Python¶

Bases: Object

File format abstract representation.

This object represents the abstraction of an executable file format. It enables to access common features (like the entrypoint) regardless of the concrete format (e.g. lief.ELF.Binary.entrypoint)

class FORMATS(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Enum

ELF = 1¶

MACHO = 3¶

OAT = 4¶

PE = 2¶

UNKNOWN = 0¶

class VA_TYPES(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Enum

AUTO = 0¶

RVA = 1¶

VA = 2¶

property abstract → lief.Binary¶

Return the abstract representation of the current binary (lief.Binary)

assemble(self, address: int, assembly: str) → bytes¶

Assemble and patch the provided assembly code at the specified address.

The function returns the generated assembly bytes.

Example:

bin.assemble(0x12000440, """
xor rax, rbx;
mov rcx, rax;
""")

property concrete → lief.ELF.Binary | lief.PE.Binary | lief.MachO.Binary¶

The concrete representation of the binary. Basically, this property cast a lief.Binary into a lief.PE.Binary, lief.ELF.Binary or lief.MachO.Binary.

See also: lief.Binary.abstract

property ctor_functions → list[lief.Function]¶

Constructor functions that are called prior to any other functions

property debug_info → lief.DebugInfo¶

Return debug info if present. It can be either a lief.dwarf.DebugInfo or a lief.pdb.DebugInfo

For ELF and Mach-O binaries, it returns the given DebugInfo object only if the binary embeds the DWARF debug info in the binary itself.

For PE file, this function tries to find the external PDB using the lief.PE.CodeViewPDB.filename output (if present). One can also use lief.pdb.load() to manually load a PDB.

Warning

This function requires LIEF’s extended version otherwise it always return None

disassemble(*args) → Iterator[lief.assembly.Instruction | None]¶

Overloaded function.

1. disassemble(self, address: int) -> Iterator[Optional[lief._lief.assembly.Instruction]]

   Disassemble code starting a the given virtual address.

   insts = binary.disassemble(0xacde, 100);
   for inst in insts:
       print(inst)
   

   See also

   lief.assembly.Instruction

2. disassemble(self, address: int, size: int) -> Iterator[Optional[lief._lief.assembly.Instruction]]

   Disassemble code starting a the given virtual address and with the given size.

   insts = binary.disassemble(0xacde, 100);
   for inst in insts:
       print(inst)
   

   See also

   lief.assembly.Instruction

3. disassemble(self, function_name: str) -> Iterator[Optional[lief._lief.assembly.Instruction]]

   Disassemble code for the given symbol name

   insts = binary.disassemble("__libc_start_main");
   for inst in insts:
       print(inst)
   

   See also

   lief.assembly.Instruction

disassemble_from_bytes(self, buffer: bytes, address: int) → Iterator[lief.assembly.Instruction | None]¶

Disassemble code from the provided bytes

raw = bytes(binary.get_section(".text").content)
insts = binary.disassemble_from_bytes(raw);
for inst in insts:
    print(inst)

See also

lief.assembly.Instruction

property entrypoint → int¶

Binary’s entrypoint

property exported_functions → list[lief.Function]¶

Return the binary’s exported Function

property format → lief.Binary.FORMATS¶

File format (FORMATS) of the underlying binary.

get_content_from_virtual_address(self, virtual_address: int, size: int, va_type: lief.Binary.VA_TYPES) → memoryview¶

Return the content located at the provided virtual address. The virtual address is specified in the first argument and size to read (in bytes) in the second.

If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default, it is set to AUTO.

get_function_address(self, function_name: str) → int | lief.lief_errors¶

Return the address of the given function name

get_int_from_virtual_address(self, address: int, interger_size: int, type: lief.Binary.VA_TYPES) → int | None¶

Get an integer representation of the data at the given address

get_symbol(self, symbol_name: str) → lief.Symbol¶

Return the Symbol from the given name.

If the symbol can’t be found, it returns None.

property has_nx → bool¶

Check if the binary has NX protection (non executable stack)

has_symbol(self, symbol_name: str) → bool¶

Check if a Symbol with the given name exists

property header → lief.Header¶

Binary’s abstract header (Header)

property imagebase → int¶

Default image base (i.e. if the ASLR is not enabled)

property imported_functions → list[lief.Function]¶

Return the binary’s imported Function (name)

property is_pie → bool¶

Check if the binary is position independent

class it_relocations¶

Bases: object

Iterator over lief._lief.Relocation

class it_sections¶

Bases: object

Iterator over lief._lief.Section

class it_symbols¶

Bases: object

Iterator over lief._lief.Symbol

property libraries → list[str | bytes]¶

Return binary’s imported libraries (name)

offset_to_virtual_address(self, offset: int, slide: int) → int | lief.lief_errors¶

Convert an offset into a virtual address.

property original_size → int¶

Original size of the binary

patch_address(*args) → None¶

Overloaded function.

1. patch_address(self, address: int, patch_value: collections.abc.Sequence[int], va_type: lief._lief.Binary.VA_TYPES = VA_TYPES.AUTO) -> None

   Patch the address with the given list of bytes. The virtual address is specified in the first argument and the content in the second (as a list of bytes).

   If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default, it is set to AUTO.

2. patch_address(self, address: int, patch_value: int, size: int = 8, va_type: lief._lief.Binary.VA_TYPES = VA_TYPES.AUTO) -> None

   Patch the address with the given integer value. The virtual address is specified in the first argument, the integer in the second and the integer’s size of in third one.

   If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default, it is set to AUTO.

property relocations → lief.Binary.it_relocations¶

Return an iterator over abstract Relocation

remove_section(self, name: str, clear: bool) → None¶

Remove the section with the given name

property sections → lief.Binary.it_sections¶

Return an iterator over the binary’s abstract sections (Section)

property symbols → lief.Binary.it_symbols¶

Return an iterator over the binary’s abstract Symbol

xref(self, virtual_address: int) → list[int]¶

Return all virtual addresses that use the address given in parameter

Bases: Object

Class which represents an abstracted Header

class ARCHITECTURES(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Enum

ARM = 1¶

ARM64 = 2¶

LOONGARCH = 11¶

MIPS = 3¶

PPC = 6¶

RISCV = 10¶

SPARC = 7¶

SYSZ = 8¶

UNKNOWN = 0¶

X86 = 4¶

X86_64 = 5¶

XCORE = 9¶

from_value(arg: int) → lief.Header.ARCHITECTURES = <nanobind.nb_func object>¶

class ENDIANNESS(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Enum

BIG = 1¶

LITTLE = 2¶

UNKNOWN = 0¶

from_value(arg: int) → lief.Header.ENDIANNESS = <nanobind.nb_func object>¶

class MODES(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Enum

ARM64E = 16¶

BITS_16 = 1¶

BITS_32 = 2¶

BITS_64 = 4¶

NONE = 0¶

THUMB = 8¶

from_value(arg: int) → lief.Header.MODES = <nanobind.nb_func object>¶

class OBJECT_TYPES(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Enum

EXECUTABLE = 1¶

LIBRARY = 2¶

OBJECT = 3¶

UNKNOWN = 0¶

from_value(arg: int) → lief.Header.OBJECT_TYPES = <nanobind.nb_func object>¶

property architecture → lief.Header.ARCHITECTURES¶

Target architecture

property endianness → lief.Header.ENDIANNESS¶

Binary endianness

property entrypoint → int¶

Binary entrypoint

property is_32 → bool¶

True if the binary targets a 32-bits architecture

property is_64 → bool¶

True if the binary targets a 64-bits architecture

property modes → lief.Header.MODES¶

Architecture details

property modes_list → list[lief.Header.MODES]¶

Modes as a list

property object_type → lief.Header.OBJECT_TYPES¶

Type of the binary (executable, library…)

Bases: Object

Class which represents an abstracted section

property content → memoryview¶

Section’s content

property entropy → float¶

Section’s entropy

property fullname → bytes¶

Return the fullname of the section including the trailing bytes

property name → str | bytes¶

Section’s name

property offset → int¶

Section’s file offset

search(*args) → int | None¶

Overloaded function.

1. search(self, number: int, pos: int = 0, size: int = 0) -> Optional[int]

Look for integer within the current section

2. search(self, str: str, pos: int = 0) -> Optional[int]

Look for string within the current section

3. search(self, bytes: bytes, pos: int = 0) -> Optional[int]

Look for the given bytes within the current section

search_all(*args) → list[int]¶

Overloaded function.

1. search_all(self, number: int, size: int = 0) -> list[int]

Look for all integers within the current section

2. search_all(self, str: str) -> list[int]

Look for all strings within the current section

property size → int¶

Section’s size

property virtual_address → int¶

Section’s virtual address

Bases: Object

This class represents a symbol in an executable format.

property name → str | bytes¶

Symbol’s name

property size → int¶

Symbol’s size

property value → int¶

Symbol’s value

Bases: Object

Class which represents an abstracted Relocation

property address → int¶

Relocation’s address

property size → int¶

Relocation’s size (in bits)

Bases: Symbol

Class which represents a Function in an executable file format.

class FLAGS(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Flag

CONSTRUCTOR = 1¶

DEBUG_INFO = 4¶

DESTRUCTOR = 2¶

EXPORTED = 8¶

IMPORTED = 16¶

NONE = 0¶

from_value(arg: int) → lief.Function.FLAGS = <nanobind.nb_func object>¶

add(self, flag: lief.Function.FLAGS) → lief.Function¶

Add the given FLAGS

property address → int¶

Function’s address

property flags → lief.Function.FLAGS¶

Function flags

property flags_list → list[lief.Function.FLAGS]¶

Function flags as a list of FLAGS

has(self, flag: lief.Function.FLAGS) → bool¶

Check if the function has the given flag