01 - Parse and manipulate formats

The objective of this tutorial is to provide an overview of LIEF’s API for parsing and manipulating formats.

---

ELF

We’ll start with the ELF format. To create an ELF.Binary from a file, simply pass its path to the

lief.abstract.parse

lief.parse() LIEF::Parser::parse()

or

lief.ELF.parse()

lief::elf::Binary::parse lief.ELF.parse() LIEF::ELF::Parser::parse()

functions.

Note

With the Python API, these functions exhibit the same behavior, but in C++,

lief.abstract.parse

lief.parse() LIEF::Parser::parse()

will return a pointer to a

lief.abstract.Binary

lief::generic::Binary lief.Binary LIEF::Binary

object, whereas

lief.ELF.parse()

lief::elf::Binary::parse lief.ELF.parse() LIEF::ELF::Parser::parse()

will return a

lief.ELF.Binary

lief::elf::Binary lief.ELF.Binary LIEF::ELF::Binary

object.

import lief
binary = lief.parse("/bin/ls")

Once the ELF file has been parsed, we can access its Header:

binary: lief.ELF.Binary

header = binary.header

To change the entry point and the target architecture (ARCH):

header: lief.ELF.Header

header.entrypoint = 0x123
header.machine_type = lief.ELF.ARCH.AARCH64

Then, write these changes to a new ELF binary:

binary: lief.ELF.Binary

binary.write("ls.modified")

We can also iterate over the Section entries as follows:

binary: lief.ELF.Binary

for section in binary.sections:
    print(section.name)  # section name
    print(section.size)  # section size
    print(len(section.content))  # Should match the previous print

To modify the content of the .text section:

binary: lief.ELF.Binary

text = binary.get_section(".text")
assert text is not None
text.content = bytes([0x33] * text.size)

PE

As with the ELF section, you can use the

lief.abstract.parse

lief.parse() LIEF::Parser::parse()

or

lief.PE.parse()

lief::pe::Binary::parse lief.PE.parse() LIEF::PE::Parser::parse()

functions to create a PE.Binary

import lief
binary = lief.parse("C:\\Windows\\explorer.exe")

To access the various PE headers (DosHeader, Header, and OptionalHeader):

binary: lief.PE.Binary

print(binary.dos_header)
print(binary.header)
print(binary.optional_header)

You can also access imported functions in two ways:

1. Using the abstract layer

2. Using the PE definition

# Using the abstract layer
binary: lief.PE.Binary

for func in binary.imported_functions:
    print(func)

# Using the PE definition
for func in binary.imports:
    print(func)

For finer granularity regarding the location of imported functions in libraries, or to access other fields of the PE imports, we can process the imports as follows:

binary: lief.PE.Binary

for imported_library in binary.imports:
    print("Library name: " + imported_library.name)
    for func in imported_library.entries:
        if not func.is_ordinal:
            print(func.name)
        print(func.iat_address)