Python¶

Bases: DebugInfo

This class provides an interface for PDB files.

One can instantiate this class using lief.pdb.load() or lief.pdb.DebugInfo.from_file()

property age → int¶

The number of times the PDB file has been written.

property compilation_units → Iterator[lief.pdb.CompilationUnit | None]¶

Iterator over the CompilationUnit from the PDB’s DBI stream. CompilationUnit are also named “Module” in the PDB’s official documentation

find_public_symbol(self, name: str) → lief._lief.pdb.PublicSymbol | None¶

Try to find the PublicSymbol from the given name (based on the public symbol stream) The function returns None if the symbol can’t be found.

debug_info: lief.pdb.DebugInfo = ...
if sym := debug_info.find_public_symbol("MiSyncSystemPdes"):
    print("found")

find_type(self, name: str) → lief._lief.pdb.Type | None¶

find_type(self, index: int) → lief._lief.pdb.Type | None

Overloaded function.

1. find_type(self, name: str) -> Optional[lief._lief.pdb.Type]

Find the type with the given name

2. find_type(self, index: int) -> Optional[lief._lief.pdb.Type]

Find type at the given index

from_file(filepath: str | os.PathLike) → lief.pdb.DebugInfo | None = <nanobind.nb_func object>¶

property guid → str¶

Unique identifier of the PDB file.

property public_symbols → Iterator[lief.pdb.PublicSymbol | None]¶

Return an iterator over the public symbol stream.

property types → Iterator[lief.pdb.Type | None]¶

Return an iterator over the different types registered in this PDB file

Bases: object

This class represents a Compilation Unit (or Module) in a PDB file

property build_metadata → lief.pdb.BuildMetadata | None¶

property functions → Iterator[lief.pdb.Function | None]¶

Return an iterator over the functions defined in this compilation unit. If the PDB does not contain or has an empty DBI stream, it returns an empty iterator.

property module_name → str¶

Name (or path) to the COFF object (.obj) associated with this compilation unit (e.g. e:\obj.amd64fre\minkernel\ntos\hvl\mp\objfre\amd64\hvlp.obj)

property object_filename → str¶

Name of path to the original binary object (COFF, Archive) in which the compilation unit was located before being linked. e.g. e:\obj.amd64fre\minkernel\ntos\hvl\mp\objfre\amd64\hvl.lib

property sources → Iterator[str]¶

Iterator over the sources files that compose this compilation unit. These files include headers (.h, .hpp, …).

to_decl(self, opt: lief._lief.DeclOpt | None = None) → str¶

Generates a C/C++ definition for the functions defined in this compilation unit

Bases: object

This class wraps build metadata represented by the codeview symbols: S_COMPILE3, S_COMPILE2, S_BUILDINFO

class CPU(*values)¶

Bases: Enum

ALPHA = 48¶

ALPHA_21164 = 49¶

ALPHA_21164A = 50¶

ALPHA_21264 = 51¶

ALPHA_21364 = 52¶

AM33 = 160¶

ARM3 = 96¶

ARM4 = 97¶

ARM4T = 98¶

ARM5 = 99¶

ARM5T = 100¶

ARM6 = 101¶

ARM64 = 246¶

ARM64EC = 248¶

ARM64X = 249¶

ARM7 = 104¶

ARMNT = 244¶

ARM_WMMX = 103¶

ARM_XMAC = 102¶

CEE = 144¶

D3D11_SHADER = 256¶

EBC = 224¶

HYBRID_X86ARM64 = 247¶

IA64 = 128¶

IA64_2 = 129¶

INTEL_80286 = 2¶

INTEL_80386 = 3¶

INTEL_80486 = 4¶

INTEL_8080 = 0¶

INTEL_8086 = 1¶

M32R = 176¶

M68000 = 32¶

M68010 = 33¶

M68020 = 34¶

M68030 = 35¶

M68040 = 36¶

MIPS = 16¶

MIPS16 = 17¶

MIPS32 = 18¶

MIPS64 = 19¶

MIPSI = 20¶

MIPSII = 21¶

MIPSIII = 22¶

MIPSIV = 23¶

MIPSV = 24¶

OMNI = 112¶

PENTIUM = 5¶

PENTIUM3 = 7¶

PENTIUMPRO = 6¶

PPC601 = 64¶

PPC603 = 65¶

PPC604 = 66¶

PPC620 = 67¶

PPCBE = 69¶

PPCFP = 68¶

SH3 = 80¶

SH3DSP = 82¶

SH3E = 81¶

SH4 = 83¶

SHMEDIA = 84¶

THUMB = 240¶

TRICORE = 192¶

UNKNOWN = 255¶

X64 = 208¶

class LANG(*values)¶

Bases: Enum

ALIASOBJ = 20¶

BASIC = 5¶

C = 0¶

COBOL = 6¶

CPP = 1¶

CSHARP = 10¶

CVTPGD = 9¶

CVTRES = 8¶

FORTRAN = 2¶

GO = 22¶

HLSL = 16¶

ILASM = 12¶

JAVA = 13¶

JSCRIPT = 14¶

LINK = 7¶

MASM = 3¶

MSIL = 15¶

OBJC = 17¶

OBJCPP = 18¶

PASCAL_LANG = 4¶

RUST = 21¶

SWIFT = 19¶

UNKNOWN = 255¶

VB = 11¶

property backend_version → lief.pdb.BuildMetadata.version_t¶

Version of the backend (e.g. 14.36.32537)

property build_info → lief.pdb.BuildMetadata.build_info_t | None¶

Build information represented by the S_BUILDINFO symbol

class build_info_t¶

Bases: object

Build information represented by the S_BUILDINFO symbol

property build_tool → str¶

Path to the build tool (e.g. C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX64\x64\CL.exe

property command_line → str¶

Command line arguments used to invoke the build tool

property cwd → str¶

Working directory where the build tool was invoked

property pdb → str¶

PDB path

property source_file → str¶

Source file consumed by the build tool

property env → list[str]¶

Environment information represented by the S_ENVBLOCK symbol

property frontend_version → lief.pdb.BuildMetadata.version_t¶

Version of the frontend (e.g. 19.36.32537)

property language → lief.pdb.BuildMetadata.LANG¶

Source language

property target_cpu → lief.pdb.BuildMetadata.CPU¶

Target CPU

property version → str¶

Version of the tool as a string. For instance, Microsoft (R) CVTRES, Microsoft (R) LINK.

class version_t¶

Bases: object

This structure represents a version for the backend or the frontend

property build → int¶

Build version

property major → int¶

Major version

property minor → int¶

Minor version

property qfe → int¶

Quick Fix Engineering version

Bases: object

This class provides general information (RVA, name) about a symbol from the PDB’s public symbol stream (or Public symbol hash stream)

property RVA → int¶

Relative Virtual Address of this symbol.

This function returns 0 if the RVA can’t be computed.

property demangled_name → str¶

Demangled representation of the symbol

property name → str¶

Name of the symbol

property section_name → str¶

Name of the section in which this symbol is defined (e.g. .text). This function returns an empty string if the section’s name can’t be found

Bases: object

property RVA → int¶

The Relative Virtual Address of the function

property code_size → int¶

The size of the function

property debug_location → lief.debug_location_t¶

Original source code location.

property name → str¶

Name of the function

property section_name → str¶

The name of the section in which this function is defined

to_decl(self, opt: lief._lief.DeclOpt | None = None) → str¶

Generates a C/C++ definition for this function

Bases: object

class KIND(*values)¶

Bases: Enum

ARRAY = 8¶

BITFIELD = 7¶

CLASS = 1¶

ENUM = 4¶

FUNCTION = 5¶

INTERFACE = 11¶

MODIFIER = 6¶

POINTER = 2¶

SIMPLE = 3¶

STRUCTURE = 10¶

UNION = 9¶

UNKNOWN = 0¶

property kind → lief.pdb.Type.KIND¶

Discriminator for the type’s subclasses

property name → str | None¶

Type’s name (if present)

property size → int | None¶

Size of the type. This size should match the value of sizeof(...) applied to this type.

to_decl(self, opt: lief._lief.DeclOpt | None = None) → str¶

Generates a C/C++ definition for this type

Bases: Type

This class represents a LF_ARRAY PDB type.

property element_type → lief.pdb.Type | None¶

Type of the elements

property index_type → lief.pdb.Type | None¶

Type of the index

property numberof_elements → int¶

Number of elements in this array

Bases: object

This class represents an attribute (LF_MEMBER) in an aggregate (class, struct, union, …)

property field_offset → int¶

Offset of this attribute in the aggregate

property name → str¶

Name of this attribute.

property type → lief.pdb.Type | None¶

Type of this attribute

Bases: Type

This class represents a LF_BITFIELD PDB type

Bases: Type

This class abstracts the following PDB types: LF_STRUCTURE, LF_INTERFACE, LF_CLASS or LF_UNION.

property attributes → Iterator[lief.pdb.types.Attribute | None]¶

Return an iterator over the different attributes defined in this class-like type

property methods → Iterator[lief.pdb.types.Method | None]¶

Return an iterator over the different methods implemented in this class-like type

property unique_name → str¶

Mangled type name.

Bases: ClassLike

Interface for the LF_STRUCTURE PDB type

Bases: ClassLike

Interface for the LF_CLASS PDB type

Bases: ClassLike

Interface for the LF_INTERFACE PDB type

Bases: Type

This class represents a LF_ENUM PDB type

class Entry¶

Bases: object

This class represents an enum entry which is essentially composed of a name and its value (integer).

property name → str¶

Enum entry’s name

property value → int¶

Enum entry’s value (if any)

property entries → list[lief.pdb.types.Enum.Entry]¶

Return the different entries associated with this enum

find_entry(self, value: int) → lief._lief.pdb.types.Enum.Entry | None¶

Try to find the enum matching the given value

property underlying_type → lief.pdb.Type | None¶

The underlying type that is used to encode this enum

property unique_name → str¶

Enum’s mangled name

Bases: Type

This class represents a LF_PROCEDURE PDB type

property parameters → list[lief.pdb.Type | None]¶

Types of the function’s parameters

property return_type → lief.pdb.Type | None¶

Type returned by this function

Bases: object

This class represents a Method (LF_ONEMETHOD) that can be defined in ClassLike PDB type

class ACCESS(*values)¶

Bases: Enum

NONE = 0¶

PRIVATE = 1¶

PROTECTED = 2¶

PUBLIC = 3¶

class TYPE(*values)¶

Bases: Enum

FRIEND = 3¶

INTRODUCING_VIRTUAL = 4¶

PURE_INTRODUCING_VIRTUAL = 6¶

PURE_VIRTUAL = 5¶

STATIC = 2¶

VANILLA = 0¶

VIRTUAL = 1¶

property access → lief.pdb.types.Method.ACCESS¶

Visibility access (public, private, …)

property name → str¶

Name of the method

property type → lief.pdb.types.Method.TYPE¶

Type/Properties of the method (virtual, static, etc.)

Bases: Type

This class represents a LF_MODIFIER PDB type

property underlying_type → lief.pdb.Type | None¶

Underlying type targeted by this modifier

Bases: Type

This class represents a LF_POINTER PDB type

property underlying_type → lief.pdb.Type | None¶

The underlying type pointed to by this pointer

Bases: Type

This class represents primitive types (int, float, …) which are also named simple types in the PDB format.

class MODES(*values)¶

Bases: Enum

DIRECT = 0¶

FAR_POINTER = 512¶

FAR_POINTER32 = 1280¶

HUGE_POINTER = 768¶

NEAR_POINTER128 = 1792¶

NEAR_POINTER32 = 1024¶

NEAR_POINTER64 = 1536¶

class TYPES(*values)¶

Bases: Enum

BOOL128 = 52¶

BOOL16 = 49¶

BOOL32 = 50¶

BOOL64 = 51¶

BOOL8 = 48¶

CHAR16 = 122¶

CHAR32 = 123¶

CHAR8 = 124¶

COMPLEX128 = 83¶

COMPLEX16 = 86¶

COMPLEX32 = 80¶

COMPLEX32_PARTIAL_PRECISION = 85¶

COMPLEX48 = 84¶

COMPLEX64 = 81¶

COMPLEX80 = 82¶

FLOAT128 = 67¶

FLOAT16 = 70¶

FLOAT32 = 64¶

FLOAT32_PARTIAL_PRECISION = 69¶

FLOAT48 = 68¶

FLOAT64 = 65¶

FLOAT80 = 66¶

RCHAR = 112¶

SBYTE = 104¶

SCHAR = 16¶

SINT128 = 120¶

SINT16 = 114¶

SINT32 = 116¶

SINT64 = 118¶

SLONG = 18¶

SOCTA = 20¶

SQUAD = 19¶

SSHORT = 17¶

UBYTE = 105¶

UCHAR = 32¶

UINT128 = 121¶

UINT16 = 115¶

UINT32 = 117¶

UINT64 = 119¶

ULONG = 34¶

UNKNOWN = 0¶

UOCTA = 36¶

UQUAD = 35¶

USHORT = 33¶

VOID = 3¶

WCHAR = 113¶

property is_pointer → bool¶

Check if this simple type is a pointer.

property is_signed → bool¶

Check if the underlying type is signed.

property modes → lief.pdb.types.Simple.MODES¶

Returns the mode (pointer type) of this Simple type.

property type → lief.pdb.types.Simple.TYPES¶

Returns the underlying primitive type.

Bases: ClassLike

This class represents a LF_UNION PDB type