** – **[in]** Address to patch - **patch\_value** – **[in]** Patch to apply - **size** – **[in]** Size of the value in **bytes** (1, 2, … 8) - **addr\_type** – **[in]** Specify if the address should be used as an absolute virtual address or an RVA #### [` get_content_from_virtual_address `]() virtual span<const uint8\_t> get\_content\_from\_virtual\_address(uint64\_t virtual\_address, uint64\_t size, [Binary]( "LIEF::MachO::Binary")::VA\_TYPES addr\_type = [Binary]( "LIEF::MachO::Binary")::VA\_TYPES::AUTO) const override Return the content located at virtual address. #### [` entrypoint `]() virtual uint64\_t entrypoint() const override The binary entrypoint. #### [` is_pie `]() inline virtual bool is\_pie() const override Check if the binary is position independent. #### [` has_nx `]() inline virtual bool has\_nx() const override Check if the binary uses `NX` protection. #### [` has_nx_stack `]() inline bool has\_nx\_stack() const Return True if the **stack** is flagged as non-executable. False otherwise. #### [` has_nx_heap `]() inline bool has\_nx\_heap() const Return True if the **heap** is flagged as non-executable. False otherwise. #### [` has_entrypoint `]() inline bool has\_entrypoint() const `true` if the binary has an entrypoint. Basically for libraries it will return `false` #### [` has_uuid `]() inline bool has\_uuid() const `true` if the binary has a [MachO::UUIDCommand]() command. #### [` uuid `]() [UUIDCommand]( "LIEF::MachO::UUIDCommand") \*uuid() Return the [MachO::UUIDCommand]() if present, a nullptr otherwise. #### [` uuid `]() const [UUIDCommand]( "LIEF::MachO::UUIDCommand") \*uuid() const #### [` has_main_command `]() inline bool has\_main\_command() const `true` if the binary has a [MachO::MainCommand]() command. #### [` main_command `]() [MainCommand]( "LIEF::MachO::MainCommand") \*main\_command() Return the [MachO::MainCommand]() if present, a nullptr otherwise. #### [` main_command `]() const [MainCommand]( "LIEF::MachO::MainCommand") \*main\_command() const #### [` has_dylinker `]() inline bool has\_dylinker() const `true` if the binary has a [MachO::DylinkerCommand](). #### [` dylinker `]() [DylinkerCommand]( "LIEF::MachO::DylinkerCommand") \*dylinker() Return the [MachO::DylinkerCommand]() if present, a nullptr otherwise. #### [` dylinker `]() const [DylinkerCommand]( "LIEF::MachO::DylinkerCommand") \*dylinker() const #### [` has_dyld_info `]() inline bool has\_dyld\_info() const `true` if the binary has a [MachO::DyldInfo]() command. #### [` dyld_info `]() [DyldInfo]( "LIEF::MachO::DyldInfo") \*dyld\_info() Return the MachO::Dyld command if present, a nullptr otherwise. #### [` dyld_info `]() const [DyldInfo]( "LIEF::MachO::DyldInfo") \*dyld\_info() const #### [` has_function_starts `]() inline bool has\_function\_starts() const `true` if the binary has a [MachO::FunctionStarts]() command. #### [` function_starts `]() [FunctionStarts]( "LIEF::MachO::FunctionStarts") \*function\_starts() Return the [MachO::FunctionStarts]() command if present, a nullptr otherwise. #### [` function_starts `]() const [FunctionStarts]( "LIEF::MachO::FunctionStarts") \*function\_starts() const #### [` has_source_version `]() inline bool has\_source\_version() const `true` if the binary has a [MachO::SourceVersion]() command. #### [` source_version `]() [SourceVersion]( "LIEF::MachO::SourceVersion") \*source\_version() Return the [MachO::SourceVersion]() command if present, a nullptr otherwise. #### [` source_version `]() const [SourceVersion]( "LIEF::MachO::SourceVersion") \*source\_version() const #### [` has_version_min `]() inline bool has\_version\_min() const `true` if the binary has a [MachO::VersionMin]() command. #### [` version_min `]() [VersionMin]( "LIEF::MachO::VersionMin") \*version\_min() Return the [MachO::VersionMin]() command if present, a nullptr otherwise. #### [` version_min `]() const [VersionMin]( "LIEF::MachO::VersionMin") \*version\_min() const #### [` has_thread_command `]() inline bool has\_thread\_command() const `true` if the binary has a [MachO::ThreadCommand]() command. #### [` thread_command `]() [ThreadCommand]( "LIEF::MachO::ThreadCommand") \*thread\_command() Return the [MachO::ThreadCommand]() command if present, a nullptr otherwise. #### [` thread_command `]() const [ThreadCommand]( "LIEF::MachO::ThreadCommand") \*thread\_command() const #### [` has_routine_command `]() inline bool has\_routine\_command() const `true` if the binary has a [MachO::Routine]() command. #### [` routine_command `]() [Routine]( "LIEF::MachO::Routine") \*routine\_command() Return the [MachO::Routine]() command if present, a nullptr otherwise. #### [` routine_command `]() const [Routine]( "LIEF::MachO::Routine") \*routine\_command() const #### [` has_rpath `]() inline bool has\_rpath() const `true` if the binary has a [MachO::RPathCommand]() command. #### [` rpath `]() [RPathCommand]( "LIEF::MachO::RPathCommand") \*rpath() Return the [MachO::RPathCommand]() command if present, a nullptr otherwise. #### [` rpath `]() const [RPathCommand]( "LIEF::MachO::RPathCommand") \*rpath() const #### [` rpaths `]() [it\_rpaths]( "LIEF::MachO::Binary::it_rpaths") rpaths() Iterator over **all** the [MachO::RPathCommand]() commands. #### [` rpaths `]() [it\_const\_rpaths]( "LIEF::MachO::Binary::it_const_rpaths") rpaths() const #### [` has_symbol_command `]() inline bool has\_symbol\_command() const `true` if the binary has a [MachO::SymbolCommand]() command. #### [` symbol_command `]() [SymbolCommand]( "LIEF::MachO::SymbolCommand") \*symbol\_command() Return the [MachO::SymbolCommand]() if present, a nullptr otherwise. #### [` symbol_command `]() const [SymbolCommand]( "LIEF::MachO::SymbolCommand") \*symbol\_command() const #### [` has_dynamic_symbol_command `]() inline bool has\_dynamic\_symbol\_command() const `true` if the binary has a [MachO::DynamicSymbolCommand]() command. #### [` dynamic_symbol_command `]() [DynamicSymbolCommand]( "LIEF::MachO::DynamicSymbolCommand") \*dynamic\_symbol\_command() Return the [MachO::SymbolCommand]() if present, a nullptr otherwise. #### [` dynamic_symbol_command `]() const [DynamicSymbolCommand]( "LIEF::MachO::DynamicSymbolCommand") \*dynamic\_symbol\_command() const #### [` has_code_signature `]() inline bool has\_code\_signature() const `true` if the binary is signed with `LC_CODE_SIGNATURE` command #### [` code_signature `]() inline [CodeSignature]( "LIEF::MachO::CodeSignature") \*code\_signature() Return the [MachO::CodeSignature]() if present, a nullptr otherwise. #### [` code_signature `]() const [CodeSignature]( "LIEF::MachO::CodeSignature") \*code\_signature() const #### [` has_code_signature_dir `]() inline bool has\_code\_signature\_dir() const `true` if the binary is signed with the command `DYLIB_CODE_SIGN_DRS` #### [` code_signature_dir `]() inline [CodeSignatureDir]( "LIEF::MachO::CodeSignatureDir") \*code\_signature\_dir() Return the [MachO::CodeSignatureDir]() if present, a nullptr otherwise. #### [` code_signature_dir `]() const [CodeSignatureDir]( "LIEF::MachO::CodeSignatureDir") \*code\_signature\_dir() const #### [` has_data_in_code `]() inline bool has\_data\_in\_code() const `true` if the binary has a [MachO::DataInCode]() command. #### [` data_in_code `]() [DataInCode]( "LIEF::MachO::DataInCode") \*data\_in\_code() Return the [MachO::DataInCode]() if present, a nullptr otherwise. #### [` data_in_code `]() const [DataInCode]( "LIEF::MachO::DataInCode") \*data\_in\_code() const #### [` has_segment_split_info `]() inline bool has\_segment\_split\_info() const `true` if the binary has segment split info. #### [` segment_split_info `]() [SegmentSplitInfo]( "LIEF::MachO::SegmentSplitInfo") \*segment\_split\_info() Return the [MachO::SegmentSplitInfo]() if present, a nullptr otherwise. #### [` segment_split_info `]() const [SegmentSplitInfo]( "LIEF::MachO::SegmentSplitInfo") \*segment\_split\_info() const #### [` has_sub_framework `]() inline bool has\_sub\_framework() const `true` if the binary has a sub framework command. #### [` has_encryption_info `]() inline bool has\_encryption\_info() const `true` if the binary has Encryption Info. #### [` encryption_info `]() [EncryptionInfo]( "LIEF::MachO::EncryptionInfo") \*encryption\_info() Return the [MachO::EncryptionInfo]() if present, a nullptr otherwise. #### [` encryption_info `]() const [EncryptionInfo]( "LIEF::MachO::EncryptionInfo") \*encryption\_info() const #### [` sub_framework `]() [SubFramework]( "LIEF::MachO::SubFramework") \*sub\_framework() Return the [MachO::SubFramework]() if present, a nullptr otherwise. #### [` sub_framework `]() const [SubFramework]( "LIEF::MachO::SubFramework") \*sub\_framework() const #### [` subclients `]() [it\_sub\_clients]( "LIEF::MachO::Binary::it_sub_clients") subclients() Iterator over **all** the [MachO::SubClient]() commands. #### [` subclients `]() [it\_const\_sub\_clients]( "LIEF::MachO::Binary::it_const_sub_clients") subclients() const #### [` has_subclients `]() bool has\_subclients() const #### [` has_dyld_environment `]() inline bool has\_dyld\_environment() const `true` if the binary has Dyld environment variables. #### [` dyld_environment `]() [DyldEnvironment]( "LIEF::MachO::DyldEnvironment") \*dyld\_environment() Return the [MachO::DyldEnvironment]() if present, a nullptr otherwise. #### [` dyld_environment `]() const [DyldEnvironment]( "LIEF::MachO::DyldEnvironment") \*dyld\_environment() const #### [` has_build_version `]() inline bool has\_build\_version() const `true` if the binary has the [BuildVersion]() command. #### [` build_version `]() [BuildVersion]( "LIEF::MachO::BuildVersion") \*build\_version() Return the [MachO::BuildVersion]() if present, a nullptr otherwise. #### [` build_version `]() const [BuildVersion]( "LIEF::MachO::BuildVersion") \*build\_version() const #### [` platform `]() inline [BuildVersion]( "LIEF::MachO::BuildVersion")::[PLATFORMS]( "LIEF::MachO::BuildVersion::PLATFORMS") platform() const Return the platform for which this Mach-O has been compiled for. #### [` is_ios `]() inline bool is\_ios() const True if this binary targets iOS. #### [` is_macos `]() inline bool is\_macos() const True if this binary targets macOS. #### [` has_dyld_chained_fixups `]() inline bool has\_dyld\_chained\_fixups() const `true` if the binary has the command LC\_DYLD\_CHAINED\_FIXUPS. #### [` dyld_chained_fixups `]() [DyldChainedFixups]( "LIEF::MachO::DyldChainedFixups") \*dyld\_chained\_fixups() Return the [MachO::DyldChainedFixups]() if present, a nullptr otherwise. #### [` dyld_chained_fixups `]() const [DyldChainedFixups]( "LIEF::MachO::DyldChainedFixups") \*dyld\_chained\_fixups() const #### [` has_dyld_exports_trie `]() inline bool has\_dyld\_exports\_trie() const `true` if the binary has the command LC\_DYLD\_EXPORTS\_TRIE. #### [` dyld_exports_trie `]() [DyldExportsTrie]( "LIEF::MachO::DyldExportsTrie") \*dyld\_exports\_trie() Return the [MachO::DyldExportsTrie]() if present, a nullptr otherwise. #### [` dyld_exports_trie `]() const [DyldExportsTrie]( "LIEF::MachO::DyldExportsTrie") \*dyld\_exports\_trie() const #### [` has_two_level_hints `]() inline bool has\_two\_level\_hints() const `true` if the binary has the command LC\_TWO\_LEVEL\_HINTS. #### [` two_level_hints `]() inline [TwoLevelHints]( "LIEF::MachO::TwoLevelHints") \*two\_level\_hints() Return the [MachO::TwoLevelHints]() if present, a nullptr otherwise. #### [` two_level_hints `]() const [TwoLevelHints]( "LIEF::MachO::TwoLevelHints") \*two\_level\_hints() const #### [` has_linker_opt_hint `]() inline bool has\_linker\_opt\_hint() const `true` if the binary has the command LC\_LINKER\_OPTIMIZATION\_HINT. #### [` linker_opt_hint `]() inline [LinkerOptHint]( "LIEF::MachO::LinkerOptHint") \*linker\_opt\_hint() Return the [MachO::LinkerOptHint]() if present, a nullptr otherwise. #### [` linker_opt_hint `]() const [LinkerOptHint]( "LIEF::MachO::LinkerOptHint") \*linker\_opt\_hint() const #### [` add_exported_function `]() [ExportInfo]( "LIEF::MachO::ExportInfo") \*add\_exported\_function(uint64\_t address, const std::string &name) Add a symbol in the export trie of the current binary. #### [` add_local_symbol `]() [Symbol]( "LIEF::MachO::Symbol") \*add\_local\_symbol(uint64\_t address, const std::string &name) Add a symbol in LC\_SYMTAB command of the current binary. #### [` objc_metadata `]() std::unique\_ptr<objc::[Metadata]( "LIEF::objc::Metadata")> objc\_metadata() const Return Objective-C metadata if present. #### [` symbol_stubs `]() [stub\_iterator]( "LIEF::MachO::Binary::stub_iterator") symbol\_stubs() const Return an iterator over the symbol stubs. These stubs are involved when calling an **imported** function and are similar to the ELF’s plt/got mechanism. There are located in sections like: `__stubs,__auth_stubs,__symbol_stub,__picsymbolstub4` #### [` has_atom_info `]() inline bool has\_atom\_info() const `true` if the binary has the command LC\_ATOM\_INFO. #### [` atom_info `]() inline AtomInfo \*atom\_info() Return the MachO::AtomInfo if present, a nullptr otherwise. #### [` atom_info `]() const AtomInfo \*atom\_info() const #### [` notes `]() [it\_notes]( "LIEF::MachO::Binary::it_notes") notes() Iterator over the different `LC_NOTE` commands. #### [` notes `]() [it\_const\_notes]( "LIEF::MachO::Binary::it_const_notes") notes() const #### [` has_notes `]() inline bool has\_notes() const True if the binary contains `LC_NOTE` command(s). #### [` has_function_variants `]() inline bool has\_function\_variants() const `true` if the binary has the command `LC_FUNCTION_VARIANTS`. #### [` function_variants `]() inline [FunctionVariants]( "LIEF::MachO::FunctionVariants") \*function\_variants() Return the [FunctionVariants]() if present, a nullptr otherwise. #### [` function_variants `]() const [FunctionVariants]( "LIEF::MachO::FunctionVariants") \*function\_variants() const #### [` has_function_variant_fixups `]() inline bool has\_function\_variant\_fixups() const `true` if the binary has the command `LC_FUNCTION_VARIANT_FIXUPS`. #### [` function_variant_fixups `]() inline [FunctionVariantFixups]( "LIEF::MachO::FunctionVariantFixups") \*function\_variant\_fixups() Return the [FunctionVariantFixups]() if present, a nullptr otherwise. #### [` function_variant_fixups `]() const [FunctionVariantFixups]( "LIEF::MachO::FunctionVariantFixups") \*function\_variant\_fixups() const #### [` Thas_command `]() template<class T> bool has\_command() const #### [` Tcommand `]() template<class T> [T]( "LIEF::MachO::Binary::command::T") \*command() #### [` Tcommand `]() template<class T> const [T]( "LIEF::MachO::Binary::command::T") \*command() const #### [` Tcount_commands `]() template<class T> size\_t count\_commands() const #### [` CMDFuncfor_commands `]() template<class CMD, class Func> [Binary]( "LIEF::MachO::Binary") &for\_commands([Func]( "LIEF::MachO::Binary::for_commands::Func") f) #### [` operator[] `]() inline [LoadCommand]( "LIEF::MachO::LoadCommand") \*operator[]([LoadCommand]( "LIEF::MachO::LoadCommand")::[TYPE]( "LIEF::MachO::LoadCommand::TYPE") type) #### [` operator[] `]() inline const [LoadCommand]( "LIEF::MachO::LoadCommand") \*operator[]([LoadCommand]( "LIEF::MachO::LoadCommand")::[TYPE]( "LIEF::MachO::LoadCommand::TYPE") type) const #### [` ctor_functions `]() virtual LIEF::[Binary]( "LIEF::Binary")::[functions\_t]( "LIEF::Binary::functions_t") ctor\_functions() const override Return the list of the MachO’s constructors. #### [` functions `]() LIEF::[Binary]( "LIEF::Binary")::[functions\_t]( "LIEF::Binary::functions_t") functions() const Return all the functions found in this MachO. #### [` unwind_functions `]() LIEF::[Binary]( "LIEF::Binary")::[functions\_t]( "LIEF::Binary::functions_t") unwind\_functions() const Return the functions found in the `__unwind_info` section. #### [` has_filesets `]() inline bool has\_filesets() const `true` if the binary has a [LoadCommand::TYPE::FILESET\_ENTRY]() command #### [` fileset_name `]() inline std::string\_view fileset\_name() const Name associated with the `LC_FILESET_ENTRY` for this MachO. For instance: `com.apple.kec.corecrypto`. #### [` fileset_addr `]() inline uint64\_t fileset\_addr() const Original address associated with the `LC_FILESET_ENTRY` for this MachO. #### [` add `]() [Symbol]( "LIEF::MachO::Symbol") &add(const [Symbol]( "LIEF::MachO::Symbol") &symbol) Add a symbol to this binary. #### [` ~Binary `]() ~Binary() override #### [` shift `]() [ok\_error\_t]( "LIEF::ok_error_t") shift(size\_t value) Shift the content located right after the Load commands table. This operation can be used to add a new command. #### [` shift_linkedit `]() [ok\_error\_t]( "LIEF::ok_error_t") shift\_linkedit(size\_t width) Shift the position on the \_\_LINKEDIT data by `width`. #### [` memory_base_address `]() inline uint64\_t memory\_base\_address() const If this Mach-O binary has been parsed from memory, it returns the in-memory base address of this binary. Otherwise, it returns 0 #### [` support_arm64_ptr_auth `]() inline bool support\_arm64\_ptr\_auth() const Check if the binary is supporting ARM64 pointer authentication (arm64e). #### [` bindings `]() [it\_bindings]( "LIEF::MachO::Binary::it_bindings") bindings() const Return an iterator over the binding info which can come from either [DyldInfo]() or [DyldChainedFixups]() commands. #### [` get_function_address `]() virtual [result]( "LIEF::result")<uint64\_t> get\_function\_address(const std::string &name) const override Try to get the address for the function’s name given in parameter. #### [` overlay `]() inline span<const uint8\_t> overlay() const #### [` sort_segments `]() void sort\_segments() #### [` refresh_seg_offset `]() void refresh\_seg\_offset() Public Static Functions #### [` is_exported `]() static bool is\_exported(const [Symbol]( "LIEF::MachO::Symbol") &symbol) Check if the given symbol is exported. #### [` is_imported `]() static bool is\_imported(const [Symbol]( "LIEF::MachO::Symbol") &symbol) Check if the given symbol is an imported one. #### [` classof `]() static inline bool classof(const LIEF::[Binary]( "LIEF::Binary") \*bin) #### [` can_cache_segment `]() static bool can\_cache\_segment(const [SegmentCommand]( "LIEF::MachO::SegmentCommand") &segment) Check if the given segment can go in the offset\_seg\_ cache. #### [` range_t `]() struct range\_t Public Functions ##### [` size `]() inline uint64\_t size() const ##### [` empty `]() inline bool empty() const Public Members ##### [` start `]() uint64\_t start = 0 ##### [` end `]() uint64\_t end = 0 #### [` KeyCmp `]() struct KeyCmp Public Functions ##### [` operator() `]() bool operator()(const [Relocation]( "LIEF::MachO::Relocation") \*lhs, const [Relocation]( "LIEF::MachO::Relocation") \*rhs) const --- ## [Header]() ### [` Header `]() class Header : public LIEF::Object Class that represents the Mach-O header. Public Types #### [` FILE_TYPE `]() enum class FILE\_TYPE : uint32\_t *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` OBJECT `]() enumerator OBJECT = 0x1u ##### [` EXECUTE `]() enumerator EXECUTE = 0x2u ##### [` FVMLIB `]() enumerator FVMLIB = 0x3u ##### [` CORE `]() enumerator CORE = 0x4u ##### [` PRELOAD `]() enumerator PRELOAD = 0x5u ##### [` DYLIB `]() enumerator DYLIB = 0x6u ##### [` DYLINKER `]() enumerator DYLINKER = 0x7u ##### [` BUNDLE `]() enumerator BUNDLE = 0x8u ##### [` DYLIB_STUB `]() enumerator DYLIB\_STUB = 0x9u ##### [` DSYM `]() enumerator DSYM = 0xAu ##### [` KEXT_BUNDLE `]() enumerator KEXT\_BUNDLE = 0xBu ##### [` FILESET `]() enumerator FILESET = 0xCu ##### [` GPU_EXECUTE `]() enumerator GPU\_EXECUTE = 0xDu ##### [` GPU_DYLIB `]() enumerator GPU\_DYLIB = 0xEu #### [` FLAGS `]() enum class FLAGS : uint32\_t *Values:* ##### [` NOUNDEFS `]() enumerator NOUNDEFS = 0x00000001u ##### [` INCRLINK `]() enumerator INCRLINK = 0x00000002u ##### [` DYLDLINK `]() enumerator DYLDLINK = 0x00000004u ##### [` BINDATLOAD `]() enumerator BINDATLOAD = 0x00000008u ##### [` PREBOUND `]() enumerator PREBOUND = 0x00000010u ##### [` SPLIT_SEGS `]() enumerator SPLIT\_SEGS = 0x00000020u ##### [` LAZY_INIT `]() enumerator LAZY\_INIT = 0x00000040u ##### [` TWOLEVEL `]() enumerator TWOLEVEL = 0x00000080u ##### [` FORCE_FLAT `]() enumerator FORCE\_FLAT = 0x00000100u ##### [` NOMULTIDEFS `]() enumerator NOMULTIDEFS = 0x00000200u ##### [` NOFIXPREBINDING `]() enumerator NOFIXPREBINDING = 0x00000400u ##### [` PREBINDABLE `]() enumerator PREBINDABLE = 0x00000800u ##### [` ALLMODSBOUND `]() enumerator ALLMODSBOUND = 0x00001000u ##### [` SUBSECTIONS_VIA_SYMBOLS `]() enumerator SUBSECTIONS\_VIA\_SYMBOLS = 0x00002000u ##### [` CANONICAL `]() enumerator CANONICAL = 0x00004000u ##### [` WEAK_DEFINES `]() enumerator WEAK\_DEFINES = 0x00008000u ##### [` BINDS_TO_WEAK `]() enumerator BINDS\_TO\_WEAK = 0x00010000u ##### [` ALLOW_STACK_EXECUTION `]() enumerator ALLOW\_STACK\_EXECUTION = 0x00020000u ##### [` ROOT_SAFE `]() enumerator ROOT\_SAFE = 0x00040000u ##### [` SETUID_SAFE `]() enumerator SETUID\_SAFE = 0x00080000u ##### [` NO_REEXPORTED_DYLIBS `]() enumerator NO\_REEXPORTED\_DYLIBS = 0x00100000u ##### [` PIE `]() enumerator PIE = 0x00200000u ##### [` DEAD_STRIPPABLE_DYLIB `]() enumerator DEAD\_STRIPPABLE\_DYLIB = 0x00400000u ##### [` HAS_TLV_DESCRIPTORS `]() enumerator HAS\_TLV\_DESCRIPTORS = 0x00800000u ##### [` NO_HEAP_EXECUTION `]() enumerator NO\_HEAP\_EXECUTION = 0x01000000u ##### [` APP_EXTENSION_SAFE `]() enumerator APP\_EXTENSION\_SAFE = 0x02000000u ##### [` NLIST_OUTOFSYNC_WITH_DYLDINFO `]() enumerator NLIST\_OUTOFSYNC\_WITH\_DYLDINFO = 0x04000000u ##### [` SIM_SUPPORT `]() enumerator SIM\_SUPPORT = 0x08000000u ##### [` IMPLICIT_PAGEZERO `]() enumerator IMPLICIT\_PAGEZERO = 0x10000000u ##### [` DYLIB_IN_CACHE `]() enumerator DYLIB\_IN\_CACHE = 0x80000000u #### [` CPU_TYPE `]() enum class CPU\_TYPE : int32\_t *Values:* ##### [` ANY `]() enumerator ANY = -1 ##### [` X86 `]() enumerator X86 = 7 ##### [` X86_64 `]() enumerator X86\_64 = 7 | [ABI64]( "LIEF::MachO::Header::ABI64") ##### [` MIPS `]() enumerator MIPS = 8 ##### [` MC98000 `]() enumerator MC98000 = 10 ##### [` HPPA `]() enumerator HPPA = 11 ##### [` ARM `]() enumerator ARM = 12 ##### [` ARM64 `]() enumerator ARM64 = 12 | [ABI64]( "LIEF::MachO::Header::ABI64") ##### [` MC88000 `]() enumerator MC88000 = 13 ##### [` SPARC `]() enumerator SPARC = 14 ##### [` I860 `]() enumerator I860 = 15 ##### [` ALPHA `]() enumerator ALPHA = 16 ##### [` POWERPC `]() enumerator POWERPC = 18 ##### [` POWERPC64 `]() enumerator POWERPC64 = 18 | [ABI64]( "LIEF::MachO::Header::ABI64") ##### [` APPLE_GPU `]() enumerator APPLE\_GPU = 19 | [ABI64]( "LIEF::MachO::Header::ABI64") ##### [` AMD_GPU `]() enumerator AMD\_GPU = 20 | [ABI64]( "LIEF::MachO::Header::ABI64") ##### [` INTEL_GPU `]() enumerator INTEL\_GPU = 21 | [ABI64]( "LIEF::MachO::Header::ABI64") ##### [` AIR64 `]() enumerator AIR64 = 23 | [ABI64]( "LIEF::MachO::Header::ABI64") Public Functions #### [` Header `]() Header() = default #### [` operator= `]() [Header]( "LIEF::MachO::Header") &operator=(const [Header]( "LIEF::MachO::Header") &copy) = default #### [` Header `]() Header(const [Header]( "LIEF::MachO::Header::Header") &copy) = default #### [` ~Header `]() ~Header() override = default #### [` magic `]() inline [MACHO\_TYPES]( "LIEF::MachO::MACHO_TYPES") magic() const The Mach-O magic bytes. These bytes determine whether it is a 32 bits Mach-O, a 64 bits Mach-O files etc. #### [` cpu_type `]() inline [CPU\_TYPE]( "LIEF::MachO::Header::CPU_TYPE") cpu\_type() const The CPU architecture targeted by this binary. #### [` cpu_subtype `]() inline uint32\_t cpu\_subtype() const Return the CPU subtype supported by the Mach-O binary. For ARM architectures, this value could represent the minimum version for which the Mach-O binary has been compiled for. #### [` file_type `]() inline [FILE\_TYPE]( "LIEF::MachO::Header::FILE_TYPE") file\_type() const Return the type of the Mach-O file (executable, object, shared library, …). #### [` flags_list `]() std::vector<[FLAGS]( "LIEF::MachO::Header::FLAGS")> flags\_list() const Return the [FLAGS]() as a list. #### [` has `]() bool has([FLAGS]( "LIEF::MachO::Header::FLAGS") flag) const Check if the given HEADER\_FLAGS is present in the header’s flags. #### [` nb_cmds `]() inline uint32\_t nb\_cmds() const Number of [LoadCommand]() present in the Mach-O binary. #### [` sizeof_cmds `]() inline uint32\_t sizeof\_cmds() const The size of **all** the [LoadCommand](). #### [` flags `]() inline uint32\_t flags() const [Header]() flags (cf. HEADER\_FLAGS). > **See also** > > [flags\_list]() #### [` reserved `]() inline uint32\_t reserved() const According to the official documentation, a reserved value. #### [` add `]() void add([FLAGS]( "LIEF::MachO::Header::FLAGS") flag) #### [` magic `]() inline void magic([MACHO\_TYPES]( "LIEF::MachO::MACHO_TYPES") magic) #### [` cpu_type `]() inline void cpu\_type([CPU\_TYPE]( "LIEF::MachO::Header::CPU_TYPE") type) #### [` cpu_subtype `]() inline void cpu\_subtype(uint32\_t cpusubtype) #### [` file_type `]() inline void file\_type([FILE\_TYPE]( "LIEF::MachO::Header::FILE_TYPE") filetype) #### [` nb_cmds `]() inline void nb\_cmds(uint32\_t ncmds) #### [` sizeof_cmds `]() inline void sizeof\_cmds(uint32\_t sizeofcmds) #### [` flags `]() inline void flags(uint32\_t flags) #### [` is_32bit `]() inline bool is\_32bit() const True if the binary is 32-bit. #### [` is_64bit `]() inline bool is\_64bit() const True if the binary is 64-bit. #### [` remove `]() void remove([FLAGS]( "LIEF::MachO::Header::FLAGS") flag) #### [` reserved `]() inline void reserved(uint32\_t reserved) #### [` operator+= `]() inline [Header]( "LIEF::MachO::Header") &operator+=([FLAGS]( "LIEF::MachO::Header::FLAGS") c) #### [` operator-= `]() inline [Header]( "LIEF::MachO::Header") &operator-=([FLAGS]( "LIEF::MachO::Header::FLAGS") c) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Attributes #### [` ABI64 `]() static int ABI64 = 0x01000000 #### [` SUBTYPE_MASK `]() static uint32\_t SUBTYPE\_MASK = 0xff000000 #### [` SUBTYPE_LIB64 `]() static uint32\_t SUBTYPE\_LIB64 = 0x80000000 #### [` CPU_SUBTYPE_ARM64_ARM64E `]() static auto CPU\_SUBTYPE\_ARM64\_ARM64E = 2 Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Header]( "LIEF::MachO::Header") &hdr) --- ## [Builder]() ### [` Builder `]() class Builder Class used to rebuild a Mach-O file. Public Functions #### [` Builder `]() Builder() = delete #### [` ~Builder `]() ~Builder() Public Static Functions #### [` write `]() static [ok\_error\_t]( "LIEF::ok_error_t") write([Binary]( "LIEF::MachO::Binary") &binary, const std::string &filename) #### [` write `]() static [ok\_error\_t]( "LIEF::ok_error_t") write([Binary]( "LIEF::MachO::Binary") &binary, const std::string &filename, [config\_t]( "LIEF::MachO::Builder::config_t") config) #### [` write `]() static [ok\_error\_t]( "LIEF::ok_error_t") write([Binary]( "LIEF::MachO::Binary") &binary, std::vector<uint8\_t> &out) #### [` write `]() static [ok\_error\_t]( "LIEF::ok_error_t") write([Binary]( "LIEF::MachO::Binary") &binary, std::vector<uint8\_t> &out, [config\_t]( "LIEF::MachO::Builder::config_t") config) #### [` write `]() static [ok\_error\_t]( "LIEF::ok_error_t") write([Binary]( "LIEF::MachO::Binary") &binary, std::ostream &out) #### [` write `]() static [ok\_error\_t]( "LIEF::ok_error_t") write([Binary]( "LIEF::MachO::Binary") &binary, std::ostream &out, [config\_t]( "LIEF::MachO::Builder::config_t") config) #### [` write `]() static [ok\_error\_t]( "LIEF::ok_error_t") write([FatBinary]( "LIEF::MachO::FatBinary") &fat, const std::string &filename) #### [` write `]() static [ok\_error\_t]( "LIEF::ok_error_t") write([FatBinary]( "LIEF::MachO::FatBinary") &fat, const std::string &filename, [config\_t]( "LIEF::MachO::Builder::config_t") config) #### [` write `]() static [ok\_error\_t]( "LIEF::ok_error_t") write([FatBinary]( "LIEF::MachO::FatBinary") &fat, std::vector<uint8\_t> &out) #### [` write `]() static [ok\_error\_t]( "LIEF::ok_error_t") write([FatBinary]( "LIEF::MachO::FatBinary") &fat, std::vector<uint8\_t> &out, [config\_t]( "LIEF::MachO::Builder::config_t") config) #### [` write `]() static [ok\_error\_t]( "LIEF::ok_error_t") write([FatBinary]( "LIEF::MachO::FatBinary") &fat, std::ostream &out) #### [` write `]() static [ok\_error\_t]( "LIEF::ok_error_t") write([FatBinary]( "LIEF::MachO::FatBinary") &fat, std::ostream &out, [config\_t]( "LIEF::MachO::Builder::config_t") config) #### [` config_t `]() struct config\_t Options to tweak the building process. Public Members ##### [` linkedit `]() bool linkedit = true --- ## [DylibCommand]() ### [` DylibCommand `]() class DylibCommand : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class which represents a library dependency. Public Types #### [` version_t `]() using version\_t = std::array<uint16\_t, 3> Public Functions #### [` DylibCommand `]() DylibCommand() = default #### [` DylibCommand `]() DylibCommand(const details::dylib\_command &cmd) #### [` operator= `]() [DylibCommand]( "LIEF::MachO::DylibCommand") &operator=(const [DylibCommand]( "LIEF::MachO::DylibCommand") &copy) = default #### [` DylibCommand `]() DylibCommand(const [DylibCommand]( "LIEF::MachO::DylibCommand::DylibCommand") &copy) = default #### [` ~DylibCommand `]() ~DylibCommand() override = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` name `]() inline std::string\_view name() const Library name. #### [` name_offset `]() inline uint32\_t name\_offset() const Original string offset of the name. #### [` timestamp `]() inline uint32\_t timestamp() const Date and Time when the shared library was built. #### [` current_version `]() inline [version\_t]( "LIEF::MachO::DylibCommand::version_t") current\_version() const Current version of the shared library. #### [` compatibility_version `]() inline [version\_t]( "LIEF::MachO::DylibCommand::version_t") compatibility\_version() const Compatibility version of the shared library. #### [` name `]() inline void name(std::string name) #### [` timestamp `]() inline void timestamp(uint32\_t timestamp) #### [` current_version `]() inline void current\_version([version\_t]( "LIEF::MachO::DylibCommand::version_t") version) #### [` compatibility_version `]() inline void compatibility\_version([version\_t]( "LIEF::MachO::DylibCommand::version_t") version) #### [` print `]() virtual std::ostream &print(std::ostream &os) const override #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` int2version `]() static inline [version\_t]( "LIEF::MachO::DylibCommand::version_t") int2version(uint32\_t version) Helper to convert an integer into a version array. #### [` version2int `]() static inline uint32\_t version2int([version\_t]( "LIEF::MachO::DylibCommand::version_t") version) Helper to convert a version array into an integer. #### [` weak_dylib `]() static [DylibCommand]( "LIEF::MachO::DylibCommand") weak\_dylib(const std::string &name, uint32\_t timestamp = 0, uint32\_t current\_version = 0, uint32\_t compat\_version = 0) Factory function to generate a LC\_LOAD\_WEAK\_DYLIB library. #### [` id_dylib `]() static [DylibCommand]( "LIEF::MachO::DylibCommand") id\_dylib(const std::string &name, uint32\_t timestamp = 0, uint32\_t current\_version = 0, uint32\_t compat\_version = 0) Factory function to generate a LC\_ID\_DYLIB library. #### [` load_dylib `]() static [DylibCommand]( "LIEF::MachO::DylibCommand") load\_dylib(const std::string &name, uint32\_t timestamp = 2, uint32\_t current\_version = 0, uint32\_t compat\_version = 0) Factory function to generate a LC\_LOAD\_DYLIB library. #### [` reexport_dylib `]() static [DylibCommand]( "LIEF::MachO::DylibCommand") reexport\_dylib(const std::string &name, uint32\_t timestamp = 0, uint32\_t current\_version = 0, uint32\_t compat\_version = 0) Factory function to generate a LC\_REEXPORT\_DYLIB library. #### [` load_upward_dylib `]() static [DylibCommand]( "LIEF::MachO::DylibCommand") load\_upward\_dylib(const std::string &name, uint32\_t timestamp = 0, uint32\_t current\_version = 0, uint32\_t compat\_version = 0) Factory function to generate a LC\_LOAD\_UPWARD\_DYLIB library. #### [` lazy_load_dylib `]() static [DylibCommand]( "LIEF::MachO::DylibCommand") lazy\_load\_dylib(const std::string &name, uint32\_t timestamp = 0, uint32\_t current\_version = 0, uint32\_t compat\_version = 0) Factory function to generate a LC\_LAZY\_LOAD\_DYLIB library. #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [DylinkerCommand]() ### [` DylinkerCommand `]() class DylinkerCommand : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class that represents the Mach-O linker, also named loader. Most of the time, [DylinkerCommand::name()]() should return `/usr/lib/dyld`. Public Functions #### [` DylinkerCommand `]() DylinkerCommand() = default #### [` DylinkerCommand `]() DylinkerCommand(const details::dylinker\_command &cmd) #### [` DylinkerCommand `]() DylinkerCommand(std::string name) #### [` operator= `]() [DylinkerCommand]( "LIEF::MachO::DylinkerCommand") &operator=(const [DylinkerCommand]( "LIEF::MachO::DylinkerCommand") &copy) = default #### [` DylinkerCommand `]() DylinkerCommand(const [DylinkerCommand]( "LIEF::MachO::DylinkerCommand::DylinkerCommand") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` ~DylinkerCommand `]() ~DylinkerCommand() override = default #### [` print `]() virtual std::ostream &print(std::ostream &os) const override #### [` name `]() inline std::string\_view name() const Path to the linker (or loader). #### [` name `]() inline void name(std::string name) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [DynamicSymbolCommand]() ### [` DynamicSymbolCommand `]() class DynamicSymbolCommand : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class that represents the LC\_DYSYMTAB command. This command completes the LC\_SYMTAB ([SymbolCommand]()) to provide a better granularity over the symbols layout. Public Types #### [` indirect_symbols_t `]() using indirect\_symbols\_t = std::vector<[Symbol]( "LIEF::MachO::Symbol")\*> Container for the indirect symbols references (owned by [MachO::Binary]()). #### [` it_indirect_symbols `]() using it\_indirect\_symbols = [ref\_iterator]( "LIEF::ref_iterator")<[indirect\_symbols\_t]( "LIEF::MachO::DynamicSymbolCommand::indirect_symbols_t")&> Iterator for the indirect symbols referenced by this command. #### [` it_const_indirect_symbols `]() using it\_const\_indirect\_symbols = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [indirect\_symbols\_t]( "LIEF::MachO::DynamicSymbolCommand::indirect_symbols_t")&> Public Functions #### [` DynamicSymbolCommand `]() DynamicSymbolCommand() #### [` DynamicSymbolCommand `]() DynamicSymbolCommand(const details::dysymtab\_command &cmd) #### [` operator= `]() [DynamicSymbolCommand]( "LIEF::MachO::DynamicSymbolCommand") &operator=(const [DynamicSymbolCommand]( "LIEF::MachO::DynamicSymbolCommand") &copy) = default #### [` DynamicSymbolCommand `]() DynamicSymbolCommand(const [DynamicSymbolCommand]( "LIEF::MachO::DynamicSymbolCommand::DynamicSymbolCommand") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` ~DynamicSymbolCommand `]() ~DynamicSymbolCommand() override = default #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override #### [` idx_local_symbol `]() inline uint32\_t idx\_local\_symbol() const Index of the first symbol in the group of local symbols. #### [` nb_local_symbols `]() inline uint32\_t nb\_local\_symbols() const Number of symbols in the group of local symbols. #### [` idx_external_define_symbol `]() inline uint32\_t idx\_external\_define\_symbol() const Index of the first symbol in the group of defined external symbols. #### [` nb_external_define_symbols `]() inline uint32\_t nb\_external\_define\_symbols() const Number of symbols in the group of defined external symbols. #### [` idx_undefined_symbol `]() inline uint32\_t idx\_undefined\_symbol() const Index of the first symbol in the group of undefined external symbols. #### [` nb_undefined_symbols `]() inline uint32\_t nb\_undefined\_symbols() const Number of symbols in the group of undefined external symbols. #### [` toc_offset `]() inline uint32\_t toc\_offset() const Byte offset from the start of the file to the table of contents data. Table of content is used by legacy Mach-O loader and this field should be set to 0 #### [` nb_toc `]() inline uint32\_t nb\_toc() const Number of entries in the table of contents. Should be set to 0 on recent Mach-O #### [` module_table_offset `]() inline uint32\_t module\_table\_offset() const Byte offset from the start of the file to the module table data. This field seems unused by recent Mach-O loader and should be set to 0 #### [` nb_module_table `]() inline uint32\_t nb\_module\_table() const Number of entries in the module table. This field seems unused by recent Mach-O loader and should be set to 0 #### [` external_reference_symbol_offset `]() inline uint32\_t external\_reference\_symbol\_offset() const Byte offset from the start of the file to the external reference table data. This field seems unused by recent Mach-O loader and should be set to 0 #### [` nb_external_reference_symbols `]() inline uint32\_t nb\_external\_reference\_symbols() const Number of entries in the external reference table. This field seems unused by recent Mach-O loader and should be set to 0 #### [` indirect_symbol_offset `]() inline uint32\_t indirect\_symbol\_offset() const Byte offset from the start of the file to the indirect symbol table data. Indirect symbol table is used by the loader to speed-up symbol resolution during the *lazy binding* process References: - dyld-519.2.1/src/ImageLoaderMachOCompressed.cpp - dyld-519.2.1/src/ImageLoaderMachOClassic.cpp #### [` nb_indirect_symbols `]() inline uint32\_t nb\_indirect\_symbols() const Number of entries in the indirect symbol table. > **See also** > > [indirect\_symbol\_offset]() #### [` external_relocation_offset `]() inline uint32\_t external\_relocation\_offset() const Byte offset from the start of the file to the external relocation table data. This field seems unused by recent Mach-O loader and should be set to 0 #### [` nb_external_relocations `]() inline uint32\_t nb\_external\_relocations() const Number of entries in the external relocation table. This field seems unused by recent Mach-O loader and should be set to 0 #### [` local_relocation_offset `]() inline uint32\_t local\_relocation\_offset() const Byte offset from the start of the file to the local relocation table data. This field seems unused by recent Mach-O loader and should be set to 0 #### [` nb_local_relocations `]() inline uint32\_t nb\_local\_relocations() const Number of entries in the local relocation table. This field seems unused by recent Mach-O loader and should be set to 0 #### [` idx_local_symbol `]() inline void idx\_local\_symbol(uint32\_t value) #### [` nb_local_symbols `]() inline void nb\_local\_symbols(uint32\_t value) #### [` idx_external_define_symbol `]() inline void idx\_external\_define\_symbol(uint32\_t value) #### [` nb_external_define_symbols `]() inline void nb\_external\_define\_symbols(uint32\_t value) #### [` idx_undefined_symbol `]() inline void idx\_undefined\_symbol(uint32\_t value) #### [` nb_undefined_symbols `]() inline void nb\_undefined\_symbols(uint32\_t value) #### [` toc_offset `]() inline void toc\_offset(uint32\_t value) #### [` nb_toc `]() inline void nb\_toc(uint32\_t value) #### [` module_table_offset `]() inline void module\_table\_offset(uint32\_t value) #### [` nb_module_table `]() inline void nb\_module\_table(uint32\_t value) #### [` external_reference_symbol_offset `]() inline void external\_reference\_symbol\_offset(uint32\_t value) #### [` nb_external_reference_symbols `]() inline void nb\_external\_reference\_symbols(uint32\_t value) #### [` indirect_symbol_offset `]() inline void indirect\_symbol\_offset(uint32\_t value) #### [` nb_indirect_symbols `]() inline void nb\_indirect\_symbols(uint32\_t value) #### [` external_relocation_offset `]() inline void external\_relocation\_offset(uint32\_t value) #### [` nb_external_relocations `]() inline void nb\_external\_relocations(uint32\_t value) #### [` local_relocation_offset `]() inline void local\_relocation\_offset(uint32\_t value) #### [` nb_local_relocations `]() inline void nb\_local\_relocations(uint32\_t value) #### [` indirect_symbols `]() inline [it\_indirect\_symbols]( "LIEF::MachO::DynamicSymbolCommand::it_indirect_symbols") indirect\_symbols() Iterator over the indirect symbols indexed by this command. #### [` indirect_symbols `]() inline [it\_const\_indirect\_symbols]( "LIEF::MachO::DynamicSymbolCommand::it_const_indirect_symbols") indirect\_symbols() const Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [LoadCommand]() ### [` LoadCommand `]() class LoadCommand : public LIEF::Object Base class for the Mach-O load commands. Subclassed by LIEF::MachO::AtomInfo, [LIEF::MachO::BuildVersion](), [LIEF::MachO::CodeSignature](), [LIEF::MachO::CodeSignatureDir](), [LIEF::MachO::DataInCode](), [LIEF::MachO::DyldChainedFixups](), [LIEF::MachO::DyldEnvironment](), [LIEF::MachO::DyldExportsTrie](), [LIEF::MachO::DyldInfo](), [LIEF::MachO::DylibCommand](), [LIEF::MachO::DylinkerCommand](), [LIEF::MachO::DynamicSymbolCommand](), [LIEF::MachO::EncryptionInfo](), [LIEF::MachO::FilesetCommand](), [LIEF::MachO::FunctionStarts](), [LIEF::MachO::FunctionVariantFixups](), [LIEF::MachO::FunctionVariants](), [LIEF::MachO::LazyLoadDylibInfo](), [LIEF::MachO::LinkerOptHint](), [LIEF::MachO::MainCommand](), [LIEF::MachO::NoteCommand](), [LIEF::MachO::RPathCommand](), [LIEF::MachO::Routine](), [LIEF::MachO::SegmentCommand](), [LIEF::MachO::SegmentSplitInfo](), [LIEF::MachO::SourceVersion](), [LIEF::MachO::SubClient](), [LIEF::MachO::SubFramework](), [LIEF::MachO::SymbolCommand](), [LIEF::MachO::ThreadCommand](), [LIEF::MachO::TwoLevelHints](), [LIEF::MachO::UUIDCommand](), [LIEF::MachO::UnknownCommand](), [LIEF::MachO::VersionMin]() Public Types #### [` TYPE `]() enum class TYPE : uint64\_t *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` SEGMENT `]() enumerator SEGMENT = 0x00000001u ##### [` SYMTAB `]() enumerator SYMTAB = 0x00000002u ##### [` SYMSEG `]() enumerator SYMSEG = 0x00000003u ##### [` THREAD `]() enumerator THREAD = 0x00000004u ##### [` UNIXTHREAD `]() enumerator UNIXTHREAD = 0x00000005u ##### [` LOADFVMLIB `]() enumerator LOADFVMLIB = 0x00000006u ##### [` IDFVMLIB `]() enumerator IDFVMLIB = 0x00000007u ##### [` IDENT `]() enumerator IDENT = 0x00000008u ##### [` FVMFILE `]() enumerator FVMFILE = 0x00000009u ##### [` PREPAGE `]() enumerator PREPAGE = 0x0000000Au ##### [` DYSYMTAB `]() enumerator DYSYMTAB = 0x0000000Bu ##### [` LOAD_DYLIB `]() enumerator LOAD\_DYLIB = 0x0000000Cu ##### [` ID_DYLIB `]() enumerator ID\_DYLIB = 0x0000000Du ##### [` LOAD_DYLINKER `]() enumerator LOAD\_DYLINKER = 0x0000000Eu ##### [` ID_DYLINKER `]() enumerator ID\_DYLINKER = 0x0000000Fu ##### [` PREBOUND_DYLIB `]() enumerator PREBOUND\_DYLIB = 0x00000010u ##### [` ROUTINES `]() enumerator ROUTINES = 0x00000011u ##### [` SUB_FRAMEWORK `]() enumerator SUB\_FRAMEWORK = 0x00000012u ##### [` SUB_UMBRELLA `]() enumerator SUB\_UMBRELLA = 0x00000013u ##### [` SUB_CLIENT `]() enumerator SUB\_CLIENT = 0x00000014u ##### [` SUB_LIBRARY `]() enumerator SUB\_LIBRARY = 0x00000015u ##### [` TWOLEVEL_HINTS `]() enumerator TWOLEVEL\_HINTS = 0x00000016u ##### [` PREBIND_CKSUM `]() enumerator PREBIND\_CKSUM = 0x00000017u ##### [` LOAD_WEAK_DYLIB `]() enumerator LOAD\_WEAK\_DYLIB = 0x80000018u ##### [` SEGMENT_64 `]() enumerator SEGMENT\_64 = 0x00000019u ##### [` ROUTINES_64 `]() enumerator ROUTINES\_64 = 0x0000001Au ##### [` UUID `]() enumerator UUID = 0x0000001Bu ##### [` RPATH `]() enumerator RPATH = 0x8000001Cu ##### [` CODE_SIGNATURE `]() enumerator CODE\_SIGNATURE = 0x0000001Du ##### [` SEGMENT_SPLIT_INFO `]() enumerator SEGMENT\_SPLIT\_INFO = 0x0000001Eu ##### [` REEXPORT_DYLIB `]() enumerator REEXPORT\_DYLIB = 0x8000001Fu ##### [` LAZY_LOAD_DYLIB `]() enumerator LAZY\_LOAD\_DYLIB = 0x00000020u ##### [` ENCRYPTION_INFO `]() enumerator ENCRYPTION\_INFO = 0x00000021u ##### [` DYLD_INFO `]() enumerator DYLD\_INFO = 0x00000022u ##### [` DYLD_INFO_ONLY `]() enumerator DYLD\_INFO\_ONLY = 0x80000022u ##### [` LOAD_UPWARD_DYLIB `]() enumerator LOAD\_UPWARD\_DYLIB = 0x80000023u ##### [` VERSION_MIN_MACOSX `]() enumerator VERSION\_MIN\_MACOSX = 0x00000024u ##### [` VERSION_MIN_IPHONEOS `]() enumerator VERSION\_MIN\_IPHONEOS = 0x00000025u ##### [` FUNCTION_STARTS `]() enumerator FUNCTION\_STARTS = 0x00000026u ##### [` DYLD_ENVIRONMENT `]() enumerator DYLD\_ENVIRONMENT = 0x00000027u ##### [` MAIN `]() enumerator MAIN = 0x80000028u ##### [` DATA_IN_CODE `]() enumerator DATA\_IN\_CODE = 0x00000029u ##### [` SOURCE_VERSION `]() enumerator SOURCE\_VERSION = 0x0000002Au ##### [` DYLIB_CODE_SIGN_DRS `]() enumerator DYLIB\_CODE\_SIGN\_DRS = 0x0000002Bu ##### [` ENCRYPTION_INFO_64 `]() enumerator ENCRYPTION\_INFO\_64 = 0x0000002Cu ##### [` LINKER_OPTION `]() enumerator LINKER\_OPTION = 0x0000002Du ##### [` LINKER_OPTIMIZATION_HINT `]() enumerator LINKER\_OPTIMIZATION\_HINT = 0x0000002Eu ##### [` VERSION_MIN_TVOS `]() enumerator VERSION\_MIN\_TVOS = 0x0000002Fu ##### [` VERSION_MIN_WATCHOS `]() enumerator VERSION\_MIN\_WATCHOS = 0x00000030u ##### [` NOTE `]() enumerator NOTE = 0x00000031u ##### [` BUILD_VERSION `]() enumerator BUILD\_VERSION = 0x00000032u ##### [` DYLD_EXPORTS_TRIE `]() enumerator DYLD\_EXPORTS\_TRIE = 0x80000033u ##### [` DYLD_CHAINED_FIXUPS `]() enumerator DYLD\_CHAINED\_FIXUPS = 0x80000034u ##### [` FILESET_ENTRY `]() enumerator FILESET\_ENTRY = 0x80000035u ##### [` ATOM_INFO `]() enumerator ATOM\_INFO = 0x00000036u ##### [` FUNCTION_VARIANTS `]() enumerator FUNCTION\_VARIANTS = 0x00000037u ##### [` FUNCTION_VARIANT_FIXUPS `]() enumerator FUNCTION\_VARIANT\_FIXUPS = 0x00000038u ##### [` TARGET_TRIPLE `]() enumerator TARGET\_TRIPLE = 0x00000039u ##### [` LAZY_LOAD_DYLIB_INFO `]() enumerator LAZY\_LOAD\_DYLIB\_INFO = 0x0000003Au ##### [` LIEF_UNKNOWN `]() enumerator LIEF\_UNKNOWN = 0xffee0001u #### [` raw_t `]() using raw\_t = std::vector<uint8\_t> Public Functions #### [` LoadCommand `]() LoadCommand() = default #### [` LoadCommand `]() LoadCommand(const details::load\_command &command) #### [` LoadCommand `]() inline LoadCommand([LoadCommand]( "LIEF::MachO::LoadCommand::LoadCommand")::TYPE type, uint32\_t size) #### [` operator= `]() [LoadCommand]( "LIEF::MachO::LoadCommand") &operator=(const [LoadCommand]( "LIEF::MachO::LoadCommand") &copy) = default #### [` LoadCommand `]() LoadCommand(const [LoadCommand]( "LIEF::MachO::LoadCommand::LoadCommand") &copy) = default #### [` swap `]() void swap([LoadCommand]( "LIEF::MachO::LoadCommand") &other) noexcept #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const #### [` ~LoadCommand `]() ~LoadCommand() override = default #### [` command `]() inline [LoadCommand]( "LIEF::MachO::LoadCommand")::[TYPE]( "LIEF::MachO::LoadCommand::TYPE") command() const Command type. #### [` size `]() inline uint32\_t size() const Size of the command (should be greater than `sizeof(load_command)`). #### [` data `]() inline span<const uint8\_t> data() const Raw command. #### [` command_offset `]() inline uint64\_t command\_offset() const Offset of the command within the *Load Command Table*. #### [` data `]() inline void data([raw\_t]( "LIEF::MachO::LoadCommand::raw_t") data) #### [` command `]() inline void command([LoadCommand]( "LIEF::MachO::LoadCommand")::[TYPE]( "LIEF::MachO::LoadCommand::TYPE") command) #### [` size `]() inline void size(uint32\_t size) #### [` command_offset `]() inline void command\_offset(uint64\_t offset) #### [` print `]() virtual std::ostream &print(std::ostream &os) const #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` Tcast `]() template<class T> inline const [T]( "LIEF::MachO::LoadCommand::cast::T") \*cast() const #### [` Tcast `]() template<class T> inline [T]( "LIEF::MachO::LoadCommand::cast::T") \*cast() Public Static Functions #### [` is_linkedit_data `]() static bool is\_linkedit\_data(const [LoadCommand]( "LIEF::MachO::LoadCommand") &cmd) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [LoadCommand]( "LIEF::MachO::LoadCommand") &cmd) --- ## [MainCommand]() ### [` MainCommand `]() class MainCommand : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class that represents the LC\_MAIN command. This kind of command can be used to determine the entrypoint of an executable. Public Functions #### [` MainCommand `]() MainCommand() = default #### [` MainCommand `]() MainCommand(const details::entry\_point\_command &cmd) #### [` MainCommand `]() MainCommand(uint64\_t entrypoint, uint64\_t stacksize) #### [` operator= `]() [MainCommand]( "LIEF::MachO::MainCommand") &operator=(const [MainCommand]( "LIEF::MachO::MainCommand") &copy) = default #### [` MainCommand `]() MainCommand(const [MainCommand]( "LIEF::MachO::MainCommand::MainCommand") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` ~MainCommand `]() ~MainCommand() override = default #### [` entrypoint `]() inline uint64\_t entrypoint() const Offset of the *main* function relative to the `__TEXT` segment. #### [` stack_size `]() inline uint64\_t stack\_size() const The initial stack size. #### [` entrypoint `]() inline void entrypoint(uint64\_t entrypoint) #### [` stack_size `]() inline void stack\_size(uint64\_t stacksize) #### [` print `]() virtual std::ostream &print(std::ostream &os) const override #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [NoteCommand]() ### [` NoteCommand `]() class NoteCommand : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class that represents the `LC_NOTE` command. This command is used to include arbitrary notes or metadata within a binary. Public Functions #### [` NoteCommand `]() NoteCommand() = default #### [` NoteCommand `]() NoteCommand(const details::note\_command &cmd) #### [` operator= `]() [NoteCommand]( "LIEF::MachO::NoteCommand") &operator=(const [NoteCommand]( "LIEF::MachO::NoteCommand") &copy) = default #### [` NoteCommand `]() NoteCommand(const [NoteCommand]( "LIEF::MachO::NoteCommand::NoteCommand") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` note_offset `]() inline uint64\_t note\_offset() const Offset of the data associated with this note. #### [` note_size `]() inline uint64\_t note\_size() const Size of the data referenced by the note\_offset. #### [` owner `]() inline span<const char> owner() const Owner of the note (e.g. `AIR_METALLIB`). #### [` owner `]() inline span<char> owner() #### [` owner_str `]() inline std::string owner\_str() const Owner as a zero-terminated string. #### [` note_offset `]() inline void note\_offset(uint64\_t offset) #### [` note_size `]() inline void note\_size(uint64\_t size) #### [` ~NoteCommand `]() ~NoteCommand() override = default #### [` print `]() virtual std::ostream &print(std::ostream &os) const override #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [Section]() ### [` Section `]() class Section : public LIEF::[Section]( "LIEF::Section") Class that represents a Mach-O section. Subclassed by [LIEF::MachO::ThreadLocalVariables]() Public Types #### [` TYPE `]() enum class TYPE : uint64\_t *Values:* ##### [` REGULAR `]() enumerator REGULAR = 0x00u Regular section. ##### [` ZEROFILL `]() enumerator ZEROFILL = 0x01u Zero fill on demand section. ##### [` CSTRING_LITERALS `]() enumerator CSTRING\_LITERALS = 0x02u [Section]() with literal C strings. ##### [` IS_4BYTE_LITERALS `]() enumerator IS\_4BYTE\_LITERALS = 0x03u [Section]() with 4 byte literals. ##### [` IS_8BYTE_LITERALS `]() enumerator IS\_8BYTE\_LITERALS = 0x04u [Section]() with 8 byte literals. ##### [` LITERAL_POINTERS `]() enumerator LITERAL\_POINTERS = 0x05u [Section]() with pointers to literals. ##### [` NON_LAZY_SYMBOL_POINTERS `]() enumerator NON\_LAZY\_SYMBOL\_POINTERS = 0x06u [Section]() with non-lazy symbol pointers. ##### [` LAZY_SYMBOL_POINTERS `]() enumerator LAZY\_SYMBOL\_POINTERS = 0x07u [Section]() with lazy symbol pointers. ##### [` SYMBOL_STUBS `]() enumerator SYMBOL\_STUBS = 0x08u [Section]() with symbol stubs, byte size of stub in the Reserved2 field. ##### [` MOD_INIT_FUNC_POINTERS `]() enumerator MOD\_INIT\_FUNC\_POINTERS = 0x09u [Section]() with only function pointers for initialization. ##### [` MOD_TERM_FUNC_POINTERS `]() enumerator MOD\_TERM\_FUNC\_POINTERS = 0x0au [Section]() with only function pointers for termination. ##### [` COALESCED `]() enumerator COALESCED = 0x0bu [Section]() contains symbols that are to be coalesced. ##### [` GB_ZEROFILL `]() enumerator GB\_ZEROFILL = 0x0cu Zero fill on demand section (that can be larger than 4 gigabytes). ##### [` INTERPOSING `]() enumerator INTERPOSING = 0x0du [Section]() with only pairs of function pointers for interposing. ##### [` IS_16BYTE_LITERALS `]() enumerator IS\_16BYTE\_LITERALS = 0x0eu [Section]() with only 16 byte literals. ##### [` DTRACE_DOF `]() enumerator DTRACE\_DOF = 0x0fu [Section]() contains DTrace Object Format. ##### [` LAZY_DYLIB_SYMBOL_POINTERS `]() enumerator LAZY\_DYLIB\_SYMBOL\_POINTERS = 0x10u [Section]() with lazy symbol pointers to lazy loaded dylibs. ##### [` THREAD_LOCAL_REGULAR `]() enumerator THREAD\_LOCAL\_REGULAR = 0x11u Thread local data section. ##### [` THREAD_LOCAL_ZEROFILL `]() enumerator THREAD\_LOCAL\_ZEROFILL = 0x12u Thread local zerofill section. ##### [` THREAD_LOCAL_VARIABLES `]() enumerator THREAD\_LOCAL\_VARIABLES = 0x13u [Section]() with thread local variable structure data. ##### [` THREAD_LOCAL_VARIABLE_POINTERS `]() enumerator THREAD\_LOCAL\_VARIABLE\_POINTERS = 0x14u [Section]() with pointers to thread local structures. ##### [` THREAD_LOCAL_INIT_FUNCTION_POINTERS `]() enumerator THREAD\_LOCAL\_INIT\_FUNCTION\_POINTERS = 0x15u [Section]() with thread local variable initialization pointers to functions. ##### [` INIT_FUNC_OFFSETS `]() enumerator INIT\_FUNC\_OFFSETS = 0x16u [Section]() with 32-bit offsets to initializer functions. #### [` FLAGS `]() enum class FLAGS : uint64\_t *Values:* ##### [` PURE_INSTRUCTIONS `]() enumerator PURE\_INSTRUCTIONS = 0x80000000u [Section]() contains only true machine instructions. ##### [` NO_TOC `]() enumerator NO\_TOC = 0x40000000u [Section]() contains coalesced symbols that are not to be in a ranlib table of contents. ##### [` STRIP_STATIC_SYMS `]() enumerator STRIP\_STATIC\_SYMS = 0x20000000u Okay to strip static symbols in this section in files with the MY\_DYLDLINK flag. ##### [` NO_DEAD_STRIP `]() enumerator NO\_DEAD\_STRIP = 0x10000000u No dead stripping. ##### [` LIVE_SUPPORT `]() enumerator LIVE\_SUPPORT = 0x08000000u Blocks are live if they reference live blocks. ##### [` SELF_MODIFYING_CODE `]() enumerator SELF\_MODIFYING\_CODE = 0x04000000u Used with i386 code stubs written on by dyld. ##### [` DEBUG_INFO `]() enumerator DEBUG\_INFO = 0x02000000u A debug section. ##### [` SOME_INSTRUCTIONS `]() enumerator SOME\_INSTRUCTIONS = 0x00000400u [Section]() contains some machine instructions. ##### [` EXT_RELOC `]() enumerator EXT\_RELOC = 0x00000200u [Section]() has external relocation entries. ##### [` LOC_RELOC `]() enumerator LOC\_RELOC = 0x00000100u [Section]() has local relocation entries. #### [` content_t `]() using content\_t = std::vector<uint8\_t> #### [` relocations_t `]() using relocations\_t = std::vector<std::unique\_ptr<[Relocation]( "LIEF::MachO::Relocation")>> Internal container for storing Mach-O [Relocation](). #### [` it_relocations `]() using it\_relocations = [ref\_iterator]( "LIEF::ref_iterator")<[relocations\_t]( "LIEF::MachO::Section::relocations_t")&, [Relocation]( "LIEF::MachO::Relocation")\*> Iterator which outputs [Relocation]()&. #### [` it_const_relocations `]() using it\_const\_relocations = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [relocations\_t]( "LIEF::MachO::Section::relocations_t")&, const [Relocation]( "LIEF::MachO::Relocation")\*> Iterator which outputs const [Relocation]()&. Public Functions #### [` Section `]() Section(const details::section\_32 &sec) #### [` Section `]() Section(const details::section\_64 &sec) #### [` Section `]() Section([Section]( "LIEF::MachO::Section::Section")&&) #### [` operator= `]() [Section]( "LIEF::MachO::Section") &operator=([Section]( "LIEF::MachO::Section")&&) #### [` ~Section `]() ~Section() override #### [` clone `]() inline virtual std::unique\_ptr<[Section]( "LIEF::MachO::Section")> clone() const #### [` content `]() virtual span<const uint8\_t> content() const override [Section]()’s content. #### [` content `]() inline span<uint8\_t> content() #### [` content `]() virtual void content(const [content\_t]( "LIEF::MachO::Section::content_t") &data) override Update the content of the section. #### [` segment_name `]() std::string\_view segment\_name() const Return the name of the segment linked to this section. #### [` address `]() inline uint64\_t address() const Virtual base address of the section. #### [` alignment `]() inline uint32\_t alignment() const [Section]() alignment as a power of 2. #### [` relocation_offset `]() inline uint32\_t relocation\_offset() const Offset of the relocation table. This value should be 0 for executable and libraries as the relocations are managed by the [DyldInfo::rebase](). On the other hand, for object files (`.o`) this value should not be 0 > **See also** > > [numberof\_relocations]() > **See also** > > [relocations]() #### [` numberof_relocations `]() inline uint32\_t numberof\_relocations() const Number of relocations associated with this section. #### [` flags `]() inline [FLAGS]( "LIEF::MachO::Section::FLAGS") flags() const [Section]()’s flags masked with SECTION\_FLAGS\_MASK (see: [Section::FLAGS]()). > **See also** > > [flags]() #### [` type `]() inline [TYPE]( "LIEF::MachO::Section::TYPE") type() const Type of the section. This value can help to determine the purpose of the section (e.g. [TYPE::INTERPOSING]()). #### [` reserved1 `]() inline uint32\_t reserved1() const According to the official `loader.h` file, this value is reserved for *offset* or *index*. #### [` reserved2 `]() inline uint32\_t reserved2() const According to the official `loader.h` file, this value is reserved for *count* or *sizeof*. #### [` reserved3 `]() inline uint32\_t reserved3() const This value is only present for 64 bits Mach-O files. In that case, the value is *reserved*. #### [` flags_list `]() std::vector<[FLAGS]( "LIEF::MachO::Section::FLAGS")> flags\_list() const Return the [Section::flags]() as a list of [Section::FLAGS](). > **See also** > > [flags]() #### [` raw_flags `]() inline uint32\_t raw\_flags() const [Section]() flags without applying the SECTION\_FLAGS\_MASK mask. #### [` has_segment `]() inline bool has\_segment() const Check if this section is correctly linked with a [MachO::SegmentCommand](). #### [` segment `]() inline [SegmentCommand]( "LIEF::MachO::SegmentCommand") \*segment() The segment associated with this section or a nullptr if not present. #### [` segment `]() inline const [SegmentCommand]( "LIEF::MachO::SegmentCommand") \*segment() const #### [` stream `]() std::unique\_ptr<[SpanStream]( "LIEF::SpanStream")> stream() const Return a stream over the content of this section. #### [` clear `]() inline void clear(uint8\_t v) Clear the content of this section by filling its values with the byte provided in parameter. #### [` relocations `]() inline [it\_relocations]( "LIEF::MachO::Section::it_relocations") relocations() Return an iterator over the [MachO::Relocation]() associated with this section. This iterator is likely to be empty for executables and libraries while it should not be for object files (`.o`) #### [` relocations `]() inline [it\_const\_relocations]( "LIEF::MachO::Section::it_const_relocations") relocations() const #### [` segment_name `]() void segment\_name(const std::string &name) #### [` address `]() inline void address(uint64\_t address) #### [` alignment `]() inline void alignment(uint32\_t align) #### [` relocation_offset `]() inline void relocation\_offset(uint32\_t offset) #### [` numberof_relocations `]() inline void numberof\_relocations(uint32\_t nb\_reloc) #### [` flags `]() inline void flags(uint32\_t flags) #### [` flags `]() void flags(std::vector<[FLAGS]( "LIEF::MachO::Section::FLAGS")> flags) #### [` type `]() inline void type([TYPE]( "LIEF::MachO::Section::TYPE") type) #### [` reserved1 `]() inline void reserved1(uint32\_t reserved1) #### [` reserved2 `]() inline void reserved2(uint32\_t reserved2) #### [` reserved3 `]() inline void reserved3(uint32\_t reserved3) #### [` has `]() bool has([FLAGS]( "LIEF::MachO::Section::FLAGS") flag) const Check if the section has the given [Section::FLAGS]() flag. #### [` add `]() void add([FLAGS]( "LIEF::MachO::Section::FLAGS") flag) Append a [Section::FLAGS]() to the current section. #### [` remove `]() void remove([FLAGS]( "LIEF::MachO::Section::FLAGS") flag) Remove a [Section::FLAGS]() to the current section. #### [` operator+= `]() inline [Section]( "LIEF::MachO::Section") &operator+=([FLAGS]( "LIEF::MachO::Section::FLAGS") flag) #### [` operator-= `]() inline [Section]( "LIEF::MachO::Section") &operator-=([FLAGS]( "LIEF::MachO::Section::FLAGS") flag) #### [` Tcast `]() template<class T> inline const [T]( "LIEF::MachO::Section::cast::T") \*cast() const #### [` Tcast `]() template<class T> inline [T]( "LIEF::MachO::Section::cast::T") \*cast() #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` create `]() static std::unique\_ptr<[Section]( "LIEF::MachO::Section")> create(const details::section\_32 &sec) #### [` create `]() static std::unique\_ptr<[Section]( "LIEF::MachO::Section")> create(const details::section\_64 &sec) #### [` create `]() static std::unique\_ptr<[Section]( "LIEF::MachO::Section")> create(std::string name, const [content\_t]( "LIEF::MachO::Section::content_t") &content, [TYPE]( "LIEF::MachO::Section::TYPE") type = [TYPE]( "LIEF::MachO::Section::TYPE")::[REGULAR]( "LIEF::MachO::Section::TYPE::REGULAR")) #### [` create `]() static inline std::unique\_ptr<[Section]( "LIEF::MachO::Section")> create(std::string name, [TYPE]( "LIEF::MachO::Section::TYPE") type = [TYPE]( "LIEF::MachO::Section::TYPE")::[REGULAR]( "LIEF::MachO::Section::TYPE::REGULAR")) Public Static Attributes #### [` FLAGS_MASK `]() static auto FLAGS\_MASK = uint32\_t(0xffffff00u) #### [` TYPE_MASK `]() static auto TYPE\_MASK = uint32\_t(0xff) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Section]( "LIEF::MachO::Section") &section) --- ## [ThreadLocalVariables]() ### [` ThreadLocalVariables `]() class ThreadLocalVariables : public LIEF::MachO::[Section]( "LIEF::MachO::Section") This class represents a MachO section with type [Section::TYPE::THREAD\_LOCAL\_VARIABLES]() (`S_THREAD_LOCAL_VARIABLES`). Such a section contains an array of thread-local variable descriptors ([Thunk]()) that the dynamic linker (dyld) uses to lazily initialize thread-local storage (TLS) on first access. Each descriptor holds a pointer to the initializer function, a TLS key, and the offset of the variable in the TLS block. Public Types #### [` thunks_it `]() using thunks\_it = [iterator\_range]( "LIEF::iterator_range")<[Iterator]( "LIEF::MachO::ThreadLocalVariables::Iterator")> Public Functions #### [` ThreadLocalVariables `]() ThreadLocalVariables() #### [` ThreadLocalVariables `]() ThreadLocalVariables(const [ThreadLocalVariables]( "LIEF::MachO::ThreadLocalVariables::ThreadLocalVariables")&) = default #### [` ThreadLocalVariables `]() ThreadLocalVariables([ThreadLocalVariables]( "LIEF::MachO::ThreadLocalVariables::ThreadLocalVariables")&&) noexcept = default #### [` operator= `]() [ThreadLocalVariables]( "LIEF::MachO::ThreadLocalVariables") &operator=(const [ThreadLocalVariables]( "LIEF::MachO::ThreadLocalVariables")&) = default #### [` operator= `]() [ThreadLocalVariables]( "LIEF::MachO::ThreadLocalVariables") &operator=([ThreadLocalVariables]( "LIEF::MachO::ThreadLocalVariables")&&) noexcept = default #### [` clone `]() inline virtual std::unique\_ptr<[Section]( "LIEF::MachO::ThreadLocalVariables::Section")> clone() const override #### [` thunks `]() inline [thunks\_it]( "LIEF::MachO::ThreadLocalVariables::thunks_it") thunks() const Return an iterator range over the [Thunk]() descriptors stored in this section. #### [` nb_thunks `]() size\_t nb\_thunks() const Number of [Thunk]() descriptors in this section. #### [` get `]() std::optional<[Thunk]( "LIEF::MachO::ThreadLocalVariables::Thunk")> get(size\_t idx) const Access the [Thunk]() at the given `idx`, or return an empty optional if the index is out of range. #### [` set `]() void set(size\_t idx, const [Thunk]( "LIEF::MachO::ThreadLocalVariables::Thunk") &thunk) Change the [Thunk]() at the given `idx`. #### [` operator[] `]() inline std::optional<[Thunk]( "LIEF::MachO::ThreadLocalVariables::Thunk")> operator[](size\_t idx) const Access the [Thunk]() at the given `idx`. #### [` ~ThreadLocalVariables `]() ~ThreadLocalVariables() override = default #### [` Section `]() Section(const details::section\_32 &sec) #### [` Section `]() Section(const details::section\_64 &sec) #### [` Section `]() Section([Section]( "LIEF::MachO::ThreadLocalVariables::Section")&&) Public Static Functions #### [` classof `]() static inline bool classof(const [Section]( "LIEF::MachO::ThreadLocalVariables::Section") \*section) Friends **friend class Section** #### [` Thunk `]() struct Thunk Descriptor for a single thread-local variable. The layout mirrors the `tlv_descriptor` structure defined in `` (see also `libdyld/ThreadLocalVariables.h` in dyld). Public Functions ##### [` to_string `]() std::string to\_string() const Public Members ##### [` func `]() uint64\_t func = 0 Address of the initializer function (`tlv_thunk`). ##### [` key `]() uint64\_t key = 0 `pthread_key_t` key used by the runtime ##### [` offset `]() uint64\_t offset = 0 Offset of the variable in the TLS block. Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Thunk]( "LIEF::MachO::ThreadLocalVariables::Thunk") &thunk) #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::MachO::ThreadLocalVariables::Iterator"), std::random\_access\_iterator\_tag, const [Thunk]( "LIEF::MachO::ThreadLocalVariables::Thunk")> Random-access iterator that materializes [Thunk]() values on the fly from the raw section content. Public Functions ##### [` Iterator `]() Iterator() = default ##### [` Iterator `]() inline Iterator(const [ThreadLocalVariables]( "LIEF::MachO::ThreadLocalVariables") &parent, size\_t pos) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::MachO::ThreadLocalVariables::Iterator::Iterator")&) = default ##### [` operator= `]() [Iterator]( "LIEF::MachO::ThreadLocalVariables::Iterator") &operator=(const [Iterator]( "LIEF::MachO::ThreadLocalVariables::Iterator")&) = default ##### [` Iterator `]() Iterator([Iterator]( "LIEF::MachO::ThreadLocalVariables::Iterator::Iterator")&&) noexcept = default ##### [` operator= `]() [Iterator]( "LIEF::MachO::ThreadLocalVariables::Iterator") &operator=([Iterator]( "LIEF::MachO::ThreadLocalVariables::Iterator")&&) noexcept = default ##### [` ~Iterator `]() ~Iterator() = default ##### [` operator< `]() inline bool operator<(const [Iterator]( "LIEF::MachO::ThreadLocalVariables::Iterator") &rhs) const ##### [` operator- `]() inline std::ptrdiff\_t operator-(const [Iterator]( "LIEF::MachO::ThreadLocalVariables::Iterator") &R) const ##### [` operator+= `]() inline [Iterator]( "LIEF::MachO::ThreadLocalVariables::Iterator") &operator+=(std::ptrdiff\_t n) ##### [` operator-= `]() inline [Iterator]( "LIEF::MachO::ThreadLocalVariables::Iterator") &operator-=(std::ptrdiff\_t n) ##### [` operator* `]() inline [Thunk]( "LIEF::MachO::ThreadLocalVariables::Thunk") operator\*() const Friends ##### [` operator== `]() inline friend bool operator==(const [Iterator]( "LIEF::MachO::ThreadLocalVariables::Iterator") &LHS, const [Iterator]( "LIEF::MachO::ThreadLocalVariables::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::MachO::ThreadLocalVariables::Iterator") &LHS, const [Iterator]( "LIEF::MachO::ThreadLocalVariables::Iterator") &RHS) --- ## [SegmentCommand]() ### [` SegmentCommand `]() class SegmentCommand : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class which represents a [LoadCommand::TYPE::SEGMENT]() / [LoadCommand::TYPE::SEGMENT\_64]() command. Subclassed by LIEF::MachO::LinkEdit Public Types #### [` FLAGS `]() enum class FLAGS : uint64\_t *Values:* ##### [` HIGHVM `]() enumerator HIGHVM = 0x1u The file contents for this segment are for the high part of the virtual memory space; the low part is zero filled (for stacks in core files). ##### [` FVMLIB `]() enumerator FVMLIB = 0x2u This segment is the VM that is allocated by a fixed VM library, for overlap checking in the link editor. ##### [` NORELOC `]() enumerator NORELOC = 0x4u This segment has nothing that was relocated in it and nothing relocated to it. It may be safely replaced without relocation. ##### [` PROTECTED_VERSION_1 `]() enumerator PROTECTED\_VERSION\_1 = 0x8u ##### [` READ_ONLY `]() enumerator READ\_ONLY = 0x10u #### [` VM_PROTECTIONS `]() enum class VM\_PROTECTIONS Values for segment\_command.initprot. From <mach/vm\_prot.h>. *Values:* ##### [` READ `]() enumerator READ = 0x1 Reading data within the segment is allowed. ##### [` WRITE `]() enumerator WRITE = 0x2 Writing data within the segment is allowed. ##### [` EXECUTE `]() enumerator EXECUTE = 0x4 Executing data within the segment is allowed. #### [` content_t `]() using content\_t = std::vector<uint8\_t> #### [` sections_t `]() using sections\_t = std::vector<std::unique\_ptr<[Section]( "LIEF::MachO::Section")>> Internal container for storing Mach-O [Section](). #### [` it_sections `]() using it\_sections = [ref\_iterator]( "LIEF::ref_iterator")<[sections\_t]( "LIEF::MachO::SegmentCommand::sections_t")&, [Section]( "LIEF::MachO::Section")\*> Iterator which outputs [Section]()&. #### [` it_const_sections `]() using it\_const\_sections = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [sections\_t]( "LIEF::MachO::SegmentCommand::sections_t")&, const [Section]( "LIEF::MachO::Section")\*> Iterator which outputs const [Section]()&. #### [` relocations_t `]() using relocations\_t = std::vector<std::unique\_ptr<[Relocation]( "LIEF::MachO::Relocation")>> Internal container for storing Mach-O [Relocation](). #### [` it_relocations `]() using it\_relocations = [ref\_iterator]( "LIEF::ref_iterator")<[relocations\_t]( "LIEF::MachO::SegmentCommand::relocations_t")&, [Relocation]( "LIEF::MachO::Relocation")\*> Iterator which outputs [Relocation]()&. #### [` it_const_relocations `]() using it\_const\_relocations = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [relocations\_t]( "LIEF::MachO::SegmentCommand::relocations_t")&, const [Relocation]( "LIEF::MachO::Relocation")\*> Iterator which outputs const [Relocation]()&. Public Functions #### [` SegmentCommand `]() SegmentCommand() #### [` SegmentCommand `]() SegmentCommand(const details::segment\_command\_32 &cmd) #### [` SegmentCommand `]() SegmentCommand(const details::segment\_command\_64 &cmd) #### [` operator= `]() [SegmentCommand]( "LIEF::MachO::SegmentCommand") &operator=([SegmentCommand]( "LIEF::MachO::SegmentCommand") other) #### [` SegmentCommand `]() SegmentCommand(const [SegmentCommand]( "LIEF::MachO::SegmentCommand::SegmentCommand") &copy) #### [` SegmentCommand `]() SegmentCommand(std::string name, [content\_t]( "LIEF::MachO::SegmentCommand::content_t") content) #### [` SegmentCommand `]() SegmentCommand(std::string name) #### [` swap `]() void swap([SegmentCommand]( "LIEF::MachO::SegmentCommand") &other) noexcept #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` ~SegmentCommand `]() ~SegmentCommand() override #### [` name `]() inline std::string\_view name() const Name of the segment (e.g. `__TEXT`). #### [` virtual_address `]() inline uint64\_t virtual\_address() const Absolute virtual base address of the segment. #### [` virtual_size `]() inline uint64\_t virtual\_size() const Virtual size of the segment. #### [` file_size `]() inline uint64\_t file\_size() const Size of this segment in the binary file. #### [` file_offset `]() inline uint64\_t file\_offset() const Offset of the data of this segment in the file. #### [` max_protection `]() inline uint32\_t max\_protection() const The maximum of protections for this segment (cf. [VM\_PROTECTIONS]()). #### [` init_protection `]() inline uint32\_t init\_protection() const The initial protections of this segment (cf. [VM\_PROTECTIONS]()). #### [` numberof_sections `]() inline uint32\_t numberof\_sections() const The number of sections associated with this segment. #### [` flags `]() inline uint32\_t flags() const Flags associated with this segment (cf. [SegmentCommand::FLAGS]()). #### [` sections `]() inline [it\_sections]( "LIEF::MachO::SegmentCommand::it_sections") sections() Return an iterator over the [MachO::Section]() linked to this segment. #### [` sections `]() inline [it\_const\_sections]( "LIEF::MachO::SegmentCommand::it_const_sections") sections() const #### [` relocations `]() inline [it\_relocations]( "LIEF::MachO::SegmentCommand::it_relocations") relocations() Return an iterator over the [MachO::Relocation]() linked to this segment. For Mach-O executable or library this iterator should be empty as the relocations are managed by the Dyld::rebase\_opcodes. On the other hand, for object files (`.o`) this iterator should not be empty #### [` relocations `]() inline [it\_const\_relocations]( "LIEF::MachO::SegmentCommand::it_const_relocations") relocations() const #### [` get_section `]() const [Section]( "LIEF::MachO::Section") \*get\_section(const std::string &name) const Get the section with the given name. #### [` get_section `]() [Section]( "LIEF::MachO::Section") \*get\_section(const std::string &name) #### [` content `]() inline span<const uint8\_t> content() const The raw content of this segment. #### [` content `]() inline span<uint8\_t> content() #### [` stream `]() std::unique\_ptr<[SpanStream]( "LIEF::SpanStream")> stream() const Return a stream over the content of this segment. #### [` index `]() inline int8\_t index() const The original index of this segment or -1 if not defined. #### [` name `]() inline void name(std::string name) #### [` virtual_address `]() inline void virtual\_address(uint64\_t virtual\_address) #### [` virtual_size `]() inline void virtual\_size(uint64\_t virtual\_size) #### [` file_offset `]() inline void file\_offset(uint64\_t file\_offset) #### [` file_size `]() inline void file\_size(uint64\_t file\_size) #### [` max_protection `]() inline void max\_protection(uint32\_t max\_protection) #### [` init_protection `]() inline void init\_protection(uint32\_t init\_protection) #### [` numberof_sections `]() inline void numberof\_sections(uint32\_t nb\_section) #### [` flags `]() inline void flags(uint32\_t flags) #### [` content `]() void content([content\_t]( "LIEF::MachO::SegmentCommand::content_t") data) #### [` add_section `]() [Section]( "LIEF::MachO::Section") &add\_section(const [Section]( "LIEF::MachO::Section") &section) Add a new section in this segment. #### [` remove_all_sections `]() void remove\_all\_sections() Remove all the sections linked to this segment. #### [` has `]() bool has(const [Section]( "LIEF::MachO::Section") &section) const Check if the current segment embeds the given section. #### [` has_section `]() bool has\_section(const std::string &section\_name) const Check if the current segment embeds the given section name. #### [` is `]() inline bool is([VM\_PROTECTIONS]( "LIEF::MachO::SegmentCommand::VM_PROTECTIONS") prot) const #### [` print `]() virtual std::ostream &print(std::ostream &os) const override #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [Symbol]() ### [` Symbol `]() class Symbol : public LIEF::[Symbol]( "LIEF::Symbol") Class that represents a [Symbol]() in a Mach-O file. A Mach-O symbol can come from: 1. The symbols command (LC\_SYMTAB / [SymbolCommand]()) 2. The Dyld Export trie 3. The Dyld [Symbol]() bindings Public Types #### [` CATEGORY `]() enum class CATEGORY : uint32\_t Category of the symbol when the symbol comes from the `LC_SYMTAB` command. The category is defined according to the `LC_DYSYMTAB` ([DynamicSymbolCommand]()) command. *Values:* ##### [` NONE `]() enumerator NONE = 0 ##### [` LOCAL `]() enumerator LOCAL ##### [` EXTERNAL `]() enumerator EXTERNAL ##### [` UNDEFINED `]() enumerator UNDEFINED ##### [` INDIRECT_ABS `]() enumerator INDIRECT\_ABS ##### [` INDIRECT_LOCAL `]() enumerator INDIRECT\_LOCAL ##### [` INDIRECT_ABS_LOCAL `]() enumerator INDIRECT\_ABS\_LOCAL #### [` ORIGIN `]() enum class ORIGIN : uint32\_t *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` DYLD_EXPORT `]() enumerator DYLD\_EXPORT = 1 ##### [` DYLD_BIND `]() enumerator DYLD\_BIND = 2 The symbol comes from the binding opcodes. ##### [` SYMTAB `]() enumerator SYMTAB = 3 The symbol comes from the LC\_SYMTAB command. #### [` TYPE `]() enum class TYPE : uint32\_t *Values:* ##### [` UNDEFINED `]() enumerator UNDEFINED = 0x0u The symbol is undefined. It is referenced in a different module. ##### [` ABSOLUTE_SYM `]() enumerator ABSOLUTE\_SYM = 0x2u The symbol is absolute. The linker doesn’t update its value. ##### [` SECTION `]() enumerator SECTION = 0xeu The symbol is defined in the section number given in nlist\_base.n\_sect. ##### [` PREBOUND `]() enumerator PREBOUND = 0xcu The symbol is undefined and the image is using a prebound value for the symbol. Set the n\_sect field to NO\_SECT. ##### [` INDIRECT `]() enumerator INDIRECT = 0xau The symbol is defined to be the same as another symbol. The n\_value field is an index into the string table specifying the name of the other symbol. When that symbol is linked, both this and the other symbol point to the same defined type and value. Public Functions #### [` Symbol `]() Symbol() = default #### [` Symbol `]() Symbol(const details::nlist\_32 &cmd) #### [` Symbol `]() Symbol(const details::nlist\_64 &cmd) #### [` Symbol `]() inline Symbol(uint8\_t n\_type, uint8\_t n\_sect, uint8\_t n\_desc, uint64\_t value) #### [` operator= `]() [Symbol]( "LIEF::MachO::Symbol") &operator=([Symbol]( "LIEF::MachO::Symbol") other) #### [` Symbol `]() Symbol(const [Symbol]( "LIEF::MachO::Symbol::Symbol") &other) #### [` swap `]() void swap([Symbol]( "LIEF::MachO::Symbol") &other) noexcept #### [` ~Symbol `]() ~Symbol() override = default #### [` library_ordinal `]() inline int library\_ordinal() const #### [` raw_type `]() inline uint8\_t raw\_type() const Raw value of `nlist_xx.n_type`. #### [` type `]() inline [TYPE]( "LIEF::MachO::Symbol::TYPE") type() const Type as defined by `nlist_xx.n_type & N_TYPE`. #### [` numberof_sections `]() inline uint8\_t numberof\_sections() const It returns the number of sections in which this symbol can be found. If the symbol can’t be found in any section, it returns 0 (NO\_SECT). #### [` description `]() inline uint16\_t description() const Return information about the symbol (SYMBOL\_DESCRIPTIONS). #### [` has_export_info `]() inline bool has\_export\_info() const True if the symbol is associated with an [ExportInfo]() This value is set when the symbol comes from the Dyld Export trie. #### [` export_info `]() inline const [ExportInfo]( "LIEF::MachO::ExportInfo") \*export\_info() const Return the [ExportInfo]() associated with this symbol (or nullptr if not present). > **See also** > > [has\_export\_info]() #### [` export_info `]() inline [ExportInfo]( "LIEF::MachO::ExportInfo") \*export\_info() #### [` has_binding_info `]() inline bool has\_binding\_info() const True if the symbol is associated with a BindingInfo This value is set when the symbol comes from the Dyld symbol bindings. #### [` binding_info `]() inline const BindingInfo \*binding\_info() const Return the BindingInfo associated with this symbol (or nullptr if not present). > **See also** > > [has\_binding\_info]() #### [` binding_info `]() inline BindingInfo \*binding\_info() #### [` demangled_name `]() std::string demangled\_name() const Try to demangle the symbol or return an empty string if it is not possible. #### [` is_external `]() inline bool is\_external() const True if the symbol is defined as an external symbol. #### [` library `]() inline const [DylibCommand]( "LIEF::MachO::DylibCommand") \*library() const Return the library in which the symbol is defined. It returns a null pointer if the library can’t be resolved. #### [` library `]() inline [DylibCommand]( "LIEF::MachO::DylibCommand") \*library() #### [` origin `]() inline [ORIGIN]( "LIEF::MachO::Symbol::ORIGIN") origin() const Return the origin of the symbol: from LC\_SYMTAB command or from the Dyld information. #### [` category `]() inline [CATEGORY]( "LIEF::MachO::Symbol::CATEGORY") category() const Category of the symbol according to the `LC_DYSYMTAB` command. #### [` raw_type `]() inline void raw\_type(uint8\_t type) #### [` numberof_sections `]() inline void numberof\_sections(uint8\_t nbsections) #### [` description `]() inline void description(uint16\_t desc) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` is_valid_index_ordinal `]() static inline bool is\_valid\_index\_ordinal(int idx) #### [` indirect_abs `]() static const [Symbol]( "LIEF::MachO::Symbol") &indirect\_abs() #### [` indirect_local `]() static const [Symbol]( "LIEF::MachO::Symbol") &indirect\_local() #### [` indirect_abs_local `]() static const [Symbol]( "LIEF::MachO::Symbol") &indirect\_abs\_local() Public Static Attributes #### [` SELF_LIBRARY_ORD `]() static int SELF\_LIBRARY\_ORD = 0x0 #### [` MAIN_EXECUTABLE_ORD `]() static int MAIN\_EXECUTABLE\_ORD = 0xff #### [` DYNAMIC_LOOKUP_ORD `]() static int DYNAMIC\_LOOKUP\_ORD = 0xfe #### [` TYPE_MASK `]() static uint32\_t TYPE\_MASK = 0x0e Same as N\_TYPE. Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Symbol]( "LIEF::MachO::Symbol") &symbol) --- ## [SymbolCommand]() ### [` SymbolCommand `]() class SymbolCommand : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class that represents the LC\_SYMTAB command. Public Functions #### [` SymbolCommand `]() SymbolCommand() = default #### [` SymbolCommand `]() SymbolCommand(const details::symtab\_command &command) #### [` operator= `]() [SymbolCommand]( "LIEF::MachO::SymbolCommand") &operator=(const [SymbolCommand]( "LIEF::MachO::SymbolCommand") &copy) = default #### [` SymbolCommand `]() SymbolCommand(const [SymbolCommand]( "LIEF::MachO::SymbolCommand::SymbolCommand") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` ~SymbolCommand `]() ~SymbolCommand() override = default #### [` symbol_offset `]() inline uint32\_t symbol\_offset() const Offset from the start of the file to the n\_list associated with the command. #### [` numberof_symbols `]() inline uint32\_t numberof\_symbols() const Number of symbols registered. #### [` strings_offset `]() inline uint32\_t strings\_offset() const Offset from the start of the file to the string table. #### [` strings_size `]() inline uint32\_t strings\_size() const Size of the string table. #### [` symbol_offset `]() inline void symbol\_offset(uint32\_t offset) #### [` numberof_symbols `]() inline void numberof\_symbols(uint32\_t nb) #### [` strings_offset `]() inline void strings\_offset(uint32\_t offset) #### [` strings_size `]() inline void strings\_size(uint32\_t size) #### [` symbol_table `]() inline span<const uint8\_t> symbol\_table() const #### [` symbol_table `]() inline span<uint8\_t> symbol\_table() #### [` string_table `]() inline span<const uint8\_t> string\_table() const #### [` string_table `]() inline span<uint8\_t> string\_table() #### [` original_str_size `]() inline uint32\_t original\_str\_size() const #### [` original_nb_symbols `]() inline uint32\_t original\_nb\_symbols() const #### [` print `]() virtual std::ostream &print(std::ostream &os) const override #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [UUIDCommand]() ### [` UUIDCommand `]() class UUIDCommand : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class that represents the UUID command. Public Functions #### [` UUIDCommand `]() UUIDCommand() = default #### [` UUIDCommand `]() UUIDCommand(const details::uuid\_command &cmd) #### [` operator= `]() [UUIDCommand]( "LIEF::MachO::UUIDCommand") &operator=(const [UUIDCommand]( "LIEF::MachO::UUIDCommand") &copy) = default #### [` UUIDCommand `]() UUIDCommand(const [UUIDCommand]( "LIEF::MachO::UUIDCommand::UUIDCommand") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` ~UUIDCommand `]() ~UUIDCommand() override = default #### [` uuid `]() inline const uuid\_t &uuid() const The UUID as a 16-bytes array. #### [` uuid `]() inline void uuid(const uuid\_t &uuid) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [Dyld Info]() ### [` DyldInfo `]() class DyldInfo : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class that represents the LC\_DYLD\_INFO and LC\_DYLD\_INFO\_ONLY commands. Public Types #### [` BINDING_ENCODING_VERSION `]() enum class BINDING\_ENCODING\_VERSION *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` V1 `]() enumerator V1 ##### [` V2 `]() enumerator V2 #### [` REBASE_TYPE `]() enum class REBASE\_TYPE : uint64\_t *Values:* ##### [` POINTER `]() enumerator POINTER = 1u ##### [` TEXT_ABSOLUTE32 `]() enumerator TEXT\_ABSOLUTE32 = 2u ##### [` TEXT_PCREL32 `]() enumerator TEXT\_PCREL32 = 3u ##### [` THREADED `]() enumerator THREADED = 102u #### [` REBASE_OPCODES `]() enum class REBASE\_OPCODES : uint8\_t *Values:* ##### [` DONE `]() enumerator DONE = 0x00u It’s finished. ##### [` SET_TYPE_IMM `]() enumerator SET\_TYPE\_IMM = 0x10u Set type to immediate (lower 4-bits). Used for ordinal numbers from 0-15. ##### [` SET_SEGMENT_AND_OFFSET_ULEB `]() enumerator SET\_SEGMENT\_AND\_OFFSET\_ULEB = 0x20u Set segment’s index to immediate (lower 4-bits) and segment’s offset to following ULEB128 encoding. ##### [` ADD_ADDR_ULEB `]() enumerator ADD\_ADDR\_ULEB = 0x30u Add segment’s offset with the following ULEB128 encoding. ##### [` ADD_ADDR_IMM_SCALED `]() enumerator ADD\_ADDR\_IMM\_SCALED = 0x40u Add segment’s offset with immediate scaling. ##### [` DO_REBASE_IMM_TIMES `]() enumerator DO\_REBASE\_IMM\_TIMES = 0x50u Rebase in the range of `[segment's offset; segment's offset + immediate * sizeof(ptr)]`. ##### [` DO_REBASE_ULEB_TIMES `]() enumerator DO\_REBASE\_ULEB\_TIMES = 0x60u Same as REBASE\_OPCODE\_DO\_REBASE\_IMM\_TIMES but *immediate* is replaced with ULEB128 value. ##### [` DO_REBASE_ADD_ADDR_ULEB `]() enumerator DO\_REBASE\_ADD\_ADDR\_ULEB = 0x70u Rebase and increment segment’s offset with following ULEB128 encoding + pointer’s size. ##### [` DO_REBASE_ULEB_TIMES_SKIPPING_ULEB `]() enumerator DO\_REBASE\_ULEB\_TIMES\_SKIPPING\_ULEB = 0x80u Rebase and skip several bytes. #### [` BIND_OPCODES `]() enum class BIND\_OPCODES : uint8\_t Opcodes used by Dyld info to bind symbols. *Values:* ##### [` DONE `]() enumerator DONE = 0x00u It’s finished. ##### [` SET_DYLIB_ORDINAL_IMM `]() enumerator SET\_DYLIB\_ORDINAL\_IMM = 0x10u Set ordinal to immediate (lower 4-bits). Used for ordinal numbers from 0-15. ##### [` SET_DYLIB_ORDINAL_ULEB `]() enumerator SET\_DYLIB\_ORDINAL\_ULEB = 0x20u Set ordinal to following ULEB128 encoding. Used for ordinal numbers from 16+. ##### [` SET_DYLIB_SPECIAL_IMM `]() enumerator SET\_DYLIB\_SPECIAL\_IMM = 0x30u Set ordinal, with 0 or negative number as immediate. The value is sign extended. ##### [` SET_SYMBOL_TRAILING_FLAGS_IMM `]() enumerator SET\_SYMBOL\_TRAILING\_FLAGS\_IMM = 0x40u Set the following symbol (NULL-terminated char\*). ##### [` SET_TYPE_IMM `]() enumerator SET\_TYPE\_IMM = 0x50u Set the type to immediate (lower 4-bits). See BIND\_TYPES. ##### [` SET_ADDEND_SLEB `]() enumerator SET\_ADDEND\_SLEB = 0x60u Set the addend field to the following SLEB128 encoding. ##### [` SET_SEGMENT_AND_OFFSET_ULEB `]() enumerator SET\_SEGMENT\_AND\_OFFSET\_ULEB = 0x70u Set Segment to immediate value, and address to the following SLEB128 encoding. ##### [` ADD_ADDR_ULEB `]() enumerator ADD\_ADDR\_ULEB = 0x80u Set the address field to the following SLEB128 encoding. ##### [` DO_BIND `]() enumerator DO\_BIND = 0x90u Perform binding of current table row. ##### [` DO_BIND_ADD_ADDR_ULEB `]() enumerator DO\_BIND\_ADD\_ADDR\_ULEB = 0xA0u Perform binding, also add following ULEB128 as address. ##### [` DO_BIND_ADD_ADDR_IMM_SCALED `]() enumerator DO\_BIND\_ADD\_ADDR\_IMM\_SCALED = 0xB0u Perform binding, also add immediate (lower 4-bits) using scaling. ##### [` DO_BIND_ULEB_TIMES_SKIPPING_ULEB `]() enumerator DO\_BIND\_ULEB\_TIMES\_SKIPPING\_ULEB = 0xC0u Perform binding for several symbols (as following ULEB128), and skip several bytes. ##### [` THREADED `]() enumerator THREADED = 0xD0u ##### [` THREADED_APPLY `]() enumerator THREADED\_APPLY = 0xD0u | 0x01u ##### [` THREADED_SET_BIND_ORDINAL_TABLE_SIZE_ULEB `]() enumerator THREADED\_SET\_BIND\_ORDINAL\_TABLE\_SIZE\_ULEB = 0xD0u | 0x00u #### [` BIND_SUBOPCODE_THREADED `]() enum class BIND\_SUBOPCODE\_THREADED : uint8\_t *Values:* ##### [` SET_BIND_ORDINAL_TABLE_SIZE_ULEB `]() enumerator SET\_BIND\_ORDINAL\_TABLE\_SIZE\_ULEB = 0x00u ##### [` APPLY `]() enumerator APPLY = 0x01u #### [` BIND_SYMBOL_FLAGS `]() enum BIND\_SYMBOL\_FLAGS *Values:* ##### [` WEAK_IMPORT `]() enumerator WEAK\_IMPORT = 0x1u ##### [` NON_WEAK_DEFINITION `]() enumerator NON\_WEAK\_DEFINITION = 0x8u #### [` info_t `]() using info\_t = std::pair<uint32\_t, uint32\_t> Tuple of `offset` and `size`. #### [` binding_info_t `]() using binding\_info\_t = std::vector<std::unique\_ptr<[DyldBindingInfo]( "LIEF::MachO::DyldBindingInfo")>> Internal container for storing [DyldBindingInfo](). #### [` it_binding_info `]() using it\_binding\_info = [ref\_iterator]( "LIEF::ref_iterator")<[binding\_info\_t]( "LIEF::MachO::DyldInfo::binding_info_t")&, [DyldBindingInfo]( "LIEF::MachO::DyldBindingInfo")\*> Iterator which outputs [DyldBindingInfo]()&. #### [` it_const_binding_info `]() using it\_const\_binding\_info = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [binding\_info\_t]( "LIEF::MachO::DyldInfo::binding_info_t")&, [DyldBindingInfo]( "LIEF::MachO::DyldBindingInfo")\*> Iterator which outputs const [DyldBindingInfo]()&. #### [` export_info_t `]() using export\_info\_t = std::vector<std::unique\_ptr<[ExportInfo]( "LIEF::MachO::ExportInfo")>> Internal container for storing [ExportInfo](). #### [` it_export_info `]() using it\_export\_info = [ref\_iterator]( "LIEF::ref_iterator")<[export\_info\_t]( "LIEF::MachO::DyldInfo::export_info_t")&, [ExportInfo]( "LIEF::MachO::ExportInfo")\*> Iterator which outputs const [ExportInfo]()&. #### [` it_const_export_info `]() using it\_const\_export\_info = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [export\_info\_t]( "LIEF::MachO::DyldInfo::export_info_t")&, [ExportInfo]( "LIEF::MachO::ExportInfo")\*> Iterator which outputs const [ExportInfo]()&. Public Functions #### [` DyldInfo `]() DyldInfo() #### [` DyldInfo `]() DyldInfo(const details::dyld\_info\_command &dyld\_info\_cmd) #### [` operator= `]() [DyldInfo]( "LIEF::MachO::DyldInfo") &operator=([DyldInfo]( "LIEF::MachO::DyldInfo") other) #### [` DyldInfo `]() DyldInfo(const [DyldInfo]( "LIEF::MachO::DyldInfo::DyldInfo") &copy) #### [` swap `]() void swap([DyldInfo]( "LIEF::MachO::DyldInfo") &other) noexcept #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` ~DyldInfo `]() ~DyldInfo() override #### [` rebase `]() inline const [info\_t]( "LIEF::MachO::DyldInfo::info_t") &rebase() const *Rebase* information Dyld rebases an image whenever dyld loads it at an address different from its preferred address. The rebase information is a stream of byte sized opcodes for which symbolic names start with REBASE\_OPCODE\_. Conceptually the rebase information is a table of tuples: <seg-index, seg-offset, type> The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like “every nth offset for m times” can be encoded in a few bytes. > **See also** > > `/usr/include/mach-o/loader.h` #### [` rebase_opcodes `]() inline span<const uint8\_t> rebase\_opcodes() const Return Rebase’s opcodes as raw data. #### [` rebase_opcodes `]() inline span<uint8\_t> rebase\_opcodes() #### [` rebase_opcodes `]() void rebase\_opcodes(buffer\_t raw) Set new opcodes. #### [` show_rebases_opcodes `]() std::string show\_rebases\_opcodes() const Return the rebase opcodes in a human-readable way. #### [` bind `]() inline const [info\_t]( "LIEF::MachO::DyldInfo::info_t") &bind() const *Bind* information Dyld binds an image during the loading process, if the image requires any pointers to be initialized to symbols in other images. The rebase information is a stream of byte sized opcodes for which symbolic names start with BIND\_OPCODE\_. Conceptually the bind information is a table of tuples: <seg-index, seg-offset, type, symbol-library-ordinal, symbol-name, addend> The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like for runs of pointers initialized to the same value can be encoded in a few bytes. > **See also** > > `/usr/include/mach-o/loader.h` #### [` bind_opcodes `]() inline span<const uint8\_t> bind\_opcodes() const Return Binding’s opcodes as raw data. #### [` bind_opcodes `]() inline span<uint8\_t> bind\_opcodes() #### [` bind_opcodes `]() void bind\_opcodes(buffer\_t raw) Set new opcodes. #### [` show_bind_opcodes `]() std::string show\_bind\_opcodes() const Return the bind opcodes in a human-readable way. #### [` weak_bind `]() inline const [info\_t]( "LIEF::MachO::DyldInfo::info_t") &weak\_bind() const *Weak Bind* information Some C++ programs require dyld to unique symbols so that all images in the process use the same copy of some code/data. This step is done after binding. The content of the weak\_bind info is an opcode stream like the bind\_info. But it is sorted alphabetically by symbol name. This enables dyld to walk all images with weak binding information in order and look for collisions. If there are no collisions, dyld does no updating. That means that some fixups are also encoded in the bind\_info. For instance, all calls to “operator new” are first bound to libstdc++.dylib using the information in bind\_info. Then if some image overrides operator new that is detected when the weak\_bind information is processed and the call to operator new is then rebound. > **See also** > > `/usr/include/mach-o/loader.h` #### [` weak_bind_opcodes `]() inline span<const uint8\_t> weak\_bind\_opcodes() const Return **Weak** Binding’s opcodes as raw data. #### [` weak_bind_opcodes `]() inline span<uint8\_t> weak\_bind\_opcodes() #### [` weak_bind_opcodes `]() void weak\_bind\_opcodes(buffer\_t raw) Set new opcodes. #### [` show_weak_bind_opcodes `]() std::string show\_weak\_bind\_opcodes() const Return the bind opcodes in a human-readable way. #### [` lazy_bind `]() inline const [info\_t]( "LIEF::MachO::DyldInfo::info_t") &lazy\_bind() const *Lazy Bind* information Some uses of external symbols do not need to be bound immediately. Instead, they can be lazily bound on first use. The lazy\_bind area contains a stream of BIND opcodes to bind all lazy symbols. Normal use is that dyld ignores the lazy\_bind section when loading an image. Instead, the static linker arranged for the lazy pointer to initially point to a helper function which pushes the offset into the lazy\_bind area for the symbol needing to be bound, then jumps to dyld which simply adds the offset to lazy\_bind\_off to get the information on what to bind. > **See also** > > `/usr/include/mach-o/loader.h` #### [` lazy_bind_opcodes `]() inline span<const uint8\_t> lazy\_bind\_opcodes() const Return **Lazy** Binding’s opcodes as raw data. #### [` lazy_bind_opcodes `]() inline span<uint8\_t> lazy\_bind\_opcodes() #### [` lazy_bind_opcodes `]() void lazy\_bind\_opcodes(buffer\_t raw) Set new opcodes. #### [` show_lazy_bind_opcodes `]() std::string show\_lazy\_bind\_opcodes() const Return the lazy opcodes in a human-readable way. #### [` bindings `]() inline [it\_binding\_info]( "LIEF::MachO::DyldInfo::it_binding_info") bindings() Iterator over BindingInfo entries. #### [` bindings `]() inline [it\_const\_binding\_info]( "LIEF::MachO::DyldInfo::it_const_binding_info") bindings() const #### [` export_info `]() inline const [info\_t]( "LIEF::MachO::DyldInfo::info_t") &export\_info() const *Export* information The symbols exported by a dylib are encoded in a trie. This is a compact representation that factors out common prefixes. It also reduces LINKEDIT pages in RAM because it encodes all information (name, address, flags) in one small, contiguous range. The export area is a stream of nodes. The first node sequentially is the start node for the trie. Nodes for a symbol start with a byte that is the length of the exported symbol information for the string so far. If there is no exported symbol, the byte is zero. If there is exported info, it follows the length byte. The exported info normally consists of a flags and offset both encoded in uleb128. The offset is location of the content named by the symbol. It is the offset from the mach\_header for the image. After the initial byte and optional exported symbol information is a byte of how many edges (0-255) that this node has leaving it, followed by each edge. Each edge is a zero terminated cstring of the addition chars in the symbol, followed by a uleb128 offset for the node that edge points to. > **See also** > > `/usr/include/mach-o/loader.h` #### [` exports `]() inline [it\_export\_info]( "LIEF::MachO::DyldInfo::it_export_info") exports() Iterator over [ExportInfo]() entries. #### [` exports `]() inline [it\_const\_export\_info]( "LIEF::MachO::DyldInfo::it_const_export_info") exports() const #### [` export_trie `]() inline span<const uint8\_t> export\_trie() const Return Export’s trie as raw data. #### [` export_trie `]() inline span<uint8\_t> export\_trie() #### [` export_trie `]() void export\_trie(buffer\_t raw) Set new trie. #### [` show_export_trie `]() std::string show\_export\_trie() const Return the export trie in a human-readable way. #### [` rebase `]() inline void rebase(const [info\_t]( "LIEF::MachO::DyldInfo::info_t") &info) #### [` bind `]() inline void bind(const [info\_t]( "LIEF::MachO::DyldInfo::info_t") &info) #### [` weak_bind `]() inline void weak\_bind(const [info\_t]( "LIEF::MachO::DyldInfo::info_t") &info) #### [` lazy_bind `]() inline void lazy\_bind(const [info\_t]( "LIEF::MachO::DyldInfo::info_t") &info) #### [` export_info `]() inline void export\_info(const [info\_t]( "LIEF::MachO::DyldInfo::info_t") &info) #### [` set_rebase_offset `]() inline void set\_rebase\_offset(uint32\_t offset) #### [` set_rebase_size `]() inline void set\_rebase\_size(uint32\_t size) #### [` set_bind_offset `]() inline void set\_bind\_offset(uint32\_t offset) #### [` set_bind_size `]() inline void set\_bind\_size(uint32\_t size) #### [` set_weak_bind_offset `]() inline void set\_weak\_bind\_offset(uint32\_t offset) #### [` set_weak_bind_size `]() inline void set\_weak\_bind\_size(uint32\_t size) #### [` set_lazy_bind_offset `]() inline void set\_lazy\_bind\_offset(uint32\_t offset) #### [` set_lazy_bind_size `]() inline void set\_lazy\_bind\_size(uint32\_t size) #### [` set_export_offset `]() inline void set\_export\_offset(uint32\_t offset) #### [` set_export_size `]() inline void set\_export\_size(uint32\_t size) #### [` add `]() [ExportInfo]( "LIEF::MachO::ExportInfo") \*add(std::unique\_ptr<[ExportInfo]( "LIEF::MachO::ExportInfo")> info) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) Public Static Attributes #### [` OPCODE_MASK `]() static auto OPCODE\_MASK = uint32\_t(0xF0) #### [` IMMEDIATE_MASK `]() static auto IMMEDIATE\_MASK = uint32\_t(0x0F) --- ## [Function starts]() ### [` FunctionStarts `]() class FunctionStarts : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class which represents the LC\_FUNCTION\_STARTS command. This command is an array of ULEB128 encoded values Public Functions #### [` FunctionStarts `]() FunctionStarts() = default #### [` FunctionStarts `]() FunctionStarts(const details::linkedit\_data\_command &cmd) #### [` operator= `]() [FunctionStarts]( "LIEF::MachO::FunctionStarts") &operator=(const [FunctionStarts]( "LIEF::MachO::FunctionStarts") &copy) = default #### [` FunctionStarts `]() FunctionStarts(const [FunctionStarts]( "LIEF::MachO::FunctionStarts::FunctionStarts") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` data_offset `]() inline uint32\_t data\_offset() const Offset in the `__LINKEDIT` [SegmentCommand]() where *start functions* are located. #### [` data_size `]() inline uint32\_t data\_size() const Size of the functions list in the binary. #### [` functions `]() inline const std::vector<uint64\_t> &functions() const Addresses of every function entry point in the executable. This allows functions to exist for which there are no entries in the symbol table. > **Warning** > > The address is relative to the `__TEXT` segment #### [` functions `]() inline std::vector<uint64\_t> &functions() #### [` add_function `]() inline void add\_function(uint64\_t address) Add a new function. #### [` data_offset `]() inline void data\_offset(uint32\_t offset) #### [` data_size `]() inline void data\_size(uint32\_t size) #### [` functions `]() inline void functions(std::vector<uint64\_t> funcs) #### [` content `]() inline span<const uint8\_t> content() const #### [` content `]() inline span<uint8\_t> content() #### [` ~FunctionStarts `]() ~FunctionStarts() override = default #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [Function Variants]() ### [` FunctionVariants `]() class FunctionVariants : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class representing the `LC_FUNCTION_VARIANTS` load command. Introduced publicly in `dyld-1284.13` (April 2025), this command supports **function multiversioning**, the ability to associate multiple implementations of the same function, each optimized for a specific platform, architecture, or runtime context. At runtime, the system dispatches the most appropriate variant based on hardware capabilities or execution environment. For example: ```cpp FUNCTION_VARIANT_TABLE(my_function, { (void*)my_function$Rosetta, "rosetta" }, // Rosetta translation { (void*)my_function$Haswell, "haswell" }, // Haswell-optimized { (void*)my_function$Base, "default" } // Default fallback ); ``` Public Types #### [` runtime_table_t `]() using runtime\_table\_t = std::vector<[RuntimeTable]( "LIEF::MachO::FunctionVariants::RuntimeTable")> #### [` it_runtime_table `]() using it\_runtime\_table = [ref\_iterator]( "LIEF::ref_iterator")<[runtime\_table\_t]( "LIEF::MachO::FunctionVariants::runtime_table_t")&> Iterator that outputs [RuntimeTable]()&. #### [` it_const_runtime_table `]() using it\_const\_runtime\_table = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [runtime\_table\_t]( "LIEF::MachO::FunctionVariants::runtime_table_t")&> Iterator that outputs const [RuntimeTable]()&. Public Functions #### [` FunctionVariants `]() FunctionVariants() = default #### [` FunctionVariants `]() FunctionVariants(const details::linkedit\_data\_command &cmd) #### [` operator= `]() [FunctionVariants]( "LIEF::MachO::FunctionVariants") &operator=(const [FunctionVariants]( "LIEF::MachO::FunctionVariants") &copy) = default #### [` FunctionVariants `]() FunctionVariants(const [FunctionVariants]( "LIEF::MachO::FunctionVariants::FunctionVariants") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` data_offset `]() inline uint32\_t data\_offset() const Offset in the `__LINKEDIT` [SegmentCommand]() where the payload starts. #### [` data_size `]() inline uint32\_t data\_size() const Size of the payload. #### [` data_offset `]() inline void data\_offset(uint32\_t offset) #### [` data_size `]() inline void data\_size(uint32\_t size) #### [` content `]() inline span<const uint8\_t> content() const Return the data slice in the `__LINKEDIT` segment referenced by data\_offset and data\_size;. #### [` content `]() inline span<uint8\_t> content() #### [` runtime_table `]() inline [it\_runtime\_table]( "LIEF::MachO::FunctionVariants::it_runtime_table") runtime\_table() Iterator over the different [RuntimeTable]() entries located in the content of this `__LINKEDIT` command. #### [` runtime_table `]() inline [it\_const\_runtime\_table]( "LIEF::MachO::FunctionVariants::it_const_runtime_table") runtime\_table() const #### [` add `]() inline [RuntimeTable]( "LIEF::MachO::FunctionVariants::RuntimeTable") &add([RuntimeTable]( "LIEF::MachO::FunctionVariants::RuntimeTable") table) Append a new [RuntimeTable]() and return a reference to the inserted table. #### [` ~FunctionVariants `]() ~FunctionVariants() override = default #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) #### [` parse_payload `]() static std::vector<[RuntimeTable]( "LIEF::MachO::FunctionVariants::RuntimeTable")> parse\_payload([SpanStream]( "LIEF::SpanStream") &stream) #### [` parse_entry `]() static [result]( "LIEF::result")<[RuntimeTable]( "LIEF::MachO::FunctionVariants::RuntimeTable")> parse\_entry([BinaryStream]( "LIEF::BinaryStream") &stream, uint64\_t max\_entries) #### [` RuntimeTableEntry `]() class RuntimeTableEntry This class exposes information about a given implementation. Public Types ##### [` FLAGS `]() enum class FLAGS : uint32\_t Flags describing the target platform, environment, or architecture for a given function implementation. These are encoded as a `uint32_t`, where high bits determine the namespace (`KIND`), and the lower bits encode the specific capability. *Values:* ###### [` UNKNOWN `]() enumerator UNKNOWN = 0 ###### [` ARM64_DEFAULT `]() enumerator ARM64\_DEFAULT = (0 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_FLAGM `]() enumerator ARM64\_FLAGM = (1 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_FLAGM2 `]() enumerator ARM64\_FLAGM2 = (2 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_FHM `]() enumerator ARM64\_FHM = (3 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_DOTPROD `]() enumerator ARM64\_DOTPROD = (4 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_SHA3 `]() enumerator ARM64\_SHA3 = (5 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_RDM `]() enumerator ARM64\_RDM = (6 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_LSE `]() enumerator ARM64\_LSE = (7 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_SHA256 `]() enumerator ARM64\_SHA256 = (8 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_SHA512 `]() enumerator ARM64\_SHA512 = (9 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_SHA1 `]() enumerator ARM64\_SHA1 = (10 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_AES `]() enumerator ARM64\_AES = (11 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_PMULL `]() enumerator ARM64\_PMULL = (12 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_SPECRES `]() enumerator ARM64\_SPECRES = (13 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_SB `]() enumerator ARM64\_SB = (14 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_FRINTTS `]() enumerator ARM64\_FRINTTS = (15 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_LRCPC `]() enumerator ARM64\_LRCPC = (16 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_LRCPC2 `]() enumerator ARM64\_LRCPC2 = (17 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_FCMA `]() enumerator ARM64\_FCMA = (18 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_JSCVT `]() enumerator ARM64\_JSCVT = (19 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_PAUTH `]() enumerator ARM64\_PAUTH = (20 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_PAUTH2 `]() enumerator ARM64\_PAUTH2 = (21 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_FPAC `]() enumerator ARM64\_FPAC = (22 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_DPB `]() enumerator ARM64\_DPB = (23 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_DPB2 `]() enumerator ARM64\_DPB2 = (24 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_BF16 `]() enumerator ARM64\_BF16 = (25 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_I8MM `]() enumerator ARM64\_I8MM = (26 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_WFXT `]() enumerator ARM64\_WFXT = (27 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_RPRES `]() enumerator ARM64\_RPRES = (28 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_ECV `]() enumerator ARM64\_ECV = (29 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_AFP `]() enumerator ARM64\_AFP = (30 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_LSE2 `]() enumerator ARM64\_LSE2 = (31 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_CSV2 `]() enumerator ARM64\_CSV2 = (32 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_CVS3 `]() enumerator ARM64\_CVS3 = (33 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_DIT `]() enumerator ARM64\_DIT = (34 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_FP16 `]() enumerator ARM64\_FP16 = (35 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_SSBS `]() enumerator ARM64\_SSBS = (36 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_BTI `]() enumerator ARM64\_BTI = (37 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_SME `]() enumerator ARM64\_SME = (44 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_SME2 `]() enumerator ARM64\_SME2 = (45 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_SMEF64F64 `]() enumerator ARM64\_SMEF64F64 = (46 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_SMEI16I64 `]() enumerator ARM64\_SMEI16I64 = (47 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_SMEF32F32 `]() enumerator ARM64\_SMEF32F32 = (48 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_SMEBI32I32 `]() enumerator ARM64\_SMEBI32I32 = (49 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_SMEB16F32 `]() enumerator ARM64\_SMEB16F32 = (50 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_SMEF16F32 `]() enumerator ARM64\_SMEF16F32 = (51 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_SMEI8I32 `]() enumerator ARM64\_SMEI8I32 = (52 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_SMEI16I32 `]() enumerator ARM64\_SMEI16I32 = (53 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_ADVSIMD `]() enumerator ARM64\_ADVSIMD = (54 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_ADVSIMDHPFP `]() enumerator ARM64\_ADVSIMDHPFP = (55 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` ARM64_CRC32 `]() enumerator ARM64\_CRC32 = (56 | [F\_ARM64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_ARM64")) ###### [` X86_64_DEFAULT `]() enumerator X86\_64\_DEFAULT = (0 | [F\_X86\_64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_X86_64")) ###### [` X86_64_SSE41 `]() enumerator X86\_64\_SSE41 = (1 | [F\_X86\_64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_X86_64")) ###### [` X86_64_FMA `]() enumerator X86\_64\_FMA = (2 | [F\_X86\_64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_X86_64")) ###### [` X86_64_AVX `]() enumerator X86\_64\_AVX = (3 | [F\_X86\_64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_X86_64")) ###### [` X86_64_AVX2 `]() enumerator X86\_64\_AVX2 = (4 | [F\_X86\_64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_X86_64")) ###### [` X86_64_AVX512F `]() enumerator X86\_64\_AVX512F = (5 | [F\_X86\_64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_X86_64")) ###### [` X86_64_AVX512BW `]() enumerator X86\_64\_AVX512BW = (6 | [F\_X86\_64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_X86_64")) ###### [` X86_64_BMI1 `]() enumerator X86\_64\_BMI1 = (7 | [F\_X86\_64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_X86_64")) ###### [` X86_64_ROSETTA `]() enumerator X86\_64\_ROSETTA = (8 | [F\_X86\_64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_X86_64")) ###### [` X86_64_HASWELL `]() enumerator X86\_64\_HASWELL = (9 | [F\_X86\_64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_X86_64")) ###### [` X86_64_IVYBRIDGE `]() enumerator X86\_64\_IVYBRIDGE = (10 | [F\_X86\_64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_X86_64")) ###### [` X86_64_NEHALEM `]() enumerator X86\_64\_NEHALEM = (11 | [F\_X86\_64]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_X86_64")) ###### [` SYSTEM_WIDE_DEFAULT `]() enumerator SYSTEM\_WIDE\_DEFAULT = (0 | [F\_SYSTEM\_WIDE]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_SYSTEM_WIDE")) ###### [` SYSTEM_WIDE_INTERNAL_INSTALL `]() enumerator SYSTEM\_WIDE\_INTERNAL\_INSTALL = (1 | [F\_SYSTEM\_WIDE]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_SYSTEM_WIDE")) ###### [` SYSTEM_WIDE_CUSTOMER_INSTALL `]() enumerator SYSTEM\_WIDE\_CUSTOMER\_INSTALL = (2 | [F\_SYSTEM\_WIDE]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_SYSTEM_WIDE")) ###### [` SYSTEM_WIDE_LOCKDOWN `]() enumerator SYSTEM\_WIDE\_LOCKDOWN = (3 | [F\_SYSTEM\_WIDE]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_SYSTEM_WIDE")) ###### [` PER_PROCESS_DEFAULT `]() enumerator PER\_PROCESS\_DEFAULT = (0 | [F\_PER\_PROCESS]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_PER_PROCESS")) ###### [` PER_PROCESS_TRANSLATED `]() enumerator PER\_PROCESS\_TRANSLATED = (1 | [F\_PER\_PROCESS]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_PER_PROCESS")) ###### [` PER_PROCESS_MTE_ENABLED `]() enumerator PER\_PROCESS\_MTE\_ENABLED = (2 | [F\_PER\_PROCESS]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_PER_PROCESS")) ###### [` PER_PROCESS_NO_OVERREAD `]() enumerator PER\_PROCESS\_NO\_OVERREAD = (3 | [F\_PER\_PROCESS]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_PER_PROCESS")) Public Functions ##### [` RuntimeTableEntry `]() RuntimeTableEntry() = default ##### [` RuntimeTableEntry `]() RuntimeTableEntry(const details::runtime\_table\_entry\_t &entry) ##### [` RuntimeTableEntry `]() RuntimeTableEntry(const [RuntimeTableEntry]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::RuntimeTableEntry")&) = default ##### [` operator= `]() [RuntimeTableEntry]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry") &operator=(const [RuntimeTableEntry]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry")&) = default ##### [` RuntimeTableEntry `]() RuntimeTableEntry([RuntimeTableEntry]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::RuntimeTableEntry")&&) noexcept = default ##### [` operator= `]() [RuntimeTableEntry]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry") &operator=([RuntimeTableEntry]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry")&&) noexcept = default ##### [` ~RuntimeTableEntry `]() ~RuntimeTableEntry() = default ##### [` impl `]() inline uint32\_t impl() const The relative address of the implementation or an index if [another\_table()]() is set. ##### [` impl `]() inline void impl(uint32\_t value) Set the relative address of the implementation (or the index of the target entry when [another\_table()]() is set). > **Note** > > The value is stored on 31 bits, so the most significant bit is silently dropped. ##### [` another_table `]() inline bool another\_table() const Indicates whether [impl()]() refers to an entry in another runtime table, rather than a direct function implementation address. ##### [` another_table `]() inline void another\_table(bool value) Set whether [impl()]() refers to an entry in another runtime table. ##### [` flag_bit_nums `]() inline span<const uint8\_t> flag\_bit\_nums() const The `flagBitNums` value as a slice of bytes. ##### [` flags `]() inline const std::vector<[FLAGS]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::FLAGS")> &flags() const Return the **interpreted** [flag\_bit\_nums()](). ##### [` to_string `]() std::string to\_string() const Public Static Functions ##### [` get_raw `]() static inline uint8\_t get\_raw([FLAGS]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::FLAGS") f) Public Static Attributes ##### [` MAX_IMPL `]() static uint32\_t MAX\_IMPL = (uint32\_t(1) << 31) - 1 The implementation address/index is encoded on 31 bits. ##### [` F_BIT `]() static uint32\_t F\_BIT = 20 ##### [` F_MASK `]() static uint32\_t F\_MASK = (uint32\_t(1) << [F\_BIT]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_BIT")) - 1 ##### [` F_PER_PROCESS `]() static uint32\_t F\_PER\_PROCESS = uint32\_t(1) << [F\_BIT]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_BIT") ##### [` F_SYSTEM_WIDE `]() static uint32\_t F\_SYSTEM\_WIDE = uint32\_t(2) << [F\_BIT]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_BIT") ##### [` F_ARM64 `]() static uint32\_t F\_ARM64 = uint32\_t(3) << [F\_BIT]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_BIT") ##### [` F_X86_64 `]() static uint32\_t F\_X86\_64 = uint32\_t(4) << [F\_BIT]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry::F_BIT") Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [RuntimeTableEntry]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry") &entry) #### [` RuntimeTable `]() class RuntimeTable Represents a runtime table of function variants sharing a common namespace (referred to internally as `FunctionVariantsRuntimeTable` in `dyld`). Each table holds multiple [RuntimeTableEntry]() instances that map to function implementations optimized for a given [KIND](). Public Types ##### [` KIND `]() enum class KIND : uint32\_t Enumeration describing the namespace or category of a function variant. Each [FunctionVariants::RuntimeTable]() is associated with one [KIND](), which indicates the domain or context under which its variant entries should be considered valid or applicable. These categories map to the runtime dispatch logic used by `dyld` when selecting the optimal function variant. *Values:* ###### [` UNKNOWN `]() enumerator UNKNOWN = 0 Fallback/default kind when the category is not recognized. ###### [` PER_PROCESS `]() enumerator PER\_PROCESS = 1 Variants that apply on a per-process basis. ###### [` SYSTEM_WIDE `]() enumerator SYSTEM\_WIDE = 2 Variants that are selected based on system-wide capabilities or configurations. ###### [` ARM64 `]() enumerator ARM64 = 3 Variants optimized for the ARM64 architecture. ###### [` X86_64 `]() enumerator X86\_64 = 4 Variants optimized for the x86-64 architecture. ##### [` entries_t `]() using entries\_t = std::vector<[RuntimeTableEntry]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry")> ##### [` it_entries `]() using it\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[entries\_t]( "LIEF::MachO::FunctionVariants::RuntimeTable::entries_t")&> Iterator that outputs [RuntimeTableEntry]()&. ##### [` it_const_entries `]() using it\_const\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [entries\_t]( "LIEF::MachO::FunctionVariants::RuntimeTable::entries_t")&> Iterator that outputs const [RuntimeTableEntry]()&. Public Functions ##### [` RuntimeTable `]() RuntimeTable() = default ##### [` RuntimeTable `]() inline RuntimeTable([KIND]( "LIEF::MachO::FunctionVariants::RuntimeTable::KIND") kind, uint32\_t offset) ##### [` RuntimeTable `]() RuntimeTable(const [RuntimeTable]( "LIEF::MachO::FunctionVariants::RuntimeTable::RuntimeTable")&) = default ##### [` operator= `]() [RuntimeTable]( "LIEF::MachO::FunctionVariants::RuntimeTable") &operator=(const [RuntimeTable]( "LIEF::MachO::FunctionVariants::RuntimeTable")&) = default ##### [` RuntimeTable `]() RuntimeTable([RuntimeTable]( "LIEF::MachO::FunctionVariants::RuntimeTable::RuntimeTable")&&) noexcept = default ##### [` operator= `]() [RuntimeTable]( "LIEF::MachO::FunctionVariants::RuntimeTable") &operator=([RuntimeTable]( "LIEF::MachO::FunctionVariants::RuntimeTable")&&) noexcept = default ##### [` ~RuntimeTable `]() ~RuntimeTable() = default ##### [` kind `]() inline [KIND]( "LIEF::MachO::FunctionVariants::RuntimeTable::KIND") kind() const Kind of this runtime table. ##### [` offset `]() inline uint32\_t offset() const Original offset in the payload. ##### [` entries `]() inline [it\_entries]( "LIEF::MachO::FunctionVariants::RuntimeTable::it_entries") entries() Iterator over the different [RuntimeTableEntry]() entries. ##### [` entries `]() inline [it\_const\_entries]( "LIEF::MachO::FunctionVariants::RuntimeTable::it_const_entries") entries() const ##### [` add `]() inline void add([RuntimeTableEntry]( "LIEF::MachO::FunctionVariants::RuntimeTableEntry") entry) ##### [` to_string `]() std::string to\_string() const Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [RuntimeTable]( "LIEF::MachO::FunctionVariants::RuntimeTable") &table) --- ## [Function Variant Fixups]() ### [` FunctionVariantFixups `]() class FunctionVariantFixups : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class which represents the `LC_FUNCTION_VARIANT_FIXUPS` command. This command contains the relocations that must be applied to the GOT-like slots associated with a [FunctionVariants]() table. At runtime, `dyld` resolves each slot to the best implementation and (re-)signs it according to the pointer-authentication information. Public Types #### [` fixups_t `]() using fixups\_t = std::vector<[Fixup]( "LIEF::MachO::FunctionVariantFixups::Fixup")> #### [` it_fixups `]() using it\_fixups = [ref\_iterator]( "LIEF::ref_iterator")<[fixups\_t]( "LIEF::MachO::FunctionVariantFixups::fixups_t")&> Iterator that outputs [Fixup]()&. #### [` it_const_fixups `]() using it\_const\_fixups = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [fixups\_t]( "LIEF::MachO::FunctionVariantFixups::fixups_t")&> Iterator that outputs const [Fixup]()&. Public Functions #### [` FunctionVariantFixups `]() FunctionVariantFixups() = default #### [` FunctionVariantFixups `]() FunctionVariantFixups([FunctionVariantFixups]( "LIEF::MachO::FunctionVariantFixups::FunctionVariantFixups")&&) noexcept = default #### [` operator= `]() [FunctionVariantFixups]( "LIEF::MachO::FunctionVariantFixups") &operator=([FunctionVariantFixups]( "LIEF::MachO::FunctionVariantFixups")&&) noexcept = default #### [` FunctionVariantFixups `]() FunctionVariantFixups(const details::linkedit\_data\_command &cmd) #### [` operator= `]() [FunctionVariantFixups]( "LIEF::MachO::FunctionVariantFixups") &operator=(const [FunctionVariantFixups]( "LIEF::MachO::FunctionVariantFixups") &copy) = default #### [` FunctionVariantFixups `]() FunctionVariantFixups(const [FunctionVariantFixups]( "LIEF::MachO::FunctionVariantFixups::FunctionVariantFixups") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` data_offset `]() inline uint32\_t data\_offset() const Offset in the `__LINKEDIT` [SegmentCommand]() where the payload starts. #### [` data_size `]() inline uint32\_t data\_size() const Size of the payload. #### [` data_offset `]() inline void data\_offset(uint32\_t offset) #### [` data_size `]() inline void data\_size(uint32\_t size) #### [` content `]() inline span<const uint8\_t> content() const Return the data slice in the `__LINKEDIT` segment referenced by data\_offset and data\_size. #### [` content `]() inline span<uint8\_t> content() #### [` fixups `]() inline [it\_fixups]( "LIEF::MachO::FunctionVariantFixups::it_fixups") fixups() Iterator over the different [Fixup]() entries. #### [` fixups `]() inline [it\_const\_fixups]( "LIEF::MachO::FunctionVariantFixups::it_const_fixups") fixups() const #### [` add `]() inline [FunctionVariantFixups]( "LIEF::MachO::FunctionVariantFixups") &add([Fixup]( "LIEF::MachO::FunctionVariantFixups::Fixup") fixup) Append a new [Fixup](). #### [` ~FunctionVariantFixups `]() ~FunctionVariantFixups() override = default #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) #### [` parse_payload `]() static std::vector<[Fixup]( "LIEF::MachO::FunctionVariantFixups::Fixup")> parse\_payload([SpanStream]( "LIEF::SpanStream") &stream) #### [` Fixup `]() class Fixup A single relocation associated with a function-variant. It mirrors the `FunctionVariantFixups::InternalFixup` structure used by `dyld` and describes a slot that must be fixed up to point to the variant referenced by [variant\_index()](). Public Functions ##### [` Fixup `]() Fixup() = default ##### [` Fixup `]() inline Fixup(uint32\_t seg\_offset, uint32\_t seg\_index, uint32\_t variant\_index, bool pac\_auth, bool pac\_address, uint8\_t pac\_key, uint16\_t pac\_diversity) ##### [` Fixup `]() Fixup(const details::function\_variant\_fixup\_t &raw) ##### [` Fixup `]() Fixup(const [Fixup]( "LIEF::MachO::FunctionVariantFixups::Fixup::Fixup")&) = default ##### [` operator= `]() [Fixup]( "LIEF::MachO::FunctionVariantFixups::Fixup") &operator=(const [Fixup]( "LIEF::MachO::FunctionVariantFixups::Fixup")&) = default ##### [` Fixup `]() Fixup([Fixup]( "LIEF::MachO::FunctionVariantFixups::Fixup::Fixup")&&) noexcept = default ##### [` operator= `]() [Fixup]( "LIEF::MachO::FunctionVariantFixups::Fixup") &operator=([Fixup]( "LIEF::MachO::FunctionVariantFixups::Fixup")&&) noexcept = default ##### [` ~Fixup `]() ~Fixup() = default ##### [` seg_offset `]() inline uint32\_t seg\_offset() const Offset of the slot to fix up, relative to the segment designated by [seg\_index()](). ##### [` seg_index `]() inline uint32\_t seg\_index() const Index of the segment that owns the slot to fix up. ##### [` variant_index `]() inline uint32\_t variant\_index() const Index of the [FunctionVariants]() runtime table used to resolve the slot. ##### [` pac_auth `]() inline bool pac\_auth() const Whether the slot is signed with pointer authentication (arm64e). ##### [` pac_address `]() inline bool pac\_address() const Whether the pointer-authentication signature mixes the storage address (address diversity). ##### [` pac_key `]() inline uint8\_t pac\_key() const Pointer-authentication key used to sign the slot. ##### [` pac_diversity `]() inline uint16\_t pac\_diversity() const Pointer-authentication diversity (discriminator) of the slot. ##### [` segment `]() inline [SegmentCommand]( "LIEF::MachO::SegmentCommand") \*segment() [SegmentCommand]() referenced by [seg\_index()]() if it could be resolved. ##### [` segment `]() inline const [SegmentCommand]( "LIEF::MachO::SegmentCommand") \*segment() const ##### [` seg_offset `]() inline void seg\_offset(uint32\_t value) ##### [` seg_index `]() inline void seg\_index(uint32\_t value) ##### [` variant_index `]() inline void variant\_index(uint32\_t value) ##### [` pac_auth `]() inline void pac\_auth(bool value) ##### [` pac_address `]() inline void pac\_address(bool value) ##### [` pac_key `]() inline void pac\_key(uint8\_t value) ##### [` pac_diversity `]() inline void pac\_diversity(uint16\_t value) ##### [` segment `]() inline void segment([SegmentCommand]( "LIEF::MachO::SegmentCommand") &seg) ##### [` to_string `]() std::string to\_string() const Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Fixup]( "LIEF::MachO::FunctionVariantFixups::Fixup") &fixup) --- ## [Lazy Load Dylib Info]() ### [` LazyLoadDylibInfo `]() class LazyLoadDylibInfo : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class representing the `LC_LAZY_LOAD_DYLIB_INFO` load command. This command describes how to **lazily load a dylib**: instead of binding the library and its symbols at launch time, `dyld` keeps the information required to resolve the dylib on the first use of one of its symbols. Public Types #### [` fixups_t `]() using fixups\_t = std::vector<[Fixup]( "LIEF::MachO::LazyLoadDylibInfo::Fixup")> #### [` it_fixups `]() using it\_fixups = [ref\_iterator]( "LIEF::ref_iterator")<[fixups\_t]( "LIEF::MachO::LazyLoadDylibInfo::fixups_t")&> Iterator that outputs [Fixup]()&. #### [` it_const_fixups `]() using it\_const\_fixups = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [fixups\_t]( "LIEF::MachO::LazyLoadDylibInfo::fixups_t")&> Iterator that outputs const [Fixup]()&. Public Functions #### [` LazyLoadDylibInfo `]() LazyLoadDylibInfo() #### [` LazyLoadDylibInfo `]() LazyLoadDylibInfo(const details::linkedit\_data\_command &cmd) #### [` operator= `]() [LazyLoadDylibInfo]( "LIEF::MachO::LazyLoadDylibInfo") &operator=(const [LazyLoadDylibInfo]( "LIEF::MachO::LazyLoadDylibInfo") &copy) = default #### [` LazyLoadDylibInfo `]() LazyLoadDylibInfo(const [LazyLoadDylibInfo]( "LIEF::MachO::LazyLoadDylibInfo::LazyLoadDylibInfo") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` data_offset `]() inline uint32\_t data\_offset() const Offset in the `__LINKEDIT` segment where the payload starts. #### [` data_size `]() inline uint32\_t data\_size() const Size of the payload. #### [` data_offset `]() inline void data\_offset(uint32\_t offset) #### [` data_size `]() inline void data\_size(uint32\_t size) #### [` content `]() inline span<const uint8\_t> content() const Return the data slice in the `__LINKEDIT` segment referenced by data\_offset and data\_size. #### [` content `]() inline span<uint8\_t> content() #### [` load_path `]() inline std::string\_view load\_path() const Load path of the dylib to bind lazily. #### [` load_path `]() inline [LazyLoadDylibInfo]( "LIEF::MachO::LazyLoadDylibInfo") &load\_path(std::string value) Change the load path of the dylib to bind lazily. #### [` flag_image_offset `]() inline uint32\_t flag\_image\_offset() const Image offset of the global flag that is set once the dylib has been loaded by dyld. #### [` flag_image_offset `]() inline [LazyLoadDylibInfo]( "LIEF::MachO::LazyLoadDylibInfo") &flag\_image\_offset(uint32\_t value) #### [` flags `]() inline uint16\_t flags() const Raw flags associated with this command. #### [` flags `]() inline [LazyLoadDylibInfo]( "LIEF::MachO::LazyLoadDylibInfo") &flags(uint16\_t value) #### [` may_be_missing `]() inline bool may\_be\_missing() const Whether the dylib is allowed to be missing at runtime (i.e. “weak linked”). #### [` may_be_missing `]() inline [LazyLoadDylibInfo]( "LIEF::MachO::LazyLoadDylibInfo") &may\_be\_missing(bool value) Set or clear the “may be missing” (weak linked) bit of [flags()](). #### [` pointer_format `]() inline uint16\_t pointer\_format() const Chained-fixups pointer format used by the binding chain (e.g. `DYLD_CHAINED_PTR_ARM64E_USERLAND`). #### [` pointer_format `]() inline [LazyLoadDylibInfo]( "LIEF::MachO::LazyLoadDylibInfo") &pointer\_format(uint16\_t value) #### [` chain_start_image_offset `]() inline uint32\_t chain\_start\_image\_offset() const Image offset of the fixup chain start used to bind the dylib’s symbols. #### [` chain_start_image_offset `]() inline [LazyLoadDylibInfo]( "LIEF::MachO::LazyLoadDylibInfo") &chain\_start\_image\_offset(uint32\_t value) #### [` symbols `]() inline const std::vector<std::string> &symbols() const List of the symbol names to bind lazily for this dylib. #### [` symbols `]() inline [LazyLoadDylibInfo]( "LIEF::MachO::LazyLoadDylibInfo") &symbols(std::vector<std::string> value) Replace the list of the symbol names to bind lazily for this dylib. #### [` add_symbol `]() inline [LazyLoadDylibInfo]( "LIEF::MachO::LazyLoadDylibInfo") &add\_symbol(std::string value) Append a symbol name to the list of symbols to bind lazily. #### [` clear_symbols `]() inline [LazyLoadDylibInfo]( "LIEF::MachO::LazyLoadDylibInfo") &clear\_symbols() Remove all the symbol names to bind lazily. #### [` fixups `]() inline [it\_fixups]( "LIEF::MachO::LazyLoadDylibInfo::it_fixups") fixups() Iterator over the lazy-binding [Fixup]() entries. #### [` fixups `]() inline [it\_const\_fixups]( "LIEF::MachO::LazyLoadDylibInfo::it_const_fixups") fixups() const #### [` ~LazyLoadDylibInfo `]() ~LazyLoadDylibInfo() override = default #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) Public Static Attributes #### [` MAYBE_MISSING_FLAG `]() static auto MAYBE\_MISSING\_FLAG = 1 #### [` Fixup `]() class Fixup A single lazy-binding fixup decoded from the chain referenced by chain\_start\_image\_offset and decoded according to pointer\_format. Public Functions ##### [` Fixup `]() Fixup() = default ##### [` Fixup `]() inline Fixup(uint64\_t address, uint32\_t ordinal, std::string symbol, bool is\_auth) ##### [` Fixup `]() Fixup(const [Fixup]( "LIEF::MachO::LazyLoadDylibInfo::Fixup::Fixup")&) = default ##### [` operator= `]() [Fixup]( "LIEF::MachO::LazyLoadDylibInfo::Fixup") &operator=(const [Fixup]( "LIEF::MachO::LazyLoadDylibInfo::Fixup")&) = default ##### [` Fixup `]() Fixup([Fixup]( "LIEF::MachO::LazyLoadDylibInfo::Fixup::Fixup")&&) noexcept = default ##### [` operator= `]() [Fixup]( "LIEF::MachO::LazyLoadDylibInfo::Fixup") &operator=([Fixup]( "LIEF::MachO::LazyLoadDylibInfo::Fixup")&&) noexcept = default ##### [` ~Fixup `]() ~Fixup() = default ##### [` address `]() inline uint64\_t address() const Virtual address of the slot bound by this fixup. ##### [` address `]() inline void address(uint64\_t value) ##### [` ordinal `]() inline uint32\_t ordinal() const Index of the bound symbol in the symbols table of [LazyLoadDylibInfo](). ##### [` symbol `]() inline std::string\_view symbol() const Name of the bound symbol, resolved from [ordinal()]() (empty if the ordinal is out of the [symbols()]() range). ##### [` is_auth `]() inline bool is\_auth() const Whether the bound pointer is authenticated (`arm64e` PAC). ##### [` to_string `]() std::string to\_string() const Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Fixup]( "LIEF::MachO::LazyLoadDylibInfo::Fixup") &fixup) --- ## [Source Version]() ### [` SourceVersion `]() class SourceVersion : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class that represents the MachO [LoadCommand::TYPE::SOURCE\_VERSION]() This command is used to provide the *version* of the sources used to build the binary. Public Types #### [` version_t `]() using version\_t = std::array<uint32\_t, 5> Version is an array of **5** integers. Public Functions #### [` SourceVersion `]() SourceVersion() = default #### [` SourceVersion `]() SourceVersion(const details::source\_version\_command &version\_cmd) #### [` operator= `]() [SourceVersion]( "LIEF::MachO::SourceVersion") &operator=(const [SourceVersion]( "LIEF::MachO::SourceVersion") &copy) = default #### [` SourceVersion `]() SourceVersion(const [SourceVersion]( "LIEF::MachO::SourceVersion::SourceVersion") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` ~SourceVersion `]() ~SourceVersion() override = default #### [` version `]() inline const [version\_t]( "LIEF::MachO::SourceVersion::version_t") &version() const Return the version as an array. #### [` version `]() inline void version(const [version\_t]( "LIEF::MachO::SourceVersion::version_t") &version) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [Version Min]() ### [` VersionMin `]() class VersionMin : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class that wraps the LC\_VERSION\_MIN\_MACOSX, LC\_VERSION\_MIN\_IPHONEOS, … commands. Public Types #### [` version_t `]() using version\_t = std::array<uint32\_t, 3> Version is an array of **3** integers. Public Functions #### [` VersionMin `]() VersionMin() = default #### [` VersionMin `]() VersionMin(const details::version\_min\_command &version\_cmd) #### [` operator= `]() [VersionMin]( "LIEF::MachO::VersionMin") &operator=(const [VersionMin]( "LIEF::MachO::VersionMin") &copy) = default #### [` VersionMin `]() VersionMin(const [VersionMin]( "LIEF::MachO::VersionMin::VersionMin") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` ~VersionMin `]() ~VersionMin() override = default #### [` version `]() inline const [version\_t]( "LIEF::MachO::VersionMin::version_t") &version() const Return the version as an array. #### [` version `]() inline void version(const [version\_t]( "LIEF::MachO::VersionMin::version_t") &version) #### [` sdk `]() inline const [version\_t]( "LIEF::MachO::VersionMin::version_t") &sdk() const Return the sdk version as an array. #### [` sdk `]() inline void sdk(const [version\_t]( "LIEF::MachO::VersionMin::version_t") &sdk) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [Routine]() ### [` Routine `]() class Routine : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class that represents the `LC_ROUTINE/LC_ROUTINE64` commands. According to the Mach-O `loader.h` documentation: > The routines command contains the address of the dynamic shared library initialization routine and an index into the module table for the module that defines the routine. Before any modules are used from the library the dynamic linker fully binds the module that defines the initialization routine and then calls it. This gets called before any module initialization routines (used for C++ static constructors) in the library. Public Functions #### [` Routine `]() Routine() = default #### [` TRoutine `]() template<class T> Routine(const [T]( "LIEF::MachO::Routine::Routine::T") &cmd) #### [` operator= `]() [Routine]( "LIEF::MachO::Routine") &operator=(const [Routine]( "LIEF::MachO::Routine") &copy) = default #### [` Routine `]() Routine(const [Routine]( "LIEF::MachO::Routine::Routine") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` init_address `]() inline uint64\_t init\_address() const address of initialization routine #### [` init_address `]() inline void init\_address(uint64\_t addr) #### [` init_module `]() inline uint64\_t init\_module() const Index into the module table that the init routine is defined in. #### [` init_module `]() inline void init\_module(uint64\_t mod) #### [` reserved1 `]() inline uint64\_t reserved1() const #### [` reserved1 `]() inline void reserved1(uint64\_t value) #### [` reserved2 `]() inline uint64\_t reserved2() const #### [` reserved2 `]() inline void reserved2(uint64\_t value) #### [` reserved3 `]() inline uint64\_t reserved3() const #### [` reserved3 `]() inline void reserved3(uint64\_t value) #### [` reserved4 `]() inline uint64\_t reserved4() const #### [` reserved4 `]() inline void reserved4(uint64\_t value) #### [` reserved5 `]() inline uint64\_t reserved5() const #### [` reserved5 `]() inline void reserved5(uint64\_t value) #### [` reserved6 `]() inline uint64\_t reserved6() const #### [` reserved6 `]() inline void reserved6(uint64\_t value) #### [` ~Routine `]() ~Routine() override = default #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [Relocation]() ### [` Relocation `]() class Relocation : public LIEF::[Relocation]( "LIEF::Relocation") Class that represents a Mach-O relocation. > **See also** > > - [MachO::RelocationObject]() > - [MachO::RelocationDyld]() > - [MachO::RelocationFixup]() Subclassed by [LIEF::MachO::RelocationDyld](), [LIEF::MachO::RelocationFixup](), [LIEF::MachO::RelocationObject]() Public Types #### [` ORIGIN `]() enum class ORIGIN *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` DYLDINFO `]() enumerator DYLDINFO = 1 ##### [` RELOC_TABLE `]() enumerator RELOC\_TABLE = 2 ##### [` CHAINED_FIXUPS `]() enumerator CHAINED\_FIXUPS = 3 Public Functions #### [` Relocation `]() Relocation() = default #### [` Relocation `]() Relocation(uint64\_t address, uint8\_t type) #### [` operator= `]() [Relocation]( "LIEF::MachO::Relocation") &operator=(const [Relocation]( "LIEF::MachO::Relocation") &other) #### [` Relocation `]() Relocation(const [Relocation]( "LIEF::MachO::Relocation::Relocation") &other) #### [` swap `]() void swap([Relocation]( "LIEF::MachO::Relocation") &other) noexcept #### [` ~Relocation `]() ~Relocation() override = default #### [` clone `]() virtual std::unique\_ptr<[Relocation]( "LIEF::MachO::Relocation")> clone() const = 0 #### [` is_pc_relative `]() virtual bool is\_pc\_relative() const = 0 Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing. For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction. #### [` type `]() inline virtual uint8\_t type() const Type of the relocation according to the [Relocation::architecture]() and/or the [Relocation::origin](). See: - [MachO::X86\_RELOCATION]() - [MachO::X86\_64\_RELOCATION]() - [MachO::PPC\_RELOCATION]() - [MachO::ARM\_RELOCATION]() - [MachO::ARM64\_RELOCATION]() - MachO::REBASE\_TYPES #### [` architecture `]() inline [Header]( "LIEF::MachO::Header")::[CPU\_TYPE]( "LIEF::MachO::Header::CPU_TYPE") architecture() const Architecture targeted by this relocation. #### [` origin `]() virtual [ORIGIN]( "LIEF::MachO::Relocation::ORIGIN") origin() const = 0 Origin of the relocation. #### [` has_symbol `]() inline bool has\_symbol() const `true` if the relocation has a symbol associated with #### [` symbol `]() inline [Symbol]( "LIEF::MachO::Symbol") \*symbol() [Symbol]() associated with the relocation, if any, otherwise a nullptr. #### [` symbol `]() inline const [Symbol]( "LIEF::MachO::Symbol") \*symbol() const #### [` has_section `]() inline bool has\_section() const `true` if the relocation has a section associated with #### [` section `]() inline [Section]( "LIEF::MachO::Section") \*section() [Section]() associated with the relocation, if any, otherwise a nullptr. #### [` section `]() inline const [Section]( "LIEF::MachO::Section") \*section() const #### [` has_segment `]() inline bool has\_segment() const `true` if the relocation has a [SegmentCommand]() associated with #### [` segment `]() inline [SegmentCommand]( "LIEF::MachO::SegmentCommand") \*segment() [SegmentCommand]() associated with the relocation, if any, otherwise a nullptr. #### [` segment `]() inline const [SegmentCommand]( "LIEF::MachO::SegmentCommand") \*segment() const #### [` Tcast `]() template<class T> inline const [T]( "LIEF::MachO::Relocation::cast::T") \*cast() const #### [` Tcast `]() template<class T> inline [T]( "LIEF::MachO::Relocation::cast::T") \*cast() #### [` pc_relative `]() virtual void pc\_relative(bool val) = 0 #### [` type `]() virtual void type(uint8\_t type) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const #### [` address `]() inline virtual uint64\_t address() const [Relocation]()’s address. #### [` address `]() inline virtual void address(uint64\_t address) #### [` size `]() inline virtual size\_t size() const [Relocation]() size in **bits**. #### [` size `]() inline virtual void size(size\_t size) Public Static Attributes #### [` R_SCATTERED `]() static auto R\_SCATTERED = uint32\_t(0x80000000) #### [` R_ABS `]() static auto R\_ABS = uint32\_t(0) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Relocation]( "LIEF::MachO::Relocation") &relocation) --- ## [Relocation Object]() ### [` RelocationObject `]() class RelocationObject : public LIEF::MachO::[Relocation]( "LIEF::MachO::Relocation") Class that represents a relocation present in the MachO object file (`.o`). Usually, this kind of relocation is found in the [MachO::Section](). > **See also** > > [RelocationDyld]() Public Functions #### [` RelocationObject `]() RelocationObject() = default #### [` RelocationObject `]() RelocationObject(const details::relocation\_info &relocinfo) #### [` RelocationObject `]() RelocationObject(const details::scattered\_relocation\_info &scattered\_relocinfo) #### [` operator= `]() [RelocationObject]( "LIEF::MachO::RelocationObject") &operator=(const [RelocationObject]( "LIEF::MachO::RelocationObject") &other) = default #### [` RelocationObject `]() RelocationObject(const [RelocationObject]( "LIEF::MachO::RelocationObject::RelocationObject") &other) = default #### [` swap `]() void swap([RelocationObject]( "LIEF::MachO::RelocationObject") &other) noexcept #### [` ~RelocationObject `]() ~RelocationObject() override = default #### [` clone `]() inline virtual std::unique\_ptr<[Relocation]( "LIEF::MachO::RelocationObject::Relocation")> clone() const override #### [` is_pc_relative `]() inline virtual bool is\_pc\_relative() const override Whether the relocation is PC relative. #### [` size `]() virtual size\_t size() const override Size of the relocation. #### [` address `]() virtual uint64\_t address() const override Address where the relocation is applied This address is relative to the start of the section where the relocation takes place. #### [` is_scattered `]() inline bool is\_scattered() const `true` if the relocation is a scattered one #### [` value `]() int32\_t value() const For **scattered** relocations: The address of the relocatable expression for the item in the file that needs to be updated if the address is changed. For relocatable expressions with the difference of two section addresses, the address from which to subtract (in mathematical terms, the minuend) is contained in the first relocation entry and the address to subtract (the subtrahend) is contained in the second relocation entry. #### [` origin `]() inline virtual ORIGIN origin() const override Origin of the relocation. For this object it should be [Relocation::ORIGIN::RELOC\_TABLE]()). #### [` pc_relative `]() inline virtual void pc\_relative(bool val) override #### [` size `]() virtual void size(size\_t size) override #### [` value `]() void value(int32\_t value) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() inline virtual std::ostream &print(std::ostream &os) const override #### [` Relocation `]() Relocation() = default #### [` Relocation `]() Relocation(uint64\_t address, uint8\_t type) #### [` Relocation `]() Relocation(const [Relocation]( "LIEF::MachO::RelocationObject::Relocation") &other) Public Static Functions #### [` classof `]() static inline bool classof(const [Relocation]( "LIEF::MachO::RelocationObject::Relocation") &r) --- ## [Relocation Dyld]() ### [` RelocationDyld `]() class RelocationDyld : public LIEF::MachO::[Relocation]( "LIEF::MachO::Relocation") Class that represents a relocation found in the [DyldInfo]() structure. While this class does not have an associated structure in the Mach-O format specification, it provides a convenient interface for the Dyld::rebase Public Functions #### [` RelocationDyld `]() RelocationDyld() = default #### [` operator= `]() [RelocationDyld]( "LIEF::MachO::RelocationDyld") &operator=(const [RelocationDyld]( "LIEF::MachO::RelocationDyld")&) = default #### [` RelocationDyld `]() RelocationDyld(const [RelocationDyld]( "LIEF::MachO::RelocationDyld::RelocationDyld")&) = default #### [` ~RelocationDyld `]() ~RelocationDyld() override = default #### [` clone `]() inline virtual std::unique\_ptr<[Relocation]( "LIEF::MachO::RelocationDyld::Relocation")> clone() const override #### [` is_pc_relative `]() virtual bool is\_pc\_relative() const override Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing. For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction. #### [` origin `]() inline virtual ORIGIN origin() const override Origin of the relocation. For this concrete object, it should be [Relocation::ORIGIN::DYLDINFO](). #### [` pc_relative `]() virtual void pc\_relative(bool val) override #### [` operator< `]() bool operator<(const [RelocationDyld]( "LIEF::MachO::RelocationDyld") &rhs) const #### [` operator>= `]() inline bool operator>=(const [RelocationDyld]( "LIEF::MachO::RelocationDyld") &rhs) const #### [` operator> `]() bool operator>(const [RelocationDyld]( "LIEF::MachO::RelocationDyld") &rhs) const #### [` operator<= `]() inline bool operator<=(const [RelocationDyld]( "LIEF::MachO::RelocationDyld") &rhs) const #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() inline virtual std::ostream &print(std::ostream &os) const override #### [` Relocation `]() Relocation() = default #### [` Relocation `]() Relocation(uint64\_t address, uint8\_t type) #### [` Relocation `]() Relocation(const [Relocation]( "LIEF::MachO::RelocationDyld::Relocation") &other) #### [` operator< `]() inline virtual bool operator<(const [Relocation]( "LIEF::MachO::RelocationDyld::Relocation") &rhs) const Comparison based on the [Relocation]()’s **address**. #### [` operator<= `]() inline virtual bool operator<=(const [Relocation]( "LIEF::MachO::RelocationDyld::Relocation") &rhs) const Comparison based on the [Relocation]()’s **address**. #### [` operator> `]() inline virtual bool operator>(const [Relocation]( "LIEF::MachO::RelocationDyld::Relocation") &rhs) const Comparison based on the [Relocation]()’s **address**. #### [` operator>= `]() inline virtual bool operator>=(const [Relocation]( "LIEF::MachO::RelocationDyld::Relocation") &rhs) const Comparison based on the [Relocation]()’s **address**. Public Static Functions #### [` classof `]() static inline bool classof(const [Relocation]( "LIEF::MachO::RelocationDyld::Relocation") &r) --- ## [Relocation Fixup]() ### [` RelocationFixup `]() class RelocationFixup : public LIEF::MachO::[Relocation]( "LIEF::MachO::Relocation") Class that represents a rebase relocation found in the `LC_DYLD_CHAINED_FIXUPS` command. This class extends [LIEF::Relocation]() in which [LIEF::Relocation::address]() is set to the absolute virtual address where the relocation must take place (e.g. `0x10000d270`). On the other hand, [RelocationFixup::target]() contains the value that should be set at [LIEF::Relocation::address]() if the imagebase is [LIEF::Binary::imagebase]() (e.g. `0x1000073a8`). If the Mach-O loader chooses another base address (like 0x7ff100000), it must set `0x10000d270` to `0x7ff1073a8`. Public Functions #### [` RelocationFixup `]() RelocationFixup() = delete #### [` RelocationFixup `]() RelocationFixup([DYLD\_CHAINED\_PTR\_FORMAT]( "LIEF::MachO::DYLD_CHAINED_PTR_FORMAT") fmt, uint64\_t imagebase) #### [` operator= `]() [RelocationFixup]( "LIEF::MachO::RelocationFixup") &operator=(const [RelocationFixup]( "LIEF::MachO::RelocationFixup")&) #### [` RelocationFixup `]() RelocationFixup(const [RelocationFixup]( "LIEF::MachO::RelocationFixup::RelocationFixup")&) #### [` operator= `]() [RelocationFixup]( "LIEF::MachO::RelocationFixup") &operator=([RelocationFixup]( "LIEF::MachO::RelocationFixup")&&) noexcept = default #### [` RelocationFixup `]() RelocationFixup([RelocationFixup]( "LIEF::MachO::RelocationFixup::RelocationFixup")&&) noexcept = default #### [` ~RelocationFixup `]() ~RelocationFixup() override #### [` clone `]() inline virtual std::unique\_ptr<[Relocation]( "LIEF::MachO::Relocation")> clone() const override #### [` is_pc_relative `]() inline virtual bool is\_pc\_relative() const override Not relevant for this kind of relocation. #### [` origin `]() inline virtual ORIGIN origin() const override Origin of the relocation. For this concrete object, it should be [Relocation::ORIGIN::CHAINED\_FIXUPS](). #### [` ptr_format `]() inline [DYLD\_CHAINED\_PTR\_FORMAT]( "LIEF::MachO::DYLD_CHAINED_PTR_FORMAT") ptr\_format() const #### [` target `]() uint64\_t target() const The value that should be set at the address pointed by [LIEF::Relocation::address]() if the imagebase chosen by the loader is [LIEF::Binary::imagebase](). Otherwise: [target()]() - [LIEF::Binary::imagebase()]() + new\_imagebase. #### [` target `]() void target(uint64\_t target) #### [` pc_relative `]() inline virtual void pc\_relative(bool) override Not relevant for this kind of relocation. #### [` offset `]() inline uint32\_t offset() const #### [` offset `]() inline void offset(uint32\_t offset) #### [` address `]() inline virtual uint64\_t address() const override The address of this relocation is bound to its offset. #### [` address `]() inline virtual void address(uint64\_t address) override Changing the address means changing the offset. #### [` next `]() uint32\_t next() const Return the (unscaled) next offset in the chain. #### [` next `]() void next(uint32\_t value) Change next offset of the current element. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [Relocation]( "LIEF::MachO::Relocation") &r) --- ## [Dyld Binding Info]() ### [` DyldBindingInfo `]() class DyldBindingInfo : public LIEF::MachO::BindingInfo This class represents a symbol binding operation associated with the LC\_DYLD\_INFO bytecode. It does not represent a structure that exists in the Mach-O format specifications but it provides a *view* on an entry of the Dyld binding opcodes. > **See also** > > BindingInfo Public Types #### [` CLASS `]() enum class CLASS : uint64\_t *Values:* ##### [` WEAK `]() enumerator WEAK = 1u ##### [` LAZY `]() enumerator LAZY = 2u ##### [` STANDARD `]() enumerator STANDARD = 3u ##### [` THREADED `]() enumerator THREADED = 100u #### [` TYPE `]() enum class TYPE : uint64\_t *Values:* ##### [` POINTER `]() enumerator POINTER = 1u ##### [` TEXT_ABSOLUTE32 `]() enumerator TEXT\_ABSOLUTE32 = 2u ##### [` TEXT_PCREL32 `]() enumerator TEXT\_PCREL32 = 3u Public Functions #### [` DyldBindingInfo `]() DyldBindingInfo() = default #### [` DyldBindingInfo `]() DyldBindingInfo([CLASS]( "LIEF::MachO::DyldBindingInfo::CLASS") cls, [TYPE]( "LIEF::MachO::DyldBindingInfo::TYPE") type, uint64\_t address, int64\_t addend = 0, int32\_t oridnal = 0, bool is\_weak = false, bool is\_non\_weak\_definition = false, uint64\_t offset = 0) #### [` operator= `]() [DyldBindingInfo]( "LIEF::MachO::DyldBindingInfo") &operator=(const [DyldBindingInfo]( "LIEF::MachO::DyldBindingInfo") &other) = default #### [` DyldBindingInfo `]() DyldBindingInfo(const [DyldBindingInfo]( "LIEF::MachO::DyldBindingInfo::DyldBindingInfo") &other) = default #### [` operator= `]() [DyldBindingInfo]( "LIEF::MachO::DyldBindingInfo") &operator=([DyldBindingInfo]( "LIEF::MachO::DyldBindingInfo")&&) noexcept = default #### [` DyldBindingInfo `]() DyldBindingInfo([DyldBindingInfo]( "LIEF::MachO::DyldBindingInfo::DyldBindingInfo")&&) noexcept = default #### [` swap `]() void swap([DyldBindingInfo]( "LIEF::MachO::DyldBindingInfo") &other) noexcept #### [` binding_class `]() inline [CLASS]( "LIEF::MachO::DyldBindingInfo::CLASS") binding\_class() const Class of the binding (weak, lazy, …). #### [` binding_class `]() inline void binding\_class([CLASS]( "LIEF::MachO::DyldBindingInfo::CLASS") bind\_class) #### [` binding_type `]() inline [TYPE]( "LIEF::MachO::DyldBindingInfo::TYPE") binding\_type() const Type of the binding. Most of the time it’s [TYPE::POINTER](). #### [` binding_type `]() inline void binding\_type([TYPE]( "LIEF::MachO::DyldBindingInfo::TYPE") type) #### [` is_non_weak_definition `]() inline bool is\_non\_weak\_definition() const #### [` set_non_weak_definition `]() inline void set\_non\_weak\_definition(bool val) #### [` original_offset `]() inline uint64\_t original\_offset() const Original relative offset of the binding opcodes. #### [` type `]() inline virtual BindingInfo::TYPES type() const override The type of the binding. This type provides the origin of the binding (LC\_DYLD\_INFO or LC\_DYLD\_CHAINED\_FIXUPS). #### [` ~DyldBindingInfo `]() ~DyldBindingInfo() override = default #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` classof `]() static inline bool classof(const BindingInfo \*info) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [DyldBindingInfo]( "LIEF::MachO::DyldBindingInfo") &info) --- ## [Chained Binding Info]() ### [` ChainedBindingInfo `]() class ChainedBindingInfo : public LIEF::MachO::BindingInfo This class represents a symbol binding operation associated with the LC\_DYLD\_CHAINED\_FIXUPS command. This class does not represent a structure that exists in the Mach-O format specifications but it provides a *view* on an entry. > **See also** > > BindingInfo Public Functions #### [` ChainedBindingInfo `]() ChainedBindingInfo() = delete #### [` ChainedBindingInfo `]() explicit ChainedBindingInfo([DYLD\_CHAINED\_FORMAT]( "LIEF::MachO::DYLD_CHAINED_FORMAT") fmt, bool is\_weak) #### [` operator= `]() [ChainedBindingInfo]( "LIEF::MachO::ChainedBindingInfo") &operator=(const [ChainedBindingInfo]( "LIEF::MachO::ChainedBindingInfo") &other) #### [` ChainedBindingInfo `]() ChainedBindingInfo(const [ChainedBindingInfo]( "LIEF::MachO::ChainedBindingInfo::ChainedBindingInfo") &other) #### [` ChainedBindingInfo `]() ChainedBindingInfo([ChainedBindingInfo]( "LIEF::MachO::ChainedBindingInfo::ChainedBindingInfo")&&) noexcept #### [` operator= `]() [ChainedBindingInfo]( "LIEF::MachO::ChainedBindingInfo") &operator=([ChainedBindingInfo]( "LIEF::MachO::ChainedBindingInfo")&&) noexcept #### [` format `]() inline [DYLD\_CHAINED\_FORMAT]( "LIEF::MachO::DYLD_CHAINED_FORMAT") format() const Format of the imports. #### [` ptr_format `]() inline [DYLD\_CHAINED\_PTR\_FORMAT]( "LIEF::MachO::DYLD_CHAINED_PTR_FORMAT") ptr\_format() const Format of the pointer. #### [` offset `]() inline uint32\_t offset() const Original offset in the chain of this binding. #### [` offset `]() inline void offset(uint32\_t offset) #### [` address `]() inline virtual uint64\_t address() const override Address of the binding. #### [` address `]() inline virtual void address(uint64\_t address) override #### [` sign_extended_addend `]() uint64\_t sign\_extended\_addend() const #### [` type `]() inline virtual TYPES type() const override The type of the binding. This type provides the origin of the binding (LC\_DYLD\_INFO or LC\_DYLD\_CHAINED\_FIXUPS). #### [` ~ChainedBindingInfo `]() ~ChainedBindingInfo() override #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` classof `]() static inline bool classof(const BindingInfo \*info) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [ChainedBindingInfo]( "LIEF::MachO::ChainedBindingInfo") &info) --- ## [Export Info]() ### [` ExportInfo `]() class ExportInfo : public LIEF::Object Class that provides an interface over the Dyld export info. This class does not represent a structure that exists in the Mach-O format specification but provides a *view* on an entry of the Dyld export trie. Public Types #### [` KIND `]() enum class KIND : uint64\_t *Values:* ##### [` REGULAR `]() enumerator REGULAR = 0x00u ##### [` THREAD_LOCAL_KIND `]() enumerator THREAD\_LOCAL\_KIND = 0x01u ##### [` ABSOLUTE_KIND `]() enumerator ABSOLUTE\_KIND = 0x02u #### [` FLAGS `]() enum class FLAGS : uint64\_t *Values:* ##### [` WEAK_DEFINITION `]() enumerator WEAK\_DEFINITION = 0x04u ##### [` REEXPORT `]() enumerator REEXPORT = 0x08u ##### [` STUB_AND_RESOLVER `]() enumerator STUB\_AND\_RESOLVER = 0x10u ##### [` STATIC_RESOLVER `]() enumerator STATIC\_RESOLVER = 0x20u #### [` flag_list_t `]() using flag\_list\_t = std::vector<[FLAGS]( "LIEF::MachO::ExportInfo::FLAGS")> Public Functions #### [` ExportInfo `]() ExportInfo() = default #### [` ExportInfo `]() inline ExportInfo(uint64\_t address, uint64\_t flags, uint64\_t offset = 0) #### [` operator= `]() [ExportInfo]( "LIEF::MachO::ExportInfo") &operator=([ExportInfo]( "LIEF::MachO::ExportInfo") copy) #### [` ExportInfo `]() ExportInfo(const [ExportInfo]( "LIEF::MachO::ExportInfo::ExportInfo") &copy) #### [` swap `]() void swap([ExportInfo]( "LIEF::MachO::ExportInfo") &other) noexcept #### [` node_offset `]() inline uint64\_t node\_offset() const Original offset in the export Trie. #### [` flags `]() inline uint64\_t flags() const Some information ([ExportInfo::FLAGS]()) about the export. (like weak export, reexport, …). #### [` flags `]() inline void flags(uint64\_t flags) #### [` flags_list `]() [flag\_list\_t]( "LIEF::MachO::ExportInfo::flag_list_t") flags\_list() const The export [flags()]() as a list. #### [` has `]() bool has([FLAGS]( "LIEF::MachO::ExportInfo::FLAGS") flag) const Check if the current entry contains the provided [ExportInfo::FLAGS](). #### [` kind `]() inline [KIND]( "LIEF::MachO::ExportInfo::KIND") kind() const The export’s kind (regular, thread local, absolute, …). #### [` other `]() inline uint64\_t other() const #### [` address `]() inline uint64\_t address() const The address of the export. #### [` address `]() inline void address(uint64\_t addr) #### [` has_symbol `]() inline bool has\_symbol() const Check if a symbol is associated with this export. #### [` symbol `]() inline const [Symbol]( "LIEF::MachO::Symbol") \*symbol() const [MachO::Symbol]() associated with this export or a nullptr if no symbol. #### [` symbol `]() inline [Symbol]( "LIEF::MachO::Symbol") \*symbol() #### [` alias `]() inline [Symbol]( "LIEF::MachO::Symbol") \*alias() If the export is a [ExportInfo::FLAGS::REEXPORT](), this returns the (optional) [MachO::Symbol](). #### [` alias `]() inline const [Symbol]( "LIEF::MachO::Symbol") \*alias() const #### [` alias_library `]() inline [DylibCommand]( "LIEF::MachO::DylibCommand") \*alias\_library() If the export is a [ExportInfo::FLAGS::REEXPORT](), this returns the (optional) library ([MachO::DylibCommand]()). #### [` alias_library `]() inline const [DylibCommand]( "LIEF::MachO::DylibCommand") \*alias\_library() const #### [` ~ExportInfo `]() ~ExportInfo() override = default #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ExportInfo]( "LIEF::MachO::ExportInfo") &export\_info) --- ## [Thread Command]() ### [` ThreadCommand `]() class ThreadCommand : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class that represents the LC\_THREAD / LC\_UNIXTHREAD commands and that can be used to get the binary entrypoint when the LC\_MAIN ([MainCommand]()) is not present. Generally speaking, this command aims at defining the original state of the main thread which includes the registers’ values Public Functions #### [` ThreadCommand `]() ThreadCommand() = default #### [` ThreadCommand `]() ThreadCommand(const details::thread\_command &cmd, [Header]( "LIEF::MachO::Header")::[CPU\_TYPE]( "LIEF::MachO::Header::CPU_TYPE") arch = [Header]( "LIEF::MachO::Header")::[CPU\_TYPE]( "LIEF::MachO::Header::CPU_TYPE")::[ANY]( "LIEF::MachO::Header::CPU_TYPE::ANY")) #### [` ThreadCommand `]() ThreadCommand(uint32\_t flavor, uint32\_t count, [Header]( "LIEF::MachO::Header")::[CPU\_TYPE]( "LIEF::MachO::Header::CPU_TYPE") arch = [Header]( "LIEF::MachO::Header")::[CPU\_TYPE]( "LIEF::MachO::Header::CPU_TYPE")::[ANY]( "LIEF::MachO::Header::CPU_TYPE::ANY")) #### [` operator= `]() [ThreadCommand]( "LIEF::MachO::ThreadCommand") &operator=(const [ThreadCommand]( "LIEF::MachO::ThreadCommand") &copy) = default #### [` ThreadCommand `]() ThreadCommand(const [ThreadCommand]( "LIEF::MachO::ThreadCommand::ThreadCommand") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` ~ThreadCommand `]() ~ThreadCommand() override = default #### [` flavor `]() inline uint32\_t flavor() const Integer that defines a special *flavor* for the thread. The meaning of this value depends on the [architecture()](). The list of the values can be found in the XNU kernel files: - xnu/osfmk/mach/arm/thread\_status.h for the ARM/AArch64 architectures - xnu/osfmk/mach/i386/thread\_status.h for the x86/x86-64 architectures #### [` count `]() inline uint32\_t count() const Size of the thread state data with 32-bits alignment. This value should match [state()]().[size()]() #### [` architecture `]() inline [Header]( "LIEF::MachO::Header")::[CPU\_TYPE]( "LIEF::MachO::Header::CPU_TYPE") architecture() const The CPU architecture that is targeted by this [ThreadCommand](). #### [` state `]() inline span<const uint8\_t> state() const The actual thread state as a vector of bytes. Depending on the [architecture()](), these data can be cast into x86\_thread\_state\_t, x86\_thread\_state64\_t, … #### [` state `]() inline span<uint8\_t> state() #### [` pc `]() uint64\_t pc() const Return the initial Program Counter regardless of the underlying architecture. This value, when non null, can be used to determine the binary’s entrypoint. Underneath, it works by looking for the PC register value in the [state()]() data #### [` state `]() inline void state(std::vector<uint8\_t> state) #### [` flavor `]() inline void flavor(uint32\_t flavor) #### [` count `]() inline void count(uint32\_t count) #### [` architecture `]() inline void architecture([Header]( "LIEF::MachO::Header")::[CPU\_TYPE]( "LIEF::MachO::Header::CPU_TYPE") arch) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [RPath Command]() ### [` RPathCommand `]() class RPathCommand : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class that represents the `LC_RPATH` command. This command is used to add path for searching libraries associated with the `@rpath` prefix. Public Functions #### [` RPathCommand `]() RPathCommand() = default #### [` RPathCommand `]() RPathCommand(std::string path) #### [` RPathCommand `]() RPathCommand(const details::rpath\_command &rpathCmd) #### [` operator= `]() [RPathCommand]( "LIEF::MachO::RPathCommand") &operator=(const [RPathCommand]( "LIEF::MachO::RPathCommand") &copy) = default #### [` RPathCommand `]() RPathCommand(const [RPathCommand]( "LIEF::MachO::RPathCommand::RPathCommand") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` ~RPathCommand `]() ~RPathCommand() override = default #### [` path `]() inline std::string\_view path() const The rpath value as a string. #### [` path_offset `]() inline uint32\_t path\_offset() const Original string offset of the path. #### [` path `]() inline void path(std::string path) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` create `]() static inline std::unique\_ptr<[RPathCommand]( "LIEF::MachO::RPathCommand")> create(std::string path) Create a new RPath command for the provided `path`. #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [Code Signature]() ### [` CodeSignature `]() class CodeSignature : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Public Functions #### [` CodeSignature `]() CodeSignature() = default #### [` CodeSignature `]() CodeSignature(const details::linkedit\_data\_command &cmd) #### [` operator= `]() [CodeSignature]( "LIEF::MachO::CodeSignature") &operator=(const [CodeSignature]( "LIEF::MachO::CodeSignature") &copy) = default #### [` CodeSignature `]() CodeSignature(const [CodeSignature]( "LIEF::MachO::CodeSignature::CodeSignature") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` data_offset `]() inline uint32\_t data\_offset() const Offset in the binary where the signature starts. #### [` data_size `]() inline uint32\_t data\_size() const Size of the raw signature. #### [` data_offset `]() inline void data\_offset(uint32\_t offset) #### [` data_size `]() inline void data\_size(uint32\_t size) #### [` content `]() inline span<uint8\_t> content() #### [` content `]() inline span<const uint8\_t> content() const #### [` ~CodeSignature `]() ~CodeSignature() override = default #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [Data In Code]() ### [` DataInCode `]() class DataInCode : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Interface of the LC\_DATA\_IN\_CODE command This command is used to list slices of code sections that contain data. The *slices* information are stored as an array of [DataCodeEntry](). > **See also** > > [DataCodeEntry]() Public Types #### [` entries_t `]() using entries\_t = std::vector<[DataCodeEntry]( "LIEF::MachO::DataCodeEntry")> #### [` it_const_entries `]() using it\_const\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [entries\_t]( "LIEF::MachO::DataInCode::entries_t")&> #### [` it_entries `]() using it\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[entries\_t]( "LIEF::MachO::DataInCode::entries_t")&> Public Functions #### [` DataInCode `]() DataInCode() = default #### [` DataInCode `]() DataInCode(const details::linkedit\_data\_command &cmd) #### [` operator= `]() [DataInCode]( "LIEF::MachO::DataInCode") &operator=(const [DataInCode]( "LIEF::MachO::DataInCode")&) = default #### [` DataInCode `]() DataInCode(const [DataInCode]( "LIEF::MachO::DataInCode::DataInCode")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` data_offset `]() inline uint32\_t data\_offset() const Start of the array of the [DataCodeEntry]() entries. #### [` data_size `]() inline uint32\_t data\_size() const Size of the raw array (`size = sizeof(DataCodeEntry) * nb_elements`). #### [` data_offset `]() inline void data\_offset(uint32\_t offset) #### [` data_size `]() inline void data\_size(uint32\_t size) #### [` add `]() inline [DataInCode]( "LIEF::MachO::DataInCode") &add([DataCodeEntry]( "LIEF::MachO::DataCodeEntry") entry) Add a new entry. #### [` entries `]() inline [it\_const\_entries]( "LIEF::MachO::DataInCode::it_const_entries") entries() const Iterator over the [DataCodeEntry](). #### [` entries `]() inline [it\_entries]( "LIEF::MachO::DataInCode::it_entries") entries() #### [` content `]() inline span<uint8\_t> content() #### [` content `]() inline span<const uint8\_t> content() const #### [` ~DataInCode `]() ~DataInCode() override = default #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [Data Code Entry]() ### [` DataCodeEntry `]() class DataCodeEntry : public LIEF::Object Interface over an entry in the [DataInCode]() command. Public Types #### [` TYPES `]() enum class TYPES *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` DATA `]() enumerator DATA = 1 ##### [` JUMP_TABLE_8 `]() enumerator JUMP\_TABLE\_8 = 2 ##### [` JUMP_TABLE_16 `]() enumerator JUMP\_TABLE\_16 = 3 ##### [` JUMP_TABLE_32 `]() enumerator JUMP\_TABLE\_32 = 4 ##### [` ABS_JUMP_TABLE_32 `]() enumerator ABS\_JUMP\_TABLE\_32 = 5 Public Functions #### [` DataCodeEntry `]() DataCodeEntry() = default #### [` DataCodeEntry `]() inline DataCodeEntry(uint32\_t off, uint16\_t length, [TYPES]( "LIEF::MachO::DataCodeEntry::TYPES") type) #### [` DataCodeEntry `]() DataCodeEntry(const details::data\_in\_code\_entry &entry) #### [` operator= `]() [DataCodeEntry]( "LIEF::MachO::DataCodeEntry") &operator=(const [DataCodeEntry]( "LIEF::MachO::DataCodeEntry")&) = default #### [` DataCodeEntry `]() DataCodeEntry(const [DataCodeEntry]( "LIEF::MachO::DataCodeEntry::DataCodeEntry")&) = default #### [` offset `]() inline uint32\_t offset() const Offset of the data. #### [` length `]() inline uint16\_t length() const Length of the data. #### [` type `]() inline [TYPES]( "LIEF::MachO::DataCodeEntry::TYPES") type() const #### [` offset `]() inline void offset(uint32\_t off) #### [` length `]() inline void length(uint16\_t length) #### [` type `]() inline void type([TYPES]( "LIEF::MachO::DataCodeEntry::TYPES") type) #### [` ~DataCodeEntry `]() ~DataCodeEntry() override = default #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [DataCodeEntry]( "LIEF::MachO::DataCodeEntry") &entry) --- ## [Segment Split Info]() ### [` SegmentSplitInfo `]() class SegmentSplitInfo : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class that represents the [LoadCommand::TYPE::SEGMENT\_SPLIT\_INFO]() command. Public Functions #### [` SegmentSplitInfo `]() SegmentSplitInfo() = default #### [` SegmentSplitInfo `]() SegmentSplitInfo(const details::linkedit\_data\_command &cmd) #### [` operator= `]() [SegmentSplitInfo]( "LIEF::MachO::SegmentSplitInfo") &operator=(const [SegmentSplitInfo]( "LIEF::MachO::SegmentSplitInfo") &copy) = default #### [` SegmentSplitInfo `]() SegmentSplitInfo(const [SegmentSplitInfo]( "LIEF::MachO::SegmentSplitInfo::SegmentSplitInfo") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` data_offset `]() inline uint32\_t data\_offset() const #### [` data_size `]() inline uint32\_t data\_size() const #### [` data_offset `]() inline void data\_offset(uint32\_t offset) #### [` data_size `]() inline void data\_size(uint32\_t size) #### [` content `]() inline span<uint8\_t> content() #### [` content `]() inline span<const uint8\_t> content() const #### [` ~SegmentSplitInfo `]() ~SegmentSplitInfo() override = default #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [Sub-Framework]() ### [` SubFramework `]() class SubFramework : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class that represents the [SubFramework]() command. According to the Mach-O `loader.h` documentation: > A dynamically linked shared library may be a subframework of an umbrella framework. If so it will be linked with “-umbrella umbrella\_name” where Where “umbrella\_name” is the name of the umbrella framework. A subframework can only be linked against by its umbrella framework or other subframeworks that are part of the same umbrella framework. Otherwise the static link editor produces an error and states to link against the umbrella framework. The name of the umbrella framework for subframeworks is recorded in the following structure. Public Functions #### [` SubFramework `]() SubFramework() = default #### [` SubFramework `]() SubFramework(const details::sub\_framework\_command &cmd) #### [` operator= `]() [SubFramework]( "LIEF::MachO::SubFramework") &operator=(const [SubFramework]( "LIEF::MachO::SubFramework") &copy) = default #### [` SubFramework `]() SubFramework(const [SubFramework]( "LIEF::MachO::SubFramework::SubFramework") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` umbrella `]() inline std::string\_view umbrella() const Name of the umbrella framework. #### [` umbrella `]() inline void umbrella(std::string u) #### [` ~SubFramework `]() ~SubFramework() override = default #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [Sub-Client]() ### [` SubClient `]() class SubClient : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class that represents the [SubClient]() command. According to the Mach-O `loader.h` documentation: > For dynamically linked shared libraries that are subframework of an umbrella framework they can allow clients other than the umbrella framework or other subframeworks in the same umbrella framework. To do this the subframework is built with “-allowable\_client client\_name” and an LC\_SUB\_CLIENT load command is created for each -allowable\_client flag. The client\_name is usually a framework name. It can also be a name used for bundles clients where the bundle is built with “-client\_name client\_name”. Public Functions #### [` SubClient `]() SubClient() = default #### [` SubClient `]() SubClient(const details::sub\_client\_command &cmd) #### [` operator= `]() [SubClient]( "LIEF::MachO::SubClient") &operator=(const [SubClient]( "LIEF::MachO::SubClient") &copy) = default #### [` SubClient `]() SubClient(const [SubClient]( "LIEF::MachO::SubClient::SubClient") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` client `]() inline std::string\_view client() const Name of the client. #### [` client `]() inline void client(std::string u) #### [` ~SubClient `]() ~SubClient() override = default #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [Dyld Environment]() ### [` DyldEnvironment `]() class DyldEnvironment : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class that represents a `LC_DYLD_ENVIRONMENT` command which is used by the Mach-O linker/loader to initialize an environment variable. Public Functions #### [` DyldEnvironment `]() DyldEnvironment() = default #### [` DyldEnvironment `]() DyldEnvironment(const details::dylinker\_command &cmd) #### [` operator= `]() [DyldEnvironment]( "LIEF::MachO::DyldEnvironment") &operator=(const [DyldEnvironment]( "LIEF::MachO::DyldEnvironment") &copy) = default #### [` DyldEnvironment `]() DyldEnvironment(const [DyldEnvironment]( "LIEF::MachO::DyldEnvironment::DyldEnvironment") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` ~DyldEnvironment `]() ~DyldEnvironment() override = default #### [` print `]() virtual std::ostream &print(std::ostream &os) const override #### [` value `]() inline std::string\_view value() const The actual environment variable. #### [` value `]() inline void value(std::string value) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [Encryption Info]() ### [` EncryptionInfo `]() class EncryptionInfo : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class that represents the LC\_ENCRYPTION\_INFO / LC\_ENCRYPTION\_INFO\_64 commands. The encryption info is usually present in Mach-O executables that target iOS to encrypt some sections of the binary Public Functions #### [` EncryptionInfo `]() EncryptionInfo() = default #### [` EncryptionInfo `]() EncryptionInfo(const details::encryption\_info\_command &cmd) #### [` operator= `]() [EncryptionInfo]( "LIEF::MachO::EncryptionInfo") &operator=(const [EncryptionInfo]( "LIEF::MachO::EncryptionInfo") &copy) = default #### [` EncryptionInfo `]() EncryptionInfo(const [EncryptionInfo]( "LIEF::MachO::EncryptionInfo::EncryptionInfo") &copy) = default #### [` ~EncryptionInfo `]() ~EncryptionInfo() override = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` crypt_offset `]() inline uint32\_t crypt\_offset() const The beginning of the encrypted area. #### [` crypt_size `]() inline uint32\_t crypt\_size() const The size of the encrypted area. #### [` crypt_id `]() inline uint32\_t crypt\_id() const The encryption system. 0 means not encrypted. #### [` crypt_offset `]() inline void crypt\_offset(uint32\_t offset) #### [` crypt_size `]() inline void crypt\_size(uint32\_t size) #### [` crypt_id `]() inline void crypt\_id(uint32\_t id) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [Build Version]() ### [` BuildVersion `]() class BuildVersion : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Public Types #### [` PLATFORMS `]() enum class PLATFORMS : uint32\_t *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` MACOS `]() enumerator MACOS = 1 ##### [` IOS `]() enumerator IOS = 2 ##### [` TVOS `]() enumerator TVOS = 3 ##### [` WATCHOS `]() enumerator WATCHOS = 4 ##### [` BRIDGEOS `]() enumerator BRIDGEOS = 5 ##### [` MAC_CATALYST `]() enumerator MAC\_CATALYST = 6 ##### [` IOS_SIMULATOR `]() enumerator IOS\_SIMULATOR = 7 ##### [` TVOS_SIMULATOR `]() enumerator TVOS\_SIMULATOR = 8 ##### [` WATCHOS_SIMULATOR `]() enumerator WATCHOS\_SIMULATOR = 9 ##### [` DRIVERKIT `]() enumerator DRIVERKIT = 10 ##### [` VISIONOS `]() enumerator VISIONOS = 11 ##### [` VISIONOS_SIMULATOR `]() enumerator VISIONOS\_SIMULATOR = 12 ##### [` FIRMWARE `]() enumerator FIRMWARE = 13 ##### [` SEPOS `]() enumerator SEPOS = 14 ##### [` MACOS_EXCLAVE_CORE `]() enumerator MACOS\_EXCLAVE\_CORE = 15 ##### [` MACOS_EXCLAVE_KIT `]() enumerator MACOS\_EXCLAVE\_KIT = 16 ##### [` IOS_EXCLAVE_CORE `]() enumerator IOS\_EXCLAVE\_CORE = 17 ##### [` IOS_EXCLAVE_KIT `]() enumerator IOS\_EXCLAVE\_KIT = 18 ##### [` TVOS_EXCLAVE_CORE `]() enumerator TVOS\_EXCLAVE\_CORE = 19 ##### [` TVOS_EXCLAVE_KIT `]() enumerator TVOS\_EXCLAVE\_KIT = 20 ##### [` WATCHOS_EXCLAVE_CORE `]() enumerator WATCHOS\_EXCLAVE\_CORE = 21 ##### [` WATCHOS_EXCLAVE_KIT `]() enumerator WATCHOS\_EXCLAVE\_KIT = 22 ##### [` VISIONOS_EXCLAVE_CORE `]() enumerator VISIONOS\_EXCLAVE\_CORE = 23 ##### [` VISIONOS_EXCLAVE_KIT `]() enumerator VISIONOS\_EXCLAVE\_KIT = 24 ##### [` ANY `]() enumerator ANY = 0xFFFFFFFF #### [` version_t `]() using version\_t = std::array<uint32\_t, 3> Version is an array of **3** integers. #### [` tools_list_t `]() using tools\_list\_t = std::vector<[BuildToolVersion]( "LIEF::MachO::BuildToolVersion")> Public Functions #### [` BuildVersion `]() BuildVersion() = default #### [` BuildVersion `]() BuildVersion(const details::build\_version\_command &version\_cmd) #### [` BuildVersion `]() BuildVersion(const [PLATFORMS]( "LIEF::MachO::BuildVersion::PLATFORMS") platform, const [version\_t]( "LIEF::MachO::BuildVersion::version_t") &minos, const [version\_t]( "LIEF::MachO::BuildVersion::version_t") &sdk, const [tools\_list\_t]( "LIEF::MachO::BuildVersion::tools_list_t") &tools) #### [` operator= `]() [BuildVersion]( "LIEF::MachO::BuildVersion") &operator=(const [BuildVersion]( "LIEF::MachO::BuildVersion") &copy) = default #### [` BuildVersion `]() BuildVersion(const [BuildVersion]( "LIEF::MachO::BuildVersion::BuildVersion") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` minos `]() inline [version\_t]( "LIEF::MachO::BuildVersion::version_t") minos() const #### [` minos `]() inline void minos([version\_t]( "LIEF::MachO::BuildVersion::version_t") version) #### [` sdk `]() inline [version\_t]( "LIEF::MachO::BuildVersion::version_t") sdk() const #### [` sdk `]() inline void sdk([version\_t]( "LIEF::MachO::BuildVersion::version_t") version) #### [` platform `]() inline [PLATFORMS]( "LIEF::MachO::BuildVersion::PLATFORMS") platform() const #### [` platform `]() inline void platform([PLATFORMS]( "LIEF::MachO::BuildVersion::PLATFORMS") plat) #### [` tools `]() inline const [tools\_list\_t]( "LIEF::MachO::BuildVersion::tools_list_t") &tools() const #### [` ~BuildVersion `]() ~BuildVersion() override = default #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [Build Tool Version]() ### [` BuildToolVersion `]() class BuildToolVersion : public LIEF::Object Class that represents a tool’s version that was involved in the build of the binary. Public Types #### [` TOOLS `]() enum class TOOLS *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` CLANG `]() enumerator CLANG = 1 ##### [` SWIFT `]() enumerator SWIFT = 2 ##### [` LD `]() enumerator LD = 3 ##### [` LLD `]() enumerator LLD = 4 ##### [` METAL `]() enumerator METAL = 1024 ##### [` AIRLLD `]() enumerator AIRLLD = 1025 ##### [` AIRNT `]() enumerator AIRNT = 1026 ##### [` AIRNT_PLUGIN `]() enumerator AIRNT\_PLUGIN = 1027 ##### [` AIRPACK `]() enumerator AIRPACK = 1028 ##### [` GPUARCHIVER `]() enumerator GPUARCHIVER = 1031 ##### [` METAL_FRAMEWORK `]() enumerator METAL\_FRAMEWORK = 1032 #### [` version_t `]() using version\_t = std::array<uint32\_t, 3> A version is an array of **3** integers. Public Functions #### [` BuildToolVersion `]() BuildToolVersion() = default #### [` BuildToolVersion `]() BuildToolVersion(const details::build\_tool\_version &tool) #### [` tool `]() inline [TOOLS]( "LIEF::MachO::BuildToolVersion::TOOLS") tool() const The tools used. #### [` version `]() inline [version\_t]( "LIEF::MachO::BuildToolVersion::version_t") version() const Version associated with the tool. #### [` ~BuildToolVersion `]() ~BuildToolVersion() override = default #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [BuildToolVersion]( "LIEF::MachO::BuildToolVersion") &tool) --- ## [Fileset Command]() ### [` FilesetCommand `]() class FilesetCommand : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class associated with the LC\_FILESET\_ENTRY commands. Public Types #### [` content_t `]() using content\_t = std::vector<uint8\_t> Public Functions #### [` FilesetCommand `]() FilesetCommand() = default #### [` FilesetCommand `]() FilesetCommand(const details::fileset\_entry\_command &command) #### [` FilesetCommand `]() inline FilesetCommand(std::string name) #### [` operator= `]() [FilesetCommand]( "LIEF::MachO::FilesetCommand") &operator=([FilesetCommand]( "LIEF::MachO::FilesetCommand") copy) #### [` FilesetCommand `]() FilesetCommand(const [FilesetCommand]( "LIEF::MachO::FilesetCommand::FilesetCommand") &copy) #### [` swap `]() void swap([FilesetCommand]( "LIEF::MachO::FilesetCommand") &other) noexcept #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` ~FilesetCommand `]() ~FilesetCommand() override = default #### [` name `]() inline std::string\_view name() const Name of the underlying MachO binary (e.g. `com.apple.security.quarantine`). #### [` virtual_address `]() inline uint64\_t virtual\_address() const Memory address where the MachO file should be mapped. #### [` file_offset `]() inline uint64\_t file\_offset() const Original offset in the kernel cache. #### [` binary `]() inline const [Binary]( "LIEF::MachO::Binary") \*binary() const Return a pointer on the [LIEF::MachO::Binary]() associated with this entry. #### [` binary `]() inline [Binary]( "LIEF::MachO::Binary") \*binary() #### [` name `]() inline void name(std::string name) #### [` virtual_address `]() inline void virtual\_address(uint64\_t virtual\_address) #### [` file_offset `]() inline void file\_offset(uint64\_t file\_offset) #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) Friends **friend class BinaryParser** --- ## [DyldChainedFixups Command]() ### [` DyldChainedFixups `]() class DyldChainedFixups : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class that represents the LC\_DYLD\_CHAINED\_FIXUPS command. This command aims at providing rebase and binding information like the [DyldInfo]()’s bytecode. Compared to the [DyldInfo]() bytecode, these chained fixups are taking less space. Public Types #### [` chained_starts_in_segments_t `]() using chained\_starts\_in\_segments\_t = std::vector<[chained\_starts\_in\_segment]( "LIEF::MachO::DyldChainedFixups::chained_starts_in_segment")> Internal container for storing [chained\_starts\_in\_segment](). #### [` it_chained_starts_in_segments_t `]() using it\_chained\_starts\_in\_segments\_t = [ref\_iterator]( "LIEF::ref_iterator")<[chained\_starts\_in\_segments\_t]( "LIEF::MachO::DyldChainedFixups::chained_starts_in_segments_t")&> Iterator that outputs [chained\_starts\_in\_segment]()&. #### [` it_const_chained_starts_in_segments_t `]() using it\_const\_chained\_starts\_in\_segments\_t = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [chained\_starts\_in\_segments\_t]( "LIEF::MachO::DyldChainedFixups::chained_starts_in_segments_t")&> Iterator that outputs const [chained\_starts\_in\_segment]()&. #### [` binding_info_t `]() using binding\_info\_t = std::vector<std::unique\_ptr<[ChainedBindingInfo]( "LIEF::MachO::ChainedBindingInfo")>> Internal container for storing [DyldBindingInfo](). #### [` it_binding_info `]() using it\_binding\_info = [ref\_iterator]( "LIEF::ref_iterator")<[binding\_info\_t]( "LIEF::MachO::DyldChainedFixups::binding_info_t")&, [ChainedBindingInfo]( "LIEF::MachO::ChainedBindingInfo")\*> Iterator which outputs [DyldBindingInfo]()&. #### [` it_const_binding_info `]() using it\_const\_binding\_info = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [binding\_info\_t]( "LIEF::MachO::DyldChainedFixups::binding_info_t")&, [ChainedBindingInfo]( "LIEF::MachO::ChainedBindingInfo")\*> Iterator which outputs const [DyldBindingInfo]()&. Public Functions #### [` DyldChainedFixups `]() DyldChainedFixups() #### [` DyldChainedFixups `]() DyldChainedFixups(const details::linkedit\_data\_command &cmd) #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` ~DyldChainedFixups `]() ~DyldChainedFixups() override #### [` data_offset `]() inline uint32\_t data\_offset() const Offset of the LC\_DYLD\_CHAINED\_FIXUPS chained payload. This offset should point in the \_\_LINKEDIT segment. #### [` data_size `]() inline uint32\_t data\_size() const Size of the LC\_DYLD\_CHAINED\_FIXUPS payload. #### [` data_offset `]() inline void data\_offset(uint32\_t offset) #### [` data_size `]() inline void data\_size(uint32\_t size) #### [` payload `]() inline span<const uint8\_t> payload() const Return the raw content of the command. #### [` bindings `]() inline [it\_binding\_info]( "LIEF::MachO::DyldChainedFixups::it_binding_info") bindings() Iterator over the bindings ([ChainedBindingInfo]()) associated with this command. #### [` bindings `]() inline [it\_const\_binding\_info]( "LIEF::MachO::DyldChainedFixups::it_const_binding_info") bindings() const Iterator over the bindings ([ChainedBindingInfo]()) associated with this command. #### [` chained_starts_in_segments `]() inline [it\_chained\_starts\_in\_segments\_t]( "LIEF::MachO::DyldChainedFixups::it_chained_starts_in_segments_t") chained\_starts\_in\_segments() Iterator over the chained fixup metadata. #### [` chained_starts_in_segments `]() inline [it\_const\_chained\_starts\_in\_segments\_t]( "LIEF::MachO::DyldChainedFixups::it_const_chained_starts_in_segments_t") chained\_starts\_in\_segments() const #### [` fixups_version `]() inline uint32\_t fixups\_version() const Chained fixups version. The loader (dyld v852.2) checks that this value is set to 0. #### [` fixups_version `]() inline void fixups\_version(uint32\_t version) #### [` starts_offset `]() inline uint32\_t starts\_offset() const offset of dyld\_chained\_starts\_in\_image in chain\_data #### [` starts_offset `]() inline void starts\_offset(uint32\_t offset) #### [` imports_offset `]() inline uint32\_t imports\_offset() const Offset of imports table in chain data. #### [` imports_offset `]() inline void imports\_offset(uint32\_t offset) #### [` symbols_offset `]() inline uint32\_t symbols\_offset() const Offset of symbol strings in chain data. #### [` symbols_offset `]() inline void symbols\_offset(uint32\_t offset) #### [` imports_count `]() inline uint32\_t imports\_count() const Number of imported symbol names. #### [` imports_count `]() inline void imports\_count(uint32\_t cnt) #### [` symbols_format `]() inline uint32\_t symbols\_format() const The compression algorithm (if any) used to store the symbols 0 means uncompressed while 1 means zlib compressed. As far of the version v852.2 of dyld loader, it only supports **uncompressed** format #### [` symbols_format `]() inline void symbols\_format(uint32\_t fmt) #### [` imports_format `]() inline [DYLD\_CHAINED\_FORMAT]( "LIEF::MachO::DYLD_CHAINED_FORMAT") imports\_format() const The format of the imports ([ChainedBindingInfo]()). #### [` imports_format `]() inline void imports\_format([DYLD\_CHAINED\_FORMAT]( "LIEF::MachO::DYLD_CHAINED_FORMAT") fmt) #### [` add `]() inline [chained\_starts\_in\_segment]( "LIEF::MachO::DyldChainedFixups::chained_starts_in_segment") &add([chained\_starts\_in\_segment]( "LIEF::MachO::DyldChainedFixups::chained_starts_in_segment") start\_info) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) #### [` chained_starts_in_segment `]() struct chained\_starts\_in\_segment Structure that mirrors the raw dyld\_chained\_starts\_in\_segment which aims at providing information about the chained rebase/bind fixups. The relocations provided by this structure can be accessed through [SegmentCommand::relocations]() Public Functions ##### [` page_count `]() inline size\_t page\_count() const How many pages are in the page\_start array. Public Members ##### [` offset `]() uint32\_t offset = 0 Original offset of the structure, relative to [DyldChainedFixups::starts\_offset](). ##### [` size `]() uint32\_t size = 0 sizeof(size) + sizeof(page\_size) + … + sizeof(pointer\_format) ##### [` page_size `]() uint16\_t page\_size = 0 Likely 0x1000 for x86/x86\_64 architectures and 0x4000 for ARM64 architecture. ##### [` segment_offset `]() uint64\_t segment\_offset = 0 Offset of the segment’s data from the beginning of the file (it should match [SegmentCommand::file\_offset]()). ##### [` max_valid_pointer `]() uint32\_t max\_valid\_pointer = 0 for 32-bit OS, any value beyond this is not a pointer ##### [` pointer_format `]() [DYLD\_CHAINED\_PTR\_FORMAT]( "LIEF::MachO::DYLD_CHAINED_PTR_FORMAT") pointer\_format = [DYLD\_CHAINED\_PTR\_FORMAT]( "LIEF::MachO::DYLD_CHAINED_PTR_FORMAT")::[NONE]( "LIEF::MachO::DYLD_CHAINED_PTR_FORMAT::NONE") How pointers are encoded. ##### [` page_start `]() std::vector<uint16\_t> page\_start Offset in the [SegmentCommand]() of the first element of the chain. ##### [` chain_starts `]() std::vector<uint16\_t> chain\_starts Currently not supported. ##### [` segment `]() [SegmentCommand]( "LIEF::MachO::SegmentCommand") &segment Segment in which the rebase/bind fixups take place. Public Static Functions ##### [` create_empty_chained `]() static inline [chained\_starts\_in\_segment]( "LIEF::MachO::DyldChainedFixups::chained_starts_in_segment") create\_empty\_chained([SegmentCommand]( "LIEF::MachO::SegmentCommand") &segment) Friends ##### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [chained\_starts\_in\_segment]( "LIEF::MachO::DyldChainedFixups::chained_starts_in_segment") &info) --- ## [DyldExportsTrie Command]() ### [` DyldExportsTrie `]() class DyldExportsTrie : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class that represents the LC\_DYLD\_EXPORTS\_TRIE command. In recent Mach-O binaries, this command replaces the [DyldInfo]() export trie buffer Public Types #### [` export_info_t `]() using export\_info\_t = std::vector<std::unique\_ptr<[ExportInfo]( "LIEF::MachO::ExportInfo")>> Internal container for storing [ExportInfo](). #### [` it_export_info `]() using it\_export\_info = [ref\_iterator]( "LIEF::ref_iterator")<[export\_info\_t]( "LIEF::MachO::DyldExportsTrie::export_info_t")&, [ExportInfo]( "LIEF::MachO::ExportInfo")\*> Iterator which outputs const [ExportInfo]()&. #### [` it_const_export_info `]() using it\_const\_export\_info = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [export\_info\_t]( "LIEF::MachO::DyldExportsTrie::export_info_t")&, [ExportInfo]( "LIEF::MachO::ExportInfo")\*> Iterator which outputs const [ExportInfo]()&. Public Functions #### [` DyldExportsTrie `]() DyldExportsTrie() #### [` DyldExportsTrie `]() DyldExportsTrie(const details::linkedit\_data\_command &cmd) #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` swap `]() void swap([DyldExportsTrie]( "LIEF::MachO::DyldExportsTrie") &other) noexcept #### [` ~DyldExportsTrie `]() ~DyldExportsTrie() override #### [` data_offset `]() inline uint32\_t data\_offset() const Offset of the LC\_DYLD\_EXPORTS\_TRIE. This offset should point in the \_\_LINKEDIT segment. #### [` data_size `]() inline uint32\_t data\_size() const Size of the LC\_DYLD\_EXPORTS\_TRIE payload. #### [` data_offset `]() inline void data\_offset(uint32\_t offset) #### [` data_size `]() inline void data\_size(uint32\_t size) #### [` content `]() inline span<const uint8\_t> content() const #### [` exports `]() inline [it\_export\_info]( "LIEF::MachO::DyldExportsTrie::it_export_info") exports() Iterator over the [ExportInfo]() entries. #### [` exports `]() inline [it\_const\_export\_info]( "LIEF::MachO::DyldExportsTrie::it_const_export_info") exports() const #### [` show_export_trie `]() std::string show\_export\_trie() const Print the exports trie in a human-readable way. #### [` add `]() [ExportInfo]( "LIEF::MachO::ExportInfo") \*add(std::unique\_ptr<[ExportInfo]( "LIEF::MachO::ExportInfo")> info) Add an entry in the current trie. See also: [LIEF::MachO::Binary::add\_exported\_function](). #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [Code Signature Dir Command]() ### [` CodeSignatureDir `]() class CodeSignatureDir : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Public Functions #### [` CodeSignatureDir `]() CodeSignatureDir() = default #### [` CodeSignatureDir `]() CodeSignatureDir(const details::linkedit\_data\_command &cmd) #### [` operator= `]() [CodeSignatureDir]( "LIEF::MachO::CodeSignatureDir") &operator=(const [CodeSignatureDir]( "LIEF::MachO::CodeSignatureDir") &copy) = default #### [` CodeSignatureDir `]() CodeSignatureDir(const [CodeSignatureDir]( "LIEF::MachO::CodeSignatureDir::CodeSignatureDir") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` data_offset `]() inline uint32\_t data\_offset() const Offset in the binary where the signature starts. #### [` data_size `]() inline uint32\_t data\_size() const Size of the raw signature. #### [` data_offset `]() inline void data\_offset(uint32\_t offset) #### [` data_size `]() inline void data\_size(uint32\_t size) #### [` content `]() inline span<const uint8\_t> content() const #### [` content `]() inline span<uint8\_t> content() #### [` ~CodeSignatureDir `]() ~CodeSignatureDir() override = default #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [Linker Optimization Hint Command]() ### [` LinkerOptHint `]() class LinkerOptHint : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class which represents the `LC_LINKER_OPTIMIZATION_HINT` command. Public Functions #### [` LinkerOptHint `]() LinkerOptHint() = default #### [` LinkerOptHint `]() LinkerOptHint(const details::linkedit\_data\_command &cmd) #### [` operator= `]() [LinkerOptHint]( "LIEF::MachO::LinkerOptHint") &operator=(const [LinkerOptHint]( "LIEF::MachO::LinkerOptHint") &copy) = default #### [` LinkerOptHint `]() LinkerOptHint(const [LinkerOptHint]( "LIEF::MachO::LinkerOptHint::LinkerOptHint") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` data_offset `]() inline uint32\_t data\_offset() const Offset in the binary where the *hint* starts. #### [` data_size `]() inline uint32\_t data\_size() const Size of the payload. #### [` data_offset `]() inline void data\_offset(uint32\_t offset) #### [` data_size `]() inline void data\_size(uint32\_t size) #### [` content `]() inline span<const uint8\_t> content() const #### [` content `]() inline span<uint8\_t> content() #### [` ~LinkerOptHint `]() ~LinkerOptHint() override = default #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [Two Level Hints Command]() ### [` TwoLevelHints `]() class TwoLevelHints : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Class which represents the `LC_TWOLEVEL_HINTS` command. Public Types #### [` hints_list_t `]() using hints\_list\_t = std::vector<uint32\_t> #### [` it_hints_t `]() using it\_hints\_t = [ref\_iterator]( "LIEF::ref_iterator")<[hints\_list\_t]( "LIEF::MachO::TwoLevelHints::hints_list_t")&> #### [` it_const_hints_t `]() using it\_const\_hints\_t = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [hints\_list\_t]( "LIEF::MachO::TwoLevelHints::hints_list_t")&> Public Functions #### [` TwoLevelHints `]() TwoLevelHints() = default #### [` TwoLevelHints `]() TwoLevelHints(const details::twolevel\_hints\_command &cmd) #### [` operator= `]() [TwoLevelHints]( "LIEF::MachO::TwoLevelHints") &operator=(const [TwoLevelHints]( "LIEF::MachO::TwoLevelHints") &copy) = default #### [` TwoLevelHints `]() TwoLevelHints(const [TwoLevelHints]( "LIEF::MachO::TwoLevelHints::TwoLevelHints") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` content `]() inline span<const uint8\_t> content() const Original payload of the command. #### [` content `]() inline span<uint8\_t> content() #### [` hints `]() inline [it\_hints\_t]( "LIEF::MachO::TwoLevelHints::it_hints_t") hints() Iterator over the hints (`uint32_t` integers). #### [` hints `]() inline [it\_const\_hints\_t]( "LIEF::MachO::TwoLevelHints::it_const_hints_t") hints() const #### [` offset `]() inline uint32\_t offset() const Original offset of the command. It should point in the `__LINKEDIT` segment. #### [` offset `]() inline void offset(uint32\_t offset) #### [` original_nb_hints `]() inline uint32\_t original\_nb\_hints() const #### [` ~TwoLevelHints `]() ~TwoLevelHints() override = default #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [Unknown Command]() ### [` UnknownCommand `]() class UnknownCommand : public LIEF::MachO::[LoadCommand]( "LIEF::MachO::LoadCommand") Generic class when the command is not recognized by LIEF. Public Functions #### [` UnknownCommand `]() UnknownCommand() = delete #### [` UnknownCommand `]() inline UnknownCommand(const details::load\_command &command) #### [` operator= `]() [UnknownCommand]( "LIEF::MachO::UnknownCommand") &operator=(const [UnknownCommand]( "LIEF::MachO::UnknownCommand") &copy) = default #### [` UnknownCommand `]() UnknownCommand(const [UnknownCommand]( "LIEF::MachO::UnknownCommand::UnknownCommand") &copy) = default #### [` clone `]() inline virtual std::unique\_ptr<[LoadCommand]( "LIEF::MachO::LoadCommand")> clone() const override #### [` ~UnknownCommand `]() ~UnknownCommand() override = default #### [` original_command `]() inline uint64\_t original\_command() const The original `LC_` int that is not supported by LIEF. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const [LoadCommand]( "LIEF::MachO::LoadCommand") \*cmd) --- ## [Stub]() ### [` Stub `]() class Stub This class represents a stub entry in sections like `__stubs,__auth_stubs`. It wraps assembly instructions which are used to access the *got* where the address of the symbol is resolved. Example: ```text 0000000236a3c1bc: ___memcpy_chk adrp x17, #0x241513aa8 add x17, x17, #0x241513aa8 ldr x16, [x17] braa x16, x17 ``` Public Functions #### [` Stub `]() Stub() = delete #### [` Stub `]() Stub(const [Stub]( "LIEF::MachO::Stub::Stub")&) = default #### [` operator= `]() [Stub]( "LIEF::MachO::Stub") &operator=(const [Stub]( "LIEF::MachO::Stub")&) = default #### [` Stub `]() Stub([Stub]( "LIEF::MachO::Stub::Stub")&&) noexcept = default #### [` operator= `]() [Stub]( "LIEF::MachO::Stub") &operator=([Stub]( "LIEF::MachO::Stub")&&) noexcept = default #### [` ~Stub `]() ~Stub() = default #### [` Stub `]() inline Stub([target\_info\_t]( "LIEF::MachO::Stub::target_info_t") target\_info, uint64\_t addr, std::vector<uint8\_t> raw) #### [` raw `]() inline span<const uint8\_t> raw() const The (raw) instructions of this entry as a slice of bytes. #### [` address `]() inline uint64\_t address() const The virtual address where the stub is located. #### [` target `]() [result]( "LIEF::result")<uint64\_t> target() const The address resolved by this stub. For instance, given this stub: ```text 0x3eec: adrp x16, #4096 0x3ef0: ldr x16, [x16, #24] 0x3ef4: br x16 ``` The function returns: `0x4018`. > **Warning** > > This function is only available with LIEF’s extended version Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Stub]( "LIEF::MachO::Stub") &stub) #### [` target_info_t `]() struct target\_info\_t Public Members ##### [` arch `]() [Header]( "LIEF::MachO::Header")::[CPU\_TYPE]( "LIEF::MachO::Header::CPU_TYPE") arch = [Header]( "LIEF::MachO::Header")::[CPU\_TYPE]( "LIEF::MachO::Header::CPU_TYPE")::[ANY]( "LIEF::MachO::Header::CPU_TYPE::ANY") ##### [` subtype `]() uint32\_t subtype = 0 Friends ##### [` operator== `]() inline friend bool operator==([Stub]( "LIEF::MachO::Stub")::[target\_info\_t]( "LIEF::MachO::Stub::target_info_t") lhs, [Stub]( "LIEF::MachO::Stub")::[target\_info\_t]( "LIEF::MachO::Stub::target_info_t") rhs) #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::MachO::Stub::Iterator"), std::random\_access\_iterator\_tag, const [Stub]( "LIEF::MachO::Stub")> Public Functions ##### [` Iterator `]() Iterator() = default ##### [` Iterator `]() inline Iterator([target\_info\_t]( "LIEF::MachO::Stub::target_info_t") target\_info, std::vector<const [Section]( "LIEF::MachO::Section")\*> sections, size\_t pos) ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::MachO::Stub::Iterator::Iterator")&) = default ##### [` operator= `]() [Iterator]( "LIEF::MachO::Stub::Iterator") &operator=(const [Iterator]( "LIEF::MachO::Stub::Iterator")&) = default ##### [` Iterator `]() Iterator([Iterator]( "LIEF::MachO::Stub::Iterator::Iterator")&&) noexcept = default ##### [` operator= `]() [Iterator]( "LIEF::MachO::Stub::Iterator") &operator=([Iterator]( "LIEF::MachO::Stub::Iterator")&&) noexcept = default ##### [` ~Iterator `]() ~Iterator() = default ##### [` operator< `]() inline bool operator<(const [Iterator]( "LIEF::MachO::Stub::Iterator") &rhs) const ##### [` operator- `]() inline std::ptrdiff\_t operator-(const [Iterator]( "LIEF::MachO::Stub::Iterator") &R) const ##### [` operator+= `]() inline [Iterator]( "LIEF::MachO::Stub::Iterator") &operator+=(std::ptrdiff\_t n) ##### [` operator-= `]() inline [Iterator]( "LIEF::MachO::Stub::Iterator") &operator-=(std::ptrdiff\_t n) ##### [` operator* `]() [Stub]( "LIEF::MachO::Stub") operator\*() const Friends ##### [` operator== `]() inline friend bool operator==(const [Iterator]( "LIEF::MachO::Stub::Iterator") &LHS, const [Iterator]( "LIEF::MachO::Stub::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::MachO::Stub::Iterator") &LHS, const [Iterator]( "LIEF::MachO::Stub::Iterator") &RHS) --- ## [Utilities]() ### [` LIEF::MachO::check_layout `]() bool LIEF::MachO::check\_layout(const [Binary]( "LIEF::MachO::Binary") &binary, std::string \*error = nullptr) Check the layout of the given Mach-O binary. It checks if it can be signed according to cctools-921/libstuff/checkout.c. ### [` LIEF::MachO::check_layout `]() bool LIEF::MachO::check\_layout(const [FatBinary]( "LIEF::MachO::FatBinary") &binary, std::string \*error = nullptr) Check the layout of the given FAT Mach-O by checking individually the layout of the binaries embedded in the FAT. ### [` LIEF::MachO::is_macho `]() bool LIEF::MachO::is\_macho(std::string\_view file) Check if the given file is a Mach-O binary. ### [` LIEF::MachO::is_macho `]() bool LIEF::MachO::is\_macho(const std::vector<uint8\_t> &raw) Check if the given raw data is a Mach-O binary. ### [` LIEF::MachO::is_fat `]() bool LIEF::MachO::is\_fat(std::string\_view file) Check if the given file is a FAT Mach-O. ### [` LIEF::MachO::is_64 `]() bool LIEF::MachO::is\_64(std::string\_view file) Check if the given Mach-O is 64-bits. --- ## [Enums]() ### [` LIEF::MachO::MACHO_TYPES `]() enum class LIEF::MachO::MACHO\_TYPES : uint32\_t *Values:* #### [` UNKNOWN `]() enumerator UNKNOWN = 0 #### [` MAGIC `]() enumerator MAGIC = 0xFEEDFACEu 32-bit big-endian magic #### [` CIGAM `]() enumerator CIGAM = 0xCEFAEDFEu 32-bit little-endian magic #### [` MAGIC_64 `]() enumerator MAGIC\_64 = 0xFEEDFACFu 64-bit big-endian magic #### [` CIGAM_64 `]() enumerator CIGAM\_64 = 0xCFFAEDFEu 64-bit little-endian magic #### [` MAGIC_FAT `]() enumerator MAGIC\_FAT = 0xCAFEBABEu big-endian fat magic #### [` CIGAM_FAT `]() enumerator CIGAM\_FAT = 0xBEBAFECAu little-endian fat magic #### [` NEURAL_MODEL `]() enumerator NEURAL\_MODEL = 0xbeeffaceu ### [` LIEF::MachO::X86_RELOCATION `]() enum class LIEF::MachO::X86\_RELOCATION *Values:* #### [` GENERIC_RELOC_VANILLA `]() enumerator GENERIC\_RELOC\_VANILLA = 0 A generic relocation entry for both addresses contained in data and addresses contained in CPU instructions. #### [` GENERIC_RELOC_PAIR `]() enumerator GENERIC\_RELOC\_PAIR = 1 The second relocation entry of a pair. #### [` GENERIC_RELOC_SECTDIFF `]() enumerator GENERIC\_RELOC\_SECTDIFF = 2 A relocation entry for an item that contains the difference of two section addresses. This is generally used for position-independent code generation. #### [` GENERIC_RELOC_PB_LA_PTR `]() enumerator GENERIC\_RELOC\_PB\_LA\_PTR = 3 contains the address from which to subtract; it must be followed by a [X86\_RELOCATION::GENERIC\_RELOC\_PAIR]() containing the address to subtract. #### [` GENERIC_RELOC_LOCAL_SECTDIFF `]() enumerator GENERIC\_RELOC\_LOCAL\_SECTDIFF = 4 Similar to [X86\_RELOCATION::GENERIC\_RELOC\_SECTDIFF]() except that this entry refers specifically to the address in this item. If the address is that of a globally visible coalesced symbol, this relocation entry does not change if the symbol is overridden. This is used to associate stack unwinding information with the object code this relocation entry describes. #### [` GENERIC_RELOC_TLV `]() enumerator GENERIC\_RELOC\_TLV = 5 A relocation entry for a prebound lazy pointer. This is always a scattered relocation entry. The MachO::Relocation::value field contains the non-prebound value of the lazy pointer. ### [` LIEF::MachO::X86_64_RELOCATION `]() enum class LIEF::MachO::X86\_64\_RELOCATION *Values:* #### [` X86_64_RELOC_UNSIGNED `]() enumerator X86\_64\_RELOC\_UNSIGNED = 0 A CALL/JMP instruction with 32-bit displacement. #### [` X86_64_RELOC_SIGNED `]() enumerator X86\_64\_RELOC\_SIGNED = 1 A MOVQ load of a GOT entry. #### [` X86_64_RELOC_BRANCH `]() enumerator X86\_64\_RELOC\_BRANCH = 2 Other GOT references. #### [` X86_64_RELOC_GOT_LOAD `]() enumerator X86\_64\_RELOC\_GOT\_LOAD = 3 Signed 32-bit displacement. #### [` X86_64_RELOC_GOT `]() enumerator X86\_64\_RELOC\_GOT = 4 Absolute address. #### [` X86_64_RELOC_SUBTRACTOR `]() enumerator X86\_64\_RELOC\_SUBTRACTOR = 5 Must be followed by a [X86\_64\_RELOCATION::X86\_64\_RELOC\_UNSIGNED]() relocation. #### [` X86_64_RELOC_SIGNED_1 `]() enumerator X86\_64\_RELOC\_SIGNED\_1 = 6 #### [` X86_64_RELOC_SIGNED_2 `]() enumerator X86\_64\_RELOC\_SIGNED\_2 = 7 #### [` X86_64_RELOC_SIGNED_4 `]() enumerator X86\_64\_RELOC\_SIGNED\_4 = 8 #### [` X86_64_RELOC_TLV `]() enumerator X86\_64\_RELOC\_TLV = 9 ### [` LIEF::MachO::PPC_RELOCATION `]() enum class LIEF::MachO::PPC\_RELOCATION *Values:* #### [` PPC_RELOC_VANILLA `]() enumerator PPC\_RELOC\_VANILLA = 0 #### [` PPC_RELOC_PAIR `]() enumerator PPC\_RELOC\_PAIR = 1 #### [` PPC_RELOC_BR14 `]() enumerator PPC\_RELOC\_BR14 = 2 #### [` PPC_RELOC_BR24 `]() enumerator PPC\_RELOC\_BR24 = 3 #### [` PPC_RELOC_HI16 `]() enumerator PPC\_RELOC\_HI16 = 4 #### [` PPC_RELOC_LO16 `]() enumerator PPC\_RELOC\_LO16 = 5 #### [` PPC_RELOC_HA16 `]() enumerator PPC\_RELOC\_HA16 = 6 #### [` PPC_RELOC_LO14 `]() enumerator PPC\_RELOC\_LO14 = 7 #### [` PPC_RELOC_SECTDIFF `]() enumerator PPC\_RELOC\_SECTDIFF = 8 #### [` PPC_RELOC_PB_LA_PTR `]() enumerator PPC\_RELOC\_PB\_LA\_PTR = 9 #### [` PPC_RELOC_HI16_SECTDIFF `]() enumerator PPC\_RELOC\_HI16\_SECTDIFF = 10 #### [` PPC_RELOC_LO16_SECTDIFF `]() enumerator PPC\_RELOC\_LO16\_SECTDIFF = 11 #### [` PPC_RELOC_HA16_SECTDIFF `]() enumerator PPC\_RELOC\_HA16\_SECTDIFF = 12 #### [` PPC_RELOC_JBSR `]() enumerator PPC\_RELOC\_JBSR = 13 #### [` PPC_RELOC_LO14_SECTDIFF `]() enumerator PPC\_RELOC\_LO14\_SECTDIFF = 14 #### [` PPC_RELOC_LOCAL_SECTDIFF `]() enumerator PPC\_RELOC\_LOCAL\_SECTDIFF = 15 ### [` LIEF::MachO::ARM_RELOCATION `]() enum class LIEF::MachO::ARM\_RELOCATION *Values:* #### [` ARM_RELOC_VANILLA `]() enumerator ARM\_RELOC\_VANILLA = 0 #### [` ARM_RELOC_PAIR `]() enumerator ARM\_RELOC\_PAIR = 1 #### [` ARM_RELOC_SECTDIFF `]() enumerator ARM\_RELOC\_SECTDIFF = 2 #### [` ARM_RELOC_LOCAL_SECTDIFF `]() enumerator ARM\_RELOC\_LOCAL\_SECTDIFF = 3 #### [` ARM_RELOC_PB_LA_PTR `]() enumerator ARM\_RELOC\_PB\_LA\_PTR = 4 #### [` ARM_RELOC_BR24 `]() enumerator ARM\_RELOC\_BR24 = 5 #### [` ARM_THUMB_RELOC_BR22 `]() enumerator ARM\_THUMB\_RELOC\_BR22 = 6 #### [` ARM_THUMB_32BIT_BRANCH `]() enumerator ARM\_THUMB\_32BIT\_BRANCH = 7 #### [` ARM_RELOC_HALF `]() enumerator ARM\_RELOC\_HALF = 8 #### [` ARM_RELOC_HALF_SECTDIFF `]() enumerator ARM\_RELOC\_HALF\_SECTDIFF = 9 ### [` LIEF::MachO::ARM64_RELOCATION `]() enum class LIEF::MachO::ARM64\_RELOCATION *Values:* #### [` ARM64_RELOC_UNSIGNED `]() enumerator ARM64\_RELOC\_UNSIGNED = 0 For pointers. #### [` ARM64_RELOC_SUBTRACTOR `]() enumerator ARM64\_RELOC\_SUBTRACTOR = 1 Must be followed by an [ARM64\_RELOCATION::ARM64\_RELOC\_UNSIGNED](). #### [` ARM64_RELOC_BRANCH26 `]() enumerator ARM64\_RELOC\_BRANCH26 = 2 A B/BL instruction with 26-bit displacement. #### [` ARM64_RELOC_PAGE21 `]() enumerator ARM64\_RELOC\_PAGE21 = 3 PC-rel distance to page of target. #### [` ARM64_RELOC_PAGEOFF12 `]() enumerator ARM64\_RELOC\_PAGEOFF12 = 4 Offset within page, scaled by [MachO::Relocation::size](). #### [` ARM64_RELOC_GOT_LOAD_PAGE21 `]() enumerator ARM64\_RELOC\_GOT\_LOAD\_PAGE21 = 5 PC-rel distance to page of GOT slot. #### [` ARM64_RELOC_GOT_LOAD_PAGEOFF12 `]() enumerator ARM64\_RELOC\_GOT\_LOAD\_PAGEOFF12 = 6 Offset within page of GOT slot, scaled by [MachO::Relocation::size](). #### [` ARM64_RELOC_POINTER_TO_GOT `]() enumerator ARM64\_RELOC\_POINTER\_TO\_GOT = 7 For pointers to GOT slots. #### [` ARM64_RELOC_TLVP_LOAD_PAGE21 `]() enumerator ARM64\_RELOC\_TLVP\_LOAD\_PAGE21 = 8 PC-rel distance to page of TLVP slot. #### [` ARM64_RELOC_TLVP_LOAD_PAGEOFF12 `]() enumerator ARM64\_RELOC\_TLVP\_LOAD\_PAGEOFF12 = 9 Offset within page of TLVP slot, scaled by [MachO::Relocation::size](). #### [` ARM64_RELOC_ADDEND `]() enumerator ARM64\_RELOC\_ADDEND = 10 Must be followed by [ARM64\_RELOCATION::ARM64\_RELOC\_PAGE21]() or [ARM64\_RELOCATION::ARM64\_RELOC\_PAGEOFF12](). ### [` LIEF::MachO::DYLD_CHAINED_FORMAT `]() enum class LIEF::MachO::DYLD\_CHAINED\_FORMAT *Values:* #### [` IMPORT `]() enumerator IMPORT = 1 Originally: DYLD\_CHAINED\_IMPORT. #### [` IMPORT_ADDEND `]() enumerator IMPORT\_ADDEND = 2 Originally: DYLD\_CHAINED\_IMPORT\_ADDEND. #### [` IMPORT_ADDEND64 `]() enumerator IMPORT\_ADDEND64 = 3 Originally: DYLD\_CHAINED\_IMPORT\_ADDEND64. ### [` LIEF::MachO::DYLD_CHAINED_PTR_FORMAT `]() enum class LIEF::MachO::DYLD\_CHAINED\_PTR\_FORMAT *Values:* #### [` NONE `]() enumerator NONE = 0 #### [` PTR_ARM64E `]() enumerator PTR\_ARM64E = 1 #### [` PTR_64 `]() enumerator PTR\_64 = 2 #### [` PTR_32 `]() enumerator PTR\_32 = 3 #### [` PTR_32_CACHE `]() enumerator PTR\_32\_CACHE = 4 #### [` PTR_32_FIRMWARE `]() enumerator PTR\_32\_FIRMWARE = 5 #### [` PTR_64_OFFSET `]() enumerator PTR\_64\_OFFSET = 6 #### [` PTR_ARM64E_OFFSET `]() enumerator PTR\_ARM64E\_OFFSET = 7 #### [` PTR_ARM64E_KERNEL `]() enumerator PTR\_ARM64E\_KERNEL = 7 #### [` PTR_64_KERNEL_CACHE `]() enumerator PTR\_64\_KERNEL\_CACHE = 8 #### [` PTR_ARM64E_USERLAND `]() enumerator PTR\_ARM64E\_USERLAND = 9 #### [` PTR_ARM64E_FIRMWARE `]() enumerator PTR\_ARM64E\_FIRMWARE = 10 #### [` PTR_X86_64_KERNEL_CACHE `]() enumerator PTR\_X86\_64\_KERNEL\_CACHE = 11 #### [` PTR_ARM64E_USERLAND24 `]() enumerator PTR\_ARM64E\_USERLAND24 = 12 #### [` PTR_ARM64E_SHARED_CACHE `]() enumerator PTR\_ARM64E\_SHARED\_CACHE = 13 #### [` PTR_ARM64E_SEGMENTED `]() enumerator PTR\_ARM64E\_SEGMENTED = 14 --- documentID: "480297733823647889e4623a5505326a975fc97b11fd3e8be42a75d63e4b65ed" docname: "formats/macho/index" title: "Mach-O - LIEF Documentation" description: "Mach-O binaries can be parsed using the lief.MachO.parse() function." canonical: "https://lief.re/doc/latest/formats/macho/index.html" markdownURL: "https://lief.re/doc/latest/formats/macho/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "43ace54784265dbc8a28b8f9338638faf8c98c004ee3552c1b1e966bfea13850" --- # [Mach-O]() API - [C++]() - [Python]() - [Rust]() ## [Introduction]() Mach-O binaries can be parsed using the `lief.MachO.parse()` ( [`lief::macho::FatBinary::parse`]() ; [`lief.MachO.parse()`]() ; [`LIEF::MachO::Parser::parse()`]() ) function. > **Note** > > The Mach-O format defines FAT binaries, which can embed different architectures into a single file. `lief.MachO.parse()` ( [`lief::macho::FatBinary::parse`]() ; [`lief.MachO.parse()`]() ; [`LIEF::MachO::Parser::parse()`]() ) always returns a `lief.MachO.FatBinary` ( [`lief::macho::FatBinary`]() ; [`lief.MachO.FatBinary`]() ; [`LIEF::MachO::FatBinary`]() ), assuming that a non-FAT Mach-O can be represented as a `lief.MachO.FatBinary` ( [`lief::macho::FatBinary`]() ; [`lief.MachO.FatBinary`]() ; [`LIEF::MachO::FatBinary`]() ) containing a single architecture. **Python** ```python import lief # Using filepath macho: lief.MachO.FatBinary | None = lief.MachO.parse("/bin/ls") # Using a Path from pathlib macho: lief.MachO.FatBinary | None = lief.MachO.parse( pathlib.Path(r"C:\Users\test.macho") ) # Using an io object with open("/bin/ssh", "rb") as f: macho: lief.MachO.FatBinary | None = lief.MachO.parse(f) ``` **C++** ```cpp #include // Using a file path as a std::string std::unique_ptr macho = LIEF::MachO::Parser::parse("/bin/ls"); // Using a vector std::vector my_raw_macho; macho = LIEF::MachO::Parser::parse(my_raw_macho); ``` **Rust** ```rust let macho: lief::macho::FatBinary = lief::macho::FatBinary::parse("/bin/ls").unwrap(); ``` This `lief.MachO.FatBinary` ( [`lief::macho::FatBinary`]() ; [`lief.MachO.FatBinary`]() ; [`LIEF::MachO::FatBinary`]() ) object exposes facilities to either iterate over the different `lief.MachO.Binary` ( [`lief::macho::Binary`]() ; [`lief.MachO.Binary`]() ; [`LIEF::MachO::Binary`]() ) or pick/take a specific one: **Python** ```python fat: lief.MachO.FatBinary # Iterate for macho in fat: print(macho.entrypoint) print(len(macho.commands)) # Pick one at the specified index macho = fat.at(0) # Pick one based on the architecture macho = fat.take(lief.MachO.Header.CPU_TYPE.ARM64) ``` **C++** ```cpp std::unique_ptr fat; // Iterate for (const LIEF::MachO::Binary& macho : *fat) { std::cout << macho.entrypoint() << '\n'; std::cout << macho.commands().size() << '\n'; } // Pick one at the specified index (without taking ownership) const LIEF::MachO::Binary* macho = fat->at(0); // Pick one at the specified index and taking ownership std::unique_ptr owned = fat->take(0); // Pick one with the given arch and taking ownership std::unique_ptr arm64 = fat->take(LIEF::MachO::Header::CPU_TYPE::ARM64); ``` **Rust** ```rust let fat: &lief::macho::FatBinary = some_fat; // Iterate for macho in fat.iter() { println!("{}", macho.entrypoint()); } // Pick one with the given arch let arm64 = fat .with_cpu(lief::macho::header::CpuType::ARM64) .expect("Missing ARM64"); ``` After modifying a `lief.MachO.Binary` ( [`lief::macho::Binary`]() ; [`lief.MachO.Binary`]() ; [`LIEF::MachO::Binary`]() ) or `lief.MachO.FatBinary` ( [`lief::macho::FatBinary`]() ; [`lief.MachO.FatBinary`]() ; [`LIEF::MachO::FatBinary`]() ) object, you can use either `lief.MachO.Binary.write()` ( [`lief::macho::Binary::write`]() ; [`lief::macho::Binary::write_with_config`]() ; [`lief.MachO.Binary.write()`]() ; [`LIEF::MachO::Binary::write()`]() ) or `lief.MachO.FatBinary.write()` ( [`lief.FatBinary.Binary.write()`]() ; [`LIEF::FatBinary::Binary::write()`]() ) to write it back to a raw Mach-O file. **Python** ```python macho: lief.MachO.FatBinary macho.at(0).write("fit.macho") macho.write("fat.macho") # write-back the whole FAT binary ``` **C++** ```cpp std::unique_ptr macho; macho->take(LIEF::MachO::Header::CPU_TYPE::ARM64)->write("fit.macho"); macho->write("fat.macho"); ``` **Rust** ```rust let fat: &mut lief::macho::FatBinary = some_fat; fat.with_cpu(lief::macho::header::CpuType::ARM64) .unwrap() .write("fit.macho"); ``` You can also use `lief.MachO.Binary.write_to_bytes()` ( [`lief::macho::Binary::write_to_bytes`]() ; [`lief::macho::Binary::write_to_bytes_with_config`]() ; [`lief.MachO.Binary.write_to_bytes()`]() ; [`std::unique_ptr LIEF::MachO::Binary::write(std::ostream &)`]() ; [`std::unique_ptr LIEF::MachO::Binary::write(std::ostream &, const Builder::config_t &)()`]() ) to get the new Mach-O binary as a buffer of bytes: > **Note** > > This API can also take an extra `lief.MachO.Builder.config_t` ( [`lief::pe::builder::Config`]() ; [`lief.MachO.Builder.config_t`]() ; [`LIEF::MachO::Builder::config_t`]() ) parameter. **Python** ```python macho: lief.MachO.Binary new_macho: bytes = macho.write_to_bytes() ``` **C++** ```cpp std::unique_ptr macho; std::ostringstream os; macho->write(os); std::string buffer = os.str(); const auto* start = reinterpret_cast(buffer.data()); size_t size = buffer.size(); ``` **Rust** ```rust let macho: &mut lief::macho::Binary = some_macho; let bytes: Vec = macho.write_to_bytes(); ``` ## [Advanced Parsing/Writing]() `lief.MachO.parse()` ( [`lief::macho::FatBinary::parse`]() ; [`lief.MachO.parse()`]() ; [`LIEF::MachO::Parser::parse()`]() ) can take an extra `lief.MachO.ParserConfig` ( [`lief.MachO.ParserConfig`]() ; [`LIEF::MachO::ParserConfig`]() ) parameter to specify parts of the Mach-O format to skip during parsing. > **Warning** > > Generally, `lief.MachO.Binary.write()` ( [`lief::macho::Binary::write`]() ; [`lief::macho::Binary::write_with_config`]() ; [`lief.MachO.Binary.write()`]() ; [`LIEF::MachO::Binary::write()`]() ) and `lief.MachO.FatBinary.write()` ( [`lief.FatBinary.Binary.write()`]() ; [`LIEF::FatBinary::Binary::write()`]() ) require a **complete** initial parsing of the Mach-O file. Similarly, `lief.MachO.Binary.write()` ( [`lief::macho::Binary::write`]() ; [`lief::macho::Binary::write_with_config`]() ; [`lief.MachO.Binary.write()`]() ; [`LIEF::MachO::Binary::write()`]() ) can also take an extra `lief.MachO.Builder.config_t` ( [`lief::pe::builder::Config`]() ; [`lief.MachO.Builder.config_t`]() ; [`LIEF::MachO::Builder::config_t`]() ) to specify which parts of the Mach-O should be rebuilt. **Python** ```python parser_config = lief.MachO.ParserConfig() parser_config.parse_dyld_bindings = False fat = lief.MachO.parse("my.macho", parser_config) assert isinstance(fat, lief.MachO.FatBinary) macho = fat.at(0) assert isinstance(fat, lief.MachO.Binary) builder_config = lief.MachO.Builder.config_t() builder_config.linkedit = False macho.write("new.macho", builder_config) ``` **C++** ```cpp LIEF::MachO::ParserConfig parser_config; parser_config.parse_dyld_bindings = false; std::unique_ptr fat = LIEF::MachO::Parser::parse("my.macho", parser_config); LIEF::MachO::Binary* macho = fat->at(0); LIEF::MachO::Builder::config_t builder_config; builder_config.linkedit = false; macho->write("new.macho", builder_config); ``` **Rust** ```rust let mut parser_config = lief::macho::ParserConfig::default(); parser_config.parse_dyld_bindings = false; let mut fat = lief::macho::parse_with_config("my.macho", &parser_config).unwrap(); let mut macho = fat.iter().next().unwrap(); let mut builder_config = lief::macho::builder::Config::default(); builder_config.linkedit = false; macho.write_with_config("new.macho", builder_config); ``` > **See also** > > [Binary Abstraction]() ## [Dump Analysis]() LIEF has the support to process Mach-O memory dump with `lief.MachO.parse_from_dump()` ( [`lief::macho::FatBinary::parse_from_dump`]() ; [`lief.MachO.parse_from_dump()`]() ; [`LIEF::MachO::Parser::parse_from_dump()`]() ). This function translates the file offsets referenced by the Mach-O structures into their location inside the dump, using the base address passed as the second parameter. As for the regular parser, it returns a `lief.MachO.FatBinary` ( [`lief::macho::FatBinary`]() ; [`lief.MachO.FatBinary`]() ; [`LIEF::MachO::FatBinary`]() ): **Python** ```python # 0x11e32c000 is the (absolute) address at which the dump was mapped fat = lief.MachO.parse_from_dump("module.dump", 0x11E32C000) assert isinstance(fat, lief.MachO.FatBinary) macho = fat.at(0) assert isinstance(fat, lief.MachO.Binary) for segment in macho.segments: print(segment.name, hex(segment.virtual_address)) ``` **C++** ```cpp auto fat = LIEF::MachO::Parser::parse_from_dump("module.dump", 0x11e32c000); const LIEF::MachO::Binary* macho = fat->at(0); for (const LIEF::MachO::SegmentCommand& segment : macho->segments()) { std::cout << segment.name() << '\n'; } ``` **Rust** ```rust let fat = lief::macho::FatBinary::parse_from_dump("module.dump", 0x1_1e32_c000).unwrap(); let macho = fat.iter().next().unwrap(); for segment in macho.segments() { println!("{} {:#x}", segment.name(), segment.virtual_address()); } ``` > **Note** > > The second parameter **must** be the (absolute) virtual address at which the dump was mapped. It is used to convert the virtual addresses found in the Mach-O structures back into an offset within the dump. ### [Producing a dump with the runtime API]() Such a dump can be produced from a live process thanks to the LIEF [runtime]() and, more precisely, the [Module API](). `lief.runtime.Module.dump()` ( [`lief::runtime::module::Module::dump`]() ; [`lief.runtime.Module.dump()`]() ; [`LIEF::runtime::Module::dump()`]() ) captures the memory of a loaded module (from its imagebase over its virtual size): **Python** ```python # Find the module to dump in the current process mod = lief.runtime.module_from_name("libsystem_c.dylib") assert isinstance(mod, lief.runtime.osx.Module) # Dump the module's memory into a file (the raw bytes are also returned) ... data: bytes = mod.dump("module.dump") # ... and parse it back using the same imagebase: macho = lief.MachO.parse_from_dump(data, mod.imagebase) ``` **C++** ```cpp // Find the module to dump in the current process auto mod = LIEF::runtime::module_from_name("libsystem_c.dylib"); // Dump the module's memory into a file (the raw bytes are also returned) std::vector data = mod->dump("module.dump"); auto fat = LIEF::MachO::Parser::parse_from_dump("module.dump", mod->imagebase()); ``` **Rust** ```rust use lief::runtime::Module; let module = lief::runtime::module_from_name("libsystem_c.dylib").unwrap(); // Dump the module's memory into a file (the raw bytes are also returned) let data = module.dump_to_file("module.dump"); let fat = lief::macho::FatBinary::parse_from_dump("module.dump", module.imagebase()).unwrap(); ``` ## [RPath and Library Path Modification]() Sometimes, we need to modify the Mach-O RPath commands or the (absolute) path of a linked library in an executable. When recompiling or linking the executable is not possible, LIEF can be used for these modifications. For example, let’s consider a binary with the following dependencies: ```bash $ otool -L hello.bin hello: /Users/romain/dev/libmylib.dylib (compatibility version 0.0.0, current version 0.0.0) /usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 1700.255.0) /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.100.2) ``` One can change the directory of `libmylib.dylib` with the following code: **Python** ```python fat = lief.MachO.parse("hello.bin") assert isinstance(fat, lief.MachO.FatBinary) macho = fat.at(0) assert isinstance(fat, lief.MachO.Binary) lib = macho.find_library("libmylib.dylib") assert isinstance(lib, lief.MachO.DylibCommand) lib.name = "/opt/homebrew/my_package/libmylib.dylib" macho.write("hello_fixed.bin") ``` **C++** ```cpp std::unique_ptr macho = LIEF::MachO::Parser::parse("hello.bin")->take(0); LIEF::MachO::DylibCommand* lib = macho->find_library("libmylib.dylib"); lib->name("/opt/homebrew/my_package/libmylib.dylib"); macho->write("hello_fixed.bin"); ``` **Rust** ```rust let fat = lief::macho::FatBinary::parse("hello.bin").unwrap(); let mut binary = fat.iter().next().unwrap(); let mut lib = binary.find_library("libmylib.dylib").unwrap(); lib.set_name("/opt/homebrew/my_package/libmylib.dylib"); binary.write("hello_fixed.bin"); ``` > **Note** > > It is worth mentioning that LIEF doesn’t impose restrictions on the length of modified library paths. LIEF manages all internal modifications to support both longer and shorter library paths. This type of modification can be used in conjunction with the `@rpath` feature of Mach-O binaries: 1. We can add an extra `LC_RPATH` ( `lief.MachO.RPathCommand` ( [`lief::macho::commands::RPath`]() ; [`lief.MachO.RPathCommand`]() ; [`LIEF::MachO::RPathCommand`]() )) command to `hello.bin`: **Python** ```python fat = lief.MachO.parse("hello.bin") assert isinstance(fat, lief.MachO.FatBinary) macho = fat.at(0) assert isinstance(fat, lief.MachO.Binary) rpath = lief.MachO.RPathCommand.create("/opt/homebrew/my_package") assert isinstance(rpath, lief.MachO.RPathCommand) macho.add(rpath) ``` **C++** ```cpp std::unique_ptr macho = LIEF::MachO::Parser::parse("hello.bin")->take(0); auto rpath = LIEF::MachO::RPathCommand::create("/opt/homebrew/my_package"); macho->add(*rpath); ``` **Rust** ```rust let fat = lief::macho::FatBinary::parse("hello.bin").unwrap(); let mut binary = fat.iter().next().unwrap(); let rpath = RPath::new("/opt/homebrew/my_package"); binary.add_command(rpath); ``` 2. Then, we can change the library path of `libmylib.dylib` to include the RPath prefix: **Python** ```python macho: lief.MachO.Binary lib = macho.find_library("libmylib.dylib") assert isinstance(lib, lief.MachO.DylibCommand) lib.name = "@rpath/libmylib.dylib" macho.write("hello_fixed.bin") ``` **C++** ```cpp std::unique_ptr macho; LIEF::MachO::DylibCommand* lib = macho->find_library("libmylib.dylib"); lib->name("@rpath/libmylib.dylib"); macho->write("hello_fixed.bin"); ``` **Rust** ```rust let binary: &mut lief::macho::Binary = some_binary; let mut lib = binary.find_library("libmylib.dylib").unwrap(); lib.set_name("@rpath/libmylib.dylib"); binary.write("hello_fixed.bin"); ``` ## [Objective-C Support]() If a Mach-O binary is compiled from Objective-C sources, it may contain metadata represented by the `lief.ObjC.Metadata` ( [`lief::objc::Metadata`]() ; [`lief.objc.Metadata`]() ; [`LIEF::objc::Metadata`]() ) object. This metadata can help understand the underlying structures of the binary, and [LIEF Extended]() provides support for accessing this information through `lief.MachO.Binary.objc_metadata` ( [`lief::macho::Binary::objc_metadata`]() ; [`lief.MachO.Binary.objc_metadata`]() ; [`LIEF::MachO::Binary::objc_metadata()`]() ). For more details, you can check the [Obj-C section](). --- documentID: "931a8e3a90f715f97d3dd6f6afc9c0bd5e7d4a678bda9cd08123b0d129fc8cb7" docname: "formats/macho/python" title: "Mach-O Python API - LIEF Documentation" description: "Mach-O Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/macho/python.html" markdownURL: "https://lief.re/doc/latest/formats/macho/python.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "a91b59945edd309bcbc8e9511eeab66aa9a40aaebe628ce3c02dc93ec09937fc" --- # [Python]() ## [Parser]() ### [` lief.MachO.parse `]() lief.MachO.parse(*obj: str | io.IOBase | os.PathLike | bytes | list[int]*, *config: [lief.MachO.ParserConfig]( "lief.MachO.ParserConfig")*) → [lief.MachO.FatBinary]( "lief.MachO.FatBinary") | None Parse the given binary from the given input and return a [`FatBinary`]( "lief.MachO.FatBinary") object One can configure the parser with the `config` parameter. See [`ParserConfig`]( "lief.MachO.ParserConfig") ### [` lief.MachO.ParserConfig `]() class lief.MachO.ParserConfig(*self*) Bases: `object` This class is used to tweak the MachO Parser (`Parser`) #### [` deep `]() deep = <lief.\_lief.MachO.ParserConfig object> #### [` fix_from_memory `]() property fix\_from\_memory → bool When parsing Mach-O from memory, this option can be used to *undo* relocations and symbols bindings. When activated, this option requires parse\_dyld\_bindings and parse\_dyld\_rebases to be enabled. #### [` from_dyld_shared_cache `]() property from\_dyld\_shared\_cache → bool Whether the binary is coming/extracted from Dyld shared cache #### [` full_dyldinfo `]() full\_dyldinfo(*self*, *flag: bool*) → [lief.\_lief.MachO.ParserConfig]( "lief._lief.MachO.ParserConfig") If `flag` is set to `true`, Exports, Bindings and Rebases opcodes are parsed. > **Warning** > > Enabling this flag can slow down the parsing #### [` parse_dyld_bindings `]() property parse\_dyld\_bindings → bool Parse the Dyld binding opcodes #### [` parse_dyld_exports `]() property parse\_dyld\_exports → bool Parse the Dyld export trie #### [` parse_dyld_rebases `]() property parse\_dyld\_rebases → bool Parse the Dyld rebase opcodes #### [` quick `]() quick = <lief.\_lief.MachO.ParserConfig object> ```python fatbinary_1 = lief.MachO.parse("/usr/bin/ls", config=lief.MachO.ParserConfig.deep) # or fatbinary_2 = lief.MachO.parse("/usr/bin/ls", config=lief.MachO.ParserConfig.quick) ``` --- ## [FatBinary]() ### [` lief.MachO.FatBinary `]() class lief.MachO.FatBinary Bases: `object` Class which represents a Mach-O (fat) binary This object is also used for representing Mach-O binaries that are **NOT FAT** #### [` at `]() at(*self*, *index: int*) → [lief.\_lief.MachO.Binary]( "lief._lief.MachO.Binary") | None Return the [`Binary`]( "lief.MachO.Binary") at the given index or None if it is not present #### [` create `]() create(*binaries: collections.abc.Sequence[[lief.MachO.Binary]( "lief.MachO.Binary") | None]*) → [lief.MachO.FatBinary]( "lief.MachO.FatBinary") | None = <nanobind.nb\_func object> #### [` get `]() get(*self*, *arg: [lief.\_lief.MachO.Header.CPU\_TYPE]( "lief._lief.MachO.Header.CPU_TYPE")*, */*) → [lief.\_lief.MachO.Binary]( "lief._lief.MachO.Binary") | None Gets the [`Binary`]( "lief.MachO.Binary") that matches the given architecture #### [` raw `]() raw(*self*) → list[int] Build a Mach-O universal binary and return its bytes #### [` size `]() property size → int Number of [`Binary`]( "lief.MachO.Binary") registered #### [` take `]() take(*self*, *cpu: [lief.\_lief.MachO.Header.CPU\_TYPE]( "lief._lief.MachO.Header.CPU_TYPE")*) → [lief.\_lief.MachO.Binary]( "lief._lief.MachO.Binary") | None Return the [`Binary`]( "lief.MachO.Binary") that matches the given [`CPU_TYPE`]( "lief.MachO.Header.CPU_TYPE") #### [` write `]() write(*self*, *filename: str | os.PathLike*) → None Build a Mach-O universal binary --- ## [Binary]() ### [` lief.MachO.Binary `]() class lief.MachO.Binary Bases: [`Binary`]( "lief._lief.Binary") Class which represents a MachO binary #### [` addaddaddadd `]() add(*self*, *dylib\_command: [lief.\_lief.MachO.DylibCommand]( "lief._lief.MachO.DylibCommand")*) → [lief.\_lief.MachO.LoadCommand]( "lief._lief.MachO.LoadCommand") | None **add(*self*, *segment: [lief.\_lief.MachO.SegmentCommand]( "lief._lief.MachO.SegmentCommand")*) → [lief.\_lief.MachO.LoadCommand]( "lief._lief.MachO.LoadCommand") | None **add(*self*, *load\_command: [lief.\_lief.MachO.LoadCommand]( "lief._lief.MachO.LoadCommand")*) → [lief.\_lief.MachO.LoadCommand]( "lief._lief.MachO.LoadCommand") | None **add(*self*, *load\_command: [lief.\_lief.MachO.LoadCommand]( "lief._lief.MachO.LoadCommand")*, *index: int*) → [lief.\_lief.MachO.LoadCommand]( "lief._lief.MachO.LoadCommand") | None****** Overloaded function. 1. `add(self, dylib_command: lief._lief.MachO.DylibCommand) -> lief._lief.MachO.LoadCommand | None` Add a new [`DylibCommand`]( "lief.MachO.DylibCommand") 2. `add(self, segment: lief._lief.MachO.SegmentCommand) -> lief._lief.MachO.LoadCommand | None` Add a new [`SegmentCommand`]( "lief.MachO.SegmentCommand") 3. `add(self, load_command: lief._lief.MachO.LoadCommand) -> lief._lief.MachO.LoadCommand | None` Add a new [`LoadCommand`]( "lief.MachO.LoadCommand") 4. `add(self, load_command: lief._lief.MachO.LoadCommand, index: int) -> lief._lief.MachO.LoadCommand | None` Add a new [`LoadCommand`]( "lief.MachO.LoadCommand") at `index` #### [` add_exported_function `]() add\_exported\_function(*self*, *address: int*, *name: str*) → [lief.\_lief.MachO.ExportInfo]( "lief._lief.MachO.ExportInfo") | None Add a new export in the binary #### [` add_library `]() add\_library(*self*, *library\_name: str*) → [lief.\_lief.MachO.LoadCommand]( "lief._lief.MachO.LoadCommand") | None Add a new library dependency #### [` add_local_symbol `]() add\_local\_symbol(*self*, *address: int*, *name: str*) → [lief.\_lief.MachO.Symbol]( "lief._lief.MachO.Symbol") | None Add a new symbol in the LC\_SYMTAB #### [` add_sectionadd_section `]() add\_section(*self*, *segment: [lief.\_lief.MachO.SegmentCommand]( "lief._lief.MachO.SegmentCommand")*, *section: [lief.\_lief.MachO.Section]( "lief._lief.MachO.Section")*) → [lief.\_lief.MachO.Section]( "lief._lief.MachO.Section") | None **add\_section(*self*, *section: [lief.\_lief.MachO.Section]( "lief._lief.MachO.Section")*) → [lief.\_lief.MachO.Section]( "lief._lief.MachO.Section") | None** Overloaded function. 1. `add_section(self, segment: lief._lief.MachO.SegmentCommand, section: lief._lief.MachO.Section) -> lief._lief.MachO.Section | None` Add a new [`Section`]( "lief.MachO.Section") in the given [`SegmentCommand`]( "lief.MachO.SegmentCommand") 2. `add_section(self, section: lief._lief.MachO.Section) -> lief._lief.MachO.Section | None` Add a new [`Section`]( "lief.MachO.Section") within the `__TEXT` segment #### [` atom_info `]() property atom\_info → lief.MachO.AtomInfo | None Return the binary’s `AtomInfo` if any, or None #### [` available_command_space `]() property available\_command\_space → int #### [` bindings `]() property bindings → Iterator[[lief.MachO.BindingInfo]( "lief.MachO.BindingInfo")] Return an iterator over the binding info which can come from either [`DyldInfo`]( "lief.MachO.DyldInfo") or [`DyldChainedFixups`]( "lief.MachO.DyldChainedFixups") commands. #### [` build_version `]() property build\_version → [lief.MachO.BuildVersion]( "lief.MachO.BuildVersion") | None Return the binary’s [`BuildVersion`]( "lief.MachO.BuildVersion") if any, or None #### [` can_remove `]() can\_remove(*self*, *symbol: [lief.\_lief.MachO.Symbol]( "lief._lief.MachO.Symbol")*) → bool Check if the given symbol can be safely removed. #### [` can_remove_symbol `]() can\_remove\_symbol(*self*, *symbol\_name: str*) → bool Check if the given symbol name can be safely removed. #### [` code_signature `]() property code\_signature → [lief.MachO.CodeSignature]( "lief.MachO.CodeSignature") | None Return the binary’s [`CodeSignature`]( "lief.MachO.CodeSignature") if any, or None #### [` code_signature_dir `]() property code\_signature\_dir → [lief.MachO.CodeSignatureDir]( "lief.MachO.CodeSignatureDir") | None Return the binary’s [`CodeSignatureDir`]( "lief.MachO.CodeSignatureDir") if any, or None #### [` commands `]() property commands → lief.MachO.Binary.it\_commands Return an iterator over the binary’s `Command` #### [` data_in_code `]() property data\_in\_code → [lief.MachO.DataInCode]( "lief.MachO.DataInCode") | None Return the binary’s [`DataInCode`]( "lief.MachO.DataInCode") if any, or None #### [` dyld_chained_fixups `]() property dyld\_chained\_fixups → [lief.MachO.DyldChainedFixups]( "lief.MachO.DyldChainedFixups") | None Return the binary’s [`DyldChainedFixups`]( "lief.MachO.DyldChainedFixups") if any, or None #### [` dyld_environment `]() property dyld\_environment → [lief.MachO.DyldEnvironment]( "lief.MachO.DyldEnvironment") | None Return the binary’s [`DyldEnvironment`]( "lief.MachO.DyldEnvironment") if any, or None #### [` dyld_exports_trie `]() property dyld\_exports\_trie → [lief.MachO.DyldExportsTrie]( "lief.MachO.DyldExportsTrie") | None Return the binary’s [`DyldExportsTrie`]( "lief.MachO.DyldExportsTrie") if any, or None #### [` dyld_info `]() property dyld\_info → [lief.MachO.DyldInfo]( "lief.MachO.DyldInfo") | None Return the binary’s [`DyldInfo`]( "lief.MachO.DyldInfo") if any, or None #### [` dylinker `]() property dylinker → [lief.MachO.DylinkerCommand]( "lief.MachO.DylinkerCommand") | None Return the binary’s [`DylinkerCommand`]( "lief.MachO.DylinkerCommand") if any, or None #### [` dynamic_symbol_command `]() property dynamic\_symbol\_command → [lief.MachO.DynamicSymbolCommand]( "lief.MachO.DynamicSymbolCommand") | None Return the binary’s [`DynamicSymbolCommand`]( "lief.MachO.DynamicSymbolCommand") if any, or None #### [` encryption_info `]() property encryption\_info → [lief.MachO.EncryptionInfo]( "lief.MachO.EncryptionInfo") | None Return the binary’s [`EncryptionInfo`]( "lief.MachO.EncryptionInfo") if any, or None #### [` exported_symbols `]() property exported\_symbols → lief.MachO.Binary.it\_filter\_symbols Return the binary’s [`Symbol`]( "lief.MachO.Symbol") which are exported #### [` extend `]() extend(*self*, *load\_command: [lief.\_lief.MachO.LoadCommand]( "lief._lief.MachO.LoadCommand")*, *size: int*) → bool Extend a [`LoadCommand`]( "lief.MachO.LoadCommand") by `size` #### [` extend_section `]() extend\_section(*self*, *section: [lief.\_lief.MachO.Section]( "lief._lief.MachO.Section")*, *size: int*) → bool Extend the **content** of the given [`Section`]( "lief.MachO.Section") by `size` #### [` extend_segment `]() extend\_segment(*self*, *segment\_command: [lief.\_lief.MachO.SegmentCommand]( "lief._lief.MachO.SegmentCommand")*, *size: int*) → bool Extend the **content** of the given [`SegmentCommand`]( "lief.MachO.SegmentCommand") by `size` #### [` fat_offset `]() property fat\_offset → int Return binary’s *fat offset*. `0` if not relevant. #### [` fileset_addr `]() property fileset\_addr → int Original address associated with the `LC_FILESET_ENTRY` for this MachO. #### [` fileset_name `]() property fileset\_name → str Name associated with the `LC_FILESET_ENTRY` for this MachO. For instance: `com.apple.kec.corecrypto` #### [` filesets `]() property filesets → lief.MachO.FatBinary.it\_binaries Return binary’s `Filesets` #### [` find_library `]() find\_library(*self*, *name: str*) → [lief.\_lief.MachO.DylibCommand]( "lief._lief.MachO.DylibCommand") | None Try to find the library with the given library name. This function tries to match the fullpath of the [`DylibCommand`]( "lief.MachO.DylibCommand") or the library name suffix. #### [` function_starts `]() property function\_starts → [lief.MachO.FunctionStarts]( "lief.MachO.FunctionStarts") | None Return the binary’s [`FunctionStarts`]( "lief.MachO.FunctionStarts") if any, or None #### [` function_variant_fixups `]() property function\_variant\_fixups → [lief.MachO.FunctionVariantFixups]( "lief.MachO.FunctionVariantFixups") | None Return `LC_FUNCTION_VARIANT_FIXUPS` command #### [` function_variants `]() property function\_variants → [lief.MachO.FunctionVariants]( "lief.MachO.FunctionVariants") | None Return `LC_FUNCTION_VARIANTS` command #### [` functions `]() property functions → list[[lief.Function]( "lief.Function")] Return list of **all** [`Function`]( "lief.Function") found #### [` get `]() get(*self*, *type: [lief.\_lief.MachO.LoadCommand.TYPE]( "lief._lief.MachO.LoadCommand.TYPE")*) → [lief.\_lief.MachO.LoadCommand]( "lief._lief.MachO.LoadCommand") | None Return the **first** [`LoadCommand`]( "lief.MachO.LoadCommand") with the given [`TYPE`]( "lief.MachO.LoadCommand.TYPE") or None if it is not present. #### [` get_sectionget_section `]() get\_section(*self*, *name: str*) → [lief.\_lief.MachO.Section]( "lief._lief.MachO.Section") | None **get\_section(*self*, *segname: str*, *secname: str*) → [lief.\_lief.MachO.Section]( "lief._lief.MachO.Section") | None** Overloaded function. 1. `get_section(self, name: str) -> lief._lief.MachO.Section | None` Return the section from the given name or None if the section does not exist 2. `get_section(self, segname: str, secname: str) -> lief._lief.MachO.Section | None` > Return the section from the segment with the name given in the first parameter and with the section’s name provided in the second parameter. If the section cannot be found, it returns a nullptr #### [` get_segment `]() get\_segment(*self*, *name: str*) → [lief.\_lief.MachO.SegmentCommand]( "lief._lief.MachO.SegmentCommand") | None Return the [`SegmentCommand`]( "lief.MachO.SegmentCommand") from the given name #### [` get_symbol `]() get\_symbol(*self*, *name: str*) → [lief.\_lief.MachO.Symbol]( "lief._lief.MachO.Symbol") | None Return the [`Symbol`]( "lief.MachO.Symbol") from the given name #### [` has `]() has(*self*, *type: [lief.\_lief.MachO.LoadCommand.TYPE]( "lief._lief.MachO.LoadCommand.TYPE")*) → bool Check if the current binary has a [`LoadCommand`]( "lief.MachO.LoadCommand") with the given [`TYPE`]( "lief.MachO.LoadCommand.TYPE") #### [` has_atom_info `]() property has\_atom\_info → bool `True` if the binary embeds the `LC_ATOM_INFO` command (`AtomInfo`) #### [` has_build_version `]() property has\_build\_version → bool `True` if the binary has a [`BuildVersion`]( "lief.MachO.BuildVersion") command #### [` has_code_signature `]() property has\_code\_signature → bool `True` if the binary is signed (i.e. has a [`CodeSignature`]( "lief.MachO.CodeSignature") command) #### [` has_code_signature_dir `]() property has\_code\_signature\_dir → bool `True` if the binary is signed (i.e. has a [`CodeSignatureDir`]( "lief.MachO.CodeSignatureDir") command) with the command LC\_DYLIB\_CODE\_SIGN\_DRS #### [` has_data_in_code `]() property has\_data\_in\_code → bool `True` if the binary has a [`DataInCode`]( "lief.MachO.DataInCode") command #### [` has_dyld_chained_fixups `]() property has\_dyld\_chained\_fixups → bool `True` if the binary has a [`DyldChainedFixups`]( "lief.MachO.DyldChainedFixups") command #### [` has_dyld_environment `]() property has\_dyld\_environment → bool `True` if the binary has a [`DyldEnvironment`]( "lief.MachO.DyldEnvironment") command #### [` has_dyld_exports_trie `]() property has\_dyld\_exports\_trie → bool `True` if the binary has a [`DyldExportsTrie`]( "lief.MachO.DyldExportsTrie") command #### [` has_dyld_info `]() property has\_dyld\_info → bool `True` if the binary has a [`DyldInfo`]( "lief.MachO.DyldInfo") command. #### [` has_dylinker `]() property has\_dylinker → bool `True` if the binary has a [`DylinkerCommand`]( "lief.MachO.DylinkerCommand") command. #### [` has_dynamic_symbol_command `]() property has\_dynamic\_symbol\_command → bool `True` if the binary has a [`DynamicSymbolCommand`]( "lief.MachO.DynamicSymbolCommand") command. #### [` has_encryption_info `]() property has\_encryption\_info → bool `True` if the binary has a [`EncryptionInfo`]( "lief.MachO.EncryptionInfo") command #### [` has_entrypoint `]() property has\_entrypoint → bool `True` if the binary has an entrypoint. Basically for libraries it will return `false` #### [` has_filesets `]() property has\_filesets → bool Return `True` if the binary has filesets #### [` has_function_starts `]() property has\_function\_starts → bool `True` if the binary has a [`FunctionStarts`]( "lief.MachO.FunctionStarts") command. #### [` has_function_variant_fixups `]() property has\_function\_variant\_fixups → bool `True` if the binary has a `LC_FUNCTION_VARIANT_FIXUPS` command #### [` has_function_variants `]() property has\_function\_variants → bool `True` if the binary has a `LC_FUNCTION_VARIANTS` command #### [` has_linker_opt_hint `]() property has\_linker\_opt\_hint → bool `True` if the binary embeds the Linker optimization hint command ([`LinkerOptHint`]( "lief.MachO.LinkerOptHint")) #### [` has_main_command `]() property has\_main\_command → bool `True` if the binary has a [`MainCommand`]( "lief.MachO.MainCommand") command. #### [` has_notes `]() property has\_notes → bool True if the binary contains `LC_NOTE` command(s) #### [` has_nx_heap `]() property has\_nx\_heap → bool Return True if the **heap** is flagged as non-executable. False otherwise. #### [` has_nx_stack `]() property has\_nx\_stack → bool Return True if the **stack** is flagged as non-executable. False otherwise. #### [` has_routine_command `]() property has\_routine\_command → bool `True` if the binary has a [`Routine`]( "lief.MachO.Routine") command. #### [` has_rpath `]() property has\_rpath → bool `True` if the binary has a [`RPathCommand`]( "lief.MachO.RPathCommand") command. #### [` has_section `]() has\_section(*self*, *name: str*) → bool Check if a section with the given name exists #### [` has_segment `]() has\_segment(*self*, *name: str*) → bool Check if a [`SegmentCommand`]( "lief.MachO.SegmentCommand") with the given name exists #### [` has_segment_split_info `]() property has\_segment\_split\_info → bool `True` if the binary has a [`SegmentSplitInfo`]( "lief.MachO.SegmentSplitInfo") command #### [` has_source_version `]() property has\_source\_version → bool `True` if the binary has a [`SourceVersion`]( "lief.MachO.SourceVersion") command. #### [` has_sub_framework `]() property has\_sub\_framework → bool `True` if the binary has a [`SubFramework`]( "lief.MachO.SubFramework") command #### [` has_subclients `]() property has\_subclients → bool `True` if the binary has a [`SubClient`]( "lief.MachO.SubClient") command #### [` has_symbol `]() has\_symbol(*self*, *name: str*) → bool Check if a [`Symbol`]( "lief.MachO.Symbol") with the given name exists #### [` has_symbol_command `]() property has\_symbol\_command → bool `True` if the binary has a [`SymbolCommand`]( "lief.MachO.SymbolCommand") command. #### [` has_thread_command `]() property has\_thread\_command → bool `True` if the binary has a [`ThreadCommand`]( "lief.MachO.ThreadCommand") command. #### [` has_two_level_hints `]() property has\_two\_level\_hints → bool `True` if the binary embeds the Two Level Hint command ([`TwoLevelHints`]( "lief.MachO.TwoLevelHints")) #### [` has_uuid `]() property has\_uuid → bool `True` if the binary has a [`UUIDCommand`]( "lief.MachO.UUIDCommand") command. #### [` has_version_min `]() property has\_version\_min → bool `True` if the binary has a [`VersionMin`]( "lief.MachO.VersionMin") command. #### [` header `]() property header → [lief.MachO.Header]( "lief.MachO.Header") Return binary’s [`Header`]( "lief.MachO.Header") #### [` imagebase `]() property imagebase → int Return the binary’s `imagebase` which is the base address where segments are mapped (without the ASLR). `0` if not relevant. #### [` imported_symbols `]() property imported\_symbols → lief.MachO.Binary.it\_filter\_symbols Return the binary’s [`Symbol`]( "lief.MachO.Symbol") which are imported #### [` is_ios `]() property is\_ios → bool True if this binary targets iOS #### [` is_macos `]() property is\_macos → bool True if this binary targets macOS #### [` is_valid_addr `]() is\_valid\_addr(*self*, *address: int*) → bool Check if the given address is encompassed between the range of virtual addresses. See: [`va_ranges`]( "lief.MachO.Binary.va_ranges") #### [` lazy_load_dylib_infos `]() property lazy\_load\_dylib\_infos → lief.MachO.Binary.it\_lazy\_load\_dylib\_info Return an iterator over the binary’s [`LazyLoadDylibInfo`]( "lief.MachO.LazyLoadDylibInfo") #### [` libraries `]() property libraries → lief.MachO.Binary.it\_libraries Return an iterator over the binary’s [`DylibCommand`]( "lief.MachO.DylibCommand") #### [` linker_opt_hint `]() property linker\_opt\_hint → [lief.MachO.LinkerOptHint]( "lief.MachO.LinkerOptHint") | None Return the binary’s [`LinkerOptHint`]( "lief.MachO.LinkerOptHint") if any, or None #### [` main_command `]() property main\_command → [lief.MachO.MainCommand]( "lief.MachO.MainCommand") | None Return the binary’s [`MainCommand`]( "lief.MachO.MainCommand") if any, or None #### [` notes `]() property notes → lief.MachO.Binary.it\_notes Iterator over the different `LC_NOTE` commands #### [` objc_metadata `]() property objc\_metadata → [lief.objc.Metadata]( "lief.objc.Metadata") | None Return Objective-C metadata info if present > **Warning** > > This is only available with the extended version of LIEF. #### [` off_ranges `]() property off\_ranges → [lief.MachO.Binary.range\_t]( "lief.MachO.Binary.range_t") Return the range of offsets as a tuple `(off_start, off_end)` #### [` overlay `]() property overlay → memoryview #### [` platform `]() property platform → [lief.MachO.BuildVersion.PLATFORMS]( "lief.MachO.BuildVersion.PLATFORMS") Return the platform for which this Mach-O has been compiled #### [` range_t `]() class range\_t Bases: `object` ##### [` end `]() property end → int ##### [` start `]() property start → int #### [` relocations `]() property relocations → lief.MachO.Binary.it\_relocations Return an iterator over binary’s [`Relocation`]( "lief.MachO.Relocation") #### [` removeremoveremove `]() remove(*self*, *load\_command: [lief.\_lief.MachO.LoadCommand]( "lief._lief.MachO.LoadCommand")*) → bool **remove(*self*, *type: [lief.\_lief.MachO.LoadCommand.TYPE]( "lief._lief.MachO.LoadCommand.TYPE")*) → bool **remove(*self*, *symbol: [lief.\_lief.MachO.Symbol]( "lief._lief.MachO.Symbol")*) → bool**** Overloaded function. 1. `remove(self, load_command: lief._lief.MachO.LoadCommand) -> bool` Remove a [`LoadCommand`]( "lief.MachO.LoadCommand") 2. `remove(self, type: lief._lief.MachO.LoadCommand.TYPE) -> bool` Remove **all** the [`LoadCommand`]( "lief.MachO.LoadCommand") with the given [`TYPE`]( "lief.MachO.LoadCommand.TYPE") 3. `remove(self, symbol: lief._lief.MachO.Symbol) -> bool` Remove the given [`Symbol`]( "lief.MachO.Symbol") #### [` remove_command `]() remove\_command(*self*, *index: int*) → bool Remove the [`LoadCommand`]( "lief.MachO.LoadCommand") at the given `index` #### [` remove_sectionremove_section `]() remove\_section(*self*, *name: str*, *clear: bool = False*) → None **remove\_section(*self*, *segname: str*, *secname: str*, *clear: bool = False*) → None** Overloaded function. 1. `remove_section(self, name: str, clear: bool = False) -> None` Remove the section with the given name 2. `remove_section(self, segname: str, secname: str, clear: bool = False) -> None` > Remove the section from the segment with the name given in the first parameter and with the section’s name provided in the second parameter. #### [` remove_signature `]() remove\_signature(*self*) → bool Remove the [`CodeSignature`]( "lief.MachO.CodeSignature") (if any) #### [` remove_symbol `]() remove\_symbol(*self*, *name: str*) → bool Remove all symbol(s) with the given name #### [` routine_command `]() property routine\_command → [lief.MachO.Routine]( "lief.MachO.Routine") | None Return the binary’s [`Routine`]( "lief.MachO.Routine") if any, or None #### [` rpath `]() property rpath → [lief.MachO.RPathCommand]( "lief.MachO.RPathCommand") | None Return the binary’s [`RPathCommand`]( "lief.MachO.RPathCommand") if any, or None #### [` rpaths `]() property rpaths → lief.MachO.Binary.it\_rpaths Return an iterator over the binary’s [`RPathCommand`]( "lief.MachO.RPathCommand") #### [` section_from_offset `]() section\_from\_offset(*self*, *arg: int*, */*) → [lief.\_lief.MachO.Section]( "lief._lief.MachO.Section") | None Return the [`Section`]( "lief.MachO.Section") which encompasses the offset #### [` section_from_virtual_address `]() section\_from\_virtual\_address(*self*, *arg: int*, */*) → [lief.\_lief.MachO.Section]( "lief._lief.MachO.Section") | None Return the [`Section`]( "lief.MachO.Section") which encompasses the virtual address #### [` sections `]() property sections → lief.MachO.Binary.it\_sections Return an iterator over the binary’s [`Section`]( "lief.MachO.Section") #### [` segment_from_offset `]() segment\_from\_offset(*self*, *arg: int*, */*) → [lief.\_lief.MachO.SegmentCommand]( "lief._lief.MachO.SegmentCommand") | None Return the [`SegmentCommand`]( "lief.MachO.SegmentCommand") which encompasses the offset #### [` segment_from_virtual_address `]() segment\_from\_virtual\_address(*self*, *arg: int*, */*) → [lief.\_lief.MachO.SegmentCommand]( "lief._lief.MachO.SegmentCommand") | None Return the [`SegmentCommand`]( "lief.MachO.SegmentCommand") which encompasses the virtual address #### [` segment_split_info `]() property segment\_split\_info → [lief.MachO.SegmentSplitInfo]( "lief.MachO.SegmentSplitInfo") | None Return the binary’s [`SegmentSplitInfo`]( "lief.MachO.SegmentSplitInfo") if any, or None #### [` segments `]() property segments → lief.MachO.Binary.it\_segments Return an iterator over the binary’s [`SegmentCommand`]( "lief.MachO.SegmentCommand") #### [` shift `]() shift(*self*, *value: int*) → [lief.\_lief.ok\_t]( "lief._lief.ok_t") | [lief.\_lief.lief\_errors]( "lief._lief.lief_errors") Shift the content located right after the Load commands table. This operation can be used to add a new command #### [` shift_linkedit `]() shift\_linkedit(*self*, *value: int*) → [lief.\_lief.ok\_t]( "lief._lief.ok_t") | [lief.\_lief.lief\_errors]( "lief._lief.lief_errors") Shift the position on the \_\_LINKEDIT data by width #### [` source_version `]() property source\_version → [lief.MachO.SourceVersion]( "lief.MachO.SourceVersion") | None Return the binary’s [`SourceVersion`]( "lief.MachO.SourceVersion") if any, or None #### [` sub_framework `]() property sub\_framework → [lief.MachO.SubFramework]( "lief.MachO.SubFramework") | None Return the binary’s [`SubFramework`]( "lief.MachO.SubFramework") if any, or None #### [` subclients `]() property subclients → lief.MachO.Binary.it\_sub\_clients Return an iterator over the binary’s [`SubClient`]( "lief.MachO.SubClient") #### [` support_arm64_ptr_auth `]() property support\_arm64\_ptr\_auth → bool Check if the binary is supporting ARM64 pointer authentication (arm64e) #### [` symbol_command `]() property symbol\_command → [lief.MachO.SymbolCommand]( "lief.MachO.SymbolCommand") | None Return the binary’s [`SymbolCommand`]( "lief.MachO.SymbolCommand") if any, or None #### [` symbol_stubs `]() property symbol\_stubs → collections.abc.Sequence[[lief.MachO.Stub]( "lief.MachO.Stub")] Return an iterator over the symbol stubs. These stubs are involved when calling an **imported** function and are similar to the ELF’s plt/got mechanism. There are located in sections like: `__stubs,__auth_stubs,__symbol_stub,__picsymbolstub4` #### [` symbols `]() property symbols → lief.MachO.Binary.it\_symbols Return an iterator over the binary’s [`Symbol`]( "lief.MachO.Symbol") #### [` thread_command `]() property thread\_command → [lief.MachO.ThreadCommand]( "lief.MachO.ThreadCommand") | None Return the binary’s [`ThreadCommand`]( "lief.MachO.ThreadCommand") if any, or None #### [` tlv_initial_content_range `]() property tlv\_initial\_content\_range → [lief.MachO.Binary.range\_t]( "lief.MachO.Binary.range_t") Return the TLV initial content range #### [` two_level_hints `]() property two\_level\_hints → [lief.MachO.TwoLevelHints]( "lief.MachO.TwoLevelHints") | None Return the binary’s [`TwoLevelHints`]( "lief.MachO.TwoLevelHints") if any, or None #### [` unexportunexport `]() unexport(*self*, *name: str*) → bool **unexport(*self*, *symbol: [lief.\_lief.MachO.Symbol]( "lief._lief.MachO.Symbol")*) → bool** Remove the symbol from the export table #### [` unwind_functions `]() property unwind\_functions → list[[lief.Function]( "lief.Function")] Return list of [`Function`]( "lief.Function") found in the `__unwind_info` section #### [` uuid `]() property uuid → [lief.MachO.UUIDCommand]( "lief.MachO.UUIDCommand") | None Return the binary’s [`UUIDCommand`]( "lief.MachO.UUIDCommand") if any, or None #### [` va_ranges `]() property va\_ranges → [lief.MachO.Binary.range\_t]( "lief.MachO.Binary.range_t") Return the range of virtual addresses as a tuple `(va_start, va_end)` #### [` version_min `]() property version\_min → [lief.MachO.VersionMin]( "lief.MachO.VersionMin") | None Return the binary’s [`VersionMin`]( "lief.MachO.VersionMin") if any, or None #### [` virtual_address_to_offset `]() virtual\_address\_to\_offset(*self*, *virtual\_address: int*) → int | [lief.\_lief.lief\_errors]( "lief._lief.lief_errors") Convert the virtual address to an offset in the binary #### [` virtual_size `]() property virtual\_size → int Binary’s memory size when mapped #### [` writewrite `]() write(*self*, *output: str | os.PathLike*) → None **write(*self*, *output: str | os.PathLike*, *config: [lief.\_lief.MachO.Builder.config\_t]( "lief._lief.MachO.Builder.config_t")*) → None** Overloaded function. 1. `write(self, output: Union[str | os.PathLike]) -> None` Rebuild the binary and write its content in the file given in the first parameter 2. `write(self, output: Union[str | os.PathLike], config: lief._lief.MachO.Builder.config_t) -> None` > Rebuild the binary and write its content in the file given in the first parameter. The `config` parameter can be used to tweak the building process. #### [` write_to_byteswrite_to_bytes `]() write\_to\_bytes(*self*, *config: [lief.\_lief.MachO.Builder.config\_t]( "lief._lief.MachO.Builder.config_t")*) → bytes **write\_to\_bytes(*self*) → bytes** --- ## [Header]() ### [` lief.MachO.Header `]() class lief.MachO.Header(*self*) Bases: `Object` Class that represents the Mach-O header #### [` CPU_TYPE `]() class CPU\_TYPE(*\*values*) Bases: `Enum` ##### [` AIR64 `]() AIR64 = 16777239 ##### [` ALPHA `]() ALPHA = 16 ##### [` AMD_GPU `]() AMD\_GPU = 16777236 ##### [` ANY `]() ANY = -1 ##### [` APPLE_GPU `]() APPLE\_GPU = 16777235 ##### [` ARM `]() ARM = 12 ##### [` ARM64 `]() ARM64 = 16777228 ##### [` HPPA `]() HPPA = 11 ##### [` I860 `]() I860 = 15 ##### [` INTEL_GPU `]() INTEL\_GPU = 16777237 ##### [` MC88000 `]() MC88000 = 13 ##### [` MC98000 `]() MC98000 = 10 ##### [` MIPS `]() MIPS = 8 ##### [` POWERPC `]() POWERPC = 18 ##### [` POWERPC64 `]() POWERPC64 = 16777234 ##### [` SPARC `]() SPARC = 14 ##### [` X86 `]() X86 = 7 ##### [` X86_64 `]() X86\_64 = 16777223 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.Header.CPU\_TYPE]( "lief.MachO.Header.CPU_TYPE") = <nanobind.nb\_func object> #### [` FILE_TYPE `]() class FILE\_TYPE(*\*values*) Bases: `Enum` ##### [` BUNDLE `]() BUNDLE = 8 ##### [` CORE `]() CORE = 4 ##### [` DSYM `]() DSYM = 10 ##### [` DYLIB `]() DYLIB = 6 ##### [` DYLIB_STUB `]() DYLIB\_STUB = 9 ##### [` DYLINKER `]() DYLINKER = 7 ##### [` EXECUTE `]() EXECUTE = 2 ##### [` FILESET `]() FILESET = 12 ##### [` FVMLIB `]() FVMLIB = 3 ##### [` GPU_DYLIB `]() GPU\_DYLIB = 14 ##### [` GPU_EXECUTE `]() GPU\_EXECUTE = 13 ##### [` KEXT_BUNDLE `]() KEXT\_BUNDLE = 11 ##### [` OBJECT `]() OBJECT = 1 ##### [` PRELOAD `]() PRELOAD = 5 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.Header.FILE\_TYPE]( "lief.MachO.Header.FILE_TYPE") = <nanobind.nb\_func object> #### [` FLAGS `]() class FLAGS(*\*values*) Bases: `Flag` ##### [` ALLMODSBOUND `]() ALLMODSBOUND = 4096 ##### [` ALLOW_STACK_EXECUTION `]() ALLOW\_STACK\_EXECUTION = 131072 ##### [` APP_EXTENSION_SAFE `]() APP\_EXTENSION\_SAFE = 33554432 ##### [` BINDATLOAD `]() BINDATLOAD = 8 ##### [` BINDS_TO_WEAK `]() BINDS\_TO\_WEAK = 65536 ##### [` CANONICAL `]() CANONICAL = 16384 ##### [` DEAD_STRIPPABLE_DYLIB `]() DEAD\_STRIPPABLE\_DYLIB = 4194304 ##### [` DYLDLINK `]() DYLDLINK = 4 ##### [` DYLIB_IN_CACHE `]() DYLIB\_IN\_CACHE = 2147483648 ##### [` FORCE_FLAT `]() FORCE\_FLAT = 256 ##### [` HAS_TLV_DESCRIPTORS `]() HAS\_TLV\_DESCRIPTORS = 8388608 ##### [` IMPLICIT_PAGEZERO `]() IMPLICIT\_PAGEZERO = 268435456 ##### [` INCRLINK `]() INCRLINK = 2 ##### [` LAZY_INIT `]() LAZY\_INIT = 64 ##### [` NLIST_OUTOFSYNC_WITH_DYLDINFO `]() NLIST\_OUTOFSYNC\_WITH\_DYLDINFO = 67108864 ##### [` NOFIXPREBINDING `]() NOFIXPREBINDING = 1024 ##### [` NOMULTIDEFS `]() NOMULTIDEFS = 512 ##### [` NOUNDEFS `]() NOUNDEFS = 1 ##### [` NO_HEAP_EXECUTION `]() NO\_HEAP\_EXECUTION = 16777216 ##### [` NO_REEXPORTED_DYLIBS `]() NO\_REEXPORTED\_DYLIBS = 1048576 ##### [` PIE `]() PIE = 2097152 ##### [` PREBINDABLE `]() PREBINDABLE = 2048 ##### [` PREBOUND `]() PREBOUND = 16 ##### [` ROOT_SAFE `]() ROOT\_SAFE = 262144 ##### [` SETUID_SAFE `]() SETUID\_SAFE = 524288 ##### [` SIM_SUPPORT `]() SIM\_SUPPORT = 134217728 ##### [` SPLIT_SEGS `]() SPLIT\_SEGS = 32 ##### [` SUBSECTIONS_VIA_SYMBOLS `]() SUBSECTIONS\_VIA\_SYMBOLS = 8192 ##### [` TWOLEVEL `]() TWOLEVEL = 128 ##### [` WEAK_DEFINES `]() WEAK\_DEFINES = 32768 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.Header.FLAGS]( "lief.MachO.Header.FLAGS") = <nanobind.nb\_func object> #### [` add `]() add(*self*, *flag: [lief.\_lief.MachO.Header.FLAGS]( "lief._lief.MachO.Header.FLAGS")*) → None Add the given [`FLAGS`]( "lief.MachO.Header.FLAGS") #### [` cpu_subtype `]() property cpu\_subtype → int Return the CPU subtype supported by the Mach-O binary. For ARM architectures, this value could represent the minimum version for which the Mach-O binary has been compiled for. #### [` cpu_type `]() property cpu\_type → [lief.MachO.Header.CPU\_TYPE]( "lief.MachO.Header.CPU_TYPE") Target CPU #### [` file_type `]() property file\_type → [lief.MachO.Header.FILE\_TYPE]( "lief.MachO.Header.FILE_TYPE") Binary’s type #### [` flags `]() property flags → int Binary’s flags #### [` flags_list `]() property flags\_list → list[[lief.MachO.Header.FLAGS]( "lief.MachO.Header.FLAGS")] [`FLAGS`]( "lief.MachO.Header.FLAGS") as a list #### [` has `]() has(*self*, *flag: [lief.\_lief.MachO.Header.FLAGS]( "lief._lief.MachO.Header.FLAGS")*) → bool `True` if the given [`FLAGS`]( "lief.MachO.Header.FLAGS") is in the [`flags`]( "lief.MachO.Header.flags") #### [` is_32bit `]() property is\_32bit → bool True if the binary is 32-bits #### [` is_64bit `]() property is\_64bit → bool True if the binary is 64-bits #### [` magic `]() property magic → [lief.MachO.MACHO\_TYPES]( "lief.MachO.MACHO_TYPES") The Mach-O magic bytes. These bytes determine whether it is a 32 bits Mach-O, a 64 bits Mach-O files etc. #### [` nb_cmds `]() property nb\_cmds → int Number of [`LoadCommand`]( "lief.MachO.LoadCommand") #### [` remove `]() remove(*self*, *flag: [lief.\_lief.MachO.Header.FLAGS]( "lief._lief.MachO.Header.FLAGS")*) → None Remove the given [`FLAGS`]( "lief.MachO.Header.FLAGS") #### [` reserved `]() property reserved → int According to the official documentation, a reserved value #### [` sizeof_cmds `]() property sizeof\_cmds → int Size of all [`LoadCommand`]( "lief.MachO.LoadCommand") --- ## [Section]() ![Inheritance diagram of lief._lief.MachO.Section, lief._lief.MachO.ThreadLocalVariables](https://lief.re/doc/latest/_images/inheritance-0b050e305cc689530f9a1201959812b5d00abc80.png) ### [` lief.MachO.Section `]() class lief.MachO.Section Bases: [`Section`]( "lief._lief.Section") Class that represents a Mach-O section #### [` FLAGS `]() class FLAGS(*\*values*) Bases: `Flag` ##### [` DEBUG_INFO `]() DEBUG\_INFO = 33554432 ##### [` EXT_RELOC `]() EXT\_RELOC = 512 ##### [` LIVE_SUPPORT `]() LIVE\_SUPPORT = 134217728 ##### [` LOC_RELOC `]() LOC\_RELOC = 256 ##### [` NO_DEAD_STRIP `]() NO\_DEAD\_STRIP = 268435456 ##### [` NO_TOC `]() NO\_TOC = 1073741824 ##### [` PURE_INSTRUCTIONS `]() PURE\_INSTRUCTIONS = 2147483648 ##### [` SELF_MODIFYING_CODE `]() SELF\_MODIFYING\_CODE = 67108864 ##### [` SOME_INSTRUCTIONS `]() SOME\_INSTRUCTIONS = 1024 ##### [` STRIP_STATIC_SYMS `]() STRIP\_STATIC\_SYMS = 536870912 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.Section.FLAGS]( "lief.MachO.Section.FLAGS") = <nanobind.nb\_func object> #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` ##### [` COALESCED `]() COALESCED = 11 ##### [` CSTRING_LITERALS `]() CSTRING\_LITERALS = 2 ##### [` DTRACE_DOF `]() DTRACE\_DOF = 15 ##### [` GB_ZEROFILL `]() GB\_ZEROFILL = 12 ##### [` INIT_FUNC_OFFSETS `]() INIT\_FUNC\_OFFSETS = 22 ##### [` INTERPOSING `]() INTERPOSING = 13 ##### [` IS_16BYTE_LITERALS `]() IS\_16BYTE\_LITERALS = 14 ##### [` IS_4BYTE_LITERALS `]() IS\_4BYTE\_LITERALS = 3 ##### [` IS_8BYTE_LITERALS `]() IS\_8BYTE\_LITERALS = 4 ##### [` LAZY_DYLIB_SYMBOL_POINTERS `]() LAZY\_DYLIB\_SYMBOL\_POINTERS = 16 ##### [` LAZY_SYMBOL_POINTERS `]() LAZY\_SYMBOL\_POINTERS = 7 ##### [` LITERAL_POINTERS `]() LITERAL\_POINTERS = 5 ##### [` MOD_INIT_FUNC_POINTERS `]() MOD\_INIT\_FUNC\_POINTERS = 9 ##### [` MOD_TERM_FUNC_POINTERS `]() MOD\_TERM\_FUNC\_POINTERS = 10 ##### [` NON_LAZY_SYMBOL_POINTERS `]() NON\_LAZY\_SYMBOL\_POINTERS = 6 ##### [` REGULAR `]() REGULAR = 0 ##### [` SYMBOL_STUBS `]() SYMBOL\_STUBS = 8 ##### [` THREAD_LOCAL_INIT_FUNCTION_POINTERS `]() THREAD\_LOCAL\_INIT\_FUNCTION\_POINTERS = 21 ##### [` THREAD_LOCAL_REGULAR `]() THREAD\_LOCAL\_REGULAR = 17 ##### [` THREAD_LOCAL_VARIABLES `]() THREAD\_LOCAL\_VARIABLES = 19 ##### [` THREAD_LOCAL_VARIABLE_POINTERS `]() THREAD\_LOCAL\_VARIABLE\_POINTERS = 20 ##### [` THREAD_LOCAL_ZEROFILL `]() THREAD\_LOCAL\_ZEROFILL = 18 ##### [` ZEROFILL `]() ZEROFILL = 1 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.Section.TYPE]( "lief.MachO.Section.TYPE") = <nanobind.nb\_func object> #### [` add `]() add(*self*, *flag: [lief.\_lief.MachO.Section.FLAGS]( "lief._lief.MachO.Section.FLAGS")*) → None Add the given `SECTION_FLAGS` #### [` alignment `]() property alignment → int Section’s alignment as a power of 2 #### [` create `]() create(*\*args*) → [lief.MachO.Section]( "lief.MachO.Section") | None = <nanobind.nb\_func object> #### [` flags `]() property flags → [lief.MachO.Section.FLAGS]( "lief.MachO.Section.FLAGS") Section’s flags masked with SECTION\_FLAGS\_MASK (see: [`FLAGS`]( "lief.MachO.Section.FLAGS")) #### [` flags_list `]() property flags\_list → list[[lief.MachO.Section.FLAGS]( "lief.MachO.Section.FLAGS")] #### [` has `]() has(*self*, *flag: [lief.\_lief.MachO.Section.FLAGS]( "lief._lief.MachO.Section.FLAGS")*) → bool Check if the section has the given `SECTION_FLAGS` #### [` has_segment `]() property has\_segment → bool True if the current section has a segment associated with #### [` numberof_relocations `]() property numberof\_relocations → int Number of relocations associated with this section #### [` relocation_offset `]() property relocation\_offset → int Offset of the relocation table. This value should be 0 for executable and libraries as the relocations are managed by the [`lief.MachO.DyldInfo.rebase`]( "lief.MachO.DyldInfo.rebase") On the other hand, for object files (`.o`) this value should not be 0 #### [` relocations `]() property relocations → lief.MachO.SegmentCommand.it\_relocations Iterator over the [`Relocation`]( "lief.MachO.Relocation") (if any) #### [` remove `]() remove(*self*, *flag: [lief.\_lief.MachO.Section.FLAGS]( "lief._lief.MachO.Section.FLAGS")*) → None Remove the given `SECTION_FLAGS` #### [` reserved1 `]() property reserved1 → int According to the official `loader.h` file, this value is reserved for *offset* or *index* #### [` reserved2 `]() property reserved2 → int According to the official `loader.h` file, this value is reserved for *offset* or *index* #### [` reserved3 `]() property reserved3 → int According to the official `loader.h` file, this value is reserved for *offset* or *index* #### [` segment `]() property segment → [lief.MachO.SegmentCommand]( "lief.MachO.SegmentCommand") | None [`SegmentCommand`]( "lief.MachO.SegmentCommand") associated with the section or None if not present #### [` segment_name `]() property segment\_name → str The segment name associated with the section #### [` type `]() property type → [lief.MachO.Section.TYPE]( "lief.MachO.Section.TYPE") Type of the section. This value can help to determine the purpose of the section (c.f. [`TYPE`]( "lief.MachO.Section.TYPE")) --- ## [ThreadLocalVariables]() ![Inheritance diagram of lief._lief.MachO.ThreadLocalVariables](https://lief.re/doc/latest/_images/inheritance-ed5df4b965c40206128df2871db06e5fa4b2aa28.png) ### [` lief.MachO.ThreadLocalVariables `]() class lief.MachO.ThreadLocalVariables Bases: [`Section`]( "lief._lief.MachO.Section") This class represents a MachO section whose type is [`THREAD_LOCAL_VARIABLES`]( "lief.MachO.Section.TYPE.THREAD_LOCAL_VARIABLES"). It contains an array of thread-local variable descriptors ([`Thunk`]( "lief.MachO.ThreadLocalVariables.Thunk")) used by dyld to lazily initialize thread-local storage on first access. #### [` ThunkThunk `]() class Thunk(*self*) **class Thunk(*self*, *func: int*, *key: int*, *offset: int*)** Bases: `object` Descriptor for a single thread-local variable. The layout mirrors the `tlv_descriptor` structure from ``. ##### [` func `]() property func → int Address of the initializer function (`tlv_thunk`) ##### [` key `]() property key → int `pthread_key_t` key used by the runtime ##### [` offset `]() property offset → int Offset of the variable in the TLS block #### [` get `]() get(*self*, *idx: int*) → [lief.\_lief.MachO.ThreadLocalVariables.Thunk]( "lief._lief.MachO.ThreadLocalVariables.Thunk") | None Return the [`Thunk`]( "lief.MachO.ThreadLocalVariables.Thunk") at the given index, or None if the index is out of range. #### [` nb_thunks `]() property nb\_thunks → int Number of [`Thunk`]( "lief.MachO.ThreadLocalVariables.Thunk") descriptors #### [` set `]() set(*self*, *idx: int*, *thunk: [lief.\_lief.MachO.ThreadLocalVariables.Thunk]( "lief._lief.MachO.ThreadLocalVariables.Thunk")*) → None Change the [`Thunk`]( "lief.MachO.ThreadLocalVariables.Thunk") at the given index. #### [` thunks `]() property thunks → collections.abc.Sequence[[lief.MachO.ThreadLocalVariables.Thunk]( "lief.MachO.ThreadLocalVariables.Thunk")] Return an iterator over the [`Thunk`]( "lief.MachO.ThreadLocalVariables.Thunk") descriptors stored in this section. --- ## [SegmentCommand]() ![Inheritance diagram of lief._lief.MachO.SegmentCommand, lief._lief.MachO.LinkEdit](https://lief.re/doc/latest/_images/inheritance-9c44cefe82a758034166bf525eb6cd242cfe46fe.png) ### [` lief.MachO.SegmentCommandlief.MachO.SegmentCommandlief.MachO.SegmentCommand `]() class lief.MachO.SegmentCommand(*self*) **class lief.MachO.SegmentCommand(*self*, *arg: str*, */*) **class lief.MachO.SegmentCommand(*self*, *arg0: str*, *arg1: collections.abc.Sequence[int]*, */*)**** Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class which represents a [`SEGMENT`]( "lief.MachO.LoadCommand.TYPE.SEGMENT") / [`SEGMENT_64`]( "lief.MachO.LoadCommand.TYPE.SEGMENT_64") command #### [` FLAGS `]() class FLAGS(*\*values*) Bases: `Enum` ##### [` FVMLIB `]() FVMLIB = 2 ##### [` HIGHVM `]() HIGHVM = 1 ##### [` NORELOC `]() NORELOC = 4 ##### [` PROTECTED_VERSION_1 `]() PROTECTED\_VERSION\_1 = 8 ##### [` READ_ONLY `]() READ\_ONLY = 16 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.SegmentCommand.FLAGS]( "lief.MachO.SegmentCommand.FLAGS") = <nanobind.nb\_func object> #### [` VM_PROTECTIONS `]() class VM\_PROTECTIONS(*\*values*) Bases: `Enum` ##### [` R `]() R = 1 ##### [` W `]() W = 2 ##### [` X `]() X = 4 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.SegmentCommand.VM\_PROTECTIONS]( "lief.MachO.SegmentCommand.VM_PROTECTIONS") = <nanobind.nb\_func object> #### [` add_section `]() add\_section(*self*, *section: [lief.\_lief.MachO.Section]( "lief._lief.MachO.Section")*) → [lief.\_lief.MachO.Section]( "lief._lief.MachO.Section") #### [` content `]() property content → memoryview Segment’s content #### [` file_offset `]() property file\_offset → int Segment’s file offset #### [` file_size `]() property file\_size → int Segment’s file size #### [` flags `]() property flags → int Segment’s flags #### [` get_section `]() get\_section(*self*, *name: str*) → [lief.\_lief.MachO.Section]( "lief._lief.MachO.Section") | None Get the [`Section`]( "lief.MachO.Section") with the given name #### [` has `]() has(*self*, *section: [lief.\_lief.MachO.Section]( "lief._lief.MachO.Section")*) → bool Check if the given [`Section`]( "lief.MachO.Section") belongs to the current segment #### [` has_section `]() has\_section(*self*, *section\_name: str*) → bool Check if the given section name belongs to the current segment #### [` index `]() property index → int Relative index of the segment in the segment table #### [` init_protection `]() property init\_protection → int Segment’s initial protection #### [` max_protection `]() property max\_protection → int Segment’s max protection #### [` name `]() property name → str | bytes Segment’s name #### [` numberof_sections `]() property numberof\_sections → int Number of sections in this segment #### [` relocations `]() property relocations → lief.MachO.SegmentCommand.it\_relocations Segment’s relocations #### [` sections `]() property sections → lief.MachO.SegmentCommand.it\_sections Segment’s sections #### [` virtual_address `]() property virtual\_address → int Segment’s virtual address #### [` virtual_size `]() property virtual\_size → int Segment’s virtual size --- ## [LoadCommand]() ![Inheritance diagram of lief._lief.MachO.DyldExportsTrie, lief._lief.MachO.FilesetCommand, lief._lief.MachO.FunctionStarts, lief._lief.MachO.UUIDCommand, lief._lief.MachO.SourceVersion, lief._lief.MachO.TwoLevelHints, lief._lief.MachO.DylinkerCommand, lief._lief.MachO.SegmentCommand, lief._lief.MachO.BuildVersion, lief._lief.MachO.EncryptionInfo, lief._lief.MachO.SubClient, lief._lief.MachO.SegmentSplitInfo, lief._lief.MachO.DyldEnvironment, lief._lief.MachO.DataInCode, lief._lief.MachO.LoadCommand, lief._lief.MachO.LinkerOptHint, lief._lief.MachO.SubFramework, lief._lief.MachO.VersionMin, lief._lief.MachO.ThreadCommand, lief._lief.MachO.CodeSignature, lief._lief.MachO.LazyLoadDylibInfo, lief._lief.MachO.DylibCommand, lief._lief.MachO.DyldChainedFixups, lief._lief.MachO.DyldInfo, lief._lief.MachO.FunctionVariants, lief._lief.MachO.DynamicSymbolCommand, lief._lief.MachO.Routine, lief._lief.MachO.AtomInfo, lief._lief.MachO.RPathCommand, lief._lief.MachO.MainCommand, lief._lief.MachO.UnknownCommand, lief._lief.MachO.SymbolCommand, lief._lief.MachO.CodeSignatureDir, lief._lief.MachO.FunctionVariantFixups, lief._lief.MachO.NoteCommand, lief._lief.MachO.LinkEdit](https://lief.re/doc/latest/_images/inheritance-1da9715b9216f55122ae66931dab26d4cf5747cb.png) ### [` lief.MachO.LoadCommand `]() class lief.MachO.LoadCommand(*self*) Bases: `Object` Base class for the Mach-O load commands #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` ##### [` ATOM_INFO `]() ATOM\_INFO = 54 ##### [` BUILD_VERSION `]() BUILD\_VERSION = 50 ##### [` CODE_SIGNATURE `]() CODE\_SIGNATURE = 29 ##### [` DATA_IN_CODE `]() DATA\_IN\_CODE = 41 ##### [` DYLD_CHAINED_FIXUPS `]() DYLD\_CHAINED\_FIXUPS = 2147483700 ##### [` DYLD_ENVIRONMENT `]() DYLD\_ENVIRONMENT = 39 ##### [` DYLD_EXPORTS_TRIE `]() DYLD\_EXPORTS\_TRIE = 2147483699 ##### [` DYLD_INFO `]() DYLD\_INFO = 34 ##### [` DYLD_INFO_ONLY `]() DYLD\_INFO\_ONLY = 2147483682 ##### [` DYLIB_CODE_SIGN_DRS `]() DYLIB\_CODE\_SIGN\_DRS = 43 ##### [` DYSYMTAB `]() DYSYMTAB = 11 ##### [` ENCRYPTION_INFO `]() ENCRYPTION\_INFO = 33 ##### [` ENCRYPTION_INFO_64 `]() ENCRYPTION\_INFO\_64 = 44 ##### [` FILESET_ENTRY `]() FILESET\_ENTRY = 2147483701 ##### [` FUNCTION_STARTS `]() FUNCTION\_STARTS = 38 ##### [` FUNCTION_VARIANTS `]() FUNCTION\_VARIANTS = 55 ##### [` FUNCTION_VARIANT_FIXUPS `]() FUNCTION\_VARIANT\_FIXUPS = 56 ##### [` FVMFILE `]() FVMFILE = 9 ##### [` IDENT `]() IDENT = 8 ##### [` IDFVMLIB `]() IDFVMLIB = 7 ##### [` ID_DYLIB `]() ID\_DYLIB = 13 ##### [` ID_DYLINKER `]() ID\_DYLINKER = 15 ##### [` LAZY_LOAD_DYLIB `]() LAZY\_LOAD\_DYLIB = 32 ##### [` LAZY_LOAD_DYLIB_INFO `]() LAZY\_LOAD\_DYLIB\_INFO = 58 ##### [` LIEF_UNKNOWN `]() LIEF\_UNKNOWN = 4293787649 ##### [` LINKER_OPTIMIZATION_HINT `]() LINKER\_OPTIMIZATION\_HINT = 46 ##### [` LINKER_OPTION `]() LINKER\_OPTION = 45 ##### [` LOADFVMLIB `]() LOADFVMLIB = 6 ##### [` LOAD_DYLIB `]() LOAD\_DYLIB = 12 ##### [` LOAD_DYLINKER `]() LOAD\_DYLINKER = 14 ##### [` LOAD_UPWARD_DYLIB `]() LOAD\_UPWARD\_DYLIB = 2147483683 ##### [` LOAD_WEAK_DYLIB `]() LOAD\_WEAK\_DYLIB = 2147483672 ##### [` MAIN `]() MAIN = 2147483688 ##### [` NOTE `]() NOTE = 49 ##### [` PREBIND_CKSUM `]() PREBIND\_CKSUM = 23 ##### [` PREBOUND_DYLIB `]() PREBOUND\_DYLIB = 16 ##### [` PREPAGE `]() PREPAGE = 10 ##### [` REEXPORT_DYLIB `]() REEXPORT\_DYLIB = 2147483679 ##### [` ROUTINES `]() ROUTINES = 17 ##### [` ROUTINES_64 `]() ROUTINES\_64 = 26 ##### [` RPATH `]() RPATH = 2147483676 ##### [` SEGMENT `]() SEGMENT = 1 ##### [` SEGMENT_64 `]() SEGMENT\_64 = 25 ##### [` SEGMENT_SPLIT_INFO `]() SEGMENT\_SPLIT\_INFO = 30 ##### [` SOURCE_VERSION `]() SOURCE\_VERSION = 42 ##### [` SUB_CLIENT `]() SUB\_CLIENT = 20 ##### [` SUB_FRAMEWORK `]() SUB\_FRAMEWORK = 18 ##### [` SUB_LIBRARY `]() SUB\_LIBRARY = 21 ##### [` SUB_UMBRELLA `]() SUB\_UMBRELLA = 19 ##### [` SYMSEG `]() SYMSEG = 3 ##### [` SYMTAB `]() SYMTAB = 2 ##### [` TARGET_TRIPLE `]() TARGET\_TRIPLE = 57 ##### [` THREAD `]() THREAD = 4 ##### [` TWOLEVEL_HINTS `]() TWOLEVEL\_HINTS = 22 ##### [` UNIXTHREAD `]() UNIXTHREAD = 5 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` UUID `]() UUID = 27 ##### [` VERSION_MIN_IPHONEOS `]() VERSION\_MIN\_IPHONEOS = 37 ##### [` VERSION_MIN_MACOSX `]() VERSION\_MIN\_MACOSX = 36 ##### [` VERSION_MIN_TVOS `]() VERSION\_MIN\_TVOS = 47 ##### [` VERSION_MIN_WATCHOS `]() VERSION\_MIN\_WATCHOS = 48 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.LoadCommand.TYPE]( "lief.MachO.LoadCommand.TYPE") = <nanobind.nb\_func object> #### [` command `]() property command → [lief.MachO.LoadCommand.TYPE]( "lief.MachO.LoadCommand.TYPE") Command type #### [` command_offset `]() property command\_offset → int Offset of the command within the *Load Command Table* #### [` data `]() property data → memoryview Command’s data #### [` size `]() property size → int Size of the command (should be greater than `sizeof(load_command)`) --- ## [DylibCommand]() ![Inheritance diagram of lief._lief.MachO.DylibCommand](https://lief.re/doc/latest/_images/inheritance-36c46371e2d72022cd92817ae70e7bd46d3c4b3e.png) ### [` lief.MachO.DylibCommand `]() class lief.MachO.DylibCommand Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class which represents a library dependency #### [` compatibility_version `]() property compatibility\_version → list[int] Library’s compatibility version #### [` current_version `]() property current\_version → list[int] Library’s current version #### [` id_dylib `]() id\_dylib(*name: str*, *timestamp: int*, *current\_version: int*, *compat\_version: int*) → [lief.MachO.DylibCommand]( "lief.MachO.DylibCommand") = <nanobind.nb\_func object> #### [` lazy_load_dylib `]() lazy\_load\_dylib(*name: str*, *timestamp: int*, *current\_version: int*, *compat\_version: int*) → [lief.MachO.DylibCommand]( "lief.MachO.DylibCommand") = <nanobind.nb\_func object> #### [` load_dylib `]() load\_dylib(*name: str*, *timestamp: int*, *current\_version: int*, *compat\_version: int*) → [lief.MachO.DylibCommand]( "lief.MachO.DylibCommand") = <nanobind.nb\_func object> #### [` load_upward_dylib `]() load\_upward\_dylib(*name: str*, *timestamp: int*, *current\_version: int*, *compat\_version: int*) → [lief.MachO.DylibCommand]( "lief.MachO.DylibCommand") = <nanobind.nb\_func object> #### [` name `]() property name → str Library’s name #### [` name_offset `]() property name\_offset → int Original string offset of the name #### [` reexport_dylib `]() reexport\_dylib(*name: str*, *timestamp: int*, *current\_version: int*, *compat\_version: int*) → [lief.MachO.DylibCommand]( "lief.MachO.DylibCommand") = <nanobind.nb\_func object> #### [` timestamp `]() property timestamp → int Library’s timestamp #### [` weak_lib `]() weak\_lib(*name: str*, *timestamp: int*, *current\_version: int*, *compat\_version: int*) → [lief.MachO.DylibCommand]( "lief.MachO.DylibCommand") = <nanobind.nb\_func object> --- ## [DylinkerCommand]() ![Inheritance diagram of lief._lief.MachO.DylinkerCommand](https://lief.re/doc/latest/_images/inheritance-fed860fdbbc5ae77feb0bae4801e9aae9b22ec8b.png) ### [` lief.MachO.DylinkerCommand `]() class lief.MachO.DylinkerCommand(*self*, *arg: str*, */*) Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class that represents the Mach-O linker, also named loader Most of the time, [`name`]( "lief.MachO.DylinkerCommand.name") returns `/usr/lib/dyld` #### [` name `]() property name → str Path to the loader/linker --- ## [UUIDCommand]() ![Inheritance diagram of lief._lief.MachO.UUIDCommand](https://lief.re/doc/latest/_images/inheritance-6dd221b9b4b0898786814fd1a4367ebd8b64a8f9.png) ### [` lief.MachO.UUIDCommand `]() class lief.MachO.UUIDCommand Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class that represents the UUID command #### [` uuid `]() property uuid → list[int] UUID as a list --- ## [MainCommand]() ![Inheritance diagram of lief._lief.MachO.MainCommand](https://lief.re/doc/latest/_images/inheritance-fc6235ab5a77d68721e604881ea66637ba44ce2b.png) ### [` lief.MachO.MainCommand `]() class lief.MachO.MainCommand(*self*, *arg0: int*, *arg1: int*, */*) Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class that represents the LC\_MAIN command. This kind of command can be used to determine the entrypoint of an executable #### [` entrypoint `]() property entrypoint → int Offset of the *main* function relative to the `__TEXT` segment #### [` stack_size `]() property stack\_size → int The initial stack size (if not 0) --- ## [NoteCommand]() ![Inheritance diagram of lief._lief.MachO.NoteCommand](https://lief.re/doc/latest/_images/inheritance-91d1d4358c63695f15f42bc33b72e9bfbf14752b.png) ### [` lief.MachO.NoteCommand `]() class lief.MachO.NoteCommand Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class that represent the `LC_NOTE` command. This command is used to include arbitrary notes or metadata within a binary. #### [` note_offset `]() property note\_offset → int Offset of the data associated with this note #### [` note_size `]() property note\_size → int Size of the data referenced by the [`note_offset`]( "lief.MachO.NoteCommand.note_offset") #### [` owner `]() property owner → memoryview Owner of the note (e.g. `AIR_METALLIB`) #### [` owner_str `]() property owner\_str → str Owner as a zero-terminated string --- ## [Symbol]() ![Inheritance diagram of lief._lief.MachO.Symbol](https://lief.re/doc/latest/_images/inheritance-fdf6e58ad2f02c53643d7fc079038f37e40671b2.png) ### [` lief.MachO.Symbol `]() class lief.MachO.Symbol(*self*) Bases: [`Symbol`]( "lief._lief.Symbol") Class that represents a Symbol in a Mach-O file. A Mach-O symbol can come from: 1. The symbols command (LC\_SYMTAB / SymbolCommand) 2. The Dyld Export trie 3. The Dyld Symbol bindings #### [` CATEGORY `]() class CATEGORY(*\*values*) Bases: `Enum` ##### [` EXTERNAL `]() EXTERNAL = 2 ##### [` INDIRECT_ABS `]() INDIRECT\_ABS = 4 ##### [` INDIRECT_ABS_LOCAL `]() INDIRECT\_ABS\_LOCAL = 6 ##### [` INDIRECT_LOCAL `]() INDIRECT\_LOCAL = 5 ##### [` LOCAL `]() LOCAL = 1 ##### [` NONE `]() NONE = 0 ##### [` UNDEFINED `]() UNDEFINED = 3 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.Symbol.CATEGORY]( "lief.MachO.Symbol.CATEGORY") = <nanobind.nb\_func object> #### [` ORIGIN `]() class ORIGIN(*\*values*) Bases: `Enum` ##### [` DYLD_BIND `]() DYLD\_BIND = 2 ##### [` DYLD_EXPORT `]() DYLD\_EXPORT = 1 ##### [` SYMTAB `]() SYMTAB = 3 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.Symbol.ORIGIN]( "lief.MachO.Symbol.ORIGIN") = <nanobind.nb\_func object> #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` ##### [` ABSOLUTE_SYM `]() ABSOLUTE\_SYM = 2 ##### [` INDIRECT `]() INDIRECT = 10 ##### [` PREBOUND `]() PREBOUND = 12 ##### [` SECTION `]() SECTION = 14 ##### [` UNDEFINED `]() UNDEFINED = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.Symbol.TYPE]( "lief.MachO.Symbol.TYPE") = <nanobind.nb\_func object> #### [` binding_info `]() property binding\_info → [lief.MachO.BindingInfo]( "lief.MachO.BindingInfo") | None [`BindingInfo`]( "lief.MachO.BindingInfo") associated with the symbol if any, or None #### [` category `]() property category → [lief.MachO.Symbol.CATEGORY]( "lief.MachO.Symbol.CATEGORY") Category of the symbol according to the LC\_DYSYMTAB command #### [` demangled_name `]() property demangled\_name → str Symbol’s unmangled name #### [` description `]() property description → int Return information about the symbol #### [` export_info `]() property export\_info → [lief.MachO.ExportInfo]( "lief.MachO.ExportInfo") | None [`ExportInfo`]( "lief.MachO.ExportInfo") associated with the symbol if any, or None #### [` has_binding_info `]() property has\_binding\_info → bool `True` if the symbol has an [`BindingInfo`]( "lief.MachO.BindingInfo") associated with #### [` has_export_info `]() property has\_export\_info → bool `True` if the symbol has an [`ExportInfo`]( "lief.MachO.ExportInfo") associated with #### [` is_external `]() property is\_external → bool True if the symbol is defined as an external symbol. #### [` library `]() property library → [lief.MachO.DylibCommand]( "lief.MachO.DylibCommand") | None [`DylibCommand`]( "lief.MachO.DylibCommand") the library where the symbol is exposed #### [` library_ordinal `]() property library\_ordinal → int Library ordinal + 1 (0 means self) #### [` numberof_sections `]() property numberof\_sections → int It returns the number of sections in which this symbol can be found. If the symbol can’t be found in any section, it returns 0 (NO\_SECT) #### [` origin `]() property origin → [lief.MachO.Symbol.ORIGIN]( "lief.MachO.Symbol.ORIGIN") Return the [`ORIGIN`]( "lief.MachO.Symbol.ORIGIN") of this symbol #### [` raw_type `]() property raw\_type → int Raw value of `nlist_xx.n_type` #### [` type `]() property type → [lief.MachO.Symbol.TYPE]( "lief.MachO.Symbol.TYPE") Type as defined by `nlist_xx.n_type & N_TYPE` --- ## [Symbol Command]() ![Inheritance diagram of lief._lief.MachO.DylinkerCommand](https://lief.re/doc/latest/_images/inheritance-fed860fdbbc5ae77feb0bae4801e9aae9b22ec8b.png) ### [` lief.MachO.SymbolCommand `]() class lief.MachO.SymbolCommand(*self*) Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class that represents the LC\_SYMTAB command #### [` numberof_symbols `]() property numberof\_symbols → int Number of symbols registered #### [` strings_offset `]() property strings\_offset → int Offset from the start of the file to the string table #### [` strings_size `]() property strings\_size → int Size of the string table #### [` symbol_offset `]() property symbol\_offset → int Offset from the start of the file to the n\_list associated with the command --- ## [Dynamic Symbol Command]() ![Inheritance diagram of lief._lief.MachO.DynamicSymbolCommand](https://lief.re/doc/latest/_images/inheritance-f19a648feacaafadfa1d909de9c01689d198022a.png) ### [` lief.MachO.DynamicSymbolCommand `]() class lief.MachO.DynamicSymbolCommand Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class that represents the LC\_DYSYMTAB command. This command completes the LC\_SYMTAB (SymbolCommand) to provide a better granularity over the symbols layout. #### [` external_reference_symbol_offset `]() property external\_reference\_symbol\_offset → int Byte offset from the start of the file to the external reference table data. This field seems unused by recent Mach-O loader and should be set to 0 #### [` external_relocation_offset `]() property external\_relocation\_offset → int Byte offset from the start of the file to the module table data. This field seems unused by recent Mach-O loader and should be set to 0 #### [` idx_external_define_symbol `]() property idx\_external\_define\_symbol → int Index of the first symbol in the group of defined external symbols. #### [` idx_local_symbol `]() property idx\_local\_symbol → int Index of the first symbol in the group of local symbols. #### [` idx_undefined_symbol `]() property idx\_undefined\_symbol → int Index of the first symbol in the group of undefined external symbols. #### [` indirect_symbol_offset `]() property indirect\_symbol\_offset → int Byte offset from the start of the file to the indirect symbol table data. Indirect symbol table is used by the loader to speed-up symbol resolution during the *lazy binding* process References: > - `dyld-519.2.1/src/ImageLoaderMachOCompressed.cpp` > - `dyld-519.2.1/src/ImageLoaderMachOClassic.cpp` #### [` indirect_symbols `]() property indirect\_symbols → lief.MachO.DynamicSymbolCommand.it\_indirect\_symbols Iterator over the indirect symbols indexed by this command #### [` local_relocation_offset `]() property local\_relocation\_offset → int Byte offset from the start of the file to the local relocation table data. This field seems unused by recent Mach-O loader and should be set to 0 #### [` module_table_offset `]() property module\_table\_offset → int Byte offset from the start of the file to the module table data. This field seems unused by recent Mach-O loader and should be set to 0 #### [` nb_external_define_symbols `]() property nb\_external\_define\_symbols → int Number of symbols in the group of defined external symbols. #### [` nb_external_reference_symbols `]() property nb\_external\_reference\_symbols → int Number of entries in the external reference table. This field seems unused by recent Mach-O loader and should be set to 0. #### [` nb_external_relocations `]() property nb\_external\_relocations → int Number of entries in the external relocation table. This field seems unused by recent Mach-O loader and should be set to 0 #### [` nb_indirect_symbols `]() property nb\_indirect\_symbols → int Number of entries in the indirect symbol table. #### [` nb_local_relocations `]() property nb\_local\_relocations → int Number of entries in the local relocation table. This field seems unused by recent Mach-O loader and should be set to 0 #### [` nb_local_symbols `]() property nb\_local\_symbols → int Number of symbols in the group of local symbols. #### [` nb_module_table `]() property nb\_module\_table → int Number of entries in the module table. This field seems unused by recent Mach-O loader and should be set to 0. #### [` nb_toc `]() property nb\_toc → int Number of entries in the table of contents Should be set to 0 on recent Mach-O #### [` nb_undefined_symbols `]() property nb\_undefined\_symbols → int Number of symbols in the group of undefined external symbols. #### [` toc_offset `]() property toc\_offset → int Byte offset from the start of the file to the table of contents data. Table of content is used by legacy Mach-O loader and this field should be set to 0 --- ## [Dyld Info]() ![Inheritance diagram of lief._lief.MachO.DyldInfo](https://lief.re/doc/latest/_images/inheritance-da796279986c7456e09ff8cf6b20be02f2261ec8.png) ### [` lief.MachO.DyldInfo `]() class lief.MachO.DyldInfo Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class that represents the LC\_DYLD\_INFO and LC\_DYLD\_INFO\_ONLY commands #### [` BIND_OPCODES `]() class BIND\_OPCODES(*\*values*) Bases: `Enum` ##### [` ADD_ADDR_ULEB `]() ADD\_ADDR\_ULEB = 128 ##### [` DONE `]() DONE = 0 ##### [` DO_BIND `]() DO\_BIND = 144 ##### [` DO_BIND_ADD_ADDR_IMM_SCALED `]() DO\_BIND\_ADD\_ADDR\_IMM\_SCALED = 176 ##### [` DO_BIND_ADD_ADDR_ULEB `]() DO\_BIND\_ADD\_ADDR\_ULEB = 160 ##### [` DO_BIND_ULEB_TIMES_SKIPPING_ULEB `]() DO\_BIND\_ULEB\_TIMES\_SKIPPING\_ULEB = 192 ##### [` SET_ADDEND_SLEB `]() SET\_ADDEND\_SLEB = 96 ##### [` SET_DYLIB_ORDINAL_IMM `]() SET\_DYLIB\_ORDINAL\_IMM = 16 ##### [` SET_DYLIB_ORDINAL_ULEB `]() SET\_DYLIB\_ORDINAL\_ULEB = 32 ##### [` SET_DYLIB_SPECIAL_IMM `]() SET\_DYLIB\_SPECIAL\_IMM = 48 ##### [` SET_SEGMENT_AND_OFFSET_ULEB `]() SET\_SEGMENT\_AND\_OFFSET\_ULEB = 112 ##### [` SET_SYMBOL_TRAILING_FLAGS_IMM `]() SET\_SYMBOL\_TRAILING\_FLAGS\_IMM = 64 ##### [` SET_TYPE_IMM `]() SET\_TYPE\_IMM = 80 ##### [` THREADED `]() THREADED = 208 ##### [` THREADED_APPLY `]() THREADED\_APPLY = 209 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.DyldInfo.BIND\_OPCODES]( "lief.MachO.DyldInfo.BIND_OPCODES") = <nanobind.nb\_func object> #### [` REBASE_OPCODES `]() class REBASE\_OPCODES(*\*values*) Bases: `Enum` ##### [` ADD_ADDR_IMM_SCALED `]() ADD\_ADDR\_IMM\_SCALED = 64 ##### [` ADD_ADDR_ULEB `]() ADD\_ADDR\_ULEB = 48 ##### [` DONE `]() DONE = 0 ##### [` DO_REBASE_ADD_ADDR_ULEB `]() DO\_REBASE\_ADD\_ADDR\_ULEB = 112 ##### [` DO_REBASE_IMM_TIMES `]() DO\_REBASE\_IMM\_TIMES = 80 ##### [` DO_REBASE_ULEB_TIMES `]() DO\_REBASE\_ULEB\_TIMES = 96 ##### [` DO_REBASE_ULEB_TIMES_SKIPPING_ULEB `]() DO\_REBASE\_ULEB\_TIMES\_SKIPPING\_ULEB = 128 ##### [` SET_SEGMENT_AND_OFFSET_ULEB `]() SET\_SEGMENT\_AND\_OFFSET\_ULEB = 32 ##### [` SET_TYPE_IMM `]() SET\_TYPE\_IMM = 16 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.DyldInfo.REBASE\_OPCODES]( "lief.MachO.DyldInfo.REBASE_OPCODES") = <nanobind.nb\_func object> #### [` REBASE_TYPE `]() class REBASE\_TYPE(*\*values*) Bases: `Enum` ##### [` POINTER `]() POINTER = 1 ##### [` TEXT_ABSOLUTE32 `]() TEXT\_ABSOLUTE32 = 2 ##### [` TEXT_PCREL32 `]() TEXT\_PCREL32 = 3 ##### [` THREADED `]() THREADED = 102 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.DyldInfo.REBASE\_TYPE]( "lief.MachO.DyldInfo.REBASE_TYPE") = <nanobind.nb\_func object> #### [` bind `]() property bind → tuple[int, int] *Bind* information as a tuple `(offset, size)` Dyld binds an image during the loading process, if the image requires any pointers to be initialized to symbols in other images. The rebase information is a stream of byte sized opcodes for which symbolic names start with `BIND_OPCODE_`. Conceptually the bind information is a table of tuples: `(seg-index, seg-offset, type, symbol-library-ordinal, symbol-name, addend)` The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like for runs of pointers initialized to the same value can be encoded in a few bytes. > **See also** > > `/usr/include/mach-o/loader.h` #### [` bind_opcodes `]() property bind\_opcodes → memoryview Return the binding’s opcodes as `list` of bytes #### [` bindings `]() property bindings → lief.MachO.DyldInfo.it\_binding\_info Return an iterator over Dyld’s [`BindingInfo`]( "lief.MachO.BindingInfo") #### [` export_info `]() property export\_info → tuple[int, int] *Export* information as a tuple `(offset, size)` The symbols exported by a dylib are encoded in a trie. This is a compact representation that factors out common prefixes. It also reduces `LINKEDIT` pages in RAM because it encodes all information (name, address, flags) in one small, contiguous range. The export area is a stream of nodes. The first node sequentially is the start node for the trie. Nodes for a symbol start with a byte that is the length of the exported symbol information for the string so far. If there is no exported symbol, the byte is zero. If there is exported info, it follows the length byte. The exported info normally consists of a flags and offset both encoded in [uleb128](). The offset is location of the content named by the symbol. It is the offset from the mach\_header for the image. After the initial byte and optional exported symbol information is a byte of how many edges (0-255) that this node has leaving it, followed by each edge. Each edge is a zero terminated cstring of the addition chars in the symbol, followed by a uleb128 offset for the node that edge points to. > **See also** > > `/usr/include/mach-o/loader.h` #### [` export_trie `]() property export\_trie → memoryview Return Export’s trie as `list` of bytes #### [` exports `]() property exports → lief.MachO.DyldExportsTrie.it\_export\_info Return an iterator over Dyld’s [`ExportInfo`]( "lief.MachO.ExportInfo") #### [` lazy_bind `]() property lazy\_bind → tuple[int, int] *Lazy Bind* information as a tuple `(offset, size)` Some uses of external symbols do not need to be bound immediately. Instead they can be lazily bound on first use. The lazy\_bind contains a stream of BIND opcodes to bind all lazy symbols. Normal use is that dyld ignores the lazy\_bind section when loading an image. Instead the static linker arranged for the lazy pointer to initially point to a helper function which pushes the offset into the lazy\_bind area for the symbol needing to be bound, then jumps to dyld which simply adds the offset to lazy\_bind\_off to get the information on what to bind. > **See also** > > `/usr/include/mach-o/loader.h` #### [` lazy_bind_opcodes `]() property lazy\_bind\_opcodes → memoryview Return **lazy** binding’s opcodes as `list` of bytes #### [` rebase `]() property rebase → tuple[int, int] *Rebase* information as a tuple `(offset, size)` Dyld rebases an image whenever dyld loads it at an address different from its preferred address. The rebase information is a stream of byte sized opcodes for which symbolic names start with `REBASE_OPCODE_`. Conceptually the rebase information is a table of tuples: `(seg-index, seg-offset, type)` The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like “every n’th offset for m times” can be encoded in a few bytes > **See also** > > `/usr/include/mach-o/loader.h` #### [` rebase_opcodes `]() property rebase\_opcodes → memoryview Return the rebase’s opcodes as `list` of bytes #### [` set_bind_offset `]() set\_bind\_offset(*self*, *offset: int*) → None #### [` set_bind_size `]() set\_bind\_size(*self*, *size: int*) → None #### [` set_export_offset `]() set\_export\_offset(*self*, *offset: int*) → None #### [` set_export_size `]() set\_export\_size(*self*, *size: int*) → None #### [` set_lazy_bind_offset `]() set\_lazy\_bind\_offset(*self*, *offset: int*) → None #### [` set_lazy_bind_size `]() set\_lazy\_bind\_size(*self*, *size: int*) → None #### [` set_rebase_offset `]() set\_rebase\_offset(*self*, *offset: int*) → None #### [` set_rebase_size `]() set\_rebase\_size(*self*, *size: int*) → None #### [` set_weak_bind_offset `]() set\_weak\_bind\_offset(*self*, *offset: int*) → None #### [` set_weak_bind_size `]() set\_weak\_bind\_size(*self*, *size: int*) → None #### [` show_bind_opcodes `]() property show\_bind\_opcodes → str Return the bind opcodes in a human-readable way #### [` show_export_trie `]() property show\_export\_trie → str Return the export trie in a human-readable way #### [` show_lazy_bind_opcodes `]() property show\_lazy\_bind\_opcodes → str Return the lazy bind opcodes in a human-readable way #### [` show_rebases_opcodes `]() property show\_rebases\_opcodes → str Return the rebase opcodes in a human-readable way #### [` show_weak_bind_opcodes `]() property show\_weak\_bind\_opcodes → str Return the weak bind opcodes in a human-readable way #### [` weak_bind `]() property weak\_bind → tuple[int, int] *Weak Bind* information as a tuple `(offset, size)` Some C++ programs require dyld to unique symbols so that all images in the process use the same copy of some code/data. This step is done after binding. The content of the weak\_bind info is an opcode stream like the bind\_info. But it is sorted alphabetically by symbol name. This enables dyld to walk all images with weak binding information in order and look for collisions. If there are no collisions, dyld does no updating. That means that some fixups are also encoded in the bind\_info. For instance, all calls to `operator new` are first bound to `libstdc++.dylib` using the information in bind\_info. Then if some image overrides operator new that is detected when the weak\_bind information is processed and the call to operator new is then rebound. > **See also** > > `/usr/include/mach-o/loader.h` #### [` weak_bind_opcodes `]() property weak\_bind\_opcodes → memoryview Return **Weak** binding’s opcodes as `list` of bytes --- ## [Function starts]() ![Inheritance diagram of lief._lief.MachO.FunctionStarts](https://lief.re/doc/latest/_images/inheritance-870d037035f54f1aadc038c78426529f20a4ccde.png) ### [` lief.MachO.FunctionStarts `]() class lief.MachO.FunctionStarts Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class which represents the LC\_FUNCTION\_STARTS command This command is an array of ULEB128 encoded values #### [` add_function `]() add\_function(*self*, *address: int*) → None Add a new function #### [` content `]() property content → memoryview The original content as a bytes stream #### [` data_offset `]() property data\_offset → int Offset in the binary where *start functions* are located #### [` data_size `]() property data\_size → int Size of the functions list in the binary #### [` functions `]() property functions → list[int] Addresses of every function entry point in the executable This allows functions to exist for which there are no entries in the symbol table. > **Warning** > > The address is relative to the `__TEXT` segment --- ## [Function Variants]() ![Inheritance diagram of lief._lief.MachO.FunctionVariants](https://lief.re/doc/latest/_images/inheritance-790d0a10f8fdeca018d6c075c6735779cff30c1b.png) ### [` lief.MachO.FunctionVariants `]() class lief.MachO.FunctionVariants Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class representing the `LC_FUNCTION_VARIANTS` load command. Introduced publicly in `dyld-1284.13` (April 2025), this command supports **function multiversioning**, the ability to associate multiple implementations of the same function, each optimized for a specific platform, architecture, or runtime context. At runtime, the system dispatches the most appropriate variant based on hardware capabilities or execution environment. For example: ```cpp FUNCTION_VARIANT_TABLE(my_function, { (void*)my_function$Rosetta, "rosetta" }, // Rosetta translation { (void*)my_function$Haswell, "haswell" }, // Haswell-optimized { (void*)my_function$Base, "default" } // Default fallback ); ``` #### [` RuntimeTable `]() class RuntimeTable Bases: `object` Represents a runtime table of function variants sharing a common namespace (referred to internally as `FunctionVariantsRuntimeTable` in `dyld`). Each table holds multiple [`RuntimeTableEntry`]( "lief.MachO.FunctionVariants.RuntimeTableEntry") instances that map to function implementations optimized for a given [`KIND`]( "lief.MachO.FunctionVariants.RuntimeTable.KIND"). ##### [` KIND `]() class KIND(*\*values*) Bases: `Enum` Enumeration describing the namespace or category of a function variant. Each [`RuntimeTable`]( "lief.MachO.FunctionVariants.RuntimeTable") is associated with one [`KIND`]( "lief.MachO.FunctionVariants.RuntimeTable.KIND"), which indicates the domain or context under which its variant entries should be considered valid or applicable. These categories map to the runtime dispatch logic used by `dyld` when selecting the optimal function variant. ###### [` ARM64 `]() ARM64 = 3 ###### [` PER_PROCESS `]() PER\_PROCESS = 1 ###### [` SYSTEM_WIDE `]() SYSTEM\_WIDE = 2 ###### [` UNKNOWN `]() UNKNOWN = 0 ###### [` X86_64 `]() X86\_64 = 4 ##### [` entries `]() property entries → lief.MachO.FunctionVariants.RuntimeTable.it\_entries Iterator over the different [`RuntimeTableEntry`]( "lief.MachO.FunctionVariants.RuntimeTableEntry") entries ##### [` kind `]() property kind → [lief.MachO.FunctionVariants.RuntimeTable.KIND]( "lief.MachO.FunctionVariants.RuntimeTable.KIND") Kind of the runtime table ##### [` offset `]() property offset → int Original offset in the payload #### [` RuntimeTableEntry `]() class RuntimeTableEntry Bases: `object` This class exposes information about a given implementation. ##### [` FLAGS `]() class FLAGS(*\*values*) Bases: `Enum` ###### [` ARM64_ADVSIMD `]() ARM64\_ADVSIMD = 3145782 ###### [` ARM64_ADVSIMDHPFP `]() ARM64\_ADVSIMDHPFP = 3145783 ###### [` ARM64_AES `]() ARM64\_AES = 3145739 ###### [` ARM64_AFP `]() ARM64\_AFP = 3145758 ###### [` ARM64_BF16 `]() ARM64\_BF16 = 3145753 ###### [` ARM64_BTI `]() ARM64\_BTI = 3145765 ###### [` ARM64_CRC32 `]() ARM64\_CRC32 = 3145784 ###### [` ARM64_CSV2 `]() ARM64\_CSV2 = 3145760 ###### [` ARM64_CVS3 `]() ARM64\_CVS3 = 3145761 ###### [` ARM64_DEFAULT `]() ARM64\_DEFAULT = 3145728 ###### [` ARM64_DIT `]() ARM64\_DIT = 3145762 ###### [` ARM64_DOTPROD `]() ARM64\_DOTPROD = 3145732 ###### [` ARM64_DPB `]() ARM64\_DPB = 3145751 ###### [` ARM64_DPB2 `]() ARM64\_DPB2 = 3145752 ###### [` ARM64_ECV `]() ARM64\_ECV = 3145757 ###### [` ARM64_FCMA `]() ARM64\_FCMA = 3145746 ###### [` ARM64_FHM `]() ARM64\_FHM = 3145731 ###### [` ARM64_FLAGM `]() ARM64\_FLAGM = 3145729 ###### [` ARM64_FLAGM2 `]() ARM64\_FLAGM2 = 3145730 ###### [` ARM64_FP16 `]() ARM64\_FP16 = 3145763 ###### [` ARM64_FPAC `]() ARM64\_FPAC = 3145750 ###### [` ARM64_FRINTTS `]() ARM64\_FRINTTS = 3145743 ###### [` ARM64_I8MM `]() ARM64\_I8MM = 3145754 ###### [` ARM64_JSCVT `]() ARM64\_JSCVT = 3145747 ###### [` ARM64_LRCPC `]() ARM64\_LRCPC = 3145744 ###### [` ARM64_LRCPC2 `]() ARM64\_LRCPC2 = 3145745 ###### [` ARM64_LSE `]() ARM64\_LSE = 3145735 ###### [` ARM64_LSE2 `]() ARM64\_LSE2 = 3145759 ###### [` ARM64_PAUTH `]() ARM64\_PAUTH = 3145748 ###### [` ARM64_PAUTH2 `]() ARM64\_PAUTH2 = 3145749 ###### [` ARM64_PMULL `]() ARM64\_PMULL = 3145740 ###### [` ARM64_RDM `]() ARM64\_RDM = 3145734 ###### [` ARM64_RPRES `]() ARM64\_RPRES = 3145756 ###### [` ARM64_SB `]() ARM64\_SB = 3145742 ###### [` ARM64_SHA1 `]() ARM64\_SHA1 = 3145738 ###### [` ARM64_SHA256 `]() ARM64\_SHA256 = 3145736 ###### [` ARM64_SHA3 `]() ARM64\_SHA3 = 3145733 ###### [` ARM64_SHA512 `]() ARM64\_SHA512 = 3145737 ###### [` ARM64_SME `]() ARM64\_SME = 3145772 ###### [` ARM64_SME2 `]() ARM64\_SME2 = 3145773 ###### [` ARM64_SMEB16F32 `]() ARM64\_SMEB16F32 = 3145778 ###### [` ARM64_SMEBI32I32 `]() ARM64\_SMEBI32I32 = 3145777 ###### [` ARM64_SMEF16F32 `]() ARM64\_SMEF16F32 = 3145779 ###### [` ARM64_SMEF32F32 `]() ARM64\_SMEF32F32 = 3145776 ###### [` ARM64_SMEF64F64 `]() ARM64\_SMEF64F64 = 3145774 ###### [` ARM64_SMEI16I32 `]() ARM64\_SMEI16I32 = 3145781 ###### [` ARM64_SMEI16I64 `]() ARM64\_SMEI16I64 = 3145775 ###### [` ARM64_SMEI8I32 `]() ARM64\_SMEI8I32 = 3145780 ###### [` ARM64_SPECRES `]() ARM64\_SPECRES = 3145741 ###### [` ARM64_SSBS `]() ARM64\_SSBS = 3145764 ###### [` ARM64_WFXT `]() ARM64\_WFXT = 3145755 ###### [` PER_PROCESS_DEFAULT `]() PER\_PROCESS\_DEFAULT = 1048576 ###### [` PER_PROCESS_MTE_ENABLED `]() PER\_PROCESS\_MTE\_ENABLED = 1048578 ###### [` PER_PROCESS_NO_OVERREAD `]() PER\_PROCESS\_NO\_OVERREAD = 1048579 ###### [` PER_PROCESS_TRANSLATED `]() PER\_PROCESS\_TRANSLATED = 1048577 ###### [` SYSTEM_WIDE_CUSTOMER_INSTALL `]() SYSTEM\_WIDE\_CUSTOMER\_INSTALL = 2097154 ###### [` SYSTEM_WIDE_DEFAULT `]() SYSTEM\_WIDE\_DEFAULT = 2097152 ###### [` SYSTEM_WIDE_INTERNAL_INSTALL `]() SYSTEM\_WIDE\_INTERNAL\_INSTALL = 2097153 ###### [` SYSTEM_WIDE_LOCKDOWN `]() SYSTEM\_WIDE\_LOCKDOWN = 2097155 ###### [` UNKNOWN `]() UNKNOWN = 0 ###### [` X86_64_AVX `]() X86\_64\_AVX = 4194307 ###### [` X86_64_AVX2 `]() X86\_64\_AVX2 = 4194308 ###### [` X86_64_AVX512BW `]() X86\_64\_AVX512BW = 4194310 ###### [` X86_64_AVX512F `]() X86\_64\_AVX512F = 4194309 ###### [` X86_64_BMI1 `]() X86\_64\_BMI1 = 4194311 ###### [` X86_64_DEFAULT `]() X86\_64\_DEFAULT = 4194304 ###### [` X86_64_FMA `]() X86\_64\_FMA = 4194306 ###### [` X86_64_HASWELL `]() X86\_64\_HASWELL = 4194313 ###### [` X86_64_IVYBRIDGE `]() X86\_64\_IVYBRIDGE = 4194314 ###### [` X86_64_NEHALEM `]() X86\_64\_NEHALEM = 4194315 ###### [` X86_64_ROSETTA `]() X86\_64\_ROSETTA = 4194312 ###### [` X86_64_SSE41 `]() X86\_64\_SSE41 = 4194305 ##### [` another_table `]() property another\_table → bool Indicates whether [`impl`]( "lief.MachO.FunctionVariants.RuntimeTableEntry.impl") refers to an entry in another runtime table, rather than a direct function implementation address. ##### [` flag_bit_nums `]() property flag\_bit\_nums → memoryview The `flagBitNums` value as a slice of bytes ##### [` flags `]() property flags → list[[lief.MachO.FunctionVariants.RuntimeTableEntry.FLAGS]( "lief.MachO.FunctionVariants.RuntimeTableEntry.FLAGS")] Return the **interpreted** [`flag_bit_nums`]( "lief.MachO.FunctionVariants.RuntimeTableEntry.flag_bit_nums") ##### [` impl `]() property impl → int The relative address of the implementation or an index if [`another_table`]( "lief.MachO.FunctionVariants.RuntimeTableEntry.another_table") is set. #### [` content `]() property content → memoryview Payload content #### [` data_offset `]() property data\_offset → int Offset in the binary where the payload starts #### [` data_size `]() property data\_size → int Size of the payload #### [` runtime_table `]() property runtime\_table → lief.MachO.FunctionVariants.it\_runtime\_table Iterator over the different [`RuntimeTable`]( "lief.MachO.FunctionVariants.RuntimeTable") entries located in the content of this `__LINKEDIT` command --- ## [Function Variant Fixups]() ![Inheritance diagram of lief._lief.MachO.FunctionVariantFixups](https://lief.re/doc/latest/_images/inheritance-3bd631e721eeb92f9a246aebda43748777847b53.png) ### [` lief.MachO.FunctionVariantFixups `]() class lief.MachO.FunctionVariantFixups Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class which represents the `LC_FUNCTION_VARIANT_FIXUPS` command. This command contains the relocations that must be applied to the GOT-like slots associated with a [`FunctionVariants`]( "lief.MachO.FunctionVariants") table. At runtime, `dyld` resolves each slot to the best implementation and (re-)signs it according to the pointer-authentication information. #### [` FixupFixup `]() class Fixup(*self*) **class Fixup(*self*, *seg\_offset: int*, *seg\_index: int*, *variant\_index: int*, *pac\_auth: bool*, *pac\_address: bool*, *pac\_key: int*, *pac\_diversity: int*)** Bases: `object` A single relocation associated with a function-variant. It mirrors the `FunctionVariantFixups::InternalFixup` structure used by `dyld` and describes a slot that must be fixed up to point to the variant referenced by [`variant_index`]( "lief.MachO.FunctionVariantFixups.Fixup.variant_index"). ##### [` pac_address `]() property pac\_address → bool Whether the PAC signature mixes the storage address (address diversity) ##### [` pac_auth `]() property pac\_auth → bool Whether the slot is signed with pointer authentication (arm64e) ##### [` pac_diversity `]() property pac\_diversity → int PAC diversity (discriminator) of the slot ##### [` pac_key `]() property pac\_key → int PAC key used to sign the slot ##### [` seg_index `]() property seg\_index → int Index of the segment that owns the slot to fix up ##### [` seg_offset `]() property seg\_offset → int Offset of the slot to fix up, relative to [`seg_index`]( "lief.MachO.FunctionVariantFixups.Fixup.seg_index") ##### [` segment `]() property segment → [lief.MachO.SegmentCommand]( "lief.MachO.SegmentCommand") | None [`SegmentCommand`]( "lief.MachO.SegmentCommand") referenced by [`seg_index`]( "lief.MachO.FunctionVariantFixups.Fixup.seg_index") if it could be resolved, or None ##### [` variant_index `]() property variant\_index → int Index of the FunctionVariants runtime table used to resolve the slot #### [` add `]() add(*self*, *fixup: [lief.\_lief.MachO.FunctionVariantFixups.Fixup]( "lief._lief.MachO.FunctionVariantFixups.Fixup")*) → [lief.\_lief.MachO.FunctionVariantFixups]( "lief._lief.MachO.FunctionVariantFixups") Append a new [`Fixup`]( "lief.MachO.FunctionVariantFixups.Fixup") #### [` content `]() property content → memoryview Payload content #### [` data_offset `]() property data\_offset → int Offset in the binary where the payload starts #### [` data_size `]() property data\_size → int Size of the payload #### [` fixups `]() property fixups → lief.MachO.FunctionVariantFixups.it\_fixups Iterator over the different [`Fixup`]( "lief.MachO.FunctionVariantFixups.Fixup") entries --- ## [Lazy Load Dylib Info]() ![Inheritance diagram of lief._lief.MachO.LazyLoadDylibInfo](https://lief.re/doc/latest/_images/inheritance-383dd58abda8757b618a2dc7062dfd93e8c26133.png) ### [` lief.MachO.LazyLoadDylibInfo `]() class lief.MachO.LazyLoadDylibInfo Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class representing the `LC_LAZY_LOAD_DYLIB_INFO` load command. This command describes how to **lazily load a dylib**: instead of binding the library and its symbols at launch time, `dyld` keeps the information required to resolve the dylib on the first use of one of its symbols. #### [` Fixup `]() class Fixup Bases: `object` A single lazy-binding fixup decoded from the chain referenced by [`chain_start_image_offset`]( "lief.MachO.LazyLoadDylibInfo.chain_start_image_offset") and decoded according to [`pointer_format`]( "lief.MachO.LazyLoadDylibInfo.pointer_format"). ##### [` address `]() property address → int Virtual address of the slot bound by this fixup ##### [` is_auth `]() property is\_auth → bool Whether the bound pointer is authenticated (`arm64e` PAC) ##### [` ordinal `]() property ordinal → int Index of the bound symbol in [`symbols`]( "lief.MachO.LazyLoadDylibInfo.symbols") ##### [` symbol `]() property symbol → str Name of the bound symbol (resolved from [`ordinal`]( "lief.MachO.LazyLoadDylibInfo.Fixup.ordinal")) #### [` add_symbol `]() add\_symbol(*self*, *symbol: str*) → [lief.\_lief.MachO.LazyLoadDylibInfo]( "lief._lief.MachO.LazyLoadDylibInfo") Append a symbol name to the list of symbols to bind lazily #### [` chain_start_image_offset `]() property chain\_start\_image\_offset → int Image offset of the fixup chain start used to bind the dylib’s symbols #### [` clear_symbols `]() clear\_symbols(*self*) → [lief.\_lief.MachO.LazyLoadDylibInfo]( "lief._lief.MachO.LazyLoadDylibInfo") Remove all the symbol names to bind lazily #### [` content `]() property content → memoryview The original content of this payload #### [` data_offset `]() property data\_offset → int Offset in the `__LINKEDIT` segment where the payload starts #### [` data_size `]() property data\_size → int Size of the payload #### [` fixups `]() property fixups → lief.MachO.LazyLoadDylibInfo.it\_fixups Iterator over the lazy-binding [`Fixup`]( "lief.MachO.LazyLoadDylibInfo.Fixup") entries decoded from the chain #### [` flag_image_offset `]() property flag\_image\_offset → int Image offset of the global flag that is set once the dylib has been loaded by dyld #### [` flags `]() property flags → int Raw flags associated with this command (see [`may_be_missing`]( "lief.MachO.LazyLoadDylibInfo.may_be_missing")) #### [` load_path `]() property load\_path → str Load path of the dylib to bind lazily #### [` may_be_missing `]() property may\_be\_missing → bool Whether the dylib is allowed to be missing at runtime (weak linked) #### [` pointer_format `]() property pointer\_format → int Chained-fixups pointer format used by the binding chain #### [` symbols `]() property symbols → list[str] List of the symbol names to bind lazily for this dylib --- ## [Source Version]() ![Inheritance diagram of lief._lief.MachO.SourceVersion](https://lief.re/doc/latest/_images/inheritance-63c39de470bc440c1564324931abb7fc6127cf6f.png) ### [` lief.MachO.SourceVersion `]() class lief.MachO.SourceVersion Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class that represents the MachO [`SOURCE_VERSION`]( "lief.MachO.LoadCommand.TYPE.SOURCE_VERSION") This command is used to provide the *version* of the sources used to build the binary #### [` version `]() property version → list[int] Version as a tuple of **5** integers --- ## [Version Min]() ![Inheritance diagram of lief._lief.MachO.VersionMin](https://lief.re/doc/latest/_images/inheritance-e0d888ece5d47b9e22fdbb6f26862d5da988eed3.png) ### [` lief.MachO.VersionMin `]() class lief.MachO.VersionMin Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class that wraps the LC\_VERSION\_MIN\_MACOSX, LC\_VERSION\_MIN\_IPHONEOS, … commands #### [` sdk `]() property sdk → list[int] SDK as a tuple of **3** integers #### [` version `]() property version → list[int] Version as a tuple of **3** integers --- ## [Routine]() ![Inheritance diagram of lief._lief.MachO.Routine](https://lief.re/doc/latest/_images/inheritance-135c62a49b5b90e87ca388ba0be9ecfd048a6ad5.png) ### [` lief.MachO.Routine `]() class lief.MachO.Routine Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class that represents the `LC_ROUTINE/LC_ROUTINE64` commands. According to the Mach-O `loader.h` documentation: The routines command contains the address of the dynamic shared library initialization routine and an index into the module table for the module that defines the routine. Before any modules are used from the library the dynamic linker fully binds the module that defines the initialization routine and then calls it. This gets called before any module initialization routines (used for C++ static constructors) in the library. #### [` init_address `]() property init\_address → int Address of initialization routine #### [` init_module `]() property init\_module → int Index into the module table that the init routine is defined in #### [` reserved1 `]() property reserved1 → int #### [` reserved2 `]() property reserved2 → int #### [` reserved3 `]() property reserved3 → int #### [` reserved4 `]() property reserved4 → int #### [` reserved5 `]() property reserved5 → int #### [` reserved6 `]() property reserved6 → int --- ## [Relocation]() ![Inheritance diagram of lief._lief.MachO.Relocation, lief._lief.MachO.RelocationDyld, lief._lief.MachO.RelocationFixup, lief._lief.MachO.RelocationObject](https://lief.re/doc/latest/_images/inheritance-75e16dc6664b2904cb85323be5cb4694f1bfa065.png) ### [` lief.MachO.Relocation `]() class lief.MachO.Relocation Bases: [`Relocation`]( "lief._lief.Relocation") It extends the LIEF [`lief.Relocation`]( "lief.Relocation") abstract class and it is sub-classed by 1. [`RelocationObject`]( "lief.MachO.RelocationObject") 2. [`RelocationDyld`]( "lief.MachO.RelocationDyld") #### [` ORIGIN `]() class ORIGIN(*\*values*) Bases: `Enum` ##### [` CHAINED_FIXUPS `]() CHAINED\_FIXUPS = 3 ##### [` DYLDINFO `]() DYLDINFO = 1 ##### [` RELOC_TABLE `]() RELOC\_TABLE = 2 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.Relocation.ORIGIN]( "lief.MachO.Relocation.ORIGIN") = <nanobind.nb\_func object> #### [` address `]() property address → int For `OBJECT` or ([`origin`]( "lief.MachO.Relocation.origin") is [`RELOC_TABLE`]( "lief.MachO.Relocation.ORIGIN.RELOC_TABLE")) this is an offset from the start of the [`Section`]( "lief.MachO.Section") to the item containing the address requiring relocation. For [`EXECUTE`]( "lief.MachO.Header.FILE_TYPE.EXECUTE") / [`DYLIB`]( "lief.MachO.Header.FILE_TYPE.DYLIB") or ([`origin`]( "lief.MachO.Relocation.origin") is [`DYLDINFO`]( "lief.MachO.Relocation.ORIGIN.DYLDINFO")) this is a [`virtual_address`]( "lief.MachO.SegmentCommand.virtual_address"). #### [` architecture `]() property architecture → [lief.MachO.Header.CPU\_TYPE]( "lief.MachO.Header.CPU_TYPE") [`CPU_TYPE`]( "lief.MachO.Header.CPU_TYPE") of the relocation #### [` has_section `]() property has\_section → bool `True` if the relocation has a [`Section`]( "lief.MachO.Section") associated with #### [` has_segment `]() property has\_segment → bool `True` if the relocation has a [`SegmentCommand`]( "lief.MachO.SegmentCommand") associated with #### [` has_symbol `]() property has\_symbol → bool `True` if the relocation has a [`Symbol`]( "lief.MachO.Symbol") associated with #### [` origin `]() property origin → [lief.MachO.Relocation.ORIGIN]( "lief.MachO.Relocation.ORIGIN") [`ORIGIN`]( "lief.MachO.Relocation.ORIGIN") of the relocation - For [`OBJECT`]( "lief.MachO.Header.FILE_TYPE.OBJECT") file it should be [`RELOC_TABLE`]( "lief.MachO.Relocation.ORIGIN.RELOC_TABLE") - For [`EXECUTE`]( "lief.MachO.Header.FILE_TYPE.EXECUTE") or `DYLIB` it should be [`DYLDINFO`]( "lief.MachO.Relocation.ORIGIN.DYLDINFO")”) #### [` pc_relative `]() property pc\_relative → bool Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing. For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction. #### [` section `]() property section → [lief.MachO.Section]( "lief.MachO.Section") | None [`Section`]( "lief.MachO.Section") associated with the relocation if any, or None #### [` segment `]() property segment → [lief.MachO.SegmentCommand]( "lief.MachO.SegmentCommand") | None [`SegmentCommand`]( "lief.MachO.SegmentCommand") associated with the relocation if any, or None #### [` symbol `]() property symbol → [lief.MachO.Symbol]( "lief.MachO.Symbol") | None [`Symbol`]( "lief.MachO.Symbol") associated with the relocation if any, or None #### [` type `]() property type → [lief.MachO.X86\_RELOCATION]( "lief.MachO.X86_RELOCATION") | [lief.MachO.X86\_64\_RELOCATION]( "lief.MachO.X86_64_RELOCATION") | [lief.MachO.PPC\_RELOCATION]( "lief.MachO.PPC_RELOCATION") | [lief.MachO.ARM\_RELOCATION]( "lief.MachO.ARM_RELOCATION") | [lief.MachO.ARM64\_RELOCATION]( "lief.MachO.ARM64_RELOCATION") | [lief.MachO.DyldInfo.REBASE\_TYPE]( "lief.MachO.DyldInfo.REBASE_TYPE") Type of the relocation according to the [`architecture`]( "lief.MachO.Relocation.architecture") and/or [`origin`]( "lief.MachO.Relocation.origin") If [`origin`]( "lief.MachO.Relocation.origin") is [`RELOC_TABLE`]( "lief.MachO.Relocation.ORIGIN.RELOC_TABLE"): See: > - [`lief.MachO.X86_RELOCATION`]( "lief.MachO.X86_RELOCATION") > - [`lief.MachO.X86_64_RELOCATION`]( "lief.MachO.X86_64_RELOCATION") > - [`lief.MachO.PPC_RELOCATION`]( "lief.MachO.PPC_RELOCATION") > - [`lief.MachO.ARM_RELOCATION`]( "lief.MachO.ARM_RELOCATION") > - [`lief.MachO.ARM64_RELOCATION`]( "lief.MachO.ARM64_RELOCATION") If [`origin`]( "lief.MachO.Relocation.origin") is [`DYLDINFO`]( "lief.MachO.Relocation.ORIGIN.DYLDINFO"), the value is associated with [`REBASE_TYPE`]( "lief.MachO.DyldInfo.REBASE_TYPE"). --- ## [Relocation Object]() ![Inheritance diagram of lief._lief.MachO.RelocationObject](https://lief.re/doc/latest/_images/inheritance-655bbfa0687afc98c09dd480a71bf97e63308b9b.png) ### [` lief.MachO.RelocationObject `]() class lief.MachO.RelocationObject Bases: [`Relocation`]( "lief._lief.MachO.Relocation") Class that represents a relocation present in the MachO object file (`.o`). Usually, this kind of relocation is found in the [`lief.MachO.Section`]( "lief.MachO.Section"). #### [` is_scattered `]() property is\_scattered → bool `True` if the relocation is a scattered one #### [` value `]() property value → int For **scattered** relocations, the address of the relocatable expression for the item in the file that needs to be updated if the address is changed. For relocatable expressions with the difference of two section addresses, the address from which to subtract (in mathematical terms, the minuend) is contained in the first relocation entry and the address to subtract (the subtrahend) is contained in the second relocation entry.”, --- ## [Relocation Dyld]() ![Inheritance diagram of lief._lief.MachO.RelocationDyld](https://lief.re/doc/latest/_images/inheritance-d151a86d63cc6ff1436a989e36f773c128b94920.png) ### [` lief.MachO.RelocationDyld `]() class lief.MachO.RelocationDyld Bases: [`Relocation`]( "lief._lief.MachO.Relocation") Class that represents a relocation found in the [`DyldInfo`]( "lief.MachO.DyldInfo") structure. While this class does not have an associated structure in the Mach-O format specification, it provides a convenient interface for the [`lief.MachO.DyldInfo.rebase`]( "lief.MachO.DyldInfo.rebase") values See also: [`RelocationObject`]( "lief.MachO.RelocationObject") --- ## [Relocation Fixup]() ![Inheritance diagram of lief._lief.MachO.RelocationFixup](https://lief.re/doc/latest/_images/inheritance-b2407301e633e8b2aecd674b76d15b8cf98dc15f.png) ### [` lief.MachO.RelocationFixup `]() class lief.MachO.RelocationFixup Bases: [`Relocation`]( "lief._lief.MachO.Relocation") Class that represents a rebase relocation found in the LC\_DYLD\_CHAINED\_FIXUPS command. This class extends [`lief.Relocation`]( "lief.Relocation") (and [`lief.MachO.Relocation`]( "lief.MachO.Relocation")) in which [`address`]( "lief.Relocation.address") is set to the absolute virtual address where the relocation must take place (e.g. `0x10000d270`). On the other hand, [`target`]( "lief.MachO.RelocationFixup.target") contains the value that should be set at [`address`]( "lief.Relocation.address") if the imagebase is [`imagebase`]( "lief.Binary.imagebase") (e.g. `0x1000073a8`). If the Mach-O loader chooses another base address (like `0x7ff100000`), it must set `0x10000d270` to `0x7ff1073a8`. #### [` next `]() property next → int (unscaled) next offset in the chain #### [` target `]() property target → int --- ## [Binding Info]() ![Inheritance diagram of lief._lief.MachO.ChainedBindingInfo, lief._lief.MachO.BindingInfo, lief._lief.MachO.DyldBindingInfo, lief._lief.MachO.IndirectBindingInfo](https://lief.re/doc/latest/_images/inheritance-53697f801140357a3bfcc5b43cdfe14106e33d14.png) ### [` lief.MachO.BindingInfo `]() class lief.MachO.BindingInfo Bases: `Object` Class that provides an interface over an entry in DyldInfo structure This class does not represent a structure that exists in the Mach-O format specifications but it provides a *view* of a binding operation that is performed by the Dyld binding bytecode (`LC_DYLD_INFO`) or the Dyld chained fixups (`DYLD_CHAINED_FIXUPS`) See: [`ChainedBindingInfo`]( "lief.MachO.ChainedBindingInfo"), [`DyldBindingInfo`]( "lief.MachO.DyldBindingInfo") #### [` addend `]() property addend → int Value added to the segment’s virtual address when binding #### [` address `]() property address → int Binding’s address #### [` has_library `]() property has\_library → bool `True` if the binding info has a [`DylibCommand`]( "lief.MachO.DylibCommand") associated with #### [` has_segment `]() property has\_segment → bool `True` if the binding info has a [`SegmentCommand`]( "lief.MachO.SegmentCommand") associated with #### [` has_symbol `]() property has\_symbol → bool `True` if the binding info has a [`Symbol`]( "lief.MachO.Symbol") associated with #### [` library `]() property library → [lief.MachO.DylibCommand]( "lief.MachO.DylibCommand") | None [`DylibCommand`]( "lief.MachO.DylibCommand") associated with the binding if any, or None #### [` library_ordinal `]() property library\_ordinal → int #### [` segment `]() property segment → [lief.MachO.SegmentCommand]( "lief.MachO.SegmentCommand") | None [`SegmentCommand`]( "lief.MachO.SegmentCommand") associated with the binding if any, or None #### [` symbol `]() property symbol → [lief.MachO.Symbol]( "lief.MachO.Symbol") | None [`Symbol`]( "lief.MachO.Symbol") associated with the binding if any, or None #### [` weak_import `]() property weak\_import → bool --- ## [Dyld Binding Info]() ![Inheritance diagram of lief._lief.MachO.DyldBindingInfo](https://lief.re/doc/latest/_images/inheritance-245f1a31aeeff0fd8681855a0d940eda42bf366b.png) ### [` lief.MachO.DyldBindingInfo `]() class lief.MachO.DyldBindingInfo Bases: [`BindingInfo`]( "lief._lief.MachO.BindingInfo") This class represents a symbol binding operation associated with the LC\_DYLD\_INFO bytecode. This class does not represent a structure that exists in the Mach-O format specifications but it provides a *view* on an entry of the Dyld binding opcodes. See also: [`BindingInfo`]( "lief.MachO.BindingInfo") #### [` CLASS `]() class CLASS(*\*values*) Bases: `Enum` ##### [` LAZY `]() LAZY = 2 ##### [` STANDARD `]() STANDARD = 3 ##### [` THREADED `]() THREADED = 100 ##### [` WEAK `]() WEAK = 1 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.DyldBindingInfo.CLASS]( "lief.MachO.DyldBindingInfo.CLASS") = <nanobind.nb\_func object> #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` ##### [` POINTER `]() POINTER = 1 ##### [` TEXT_ABSOLUTE32 `]() TEXT\_ABSOLUTE32 = 2 ##### [` TEXT_PCREL32 `]() TEXT\_PCREL32 = 3 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.DyldBindingInfo.TYPE]( "lief.MachO.DyldBindingInfo.TYPE") = <nanobind.nb\_func object> #### [` binding_class `]() property binding\_class → [lief.MachO.DyldBindingInfo.CLASS]( "lief.MachO.DyldBindingInfo.CLASS") `BINDING_CLASS` of the binding #### [` binding_type `]() property binding\_type → [lief.MachO.DyldBindingInfo.TYPE]( "lief.MachO.DyldBindingInfo.TYPE") `BIND_TYPES` of the binding. Usually, it is `POINTER`. #### [` original_offset `]() property original\_offset → int Original relative offset of the binding opcodes --- ## [Chained Binding Info]() ![Inheritance diagram of lief._lief.MachO.ChainedBindingInfo](https://lief.re/doc/latest/_images/inheritance-79a9d2d311fd4b93cb4e02ceb60b83d8a50f21ea.png) ### [` lief.MachO.ChainedBindingInfo `]() class lief.MachO.ChainedBindingInfo Bases: [`BindingInfo`]( "lief._lief.MachO.BindingInfo") This class represents a symbol binding operation associated with the LC\_DYLD\_CHAINED\_FIXUPS command. This class does not represent a structure that exists in the Mach-O format specifications but it provides a *view* on an entry. See also: [`BindingInfo`]( "lief.MachO.BindingInfo") #### [` format `]() property format → [lief.MachO.DYLD\_CHAINED\_FORMAT]( "lief.MachO.DYLD_CHAINED_FORMAT") [`DYLD_CHAINED_FORMAT`]( "lief.MachO.DYLD_CHAINED_FORMAT") of the import #### [` offset `]() property offset → int Offset of the entry in the chained fixups #### [` ptr_format `]() property ptr\_format → [lief.MachO.DYLD\_CHAINED\_PTR\_FORMAT]( "lief.MachO.DYLD_CHAINED_PTR_FORMAT") [`DYLD_CHAINED_PTR_FORMAT`]( "lief.MachO.DYLD_CHAINED_PTR_FORMAT") of the import #### [` sign_extended_addend `]() property sign\_extended\_addend → int --- ## [Export Info]() ### [` lief.MachO.ExportInfo `]() class lief.MachO.ExportInfo Bases: `Object` Class that provides an interface over the Dyld export info This class does not represent a structure that exists in the Mach-O format specification but provides a *view* on an entry of the Dyld export trie. #### [` FLAGS `]() class FLAGS(*\*values*) Bases: `Flag` ##### [` REEXPORT `]() REEXPORT = 8 ##### [` STATIC_RESOLVER `]() STATIC\_RESOLVER = 32 ##### [` STUB_AND_RESOLVER `]() STUB\_AND\_RESOLVER = 16 ##### [` WEAK_DEFINITION `]() WEAK\_DEFINITION = 4 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.ExportInfo.FLAGS]( "lief.MachO.ExportInfo.FLAGS") = <nanobind.nb\_func object> #### [` KIND `]() class KIND(*\*values*) Bases: `Enum` ##### [` ABSOLUTE_KIND `]() ABSOLUTE\_KIND = 2 ##### [` REGULAR `]() REGULAR = 0 ##### [` THREAD_LOCAL_KIND `]() THREAD\_LOCAL\_KIND = 1 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.ExportInfo.KIND]( "lief.MachO.ExportInfo.KIND") = <nanobind.nb\_func object> #### [` address `]() property address → int The address of the export #### [` alias `]() property alias → [lief.MachO.Symbol]( "lief.MachO.Symbol") | None [`Symbol`]( "lief.MachO.Symbol") alias if the current symbol is re-exported #### [` alias_library `]() property alias\_library → [lief.MachO.DylibCommand]( "lief.MachO.DylibCommand") | None If the current symbol has an alias, it returns the [`DylibCommand`]( "lief.MachO.DylibCommand") command associated with #### [` flags `]() property flags → int Some information ([`FLAGS`]( "lief.MachO.ExportInfo.FLAGS")) about the export (like weak export, reexport, …) #### [` flags_list `]() property flags\_list → list[[lief.MachO.ExportInfo.FLAGS]( "lief.MachO.ExportInfo.FLAGS")] Return flags as a list of [`FLAGS`]( "lief.MachO.ExportInfo.FLAGS") #### [` has `]() has(*self*, *flag: [lief.\_lief.MachO.ExportInfo.FLAGS]( "lief._lief.MachO.ExportInfo.FLAGS")*) → bool Check if the flag [`FLAGS`]( "lief.MachO.ExportInfo.FLAGS") given in first parameter is present #### [` has_symbol `]() property has\_symbol → bool `True` if the export info has a [`Symbol`]( "lief.MachO.Symbol") associated with #### [` kind `]() property kind → [lief.MachO.ExportInfo.KIND]( "lief.MachO.ExportInfo.KIND") The export’s kind: regular, thread local, absolute, … ([`KIND`]( "lief.MachO.ExportInfo.KIND")) #### [` node_offset `]() property node\_offset → int Original offset in the export Trie #### [` symbol `]() property symbol → [lief.MachO.Symbol]( "lief.MachO.Symbol") | None [`Symbol`]( "lief.MachO.Symbol") associated with the export if any, or None --- ## [Thread Command]() ![Inheritance diagram of lief._lief.MachO.ThreadCommand](https://lief.re/doc/latest/_images/inheritance-b4b6e2358c34744fec0c0dfbde874736e8fafaa0.png) ### [` lief.MachO.ThreadCommand `]() class lief.MachO.ThreadCommand(*self*, *arg0: int*, *arg1: int*, *arg2: [lief.\_lief.MachO.Header.CPU\_TYPE]( "lief._lief.MachO.Header.CPU_TYPE")*, */*) Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class that represents the LC\_THREAD / LC\_UNIXTHREAD commands and that can be used to get the binary entrypoint when the LC\_MAIN (MainCommand) is not present Generally speaking, this command aims at defining the original state of the main thread which includes the registers’ values #### [` architecture `]() property architecture → [lief.MachO.Header.CPU\_TYPE]( "lief.MachO.Header.CPU_TYPE") The CPU architecture that is targeted by this ThreadCommand #### [` count `]() property count → int Size of the thread state data with 32-bits alignment. This value should match len([`state`]( "lief.MachO.ThreadCommand.state")) #### [` flavor `]() property flavor → int Integer that defines a special *flavor* for the thread. The meaning of this value depends on the [`architecture`]( "lief.MachO.ThreadCommand.architecture"). The list of the values can be found in the XNU kernel files: - xnu/osfmk/mach/arm/thread\_status.h for the ARM/AArch64 architectures - xnu/osfmk/mach/i386/thread\_status.h for the x86/x86-64 architectures #### [` pc `]() property pc → int Return the initial Program Counter regardless of the underlying architecture. This value, when non null, can be used to determine the binary’s entrypoint. Underneath, it works by looking for the PC register value in the [`state`]( "lief.MachO.ThreadCommand.state") data #### [` state `]() property state → memoryview The actual thread state as a vector of bytes. Depending on the architecture(), these data can be casted into x86\_thread\_state\_t, x86\_thread\_state64\_t, … --- ## [RPath Command]() ![Inheritance diagram of lief._lief.MachO.RPathCommand](https://lief.re/doc/latest/_images/inheritance-bcfc1cab0a12b70ca77ded5dfaca455bcd6f903a.png) ### [` lief.MachO.RPathCommand `]() class lief.MachO.RPathCommand Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") #### [` create `]() create(*path: str*) → [lief.MachO.RPathCommand]( "lief.MachO.RPathCommand") | None = <nanobind.nb\_func object> #### [` path `]() property path → str @rpath path #### [` path_offset `]() property path\_offset → int Original string offset of the path --- ## [Code Signature]() ![Inheritance diagram of lief._lief.MachO.CodeSignature](https://lief.re/doc/latest/_images/inheritance-740a49152473d00511d001b725c44090db6313ac.png) ### [` lief.MachO.CodeSignature `]() class lief.MachO.CodeSignature Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") #### [` content `]() property content → memoryview The raw signature as a bytes stream #### [` data_offset `]() property data\_offset → int Offset in the binary where the signature starts #### [` data_size `]() property data\_size → int Size of the raw signature --- ## [Data In Code]() ![Inheritance diagram of lief._lief.MachO.DataInCode](https://lief.re/doc/latest/_images/inheritance-8ed484b8bbeb457c50364202ab5a7fdd19e91788.png) ### [` lief.MachO.DataInCode `]() class lief.MachO.DataInCode Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Interface of the LC\_DATA\_IN\_CODE command This command is used to list slices of code sections that contain data. The *slices* information are stored as an array of [`DataCodeEntry`]( "lief.MachO.DataCodeEntry") #### [` add `]() add(*self*, *entry: [lief.\_lief.MachO.DataCodeEntry]( "lief._lief.MachO.DataCodeEntry")*) → [lief.\_lief.MachO.DataInCode]( "lief._lief.MachO.DataInCode") Add a new [`DataCodeEntry`]( "lief.MachO.DataCodeEntry") #### [` content `]() property content → memoryview The original content as a bytes stream #### [` data_offset `]() property data\_offset → int Start of the array of the DataCodeEntry entries #### [` data_size `]() property data\_size → int Whole size of the array (`size = sizeof(DataCodeEntry) * nb_elements`) #### [` entries `]() property entries → lief.MachO.it\_data\_in\_code\_entries Iterator over [`DataCodeEntry`]( "lief.MachO.DataCodeEntry") --- ## [Data Code Entry]() ### [` lief.MachO.DataCodeEntry `]() class lief.MachO.DataCodeEntry Bases: `Object` Interface over an entry in the [`DataInCode`]( "lief.MachO.DataInCode") command #### [` TYPES `]() class TYPES(*\*values*) Bases: `Enum` ##### [` ABS_JUMP_TABLE_32 `]() ABS\_JUMP\_TABLE\_32 = 5 ##### [` DATA `]() DATA = 1 ##### [` JUMP_TABLE_16 `]() JUMP\_TABLE\_16 = 3 ##### [` JUMP_TABLE_32 `]() JUMP\_TABLE\_32 = 4 ##### [` JUMP_TABLE_8 `]() JUMP\_TABLE\_8 = 2 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.DataCodeEntry.TYPES]( "lief.MachO.DataCodeEntry.TYPES") = <nanobind.nb\_func object> #### [` length `]() property length → int Length of the data #### [` offset `]() property offset → int Offset of the data #### [` type `]() property type → [lief.MachO.DataCodeEntry.TYPES]( "lief.MachO.DataCodeEntry.TYPES") Type of the data ([`TYPES`]( "lief.MachO.DataCodeEntry.TYPES") --- ## [Segment Split Info]() ![Inheritance diagram of lief._lief.MachO.SegmentSplitInfo](https://lief.re/doc/latest/_images/inheritance-574a4897deb41281f14a6e36c11fdc8a350fe9ff.png) ### [` lief.MachO.SegmentSplitInfo `]() class lief.MachO.SegmentSplitInfo Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class that represents the [`SEGMENT_SPLIT_INFO`]( "lief.MachO.LoadCommand.TYPE.SEGMENT_SPLIT_INFO") command #### [` content `]() property content → memoryview The original content as a bytes stream #### [` data_offset `]() property data\_offset → int Offset in the binary where the data start #### [` data_size `]() property data\_size → int Size of the raw data --- ## [Sub Framework]() ![Inheritance diagram of lief._lief.MachO.SubFramework](https://lief.re/doc/latest/_images/inheritance-9c6b04330a81d56f97ff7c80615bea9f905c57be.png) ### [` lief.MachO.SubFramework `]() class lief.MachO.SubFramework Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class that represents the SubFramework command. According to the Mach-O `loader.h` documentation: > A dynamically linked shared library may be a subframework of an umbrella > framework. If so it will be linked with “-umbrella umbrella\_name” where > Where “umbrella\_name” is the name of the umbrella framework. A subframework > can only be linked against by its umbrella framework or other subframeworks > that are part of the same umbrella framework. Otherwise the static link > editor produces an error and states to link against the umbrella framework. > The name of the umbrella framework for subframeworks is recorded in the > following structure. #### [` umbrella `]() property umbrella → str Name of the umbrella framework --- ## [Sub Client]() ![Inheritance diagram of lief._lief.MachO.SubClient](https://lief.re/doc/latest/_images/inheritance-3ec2d5d691b46666c7182a687a3c0446d72880dc.png) ### [` lief.MachO.SubClient `]() class lief.MachO.SubClient Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class that represents the SubClient command. According to the Mach-O `loader.h` documentation: > For dynamically linked shared libraries that are subframework of an umbrella > framework they can allow clients other than the umbrella framework or other > subframeworks in the same umbrella framework. To do this the subframework > is built with “-allowable\_client client\_name” and an LC\_SUB\_CLIENT load > command is created for each -allowable\_client flag. The client\_name is > usually a framework name. It can also be a name used for bundles clients > where the bundle is built with “-client\_name client\_name”. #### [` client `]() property client → str Name of the sub client --- ## [Dyld Environment]() ![Inheritance diagram of lief._lief.MachO.DyldEnvironment](https://lief.re/doc/latest/_images/inheritance-eba12509a0be0b825bca4866e37669c2e25451b1.png) ### [` lief.MachO.DyldEnvironment `]() class lief.MachO.DyldEnvironment Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class that represents a LC\_DYLD\_ENVIRONMENT which is used by the Mach-O linker/loader to initialize an environment variable #### [` value `]() property value → str Environment variable as a string --- ## [Encryption Info]() ![Inheritance diagram of lief._lief.MachO.EncryptionInfo](https://lief.re/doc/latest/_images/inheritance-0e20e37f438e647f796c219f12f4eb1e2db57a25.png) ### [` lief.MachO.EncryptionInfo `]() class lief.MachO.EncryptionInfo Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class that represents the LC\_ENCRYPTION\_INFO / LC\_ENCRYPTION\_INFO\_64 commands The encryption info is usually present in Mach-O executables that target iOS to encrypt some sections of the binary #### [` crypt_id `]() property crypt\_id → int The encryption system. 0 means not encrypted #### [` crypt_offset `]() property crypt\_offset → int File offset of encrypted range #### [` crypt_size `]() property crypt\_size → int File size of encrypted range --- ## [Build Version]() ![Inheritance diagram of lief._lief.MachO.BuildVersion](https://lief.re/doc/latest/_images/inheritance-f85d6b788d5f88d82e4a7bcf41e8131cb18ed205.png) ### [` lief.MachO.BuildVersion `]() class lief.MachO.BuildVersion Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") #### [` PLATFORMS `]() class PLATFORMS(*\*values*) Bases: `Enum` ##### [` ANY `]() ANY = 4294967295 ##### [` BRIDGEOS `]() BRIDGEOS = 5 ##### [` DRIVERKIT `]() DRIVERKIT = 10 ##### [` FIRMWARE `]() FIRMWARE = 13 ##### [` IOS `]() IOS = 2 ##### [` IOS_EXCLAVE_CORE `]() IOS\_EXCLAVE\_CORE = 17 ##### [` IOS_EXCLAVE_KIT `]() IOS\_EXCLAVE\_KIT = 18 ##### [` IOS_SIMULATOR `]() IOS\_SIMULATOR = 7 ##### [` MACOS `]() MACOS = 1 ##### [` MACOS_EXCLAVE_CORE `]() MACOS\_EXCLAVE\_CORE = 15 ##### [` MACOS_EXCLAVE_KIT `]() MACOS\_EXCLAVE\_KIT = 16 ##### [` MAC_CATALYST `]() MAC\_CATALYST = 6 ##### [` SEPOS `]() SEPOS = 14 ##### [` TVOS `]() TVOS = 3 ##### [` TVOS_EXCLAVE_CORE `]() TVOS\_EXCLAVE\_CORE = 19 ##### [` TVOS_EXCLAVE_KIT `]() TVOS\_EXCLAVE\_KIT = 20 ##### [` TVOS_SIMULATOR `]() TVOS\_SIMULATOR = 8 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` VISIONOS `]() VISIONOS = 11 ##### [` VISIONOS_EXCLAVE_CORE `]() VISIONOS\_EXCLAVE\_CORE = 23 ##### [` VISIONOS_EXCLAVE_KIT `]() VISIONOS\_EXCLAVE\_KIT = 24 ##### [` VISIONOS_SIMULATOR `]() VISIONOS\_SIMULATOR = 12 ##### [` WATCHOS `]() WATCHOS = 4 ##### [` WATCHOS_EXCLAVE_CORE `]() WATCHOS\_EXCLAVE\_CORE = 21 ##### [` WATCHOS_EXCLAVE_KIT `]() WATCHOS\_EXCLAVE\_KIT = 22 ##### [` WATCHOS_SIMULATOR `]() WATCHOS\_SIMULATOR = 9 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.BuildVersion.PLATFORMS]( "lief.MachO.BuildVersion.PLATFORMS") = <nanobind.nb\_func object> #### [` minos `]() property minos → list[int] Minimal OS version on which this binary was built to run #### [` platform `]() property platform → [lief.MachO.BuildVersion.PLATFORMS]( "lief.MachO.BuildVersion.PLATFORMS") Target [`PLATFORMS`]( "lief.MachO.BuildVersion.PLATFORMS") #### [` sdk `]() property sdk → list[int] SDK Version #### [` tools `]() property tools → list[[lief.MachO.BuildToolVersion]( "lief.MachO.BuildToolVersion")] List of [`BuildToolVersion`]( "lief.MachO.BuildToolVersion") used while building this binary --- ## [Build Tool Version]() ![Inheritance diagram of lief._lief.MachO.BuildToolVersion](https://lief.re/doc/latest/_images/inheritance-72d9da5e63e9eed6e77e061e5803cc02bc85a84e.png) ### [` lief.MachO.BuildToolVersion `]() class lief.MachO.BuildToolVersion Bases: `Object` Class that represents a tool’s version that was involved in the build of the binary #### [` TOOLS `]() class TOOLS(*\*values*) Bases: `Enum` ##### [` AIRLLD `]() AIRLLD = 1025 ##### [` AIRNT `]() AIRNT = 1026 ##### [` AIRNT_PLUGIN `]() AIRNT\_PLUGIN = 1027 ##### [` AIRPACK `]() AIRPACK = 1028 ##### [` CLANG `]() CLANG = 1 ##### [` GPUARCHIVER `]() GPUARCHIVER = 1031 ##### [` LD `]() LD = 3 ##### [` LLD `]() LLD = 4 ##### [` METAL `]() METAL = 1024 ##### [` METAL_FRAMEWORK `]() METAL\_FRAMEWORK = 1032 ##### [` SWIFT `]() SWIFT = 2 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.BuildToolVersion.TOOLS]( "lief.MachO.BuildToolVersion.TOOLS") = <nanobind.nb\_func object> #### [` tool `]() property tool → [lief.MachO.BuildToolVersion.TOOLS]( "lief.MachO.BuildToolVersion.TOOLS") `TOOLS` type #### [` version `]() property version → list[int] Version of the tool --- ## [Fileset Command]() ![Inheritance diagram of lief._lief.MachO.FilesetCommand](https://lief.re/doc/latest/_images/inheritance-e852680add21235c95751c8c8849f395740ce527.png) ### [` lief.MachO.FilesetCommand `]() class lief.MachO.FilesetCommand Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class associated with the LC\_FILESET\_ENTRY commands #### [` binary `]() property binary → [lief.MachO.Binary]( "lief.MachO.Binary") | None Return the [`Binary`]( "lief.MachO.Binary") object associated with the entry #### [` file_offset `]() property file\_offset → int Original offset in the kernel cache #### [` name `]() property name → str Name of the underlying MachO binary #### [` virtual_address `]() property virtual\_address → int Memory address where the MachO file should be mapped --- ## [DyldChainedFixups Command]() ![Inheritance diagram of lief._lief.MachO.DyldChainedFixups](https://lief.re/doc/latest/_images/inheritance-0a2ba2fd368cc33abfe41c1b2dbd604b8fbd48f6.png) ### [` lief.MachO.DyldChainedFixups `]() class lief.MachO.DyldChainedFixups Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class that represents the LC\_DYLD\_CHAINED\_FIXUPS command This command aims at providing rebase and binding information like the [`DyldInfo`]( "lief.MachO.DyldInfo") ‘s bytecode. Compared to the [`DyldInfo`]( "lief.MachO.DyldInfo") bytecode, these chained fixups are taking less space. #### [` bindings `]() property bindings → lief.MachO.DyldChainedFixups.it\_binding\_info Iterator over the bindings [`ChainedBindingInfo`]( "lief.MachO.ChainedBindingInfo") associated with this command #### [` chained_starts_in_segment `]() class chained\_starts\_in\_segment Bases: `object` Structure that mirrors the raw dyld\_chained\_starts\_in\_segment which aims at providing information about the chained rebase/bind fixups The relocations provided by this structure can be accessed through [`relocations`]( "lief.MachO.SegmentCommand.relocations") ##### [` max_valid_pointer `]() property max\_valid\_pointer → int for 32-bit OS, any value beyond this is not a pointer ##### [` offset `]() property offset → int Original offset of the structure, relative to [`starts_offset`]( "lief.MachO.DyldChainedFixups.starts_offset") ##### [` page_count `]() property page\_count → int How many pages are in the `page_start` array ##### [` page_size `]() property page\_size → int Likely 0x1000 for x86/x86\_64 architectures and 0x4000 for ARM64 architecture ##### [` page_start `]() property page\_start → list[int] Offset in the [`SegmentCommand`]( "lief.MachO.SegmentCommand") of the first element of the chain. ##### [` pointer_format `]() property pointer\_format → [lief.MachO.DYLD\_CHAINED\_PTR\_FORMAT]( "lief.MachO.DYLD_CHAINED_PTR_FORMAT") How pointers are encoded ##### [` segment `]() property segment → [lief.MachO.SegmentCommand]( "lief.MachO.SegmentCommand") | None [`SegmentCommand`]( "lief.MachO.SegmentCommand") in which the rebase/bind fixups take place ##### [` segment_offset `]() property segment\_offset → int Offset of the segment’s data from the beginning of the file. (it should match [`file_offset`]( "lief.MachO.SegmentCommand.file_offset")) ##### [` size `]() property size → int `sizeof(size) + sizeof(page_size) + ... + sizeof(pointer_format)` #### [` chained_starts_in_segments `]() property chained\_starts\_in\_segments → lief.MachO.DyldChainedFixups.it\_chained\_starts\_in\_segments\_t Iterator over the chained fixup metadata, [`chained_starts_in_segment`]( "lief.MachO.DyldChainedFixups.chained_starts_in_segment") #### [` data_offset `]() property data\_offset → int Offset of the LC\_DYLD\_CHAINED\_FIXUPS chained payload. This offset should point in the `__LINKEDIT` segment #### [` data_size `]() property data\_size → int Size of the LC\_DYLD\_CHAINED\_FIXUPS payload #### [` fixups_version `]() property fixups\_version → int Chained fixups version. The loader (as of dyld v852.2) checks that this value is set to 0. #### [` imports_count `]() property imports\_count → int Number of imported symbol names #### [` imports_format `]() property imports\_format → [lief.MachO.DYLD\_CHAINED\_FORMAT]( "lief.MachO.DYLD_CHAINED_FORMAT") The format of the imports ([`ChainedBindingInfo`]( "lief.MachO.ChainedBindingInfo")) #### [` imports_offset `]() property imports\_offset → int Offset of imports table in chain data #### [` payload `]() property payload → memoryview Return the raw content of the command #### [` starts_offset `]() property starts\_offset → int offset of dyld\_chained\_starts\_in\_image in chain\_data #### [` symbols_format `]() property symbols\_format → int The compression algorithm (if any) used to store the symbols 0 means uncompressed while 1 means zlib compressed. As of the version v852.2 of dyld loader, it only supports **uncompressed** format #### [` symbols_offset `]() property symbols\_offset → int Offset of symbol strings in chain data --- ## [DyldExportsTrie Command]() ![Inheritance diagram of lief._lief.MachO.DyldExportsTrie](https://lief.re/doc/latest/_images/inheritance-a60d87c9075f7614206af79a252a390ec3fe75a8.png) ### [` lief.MachO.DyldExportsTrie `]() class lief.MachO.DyldExportsTrie Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class that represents the LC\_DYLD\_EXPORTS\_TRIE command In recent Mach-O binaries, this command replace the DyldInfo export trie buffer #### [` content `]() property content → memoryview The raw export trie #### [` data_offset `]() property data\_offset → int Offset of the trie in the binary. This offset should point in the \_\_LINKEDIT #### [` data_size `]() property data\_size → int Raw size of the trie #### [` exports `]() property exports → lief.MachO.DyldExportsTrie.it\_export\_info Iterator over the [`ExportInfo`]( "lief.MachO.ExportInfo") associated with this trie. #### [` show_export_trie `]() show\_export\_trie(*self*) → str Show the trie in a human-readable way --- ## [Code Signature Dir Command]() ![Inheritance diagram of lief._lief.MachO.CodeSignatureDir](https://lief.re/doc/latest/_images/inheritance-af26e08a02024dc8771a8a8086797fa3c5453a0e.png) ### [` lief.MachO.CodeSignatureDir `]() class lief.MachO.CodeSignatureDir Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") #### [` content `]() property content → memoryview The raw signature as a bytes stream #### [` data_offset `]() property data\_offset → int Offset in the binary where the signature starts #### [` data_size `]() property data\_size → int Size of the raw signature --- ## [Two Level Hints]() ![Inheritance diagram of lief._lief.MachO.TwoLevelHints](https://lief.re/doc/latest/_images/inheritance-9cd2c089731909ae639ac649ac29410d7ba973f5.png) ### [` lief.MachO.TwoLevelHints `]() class lief.MachO.TwoLevelHints Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class which represents the LC\_TWOLEVEL\_HINTS command #### [` content `]() property content → memoryview The original content as a bytes stream #### [` hints `]() property hints → lief.MachO.TwoLevelHints.it\_hints\_t --- ## [Linker Optimization Hint]() ![Inheritance diagram of lief._lief.MachO.LinkerOptHint](https://lief.re/doc/latest/_images/inheritance-c0b0ca7939674c9f5655997433175d9b3e40ced3.png) ### [` lief.MachO.LinkerOptHint `]() class lief.MachO.LinkerOptHint Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Class which represents the LC\_LINKER\_OPTIMIZATION\_HINT command #### [` content `]() property content → memoryview The raw payload #### [` data_offset `]() property data\_offset → int Offset in the binary where the payload starts #### [` data_size `]() property data\_size → int Size of the raw payload --- ## [UnknownCommand]() ![Inheritance diagram of lief._lief.MachO.UnknownCommand](https://lief.re/doc/latest/_images/inheritance-02b12d853e1dbabf3240463b555358fda26f7983.png) ### [` lief.MachO.UnknownCommand `]() class lief.MachO.UnknownCommand Bases: [`LoadCommand`]( "lief._lief.MachO.LoadCommand") Generic class when the command is not recognized by LIEF #### [` original_command `]() property original\_command → int --- ## [Stub]() ### [` lief.MachO.Stub `]() class lief.MachO.Stub(*self*, *target\_info: [lief.\_lief.MachO.Stub.target\_info\_t]( "lief._lief.MachO.Stub.target_info_t")*, *address: int*, *raw\_stub: collections.abc.Sequence[int]*) Bases: `object` This class represents a stub entry in sections like `__stubs,__auth_stubs`. It wraps assembly instructions which are used to access the *got* where the address of the symbol is resolved. Example: ```text 0000000236a3c1bc: ___memcpy_chk adrp x17, #0x241513aa8 add x17, x17, #0x241513aa8 ldr x16, [x17] braa x16, x17 ``` #### [` address `]() property address → int The virtual address where the stub is located #### [` raw `]() property raw → memoryview The (raw) instructions of this entry as a memory view of bytes #### [` target `]() property target → int | [lief.lief\_errors]( "lief.lief_errors") The address resolved by this stub. For instance, given this stub: ```default 0x3eec: adrp x16, #4096 0x3ef0: ldr x16, [x16, #24] 0x3ef4: br x16 ``` The function returns: `0x4018`. > **Warning** > > This function is only available with LIEF’s extended version #### [` target_info_ttarget_info_t `]() class target\_info\_t(*self*) **class target\_info\_t(*self*, *arg0: [lief.\_lief.MachO.Header.CPU\_TYPE]( "lief._lief.MachO.Header.CPU_TYPE")*, *arg1: int*, */*)** Bases: `object` ##### [` arch `]() property arch → [lief.MachO.Header.CPU\_TYPE]( "lief.MachO.Header.CPU_TYPE") ##### [` subtype `]() property subtype → int --- ## [Builder]() ### [` lief.MachO.Builder `]() class lief.MachO.Builder Bases: `object` Class used to reconstruct a Mach-O binary from its object representation #### [` config_t `]() class config\_t(*self*) Bases: `object` Interface to tweak the [`Builder`]( "lief.MachO.Builder") ##### [` linkedit `]() property linkedit → bool #### [` write `]() write(*\*args*) → [lief.ok\_t]( "lief.ok_t") | [lief.lief\_errors]( "lief.lief_errors") = <nanobind.nb\_func object at 0x7976e00> --- ## [Utilities]() ### [` lief.MachO.check_layoutlief.MachO.check_layout `]() lief.MachO.check\_layout(*\*args*) → tuple[bool, str] **lief.MachO.check\_layout(*file: [lief.\_lief.MachO.FatBinary]( "lief._lief.MachO.FatBinary")*) → tuple[bool, str]** Overloaded function. 1. `check_layout(file: lief._lief.MachO.Binary) -> tuple[bool, str]` Check the layout of the given Mach-O binary. It checks if it can be signed according to `cctools-921/libstuff/checkout.c` 2. `check_layout(file: lief._lief.MachO.FatBinary) -> tuple[bool, str]` > Check the layout of the given FAT Mach-O by checking individually the layout of the binaries embedded in the FAT. --- ## [Enums]() ### [MACHO\_TYPES]() #### [` lief.MachO.MACHO_TYPES `]() class lief.MachO.MACHO\_TYPES(*\*values*) Bases: `Enum` ##### [` CIGAM `]() CIGAM = 3472551422 ##### [` CIGAM_64 `]() CIGAM\_64 = 3489328638 ##### [` CIGAM_FAT `]() CIGAM\_FAT = 3199925962 ##### [` MAGIC `]() MAGIC = 4277009102 ##### [` MAGIC_64 `]() MAGIC\_64 = 4277009103 ##### [` MAGIC_FAT `]() MAGIC\_FAT = 3405691582 ##### [` NEURAL_MODEL `]() NEURAL\_MODEL = 3203398350 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.MACHO\_TYPES]( "lief.MachO.MACHO_TYPES") = <nanobind.nb\_func object> --- ### [X86\_RELOCATION]() #### [` lief.MachO.X86_RELOCATION `]() class lief.MachO.X86\_RELOCATION(*\*values*) Bases: `Enum` ##### [` LOCAL_SECTDIFF `]() LOCAL\_SECTDIFF = 4 ##### [` PAIR `]() PAIR = 1 ##### [` PB_LA_PTR `]() PB\_LA\_PTR = 3 ##### [` SECTDIFF `]() SECTDIFF = 2 ##### [` TLV `]() TLV = 5 ##### [` VANILLA `]() VANILLA = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.X86\_RELOCATION]( "lief.MachO.X86_RELOCATION") = <nanobind.nb\_func object> --- ### [X86\_64\_RELOCATION]() #### [` lief.MachO.X86_64_RELOCATION `]() class lief.MachO.X86\_64\_RELOCATION(*\*values*) Bases: `Enum` ##### [` BRANCH `]() BRANCH = 2 ##### [` GOT `]() GOT = 4 ##### [` GOT_LOAD `]() GOT\_LOAD = 3 ##### [` SIGNED `]() SIGNED = 1 ##### [` SIGNED_1 `]() SIGNED\_1 = 6 ##### [` SIGNED_2 `]() SIGNED\_2 = 7 ##### [` SIGNED_4 `]() SIGNED\_4 = 8 ##### [` SUBTRACTOR `]() SUBTRACTOR = 5 ##### [` TLV `]() TLV = 9 ##### [` UNSIGNED `]() UNSIGNED = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.X86\_64\_RELOCATION]( "lief.MachO.X86_64_RELOCATION") = <nanobind.nb\_func object> --- ### [PPC\_RELOCATION]() #### [` lief.MachO.PPC_RELOCATION `]() class lief.MachO.PPC\_RELOCATION(*\*values*) Bases: `Enum` ##### [` BR14 `]() BR14 = 2 ##### [` BR24 `]() BR24 = 3 ##### [` HA16 `]() HA16 = 6 ##### [` HA16_SECTDIFF `]() HA16\_SECTDIFF = 12 ##### [` HI16 `]() HI16 = 4 ##### [` HI16_SECTDIFF `]() HI16\_SECTDIFF = 10 ##### [` JBSR `]() JBSR = 13 ##### [` LO14 `]() LO14 = 7 ##### [` LO14_SECTDIFF `]() LO14\_SECTDIFF = 14 ##### [` LO16 `]() LO16 = 5 ##### [` LO16_SECTDIFF `]() LO16\_SECTDIFF = 11 ##### [` LOCAL_SECTDIFF `]() LOCAL\_SECTDIFF = 15 ##### [` PAIR `]() PAIR = 1 ##### [` PB_LA_PTR `]() PB\_LA\_PTR = 9 ##### [` SECTDIFF `]() SECTDIFF = 8 ##### [` VANILLA `]() VANILLA = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.PPC\_RELOCATION]( "lief.MachO.PPC_RELOCATION") = <nanobind.nb\_func object> --- ### [ARM\_RELOCATION]() #### [` lief.MachO.ARM_RELOCATION `]() class lief.MachO.ARM\_RELOCATION(*\*values*) Bases: `Enum` ##### [` BR24 `]() BR24 = 5 ##### [` HALF `]() HALF = 8 ##### [` HALF_SECTDIFF `]() HALF\_SECTDIFF = 9 ##### [` LOCAL_SECTDIFF `]() LOCAL\_SECTDIFF = 3 ##### [` PAIR `]() PAIR = 1 ##### [` PB_LA_PTR `]() PB\_LA\_PTR = 4 ##### [` SECTDIFF `]() SECTDIFF = 2 ##### [` THUMB_32BIT_BRANCH `]() THUMB\_32BIT\_BRANCH = 7 ##### [` THUMB_RELOC_BR22 `]() THUMB\_RELOC\_BR22 = 6 ##### [` VANILLA `]() VANILLA = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.ARM\_RELOCATION]( "lief.MachO.ARM_RELOCATION") = <nanobind.nb\_func object> --- ### [ARM64\_RELOCATION]() #### [` lief.MachO.ARM64_RELOCATION `]() class lief.MachO.ARM64\_RELOCATION(*\*values*) Bases: `Enum` ##### [` ADDEND `]() ADDEND = 10 ##### [` BRANCH26 `]() BRANCH26 = 2 ##### [` GOT_LOAD_PAGE21 `]() GOT\_LOAD\_PAGE21 = 5 ##### [` GOT_LOAD_PAGEOFF12 `]() GOT\_LOAD\_PAGEOFF12 = 6 ##### [` PAGE21 `]() PAGE21 = 3 ##### [` PAGEOFF12 `]() PAGEOFF12 = 4 ##### [` POINTER_TO_GOT `]() POINTER\_TO\_GOT = 7 ##### [` SUBTRACTOR `]() SUBTRACTOR = 1 ##### [` TLVP_LOAD_PAGE21 `]() TLVP\_LOAD\_PAGE21 = 8 ##### [` TLVP_LOAD_PAGEOFF12 `]() TLVP\_LOAD\_PAGEOFF12 = 9 ##### [` UNSIGNED `]() UNSIGNED = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.ARM64\_RELOCATION]( "lief.MachO.ARM64_RELOCATION") = <nanobind.nb\_func object> ### [DYLD\_CHAINED\_FORMAT]() #### [` lief.MachO.DYLD_CHAINED_FORMAT `]() class lief.MachO.DYLD\_CHAINED\_FORMAT(*\*values*) Bases: `Enum` ##### [` IMPORT `]() IMPORT = 1 ##### [` IMPORT_ADDEND `]() IMPORT\_ADDEND = 2 ##### [` IMPORT_ADDEND64 `]() IMPORT\_ADDEND64 = 3 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.DYLD\_CHAINED\_FORMAT]( "lief.MachO.DYLD_CHAINED_FORMAT") = <nanobind.nb\_func object> ### [DYLD\_CHAINED\_PTR\_FORMAT]() #### [` lief.MachO.DYLD_CHAINED_PTR_FORMAT `]() class lief.MachO.DYLD\_CHAINED\_PTR\_FORMAT(*\*values*) Bases: `Enum` ##### [` NONE `]() NONE = 0 ##### [` PTR_32 `]() PTR\_32 = 3 ##### [` PTR_32_CACHE `]() PTR\_32\_CACHE = 4 ##### [` PTR_32_FIRMWARE `]() PTR\_32\_FIRMWARE = 5 ##### [` PTR_64 `]() PTR\_64 = 2 ##### [` PTR_64_KERNEL_CACHE `]() PTR\_64\_KERNEL\_CACHE = 8 ##### [` PTR_64_OFFSET `]() PTR\_64\_OFFSET = 6 ##### [` PTR_ARM64E `]() PTR\_ARM64E = 1 ##### [` PTR_ARM64E_FIRMWARE `]() PTR\_ARM64E\_FIRMWARE = 10 ##### [` PTR_ARM64E_KERNEL `]() PTR\_ARM64E\_KERNEL = 7 ##### [` PTR_ARM64E_SEGMENTED `]() PTR\_ARM64E\_SEGMENTED = 14 ##### [` PTR_ARM64E_SHARED_CACHE `]() PTR\_ARM64E\_SHARED\_CACHE = 13 ##### [` PTR_ARM64E_USERLAND `]() PTR\_ARM64E\_USERLAND = 9 ##### [` PTR_ARM64E_USERLAND24 `]() PTR\_ARM64E\_USERLAND24 = 12 ##### [` PTR_X86_64_KERNEL_CACHE `]() PTR\_X86\_64\_KERNEL\_CACHE = 11 ##### [` from_value `]() from\_value(*arg: int*) → [lief.MachO.DYLD\_CHAINED\_PTR\_FORMAT]( "lief.MachO.DYLD_CHAINED_PTR_FORMAT") = <nanobind.nb\_func object> --- documentID: "91f1c4ea2ae5a1866fe57037003d09c5608127950be3324a9fdbc211673b72e5" docname: "formats/macho/rust" title: "Mach-O Rust API - LIEF Documentation" description: "Mach-O Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/macho/rust.html" markdownURL: "https://lief.re/doc/latest/formats/macho/rust.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "1c7562925959d13eea9b20e47284b58791493c0fa42e6e210946198b780f19a5" --- # [Rust]() > **Note** > > Please check: [`lief::macho`]() --- documentID: "022ea70514310c02b0dca00aca48908628e5f3ae01f867a7242d83eb9fa9953e" docname: "formats/pe/cpp" title: "PE C++ API - LIEF Documentation" description: "PE C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/pe/cpp.html" markdownURL: "https://lief.re/doc/latest/formats/pe/cpp.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "58de60546f782310df4050f4f47b0d0aba0f5b04a1b01949e50ab60a72b82757" --- # [C++]() ## [Parser]() ### [` Parser `]() class Parser : public LIEF::[Parser]( "LIEF::Parser") Main interface to parse PE binaries. In particular, the **static** [Parser::parse]() functions should be used to get a [LIEF::PE::Binary]() instance. Public Functions #### [` operator= `]() [Parser]( "LIEF::PE::Parser") &operator=(const [Parser]( "LIEF::PE::Parser") &copy) = delete #### [` Parser `]() Parser(const [Parser]( "LIEF::PE::Parser::Parser") &copy) = delete #### [` find_coff_string `]() COFF::[String]( "LIEF::COFF::String") \*find\_coff\_string(uint32\_t offset) const #### [` find_exception_info `]() inline [ExceptionInfo]( "LIEF::PE::ExceptionInfo") \*find\_exception\_info(uint32\_t rva) const #### [` bin `]() inline const [Binary]( "LIEF::PE::Binary") &bin() const #### [` bin `]() inline [Binary]( "LIEF::PE::Binary") &bin() #### [` stream `]() inline [BinaryStream]( "LIEF::BinaryStream") &stream() #### [` config `]() inline const [ParserConfig]( "LIEF::PE::ParserConfig") &config() const #### [` memoize `]() void memoize([ExceptionInfo]( "LIEF::PE::ExceptionInfo") &info) #### [` memoize `]() void memoize(COFF::[String]( "LIEF::COFF::String") str) #### [` add_non_resolved `]() inline void add\_non\_resolved([ExceptionInfo]( "LIEF::PE::ExceptionInfo") &info, uint32\_t target) #### [` stream_from_rva `]() std::unique\_ptr<[SpanStream]( "LIEF::SpanStream")> stream\_from\_rva(uint32\_t rva, size\_t size = 0) #### [` record_relocation `]() void record\_relocation(uint32\_t rva, span<const uint8\_t> data) #### [` record_delta_relocation `]() [ok\_error\_t]( "LIEF::ok_error_t") record\_delta\_relocation(uint32\_t rva, int64\_t delta, size\_t size) Public Static Functions #### [` is_valid_import_name `]() static bool is\_valid\_import\_name(std::string\_view name) Check if the given name is a valid import. This check verifies that: 1. The name is not too large or empty (cf. [https://stackoverflow.com/a/23340781]()) 2. All the characters are printable #### [` is_valid_dll_name `]() static bool is\_valid\_dll\_name(std::string\_view name) Check if the given name is a valid DLL name. This check verifies that: 1. The name of the DLL is at least 4 characters long 2. All the characters are printable #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::PE::Binary")> parse(std::string\_view filename, const [ParserConfig]( "LIEF::PE::ParserConfig") &conf = [ParserConfig]( "LIEF::PE::ParserConfig")::[default\_conf]( "LIEF::PE::ParserConfig::default_conf")()) Parse a PE binary from the given filename. #### [` PathTparse `]() template<class PathT, enable\_if\_path\_t<[PathT]( "LIEF::PE::Parser::parse::PathT")> = 0> static inline std::unique\_ptr<[Binary]( "LIEF::PE::Binary")> parse(const [PathT]( "LIEF::PE::Parser::parse::PathT") &filename, const [ParserConfig]( "LIEF::PE::ParserConfig") &conf = [ParserConfig]( "LIEF::PE::ParserConfig")::[default\_conf]( "LIEF::PE::ParserConfig::default_conf")()) Same as [parse(std::string\_view, const ParserConfig&)]() but the file is given as a `std::filesystem::path`. #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::PE::Binary")> parse(std::vector<uint8\_t> data, const [ParserConfig]( "LIEF::PE::ParserConfig") &conf = [ParserConfig]( "LIEF::PE::ParserConfig")::[default\_conf]( "LIEF::PE::ParserConfig::default_conf")()) Parse a PE binary from a data buffer. #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::PE::Binary")> parse(const uint8\_t \*buffer, size\_t size, const [ParserConfig]( "LIEF::PE::ParserConfig") &conf = [ParserConfig]( "LIEF::PE::ParserConfig")::[default\_conf]( "LIEF::PE::ParserConfig::default_conf")()) #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::PE::Binary")> parse(std::unique\_ptr<[BinaryStream]( "LIEF::BinaryStream")> stream, const [ParserConfig]( "LIEF::PE::ParserConfig") &conf = [ParserConfig]( "LIEF::PE::ParserConfig")::[default\_conf]( "LIEF::PE::ParserConfig::default_conf")()) Parse a PE binary from the given [BinaryStream](). #### [` parse_from_memory `]() static std::unique\_ptr<[Binary]( "LIEF::PE::Binary")> parse\_from\_memory(uintptr\_t address, const [ParserConfig]( "LIEF::PE::ParserConfig") &config = [ParserConfig]( "LIEF::PE::ParserConfig")::[default\_conf]( "LIEF::PE::ParserConfig::default_conf")()) Parse the PE binary at the given memory address. #### [` parse_from_memory `]() static std::unique\_ptr<[Binary]( "LIEF::PE::Binary")> parse\_from\_memory(uintptr\_t address, size\_t size, const [ParserConfig]( "LIEF::PE::ParserConfig") &config = [ParserConfig]( "LIEF::PE::ParserConfig")::[default\_conf]( "LIEF::PE::ParserConfig::default_conf")()) Parse the PE binary at the given memory address and with the given size. #### [` parse_from_dump `]() static std::unique\_ptr<[Binary]( "LIEF::PE::Binary")> parse\_from\_dump(std::string\_view filepath, uint64\_t addr, const [ParserConfig]( "LIEF::PE::ParserConfig") &config = [ParserConfig]( "LIEF::PE::ParserConfig")::[default\_conf]( "LIEF::PE::ParserConfig::default_conf")()) Parse a PE binary from a memory dump located on disk. A dump is a raw capture of the process memory that was mapped starting at the virtual address `addr`. This is typically used to parse a PE image that has been dumped from memory (e.g. from a debugger or a runtime hook). **Parameters:** - **filepath** – **[in]** Path to the file that contains the memory dump - **addr** – **[in]** Virtual address at which the dump was mapped - **config** – **[in]** Optional configuration for the parser #### [` PathTparse_from_dump `]() template<class PathT, enable\_if\_path\_t<[PathT]( "LIEF::PE::Parser::parse_from_dump::PathT")> = 0> static inline std::unique\_ptr<[Binary]( "LIEF::PE::Binary")> parse\_from\_dump(const [PathT]( "LIEF::PE::Parser::parse_from_dump::PathT") &filepath, uint64\_t addr, const [ParserConfig]( "LIEF::PE::ParserConfig") &config = [ParserConfig]( "LIEF::PE::ParserConfig")::[default\_conf]( "LIEF::PE::ParserConfig::default_conf")()) Same as [parse\_from\_dump(std::string\_view, uint64\_t, const ParserConfig&)]() but the dump file is given as a `std::filesystem::path`. #### [` parse_from_dump `]() static std::unique\_ptr<[Binary]( "LIEF::PE::Binary")> parse\_from\_dump([BinaryStream]( "LIEF::BinaryStream") &stream, uint64\_t addr, const [ParserConfig]( "LIEF::PE::ParserConfig") &config = [ParserConfig]( "LIEF::PE::ParserConfig")::[default\_conf]( "LIEF::PE::ParserConfig::default_conf")()) Same as [parse\_from\_dump(std::string\_view, uint64\_t, const ParserConfig&)]() but the dump is wrapped in the given **non-owned** stream. #### [` parse_from_dump `]() static std::unique\_ptr<[Binary]( "LIEF::PE::Binary")> parse\_from\_dump(std::unique\_ptr<[BinaryStream]( "LIEF::BinaryStream")> stream, uint64\_t addr, const [ParserConfig]( "LIEF::PE::ParserConfig") &config = [ParserConfig]( "LIEF::PE::ParserConfig")::[default\_conf]( "LIEF::PE::ParserConfig::default_conf")()) Same as [parse\_from\_dump(std::string\_view, uint64\_t, const ParserConfig&)]() but the dump is wrapped in the given **owned** stream. Public Static Attributes #### [` MAX_DATA_SIZE `]() static size\_t MAX\_DATA\_SIZE = 3\_GB Maximum size of the data read. #### [` MAX_TLS_CALLBACKS `]() static size\_t MAX\_TLS\_CALLBACKS = 3000 #### [` MAX_IMPORT_ENTRIES `]() static size\_t MAX\_IMPORT\_ENTRIES = 0x10000 #### [` MAX_IMPORT_NAME_SIZE `]() static size\_t MAX\_IMPORT\_NAME\_SIZE = 0x1000 #### [` MAX_DLL_NAME_SIZE `]() static size\_t MAX\_DLL\_NAME\_SIZE = 255 #### [` MAX_PADDING_SIZE `]() static size\_t MAX\_PADDING\_SIZE = 1\_GB Max size of the padding section. ### [` ParserConfig `]() struct ParserConfig This structure is used to configure the behavior of the PE [Parser]() ([PE::Parser]()). Public Functions #### [` to_string `]() std::string to\_string() const Public Members #### [` parse_signature `]() bool parse\_signature = true Whether to parse the PE Authenticode signature. #### [` parse_exports `]() bool parse\_exports = true Whether to parse the PE [Export]() Directory. #### [` parse_imports `]() bool parse\_imports = true Whether to parse the PE [Import]() Directory. #### [` parse_rsrc `]() bool parse\_rsrc = true Whether to parse the PE resources tree. #### [` parse_reloc `]() bool parse\_reloc = true Whether to parse PE relocations. #### [` parse_exceptions `]() bool parse\_exceptions = false Whether to parse in-depth exception metadata. This option is disabled by default because it can introduce significant parsing overhead. #### [` parse_arm64x_binary `]() bool parse\_arm64x\_binary = false Whether to parse nested ARM64X binaries. This option is disabled by default because it can introduce significant parsing overhead. #### [` rebase `]() std::optional<uint64\_t> rebase If set, this value holds the original image base from which the binary should be rebased. This is used to *undo* relocations and IAT bindings when parsing a PE loaded in memory. Public Static Functions #### [` default_conf `]() static inline const [ParserConfig]( "LIEF::PE::ParserConfig") &default\_conf() Returns the default configuration for the PE [Parser](). #### [` all `]() static inline [ParserConfig]( "LIEF::PE::ParserConfig") all() Returns a configuration that enables all optional parsing features. Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [ParserConfig]( "LIEF::PE::ParserConfig") &config) --- ## [Binary]() ### [` Binary `]() class Binary : public LIEF::[Binary]( "LIEF::Binary") Class which represents a PE binary This is the main interface to manage and modify a PE executable. Public Types #### [` sections_t `]() using sections\_t = std::vector<std::unique\_ptr<[Section]( "LIEF::PE::Section")>> Internal container for storing PE’s [Section](). #### [` it_sections `]() using it\_sections = [ref\_iterator]( "LIEF::ref_iterator")<[sections\_t]( "LIEF::PE::Binary::sections_t")&, [Section]( "LIEF::PE::Section")\*> Iterator that outputs [Section]()& object. #### [` it_const_sections `]() using it\_const\_sections = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [sections\_t]( "LIEF::PE::Binary::sections_t")&, const [Section]( "LIEF::PE::Section")\*> Iterator that outputs const [Section]()& object. #### [` data_directories_t `]() using data\_directories\_t = std::vector<std::unique\_ptr<[DataDirectory]( "LIEF::PE::DataDirectory")>> Internal container for storing PE’s [DataDirectory](). #### [` it_data_directories `]() using it\_data\_directories = [ref\_iterator]( "LIEF::ref_iterator")<[data\_directories\_t]( "LIEF::PE::Binary::data_directories_t")&, [DataDirectory]( "LIEF::PE::DataDirectory")\*> Iterator that outputs [DataDirectory]()&. #### [` it_const_data_directories `]() using it\_const\_data\_directories = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [data\_directories\_t]( "LIEF::PE::Binary::data_directories_t")&, const [DataDirectory]( "LIEF::PE::DataDirectory")\*> Iterator that outputs const [DataDirectory]()&. #### [` relocations_t `]() using relocations\_t = std::vector<std::unique\_ptr<[Relocation]( "LIEF::PE::Relocation")>> Internal container for storing PE’s [Relocation](). #### [` it_relocations `]() using it\_relocations = [ref\_iterator]( "LIEF::ref_iterator")<[relocations\_t]( "LIEF::PE::Binary::relocations_t")&, [Relocation]( "LIEF::PE::Relocation")\*> Iterator that outputs [Relocation]()&. #### [` it_const_relocations `]() using it\_const\_relocations = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [relocations\_t]( "LIEF::PE::Binary::relocations_t")&, const [Relocation]( "LIEF::PE::Relocation")\*> Iterator that outputs const [Relocation]()&. #### [` imports_t `]() using imports\_t = std::vector<std::unique\_ptr<[Import]( "LIEF::PE::Import")>> Internal container for storing PE’s [Import](). #### [` it_imports `]() using it\_imports = [ref\_iterator]( "LIEF::ref_iterator")<[imports\_t]( "LIEF::PE::Binary::imports_t")&, [Import]( "LIEF::PE::Import")\*> Iterator that outputs [Import]()&. #### [` it_const_imports `]() using it\_const\_imports = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [imports\_t]( "LIEF::PE::Binary::imports_t")&, const [Import]( "LIEF::PE::Import")\*> Iterator that outputs const [Import]()&. #### [` delay_imports_t `]() using delay\_imports\_t = std::vector<std::unique\_ptr<[DelayImport]( "LIEF::PE::DelayImport")>> Internal container for storing PE’s [DelayImport](). #### [` it_delay_imports `]() using it\_delay\_imports = [ref\_iterator]( "LIEF::ref_iterator")<[delay\_imports\_t]( "LIEF::PE::Binary::delay_imports_t")&, [DelayImport]( "LIEF::PE::DelayImport")\*> Iterator that outputs [DelayImport]()&. #### [` it_const_delay_imports `]() using it\_const\_delay\_imports = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [delay\_imports\_t]( "LIEF::PE::Binary::delay_imports_t")&, const [DelayImport]( "LIEF::PE::DelayImport")\*> Iterator that outputs const [DelayImport]()&. #### [` debug_entries_t `]() using debug\_entries\_t = std::vector<std::unique\_ptr<[Debug]( "LIEF::PE::Debug")>> Internal container for storing [Debug]() information. #### [` it_debug_entries `]() using it\_debug\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[debug\_entries\_t]( "LIEF::PE::Binary::debug_entries_t")&, [Debug]( "LIEF::PE::Debug")\*> Iterator that outputs [Debug]()&. #### [` it_const_debug_entries `]() using it\_const\_debug\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [debug\_entries\_t]( "LIEF::PE::Binary::debug_entries_t")&, const [Debug]( "LIEF::PE::Debug")\*> Iterator that outputs const [Debug]()&. #### [` symbols_t `]() using symbols\_t = std::vector<std::unique\_ptr<COFF::[Symbol]( "LIEF::COFF::Symbol")>> Internal container for storing COFF Symbols. #### [` it_symbols `]() using it\_symbols = [ref\_iterator]( "LIEF::ref_iterator")<[symbols\_t]( "LIEF::PE::Binary::symbols_t")&, COFF::[Symbol]( "LIEF::COFF::Symbol")\*> Iterator that outputs [Symbol]()&. #### [` it_const_symbols `]() using it\_const\_symbols = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [symbols\_t]( "LIEF::PE::Binary::symbols_t")&, const COFF::[Symbol]( "LIEF::COFF::Symbol")\*> Iterator that outputs const [Symbol]()&. #### [` strings_table_t `]() using strings\_table\_t = std::vector<COFF::[String]( "LIEF::COFF::String")> Internal container for storing strings. #### [` it_strings_table `]() using it\_strings\_table = [ref\_iterator]( "LIEF::ref_iterator")<[strings\_table\_t]( "LIEF::PE::Binary::strings_table_t")&> Iterator that outputs [COFF::String]()&. #### [` it_const_strings_table `]() using it\_const\_strings\_table = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [strings\_table\_t]( "LIEF::PE::Binary::strings_table_t")&> Iterator that outputs const [COFF::String]()&. #### [` signatures_t `]() using signatures\_t = std::vector<[Signature]( "LIEF::PE::Signature")> Internal container for storing PE’s authenticode [Signature](). #### [` it_signatures `]() using it\_signatures = [ref\_iterator]( "LIEF::ref_iterator")<[signatures\_t]( "LIEF::PE::Binary::signatures_t")&> Iterator that outputs [Signature]()&. #### [` it_const_signatures `]() using it\_const\_signatures = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [signatures\_t]( "LIEF::PE::Binary::signatures_t")&> Iterator that outputs const [Signature]()&. #### [` exceptions_t `]() using exceptions\_t = std::vector<std::unique\_ptr<[ExceptionInfo]( "LIEF::PE::ExceptionInfo")>> Internal container for storing runtime function associated with exceptions. #### [` it_exceptions `]() using it\_exceptions = [ref\_iterator]( "LIEF::ref_iterator")<[exceptions\_t]( "LIEF::PE::Binary::exceptions_t")&, [ExceptionInfo]( "LIEF::PE::ExceptionInfo")\*> Iterator that outputs [ExceptionInfo]()&. #### [` it_const_exceptions `]() using it\_const\_exceptions = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [exceptions\_t]( "LIEF::PE::Binary::exceptions_t")&, const [ExceptionInfo]( "LIEF::PE::ExceptionInfo")\*> Iterator that outputs const [ExceptionInfo]()&. Public Functions #### [` Binary `]() Binary() #### [` ~Binary `]() ~Binary() override #### [` type `]() inline [PE\_TYPE]( "LIEF::PE::PE_TYPE") type() const Return `PE32` or `PE32+`. #### [` rva_to_offset `]() uint64\_t rva\_to\_offset(uint64\_t RVA) const Convert a Relative Virtual Address into an offset. The conversion is performed by looking for the section that encompasses the provided RVA. #### [` va_to_offset `]() inline uint64\_t va\_to\_offset(uint64\_t VA) const Convert the **absolute** virtual address into an offset. > **See also** > > [rva\_to\_offset]() #### [` offset_to_virtual_address `]() virtual [result]( "LIEF::result")<uint64\_t> offset\_to\_virtual\_address(uint64\_t offset, uint64\_t slide = 0) const override Convert the given offset into an absolute virtual address. **Parameters:** - **offset** – **[in]** The offset to convert. - **slide** – **[in]** If not 0, it will replace the default base address (if any) #### [` offset_to_rva `]() uint64\_t offset\_to\_rva(uint64\_t offset) const Convert the given offset into a relative virtual address (RVA). #### [` imagebase `]() inline virtual uint64\_t imagebase() const override Return binary’s imagebase. `0` if not relevant. The value is the same as those returned by [OptionalHeader::imagebase]() #### [` section_from_offset `]() inline [Section]( "LIEF::PE::Section") \*section\_from\_offset(uint64\_t offset) Find the section that encompasses the given offset. If no section can be found, return a nullptr #### [` section_from_offset `]() const [Section]( "LIEF::PE::Section") \*section\_from\_offset(uint64\_t offset) const #### [` section_from_rva `]() inline [Section]( "LIEF::PE::Section") \*section\_from\_rva(uint64\_t virtual\_address) Find the section that encompasses the given RVA. If no section can be found, return a nullptr #### [` section_from_rva `]() const [Section]( "LIEF::PE::Section") \*section\_from\_rva(uint64\_t virtual\_address) const #### [` sections `]() inline [it\_sections]( "LIEF::PE::Binary::it_sections") sections() Return an iterator over the PE’s [Section](). #### [` sections `]() inline [it\_const\_sections]( "LIEF::PE::Binary::it_const_sections") sections() const #### [` dos_header `]() inline [DosHeader]( "LIEF::PE::DosHeader") &dos\_header() Return a reference to the [PE::DosHeader]() object. #### [` dos_header `]() inline const [DosHeader]( "LIEF::PE::DosHeader") &dos\_header() const #### [` header `]() inline [Header]( "LIEF::PE::Header") &header() Return a reference to the [PE::Header]() object. #### [` header `]() inline const [Header]( "LIEF::PE::Header") &header() const #### [` optional_header `]() inline [OptionalHeader]( "LIEF::PE::OptionalHeader") &optional\_header() [Header]() that follows the [header()](). It is named optional from the COFF specification but it is mandatory in a PE file. #### [` optional_header `]() inline const [OptionalHeader]( "LIEF::PE::OptionalHeader") &optional\_header() const #### [` compute_checksum `]() uint32\_t compute\_checksum() const Re-compute the value of [OptionalHeader::checksum](). If both values do not match, it could mean that the binary has been modified after the compilation. This value is computed by LIEF for the current binary object. #### [` virtual_size `]() virtual uint64\_t virtual\_size() const override Compute the binary’s virtual size. It should match [OptionalHeader::sizeof\_image](). #### [` sizeof_headers `]() uint32\_t sizeof\_headers() const Compute the size of all the headers. #### [` tls `]() inline [TLS]( "LIEF::PE::TLS") \*tls() Return a reference to the [TLS]() object. #### [` tls `]() inline const [TLS]( "LIEF::PE::TLS") \*tls() const #### [` tls `]() [TLS]( "LIEF::PE::TLS") &tls(const [TLS]( "LIEF::PE::TLS") &tls) Set a [TLS]() object in the current [Binary](). #### [` has_tls `]() inline bool has\_tls() const Check if the current binary has a [TLS]() object. #### [` remove_tls `]() void remove\_tls() Remove the [TLS]() from the binary. #### [` has_imports `]() inline bool has\_imports() const Check if the current binary contains imports. > **See also** > > [Import]() #### [` has_signatures `]() inline bool has\_signatures() const Check if the current binary contains signatures. > **See also** > > [signatures]() #### [` has_exports `]() inline bool has\_exports() const Check if the current binary has exports. > **See also** > > [Export]() #### [` has_resources `]() inline bool has\_resources() const Check if the current binary has resources. #### [` has_exceptions `]() inline bool has\_exceptions() const Check if the current binary has exceptions. #### [` has_relocations `]() inline bool has\_relocations() const Check if the current binary has relocations. > **See also** > > [Relocation]() #### [` has_debug `]() inline bool has\_debug() const Check if the current binary contains debug information. #### [` has_configuration `]() inline bool has\_configuration() const Check if the current binary has a load configuration. #### [` is_reproducible_build `]() bool is\_reproducible\_build() const Check if the current binary is *reproducible build*, replacing timestamps by a compile hash. > **See also** > > [Repro]() #### [` signatures `]() inline [it\_const\_signatures]( "LIEF::PE::Binary::it_const_signatures") signatures() const Return an iterator over the [Signature]() object(s) if the binary is signed. #### [` signatures `]() inline [it\_signatures]( "LIEF::PE::Binary::it_signatures") signatures() #### [` verify_signature `]() [Signature]( "LIEF::PE::Signature")::[VERIFICATION\_FLAGS]( "LIEF::PE::Signature::VERIFICATION_FLAGS") verify\_signature([Signature]( "LIEF::PE::Signature")::[VERIFICATION\_CHECKS]( "LIEF::PE::Signature::VERIFICATION_CHECKS") checks = [Signature]( "LIEF::PE::Signature")::[VERIFICATION\_CHECKS]( "LIEF::PE::Signature::VERIFICATION_CHECKS")::[DEFAULT]( "LIEF::PE::Signature::VERIFICATION_CHECKS::DEFAULT")) const Verify the binary against the embedded signature(s) (if any) First, it checks that the embedded signatures are correct (c.f. [Signature::check]()) and then, it checks that the authentihash matches [ContentInfo::digest](). One can tweak the verification process with the [Signature::VERIFICATION\_CHECKS]() flags > **See also** > > [LIEF::PE::Signature::check]() #### [` verify_signature `]() [Signature]( "LIEF::PE::Signature")::[VERIFICATION\_FLAGS]( "LIEF::PE::Signature::VERIFICATION_FLAGS") verify\_signature(const [Signature]( "LIEF::PE::Signature") &sig, [Signature]( "LIEF::PE::Signature")::[VERIFICATION\_CHECKS]( "LIEF::PE::Signature::VERIFICATION_CHECKS") checks = [Signature]( "LIEF::PE::Signature")::[VERIFICATION\_CHECKS]( "LIEF::PE::Signature::VERIFICATION_CHECKS")::[DEFAULT]( "LIEF::PE::Signature::VERIFICATION_CHECKS::DEFAULT")) const Verify the binary with the [Signature]() object provided in the first parameter. It can be used to verify a detached signature: ```cpp result detached = LIEF::PE::SignatureParser::parse("sig.pkcs7") if (detached) { binary->verify_signature(detached.value()); } ``` #### [` authentihash `]() std::vector<uint8\_t> authentihash([ALGORITHMS]( "LIEF::PE::ALGORITHMS") algo) const Compute the authentihash according to the algorithm provided in the first parameter. #### [` get_export `]() inline [Export]( "LIEF::PE::Export") \*get\_export() Return the [Export]() object. #### [` get_export `]() inline const [Export]( "LIEF::PE::Export") \*get\_export() const #### [` set_export `]() [Export]( "LIEF::PE::Export") &set\_export(const [Export]( "LIEF::PE::Export") &export\_table) #### [` symbols `]() inline [it\_symbols]( "LIEF::PE::Binary::it_symbols") symbols() Return binary Symbols. #### [` symbols `]() inline [it\_const\_symbols]( "LIEF::PE::Binary::it_const_symbols") symbols() const #### [` coff_string_table `]() inline [it\_const\_strings\_table]( "LIEF::PE::Binary::it_const_strings_table") coff\_string\_table() const Iterator over the strings located in the COFF string table. #### [` coff_string_table `]() inline [it\_strings\_table]( "LIEF::PE::Binary::it_strings_table") coff\_string\_table() #### [` find_coff_string `]() inline COFF::[String]( "LIEF::COFF::String") \*find\_coff\_string(uint32\_t offset) Try to find the COFF string at the given offset in the COFF string table. > **Warning** > > This offset must include the first 4 bytes holding the size of the table. Hence, the first string starts at the offset 4. #### [` find_coff_string `]() inline const COFF::[String]( "LIEF::COFF::String") \*find\_coff\_string(uint32\_t offset) const #### [` resources `]() inline [ResourceNode]( "LIEF::PE::ResourceNode") \*resources() Return resources as a tree or a nullptr if there is no resources. #### [` resources `]() inline const [ResourceNode]( "LIEF::PE::ResourceNode") \*resources() const #### [` set_resources `]() [ResourceNode]( "LIEF::PE::ResourceNode") \*set\_resources(const [ResourceNode]( "LIEF::PE::ResourceNode") &root) Change or set the current resource tree with the new one provided in parameter. #### [` set_resources `]() [ResourceNode]( "LIEF::PE::ResourceNode") \*set\_resources(std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")> root) #### [` resources_manager `]() [result]( "LIEF::result")<[ResourcesManager]( "LIEF::PE::ResourcesManager")> resources\_manager() const Return the [ResourcesManager]() (class to manage resources more easily than the tree one). #### [` get_section `]() inline [Section]( "LIEF::PE::Section") \*get\_section(const std::string &name) Return binary’s section from its name. If the section can’t be found, return a nullptr. **Parameters:** **name** – **[in]** Name of the [Section]() #### [` get_section `]() const [Section]( "LIEF::PE::Section") \*get\_section(const std::string &name) const #### [` import_section `]() const [Section]( "LIEF::PE::Section") \*import\_section() const Return the section associated with import table or a nullptr if the binary does not have an import table. #### [` import_section `]() inline [Section]( "LIEF::PE::Section") \*import\_section() #### [` remove_section `]() virtual void remove\_section(const std::string &name, bool clear = false) override Delete the section with the given name. **Parameters:** - **name** – **[in]** Name of section to delete - **clear** – **[in]** if `true` clear the section’s content with 0 before removing (default: `false`) #### [` remove `]() void remove(const [Section]( "LIEF::PE::Section") &section, bool clear = false) Remove the given section. > **See also** > > [remove\_section]() #### [` add_section `]() [Section]( "LIEF::PE::Section") \*add\_section(const [Section]( "LIEF::PE::Section") &section) Add a section to the binary and return the section added. #### [` relocations `]() inline [it\_relocations]( "LIEF::PE::Binary::it_relocations") relocations() Return an iterator over the PE’s [Relocation](). #### [` relocations `]() inline [it\_const\_relocations]( "LIEF::PE::Binary::it_const_relocations") relocations() const #### [` add_relocation `]() [Relocation]( "LIEF::PE::Relocation") &add\_relocation(const [Relocation]( "LIEF::PE::Relocation") &relocation) Add a new PE [Relocation](). #### [` remove_all_relocations `]() void remove\_all\_relocations() Remove all the relocations. #### [` data_directories `]() inline [it\_data\_directories]( "LIEF::PE::Binary::it_data_directories") data\_directories() Return an iterator over the [DataDirectory]() present in the [Binary](). #### [` data_directories `]() inline [it\_const\_data\_directories]( "LIEF::PE::Binary::it_const_data_directories") data\_directories() const #### [` data_directory `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*data\_directory([DataDirectory]( "LIEF::PE::DataDirectory")::[TYPES]( "LIEF::PE::DataDirectory::TYPES") type) Return the [DataDirectory]() with the given type (or index). #### [` data_directory `]() const [DataDirectory]( "LIEF::PE::DataDirectory") \*data\_directory([DataDirectory]( "LIEF::PE::DataDirectory")::[TYPES]( "LIEF::PE::DataDirectory::TYPES") type) const #### [` has `]() inline bool has([DataDirectory]( "LIEF::PE::DataDirectory")::[TYPES]( "LIEF::PE::DataDirectory::TYPES") type) const Check if the current binary has the given [DataDirectory::TYPES](). #### [` debug `]() inline [it\_debug\_entries]( "LIEF::PE::Binary::it_debug_entries") debug() Return an iterator over the [Debug]() entries. #### [` debug `]() inline [it\_const\_debug\_entries]( "LIEF::PE::Binary::it_const_debug_entries") debug() const #### [` add_debug_info `]() [Debug]( "LIEF::PE::Debug") \*add\_debug\_info(const [Debug]( "LIEF::PE::Debug") &entry) Add a new debug entry. #### [` remove_debug `]() bool remove\_debug(const [Debug]( "LIEF::PE::Debug") &entry) Remove a specific debug entry. #### [` clear_debug `]() bool clear\_debug() Remove all debug info from the binary. #### [` codeview_pdb `]() const [CodeViewPDB]( "LIEF::PE::CodeViewPDB") \*codeview\_pdb() const Return the [CodeViewPDB]() object if present. #### [` codeview_pdb `]() inline [CodeViewPDB]( "LIEF::PE::CodeViewPDB") \*codeview\_pdb() #### [` load_configuration `]() inline const [LoadConfiguration]( "LIEF::PE::LoadConfiguration") \*load\_configuration() const Return the [LoadConfiguration]() object or a nullptr if the binary does not use the [LoadConfiguration](). #### [` load_configuration `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") \*load\_configuration() #### [` overlay `]() inline span<const uint8\_t> overlay() const Return the overlay content. #### [` overlay `]() inline span<uint8\_t> overlay() #### [` overlay_offset `]() inline uint64\_t overlay\_offset() const Return the original overlay offset. #### [` dos_stub `]() inline span<const uint8\_t> dos\_stub() const Return the DOS stub content. #### [` dos_stub `]() inline span<uint8\_t> dos\_stub() #### [` dos_stub `]() inline void dos\_stub(std::vector<uint8\_t> content) Update the DOS stub content. #### [` rich_header `]() inline [RichHeader]( "LIEF::PE::RichHeader") \*rich\_header() Return a reference to the [RichHeader]() object. #### [` rich_header `]() inline const [RichHeader]( "LIEF::PE::RichHeader") \*rich\_header() const #### [` rich_header `]() void rich\_header(const [RichHeader]( "LIEF::PE::RichHeader") &rich\_header) Set a [RichHeader]() object in the current [Binary](). #### [` has_rich_header `]() inline bool has\_rich\_header() const Check if the current binary has a [RichHeader]() object. #### [` imports `]() inline [it\_imports]( "LIEF::PE::Binary::it_imports") imports() Return an iterator over the binary imports. #### [` imports `]() inline [it\_const\_imports]( "LIEF::PE::Binary::it_const_imports") imports() const #### [` get_import `]() inline [Import]( "LIEF::PE::Import") \*get\_import(const std::string &import\_name) Return the [Import]() matching the provided name (case-sensitive). If the import can’t be found, it returns a nullptr #### [` get_import `]() const [Import]( "LIEF::PE::Import") \*get\_import(const std::string &import\_name) const #### [` has_import `]() inline bool has\_import(const std::string &import\_name) const `True` if the binary imports the given library name #### [` has_delay_imports `]() inline bool has\_delay\_imports() const Check if the current binary contains delay imports. #### [` delay_imports `]() inline [it\_delay\_imports]( "LIEF::PE::Binary::it_delay_imports") delay\_imports() Return an iterator over the binary’s delay imports. #### [` delay_imports `]() inline [it\_const\_delay\_imports]( "LIEF::PE::Binary::it_const_delay_imports") delay\_imports() const #### [` get_delay_import `]() inline [DelayImport]( "LIEF::PE::DelayImport") \*get\_delay\_import(const std::string &import\_name) Returns the [DelayImport]() matching the given name. If it can’t be found, it returns a nullptr. #### [` get_delay_import `]() const [DelayImport]( "LIEF::PE::DelayImport") \*get\_delay\_import(const std::string &import\_name) const #### [` has_delay_import `]() inline bool has\_delay\_import(const std::string &import\_name) const `True` if the binary delay-imports the given library name #### [` add_import `]() inline [Import]( "LIEF::PE::Import") &add\_import(const std::string &name, int32\_t pos = -1) Add an imported library (i.e. `DLL`) to the binary. The second parameter `pos` defines where to insert the import. If negative (default), the import is appended to the end of the list. #### [` remove_import `]() bool remove\_import(const std::string &name) Remove the imported library with the given `name`. Return true if the deletion succeeded, false otherwise. #### [` remove_all_imports `]() inline void remove\_all\_imports() Remove all libraries in the binary. #### [` write `]() inline std::unique\_ptr<[Builder]( "LIEF::PE::Builder")> write(const std::string &filename) Reconstruct the binary object and write the raw PE in `filename`. #### [` write `]() std::unique\_ptr<[Builder]( "LIEF::PE::Builder")> write(const std::string &filename, const [Builder]( "LIEF::PE::Builder")::[config\_t]( "LIEF::PE::Builder::config_t") &config) Reconstruct the binary object with the given configuration and write it in `filename`. #### [` write `]() inline std::unique\_ptr<[Builder]( "LIEF::PE::Builder")> write(std::ostream &os) Reconstruct the binary object and write the raw PE in `os` stream. Rebuild a PE binary from the current [Binary]() object. When rebuilding, import table and relocations are not rebuilt. #### [` write `]() std::unique\_ptr<[Builder]( "LIEF::PE::Builder")> write(std::ostream &os, const [Builder]( "LIEF::PE::Builder")::[config\_t]( "LIEF::PE::Builder::config_t") &config) #### [` accept `]() virtual void accept(Visitor &visitor) const override Method so that a `visitor` can visit us. #### [` patch_address `]() virtual void patch\_address(uint64\_t address, const std::vector<uint8\_t> &patch\_value, VA\_TYPES addr\_type = VA\_TYPES::AUTO) override Patch the content at virtual address `address` with `patch_value`. **Parameters:** - **address** – **[in]** Address to patch - **patch\_value** – **[in]** Patch to apply - **addr\_type** – **[in]** Type of the Virtual address: VA or RVA. Default: Auto #### [` patch_address `]() virtual void patch\_address(uint64\_t address, uint64\_t patch\_value, size\_t size = sizeof(uint64\_t), VA\_TYPES addr\_type = VA\_TYPES::AUTO) override Patch the address with the given value. **Parameters:** - **address** – **[in]** Address to patch - **patch\_value** – **[in]** Patch to apply - **size** – **[in]** Size of the value in **bytes** (1, 2, … 8) - **addr\_type** – **[in]** Type of the Virtual address: VA or RVA. Default: Auto #### [` fill_address `]() void fill\_address(uint64\_t address, size\_t size, uint8\_t value = 0, VA\_TYPES addr\_type = VA\_TYPES::AUTO) Fill the content at the provided address with a fixed value. #### [` get_content_from_virtual_address `]() virtual span<const uint8\_t> get\_content\_from\_virtual\_address(uint64\_t virtual\_address, uint64\_t size, [Binary]( "LIEF::PE::Binary")::VA\_TYPES addr\_type = [Binary]( "LIEF::PE::Binary")::VA\_TYPES::AUTO) const override Return the content located at the provided virtual address. **Parameters:** - **virtual\_address** – **[in]** Virtual address of the data to retrieve - **size** – **[in]** Size in bytes of the data to retrieve - **addr\_type** – **[in]** Type of the Virtual address: VA or RVA. Default: Auto #### [` entrypoint `]() inline virtual uint64\_t entrypoint() const override Return the binary’s entrypoint (it is the same value as [OptionalHeader::addressof\_entrypoint]()). #### [` is_pie `]() inline virtual bool is\_pie() const override Check if the binary is position independent. #### [` has_nx `]() inline virtual bool has\_nx() const override Check if the binary uses `NX` protection. #### [` last_section_offset `]() uint64\_t last\_section\_offset() const #### [` export_dir `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*export\_dir() Return the data directory associated with the export table. #### [` export_dir `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*export\_dir() const #### [` import_dir `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*import\_dir() Return the data directory associated with the import table. #### [` import_dir `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*import\_dir() const #### [` rsrc_dir `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*rsrc\_dir() Return the data directory associated with the resources tree. #### [` rsrc_dir `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*rsrc\_dir() const #### [` exceptions_dir `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*exceptions\_dir() Return the data directory associated with the exceptions. #### [` exceptions_dir `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*exceptions\_dir() const #### [` cert_dir `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*cert\_dir() Return the data directory associated with the certificate table (authenticode). #### [` cert_dir `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*cert\_dir() const #### [` relocation_dir `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*relocation\_dir() Return the data directory associated with the relocation table. #### [` relocation_dir `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*relocation\_dir() const #### [` debug_dir `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*debug\_dir() Return the data directory associated with the debug table. #### [` debug_dir `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*debug\_dir() const #### [` tls_dir `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*tls\_dir() Return the data directory associated with [TLS](). #### [` tls_dir `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*tls\_dir() const #### [` load_config_dir `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*load\_config\_dir() Return the data directory associated with the load config. #### [` load_config_dir `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*load\_config\_dir() const #### [` iat_dir `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*iat\_dir() Return the data directory associated with the IAT. #### [` iat_dir `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*iat\_dir() const #### [` delay_dir `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*delay\_dir() Return the data directory associated with delayed imports. #### [` delay_dir `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*delay\_dir() const #### [` ctor_functions `]() virtual LIEF::[Binary]( "LIEF::Binary")::[functions\_t]( "LIEF::Binary::functions_t") ctor\_functions() const override Return the list of the binary constructors. In a PE file, we consider a constructors as a callback in the [TLS]() object #### [` functions `]() LIEF::[Binary]( "LIEF::Binary")::[functions\_t]( "LIEF::Binary::functions_t") functions() const **All** functions found in the binary #### [` exception_functions `]() LIEF::[Binary]( "LIEF::Binary")::[functions\_t]( "LIEF::Binary::functions_t") exception\_functions() const Functions found in the Exception table directory. #### [` exceptions `]() inline [it\_exceptions]( "LIEF::PE::Binary::it_exceptions") exceptions() Iterator over the exception (`_RUNTIME_FUNCTION`) functions. > **Warning** > > This function requires that the option [LIEF::PE::ParserConfig::parse\_exceptions]() was turned on (default is false) when parsing the binary #### [` exceptions `]() inline [it\_const\_exceptions]( "LIEF::PE::Binary::it_const_exceptions") exceptions() const #### [` find_exception_at `]() [ExceptionInfo]( "LIEF::PE::ExceptionInfo") \*find\_exception\_at(uint32\_t rva) Try to find the exception info at the given RVA. > **Warning** > > This function requires that the option [LIEF::PE::ParserConfig::parse\_exceptions]() was turned on (default is false) when parsing the binary #### [` find_exception_at `]() inline const [ExceptionInfo]( "LIEF::PE::ExceptionInfo") \*find\_exception\_at(uint32\_t rva) const #### [` is_arm64ec `]() bool is\_arm64ec() const True if this binary is compiled in ARM64EC mode (emulation compatible). #### [` is_arm64x `]() bool is\_arm64x() const True if this binary is compiled in ARM64X mode (contains both ARM64 and ARM64EC code). #### [` nested_pe_binary `]() inline const [Binary]( "LIEF::PE::Binary") \*nested\_pe\_binary() const If the current binary contains dynamic relocations (e.g. [LIEF::PE::DynamicFixupARM64X]()), this function returns the **relocated** view of the current PE. This can be used to get the alternative PE binary, targeting a different architectures. > **Warning** > > This function requires that the option [LIEF::PE::ParserConfig::parse\_arm64x\_binary]() was turned on (default is false) when parsing the binary #### [` nested_pe_binary `]() inline [Binary]( "LIEF::PE::Binary") \*nested\_pe\_binary() #### [` get_function_address `]() virtual [result]( "LIEF::result")<uint64\_t> get\_function\_address(const std::string &name) const override Attempt to resolve the address of the function specified by `name`. #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const LIEF::[Binary]( "LIEF::Binary") \*bin) --- ## [Dos Header]() ### [` DosHeader `]() class DosHeader : public LIEF::Object Class which represents the [DosHeader](), the **first** structure present at the beginning of a PE file. Most of the attributes of this structures are no longer relevant. Public Types #### [` reserved_t `]() using reserved\_t = std::array<uint16\_t, 4> #### [` reserved2_t `]() using reserved2\_t = std::array<uint16\_t, 10> Public Functions #### [` DosHeader `]() DosHeader(const details::pe\_dos\_header &header) #### [` DosHeader `]() DosHeader(const [DosHeader]( "LIEF::PE::DosHeader::DosHeader")&) = default #### [` operator= `]() [DosHeader]( "LIEF::PE::DosHeader") &operator=(const [DosHeader]( "LIEF::PE::DosHeader")&) = default #### [` DosHeader `]() DosHeader([DosHeader]( "LIEF::PE::DosHeader::DosHeader")&&) = default #### [` operator= `]() [DosHeader]( "LIEF::PE::DosHeader") &operator=([DosHeader]( "LIEF::PE::DosHeader")&&) = default #### [` ~DosHeader `]() ~DosHeader() override = default #### [` magic `]() inline uint16\_t magic() const Magic bytes identifying a DOS/PE binary. #### [` used_bytes_in_last_page `]() inline uint16\_t used\_bytes\_in\_last\_page() const #### [` file_size_in_pages `]() inline uint16\_t file\_size\_in\_pages() const #### [` numberof_relocation `]() inline uint16\_t numberof\_relocation() const #### [` header_size_in_paragraphs `]() inline uint16\_t header\_size\_in\_paragraphs() const #### [` minimum_extra_paragraphs `]() inline uint16\_t minimum\_extra\_paragraphs() const #### [` maximum_extra_paragraphs `]() inline uint16\_t maximum\_extra\_paragraphs() const #### [` initial_relative_ss `]() inline uint16\_t initial\_relative\_ss() const #### [` initial_sp `]() inline uint16\_t initial\_sp() const #### [` checksum `]() inline uint16\_t checksum() const #### [` initial_ip `]() inline uint16\_t initial\_ip() const #### [` initial_relative_cs `]() inline uint16\_t initial\_relative\_cs() const #### [` addressof_relocation_table `]() inline uint16\_t addressof\_relocation\_table() const #### [` overlay_number `]() inline uint16\_t overlay\_number() const #### [` reserved `]() inline const [reserved\_t]( "LIEF::PE::DosHeader::reserved_t") &reserved() const #### [` oem_id `]() inline uint16\_t oem\_id() const #### [` oem_info `]() inline uint16\_t oem\_info() const #### [` reserved2 `]() inline const [reserved2\_t]( "LIEF::PE::DosHeader::reserved2_t") &reserved2() const #### [` addressof_new_exeheader `]() inline uint32\_t addressof\_new\_exeheader() const Return the offset to the [PE::Header]() structure. #### [` magic `]() inline void magic(uint16\_t magic) #### [` used_bytes_in_last_page `]() inline void used\_bytes\_in\_last\_page(uint16\_t value) #### [` file_size_in_pages `]() inline void file\_size\_in\_pages(uint16\_t value) #### [` numberof_relocation `]() inline void numberof\_relocation(uint16\_t value) #### [` header_size_in_paragraphs `]() inline void header\_size\_in\_paragraphs(uint16\_t value) #### [` minimum_extra_paragraphs `]() inline void minimum\_extra\_paragraphs(uint16\_t value) #### [` maximum_extra_paragraphs `]() inline void maximum\_extra\_paragraphs(uint16\_t value) #### [` initial_relative_ss `]() inline void initial\_relative\_ss(uint16\_t value) #### [` initial_sp `]() inline void initial\_sp(uint16\_t value) #### [` checksum `]() inline void checksum(uint16\_t value) #### [` initial_ip `]() inline void initial\_ip(uint16\_t value) #### [` initial_relative_cs `]() inline void initial\_relative\_cs(uint16\_t value) #### [` addressof_relocation_table `]() inline void addressof\_relocation\_table(uint16\_t value) #### [` overlay_number `]() inline void overlay\_number(uint16\_t value) #### [` reserved `]() inline void reserved(const [reserved\_t]( "LIEF::PE::DosHeader::reserved_t") &reserved) #### [` oem_id `]() inline void oem\_id(uint16\_t value) #### [` oem_info `]() inline void oem\_info(uint16\_t value) #### [` reserved2 `]() inline void reserved2(const [reserved2\_t]( "LIEF::PE::DosHeader::reserved2_t") &reserved2) #### [` addressof_new_exeheader `]() inline void addressof\_new\_exeheader(uint32\_t value) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` create `]() static [DosHeader]( "LIEF::PE::DosHeader") create([PE\_TYPE]( "LIEF::PE::PE_TYPE") type) Public Static Attributes #### [` MAGIC `]() static uint16\_t MAGIC = 0x5a4d Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [DosHeader]( "LIEF::PE::DosHeader") &entry) --- ## [Header]() ### [` Header `]() class Header : public LIEF::Object Class that represents the PE header (which follows the [DosHeader]()). Public Types #### [` MACHINE_TYPES `]() enum class MACHINE\_TYPES *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0x0 ##### [` ALPHA `]() enumerator ALPHA = 0x184 Alpha AXP, 32-bit address space ##### [` ALPHA64 `]() enumerator ALPHA64 = 0x284 Alpha AXP, 64-bit address space ##### [` AM33 `]() enumerator AM33 = 0x1D3 Matsushita AM33 ##### [` AMD64 `]() enumerator AMD64 = 0x8664 AMD x64 ##### [` ARM `]() enumerator ARM = 0x1C0 ARM little endian ##### [` ARMNT `]() enumerator ARMNT = 0x1C4 ARMv7 Thumb mode only ##### [` ARM64 `]() enumerator ARM64 = 0xAA64 ARMv8 in 64-bits mode ##### [` EBC `]() enumerator EBC = 0xEBC EFI byte code ##### [` I386 `]() enumerator I386 = 0x14C Intel 386 or later ##### [` IA64 `]() enumerator IA64 = 0x200 Intel Itanium processor family ##### [` LOONGARCH32 `]() enumerator LOONGARCH32 = 0x6232 LoongArch 32-bit processor family ##### [` LOONGARCH64 `]() enumerator LOONGARCH64 = 0x6264 LoongArch 64-bit processor family ##### [` M32R `]() enumerator M32R = 0x9041 Mitsubishi M32R little endian ##### [` MIPS16 `]() enumerator MIPS16 = 0x266 MIPS16 ##### [` MIPSFPU `]() enumerator MIPSFPU = 0x366 MIPS with FPU ##### [` MIPSFPU16 `]() enumerator MIPSFPU16 = 0x466 MIPS16 with FPU ##### [` POWERPC `]() enumerator POWERPC = 0x1F0 Power PC little endian ##### [` POWERPCFP `]() enumerator POWERPCFP = 0x1F1 Power PC with floating point ##### [` POWERPCBE `]() enumerator POWERPCBE = 0x1F2 Power PC big endian ##### [` R4000 `]() enumerator R4000 = 0x166 MIPS with little endian ##### [` RISCV32 `]() enumerator RISCV32 = 0x5032 RISC-V 32-bit address space ##### [` RISCV64 `]() enumerator RISCV64 = 0x5064 RISC-V 64-bit address space ##### [` RISCV128 `]() enumerator RISCV128 = 0x5128 RISC-V 128-bit address space ##### [` SH3 `]() enumerator SH3 = 0x1A2 Hitachi SH3 ##### [` SH3DSP `]() enumerator SH3DSP = 0x1A3 Hitachi SH3 DSP ##### [` SH4 `]() enumerator SH4 = 0x1A6 Hitachi SH4 ##### [` SH5 `]() enumerator SH5 = 0x1A8 Hitachi SH5 ##### [` THUMB `]() enumerator THUMB = 0x1C2 ARM or Thumb ##### [` WCEMIPSV2 `]() enumerator WCEMIPSV2 = 0x169 MIPS little-endian WCE v2 ##### [` ARM64EC `]() enumerator ARM64EC = 0xa641 ##### [` ARM64X `]() enumerator ARM64X = 0xa64e ##### [` CHPE_X86 `]() enumerator CHPE\_X86 = 0x3a64 #### [` CHARACTERISTICS `]() enum class CHARACTERISTICS *Values:* ##### [` NONE `]() enumerator NONE = 0x0000 ##### [` RELOCS_STRIPPED `]() enumerator RELOCS\_STRIPPED = 0x0001 The file does not contain base relocations and must be loaded at its preferred base. If this cannot be done, the loader will error. ##### [` EXECUTABLE_IMAGE `]() enumerator EXECUTABLE\_IMAGE = 0x0002 File is executable (i.e. no unresolved external references). ##### [` LINE_NUMS_STRIPPED `]() enumerator LINE\_NUMS\_STRIPPED = 0x0004 COFF line numbers have been stripped. This is deprecated and should be 0. ##### [` LOCAL_SYMS_STRIPPED `]() enumerator LOCAL\_SYMS\_STRIPPED = 0x0008 COFF symbol table entries for local symbols have been removed. This is deprecated and should be 0. ##### [` AGGRESSIVE_WS_TRIM `]() enumerator AGGRESSIVE\_WS\_TRIM = 0x0010 Aggressively trim working set. This is deprecated and must be 0. ##### [` LARGE_ADDRESS_AWARE `]() enumerator LARGE\_ADDRESS\_AWARE = 0x0020 Image can handle > 2GiB addresses. ##### [` BYTES_REVERSED_LO `]() enumerator BYTES\_REVERSED\_LO = 0x0080 Little endian: the LSB precedes the MSB in memory. This is deprecated and should be 0. ##### [` NEED_32BIT_MACHINE `]() enumerator NEED\_32BIT\_MACHINE = 0x0100 Machine is based on a 32bit word architecture. ##### [` DEBUG_STRIPPED `]() enumerator DEBUG\_STRIPPED = 0x0200 Debugging info has been removed. ##### [` REMOVABLE_RUN_FROM_SWAP `]() enumerator REMOVABLE\_RUN\_FROM\_SWAP = 0x0400 If the image is on removable media, fully load it and copy it to swap. ##### [` NET_RUN_FROM_SWAP `]() enumerator NET\_RUN\_FROM\_SWAP = 0x0800 If the image is on network media, fully load it and copy it to swap. ##### [` SYSTEM `]() enumerator SYSTEM = 0x1000 The image file is a system file, not a user program. ##### [` DLL `]() enumerator DLL = 0x2000 The image file is a DLL. ##### [` UP_SYSTEM_ONLY `]() enumerator UP\_SYSTEM\_ONLY = 0x4000 This file should only be run on a uniprocessor machine. ##### [` BYTES_REVERSED_HI `]() enumerator BYTES\_REVERSED\_HI = 0x8000 Big endian: the MSB precedes the LSB in memory. This is deprecated. #### [` signature_t `]() using signature\_t = std::array<uint8\_t, 4> Public Functions #### [` Header `]() Header(const details::pe\_header &header) #### [` ~Header `]() ~Header() override = default #### [` operator= `]() [Header]( "LIEF::PE::Header") &operator=(const [Header]( "LIEF::PE::Header")&) = default #### [` Header `]() Header(const [Header]( "LIEF::PE::Header::Header")&) = default #### [` signature `]() inline const [signature\_t]( "LIEF::PE::Header::signature_t") &signature() const [Signature]() (or magic byte) of the header. It must be: `PE\0\0`. #### [` machine `]() inline [MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") machine() const The targeted machine architecture like ARM, x86, AMD64, … #### [` numberof_sections `]() inline uint16\_t numberof\_sections() const The number of sections in the binary. #### [` time_date_stamp `]() inline uint32\_t time\_date\_stamp() const The low 32 bits of the number of seconds since January 1, 1970. It **indicates** when the file was created. #### [` pointerto_symbol_table `]() inline uint32\_t pointerto\_symbol\_table() const The offset of the **COFF** symbol table. This value should be zero for an image because COFF debugging information is deprecated. #### [` numberof_symbols `]() inline uint32\_t numberof\_symbols() const The number of entries in the symbol table. This data can be used to locate the string table which immediately follows the symbol table. This value should be zero for an image because COFF debugging information is deprecated. #### [` sizeof_optional_header `]() inline uint16\_t sizeof\_optional\_header() const Size of the [OptionalHeader]() **AND** the data directories which follows this header. This value is equivalent to: `sizeof(pe_optional_header) + NB_DATA_DIR * sizeof(data_directory)` This size **should** be either: - 0xE0 (224) for a PE32 (32 bits) - 0xF0 (240) for a PE32+ (64 bits) #### [` characteristics `]() inline uint32\_t characteristics() const Characteristics of the binary like whether it is a DLL or an executable. #### [` has_characteristic `]() inline bool has\_characteristic([CHARACTERISTICS]( "LIEF::PE::Header::CHARACTERISTICS") c) const Check if the given [CHARACTERISTICS]() is present. #### [` characteristics_list `]() std::vector<[CHARACTERISTICS]( "LIEF::PE::Header::CHARACTERISTICS")> characteristics\_list() const The list of the [CHARACTERISTICS](). #### [` machine `]() inline void machine([MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") type) #### [` numberof_sections `]() inline void numberof\_sections(uint16\_t nb) #### [` time_date_stamp `]() inline void time\_date\_stamp(uint32\_t timestamp) #### [` pointerto_symbol_table `]() inline void pointerto\_symbol\_table(uint32\_t ptr) #### [` numberof_symbols `]() inline void numberof\_symbols(uint32\_t nb) #### [` sizeof_optional_header `]() inline void sizeof\_optional\_header(uint16\_t size) #### [` characteristics `]() inline void characteristics(uint32\_t characteristics) #### [` signature `]() inline void signature(const [signature\_t]( "LIEF::PE::Header::signature_t") &sig) #### [` add_characteristic `]() inline void add\_characteristic([CHARACTERISTICS]( "LIEF::PE::Header::CHARACTERISTICS") c) #### [` remove_characteristic `]() inline void remove\_characteristic([CHARACTERISTICS]( "LIEF::PE::Header::CHARACTERISTICS") c) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` is_known_machine `]() static bool is\_known\_machine(uint16\_t machine) #### [` is_arm `]() static inline bool is\_arm([MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") ty) #### [` is_riscv `]() static inline bool is\_riscv([MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") ty) #### [` is_loonarch `]() static inline bool is\_loonarch([MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") ty) #### [` is_arm64 `]() static inline bool is\_arm64([MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") ty) #### [` is_thumb `]() static inline bool is\_thumb([MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") ty) #### [` x86 `]() static inline bool x86([MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") ty) #### [` x86_64 `]() static inline bool x86\_64([MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") ty) #### [` is_mips `]() static inline bool is\_mips([MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") ty) #### [` is_ppc `]() static inline bool is\_ppc([MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") ty) #### [` create `]() static [Header]( "LIEF::PE::Header") create([PE\_TYPE]( "LIEF::PE::PE_TYPE") type) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Header]( "LIEF::PE::Header") &entry) --- ## [Optional Header]() ### [` OptionalHeader `]() class OptionalHeader : public LIEF::Object Class which represents the PE [OptionalHeader]() structure. Note that the term *optional* comes from the COFF specifications but this header is **mandatory** for a PE binary. Public Types #### [` DLL_CHARACTERISTICS `]() enum class DLL\_CHARACTERISTICS : size\_t *Values:* ##### [` HIGH_ENTROPY_VA `]() enumerator HIGH\_ENTROPY\_VA = 0x0020 ASLR with 64 bit address space. ##### [` DYNAMIC_BASE `]() enumerator DYNAMIC\_BASE = 0x0040 DLL can be relocated at load time. ##### [` FORCE_INTEGRITY `]() enumerator FORCE\_INTEGRITY = 0x0080 Code integrity checks are enforced. ##### [` NX_COMPAT `]() enumerator NX\_COMPAT = 0x0100 Image is NX compatible. ##### [` NO_ISOLATION `]() enumerator NO\_ISOLATION = 0x0200 Isolation aware, but do not isolate the image. ##### [` NO_SEH `]() enumerator NO\_SEH = 0x0400 Does not use structured exception handling (SEH). No SEH handler may be called in this image. ##### [` NO_BIND `]() enumerator NO\_BIND = 0x0800 Do not bind the image. ##### [` APPCONTAINER `]() enumerator APPCONTAINER = 0x1000 Image should execute in an AppContainer. ##### [` WDM_DRIVER `]() enumerator WDM\_DRIVER = 0x2000 A WDM driver. ##### [` GUARD_CF `]() enumerator GUARD\_CF = 0x4000 Image supports Control Flow Guard. ##### [` TERMINAL_SERVER_AWARE `]() enumerator TERMINAL\_SERVER\_AWARE = 0x8000 Terminal Server aware. #### [` SUBSYSTEM `]() enum class SUBSYSTEM : size\_t *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 An unknown subsystem. ##### [` NATIVE `]() enumerator NATIVE = 1 Device drivers and native Windows processes. ##### [` WINDOWS_GUI `]() enumerator WINDOWS\_GUI = 2 The Windows GUI subsystem. ##### [` WINDOWS_CUI `]() enumerator WINDOWS\_CUI = 3 The Windows character subsystem. ##### [` OS2_CUI `]() enumerator OS2\_CUI = 5 The OS/2 character subsystem. ##### [` POSIX_CUI `]() enumerator POSIX\_CUI = 7 The POSIX character subsystem. ##### [` NATIVE_WINDOWS `]() enumerator NATIVE\_WINDOWS = 8 Native Windows 9x driver. ##### [` WINDOWS_CE_GUI `]() enumerator WINDOWS\_CE\_GUI = 9 Windows CE. ##### [` EFI_APPLICATION `]() enumerator EFI\_APPLICATION = 10 An EFI application. ##### [` EFI_BOOT_SERVICE_DRIVER `]() enumerator EFI\_BOOT\_SERVICE\_DRIVER = 11 An EFI driver with boot services. ##### [` EFI_RUNTIME_DRIVER `]() enumerator EFI\_RUNTIME\_DRIVER = 12 An EFI driver with run-time services. ##### [` EFI_ROM `]() enumerator EFI\_ROM = 13 An EFI ROM image. ##### [` XBOX `]() enumerator XBOX = 14 XBOX. ##### [` WINDOWS_BOOT_APPLICATION `]() enumerator WINDOWS\_BOOT\_APPLICATION = 16 A BCD application. ##### [` XBOX_CODE_CATALOG `]() enumerator XBOX\_CODE\_CATALOG = 17 Security Metadata Containers. Public Functions #### [` OptionalHeader `]() OptionalHeader(const details::pe32\_optional\_header &header) #### [` OptionalHeader `]() OptionalHeader(const details::pe64\_optional\_header &header) #### [` ~OptionalHeader `]() ~OptionalHeader() override = default #### [` operator= `]() [OptionalHeader]( "LIEF::PE::OptionalHeader") &operator=(const [OptionalHeader]( "LIEF::PE::OptionalHeader")&) = default #### [` OptionalHeader `]() OptionalHeader(const [OptionalHeader]( "LIEF::PE::OptionalHeader::OptionalHeader")&) = default #### [` magic `]() inline [PE\_TYPE]( "LIEF::PE::PE_TYPE") magic() const Magic bytes: either `PE32` or `PE32+` for 64-bits PE files. #### [` major_linker_version `]() inline uint8\_t major\_linker\_version() const The linker major version. #### [` minor_linker_version `]() inline uint8\_t minor\_linker\_version() const The linker minor version. #### [` sizeof_code `]() inline uint32\_t sizeof\_code() const The size of the code `.text` section or the sum of all the sections that contain code (i.e. [PE::Section]() with the flag [Section::CHARACTERISTICS::CNT\_CODE]()). #### [` sizeof_initialized_data `]() inline uint32\_t sizeof\_initialized\_data() const The size of the initialized data which are usually located in the `.data` section. If the initialized data are split across multiple sections, it is the sum of the sections. The sections associated with the initialized data are usually identified with the flag [Section::CHARACTERISTICS::CNT\_INITIALIZED\_DATA]() #### [` sizeof_uninitialized_data `]() inline uint32\_t sizeof\_uninitialized\_data() const The size of the uninitialized data which are usually located in the `.bss` section. If the uninitialized data are split across multiple sections, it is the sum of the sections. The sections associated with the uninitialized data are usually identified with the flag [Section::CHARACTERISTICS::CNT\_UNINITIALIZED\_DATA]() #### [` addressof_entrypoint `]() inline uint32\_t addressof\_entrypoint() const The address of the entry point relative to the image base when the executable file is loaded into memory. For program images, this is the starting address. For device drivers, this is the address of the initialization function. An entry point is optional for DLLs. When no entry point is present, this field must be zero. #### [` baseof_code `]() inline uint32\_t baseof\_code() const Address relative to the imagebase where the binary’s code starts. #### [` baseof_data `]() inline uint32\_t baseof\_data() const Address relative to the imagebase where the binary’s data starts. > **Warning** > > This value is not present for PE64 files #### [` imagebase `]() inline uint64\_t imagebase() const The preferred base address when mapping the binary in memory. #### [` section_alignment `]() inline uint32\_t section\_alignment() const The alignment (in bytes) of sections when they are loaded into memory. It must be greater than or equal to file\_alignment and the default is the page size for the architecture. #### [` file_alignment `]() inline uint32\_t file\_alignment() const The section’s file alignment. This value must be a power of 2 between 512 and 64K. The default value is usually 512. #### [` major_operating_system_version `]() inline uint16\_t major\_operating\_system\_version() const The **major** version number of the required operating system. #### [` minor_operating_system_version `]() inline uint16\_t minor\_operating\_system\_version() const The **minor** version number of the required operating system. #### [` major_image_version `]() inline uint16\_t major\_image\_version() const The major version number of the image. #### [` minor_image_version `]() inline uint16\_t minor\_image\_version() const The minor version number of the image. #### [` major_subsystem_version `]() inline uint16\_t major\_subsystem\_version() const The major version number of the subsystem. #### [` minor_subsystem_version `]() inline uint16\_t minor\_subsystem\_version() const The minor version number of the subsystem. #### [` win32_version_value `]() inline uint32\_t win32\_version\_value() const According to the official PE specifications, this value is reserved and **should** be 0. #### [` sizeof_image `]() inline uint32\_t sizeof\_image() const The size (in bytes) of the image, including all headers, as the image is loaded in memory. It must be a multiple of section\_alignment and should match [Binary::virtual\_size]() #### [` sizeof_headers `]() inline uint32\_t sizeof\_headers() const Size of the [DosHeader]() + PE [Header]() + [Section]() headers rounded up to a multiple of the file\_alignment. #### [` checksum `]() inline uint32\_t checksum() const The image file checksum. The algorithm for computing the checksum is incorporated into `IMAGHELP.DLL`. The following are checked for validation at load time all **drivers**, any **DLL loaded at boot** time, and any **DLL** that is loaded into a **critical** Windows process. #### [` subsystem `]() inline [SUBSYSTEM]( "LIEF::PE::OptionalHeader::SUBSYSTEM") subsystem() const Target subsystem like Driver, XBox, Windows GUI, … #### [` dll_characteristics `]() inline uint32\_t dll\_characteristics() const Some characteristics of the underlying binary like the support of the PIE. The prefix `dll` comes from the official PE specifications but these characteristics are also used for **executables**. #### [` sizeof_stack_reserve `]() inline uint64\_t sizeof\_stack\_reserve() const Size of the stack to reserve when loading the PE binary. Only [OptionalHeader::sizeof\_stack\_commit]() is committed, the rest is made available one page at a time until the reserve size is reached. #### [` sizeof_stack_commit `]() inline uint64\_t sizeof\_stack\_commit() const Size of the stack to commit. #### [` sizeof_heap_reserve `]() inline uint64\_t sizeof\_heap\_reserve() const Size of the heap to reserve when loading the PE binary. #### [` sizeof_heap_commit `]() inline uint64\_t sizeof\_heap\_commit() const Size of the heap to commit. #### [` loader_flags `]() inline uint32\_t loader\_flags() const According to the PE specifications, this value is *reserved* and **should** be 0. #### [` numberof_rva_and_size `]() inline uint32\_t numberof\_rva\_and\_size() const The number of [DataDirectory]() that follow this header. #### [` has `]() inline bool has([DLL\_CHARACTERISTICS]( "LIEF::PE::OptionalHeader::DLL_CHARACTERISTICS") c) const Check if the given [DLL\_CHARACTERISTICS]() is included in the dll\_characteristics. #### [` dll_characteristics_list `]() std::vector<[DLL\_CHARACTERISTICS]( "LIEF::PE::OptionalHeader::DLL_CHARACTERISTICS")> dll\_characteristics\_list() const Return the list of the dll\_characteristics as an std::set of [DLL\_CHARACTERISTICS](). #### [` add `]() inline void add([DLL\_CHARACTERISTICS]( "LIEF::PE::OptionalHeader::DLL_CHARACTERISTICS") c) Add a [DLL\_CHARACTERISTICS]() to the current characteristics. #### [` remove `]() inline void remove([DLL\_CHARACTERISTICS]( "LIEF::PE::OptionalHeader::DLL_CHARACTERISTICS") c) Remove a [DLL\_CHARACTERISTICS]() from the current characteristics. #### [` magic `]() inline void magic([PE\_TYPE]( "LIEF::PE::PE_TYPE") magic) #### [` major_linker_version `]() inline void major\_linker\_version(uint8\_t value) #### [` minor_linker_version `]() inline void minor\_linker\_version(uint8\_t value) #### [` sizeof_code `]() inline void sizeof\_code(uint32\_t value) #### [` sizeof_initialized_data `]() inline void sizeof\_initialized\_data(uint32\_t value) #### [` sizeof_uninitialized_data `]() inline void sizeof\_uninitialized\_data(uint32\_t value) #### [` addressof_entrypoint `]() inline void addressof\_entrypoint(uint32\_t value) #### [` baseof_code `]() inline void baseof\_code(uint32\_t value) #### [` baseof_data `]() inline void baseof\_data(uint32\_t value) #### [` imagebase `]() inline void imagebase(uint64\_t value) #### [` section_alignment `]() inline void section\_alignment(uint32\_t value) #### [` file_alignment `]() inline void file\_alignment(uint32\_t value) #### [` major_operating_system_version `]() inline void major\_operating\_system\_version(uint16\_t value) #### [` minor_operating_system_version `]() inline void minor\_operating\_system\_version(uint16\_t value) #### [` major_image_version `]() inline void major\_image\_version(uint16\_t value) #### [` minor_image_version `]() inline void minor\_image\_version(uint16\_t value) #### [` major_subsystem_version `]() inline void major\_subsystem\_version(uint16\_t value) #### [` minor_subsystem_version `]() inline void minor\_subsystem\_version(uint16\_t value) #### [` win32_version_value `]() inline void win32\_version\_value(uint32\_t value) #### [` sizeof_image `]() inline void sizeof\_image(uint32\_t value) #### [` sizeof_headers `]() inline void sizeof\_headers(uint32\_t value) #### [` checksum `]() inline void checksum(uint32\_t value) #### [` subsystem `]() inline void subsystem([SUBSYSTEM]( "LIEF::PE::OptionalHeader::SUBSYSTEM") value) #### [` dll_characteristics `]() inline void dll\_characteristics(uint32\_t value) #### [` sizeof_stack_reserve `]() inline void sizeof\_stack\_reserve(uint64\_t value) #### [` sizeof_stack_commit `]() inline void sizeof\_stack\_commit(uint64\_t value) #### [` sizeof_heap_reserve `]() inline void sizeof\_heap\_reserve(uint64\_t value) #### [` sizeof_heap_commit `]() inline void sizeof\_heap\_commit(uint64\_t value) #### [` loader_flags `]() inline void loader\_flags(uint32\_t value) #### [` numberof_rva_and_size `]() inline void numberof\_rva\_and\_size(uint32\_t value) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` operator+= `]() inline [OptionalHeader]( "LIEF::PE::OptionalHeader") &operator+=([DLL\_CHARACTERISTICS]( "LIEF::PE::OptionalHeader::DLL_CHARACTERISTICS") c) #### [` operator-= `]() inline [OptionalHeader]( "LIEF::PE::OptionalHeader") &operator-=([DLL\_CHARACTERISTICS]( "LIEF::PE::OptionalHeader::DLL_CHARACTERISTICS") c) Public Static Functions #### [` create `]() static [OptionalHeader]( "LIEF::PE::OptionalHeader") create([PE\_TYPE]( "LIEF::PE::PE_TYPE") type) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [OptionalHeader]( "LIEF::PE::OptionalHeader") &entry) --- ## [Data Directory]() ### [` DataDirectory `]() class DataDirectory : public LIEF::Object Class that represents a PE data directory entry. Public Types #### [` TYPES `]() enum class TYPES : uint32\_t *Values:* ##### [` EXPORT_TABLE `]() enumerator EXPORT\_TABLE = 0 ##### [` IMPORT_TABLE `]() enumerator IMPORT\_TABLE ##### [` RESOURCE_TABLE `]() enumerator RESOURCE\_TABLE ##### [` EXCEPTION_TABLE `]() enumerator EXCEPTION\_TABLE ##### [` CERTIFICATE_TABLE `]() enumerator CERTIFICATE\_TABLE ##### [` BASE_RELOCATION_TABLE `]() enumerator BASE\_RELOCATION\_TABLE ##### [` DEBUG_DIR `]() enumerator DEBUG\_DIR ##### [` ARCHITECTURE `]() enumerator ARCHITECTURE ##### [` GLOBAL_PTR `]() enumerator GLOBAL\_PTR ##### [` TLS_TABLE `]() enumerator TLS\_TABLE ##### [` LOAD_CONFIG_TABLE `]() enumerator LOAD\_CONFIG\_TABLE ##### [` BOUND_IMPORT `]() enumerator BOUND\_IMPORT ##### [` IAT `]() enumerator IAT ##### [` DELAY_IMPORT_DESCRIPTOR `]() enumerator DELAY\_IMPORT\_DESCRIPTOR ##### [` CLR_RUNTIME_HEADER `]() enumerator CLR\_RUNTIME\_HEADER ##### [` RESERVED `]() enumerator RESERVED ##### [` UNKNOWN `]() enumerator UNKNOWN Public Functions #### [` DataDirectory `]() DataDirectory() = default #### [` DataDirectory `]() inline DataDirectory([TYPES]( "LIEF::PE::DataDirectory::TYPES") type) #### [` DataDirectory `]() DataDirectory(const details::pe\_data\_directory &header, [TYPES]( "LIEF::PE::DataDirectory::TYPES") type) #### [` DataDirectory `]() DataDirectory(const [DataDirectory]( "LIEF::PE::DataDirectory::DataDirectory") &other) = default #### [` operator= `]() [DataDirectory]( "LIEF::PE::DataDirectory") &operator=(const [DataDirectory]( "LIEF::PE::DataDirectory") &other) = default #### [` DataDirectory `]() DataDirectory([DataDirectory]( "LIEF::PE::DataDirectory::DataDirectory") &&other) noexcept = default #### [` operator= `]() [DataDirectory]( "LIEF::PE::DataDirectory") &operator=([DataDirectory]( "LIEF::PE::DataDirectory") &&other) noexcept = default #### [` ~DataDirectory `]() ~DataDirectory() override = default #### [` RVA `]() inline uint32\_t RVA() const The relative virtual address of the content of this data directory. #### [` size `]() inline uint32\_t size() const The size of the content. #### [` has_section `]() inline bool has\_section() const Check if the content of this data directory is associated with a PE [Section](). #### [` content `]() inline span<const uint8\_t> content() const Raw content (bytes) referenced by this data directory. #### [` content `]() span<uint8\_t> content() #### [` section `]() inline [Section]( "LIEF::PE::Section") \*section() [Section]() associated with the [DataDirectory](). #### [` section `]() inline const [Section]( "LIEF::PE::Section") \*section() const #### [` type `]() inline [TYPES]( "LIEF::PE::DataDirectory::TYPES") type() const Type of the data directory. #### [` size `]() inline void size(uint32\_t size) #### [` RVA `]() inline void RVA(uint32\_t rva) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Attributes #### [` DEFAULT_NB `]() static size\_t DEFAULT\_NB = 16 Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [DataDirectory]( "LIEF::PE::DataDirectory") &entry) --- ## [Section]() ### [` Section `]() class Section : public LIEF::[Section]( "LIEF::Section") Class which represents a PE section. Public Types #### [` CHARACTERISTICS `]() enum class CHARACTERISTICS : uint64\_t *Values:* ##### [` TYPE_NO_PAD `]() enumerator TYPE\_NO\_PAD = 0x00000008 ##### [` CNT_CODE `]() enumerator CNT\_CODE = 0x00000020 ##### [` CNT_INITIALIZED_DATA `]() enumerator CNT\_INITIALIZED\_DATA = 0x00000040 ##### [` CNT_UNINITIALIZED_DATA `]() enumerator CNT\_UNINITIALIZED\_DATA = 0x00000080 ##### [` LNK_OTHER `]() enumerator LNK\_OTHER = 0x00000100 ##### [` LNK_INFO `]() enumerator LNK\_INFO = 0x00000200 ##### [` LNK_REMOVE `]() enumerator LNK\_REMOVE = 0x00000800 ##### [` LNK_COMDAT `]() enumerator LNK\_COMDAT = 0x00001000 ##### [` GPREL `]() enumerator GPREL = 0x00008000 ##### [` MEM_PURGEABLE `]() enumerator MEM\_PURGEABLE = 0x00010000 ##### [` MEM_16BIT `]() enumerator MEM\_16BIT = 0x00020000 ##### [` MEM_LOCKED `]() enumerator MEM\_LOCKED = 0x00040000 ##### [` MEM_PRELOAD `]() enumerator MEM\_PRELOAD = 0x00080000 ##### [` ALIGN_1BYTES `]() enumerator ALIGN\_1BYTES = 0x00100000 ##### [` ALIGN_2BYTES `]() enumerator ALIGN\_2BYTES = 0x00200000 ##### [` ALIGN_4BYTES `]() enumerator ALIGN\_4BYTES = 0x00300000 ##### [` ALIGN_8BYTES `]() enumerator ALIGN\_8BYTES = 0x00400000 ##### [` ALIGN_16BYTES `]() enumerator ALIGN\_16BYTES = 0x00500000 ##### [` ALIGN_32BYTES `]() enumerator ALIGN\_32BYTES = 0x00600000 ##### [` ALIGN_64BYTES `]() enumerator ALIGN\_64BYTES = 0x00700000 ##### [` ALIGN_128BYTES `]() enumerator ALIGN\_128BYTES = 0x00800000 ##### [` ALIGN_256BYTES `]() enumerator ALIGN\_256BYTES = 0x00900000 ##### [` ALIGN_512BYTES `]() enumerator ALIGN\_512BYTES = 0x00A00000 ##### [` ALIGN_1024BYTES `]() enumerator ALIGN\_1024BYTES = 0x00B00000 ##### [` ALIGN_2048BYTES `]() enumerator ALIGN\_2048BYTES = 0x00C00000 ##### [` ALIGN_4096BYTES `]() enumerator ALIGN\_4096BYTES = 0x00D00000 ##### [` ALIGN_8192BYTES `]() enumerator ALIGN\_8192BYTES = 0x00E00000 ##### [` LNK_NRELOC_OVFL `]() enumerator LNK\_NRELOC\_OVFL = 0x01000000 ##### [` MEM_DISCARDABLE `]() enumerator MEM\_DISCARDABLE = 0x02000000 ##### [` MEM_NOT_CACHED `]() enumerator MEM\_NOT\_CACHED = 0x04000000 ##### [` MEM_NOT_PAGED `]() enumerator MEM\_NOT\_PAGED = 0x08000000 ##### [` MEM_SHARED `]() enumerator MEM\_SHARED = 0x10000000 ##### [` MEM_EXECUTE `]() enumerator MEM\_EXECUTE = 0x20000000 ##### [` MEM_READ `]() enumerator MEM\_READ = 0x40000000 ##### [` MEM_WRITE `]() enumerator MEM\_WRITE = 0x80000000 Public Functions #### [` Section `]() Section(const details::pe\_section &header) #### [` Section `]() Section() = default #### [` Section `]() inline Section(std::string name) #### [` Section `]() inline Section(std::string name, std::vector<uint8\_t> content) #### [` operator= `]() [Section]( "LIEF::PE::Section") &operator=(const [Section]( "LIEF::PE::Section")&) = default #### [` Section `]() Section(const [Section]( "LIEF::PE::Section::Section")&) = default #### [` ~Section `]() ~Section() override = default #### [` sizeof_raw_data `]() uint32\_t sizeof\_raw\_data() const Return the size of the data in the section. #### [` virtual_size `]() inline uint32\_t virtual\_size() const Return the size of the data when mapped in memory. If this value is greater than sizeof\_raw\_data, the section is zero-padded. #### [` content `]() inline virtual span<const uint8\_t> content() const override The actual content of the section. #### [` padding `]() inline span<const uint8\_t> padding() const Content of the section’s padding area. #### [` pointerto_raw_data `]() uint32\_t pointerto\_raw\_data() const The offset of the section data in the PE file. #### [` pointerto_relocation `]() inline uint32\_t pointerto\_relocation() const The file pointer to the beginning of the COFF relocation entries for the section. This is set to zero for executable images or if there are no relocations. For modern PE binaries, this value is usually set to 0 as the relocations are managed by [PE::Relocation](). #### [` pointerto_line_numbers `]() inline uint32\_t pointerto\_line\_numbers() const The file pointer to the beginning of line-number entries for the section. This is set to zero if there are no COFF line numbers. This value should be zero for an image because COFF debugging information is deprecated and modern debug information relies on the PDB files. #### [` numberof_relocations `]() inline uint16\_t numberof\_relocations() const No longer used in recent PE binaries produced by Visual Studio. #### [` numberof_line_numbers `]() inline uint16\_t numberof\_line\_numbers() const No longer used in recent PE binaries produced by Visual Studio. #### [` characteristics `]() inline uint32\_t characteristics() const Characteristics of the section: it provides information about the permissions of the section when mapped. It can also provide information about the *purpose* of the section (contain code, BSS-like, …). #### [` has_characteristic `]() inline bool has\_characteristic([CHARACTERISTICS]( "LIEF::PE::Section::CHARACTERISTICS") c) const Check if the section has the given [CHARACTERISTICS](). #### [` characteristics_list `]() inline std::vector<[CHARACTERISTICS]( "LIEF::PE::Section::CHARACTERISTICS")> characteristics\_list() const List of the section characteristics. #### [` is_discardable `]() inline bool is\_discardable() const True if the section can be discarded as needed. This is typically the case for debug-related sections #### [` clear `]() void clear(uint8\_t c) Fill the content of the section with the given `char`. #### [` content `]() virtual void content(const std::vector<uint8\_t> &data) override Change section content. #### [` name `]() virtual void name(std::string name) override Change the section’s name. #### [` virtual_size `]() inline void virtual\_size(uint32\_t virtual\_sz) #### [` pointerto_raw_data `]() inline void pointerto\_raw\_data(uint32\_t ptr) #### [` pointerto_relocation `]() inline void pointerto\_relocation(uint32\_t ptr) #### [` pointerto_line_numbers `]() inline void pointerto\_line\_numbers(uint32\_t ptr) #### [` numberof_relocations `]() inline void numberof\_relocations(uint16\_t nb) #### [` numberof_line_numbers `]() inline void numberof\_line\_numbers(uint16\_t nb) #### [` sizeof_raw_data `]() inline void sizeof\_raw\_data(uint32\_t size) #### [` characteristics `]() inline void characteristics(uint32\_t characteristics) #### [` coff_string `]() inline COFF::[String]( "LIEF::COFF::String") \*coff\_string() Return the COFF string associated with the section’s name (or a nullptr). This coff string is usually present for long section names whose length does not fit in the 8 bytes allocated by the PE format. #### [` coff_string `]() inline const COFF::[String]( "LIEF::COFF::String") \*coff\_string() const #### [` remove_characteristic `]() inline [Section]( "LIEF::PE::Section") &remove\_characteristic([CHARACTERISTICS]( "LIEF::PE::Section::CHARACTERISTICS") characteristic) #### [` add_characteristic `]() inline [Section]( "LIEF::PE::Section") &add\_characteristic([CHARACTERISTICS]( "LIEF::PE::Section::CHARACTERISTICS") characteristic) #### [` stream `]() std::unique\_ptr<[SpanStream]( "LIEF::SpanStream")> stream() const #### [` writable_content `]() inline span<uint8\_t> writable\_content() #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` name `]() inline virtual std::string\_view name() const [Section]()’s name. Public Static Functions #### [` characteristics_to_list `]() static std::vector<[CHARACTERISTICS]( "LIEF::PE::Section::CHARACTERISTICS")> characteristics\_to\_list(uint32\_t value) Public Static Attributes #### [` MAX_SECTION_NAME `]() static size\_t MAX\_SECTION\_NAME = 8 Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Section]( "LIEF::PE::Section") &section) --- ## [Import]() ### [` Import `]() class Import : public LIEF::Object Class that represents a PE import. Public Types #### [` entries_t `]() using entries\_t = std::vector<std::unique\_ptr<[ImportEntry]( "LIEF::PE::ImportEntry")>> #### [` it_entries `]() using it\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[entries\_t]( "LIEF::PE::Import::entries_t")&, [ImportEntry]( "LIEF::PE::ImportEntry")\*> #### [` it_const_entries `]() using it\_const\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [entries\_t]( "LIEF::PE::Import::entries_t")&, const [ImportEntry]( "LIEF::PE::ImportEntry")\*> Public Functions #### [` Import `]() Import(const details::pe\_import &import) #### [` Import `]() inline Import(std::string name) #### [` Import `]() Import() = default #### [` ~Import `]() ~Import() override = default #### [` Import `]() Import(const [Import]( "LIEF::PE::Import::Import") &other) #### [` operator= `]() [Import]( "LIEF::PE::Import") &operator=(const [Import]( "LIEF::PE::Import") &other) #### [` Import `]() Import([Import]( "LIEF::PE::Import::Import") &&other) noexcept = default #### [` operator= `]() [Import]( "LIEF::PE::Import") &operator=([Import]( "LIEF::PE::Import") &&other) noexcept = default #### [` forwarder_chain `]() inline uint32\_t forwarder\_chain() const The index of the first forwarder reference. #### [` timedatestamp `]() inline uint32\_t timedatestamp() const The stamp that is set to zero until the image is bound. After the image is bound, this field is set to the time/data stamp of the DLL. #### [` entries `]() inline [it\_const\_entries]( "LIEF::PE::Import::it_const_entries") entries() const Iterator over the [PE::ImportEntry](). #### [` entries `]() inline [it\_entries]( "LIEF::PE::Import::it_entries") entries() #### [` import_address_table_rva `]() inline uint32\_t import\_address\_table\_rva() const The RVA of the import address table (`IAT`). The content of this table is **identical** to the content of the [Import]() Lookup Table (`ILT`) until the image is bound. > **Warning** > > This address could change when re-building the binary #### [` import_lookup_table_rva `]() inline uint32\_t import\_lookup\_table\_rva() const Return the relative virtual address of the import lookup table. > **Warning** > > This address could change when re-building the binary #### [` get_function_rva_from_iat `]() [result]( "LIEF::result")<uint32\_t> get\_function\_rva\_from\_iat(const std::string &function) const Return the [Function]()’s RVA from the import address table (`IAT`). > **Warning** > > This address could change when re-building the binary #### [` get_entry `]() inline [ImportEntry]( "LIEF::PE::ImportEntry") \*get\_entry(const std::string &name) Return the imported function with the given name. #### [` get_entry `]() const [ImportEntry]( "LIEF::PE::ImportEntry") \*get\_entry(const std::string &name) const #### [` name `]() inline std::string\_view name() const Return the library’s name (e.g. `kernel32.dll`). #### [` name `]() inline void name(std::string name) Change the current import name. #### [` name_rva `]() inline uint32\_t name\_rva() const The original name rva. #### [` directory `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*directory() Return the [PE::DataDirectory]() associated with this import. It should be the one at index [PE::DataDirectory::TYPES::IMPORT\_TABLE](). If the data directory can’t be found, return a nullptr #### [` directory `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*directory() const #### [` iat_directory `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*iat\_directory() Return the [PE::DataDirectory]() associated with the IAT. It should be the one at index [PE::DataDirectory::TYPES::IAT](). If the data directory can’t be found, return a nullptr #### [` iat_directory `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*iat\_directory() const #### [` add_entry `]() inline [ImportEntry]( "LIEF::PE::ImportEntry") &add\_entry(const [ImportEntry]( "LIEF::PE::ImportEntry") &entry) Add a new import entry (i.e. an imported function). #### [` add_entry `]() inline [ImportEntry]( "LIEF::PE::ImportEntry") &add\_entry(const std::string &name) Add a new import entry with the given name (i.e. an imported function). #### [` remove_entry `]() bool remove\_entry(const std::string &name) Remove the import entry with the given name. Return true if the deletion succeeded, false otherwise #### [` remove_entry `]() bool remove\_entry(uint32\_t ordinal) Remove the import entry with the given ordinal number. Return true if the deletion succeeded, false otherwise #### [` import_lookup_table_rva `]() inline void import\_lookup\_table\_rva(uint32\_t rva) #### [` import_address_table_rva `]() inline void import\_address\_table\_rva(uint32\_t rva) #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Import]( "LIEF::PE::Import") &entry) --- ## [Import Entry]() ### [` ImportEntry `]() class ImportEntry : public LIEF::[Symbol]( "LIEF::Symbol") Class that represents an entry (i.e. an import) in the import table ([Import]()). It extends the [LIEF::Symbol]() generic class that exposes the [LIEF::Symbol::name]() and [LIEF::Symbol::value]() API Public Functions #### [` ImportEntry `]() ImportEntry() = default #### [` ImportEntry `]() inline ImportEntry(uint64\_t data, [PE\_TYPE]( "LIEF::PE::PE_TYPE") type) #### [` ImportEntry `]() inline ImportEntry(std::string name) #### [` ImportEntry `]() ImportEntry(const [ImportEntry]( "LIEF::PE::ImportEntry::ImportEntry")&) = default #### [` operator= `]() [ImportEntry]( "LIEF::PE::ImportEntry") &operator=(const [ImportEntry]( "LIEF::PE::ImportEntry")&) = default #### [` ~ImportEntry `]() ~ImportEntry() override = default #### [` demangled_name `]() std::string demangled\_name() const Demangled representation of the symbol or an empty string if it can’t be demangled. #### [` is_ordinal `]() bool is\_ordinal() const `True` if it is an import by ordinal #### [` ordinal `]() inline uint16\_t ordinal() const The ordinal value. #### [` hint_name_rva `]() inline uint64\_t hint\_name\_rva() const > **See also** > > [ImportEntry::data]() #### [` hint `]() inline uint16\_t hint() const Index into the [Export::entries]() that is used to speed-up the symbol resolution. #### [` iat_value `]() inline uint64\_t iat\_value() const Value of the current entry in the [Import]() Address Table. It should match the lookup table value. #### [` iat_value `]() inline void iat\_value(uint64\_t value) #### [` ilt_value `]() inline uint64\_t ilt\_value() const Original value in the import lookup table. This value should match the [iat\_value()](). #### [` ilt_value `]() inline void ilt\_value(uint64\_t value) #### [` data `]() inline uint64\_t data() const Raw value. #### [` iat_address `]() inline uint64\_t iat\_address() const **Original** address of the entry in the [Import]() Address Table #### [` data `]() inline void data(uint64\_t data) #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ImportEntry]( "LIEF::PE::ImportEntry") &entry) --- ## [Delay Import]() ### [` DelayImport `]() class DelayImport : public LIEF::Object Class that represents a PE delayed import. Public Types #### [` entries_t `]() using entries\_t = std::vector<std::unique\_ptr<[DelayImportEntry]( "LIEF::PE::DelayImportEntry")>> #### [` it_entries `]() using it\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[entries\_t]( "LIEF::PE::DelayImport::entries_t")&, [DelayImportEntry]( "LIEF::PE::DelayImportEntry")\*> #### [` it_const_entries `]() using it\_const\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [entries\_t]( "LIEF::PE::DelayImport::entries_t")&, const [DelayImportEntry]( "LIEF::PE::DelayImportEntry")\*> Public Functions #### [` DelayImport `]() DelayImport() = default #### [` DelayImport `]() DelayImport(const details::delay\_imports &import, [PE\_TYPE]( "LIEF::PE::PE_TYPE") type) #### [` DelayImport `]() inline DelayImport(std::string name) #### [` ~DelayImport `]() ~DelayImport() override = default #### [` DelayImport `]() DelayImport(const [DelayImport]( "LIEF::PE::DelayImport::DelayImport") &other) #### [` operator= `]() inline [DelayImport]( "LIEF::PE::DelayImport") &operator=([DelayImport]( "LIEF::PE::DelayImport") other) #### [` DelayImport `]() DelayImport([DelayImport]( "LIEF::PE::DelayImport::DelayImport")&&) noexcept = default #### [` operator= `]() [DelayImport]( "LIEF::PE::DelayImport") &operator=([DelayImport]( "LIEF::PE::DelayImport")&&) noexcept = default #### [` swap `]() void swap([DelayImport]( "LIEF::PE::DelayImport") &other) #### [` attribute `]() inline uint32\_t attribute() const According to the official PE specifications, this value is reserved and should be set to 0. #### [` attribute `]() inline void attribute(uint32\_t hdl) #### [` name `]() inline std::string\_view name() const Return the library’s name (e.g. `kernel32.dll`). #### [` name `]() inline void name(std::string name) #### [` handle `]() inline uint32\_t handle() const The RVA of the module handle (in the `.data` section) It is used for storage by the routine that is supplied to manage delay-loading. #### [` handle `]() inline void handle(uint32\_t hdl) #### [` iat `]() inline uint32\_t iat() const RVA of the delay-load import address table. #### [` iat `]() inline void iat(uint32\_t iat) #### [` names_table `]() inline uint32\_t names\_table() const RVA of the delay-load import names table. The content of this table has the layout as the [Import]() lookup table. #### [` names_table `]() inline void names\_table(uint32\_t value) #### [` biat `]() inline uint32\_t biat() const RVA of the **bound** delay-load import address table or 0 if the table does not exist. #### [` biat `]() inline void biat(uint32\_t value) #### [` uiat `]() inline uint32\_t uiat() const RVA of the **unload** delay-load import address table or 0 if the table does not exist. According to the PE specifications, this table is an exact copy of the delay import address table that can be used to restore the original IAT in the case of unloading. #### [` uiat `]() inline void uiat(uint32\_t value) #### [` timestamp `]() inline uint32\_t timestamp() const The timestamp of the DLL to which this image has been bound. #### [` timestamp `]() inline void timestamp(uint32\_t value) #### [` entries `]() inline [it\_entries]( "LIEF::PE::DelayImport::it_entries") entries() Iterator over the [DelayImport]()’s entries ([DelayImportEntry]()). #### [` entries `]() inline [it\_const\_entries]( "LIEF::PE::DelayImport::it_const_entries") entries() const Iterator over the [DelayImport]()’s entries ([DelayImportEntry]()). #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [DelayImport]( "LIEF::PE::DelayImport") &entry) --- ## [Delay Import Entry]() ### [` DelayImportEntry `]() class DelayImportEntry : public LIEF::[Symbol]( "LIEF::Symbol") Class that represents an entry (i.e. an import) in the delay import table ([DelayImport]()). It extends the [LIEF::Symbol]() generic class that exposes the [LIEF::Symbol::name]() and [LIEF::Symbol::value]() API. The meaning of [LIEF::Symbol::value]() for this PE object is the address (as an RVA) in the IAT where the resolution should take place. Public Functions #### [` DelayImportEntry `]() DelayImportEntry() = default #### [` DelayImportEntry `]() inline DelayImportEntry(uint64\_t data, [PE\_TYPE]( "LIEF::PE::PE_TYPE") type) #### [` DelayImportEntry `]() DelayImportEntry(const [DelayImportEntry]( "LIEF::PE::DelayImportEntry::DelayImportEntry")&) = default #### [` operator= `]() [DelayImportEntry]( "LIEF::PE::DelayImportEntry") &operator=(const [DelayImportEntry]( "LIEF::PE::DelayImportEntry")&) = default #### [` DelayImportEntry `]() DelayImportEntry([DelayImportEntry]( "LIEF::PE::DelayImportEntry::DelayImportEntry")&&) noexcept = default #### [` operator= `]() [DelayImportEntry]( "LIEF::PE::DelayImportEntry") &operator=([DelayImportEntry]( "LIEF::PE::DelayImportEntry")&&) noexcept = default #### [` ~DelayImportEntry `]() ~DelayImportEntry() override = default #### [` demangled_name `]() std::string demangled\_name() const Demangled representation of the symbol or an empty string if it can’t be demangled. #### [` is_ordinal `]() bool is\_ordinal() const `True` if it is an import by ordinal #### [` ordinal `]() inline uint16\_t ordinal() const The ordinal value. #### [` hint_name_rva `]() inline uint64\_t hint\_name\_rva() const > **See also** > > [DelayImportEntry::data]() #### [` hint `]() inline uint16\_t hint() const Index into the [Export::entries]() that is used to speed-up the symbol resolution. #### [` iat_value `]() inline uint64\_t iat\_value() const Value of the current entry in the [Import]() Address Table. #### [` data `]() inline uint64\_t data() const Raw value. #### [` data `]() inline void data(uint64\_t data) #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [DelayImportEntry]( "LIEF::PE::DelayImportEntry") &entry) --- ## [TLS]() ### [` TLS `]() class TLS : public LIEF::Object Class which represents the PE Thread Local Storage. This PE structure is also used to implement binary/library constructors. Public Functions #### [` TLS `]() TLS() = default #### [` TLS `]() TLS(const details::pe32\_tls &header) #### [` TLS `]() TLS(const details::pe64\_tls &header) #### [` ~TLS `]() ~TLS() override = default #### [` TLS `]() TLS(const [TLS]( "LIEF::PE::TLS::TLS") &copy) = default #### [` operator= `]() [TLS]( "LIEF::PE::TLS") &operator=(const [TLS]( "LIEF::PE::TLS") &copy) = default #### [` TLS `]() TLS([TLS]( "LIEF::PE::TLS::TLS") &&other) noexcept = default #### [` operator= `]() [TLS]( "LIEF::PE::TLS") &operator=([TLS]( "LIEF::PE::TLS") &&other) noexcept = default #### [` callbacks `]() inline const std::vector<uint64\_t> &callbacks() const List of the callbacks associated with the current [TLS](). These functions are called before any other functions. #### [` add_callback `]() inline [TLS]( "LIEF::PE::TLS") &add\_callback(uint64\_t addr) Add a new [TLS]() callback. #### [` addressof_raw_data `]() inline const std::pair<uint64\_t, uint64\_t> &addressof\_raw\_data() const Pair `(start address, end address)` of the [TLS]() template. The template is a block of data that is used to initialize [TLS]() data. The system copies all of this data each time a thread is created, so it must not be corrupted. > **Note** > > These addresses are not RVA. They are addresses for which there should be a rebase relocation in the `.reloc` section. #### [` addressof_index `]() inline uint64\_t addressof\_index() const The location to receive the [TLS]() index assigned by the loader. This location should be located in a writable section like `.data`. #### [` addressof_callbacks `]() inline uint64\_t addressof\_callbacks() const Pointer to an array of [TLS]() callback functions. The array is null-terminated, so if there is no callback function this field points to **4 bytes** set to zero. #### [` sizeof_zero_fill `]() inline uint32\_t sizeof\_zero\_fill() const Size in bytes of the zero to be *padded* after the data specified by data\_template. #### [` characteristics `]() inline uint32\_t characteristics() const The four bits [23:20] describe alignment info. Possible values are those defined as `IMAGE_SCN_ALIGN_*`, which are also used to describe alignment of section in object files. The other 28 bits are reserved for future use. #### [` data_template `]() inline span<const uint8\_t> data\_template() const The initial content used to initialize [TLS]() data. #### [` has_data_directory `]() inline bool has\_data\_directory() const True if there is a data directory associated with this entry. #### [` directory `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*directory() Return the [DataDirectory]() associated with this object or a nullptr If it exists, its type should be [DataDirectory::TYPES::TLS\_TABLE](). #### [` directory `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*directory() const #### [` has_section `]() inline bool has\_section() const Check if there is a section associated with this entry. #### [` section `]() inline [Section]( "LIEF::PE::Section") \*section() The section associated with the entry (or a nullptr). #### [` section `]() inline const [Section]( "LIEF::PE::Section") \*section() const #### [` callbacks `]() inline void callbacks(std::vector<uint64\_t> callbacks) #### [` addressof_raw_data `]() inline void addressof\_raw\_data(std::pair<uint64\_t, uint64\_t> addresses) #### [` addressof_index `]() inline void addressof\_index(uint64\_t addr\_idx) #### [` addressof_callbacks `]() inline void addressof\_callbacks(uint64\_t addr) #### [` sizeof_zero_fill `]() inline void sizeof\_zero\_fill(uint32\_t size) #### [` characteristics `]() inline void characteristics(uint32\_t characteristics) #### [` data_template `]() inline void data\_template(std::vector<uint8\_t> data\_template) #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [TLS]( "LIEF::PE::TLS") &entry) --- ## [Debug]() ### [` Debug `]() class Debug : public LIEF::Object This class represents a generic entry in the debug data directory. For known types, this class is extended to provide a dedicated API (see: [CodeView]()). Subclassed by [LIEF::PE::CodeView](), [LIEF::PE::ExDllCharacteristics](), [LIEF::PE::FPO](), [LIEF::PE::PDBChecksum](), [LIEF::PE::Pogo](), [LIEF::PE::Repro](), [LIEF::PE::VCFeature]() Public Types #### [` TYPES `]() enum class TYPES The entry types. *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` COFF `]() enumerator COFF = 1 COFF [Debug]() information. ##### [` CODEVIEW `]() enumerator CODEVIEW = 2 [CodeView]() debug information that is used to store PDB info. ##### [` FPO `]() enumerator FPO = 3 Frame pointer omission information. ##### [` MISC `]() enumerator MISC = 4 Miscellaneous debug information. ##### [` EXCEPTION `]() enumerator EXCEPTION = 5 [Debug]() information that is a *copy* of the `.pdata` section. ##### [` FIXUP `]() enumerator FIXUP = 6 (Reserved) [Debug]() information used for fixup relocations ##### [` OMAP_TO_SRC `]() enumerator OMAP\_TO\_SRC = 7 The mapping from an RVA in image to an RVA in source image. ##### [` OMAP_FROM_SRC `]() enumerator OMAP\_FROM\_SRC = 8 The mapping from an RVA in source image to an RVA in image. ##### [` BORLAND `]() enumerator BORLAND = 9 Reserved for Borland. ##### [` RESERVED10 `]() enumerator RESERVED10 = 10 Reserved. ##### [` CLSID `]() enumerator CLSID = 11 Reserved. ##### [` VC_FEATURE `]() enumerator VC\_FEATURE = 12 Visual C++ feature information. ##### [` POGO `]() enumerator POGO = 13 Profile Guided Optimization metadata. ##### [` ILTCG `]() enumerator ILTCG = 14 Incremental Link Time Code Generation metadata. ##### [` MPX `]() enumerator MPX = 15 ##### [` REPRO `]() enumerator REPRO = 16 PE determinism or reproducibility information. ##### [` PDBCHECKSUM `]() enumerator PDBCHECKSUM = 19 Checksum of the PDB file. ##### [` EX_DLLCHARACTERISTICS `]() enumerator EX\_DLLCHARACTERISTICS = 20 Extended DLL characteristics. Public Functions #### [` Debug `]() Debug() = default #### [` Debug `]() inline Debug([TYPES]( "LIEF::PE::Debug::TYPES") type) #### [` Debug `]() Debug(const details::pe\_debug &debug\_s, [Section]( "LIEF::PE::Section") \*section) #### [` Debug `]() Debug(const [Debug]( "LIEF::PE::Debug::Debug") &other) = default #### [` operator= `]() [Debug]( "LIEF::PE::Debug") &operator=(const [Debug]( "LIEF::PE::Debug") &other) = default #### [` Debug `]() Debug([Debug]( "LIEF::PE::Debug::Debug")&&) = default #### [` operator= `]() [Debug]( "LIEF::PE::Debug") &operator=([Debug]( "LIEF::PE::Debug")&&) = default #### [` ~Debug `]() ~Debug() override = default #### [` clone `]() inline virtual std::unique\_ptr<[Debug]( "LIEF::PE::Debug")> clone() const #### [` characteristics `]() inline uint32\_t characteristics() const Reserved should be 0. #### [` timestamp `]() inline uint32\_t timestamp() const The time and date when the debug data was created. #### [` major_version `]() inline uint16\_t major\_version() const The major version number of the debug data format. #### [` minor_version `]() inline uint16\_t minor\_version() const The minor version number of the debug data format. #### [` type `]() inline [TYPES]( "LIEF::PE::Debug::TYPES") type() const The format DEBUG\_TYPES of the debugging information. #### [` sizeof_data `]() inline uint32\_t sizeof\_data() const Size of the debug data. #### [` addressof_rawdata `]() inline uint32\_t addressof\_rawdata() const Address of the debug data relative to the image base. #### [` pointerto_rawdata `]() inline uint32\_t pointerto\_rawdata() const File offset of the debug data. #### [` section `]() inline const [Section]( "LIEF::PE::Section") \*section() const The section where debug data is located. #### [` section `]() inline [Section]( "LIEF::PE::Section") \*section() #### [` payload `]() span<uint8\_t> payload() [Debug]() data associated with this entry. #### [` payload `]() inline span<const uint8\_t> payload() const #### [` characteristics `]() inline void characteristics(uint32\_t characteristics) #### [` timestamp `]() inline void timestamp(uint32\_t timestamp) #### [` major_version `]() inline void major\_version(uint16\_t major\_version) #### [` minor_version `]() inline void minor\_version(uint16\_t minor\_version) #### [` sizeof_data `]() inline void sizeof\_data(uint32\_t sizeof\_data) #### [` addressof_rawdata `]() inline void addressof\_rawdata(uint32\_t addressof\_rawdata) #### [` pointerto_rawdata `]() inline void pointerto\_rawdata(uint32\_t pointerto\_rawdata) #### [` Tas `]() template<class T> inline const [T]( "LIEF::PE::Debug::as::T") \*as() const #### [` Tas `]() template<class T> inline [T]( "LIEF::PE::Debug::as::T") \*as() #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` to_string `]() virtual std::string to\_string() const Public Static Functions #### [` get_payload `]() static span<uint8\_t> get\_payload([Section]( "LIEF::PE::Section") &section, uint32\_t rva, uint32\_t offset, uint32\_t size) #### [` get_payload `]() static span<uint8\_t> get\_payload([Section]( "LIEF::PE::Section") &section, const details::pe\_debug &hdr) #### [` get_payload `]() static inline span<uint8\_t> get\_payload([Section]( "LIEF::PE::Section") &section, const [Debug]( "LIEF::PE::Debug") &dbg) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Debug]( "LIEF::PE::Debug") &entry) --- ## [Code View]() ### [` CodeView `]() class CodeView : public LIEF::PE::[Debug]( "LIEF::PE::Debug") Interface for the (generic) [Debug]() [CodeView]() (`IMAGE_DEBUG_TYPE_CODEVIEW`). Subclassed by [LIEF::PE::CodeViewPDB]() Public Types #### [` SIGNATURES `]() enum class SIGNATURES Code view signatures. > **See also** > > : [http://llvm.org/doxygen/CVDebugRecord\_8h\_source.html]() *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` PDB_70 `]() enumerator PDB\_70 = 0x53445352 ##### [` PDB_20 `]() enumerator PDB\_20 = 0x3031424e ##### [` CV_50 `]() enumerator CV\_50 = 0x3131424e ##### [` CV_41 `]() enumerator CV\_41 = 0x3930424e Public Functions #### [` CodeView `]() inline CodeView() #### [` CodeView `]() inline CodeView([SIGNATURES]( "LIEF::PE::CodeView::SIGNATURES") sig) #### [` CodeView `]() inline CodeView(const details::pe\_debug &debug, [SIGNATURES]( "LIEF::PE::CodeView::SIGNATURES") sig, [Section]( "LIEF::PE::Section") \*sec) #### [` CodeView `]() CodeView(const [CodeView]( "LIEF::PE::CodeView::CodeView") &other) = default #### [` operator= `]() [CodeView]( "LIEF::PE::CodeView") &operator=(const [CodeView]( "LIEF::PE::CodeView") &other) = default #### [` CodeView `]() CodeView([CodeView]( "LIEF::PE::CodeView::CodeView") &&other) = default #### [` operator= `]() [CodeView]( "LIEF::PE::CodeView") &operator=([CodeView]( "LIEF::PE::CodeView") &&other) = default #### [` ~CodeView `]() ~CodeView() override = default #### [` signature `]() inline [SIGNATURES]( "LIEF::PE::CodeView::SIGNATURES") signature() const The signature that defines the underlying type of the payload. #### [` clone `]() inline virtual std::unique\_ptr<[Debug]( "LIEF::PE::Debug")> clone() const override #### [` to_string `]() virtual std::string to\_string() const override #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` classof `]() static inline bool classof(const [Debug]( "LIEF::PE::Debug") \*debug) --- ## [Code View PDB]() ### [` CodeViewPDB `]() class CodeViewPDB : public LIEF::PE::[CodeView]( "LIEF::PE::CodeView") [CodeView]() PDB specialization. Public Types #### [` signature_t `]() using signature\_t = std::array<uint8\_t, 16> Public Functions #### [` CodeViewPDB `]() inline CodeViewPDB() #### [` CodeViewPDB `]() inline CodeViewPDB(std::string filename) #### [` CodeViewPDB `]() CodeViewPDB(const details::pe\_debug &debug\_info, const details::pe\_pdb\_70 &pdb\_70, [Section]( "LIEF::PE::Section") \*sec) #### [` CodeViewPDB `]() CodeViewPDB(const details::pe\_debug &debug\_info, const details::pe\_pdb\_20 &pdb\_70, [Section]( "LIEF::PE::Section") \*sec) #### [` CodeViewPDB `]() CodeViewPDB(const [CodeViewPDB]( "LIEF::PE::CodeViewPDB::CodeViewPDB") &other) = default #### [` operator= `]() [CodeViewPDB]( "LIEF::PE::CodeViewPDB") &operator=(const [CodeViewPDB]( "LIEF::PE::CodeViewPDB") &other) = default #### [` CodeViewPDB `]() CodeViewPDB([CodeViewPDB]( "LIEF::PE::CodeViewPDB::CodeViewPDB") &&other) = default #### [` operator= `]() [CodeViewPDB]( "LIEF::PE::CodeViewPDB") &operator=([CodeViewPDB]( "LIEF::PE::CodeViewPDB") &&other) = default #### [` guid `]() std::string guid() const The GUID signature to verify against the `.pdb` file signature. This attribute might be used to lookup remote PDB file on a symbol server. #### [` age `]() inline uint32\_t age() const Age value to verify. The age does not necessarily correspond to any known time value, it is used to determine if a .pdb file is out of sync with corresponding `.exe` file. #### [` signature `]() inline const [signature\_t]( "LIEF::PE::CodeViewPDB::signature_t") &signature() const The 32-bit signature to verify against the .pdb file signature. #### [` filename `]() inline std::string\_view filename() const The path to the `.pdb` file. #### [` age `]() inline void age(uint32\_t age) #### [` signature `]() inline void signature(const [signature\_t]( "LIEF::PE::CodeViewPDB::signature_t") &sig) #### [` filename `]() inline void filename(std::string filename) #### [` clone `]() inline virtual std::unique\_ptr<[Debug]( "LIEF::PE::Debug")> clone() const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` to_string `]() virtual std::string to\_string() const override #### [` ~CodeViewPDB `]() ~CodeViewPDB() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Debug]( "LIEF::PE::Debug") \*debug) --- ## [Relocation]() ### [` Relocation `]() class Relocation : public LIEF::Object Class which represents the *Base [Relocation]() Block* We usually find this structure in the `.reloc` section. Public Types #### [` entries_t `]() using entries\_t = std::vector<std::unique\_ptr<[RelocationEntry]( "LIEF::PE::RelocationEntry")>> #### [` it_entries `]() using it\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[entries\_t]( "LIEF::PE::Relocation::entries_t")&, [RelocationEntry]( "LIEF::PE::RelocationEntry")\*> #### [` it_const_entries `]() using it\_const\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [entries\_t]( "LIEF::PE::Relocation::entries_t")&, [RelocationEntry]( "LIEF::PE::RelocationEntry")\*> #### [` relocations_t `]() using relocations\_t = std::vector<std::unique\_ptr<[Relocation]( "LIEF::PE::Relocation")>> Public Functions #### [` Relocation `]() Relocation() #### [` Relocation `]() Relocation(uint32\_t base, uint32\_t block\_size) #### [` Relocation `]() Relocation(uint32\_t base) #### [` Relocation `]() Relocation(const [Relocation]( "LIEF::PE::Relocation::Relocation") &other) #### [` operator= `]() [Relocation]( "LIEF::PE::Relocation") &operator=([Relocation]( "LIEF::PE::Relocation") other) #### [` Relocation `]() Relocation([Relocation]( "LIEF::PE::Relocation::Relocation")&&) #### [` operator= `]() [Relocation]( "LIEF::PE::Relocation") &operator=([Relocation]( "LIEF::PE::Relocation") &&other) #### [` Relocation `]() Relocation(const details::pe\_base\_relocation\_block &header) #### [` ~Relocation `]() ~Relocation() override #### [` swap `]() void swap([Relocation]( "LIEF::PE::Relocation") &other) #### [` virtual_address `]() inline uint32\_t virtual\_address() const The RVA for which the offset of the relocation entries ([RelocationEntry]()) is added. #### [` block_size `]() inline uint32\_t block\_size() const The total number of bytes in the base relocation block. ```default block_size = sizeof(BaseRelocationBlock) + nb_of_relocs * sizeof(uint16_t = RelocationEntry) ``` #### [` entries `]() inline [it\_const\_entries]( "LIEF::PE::Relocation::it_const_entries") entries() const Iterator over the [RelocationEntry](). #### [` entries `]() inline [it\_entries]( "LIEF::PE::Relocation::it_entries") entries() #### [` virtual_address `]() inline void virtual\_address(uint32\_t virtual\_address) #### [` block_size `]() inline void block\_size(uint32\_t block\_size) #### [` add_entry `]() [RelocationEntry]( "LIEF::PE::RelocationEntry") &add\_entry(const [RelocationEntry]( "LIEF::PE::RelocationEntry") &entry) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` parse `]() static [relocations\_t]( "LIEF::PE::Relocation::relocations_t") parse([Parser]( "LIEF::PE::Parser") &ctx, [BinaryStream]( "LIEF::BinaryStream") &stream) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Relocation]( "LIEF::PE::Relocation") &relocation) --- ## [Relocation Entry]() ### [` RelocationEntry `]() class RelocationEntry : public LIEF::[Relocation]( "LIEF::Relocation") Class which represents an entry of the PE relocation table. It extends the [LIEF::Relocation]() object to provide a uniform API across the file formats Public Types #### [` BASE_TYPES `]() enum class BASE\_TYPES [Relocation]() type as described in [https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#base-relocation-types](). *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = -1 ##### [` ABS `]() enumerator ABS = 0 This value matches: `IMAGE_REL_BASED_ABSOLUTE` The base relocation is skipped. This type can be used to pad a block. ##### [` HIGH `]() enumerator HIGH = 1 This value matches: `IMAGE_REL_BASED_HIGH` The base relocation adds the high 16 bits of the difference to the 16-bit field at offset. The 16-bit field represents the high value of a 32-bit word. Operation: ```cpp write(ADDR, ((read(ADDR) << 16) + DELTA) >> 16) ``` ##### [` LOW `]() enumerator LOW = 2 The base relocation adds the low 16 bits of the difference to the 16-bit field at offset. The 16-bit field represents the low half of a 32-bit word. Operation: ```cpp write(ADDR, ((int32_t_t)read(ADDR) + DELTA)) ``` ##### [` HIGHLOW `]() enumerator HIGHLOW = 3 This value matches `IMAGE_REL_BASED_HIGHLOW`. The base relocation applies all 32 bits of the difference to the 32-bit field at offset. Operation: ```cpp write(ADDR, read(ADDR) + DELTA) ``` ##### [` HIGHADJ `]() enumerator HIGHADJ = 4 This value matches `IMAGE_REL_BASED_HIGHADJ`. The base relocation adds the high 16 bits of the difference to the 16-bit field at offset. The 16-bit field represents the high value of a 32-bit word. The low 16 bits of the 32-bit value are stored in the 16-bit word that follows this base relocation. This means that this base relocation occupies two slots. ##### [` MIPS_JMPADDR `]() enumerator MIPS\_JMPADDR = 5 | (1 << 8) ##### [` ARM_MOV32 `]() enumerator ARM\_MOV32 = 5 | (1 << 9) ##### [` RISCV_HI20 `]() enumerator RISCV\_HI20 = 5 | (1 << 10) ##### [` SECTION `]() enumerator SECTION = 6 ##### [` THUMB_MOV32 `]() enumerator THUMB\_MOV32 = 7 | (1 << 11) ##### [` RISCV_LOW12I `]() enumerator RISCV\_LOW12I = 7 | (1 << 12) ##### [` RISCV_LOW12S `]() enumerator RISCV\_LOW12S = 8 | (1 << 13) ##### [` LOONARCH_MARK_LA `]() enumerator LOONARCH\_MARK\_LA = 8 | (1 << 14) ##### [` MIPS_JMPADDR16 `]() enumerator MIPS\_JMPADDR16 = 9 ##### [` DIR64 `]() enumerator DIR64 = 10 This value matches `IMAGE_REL_BASED_DIR64`. The base relocation applies the difference to the 64-bit field at offset. Operation: ```cpp write(ADDR, read(ADDR) + DELTA) ``` ##### [` HIGH3ADJ `]() enumerator HIGH3ADJ = 11 Public Functions #### [` RelocationEntry `]() RelocationEntry() = default #### [` RelocationEntry `]() inline RelocationEntry(const [RelocationEntry]( "LIEF::PE::RelocationEntry::RelocationEntry") &other) #### [` operator= `]() inline [RelocationEntry]( "LIEF::PE::RelocationEntry") &operator=([RelocationEntry]( "LIEF::PE::RelocationEntry") other) #### [` RelocationEntry `]() RelocationEntry([RelocationEntry]( "LIEF::PE::RelocationEntry::RelocationEntry") &&other) = default #### [` operator= `]() [RelocationEntry]( "LIEF::PE::RelocationEntry") &operator=([RelocationEntry]( "LIEF::PE::RelocationEntry") &&other) = default #### [` RelocationEntry `]() inline RelocationEntry(uint16\_t position, [BASE\_TYPES]( "LIEF::PE::RelocationEntry::BASE_TYPES") type) #### [` ~RelocationEntry `]() ~RelocationEntry() override = default #### [` swap `]() inline void swap([RelocationEntry]( "LIEF::PE::RelocationEntry") &other) #### [` address `]() virtual uint64\_t address() const override The address of the relocation. #### [` address `]() virtual void address(uint64\_t address) override #### [` size `]() virtual size\_t size() const override The size of the relocatable pointer. #### [` size `]() virtual void size(size\_t size) override #### [` data `]() inline uint16\_t data() const Raw data of the relocation: - The **high** 4 bits store the relocation type - The **low** 12 bits store the relocation offset #### [` position `]() inline uint16\_t position() const Offset relative to [Relocation::virtual\_address]() where the relocation occurs. #### [` type `]() inline [BASE\_TYPES]( "LIEF::PE::RelocationEntry::BASE_TYPES") type() const Type of the relocation. #### [` position `]() inline void position(uint16\_t position) #### [` type `]() inline void type([BASE\_TYPES]( "LIEF::PE::RelocationEntry::BASE_TYPES") type) #### [` accept `]() virtual void accept(Visitor &visitor) const override Method so that the `visitor` can visit us. Public Static Functions #### [` get_position `]() static inline uint16\_t get\_position(uint16\_t data) #### [` get_type `]() static inline uint16\_t get\_type(uint16\_t data) #### [` type_from_data `]() static [BASE\_TYPES]( "LIEF::PE::RelocationEntry::BASE_TYPES") type\_from\_data([Header]( "LIEF::PE::Header")::[MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") arch, uint16\_t data) Public Static Attributes #### [` MAX_ADDR `]() static auto MAX\_ADDR = 1 << 12 Friends **friend class PE::Relocation** #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [RelocationEntry]( "LIEF::PE::RelocationEntry") &entry) --- ## [Export]() ### [` Export `]() class Export : public LIEF::Object Class which represents a PE [Export](). Public Types #### [` entries_t `]() using entries\_t = std::vector<std::unique\_ptr<[ExportEntry]( "LIEF::PE::ExportEntry")>> #### [` it_entries `]() using it\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[entries\_t]( "LIEF::PE::Export::entries_t")&, [ExportEntry]( "LIEF::PE::ExportEntry")\*> #### [` it_const_entries `]() using it\_const\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [entries\_t]( "LIEF::PE::Export::entries_t")&, const [ExportEntry]( "LIEF::PE::ExportEntry")\*> Public Functions #### [` Export `]() Export() = default #### [` Export `]() inline Export(std::string name, const std::vector<[ExportEntry]( "LIEF::PE::ExportEntry")> &entries) #### [` Export `]() inline Export(std::string name) #### [` Export `]() Export(const details::pe\_export\_directory\_table &header) #### [` Export `]() Export(const [Export]( "LIEF::PE::Export::Export")&) #### [` operator= `]() [Export]( "LIEF::PE::Export") &operator=(const [Export]( "LIEF::PE::Export")&) #### [` Export `]() Export([Export]( "LIEF::PE::Export::Export")&&) = default #### [` operator= `]() [Export]( "LIEF::PE::Export") &operator=([Export]( "LIEF::PE::Export")&&) = default #### [` ~Export `]() ~Export() override = default #### [` export_flags `]() inline uint32\_t export\_flags() const According to the PE specifications this value is reserved and should be set to 0. #### [` timestamp `]() inline uint32\_t timestamp() const The time and date that the export data was created. #### [` major_version `]() inline uint16\_t major\_version() const The major version number (can be user-defined). #### [` minor_version `]() inline uint16\_t minor\_version() const The minor version number (can be user-defined). #### [` ordinal_base `]() inline uint32\_t ordinal\_base() const The starting number for the exports. Usually this value is set to 1. #### [` name `]() inline std::string\_view name() const The name of the library exported (e.g. `KERNEL32.dll`). #### [` entries `]() inline [it\_entries]( "LIEF::PE::Export::it_entries") entries() Iterator over the [ExportEntry](). #### [` entries `]() inline [it\_const\_entries]( "LIEF::PE::Export::it_const_entries") entries() const #### [` name_rva `]() inline uint32\_t name\_rva() const Address of the ASCII DLL’s name (RVA). #### [` export_addr_table_rva `]() inline uint32\_t export\_addr\_table\_rva() const RVA of the export address table. #### [` export_addr_table_cnt `]() inline uint32\_t export\_addr\_table\_cnt() const Number of entries in the export address table. #### [` names_addr_table_rva `]() inline uint32\_t names\_addr\_table\_rva() const RVA to the list of exported names. #### [` names_addr_table_cnt `]() inline uint32\_t names\_addr\_table\_cnt() const Number of exports by name. #### [` ord_addr_table_rva `]() inline uint32\_t ord\_addr\_table\_rva() const RVA to the list of exported ordinals. #### [` export_flags `]() inline void export\_flags(uint32\_t flags) #### [` timestamp `]() inline void timestamp(uint32\_t timestamp) #### [` major_version `]() inline void major\_version(uint16\_t major\_version) #### [` minor_version `]() inline void minor\_version(uint16\_t minor\_version) #### [` ordinal_base `]() inline void ordinal\_base(uint32\_t ordinal\_base) #### [` name `]() inline void name(std::string name) #### [` find_entry `]() const [ExportEntry]( "LIEF::PE::ExportEntry") \*find\_entry(const std::string &name) const Find the export entry with the given name. #### [` find_entry `]() inline [ExportEntry]( "LIEF::PE::ExportEntry") \*find\_entry(const std::string &name) #### [` find_entry `]() const [ExportEntry]( "LIEF::PE::ExportEntry") \*find\_entry(uint32\_t ordinal) const Find the export entry with the given ordinal number. #### [` find_entry `]() inline [ExportEntry]( "LIEF::PE::ExportEntry") \*find\_entry(uint32\_t ordinal) #### [` find_entry_at `]() const [ExportEntry]( "LIEF::PE::ExportEntry") \*find\_entry\_at(uint32\_t rva) const Find the export entry at the provided RVA. #### [` find_entry_at `]() inline [ExportEntry]( "LIEF::PE::ExportEntry") \*find\_entry\_at(uint32\_t rva) #### [` add_entry `]() [ExportEntry]( "LIEF::PE::ExportEntry") &add\_entry(const [ExportEntry]( "LIEF::PE::ExportEntry") &exp) Add the given export and return the newly created and added export. #### [` add_entry `]() inline [ExportEntry]( "LIEF::PE::ExportEntry") &add\_entry(std::string name, uint32\_t rva) #### [` remove_entry `]() bool remove\_entry(const [ExportEntry]( "LIEF::PE::ExportEntry") &exp) Remove the given export entry. #### [` remove_entry `]() inline bool remove\_entry(const std::string &name) Remove the export entry with the given name. #### [` remove_entry `]() inline bool remove\_entry(uint32\_t rva) Remove the export entry with the given RVA. #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Export]( "LIEF::PE::Export") &exp) --- ## [Export Entry]() ### [` ExportEntry `]() class ExportEntry : public LIEF::[Symbol]( "LIEF::Symbol") Class which represents a PE [Export]() entry (cf. [PE::Export]()). Public Functions #### [` ExportEntry `]() ExportEntry() = default #### [` ExportEntry `]() inline ExportEntry(uint32\_t address, bool is\_extern, uint16\_t ordinal, uint32\_t function\_rva) #### [` ExportEntry `]() inline ExportEntry(std::string name, uint32\_t rva) #### [` ExportEntry `]() ExportEntry(const [ExportEntry]( "LIEF::PE::ExportEntry::ExportEntry")&) = default #### [` operator= `]() [ExportEntry]( "LIEF::PE::ExportEntry") &operator=(const [ExportEntry]( "LIEF::PE::ExportEntry")&) = default #### [` ExportEntry `]() ExportEntry([ExportEntry]( "LIEF::PE::ExportEntry::ExportEntry")&&) = default #### [` operator= `]() [ExportEntry]( "LIEF::PE::ExportEntry") &operator=([ExportEntry]( "LIEF::PE::ExportEntry")&&) = default #### [` ~ExportEntry `]() ~ExportEntry() override = default #### [` demangled_name `]() std::string demangled\_name() const Demangled representation of the symbol or an empty string if it can’t be demangled. #### [` ordinal `]() inline uint16\_t ordinal() const Ordinal value associated with this exported entry. This value is computed as the index of this entry in the address table plus the ordinal base ([Export::ordinal\_base]()) #### [` address `]() inline uint32\_t address() const Address of the current exported function in the DLL. > **Warning** > > If this entry is **external** to the DLL then it returns 0 and the external address is returned by [function\_rva()]() #### [` is_extern `]() inline bool is\_extern() const #### [` is_forwarded `]() inline bool is\_forwarded() const #### [` forward_information `]() inline [forward\_information\_t]( "LIEF::PE::ExportEntry::forward_information_t") forward\_information() const #### [` function_rva `]() inline uint32\_t function\_rva() const #### [` ordinal `]() inline void ordinal(uint16\_t ordinal) #### [` address `]() inline void address(uint32\_t address) #### [` is_extern `]() inline void is\_extern(bool is\_extern) #### [` value `]() inline virtual uint64\_t value() const override [Symbol]()’s value which is usually the **address** of the symbol. #### [` value `]() inline virtual void value(uint64\_t value) override #### [` set_forward_info `]() inline void set\_forward\_info(std::string lib, std::string function) #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ExportEntry]( "LIEF::PE::ExportEntry") &exportEntry) #### [` forward_information_t `]() struct forward\_information\_t Public Functions ##### [` operator bool `]() inline operator bool() const ##### [` key `]() inline std::string key() const Public Members ##### [` library `]() std::string library ##### [` function `]() std::string function Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [forward\_information\_t]( "LIEF::PE::ExportEntry::forward_information_t") &info) --- ## [Signature]() ### [` Signature `]() class Signature : public LIEF::Object Main interface for the PKCS #7 signature scheme. Public Types #### [` VERIFICATION_FLAGS `]() enum class VERIFICATION\_FLAGS : uint32\_t Flags returned by the verification functions. *Values:* ##### [` OK `]() enumerator OK = 0 ##### [` INVALID_SIGNER `]() enumerator INVALID\_SIGNER = 1 << 0 ##### [` UNSUPPORTED_ALGORITHM `]() enumerator UNSUPPORTED\_ALGORITHM = 1 << 1 ##### [` INCONSISTENT_DIGEST_ALGORITHM `]() enumerator INCONSISTENT\_DIGEST\_ALGORITHM = 1 << 2 ##### [` CERT_NOT_FOUND `]() enumerator CERT\_NOT\_FOUND = 1 << 3 ##### [` CORRUPTED_CONTENT_INFO `]() enumerator CORRUPTED\_CONTENT\_INFO = 1 << 4 ##### [` CORRUPTED_AUTH_DATA `]() enumerator CORRUPTED\_AUTH\_DATA = 1 << 5 ##### [` MISSING_PKCS9_MESSAGE_DIGEST `]() enumerator MISSING\_PKCS9\_MESSAGE\_DIGEST = 1 << 6 ##### [` BAD_DIGEST `]() enumerator BAD\_DIGEST = 1 << 7 ##### [` BAD_SIGNATURE `]() enumerator BAD\_SIGNATURE = 1 << 8 ##### [` NO_SIGNATURE `]() enumerator NO\_SIGNATURE = 1 << 9 ##### [` CERT_EXPIRED `]() enumerator CERT\_EXPIRED = 1 << 10 ##### [` CERT_FUTURE `]() enumerator CERT\_FUTURE = 1 << 11 #### [` VERIFICATION_CHECKS `]() enum class VERIFICATION\_CHECKS : uint32\_t Flags to tweak the verification process of the signature. See [Signature::check]() and [LIEF::PE::Binary::verify\_signature]() *Values:* ##### [` DEFAULT `]() enumerator DEFAULT = 1 << 0 Default behavior that tries to follow the Microsoft verification process as close as possible. ##### [` HASH_ONLY `]() enumerator HASH\_ONLY = 1 << 1 Only check that [Binary::authentihash]() matches [ContentInfo::digest]() regardless of the signature’s validity. ##### [` LIFETIME_SIGNING `]() enumerator LIFETIME\_SIGNING = 1 << 2 Same semantic as [WTD\_LIFETIME\_SIGNING\_FLAG](). ##### [` SKIP_CERT_TIME `]() enumerator SKIP\_CERT\_TIME = 1 << 3 Skip the verification of the certificate validity periods so that even though a certificate expired, it returns [VERIFICATION\_FLAGS::OK](). #### [` it_const_crt `]() using it\_const\_crt = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const std::vector<[x509]( "LIEF::PE::x509")>&> Iterator which outputs const [x509]()& certificates. #### [` it_crt `]() using it\_crt = [ref\_iterator]( "LIEF::ref_iterator")<std::vector<[x509]( "LIEF::PE::x509")>&> Iterator which outputs [x509]()& certificates. #### [` it_const_signers_t `]() using it\_const\_signers\_t = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const std::vector<[SignerInfo]( "LIEF::PE::SignerInfo")>&> Iterator which outputs const [SignerInfo]()&. #### [` it_signers_t `]() using it\_signers\_t = [ref\_iterator]( "LIEF::ref_iterator")<std::vector<[SignerInfo]( "LIEF::PE::SignerInfo")>&> Iterator which outputs [SignerInfo]()&. Public Functions #### [` Signature `]() Signature() #### [` Signature `]() Signature(const [Signature]( "LIEF::PE::Signature::Signature")&) #### [` operator= `]() [Signature]( "LIEF::PE::Signature") &operator=(const [Signature]( "LIEF::PE::Signature")&) #### [` Signature `]() Signature([Signature]( "LIEF::PE::Signature::Signature")&&) #### [` operator= `]() [Signature]( "LIEF::PE::Signature") &operator=([Signature]( "LIEF::PE::Signature")&&) #### [` version `]() inline uint32\_t version() const Should be 1. #### [` digest_algorithm `]() inline [ALGORITHMS]( "LIEF::PE::ALGORITHMS") digest\_algorithm() const Algorithm used to *digest* the file. It should match [SignerInfo::digest\_algorithm]() #### [` content_info `]() inline const [ContentInfo]( "LIEF::PE::ContentInfo") &content\_info() const Return the [ContentInfo](). #### [` certificates `]() inline [it\_const\_crt]( "LIEF::PE::Signature::it_const_crt") certificates() const Return an iterator over [x509]() certificates. #### [` certificates `]() inline [it\_crt]( "LIEF::PE::Signature::it_crt") certificates() #### [` signers `]() inline [it\_const\_signers\_t]( "LIEF::PE::Signature::it_const_signers_t") signers() const Return an iterator over the signers ([SignerInfo]()) defined in the PKCS #7 signature. #### [` signers `]() inline [it\_signers\_t]( "LIEF::PE::Signature::it_signers_t") signers() #### [` raw_der `]() inline span<const uint8\_t> raw\_der() const Return the raw original PKCS7 signature. #### [` find_crt `]() const [x509]( "LIEF::PE::x509") \*find\_crt(const std::vector<uint8\_t> &serialno) const Find [x509]() certificate according to its serial number. #### [` find_crt_subject `]() const [x509]( "LIEF::PE::x509") \*find\_crt\_subject(std::string\_view subject) const Find [x509]() certificate according to its subject. #### [` find_crt_subject `]() const [x509]( "LIEF::PE::x509") \*find\_crt\_subject(std::string\_view subject, const std::vector<uint8\_t> &serialno) const Find [x509]() certificate according to its subject **AND** serial number. #### [` find_crt_issuer `]() const [x509]( "LIEF::PE::x509") \*find\_crt\_issuer(std::string\_view issuer) const Find [x509]() certificate according to its issuer. #### [` find_crt_issuer `]() const [x509]( "LIEF::PE::x509") \*find\_crt\_issuer(std::string\_view issuer, const std::vector<uint8\_t> &serialno) const Find [x509]() certificate according to its issuer **AND** serial number. #### [` check `]() [VERIFICATION\_FLAGS]( "LIEF::PE::Signature::VERIFICATION_FLAGS") check([VERIFICATION\_CHECKS]( "LIEF::PE::Signature::VERIFICATION_CHECKS") checks = [VERIFICATION\_CHECKS]( "LIEF::PE::Signature::VERIFICATION_CHECKS")::[DEFAULT]( "LIEF::PE::Signature::VERIFICATION_CHECKS::DEFAULT")) const Check if this signature is valid according to the Authenticode/PKCS #7 verification scheme. By default, it performs the following verifications: 1. It must contain only **one** signer info 2. [Signature::digest\_algorithm]() must match: - [ContentInfo::digest\_algorithm]() - [SignerInfo::digest\_algorithm]() 3. The [x509]() certificate specified by [SignerInfo::serial\_number]() **and** [SignerInfo::issuer]() must exist within [Signature::certificates]() 4. Given the [x509]() certificate, compare [SignerInfo::encrypted\_digest]() against either: - hash of authenticated attributes if present - hash of [ContentInfo]() 5. If authenticated attributes are present, check that a PKCS9\_MESSAGE\_DIGEST attribute exists and that its value matches hash of [ContentInfo]() 6. Check the validity of the PKCS #9 counter signature if present 7. If the signature doesn’t embed a signing-time in the counter signature, check the certificate validity. (See [LIEF::PE::Signature::VERIFICATION\_CHECKS::LIFETIME\_SIGNING]() and [LIEF::PE::Signature::VERIFICATION\_CHECKS::SKIP\_CERT\_TIME]()) See: [LIEF::PE::Signature::VERIFICATION\_CHECKS]() to tweak the behavior #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~Signature `]() ~Signature() override Public Static Functions #### [` hash `]() static inline std::vector<uint8\_t> hash(const std::vector<uint8\_t> &input, [ALGORITHMS]( "LIEF::PE::ALGORITHMS") algo) Hash the input given the algorithm. #### [` hash `]() static std::vector<uint8\_t> hash(const uint8\_t \*buffer, size\_t size, [ALGORITHMS]( "LIEF::PE::ALGORITHMS") algo) #### [` flag_to_string `]() static std::string flag\_to\_string([VERIFICATION\_FLAGS]( "LIEF::PE::Signature::VERIFICATION_FLAGS") flag) Convert a verification flag into a human-readable representation. e.g [VERIFICATION\_FLAGS.BAD\_DIGEST]() | [VERIFICATION\_FLAGS.BAD\_SIGNATURE]() | [VERIFICATION\_FLAGS.CERT\_EXPIRED](). Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Signature]( "LIEF::PE::Signature") &signature) --- ## [Signature Attribute]() ### [` Attribute `]() class Attribute : public LIEF::Object Interface over PKCS #7 attribute. Subclassed by [LIEF::PE::ContentType](), [LIEF::PE::GenericType](), [LIEF::PE::MsCounterSign](), [LIEF::PE::MsManifestBinaryID](), [LIEF::PE::MsSpcNestedSignature](), [LIEF::PE::MsSpcStatementType](), [LIEF::PE::PKCS9AtSequenceNumber](), [LIEF::PE::PKCS9CounterSignature](), [LIEF::PE::PKCS9MessageDigest](), [LIEF::PE::PKCS9SigningTime](), [LIEF::PE::SigningCertificateV2](), [LIEF::PE::SpcRelaxedPeMarkerCheck](), [LIEF::PE::SpcSpOpusInfo]() Public Types #### [` TYPE `]() enum class TYPE *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` CONTENT_TYPE `]() enumerator CONTENT\_TYPE ##### [` GENERIC_TYPE `]() enumerator GENERIC\_TYPE ##### [` SIGNING_CERTIFICATE_V2 `]() enumerator SIGNING\_CERTIFICATE\_V2 ##### [` SPC_SP_OPUS_INFO `]() enumerator SPC\_SP\_OPUS\_INFO ##### [` SPC_RELAXED_PE_MARKER_CHECK `]() enumerator SPC\_RELAXED\_PE\_MARKER\_CHECK ##### [` MS_COUNTER_SIGN `]() enumerator MS\_COUNTER\_SIGN ##### [` MS_SPC_NESTED_SIGN `]() enumerator MS\_SPC\_NESTED\_SIGN ##### [` MS_SPC_STATEMENT_TYPE `]() enumerator MS\_SPC\_STATEMENT\_TYPE ##### [` MS_PLATFORM_MANIFEST_BINARY_ID `]() enumerator MS\_PLATFORM\_MANIFEST\_BINARY\_ID ##### [` PKCS9_AT_SEQUENCE_NUMBER `]() enumerator PKCS9\_AT\_SEQUENCE\_NUMBER ##### [` PKCS9_COUNTER_SIGNATURE `]() enumerator PKCS9\_COUNTER\_SIGNATURE ##### [` PKCS9_MESSAGE_DIGEST `]() enumerator PKCS9\_MESSAGE\_DIGEST ##### [` PKCS9_SIGNING_TIME `]() enumerator PKCS9\_SIGNING\_TIME Public Functions #### [` Attribute `]() Attribute() = delete #### [` Attribute `]() Attribute(const [Attribute]( "LIEF::PE::Attribute::Attribute")&) = default #### [` operator= `]() [Attribute]( "LIEF::PE::Attribute") &operator=(const [Attribute]( "LIEF::PE::Attribute")&) = default #### [` clone `]() virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const = 0 #### [` type `]() inline virtual [TYPE]( "LIEF::PE::Attribute::TYPE") type() const Concrete type of the attribute. #### [` print `]() virtual std::string print() const = 0 Print information about the underlying attribute. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~Attribute `]() ~Attribute() override = default #### [` Tcast `]() template<class T> inline const [T]( "LIEF::PE::Attribute::cast::T") \*cast() const #### [` Tcast `]() template<class T> inline [T]( "LIEF::PE::Attribute::cast::T") \*cast() Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Attribute]( "LIEF::PE::Attribute") &attribute) --- ## [Signature ContentType]() ### [` ContentType `]() class ContentType : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") Interface over the structure described by the OID `1.2.840.113549.1.9.3` (PKCS #9). The internal structure is described in the [RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0]() ```text ContentType ::= OBJECT IDENTIFIER ``` Public Functions #### [` ContentType `]() inline ContentType() #### [` ContentType `]() inline ContentType(oid\_t oid) #### [` ContentType `]() ContentType(const [ContentType]( "LIEF::PE::ContentType::ContentType")&) = default #### [` operator= `]() [ContentType]( "LIEF::PE::ContentType") &operator=(const [ContentType]( "LIEF::PE::ContentType")&) = default #### [` oid `]() inline const oid\_t &oid() const OID as described in RFC #2985. #### [` print `]() virtual std::string print() const override Print information about the attribute. #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~ContentType `]() ~ContentType() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [Signature GenericType]() ### [` GenericType `]() class GenericType : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") Interface over an attribute for which the internal structure is not supported by LIEF. Public Functions #### [` GenericType `]() inline GenericType() #### [` GenericType `]() inline GenericType(oid\_t oid, std::vector<uint8\_t> raw) #### [` GenericType `]() GenericType(const [GenericType]( "LIEF::PE::GenericType::GenericType")&) = default #### [` operator= `]() [GenericType]( "LIEF::PE::GenericType") &operator=(const [GenericType]( "LIEF::PE::GenericType")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` oid `]() inline const oid\_t &oid() const OID of the original attribute. #### [` raw_content `]() inline span<const uint8\_t> raw\_content() const Original DER blob of the attribute. #### [` print `]() virtual std::string print() const override Print information about the attribute. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~GenericType `]() ~GenericType() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [Signature MsSpcNestedSignature]() ### [` MsSpcNestedSignature `]() class MsSpcNestedSignature : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") Interface over the structure described by the OID `1.3.6.1.4.1.311.2.4.1`. The internal structure is not documented but we can infer the following structure: ```text MsSpcNestedSignature ::= SET OF SignedData ``` `SignedData` is the structure described in PKCS #7 RFC ([LIEF::PE::Signature]()) Public Functions #### [` MsSpcNestedSignature `]() MsSpcNestedSignature() = delete #### [` MsSpcNestedSignature `]() inline MsSpcNestedSignature([Signature]( "LIEF::PE::Signature") sig) #### [` MsSpcNestedSignature `]() MsSpcNestedSignature(const [MsSpcNestedSignature]( "LIEF::PE::MsSpcNestedSignature::MsSpcNestedSignature")&) = default #### [` operator= `]() [MsSpcNestedSignature]( "LIEF::PE::MsSpcNestedSignature") &operator=(const [MsSpcNestedSignature]( "LIEF::PE::MsSpcNestedSignature")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` sig `]() inline const [Signature]( "LIEF::PE::Signature") &sig() const Underlying [Signature]() object. #### [` print `]() virtual std::string print() const override Print information about the attribute. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~MsSpcNestedSignature `]() ~MsSpcNestedSignature() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [Signature MsSpcStatementType]() ### [` MsSpcStatementType `]() class MsSpcStatementType : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") Interface over the structure described by the OID `1.3.6.1.4.1.311.2.1.11`. The internal structure is described in the official document: [Windows Authenticode Portable Executable Signature Format]() ```text SpcStatementType ::= SEQUENCE of OBJECT IDENTIFIER ``` Public Functions #### [` MsSpcStatementType `]() MsSpcStatementType() = delete #### [` MsSpcStatementType `]() inline MsSpcStatementType(oid\_t oid) #### [` MsSpcStatementType `]() MsSpcStatementType(const [MsSpcStatementType]( "LIEF::PE::MsSpcStatementType::MsSpcStatementType")&) = default #### [` operator= `]() [MsSpcStatementType]( "LIEF::PE::MsSpcStatementType") &operator=(const [MsSpcStatementType]( "LIEF::PE::MsSpcStatementType")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` oid `]() inline const oid\_t &oid() const According to the documentation: > The SpcStatementType MUST contain one Object Identifier with either the value `1.3.6.1.4.1.311.2.1.21 (SPC_INDIVIDUAL_SP_KEY_PURPOSE_OBJID)` or > `1.3.6.1.4.1.311.2.1.22 (SPC_COMMERCIAL_SP_KEY_PURPOSE_OBJID)`. #### [` print `]() virtual std::string print() const override Print information about the attribute. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~MsSpcStatementType `]() ~MsSpcStatementType() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [Signature PKCS9AtSequenceNumber]() ### [` PKCS9AtSequenceNumber `]() class PKCS9AtSequenceNumber : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") Interface over the structure described by the OID `1.2.840.113549.1.9.25.4` (PKCS #9). The internal structure is described in the [RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0]() ```text sequenceNumber ATTRIBUTE ::= { WITH SYNTAX SequenceNumber EQUALITY MATCHING RULE integerMatch SINGLE VALUE TRUE ID pkcs-9-at-sequenceNumber } SequenceNumber ::= INTEGER (1..MAX) ``` Public Functions #### [` PKCS9AtSequenceNumber `]() PKCS9AtSequenceNumber() = delete #### [` PKCS9AtSequenceNumber `]() inline PKCS9AtSequenceNumber(uint32\_t num) #### [` PKCS9AtSequenceNumber `]() PKCS9AtSequenceNumber(const [PKCS9AtSequenceNumber]( "LIEF::PE::PKCS9AtSequenceNumber::PKCS9AtSequenceNumber")&) = default #### [` operator= `]() [PKCS9AtSequenceNumber]( "LIEF::PE::PKCS9AtSequenceNumber") &operator=(const [PKCS9AtSequenceNumber]( "LIEF::PE::PKCS9AtSequenceNumber")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` number `]() inline uint32\_t number() const Number as described in the RFC. #### [` print `]() virtual std::string print() const override Print information about the attribute. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~PKCS9AtSequenceNumber `]() ~PKCS9AtSequenceNumber() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [Signature PKCS9CounterSignature]() ### [` PKCS9CounterSignature `]() class PKCS9CounterSignature : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") Interface over the structure described by the OID `1.2.840.113549.1.9.6` (PKCS #9). The internal structure is described in the [RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0]() ```text counterSignature ATTRIBUTE ::= { WITH SYNTAX SignerInfo ID pkcs-9-at-counterSignature } ``` Public Functions #### [` PKCS9CounterSignature `]() PKCS9CounterSignature() = delete #### [` PKCS9CounterSignature `]() inline PKCS9CounterSignature([SignerInfo]( "LIEF::PE::SignerInfo") signer) #### [` PKCS9CounterSignature `]() PKCS9CounterSignature(const [PKCS9CounterSignature]( "LIEF::PE::PKCS9CounterSignature::PKCS9CounterSignature")&) = default #### [` operator= `]() [PKCS9CounterSignature]( "LIEF::PE::PKCS9CounterSignature") &operator=(const [PKCS9CounterSignature]( "LIEF::PE::PKCS9CounterSignature")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` signer `]() inline const [SignerInfo]( "LIEF::PE::SignerInfo") &signer() const [SignerInfo]() as described in the RFC #2985. #### [` print `]() virtual std::string print() const override Print information about the attribute. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~PKCS9CounterSignature `]() ~PKCS9CounterSignature() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [Signature PKCS9MessageDigest]() ### [` PKCS9MessageDigest `]() class PKCS9MessageDigest : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") Interface over the structure described by the OID `1.2.840.113549.1.9.4` (PKCS #9). The internal structure is described in the [RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0]() ```text messageDigest ATTRIBUTE ::= { WITH SYNTAX MessageDigest EQUALITY MATCHING RULE octetStringMatch SINGLE VALUE TRUE ID pkcs-9-at-messageDigest } MessageDigest ::= OCTET STRING ``` Public Functions #### [` PKCS9MessageDigest `]() PKCS9MessageDigest() = delete #### [` PKCS9MessageDigest `]() inline PKCS9MessageDigest(std::vector<uint8\_t> digest) #### [` PKCS9MessageDigest `]() PKCS9MessageDigest(const [PKCS9MessageDigest]( "LIEF::PE::PKCS9MessageDigest::PKCS9MessageDigest")&) = default #### [` operator= `]() [PKCS9MessageDigest]( "LIEF::PE::PKCS9MessageDigest") &operator=(const [PKCS9MessageDigest]( "LIEF::PE::PKCS9MessageDigest")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` digest `]() inline span<const uint8\_t> digest() const Message digest as a blob of bytes as described in the RFC. #### [` print `]() virtual std::string print() const override Print information about the attribute. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~PKCS9MessageDigest `]() ~PKCS9MessageDigest() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [Signature PKCS9SigningTime]() ### [` PKCS9SigningTime `]() class PKCS9SigningTime : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") Interface over the structure described by the OID `1.2.840.113549.1.9.5` (PKCS #9). The internal structure is described in the [RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0]() ```text signingTime ATTRIBUTE ::= { WITH SYNTAX SigningTime EQUALITY MATCHING RULE signingTimeMatch SINGLE VALUE TRUE ID pkcs-9-at-signingTime } SigningTime ::= Time -- imported from ISO/IEC 9594-8 ``` Public Types #### [` time_t `]() using time\_t = std::array<int32\_t, 6> Time as an array [year, month, day, hour, min, sec]. Public Functions #### [` PKCS9SigningTime `]() PKCS9SigningTime() = delete #### [` PKCS9SigningTime `]() inline PKCS9SigningTime([time\_t]( "LIEF::PE::PKCS9SigningTime::time_t") time) #### [` PKCS9SigningTime `]() PKCS9SigningTime(const [PKCS9SigningTime]( "LIEF::PE::PKCS9SigningTime::PKCS9SigningTime")&) = default #### [` operator= `]() [PKCS9SigningTime]( "LIEF::PE::PKCS9SigningTime") &operator=(const [PKCS9SigningTime]( "LIEF::PE::PKCS9SigningTime")&) = default #### [` time `]() inline const [time\_t]( "LIEF::PE::PKCS9SigningTime::time_t") &time() const Time as an array [year, month, day, hour, min, sec]. #### [` print `]() virtual std::string print() const override Print information about the attribute. #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~PKCS9SigningTime `]() ~PKCS9SigningTime() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [Signature SpcSpOpusInfo]() ### [` SpcSpOpusInfo `]() class SpcSpOpusInfo : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") Interface over the structure described by the OID `1.3.6.1.4.1.311.2.1.12`. The internal structure is described in the official document: [Windows Authenticode Portable Executable Signature Format]() ```text SpcSpOpusInfo ::= SEQUENCE { programName [0] EXPLICIT SpcString OPTIONAL, moreInfo [1] EXPLICIT SpcLink OPTIONAL } ``` Public Functions #### [` SpcSpOpusInfo `]() inline SpcSpOpusInfo(std::string program\_name, std::string more\_info) #### [` SpcSpOpusInfo `]() inline SpcSpOpusInfo() #### [` SpcSpOpusInfo `]() SpcSpOpusInfo(const [SpcSpOpusInfo]( "LIEF::PE::SpcSpOpusInfo::SpcSpOpusInfo")&) = default #### [` operator= `]() [SpcSpOpusInfo]( "LIEF::PE::SpcSpOpusInfo") &operator=(const [SpcSpOpusInfo]( "LIEF::PE::SpcSpOpusInfo")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` program_name `]() inline std::string\_view program\_name() const Program description provided by the publisher. #### [` more_info `]() inline std::string\_view more\_info() const Other information such as a URL. #### [` print `]() virtual std::string print() const override Print information about the attribute. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~SpcSpOpusInfo `]() ~SpcSpOpusInfo() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [Signature SpcIndirectData]() ### [` SpcIndirectData `]() class SpcIndirectData : public LIEF::PE::[ContentInfo]( "LIEF::PE::ContentInfo")::[Content]( "LIEF::PE::ContentInfo::Content") Public Functions #### [` SpcIndirectData `]() inline SpcIndirectData() #### [` SpcIndirectData `]() SpcIndirectData(const [SpcIndirectData]( "LIEF::PE::SpcIndirectData::SpcIndirectData")&) = default #### [` operator= `]() [SpcIndirectData]( "LIEF::PE::SpcIndirectData") &operator=(const [SpcIndirectData]( "LIEF::PE::SpcIndirectData")&) = default #### [` clone `]() inline virtual std::unique\_ptr<Content> clone() const override #### [` digest_algorithm `]() inline [ALGORITHMS]( "LIEF::PE::ALGORITHMS") digest\_algorithm() const Digest used to hash the file. It should match [LIEF::PE::SignerInfo::digest\_algorithm]() #### [` digest `]() inline span<const uint8\_t> digest() const PE’s authentihash. > **See also** > > [LIEF::PE::Binary::authentihash]() #### [` file `]() inline std::string\_view file() const #### [` url `]() inline std::string\_view url() const #### [` print `]() virtual void print(std::ostream &os) const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~SpcIndirectData `]() ~SpcIndirectData() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [ContentInfo]( "LIEF::PE::ContentInfo")::[Content]( "LIEF::PE::ContentInfo::Content") \*content) Public Static Attributes #### [` SPC_INDIRECT_DATA_OBJID `]() static auto SPC\_INDIRECT\_DATA\_OBJID = "1.3.6.1.4.1.311.2.1.4" Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [SpcIndirectData]( "LIEF::PE::SpcIndirectData") &content) --- ## [Signature GenericContent]() ### [` GenericContent `]() class GenericContent : public LIEF::PE::[ContentInfo]( "LIEF::PE::ContentInfo")::[Content]( "LIEF::PE::ContentInfo::Content") Public Functions #### [` GenericContent `]() GenericContent() #### [` GenericContent `]() GenericContent(oid\_t oid) #### [` GenericContent `]() GenericContent(const [GenericContent]( "LIEF::PE::GenericContent::GenericContent")&) = default #### [` operator= `]() [GenericContent]( "LIEF::PE::GenericContent") &operator=(const [GenericContent]( "LIEF::PE::GenericContent")&) = default #### [` clone `]() inline virtual std::unique\_ptr<Content> clone() const override #### [` oid `]() inline const oid\_t &oid() const #### [` raw `]() inline span<const uint8\_t> raw() const #### [` raw `]() inline span<uint8\_t> raw() #### [` ~GenericContent `]() ~GenericContent() override #### [` print `]() virtual void print(std::ostream &os) const override #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` classof `]() static bool classof(const [ContentInfo]( "LIEF::PE::ContentInfo")::[Content]( "LIEF::PE::ContentInfo::Content") \*content) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [GenericContent]( "LIEF::PE::GenericContent") &content) --- ## [RsaInfo]() ### [` RsaInfo `]() class RsaInfo Object that wraps a RSA key. Public Types #### [` rsa_ctx_handle `]() using rsa\_ctx\_handle = void\* #### [` bignum_wrapper_t `]() using bignum\_wrapper\_t = std::vector<uint8\_t> Container for BigInt. Public Functions #### [` RsaInfo `]() RsaInfo(const [RsaInfo]( "LIEF::PE::RsaInfo::RsaInfo") &other) #### [` RsaInfo `]() RsaInfo([RsaInfo]( "LIEF::PE::RsaInfo::RsaInfo") &&other) #### [` operator= `]() [RsaInfo]( "LIEF::PE::RsaInfo") &operator=([RsaInfo]( "LIEF::PE::RsaInfo") other) #### [` has_public_key `]() bool has\_public\_key() const True if it embeds a public key. #### [` has_private_key `]() bool has\_private\_key() const True if it embeds a private key. #### [` N `]() [bignum\_wrapper\_t]( "LIEF::PE::RsaInfo::bignum_wrapper_t") N() const RSA public modulus. #### [` E `]() [bignum\_wrapper\_t]( "LIEF::PE::RsaInfo::bignum_wrapper_t") E() const RSA public exponent. #### [` D `]() [bignum\_wrapper\_t]( "LIEF::PE::RsaInfo::bignum_wrapper_t") D() const RSA private exponent. #### [` P `]() [bignum\_wrapper\_t]( "LIEF::PE::RsaInfo::bignum_wrapper_t") P() const First prime factor. #### [` Q `]() [bignum\_wrapper\_t]( "LIEF::PE::RsaInfo::bignum_wrapper_t") Q() const Second prime factor. #### [` key_size `]() size\_t key\_size() const Size of the public modulus (in bits). #### [` swap `]() void swap([RsaInfo]( "LIEF::PE::RsaInfo") &other) #### [` operator bool `]() operator bool() const #### [` ~RsaInfo `]() ~RsaInfo() Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [RsaInfo]( "LIEF::PE::RsaInfo") &info) --- ## [x509]() ### [` x509 `]() class x509 : public LIEF::Object Interface over a [x509]() certificate. Public Types #### [` KEY_TYPES `]() enum class KEY\_TYPES : uint32\_t Public key scheme. *Values:* ##### [` NONE `]() enumerator NONE = 0 Unknown scheme. ##### [` RSA `]() enumerator RSA RSA Scheme. ##### [` ECKEY `]() enumerator ECKEY Elliptic-curve scheme. ##### [` ECKEY_DH `]() enumerator ECKEY\_DH Elliptic-curve Diffie-Hellman. ##### [` ECDSA `]() enumerator ECDSA Elliptic-curve Digital [Signature]() Algorithm. ##### [` RSA_ALT `]() enumerator RSA\_ALT RSA scheme with an alternative implementation for signing and decrypting. ##### [` RSASSA_PSS `]() enumerator RSASSA\_PSS RSA Probabilistic signature scheme. #### [` VERIFICATION_FLAGS `]() enum class VERIFICATION\_FLAGS : uint32\_t Mirror of mbedtls’s X509 Verify codes: MBEDTLS\_X509\_XX. It must be sync with include/mbedtls/x509.h *Values:* ##### [` OK `]() enumerator OK = 0 The verification succeed. ##### [` BADCERT_EXPIRED `]() enumerator BADCERT\_EXPIRED = 1 << 0 The certificate validity has expired. ##### [` BADCERT_REVOKED `]() enumerator BADCERT\_REVOKED = 1 << 1 The certificate has been revoked (is on a CRL). ##### [` BADCERT_CN_MISMATCH `]() enumerator BADCERT\_CN\_MISMATCH = 1 << 2 The certificate Common Name (CN) does not match with the expected CN. ##### [` BADCERT_NOT_TRUSTED `]() enumerator BADCERT\_NOT\_TRUSTED = 1 << 3 The certificate is not correctly signed by the trusted CA. ##### [` BADCRL_NOT_TRUSTED `]() enumerator BADCRL\_NOT\_TRUSTED = 1 << 4 The CRL is not correctly signed by the trusted CA. ##### [` BADCRL_EXPIRED `]() enumerator BADCRL\_EXPIRED = 1 << 5 The CRL is expired. ##### [` BADCERT_MISSING `]() enumerator BADCERT\_MISSING = 1 << 6 Certificate was missing. ##### [` BADCERT_SKIP_VERIFY `]() enumerator BADCERT\_SKIP\_VERIFY = 1 << 7 Certificate verification was skipped. ##### [` BADCERT_OTHER `]() enumerator BADCERT\_OTHER = 1 << 8 Other reason (can be used by verify callback). ##### [` BADCERT_FUTURE `]() enumerator BADCERT\_FUTURE = 1 << 9 The certificate validity starts in the future. ##### [` BADCRL_FUTURE `]() enumerator BADCRL\_FUTURE = 1 << 10 The CRL is from the future. ##### [` BADCERT_KEY_USAGE `]() enumerator BADCERT\_KEY\_USAGE = 1 << 11 Usage does not match the keyUsage extension. ##### [` BADCERT_EXT_KEY_USAGE `]() enumerator BADCERT\_EXT\_KEY\_USAGE = 1 << 12 Usage does not match the extendedKeyUsage extension. ##### [` BADCERT_NS_CERT_TYPE `]() enumerator BADCERT\_NS\_CERT\_TYPE = 1 << 13 Usage does not match the nsCertType extension. ##### [` BADCERT_BAD_MD `]() enumerator BADCERT\_BAD\_MD = 1 << 14 The certificate is signed with an unacceptable hash. ##### [` BADCERT_BAD_PK `]() enumerator BADCERT\_BAD\_PK = 1 << 15 The certificate is signed with an unacceptable PK alg (e.g. RSA vs ECDSA). ##### [` BADCERT_BAD_KEY `]() enumerator BADCERT\_BAD\_KEY = 1 << 16 The certificate is signed with an unacceptable key (e.g. bad curve, RSA too short). ##### [` BADCRL_BAD_MD `]() enumerator BADCRL\_BAD\_MD = 1 << 17 The CRL is signed with an unacceptable hash. ##### [` BADCRL_BAD_PK `]() enumerator BADCRL\_BAD\_PK = 1 << 18 The CRL is signed with an unacceptable PK alg (e.g. RSA vs ECDSA). ##### [` BADCRL_BAD_KEY `]() enumerator BADCRL\_BAD\_KEY = 1 << 19 The CRL is signed with an unacceptable key (e.g. bad curve, RSA too short). #### [` KEY_USAGE `]() enum class KEY\_USAGE : uint32\_t Key usage as defined in [RFC #5280 - section-4.2.1.3](). *Values:* ##### [` DIGITAL_SIGNATURE `]() enumerator DIGITAL\_SIGNATURE = 0 The key is used for digital signature. ##### [` NON_REPUDIATION `]() enumerator NON\_REPUDIATION The key is used for digital signature AND to protect against falsely denying some action. ##### [` KEY_ENCIPHERMENT `]() enumerator KEY\_ENCIPHERMENT The key is used for enciphering private or secret keys. ##### [` DATA_ENCIPHERMENT `]() enumerator DATA\_ENCIPHERMENT The key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher. ##### [` KEY_AGREEMENT `]() enumerator KEY\_AGREEMENT The Key is used for key agreement. (e.g. with Diffie-Hellman). ##### [` KEY_CERT_SIGN `]() enumerator KEY\_CERT\_SIGN The key is used for verifying signatures on public key certificates. ##### [` CRL_SIGN `]() enumerator CRL\_SIGN The key is used for verifying signatures on certificate revocation lists. ##### [` ENCIPHER_ONLY `]() enumerator ENCIPHER\_ONLY In **association with** KEY\_AGREEMENT (otherwise the meaning is undefined), the key is only used for enciphering data while performing key agreement. ##### [` DECIPHER_ONLY `]() enumerator DECIPHER\_ONLY In **association with** KEY\_AGREEMENT (otherwise the meaning is undefined), the key is only used for deciphering data while performing key agreement. #### [` date_t `]() using date\_t = std::array<int32\_t, 6> Tuple (Year, Month, Day, Hour, Minute, Second). #### [` certificates_t `]() using certificates\_t = std::vector<[x509]( "LIEF::PE::x509")> Public Functions #### [` x509 `]() x509(mbedtls\_x509\_crt \*ca) #### [` x509 `]() x509(const [x509]( "LIEF::PE::x509::x509") &other) #### [` operator= `]() [x509]( "LIEF::PE::x509") &operator=([x509]( "LIEF::PE::x509") other) #### [` swap `]() void swap([x509]( "LIEF::PE::x509") &other) #### [` version `]() uint32\_t version() const X.509 version. (1=v1, 2=v2, 3=v3). #### [` serial_number `]() std::vector<uint8\_t> serial\_number() const Unique id for certificate issued by a specific CA. #### [` signature_algorithm `]() oid\_t signature\_algorithm() const [Signature]() algorithm (OID). #### [` valid_from `]() [date\_t]( "LIEF::PE::x509::date_t") valid\_from() const Start time of certificate validity. #### [` valid_to `]() [date\_t]( "LIEF::PE::x509::date_t") valid\_to() const End time of certificate validity. #### [` issuer `]() std::string issuer() const Issuer information. #### [` subject `]() std::string subject() const Subject information. #### [` check_signature `]() bool check\_signature(const std::vector<uint8\_t> &hash, const std::vector<uint8\_t> &signature, [ALGORITHMS]( "LIEF::PE::ALGORITHMS") digest) const Try to decrypt the given signature and check if it matches the given hash according to the hash algorithm provided. #### [` raw `]() std::vector<uint8\_t> raw() const The raw [x509]() bytes (DER encoded). #### [` key_type `]() [KEY\_TYPES]( "LIEF::PE::x509::KEY_TYPES") key\_type() const Return the underlying public-key scheme. #### [` rsa_info `]() std::unique\_ptr<[RsaInfo]( "LIEF::PE::RsaInfo")> rsa\_info() const **If** the underlying public-key scheme is RSA, return the RSA information. Otherwise, return a nullptr #### [` verify `]() [VERIFICATION\_FLAGS]( "LIEF::PE::x509::VERIFICATION_FLAGS") verify(const [x509]( "LIEF::PE::x509") &ca) const Verify that this certificate has been used **to trust** the given certificate. #### [` is_trusted_by `]() [VERIFICATION\_FLAGS]( "LIEF::PE::x509::VERIFICATION_FLAGS") is\_trusted\_by(const std::vector<[x509]( "LIEF::PE::x509")> &ca) const Verify that this certificate **is trusted** by the given CA list. #### [` certificate_policies `]() std::vector<oid\_t> certificate\_policies() const Policy information terms as OID (see RFC #5280). #### [` key_usage `]() std::vector<[KEY\_USAGE]( "LIEF::PE::x509::KEY_USAGE")> key\_usage() const Purpose of the key contained in the certificate. #### [` ext_key_usage `]() std::vector<oid\_t> ext\_key\_usage() const Indicates one or more purposes for which the certified public key may be used (OID types). #### [` is_ca `]() bool is\_ca() const #### [` signature `]() std::vector<uint8\_t> signature() const The signature of the certificate. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~x509 `]() ~x509() override Public Static Functions #### [` parse `]() static [certificates\_t]( "LIEF::PE::x509::certificates_t") parse(const std::string &path) Parse [x509]() certificate(s) from file path. #### [` parse `]() static [certificates\_t]( "LIEF::PE::x509::certificates_t") parse(const std::vector<uint8\_t> &content) Parse [x509]() certificate(s) from raw blob. #### [` check_time `]() static bool check\_time(const [date\_t]( "LIEF::PE::x509::date_t") &before, const [date\_t]( "LIEF::PE::x509::date_t") &after) Return True if `before` is *before* than `after`. False otherwise. #### [` time_is_past `]() static bool time\_is\_past(const [date\_t]( "LIEF::PE::x509::date_t") &to) True if the given time is in the **past** according to the clock’s system. #### [` time_is_future `]() static bool time\_is\_future(const [date\_t]( "LIEF::PE::x509::date_t") &from) True if the given time is in the future according to the clock’s system. Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [x509]( "LIEF::PE::x509") &x509\_cert) --- ## [ContentInfo]() ### [` ContentInfo `]() class ContentInfo : public LIEF::Object [ContentInfo]() as described in the RFC2315 ([https://tools.ietf.org/html/rfc2315#section-7]()) ```text ContentInfo ::= SEQUENCE { contentType ContentType, content [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL } ContentType ::= OBJECT IDENTIFIER ``` In the case of PE signature, [ContentType]() **must** be set to SPC\_INDIRECT\_DATA\_OBJID OID: `1.3.6.1.4.1.311.2.1.4` and content is defined by the structure: `SpcIndirectDataContent` ```text SpcIndirectDataContent ::= SEQUENCE { data SpcAttributeTypeAndOptionalValue, messageDigest DigestInfo } SpcAttributeTypeAndOptionalValue ::= SEQUENCE { type ObjectID, value [0] EXPLICIT ANY OPTIONAL } ``` For PE signature, `SpcAttributeTypeAndOptionalValue.type` is set to `SPC_PE_IMAGE_DATAOBJ` (OID: `1.3.6.1.4.1.311.2.1.15`) and the value is defined by `SpcPeImageData` ```text DigestInfo ::= SEQUENCE { digestAlgorithm AlgorithmIdentifier, digest OCTETSTRING } AlgorithmIdentifier ::= SEQUENCE { algorithm ObjectID, parameters [0] EXPLICIT ANY OPTIONAL } ``` Public Functions #### [` ContentInfo `]() ContentInfo() #### [` ContentInfo `]() ContentInfo(const [ContentInfo]( "LIEF::PE::ContentInfo::ContentInfo") &other) #### [` ContentInfo `]() ContentInfo([ContentInfo]( "LIEF::PE::ContentInfo::ContentInfo") &&other) noexcept = default #### [` operator= `]() [ContentInfo]( "LIEF::PE::ContentInfo") &operator=([ContentInfo]( "LIEF::PE::ContentInfo") other) #### [` swap `]() void swap([ContentInfo]( "LIEF::PE::ContentInfo") &other) noexcept #### [` content_type `]() inline oid\_t content\_type() const Return the OID that describes the content wrapped by this object. It should match SPC\_INDIRECT\_DATA\_OBJID (1.3.6.1.4.1.311.2.1.4). #### [` value `]() inline [Content]( "LIEF::PE::ContentInfo::Content") &value() #### [` value `]() inline const [Content]( "LIEF::PE::ContentInfo::Content") &value() const #### [` digest `]() std::vector<uint8\_t> digest() const Return the digest (authentihash) if the underlying content type is `SPC_INDIRECT_DATA_OBJID` Otherwise, return an empty vector. #### [` digest_algorithm `]() [ALGORITHMS]( "LIEF::PE::ALGORITHMS") digest\_algorithm() const Return the digest used to hash the file. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~ContentInfo `]() ~ContentInfo() override = default Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ContentInfo]( "LIEF::PE::ContentInfo") &content\_info) #### [` Content `]() class Content : public LIEF::Object Subclassed by [LIEF::PE::GenericContent](), [LIEF::PE::PKCS9TSTInfo](), [LIEF::PE::SpcIndirectData]() Public Functions ##### [` Content `]() inline Content(oid\_t oid) ##### [` content_type `]() inline const oid\_t &content\_type() const ##### [` clone `]() virtual std::unique\_ptr<[Content]( "LIEF::PE::ContentInfo::Content")> clone() const = 0 ##### [` print `]() virtual void print(std::ostream &os) const = 0 ##### [` Tcast `]() template<class T> inline const [T]( "LIEF::PE::ContentInfo::Content::cast::T") \*cast() const ##### [` Tcast `]() template<class T> inline [T]( "LIEF::PE::ContentInfo::Content::cast::T") \*cast() ##### [` ~Content `]() ~Content() override = default Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Content]( "LIEF::PE::ContentInfo::Content") &content) --- ## [SignerInfo]() ### [` SignerInfo `]() class SignerInfo : public LIEF::Object [SignerInfo]() as described in the [RFC 2315]() ```text SignerInfo ::= SEQUENCE { version Version, issuerAndSerialNumber IssuerAndSerialNumber, digestAlgorithm DigestAlgorithmIdentifier, authenticatedAttributes [0] IMPLICIT Attributes OPTIONAL, digestEncryptionAlgorithm DigestEncryptionAlgorithmIdentifier, encryptedDigest EncryptedDigest, unauthenticatedAttributes [1] IMPLICIT Attributes OPTIONAL } EncryptedDigest ::= OCTET STRING ``` Public Types #### [` encrypted_digest_t `]() using encrypted\_digest\_t = std::vector<uint8\_t> #### [` attributes_t `]() using attributes\_t = std::vector<std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")>> Internal container used to store both authenticated and unauthenticated attributes. #### [` it_const_attributes_t `]() using it\_const\_attributes\_t = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [attributes\_t]( "LIEF::PE::SignerInfo::attributes_t")&, const [Attribute]( "LIEF::PE::Attribute")\*> Iterator which outputs const [Attribute]()&. Public Functions #### [` SignerInfo `]() SignerInfo() #### [` SignerInfo `]() SignerInfo(const [SignerInfo]( "LIEF::PE::SignerInfo::SignerInfo") &other) #### [` operator= `]() [SignerInfo]( "LIEF::PE::SignerInfo") &operator=([SignerInfo]( "LIEF::PE::SignerInfo") other) #### [` SignerInfo `]() SignerInfo([SignerInfo]( "LIEF::PE::SignerInfo::SignerInfo")&&) #### [` operator= `]() [SignerInfo]( "LIEF::PE::SignerInfo") &operator=([SignerInfo]( "LIEF::PE::SignerInfo")&&) #### [` swap `]() void swap([SignerInfo]( "LIEF::PE::SignerInfo") &other) #### [` version `]() inline uint32\_t version() const Should be 1. #### [` serial_number `]() inline span<const uint8\_t> serial\_number() const Return the serial number associated with the [x509]() certificate used by this signer. > **See also** > > [LIEF::PE::x509::serial\_number]() [SignerInfo::issuer]() #### [` issuer `]() inline std::string\_view issuer() const Return the [x509::issuer]() used by this signer. #### [` digest_algorithm `]() inline [ALGORITHMS]( "LIEF::PE::ALGORITHMS") digest\_algorithm() const Algorithm (OID) used to hash the file. This value should match [LIEF::PE::ContentInfo::digest\_algorithm]() and [LIEF::PE::Signature::digest\_algorithm]() #### [` encryption_algorithm `]() inline [ALGORITHMS]( "LIEF::PE::ALGORITHMS") encryption\_algorithm() const Return the (public-key) algorithm used to encrypt the signature. #### [` encrypted_digest `]() inline const [encrypted\_digest\_t]( "LIEF::PE::SignerInfo::encrypted_digest_t") &encrypted\_digest() const Return the signature created by the signing certificate’s private key. #### [` authenticated_attributes `]() inline [it\_const\_attributes\_t]( "LIEF::PE::SignerInfo::it_const_attributes_t") authenticated\_attributes() const Iterator over [LIEF::PE::Attribute]() for **authenticated** attributes. #### [` unauthenticated_attributes `]() inline [it\_const\_attributes\_t]( "LIEF::PE::SignerInfo::it_const_attributes_t") unauthenticated\_attributes() const Iterator over [LIEF::PE::Attribute]() for **unauthenticated** attributes. #### [` get_attribute `]() const [Attribute]( "LIEF::PE::Attribute") \*get\_attribute([Attribute]( "LIEF::PE::Attribute")::[TYPE]( "LIEF::PE::Attribute::TYPE") type) const Return the authenticated or unauthenticated attribute matching the given PE::SIG\_ATTRIBUTE\_TYPES. It returns **the first** entry that matches the given type. If it can’t be found, it returns a nullptr. #### [` get_auth_attribute `]() const [Attribute]( "LIEF::PE::Attribute") \*get\_auth\_attribute([Attribute]( "LIEF::PE::Attribute")::[TYPE]( "LIEF::PE::Attribute::TYPE") type) const Return the authenticated attribute matching the given PE::SIG\_ATTRIBUTE\_TYPES. It returns **the first** entry that matches the given type. If it can’t be found, it returns a nullptr. #### [` get_unauth_attribute `]() const [Attribute]( "LIEF::PE::Attribute") \*get\_unauth\_attribute([Attribute]( "LIEF::PE::Attribute")::[TYPE]( "LIEF::PE::Attribute::TYPE") type) const Return the unauthenticated attribute matching the given PE::SIG\_ATTRIBUTE\_TYPES. It returns **the first** entry that matches the given type. If it can’t be found, it returns a nullptr. #### [` cert `]() inline const [x509]( "LIEF::PE::x509") \*cert() const [x509]() certificate used by this signer. If it can’t be found, it returns a nullptr #### [` cert `]() inline [x509]( "LIEF::PE::x509") \*cert() [x509]() certificate used by this signer. If it can’t be found, it returns a nullptr #### [` raw_auth_data `]() inline span<const uint8\_t> raw\_auth\_data() const Raw blob that is signed by the signer certificate. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~SignerInfo `]() ~SignerInfo() override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [SignerInfo]( "LIEF::PE::SignerInfo") &signer\_info) --- ## [MsCounterSign]() ### [` MsCounterSign `]() class MsCounterSign : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") This class exposes the MS Counter [Signature]() attribute. Public Types #### [` certificates_t `]() using certificates\_t = std::vector<[x509]( "LIEF::PE::x509")> #### [` it_const_certificates `]() using it\_const\_certificates = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [certificates\_t]( "LIEF::PE::MsCounterSign::certificates_t")&> #### [` it_certificates `]() using it\_certificates = [ref\_iterator]( "LIEF::ref_iterator")<[certificates\_t]( "LIEF::PE::MsCounterSign::certificates_t")&> #### [` signers_t `]() using signers\_t = std::vector<[SignerInfo]( "LIEF::PE::SignerInfo")> #### [` it_const_signers `]() using it\_const\_signers = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [signers\_t]( "LIEF::PE::MsCounterSign::signers_t")&> #### [` it_signers `]() using it\_signers = [ref\_iterator]( "LIEF::ref_iterator")<[signers\_t]( "LIEF::PE::MsCounterSign::signers_t")&> Public Functions #### [` MsCounterSign `]() inline MsCounterSign() #### [` MsCounterSign `]() MsCounterSign(const [MsCounterSign]( "LIEF::PE::MsCounterSign::MsCounterSign")&) = default #### [` operator= `]() [MsCounterSign]( "LIEF::PE::MsCounterSign") &operator=(const [MsCounterSign]( "LIEF::PE::MsCounterSign")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` version `]() inline uint32\_t version() const #### [` certificates `]() inline [it\_const\_certificates]( "LIEF::PE::MsCounterSign::it_const_certificates") certificates() const Iterator over the [LIEF::PE::x509]() certificates of this counter signature. #### [` certificates `]() inline [it\_certificates]( "LIEF::PE::MsCounterSign::it_certificates") certificates() #### [` signers `]() inline [it\_const\_signers]( "LIEF::PE::MsCounterSign::it_const_signers") signers() const Signer iterator (same as [LIEF::PE::SignerInfo]()). #### [` signers `]() inline [it\_signers]( "LIEF::PE::MsCounterSign::it_signers") signers() #### [` digest_algorithm `]() inline [ALGORITHMS]( "LIEF::PE::ALGORITHMS") digest\_algorithm() const #### [` content_info `]() inline const [ContentInfo]( "LIEF::PE::ContentInfo") &content\_info() const #### [` print `]() virtual std::string print() const override Print information about the underlying attribute. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~MsCounterSign `]() ~MsCounterSign() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [PKCS9TSTInfo]() ### [` PKCS9TSTInfo `]() class PKCS9TSTInfo : public LIEF::PE::[ContentInfo]( "LIEF::PE::ContentInfo")::[Content]( "LIEF::PE::ContentInfo::Content") Interface over the structure described by the OID `1.2.840.113549.1.9.16.1.4` (PKCS #9). The internal structure is described in the [RFC #3161]() ```text TSTInfo ::= SEQUENCE { version INTEGER { v1(1) }, policy TSAPolicyId, messageImprint MessageImprint, serialNumber INTEGER, genTime GeneralizedTime, accuracy Accuracy OPTIONAL, ordering BOOLEAN DEFAULT FALSE, nonce INTEGER OPTIONAL, tsa [0] GeneralName OPTIONAL, extensions [1] IMPLICIT Extensions OPTIONAL } TSAPolicyId ::= OBJECT IDENTIFIER MessageImprint ::= SEQUENCE { hashAlgorithm AlgorithmIdentifier, hashedMessage OCTET STRING } Accuracy ::= SEQUENCE { seconds INTEGER OPTIONAL, millis [0] INTEGER (1..999) OPTIONAL, micros [1] INTEGER (1..999) OPTIONAL } ``` Public Functions #### [` PKCS9TSTInfo `]() inline PKCS9TSTInfo() #### [` PKCS9TSTInfo `]() PKCS9TSTInfo(const [PKCS9TSTInfo]( "LIEF::PE::PKCS9TSTInfo::PKCS9TSTInfo")&) = default #### [` operator= `]() [PKCS9TSTInfo]( "LIEF::PE::PKCS9TSTInfo") &operator=(const [PKCS9TSTInfo]( "LIEF::PE::PKCS9TSTInfo")&) = default #### [` clone `]() inline virtual std::unique\_ptr<Content> clone() const override #### [` print `]() inline virtual void print(std::ostream&) const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~PKCS9TSTInfo `]() ~PKCS9TSTInfo() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [ContentInfo]( "LIEF::PE::ContentInfo")::[Content]( "LIEF::PE::ContentInfo::Content") \*content) Public Static Attributes #### [` PKCS9_TSTINFO_OBJID `]() static auto PKCS9\_TSTINFO\_OBJID = "1.2.840.113549.1.9.16.1.4" --- ## [MsManifestBinaryID]() ### [` MsManifestBinaryID `]() class MsManifestBinaryID : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") Interface over the structure described by the OID `1.3.6.1.4.1.311.10.3.28` (szOID\_PLATFORM\_MANIFEST\_BINARY\_ID). The internal structure is not documented but we can infer the following structure: ```text szOID_PLATFORM_MANIFEST_BINARY_ID ::= SET OF BinaryID ``` `BinaryID` being an alias of UTF8STRING Public Functions #### [` MsManifestBinaryID `]() MsManifestBinaryID() = delete #### [` MsManifestBinaryID `]() inline MsManifestBinaryID(std::string binid) #### [` MsManifestBinaryID `]() MsManifestBinaryID(const [MsManifestBinaryID]( "LIEF::PE::MsManifestBinaryID::MsManifestBinaryID")&) = default #### [` operator= `]() [MsManifestBinaryID]( "LIEF::PE::MsManifestBinaryID") &operator=(const [MsManifestBinaryID]( "LIEF::PE::MsManifestBinaryID")&) = default #### [` print `]() inline virtual std::string print() const override Print information about the attribute. #### [` manifest_id `]() inline std::string\_view manifest\_id() const The manifest id as a string. #### [` manifest_id `]() inline void manifest\_id(const std::string &id) #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~MsManifestBinaryID `]() ~MsManifestBinaryID() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [SpcRelaxedPeMarkerCheck]() ### [` SpcRelaxedPeMarkerCheck `]() class SpcRelaxedPeMarkerCheck : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") Public Functions #### [` SpcRelaxedPeMarkerCheck `]() inline SpcRelaxedPeMarkerCheck() #### [` SpcRelaxedPeMarkerCheck `]() inline SpcRelaxedPeMarkerCheck(uint32\_t value) #### [` SpcRelaxedPeMarkerCheck `]() SpcRelaxedPeMarkerCheck(const [SpcRelaxedPeMarkerCheck]( "LIEF::PE::SpcRelaxedPeMarkerCheck::SpcRelaxedPeMarkerCheck")&) = default #### [` operator= `]() [SpcRelaxedPeMarkerCheck]( "LIEF::PE::SpcRelaxedPeMarkerCheck") &operator=(const [SpcRelaxedPeMarkerCheck]( "LIEF::PE::SpcRelaxedPeMarkerCheck")&) = default #### [` value `]() inline uint32\_t value() const #### [` value `]() inline void value(uint32\_t v) #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` print `]() inline virtual std::string print() const override Print information about the underlying attribute. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~SpcRelaxedPeMarkerCheck `]() ~SpcRelaxedPeMarkerCheck() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [SigningCertificateV2]() ### [` SigningCertificateV2 `]() class SigningCertificateV2 : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") [SigningCertificateV2]() ::= SEQUENCE { certs SEQUENCE OF ESSCertIDv2, policies SEQUENCE OF PolicyInformation OPTIONAL }. ESSCertIDv2 ::= SEQUENCE { hashAlgorithm AlgorithmIdentifier DEFAULT {algorithm id-sha256}, certHash OCTET STRING, issuerSerial IssuerSerial OPTIONAL } IssuerSerial ::= SEQUENCE { issuer GeneralNames, serialNumber CertificateSerialNumber } PolicyInformation ::= SEQUENCE { policyIdentifier OBJECT IDENTIFIER, policyQualifiers SEQUENCE SIZE (1..MAX) OF PolicyQualifierInfo OPTIONAL } Public Functions #### [` SigningCertificateV2 `]() inline SigningCertificateV2() #### [` SigningCertificateV2 `]() SigningCertificateV2(const [SigningCertificateV2]( "LIEF::PE::SigningCertificateV2::SigningCertificateV2")&) = default #### [` operator= `]() [SigningCertificateV2]( "LIEF::PE::SigningCertificateV2") &operator=(const [SigningCertificateV2]( "LIEF::PE::SigningCertificateV2")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` print `]() virtual std::string print() const override Print information about the underlying attribute. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~SigningCertificateV2 `]() ~SigningCertificateV2() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [Builder]() ### [` Builder `]() class Builder Class that is used to rebuild a raw PE binary from a [PE::Binary]() object. Public Functions #### [` Builder `]() Builder() = delete #### [` Builder `]() inline Builder([Binary]( "LIEF::PE::Binary") &binary, [config\_t]( "LIEF::PE::Builder::config_t") config) #### [` ~Builder `]() ~Builder() #### [` build `]() [ok\_error\_t]( "LIEF::ok_error_t") build() Perform the build process. #### [` get_build `]() inline const std::vector<uint8\_t> &get\_build() Return the build result. #### [` write `]() void write(const std::string &filename) const Write the build result into the `output` file. #### [` write `]() void write(std::ostream &os) const Write the build result into the `os` stream. #### [` build `]() [ok\_error\_t]( "LIEF::ok_error_t") build(const [DosHeader]( "LIEF::PE::DosHeader") &dos\_header) #### [` build `]() [ok\_error\_t]( "LIEF::ok_error_t") build(const [Header]( "LIEF::PE::Header") &header) #### [` build `]() [ok\_error\_t]( "LIEF::ok_error_t") build(const [OptionalHeader]( "LIEF::PE::OptionalHeader") &optional\_header) #### [` build `]() [ok\_error\_t]( "LIEF::ok_error_t") build(const [DataDirectory]( "LIEF::PE::DataDirectory") &data\_directory) #### [` build `]() [ok\_error\_t]( "LIEF::ok_error_t") build(const [Section]( "LIEF::PE::Section") &section) #### [` build_overlay `]() [ok\_error\_t]( "LIEF::ok_error_t") build\_overlay() #### [` build_relocations `]() [ok\_error\_t]( "LIEF::ok_error_t") build\_relocations() #### [` build_resources `]() [ok\_error\_t]( "LIEF::ok_error_t") build\_resources() #### [` build_debug_info `]() [ok\_error\_t]( "LIEF::ok_error_t") build\_debug\_info() #### [` build_exports `]() [ok\_error\_t]( "LIEF::ok_error_t") build\_exports() #### [` PE_Tbuild_imports `]() template<typename PE\_T> [ok\_error\_t]( "LIEF::ok_error_t") build\_imports() #### [` PE_Tbuild_tls `]() template<typename PE\_T> [ok\_error\_t]( "LIEF::ok_error_t") build\_tls() #### [` PE_Tbuild_load_config `]() template<typename PE\_T> [ok\_error\_t]( "LIEF::ok_error_t") build\_load\_config() #### [` rsrc_data `]() inline const std::vector<uint8\_t> &rsrc\_data() const #### [` config_t `]() struct config\_t This structure is used to configure the build operation. The default value of these attributes is set to `false` if the operation modifies the binary layout even though nothing changed. For instance, building the import table **always** requires relocating the table to another place. Thus, the default value is false and must be explicitly set to true. Public Types ##### [` resolved_iat_cbk_t `]() using resolved\_iat\_cbk\_t = std::function<void([Binary]( "LIEF::PE::Binary")\*, const [Import]( "LIEF::PE::Import")\*, const [ImportEntry]( "LIEF::PE::ImportEntry")\*, uint32\_t)> Public Members ##### [` imports `]() bool imports = false Whether the builder should reconstruct the imports table. This option should be turned on if you modify imports. Please check LIEF website for more details ##### [` exports `]() bool exports = false Whether the builder should reconstruct the export table This option should be turned on if you modify exports. Please check LIEF website for more details ##### [` resources `]() bool resources = true Whether the builder should regenerate the resources tree. ##### [` relocations `]() bool relocations = true Whether the builder should regenerate relocations. ##### [` load_configuration `]() bool load\_configuration = true Whether the builder should regenerate the load config. ##### [` tls `]() bool tls = true Whether the builder should regenerate the [TLS]() info. ##### [` overlay `]() bool overlay = true Whether the builder should write back any overlay data. ##### [` debug `]() bool debug = true Whether the builder should regenerate debug entries. ##### [` dos_stub `]() bool dos\_stub = true Whether the builder should write back dos stub (including the rich header). ##### [` rsrc_section `]() std::string rsrc\_section = ".rsrc" If the resources tree needs to be relocated, this defines the name of the new section that contains the relocated tree. ##### [` idata_section `]() std::string idata\_section = ".idata" [Section]() that holds the relocated import table (IAT/ILT). ##### [` tls_section `]() std::string tls\_section = ".tls" [Section]() that holds the relocated [TLS]() info. ##### [` reloc_section `]() std::string reloc\_section = ".reloc" [Section]() that holds the relocated relocations. ##### [` export_section `]() std::string export\_section = ".edata" [Section]() that holds the export table. ##### [` debug_section `]() std::string debug\_section = ".debug" [Section]() that holds the debug entries. ##### [` resolved_iat_cbk `]() [resolved\_iat\_cbk\_t]( "LIEF::PE::Builder::config_t::resolved_iat_cbk_t") resolved\_iat\_cbk = nullptr --- ## [Resources Manager]() ### [` ResourcesManager `]() class ResourcesManager : public LIEF::Object The Resource Manager provides an enhanced API to manipulate the resource tree. Public Types #### [` TYPE `]() enum class TYPE The different types of resources From [https://learn.microsoft.com/en-us/windows/win32/menurc/resource-types](). *Values:* ##### [` CURSOR `]() enumerator CURSOR = 1 ##### [` BITMAP `]() enumerator BITMAP = 2 ##### [` ICON `]() enumerator ICON = 3 ##### [` MENU `]() enumerator MENU = 4 ##### [` DIALOG `]() enumerator DIALOG = 5 ##### [` STRING `]() enumerator STRING = 6 ##### [` FONTDIR `]() enumerator FONTDIR = 7 ##### [` FONT `]() enumerator FONT = 8 ##### [` ACCELERATOR `]() enumerator ACCELERATOR = 9 ##### [` RCDATA `]() enumerator RCDATA = 10 ##### [` MESSAGETABLE `]() enumerator MESSAGETABLE = 11 ##### [` GROUP_CURSOR `]() enumerator GROUP\_CURSOR = 12 ##### [` GROUP_ICON `]() enumerator GROUP\_ICON = 14 ##### [` VERSION `]() enumerator VERSION = 16 ##### [` DLGINCLUDE `]() enumerator DLGINCLUDE = 17 ##### [` PLUGPLAY `]() enumerator PLUGPLAY = 19 ##### [` VXD `]() enumerator VXD = 20 ##### [` ANICURSOR `]() enumerator ANICURSOR = 21 ##### [` ANIICON `]() enumerator ANIICON = 22 ##### [` HTML `]() enumerator HTML = 23 ##### [` MANIFEST `]() enumerator MANIFEST = 24 #### [` dialogs_t `]() using dialogs\_t = [ResourceDialog]( "LIEF::PE::ResourceDialog")::[dialogs\_t]( "LIEF::PE::ResourceDialog::dialogs_t") #### [` it_const_dialogs `]() using it\_const\_dialogs = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [dialogs\_t]( "LIEF::PE::ResourcesManager::dialogs_t")&, const [ResourceDialog]( "LIEF::PE::ResourceDialog")\*> #### [` icons_t `]() using icons\_t = std::vector<[ResourceIcon]( "LIEF::PE::ResourceIcon")> #### [` it_const_icons `]() using it\_const\_icons = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<[icons\_t]( "LIEF::PE::ResourcesManager::icons_t")> #### [` accelerators_t `]() using accelerators\_t = std::vector<[ResourceAccelerator]( "LIEF::PE::ResourceAccelerator")> #### [` it_const_accelerators `]() using it\_const\_accelerators = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<[accelerators\_t]( "LIEF::PE::ResourcesManager::accelerators_t")> #### [` strings_table_t `]() using strings\_table\_t = std::vector<[string\_entry\_t]( "LIEF::PE::ResourcesManager::string_entry_t")> Public Functions #### [` ResourcesManager `]() ResourcesManager() = delete #### [` ResourcesManager `]() inline ResourcesManager([ResourceNode]( "LIEF::PE::ResourceNode") &rsrc) #### [` ResourcesManager `]() inline ResourcesManager(const [ResourcesManager]( "LIEF::PE::ResourcesManager::ResourcesManager") &other) #### [` operator= `]() inline [ResourcesManager]( "LIEF::PE::ResourcesManager") &operator=(const [ResourcesManager]( "LIEF::PE::ResourcesManager") &other) #### [` ResourcesManager `]() ResourcesManager([ResourcesManager]( "LIEF::PE::ResourcesManager::ResourcesManager")&&) = default #### [` operator= `]() [ResourcesManager]( "LIEF::PE::ResourcesManager") &operator=([ResourcesManager]( "LIEF::PE::ResourcesManager")&&) = default #### [` ~ResourcesManager `]() ~ResourcesManager() override = default #### [` get_node_type `]() inline [ResourceNode]( "LIEF::PE::ResourceNode") \*get\_node\_type([TYPE]( "LIEF::PE::ResourcesManager::TYPE") type) Return the [ResourceNode]() associated with the given [TYPE]() or a nullptr if not found;. #### [` get_node_type `]() const [ResourceNode]( "LIEF::PE::ResourceNode") \*get\_node\_type([TYPE]( "LIEF::PE::ResourcesManager::TYPE") type) const #### [` get_types `]() std::vector<[TYPE]( "LIEF::PE::ResourcesManager::TYPE")> get\_types() const List of [TYPE]() present in the resources. #### [` has_type `]() inline bool has\_type([TYPE]( "LIEF::PE::ResourcesManager::TYPE") type) const `true` if the resource has the given [TYPE]() node #### [` has_manifest `]() inline bool has\_manifest() const `true` if resources contain the Manifest element #### [` manifest `]() std::string manifest() const Return the manifest as a std::string or an empty string if not found or corrupted. #### [` manifest `]() void manifest(const std::string &manifest) Change or set the manifest. If the manifest node path does not exist, all required nodes are created. #### [` has_version `]() inline bool has\_version() const `true` if resources contain a [LIEF::PE::ResourceVersion]() #### [` version `]() std::vector<[ResourceVersion]( "LIEF::PE::ResourceVersion")> version() const Return a list of version info (`VS_VERSIONINFO`). #### [` has_icons `]() inline bool has\_icons() const `true` if resources contain a [LIEF::PE::ResourceIcon]() #### [` icons `]() [it\_const\_icons]( "LIEF::PE::ResourcesManager::it_const_icons") icons() const Return the list of the icons present in the resources. #### [` add_icon `]() void add\_icon(const [ResourceIcon]( "LIEF::PE::ResourceIcon") &icon) Add an icon to the resources. #### [` change_icon `]() void change\_icon(const [ResourceIcon]( "LIEF::PE::ResourceIcon") &original, const [ResourceIcon]( "LIEF::PE::ResourceIcon") &newone) #### [` has_dialogs `]() inline bool has\_dialogs() const `true` if resources contain dialogs #### [` dialogs `]() [it\_const\_dialogs]( "LIEF::PE::ResourcesManager::it_const_dialogs") dialogs() const Return the list of the dialogs present in the resource. #### [` has_string_table `]() inline bool has\_string\_table() const `true` if the resources contain a string table #### [` string_table `]() [strings\_table\_t]( "LIEF::PE::ResourcesManager::strings_table_t") string\_table() const Return the list of the strings embedded in the string table (`RT_STRING`). #### [` has_html `]() inline bool has\_html() const `true` if the resources contain html #### [` html `]() std::vector<std::string> html() const Return the list of the html resources. #### [` has_accelerator `]() inline bool has\_accelerator() const `true` if the resources contain accelerator info #### [` accelerator `]() [it\_const\_accelerators]( "LIEF::PE::ResourcesManager::it_const_accelerators") accelerator() const Return the list of the accelerator in the resource. #### [` print `]() std::string print(uint32\_t depth = 0) const Print the resource tree to the given depth. #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ResourcesManager]( "LIEF::PE::ResourcesManager") &m) #### [` string_entry_t `]() struct string\_entry\_t This structure represent an entry in the string table (`RT_STRING`). Public Functions ##### [` string_u8 `]() std::string string\_u8() const ##### [` is_defined `]() inline bool is\_defined() const ##### [` operator bool `]() inline operator bool() const Public Members ##### [` string `]() std::u16string string ##### [` id `]() uint32\_t id = 0 Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [string\_entry\_t]( "LIEF::PE::ResourcesManager::string_entry_t") &str) --- ## [Resource Node]() ### [` ResourceNode `]() class ResourceNode : public LIEF::Object Class which represents a Node in the resource tree. Subclassed by [LIEF::PE::ResourceData](), [LIEF::PE::ResourceDirectory]() Public Types #### [` TYPE `]() enum class TYPE Enum that identifies the type of a node in the resource tree. *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` DATA `]() enumerator DATA ##### [` DIRECTORY `]() enumerator DIRECTORY #### [` childs_t `]() using childs\_t = std::vector<std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")>> #### [` it_childs `]() using it\_childs = [ref\_iterator]( "LIEF::ref_iterator")<[childs\_t]( "LIEF::PE::ResourceNode::childs_t")&, [ResourceNode]( "LIEF::PE::ResourceNode")\*> #### [` it_const_childs `]() using it\_const\_childs = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [childs\_t]( "LIEF::PE::ResourceNode::childs_t")&, [ResourceNode]( "LIEF::PE::ResourceNode")\*> Public Functions #### [` ResourceNode `]() ResourceNode(const [ResourceNode]( "LIEF::PE::ResourceNode::ResourceNode") &other) #### [` operator= `]() [ResourceNode]( "LIEF::PE::ResourceNode") &operator=(const [ResourceNode]( "LIEF::PE::ResourceNode") &other) #### [` ResourceNode `]() ResourceNode([ResourceNode]( "LIEF::PE::ResourceNode::ResourceNode") &&other) = default #### [` operator= `]() [ResourceNode]( "LIEF::PE::ResourceNode") &operator=([ResourceNode]( "LIEF::PE::ResourceNode") &&other) = default #### [` swap `]() void swap([ResourceNode]( "LIEF::PE::ResourceNode") &other) #### [` ~ResourceNode `]() ~ResourceNode() override #### [` clone `]() virtual std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")> clone() const = 0 #### [` id `]() inline uint32\_t id() const Integer that identifies the Type, Name, or Language ID of the entry depending on its depth in the tree. #### [` name `]() inline const std::u16string &name() const Name of the entry (if any). #### [` utf8_name `]() std::string utf8\_name() const UTF-8 representation of the [name()](). #### [` childs `]() inline [it\_childs]( "LIEF::PE::ResourceNode::it_childs") childs() Iterator on node’s children. #### [` childs `]() inline [it\_const\_childs]( "LIEF::PE::ResourceNode::it_const_childs") childs() const #### [` has_name `]() inline bool has\_name() const `True` if the entry uses a name as ID #### [` depth `]() inline uint32\_t depth() const Current depth of the Node in the resource tree. #### [` is_directory `]() inline bool is\_directory() const `True` if the current entry is a [ResourceDirectory](). It can be safely cast with: ```cpp const auto* dir_node = node.cast(); ``` #### [` is_data `]() inline bool is\_data() const `True` if the current entry is a [ResourceData](). It can be safely cast with: ```cpp const auto* data_node = node.cast(); ``` #### [` id `]() inline void id(uint32\_t id) #### [` name `]() void name(const std::string &name) #### [` name `]() inline void name(std::u16string name) #### [` add_child `]() [ResourceNode]( "LIEF::PE::ResourceNode") &add\_child(std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")> child) Add a new child to the current node, taking the ownership of the provided `unique_ptr`. #### [` add_child `]() inline [ResourceNode]( "LIEF::PE::ResourceNode") &add\_child(const [ResourceNode]( "LIEF::PE::ResourceNode") &child) Add a new child to the current node. #### [` delete_child `]() void delete\_child(uint32\_t id) Delete the node with the given `id`. #### [` delete_child `]() void delete\_child(const [ResourceNode]( "LIEF::PE::ResourceNode") &node) Delete the given node from the node’s children. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` Tcast `]() template<class T> inline const [T]( "LIEF::PE::ResourceNode::cast::T") \*cast() const #### [` Tcast `]() template<class T> inline [T]( "LIEF::PE::ResourceNode::cast::T") \*cast() #### [` to_string `]() inline std::string to\_string() const #### [` push_child `]() inline void push\_child(std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")> node) Public Static Functions #### [` parse `]() static std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")> parse([BinaryStream]( "LIEF::BinaryStream") &stream, uint64\_t rva) Parse the resource tree from the provided [BinaryStream]() stream and with the original RVA provided in the second parameter. The RVA value should come from the [DataDirectory::RVA]() associated with the resource tree. #### [` parse `]() static std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")> parse(const uint8\_t \*buffer, size\_t size, uint64\_t rva) Parse the resource tree from the provided buffer referenced by a pointer and the size. The second parameter is the RVA where the resource is (or was) located. #### [` parse `]() static inline std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")> parse(const std::vector<uint8\_t> &buffer, uint64\_t rva) See doc from other parse functions. #### [` parse `]() static inline std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")> parse(span<const uint8\_t> buffer, uint64\_t rva) See doc from other parse functions. #### [` parse `]() static std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")> parse([BinaryStream]( "LIEF::BinaryStream") &stream, const [Binary]( "LIEF::PE::Binary") &bin) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ResourceNode]( "LIEF::PE::ResourceNode") &node) #### [` operator== `]() friend bool operator==(const [ResourceNode]( "LIEF::PE::ResourceNode") &LHS, const [ResourceNode]( "LIEF::PE::ResourceNode") &RHS) #### [` operator!= `]() inline friend bool operator!=(const [ResourceNode]( "LIEF::PE::ResourceNode") &LHS, const [ResourceNode]( "LIEF::PE::ResourceNode") &RHS) --- ## [Resource Directory]() ### [` ResourceDirectory `]() class ResourceDirectory : public LIEF::PE::[ResourceNode]( "LIEF::PE::ResourceNode") Public Functions #### [` ResourceDirectory `]() inline ResourceDirectory() #### [` ResourceDirectory `]() inline ResourceDirectory(uint32\_t id) #### [` ResourceDirectory `]() ResourceDirectory(const details::pe\_resource\_directory\_table &header) #### [` ResourceDirectory `]() ResourceDirectory(const [ResourceDirectory]( "LIEF::PE::ResourceDirectory::ResourceDirectory") &other) = default #### [` operator= `]() [ResourceDirectory]( "LIEF::PE::ResourceDirectory") &operator=(const [ResourceDirectory]( "LIEF::PE::ResourceDirectory") &other) = default #### [` swap `]() void swap([ResourceDirectory]( "LIEF::PE::ResourceDirectory") &other) noexcept #### [` ~ResourceDirectory `]() ~ResourceDirectory() override = default #### [` clone `]() inline virtual std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")> clone() const override #### [` characteristics `]() inline uint32\_t characteristics() const Resource characteristics. This field is reserved for future use. It is currently set to zero. #### [` time_date_stamp `]() inline uint32\_t time\_date\_stamp() const The time that the resource data was created by the resource compiler. #### [` major_version `]() inline uint16\_t major\_version() const The major version number, set by the user. #### [` minor_version `]() inline uint16\_t minor\_version() const The minor version number, set by the user. #### [` numberof_name_entries `]() inline uint16\_t numberof\_name\_entries() const The number of directory entries immediately following the table that use strings to identify Type, Name, or Language entries (depending on the level of the table). #### [` numberof_id_entries `]() inline uint16\_t numberof\_id\_entries() const The number of directory entries immediately following the Name entries that use numeric IDs for Type, Name, or Language entries. #### [` characteristics `]() inline void characteristics(uint32\_t characteristics) #### [` time_date_stamp `]() inline void time\_date\_stamp(uint32\_t time\_date\_stamp) #### [` major_version `]() inline void major\_version(uint16\_t major\_version) #### [` minor_version `]() inline void minor\_version(uint16\_t minor\_version) #### [` numberof_name_entries `]() inline void numberof\_name\_entries(uint16\_t numberof\_name\_entries) #### [` numberof_id_entries `]() inline void numberof\_id\_entries(uint16\_t numberof\_id\_entries) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` classof `]() static inline bool classof(const [ResourceNode]( "LIEF::PE::ResourceNode") \*node) --- ## [Resource Data]() ### [` ResourceData `]() class ResourceData : public LIEF::PE::[ResourceNode]( "LIEF::PE::ResourceNode") Class which represents a Data Node in the PE resources tree. Public Functions #### [` ResourceData `]() inline ResourceData() #### [` ResourceData `]() inline ResourceData(std::vector<uint8\_t> content, uint32\_t code\_page = 0) #### [` ResourceData `]() inline ResourceData(const std::string &str, uint32\_t code\_page = 0) #### [` ResourceData `]() ResourceData(const [ResourceData]( "LIEF::PE::ResourceData::ResourceData") &other) = default #### [` operator= `]() [ResourceData]( "LIEF::PE::ResourceData") &operator=(const [ResourceData]( "LIEF::PE::ResourceData") &other) = default #### [` swap `]() void swap([ResourceData]( "LIEF::PE::ResourceData") &other) noexcept #### [` ~ResourceData `]() ~ResourceData() override = default #### [` clone `]() inline virtual std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")> clone() const override #### [` code_page `]() inline uint32\_t code\_page() const Return the code page that is used to decode code point values within the resource data. Typically, the code page is the unicode code page. #### [` content `]() inline span<const uint8\_t> content() const Resource content. #### [` content `]() inline span<uint8\_t> content() #### [` reserved `]() inline uint32\_t reserved() const Reserved value. Should be `0`. #### [` offset `]() inline uint32\_t offset() const Offset of the content within the resource. > **Warning** > > This value may change when rebuilding resource table #### [` code_page `]() inline void code\_page(uint32\_t code\_page) #### [` content `]() inline void content(std::vector<uint8\_t> content) #### [` content `]() inline void content(const std::string &string) #### [` content `]() inline void content(const uint8\_t \*buffer, size\_t size) #### [` reserved `]() inline void reserved(uint32\_t value) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` classof `]() static inline bool classof(const [ResourceNode]( "LIEF::PE::ResourceNode") \*node) --- ## [Resource Icon]() ### [` ResourceIcon `]() class ResourceIcon : public LIEF::Object Public Functions #### [` ResourceIcon `]() ResourceIcon() = default #### [` ResourceIcon `]() ResourceIcon(const details::pe\_resource\_icon\_group &header) #### [` ResourceIcon `]() ResourceIcon(const details::pe\_icon\_header &header) #### [` ResourceIcon `]() ResourceIcon(const [ResourceIcon]( "LIEF::PE::ResourceIcon::ResourceIcon")&) = default #### [` operator= `]() [ResourceIcon]( "LIEF::PE::ResourceIcon") &operator=(const [ResourceIcon]( "LIEF::PE::ResourceIcon")&) = default #### [` ResourceIcon `]() ResourceIcon([ResourceIcon]( "LIEF::PE::ResourceIcon::ResourceIcon")&&) = default #### [` operator= `]() [ResourceIcon]( "LIEF::PE::ResourceIcon") &operator=([ResourceIcon]( "LIEF::PE::ResourceIcon")&&) = default #### [` ~ResourceIcon `]() ~ResourceIcon() override = default #### [` id `]() inline uint32\_t id() const Id associated with the icon. #### [` lang `]() inline uint32\_t lang() const Language associated with the icon. #### [` sublang `]() inline uint32\_t sublang() const Sub language associated with the icon. #### [` width `]() inline uint8\_t width() const Width in pixels of the image. #### [` height `]() inline uint8\_t height() const Height in pixels of the image. #### [` color_count `]() inline uint8\_t color\_count() const Number of colors in image (0 if >=8bpp). #### [` reserved `]() inline uint8\_t reserved() const Reserved (must be 0). #### [` planes `]() inline uint16\_t planes() const Color Planes. #### [` bit_count `]() inline uint16\_t bit\_count() const Bits per pixel. #### [` size `]() inline uint32\_t size() const Size in bytes of the image. #### [` pixels `]() inline span<const uint8\_t> pixels() const Pixels of the image (as bytes). #### [` id `]() inline void id(uint32\_t id) #### [` lang `]() inline void lang(uint32\_t lang) #### [` sublang `]() inline void sublang(uint32\_t sublang) #### [` width `]() inline void width(uint8\_t width) #### [` height `]() inline void height(uint8\_t height) #### [` color_count `]() inline void color\_count(uint8\_t color\_count) #### [` reserved `]() inline void reserved(uint8\_t reserved) #### [` planes `]() inline void planes(uint16\_t planes) #### [` bit_count `]() inline void bit\_count(uint16\_t bit\_count) #### [` pixels `]() inline void pixels(std::vector<uint8\_t> pixels) #### [` save `]() void save(const std::string &filename) const Save the icon to the given filename. **Parameters:** **filename** – **[in]** Path to file in which the icon will be saved #### [` serialize `]() std::vector<uint8\_t> serialize() const #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` from_serialization `]() static [result]( "LIEF::result")<[ResourceIcon]( "LIEF::PE::ResourceIcon")> from\_serialization(const uint8\_t \*buffer, size\_t size) #### [` from_serialization `]() static inline [result]( "LIEF::result")<[ResourceIcon]( "LIEF::PE::ResourceIcon")> from\_serialization(const std::vector<uint8\_t> &bytes) #### [` from_bytes `]() static inline [result]( "LIEF::result")<[ResourceIcon]( "LIEF::PE::ResourceIcon")> from\_bytes(LIEF::span<const uint8\_t> bytes) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ResourceIcon]( "LIEF::PE::ResourceIcon") &entry) --- ## [Resource Dialog]() ### [` ResourceDialog `]() class ResourceDialog : public LIEF::Object This class is the base class for either a regular (legacy) Dialog or an extended Dialog. These different kinds of Dialogs are documented by MS at the following addresses: - [https://learn.microsoft.com/en-us/windows/win32/api/winuser/ns-winuser-dlgtemplate]() - [https://learn.microsoft.com/fr-fr/windows/win32/dlgbox/dlgitemtemplateex]() Subclassed by [LIEF::PE::ResourceDialogExtended](), [LIEF::PE::ResourceDialogRegular]() Public Types #### [` TYPE `]() enum class TYPE Enum for discriminating the kind of the Dialog (regular vs extended). *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` REGULAR `]() enumerator REGULAR ##### [` EXTENDED `]() enumerator EXTENDED #### [` DIALOG_STYLES `]() enum class DIALOG\_STYLES : uint32\_t From: [https://learn.microsoft.com/en-us/windows/win32/dlgbox/dialog-box-styles](). *Values:* ##### [` ABSALIGN `]() enumerator ABSALIGN = 0x0001 ##### [` SYSMODAL `]() enumerator SYSMODAL = 0x0002 ##### [` LOCALEDIT `]() enumerator LOCALEDIT = 0x0020 ##### [` SETFONT `]() enumerator SETFONT = 0x0040 ##### [` MODALFRAME `]() enumerator MODALFRAME = 0x0080 ##### [` NOIDLEMSG `]() enumerator NOIDLEMSG = 0x0100 ##### [` SETFOREGROUND `]() enumerator SETFOREGROUND = 0x0200 ##### [` S3DLOOK `]() enumerator S3DLOOK = 0x0004 ##### [` FIXEDSYS `]() enumerator FIXEDSYS = 0x0008 ##### [` NOFAILCREATE `]() enumerator NOFAILCREATE = 0x0010 ##### [` CONTROL `]() enumerator CONTROL = 0x0400 ##### [` CENTER `]() enumerator CENTER = 0x0800 ##### [` CENTERMOUSE `]() enumerator CENTERMOUSE = 0x1000 ##### [` CONTEXTHELP `]() enumerator CONTEXTHELP = 0x2000 ##### [` SHELLFONT `]() enumerator SHELLFONT = [SETFONT]( "LIEF::PE::ResourceDialog::DIALOG_STYLES::SETFONT") | [FIXEDSYS]( "LIEF::PE::ResourceDialog::DIALOG_STYLES::FIXEDSYS") #### [` WINDOW_STYLES `]() enum class WINDOW\_STYLES : uint32\_t From: [https://docs.microsoft.com/en-us/windows/win32/winmsg/window-styles](). *Values:* ##### [` OVERLAPPED `]() enumerator OVERLAPPED = 0x00000000 ##### [` POPUP `]() enumerator POPUP = 0x80000000 ##### [` CHILD `]() enumerator CHILD = 0x40000000 ##### [` MINIMIZE `]() enumerator MINIMIZE = 0x20000000 ##### [` VISIBLE `]() enumerator VISIBLE = 0x10000000 ##### [` DISABLED `]() enumerator DISABLED = 0x08000000 ##### [` CLIPSIBLINGS `]() enumerator CLIPSIBLINGS = 0x04000000 ##### [` CLIPCHILDREN `]() enumerator CLIPCHILDREN = 0x02000000 ##### [` MAXIMIZE `]() enumerator MAXIMIZE = 0x01000000 ##### [` CAPTION `]() enumerator CAPTION = 0x00C00000 ##### [` BORDER `]() enumerator BORDER = 0x00800000 ##### [` DLGFRAME `]() enumerator DLGFRAME = 0x00400000 ##### [` VSCROLL `]() enumerator VSCROLL = 0x00200000 ##### [` HSCROLL `]() enumerator HSCROLL = 0x00100000 ##### [` SYSMENU `]() enumerator SYSMENU = 0x00080000 ##### [` THICKFRAME `]() enumerator THICKFRAME = 0x00040000 ##### [` GROUP `]() enumerator GROUP = 0x00020000 ##### [` TABSTOP `]() enumerator TABSTOP = 0x00010000 #### [` WINDOW_EXTENDED_STYLES `]() enum class WINDOW\_EXTENDED\_STYLES : uint32\_t From [https://docs.microsoft.com/en-us/windows/win32/winmsg/extended-window-styles](). *Values:* ##### [` DLGMODALFRAME `]() enumerator DLGMODALFRAME = 0x00000001 ##### [` NOPARENTNOTIFY `]() enumerator NOPARENTNOTIFY = 0x00000004 ##### [` TOPMOST `]() enumerator TOPMOST = 0x00000008 ##### [` ACCEPTFILES `]() enumerator ACCEPTFILES = 0x00000010 ##### [` TRANSPARENT_STY `]() enumerator TRANSPARENT\_STY = 0x00000020 ##### [` MDICHILD `]() enumerator MDICHILD = 0x00000040 ##### [` TOOLWINDOW `]() enumerator TOOLWINDOW = 0x00000080 ##### [` WINDOWEDGE `]() enumerator WINDOWEDGE = 0x00000100 ##### [` CLIENTEDGE `]() enumerator CLIENTEDGE = 0x00000200 ##### [` CONTEXTHELP `]() enumerator CONTEXTHELP = 0x00000400 ##### [` RIGHT `]() enumerator RIGHT = 0x00001000 ##### [` LEFT `]() enumerator LEFT = 0x00000000 ##### [` RTLREADING `]() enumerator RTLREADING = 0x00002000 ##### [` LEFTSCROLLBAR `]() enumerator LEFTSCROLLBAR = 0x00004000 ##### [` CONTROLPARENT `]() enumerator CONTROLPARENT = 0x00010000 ##### [` STATICEDGE `]() enumerator STATICEDGE = 0x00020000 ##### [` APPWINDOW `]() enumerator APPWINDOW = 0x00040000 #### [` CONTROL_STYLES `]() enum class CONTROL\_STYLES : uint32\_t From: [https://learn.microsoft.com/en-us/windows/win32/controls/common-control-styles](). *Values:* ##### [` TOP `]() enumerator TOP = 0x00000001 ##### [` NOMOVEY `]() enumerator NOMOVEY = 0x00000002 ##### [` BOTTOM `]() enumerator BOTTOM = 0x00000003 ##### [` NORESIZE `]() enumerator NORESIZE = 0x00000004 ##### [` NOPARENTALIGN `]() enumerator NOPARENTALIGN = 0x00000008 ##### [` ADJUSTABLE `]() enumerator ADJUSTABLE = 0x00000020 ##### [` NODIVIDER `]() enumerator NODIVIDER = 0x00000040 ##### [` VERT `]() enumerator VERT = 0x00000080 ##### [` LEFT `]() enumerator LEFT = [VERT]( "LIEF::PE::ResourceDialog::CONTROL_STYLES::VERT") | [TOP]( "LIEF::PE::ResourceDialog::CONTROL_STYLES::TOP") ##### [` RIGHT `]() enumerator RIGHT = [VERT]( "LIEF::PE::ResourceDialog::CONTROL_STYLES::VERT") | [BOTTOM]( "LIEF::PE::ResourceDialog::CONTROL_STYLES::BOTTOM") ##### [` NOMOVEX `]() enumerator NOMOVEX = [VERT]( "LIEF::PE::ResourceDialog::CONTROL_STYLES::VERT") | [NOMOVEY]( "LIEF::PE::ResourceDialog::CONTROL_STYLES::NOMOVEY") #### [` dialogs_t `]() using dialogs\_t = std::vector<std::unique\_ptr<[ResourceDialog]( "LIEF::PE::ResourceDialog")>> Public Functions #### [` ResourceDialog `]() ResourceDialog() = default #### [` ResourceDialog `]() ResourceDialog(const [ResourceDialog]( "LIEF::PE::ResourceDialog::ResourceDialog")&) = default #### [` operator= `]() [ResourceDialog]( "LIEF::PE::ResourceDialog") &operator=(const [ResourceDialog]( "LIEF::PE::ResourceDialog")&) = default #### [` ResourceDialog `]() ResourceDialog([ResourceDialog]( "LIEF::PE::ResourceDialog::ResourceDialog")&&) = default #### [` operator= `]() [ResourceDialog]( "LIEF::PE::ResourceDialog") &operator=([ResourceDialog]( "LIEF::PE::ResourceDialog")&&) = default #### [` ResourceDialog `]() inline ResourceDialog([TYPE]( "LIEF::PE::ResourceDialog::TYPE") ty) #### [` clone `]() virtual std::unique\_ptr<[ResourceDialog]( "LIEF::PE::ResourceDialog")> clone() const = 0 #### [` type `]() inline [TYPE]( "LIEF::PE::ResourceDialog::TYPE") type() const #### [` style `]() inline uint32\_t style() const The style of the dialog box. This member can be a combination of window style values (such as [WINDOW\_STYLES::CAPTION]() and [WINDOW\_STYLES::SYSMENU]()) and dialog box style values (such as [DIALOG\_STYLES::CENTER]()). #### [` extended_style `]() inline uint32\_t extended\_style() const The extended styles for a window. This member is not used to create dialog boxes, but applications that use dialog box templates can use it to create other types of windows. For a list of values, see [WINDOW\_EXTENDED\_STYLES](). #### [` x `]() inline int16\_t x() const The x-coordinate, in dialog box units, of the upper-left corner of the dialog box. #### [` y `]() inline int16\_t y() const The y-coordinate, in dialog box units, of the upper-left corner of the dialog box. #### [` cx `]() inline int16\_t cx() const The width, in dialog box units, of the dialog box. #### [` cy `]() inline int16\_t cy() const The height, in dialog box units, of the dialog box. #### [` style `]() inline [ResourceDialog]( "LIEF::PE::ResourceDialog") &style(uint32\_t value) #### [` extended_style `]() inline [ResourceDialog]( "LIEF::PE::ResourceDialog") &extended\_style(uint32\_t value) #### [` x `]() inline [ResourceDialog]( "LIEF::PE::ResourceDialog") &x(int16\_t value) #### [` y `]() inline [ResourceDialog]( "LIEF::PE::ResourceDialog") &y(int16\_t value) #### [` cx `]() inline [ResourceDialog]( "LIEF::PE::ResourceDialog") &cx(int16\_t value) #### [` cy `]() inline [ResourceDialog]( "LIEF::PE::ResourceDialog") &cy(int16\_t value) #### [` menu `]() inline [ResourceDialog]( "LIEF::PE::ResourceDialog") &menu(std::u16string title) #### [` menu `]() inline [ResourceDialog]( "LIEF::PE::ResourceDialog") &menu(uint16\_t ord) #### [` window_class `]() inline [ResourceDialog]( "LIEF::PE::ResourceDialog") &window\_class(std::u16string title) #### [` window_class `]() inline [ResourceDialog]( "LIEF::PE::ResourceDialog") &window\_class(uint16\_t ord) #### [` title `]() inline [ResourceDialog]( "LIEF::PE::ResourceDialog") &title(std::u16string value) #### [` title `]() [ResourceDialog]( "LIEF::PE::ResourceDialog") &title(const std::string &title) #### [` has `]() inline bool has([DIALOG\_STYLES]( "LIEF::PE::ResourceDialog::DIALOG_STYLES") style) const Check if the dialog uses the given dialog style. #### [` has `]() inline bool has([WINDOW\_STYLES]( "LIEF::PE::ResourceDialog::WINDOW_STYLES") style) const Check if the dialog uses the given window style. #### [` has `]() inline bool has([WINDOW\_EXTENDED\_STYLES]( "LIEF::PE::ResourceDialog::WINDOW_EXTENDED_STYLES") style) const Check if the dialog uses the given extended window style. #### [` styles_list `]() std::vector<[DIALOG\_STYLES]( "LIEF::PE::ResourceDialog::DIALOG_STYLES")> styles\_list() const List of [DIALOG\_STYLES]() used by this dialog. #### [` windows_styles_list `]() std::vector<[WINDOW\_STYLES]( "LIEF::PE::ResourceDialog::WINDOW_STYLES")> windows\_styles\_list() const List of [WINDOW\_STYLES]() used by this dialog. #### [` windows_ext_styles_list `]() std::vector<[WINDOW\_EXTENDED\_STYLES]( "LIEF::PE::ResourceDialog::WINDOW_EXTENDED_STYLES")> windows\_ext\_styles\_list() const List of [WINDOW\_EXTENDED\_STYLES]() used by this dialog. #### [` title `]() inline const std::u16string &title() const title of the dialog box #### [` title_utf8 `]() std::string title\_utf8() const title of the dialog box #### [` menu `]() inline const [ordinal\_or\_str\_t]( "LIEF::PE::ResourceDialog::ordinal_or_str_t") &menu() const ordinal or name value of a menu resource. #### [` window_class `]() inline const [ordinal\_or\_str\_t]( "LIEF::PE::ResourceDialog::ordinal_or_str_t") &window\_class() const ordinal of a predefined system window class or name of a registered window class #### [` to_string `]() virtual std::string to\_string() const = 0 #### [` ~ResourceDialog `]() ~ResourceDialog() override = default #### [` Tas `]() template<class T> inline const [T]( "LIEF::PE::ResourceDialog::as::T") \*as() const Helper to **downcast** a [ResourceDialog]() into a [ResourceDialogRegular]() or a [ResourceDialogExtended](). Public Static Functions #### [` parse `]() static [dialogs\_t]( "LIEF::PE::ResourceDialog::dialogs_t") parse(const [ResourceData]( "LIEF::PE::ResourceData") &node) Parse dialogs from the given resource data node. #### [` parse `]() static [dialogs\_t]( "LIEF::PE::ResourceDialog::dialogs_t") parse(const uint8\_t \*buffer, size\_t size) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [ResourceDialog]( "LIEF::PE::ResourceDialog") &dialog) #### [` ordinal_or_str_t `]() struct ordinal\_or\_str\_t This structure wraps either an ordinal value (`uint16_t`) or a string. The ordinal value should refer to an existing resource id in the resource tree. Public Functions ##### [` is_defined `]() inline bool is\_defined() const ##### [` operator bool `]() inline operator bool() const ##### [` to_string `]() std::string to\_string() const Public Members ##### [` ordinal `]() [result]( "LIEF::result")<uint16\_t> ordinal = make\_error\_code([lief\_errors]( "lief_errors")::[not\_found]( "lief_errors::not_found")) ##### [` string `]() std::u16string string #### [` Item `]() class Item This class represents an element of the dialog. It can be for instance, a button, or a caption. This class is inherited by the regular or extended dialog’s item: - [ResourceDialogRegular::Item]() - [ResourceDialogExtended::Item]() Subclassed by [LIEF::PE::ResourceDialogExtended::Item](), [LIEF::PE::ResourceDialogRegular::Item]() Public Types ##### [` WINDOW_CLASS `]() enum class WINDOW\_CLASS : uint32\_t *Values:* ###### [` BUTTON `]() enumerator BUTTON = 0x0080 ###### [` EDIT `]() enumerator EDIT = 0x0081 ###### [` STATIC `]() enumerator STATIC = 0x0082 ###### [` LIST_BOX `]() enumerator LIST\_BOX = 0x0083 ###### [` SCROLL_BAR `]() enumerator SCROLL\_BAR = 0x0084 ###### [` COMBO_BOX `]() enumerator COMBO\_BOX = 0x0085 Public Functions ##### [` Item `]() Item() = default ##### [` Item `]() Item(const [Item]( "LIEF::PE::ResourceDialog::Item::Item")&) = default ##### [` operator= `]() [Item]( "LIEF::PE::ResourceDialog::Item") &operator=(const [Item]( "LIEF::PE::ResourceDialog::Item")&) = default ##### [` Item `]() Item([Item]( "LIEF::PE::ResourceDialog::Item::Item")&&) = default ##### [` operator= `]() [Item]( "LIEF::PE::ResourceDialog::Item") &operator=([Item]( "LIEF::PE::ResourceDialog::Item")&&) = default ##### [` style `]() inline uint32\_t style() const The style of the control. This can be a combination of [WINDOW\_STYLES]() or [CONTROL\_STYLES](). ##### [` extended_style `]() inline uint32\_t extended\_style() const The extended styles for a window. This member is not used to create controls in dialog boxes, but applications that use dialog box templates can use it to create other types of windows. It can take a combination of [WINDOW\_EXTENDED\_STYLES]() ##### [` id `]() inline int32\_t id() const The control identifier. ##### [` has `]() inline bool has([WINDOW\_STYLES]( "LIEF::PE::ResourceDialog::WINDOW_STYLES") style) const Check if this item has the given [WINDOW\_STYLES](). ##### [` has `]() inline bool has([CONTROL\_STYLES]( "LIEF::PE::ResourceDialog::CONTROL_STYLES") style) const Check if this item has the given [CONTROL\_STYLES](). ##### [` window_styles `]() std::vector<[WINDOW\_STYLES]( "LIEF::PE::ResourceDialog::WINDOW_STYLES")> window\_styles() const List of [WINDOW\_STYLES]() used by this item. ##### [` control_styles `]() std::vector<[CONTROL\_STYLES]( "LIEF::PE::ResourceDialog::CONTROL_STYLES")> control\_styles() const List of [CONTROL\_STYLES]() used by this item. ##### [` x `]() inline int16\_t x() const The x-coordinate, in dialog box units, of the upper-left corner of the control. This coordinate is always relative to the upper-left corner of the dialog box’s client area. ##### [` y `]() inline int16\_t y() const The y-coordinate, in dialog box units, of the upper-left corner of the control. This coordinate is always relative to the upper-left corner of the dialog box’s client area. ##### [` cx `]() inline int16\_t cx() const The width, in dialog box units, of the control. ##### [` cy `]() inline int16\_t cy() const The height, in dialog box units, of the control. ##### [` style `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &style(uint32\_t value) ##### [` extended_style `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &extended\_style(uint32\_t value) ##### [` x `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &x(int16\_t value) ##### [` y `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &y(int16\_t value) ##### [` cx `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &cx(int16\_t value) ##### [` cy `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &cy(int16\_t value) ##### [` id `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &id(int32\_t value) ##### [` data `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &data(std::vector<uint8\_t> creation\_data) ##### [` clazz `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &clazz(std::u16string title) ##### [` clazz `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &clazz(uint16\_t ord) ##### [` title `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &title(std::u16string value) ##### [` title `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &title(uint16\_t ord) ##### [` clazz `]() inline const [ordinal\_or\_str\_t]( "LIEF::PE::ResourceDialog::ordinal_or_str_t") &clazz() const Window class of the control. This can be either: a string that specifies the name of a registered window class or an ordinal value of a predefined system class. ##### [` title `]() inline const [ordinal\_or\_str\_t]( "LIEF::PE::ResourceDialog::ordinal_or_str_t") &title() const Title of the item which can be either: a string that specifies the initial text or an ordinal value of a resource, such as an icon, in an executable file. ##### [` creation_data `]() inline span<const uint8\_t> creation\_data() const Creation data that is passed to the control’s window procedure. ##### [` creation_data `]() inline span<uint8\_t> creation\_data() ##### [` ~Item `]() virtual ~Item() = default ##### [` to_string `]() virtual std::string to\_string() const = 0 Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Item]( "LIEF::PE::ResourceDialog::Item") &item) --- ## [Resource Dialog – Regular]() ### [` ResourceDialogRegular `]() class ResourceDialogRegular : public LIEF::PE::[ResourceDialog]( "LIEF::PE::ResourceDialog") Implementation for a regular/legacy dialog box. See: [https://learn.microsoft.com/en-us/windows/win32/api/winuser/ns-winuser-dlgtemplate]() Public Types #### [` items_t `]() using items\_t = std::vector<[Item]( "LIEF::PE::ResourceDialogRegular::Item")> #### [` it_items `]() using it\_items = [ref\_iterator]( "LIEF::ref_iterator")<[items\_t]( "LIEF::PE::ResourceDialogRegular::items_t")&> #### [` it_const_items `]() using it\_const\_items = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [items\_t]( "LIEF::PE::ResourceDialogRegular::items_t")&> Public Functions #### [` ResourceDialogRegular `]() inline ResourceDialogRegular() #### [` ResourceDialogRegular `]() ResourceDialogRegular(const [ResourceDialogRegular]( "LIEF::PE::ResourceDialogRegular::ResourceDialogRegular")&) = default #### [` operator= `]() [ResourceDialogRegular]( "LIEF::PE::ResourceDialogRegular") &operator=(const [ResourceDialogRegular]( "LIEF::PE::ResourceDialogRegular")&) = default #### [` ResourceDialogRegular `]() ResourceDialogRegular([ResourceDialogRegular]( "LIEF::PE::ResourceDialogRegular::ResourceDialogRegular")&&) = default #### [` operator= `]() [ResourceDialogRegular]( "LIEF::PE::ResourceDialogRegular") &operator=([ResourceDialogRegular]( "LIEF::PE::ResourceDialogRegular")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[ResourceDialog]( "LIEF::PE::ResourceDialog")> clone() const override #### [` to_string `]() virtual std::string to\_string() const override #### [` nb_items `]() inline uint32\_t nb\_items() const Number of control items. #### [` items `]() inline [it\_items]( "LIEF::PE::ResourceDialogRegular::it_items") items() Iterator over the different control items. #### [` items `]() inline [it\_const\_items]( "LIEF::PE::ResourceDialogRegular::it_const_items") items() const #### [` add_item `]() inline void add\_item(const [Item]( "LIEF::PE::ResourceDialogRegular::Item") &item) Add a new control item to the dialog. #### [` font `]() inline const [font\_t]( "LIEF::PE::ResourceDialogRegular::font_t") &font() const Additional font information. #### [` font `]() inline [ResourceDialogRegular]( "LIEF::PE::ResourceDialogRegular") &font(uint16\_t pointsize, std::u16string name) #### [` font `]() inline [ResourceDialogRegular]( "LIEF::PE::ResourceDialogRegular") &font([font\_t]( "LIEF::PE::ResourceDialogRegular::font_t") f) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~ResourceDialogRegular `]() ~ResourceDialogRegular() override = default Public Static Functions #### [` create `]() static std::unique\_ptr<[ResourceDialogRegular]( "LIEF::PE::ResourceDialogRegular")> create([BinaryStream]( "LIEF::BinaryStream") &stream) #### [` classof `]() static inline bool classof(const [ResourceDialog]( "LIEF::PE::ResourceDialog") \*dialog) #### [` Item `]() class Item : public LIEF::PE::[ResourceDialog]( "LIEF::PE::ResourceDialog")::[Item]( "LIEF::PE::ResourceDialog::Item") This class represents a `DLGTEMPLATE` item: `DLGITEMTEMPLATE`. See: [https://learn.microsoft.com/en-us/windows/win32/api/winuser/ns-winuser-dlgitemtemplate]() Public Functions ##### [` Item `]() Item() = default ##### [` Item `]() Item(const [Item]( "LIEF::PE::ResourceDialogRegular::Item::Item")&) = default ##### [` operator= `]() [Item]( "LIEF::PE::ResourceDialogRegular::Item") &operator=(const [Item]( "LIEF::PE::ResourceDialogRegular::Item")&) = default ##### [` Item `]() Item([Item]( "LIEF::PE::ResourceDialogRegular::Item::Item")&&) = default ##### [` operator= `]() [Item]( "LIEF::PE::ResourceDialogRegular::Item") &operator=([Item]( "LIEF::PE::ResourceDialogRegular::Item")&&) = default ##### [` to_string `]() virtual std::string to\_string() const override ##### [` ~Item `]() virtual ~Item() override = default Public Static Functions ##### [` parse `]() static [result]( "LIEF::result")<[Item]( "LIEF::PE::ResourceDialogRegular::Item")> parse([BinaryStream]( "LIEF::BinaryStream") &stream) #### [` font_t `]() struct font\_t This structure represents additional font information that might be embedded at the end of the DLGTEMPLATE stream. Public Functions ##### [` is_defined `]() inline bool is\_defined() const ##### [` operator bool `]() inline operator bool() const ##### [` to_string `]() std::string to\_string() const Public Members ##### [` point_size `]() uint16\_t point\_size = 0 ##### [` name `]() std::u16string name Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [font\_t]( "LIEF::PE::ResourceDialogRegular::font_t") &font) --- ## [Resource Dialog – Extended]() ### [` ResourceDialogExtended `]() class ResourceDialogExtended : public LIEF::PE::[ResourceDialog]( "LIEF::PE::ResourceDialog") Implementation for the new extended dialogbox format. See: [https://learn.microsoft.com/en-us/windows/win32/dlgbox/dlgtemplateex]() Public Types #### [` items_t `]() using items\_t = std::vector<[Item]( "LIEF::PE::ResourceDialogExtended::Item")> #### [` it_items `]() using it\_items = [ref\_iterator]( "LIEF::ref_iterator")<[items\_t]( "LIEF::PE::ResourceDialogExtended::items_t")&> #### [` it_const_items `]() using it\_const\_items = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [items\_t]( "LIEF::PE::ResourceDialogExtended::items_t")&> Public Functions #### [` ResourceDialogExtended `]() inline ResourceDialogExtended() #### [` ResourceDialogExtended `]() ResourceDialogExtended(const [ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended::ResourceDialogExtended")&) = default #### [` operator= `]() [ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended") &operator=(const [ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended")&) = default #### [` ResourceDialogExtended `]() ResourceDialogExtended([ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended::ResourceDialogExtended")&&) = default #### [` operator= `]() [ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended") &operator=([ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[ResourceDialog]( "LIEF::PE::ResourceDialog")> clone() const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` to_string `]() virtual std::string to\_string() const override #### [` ~ResourceDialogExtended `]() ~ResourceDialogExtended() override = default #### [` version `]() inline uint16\_t version() const The version number of the extended dialog box template. This member must be set to 1. #### [` signature `]() inline uint16\_t signature() const Indicates whether a template is an extended dialog box template. If signature is 0xFFFF, this is an extended dialog box template. In this case, the dlgVer member specifies the template version number. #### [` help_id `]() inline uint32\_t help\_id() const The help context identifier for the dialog box window. When the system sends a `WM_HELP` message, it passes the `helpID` value in the `dwContextId` member of the `HELPINFO` structure. #### [` items `]() inline [it\_items]( "LIEF::PE::ResourceDialogExtended::it_items") items() Iterator over the control items of this dialog box. #### [` items `]() inline [it\_const\_items]( "LIEF::PE::ResourceDialogExtended::it_const_items") items() const #### [` add_item `]() inline void add\_item(const [Item]( "LIEF::PE::ResourceDialogExtended::Item") &item) Add a new control item to the dialog. #### [` version `]() inline [ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended") &version(uint16\_t value) #### [` signature `]() inline [ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended") &signature(uint16\_t value) #### [` help_id `]() inline [ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended") &help\_id(uint32\_t value) #### [` font `]() inline const [font\_t]( "LIEF::PE::ResourceDialogExtended::font_t") &font() const Additional font information. #### [` font `]() inline [ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended") &font(uint16\_t point\_size, uint16\_t weight, bool italic, uint8\_t charset, std::u16string typeface) #### [` font `]() inline [ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended") &font([font\_t]( "LIEF::PE::ResourceDialogExtended::font_t") f) Public Static Functions #### [` create `]() static std::unique\_ptr<[ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended")> create([BinaryStream]( "LIEF::BinaryStream") &stream) #### [` classof `]() static inline bool classof(const [ResourceDialog]( "LIEF::PE::ResourceDialog") \*dialog) #### [` Item `]() class Item : public LIEF::PE::[ResourceDialog]( "LIEF::PE::ResourceDialog")::[Item]( "LIEF::PE::ResourceDialog::Item") This class represents a `DLGTEMPLATEEX` item (`DLGITEMTEMPLATEEX`). See: [https://learn.microsoft.com/en-us/windows/win32/dlgbox/dlgitemtemplateex]() Public Functions ##### [` Item `]() Item() = default ##### [` Item `]() Item(const [Item]( "LIEF::PE::ResourceDialogExtended::Item::Item")&) = default ##### [` operator= `]() [Item]( "LIEF::PE::ResourceDialogExtended::Item") &operator=(const [Item]( "LIEF::PE::ResourceDialogExtended::Item")&) = default ##### [` Item `]() Item([Item]( "LIEF::PE::ResourceDialogExtended::Item::Item")&&) = default ##### [` operator= `]() [Item]( "LIEF::PE::ResourceDialogExtended::Item") &operator=([Item]( "LIEF::PE::ResourceDialogExtended::Item")&&) = default ##### [` to_string `]() virtual std::string to\_string() const override ##### [` help_id `]() inline uint32\_t help\_id() const The help context identifier for the control. When the system sends a `WM_HELP` message, it passes the `helpID` value in the `dwContextId` member of the `HELPINFO` structure. ##### [` help_id `]() inline [Item]( "LIEF::PE::ResourceDialogExtended::Item") &help\_id(uint32\_t value) ##### [` ~Item `]() virtual ~Item() override = default Public Static Functions ##### [` parse `]() static [result]( "LIEF::result")<[Item]( "LIEF::PE::ResourceDialogExtended::Item")> parse([BinaryStream]( "LIEF::BinaryStream") &stream) #### [` font_t `]() struct font\_t Font information for the font to use for the text in the dialog box and its controls. Public Functions ##### [` is_defined `]() inline bool is\_defined() const ##### [` operator bool `]() inline operator bool() const ##### [` to_string `]() std::string to\_string() const Public Members ##### [` point_size `]() uint16\_t point\_size = 0 The point size of the font. ##### [` weight `]() uint16\_t weight = 0 The weight of the font. ##### [` italic `]() bool italic = false Indicates whether the font is italic. ##### [` charset `]() uint8\_t charset = false The character set to be used. ##### [` typeface `]() std::u16string typeface The name of the typeface for the font. Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [font\_t]( "LIEF::PE::ResourceDialogExtended::font_t") &font) --- ## [Resource Version]() ### [` ResourceVersion `]() class ResourceVersion : public LIEF::Object Representation of the data associated with the `RT_VERSION` entry. See: `VS_VERSIONINFO` at [https://learn.microsoft.com/en-us/windows/win32/menurc/vs-versioninfo]() Public Functions #### [` ResourceVersion `]() ResourceVersion(const [ResourceVersion]( "LIEF::PE::ResourceVersion::ResourceVersion")&) = default #### [` operator= `]() [ResourceVersion]( "LIEF::PE::ResourceVersion") &operator=(const [ResourceVersion]( "LIEF::PE::ResourceVersion")&) = default #### [` ResourceVersion `]() ResourceVersion([ResourceVersion]( "LIEF::PE::ResourceVersion::ResourceVersion")&&) = default #### [` operator= `]() [ResourceVersion]( "LIEF::PE::ResourceVersion") &operator=([ResourceVersion]( "LIEF::PE::ResourceVersion")&&) = default #### [` ~ResourceVersion `]() ~ResourceVersion() override = default #### [` file_info `]() inline const [fixed\_file\_info\_t]( "LIEF::PE::ResourceVersion::fixed_file_info_t") &file\_info() const Return the fixed file info (`VS_FIXEDFILEINFO`). #### [` file_info `]() inline [fixed\_file\_info\_t]( "LIEF::PE::ResourceVersion::fixed_file_info_t") &file\_info() #### [` string_file_info `]() inline [ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo") \*string\_file\_info() Return the `StringFileInfo` element. #### [` string_file_info `]() inline const [ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo") \*string\_file\_info() const #### [` var_file_info `]() inline [ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo") \*var\_file\_info() Return the `VarFileInfo` element. #### [` type `]() inline uint16\_t type() const The type of data in the version resource. - `1` if it contains text data - `0` if it contains binary data #### [` key `]() inline const std::u16string &key() const The Unicode string `L"VS_VERSION_INFO"`. #### [` key_u8 `]() std::string key\_u8() const The key as an utf8 string. #### [` type `]() inline [ResourceVersion]( "LIEF::PE::ResourceVersion") &type(uint16\_t value) #### [` key `]() inline [ResourceVersion]( "LIEF::PE::ResourceVersion") &key(std::u16string value) #### [` var_file_info `]() inline const [ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo") \*var\_file\_info() const #### [` var_file_info `]() inline [ResourceVersion]( "LIEF::PE::ResourceVersion") &var\_file\_info([ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo") info) #### [` string_file_info `]() inline [ResourceVersion]( "LIEF::PE::ResourceVersion") &string\_file\_info([ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo") info) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` parse `]() static [result]( "LIEF::result")<[ResourceVersion]( "LIEF::PE::ResourceVersion")> parse(const [ResourceData]( "LIEF::PE::ResourceData") &node) #### [` parse `]() static [result]( "LIEF::result")<[ResourceVersion]( "LIEF::PE::ResourceVersion")> parse(const uint8\_t \*p, size\_t sz) #### [` parse `]() static [result]( "LIEF::result")<[ResourceVersion]( "LIEF::PE::ResourceVersion")> parse([BinaryStream]( "LIEF::BinaryStream") &stream) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ResourceVersion]( "LIEF::PE::ResourceVersion") &version) #### [` fixed_file_info_t `]() struct fixed\_file\_info\_t This structure represents the `VS_FIXEDFILEINFO` structure defined in `verrsrc.h`. Public Types ##### [` VERSION_OS `]() enum class VERSION\_OS : uint32\_t *Values:* ###### [` UNKNOWN `]() enumerator UNKNOWN = 0x00000000 The operating system for which the file was designed is unknown to the system. ###### [` DOS `]() enumerator DOS = 0x00010000 The file was designed for MS-DOS. ###### [` OS216 `]() enumerator OS216 = 0x00020000 The file was designed for 16-bit OS/2. ###### [` OS232 `]() enumerator OS232 = 0x00030000 The file was designed for 32-bit OS/2. ###### [` NT `]() enumerator NT = 0x00040000 The file was designed for Windows NT. ###### [` WINCE `]() enumerator WINCE = 0x00050000 The file was designed for Windows CE (Windows Embedded Compact). ###### [` WINDOWS16 `]() enumerator WINDOWS16 = 0x00000001 The file was designed for 16-bit Windows. ###### [` PM16 `]() enumerator PM16 = 0x00000002 The file was designed for 16-bit Presentation Manager. ###### [` PM32 `]() enumerator PM32 = 0x00000003 The file was designed for 32-bit Presentation Manager. ###### [` WINDOWS32 `]() enumerator WINDOWS32 = 0x00000004 The file was designed for 32-bit Windows. ###### [` DOS_WINDOWS16 `]() enumerator DOS\_WINDOWS16 = [DOS]( "LIEF::PE::ResourceVersion::fixed_file_info_t::VERSION_OS::DOS") | [WINDOWS16]( "LIEF::PE::ResourceVersion::fixed_file_info_t::VERSION_OS::WINDOWS16") The file was designed for 16-bit Windows running on MS-DOS. ###### [` DOS_WINDOWS32 `]() enumerator DOS\_WINDOWS32 = [DOS]( "LIEF::PE::ResourceVersion::fixed_file_info_t::VERSION_OS::DOS") | [WINDOWS32]( "LIEF::PE::ResourceVersion::fixed_file_info_t::VERSION_OS::WINDOWS32") The file was designed for 32-bit Windows running on MS-DOS. ###### [` OS216_PM16 `]() enumerator OS216\_PM16 = [OS216]( "LIEF::PE::ResourceVersion::fixed_file_info_t::VERSION_OS::OS216") | [PM16]( "LIEF::PE::ResourceVersion::fixed_file_info_t::VERSION_OS::PM16") The file was designed for 16-bit Presentation Manager running on 16-bit OS/2. ###### [` OS232_PM32 `]() enumerator OS232\_PM32 = [OS232]( "LIEF::PE::ResourceVersion::fixed_file_info_t::VERSION_OS::OS232") | [PM32]( "LIEF::PE::ResourceVersion::fixed_file_info_t::VERSION_OS::PM32") The file was designed for 32-bit Presentation Manager running on 32-bit OS/2. ###### [` NT_WINDOWS32 `]() enumerator NT\_WINDOWS32 = [NT]( "LIEF::PE::ResourceVersion::fixed_file_info_t::VERSION_OS::NT") | [WINDOWS32]( "LIEF::PE::ResourceVersion::fixed_file_info_t::VERSION_OS::WINDOWS32") The file was designed for Windows NT. ##### [` FILE_TYPE `]() enum class FILE\_TYPE : uint32\_t *Values:* ###### [` UNKNOWN `]() enumerator UNKNOWN = 0x00000000 The file type is unknown to the system. ###### [` APP `]() enumerator APP = 0x00000001 The file contains an application. ###### [` DLL `]() enumerator DLL = 0x00000002 The file contains a DLL. ###### [` DRV `]() enumerator DRV = 0x00000003 The file contains a device driver. If dwFileType is VFT\_DRV, dwFileSubtype contains a more specific description of the driver. ###### [` FONT `]() enumerator FONT = 0x00000004 The file contains a font. If dwFileType is VFT\_FONT, dwFileSubtype contains a more specific description of the font file. ###### [` VXD `]() enumerator VXD = 0x00000005 The file contains a virtual device. ###### [` STATIC_LIB `]() enumerator STATIC\_LIB = 0x00000007 The file contains a static-link library. ##### [` FILE_TYPE_DETAILS `]() enum class FILE\_TYPE\_DETAILS : uint64\_t *Values:* ###### [` UNKNOWN `]() enumerator UNKNOWN = 0x00000000 The type is unknown by the system. ###### [` DRV_PRINTER `]() enumerator DRV\_PRINTER = 0x00000001 | [DRV\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::DRV_K") The file contains a printer driver. ###### [` DRV_KEYBOARD `]() enumerator DRV\_KEYBOARD = 0x00000002 | [DRV\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::DRV_K") The file contains a keyboard driver. ###### [` DRV_LANGUAGE `]() enumerator DRV\_LANGUAGE = 0x00000003 | [DRV\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::DRV_K") The file contains a language driver. ###### [` DRV_DISPLAY `]() enumerator DRV\_DISPLAY = 0x00000004 | [DRV\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::DRV_K") The file contains a display driver. ###### [` DRV_MOUSE `]() enumerator DRV\_MOUSE = 0x00000005 | [DRV\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::DRV_K") The file contains a mouse driver. ###### [` DRV_NETWORK `]() enumerator DRV\_NETWORK = 0x00000006 | [DRV\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::DRV_K") The file contains a network driver. ###### [` DRV_SYSTEM `]() enumerator DRV\_SYSTEM = 0x00000007 | [DRV\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::DRV_K") The file contains a system driver. ###### [` DRV_INSTALLABLE `]() enumerator DRV\_INSTALLABLE = 0x00000008 | [DRV\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::DRV_K") The file contains an installable driver. ###### [` DRV_SOUND `]() enumerator DRV\_SOUND = 0x00000009 | [DRV\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::DRV_K") The file contains a sound driver. ###### [` DRV_COMM `]() enumerator DRV\_COMM = 0x0000000A | [DRV\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::DRV_K") The file contains a communications driver. ###### [` DRV_INPUTMETHOD `]() enumerator DRV\_INPUTMETHOD = 0x0000000B | [DRV\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::DRV_K") ###### [` DRV_VERSIONED_PRINTER `]() enumerator DRV\_VERSIONED\_PRINTER = 0x0000000C The file contains a versioned printer driver. ###### [` FONT_RASTER `]() enumerator FONT\_RASTER = 0x00000001 | [FONT\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::FONT_K") The file contains a raster font. ###### [` FONT_VECTOR `]() enumerator FONT\_VECTOR = 0x00000002 | [FONT\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::FONT_K") The file contains a vector font. ###### [` FONT_TRUETYPE `]() enumerator FONT\_TRUETYPE = 0x00000003 | [FONT\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::FONT_K") The file contains a TrueType font. ##### [` FILE_FLAGS `]() enum class FILE\_FLAGS : uint32\_t *Values:* ###### [` DEBUG `]() enumerator DEBUG = 0x00000001 The file contains debugging information or is compiled with debugging features enabled. ###### [` INFO_INFERRED `]() enumerator INFO\_INFERRED = 0x00000010 The file’s version structure was created dynamically; therefore, some of the members in this structure may be empty or incorrect. This flag should never be set in a file’s `VS_VERSIONINFO` data. ###### [` PATCHED `]() enumerator PATCHED = 0x00000004 The file has been modified and is not identical to the original shipping file of the same version number. ###### [` PRERELEASE `]() enumerator PRERELEASE = 0x00000002 The file is a development version, not a commercially released product. ###### [` PRIVATEBUILD `]() enumerator PRIVATEBUILD = 0x00000008 The file was not built using standard release procedures. If this flag is set, the StringFileInfo structure should contain a PrivateBuild entry. ###### [` SPECIALBUILD `]() enumerator SPECIALBUILD = 0x00000020 The file was built by the original company using standard release procedures but is a variation of the normal file of the same version number. If this flag is set, the StringFileInfo structure should contain a SpecialBuild entry. Public Functions ##### [` has `]() inline bool has([FILE\_FLAGS]( "LIEF::PE::ResourceVersion::fixed_file_info_t::FILE_FLAGS") f) const Check if the given [FILE\_FLAGS]() is present. ##### [` flags `]() std::vector<[FILE\_FLAGS]( "LIEF::PE::ResourceVersion::fixed_file_info_t::FILE_FLAGS")> flags() const List of [FILE\_FLAGS](). ##### [` file_type_details `]() inline [FILE\_TYPE\_DETAILS]( "LIEF::PE::ResourceVersion::fixed_file_info_t::FILE_TYPE_DETAILS") file\_type\_details() const ##### [` to_string `]() std::string to\_string() const Public Members ##### [` signature `]() uint32\_t signature = 0 Contains the value `0xFEEF04BD`. This is used with the `szKey` member of the `VS_VERSIONINFO` structure when searching a file for the `VS_FIXEDFILEINFO` structure. ##### [` struct_version `]() uint32\_t struct\_version = 0 The binary version number of this structure. The high-order word of this member contains the major version number, and the low-order word contains the minor version number. ##### [` file_version_ms `]() uint32\_t file\_version\_ms = 0 The most significant 32 bits of the file’s binary version number. This member is used with file\_version\_ls to form a 64-bit value used for numeric comparisons. ##### [` file_version_ls `]() uint32\_t file\_version\_ls = 0 The least significant 32 bits of the file’s binary version number. This member is used with file\_version\_ms to form a 64-bit value used for numeric comparisons. ##### [` product_version_ms `]() uint32\_t product\_version\_ms = 0 The most significant 32 bits of the binary version number of the product with which this file was distributed. This member is used with product\_version\_ls to form a 64-bit value used for numeric comparisons. ##### [` product_version_ls `]() uint32\_t product\_version\_ls = 0 The least significant 32 bits of the binary version number of the product with which this file was distributed. This member is used with product\_version\_ms to form a 64-bit value used for numeric comparisons. ##### [` file_flags_mask `]() uint32\_t file\_flags\_mask = 0 Contains a bitmask that specifies the valid bits in file\_flags. A bit is valid only if it was defined when the file was created. ##### [` file_flags `]() uint32\_t file\_flags = 0 Contains a bitmask that specifies the Boolean attributes of the file. This member can include one or more of the values specified in [FILE\_FLAGS](). ##### [` file_os `]() uint32\_t file\_os = 0 The operating system for which this file was designed. This member can be one of the values specified in [VERSION\_OS](). ##### [` file_type `]() uint32\_t file\_type = 0 The general type of file. This member can be one of the values specified in [FILE\_TYPE](). All other values are reserved. ##### [` file_subtype `]() uint32\_t file\_subtype = 0 The function of the file. The possible values depend on the value of file\_type. ##### [` file_date_ms `]() uint32\_t file\_date\_ms = 0 The most significant 32 bits of the file’s 64-bit binary creation date and time stamp. ##### [` file_date_ls `]() uint32\_t file\_date\_ls = 0 The least significant 32 bits of the file’s 64-bit binary creation date and time stamp. Public Static Attributes ##### [` DRV_K `]() static auto DRV\_K = uint64\_t(1) << 33 ##### [` FONT_K `]() static auto FONT\_K = uint64\_t(1) << 34 ##### [` SIGNATURE_VALUE `]() static auto SIGNATURE\_VALUE = 0xFEEF04BD Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [fixed\_file\_info\_t]( "LIEF::PE::ResourceVersion::fixed_file_info_t") &info) --- ## [Resource Var File Info]() ### [` ResourceVarFileInfo `]() class ResourceVarFileInfo : public LIEF::Object Representation of the `VarFileInfo` structure. This structure represents the organization of data in a file-version resource. It contains version information not dependent on a particular language and code page combination. See: [https://learn.microsoft.com/en-us/windows/win32/menurc/varfileinfo]() Public Types #### [` vars_t `]() using vars\_t = std::vector<[ResourceVar]( "LIEF::PE::ResourceVar")> #### [` it_vars `]() using it\_vars = [ref\_iterator]( "LIEF::ref_iterator")<[vars\_t]( "LIEF::PE::ResourceVarFileInfo::vars_t")&> #### [` it_const_vars `]() using it\_const\_vars = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [vars\_t]( "LIEF::PE::ResourceVarFileInfo::vars_t")&> Public Functions #### [` ResourceVarFileInfo `]() ResourceVarFileInfo() = default #### [` ResourceVarFileInfo `]() ResourceVarFileInfo(const [ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo::ResourceVarFileInfo")&) = default #### [` operator= `]() [ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo") &operator=(const [ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo")&) = default #### [` ResourceVarFileInfo `]() ResourceVarFileInfo([ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo::ResourceVarFileInfo")&&) = default #### [` operator= `]() [ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo") &operator=([ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo")&&) = default #### [` ~ResourceVarFileInfo `]() ~ResourceVarFileInfo() override = default #### [` type `]() inline uint16\_t type() const The type of data in the version resource. - `1` if it contains text data - `0` if it contains binary data #### [` key `]() inline const std::u16string &key() const [Signature]() of the structure. Must be the unicode string “VarFileInfo”. #### [` key_u8 `]() std::string key\_u8() const Key as an utf8 string. #### [` vars `]() inline [it\_vars]( "LIEF::PE::ResourceVarFileInfo::it_vars") vars() Iterator over the embedded variables associated to the structure. #### [` vars `]() inline [it\_const\_vars]( "LIEF::PE::ResourceVarFileInfo::it_const_vars") vars() const #### [` type `]() inline [ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo") &type(uint16\_t type) #### [` key `]() inline [ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo") &key(std::u16string key) #### [` add_var `]() inline void add\_var([ResourceVar]( "LIEF::PE::ResourceVar") var) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` parse `]() static [result]( "LIEF::result")<[ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo")> parse([BinaryStream]( "LIEF::BinaryStream") &stream) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo") &entry) --- ## [Resource Var]() ### [` ResourceVar `]() class ResourceVar This class represents an element of the [ResourceVarFileInfo]() structure It typically contains a list of language and code page identifier pairs that the version of the application or DLL supports. See: [https://learn.microsoft.com/en-us/windows/win32/menurc/var-str]() Public Types #### [` values_t `]() using values\_t = std::vector<uint32\_t> Translation values as a vector of `uint32_t`. Public Functions #### [` ResourceVar `]() ResourceVar() = default #### [` ResourceVar `]() ResourceVar(const [ResourceVar]( "LIEF::PE::ResourceVar::ResourceVar")&) = default #### [` operator= `]() [ResourceVar]( "LIEF::PE::ResourceVar") &operator=(const [ResourceVar]( "LIEF::PE::ResourceVar")&) = default #### [` ResourceVar `]() ResourceVar([ResourceVar]( "LIEF::PE::ResourceVar::ResourceVar")&&) = default #### [` operator= `]() [ResourceVar]( "LIEF::PE::ResourceVar") &operator=([ResourceVar]( "LIEF::PE::ResourceVar")&&) = default #### [` ~ResourceVar `]() ~ResourceVar() = default #### [` key `]() inline const std::u16string &key() const The Unicode string `L"Translation"`. #### [` type `]() inline uint16\_t type() const The type of data in the version resource: - `1` if it contains text data - `0` if it contains binary #### [` key_u8 `]() std::string key\_u8() const The key as an utf8 string. #### [` values `]() inline const [values\_t]( "LIEF::PE::ResourceVar::values_t") &values() const Return the translation values. The low-order word of each uint32\_t must contain a Microsoft language identifier, and the high-order word must contain the IBM code page number. Either high-order or low-order word can be zero, indicating that the file is language or code page independent #### [` values `]() inline [values\_t]( "LIEF::PE::ResourceVar::values_t") &values() #### [` key `]() inline [ResourceVar]( "LIEF::PE::ResourceVar") &key(std::u16string key) #### [` type `]() inline [ResourceVar]( "LIEF::PE::ResourceVar") &type(uint16\_t ty) #### [` add_value `]() inline void add\_value(uint32\_t val) Public Static Functions #### [` parse `]() static [result]( "LIEF::result")<[ResourceVar]( "LIEF::PE::ResourceVar")> parse([BinaryStream]( "LIEF::BinaryStream") &stream) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ResourceVar]( "LIEF::PE::ResourceVar") &entry) --- ## [Resource String File Info]() ### [` ResourceStringFileInfo `]() class ResourceStringFileInfo : public LIEF::Object Representation of the `StringFileInfo` structure. It contains version information that can be displayed for a particular language and code page. See: [https://learn.microsoft.com/en-us/windows/win32/menurc/stringfileinfo]() Public Types #### [` elements_t `]() using elements\_t = std::vector<[ResourceStringTable]( "LIEF::PE::ResourceStringTable")> #### [` it_const_elements `]() using it\_const\_elements = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [elements\_t]( "LIEF::PE::ResourceStringFileInfo::elements_t")&> #### [` it_elements `]() using it\_elements = [ref\_iterator]( "LIEF::ref_iterator")<[elements\_t]( "LIEF::PE::ResourceStringFileInfo::elements_t")&> Public Functions #### [` ResourceStringFileInfo `]() ResourceStringFileInfo() = default #### [` ResourceStringFileInfo `]() ResourceStringFileInfo(const [ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo::ResourceStringFileInfo")&) = default #### [` operator= `]() [ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo") &operator=(const [ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo")&) = default #### [` ResourceStringFileInfo `]() ResourceStringFileInfo([ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo::ResourceStringFileInfo")&&) = default #### [` operator= `]() [ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo") &operator=([ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo")&&) = default #### [` ~ResourceStringFileInfo `]() ~ResourceStringFileInfo() override = default #### [` type `]() inline uint16\_t type() const The type of data in the version resource. - `1` if it contains text data - `0` if it contains binary data #### [` key `]() inline const std::u16string &key() const [Signature]() of the structure. Must be the unicode string “StringFileInfo”. #### [` children `]() inline [it\_const\_elements]( "LIEF::PE::ResourceStringFileInfo::it_const_elements") children() const Iterator over the children values. #### [` children `]() inline [it\_elements]( "LIEF::PE::ResourceStringFileInfo::it_elements") children() #### [` key_u8 `]() std::string key\_u8() const The key as an utf8 string. #### [` type `]() inline [ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo") &type(uint16\_t type) #### [` key `]() inline [ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo") &key(std::u16string key) #### [` add_child `]() inline void add\_child([ResourceStringTable]( "LIEF::PE::ResourceStringTable") table) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` parse `]() static [result]( "LIEF::result")<[ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo")> parse([BinaryStream]( "LIEF::BinaryStream") &stream) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo") &info) --- ## [Resource String Table]() ### [` ResourceStringTable `]() class ResourceStringTable : public LIEF::Object This class represents the `StringTable` structure. This structure can be seen as a dictionary of key-value pairs with keys and values defined as UTF-16 strings. Public Types #### [` entries_t `]() using entries\_t = std::vector<[entry\_t]( "LIEF::PE::ResourceStringTable::entry_t")> #### [` it_entries `]() using it\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[entries\_t]( "LIEF::PE::ResourceStringTable::entries_t")&> #### [` it_const_entries `]() using it\_const\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [entries\_t]( "LIEF::PE::ResourceStringTable::entries_t")&> Public Functions #### [` ResourceStringTable `]() ResourceStringTable() = default #### [` ResourceStringTable `]() ResourceStringTable(const [ResourceStringTable]( "LIEF::PE::ResourceStringTable::ResourceStringTable")&) = default #### [` operator= `]() [ResourceStringTable]( "LIEF::PE::ResourceStringTable") &operator=(const [ResourceStringTable]( "LIEF::PE::ResourceStringTable")&) = default #### [` ResourceStringTable `]() ResourceStringTable([ResourceStringTable]( "LIEF::PE::ResourceStringTable::ResourceStringTable")&&) = default #### [` operator= `]() [ResourceStringTable]( "LIEF::PE::ResourceStringTable") &operator=([ResourceStringTable]( "LIEF::PE::ResourceStringTable")&&) = default #### [` ~ResourceStringTable `]() ~ResourceStringTable() override = default #### [` key `]() inline const std::u16string &key() const An 8-digit hexadecimal number stored as a Unicode string. The four most significant digits represent the language identifier. The four least significant digits represent the code page for which the data is formatted. Each Microsoft Standard Language identifier contains two parts: the low-order 10 bits specify the major language, and the high-order 6 bits specify the sublanguage. #### [` type `]() inline uint16\_t type() const The type of data in the version resource: - `1` if it contains text data - `0` if it contains binary #### [` key_u8 `]() std::string key\_u8() const The key as an utf8 string. #### [` entries `]() inline [it\_entries]( "LIEF::PE::ResourceStringTable::it_entries") entries() Iterator over the different [entry\_t]() element of this table. #### [` entries `]() inline [it\_const\_entries]( "LIEF::PE::ResourceStringTable::it_const_entries") entries() const #### [` get `]() inline std::optional<std::u16string> get(const std::u16string &key) const #### [` get `]() std::optional<std::string> get(const std::string &key) const #### [` key `]() inline [ResourceStringTable]( "LIEF::PE::ResourceStringTable") &key(std::u16string value) #### [` type `]() inline [ResourceStringTable]( "LIEF::PE::ResourceStringTable") &type(uint16\_t value) #### [` add_entry `]() inline void add\_entry([entry\_t]( "LIEF::PE::ResourceStringTable::entry_t") entry) #### [` add_entry `]() inline void add\_entry(std::u16string key, std::u16string value) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` operator[] `]() inline std::optional<std::string> operator[](const std::string &str) const #### [` operator[] `]() inline std::optional<std::u16string> operator[](const std::u16string &str) const Public Static Functions #### [` parse `]() static [result]( "LIEF::result")<[ResourceStringTable]( "LIEF::PE::ResourceStringTable")> parse([BinaryStream]( "LIEF::BinaryStream") &stream) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ResourceStringTable]( "LIEF::PE::ResourceStringTable") &table) #### [` entry_t `]() struct entry\_t An entry in this table which is composed of an UTF-16 key and an UTF-16 value. Public Functions ##### [` key_u8 `]() std::string key\_u8() const Key in utf8 representation. ##### [` value_u8 `]() std::string value\_u8() const Value in utf8 representation. ##### [` is_defined `]() inline bool is\_defined() const ##### [` operator bool `]() inline operator bool() const ##### [` to_string `]() inline std::string to\_string() const Public Members ##### [` key `]() std::u16string key ##### [` value `]() std::u16string value Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [entry\_t]( "LIEF::PE::ResourceStringTable::entry_t") &entry) --- ## [Resource Accelerator]() ### [` ResourceAccelerator `]() class ResourceAccelerator : public LIEF::Object Public Types #### [` FLAGS `]() enum class FLAGS : uint32\_t From: [https://docs.microsoft.com/en-us/windows/win32/menurc/acceltableentry](). *Values:* ##### [` VIRTKEY `]() enumerator VIRTKEY = 0x01 The accelerator key is a virtual-key code. If this flag is not specified, the accelerator key is assumed to specify an ASCII character code. ##### [` NOINVERT `]() enumerator NOINVERT = 0x02 A menu item on the menu bar is not highlighted when an accelerator is used. This attribute is obsolete and retained only for backward compatibility with resource files designed for 16-bit Windows. ##### [` SHIFT `]() enumerator SHIFT = 0x04 The accelerator is activated only if the user presses the SHIFT key. This flag applies only to virtual keys. ##### [` CONTROL `]() enumerator CONTROL = 0x08 The accelerator is activated only if the user presses the CTRL key. This flag applies only to virtual keys. ##### [` ALT `]() enumerator ALT = 0x10 The accelerator is activated only if the user presses the ALT key. This flag applies only to virtual keys. ##### [` END `]() enumerator END = 0x80 The entry is last in an accelerator table. Public Functions #### [` ResourceAccelerator `]() ResourceAccelerator() = default #### [` ResourceAccelerator `]() explicit ResourceAccelerator(const details::pe\_resource\_acceltableentry&) #### [` ResourceAccelerator `]() ResourceAccelerator(const [ResourceAccelerator]( "LIEF::PE::ResourceAccelerator::ResourceAccelerator")&) = default #### [` operator= `]() [ResourceAccelerator]( "LIEF::PE::ResourceAccelerator") &operator=(const [ResourceAccelerator]( "LIEF::PE::ResourceAccelerator")&) = default #### [` ResourceAccelerator `]() ResourceAccelerator([ResourceAccelerator]( "LIEF::PE::ResourceAccelerator::ResourceAccelerator")&&) = default #### [` operator= `]() [ResourceAccelerator]( "LIEF::PE::ResourceAccelerator") &operator=([ResourceAccelerator]( "LIEF::PE::ResourceAccelerator")&&) = default #### [` ~ResourceAccelerator `]() ~ResourceAccelerator() override = default #### [` flags_list `]() std::vector<[FLAGS]( "LIEF::PE::ResourceAccelerator::FLAGS")> flags\_list() const #### [` ansi_str `]() inline const char \*ansi\_str() const #### [` flags `]() inline int16\_t flags() const Describe the keyboard accelerator characteristics. #### [` ansi `]() inline int16\_t ansi() const An ANSI character value or a virtual-key code that identifies the accelerator key. #### [` id `]() inline uint16\_t id() const An identifier for the keyboard accelerator. #### [` padding `]() inline int16\_t padding() const The number of bytes inserted to ensure that the structure is aligned on a DWORD boundary. #### [` has `]() inline bool has([FLAGS]( "LIEF::PE::ResourceAccelerator::FLAGS") flag) const Whether the entry has the given flag. #### [` add `]() inline [ResourceAccelerator]( "LIEF::PE::ResourceAccelerator") &add([FLAGS]( "LIEF::PE::ResourceAccelerator::FLAGS") flag) #### [` remove `]() inline [ResourceAccelerator]( "LIEF::PE::ResourceAccelerator") &remove([FLAGS]( "LIEF::PE::ResourceAccelerator::FLAGS") flag) #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ResourceAccelerator]( "LIEF::PE::ResourceAccelerator") &acc) --- ## [Rich Header]() ### [` RichHeader `]() class RichHeader : public LIEF::Object Class which represents the not-so-documented rich header. This structure is usually located at the end of the [Binary::dos\_stub]() and contains information about the build environment. It is generated by the Microsoft linker `link.exe` and there are no options to disable or remove this information. Public Types #### [` entries_t `]() using entries\_t = std::vector<[RichEntry]( "LIEF::PE::RichEntry")> #### [` it_entries `]() using it\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[entries\_t]( "LIEF::PE::RichHeader::entries_t")&> #### [` it_const_entries `]() using it\_const\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [entries\_t]( "LIEF::PE::RichHeader::entries_t")&> Public Functions #### [` RichHeader `]() RichHeader() = default #### [` RichHeader `]() RichHeader(const [RichHeader]( "LIEF::PE::RichHeader::RichHeader")&) = default #### [` operator= `]() [RichHeader]( "LIEF::PE::RichHeader") &operator=(const [RichHeader]( "LIEF::PE::RichHeader")&) = default #### [` ~RichHeader `]() ~RichHeader() override = default #### [` key `]() inline uint32\_t key() const Key used to encode the header (xor operation). #### [` entries `]() inline [it\_entries]( "LIEF::PE::RichHeader::it_entries") entries() Return an iterator over the [PE::RichEntry]() within the header. #### [` entries `]() inline [it\_const\_entries]( "LIEF::PE::RichHeader::it_const_entries") entries() const #### [` key `]() inline void key(uint32\_t key) #### [` add_entry `]() inline void add\_entry([RichEntry]( "LIEF::PE::RichEntry") entry) Add a new [PE::RichEntry](). #### [` add_entry `]() inline void add\_entry(uint16\_t id, uint16\_t build\_id, uint32\_t count) Add a new entry given the id, build\_id and count. #### [` raw `]() inline std::vector<uint8\_t> raw() const The raw structure of the Rich header without xor-encoding. This function is equivalent as calling RichHeader::raw(uint32\_t) with a `xor_key` set to 0 #### [` raw `]() std::vector<uint8\_t> raw(uint32\_t xor\_key) const Given this rich header, this function re-computes the raw bytes of the structure with the provided xor-key. You can access the decoded data’s structure with the `xor_key` set to 0 **Parameters:** **xor\_key** – **[in]** The key to use for the xor-encoding (can be 0) #### [` hash `]() inline std::vector<uint8\_t> hash([ALGORITHMS]( "LIEF::PE::ALGORITHMS") algo) const Compute the hash of the decoded rich header structure with the given hash algorithm. #### [` hash `]() std::vector<uint8\_t> hash([ALGORITHMS]( "LIEF::PE::ALGORITHMS") algo, uint32\_t xor\_key) const Compute the hash of the rich header structure encoded with the provided key. #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Attributes #### [` RICH_MAGIC `]() static uint8\_t RICH\_MAGIC[] = {'R', 'i', 'c', 'h'} #### [` RICH_MAGIC_INT `]() static uint32\_t RICH\_MAGIC\_INT = 0x68636952 #### [` DANS_MAGIC_NUMBER `]() static uint32\_t DANS\_MAGIC\_NUMBER = 0x536E6144 Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [RichHeader]( "LIEF::PE::RichHeader") &rich\_header) --- ## [Rich Entry]() ### [` RichEntry `]() class RichEntry : public LIEF::Object Class which represents an entry associated to the [RichHeader](). Public Functions #### [` RichEntry `]() RichEntry() = default #### [` RichEntry `]() inline RichEntry(uint16\_t id, uint16\_t build\_id, uint32\_t count) #### [` RichEntry `]() RichEntry(const [RichEntry]( "LIEF::PE::RichEntry::RichEntry")&) = default #### [` operator= `]() [RichEntry]( "LIEF::PE::RichEntry") &operator=(const [RichEntry]( "LIEF::PE::RichEntry")&) = default #### [` ~RichEntry `]() ~RichEntry() override = default #### [` id `]() inline uint16\_t id() const Entry type. #### [` build_id `]() inline uint16\_t build\_id() const Build number of the tool (if any). #### [` count `]() inline uint32\_t count() const *Occurrence* count. #### [` id `]() inline void id(uint16\_t id) #### [` build_id `]() inline void build\_id(uint16\_t build\_id) #### [` count `]() inline void count(uint32\_t count) #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [RichEntry]( "LIEF::PE::RichEntry") &rich\_entry) --- ## [Code Integrity]() ### [` CodeIntegrity `]() class CodeIntegrity : public LIEF::Object Public Functions #### [` CodeIntegrity `]() CodeIntegrity() = default #### [` ~CodeIntegrity `]() ~CodeIntegrity() override = default #### [` operator= `]() [CodeIntegrity]( "LIEF::PE::CodeIntegrity") &operator=(const [CodeIntegrity]( "LIEF::PE::CodeIntegrity")&) = default #### [` CodeIntegrity `]() CodeIntegrity(const [CodeIntegrity]( "LIEF::PE::CodeIntegrity::CodeIntegrity")&) = default #### [` operator= `]() [CodeIntegrity]( "LIEF::PE::CodeIntegrity") &operator=([CodeIntegrity]( "LIEF::PE::CodeIntegrity")&&) = default #### [` CodeIntegrity `]() CodeIntegrity([CodeIntegrity]( "LIEF::PE::CodeIntegrity::CodeIntegrity")&&) = default #### [` flags `]() inline uint16\_t flags() const Flags to indicate if CI information is available, etc. #### [` catalog `]() inline uint16\_t catalog() const 0xFFFF means not available #### [` catalog_offset `]() inline uint32\_t catalog\_offset() const #### [` reserved `]() inline uint32\_t reserved() const Additional bitmask to be defined later. #### [` flags `]() inline [CodeIntegrity]( "LIEF::PE::CodeIntegrity") &flags(uint16\_t flags) #### [` catalog `]() inline [CodeIntegrity]( "LIEF::PE::CodeIntegrity") &catalog(uint16\_t catalog) #### [` catalog_offset `]() inline [CodeIntegrity]( "LIEF::PE::CodeIntegrity") &catalog\_offset(uint32\_t catalog\_offset) #### [` reserved `]() inline [CodeIntegrity]( "LIEF::PE::CodeIntegrity") &reserved(uint32\_t reserved) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` parse `]() static [result]( "LIEF::result")<[CodeIntegrity]( "LIEF::PE::CodeIntegrity")> parse([Parser]( "LIEF::PE::Parser") &ctx, [BinaryStream]( "LIEF::BinaryStream") &stream) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [CodeIntegrity]( "LIEF::PE::CodeIntegrity") &entry) --- ## [Pogo]() ### [` Pogo `]() class Pogo : public LIEF::PE::[Debug]( "LIEF::PE::Debug") This class represents a *Profile Guided Optimization* entry from the debug directory (`IMAGE_DEBUG_TYPE_POGO`). Public Types #### [` SIGNATURES `]() enum class SIGNATURES *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0x0fffffff ##### [` ZERO `]() enumerator ZERO = 0x00000000 ##### [` LCTG `]() enumerator LCTG = 0x4C544347 ##### [` PGI `]() enumerator PGI = 0x50474900 ##### [` PGO `]() enumerator PGO = 0x50474F00 ##### [` PGU `]() enumerator PGU = 0x50475500 ##### [` SPGO `]() enumerator SPGO = 0x5350474f #### [` entries_t `]() using entries\_t = std::vector<[PogoEntry]( "LIEF::PE::PogoEntry")> #### [` it_entries `]() using it\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[entries\_t]( "LIEF::PE::Pogo::entries_t")&> #### [` it_const_entries `]() using it\_const\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [entries\_t]( "LIEF::PE::Pogo::entries_t")&> Public Functions #### [` Pogo `]() inline Pogo() #### [` Pogo `]() inline Pogo([SIGNATURES]( "LIEF::PE::Pogo::SIGNATURES") sig) #### [` Pogo `]() inline Pogo(const details::pe\_debug &debug, [SIGNATURES]( "LIEF::PE::Pogo::SIGNATURES") sig, [Section]( "LIEF::PE::Section") \*sec) #### [` Pogo `]() Pogo(const [Pogo]( "LIEF::PE::Pogo::Pogo")&) = default #### [` operator= `]() [Pogo]( "LIEF::PE::Pogo") &operator=(const [Pogo]( "LIEF::PE::Pogo")&) = default #### [` Pogo `]() Pogo([Pogo]( "LIEF::PE::Pogo::Pogo")&&) = default #### [` operator= `]() [Pogo]( "LIEF::PE::Pogo") &operator=([Pogo]( "LIEF::PE::Pogo")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[Debug]( "LIEF::PE::Debug")> clone() const override #### [` signature `]() inline [SIGNATURES]( "LIEF::PE::Pogo::SIGNATURES") signature() const #### [` entries `]() inline [it\_entries]( "LIEF::PE::Pogo::it_entries") entries() An iterator over the different POGO elements. #### [` entries `]() inline [it\_const\_entries]( "LIEF::PE::Pogo::it_const_entries") entries() const #### [` add `]() inline void add([PogoEntry]( "LIEF::PE::PogoEntry") entry) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` to_string `]() virtual std::string to\_string() const override #### [` ~Pogo `]() ~Pogo() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Debug]( "LIEF::PE::Debug") \*debug) --- ## [Pogo Entry]() ### [` PogoEntry `]() class PogoEntry : public LIEF::Object Public Functions #### [` PogoEntry `]() PogoEntry() = default #### [` PogoEntry `]() PogoEntry([PogoEntry]( "LIEF::PE::PogoEntry::PogoEntry") &&other) = default #### [` operator= `]() [PogoEntry]( "LIEF::PE::PogoEntry") &operator=([PogoEntry]( "LIEF::PE::PogoEntry") &&other) = default #### [` PogoEntry `]() PogoEntry(const [PogoEntry]( "LIEF::PE::PogoEntry::PogoEntry")&) = default #### [` PogoEntry `]() inline PogoEntry(uint32\_t start\_rva, uint32\_t size, std::string name) #### [` PogoEntry `]() inline PogoEntry(uint32\_t start\_rva, uint32\_t size) #### [` operator= `]() [PogoEntry]( "LIEF::PE::PogoEntry") &operator=(const [PogoEntry]( "LIEF::PE::PogoEntry")&) = default #### [` ~PogoEntry `]() ~PogoEntry() override = default #### [` start_rva `]() inline uint32\_t start\_rva() const #### [` size `]() inline uint32\_t size() const #### [` name `]() inline std::string\_view name() const #### [` start_rva `]() inline void start\_rva(uint32\_t start\_rva) #### [` size `]() inline void size(uint32\_t size) #### [` name `]() inline void name(std::string name) #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [PogoEntry]( "LIEF::PE::PogoEntry") &entry) --- ## [Repro]() ### [` Repro `]() class Repro : public LIEF::PE::[Debug]( "LIEF::PE::Debug") This class represents a reproducible build entry from the debug directory. (`IMAGE_DEBUG_TYPE_REPRO`). This entry is usually generated with the undocumented `/Brepro` linker flag. See: [https://nikhilism.com/post/2020/windows-deterministic-builds/]() Public Functions #### [` Repro `]() inline Repro() #### [` Repro `]() inline Repro(std::vector<uint8\_t> hash) #### [` Repro `]() inline Repro(const details::pe\_debug &dbg, std::vector<uint8\_t> hash, [Section]( "LIEF::PE::Section") \*sec) #### [` Repro `]() inline Repro(const details::pe\_debug &dbg, [Section]( "LIEF::PE::Section") \*sec) #### [` Repro `]() Repro(const [Repro]( "LIEF::PE::Repro::Repro") &other) = default #### [` operator= `]() [Repro]( "LIEF::PE::Repro") &operator=(const [Repro]( "LIEF::PE::Repro") &other) = default #### [` Repro `]() Repro([Repro]( "LIEF::PE::Repro::Repro")&&) = default #### [` operator= `]() [Repro]( "LIEF::PE::Repro") &operator=([Repro]( "LIEF::PE::Repro") &&other) = default #### [` hash `]() inline span<const uint8\_t> hash() const The hash associated with the reproducible build. #### [` hash `]() inline span<uint8\_t> hash() #### [` hash `]() inline void hash(std::vector<uint8\_t> h) #### [` clone `]() inline virtual std::unique\_ptr<[Debug]( "LIEF::PE::Debug")> clone() const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` to_string `]() virtual std::string to\_string() const override #### [` ~Repro `]() ~Repro() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Debug]( "LIEF::PE::Debug") \*debug) --- ## [PDBChecksum]() ### [` PDBChecksum `]() class PDBChecksum : public LIEF::PE::[Debug]( "LIEF::PE::Debug") This class represents the PDB Checksum debug entry which is essentially an array of bytes representing the checksum of the PDB content. Public Types #### [` HASH_ALGO `]() enum class HASH\_ALGO : uint32\_t *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` SHA256 `]() enumerator SHA256 Public Functions #### [` PDBChecksum `]() inline PDBChecksum([HASH\_ALGO]( "LIEF::PE::PDBChecksum::HASH_ALGO") algo, std::vector<uint8\_t> hash) #### [` PDBChecksum `]() inline PDBChecksum(const details::pe\_debug &dbg, [Section]( "LIEF::PE::Section") \*sec, [HASH\_ALGO]( "LIEF::PE::PDBChecksum::HASH_ALGO") algo, std::vector<uint8\_t> hash) #### [` PDBChecksum `]() PDBChecksum(const [PDBChecksum]( "LIEF::PE::PDBChecksum::PDBChecksum") &other) = default #### [` operator= `]() [PDBChecksum]( "LIEF::PE::PDBChecksum") &operator=(const [PDBChecksum]( "LIEF::PE::PDBChecksum") &other) = default #### [` PDBChecksum `]() PDBChecksum([PDBChecksum]( "LIEF::PE::PDBChecksum::PDBChecksum")&&) = default #### [` operator= `]() [PDBChecksum]( "LIEF::PE::PDBChecksum") &operator=([PDBChecksum]( "LIEF::PE::PDBChecksum") &&other) = default #### [` clone `]() inline virtual std::unique\_ptr<[Debug]( "LIEF::PE::Debug")> clone() const override #### [` hash `]() inline span<const uint8\_t> hash() const Hash of the PDB content. #### [` hash `]() inline span<uint8\_t> hash() #### [` hash `]() inline void hash(std::vector<uint8\_t> h) #### [` algorithm `]() inline [HASH\_ALGO]( "LIEF::PE::PDBChecksum::HASH_ALGO") algorithm() const Algorithm used for hashing the PDB content. #### [` algorithm `]() inline void algorithm([HASH\_ALGO]( "LIEF::PE::PDBChecksum::HASH_ALGO") algo) #### [` ~PDBChecksum `]() ~PDBChecksum() override = default #### [` to_string `]() virtual std::string to\_string() const override Public Static Functions #### [` parse `]() static std::unique\_ptr<[PDBChecksum]( "LIEF::PE::PDBChecksum")> parse(const details::pe\_debug &hdr, [Section]( "LIEF::PE::Section") \*section, span<uint8\_t> payload) #### [` classof `]() static inline bool classof(const [Debug]( "LIEF::PE::Debug") \*debug) --- ## [VCFeature]() ### [` VCFeature `]() class VCFeature : public LIEF::PE::[Debug]( "LIEF::PE::Debug") This class represents the `IMAGE_DEBUG_TYPE_VC_FEATURE` debug entry. Public Functions #### [` VCFeature `]() inline VCFeature(const details::pe\_debug &debug, [Section]( "LIEF::PE::Section") \*sec, uint32\_t pre\_vc, uint32\_t c\_cpp, uint32\_t gs, uint32\_t sdl, uint32\_t guards) #### [` VCFeature `]() VCFeature(const [VCFeature]( "LIEF::PE::VCFeature::VCFeature") &other) = default #### [` operator= `]() [VCFeature]( "LIEF::PE::VCFeature") &operator=(const [VCFeature]( "LIEF::PE::VCFeature") &other) = default #### [` VCFeature `]() VCFeature([VCFeature]( "LIEF::PE::VCFeature::VCFeature")&&) = default #### [` operator= `]() [VCFeature]( "LIEF::PE::VCFeature") &operator=([VCFeature]( "LIEF::PE::VCFeature") &&other) = default #### [` clone `]() inline virtual std::unique\_ptr<[Debug]( "LIEF::PE::Debug")> clone() const override #### [` pre_vcpp `]() inline uint32\_t pre\_vcpp() const Count for `Pre-VC++ 11.00`. #### [` c_cpp `]() inline uint32\_t c\_cpp() const Count for `C/C++`. #### [` gs `]() inline uint32\_t gs() const Count for `/GS` (number of guard stack). #### [` sdl `]() inline uint32\_t sdl() const Whether `/sdl` was enabled for this binary. `sdl` stands for Security Development Lifecycle and provides enhanced security features like changing security-relevant warnings into errors or enforcing guard stack. #### [` guards `]() inline uint32\_t guards() const Count for `/guardN`. #### [` pre_vcpp `]() inline [VCFeature]( "LIEF::PE::VCFeature") &pre\_vcpp(uint32\_t value) #### [` c_cpp `]() inline [VCFeature]( "LIEF::PE::VCFeature") &c\_cpp(uint32\_t value) #### [` gs `]() inline [VCFeature]( "LIEF::PE::VCFeature") &gs(uint32\_t value) #### [` sdl `]() inline [VCFeature]( "LIEF::PE::VCFeature") &sdl(uint32\_t value) #### [` guards `]() inline [VCFeature]( "LIEF::PE::VCFeature") &guards(uint32\_t value) #### [` ~VCFeature `]() ~VCFeature() override = default #### [` to_string `]() virtual std::string to\_string() const override Public Static Functions #### [` parse `]() static std::unique\_ptr<[VCFeature]( "LIEF::PE::VCFeature")> parse(const details::pe\_debug &hdr, [Section]( "LIEF::PE::Section") \*section, span<uint8\_t> payload) #### [` classof `]() static inline bool classof(const [Debug]( "LIEF::PE::Debug") \*debug) --- ## [ExDllCharacteristics]() ### [` ExDllCharacteristics `]() class ExDllCharacteristics : public LIEF::PE::[Debug]( "LIEF::PE::Debug") This class represents the `IMAGE_DEBUG_TYPE_EX_DLLCHARACTERISTICS` debug entry. Public Types #### [` CHARACTERISTICS `]() enum class CHARACTERISTICS : uint32\_t Extended DLL Characteristics. *Values:* ##### [` CET_COMPAT `]() enumerator CET\_COMPAT = 0x01 ##### [` CET_COMPAT_STRICT_MODE `]() enumerator CET\_COMPAT\_STRICT\_MODE = 0x02 ##### [` CET_SET_CONTEXT_IP_VALIDATION_RELAXED_MODE `]() enumerator CET\_SET\_CONTEXT\_IP\_VALIDATION\_RELAXED\_MODE = 0x04 ##### [` CET_DYNAMIC_APIS_ALLOW_IN_PROC `]() enumerator CET\_DYNAMIC\_APIS\_ALLOW\_IN\_PROC = 0x08 ##### [` CET_RESERVED_1 `]() enumerator CET\_RESERVED\_1 = 0x10 ##### [` CET_RESERVED_2 `]() enumerator CET\_RESERVED\_2 = 0x20 ##### [` FORWARD_CFI_COMPAT `]() enumerator FORWARD\_CFI\_COMPAT = 0x40 ##### [` HOTPATCH_COMPATIBLE `]() enumerator HOTPATCH\_COMPATIBLE = 0x80 Public Functions #### [` ExDllCharacteristics `]() inline ExDllCharacteristics(const details::pe\_debug &debug, [Section]( "LIEF::PE::Section") \*sec, uint32\_t characteristics) #### [` ExDllCharacteristics `]() ExDllCharacteristics(const [ExDllCharacteristics]( "LIEF::PE::ExDllCharacteristics::ExDllCharacteristics") &other) = default #### [` operator= `]() [ExDllCharacteristics]( "LIEF::PE::ExDllCharacteristics") &operator=(const [ExDllCharacteristics]( "LIEF::PE::ExDllCharacteristics") &other) = default #### [` ExDllCharacteristics `]() ExDllCharacteristics([ExDllCharacteristics]( "LIEF::PE::ExDllCharacteristics::ExDllCharacteristics")&&) = default #### [` operator= `]() [ExDllCharacteristics]( "LIEF::PE::ExDllCharacteristics") &operator=([ExDllCharacteristics]( "LIEF::PE::ExDllCharacteristics") &&other) = default #### [` clone `]() inline virtual std::unique\_ptr<[Debug]( "LIEF::PE::Debug")> clone() const override #### [` characteristics `]() inline [CHARACTERISTICS]( "LIEF::PE::ExDllCharacteristics::CHARACTERISTICS") characteristics() const Return the characteristics. #### [` characteristics_list `]() std::vector<[CHARACTERISTICS]( "LIEF::PE::ExDllCharacteristics::CHARACTERISTICS")> characteristics\_list() const Characteristics as a vector. #### [` has `]() inline bool has([CHARACTERISTICS]( "LIEF::PE::ExDllCharacteristics::CHARACTERISTICS") c) const Check if the given [CHARACTERISTICS]() is used. #### [` ~ExDllCharacteristics `]() ~ExDllCharacteristics() override = default #### [` to_string `]() virtual std::string to\_string() const override Public Static Functions #### [` parse `]() static std::unique\_ptr<[ExDllCharacteristics]( "LIEF::PE::ExDllCharacteristics")> parse(const details::pe\_debug &hdr, [Section]( "LIEF::PE::Section") \*section, span<uint8\_t> payload) #### [` classof `]() static inline bool classof(const [Debug]( "LIEF::PE::Debug") \*debug) --- ## [Frame Pointer Omission (FPO)]() ### [` FPO `]() class FPO : public LIEF::PE::[Debug]( "LIEF::PE::Debug") This class represents the `IMAGE_DEBUG_TYPE_FPO` debug entry. Public Types #### [` FRAME_TYPE `]() enum class FRAME\_TYPE *Values:* ##### [` FPO `]() enumerator FPO = 0 ##### [` TRAP `]() enumerator TRAP = 1 ##### [` TSS `]() enumerator TSS = 2 ##### [` NON_FPO `]() enumerator NON\_FPO = 3 #### [` entries_t `]() using entries\_t = std::vector<[entry\_t]( "LIEF::PE::FPO::entry_t")> #### [` it_entries `]() using it\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[entries\_t]( "LIEF::PE::FPO::entries_t")&> #### [` it_const_entries `]() using it\_const\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [entries\_t]( "LIEF::PE::FPO::entries_t")&> Public Functions #### [` FPO `]() inline FPO(const details::pe\_debug &hdr, [Section]( "LIEF::PE::Section") \*section) #### [` FPO `]() FPO(const [FPO]( "LIEF::PE::FPO::FPO") &other) = default #### [` operator= `]() [FPO]( "LIEF::PE::FPO") &operator=(const [FPO]( "LIEF::PE::FPO") &other) = default #### [` FPO `]() FPO([FPO]( "LIEF::PE::FPO::FPO")&&) = default #### [` operator= `]() [FPO]( "LIEF::PE::FPO") &operator=([FPO]( "LIEF::PE::FPO") &&other) = default #### [` clone `]() inline virtual std::unique\_ptr<[Debug]( "LIEF::PE::Debug")> clone() const override #### [` entries `]() inline [it\_const\_entries]( "LIEF::PE::FPO::it_const_entries") entries() const Iterator over the [FPO]() entries. #### [` entries `]() inline [it\_entries]( "LIEF::PE::FPO::it_entries") entries() #### [` ~FPO `]() ~FPO() override = default #### [` to_string `]() virtual std::string to\_string() const override Public Static Functions #### [` parse `]() static std::unique\_ptr<[FPO]( "LIEF::PE::FPO")> parse(const details::pe\_debug &hdr, [Section]( "LIEF::PE::Section") \*section, span<uint8\_t> payload) #### [` classof `]() static inline bool classof(const [Debug]( "LIEF::PE::Debug") \*debug) #### [` entry_t `]() struct entry\_t Represents the stack frame layout for a x86 function when frame pointer omission ([FPO]()) optimization is used. Public Functions ##### [` to_string `]() std::string to\_string() const Public Members ##### [` rva `]() uint32\_t rva = 0 The function RVA. ##### [` proc_size `]() uint32\_t proc\_size = 0 The number of bytes in the function. ##### [` nb_locals `]() uint32\_t nb\_locals = 0 The number of local variables. ##### [` parameters_size `]() uint32\_t parameters\_size = 0 The size of the parameters. ##### [` prolog_size `]() uint16\_t prolog\_size = 0 The number of bytes in the function prologue code. ##### [` nb_saved_regs `]() uint16\_t nb\_saved\_regs = 0 Number of registers saved. ##### [` use_seh `]() bool use\_seh = false Whether the function uses structured exception handling. ##### [` use_bp `]() bool use\_bp = false Whether the EBP register has been allocated. ##### [` reserved `]() uint16\_t reserved = 0 Reserved for future use. ##### [` type `]() [FRAME\_TYPE]( "LIEF::PE::FPO::FRAME_TYPE") type = [FRAME\_TYPE]( "LIEF::PE::FPO::FRAME_TYPE")::[FPO]( "LIEF::PE::FPO::FRAME_TYPE::FPO") Variable that indicates the frame type. Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [entry\_t]( "LIEF::PE::FPO::entry_t") &entry) --- ## [Exception Info]() ### [` ExceptionInfo `]() class ExceptionInfo This class is the base class for any exception or runtime function entry. Subclassed by [LIEF::PE::RuntimeFunctionAArch64](), [LIEF::PE::RuntimeFunctionX64]() Public Types #### [` ARCH `]() enum class ARCH Arch discriminator for the subclasses. *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` ARM64 `]() enumerator ARM64 ##### [` X86_64 `]() enumerator X86\_64 Public Functions #### [` ExceptionInfo `]() ExceptionInfo() = delete #### [` ExceptionInfo `]() ExceptionInfo(const [ExceptionInfo]( "LIEF::PE::ExceptionInfo::ExceptionInfo")&) = default #### [` operator= `]() [ExceptionInfo]( "LIEF::PE::ExceptionInfo") &operator=(const [ExceptionInfo]( "LIEF::PE::ExceptionInfo")&) = default #### [` ExceptionInfo `]() ExceptionInfo([ExceptionInfo]( "LIEF::PE::ExceptionInfo::ExceptionInfo")&&) = default #### [` operator= `]() [ExceptionInfo]( "LIEF::PE::ExceptionInfo") &operator=([ExceptionInfo]( "LIEF::PE::ExceptionInfo")&&) = default #### [` clone `]() virtual std::unique\_ptr<[ExceptionInfo]( "LIEF::PE::ExceptionInfo")> clone() const = 0 #### [` ExceptionInfo `]() inline ExceptionInfo([ARCH]( "LIEF::PE::ExceptionInfo::ARCH") arch, uint64\_t rva) #### [` ExceptionInfo `]() inline ExceptionInfo([ARCH]( "LIEF::PE::ExceptionInfo::ARCH") arch) #### [` arch `]() inline [ARCH]( "LIEF::PE::ExceptionInfo::ARCH") arch() const Target architecture of this exception. #### [` rva_start `]() inline uint32\_t rva\_start() const [Function]() start address. #### [` offset `]() inline uint64\_t offset() const Offset in the binary where the raw exception information associated with this entry is defined. #### [` to_string `]() virtual std::string to\_string() const = 0 #### [` ~ExceptionInfo `]() virtual ~ExceptionInfo() = default #### [` Tas `]() template<class T> inline [T]( "LIEF::PE::ExceptionInfo::as::T") \*as() Helper to **downcast** an [ExceptionInfo]() into a concrete implementation. #### [` Tas `]() template<class T> inline const [T]( "LIEF::PE::ExceptionInfo::as::T") \*as() const Public Static Functions #### [` parse `]() static std::unique\_ptr<[ExceptionInfo]( "LIEF::PE::ExceptionInfo")> parse([Parser]( "LIEF::PE::Parser") &ctx, [BinaryStream]( "LIEF::BinaryStream") &strm) #### [` parse `]() static std::unique\_ptr<[ExceptionInfo]( "LIEF::PE::ExceptionInfo")> parse([Parser]( "LIEF::PE::Parser") &ctx, [BinaryStream]( "LIEF::BinaryStream") &strm, [Header]( "LIEF::PE::Header")::[MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") arch) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [ExceptionInfo]( "LIEF::PE::ExceptionInfo") &info) --- ## [RuntimeFunctionX64]() ### [` RuntimeFunctionX64 `]() class RuntimeFunctionX64 : public LIEF::PE::[ExceptionInfo]( "LIEF::PE::ExceptionInfo") This class represents an entry in the exception table (`.pdata` section) for the x86-64 architecture. Reference: [https://learn.microsoft.com/en-us/cpp/build/exception-handling-x64]() Public Types #### [` UNWIND_FLAGS `]() enum class UNWIND\_FLAGS : uint8\_t *Values:* ##### [` EXCEPTION_HANDLER `]() enumerator EXCEPTION\_HANDLER = 1 The function has an exception handler that should be called when looking for functions that need to examine exceptions. ##### [` TERMINATE_HANDLER `]() enumerator TERMINATE\_HANDLER = 2 The function has a termination handler that should be called when unwinding an exception. ##### [` CHAIN_INFO `]() enumerator CHAIN\_INFO = 4 The chained info payload references a previous `RUNTIME_FUNCTION`. #### [` UNWIND_OPCODES `]() enum class UNWIND\_OPCODES : uint32\_t *Values:* ##### [` PUSH_NONVOL `]() enumerator PUSH\_NONVOL = 0 Push a nonvolatile integer register, decrementing RSP by 8. The operation info is the number of the register. Because of the constraints on epilogs, `PUSH_NONVOL` unwind codes must appear first in the prolog and correspondingly, last in the unwind code array. This relative ordering applies to all other unwind codes except [UNWIND\_OPCODES::PUSH\_MACHFRAME](). ##### [` ALLOC_LARGE `]() enumerator ALLOC\_LARGE = 1 Allocate a large-sized area on the stack. There are two forms. If the operation info equals 0, then the size of the allocation divided by 8 is recorded in the next slot, allowing an allocation up to 512K - 8. If the operation info equals 1, then the unscaled size of the allocation is recorded in the next two slots in little-endian format, allowing allocations up to 4GB - 8. ##### [` ALLOC_SMALL `]() enumerator ALLOC\_SMALL = 2 Allocate a small-sized area on the stack. The size of the allocation is the operation info field \* 8 + 8, allowing allocations from 8 to 128 bytes. ##### [` SET_FPREG `]() enumerator SET\_FPREG = 3 Establish the frame pointer register by setting the register to some offset of the current RSP. The offset is equal to the Frame Register offset (scaled) field in the UNWIND\_INFO \* 16, allowing offsets from 0 to 240. The use of an offset permits establishing a frame pointer that points to the middle of the fixed stack allocation, helping code density by allowing more accesses to use short instruction forms. The operation info field is reserved and shouldn’t be used. ##### [` SAVE_NONVOL `]() enumerator SAVE\_NONVOL = 4 Save a nonvolatile integer register on the stack using a MOV instead of a PUSH. This code is primarily used for shrink-wrapping, where a nonvolatile register is saved to the stack in a position that was previously allocated. The operation info is the number of the register. The scaled-by-8 stack offset is recorded in the next unwind operation code slot, as described in the note above. ##### [` SAVE_NONVOL_FAR `]() enumerator SAVE\_NONVOL\_FAR = 5 Save a nonvolatile integer register on the stack with a long offset, using a MOV instead of a PUSH. This code is primarily used for shrink-wrapping, where a nonvolatile register is saved to the stack in a position that was previously allocated. The operation info is the number of the register. The unscaled stack offset is recorded in the next two unwind operation code slots, as described in the note above. ##### [` EPILOG `]() enumerator EPILOG = 6 This entry is only relevant for version 2. It describes the function epilog. ##### [` SPARE `]() enumerator SPARE = 7 Reserved Originally SAVE\_XMM128\_FAR in version 1, but deprecated and removed. ##### [` SAVE_XMM128 `]() enumerator SAVE\_XMM128 = 8 Save all 128 bits of a nonvolatile XMM register on the stack. The operation info is the number of the register. The scaled-by-16 stack offset is recorded in the next slot. ##### [` SAVE_XMM128_FAR `]() enumerator SAVE\_XMM128\_FAR = 9 Save all 128 bits of a nonvolatile XMM register on the stack with a long offset. The operation info is the number of the register. The unscaled stack offset is recorded in the next two slots. ##### [` PUSH_MACHFRAME `]() enumerator PUSH\_MACHFRAME = 10 Push a machine frame. This unwind code is used to record the effect of a hardware interrupt or exception. #### [` UNWIND_REG `]() enum class UNWIND\_REG : uint32\_t *Values:* ##### [` RAX `]() enumerator RAX = 0 ##### [` RCX `]() enumerator RCX ##### [` RDX `]() enumerator RDX ##### [` RBX `]() enumerator RBX ##### [` RSP `]() enumerator RSP ##### [` RBP `]() enumerator RBP ##### [` RSI `]() enumerator RSI ##### [` RDI `]() enumerator RDI ##### [` R8 `]() enumerator R8 ##### [` R9 `]() enumerator R9 ##### [` R10 `]() enumerator R10 ##### [` R11 `]() enumerator R11 ##### [` R12 `]() enumerator R12 ##### [` R13 `]() enumerator R13 ##### [` R14 `]() enumerator R14 ##### [` R15 `]() enumerator R15 Public Functions #### [` RuntimeFunctionX64 `]() inline RuntimeFunctionX64(uint32\_t rva\_start, uint32\_t rva\_end, uint32\_t unwind\_rva) #### [` RuntimeFunctionX64 `]() RuntimeFunctionX64(const [RuntimeFunctionX64]( "LIEF::PE::RuntimeFunctionX64::RuntimeFunctionX64")&) = default #### [` operator= `]() [RuntimeFunctionX64]( "LIEF::PE::RuntimeFunctionX64") &operator=(const [RuntimeFunctionX64]( "LIEF::PE::RuntimeFunctionX64")&) = default #### [` RuntimeFunctionX64 `]() RuntimeFunctionX64([RuntimeFunctionX64]( "LIEF::PE::RuntimeFunctionX64::RuntimeFunctionX64")&&) = default #### [` operator= `]() [RuntimeFunctionX64]( "LIEF::PE::RuntimeFunctionX64") &operator=([RuntimeFunctionX64]( "LIEF::PE::RuntimeFunctionX64")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[ExceptionInfo]( "LIEF::PE::ExceptionInfo")> clone() const override #### [` to_string `]() virtual std::string to\_string() const override #### [` rva_end `]() inline uint32\_t rva\_end() const [Function]() end address. #### [` unwind_rva `]() inline uint32\_t unwind\_rva() const Unwind info address. #### [` size `]() inline uint32\_t size() const Size of the function (in bytes). #### [` unwind_info `]() inline const [unwind\_info\_t]( "LIEF::PE::RuntimeFunctionX64::unwind_info_t") \*unwind\_info() const Detailed unwind information. #### [` unwind_info `]() inline [unwind\_info\_t]( "LIEF::PE::RuntimeFunctionX64::unwind_info_t") \*unwind\_info() #### [` unwind_info `]() inline void unwind\_info([unwind\_info\_t]( "LIEF::PE::RuntimeFunctionX64::unwind_info_t") info) #### [` ~RuntimeFunctionX64 `]() ~RuntimeFunctionX64() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [ExceptionInfo]( "LIEF::PE::ExceptionInfo") \*info) #### [` unwind_info_t `]() struct unwind\_info\_t This structure represents the `UNWIND_INFO` which records the effects a function has on the stack pointer, and where the nonvolatile registers are saved on the stack. Public Types ##### [` opcodes_t `]() using opcodes\_t = std::vector<std::unique\_ptr<unwind\_x64::[Code]( "LIEF::PE::unwind_x64::Code")>> Public Functions ##### [` has `]() inline bool has([UNWIND\_FLAGS]( "LIEF::PE::RuntimeFunctionX64::UNWIND_FLAGS") flag) const Check if the given flag is used. ##### [` opcodes `]() [opcodes\_t]( "LIEF::PE::RuntimeFunctionX64::unwind_info_t::opcodes_t") opcodes() const Enhanced representation of the unwind code. ##### [` to_string `]() std::string to\_string() const Pretty representation of this structure as a string. Public Members ##### [` version `]() uint8\_t version = 0 Version number of the unwind data, currently 1 or 2. ##### [` flags `]() uint8\_t flags = 0 See: [UNWIND\_FLAGS](). ##### [` sizeof_prologue `]() uint8\_t sizeof\_prologue = 0 Length of the function prolog in bytes. ##### [` count_opcodes `]() uint8\_t count\_opcodes = 0 The number of slots in the unwind codes array. Some unwind codes, for example, [UNWIND\_OPCODES::SAVE\_NONVOL](), require more than one slot in the array. ##### [` frame_reg `]() uint8\_t frame\_reg = 0 If nonzero, then the function uses a frame pointer (FP), and this field is the number of the nonvolatile register used as the frame pointer, using the same encoding for the operation info field of [UNWIND\_OPCODES]() nodes. ##### [` frame_reg_offset `]() uint8\_t frame\_reg\_offset = 0 If the frame register field is nonzero, this field is the scaled offset from RSP that is applied to the FP register when it’s established. ##### [` raw_opcodes `]() std::vector<uint8\_t> raw\_opcodes An array of items that explains the effect of the prolog on the nonvolatile registers and RSP. ##### [` handler `]() std::optional<uint32\_t> handler An image-relative pointer to either the function’s language-specific exception or termination handler. This value is set if one of these flags is set: [UNWIND\_FLAGS::EXCEPTION\_HANDLER](), [UNWIND\_FLAGS::TERMINATE\_HANDLER](). ##### [` chained `]() [RuntimeFunctionX64]( "LIEF::PE::RuntimeFunctionX64") \*chained = nullptr If [UNWIND\_FLAGS::CHAIN\_INFO]() is set, this attributes references the chained runtime function. Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [unwind\_info\_t]( "LIEF::PE::RuntimeFunctionX64::unwind_info_t") &info) --- ## [unwind\_x64 - Code]() ### [` Code `]() class Code Base class for all unwind operations. Subclassed by [LIEF::PE::unwind\_x64::Alloc](), [LIEF::PE::unwind\_x64::Epilog](), [LIEF::PE::unwind\_x64::PushMachFrame](), [LIEF::PE::unwind\_x64::PushNonVol](), [LIEF::PE::unwind\_x64::SaveNonVolatile](), [LIEF::PE::unwind\_x64::SaveXMM128](), [LIEF::PE::unwind\_x64::SetFPReg](), [LIEF::PE::unwind\_x64::Spare]() Public Types #### [` OPCODE `]() using OPCODE = [RuntimeFunctionX64]( "LIEF::PE::RuntimeFunctionX64")::[UNWIND\_OPCODES]( "LIEF::PE::RuntimeFunctionX64::UNWIND_OPCODES") #### [` REG `]() using REG = [RuntimeFunctionX64]( "LIEF::PE::RuntimeFunctionX64")::[UNWIND\_REG]( "LIEF::PE::RuntimeFunctionX64::UNWIND_REG") Public Functions #### [` Code `]() Code() = delete #### [` Code `]() Code(const [Code]( "LIEF::PE::unwind_x64::Code::Code")&) = default #### [` operator= `]() [Code]( "LIEF::PE::unwind_x64::Code") &operator=(const [Code]( "LIEF::PE::unwind_x64::Code")&) = default #### [` Code `]() Code([Code]( "LIEF::PE::unwind_x64::Code::Code")&&) = default #### [` operator= `]() [Code]( "LIEF::PE::unwind_x64::Code") &operator=([Code]( "LIEF::PE::unwind_x64::Code")&&) = default #### [` ~Code `]() virtual ~Code() = default #### [` Code `]() inline Code([OPCODE]( "LIEF::PE::unwind_x64::Code::OPCODE") opcode, uint32\_t pos) #### [` Code `]() inline Code([OPCODE]( "LIEF::PE::unwind_x64::Code::OPCODE") opcode) #### [` opcode `]() inline [OPCODE]( "LIEF::PE::unwind_x64::Code::OPCODE") opcode() const The original opcode. #### [` position `]() inline uint32\_t position() const Offset in the prolog. #### [` to_string `]() virtual std::string to\_string() const Pretty representation. Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Code]( "LIEF::PE::unwind_x64::Code") &code) --- ## [unwind\_x64 - Alloc]() ### [` Alloc `]() class Alloc : public LIEF::PE::unwind\_x64::[Code]( "LIEF::PE::unwind_x64::Code") This class represents a stack-allocation operation (UNWIND\_OPCODES::ALLOC\_SMALL or UNWIND\_OPCODES::ALLOC\_LARGE). Public Functions #### [` Alloc `]() inline Alloc(OPCODE op, size\_t pos, uint32\_t size) #### [` size `]() inline uint32\_t size() const The size allocated. #### [` to_string `]() virtual std::string to\_string() const override Pretty representation. #### [` ~Alloc `]() ~Alloc() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Code]( "LIEF::PE::unwind_x64::Code") \*code) --- ## [unwind\_x64 - PushNonVol]() ### [` PushNonVol `]() class PushNonVol : public LIEF::PE::unwind\_x64::[Code]( "LIEF::PE::unwind_x64::Code") Push a nonvolatile integer register, decrementing RSP by 8. Public Functions #### [` PushNonVol `]() PushNonVol() = delete #### [` PushNonVol `]() inline PushNonVol(REG reg, size\_t pos) #### [` to_string `]() virtual std::string to\_string() const override Pretty representation. #### [` reg `]() inline REG reg() const The register pushed. #### [` ~PushNonVol `]() ~PushNonVol() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Code]( "LIEF::PE::unwind_x64::Code") \*code) --- ## [unwind\_x64 - PushMachFrame]() ### [` PushMachFrame `]() class PushMachFrame : public LIEF::PE::unwind\_x64::[Code]( "LIEF::PE::unwind_x64::Code") Push a machine frame. Public Functions #### [` PushMachFrame `]() PushMachFrame() = delete #### [` PushMachFrame `]() inline PushMachFrame(uint8\_t value, size\_t pos) #### [` value `]() inline uint8\_t value() const 0 or 1 #### [` to_string `]() virtual std::string to\_string() const override Pretty representation. #### [` ~PushMachFrame `]() ~PushMachFrame() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Code]( "LIEF::PE::unwind_x64::Code") \*code) --- ## [unwind\_x64 - SetFPReg]() ### [` SetFPReg `]() class SetFPReg : public LIEF::PE::unwind\_x64::[Code]( "LIEF::PE::unwind_x64::Code") Establish the frame pointer register by setting the register to some offset of the current RSP. Public Functions #### [` SetFPReg `]() SetFPReg() = delete #### [` SetFPReg `]() inline SetFPReg(REG value, size\_t pos) #### [` reg `]() inline REG reg() const Frame pointer register. #### [` to_string `]() virtual std::string to\_string() const override Pretty representation. #### [` ~SetFPReg `]() ~SetFPReg() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Code]( "LIEF::PE::unwind_x64::Code") \*code) --- ## [unwind\_x64 - SaveNonVolatile]() ### [` SaveNonVolatile `]() class SaveNonVolatile : public LIEF::PE::unwind\_x64::[Code]( "LIEF::PE::unwind_x64::Code") Save a nonvolatile integer register on the stack using a `MOV` instead of a `PUSH`. Public Functions #### [` SaveNonVolatile `]() SaveNonVolatile() = delete #### [` SaveNonVolatile `]() inline SaveNonVolatile(OPCODE op, REG value, size\_t pos, uint32\_t offset) #### [` reg `]() inline REG reg() const #### [` offset `]() inline uint32\_t offset() const #### [` to_string `]() virtual std::string to\_string() const override Pretty representation. #### [` ~SaveNonVolatile `]() ~SaveNonVolatile() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Code]( "LIEF::PE::unwind_x64::Code") \*code) --- ## [unwind\_x64 - SaveXMM128]() ### [` SaveXMM128 `]() class SaveXMM128 : public LIEF::PE::unwind\_x64::[Code]( "LIEF::PE::unwind_x64::Code") Public Functions #### [` SaveXMM128 `]() SaveXMM128() = delete #### [` SaveXMM128 `]() inline SaveXMM128(OPCODE op, uint8\_t num, size\_t pos, uint32\_t offset) #### [` num `]() inline uint8\_t num() const #### [` offset `]() inline uint32\_t offset() const #### [` to_string `]() virtual std::string to\_string() const override Pretty representation. #### [` ~SaveXMM128 `]() ~SaveXMM128() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Code]( "LIEF::PE::unwind_x64::Code") \*code) --- ## [unwind\_x64 - Epilog]() ### [` Epilog `]() class Epilog : public LIEF::PE::unwind\_x64::[Code]( "LIEF::PE::unwind_x64::Code") Describes the function’s epilog. Public Functions #### [` Epilog `]() Epilog() = delete #### [` Epilog `]() inline Epilog(uint8\_t flags, uint8\_t size) #### [` flags `]() inline uint8\_t flags() const #### [` size `]() inline uint32\_t size() const Size of the epilog. #### [` to_string `]() virtual std::string to\_string() const override Pretty representation. #### [` ~Epilog `]() ~Epilog() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Code]( "LIEF::PE::unwind_x64::Code") \*code) --- ## [unwind\_x64 - Spare]() ### [` Spare `]() class Spare : public LIEF::PE::unwind\_x64::[Code]( "LIEF::PE::unwind_x64::Code") Public Functions #### [` Spare `]() inline Spare() #### [` to_string `]() inline virtual std::string to\_string() const override Pretty representation. #### [` ~Spare `]() ~Spare() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Code]( "LIEF::PE::unwind_x64::Code") \*code) --- ## [RuntimeFunctionAArch64]() ### [` RuntimeFunctionAArch64 `]() class RuntimeFunctionAArch64 : public LIEF::PE::[ExceptionInfo]( "LIEF::PE::ExceptionInfo") This class represents an entry in the exception table (`.pdata` section) for the AArch64 architecture. Since the ARM64 unwinding info can be encoded in a *packed* and *unpacked* format, this class is inherited by [LIEF::PE::unwind\_aarch64::PackedFunction]() and [LIEF::PE::unwind\_aarch64::UnpackedFunction]() Reference: [https://learn.microsoft.com/en-us/cpp/build/arm64-exception-handling#arm64-exception-handling-information]() Subclassed by [LIEF::PE::unwind\_aarch64::PackedFunction](), [LIEF::PE::unwind\_aarch64::UnpackedFunction]() Public Types #### [` PACKED_FLAGS `]() enum class PACKED\_FLAGS *Values:* ##### [` UNPACKED `]() enumerator UNPACKED = 0 ##### [` PACKED `]() enumerator PACKED = 1 ##### [` PACKED_FRAGMENT `]() enumerator PACKED\_FRAGMENT = 2 ##### [` RESERVED `]() enumerator RESERVED = 3 Public Functions #### [` RuntimeFunctionAArch64 `]() inline RuntimeFunctionAArch64(uint64\_t RVA, uint32\_t length, [PACKED\_FLAGS]( "LIEF::PE::RuntimeFunctionAArch64::PACKED_FLAGS") flag) #### [` RuntimeFunctionAArch64 `]() RuntimeFunctionAArch64(const [RuntimeFunctionAArch64]( "LIEF::PE::RuntimeFunctionAArch64::RuntimeFunctionAArch64")&) = default #### [` operator= `]() [RuntimeFunctionAArch64]( "LIEF::PE::RuntimeFunctionAArch64") &operator=(const [RuntimeFunctionAArch64]( "LIEF::PE::RuntimeFunctionAArch64")&) = default #### [` RuntimeFunctionAArch64 `]() RuntimeFunctionAArch64([RuntimeFunctionAArch64]( "LIEF::PE::RuntimeFunctionAArch64::RuntimeFunctionAArch64")&&) = default #### [` operator= `]() [RuntimeFunctionAArch64]( "LIEF::PE::RuntimeFunctionAArch64") &operator=([RuntimeFunctionAArch64]( "LIEF::PE::RuntimeFunctionAArch64")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[ExceptionInfo]( "LIEF::PE::ExceptionInfo")> clone() const override #### [` length `]() inline uint32\_t length() const Length of the function in bytes. #### [` flag `]() inline [PACKED\_FLAGS]( "LIEF::PE::RuntimeFunctionAArch64::PACKED_FLAGS") flag() const Flag describing the format the unwind data. #### [` rva_end `]() inline uint32\_t rva\_end() const [Function]() end address. #### [` to_string `]() virtual std::string to\_string() const override #### [` ~RuntimeFunctionAArch64 `]() ~RuntimeFunctionAArch64() override = default Public Static Functions #### [` parse `]() static std::unique\_ptr<[RuntimeFunctionAArch64]( "LIEF::PE::RuntimeFunctionAArch64")> parse([Parser]( "LIEF::PE::Parser") &ctx, [BinaryStream]( "LIEF::BinaryStream") &strm) #### [` classof `]() static inline bool classof(const [ExceptionInfo]( "LIEF::PE::ExceptionInfo") \*info) ## [Runtime AArch64 (Packed) Function]() ### [` PackedFunction `]() class PackedFunction : public LIEF::PE::[RuntimeFunctionAArch64]( "LIEF::PE::RuntimeFunctionAArch64") This class represents a packed AArch64 exception entry. An excepted entry can be packed if the unwind data fit in 30 bits Reference: [https://learn.microsoft.com/en-us/cpp/build/arm64-exception-handling?view=msvc-170#packed-unwind-data]() Public Functions #### [` PackedFunction `]() PackedFunction(const [PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction::PackedFunction")&) = default #### [` operator= `]() [PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction") &operator=(const [PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction")&) = default #### [` PackedFunction `]() PackedFunction([PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction::PackedFunction")&&) = default #### [` operator= `]() [PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction") &operator=([PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction")&&) = default #### [` ~PackedFunction `]() ~PackedFunction() override = default #### [` clone `]() inline virtual std::unique\_ptr<[ExceptionInfo]( "LIEF::PE::ExceptionInfo")> clone() const override #### [` to_string `]() virtual std::string to\_string() const override #### [` frame_size `]() inline uint8\_t frame\_size() const Size of the allocated stack. #### [` reg_I `]() inline uint8\_t reg\_I() const Number of non-volatile INT registers (x19-x28) saved in the canonical stack location. #### [` reg_F `]() inline uint8\_t reg\_F() const Number of non-volatile FP registers (d8-d15) saved in the canonical stack location. #### [` H `]() inline uint8\_t H() const 1-bit flag indicating whether the function homes the integer parameter registers (x0-x7) by storing them at the very start of the function. (0 = doesn’t home registers, 1 = homes registers). #### [` CR `]() inline uint8\_t CR() const Flag indicating whether the function includes extra instructions to set up a frame chain and return link. #### [` frame_size `]() inline [PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction") &frame\_size(uint8\_t value) #### [` reg_I `]() inline [PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction") &reg\_I(uint8\_t value) #### [` reg_F `]() inline [PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction") &reg\_F(uint8\_t value) #### [` H `]() inline [PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction") &H(uint8\_t value) #### [` CR `]() inline [PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction") &CR(uint8\_t value) #### [` RuntimeFunctionAArch64 `]() inline RuntimeFunctionAArch64(uint64\_t RVA, uint32\_t length, PACKED\_FLAGS flag) #### [` RuntimeFunctionAArch64 `]() RuntimeFunctionAArch64(const [RuntimeFunctionAArch64]( "LIEF::PE::unwind_aarch64::PackedFunction::RuntimeFunctionAArch64")&) = default #### [` RuntimeFunctionAArch64 `]() RuntimeFunctionAArch64([RuntimeFunctionAArch64]( "LIEF::PE::unwind_aarch64::PackedFunction::RuntimeFunctionAArch64")&&) = default Public Static Functions #### [` parse `]() static std::unique\_ptr<[PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction")> parse([Parser]( "LIEF::PE::Parser") &ctx, [BinaryStream]( "LIEF::BinaryStream") &strm, uint32\_t rva, uint32\_t unwind\_data) #### [` classof `]() static inline bool classof(const [ExceptionInfo]( "LIEF::PE::ExceptionInfo") \*info) ## [Runtime AArch64 (UnpackedFunction) Function]() ### [` UnpackedFunction `]() class UnpackedFunction : public LIEF::PE::[RuntimeFunctionAArch64]( "LIEF::PE::RuntimeFunctionAArch64") This class represents an unpacked AArch64 exception entry. Reference: [https://learn.microsoft.com/en-us/cpp/build/arm64-exception-handling?view=msvc-170#xdata-records]() Public Types #### [` epilog_scopes_t `]() using epilog\_scopes\_t = std::vector<[epilog\_scope\_t]( "LIEF::PE::unwind_aarch64::UnpackedFunction::epilog_scope_t")> #### [` it_epilog_scopes `]() using it\_epilog\_scopes = [ref\_iterator]( "LIEF::ref_iterator")<[epilog\_scopes\_t]( "LIEF::PE::unwind_aarch64::UnpackedFunction::epilog_scopes_t")&> #### [` it_const_epilog_scopes `]() using it\_const\_epilog\_scopes = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [epilog\_scopes\_t]( "LIEF::PE::unwind_aarch64::UnpackedFunction::epilog_scopes_t")&> Public Functions #### [` UnpackedFunction `]() inline UnpackedFunction(uint32\_t rva, uint32\_t length) #### [` UnpackedFunction `]() UnpackedFunction(const [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction::UnpackedFunction")&) = default #### [` operator= `]() [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &operator=(const [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction")&) = default #### [` UnpackedFunction `]() UnpackedFunction([UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction::UnpackedFunction")&&) = default #### [` operator= `]() [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &operator=([UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction")&&) = default #### [` ~UnpackedFunction `]() ~UnpackedFunction() override = default #### [` clone `]() inline virtual std::unique\_ptr<[ExceptionInfo]( "LIEF::PE::ExceptionInfo")> clone() const override #### [` to_string `]() virtual std::string to\_string() const override #### [` xdata_rva `]() inline uint32\_t xdata\_rva() const RVA where this unpacked data is located (usually pointing in `.xdata`). #### [` version `]() inline uint32\_t version() const Describes the version of the remaining `.xdata`. Currently (2025-01-04), only version 0 is defined, so values of 1-3 aren’t permitted. #### [` X `]() inline uint8\_t X() const 1-bit field that indicates the presence (1) or absence (0) of exception data. #### [` E `]() inline uint8\_t E() const 1-bit field that indicates that information describing a single epilog is packed into the header (1) rather than requiring more scope words later (0). #### [` epilog_count `]() inline uint16\_t epilog\_count() const **If [E()]() == 0**, specifies the count of the total number of epilog scopes. Otherwise, return 0 #### [` epilog_offset `]() inline uint16\_t epilog\_offset() const **If [E()]() == 1**, index of the first unwind code that describes the one and only epilog. #### [` code_words `]() inline uint32\_t code\_words() const Number of 32-bit words needed to contain all the unwind codes. #### [` exception_handler `]() inline uint32\_t exception\_handler() const Exception handler RVA (if any). #### [` unwind_code `]() inline span<const uint8\_t> unwind\_code() const Bytes that contain the unwind codes. #### [` unwind_code `]() inline span<uint8\_t> unwind\_code() #### [` is_extended `]() inline bool is\_extended() const Whether it uses 2-words encoding. #### [` epilog_scopes_offset `]() inline uint64\_t epilog\_scopes\_offset() const #### [` unwind_code_offset `]() inline uint64\_t unwind\_code\_offset() const #### [` exception_handler_offset `]() inline uint64\_t exception\_handler\_offset() const #### [` epilog_scopes `]() inline [it\_epilog\_scopes]( "LIEF::PE::unwind_aarch64::UnpackedFunction::it_epilog_scopes") epilog\_scopes() Iterator over the epilog scopes. #### [` epilog_scopes `]() inline [it\_const\_epilog\_scopes]( "LIEF::PE::unwind_aarch64::UnpackedFunction::it_const_epilog_scopes") epilog\_scopes() const #### [` xdata_rva `]() inline [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &xdata\_rva(uint32\_t value) #### [` version `]() inline [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &version(uint32\_t value) #### [` X `]() inline [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &X(uint8\_t value) #### [` E `]() inline [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &E(uint8\_t value) #### [` epilog_cnt_offset `]() inline [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &epilog\_cnt\_offset(uint16\_t value) #### [` code_words `]() inline [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &code\_words(uint32\_t value) #### [` exception_handler `]() inline [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &exception\_handler(uint32\_t value) #### [` epilog_scopes `]() inline [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &epilog\_scopes([epilog\_scopes\_t]( "LIEF::PE::unwind_aarch64::UnpackedFunction::epilog_scopes_t") scopes) #### [` unwind_code `]() inline [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &unwind\_code(std::vector<uint8\_t> code) #### [` is_extended `]() inline [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &is\_extended(bool value) Public Static Functions #### [` parse `]() static std::unique\_ptr<[UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction")> parse([Parser]( "LIEF::PE::Parser") &ctx, [BinaryStream]( "LIEF::BinaryStream") &strm, uint32\_t xdata\_rva, uint32\_t rva) #### [` classof `]() static inline bool classof(const [ExceptionInfo]( "LIEF::PE::ExceptionInfo") \*info) #### [` epilog_scope_t `]() struct epilog\_scope\_t This structure describes an epilog scope. Public Members ##### [` start_offset `]() uint32\_t start\_offset = 0 Offset of the epilog relatives to the start of the function. ##### [` start_index `]() uint16\_t start\_index = 0 Byte index of the first unwind code that describes this epilog. ##### [` reserved `]() uint8\_t reserved = 0 Reserved for future expansion. Should be 0. Public Static Functions ##### [` from_raw `]() static [epilog\_scope\_t]( "LIEF::PE::unwind_aarch64::UnpackedFunction::epilog_scope_t") from\_raw(uint32\_t raw) --- ## [Load Configuration]() ### [` LoadConfiguration `]() class LoadConfiguration : public LIEF::Object This class represents the load configuration data associated with the `IMAGE_LOAD_CONFIG_DIRECTORY`. This structure is frequently updated by Microsoft to add new metadata. Reference: [https://github.com/MicrosoftDocs/sdk-api/blob/cbeab4d371e8bc7e352c4d3a4c5819caa08c6a1c/sdk-api-src/content/winnt/ns-winnt-image\_load\_config\_directory64.md#L2]() Public Types #### [` IMAGE_GUARD `]() enum class IMAGE\_GUARD : uint32\_t *Values:* ##### [` NONE `]() enumerator NONE = 0x00000000 ##### [` CF_INSTRUMENTED `]() enumerator CF\_INSTRUMENTED = 0x100 Module performs control flow integrity checks using system-supplied support. ##### [` CFW_INSTRUMENTED `]() enumerator CFW\_INSTRUMENTED = 0x200 Module performs control flow and write integrity checks. ##### [` CF_FUNCTION_TABLE_PRESENT `]() enumerator CF\_FUNCTION\_TABLE\_PRESENT = 0x400 Module contains valid control flow target metadata. ##### [` SECURITY_COOKIE_UNUSED `]() enumerator SECURITY\_COOKIE\_UNUSED = 0x800 Module does not make use of the /GS security cookie. ##### [` PROTECT_DELAYLOAD_IAT `]() enumerator PROTECT\_DELAYLOAD\_IAT = 0x1000 Module supports read only delay load IAT. ##### [` DELAYLOAD_IAT_IN_ITS_OWN_SECTION `]() enumerator DELAYLOAD\_IAT\_IN\_ITS\_OWN\_SECTION = 0x2000 Delayload import table in its own .didat section (with nothing else in it) that can be freely reprotected. ##### [` CF_EXPORT_SUPPRESSION_INFO_PRESENT `]() enumerator CF\_EXPORT\_SUPPRESSION\_INFO\_PRESENT = 0x4000 Module contains suppressed export information. This also infers that the address taken IAT table is also present in the load config. ##### [` CF_ENABLE_EXPORT_SUPPRESSION `]() enumerator CF\_ENABLE\_EXPORT\_SUPPRESSION = 0x8000 Module enables suppression of exports. ##### [` CF_LONGJUMP_TABLE_PRESENT `]() enumerator CF\_LONGJUMP\_TABLE\_PRESENT = 0x10000 Module contains longjmp target information. ##### [` RF_INSTRUMENTED `]() enumerator RF\_INSTRUMENTED = 0x00020000 Module contains return flow instrumentation and metadata. ##### [` RF_ENABLE `]() enumerator RF\_ENABLE = 0x00040000 Module requests that the OS enable return flow protection. ##### [` RF_STRICT `]() enumerator RF\_STRICT = 0x00080000 Module requests that the OS enable return flow protection in strict mode. ##### [` RETPOLINE_PRESENT `]() enumerator RETPOLINE\_PRESENT = 0x00100000 Module was built with retpoline support. ##### [` EH_CONTINUATION_TABLE_PRESENT `]() enumerator EH\_CONTINUATION\_TABLE\_PRESENT = 0x400000 Module contains EH continuation target information. ##### [` XFG_ENABLED `]() enumerator XFG\_ENABLED = 0x00800000 Module was built with xfg (deprecated). ##### [` CASTGUARD_PRESENT `]() enumerator CASTGUARD\_PRESENT = 0x01000000 Module has CastGuard instrumentation present. ##### [` MEMCPY_PRESENT `]() enumerator MEMCPY\_PRESENT = 0x02000000 Module has Guarded Memcpy instrumentation present. #### [` guard_functions_t `]() using guard\_functions\_t = std::vector<[guard\_function\_t]( "LIEF::PE::LoadConfiguration::guard_function_t")> #### [` it_guard_functions `]() using it\_guard\_functions = [ref\_iterator]( "LIEF::ref_iterator")<[guard\_functions\_t]( "LIEF::PE::LoadConfiguration::guard_functions_t")&> #### [` it_const_guard_functions `]() using it\_const\_guard\_functions = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [guard\_functions\_t]( "LIEF::PE::LoadConfiguration::guard_functions_t")&> #### [` dynamic_relocations_t `]() using dynamic\_relocations\_t = std::vector<std::unique\_ptr<[DynamicRelocation]( "LIEF::PE::DynamicRelocation")>> #### [` it_dynamic_relocations_t `]() using it\_dynamic\_relocations\_t = [ref\_iterator]( "LIEF::ref_iterator")<[dynamic\_relocations\_t]( "LIEF::PE::LoadConfiguration::dynamic_relocations_t")&, [DynamicRelocation]( "LIEF::PE::DynamicRelocation")\*> #### [` it_const_dynamic_relocations_t `]() using it\_const\_dynamic\_relocations\_t = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [dynamic\_relocations\_t]( "LIEF::PE::LoadConfiguration::dynamic_relocations_t")&, const [DynamicRelocation]( "LIEF::PE::DynamicRelocation")\*> Public Functions #### [` LoadConfiguration `]() LoadConfiguration() #### [` operator= `]() [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &operator=(const [LoadConfiguration]( "LIEF::PE::LoadConfiguration")&) #### [` LoadConfiguration `]() LoadConfiguration(const [LoadConfiguration]( "LIEF::PE::LoadConfiguration::LoadConfiguration")&) #### [` LoadConfiguration `]() LoadConfiguration([LoadConfiguration]( "LIEF::PE::LoadConfiguration::LoadConfiguration")&&) #### [` operator= `]() [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &operator=([LoadConfiguration]( "LIEF::PE::LoadConfiguration")&&) #### [` characteristics `]() inline uint32\_t characteristics() const Characteristics of the structure which is defined by its size. #### [` size `]() inline uint32\_t size() const Size of the current structure. #### [` timedatestamp `]() inline uint32\_t timedatestamp() const The date and time stamp value. #### [` major_version `]() inline uint16\_t major\_version() const Major version. #### [` minor_version `]() inline uint16\_t minor\_version() const Minor version. #### [` global_flags_clear `]() inline uint32\_t global\_flags\_clear() const The global flags that control system behavior. For more information, see `Gflags.exe`. #### [` global_flags_set `]() inline uint32\_t global\_flags\_set() const The global flags that control system behavior. For more information, see `Gflags.exe`. #### [` critical_section_default_timeout `]() inline uint32\_t critical\_section\_default\_timeout() const The critical section default time-out value. #### [` decommit_free_block_threshold `]() inline uint64\_t decommit\_free\_block\_threshold() const The size of the minimum block that must be freed before it is freed (de-committed), in bytes. This value is advisory. #### [` decommit_total_free_threshold `]() inline uint64\_t decommit\_total\_free\_threshold() const The size of the minimum total memory that must be freed in the process heap before it is freed (de-committed), in bytes. This value is advisory. #### [` lock_prefix_table `]() inline uint64\_t lock\_prefix\_table() const The VA of a list of addresses where the `LOCK` prefix is used. These will be replaced by `NOP` on single-processor systems. This member is available only for x86. #### [` maximum_allocation_size `]() inline uint64\_t maximum\_allocation\_size() const The maximum allocation size, in bytes. This member is obsolete and is used only for debugging purposes. #### [` virtual_memory_threshold `]() inline uint64\_t virtual\_memory\_threshold() const The maximum block size that can be allocated from heap segments, in bytes. #### [` process_affinity_mask `]() inline uint64\_t process\_affinity\_mask() const The process affinity mask. For more information, see `GetProcessAffinityMask`. This member is available only for `.exe` files. #### [` process_heap_flags `]() inline uint32\_t process\_heap\_flags() const The process heap flags. For more information, see `HeapCreate`. #### [` csd_version `]() inline uint16\_t csd\_version() const The service pack version. #### [` reserved1 `]() inline uint16\_t reserved1() const See: [dependent\_load\_flags()](). #### [` dependent_load_flags `]() inline uint16\_t dependent\_load\_flags() const Alias for [reserved1()](). The default load flags used when the operating system resolves the statically linked imports of a module. For more information, see `LoadLibraryEx`. #### [` editlist `]() inline uint64\_t editlist() const Reserved for use by the system. #### [` security_cookie `]() inline uint64\_t security\_cookie() const A pointer to a cookie that is used by Visual C++ or GS implementation. #### [` se_handler_table `]() inline std::optional<uint64\_t> se\_handler\_table() const The VA of the sorted table of RVAs of each valid, unique handler in the image. This member is available only for x86. #### [` se_handler_count `]() inline std::optional<uint64\_t> se\_handler\_count() const The count of unique handlers in the table. This member is available only for x86. #### [` seh_functions `]() inline const std::vector<uint32\_t> &seh\_functions() const Return the list of the function RVA in the SEH table (if any). #### [` guard_cf_check_function_pointer `]() inline std::optional<uint64\_t> guard\_cf\_check\_function\_pointer() const The VA where Control Flow Guard check-function pointer is stored. #### [` guard_cf_dispatch_function_pointer `]() inline std::optional<uint64\_t> guard\_cf\_dispatch\_function\_pointer() const The VA where Control Flow Guard dispatch-function pointer is stored. #### [` guard_cf_function_table `]() inline std::optional<uint64\_t> guard\_cf\_function\_table() const The VA of the sorted table of RVAs of each Control Flow Guard function in the image. #### [` guard_cf_function_count `]() inline std::optional<uint64\_t> guard\_cf\_function\_count() const The count of unique RVAs in the [guard\_cf\_function\_table()]() table. #### [` guard_cf_functions `]() inline [it\_const\_guard\_functions]( "LIEF::PE::LoadConfiguration::it_const_guard_functions") guard\_cf\_functions() const Iterator over the Control Flow Guard functions referenced by [guard\_cf\_function\_table()](). #### [` guard_cf_functions `]() inline [it\_guard\_functions]( "LIEF::PE::LoadConfiguration::it_guard_functions") guard\_cf\_functions() #### [` guard_flags `]() inline std::optional<uint32\_t> guard\_flags() const Control Flow Guard related flags. #### [` has `]() inline bool has([IMAGE\_GUARD]( "LIEF::PE::LoadConfiguration::IMAGE_GUARD") flag) const Check if the given flag is present. #### [` guard_cf_flags_list `]() std::vector<[IMAGE\_GUARD]( "LIEF::PE::LoadConfiguration::IMAGE_GUARD")> guard\_cf\_flags\_list() const List of flags. #### [` code_integrity `]() inline const [CodeIntegrity]( "LIEF::PE::CodeIntegrity") \*code\_integrity() const Code integrity information. #### [` code_integrity `]() inline [CodeIntegrity]( "LIEF::PE::CodeIntegrity") \*code\_integrity() #### [` guard_address_taken_iat_entry_table `]() inline std::optional<uint64\_t> guard\_address\_taken\_iat\_entry\_table() const The VA where Control Flow Guard address taken IAT table is stored. #### [` guard_address_taken_iat_entry_count `]() inline std::optional<uint64\_t> guard\_address\_taken\_iat\_entry\_count() const The count of unique RVAs in the table pointed by [guard\_address\_taken\_iat\_entry\_table()](). #### [` guard_address_taken_iat_entries `]() inline [it\_const\_guard\_functions]( "LIEF::PE::LoadConfiguration::it_const_guard_functions") guard\_address\_taken\_iat\_entries() const List of RVA pointed by [guard\_address\_taken\_iat\_entry\_table()](). #### [` guard_address_taken_iat_entries `]() inline [it\_guard\_functions]( "LIEF::PE::LoadConfiguration::it_guard_functions") guard\_address\_taken\_iat\_entries() #### [` guard_long_jump_target_table `]() inline std::optional<uint64\_t> guard\_long\_jump\_target\_table() const The VA where Control Flow Guard long jump target table is stored. #### [` guard_long_jump_target_count `]() inline std::optional<uint64\_t> guard\_long\_jump\_target\_count() const The count of unique RVAs in the table pointed by guard\_long\_jump\_target\_table. #### [` guard_long_jump_targets `]() inline [it\_const\_guard\_functions]( "LIEF::PE::LoadConfiguration::it_const_guard_functions") guard\_long\_jump\_targets() const List of RVA pointed by [guard\_address\_taken\_iat\_entry\_table()](). #### [` guard_long_jump_targets `]() inline [it\_guard\_functions]( "LIEF::PE::LoadConfiguration::it_guard_functions") guard\_long\_jump\_targets() #### [` dynamic_value_reloc_table `]() inline std::optional<uint64\_t> dynamic\_value\_reloc\_table() const VA pointing to a `IMAGE_DYNAMIC_RELOCATION_TABLE`. #### [` dynamic_relocations `]() inline [it\_dynamic\_relocations\_t]( "LIEF::PE::LoadConfiguration::it_dynamic_relocations_t") dynamic\_relocations() Return an iterator over the Dynamic relocations (DVRT). #### [` dynamic_relocations `]() inline [it\_const\_dynamic\_relocations\_t]( "LIEF::PE::LoadConfiguration::it_const_dynamic_relocations_t") dynamic\_relocations() const #### [` hybrid_metadata_pointer `]() inline std::optional<uint64\_t> hybrid\_metadata\_pointer() const Alias for [chpe\_metadata\_pointer()](). #### [` chpe_metadata_pointer `]() inline std::optional<uint64\_t> chpe\_metadata\_pointer() const VA to the extra Compiled Hybrid Portable Executable (CHPE) metadata. #### [` chpe_metadata `]() inline const [CHPEMetadata]( "LIEF::PE::CHPEMetadata") \*chpe\_metadata() const Compiled Hybrid Portable Executable (CHPE) metadata (if any). #### [` chpe_metadata `]() inline [CHPEMetadata]( "LIEF::PE::CHPEMetadata") \*chpe\_metadata() #### [` guard_rf_failure_routine `]() inline std::optional<uint64\_t> guard\_rf\_failure\_routine() const VA of the failure routine. #### [` guard_rf_failure_routine_function_pointer `]() inline std::optional<uint64\_t> guard\_rf\_failure\_routine\_function\_pointer() const VA of the failure routine `fptr`. #### [` dynamic_value_reloctable_offset `]() inline std::optional<uint32\_t> dynamic\_value\_reloctable\_offset() const Offset of dynamic relocation table relative to the relocation table. #### [` dynamic_value_reloctable_section `]() inline std::optional<uint16\_t> dynamic\_value\_reloctable\_section() const The section index of the dynamic value relocation table. #### [` reserved2 `]() inline std::optional<uint16\_t> reserved2() const Must be zero. #### [` guard_rf_verify_stackpointer_function_pointer `]() inline std::optional<uint64\_t> guard\_rf\_verify\_stackpointer\_function\_pointer() const VA of the [Function]() verifying the stack pointer. #### [` hotpatch_table_offset `]() inline std::optional<uint32\_t> hotpatch\_table\_offset() const Offset to the *hotpatch* table. #### [` reserved3 `]() inline std::optional<uint32\_t> reserved3() const #### [` enclave_configuration_ptr `]() inline std::optional<uint64\_t> enclave\_configuration\_ptr() const #### [` enclave_config `]() inline const [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") \*enclave\_config() const #### [` enclave_config `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") \*enclave\_config() #### [` volatile_metadata_pointer `]() inline std::optional<uint64\_t> volatile\_metadata\_pointer() const #### [` volatile_metadata `]() inline const [VolatileMetadata]( "LIEF::PE::VolatileMetadata") \*volatile\_metadata() const #### [` volatile_metadata `]() inline [VolatileMetadata]( "LIEF::PE::VolatileMetadata") \*volatile\_metadata() #### [` guard_eh_continuation_table `]() inline std::optional<uint64\_t> guard\_eh\_continuation\_table() const #### [` guard_eh_continuation_count `]() inline std::optional<uint64\_t> guard\_eh\_continuation\_count() const #### [` guard_eh_continuation_functions `]() inline [it\_const\_guard\_functions]( "LIEF::PE::LoadConfiguration::it_const_guard_functions") guard\_eh\_continuation\_functions() const #### [` guard_eh_continuation_functions `]() inline [it\_guard\_functions]( "LIEF::PE::LoadConfiguration::it_guard_functions") guard\_eh\_continuation\_functions() #### [` guard_xfg_check_function_pointer `]() inline std::optional<uint64\_t> guard\_xfg\_check\_function\_pointer() const #### [` guard_xfg_dispatch_function_pointer `]() inline std::optional<uint64\_t> guard\_xfg\_dispatch\_function\_pointer() const #### [` guard_xfg_table_dispatch_function_pointer `]() inline std::optional<uint64\_t> guard\_xfg\_table\_dispatch\_function\_pointer() const #### [` cast_guard_os_determined_failure_mode `]() inline std::optional<uint64\_t> cast\_guard\_os\_determined\_failure\_mode() const #### [` guard_memcpy_function_pointer `]() inline std::optional<uint64\_t> guard\_memcpy\_function\_pointer() const #### [` uma_function_pointers `]() inline std::optional<uint64\_t> uma\_function\_pointers() const #### [` characteristics `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &characteristics(uint32\_t characteristics) #### [` size `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &size(uint32\_t value) #### [` timedatestamp `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &timedatestamp(uint32\_t timedatestamp) #### [` major_version `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &major\_version(uint16\_t major\_version) #### [` minor_version `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &minor\_version(uint16\_t minor\_version) #### [` global_flags_clear `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &global\_flags\_clear(uint32\_t global\_flags\_clear) #### [` global_flags_set `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &global\_flags\_set(uint32\_t global\_flags\_set) #### [` critical_section_default_timeout `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &critical\_section\_default\_timeout(uint32\_t critical\_section\_default\_timeout) #### [` decommit_free_block_threshold `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &decommit\_free\_block\_threshold(uint64\_t decommit\_free\_block\_threshold) #### [` decommit_total_free_threshold `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &decommit\_total\_free\_threshold(uint64\_t decommit\_total\_free\_threshold) #### [` lock_prefix_table `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &lock\_prefix\_table(uint64\_t lock\_prefix\_table) #### [` maximum_allocation_size `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &maximum\_allocation\_size(uint64\_t maximum\_allocation\_size) #### [` virtual_memory_threshold `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &virtual\_memory\_threshold(uint64\_t virtual\_memory\_threshold) #### [` process_affinity_mask `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &process\_affinity\_mask(uint64\_t process\_affinity\_mask) #### [` process_heap_flags `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &process\_heap\_flags(uint32\_t process\_heap\_flagsid) #### [` csd_version `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &csd\_version(uint16\_t csd\_version) #### [` reserved1 `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &reserved1(uint16\_t reserved1) #### [` dependent_load_flags `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &dependent\_load\_flags(uint16\_t flags) #### [` editlist `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &editlist(uint64\_t editlist) #### [` security_cookie `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &security\_cookie(uint64\_t security\_cookie) #### [` se_handler_table `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &se\_handler\_table(uint64\_t se\_handler\_table) #### [` se_handler_count `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &se\_handler\_count(uint64\_t se\_handler\_count) #### [` guard_cf_check_function_pointer `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_cf\_check\_function\_pointer(uint64\_t check\_pointer) #### [` guard_cf_dispatch_function_pointer `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_cf\_dispatch\_function\_pointer(uint64\_t dispatch\_pointer) #### [` guard_cf_function_table `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_cf\_function\_table(uint64\_t guard\_cf\_function\_table) #### [` guard_cf_function_count `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_cf\_function\_count(uint64\_t guard\_cf\_function\_count) #### [` guard_flags `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_flags([IMAGE\_GUARD]( "LIEF::PE::LoadConfiguration::IMAGE_GUARD") flags) #### [` guard_flags `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_flags(uint32\_t flags) #### [` code_integrity `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &code\_integrity([CodeIntegrity]( "LIEF::PE::CodeIntegrity") CI) #### [` guard_address_taken_iat_entry_table `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_address\_taken\_iat\_entry\_table(uint64\_t value) #### [` guard_address_taken_iat_entry_count `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_address\_taken\_iat\_entry\_count(uint64\_t value) #### [` guard_long_jump_target_table `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_long\_jump\_target\_table(uint64\_t value) #### [` guard_long_jump_target_count `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_long\_jump\_target\_count(uint64\_t value) #### [` dynamic_value_reloc_table `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &dynamic\_value\_reloc\_table(uint64\_t value) #### [` hybrid_metadata_pointer `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &hybrid\_metadata\_pointer(uint64\_t value) #### [` guard_rf_failure_routine `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_rf\_failure\_routine(uint64\_t value) #### [` guard_rf_failure_routine_function_pointer `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_rf\_failure\_routine\_function\_pointer(uint64\_t value) #### [` dynamic_value_reloctable_offset `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &dynamic\_value\_reloctable\_offset(uint32\_t value) #### [` dynamic_value_reloctable_section `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &dynamic\_value\_reloctable\_section(uint16\_t value) #### [` reserved2 `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &reserved2(uint16\_t value) #### [` guard_rf_verify_stackpointer_function_pointer `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_rf\_verify\_stackpointer\_function\_pointer(uint64\_t value) #### [` hotpatch_table_offset `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &hotpatch\_table\_offset(uint32\_t value) #### [` reserved3 `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &reserved3(uint32\_t value) #### [` enclave_configuration_ptr `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &enclave\_configuration\_ptr(uint64\_t value) #### [` volatile_metadata_pointer `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &volatile\_metadata\_pointer(uint64\_t value) #### [` guard_eh_continuation_table `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_eh\_continuation\_table(uint64\_t value) #### [` guard_eh_continuation_count `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_eh\_continuation\_count(uint64\_t value) #### [` guard_xfg_check_function_pointer `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_xfg\_check\_function\_pointer(uint64\_t value) #### [` guard_xfg_dispatch_function_pointer `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_xfg\_dispatch\_function\_pointer(uint64\_t value) #### [` guard_xfg_table_dispatch_function_pointer `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_xfg\_table\_dispatch\_function\_pointer(uint64\_t value) #### [` cast_guard_os_determined_failure_mode `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &cast\_guard\_os\_determined\_failure\_mode(uint64\_t value) #### [` guard_memcpy_function_pointer `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_memcpy\_function\_pointer(uint64\_t value) #### [` uma_function_pointers `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &uma\_function\_pointers(uint64\_t value) #### [` ~LoadConfiguration `]() ~LoadConfiguration() override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` to_string `]() std::string to\_string() const Public Static Functions #### [` PE_Tparse `]() template<class PE\_T> static std::unique\_ptr<[LoadConfiguration]( "LIEF::PE::LoadConfiguration")> parse([Parser]( "LIEF::PE::Parser") &ctx, [BinaryStream]( "LIEF::BinaryStream") &stream) Friends **friend class Parser** #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &config) #### [` guard_function_t `]() struct guard\_function\_t Public Members ##### [` rva `]() uint32\_t rva = 0 ##### [` extra `]() uint32\_t extra = 0 --- ## [CHPEMetadata]() ### [` CHPEMetadata `]() class CHPEMetadata Base class for any Compiled Hybrid Portable Executable (CHPE) metadata. This class is inherited by architecture-specific implementation. Subclassed by [LIEF::PE::CHPEMetadataARM64](), [LIEF::PE::CHPEMetadataX86]() Public Types #### [` KIND `]() enum class KIND Discriminator for the subclasses. *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` ARM64 `]() enumerator ARM64 ##### [` X86 `]() enumerator X86 Public Functions #### [` CHPEMetadata `]() CHPEMetadata() = default #### [` CHPEMetadata `]() inline CHPEMetadata([KIND]( "LIEF::PE::CHPEMetadata::KIND") kind, uint32\_t version) #### [` CHPEMetadata `]() CHPEMetadata(const [CHPEMetadata]( "LIEF::PE::CHPEMetadata::CHPEMetadata")&) = default #### [` operator= `]() [CHPEMetadata]( "LIEF::PE::CHPEMetadata") &operator=(const [CHPEMetadata]( "LIEF::PE::CHPEMetadata")&) = default #### [` CHPEMetadata `]() CHPEMetadata([CHPEMetadata]( "LIEF::PE::CHPEMetadata::CHPEMetadata")&&) = default #### [` operator= `]() [CHPEMetadata]( "LIEF::PE::CHPEMetadata") &operator=([CHPEMetadata]( "LIEF::PE::CHPEMetadata")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[CHPEMetadata]( "LIEF::PE::CHPEMetadata")> clone() const #### [` kind `]() inline [KIND]( "LIEF::PE::CHPEMetadata::KIND") kind() const Determine the type of the concrete implementation. #### [` version `]() inline uint32\_t version() const Version of the structure. #### [` to_string `]() inline virtual std::string to\_string() const #### [` Tas `]() template<class T> inline [T]( "LIEF::PE::CHPEMetadata::as::T") \*as() #### [` Tas `]() template<class T> inline const [T]( "LIEF::PE::CHPEMetadata::as::T") \*as() const #### [` ~CHPEMetadata `]() virtual ~CHPEMetadata() = default Public Static Functions #### [` parse `]() static std::unique\_ptr<[CHPEMetadata]( "LIEF::PE::CHPEMetadata")> parse([Parser]( "LIEF::PE::Parser") &ctx, [BinaryStream]( "LIEF::BinaryStream") &stream) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [CHPEMetadata]( "LIEF::PE::CHPEMetadata") &meta) ## [CHPEMetadata (ARM64)]() ### [` CHPEMetadataARM64 `]() class CHPEMetadataARM64 : public LIEF::PE::[CHPEMetadata]( "LIEF::PE::CHPEMetadata") This class represents ARM64-specific metadata used in CHPE (Compatible Hybrid PE) binaries, particularly for hybrid architectures like ARM64EC and ARM64X. It extends the [CHPEMetadata]() base class and provides access to metadata describing code ranges, redirections, entry points, and other hybrid-specific information relevant for binary analysis or instrumentation. Public Types #### [` range_entries_t `]() using range\_entries\_t = std::vector<[range\_entry\_t]( "LIEF::PE::CHPEMetadataARM64::range_entry_t")> #### [` it_range_entries `]() using it\_range\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[range\_entries\_t]( "LIEF::PE::CHPEMetadataARM64::range_entries_t")&> #### [` it_const_range_entries `]() using it\_const\_range\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [range\_entries\_t]( "LIEF::PE::CHPEMetadataARM64::range_entries_t")&> #### [` redirection_entries_t `]() using redirection\_entries\_t = std::vector<[redirection\_entry\_t]( "LIEF::PE::CHPEMetadataARM64::redirection_entry_t")> #### [` it_redirection_entries `]() using it\_redirection\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[redirection\_entries\_t]( "LIEF::PE::CHPEMetadataARM64::redirection_entries_t")&> #### [` it_const_redirection_entries `]() using it\_const\_redirection\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [redirection\_entries\_t]( "LIEF::PE::CHPEMetadataARM64::redirection_entries_t")&> #### [` code_range_entry_point_entries `]() using code\_range\_entry\_point\_entries = std::vector<[code\_range\_entry\_point\_t]( "LIEF::PE::CHPEMetadataARM64::code_range_entry_point_t")> #### [` it_code_range_entry_point `]() using it\_code\_range\_entry\_point = [ref\_iterator]( "LIEF::ref_iterator")<[code\_range\_entry\_point\_entries]( "LIEF::PE::CHPEMetadataARM64::code_range_entry_point_entries")&> #### [` it_const_code_range_entry_point `]() using it\_const\_code\_range\_entry\_point = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [code\_range\_entry\_point\_entries]( "LIEF::PE::CHPEMetadataARM64::code_range_entry_point_entries")&> Public Functions #### [` CHPEMetadataARM64 `]() inline CHPEMetadataARM64(uint32\_t version) #### [` CHPEMetadataARM64 `]() CHPEMetadataARM64(const [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64::CHPEMetadataARM64")&) = default #### [` operator= `]() [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &operator=(const [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64")&) = default #### [` CHPEMetadataARM64 `]() CHPEMetadataARM64([CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64::CHPEMetadataARM64")&&) = default #### [` operator= `]() [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &operator=([CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[CHPEMetadata]( "LIEF::PE::CHPEMetadata")> clone() const override #### [` code_map `]() inline uint32\_t code\_map() const RVA to the array that describes architecture-specific ranges. #### [` code_map_count `]() inline uint32\_t code\_map\_count() const Number of entries in the code map. #### [` code_ranges_to_entrypoints `]() inline uint32\_t code\_ranges\_to\_entrypoints() const #### [` redirection_metadata `]() inline uint32\_t redirection\_metadata() const #### [` os_arm64x_dispatch_call_no_redirect `]() inline uint32\_t os\_arm64x\_dispatch\_call\_no\_redirect() const #### [` os_arm64x_dispatch_ret `]() inline uint32\_t os\_arm64x\_dispatch\_ret() const #### [` os_arm64x_dispatch_call `]() inline uint32\_t os\_arm64x\_dispatch\_call() const #### [` os_arm64x_dispatch_icall `]() inline uint32\_t os\_arm64x\_dispatch\_icall() const #### [` os_arm64x_dispatch_icall_cfg `]() inline uint32\_t os\_arm64x\_dispatch\_icall\_cfg() const #### [` alternate_entry_point `]() inline uint32\_t alternate\_entry\_point() const #### [` auxiliary_iat `]() inline uint32\_t auxiliary\_iat() const #### [` code_ranges_to_entry_points_count `]() inline uint32\_t code\_ranges\_to\_entry\_points\_count() const #### [` redirection_metadata_count `]() inline uint32\_t redirection\_metadata\_count() const #### [` get_x64_information_function_pointer `]() inline uint32\_t get\_x64\_information\_function\_pointer() const #### [` set_x64_information_function_pointer `]() inline uint32\_t set\_x64\_information\_function\_pointer() const #### [` extra_rfe_table `]() inline uint32\_t extra\_rfe\_table() const RVA to this architecture-specific exception table. #### [` extra_rfe_table_size `]() inline uint32\_t extra\_rfe\_table\_size() const architecture-specific exception table size #### [` os_arm64x_dispatch_fptr `]() inline uint32\_t os\_arm64x\_dispatch\_fptr() const #### [` auxiliary_iat_copy `]() inline uint32\_t auxiliary\_iat\_copy() const #### [` auxiliary_delay_import `]() inline uint32\_t auxiliary\_delay\_import() const #### [` auxiliary_delay_import_copy `]() inline uint32\_t auxiliary\_delay\_import\_copy() const #### [` bitfield_info `]() inline uint32\_t bitfield\_info() const #### [` code_ranges `]() inline [it\_range\_entries]( "LIEF::PE::CHPEMetadataARM64::it_range_entries") code\_ranges() #### [` code_ranges `]() inline [it\_const\_range\_entries]( "LIEF::PE::CHPEMetadataARM64::it_const_range_entries") code\_ranges() const #### [` redirections `]() inline [it\_redirection\_entries]( "LIEF::PE::CHPEMetadataARM64::it_redirection_entries") redirections() #### [` redirections `]() inline [it\_const\_redirection\_entries]( "LIEF::PE::CHPEMetadataARM64::it_const_redirection_entries") redirections() const #### [` code_range_entry_point `]() inline [it\_code\_range\_entry\_point]( "LIEF::PE::CHPEMetadataARM64::it_code_range_entry_point") code\_range\_entry\_point() #### [` code_range_entry_point `]() inline [it\_const\_code\_range\_entry\_point]( "LIEF::PE::CHPEMetadataARM64::it_const_code_range_entry_point") code\_range\_entry\_point() const #### [` code_map `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &code\_map(uint32\_t value) #### [` code_map_count `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &code\_map\_count(uint32\_t value) #### [` code_ranges_to_entrypoints `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &code\_ranges\_to\_entrypoints(uint32\_t value) #### [` redirection_metadata `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &redirection\_metadata(uint32\_t value) #### [` os_arm64x_dispatch_call_no_redirect `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &os\_arm64x\_dispatch\_call\_no\_redirect(uint32\_t value) #### [` os_arm64x_dispatch_ret `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &os\_arm64x\_dispatch\_ret(uint32\_t value) #### [` os_arm64x_dispatch_call `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &os\_arm64x\_dispatch\_call(uint32\_t value) #### [` os_arm64x_dispatch_icall `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &os\_arm64x\_dispatch\_icall(uint32\_t value) #### [` os_arm64x_dispatch_icall_cfg `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &os\_arm64x\_dispatch\_icall\_cfg(uint32\_t value) #### [` alternate_entry_point `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &alternate\_entry\_point(uint32\_t value) #### [` auxiliary_iat `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &auxiliary\_iat(uint32\_t value) #### [` code_ranges_to_entry_points_count `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &code\_ranges\_to\_entry\_points\_count(uint32\_t value) #### [` redirection_metadata_count `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &redirection\_metadata\_count(uint32\_t value) #### [` get_x64_information_function_pointer `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &get\_x64\_information\_function\_pointer(uint32\_t value) #### [` set_x64_information_function_pointer `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &set\_x64\_information\_function\_pointer(uint32\_t value) #### [` extra_rfe_table `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &extra\_rfe\_table(uint32\_t value) #### [` extra_rfe_table_size `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &extra\_rfe\_table\_size(uint32\_t value) #### [` os_arm64x_dispatch_fptr `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &os\_arm64x\_dispatch\_fptr(uint32\_t value) #### [` auxiliary_iat_copy `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &auxiliary\_iat\_copy(uint32\_t value) #### [` auxiliary_delay_import `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &auxiliary\_delay\_import(uint32\_t value) #### [` auxiliary_delay_import_copy `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &auxiliary\_delay\_import\_copy(uint32\_t value) #### [` bitfield_info `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &bitfield\_info(uint32\_t value) #### [` to_string `]() virtual std::string to\_string() const override #### [` ~CHPEMetadataARM64 `]() ~CHPEMetadataARM64() override = default Public Static Functions #### [` parse `]() static std::unique\_ptr<[CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64")> parse([Parser]( "LIEF::PE::Parser") &ctx, [BinaryStream]( "LIEF::BinaryStream") &stream, uint32\_t version) #### [` parse_code_map `]() static [ok\_error\_t]( "LIEF::ok_error_t") parse\_code\_map([Parser]( "LIEF::PE::Parser") &ctx, [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &metadata) #### [` parse_redirections `]() static [ok\_error\_t]( "LIEF::ok_error_t") parse\_redirections([Parser]( "LIEF::PE::Parser") &ctx, [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &metadata) #### [` parse_code_ranges_to_entry_points `]() static [ok\_error\_t]( "LIEF::ok_error_t") parse\_code\_ranges\_to\_entry\_points([Parser]( "LIEF::PE::Parser") &ctx, [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &metadata) #### [` classof `]() static inline bool classof(const [CHPEMetadata]( "LIEF::PE::CHPEMetadata") \*meta) #### [` range_entry_t `]() struct range\_entry\_t Structure that describes architecture-specific ranges. Public Types ##### [` TYPE `]() enum class TYPE *Values:* ###### [` ARM64 `]() enumerator ARM64 = 0 Pure ARM64 code. ###### [` ARM64EC `]() enumerator ARM64EC = 1 ARM64EC hybrid code (compatible with x64). ###### [` AMD64 `]() enumerator AMD64 = 2 x64 code. Public Functions ##### [` start `]() inline uint32\_t start() const Start of the range (RVA). ##### [` type `]() inline [TYPE]( "LIEF::PE::CHPEMetadataARM64::range_entry_t::TYPE") type() const Architecture for this range. ##### [` end `]() inline uint32\_t end() const End of the range (RVA). Public Members ##### [` start_offset `]() uint32\_t start\_offset = 0 Raw data (include start RVA and type). ##### [` length `]() uint32\_t length = 0 Range’s length. Public Static Attributes ##### [` TYPE_MASK `]() static uint32\_t TYPE\_MASK = 3 #### [` redirection_entry_t `]() struct redirection\_entry\_t Structure that describes a redirection. Public Members ##### [` src `]() uint32\_t src = 0 ##### [` dst `]() uint32\_t dst = 0 #### [` code_range_entry_point_t `]() struct code\_range\_entry\_point\_t Mirror of `IMAGE_ARM64EC_CODE_RANGE_ENTRY_POINT`: Represents a mapping between code range and its entry point. Public Members ##### [` start_rva `]() uint32\_t start\_rva = 0 Start of the code range. ##### [` end_rva `]() uint32\_t end\_rva = 0 End of the code range (RVA). ##### [` entrypoint `]() uint32\_t entrypoint = 0 RVA of the entry point for this range. ## [CHPEMetadata (X86)]() ### [` CHPEMetadataX86 `]() class CHPEMetadataX86 : public LIEF::PE::[CHPEMetadata]( "LIEF::PE::CHPEMetadata") This class represents hybrid metadata for X86. Public Functions #### [` CHPEMetadataX86 `]() inline CHPEMetadataX86(uint32\_t version) #### [` CHPEMetadataX86 `]() CHPEMetadataX86(const [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86::CHPEMetadataX86")&) = default #### [` operator= `]() [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &operator=(const [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86")&) = default #### [` CHPEMetadataX86 `]() CHPEMetadataX86([CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86::CHPEMetadataX86")&&) = default #### [` operator= `]() [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &operator=([CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[CHPEMetadata]( "LIEF::PE::CHPEMetadata")> clone() const override #### [` chpe_code_address_range_offset `]() inline uint32\_t chpe\_code\_address\_range\_offset() const #### [` chpe_code_address_range_count `]() inline uint32\_t chpe\_code\_address\_range\_count() const #### [` wowa64_exception_handler_function_pointer `]() inline uint32\_t wowa64\_exception\_handler\_function\_pointer() const #### [` wowa64_dispatch_call_function_pointer `]() inline uint32\_t wowa64\_dispatch\_call\_function\_pointer() const #### [` wowa64_dispatch_indirect_call_function_pointer `]() inline uint32\_t wowa64\_dispatch\_indirect\_call\_function\_pointer() const #### [` wowa64_dispatch_indirect_call_cfg_function_pointer `]() inline uint32\_t wowa64\_dispatch\_indirect\_call\_cfg\_function\_pointer() const #### [` wowa64_dispatch_ret_function_pointer `]() inline uint32\_t wowa64\_dispatch\_ret\_function\_pointer() const #### [` wowa64_dispatch_ret_leaf_function_pointer `]() inline uint32\_t wowa64\_dispatch\_ret\_leaf\_function\_pointer() const #### [` wowa64_dispatch_jump_function_pointer `]() inline uint32\_t wowa64\_dispatch\_jump\_function\_pointer() const #### [` compiler_iat_pointer `]() inline std::optional<uint32\_t> compiler\_iat\_pointer() const #### [` wowa64_rdtsc_function_pointer `]() inline std::optional<uint32\_t> wowa64\_rdtsc\_function\_pointer() const #### [` chpe_code_address_range_offset `]() inline [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &chpe\_code\_address\_range\_offset(uint32\_t value) #### [` chpe_code_address_range_count `]() inline [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &chpe\_code\_address\_range\_count(uint32\_t value) #### [` wowa64_exception_handler_function_pointer `]() inline [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &wowa64\_exception\_handler\_function\_pointer(uint32\_t value) #### [` wowa64_dispatch_call_function_pointer `]() inline [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &wowa64\_dispatch\_call\_function\_pointer(uint32\_t value) #### [` wowa64_dispatch_indirect_call_function_pointer `]() inline [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &wowa64\_dispatch\_indirect\_call\_function\_pointer(uint32\_t value) #### [` wowa64_dispatch_indirect_call_cfg_function_pointer `]() inline [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &wowa64\_dispatch\_indirect\_call\_cfg\_function\_pointer(uint32\_t value) #### [` wowa64_dispatch_ret_function_pointer `]() inline [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &wowa64\_dispatch\_ret\_function\_pointer(uint32\_t value) #### [` wowa64_dispatch_ret_leaf_function_pointer `]() inline [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &wowa64\_dispatch\_ret\_leaf\_function\_pointer(uint32\_t value) #### [` wowa64_dispatch_jump_function_pointer `]() inline [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &wowa64\_dispatch\_jump\_function\_pointer(uint32\_t value) #### [` compiler_iat_pointer `]() inline [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &compiler\_iat\_pointer(uint32\_t value) #### [` wowa64_rdtsc_function_pointer `]() inline [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &wowa64\_rdtsc\_function\_pointer(uint32\_t value) #### [` to_string `]() virtual std::string to\_string() const override #### [` ~CHPEMetadataX86 `]() ~CHPEMetadataX86() override = default Public Static Functions #### [` parse `]() static std::unique\_ptr<[CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86")> parse([Parser]( "LIEF::PE::Parser") &ctx, [BinaryStream]( "LIEF::BinaryStream") &stream, uint32\_t version) #### [` classof `]() static inline bool classof(const [CHPEMetadata]( "LIEF::PE::CHPEMetadata") \*meta) --- ## [DynamicRelocation]() ### [` DynamicRelocation `]() class DynamicRelocation This is the base class for any `IMAGE_DYNAMIC_RELOCATION32`, `IMAGE_DYNAMIC_RELOCATION32_V2`, `IMAGE_DYNAMIC_RELOCATION64`, `IMAGE_DYNAMIC_RELOCATION64_V2` dynamic relocations. Subclassed by [LIEF::PE::DynamicRelocationV1](), [LIEF::PE::DynamicRelocationV2]() Public Types #### [` IMAGE_DYNAMIC_RELOCATION `]() enum IMAGE\_DYNAMIC\_RELOCATION Special symbol values as defined in `link.exe - GetDVRTSpecialSymbolName`. *Values:* ##### [` RELOCATION_GUARD_RF_PROLOGUE `]() enumerator RELOCATION\_GUARD\_RF\_PROLOGUE = 1 Mirror `IMAGE_DYNAMIC_RELOCATION_GUARD_RF_PROLOGUE`. ##### [` RELOCATION_GUARD_RF_EPILOGUE `]() enumerator RELOCATION\_GUARD\_RF\_EPILOGUE = 2 Mirror `IMAGE_DYNAMIC_RELOCATION_GUARD_RF_EPILOGUE`. ##### [` RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER `]() enumerator RELOCATION\_GUARD\_IMPORT\_CONTROL\_TRANSFER = 3 Mirror `IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER`. ##### [` RELOCATION_GUARD_INDIR_CONTROL_TRANSFER `]() enumerator RELOCATION\_GUARD\_INDIR\_CONTROL\_TRANSFER = 4 Mirror `IMAGE_DYNAMIC_RELOCATION_GUARD_INDIR_CONTROL_TRANSFER`. ##### [` RELOCATION_GUARD_SWITCHTABLE_BRANCH `]() enumerator RELOCATION\_GUARD\_SWITCHTABLE\_BRANCH = 5 Mirror `IMAGE_DYNAMIC_RELOCATION_GUARD_SWITCHTABLE_BRANCH`. ##### [` RELOCATION_ARM64X `]() enumerator RELOCATION\_ARM64X = 6 Mirror `IMAGE_DYNAMIC_RELOCATION_ARM64X`. ##### [` RELOCATION_FUNCTION_OVERRIDE `]() enumerator RELOCATION\_FUNCTION\_OVERRIDE = 7 Mirror `IMAGE_DYNAMIC_RELOCATION_FUNCTION_OVERRIDE`. ##### [` RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER `]() enumerator RELOCATION\_ARM64\_KERNEL\_IMPORT\_CALL\_TRANSFER = 8 Mirror `IMAGE_DYNAMIC_RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER`. ##### [` _RELOC_LAST_ENTRY `]() enumerator \_RELOC\_LAST\_ENTRY Public Functions #### [` DynamicRelocation `]() DynamicRelocation() = delete #### [` DynamicRelocation `]() DynamicRelocation(uint32\_t version) #### [` DynamicRelocation `]() DynamicRelocation(const [DynamicRelocation]( "LIEF::PE::DynamicRelocation::DynamicRelocation")&) #### [` operator= `]() [DynamicRelocation]( "LIEF::PE::DynamicRelocation") &operator=(const [DynamicRelocation]( "LIEF::PE::DynamicRelocation")&) #### [` DynamicRelocation `]() DynamicRelocation([DynamicRelocation]( "LIEF::PE::DynamicRelocation::DynamicRelocation")&&) #### [` operator= `]() [DynamicRelocation]( "LIEF::PE::DynamicRelocation") &operator=([DynamicRelocation]( "LIEF::PE::DynamicRelocation")&&) #### [` clone `]() virtual std::unique\_ptr<[DynamicRelocation]( "LIEF::PE::DynamicRelocation")> clone() const = 0 #### [` version `]() inline uint32\_t version() const Version of the structure. #### [` symbol `]() inline uint64\_t symbol() const [Symbol]() address. Some values have a special meaning (c.f. [IMAGE\_DYNAMIC\_RELOCATION]()) and define how fixups are encoded. #### [` fixups `]() inline const [DynamicFixup]( "LIEF::PE::DynamicFixup") \*fixups() const #### [` fixups `]() inline [DynamicFixup]( "LIEF::PE::DynamicFixup") \*fixups() Return fixups information, where the interpretation may depend on the symbol’s value. #### [` symbol `]() inline [DynamicRelocation]( "LIEF::PE::DynamicRelocation") &symbol(uint64\_t value) #### [` fixups `]() [DynamicRelocation]( "LIEF::PE::DynamicRelocation") &fixups(std::unique\_ptr<[DynamicFixup]( "LIEF::PE::DynamicFixup")> F) #### [` to_string `]() virtual std::string to\_string() const = 0 #### [` Tas `]() template<class T> inline [T]( "LIEF::PE::DynamicRelocation::as::T") \*as() #### [` Tas `]() template<class T> inline const [T]( "LIEF::PE::DynamicRelocation::as::T") \*as() const #### [` ~DynamicRelocation `]() virtual ~DynamicRelocation() Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [DynamicRelocation]( "LIEF::PE::DynamicRelocation") &reloc) ## [DynamicRelocationV1]() ### [` DynamicRelocationV1 `]() class DynamicRelocationV1 : public LIEF::PE::[DynamicRelocation]( "LIEF::PE::DynamicRelocation") This class represents a dynamic relocation (`IMAGE_DYNAMIC_RELOCATION32` or `IMAGE_DYNAMIC_RELOCATION64`). Public Functions #### [` DynamicRelocationV1 `]() inline DynamicRelocationV1() #### [` DynamicRelocationV1 `]() DynamicRelocationV1(const [DynamicRelocationV1]( "LIEF::PE::DynamicRelocationV1::DynamicRelocationV1")&) = default #### [` operator= `]() [DynamicRelocationV1]( "LIEF::PE::DynamicRelocationV1") &operator=(const [DynamicRelocationV1]( "LIEF::PE::DynamicRelocationV1")&) = default #### [` DynamicRelocationV1 `]() DynamicRelocationV1([DynamicRelocationV1]( "LIEF::PE::DynamicRelocationV1::DynamicRelocationV1")&&) = default #### [` operator= `]() [DynamicRelocationV1]( "LIEF::PE::DynamicRelocationV1") &operator=([DynamicRelocationV1]( "LIEF::PE::DynamicRelocationV1")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[DynamicRelocation]( "LIEF::PE::DynamicRelocation")> clone() const override #### [` to_string `]() virtual std::string to\_string() const override #### [` ~DynamicRelocationV1 `]() ~DynamicRelocationV1() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicRelocation]( "LIEF::PE::DynamicRelocation") \*reloc) ## [DynamicRelocationV2]() ### [` DynamicRelocationV2 `]() class DynamicRelocationV2 : public LIEF::PE::[DynamicRelocation]( "LIEF::PE::DynamicRelocation") This class represents a dynamic relocation (`IMAGE_DYNAMIC_RELOCATION64_V2` or `IMAGE_DYNAMIC_RELOCATION32_V2`). Public Functions #### [` DynamicRelocationV2 `]() inline DynamicRelocationV2() #### [` DynamicRelocationV2 `]() DynamicRelocationV2(const [DynamicRelocationV2]( "LIEF::PE::DynamicRelocationV2::DynamicRelocationV2")&) = default #### [` operator= `]() [DynamicRelocationV2]( "LIEF::PE::DynamicRelocationV2") &operator=(const [DynamicRelocationV2]( "LIEF::PE::DynamicRelocationV2")&) = default #### [` DynamicRelocationV2 `]() DynamicRelocationV2([DynamicRelocationV2]( "LIEF::PE::DynamicRelocationV2::DynamicRelocationV2")&&) = default #### [` operator= `]() [DynamicRelocationV2]( "LIEF::PE::DynamicRelocationV2") &operator=([DynamicRelocationV2]( "LIEF::PE::DynamicRelocationV2")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[DynamicRelocation]( "LIEF::PE::DynamicRelocation")> clone() const override #### [` to_string `]() virtual std::string to\_string() const override #### [` ~DynamicRelocationV2 `]() ~DynamicRelocationV2() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicRelocation]( "LIEF::PE::DynamicRelocation") \*reloc) --- ## [DynamicFixup]() ### [` DynamicFixup `]() class DynamicFixup This is the base class for any fixups located in [DynamicRelocation](). Subclassed by [LIEF::PE::DynamicFixupARM64Kernel](), [LIEF::PE::DynamicFixupARM64X](), [LIEF::PE::DynamicFixupControlTransfer](), [LIEF::PE::DynamicFixupGeneric](), [LIEF::PE::DynamicFixupUnknown](), [LIEF::PE::FunctionOverride]() Public Types #### [` KIND `]() enum KIND *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 If [DynamicRelocation::symbol]() is a special value that is not supported by LIEF. ##### [` GENERIC `]() enumerator GENERIC If [DynamicRelocation::symbol]() is not a special value. ##### [` ARM64X `]() enumerator ARM64X If [DynamicRelocation::symbol]() is set to `IMAGE_DYNAMIC_RELOCATION_ARM64X`. ##### [` FUNCTION_OVERRIDE `]() enumerator FUNCTION\_OVERRIDE If [DynamicRelocation::symbol]() is set to `IMAGE_DYNAMIC_RELOCATION_FUNCTION_OVERRIDE`. ##### [` ARM64_KERNEL_IMPORT_CALL_TRANSFER `]() enumerator ARM64\_KERNEL\_IMPORT\_CALL\_TRANSFER If [DynamicRelocation::symbol]() is set to `IMAGE_DYNAMIC_RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER`. ##### [` GUARD_IMPORT_CONTROL_TRANSFER `]() enumerator GUARD\_IMPORT\_CONTROL\_TRANSFER If [DynamicRelocation::symbol]() is set to `IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER`. Public Functions #### [` DynamicFixup `]() DynamicFixup() = delete #### [` DynamicFixup `]() inline DynamicFixup([KIND]( "LIEF::PE::DynamicFixup::KIND") kind) #### [` DynamicFixup `]() DynamicFixup(const [DynamicFixup]( "LIEF::PE::DynamicFixup::DynamicFixup")&) = default #### [` operator= `]() [DynamicFixup]( "LIEF::PE::DynamicFixup") &operator=(const [DynamicFixup]( "LIEF::PE::DynamicFixup")&) = default #### [` DynamicFixup `]() DynamicFixup([DynamicFixup]( "LIEF::PE::DynamicFixup::DynamicFixup")&&) = default #### [` operator= `]() [DynamicFixup]( "LIEF::PE::DynamicFixup") &operator=([DynamicFixup]( "LIEF::PE::DynamicFixup")&&) = default #### [` clone `]() virtual std::unique\_ptr<[DynamicFixup]( "LIEF::PE::DynamicFixup")> clone() const = 0 #### [` to_string `]() virtual std::string to\_string() const = 0 #### [` kind `]() inline [KIND]( "LIEF::PE::DynamicFixup::KIND") kind() const Encoding of the fixups. #### [` Tas `]() template<class T> inline [T]( "LIEF::PE::DynamicFixup::as::T") \*as() #### [` Tas `]() template<class T> inline const [T]( "LIEF::PE::DynamicFixup::as::T") \*as() const #### [` ~DynamicFixup `]() virtual ~DynamicFixup() = default Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [DynamicFixup]( "LIEF::PE::DynamicFixup") &fixup) ## [DynamicFixupControlTransfer]() ### [` DynamicFixupControlTransfer `]() class DynamicFixupControlTransfer : public LIEF::PE::[DynamicFixup]( "LIEF::PE::DynamicFixup") This class wraps fixups associated with the (special) symbol value: `IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER (3)`. Public Types #### [` reloc_entries_t `]() using reloc\_entries\_t = std::vector<[reloc\_entry\_t]( "LIEF::PE::DynamicFixupControlTransfer::reloc_entry_t")> #### [` it_relocations `]() using it\_relocations = [ref\_iterator]( "LIEF::ref_iterator")<[reloc\_entries\_t]( "LIEF::PE::DynamicFixupControlTransfer::reloc_entries_t")&> #### [` it_const_relocations `]() using it\_const\_relocations = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [reloc\_entries\_t]( "LIEF::PE::DynamicFixupControlTransfer::reloc_entries_t")&> Public Functions #### [` DynamicFixupControlTransfer `]() inline DynamicFixupControlTransfer() #### [` DynamicFixupControlTransfer `]() DynamicFixupControlTransfer(const [DynamicFixupControlTransfer]( "LIEF::PE::DynamicFixupControlTransfer::DynamicFixupControlTransfer")&) = default #### [` operator= `]() [DynamicFixupControlTransfer]( "LIEF::PE::DynamicFixupControlTransfer") &operator=(const [DynamicFixupControlTransfer]( "LIEF::PE::DynamicFixupControlTransfer")&) = default #### [` DynamicFixupControlTransfer `]() DynamicFixupControlTransfer([DynamicFixupControlTransfer]( "LIEF::PE::DynamicFixupControlTransfer::DynamicFixupControlTransfer")&&) = default #### [` operator= `]() [DynamicFixupControlTransfer]( "LIEF::PE::DynamicFixupControlTransfer") &operator=([DynamicFixupControlTransfer]( "LIEF::PE::DynamicFixupControlTransfer")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[DynamicFixup]( "LIEF::PE::DynamicFixup")> clone() const override #### [` to_string `]() virtual std::string to\_string() const override #### [` relocations `]() inline [it\_relocations]( "LIEF::PE::DynamicFixupControlTransfer::it_relocations") relocations() Iterator over the relocations. #### [` relocations `]() inline [it\_const\_relocations]( "LIEF::PE::DynamicFixupControlTransfer::it_const_relocations") relocations() const #### [` ~DynamicFixupControlTransfer `]() ~DynamicFixupControlTransfer() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicFixup]( "LIEF::PE::DynamicFixup") \*fixup) Public Static Attributes #### [` NO_IAT_INDEX `]() static auto NO\_IAT\_INDEX = 0x7fff #### [` reloc_entry_t `]() struct reloc\_entry\_t Mirror `IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION`. Public Functions ##### [` to_string `]() std::string to\_string() const Public Members ##### [` rva `]() uint32\_t rva = 0 RVA to the call instruction. ##### [` is_call `]() bool is\_call = false True if target instruction is a `call`, false otherwise. ##### [` iat_index `]() uint16\_t iat\_index = [NO\_IAT\_INDEX]( "LIEF::PE::DynamicFixupControlTransfer::NO_IAT_INDEX") IAT index of the corresponding import. `0x7FFF` is a special value indicating no index. Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [reloc\_entry\_t]( "LIEF::PE::DynamicFixupControlTransfer::reloc_entry_t") &entry) ## [DynamicFixupARM64Kernel]() ### [` DynamicFixupARM64Kernel `]() class DynamicFixupARM64Kernel : public LIEF::PE::[DynamicFixup]( "LIEF::PE::DynamicFixup") This class wraps fixups associated with the (special) symbol value: `IMAGE_DYNAMIC_RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER (8)`. Public Types #### [` IMPORT_TYPE `]() enum class IMPORT\_TYPE : uint8\_t *Values:* ##### [` STATIC `]() enumerator STATIC = 0 ##### [` DELAYED `]() enumerator DELAYED = 1 #### [` reloc_entries_t `]() using reloc\_entries\_t = std::vector<[reloc\_entry\_t]( "LIEF::PE::DynamicFixupARM64Kernel::reloc_entry_t")> #### [` it_relocations `]() using it\_relocations = [ref\_iterator]( "LIEF::ref_iterator")<[reloc\_entries\_t]( "LIEF::PE::DynamicFixupARM64Kernel::reloc_entries_t")&> #### [` it_const_relocations `]() using it\_const\_relocations = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [reloc\_entries\_t]( "LIEF::PE::DynamicFixupARM64Kernel::reloc_entries_t")&> Public Functions #### [` DynamicFixupARM64Kernel `]() inline DynamicFixupARM64Kernel() #### [` DynamicFixupARM64Kernel `]() DynamicFixupARM64Kernel(const [DynamicFixupARM64Kernel]( "LIEF::PE::DynamicFixupARM64Kernel::DynamicFixupARM64Kernel")&) = default #### [` operator= `]() [DynamicFixupARM64Kernel]( "LIEF::PE::DynamicFixupARM64Kernel") &operator=(const [DynamicFixupARM64Kernel]( "LIEF::PE::DynamicFixupARM64Kernel")&) = default #### [` DynamicFixupARM64Kernel `]() DynamicFixupARM64Kernel([DynamicFixupARM64Kernel]( "LIEF::PE::DynamicFixupARM64Kernel::DynamicFixupARM64Kernel")&&) = default #### [` operator= `]() [DynamicFixupARM64Kernel]( "LIEF::PE::DynamicFixupARM64Kernel") &operator=([DynamicFixupARM64Kernel]( "LIEF::PE::DynamicFixupARM64Kernel")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[DynamicFixup]( "LIEF::PE::DynamicFixup")> clone() const override #### [` to_string `]() virtual std::string to\_string() const override #### [` relocations `]() inline [it\_relocations]( "LIEF::PE::DynamicFixupARM64Kernel::it_relocations") relocations() Iterator over the relocations. #### [` relocations `]() inline [it\_const\_relocations]( "LIEF::PE::DynamicFixupARM64Kernel::it_const_relocations") relocations() const #### [` ~DynamicFixupARM64Kernel `]() ~DynamicFixupARM64Kernel() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicFixup]( "LIEF::PE::DynamicFixup") \*fixup) Public Static Attributes #### [` NO_IAT_INDEX `]() static auto NO\_IAT\_INDEX = 0x7fff #### [` reloc_entry_t `]() struct reloc\_entry\_t Mirror `IMAGE_IMPORT_CONTROL_TRANSFER_ARM64_RELOCATION`. Public Functions ##### [` to_string `]() std::string to\_string() const Public Members ##### [` rva `]() uint32\_t rva = 0 RVA to the call instruction. ##### [` indirect_call `]() bool indirect\_call = false True if target instruction is a `blr`, false if it’s a `br`. ##### [` register_index `]() uint8\_t register\_index = 0 Register index used for the indirect call/jump. For instance, if the instruction is `br x3`, this index is set to `3`. ##### [` import_type `]() [IMPORT\_TYPE]( "LIEF::PE::DynamicFixupARM64Kernel::IMPORT_TYPE") import\_type = [IMPORT\_TYPE]( "LIEF::PE::DynamicFixupARM64Kernel::IMPORT_TYPE")::[STATIC]( "LIEF::PE::DynamicFixupARM64Kernel::IMPORT_TYPE::STATIC") See [IMPORT\_TYPE](). ##### [` iat_index `]() uint16\_t iat\_index = [NO\_IAT\_INDEX]( "LIEF::PE::DynamicFixupARM64Kernel::NO_IAT_INDEX") IAT index of the corresponding import. `0x7FFF` is a special value indicating no index. Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [reloc\_entry\_t]( "LIEF::PE::DynamicFixupARM64Kernel::reloc_entry_t") &entry) ## [DynamicFixupARM64X]() ### [` DynamicFixupARM64X `]() class DynamicFixupARM64X : public LIEF::PE::[DynamicFixup]( "LIEF::PE::DynamicFixup") This class represents `IMAGE_DYNAMIC_RELOCATION_ARM64X`. Public Types #### [` FIXUP_TYPE `]() enum class FIXUP\_TYPE *Values:* ##### [` ZEROFILL `]() enumerator ZEROFILL = 0 ##### [` VALUE `]() enumerator VALUE = 1 ##### [` DELTA `]() enumerator DELTA = 2 #### [` reloc_entries_t `]() using reloc\_entries\_t = std::vector<[reloc\_entry\_t]( "LIEF::PE::DynamicFixupARM64X::reloc_entry_t")> #### [` it_relocations `]() using it\_relocations = [ref\_iterator]( "LIEF::ref_iterator")<[reloc\_entries\_t]( "LIEF::PE::DynamicFixupARM64X::reloc_entries_t")&> #### [` it_const_relocations `]() using it\_const\_relocations = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [reloc\_entries\_t]( "LIEF::PE::DynamicFixupARM64X::reloc_entries_t")&> Public Functions #### [` DynamicFixupARM64X `]() inline DynamicFixupARM64X() #### [` DynamicFixupARM64X `]() DynamicFixupARM64X(const [DynamicFixupARM64X]( "LIEF::PE::DynamicFixupARM64X::DynamicFixupARM64X")&) = default #### [` operator= `]() [DynamicFixupARM64X]( "LIEF::PE::DynamicFixupARM64X") &operator=(const [DynamicFixupARM64X]( "LIEF::PE::DynamicFixupARM64X")&) = default #### [` DynamicFixupARM64X `]() DynamicFixupARM64X([DynamicFixupARM64X]( "LIEF::PE::DynamicFixupARM64X::DynamicFixupARM64X")&&) = default #### [` operator= `]() [DynamicFixupARM64X]( "LIEF::PE::DynamicFixupARM64X") &operator=([DynamicFixupARM64X]( "LIEF::PE::DynamicFixupARM64X")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[DynamicFixup]( "LIEF::PE::DynamicFixup")> clone() const override #### [` to_string `]() virtual std::string to\_string() const override #### [` relocations `]() inline [it\_relocations]( "LIEF::PE::DynamicFixupARM64X::it_relocations") relocations() Iterator over the different fixup entries. #### [` relocations `]() inline [it\_const\_relocations]( "LIEF::PE::DynamicFixupARM64X::it_const_relocations") relocations() const #### [` ~DynamicFixupARM64X `]() ~DynamicFixupARM64X() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicFixup]( "LIEF::PE::DynamicFixup") \*fixup) #### [` reloc_entry_t `]() struct reloc\_entry\_t Public Functions ##### [` to_string `]() std::string to\_string() const Public Members ##### [` rva `]() uint32\_t rva = 0 RVA where the fixup takes place. ##### [` type `]() [FIXUP\_TYPE]( "LIEF::PE::DynamicFixupARM64X::FIXUP_TYPE") type = [FIXUP\_TYPE]( "LIEF::PE::DynamicFixupARM64X::FIXUP_TYPE")::[ZEROFILL]( "LIEF::PE::DynamicFixupARM64X::FIXUP_TYPE::ZEROFILL") Fixup’s kind. ##### [` size `]() size\_t size = 0 Size of the value to patch. ##### [` bytes `]() std::vector<uint8\_t> bytes If the type is [FIXUP\_TYPE::VALUE](), the bytes associated to the fixup entry. ##### [` value `]() int64\_t value = 0 If the type is [FIXUP\_TYPE::DELTA](), the (signed) value. Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [reloc\_entry\_t]( "LIEF::PE::DynamicFixupARM64X::reloc_entry_t") &entry) ## [DynamicFixupGeneric]() ### [` DynamicFixupGeneric `]() class DynamicFixupGeneric : public LIEF::PE::[DynamicFixup]( "LIEF::PE::DynamicFixup") This class represents a generic entry where fixups are regular relocations ([LIEF::PE::Relocation]()). Public Types #### [` relocations_t `]() using relocations\_t = std::vector<std::unique\_ptr<[Relocation]( "LIEF::PE::Relocation")>> #### [` it_relocations `]() using it\_relocations = [ref\_iterator]( "LIEF::ref_iterator")<[relocations\_t]( "LIEF::PE::DynamicFixupGeneric::relocations_t")&, [Relocation]( "LIEF::PE::Relocation")\*> #### [` it_const_relocations `]() using it\_const\_relocations = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [relocations\_t]( "LIEF::PE::DynamicFixupGeneric::relocations_t")&, [Relocation]( "LIEF::PE::Relocation")\*> Public Functions #### [` DynamicFixupGeneric `]() DynamicFixupGeneric() #### [` DynamicFixupGeneric `]() DynamicFixupGeneric(const [DynamicFixupGeneric]( "LIEF::PE::DynamicFixupGeneric::DynamicFixupGeneric")&) #### [` operator= `]() [DynamicFixupGeneric]( "LIEF::PE::DynamicFixupGeneric") &operator=(const [DynamicFixupGeneric]( "LIEF::PE::DynamicFixupGeneric")&) #### [` DynamicFixupGeneric `]() DynamicFixupGeneric([DynamicFixupGeneric]( "LIEF::PE::DynamicFixupGeneric::DynamicFixupGeneric")&&) #### [` operator= `]() [DynamicFixupGeneric]( "LIEF::PE::DynamicFixupGeneric") &operator=([DynamicFixupGeneric]( "LIEF::PE::DynamicFixupGeneric")&&) #### [` clone `]() inline virtual std::unique\_ptr<[DynamicFixup]( "LIEF::PE::DynamicFixup")> clone() const override #### [` relocations `]() inline [it\_relocations]( "LIEF::PE::DynamicFixupGeneric::it_relocations") relocations() Iterator over the relocations. #### [` relocations `]() inline [it\_const\_relocations]( "LIEF::PE::DynamicFixupGeneric::it_const_relocations") relocations() const #### [` to_string `]() virtual std::string to\_string() const override #### [` ~DynamicFixupGeneric `]() ~DynamicFixupGeneric() override Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicFixup]( "LIEF::PE::DynamicFixup") \*fixup) ## [DynamicFixupUnknown]() ### [` DynamicFixupUnknown `]() class DynamicFixupUnknown : public LIEF::PE::[DynamicFixup]( "LIEF::PE::DynamicFixup") This class represents a special dynamic relocation where the format of the fixups is not supported by LIEF. Public Functions #### [` DynamicFixupUnknown `]() inline DynamicFixupUnknown(std::vector<uint8\_t> payload) #### [` DynamicFixupUnknown `]() DynamicFixupUnknown(const [DynamicFixupUnknown]( "LIEF::PE::DynamicFixupUnknown::DynamicFixupUnknown")&) = default #### [` operator= `]() [DynamicFixupUnknown]( "LIEF::PE::DynamicFixupUnknown") &operator=(const [DynamicFixupUnknown]( "LIEF::PE::DynamicFixupUnknown")&) = default #### [` DynamicFixupUnknown `]() DynamicFixupUnknown([DynamicFixupUnknown]( "LIEF::PE::DynamicFixupUnknown::DynamicFixupUnknown")&&) = default #### [` operator= `]() [DynamicFixupUnknown]( "LIEF::PE::DynamicFixupUnknown") &operator=([DynamicFixupUnknown]( "LIEF::PE::DynamicFixupUnknown")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[DynamicFixup]( "LIEF::PE::DynamicFixup")> clone() const override #### [` to_string `]() inline virtual std::string to\_string() const override #### [` payload `]() inline span<const uint8\_t> payload() const Raw fixups. #### [` payload `]() inline span<uint8\_t> payload() #### [` ~DynamicFixupUnknown `]() ~DynamicFixupUnknown() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicFixup]( "LIEF::PE::DynamicFixup") \*fixup) ## [FunctionOverride]() ### [` FunctionOverride `]() class FunctionOverride : public LIEF::PE::[DynamicFixup]( "LIEF::PE::DynamicFixup") This class represents `IMAGE_DYNAMIC_RELOCATION_FUNCTION_OVERRIDE`. Public Types #### [` func_overriding_info_t `]() using func\_overriding\_info\_t = std::vector<std::unique\_ptr<[FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo")>> #### [` it_func_overriding_info `]() using it\_func\_overriding\_info = [ref\_iterator]( "LIEF::ref_iterator")<[func\_overriding\_info\_t]( "LIEF::PE::FunctionOverride::func_overriding_info_t")&, [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo")\*> #### [` it_const_func_overriding_info `]() using it\_const\_func\_overriding\_info = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [func\_overriding\_info\_t]( "LIEF::PE::FunctionOverride::func_overriding_info_t")&, const [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo")\*> #### [` bdd_info_list_t `]() using bdd\_info\_list\_t = std::vector<[image\_bdd\_info\_t]( "LIEF::PE::FunctionOverride::image_bdd_info_t")> #### [` it_bdd_info `]() using it\_bdd\_info = [ref\_iterator]( "LIEF::ref_iterator")<[bdd\_info\_list\_t]( "LIEF::PE::FunctionOverride::bdd_info_list_t")&> #### [` it_const_bdd_info `]() using it\_const\_bdd\_info = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [bdd\_info\_list\_t]( "LIEF::PE::FunctionOverride::bdd_info_list_t")&> Public Functions #### [` FunctionOverride `]() FunctionOverride() #### [` FunctionOverride `]() FunctionOverride(const [FunctionOverride]( "LIEF::PE::FunctionOverride::FunctionOverride")&) #### [` operator= `]() [FunctionOverride]( "LIEF::PE::FunctionOverride") &operator=(const [FunctionOverride]( "LIEF::PE::FunctionOverride")&) #### [` FunctionOverride `]() FunctionOverride([FunctionOverride]( "LIEF::PE::FunctionOverride::FunctionOverride")&&) #### [` operator= `]() [FunctionOverride]( "LIEF::PE::FunctionOverride") &operator=([FunctionOverride]( "LIEF::PE::FunctionOverride")&&) #### [` clone `]() inline virtual std::unique\_ptr<[DynamicFixup]( "LIEF::PE::DynamicFixup")> clone() const override #### [` func_overriding_info `]() inline [it\_func\_overriding\_info]( "LIEF::PE::FunctionOverride::it_func_overriding_info") func\_overriding\_info() Iterator over the overriding info. #### [` func_overriding_info `]() inline [it\_const\_func\_overriding\_info]( "LIEF::PE::FunctionOverride::it_const_func_overriding_info") func\_overriding\_info() const #### [` bdd_info `]() inline [it\_bdd\_info]( "LIEF::PE::FunctionOverride::it_bdd_info") bdd\_info() Iterator over the BDD info. #### [` bdd_info `]() inline [it\_const\_bdd\_info]( "LIEF::PE::FunctionOverride::it_const_bdd_info") bdd\_info() const #### [` find_bdd_info `]() [image\_bdd\_info\_t]( "LIEF::PE::FunctionOverride::image_bdd_info_t") \*find\_bdd\_info(uint32\_t offset) Find the `IMAGE_BDD_INFO` at the given offset. #### [` find_bdd_info `]() [image\_bdd\_info\_t]( "LIEF::PE::FunctionOverride::image_bdd_info_t") \*find\_bdd\_info(const [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo") &info) Find the `IMAGE_BDD_INFO` associated with the given info. #### [` find_bdd_info `]() inline const [image\_bdd\_info\_t]( "LIEF::PE::FunctionOverride::image_bdd_info_t") \*find\_bdd\_info(uint32\_t offset) const #### [` find_bdd_info `]() inline const [image\_bdd\_info\_t]( "LIEF::PE::FunctionOverride::image_bdd_info_t") \*find\_bdd\_info(const [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo") &info) const #### [` to_string `]() virtual std::string to\_string() const override #### [` ~FunctionOverride `]() ~FunctionOverride() override Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicFixup]( "LIEF::PE::DynamicFixup") \*fixup) #### [` image_bdd_dynamic_relocation_t `]() struct image\_bdd\_dynamic\_relocation\_t Mirror `IMAGE_BDD_DYNAMIC_RELOCATION`. Public Members ##### [` left `]() uint16\_t left = 0 ##### [` right `]() uint16\_t right = 0 ##### [` value `]() uint32\_t value = 0 #### [` image_bdd_info_t `]() struct image\_bdd\_info\_t Mirror `IMAGE_BDD_INFO`. Public Members ##### [` version `]() uint32\_t version = 0 ##### [` original_size `]() uint32\_t original\_size = 0 ##### [` original_offset `]() uint32\_t original\_offset = 0 ##### [` relocations `]() std::vector<[image\_bdd\_dynamic\_relocation\_t]( "LIEF::PE::FunctionOverride::image_bdd_dynamic_relocation_t")> relocations If version == 1. ##### [` payload `]() std::vector<uint8\_t> payload If version != 1. ## [FunctionOverrideInfo]() ### [` FunctionOverrideInfo `]() class FunctionOverrideInfo Public Types #### [` relocations_t `]() using relocations\_t = std::vector<std::unique\_ptr<[Relocation]( "LIEF::PE::Relocation")>> #### [` it_relocations `]() using it\_relocations = [ref\_iterator]( "LIEF::ref_iterator")<[relocations\_t]( "LIEF::PE::FunctionOverrideInfo::relocations_t")&, [Relocation]( "LIEF::PE::Relocation")\*> #### [` it_const_relocations `]() using it\_const\_relocations = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [relocations\_t]( "LIEF::PE::FunctionOverrideInfo::relocations_t")&, const [Relocation]( "LIEF::PE::Relocation")\*> Public Functions #### [` FunctionOverrideInfo `]() FunctionOverrideInfo() = default #### [` FunctionOverrideInfo `]() FunctionOverrideInfo(uint32\_t original\_rva, uint32\_t bdd\_offset, uint32\_t base\_reloc\_size) #### [` FunctionOverrideInfo `]() FunctionOverrideInfo(const [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo::FunctionOverrideInfo")&) #### [` operator= `]() [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo") &operator=(const [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo")&) #### [` FunctionOverrideInfo `]() FunctionOverrideInfo([FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo::FunctionOverrideInfo")&&) #### [` operator= `]() [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo") &operator=([FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo")&&) #### [` to_string `]() std::string to\_string() const #### [` original_rva `]() inline uint32\_t original\_rva() const RVA of the original function. #### [` bdd_offset `]() inline uint32\_t bdd\_offset() const Offset into the BDD region. #### [` rva_size `]() inline uint32\_t rva\_size() const Size in bytes taken by RVAs. #### [` base_reloc_size `]() inline uint32\_t base\_reloc\_size() const Size in bytes taken by BaseRelocs. #### [` functions_rva `]() inline const std::vector<uint32\_t> &functions\_rva() const #### [` relocations `]() inline [it\_relocations]( "LIEF::PE::FunctionOverrideInfo::it_relocations") relocations() #### [` relocations `]() inline [it\_const\_relocations]( "LIEF::PE::FunctionOverrideInfo::it_const_relocations") relocations() const #### [` original_rva `]() inline [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo") &original\_rva(uint32\_t value) #### [` bdd_offset `]() inline [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo") &bdd\_offset(uint32\_t value) #### [` base_reloc_size `]() inline [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo") &base\_reloc\_size(uint32\_t value) #### [` overriding_funcs `]() inline [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo") &overriding\_funcs(std::vector<uint32\_t> funcs) #### [` ~FunctionOverrideInfo `]() ~FunctionOverrideInfo() Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo") &info) --- ## [EnclaveConfiguration]() ### [` EnclaveConfiguration `]() class EnclaveConfiguration This class represents the enclave configuration. Public Types #### [` id_array_t `]() using id\_array\_t = std::array<uint8\_t, 16> #### [` imports_t `]() using imports\_t = std::vector<[EnclaveImport]( "LIEF::PE::EnclaveImport")> #### [` it_imports `]() using it\_imports = [ref\_iterator]( "LIEF::ref_iterator")<[imports\_t]( "LIEF::PE::EnclaveConfiguration::imports_t")&> #### [` it_const_imports `]() using it\_const\_imports = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [imports\_t]( "LIEF::PE::EnclaveConfiguration::imports_t")&> Public Functions #### [` EnclaveConfiguration `]() EnclaveConfiguration() = default #### [` EnclaveConfiguration `]() EnclaveConfiguration(const [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration::EnclaveConfiguration")&) = default #### [` operator= `]() [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &operator=(const [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration")&) = default #### [` EnclaveConfiguration `]() EnclaveConfiguration([EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration::EnclaveConfiguration")&&) = default #### [` operator= `]() [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &operator=([EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration")&&) = default #### [` clone `]() inline std::unique\_ptr<[EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration")> clone() const #### [` size `]() inline uint32\_t size() const The size of the `IMAGE_ENCLAVE_CONFIG64/IMAGE_ENCLAVE_CONFIG32` structure, in bytes. #### [` min_required_config_size `]() inline uint32\_t min\_required\_config\_size() const The minimum size of the `IMAGE_ENCLAVE_CONFIG(32,64)` structure that the image loader must be able to process in order for the enclave to be usable. This member allows an enclave to inform an earlier version of the image loader that the image loader can safely load the enclave and ignore optional members added to `IMAGE_ENCLAVE_CONFIG(32,64)` for later versions of the enclave. If the size of `IMAGE_ENCLAVE_CONFIG(32,64)` that the image loader can process is less than `MinimumRequiredConfigSize`, the enclave cannot be run securely. If `MinimumRequiredConfigSize` is zero, the minimum size of the `IMAGE_ENCLAVE_CONFIG(32,64)` structure that the image loader must be able to process in order for the enclave to be usable is assumed to be the size of the structure through and including the `MinimumRequiredConfigSize` member. #### [` policy_flags `]() inline uint32\_t policy\_flags() const A flag that indicates whether the enclave permits debugging. #### [` is_debuggable `]() inline bool is\_debuggable() const Whether this enclave can be debugged. #### [` import_list_rva `]() inline uint32\_t import\_list\_rva() const The RVA of the array of images that the enclave image may import, with identity information for each image. #### [` import_entry_size `]() inline uint32\_t import\_entry\_size() const The size of each image in the array of images that the [import\_list\_rva()]() member points to. #### [` nb_imports `]() inline size\_t nb\_imports() const The number of images in the array of images that the [import\_list\_rva()]() member points to. #### [` imports `]() inline [it\_imports]( "LIEF::PE::EnclaveConfiguration::it_imports") imports() Return an iterator over the enclave’s imports. #### [` imports `]() inline [it\_const\_imports]( "LIEF::PE::EnclaveConfiguration::it_const_imports") imports() const #### [` family_id `]() inline const [id\_array\_t]( "LIEF::PE::EnclaveConfiguration::id_array_t") &family\_id() const The family identifier that the author of the enclave assigned to the enclave. #### [` image_id `]() inline const [id\_array\_t]( "LIEF::PE::EnclaveConfiguration::id_array_t") &image\_id() const The image identifier that the author of the enclave assigned to the enclave. #### [` image_version `]() inline uint32\_t image\_version() const The version number that the author of the enclave assigned to the enclave. #### [` security_version `]() inline uint32\_t security\_version() const The security version number that the author of the enclave assigned to the enclave. #### [` enclave_size `]() inline uint64\_t enclave\_size() const The expected virtual size of the private address range for the enclave, in bytes. #### [` nb_threads `]() inline uint32\_t nb\_threads() const The maximum number of threads that can be created within the enclave. #### [` enclave_flags `]() inline uint32\_t enclave\_flags() const A flag that indicates whether the image is suitable for use as the primary image in the enclave. #### [` size `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &size(uint32\_t value) #### [` min_required_config_size `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &min\_required\_config\_size(uint32\_t value) #### [` policy_flags `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &policy\_flags(uint32\_t value) #### [` import_list_rva `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &import\_list\_rva(uint32\_t value) #### [` import_entry_size `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &import\_entry\_size(uint32\_t value) #### [` family_id `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &family\_id(const [id\_array\_t]( "LIEF::PE::EnclaveConfiguration::id_array_t") &value) #### [` image_id `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &image\_id(const [id\_array\_t]( "LIEF::PE::EnclaveConfiguration::id_array_t") &value) #### [` image_version `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &image\_version(uint32\_t value) #### [` security_version `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &security\_version(uint32\_t value) #### [` enclave_size `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &enclave\_size(uint64\_t value) #### [` nb_threads `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &nb\_threads(uint32\_t value) #### [` enclave_flags `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &enclave\_flags(uint32\_t value) #### [` to_string `]() std::string to\_string() const Public Static Attributes #### [` MIN_SIZE `]() static auto MIN\_SIZE = 0x4C #### [` POLICY_DEBUGGABLE `]() static auto POLICY\_DEBUGGABLE = 0x00000001 #### [` POLICY_STRICT_MEMORY `]() static auto POLICY\_STRICT\_MEMORY = 0x00000002 Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &meta) --- ## [EnclaveImport]() ### [` EnclaveImport `]() class EnclaveImport Defines an entry in the array of images that an enclave can import. Public Types #### [` TYPE `]() enum class TYPE : uint32\_t *Values:* ##### [` NONE `]() enumerator NONE = 0x00000000 None of the identifiers of the image need to match the value in the import record. ##### [` UNIQUE_ID `]() enumerator UNIQUE\_ID = 0x00000001 The value of the enclave unique identifier of the image must match the value in the import record. Otherwise, loading of the image fails. ##### [` AUTHOR_ID `]() enumerator AUTHOR\_ID = 0x00000002 The value of the enclave author identifier of the image must match the value in the import record. Otherwise, loading of the image fails. If this flag is set and the import record indicates an author identifier of all zeros, the imported image must be part of the Windows installation. ##### [` FAMILY_ID `]() enumerator FAMILY\_ID = 0x00000003 The value of the enclave family identifier of the image must match the value in the import record. Otherwise, loading of the image fails. ##### [` IMAGE_ID `]() enumerator IMAGE\_ID = 0x00000004 The value of the enclave image identifier of the image must match the value in the import record. Otherwise, loading of the image fails. #### [` short_id_t `]() using short\_id\_t = std::array<uint8\_t, 16> #### [` long_id_t `]() using long\_id\_t = std::array<uint8\_t, 32> Public Functions #### [` EnclaveImport `]() EnclaveImport() = default #### [` EnclaveImport `]() EnclaveImport(const [EnclaveImport]( "LIEF::PE::EnclaveImport::EnclaveImport")&) = default #### [` operator= `]() [EnclaveImport]( "LIEF::PE::EnclaveImport") &operator=(const [EnclaveImport]( "LIEF::PE::EnclaveImport")&) = default #### [` EnclaveImport `]() EnclaveImport([EnclaveImport]( "LIEF::PE::EnclaveImport::EnclaveImport")&&) = default #### [` operator= `]() [EnclaveImport]( "LIEF::PE::EnclaveImport") &operator=([EnclaveImport]( "LIEF::PE::EnclaveImport")&&) = default #### [` type `]() inline [TYPE]( "LIEF::PE::EnclaveImport::TYPE") type() const The type of identifier of the image that must match the value in the import record. #### [` min_security_version `]() inline uint32\_t min\_security\_version() const The minimum enclave security version that each image must have for the image to be imported successfully. The image is rejected unless its enclave security version is equal to or greater than the minimum value in the import record. Set the value in the import record to zero to turn off the security version check. #### [` id `]() inline const [long\_id\_t]( "LIEF::PE::EnclaveImport::long_id_t") &id() const The unique identifier of the primary module for the enclave, if the [type()]() is [TYPE::UNIQUE\_ID](). Otherwise, the author identifier of the primary module for the enclave. #### [` family_id `]() inline const [short\_id\_t]( "LIEF::PE::EnclaveImport::short_id_t") &family\_id() const The family identifier of the primary module for the enclave. #### [` image_id `]() inline const [short\_id\_t]( "LIEF::PE::EnclaveImport::short_id_t") &image\_id() const The image identifier of the primary module for the enclave. #### [` import_name_rva `]() inline uint32\_t import\_name\_rva() const The relative virtual address of a NULL-terminated string that contains the same value found in the import directory for the image. #### [` import_name `]() inline std::string\_view import\_name() const Resolved import name. #### [` reserved `]() inline uint32\_t reserved() const Reserved. Should be 0. #### [` type `]() inline [EnclaveImport]( "LIEF::PE::EnclaveImport") &type([TYPE]( "LIEF::PE::EnclaveImport::TYPE") ty) #### [` min_security_version `]() inline [EnclaveImport]( "LIEF::PE::EnclaveImport") &min\_security\_version(uint32\_t value) #### [` id `]() inline [EnclaveImport]( "LIEF::PE::EnclaveImport") &id(const [long\_id\_t]( "LIEF::PE::EnclaveImport::long_id_t") &value) #### [` family_id `]() inline [EnclaveImport]( "LIEF::PE::EnclaveImport") &family\_id(const [short\_id\_t]( "LIEF::PE::EnclaveImport::short_id_t") &value) #### [` image_id `]() inline [EnclaveImport]( "LIEF::PE::EnclaveImport") &image\_id(const [short\_id\_t]( "LIEF::PE::EnclaveImport::short_id_t") &value) #### [` import_name_rva `]() inline [EnclaveImport]( "LIEF::PE::EnclaveImport") &import\_name\_rva(uint32\_t value) #### [` reserved `]() inline [EnclaveImport]( "LIEF::PE::EnclaveImport") &reserved(uint32\_t value) #### [` import_name `]() inline [EnclaveImport]( "LIEF::PE::EnclaveImport") &import\_name(std::string name) #### [` to_string `]() std::string to\_string() const Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [EnclaveImport]( "LIEF::PE::EnclaveImport") &meta) --- ## [Volatile Metadata]() ### [` VolatileMetadata `]() class VolatileMetadata This class represents volatile metadata which can be enabled at link time with `/volatileMetadata`. This metadata aims to improve performances when running x64 code on ARM64. Public Types #### [` access_table_t `]() using access\_table\_t = std::vector<uint32\_t> #### [` info_ranges_t `]() using info\_ranges\_t = std::vector<[range\_t]( "LIEF::PE::VolatileMetadata::range_t")> #### [` it_info_ranges_t `]() using it\_info\_ranges\_t = [ref\_iterator]( "LIEF::ref_iterator")<[info\_ranges\_t]( "LIEF::PE::VolatileMetadata::info_ranges_t")&> #### [` it_const_info_ranges_t `]() using it\_const\_info\_ranges\_t = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [info\_ranges\_t]( "LIEF::PE::VolatileMetadata::info_ranges_t")&> Public Functions #### [` VolatileMetadata `]() VolatileMetadata() = default #### [` VolatileMetadata `]() VolatileMetadata(const [VolatileMetadata]( "LIEF::PE::VolatileMetadata::VolatileMetadata")&) = default #### [` operator= `]() [VolatileMetadata]( "LIEF::PE::VolatileMetadata") &operator=(const [VolatileMetadata]( "LIEF::PE::VolatileMetadata")&) = default #### [` VolatileMetadata `]() VolatileMetadata([VolatileMetadata]( "LIEF::PE::VolatileMetadata::VolatileMetadata")&&) = default #### [` operator= `]() [VolatileMetadata]( "LIEF::PE::VolatileMetadata") &operator=([VolatileMetadata]( "LIEF::PE::VolatileMetadata")&&) = default #### [` clone `]() inline std::unique\_ptr<[VolatileMetadata]( "LIEF::PE::VolatileMetadata")> clone() const #### [` size `]() inline uint32\_t size() const Size (in bytes) of the current raw structure. #### [` min_version `]() inline uint16\_t min\_version() const #### [` max_version `]() inline uint16\_t max\_version() const #### [` access_table_rva `]() inline uint32\_t access\_table\_rva() const #### [` access_table `]() inline const [access\_table\_t]( "LIEF::PE::VolatileMetadata::access_table_t") &access\_table() const #### [` access_table_size `]() inline uint32\_t access\_table\_size() const #### [` info_range_rva `]() inline uint32\_t info\_range\_rva() const #### [` info_ranges_size `]() inline uint32\_t info\_ranges\_size() const #### [` info_ranges `]() inline [it\_const\_info\_ranges\_t]( "LIEF::PE::VolatileMetadata::it_const_info_ranges_t") info\_ranges() const #### [` info_ranges `]() inline [it\_info\_ranges\_t]( "LIEF::PE::VolatileMetadata::it_info_ranges_t") info\_ranges() #### [` size `]() inline [VolatileMetadata]( "LIEF::PE::VolatileMetadata") &size(uint32\_t value) #### [` min_version `]() inline [VolatileMetadata]( "LIEF::PE::VolatileMetadata") &min\_version(uint16\_t min) #### [` max_version `]() inline [VolatileMetadata]( "LIEF::PE::VolatileMetadata") &max\_version(uint16\_t max) #### [` access_table_rva `]() inline [VolatileMetadata]( "LIEF::PE::VolatileMetadata") &access\_table\_rva(uint32\_t value) #### [` info_range_rva `]() inline [VolatileMetadata]( "LIEF::PE::VolatileMetadata") &info\_range\_rva(uint32\_t value) #### [` to_string `]() std::string to\_string() const Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [VolatileMetadata]( "LIEF::PE::VolatileMetadata") &meta) #### [` range_t `]() struct range\_t Public Functions ##### [` end `]() inline uint32\_t end() const Public Members ##### [` start `]() uint32\_t start = 0 ##### [` size `]() uint32\_t size = 0 --- ## [Utilities]() ### [` LIEF::PE::check_layout `]() bool LIEF::PE::check\_layout(const [Binary]( "LIEF::PE::Binary") &bin, std::string \*error\_info = nullptr) Check that the layout of the given [Binary]() is correct from the Windows loader perspective. ### [` LIEF::PE::get_type `]() [result]( "LIEF::result")<[PE\_TYPE]( "LIEF::PE::PE_TYPE")> LIEF::PE::get\_type(std::string\_view file) if the input `file` is a PE one, return `PE32` or `PE32+` ### [` LIEF::PE::get_type `]() [result]( "LIEF::result")<[PE\_TYPE]( "LIEF::PE::PE_TYPE")> LIEF::PE::get\_type(const std::vector<uint8\_t> &raw) Return `PE32` or `PE32+`. ### [` LIEF::PE::is_pe `]() bool LIEF::PE::is\_pe(std::string\_view file) check if the `file` is a PE file ### [` LIEF::PE::is_pe `]() bool LIEF::PE::is\_pe(const std::vector<uint8\_t> &raw) check if the raw data is a PE file ### [` LIEF::PE::get_imphash `]() std::string LIEF::PE::get\_imphash(const [Binary]( "LIEF::PE::Binary") &binary, [IMPHASH\_MODE]( "LIEF::PE::IMPHASH_MODE") mode = [IMPHASH\_MODE]( "LIEF::PE::IMPHASH_MODE")::[DEFAULT]( "LIEF::PE::IMPHASH_MODE::DEFAULT")) Compute the hash of imported functions. By default, it generates a hash with the following properties: - Order agnostic - Case agnostic - Ordinal (**in some extent**) agnostic If one needs the same output as Virus Total (i.e. pefile), you can pass [IMPHASH\_MODE::PEFILE]() as second parameter. > **See also** > > [https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html]() > **Warning** > > The default algorithm used to compute the *imphash* value has some variations compared to Yara, pefile, VT implementation ### [` LIEF::PE::IMPHASH_MODE `]() enum class [LIEF]( "LIEF::PE::IMPHASH_MODE::LIEF")::PE::IMPHASH\_MODE Enum to define the behavior of [LIEF::PE::get\_imphash](). *Values:* #### [` DEFAULT `]() enumerator DEFAULT = 0 Default implementation. #### [` LIEF `]() enumerator LIEF = [DEFAULT]( "LIEF::PE::IMPHASH_MODE::DEFAULT") Same as [IMPHASH\_MODE::DEFAULT](). #### [` PEFILE `]() enumerator PEFILE Use pefile algorithm. #### [` VT `]() enumerator VT = [PEFILE]( "LIEF::PE::IMPHASH_MODE::PEFILE") Same as [IMPHASH\_MODE::PEFILE]() since Virus Total is using pefile. ### [` LIEF::PE::resolve_ordinals `]() [result]( "LIEF::result")<[Import]( "LIEF::PE::Import")> LIEF::PE::resolve\_ordinals(const [Import]( "LIEF::PE::Import") &import, bool strict = false, bool use\_std = false) Take a [PE::Import]() as entry and try to resolve imports by ordinal. The `strict` boolean parameter enables to throw an LIEF::not\_found exception if the ordinal can’t be resolved. Otherwise, it skips the entry. **Parameters:** - **import** – **[in]** [Import]() to resolve - **strict** – **[in]** If set to `true`, throw an exception if the import can’t be resolved - **use\_std** – **[in]** If `true`, it will use the [pefile]() look-up table for resolving imports **Returns:** The PE::import resolved with [PE::ImportEntry::name]() set ### [` LIEF::PE::oid_to_string `]() const char \*LIEF::PE::oid\_to\_string(const oid\_t &oid) Convert an OID to a human-readable string. --- ## [Enums]() ### [` LIEF::PE::PE_TYPE `]() enum class LIEF::PE::PE\_TYPE : uint16\_t *Values:* #### [` PE32 `]() enumerator PE32 = 0x10b 32bits #### [` PE32_PLUS `]() enumerator PE32\_PLUS = 0x20b 64 bits ### [` LIEF::PE::CODE_PAGES `]() enum class LIEF::PE::CODE\_PAGES : uint32\_t Code page from [https://docs.microsoft.com/en-us/windows/win32/intl/code-page-identifiers](). *Values:* #### [` IBM037 `]() enumerator IBM037 = 37 IBM EBCDIC US-Canada #### [` IBM437 `]() enumerator IBM437 = 437 OEM United States #### [` IBM500 `]() enumerator IBM500 = 500 IBM EBCDIC International #### [` ASMO_708 `]() enumerator ASMO\_708 = 708 Arabic (ASMO 708) #### [` DOS_720 `]() enumerator DOS\_720 = 720 Arabic (Transparent ASMO); Arabic (DOS) #### [` IBM737 `]() enumerator IBM737 = 737 OEM Greek (formerly 437G); Greek (DOS) #### [` IBM775 `]() enumerator IBM775 = 775 OEM Baltic; Baltic (DOS) #### [` IBM850 `]() enumerator IBM850 = 850 OEM Multilingual Latin 1; Western European (DOS) #### [` IBM852 `]() enumerator IBM852 = 852 OEM Latin 2; Central European (DOS) #### [` IBM855 `]() enumerator IBM855 = 855 OEM Cyrillic (primarily Russian) #### [` IBM857 `]() enumerator IBM857 = 857 OEM Turkish; Turkish (DOS) #### [` IBM00858 `]() enumerator IBM00858 = 858 OEM Multilingual Latin 1 + Euro symbol #### [` IBM860 `]() enumerator IBM860 = 860 OEM Portuguese; Portuguese (DOS) #### [` IBM861 `]() enumerator IBM861 = 861 OEM Icelandic; Icelandic (DOS) #### [` DOS_862 `]() enumerator DOS\_862 = 862 OEM Hebrew; Hebrew (DOS) #### [` IBM863 `]() enumerator IBM863 = 863 OEM French Canadian; French Canadian (DOS) #### [` IBM864 `]() enumerator IBM864 = 864 OEM Arabic; Arabic (864) #### [` IBM865 `]() enumerator IBM865 = 865 OEM Nordic; Nordic (DOS) #### [` CP866 `]() enumerator CP866 = 866 OEM Russian; Cyrillic (DOS) #### [` IBM869 `]() enumerator IBM869 = 869 OEM Modern Greek; Greek, Modern (DOS) #### [` IBM870 `]() enumerator IBM870 = 870 IBM EBCDIC Multilingual/ROECE (Latin 2); IBM EBCDIC Multilingual Latin 2 #### [` WINDOWS_874 `]() enumerator WINDOWS\_874 = 874 ANSI/OEM Thai (same as 28605, ISO 8859-15); Thai (Windows) #### [` CP875 `]() enumerator CP875 = 875 IBM EBCDIC Greek Modern #### [` SHIFT_JIS `]() enumerator SHIFT\_JIS = 932 ANSI/OEM Japanese; Japanese (Shift-JIS) #### [` GB2312 `]() enumerator GB2312 = 936 ANSI/OEM Simplified Chinese (PRC, Singapore); Chinese Simplified (GB2312) #### [` KS_C_5601_1987 `]() enumerator KS\_C\_5601\_1987 = 949 ANSI/OEM Korean (Unified Hangul Code) #### [` BIG5 `]() enumerator BIG5 = 950 ANSI/OEM Traditional Chinese (Taiwan; Hong Kong SAR, PRC); Chinese Traditional (Big5) #### [` IBM1026 `]() enumerator IBM1026 = 1026 IBM EBCDIC Turkish (Latin 5) #### [` IBM01047 `]() enumerator IBM01047 = 1047 IBM EBCDIC Latin 1/Open System #### [` IBM01140 `]() enumerator IBM01140 = 1140 IBM EBCDIC US-Canada (037 + Euro symbol); IBM EBCDIC (US-Canada-Euro) #### [` IBM01141 `]() enumerator IBM01141 = 1141 IBM EBCDIC Germany (20273 + Euro symbol); IBM EBCDIC (Germany-Euro) #### [` IBM01142 `]() enumerator IBM01142 = 1142 IBM EBCDIC Denmark-Norway (20277 + Euro symbol); IBM EBCDIC (Denmark-Norway-Euro) #### [` IBM01143 `]() enumerator IBM01143 = 1143 IBM EBCDIC Finland-Sweden (20278 + Euro symbol); IBM EBCDIC (Finland-Sweden-Euro) #### [` IBM01144 `]() enumerator IBM01144 = 1144 IBM EBCDIC Italy (20280 + Euro symbol); IBM EBCDIC (Italy-Euro) #### [` IBM01145 `]() enumerator IBM01145 = 1145 IBM EBCDIC Latin America-Spain (20284 + Euro symbol); IBM EBCDIC (Spain-Euro) #### [` IBM01146 `]() enumerator IBM01146 = 1146 IBM EBCDIC United Kingdom (20285 + Euro symbol); IBM EBCDIC (UK-Euro) #### [` IBM01147 `]() enumerator IBM01147 = 1147 IBM EBCDIC France (20297 + Euro symbol); IBM EBCDIC (France-Euro) #### [` IBM01148 `]() enumerator IBM01148 = 1148 IBM EBCDIC International (500 + Euro symbol); IBM EBCDIC (International-Euro) #### [` IBM01149 `]() enumerator IBM01149 = 1149 IBM EBCDIC Icelandic (20871 + Euro symbol); IBM EBCDIC (Icelandic-Euro) #### [` UTF_16 `]() enumerator UTF\_16 = 1200 Unicode UTF-16, little endian byte order (BMP of ISO 10646); available only to managed applications #### [` UNICODEFFFE `]() enumerator UNICODEFFFE = 1201 Unicode UTF-16, big endian byte order; available only to managed applications #### [` WINDOWS_1250 `]() enumerator WINDOWS\_1250 = 1250 ANSI Central European; Central European (Windows) #### [` WINDOWS_1251 `]() enumerator WINDOWS\_1251 = 1251 ANSI Cyrillic; Cyrillic (Windows) #### [` WINDOWS_1252 `]() enumerator WINDOWS\_1252 = 1252 ANSI Latin 1; Western European (Windows) #### [` WINDOWS_1253 `]() enumerator WINDOWS\_1253 = 1253 ANSI Greek; Greek (Windows) #### [` WINDOWS_1254 `]() enumerator WINDOWS\_1254 = 1254 ANSI Turkish; Turkish (Windows) #### [` WINDOWS_1255 `]() enumerator WINDOWS\_1255 = 1255 ANSI Hebrew; Hebrew (Windows) #### [` WINDOWS_1256 `]() enumerator WINDOWS\_1256 = 1256 ANSI Arabic; Arabic (Windows) #### [` WINDOWS_1257 `]() enumerator WINDOWS\_1257 = 1257 ANSI Baltic; Baltic (Windows) #### [` WINDOWS_1258 `]() enumerator WINDOWS\_1258 = 1258 ANSI/OEM Vietnamese; Vietnamese (Windows) #### [` JOHAB `]() enumerator JOHAB = 1361 Korean (Johab) #### [` MACINTOSH `]() enumerator MACINTOSH = 10000 MAC Roman; Western European (Mac) #### [` X_MAC_JAPANESE `]() enumerator X\_MAC\_JAPANESE = 10001 Japanese (Mac) #### [` X_MAC_CHINESETRAD `]() enumerator X\_MAC\_CHINESETRAD = 10002 MAC Traditional Chinese (Big5); Chinese Traditional (Mac) #### [` X_MAC_KOREAN `]() enumerator X\_MAC\_KOREAN = 10003 Korean (Mac) #### [` X_MAC_ARABIC `]() enumerator X\_MAC\_ARABIC = 10004 Arabic (Mac) #### [` X_MAC_HEBREW `]() enumerator X\_MAC\_HEBREW = 10005 Hebrew (Mac) #### [` X_MAC_GREEK `]() enumerator X\_MAC\_GREEK = 10006 Greek (Mac) #### [` X_MAC_CYRILLIC `]() enumerator X\_MAC\_CYRILLIC = 10007 Cyrillic (Mac) #### [` X_MAC_CHINESESIMP `]() enumerator X\_MAC\_CHINESESIMP = 10008 MAC Simplified Chinese (GB 2312); Chinese Simplified (Mac) #### [` X_MAC_ROMANIAN `]() enumerator X\_MAC\_ROMANIAN = 10010 Romanian (Mac) #### [` X_MAC_UKRAINIAN `]() enumerator X\_MAC\_UKRAINIAN = 10017 Ukrainian (Mac) #### [` X_MAC_THAI `]() enumerator X\_MAC\_THAI = 10021 Thai (Mac) #### [` X_MAC_CE `]() enumerator X\_MAC\_CE = 10029 MAC Latin 2; Central European (Mac) #### [` X_MAC_ICELANDIC `]() enumerator X\_MAC\_ICELANDIC = 10079 Icelandic (Mac) #### [` X_MAC_TURKISH `]() enumerator X\_MAC\_TURKISH = 10081 Turkish (Mac) #### [` X_MAC_CROATIAN `]() enumerator X\_MAC\_CROATIAN = 10082 Croatian (Mac) #### [` UTF_32 `]() enumerator UTF\_32 = 12000 Unicode UTF-32, little endian byte order; available only to managed applications #### [` UTF_32BE `]() enumerator UTF\_32BE = 12001 Unicode UTF-32, big endian byte order; available only to managed applications #### [` X_CHINESE_CNS `]() enumerator X\_CHINESE\_CNS = 20000 CNS Taiwan; Chinese Traditional (CNS) #### [` X_CP20001 `]() enumerator X\_CP20001 = 20001 TCA Taiwan #### [` X_CHINESE_ETEN `]() enumerator X\_CHINESE\_ETEN = 20002 Eten Taiwan; Chinese Traditional (Eten) #### [` X_CP20003 `]() enumerator X\_CP20003 = 20003 IBM5550 Taiwan #### [` X_CP20004 `]() enumerator X\_CP20004 = 20004 TeleText Taiwan #### [` X_CP20005 `]() enumerator X\_CP20005 = 20005 Wang Taiwan #### [` X_IA5 `]() enumerator X\_IA5 = 20105 IA5 (IRV International Alphabet No. 5, 7-bit); Western European (IA5) #### [` X_IA5_GERMAN `]() enumerator X\_IA5\_GERMAN = 20106 IA5 German (7-bit) #### [` X_IA5_SWEDISH `]() enumerator X\_IA5\_SWEDISH = 20107 IA5 Swedish (7-bit) #### [` X_IA5_NORWEGIAN `]() enumerator X\_IA5\_NORWEGIAN = 20108 IA5 Norwegian (7-bit) #### [` US_ASCII `]() enumerator US\_ASCII = 20127 US-ASCII (7-bit) #### [` X_CP20261 `]() enumerator X\_CP20261 = 20261 T.61 #### [` X_CP20269 `]() enumerator X\_CP20269 = 20269 ISO 6937 Non-Spacing Accent #### [` IBM273 `]() enumerator IBM273 = 20273 IBM EBCDIC Germany #### [` IBM277 `]() enumerator IBM277 = 20277 IBM EBCDIC Denmark-Norway #### [` IBM278 `]() enumerator IBM278 = 20278 IBM EBCDIC Finland-Sweden #### [` IBM280 `]() enumerator IBM280 = 20280 IBM EBCDIC Italy #### [` IBM284 `]() enumerator IBM284 = 20284 IBM EBCDIC Latin America-Spain #### [` IBM285 `]() enumerator IBM285 = 20285 IBM EBCDIC United Kingdom #### [` IBM290 `]() enumerator IBM290 = 20290 IBM EBCDIC Japanese Katakana Extended #### [` IBM297 `]() enumerator IBM297 = 20297 IBM EBCDIC France #### [` IBM420 `]() enumerator IBM420 = 20420 IBM EBCDIC Arabic #### [` IBM423 `]() enumerator IBM423 = 20423 IBM EBCDIC Greek #### [` IBM424 `]() enumerator IBM424 = 20424 IBM EBCDIC Hebrew #### [` X_EBCDIC_KOREANEXTENDED `]() enumerator X\_EBCDIC\_KOREANEXTENDED = 20833 IBM EBCDIC Korean Extended #### [` IBM_THAI `]() enumerator IBM\_THAI = 20838 IBM EBCDIC Thai #### [` KOI8_R `]() enumerator KOI8\_R = 20866 Russian (KOI8-R); Cyrillic (KOI8-R) #### [` IBM871 `]() enumerator IBM871 = 20871 IBM EBCDIC Icelandic #### [` IBM880 `]() enumerator IBM880 = 20880 IBM EBCDIC Cyrillic Russian #### [` IBM905 `]() enumerator IBM905 = 20905 IBM EBCDIC Turkish #### [` IBM00924 `]() enumerator IBM00924 = 20924 IBM EBCDIC Latin 1/Open System (1047 + Euro symbol) #### [` EUC_JP_JIS `]() enumerator EUC\_JP\_JIS = 20932 Japanese (JIS 0208-1990 and 0121-1990) #### [` X_CP20936 `]() enumerator X\_CP20936 = 20936 Simplified Chinese (GB2312); Chinese Simplified (GB2312-80) #### [` X_CP20949 `]() enumerator X\_CP20949 = 20949 Korean Wansung #### [` CP1025 `]() enumerator CP1025 = 21025 IBM EBCDIC Cyrillic Serbian-Bulgarian #### [` KOI8_U `]() enumerator KOI8\_U = 21866 Ukrainian (KOI8-U); Cyrillic (KOI8-U) #### [` ISO_8859_1 `]() enumerator ISO\_8859\_1 = 28591 ISO 8859-1 Latin 1; Western European (ISO) #### [` ISO_8859_2 `]() enumerator ISO\_8859\_2 = 28592 ISO 8859-2 Central European; Central European (ISO) #### [` ISO_8859_3 `]() enumerator ISO\_8859\_3 = 28593 ISO 8859-3 Latin 3 #### [` ISO_8859_4 `]() enumerator ISO\_8859\_4 = 28594 ISO 8859-4 Baltic #### [` ISO_8859_5 `]() enumerator ISO\_8859\_5 = 28595 ISO 8859-5 Cyrillic #### [` ISO_8859_6 `]() enumerator ISO\_8859\_6 = 28596 ISO 8859-6 Arabic #### [` ISO_8859_7 `]() enumerator ISO\_8859\_7 = 28597 ISO 8859-7 Greek #### [` ISO_8859_8 `]() enumerator ISO\_8859\_8 = 28598 ISO 8859-8 Hebrew; Hebrew (ISO-Visual) #### [` ISO_8859_9 `]() enumerator ISO\_8859\_9 = 28599 ISO 8859-9 Turkish #### [` ISO_8859_13 `]() enumerator ISO\_8859\_13 = 28603 ISO 8859-13 Estonian #### [` ISO_8859_15 `]() enumerator ISO\_8859\_15 = 28605 ISO 8859-15 Latin 9 #### [` X_EUROPA `]() enumerator X\_EUROPA = 29001 Europa 3 #### [` ISO_8859_8_I `]() enumerator ISO\_8859\_8\_I = 38598 ISO 8859-8 Hebrew; Hebrew (ISO-Logical) #### [` ISO_2022_JP `]() enumerator ISO\_2022\_JP = 50220 ISO 2022 Japanese with no halfwidth Katakana; Japanese (JIS) #### [` CSISO2022JP `]() enumerator CSISO2022JP = 50221 ISO 2022 Japanese with halfwidth Katakana; Japanese (JIS-Allow 1 byte Kana) #### [` ISO_2022_JP_JIS `]() enumerator ISO\_2022\_JP\_JIS = 50222 ISO 2022 Japanese JIS X 0201-1989; Japanese (JIS-Allow 1 byte Kana - SO/SI) #### [` ISO_2022_KR `]() enumerator ISO\_2022\_KR = 50225 ISO 2022 Korean #### [` X_CP50227 `]() enumerator X\_CP50227 = 50227 ISO 2022 Simplified Chinese; Chinese Simplified (ISO 2022) #### [` EUC_JP `]() enumerator EUC\_JP = 51932 EUC Japanese #### [` EUC_CN `]() enumerator EUC\_CN = 51936 EUC Simplified Chinese; Chinese Simplified (EUC) #### [` EUC_KR `]() enumerator EUC\_KR = 51949 EUC Korean #### [` HZ_GB_2312 `]() enumerator HZ\_GB\_2312 = 52936 HZ-GB2312 Simplified Chinese; Chinese Simplified (HZ) #### [` GB18030 `]() enumerator GB18030 = 54936 Windows XP and later: GB18030 Simplified Chinese (4 byte); Chinese Simplified (GB18030) #### [` X_ISCII_DE `]() enumerator X\_ISCII\_DE = 57002 ISCII Devanagari #### [` X_ISCII_BE `]() enumerator X\_ISCII\_BE = 57003 ISCII Bengali #### [` X_ISCII_TA `]() enumerator X\_ISCII\_TA = 57004 ISCII Tamil #### [` X_ISCII_TE `]() enumerator X\_ISCII\_TE = 57005 ISCII Telugu #### [` X_ISCII_AS `]() enumerator X\_ISCII\_AS = 57006 ISCII Assamese #### [` X_ISCII_OR `]() enumerator X\_ISCII\_OR = 57007 ISCII Oriya #### [` X_ISCII_KA `]() enumerator X\_ISCII\_KA = 57008 ISCII Kannada #### [` X_ISCII_MA `]() enumerator X\_ISCII\_MA = 57009 ISCII Malayalam #### [` X_ISCII_GU `]() enumerator X\_ISCII\_GU = 57010 ISCII Gujarati #### [` X_ISCII_PA `]() enumerator X\_ISCII\_PA = 57011 ISCII Punjabi #### [` UTF_7 `]() enumerator UTF\_7 = 65000 Unicode (UTF-7) #### [` UTF_8 `]() enumerator UTF\_8 = 65001 Unicode (UTF-8) ### [` LIEF::PE::ALGORITHMS `]() enum class LIEF::PE::ALGORITHMS : uint32\_t Cryptography algorithms. *Values:* #### [` UNKNOWN `]() enumerator UNKNOWN = 0 #### [` SHA_512 `]() enumerator SHA\_512 #### [` SHA_384 `]() enumerator SHA\_384 #### [` SHA_256 `]() enumerator SHA\_256 #### [` SHA_1 `]() enumerator SHA\_1 #### [` MD5 `]() enumerator MD5 #### [` MD4 `]() enumerator MD4 #### [` MD2 `]() enumerator MD2 #### [` RSA `]() enumerator RSA #### [` EC `]() enumerator EC #### [` MD5_RSA `]() enumerator MD5\_RSA #### [` SHA1_DSA `]() enumerator SHA1\_DSA #### [` SHA1_RSA `]() enumerator SHA1\_RSA #### [` SHA_256_RSA `]() enumerator SHA\_256\_RSA #### [` SHA_384_RSA `]() enumerator SHA\_384\_RSA #### [` SHA_512_RSA `]() enumerator SHA\_512\_RSA #### [` SHA1_ECDSA `]() enumerator SHA1\_ECDSA #### [` SHA_256_ECDSA `]() enumerator SHA\_256\_ECDSA #### [` SHA_384_ECDSA `]() enumerator SHA\_384\_ECDSA #### [` SHA_512_ECDSA `]() enumerator SHA\_512\_ECDSA ### [` LIEF::PE::ACCELERATOR_CODES `]() enum class LIEF::PE::ACCELERATOR\_CODES : uint32\_t From [https://docs.microsoft.com/en-us/windows/win32/inputdev/virtual-key-codes](). *Values:* #### [` LBUTTON `]() enumerator LBUTTON = 0x01 #### [` RBUTTON `]() enumerator RBUTTON = 0x02 #### [` CANCEL `]() enumerator CANCEL = 0x03 #### [` MBUTTON `]() enumerator MBUTTON = 0x04 #### [` XBUTTON1_K `]() enumerator XBUTTON1\_K = 0x05 #### [` XBUTTON2_K `]() enumerator XBUTTON2\_K = 0x06 #### [` BACK `]() enumerator BACK = 0x08 #### [` TAB `]() enumerator TAB = 0x09 #### [` CLEAR `]() enumerator CLEAR = 0x0C #### [` RETURN `]() enumerator RETURN = 0x0D #### [` SHIFT `]() enumerator SHIFT = 0x10 #### [` CONTROL `]() enumerator CONTROL = 0x11 #### [` MENU `]() enumerator MENU = 0x12 #### [` PAUSE `]() enumerator PAUSE = 0x13 #### [` CAPITAL `]() enumerator CAPITAL = 0x14 #### [` KANA `]() enumerator KANA = 0x15 #### [` IME_ON `]() enumerator IME\_ON = 0x16 #### [` JUNJA `]() enumerator JUNJA = 0x17 #### [` FINAL `]() enumerator FINAL = 0x18 #### [` KANJI `]() enumerator KANJI = 0x19 #### [` IME_OFF `]() enumerator IME\_OFF = 0x1A #### [` ESCAPE `]() enumerator ESCAPE = 0x1B #### [` CONVERT `]() enumerator CONVERT = 0x1C #### [` NONCONVERT `]() enumerator NONCONVERT = 0x1D #### [` ACCEPT `]() enumerator ACCEPT = 0x1E #### [` MODECHANGE `]() enumerator MODECHANGE = 0x1F #### [` SPACE `]() enumerator SPACE = 0x20 #### [` PRIOR `]() enumerator PRIOR = 0x21 #### [` NEXT `]() enumerator NEXT = 0x22 #### [` END `]() enumerator END = 0x23 #### [` HOME `]() enumerator HOME = 0x24 #### [` LEFT `]() enumerator LEFT = 0x25 #### [` UP `]() enumerator UP = 0x26 #### [` RIGHT `]() enumerator RIGHT = 0x27 #### [` DOWN `]() enumerator DOWN = 0x28 #### [` SELECT `]() enumerator SELECT = 0x29 #### [` PRINT `]() enumerator PRINT = 0x2A #### [` EXECUTE `]() enumerator EXECUTE = 0x2B #### [` SNAPSHOT `]() enumerator SNAPSHOT = 0x2C #### [` INSERT `]() enumerator INSERT = 0x2D #### [` DELETE_K `]() enumerator DELETE\_K = 0x2E #### [` HELP `]() enumerator HELP = 0x2F #### [` NUM_0 `]() enumerator NUM\_0 = 0x30 #### [` NUM_1 `]() enumerator NUM\_1 = 0x31 #### [` NUM_2 `]() enumerator NUM\_2 = 0x32 #### [` NUM_3 `]() enumerator NUM\_3 = 0x33 #### [` NUM_4 `]() enumerator NUM\_4 = 0x34 #### [` NUM_5 `]() enumerator NUM\_5 = 0x35 #### [` NUM_6 `]() enumerator NUM\_6 = 0x36 #### [` NUM_7 `]() enumerator NUM\_7 = 0x37 #### [` NUM_8 `]() enumerator NUM\_8 = 0x38 #### [` NUM_9 `]() enumerator NUM\_9 = 0x39 #### [` A `]() enumerator A = 0x41 #### [` B `]() enumerator B = 0x42 #### [` C `]() enumerator C = 0x43 #### [` D `]() enumerator D = 0x44 #### [` E `]() enumerator E = 0x45 #### [` F `]() enumerator F = 0x46 #### [` G `]() enumerator G = 0x47 #### [` H `]() enumerator H = 0x48 #### [` I `]() enumerator I = 0x49 #### [` J `]() enumerator J = 0x4A #### [` K `]() enumerator K = 0x4B #### [` L `]() enumerator L = 0x4C #### [` M `]() enumerator M = 0x4D #### [` N `]() enumerator N = 0x4E #### [` O `]() enumerator O = 0x4F #### [` P `]() enumerator P = 0x50 #### [` Q `]() enumerator Q = 0x51 #### [` R `]() enumerator R = 0x52 #### [` S `]() enumerator S = 0x53 #### [` T `]() enumerator T = 0x54 #### [` U `]() enumerator U = 0x55 #### [` V `]() enumerator V = 0x56 #### [` W `]() enumerator W = 0x57 #### [` X `]() enumerator X = 0x58 #### [` Y `]() enumerator Y = 0x59 #### [` Z `]() enumerator Z = 0x5A #### [` LWIN `]() enumerator LWIN = 0x5B #### [` RWIN `]() enumerator RWIN = 0x5C #### [` APPS `]() enumerator APPS = 0x5D #### [` SLEEP `]() enumerator SLEEP = 0x5F #### [` NUMPAD0 `]() enumerator NUMPAD0 = 0x60 #### [` NUMPAD1 `]() enumerator NUMPAD1 = 0x61 #### [` NUMPAD2 `]() enumerator NUMPAD2 = 0x62 #### [` NUMPAD3 `]() enumerator NUMPAD3 = 0x63 #### [` NUMPAD4 `]() enumerator NUMPAD4 = 0x64 #### [` NUMPAD5 `]() enumerator NUMPAD5 = 0x65 #### [` NUMPAD6 `]() enumerator NUMPAD6 = 0x66 #### [` NUMPAD7 `]() enumerator NUMPAD7 = 0x67 #### [` NUMPAD8 `]() enumerator NUMPAD8 = 0x68 #### [` NUMPAD9 `]() enumerator NUMPAD9 = 0x69 #### [` MULTIPLY `]() enumerator MULTIPLY = 0x6A #### [` ADD `]() enumerator ADD = 0x6B #### [` SEPARATOR `]() enumerator SEPARATOR = 0x6C #### [` SUBTRACT `]() enumerator SUBTRACT = 0x6D #### [` DECIMAL `]() enumerator DECIMAL = 0x6E #### [` DIVIDE `]() enumerator DIVIDE = 0x6F #### [` F1 `]() enumerator F1 = 0x70 #### [` F2 `]() enumerator F2 = 0x71 #### [` F3 `]() enumerator F3 = 0x72 #### [` F4 `]() enumerator F4 = 0x73 #### [` F5 `]() enumerator F5 = 0x74 #### [` F6 `]() enumerator F6 = 0x75 #### [` F7 `]() enumerator F7 = 0x76 #### [` F8 `]() enumerator F8 = 0x77 #### [` F9 `]() enumerator F9 = 0x78 #### [` F10 `]() enumerator F10 = 0x79 #### [` F11 `]() enumerator F11 = 0x7A #### [` F12 `]() enumerator F12 = 0x7B #### [` F13 `]() enumerator F13 = 0x7C #### [` F14 `]() enumerator F14 = 0x7D #### [` F15 `]() enumerator F15 = 0x7E #### [` F16 `]() enumerator F16 = 0x7F #### [` F17 `]() enumerator F17 = 0x80 #### [` F18 `]() enumerator F18 = 0x81 #### [` F19 `]() enumerator F19 = 0x82 #### [` F20 `]() enumerator F20 = 0x83 #### [` F21 `]() enumerator F21 = 0x84 #### [` F22 `]() enumerator F22 = 0x85 #### [` F23 `]() enumerator F23 = 0x86 #### [` F24 `]() enumerator F24 = 0x87 #### [` NUMLOCK `]() enumerator NUMLOCK = 0x90 #### [` SCROLL `]() enumerator SCROLL = 0x91 #### [` LSHIFT `]() enumerator LSHIFT = 0xA0 #### [` RSHIFT `]() enumerator RSHIFT = 0xA1 #### [` LCONTROL `]() enumerator LCONTROL = 0xA2 #### [` RCONTROL `]() enumerator RCONTROL = 0xA3 #### [` LMENU `]() enumerator LMENU = 0xA4 #### [` RMENU `]() enumerator RMENU = 0xA5 #### [` BROWSER_BACK `]() enumerator BROWSER\_BACK = 0xA6 #### [` BROWSER_FORWARD `]() enumerator BROWSER\_FORWARD = 0xA7 #### [` BROWSER_REFRESH `]() enumerator BROWSER\_REFRESH = 0xA8 #### [` BROWSER_STOP `]() enumerator BROWSER\_STOP = 0xA9 #### [` BROWSER_SEARCH `]() enumerator BROWSER\_SEARCH = 0xAA #### [` BROWSER_FAVORITES `]() enumerator BROWSER\_FAVORITES = 0xAB #### [` BROWSER_HOME `]() enumerator BROWSER\_HOME = 0xAC #### [` VOLUME_MUTE `]() enumerator VOLUME\_MUTE = 0xAD #### [` VOLUME_DOWN `]() enumerator VOLUME\_DOWN = 0xAE #### [` VOLUME_UP `]() enumerator VOLUME\_UP = 0xAF #### [` MEDIA_NEXT_TRACK `]() enumerator MEDIA\_NEXT\_TRACK = 0xB0 #### [` MEDIA_PREV_TRACK `]() enumerator MEDIA\_PREV\_TRACK = 0xB1 #### [` MEDIA_STOP `]() enumerator MEDIA\_STOP = 0xB2 #### [` MEDIA_PLAY_PAUSE `]() enumerator MEDIA\_PLAY\_PAUSE = 0xB3 #### [` LAUNCH_MAIL `]() enumerator LAUNCH\_MAIL = 0xB4 #### [` LAUNCH_MEDIA_SELECT `]() enumerator LAUNCH\_MEDIA\_SELECT = 0xB5 #### [` LAUNCH_APP1 `]() enumerator LAUNCH\_APP1 = 0xB6 #### [` LAUNCH_APP2 `]() enumerator LAUNCH\_APP2 = 0xB7 #### [` OEM_1 `]() enumerator OEM\_1 = 0xBA #### [` OEM_PLUS `]() enumerator OEM\_PLUS = 0xBB #### [` OEM_COMMA `]() enumerator OEM\_COMMA = 0xBC #### [` OEM_MINUS `]() enumerator OEM\_MINUS = 0xBD #### [` OEM_PERIOD `]() enumerator OEM\_PERIOD = 0xBE #### [` OEM_2 `]() enumerator OEM\_2 = 0xBF #### [` OEM_4 `]() enumerator OEM\_4 = 0xDB #### [` OEM_5 `]() enumerator OEM\_5 = 0xDC #### [` OEM_6 `]() enumerator OEM\_6 = 0xDD #### [` OEM_7 `]() enumerator OEM\_7 = 0xDE #### [` OEM_8 `]() enumerator OEM\_8 = 0xDF #### [` OEM_102 `]() enumerator OEM\_102 = 0xE2 #### [` PROCESSKEY `]() enumerator PROCESSKEY = 0xE5 #### [` PACKET `]() enumerator PACKET = 0xE7 #### [` ATTN `]() enumerator ATTN = 0xF6 #### [` CRSEL `]() enumerator CRSEL = 0xF7 #### [` EXSEL `]() enumerator EXSEL = 0xF8 #### [` EREOF `]() enumerator EREOF = 0xF9 #### [` PLAY `]() enumerator PLAY = 0xFA #### [` ZOOM `]() enumerator ZOOM = 0xFB #### [` NONAME `]() enumerator NONAME = 0xFC #### [` PA1 `]() enumerator PA1 = 0xFD #### [` OEM_CLEAR `]() enumerator OEM\_CLEAR = 0xFE --- documentID: "85b1a75d1f46fecf3727285bb326e2e96bdb0244f38375f18118f73bebd1de51" docname: "formats/pe/index" title: "PE - LIEF Documentation" description: "PE binaries can be parsed using the lief.PE.parse() function." canonical: "https://lief.re/doc/latest/formats/pe/index.html" markdownURL: "https://lief.re/doc/latest/formats/pe/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "69210fc49b148d62c568557b381776ff684310af1572a25f5b78c4cb10b00163" --- # [PE]() API - [C++]() - [Python]() - [Rust]() Modifications - [Imports Modification]() - [Resources Modification]() - [TLS Modification]() - [Debug Modification]() - [Exports Modification]() ## [Introduction]() PE binaries can be parsed using the `lief.PE.parse()` ( [`lief::pe::Binary::parse`]() ; [`lief.PE.parse()`]() ; [`LIEF::PE::Parser::parse()`]() ) function. **Python** ```python import lief # Using filepath pe: lief.PE.Binary | None = lief.PE.parse(r"C:\Users\test.exe") # Using a Path from pathlib pe: lief.PE.Binary | None = lief.PE.parse(pathlib.Path(r"C:\Users\test.exe")) # Using an io object with open(r"C:\Users\test.exe", "rb") as f: pe: lief.PE.Binary | None = lief.PE.parse(f) ``` **C++** ```cpp #include // Using a file path as a std::string std::unique_ptr pe = LIEF::PE::Parser::parse("some.exe"); // Using a vector std::vector my_raw_pe; pe = LIEF::PE::Parser::parse(my_raw_pe); ``` **Rust** ```rust let pe: lief::pe::Binary = lief::pe::Binary::parse("/bin/ls").unwrap(); ``` > **Note** > > In Python, you can also use the generic [`lief.parse()`]( "lief.parse"), which returns a [`lief.PE.Binary`]( "lief.PE.Binary") object. With the parsed PE binary, you can use the `lief.PE.Binary` ( [`lief::pe::Binary`]() ; [`lief.PE.Binary`]() ; [`LIEF::PE::Binary`]() ) API to inspect or modify the binary itself. **Python** ```python pe: lief.PE.Binary print(pe.rich_header) print(pe.authentihash_md5.hex(":")) for section in pe.sections: print(section.name, len(section.content)) ``` **C++** ```cpp std::unique_ptr pe; if (const LIEF::PE::RichHeader* rich = pe->rich_header()) { std::cout << *rich << '\n'; } for (const LIEF::PE::Section& section : pe->sections()) { std::cout << section.name() << section.content().size() << '\n'; } ``` **Rust** ```rust let pe: &lief::pe::Binary = some_pe; println!("{:?}", pe.rich_header().expect("Missing Rich header")); for section in pe.sections() { println!("{} {}", section.name(), section.content().len()); } ``` After modifying a `lief.PE.Binary` ( [`lief::pe::Binary`]() ; [`lief.PE.Binary`]() ; [`LIEF::PE::Binary`]() ) object, you can use `lief.PE.Binary.write()` ( [`lief::pe::Binary::write`]() ; [`lief.PE.Binary.write()`]() ; [`LIEF::PE::Binary::write()`]() ) to write the changes back to a raw PE file. **Python** ```python pe: lief.PE.Binary section = lief.PE.Section(".hello") section.content = [0xCC] * 0x100 pe.add_section(section) pe.write("new.exe") ``` **C++** ```cpp std::unique_ptr pe; LIEF::PE::Section section(".hello"); section.content(std::vector(0x100, 0xCC)); pe->add_section(section); pe->write("new.exe"); ``` **Rust** ```rust let mut pe = lief::pe::Binary::parse("some.exe").unwrap(); let mut section = lief::pe::Section::new_with_name(".hello"); section.set_content(&[0xCC; 0x100]); pe.add_section(section); pe.write("new.exe"); ``` > **See also** > > [Binary Abstraction]() ## [Dump Analysis]() LIEF has the support to process PE memory dump with `lief.PE.parse_from_dump()` ( [`lief::pe::Binary::parse_from_dump`]() ; [`lief.PE.parse_from_dump()`]() ; [`LIEF::PE::Parser::parse_from_dump()`]() ). This function translates the file offsets referenced by the PE structures into their location inside the dump, using the base address passed as the second parameter: **Python** ```python # 0x7ffd21b80000 is the (absolute) address at which the dump was mapped pe = lief.PE.parse_from_dump("module.dump", 0x7FFD21B80000) assert isinstance(pe, lief.PE.Binary) for imp in pe.imports: print(imp.name) ``` **C++** ```cpp auto pe = LIEF::PE::Parser::parse_from_dump("module.dump", 0x7ffd21b80000); for (const LIEF::PE::Import& imp : pe->imports()) { std::cout << imp.name() << '\n'; } ``` **Rust** ```rust let pe = lief::pe::Binary::parse_from_dump("module.dump", 0x7ffd_21b8_0000).unwrap(); for imp in pe.imports() { println!("{}", imp.name()); } ``` > **Note** > > The second parameter **must** be the (absolute) virtual address at which the dump was mapped. It is used to convert the RVAs found in the PE structures back into an offset within the dump. ### [Producing a dump with the runtime API]() Such a dump can be produced from a live process thanks to the LIEF [runtime]() and, more precisely, the [Module API](). `lief.runtime.Module.dump()` ( [`lief::runtime::module::Module::dump`]() ; [`lief.runtime.Module.dump()`]() ; [`LIEF::runtime::Module::dump()`]() ) captures the memory of a loaded module (from its imagebase over its virtual size): **Python** ```python # Find the module to dump in the current process mod = lief.runtime.module_from_name("target.dll") assert isinstance(mod, lief.runtime.windows.Module) # Dump the module's memory into a file (the raw bytes are also returned) ... data: bytes = mod.dump("module.dump") # ... and parse it back using the same imagebase: pe = lief.PE.parse_from_dump(data, mod.imagebase) ``` **C++** ```cpp // Find the module to dump in the current process auto mod = LIEF::runtime::module_from_name("target.dll"); // Dump the module's memory into a file (the raw bytes are also returned) std::vector data = mod->dump("module.dump"); auto pe = LIEF::PE::Parser::parse_from_dump("module.dump", mod->imagebase()); ``` **Rust** ```rust use lief::runtime::Module; let module = lief::runtime::module_from_name("target.dll").unwrap(); // Dump the module's memory into a file (the raw bytes are also returned) let data = module.dump_to_file("module.dump"); let pe = lief::pe::Binary::parse_from_dump("module.dump", module.imagebase()).unwrap(); ``` ## [Advanced Parsing/Writing]() Modifications - [Imports Modification]() - [Resources Modification]() - [TLS Modification]() `lief.PE.parse()` ( [`lief::pe::Binary::parse`]() ; [`lief.PE.parse()`]() ; [`LIEF::PE::Parser::parse()`]() ) can take an extra `lief.PE.ParserConfig` ( [`lief::pe::ParserConfig`]() ; [`lief.PE.ParserConfig`]() ; [`LIEF::PE::ParserConfig`]() ) parameter to specify parts of the PE format to ignore during parsing. > **Warning** > > Generally, `lief.PE.Binary.write()` ( [`lief::pe::Binary::write`]() ; [`lief.PE.Binary.write()`]() ; [`LIEF::PE::Binary::write()`]() ) requires a **complete** initial parsing of the PE file. Similarly, `lief.PE.Binary.write()` ( [`lief::pe::Binary::write`]() ; [`lief.PE.Binary.write()`]() ; [`LIEF::PE::Binary::write()`]() ) can take an extra `lief.PE.Builder.config_t` ( [`lief::pe::::builder::Config`]() ; [`lief.PE.Builder.config_t`]() ; [`LIEF::PE::Builder::config_t`]() ) parameter to include or ignore parts of the PE binary during the build process. **Python** ```python parser_config = lief.PE.ParserConfig() parser_config.parse_signature = False pe = lief.PE.parse("some.exe", parser_config) assert isinstance(pe, lief.PE.Binary) builder_config = lief.PE.Builder.config_t() builder_config.imports = True pe.write("new.exe", builder_config) ``` **C++** ```cpp LIEF::PE::ParserConfig parser_config; parser_config.parse_signature = false; auto pe = LIEF::PE::Parser::parse("some.exe", parser_config); LIEF::PE::Builder::config_t builder_config; builder_config.imports = true; pe->write("new.exe", builder_config); ``` **Rust** ```rust let mut parser_config = lief::pe::parser_config::Config::default(); parser_config.parse_signature = false; let mut pe = lief::pe::parse_with_config("some.exe", &parser_config).unwrap(); let mut config = lief::pe::builder::Config::default(); config.imports = true; pe.write_with_config("new.exe", config); ``` You can also use `lief.PE.Binary.write_to_bytes()` ( [`lief::pe::Binary::write_to_bytes`]() ; [`lief::pe::Binary::write_to_bytes_with_config`]() ; [`lief.PE.Binary.write_to_bytes()`]() ; [`std::unique_ptr LIEF::PE::Binary::write(std::ostream &)`]() ; [`std::unique_ptr LIEF::PE::Binary::write(std::ostream &, const Builder::config_t &)`]() ) to get the new PE binary as a buffer of bytes: > **Note** > > This API can also take an extra `lief.PE.Builder.config_t` ( [`lief::pe::::builder::Config`]() ; [`lief.PE.Builder.config_t`]() ; [`LIEF::PE::Builder::config_t`]() ) parameter. **Python** ```python pe: lief.PE.Binary new_pe: bytes = pe.write_to_bytes() ``` **C++** ```cpp std::unique_ptr pe; std::ostringstream os; pe->write(os); std::string buffer = os.str(); const auto* start = reinterpret_cast(buffer.data()); size_t size = buffer.size(); ``` **Rust** ```rust let pe: &mut lief::pe::Binary = some_pe; let bytes: Vec = pe.write_to_bytes(); ``` ## [PDB Support]() Using [LIEF Extended](), you can access PDB debug information ( `lief.pdb.DebugInfo` ( [`lief::pdb::DebugInfo`]() ; [`lief.pdb.DebugInfo`]() ; [`LIEF::pdb::DebugInfo`]() )) using the `lief.Binary.debug_info()` ( [`lief::pe::Binary::debug_info`]() ; [`lief.Binary.debug_info`]() ; [`LIEF::Binary::debug_info()`]() ) function. For more details regarding PDB support, please refer to the [PDB section](). ## [Authenticode]() LIEF supports PE Authenticode by providing an API for inspecting and **verifying** PE executable signatures. PE Authenticode signatures can be accessed by iterating over `lief.PE.Binary.signatures()` ( [`lief::pe::Binary::signatures`]() ; [`lief.PE.Binary.signatures`]() ; [`LIEF::PE::Binary::signatures()`]() ). The `lief.PE.Binary.verify_signature()` ( [`lief::pe::Binary::verify_signature`]() ; [`lief.PE.Binary.verify_signature()`]() ; [`LIEF::PE::Binary::verify_signature()`]() ) function can be used to verify that a PE binary is correctly signed. > **Note** > > Typically, a signed PE executable contains a single signature, but the format allows for multiple signatures. Consequently, `lief.PE.Binary.signatures()` ( [`lief::pe::Binary::signatures`]() ; [`lief.PE.Binary.signatures`]() ; [`LIEF::PE::Binary::signatures()`]() ) returns an iterator rather than a single signature object. **Python** ```python pe = lief.PE.parse("signed.exe") assert isinstance(pe, lief.PE.Binary) for signature in pe.signatures: for crt in signature.certificates: print(crt) assert pe.verify_signature() == lief.PE.Signature.VERIFICATION_FLAGS.OK ``` **C++** ```cpp auto pe = LIEF::PE::Parser::parse("signed.exe"); for (const LIEF::PE::Signature& sig : pe->signatures()) { for (const LIEF::PE::x509& crt : sig.certificates()) { std::cout << crt << '\n'; } } std::cout << (pe->verify_signature() == LIEF::PE::Signature::VERIFICATION_FLAGS::OK) << '\n'; ``` **Rust** ```rust if let Some(lief::Binary::PE(pe)) = lief::Binary::parse("signed.exe") { for sig in pe.signatures() { for crt in sig.certificates() { println!("{:?}", crt); } } assert!( pe.verify_signature(lief::pe::signature::VerificationChecks::DEFAULT) == lief::pe::signature::VerificationFlags::OK ); } ``` You can find additional details about Authenticode support in this tutorial: [PE Authenticode]() --- documentID: "63b14fb0ad0a376b396c25b8679576269df77f4b1a2a886e6249816a0936667e" docname: "formats/pe/modifications/debug" title: "Debug Modification - PE - LIEF Documentation" description: "Debug Modification in PE. LIEF can create, modify, or delete PE debug information entries." canonical: "https://lief.re/doc/latest/formats/pe/modifications/debug.html" markdownURL: "https://lief.re/doc/latest/formats/pe/modifications/debug.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "79870878b1ccf01b6b455bf36266ee14a4d4df3a39c6bdee9d1ccd4c337cf708" --- # [Debug Modification]() LIEF can create, modify, or delete PE debug information entries.[![PE Debug Overview](https://lief.re/doc/latest/_images/overview.webp)]() This debug information is located in the `IMAGE_DIRECTORY_ENTRY_DEBUG` and is represented in LIEF through the `lief.PE.Debug` ( [`lief::pe::debug::Entries`]() ; [`lief.PE.Debug`]() ; [`LIEF::PE::Debug`]() ) class. These entries can be modified using the API exposed by these structures. For example, the PDB path referenced in a `lief.PE.CodeViewPDB` ( [`lief::pe::debug::CodeViewPDB`]() ; [`lief.PE.CodeViewPDB`]() ; [`LIEF::PE::CodeViewPDB`]() ) entry can be changed as follows: **Python** ```python pe: lief.PE.Binary assert isinstance(pe.codeview_pdb, lief.PE.CodeViewPDB) pe.codeview_pdb.filename = r"C:\A\B\C\path.pdb" pe.write("out.dll") ``` **C++** ```cpp std::unique_ptr pe; pe->codeview_pdb()->filename(R"(C:\A\B\C\path.pdb)"); pe->write("out.dll"); ``` **Rust** ```rust let pe: &mut lief::pe::Binary = some_pe; pe.codeview_pdb() .unwrap() .set_filename(r#"C:\A\B\C\path.pdb"#); pe.write("out.exe"); ``` The `lief.PE.Binary.remove_debug` ( [`lief::pe::Binary::remove_debug`]() ; [`lief.PE.Binary.remove_debug()`]() ; [`LIEF::PE::Binary::remove_debug()`]() ) function can be used to remove a specific entry, whereas the `lief.PE.Binary.clear_debug` ( [`lief::pe::Binary::clear_debug`]() ; [`lief.PE.Binary.clear_debug()`]() ; [`LIEF::PE::Binary::clear_debug()`]() ) function removes **all** debug entries: **Python** ```python # Remove a single CodeViewPDB entry assert pe.codeview_pdb is not None pe.remove_debug(pe.codeview_pdb) # Remove all entries pe.clear_debug() pe.write("out.dll") ``` **C++** ```cpp std::unique_ptr pe; // Remove a single CodeViewPDB entry pe->remove_debug(*pe->codeview_pdb()); // Remove all entries pe->clear_debug(); pe->write("out.dll"); ``` **Rust** ```rust let pe: &mut lief::pe::Binary = some_pe; // Remove a single CodeViewPDB entry if let Some(cv_pdb) = pe.codeview_pdb() { todo!("Not Implemented yet"); //pe.remove_debug(cv_pdb); } // Remove all entries pe.clear_debug(); pe.write("out.exe"); ``` Finally, `lief.PE.Binary.add_debug_info` ( [`lief::pe::Binary::add_debug_info`]() ; [`lief.PE.Binary.add_debug_info()`]() ; [`LIEF::PE::Binary::add_debug_info()`]() ) can be used to add a crafted debug entry to an existing PE. For example, a custom `lief.PE.CodeViewPDB` ( [`lief::pe::debug::CodeViewPDB`]() ; [`lief.PE.CodeViewPDB`]() ; [`LIEF::PE::CodeViewPDB`]() ) can be created as follows: **Python** ```python cv = lief.PE.CodeViewPDB("MyCustom.pdb") pe.add_debug_info(cv) pe.write("out.dll") ``` **C++** ```cpp std::unique_ptr pe; LIEF::PE::CodeViewPDB cv("MyCustom.pdb"); pe->add_debug_info(cv); pe->write("out.dll"); ``` **Rust** ```rust let pe: &mut lief::pe::Binary = some_pe; let cv = lief::pe::debug::CodeViewPDB::with_filename("MyCustom.pdb"); pe.add_debug_info(&cv); pe.write("out.exe"); ``` --- documentID: "392bb02258cc448fdd80b5a65eb2e71c884109303322044ccc28967cb59bac81" docname: "formats/pe/modifications/exports" title: "Exports Modification - PE - LIEF Documentation" description: "Exports Modification in PE. LIEF provides extensive support for modifying the PE export table, enabling you to add, remove, or modify export entries, or…" canonical: "https://lief.re/doc/latest/formats/pe/modifications/exports.html" markdownURL: "https://lief.re/doc/latest/formats/pe/modifications/exports.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "7431a17d5b683e099977e49f16dd66c990f2e1c7f7230a316641fdbfdb5696b6" --- # [Exports Modification]() [![PE Resources Overview](https://lief.re/doc/latest/_images/overview1.webp)]() LIEF provides extensive support for modifying the PE export table, enabling you to add, remove, or modify export entries, or create an entire export table for a PE binary. This functionality requires enabling `lief.PE.Builder.config_t.exports` ( [`lief::pe::builder::Config::exports`]() ; [`lief.PE.Builder.config_t.exports`]() ; [`LIEF::PE::Builder::config_t::exports`]() ), as the modified export table is **relocated** to a **new** section. The section name can be controlled with `lief.PE.Builder.config_t.export_section` ( [`lief::pe::builder::Config::export_section`]() ; [`lief.PE.Builder.config_t.export_section`]() ; [`LIEF::PE::Builder::config_t::export_section`]() ). ## [Creating Export Entries]() Creating a `lief.PE.ExportEntry` ( [`lief::pe::export::Entry`]() ; [`lief.PE.ExportEntry`]() ; [`LIEF::PE::ExportEntry`]() ) is useful for exposing a “hidden” function by its address, allowing it to be used like a standard linker-generated export. This could be used for code lifting or fuzzing. **Python** ```python pe: lief.PE.Binary exp = pe.get_export() assert isinstance(exp, lief.PE.Export) # Remove an entry exp.remove_entry("my_exported_name") # Add a new export exp.add_entry("fuzz_me", 0x10010) config = lief.PE.Builder.config_t() config.exports = True config.export_section = ".myedata" # optional pe.write("out.dll", config) ``` **C++** ```cpp std::unique_ptr pe; LIEF::PE::Export* exp = pe->get_export(); // Remove an entry exp->remove_entry("my_exported_name"); // Add a new export exp->add_entry("fuzz_me", 0x10010); LIEF::PE::Builder::config_t config; config.exports = true; config.export_section = ".myedata"; pe->write("out.dll", config); ``` **Rust** ```rust let pe: &mut lief::pe::Binary = some_pe; let mut exp: lief::pe::Export = pe.export().unwrap(); // Remove an entry exp.remove_entry_by_name("my_exported_name"); // Add a new export exp.add_entry_by_name("fuzz_me", 0x10010); let mut config = lief::pe::builder::Config::default(); config.exports = true; config.export_section = ".myedata".to_string(); pe.write_with_config("out.dll", config); ``` ## [Creating an Export Table]() This section introduces the API for creating an export table. We’ll explore a scenario where we want to convert a PE executable into a DLL. > **Note** > > The process of converting an executable to a library is also detailed for ELF binaries in the tutorial: [08 - Transforming an ELF executable into a library](). First, we must update the PE headers to ensure they are compliant with the DLL format: **Python** ```python pe: lief.PE.Binary pe.header.add_characteristic(lief.PE.Header.CHARACTERISTICS.DLL) pe.optional_header.addressof_entrypoint = 0 ``` **C++** ```cpp std::unique_ptr pe; pe->header().add_characteristic(LIEF::PE::Header::CHARACTERISTICS::DLL); pe->optional_header().addressof_entrypoint(0); ``` **Rust** ```rust let pe: &mut lief::pe::Binary = some_pe; pe.header() .add_characteristic(lief::pe::headers::Characteristics::DLL); pe.optional_header().set_addressof_entrypoint(0); ``` Then, we can start creating and populating a new export table: **Python** ```python pe: lief.PE.Binary exp = lief.PE.Export( "lib_exe2dll.dll", [ lief.PE.ExportEntry("cbk1", 0x0001000), lief.PE.ExportEntry("cbk2", 0x0001010), ], ) pe.set_export(exp) config = lief.PE.Builder.config_t() config.exports = True pe.write("lib_exe2dll.dll") ``` **C++** ```cpp std::unique_ptr pe; LIEF::PE::Export exp("lib_exe2dll.dll", { LIEF::PE::ExportEntry("cbk1", 0x0001000), LIEF::PE::ExportEntry("cbk2", 0x0001010), }); pe->set_export(exp); LIEF::PE::Builder::config_t config; config.exports = true; pe->write("lib_exe2dll.dll", config); ``` **Rust** ```rust let pe: &mut lief::pe::Binary = some_pe; let mut exp = lief::pe::Export::new(); exp.set_name("lib_exe2dll.dll"); exp.add_entry_by_name("cbk1", 0x0001000); exp.add_entry_by_name("cbk2", 0x0001010); pe.set_export(&exp); let mut config = lief::pe::builder::Config::default(); config.exports = true; pe.write_with_config("lib_exe2dll.dll", config); ``` > **Limitations** > > This binary-to-library example assumes that the original executable was compiled to be position-independent, meaning it contains relocations. Within a Python environment, we can verify that `lib_exe2dll.dll` can be loaded as a DLL and that we can call `cbk1` and `cbk2`: ```python import ctypes lib = ctypes.windll.LoadLibrary("lib_exe2dll.dll") assert lib.cbk1() >= 0 assert lib.cbk2() >= 0 ``` --- documentID: "455bea748adb327b19f0db4f74a1e08d0ed93c0b65b3d02b7e2df8472c809386" docname: "formats/pe/modifications/imports" title: "Imports Modification - PE - LIEF Documentation" description: "Imports Modification in PE. This section describes the different operations supported by LIEF to modify the PE import table. Please note that any operation…" canonical: "https://lief.re/doc/latest/formats/pe/modifications/imports.html" markdownURL: "https://lief.re/doc/latest/formats/pe/modifications/imports.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "86a8572acad04e59d47b87b2b0ad6cd0ed2f87c355951a4a1006ad0691ea5b97" --- # [Imports Modification]() This section describes the different operations supported by LIEF to modify the PE import table. Please note that any operation not mentioned on this page should be considered unsupported or might lead to a corrupted binary. | Operation | Supported | | --- | --- | | [Add new import]() | | | [Add an imported function]() | | | [Remove an import]() | | | [Remove an imported function]() | | | Extend original IAT | | | Extend original ILT | | > **Implementation Update** > > Compared to previous versions of LIEF, import table modification has been completely redesigned to be more reliable when modifying or rebuilding a PE binary. ## [Introduction]() Modifying the PE import table generically and reliably can be challenging due to its flexible layout and strong dependency on the assembly code. To better understand these challenges and how LIEF addresses them, let’s start with the layout of the import table generated by the MSVC linker (`link.exe`):[![Import Table (MSVC Layout)](https://lief.re/doc/latest/_images/msvc_layout.webp)]() Import Table Layout (`MSVC/link.exe`) First, the import table is referenced by the `lief.PE.DataDirectory` ( [`lief::pe::DataDirectory`]() ; [`lief.PE.DataDirectory`]() ; [`LIEF::PE::DataDirectory`]() ) indexed by the `IMPORT_TABLE` value. The RVA of this data directory points to the beginning of the raw structure describing the import table, while the size of the data directory provides the length of this table. For each imported library (e.g., `kernel32.dll`), the import header references three locations: 1. Address (RVA) of the import **lookup** table (**ILT**) 2. RVA of the imported library name (e.g., RVA of the string `kernel32.dll`) 3. Address (RVA) of the import **address** table (**IAT**) The IAT and the ILT point to an array of integers (pointer width) ending with a zero. In the on-disk PE binary, both tables are filled with an RVA referencing the imported function name (or an ordinal value). For example, if the binary imports `kernel32.dll!GetCurrentProcess` and `kernel32.dll!TerminateProcess`, we would have the following ILT/IAT: ```cpp uintptr_t IAT[3] = { RVA("GetCurrentProcess"), RVA("TerminateProcess"), 0 }; uintptr_t ILT[3] = { RVA("GetCurrentProcess"), RVA("TerminateProcess"), 0 }; ``` When Windows loads the binary and resolves its imports, it fills the **IAT** with the **resolved addresses** of the imported functions: ```diff uintptr_t IAT[3] = { - RVA("GetCurrentProcess"), - RVA("TerminateProcess"), + 0x7ff7bfdb3f00, // GetCurrentProcess resolved address + 0x7ff7ceab4f00, // TerminateProcess resolved address 0 }; ``` On the other hand, the ILT is left unchanged when the binary is loaded (according to Microsoft documentation). While the import header references three RVAs, the PE format (and the Windows loader) does not enforce any specific ordering between them. This means the ILT can appear before the IAT or vice versa. Figure [Import Table Layout (MSVC/link.exe)]() shows the layout when linking a PE binary with MSVC `link.exe`. As shown in this figure, the IATs come first, followed by the import headers, then the ILT, and finally the strings (DLL names and imported function names). This layout can vary depending on the linker used to generate the final PE file. In Figure [Import Table Layout (LLVM/ld-link.exe)](), we can see that the IAT follows the ILT, which is the default order for PE binaries generated by LLVM `ld-link.exe`.[![Import Table (LLVM Layout)](https://lief.re/doc/latest/_images/llvm-link-layout.webp)]() Import Table Layout (`LLVM/ld-link.exe`) Since we cannot assume any predefined layout or ordering of import table elements, we cannot safely recreate a new table at the same locations as the original without risking overwriting important data. Additionally, if we add new imports or imported functions, the modified import table would no longer fit in the original location. To address these constraints, a generic solution involves relocating the import table elsewhere within the binary. > **Builder Config** > > As this modification is not conservative (i.e., it impacts the layout of the binary even if the import table remains unchanged), it must be explicitly enabled using the builder’s config attribute: `lief.PE.Builder.config_t.imports` ( [`lief::pe::builder::Config::imports`]() ; [`lief.PE.Builder.config_t.imports`]() ; [`LIEF::PE::Builder::config_t::imports`]() ) We can relocate the import headers, the ILTs, and the strings (DLL names and import names), but we **cannot** relocate the IAT arbitrarily within the binary. The import table informs the Windows loader about the functions required by the program. When the loader resolves an imported function, its address is written to the IAT, and the assembly code accesses this IAT using stubbing instructions like these: ```nasm jmp [rip + #IAT_FIXUP]; // e.g. jmp *IAT[3]; ``` or ```nasm mov rax, [rip + #IAT_FIXUP]; call rax; ``` If we relocate the IAT elsewhere in the binary without taking other factors into account, the instructions referencing the IAT become invalid. Several solutions exist for this problem, one of which involves creating trampolines between the original IAT and the new IAT location. This approach was used in **former versions** of LIEF; you can read the blog post [Washi’s Injecting Code using Imported Functions into Native PE Files]() for more details. The new approach used by LIEF relocates most elements of the import table (headers, ILTs, and strings) but keeps the original IATs **in their original locations**.[![LIEF Import Table Relocation](https://lief.re/doc/latest/_images/lief-mod.webp)]() LIEF import table relocation By keeping the original IATs in place, we avoid creating trampolines that require generating assembly. However, this approach introduces constraints on how imports can be modified. Specifically, we must ensure that the untouched IAT remains consistent with the assembly code that uses it. ## [Removing Import]() You can remove an imported library using the `lief.PE.Binary.remove_import()` ( [`lief::pe::Binary::remove_import`]() ; [`lief.PE.Binary.remove_import()`]() ; [`LIEF::PE::Binary::remove_import()`]() ) function, or remove all libraries with `lief.PE.Binary.remove_all_imports()` ( [`lief::pe::Binary::remove_all_imports`]() ; [`lief.PE.Binary.remove_all_imports()`]() ; [`LIEF::PE::Binary::remove_all_imports()`]() ): **Python** ```python pe: lief.PE.Binary pe.remove_import("kernel32.dll") config = lief.PE.Builder.config_t() config.imports = True pe.write("new.exe", config) ``` **C++** ```cpp std::unique_ptr pe; pe->remove_import("kernel32.dll"); LIEF::PE::Builder::config_t config; config.imports = true; pe->write("new.exe", config); ``` **Rust** ```rust let pe: &mut lief::pe::Binary = some_pe; pe.remove_import("kernel32.dll"); let mut config = lief::pe::builder::Config::default(); config.imports = true; pe.write_with_config("new.exe", config); ``` ## [Removing an imported function]() To remove an imported function, use `lief.PE.Import.remove_entry` ( [`lief::pe::import::Import::remove_entry_by_name`]() ; [`lief::pe::import::Import::remove_entry_by_ordinal`]() ; [`lief.PE.Import.remove_entry()`]() ; [`LIEF::PE::Import::remove_entry()`]() ) on an `lief.PE.Import` ( [`lief::pe::import::Import`]() ; [`lief.PE.Import`]() ; [`LIEF::PE::Import`]() ) instance. **Python** ```python pe: lief.PE.Binary kernel32 = pe.get_import("kernel32.dll") assert kernel32 is not None kernel32.remove_entry("IsDebuggerPresent") config = lief.PE.Builder.config_t() config.imports = True pe.write("new.exe", config) ``` **C++** ```cpp std::unique_ptr pe; LIEF::PE::Import* kernel32 = pe->get_import("kernel32.dll"); kernel32->remove_entry("IsDebuggerPresent"); LIEF::PE::Builder::config_t config; config.imports = true; pe->write("new.exe", config); ``` **Rust** ```rust let pe: &mut lief::pe::Binary = some_pe; if let Some(mut kernel32) = pe.import_by_name("kernel32.dll") { kernel32.remove_entry_by_name("IsDebuggerPresent"); } let mut config = lief::pe::builder::Config::default(); config.imports = true; pe.write_with_config("new.exe", config); ``` Since this operation removes an entry from the IAT, and we cannot shrink the table without patching the assembly (or using trampolines), the workaround involves replacing the removed entry with another existing entry. For example, if we remove `IsDebuggerPresent` from `Kernel32.dll`, the IAT changes as follows: **Before:** ```cpp // Import Address Table of Kernel32.dll uintptr_t IAT[] = { RVA("GetCurrentProcess"), RVA("IsDebuggerPresent"), RVA("TerminateProcess"), 0 }; ``` **After:** ```cpp // Import Address Table of Kernel32.dll uintptr_t IAT[] = { RVA("GetCurrentProcess"), RVA("GetCurrentProcess"), RVA("TerminateProcess"), 0 }; ``` > **Implicit Operation** > > LIEF **implicitly** performs this padding during the build process. This works because we can reuse the IAT entry associated with the deleted function as a placeholder for any other imported function. Windows allows duplicate symbols for a given import, so duplicating an import is perfectly valid and maintains the IAT’s original length. ## [Creating a new import]() LIEF allows you to create and add new imports using the `lief.PE.Binary.add_import()` ( [`lief::pe::Binary::add_import`]() ; [`lief::pe::Binary::add_import_at_pos`]() ; [`lief.PE.Binary.add_import()`]() ; [`LIEF::PE::Binary::add_import()`]() ) and `lief.PE.Import.add_entry()` ( [`lief::pe::import::Import::add_entry_by_name`]() ; [`lief.PE.Import.add_entry()`]() ; [`LIEF::PE::Import::add_entry()`]() ) functions: **Python** ```python pe: lief.PE.Binary stdio = pe.add_import("api-ms-win-crt-stdio-l1-1-0.dll") stdio.add_entry("puts") config = lief.PE.Builder.config_t() config.imports = True pe.write("new.exe", config) ``` **C++** ```cpp std::unique_ptr pe; LIEF::PE::Import& stdio = pe->add_import("api-ms-win-crt-stdio-l1-1-0.dll"); LIEF::PE::ImportEntry& _puts = stdio.add_entry("puts"); LIEF::PE::Builder::config_t config; config.imports = true; pe->write("new.exe", config); ``` **Rust** ```rust let pe: &mut lief::pe::Binary = some_pe; let mut stdio = pe.add_import("api-ms-win-crt-stdio-l1-1-0.dll"); let _puts = stdio.add_entry_by_name("puts"); let mut config = lief::pe::builder::Config::default(); config.imports = true; pe.write_with_config("new.exe", config); ``` As shown in Figure [LIEF import table relocation](), this modification introduces a new IAT located near the relocated import table. This new IAT contains values for the newly imported functions (`puts` in this example). Consequently, the Windows loader will resolve the imported functions in this table. When crafting new imports and adding functions, you may need to determine the IAT address ( `lief.PE.ImportEntry.iat_address()` ( [`lief::pe::import::ImportEntry::iat_address`]() ; [`lief.PE.ImportEntry.iat_address`]() ; [`LIEF::PE::ImportEntry::iat_address()`]() )) associated with these new functions. The new IAT containing user-created imports is generated during the LIEF write operation. Notably, **there is no reliable way to determine the address of the new IAT before the write operation**. To address this limitation and allow for modifications after the new IAT is created, `lief.PE.Builder.config_t` ( [`lief::pe::::builder::Config`]() ; [`lief.PE.Builder.config_t`]() ; [`LIEF::PE::Builder::config_t`]() ) accepts a callback via its `lief.PE.Builder.config_t.resolved_iat_cbk` ( [`lief.PE.Builder.config_t.resolved_iat_cbk`]() ; [`LIEF::PE::Builder::config_t::resolved_iat_cbk`]() ) attribute: **Python** ```python pe: lief.PE.Binary def iat_resolution_cbk( pe: lief.PE.Binary, imp: lief.PE.Import, entry: lief.PE.ImportEntry, rva: int ): # Process return stdio = pe.add_import("api-ms-win-crt-stdio-l1-1-0.dll") stdio.add_entry("puts") config = lief.PE.Builder.config_t() config.imports = True config.resolved_iat_cbk = iat_resolution_cbk pe.write("new.exe", config) ``` **C++** ```cpp std::unique_ptr pe; LIEF::PE::Import& stdio = pe->add_import("api-ms-win-crt-stdio-l1-1-0.dll"); LIEF::PE::ImportEntry& _puts = stdio.add_entry("puts"); LIEF::PE::Builder::config_t config; config.imports = true; config.resolved_iat_cbk = [](LIEF::PE::Binary* pe, const LIEF::PE::Import* imp, const LIEF::PE::ImportEntry* entry, uint32_t RVA) -> void { // Process return; }; pe->write("new.exe", config); ``` > **Rust Bindings** > > This callback is not yet available in Rust. > **Nanobind Leaks** > > Due to Python’s reference counting, you might encounter Nanobind warnings about leaked objects. You can disable these warnings using [`lief.disable_leak_warning()`]( "lief.disable_leak_warning"). The fourth parameter of this callback, `uint32_t RVA`, is the address in the IAT where the address of the resolved function ( `lief.PE.ImportEntry` ( [`lief::pe::import::ImportEntry`]() ; [`lief.PE.ImportEntry`]() ; [`LIEF::PE::ImportEntry`]() )) will be stored by the loader. For example, these addresses can be traced as follows: ```python def iat_resolution_cbk(pe: lief.PE.Binary, imp: lief.PE.Import, entry: lief.PE.ImportEntry, rva: int): print(f"{imp.name}!{entry.name}: 0x{rva:010x}") # [...] stdio = dll.add_import("api-ms-win-crt-stdio-l1-1-0.dll") stdio.add_entry("puts") stdio.add_entry("__p__commode") stdio.add_entry("_set_fmode") # [...] ``` Which can result in the following output: ```text api-ms-win-crt-stdio-l1-1-0.dll!puts: 0x000046c9e2 api-ms-win-crt-stdio-l1-1-0.dll!__p__commode: 0x000046c9ea api-ms-win-crt-stdio-l1-1-0.dll!_set_fmode: 0x000046c9f2 ``` Given this output, the IAT address of `puts` is at RVA `0x000046c9e2`. This information can be used to patch sections that need this address: ```python def iat_resolution_cbk(pe: lief.PE.Binary, imp: lief.PE.Import, entry: lief.PE.ImportEntry, rva: int): code = pe.get_section(".injected") patch(code, rva) ``` ## [Adding a new imported function]() LIEF can also be used to add a function to an **existing** import, but this must be done carefully to avoid corrupting the binary. Since we cannot extend the original IAT of the import where we want to add the new function, the workaround involves adding a new import with the **same name** as the existing one and adding the function to this duplicate import. ```text // Original Import * kernel32.dll │ ├── GetCurrentProcessId IAT[0] │ ├── GetCurrentThreadId IAT[1] │ └── GetModuleHandleW IAT[2] // Duplicated import * kernel32.dll │ └── GetStartupInfoW NEW IAT[0] │ └────────-> New Import ``` The code is very similar to that in [Creating a new import](). **Python** ```python pe: lief.PE.Binary kernel32 = pe.add_import("kernel32.dll") kernel32.add_entry("GetStartupInfoW") config = lief.PE.Builder.config_t() config.imports = True pe.write("new.exe", config) ``` **C++** ```cpp std::unique_ptr pe; LIEF::PE::Import& kernel32 = pe->add_import("kernel32.dll"); LIEF::PE::ImportEntry& _GetStartupInfoW = kernel32.add_entry("GetStartupInfoW"); LIEF::PE::Builder::config_t config; config.imports = true; pe->write("new.exe", config); ``` **Rust** ```rust let pe: &mut lief::pe::Binary = some_pe; let mut kernel32 = pe.add_import("kernel32.dll"); let _get_startup_info = kernel32.add_entry_by_name("GetStartupInfoW"); let mut config = lief::pe::builder::Config::default(); config.imports = true; pe.write_with_config("new.exe", config); ``` --- documentID: "a0971aaf5247b06ebf642a5185d5b0355760c4355c113f5f0215ec0f42e3d7f7" docname: "formats/pe/modifications/resources" title: "Resources Modification - PE - LIEF Documentation" description: "Resources Modification in PE. LIEF allows you to modify (or create) PE resources at different levels:" canonical: "https://lief.re/doc/latest/formats/pe/modifications/resources.html" markdownURL: "https://lief.re/doc/latest/formats/pe/modifications/resources.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "88c716cf91ee72635e23e012c2368905b76b463ad33d35818033c9a7010384be" --- # [Resources Modification]() [![PE Resources Overview](https://lief.re/doc/latest/_images/overview2.webp)]() LIEF allows you to modify (or create) PE resources at different levels: - Directly on the binary tree ( `lief.PE.ResourceNode` ( [`lief::pe::resources::Node`]() ; [`lief.PE.ResourceNode`]() ; [`LIEF::PE::ResourceNode`]() )) - Using the `lief.PE.ResourcesManager` ( [`lief::pe::resources::Manager`]() ; [`lief.PE.ResourcesManager`]() ; [`LIEF::PE::ResourcesManager`]() ). ## [Binary Tree Modifications]() The resource root node can be accessed using the `lief.PE.Binary.resources()` ( [`lief::pe::Binary::resources`]() ; [`lief.PE.Binary.resources`]() ; [`LIEF::PE::Binary::resources()`]() ) function: **Python** ```python pe: lief.PE.Binary rsrc = pe.resources print(rsrc) ``` **C++** ```cpp std::unique_ptr pe; LIEF::PE::ResourceNode* rsrc = pe->resources(); std::cout << *rsrc << '\n'; ``` **Rust** ```rust let pe: &lief::pe::Binary = some_pe; let rsrc = pe.resources().unwrap(); println!("{}", &rsrc as &dyn NodeBase); ``` From this `lief.PE.ResourceNode` ( [`lief::pe::resources::Node`]() ; [`lief.PE.ResourceNode`]() ; [`LIEF::PE::ResourceNode`]() ) instance, you can use the `lief.PE.ResourceNode.add_child()` ( [`lief::pe::resources::NodeBase::add_child`]() ; [`lief.PE.ResourceNode.add_child()`]() ; [`LIEF::PE::ResourceNode::add_child()`]() ) or `lief.PE.ResourceNode.delete_child()` ( [`lief::pe::resources::NodeBase::delete_child`]() ; [`lief.PE.ResourceNode.delete_child()`]() ; [`LIEF::PE::ResourceNode::delete_child()`]() ) functions to add or delete nodes: **Python** ```python pe: lief.PE.Binary rsrc = pe.resources assert isinstance(rsrc, lief.PE.ResourceNode) dir_node = lief.PE.ResourceDirectory(100) data_node = lief.PE.ResourceData([1, 2, 3]) rsrc.add_child(dir_node).add_child(data_node) ``` **C++** ```cpp std::unique_ptr pe; LIEF::PE::ResourceNode* root = pe->resources(); LIEF::PE::ResourceDirectory dir_node(/*id=*/100); LIEF::PE::ResourceData data_node(std::vector{1, 2, 3}); (*root).add_child(dir_node).add_child(data_node); pe->write("new.exe"); ``` **Rust** ```rust let pe: &mut lief::pe::Binary = some_pe; let mut root = pe.resources().unwrap(); let mut dir_node = lief::pe::resources::Directory::with_id(100); let data_node = lief::pe::resources::Data::with_buffer(&[1, 2, 3]); dir_node.add_child(&Node::Data(data_node)); root.add_child(&Node::Directory(dir_node)); pe.write("new.exe"); ``` This low-level API can be used to modify the tree or change the data of a specific node. > **Pretty Printing** > > You can also *print* a node to get a formatted representation of the resource tree: > > ```python > pe: lief.PE.Binary > > tree = pe.resources > print(tree) > ``` > > ```text > ├── Directory ID: 0000 (0x0000) > │ ├── Directory ID: 0016 (0x0010) type: VERSION > │ │ └── Directory ID: 0001 (0x0001) > │ │ └── Data ID: 0000 (0x0000) Lang: 0x00 / Sublang: 0x00 length=772 (0x000304), offset: 0x1ca0 > │ │ ├── Hex: 04:03:34:00:00:00:56:00:53:00:5f:00:56:00:45:00:52:00:53:00 > │ │ └── Str: ..4...V.S._.V.E.R.S. > │ └── Directory ID: 0024 (0x0018) type: MANIFEST > │ └── Directory ID: 0001 (0x0001) > │ └── Data ID: 1033 (0x0409) Lang: 0x09 / Sublang: 0x01 length=1900 (0x00076c), offset: 0x1fa4 > │ ├── Hex: 3c:61:73:73:65:6d:62:6c:79:20:78:6d:6c:6e:73:3d:22:75:72:6e > │ └── Str: """ pe.write("new.exe") ``` **C++** ```cpp std::unique_ptr pe; result manager = pe->resources_manager(); manager->manifest(R"manifest( )manifest"); pe->write("new.exe"); ``` **Rust** ```rust let pe: &mut lief::pe::Binary = some_pe; let mut manager = pe.resources_manager().unwrap(); manager.set_manifest( r#" "#, ); pe.write("new.exe"); ``` ## [Resource Tree Transfer between Binaries]() LIEF can transfer the resource tree from one binary to another. This operation can be performed using the `lief.PE.Binary.set_resources()` ( [`lief::pe::Binary::set_resources`]() ; [`lief.PE.Binary.set_resources()`]() ; [`LIEF::PE::Binary::set_resources()`]() ) function: **Python** ```python from_pe: lief.PE.Binary to_pe: lief.PE.Binary resources = from_pe.resources assert isinstance(resources, lief.PE.ResourceNode) to_pe.set_resources(resources) to_pe.write("new.exe") ``` **C++** ```cpp std::unique_ptr from; std::unique_ptr to; to->set_resources(*from->resources()); to->write("new.exe"); ``` **Rust** ```rust to_pe.set_resources(&from_pe.resources().unwrap()); ``` --- documentID: "048c732da6998b2fa773a35f776bc0d68f8a1af302351f8eeffad529e2f0c94f" docname: "formats/pe/modifications/tls" title: "TLS Modification - PE - LIEF Documentation" description: "TLS Modification in PE. LIEF can be used to modify, create, or remove Thread Local Storage (TLS) information." canonical: "https://lief.re/doc/latest/formats/pe/modifications/tls.html" markdownURL: "https://lief.re/doc/latest/formats/pe/modifications/tls.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "c7f97062a240e011360ed0bf34ebbf407932463c1df22d965a2f3f85ba82e50c" --- # [TLS Modification]() [![PE TLS Overview](https://lief.re/doc/latest/_images/tls.webp)]() LIEF can be used to **modify**, **create**, or **remove** Thread Local Storage (TLS) information. ## [TLS Modifications]() All attributes of the `lief.PE.TLS` ( [`lief::pe::TLS`]() ; [`lief.PE.TLS`]() ; [`LIEF::PE::TLS`]() ) interface can be modified as long as the changes are consistent with the layout of the PE binary. For instance, you can adjust the TLS callbacks by removing, reordering, or adding addresses: **Python** ```python pe: lief.PE.Binary tls = pe.tls assert isinstance(tls, lief.PE.TLS) callbacks: list[int] = tls.callbacks # Remove the last entry callbacks.pop() # Add an address callbacks.append(0x140001010) tls.callbacks = callbacks pe.write("tls_modified.exe") ``` **C++** ```cpp std::unique_ptr pe; TLS* tls = pe->tls(); std::vector callbacks = tls->callbacks(); // Remove the last entry callbacks.pop_back(); // Add an address callbacks.push_back(0x140001010); tls->callbacks(std::move(callbacks)); pe->write("tls_modified.exe"); ``` **Rust** ```rust let pe: &mut lief::pe::Binary = some_pe; let mut tls = pe.tls().unwrap(); let mut callbacks: Vec = tls.callbacks(); // Remove the last entry callbacks.pop(); // Add an address callbacks.push(0x140001010); tls.set_callbacks(&callbacks); pe.write("tls_modified.exe"); ``` > **Relocations** > > Note that LIEF **automatically** manages the relocations that must be created or removed when modifying the TLS callbacks. ## [TLS Creation]() If a PE binary does not contain TLS metadata, LIEF can be used to create this structure. First, we can create and initialize a TLS instance: **Python** ```python tls = lief.PE.TLS() tls.callbacks = [ 0x140001000, 0x140001010, ] ``` **C++** ```cpp LIEF::PE::TLS tls; tls.callbacks(std::vector{ 0x140001000, 0x140001010, }); ``` **Rust** ```rust let mut tls = lief::pe::TLS::new(); tls.set_callbacks(&[0x140001000, 0x140001010]); ``` And then, we can add this instance to a `lief.PE.Binary` ( [`lief::pe::Binary`]() ; [`lief.PE.Binary`]() ; [`LIEF::PE::Binary`]() ): **Python** ```python pe.tls = tls # `tls` defined previously pe.write("tls_demo.exe") ``` **C++** ```cpp pe->tls(tls); // `tls` defined previously pe->write("tls_demo.exe"); ``` **Rust** ```rust pe.set_tls(&tls); // `tls` defined previously pe.write("tls_demo.exe"); ``` > **Relocations** > > Similar to TLS callback modifications, LIEF **automatically** manages relocations. In addition, it automatically initializes (if not set by the user) `AddressOfIndex`, which is required when setting up TLS metadata. --- documentID: "f5ee3f490aed9a938733d2e80f209a0ab905430aaf59a382cabd61a646248a41" docname: "formats/pe/python" title: "PE Python API - LIEF Documentation" description: "PE Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/pe/python.html" markdownURL: "https://lief.re/doc/latest/formats/pe/python.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "576863a830cdca9641ff6aca29f1fdd18d5f9dfe6c897f8a574cc10e925a7299" --- # [Python]() ## [Parser]() ### [` lief.PE.parse `]() lief.PE.parse(*obj: str | io.IOBase | os.PathLike | bytes | list[int]*, *config: [lief.PE.ParserConfig]( "lief.PE.ParserConfig")*) → [lief.PE.Binary]( "lief.PE.Binary") | None Parse the PE binary from the given parameter and return a [`lief.PE.Binary`]( "lief.PE.Binary") object ### [` lief.PE.ParserConfig `]() class lief.PE.ParserConfig(*self*) Bases: `object` This class is used to configure the behavior of the PE Parser ([`lief.PE.parse()`]( "lief.PE.parse")) #### [` all `]() all = <lief.\_lief.PE.ParserConfig object> #### [` default_conf `]() default\_conf = <lief.\_lief.PE.ParserConfig object> #### [` parse_arm64x_binary `]() property parse\_arm64x\_binary → bool Whether to parse nested ARM64X binaries. This option is disabled by default because it can introduce significant parsing overhead. #### [` parse_exceptions `]() property parse\_exceptions → bool Whether to parse in-depth exception metadata. This option is disabled by default because it can introduce significant parsing overhead. #### [` parse_exports `]() property parse\_exports → bool Whether to parse the PE Export Directory. #### [` parse_imports `]() property parse\_imports → bool Whether to parse the PE Import Directory. #### [` parse_reloc `]() property parse\_reloc → bool Whether to parse PE relocations. #### [` parse_rsrc `]() property parse\_rsrc → bool Whether to parse the PE resources tree. #### [` parse_signature `]() property parse\_signature → bool Whether to parse the PE Authenticode signature. #### [` rebase `]() property rebase → int | None If set, this value holds the original image base from which the binary should be rebased. This is used to *undo* relocations and IAT bindings when parsing a PE loaded in memory. ## [Binary]() ### [` lief.PE.Binary `]() class lief.PE.Binary Bases: [`Binary`]( "lief._lief.Binary") Class which represents a PE binary which is the main interface to manage and modify a PE executable. This object can be instantiated through [`lief.parse()`]( "lief.parse") or [`lief.PE.parse()`]( "lief.PE.parse") while the constructor of this object can be used to craft a binary from scratch (see: [02 - Create a PE from scratch (Deprecated)]()) #### [` add_debug_info `]() add\_debug\_info(*self*, *entry: [lief.\_lief.PE.Debug]( "lief._lief.PE.Debug")*) → [lief.\_lief.PE.Debug]( "lief._lief.PE.Debug") | None Add a new debug entry #### [` add_import `]() add\_import(*self*, *import\_name: str*, *pos: int = -1*) → [lief.\_lief.PE.Import]( "lief._lief.PE.Import") Add an imported library (i.e. `DLL`) to the binary. The second parameter `pos` defines where to insert the import. If negative (default), the import is appended to the end of the list. #### [` add_relocation `]() add\_relocation(*self*, *relocation: [lief.\_lief.PE.Relocation]( "lief._lief.PE.Relocation")*) → [lief.\_lief.PE.Relocation]( "lief._lief.PE.Relocation") Add a [`Relocation`]( "lief.PE.Relocation") to the binary #### [` add_section `]() add\_section(*self*, *section: [lief.\_lief.PE.Section]( "lief._lief.PE.Section")*) → [lief.\_lief.PE.Section]( "lief._lief.PE.Section") | None Add a [`Section`]( "lief.PE.Section") to the binary. #### [` authentihash `]() authentihash(*self*, *algorithm: [lief.\_lief.PE.ALGORITHMS]( "lief._lief.PE.ALGORITHMS")*) → bytes Compute the authentihash according to the [`ALGORITHMS`]( "lief.PE.ALGORITHMS") given in the first parameter #### [` authentihash_md5 `]() property authentihash\_md5 → bytes Authentihash **MD5** value #### [` authentihash_sha1 `]() property authentihash\_sha1 → bytes Authentihash **SHA1** value #### [` authentihash_sha256 `]() property authentihash\_sha256 → bytes Authentihash **SHA-256** value #### [` authentihash_sha512 `]() property authentihash\_sha512 → bytes Authentihash **SHA-512** value #### [` cert_dir `]() property cert\_dir → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the data directory associated with the certificate table (authenticode). #### [` clear_debug `]() clear\_debug(*self*) → bool Remove all debug info from the binary #### [` codeview_pdb `]() property codeview\_pdb → [lief.PE.CodeViewPDB]( "lief.PE.CodeViewPDB") | None Return the [`CodeViewPDB`]( "lief.PE.CodeViewPDB") if present #### [` coff_string_table `]() property coff\_string\_table → lief.PE.Binary.it\_strings\_table Iterator over the strings located in the COFF string table #### [` compute_checksum `]() compute\_checksum(*self*) → int Re-compute the value of [`checksum`]( "lief.PE.OptionalHeader.checksum"). If both values do not match, it could mean that the binary has been modified after the compilation. This value is computed by LIEF for the current binary object. #### [` data_directories `]() property data\_directories → lief.PE.Binary.it\_data\_directories Return an iterator over the [`DataDirectory`]( "lief.PE.DataDirectory") #### [` data_directory `]() data\_directory(*self*, *type: [lief.\_lief.PE.DataDirectory.TYPES]( "lief._lief.PE.DataDirectory.TYPES")*) → [lief.\_lief.PE.DataDirectory]( "lief._lief.PE.DataDirectory") | None Return the [`DataDirectory`]( "lief.PE.DataDirectory") object from the given [`TYPES`]( "lief.PE.DataDirectory.TYPES") type #### [` debug `]() property debug → lief.PE.Binary.it\_debug Return the [`Debug`]( "lief.PE.Debug") #### [` debug_dir `]() property debug\_dir → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the data directory associated with the debug table #### [` delay_dir `]() property delay\_dir → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the data directory associated with delayed imports #### [` delay_imports `]() property delay\_imports → lief.PE.Binary.it\_delay\_imports Return an iterator over the [`DelayImport`]( "lief.PE.DelayImport") #### [` dos_header `]() property dos\_header → [lief.PE.DosHeader]( "lief.PE.DosHeader") Return the [`DosHeader`]( "lief.PE.DosHeader") #### [` dos_stub `]() property dos\_stub → memoryview DOS stub content as a `list` of bytes #### [` exception_functions `]() property exception\_functions → list[[lief.Function]( "lief.Function")] [`Function`]( "lief.Function") found in the Exception directory #### [` exceptions `]() property exceptions → lief.PE.Binary.it\_exceptions Iterator over the exception (`_RUNTIME_FUNCTION`) functions. > **Warning** > > This property requires that the option [`lief.PE.ParserConfig.parse_exceptions`]( "lief.PE.ParserConfig.parse_exceptions") was turned on (default is `False`) when parsing the binary. #### [` exceptions_dir `]() property exceptions\_dir → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the data directory associated with the exceptions #### [` export_dir `]() property export\_dir → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the data directory associated with the export table #### [` fill_address `]() fill\_address(*self*, *address: int*, *size: int*, *value: int = 0*, *addr\_type: [lief.\_lief.Binary.VA\_TYPES]( "lief._lief.Binary.VA_TYPES") = VA\_TYPES.AUTO*) → None Fill the content at the provided address with a fixed value #### [` find_coff_string `]() find\_coff\_string(*self*, *offset: int*) → [lief.\_lief.COFF.String]( "lief._lief.COFF.String") | None Try to find the COFF string at the given offset in the COFF string table. > **Warning** > > This offset must include the first 4 bytes holding the size of the table. Hence, the first string starts a the offset 4. #### [` find_exception_at `]() find\_exception\_at(*self*, *rva: int*) → [lief.\_lief.PE.ExceptionInfo]( "lief._lief.PE.ExceptionInfo") | None Try to find the exception info at the given RVA. > **Warning** > > This property requires that the option [`lief.PE.ParserConfig.parse_exceptions`]( "lief.PE.ParserConfig.parse_exceptions") was turned on (default is `False`) when parsing the binary. #### [` functions `]() property functions → list[[lief.Function]( "lief.Function")] **All** [`Function`]( "lief.Function") found in the binary #### [` get_delay_import `]() get\_delay\_import(*self*, *import\_name: str*) → [lief.\_lief.PE.DelayImport]( "lief._lief.PE.DelayImport") | None Return the [`DelayImport`]( "lief.PE.DelayImport") from the given name or None if not found #### [` get_export `]() get\_export(*self*) → [lief.\_lief.PE.Export]( "lief._lief.PE.Export") | None Return the [`Export`]( "lief.PE.Export") object #### [` get_import `]() get\_import(*self*, *import\_name: str*) → [lief.\_lief.PE.Import]( "lief._lief.PE.Import") | None Return the [`Import`]( "lief.PE.Import") from the given name or None if it can’t be found #### [` get_section `]() get\_section(*self*, *section\_name: str*) → [lief.\_lief.PE.Section]( "lief._lief.PE.Section") | None Return the [`Section`]( "lief.PE.Section") object from the given name or None if not found #### [` has_configuration `]() property has\_configuration → bool `True` if the current binary has [`LoadConfiguration`]( "lief.PE.LoadConfiguration") #### [` has_debug `]() property has\_debug → bool `True` if the current binary has a [`Debug`]( "lief.PE.Debug") object #### [` has_delay_import `]() has\_delay\_import(*self*, *import\_name: str*) → bool `True` if the binary imports the given library name #### [` has_delay_imports `]() property has\_delay\_imports → bool `True` if the current binary has delay imports ([`DelayImport`]( "lief.PE.DelayImport")) #### [` has_exceptions `]() property has\_exceptions → bool `True` if the current binary uses `Exceptions` #### [` has_exports `]() property has\_exports → bool `True` if the current binary has a [`Export`]( "lief.PE.Export") object #### [` has_import `]() has\_import(*self*, *import\_name: str*) → bool `True` if the binary imports the given library name #### [` has_imports `]() property has\_imports → bool `True` if the current binary has imports ([`Import`]( "lief.PE.Import")) #### [` has_relocations `]() property has\_relocations → bool `True` if the current binary uses [`Relocation`]( "lief.PE.Relocation") #### [` has_resources `]() property has\_resources → bool `True` if the current binary has a `Resources` object #### [` has_rich_header `]() property has\_rich\_header → bool `True` if the current binary has a [`RichHeader`]( "lief.PE.RichHeader") object #### [` has_signatures `]() property has\_signatures → bool `True` if the binary is signed with the PE authenticode ([`Signature`]( "lief.PE.Signature")) #### [` has_tls `]() property has\_tls → bool `True` if the current binary has a [`TLS`]( "lief.PE.TLS") object #### [` header `]() property header → [lief.PE.Header]( "lief.PE.Header") Return the [`Header`]( "lief.PE.Header") #### [` iat_dir `]() property iat\_dir → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the data directory associated with the IAT #### [` import_dir `]() property import\_dir → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the data directory associated with the import table #### [` imports `]() property imports → lief.PE.Binary.it\_imports Return an iterator over the [`Import`]( "lief.PE.Import") libraries #### [` is_arm64ec `]() property is\_arm64ec → bool True if this binary is compiled in ARM64EC mode (emulation compatible) #### [` is_arm64x `]() property is\_arm64x → bool True if this binary is compiled in ARM64X mode (contains both ARM64 and ARM64EC #### [` is_reproducible_build `]() property is\_reproducible\_build → bool `True` if the binary was compiled with a reproducible build directive ([`Debug`]( "lief.PE.Debug")) #### [` load_config_dir `]() property load\_config\_dir → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the data directory associated with the load config #### [` load_configuration `]() property load\_configuration → [lief.PE.LoadConfiguration]( "lief.PE.LoadConfiguration") | None Return the [`LoadConfiguration`]( "lief.PE.LoadConfiguration") object or None if not present #### [` nested_pe_binary `]() property nested\_pe\_binary → [lief.PE.Binary]( "lief.PE.Binary") | None If the current binary contains dynamic relocations (e.g. [`lief.PE.DynamicFixupARM64X`]( "lief.PE.DynamicFixupARM64X")), this function returns the **relocated** view of the current PE. This can be used to get the alternative PE binary, targeting a different architecture. > **Warning** > > This property requires that the option [`lief.PE.ParserConfig.parse_arm64x_binary`]( "lief.PE.ParserConfig.parse_arm64x_binary") was turned on (default is `False`) when parsing the binary. #### [` offset_to_rva `]() offset\_to\_rva(*self*, *offset: int*) → int Convert the given offset into a relative virtual address (RVA). #### [` optional_header `]() property optional\_header → [lief.PE.OptionalHeader]( "lief.PE.OptionalHeader") Header that follows the [`header`]( "lief.PE.Binary.header"). It is named optional from the COFF specifications but it is mandatory in a PE file. #### [` overlay `]() property overlay → memoryview Return the overlay content as a `list` of bytes #### [` overlay_offset `]() property overlay\_offset → int Return the original overlay offset #### [` relocation_dir `]() property relocation\_dir → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the data directory associated with the relocation table #### [` relocations `]() property relocations → lief.PE.DynamicFixupGeneric.it\_relocations Return an iterator over the [`Relocation`]( "lief.PE.Relocation") #### [` remove `]() remove(*self*, *section: [lief.\_lief.PE.Section]( "lief._lief.PE.Section")*, *clear: bool = False*) → None Remove the [`Section`]( "lief.PE.Section") given in first parameter #### [` remove_all_imports `]() remove\_all\_imports(*self*) → None Remove all imported libraries #### [` remove_all_relocations `]() remove\_all\_relocations(*self*) → None #### [` remove_debug `]() remove\_debug(*self*, *entry: [lief.\_lief.PE.Debug]( "lief._lief.PE.Debug")*) → bool Remove a specific debug entry #### [` remove_import `]() remove\_import(*self*, *name: str*) → bool Remove the imported library with the given name #### [` remove_tls `]() remove\_tls(*self*) → None Remove the TLS from the binary #### [` resources `]() property resources → [lief.PE.ResourceNode]( "lief.PE.ResourceNode") | None Return the [`ResourceNode`]( "lief.PE.ResourceNode") tree or None if not present #### [` resources_manager `]() property resources\_manager → [lief.PE.ResourcesManager]( "lief.PE.ResourcesManager") | [lief.lief\_errors]( "lief.lief_errors") Return the [`ResourcesManager`]( "lief.PE.ResourcesManager") to manage resources #### [` rich_header `]() property rich\_header → [lief.PE.RichHeader]( "lief.PE.RichHeader") | None [`RichHeader`]( "lief.PE.RichHeader") object (if present) #### [` rsrc_dir `]() property rsrc\_dir → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the data directory associated with the resources tree #### [` rva_to_offset `]() rva\_to\_offset(*self*, *rva\_address: int*) → int Convert a relative virtual address to an offset The conversion is performed by looking for the section that encompasses the provided RVA. #### [` section_from_offset `]() section\_from\_offset(*self*, *offset: int*) → [lief.\_lief.PE.Section]( "lief._lief.PE.Section") | None Return the [`Section`]( "lief.PE.Section") which encompasses the provided offset. It returns None if a section can’t be found. #### [` section_from_rva `]() section\_from\_rva(*self*, *rva: int*) → [lief.\_lief.PE.Section]( "lief._lief.PE.Section") | None Return the [`Section`]( "lief.PE.Section") which encompasses the provided **relative** virtual address. If a section can’t be found, it returns None. #### [` sections `]() property sections → lief.PE.Binary.it\_section Return an iterator over the PE’s [`Section`]( "lief.PE.Section") #### [` set_export `]() set\_export(*self*, *arg: [lief.\_lief.PE.Export]( "lief._lief.PE.Export")*, */*) → [lief.\_lief.PE.Export]( "lief._lief.PE.Export") Add or replace the export table #### [` set_resources `]() set\_resources(*self*, *new\_tree: [lief.\_lief.PE.ResourceNode]( "lief._lief.PE.ResourceNode")*) → [lief.\_lief.PE.ResourceNode]( "lief._lief.PE.ResourceNode") | None Change or set the current resource tree with the new one provided in parameter. #### [` signatures `]() property signatures → lief.PE.Binary.it\_const\_signatures Return an iterator over the [`Signature`]( "lief.PE.Signature") objects #### [` sizeof_headers `]() property sizeof\_headers → int Size of all the PE headers #### [` symbols `]() property symbols → lief.PE.Binary.it\_symbols Return binary’s `Symbol` #### [` tls `]() property tls → [lief.PE.TLS]( "lief.PE.TLS") | None [`TLS`]( "lief.PE.TLS") object (if present) #### [` tls_dir `]() property tls\_dir → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the data directory associated with TLS #### [` va_to_offset `]() va\_to\_offset(*self*, *va\_address: int*) → int Convert an **absolute** virtual address into an offset See: [`rva_to_offset()`]( "lief.PE.Binary.rva_to_offset") #### [` verify_signatureverify_signature `]() verify\_signature(*self*, *checks: [lief.\_lief.PE.Signature.VERIFICATION\_CHECKS]( "lief._lief.PE.Signature.VERIFICATION_CHECKS") = VERIFICATION\_CHECKS.DEFAULT*) → [lief.\_lief.PE.Signature.VERIFICATION\_FLAGS]( "lief._lief.PE.Signature.VERIFICATION_FLAGS") **verify\_signature(*self*, *signature: [lief.\_lief.PE.Signature]( "lief._lief.PE.Signature")*, *checks: [lief.\_lief.PE.Signature.VERIFICATION\_CHECKS]( "lief._lief.PE.Signature.VERIFICATION_CHECKS") = VERIFICATION\_CHECKS.DEFAULT*) → [lief.\_lief.PE.Signature.VERIFICATION\_FLAGS]( "lief._lief.PE.Signature.VERIFICATION_FLAGS")** Overloaded function. 1. `verify_signature(self, checks: lief._lief.PE.Signature.VERIFICATION_CHECKS = VERIFICATION_CHECKS.DEFAULT) -> lief._lief.PE.Signature.VERIFICATION_FLAGS` > Verify the binary against the embedded signature(s) (if any) > > First off, it checks that the embedded signatures are correct (c.f. [`lief.PE.Signature.check()`]( "lief.PE.Signature.check")) and then it checks that the authentihash matches [`lief.PE.ContentInfo.digest`]( "lief.PE.ContentInfo.digest") > > One can tweak the verification process with the [`lief.PE.Signature.VERIFICATION_CHECKS`]( "lief.PE.Signature.VERIFICATION_CHECKS") flags > > > **See also** > > > > [`lief.PE.Signature.check()`]( "lief.PE.Signature.check") 2. `verify_signature(self, signature: lief._lief.PE.Signature, checks: lief._lief.PE.Signature.VERIFICATION_CHECKS = VERIFICATION_CHECKS.DEFAULT) -> lief._lief.PE.Signature.VERIFICATION_FLAGS` > Verify the binary with the Signature object provided in the first parameter It can be used to verify a detached signature: > > ```python > detached = lief.PE.Signature.parse("sig.pkcs7") > binary.verify_signature(detached) > ``` #### [` virtual_size `]() property virtual\_size → int Return the binary’s virtual size. This value should match [`sizeof_image`]( "lief.PE.OptionalHeader.sizeof_image") #### [` writewrite `]() write(*self*, *output\_path: str | os.PathLike*) → None **write(*self*, *output\_path: str | os.PathLike*, *config: [lief.\_lief.PE.Builder.config\_t]( "lief._lief.PE.Builder.config_t")*) → None** Overloaded function. 1. `write(self, output_path: Union[str | os.PathLike]) -> None` Build the binary and write the result in the given `output` file 2. `write(self, output_path: Union[str | os.PathLike], config: lief._lief.PE.Builder.config_t) -> None` Build the binary with the given config and write the result in the given `output` file #### [` write_to_byteswrite_to_bytes `]() write\_to\_bytes(*self*, *config: [lief.\_lief.PE.Builder.config\_t]( "lief._lief.PE.Builder.config_t")*) → bytes **write\_to\_bytes(*self*) → bytes** --- ## [Dos Header]() ### [` lief.PE.DosHeader `]() class lief.PE.DosHeader Bases: `Object` Class which represents the DosHeader, the **first** structure present at the beginning of a PE file. Most of the attributes of this structures are not relevant, except [`addressof_new_exeheader`]( "lief.PE.DosHeader.addressof_new_exeheader") #### [` addressof_new_exeheader `]() property addressof\_new\_exeheader → int #### [` addressof_relocation_table `]() property addressof\_relocation\_table → int #### [` checksum `]() property checksum → int #### [` copy `]() copy(*self*) → [lief.\_lief.PE.DosHeader]( "lief._lief.PE.DosHeader") Duplicate the current instance of this object #### [` create `]() create(*arg: [lief.PE.PE\_TYPE]( "lief.PE.PE_TYPE")*) → [lief.PE.DosHeader]( "lief.PE.DosHeader") = <nanobind.nb\_func object> #### [` file_size_in_pages `]() property file\_size\_in\_pages → int #### [` header_size_in_paragraphs `]() property header\_size\_in\_paragraphs → int #### [` initial_ip `]() property initial\_ip → int #### [` initial_relative_cs `]() property initial\_relative\_cs → int #### [` initial_relative_ss `]() property initial\_relative\_ss → int #### [` initial_sp `]() property initial\_sp → int #### [` magic `]() property magic → int #### [` maximum_extra_paragraphs `]() property maximum\_extra\_paragraphs → int #### [` minimum_extra_paragraphs `]() property minimum\_extra\_paragraphs → int #### [` numberof_relocation `]() property numberof\_relocation → int #### [` oem_id `]() property oem\_id → int #### [` oem_info `]() property oem\_info → int #### [` overlay_number `]() property overlay\_number → int #### [` used_bytes_in_last_page `]() property used\_bytes\_in\_last\_page → int --- ## [Header]() ### [` lief.PE.Header `]() class lief.PE.Header Bases: `Object` Class that represents the PE header (which follows the [`lief.PE.DosHeader`]( "lief.PE.DosHeader")) #### [` CHARACTERISTICS `]() class CHARACTERISTICS(*\*values*) Bases: `Flag` ##### [` AGGRESSIVE_WS_TRIM `]() AGGRESSIVE\_WS\_TRIM = 16 ##### [` BYTES_REVERSED_HI `]() BYTES\_REVERSED\_HI = 32768 ##### [` BYTES_REVERSED_LO `]() BYTES\_REVERSED\_LO = 128 ##### [` DEBUG_STRIPPED `]() DEBUG\_STRIPPED = 512 ##### [` DLL `]() DLL = 8192 ##### [` EXECUTABLE_IMAGE `]() EXECUTABLE\_IMAGE = 2 ##### [` LARGE_ADDRESS_AWARE `]() LARGE\_ADDRESS\_AWARE = 32 ##### [` LINE_NUMS_STRIPPED `]() LINE\_NUMS\_STRIPPED = 4 ##### [` LOCAL_SYMS_STRIPPED `]() LOCAL\_SYMS\_STRIPPED = 8 ##### [` NEED_32BIT_MACHINE `]() NEED\_32BIT\_MACHINE = 256 ##### [` NET_RUN_FROM_SWAP `]() NET\_RUN\_FROM\_SWAP = 2048 ##### [` RELOCS_STRIPPED `]() RELOCS\_STRIPPED = 1 ##### [` REMOVABLE_RUN_FROM_SWAP `]() REMOVABLE\_RUN\_FROM\_SWAP = 1024 ##### [` SYSTEM `]() SYSTEM = 4096 ##### [` UP_SYSTEM_ONLY `]() UP\_SYSTEM\_ONLY = 16384 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.Header.CHARACTERISTICS]( "lief.PE.Header.CHARACTERISTICS") = <nanobind.nb\_func object> #### [` MACHINE_TYPES `]() class MACHINE\_TYPES(*\*values*) Bases: `Enum` ##### [` ALPHA `]() ALPHA = 388 ##### [` ALPHA64 `]() ALPHA64 = 644 ##### [` AM33 `]() AM33 = 467 ##### [` AMD64 `]() AMD64 = 34404 ##### [` ARM `]() ARM = 448 ##### [` ARM64 `]() ARM64 = 43620 ##### [` ARM64EC `]() ARM64EC = 42561 ##### [` ARM64X `]() ARM64X = 42574 ##### [` ARMNT `]() ARMNT = 452 ##### [` CHPE_X86 `]() CHPE\_X86 = 14948 ##### [` EBC `]() EBC = 3772 ##### [` I386 `]() I386 = 332 ##### [` IA64 `]() IA64 = 512 ##### [` LOONGARCH32 `]() LOONGARCH32 = 25138 ##### [` LOONGARCH64 `]() LOONGARCH64 = 25188 ##### [` M32R `]() M32R = 36929 ##### [` MIPS16 `]() MIPS16 = 614 ##### [` MIPSFPU `]() MIPSFPU = 870 ##### [` MIPSFPU16 `]() MIPSFPU16 = 1126 ##### [` POWERPC `]() POWERPC = 496 ##### [` POWERPCBE `]() POWERPCBE = 498 ##### [` POWERPCFP `]() POWERPCFP = 497 ##### [` R4000 `]() R4000 = 358 ##### [` SH3 `]() SH3 = 418 ##### [` SH3DSP `]() SH3DSP = 419 ##### [` SH4 `]() SH4 = 422 ##### [` SH5 `]() SH5 = 424 ##### [` THUMB `]() THUMB = 450 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` WCEMIPSV2 `]() WCEMIPSV2 = 361 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.Header.MACHINE\_TYPES]( "lief.PE.Header.MACHINE_TYPES") = <nanobind.nb\_func object> #### [` add_characteristic `]() add\_characteristic(*self*, *characteristic: [lief.\_lief.PE.Header.CHARACTERISTICS]( "lief._lief.PE.Header.CHARACTERISTICS")*) → None Add the given [`CHARACTERISTICS`]( "lief.PE.Header.CHARACTERISTICS") to the header #### [` characteristics `]() property characteristics → int The [`CHARACTERISTICS`]( "lief.PE.Header.CHARACTERISTICS") that indicate the attributes of the file. #### [` characteristics_list `]() property characteristics\_list → list[[lief.PE.Header.CHARACTERISTICS]( "lief.PE.Header.CHARACTERISTICS")] Return the [`CHARACTERISTICS`]( "lief.PE.Header.CHARACTERISTICS") as a `list` #### [` copy `]() copy(*self*) → [lief.\_lief.PE.Header]( "lief._lief.PE.Header") Duplicate the current instance of this object #### [` create `]() create(*type: [lief.PE.PE\_TYPE]( "lief.PE.PE_TYPE")*) → [lief.PE.Header]( "lief.PE.Header") = <nanobind.nb\_func object> #### [` has_characteristic `]() has\_characteristic(*self*, *characteristic: [lief.\_lief.PE.Header.CHARACTERISTICS]( "lief._lief.PE.Header.CHARACTERISTICS")*) → bool `True` if the header has the given [`CHARACTERISTICS`]( "lief.PE.Header.CHARACTERISTICS") #### [` machine `]() property machine → [lief.PE.Header.MACHINE\_TYPES]( "lief.PE.Header.MACHINE_TYPES") The target machine architecture ([`MACHINE_TYPES`]( "lief.PE.Header.MACHINE_TYPES")) #### [` numberof_sections `]() property numberof\_sections → int Number of sections in the binary #### [` numberof_symbols `]() property numberof\_symbols → int The number of entries in the symbol table. This data can be used to locate the string table which immediately follows the symbol table. This value should be zero for an image because COFF debugging information is deprecated. #### [` pointerto_symbol_table `]() property pointerto\_symbol\_table → int The file offset of the COFF symbol table, or zero if no COFF symbol table is present. This value should be zero for an image because COFF debugging information is deprecated. #### [` remove_characteristic `]() remove\_characteristic(*self*, *characteristic: [lief.\_lief.PE.Header.CHARACTERISTICS]( "lief._lief.PE.Header.CHARACTERISTICS")*) → None Remove the given [`CHARACTERISTICS`]( "lief.PE.Header.CHARACTERISTICS") from the header #### [` signature `]() property signature → list[int] Signature (or magic byte) of the header. It must be: `PE\0\0` #### [` sizeof_optional_header `]() property sizeof\_optional\_header → int Size of the [`OptionalHeader`]( "lief.PE.OptionalHeader") **AND** the data directories which follows this header. This value is equivalent to: `sizeof(pe_optional_header) + NB_DATA_DIR * sizeof(data_directory)` This size **should** be either: > - 0xE0 (224) for a PE32 (32 bits) > - 0xF0 (240) for a PE32+ (64 bits) #### [` time_date_stamps `]() property time\_date\_stamps → int The low 32 bits of the number of seconds since 00:00 January 1, 1970 that indicates when the file was created. --- ## [Optional Header]() ### [` lief.PE.OptionalHeader `]() class lief.PE.OptionalHeader Bases: `Object` Class which represents the PE OptionalHeader structure. #### [` DLL_CHARACTERISTICS `]() class DLL\_CHARACTERISTICS(*\*values*) Bases: `IntFlag` ##### [` APPCONTAINER `]() APPCONTAINER = 4096 ##### [` DYNAMIC_BASE `]() DYNAMIC\_BASE = 64 ##### [` FORCE_INTEGRITY `]() FORCE\_INTEGRITY = 128 ##### [` GUARD_CF `]() GUARD\_CF = 16384 ##### [` HIGH_ENTROPY_VA `]() HIGH\_ENTROPY\_VA = 32 ##### [` NO_BIND `]() NO\_BIND = 2048 ##### [` NO_ISOLATION `]() NO\_ISOLATION = 512 ##### [` NO_SEH `]() NO\_SEH = 1024 ##### [` NX_COMPAT `]() NX\_COMPAT = 256 ##### [` TERMINAL_SERVER_AWARE `]() TERMINAL\_SERVER\_AWARE = 32768 ##### [` WDM_DRIVER `]() WDM\_DRIVER = 8192 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.OptionalHeader.DLL\_CHARACTERISTICS]( "lief.PE.OptionalHeader.DLL_CHARACTERISTICS") = <nanobind.nb\_func object> #### [` SUBSYSTEM `]() class SUBSYSTEM(*\*values*) Bases: `Enum` ##### [` EFI_APPLICATION `]() EFI\_APPLICATION = 10 ##### [` EFI_BOOT_SERVICE_DRIVER `]() EFI\_BOOT\_SERVICE\_DRIVER = 11 ##### [` EFI_ROM `]() EFI\_ROM = 13 ##### [` EFI_RUNTIME_DRIVER `]() EFI\_RUNTIME\_DRIVER = 12 ##### [` NATIVE `]() NATIVE = 1 ##### [` NATIVE_WINDOWS `]() NATIVE\_WINDOWS = 8 ##### [` OS2_CUI `]() OS2\_CUI = 5 ##### [` POSIX_CUI `]() POSIX\_CUI = 7 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` WINDOWS_BOOT_APPLICATION `]() WINDOWS\_BOOT\_APPLICATION = 16 ##### [` WINDOWS_CE_GUI `]() WINDOWS\_CE\_GUI = 9 ##### [` WINDOWS_CUI `]() WINDOWS\_CUI = 3 ##### [` WINDOWS_GUI `]() WINDOWS\_GUI = 2 ##### [` XBOX `]() XBOX = 14 ##### [` XBOX_CODE_CATALOG `]() XBOX\_CODE\_CATALOG = 17 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.OptionalHeader.SUBSYSTEM]( "lief.PE.OptionalHeader.SUBSYSTEM") = <nanobind.nb\_func object> #### [` add `]() add(*self*, *characteristic: [lief.\_lief.PE.OptionalHeader.DLL\_CHARACTERISTICS]( "lief._lief.PE.OptionalHeader.DLL_CHARACTERISTICS")*) → None Add the given [`DLL_CHARACTERISTICS`]( "lief.PE.OptionalHeader.DLL_CHARACTERISTICS") #### [` addressof_entrypoint `]() property addressof\_entrypoint → int The address of the entry point relative to the image base when the executable file is loaded into memory. For program images, this is the starting address. For device drivers, this is the address of the initialization function. An entry point is optional for DLLs. When no entry point is present, this field must be zero. #### [` baseof_code `]() property baseof\_code → int Address relative to the imagebase where the binary’s code starts #### [` baseof_data `]() property baseof\_data → int Address relative to the imagebase where the binary’s data starts. > **Warning** > > This value is not present for `PE64` files #### [` checksum `]() property checksum → int The image file checksum. The algorithm for computing the checksum is incorporated into `IMAGHELP.DLL`. The following are checked for validation at load time all **drivers**, any **DLL loaded at boot** time, and any **DLL** that is loaded into a **critical** Windows process. #### [` copy `]() copy(*self*) → [lief.\_lief.PE.OptionalHeader]( "lief._lief.PE.OptionalHeader") Duplicate the current instance of this object #### [` create `]() create(*type: [lief.PE.PE\_TYPE]( "lief.PE.PE_TYPE")*) → [lief.PE.OptionalHeader]( "lief.PE.OptionalHeader") = <nanobind.nb\_func object> #### [` dll_characteristics `]() property dll\_characteristics → int Some characteristics ([`DLL_CHARACTERISTICS`]( "lief.PE.OptionalHeader.DLL_CHARACTERISTICS")) of the underlying binary like the support of the PIE. The prefix `dll` comes from the official PE specifications but these characteristics are also used for **executables** #### [` dll_characteristics_lists `]() property dll\_characteristics\_lists → list[[lief.PE.OptionalHeader.DLL\_CHARACTERISTICS]( "lief.PE.OptionalHeader.DLL_CHARACTERISTICS")] [`dll_characteristics`]( "lief.PE.OptionalHeader.dll_characteristics") as a list of [`DLL_CHARACTERISTICS`]( "lief.PE.OptionalHeader.DLL_CHARACTERISTICS") #### [` file_alignment `]() property file\_alignment → int The alignment factor (in bytes) that is used to align the raw data of sections in the image file. The value should be a **power of 2** between 512 and 64K, inclusive. The default value is 512. If the [`section_alignment`]( "lief.PE.OptionalHeader.section_alignment") is less than the architecture’s page size, then [`file_alignment`]( "lief.PE.OptionalHeader.file_alignment") must match [`section_alignment`]( "lief.PE.OptionalHeader.section_alignment"). #### [` has `]() has(*self*, *characteristics: [lief.\_lief.PE.OptionalHeader.DLL\_CHARACTERISTICS]( "lief._lief.PE.OptionalHeader.DLL_CHARACTERISTICS")*) → bool `True` if the given [`DLL_CHARACTERISTICS`]( "lief.PE.OptionalHeader.DLL_CHARACTERISTICS") is in the [`dll_characteristics`]( "lief.PE.OptionalHeader.dll_characteristics") #### [` imagebase `]() property imagebase → int The preferred base address when mapping the binary in memory #### [` loader_flags `]() property loader\_flags → int According to the PE specifications, this value is *reserved* and **should** be 0. #### [` magic `]() property magic → [lief.PE.PE\_TYPE]( "lief.PE.PE_TYPE") Magic value ([`PE_TYPE`]( "lief.PE.PE_TYPE")) that identifies a `PE32` from a `PE64` #### [` major_image_version `]() property major\_image\_version → int The major version number of the image. #### [` major_linker_version `]() property major\_linker\_version → int The linker major version number #### [` major_operating_system_version `]() property major\_operating\_system\_version → int The major version number of the required operating system. #### [` major_subsystem_version `]() property major\_subsystem\_version → int The major version number of the subsystem. #### [` minor_image_version `]() property minor\_image\_version → int The minor version number of the image. #### [` minor_linker_version `]() property minor\_linker\_version → int The linker minor version number #### [` minor_operating_system_version `]() property minor\_operating\_system\_version → int The minor version number of the required operating system. #### [` minor_subsystem_version `]() property minor\_subsystem\_version → int The minor version number of the subsystem #### [` numberof_rva_and_size `]() property numberof\_rva\_and\_size → int The number of [`DataDirectory`]( "lief.PE.DataDirectory") that follow this header #### [` remove `]() remove(*self*, *characteristic: [lief.\_lief.PE.OptionalHeader.DLL\_CHARACTERISTICS]( "lief._lief.PE.OptionalHeader.DLL_CHARACTERISTICS")*) → None Remove the given [`DLL_CHARACTERISTICS`]( "lief.PE.OptionalHeader.DLL_CHARACTERISTICS") #### [` section_alignment `]() property section\_alignment → int The alignment (in bytes) of sections when they are loaded into memory. It must be greater than or equal to [`file_alignment`]( "lief.PE.OptionalHeader.file_alignment") and the default is the page size for the architecture. #### [` sizeof_code `]() property sizeof\_code → int The size of the code `.text` section or the sum of all the sections that contain code (ie. [`Section`]( "lief.PE.Section") with the flag [`CNT_CODE`]( "lief.PE.Section.CHARACTERISTICS.CNT_CODE")) #### [` sizeof_headers `]() property sizeof\_headers → int The combined size of an MS-DOS stub, PE header, and section headers rounded up to a multiple of [`file_alignment`]( "lief.PE.OptionalHeader.file_alignment"). #### [` sizeof_heap_commit `]() property sizeof\_heap\_commit → int The size of the local heap space to commit. #### [` sizeof_heap_reserve `]() property sizeof\_heap\_reserve → int The size of the local heap space to reserve. Only [`sizeof_heap_commit`]( "lief.PE.OptionalHeader.sizeof_heap_commit") is available one page at a time until the reserve size is reached. #### [` sizeof_image `]() property sizeof\_image → int The size (in bytes) of the image, including all headers, as the image is loaded in memory. It must be a multiple of [`section_alignment`]( "lief.PE.OptionalHeader.section_alignment") and should match [`virtual_size`]( "lief.PE.Binary.virtual_size"). #### [` sizeof_initialized_data `]() property sizeof\_initialized\_data → int The size of the initialized data which are usually located in the `.data` section. If the initialized data are split across multiple sections, it is the sum of the sections. The sections associated with the initialized data are usually identified with the flag [`CNT_INITIALIZED_DATA`]( "lief.PE.Section.CHARACTERISTICS.CNT_INITIALIZED_DATA") #### [` sizeof_stack_commit `]() property sizeof\_stack\_commit → int The size of the stack to commit. #### [` sizeof_stack_reserve `]() property sizeof\_stack\_reserve → int The size of the stack to reserve. Only [`sizeof_stack_commit`]( "lief.PE.OptionalHeader.sizeof_stack_commit") is committed, the rest is made available one page at a time until the reserve size is reached. #### [` sizeof_uninitialized_data `]() property sizeof\_uninitialized\_data → int The size of the uninitialized data which are usually located in the `.bss` section. If the uninitialized data are split across multiple sections, it is the sum of the sections. The sections associated with the uninitialized data are usually identified with the flag [`CNT_UNINITIALIZED_DATA`]( "lief.PE.Section.CHARACTERISTICS.CNT_UNINITIALIZED_DATA") #### [` subsystem `]() property subsystem → [lief.PE.OptionalHeader.SUBSYSTEM]( "lief.PE.OptionalHeader.SUBSYSTEM") Target subsystem ([`SUBSYSTEM`]( "lief.PE.OptionalHeader.SUBSYSTEM")) like Driver, XBox, Windows GUI, .. #### [` win32_version_value `]() property win32\_version\_value → int Reserved, must be zero. --- ## [Data Directory]() ### [` lief.PE.DataDirectory `]() class lief.PE.DataDirectory(*self*) Bases: `Object` Class that represents a PE data directory entry #### [` TYPES `]() class TYPES(*\*values*) Bases: `Enum` ##### [` ARCHITECTURE `]() ARCHITECTURE = 7 ##### [` BASE_RELOCATION_TABLE `]() BASE\_RELOCATION\_TABLE = 5 ##### [` BOUND_IMPORT `]() BOUND\_IMPORT = 11 ##### [` CERTIFICATE_TABLE `]() CERTIFICATE\_TABLE = 4 ##### [` CLR_RUNTIME_HEADER `]() CLR\_RUNTIME\_HEADER = 14 ##### [` DEBUG_DIR `]() DEBUG\_DIR = 6 ##### [` DELAY_IMPORT_DESCRIPTOR `]() DELAY\_IMPORT\_DESCRIPTOR = 13 ##### [` EXCEPTION_TABLE `]() EXCEPTION\_TABLE = 3 ##### [` EXPORT_TABLE `]() EXPORT\_TABLE = 0 ##### [` GLOBAL_PTR `]() GLOBAL\_PTR = 8 ##### [` IAT `]() IAT = 12 ##### [` IMPORT_TABLE `]() IMPORT\_TABLE = 1 ##### [` LOAD_CONFIG_TABLE `]() LOAD\_CONFIG\_TABLE = 10 ##### [` RESERVED `]() RESERVED = 15 ##### [` RESOURCE_TABLE `]() RESOURCE\_TABLE = 2 ##### [` TLS_TABLE `]() TLS\_TABLE = 9 ##### [` UNKNOWN `]() UNKNOWN = 16 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.DataDirectory.TYPES]( "lief.PE.DataDirectory.TYPES") = <nanobind.nb\_func object> #### [` content `]() property content → memoryview Raw content (bytes) referenced by this data directory #### [` copy `]() copy(*self*) → [lief.\_lief.PE.DataDirectory]( "lief._lief.PE.DataDirectory") Duplicate the current instance of this object #### [` has_section `]() property has\_section → bool `True` if the current data directory is tied to a [`Section`]( "lief.PE.Section") #### [` rva `]() property rva → int **Relative** virtual address of the content associated with the current data directory #### [` section `]() property section → [lief.PE.Section]( "lief.PE.Section") | None [`Section`]( "lief.PE.Section") associated with the current data directory or None if not linked #### [` size `]() property size → int Size in bytes of the content associated with the current data directory #### [` type `]() property type → [lief.PE.DataDirectory.TYPES]( "lief.PE.DataDirectory.TYPES") Type ([`TYPES`]( "lief.PE.DataDirectory.TYPES")) of the current data directory --- ## [Section]() ![Inheritance diagram of lief._lief.PE.Section](https://lief.re/doc/latest/_images/inheritance-4ec5847f99e6746fb5ba5ed346b3612401634fa6.png) ### [` lief.PE.Sectionlief.PE.Sectionlief.PE.Section `]() class lief.PE.Section(*self*) **class lief.PE.Section(*self*, *name: str*, *content: collections.abc.Sequence[int]*) **class lief.PE.Section(*self*, *name: str*)**** Bases: [`Section`]( "lief._lief.Section") Class which represents a PE section. It extends the base class [`lief.Section`]( "lief.Section") #### [` CHARACTERISTICS `]() class CHARACTERISTICS(*\*values*) Bases: `Flag` ##### [` ALIGN_1024BYTES `]() ALIGN\_1024BYTES = 11534336 ##### [` ALIGN_128BYTES `]() ALIGN\_128BYTES = 8388608 ##### [` ALIGN_16BYTES `]() ALIGN\_16BYTES = 5242880 ##### [` ALIGN_1BYTES `]() ALIGN\_1BYTES = 1048576 ##### [` ALIGN_2048BYTES `]() ALIGN\_2048BYTES = 12582912 ##### [` ALIGN_256BYTES `]() ALIGN\_256BYTES = 9437184 ##### [` ALIGN_2BYTES `]() ALIGN\_2BYTES = 2097152 ##### [` ALIGN_32BYTES `]() ALIGN\_32BYTES = 6291456 ##### [` ALIGN_4096BYTES `]() ALIGN\_4096BYTES = 13631488 ##### [` ALIGN_4BYTES `]() ALIGN\_4BYTES = 3145728 ##### [` ALIGN_512BYTES `]() ALIGN\_512BYTES = 10485760 ##### [` ALIGN_64BYTES `]() ALIGN\_64BYTES = 7340032 ##### [` ALIGN_8192BYTES `]() ALIGN\_8192BYTES = 14680064 ##### [` ALIGN_8BYTES `]() ALIGN\_8BYTES = 4194304 ##### [` CNT_CODE `]() CNT\_CODE = 32 ##### [` CNT_INITIALIZED_DATA `]() CNT\_INITIALIZED\_DATA = 64 ##### [` CNT_UNINITIALIZED_DATA `]() CNT\_UNINITIALIZED\_DATA = 128 ##### [` GPREL `]() GPREL = 32768 ##### [` LNK_COMDAT `]() LNK\_COMDAT = 4096 ##### [` LNK_INFO `]() LNK\_INFO = 512 ##### [` LNK_NRELOC_OVFL `]() LNK\_NRELOC\_OVFL = 16777216 ##### [` LNK_OTHER `]() LNK\_OTHER = 256 ##### [` LNK_REMOVE `]() LNK\_REMOVE = 2048 ##### [` MEM_16BIT `]() MEM\_16BIT = 131072 ##### [` MEM_DISCARDABLE `]() MEM\_DISCARDABLE = 33554432 ##### [` MEM_EXECUTE `]() MEM\_EXECUTE = 536870912 ##### [` MEM_LOCKED `]() MEM\_LOCKED = 262144 ##### [` MEM_NOT_CACHED `]() MEM\_NOT\_CACHED = 67108864 ##### [` MEM_NOT_PAGED `]() MEM\_NOT\_PAGED = 134217728 ##### [` MEM_PRELOAD `]() MEM\_PRELOAD = 524288 ##### [` MEM_PURGEABLE `]() MEM\_PURGEABLE = 65536 ##### [` MEM_READ `]() MEM\_READ = 1073741824 ##### [` MEM_SHARED `]() MEM\_SHARED = 268435456 ##### [` MEM_WRITE `]() MEM\_WRITE = 2147483648 ##### [` TYPE_NO_PAD `]() TYPE\_NO\_PAD = 8 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.Section.CHARACTERISTICS]( "lief.PE.Section.CHARACTERISTICS") = <nanobind.nb\_func object> #### [` characteristics `]() property characteristics → int The [`CHARACTERISTICS`]( "lief.PE.Section.CHARACTERISTICS") that describe the characteristics of the section #### [` characteristics_lists `]() property characteristics\_lists → list[[lief.PE.Section.CHARACTERISTICS]( "lief.PE.Section.CHARACTERISTICS")] [`characteristics`]( "lief.PE.Section.characteristics") as a `list` #### [` coff_string `]() property coff\_string → [lief.COFF.String]( "lief.COFF.String") | None Return the COFF string associated with the section’s name (or None) This coff string is usually present for long section names whose length does not fit in the 8 bytes allocated by the PE format. #### [` copy `]() copy(*self*) → [lief.\_lief.PE.Section]( "lief._lief.PE.Section") Duplicate the current instance of this object #### [` has_characteristic `]() has\_characteristic(*self*, *characteristic: [lief.\_lief.PE.Section.CHARACTERISTICS]( "lief._lief.PE.Section.CHARACTERISTICS")*) → bool `True` if the section has the given [`CHARACTERISTICS`]( "lief.PE.Section.CHARACTERISTICS") #### [` is_discardable `]() property is\_discardable → bool True if the section can be discarded as needed. This is typically the case for debug-related sections. #### [` numberof_line_numbers `]() property numberof\_line\_numbers → int The number of line-number entries for the section. This value should be zero for an image because COFF debugging information is deprecated. See: [`pointerto_line_numbers`]( "lief.PE.Section.pointerto_line_numbers") #### [` numberof_relocations `]() property numberof\_relocations → int The number of relocation entries for the section. See: [`pointerto_relocation`]( "lief.PE.Section.pointerto_relocation") #### [` padding `]() property padding → bytes Section padding content as bytes #### [` pointerto_line_numbers `]() property pointerto\_line\_numbers → int The file pointer to the beginning of line-number entries for the section. This is set to zero if there are no COFF line numbers. This value should be zero for an image because COFF debugging information is deprecated and modern debug information relies on the PDB files. #### [` pointerto_raw_data `]() property pointerto\_raw\_data → int The offset of the section data in the PE file. Alias of `offset` #### [` pointerto_relocation `]() property pointerto\_relocation → int The file pointer to the beginning of the COFF relocation entries for the section. This is set to zero for executable images or if there are no relocations. For modern PE binaries, this value is usually set to 0 as the relocations are managed by [`Relocation`]( "lief.PE.Relocation"). #### [` sizeof_raw_data `]() property sizeof\_raw\_data → int Alias of `size` (size of the data in the section) #### [` virtual_size `]() property virtual\_size → int The total size of the section when loaded into memory. If this value is greater than [`sizeof_raw_data`]( "lief.PE.Section.sizeof_raw_data"), the section is zero-padded. --- ## [Import]() ### [` lief.PE.Importlief.PE.Import `]() class lief.PE.Import(*self*) **class lief.PE.Import(*self*, *library\_name: str*)** Bases: `Object` Class that represents a PE import Overloaded function. 1. `__init__(self) -> None` Default constructor 2. `__init__(self, library_name: str) -> None` Constructor from a library name #### [` add_entryadd_entry `]() add\_entry(*self*, *entry: [lief.\_lief.PE.ImportEntry]( "lief._lief.PE.ImportEntry")*) → [lief.\_lief.PE.ImportEntry]( "lief._lief.PE.ImportEntry") **add\_entry(*self*, *function\_name: str*) → [lief.\_lief.PE.ImportEntry]( "lief._lief.PE.ImportEntry")** Add an [`ImportEntry`]( "lief.PE.ImportEntry") (function) to the current import #### [` directory `]() property directory → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the [`DataDirectory`]( "lief.PE.DataDirectory") associated with this import. It should be the one at index [`lief.PE.DataDirectory.TYPES.IMPORT_TABLE`]( "lief.PE.DataDirectory.TYPES.IMPORT_TABLE"). It can return None if the Import directory can’t be resolved. #### [` entries `]() property entries → lief.PE.Import.it\_entries Iterator over the [`ImportEntry`]( "lief.PE.ImportEntry") (functions) #### [` forwarder_chain `]() property forwarder\_chain → int The index of the first forwarder reference #### [` get_entry `]() get\_entry(*self*, *function\_name: str*) → [lief.\_lief.PE.ImportEntry]( "lief._lief.PE.ImportEntry") | None Return the [`ImportEntry`]( "lief.PE.ImportEntry") with the given name or None if not found #### [` get_function_rva_from_iat `]() get\_function\_rva\_from\_iat(*self*, *function\_name: str*) → int | [lief.\_lief.lief\_errors]( "lief._lief.lief_errors") Return the relative virtual address of the given function within the *Import Address Table* #### [` iat_directory `]() property iat\_directory → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None Return the [`DataDirectory`]( "lief.PE.DataDirectory") associated with the `IAT` table. It should be the one at index [`lief.PE.DataDirectory.TYPES.IAT`]( "lief.PE.DataDirectory.TYPES.IAT"). It can return None if the IAT directory can’t be resolved. #### [` import_address_table_rva `]() property import\_address\_table\_rva → int The RVA of the import address table (`IAT`). The content of this table is **identical** to the content of the Import Lookup Table (`ILT`) until the image is bound. > **Warning** > > This address could change when re-building the binary #### [` import_lookup_table_rva `]() property import\_lookup\_table\_rva → int The RVA of the import lookup table. This table contains the [`name`]( "lief.PE.ImportEntry.name") or the [`ordinal`]( "lief.PE.ImportEntry.ordinal") for all the imports. #### [` name `]() property name → str | bytes Library name (e.g. `kernel32.dll`) #### [` name_rva `]() property name\_rva → int The original name rva #### [` remove_entryremove_entry `]() remove\_entry(*self*, *name: str*) → bool **remove\_entry(*self*, *ord: int*) → bool** Overloaded function. 1. `remove_entry(self, name: str) -> bool` > Remove the import entry with the given name. > > Return True if the deletion succeeds, False otherwise 2. `remove_entry(self, ord: int) -> bool` > Remove the import entry with the given ordinal number > > Return True if the deletion succeeds, False otherwise #### [` timedatestamp `]() property timedatestamp → int The stamp that is set to zero until the image is bound. After the image is bound, this field is set to the time/data stamp of the DLL --- ## [Import Entry]() ![Inheritance diagram of lief._lief.PE.ImportEntry](https://lief.re/doc/latest/_images/inheritance-0d8847179a2a8791a1abb018ab960e38abe26ede.png) ### [` lief.PE.ImportEntrylief.PE.ImportEntrylief.PE.ImportEntry `]() class lief.PE.ImportEntry(*self*) **class lief.PE.ImportEntry(*self*, *import\_name: str*) **class lief.PE.ImportEntry(*self*, *data: int*, *type: [lief.\_lief.PE.PE\_TYPE]( "lief._lief.PE.PE_TYPE")*)**** Bases: [`Symbol`]( "lief._lief.Symbol") Class that represents an entry (i.e. an import) in the import table ([`Import`]( "lief.PE.Import")). It extends the [`lief.Symbol`]( "lief.Symbol") generic class that provides the [`lief.Symbol.name`]( "lief.Symbol.name") and [`lief.Symbol.value`]( "lief.Symbol.value") Overloaded function. 1. `__init__(self) -> None` 2. `__init__(self, import_name: str) -> None` Constructor from a [`name`]( "lief.PE.ImportEntry.name") 3. `__init__(self, data: int, type: lief._lief.PE.PE_TYPE) -> None` #### [` copy `]() copy(*self*) → [lief.\_lief.PE.ImportEntry]( "lief._lief.PE.ImportEntry") Duplicate the current instance of this object #### [` data `]() property data → int Raw value #### [` demangled_name `]() property demangled\_name → str Demangled representation of the symbol or an empty string if it can’t be demangled. #### [` hint `]() property hint → int Index into the [`lief.PE.Export.entries`]( "lief.PE.Export.entries") that is used to speed-up the symbol resolution #### [` iat_address `]() property iat\_address → int **Original** address of the entry in the Import Address Table #### [` iat_value `]() property iat\_value → int Value of the current entry in the Import Address Table. It should match the lookup table value. #### [` ilt_value `]() property ilt\_value → int Original value in the import lookup table. This value should match the [`iat_value`]( "lief.PE.ImportEntry.iat_value") #### [` is_ordinal `]() property is\_ordinal → bool `True` if it is an import by ordinal #### [` name `]() property name → str | bytes Import name if not ordinal #### [` ordinal `]() property ordinal → int Ordinal value (if any). See: [`is_ordinal`]( "lief.PE.ImportEntry.is_ordinal") --- ## [Delay Import]() ### [` lief.PE.DelayImport `]() class lief.PE.DelayImport(*self*, *library\_name: str*) Bases: `Object` Class that represents a PE delay import Constructor from a library name #### [` attribute `]() property attribute → int Reserved and **should** be zero according to the PE specifications #### [` biat `]() property biat → int RVA of the **bound** delay-load import address table or 0 if the table does not exist. #### [` copy `]() copy(*self*) → [lief.\_lief.PE.DelayImport]( "lief._lief.PE.DelayImport") Duplicate the current instance of this object #### [` entries `]() property entries → lief.PE.DelayImport.it\_entries Iterator over the [`DelayImportEntry`]( "lief.PE.DelayImportEntry") (functions) #### [` handle `]() property handle → int The RVA of the module handle (in the `.data` section) It is used for storage by the routine that is supplied to manage delay-loading. #### [` iat `]() property iat → int RVA of the delay-load import address table. #### [` name `]() property name → str | bytes Library name (e.g. `kernel32.dll`) #### [` names_table `]() property names\_table → int RVA of the delay-load import names table. The content of this table has the same layout as the Import lookup table #### [` timestamp `]() property timestamp → int The timestamp of the DLL to which this image has been bound. #### [` uiat `]() property uiat → int RVA of the **unload** delay-load import address table or 0 if the table does not exist. According to the PE specifications, this table is an exact copy of the delay import address table that can be used to restore the original IAT in the case of unloading. --- ## [Delay Import Entry]() ![Inheritance diagram of lief._lief.PE.DelayImportEntry](https://lief.re/doc/latest/_images/inheritance-eb3b10b9aa120286296559dc2f4cc31831aae3ba.png) ### [` lief.PE.DelayImportEntry `]() class lief.PE.DelayImportEntry(*self*) Bases: [`Symbol`]( "lief._lief.Symbol") Class that represents an entry (i.e. a delay import) in the delay import table ([`DelayImport`]( "lief.PE.DelayImport")). It extends the [`lief.Symbol`]( "lief.Symbol") generic class that provides the [`lief.Symbol.name`]( "lief.Symbol.name") and [`lief.Symbol.value`]( "lief.Symbol.value") The meaning of [`lief.Symbol.value`]( "lief.Symbol.value") for this PE object is the address (as an RVA) in the IAT where the resolution should take place #### [` copy `]() copy(*self*) → [lief.\_lief.PE.DelayImportEntry]( "lief._lief.PE.DelayImportEntry") Duplicate the current instance of this object #### [` data `]() property data → int Raw value #### [` demangled_name `]() property demangled\_name → str Demangled representation of the symbol or an empty string if it can’t be demangled. #### [` hint `]() property hint → int Index into the [`lief.PE.Export.entries`]( "lief.PE.Export.entries") that is used to speed-up the symbol resolution #### [` iat_value `]() property iat\_value → int Value of the current entry in the delay-loaded import address table. See: `iat` #### [` is_ordinal `]() property is\_ordinal → bool `True` if it is an import by ordinal #### [` name `]() property name → str | bytes Delay import name if not ordinal #### [` ordinal `]() property ordinal → int Ordinal value (if any). See: [`is_ordinal`]( "lief.PE.DelayImportEntry.is_ordinal") --- ## [TLS]() ### [` lief.PE.TLS `]() class lief.PE.TLS(*self*) Bases: `Object` Class which represents the PE Thread Local Storage. This PE structure is also used to implement binary/library constructors. Default constructor #### [` add_callback `]() add\_callback(*self*, *addr: int*) → [lief.\_lief.PE.TLS]( "lief._lief.PE.TLS") Add a new TLS callback #### [` addressof_callbacks `]() property addressof\_callbacks → int Pointer to an array of TLS callback functions. The array is null-terminated, so if there is no callback, this field points to 4 bytes set to zero. See: [`callbacks`]( "lief.PE.TLS.callbacks") #### [` addressof_index `]() property addressof\_index → int The location to receive the TLS index assigned by the loader. This location should be located in a writable section like `.data`. #### [` addressof_raw_data `]() property addressof\_raw\_data → tuple[int, int] Tuple `(start address, end address)` of the TLS template. The template is a block of data that is used to initialize TLS data. The system copies all of this data each time a thread is created, so it must not be corrupted. > **Note** > > These addresses are not RVA. It is addresses for which there should be a base relocation in the `.reloc` section. #### [` callbacks `]() property callbacks → list[int] List of the callbacks associated with the current TLS. These functions are called before any other functions. #### [` characteristics `]() property characteristics → int The four bits [23:20] describe alignment info. Possible values are those defined as `IMAGE_SCN_ALIGN_*`, which are also used to describe alignment of section in object files. The other 28 bits are reserved for future use. #### [` copy `]() copy(*self*) → [lief.\_lief.PE.TLS]( "lief._lief.PE.TLS") Duplicate the current instance of this object #### [` data_template `]() property data\_template → memoryview The initial content used to initialize TLS data. #### [` directory `]() property directory → [lief.PE.DataDirectory]( "lief.PE.DataDirectory") | None [`DataDirectory`]( "lief.PE.DataDirectory") associated with the TLS object (or None if not linked) #### [` has_data_directory `]() property has\_data\_directory → bool `True` if there is a [`DataDirectory`]( "lief.PE.DataDirectory") associated with the TLS object #### [` has_section `]() property has\_section → bool `True` if there is a [`Section`]( "lief.PE.Section") associated with the TLS object #### [` section `]() property section → [lief.PE.Section]( "lief.PE.Section") | None [`Section`]( "lief.PE.Section") associated with the TLS object (or None if not linked) #### [` sizeof_zero_fill `]() property sizeof\_zero\_fill → int Size in bytes of the zeros to be *padded* after the data specified by [`data_template`]( "lief.PE.TLS.data_template"). --- ## [Relocation]() ### [` lief.PE.Relocation `]() class lief.PE.Relocation(*self*) Bases: `Object` Class which represents the *Base Relocation Block* Usually, we find this structure in the `.reloc` section #### [` add_entry `]() add\_entry(*self*, *new\_entry: [lief.\_lief.PE.RelocationEntry]( "lief._lief.PE.RelocationEntry")*) → [lief.\_lief.PE.RelocationEntry]( "lief._lief.PE.RelocationEntry") Add a new [`RelocationEntry`]( "lief.PE.RelocationEntry") #### [` block_size `]() property block\_size → int The total number of bytes in the base relocation block. `block_size = sizeof(BaseRelocationBlock) + nb_of_relocs * sizeof(uint16_t = RelocationEntry)` #### [` copy `]() copy(*self*) → [lief.\_lief.PE.Relocation]( "lief._lief.PE.Relocation") Duplicate the current instance of this object #### [` entries `]() property entries → lief.PE.Relocation.it\_entries Iterator over the [`RelocationEntry`]( "lief.PE.RelocationEntry") #### [` virtual_address `]() property virtual\_address → int The RVA for which the offset of the relocation entries (RelocationEntry) is added --- ## [Relocation Entry]() ![Inheritance diagram of lief._lief.PE.RelocationEntry](https://lief.re/doc/latest/_images/inheritance-95557131fc2837858595d2a195361e582d395a11.png) ### [` lief.PE.RelocationEntrylief.PE.RelocationEntry `]() class lief.PE.RelocationEntry(*self*) **class lief.PE.RelocationEntry(*self*, *arg0: int*, *arg1: [lief.\_lief.PE.RelocationEntry.BASE\_TYPES]( "lief._lief.PE.RelocationEntry.BASE_TYPES")*, */*)** Bases: [`Relocation`]( "lief._lief.Relocation") Class which represents an entry of the PE relocation table. It extends the [`lief.Relocation`]( "lief.Relocation") object to provide an uniform API across the file formats. #### [` BASE_TYPES `]() class BASE\_TYPES(*\*values*) Bases: `Enum` ##### [` ABS `]() ABS = 0 ##### [` ARM_MOV32 `]() ARM\_MOV32 = 517 ##### [` DIR64 `]() DIR64 = 10 ##### [` HIGH `]() HIGH = 1 ##### [` HIGH3ADJ `]() HIGH3ADJ = 11 ##### [` HIGHADJ `]() HIGHADJ = 4 ##### [` HIGHLOW `]() HIGHLOW = 3 ##### [` LOW `]() LOW = 2 ##### [` MIPS_JMPADDR `]() MIPS\_JMPADDR = 261 ##### [` MIPS_JMPADDR16 `]() MIPS\_JMPADDR16 = 9 ##### [` RISCV_HI20 `]() RISCV\_HI20 = 1029 ##### [` RISCV_LOW12I `]() RISCV\_LOW12I = 4103 ##### [` RISCV_LOW12S `]() RISCV\_LOW12S = 8200 ##### [` SECTION `]() SECTION = 6 ##### [` THUMB_MOV32 `]() THUMB\_MOV32 = 2055 ##### [` UNKNOWN `]() UNKNOWN = -1 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.RelocationEntry.BASE\_TYPES]( "lief.PE.RelocationEntry.BASE_TYPES") = <nanobind.nb\_func object> #### [` data `]() property data → int Raw data of the relocation: - The **high** 4 bits store the relocation [`type`]( "lief.PE.RelocationEntry.type") - The **low** 12 bits store the relocation offset ([`position`]( "lief.PE.RelocationEntry.position")) #### [` position `]() property position → int Offset - relative to [`virtual_address`]( "lief.PE.Relocation.virtual_address") - where the relocation occurs #### [` type `]() property type → [lief.PE.RelocationEntry.BASE\_TYPES]( "lief.PE.RelocationEntry.BASE_TYPES") Type of the relocation --- ## [Export]() ### [` lief.PE.Exportlief.PE.Export `]() class lief.PE.Export(*self*) **class lief.PE.Export(*self*, *name: str*, *entries: collections.abc.Sequence[[lief.\_lief.PE.ExportEntry]( "lief._lief.PE.ExportEntry")]*)** Bases: `Object` Class which represents a PE Export Overloaded function. 1. `__init__(self) -> None` Default constructor 2. `__init__(self, name: str, entries: collections.abc.Sequence[lief._lief.PE.ExportEntry]) -> None` Constructor from DLL name and its exports #### [` add_entryadd_entry `]() add\_entry(*self*, *exp: [lief.\_lief.PE.ExportEntry]( "lief._lief.PE.ExportEntry")*) → [lief.\_lief.PE.ExportEntry]( "lief._lief.PE.ExportEntry") **add\_entry(*self*, *name: str*, *addr: int*) → [lief.\_lief.PE.ExportEntry]( "lief._lief.PE.ExportEntry")** Add the given export and return the newly created and added entry #### [` copy `]() copy(*self*) → [lief.\_lief.PE.Export]( "lief._lief.PE.Export") Duplicate the current instance of this object #### [` entries `]() property entries → lief.PE.Export.it\_entries Iterator over the [`ExportEntry`]( "lief.PE.ExportEntry") #### [` export_addr_table_cnt `]() property export\_addr\_table\_cnt → int Number of entries in the export address table #### [` export_addr_table_rva `]() property export\_addr\_table\_rva → int RVA of the export address table #### [` export_flags `]() property export\_flags → int According to the PE specifications this value is reserved and should be set to 0 #### [` find_entryfind_entry `]() find\_entry(*self*, *name: str*) → [lief.\_lief.PE.ExportEntry]( "lief._lief.PE.ExportEntry") | None **find\_entry(*self*, *ordinal: int*) → [lief.\_lief.PE.ExportEntry]( "lief._lief.PE.ExportEntry") | None** Overloaded function. 1. `find_entry(self, name: str) -> lief._lief.PE.ExportEntry | None` Find the export with the given name 2. `find_entry(self, ordinal: int) -> lief._lief.PE.ExportEntry | None` Find the export entry with the given ordinal number #### [` find_entry_at `]() find\_entry\_at(*self*, *rva\_addr: int*) → [lief.\_lief.PE.ExportEntry]( "lief._lief.PE.ExportEntry") | None Find the export entry at the provided RVA #### [` major_version `]() property major\_version → int The major version number (can be user-defined) #### [` minor_version `]() property minor\_version → int The minor version number (can be user-defined) #### [` name `]() property name → str | bytes The name of the library exported (e.g. `KERNEL32.dll`) #### [` name_rva `]() property name\_rva → int Address of the ASCII DLL’s name (RVA) #### [` names_addr_table_cnt `]() property names\_addr\_table\_cnt → int Number of exports by name #### [` names_addr_table_rva `]() property names\_addr\_table\_rva → int RVA to the list of exported names #### [` ord_addr_table_rva `]() property ord\_addr\_table\_rva → int RVA to the list of exported ordinals #### [` ordinal_base `]() property ordinal\_base → int The starting number for the exports. Usually this value is set to 1 #### [` remove_entryremove_entryremove_entry `]() remove\_entry(*self*, *entry: [lief.\_lief.PE.ExportEntry]( "lief._lief.PE.ExportEntry")*) → bool **remove\_entry(*self*, *name: str*) → bool **remove\_entry(*self*, *rva: int*) → bool**** Overloaded function. 1. `remove_entry(self, entry: lief._lief.PE.ExportEntry) -> bool` Remove the given export entry 2. `remove_entry(self, name: str) -> bool` Remove the export entry with the given name 3. `remove_entry(self, rva: int) -> bool` Remove the export entry with the given RVA #### [` timestamp `]() property timestamp → int The time and date that the export data was created --- ## [Export Entry]() ![Inheritance diagram of lief._lief.PE.ExportEntry](https://lief.re/doc/latest/_images/inheritance-f7265a6267bcab14ecabc92c7abd26727b8d91dd.png) ### [` lief.PE.ExportEntrylief.PE.ExportEntry `]() class lief.PE.ExportEntry(*self*) **class lief.PE.ExportEntry(*self*, *name: str*, *addr: int*)** Bases: [`Symbol`]( "lief._lief.Symbol") Class which represents a PE Export entry (cf. [`lief.PE.Export`]( "lief.PE.Export")) Overloaded function. 1. `__init__(self) -> None` Default constructor 2. `__init__(self, name: str, addr: int) -> None` Constructor with export name and address #### [` address `]() property address → int #### [` demangled_name `]() property demangled\_name → str Demangled representation of the symbol or an empty string if it can’t be demangled. #### [` forward_information `]() property forward\_information → [lief.PE.ExportEntry.forward\_information\_t]( "lief.PE.ExportEntry.forward_information_t") #### [` forward_information_t `]() class forward\_information\_t Bases: `object` ##### [` function `]() property function → str ##### [` library `]() property library → str #### [` function_rva `]() property function\_rva → int #### [` is_extern `]() property is\_extern → bool #### [` is_forwarded `]() property is\_forwarded → bool #### [` name `]() property name → str | bytes #### [` ordinal `]() property ordinal → int #### [` set_forward_info `]() set\_forward\_info(*self*, *lib: str*, *function: str*) → None --- ## [Signature]() ### [` lief.PE.Signature `]() class lief.PE.Signature Bases: `Object` #### [` VERIFICATION_CHECKS `]() class VERIFICATION\_CHECKS(*\*values*) Bases: `Flag` Flags to tweak the verification process of the signature See [`lief.PE.Signature.check()`]( "lief.PE.Signature.check") and [`lief.PE.Binary.verify_signature()`]( "lief.PE.Binary.verify_signature") ##### [` DEFAULT `]() DEFAULT = 1 ##### [` HASH_ONLY `]() HASH\_ONLY = 2 ##### [` LIFETIME_SIGNING `]() LIFETIME\_SIGNING = 4 ##### [` SKIP_CERT_TIME `]() SKIP\_CERT\_TIME = 8 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.Signature.VERIFICATION\_CHECKS]( "lief.PE.Signature.VERIFICATION_CHECKS") = <nanobind.nb\_func object> #### [` VERIFICATION_FLAGS `]() class VERIFICATION\_FLAGS(*\*values*) Bases: `Flag` ##### [` BAD_DIGEST `]() BAD\_DIGEST = 128 ##### [` BAD_SIGNATURE `]() BAD\_SIGNATURE = 256 ##### [` CERT_EXPIRED `]() CERT\_EXPIRED = 1024 ##### [` CERT_FUTURE `]() CERT\_FUTURE = 2048 ##### [` CERT_NOT_FOUND `]() CERT\_NOT\_FOUND = 8 ##### [` CORRUPTED_AUTH_DATA `]() CORRUPTED\_AUTH\_DATA = 32 ##### [` CORRUPTED_CONTENT_INFO `]() CORRUPTED\_CONTENT\_INFO = 16 ##### [` INCONSISTENT_DIGEST_ALGORITHM `]() INCONSISTENT\_DIGEST\_ALGORITHM = 4 ##### [` INVALID_SIGNER `]() INVALID\_SIGNER = 1 ##### [` MISSING_PKCS9_MESSAGE_DIGEST `]() MISSING\_PKCS9\_MESSAGE\_DIGEST = 64 ##### [` NO_SIGNATURE `]() NO\_SIGNATURE = 512 ##### [` OK `]() OK = 0 ##### [` UNSUPPORTED_ALGORITHM `]() UNSUPPORTED\_ALGORITHM = 2 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.Signature.VERIFICATION\_FLAGS]( "lief.PE.Signature.VERIFICATION_FLAGS") = <nanobind.nb\_func object> #### [` certificates `]() property certificates → lief.PE.Signature.it\_const\_crt Return an iterator over [`x509`]( "lief.PE.x509") certificates #### [` check `]() check(*self*, *checks: [lief.\_lief.PE.Signature.VERIFICATION\_CHECKS]( "lief._lief.PE.Signature.VERIFICATION_CHECKS") = VERIFICATION\_CHECKS.DEFAULT*) → [lief.\_lief.PE.Signature.VERIFICATION\_FLAGS]( "lief._lief.PE.Signature.VERIFICATION_FLAGS") Check the integrity of the signature and return a [`lief.PE.Signature.VERIFICATION_FLAGS`]( "lief.PE.Signature.VERIFICATION_FLAGS") By default, it performs the following verifications: 1. It must contain only **one** signer info ([`signers`]( "lief.PE.Signature.signers")) 2. [`lief.PE.Signature.digest_algorithm`]( "lief.PE.Signature.digest_algorithm") must match: - [`lief.PE.ContentInfo.digest_algorithm`]( "lief.PE.ContentInfo.digest_algorithm") - [`lief.PE.SignerInfo.digest_algorithm`]( "lief.PE.SignerInfo.digest_algorithm") 3. The x509 certificate specified by [`lief.PE.SignerInfo.serial_number`]( "lief.PE.SignerInfo.serial_number") **and** [`lief.PE.SignerInfo.issuer`]( "lief.PE.SignerInfo.issuer") must exist within [`lief.PE.Signature.certificates`]( "lief.PE.Signature.certificates") 4. Given the x509 certificate, compare [`lief.PE.SignerInfo.encrypted_digest`]( "lief.PE.SignerInfo.encrypted_digest") against either: - hash of authenticated attributes ([`authenticated_attributes`]( "lief.PE.SignerInfo.authenticated_attributes")) if present - hash of ContentInfo 5. If they are Authenticated attributes, check that a PKCS9\_MESSAGE\_DIGEST ([`lief.PE.PKCS9MessageDigest`]( "lief.PE.PKCS9MessageDigest")) attribute exists and that its value matches hash of ContentInfo 6. Check the validity of the PKCS #9 counter signature if present 7. If the signature doesn’t embed a signing-time in the counter signature, check the certificate validity. (See [`lief.PE.Signature.VERIFICATION_CHECKS.LIFETIME_SIGNING`]( "lief.PE.Signature.VERIFICATION_CHECKS.LIFETIME_SIGNING") and [`lief.PE.Signature.VERIFICATION_CHECKS.SKIP_CERT_TIME`]( "lief.PE.Signature.VERIFICATION_CHECKS.SKIP_CERT_TIME")) See: [`lief.PE.Signature.VERIFICATION_CHECKS`]( "lief.PE.Signature.VERIFICATION_CHECKS") to tweak the behavior #### [` content_info `]() property content\_info → [lief.PE.ContentInfo]( "lief.PE.ContentInfo") Return the [`ContentInfo`]( "lief.PE.ContentInfo") #### [` digest_algorithm `]() property digest\_algorithm → [lief.PE.ALGORITHMS]( "lief.PE.ALGORITHMS") Return the algorithm ([`ALGORITHMS`]( "lief.PE.ALGORITHMS")) used to sign the content of [`ContentInfo`]( "lief.PE.ContentInfo") #### [` find_crt `]() find\_crt(*self*, *serialno: collections.abc.Sequence[int]*) → [lief.\_lief.PE.x509]( "lief._lief.PE.x509") | None Find the [`x509`]( "lief.PE.x509") certificate according to its serial number #### [` find_crt_issuerfind_crt_issuer `]() find\_crt\_issuer(*self*, *issuer: str*) → [lief.\_lief.PE.x509]( "lief._lief.PE.x509") | None **find\_crt\_issuer(*self*, *issuer: str*, *serialno: collections.abc.Sequence[int]*) → [lief.\_lief.PE.x509]( "lief._lief.PE.x509") | None** Overloaded function. 1. `find_crt_issuer(self, issuer: str) -> lief._lief.PE.x509 | None` Find the [`x509`]( "lief.PE.x509") certificate according to its issuer 2. `find_crt_issuer(self, issuer: str, serialno: collections.abc.Sequence[int]) -> lief._lief.PE.x509 | None` Find the [`x509`]( "lief.PE.x509") certificate according to its issuer **AND** its serial number #### [` find_crt_subjectfind_crt_subject `]() find\_crt\_subject(*self*, *subject: str*) → [lief.\_lief.PE.x509]( "lief._lief.PE.x509") | None **find\_crt\_subject(*self*, *subject: str*, *serialno: collections.abc.Sequence[int]*) → [lief.\_lief.PE.x509]( "lief._lief.PE.x509") | None** Overloaded function. 1. `find_crt_subject(self, subject: str) -> lief._lief.PE.x509 | None` Find the [`x509`]( "lief.PE.x509") certificate according to its subject 2. `find_crt_subject(self, subject: str, serialno: collections.abc.Sequence[int]) -> lief._lief.PE.x509 | None` Find the [`x509`]( "lief.PE.x509") certificate according to its subject **AND** its serial number #### [` parse `]() parse(*\*args*) → [lief.PE.Signature]( "lief.PE.Signature") | None = <nanobind.nb\_func object> #### [` raw_der `]() property raw\_der → memoryview Return the raw original signature as a byte object #### [` signers `]() property signers → lief.PE.Signature.it\_const\_signers\_t Return an iterator over the signers ([`SignerInfo`]( "lief.PE.SignerInfo")) #### [` version `]() property version → int Version of the signature. It should be 1 --- ## [Signature Attribute]() ![Inheritance diagram of lief._lief.PE.PKCS9CounterSignature, lief._lief.PE.Attribute, lief._lief.PE.MsCounterSign, lief._lief.PE.MsManifestBinaryID, lief._lief.PE.PKCS9AtSequenceNumber, lief._lief.PE.ContentType, lief._lief.PE.SpcRelaxedPeMarkerCheck, lief._lief.PE.MsSpcNestedSignature, lief._lief.PE.SigningCertificateV2, lief._lief.PE.SpcSpOpusInfo, lief._lief.PE.PKCS9SigningTime, lief._lief.PE.GenericType, lief._lief.PE.PKCS9MessageDigest, lief._lief.PE.MsSpcStatementType](https://lief.re/doc/latest/_images/inheritance-94f3792e965be92f8a7903556e513bf93ea4b820.png) ### [` lief.PE.Attribute `]() class lief.PE.Attribute Bases: `Object` Interface over PKCS #7 attribute #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` ##### [` CONTENT_TYPE `]() CONTENT\_TYPE = 1 ##### [` GENERIC_TYPE `]() GENERIC\_TYPE = 2 ##### [` MS_COUNTER_SIGN `]() MS\_COUNTER\_SIGN = 6 ##### [` MS_PLATFORM_MANIFEST_BINARY_ID `]() MS\_PLATFORM\_MANIFEST\_BINARY\_ID = 9 ##### [` MS_SPC_NESTED_SIGN `]() MS\_SPC\_NESTED\_SIGN = 7 ##### [` MS_SPC_STATEMENT_TYPE `]() MS\_SPC\_STATEMENT\_TYPE = 8 ##### [` PKCS9_AT_SEQUENCE_NUMBER `]() PKCS9\_AT\_SEQUENCE\_NUMBER = 10 ##### [` PKCS9_COUNTER_SIGNATURE `]() PKCS9\_COUNTER\_SIGNATURE = 11 ##### [` PKCS9_MESSAGE_DIGEST `]() PKCS9\_MESSAGE\_DIGEST = 12 ##### [` PKCS9_SIGNING_TIME `]() PKCS9\_SIGNING\_TIME = 13 ##### [` SIGNING_CERTIFICATE_V2 `]() SIGNING\_CERTIFICATE\_V2 = 3 ##### [` SPC_RELAXED_PE_MARKER_CHECK `]() SPC\_RELAXED\_PE\_MARKER\_CHECK = 5 ##### [` SPC_SP_OPUS_INFO `]() SPC\_SP\_OPUS\_INFO = 4 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.Attribute.TYPE]( "lief.PE.Attribute.TYPE") = <nanobind.nb\_func object> #### [` type `]() property type → [lief.PE.Attribute.TYPE]( "lief.PE.Attribute.TYPE") Concrete type of the attribute --- ## [Signature ContentType]() ![Inheritance diagram of lief._lief.PE.ContentType](https://lief.re/doc/latest/_images/inheritance-68ea2eed31ab0290254f41e5c925d99b28995375.png) ### [` lief.PE.ContentType `]() class lief.PE.ContentType Bases: [`Attribute`]( "lief._lief.PE.Attribute") Interface over the structure described by the OID `1.2.840.113549.1.9.3` (PKCS #9) The internal structure is described in the: [RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0]() ```text ContentType ::= OBJECT IDENTIFIER ``` #### [` oid `]() property oid → str OID as described in RFC #2985 (string object) --- ## [Signature GenericType]() ![Inheritance diagram of lief._lief.PE.GenericType](https://lief.re/doc/latest/_images/inheritance-6072a4c4cb1f8467d8b3bd789137016f89966b4b.png) ### [` lief.PE.GenericType `]() class lief.PE.GenericType Bases: [`Attribute`]( "lief._lief.PE.Attribute") Interface over an attribute for which the internal structure is not supported by LIEF #### [` oid `]() property oid → str OID of the original attribute #### [` raw_content `]() property raw\_content → memoryview Original DER blob of the attribute --- ## [Signature MsSpcNestedSignature]() ![Inheritance diagram of lief._lief.PE.MsSpcNestedSignature](https://lief.re/doc/latest/_images/inheritance-c583655be46254480df30f51fe698addaef7ecf0.png) ### [` lief.PE.MsSpcNestedSignature `]() class lief.PE.MsSpcNestedSignature Bases: [`Attribute`]( "lief._lief.PE.Attribute") Interface over the structure described by the OID `1.3.6.1.4.1.311.2.4.1` The internal structure is not documented but we can infer the following structure: ```text MsSpcNestedSignature ::= SET OF SignedData ``` With `SignedData`, the structure described in PKCS #7 RFC (See: [`lief.PE.Signature`]( "lief.PE.Signature")) #### [` signature `]() property signature → [lief.PE.Signature]( "lief.PE.Signature") Underlying [`Signature`]( "lief.PE.Signature") object --- ## [Signature MsSpcStatementType]() ![Inheritance diagram of lief._lief.PE.MsSpcStatementType](https://lief.re/doc/latest/_images/inheritance-a99d0cdd8d0b2066ff4126281fe75e12c38726df.png) ### [` lief.PE.MsSpcStatementType `]() class lief.PE.MsSpcStatementType Bases: [`Attribute`]( "lief._lief.PE.Attribute") Interface over the structure described by the OID `1.3.6.1.4.1.311.2.1.11` The internal structure is described in the official document: [Windows Authenticode Portable Executable Signature Format]() ```text SpcStatementType ::= SEQUENCE of OBJECT IDENTIFIER ``` #### [` oid `]() property oid → str According to the documentation: ```default The SpcStatementType MUST contain one Object Identifier with either the value ``1.3.6.1.4.1.311.2.1.21 (SPC_INDIVIDUAL_SP_KEY_PURPOSE_OBJID)`` or ``1.3.6.1.4.1.311.2.1.22 (SPC_COMMERCIAL_SP_KEY_PURPOSE_OBJID)``. ``` --- ## [Signature PKCS9AtSequenceNumber]() ![Inheritance diagram of lief._lief.PE.PKCS9AtSequenceNumber](https://lief.re/doc/latest/_images/inheritance-c566c72b742bfc686faeba12a40fd9de7ebb3eee.png) ### [` lief.PE.PKCS9AtSequenceNumber `]() class lief.PE.PKCS9AtSequenceNumber Bases: [`Attribute`]( "lief._lief.PE.Attribute") Interface over the structure described by the OID `1.2.840.113549.1.9.25.4` (PKCS #9) The internal structure is described in the [RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0]() ```text sequenceNumber ATTRIBUTE ::= { WITH SYNTAX SequenceNumber EQUALITY MATCHING RULE integerMat SINGLE VALUE TRUE ID pkcs-9-at-sequenceNumber } SequenceNumber ::= INTEGER (1..MAX) ``` #### [` number `]() property number → int Number as described in the RFC --- ## [Signature PKCS9CounterSignature]() ![Inheritance diagram of lief._lief.PE.PKCS9CounterSignature](https://lief.re/doc/latest/_images/inheritance-aec95366d78a3cd0fe415bb41938bde6d7ee3ae9.png) ### [` lief.PE.PKCS9CounterSignature `]() class lief.PE.PKCS9CounterSignature Bases: [`Attribute`]( "lief._lief.PE.Attribute") Interface over the structure described by the OID `1.2.840.113549.1.9.6` (PKCS #9) The internal structure is described in the [RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0]() ```text counterSignature ATTRIBUTE ::= { WITH SYNTAX SignerInfo ID pkcs-9-at-counterSignature } ``` #### [` signer `]() property signer → [lief.PE.SignerInfo]( "lief.PE.SignerInfo") Return the [`SignerInfo`]( "lief.PE.SignerInfo") as described in the RFC #2985 --- ## [Signature PKCS9MessageDigest]() ![Inheritance diagram of lief._lief.PE.PKCS9MessageDigest](https://lief.re/doc/latest/_images/inheritance-44cb689b680e830bcf5ed055db8aba6bfbec9ff8.png) ### [` lief.PE.PKCS9MessageDigest `]() class lief.PE.PKCS9MessageDigest Bases: [`Attribute`]( "lief._lief.PE.Attribute") Interface over the structure described by the OID `1.2.840.113549.1.9.4` (PKCS #9) The internal structure is described in the [RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0]() ```text messageDigest ATTRIBUTE ::= { WITH SYNTAX MessageDigest EQUALITY MATCHING RULE octet SINGLE VALUE TRUE ID pkcs-9-at-messageDigest } MessageDigest ::= OCTET STRING ``` #### [` digest `]() property digest → bytes Message digest as a blob of bytes as described in the RFC --- ## [Signature PKCS9SigningTime]() ![Inheritance diagram of lief._lief.PE.PKCS9SigningTime](https://lief.re/doc/latest/_images/inheritance-63d71d38b0452b44085c9b0424f9908b81750f2a.png) ### [` lief.PE.PKCS9SigningTime `]() class lief.PE.PKCS9SigningTime Bases: [`Attribute`]( "lief._lief.PE.Attribute") Interface over the structure described by the OID `1.2.840.113549.1.9.5` (PKCS #9) The internal structure is described in the [RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0]() ```text signingTime ATTRIBUTE ::= { WITH SYNTAX SigningTime EQUALITY MATCHING RULE signingTimeMatch SINGLE VALUE TRUE ID pkcs-9-at-signingTime } SigningTime ::= Time -- imported from ISO/IEC 9594-8 ``` #### [` time `]() property time → list[int] Time as a list [year, month, day, hour, min, sec] --- ## [Signature SpcSpOpusInfo]() ![Inheritance diagram of lief._lief.PE.SpcSpOpusInfo](https://lief.re/doc/latest/_images/inheritance-93dd785fdff90ccf7d2b3c2c253963b4ea15d799.png) ### [` lief.PE.SpcSpOpusInfo `]() class lief.PE.SpcSpOpusInfo Bases: [`Attribute`]( "lief._lief.PE.Attribute") Interface over the structure described by the OID `1.3.6.1.4.1.311.2.1.12` The internal structure is described in the official document: [Windows Authenticode Portable Executable Signature Format]() ```text SpcSpOpusInfo ::= SEQUENCE { programName [0] EXPLICIT SpcString OPTIONAL, moreInfo [1] EXPLICIT SpcLink OPTIONAL } ``` #### [` more_info `]() property more\_info → str | bytes Other information such as an URL #### [` program_name `]() property program\_name → str | bytes Program description provided by the publisher --- ## [Signature SpcIndirectData]() ![Inheritance diagram of lief._lief.PE.SpcIndirectData](https://lief.re/doc/latest/_images/inheritance-74d8c1344ad990b674d2729a43782875d2d3b408.png) ### [` lief.PE.SpcIndirectData `]() class lief.PE.SpcIndirectData Bases: [`Content`]( "lief._lief.PE.ContentInfo.Content") #### [` digest `]() property digest → memoryview #### [` digest_algorithm `]() property digest\_algorithm → [lief.PE.ALGORITHMS]( "lief.PE.ALGORITHMS") Digest used to hash the file. This should match [`digest_algorithm`]( "lief.PE.SignerInfo.digest_algorithm") #### [` file `]() property file → str #### [` url `]() property url → str --- ## [GenericContent]() ![Inheritance diagram of lief._lief.PE.GenericContent](https://lief.re/doc/latest/_images/inheritance-ac9d59568814b05fc4fcd19223b35675ee727938.png) ### [` lief.PE.GenericContent `]() class lief.PE.GenericContent Bases: [`Content`]( "lief._lief.PE.ContentInfo.Content") --- ## [RsaInfo]() ### [` lief.PE.RsaInfo `]() class lief.PE.RsaInfo Bases: `object` Object representing a RSA key #### [` D `]() property D → bytes RSA private exponent (in bytes) #### [` E `]() property E → bytes RSA public exponent (in bytes) #### [` N `]() property N → bytes RSA public modulus (in bytes) #### [` P `]() property P → bytes First prime factor (in bytes) #### [` Q `]() property Q → bytes Second prime factor (in bytes) #### [` has_private_key `]() property has\_private\_key → bool True if it embeds a private key #### [` has_public_key `]() property has\_public\_key → bool True if it embeds a public key #### [` key_size `]() property key\_size → int Size of the public modulus in bits --- ## [x509]() ### [` lief.PE.x509 `]() class lief.PE.x509 Bases: `Object` Interface over a x509 certificate #### [` KEY_TYPES `]() class KEY\_TYPES(*\*values*) Bases: `Enum` Public key scheme used by the x509 certificate ##### [` ECDSA `]() ECDSA = 4 ##### [` ECKEY `]() ECKEY = 2 ##### [` ECKEY_DH `]() ECKEY\_DH = 3 ##### [` NONE `]() NONE = 0 ##### [` RSA `]() RSA = 1 ##### [` RSASSA_PSS `]() RSASSA\_PSS = 6 ##### [` RSA_ALT `]() RSA\_ALT = 5 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.x509.KEY\_TYPES]( "lief.PE.x509.KEY_TYPES") = <nanobind.nb\_func object> #### [` KEY_USAGE `]() class KEY\_USAGE(*\*values*) Bases: `Enum` Key usage as defined in [RFC #5280 - section-4.2.1.3]() ##### [` CRL_SIGN `]() CRL\_SIGN = 6 ##### [` DATA_ENCIPHERMENT `]() DATA\_ENCIPHERMENT = 3 ##### [` DECIPHER_ONLY `]() DECIPHER\_ONLY = 8 ##### [` DIGITAL_SIGNATURE `]() DIGITAL\_SIGNATURE = 0 ##### [` ENCIPHER_ONLY `]() ENCIPHER\_ONLY = 7 ##### [` KEY_AGREEMENT `]() KEY\_AGREEMENT = 4 ##### [` KEY_CERT_SIGN `]() KEY\_CERT\_SIGN = 5 ##### [` KEY_ENCIPHERMENT `]() KEY\_ENCIPHERMENT = 2 ##### [` NON_REPUDIATION `]() NON\_REPUDIATION = 1 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.x509.KEY\_USAGE]( "lief.PE.x509.KEY_USAGE") = <nanobind.nb\_func object> #### [` VERIFICATION_FLAGS `]() class VERIFICATION\_FLAGS(*\*values*) Bases: `Flag` Verification flags associated with [`verify`]( "lief.PE.x509.verify") ##### [` BADCERT_BAD_KEY `]() BADCERT\_BAD\_KEY = 65536 ##### [` BADCERT_BAD_MD `]() BADCERT\_BAD\_MD = 16384 ##### [` BADCERT_BAD_PK `]() BADCERT\_BAD\_PK = 32768 ##### [` BADCERT_CN_MISMATCH `]() BADCERT\_CN\_MISMATCH = 4 ##### [` BADCERT_EXPIRED `]() BADCERT\_EXPIRED = 1 ##### [` BADCERT_EXT_KEY_USAGE `]() BADCERT\_EXT\_KEY\_USAGE = 4096 ##### [` BADCERT_FUTURE `]() BADCERT\_FUTURE = 512 ##### [` BADCERT_KEY_USAGE `]() BADCERT\_KEY\_USAGE = 2048 ##### [` BADCERT_MISSING `]() BADCERT\_MISSING = 64 ##### [` BADCERT_NOT_TRUSTED `]() BADCERT\_NOT\_TRUSTED = 8 ##### [` BADCERT_NS_CERT_TYPE `]() BADCERT\_NS\_CERT\_TYPE = 8192 ##### [` BADCERT_OTHERNATURE `]() BADCERT\_OTHERNATURE = 256 ##### [` BADCERT_REVOKED `]() BADCERT\_REVOKED = 2 ##### [` BADCERT_SKIP_VERIFY `]() BADCERT\_SKIP\_VERIFY = 128 ##### [` BADCRL_BAD_KEY `]() BADCRL\_BAD\_KEY = 524288 ##### [` BADCRL_BAD_MD `]() BADCRL\_BAD\_MD = 131072 ##### [` BADCRL_BAD_PK `]() BADCRL\_BAD\_PK = 262144 ##### [` BADCRL_EXPIRED `]() BADCRL\_EXPIRED = 32 ##### [` BADCRL_FUTURE `]() BADCRL\_FUTURE = 1024 ##### [` BADCRL_NOT_TRUSTED `]() BADCRL\_NOT\_TRUSTED = 16 ##### [` OK `]() OK = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.x509.VERIFICATION\_FLAGS]( "lief.PE.x509.VERIFICATION_FLAGS") = <nanobind.nb\_func object> #### [` certificate_policies `]() property certificate\_policies → list[str] Policy information terms as list of OID (see RFC #5280) #### [` ext_key_usage `]() property ext\_key\_usage → list[str] Indicates one or more purposes for which the certified public key may be used (list of OID) #### [` is_ca `]() property is\_ca → bool #### [` is_trusted_by `]() is\_trusted\_by(*self*, *ca\_list: collections.abc.Sequence[[lief.\_lief.PE.x509]( "lief._lief.PE.x509")]*) → [lief.\_lief.PE.x509.VERIFICATION\_FLAGS]( "lief._lief.PE.x509.VERIFICATION_FLAGS") Verify this certificate against a list of root CA (list of [`x509`]( "lief.PE.x509") objects) It returns a set of flags defined by [`VERIFICATION_FLAGS`]( "lief.PE.x509.VERIFICATION_FLAGS") **Example:** ```python signer = binary.signatures[0].signers[0] microsoft_ca_bundle = lief.PE.x509.parse("bundle.pem") print(signer.cert.is_trusted_by(microsoft_ca_bundle)) ``` #### [` issuer `]() property issuer → str | bytes Issuer of the certificate #### [` key_type `]() property key\_type → [lief.PE.x509.KEY\_TYPES]( "lief.PE.x509.KEY_TYPES") Return the underlying public-key scheme ([`KEY_TYPES`]( "lief.PE.x509.KEY_TYPES")) #### [` key_usage `]() property key\_usage → list[[lief.PE.x509.KEY\_USAGE]( "lief.PE.x509.KEY_USAGE")] Purpose of the key contained in the certificate (see [`KEY_USAGE`]( "lief.PE.x509.KEY_USAGE")) #### [` parse `]() parse(*\*args*) → list[[lief.PE.x509]( "lief.PE.x509")] = <nanobind.nb\_func object> #### [` raw `]() property raw → bytes The raw bytes associated with this x509 cert (DER encoded) #### [` rsa_info `]() property rsa\_info → [lief.PE.RsaInfo]( "lief.PE.RsaInfo") | None If the underlying public-key scheme is RSA, return the [`RsaInfo`]( "lief.PE.RsaInfo") associated with this certificate. Otherwise, return None #### [` serial_number `]() property serial\_number → bytes Unique id for certificate issued by a specific CA. #### [` signature `]() property signature → bytes The signature of the certificate #### [` signature_algorithm `]() property signature\_algorithm → str Signature algorithm (OID) #### [` subject `]() property subject → str | bytes Subject of the certificate #### [` valid_from `]() property valid\_from → list[int] Start time of certificate validity #### [` valid_to `]() property valid\_to → list[int] End time of certificate validity #### [` verify `]() verify(*self*, *ca: [lief.\_lief.PE.x509]( "lief._lief.PE.x509")*) → [lief.\_lief.PE.x509.VERIFICATION\_FLAGS]( "lief._lief.PE.x509.VERIFICATION_FLAGS") Verify that this certificate has been used **to trust** the given [`x509`]( "lief.PE.x509") certificate It returns a set of flags defined by [`VERIFICATION_FLAGS`]( "lief.PE.x509.VERIFICATION_FLAGS") **Example:** ```python ca = lief.PE.x509.parse("ca.crt")[0] signer = lief.PE.x509.parse("signer.crt")[0] print(ca.verify(signer)) # lief.PE.x509.VERIFICATION_FLAGS.OK ``` #### [` version `]() property version → int X.509 version. (1=v1, 2=v2, 3=v3) --- ## [ContentInfo]() ![Inheritance diagram of lief._lief.PE.PKCS9TSTInfo, lief._lief.PE.GenericContent, lief._lief.PE.SpcIndirectData](https://lief.re/doc/latest/_images/inheritance-e740c3930d239e3b56437a7ebd01caecb679c0b3.png) ### [` lief.PE.ContentInfo `]() class lief.PE.ContentInfo Bases: `Object` ContentInfo as described in the [RFC 2315]() ```text ContentInfo ::= SEQUENCE { contentType ContentType, content [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL } ContentType ::= OBJECT IDENTIFIER ``` In the case of PE signature, ContentType **must** be set to SPC\_INDIRECT\_DATA\_OBJID OID: `1.3.6.1.4.1.311.2.1.4` and content is defined by the structure: `SpcIndirectDataContent` ```text SpcIndirectDataContent ::= SEQUENCE { data SpcAttributeTypeAndOptionalValue, messageDigest DigestInfo } SpcAttributeTypeAndOptionalValue ::= SEQUENCE { type ObjectID, value [0] EXPLICIT ANY OPTIONAL } ``` For PE signature, `SpcAttributeTypeAndOptionalValue.type` is set to `SPC_PE_IMAGE_DATAOBJ` (OID: `1.3.6.1.4.1.311.2.1.15`) and the value is defined by `SpcPeImageData` ```text DigestInfo ::= SEQUENCE { digestAlgorithm AlgorithmIdentifier, digest OCTETSTRING } AlgorithmIdentifier ::= SEQUENCE { algorithm ObjectID, parameters [0] EXPLICIT ANY OPTIONAL } ``` #### [` Content `]() class Content Bases: `Object` ##### [` content_type `]() property content\_type → str OID of the content type. This value should match `SPC_INDIRECT_DATA_OBJID` ##### [` copy `]() copy(*self*) → [lief.\_lief.PE.ContentInfo.Content]( "lief._lief.PE.ContentInfo.Content") | None Duplicate the current instance of this object #### [` content_type `]() property content\_type → str An alias for [`content_type`]( "lief.PE.ContentInfo.content_type") #### [` copy `]() copy(*self*) → [lief.\_lief.PE.ContentInfo]( "lief._lief.PE.ContentInfo") Duplicate the current instance of this object #### [` digest `]() property digest → bytes Return the digest (authentihash) if the underlying content type is `SPC_INDIRECT_DATA_OBJID`. Return empty bytes otherwise. #### [` digest_algorithm `]() property digest\_algorithm → [lief.PE.ALGORITHMS]( "lief.PE.ALGORITHMS") Return the hash algorithm used to generate the [`digest`]( "lief.PE.ContentInfo.digest") #### [` value `]() property value → [lief.PE.ContentInfo.Content]( "lief.PE.ContentInfo.Content") --- ## [SignerInfo]() ### [` lief.PE.SignerInfo `]() class lief.PE.SignerInfo Bases: `Object` SignerInfo as described in the [RFC 2315 #Section 9.2]() ```text SignerInfo ::= SEQUENCE { version Version, issuerAndSerialNumber IssuerAndSerialNumber, digestAlgorithm DigestAlgorithmIdentifier, authenticatedAttributes [0] IMPLICIT Attributes OPTIONAL, digestEncryptionAlgorithm DigestEncryptionAlgorithmIdentifier, encryptedDigest EncryptedDigest, unauthenticatedAttributes [1] IMPLICIT Attributes OPTIONAL } EncryptedDigest ::= OCTET STRING ``` #### [` authenticated_attributes `]() property authenticated\_attributes → lief.PE.SignerInfo.it\_const\_attributes\_t Return an iterator over the authenticated attributes ([`Attribute`]( "lief.PE.Attribute")) #### [` cert `]() property cert → [lief.PE.x509]( "lief.PE.x509") | None [`x509`]( "lief.PE.x509") certificate used by this signer. If it can’t be found, it returns None #### [` digest_algorithm `]() property digest\_algorithm → [lief.PE.ALGORITHMS]( "lief.PE.ALGORITHMS") Algorithm ([`ALGORITHMS`]( "lief.PE.ALGORITHMS")) used to hash the file. This value should match [`ContentInfo.digest_algorithm`]( "lief.PE.ContentInfo.digest_algorithm") and [`Signature.digest_algorithm`]( "lief.PE.Signature.digest_algorithm") #### [` encrypted_digest `]() property encrypted\_digest → bytes Return the signature created by the signing certificate’s private key #### [` encryption_algorithm `]() property encryption\_algorithm → [lief.PE.ALGORITHMS]( "lief.PE.ALGORITHMS") Return algorithm ([`ALGORITHMS`]( "lief.PE.ALGORITHMS")) used to encrypt the digest #### [` get_attribute `]() get\_attribute(*self*, *type: [lief.\_lief.PE.Attribute.TYPE]( "lief._lief.PE.Attribute.TYPE")*) → [lief.\_lief.PE.Attribute]( "lief._lief.PE.Attribute") | None Return the authenticated or un-authenticated attribute matching the given `lief.PE.SIG_ATTRIBUTE_TYPES` It returns **the first** entry that matches the given type. If it can’t be found, it returns None #### [` get_auth_attribute `]() get\_auth\_attribute(*self*, *type: [lief.\_lief.PE.Attribute.TYPE]( "lief._lief.PE.Attribute.TYPE")*) → [lief.\_lief.PE.Attribute]( "lief._lief.PE.Attribute") | None Return the authenticated attribute matching the given `lief.PE.SIG_ATTRIBUTE_TYPES` It returns **the first** entry that matches the given type. If it can’t be found, it returns None #### [` get_unauth_attribute `]() get\_unauth\_attribute(*self*, *type: [lief.\_lief.PE.Attribute.TYPE]( "lief._lief.PE.Attribute.TYPE")*) → [lief.\_lief.PE.Attribute]( "lief._lief.PE.Attribute") | None Return the un-authenticated attribute matching the given `lief.PE.SIG_ATTRIBUTE_TYPES` It returns **the first** entry that matches the given type. If it can’t be found, it returns None #### [` issuer `]() property issuer → str | bytes The X509 issuer used to sign the signed-data (see: [`lief.PE.x509.issuer`]( "lief.PE.x509.issuer")) #### [` serial_number `]() property serial\_number → bytes The X509 serial number used to sign the signed-data (see: [`lief.PE.x509.serial_number`]( "lief.PE.x509.serial_number")) #### [` unauthenticated_attributes `]() property unauthenticated\_attributes → lief.PE.SignerInfo.it\_const\_attributes\_t Return an iterator over the unauthenticated attributes ([`Attribute`]( "lief.PE.Attribute")) #### [` version `]() property version → int Should be 1 --- ## [MsCounterSign]() ### [` lief.PE.MsCounterSign `]() class lief.PE.MsCounterSign Bases: [`Attribute`]( "lief._lief.PE.Attribute") This class exposes the ms-counter-signature. #### [` certificates `]() property certificates → lief.PE.MsCounterSign.it\_const\_crt Return an iterator over [`x509`]( "lief.PE.x509") certificates #### [` content_info `]() property content\_info → [lief.PE.ContentInfo]( "lief.PE.ContentInfo") #### [` digest_algorithm `]() property digest\_algorithm → [lief.PE.ALGORITHMS]( "lief.PE.ALGORITHMS") #### [` signers `]() property signers → lief.PE.MsCounterSign.it\_const\_signers\_t Return an iterator over the signers ([`SignerInfo`]( "lief.PE.SignerInfo")) #### [` version `]() property version → int --- ## [PKCS9TSTInfo]() ### [` lief.PE.PKCS9TSTInfo `]() class lief.PE.PKCS9TSTInfo Bases: [`Content`]( "lief._lief.PE.ContentInfo.Content") Interface over the structure described by the OID `1.2.840.113549.1.9.16.1.4` (PKCS #9) The internal structure is described in the [RFC #3161]() ```text TSTInfo ::= SEQUENCE { version INTEGER { v1(1) }, policy TSAPolicyId, messageImprint MessageImprint, serialNumber INTEGER, genTime GeneralizedTime, accuracy Accuracy OPTIONAL, ordering BOOLEAN DEFAULT FALSE, nonce INTEGER OPTIONAL, tsa [0] GeneralName OPTIONAL, extensions [1] IMPLICIT Extensions OPTIONAL } TSAPolicyId ::= OBJECT IDENTIFIER MessageImprint ::= SEQUENCE { hashAlgorithm AlgorithmIdentifier, hashedMessage OCTET STRING } Accuracy ::= SEQUENCE { seconds INTEGER OPTIONAL, millis [0] INTEGER (1..999) OPTIONAL, micros [1] INTEGER (1..999) OPTIONAL } ``` --- ## [MsManifestBinaryID]() ### [` lief.PE.MsManifestBinaryID `]() class lief.PE.MsManifestBinaryID Bases: [`Attribute`]( "lief._lief.PE.Attribute") Interface over the structure described by the OID `1.3.6.1.4.1.311.10.3.28` (`szOID_PLATFORM_MANIFEST_BINARY_ID`) The internal structure is not documented but we can infer the following structure: ```text szOID_PLATFORM_MANIFEST_BINARY_ID ::= SET OF BinaryID BinaryID ::= UTF8STRING ``` #### [` manifest_id `]() property manifest\_id → str The manifest id --- ## [SpcRelaxedPeMarkerCheck]() ### [` lief.PE.SpcRelaxedPeMarkerCheck `]() class lief.PE.SpcRelaxedPeMarkerCheck Bases: [`Attribute`]( "lief._lief.PE.Attribute") #### [` value `]() property value → int --- ## [SigningCertificateV2]() ### [` lief.PE.SigningCertificateV2 `]() class lief.PE.SigningCertificateV2 Bases: [`Attribute`]( "lief._lief.PE.Attribute") ```text SigningCertificateV2 ::= SEQUENCE { certs SEQUENCE OF ESSCertIDv2, policies SEQUENCE OF PolicyInformation OPTIONAL } ESSCertIDv2 ::= SEQUENCE { hashAlgorithm AlgorithmIdentifier DEFAULT {algorithm id-sha256}, certHash OCTET STRING, issuerSerial IssuerSerial OPTIONAL } IssuerSerial ::= SEQUENCE { issuer GeneralNames, serialNumber CertificateSerialNumber } PolicyInformation ::= SEQUENCE { policyIdentifier OBJECT IDENTIFIER, policyQualifiers SEQUENCE SIZE (1..MAX) OF PolicyQualifierInfo OPTIONAL } ``` --- ## [Builder]() ### [` lief.PE.Builder `]() class lief.PE.Builder(*self*, *binary: [lief.\_lief.PE.Binary]( "lief._lief.PE.Binary")*, *config: [lief.\_lief.PE.Builder.config\_t]( "lief._lief.PE.Builder.config_t")*) Bases: `object` #### [` build `]() build(*self*) → [lief.\_lief.ok\_t]( "lief._lief.ok_t") | [lief.\_lief.lief\_errors]( "lief._lief.lief_errors") Perform the build process #### [` config_t `]() class config\_t(*self*) Bases: `object` This structure is used to configure the build operation. The default value of these attributes is set to `False` if the operation modifies the binary layout even though nothing changed. For instance, building the import table **always** requires relocating the table to another place. Thus, the default value is false and must be explicitly set to true. ##### [` debug `]() property debug → bool Whether the builder should regenerate debug entries ##### [` debug_section `]() property debug\_section → str Section that holds the debug entries ##### [` dos_stub `]() property dos\_stub → bool Whether the builder should write back dos stub (including the rich header) ##### [` export_section `]() property export\_section → str Section that holds the export table ##### [` exports `]() property exports → bool Whether the builder should reconstruct the export table This option should be turned on if you modify exports. Please check LIEF website for more details ##### [` force_relocating `]() property force\_relocating → bool ##### [` idata_section `]() property idata\_section → str Section that holds the relocated import table (IAT/ILT) ##### [` imports `]() property imports → bool Whether the builder should reconstruct the imports table. This option should be turned on if you modify imports. Please check LIEF website for more details ##### [` load_configuration `]() property load\_configuration → bool Whether the builder should regenerate the load configuration ##### [` overlay `]() property overlay → bool Whether the builder should write back any overlay data ##### [` reloc_section `]() property reloc\_section → str Section that holds the relocated relocations ##### [` relocations `]() property relocations → bool Whether the builder should regenerate relocations ##### [` resolved_iat_cbk `]() property resolved\_iat\_cbk → collections.abc.Callable[[[lief.PE.Binary]( "lief.PE.Binary"), [lief.PE.Import]( "lief.PE.Import"), [lief.PE.ImportEntry]( "lief.PE.ImportEntry"), int], None] ##### [` resources `]() property resources → bool Whether the builder should regenerate the resources tree ##### [` rsrc_section `]() property rsrc\_section → str If the resources tree needs to be relocated, this attribute defines the name of the new section that contains the relocated tree. ##### [` tls `]() property tls → bool Whether the builder should regenerate the TLS info ##### [` tls_section `]() property tls\_section → str Section that holds the relocated TLS info #### [` raw_bytes `]() raw\_bytes(*self*) → bytes #### [` rsrc_data `]() property rsrc\_data → memoryview #### [` write `]() write(*self*, *output: str*) → None Write the build result into the `output` file --- ## [Resource Node]() ![Inheritance diagram of lief._lief.PE.ResourceDirectory, lief._lief.PE.ResourceNode, lief._lief.PE.ResourceData](https://lief.re/doc/latest/_images/inheritance-ddb7f6effe66ce89bc2bb80a7d2f5df47a9fe83d.png) ### [` lief.PE.ResourceNode `]() class lief.PE.ResourceNode Bases: `Object` Class which represents a Node in the resource tree. It is extended by [`lief.PE.ResourceData`]( "lief.PE.ResourceData") and [`lief.PE.ResourceDirectory`]( "lief.PE.ResourceDirectory") #### [` add_child `]() add\_child(*self*, *node: [lief.\_lief.PE.ResourceNode]( "lief._lief.PE.ResourceNode")*) → [lief.\_lief.PE.ResourceNode]( "lief._lief.PE.ResourceNode") Add a new child to the current node #### [` childs `]() property childs → lief.PE.ResourceNode.it\_childs Node’s children #### [` copy `]() copy(*self*) → [lief.\_lief.PE.ResourceNode]( "lief._lief.PE.ResourceNode") | None Duplicate the current instance of this object #### [` delete_childdelete_child `]() delete\_child(*self*, *node: [lief.\_lief.PE.ResourceNode]( "lief._lief.PE.ResourceNode")*) → None **delete\_child(*self*, *id: int*) → None** Overloaded function. 1. `delete_child(self, node: lief._lief.PE.ResourceNode) -> None` Delete the given [`ResourceNode`]( "lief.PE.ResourceNode") from the current children 2. `delete_child(self, id: int) -> None` > Delete the [`ResourceNode`]( "lief.PE.ResourceNode") with the given [`id`]( "lief.PE.ResourceNode.id") from the current children #### [` depth `]() property depth → int Current depth of the node in the resource tree #### [` has_name `]() property has\_name → bool `True` if the current node uses a name #### [` id `]() property id → int Integer that identifies the Type, Name, or Language ID entry. #### [` is_data `]() property is\_data → bool `True` if the current node is a [`ResourceData`]( "lief.PE.ResourceData") #### [` is_directory `]() property is\_directory → bool `True` if the current node is a [`ResourceDirectory`]( "lief.PE.ResourceDirectory") #### [` name `]() property name → str Resource’s name #### [` parse `]() parse(*bytes: bytes*, *rva: int*) → [lief.PE.ResourceNode]( "lief.PE.ResourceNode") | None = <nanobind.nb\_func object> --- ## [Resource Directory]() ![Inheritance diagram of lief._lief.PE.ResourceDirectory](https://lief.re/doc/latest/_images/inheritance-8328839eac0f516c1cd5ade72642bc6a04518e81.png) ### [` lief.PE.ResourceDirectorylief.PE.ResourceDirectory `]() class lief.PE.ResourceDirectory(*self*) **class lief.PE.ResourceDirectory(*self*, *arg: int*, */*)** Bases: [`ResourceNode`]( "lief._lief.PE.ResourceNode") Overloaded function. 1. `__init__(self) -> None` Default constructor 2. `__init__(self, arg: int, /) -> None` Constructor from an ID #### [` characteristics `]() property characteristics → int Resource characteristics. This field is reserved for future use. It is currently set to zero. #### [` major_version `]() property major\_version → int The major version number, set by the user. #### [` minor_version `]() property minor\_version → int The minor version number, set by the user. #### [` numberof_id_entries `]() property numberof\_id\_entries → int The number of directory entries immediately following the Name entries that use numeric IDs for Type, Name, or Language entries. #### [` numberof_name_entries `]() property numberof\_name\_entries → int The number of directory entries immediately following the table that use strings to identify Type, Name, or Language entries (depending on the level of the table #### [` time_date_stamp `]() property time\_date\_stamp → int The time that the resource data was created by the resource compiler. --- ## [Resource Data]() ![Inheritance diagram of lief._lief.PE.ResourceData](https://lief.re/doc/latest/_images/inheritance-55e48956f9b2cf7d9c131a300a29764795c01291.png) ### [` lief.PE.ResourceDatalief.PE.ResourceData `]() class lief.PE.ResourceData(*self*) **class lief.PE.ResourceData(*self*, *content: collections.abc.Sequence[int]*, *code\_page: int = 0*)** Bases: [`ResourceNode`]( "lief._lief.PE.ResourceNode") Class which represents a Data Node in the PE resources tree Overloaded function. 1. `__init__(self) -> None` Default constructor 2. `__init__(self, content: collections.abc.Sequence[int], code_page: int = 0) -> None` #### [` code_page `]() property code\_page → int Return the code page that is used to decode code point values within the resource data. Typically, the code page is the Unicode code page. #### [` content `]() property content → memoryview Resource content #### [` offset `]() property offset → int Offset of the content within the resource > **Warning** > > This value can change when re-building the resource table #### [` reserved `]() property reserved → int Reserved value. Should be `0` --- ## [Resources Manager]() ### [` lief.PE.ResourcesManager `]() class lief.PE.ResourcesManager(*self*, *node: [lief.\_lief.PE.ResourceNode]( "lief._lief.PE.ResourceNode")*) Bases: `Object` The Resource Manager provides an enhanced API to manipulate the resource tree #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` ##### [` ACCELERATOR `]() ACCELERATOR = 9 ##### [` ANICURSOR `]() ANICURSOR = 21 ##### [` ANIICON `]() ANIICON = 22 ##### [` BITMAP `]() BITMAP = 2 ##### [` CURSOR `]() CURSOR = 1 ##### [` DIALOG `]() DIALOG = 5 ##### [` DLGINCLUDE `]() DLGINCLUDE = 17 ##### [` FONT `]() FONT = 8 ##### [` FONTDIR `]() FONTDIR = 7 ##### [` GROUP_CURSOR `]() GROUP\_CURSOR = 12 ##### [` GROUP_ICON `]() GROUP\_ICON = 14 ##### [` HTML `]() HTML = 23 ##### [` ICON `]() ICON = 3 ##### [` MANIFEST `]() MANIFEST = 24 ##### [` MENU `]() MENU = 4 ##### [` MESSAGETABLE `]() MESSAGETABLE = 11 ##### [` PLUGPLAY `]() PLUGPLAY = 19 ##### [` RCDATA `]() RCDATA = 10 ##### [` STRING `]() STRING = 6 ##### [` VERSION `]() VERSION = 16 ##### [` VXD `]() VXD = 20 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.ResourcesManager.TYPE]( "lief.PE.ResourcesManager.TYPE") = <nanobind.nb\_func object> #### [` accelerator `]() property accelerator → lief.PE.ResourcesManager.it\_const\_accelerators Return list of [`ResourceAccelerator`]( "lief.PE.ResourceAccelerator") present in the resource #### [` add_icon `]() add\_icon(*self*, *icon: [lief.\_lief.PE.ResourceIcon]( "lief._lief.PE.ResourceIcon")*) → None Add an icon to the resources #### [` change_icon `]() change\_icon(*self*, *old\_one: [lief.\_lief.PE.ResourceIcon]( "lief._lief.PE.ResourceIcon")*, *new\_one: [lief.\_lief.PE.ResourceIcon]( "lief._lief.PE.ResourceIcon")*) → None Switch the given icons #### [` dialogs `]() property dialogs → lief.PE.ResourcesManager.it\_const\_dialogs Return the list of the [`ResourceDialog`]( "lief.PE.ResourceDialog") present in the resource #### [` get_node_type `]() get\_node\_type(*self*, *type: [lief.\_lief.PE.ResourcesManager.TYPE]( "lief._lief.PE.ResourcesManager.TYPE")*) → [lief.\_lief.PE.ResourceNode]( "lief._lief.PE.ResourceNode") | None Return [`ResourceNode`]( "lief.PE.ResourceNode") with the given [`TYPE`]( "lief.PE.ResourcesManager.TYPE") or None if not found. #### [` has_accelerator `]() property has\_accelerator → bool `True` if resources contain [`ResourceAccelerator`]( "lief.PE.ResourceAccelerator") #### [` has_dialogs `]() property has\_dialogs → bool `True` if the resources contain [`ResourceDialog`]( "lief.PE.ResourceDialog") #### [` has_html `]() property has\_html → bool `True` if resources contain HTML resource #### [` has_icons `]() property has\_icons → bool `True` if the resources contain [`ResourceIcon`]( "lief.PE.ResourceIcon") #### [` has_manifest `]() property has\_manifest → bool `True` if the resources contain a Manifest element #### [` has_string_table `]() property has\_string\_table → bool `True` if resources contain [`ResourceStringTable`]( "lief.PE.ResourceStringTable") #### [` has_type `]() has\_type(*self*, *type: [lief.\_lief.PE.ResourcesManager.TYPE]( "lief._lief.PE.ResourcesManager.TYPE")*) → bool `True` if the resource has the given [`TYPE`]( "lief.PE.ResourcesManager.TYPE") #### [` has_version `]() property has\_version → bool `True` if the resources contain a [`ResourceVersion`]( "lief.PE.ResourceVersion") #### [` html `]() property html → list[str] HTML resource as the list of `string` #### [` icons `]() property icons → lief.PE.ResourcesManager.it\_const\_icons Return the list of the [`ResourceIcon`]( "lief.PE.ResourceIcon") present in the resource #### [` manifest `]() property manifest → str | bytes Manifest as a `string` #### [` print `]() print(*self*, *max\_depth: int = 0*) → str Print the current resource tree #### [` string_entry_t `]() class string\_entry\_t Bases: `object` ##### [` id `]() property id → int ##### [` string `]() property string → str #### [` string_table `]() property string\_table → list[[lief.PE.ResourcesManager.string\_entry\_t]( "lief.PE.ResourcesManager.string_entry_t")] Return the list of the strings embedded in the string table (`RT_STRING`) #### [` types `]() property types → list[[lief.PE.ResourcesManager.TYPE]( "lief.PE.ResourcesManager.TYPE")] Return list of [`TYPE`]( "lief.PE.ResourcesManager.TYPE") present in the resources #### [` version `]() property version → list[[lief.PE.ResourceVersion]( "lief.PE.ResourceVersion")] Return a list of version info (`VS_VERSIONINFO`). --- ## [Resource Icon]() ### [` lief.PE.ResourceIcon `]() class lief.PE.ResourceIcon Bases: `Object` #### [` bit_count `]() property bit\_count → int Bits per pixel #### [` color_count `]() property color\_count → int Number of colors in image (0 if >=8bpp) #### [` from_serialization `]() from\_serialization(*arg: bytes*) → [lief.PE.ResourceIcon]( "lief.PE.ResourceIcon") | [lief.lief\_errors]( "lief.lief_errors") = <nanobind.nb\_func object> #### [` height `]() property height → int Height in pixels of the image #### [` id `]() property id → int Id associated with the icon #### [` lang `]() property lang → int Language associated with the icon #### [` pixels `]() property pixels → memoryview #### [` planes `]() property planes → int Color Planes #### [` reserved `]() property reserved → int Reserved (must be 0) #### [` save `]() save(*self*, *filepath: str*) → None Save the icon to the given filepath #### [` serialize `]() serialize(*self*) → bytes Serialize the current icon into bytes #### [` sublang `]() property sublang → int Sublanguage associated with the icon #### [` width `]() property width → int Width in pixels of the image --- ## [Resource Dialog]() ![Inheritance diagram of lief._lief.PE.ResourceDialogRegular, lief._lief.PE.ResourceDialog, lief._lief.PE.ResourceDialogExtended](https://lief.re/doc/latest/_images/inheritance-2421608f967145b603913d08c1aaab97863bc4ba.png) ### [` lief.PE.ResourceDialog `]() class lief.PE.ResourceDialog Bases: `Object` This class is the base class for either a regular (legacy) Dialog or an extended Dialog. These different kinds of Dialogs are documented by MS at the following addresses: - [https://learn.microsoft.com/en-us/windows/win32/api/winuser/ns-winuser-dlgtemplate]() - [https://learn.microsoft.com/fr-fr/windows/win32/dlgbox/dlgitemtemplateex]() #### [` CONTROL_STYLES `]() class CONTROL\_STYLES(*\*values*) Bases: `Flag` From: [https://learn.microsoft.com/en-us/windows/win32/controls/common-control-styles]() ##### [` ADJUSTABLE `]() ADJUSTABLE = 32 ##### [` BOTTOM `]() BOTTOM = 3 ##### [` LEFT `]() LEFT = 129 ##### [` NODIVIDER `]() NODIVIDER = 64 ##### [` NOMOVEX `]() NOMOVEX = 130 ##### [` NOMOVEY `]() NOMOVEY = 2 ##### [` NOPARENTALIGN `]() NOPARENTALIGN = 8 ##### [` NORESIZE `]() NORESIZE = 4 ##### [` RIGHT `]() RIGHT = 131 ##### [` TOP `]() TOP = 1 ##### [` VERT `]() VERT = 128 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.ResourceDialog.CONTROL\_STYLES]( "lief.PE.ResourceDialog.CONTROL_STYLES") = <nanobind.nb\_func object> #### [` DIALOG_STYLES `]() class DIALOG\_STYLES(*\*values*) Bases: `Flag` From: [https://learn.microsoft.com/en-us/windows/win32/dlgbox/dialog-box-styles]() ##### [` ABSALIGN `]() ABSALIGN = 1 ##### [` CENTER `]() CENTER = 2048 ##### [` CENTERMOUSE `]() CENTERMOUSE = 4096 ##### [` CONTEXTHELP `]() CONTEXTHELP = 8192 ##### [` CONTROL `]() CONTROL = 1024 ##### [` FIXEDSYS `]() FIXEDSYS = 8 ##### [` LOCALEDIT `]() LOCALEDIT = 32 ##### [` MODALFRAME `]() MODALFRAME = 128 ##### [` NOFAILCREATE `]() NOFAILCREATE = 16 ##### [` NOIDLEMSG `]() NOIDLEMSG = 256 ##### [` S3DLOOK `]() S3DLOOK = 4 ##### [` SETFONT `]() SETFONT = 64 ##### [` SETFOREGROUND `]() SETFOREGROUND = 512 ##### [` SHELLFONT `]() SHELLFONT = 72 ##### [` SYSMODAL `]() SYSMODAL = 2 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.ResourceDialog.DIALOG\_STYLES]( "lief.PE.ResourceDialog.DIALOG_STYLES") = <nanobind.nb\_func object> #### [` Item `]() class Item Bases: `object` ##### [` clazz `]() property clazz → int | str | None Window class of the control. This can be either: a string that specifies the name of a registered window class or an ordinal value of a predefined system class. ##### [` control_styles `]() property control\_styles → list[[lief.PE.ResourceDialog.CONTROL\_STYLES]( "lief.PE.ResourceDialog.CONTROL_STYLES")] List of [`CONTROL_STYLES`]( "lief.PE.ResourceDialog.CONTROL_STYLES") used by this item ##### [` creation_data `]() property creation\_data → memoryview Creation data that is passed to the control’s window procedure ##### [` cx `]() property cx → int The width, in dialog box units, of the control. ##### [` cy `]() property cy → int The height, in dialog box units, of the control. ##### [` extended_style `]() property extended\_style → int The extended styles for a window. This member is not used to create controls in dialog boxes, but applications that use dialog box templates can use it to create other types of windows. It can take a combination of [`WINDOW_EXTENDED_STYLES`]( "lief.PE.ResourceDialog.WINDOW_EXTENDED_STYLES") ##### [` hashas `]() has(*self*, *style: [lief.\_lief.PE.ResourceDialog.WINDOW\_STYLES]( "lief._lief.PE.ResourceDialog.WINDOW_STYLES")*) → bool **has(*self*, *style: [lief.\_lief.PE.ResourceDialog.CONTROL\_STYLES]( "lief._lief.PE.ResourceDialog.CONTROL_STYLES")*) → bool** Overloaded function. 1. `has(self, style: lief._lief.PE.ResourceDialog.WINDOW_STYLES) -> bool` Check if this item has the given [`WINDOW_STYLES`]( "lief.PE.ResourceDialog.WINDOW_STYLES") 2. `has(self, style: lief._lief.PE.ResourceDialog.CONTROL_STYLES) -> bool` Check if this item has the given [`CONTROL_STYLES`]( "lief.PE.ResourceDialog.CONTROL_STYLES") ##### [` id `]() property id → int The control identifier. ##### [` style `]() property style → int The style of the control. This can be a combination of [`WINDOW_STYLES`]( "lief.PE.ResourceDialog.WINDOW_STYLES") or [`CONTROL_STYLES`]( "lief.PE.ResourceDialog.CONTROL_STYLES"). ##### [` title `]() property title → int | str | None Title of the item which can be either: a string that specifies the initial text or an ordinal value of a resource, such as an icon, in an executable file ##### [` window_styles `]() property window\_styles → list[[lief.PE.ResourceDialog.WINDOW\_STYLES]( "lief.PE.ResourceDialog.WINDOW_STYLES")] List of [`WINDOW_STYLES`]( "lief.PE.ResourceDialog.WINDOW_STYLES") used by this item ##### [` x `]() property x → int The x-coordinate, in dialog box units, of the upper-left corner of the control. This coordinate is always relative to the upper-left corner of the dialog box’s client area. ##### [` y `]() property y → int The y-coordinate, in dialog box units, of the upper-left corner of the control. This coordinate is always relative to the upper-left corner of the dialog box’s client area. #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` Enum for discriminating the kind of the Dialog (regular vs extended) ##### [` EXTENDED `]() EXTENDED = 2 ##### [` REGULAR `]() REGULAR = 1 ##### [` UNKNOWN `]() UNKNOWN = 0 #### [` WINDOW_EXTENDED_STYLES `]() class WINDOW\_EXTENDED\_STYLES(*\*values*) Bases: `Flag` From: [https://docs.microsoft.com/en-us/windows/win32/winmsg/extended-window-styles]() ##### [` ACCEPTFILES `]() ACCEPTFILES = 16 ##### [` APPWINDOW `]() APPWINDOW = 262144 ##### [` CLIENTEDGE `]() CLIENTEDGE = 512 ##### [` CONTEXTHELP `]() CONTEXTHELP = 1024 ##### [` CONTROLPARENT `]() CONTROLPARENT = 65536 ##### [` DLGMODALFRAME `]() DLGMODALFRAME = 1 ##### [` LEFT `]() LEFT = 0 ##### [` LEFTSCROLLBAR `]() LEFTSCROLLBAR = 16384 ##### [` MDICHILD `]() MDICHILD = 64 ##### [` NOPARENTNOTIFY `]() NOPARENTNOTIFY = 4 ##### [` RIGHT `]() RIGHT = 4096 ##### [` RTLREADING `]() RTLREADING = 8192 ##### [` STATICEDGE `]() STATICEDGE = 131072 ##### [` TOOLWINDOW `]() TOOLWINDOW = 128 ##### [` TOPMOST `]() TOPMOST = 8 ##### [` TRANSPARENT_STY `]() TRANSPARENT\_STY = 32 ##### [` WINDOWEDGE `]() WINDOWEDGE = 256 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.ResourceDialog.WINDOW\_EXTENDED\_STYLES]( "lief.PE.ResourceDialog.WINDOW_EXTENDED_STYLES") = <nanobind.nb\_func object> #### [` WINDOW_STYLES `]() class WINDOW\_STYLES(*\*values*) Bases: `Flag` From: [https://docs.microsoft.com/en-us/windows/win32/winmsg/window-styles]() ##### [` BORDER `]() BORDER = 8388608 ##### [` CAPTION `]() CAPTION = 12582912 ##### [` CHILD `]() CHILD = 1073741824 ##### [` CLIPCHILDREN `]() CLIPCHILDREN = 33554432 ##### [` CLIPSIBLINGS `]() CLIPSIBLINGS = 67108864 ##### [` DISABLED `]() DISABLED = 134217728 ##### [` DLGFRAME `]() DLGFRAME = 4194304 ##### [` GROUP `]() GROUP = 131072 ##### [` HSCROLL `]() HSCROLL = 1048576 ##### [` MAXIMIZE `]() MAXIMIZE = 16777216 ##### [` MINIMIZE `]() MINIMIZE = 536870912 ##### [` OVERLAPPED `]() OVERLAPPED = 0 ##### [` POPUP `]() POPUP = 2147483648 ##### [` SYSMENU `]() SYSMENU = 524288 ##### [` TABSTOP `]() TABSTOP = 65536 ##### [` THICKFRAME `]() THICKFRAME = 262144 ##### [` VISIBLE `]() VISIBLE = 268435456 ##### [` VSCROLL `]() VSCROLL = 2097152 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.ResourceDialog.WINDOW\_STYLES]( "lief.PE.ResourceDialog.WINDOW_STYLES") = <nanobind.nb\_func object> #### [` copy `]() copy(*self*) → [lief.\_lief.PE.ResourceDialog]( "lief._lief.PE.ResourceDialog") | None Duplicate the current instance of this object #### [` cx `]() property cx → int The width, in dialog box units, of the dialog box. #### [` cy `]() property cy → int The height, in dialog box units, of the dialog box #### [` extended_style `]() property extended\_style → int The extended styles for a window. This member is not used to create dialog boxes, but applications that use dialog box templates can use it to create other types of windows. For a list of values, see [`WINDOW_EXTENDED_STYLES`]( "lief.PE.ResourceDialog.WINDOW_EXTENDED_STYLES") #### [` hashashas `]() has(*self*, *arg: [lief.\_lief.PE.ResourceDialog.DIALOG\_STYLES]( "lief._lief.PE.ResourceDialog.DIALOG_STYLES")*, */*) → bool **has(*self*, *arg: [lief.\_lief.PE.ResourceDialog.WINDOW\_STYLES]( "lief._lief.PE.ResourceDialog.WINDOW_STYLES")*, */*) → bool **has(*self*, *arg: [lief.\_lief.PE.ResourceDialog.WINDOW\_EXTENDED\_STYLES]( "lief._lief.PE.ResourceDialog.WINDOW_EXTENDED_STYLES")*, */*) → bool**** Overloaded function. 1. `has(self, arg: lief._lief.PE.ResourceDialog.DIALOG_STYLES, /) -> bool` Check if the dialog uses the given dialog style 2. `has(self, arg: lief._lief.PE.ResourceDialog.WINDOW_STYLES, /) -> bool` Check if the dialog uses the given window style 3. `has(self, arg: lief._lief.PE.ResourceDialog.WINDOW_EXTENDED_STYLES, /) -> bool` Check if the dialog uses the given extended window style #### [` menu `]() property menu → int | str | None ordinal or name value of a menu resource #### [` style `]() property style → int The style of the dialog box. This member can be a combination of window style values (such as [`CAPTION`]( "lief.PE.ResourceDialog.WINDOW_STYLES.CAPTION") and [`SYSMENU`]( "lief.PE.ResourceDialog.WINDOW_STYLES.SYSMENU")) and dialog box style values (such as [`CENTER`]( "lief.PE.ResourceDialog.DIALOG_STYLES.CENTER")). #### [` styles_list `]() property styles\_list → list[[lief.PE.ResourceDialog.DIALOG\_STYLES]( "lief.PE.ResourceDialog.DIALOG_STYLES")] List of [`DIALOG_STYLES`]( "lief.PE.ResourceDialog.DIALOG_STYLES") used by this dialog #### [` title `]() property title → str title of the dialog box #### [` type `]() property type → [lief.PE.ResourceDialog.TYPE]( "lief.PE.ResourceDialog.TYPE") #### [` window_class `]() property window\_class → int | str | None ordinal of a predefined system window class or name of a registered window class #### [` windows_ext_styles_list `]() property windows\_ext\_styles\_list → list[[lief.PE.ResourceDialog.WINDOW\_EXTENDED\_STYLES]( "lief.PE.ResourceDialog.WINDOW_EXTENDED_STYLES")] List of [`WINDOW_EXTENDED_STYLES`]( "lief.PE.ResourceDialog.WINDOW_EXTENDED_STYLES") used by this dialog #### [` windows_styles_list `]() property windows\_styles\_list → list[[lief.PE.ResourceDialog.WINDOW\_STYLES]( "lief.PE.ResourceDialog.WINDOW_STYLES")] List of [`WINDOW_STYLES`]( "lief.PE.ResourceDialog.WINDOW_STYLES") used by this dialog #### [` x `]() property x → int The x-coordinate, in dialog box units, of the upper-left corner of the dialog box. #### [` y `]() property y → int The y-coordinate, in dialog box units, of the upper-left corner of the dialog box. --- ## [Resource Dialog – Regular]() ![Inheritance diagram of lief._lief.PE.ResourceDialogRegular](https://lief.re/doc/latest/_images/inheritance-2b9c806f92793b04be85796f6188ca18a6b07e0c.png) ### [` lief.PE.ResourceDialogRegular `]() class lief.PE.ResourceDialogRegular(*self*) Bases: [`ResourceDialog`]( "lief._lief.PE.ResourceDialog") Implementation for a regular/legacy dialog box. See: [https://learn.microsoft.com/en-us/windows/win32/api/winuser/ns-winuser-dlgtemplate]() #### [` Item `]() class Item(*self*) Bases: [`Item`]( "lief._lief.PE.ResourceDialog.Item") This class represents a `DLGTEMPLATE` item (`DLGITEMTEMPLATE`) See: [https://learn.microsoft.com/en-us/windows/win32/api/winuser/ns-winuser-dlgitemtemplate]() #### [` add_item `]() add\_item(*self*, *item: [lief.\_lief.PE.ResourceDialogRegular.Item]( "lief._lief.PE.ResourceDialogRegular.Item")*) → None Add a new control item to the dialog #### [` font `]() property font → [lief.PE.ResourceDialogRegular.font\_t]( "lief.PE.ResourceDialogRegular.font_t") Additional font information #### [` font_t `]() class font\_t Bases: `object` This structure represents additional font information that might be embedded at the end of the DLGTEMPLATE stream ##### [` name `]() property name → str ##### [` point_size `]() property point\_size → int #### [` items `]() property items → lief.PE.ResourceDialogRegular.it\_items Iterator over the different control items #### [` nb_items `]() property nb\_items → int Number of control items --- ## [Resource Dialog – Extended]() ![Inheritance diagram of lief._lief.PE.ResourceDialogExtended](https://lief.re/doc/latest/_images/inheritance-a63e6bbdd6a5981d2f0ab5c6629aaaf03139aed7.png) ### [` lief.PE.ResourceDialogExtended `]() class lief.PE.ResourceDialogExtended(*self*) Bases: [`ResourceDialog`]( "lief._lief.PE.ResourceDialog") Implementation for the new extended dialogbox format. See: [https://learn.microsoft.com/en-us/windows/win32/dlgbox/dlgtemplateex]() #### [` Item `]() class Item(*self*) Bases: [`Item`]( "lief._lief.PE.ResourceDialog.Item") This class represents a `DLGTEMPLATEEX` item (`DLGITEMTEMPLATEEX`). See: [https://learn.microsoft.com/en-us/windows/win32/dlgbox/dlgitemtemplateex]() ##### [` help_id `]() property help\_id → int The help context identifier for the control. When the system sends a `WM_HELP` message, it passes the `helpID` value in the `dwContextId` member of the `HELPINFO` structure. #### [` add_item `]() add\_item(*self*, *item: [lief.\_lief.PE.ResourceDialogExtended.Item]( "lief._lief.PE.ResourceDialogExtended.Item")*) → None Add a new control item to the dialog #### [` font `]() property font → [lief.PE.ResourceDialogExtended.font\_t]( "lief.PE.ResourceDialogExtended.font_t") Additional font information #### [` font_t `]() class font\_t Bases: `object` Font information for the font to use for the text in the dialog box and its controls ##### [` charset `]() property charset → int The character set to be used ##### [` italic `]() property italic → bool Indicates whether the font is italic ##### [` point_size `]() property point\_size → int The point size of the font ##### [` typeface `]() property typeface → str The name of the typeface for the font. ##### [` weight `]() property weight → int The weight of the font #### [` help_id `]() property help\_id → int The help context identifier for the dialog box window. When the system sends a `WM_HELP` message, it passes the `helpID` value in the `dwContextId` member of the `HELPINFO` structure. #### [` items `]() property items → lief.PE.ResourceDialogExtended.it\_items Iterator over the different control items #### [` signature `]() property signature → int Indicates whether a template is an extended dialog box template. If signature is 0xFFFF, this is an extended dialog box template. In this case, the dlgVer member specifies the template version number. #### [` version `]() property version → int The version number of the extended dialog box template. This member must be set to 1. --- ## [Resource Version]() ### [` lief.PE.ResourceVersion `]() class lief.PE.ResourceVersion Bases: `Object` Class that represents the data associated with the `RT_VERSION` entry See: VS\_VERSIONINFO – [https://docs.microsoft.com/en-us/windows/win32/menurc/vs-versioninfo]() #### [` file_info `]() property file\_info → [lief.PE.ResourceVersion.fixed\_file\_info\_t]( "lief.PE.ResourceVersion.fixed_file_info_t") Return the fixed file info (`VS_FIXEDFILEINFO`) #### [` fixed_file_info_t `]() class fixed\_file\_info\_t Bases: `object` This structure represents the `VS_FIXEDFILEINFO` structure defined in `verrsrc.h`. ##### [` FILE_FLAGS `]() class FILE\_FLAGS(*\*values*) Bases: `Enum` ###### [` DEBUG `]() DEBUG = 1 ###### [` INFO_INFERRED `]() INFO\_INFERRED = 16 ###### [` PATCHED `]() PATCHED = 4 ###### [` PRERELEASE `]() PRERELEASE = 2 ###### [` PRIVATEBUILD `]() PRIVATEBUILD = 8 ###### [` SPECIALBUILD `]() SPECIALBUILD = 32 ##### [` FILE_TYPE `]() class FILE\_TYPE(*\*values*) Bases: `Enum` ###### [` APP `]() APP = 1 ###### [` DLL `]() DLL = 2 ###### [` DRV `]() DRV = 3 ###### [` FONT `]() FONT = 4 ###### [` STATIC_LIB `]() STATIC\_LIB = 7 ###### [` UNKNOWN `]() UNKNOWN = 0 ###### [` VXD `]() VXD = 5 ##### [` FILE_TYPE_DETAILS `]() class FILE\_TYPE\_DETAILS(*\*values*) Bases: `Enum` ###### [` DRV_COMM `]() DRV\_COMM = 8589934602 ###### [` DRV_DISPLAY `]() DRV\_DISPLAY = 8589934596 ###### [` DRV_INPUTMETHOD `]() DRV\_INPUTMETHOD = 8589934603 ###### [` DRV_INSTALLABLE `]() DRV\_INSTALLABLE = 8589934600 ###### [` DRV_KEYBOARD `]() DRV\_KEYBOARD = 8589934594 ###### [` DRV_LANGUAGE `]() DRV\_LANGUAGE = 8589934595 ###### [` DRV_MOUSE `]() DRV\_MOUSE = 8589934597 ###### [` DRV_NETWORK `]() DRV\_NETWORK = 8589934598 ###### [` DRV_PRINTER `]() DRV\_PRINTER = 8589934593 ###### [` DRV_SOUND `]() DRV\_SOUND = 8589934601 ###### [` DRV_SYSTEM `]() DRV\_SYSTEM = 8589934599 ###### [` DRV_VERSIONED_PRINTER `]() DRV\_VERSIONED\_PRINTER = 12 ###### [` FONT_RASTER `]() FONT\_RASTER = 17179869185 ###### [` FONT_TRUETYPE `]() FONT\_TRUETYPE = 17179869187 ###### [` FONT_VECTOR `]() FONT\_VECTOR = 17179869186 ###### [` UNKNOWN `]() UNKNOWN = 0 ##### [` VERSION_OS `]() class VERSION\_OS(*\*values*) Bases: `Enum` ###### [` DOS_WINDOWS16 `]() DOS\_WINDOWS16 = 65537 ###### [` DOS_WINDOWS32 `]() DOS\_WINDOWS32 = 65540 ###### [` NT `]() NT = 262144 ###### [` NT_WINDOWS32 `]() NT\_WINDOWS32 = 262148 ###### [` OS216 `]() OS216 = 131072 ###### [` OS216_PM16 `]() OS216\_PM16 = 131074 ###### [` OS232 `]() OS232 = 196608 ###### [` OS232_PM32 `]() OS232\_PM32 = 196611 ###### [` PM16 `]() PM16 = 2 ###### [` PM32 `]() PM32 = 3 ###### [` UNKNOWN `]() UNKNOWN = 0 ###### [` WINCE `]() WINCE = 327680 ###### [` WINDOWS16 `]() WINDOWS16 = 1 ###### [` WINDOWS32 `]() WINDOWS32 = 4 ##### [` file_date_ls `]() property file\_date\_ls → int The least significant 32 bits of the file’s 64-bit binary creation date and time stamp. ##### [` file_date_ms `]() property file\_date\_ms → int The most significant 32 bits of the file’s 64-bit binary creation date and time stamp. ##### [` file_flags `]() property file\_flags → int Contains a bitmask that specifies the Boolean attributes of the file. This member can include one or more of the values specified in [`FILE_FLAGS`]( "lief.PE.ResourceVersion.fixed_file_info_t.FILE_FLAGS"). ##### [` file_flags_mask `]() property file\_flags\_mask → int Contains a bitmask that specifies the valid bits in file\_flags. A bit is valid only if it was defined when the file was created. ##### [` file_os `]() property file\_os → int The operating system for which this file was designed. This member can be one of the values specified in [`VERSION_OS`]( "lief.PE.ResourceVersion.fixed_file_info_t.VERSION_OS"). ##### [` file_subtype `]() property file\_subtype → int The function of the file. The possible values depend on the value of file\_type. ##### [` file_type `]() property file\_type → int The general type of file. This member can be one of the values specified in [`FILE_TYPE`]( "lief.PE.ResourceVersion.fixed_file_info_t.FILE_TYPE"). All other values are reserved. ##### [` file_type_details `]() property file\_type\_details → [lief.PE.ResourceVersion.fixed\_file\_info\_t.FILE\_TYPE\_DETAILS]( "lief.PE.ResourceVersion.fixed_file_info_t.FILE_TYPE_DETAILS") ##### [` file_version_ls `]() property file\_version\_ls → int The least significant 32 bits of the file’s binary version number. This member is used with [`file_version_ms`]( "lief.PE.ResourceVersion.fixed_file_info_t.file_version_ms") to form a 64-bit value used for numeric comparisons. ##### [` file_version_ms `]() property file\_version\_ms → int The most significant 32 bits of the file’s binary version number. This member is used with [`file_version_ls`]( "lief.PE.ResourceVersion.fixed_file_info_t.file_version_ls") to form a 64-bit value used for numeric comparisons. ##### [` flags `]() property flags → list[[lief.PE.ResourceVersion.fixed\_file\_info\_t.FILE\_FLAGS]( "lief.PE.ResourceVersion.fixed_file_info_t.FILE_FLAGS")] List of flags ##### [` has `]() has(*self*, *flag: [lief.\_lief.PE.ResourceVersion.fixed\_file\_info\_t.FILE\_FLAGS]( "lief._lief.PE.ResourceVersion.fixed_file_info_t.FILE_FLAGS")*) → bool Check if the given flag is present ##### [` product_version_ls `]() property product\_version\_ls → int The least significant 32 bits of the binary version number of the product with which this file was distributed. This member is used with [`product_version_ms`]( "lief.PE.ResourceVersion.fixed_file_info_t.product_version_ms") to form a 64-bit value used for numeric comparisons. ##### [` product_version_ms `]() property product\_version\_ms → int The most significant 32 bits of the binary version number of the product with which this file was distributed. This member is used with [`product_version_ls`]( "lief.PE.ResourceVersion.fixed_file_info_t.product_version_ls") to form a 64-bit value used for numeric comparisons. ##### [` signature `]() property signature → int Contains the value `0xFEEF04BD`. This is used with the `szKey` member of the `VS_VERSIONINFO` structure when searching a file for the `VS_FIXEDFILEINFO` structure. ##### [` struct_version `]() property struct\_version → int The binary version number of this structure. The high-order word of this member contains the major version number, and the low-order word contains the minor version number. #### [` key `]() property key → str The Unicode string L”VS\_VERSION\_INFO”” #### [` string_file_info `]() property string\_file\_info → [lief.PE.ResourceStringFileInfo]( "lief.PE.ResourceStringFileInfo") | None Return the `StringFileInfo` element #### [` type `]() property type → int The type of data in the version resource: \* `1` if it contains text data \* `0` if it contains binary data #### [` var_file_info `]() property var\_file\_info → [lief.PE.ResourceVarFileInfo]( "lief.PE.ResourceVarFileInfo") | None Return the `VarFileInfo` element --- ## [Resource Var File Info]() ### [` lief.PE.ResourceVarFileInfo `]() class lief.PE.ResourceVarFileInfo Bases: `Object` Representation of the `VarFileInfo` structure This structure represents the organization of data in a file-version resource. It contains version information not dependent on a particular language and code page combination. See: [https://learn.microsoft.com/en-us/windows/win32/menurc/varfileinfo]() #### [` key `]() property key → str Signature of the structure. Must be the unicode string “VarFileInfo” #### [` type `]() property type → int The type of data in the version resource: \* `1` if it contains text data \* `0` if it contains binary data #### [` vars `]() property vars → lief.PE.ResourceVarFileInfo.it\_vars Iterator over the embedded variables associated to the structure --- ## [Resource String File Info]() ### [` lief.PE.ResourceStringFileInfo `]() class lief.PE.ResourceStringFileInfo Bases: `Object` Representation of the `StringFileInfo` structure See: [https://docs.microsoft.com/en-us/windows/win32/menurc/stringfileinfo]() #### [` children `]() property children → lief.PE.ResourceStringFileInfo.it\_elements Iterator over the children values #### [` key `]() property key → str Signature of the structure. Must be the unicode string “StringFileInfo” #### [` type `]() property type → int The type of data in the version resource: \* `1` if it contains text data \* `0` if it contains binary data --- ## [Resource Var]() ### [` lief.PE.ResourceVar `]() class lief.PE.ResourceVar Bases: `object` This class represents an element of the [`ResourceVarFileInfo`]( "lief.PE.ResourceVarFileInfo") structure It typically contains a list of language and code page identifier pairs that the version of the application or DLL supports. See: [https://learn.microsoft.com/en-us/windows/win32/menurc/var-str]() #### [` key `]() property key → str Signature of the structure. Must be the unicode string “Translation” #### [` type `]() property type → int The type of data in the version resource: \* `1` if it contains text data \* `0` if it contains binary data #### [` values `]() property values → list[int] Return the translation values. The low-order word of each uint32\_t must contain a Microsoft language identifier, and the high-order word must contain the IBM code page number. Either high-order or low-order word can be zero, indicating that the file is language or code page independent --- ## [Resource String Table]() ### [` lief.PE.ResourceStringTable `]() class lief.PE.ResourceStringTable Bases: `Object` This class represents the `StringTable` structure. This structure can be seen as a dictionary of key, values with key and values defined as utf-16 strings. #### [` entries `]() property entries → lief.PE.ResourceStringTable.it\_entries Iterator over the different [`entry_t`]( "lief.PE.ResourceStringTable.entry_t") in this table #### [` entry_t `]() class entry\_t Bases: `object` An entry in this table which is composed of an UTF-16 key and an UTF-16 value. ##### [` key `]() property key → str ##### [` value `]() property value → str #### [` get `]() get(*self*, *key: str*) → str | None #### [` key `]() property key → str An 8-digit hexadecimal number stored as a Unicode string. The four most significant digits represent the language identifier. The four least significant digits represent the code page for which the data is formatted. Each Microsoft Standard Language identifier contains two parts: the low-order 10 bits specify the major language, and the high-order 6 bits specify the sublanguage. #### [` type `]() property type → int The type of data in the version resource: \* `1` if it contains text data \* `0` if it contains binary data --- ## [Resource Accelerator]() ### [` lief.PE.ResourceAccelerator `]() class lief.PE.ResourceAccelerator Bases: `Object` #### [` FLAGS `]() class FLAGS(*\*values*) Bases: `Flag` From: [https://docs.microsoft.com/en-us/windows/win32/menurc/acceltableentry]() ##### [` ALT `]() ALT = 16 ##### [` CONTROL `]() CONTROL = 8 ##### [` END `]() END = 128 ##### [` NOINVERT `]() NOINVERT = 2 ##### [` SHIFT `]() SHIFT = 4 ##### [` VIRTKEY `]() VIRTKEY = 1 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.ResourceAccelerator.FLAGS]( "lief.PE.ResourceAccelerator.FLAGS") = <nanobind.nb\_func object> #### [` add `]() add(*self*, *arg: [lief.\_lief.PE.ResourceAccelerator.FLAGS]( "lief._lief.PE.ResourceAccelerator.FLAGS")*, */*) → [lief.\_lief.PE.ResourceAccelerator]( "lief._lief.PE.ResourceAccelerator") Append the given flag #### [` ansi `]() property ansi → int An ANSI character value or a virtual-key code that identifies the accelerator key. #### [` ansi_str `]() property ansi\_str → str #### [` flags `]() property flags → int Describe the keyboard accelerator characteristics. #### [` has `]() has(*self*, *arg: [lief.\_lief.PE.ResourceAccelerator.FLAGS]( "lief._lief.PE.ResourceAccelerator.FLAGS")*, */*) → bool Whether the entry has the given flag #### [` id `]() property id → int An identifier for the keyboard accelerator. #### [` padding `]() property padding → int The number of bytes inserted to ensure that the structure is aligned on a DWORD boundary. #### [` remove `]() remove(*self*, *arg: [lief.\_lief.PE.ResourceAccelerator.FLAGS]( "lief._lief.PE.ResourceAccelerator.FLAGS")*, */*) → [lief.\_lief.PE.ResourceAccelerator]( "lief._lief.PE.ResourceAccelerator") Remove the given flag --- ## [Rich Header]() ### [` lief.PE.RichHeader `]() class lief.PE.RichHeader(*self*) Bases: `Object` Class which represents the not-so-documented rich header This structure is usually located at the end of the [`dos_stub`]( "lief.PE.Binary.dos_stub") and contains information about the build environment. It is generated by the Microsoft linker link.exe and there are no options to disable or remove this information. #### [` add_entryadd_entry `]() add\_entry(*self*, *entry: [lief.\_lief.PE.RichEntry]( "lief._lief.PE.RichEntry")*) → None **add\_entry(*self*, *id: int*, *build\_id: int*, *count: int*) → None** Overloaded function. 1. `add_entry(self, entry: lief._lief.PE.RichEntry) -> None` Add a new [`RichEntry`]( "lief.PE.RichEntry") 2. `add_entry(self, id: int, build_id: int, count: int) -> None` Add a new [`RichEntry`]( "lief.PE.RichEntry") given its [`id`]( "lief.PE.RichEntry.id"), [`build_id`]( "lief.PE.RichEntry.build_id"), [`count`]( "lief.PE.RichEntry.count") #### [` copy `]() copy(*self*) → [lief.\_lief.PE.RichHeader]( "lief._lief.PE.RichHeader") Duplicate the current instance of this object #### [` entries `]() property entries → lief.PE.RichHeader.it\_entries Return an iterator over the [`RichEntry`]( "lief.PE.RichEntry") within the header #### [` hashhash `]() hash(*self*, *algo: [lief.\_lief.PE.ALGORITHMS]( "lief._lief.PE.ALGORITHMS")*) → list[int] **hash(*self*, *algo: [lief.\_lief.PE.ALGORITHMS]( "lief._lief.PE.ALGORITHMS")*, *xor\_key: int*) → list[int]** Overloaded function. 1. `hash(self, algo: lief._lief.PE.ALGORITHMS) -> list[int]` > Compute the hash of the decoded rich header structure with the given hash [`ALGORITHMS`]( "lief.PE.ALGORITHMS") 2. `hash(self, algo: lief._lief.PE.ALGORITHMS, xor_key: int) -> list[int]` > Compute the hash of the rich header structure encoded with the provided key and the given hash [`ALGORITHMS`]( "lief.PE.ALGORITHMS") #### [` key `]() property key → int Key used to encode the header (xor operation) #### [` rawraw `]() raw(*self*) → list[int] **raw(*self*, *xor\_key: int*) → list[int]** Overloaded function. 1. `raw(self) -> list[int]` > The raw structure of the Rich header without xor-encoding. > > This function is equivalent as calling the other raw function with a xor\_key set to 0 2. `raw(self, xor_key: int) -> list[int]` > Given this rich header, this function re-computes the raw bytes of the structure with the provided xor-key. > > You can access the decoded data’s structure with the xor\_key set to 0 --- ## [Rich Entry]() ### [` lief.PE.RichEntrylief.PE.RichEntry `]() class lief.PE.RichEntry(*self*) **class lief.PE.RichEntry(*self*, *id: int*, *build\_id: int*, *count: int*)** Bases: `Object` Class which represents an entry associated to the RichHeader Overloaded function. 1. `__init__(self) -> None` 2. `__init__(self, id: int, build_id: int, count: int) -> None` Constructor from [`id`]( "lief.PE.RichEntry.id"), [`build_id`]( "lief.PE.RichEntry.build_id") and [`count`]( "lief.PE.RichEntry.count") #### [` build_id `]() property build\_id → int Builder number of the tool (if any) #### [` copy `]() copy(*self*) → [lief.\_lief.PE.RichEntry]( "lief._lief.PE.RichEntry") Duplicate the current instance of this object #### [` count `]() property count → int *Occurrence* count #### [` id `]() property id → int Type of the entry --- ## [Debug]() ![Inheritance diagram of lief._lief.PE.ExDllCharacteristics, lief._lief.PE.CodeView, lief._lief.PE.VCFeature, lief._lief.PE.Pogo, lief._lief.PE.FPO, lief._lief.PE.Debug, lief._lief.PE.Repro, lief._lief.PE.PDBChecksum, lief._lief.PE.CodeViewPDB](https://lief.re/doc/latest/_images/inheritance-fbde315166f89f11cf52c88af307b6b709a864ac.png) ### [` lief.PE.Debug `]() class lief.PE.Debug(*self*) Bases: `Object` This class represents a generic entry in the debug data directory. For known types, this class is extended to provide a dedicated API (see: [`CodeView`]( "lief.PE.CodeView")) #### [` TYPES `]() class TYPES(*\*values*) Bases: `Enum` The entry types ##### [` BORLAND `]() BORLAND = 9 ##### [` CLSID `]() CLSID = 11 ##### [` CODEVIEW `]() CODEVIEW = 2 ##### [` COFF `]() COFF = 1 ##### [` EXCEPTION `]() EXCEPTION = 5 ##### [` EX_DLLCHARACTERISTICS `]() EX\_DLLCHARACTERISTICS = 20 ##### [` FIXUP `]() FIXUP = 6 ##### [` FPO `]() FPO = 3 ##### [` ILTCG `]() ILTCG = 14 ##### [` MISC `]() MISC = 4 ##### [` MPX `]() MPX = 15 ##### [` OMAP_FROM_SRC `]() OMAP\_FROM\_SRC = 8 ##### [` OMAP_TO_SRC `]() OMAP\_TO\_SRC = 7 ##### [` PDBCHECKSUM `]() PDBCHECKSUM = 19 ##### [` POGO `]() POGO = 13 ##### [` REPRO `]() REPRO = 16 ##### [` RESERVED10 `]() RESERVED10 = 10 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` VC_FEATURE `]() VC\_FEATURE = 12 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.Debug.TYPES]( "lief.PE.Debug.TYPES") = <nanobind.nb\_func object> #### [` addressof_rawdata `]() property addressof\_rawdata → int Address of the debug data relative to the image base #### [` characteristics `]() property characteristics → int Reserved should be 0 #### [` copy `]() copy(*self*) → [lief.\_lief.PE.Debug]( "lief._lief.PE.Debug") | None Duplicate the current instance of this object #### [` major_version `]() property major\_version → int The major version number of the debug data format. #### [` minor_version `]() property minor\_version → int The minor version number of the debug data format. #### [` payload `]() property payload → memoryview Debug data associated with this entry #### [` pointerto_rawdata `]() property pointerto\_rawdata → int File offset of the debug data #### [` section `]() property section → [lief.PE.Section]( "lief.PE.Section") | None The section where debug data is located #### [` sizeof_data `]() property sizeof\_data → int Size of the debug data #### [` timestamp `]() property timestamp → int The time and date when the debug data was created. #### [` type `]() property type → [lief.PE.Debug.TYPES]( "lief.PE.Debug.TYPES") The format ([`TYPES`]( "lief.PE.Debug.TYPES")) of the debugging information --- ## [Code View]() ![Inheritance diagram of lief._lief.PE.CodeView, lief._lief.PE.CodeViewPDB](https://lief.re/doc/latest/_images/inheritance-e9f8a7d74456f46b65866cd68f7564de313cd2a8.png) ### [` lief.PE.CodeViewlief.PE.CodeView `]() class lief.PE.CodeView(*self*) **class lief.PE.CodeView(*self*, *arg: [lief.\_lief.PE.CodeView.SIGNATURES]( "lief._lief.PE.CodeView.SIGNATURES")*, */*)** Bases: [`Debug`]( "lief._lief.PE.Debug") #### [` SIGNATURES `]() class SIGNATURES(*\*values*) Bases: `Enum` ##### [` CV_41 `]() CV\_41 = 959464014 ##### [` CV_50 `]() CV\_50 = 825311822 ##### [` PDB_20 `]() PDB\_20 = 808534606 ##### [` PDB_70 `]() PDB\_70 = 1396986706 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.CodeView.SIGNATURES]( "lief.PE.CodeView.SIGNATURES") = <nanobind.nb\_func object> #### [` cv_signature `]() property cv\_signature → [lief.PE.CodeView.SIGNATURES]( "lief.PE.CodeView.SIGNATURES") Type of the code view ([`SIGNATURES`]( "lief.PE.CodeView.SIGNATURES")) --- ## [Code View PDB]() ![Inheritance diagram of lief._lief.PE.CodeViewPDB](https://lief.re/doc/latest/_images/inheritance-0ce9d372a40e1ccad005610ebcd1b1ff1383dfe4.png) ### [` lief.PE.CodeViewPDBlief.PE.CodeViewPDB `]() class lief.PE.CodeViewPDB(*self*) **class lief.PE.CodeViewPDB(*self*, *filename: str*)** Bases: [`CodeView`]( "lief._lief.PE.CodeView") CodeView PDB specialization Overloaded function. 1. `__init__(self) -> None` Default constructor 2. `__init__(self, filename: str) -> None` Filename-based constructor #### [` age `]() property age → int Age value to verify. The age does not necessarily correspond to any known time value, it is used to determine if a .pdb file is out of sync with a corresponding .exe file. #### [` filename `]() property filename → str | bytes The path to the `.pdb` file #### [` guid `]() property guid → str The GUID signature to verify against the .pdb file signature. This attribute might be used to lookup remote PDB file on a symbol server #### [` parent `]() property parent → [lief.PE.CodeView]( "lief.PE.CodeView") Return a reference to the parent [`lief.PE.CodeView`]( "lief.PE.CodeView") #### [` signature `]() property signature → list[int] The 32-bit signature to verify against the .pdb file signature. --- ## [Code Integrity]() ### [` lief.PE.CodeIntegrity `]() class lief.PE.CodeIntegrity(*self*) Bases: `Object` #### [` catalog `]() property catalog → int `0xFFFF` means not available #### [` catalog_offset `]() property catalog\_offset → int #### [` flags `]() property flags → int Flags to indicate if CI information is available, etc. #### [` reserved `]() property reserved → int Additional bitmask to be defined later --- ## [Pogo]() ![Inheritance diagram of lief._lief.PE.Pogo](https://lief.re/doc/latest/_images/inheritance-dd30c158f5f4a77263dd1bdb9d538cef832100c9.png) ### [` lief.PE.Pogo `]() class lief.PE.Pogo(*self*) Bases: [`Debug`]( "lief._lief.PE.Debug") #### [` SIGNATURES `]() class SIGNATURES(*\*values*) Bases: `Enum` ##### [` LCTG `]() LCTG = 1280590663 ##### [` PGI `]() PGI = 1346849024 ##### [` PGO `]() PGO = 1346850560 ##### [` PGU `]() PGU = 1346852096 ##### [` SPGO `]() SPGO = 1397770063 ##### [` UNKNOWN `]() UNKNOWN = 268435455 ##### [` ZERO `]() ZERO = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.Pogo.SIGNATURES]( "lief.PE.Pogo.SIGNATURES") = <nanobind.nb\_func object> #### [` entries `]() property entries → lief.PE.Pogo.it\_entries #### [` signature `]() property signature → [lief.PE.Pogo.SIGNATURES]( "lief.PE.Pogo.SIGNATURES") Type of the pogo ([`SIGNATURES`]( "lief.PE.Pogo.SIGNATURES")) --- ## [Pogo Entry]() ### [` lief.PE.PogoEntry `]() class lief.PE.PogoEntry(*self*) Bases: `Object` #### [` copy `]() copy(*self*) → [lief.\_lief.PE.PogoEntry]( "lief._lief.PE.PogoEntry") Duplicate the current instance of this object #### [` name `]() property name → str | bytes #### [` size `]() property size → int #### [` start_rva `]() property start\_rva → int --- ## [Repro]() ![Inheritance diagram of lief._lief.PE.Repro](https://lief.re/doc/latest/_images/inheritance-a4618a37c1668ee05ba4dc75bbc1b0ac8e950ead.png) ### [` lief.PE.Repro `]() class lief.PE.Repro Bases: [`Debug`]( "lief._lief.PE.Debug") This class represents a reproducible build entry from the debug directory. (`IMAGE_DEBUG_TYPE_REPRO`). This entry is usually generated with the undocumented /Brepro linker flag. See: [https://nikhilism.com/post/2020/windows-deterministic-builds/]() #### [` hash `]() property hash → memoryview The hash associated with the reproducible build --- ## [PDBChecksum]() ![Inheritance diagram of lief._lief.PE.PDBChecksum](https://lief.re/doc/latest/_images/inheritance-956f427dab66275c2cca7bcf26c9d2cb1b152d6b.png) ### [` lief.PE.PDBChecksum `]() class lief.PE.PDBChecksum(*self*, *algo: [lief.\_lief.PE.PDBChecksum.HASH\_ALGO]( "lief._lief.PE.PDBChecksum.HASH_ALGO")*, *hash: collections.abc.Sequence[int]*) Bases: [`Debug`]( "lief._lief.PE.Debug") This class represents the PDB Checksum debug entry which is essentially an array of bytes representing the checksum of the PDB content. #### [` HASH_ALGO `]() class HASH\_ALGO(*\*values*) Bases: `Enum` ##### [` SHA256 `]() SHA256 = 1 ##### [` UNKNOWN `]() UNKNOWN = 0 #### [` algorithm `]() property algorithm → [lief.PE.PDBChecksum.HASH\_ALGO]( "lief.PE.PDBChecksum.HASH_ALGO") Algorithm used for hashing the PDB content #### [` hash `]() property hash → memoryview Hash of the PDB content --- ## [VCFeature]() ![Inheritance diagram of lief._lief.PE.VCFeature](https://lief.re/doc/latest/_images/inheritance-35e0913f46335201c76afeabd5ef7dcd694f10a8.png) ### [` lief.PE.VCFeature `]() class lief.PE.VCFeature Bases: [`Debug`]( "lief._lief.PE.Debug") This class represents the `IMAGE_DEBUG_TYPE_VC_FEATURE` debug entry #### [` c_cpp `]() property c\_cpp → int Count for `C/C++` #### [` gs `]() property gs → int Count for `/GS` (number of guard stack) #### [` guards `]() property guards → int Count for `/guardN` #### [` pre_vcpp `]() property pre\_vcpp → int Count for `Pre-VC++ 11.00` #### [` sdl `]() property sdl → int Whether `/sdl` was enabled for this binary. `sdl` stands for Security Development Lifecycle and provides enhanced security features like changing security-relevant warnings into errors or enforcing guard stack. --- ## [ExDllCharacteristics]() ![Inheritance diagram of lief._lief.PE.ExDllCharacteristics](https://lief.re/doc/latest/_images/inheritance-c590e5f217242ec7542cab43163b5b04a96c047b.png) ### [` lief.PE.ExDllCharacteristics `]() class lief.PE.ExDllCharacteristics Bases: [`Debug`]( "lief._lief.PE.Debug") This class represents the `IMAGE_DEBUG_TYPE_EX_DLLCHARACTERISTICS` debug entry #### [` CHARACTERISTICS `]() class CHARACTERISTICS(*\*values*) Bases: `Flag` Extended DLL Characteristics ##### [` CET_COMPAT `]() CET\_COMPAT = 1 ##### [` CET_COMPAT_STRICT_MODE `]() CET\_COMPAT\_STRICT\_MODE = 2 ##### [` CET_DYNAMIC_APIS_ALLOW_IN_PROC `]() CET\_DYNAMIC\_APIS\_ALLOW\_IN\_PROC = 8 ##### [` CET_RESERVED_1 `]() CET\_RESERVED\_1 = 16 ##### [` CET_RESERVED_2 `]() CET\_RESERVED\_2 = 32 ##### [` CET_SET_CONTEXT_IP_VALIDATION_RELAXED_MODE `]() CET\_SET\_CONTEXT\_IP\_VALIDATION\_RELAXED\_MODE = 4 ##### [` FORWARD_CFI_COMPAT `]() FORWARD\_CFI\_COMPAT = 64 ##### [` HOTPATCH_COMPATIBLE `]() HOTPATCH\_COMPATIBLE = 128 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.ExDllCharacteristics.CHARACTERISTICS]( "lief.PE.ExDllCharacteristics.CHARACTERISTICS") = <nanobind.nb\_func object> #### [` ex_characteristics `]() property ex\_characteristics → [lief.PE.ExDllCharacteristics.CHARACTERISTICS]( "lief.PE.ExDllCharacteristics.CHARACTERISTICS") The extended characteristics #### [` ex_characteristics_list `]() property ex\_characteristics\_list → list[[lief.PE.ExDllCharacteristics.CHARACTERISTICS]( "lief.PE.ExDllCharacteristics.CHARACTERISTICS")] Characteristics as a vector #### [` has `]() has(*self*, *characteristic: [lief.\_lief.PE.ExDllCharacteristics.CHARACTERISTICS]( "lief._lief.PE.ExDllCharacteristics.CHARACTERISTICS")*) → bool Check if the given CHARACTERISTICS is used --- ## [Frame Pointer Omission (FPO)]() ![Inheritance diagram of lief._lief.PE.FPO](https://lief.re/doc/latest/_images/inheritance-2ca251243b9682efb5f61542367a4014e25083d2.png) ### [` lief.PE.FPO `]() class lief.PE.FPO Bases: [`Debug`]( "lief._lief.PE.Debug") This class represents the `IMAGE_DEBUG_TYPE_FPO` debug entry #### [` FRAME_TYPE `]() class FRAME\_TYPE(*\*values*) Bases: `Enum` ##### [` FPO_ `]() FPO\_ = 0 ##### [` NON_FPO `]() NON\_FPO = 3 ##### [` TRAP `]() TRAP = 1 ##### [` TSS `]() TSS = 2 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.FPO.FRAME\_TYPE]( "lief.PE.FPO.FRAME_TYPE") = <nanobind.nb\_func object> #### [` entries `]() property entries → lief.PE.FPO.it\_entries Iterator over the different FPO entries #### [` entry_t `]() class entry\_t Bases: `object` Represents the stack frame layout for a x86 function when frame pointer omission (FPO) optimization is used. ##### [` nb_locals `]() property nb\_locals → int The number of local variables. ##### [` nb_saved_regs `]() property nb\_saved\_regs → int Number of registers saved. ##### [` parameters_size `]() property parameters\_size → int The size of the parameters. ##### [` proc_size `]() property proc\_size → int The number of bytes in the function. ##### [` prolog_size `]() property prolog\_size → int The number of bytes in the function prolog code. ##### [` reserved `]() property reserved → int reserved for future use ##### [` rva `]() property rva → int The function RVA ##### [` type `]() property type → [lief.PE.FPO.FRAME\_TYPE]( "lief.PE.FPO.FRAME_TYPE") Variable that indicates the frame type. ##### [` use_bp `]() property use\_bp → bool Whether the EBP register has been allocated. ##### [` use_seh `]() property use\_seh → bool Whether the function uses structured exception handling. --- ## [Exception Info]() ![Inheritance diagram of lief._lief.PE.ExceptionInfo, lief._lief.PE.RuntimeFunctionAArch64, lief._lief.PE.unwind_aarch64.UnpackedFunction, lief._lief.PE.unwind_aarch64.PackedFunction, lief._lief.PE.RuntimeFunctionX64](https://lief.re/doc/latest/_images/inheritance-f0c6864431ee343df21cbaadcd4a611c95727c95.png) ### [` lief.PE.ExceptionInfo `]() class lief.PE.ExceptionInfo Bases: `object` This class is the base class for any exception or runtime function entry #### [` ARCH `]() class ARCH(*\*values*) Bases: `Enum` Arch discriminator for the subclasses ##### [` ARM64 `]() ARM64 = 1 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` X86_64 `]() X86\_64 = 2 #### [` arch `]() property arch → [lief.PE.ExceptionInfo.ARCH]( "lief.PE.ExceptionInfo.ARCH") Target architecture of this exception #### [` copy `]() copy(*self*) → [lief.\_lief.PE.ExceptionInfo]( "lief._lief.PE.ExceptionInfo") | None Duplicate the current instance of this object #### [` offset `]() property offset → int Offset in the binary where the raw exception information associated with this entry is defined #### [` rva_start `]() property rva\_start → int Function start address --- ## [RuntimeFunctionX64]() ![Inheritance diagram of lief._lief.PE.RuntimeFunctionX64](https://lief.re/doc/latest/_images/inheritance-a67b8160b956027a2d597bab5b2df2305c43cc1b.png) ### [` lief.PE.RuntimeFunctionX64 `]() class lief.PE.RuntimeFunctionX64 Bases: [`ExceptionInfo`]( "lief._lief.PE.ExceptionInfo") This class represents an entry in the exception table (`.pdata` section) for the x86-64 architecture. Reference: [https://learn.microsoft.com/en-us/cpp/build/exception-handling-x64]() #### [` UNWIND_FLAGS `]() class UNWIND\_FLAGS(*\*values*) Bases: `Flag` ##### [` CHAIN_INFO `]() CHAIN\_INFO = 4 ##### [` EXCEPTION_HANDLER `]() EXCEPTION\_HANDLER = 1 ##### [` TERMINATE_HANDLER `]() TERMINATE\_HANDLER = 2 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.RuntimeFunctionX64.UNWIND\_FLAGS]( "lief.PE.RuntimeFunctionX64.UNWIND_FLAGS") = <nanobind.nb\_func object> #### [` UNWIND_OPCODES `]() class UNWIND\_OPCODES(*\*values*) Bases: `Enum` ##### [` ALLOC_LARGE `]() ALLOC\_LARGE = 1 ##### [` ALLOC_SMALL `]() ALLOC\_SMALL = 2 ##### [` EPILOG `]() EPILOG = 6 ##### [` PUSH_MACHFRAME `]() PUSH\_MACHFRAME = 10 ##### [` PUSH_NONVOL `]() PUSH\_NONVOL = 0 ##### [` SAVE_NONVOL `]() SAVE\_NONVOL = 4 ##### [` SAVE_NONVOL_FAR `]() SAVE\_NONVOL\_FAR = 5 ##### [` SAVE_XMM128 `]() SAVE\_XMM128 = 8 ##### [` SAVE_XMM128_FAR `]() SAVE\_XMM128\_FAR = 9 ##### [` SET_FPREG `]() SET\_FPREG = 3 ##### [` SPARE `]() SPARE = 7 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.RuntimeFunctionX64.UNWIND\_OPCODES]( "lief.PE.RuntimeFunctionX64.UNWIND_OPCODES") = <nanobind.nb\_func object> #### [` UNWIND_REG `]() class UNWIND\_REG(*\*values*) Bases: `Enum` ##### [` R10 `]() R10 = 10 ##### [` R11 `]() R11 = 11 ##### [` R12 `]() R12 = 12 ##### [` R13 `]() R13 = 13 ##### [` R14 `]() R14 = 14 ##### [` R15 `]() R15 = 15 ##### [` R8 `]() R8 = 8 ##### [` R9 `]() R9 = 9 ##### [` RAX `]() RAX = 0 ##### [` RBP `]() RBP = 5 ##### [` RBX `]() RBX = 3 ##### [` RCX `]() RCX = 1 ##### [` RDI `]() RDI = 7 ##### [` RDX `]() RDX = 2 ##### [` RSI `]() RSI = 6 ##### [` RSP `]() RSP = 4 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.RuntimeFunctionX64.UNWIND\_REG]( "lief.PE.RuntimeFunctionX64.UNWIND_REG") = <nanobind.nb\_func object> #### [` rva_end `]() property rva\_end → int Function end address #### [` size `]() property size → int Size of the function (in bytes) #### [` unwind_info `]() property unwind\_info → [lief.PE.RuntimeFunctionX64.unwind\_info\_t]( "lief.PE.RuntimeFunctionX64.unwind_info_t") | None Detailed unwind information #### [` unwind_info_t `]() class unwind\_info\_t Bases: `object` ##### [` chained `]() property chained → [lief.PE.RuntimeFunctionX64]( "lief.PE.RuntimeFunctionX64") If [`lief.PE.RuntimeFunctionX64.UNWIND_FLAGS.CHAIN_INFO`]( "lief.PE.RuntimeFunctionX64.UNWIND_FLAGS.CHAIN_INFO") is set, this attribute references the chained runtime function. ##### [` count_opcodes `]() property count\_opcodes → int The number of slots in the unwind codes array. Some unwind codes, for example, [`lief.PE.RuntimeFunctionX64.UNWIND_OPCODES.SAVE_NONVOL`]( "lief.PE.RuntimeFunctionX64.UNWIND_OPCODES.SAVE_NONVOL"), require more than one slot in the array. ##### [` flags `]() property flags → int See: [`lief.PE.RuntimeFunctionX64.UNWIND_FLAGS`]( "lief.PE.RuntimeFunctionX64.UNWIND_FLAGS") ##### [` frame_reg `]() property frame\_reg → int If nonzero, then the function uses a frame pointer (FP), and this field is the number of the nonvolatile register used as the frame pointer, using the same encoding for the operation info field of [`UNWIND_OPCODES`]( "lief.PE.RuntimeFunctionX64.UNWIND_OPCODES") node ##### [` frame_reg_offset `]() property frame\_reg\_offset → int If the frame register field is nonzero, this field is the scaled offset from RSP that is applied to the FP register when it’s established ##### [` handler `]() property handler → int | None An image-relative pointer to either the function’s language-specific exception or termination handler. This value is set if one of these flags is set: [`lief.PE.RuntimeFunctionX64.UNWIND_FLAGS.EXCEPTION_HANDLER`]( "lief.PE.RuntimeFunctionX64.UNWIND_FLAGS.EXCEPTION_HANDLER"), [`lief.PE.RuntimeFunctionX64.UNWIND_FLAGS.TERMINATE_HANDLER`]( "lief.PE.RuntimeFunctionX64.UNWIND_FLAGS.TERMINATE_HANDLER"). ##### [` has `]() has(*self*, *arg: [lief.\_lief.PE.RuntimeFunctionX64.UNWIND\_FLAGS]( "lief._lief.PE.RuntimeFunctionX64.UNWIND_FLAGS")*, */*) → bool Check if the given flag is used ##### [` opcodes `]() property opcodes → list[[lief.PE.unwind\_x64.Code]( "lief.PE.unwind_x64.Code") | None] Enhanced representation of the unwind code ##### [` raw_opcodes `]() property raw\_opcodes → list[int] An array of items that explains the effect of the prolog on the nonvolatile registers and RSP ##### [` sizeof_prologue `]() property sizeof\_prologue → int Length of the function prolog in bytes. ##### [` version `]() property version → int Version number of the unwind data, currently 1 or 2. #### [` unwind_rva `]() property unwind\_rva → int Unwind info address --- ## [unwind\_x64 - Code]() ![Inheritance diagram of lief._lief.PE.unwind_x64.Spare, lief._lief.PE.unwind_x64.Code, lief._lief.PE.unwind_x64.PushNonVol, lief._lief.PE.unwind_x64.SaveNonVolatile, lief._lief.PE.unwind_x64.SetFPReg, lief._lief.PE.unwind_x64.PushMachFrame, lief._lief.PE.unwind_x64.SaveXMM128, lief._lief.PE.unwind_x64.Epilog, lief._lief.PE.unwind_x64.Alloc](https://lief.re/doc/latest/_images/inheritance-90dab8e8a11b4d878444ffd41a29893a3271c51f.png) ### [` lief.PE.unwind_x64.Code `]() class lief.PE.unwind\_x64.Code Bases: `object` Base class for all unwind operations #### [` opcode `]() property opcode → [lief.PE.RuntimeFunctionX64.UNWIND\_OPCODES]( "lief.PE.RuntimeFunctionX64.UNWIND_OPCODES") The original opcode #### [` position `]() property position → int Offset in the prolog --- ## [unwind\_x64 - Alloc]() ![Inheritance diagram of lief._lief.PE.unwind_x64.Alloc](https://lief.re/doc/latest/_images/inheritance-7932a760e824ebd8327192d9407686191ba0c101.png) ### [` lief.PE.unwind_x64.Alloc `]() class lief.PE.unwind\_x64.Alloc Bases: [`Code`]( "lief._lief.PE.unwind_x64.Code") This class represents a stack-allocation operation ([`lief.PE.RuntimeFunctionX64.UNWIND_OPCODES.ALLOC_SMALL`]( "lief.PE.RuntimeFunctionX64.UNWIND_OPCODES.ALLOC_SMALL"), [`lief.PE.RuntimeFunctionX64.UNWIND_OPCODES.ALLOC_LARGE`]( "lief.PE.RuntimeFunctionX64.UNWIND_OPCODES.ALLOC_LARGE")) #### [` size `]() property size → int The size allocated --- ## [unwind\_x64 - PushNonVol]() ![Inheritance diagram of lief._lief.PE.unwind_x64.PushNonVol](https://lief.re/doc/latest/_images/inheritance-5eac9f87597251388a440f3a60d481db96fe2564.png) ### [` lief.PE.unwind_x64.PushNonVol `]() class lief.PE.unwind\_x64.PushNonVol Bases: [`Code`]( "lief._lief.PE.unwind_x64.Code") Push a nonvolatile integer register, decrementing RSP by 8 #### [` reg `]() property reg → [lief.PE.RuntimeFunctionX64.UNWIND\_REG]( "lief.PE.RuntimeFunctionX64.UNWIND_REG") The register pushed --- ## [unwind\_x64 - PushMachFrame]() ![Inheritance diagram of lief._lief.PE.unwind_x64.PushMachFrame](https://lief.re/doc/latest/_images/inheritance-83f06da173147608509db8e636e283220441f4ec.png) ### [` lief.PE.unwind_x64.PushMachFrame `]() class lief.PE.unwind\_x64.PushMachFrame Bases: [`Code`]( "lief._lief.PE.unwind_x64.Code") Push a machine frame #### [` value `]() property value → int 0 or 1 --- ## [unwind\_x64 - SetFPReg]() ![Inheritance diagram of lief._lief.PE.unwind_x64.SetFPReg](https://lief.re/doc/latest/_images/inheritance-f4fd7774f8d5969331cb79842a09b6b1506851d5.png) ### [` lief.PE.unwind_x64.SetFPReg `]() class lief.PE.unwind\_x64.SetFPReg Bases: [`Code`]( "lief._lief.PE.unwind_x64.Code") Establish the frame pointer register by setting the register to some offset of the current RSP #### [` reg `]() property reg → [lief.PE.RuntimeFunctionX64.UNWIND\_REG]( "lief.PE.RuntimeFunctionX64.UNWIND_REG") Frame pointer register --- ## [unwind\_x64 - SaveNonVolatile]() ![Inheritance diagram of lief._lief.PE.unwind_x64.SaveNonVolatile](https://lief.re/doc/latest/_images/inheritance-14dd76e7d856869346e54e3568e2a502f80710ba.png) ### [` lief.PE.unwind_x64.SaveNonVolatile `]() class lief.PE.unwind\_x64.SaveNonVolatile Bases: [`Code`]( "lief._lief.PE.unwind_x64.Code") Save a nonvolatile integer register on the stack using a MOV instead of a PUSH. #### [` offset `]() property offset → int The offset where to save the register #### [` reg `]() property reg → [lief.PE.RuntimeFunctionX64.UNWIND\_REG]( "lief.PE.RuntimeFunctionX64.UNWIND_REG") The register to save --- ## [unwind\_x64 - SaveXMM128]() ![Inheritance diagram of lief._lief.PE.unwind_x64.SaveXMM128](https://lief.re/doc/latest/_images/inheritance-17a1bf8e61c218b96e60c63ac497b6e22c11b166.png) ### [` lief.PE.unwind_x64.SaveXMM128 `]() class lief.PE.unwind\_x64.SaveXMM128 Bases: [`Code`]( "lief._lief.PE.unwind_x64.Code") Save all 128 bits of a nonvolatile XMM register on the stack #### [` num `]() property num → int XMM register number #### [` offset `]() property offset → int The offset where to save the register --- ## [unwind\_x64 - Epilog]() ![Inheritance diagram of lief._lief.PE.unwind_x64.Epilog](https://lief.re/doc/latest/_images/inheritance-437397e8ee9ee6de699dc8140357066f7458375c.png) ### [` lief.PE.unwind_x64.Epilog `]() class lief.PE.unwind\_x64.Epilog Bases: [`Code`]( "lief._lief.PE.unwind_x64.Code") Describes the function’s epilog #### [` flags `]() property flags → int #### [` size `]() property size → int Size of the epilog --- ## [unwind\_x64 - Spare]() ![Inheritance diagram of lief._lief.PE.unwind_x64.Spare](https://lief.re/doc/latest/_images/inheritance-e73f005757aa71a7c1c1dd2b7c860591b9abc76f.png) ### [` lief.PE.unwind_x64.Spare `]() class lief.PE.unwind\_x64.Spare Bases: [`Code`]( "lief._lief.PE.unwind_x64.Code") --- ## [RuntimeFunctionAArch64]() ![Inheritance diagram of lief._lief.PE.unwind_aarch64.UnpackedFunction, lief._lief.PE.RuntimeFunctionAArch64, lief._lief.PE.unwind_aarch64.PackedFunction](https://lief.re/doc/latest/_images/inheritance-8c2e084ff297ede8b2084e665de7e6a265e9dcf6.png) ### [` lief.PE.RuntimeFunctionAArch64 `]() class lief.PE.RuntimeFunctionAArch64 Bases: [`ExceptionInfo`]( "lief._lief.PE.ExceptionInfo") This class represents an entry in the exception table (`.pdata` section) for the AArch64 architecture. Since the ARM64 unwinding info can be encoded in a *packed* and *unpacked* format, this class is inherited by [`lief.PE.unwind_aarch64.PackedFunction`]( "lief.PE.unwind_aarch64.PackedFunction") and [`lief.PE.unwind_aarch64.UnpackedFunction`]( "lief.PE.unwind_aarch64.UnpackedFunction") Reference: [https://learn.microsoft.com/en-us/cpp/build/arm64-exception-handling#arm64-exception-handling-information]() #### [` PACKED_FLAGS `]() class PACKED\_FLAGS(*\*values*) Bases: `Enum` ##### [` PACKED `]() PACKED = 1 ##### [` PACKED_FRAGMENT `]() PACKED\_FRAGMENT = 2 ##### [` RESERVED `]() RESERVED = 3 ##### [` UNPACKED `]() UNPACKED = 0 #### [` flag `]() property flag → [lief.PE.RuntimeFunctionAArch64.PACKED\_FLAGS]( "lief.PE.RuntimeFunctionAArch64.PACKED_FLAGS") Flag describing the format the unwind data #### [` length `]() property length → int Length of the function in bytes #### [` rva_end `]() property rva\_end → int Function end address ## [Runtime AArch64 (Packed) Function]() ![Inheritance diagram of lief._lief.PE.unwind_aarch64.PackedFunction](https://lief.re/doc/latest/_images/inheritance-f28464486f1fd687abc93c5686a0ec0397a0f65d.png) ### [` lief.PE.unwind_aarch64.PackedFunction `]() class lief.PE.unwind\_aarch64.PackedFunction Bases: [`RuntimeFunctionAArch64`]( "lief._lief.PE.RuntimeFunctionAArch64") This class represents a packed AArch64 exception entry. An exception entry can be packed if the unwind data fit in 30 bits Reference: [https://learn.microsoft.com/en-us/cpp/build/arm64-exception-handling?view=msvc-170#packed-unwind-data]() #### [` CR `]() property CR → int Flag indicating whether the function includes extra instructions to set up a frame chain and return link. #### [` H `]() property H → int 1-bit flag indicating whether the function homes the integer parameter registers (x0-x7) by storing them at the very start of the function. (0 = doesn’t home registers, 1 = homes registers). #### [` frame_size `]() property frame\_size → int Size of the allocated stack #### [` reg_F `]() property reg\_F → int Number of non-volatile FP registers (d8-d15) saved in the canonical stack location #### [` reg_I `]() property reg\_I → int Number of non-volatile INT registers (x19-x28) saved in the canonical stack location. ## [Runtime AArch64 (UnpackedFunction) Function]() ![Inheritance diagram of lief._lief.PE.unwind_aarch64.UnpackedFunction](https://lief.re/doc/latest/_images/inheritance-bb38985a5022477862bb99d31f385669f31b4248.png) ### [` lief.PE.unwind_aarch64.UnpackedFunction `]() class lief.PE.unwind\_aarch64.UnpackedFunction Bases: [`RuntimeFunctionAArch64`]( "lief._lief.PE.RuntimeFunctionAArch64") This class represents an unpacked AArch64 exception entry Reference: [https://learn.microsoft.com/en-us/cpp/build/arm64-exception-handling?view=msvc-170#xdata-records]() #### [` E `]() property E → int 1-bit field that indicates that information describing a single epilog is packed into the header (1) rather than requiring more scope words later (0). #### [` X `]() property X → int 1-bit field that indicates the presence (1) or absence (0) of exception data. #### [` code_words `]() property code\_words → int Number of 32-bit words needed to contain all of the unwind codes #### [` epilog_count `]() property epilog\_count → int **If E == 0**, specifies the count of the total number of epilog scopes. Otherwise, return 0. #### [` epilog_offset `]() property epilog\_offset → int **If E() == 1**, index of the first unwind code that describes the one and only epilog. #### [` epilog_scope_t `]() class epilog\_scope\_t Bases: `object` This structure describes an epilog scope. ##### [` reserved `]() property reserved → int Reserved for future expansion. Should be 0. ##### [` start_index `]() property start\_index → int Byte index of the first unwind code that describes this epilog ##### [` start_offset `]() property start\_offset → int Offset of the epilog relative to the start of the function #### [` epilog_scopes `]() property epilog\_scopes → lief.PE.unwind\_aarch64.UnpackedFunction.it\_epilog\_scopes Iterator over the epilog scopes #### [` exception_handler `]() property exception\_handler → int Exception handler RVA (if any) #### [` is_extended `]() property is\_extended → bool Whether it uses 2-words encoding #### [` unwind_code `]() property unwind\_code → memoryview Bytes that contain unwind codes #### [` version `]() property version → int Describes the version of the remaining `.xdata`. Currently (2025-01-04), only version 0 is defined, so values of 1-3 aren’t permitted. #### [` xdata_rva `]() property xdata\_rva → int RVA where this unpacked data is located (usually pointing in `.xdata`) --- ## [Load Configuration]() ### [` lief.PE.LoadConfiguration `]() class lief.PE.LoadConfiguration Bases: `Object` This class represents the load configuration data associated with the `IMAGE_LOAD_CONFIG_DIRECTORY`. This structure is frequently updated by Microsoft to add new metadata. Reference: [https://github.com/MicrosoftDocs/sdk-api/blob/cbeab4d371e8bc7e352c4d3a4c5819caa08c6a1c/sdk-api-src/content/winnt/ns-winnt-image\_load\_config\_directory64.md#L2]() #### [` IMAGE_GUARD `]() class IMAGE\_GUARD(*\*values*) Bases: `Flag` ##### [` CASTGUARD_PRESENT `]() CASTGUARD\_PRESENT = 16777216 ##### [` CFW_INSTRUMENTED `]() CFW\_INSTRUMENTED = 512 ##### [` CF_ENABLE_EXPORT_SUPPRESSION `]() CF\_ENABLE\_EXPORT\_SUPPRESSION = 32768 ##### [` CF_EXPORT_SUPPRESSION_INFO_PRESENT `]() CF\_EXPORT\_SUPPRESSION\_INFO\_PRESENT = 16384 ##### [` CF_FUNCTION_TABLE_PRESENT `]() CF\_FUNCTION\_TABLE\_PRESENT = 1024 ##### [` CF_INSTRUMENTED `]() CF\_INSTRUMENTED = 256 ##### [` CF_LONGJUMP_TABLE_PRESENT `]() CF\_LONGJUMP\_TABLE\_PRESENT = 65536 ##### [` DELAYLOAD_IAT_IN_ITS_OWN_SECTION `]() DELAYLOAD\_IAT\_IN\_ITS\_OWN\_SECTION = 8192 ##### [` EH_CONTINUATION_TABLE_PRESENT `]() EH\_CONTINUATION\_TABLE\_PRESENT = 4194304 ##### [` MEMCPY_PRESENT `]() MEMCPY\_PRESENT = 33554432 ##### [` NONE `]() NONE = 0 ##### [` PROTECT_DELAYLOAD_IAT `]() PROTECT\_DELAYLOAD\_IAT = 4096 ##### [` RETPOLINE_PRESENT `]() RETPOLINE\_PRESENT = 1048576 ##### [` RF_ENABLE `]() RF\_ENABLE = 262144 ##### [` RF_INSTRUMENTED `]() RF\_INSTRUMENTED = 131072 ##### [` RF_STRICT `]() RF\_STRICT = 524288 ##### [` SECURITY_COOKIE_UNUSED `]() SECURITY\_COOKIE\_UNUSED = 2048 ##### [` XFG_ENABLED `]() XFG\_ENABLED = 8388608 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.LoadConfiguration.IMAGE\_GUARD]( "lief.PE.LoadConfiguration.IMAGE_GUARD") = <nanobind.nb\_func object> #### [` cast_guard_os_determined_failure_mode `]() property cast\_guard\_os\_determined\_failure\_mode → int | None #### [` characteristics `]() property characteristics → int Characteristics of the structure which is defined by its size #### [` chpe_metadata `]() property chpe\_metadata → [lief.PE.CHPEMetadata]( "lief.PE.CHPEMetadata") | None Compiled Hybrid Portable Executable (CHPE) metadata (if any) #### [` chpe_metadata_pointer `]() property chpe\_metadata\_pointer → int | None VA to the extra Compiled Hybrid Portable Executable (CHPE) metadata. #### [` code_integrity `]() property code\_integrity → [lief.PE.CodeIntegrity]( "lief.PE.CodeIntegrity") | None Code integrity information. #### [` copy `]() copy(*self*) → [lief.\_lief.PE.LoadConfiguration]( "lief._lief.PE.LoadConfiguration") Duplicate the current instance of this object #### [` critical_section_default_timeout `]() property critical\_section\_default\_timeout → int The critical section default time-out value. #### [` csd_version `]() property csd\_version → int The service pack version. #### [` decommit_free_block_threshold `]() property decommit\_free\_block\_threshold → int The size of the minimum block that must be freed before it is freed (de-committed), in bytes. This value is advisory. #### [` decommit_total_free_threshold `]() property decommit\_total\_free\_threshold → int The size of the minimum total memory that must be freed in the process heap before it is freed (de-committed), in bytes. This value is advisory. #### [` dependent_load_flags `]() property dependent\_load\_flags → int Alias for [`reserved1`]( "lief.PE.LoadConfiguration.reserved1"). The default load flags used when the operating system resolves the statically linked imports of a module. For more information, see `LoadLibraryEx`. #### [` dynamic_relocations `]() property dynamic\_relocations → lief.PE.LoadConfiguration.it\_dynamic\_relocations\_t #### [` dynamic_value_reloc_table `]() property dynamic\_value\_reloc\_table → int | None VA pointing to a `IMAGE_DYNAMIC_RELOCATION_TABLE` #### [` dynamic_value_reloctable_offset `]() property dynamic\_value\_reloctable\_offset → int | None Offset of dynamic relocation table relative to the relocation table #### [` dynamic_value_reloctable_section `]() property dynamic\_value\_reloctable\_section → int | None The section index of the dynamic value relocation table #### [` editlist `]() property editlist → int Reserved for use by the system. #### [` enclave_config `]() property enclave\_config → [lief.PE.EnclaveConfiguration]( "lief.PE.EnclaveConfiguration") | None #### [` enclave_configuration_ptr `]() property enclave\_configuration\_ptr → int | None #### [` global_flags_clear `]() property global\_flags\_clear → int The global flags that control system behavior. For more information, see `Gflags.exe`. #### [` global_flags_set `]() property global\_flags\_set → int The global flags that control system behavior. For more information, see `Gflags.exe`. #### [` guard_address_taken_iat_entries `]() property guard\_address\_taken\_iat\_entries → lief.PE.LoadConfiguration.it\_guard\_functions List of RVA pointed by [`guard_address_taken_iat_entry_table`]( "lief.PE.LoadConfiguration.guard_address_taken_iat_entry_table") #### [` guard_address_taken_iat_entry_count `]() property guard\_address\_taken\_iat\_entry\_count → int | None The count of unique RVAs in the table pointed by [`guard_address_taken_iat_entry_table`]( "lief.PE.LoadConfiguration.guard_address_taken_iat_entry_table"). #### [` guard_address_taken_iat_entry_table `]() property guard\_address\_taken\_iat\_entry\_table → int | None The VA where Control Flow Guard address taken IAT table is stored. #### [` guard_cf_check_function_pointer `]() property guard\_cf\_check\_function\_pointer → int | None The VA where Control Flow Guard check-function pointer is stored. #### [` guard_cf_dispatch_function_pointer `]() property guard\_cf\_dispatch\_function\_pointer → int | None The VA where Control Flow Guard dispatch-function pointer is stored. #### [` guard_cf_flags_list `]() property guard\_cf\_flags\_list → list[[lief.PE.LoadConfiguration.IMAGE\_GUARD]( "lief.PE.LoadConfiguration.IMAGE_GUARD")] List of flags #### [` guard_cf_function_count `]() property guard\_cf\_function\_count → int | None The count of unique RVAs in the [`guard_cf_function_table`]( "lief.PE.LoadConfiguration.guard_cf_function_table") table. #### [` guard_cf_function_table `]() property guard\_cf\_function\_table → int | None The VA of the sorted table of RVAs of each Control Flow Guard function in the image. #### [` guard_cf_functions `]() property guard\_cf\_functions → lief.PE.LoadConfiguration.it\_guard\_functions Iterator over the Control Flow Guard functions referenced by [`guard_cf_function_table`]( "lief.PE.LoadConfiguration.guard_cf_function_table") #### [` guard_eh_continuation_count `]() property guard\_eh\_continuation\_count → int | None #### [` guard_eh_continuation_functions `]() property guard\_eh\_continuation\_functions → lief.PE.LoadConfiguration.it\_guard\_functions List of RVA pointed by [`guard_eh_continuation_table`]( "lief.PE.LoadConfiguration.guard_eh_continuation_table") #### [` guard_eh_continuation_table `]() property guard\_eh\_continuation\_table → int | None #### [` guard_flags `]() property guard\_flags → int | None Control Flow Guard related flags. #### [` guard_function_t `]() class guard\_function\_t Bases: `object` ##### [` extra `]() property extra → int ##### [` rva `]() property rva → int #### [` guard_long_jump_target_count `]() property guard\_long\_jump\_target\_count → int | None The count of unique RVAs in the table pointed by [`guard_long_jump_target_table`]( "lief.PE.LoadConfiguration.guard_long_jump_target_table"). #### [` guard_long_jump_target_table `]() property guard\_long\_jump\_target\_table → int | None The VA where Control Flow Guard long jump target table is stored. #### [` guard_long_jump_targets `]() property guard\_long\_jump\_targets → lief.PE.LoadConfiguration.it\_guard\_functions List of RVA pointed by [`guard_long_jump_target_table`]( "lief.PE.LoadConfiguration.guard_long_jump_target_table") #### [` guard_memcpy_function_pointer `]() property guard\_memcpy\_function\_pointer → int | None #### [` guard_rf_failure_routine `]() property guard\_rf\_failure\_routine → int | None VA of the failure routine #### [` guard_rf_failure_routine_function_pointer `]() property guard\_rf\_failure\_routine\_function\_pointer → int | None VA of the failure routine `fptr`. #### [` guard_rf_verify_stackpointer_function_pointer `]() property guard\_rf\_verify\_stackpointer\_function\_pointer → int | None VA of the Function verifying the stack pointer #### [` guard_xfg_check_function_pointer `]() property guard\_xfg\_check\_function\_pointer → int | None #### [` guard_xfg_dispatch_function_pointer `]() property guard\_xfg\_dispatch\_function\_pointer → int | None #### [` guard_xfg_table_dispatch_function_pointer `]() property guard\_xfg\_table\_dispatch\_function\_pointer → int | None #### [` has `]() has(*self*, *arg: [lief.\_lief.PE.LoadConfiguration.IMAGE\_GUARD]( "lief._lief.PE.LoadConfiguration.IMAGE_GUARD")*, */*) → bool Check if the given flag is present #### [` hotpatch_table_offset `]() property hotpatch\_table\_offset → int | None Offset to the *hotpatch* table #### [` hybrid_metadata_pointer `]() property hybrid\_metadata\_pointer → int | None Alias for [`chpe_metadata_pointer`]( "lief.PE.LoadConfiguration.chpe_metadata_pointer"). #### [` lock_prefix_table `]() property lock\_prefix\_table → int The VA of a list of addresses where the `LOCK` prefix is used. These will be replaced by `NOP` on single-processor systems. This member is available only for `x86`. #### [` major_version `]() property major\_version → int Major version #### [` maximum_allocation_size `]() property maximum\_allocation\_size → int The maximum allocation size, in bytes. This member is obsolete and is used only for debugging purposes. #### [` minor_version `]() property minor\_version → int Minor version #### [` process_affinity_mask `]() property process\_affinity\_mask → int The process affinity mask. For more information, see `GetProcessAffinityMask`. This member is available only for `.exe` files. #### [` process_heap_flags `]() property process\_heap\_flags → int The process heap flags. For more information, see `HeapCreate`. #### [` reserved1 `]() property reserved1 → int See: [`dependent_load_flags`]( "lief.PE.LoadConfiguration.dependent_load_flags") #### [` reserved2 `]() property reserved2 → int | None Must be 0 #### [` reserved3 `]() property reserved3 → int | None #### [` se_handler_count `]() property se\_handler\_count → int | None The count of unique handlers in the table. This member is available only for x86. #### [` se_handler_table `]() property se\_handler\_table → int | None The VA of the sorted table of RVAs of each valid, unique handler in the image. This member is available only for x86. #### [` security_cookie `]() property security\_cookie → int A pointer to a cookie that is used by Visual C++ or GS implementation. #### [` seh_functions `]() property seh\_functions → list[int] Return the list of the function RVA in the SEH table (if any) #### [` size `]() property size → int Size of the current structure #### [` timedatestamp `]() property timedatestamp → int The date and time stamp value #### [` uma_function_pointers `]() property uma\_function\_pointers → int | None #### [` virtual_memory_threshold `]() property virtual\_memory\_threshold → int The maximum block size that can be allocated from heap segments, in bytes. #### [` volatile_metadata `]() property volatile\_metadata → [lief.PE.VolatileMetadata]( "lief.PE.VolatileMetadata") | None #### [` volatile_metadata_pointer `]() property volatile\_metadata\_pointer → int | None --- ## [CHPEMetadata]() ![Inheritance diagram of lief._lief.PE.CHPEMetadata, lief._lief.PE.CHPEMetadataX86, lief._lief.PE.CHPEMetadataARM64](https://lief.re/doc/latest/_images/inheritance-7dbd6ebcce071b8fbb0282a4bb3cbd6d97573f8e.png) ### [` lief.PE.CHPEMetadata `]() class lief.PE.CHPEMetadata Bases: `object` Base class for any Compiled Hybrid Portable Executable (CHPE) metadata. This class is inherited by architecture-specific implementation. #### [` KIND `]() class KIND(*\*values*) Bases: `Enum` Discriminator for the subclasses ##### [` ARM64 `]() ARM64 = 1 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` X86 `]() X86 = 2 #### [` copy `]() copy(*self*) → [lief.\_lief.PE.CHPEMetadata]( "lief._lief.PE.CHPEMetadata") | None Duplicate the current instance of this object #### [` kind `]() property kind → [lief.PE.CHPEMetadata.KIND]( "lief.PE.CHPEMetadata.KIND") Determine the type of the concrete implementation #### [` version `]() property version → int Version of the structure --- ## [CHPEMetadata (ARM64)]() ![Inheritance diagram of lief._lief.PE.CHPEMetadataARM64](https://lief.re/doc/latest/_images/inheritance-e619027d09ee0cfabf2613b44f245186d5b2cfb1.png) ### [` lief.PE.CHPEMetadataARM64 `]() class lief.PE.CHPEMetadataARM64 Bases: [`CHPEMetadata`]( "lief._lief.PE.CHPEMetadata") This class represents ARM64-specific metadata used in CHPE (Compatible Hybrid PE) binaries, particularly for hybrid architectures like ARM64EC and ARM64X. It extends the [`CHPEMetadata`]( "lief.PE.CHPEMetadata") base class and provides access to metadata describing code ranges, redirections, entry points, and other hybrid-specific information relevant for binary analysis. #### [` alternate_entry_point `]() property alternate\_entry\_point → int #### [` auxiliary_delay_import `]() property auxiliary\_delay\_import → int #### [` auxiliary_delay_import_copy `]() property auxiliary\_delay\_import\_copy → int #### [` auxiliary_iat `]() property auxiliary\_iat → int #### [` auxiliary_iat_copy `]() property auxiliary\_iat\_copy → int #### [` bitfield_info `]() property bitfield\_info → int #### [` code_map `]() property code\_map → int #### [` code_map_count `]() property code\_map\_count → int #### [` code_range_entry_point `]() property code\_range\_entry\_point → lief.PE.CHPEMetadataARM64.it\_code\_range\_entry\_point #### [` code_range_entry_point_t `]() class code\_range\_entry\_point\_t Bases: `object` Mirror of IMAGE\_ARM64EC\_CODE\_RANGE\_ENTRY\_POINT: Represents a mapping between code range and its entry point. ##### [` end_rva `]() property end\_rva → int End of the code range (RVA). ##### [` entrypoint `]() property entrypoint → int RVA of the entry point for this range. ##### [` start_rva `]() property start\_rva → int Start of the code range. #### [` code_ranges `]() property code\_ranges → lief.PE.CHPEMetadataARM64.it\_range\_entries #### [` code_ranges_to_entry_points_count `]() property code\_ranges\_to\_entry\_points\_count → int #### [` code_ranges_to_entrypoints `]() property code\_ranges\_to\_entrypoints → int #### [` extra_rfe_table `]() property extra\_rfe\_table → int #### [` extra_rfe_table_size `]() property extra\_rfe\_table\_size → int #### [` get_x64_information_function_pointer `]() property get\_x64\_information\_function\_pointer → int #### [` os_arm64x_dispatch_call `]() property os\_arm64x\_dispatch\_call → int #### [` os_arm64x_dispatch_call_no_redirect `]() property os\_arm64x\_dispatch\_call\_no\_redirect → int #### [` os_arm64x_dispatch_fptr `]() property os\_arm64x\_dispatch\_fptr → int #### [` os_arm64x_dispatch_icall `]() property os\_arm64x\_dispatch\_icall → int #### [` os_arm64x_dispatch_icall_cfg `]() property os\_arm64x\_dispatch\_icall\_cfg → int #### [` os_arm64x_dispatch_ret `]() property os\_arm64x\_dispatch\_ret → int #### [` range_entry_t `]() class range\_entry\_t Bases: `object` Structure that describes architecture-specific ranges ##### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` ###### [` AMD64 `]() AMD64 = 2 ###### [` ARM64 `]() ARM64 = 0 ###### [` ARM64EC `]() ARM64EC = 1 ##### [` end `]() property end → int End of the range (RVA) ##### [` length `]() property length → int Range’s length ##### [` start `]() property start → int Start of the range (RVA) ##### [` start_offset `]() property start\_offset → int Raw data (includes start RVA and type) ##### [` type `]() property type → [lief.PE.CHPEMetadataARM64.range\_entry\_t.TYPE]( "lief.PE.CHPEMetadataARM64.range_entry_t.TYPE") Architecture for this range #### [` redirection_entry_t `]() class redirection\_entry\_t Bases: `object` Structure that describes a redirection ##### [` dst `]() property dst → int ##### [` src `]() property src → int #### [` redirection_metadata `]() property redirection\_metadata → int #### [` redirection_metadata_count `]() property redirection\_metadata\_count → int #### [` redirections `]() property redirections → lief.PE.CHPEMetadataARM64.it\_redirection\_entries #### [` set_x64_information_function_pointer `]() property set\_x64\_information\_function\_pointer → int ## [CHPEMetadata (X86)]() ![Inheritance diagram of lief._lief.PE.CHPEMetadataX86](https://lief.re/doc/latest/_images/inheritance-69c5c94a06f64ba854c16000b7e606af5b99537b.png) ### [` lief.PE.CHPEMetadataX86 `]() class lief.PE.CHPEMetadataX86 Bases: [`CHPEMetadata`]( "lief._lief.PE.CHPEMetadata") This class represents hybrid metadata for X86. #### [` chpe_code_address_range_count `]() property chpe\_code\_address\_range\_count → int #### [` chpe_code_address_range_offset `]() property chpe\_code\_address\_range\_offset → int #### [` compiler_iat_pointer `]() property compiler\_iat\_pointer → int | None #### [` wowa64_dispatch_call_function_pointer `]() property wowa64\_dispatch\_call\_function\_pointer → int #### [` wowa64_dispatch_indirect_call_cfg_function_pointer `]() property wowa64\_dispatch\_indirect\_call\_cfg\_function\_pointer → int #### [` wowa64_dispatch_indirect_call_function_pointer `]() property wowa64\_dispatch\_indirect\_call\_function\_pointer → int #### [` wowa64_dispatch_jump_function_pointer `]() property wowa64\_dispatch\_jump\_function\_pointer → int #### [` wowa64_dispatch_ret_function_pointer `]() property wowa64\_dispatch\_ret\_function\_pointer → int #### [` wowa64_dispatch_ret_leaf_function_pointer `]() property wowa64\_dispatch\_ret\_leaf\_function\_pointer → int #### [` wowa64_exception_handler_function_pointer `]() property wowa64\_exception\_handler\_function\_pointer → int #### [` wowa64_rdtsc_function_pointer `]() property wowa64\_rdtsc\_function\_pointer → int | None --- ## [DynamicRelocation]() ![Inheritance diagram of lief._lief.PE.DynamicRelocationV1, lief._lief.PE.DynamicRelocation, lief._lief.PE.DynamicRelocationV2](https://lief.re/doc/latest/_images/inheritance-8357f44e4cc25ea0ec9cb170066d01984720b7b3.png) ### [` lief.PE.DynamicRelocation `]() class lief.PE.DynamicRelocation Bases: `object` This is the base class for any `IMAGE_DYNAMIC_RELOCATION32`, `IMAGE_DYNAMIC_RELOCATION32_V2`, `IMAGE_DYNAMIC_RELOCATION64`, `IMAGE_DYNAMIC_RELOCATION64_V2` dynamic relocations. #### [` IMAGE_DYNAMIC_RELOCATION `]() class IMAGE\_DYNAMIC\_RELOCATION(*\*values*) Bases: `Enum` Special symbol values as defined in `link.exe - GetDVRTSpecialSymbolName` ##### [` RELOCATION_ARM64X `]() RELOCATION\_ARM64X = 6 ##### [` RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER `]() RELOCATION\_ARM64\_KERNEL\_IMPORT\_CALL\_TRANSFER = 8 ##### [` RELOCATION_FUNCTION_OVERRIDE `]() RELOCATION\_FUNCTION\_OVERRIDE = 7 ##### [` RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER `]() RELOCATION\_GUARD\_IMPORT\_CONTROL\_TRANSFER = 3 ##### [` RELOCATION_GUARD_INDIR_CONTROL_TRANSFER `]() RELOCATION\_GUARD\_INDIR\_CONTROL\_TRANSFER = 4 ##### [` RELOCATION_GUARD_RF_EPILOGUE `]() RELOCATION\_GUARD\_RF\_EPILOGUE = 2 ##### [` RELOCATION_GUARD_RF_PROLOGUE `]() RELOCATION\_GUARD\_RF\_PROLOGUE = 1 ##### [` RELOCATION_GUARD_SWITCHTABLE_BRANCH `]() RELOCATION\_GUARD\_SWITCHTABLE\_BRANCH = 5 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.DynamicRelocation.IMAGE\_DYNAMIC\_RELOCATION]( "lief.PE.DynamicRelocation.IMAGE_DYNAMIC_RELOCATION") = <nanobind.nb\_func object> #### [` copy `]() copy(*self*) → [lief.\_lief.PE.DynamicRelocation]( "lief._lief.PE.DynamicRelocation") | None Duplicate the current instance of this object #### [` fixups `]() property fixups → [lief.PE.DynamicFixup]( "lief.PE.DynamicFixup") | None Return fixups information, where the interpretation may depend on the symbol’s value #### [` symbol `]() property symbol → int Symbol address. Some values have a special meaning (c.f. [`IMAGE_DYNAMIC_RELOCATION`]( "lief.PE.DynamicRelocation.IMAGE_DYNAMIC_RELOCATION")) and define how fixups are encoded. #### [` version `]() property version → int Version of the structure ## [DynamicRelocationV1]() ![Inheritance diagram of lief._lief.PE.DynamicRelocationV1](https://lief.re/doc/latest/_images/inheritance-89cbcc8c24de64d687cb2754c13ee518ef489792.png) ### [` lief.PE.DynamicRelocationV1 `]() class lief.PE.DynamicRelocationV1 Bases: [`DynamicRelocation`]( "lief._lief.PE.DynamicRelocation") This class represents a dynamic relocation (`IMAGE_DYNAMIC_RELOCATION32` or `IMAGE_DYNAMIC_RELOCATION64`). ## [DynamicRelocationV2]() ![Inheritance diagram of lief._lief.PE.DynamicRelocationV2](https://lief.re/doc/latest/_images/inheritance-d1b5fa919e7330d2079d457d92ea5b012e5632ed.png) ### [` lief.PE.DynamicRelocationV2 `]() class lief.PE.DynamicRelocationV2 Bases: [`DynamicRelocation`]( "lief._lief.PE.DynamicRelocation") This class represents a dynamic relocation (`IMAGE_DYNAMIC_RELOCATION64_V2` or `IMAGE_DYNAMIC_RELOCATION32_V2`) --- ## [DynamicFixup]() ![Inheritance diagram of lief._lief.PE.FunctionOverride, lief._lief.PE.DynamicFixup, lief._lief.PE.DynamicFixupControlTransfer, lief._lief.PE.DynamicFixupARM64X, lief._lief.PE.DynamicFixupUnknown, lief._lief.PE.DynamicFixupARM64Kernel, lief._lief.PE.DynamicFixupGeneric](https://lief.re/doc/latest/_images/inheritance-f6123f716a39902b0b7a4c52b943736f12b1bfa6.png) ### [` lief.PE.DynamicFixup `]() class lief.PE.DynamicFixup Bases: `object` This is the base class for any fixups located in [`DynamicRelocation`]( "lief.PE.DynamicRelocation") #### [` KIND `]() class KIND(*\*values*) Bases: `Enum` ##### [` ARM64X `]() ARM64X = 2 ##### [` ARM64_KERNEL_IMPORT_CALL_TRANSFER `]() ARM64\_KERNEL\_IMPORT\_CALL\_TRANSFER = 4 ##### [` FUNCTION_OVERRIDE `]() FUNCTION\_OVERRIDE = 3 ##### [` GENERIC `]() GENERIC = 1 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.DynamicFixup.KIND]( "lief.PE.DynamicFixup.KIND") = <nanobind.nb\_func object> #### [` copy `]() copy(*self*) → [lief.\_lief.PE.DynamicFixup]( "lief._lief.PE.DynamicFixup") | None Duplicate the current instance of this object #### [` kind `]() property kind → [lief.PE.DynamicFixup.KIND]( "lief.PE.DynamicFixup.KIND") Encoding of the fixups ## [DynamicFixupControlTransfer]() ![Inheritance diagram of lief._lief.PE.DynamicFixupControlTransfer](https://lief.re/doc/latest/_images/inheritance-a19386df3dd4ce210dc0298114798cf0678e8cbb.png) ### [` lief.PE.DynamicFixupControlTransfer `]() class lief.PE.DynamicFixupControlTransfer Bases: [`DynamicFixup`]( "lief._lief.PE.DynamicFixup") This class wraps fixups associated with the (special) symbol value: `IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER (3)`. #### [` NO_IAT_INDEX `]() NO\_IAT\_INDEX = 32767 #### [` reloc_entry_t `]() class reloc\_entry\_t Bases: `object` Mirror IMAGE\_IMPORT\_CONTROL\_TRANSFER\_DYNAMIC\_RELOCATION ##### [` iat_index `]() property iat\_index → int IAT index of the corresponding import. `0x7FFF` is a special value indicating no index. ##### [` is_call `]() property is\_call → bool True if target instruction is a `call`, false otherwise ##### [` rva `]() property rva → int RVA to the instruction #### [` relocations `]() property relocations → lief.PE.DynamicFixupControlTransfer.it\_relocations Iterator over the relocations ## [DynamicFixupARM64Kernel]() ![Inheritance diagram of lief._lief.PE.DynamicFixupARM64Kernel](https://lief.re/doc/latest/_images/inheritance-19a4c466231f4f7b8fc2005617c508e59cf6aa08.png) ### [` lief.PE.DynamicFixupARM64Kernel `]() class lief.PE.DynamicFixupARM64Kernel Bases: [`DynamicFixup`]( "lief._lief.PE.DynamicFixup") This class wraps fixups associated with the (special) symbol value: `IMAGE_DYNAMIC_RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER (8)`. #### [` IMPORT_TYPE `]() class IMPORT\_TYPE(*\*values*) Bases: `Enum` ##### [` DELAYED `]() DELAYED = 1 ##### [` STATIC `]() STATIC = 0 #### [` NO_IAT_INDEX `]() NO\_IAT\_INDEX = 32767 #### [` reloc_entry_t `]() class reloc\_entry\_t Bases: `object` Mirror `IMAGE_IMPORT_CONTROL_TRANSFER_ARM64_RELOCATION` ##### [` iat_index `]() property iat\_index → int IAT index of the corresponding import. `0x7FFF` is a special value indicating no index. ##### [` import_type `]() property import\_type → [lief.PE.DynamicFixupARM64Kernel.IMPORT\_TYPE]( "lief.PE.DynamicFixupARM64Kernel.IMPORT_TYPE") See: [`IMPORT_TYPE`]( "lief.PE.DynamicFixupARM64Kernel.IMPORT_TYPE") ##### [` indirect_call `]() property indirect\_call → bool True if target instruction is a `blr`, false if it’s a `br`. ##### [` register_index `]() property register\_index → int Register index used for the indirect call/jump. For instance, if the instruction is `br x3`, this index is set to `3` ##### [` rva `]() property rva → int RVA to the call instruction #### [` relocations `]() property relocations → lief.PE.DynamicFixupARM64Kernel.it\_relocations Iterator over the relocations ## [DynamicFixupARM64X]() ![Inheritance diagram of lief._lief.PE.DynamicFixupARM64X](https://lief.re/doc/latest/_images/inheritance-925804b9f9696ad6f5aecd59645a406a5aa9525c.png) ### [` lief.PE.DynamicFixupARM64X `]() class lief.PE.DynamicFixupARM64X Bases: [`DynamicFixup`]( "lief._lief.PE.DynamicFixup") This class represents `IMAGE_DYNAMIC_RELOCATION_ARM64X` #### [` FIXUP_TYPE `]() class FIXUP\_TYPE(*\*values*) Bases: `Enum` ##### [` DELTA `]() DELTA = 2 ##### [` VALUE `]() VALUE = 1 ##### [` ZEROFILL `]() ZEROFILL = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.DynamicFixupARM64X.FIXUP\_TYPE]( "lief.PE.DynamicFixupARM64X.FIXUP_TYPE") = <nanobind.nb\_func object> #### [` reloc_entry_t `]() class reloc\_entry\_t Bases: `object` ##### [` raw_bytes `]() property raw\_bytes → list[int] If the type is class:~.FIXUP\_TYPE.VALUE, the bytes associated with the fixup. ##### [` rva `]() property rva → int RVA where the fixup takes place ##### [` size `]() property size → int Size of the value to patch ##### [` type `]() property type → [lief.PE.DynamicFixupARM64X.FIXUP\_TYPE]( "lief.PE.DynamicFixupARM64X.FIXUP_TYPE") Fixup’s kind ##### [` value `]() property value → int If the type is class:~.FIXUP\_TYPE.DELTA, the (signed) value #### [` relocations `]() property relocations → lief.PE.DynamicFixupARM64X.it\_relocations Iterator over the different fixup entries ## [DynamicFixupGeneric]() ![Inheritance diagram of lief._lief.PE.DynamicFixupGeneric](https://lief.re/doc/latest/_images/inheritance-5ddb4ff0999a1991c7671b8337a429fcdaf51bf6.png) ### [` lief.PE.DynamicFixupGeneric `]() class lief.PE.DynamicFixupGeneric Bases: [`DynamicFixup`]( "lief._lief.PE.DynamicFixup") This class represents a generic entry where the fixups are regular relocations ([`lief.PE.Relocation`]( "lief.PE.Relocation")) #### [` relocations `]() property relocations → lief.PE.DynamicFixupGeneric.it\_relocations Iterator over the relocations ## [DynamicFixupUnknown]() ![Inheritance diagram of lief._lief.PE.DynamicFixupUnknown](https://lief.re/doc/latest/_images/inheritance-c4a4895ab753ab3b8e742bc708b347ae062811bd.png) ### [` lief.PE.DynamicFixupUnknown `]() class lief.PE.DynamicFixupUnknown Bases: [`DynamicFixup`]( "lief._lief.PE.DynamicFixup") This class represents a special dynamic relocation where the format of the fixups is not supported by LIEF. #### [` payload `]() property payload → memoryview Raw fixups ## [FunctionOverride]() ![Inheritance diagram of lief._lief.PE.FunctionOverride](https://lief.re/doc/latest/_images/inheritance-d2bb6cf821159f887d14e027f3de02c16ee3b962.png) ### [` lief.PE.FunctionOverride `]() class lief.PE.FunctionOverride Bases: [`DynamicFixup`]( "lief._lief.PE.DynamicFixup") This class represents `IMAGE_DYNAMIC_RELOCATION_FUNCTION_OVERRIDE` #### [` bdd_info `]() property bdd\_info → lief.PE.FunctionOverride.it\_bdd\_info Iterator over the BDD info #### [` find_bdd_infofind_bdd_info `]() find\_bdd\_info(*self*, *arg: int*, */*) → [lief.\_lief.PE.FunctionOverride.image\_bdd\_info\_t]( "lief._lief.PE.FunctionOverride.image_bdd_info_t") | None **find\_bdd\_info(*self*, *arg: [lief.\_lief.PE.FunctionOverrideInfo]( "lief._lief.PE.FunctionOverrideInfo")*, */*) → [lief.\_lief.PE.FunctionOverride.image\_bdd\_info\_t]( "lief._lief.PE.FunctionOverride.image_bdd_info_t") | None** Overloaded function. 1. `find_bdd_info(self, arg: int, /) -> lief._lief.PE.FunctionOverride.image_bdd_info_t | None` Find the `IMAGE_BDD_INFO` at the given offset 2. `find_bdd_info(self, arg: lief._lief.PE.FunctionOverrideInfo, /) -> lief._lief.PE.FunctionOverride.image_bdd_info_t | None` Find the `IMAGE_BDD_INFO` associated with the given function override info #### [` func_overriding_info `]() property func\_overriding\_info → lief.PE.FunctionOverride.it\_func\_overriding\_info Iterator over the overriding info #### [` image_bdd_dynamic_relocation_t `]() class image\_bdd\_dynamic\_relocation\_t Bases: `object` Mirror `IMAGE_BDD_DYNAMIC_RELOCATION` ##### [` left `]() property left → int ##### [` right `]() property right → int ##### [` value `]() property value → int #### [` image_bdd_info_t `]() class image\_bdd\_info\_t Bases: `object` Mirror `IMAGE_BDD_INFO` ##### [` original_offset `]() property original\_offset → int ##### [` original_size `]() property original\_size → int ##### [` payload `]() property payload → list[int] ##### [` relocations `]() property relocations → list[[lief.PE.FunctionOverride.image\_bdd\_dynamic\_relocation\_t]( "lief.PE.FunctionOverride.image_bdd_dynamic_relocation_t")] ##### [` version `]() property version → int ## [FunctionOverrideInfo]() ### [` lief.PE.FunctionOverrideInfo `]() class lief.PE.FunctionOverrideInfo Bases: `object` #### [` base_reloc_size `]() property base\_reloc\_size → int Size in bytes taken by BaseRelocs #### [` bdd_offset `]() property bdd\_offset → int Offset into the BDD region #### [` functions_rva `]() property functions\_rva → list[int] #### [` original_rva `]() property original\_rva → int RVA of original function #### [` relocations `]() property relocations → lief.PE.DynamicFixupGeneric.it\_relocations #### [` rva_size `]() property rva\_size → int Size in bytes taken by RVAs --- ## [EnclaveConfiguration]() ### [` lief.PE.EnclaveConfiguration `]() class lief.PE.EnclaveConfiguration Bases: `object` This class represents the enclave configuration #### [` enclave_flags `]() property enclave\_flags → int A flag that indicates whether the image is suitable for use as the primary image in the enclave. #### [` enclave_size `]() property enclave\_size → int The expected virtual size of the private address range for the enclave, in bytes. #### [` family_id `]() property family\_id → list[int] The family identifier that the author of the enclave assigned to the enclave. #### [` image_id `]() property image\_id → list[int] The image identifier that the author of the enclave assigned to the enclave. #### [` image_version `]() property image\_version → int The version number that the author of the enclave assigned to the enclave. #### [` import_entry_size `]() property import\_entry\_size → int The size of each image in the array of images that the [`import_list_rva`]( "lief.PE.EnclaveConfiguration.import_list_rva") member points to. #### [` import_list_rva `]() property import\_list\_rva → int The RVA of the array of images that the enclave image may import, with identity information for each image. #### [` imports `]() property imports → lief.PE.EnclaveConfiguration.it\_imports Iterator over the enclave’s imports #### [` is_debuggable `]() property is\_debuggable → bool Whether this enclave can be debugged #### [` min_required_config_size `]() property min\_required\_config\_size → int The minimum size of the `IMAGE_ENCLAVE_CONFIG(32,64)` structure that the image loader must be able to process in order for the enclave to be usable. This member allows an enclave to inform an earlier version of the image loader that the image loader can safely load the enclave and ignore optional members added to `IMAGE_ENCLAVE_CONFIG(32,64)` for later versions of the enclave. If the size of `IMAGE_ENCLAVE_CONFIG(32,64)` that the image loader can process is less than `MinimumRequiredConfigSize`, the enclave cannot be run securely. If `MinimumRequiredConfigSize` is zero, the minimum size of the `IMAGE_ENCLAVE_CONFIG(32,64)` structure that the image loader must be able to process in order for the enclave to be usable is assumed to be the size of the structure through and including the `MinimumRequiredConfigSize` member. #### [` nb_imports `]() property nb\_imports → int The number of images in the array of images that the [`import_list_rva`]( "lief.PE.EnclaveConfiguration.import_list_rva") member points to. #### [` nb_threads `]() property nb\_threads → int The maximum number of threads that can be created within the enclave. #### [` policy_flags `]() property policy\_flags → int A flag that indicates whether the enclave permits debugging. #### [` security_version `]() property security\_version → int The security version number that the author of the enclave assigned to the enclave. #### [` size `]() property size → int The size of the `IMAGE_ENCLAVE_CONFIG64/IMAGE_ENCLAVE_CONFIG32` structure, in bytes. --- ## [EnclaveImport]() ### [` lief.PE.EnclaveImport `]() class lief.PE.EnclaveImport Bases: `object` Defines an entry in the array of images that an enclave can import. #### [` TYPE `]() class TYPE(*\*values*) Bases: `Enum` ##### [` AUTHOR_ID `]() AUTHOR\_ID = 2 ##### [` FAMILY_ID `]() FAMILY\_ID = 3 ##### [` IMAGE_ID `]() IMAGE\_ID = 4 ##### [` NONE `]() NONE = 0 ##### [` UNIQUE_ID `]() UNIQUE\_ID = 1 #### [` family_id `]() property family\_id → list[int] The family identifier of the primary module for the enclave. #### [` id `]() property id → list[int] The unique identifier of the primary module for the enclave, if the [`type`]( "lief.PE.EnclaveImport.type") is [`UNIQUE_ID`]( "lief.PE.EnclaveImport.TYPE.UNIQUE_ID"). Otherwise, the author identifier of the primary module for the enclave. #### [` image_id `]() property image\_id → list[int] The image identifier of the primary module for the enclave. #### [` import_name `]() property import\_name → str Resolved import name #### [` import_name_rva `]() property import\_name\_rva → int The relative virtual address of a NULL-terminated string that contains the same value found in the import directory for the image. #### [` min_security_version `]() property min\_security\_version → int The minimum enclave security version that each image must have for the image to be imported successfully. The image is rejected unless its enclave security version is equal to or greater than the minimum value in the import record. Set the value in the import record to zero to turn off the security version check. #### [` reserved `]() property reserved → int Reserved. Should be 0 #### [` type `]() property type → [lief.PE.EnclaveImport.TYPE]( "lief.PE.EnclaveImport.TYPE") The type of identifier of the image that must match the value in the import record. --- ## [Volatile Metadata]() ### [` lief.PE.VolatileMetadata `]() class lief.PE.VolatileMetadata Bases: `object` This class represents volatile metadata which can be enabled at link time with `/volatileMetadata`. This metadata aims to improve performances when running x64 code on ARM64. #### [` access_table `]() property access\_table → list[int] #### [` access_table_rva `]() property access\_table\_rva → int #### [` access_table_size `]() property access\_table\_size → int #### [` info_range_rva `]() property info\_range\_rva → int #### [` info_ranges `]() property info\_ranges → lief.PE.VolatileMetadata.it\_info\_ranges\_t #### [` info_ranges_size `]() property info\_ranges\_size → int #### [` max_version `]() property max\_version → int #### [` min_version `]() property min\_version → int #### [` range_t `]() class range\_t Bases: `object` ##### [` end `]() property end → int ##### [` size `]() property size → int ##### [` start `]() property start → int #### [` size `]() property size → int --- ## [Utilities]() ### [` lief.PE.check_layout `]() lief.PE.check\_layout(*binary: [lief.PE.Binary]( "lief.PE.Binary")*) → tuple[bool, str] Check that the layout of the given binary is correct from the Windows loader perspective. ### [` lief.is_pelief.is_pe `]() lief.is\_pe(*\*args*) → bool **lief.is\_pe(*raw: collections.abc.Sequence[int]*) → bool** Overloaded function. 1. `is_pe(file: Union[str | os.PathLike]) -> bool` Check if the given file is a `PE` 2. `is_pe(raw: collections.abc.Sequence[int]) -> bool` Check if the given raw data is a `PE` ### [` lief.PE.get_typelief.PE.get_type `]() lief.PE.get\_type(*\*args*) → [lief.PE.PE\_TYPE]( "lief.PE.PE_TYPE") | [lief.lief\_errors]( "lief.lief_errors") **lief.PE.get\_type(*raw: collections.abc.Sequence[int]*) → [lief.\_lief.PE.PE\_TYPE]( "lief._lief.PE.PE_TYPE") | [lief.\_lief.lief\_errors]( "lief._lief.lief_errors")** Overloaded function. 1. `get_type(file: Union[str | os.PathLike]) -> Union[lief._lief.PE.PE_TYPE, lief._lief.lief_errors]` > If the input file is a valid `PE`, return the [`PE_TYPE`]( "lief.PE.PE_TYPE"). Otherwise, return a [`lief.lief_errors`]( "lief.lief_errors"). 2. `get_type(raw: collections.abc.Sequence[int]) -> Union[lief._lief.PE.PE_TYPE, lief._lief.lief_errors]` ### [` lief.PE.get_imphash `]() lief.PE.get\_imphash(*binary: [lief.PE.Binary]( "lief.PE.Binary")*, *mode: [lief.PE.IMPHASH\_MODE]( "lief.PE.IMPHASH_MODE")*) → str Compute the hash of imported functions Properties of the hash generated: > - Order agnostic > - Case agnostic > - Ordinal (**in some extent**) agnostic If one needs the same output as Virus Total (i.e. pefile), you can use [`PEFILE`]( "lief.PE.IMPHASH_MODE.PEFILE") as second parameter. > **Warning** > > The algorithm used to compute the *imphash* value has some variations compared to Yara, pefile, VT implementation > **See also** > > [https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html]() ### [` lief.PE.IMPHASH_MODE `]() class lief.PE.IMPHASH\_MODE(*\*values*) Bases: `Enum` Enum to define the behavior of [`get_imphash()`]( "lief.PE.get_imphash") #### [` DEFAULT `]() DEFAULT = 0 #### [` LIEF `]() LIEF = 0 #### [` PEFILE `]() PEFILE = 1 #### [` VT `]() VT = 1 ### [` lief.PE.resolve_ordinals `]() lief.PE.resolve\_ordinals(*imp: [lief.PE.Import]( "lief.PE.Import")*, *strict: bool*, *use\_std: bool*) → [lief.PE.Import]( "lief.PE.Import") | [lief.lief\_errors]( "lief.lief_errors") Take a [`Import`]( "lief.PE.Import") as input and try to resolve its ordinal imports. If the `strict` boolean parameter is set, a [`lief.lief_errors.not_found`]( "lief.lief_errors.not_found") error is returned upon the first non-resolvable ordinal. --- ## [Enums]() ### [PE\_TYPE]() #### [` lief.PE.PE_TYPE `]() class lief.PE.PE\_TYPE(*\*values*) Bases: `Enum` ##### [` PE32 `]() PE32 = 267 ##### [` PE32_PLUS `]() PE32\_PLUS = 523 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.PE\_TYPE]( "lief.PE.PE_TYPE") = <nanobind.nb\_func object> --- ### [RESOURCE\_LANGS]() #### [` lief.PE.RESOURCE_LANGS `]() class lief.PE.RESOURCE\_LANGS(*\*values*) Bases: `Enum` ##### [` AFRIKAANS `]() AFRIKAANS = 54 ##### [` ALBANIAN `]() ALBANIAN = 28 ##### [` ARABIC `]() ARABIC = 1 ##### [` ARMENIAN `]() ARMENIAN = 43 ##### [` ASSAMESE `]() ASSAMESE = 77 ##### [` AZERI `]() AZERI = 44 ##### [` BANGLA `]() BANGLA = 69 ##### [` BASQUE `]() BASQUE = 45 ##### [` BELARUSIAN `]() BELARUSIAN = 35 ##### [` BOSNIAN `]() BOSNIAN = 26 ##### [` BRETON `]() BRETON = 147 ##### [` BULGARIAN `]() BULGARIAN = 2 ##### [` CATALAN `]() CATALAN = 3 ##### [` CHINESE `]() CHINESE = 4 ##### [` CORNISH `]() CORNISH = 145 ##### [` CROATIAN `]() CROATIAN = 26 ##### [` CZECH `]() CZECH = 5 ##### [` DANISH `]() DANISH = 6 ##### [` DIVEHI `]() DIVEHI = 101 ##### [` DUTCH `]() DUTCH = 19 ##### [` ENGLISH `]() ENGLISH = 9 ##### [` ESPERANTO `]() ESPERANTO = 143 ##### [` ESTONIAN `]() ESTONIAN = 37 ##### [` FAEROESE `]() FAEROESE = 56 ##### [` FARSI `]() FARSI = 41 ##### [` FINNISH `]() FINNISH = 11 ##### [` FRENCH `]() FRENCH = 12 ##### [` GAELIC `]() GAELIC = 60 ##### [` GALICIAN `]() GALICIAN = 86 ##### [` GEORGIAN `]() GEORGIAN = 55 ##### [` GERMAN `]() GERMAN = 7 ##### [` GREEK `]() GREEK = 8 ##### [` GUJARATI `]() GUJARATI = 71 ##### [` HEBREW `]() HEBREW = 13 ##### [` HINDI `]() HINDI = 57 ##### [` HUNGARIAN `]() HUNGARIAN = 14 ##### [` ICELANDIC `]() ICELANDIC = 15 ##### [` INDONESIAN `]() INDONESIAN = 33 ##### [` INUKTITUT `]() INUKTITUT = 93 ##### [` INVARIANT `]() INVARIANT = 127 ##### [` IRISH `]() IRISH = 60 ##### [` ITALIAN `]() ITALIAN = 16 ##### [` JAPANESE `]() JAPANESE = 17 ##### [` KANNADA `]() KANNADA = 75 ##### [` KASHMIRI `]() KASHMIRI = 96 ##### [` KAZAK `]() KAZAK = 63 ##### [` KONKANI `]() KONKANI = 87 ##### [` KOREAN `]() KOREAN = 18 ##### [` KYRGYZ `]() KYRGYZ = 64 ##### [` LATVIAN `]() LATVIAN = 38 ##### [` LITHUANIAN `]() LITHUANIAN = 39 ##### [` LOWER_SORBIAN `]() LOWER\_SORBIAN = 46 ##### [` MACEDONIAN `]() MACEDONIAN = 47 ##### [` MALAY `]() MALAY = 62 ##### [` MALAYALAM `]() MALAYALAM = 76 ##### [` MALTESE `]() MALTESE = 58 ##### [` MANIPURI `]() MANIPURI = 88 ##### [` MAORI `]() MAORI = 40 ##### [` MARATHI `]() MARATHI = 78 ##### [` MONGOLIAN `]() MONGOLIAN = 80 ##### [` NEPALI `]() NEPALI = 97 ##### [` NEUTRAL `]() NEUTRAL = 0 ##### [` NORWEGIAN `]() NORWEGIAN = 20 ##### [` ORIYA `]() ORIYA = 72 ##### [` POLISH `]() POLISH = 21 ##### [` PORTUGUESE `]() PORTUGUESE = 22 ##### [` PULAR `]() PULAR = 103 ##### [` PUNJABI `]() PUNJABI = 70 ##### [` QUECHUA `]() QUECHUA = 107 ##### [` RHAETO_ROMANCE `]() RHAETO\_ROMANCE = 23 ##### [` ROMANIAN `]() ROMANIAN = 24 ##### [` RUSSIAN `]() RUSSIAN = 25 ##### [` SAMI `]() SAMI = 59 ##### [` SANSKRIT `]() SANSKRIT = 79 ##### [` SERBIAN `]() SERBIAN = 26 ##### [` SINDHI `]() SINDHI = 89 ##### [` SLOVAK `]() SLOVAK = 27 ##### [` SLOVENIAN `]() SLOVENIAN = 36 ##### [` SORBIAN `]() SORBIAN = 46 ##### [` SPANISH `]() SPANISH = 10 ##### [` SUTU `]() SUTU = 48 ##### [` SWAHILI `]() SWAHILI = 65 ##### [` SWEDISH `]() SWEDISH = 29 ##### [` SYRIAC `]() SYRIAC = 90 ##### [` TAMAZIGHT `]() TAMAZIGHT = 95 ##### [` TAMIL `]() TAMIL = 73 ##### [` TATAR `]() TATAR = 68 ##### [` TELUGU `]() TELUGU = 74 ##### [` THAI `]() THAI = 30 ##### [` TIGRINYA `]() TIGRINYA = 115 ##### [` TSONGA `]() TSONGA = 49 ##### [` TSWANA `]() TSWANA = 50 ##### [` TURKISH `]() TURKISH = 31 ##### [` UKRAINIAN `]() UKRAINIAN = 34 ##### [` URDU `]() URDU = 32 ##### [` UZBEK `]() UZBEK = 67 ##### [` VALENCIAN `]() VALENCIAN = 3 ##### [` VENDA `]() VENDA = 51 ##### [` VIETNAMESE `]() VIETNAMESE = 42 ##### [` WALON `]() WALON = 144 ##### [` WELSH `]() WELSH = 146 ##### [` XHOSA `]() XHOSA = 52 ##### [` ZULU `]() ZULU = 53 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.RESOURCE\_LANGS]( "lief.PE.RESOURCE_LANGS") = <nanobind.nb\_func object> ### [ACCELERATOR\_CODES]() #### [` lief.PE.ACCELERATOR_CODES `]() class lief.PE.ACCELERATOR\_CODES(*\*values*) Bases: `Enum` ##### [` A `]() A = 65 ##### [` ACCEPT `]() ACCEPT = 30 ##### [` ADD `]() ADD = 107 ##### [` APPS `]() APPS = 93 ##### [` ATTN `]() ATTN = 246 ##### [` B `]() B = 66 ##### [` BACK `]() BACK = 8 ##### [` BROWSER_BACK `]() BROWSER\_BACK = 166 ##### [` BROWSER_FAVORITES `]() BROWSER\_FAVORITES = 171 ##### [` BROWSER_FORWARD `]() BROWSER\_FORWARD = 167 ##### [` BROWSER_HOME `]() BROWSER\_HOME = 172 ##### [` BROWSER_REFRESH `]() BROWSER\_REFRESH = 168 ##### [` BROWSER_SEARCH `]() BROWSER\_SEARCH = 170 ##### [` BROWSER_STOP `]() BROWSER\_STOP = 169 ##### [` C `]() C = 67 ##### [` CANCEL `]() CANCEL = 3 ##### [` CAPITAL `]() CAPITAL = 20 ##### [` CLEAR `]() CLEAR = 12 ##### [` CONTROL `]() CONTROL = 17 ##### [` CONVERT `]() CONVERT = 28 ##### [` CRSEL `]() CRSEL = 247 ##### [` D `]() D = 68 ##### [` DECIMAL `]() DECIMAL = 110 ##### [` DELETE_K `]() DELETE\_K = 46 ##### [` DIVIDE `]() DIVIDE = 111 ##### [` DOWN `]() DOWN = 40 ##### [` E `]() E = 69 ##### [` END `]() END = 35 ##### [` EREOF `]() EREOF = 249 ##### [` ESCAPE `]() ESCAPE = 27 ##### [` EXECUTE `]() EXECUTE = 43 ##### [` EXSEL `]() EXSEL = 248 ##### [` F `]() F = 70 ##### [` F1 `]() F1 = 112 ##### [` F10 `]() F10 = 121 ##### [` F11 `]() F11 = 122 ##### [` F12 `]() F12 = 123 ##### [` F13 `]() F13 = 124 ##### [` F14 `]() F14 = 125 ##### [` F15 `]() F15 = 126 ##### [` F16 `]() F16 = 127 ##### [` F17 `]() F17 = 128 ##### [` F18 `]() F18 = 129 ##### [` F19 `]() F19 = 130 ##### [` F2 `]() F2 = 113 ##### [` F20 `]() F20 = 131 ##### [` F21 `]() F21 = 132 ##### [` F22 `]() F22 = 133 ##### [` F23 `]() F23 = 134 ##### [` F24 `]() F24 = 135 ##### [` F3 `]() F3 = 114 ##### [` F4 `]() F4 = 115 ##### [` F5 `]() F5 = 116 ##### [` F6 `]() F6 = 117 ##### [` F7 `]() F7 = 118 ##### [` F8 `]() F8 = 119 ##### [` F9 `]() F9 = 120 ##### [` FINAL `]() FINAL = 24 ##### [` G `]() G = 71 ##### [` H `]() H = 72 ##### [` HELP `]() HELP = 47 ##### [` HOME `]() HOME = 36 ##### [` I `]() I = 73 ##### [` IME_OFF `]() IME\_OFF = 26 ##### [` IME_ON `]() IME\_ON = 22 ##### [` INSERT `]() INSERT = 45 ##### [` J `]() J = 74 ##### [` JUNJA `]() JUNJA = 23 ##### [` K `]() K = 75 ##### [` KANA `]() KANA = 21 ##### [` KANJI `]() KANJI = 25 ##### [` L `]() L = 76 ##### [` LAUNCH_APP1 `]() LAUNCH\_APP1 = 182 ##### [` LAUNCH_APP2 `]() LAUNCH\_APP2 = 183 ##### [` LAUNCH_MAIL `]() LAUNCH\_MAIL = 180 ##### [` LAUNCH_MEDIA_SELECT `]() LAUNCH\_MEDIA\_SELECT = 181 ##### [` LBUTTON `]() LBUTTON = 1 ##### [` LCONTROL `]() LCONTROL = 162 ##### [` LEFT `]() LEFT = 37 ##### [` LMENU `]() LMENU = 164 ##### [` LSHIFT `]() LSHIFT = 160 ##### [` LWIN `]() LWIN = 91 ##### [` M `]() M = 77 ##### [` MBUTTON `]() MBUTTON = 4 ##### [` MEDIA_NEXT_TRACK `]() MEDIA\_NEXT\_TRACK = 176 ##### [` MEDIA_PLAY_PAUSE `]() MEDIA\_PLAY\_PAUSE = 179 ##### [` MEDIA_PREV_TRACK `]() MEDIA\_PREV\_TRACK = 177 ##### [` MEDIA_STOP `]() MEDIA\_STOP = 178 ##### [` MENU `]() MENU = 18 ##### [` MODECHANGE `]() MODECHANGE = 31 ##### [` MULTIPLY `]() MULTIPLY = 106 ##### [` N `]() N = 78 ##### [` NEXT `]() NEXT = 34 ##### [` NONAME `]() NONAME = 252 ##### [` NONCONVERT `]() NONCONVERT = 29 ##### [` NUMLOCK `]() NUMLOCK = 144 ##### [` NUMPAD0 `]() NUMPAD0 = 96 ##### [` NUMPAD1 `]() NUMPAD1 = 97 ##### [` NUMPAD2 `]() NUMPAD2 = 98 ##### [` NUMPAD3 `]() NUMPAD3 = 99 ##### [` NUMPAD4 `]() NUMPAD4 = 100 ##### [` NUMPAD5 `]() NUMPAD5 = 101 ##### [` NUMPAD6 `]() NUMPAD6 = 102 ##### [` NUMPAD7 `]() NUMPAD7 = 103 ##### [` NUMPAD8 `]() NUMPAD8 = 104 ##### [` NUMPAD9 `]() NUMPAD9 = 105 ##### [` NUM_0 `]() NUM\_0 = 48 ##### [` NUM_1 `]() NUM\_1 = 49 ##### [` NUM_2 `]() NUM\_2 = 50 ##### [` NUM_3 `]() NUM\_3 = 51 ##### [` NUM_4 `]() NUM\_4 = 52 ##### [` NUM_5 `]() NUM\_5 = 53 ##### [` NUM_6 `]() NUM\_6 = 54 ##### [` NUM_7 `]() NUM\_7 = 55 ##### [` NUM_8 `]() NUM\_8 = 56 ##### [` NUM_9 `]() NUM\_9 = 57 ##### [` O `]() O = 79 ##### [` OEM_1 `]() OEM\_1 = 186 ##### [` OEM_102 `]() OEM\_102 = 226 ##### [` OEM_2 `]() OEM\_2 = 191 ##### [` OEM_4 `]() OEM\_4 = 219 ##### [` OEM_5 `]() OEM\_5 = 220 ##### [` OEM_6 `]() OEM\_6 = 221 ##### [` OEM_7 `]() OEM\_7 = 222 ##### [` OEM_8 `]() OEM\_8 = 223 ##### [` OEM_CLEAR `]() OEM\_CLEAR = 254 ##### [` OEM_COMMA `]() OEM\_COMMA = 188 ##### [` OEM_MINUS `]() OEM\_MINUS = 189 ##### [` OEM_PERIOD `]() OEM\_PERIOD = 190 ##### [` OEM_PLUS `]() OEM\_PLUS = 187 ##### [` P `]() P = 80 ##### [` PA1 `]() PA1 = 253 ##### [` PACKET `]() PACKET = 231 ##### [` PAUSE `]() PAUSE = 19 ##### [` PLAY `]() PLAY = 250 ##### [` PRINT `]() PRINT = 42 ##### [` PRIOR `]() PRIOR = 33 ##### [` PROCESSKEY `]() PROCESSKEY = 229 ##### [` Q `]() Q = 81 ##### [` R `]() R = 82 ##### [` RBUTTON `]() RBUTTON = 2 ##### [` RCONTROL `]() RCONTROL = 163 ##### [` RETURN `]() RETURN = 13 ##### [` RIGHT `]() RIGHT = 39 ##### [` RMENU `]() RMENU = 165 ##### [` RSHIFT `]() RSHIFT = 161 ##### [` RWIN `]() RWIN = 92 ##### [` S `]() S = 83 ##### [` SCROLL `]() SCROLL = 145 ##### [` SELECT `]() SELECT = 41 ##### [` SEPARATOR `]() SEPARATOR = 108 ##### [` SHIFT `]() SHIFT = 16 ##### [` SLEEP `]() SLEEP = 95 ##### [` SNAPSHOT `]() SNAPSHOT = 44 ##### [` SPACE `]() SPACE = 32 ##### [` SUBTRACT `]() SUBTRACT = 109 ##### [` T `]() T = 84 ##### [` TAB `]() TAB = 9 ##### [` U `]() U = 85 ##### [` UP `]() UP = 38 ##### [` V `]() V = 86 ##### [` VOLUME_DOWN `]() VOLUME\_DOWN = 174 ##### [` VOLUME_MUTE `]() VOLUME\_MUTE = 173 ##### [` VOLUME_UP `]() VOLUME\_UP = 175 ##### [` W `]() W = 87 ##### [` X `]() X = 88 ##### [` XBUTTON1_K `]() XBUTTON1\_K = 5 ##### [` XBUTTON2_K `]() XBUTTON2\_K = 6 ##### [` Y `]() Y = 89 ##### [` Z `]() Z = 90 ##### [` ZOOM `]() ZOOM = 251 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.ACCELERATOR\_CODES]( "lief.PE.ACCELERATOR_CODES") = <nanobind.nb\_func object> --- ### [ALGORITHMS]() #### [` lief.PE.ALGORITHMS `]() class lief.PE.ALGORITHMS(*\*values*) Bases: `Enum` ##### [` EC `]() EC = 9 ##### [` MD2 `]() MD2 = 7 ##### [` MD4 `]() MD4 = 6 ##### [` MD5 `]() MD5 = 5 ##### [` MD5_RSA `]() MD5\_RSA = 10 ##### [` RSA `]() RSA = 8 ##### [` SHA1_DSA `]() SHA1\_DSA = 11 ##### [` SHA1_ECDSA `]() SHA1\_ECDSA = 16 ##### [` SHA1_RSA `]() SHA1\_RSA = 12 ##### [` SHA_1 `]() SHA\_1 = 4 ##### [` SHA_256 `]() SHA\_256 = 3 ##### [` SHA_256_ECDSA `]() SHA\_256\_ECDSA = 17 ##### [` SHA_256_RSA `]() SHA\_256\_RSA = 13 ##### [` SHA_384 `]() SHA\_384 = 2 ##### [` SHA_384_ECDSA `]() SHA\_384\_ECDSA = 18 ##### [` SHA_384_RSA `]() SHA\_384\_RSA = 14 ##### [` SHA_512 `]() SHA\_512 = 1 ##### [` SHA_512_ECDSA `]() SHA\_512\_ECDSA = 19 ##### [` SHA_512_RSA `]() SHA\_512\_RSA = 15 ##### [` UNKNOWN `]() UNKNOWN = 0 ##### [` from_value `]() from\_value(*arg: int*) → [lief.PE.ALGORITHMS]( "lief.PE.ALGORITHMS") = <nanobind.nb\_func object> --- documentID: "b2a4d0035b479928c014eb6f65106306b8ad260eaea64c7e38b3f0d805f190d2" docname: "formats/pe/rust" title: "PE Rust API - LIEF Documentation" description: "PE Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/pe/rust.html" markdownURL: "https://lief.re/doc/latest/formats/pe/rust.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "6b3331b1c71f872997248972064e1c1c9611b2509c791a65ce6e265854da3131" --- # [Rust]() > **Note** > > Please check: [`lief::pe`]() --- documentID: "7665567d92c0fa54e62a140e760be87689b8323be197404993d0e0842b189fb0" docname: "index" title: "LIEF Documentation - ELF, PE, Mach-O and Binary Analysis" description: "LIEF documentation for parsing, inspecting, modifying, and writing ELF, PE, Mach-O, COFF, Android, and other executable formats in C++, Python, and Rust." canonical: "https://lief.re/doc/latest/index.html" markdownURL: "https://lief.re/doc/latest/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "48733290a518de52f42f74825c54090fdb51e3490843543570a40bea11ceaff5" --- # [LIEF Documentation]() LIEF is a cross-platform library for parsing, inspecting, modifying, and writing executable formats. Explore guides, tutorials, and API references for ELF, PE, Mach-O, COFF, Android formats, and more in C++, Python, and Rust. - [Introduction]() - [Extended Version]() - [Runtime]() - [Additional Documentation]() - [Installation and Integration]() - [SDK]() - [Python]() - [Rust]() - [CMake Integration]() - [Visual Studio Integration]() - [Xcode Integration]() - [Compilation]() - [Libraries only (SDK)]() - [Python bindings]() - [Runtime features]() - [Debugging]() - [Third Party]() - [Continuous Integration]() - [CMake Options]() - [Docker]() Formats - [ELF]() - [C++]() - [Python]() - [Rust]() - [Introduction]() - [Adding a Section/Segment]() - [Dump Analysis]() - [Advanced Parsing/Writing]() - [DWARF Support]() - [R[UN]PATH Modification]() - [Symbol Versions]() - [Mach-O]() - [C++]() - [Python]() - [Rust]() - [Introduction]() - [Advanced Parsing/Writing]() - [Dump Analysis]() - [RPath and Library Path Modification]() - [Objective-C Support]() - [PE]() - [C++]() - [Python]() - [Rust]() - [Imports Modification]() - [Resources Modification]() - [TLS Modification]() - [Debug Modification]() - [Exports Modification]() - [Introduction]() - [Dump Analysis]() - [Advanced Parsing/Writing]() - [PDB Support]() - [Authenticode]() - [COFF]() - [C++]() - [Python]() - [Rust]() - [Introduction]() - [Disassembler]() - [Android]() - [OAT]() - [DEX]() - [VDEX]() - [ART]() API - [Binary Abstraction]() - [Utilities]() - [Error Handling]() - [Logging]() - [C++]() - [Rust]() - [Runtime]() LIEF Extended - [What is LIEF Extended?]() - [Debug Information]() - [DWARF]() - [PDB]() - [Objective-C]() - [Dyld Shared Cache]() - [Disassembler]() - [Assembler]() Plugins - [Ghidra]() - [BinaryNinja]() Tools - [lief-patchelf]() Tutorials - [01 - Parse and manipulate formats]() - [02 - Create a PE from scratch (Deprecated)]() - [03 - Play with ELF symbols]() - [04 - ELF Hooking]() - [05 - Infecting the PLT/GOT]() - [06 - PE Hooking (Deprecated)]() - [07 - PE Resources]() - [08 - Transforming an ELF executable into a library]() - [09 - How to use Frida on a non-rooted device]() - [10 - Android formats]() - [11 - Mach-O Modification]() - [12 - ELF Coredump]() - [13 - PE Authenticode]() Extra Information - [References]() - [Changelog]() --- documentID: "86544ce82684f44ba6e1c8119634564567ff4f85efd32dda021ce908c47c3255" docname: "installation" title: "Installation and Integration - LIEF Documentation" description: "Installation and Integration. For each platform supported by LIEF, the SDK packages contain:" canonical: "https://lief.re/doc/latest/installation.html" markdownURL: "https://lief.re/doc/latest/installation.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "b190788e5af25621e1814ba41b6a198a2025e3dd3fc0e358aeeb507a3288f401" --- # [Installation and Integration]() ## [SDK]() For each platform supported by LIEF, the SDK packages contain: - static and shared libraries - headers - compiled examples Nightly builds can be downloaded at: [https://lief.s3-website.fr-par.scw.cloud/latest/sdk](), while official releases are available on the GitHub releases page: [https://github.com/lief-project/LIEF/releases](). ## [Python]() Nightly Python wheels are uploaded to an S3 bucket for **each commit** on the main branch. They can be installed using: ```console $ pip install [--user] --index-url https://lief.s3-website.fr-par.scw.cloud/latest lief ``` For tagged releases, the wheels are uploaded to PyPI and can be installed using: ```console $ pip install lief ``` You can also compile and install from source as follows: ```console $ git clone https://github.com/lief-project/LIEF $ pip install LIEF/api/python # Or pip+git: $ pip install git+https://github.com/lief-project/LIEF.git#subdirectory=api/python ``` For more details about the compilation options, see the [Compilation]() section. ## [Rust]() You can add LIEF as a dependency in a Rust project as follows: ```toml # For nightly build [dependencies] lief = { git = "https://github.com/lief-project/LIEF", branch = "main" } # For a tagged release [dependencies] lief = "1.0.0" ``` You can find more details in the [Rust API section](). ## [CMake Integration]() There are several ways to integrate LIEF as a dependency into another project. The following methods are listed in order of preference according to CMake best practices. These snippets show basic examples; please refer to the official CMake documentation for questions related to more complex project setups. ### [find\_package()]() Using [CMake find\_package()](): ```cmake # Use LIEF with 'find_package()' # ============================== # Find LIEF. If LIEF was not installed into a default system directory then # specify the following option during CMake configuration: # -DLIEF_DIR=/share/LIEF/cmake find_package(LIEF REQUIRED COMPONENTS STATIC) # COMPONENTS: - Default: STATIC ``` To integrate this within a project: ```cmake # Add our executable # ================== add_executable(HelloLIEF main.cpp) # Enable C++11 set_property(TARGET HelloLIEF PROPERTY CXX_STANDARD 17 PROPERTY CXX_STANDARD_REQUIRED ON) # Link the executable with LIEF target_link_libraries(HelloLIEF PRIVATE LIEF::LIEF) ``` For the compilation: ```console $ mkdir build $ cd build $ cmake -DLIEF_DIR=/lib/cmake/LIEF/ .. $ make $ HelloLIEF /bin/ls # or explorer.exe or whatever ``` A *full* example is available in the `examples/cmake/find_package` directory. ### [add\_subdirectory() or FetchContent]() First, configure the options you want to use as defaults for the LIEF project: ```cmake # LIEF build config. Set the default options for LIEF's project setup option(LIEF_DOC "Build LIEF docs" OFF) option(LIEF_PYTHON_API "Build LIEF Python API" OFF) option(LIEF_EXAMPLES "Build LIEF examples" OFF) option(LIEF_TESTS "Build LIEF tests" OFF) if(MSVC) set(CMAKE_MSVC_RUNTIME_LIBRARY "MultiThreaded" CACHE STRING "CRT option") endif() # If you have LIEF as a submodule in a directory, then you can add it to this ``` Using [CMake add\_subdirectory()]() to add LIEF as a submodule from a source directory: ```cmake # NOTE: This submodule does not exist for this example, but it does the same # thing as FetchContent without the download part set(vendorLIEF_submodule_dir "${CMAKE_CURRENT_LIST_DIR}/LIEF") if(EXISTS "${vendorLIEF_submodule_dir}") add_subdirectory("${vendorLIEF_submodule_dir}") # Else, we'll specify how to obtain LIEF another way (downloading) else() ``` You can also use the [CMake FetchContent module]() to download or specify a LIEF source directory outside the current directory: ```cmake # URL of the LIEF repo (Can be your fork) set(LIEF_GIT_URL "https://github.com/lief-project/LIEF.git") # LIEF's version to be used (can be 'main') set(LIEF_VERSION 1.0.0) include(FetchContent) FetchContent_Declare(LIEF GIT_REPOSITORY "${LIEF_GIT_URL}" GIT_TAG ${LIEF_VERSION} # You may specify an existing LIEF source directory if you don't want to # download. Just comment out the above ``GIT_*`` commands and uncoment the # following ``SOURCE_DIR`` line #SOURCE_DIR "${CMAKE_CURRENT_LIST_DIR}/../../.." ) if(${CMAKE_VERSION} VERSION_LESS "3.14.0") # CMake 3.11 to 3.13 needs more verbose method to make LIEF available FetchContent_GetProperties(LIEF) if(NOT LIEF_POPULATED) FetchContent_Populate(LIEF) add_subdirectory(${LIEF_SOURCE_DIR} ${LIEF_BINARY_DIR}) endif() else() # CMake 3.14+ has single function to make LIEF available (recommended) FetchContent_MakeAvailable(LIEF) endif() endif() ``` To integrate this within a project: ```cmake add_executable(HelloLIEF main.cpp) # Enable C++11 set_property(TARGET HelloLIEF PROPERTY CXX_STANDARD 17 PROPERTY CXX_STANDARD_REQUIRED ON) # Link the executable with LIEF target_link_libraries(HelloLIEF PUBLIC LIEF::LIEF) ``` For the compilation: ```console $ mkdir build $ cd build $ cmake .. $ make $ HelloLIEF /bin/ls # or explorer.exe or whatever ``` A *full* example is available in the `examples/cmake/add_subdirectory` directory. ### [External Project]() If you don’t want to use LIEF as a submodule, you can use [CMake External Project]() to set up your project as a [\*superbuild\*](): ```cmake cmake_minimum_required(VERSION 3.21) project(CMakeLIEF LANGUAGES NONE) include(ExternalProject) # LIEF integration as an External Project # =========================== set(LIEF_PREFIX "${CMAKE_CURRENT_BINARY_DIR}/LIEF") set(LIEF_INSTALL_DIR "${LIEF_PREFIX}/install") # URL of the LIEF repo (Can be your fork) set(LIEF_GIT_URL "https://github.com/lief-project/LIEF.git") # LIEF's version to be used (can be 'main') set(LIEF_VERSION 0.13.0) # LIEF compilation config set(LIEF_CMAKE_ARGS -DCMAKE_INSTALL_PREFIX= -DCMAKE_BUILD_TYPE=RelWithDebInfo -DLIEF_DOC=OFF -DLIEF_PYTHON_API=OFF -DLIEF_EXAMPLES=OFF -DLIEF_TESTS=OFF ) if(MSVC) list(APPEND ${LIEF_CMAKE_ARGS} -DCMAKE_MSVC_RUNTIME_LIBRARY=MultiThreaded) endif() ExternalProject_Add(LIEF PREFIX "${LIEF_PREFIX}" GIT_REPOSITORY "${LIEF_GIT_URL}" GIT_TAG ${LIEF_VERSION} # You may specify an existing LIEF source directory if you don't want to # download. Just comment out the above ``GIT_*`` commands and uncoment the # following ``SOURCE_DIR`` line #SOURCE_DIR "${CMAKE_CURRENT_LIST_DIR}/../../.." INSTALL_DIR "${LIEF_INSTALL_DIR}" CMAKE_ARGS ${LIEF_CMAKE_ARGS} ``` To integrate this with a main `HelloLIEF` project located in a subdirectory (which looks exactly like the `find_package()` example shown earlier): ```cmake # User project # ============ ExternalProject_Add(HelloLIEF DEPENDS LIEF SOURCE_DIR "${CMAKE_CURRENT_LIST_DIR}/HelloLIEF" BINARY_DIR "${CMAKE_CURRENT_BUILD_DIR}" INSTALL_COMMAND "" CMAKE_ARGS "-DLIEF_DIR=${LIEF_INSTALL_DIR}/lib/cmake/LIEF" -DCMAKE_BUILD_TYPE=RelWithDebInfo ) ``` For the compilation: ```console $ mkdir build $ cd build $ cmake .. $ make $ HelloLIEF /bin/ls # or explorer.exe or what ever ``` A *full* example is available in the `examples/cmake/external_project` directory. ## [Visual Studio Integration]() Given a pre-compiled version of the LIEF SDK (e.g., `LIEF-1.0.0-win64.zip`): ```text . ├── bin │   ├── pe_reader.exe │   └── vdex_reader.exe ├── include │   └── LIEF ├── lib │   ├── LIEF.dll │   ├── LIEF.lib │   └── pkgconfig └── share └── LIEF ``` Add the `include/` directory to the compiler search path: `Configuration Properties > C/C++ > General > Additional Include Directories` and include either `LIEF.lib` or `LIEF.dll` during the linking step: `Configuration Properties > Linker > Input > Additional Dependencies` > **Warning** > > `LIEF.dll` is compiled with the `/MD` flag (`MultiThreadedDLL`), while `LIEF.lib` is compiled with the `/MT` flag (`MultiThreaded`). > > If this configuration is not suitable for your project, you can compile LIEF with your required runtime. ## [Xcode Integration]() Similar to Visual Studio, you should configure the Xcode project to include LIEF’s `include/` and `lib/` directories: - `include/`: `Build Settings > Search Paths > Header Search Paths` - `lib/`: `Build Settings > Search Paths > Library Search Paths` Then, you can add `libLIEF.a` or `libLIEF.dylib` to the list of libraries to link against: `Build Phases > Link Binary With Libraries` --- documentID: "f5fbe9a681bb8fdf775af0ba1e8def08abe388d58037dfad7b9f3296f792c800" docname: "intro" title: "Introduction - LIEF Documentation" description: "Introduction. The purpose of this project is to provide a cross-platform library to parse, modify, and abstract the ELF, PE, and Mach-O formats." canonical: "https://lief.re/doc/latest/intro.html" markdownURL: "https://lief.re/doc/latest/intro.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "2ea1280e1eec00a7e974500872b42b848ff6d9fbfce1fae1fbc7a7910d383d94" --- # [Introduction]() The purpose of this project is to provide a cross-platform library to parse, modify, and abstract the [ELF](), [PE](), and [Mach-O]() formats. From a technical standpoint, the library is written in C++ with a C++17 public interface and exposes bindings for Python and Rust. As a result, you can use LIEF through an idiomatic API in these languages: **Python** ```python import lief elf: lief.ELF.Binary | None = lief.ELF.parse("libc.so") assert elf is not None for symbol in elf.symbols: print(symbol.address, symbol.name) print(elf.header) for entry in elf.dynamic_entries: if isinstance(entry, lief.ELF.DynamicEntryLibrary): entry.name = "libhello.so" elf.write("modified.elf") ``` **C++** ```cpp #include std::unique_ptr fat = LIEF::MachO::Parser::parse("libobjc.dylib"); for (const LIEF::MachO::Binary& macho : *fat) { for (const LIEF::MachO::BindingInfo& binding : macho.bindings()) { std::cout << binding.address() << ' ' << binding.symbol()->name() << '\n'; } if (macho.is_ios()) { if (const LIEF::MachO::EncryptionInfo* info = macho.encryption_info()) { std::cout << info->crypt_id() << '\n'; } } } ``` **Rust** ```rust let mut file = std::fs::File::open(path).expect("Can't open the file"); if let Some(lief::Binary::PE(pe)) = lief::Binary::from(&mut file) { let rich_header = pe.rich_header().unwrap_or_else(|| { println!("Rich header not found!"); process::exit(0); }); println!("Rich header key: 0x{:x}", rich_header.key()); for entry in rich_header.entries() { println!( "id: 0x{:04x} build_id: 0x{:04x} count: #{}", entry.id(), entry.build_id(), entry.count() ); } let result = pe.verify_signature(lief::pe::signature::VerificationChecks::DEFAULT); if result == lief::pe::signature::VerificationFlags::OK { println!("Valid signature!"); } else { println!("Signature not valid: {:?}", result); } } ``` The project is also dedicated to providing comprehensive documentation and maintaining strong development standards, including: - A test suite with code coverage and non-regression testing - Address Sanitizer checks ([ASAN]()) - Continuous Integration for testing and releasing packages - Dockerization of various CI steps - A comprehensive [changelog]() - Nightly builds ![LIEF Architecture](https://lief.re/doc/latest/_images/elements.webp) To get started with LIEF’s features, you can check the documentation for specific formats: [ELF](), [PE](), or [Mach-O](). Integrating LIEF into your project is also straightforward: **Python** **With pip** ```console $ pip install lief ``` **Using a requirements.txt file** ```text lief==1.0.0 ``` **C++** **Compiler command line** ```console $ clang++ -lLIEF -I/include/ ... ``` **CMake** ```cmake find_package(LIEF) target_link_libraries(my-project LIEF::LIEF) ``` **Rust** **Nightly version** ```toml # For nightly build [dependencies] lief = { git = "https://github.com/lief-project/LIEF", branch = "main" } ``` **Released version** ```toml # For a tagged release [dependencies] lief = "1.0.0" ``` You can find additional content, including release notes, on the [LIEF blog](): - [LIEF 1.0.0 release info]() - [LIEF 0.17.0 release info]() - [LIEF 0.16.0 release info]() - [LIEF 0.15.0 release info]() - [LIEF 0.14.0 release info]() - [LIEF 0.13.0 release info]() - [LIEF 0.12.0 release info]() - [LIEF 0.11.1 release info]() - [LIEF 0.11.0 release info]() - [LIEF 0.9.0 release info]() Additional practical examples are available in the [examples/]() directory. ## [Extended Version]() [LIEF Extended]() adds [PDB]() and [DWARF]() analysis, [Objective-C metadata](), [Dyld shared caches](), and [assembly]()/[disassembly](). ## [Runtime]() The optional [runtime API]() inspects the process running LIEF: its host, loaded modules, and memory. Start with the ## [Additional Documentation]() - [Doxygen]() - Rust documentation: - Stable: [https://lief.re/doc/stable/rust/lief]() - Nightly: [https://lief-rs.s3.fr-par.scw.cloud/doc/latest/lief/index.html]() --- documentID: "35ca88fafa538d0586b9ca425fa8483fba5658293083920b4bcab7be43e166b2" docname: "plugins/binaryninja/analyzers/elf/android-jni/index" title: "Android JNI - ELF Analyzers - LIEF Documentation" description: "Android JNI in ELF Analyzers. This analyzer improves support for JNI functions in Android native libraries. It works by providing a BinaryNinja type library…" canonical: "https://lief.re/doc/latest/plugins/binaryninja/analyzers/elf/android-jni/index.html" markdownURL: "https://lief.re/doc/latest/plugins/binaryninja/analyzers/elf/android-jni/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "9fe7885d5b3cb992c2084a0709a228be4d89149e22552bc1f28c979e12c3811a" --- # [Android JNI]() This analyzer improves support for JNI functions in Android native libraries. It works by providing a BinaryNinja type library `android-jni.bntl`, which is placed next to the plugin’s shared library: ```text . ├── lief-analysis-plugin-linux-x86_64.so ├── lief-dwarf-plugin-linux-x86_64.so └── typelib └── aarch64 └── android-jni.bntl ``` This type library should be installed in one of the following locations: - **Linux:** `~/.binaryninja/typelib/aarch64/android-jni.bntl` - **Windows:** `C:\Users\romain\AppData\Roaming\Binary Ninja\typelib\aarch64\android-jni.bntl` - **macOS:** `~/Library/Application Support/Binary Ninja/typelib/aarch64/android-jni.bntl` After installation, select `Plugins > LIEF > Enhance Analysis`. The plugin will then import all types related to Android JNI. In addition, it will automatically define the type for the `JNI_OnLoad` function: uint64\_t JNI\_OnLoad(int64\_t\* arg1)00401270  uint64\_t x21 = \_ReadMSR(tpidr\_el0)00401284  int64\_t var\_48 = \*(x21 + 0x28)0040129c  int64\_t\* var\_2d80040129c  uint64\_t result0040129c  bool cond:10040129c  0040129c  if ((\*(\*arg1 + 0x30))(arg1, &var\_2d8, 0x10004) == 0)004012a8      int64\_t\* x19\_1 = var\_2d8004012c0      void var\_e0004012c0      sub\_401138(&data\_400b5c, &var\_e0, 0x41)004012d4      void\* var\_90 = &var\_e00040129c  else004012a0      result = 0xffffe0c0004012a0 jint JNI\_OnLoad(JavaVM\* vm, void\* reserved)00401270  uint64\_t x21 = \_ReadMSR(tpidr\_el0)00401284  int64\_t var\_48 = \*(x21 + 0x28)0040129c  JNIEnv\* env0040129c  int32\_t result0040129c  bool cond:10040129c  0040129c  if ((\*vm)->GetEnv(vm, &env, 0x10004) == 0)004012a8      JNIEnv\* env\_1 = env004012c0      void var\_e0004012c0      sub\_401138(&data\_400b5c, &var\_e0, 0x41)004012d4      JNINativeMethod var\_900040129c  else004012a0      result = -0x1f40004012a0 Functions tagged [[1]]() with `"LIEF - Android JNI Function"` are also updated to expose the correct type in the first two arguments: int64\_t Java\_com\_bytedance\_sdk\_component\_embedapplog\_PangleEncryptUtils\_ttEncrypt(int64\_t\* arg1,     int64\_t arg2, int64\_t arg3, int32\_t arg4)0000108c  uint64\_t x26 = \_ReadMSR(tpidr\_el0)00001090  int64\_t x8 = \*(x26 + 0x28)00001094  int64\_t result = 000001094  000010a8  if (arg3 != 0 && arg4 s>= 1)000010b0      int128\_t v0 = \*"UK\*@3oKpFlVVnads"000010d4      \_\_builtin\_strncpy(&data\_9830, "UK\*@3oKpFlVVnadsTfdA", 0x14)000010d8      int32\_t x0\_1 = ss\_encrypted\_size(zx.q(arg4), v0)000010e4      int64\_t x0\_3 = malloc(zx.q(arg4))000010f0      int64\_t x0\_5 = malloc(sx.q(x0\_1))00001114      (\*(\*arg1 + 0x640))(arg1, arg3, 0, zx.q(arg4), x0\_3)  {"ed\_size"}00001114      00001138      if ((ss\_encrypt(x0\_3, zx.q(arg4), &data\_9830, strlen(&data\_9830), x0\_5) & 0x80000000)00001138              != 0)00001190          result = 000001138      else00001154          result = (\*(\*arg1 + 0x580))(arg1, zx.q(x0\_1))00001170          (\*(\*arg1 + 0x680))(arg1, result, 0, zx.q(x0\_1), x0\_5)  {"ptUtils\_ttDecrypt"}00001170          00001174          if (x0\_3 != 0)0000117c              free(x0\_3)0000117c          00001180          if (x0\_5 != 0)00001188              free(x0\_5)00001188  000011a0  if (\*(x26 + 0x28) == x8)000011c0      return result000011c0  000011c4  \_\_stack\_chk\_fail()000011c4  noreturn jbyteArray Java\_com\_bytedance\_sdk\_component\_embedapplog\_PangleEncryptUtils\_ttEncrypt(JNIEnv\* env,     jobject thiz, jbyteArray arg3, jsize arg4)0000108c  uint64\_t x26 = \_ReadMSR(tpidr\_el0)00001090  int64\_t x8 = \*(x26 + 0x28)00001094  jbyteArray result = nullptr00001094  000010a8  if (arg3 != 0 && arg4 s>= 1)000010b0      int128\_t v0 = \*"UK\*@3oKpFlVVnads"000010d4      \_\_builtin\_strncpy(&data\_9830, "UK\*@3oKpFlVVnadsTfdA", 0x14)000010d8      jsize x0\_1 = ss\_encrypted\_size(zx.q(arg4), v0)000010e4      jbyte\* x0\_3 = malloc(zx.q(arg4))000010f0      jbyte\* x0\_5 = malloc(sx.q(x0\_1))00001114      (\*env)->GetByteArrayRegion(env, arg3, 0, arg4, x0\_3)00001114      00001138      if ((ss\_encrypt(x0\_3, zx.q(arg4), &data\_9830, strlen(&data\_9830), x0\_5) & 0x80000000)00001138              != 0)00001190          result = nullptr00001138      else00001154          result = (\*env)->NewByteArray(env, x0\_1)00001170          (\*env)->SetByteArrayRegion(env, result, 0, x0\_1, x0\_5)00001170          00001174          if (x0\_3 != 0)0000117c              free(x0\_3)0000117c          00001180          if (x0\_5 != 0)00001188              free(x0\_5)00001188  000011a0  if (\*(x26 + 0x28) == x8)000011c0      return result000011c0  000011c4  \_\_stack\_chk\_fail()000011c4  noreturn [[1]()] On a given function, right-click: `Tags and Bookmarks > Add Tag ... > LIEF - Android JNI Function` --- documentID: "d2111340022e03750bfd6aee4f262162f500a7e73f34d4acda035f0e243c1e8b" docname: "plugins/binaryninja/analyzers/elf/android-packed-relocations/index" title: "Android Packed Relocations - ELF Analyzers - LIEF Documentation" description: "Android Packed Relocations in ELF Analyzers. This analyzer enhances the type definition of Android-specific relocation data (DT_ANDROID_RELA)" canonical: "https://lief.re/doc/latest/plugins/binaryninja/analyzers/elf/android-packed-relocations/index.html" markdownURL: "https://lief.re/doc/latest/plugins/binaryninja/analyzers/elf/android-packed-relocations/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "cb7bff37e494f66975247908a6f19c218f40c5fd4236ebe3015c95a53334a480" --- # [Android Packed Relocations]() This analyzer enhances the type definition of Android-specific relocation data (`DT_ANDROID_RELA`) .rela.dyn section started  {0x40a950-0x40a9b6}0040a950  41 50 53 32 0b 00 0b 08 88 b5 10 81 82 80 80 e0  APS2............0040a960  2f 00 e0 0c 81 88 80 80 a0 02 00 08 81 88 80 80  /...............0040a970  c0 03 00 08 81 88 80 80 e0 3b 00 08 81 88 80 80  .........;......0040a980  80 3b 00 08 81 88 80 80 b0 31 00 08 81 88 80 80  .;.......1......0040a990  e0 2f 00 08 81 88 80 80 b0 15 00 08 81 88 80 80  ./..............0040a9a0  c0 08 00 80 c4 00 81 82 80 80 80 3b 00 88 13 81  ...........;....0040a9b0  82 80 80 b0 15 00                                .......rela.dyn section ended  {0x40a950-0x40a9b6} .rela.dyn section started  {0x40a950-0x40a9b6}0040a950  char format[0x4] = "APS2"0040a954  sleb128 nb\_relocs = 0xb0040a955  sleb128 reloc\_offset = 0x00040a956  sleb128 group\_size = 0xb0040a957  sleb128 group\_flags = 0x80040a958  sleb128 reloc\_offset\_0 = ...0040a95b  ....rela.dyn section ended  {0x40a950-0x40a9b6} > **Relocation** > > Please note that the **processing** of these relocations is part of the [Relocations]() analyzer. --- documentID: "c32e2b9c46805e1628a51ce8222bca085a2f6ff87f3e9df11f95129113bde207" docname: "plugins/binaryninja/analyzers/elf/index" title: "ELF Analyzers - BinaryNinja - LIEF Documentation" description: "ELF Analyzers in BinaryNinja reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/plugins/binaryninja/analyzers/elf/index.html" markdownURL: "https://lief.re/doc/latest/plugins/binaryninja/analyzers/elf/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "552fe09556cc8fd65c109c47f23ba869a5849342326afa612d09cd2723245763" --- # [ELF Analyzers]() ELF - [Android Packed Relocations]() - [Relative Relocations]() - [Relocations]() - [Android JNI]() --- documentID: "615ea66dc1631ddef98442ced26f038145f7e2b575ac26778fbf9c2d9e9aa068" docname: "plugins/binaryninja/analyzers/elf/relative-relocations/index" title: "Relative Relocations - ELF Analyzers - LIEF Documentation" description: "Relative Relocations in ELF Analyzers. This analyzer enhances the type definition of relative relocation data (DT_RELR)" canonical: "https://lief.re/doc/latest/plugins/binaryninja/analyzers/elf/relative-relocations/index.html" markdownURL: "https://lief.re/doc/latest/plugins/binaryninja/analyzers/elf/relative-relocations/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "d3001badfef6396d558b876dfb3cd283eb93c502d52154763c9b7545af523d53" --- # [Relative Relocations]() This analyzer enhances the type definition of relative relocation data (`DT_RELR`) .relr.dyn section started  {0x40a9b8-0x40aa88}0040a9b8                          00 00 04 00 00 00 00 00          ........0040a9c0  55 55 55 55 55 55 55 55 ab aa fe ff ff ff df c8  UUUUUUUU........0040a9d0  11 11 19 00 98 aa aa aa 55 55 55 55 55 55 55 55  ........UUUUUUUU0040a9e0  ab aa aa aa aa aa aa aa 55 55 55 55 55 55 55 55  ........UUUUUUUU0040a9f0  ab aa aa aa aa aa aa aa 55 55 55 55 55 55 55 55  ........UUUUUUUU0040aa00  ab aa aa aa aa aa aa aa 55 55 55 55 55 55 55 55  ........UUUUUUUU0040aa10  ab aa aa aa aa aa aa aa 55 55 55 55 55 55 55 55  ........UUUUUUUU0040aa20  ab aa aa aa aa aa aa ea 55 55 55 ad 8a 00 54 55  ........UUU...TU0040aa30  ab aa aa aa aa aa aa aa 55 55 d5 ff ff ff 00 00  ........UU......0040aa40  60 40 04 00 00 00 00 00 f1 42 10 80 90 18 01 00  `@.......B......0040aa50  11 21 00 50 b4 10 42 20 ff 70 fe 8c 38 00 a1 02  .!.P..B .p..8...0040aa60  01 00 00 00 00 00 00 f1 37 00 71 00 42 95 7b 0f  ........7.q.B.{.0040aa70  01 00 00 a0 77 00 1f 20 1d 00 50 c9 ff 01 00 00  ....w.. ..P.....0040aa80  3d 00 00 00 00 00 00 00                          =........relr.dyn section ended  {0x40a9b8-0x40aa88} .relr.dyn section started  {0x40a9b8-0x40aa88}0040a9b8  uintptr\_t r\_relr[0x1a] =0040a9b8  {0040a9b8      [0x00] =  0x00000000000400000040a9c0      [0x01] =  0x55555555555555550040a9c8      [0x02] =  0xc8dffffffffeaaab0040a9d0      [0x03] =  0xaaaaaa98001911110040a9d8      [0x04] =  0x55555555555555550040a9e0      [0x05] =  0xaaaaaaaaaaaaaaab0040a9e8      [0x06] =  0x55555555555555550040a9f0      [0x07] =  0xaaaaaaaaaaaaaaab0040a9f8      [0x08] =  0x55555555555555550040aa00      [0x09] =  0xaaaaaaaaaaaaaaab0040aa08      [0x0a] =  0x55555555555555550040aa10      .....relr.dyn section ended  {0x40a9b8-0x40aa88} > **Relocation** > > Please note that the **processing** of these relocations is part of the [Relocations]() analyzer. --- documentID: "e929c54aa22e4b2da49f0ba82466edb21fdaab095753ac0b94b6dc5a2e6895e0" docname: "plugins/binaryninja/analyzers/elf/relocations/index" title: "Relocations - ELF Analyzers - LIEF Documentation" description: "Relocations in ELF Analyzers. This analyzer enhances support for binaries that use recent relocation formats not recognized by BinaryNinja (e.g.…" canonical: "https://lief.re/doc/latest/plugins/binaryninja/analyzers/elf/relocations/index.html" markdownURL: "https://lief.re/doc/latest/plugins/binaryninja/analyzers/elf/relocations/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "78a4ad0cdb3dc2ef77ca4e0aa9893e1cbdfc7c1118acd7685766ea528acbd909" --- # [Relocations]() This analyzer enhances support for binaries that use recent relocation formats not recognized by BinaryNinja (e.g., `DT_ANDROID_RELA`, `DT_RELR`). For instance, here is LIEF-based processing of `DT_ANDROID_RELA` relocations: .fini\_array section started  {0x441e40-0x441e98}00441e40  void (\* fini\_array[0xb])() =00441e40  {00441e40      [0x0] = 0x1c02000441e48      [0x1] = 0x1c00000441e50      [0x2] = 0x2bd8000441e58      [0x3] = 0x2c78000441e60      [0x4] = 0x2ef5000441e68      [0x5] = 0x3269000441e70      [0x6] = 0x3441000441e78      [0x7] = 0x3862000441e80      [0x8] = 0x3a60000441e88      [0x9] = 0x3d43000441e90      [0xa] = 0x3d53000441e98  }.fini\_array section ended  {0x441e40-0x441e98}.init\_array section started  {0x441e98-0x441f08}00441e98  void (\* init\_array[0xe])() =00441e98  {00441e98      [0x0] = 0x1c30c00441ea0      [0x1] = 0x1c65000441ea8      [0x2] = 0x246f000441eb0      [0x3] = 0x284c000441eb8      [0x4] = 0x2981000441ec0      [0x5] = 0x2bd7000441ec8      [0x6] = 0x2c77000441ed0      [0x7] = 0x2ef4000441ed8      [0x8] = 0x3268000441ee0      [0x9] = 0x3440000441ee8      [0xa] = 0x3861000441ef0      [0xb] = 0x3a5f000441ef8      [0xc] = 0x3d3a000441f00      [0xd] = 0x3d4a000441f08  }.init\_array section ended  {0x441e98-0x441f08} .fini\_array section started  {0x441e40-0x441e98}00441e40  void (\* fini\_array[0xb])() =00441e40  {00441e40      void (\* fini\_array)() = \_\_on\_dlclose\_late00441e48      void (\* data\_441e48)() = \_\_on\_dlclose00441e50      void (\* data\_441e50)() = fib\_lookup\_exit00441e58      void (\* data\_441e58)() = ctrl\_exit00441e60      void (\* data\_441e60)() = addr\_exit00441e68      void (\* data\_441e68)() = link\_exit00441e70      void (\* data\_441e70)() = macsec\_exit00441e78      void (\* data\_441e78)() = vlan\_exit00441e80      void (\* data\_441e80)() = route\_exit00441e88      void (\* data\_441e88)() = release\_routing\_table\_names00441e90      void (\* data\_441e90)() = release\_proto\_names00441e98  }.fini\_array section ended  {0x441e40-0x441e98}.init\_array section started  {0x441e98-0x441f08}00441e98  void (\* init\_array[0xe])() =00441e98  {00441e98      void (\* init\_array)() = init\_have\_lse\_atomics00441ea0      void (\* data\_441ea0)() = \_\_init\_cpu\_features00441ea8      void (\* data\_441ea8)() = init\_msg\_size00441eb0      void (\* data\_441eb0)() = init\_default\_cb00441eb8      void (\* data\_441eb8)() = nl\_debug\_init00441ec0      void (\* data\_441ec0)() = fib\_lookup\_init00441ec8      void (\* data\_441ec8)() = ctrl\_init00441ed0      void (\* data\_441ed0)() = addr\_init00441ed8      void (\* data\_441ed8)() = link\_init00441ee0      void (\* data\_441ee0)() = macsec\_init00441ee8      void (\* data\_441ee8)() = vlan\_init00441ef0      void (\* data\_441ef0)() = route\_init00441ef8      void (\* data\_441ef8)() = init\_routing\_table\_names00441f00      void (\* data\_441f00)() = init\_proto\_names00441f08  }.init\_array section ended  {0x441e98-0x441f08} Here is one for `DT_RELR` relocations: .data.rel.ro (PROGBITS) section started  {0x421010-0x422310}00421020  00 00 00 00 00 00 00 00 6c 2c 01 00 00 00 00 00  ........l,......00421030  98 2c 01 00 00 00 00 00 00 00 00 00 00 00 00 00  .,..............00421040  d4 28 01 00 00 00 00 00 fc 2a 01 00 00 00 00 00  .(.......\*......00421050  fc 2a 01 00 00 00 00 00 00 2b 01 00 00 00 00 00  .\*.......+......00421060  60 00 00 00 00 00 00 00 d8 ff ff ff ff ff ff ff  `...............00421070  00 00 00 00 00 00 00 00 cc 2c 01 00 00 00 00 00  .........,......00421080  fc 2c 01 00 00 00 00 00 78 2b 01 00 00 00 00 00  .,......x+......00421090  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  .................data.rel.ro (PROGBITS) section ended  {0x421010-0x422310} .data.rel.ro (PROGBITS) section started  {0x421010-0x422310}00421020  void\* data\_421038 = 0x000421028  void\* data\_421028 = android::Choreographer::~Choreographer()00421030  void\* data\_421030 = android::Choreographer::~Choreographer()00421038  void\* data\_421038 = 0x000421040  void\* data\_421040 = android::Choreographer::dispatchVsync(int64\_t, uint64\_t, uint32\_t)00421048  void\* data\_421048 = android::Choreographer::dispatchHotplug(int64\_t, uint64\_t, bool)00421050  void\* data\_421050 = android::Choreographer::dispatchHotplug(int64\_t, uint64\_t, bool)00421058  void\* data\_421058 = android::Choreographer::handleMessage(android::Message const&).data.rel.ro (PROGBITS) section ended  {0x421010-0x422310} See also - [Android Packed Relocations]() - [Relative Relocations]() --- documentID: "9a5961c219e908b88fbf05faa2d23cb2c1ac87b64094180c92789cdc362656a3" docname: "plugins/binaryninja/analyzers/pe/exceptions-analyzer/index" title: "Exceptions - PE Analyzers - LIEF Documentation" description: "Exceptions in PE Analyzers. This analyzer improves the representation and underlying data of PE exceptions metadata, primarily for ARM64 and ARM64EC binaries." canonical: "https://lief.re/doc/latest/plugins/binaryninja/analyzers/pe/exceptions-analyzer/index.html" markdownURL: "https://lief.re/doc/latest/plugins/binaryninja/analyzers/pe/exceptions-analyzer/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "c7e10df783f93738e065476ceca55828f9fce887d220163dcdcb59c98ec1b80b" --- # [Exceptions]() This analyzer improves the representation and underlying data of PE exceptions metadata, primarily for ARM64 and ARM64EC binaries. .pdata section started  {0x140017000-0x140017d50}140017000  00 10 00 00 40 27 01 00 20 10 00 00 4c 27 01 00  ....@'.. ...L'..140017010  60 10 00 00 5c 27 01 00 80 10 00 00 6c 27 01 00  `...\'......l'..140017020  e0 10 00 00 18 29 01 00 00 11 00 00 c0 2a 01 00  .....).......\*..140017030  18 11 00 00 cc 2a 01 00 50 11 00 00 e4 2c 01 00  .....\*..P....,..140017040  80 11 00 00 ec 2c 01 00 00 12 00 00 f4 2c 01 00  .....,.......,..140017050  80 12 00 00 fc 2c 01 00 00 13 00 00 04 2d 01 00  .....,.......-..140017060  80 13 00 00 0c 2d 01 00 f0 13 00 00 14 2d 01 00  .....-.......-..140017070  60 14 00 00 1c 2d 01 00 d0 14 00 00 24 2d 01 00  `....-......$-..140017080  40 15 00 00 2c 2d 01 00 b0 15 00 00 34 2d 01 00  @...,-......4-..140017090  20 16 00 00 3c 2d 01 00 90 16 00 00 44 2d 01 00   ...<-......D-..1400170a0  00 17 00 00 4c 2d 01 00 50 17 00 00 54 2d 01 00  ....L-..P...T-..1400170b0  a0 17 00 00 5c 2d 01 00 f0 17 00 00 64 2d 01 00  ....\-......d-..1400170c0  40 18 00 00 6c 2d 01 00 b0 18 00 00 74 2d 01 00  @...l-......t-..1400170d0  20 19 00 00 7c 2d 01 00 90 19 00 00 84 2d 01 00   ...|-.......-..1400170e0  00 1a 00 00 8c 2d 01 00 70 1a 00 00 94 2d 01 00  .....-..p....-..1400170f0  e0 1a 00 00 9c 2d 01 00 50 1b 00 00 a4 2d 01 00  .....-..P....-..140017100  c0 1b 00 00 ac 2d 01 00 30 1c 00 00 b4 2d 01 00  .....-..0....-..140017110  a0 1c 00 00 bc 2d 01 00 10 1d 00 00 c4 2d 01 00  .....-.......-..140017120  80 1d 00 00 cc 2d 01 00 d0 1d 00 00 d4 2d 01 00  .....-.......-..140017130  20 1e 00 00 dc 2d 01 00 70 1e 00 00 e4 2d 01 00   ....-..p....-.. .pdata section started  {0x140017000-0x140017d50}140017000  struct \_LIEF\_IMAGE\_ARM64\_RUNTIME\_FUNCTION\_ENTRY \_\_arm64\_runtime\_function\_entry =140017000  {140017000      uint32\_t BeginAddress = 0x1000140017004      uint32\_t UnwindData = 0x12740140017008  }140017008  struct \_LIEF\_IMAGE\_ARM64\_RUNTIME\_FUNCTION\_ENTRY \_\_arm64\_runtime\_function\_entry =140017008  {140017008      uint32\_t BeginAddress = 0x102014001700c      uint32\_t UnwindData = 0x1274c140017010  }140017010  struct \_LIEF\_IMAGE\_ARM64\_RUNTIME\_FUNCTION\_ENTRY \_\_arm64\_runtime\_function\_entry =140017010  {140017010      uint32\_t BeginAddress = 0x1060140017014      uint32\_t UnwindData = 0x1275c140017018  }140017018  struct \_LIEF\_IMAGE\_ARM64\_RUNTIME\_FUNCTION\_ENTRY \_\_arm64\_runtime\_function\_entry =140017018  {140017018      uint32\_t BeginAddress = 0x108014001701c      uint32\_t UnwindData = 0x1276c140017020  }140017020  struct \_LIEF\_IMAGE\_ARM64\_RUNTIME\_FUNCTION\_ENTRY \_\_arm64\_runtime\_function\_entry = .rdata section started  {0x140010000-0x1400152d8}140012710  0b 00 20 08 81 e4 e3 e3 14 00 40 40 0a 00 c0 02  .. .......@@....140012720  e1 81 e6 e6 e6 e6 e7 66 89 fc e4 81 e7 4e 88 e7  .......f.....N..140012730  4c 86 e7 4a 84 e7 48 82 e7 66 89 fc e3 e3 e4 e3  L..J..H..f......140012740  06 00 40 08 05 00 80 00 01 e4 e4 00 0b 00 40 10  ..@...........@. .rdata section started  {0x140010000-0x1400152d8}140012710  struct LIEF\_IMAGE\_ARM64\_RUNTIME\_FUNCTION\_ENTRY\_XDATA \_\_arm64\_runtime\_function\_entry\_xdata =140012710  {140012710      uint32\_t HeaderData = 0x820000b140012714  }140012714  uint8\_t \_\_arm64\_unwind\_code[0x4] =140012714  {140012714      [0x0] =  0x81140012715      [0x1] =  0xe4140012716      [0x2] =  0xe3140012717      [0x3] =  0xe3140012718  }140012718  struct LIEF\_IMAGE\_ARM64\_RUNTIME\_FUNCTION\_ENTRY\_XDATA \_\_arm64\_runtime\_function\_entry\_xdata =140012718  {140012718      uint32\_t HeaderData = 0x4040001414001271c  }14001271c  uint32\_t \_\_arm64\_epilog\_scopes[0x1] =14001271c  {14001271c      [0x0] =  0x02c0000a140012720  }140012720  uint8\_t \_\_arm64\_unwind\_code[0x20] =140012720  {140012720      [0x00] =  0xe1140012721      [0x01] =  0x81140012722      [0x02] =  0xe6140012723      [0x03] =  0xe6140012724      [0x04] =  0xe6140012725      [0x05] =  0xe6               [....]140012740  } Additionally, it defines functions automatically based on the metadata of exceptions. This results in a more accurate representation of the binary, as illustrated in this feature map: > **See also** > > See also this blog post: [https://lief.re/blog/2025-02-16-arm64ec-pe-support/#binaryninja-arm64ec-support]() --- documentID: "b221488e4d9d8165847aad18ec12d727d0fd9d2844fb7bfdbd2be68483e0bf9f" docname: "plugins/binaryninja/analyzers/pe/index" title: "PE Analyzers - BinaryNinja - LIEF Documentation" description: "PE Analyzers in BinaryNinja reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/plugins/binaryninja/analyzers/pe/index.html" markdownURL: "https://lief.re/doc/latest/plugins/binaryninja/analyzers/pe/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "8a5a93f98a11c0875ac591f1158421e70dbf787d723ab5d3ffe68427e0d6073d" --- # [PE Analyzers]() PE - [LoadConfiguration]() - [Exceptions]() --- documentID: "6f11167a8cb160da7e9003a88d302f3b95e4e86a5834dbdaac272e9d25341860" docname: "plugins/binaryninja/analyzers/pe/loadconfig-analyzer/index" title: "LoadConfiguration - PE Analyzers - LIEF Documentation" description: "LoadConfiguration in PE Analyzers. This analyzer enhances the representation and underlying data of the PE LoadConfiguration structure within BinaryNinja." canonical: "https://lief.re/doc/latest/plugins/binaryninja/analyzers/pe/loadconfig-analyzer/index.html" markdownURL: "https://lief.re/doc/latest/plugins/binaryninja/analyzers/pe/loadconfig-analyzer/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "c0819ed70b02bcfdb186ab536d0a91e5ce1e683b63d56785c33c6dd14a5ac2d8" --- # [LoadConfiguration]() This analyzer enhances the representation and underlying data of the PE LoadConfiguration structure within BinaryNinja. 140011b20  struct Load\_Configuration\_Directory\_Table \_\_load\_configuration\_directory\_table =140011b20  {140011b20      uint32\_t characteristics = 0x140140011b24      uint32\_t timeDateStamp = 0x0140011b28      uint16\_t majorVersion = 0x0140011b2a      uint16\_t minorVersion = 0x0140011b2c      uint32\_t globalFlagsClear = 0x0140011b30      uint32\_t globalFlagsSet = 0x0140011b34      uint32\_t criticalSectionDefaultTimeout = 0x0140011b38      uint64\_t deCommitFreeBlockThreshold = 0x0140011b40      uint64\_t deCommitTotalFreeThreshold = 0x0140011b48      uint64\_t lockPrefixTable = 0x0140011b50      uint64\_t maximumAllocationSize = 0x0140011b58      uint64\_t virtualMemoryThreshold = 0x0140011b60      uint64\_t processAffinityMask = 0x0140011b68      uint32\_t processHeapFlags = 0x0140011b6c      uint16\_t csdVersion = 0x0140011b6e      uint16\_t reserved = 0x0140011b70      uint64\_t editList = 0x0140011b78      uint64\_t securityCookie = 0x140016040140011b80      uint64\_t seHandlerTable = 0x0140011b88      uint64\_t seHandlerCount = 0x0140011b90      uint64\_t guardCFCheckFunctionPointer = 0x140011070140011b98      uint64\_t guardCFDispatchFunctionPointer = 0x140011080140011ba0      uint64\_t guardCFFunctionTable = 0x0140011ba8      uint64\_t guardCFFunctionCount = 0x0140011bb0      uint32\_t guardFlags = 0x100140011bb4      uint16\_t Flags = 0x0140011bb6      uint16\_t Catalog = 0x0140011bb8      uint32\_t CatalogOffset = 0x0140011bbc      uint32\_t Reserved = 0x0140011bc0      uint64\_t guardAddressTakenIatEntryTable = 0x0140011bc8      uint64\_t guardAddressTakenIatEntryCount = 0x0140011bd0      uint64\_t guardLongJumpTargetTable = 0x0140011bd8      uint64\_t guardLongJumpTargetCount = 0x0140011be0      uint64\_t dynamicValueRelocTable = 0x0140011be8      uint64\_t CHPEMetadataPointer = 0x1400111f8140011bf0      uint64\_t guardRFFailureRoutine = 0x0140011bf8      uint64\_t guardRFFailureRoutineFunctionPointer = 0x0140011c00      uint32\_t dynamicValueRelocTableOffset = 0x0140011c04      uint16\_t dynamicValueRelocTableSection = 0x0140011c06      uint16\_t reserved2 = 0x0140011c08      uint64\_t guardRFVerifyStackPointerFunctionPointer = 0x0140011c10      uint32\_t hotPatchTableOffset = 0x0140011c14      uint32\_t reserved3 = 0x0140011c18      uint64\_t enclaveConfigurationPointer = 0x0140011c20      uint64\_t volatileMetadataPointer = 0x0140011c28      uint64\_t guardEHContinuationTable = 0x0140011c30      uint64\_t guardEHContinuationCount = 0x0140011c38      uint64\_t guardXFGCheckFunctionPointer = 0x140011078140011c40      uint64\_t guardXFGDispatchFunctionPointer = 0x140011088140011c48      uint64\_t guardXFGTableDispatchFunctionPointer = 0x140011090140011c50  } 140011b20  struct \_LIEF\_IMAGE\_LOAD\_CONFIG\_DIRECTORY64 \_\_load\_configuration\_directory\_table =140011b20  {140011b20      uint32\_t Size = 0x140140011b24      uint32\_t TimeDateStamp = 0x0140011b28      uint16\_t MajorVersion = 0x0140011b2a      uint16\_t MinorVersion = 0x0140011b2c      uint32\_t GlobalFlagsClear = 0x0140011b30      uint32\_t GlobalFlagsSet = 0x0140011b34      uint32\_t CriticalSectionDefaultTimeout = 0x0140011b38      uintptr\_t DeCommitFreeBlockThreshold = 0x0140011b40      uintptr\_t DeCommitTotalFreeThreshold = 0x0140011b48      void\* LockPrefixTable = 0x0140011b50      uintptr\_t MaximumAllocationSize = 0x0140011b58      uintptr\_t VirtualMemoryThreshold = 0x0140011b60      uintptr\_t ProcessHeapFlags = 0x0140011b68      uint32\_t ProcessAffinityMask = 0x0140011b6c      uint16\_t CSDVersion = 0x0140011b6e      uint16\_t DependentLoadFlags = 0x0140011b70      void\* EditList = 0x0140011b78      void\* SecurityCookie = \_\_security\_cookie140011b80      uintptr\_t\* SEHandlerTable = 0x0140011b88      uintptr\_t SEHandlerCount = 0x0140011b90      void (\*\* GuardCFCheckFunctionPointer)() = \_\_guard\_check\_icall\_fptr140011b98      void (\*\* GuardCFDispatchFunctionPointer)() = \_\_guard\_dispatch\_icall\_fptr140011ba0      uint32\_t\* SEHandlerTable = 0x0140011ba8      uintptr\_t GuardCFFunctionCount = 0x0140011bb0      enum GuardFlags = IMAGE\_GUARD\_CF\_INSTRUMENTED140011bb4      struct CodeIntegrity =140011bb4      {140011bb4          uint16\_t Flags = 0x0140011bb6          uint16\_t Catalog = 0x0140011bb8          uint32\_t CatalogOffset = 0x0140011bbc          uint32\_t Reserved = 0x0140011bc0      }140011bc0      void\* GuardAddressTakenIatEntryTable = 0x0140011bc8      uintptr\_t GuardAddressTakenIatEntryCount = 0x0140011bd0      void\* GuardLongJumpTargetTable = 0x0140011bd8      uintptr\_t GuardLongJumpTargetCount = 0x0140011be0      void\* DynamicValueRelocTable = 0x0140011be8      struct \_LIEF\_IMAGE\_ARM64EC\_METADATA\_V2\* const CHPEMetadataPointer = \_\_image\_arm64ec\_metadata140011bf0      void (\*\* GuardRFFailureRoutine)() = 0x0140011bf8      void (\*\* GuardRFFailureRoutineFunctionPointer)() = 0x0140011c00      uint32\_t DynamicValueRelocTableOffset = 0x0140011c04      uint16\_t DynamicValueRelocTableSection = 0x0140011c06      uint16\_t Reserved2 = 0x0140011c08      void (\*\* GuardRFVerifyStackPointerFunctionPointer)() = 0x0140011c10      uint32\_t HotPatchTableOffset = 0x0140011c14      uint32\_t Reserved3 = 0x0140011c18      void\* EnclaveConfigurationPointer = 0x0140011c20      void\* VolatileMetadataPointer = 0x0140011c28      void\* GuardEHContinuationTable = 0x0140011c30      void\* GuardEHContinuationCount = 0x0140011c38      void (\*\* GuardXFGCheckFunctionPointer)() = data\_140011078140011c40      void (\*\* GuardXFGDispatchFunctionPointer)() = data\_140011088140011c48      void (\*\* GuardXFGTableDispatchFunctionPointer)() = data\_140011090140011c50      void (\*\* CastGuardOsDeterminedFailureMode)() = 0x140011098140011c58      void (\*\* GuardMemcpyFunctionPointer)() = data\_1400110a0140011c60  } The layout of this structure – exposed in LIEF through the `lief.PE.LoadConfiguration` ( [`lief::pe::LoadConfiguration`]() ; [`lief.PE.LoadConfiguration`]() ; [`LIEF::PE::LoadConfiguration`]() ) interface – evolves frequently across new Windows releases. By running this analyzer, you obtain a more complete and accurate representation of these attributes along with their correct data types. Beyond the Load Configuration, the analyzer also defines additional structures, such as `lief.PE.CHPEMetadataARM64` ( [`lief::pe::chpe_metadata_arm64::CHPEMetadata`]() ; [`lief.PE.CHPEMetadataARM64`]() ; [`LIEF::PE::CHPEMetadataARM64`]() ), which provide valuable context for analyzing ARM64EC binaries. These definitions make it easier to interpret the purpose of certain functions and pointers, leading to deeper insights during reverse engineering. 1400111e0  00 00 00 00 01 00 00 00 48 65 6c 6c 6f 20 57 6f 72 6c 64 21 0a 00 00 00 02 00 00 00 00 1e 01 00  ........Hello World!............140011200  02 00 00 00 b4 1c 01 00 00 90 01 00 00 10 01 00 08 10 01 00 18 10 01 00 10 10 01 00 20 10 01 00  ............................ ...140011220  00 00 00 00 00 50 01 00 01 00 00 00 01 00 00 00 28 10 01 00 30 10 01 00 00 70 01 00 38 0d 00 00  .....P..........(...0....p..8...140011240  38 10 01 00 48 3e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 10 01 00 48 10 01 00 50 10 01 00  8...H>..............@...H...P...140011260  58 10 01 00 60 10 01 00 68 10 01 00 00 00 00 00                                                  X...`...h....... 1400111e8  char const data\_1400111e8[0xe] = "Hello World!\n", 01400111f6                                                                    00 00                                                ..1400111f8  struct \_LIEF\_IMAGE\_ARM64EC\_METADATA\_V2 \_\_image\_arm64ec\_metadata =1400111f8  {1400111f8      uint32\_t Version = 0x21400111fc      uint32\_t CodeMap = 0x11e00140011200      uint32\_t CodeMapCount = 0x2140011204      uint32\_t CodeRangesToEntryPoints = 0x11cb4140011208      uint32\_t RedirectionMetadata = 0x1900014001120c      uint32\_t \_\_os\_arm64x\_dispatch\_call\_no\_redirect = 0x11000140011210      uint32\_t \_\_os\_arm64x\_dispatch\_ret = 0x11008140011214      uint32\_t \_\_os\_arm64x\_dispatch\_call = 0x11018140011218      uint32\_t \_\_os\_arm64x\_dispatch\_icall = 0x1101014001121c      uint32\_t \_\_os\_arm64x\_dispatch\_icall\_cfg = 0x11020140011220      uint32\_t AlternateEntryPoint = 0x0140011224      uint32\_t AuxiliaryIAT = 0x15000140011228      uint32\_t CodeRangesToEntryPointsCount = 0x114001122c      uint32\_t RedirectionMetadataCount = 0x1140011230      uint32\_t GetX64InformationFunctionPointer = 0x11028140011234      uint32\_t SetX64InformationFunctionPointer = 0x11030140011238      uint32\_t ExtraRFETable = 0x1700014001123c      uint32\_t ExtraRFETableSize = 0xd38140011240      uint32\_t \_\_os\_arm64x\_dispatch\_fptr = 0x11038140011244      uint32\_t AuxiliaryIATCopy = 0x13e48140011248      uint32\_t AuxDelayloadIAT = 0x014001124c      uint32\_t AuxDelayloadIATCopy = 0x0140011250      uint32\_t ReservedBitField = 0x0140011254  } --- documentID: "51dae1e1c8f06af3d99df3dc330b381c451df9209525fb03ee5331f3ada1583e" docname: "plugins/binaryninja/dwarf/index" title: "BinaryNinja - DWARF Plugin - LIEF Documentation" description: "BinaryNinja - DWARF Plugin. To export DWARF information from a BinaryNinja BinaryView representation, use the menu: Plugins > LIEF > Export as DWARF" canonical: "https://lief.re/doc/latest/plugins/binaryninja/dwarf/index.html" markdownURL: "https://lief.re/doc/latest/plugins/binaryninja/dwarf/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "062b297536c6442449b9f076aa2479cfa5d52ae83c991bce8c40b7fac356d6fd" --- # [BinaryNinja - DWARF Plugin]() ## [Export as DWARF]() > **BinaryNinja builtin plugin** > > Binary Ninja already embeds a DWARF export plugin that exposes most of the functionality provided by this plugin. However, this plugin exports additional information, such as stack variables and basic blocks. To export DWARF information from a BinaryNinja `BinaryView` representation, use the menu: `Plugins > LIEF > Export as DWARF` ![BinaryNinja DWARF exporter](https://lief.re/doc/latest/_static/binaryninja/trigger-dwarf-plugin.webp) ### [Support & Limitations]() This extension tries to convert most of the information registered in a BinaryView into DWARF structures, but this support is not exhaustive; here is an overview of what is and is not exported. **BinaryNinja::BinaryView** - Function - Data Variables - Types - Comments **BinaryNinja::Function** - Name - Address range - Parameters - Type of parameters - Return type - Stack variables - Types of stack variables - Basic Blocks - Comments **BinaryNinja::DataVariable** - Name - Type - Address - Comments **BinaryNinja::Type** - `BNTypeClass::VoidTypeClass` - `BNTypeClass::BoolTypeClass` - `BNTypeClass::IntegerTypeClass` - `BNTypeClass::FloatTypeClass` - `BNTypeClass::PointerTypeClass` - `BNTypeClass::PointerTypeClass` - `BNTypeClass::StructureTypeClass` - `BNTypeClass::ClassStructureType` - `BNTypeClass::UnionStructureType` - `BNTypeClass::StructStructureType` - `BNTypeClass::EnumerationTypeClass` - `BNTypeClass::NamedTypeReferenceClass` - `BNTypeClass::ArrayTypeClass` - `BNTypeClass::WideCharTypeClass` - `BNTypeClass::FunctionTypeClass` - `BNTypeClass::VarArgsTypeClass` - `BNTypeClass::ValueTypeClass` Any types not mentioned here are not supported. --- documentID: "02e012ddee20b983d9d3d3779ae581c90babb9a5411955dff17b8be9cb68f390" docname: "plugins/binaryninja/index" title: "BinaryNinja - LIEF Documentation" description: "Similar to the Ghidra plugin, LIEF can be used as a BinaryNinja plugin." canonical: "https://lief.re/doc/latest/plugins/binaryninja/index.html" markdownURL: "https://lief.re/doc/latest/plugins/binaryninja/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "8669496fcf4a0a0273012fca500b8901398512d7685cb3d894b61accf4d8c8ce" --- # [BinaryNinja]() --- ![LIEF integrated with Binary Ninja](https://lief.re/doc/latest/_static/lief_with_bn.webp) Similar to the [Ghidra plugin](), LIEF can be used as a BinaryNinja plugin. Features - [BinaryNinja - DWARF Plugin]() - [Export as DWARF]() - [ELF Analyzers]() - [Android Packed Relocations]() - [Relative Relocations]() - [Relocations]() - [Android JNI]() - [PE Analyzers]() - [LoadConfiguration]() - [Exceptions]() Downloads - [lief-binaryninja-plugins-5.0.7290.zip]() - [lief-binaryninja-plugins-5.0.7486.zip]() - [lief-binaryninja-plugins-5.1.8005.zip]() - [lief-binaryninja-plugins-5.1.8104.zip]() - [lief-binaryninja-plugins-5.2.8614.zip]() - [lief-binaryninja-plugins-5.2.8722.zip]() - [lief-binaryninja-plugins-5.3.9434.zip]() - [lief-binaryninja-plugins-6.0.10601.zip]() - [lief-binaryninja-plugins-dev.zip]() First, download the LIEF plugin package from [https://lief.s3.fr-par.scw.cloud/latest/plugins/index.html]() or from the packages listed above. Then, follow the official procedure to install plugins: [https://docs.binary.ninja/guide/plugins.html]() For instance, if you install the [DWARF Plugin](), you should have this file installed: - **Linux:** `~/.binaryninja/plugins/lief-dwarf-plugin-linux-x86_64.so` - **Windows:** `C:\Users\romain\AppData\Roaming\Binary Ninja\plugins\lief-dwarf-plugin-windows-x86_64.dll` - **macOS:** `~/Library/Application Support/Binary Ninja/plugins/lief-dwarf-plugin-darwin-arm64.dylib` > **Shared Library** > > In addition to the previously installed library, the plugins require the installation of `LIEF.dll`, `libLIEF.dylib`, or `libLIEF.so` next to the plugin directory. You can download this library from the following list: > > SDK > > - [LIEF-1.0.0-Darwin-arm64.tar.gz]() > - [LIEF-1.0.0-Darwin-x86\_64.tar.gz]() > - [LIEF-1.0.0-Linux-x86\_64.tar.gz]() > - [LIEF-1.0.0-win64.zip]() > - [LIEF-2.0.0-Darwin-arm64.tar.gz]() > - [LIEF-2.0.0-Darwin-x86\_64.tar.gz]() > - [LIEF-2.0.0-Linux-x86\_64.tar.gz]() > - [LIEF-2.0.0-win64.zip]() > > or from here: [https://lief.s3.fr-par.scw.cloud/latest/sdk/index.html](). Some plugins (like the [DWARF Plugin]()) require the extended version, which can be downloaded from [https://extended.lief.re/](). > > Given this shared library, you must copy it into the plugin directory (or its parent for Linux and macOS). > > - **macOS**: > > - `~/Library/Application Support/Binary Ninja/plugins/libLIEF.dylib` > - `~/Library/Application Support/Binary Ninja/libLIEF.dylib` > - **Linux**: > > - `~/.binaryninja/plugins/libLIEF.so` > - `~/.binaryninja/libLIEF.so` > - **Windows**: > > - `C:\Users\romain\AppData\Roaming\Binary Ninja\plugins\LIEF.dll` > - `%APPDATA%\Binary Ninja\plugins\LIEF.dll` ## [Troubleshooting]() **Plugin module failed to load** ```text [:0 Default] Plugin module '~/.binaryninja/plugins/lief-dwarf-plugin-linux-x86_64.so' failed to load [:0 Default] dlerror() reports: libLIEF.so: cannot open shared object file: No such file or directory ``` This means that `libLIEF.so`, `libLIEF.dylib`, or `LIEF.dll` is not correctly installed in the `plugins/` directory. Make sure that the LIEF shared library is next to the plugin that failed to load. **This feature requires LIEF extended** This error means that you need to install the extended version of the shared library. See the [extended section]() for more information. **libLIEF.dylib can’t be opened because Apple cannot check it for malicious software** `libLIEF.dylib` is self-signed and does not use an Apple certificate; therefore, it is considered as coming from an *unknown developer*. You can address this issue in different ways: 1. You can compile `libLIEF.dylib` yourself and sign the compiled library with your certificate. 2. You can add a security exception as described here: [https://support.apple.com/guide/mac-help/apple-cant-check-app-for-malicious-software-mchleab3a043/mac]() ![macOS library loading issue](https://lief.re/doc/latest/_static/macos-dylib-issue.png) --- documentID: "3d244d0ef870f19f55b90e737fef43a4a935da37856945c28717eedb764a30be" docname: "plugins/ghidra/analyzers/exceptions-analyzer/index" title: "Ghidra - Analyzers - Exceptions - LIEF Documentation" description: "Ghidra - Analyzers - Exceptions. This analyzer improves the representation and underlying data of PE exceptions metadata, primarily for ARM64 and ARM64EC…" canonical: "https://lief.re/doc/latest/plugins/ghidra/analyzers/exceptions-analyzer/index.html" markdownURL: "https://lief.re/doc/latest/plugins/ghidra/analyzers/exceptions-analyzer/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "514a7a9d15e62d275d7dd096cd708e83bc0486865aaaa86479ea60f9590a3d27" --- # [Ghidra - Analyzers - Exceptions]() This analyzer improves the representation and underlying data of PE exceptions metadata, primarily for ARM64 and ARM64EC binaries. 140017000 00            ??                         00h140017001 10            ??                         10h140017002 00            ??                         00h140017003 00            ??                         00h140017004 40            ??                         40h    @140017005 27            ??                         27h    '140017006 01            ??                         01h140017007 00            ??                         00h140017008 20            ??                         20h140017009 10            ??                         10h14001700a 00            ??                         00h14001700b 00            ??                         00h14001700c 4c            ??                         4Ch    L14001700d 27            ??                         27h    '14001700e 01            ??                         01h14001700f 00            ??                         00h140017010 60            ??                         60h    `140017011 10            ??                         10h140017012 00            ??                         00h140017013 00            ??                         00h140017014 5c            ??                         5Ch    \140017015 27            ??                         27h    '140017016 01            ??                         01h140017017 00            ??                         00h140017018 80            ??                         80h140017019 10            ??                         10h14001701a 00            ??                         00h14001701b 00            ??                         00h14001701c 6c            ??                         6Ch    l14001701d 27            ??                         27h    '14001701e 01            ??                         01h14001701f 00            ??                         00h140017020 e0            ??                         E0h 140017000 00 10 00 00 40 27 01 00    IMAGE\_ARM64\_RUNTIME\_FUNCTION\_UNPACKED\_ENTRY      140017000 00 10 00 00           ibo32  \_\_aarch64\_function@140001000                           BeginAddress     XREF[2]:   14000029c(\*), 140011238(\*)      140017004 40 27 01 00           ibo32  IMAGE\_ARM64\_RUNTIME\_FUNCTION\_ENTRY\_XDATA\_140012740     ExceptionInfoRVA140017008 20 10 00 00 4c 27 01 00    IMAGE\_ARM64\_RUNTIME\_FUNCTION\_UNPACKED\_ENTRY      140017008 20 10 00 00           ibo32  \_\_aarch64\_function@140001020                           BeginAddress      14001700c 4c 27 01 00           ibo32  IMAGE\_ARM64\_RUNTIME\_FUNCTION\_ENTRY\_XDATA\_14001274c     ExceptionInfoRVA140017010 60 10 00 00 5c 27 01 00    IMAGE\_ARM64\_RUNTIME\_FUNCTION\_UNPACKED\_ENTRY      140017010 60 10 00 00           ibo32  \_\_aarch64\_function@140001060                           BeginAddress      140017014 5c 27 01 00           ibo32  IMAGE\_ARM64\_RUNTIME\_FUNCTION\_ENTRY\_XDATA\_14001275c     ExceptionInfoRVA140017018 80 10 00 00 6c 27 01 00    IMAGE\_ARM64\_RUNTIME\_FUNCTION\_UNPACKED\_ENTRY      140017018 80 10 00 00           ibo32  \_\_aarch64\_function@140001080                           BeginAddress      14001701c 6c 27 01 00           ibo32  IMAGE\_ARM64\_RUNTIME\_FUNCTION\_ENTRY\_XDATA\_14001276c     ExceptionInfoRVA140017020 e0 10 00 00 18 29 01 00    IMAGE\_ARM64\_RUNTIME\_FUNCTION\_UNPACKED\_ENTRY      140017020 e0 10 00 00           ibo32  \_\_aarch64\_function@1400010e0                           BeginAddress      140017024 18 29 01 00           ibo32  IMAGE\_ARM64\_RUNTIME\_FUNCTION\_ENTRY\_XDATA\_140012918     ExceptionInfoRVA140017028 00 11 00 00 c0 2a 01 00    IMAGE\_ARM64\_RUNTIME\_FUNCTION\_UNPACKED\_ENTRY      140017028 00 11 00 00           ibo32  \_\_aarch64\_function@140001100                           BeginAddress      14001702c c0 2a 01 00           ibo32  IMAGE\_ARM64\_RUNTIME\_FUNCTION\_ENTRY\_XDATA\_140012ac0     ExceptionInfoRVA140017030 18 11 00 00 cc 2a 01 00    IMAGE\_ARM64\_RUNTIME\_FUNCTION\_UNPACKED\_ENTRY      140017030 18 11 00 00           ibo32  \_\_aarch64\_function@140001118                           BeginAddress      140017034 cc 2a 01 00           ibo32  IMAGE\_ARM64\_RUNTIME\_FUNCTION\_ENTRY\_XDATA\_140012acc     ExceptionInfoRVA140017038 50 11 00 00 e4 2c 01 00    IMAGE\_ARM64\_RUNTIME\_FUNCTION\_UNPACKED\_ENTRY      140017038 50 11 00 00           ibo32  \_\_aarch64\_function@140001150                           BeginAddress      14001703c e4 2c 01 00           ibo32  IMAGE\_ARM64\_RUNTIME\_FUNCTION\_ENTRY\_XDATA\_140012ce4     ExceptionInfoRVA140017040 80 11 00 00 ec 2c 01 00    IMAGE\_ARM64\_RUNTIME\_FUNCTION\_UNPACKED\_ENTRY      140017040 80 11 00 00           ibo32  \_\_aarch64\_function@140001180                           BeginAddress      140017044 ec 2c 01 00           ibo32  IMAGE\_ARM64\_RUNTIME\_FUNCTION\_ENTRY\_XDATA\_140012cec     ExceptionInfoRVA140017048 00 12 00 00 f4 2c 01 00    IMAGE\_ARM64\_RUNTIME\_FUNCTION\_UNPACKED\_ENTRY      140017048 00 12 00 00           ibo32  \_\_aarch64\_function@140001200                           BeginAddress      14001704c f4 2c 01 00           ibo32  IMAGE\_ARM64\_RUNTIME\_FUNCTION\_ENTRY\_XDATA\_140012cf4     ExceptionInfoRVA140017050 80 12 00 00 fc 2c 01 00    IMAGE\_ARM64\_RUNTIME\_FUNCTION\_UNPACKED\_ENTRY      140017050 80 12 00 00           ibo32  \_\_aarch64\_function@140001280                           BeginAddress      140017054 fc 2c 01 00           ibo32  IMAGE\_ARM64\_RUNTIME\_FUNCTION\_ENTRY\_XDATA\_140012cfc     ExceptionInfoRVA 140012710 0b                ??        0Bh140012711 00                ??        00h140012712 20                ??        20h140012713 08                ??        08h140012714 81                ??        81h140012715 e4                ??        E4h140012716 e3                ??        E3h140012717 e3                ??        E3h140012718 14                ??        14h140012719 00                ??        00h14001271a 40                ??        40h    @14001271b 40                ??        40h    @14001271c 0a                ??        0Ah14001271d 00                ??        00h14001271e c0                ??        C0h14001271f 02                ??        02h140012720 e1                ??        E1h140012721 81                ??        81h140012722 e6                ??        E6h140012723 e6                ??        E6h140012724 e6                ??        E6h140012725 e6                ??        E6h140012726 e7                ??        E7h140012727 66                ??        66h    f140012728 89                ??        89h140012729 fc                ??        FCh14001272a e4                ??        E4h14001272b 81                ??        81h14001272c e7                ??        E7h14001272d 4e                ??        4Eh    N14001272e 88                ??        88h14001272f e7                ??        E7h140012730 4c                ??        4Ch    L140012731 86                ??        86h140012732 e7                ??        E7h140012733 4a                ??        4Ah    J140012734 84                ??        84h 140012710 0b 00 20 08                                  IMAGE\_ARM64\_RUNTIME\_FUNCTION\_ENTRY\_XDATA      140012710 0b 00 20                                dword:18                  Bh                FunctionLength             XREF[1]:   140017a14(\*)      140012712 20                                      dword:2                   0h                Version      140012712 20                                      dword:1                   0h                ExceptionDataPresent      140012712 20                                      dword:1                   1h                EpilogInHeader      140012712 20 08                                   dword:5                   0h                EpilogCount      140012713 08                                      dword:5                   1h                CodeWords                    \_\_arm64\_unwind\_code@140012714140012714 81 e4 e3 e3                                  db[4]   140012714 [0]           81h, E4h, E3h, E3h                    IMAGE\_ARM64\_RUNTIME\_FUNCTION\_ENTRY\_XDATA  XREF[1]:   140017a1c(\*)140012718 14 00 40 40                                  IMAGE\_ARM64\_RUNTIME\_FUNCTION\_ENTRY\_XDATA      140012718 14 00 40                                dword:18                  14h               FunctionLength             XREF[1]:   140017a1c(\*)      14001271a 40                                      dword:2                   0h                Version      14001271a 40                                      dword:1                   0h                ExceptionDataPresent      14001271a 40                                      dword:1                   0h                EpilogInHeader      14001271a 40 40                                   dword:5                   1h                EpilogCount      14001271b 40                                      dword:5                   8h                CodeWords                    \_\_arm64\_epilog\_scopes@14001271c14001271c 0a 00 c0 02                                  EpilogScope[1]      14001271c 0a 00 c0 02                             EpilogScope                                 [0]         14001271c 0a 00 c0                                dword:18                  Ah                StartOffset         14001271e c0                                      dword:4                   0h                Res         14001271e c0 02                                   dword:10                  Bh                ExceptionDataPresent                    \_\_arm64\_unwind\_code@140012720140012720 e1 81 e6 e6 e6 e6 e7 66 89 fc e4 81 e7       db[32]          4e 88 e7 4c 86 e7 4a 84 e7 48 82 e7 66          89 fc e3 e3 e4 e3   140012720 [0]           E1h, 81h, E6h, E6h,   140012724 [4]           E6h, E6h, E7h, 66h,   140012728 [8]           89h, FCh, E4h, 81h,   14001272c [12]          E7h, 4Eh, 88h, E7h,   140012730 [16]          4Ch, 86h, E7h, 4Ah,   140012734 [20]          84h, E7h, 48h, 82h,   140012738 [24]          E7h, 66h, 89h, FCh,   14001273c [28]          E3h, E3h, E4h, E3h                    IMAGE\_ARM64\_RUNTIME\_FUNCTION\_ENTRY\_XDATA  XREF[1]:   140017004(\*) --- documentID: "daf35630badf0501c819bd0e64ed12f9ca3e858eb2e6cf7c8e8973151a334e36" docname: "plugins/ghidra/analyzers/loadconfig-analyzer/index" title: "Ghidra - Analyzers - IMAGE_LOAD_CONFIG_DIRECTORY - LIEF Documentation" description: "Ghidra - Analyzers - IMAGE_LOAD_CONFIG_DIRECTORY. This analyzer enhances the representation and underlying data of the PE LoadConfiguration structure within…" canonical: "https://lief.re/doc/latest/plugins/ghidra/analyzers/loadconfig-analyzer/index.html" markdownURL: "https://lief.re/doc/latest/plugins/ghidra/analyzers/loadconfig-analyzer/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "73de6dfd8d8d86758ad6451b93047072b9ca4c5da5d1f48a083a4e0abd32fc87" --- # [Ghidra - Analyzers - IMAGE\_LOAD\_CONFIG\_DIRECTORY]() This analyzer enhances the representation and underlying data of the PE LoadConfiguration structure within Ghidra. IMAGE\_LOAD\_CONFIG\_DIRECTORY64\_140011b20   XREF[1]:   1400001c0(\*)140011b20 40 01 00 00 00 00 00 00 00 00 00 00 00       IMAGE\_LOAD\_CONFIG\_DIRECTORY64          00 00 00 00 00 00 00 00 00 00 00 00 00          00 00 00 00 00 00 00 00 00 00 00 00 00      140011b20 40 01 00 00                             ddw                       140h                                  Size                            XREF[1]:   1400001c0(\*)      140011b24 00 00 00 00                             ddw                       0h                                    TimeDateStamp      140011b28 00 00                                   dw                        0h                                    MajorVersion      140011b2a 00 00                                   dw                        0h                                    MinorVersion      140011b2c 00 00 00 00                             ddw                       0h                                    GlobalFlagsClear      140011b30 00 00 00 00                             ddw                       0h                                    GlobalFlagsSet      140011b34 00 00 00 00                             ddw                       0h                                    CriticalSectionDefaultTimeout      140011b38 00 00 00 00 00 00 00 00                 dq                        0h                                    DeCommitFreeBlockThreshold      140011b40 00 00 00 00 00 00 00 00                 dq                        0h                                    DeCommitTotalFreeThreshold      140011b48 00 00 00 00 00 00 00 00                 addr                      00000000                              LockPrefixTable      140011b50 00 00 00 00 00 00 00 00                 dq                        0h                                    MaximumAllocationSize      140011b58 00 00 00 00 00 00 00 00                 dq                        0h                                    VirtualMemoryThreshold      140011b60 00 00 00 00 00 00 00 00                 dq                        0h                                    ProcessAffinityMask      140011b68 00 00 00 00                             ddw                       0h                                    ProcessHeapFlags      140011b6c 00 00                                   dw                        0h                                    CsdVersion      140011b6e 00 00                                   dw                        0h                                    DependentLoadFlags      140011b70 00 00 00 00 00 00 00 00                 addr                      00000000                              EditList      140011b78 40 60 01 40 01 00 00 00                 addr                      DAT\_140016040                         SecurityCookie                         = 32h    2      140011b80 00 00 00 00 00 00 00 00                 addr                      00000000                              SEHandlerTable      140011b88 00 00 00 00 00 00 00 00                 dq                        0h                                    SEHandlerCount      140011b90 70 10 01 40 01 00 00 00                 addr                      PTR\_\_guard\_check\_icall\_140011070      GuardCFCCheckFunctionPointer           = 14000b8d8      140011b98 80 10 01 40 01 00 00 00                 addr                      PTR\_\_guard\_dispatch\_icall\_140011080   GuardCFDispatchFunctionPointer         = 14000e2c0      140011ba0 00 00 00 00 00 00 00 00                 addr                      00000000                              GuardCFFunctionTable      140011ba8 00 00 00 00 00 00 00 00                 dq                        0h                                    GuardCFFunctionCount      140011bb0 00 01 00 00                             IMAGE\_GUARD\_FLAGS         IMAGE\_GUARD\_CF\_INSTRUMENTED           GuardFlags      140011bb4 00 00 00 00 00 00 00 00 00 00 00 00     IMAGE\_LOAD\_CONFIG\_CODE\_I                                        CodeIntegrity      140011bc0 00 00 00 00 00 00 00 00                 addr                      00000000                              GuardAddressTakenIatEntryTable      140011bc8 00 00 00 00 00 00 00 00                 dq                        0h                                    GuardAddressTakenIatEntryCount      140011bd0 00 00 00 00 00 00 00 00                 addr                      00000000                              GuardLongJumpTargetTable      140011bd8 00 00 00 00 00 00 00 00                 dq                        0h                                    GuardLongJumpTargetCount      140011be0 00 00 00 00 00 00 00 00                 addr                      00000000                              DynamicValueRelocTable      140011be8 f8 11 01 40 01 00 00 00                 addr                      DAT\_1400111f8                         CHPEMetadataPointer                    = 02h      140011bf0 00 00 00 00 00 00 00 00                 addr                      00000000                              GuardRFFailureRoutine      140011bf8 00 00 00 00 00 00 00 00                 addr                      00000000                              GuardRFFailureRoutineFunctionPointer      140011c00 00 00 00 00                             ddw                       0h                                    DynamicValueRelocTableOffset      140011c04 00 00                                   dw                        0h                                    DynamicValueRelocTableSection      140011c06 00 00                                   dw                        0h                                    Reserved1      140011c08 00 00 00 00 00 00 00 00                 addr                      00000000                              GuardRFVerifyStackPointerFunctionPoin      140011c10 00 00 00 00                             ddw                       0h                                    HotPatchTableOffset      140011c14 00 00 00 00                             ddw                       0h                                    Reserved2      140011c18 00 00 00 00 00 00 00 00                 dq                        0h                                    Reserved3 IMAGE\_LOAD\_CONFIG\_DIRECTORY64\_140011b20   XREF[1]:   1400001c0(\*)140011b20 40 01 00 00 00 00 00 00 00 00 00 00 00       IMAGE\_LOAD\_CONFIG\_DIRECTORY64          00 00 00 00 00 00 00 00 00 00 00 00 00          00 00 00 00 00 00 00 00 00 00 00 00 00      140011b20 40 01 00 00                             ddw                       140h                                  Size                            XREF[1]:   1400001c0(\*)      140011b24 00 00 00 00                             ddw                       0h                                    TimeDateStamp      140011b28 00 00                                   dw                        0h                                    MajorVersion      140011b2a 00 00                                   dw                        0h                                    MinorVersion      140011b2c 00 00 00 00                             ddw                       0h                                    GlobalFlagsClear      140011b30 00 00 00 00                             ddw                       0h                                    GlobalFlagsSet      140011b34 00 00 00 00                             ddw                       0h                                    CriticalSectionDefaultTimeout      140011b38 00 00 00 00 00 00 00 00                 dq                        0h                                    DeCommitFreeBlockThreshold      140011b40 00 00 00 00 00 00 00 00                 dq                        0h                                    DeCommitTotalFreeThreshold      140011b48 00 00 00 00 00 00 00 00                 addr                      00000000                              LockPrefixTable      140011b50 00 00 00 00 00 00 00 00                 dq                        0h                                    MaximumAllocationSize      140011b58 00 00 00 00 00 00 00 00                 dq                        0h                                    VirtualMemoryThreshold      140011b60 00 00 00 00 00 00 00 00                 dq                        0h                                    ProcessAffinityMask      140011b68 00 00 00 00                             ddw                       0h                                    ProcessHeapFlags      140011b6c 00 00                                   dw                        0h                                    CSDVersion      140011b6e 00 00                                   dw                        0h                                    DependentLoadFlags      140011b70 00 00 00 00 00 00 00 00                 addr                      00000000                              EditList      140011b78 40 60 01 40 01 00 00 00                 addr                      DAT\_140016040                         SecurityCookie                         = 32h    2      140011b80 00 00 00 00 00 00 00 00                 dq \*                      00000000                              SEHandlerTable      140011b88 00 00 00 00 00 00 00 00                 dq                        0h                                    SEHandlerCount      140011b90 70 10 01 40 01 00 00 00                 addr                      PTR\_\_guard\_check\_icall\_140011070      GuardCFCheckFunctionPointer            = 14000b8d8      140011b98 80 10 01 40 01 00 00 00                 addr                      PTR\_\_guard\_dispatch\_icall\_140011080   GuardCFDispatchFunctionPointer         = 14000e2c0      140011ba0 00 00 00 00 00 00 00 00                 ddw \*                     00000000                              GuardCFFunctionTable      140011ba8 00 00 00 00 00 00 00 00                 dq                        0h                                    GuardCFFunctionCount      140011bb0 00 01 00 00                             IMAGE\_GUARD\_FLAGS         IMAGE\_GUARD\_CF\_INSTRUMENTED           GuardFlags      140011bb4 00 00 00 00 00 00 00 00 00 00 00 00     IMAGE\_LOAD\_CONFIG\_CODE\_I                                        CodeIntegrity      140011bc0 00 00 00 00 00 00 00 00                 addr                      00000000                              GuardAddressTakenIatEntryTable      140011bc8 00 00 00 00 00 00 00 00                 dq                        0h                                    GuardAddressTakenIatEntryCount      140011bd0 00 00 00 00 00 00 00 00                 addr                      00000000                              GuardLongJumpTargetTable      140011bd8 00 00 00 00 00 00 00 00                 dq                        0h                                    GuardLongJumpTargetCount      140011be0 00 00 00 00 00 00 00 00                 addr                      00000000                              DynamicValueRelocTable      140011be8 f8 11 01 40 01 00 00 00                 IMAGE\_ARM64EC\_METADATA\_V  IMAGE\_ARM64EC\_METADATA\_V2\_1400111f8   CHPEMetadataPointer      140011bf0 00 00 00 00 00 00 00 00                 addr                      00000000                              GuardRFFailureRoutine      140011bf8 00 00 00 00 00 00 00 00                 addr                      00000000                              GuardRFFailureRoutineFunctionPointer      140011c00 00 00 00 00                             ibo32                     NaP                                   DynamicValueRelocTableOffset      140011c04 00 00                                   dw                        0h                                    DynamicValueRelocTableSection      140011c06 00 00                                   dw                        0h                                    Reserved2      140011c08 00 00 00 00 00 00 00 00                 addr                      00000000                              GuardRFVerifyStackPointerFunctionPoin      140011c10 00 00 00 00                             ibo32                     NaP                                   HotPatchTableOffset      140011c14 00 00 00 00                             ddw                       0h                                    Reserved3      140011c18 00 00 00 00 00 00 00 00                 addr                      00000000                              EnclaveConfigurationPointer      140011c20 00 00 00 00 00 00 00 00                 addr                      00000000                              VolatileMetadataPointer      140011c28 00 00 00 00 00 00 00 00                 addr                      00000000                              GuardEHContinuationTable      140011c30 00 00 00 00 00 00 00 00                 dq                        0h                                    GuardEHContinuationCount      140011c38 78 10 01 40 01 00 00 00                 addr                      PTR\_\_guard\_check\_icall\_140011078      GuardXFGCheckFunctionPointer           = 14000b8d8      140011c40 88 10 01 40 01 00 00 00                 addr                      PTR\_LAB\_140011088                     GuardXFGDispatchFunctionPointer        = 14000e2e0      140011c48 90 10 01 40 01 00 00 00                 addr                      PTR\_LAB\_140011090                     GuardXFGTableDispatchFunctionPointer   = 14000e2e0      140011c50 98 10 01 40 01 00 00 00                 addr                      DAT\_140011098                         CastGuardOsDeterminedFailureMode      140011c58 a0 10 01 40 01 00 00 00                 addr                      PTR\_LAB\_1400110a0                     GuardMemcpyFunctionPointer             = 14000e080 The layout of this structure – exposed in LIEF through the `lief.PE.LoadConfiguration` ( [`lief::pe::LoadConfiguration`]() ; [`lief.PE.LoadConfiguration`]() ; [`LIEF::PE::LoadConfiguration`]() ) interface – evolves frequently across new Windows releases. As of today, Ghidra does not natively recognize many of the newer attributes introduced in recent versions. By running this analyzer, you obtain a more complete and accurate representation of these attributes along with their correct data types. Beyond the Load Configuration, the analyzer also defines additional structures, such as `lief.PE.CHPEMetadataARM64` ( [`lief::pe::chpe_metadata_arm64::CHPEMetadata`]() ; [`lief.PE.CHPEMetadataARM64`]() ; [`LIEF::PE::CHPEMetadataARM64`]() ), which provide valuable context for analyzing ARM64EC binaries. These definitions make it easier to interpret the purpose of certain functions and pointers, leading to deeper insights during reverse engineering. DAT\_1400111f8                             XREF[1]:   140011be8(\*)1400111f8 02                                           ??                                                   02h1400111f9 00                                           ??                                                   00h1400111fa 00                                           ??                                                   00h1400111fb 00                                           ??                                                   00h1400111fc 00                                           ??                                                   00h1400111fd 1e                                           ??                                                   1Eh1400111fe 01                                           ??                                                   01h1400111ff 00                                           ??                                                   00h140011200 02                                           ??                                                   02h140011201 00                                           ??                                                   00h140011202 00                                           ??                                                   00h140011203 00                                           ??                                                   00h140011204 b4                                           ??                                                   B4h140011205 1c                                           ??                                                   1Ch140011206 01                                           ??                                                   01h140011207 00                                           ??                                                   00h140011208 00                                           ??                                                   00h140011209 90                                           ??                                                   90h14001120a 01                                           ??                                                   01h14001120b 00                                           ??                                                   00h14001120c 00                                           ??                                                   00h14001120d 10                                           ??                                                   10h14001120e 01                                           ??                                                   01h14001120f 00                                           ??                                                   00h140011210 08                                           ??                                                   08h140011211 10                                           ??                                                   10h140011212 01                                           ??                                                   01h140011213 00                                           ??                                                   00h140011214 18                                           ??                                                   18h IMAGE\_ARM64EC\_METADATA\_V2\_1400111f8       XREF[1]:   140011be8(\*)1400111f8 02 00 00 00 00 1e 01 00 02 00 00 00 b4       IMAGE\_ARM64EC\_METADATA\_V2          1c 01 00 00 90 01 00 00 10 01 00 08 10          01 00 18 10 01 00 10 10 01 00 20 10 01      1400111f8 02 00 00 00 00 1e 01 00 02 00 00 00 b4  IMAGE\_ARM64EC\_METADATA                                                                              V1                1c 01 00 00 90 01 00 00 10 01 00 08 10                01 00 18 10 01 00 10 10 01 00 20 10 01         1400111f8 02 00 00 00                             ddw                2h                                                             Version         1400111fc 00 1e 01 00                             ibo32              IMAGE\_ARM64EC\_METADATA\_CODE\_RANGE\_ARRAY\_140011e00              CodeMap         140011200 02 00 00 00                             ddw                2h                                                             CodeMapCount         140011204 b4 1c 01 00                             ibo32              IMAGE\_ARM64EC\_CODE\_RANGE\_ENTRY\_POINT\_ARRAY\_140011cb4           CodeRangesToEntryPoints         140011208 00 90 01 00                             ibo32              IMAGE\_ARM64EC\_METADATA\_REDIRECTION\_ARRAY\_140019000             RedirectionMetadata         14001120c 00 10 01 00                             ibo32              DAT\_140011000                                                  \_\_os\_arm64x\_dispatch\_call\_no\_redirect         140011210 08 10 01 00                             ibo32              DAT\_140011008                                                  \_\_os\_arm64x\_dispatch\_ret         140011214 18 10 01 00                             ibo32              DAT\_140011018                                                  \_\_os\_arm64x\_dispatch\_call         140011218 10 10 01 00                             ibo32              PTR\_DAT\_140011010                                              \_\_os\_arm64x\_dispatch\_icall         14001121c 20 10 01 00                             ibo32              PTR\_DAT\_140011020                                              \_\_os\_arm64x\_dispatch\_icall\_cfg         140011220 00 00 00 00                             ibo32              NaP                                                            AlternateEntryPoint         140011224 00 50 01 00                             ibo32              PTR\_DAT\_140015000                                              AuxiliaryIAT         140011228 01 00 00 00                             ddw                1h                                                             CodeRangesToEntryPointsCount         14001122c 01 00 00 00                             ddw                1h                                                             RedirectionMetadataCount         140011230 28 10 01 00                             ibo32              DAT\_140011028                                                  GetX64InformationFunctionPointer         140011234 30 10 01 00                             ibo32              DAT\_140011030                                                  SetX64InformationFunctionPointer         140011238 00 70 01 00                             ibo32              IMAGE\_ARM64\_RUNTIME\_FUNCTION\_UNPACKED\_ENTRY\_140017000          ExtraRFETable         14001123c 38 0d 00 00                             ddw                D38h                                                           ExtraRFETableSize         140011240 38 10 01 00                             ibo32              DAT\_140011038                                                  \_\_os\_arm64x\_dispatch\_fptr         140011244 48 3e 01 00                             ibo32              PTR\_DAT\_140013e48                                              AuxiliaryIATCopy      140011248 00 00 00 00                             ibo32              NaP                                                            AuxDelayloadIAT      14001124c 00 00 00 00                             ibo32              NaP                                                            AuxDelayloadIATCopy      140011250 00 00 00 00                             ddw                0h                                                             ReservedBitField > **BinaryNinja** > > BinaryNinja’s LIEF plugin also provides this support: [LoadConfiguration]() --- documentID: "01cf8dd1873b0e85aef074f4e924dd6358b738d556322084c63dfea1123eb354" docname: "plugins/ghidra/dwarf/index" title: "Ghidra - DWARF Plugin - LIEF Documentation" description: "Ghidra - DWARF Plugin. This functionality exports Ghidra’s program information into a DWARF file. This exported information includes function names, types…" canonical: "https://lief.re/doc/latest/plugins/ghidra/dwarf/index.html" markdownURL: "https://lief.re/doc/latest/plugins/ghidra/dwarf/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "daf42e004e40e15856e6516aa5aa2cb831cad63e81ed563c7547707bc5acf99b" --- # [Ghidra - DWARF Plugin]() ## [Export as DWARF]() This functionality exports Ghidra’s program information into a DWARF file. This exported information includes function names, types, stack variables, etc. You can use this extension in different ways as documented below: ### [Project Manager]() This extension provides a DWARF exporter that can be used by right-clicking on the binary to export, then: `Export > Format > DWARF`: ![Ghidra DWARF exporter](https://lief.re/doc/latest/_static/ghidra/project-dwarf-export.webp) ### [CodeBrowser]() From the `CodeBrowser` tool, you can left-click on the LIEF menu and select `Export as DWARF`: ![Ghidra DWARF exporter](https://lief.re/doc/latest/_static/ghidra/codebrowser-export-dwarf.webp) ### [Scripts]() You can also use the Java API from a (headless) script to export a given Ghidra program: ```java import lief.ghidra.core.dwarf.export.Manager; import lief.ghidra.core.NativeBridge; public class LiefDwarfExportScript extends GhidraScript { @Override protected void run() throws Exception { NativeBridge.init(); Manager manager = new Manager(currentProgram); File output = new File("/home/romain/output.dwarf"); manager.export(output); } } ``` ### [Support & Limitations]() This extension tries to convert as much as possible of Ghidra’s internal binary representation into DWARF structures, but this support is not exhaustive; here is an overview of what is and is not exported. **ghidra.program.model.listing.Program** - Function - Data Variables - Types - Comments **ghidra.program.model.listing.Function** - Name - Address range - Parameters - Type of parameters - Return type - Stack variables - Types of stack variables - Comments - CodeUnits **ghidra.program.model.listing.Data** - Name - Type - Address - Comments **ghidra.program.model.data.DataType** - `ghidra.program.model.data.VoidDataType` - `ghidra.program.model.data.AbstractIntegerDataType` - `ghidra.program.model.data.Array` - `ghidra.program.model.data.TypeDef` - `ghidra.program.model.data.Composite` - `ghidra.program.model.data.Enum` - `ghidra.program.model.data.FunctionDefinition` - `ghidra.program.model.data.Pointer` Any types not mentioned here are not supported. ### [References]() [https://github.com/NationalSecurityAgency/ghidra/issues/2687]() --- documentID: "349548b961a1ec298a7a64f8f93fb90e02c7306ba2c6923e054d2d69a6ee7b85" docname: "plugins/ghidra/index" title: "Ghidra - LIEF Documentation" description: "Similar to the BinaryNinja plugin, LIEF can be used as a Ghidra plugin." canonical: "https://lief.re/doc/latest/plugins/ghidra/index.html" markdownURL: "https://lief.re/doc/latest/plugins/ghidra/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "c9172ae37226989126ebac5ea0ba4ecce9baf29b194618c96092f74c55059115" --- # [Ghidra]() --- ![Ghidra with LIEF](https://lief.re/doc/latest/_static/lief_with_ghidra.webp) Similar to the [BinaryNinja plugin](), LIEF can be used as a Ghidra plugin. Features - [Ghidra - DWARF Plugin]() - [Ghidra - Analyzers - `IMAGE_LOAD_CONFIG_DIRECTORY`]() - [Ghidra - Analyzers - Exceptions]() Downloads - [ghidra\_11.3.2\_PUBLIC\_LIEF.zip]() - [ghidra\_11.4.2\_PUBLIC\_LIEF.zip]() - [ghidra\_11.4\_PUBLIC\_LIEF.zip]() - [ghidra\_12.0\_PUBLIC\_LIEF.zip]() ## [Installation]() First, download the LIEF plugin package from [https://lief.s3.fr-par.scw.cloud/latest/plugins/index.html]() or from the packages listed above. Then, follow the official procedure to install extensions: [GhidraDocs/GettingStarted.md]() > **Shared Library** > > In addition to the previously installed package, the plugins require the installation of `LIEF.dll`, `libLIEF.dylib`, or `libLIEF.so` next to the extension directory. You can download this library from the following list: > > SDK > > - [LIEF-1.0.0-Darwin-arm64.tar.gz]() > - [LIEF-1.0.0-Darwin-x86\_64.tar.gz]() > - [LIEF-1.0.0-Linux-x86\_64.tar.gz]() > - [LIEF-1.0.0-win64.zip]() > - [LIEF-2.0.0-Darwin-arm64.tar.gz]() > - [LIEF-2.0.0-Darwin-x86\_64.tar.gz]() > - [LIEF-2.0.0-Linux-x86\_64.tar.gz]() > - [LIEF-2.0.0-win64.zip]() > > or from here: [https://lief.s3.fr-par.scw.cloud/latest/sdk/index.html](). Some plugins (like the [DWARF Plugin]()) require the extended version, which can be downloaded from [https://extended.lief.re/](). > > Given this shared library, you must copy it into the Ghidra settings directory. For instance: > > - macOS: `~/Library/ghidra/ghidra_11.3.2_PUBLIC/Extensions/libLIEF.dylib` > - Linux: `~/.config/ghidra/ghidra_11.3.2_PUBLIC/Extensions/libLIEF.so` > - Windows: `C:\Users\romain\AppData\Roaming\ghidra\ghidra_11.3.2_PUBLIC\Extensions\LIEF.dll` > - Windows: `%APPDATA%\ghidra\ghidra_11.3.2_PUBLIC\Extensions\LIEF.dll` You can verify that the plugin is correctly installed by opening the `CodeBrowser` tool on a binary and ensuring that you can see the LIEF configuration in `File > Configure` (**from the CodeBrowser, not the projects window**). Alternatively, you can try running the headless script: `LiefVersionInfoScript.java`, which should output information about the installed version. ## [Troubleshooting]() **Couldn’t find the native library** This means that `libLIEF.so`, `libLIEF.dylib`, or `LIEF.dll` is not correctly installed in the `Extensions/` directory. The details of the error provide the expected path(s). ![Ghidra native library issue](https://lief.re/doc/latest/_static/cant-find-lib.png) **This feature requires LIEF extended** This error means that you need to install the extended version of the shared library. See the [extended section]() for more information. **libLIEF.dylib can’t be opened because Apple cannot check it for malicious software** `libLIEF.dylib` is self-signed and does not use an Apple certificate. Therefore, it is considered as coming from an *unknown developer*. You can address this issue in different ways: 1. You can compile `libLIEF.dylib` yourself and sign the compiled library with your certificate. 2. You can add a security exception as described here: [https://support.apple.com/guide/mac-help/apple-cant-check-app-for-malicious-software-mchleab3a043/mac]() ![macOS library loading issue](https://lief.re/doc/latest/_static/macos-dylib-issue.png) --- documentID: "2a820abed77a29731856683ed7295df4bb2470c90a40b8a1873cb5529a286191" docname: "references" title: "References - LIEF Documentation" description: "References reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/references.html" markdownURL: "https://lief.re/doc/latest/references.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "b9eb8d06b0924e9e15b6bbb6115403c233241ba2356c3de7efa8faab2297d7dd" --- # [References]() ## [Blog Posts & White Papers]() - 2021-06-03: [QBDL: Quarkslab Dynamic Loader]() - 2021-04-27: [An Empirical Evaluation of Automated Machine Learning Techniques for Malware Detection - IWSPA 21]() - 2021-01-25: [Static PE antimalware evasion - Francisco Javier Gomez Galvez]() - 2020-10-23: [[Write-up] Using a PIE binary as a Shared Library: HCSC-2020 CTF Writeup]() by [István Tóth]() - 2020-02-04: [x0rro: A PE/ELF/MachO Crypter for x86 and x86\_64 Based on Radare2 by phra]() - 2019-11-01: [Isolating the logic of an encrypted protocol with LIEF and kaitai]() by [@TheXC3LL]() - 2018-10-26: [[Write-up] HITCON 2018 - Unexecutable]() by [Andrew Wesie]() - 2018-10-06: [[Write-up] Flare-on Challenge (Level 3)]() - 2018-09-30: [Write-up] DragonCTF-Teaser-Brutal Oldskull by z3r0s - 2018-09-07: [Using a non-system glibc]() by [Ayrx]() - 2018-07-02: [PWN problem patch method commonly used in competition]() - 2018-05-03: [When SideChannelMarvels meet LIEF]() - 2018-03-11: [Fuzzing Arbitrary Functions in ELF Binaries]() - 2018-02-01: [Dissecting Mobile Native Code Packers Case Study]() - 2017-11-02: [Have Fun With LIEF and Executable Formats]() - 2017-04-04: [LIEF Library to Instrument Executable Formats]() ## [Projects using LIEF]() | Name | Language | Link | Topic | Summary | | --- | --- | --- | --- | --- | | shrinkwrap | Python | [https://github.com/fzakaria/shrinkwrap]() | ELF | A tool that embeds required dependencies into top-level executables | | sqlelf | Python | [https://github.com/fzakaria/sqlelf]() | ELF Analysis | Explore ELF objects through the power of SQL | | Maat | Python/C++ | [https://maat.re/]() | Symbolic Execution | Symbolic Execution Framework based on Ghidra’s sleigh | | QBDL | Python/C++ | [https://github.com/quarkslab/QBDL]() | Binary Loader | QBDI aims to provide a modular and portable way to dynamically load and link binaries. | | BLint | Python | [https://git.sr.ht/~prabhu/blint]() | Static Analysis | A binary linter for checking security properties and capabilities in executables | | Datalog Disassembly | C++ | [https://github.com/GrammaTech/ddisasm]() | Binary Analysis | DDisasm is a fast disassembler which is accurate enough for the resulting assembly code to be reassembled. DDisasm is implemented using the datalog (souffle) declarative logic programming language to compile disassembly rules and heuristics | | Mobile-Security-Framework-MobSF | Python | [https://github.com/MobSF/Mobile-Security-Framework-MobSF]() | Mobile Analysis | Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. | | checksec.py | Python | [https://github.com/Wenzel/checksec.py]() | Static Analysis | A simple tool to verify the security properties of your binaries. These properties can be enabled by your compiler to enforce the security of your executables, and mitigate exploitation | | youarespecial | Python | [https://github.com/endgameinc/youarespecial]() | Machine Learning | Machine learning models on malware | | gym-malware | Python | [https://github.com/endgameinc/gym-malware]() | Machine Learning | Learn how to bypass AV through machine learning. | | MISP | Python | [https://github.com/MISP/MISP]() | Malware | Malware Information Sharing Platform and Threat Sharing | | Virus Disinfector KIT | Python | [https://github.com/Fare9/Virus\_Disinfector\_KIT]() | Malware | A tool for disinfecting PE files | | lief-sys | Rust | [https://github.com/tathanhdinh/lief-sys]() | Binding | Rust binding for LIEF | | Ledger-Donjon/rainbow | Python | [https://github.com/Ledger-Donjon/rainbow]() | Dynamic Analysis | Trace generator based on Unicorn and LIEF as loader. | | smda | Python | [https://github.com/danielplohmann/smda]() | Static Analysis | Recursive disassembler using LIEF as ELF and PE loader | | conan-io/hooks | Python | [binary-linter.py]() | Static Analysis | Binary linter | | Wiggle | Python | [https://github.com/ChiChou/wiggle]() | Binary search engine | An executable binary metadata search engine. | | ANBU | C++ | [https://github.com/Fare9/ANBU]() | Unpacking | Automatic New Binary Unpacker with PIN DBI Framework | ## [Similar Projects]() | Name | Language | Link | | --- | --- | --- | | filebytes | Python | [https://github.com/sashs/filebytes]() | | angr/cle | Python | [https://github.com/angr/cle]() | | pypeelf | Python | [https://github.com/crackinglandia/pypeelf]() | | object | Rust | [https://github.com/gimli-rs/object]() | | Goblin | Rust | [https://github.com/m4b/goblin]() | ## [Parsers/Modifiers]() ### [ELF]() | Name | Language | Link | | --- | --- | --- | | pyelftools | Python | [https://github.com/eliben/pyelftools]() | | pylibelf | Python | [https://github.com/crackinglandia/pylibelf]() | | pydevtools | Python | [https://github.com/arowser/pydevtools]() | | elfparser | C++ ? | [http://elfparser.com/index.html]() | | libelf | C | hxxp://www.mr511.de/software/ | | elfio | C++ | [http://elfio.sourceforge.net/]() | | radare2 | C/Python | [https://github.com/radare/radare2/tree/master/libr/bin/format/elf]() | | node-elf | node.js | [https://github.com/sifteo/node-elf]() | | readelf | C | [https://github.com/bminor/binutils-gdb/blob/master/binutils/readelf.c]() | | elfesteem | Python | [https://github.com/LRGH/elfesteem]() | | elfsharp | C# | hxxp://elfsharp.hellsgate.pl/index.shtml | | metasm | Ruby | [https://github.com/jjyg/metasm]() | | amoco | Python | [https://github.com/bdcht/amoco]() | | Goblin | Rust | [https://github.com/m4b/goblin]() | | Mithril | Ruby | [https://github.com/jbangert/mithril]() | | ELFkickers | C | [http://www.muppetlabs.com/~breadbox/software/elfkickers.html]() | | libelfmaster | C | [https://github.com/elfmaster/libelfmaster]() | | libelf.js | JS | [https://github.com/AlexAltea/libelf.js]() | | elfy.io | JS ? | [https://elfy.io/]() | | elfhash | C | [https://github.com/cjacker/elfhash]() | ### [PE]() | Name | Language | Link | | --- | --- | --- | | pefiles | Python | [https://github.com/erocarrera/pefile]() | | radare2 | C | [https://github.com/radare/radare2/tree/master/libr/bin/format/pe]() | | PE.Explorer | C++/C# ? | [http://www.pe-explorer.com/]() | | CFF Explorer | C++/C# ? | [http://www.ntcore.com/exsuite.php]() | | PE Browser 64 | C++/C# ? | http://www.smidgeonsoft.prohosting.com/pebrowse-pro-file-viewer.html | | PE View | C++/C# ? | [http://wjradburn.com/software/]() | | FileAlyzer | C++/C# ? | [https://www.safer-networking.org/products/filealyzer/]() | | PE Studio | C++/C# ? | [https://www.winitor.com/]() | | PEDumper | C | [https://github.com/maldevel/PEdumper]() | | PE Parse | C++/Python | [https://github.com/trailofbits/pe-parse]() | | PEParse | C# | [https://github.com/DKorablin/PEReader]() | | PE Bliss | C++ | [https://github.com/BackupGGCode/portable-executable-library]() | | PE Net | .NET | [https://github.com/secana/PeNet]() | | libpe | C++ | [https://github.com/evilsocket/libpe/tree/master/libpe]() | | elfesteem | Python | [https://github.com/LRGH/elfesteem]() | | pelook | C ? | [http://bytepointer.com/tools/index.htm#pelook]() | | PortEx | Java | [https://github.com/struppigel/PortEx]() | | metasm | Ruby | [https://github.com/jjyg/metasm]() | | amoco | Python | [https://github.com/bdcht/amoco]() | | Goblin | Rust | [https://github.com/m4b/goblin]() | ### [Mach-O]() | Name | Language | Link | | --- | --- | --- | | radare2 | C | [https://github.com/radare/radare2/tree/master/libr/bin/format/mach0]() | | MachO-Kit | C/ObjC | [https://github.com/DeVaukz/MachO-Kit]() | | optool | ObjC | [https://github.com/alexzielenski/optool]() | | macho\_edit | C++ | [https://github.com/Tyilo/macho\_edit]() | | macholib | Python | [https://pypi.org/project/macholib/]() | | elfsharp | C# | http://elfsharp.hellsgate.pl/index.shtml | | elfesteem | Python | [https://github.com/LRGH/elfesteem]() | | metasm | Ruby | [https://github.com/jjyg/metasm]() | | Goblin | Rust | [https://github.com/m4b/goblin]() | | MachOView | ObjC | [https://github.com/gdbinit/MachOView]() | | XMachOViewer | C++ | [https://github.com/horsicq/XMachOViewer]() | ## [Tools]() | Name | Language | Link | Format | Summary | | --- | --- | --- | --- | --- | | Dress | Python | [https://github.com/docileninja/dress]() | ELF | Adds static symbols | | objconv | C++ | [https://www.agner.org/optimize/#objconv]() | ELF/PE/MachO | Format converter | | PEDetour | C++ | [https://github.com/chen-charles/PEDetour]() | PE | Hook exported functions | | python-elf | Python | [https://github.com/tbursztyka/python-elf]() | ELF | ELF binary format manipulation tool | | PEDetour | C++ | [https://github.com/chen-charles/PEDetour]() | PE | Hook exported functions | | libmaelf | C | [https://github.com/tiago4orion/libmalelf]() | ELF | A library for dissecting and infecting ELF binaries. | | peinjector | C | [https://github.com/JonDoNym/peinjector]() | PE | MITM PE file infector | | backdoor factory | C++ | [https://github.com/secretsquirrel/the-backdoor-factory]() | ELF/PE/MachO | Patch PE, ELF, Mach-O binaries with shellcode | | RePEconstruct | C | [https://github.com/DavidKorczynski/RePEconstruct]() | PE | PE Unpacker | | patchkit | Python | [https://github.com/lunixbochs/patchkit]() | ELF | Patch binary | | unstrip | Python | [https://github.com/pzread/unstrip]() | ELF | Unstrip static binary | | sym2elf | Python | [https://github.com/danigargu/syms2elf]() | ELF | Exports IDA symbols to the original binary | | elfhash | C | [https://github.com/cjacker/elfhash]() | ELF | Manipulate ELF’s hash | | recomposer | Python | [https://github.com/secretsquirrel/recomposer]() | PE | Modifies parts of a PE file to bypass antivirus software | | bearparser | C++ | [https://github.com/hasherezade/bearparser]() | PE | Portable Executable parsing library with a GUI | | IAT patcher | C++ | [http://hasherezade.github.io/IAT\_patcher]() | PE | IAT hooking application | | PEframe | Python | [https://github.com/guelfoweb/peframe]() | PE | PE Static analyzer | | Manalyze | C++ | [https://github.com/JusticeRage/Manalyze]() | PE | PE Static analyzer | | elf-dissector | C++ | [https://github.com/KDE/elf-dissector]() | ELF | Tool to inspect ELF files | | InfectPE | C++ | [https://github.com/secrary/InfectPE]() | PE | Inject code into PE file | | termux-elf-cleaner | C++ | [https://github.com/termux/termux-elf-cleaner]() | ELF | Utility to remove unused ELF sections causing warnings. | | vdexExtractor | C | [https://github.com/anestisb/vdexExtractor]() | VDEX | Extract DEX from VDEX | | insert\_dylib | C | [https://github.com/Tyilo/insert\_dylib]() | Mach-O | Insert a dylib load command | | optool | Obj-C | [https://github.com/alexzielenski/optool]() | Mach-O | Modify Mach-O commands: Resign, insert commands, … | | reflective- polymorphism | C | [https://github.com/zeroSteiner/reflective-polymorphism]() | PE | Transform PE files between EXE and DLL | | XELFViewer | C++/Qt | [https://github.com/horsicq/XELFViewer]() | ELF | ELF file viewer/editor for Windows, Linux and macOS. | | strongarm | Python | [https://github.com/datatheorem/strongarm]() | Mach-O | Cross-platform ARM64 Mach-O analysis library | --- documentID: "c90d16332011753cba6aa033d11d168f06a93834fe38b200999652c405d286d2" docname: "runtime/components/host" title: "Host - Runtime - LIEF Documentation" description: "Query the hostname, user directories, and platform-specific host information with the LIEF runtime API." canonical: "https://lief.re/doc/latest/runtime/components/host.html" markdownURL: "https://lief.re/doc/latest/runtime/components/host.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "f33eac6c41ce365ab1a851ea6f167c54691ce497d05974b420c92cd1bc5ebb73" --- # [Host]() The `lief.runtime.Host` ( [`lief::runtime::Host`]() ; [`lief.runtime.Host`]() ; [`LIEF::runtime::Host`]() ) interface exposes an API to query information about the host on which LIEF is running. It provides a cross-platform API for common values like the hostname and user directories for configuration, cache, and temporary files. Use [Process]() for process-specific information such as the PID and page size. ## [Cross-platform]() The following snippet illustrates how to retrieve the generic host information that is available on every supported platform: **Python** ```python print(f" Hostname: {lief.runtime.Host.name}") print(f" Home: {lief.runtime.Host.home_dir}") print(f" cache: {lief.runtime.Host.cache_dir}") print(f" temp: {lief.runtime.Host.tmp_dir}") print(f" config: {lief.runtime.Host.config_dir}") ``` **C++** ```cpp info(" Hostname: {}", LIEF::runtime::Host::name()); info(" Home: {}", LIEF::runtime::Host::home_dir()); info(" Cache: {}", LIEF::runtime::Host::cache_dir()); info(" Temp: {}", LIEF::runtime::Host::tmp_dir()); info(" Config: {}", LIEF::runtime::Host::config_dir()); ``` **Rust** ```rust println!(" Hostname: {}", runtime::Host::name()); println!(" Home: {}", runtime::Host::home_dir()); println!(" Cache: {}", runtime::Host::cache_dir()); println!(" Temp: {}", runtime::Host::tmp_dir()); println!(" Config: {}", runtime::Host::config_dir()); ``` ## [Linux]() The `lief.runtime.linux.Host` ( [`lief::runtime::linux::Host`]() ; [`lief.runtime.linux.Host`]() ; [`LIEF::runtime::Linux::Host`]() ) interface exposes Linux-specific host information: **Python** ```python print(f" sys_name: {lief.runtime.linux.Host.sys_name}") print(f" sys_release: {lief.runtime.linux.Host.sys_release}") print(f" sys_version: {lief.runtime.linux.Host.sys_version}") print(f" hardware: {lief.runtime.linux.Host.hardware}") ``` **C++** ```cpp info(" sys_name: {}", LIEF::runtime::Linux::Host::sys_name()); info(" sys_release: {}", LIEF::runtime::Linux::Host::sys_release()); info(" sys_version: {}", LIEF::runtime::Linux::Host::sys_version()); info(" hardware: {}", LIEF::runtime::Linux::Host::hardware()); ``` **Rust** ```rust println!(" sys_name: {}", runtime::linux::Host::sys_name()); println!(" sys_release: {}", runtime::linux::Host::sys_release()); println!(" sys_version: {}", runtime::linux::Host::sys_version()); println!(" hardware: {}", runtime::linux::Host::hardware()); ``` ## [Windows]() The `lief.runtime.windows.Host` ( [`lief::runtime::windows::Host`]() ; [`lief.runtime.windows.Host`]() ; [`LIEF::runtime::windows::Host`]() ) interface exposes Windows-specific host information such as the operating system version ( `lief.runtime.windows.Host.version()` ( [`lief::runtime::windows::Host::version`]() ; [`lief.runtime.windows.Host.version`]() ; [`LIEF::runtime::windows::Host::version()`]() )): **Python** ```python print(f" Version: {lief.runtime.windows.Host.version}") ``` **C++** ```cpp info(" Version: {}", LIEF::runtime::windows::Host::version().to_string()); ``` **Rust** ```rust if let Some(version) = runtime::windows::Host::version() { println!(" Version: {}", version); } ``` ## [macOS]() The `lief.runtime.osx.Host` ( [`lief::runtime::osx::Host`]() ; [`lief.runtime.osx.Host`]() ; [`LIEF::runtime::osx::Host`]() ) interface exposes macOS-specific host information such as whether System Integrity Protection is enabled ( `lief.runtime.osx.Host.is_sip_enabled` ( [`lief::runtime::osx::Host::is_sip_enabled`]() ; [`lief.runtime.osx.Host.is_sip_enabled`]() ; [`LIEF::runtime::osx::Host::is_sip_enabled()`]() )): **Python** ```python print(f" Version: {lief.runtime.osx.Host.os_version_name}") sip = "enabled" if lief.runtime.osx.Host.is_sip_enabled else "disabled" print(f" SIP: {sip}") ``` **C++** ```cpp info(" Version: {}", LIEF::runtime::osx::Host::os_version_name()); info(" SIP: {}", LIEF::runtime::osx::Host::is_sip_enabled() ? "enabled" : "disabled"); ``` **Rust** ```rust println!(" Version: {}", runtime::osx::Host::os_version_name()); println!( " SIP: {}", if runtime::osx::Host::is_sip_enabled() { "enabled" } else { "disabled" } ); ``` ## [Android]() The `lief.runtime.android.Host` ( [`lief::runtime::android::Host`]() ; [`lief.runtime.android.Host`]() ; [`LIEF::runtime::android::Host`]() ) interface exposes Android-specific host information such as the device’s SDK/API level ( `lief.runtime.android.Host.sdk_version()` ( [`lief::runtime::android::Host::sdk_version`]() ; [`lief.runtime.android.Host.sdk_version`]() ; [`LIEF::runtime::android::Host::sdk_version()`]() )): **Python** ```python if (sdk := lief.runtime.android.Host.sdk_version) is not None: print(f" SDK: {sdk}") ``` **C++** ```cpp if (auto sdk = LIEF::runtime::android::Host::sdk_version()) { info(" SDK: {}", std::to_string(*sdk)); } ``` **Rust** ```rust if let Some(sdk) = runtime::android::Host::sdk_version() { println!(" SDK: {}", sdk); } ``` --- documentID: "baf3482e620831c80bc16a442923dd32905c8a97813042559b3f9b23106b79e0" docname: "runtime/components/memory" title: "Memory - Runtime - LIEF Documentation" description: "Allocate, read, write, and release process memory with LIEF, then explore platform-specific assembly and disassembly examples." canonical: "https://lief.re/doc/latest/runtime/components/memory.html" markdownURL: "https://lief.re/doc/latest/runtime/components/memory.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "d6899b5ee6de81122fe70ea176f4af441dd38887daedfc202d8c7e22bb2af10f" --- # [Memory]() The `lief.runtime.Memory` ( [`lief::runtime::Memory`]() ; [`lief.runtime.Memory`]() ; [`LIEF::runtime::Memory`]() ) interface exposes an API to allocate, inspect and manipulate memory in the current process. It can be used to map anonymous pages, change their protection, and read or write bytes at valid mapped addresses. ## [Allocate, write, and read memory]() Start with a writable allocation and release it when finished. This Python example uses the process’s page size and checks whether allocation succeeded: ```python import lief from lief.runtime import Memory, Process if not lief.runtime.enabled: raise RuntimeError("Install or build LIEF with runtime support") chunk = Memory.mmap( Process.page_size, Memory.ANONYMOUS | Memory.PRIVATE, Memory.READ | Memory.WRITE, ) if chunk is None: raise RuntimeError("Memory allocation failed") try: message = b"LIEF runtime" Memory.write(message, chunk.addr) print(Memory.read(chunk.addr, len(message))) finally: chunk.deallocate() ``` The allocation is represented by a `lief.runtime.Memory.Chunk` ( [`lief::runtime::memory::Chunk`]() ; [`lief.runtime.Memory.Chunk`]() ; [`LIEF::runtime::Memory::Chunk`]() ). If placement matters, `lief.runtime.Memory.mmap_hint()` ( [`lief::runtime::Memory::mmap_hint`]() ; [`lief.runtime.Memory.mmap_hint()`]() ; [`LIEF::runtime::Memory::mmap_hint()`]() ) accepts a preferred address. Always use the address in the returned chunk: a hint does not guarantee the requested location. ## [Generate and inspect code]() Combined with `lief.runtime.assemble()` ( [`lief::runtime::assemble`]() ; [`lief::runtime::assemble_with_config`]() ; [`lief.runtime.assemble()`]() ; [`LIEF::runtime::assemble()`]() ), it enables lightweight JIT code generation directly from LIEF, while `lief.runtime.disassemble()` ( [`lief::runtime::disassemble`]() ; [`lief.runtime.disassemble()`]() ; [`LIEF::runtime::disassemble()`]() ) can be used to disassemble code directly from memory. ### [Linux x86-64]() The following snippet allocates a writable and executable page, assembles a small x86-64 stub inside it that prints `LIEF Runtime Extended Demo`, calls the resulting function, and rewrites part of the buffer before invoking it again: **Python** ```python chunk = lief.runtime.Memory.mmap( lief.runtime.Process.page_size, lief.runtime.Memory.ANONYMOUS | lief.runtime.Memory.PRIVATE, lief.runtime.Memory.READ | lief.runtime.Memory.WRITE | lief.runtime.Memory.EXEC, ) raw_inst = lief.runtime.assemble( chunk.addr, r""" .global _start .text _start: push 1 pop rax mov edi, eax lea rsi, [rip + msg] mov rdx, 28 syscall ret msg: .ascii "LIEF Runtime Extended Demo\n" """, ) # Ensure the assembly is correctly JITed at the beginning of the allocated # memory for inst in islice(lief.runtime.disassemble(chunk.addr), 7): print(inst) # Dump as raw bytes raw_bytes = lief.runtime.Memory.read(chunk.addr, len(raw_inst)) print(raw_bytes.hex(":")) # Change the permission to R-X chunk.make_rx() VoidVoidFunc = ctypes.CFUNCTYPE(None) # void(*)() hello_jit = VoidVoidFunc(chunk.addr) hello_jit() # Change the message pos = raw_bytes.find(b"LIEF Runtime") chunk.make_rw() lief.runtime.Memory.write(b"Hello Python ctypes World!\n", chunk.addr + pos) chunk.make_rx() # Print again hello_jit() # Don't miss good practices! chunk.deallocate() ``` **C++** ```cpp using Mem = LIEF::runtime::Memory; auto chunk = Mem::mmap(LIEF::runtime::Process::page_size(), Mem::MP_ANONYMOUS | Mem::MP_PRIVATE, Mem::P_READ | Mem::P_WRITE | Mem::P_EXEC); if (!chunk) { return; } std::vector raw_inst = LIEF::runtime::assemble(chunk->addr(), R"asm( .global _start .text _start: push 1 pop rax mov edi, eax lea rsi, [rip + msg] mov rdx, 28 syscall ret msg: .ascii "LIEF Runtime Extended Demo\n" )asm"); // Change the permission to R-X and invoke the JITed function chunk->make_rx(); using shellcode_t = void (*)(); auto hello_jit = reinterpret_cast(chunk->addr()); hello_jit(); const char new_msg[] = "Hello C++ runtime World!\n\0"; std::string_view view_inst(reinterpret_cast(raw_inst.data()), raw_inst.size()); size_t pos = view_inst.find("LIEF Runtime Extended"); assert(pos != std::string_view::npos); chunk->make_rw(); Mem::write(reinterpret_cast(new_msg), sizeof(new_msg) - 1, chunk->addr() + pos); chunk->make_rx(); hello_jit(); // Don't miss good practices! (void)chunk->deallocate(); ``` **Rust** ```rust let mut chunk = match runtime::Memory::mmap( runtime::Process::page_size() as u64, MmapFlags::ANONYMOUS | MmapFlags::PRIVATE, Perm::READ | Perm::WRITE | Perm::EXEC, ) { Some(c) => c, None => return, }; let raw_inst = runtime::assemble( chunk.addr(), r#" .global _start .text _start: push 1 pop rax mov edi, eax lea rsi, [rip + msg] mov rdx, 28 syscall ret msg: .ascii "LIEF Runtime Extended Demo\n" "#, ); // Dump the generated instruction bytes println!( "{} bytes assembled at {:#010x}", raw_inst.len(), chunk.addr() ); // Change the permission to R-X and invoke the JITed function chunk.make_rx(); let hello_jit: unsafe extern "C" fn() = unsafe { std::mem::transmute(chunk.addr() as usize) }; unsafe { hello_jit() }; // Locate the message in the generated bytes and rewrite it. let needle = b"LIEF Runtime"; if let Some(msg_off) = raw_inst.windows(needle.len()).position(|w| w == needle) { let new_msg = b"Hello Rust runtime World!\n\0"; chunk.make_rw(); unsafe { let dst = (chunk.addr() as usize + msg_off) as *mut u8; std::ptr::copy_nonoverlapping(new_msg.as_ptr(), dst, new_msg.len() - 1); } chunk.make_rx(); unsafe { hello_jit() }; } // Don't miss good practices! let _ = chunk.deallocate(); ``` ### [Windows ARM64]() > **x86-64** > > This part focuses on the ARM64 architecture but it works in the exact same way for Windows x86-64. Similarly, we can JIT a `Hello World` shellcode on Windows ARM64 with the following snippet: **Python** ```python chunk = lief.runtime.Memory.mmap( lief.runtime.Process.page_size, lief.runtime.Memory.ANONYMOUS | lief.runtime.Memory.PRIVATE, lief.runtime.Memory.READ | lief.runtime.Memory.WRITE | lief.runtime.Memory.EXEC, ) # The message printed by the shellcode. It must stay alive while the JITed # function runs, so we keep a reference for the whole function. MSG = b"Hello World\n" msg = ctypes.create_string_buffer(MSG) # The assembler resolves the symbols referenced by the shellcode through # this config, mirroring the C++ ``AssemblerConfig::resolve_symbol`` override. class Config(lief.assembly.AssemblerConfig): def resolve_symbol(self, name: str) -> int | None: kernel32 = lief.runtime.windows.dlopen("kernel32.dll") if kernel32 is None: print("Failed to dlopen kernel32.dll", file=sys.stderr) return None # Resolve the symbols that are used by the shellcode if name == "GetStdHandle": return lief.to_int(kernel32.dlsym("GetStdHandle")) if name == "WriteFile": return lief.to_int(kernel32.dlsym("WriteFile")) if name == "var_msg": return ctypes.addressof(msg) if name == "var_msg_len": return len(MSG) return None config = Config() # Shellcode dynamically compiled and whose referenced symbols are resolved # at runtime by the provided config lief.runtime.assemble( chunk.addr, r""" .text .global main .align 2 main: stp x29, x30, [sp, -64]! mov x29, sp stp x19, x20, [sp, 16] stp x21, x22, [sp, 32] // Here we use symbols that are **dynamically** resolved by the // AssemblerConfig ldr x19, =GetStdHandle ldr x20, =WriteFile ldr x21, =var_msg ldr w22, =var_msg_len // Call GetStdHandle(STD_OUTPUT_HANDLE) // STD_OUTPUT_HANDLE = -11 // GetStdHandle is stored in x19 mov w0, -11 blr x19 // Call ---> bool WriteFile( // HANDLE hConsoleOutput, // x0: from GetStdHandle (already set) // const VOID *lpBuffer, // x1: pointer to string // DWORD nNumberOfCharsToWrite, // w2: length of string // LPDWORD lpNumberOfCharsWritten,// x3: pointer to written count // LPVOID lpReserved // x4: NULL // ); mov x1, x21 mov w2, w22 add x3, sp, 48 mov x4, xzr blr x20 mov x0, xzr ldp x21, x22, [sp, 32] ldp x19, x20, [sp, 16] ldp x29, x30, [sp], 64 ret """, config, ) # Flush the instruction cache chunk.cache_flush() # Change the permission to R-X and invoke the JITed function chunk.make_rx() void_void_func = ctypes.CFUNCTYPE(None) # void(*)() hello_jit = void_void_func(chunk.addr) # This call prints the message "Hello World" on the console hello_jit() # Don't miss good practices! chunk.deallocate() ``` **C++** ```cpp using Mem = LIEF::runtime::Memory; auto chunk = Mem::mmap(LIEF::runtime::Process::page_size(), Mem::MP_ANONYMOUS | Mem::MP_PRIVATE, Mem::P_READ | Mem::P_WRITE | Mem::P_EXEC); if (!chunk) { return; } class Config : public LIEF::assembly::AssemblerConfig { public: std::optional resolve_symbol(const std::string& name) override { // The message to print static constexpr char HELLO[] = "Hello World\n"; static constexpr uint32_t HELLO_LEN = sizeof(HELLO) - 1; static auto kernel32 = LIEF::runtime::windows::dlopen("kernel32.dll"); if (kernel32 == nullptr) { err("Failed to dlopen kernel32.dll"); return std::nullopt; } // Resolve the symbols that are used by the shellcode if (name == "GetStdHandle") { return reinterpret_cast(kernel32->dlsym("GetStdHandle")); } if (name == "WriteFile") { return reinterpret_cast(kernel32->dlsym("WriteFile")); } if (name == "var_msg") { return reinterpret_cast(HELLO); } if (name == "var_msg_len") { return HELLO_LEN; } return std::nullopt; } }; Config config; // clang-format off // Shellcode dynamically compiled and whose referenced symbols are resolved // at runtime by the provided Config std::vector raw_inst = LIEF::runtime::assemble(chunk->addr(), R"asm( .text .global main .align 2 main: stp x29, x30, [sp, -64]! mov x29, sp stp x19, x20, [sp, 16] stp x21, x22, [sp, 32] // Here we use symbols that are **dynamically** resolved by the // AssemblerConfig ldr x19, =GetStdHandle ldr x20, =WriteFile ldr x21, =var_msg ldr w22, =var_msg_len // Call GetStdHandle(STD_OUTPUT_HANDLE) // STD_OUTPUT_HANDLE = -11 // GetStdHandle is stored in x19 mov w0, -11 blr x19 // Call ---> bool WriteFile( // HANDLE hConsoleOutput, // x0: from GetStdHandle (already set) // const VOID *lpBuffer, // x1: pointer to string // DWORD nNumberOfCharsToWrite, // w2: length of string // LPDWORD lpNumberOfCharsWritten,// x3: pointer to written count // LPVOID lpReserved // x4: NULL // ); mov x1, x21 mov w2, w22 add x3, sp, 48 mov x4, xzr blr x20 mov x0, xzr ldp x21, x22, [sp, 32] ldp x19, x20, [sp, 16] ldp x29, x30, [sp], 64 ret )asm", config); // clang-format on // Flush the instruction cache chunk->cache_flush(); // Change the permission to R-X and invoke the JITed function. chunk->make_rx(); using shellcode_t = void (*)(); auto hello_jit = reinterpret_cast(chunk->addr()); // This call prints the message "Hello World" on the console hello_jit(); // Don't miss good practices! (void)chunk->deallocate(); ``` **Rust** ```rust let mut chunk = match runtime::Memory::mmap( runtime::Process::page_size() as u64, MmapFlags::ANONYMOUS | MmapFlags::PRIVATE, Perm::READ | Perm::WRITE | Perm::EXEC, ) { Some(c) => c, None => return, }; // Resolve kernel32 (loaded in every Windows process) let kernel32 = match runtime::windows::dlopen("kernel32.dll") { Some(m) => m, None => { eprintln!("Failed to dlopen kernel32.dll"); let _ = chunk.deallocate(); return; } }; let p_get_std_handle = kernel32.dlsym("GetStdHandle".to_string()); let p_write_file = kernel32.dlsym("WriteFile".to_string()); if p_get_std_handle.is_null() || p_write_file.is_null() { eprintln!("Failed to resolve kernel32 symbols"); let _ = chunk.deallocate(); return; } let p_get_std_handle = p_get_std_handle as u64; let p_write_file = p_write_file as u64; // The message printed by the shellcode. const HELLO: &[u8] = b"Hello World\n"; let msg_ptr = HELLO.as_ptr() as u64; let msg_len = HELLO.len() as u64; let mut config = AssemblerConfig::default(); config.symbol_resolver = Some(Arc::new(move |name: &str| -> Option { match name { "GetStdHandle" => Some(p_get_std_handle), "WriteFile" => Some(p_write_file), "var_msg" => Some(msg_ptr), "var_msg_len" => Some(msg_len), _ => None, } })); // Shellcode dynamically compiled and whose referenced symbols are resolved // at runtime by the provided config let raw_inst = runtime::assemble_with_config( chunk.addr(), r#" .text .global main .align 2 main: stp x29, x30, [sp, -64]! mov x29, sp stp x19, x20, [sp, 16] stp x21, x22, [sp, 32] // Here we use symbols that are **dynamically** resolved by the // AssemblerConfig ldr x19, =GetStdHandle ldr x20, =WriteFile ldr x21, =var_msg ldr w22, =var_msg_len // Call GetStdHandle(STD_OUTPUT_HANDLE) // STD_OUTPUT_HANDLE = -11 // GetStdHandle is stored in x19 mov w0, -11 blr x19 // Call ---> bool WriteFile( // HANDLE hConsoleOutput, // x0: from GetStdHandle (already set) // const VOID *lpBuffer, // x1: pointer to string // DWORD nNumberOfCharsToWrite, // w2: length of string // LPDWORD lpNumberOfCharsWritten,// x3: pointer to written count // LPVOID lpReserved // x4: NULL // ); mov x1, x21 mov w2, w22 add x3, sp, 48 mov x4, xzr blr x20 mov x0, xzr ldp x21, x22, [sp, 32] ldp x19, x20, [sp, 16] ldp x29, x30, [sp], 64 ret "#, &config, ); println!( "{} bytes assembled at {:#010x}", raw_inst.len(), chunk.addr() ); // Flush the instruction cache chunk.cache_flush(); // Change the permission to R-X and invoke the JITed function chunk.make_rx(); let hello_jit: unsafe extern "C" fn() = unsafe { std::mem::transmute(chunk.addr() as usize) }; // This call prints the message "Hello World" on the console unsafe { hello_jit() }; // Don't miss good practices! let _ = chunk.deallocate(); ``` Note that this shellcode uses the external functions `GetStdHandle` and `WriteFile` that are **dynamically** resolved and injected into the shellcode **at runtime**. The shellcode is thus generated with dynamic information that would otherwise have been tedious to resolve at the assembly level. ### [macOS ARM64]() > **SIP** > > Allocating and executing JIT memory on macOS requires System Integrity Protection (SIP) to be disabled. The snippet below therefore only runs the JIT part when `lief.runtime.osx.Host.is_sip_enabled` ( [`lief::runtime::osx::Host::is_sip_enabled`]() ; [`lief.runtime.osx.Host.is_sip_enabled`]() ; [`LIEF::runtime::osx::Host::is_sip_enabled()`]() ) reports that SIP is disabled. Similarly, we can JIT a `Hello World` shellcode on macOS ARM64. The shellcode calls `write`, which is **dynamically** resolved from `libSystem` at runtime: **Python** ```python # The JIT below allocates and executes RWX memory. On macOS this is only # permitted when SIP is disabled, so we check it before. if lief.runtime.osx.Host.is_sip_enabled: print("SIP is enabled: skipping the JIT memory example", file=sys.stderr) return # Note the `JIT` flag here that is used to switch the allocated chunk into # R-X once the shellcode is committed. chunk = lief.runtime.Memory.mmap( lief.runtime.Process.page_size, lief.runtime.Memory.ANONYMOUS | lief.runtime.Memory.PRIVATE | lief.runtime.Memory.JIT, lief.runtime.Memory.READ | lief.runtime.Memory.WRITE, ) # The message printed by the shellcode. It must stay alive while the JITed # function runs, so we keep a reference for the whole function. MSG = b"Hello World\n" msg = ctypes.create_string_buffer(MSG) # libSystem re-exports the libc symbols (write, ...) libsystem = lief.runtime.osx.dlopen("libSystem.B.dylib") # The assembler resolves the symbols referenced by the shellcode through # this config, mirroring the C++ ``AssemblerConfig::resolve_symbol`` override. class Config(lief.assembly.AssemblerConfig): def resolve_symbol(self, name: str) -> int | None: if libsystem is None: print("Failed to dlopen libSystem.B.dylib", file=sys.stderr) return None # Resolve the symbols that are used by the shellcode if name == "write": return lief.to_int(libsystem.dlsym("write")) if name == "var_msg": return ctypes.addressof(msg) if name == "var_msg_len": return len(MSG) return None config = Config() # Shellcode dynamically compiled and whose referenced symbols are resolved # at runtime by the provided config lief.runtime.assemble( chunk.addr, r""" .text .global main .align 2 main: stp x29, x30, [sp, -16]! mov x29, sp // Here we use symbols that are **dynamically** resolved by the // AssemblerConfig ldr x8, =write // write(2) libc wrapper ldr x1, =var_msg // buffer ldr w2, =var_msg_len // length // write(STDOUT_FILENO, msg, len) mov x0, 1 blr x8 mov x0, xzr ldp x29, x30, [sp], 16 ret """, config, ) # Flush the instruction cache chunk.cache_flush() # Change the permission to R-X and invoke the JITed function chunk.make_rx() void_void_func = ctypes.CFUNCTYPE(None) # void(*)() hello_jit = void_void_func(chunk.addr) # This call prints the message "Hello World" on the console hello_jit() # Don't miss good practices! chunk.deallocate() ``` **C++** ```cpp // The JIT below allocates and executes RWX memory. On macOS this is only // permitted when SIP is disabled. if (LIEF::runtime::osx::Host::is_sip_enabled()) { warn("SIP is enabled: skipping the JIT memory example"); return; } using Mem = LIEF::runtime::Memory; // Note the `MP_JIT` here that is used to switch the allocated chunk into R-X // once the shellcode is committed. auto chunk = Mem::mmap(LIEF::runtime::Process::page_size(), Mem::MP_ANONYMOUS | Mem::MP_PRIVATE | Mem::MP_JIT, Mem::P_READ | Mem::P_WRITE); if (!chunk) { return; } class Config : public LIEF::assembly::AssemblerConfig { public: std::optional resolve_symbol(const std::string& name) override { // The message to print static constexpr char HELLO[] = "Hello World\n"; static constexpr uint32_t HELLO_LEN = sizeof(HELLO) - 1; // libSystem re-exports the libc symbols (write, ...) static auto libsystem = LIEF::runtime::osx::dlopen("libSystem.B.dylib"); if (libsystem == nullptr) { err("Failed to dlopen libSystem.B.dylib"); return std::nullopt; } // Resolve the symbols that are used by the shellcode if (name == "write") { return reinterpret_cast(libsystem->dlsym("write")); } if (name == "var_msg") { return reinterpret_cast(HELLO); } if (name == "var_msg_len") { return HELLO_LEN; } return std::nullopt; } }; Config config; // clang-format off // Shellcode dynamically compiled and whose referenced symbols are resolved // at runtime by the provided Config std::vector raw_inst = LIEF::runtime::assemble(chunk->addr(), R"asm( .text .global main .align 2 main: stp x29, x30, [sp, -16]! mov x29, sp // Here we use symbols that are **dynamically** resolved by the // AssemblerConfig ldr x8, =write // write(2) libc wrapper ldr x1, =var_msg // buffer ldr w2, =var_msg_len // length // write(STDOUT_FILENO, msg, len) mov x0, 1 blr x8 mov x0, xzr ldp x29, x30, [sp], 16 ret )asm", config); // clang-format on // Flush the instruction cache chunk->cache_flush(); // Change the permission to R-X and invoke the JITed function. chunk->make_rx(); using shellcode_t = void (*)(); auto hello_jit = reinterpret_cast(chunk->addr()); // This call prints the message "Hello World" on the console hello_jit(); // Don't miss good practices! (void)chunk->deallocate(); ``` **Rust** ```rust // The JIT below allocates and executes RWX memory. On macOS this is only // permitted when System Integrity Protection (SIP) is disabled, so gate the // example on it. if runtime::osx::Host::is_sip_enabled() { eprintln!("SIP is enabled: skipping the JIT memory example"); return; } // Note the `JIT` flag here that is used to switch the allocated chunk into // R-X once the shellcode is committed. let mut chunk = match runtime::Memory::mmap( runtime::Process::page_size() as u64, MmapFlags::ANONYMOUS | MmapFlags::PRIVATE | MmapFlags::JIT, Perm::READ | Perm::WRITE, ) { Some(c) => c, None => return, }; // libSystem re-exports the libc symbols (write, ...) let libsystem = match runtime::osx::dlopen("libSystem.B.dylib") { Some(m) => m, None => { eprintln!("Failed to dlopen libSystem.B.dylib"); let _ = chunk.deallocate(); return; } }; let p_write = libsystem.dlsym("write".to_string()); if p_write.is_null() { eprintln!("Failed to resolve write"); let _ = chunk.deallocate(); return; } let p_write = p_write as u64; // The message printed by the shellcode. const HELLO: &[u8] = b"Hello World\n"; let msg_ptr = HELLO.as_ptr() as u64; let msg_len = HELLO.len() as u64; let mut config = AssemblerConfig::default(); config.symbol_resolver = Some(Arc::new(move |name: &str| -> Option { match name { "write" => Some(p_write), "var_msg" => Some(msg_ptr), "var_msg_len" => Some(msg_len), _ => None, } })); // Shellcode dynamically compiled and whose referenced symbols are resolved // at runtime by the provided config let raw_inst = runtime::assemble_with_config( chunk.addr(), r#" .text .global main .align 2 main: stp x29, x30, [sp, -16]! mov x29, sp // Here we use symbols that are **dynamically** resolved by the // AssemblerConfig ldr x8, =write // write(2) libc wrapper ldr x1, =var_msg // buffer ldr w2, =var_msg_len // length // write(STDOUT_FILENO, msg, len) mov x0, 1 blr x8 mov x0, xzr ldp x29, x30, [sp], 16 ret "#, &config, ); println!( "{} bytes assembled at {:#010x}", raw_inst.len(), chunk.addr() ); // Flush the instruction cache chunk.cache_flush(); // Change the permission to R-X and invoke the JITed function chunk.make_rx(); let hello_jit: unsafe extern "C" fn() = unsafe { std::mem::transmute(chunk.addr() as usize) }; // This call prints the message "Hello World" on the console unsafe { hello_jit() }; // Don't miss good practices! let _ = chunk.deallocate(); ``` ### [Android ARM64]() Similarly, we can JIT a small AArch64 stub on Android to print `LIEF Runtime Extended Demo`. The Python tab calls `write`, which is **dynamically** resolved from Bionic `libc` at runtime: **Python** ```python chunk = lief.runtime.Memory.mmap( lief.runtime.Process.page_size, lief.runtime.Memory.ANONYMOUS | lief.runtime.Memory.PRIVATE, lief.runtime.Memory.READ | lief.runtime.Memory.WRITE | lief.runtime.Memory.EXEC, ) class Config(lief.assembly.AssemblerConfig): def resolve_symbol(self, name: str) -> int | None: libc = lief.runtime.android.dlopen("libc.so") if libc is None: print("Failed to dlopen libc.so", file=sys.stderr) return None if name == "write": return lief.to_int(libc.dlsym("write")) return None config = Config() raw_inst = lief.runtime.assemble( chunk.addr, r""" .text .global main .align 2 main: stp x29, x30, [sp, -16]! mov x29, sp ldr x8, =write mov x0, 1 // STDOUT_FILENO adr x1, msg // buf = &msg mov x2, 27 // len = len("LIEF Runtime Extended Demo\n") blr x8 // write(STDOUT_FILENO, msg, 27) ldp x29, x30, [sp], 16 ret msg: .ascii "LIEF Runtime Extended Demo\n" """, config, ) # Disassemble the JITed stub from memory for inst in islice(lief.runtime.disassemble(chunk.addr), 9): print(inst) # Dump as raw bytes raw_bytes = lief.runtime.Memory.read(chunk.addr, len(raw_inst)) print(raw_bytes.hex(":")) # Flush the instruction cache before executing the freshly written code # (this is required on AArch64). chunk.cache_flush() # Change the permission to R-X chunk.make_rx() VoidVoidFunc = ctypes.CFUNCTYPE(None) # void(*)() hello_jit = VoidVoidFunc(chunk.addr) hello_jit() # Change the message pos = raw_bytes.find(b"LIEF Runtime") chunk.make_rw() lief.runtime.Memory.write(b"Hello Python ctypes World!\n", chunk.addr + pos) chunk.make_rx() chunk.cache_flush() # Print again hello_jit() # Don't miss good practices! chunk.deallocate() ``` **C++** ```cpp using Mem = LIEF::runtime::Memory; auto chunk = Mem::mmap(LIEF::runtime::Process::page_size(), Mem::MP_ANONYMOUS | Mem::MP_PRIVATE, Mem::P_READ | Mem::P_WRITE | Mem::P_EXEC); if (!chunk) { return; } struct Config : LIEF::assembly::AssemblerConfig { std::optional resolve_symbol(const std::string& name) override { std::unique_ptr libc = LIEF::runtime::android::dlopen("libc.so"); if (libc == nullptr) { err("Failed to dlopen libc.so"); return std::nullopt; } if (name == "write") { return reinterpret_cast(libc->dlsym("write")); } return std::nullopt; } } config; std::vector raw_inst = LIEF::runtime::assemble(chunk->addr(), R"asm( .text .global main .align 2 main: stp x29, x30, [sp, -16]! mov x29, sp ldr x8, =write mov x0, 1 // STDOUT_FILENO adr x1, msg // buf = &msg mov x2, 27 // len("LIEF Runtime Extended Demo\n") blr x8 // write(STDOUT_FILENO, msg, 27) ldp x29, x30, [sp], 16 ret msg: .ascii "LIEF Runtime Extended Demo\n" )asm", config); // Disassemble the JITed stub from memory auto instructions = LIEF::runtime::disassemble(chunk->addr()); for (const LIEF::assembly::Instruction& inst : instructions | std::views::take(9)) { info("{}", inst.to_string()); } // Dump as raw bytes std::vector raw_bytes; Mem::read(chunk->addr(), raw_bytes, raw_inst.size()); std::string hex_bytes; for (uint8_t byte : raw_bytes) { if (!hex_bytes.empty()) { hex_bytes += ':'; } hex_bytes += std::format("{:02x}", static_cast(byte)); } info("{}", hex_bytes); // Flush the instruction cache before executing the freshly written code. // This is required on AArch64. chunk->cache_flush(); // Change the permission to R-X and invoke the JITed function chunk->make_rx(); using shellcode_t = void (*)(); auto hello_jit = reinterpret_cast(chunk->addr()); hello_jit(); // Change the message const char new_msg[] = "Hello C++ runtime World!\n"; std::string_view view_inst(reinterpret_cast(raw_inst.data()), raw_inst.size()); size_t pos = view_inst.find("LIEF Runtime"); assert(pos != std::string_view::npos); chunk->make_rw(); Mem::write(reinterpret_cast(new_msg), sizeof(new_msg) - 1, chunk->addr() + pos); chunk->make_rx(); chunk->cache_flush(); hello_jit(); // Don't miss good practices! (void)chunk->deallocate(); ``` **Rust** ```rust let mut chunk = match runtime::Memory::mmap( runtime::Process::page_size() as u64, MmapFlags::ANONYMOUS | MmapFlags::PRIVATE, Perm::READ | Perm::WRITE | Perm::EXEC, ) { Some(c) => c, None => return, }; let mut config = AssemblerConfig::default(); config.symbol_resolver = Some(Arc::new(|name: &str| -> Option { let libc = match runtime::android::dlopen("libc.so") { Some(lib) => lib, None => { eprintln!("Failed to dlopen libc.so"); return None; } }; if name == "write" { return Some(libc.dlsym("write".to_string()) as usize as u64); } None })); let raw_inst = runtime::assemble_with_config( chunk.addr(), r#" .text .global main .align 2 main: stp x29, x30, [sp, -16]! mov x29, sp ldr x8, =write mov x0, 1 // STDOUT_FILENO adr x1, msg // buf = &msg mov x2, 27 // len("LIEF Runtime Extended Demo\n") blr x8 // write(STDOUT_FILENO, msg, 27) ldp x29, x30, [sp], 16 ret msg: .ascii "LIEF Runtime Extended Demo\n" "#, &config, ); // Disassemble the JITed stub from memory for inst in runtime::disassemble(chunk.addr()).take(9) { println!("{}", inst); } // Dump the JITed stub as raw bytes let hex_bytes: Vec = raw_inst.iter().map(|&b| format!("{:02x}", b)).collect(); println!("{}", hex_bytes.join(":")); // Flush the instruction cache before executing the freshly written code // (this is required on AArch64). chunk.cache_flush(); // Change the permission to R-X and invoke the JITed function chunk.make_rx(); let hello_jit: unsafe extern "C" fn() = unsafe { std::mem::transmute(chunk.addr() as usize) }; unsafe { hello_jit() }; // Change the message: locate it in the generated bytes and rewrite it. let needle = b"LIEF Runtime"; if let Some(msg_off) = raw_inst.windows(needle.len()).position(|w| w == needle) { let new_msg = b"Hello Rust runtime World!\n"; chunk.make_rw(); unsafe { let dst = (chunk.addr() as usize + msg_off) as *mut u8; std::ptr::copy_nonoverlapping(new_msg.as_ptr(), dst, new_msg.len()); } chunk.make_rx(); chunk.cache_flush(); unsafe { hello_jit() }; } // Don't miss good practices! let _ = chunk.deallocate(); ``` --- documentID: "02781b3390637c965f23066c46cc3d594310c30a032d12e92f3ec9ff8231c345" docname: "runtime/components/memory_layout" title: "Memory Layout - Runtime - LIEF Documentation" description: "Inspect mapped memory regions with LIEF Extended, calculate virtual address-space usage, and locate mappings by address or name." canonical: "https://lief.re/doc/latest/runtime/components/memory_layout.html" markdownURL: "https://lief.re/doc/latest/runtime/components/memory_layout.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "360b8e9ca782ef50b84028739bc7f499f60446851765f5fab48b1f8c93da50e7" --- # [Memory Layout]() The `lief.runtime.MemoryLayout` ( [`lief.runtime.MemoryLayout`]() ; [`LIEF::runtime::MemoryLayout`]() ) interface exposes the memory layout of the **current** process: the regions that are mapped in its address space. ## [Enumerate mapped regions]() `lief.runtime.memory_layout()` ( [`lief::runtime::memory_layout`]() ; [`lief.runtime.memory_layout()`]() ; [`LIEF::runtime::memory_layout()`]() ) returns an iterator over these regions, ordered by address: **Python** ```python for region in lief.runtime.memory_layout(): print(f"{region.addr:#014x}-{region.end_addr:#014x} {region.name}") ``` **C++** ```cpp for (const LIEF::runtime::MemoryLayout::Region& region : LIEF::runtime::memory_layout()) { std::cout << region.addr() << '-' << region.end_addr() << ' ' << region.name() << '\n'; } ``` **Rust** ```rust for region in lief::runtime::memory_layout() { println!( "{:#014x}-{:#014x} {}", region.addr(), region.end_addr(), region.name() ); } ``` For illustration, a Linux process running `/usr/bin/cat` could have this layout: ```text 0x563668f9d000-0x563668f9f000 /usr/bin/cat 0x563668f9f000-0x563668fa6000 /usr/bin/cat 0x563668fa6000-0x563668fa9000 /usr/bin/cat 0x563668fa9000-0x563668faa000 /usr/bin/cat 0x563668faa000-0x563668fab000 /usr/bin/cat 0x56367cb52000-0x56367cb73000 [heap] 0x7f2d28e00000-0x7f2d29196000 /usr/lib/locale/locale-archive 0x7f2d291be000-0x7f2d29200000 0x7f2d29200000-0x7f2d29224000 /usr/lib/libc.so.6 [...] 0x7f2d29478000-0x7f2d2947a000 [vdso] 0x7f2d2947a000-0x7f2d2947b000 /lib64/ld-linux-x86-64.so.2 [...] 0x7ffd162f1000-0x7ffd16312000 [stack] 0xffffffffff600000-0xffffffffff601000 [vsyscall] ``` A `lief.runtime.MemoryLayout.Region` ( [`lief::runtime::Region`]() ; [`lief.runtime.MemoryLayout.Region`]() ; [`LIEF::runtime::MemoryLayout::Region`]() ) describes a half-open address range: the start address is included, and the end address is excluded. Its name can be: - the name or the path of the module mapped at this address (e.g. `/usr/lib/libc.so.6`); - the identifier of a region that is not backed by a file (e.g. `[stack]`, `[heap]`, `[vdso]`); - **empty**, for anonymous regions. As shown in the output above, a module is not mapped as a single region: it usually gets one region per set of permissions. Names and mappings depend on the operating system and can change as the process allocates memory or loads libraries. A region describes a mapping: it does not own the mapped memory. ## [Inspecting the layout]() The following snippet iterates over the memory layout to: - Compute the total mapped size - Group that size by region name - Locate the region containing a given address These totals measure virtual address space. They are not resident-memory (RSS) measurements, and grouping anonymous regions combines unrelated allocations. **Python** ```python address: int count = 0 mapped = 0 footprint: defaultdict[str, int] = defaultdict(int) enclosing: lief.runtime.MemoryLayout.Region | None = None for region in lief.runtime.memory_layout(): count += 1 mapped += region.size name = region.name if region.name else "" footprint[name] += region.size if region.contains(address): enclosing = region print(f"{count} regions, {mapped // 1024} KB mapped") for name, size in footprint.items(): print(f"{size:#010x} {name}") if enclosing is not None: print(f"{address:#x}: {enclosing.name}+{address - enclosing.addr:#x}") ``` **C++** ```cpp size_t count = 0; uint64_t mapped = 0; std::unordered_map footprint; LIEF::runtime::MemoryLayout::Region enclosing; for (const LIEF::runtime::MemoryLayout::Region& region : LIEF::runtime::memory_layout()) { ++count; mapped += region.size(); std::string name = region.name().empty() ? "" : std::string(region.name()); footprint[name] += region.size(); if (region.contains(address)) { enclosing = region; } } std::cout << count << " regions, " << (mapped / 1024) << " KB mapped\n"; for (const auto& [name, size] : footprint) { std::cout << size << ' ' << name << '\n'; } if (enclosing.size() > 0) { std::cout << address << ": " << enclosing.name() << '+' << (address - enclosing.addr()) << '\n'; } ``` **Rust** ```rust let mut count = 0usize; let mut mapped = 0u64; let mut footprint: BTreeMap = BTreeMap::new(); let mut enclosing: Option = None; for region in lief::runtime::memory_layout() { count += 1; mapped += region.size(); let mut name = region.name(); if name.is_empty() { name = String::from(""); } *footprint.entry(name).or_insert(0) += region.size(); if region.contains(address) { enclosing = Some(region); } } println!("{count} regions, {} KB mapped", mapped / 1024); for (name, size) in &footprint { println!("{size:#010x} {name}"); } if let Some(region) = enclosing { println!( "{address:#x}: {}+{:#x}", region.name(), address - region.addr() ); } ``` ## [Linux / Android]() On Linux and Android, named mappings such as `[stack]` and `[heap]` can be located when present. They do not account for every thread stack or allocator-managed allocation: **Python** ```python for region in lief.runtime.memory_layout(): # On Linux and Android, the kernel names the regions that back the # stack and the heap of the process. if region.name in ("[stack]", "[heap]"): print(f"{region.name}: {region.addr:#014x}-{region.end_addr:#014x}") ``` **C++** ```cpp for (const LIEF::runtime::MemoryLayout::Region& region : LIEF::runtime::memory_layout()) { // On Linux and Android, the kernel names the regions that back the stack // and the heap of the process. if (region.name() == "[stack]" || region.name() == "[heap]") { std::cout << region.name() << ": " << region.addr() << '-' << region.end_addr() << '\n'; } } ``` **Rust** ```rust for region in lief::runtime::memory_layout() { // On Linux and Android, the kernel names the regions that back the // stack and the heap of the process. let name = region.name(); if name == "[stack]" || name == "[heap]" { println!( "{name}: {:#014x}-{:#014x}", region.addr(), region.end_addr() ); } } ``` ```text [heap]: 0x56367cb52000-0x56367cb73000 [stack]: 0x7ffd162f1000-0x7ffd16312000 ``` --- documentID: "82f4e7d34cddf7c3de706983e32deb4f87f889f0ee3d53e7f094b51d78362aad" docname: "runtime/components/modules" title: "Modules - Runtime - LIEF Documentation" description: "Enumerate loaded modules, resolve symbols, parse files and in-memory images, and interpret live addresses with the LIEF runtime API." canonical: "https://lief.re/doc/latest/runtime/components/modules.html" markdownURL: "https://lief.re/doc/latest/runtime/components/modules.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "b3020c5f9e9d259f7cd89666fc4651676d52786eafc0875f70f2ee830b5ef487" --- # [Modules]() The `lief.runtime.Module` ( [`lief::runtime::module::Module`]() ; [`lief.runtime.Module`]() ; [`LIEF::runtime::Module`]() ) interface exposes the different modules (executables and shared libraries) that are loaded in the current process. It is a cross-platform API and is extended on each supported platform with OS-specific helpers (e.g. `lief.runtime.linux.Module` ( [`lief::runtime::linux::Module`]() ; [`lief.runtime.linux.Module`]() ; [`LIEF::runtime::Linux::Module`]() ), `lief.runtime.windows.Module` ( [`lief::runtime::windows::Module`]() ; [`lief.runtime.windows.Module`]() ; [`LIEF::runtime::windows::Module`]() ), `lief.runtime.osx.Module` ( [`lief::runtime::osx::Module`]() ; [`lief.runtime.osx.Module`]() ; [`LIEF::runtime::osx::Module`]() )). ## [Enumerate and locate modules]() The following Linux example enumerates the loaded modules, prints their attributes, and selects `libc` for later inspection. The enumeration API is shared by all supported platforms: **Python** ```python for mod in lief.runtime.modules(): print(mod) # Look for the libc if mod.name.startswith("libc.so"): print( f"libc.so found: {mod.path} ([{mod.imagebase:#010x}, {mod.end:#010x}])" ) assert isinstance(mod, lief.runtime.linux.Module) libc = mod ``` **C++** ```cpp for (const LIEF::runtime::Module& mod : LIEF::runtime::modules()) { info("{}", mod.to_string()); // Look for the libc if (mod.name().ends_with("libc.so")) { info("libc.so found: {} ([{}, {}])", mod.path(), hex(mod.imagebase()), hex(mod.end())); libc.reset(mod.clone().release()->as()); } } ``` **Rust** ```rust for module in runtime::modules() { println!( "{} ({:#010x} - {:#010x})", module.name(), module.imagebase(), module.end() ); if let runtime::Modules::Linux(linux_mod) = module { if linux_mod.name().starts_with("libc.so") { println!( "libc.so found: {} ([{:#010x}, {:#010x}])", linux_mod.path(), linux_mod.imagebase(), linux_mod.end() ); libc = Some(linux_mod); } } } ``` For a direct lookup, use `lief.runtime.module_from_name()` ( [`lief::runtime::module_from_name`]() ; [`lief.runtime.module_from_name()`]() ; [`LIEF::runtime::module_from_name()`]() ), `lief.runtime.module_from_path()` ( [`lief::runtime::module_from_path`]() ; [`lief.runtime.module_from_path()`]() ; [`LIEF::runtime::module_from_path()`]() ), or `lief.runtime.module_from_addr()` ( [`lief::runtime::module_from_addr`]() ; [`lief.runtime.module_from_addr()`]() ; [`LIEF::runtime::module_from_addr()`]() ). Name and path lookups use exact matches. Address lookup expects an absolute address in the current process. The platform-specific module interfaces let you parse an image from its path on disk or from its current mapping: | Operation | Result | | --- | --- | | Parse from the module’s path | The executable file as stored on disk, using its file layout | | Parse from memory | The loaded image, which may contain relocations and runtime changes | | `lief.runtime.Module.dump()` ( [`lief::runtime::module::Module::dump`]() ; [`lief.runtime.Module.dump()`]() ; [`LIEF::runtime::Module::dump()`]() ) | Raw bytes from the module’s mapped address range | Parsing produces a LIEF binary object for analysis. Modifying that object does not automatically patch the running module. You should use the [memory API]() when you intend to write to the process’s memory. A raw memory dump is not necessarily a valid on-disk executable. For offline analysis, use the dump-parsing APIs documented for [ELF](), [PE](), and [Mach-O](). ## [Linux]() On Linux, `lief.runtime.linux.Module` ( [`lief::runtime::linux::Module`]() ; [`lief.runtime.linux.Module`]() ; [`LIEF::runtime::Linux::Module`]() ) extends the generic interface with platform-specific helpers. In particular, it exposes the `lief.runtime.linux.dlopen()` ( [`lief::runtime::linux::dlopen`]() ; [`lief.runtime.linux.dlopen()`]() ; [`LIEF::runtime::Linux::dlopen()`]() ) & `lief.runtime.linux.Module.dlsym()` ( [`lief::runtime::linux::Module::dlsym`]() ; [`lief.runtime.linux.Module.dlsym()`]() ; [`LIEF::runtime::Linux::Module::dlsym()`]() ) and can parse the module directly from its path on disk or from its in-memory representation. The following snippet demonstrates these operations on the `libc` module: **Python** ```python print(f"libc path: {libc.path}") if __cxa_finalize := libc.dlsym("__cxa_finalize"): __cxa_finalize_addr = lief.to_int(__cxa_finalize) print(f"{libc.name}!__cxa_finalize: {__cxa_finalize_addr:#010x}") if malloc := libc.dlsym("malloc"): malloc_addr = lief.to_int(malloc) # lief.to_int is used to convert an opaque pointer (void*) into a # regular Python int print(f"{libc.name}!malloc: {malloc_addr:#010x}") # With LIEF extended, we can disassemble the function from its # absolute memory address: if lief.__extended__: for inst in islice(lief.runtime.disassemble(malloc_addr), 4): print(" ", inst) # This parses the ELF from its path on the disk if (elf_on_disk := libc.parse_from_path()) is not None and ( __cxa_finalize := elf_on_disk.get_symbol("__cxa_finalize") ) is not None: print(f"__cxa_finalize: {__cxa_finalize.value:#010x}") # This code loads 'librt.so' and wrap the dlopen handler in a Module. if librt := lief.runtime.linux.dlopen("librt.so.1"): print( f"librt loaded: {librt.path} (dlopen handler={lief.to_int(librt.handle):#010x})" ) # Parse the ELF directly from memory. if librt_mem := librt.parse_from_memory(): # This code looks for the relocation associated with the # **imported** symbol `__cxa_finalize` that is defined in the libc. # The relocation holds the address where the function is resolved. # Therefore, by reading this relocation address we can access the # resolved address of `__cxa_finalize`. This address should match # the value previously returned by dlsym __cxa_finalize_reloc = next( ( reloc for reloc in librt_mem.relocations if reloc.symbol is not None and reloc.symbol.name == "__cxa_finalize" ), None, ) if __cxa_finalize_reloc is not None: abs_reloc_addr = librt.imagebase + __cxa_finalize_reloc.address # We assume a 64-bit architecture __cxa_finalize_addr = lief.runtime.Memory.read_u64(abs_reloc_addr) print( f"{librt.name} -> {abs_reloc_addr:#010x} -> {__cxa_finalize_addr:#010x}" ) ``` **C++** ```cpp info("libc path: {}", libc->path()); if (void* cxa_finalize = libc->dlsym("__cxa_finalize")) { info("{}!__cxa_finalize: {}", libc->name(), hex(reinterpret_cast(cxa_finalize))); } if (void* malloc_fn = libc->dlsym("malloc")) { auto malloc_ptr = reinterpret_cast(malloc_fn); info("{}!malloc: {}", libc->name(), hex(reinterpret_cast(malloc_fn))); auto malloc_instructions = LIEF::runtime::disassemble(malloc_ptr); // Dump the first instructions of malloc for (const LIEF::assembly::Instruction& inst : malloc_instructions | std::views::take(4)) { info(" {}", inst.to_string()); } } // This parses the ELF from its path on the disk if (std::unique_ptr elf_on_disk = libc->parse_from_path()) { if (const LIEF::Symbol* sym = elf_on_disk->get_symbol("__cxa_finalize")) { info("__cxa_finalize: {}", hex(sym->value())); } } // This code loads 'librt.so' and wraps the dlopen handle in a Module. if (std::unique_ptr librt = LIEF::runtime::Linux::dlopen("librt.so.1")) { info("librt loaded: {} (dlopen handle={})", librt->path(), hex(reinterpret_cast(librt->handle()))); // Alternately you could do this: { void* handle = dlopen("librt.so.1", RTLD_NOW); auto librt_alt = LIEF::runtime::Linux::Module::from_handle(handle); } // Parse the ELF directly from memory. if (std::unique_ptr librt_mem = librt->parse_from_memory()) { // Look for the relocation associated with the **imported** symbol // `__cxa_finalize` that is defined in the libc. The relocation holds // the address where the function is resolved. Reading this address // gives back the same value previously returned by dlsym. for (const auto& reloc : librt_mem->relocations()) { const auto* sym = reloc.symbol(); if (sym == nullptr || sym->name() != "__cxa_finalize") { continue; } uintptr_t abs_reloc_addr = librt->imagebase() + reloc.address(); auto resolved = LIEF::runtime::Memory::read(abs_reloc_addr); info("{} -> {} -> {}", librt->name(), hex(abs_reloc_addr), hex(resolved)); break; } } } ``` **Rust** ```rust println!("libc path: {}", libc.path()); let cxa_finalize = libc.dlsym("__cxa_finalize".to_string()); if !cxa_finalize.is_null() { println!( "{}!__cxa_finalize: {:#010x}", libc.name(), cxa_finalize as usize ); } let malloc = libc.dlsym("malloc".to_string()); if !malloc.is_null() { println!("{}!malloc: {:#010x}", libc.name(), malloc as usize); } // Parse the ELF from its path on the disk if let Some(elf_on_disk) = libc.parse_from_path() { for sym in elf_on_disk.dynamic_symbols() { if sym.name() == "__cxa_finalize" { println!("__cxa_finalize: {:#010x}", sym.value()); break; } } } // Load 'librt.so' and wrap the dlopen handle in a Module. if let Some(librt) = runtime::linux::dlopen("librt.so.1") { println!( "librt loaded: {} (dlopen handle={:#010x})", librt.path(), librt.handle() as usize ); // Parse the ELF directly from memory. if let Some(librt_mem) = librt.parse_from_memory() { // Find the relocation for the imported symbol `__cxa_finalize` // defined in libc. Reading the relocation address returns the // resolved address, which should match what dlsym returned. for reloc in librt_mem.relocations() { let sym = match reloc.symbol() { Some(s) => s, None => continue, }; if sym.name() != "__cxa_finalize" { continue; } let abs_reloc_addr = librt.imagebase() + reloc.address(); // Assume a 64-bit architecture let resolved: u64 = unsafe { runtime::Memory::read(abs_reloc_addr) }; println!( "{} -> {:#010x} -> {:#010x}", librt.name(), abs_reloc_addr, resolved ); break; } } } ``` ## [Windows]() On Windows, you can perform similar operations such as in-memory parsing, accessing the `HMODULE` handle, and resolving functions through a dlsym-like helper: **Python** ```python print(f"ntdll path: {ntdll.path}") if nt_query := ntdll.dlsym("NtQueryInformationProcess"): # lief.to_int converts an opaque pointer (void*) into a regular Python int nt_query_addr = lief.to_int(nt_query) print(f"{ntdll.name}!NtQueryInformationProcess: {nt_query_addr:#010x}") # This parses the PE from its path on the disk if pe_on_disk := ntdll.parse_from_path(): print(f"on-disk imagebase: {pe_on_disk.optional_header.imagebase:#010x}") if sym := pe_on_disk.get_symbol("NtQueryInformationProcess"): print(f"NtQueryInformationProcess: {sym.value:#010x}") # This parses the PE directly from memory if pe_memory := ntdll.parse_from_memory(): imagebase = pe_memory.optional_header.imagebase print(f"in-memory imagebase: {imagebase:#010x}") if sym := pe_memory.get_symbol("RtlFreeHeap"): print(f"RtlFreeHeap: {sym.value:#010x}") # With LIEF extended, we can disassemble the function directly from # its absolute memory address: if lief.__extended__: for inst in islice(lief.runtime.disassemble(imagebase + sym.value), 4): print(" ", inst) ``` **C++** ```cpp info("ntdll path: {}", ntdll->path()); if (void* _NtQueryInformationProcess = ntdll->dlsym("NtQueryInformationProcess")) { info("{}!NtQueryInformationProcess: {}", ntdll->name(), hex(reinterpret_cast(_NtQueryInformationProcess))); } if (std::unique_ptr pe_on_disk = ntdll->parse_from_path()) { info("on-disk imagebase: {}", hex(pe_on_disk->optional_header().imagebase())); if (const LIEF::Symbol* sym = pe_on_disk->get_symbol("NtQueryInformationProcess")) { info("NtQueryInformationProcess: {}", hex(sym->value())); } } if (std::unique_ptr pe_memory = ntdll->parse_from_memory()) { const uintptr_t imagebase = pe_memory->optional_header().imagebase(); info("in-memory imagebase: {}", hex(imagebase)); if (const LIEF::Symbol* sym = pe_memory->get_symbol("RtlFreeHeap")) { info("RtlFreeHeap: {}", hex(sym->value())); // Disassemble RtlFreeHeap from memory auto instructions = LIEF::runtime::disassemble(imagebase + sym->value()); auto first_instructions = instructions | std::views::take(4); for (const LIEF::assembly::Instruction& inst : first_instructions) { info(" {}", inst.to_string()); } } } ``` **Rust** ```rust println!("ntdll path: {}", ntdll.path()); let nt_query = ntdll.dlsym("NtQueryInformationProcess".to_string()); if !nt_query.is_null() { println!( "{}!NtQueryInformationProcess: {:#010x}", ntdll.name(), nt_query as usize ); } // Parse the PE from its path on the disk if let Some(pe_on_disk) = ntdll.parse_from_path() { println!( "on-disk imagebase: {:#010x}", pe_on_disk.optional_header().imagebase() ); if let Some(export) = pe_on_disk.export() { if let Some(entry) = export.entry_by_name("NtQueryInformationProcess") { println!("NtQueryInformationProcess: {:#010x}", entry.address()); } } } // Parse the PE directly from memory if let Some(pe_memory) = ntdll.parse_from_memory() { let imagebase = pe_memory.optional_header().imagebase(); println!("in-memory imagebase: {:#010x}", imagebase); if let Some(export) = pe_memory.export() { if let Some(entry) = export.entry_by_name("RtlFreeHeap") { let rva = entry.address() as u64; println!("RtlFreeHeap: {:#010x}", rva); // Disassemble the first instructions of RtlFreeHeap from memory for inst in runtime::disassemble(imagebase + rva).take(4) { println!(" {}", inst.to_string()); } } } } ``` ## [macOS]() System libraries can be located in the [Dyld shared cache]() even when their module paths look like ordinary files. In that case, parsing from the path can fail. The example below parses the mapped library from memory and lists its exported symbols: **Python** ```python print(f"libsystem_c path: {libsystem.path}") if arc4_init := libsystem.dlsym("arc4_init"): # lief.to_int converts an opaque pointer (void*) into a regular Python int arc4_init_addr = lief.to_int(arc4_init) print(f"{libsystem.name}!arc4_init: {arc4_init_addr:#010x}") # With LIEF extended, we can disassemble the function directly from its # absolute memory address: if lief.__extended__: for inst in islice(lief.runtime.disassemble(arc4_init_addr), 4): print(" ", inst) # libsystem.path looks like a valid path but libsystem_c.dylib lives in the # dyld-shared-cache. Therefore, it's pointless to try to parse the library # from its filepath as the library does not exist on the disk. macho_on_disk: lief.MachO.Binary | None = None with lief.logging.level_scope(lief.logging.Level.Off): macho_on_disk = libsystem.parse_from_path() if macho_on_disk is None: print(f"As expected, {libsystem.path} is not present in the filesystem") # But we can parse it from memory: if macho_memory := libsystem.parse_from_memory(): print(f"in-memory imagebase: {macho_memory.imagebase:#010x}") # List 'exported' symbols for sym in macho_memory.exported_symbols: print(f"{sym.name:10}: {sym.value:#010x}") ``` **C++** ```cpp info("libsystem_c path: {}", libsystem->path()); if (void* p_arc4_init = libsystem->dlsym("arc4_init")) { info("{}!arc4_init: {}", libsystem->name(), hex(reinterpret_cast(p_arc4_init))); // Disassemble malloc directly from its resolved memory address auto instructions = LIEF::runtime::disassemble(reinterpret_cast(p_arc4_init)); for (const LIEF::assembly::Instruction& inst : instructions | std::views::take(4)) { info(" {}", inst.to_string()); } } // libsystem->path() looks like a valid path but libsystem_c.dylib lives // in the dyld-shared-cache. Therefore, it's pointless to try to parse the // library from its filepath as the library does not exist on the disk std::unique_ptr macho_on_disk; { LIEF::logging::Scoped disable_logger(LIEF::logging::Level::Off); macho_on_disk = libsystem->parse_from_path(); } if (macho_on_disk == nullptr) { info("As expected, {} is not present in the filesystem", libsystem->path()); } // But we can parse it from memory: if (std::unique_ptr macho_memory = libsystem->parse_from_memory()) { info("in-memory imagebase: {}", hex(macho_memory->imagebase())); for (const LIEF::MachO::Symbol& S : macho_memory->exported_symbols()) { info(std::format("{:10}: {:#010x}", S.name(), S.value())); } } ``` **Rust** ```rust println!("libsystem_c path: {}", libsystem.path()); let arc4_init = libsystem.dlsym("arc4_init".to_string()); if !arc4_init.is_null() { println!( "{}!arc4_init: {:#010x}", libsystem.name(), arc4_init as usize ); // Disassemble arc4_init directly from its resolved memory address for inst in runtime::disassemble(arc4_init as u64).take(4) { println!(" {}", inst.to_string()); } } // libsystem.path() looks like a valid path but libsystem_c.dylib lives in // the dyld-shared-cache. Therefore, it's pointless to try to parse the // library from its filepath as the library does not exist on the disk. let macho_on_disk = { let _scoped = lief::logging::Scoped::new(lief::logging::Level::Off); libsystem.parse_from_path() }; if macho_on_disk.is_none() { println!( "As expected, {} is not present in the filesystem", libsystem.path() ); } // But we can parse it from memory: if let Some(macho_memory) = libsystem.parse_from_memory() { println!("in-memory imagebase: {:#010x}", macho_memory.imagebase()); // List 'exported' symbols for sym in macho_memory.exported_symbols() { println!("{:10}: {:#010x}", sym.name(), sym.value()); } } ``` ## [Android]() On Android, `lief.runtime.android.Module` ( [`lief::runtime::android::Module`]() ; [`lief.runtime.android.Module`]() ; [`LIEF::runtime::android::Module`]() ) extends the generic interface with the same helpers as on Linux: loading a library with `lief.runtime.android.dlopen()` ( [`lief::runtime::android::dlopen`]() ; [`lief.runtime.android.dlopen()`]() ; [`LIEF::runtime::android::dlopen()`]() ), resolving symbols with `lief.runtime.android.Module.dlsym()` ( [`lief::runtime::android::Module::dlsym`]() ; [`lief.runtime.android.Module.dlsym()`]() ; [`LIEF::runtime::android::Module::dlsym()`]() ) and parsing modules from their path on disk. The following snippet demonstrates these operations on the Bionic `libc` and `liblog` modules: **Python** ```python print(f"libc path: {libc.path}") if __cxa_finalize := libc.dlsym("__cxa_finalize"): __cxa_finalize_addr = lief.to_int(__cxa_finalize) print(f"{libc.name}!__cxa_finalize: {__cxa_finalize_addr:#010x}") if malloc := libc.dlsym("malloc"): malloc_addr = lief.to_int(malloc) print(f"{libc.name}!malloc: {malloc_addr:#010x}") # With LIEF extended, we can disassemble the function from its # absolute memory address: if lief.__extended__: for inst in islice(lief.runtime.disassemble(malloc_addr), 4): print(" ", inst) if (elf_on_disk := libc.parse_from_path()) is not None and ( __cxa_finalize := elf_on_disk.get_symbol("__cxa_finalize") ) is not None: print(f"__cxa_finalize: {__cxa_finalize.value:#010x}") if liblog := lief.runtime.android.dlopen("liblog.so"): print( f"liblog loaded: {liblog.path} " f"(dlopen handler={lief.to_int(liblog.handle):#010x})" ) if log_print := liblog.dlsym("__android_log_print"): log_print_addr = lief.to_int(log_print) print(f"{liblog.name}!__android_log_print: {log_print_addr:#010x}") ``` **C++** ```cpp info("libc path: {}", libc->path()); if (void* cxa_finalize = libc->dlsym("__cxa_finalize")) { info("{}!__cxa_finalize: {}", libc->name(), hex(reinterpret_cast(cxa_finalize))); } if (void* malloc_fn = libc->dlsym("malloc")) { auto malloc_ptr = reinterpret_cast(malloc_fn); info("{}!malloc: {}", libc->name(), hex(malloc_ptr)); auto malloc_instructions = LIEF::runtime::disassemble(malloc_ptr); // Dump the first instructions of malloc for (const LIEF::assembly::Instruction& inst : malloc_instructions | std::views::take(4)) { info(" {}", inst.to_string()); } } if (std::unique_ptr elf_on_disk = libc->parse_from_path()) { if (const LIEF::Symbol* sym = elf_on_disk->get_symbol("__cxa_finalize")) { info("__cxa_finalize: {}", hex(sym->value())); } } if (std::unique_ptr liblog = LIEF::runtime::android::dlopen("liblog.so")) { info("liblog loaded: {} (dlopen handle={})", liblog->path(), hex(reinterpret_cast(liblog->handle()))); if (void* log_print = liblog->dlsym("__android_log_print")) { info("{}!__android_log_print: {}", liblog->name(), hex(reinterpret_cast(log_print))); } } ``` **Rust** ```rust println!("libc path: {}", libc.path()); let cxa_finalize = libc.dlsym("__cxa_finalize".to_string()); if !cxa_finalize.is_null() { println!( "{}!__cxa_finalize: {:#010x}", libc.name(), cxa_finalize as usize ); } let malloc = libc.dlsym("malloc".to_string()); if !malloc.is_null() { println!("{}!malloc: {:#010x}", libc.name(), malloc as usize); } // Parse the ELF from its path on the disk if let Some(elf_on_disk) = libc.parse_from_path() { for sym in elf_on_disk.dynamic_symbols() { if sym.name() == "__cxa_finalize" { println!("__cxa_finalize: {:#010x}", sym.value()); break; } } } if let Some(liblog) = runtime::android::dlopen("liblog.so") { println!( "liblog loaded: {} (dlopen handle={:#010x})", liblog.path(), liblog.handle() as usize ); let log_print = liblog.dlsym("__android_log_print".to_string()); if !log_print.is_null() { println!( "{}!__android_log_print: {:#010x}", liblog.name(), log_print as usize ); } } ``` --- documentID: "10c31e2eb505c3421202aea5ddcf9e2667feeafc79f9dcbca1db39e6728b0e6e" docname: "runtime/components/process" title: "Process - Runtime - LIEF Documentation" description: "Inspect the current process and thread IDs, page size, environment variables, and platform-specific loader information with LIEF." canonical: "https://lief.re/doc/latest/runtime/components/process.html" markdownURL: "https://lief.re/doc/latest/runtime/components/process.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "5558dd53e3de444cff6c9a5610d5c3b4184e496158788c736dbba9712a71a6d8" --- # [Process]() The `lief.runtime.Process` ( [`lief::runtime::Process`]() ; [`lief.runtime.Process`]() ; [`LIEF::runtime::Process`]() ) interface exposes an API to query information about the current process. It provides cross-platform API and is extended on each platform with additional OS-specific helpers. ## [Query the current process]() **Python** ```python print(f" PID: {lief.runtime.Process.pid}") print(f" TID: {lief.runtime.Process.tid}") print(f" Page size: {lief.runtime.Process.page_size:#06x}") print(f" Arch: {lief.runtime.Process.arch}") print(f" Platform: {lief.runtime.Process.platform}") print(f" TERM: {lief.runtime.Process.get_env('TERM')}") ``` **C++** ```cpp info(" PID: {}", std::to_string(LIEF::runtime::Process::pid())); info(" TID: {}", std::to_string(LIEF::runtime::Process::tid())); info(" Page size: {}", hex(LIEF::runtime::Process::page_size())); info(" Arch: {}", std::to_string((uint32_t)LIEF::runtime::Process::arch())); info(" Platform: {}", std::to_string((uint32_t)LIEF::runtime::Process::platform())); if (auto term = LIEF::runtime::Process::get_env("TERM")) { info(" TERM: {}", *term); } ``` **Rust** ```rust println!(" PID: {}", runtime::Process::pid()); println!(" TID: {}", runtime::Process::tid()); println!(" Page size: {:#06x}", runtime::Process::page_size()); println!(" Arch: {:?}", runtime::Process::arch()); println!(" Platform: {:?}", runtime::Process::platform()); ``` ## [Linux]() On Linux, `lief.runtime.linux.Process` ( [`lief::runtime::linux::Process`]() ; [`lief.runtime.linux.Process`]() ; [`LIEF::runtime::Linux::Process`]() ) extends the generic interface with platform-specific helpers. For instance, `lief.runtime.linux.Process.glibc_version()` ( [`lief::runtime::linux::Process::glibc_version`]() ; [`lief.runtime.linux.Process.glibc_version`]() ; [`LIEF::runtime::Linux::Process::glibc_version()`]() ) returns the version of the GNU C Library loaded in the current process: **Python** ```python print(f" glibc: {lief.runtime.linux.Process.glibc_version}") ``` **C++** ```cpp info(" glibc: {}", LIEF::runtime::Linux::Process::glibc_version()); ``` **Rust** ```rust if let Some(version) = runtime::linux::Process::glibc_version() { println!(" glibc: {}", version); } ``` ## [Windows]() On Windows, the process interface is extended with `lief.runtime.windows.Process` ( [`lief::runtime::windows::Process`]() ; [`lief.runtime.windows.Process`]() ; [`LIEF::runtime::windows::Process`]() ) which exposes the Process Environment Block (PEB) of the current process. The returned `lief.runtime.windows.PEB` ( [`lief::runtime::windows::PEB`]() ; [`lief.runtime.windows.PEB`]() ; [`LIEF::runtime::windows::PEB`]() ) object provides access to some fields of the structure (whether the process is being debugged, the loader data, the process parameters, …): **Python** ```python if (peb := lief.runtime.windows.Process.peb) is not None: print(f" PEB.BeingDebugged: {peb.being_debugged}") print(f" PEB.Ldr: {peb.ldr:#06x}") print(f" PEB.ProcessParameters: {peb.process_parameters:#06x}") print(f" PEB.AtlThunkSListPtr: {peb.atl_thunk_slist_ptr:#06x}") print(f" PEB.AtlThunkSListPtr32: {peb.atl_thunk_slist_ptr32:#06x}") print(f" PEB.PostProcessInitRoutine: {peb.post_process_init_routine:#06x}") print(f" PEB.SessionId: {peb.session_id:#06x}") ``` **C++** ```cpp if (auto peb = LIEF::runtime::windows::Process::peb()) { info(" PEB.BeingDebugged: {}", peb->being_debugged() ? "true" : "false"); info(" PEB.Ldr: {}", hex(peb->ldr())); info(" PEB.ProcessParameters: {}", hex(peb->process_parameters())); info(" PEB.AtlThunkSListPtr: {}", hex(peb->atl_thunk_slist_ptr())); info(" PEB.AtlThunkSListPtr32: {}", hex(peb->atl_thunk_slist_ptr32())); info(" PEB.PostProcessInitRoutine: {}", hex(peb->post_process_init_routine())); info(" PEB.SessionId: {}", hex(peb->session_id())); } ``` **Rust** ```rust if let Some(peb) = runtime::windows::Process::peb() { println!(" PEB.BeingDebugged: {}", peb.being_debugged()); println!(" PEB.Ldr: {:#06x}", peb.ldr()); println!( " PEB.ProcessParameters: {:#06x}", peb.process_parameters() ); println!( " PEB.AtlThunkSListPtr: {:#06x}", peb.atl_thunk_slist_ptr() ); println!( " PEB.AtlThunkSListPtr32: {:#06x}", peb.atl_thunk_slist_ptr32() ); println!( " PEB.PostProcessInitRoutine: {:#06x}", peb.post_process_init_routine() ); println!(" PEB.SessionId: {:#06x}", peb.session_id()); } ``` The loader’s module list is exposed through `lief.runtime.windows.PEB.entries` ( [`lief::runtime::windows::PEB::entries`]() ; [`lief.runtime.windows.PEB.entries`]() ; [`LIEF::runtime::windows::PEB::entries()`]() ), which yields `lief.runtime.windows.LdrDataTableEntry` ( [`lief::runtime::windows::LdrDataTableEntry`]() ; [`lief.runtime.windows.LdrDataTableEntry`]() ; [`LIEF::runtime::windows::LdrDataTableEntry`]() ) objects. In addition to the base name and image base, each entry exposes the extended `LDR_DATA_TABLE_ENTRY` fields. **Python** ```python if (peb := lief.runtime.windows.Process.peb) is not None: first = next(iter(peb.entries), None) if first is not None: print(f" {first.base_dll_name} extended LDR_DATA_TABLE_ENTRY fields:") # Always available across the supported Windows versions: print(f" Flags: {first.flags:#06x}") print(f" ObsoleteLoadCount: {first.obsolete_load_count}") print(f" TlsIndex: {first.tls_index:#06x}") print(f" TimeDateStamp: {first.time_date_stamp:#06x}") # Attributes that are available only from certain version: if (v := first.ddag_node) is not None: # Windows 8+ print(f" DdagNode: {v:#06x}") if (v := first.original_base) is not None: # Windows 8+ print(f" OriginalBase: {v:#06x}") if (v := first.load_reason) is not None: # Windows 8+ print(f" LoadReason: {v}") if (v := first.signing_level) is not None: # Windows 10+ print(f" SigningLevel: {v}") if (v := first.check_sum) is not None: # Windows 10+ print(f" CheckSum: {v:#06x}") if (v := first.hot_patch_state) is not None: # Windows 11+ print(f" HotPatchState: {v}") ``` **C++** ```cpp if (auto peb = LIEF::runtime::windows::Process::peb()) { auto entries = peb->entries(); auto it = entries.begin(); if (it != entries.end()) { info(" {} extended LDR_DATA_TABLE_ENTRY fields:", it->base_dll_name()); // Always available across the supported Windows versions: info(" Flags: {}", hex(it->flags())); info(" ObsoleteLoadCount: {}", std::to_string(it->obsolete_load_count())); info(" TlsIndex: {}", hex(it->tls_index())); info(" TimeDateStamp: {}", hex(it->time_date_stamp())); // Version-gated fields: each optional is empty when the host kernel // predates the field, so the OS version drives what gets printed. if (auto v = it->ddag_node()) { // Windows 8+ info(" DdagNode: {}", hex(*v)); } if (auto v = it->original_base()) { // Windows 8+ info(" OriginalBase: {}", hex(*v)); } if (auto v = it->load_reason()) { // Windows 8+ info(" LoadReason: {}", std::to_string(*v)); } if (auto v = it->signing_level()) { // Windows 10+ info(" SigningLevel: {}", std::to_string((uint32_t)*v)); } if (auto v = it->check_sum()) { // Windows 10+ info(" CheckSum: {}", hex(*v)); } if (auto v = it->hot_patch_state()) { // Windows 11+ info(" HotPatchState: {}", std::to_string(*v)); } } } ``` **Rust** ```rust if let Some(peb) = runtime::windows::Process::peb() { if let Some(first) = peb.entries().next() { println!( " {} extended LDR_DATA_TABLE_ENTRY fields:", first.base_dll_name() ); // Always available across the supported Windows versions: println!(" Flags: {:#06x}", first.flags()); println!(" ObsoleteLoadCount: {}", first.obsolete_load_count()); println!(" TlsIndex: {:#06x}", first.tls_index()); println!(" TimeDateStamp: {:#06x}", first.time_date_stamp()); // Version-gated fields are None when the host kernel predates them: if let Some(v) = first.ddag_node() { println!(" DdagNode: {:#06x}", v); // Windows 8+ } if let Some(v) = first.original_base() { println!(" OriginalBase: {:#06x}", v); // Windows 8+ } if let Some(v) = first.load_reason() { println!(" LoadReason: {}", v); // Windows 8+ } if let Some(v) = first.signing_level() { println!(" SigningLevel: {}", v); // Windows 10+ } if let Some(v) = first.check_sum() { println!(" CheckSum: {:#06x}", v); // Windows 10+ } if let Some(v) = first.hot_patch_state() { println!(" HotPatchState: {}", v); // Windows 11+ } } } ``` ## [macOS]() On macOS, `lief.runtime.osx.Process` ( [`lief::runtime::osx::Process`]() ; [`lief.runtime.osx.Process`]() ; [`LIEF::runtime::osx::Process`]() ) extends the generic interface with platform-specific helpers. For instance, `lief.runtime.osx.Process.dyld_version()` ( [`lief::runtime::osx::Process::dyld_version`]() ; [`lief.runtime.osx.Process.dyld_version`]() ; [`LIEF::runtime::osx::Process::dyld_version()`]() ) returns the version of `dyld` (the dynamic loader) in the current process: **Python** ```python print(f" dyld: {lief.runtime.osx.Process.dyld_version}") ``` **C++** ```cpp info(" dyld: {}", LIEF::runtime::osx::Process::dyld_version()); ``` **Rust** ```rust println!(" dyld: {}", runtime::osx::Process::dyld_version()); ``` ## [Android]() On Android, `lief.runtime.android.Process` ( [`lief::runtime::android::Process`]() ; [`lief.runtime.android.Process`]() ; [`LIEF::runtime::android::Process`]() ) extends the generic interface. Here are some examples of the API: **Python** ```python # Access a named property sdk = lief.runtime.android.Process.get_system_property("ro.build.version.sdk") if sdk is not None: print(f" {sdk.name}: {sdk.value} (serial: {sdk.serial})") # Iterate over all properties for prop in lief.runtime.android.Process.properties: print(f" {prop.name}: {prop.value} (serial: {prop.serial})") ``` **C++** ```cpp if (auto prop = LIEF::runtime::android::Process::get_system_property( "ro.build.version.sdk" )) { info(" {}: {} (serial: {})", prop->name(), prop->value(), std::to_string(prop->serial())); } for (const auto& prop : LIEF::runtime::android::Process::properties()) { info(" {}: {} (serial: {})", prop.name(), prop.value(), std::to_string(prop.serial())); } ``` **Rust** ```rust // Query a single system property by name if let Some(prop) = runtime::android::Process::get_system_property("ro.build.version.sdk") { println!( " {}: {} (serial: {})", prop.name(), prop.value(), prop.serial() ); } // Iterate over all properties for prop in runtime::android::Process::properties() { println!( " {}: {} (serial: {})", prop.name(), prop.value(), prop.serial() ); } ``` --- documentID: "dcb21aea2e98b1d6911a096db20ecfc07520ef1f2b4596ea86a4c337b8492e63" docname: "runtime/cpp" title: "Runtime C++ API - LIEF Documentation" description: "Runtime C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/runtime/cpp.html" markdownURL: "https://lief.re/doc/latest/runtime/cpp.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "3b45de75576df48592fc359b2e26271b8e640d413bc1e68d403ed9fe480991c0" --- # [C++]() ## [Utilities]() ### [` LIEF::runtime::is_enabled `]() static bool LIEF::runtime::is\_enabled() Whether the runtime features are enabled. ### [` LIEF::runtime::platform `]() static [PLATFORMS]( "LIEF::runtime::PLATFORMS") LIEF::runtime::platform() Platform for which the runtime is compiled. ### [` LIEF::runtime::arch `]() static [ARCH]( "LIEF::runtime::ARCH") LIEF::runtime::arch() Architecture for which the runtime is compiled. ### [` LIEF::runtime::modules `]() modules\_t LIEF::runtime::modules() Return an iterator over the different modules loaded in the current process. ### [` LIEF::runtime::assemble `]() std::vector<uint8\_t> LIEF::runtime::assemble(uint64\_t addr, const std::string &Asm, assembly::[AssemblerConfig]( "LIEF::assembly::AssemblerConfig") &config = assembly::[AssemblerConfig]( "LIEF::assembly::AssemblerConfig")::[default\_config]( "LIEF::assembly::AssemblerConfig::default_config")()) Assemble the provided assembly code at the specified (absolute) virtual address. The function returns the generated assembly bytes. ```cpp #include auto code = LIEF::runtime::assemble(0x7f0011223344, R"( xor rax, rbx; mov rcx, rax; )"); ``` If you need to configure the assembly engine or to define addresses for symbols, you can provide your own [assembly::AssemblerConfig]() instance. ### [` LIEF::runtime::disassemble `]() instructions\_it LIEF::runtime::disassemble(uintptr\_t addr) Start disassembling instructions at the given **absolute** virtual address. ```cpp for (const auto& inst : disassemble(0x7f0011223344)) { std::cout << inst.to_string() << '\n'; } ``` --- ## [Process]() ### [` Process `]() class Process This structure represents the current process and provides functions to query process-level information. Subclassed by [LIEF::runtime::Linux::Process](), [LIEF::runtime::android::Process](), [LIEF::runtime::osx::Process](), [LIEF::runtime::windows::Process]() Public Static Functions #### [` pid `]() static int32\_t pid() Get the [Process]() ID of the current process. #### [` tid `]() static uint32\_t tid() Get the Thread ID of the current thread. #### [` arch `]() static inline [ARCH]( "LIEF::runtime::ARCH") arch() Return the target architecture of the current process. #### [` platform `]() static inline [PLATFORMS]( "LIEF::runtime::PLATFORMS") platform() Return the target platform of the current process. #### [` page_size `]() static uint32\_t page\_size() Return the number of bytes in a memory page. For instance: - `0x1000` (4096 bytes) for x86\_64 - `0x4000` (16384 bytes) for ARM64 #### [` get_env `]() static std::optional<std::string> get\_env(const std::string &key) Return the environment variable associated with the given key. #### [` get_envs `]() static [EnvVars]( "LIEF::runtime::Process::EnvVars") get\_envs() Return the environment variables present in the current process. #### [` default_engine `]() static assembly::[Engine]( "LIEF::assembly::Engine") \*default\_engine() Return the assembler/disassembler for the current process. #### [` EnvVars `]() struct EnvVars This structure wraps environment variables. Public Functions ##### [` empty `]() inline bool empty() const Public Members ##### [` vars `]() std::unordered\_map<std::string, std::string> vars --- ## [Host]() ### [` Host `]() class Host This class represents the current host. Public Static Functions #### [` name `]() static std::string name() The machine hostname. #### [` home_dir `]() static std::string home\_dir() The user home dir (e.g. `/home/romain` or `C:\Users\romain`). #### [` tmp_dir `]() static std::string tmp\_dir() Temporary directory. This function looks at the environment variables to determine the suitable temp directory (e.g. `TEMP`, `TMPDIR`) #### [` config_dir `]() static std::string config\_dir() The directory to store user-specific configuration. #### [` cache_dir `]() static std::string cache\_dir() The directory where software should store their cache files (e.g. `$HOME/.cache`). --- ## [Module]() ### [` Module `]() class Module This class represents an in-memory module which can be an executable or a library. Subclassed by [LIEF::runtime::Linux::Module](), [LIEF::runtime::android::Module](), [LIEF::runtime::osx::Module](), [LIEF::runtime::windows::Module]() Public Functions #### [` Module `]() Module() = delete #### [` Module `]() Module(std::unique\_ptr<details::Module> impl) #### [` Module `]() Module(const [Module]( "LIEF::runtime::Module::Module")&) = delete #### [` operator= `]() [Module]( "LIEF::runtime::Module") &operator=(const [Module]( "LIEF::runtime::Module")&) = delete #### [` Module `]() Module([Module]( "LIEF::runtime::Module::Module")&&) noexcept #### [` operator= `]() [Module]( "LIEF::runtime::Module") &operator=([Module]( "LIEF::runtime::Module")&&) noexcept #### [` clone `]() virtual std::unique\_ptr<[Module]( "LIEF::runtime::Module")> clone() const #### [` imagebase `]() uint64\_t imagebase() const Base address where the module is loaded in memory. #### [` size `]() uint64\_t size() const Virtual size of the current module. #### [` end `]() inline uint64\_t end() const End address of the module. #### [` name `]() std::string name() const Name of the module (e.g. `libc.so.6, kernel32.dll, libsystem_c.dylib`). #### [` path `]() std::string path() const Path of the module. #### [` contains `]() inline bool contains(uintptr\_t addr) const Check if the current module contains the given address. #### [` dump `]() inline std::vector<uint8\_t> dump() const Return the content of the module as it is currently mapped in memory. The returned buffer spans [imagebase()]() over [size()]() bytes. An empty buffer is returned if the imagebase or the size is null. #### [` dump `]() inline std::vector<uint8\_t> dump(const std::string &filepath) const Same as [dump()]() but also writes the content into the file located at `filepath`. #### [` dump `]() inline std::vector<uint8\_t> dump(std::ostream &os) const Same as [dump()]() but also writes the content into the given output stream. #### [` to_string `]() std::string to\_string() const #### [` Tas `]() template<class T> inline const [T]( "LIEF::runtime::Module::as::T") \*as() const This function can be used to **downcast** a [Module]() instance. #### [` Tas `]() template<class T> inline [T]( "LIEF::runtime::Module::as::T") \*as() #### [` ~Module `]() virtual ~Module() Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Module]( "LIEF::runtime::Module") &M) #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::runtime::Module::Iterator"), std::forward\_iterator\_tag, [Module]( "LIEF::runtime::Module"), std::ptrdiff\_t, const [Module]( "LIEF::runtime::Module")\*, const [Module]( "LIEF::runtime::Module")&> Public Types ##### [` implementation `]() using implementation = details::ModuleIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::runtime::Module::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::runtime::Module::Iterator") &operator=(const [Iterator]( "LIEF::runtime::Module::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::runtime::Module::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::runtime::Module::Iterator") &operator=([Iterator]( "LIEF::runtime::Module::Iterator")&&) noexcept ##### [` Iterator `]() Iterator(std::unique\_ptr<details::ModuleIt> impl) ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::runtime::Module::Iterator") &operator++() ##### [` operator* `]() const [Module]( "LIEF::runtime::Module") &operator\*() const ##### [` operator-> `]() const [Module]( "LIEF::runtime::Module") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Module]( "LIEF::runtime::Module")> yield() Transfer ownership of the module at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::runtime::Module::Iterator") &LHS, const [Iterator]( "LIEF::runtime::Module::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::runtime::Module::Iterator") &LHS, const [Iterator]( "LIEF::runtime::Module::Iterator") &RHS) ### [` LIEF::runtime::module_from_name `]() inline std::unique\_ptr<[Module]( "LIEF::runtime::Module")> LIEF::runtime::module\_from\_name(const std::string &name) Find the module with the given name. ### [` LIEF::runtime::module_from_path `]() inline std::unique\_ptr<[Module]( "LIEF::runtime::Module")> LIEF::runtime::module\_from\_path(const std::string &path) Find the module with the given path. ### [` LIEF::runtime::module_from_addr `]() inline std::unique\_ptr<[Module]( "LIEF::runtime::Module")> LIEF::runtime::module\_from\_addr(uintptr\_t addr) Find the module that encompasses the given virtual address (absolute). --- ## [Memory]() ### [` Memory `]() class Memory This class exposes API to access and manage memory. Public Types #### [` MMAP_FLAGS `]() enum MMAP\_FLAGS Flags used when creating a memory map (mmap). *Values:* ##### [` MP_NONE `]() enumerator MP\_NONE = 0 ##### [` MP_PRIVATE `]() enumerator MP\_PRIVATE = 1 << 0 Changes are private to this process (copy-on-write). ##### [` MP_ANONYMOUS `]() enumerator MP\_ANONYMOUS = 1 << 1 The mapping is not backed by any file. ##### [` MP_SHARED `]() enumerator MP\_SHARED = 1 << 2 Changes are shared. ##### [` MP_FIXED `]() enumerator MP\_FIXED = 1 << 3 Interpret the address as a fixed requirement. ##### [` MP_JIT `]() enumerator MP\_JIT = 1 << 4 Map for Just-In-Time code generation. #### [` PERM `]() enum PERM *Values:* ##### [` P_NONE `]() enumerator P\_NONE = 0 ##### [` P_READ `]() enumerator P\_READ = 1 << 0 ##### [` P_WRITE `]() enumerator P\_WRITE = 1 << 1 ##### [` P_EXEC `]() enumerator P\_EXEC = 1 << 2 Public Static Functions #### [` mmap `]() static std::optional<[Chunk]( "LIEF::runtime::Memory::Chunk")> mmap(size\_t size, uint32\_t flags, uint32\_t permissions = [P\_NONE]( "LIEF::runtime::Memory::P_NONE")) Allocate a memory chunk through mmap-like function. #### [` mmap_hint `]() static std::optional<[Chunk]( "LIEF::runtime::Memory::Chunk")> mmap\_hint(uint64\_t hint, size\_t size, uint32\_t flags, uint32\_t permissions = [P\_NONE]( "LIEF::runtime::Memory::P_NONE")) Allocate a memory chunk through mmap-like function and place the allocation at or near the address given in the first parameter. This address is a **hint**: it is rounded up to the next page boundary (next allocation granularity on Windows) and the system remains free to return a chunk located somewhere else. #### [` munmap `]() static [ok\_error\_t]( "LIEF::ok_error_t") munmap([Chunk]( "LIEF::runtime::Memory::Chunk") &C) Deallocate a mmaped memory chunk. #### [` mprotect `]() static [ok\_error\_t]( "LIEF::ok_error_t") mprotect([Chunk]( "LIEF::runtime::Memory::Chunk") &C, uint32\_t flags) Sets the permission of the given memory chunk. #### [` write `]() static inline [ok\_error\_t]( "LIEF::ok_error_t") write(const uint8\_t \*buffer, size\_t size, uintptr\_t addr) Write the buffer at the address given in the third parameter. This function assumes that the memory pointed by `addr` has the correct permission to write this buffer. #### [` write `]() static inline [ok\_error\_t]( "LIEF::ok_error_t") write(const std::vector<uint8\_t> &buffer, uintptr\_t addr) Write the buffer at the address given in the third parameter. This function assumes that the memory pointed by `addr` has the correct permission to write this buffer. #### [` Twrite `]() template<class T, typename = std::enable\_if\_t<std::is\_standard\_layout\_v<[T]( "LIEF::runtime::Memory::write::T")> && std::is\_trivial\_v<[T]( "LIEF::runtime::Memory::write::T")>>> static inline [ok\_error\_t]( "LIEF::ok_error_t") write(const [T]( "LIEF::runtime::Memory::write::T") &value, uintptr\_t addr) Generic function to write a typed value. #### [` Tread `]() template<class T> static inline [T]( "LIEF::runtime::Memory::read::T") read(uintptr\_t addr) Generic function to read a typed value. #### [` read `]() static inline void read(uintptr\_t addr, std::vector<uint8\_t> &out, size\_t size) Read the content at the address pointed by the first parameter and write the result in the `std::vector` provided in the second parameter. #### [` read `]() static inline void read(uintptr\_t addr, uint8\_t \*out, size\_t size) Read the content at the address pointed by the first parameter and write the result in the buffer provided in the second parameter. This function assumes that the buffer in the second parameter is large enough to contain the data being read. #### [` perm_str `]() static std::string perm\_str(uint32\_t flags) #### [` support_rwx `]() static inline bool support\_rwx() #### [` Chunk `]() class Chunk Represents a contiguous chunk of memory allocated or inspected by the runtime. Public Functions ##### [` Chunk `]() inline Chunk(void \*addr, size\_t size, uint32\_t permissions) ##### [` Chunk `]() inline Chunk(void \*addr, size\_t size) ##### [` Chunk `]() inline Chunk(void \*addr) ##### [` addr_ptr `]() inline void \*addr\_ptr() Returns the start address of the memory chunk as an opaque pointer. ##### [` addr_ptr `]() inline const void \*addr\_ptr() const ##### [` addr `]() inline uintptr\_t addr() const Returns the start address of the memory chunk. ##### [` size `]() inline size\_t size() const Returns the size of the memory chunk in bytes. ##### [` permissions `]() inline uint32\_t permissions() const Returns the current permissions of the memory chunk. ##### [` page_start `]() uintptr\_t page\_start() const Returns the address of the start of the page containing this chunk. ##### [` page_end `]() uintptr\_t page\_end() const Returns the address of the end of the page containing this chunk. ##### [` change_permissions `]() inline [Chunk]( "LIEF::runtime::Memory::Chunk") &change\_permissions(uint32\_t p) Changes the permissions of the memory chunk. ##### [` make_x `]() inline [Chunk]( "LIEF::runtime::Memory::Chunk") &make\_x() Sets the permissions to Execute only. ##### [` make_rw `]() inline [Chunk]( "LIEF::runtime::Memory::Chunk") &make\_rw() Sets the permissions to Read and Write. ##### [` make_rx `]() inline [Chunk]( "LIEF::runtime::Memory::Chunk") &make\_rx() Sets the permissions to Read and Execute. ##### [` make_rwx `]() inline [Chunk]( "LIEF::runtime::Memory::Chunk") &make\_rwx() Sets the permissions to Read, Write, and Execute. ##### [` make_ro `]() inline [Chunk]( "LIEF::runtime::Memory::Chunk") &make\_ro() Sets the permissions to Read Only. ##### [` cache_flush `]() [Chunk]( "LIEF::runtime::Memory::Chunk") &cache\_flush() Flushes the instruction cache for this memory chunk. This should be used when modifying code in memory (e.g., hooking, JIT). ##### [` is_valid `]() inline bool is\_valid() const Check if this chunk is valid. ##### [` operator bool `]() inline operator bool() const ##### [` deallocate `]() inline [ok\_error\_t]( "LIEF::ok_error_t") deallocate() ##### [` to_string `]() std::string to\_string() const Friends **friend class Memory** ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Chunk]( "LIEF::runtime::Memory::Chunk") &C) #### [` ScopedPermissions `]() class ScopedPermissions RAII interface to change the permission within a determined scope. Public Functions ##### [` ScopedPermissions `]() inline explicit ScopedPermissions([Chunk]( "LIEF::runtime::Memory::Chunk") &chunk, uint32\_t perms) ##### [` ~ScopedPermissions `]() inline ~ScopedPermissions() --- ## [MemoryLayout]() ### [` MemoryLayout `]() class MemoryLayout This class exposes the memory layout of the current process. #### [` Region `]() class Region A contiguous range of memory mapped in the current process. Public Functions ##### [` Region `]() Region() = default ##### [` Region `]() inline Region(std::string name, uint64\_t addr, uint64\_t size) ##### [` Region `]() Region(const [Region]( "LIEF::runtime::MemoryLayout::Region::Region")&) = default ##### [` operator= `]() [Region]( "LIEF::runtime::MemoryLayout::Region") &operator=(const [Region]( "LIEF::runtime::MemoryLayout::Region")&) = default ##### [` Region `]() Region([Region]( "LIEF::runtime::MemoryLayout::Region::Region")&&) noexcept = default ##### [` operator= `]() [Region]( "LIEF::runtime::MemoryLayout::Region") &operator=([Region]( "LIEF::runtime::MemoryLayout::Region")&&) noexcept = default ##### [` ~Region `]() ~Region() = default ##### [` name `]() inline std::string\_view name() const Name associated with the region: name/path of the module mapped at this address (e.g. `libc.so.6`) or the identifier of a region that is not backed by a file (e.g. `[stack]`, `[heap]`). It can be empty for anonymous regions. ##### [` addr `]() inline uint64\_t addr() const Address at which the region starts. ##### [` size `]() inline uint64\_t size() const Size of the region. ##### [` end_addr `]() inline uint64\_t end\_addr() const Address at which the region ends. ##### [` contains `]() inline bool contains(uint64\_t addr) const Whether the given address is within this region. ##### [` to_string `]() std::string to\_string() const Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Region]( "LIEF::runtime::MemoryLayout::Region") &region) #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::runtime::MemoryLayout::Iterator"), std::forward\_iterator\_tag, [Region]( "LIEF::runtime::MemoryLayout::Region"), std::ptrdiff\_t, const [Region]( "LIEF::runtime::MemoryLayout::Region")\*, const [Region]( "LIEF::runtime::MemoryLayout::Region")&> Forward iterator over the regions of the memory layout. Public Types ##### [` implementation `]() using implementation = details::MemoryLayoutIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::runtime::MemoryLayout::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::runtime::MemoryLayout::Iterator") &operator=(const [Iterator]( "LIEF::runtime::MemoryLayout::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::runtime::MemoryLayout::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::runtime::MemoryLayout::Iterator") &operator=([Iterator]( "LIEF::runtime::MemoryLayout::Iterator")&&) noexcept ##### [` Iterator `]() Iterator(std::unique\_ptr<details::MemoryLayoutIt> impl) ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::runtime::MemoryLayout::Iterator") &operator++() ##### [` operator* `]() const [Region]( "LIEF::runtime::MemoryLayout::Region") &operator\*() const ##### [` operator-> `]() const [Region]( "LIEF::runtime::MemoryLayout::Region") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Region]( "LIEF::runtime::MemoryLayout::Region")> yield() Transfer ownership of the region at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::runtime::MemoryLayout::Iterator") &LHS, const [Iterator]( "LIEF::runtime::MemoryLayout::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::runtime::MemoryLayout::Iterator") &LHS, const [Iterator]( "LIEF::runtime::MemoryLayout::Iterator") &RHS) ### [` LIEF::runtime::memory_layout `]() memory\_layout\_it LIEF::runtime::memory\_layout() Return an iterator over the memory layout of the current process. --- ## [Linux]() ### [Module]() #### [` Module `]() class Module : public LIEF::runtime::[Module]( "LIEF::runtime::Module") This class exposes a Linux-specific API for a module. Public Functions ##### [` handle `]() void \*handle() const Return the dlopen handle for this library. Return a nullptr if the function fails or if the handler can’t be found ##### [` dlsym `]() void \*dlsym(const std::string &name) const Resolve the symbol with the given name for the current module. ##### [` parse_from_path `]() std::unique\_ptr<ELF::[Binary]( "LIEF::ELF::Binary")> parse\_from\_path() const Parse the ELF module from its path on the filesystem. ##### [` parse_from_path `]() std::unique\_ptr<ELF::[Binary]( "LIEF::ELF::Binary")> parse\_from\_path(const ELF::[ParserConfig]( "LIEF::ELF::ParserConfig") &config) const Parse the ELF module from its path on the filesystem and given the parser configuration. ##### [` parse_from_memory `]() std::unique\_ptr<ELF::[Binary]( "LIEF::ELF::Binary")> parse\_from\_memory(const ELF::[ParserConfig]( "LIEF::ELF::ParserConfig") &config) const Parse the ELF module from memory with the given configuration. ##### [` parse_from_memory `]() std::unique\_ptr<ELF::[Binary]( "LIEF::ELF::Binary")> parse\_from\_memory() const Parse the ELF module from memory. ##### [` ~Module `]() virtual ~Module() override = default ##### [` Module `]() Module() = delete ##### [` Module `]() Module(std::unique\_ptr<details::Module> impl) ##### [` Module `]() Module(const [Module]( "LIEF::runtime::Linux::Module::Module")&) = delete ##### [` Module `]() Module([Module]( "LIEF::runtime::Linux::Module::Module")&&) noexcept Public Static Functions ##### [` from_handle `]() static std::unique\_ptr<[Module]( "LIEF::runtime::Linux::Module")> from\_handle(void \*H) Instantiate a [Module]() from the given `dlopen` handle. ##### [` classof `]() static inline bool classof(const runtime::[Module]( "LIEF::runtime::Module")\*) #### [` LIEF::runtime::Linux::dlopen `]() std::unique\_ptr<[Module]( "LIEF::runtime::Linux::Module")> LIEF::runtime::Linux::dlopen(const std::string &name) Load the library with the given path/name. --- ### [Host]() #### [` Host `]() class Host This class exposes Linux-specific host information. Public Static Functions ##### [` sys_name `]() static std::string sys\_name() Operating system name (e.g., `Linux`). ##### [` sys_release `]() static std::string sys\_release() Operating system release (e.g., `2.6.28`). ##### [` sys_version `]() static std::string sys\_version() Operating system version. ##### [` hardware `]() static std::string hardware() Hardware type identifier (e.g., `x86_64`). --- ### [Process]() #### [` Process `]() class Process : public LIEF::runtime::[Process]( "LIEF::runtime::Process") This class exposes Linux-specific API for the current process. Public Static Functions ##### [` cmdline `]() static std::string cmdline() Return the content of `/proc/cmdline`. ##### [` glibc_version `]() static std::string glibc\_version() Return the version of the GNU C Library (glibc) loaded in the current process (e.g. `2.39`). Return an empty string if the version cannot be determined. ##### [` classof `]() static inline bool classof(const runtime::[Process]( "LIEF::runtime::Process")\*) --- ## [Android]() ### [Module]() #### [` Module `]() class Module : public LIEF::runtime::[Module]( "LIEF::runtime::Module") This class exposes Android-specific API for a module. Public Functions ##### [` handle `]() void \*handle() const Return the dlopen handle for this library. Return a nullptr if the function fails or if the handler can’t be found ##### [` dlsym `]() void \*dlsym(const std::string &name) const Resolve the symbol from with the given name for the current module. ##### [` parse_from_path `]() std::unique\_ptr<ELF::[Binary]( "LIEF::ELF::Binary")> parse\_from\_path() const Parse the ELF module from its path on the filesystem. ##### [` parse_from_path `]() std::unique\_ptr<ELF::[Binary]( "LIEF::ELF::Binary")> parse\_from\_path(const ELF::[ParserConfig]( "LIEF::ELF::ParserConfig") &config) const Parse the ELF module from its path on the filesystem and given the parser configuration. ##### [` parse_from_memory `]() std::unique\_ptr<ELF::[Binary]( "LIEF::ELF::Binary")> parse\_from\_memory(const ELF::[ParserConfig]( "LIEF::ELF::ParserConfig") &config) const Parse the ELF module from memory with the given configuration. ##### [` parse_from_memory `]() std::unique\_ptr<ELF::[Binary]( "LIEF::ELF::Binary")> parse\_from\_memory() const Parse the ELF module from memory. ##### [` ~Module `]() virtual ~Module() override = default ##### [` Module `]() Module() = delete ##### [` Module `]() Module(std::unique\_ptr<details::Module> impl) ##### [` Module `]() Module(const [Module]( "LIEF::runtime::android::Module::Module")&) = delete ##### [` Module `]() Module([Module]( "LIEF::runtime::android::Module::Module")&&) noexcept Public Static Functions ##### [` from_handle `]() static std::unique\_ptr<[Module]( "LIEF::runtime::android::Module")> from\_handle(void \*H) Instantiate a [Module]() from the given `dlopen` handle. ##### [` classof `]() static inline bool classof(const runtime::[Module]( "LIEF::runtime::Module")\*) #### [` LIEF::runtime::android::dlopen `]() std::unique\_ptr<[Module]( "LIEF::runtime::android::Module")> LIEF::runtime::android::dlopen(const std::string &name) Load the library with the given path/name. --- ### [Host]() #### [` Host `]() class Host This class exposes Android-specific host information. Public Static Functions ##### [` sdk_version `]() static std::optional<uint32\_t> sdk\_version() Return the Android SDK/API level of the device (e.g. `34` for Android 14). --- ### [Process]() #### [` Process `]() class Process : public LIEF::runtime::[Process]( "LIEF::runtime::Process") This class exposes Android-specific API for the current process. Public Types ##### [` properties_t `]() using properties\_t = std::vector<[Property]( "LIEF::runtime::android::Property")> Public Static Functions ##### [` cmdline `]() static std::string cmdline() Return the content of `/proc/cmdline`. ##### [` get_system_property `]() static std::optional<[Property]( "LIEF::runtime::android::Property")> get\_system\_property(const std::string &name) Return the value of the Android system property with the given `name` (e.g. `ro.build.version.sdk`). ##### [` properties `]() static [properties\_t]( "LIEF::runtime::android::Process::properties_t") properties() Get all the system properties. ##### [` classof `]() static inline bool classof(const runtime::[Process]( "LIEF::runtime::Process")\*) ### [Property]() #### [` Property `]() class Property This class represents an Android property such as `ro.boot.hardware`. Public Functions ##### [` Property `]() Property() = default ##### [` Property `]() inline Property(std::string name, std::string value, uint32\_t serial) ##### [` Property `]() Property(const [Property]( "LIEF::runtime::android::Property::Property")&) = default ##### [` operator= `]() [Property]( "LIEF::runtime::android::Property") &operator=(const [Property]( "LIEF::runtime::android::Property")&) = default ##### [` Property `]() Property([Property]( "LIEF::runtime::android::Property::Property")&&) noexcept = default ##### [` operator= `]() [Property]( "LIEF::runtime::android::Property") &operator=([Property]( "LIEF::runtime::android::Property")&&) noexcept = default ##### [` ~Property `]() ~Property() = default ##### [` name `]() inline std::string\_view name() const Name of the property (e.g. `ro.boot.hardware`). ##### [` value `]() inline std::string\_view value() const Value associated with the property. ##### [` serial `]() inline uint32\_t serial() const Serial number of the property. It is incremented each time the property is updated and can therefore be used to detect changes. ##### [` to_string `]() std::string to\_string() const Pretty representation of the property. Public Static Functions ##### [` create_from `]() static [Property]( "LIEF::runtime::android::Property") create\_from(const prop\_info &pi) Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Property]( "LIEF::runtime::android::Property") &prop) --- ## [macOS]() ### [Module]() #### [` Module `]() class Module : public LIEF::runtime::[Module]( "LIEF::runtime::Module") This class exposes an OSX-specific API for a module. Public Functions ##### [` handle `]() void \*handle() const Return the `dlopen` handle for this library. Return a nullptr if the function fails or if the handler can’t be found ##### [` dlsym `]() void \*dlsym(const std::string &name) const Resolve the symbol with the given name for the current module. ##### [` parse_from_path `]() std::unique\_ptr<MachO::[Binary]( "LIEF::MachO::Binary")> parse\_from\_path() const Parse the Mach-O module from its path on the filesystem. ##### [` parse_from_path `]() std::unique\_ptr<MachO::[Binary]( "LIEF::MachO::Binary")> parse\_from\_path(const MachO::[ParserConfig]( "LIEF::MachO::ParserConfig") &config) const Parse the Mach-O module from its path on the filesystem with the given parser configuration. ##### [` parse_from_memory `]() std::unique\_ptr<MachO::[Binary]( "LIEF::MachO::Binary")> parse\_from\_memory() const Parse the Mach-O module from memory. ##### [` parse_from_memory `]() std::unique\_ptr<MachO::[Binary]( "LIEF::MachO::Binary")> parse\_from\_memory(const MachO::[ParserConfig]( "LIEF::MachO::ParserConfig") &config) const Parse the Mach-O module from memory with the given configuration. ##### [` ~Module `]() virtual ~Module() override = default ##### [` Module `]() Module() = delete ##### [` Module `]() Module(std::unique\_ptr<details::Module> impl) ##### [` Module `]() Module(const [Module]( "LIEF::runtime::osx::Module::Module")&) = delete ##### [` Module `]() Module([Module]( "LIEF::runtime::osx::Module::Module")&&) noexcept Public Static Functions ##### [` from_handle `]() static std::unique\_ptr<[Module]( "LIEF::runtime::osx::Module")> from\_handle(void \*handle) Instantiate a [Module]() from the given `dlopen` handle. ##### [` classof `]() static inline bool classof(const runtime::[Module]( "LIEF::runtime::Module")\*) #### [` LIEF::runtime::osx::dlopen `]() std::unique\_ptr<[Module]( "LIEF::runtime::osx::Module")> LIEF::runtime::osx::dlopen(const std::string &name) Load the library with the given path or name. ### [Host]() #### [` Host `]() class Host Public Static Functions ##### [` os_version_name `]() static std::string os\_version\_name() The OS version string (e.g. `Version 26.2 (Build 25C56)`). ##### [` os_version `]() static [version\_t]( "LIEF::runtime::osx::Host::version_t") os\_version() The OS version (e.g. `13.0.0`). ##### [` is_sip_enabled `]() static bool is\_sip\_enabled() Whether System Integrity Protection (SIP) is enabled on this host. This conservatively returns `true` when the status can’t be determined (including on a non-macOS build). ##### [` version_t `]() struct version\_t Public Functions ###### [` version_t `]() inline version\_t(uint32\_t major, uint32\_t minor, uint32\_t patch) ###### [` operator<= `]() bool operator<=(const [version\_t]( "LIEF::runtime::osx::Host::version_t") &rhs) const ###### [` operator> `]() inline bool operator>(const [version\_t]( "LIEF::runtime::osx::Host::version_t") &rhs) const ###### [` operator>= `]() bool operator>=(const [version\_t]( "LIEF::runtime::osx::Host::version_t") &rhs) const ###### [` operator< `]() inline bool operator<(const [version\_t]( "LIEF::runtime::osx::Host::version_t") &rhs) const ###### [` operator== `]() bool operator==(const [version\_t]( "LIEF::runtime::osx::Host::version_t") &other) const ###### [` operator!= `]() inline bool operator!=(const [version\_t]( "LIEF::runtime::osx::Host::version_t") &other) const ###### [` to_string `]() std::string to\_string() const Public Members ###### [` major `]() uint32\_t major = 0 ###### [` minor `]() uint32\_t minor = 0 ###### [` patch `]() uint32\_t patch = 0 Public Static Functions ###### [` BigSur `]() static const [version\_t]( "LIEF::runtime::osx::Host::version_t") &BigSur() ###### [` Monterey `]() static const [version\_t]( "LIEF::runtime::osx::Host::version_t") &Monterey() ###### [` Ventura `]() static const [version\_t]( "LIEF::runtime::osx::Host::version_t") &Ventura() ###### [` Sonoma `]() static const [version\_t]( "LIEF::runtime::osx::Host::version_t") &Sonoma() ###### [` Sequoia `]() static const [version\_t]( "LIEF::runtime::osx::Host::version_t") &Sequoia() ###### [` Tahoe `]() static const [version\_t]( "LIEF::runtime::osx::Host::version_t") &Tahoe() Friends ###### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [version\_t]( "LIEF::runtime::osx::Host::version_t") version) ### [Process]() #### [` Process `]() class Process : public LIEF::runtime::[Process]( "LIEF::runtime::Process") This class exposes OSX-specific API for the current process. Public Static Functions ##### [` dyld_version `]() static std::string dyld\_version() Return the version of dyld for the current process. ##### [` classof `]() static inline bool classof(const runtime::[Process]( "LIEF::runtime::Process")\*) --- ## [Windows]() ### [Module]() #### [` Module `]() class Module : public LIEF::runtime::[Module]( "LIEF::runtime::Module") This class exposes a Windows-specific API for a module. Public Functions ##### [` handle `]() void \*handle() const Return the `HMODULE` handle as an opaque pointer. Return a nullptr if the function fails or if the handler can’t be found ##### [` dlsym `]() void \*dlsym(const std::string &name) const Resolve the symbol with the given name for the current module. ##### [` parse_from_path `]() std::unique\_ptr<PE::[Binary]( "LIEF::PE::Binary")> parse\_from\_path() const Parse the PE module from its path on the filesystem. ##### [` parse_from_path `]() std::unique\_ptr<PE::[Binary]( "LIEF::PE::Binary")> parse\_from\_path(const PE::[ParserConfig]( "LIEF::PE::ParserConfig") &config) const Parse the PE module from its path on the filesystem and given the parser configuration. ##### [` parse_from_memory `]() std::unique\_ptr<PE::[Binary]( "LIEF::PE::Binary")> parse\_from\_memory(const PE::[ParserConfig]( "LIEF::PE::ParserConfig") &config) const Parse the PE module from memory with the given configuration. ##### [` parse_from_memory `]() std::unique\_ptr<PE::[Binary]( "LIEF::PE::Binary")> parse\_from\_memory() const Parse the PE module from memory. ##### [` ~Module `]() virtual ~Module() override = default ##### [` Module `]() Module() = delete ##### [` Module `]() Module(std::unique\_ptr<details::Module> impl) ##### [` Module `]() Module(const [Module]( "LIEF::runtime::windows::Module::Module")&) = delete ##### [` Module `]() Module([Module]( "LIEF::runtime::windows::Module::Module")&&) noexcept Public Static Functions ##### [` from_handle `]() static std::unique\_ptr<[Module]( "LIEF::runtime::windows::Module")> from\_handle(void \*H) ##### [` classof `]() static inline bool classof(const runtime::[Module]( "LIEF::runtime::Module")\*) #### [` LIEF::runtime::windows::dlopen `]() std::unique\_ptr<[Module]( "LIEF::runtime::windows::Module")> LIEF::runtime::windows::dlopen(const std::string &name) Load the windows library with the given path or name. #### [` LIEF::runtime::windows::find_module `]() std::unique\_ptr<[Module]( "LIEF::runtime::windows::Module")> LIEF::runtime::windows::find\_module(const std::string &name) Try to get the [Module]() with the given name. Return a nullptr if the module is not found ```cpp if (auto ntdll = find_module("ntdll.dll")) { std::cout << ntdll->path() << '\n'; } ``` > **Note** > > This function relies on the Windows API `GetModuleHandle` which is more efficient than the generic implementation [LIEF::runtime::module\_from\_name]() ### [Host]() #### [` Host `]() class Host This class exposes Windows-specific host information. Public Static Functions ##### [` version `]() static [version\_t]( "LIEF::runtime::windows::Host::version_t") version() Return the Windows version (e.g., `10.0.26200`). ##### [` version_t `]() struct version\_t Public Functions ###### [` version_t `]() version\_t() = default ###### [` version_t `]() inline version\_t(uint32\_t major, uint32\_t minor, uint32\_t build\_number) ###### [` operator<= `]() bool operator<=(const [version\_t]( "LIEF::runtime::windows::Host::version_t") &rhs) const ###### [` operator> `]() inline bool operator>(const [version\_t]( "LIEF::runtime::windows::Host::version_t") &rhs) const ###### [` operator>= `]() bool operator>=(const [version\_t]( "LIEF::runtime::windows::Host::version_t") &rhs) const ###### [` operator< `]() inline bool operator<(const [version\_t]( "LIEF::runtime::windows::Host::version_t") &rhs) const ###### [` operator== `]() bool operator==(const [version\_t]( "LIEF::runtime::windows::Host::version_t") &other) const ###### [` operator!= `]() inline bool operator!=(const [version\_t]( "LIEF::runtime::windows::Host::version_t") &other) const ###### [` to_string `]() std::string to\_string() const Public Members ###### [` major `]() uint32\_t major = 0 ###### [` minor `]() uint32\_t minor = 0 ###### [` build_number `]() uint32\_t build\_number = 0 Friends ###### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [version\_t]( "LIEF::runtime::windows::Host::version_t") &version) ### [Injector]() #### [` injection_context_t `]() struct injection\_context\_t Describes how to spawn a new process and inject a library into it. Public Functions ##### [` validate `]() bool validate() const Check whether the context is consistent (required paths filled-in and readable). ##### [` operator bool `]() inline operator bool() const ##### [` to_string `]() std::string to\_string() const Public Members ##### [` target_path `]() std::string target\_path Absolute path to the target executable to spawn. ##### [` args `]() std::string args Command-line arguments passed to the spawned process. ##### [` library `]() std::string library Absolute path to the library (DLL) that should be injected. ##### [` env `]() std::unordered\_map<std::string, std::string> env Environment variables to set in the spawned process. If left empty, the current process environment is inherited. Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [injection\_context\_t]( "LIEF::runtime::windows::injection_context_t") &ctx) #### [` LIEF::runtime::windows::inject_spawn `]() [ok\_error\_t]( "LIEF::ok_error_t") LIEF::runtime::windows::inject\_spawn(const [injection\_context\_t]( "LIEF::runtime::windows::injection_context_t") &ctx) Spawn the target described by the given injection context and inject the associated library before the main thread starts executing. This is the Windows equivalent of a “create suspended + remote LoadLibrary” approach. ### [Process]() #### [` Process `]() class Process : public LIEF::runtime::[Process]( "LIEF::runtime::Process") This class exposes Windows-specific API for the current process. Public Static Functions ##### [` peb `]() static std::unique\_ptr<[PEB]( "LIEF::runtime::windows::PEB")> peb() Return an interface over the internal [Process]() Environment Block ([PEB]()). ##### [` classof `]() static inline bool classof(const runtime::[Process]( "LIEF::runtime::Process")\*) ### [PEB]() #### [` PEB `]() class PEB This class exposes a user-friendly interface over the [Process]() Environment Block ([PEB]()) of the current process. An instance can be created through [LIEF::runtime::windows::Process::peb()](). ```cpp if (auto peb = LIEF::runtime::windows::Process::peb()) { if (peb->being_debugged()) { // A debugger is attached to the current process } } ``` Public Types ##### [` entries_it `]() using entries\_it = [iterator\_range]( "LIEF::iterator_range")<[LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry")::[Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator")> Iterator over the [LdrDataTableEntry]() referenced by the loader data. Public Functions ##### [` PEB `]() PEB() = delete ##### [` PEB `]() PEB(const [PEB]( "LIEF::runtime::windows::PEB::PEB")&) = delete ##### [` operator= `]() [PEB]( "LIEF::runtime::windows::PEB") &operator=(const [PEB]( "LIEF::runtime::windows::PEB")&) = delete ##### [` PEB `]() PEB([PEB]( "LIEF::runtime::windows::PEB::PEB")&&) noexcept ##### [` operator= `]() [PEB]( "LIEF::runtime::windows::PEB") &operator=([PEB]( "LIEF::runtime::windows::PEB")&&) noexcept ##### [` being_debugged `]() bool being\_debugged() const Whether the current process is being debugged. ##### [` ldr `]() uintptr\_t ldr() const Address of the loader data structure (`PEB_LDR_DATA`). ##### [` process_parameters `]() uintptr\_t process\_parameters() const Address of the process parameters (`RTL_USER_PROCESS_PARAMETERS`). ##### [` atl_thunk_slist_ptr `]() uintptr\_t atl\_thunk\_slist\_ptr() const Address of the per-process ATL thunk SList (single-linked list). ##### [` atl_thunk_slist_ptr32 `]() uint32\_t atl\_thunk\_slist\_ptr32() const 32-bit value of the ATL thunk SList pointer. ##### [` post_process_init_routine `]() uintptr\_t post\_process\_init\_routine() const Address of the routine called once the process completed its initialization (`PostProcessInitRoutine`). ##### [` session_id `]() uint32\_t session\_id() const Session ID associated with the current process. ##### [` entries `]() [entries\_it]( "LIEF::runtime::windows::PEB::entries_it") entries() const Return a bidirectional iterator over the modules referenced by the loader data (`Ldr`). ```cpp if (auto peb = LIEF::runtime::windows::Process::peb()) { for (const LdrDataTableEntry& entry : peb->entries()) { // entry.base_dll_name(), entry.dll_base(), ... } } ``` ##### [` ~PEB `]() ~PEB() Friends **friend class Process** ### [LdrDataTableEntry]() #### [` LdrDataTableEntry `]() class LdrDataTableEntry This class exposes a user-friendly interface over a `LDR_DATA_TABLE_ENTRY`, the structure used by the Windows loader to describe a module loaded in the current process. Public Functions ##### [` LdrDataTableEntry `]() LdrDataTableEntry() = delete ##### [` LdrDataTableEntry `]() LdrDataTableEntry(std::unique\_ptr<details::ldr\_entry> impl) ##### [` LdrDataTableEntry `]() LdrDataTableEntry(const [LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry::LdrDataTableEntry")&) = delete ##### [` operator= `]() [LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry") &operator=(const [LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry")&) = delete ##### [` LdrDataTableEntry `]() LdrDataTableEntry([LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry::LdrDataTableEntry")&&) noexcept ##### [` operator= `]() [LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry") &operator=([LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry")&&) noexcept ##### [` dll_base `]() uintptr\_t dll\_base() const Base address at which the module is mapped in memory (`DllBase`). ##### [` entry_point `]() uintptr\_t entry\_point() const Address of the entry point of the module (`EntryPoint`). ##### [` size_of_image `]() uint32\_t size\_of\_image() const Size (in bytes) of the module’s image in memory (`SizeOfImage`). ##### [` full_dll_name `]() std::string full\_dll\_name() const Full path of the module (`FullDllName`), e.g. `C:\Windows\System32\ntdll.dll`. ##### [` base_dll_name `]() std::string base\_dll\_name() const Base name of the module (`BaseDllName`), e.g. `ntdll.dll`. ##### [` flags `]() uint32\_t flags() const Loader flags describing the state of the module (`Flags`). ##### [` obsolete_load_count `]() uint16\_t obsolete\_load\_count() const Legacy load count of the module (`ObsoleteLoadCount`). Superseded by `reference_count()` on Windows 8 and later. ##### [` tls_index `]() uint16\_t tls\_index() const TLS slot index assigned to the module, or `0` when it has no TLS (`TlsIndex`). ##### [` time_date_stamp `]() uint32\_t time\_date\_stamp() const `TimeDateStamp` of the module as cached by the loader. ##### [` entry_point_activation_context `]() uintptr\_t entry\_point\_activation\_context() const Address of the activation context associated with the module’s entry point. ##### [` lock `]() uintptr\_t lock() const Address of the per-entry loader lock. ##### [` ddag_node `]() std::optional<uintptr\_t> ddag\_node() const Address of the dependency-graph node of the module (`DdagNode`). > **Note** > > Available on Windows 8 and later. ##### [` load_context `]() std::optional<uintptr\_t> load\_context() const Address of the loader context used while the module is being snapped. > **Note** > > Available on Windows 8 and later. ##### [` parent_dll_base `]() std::optional<uintptr\_t> parent\_dll\_base() const Base address of the module that triggered the load of this one. > **Note** > > Available on Windows 8 and later. ##### [` switch_back_context `]() std::optional<uintptr\_t> switch\_back\_context() const Address of the CHPE switch-back context. > **Note** > > Available on Windows 8 and later. ##### [` original_base `]() std::optional<uintptr\_t> original\_base() const Preferred base address recorded in the PE headers. > **Note** > > Available on Windows 8 and later. ##### [` load_time `]() std::optional<int64\_t> load\_time() const Time at which the module was loaded. > **Note** > > Available on Windows 8 and later. ##### [` base_name_hash_value `]() std::optional<uint32\_t> base\_name\_hash\_value() const Hash of the module’s base name used to index the loader tables. > **Note** > > Available on Windows 8 and later. ##### [` load_reason `]() std::optional<int32\_t> load\_reason() const Reason why the module was loaded, as a `LDR_DLL_LOAD_REASON` value. > **Note** > > Available on Windows 8 and later. ##### [` implicit_path_options `]() std::optional<uint32\_t> implicit\_path\_options() const Path-search options implied when the module was resolved. > **Note** > > Available on Windows 8 and later. ##### [` reference_count `]() std::optional<uint32\_t> reference\_count() const Number of references currently held on the module. > **Note** > > Available on Windows 8 and later. ##### [` dependent_load_flags `]() std::optional<uint32\_t> dependent\_load\_flags() const Flags controlling how the statically-linked dependencies of the module are loaded. > **Note** > > Available on Windows 8 and later. ##### [` signing_level `]() std::optional<uint8\_t> signing\_level() const Signing level of the module’s image, as a `SE_SIGNING_LEVEL` value. > **Note** > > Available on Windows 10 and later. ##### [` check_sum `]() std::optional<uint32\_t> check\_sum() const Image checksum cached by the loader. > **Note** > > Available on Windows 10 and later. ##### [` active_patch_image_base `]() std::optional<uintptr\_t> active\_patch\_image\_base() const Base address of the active hot-patch image, if any. > **Note** > > Available on Windows 11 and later. ##### [` hot_patch_state `]() std::optional<uint32\_t> hot\_patch\_state() const State of the hot-patch engine for this module, as a `LDR_HOT_PATCH_STATE` value. > **Note** > > Available on Windows 11 and later. ##### [` to_string `]() std::string to\_string() const Pretty-printed representation of this entry. ##### [` ~LdrDataTableEntry `]() ~LdrDataTableEntry() Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry") &entry) ##### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator"), std::bidirectional\_iterator\_tag, [LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry"), std::ptrdiff\_t, const [LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry")\*, const [LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry")&> Bidirectional iterator over the [LdrDataTableEntry]() mirroring the doubly-linked list used by Windows. Public Types ###### [` implementation `]() using implementation = details::ldr\_entry\_it Public Functions ###### [` Iterator `]() Iterator() ###### [` Iterator `]() Iterator(std::unique\_ptr<details::ldr\_entry\_it> impl) ###### [` Iterator `]() Iterator(const [Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator::Iterator")&) ###### [` operator= `]() [Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator") &operator=(const [Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator")&) ###### [` Iterator `]() Iterator([Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator::Iterator")&&) noexcept ###### [` operator= `]() [Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator") &operator=([Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator")&&) noexcept ###### [` ~Iterator `]() ~Iterator() ###### [` operator++ `]() [Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator") &operator++() ###### [` operator-- `]() [Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator") &operator--() ###### [` operator* `]() const [LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry") &operator\*() const ###### [` operator-> `]() const [LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry") \*operator->() const ###### [` yield `]() std::unique\_ptr<[LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry")> yield() Transfer ownership of the entry at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ###### [` operator++ `]() inline DerivedT operator++(int) ###### [` operator-- `]() inline DerivedT operator--(int) Friends ###### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator") &LHS, const [Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator") &RHS) ###### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator") &LHS, const [Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator") &RHS) --- ## [ARCH]() ### [` LIEF::runtime::ARCH `]() enum class LIEF::runtime::ARCH : uint32\_t *Values:* #### [` NONE `]() enumerator NONE #### [` X86_64 `]() enumerator X86\_64 #### [` ARM64 `]() enumerator ARM64 #### [` RISCV64 `]() enumerator RISCV64 ## [PLATFORMS]() ### [` LIEF::runtime::PLATFORMS `]() enum class LIEF::runtime::PLATFORMS : uint32\_t *Values:* #### [` NONE `]() enumerator NONE = 0 #### [` LINUX `]() enumerator LINUX #### [` WINDOWS `]() enumerator WINDOWS #### [` ANDROID_ `]() enumerator ANDROID\_ #### [` OSX `]() enumerator OSX #### [` IOS `]() enumerator IOS --- documentID: "95d19b36095de51590ca6f781d05ba08be951212840a3881ee2a21fe6a13ae20" docname: "runtime/intro" title: "Runtime - LIEF Documentation" description: "Enable LIEF's runtime API and inspect the current process, loaded modules, host information, and memory in Python, C++, and Rust." canonical: "https://lief.re/doc/latest/runtime/intro.html" markdownURL: "https://lief.re/doc/latest/runtime/intro.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "34c7a81fad53c9cb9915e8bf0db6a4c35ba99b29ee8acadb3f425cf0d118e9c7" --- # [Runtime]() Components - [Host]() - [Process]() - [Memory]() - [Memory Layout]() - [Modules]() API - [C++]() - [Python]() - [Rust]() ## [Introduction]() LIEF’s runtime module provides facilities to inspect and interact with the current process in which the API is used. You can, for instance, list modules loaded in memory or read the content at a specific memory address. These runtime features are **not** enabled by default and must be explicitly turned on when compiling LIEF. When using CMake, you must enable the `LIEF_RUNTIME` option (`-DLIEF_RUNTIME=ON`) followed by the target platform and the architecture for which you want to use the runtime API: ```console $ cmake [...] \ -DLIEF_RUNTIME=ON \ -DLIEF_RUNTIME_PLATFORM=windows \ -DLIEF_RUNTIME_ARCH=arm64 ``` > **Note** > > Only `arm64`, `x86_64` and `riscv64` are currently supported for `LIEF_RUNTIME_ARCH`. The supported values for `LIEF_RUNTIME_PLATFORM` are `linux`, `windows`, `android` and `osx`. To compile the Python bindings with the runtime features, you must enable the `lief.features.runtime` option and specify the target platform and architecture within the `[lief.runtime]` block: ```toml [lief.build] type = "Release" cache = true ninja = true parallel-jobs = 0 [lief.formats] elf = true pe = true macho = true android = true art = true vdex = true oat = true dex = true [lief.features] json = true frozen = true runtime = true [lief.runtime] platform = 'linux' architecture = 'x86_64' ``` The runtime features are split in the following components: Components - [Host]() - [Process]() - [Memory]() - [Memory Layout]() - [Modules]() ## [API reference]() - [C++]() - [Python]() - [Rust]() --- documentID: "814d8cef7b0f368b469607f5929feeabdd9081b37722c78dc04c6d1d216b0e73" docname: "runtime/python" title: "Runtime Python API - LIEF Documentation" description: "Runtime Python API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/runtime/python.html" markdownURL: "https://lief.re/doc/latest/runtime/python.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "9fa82d305b90ec7a6c9095bd6c21dc88393c7940839a31deb074887e1650e99d" --- # [Python]() > **Python `void*`** > > The Python bindings manage opaque `void*` pointers as [Capsules](). Given a Capsule, there is no easy way to convert it into a raw address and vice versa. To address this limitation, LIEF exposes [`lief.to_int()`]( "lief.to_int") and [`lief.to_ptr()`]( "lief.to_ptr") to convert back and forth between raw addresses and pointers. ## [Utilities]() ### [` lief.to_int `]() lief.to\_int(*ptr: typing\_extensions.CapsuleType*) → int Convert an opaque pointer into an address (int) ### [` lief.to_ptr `]() lief.to\_ptr(*ptr: int*) → typing\_extensions.CapsuleType Convert an integer into an opaque pointer (`void*`) ### [` runtime.enabled `]() runtime.enabled = False ### [` runtime.platform `]() runtime.platform = 0 ### [` runtime.arch `]() runtime.arch = 0 ### [` lief.runtime.modules `]() lief.runtime.modules() → Iterator[[lief.runtime.Module]( "lief.runtime.Module") | None] Return an iterator over the different modules loaded in the current process ### [` lief.runtime.assemble `]() lief.runtime.assemble(*address: int*, *assembly: str*, *config: [lief.assembly.AssemblerConfig]( "lief.assembly.AssemblerConfig")*) → bytes Assemble the provided assembly code at the specified (absolute) virtual address. The function returns the generated assembly bytes. ```python from lief import runtime code = runtime.assemble(0x7f0011223344, """ xor rax, rbx; mov rcx, rax; """) ``` If you need to configure the assembly engine or to define addresses for symbols, you can provide your own [`AssemblerConfig`]( "lief.assembly.AssemblerConfig") instance. ### [` lief.runtime.disassemble `]() lief.runtime.disassemble(*addr: int*) → Iterator[[lief.assembly.Instruction]( "lief.assembly.Instruction") | None] Start disassembling instructions at the given **absolute** virtual address. ```python from lief import runtime for inst in runtime.disassemble(0x7f0011223344): print(inst) ``` > **See also** > > [`lief.assembly.Instruction`]( "lief.assembly.Instruction") --- ## [Host]() ### [` lief.runtime.Host `]() class lief.runtime.Host Bases: `object` This class represents the current host. #### [` cache_dir `]() cache\_dir = '' #### [` config_dir `]() config\_dir = '' #### [` home_dir `]() home\_dir = '' #### [` name `]() name = '' #### [` tmp_dir `]() tmp\_dir = '' --- ## [Process]() ### [` lief.runtime.Process `]() class lief.runtime.Process Bases: `object` This class represents the current process and provides functions to query process-level information. #### [` EnvVars `]() class EnvVars Bases: `object` This structure wraps environment variables ##### [` vars `]() property vars → dict[str, str] #### [` arch `]() arch = 0 #### [` envs `]() envs = <lief.\_lief.runtime.Process.EnvVars object> #### [` get_env `]() get\_env(*key: str*) → str | None = <nanobind.nb\_func object> #### [` page_size `]() page\_size = 0 #### [` pid `]() pid = -1 #### [` platform `]() platform = 0 #### [` tid `]() tid = 0 --- ## [Module]() ### [` lief.runtime.Module `]() class lief.runtime.Module Bases: `object` This class represents an in-memory module which can be an executable or a library #### [` contains `]() contains(*self*, *addr: int*) → bool Check if the current module contains the given address #### [` dumpdump `]() dump(*self*) → bytes **dump(*self*, *filepath: str*) → bytes** Overloaded function. 1. `dump(self) -> bytes` Return the content of the module as it is currently mapped in memory 2. `dump(self, filepath: str) -> bytes` Same as [`dump()`]( "lief.runtime.Module.dump") but also write the content into the file given in parameter #### [` end `]() property end → int End address of the module #### [` imagebase `]() property imagebase → int Imagebase of the module #### [` name `]() property name → str Name of the module (e.g. `libc.so.6, kernel32.dll, libsystem_c.dylib`) #### [` path `]() property path → str Path of the module #### [` size `]() property size → int Virtual size of the current module ### [` lief.runtime.module_from_name `]() lief.runtime.module\_from\_name(*name: str*) → [lief.runtime.Module]( "lief.runtime.Module") | None Find the module with the given name ### [` lief.runtime.module_from_path `]() lief.runtime.module\_from\_path(*path: str*) → [lief.runtime.Module]( "lief.runtime.Module") | None Find the module with the given path ### [` lief.runtime.module_from_addr `]() lief.runtime.module\_from\_addr(*addr: int*) → [lief.runtime.Module]( "lief.runtime.Module") | None Find the module that encompasses the given virtual address (absolute) --- ## [Memory]() ### [` lief.runtime.Memory `]() class lief.runtime.Memory Bases: `object` This class exposes API to access and manage memory #### [` ANONYMOUS `]() ANONYMOUS = 2 #### [` ChunkChunkChunk `]() class Chunk(*self*, *addr: typing\_extensions.CapsuleType*, *size: int*, *permissions: int*) **class Chunk(*self*, *addr: typing\_extensions.CapsuleType*, *size: int*) **class Chunk(*self*, *addr: typing\_extensions.CapsuleType*)**** Bases: `object` Represents a contiguous chunk of memory allocated or inspected by the runtime. ##### [` addr `]() property addr → int Returns the start address of the memory chunk ##### [` addr_ptr `]() property addr\_ptr → typing\_extensions.CapsuleType Returns the start address of the memory chunk as an opaque pointer ##### [` cache_flush `]() cache\_flush(*self*) → [lief.\_lief.runtime.Memory.Chunk]( "lief._lief.runtime.Memory.Chunk") Flushes the instruction cache for this memory chunk. This should be used when modifying code in memory (e.g., hooking, JIT). ##### [` change_permissions `]() change\_permissions(*self*, *permission: int*) → [lief.\_lief.runtime.Memory.Chunk]( "lief._lief.runtime.Memory.Chunk") Changes the permissions of the memory chunk. ##### [` deallocate `]() deallocate(*self*) → [lief.\_lief.ok\_error\_t]( "lief._lief.ok_error_t") ##### [` is_valid `]() is\_valid(*self*) → bool ##### [` make_ro `]() make\_ro(*self*) → [lief.\_lief.runtime.Memory.Chunk]( "lief._lief.runtime.Memory.Chunk") Sets the permissions to Read Only. ##### [` make_rw `]() make\_rw(*self*) → [lief.\_lief.runtime.Memory.Chunk]( "lief._lief.runtime.Memory.Chunk") Sets the permissions to Read and Write. ##### [` make_rwx `]() make\_rwx(*self*) → [lief.\_lief.runtime.Memory.Chunk]( "lief._lief.runtime.Memory.Chunk") Sets the permissions to read/write/exec ##### [` make_rx `]() make\_rx(*self*) → [lief.\_lief.runtime.Memory.Chunk]( "lief._lief.runtime.Memory.Chunk") Sets the permissions to Read and Execute. ##### [` make_x `]() make\_x(*self*) → [lief.\_lief.runtime.Memory.Chunk]( "lief._lief.runtime.Memory.Chunk") Sets the permissions to Execute only. ##### [` page_end `]() property page\_end → int Returns the address of the end of the page containing this chunk. ##### [` page_start `]() property page\_start → int Returns the address of the start of the page containing this chunk. ##### [` permissions `]() property permissions → int Returns the current permissions of the memory chunk. ##### [` size `]() property size → int Returns the size of the memory chunk in bytes. #### [` EXEC `]() EXEC = 4 #### [` FIXED `]() FIXED = 8 #### [` JIT `]() JIT = 16 #### [` MMAP_FLAGS `]() class MMAP\_FLAGS(*\*values*) Bases: `IntFlag` Flags used when creating a memory map (mmap). ##### [` ANONYMOUS `]() ANONYMOUS = 2 ##### [` FIXED `]() FIXED = 8 ##### [` JIT `]() JIT = 16 ##### [` NONE `]() NONE = 0 ##### [` PRIVATE `]() PRIVATE = 1 ##### [` SHARED `]() SHARED = 4 #### [` NONE `]() NONE = 0 #### [` PERM `]() class PERM(*\*values*) Bases: `IntFlag` ##### [` EXEC `]() EXEC = 4 ##### [` NONE `]() NONE = 0 ##### [` READ `]() READ = 1 ##### [` WRITE `]() WRITE = 2 #### [` PRIVATE `]() PRIVATE = 1 #### [` READ `]() READ = 1 #### [` SHARED `]() SHARED = 4 #### [` WRITE `]() WRITE = 2 #### [` mmap `]() mmap(*size: int*, *flags: int*, *permissions: int*) → [lief.runtime.Memory.Chunk]( "lief.runtime.Memory.Chunk") | None = <nanobind.nb\_func object> #### [` mmap_hint `]() mmap\_hint(*hint: int*, *size: int*, *flags: int*, *permissions: int*) → [lief.runtime.Memory.Chunk]( "lief.runtime.Memory.Chunk") | None = <nanobind.nb\_func object> #### [` mprotect `]() mprotect(*chunk: [lief.runtime.Memory.Chunk]( "lief.runtime.Memory.Chunk")*, *flags: int*) → [lief.ok\_error\_t]( "lief.ok_error_t") = <nanobind.nb\_func object> #### [` munmap `]() munmap(*chunk: [lief.runtime.Memory.Chunk]( "lief.runtime.Memory.Chunk")*) → [lief.ok\_error\_t]( "lief.ok_error_t") = <nanobind.nb\_func object> #### [` perm_str `]() perm\_str(*flags: int*) → str = <nanobind.nb\_func object> #### [` read `]() read(*addr: int*, *out: typing\_extensions.CapsuleType*, *size: int*) → None | bytes = <nanobind.nb\_func object> #### [` read_i16 `]() read\_i16(*addr: int*) → int = <nanobind.nb\_func object> #### [` read_i32 `]() read\_i32(*addr: int*) → int = <nanobind.nb\_func object> #### [` read_i64 `]() read\_i64(*addr: int*) → int = <nanobind.nb\_func object> #### [` read_i8 `]() read\_i8(*addr: int*) → int = <nanobind.nb\_func object> #### [` read_u16 `]() read\_u16(*addr: int*) → int = <nanobind.nb\_func object> #### [` read_u32 `]() read\_u32(*addr: int*) → int = <nanobind.nb\_func object> #### [` read_u64 `]() read\_u64(*addr: int*) → int = <nanobind.nb\_func object> #### [` read_u8 `]() read\_u8(*addr: int*) → int = <nanobind.nb\_func object> #### [` write `]() write(*buffer: bytes*, *addr: int*) → [lief.ok\_error\_t]( "lief.ok_error_t") = <nanobind.nb\_func object> #### [` write_i16 `]() write\_i16(*value: int*, *addr: int*) → [lief.ok\_error\_t]( "lief.ok_error_t") = <nanobind.nb\_func object> #### [` write_i32 `]() write\_i32(*value: int*, *addr: int*) → [lief.ok\_error\_t]( "lief.ok_error_t") = <nanobind.nb\_func object> #### [` write_i64 `]() write\_i64(*value: int*, *addr: int*) → [lief.ok\_error\_t]( "lief.ok_error_t") = <nanobind.nb\_func object> #### [` write_i8 `]() write\_i8(*value: int*, *addr: int*) → [lief.ok\_error\_t]( "lief.ok_error_t") = <nanobind.nb\_func object> #### [` write_u16 `]() write\_u16(*value: int*, *addr: int*) → [lief.ok\_error\_t]( "lief.ok_error_t") = <nanobind.nb\_func object> #### [` write_u32 `]() write\_u32(*value: int*, *addr: int*) → [lief.ok\_error\_t]( "lief.ok_error_t") = <nanobind.nb\_func object> #### [` write_u64 `]() write\_u64(*value: int*, *addr: int*) → [lief.ok\_error\_t]( "lief.ok_error_t") = <nanobind.nb\_func object> #### [` write_u8 `]() write\_u8(*value: int*, *addr: int*) → [lief.ok\_error\_t]( "lief.ok_error_t") = <nanobind.nb\_func object> --- ## [MemoryLayout]() ### [` lief.runtime.MemoryLayout `]() class lief.runtime.MemoryLayout Bases: `object` This class exposes the memory layout of the current process. #### [` Region `]() class Region Bases: `object` A contiguous range of memory mapped in the current process. ##### [` addr `]() property addr → int Address at which the region starts ##### [` contains `]() contains(*self*, *addr: int*) → bool Whether the given address is within this region ##### [` end_addr `]() property end\_addr → int Address at which the region ends ##### [` name `]() property name → str Name associated with the region: the name or the path of the module mapped at this address (e.g. `libc.so.6`) or the identifier of a region that is not backed by a file (e.g. `[stack]`, `[heap]`). It can be empty for anonymous regions. ##### [` size `]() property size → int Size of the region ### [` lief.runtime.memory_layout `]() lief.runtime.memory\_layout() → Iterator[[lief.runtime.MemoryLayout.Region]( "lief.runtime.MemoryLayout.Region") | None] Return an iterator over the memory layout of the current process --- ## [Linux]() ### [Module]() #### [` lief.runtime.linux.Module `]() class lief.runtime.linux.Module Bases: [`Module`]( "lief._lief.runtime.Module") This class exposes a Linux-specific API for a module ##### [` dlsym `]() dlsym(*self*, *name: str*) → typing\_extensions.CapsuleType Resolve the symbol with the given name for the current module ##### [` from_handle `]() from\_handle(*handle: typing\_extensions.CapsuleType*) → [lief.runtime.linux.Module]( "lief.runtime.linux.Module") | None = <nanobind.nb\_func object> ##### [` handle `]() property handle → typing\_extensions.CapsuleType Return the `dlopen` handle for this library as an opaque pointer. Return `None` if the function fails or if the handler can’t be found ##### [` parse_from_memoryparse_from_memory `]() parse\_from\_memory(*self*) → [lief.\_lief.ELF.Binary]( "lief._lief.ELF.Binary") | None **parse\_from\_memory(*self*, *config: [lief.\_lief.ELF.ParserConfig]( "lief._lief.ELF.ParserConfig")*) → [lief.\_lief.ELF.Binary]( "lief._lief.ELF.Binary") | None** Overloaded function. 1. `parse_from_memory(self) -> Optional[lief._lief.ELF.Binary]` Parse the ELF module from memory 2. `parse_from_memory(self, config: lief._lief.ELF.ParserConfig) -> Optional[lief._lief.ELF.Binary]` Parse the ELF module from memory with the given configuration ##### [` parse_from_pathparse_from_path `]() parse\_from\_path(*self*) → [lief.\_lief.ELF.Binary]( "lief._lief.ELF.Binary") | None **parse\_from\_path(*self*, *config: [lief.\_lief.ELF.ParserConfig]( "lief._lief.ELF.ParserConfig")*) → [lief.\_lief.ELF.Binary]( "lief._lief.ELF.Binary") | None** Overloaded function. 1. `parse_from_path(self) -> Optional[lief._lief.ELF.Binary]` Parse the ELF module from its path on the filesystem 2. `parse_from_path(self, config: lief._lief.ELF.ParserConfig) -> Optional[lief._lief.ELF.Binary]` Parse the ELF module from its path on the filesystem and given the parser configuration #### [` lief.runtime.linux.dlopen `]() lief.runtime.linux.dlopen(*name: str | os.PathLike*) → [lief.runtime.linux.Module]( "lief.runtime.linux.Module") | None Load the library with the given path or name. ### [Host]() #### [` lief.runtime.linux.Host `]() class lief.runtime.linux.Host Bases: `object` This class exposes Linux-specific host information. ##### [` hardware `]() hardware = '' ##### [` sys_name `]() sys\_name = '' ##### [` sys_release `]() sys\_release = '' ##### [` sys_version `]() sys\_version = '' ### [Process]() #### [` lief.runtime.linux.Process `]() class lief.runtime.linux.Process Bases: [`Process`]( "lief._lief.runtime.Process") This class exposes Linux-specific API for the current process. ##### [` cmdline `]() cmdline = '' ##### [` glibc_version `]() glibc\_version = '' --- ## [Android]() ### [Module]() #### [` lief.runtime.android.Module `]() class lief.runtime.android.Module Bases: [`Module`]( "lief._lief.runtime.Module") This class exposes an Android-specific API for a module ##### [` dlsym `]() dlsym(*self*, *name: str*) → typing\_extensions.CapsuleType Resolve the symbol with the given name for the current module ##### [` from_handle `]() from\_handle(*handle: typing\_extensions.CapsuleType*) → [lief.runtime.android.Module]( "lief.runtime.android.Module") | None = <nanobind.nb\_func object> ##### [` handle `]() property handle → typing\_extensions.CapsuleType Return the dlopen handle for this library. Return a nullptr if the function fails or if the handler can’t be found ##### [` parse_from_memoryparse_from_memory `]() parse\_from\_memory(*self*) → [lief.\_lief.ELF.Binary]( "lief._lief.ELF.Binary") | None **parse\_from\_memory(*self*, *config: [lief.\_lief.ELF.ParserConfig]( "lief._lief.ELF.ParserConfig")*) → [lief.\_lief.ELF.Binary]( "lief._lief.ELF.Binary") | None** Overloaded function. 1. `parse_from_memory(self) -> Optional[lief._lief.ELF.Binary]` Parse the ELF module from memory 2. `parse_from_memory(self, config: lief._lief.ELF.ParserConfig) -> Optional[lief._lief.ELF.Binary]` Parse the ELF module from memory with the given configuration ##### [` parse_from_pathparse_from_path `]() parse\_from\_path(*self*) → [lief.\_lief.ELF.Binary]( "lief._lief.ELF.Binary") | None **parse\_from\_path(*self*, *config: [lief.\_lief.ELF.ParserConfig]( "lief._lief.ELF.ParserConfig")*) → [lief.\_lief.ELF.Binary]( "lief._lief.ELF.Binary") | None** Overloaded function. 1. `parse_from_path(self) -> Optional[lief._lief.ELF.Binary]` Parse the ELF module from its path on the filesystem 2. `parse_from_path(self, config: lief._lief.ELF.ParserConfig) -> Optional[lief._lief.ELF.Binary]` Parse the ELF module from its path on the filesystem and given the parser configuration #### [` lief.runtime.android.dlopen `]() lief.runtime.android.dlopen(*name: str | os.PathLike*) → [lief.runtime.android.Module]( "lief.runtime.android.Module") | None Load the library with the given path/name ### [Host]() #### [` lief.runtime.android.Host `]() class lief.runtime.android.Host Bases: `object` This class exposes Android-specific host information. ##### [` sdk_version `]() sdk\_version = None ### [Process]() #### [` lief.runtime.android.Process `]() class lief.runtime.android.Process Bases: [`Process`]( "lief._lief.runtime.Process") This class exposes Android-specific API for the current process. ##### [` cmdline `]() cmdline = '' ##### [` get_system_property `]() get\_system\_property(*name: str*) → [lief.runtime.android.Property]( "lief.runtime.android.Property") | None = <nanobind.nb\_func object> ##### [` properties `]() properties = [] ### [Property]() #### [` lief.runtime.android.Property `]() class lief.runtime.android.Property Bases: `object` This class represents an Android system property such as `ro.boot.hardware`. ##### [` name `]() property name → str Name of the property (e.g. `ro.boot.hardware`) ##### [` serial `]() property serial → int Serial number of the property. ##### [` value `]() property value → str Value associated with the property --- ## [macOS]() ### [Module]() #### [` lief.runtime.osx.Module `]() class lief.runtime.osx.Module Bases: [`Module`]( "lief._lief.runtime.Module") This class exposes an OSX-specific API for a module ##### [` dlsym `]() dlsym(*self*, *name: str*) → typing\_extensions.CapsuleType Resolve the symbol with the given name for the current module ##### [` from_handle `]() from\_handle(*handle: typing\_extensions.CapsuleType*) → [lief.runtime.osx.Module]( "lief.runtime.osx.Module") | None = <nanobind.nb\_func object> ##### [` handle `]() property handle → typing\_extensions.CapsuleType Return the `dlopen` handle for this library as an opaque pointer. Return `None` if the function fails or if the handler can’t be found ##### [` parse_from_memoryparse_from_memory `]() parse\_from\_memory(*self*) → [lief.\_lief.MachO.Binary]( "lief._lief.MachO.Binary") | None **parse\_from\_memory(*self*, *config: [lief.\_lief.MachO.ParserConfig]( "lief._lief.MachO.ParserConfig")*) → [lief.\_lief.MachO.Binary]( "lief._lief.MachO.Binary") | None** Overloaded function. 1. `parse_from_memory(self) -> Optional[lief._lief.MachO.Binary]` Parse the Mach-O module from memory 2. `parse_from_memory(self, config: lief._lief.MachO.ParserConfig) -> Optional[lief._lief.MachO.Binary]` Parse the Mach-O module from memory with the given configuration ##### [` parse_from_pathparse_from_path `]() parse\_from\_path(*self*) → [lief.\_lief.MachO.Binary]( "lief._lief.MachO.Binary") | None **parse\_from\_path(*self*, *config: [lief.\_lief.MachO.ParserConfig]( "lief._lief.MachO.ParserConfig")*) → [lief.\_lief.MachO.Binary]( "lief._lief.MachO.Binary") | None** Overloaded function. 1. `parse_from_path(self) -> Optional[lief._lief.MachO.Binary]` Parse the Mach-O module from its path on the filesystem 2. `parse_from_path(self, config: lief._lief.MachO.ParserConfig) -> Optional[lief._lief.MachO.Binary]` Parse the Mach-O module from its path on the filesystem and given the parser configuration ### [Host]() #### [` lief.runtime.osx.Host `]() class lief.runtime.osx.Host Bases: `object` This class exposes OSX-specific host information. ##### [` is_sip_enabled `]() is\_sip\_enabled = True ##### [` os_version `]() os\_version = <lief.\_lief.runtime.osx.Host.version\_t object> ##### [` os_version_name `]() os\_version\_name = '' ##### [` version_t `]() class version\_t(*self*, *major: int*, *minor: int*, *patch: int*) Bases: `object` This class represents a macOS version number (major.minor.patch). ###### [` big_sur `]() big\_sur → [lief.runtime.osx.Host.version\_t]( "lief.runtime.osx.Host.version_t") = <nanobind.nb\_func object> ###### [` major `]() property major → int Major version number ###### [` minor `]() property minor → int Minor version number ###### [` monterey `]() monterey → [lief.runtime.osx.Host.version\_t]( "lief.runtime.osx.Host.version_t") = <nanobind.nb\_func object> ###### [` patch `]() property patch → int Patch version number ###### [` sequoia `]() sequoia → [lief.runtime.osx.Host.version\_t]( "lief.runtime.osx.Host.version_t") = <nanobind.nb\_func object> ###### [` sonoma `]() sonoma → [lief.runtime.osx.Host.version\_t]( "lief.runtime.osx.Host.version_t") = <nanobind.nb\_func object> ###### [` tahoe `]() tahoe → [lief.runtime.osx.Host.version\_t]( "lief.runtime.osx.Host.version_t") = <nanobind.nb\_func object> ###### [` ventura `]() ventura → [lief.runtime.osx.Host.version\_t]( "lief.runtime.osx.Host.version_t") = <nanobind.nb\_func object> ### [Process]() #### [` lief.runtime.osx.Process `]() class lief.runtime.osx.Process Bases: [`Process`]( "lief._lief.runtime.Process") This class exposes OSX-specific API for the current process. ##### [` dyld_version `]() dyld\_version = '' --- ## [Windows]() ### [Module]() #### [` lief.runtime.windows.Module `]() class lief.runtime.windows.Module Bases: [`Module`]( "lief._lief.runtime.Module") This class exposes a Windows-specific API for a module ##### [` dlsym `]() dlsym(*self*, *name: str*) → typing\_extensions.CapsuleType Resolve the symbol with the given name for the current module ##### [` from_handle `]() from\_handle(*handle: typing\_extensions.CapsuleType*) → [lief.runtime.windows.Module]( "lief.runtime.windows.Module") | None = <nanobind.nb\_func object> ##### [` handle `]() property handle → typing\_extensions.CapsuleType Return the `HMODULE` handle as an opaque pointer. Return `None` if the function fails or if the handler can’t be found ##### [` parse_from_memoryparse_from_memory `]() parse\_from\_memory(*self*) → [lief.\_lief.PE.Binary]( "lief._lief.PE.Binary") | None **parse\_from\_memory(*self*, *config: [lief.\_lief.PE.ParserConfig]( "lief._lief.PE.ParserConfig")*) → [lief.\_lief.PE.Binary]( "lief._lief.PE.Binary") | None** Overloaded function. 1. `parse_from_memory(self) -> Optional[lief._lief.PE.Binary]` Parse the PE module from memory 2. `parse_from_memory(self, config: lief._lief.PE.ParserConfig) -> Optional[lief._lief.PE.Binary]` Parse the PE module from memory with the given configuration ##### [` parse_from_pathparse_from_path `]() parse\_from\_path(*self*) → [lief.\_lief.PE.Binary]( "lief._lief.PE.Binary") | None **parse\_from\_path(*self*, *config: [lief.\_lief.PE.ParserConfig]( "lief._lief.PE.ParserConfig")*) → [lief.\_lief.PE.Binary]( "lief._lief.PE.Binary") | None** Overloaded function. 1. `parse_from_path(self) -> Optional[lief._lief.PE.Binary]` Parse the PE module from its path on the filesystem 2. `parse_from_path(self, config: lief._lief.PE.ParserConfig) -> Optional[lief._lief.PE.Binary]` Parse the PE module from its path on the filesystem and given the parser configuration #### [` lief.runtime.windows.dlopen `]() lief.runtime.windows.dlopen(*name: str | os.PathLike*) → [lief.runtime.windows.Module]( "lief.runtime.windows.Module") | None Load the windows library with the given path or name. #### [` lief.runtime.windows.find_module `]() lief.runtime.windows.find\_module(*name: str*) → [lief.runtime.windows.Module]( "lief.runtime.windows.Module") | None Try to get the [`Module`]( "lief.runtime.windows.Module") with the given name. Return `None` if the module is not found. ```python if ntdll := lief.runtime.windows.find_module("ntdll.dll"): print(ntdll.path) ``` > **Note** > > This function relies on the Windows API `GetModuleHandle` which is more efficient than the generic implementation [`lief.runtime.module_from_name()`]( "lief.runtime.module_from_name"). ### [Host]() #### [` lief.runtime.windows.Host `]() class lief.runtime.windows.Host Bases: `object` This class exposes Windows-specific host information. ##### [` version `]() version = <lief.\_lief.runtime.windows.Host.version\_t object> ##### [` version_tversion_t `]() class version\_t(*self*) **class version\_t(*self*, *major: int*, *minor: int*, *build\_number: int*)** Bases: `object` This class represents a Windows version number. ###### [` build_number `]() property build\_number → int Build number ###### [` major `]() property major → int Major version number ###### [` minor `]() property minor → int Minor version number ### [Injector]() #### [` lief.runtime.windows.injection_context_t `]() class lief.runtime.windows.injection\_context\_t(*self*) Bases: `object` Describes how to spawn a new process and inject a library into it. ##### [` args `]() property args → str Command-line arguments passed to the spawned process. ##### [` env `]() property env → dict[str, str] Environment variables to set in the spawned process. If left empty, the current process environment is inherited. ##### [` library `]() property library → str Absolute path to the library (DLL) that should be injected. ##### [` target_path `]() property target\_path → str Absolute path to the target executable to spawn. #### [` lief.runtime.windows.inject_spawn `]() lief.runtime.windows.inject\_spawn(*ctx: [lief.runtime.windows.injection\_context\_t]( "lief.runtime.windows.injection_context_t")*) → [lief.ok\_t]( "lief.ok_t") | [lief.lief\_errors]( "lief.lief_errors") Spawn the target described by the given injection context and inject the associated library before the main thread starts executing. ### [Process]() #### [` lief.runtime.windows.Process `]() class lief.runtime.windows.Process Bases: [`Process`]( "lief._lief.runtime.Process") This class exposes Windows-specific API for the current process. ##### [` peb `]() peb = None ### [PEB]() #### [` lief.runtime.windows.PEB `]() class lief.runtime.windows.PEB Bases: `object` This class exposes a user-friendly interface over the Process Environment Block (PEB) of the current process. It can be accessed through [`lief.runtime.windows.Process.peb`]( "lief.runtime.windows.Process.peb"). ##### [` atl_thunk_slist_ptr `]() property atl\_thunk\_slist\_ptr → int Address of the per-process ATL thunk SList (single-linked list). ##### [` atl_thunk_slist_ptr32 `]() property atl\_thunk\_slist\_ptr32 → int 32-bit value of the ATL thunk SList pointer. ##### [` being_debugged `]() property being\_debugged → bool Whether the current process is being debugged. ##### [` entries `]() property entries → Iterator[[lief.runtime.windows.LdrDataTableEntry]( "lief.runtime.windows.LdrDataTableEntry") | None] Iterate over the modules referenced by the loader data of the PEB, in load order, yielding [`LdrDataTableEntry`]( "lief.runtime.windows.LdrDataTableEntry") objects. ##### [` ldr `]() property ldr → int Address of the loader data structure (`PEB_LDR_DATA`) which holds the list of the modules loaded in the current process. ##### [` post_process_init_routine `]() property post\_process\_init\_routine → int Address of the routine called once the process completed its initialization (`PostProcessInitRoutine`). ##### [` process_parameters `]() property process\_parameters → int Address of the process parameters (`RTL_USER_PROCESS_PARAMETERS`) which holds information such as the command line or the current directory. ##### [` session_id `]() property session\_id → int Session ID associated with the current process. ### [LdrDataTableEntry]() #### [` lief.runtime.windows.LdrDataTableEntry `]() class lief.runtime.windows.LdrDataTableEntry Bases: `object` This class exposes a user-friendly interface over a `LDR_DATA_TABLE_ENTRY`, the structure used by the Windows loader to describe a module loaded in the current process. These entries can be enumerated through [`lief.runtime.windows.PEB.entries()`]( "lief.runtime.windows.PEB.entries"). ##### [` active_patch_image_base `]() property active\_patch\_image\_base → int | None Base address of the active hot-patch image, if any. > **Note** > > Available on Windows 11 and later. ##### [` base_dll_name `]() property base\_dll\_name → str Base name of the module (`BaseDllName`), e.g. `ntdll.dll`. ##### [` base_name_hash_value `]() property base\_name\_hash\_value → int | None Hash of the module’s base name used to index the loader tables > **Note** > > Available on Windows 8 and later. ##### [` check_sum `]() property check\_sum → int | None Image checksum cached by the loader > **Note** > > Available on Windows 10 and later. ##### [` ddag_node `]() property ddag\_node → int | None Address of the dependency-graph node of the module (`DdagNode`). > **Note** > > Available on Windows 8 and later. ##### [` dependent_load_flags `]() property dependent\_load\_flags → int | None Flags controlling how the statically-linked dependencies of the module are loaded. > **Note** > > Available on Windows 8 and later. ##### [` dll_base `]() property dll\_base → int Base address at which the module is mapped in memory (`DllBase`). ##### [` entry_point `]() property entry\_point → int Address of the entry point of the module (`EntryPoint`). ##### [` entry_point_activation_context `]() property entry\_point\_activation\_context → int Address of the activation context associated with the module’s entry point. ##### [` flags `]() property flags → int Loader flags describing the state of the module (`Flags`). ##### [` full_dll_name `]() property full\_dll\_name → str Full path of the module (`FullDllName`), e.g. `C:\Windows\System32\ntdll.dll`. ##### [` hot_patch_state `]() property hot\_patch\_state → int | None State of the hot-patch engine for this module, as a `LDR_HOT_PATCH_STATE` value. > **Note** > > Available on Windows 11 and later. ##### [` implicit_path_options `]() property implicit\_path\_options → int | None Path-search options implied when the module was resolved > **Note** > > Available on Windows 8 and later. ##### [` load_context `]() property load\_context → int | None Address of the loader context used while the module is being snapped > **Note** > > Available on Windows 8 and later. ##### [` load_reason `]() property load\_reason → int | None Reason why the module was loaded, as a `LDR_DLL_LOAD_REASON` value > **Note** > > Available on Windows 8 and later. ##### [` load_time `]() property load\_time → int | None Time at which the module was loaded. > **Note** > > Available on Windows 8 and later. ##### [` lock `]() property lock → int Address of the per-entry loader lock. ##### [` obsolete_load_count `]() property obsolete\_load\_count → int Legacy load count of the module (`ObsoleteLoadCount`). Superseded by [`reference_count`]( "lief.runtime.windows.LdrDataTableEntry.reference_count") on Windows 8 and later. ##### [` original_base `]() property original\_base → int | None Preferred base address recorded in the PE headers > **Note** > > Available on Windows 8 and later. ##### [` parent_dll_base `]() property parent\_dll\_base → int | None Base address of the module that triggered the load of this one. > **Note** > > Available on Windows 8 and later. ##### [` reference_count `]() property reference\_count → int | None Number of references currently held on the module. > **Note** > > Available on Windows 8 and later. ##### [` signing_level `]() property signing\_level → int | None Signing level of the module’s image, as a `SE_SIGNING_LEVEL` value > **Note** > > Available on Windows 10 and later. ##### [` size_of_image `]() property size\_of\_image → int Size (in bytes) of the module’s image in memory (`SizeOfImage`). ##### [` switch_back_context `]() property switch\_back\_context → int | None Address of the CHPE switch-back context. > **Note** > > Available on Windows 8 and later. ##### [` time_date_stamp `]() property time\_date\_stamp → int `TimeDateStamp` of the module as cached by the loader. ##### [` tls_index `]() property tls\_index → int TLS slot index assigned to the module, or `0` when it has no TLS (`TlsIndex`). --- ## [ARCH]() ### [` lief.runtime.ARCH `]() class lief.runtime.ARCH(*\*values*) Bases: `Enum` #### [` ARM64 `]() ARM64 = 2 #### [` NONE `]() NONE = 0 #### [` RISCV64 `]() RISCV64 = 3 #### [` X86_64 `]() X86\_64 = 1 ## [PLATFORMS]() ### [` lief.runtime.PLATFORMS `]() class lief.runtime.PLATFORMS(*\*values*) Bases: `Enum` #### [` ANDROID `]() ANDROID = 3 #### [` IOS `]() IOS = 5 #### [` LINUX `]() LINUX = 1 #### [` NONE `]() NONE = 0 #### [` OSX `]() OSX = 4 #### [` WINDOWS `]() WINDOWS = 2 --- documentID: "dcebb284791c9d25dd3502359d9e5bfb13760d591cccf6ada156a0c579286d1d" docname: "runtime/rust" title: "Runtime Rust API - LIEF Documentation" description: "Runtime Rust API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/runtime/rust.html" markdownURL: "https://lief.re/doc/latest/runtime/rust.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "ea4d43d5fad5dc55e6a108e798b4edcb5ef387eab630598d9ddbca5fe85d8071" --- # [Rust]() > **Note** > > Please check: [`lief::runtime`]() --- documentID: "0a88d4c55f99c080210e0aa33a2c913e577dd4598335e39156d6a09286708555" docname: "tools/lief-patchelf/index" title: "lief-patchelf - LIEF Documentation" description: "lief-patchelf is an implementation of the original patchelf created by NixOS (NixOS/patchelf), based on LIEF." canonical: "https://lief.re/doc/latest/tools/lief-patchelf/index.html" markdownURL: "https://lief.re/doc/latest/tools/lief-patchelf/index.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "b53f6c019f3f8fd0dff85a1db929a4fa7435595e6ad409d58f623737a733443a" --- # [lief-patchelf]() `lief-patchelf` is an implementation of the original patchelf created by NixOS ([NixOS/patchelf]()), based on LIEF. This LIEF-based version is written in Rust, offering a more robust, modern, and maintainable implementation compared to the original project. > **CLI** > > It is worth mentioning that `lief-patchelf` maintains the same command-line interface as the original NixOS implementation, allowing for a seamless transition between the two versions. ## [Compilation]() You can build `lief-patchelf` using `cargo` from the `src/tools/lief-patchelf` directory with the following commands: ```bash $ cargo build [--release] $ ./target/{release,debug}/lief-patchelf --version ``` Since LIEF is a cross-platform library that supports various platforms and architectures, you can compile (or cross-compile) this tool for other platforms. For example, you can generate a Windows ARM64 executable as follows: ```powershell rustup.exe target add $RUST_TARGET (optional) $env:RUSTFLAGS="-Ctarget-feature=+crt-static" cargo build --target=aarch64-pc-windows-msvc ./target/{release,debug}/lief-patchelf.exe --version ``` For more information about the supported platforms, please refer to the [Rust Bindings]() section. ## [Man Page]() Given the `lief-patchelf` binary, you can generate a man page using the following command: ```bash $ lief-patchelf --generate-manpage ./lief-patchelf.1 ``` This functionality is provided by the [clap\_mangen]() crate. ## [Shell Completion]() Thanks to [clap]() and its `clap_complete` extension, which generates auto-completion for various shells, you can generate completion stubs for `lief-patchelf` with: ```bash $ ./lief-patchelf --generate {bash, elvish, fish, powershell, zsh} ``` --- documentID: "08a137e7afa75ba28d26f104d7eaa53231f09351b4996f6c3f55719ddf0220d4" docname: "tutorials/01_play_with_formats" title: "01 - Parse and manipulate formats - LIEF Documentation" description: "01 - Parse and manipulate formats. The objective of this tutorial is to provide an overview of LIEF’s API for parsing and manipulating formats." canonical: "https://lief.re/doc/latest/tutorials/01_play_with_formats.html" markdownURL: "https://lief.re/doc/latest/tutorials/01_play_with_formats.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "2330f4f08d5092518796b2e2a61662dfc8667d204873faf0d065ee66e4a723cf" --- # [01 - Parse and manipulate formats]() The objective of this tutorial is to provide an overview of LIEF’s API for parsing and manipulating formats. --- ## [ELF]() We’ll start with the `ELF` format. To create an [`ELF.Binary`]( "lief.ELF.Binary") from a file, simply pass its path to the `lief.abstract.parse` ( [`lief.parse()`]() ; [`LIEF::Parser::parse()`]() ) or `lief.ELF.parse()` ( [`lief::elf::Binary::parse`]() ; [`lief.ELF.parse()`]() ; [`LIEF::ELF::Parser::parse()`]() ) functions. > **Note** > > With the Python API, these functions exhibit the same behavior, but in C++, `lief.abstract.parse` ( [`lief.parse()`]() ; [`LIEF::Parser::parse()`]() ) will return a pointer to a `lief.abstract.Binary` ( [`lief::generic::Binary`]() ; [`lief.Binary`]() ; [`LIEF::Binary`]() ) object, whereas `lief.ELF.parse()` ( [`lief::elf::Binary::parse`]() ; [`lief.ELF.parse()`]() ; [`LIEF::ELF::Parser::parse()`]() ) will return a `lief.ELF.Binary` ( [`lief::elf::Binary`]() ; [`lief.ELF.Binary`]() ; [`LIEF::ELF::Binary`]() ) object. ```python import lief binary = lief.parse("/bin/ls") ``` Once the ELF file has been parsed, we can access its [`Header`]( "lief.ELF.Header"): ```python binary: lief.ELF.Binary header = binary.header ``` To change the entry point and the target architecture ([`ARCH`]( "lief.ELF.ARCH")): ```python header: lief.ELF.Header header.entrypoint = 0x123 header.machine_type = lief.ELF.ARCH.AARCH64 ``` Then, write these changes to a new ELF binary: ```python binary: lief.ELF.Binary binary.write("ls.modified") ``` We can also iterate over the [`Section`]( "lief.ELF.Section") entries as follows: ```python binary: lief.ELF.Binary for section in binary.sections: print(section.name) # section name print(section.size) # section size print(len(section.content)) # Should match the previous print ``` To modify the content of the `.text` section: ```python binary: lief.ELF.Binary text = binary.get_section(".text") assert text is not None text.content = bytes([0x33] * text.size) ``` ## [PE]() As with the `ELF` section, you can use the `lief.abstract.parse` ( [`lief.parse()`]() ; [`LIEF::Parser::parse()`]() ) or `lief.PE.parse()` ( [`lief::pe::Binary::parse`]() ; [`lief.PE.parse()`]() ; [`LIEF::PE::Parser::parse()`]() ) functions to create a [`PE.Binary`]( "lief.PE.Binary") ```python import lief binary = lief.parse("C:\\Windows\\explorer.exe") ``` To access the various PE headers ([`DosHeader`]( "lief.PE.DosHeader"), [`Header`]( "lief.PE.Header"), and [`OptionalHeader`]( "lief.PE.OptionalHeader")): ```python binary: lief.PE.Binary print(binary.dos_header) print(binary.header) print(binary.optional_header) ``` You can also access imported functions in two ways: 1. Using the *abstract* layer 2. Using the PE definition ```python # Using the abstract layer binary: lief.PE.Binary for func in binary.imported_functions: print(func) # Using the PE definition for func in binary.imports: print(func) ``` For finer granularity regarding the location of imported functions in libraries, or to access other fields of the PE imports, we can process the imports as follows: ```python binary: lief.PE.Binary for imported_library in binary.imports: print("Library name: " + imported_library.name) for func in imported_library.entries: if not func.is_ordinal: print(func.name) print(func.iat_address) ``` --- documentID: "187b83be6545a1c1d470544442537f6e2d318348b6f7c9fed50ab6982e940da0" docname: "tutorials/02_pe_from_scratch" title: "02 - Create a PE from scratch (Deprecated) - LIEF Documentation" description: "02 - Create a PE from scratch (Deprecated). In this tutorial, we introduce the LIEF API for creating a simple PE executable from scratch." canonical: "https://lief.re/doc/latest/tutorials/02_pe_from_scratch.html" markdownURL: "https://lief.re/doc/latest/tutorials/02_pe_from_scratch.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "624399baaec0ba136041a8e88f5ad845f523eccbafa18de7f477da1f12272bc4" --- # [02 - Create a PE from scratch (Deprecated)]() > **Warning** > > This tutorial is no longer functional or accurate for LIEF version >= `0.17.0`. In this tutorial, we introduce the LIEF API for creating a simple PE executable from scratch. --- LIEF enables the creation of a simple PE from scratch. The aim of this tutorial is to create an executable that shows a “Hello World” `MessageBoxA`. First, we must create a [`Binary`]( "lief.PE.Binary"): ```python from lief import PE binary32 = PE.Binary("pe_from_scratch", PE.PE_TYPE.PE32) ``` The first parameter is the binary name, and the second is the binary type: `PE32` or `PE32_PLUS` (see [`PE_TYPE`]( "lief.PE.PE_TYPE")). The [`Binary`]( "lief.PE.Binary") constructor automatically creates [`DosHeader`]( "lief.PE.DosHeader"), [`Header`]( "lief.PE.Header"), [`OptionalHeader`]( "lief.PE.OptionalHeader"), and an empty [`DataDirectory`]( "lief.PE.DataDirectory"). Now that we have a minimal binary, we must add sections. We will have a first section holding assembly code (`.text`) and a second one containing strings (`.data`): ```python section_text = PE.Section(".text") section_text.content = code section_text.virtual_address = 0x1000 section_data = PE.Section(".data") section_data.content = data section_data.virtual_address = 0x2000 ``` A `MessageBoxA` is composed of a title and a message. These two strings can be stored in the `.data` section as follows: ```python title = "LIEF is awesome\0" message = "Hello World\0" data = list(map(ord, title)) data += list(map(ord, message)) ``` The **pseudo** assembly code of the `.text` section is provided in the following listing: ```nasm push 0x00 ; uType push "LIEF is awesome" ; Title push "Hello World" ; Message push 0 ; hWnd call MessageBoxA ; push 0 ; uExitCode call ExitProcess ; ``` Instead of pushing strings, we must push the **virtual addresses** of these strings. In the PE format, a section’s virtual address is actually a **relative** virtual address (relative to [`OptionalHeader.imagebase`]( "lief.PE.OptionalHeader.imagebase") when ASLR is not enabled). By default, the [`Binary`]( "lief.PE.Binary") constructor sets the [`imagebase`]( "lief.PE.OptionalHeader.imagebase") to `0x400000`. As a result, the virtual addresses of the strings are: > - **title**: [`imagebase`]( "lief.PE.OptionalHeader.imagebase") + `virtual_address` + 0 = `0x402000` > - **message**: [`imagebase`]( "lief.PE.OptionalHeader.imagebase") + `virtual_address` + `len(title)` = `0x402010` ```nasm push 0x00 ; uType push 0x402000 ; Title push 0x402010 ; Message push 0 ; hWnd call MessageBoxA ; push 0 ; uExitCode call ExitProcess ; ``` As the code uses `MessageBoxA`, we need to import `user32.dll` into the binary’s [`Import`]( "lief.PE.Import") entries and add the `MessageBoxA` [`ImportEntry`]( "lief.PE.ImportEntry"). To do so, we can use the `add_library()` method combined with [`add_entry()`]( "lief.PE.Import.add_entry"): ```python user32 = binary32.add_library("user32.dll") user32.add_entry("MessageBoxA") ``` The same applies to `ExitProcess` (`kernel32.dll`): ```python kernel32 = binary32.add_library("kernel32.dll") kernel32.add_entry("ExitProcess") ``` Once the necessary libraries and functions have been added to the binary, we must determine their addresses (**I**mport **A**ddress **T**able). To do so, we can use the `lief.PE.Binary.predict_function_rva` method, which returns the `IAT` address set by the [`Builder`]( "lief.PE.Builder"): ```python ExitProcess_addr = binary32.predict_function_rva("kernel32.dll", "ExitProcess") MessageBoxA_addr = binary32.predict_function_rva("user32.dll", "MessageBoxA") print("Address of 'ExitProcess': 0x{:06x} ".format(ExitProcess_addr)) print("Address of 'MessageBoxA': 0x{:06x} ".format(MessageBoxA_addr)) ``` ```console Address of 'ExitProcess': 0x00306a Address of 'MessageBoxA': 0x00305c ``` Thus, the **absolute** virtual addresses of `MessageBoxA` and `ExitProcess` are: > - `MessageBoxA`: [`imagebase`]( "lief.PE.OptionalHeader.imagebase") + `0x306a` = `0x40306a` > - `ExitProcess`: [`imagebase`]( "lief.PE.OptionalHeader.imagebase") + `0x305c` = `0x40305c` And the associated assembly code: ```nasm push 0x00 ; uType push 0x402000 ; Title push 0x402010 ; Message push 0 ; hWnd call 0x40306a ; push 0 ; uExitCode call 0x40305c ; ``` The transformation of the [`Binary`]( "lief.PE.Binary") into an executable is performed by the [`Builder`]( "lief.PE.Builder") class. By default, the import table is not rebuilt, so we must configure the builder to rebuild it: ```python builder = lief.PE.Builder(binary32) builder.build_imports(True) builder.build() builder.write("pe_from_scratch.exe") ``` You can now use the newly created binary. --- documentID: "bdb463e2daa2fb6c31c7a5976102187ebc0cc8400692f276ae5bf1ae37d6832a" docname: "tutorials/03_elf_change_symbols" title: "03 - Play with ELF symbols - LIEF Documentation" description: "03 - Play with ELF symbols. In this tutorial, we will see how to modify dynamic symbols in both an executable and a library." canonical: "https://lief.re/doc/latest/tutorials/03_elf_change_symbols.html" markdownURL: "https://lief.re/doc/latest/tutorials/03_elf_change_symbols.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "3f7952719da0d58bc9b7d4b5a1b2e56257faf4a3f83b04fd33dbd31e2a3f37d5" --- # [03 - Play with ELF symbols]() In this tutorial, we will see how to modify dynamic symbols in both an executable and a library. --- When a library is dynamically linked to an executable, the required libraries are referenced in the `DT_NEEDED` entries within the dynamic table (`PT_DYNAMIC`). Additionally, functions imported from this library are referenced in the dynamic symbols table with the following attributes: - [`value`]( "lief.ELF.Symbol.value") set to `0` - [`type`]( "lief.ELF.Symbol.type") set to [`FUNC`]( "lief.ELF.Symbol.TYPE.FUNC") Similarly, when a library exports functions, they are registered in the dynamic symbols table with the following attributes: - [`value`]( "lief.ELF.Symbol.value") set to the address of the function in the library - [`type`]( "lief.ELF.Symbol.type") set to [`FUNC`]( "lief.ELF.Symbol.TYPE.FUNC") Imported and exported functions are abstracted in LIEF, and you can iterate over these elements using the following properties: [`exported_functions`]( "lief.Binary.exported_functions") and [`imported_functions`]( "lief.Binary.imported_functions") ```python binary: lief.Binary library: lief.Binary print(binary.imported_functions) print(library.exported_functions) ``` When analyzing a binary, imported functions can reveal information about its underlying functionality. To avoid revealing these symbols, one solution could be to statically link the library with the executable. Another solution is to confuse the reverse engineer by swapping these symbols, which is the purpose of this tutorial. Consider the following code: ```C #include #include #include double hashme(double input) { return pow(input, 4) + log(input + 3); } int main(int argc, char** argv) { if (argc != 2) { printf("Usage: %s N\n", argv[0]); return EXIT_FAILURE; } double N = (double)atoi(argv[1]); double hash = hashme(N); printf("%f\n", hash); return EXIT_SUCCESS; } ``` Basically, this program takes an integer as a parameter and performs a computation on this value. ```console $ hashme 123 228886645.836282 ``` [![../_images/hashme.png](https://lief.re/doc/latest/_images/hashme.png)]() The `pow` and `log` functions are located in the `libm.so.6` library. Using LIEF, we can swap these function **names** with other function **names**. For example, let’s swap `pow` and `log` with `cos` and `sin`: First, we must load both the library and the executable: ```python import lief hashme = lief.parse("hashme") libm = lief.parse("/usr/lib/libm.so.6") # Note: the path to libm.so.6 might be different on your system. ``` Then, we can change the names of the two imported functions in the **executable**: ```python hashme: lief.ELF.Binary hashme_pow_sym = next(i for i in hashme.imported_symbols if i.name == "pow") hashme_log_sym = next(i for i in hashme.imported_symbols if i.name == "log") hashme_pow_sym.name = "cos" hashme_log_sym.name = "sin" ``` And we must do the same in the library: the `log` symbol name is swapped with `sin`, and `pow` with `cos`: ```python def swap(obj, a, b): symbol_a = next(i for i in obj.dynamic_symbols if i.name == a) symbol_b = next(i for i in obj.dynamic_symbols if i.name == b) b_name = symbol_b.name symbol_b.name = symbol_a.name symbol_a.name = b_name hashme: lief.ELF.Binary libm: lief.ELF.Binary hashme_pow_sym = next(i for i in hashme.imported_symbols if i.name == "pow") hashme_log_sym = next(i for i in hashme.imported_symbols if i.name == "log") hashme_pow_sym.name = "cos" hashme_log_sym.name = "sin" swap(libm, "log", "sin") swap(libm, "pow", "cos") hashme.write("hashme.obf") libm.write("libm.so.6") ``` [![../_images/hashme_obf.png](https://lief.re/doc/latest/_images/hashme_obf.png)]() At this point, we have a modified version of `libm.so` in the same directory as `hashme.obf`. To force the loading of this modified version of `libm.so`, we can set the `LD_LIBRARY_PATH` environment variable: ```console $ LD_LIBRARY_PATH=. hashme.obf 123 228886645.836282 ``` Without this environment variable, the Linux loader would resolve `libm.so` using the original path, and the computation would be performed using `sin` and `cos`: ```console $ hashme.obf 123 -0.557978 ``` Another more realistic use case could involve swapping symbols in cryptographic libraries like OpenSSL. For example, `EVP_DecryptInit` and `EVP_EncryptInit` have the same prototype and could be swapped. --- documentID: "2ae40ca2da2738c29f0d4267ec9b59b051672abfd8b2216fa6d934761496068c" docname: "tutorials/04_elf_hooking" title: "04 - ELF Hooking - LIEF Documentation" description: "04 - ELF Hooking. The objective of this tutorial is to hook a library function." canonical: "https://lief.re/doc/latest/tutorials/04_elf_hooking.html" markdownURL: "https://lief.re/doc/latest/tutorials/04_elf_hooking.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "cbb83f8adce49e1d43af860a0ac1b216fea6b02252aeed048ece4e657690dd24" --- # [04 - ELF Hooking]() The objective of this tutorial is to hook a library function. --- In the previous tutorial, we saw how to swap symbol names in a shared library. We will now see the mechanism for hooking a function in a shared library. The targeted library is the standard math library (`libm.so`), and we will insert a hook on the `exp` function so that \(\exp(x) = x + 1\). The source code of the sample that uses this function is provided in the following listing: ```cpp #include #include #include int main(int argc, char **argv) { if (argc != 2) { printf("Usage: %s \n", argv[0]); exit(-1); } int a = atoi(argv[1]); printf("exp(%d) = %f\n", a, exp(a)); return 0; } ``` The hook function is as follows: ```cpp double hook(double x) { return x + 1; } ``` Compiled with `gcc -Os -nostdlib -nodefaultlibs -fPIC -Wl,-shared hook.c -o hook`. To inject this hook into the library, we use the [`add()`]( "lief.ELF.Binary.add") (segment) method: **Binary.add(*self*, *arg: [lief.\_lief.ELF.DynamicEntry]( "lief._lief.ELF.DynamicEntry")*, */*) → [lief.\_lief.ELF.DynamicEntry]( "lief._lief.ELF.DynamicEntry") **Binary.add(*self*, *section: [lief.\_lief.ELF.Section]( "lief._lief.ELF.Section")*, *loaded: bool = True*, *pos: [lief.\_lief.ELF.Binary.SEC\_INSERT\_POS]( "lief._lief.ELF.Binary.SEC_INSERT_POS") = SEC\_INSERT\_POS.AUTO*) → [lief.\_lief.ELF.Section]( "lief._lief.ELF.Section") | None **Binary.add(*self*, *segment: [lief.\_lief.ELF.Segment]( "lief._lief.ELF.Segment")*, *base: int = 0*) → [lief.\_lief.ELF.Segment]( "lief._lief.ELF.Segment") | None **Binary.add(*self*, *note: [lief.\_lief.ELF.Note]( "lief._lief.ELF.Note")*) → [lief.\_lief.ELF.Note]( "lief._lief.ELF.Note")******** Overloaded function. 1. `add(self, arg: lief._lief.ELF.DynamicEntry, /) -> lief._lief.ELF.DynamicEntry` dynamic\_entry 2. `add(self, section: lief._lief.ELF.Section, loaded: bool = True, pos: lief._lief.ELF.Binary.SEC_INSERT_POS = SEC_INSERT_POS.AUTO) -> lief._lief.ELF.Section | None` > Add the given [`Section`]( "lief.ELF.Section") to the binary. > > If the section does not aim at being loaded in memory, the `loaded` parameter has to be set to `False` (default: `True`) 3. `add(self, segment: lief._lief.ELF.Segment, base: int = 0) -> lief._lief.ELF.Segment | None` Add a new [`Segment`]( "lief.ELF.Segment") in the binary 4. `add(self, note: lief._lief.ELF.Note) -> lief._lief.ELF.Note` Add a new [`Note`]( "lief.ELF.Note") in the binary First, we find the code for our hook function and add it to the library: ```python libm: lief.ELF.Binary hook: lief.ELF.Binary exp_symbol = libm.get_symbol("exp") hook_symbol = hook.get_symbol("hook") assert hook_symbol is not None code_segment = hook.segment_from_virtual_address(hook_symbol.value) assert code_segment is not None segment_added = libm.add(code_segment) ``` Once the stub is injected, we must calculate the new address for the `exp` symbol and update it: ```python new_address = ( segment_added.virtual_address + hook_symbol.value - code_segment.virtual_address ) exp_symbol.value = new_address exp_symbol.type = lief.ELF.Symbol.TYPE.FUNC # it might have been GNU_IFUNC ``` Note that we must update the symbol type to a regular FUNC because, on many distributions, libm.so is built with automatic hardware detection and exposes symbols as [GNU\_IFUNC](), which uses a different dynamic binding protocol compared to regular functions. Finally, we write the patched library to a file in the current directory: ```python libm.write("libm.so.6") ``` To test the patched library: ```console $ ./do_math.bin 1 exp(1) = 2.718282 $ LD_LIBRARY_PATH=. ./do_math.bin 1 exp(1) = 2.000000 ``` --- documentID: "de604cc070551f92e9c54a9b226bb9617b773b0ea0a47073ee6e15e9dbd1c812" docname: "tutorials/05_elf_infect_plt_got" title: "05 - Infecting the PLT/GOT - LIEF Documentation" description: "05 - Infecting the PLT/GOT. The objective of this tutorial is to hook an imported function in an ELF binary." canonical: "https://lief.re/doc/latest/tutorials/05_elf_infect_plt_got.html" markdownURL: "https://lief.re/doc/latest/tutorials/05_elf_infect_plt_got.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "3b7456c0e04033747d9fc47adec504489b9de583b3b2c27de5d252fbdbaefed9" --- # [05 - Infecting the PLT/GOT]() The objective of this tutorial is to hook an imported function in an ELF binary. --- Hooking imported functions by infecting the `.got` section is a well-known technique [[1]]() [[2]](), and this tutorial focuses on its implementation using LIEF. These figures illustrate the PLT/GOT mechanism:![../_images/pltgot.png](https://lief.re/doc/latest/_images/pltgot.png) With lazy binding, the first time the function is called, the `got` entry redirects to the PLT instruction. ![../_images/pltgot3.png](https://lief.re/doc/latest/_images/pltgot3.png) The second time, the `got` entry holds the address in the shared library. Basically, the infection is done in two steps: > - First, we inject our hook. > - Second, we redirect the targeted function to our hook by patching the `got`. This can be summarized by the following figure:![../_images/pltgot2.png](https://lief.re/doc/latest/_images/pltgot2.png) As an example, we will use a basic *crackme* that performs a *memcmp(3)* on the flag and user input. ```cpp #include #include #include // Damn_YoU_Got_The_Flag char password[] = "\x18\x3d\x31\x32\x03\x05\x33\x09\x03\x1b\x33\x28\x03\x08\x34\x39\x03\x1a\x30\x3d\x3b"; inline int check(char* input); int check(char* input) { for (int i = 0; i < sizeof(password) - 1; ++i) { password[i] ^= 0x5c; } return memcmp(password, input, sizeof(password) - 1); } int main(int argc, char **argv) { if (argc != 2) { printf("Usage: %s \n", argv[0]); return EXIT_FAILURE; } if (strlen(argv[1]) == (sizeof(password) - 1) && check(argv[1]) == 0) { puts("You got it !!"); return EXIT_SUCCESS; } puts("Wrong"); return EXIT_FAILURE; } ``` The flag is XORed with `0x5C`. To validate the *crackme*, the user must enter `Damn_YoU_Got_The_Flag`: ```console $ crackme.bin foo Wrong $ crackme.bin Damn_YoU_Got_The_Flag You got it !! ``` The hook will consist of printing the arguments of `memcmp` and returning `0`: ```cpp #include "arch/x86_64/syscall.c" #define stdout 1 int my_memcmp(const void* lhs, const void* rhs, int n) { const char msg[] = "Hook memcmp\n"; _write(stdout, msg, sizeof(msg)); _write(stdout, (const char*)lhs, n); _write(stdout, "\n", 2); _write(stdout, (const char*)rhs, n); _write(stdout, "\n", 2); return 0; } ``` Since the hook will be injected into the crackme, it must meet the following requirements: - Assembly code must be *position-independent* (compiled with `-fPIC` or `-pie/-fPIE` flags). - It must not use external libraries such as `libc.so` (`-nostdlib -nodefaultlibs` flags). Due to these requirements, the hook is compiled with: `gcc -nostdlib -nodefaultlibs -fPIC -Wl,-shared hook.c -o hook`. ## [Injecting the hook]() The first step is to inject the hook into the binary. To do so, we will add a [`Segment`]( "lief.ELF.Segment"): ```python import lief crackme = lief.parse("crackme.bin") assert isinstance(crackme, lief.ELF.Binary) hook = lief.parse("hook") assert isinstance(hook, lief.ELF.Binary) segment_added = crackme.add(hook.segments[0]) ``` All assembly code for the hook is contained in the first [`LOAD`]( "lief.ELF.Segment.TYPE.LOAD") segment of `hook`. Once the hook is added, its virtual address will be the [`virtual_address`]( "lief.ELF.Segment.virtual_address") of `segment_added`, and we can proceed with the `got` patching. ## [Patching the got]() LIEF provides a function to easily patch the `got` entry associated with a [`Symbol`]( "lief.ELF.Symbol"): **Binary.patch\_pltgot(*self*, *symbol\_name: str*, *address: int*) → None **Binary.patch\_pltgot(*self*, *symbol: [lief.\_lief.ELF.Symbol]( "lief._lief.ELF.Symbol")*, *address: int*) → None**** Overloaded function. 1. `patch_pltgot(self, symbol_name: str, address: int) -> None` Patch the imported symbol’s name with the `address` 2. `patch_pltgot(self, symbol: lief._lief.ELF.Symbol, address: int) -> None` Patch the imported [`Symbol`]( "lief.ELF.Symbol") with the `address` The offset of the `memcmp` function is stored in the [`value`]( "lief.ELF.Symbol.value") attribute of the associated dynamic symbol. Thus, its virtual address will be: - `my_memcmp`: [`value`]( "lief.ELF.Symbol.value") + `segment_added.virtual_address` ```python hook: lief.ELF.Binary segment_added: lief.ELF.Segment my_memcmp = hook.get_symbol("my_memcmp") assert my_memcmp is not None my_memcmp_addr = segment_added.virtual_address + my_memcmp.value ``` Finally, we can patch `memcmp` from the crackme with this value: ```python crackme.patch_pltgot("memcmp", my_memcmp_addr) ``` And rebuild it: ```python crackme.write("crackme.hooked") ``` ## [Run]() Since a check on the input size is performed before checking the flag value, we must provide an input with the correct length (regardless of its content): ```console $ crackme.hooked XXXXXXXXXXXXXXXXXXXXX Hook memcmp Damn_YoU_Got_The_Flag XXXXXXXXXXXXXXXXXXXXX You got it !! ``` References[[1]()] hxxp://vxheaven.org/lib/vrn00.html [[2]()] [http://phrack.org/issues/56/7.html]() --- documentID: "b4a6b91e04613ef19bf10bbd51ed0c91820c881bc21c65e215e734deb729716c" docname: "tutorials/06_pe_hooking" title: "06 - PE Hooking (Deprecated) - LIEF Documentation" description: "06 - PE Hooking (Deprecated). The objective of this tutorial is to show how to hook imported functions." canonical: "https://lief.re/doc/latest/tutorials/06_pe_hooking.html" markdownURL: "https://lief.re/doc/latest/tutorials/06_pe_hooking.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "e01415c0cd8cb98491ce78241faacff1b789e6544716d919acca30f50b85f384" --- # [06 - PE Hooking (Deprecated)]() > **Warning** > > This tutorial is no longer functional as the PE hooking functions have been removed from LIEF. The objective of this tutorial is to show how to hook imported functions. --- The targeted binary is a simple `PE64` *HelloWorld* that prints the first argument to the console: ```cpp #include "stdafx.h" #include int main(int argc, char** argv) { printf("Hello: %s\n", argv[1]); return 0; } ``` ```console $ PE64_x86-64_binary_HelloWorld.exe World $ Hello: World ``` Using LIEF, we will replace the function that prints the message to the console with a `MessageBox`. By disassembling the binary, we can see that the *print* occurs in the function `sub_140001030`, which uses two external functions: `__acrt_iob_func` and `__stdio_common_vfprintf`.[![../_images/06_hooking_1.png](https://lief.re/doc/latest/_images/06_hooking_1.png)]() [![../_images/06_hooking_2.png](https://lief.re/doc/latest/_images/06_hooking_2.png)]() According to the Microsoft x64 calling convention, the format string is located in the `rcx` register, and the input message is in the `rdx` register. Basically, the [hooking code]() replaces the `__acrt_iob_func` function and displays a `MessageBox` with the `rdx` message. hooking code ```nasm add rsp, 0x48 ; Stack unwind xor rcx, rcx ; hWnd mov rdx, rdx ; Message mov r8, 0x0140009000 ; Title xor r9, r9 ; MB_OK mov rax, 0x014000A3E4 ; MessageBoxA address call [rax] ; MessageBoxA(hWnd, Message, Title, MB_OK) xor rcx, rcx ; exit value mov rax, 0x014000A3d4 ; ExitProcess address call [rax] ; ExitProcess(0) ret ; Never reached ``` > **Note** > > As in tutorial [02 - Create a PE from scratch (Deprecated)](), the addresses of `MessageBoxA` and `ExitProcess` can be found using the function: First, we create the `.htext` section, which will hold the hooking code: ```python section_text = lief.PE.Section(".htext") section_text.content = code section_text.virtual_address = 0x7000 section_text.characteristics = lief.PE.Section.CHARACTERISTICS.CNT_CODE | lief.PE.Section.CHARACTERISTICS.MEM_READ | lief.PE.Section.CHARACTERISTICS.MEM_EXECUTE section_text = pe.add_section(section_text) ``` Next, we create the `.hdata` section for the `MessageBox` title: ```python title = "LIEF is awesome\0" data = list(map(ord, title)) section_data = lief.PE.Section(".hdata") section_data.content = data section_data.virtual_address = 0x8000 section_data.characteristics = lief.PE.Section.CHARACTERISTICS.CNT_INITIALIZED_DATA | lief.PE.Section.CHARACTERISTICS.MEM_READ section_data = pe.add_section(section_data) ``` Since ASLR is enabled, we will disable it to avoid dealing with relocations: ```python binary: lief.PE.Binary binary.optional_header.dll_characteristics &= ( ~lief.PE.OptionalHeader.DLL_CHARACTERISTICS.DYNAMIC_BASE ) ``` We will also disable `NX` protection: ```python binary: lief.PE.Binary binary.optional_header.dll_characteristics &= ( ~lief.PE.OptionalHeader.DLL_CHARACTERISTICS.NX_COMPAT ) ``` As `ExitProcess` is not imported in `KERNEL32.dll`, we need to add it: ```python binary: lief.PE.Binary kernel32 = binary.get_import("KERNEL32.dll") kernel32.add_entry("ExitProcess") ``` The `MessageBoxA` function is located in `user32.dll`, so we must add it: ```python user32 = binary.add_library("user32.dll") user32.add_entry("MessageBoxA") ``` Then, we proceed to hook the `__acrt_iob_func` function: ```python pe.hook_function("__acrt_iob_func", binary.optional_header.imagebase + section_text.virtual_address) ``` Finally, we configure the [`Builder`]( "lief.PE.Builder") to create a new import table and patch the original one with trampolines. ```python builder = lief.PE.Builder(binary) builder.build_imports(True).patch_imports(True) builder.build() builder.write("lief_pe_hooking.exe") ``` Now we can run the final executable: ```console $ lief_pe_hooking.exe "Hooking World" ``` [![../_images/06_hooking_3.png](https://lief.re/doc/latest/_images/06_hooking_3.png)]() --- documentID: "346c33f33a6fcbdbd66a3b2745bfba1fc1cc961bd017bef0ea065abed3d43414" docname: "tutorials/07_pe_resource" title: "07 - PE Resources - LIEF Documentation" description: "07 - PE Resources. This tutorial provides an overview of the resource structure in a PE file and explains how to manipulate it using LIEF." canonical: "https://lief.re/doc/latest/tutorials/07_pe_resource.html" markdownURL: "https://lief.re/doc/latest/tutorials/07_pe_resource.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "c32e93c32dbf8ada81287e6b220e0588e75ee140883fcce96781d27f216d99a2" --- # [07 - PE Resources]() This tutorial provides an overview of the resource structure in a PE file and explains how to manipulate it using LIEF. --- Unlike the **ELF** and **Mach-O** formats, **PE** enables embedding *resources* (icons, images, dialogs, etc.) within an executable or a DLL. These resources are usually located in the `.rsrc` section, but this is not an absolute rule. To retrieve the section where resources are located, you can use the [`section`]( "lief.PE.DataDirectory.section") attribute of the associated [`DataDirectory`]( "lief.PE.DataDirectory"): ```python binary: lief.PE.Binary if binary.has_resources: rsrc_directory = binary.data_directory( lief.PE.DataDirectory.TYPES.RESOURCE_TABLE ) assert rsrc_directory is not None if rsrc_directory.has_section: print(rsrc_directory.section) ``` ```console .rsrc 22e0d8 23f000 22e200 236c00 0 4.3596 CNT_INITIALIZED_DATA - MEM_READ ``` ## [Resource Structure]() The underlying structure used to represent resources is a tree:![../_images/07_resource_tree.png](https://lief.re/doc/latest/_images/07_resource_tree.png) In the resource tree, there are basically two kinds of nodes: 1. [`ResourceDirectory`]( "lief.PE.ResourceDirectory"): Contains information about the subtree. 2. [`ResourceData`]( "lief.PE.ResourceData"): Used to store raw data. These nodes are the **leaves** of the tree. The first three levels of the tree have a special meaning: - Level 1: The `id` represents the [`TYPE`]( "lief.PE.ResourcesManager.TYPE"). - Level 2: The `id` represents an ID for accessing the resource. - Level 3: The `id` represents the [`RESOURCE_LANGS`]( "lief.PE.RESOURCE_LANGS") / SUBLANG of the resource. You can check if a given binary embeds resources using the [`has_resources`]( "lief.PE.Binary.has_resources") property. You can then access this structure through the [`resources`]( "lief.PE.Binary.resources") property, which returns a [`ResourceDirectory`]( "lief.PE.ResourceDirectory") representing the **root** of the tree. Given a [`ResourceDirectory`]( "lief.PE.ResourceDirectory"), the `childs` property returns an **iterator** (similar to a `list`) over the subtree associated with the node. The following snippet retrieves the [`MANIFEST`]( "lief.PE.ResourcesManager.TYPE.MANIFEST") element and prints it: ```python filezilla: lief.PE.Binary root = filezilla.resources assert root is not None # First level => Type (ResourceDirectory node) manifest_node = next( i for i in root.childs if i.id == lief.PE.ResourcesManager.TYPE.MANIFEST ) print(manifest_node) # Second level => ID (ResourceDirectory node) id_node = manifest_node.childs[0] print(id_node) # Third level => Lang (ResourceData node) lang_node = id_node.childs[0] print(lang_node) manifest = bytes(lang_node.content).decode("utf8") print(manifest) ``` ```console [DIRECTORY] - ID: 0x18 - Depth: 1 - Childs : 1 Characteristics : 0 Time/Date stamp : 0 Major version : 0 Minor version : 0 Number of name entries : 0 Number of id entries : 1 [DIRECTORY] - ID: 0x01 - Depth: 2 - Childs : 1 Characteristics : 0 Time/Date stamp : 0 Major version : 0 Minor version : 0 Number of name entries : 0 Number of id entries : 1 [DATA] - ID: 0x409 - Depth: 3 - Childs : 0 Code page : 0 Reserved : 0 Size : 1666 Hash : ffffffffb00b5419 "lief.PE.ResourcesManager"), which provides an enhanced API for manipulating binary resources. ## [Resource Manager]() As mentioned previously, the [`ResourcesManager`]( "lief.PE.ResourcesManager") acts as a wrapper around the resource tree to: - Parse resources with predefined structures, such as [`MANIFEST`]( "lief.PE.ResourcesManager.TYPE.MANIFEST"), [`ICON`]( "lief.PE.ResourcesManager.TYPE.ICON"), [`VERSION`]( "lief.PE.ResourcesManager.TYPE.VERSION"), etc. - Access and modify these structures. This can be summarized with the following diagram:![../_images/07_pe_resource_manager.png](https://lief.re/doc/latest/_images/07_pe_resource_manager.png) The [`ResourcesManager`]( "lief.PE.ResourcesManager") can be accessed via the [`resources_manager`]( "lief.PE.Binary.resources_manager") property. To get an overview of the binary’s resources, you can simply *print* the [`ResourcesManager`]( "lief.PE.ResourcesManager") instance: ```python filezilla: lief.PE.Binar resource_manager = filezilla.resources_manager print(resource_manager) ``` ```default [Directory] ID: 01 - CURSOR [Directory] ID: 01 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 02 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 03 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 04 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 05 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 06 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 07 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 08 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 09 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 10 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 02 - BITMAP [Directory] CSQUERY [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] WXBITMAP_STD_COLOURS [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 03 - ICON [Directory] ID: 01 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 02 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 03 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 04 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 05 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 06 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 07 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 08 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 09 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 10 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 11 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 12 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 13 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 14 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 15 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 16 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 17 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 18 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 19 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 20 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 21 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 22 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 23 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 04 - MENU [Directory] WXWINDOWMENU [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 12 - GROUP_CURSOR [Directory] WXCURSOR_BLANK [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] WXCURSOR_BULLSEYE [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] WXCURSOR_CROSS [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] WXCURSOR_HAND [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] WXCURSOR_MAGNIFIER [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] WXCURSOR_PBRUSH [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] WXCURSOR_PENCIL [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] WXCURSOR_PLEFT [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] WXCURSOR_PRIGHT [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] WXCURSOR_ROLLER [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 14 - GROUP_ICON [Directory] APPICON [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] WXICON_AAA [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] WXICON_SMALL_CDROM [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] WXICON_SMALL_CLOSED_FOLDER [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] WXICON_SMALL_COMPUTER [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] WXICON_SMALL_DRIVE [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] WXICON_SMALL_FILE [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] WXICON_SMALL_FLOPPY [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] WXICON_SMALL_OPEN_FOLDER [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] WXICON_SMALL_REMOVEABLE [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 16 - VERSION [Directory] ID: 01 [Data] ID: 1033 - ENGLISH/DEFAULT [Directory] ID: 24 - MANIFEST [Directory] ID: 01 [Data] ID: 1033 - ENGLISH/DEFAULT Types: CURSOR - BITMAP - ICON - MENU - GROUP_CURSOR - GROUP_ICON - VERSION - MANIFEST Langs: ENGLISH Sub-langs: DEFAULT Manifest ======== FileZilla FTP client true Version ======= type: 0 key: VS_VERSION_INFO Fixed file info =============== Signature: feef04bd Struct version: 10000 File version: 3 - 25 - 2 - 0 Product version: 3 - 25 - 2 - 0 File OS: WINDOWS32 File type: APP String file info ================ type: 1 key: StringFileInfo type: 1 key: 000004b0: (NEUTRAL - NEUTRAL - UTF_16) Items: 'Comments': 'Version 3.25.2' 'CompanyName': 'FileZilla Project' 'FileDescription': 'FileZilla FTP Client' 'FileVersion': '3, 25, 2, 0' 'InternalName': 'FileZilla 3' 'LegalCopyright': 'Copyright (C) 2006-2016' 'OriginalFilename': 'filezilla.exe' 'ProductName': 'FileZilla' 'ProductVersion': '3, 25, 2, 0' Var file info ============= type: 1 key: VarFileInfo Translations: UTF_16/NEUTRAL/NEUTRAL Icon #0 : Size: 16x16 pixels Color count: 0 Reserved: 0 Planes: 1 Bit count: 8 Hash: ffffffffca4fbb2f Icon #1 : Size: 32x32 pixels Color count: 0 Reserved: 0 Planes: 1 Bit count: 8 Hash: 79eaa8a1 Icon #2 : Size: 48x48 pixels Color count: 0 Reserved: 0 Planes: 1 Bit count: 8 Hash: 1b38942 Icon #3 : Size: 48x48 pixels Color count: 0 Reserved: 0 Planes: 1 Bit count: 20 Hash: 281bc584 Icon #4 : Size: 0x0 pixels Color count: 0 Reserved: 0 Planes: 1 Bit count: 20 Hash: 13a82f1 FileZilla FTP client true ``` Similar to the previous example, accessing the [`MANIFEST`]( "lief.PE.ResourcesManager.TYPE.MANIFEST") element is as simple as: ```python resources_manager = filezilla.resources_manager manifest = resources_manager.manifest print(manifest) ``` ## [Playing with the Manifest]() Now we will see how to use the [`ResourcesManager`]( "lief.PE.ResourcesManager") to grant *Administrator* privileges to an executable using the [`MANIFEST`]( "lief.PE.ResourcesManager.TYPE.MANIFEST") element. The application manifest is implemented as an XML document; its documentation is available here: [MSDN]() Among these tags, the `requestedExecutionLevel` tag *“describes the minimum security permissions required for the application to run on the client computer.”* [[1]]() ```xml ``` This tag has the following options: - **Level**: Indicates the security level the application is requesting. - `asInvoker`: Same permissions as the process that started it. - `highestAvailable`: The application will run with the highest permission level possible. - `requireAdministrator`: The application will run with administrator permissions. - **uiAccess** (Optional): Indicates whether the application requires access to protected user interface elements. - `true` - `false` Using [`ResourcesManager`]( "lief.PE.ResourcesManager"), replacing the `asInvoker` value with `requireAdministrator` is straightforward: ```python filezilla: lief.PE.Binary resources_manager = filezilla.resources_manager assert isinstance(resources_manager, lief.PE.ResourcesManager) manifest = resources_manager.manifest assert isinstance(manifest, str) manifest = manifest.replace("asInvoker", "requireAdministrator") resources_manager.manifest = manifest ``` The PE [`Builder`]( "lief.PE.Builder") can be configured to rebuild the resource tree. To apply the modifications, we must rebuild it: > **Warning** > > By default, the [`Builder`]( "lief.PE.Builder") does not rebuild the resource tree. ```python builder = lief.PE.Builder(filezilla) builder.build_resources(True) builder.build() builder.write("filezilla_rsrc.exe") ``` [![../_images/filezilla.png](https://lief.re/doc/latest/_images/filezilla.png)]() ## [Playing with Icons]() The [`change_icon()`]( "lief.PE.ResourcesManager.change_icon") method switches icons between two applications. As in the previous section, obtain the [`ResourcesManager`]( "lief.PE.ResourcesManager") as follows: ```python mfc = lief.parse("mfc.exe") cmd = lief.parse("cmd.exe") mfc_rsrc_manager = mfc.resources_manager cmd_rsrc_manager = cmd.resources_manager ``` Then, switch the first icons of the applications: ```python mfc_rsrc_manager: lief.PE.ResourcesManager cmd_rsrc_manager: lief.PE.ResourcesManager mfc_icons = mfc_rsrc_manager.icons cmd_icons = cmd_rsrc_manager.icons for i in range(min(len(mfc_icons), len(cmd_icons))): mfc_rsrc_manager.change_icon(mfc_icons[i], cmd_icons[i]) ``` The MFC icons before switching:[![../_images/mfc.png](https://lief.re/doc/latest/_images/mfc.png)]() After the switch:[![../_images/mfc_modified.png](https://lief.re/doc/latest/_images/mfc_modified.png)]() References[[1]()] [https://docs.microsoft.com/en-us/previous-versions/visualstudio/visual-studio-2015/deployment/trustinfo-element-clickonce-application]() --- documentID: "9158eb241f4babd596abdb71ba63019f298072f234cf17d76fdc1835efb07443" docname: "tutorials/08_elf_bin2lib" title: "08 - Transforming an ELF executable into a library - LIEF Documentation" description: "08 - Transforming an ELF executable into a library. In this tutorial, we will see how to convert a PIE executable into a library." canonical: "https://lief.re/doc/latest/tutorials/08_elf_bin2lib.html" markdownURL: "https://lief.re/doc/latest/tutorials/08_elf_bin2lib.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "a4238007cc90b8d943eb199c46fa1fe0a48a4e8a1abd261759c81a26b6817aa5" --- # [08 - Transforming an ELF executable into a library]() In this tutorial, we will see how to convert a **PIE** executable into a library. --- ## [Introduction]() Examining the header of an ELF PIE executable reveals that it has the same type as a shared object (i.e., a library): ```console $ readelf -h /usr/bin/ssh|grep Type Type: DYN (Shared object file) $ readelf -h /usr/lib/libm.so|grep Type Type: DYN (Shared object file) ``` Using LIEF, we can access this information through the [`file_type`]( "lief.ELF.Header.file_type") attribute: ```python >>> libm = lief.parse("/usr/lib/libm.so.6") >>> print(libm.header.file_type) FILE_TYPE.DYN >>> ssh = lief.parse("/usr/bin/ssh") >>> print(ssh.header.file_type) FILE_TYPE.DYN ``` The main difference between PIE binaries and shared libraries is how symbols are exported. A shared library is designed to expose functions so that executables can bind to it, whereas executables should not expose functions [[1]](). This is confirmed by the number of exported functions in the two different objects: ```python >>> print(len(libm.exported_functions)) 572 >>> print(len(ssh.exported_functions)) 10 ``` In this tutorial, we will see how to transform raw function addresses into exported functions associated with a symbol, thus exposing internal functions of the executable. ## [Exporting functions]() Such a transformation can be useful if we find a function at a given address and want to instrument it (using `dlopen`/`dlsym`, for example). Once the target function is exported, we can link it as we would for a *normal* library. For example, in a fuzzing scenario, if one identifies a parser function, we can export it and then feed its inputs using AFL. This allows us to bypass the normal entry point to reach the function directly. Let’s see how it works on a basic *crackme*: ```cpp #include #include #include #define NOINLINE __attribute__ ((noinline)) NOINLINE int check_found(char* input) { if (strcmp(input, "easy") == 0) { return 1; } return 0; } int main(int argc, char** argv) { if (argc != 2) { printf("Usage: %s flag\n", argv[0]); return -1; } if (check_found(argv[1])) { printf("Well done!\n"); } else { printf("Wrong!\n"); } return 0; } ``` This code takes a string as input and calls the `check_found` function on this string. It returns `1` if the input is `easy`, and `0` otherwise. The `__attribute__ ((noinline))` is used to ensure the `check_found` function is not inlined by the compiler. If the function is inlined, there will be no address associated with it. The following figure summarizes the execution flow:![../_images/bin2lib_a.png](https://lief.re/doc/latest/_images/bin2lib_a.png) The *crackme* can be compiled with: ```console $ gcc crackme101.c -O0 -fPIE -pie -Wl,-strip-all,--hash-style=sysv -o crackme101.bin -fvisibility=hidden $ ./crackme101.bin foo Wrong! $ ./crackme101.bin easy Well done! ``` Note the use of the `-fvisibility=hidden` flag. It prevents the compiler from automatically exporting functions, such as `check_found`. Opening `crackme101.bin` with LIEF confirms that no functions are exported: ```python >>> import lief >>> crackme101 = lief.parse("./crackme101.bin") >>> print(len(crackme101.exported_functions)) 0 ``` Using a disassembler, we can quickly identify the address of the check function:![../_images/crackme101_ida.png](https://lief.re/doc/latest/_images/crackme101_ida.png) In this case, the **check** function is located at address: `0x72A` [[2]](). Now that we have identified the address, we can export it as a named function: `check_found`. ```python crackme101: lief.ELF.Binary addr = crackme101.get_function_address("check_found") # 0x72A assert isinstance(addr, int) crackme101.add_exported_function(addr, "check_found") crackme101.write("libcrackme101.so") ``` And that’s all! `libcrackme101.so` is now a **library** that exports one function: `check_found`. ```python >>> import lief >>> libcrackme101 = lief.parse("./libcrackme101.so") >>> print(len(libcrackme101.exported_functions)) 1 >>> print(libcrackme101.exported_functions[0]) check_found ``` Notably, `libcrackme101.so` remains an executable: ```console $ ./libcrackme101.so foo Wrong! $ ./libcrackme101.so easy Well done! ``` Since we have exported a function, we can now use `dlopen` on `libcrackme101.so` and `dlsym` on `check_found`: ```cpp #include #include #include typedef int(*check_t)(char*); int main (int argc, char** argv) { void* handler = dlopen("./libcrackme101.so", RTLD_LAZY); if (!handler) { fprintf(stderr, "dlopen error: %s\n", dlerror()); return 1; } check_t check_found = (check_t)dlsym(handler, "check_found"); int output = check_found(argv[1]); printf("Output of check_found('%s'): %d\n", argv[1], output); return 0; } ``` Running the code above should yield a similar output: ```console $ gcc instrument.c -O0 -fPIE -pie -o instrument.bin -ldl $ ./instrument.bin test Output of check_found('test'): 0 $ ./instrument.bin easy Output of check_found('easy'): 1 ``` If `dlopen` returns an error, please read [the following section about glibc >= 2.29](). The transformation of the execution flow can be represented as follows:![../_images/bin2lib_b.png](https://lief.re/doc/latest/_images/bin2lib_b.png) ## [Warning for glibc >= 2.29 users]() If you are using `glibc >= 2.29` (or a similar version depending on your Linux distribution), you might have encountered this error while using the dlopen function: ```default dlopen error: cannot dynamically load position-independent executable ``` Loading PIE binaries as shared libraries was not really an intended use case for `dlopen`, and it used to work without being properly supported. One reason is that it [does not seem trivial to support]() all possible use cases (issues with certain relocations and ELF constructors). These glibc versions now [implement a check]() to deny `dlopen` calls with PIE binaries. This is done by verifying that the `DF_1_PIE` flag is not present in the dynamic information flags. To circumvent this check, LIEF can be used to remove the `DF_1_PIE` flag: ```python import lief path = sys.argv[1] bin_ = lief.parse(path) assert isinstance(bin_, lief.ELF.Binary) bin_[lief.ELF.DynamicEntry.TAG.FLAGS_1].remove(lief.ELF.DynamicEntryFlags.FLAG.PIE) bin_.write(path + ".patched") ``` ## [Conclusion]() Because PIE executables are designed to be mapped at a random base address, they generally behave like a library. We only need to export the relevant functions. For non-PIE executables, such a transformation would be very difficult because it requires first transforming the executable into a *relocatable* executable. This involves creating relocations, patching absolute jumps, etc. LIEF currently only supports this transformation for ELF, and we need to investigate the PE and Mach-O cases [[3]](). Notes[[1]()] Some functions can be exported by the linker, such as `_init`. [[2]()] The mapped virtual address will be `BASE + 0x72A`, where `BASE` is randomly chosen by ASLR. [[3]()] In macOS, all executables are compiled with the PIE flag. **API:** - [`lief.ELF.Binary.add_exported_function()`]( "lief.ELF.Binary.add_exported_function") - [`lief.ELF.Binary.export_symbol()`]( "lief.ELF.Binary.export_symbol") - [`lief.ELF.Symbol.visibility`]( "lief.ELF.Symbol.visibility") - `lief.ELF.Symbol.name` - [`lief.ELF.Symbol.value`]( "lief.ELF.Symbol.value") --- documentID: "0906a2fb68c71cd23b046497439b47e5f2de091f71fc4f1eafbed1fa6124824b" docname: "tutorials/09_frida_lief" title: "09 - How to use Frida on a non-rooted device - LIEF Documentation" description: "09 - How to use Frida on a non-rooted device. In this tutorial, we will see how to use the Frida gadget on a non-rooted device." canonical: "https://lief.re/doc/latest/tutorials/09_frida_lief.html" markdownURL: "https://lief.re/doc/latest/tutorials/09_frida_lief.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "dfb56067d8f65008a1ec78bc2e7e5bc5d880e38030fdcbc0cd5df76ce49588e4" --- # [09 - How to use Frida on a non-rooted device]() In this tutorial, we will see how to use the Frida gadget on a non-rooted device. --- In recent years, Frida has become the standard tool for performing hooking. It supports various platforms and enables writing hooks quickly and dynamically. Most of the time, there are no constraints on using Frida on a rooted device, but in some scenarios, the application being analyzed might check its environment. A technique based on modifying the Dalvik bytecode has been well-described by [@ikoz]() in the post “[Using Frida on Android without root]()”. In this tutorial, we propose a new technique that does not require modifying the Dalvik bytecode (i.e., `classes.dex`). ## [Frida Gadget]() In its default mode, Frida first needs to inject an *agent* into the targeted application so that it resides in the process’s memory space. On Android and Linux, this injection is typically performed with `ptrace` by attaching to or spawning a process and then injecting the agent. Once the agent is injected, it communicates with its server through a pipe. Some types of injection require privileges. For example, a *normal* user cannot use `ptrace`. To address this constraint, Frida provides another mode of operation called “embedded”. In this mode, the user is responsible for injecting the *frida-gadget* library. Such injection can be performed using: - Environment variables: `LD_PRELOAD`, `DYLD_INSERT_LIBRARIES`, etc. - Using `dlopen`. - In an open-source target, using the linker to link with the Frida gadget. - … For more information about the Frida gadget, refer to the documentation: [frida-gadget]() ## [Frida & LIEF]() One less-known but established injection technique is based on modifying the ELF format. This was well-explained by Mayhem in [Phrack]() [[1]](), and LIEF provides a user-friendly API [[2]]() to perform it. To summarize, executable formats include libraries that are linked with the executable. We can obtain a list of linked libraries using `ldd` or `readelf` (Unix) or with [elf\_reader.py]() (Linux, Windows, OSX): ```console $ python ./elf_reader.py -d /bin/ls == Dynamic entries == |Tag | Value | Info | |NEEDED | 0x1 | libcap.so.2 | |NEEDED | 0x80 | libc.so.6 | ``` Here, `/bin/ls` has two dependencies: - `libcap.so.2` - `libc.so.6` During the loading phase of the executable, the loader iterates over these libraries and maps them into the process’s memory space. Once mapped, it calls their constructors [[3]](). The idea is to add `frida-agent.so` as a dependency of native libraries embedded in the APK. Adding such a dependency is as simple as: ```python import lief libnative = lief.parse("libnative.so") assert isinstance(libnative, lief.ELF.Binary) libnative.add_library("libgadget.so") # Injection! libnative.write("libnative.so") ``` ## [Telegram]() To illustrate the process, we will inject the Frida gadget into the Telegram application. It is an interesting target because: - It contains only one native library, so the library will be loaded early. - It demonstrates LIEF’s reliability in modifying ELF files. - It is a real-world application. Regarding the environment, we will use Telegram version `4.8.4-12207` (February 18, 2018) on an Android 6.0.1 device with an AArch64 architecture (Samsung Galaxy S6). ### [Injection with LIEF]() As explained above, the injection is simply a call to [`lief.ELF.Binary.add_library()`]( "lief.ELF.Binary.add_library") on the `libtmessages.28.so` library. Prior to injection, `libtmessages.28.so` is linked against the following libraries: ```bash $ readelf -d ./libtmessages.28.so|grep NEEDED 0x0000000000000001 (NEEDED) Shared library: [libjnigraphics.so] 0x0000000000000001 (NEEDED) Shared library: [liblog.so] 0x0000000000000001 (NEEDED) Shared library: [libz.so] 0x0000000000000001 (NEEDED) Shared library: [libOpenSLES.so] 0x0000000000000001 (NEEDED) Shared library: [libEGL.so] 0x0000000000000001 (NEEDED) Shared library: [libGLESv2.so] 0x0000000000000001 (NEEDED) Shared library: [libdl.so] 0x0000000000000001 (NEEDED) Shared library: [libstdc++.so] 0x0000000000000001 (NEEDED) Shared library: [libm.so] 0x0000000000000001 (NEEDED) Shared library: [libc.so] ``` After `telegram.add_library("libgadget.so")`, the new dependency is at the first position: ```bash $ readelf -d ./libtmessages.28.so|grep NEEDED 0x0000000000000001 (NEEDED) Shared library: [libgadget.so] 0x0000000000000001 (NEEDED) Shared library: [libjnigraphics.so] 0x0000000000000001 (NEEDED) Shared library: [liblog.so] 0x0000000000000001 (NEEDED) Shared library: [libz.so] 0x0000000000000001 (NEEDED) Shared library: [libOpenSLES.so] 0x0000000000000001 (NEEDED) Shared library: [libEGL.so] 0x0000000000000001 (NEEDED) Shared library: [libGLESv2.so] 0x0000000000000001 (NEEDED) Shared library: [libdl.so] 0x0000000000000001 (NEEDED) Shared library: [libstdc++.so] 0x0000000000000001 (NEEDED) Shared library: [libm.so] 0x0000000000000001 (NEEDED) Shared library: [libc.so] ``` ### [Configuring the Frida Gadget]() According to the documentation, the Frida gadget allows the use of a configuration file to parameterize interaction: - **Listing**: Interaction is the same as frida-server. - **Script**: Direct interaction with a JS script at a specified path. - **ScriptDirectory**: Same as *Script*, but for multiple applications and scripts. The *Listing* interaction would require the `android.permission.INTERNET` permission. While we could add this permission by modifying the manifest, we will use the *Script* interaction instead, as it does not require additional permissions. The Frida payload will be located in the `/data/local/tmp/myscript.js` file. The gadget configuration for this context is provided below: ```json { "interaction": { "type": "script", "path": "/data/local/tmp/myscript.js", "on_change": "reload" } } ``` Using a configuration file must follow two requirements: 1. The file must have the same name as the gadget library (e.g., `libgadget.so` and `libgadget.conf`). 2. The configuration file must be located in the **same** directory as the gadget library. The second requirement means that after installation on the device, the gadget library will look for the configuration file in the `/data/app/org.telegram.messenger-1/lib` directory. When installing an application, the Android package manager copies files from the `lib/` directory of the APK only if [[4]](): - They start with the prefix `lib`. - They end with the suffix `.so`. - It is `gdbserver`. Frida is aware of these requirements, as illustrated in the listing below. Hence, we can simply add the `.so` suffix to `libgadget.conf`: ```cpp #if ANDROID if (!FileUtils.test (config_path, FileTest.EXISTS)) { var ext_index = config_path.last_index_of_char ('.'); if (ext_index != -1) { config_path = config_path[0:ext_index] + ".config.so"; } else { config_path = config_path + ".config.so"; } } #endif ``` [lib/gadget/gadget.vala]() Finally, the `lib` directory of the new Telegram `.apk` has the following structure: ```bash $ tree lib . └── arm64-v8a ├── libgadget.config.so ├── libgadget.so └── libtmessages.28.so ``` With `libtmessages.28.so` linked against `libgadget.so`: ```bash $ readelf -d ./arm64-v8a/libtmessages.28.so 0x0000000000000001 (NEEDED) Shared library: [libgadget.so] ... ``` ### [Run]() Once: 1. The injection is performed in `libtmessages.28.so`. 2. The gadget library and its configuration are placed in the `/lib/ABI` directory. 3. The application is resigned. We can install the repackaged APK (`new.apk`) and push `myscript.js` to `/data/local/tmp`: ```console $ adb shell install new.apk $ adb push myscript.js /data/local/tmp $ adb shell chmod 777 /data/local/tmp/myscript.js ``` The Frida script `myscript.js` used in this tutorial simply calls the Android log function: ```javascript 'use strict'; console.log("Waiting for Java.."); Java.perform(function () { var Log = Java.use("android.util.Log"); Log.v("frida-lief", "Have fun!"); }); ``` myscript.js Lastly, we can run the Telegram application and observe the Android logs:[![../_images/telegram.png](https://lief.re/doc/latest/_images/telegram.png)]() ```console $ adb logcat -s "frida-lief:V" --------- beginning of system --------- beginning of main 03-24 17:23:51.908 10243 10243 V frida-lief: Have fun! ``` ## [Conclusion]() This tutorial demonstrated how static format instrumentation and dynamic instrumentation can be combined. Here is a quick summary of the advantages and disadvantages of this technique: **Advantages:** - Does not require a rooted device. - Does not depend on frida-server. - Can be used to bypass some anti-Frida protections. - Does not modify `AndroidManifest.xml` or DEX files. **Disadvantages:** - Requires adding files to the APK. - Requires the application to have at least one native library. - Relies on the library being loaded early in the application execution. Notes[[1]()] Note that LIEF **does not** modify the `DEBUG` entry … [[2]()] Modifying the ELF Dynamic section is not as simple as the API might suggest. [[3]()] In the ELF format, these are located in the [`INIT_ARRAY`]( "lief.ELF.DynamicEntry.TAG.INIT_ARRAY") or [`INIT`]( "lief.ELF.DynamicEntry.TAG.INIT") entries. [[4]()] For those interested, checks are performed in the `framework_base/core/jni/com_android_internal_content_NativeLibraryHelper.cpp` file. Notably, these checks on the prefix and suffix are only performed if the application is not *debuggable*. API - [`lief.ELF.Binary.add_library()`]( "lief.ELF.Binary.add_library") --- documentID: "f7c489749b5faa1b0ca4306bfcd9b2e7ab8ef63c6a09c0f04bfcd040a89845ef" docname: "tutorials/10_android_formats" title: "10 - Android formats - LIEF Documentation" description: "10 - Android formats. This tutorial introduces Android formats and the API for using them. This includes DEX, OAT, VDEX, and ART." canonical: "https://lief.re/doc/latest/tutorials/10_android_formats.html" markdownURL: "https://lief.re/doc/latest/tutorials/10_android_formats.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "c1b8e20f8d284cc96fac1d30ede78295b62d0ec3b5ec7714afb8097ecdc25a4a" --- # [10 - Android formats]() This tutorial introduces Android formats and the API for using them. This includes DEX, OAT, VDEX, and ART. --- ## [Introduction]() Let’s start with a quick overview of the compilation, installation, and execution of Android applications. When developing applications, the main part of the code is usually written in Java. Developers can also write native code (`C/C++`) through the Java Native Interface (JNI). In the APK building process, Java code is eventually transformed into Dalvik bytecode, which is interpreted by the Android Java virtual machine. The Android JVM differs from Oracle’s implementation; among other differences, it is register-based, whereas Oracle’s implementation is stack-based. To produce Dalvik bytecode, Java sources are first compiled with `javac` into Java bytecode, which Android then transforms into Dalvik bytecode using the `dx` compiler (or the newer `D8`). This bytecode is finally wrapped in DEX files, such as `classes.dex`. The DEX format is specific to Android, and its documentation is available [here](). During APK installation, the system applies optimizations to the DEX file to speed up execution. Interpreting bytecode is not as efficient as executing native code, and the Dalvik virtual machine is based on 32-bit registers, whereas most recent CPUs are 64-bit. To address this issue, and prior to Android 4.4 (KitKat), the runtime used JIT compilation to transform Dalvik bytecode into assembly. JIT occurred **during execution** each time the application was run. Since Android 4.4, Android has used a new runtime that performs optimizations **during installation**. Consequently, installation takes more time, but the transformation to native code is performed only once. To optimize Dalvik bytecode, the original DEX file (e.g., `classes.dex`) is transformed into another file containing the native code. This new file typically has the `.odex` or `.oat` extension and is wrapped in the ELF format. Using the ELF format makes sense for two main reasons: - It is the default format used by Linux and Android to package assembly code. - It enables the use of the same loader: `/system/bin/linker{64}`. OAT files are actually ELF files, which is why we chose to add support for this format in LIEF. The ELF format acts as a wrapper around the Android-specific OAT format. Basically, the associated ELF exports a few symbols: ```python oat = lief.OAT.parse("SomeOAT") assert oat is not None for s in oat.dynamic_symbols: print(s) ``` ```text oatdata OBJECT GLOBAL 1000 1262000 oatexec OBJECT GLOBAL 1263000 10d4060 oatlastword OBJECT GLOBAL 233705c 4 oatbss OBJECT GLOBAL 2338000 f5050 oatbsslastword OBJECT GLOBAL 242d04c 4 ``` These symbols serve as pointers to specific parts of the OAT format. For example, `oatdata` points to the beginning of the underlying OAT format, while `oatexec` points to the native code. For a deeper understanding of OAT internal structures, see: - [Hiding Behind ART - Black Hat 2015]() - [Dalvik and ART]() - [OAT internal structures]() These different formats can be a bit confusing. To summarize: **DEX files are transformed into `.odex` files, which are primarily ELF files wrapping a custom OAT format.**[![../_images/elf_oat.png](https://lief.re/doc/latest/_images/elf_oat.png)]() OAT structure is poorly documented, and its internal structures change with **each version** of Android without backward compatibility. This means OAT files produced on Android 6.0.1 can only be used on that version. --- In the Android framework, the `dex2oat` executable is responsible for converting and optimizing APK DEX files into OATs. This executable is located in the `/system/bin/` directory, and its output can be viewed via logcat: ```console $ adb logcat -s "dex2oat:I" ... 05-04 10:16:37.218 1987 1987 I dex2oat : /system/bin/dex2oat --compiler-filter=speed --dex-file=/data/user/0/com.google.android.gms/snet/installed/snet.jar --oat-file=/data/user/0/com.google.android.gms/snet/dalvik-cache/snet.dex 05-04 10:16:37.688 1987 1998 W dex2oat : Compilation of void com.google.android.snet.Snet.enterSnetIdle(android.content.Context, android.os.Bundle) took 116.995ms 05-04 10:16:37.768 1987 1987 I dex2oat : ---------------------------------------------------- 05-04 10:16:37.768 1987 1987 I dex2oat : : S T A R T I N G . . . 05-04 10:16:37.768 1987 1987 E dex2oat : : oat location is not valid /data/user/0/com.google.android.gms/snet/dalvik-cache/snet.dex 05-04 10:16:37.768 1987 1987 I dex2oat : dex2oat took 552.045ms (threads: 8) arena alloc=3MB java alloc=1150KB native alloc=8MB free=3MB 05-04 12:25:50.878 10460 10460 I dex2oat : /system/bin/dex2oat --compiler-filter=speed ... ``` The output above shows the transformation of SafetyNet DEX files, located in `/data/user/0/com.google.android.gms/snet/installed/snet.jar`, into an **OAT** saved in `/data/user/0/com.google.android.gms/snet/dalvik-cache/snet.dex`. One can see that the extension is `.dex`, which suggests a DEX file rather than an OAT. However, checking the file type reveals: ```console $ file snet.dex snet.dex: ELF 64-bit LSB shared object, ARM aarch64, version 1 (GNU/Linux), dynamically linked, stripped ``` It is an ELF file. > **Warning** > > Do not trust extensions: **.dex** can be **DEX** or **OAT**, **.odex** files are **OAT**, **.oat** files are **OAT**, etc. The process of converting Java sources into OAT can be simplified with the following diagram:![../_images/java2oat.png](https://lief.re/doc/latest/_images/java2oat.png) ## [The Missing DEX]() When analyzing applications from the Google Play Store, the APK usually contains `classes.dex` files. Since these files contain the Dalvik bytecode, most tools rely on them for analysis (decompilation, static analysis, etc.). However, when analyzing manufacturer firmware (or ROMs), these DEX files might be missing. For example, the Samsung `com.android.settings` application is associated with the `/system/priv-app/SecSettings2` directory, which has the following structure: ```console $ tree system/priv-app/SecSettings2 ├── oat │ └── arm64 │ └── SecSettings2.odex └── SecSettings2.apk 2 directories, 2 files ``` The `SecSettings2.apk` file does not contain any `.dex` files: ```console $ unzip -l ./SecSettings2.apk|grep -c "classes.dex" 0 ``` Next to `SecSettings2.apk` is `SecSettings2.odex`, which is the OAT file resulting from the optimization of the missing DEX file. Since ROM developers control the Android version and target architecture, they only need to provide the OAT file. This “feature” can also be used to hinder analysis and reverse engineering. Since the Dalvik bytecode resides in the DEX file, analysis is quite limited without it. Fortunately, a copy of the original DEX is included within the OAT! While it is not an exact copy (as `dex2oat` replaces some Dalvik instructions, such as `invoke-virtual`, with optimized ones [[1]]()), starting with **Android N**, the original instructions can also be recovered. Prior to Android Oreo (8.0.0), DEX files were embedded in the OAT itself. After Oreo, the transformation performed by `dex2oat` generates two files: - **classes.odex**: OAT containing native code - **classes.vdex**: VDEX file containing a copy of the original DEX files The DEX files originally located in the OAT have been exported to a **new file** with a **new format**: VDEX. This format is completely different from OAT; specifically, it is not an ELF file. Similar to the OAT format, VDEX internal structures change with each version of Android without backward compatibility. There also exist tools [[4]]() [[5]]() [[6]]() to extract DEX files from OAT/VDEX files, but extraction [[3]]() is either limited to OAT [[4]]() or VDEX [[5]](). LIEF aims to provide a single framework for dealing with these formats. ## [OAT and VDEX]() As explained previously, the internal structures of these formats change with each version of Android. LIEF provides an abstraction of these modifications, allowing users to work with OAT or VDEX without worrying about the underlying version. LIEF currently supports OAT files from Android 6.0 Marshmallow (OAT v64) to Android 8.0.1 Oreo (OAT v131). The OAT version can be obtained using the [`lief.OAT.version()`]( "lief.OAT.version") function: ```python >>> import lief >>> lief.OAT.version("classes.odex") # From Android 6 64 >>> lief.OAT.version("classes.odex") # From Android 7 88 ``` The associated Android version can be accessed using [`lief.OAT.android_version()`]( "lief.OAT.android_version"): ```python >>> lief.OAT.android_version(64) ANDROID_VERSIONS.VERSION_601 >>> lief.OAT.android_version(124) ANDROID_VERSIONS.VERSION_800 >>> lief.Android.code_name(lief.Android.ANDROID_VERSIONS.VERSION_800) 'Oreo' >>> lief.Android.version_string(lief.Android.ANDROID_VERSIONS.VERSION_800) "8.0.0" ``` To reflect the fact that OAT files are first and foremost ELF files, the [`lief.OAT.Binary`]( "lief.OAT.Binary") class extends `lief.ELF.Binary` ( [`lief::elf::Binary`]() ; [`lief.ELF.Binary`]() ; [`LIEF::ELF::Binary`]() ): ```python >>> import lief >>> oat = lief.OAT.parse("classes.odex") >>> type(oat) _pylief.OAT.Binary >>> isinstance(oat, lief.ELF.Binary) True ``` Thus, the same ELF API is available (adding sections, modifying dynamic entries, etc.), and the [`lief.OAT.Binary`]( "lief.OAT.Binary") object adds the following methods: **class lief.OAT.Binary** Bases: [`Binary`]( "lief._lief.ELF.Binary") OAT binary representation **property classes → lief.OAT.Binary.it\_classes** Return an iterator over [`Class`]( "lief.OAT.Class") **property dex2dex\_json\_info → str** **property dex\_files → lief.OAT.Binary.it\_dex\_files** Return an iterator over [`File`]( "lief.DEX.File") **get\_class(*self*, *class\_name: str*) → [lief.\_lief.OAT.Class]( "lief._lief.OAT.Class") | None **get\_class(*self*, *class\_index: int*) → [lief.\_lief.OAT.Class]( "lief._lief.OAT.Class") | None**** Overloaded function. 1. `get_class(self, class_name: str) -> lief._lief.OAT.Class | None` Return the [`Class`]( "lief.OAT.Class") from its name 2. `get_class(self, class_index: int) -> lief._lief.OAT.Class | None` Return the [`Class`]( "lief.OAT.Class") from its **index** **has\_class(*self*, *arg: str*, */*) → bool** Check if the class with the given name is present in the current OAT binary **property header → [lief.OAT.Header]( "lief.OAT.Header")** Return the OAT [`Header`]( "lief.OAT.Header") **property methods → lief.OAT.Binary.it\_methods** Return an iterator over [`Method`]( "lief.OAT.Method") **property oat\_dex\_files → lief.OAT.Binary.it\_oat\_dex\_files** Return an iterator over [`DexFile`]( "lief.OAT.DexFile") If the OAT targets Android Marshmallow or Nougat (6 or 7), DEX files can be retrieved via the [`lief.OAT.Binary.dex_files`]( "lief.OAT.Binary.dex_files") attribute: ```python oat: lief.OAT.Binary dex = oat.dex_files[0] dex.save("/tmp/classes.dex") ``` In the code above, the [`lief.DEX.File`]( "lief.DEX.File") has been extracted to `/tmp/classes.dex` (with de-optimization). If the OAT targets Android Oreo or above, extraction uses the VDEX file. The [`lief.OAT.parse()`]( "lief.OAT.parse") function accepts an OAT file, or both an OAT **and** a VDEX file. Providing the VDEX file allows the [`lief.OAT.Binary`]( "lief.OAT.Binary") object to offer the same functionality as it does for pre-Oreo OAT files. If the VDEX file is not provided, the [`lief.OAT.Binary`]( "lief.OAT.Binary") will have limited information: ```python # Without VDEX file >>> oat_oreo = lief.OAT.parse("KeyChain.odex") >>> len(oat_oreo.dex_files) 0 >>> len(oat_oreo.classes) 0 >>> len(oat_oreo.oat_dex_files) 1 >>> oat_dex_file = oat_oreo.oat_dex_files[0] >>> print(oat_dex_file) /system/app/KeyChain/KeyChain.apk - (Checksum: 0x206c8ab1) ``` ```python # With VDEX file >>> oat_oreo = lief.OAT.parse("KeyChain.odex", "KeyChain.vdex") >>> len(oat_oreo.dex_files) 1 >>> len(oat_oreo.classes) 17 >>> oat_oreo.dex_files[0].save("/tmp/classes.dex") ``` The LIEF VDEX module can also be used directly: ```python >>> vdex = lief.VDEX.parse("KeyChain.vdex") ``` Because the VDEX format is completely different from OAT, ELF, PE, and Mach-O, the VDEX parser creates a [`lief.VDEX.File`]( "lief.VDEX.File") object rather than a [`Binary`]( "lief.Binary"). DEX files can be extracted using the [`lief.VDEX.File.dex_files`]( "lief.VDEX.File.dex_files") attribute: ```python >>> len(vdex.dex_files) 1 >>> vdex.dex_files[0].save("/tmp/KeyChain.dex") # With de-optimization ``` ## [DEX]() The previous section covered the OAT and VDEX formats and how to access the underlying DEX. This section introduces the primary API for the [`lief.DEX.File`]( "lief.DEX.File") object. The LIEF DEX module allows you to obtain information about Java code, such as strings, class names, Dalvik bytecode, etc. > **Note** > > Since the LIEF project focuses solely on formats, the DEX module does not include a Dalvik disassembler. The primary API for a DEX file is in the [`lief.DEX.File`]( "lief.DEX.File") object. This object can be generated using: > - [`lief.OAT.Binary.dex_files`]( "lief.OAT.Binary.dex_files") > - [`lief.VDEX.File.dex_files`]( "lief.VDEX.File.dex_files") > - [`lief.DEX.parse()`]( "lief.DEX.parse") ```python >>> oat = lief.OAT.parse("SecSettings2.odex") >>> type(oat.dex_files[0]) _pylief.DEX.File >>> vdex = lief.VDEX.parse("SecSettings2.odex") >>> type(vdex.dex_files[0]) _pylief.DEX.File >>> dex = lief.DEX.parse("classes.dex") >>> type(dex) _pylief.DEX.File ``` Once created, strings can be accessed via the [`lief.DEX.File.strings`]( "lief.DEX.File.strings") attribute: ```python dex: lief.DEX.File for s in dex.strings: if "http" in s: print(s) ``` ```text https://analytics.mopub.com/i/jot/exchange_client_event https://app-measurement.com/a https://mobilecrashreporting.googleapis.com/v1/crashes:batchCreate?key= https://pagead2.googlesyndication.com/pagead/gen_204?id=gmob-apps https://plus.google.com/ https://ssl.google-analytics.com https://support.google.com/dfp_premium/answer/7160685#push https://www.google.com ... ``` Similarly, methods and classes are available via the [`lief.DEX.File.classes`]( "lief.DEX.File.classes") and [`lief.DEX.File.methods`]( "lief.DEX.File.methods") attributes: ```python dex: lief.DEX.File for cls in dex.classes: if cls.source_filename: print(cls) ``` ```text com.avast.android.sdk.antitheft.internal.protection.wipe.a - CalendarWiper.java - 3 Methods com.avast.android.account.internal.identity.a - AvastIdentityProvider.java - 17 Methods com.avast.android.account.internal.identity.d - FacebookIdentityProvider.java - 19 Methods com.avast.android.lib.wifiscanner.internal.b$a - WifiScannerComponentFactory.java - 1 Methods ``` In the DEX file format, a special attribute for classes records the original source filename: [source\_file\_idx](). Some obfuscators mangle class names but preserve this attribute! Since Java source filenames are associated with class names, the deobfuscated name can often be recovered using: > - [`lief.DEX.Class.source_filename`]( "lief.DEX.Class.source_filename") > - [`lief.DEX.Class.pretty_name`]( "lief.DEX.Class.pretty_name") ```python dex: lief.DEX.File for cls in dex.classes: if cls.source_filename: print(cls.pretty_name + ": ---> " + cls.source_filename) ``` ```text com.avast.android.sdk.antitheft.internal.protection.wipe.a: ---> CalendarWiper.java com.avast.android.account.internal.identity.a ---> AvastIdentityProvider.java com.avast.android.account.internal.identity.d ---> FacebookIdentityProvider.java com.avast.android.lib.wifiscanner.internal.b$a ---> WifiScannerComponentFactory.java DEX methods are represented by the :class:`~lief.DEX.Method` object, and raw Dalvik bytecode can be accessed via :attr:`lief.DEX.Method.bytecode`. ``` ## [ART]() **ART** is the name of the **Android Runtime**, but it is also a **format**! This format is used for optimization by the Android **framework**. As discussed previously, Android has its own implementation of the Java virtual machine based on Dalvik bytecode. This JVM is implemented in C++, and Java primitives (`java.lang.String`, `java.lang.Object`, etc.) are mirrored with C++ objects: - `java.lang.Class`: `art::mirror::Class` - `java.lang.String`: `art::mirror::String` - `java.lang.reflect.Method`: `art::mirror::Method` - … When a **new** Java class is instantiated, a mirrored C++ object is created (memory allocation, constructor calls, etc.), and the JVM maintains a reference to this C++ object. To speed up the boot process and avoid re-instantiating well-known classes [[2]]() at each boot, Android uses the ART format to store instances of C++ objects. It can be thought of as a heap dump of C++ objects. As with OAT and VDEX, the internal structures of this format change with each version of Android. LIEF 0.9 provides basic support for this format and exposes the ART [`lief.ART.Header`]( "lief.ART.Header"). The primary API is available in the [`lief.ART.File`]( "lief.ART.File") object. ```python art = lief.ART.parse("boot.art") assert isinstance(art, lief.ART.File) print(art.header) ``` ```text Version: 46 Image Begin: 0x70000000 Image Size: 0x238ac8 Checksum: 0x997c0fb0 OAT File Begin: 0x70a5b000 OAT File End: 0x71272000 OAT Data Begin: 0x70a5c000 OAT Data End: 0x7126df70 Patch Delta: 0 Pointer Size: 8 Compile pic: true Number of sections: 10 Number of methods: 7 Boot Image Begin: 0 Boot Image Size: 0 Boot OAT Begin: 0 Boot OAT Size: 0 Storage Mode: UNCOMPRESSED Data Size: 0x2389f0 ``` ## [Conclusion]() LIEF 0.9 provides *read-only* access to these formats, but future versions should allow for modification (adding methods, changing names, patching checksums, etc.). Enjoy! Notes[[1]()] - [http://mylifewithandroid.blogspot.com/2009/05/about-quick-method-invocation.html]() - [https://github.com/JesusFreke/smali/wiki/UnresolvableOdexInstruction]() [[2]()] Usually those from the Android Framework. [[3]()] Other tools may have additional features like a disassembler or pseudo-code generation that are not covered in LIEF. [4]([1](),[2]()) Dextra by Jonathan Levin: [http://newandroidbook.com/tools/dextra.html]() [5]([1](),[2]()) vdexExtractor by Anestis Bechtsoudis: [https://github.com/anestisb/vdexExtractor]() [[6]()] smali by JesusFreke: [https://github.com/JesusFreke/smali/wiki/DeodexInstructions]() API - [`lief.OAT.Binary`]( "lief.OAT.Binary") - [`lief.VDEX.File`]( "lief.VDEX.File") - [`lief.DEX.File`]( "lief.DEX.File") - [`lief.ART.File`]( "lief.ART.File") --- documentID: "4db01f98ac6622c305e0d3b5235318f57e369850cc33d0ba0f21e88ca8ba349e" docname: "tutorials/11_macho_modification" title: "11 - Mach-O Modification - LIEF Documentation" description: "11 - Mach-O Modification. This tutorial covers Mach-O format modification and introduces some internal aspects of the format." canonical: "https://lief.re/doc/latest/tutorials/11_macho_modification.html" markdownURL: "https://lief.re/doc/latest/tutorials/11_macho_modification.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "60f0f716f85b46221af442fbbc6b4358aa8f36eb09a56fb4278edab6d088e77f" --- # [11 - Mach-O Modification]() This tutorial covers Mach-O format modification and introduces some internal aspects of the format. Files and scripts used in this tutorial are available in the [tutorials repository](). --- ## [Introduction]() A basic Mach-O binary (i.e., not FAT) can be represented in four parts, as described in this diagram:![../_images/image1.png](https://lief.re/doc/latest/_images/image1.png) The first part begins with a header that can be accessed through the [`lief.MachO.Binary.header`]( "lief.MachO.Binary.header") attribute. The second part contains the load commands table, which can be iterated over using `lief.MachO.Binary.load_commands`. This is optionally followed by padding or free space. Finally, the fourth part contains the raw data (assembly code, rebase bytecode, signatures, etc.). Load commands such as [`SegmentCommand`]( "lief.MachO.SegmentCommand") or [`DyldInfo`]( "lief.MachO.DyldInfo") can be associated with *raw data* located after the load command table and the padding section. The padding section is used by macOS to sign the binary after compilation by adding a custom command. The `codesign` utility extends the *raw data* area with the signature and adds an `LC_CODE_SIGNATURE` or `LC_DYLIB_CODE_SIGN_DRS` command in the padding area. Since load commands are the base unit of the Mach-O format (segments, shared libraries, entry points, etc., are all *commands*), the ability to add arbitrary commands to a binary enables interesting possibilities such as code injection, anti-analysis, etc. Different techniques exist for adding new commands to a Mach-O binary: - Replacing an existing load command that is not mandatory for execution, such as [`UUIDCommand`]( "lief.MachO.UUIDCommand") or [`CodeSignature`]( "lief.MachO.CodeSignature"). - Using the padding area to expand the command header. The main limitation of these techniques is that the size and number of commands that can be added are tied to the padding section size or the size of the command replaced. If the padding size is small, we cannot add a `LOAD_DYLIB` command with a very long library path. Moreover, `codesign` may complain if there is insufficient space to add the `LC_CODE_SIGNATURE` because we are using space that was reserved for it. The following sections discuss format modifications and how LIEF addresses these limitations. ## [When PIE Makes Things Easier]() macOS and iOS executables are typically compiled with flags that make them position-independent. Instructions generated by the compiler use relative addressing associated with *rebase* information. To simplify, PIE binaries allow the *raw data* section to be mapped at a random base address. LIEF leverages this by shifting the raw data section within the format.![../_images/image2.png](https://lief.re/doc/latest/_images/image2.png) Such a transformation also requires maintaining consistent format metadata. Specifically, when we shift the raw data, we must update relocations, segment offsets, virtual addresses, etc. Once the raw data is shifted and the metadata updated, we have arbitrary space between the load command table and the raw data section. Thus, we can extend the load command table as shown in the figure below:![../_images/image3.png](https://lief.re/doc/latest/_images/image3.png) > **Warning** > > The size of the shift must be aligned with the page size to avoid issues with section and segment alignment. Maintaining format consistency after a shift transformation is complex. The next section presents parts of the Mach-O format that must be updated to maintain consistency. ## [When Mach-O Makes Things Harder]() After the shift operation, we must update several load commands: - [`lief.MachO.SymbolCommand.symbol_offset`]( "lief.MachO.SymbolCommand.symbol_offset") / [`lief.MachO.SymbolCommand.strings_offset`]( "lief.MachO.SymbolCommand.strings_offset") - [`lief.MachO.DataInCode.data_offset`]( "lief.MachO.DataInCode.data_offset"), [`lief.MachO.CodeSignature.data_offset`]( "lief.MachO.CodeSignature.data_offset"), [`lief.MachO.SegmentSplitInfo.data_offset`]( "lief.MachO.SegmentSplitInfo.data_offset") - [`lief.MachO.MainCommand.entrypoint`]( "lief.MachO.MainCommand.entrypoint") - [`lief.MachO.FunctionStarts.data_offset`]( "lief.MachO.FunctionStarts.data_offset") / [`lief.MachO.FunctionStarts.functions`]( "lief.MachO.FunctionStarts.functions") - [`DynamicSymbolCommand`]( "lief.MachO.DynamicSymbolCommand") - `lief.MachO.Section.offset` / `lief.MachO.Section.virtual_address` - `lief.MachO.SegmentCommand.offset` / [`lief.MachO.SegmentCommand.virtual_address`]( "lief.MachO.SegmentCommand.virtual_address") - … We also need to update: - Relocations - Binding information - Export information While the ELF and PE formats use structures for internal storage of relocations and exports, the Mach-O format uses bytecode to *rebase* the binary. Export information is stored in a [trie]() data structure. The use of tries and bytecode reduces binary size but makes updates more difficult, as we must interpret and regenerate the bytecode. ### [Rebase Bytecode]() As mentioned previously, recent Mach-O loaders use bytecode to relocate (or rebase) the binary. The offset and size of the bytecode are specified in the [`lief.MachO.DyldInfo.rebase`]( "lief.MachO.DyldInfo.rebase") attribute. Basically, the bytecode is composed of [`REBASE_OPCODES`]( "lief.MachO.DyldInfo.REBASE_OPCODES") that define addresses to relocate. > **Warning** > > Note that the [`Section`]( "lief.MachO.Section") object has a [`relocation_offset`]( "lief.MachO.Section.relocation_offset") attribute. This appears to be used only for Mach-O object files ([`lief.MachO.Header.FILE_TYPE.OBJECT`]( "lief.MachO.Header.FILE_TYPE.OBJECT")) or executables using an old version of the Mach-O loader. > > This offset points to a list of relocation structures (not bytecode), the number of which is defined by [`numberof_relocations`]( "lief.MachO.Section.numberof_relocations"). To determine which addresses must be relocated, we must interpret the bytecode. The [`lief.MachO.DyldInfo.show_rebases_opcodes`]( "lief.MachO.DyldInfo.show_rebases_opcodes") attribute returns the bytecode as *pseudo-code*: ```python import lief app = lief.parse("MachO64_x86-64_binary_id.bin") print(app.dyld_info.show_rebases_opcodes) ``` ```text [SET_TYPE_IMM] Type: POINTER [SET_SEGMENT_AND_OFFSET_ULEB] Segment Index := 2 (__DATA) Segment Offset := 0x20 [DO_REBASE_ULEB_TIMES] for i in range(26): rebase(POINTER, __DATA, 0x20) Segment Offset += 0x8 (0x28) rebase(POINTER, __DATA, 0x28) Segment Offset += 0x8 (0x30) rebase(POINTER, __DATA, 0x30) Segment Offset += 0x8 (0x38) rebase(POINTER, __DATA, 0x38) Segment Offset += 0x8 (0x40) rebase(POINTER, __DATA, 0x40) Segment Offset += 0x8 (0x48) ... [DONE] ``` From the output above, we can see that the loader will rebase **pointers** in the `__DATA` segment at offsets `0x20, 0x28, 0x38, ...`. For those who only care about the exact addresses being relocated, this output is not very user-friendly. LIEF also provides a **representation** of this bytecode by creating [`lief.MachO.Relocation`]( "lief.MachO.Relocation") objects, which are the result of interpreting the bytecode. The [`lief.MachO.Binary.relocations`]( "lief.MachO.Binary.relocations") attribute returns an iterator over [`lief.MachO.Relocation`]( "lief.MachO.Relocation") objects that **model** a relocation, similar to [`lief.ELF.Relocation`]( "lief.ELF.Relocation") and [`lief.PE.Relocation`]( "lief.PE.Relocation"). ```python app: lief.MachO.Binary for relocation in app.relocations: print(relocation) ``` ```text 100002020 POINTER 64 DYLDINFO __DATA.__la_symbol_ptr _err 100002028 POINTER 64 DYLDINFO __DATA.__la_symbol_ptr _errx 100002030 POINTER 64 DYLDINFO __DATA.__la_symbol_ptr _exit 100002038 POINTER 64 DYLDINFO __DATA.__la_symbol_ptr _fprintf 100002040 POINTER 64 DYLDINFO __DATA.__la_symbol_ptr _free 100002048 POINTER 64 DYLDINFO __DATA.__la_symbol_ptr _fwrite ... ``` Using this representation, we can update relocations by adding the shift size to the [`lief.MachO.Relocation.address`]( "lief.MachO.Relocation.address") attribute. When the Mach-O builder reconstructs the final binary, it **regenerates** and optimizes the rebase bytecode according to the current state of the relocations. The process can be summarized by the following diagram:![../_images/lief_bytecode.png](https://lief.re/doc/latest/_images/lief_bytecode.png) ### [Binding Bytecode]() The Mach-O loader also uses bytecode to bind imported functions or symbols. This bytecode is used in three different binding methods: - Normal binding - Weak binding (used when the same symbol is defined multiple times) - Lazy binding (bound only when the symbol is accessed) The bytecode can be pretty-printed with [`show_bind_opcodes`]( "lief.MachO.DyldInfo.show_bind_opcodes"), [`show_weak_bind_opcodes`]( "lief.MachO.DyldInfo.show_weak_bind_opcodes"), and [`show_lazy_bind_opcodes`]( "lief.MachO.DyldInfo.show_lazy_bind_opcodes"): ```python app: lief.MachO.Binary print(app.dyld_info.show_bind_opcodes) ``` ```text [SET_DYLIB_ORDINAL_IMM] Library Ordinal := 1 [SET_SYMBOL_TRAILING_FLAGS_IMM] Symbol name := ___stderrp Is Weak ? false [SET_TYPE_IMM] Type := POINTER [SET_SEGMENT_AND_OFFSET_ULEB] Segment := __DATA Segment Offset := 0x10 [DO_BIND] bind(POINTER, __DATA, 0x10, ___stderrp, library_ordinal=/usr/lib/libSystem.B.dylib, addend=0, is_weak_import=false) Segment Offset += 0x8 (0x18) ``` The representation and update process are identical to those described in the *Rebase Bytecode* section. ### [Export Trie]() For exported functions and symbols, the Mach-O format uses a *trie* structure to store export information. The trie offset and size are specified in the [`export_trie`]( "lief.MachO.DyldInfo.export_trie") attribute. Once parsed, trie entries are represented via the [`ExportInfo`]( "lief.MachO.ExportInfo") object and can be retrieved using the [`export_info`]( "lief.MachO.Symbol.export_info") attribute. ```python app = lief.parse("FAT_MachO_x86_x86-64_library_libdyld.dylib") print(app.dyld_info.show_export_trie) ``` ```text ... _@off.0x17 _N@off.0x21 _NS@off.0x50 _NSI@off.0x5d _NSInstallLinkEditErrorHandlers@off.0x11d _NSInstallLinkEditErrorHandlers{addr: 0x126b, flags: 0} ... ``` ```python app: lief.MachO.Binary for s in app.symbols: if s.has_export_info: print(s.export_info) ``` ```text Node Offset: 128 Flags: 0 Address: 126b Symbol: _NSInstallLinkEditErrorHandlers Node Offset: 5f6 Flags: 0 Address: 2168 Symbol: _NSIsSymbolDefinedInObjectFileImage Node Offset: 1a0 Flags: 0 Address: 1391 Symbol: _NSIsSymbolNameDefined ... ``` After the shift operation, export information is patched by updating the [`address`]( "lief.MachO.ExportInfo.address") attribute, and a new export trie is generated from the updated data. ## [Removing the Signature]() Removing the `LC_CODE_SIGNATURE` command is a basic modification that is very useful when modifying Mach-O files. Since the signature verifies the integrity of the binary, this command typically needs to be removed after modifying the file. The binary can be re-signed once all modifications are finished. LIEF provides the [`lief.MachO.Binary.remove_signature()`]( "lief.MachO.Binary.remove_signature") function to remove this command: ```python ssh: lief.MachO.Binary ssh.remove_signature() ssh.write("ssh.nosigned") ``` ## [Code Injection with Shared Libraries]() As explained in the talk on format modification [[1]](), one way to inject code into a program’s memory space is to force the loader to load a library (previously unlinked) that contains a constructor function. For a Mach-O binary, this can be achieved by adding one of these load commands: - [`ID_DYLIB`]( "lief.MachO.LoadCommand.TYPE.ID_DYLIB") - [`LOAD_DYLIB`]( "lief.MachO.LoadCommand.TYPE.LOAD_DYLIB") - … Consider an example using `clang`. First, we create a small library that defines a constructor: ```cpp #include #include __attribute__((constructor)) void my_constructor(void) { printf("Hello World\n"); } ``` This is compiled with: ```console $ clang -fPIC -shared libexample.c -o libexample.dylib ``` Then, we add a new [`LOAD_DYLIB`]( "lief.MachO.LoadCommand.TYPE.LOAD_DYLIB") using the [`lief.MachO.Binary.add_library()`]( "lief.MachO.Binary.add_library") function: ```python clang: lief.MachO.Binary clang.add_library("/Users/romain/libexample.dylib") clang.write("/tmp/clang.new") ``` Finally, we run `clang.new` and observe that `Hello World` is printed before the main execution of `clang`: ```console $ chmod u+x /tmp/clang.new $ /tmp/clang.new Hello World clang: error: no input files ``` We can also see the new [`LOAD_DYLIB`]( "lief.MachO.LoadCommand.TYPE.LOAD_DYLIB") command using `otool`: ```console $ otool -l /tmp/clang.new|grep -C4 LOAD_DYLIB ... cmdsize 16 dataoff 73864 datasize 0 Load command 16 cmd LC_LOAD_DYLIB cmdsize 56 name /Users/romain/libexample.dylib (offset 24) time stamp 2 Thu Jan 1 01:00:02 1970 current version 0.0.0 ``` ## [Adding a Section/Segment]() Since we can allocate arbitrary space between the load command table and the raw data, we can also extend an existing [`LoadCommand`]( "lief.MachO.LoadCommand"). In particular, Mach-O segments are commands associated with the LIEF object [`lief.MachO.SegmentCommand`]( "lief.MachO.SegmentCommand"). To add a new section to the `__TEXT` segment, we must extend the load command associated with that segment to accommodate a new section structure. We must also reserve space for the section’s content. Since the content of the `__TEXT` segment begins at offset 0 and ends somewhere in the raw data, the appropriate place to insert the new content is between the end of the load command table and the beginning of the raw data:![../_images/extendtxt.png](https://lief.re/doc/latest/_images/extendtxt.png) The process described above is implemented via the [`lief.MachO.Binary.add_section()`]( "lief.MachO.Binary.add_section") method. In this example, we will inject assembly code that executes `/bin/sh`: ```python app: lief.MachO.Binary raw_shell: list[int] section = lief.MachO.Section.create("__shell", raw_shell) assert isinstance(section, lief.MachO.Section) section.alignment = 2 section += lief.MachO.Section.FLAGS.SOME_INSTRUCTIONS section += lief.MachO.Section.FLAGS.PURE_INSTRUCTIONS section = app.add_section(section) print(section) ``` We can then change the entry point by setting the [`lief.MachO.MainCommand.entrypoint`]( "lief.MachO.MainCommand.entrypoint") attribute: ```python app: lief.MachO.Binary section: lief.MachO.Section __TEXT = app.get_segment("__TEXT") assert __TEXT is not None main = app.main_command assert main is not None main.entrypoint = section.virtual_address - __TEXT.virtual_address ``` Finally, we remove the signature and reconstruct the binary: ```python app: lief.MachO.Binary app.remove_signature() app.write("./id.modified") ``` The execution of `id.modified` should yield a similar output: ```console Mac-mini:tmp romain$ ./id.modified tmp @ [romain] $ ``` You can also check other tools such as optool [[2]]() or insert\_dylib [[3]](). References[[1]()] [https://www.romainthomas.fr/publication/static-instrumentation/]() [[2]()] [https://github.com/alexzielenski/optool]() [[3]()] [https://github.com/Tyilo/insert\_dylib]() API - [`lief.MachO.Binary.add_section()`]( "lief.MachO.Binary.add_section") - [`lief.MachO.Binary.add_library()`]( "lief.MachO.Binary.add_library") --- documentID: "c0a1d1ed22afa1356d76b86193d0ef29b5627784077415da26e29e8041bb9cde" docname: "tutorials/12_elf_coredump" title: "12 - ELF Coredump - LIEF Documentation" description: "12 - ELF Coredump. This tutorial introduces the API for analyzing and manipulating ELF coredumps." canonical: "https://lief.re/doc/latest/tutorials/12_elf_coredump.html" markdownURL: "https://lief.re/doc/latest/tutorials/12_elf_coredump.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "63405ca42d98d3f44dba2776e3da33e6acf7bec2927d6ed65621478fa4a8a7aa" --- # [12 - ELF Coredump]() This tutorial introduces the API for analyzing and manipulating ELF coredumps. --- ## [Introduction]() ELF core [[1]]() files provide information about the CPU state and memory state of a program at the time the coredump was generated. The memory state includes a *snapshot* of all segments mapped into the process’s memory space. The CPU state contains register values from when the core dump was generated. Coredump files use a subset of ELF structures to store this information. **Segments** are used for the memory state of the process, while ELF notes ([`lief.ELF.Note`]( "lief.ELF.Note")) are used for process metadata (PID, signal, etc.). Notably, the CPU state is stored in a note with a specific type. Here is an overview of the coredump layout:![../_images/elf_notes.png](https://lief.re/doc/latest/_images/elf_notes.png) For more details about coredump internal structures, refer to the following blog post: [Anatomy of an ELF core file](). ## [Coredump Analysis]() Since core files are effectively ELF files, they can be opened using the `lief.abstract.parse` ( [`lief.parse()`]() ; [`LIEF::Parser::parse()`]() ) function: ```python import lief core = lief.parse("ELF64_AArch64_core_hello.core") ``` We can iterate over the [`Segment`]( "lief.ELF.Segment") objects to inspect the memory state of the program: ```python core: lief.ELF.Binary segments = core.segments print(f"Number of segments {len(segments)}") for segment in segments: print(hex(segment.virtual_address)) ``` To resolve the relationship between libraries and segments, we can examine the special note [`lief.ELF.CoreFile`]( "lief.ELF.CoreFile"): ```python core: lief.ELF.Binary nt_core_file = core.get(lief.ELF.Note.TYPE.CORE_FILE) ``` ELF notes are represented via the main [`lief.ELF.Note`]( "lief.ELF.Note") interface. Some notes, such as [`lief.ELF.CoreFile`]( "lief.ELF.CoreFile"), expose additional APIs by extending the original [`lief.ELF.Note`]( "lief.ELF.Note"). ![Inheritance diagram of lief._lief.ELF.Note, lief._lief.ELF.QNXStack, lief._lief.ELF.AndroidIdent, lief._lief.ELF.CoreFile, lief._lief.ELF.CorePrPsInfo, lief._lief.ELF.CoreSigInfo, lief._lief.ELF.CoreAuxv, lief._lief.ELF.NoteAbi, lief._lief.ELF.NoteGnuProperty, lief._lief.ELF.CorePrStatus](https://lief.re/doc/latest/_images/inheritance-db2183b1e6a80ad92e81168ac4ac276eeedbbe21.png) > **Note** > > All note details inherit from the base class [`lief.ELF.Note`]( "lief.ELF.Note") (or [`LIEF::ELF::Note`]( "LIEF::ELF::Note")). > > Specifically, in C++, we must downcast using the classof function: > > ```cpp > for (const Note& note : binary->notes()) { > if (CoreFile::classof(¬e)) { > const auto& nt_core_file = static_cast(note); > } > } > ``` > > This is roughly equivalent in Python to: > > ```python > binary: lief.ELF.Binary > > for note in binary.notes: > if isinstance(note, lief.ELF.CoreFile): > print("This is a CoreFile note") > ``` We can use the [`lief.ELF.CoreFile.files`]( "lief.ELF.CoreFile.files") attribute or iterate directly over the [`lief.ELF.CoreFile`]( "lief.ELF.CoreFile") object. Both provide access to `lief.ELF.CoreFileEntry` objects: ```python nt_core_file: lief.ELF.CoreFile for file_entry in nt_core_file: print(file_entry) ``` ```text /data/local/tmp/hello-exe: [0x5580b86000, 0x5580b88000]@0 /data/local/tmp/hello-exe: [0x5580b97000, 0x5580b98000]@0x1000 /data/local/tmp/hello-exe: [0x5580b98000, 0x5580b99000]@0x2000 /system/lib64/libcutils.so: [0x7fb7593000, 0x7fb7595000]@0xf000 /system/lib64/libcutils.so: [0x7fb7595000, 0x7fb7596000]@0x11000 /system/lib64/libnetd_client.so: [0x7fb75fb000, 0x7fb75fc000]@0x2000 /system/lib64/libnetd_client.so: [0x7fb75fc000, 0x7fb75fd000]@0x3000 /system/lib64/libdl.so: [0x7fb7a2e000, 0x7fb7a2f000]@0x1000 /system/lib64/libdl.so: [0x7fb7a2f000, 0x7fb7a30000]@0x2000 /data/local/tmp/liblibhello.so: [0x7fb7b22000, 0x7fb7b2a000]@0xcb000 /data/local/tmp/liblibhello.so: [0x7fb7b2a000, 0x7fb7b2b000]@0xd3000 /system/lib64/libc.so: [0x7fb7c0e000, 0x7fb7c14000]@0xc5000 /system/lib64/libc.so: [0x7fb7c14000, 0x7fb7c16000]@0xcb000 /system/lib64/liblog.so: [0x7fb7c6c000, 0x7fb7c6d000]@0x16000 /system/lib64/liblog.so: [0x7fb7c6d000, 0x7fb7c6e000]@0x17000 /system/lib64/libc++.so: [0x7fb7d6f000, 0x7fb7d77000]@0xe2000 /system/lib64/libc++.so: [0x7fb7d77000, 0x7fb7d78000]@0xea000 /system/lib64/libm.so: [0x7fb7db8000, 0x7fb7db9000]@0x36000 /system/lib64/libm.so: [0x7fb7db9000, 0x7fb7dba000]@0x37000 /system/bin/linker64: [0x7fb7e93000, 0x7fb7f87000]@0 /system/bin/linker64: [0x7fb7f88000, 0x7fb7f8c000]@0xf4000 /system/bin/linker64: [0x7fb7f8c000, 0x7fb7f8d000]@0xf8000 ``` From this output, we can see that the [`Segment`]( "lief.ELF.Segment") entries of the main executable (`/data/local/tmp/hello-exe`) are mapped from address `0x5580b86000` to `0x5580b99000`. The register state can also be accessed by looking for the [`lief.ELF.CorePrStatus`]( "lief.ELF.CorePrStatus") note: ```python core: lief.ELF.Binary for note in core.notes: if not isinstance(note, lief.ELF.CorePrStatus): continue # Both are equivalent print(note.pc) reg_values = note.register_values print(reg_values[lief.ELF.CorePrStatus.Registers.AARCH64.PC.value]) ``` ```text 0x5580b86f50 0x5580b86f50 ``` ## [Coredump Manipulation]() To a certain extent, LIEF enables the modification of coredumps. For instance, we can update register values as follows: ```python core: lief.ELF.Binary prstatus = core.get(lief.ELF.Note.TYPE.CORE_PRSTATUS) assert isinstance(prstatus, lief.ELF.CorePrStatus) prstatus.set(lief.ELF.CorePrStatus.Registers.AARCH64.PC, 0xDEADC0DE) core.write("/tmp/new.core") ``` When opening `/tmp/new.core` in GDB, we can observe the modification:![../_images/gdb.png](https://lief.re/doc/latest/_images/gdb.png) ## [Final word]() One advantage of a coredump over a raw binary is that **relocations** and **dependencies** are already resolved within the coredump. This API can be used in conjunction with other tools. For example, we could use the [Triton]() API: - [AArch64Cpu::setConcreteRegisterValue()]() - [AArch64Cpu::setConcreteMemoryAreaValue()]() to map the coredump into Triton and then use its engines for taint analysis and symbolic execution. References[[1]()] [https://www.gabriel.urdhr.fr/2015/05/29/core-file/]() API - [`lief.parse()`]( "lief.parse") - [`lief.ELF.Note`]( "lief.ELF.Note") - [`lief.ELF.CorePrPsInfo`]( "lief.ELF.CorePrPsInfo") - [`lief.ELF.CorePrStatus`]( "lief.ELF.CorePrStatus") - [`lief.ELF.CoreFile`]( "lief.ELF.CoreFile") - `lief.ELF.CoreFileEntry` - [`lief.ELF.CoreSigInfo`]( "lief.ELF.CoreSigInfo") - [`lief.ELF.CoreAuxv`]( "lief.ELF.CoreAuxv") --- documentID: "e8586e304ce4758986b5865d38eeb79c0a3b3c864919ec66363a2ea95cea74be" docname: "tutorials/13_pe_authenticode" title: "13 - PE Authenticode - LIEF Documentation" description: "13 - PE Authenticode. This tutorial explains how to process and verify PE Authenticode with LIEF." canonical: "https://lief.re/doc/latest/tutorials/13_pe_authenticode.html" markdownURL: "https://lief.re/doc/latest/tutorials/13_pe_authenticode.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "149be128246a0d638f5ad5cc87db98250ba859107dee5a4d1e299ed863735da3" --- # [13 - PE Authenticode]() This tutorial explains how to process and verify PE Authenticode with LIEF. --- ## [Introduction]() PE Authenticode is the signature scheme used by Windows to sign and verify the integrity of PE executables. The signature is associated with the [`CERTIFICATE_TABLE`]( "lief.PE.DataDirectory.TYPES.CERTIFICATE_TABLE") data directory, which is not always tied to a section (implying that the signature is not necessarily mapped into memory). In fact, the data directory entry points to a file offset, not an RVA. This signature is wrapped in a PKCS #7 container with custom object types, as defined in the official documentation [[1]](). Parsing these signatures has been a goal since LIEF’s inception. Before version [v0.11.0](), the implementation was incomplete and sometimes inaccurate. Since version [v0.11.0](), and thanks to sponsorship from the [CERT Gouvernemental of Luxembourg](), we have refactored the Authenticode parser [[2]]() and implemented signature verification functions. ## [Exploring the PKCS #7 Signature]() The LIEF API exposes most internal components of the PKCS #7 container associated with Authenticode. First, we can access the PE signatures through the `lief.PE.Binary.signatures()` ( [`lief::pe::Binary::signatures`]() ; [`lief.PE.Binary.signatures`]() ; [`LIEF::PE::Binary::signatures()`]() ) attribute [[3]](): ```python pe: lief.PE.Binary print(len(pe.signatures)) signature = pe.signatures[0] ``` Although we usually find only **one** signature, PE executables can embed multiple signatures using the `/as` command of `signtool.exe`. This is why the [`signatures`]( "lief.PE.Binary.signatures") attribute returns an **iterator** over the signatures parsed by LIEF. The [`signature`]( "lief.PE.Signature") variable is a `lief.PE.Signature` ( [`lief::pe::Signature`]() ; [`lief.PE.Signature`]() ; [`LIEF::PE::Signature`]() ) object, which mirrors the PKCS #7 container and includes methods for verifying its integrity. Within this object, we can access the following attributes: - [`x509`]( "lief.PE.x509") certificates used to sign the executable: [`lief.PE.Signature.certificates`]( "lief.PE.Signature.certificates") - The [`ContentInfo`]( "lief.PE.ContentInfo") object containing the authentihash: [`lief.PE.ContentInfo.digest`]( "lief.PE.ContentInfo.digest") - The [`SignerInfo`]( "lief.PE.SignerInfo") structures: [`lief.PE.Signature.signers`]( "lief.PE.Signature.signers") > **Note** > > While the PKCS #7 standard supports multiple signers, Microsoft specifications require **exactly one** signer. The `__str__()` methods of these objects are overloaded to facilitate pretty-printing their content: ```python signature: lief.PE.Signature # Print certificate information for crt in signature.certificates: print(crt) # Print the authentihash value embedded in the signature print(signature.content_info.digest.hex()) # Print signer information print(signature.signers[0]) ``` ```text cert. version : 3 serial number : 04:09:18:1B:5F:D5:BB:66:75:53:43:B5:6F:95:50:08 issuer name : C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA subject name : C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA issued on : 2013-10-22 12:00:00 expires on : 2028-10-22 12:00:00 signed using : RSA with SHA-256 RSA key size : 2048 bits basic constraints : CA=true, max_pathlen=0 key usage : Digital Signature, Key Cert Sign, CRL Sign ext key usage : Code Signing cert. version : 3 serial number : 09:70:EF:4B:AD:5C:C4:4A:1C:2B:C3:D9:64:01:67:4C issuer name : C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA subject name : C=CZ, L=Praha, O=Avast Software s.r.o., OU=RE stapler cistodc, CN=Avast Software s.r.o. issued on : 2020-04-02 00:00:00 expires on : 2023-03-09 12:00:00 signed using : RSA with SHA-256 RSA key size : 2048 bits basic constraints : CA=false key usage : Digital Signature ext key usage : Code Signing a738da4446a4e78ab647db7e53427eb07961c994317f4c59d7edbea5cc786d80 SHA_256/RSA - C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA - 4 auth attr - 1 unauth attr ``` For PE files, the authentihash is computed using the [`lief.PE.Binary.authentihash()`]( "lief.PE.Binary.authentihash") function, which takes a [`lief.PE.ALGORITHMS`]( "lief.PE.ALGORITHMS") enum as a parameter to define the hash algorithm. For instance, to compute the SHA-256 authentihash, pass [`lief.PE.ALGORITHMS.SHA_256`]( "lief.PE.ALGORITHMS.SHA_256"): ```python pe: lief.PE.Binary print(pe.authentihash(lief.PE.ALGORITHMS.SHA_256).hex()) ``` ```text a738da4446a4e78ab647db7e53427eb07961c994317f4c59d7edbea5cc786d80 ``` > **Note** > > To compare the [`lief.PE.Binary.authentihash()`]( "lief.PE.Binary.authentihash") value with the signed one (i.e., [`lief.PE.ContentInfo.digest`]( "lief.PE.ContentInfo.digest")), you must use the same hash algorithm as defined by [`lief.PE.Signature.digest_algorithm`]( "lief.PE.Signature.digest_algorithm"). We also provide shortcut attributes in the Python API to compute authentihash values: | Hash Algorithm | Binary Attribute | | --- | --- | | MD5 | [`authentihash_md5`]( "lief.PE.Binary.authentihash_md5") | | SHA1 | [`authentihash_sha1`]( "lief.PE.Binary.authentihash_sha1") | | SHA-256 | [`authentihash_sha256`]( "lief.PE.Binary.authentihash_sha256") | | SHA-512 | [`authentihash_sha512`]( "lief.PE.Binary.authentihash_sha512") | LIEF also exposes the original raw signature blob via the [`lief.PE.Signature.raw_der`]( "lief.PE.Signature.raw_der") property, which allows for exporting the signature: ```python from pathlib import Path signature: lief.PE.Signature Path("/tmp/extracted.p7b").write_bytes(signature.raw_der) ``` Then, you can use `openssl` to process its content: ```text $ openssl pkcs7 -inform der -print -in /tmp/extracted.p7b -noout -text ... sig_alg: algorithm: sha256WithRSAEncryption (1.2.840.113549.1.1.11) parameter: NULL signature: (0 unused bits) 0000 - 31 c3 a7 f3 70 e3 2c 49-15 bd f4 09 6c 27 4e 1...p.,I....l'N 000f - 00 a9 23 df cb ea 7f 99-55 cb 24 88 75 e8 c4 ..#.....U.$.u.. 001e - de 48 4f 70 dd 2a 27 5c-df be 36 f6 84 0d ad .HOp.*'\..6.... 002d - 35 5e 65 f7 af 55 01 7a-2d 01 18 a0 d6 98 a4 5^e..U.z-...... 003c - d1 bd 19 e9 a4 03 f4 a3-4d 12 6e 72 5f 6b 3a ........M.nr_k: 004b - b8 de 45 f1 63 80 b0 47-42 f6 38 b8 e7 5b dd ..E.c..GB.8..[. 005a - cf f2 f8 c2 61 4b 2c 19-b7 7d 78 8f 2e 0c b0 ....aK,..}x.... 0069 - 7c f2 d9 8e 9f 65 4e 21-63 19 6a 5b 0c 91 12 |....eN!c.j[... 0078 - 44 29 fe 91 d5 6f 5d 9c-4d 7b a1 74 c6 69 d9 D)...o].M{.t.i. 0087 - e7 23 26 54 35 5c 38 33-c5 a7 92 0d 70 a5 2a .#&T5\83....p.* 0096 - 33 77 4a fc 86 b0 fa 59-2f 24 f6 a1 45 b2 09 3wJ....Y/$..E.. 00a5 - 75 2d a1 81 68 e4 67 11-46 e3 fb bf 0c c5 d5 u-..h.g.F...... 00b4 - d7 7b 7b 35 fb d6 e8 4a-c9 13 82 82 a7 0c 3e .{{5...J......> 00c3 - 6f 61 e0 37 15 e0 37 5d-b8 22 14 ad 54 58 0e oa.7..7]."..TX. 00d2 - 95 6c 2b b1 d2 c7 6c 86-a1 9f fa d8 37 ca f7 .l+...l.....7.. 00e1 - 56 75 b0 9d df 7c 46 43-20 87 8a a3 81 47 82 Vu...|FC ....G. 00f0 - 99 57 87 12 46 96 02 7c-a7 77 b9 42 4d c8 05 .W..F..|.w.BM.. 00ff - 0a . crl: signer_info: version: 1 issuer_and_serial: issuer: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA serial: 12549442701880659695003200114191853388 digest_alg: algorithm: sha256 (2.16.840.1.101.3.4.2.1) parameter: NULL auth_attr: object: contentType (1.2.840.113549.1.9.3) set: OBJECT:undefined (1.3.6.1.4.1.311.2.1.4) object: undefined (1.3.6.1.4.1.311.2.1.11) ``` The [pe\_authenticode\_reader.py]() script in the [examples/]() directory can also be used to inspect the signature: ```console $ python pe_authenticode_reader.py --all avast_free_antivirus_setup_online.exe ``` ```text Signature version : 1 Digest Algorithm : ALGORITHMS.SHA_256 Content Info: Content Type : 1.3.6.1.4.1.311.2.1.4 (SPC_INDIRECT_DATA_CONTENT) Digest Algorithm: ALGORITHMS.SHA_256 Digest : a738da4446a4e78ab647db7e53427eb07961c994317f4c59d7edbea5cc786d80 Certificates Version : 3 Issuer : C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA Subject : C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA Serial Number : 0409181b5fd5bb66755343b56f955008 Signature Algorithm: SHA256_WITH_RSA_ENCRYPTION Valid from : 2013/10/22 - 12:00:00 Valid to : 2028/10/22 - 12:00:00 Key usage : CRL_SIGN - KEY_CERT_SIGN - DIGITAL_SIGNATURE Ext key usage : CODE_SIGNING RSA key size : 2048 =========================================== Version : 3 Issuer : C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA Subject : C=CZ, L=Praha, O=Avast Software s.r.o., OU=RE stapler cistodc, CN=Avast Software s.r.o. Serial Number : 0970ef4bad5cc44a1c2bc3d96401674c Signature Algorithm: SHA256_WITH_RSA_ENCRYPTION Valid from : 2020/04/02 - 00:00:00 Valid to : 2023/03/09 - 12:00:00 Key usage : DIGITAL_SIGNATURE Ext key usage : CODE_SIGNING RSA key size : 2048 =========================================== Signer(s) Version : 1 Serial Number : 0970ef4bad5cc44a1c2bc3d96401674c Issuer : C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA Digest Algorithm : ALGORITHMS.SHA_256 Encryption Algorithm: ALGORITHMS.RSA Encrypted Digest : 758db1f480eb25bada6c ... Authenticated attributes: Content Type OID: 1.3.6.1.4.1.311.2.1.4 (SPC_INDIRECT_DATA_CONTENT) MS Statement type OID: 1.3.6.1.4.1.311.2.1.21 (INDIVIDUAL_CODE_SIGNING) Info: http://www.avast.com PKCS9 Message Digest: 3983816a7d1c62962540ec66fa8790fa45d1063cb23e933677de459f0b73c577 Un-authenticated attributes: Generic Type 1.3.6.1.4.1.311.3.3.1 (MS_COUNTER_SIGN) ``` ## [Verifying the Signature]() In addition to parsing Authenticode signatures, LIEF can also verify the integrity of the authentihash using the `lief.PE.Binary.verify_signature()` ( [`lief::pe::Binary::verify_signature`]() ; [`lief.PE.Binary.verify_signature()`]() ; [`LIEF::PE::Binary::verify_signature()`]() ) method. This method returns [`lief.PE.Signature.VERIFICATION_FLAGS.OK`]( "lief.PE.Signature.VERIFICATION_FLAGS.OK") if the signature is valid, or another enum value if it is invalid (see: [`lief.PE.Signature.VERIFICATION_FLAGS`]( "lief.PE.Signature.VERIFICATION_FLAGS")): ```python pe: lief.PE.Binary print(pe.verify_signature()) # lief.PE.Signature.VERIFICATION_FLAGS.OK ``` You can also verify a PE binary with a **detached signature** by providing a [`signature`]( "lief.PE.Signature") object to [`verify_signature()`]( "lief.PE.Binary.verify_signature"): ```python pe: lief.PE.Binary detached_sig = lief.PE.Signature.parse("/tmp/detached.p7b") assert isinstance(detached_sig, lief.PE.Signature) print(pe.verify_signature(detached_sig)) ``` The verification process does not rely on external components (i.e., neither OpenSSL nor the WinTrust API). Instead, we attempt to reproduce the same checks described in the RFCs and official Authenticode documentation [[4]](). These checks include: 1. Verifying the integrity of the signature ([`lief.PE.Signature.check()`]( "lief.PE.Signature.check")): 1. Ensuring there is exactly one [`SignerInfo`]( "lief.PE.SignerInfo") structure. 2. Confirming that digest algorithms are consistent ([`Signature.digest_algorithm`]( "lief.PE.Signature.digest_algorithm") `==` [`ContentInfo.digest_algorithm`]( "lief.PE.ContentInfo.digest_algorithm") `==` [`SignerInfo.digest_algorithm`]( "lief.PE.SignerInfo.digest_algorithm")). 3. If [`SignerInfo`]( "lief.PE.SignerInfo") has authenticated attributes, verifying their integrity. Otherwise, verifying the integrity of the [`ContentInfo`]( "lief.PE.ContentInfo") against the signer’s certificate. 4. If authenticated attributes exist, confirming the presence of a [`lief.PE.PKCS9MessageDigest`]( "lief.PE.PKCS9MessageDigest") attribute whose [`digest`]( "lief.PE.PKCS9MessageDigest.digest") matches the hash of the [`ContentInfo`]( "lief.PE.ContentInfo"). 5. If a countersignature exists in the **unauthenticated attributes**, verifying its integrity and ensuring it includes a valid *timestamp*. 6. Checking certificate expiration relative to any *timestamp*. 2. If the signature is valid, confirming that [`lief.PE.ContentInfo.digest`]( "lief.PE.ContentInfo.digest") matches the computed [`authentihash()`]( "lief.PE.Binary.authentihash"). These checks represent the default behavior of [`verify_signature()`]( "lief.PE.Binary.verify_signature"). You can, however, pass [`lief.PE.Signature.VERIFICATION_CHECKS`]( "lief.PE.Signature.VERIFICATION_CHECKS") flags to customize this behavior: **Hash Only:** Using [`VERIFICATION_CHECKS.HASH_ONLY`]( "lief.PE.Signature.VERIFICATION_CHECKS.HASH_ONLY") only performs step `B)` (i.e., checks the authentihash values regardless of signature integrity). ```python pe: lief.PE.Binary pe.verify_signature(lief.PE.Signature.VERIFICATION_CHECKS.HASH_ONLY) ``` **Lifetime Signing:** Using [`VERIFICATION_CHECKS.LIFETIME_SIGNING`]( "lief.PE.Signature.VERIFICATION_CHECKS.LIFETIME_SIGNING") allows timestamped signatures to expire if their certificate has expired. This corresponds to [WTD\_LIFETIME\_SIGNING\_FLAG](). ```python pe: lief.PE.Binary signature: lief.PE.Signature pe.verify_signature(lief.PE.Signature.VERIFICATION_CHECKS.LIFETIME_SIGNING) signature.check(lief.PE.Signature.VERIFICATION_CHECKS.LIFETIME_SIGNING) ``` **Skip Certificate Time Check:** Using [`VERIFICATION_CHECKS.SKIP_CERT_TIME`]( "lief.PE.Signature.VERIFICATION_CHECKS.SKIP_CERT_TIME") prevents LIEF from raising an error if certificates have expired. ```python pe: lief.PE.Binary signature: lief.PE.Signature # Returns lief.PE.Signature.VERIFICATION_FLAGS.OK even if # the certificates have expired pe.verify_signature(lief.PE.Signature.VERIFICATION_CHECKS.SKIP_CERT_TIME) signature.check(lief.PE.Signature.VERIFICATION_CHECKS.SKIP_CERT_TIME) ``` > **Note** > > To verify the integrity of a [`Signature`]( "lief.PE.Signature") object, you can use `lief.PE.Signature.check()` ( [`lief::pe::Signature::check`]() ; [`lief.PE.Signature.check()`]() ; [`LIEF::PE::Signature::check()`]() ). ## [Certificate Chain of Trust]() Finally, the certificate chain can be verified using: 1. [`lief.PE.x509.verify()`]( "lief.PE.x509.verify") 2. [`lief.PE.x509.is_trusted_by()`]( "lief.PE.x509.is_trusted_by") [`verify()`]( "lief.PE.x509.verify") is used to verify a signed certificate against its CA. Given a CA [`x509`]( "lief.PE.x509") certificate, `CA.verify(signed)` confirms that the `signed` parameter was indeed signed by `CA`. Alternatively, [`is_trusted_by()`]( "lief.PE.x509.is_trusted_by") checks whether a given [`x509`]( "lief.PE.x509") certificate can be verified against a **list of certificates**: ```python signature: lief.PE.Signature CA_BUNDLE = lief.PE.x509.parse("ms_bundle.pem") signer = signature.signers[0] print(signer.cert.is_trusted_by(CA_BUNDLE)) ``` ```python signer: lief.PE.SignerInfo cert1 = lief.PE.x509.parse("ca1.crt")[0] cert2 = lief.PE.x509.parse("ca2.crt")[0] print(signer.cert.is_trusted_by([cert1, cert2])) ``` ## [Limitations]() Regarding the PKCS #7 structure, LIEF can parse and process most of its elements. However, the [`lief.PE.SignerInfo`]( "lief.PE.SignerInfo") structure can embed attributes (authenticated or otherwise) whose ASN.1 structure may or may not be public. As of LIEF v0.11.0, the following OIDs are not yet supported: | OID | Description | | --- | --- | | 1.3.6.1.4.1.311.3.3.1 | Ms-CounterSign (undocumented, supported in LIEF 0.15.0) | | 1.2.840.113549.1.9.16.2.12 | S/MIME Signing certificate (id-aa-signingCertificate) | | 1.3.6.1.4.1.311.2.6.1 | SPC\_COMMERCIAL\_SP\_KEY\_PURPOSE\_OBJID | | 1.3.6.1.4.1.311.10.3.28 | szOID\_PLATFORM\_MANIFEST\_BINARY\_ID (supported in LIEF 0.15.0) | These unsupported attributes are wrapped in the [`lief.PE.GenericType`]( "lief.PE.GenericType"), which exposes the raw ASN.1 blob via the [`raw_content`]( "lief.PE.GenericType.raw_content") property. ## [Conclusion]() Under the hood, most of the work is performed by [mbedtls](), which provides the following primitives used by LIEF: - ASN.1 decoder - x509 certificate processing (parsing AND verification) - Hash algorithms - Public key algorithms A small C++ snippet can also be cross-compiled for iOS: ```cpp #include int main(int argc, char** argv) { std::unique_ptr pe = LIEF::PE::Parser::parse(argv[1]); if (pe->verify_signature() == LIEF::PE::Signature::VERIFICATION_FLAGS::OK) { std::cout << "Signature ok!" << "\n"; return 0; } std::cout << "Error!" << "\n"; return 1; } ``` This allows for verifying the integrity of a PE executable on an iPhone: ```console iPhone:~ root# file PE32_x86-64_binary_avast-free-antivirus-setup-online.exe PE32_x86-64_binary_avast-free-antivirus-setup-online.exe: PE32 executable (GUI) Intel 80386, for MS Windows iPhone:~ root# file ./pe_authenticode_check ./pe_authenticode_check: Mach-O 64-bit arm64 executable, flags: iPhone:~ root# ./pe_authenticode_check PE32_x86-64_binary_avast-free-antivirus-setup-online.exe Signature ok! iPhone:~ root# ``` While this example may seem niche, it highlights the project’s purpose: - Providing a cross-platform and cross-format library. - Exposing both a high-level API (Python) and a low-level API (C++). - Minimizing dependencies so that the static version of LIEF does not require external libraries [[5]](). ```console $ otool -L pe_authenticode_check /System/Library/Frameworks/Foundation.framework/Foundation (compatibility version 300.0.0, current version 1770.255.0) /usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0) /usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 904.4.0) /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1292.60.1) ``` In addition to LIEF, you may be interested in other projects that handle Authenticode: | Project | URL | | --- | --- | | signify | [https://github.com/ralphje/signify]() | | winsign | [https://github.com/mozilla-releng/winsign]() | | uthenticode | [https://github.com/trailofbits/uthenticode]() | | AuthenticodeLint | [https://github.com/vcsjones/AuthenticodeLint]() | | osslsigncode | [https://github.com/mtrojnar/osslsigncode]() | | yara-x | [https://github.com/VirusTotal/yara-x]() (which has support for PE Authenticode) | Finally, additional information about Authenticode can be found in the Trail of Bits blog post [[6]](). For Authenticode techniques used by Dropbox, refer to the Microsoft website [[7]](). If you are interested in how PKCS #7 integrity works, refer to *Manually verify PKCS#7 signed data with OpenSSL* [[8]](). References[[1]()] [http://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/Authenticode\_PE.docx]() [[2]()] Which is now exception-free. [[3]()] This tutorial uses the Python API, but the C++ API is very similar. [[4]()] See [src/PE/signature/Signature.cpp - check()]() for the implementation. [[5]()] Except for the C/C++ STL. [[6]()] [https://blog.trailofbits.com/2020/05/27/verifying-windows-binaries-without-windows/]() [[7]()] [https://docs.microsoft.com/en-us/archive/blogs/ieinternals/caveats-for-authenticode-code-signing]() [[8]()] [http://qistoph.blogspot.com/2012/01/manual-verify-pkcs7-signed-data-with.html]() API - `lief.PE.Binary.verify_signature()` ( [`lief::pe::Binary::verify_signature`]() ; [`lief.PE.Binary.verify_signature()`]() ; [`LIEF::PE::Binary::verify_signature()`]() ) - [`lief.PE.Binary.authentihash()`]( "lief.PE.Binary.authentihash") - [`lief.PE.Binary.authentihash_md5`]( "lief.PE.Binary.authentihash_md5") - [`lief.PE.Binary.authentihash_sha1`]( "lief.PE.Binary.authentihash_sha1") - [`lief.PE.Binary.authentihash_sha256`]( "lief.PE.Binary.authentihash_sha256") - [`lief.PE.Binary.authentihash_sha512`]( "lief.PE.Binary.authentihash_sha512") - `lief.PE.Binary.signatures()` ( [`lief::pe::Binary::signatures`]() ; [`lief.PE.Binary.signatures`]() ; [`LIEF::PE::Binary::signatures()`]() ) - `lief.PE.Signature` ( [`lief::pe::Signature`]() ; [`lief.PE.Signature`]() ; [`LIEF::PE::Signature`]() ) - [`lief.PE.x509`]( "lief.PE.x509") - [`lief.PE.ContentInfo`]( "lief.PE.ContentInfo") - [`lief.PE.SignerInfo`]( "lief.PE.SignerInfo") - [`lief.PE.Attribute`]( "lief.PE.Attribute") - [`lief.PE.ContentType`]( "lief.PE.ContentType") - [`lief.PE.GenericType`]( "lief.PE.GenericType") - [`lief.PE.MsSpcNestedSignature`]( "lief.PE.MsSpcNestedSignature") - [`lief.PE.MsSpcStatementType`]( "lief.PE.MsSpcStatementType") - [`lief.PE.PKCS9AtSequenceNumber`]( "lief.PE.PKCS9AtSequenceNumber") - [`lief.PE.PKCS9CounterSignature`]( "lief.PE.PKCS9CounterSignature") - [`lief.PE.PKCS9MessageDigest`]( "lief.PE.PKCS9MessageDigest") - [`lief.PE.PKCS9SigningTime`]( "lief.PE.PKCS9SigningTime") - [`lief.PE.SpcSpOpusInfo`]( "lief.PE.SpcSpOpusInfo")