BinaryNinja¶

Similarly to the Ghidra plugin, LIEF can be used as a BinaryNinja plugin.

Plugins

BinaryNinja - DWARF Plugin

Downloads

First, download the LIEF plugin package from here https://lief.s3.fr-par.scw.cloud/latest/plugins/index.html or from the packages listed above. Then, follow the official procedure to install plugins: https://docs.binary.ninja/guide/plugins.html

For instance, if you install the DWARF Plugin, you should have this file installed:

Linux: ~/.binaryninja/plugins/lief-dwarf-plugin-linux-x86_64.so
Windows: C:\Users\romain\AppData\Roaming\Binary Ninja\plugins\lief-dwarf-plugin-windows-x86_64.dll
macOS: ~/Library/Application Support/Binary Ninja/plugins/lief-dwarf-plugin-darwin-arm64.dylib

Shared Library

In addition to the previously installed library, the plugins require to install LIEF.dll, libLIEF.dylib, or libLIEF.so next to the plugin directory. You can download this library from the following list:

SDK

or from here: https://lief.s3.fr-par.scw.cloud/latest/sdk/index.html. Some plugins (like: DWARF Plugin) need the extended version that can be downloaded from https://extended.lief.re/.

Given this shared library, you must copy it in the plugin directory (or its parent for Linux and macOS).

macOS:
- ~/Library/Application Support/Binary Ninja/plugins/libLIEF.dylib
- ~/Library/Application Support/Binary Ninja/libLIEF.dylib
Linux:
- ~/.binaryninja/plugins/libLIEF.so
- ~/.binaryninja/libLIEF.so
Windows:
- C:\Users\romain\AppData\Roaming\Binary Ninja\plugins\LIEF.dll
- %APPDATA%\Binary Ninja\plugins\LIEF.dll

Troubleshooting¶

Plugin module failed to load

[:0 Default] Plugin module '~/.binaryninja/plugins/lief-dwarf-plugin-linux-x86_64.so' failed to load
[:0 Default] dlerror() reports: libLIEF.so: cannot open shared object file: No such file or directory

This means that libLIEF.so, libLIEF.dylib, or LIEF.dll is not correctly installed in the plugins/ directory. Make sure that the LIEF shared library is next to the plugin that failed to load.

This feature requires LIEF extended

This error means that you need to install the extended version of the shared library. See the extended section for more information.

libLIEF.dylib can’t be opened because Apple cannot check it for malicious software

libLIEF.dylib is self-signed and does not use an Apple certificate so it’s considered as coming from an unknown developer.

You can address this issue in different ways:

You can compile libLIEF.dylib by yourself and sign the compiled library with your certificate.
You can add a security exception as described here: https://support.apple.com/guide/mac-help/apple-cant-check-app-for-malicious-software-mchleab3a043/mac