
Similar to the Ghidra plugin, LIEF can be used as a BinaryNinja plugin.
Features
Downloads
First, download the LIEF plugin package from https://lief.s3.fr-par.scw.cloud/latest/plugins/index.html or from the packages listed above. Then, follow the official procedure to install plugins: https://docs.binary.ninja/guide/plugins.html
For instance, if you install the DWARF Plugin, you should have this file installed:
Linux: ~/.binaryninja/plugins/lief-dwarf-plugin-linux-x86_64.so
Windows: C:\Users\romain\AppData\Roaming\Binary Ninja\plugins\lief-dwarf-plugin-windows-x86_64.dll
macOS: ~/Library/Application Support/Binary Ninja/plugins/lief-dwarf-plugin-darwin-arm64.dylib
Shared Library
In addition to the previously installed library, the plugins require the installation of LIEF.dll, libLIEF.dylib, or libLIEF.so next to the plugin directory. You can download this library from the following list:
SDK
or from here: https://lief.s3.fr-par.scw.cloud/latest/sdk/index.html. Some plugins (like the DWARF Plugin) require the extended version, which can be downloaded from https://extended.lief.re/.
Given this shared library, you must copy it into the plugin directory (or its parent for Linux and macOS).
macOS:
~/Library/Application Support/Binary Ninja/plugins/libLIEF.dylib
~/Library/Application Support/Binary Ninja/libLIEF.dylib
Linux:
~/.binaryninja/plugins/libLIEF.so
~/.binaryninja/libLIEF.so
Windows:
C:\Users\romain\AppData\Roaming\Binary Ninja\plugins\LIEF.dll
%APPDATA%\Binary Ninja\plugins\LIEF.dll
Plugin module failed to load
[:0 Default] Plugin module '~/.binaryninja/plugins/lief-dwarf-plugin-linux-x86_64.so' failed to load
[:0 Default] dlerror() reports: libLIEF.so: cannot open shared object file: No such file or directory
This means that libLIEF.so, libLIEF.dylib, or LIEF.dll is not correctly installed in the plugins/ directory. Make sure that the LIEF shared library is next to the plugin that failed to load.
This feature requires LIEF extended
This error means that you need to install the extended version of the shared library. See the extended section for more information.
libLIEF.dylib can’t be opened because Apple cannot check it for malicious software
libLIEF.dylib is self-signed and does not use an Apple certificate; therefore, it is considered as coming from an unknown developer.
You can address this issue in different ways:
You can compile libLIEF.dylib yourself and sign the compiled library with your certificate.
You can add a security exception as described here: https://support.apple.com/guide/mac-help/apple-cant-check-app-for-malicious-software-mchleab3a043/mac
