Python¶

Parser¶

lief.ELF.parse(*args) → lief.ELF.Binary | None¶

lief.ELF.parse(raw: collections.abc.Sequence[int], config: lief._lief.ELF.ParserConfig = <lief._lief.ELF.ParserConfig object at 0x7bc19d940450>) → lief._lief.ELF.Binary | None

lief.ELF.parse(obj: Union[io.IOBase | os.PathLike], config: lief._lief.ELF.ParserConfig = <lief._lief.ELF.ParserConfig object at 0x7bc19d940510>) → lief._lief.ELF.Binary | None

Overloaded function.

1. parse(filename: str, config: lief._lief.ELF.ParserConfig = <lief._lief.ELF.ParserConfig object at 0x7bc19d9404e0>) -> Optional[lief._lief.ELF.Binary]

   Parse the ELF binary from the given file path and return a lief.ELF.Binary object

   The second argument is an optional configuration (ParserConfig) that can be used to define which part(s) of the ELF should be parsed or skipped.

2. parse(raw: collections.abc.Sequence[int], config: lief._lief.ELF.ParserConfig = <lief._lief.ELF.ParserConfig object at 0x7bc19d940450>) -> Optional[lief._lief.ELF.Binary]

   Parse the ELF binary from the given list of bytes and return a lief.ELF.Binary object

   The second argument is an optional configuration (ParserConfig) that can be used to define which part(s) of the ELF should be parsed or skipped.

3. parse(obj: Union[io.IOBase | os.PathLike], config: lief._lief.ELF.ParserConfig = <lief._lief.ELF.ParserConfig object at 0x7bc19d940510>) -> Optional[lief._lief.ELF.Binary]

   Parse the ELF binary from the given Python object and return a lief.ELF.Binary object

   The second argument is an optional configuration (ParserConfig) that can be used to define which part(s) of the ELF should be parsed or skipped.

class lief.ELF.ParserConfig(self)¶

Bases: object

This class is used to tweak the ELF Parser

class DYNSYM_COUNT(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Enum

AUTO = 0¶

HASH = 2¶

RELOCATIONS = 3¶

SECTION = 1¶

from_value(arg: int) → lief.ELF.ParserConfig.DYNSYM_COUNT = <nanobind.nb_func object>¶

all = <lief._lief.ELF.ParserConfig object>¶

property count_mtd → lief.ELF.ParserConfig.DYNSYM_COUNT¶

The DYNSYM_COUNT_METHODS to use for counting the dynamic symbols

For weird binaries (e.g sectionless) you can choose the method for counting dynamic symbols (lief.ELF.DYNSYM_COUNT_METHODS). By default, the value is set to lief.ELF.DYNSYM_COUNT_METHODS.COUNT_AUTO

property parse_dyn_symbols → bool¶

Whether dynamic symbols (those from .dynsym) should be parsed

property parse_notes → bool¶

Whether ELF notes information should be parsed

property parse_overlay → bool¶

Whether the overlay data should be parsed

property parse_relocations → bool¶

Whether relocations (including plt-like relocations) should be parsed.

property parse_symbol_versions → bool¶

Whether versioning symbols should be parsed

property parse_symtab_symbols → bool¶

Whether debug symbols (those from .symtab) should be parsed

Binary¶

class lief.ELF.Binary¶

Bases: Binary

Class which represents an ELF binary

class PHDR_RELOC(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Enum

This enum describes the different ways to relocate the segments table.

AUTO = 0¶

BSS_END = 2¶

FILE_END = 3¶

PIE_SHIFT = 1¶

SEGMENT_GAP = 4¶

add(*args) → lief.ELF.Note | lief.ELF.Section | lief.ELF.Segment | lief.ELF.DynamicEntry¶

Overloaded function.

1. add(self, arg: lief._lief.ELF.DynamicEntry, /) -> lief._lief.ELF.DynamicEntry

dynamic_entry

2. add(self, section: lief._lief.ELF.Section, loaded: bool = True) -> lief._lief.ELF.Section

   Add the given Section to the binary.

   If the section does not aim at being loaded in memory, the loaded parameter has to be set to False (default: True)

3. add(self, segment: lief._lief.ELF.Segment, base: int = 0) -> lief._lief.ELF.Segment

Add a new Segment in the binary

4. add(self, note: lief._lief.ELF.Note) -> lief._lief.ELF.Note

Add a new Note in the binary

add_dynamic_relocation(self, relocation: lief.ELF.Relocation) → lief.ELF.Relocation¶

Add a new dynamic relocation.

We consider a dynamic relocation as a relocation which is not plt-related.

See: lief.ELF.Binary.add_pltgot_relocation()

add_dynamic_symbol(self, symbol: lief.ELF.Symbol, symbol_version: lief.ELF.SymbolVersion | None) → lief.ELF.Symbol¶

Add a dynamic Symbol to the binary

The function also takes an optional lief.ELF.SymbolVersion

add_exported_function(self, address: int, name: str) → lief.ELF.Symbol¶

Create a symbol for the function at the given address and create an export

add_library(self, library_name: str) → lief.ELF.DynamicEntryLibrary¶

Add a library with the given name as dependency

add_object_relocation(self, relocation: lief.ELF.Relocation, section: lief.ELF.Section) → lief.ELF.Relocation¶

Add relocation for object file (.o)

The first parameter is the section to add while the second parameter is the Section associated with the relocation.

If there is an error, this function returns a nullptr. Otherwise, it returns the relocation added.”,

add_pltgot_relocation(self, relocation: lief.ELF.Relocation) → lief.ELF.Relocation¶

Add a .plt.got relocation. This kind of relocation is usually associated with a PLT stub that aims at resolving the underlying symbol.

See: lief.ELF.Binary.add_dynamic_relocation()

add_symtab_symbol(self, symbol: lief.ELF.Symbol) → lief.ELF.Symbol¶

Add a static Symbol to the binary

property dtor_functions → list[lief.Function]¶

List of the binary destructors (typically, the functions located in the .fini_array)

property dynamic_entries → lief.ELF.Binary.it_dynamic_entries¶

Return an iterator to DynamicEntry entries as a list

property dynamic_relocations → lief.ELF.Binary.it_filter_relocation¶

Return an iterator over dynamics Relocation

property dynamic_symbols → lief.ELF.Binary.it_symbols¶

Return an iterator to dynamic Symbol

dynsym_idx(*args) → int¶

Overloaded function.

1. dynsym_idx(self, name: str) -> int

   Get the symbol index in the dynamic symbol from the given name or return -1 if the symbol does not exist.

2. dynsym_idx(self, symbol: lief._lief.ELF.Symbol) -> int

   Get the symbol index in the dynamic symbol table for the given symbol or return -1 if the symbol does not exist

property eof_offset → int¶

Return the last offset used by the ELF binary according to both, the sections table and the segments table.

export_symbol(*args) → lief.ELF.Symbol¶

Overloaded function.

1. export_symbol(self, symbol: lief._lief.ELF.Symbol) -> lief._lief.ELF.Symbol

Export the given symbol and create an entry if it doesn’t exist

2. export_symbol(self, symbol_name: str, value: int = 0) -> lief._lief.ELF.Symbol

Export the symbol with the given name and create an entry if it doesn’t exist

property exported_symbols → lief.ELF.Binary.it_filter_symbols¶

Return dynamic Symbol which are exported

extend(*args) → lief.ELF.Section | lief.ELF.Segment¶

Overloaded function.

1. extend(self, segment: lief._lief.ELF.Segment, size: int) -> lief._lief.ELF.Segment

Extend the given given Segment by the given size

2. extend(self, segment: lief._lief.ELF.Section, size: int) -> lief._lief.ELF.Section

Extend the given given Section by the given size

property functions → list[lief.Function]¶

List of the functions found the in the binary

get(*args) → lief.ELF.Note | lief.ELF.Section | lief.ELF.Segment | lief.ELF.DynamicEntry¶

Overloaded function.

1. get(self, tag: lief._lief.ELF.DynamicEntry.TAG) -> lief._lief.ELF.DynamicEntry

   Return the first binary’s DynamicEntry from the given TAG.

   It returns None if the dynamic entry can’t be found.

2. get(self, type: lief._lief.ELF.Segment.TYPE) -> lief._lief.ELF.Segment

   Return the first binary’s Segment from the given SEGMENT_TYPES

   It returns None if the segment can’t be found.

3. get(self, type: lief._lief.ELF.Note.TYPE) -> lief._lief.ELF.Note

   Return the first binary’s Note from the given TYPE.

   It returns None if the note can’t be found.

4. get(self, type: lief._lief.ELF.Section.TYPE) -> lief._lief.ELF.Section

   Return the first binary’s Section from the given ELF_SECTION_TYPES

   It returns None if the section can’t be found.

get_dynamic_symbol(self, symbol_name: str) → lief.ELF.Symbol¶

Get the dynamic symbol from the given name.

It returns None if it can’t be found.

get_library(self, library_name: str) → lief.ELF.DynamicEntryLibrary¶

Return the DynamicEntryLibrary with the given name

It returns None if the library can’t be found.

get_relocated_dynamic_array(self, array_tag: lief.ELF.DynamicEntry.TAG) → list[int]¶

Return the array defined by the given tag (e.g. INIT_ARRAY with relocations applied (if any)

get_relocation(*args) → lief.ELF.Relocation¶

Overloaded function.

1. get_relocation(self, symbol_name: str) -> lief._lief.ELF.Relocation

Return the Relocation associated with the given symbol name

2. get_relocation(self, symbol: lief._lief.ELF.Symbol) -> lief._lief.ELF.Relocation

Return the Relocation associated with the given Symbol

3. get_relocation(self, address: int) -> lief._lief.ELF.Relocation

Return the Relocation associated with the given address

get_section(self, section_name: str) → lief.ELF.Section¶

Return the Section with the given name

It returns None if the section can’t be found.

get_strings(self, min_size: int) → list[str]¶

Return list of strings used in the current ELF file with a minimal size given in first parameter (Default: 5) It looks for strings in the .roadata section

get_symtab_symbol(self, symbol_name: str) → lief.ELF.Symbol¶

Get the static symbol from the given name.

It returns None if it can’t be found.

property gnu_hash → lief.ELF.GnuHash¶

Return the GnuHash object

Hash are used by the loader to speed up symbols resolution (GNU Version)

has(*args) → bool¶

Overloaded function.

1. has(self, tag: lief._lief.ELF.DynamicEntry.TAG) -> bool

   Check if it exists a DynamicEntry with the given TAG

2. has(self, type: lief._lief.ELF.Segment.TYPE) -> bool

Check if a Segment of type (SEGMENT_TYPES) exists

3. has(self, type: lief._lief.ELF.Note.TYPE) -> bool

Check if a Note of type (TYPE) exists

4. has(self, type: lief._lief.ELF.Section.TYPE) -> bool

Check if a Section of type (SECTION_TYPES) exists

has_dynamic_symbol(self, symbol_name: str) → bool¶

Check if the symbol with the given name exists in the dynamic symbol table

property has_interpreter → bool¶

Check if the binary uses a loader (also named linker or interpreter)

has_library(self, library_name: str) → bool¶

Check if the given library name exists in the current binary

property has_notes → bool¶

True if the binary contains notes

property has_overlay → bool¶

True if data are appended to the end of the binary

has_section(self, section_name: str) → bool¶

Check if a Section with the given name exists in the binary

has_section_with_offset(self, offset: int) → bool¶

Check if a Section that encompasses the given offset exists

has_section_with_va(self, virtual_address: int) → bool¶

Check if a Section that encompasses the given virtual address exists

has_symtab_symbol(self, symbol_name: str) → bool¶

Check if the symbol with the given name exists in the static symbol table

property header → lief.ELF.Header¶

Return Header object

property imagebase → int¶

Return the program image base. (e.g. 0x400000)

property imported_symbols → lief.ELF.Binary.it_filter_symbols¶

Return dynamic Symbol which are imported

property interpreter → str¶

ELF interpreter (loader) if any. (e.g. /lib64/ld-linux-x86-64.so.2)

property is_pie → bool¶

Check if the binary has been compiled with -fpie -pie flags

To do so we check if there is a PT_INTERP segment and if the binary type is ET_DYN (Shared object)

property is_targeting_android → bool¶

True if the current is targeting Android

class it_dyn_symtab_symbols¶

Bases: object

Iterator over lief._lief.ELF.Symbol

class it_dynamic_entries¶

Bases: object

Iterator over lief._lief.ELF.DynamicEntry

class it_filter_relocation¶

Bases: object

Iterator over lief._lief.ELF.Relocation

class it_filter_symbols¶

Bases: object

Iterator over lief._lief.ELF.Symbol

class it_notes¶

Bases: object

Iterator over lief._lief.ELF.Note

class it_relocations¶

Bases: object

Iterator over lief._lief.ELF.Relocation

class it_sections¶

Bases: object

Iterator over lief._lief.ELF.Section

class it_segments¶

Bases: object

Iterator over lief._lief.ELF.Segment

class it_symbols¶

Bases: object

Iterator over lief._lief.ELF.Symbol

class it_symbols_version¶

Bases: object

Iterator over lief._lief.ELF.SymbolVersion

class it_symbols_version_definition¶

Bases: object

Iterator over lief._lief.ELF.SymbolVersionDefinition

class it_symbols_version_requirement¶

Bases: object

Iterator over lief._lief.ELF.SymbolVersionRequirement

property last_offset_section → int¶

Return the last offset used in binary according to sections table

property last_offset_segment → int¶

Return the last offset used in binary according to segments table

property next_virtual_address → int¶

Return the next virtual address available

property notes → lief.ELF.Binary.it_notes¶

Return an iterator over the Note entries

property object_relocations → lief.ELF.Binary.it_filter_relocation¶

Return an iterator over object Relocation

property overlay → memoryview¶

Overlay data that are not a part of the ELF format

patch_pltgot(*args) → None¶

Overloaded function.

1. patch_pltgot(self, symbol_name: str, address: int) -> None

Patch the imported symbol’s name with the address

2. patch_pltgot(self, symbol: lief._lief.ELF.Symbol, address: int) -> None

Patch the imported Symbol with the address

permute_dynamic_symbols(self, permutation: collections.abc.Sequence[int]) → None¶

Apply the given permutation on the dynamic symbols table

property pltgot_relocations → lief.ELF.Binary.it_filter_relocation¶

Return an iterator over PLT/GOT Relocation

relocate_phdr_table(self, type: lief.ELF.Binary.PHDR_RELOC) → int¶

Force relocating the segments table in a specific way (see: PHDR_RELOC).

This function can be used to enforce a specific relocation of the segments table. Upon successful relocation, the function returns the offset of the relocated segments table. Otherwise, if the function fails, it returns 0

property relocations → lief.ELF.Binary.it_relocations¶

Return an iterator over all Relocation

remove(*args) → None¶

Overloaded function.

1. remove(self, dynamic_entry: lief._lief.ELF.DynamicEntry) -> None

Remove the given DynamicEntry from the dynamic table

2. remove(self, tag: lief._lief.ELF.DynamicEntry.TAG) -> None

Remove all the DynamicEntry with the given TAG

3. remove(self, section: lief._lief.ELF.Section, clear: bool = False) -> None

Remove the given Section. The clear parameter specifies whether or not we must fill its content with 0 before removing

4. remove(self, note: lief._lief.ELF.Note) -> None

Remove the given Note

5. remove(self, type: lief._lief.ELF.Note.TYPE) -> None

Remove all the Note with the given TYPE

remove_dynamic_symbol(*args) → None¶

Overloaded function.

1. remove_dynamic_symbol(self, arg: lief._lief.ELF.Symbol, /) -> None

Remove the given Symbol from the .dynsym section

2. remove_dynamic_symbol(self, arg: str, /) -> None

Remove the Symbol with the name given in parameter from the .dynsym section

remove_library(self, library_name: str) → None¶

Remove the given library

remove_symtab_symbol(self, arg: lief.ELF.Symbol) → None¶

Remove the given Symbol from the .symtab section

replace(self, new_segment: lief.ELF.Segment, original_segment: lief.ELF.Segment, base: int) → lief.ELF.Segment¶

Replace the Segment given in 2nd parameter with the Segment given in the first parameter and return the updated segment.

Warning

The original_segment is no longer valid after this function

section_from_offset(self, offset: int, skip_nobits: bool) → lief.ELF.Section¶

Return the Section which encompasses the given offset. It returns None if a section can’t be found.

If skip_nobits is set (which is the case by default), this function won’t consider sections for which the type is SHT_NOBITS (like .bss, .tbss, ...)

section_from_virtual_address(self, address: int, skip_nobits: bool) → lief.ELF.Section¶

Return the Section which encompasses the given virtual address. It returns None if a section can’t be found.

If skip_nobits is set (which is the case by default), this function won’t consider sections for which the type is SHT_NOBITS (like .bss, .tbss, ...)

property sections → lief.ELF.Binary.it_sections¶

Return an iterator over binary’s Section

segment_from_offset(self, offset: int) → lief.ELF.Segment¶

Return the Segment which encompasses the given offset. It returns None if a segment can’t be found.

segment_from_virtual_address(self, address: int) → lief.ELF.Segment¶

Return the Segment which encompasses the given virtual address. It returns None if a segment can’t be found.

property segments → lief.ELF.Binary.it_segments¶

Return an iterator to binary’s Segment

property strings → list[str | bytes]¶

Return list of strings used in the current ELF file. Basically this function looks for strings in the .roadata section

strip(self) → None¶

Strip the binary

property symbols → lief.ELF.Binary.it_dyn_symtab_symbols¶

Return an iterator over both static and dynamic Symbol

property symbols_version → lief.ELF.Binary.it_symbols_version¶

Return an iterator SymbolVersion

property symbols_version_definition → lief.ELF.Binary.it_symbols_version_definition¶

Return an iterator to SymbolVersionDefinition

property symbols_version_requirement → lief.ELF.Binary.it_symbols_version_requirement¶

Return an iterator to SymbolVersionRequirement

symtab_idx(*args) → int¶

Overloaded function.

1. symtab_idx(self, name: str) -> int

   Get the symbol index in the .symtab section from the given name or return -1 if the symbol does not exist.

2. symtab_idx(self, symbol: lief._lief.ELF.Symbol) -> int

   Get the symbol index in the .symtab section or return -1 if the symbol does not exist

property symtab_symbols → lief.ELF.Binary.it_symbols¶

Return an iterator to static Symbol

property sysv_hash → lief.ELF.SysvHash¶

Return the SysvHash object

Hash are used by the loader to speed up symbols resolution (SYSV version)

property type → lief.ELF.Header.CLASS¶

Return the binary’s ELF_CLASS

property use_gnu_hash → bool¶

True if GNU hash is used

property use_sysv_hash → bool¶

True if SYSV hash is used

virtual_address_to_offset(self, virtual_address: int) → int | lief.lief_errors¶

Convert the virtual address to a file offset

property virtual_size → int¶

Return the size of the mapped binary

write(*args) → None¶

Overloaded function.

1. write(self, output: str) -> None

Rebuild the binary and write it in a file

2. write(self, output: str, config: lief._lief.ELF.Builder.config_t) -> None

Rebuild the binary with the given configuration and write it in a file

Header¶

class lief.ELF.Header(self)¶

Bases: Object

Class which represents the ELF’s header. This class mirrors the raw ELF Elfxx_Ehdr structure.

class CLASS(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Enum

Match the result of Elfxx_Ehdr.e_ident[EI_CLASS]

ELF32 = 1¶

ELF64 = 2¶

NONE = 0¶

from_value(arg: int) → lief.ELF.Header.CLASS = <nanobind.nb_func object>¶

class ELF_DATA(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Enum

Match the result Elfxx_Ehdr.e_ident[EI_DATA]

LSB = 1¶

MSB = 2¶

NONE = 0¶

from_value(arg: int) → lief.ELF.Header.ELF_DATA = <nanobind.nb_func object>¶

class FILE_TYPE(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Enum

The type of the underlying ELF file. This enum matches the semantic of ET_NONE, ET_REL, …

CORE = 4¶

DYN = 3¶

EXEC = 2¶

NONE = 0¶

REL = 1¶

from_value(arg: int) → lief.ELF.Header.FILE_TYPE = <nanobind.nb_func object>¶

class OS_ABI(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Enum

AIX = 7¶

AMDGPU_HSA = 64¶

ARM = 97¶

AROS = 15¶

C6000_LINUX = 65¶

CLOUDABI = 17¶

FENIXOS = 16¶

FREEBSD = 9¶

HPUX = 1¶

HURD = 4¶

IRIX = 8¶

LINUX = 3¶

MODESTO = 11¶

NETBSD = 2¶

NSK = 14¶

OPENBSD = 12¶

OPENVMS = 13¶

SOLARIS = 6¶

STANDALONE = 255¶

SYSTEMV = 0¶

TRU64 = 10¶

from_value(arg: int) → lief.ELF.Header.OS_ABI = <nanobind.nb_func object>¶

class VERSION(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Enum

Match the result of Elfxx_Ehdr.e_version

CURRENT = 1¶

NONE = 0¶

from_value(arg: int) → lief.ELF.Header.VERSION = <nanobind.nb_func object>¶

property entrypoint → int¶

Return the binary entry point

property file_type → lief.ELF.Header.FILE_TYPE¶

Return binary’s type. This field determines if the binary is a executable, a library…

property flags_list → list[lief.ELF.PROCESSOR_FLAGS]¶

Processor flags as a list

has(self, arg: lief.ELF.PROCESSOR_FLAGS) → bool¶

Check if the given processor flag is present

property header_size → int¶

Return the size of the ELF header This size should be 64 for an ELF64 binary and 52 for an ELF32.

property identity → list[int]¶

Header’s identity.

property identity_abi_version → int¶

Return the ABI version (integer).

property identity_class → lief.ELF.Header.CLASS¶

Header’s class.

property identity_data → lief.ELF.Header.ELF_DATA¶

Specify the data encoding

property identity_os_abi → lief.ELF.Header.OS_ABI¶

Identifies the version of the ABI for which the object is prepared.

property identity_version → lief.ELF.Header.VERSION¶

property machine_type → lief.ELF.ARCH¶

Return the target architecture

property numberof_sections → int¶

Return the number of sections

property numberof_segments → int¶

Return the number of program headers (segments)

property object_file_version → lief.ELF.Header.VERSION¶

Return the version

property processor_flag → int¶

Processor-specific flags

property program_header_offset → int¶

Offset of program table (also known as segments table)

property program_header_size → int¶

Return the size of the raw Elfxx_Phdr structure (see lief.ELF.Segment) This size should be 56 for an ELF64 binary and 32 for an ELF32.

property section_header_offset → int¶

Offset of section table

property section_header_size → int¶

Return the size of the raw Elfxx_Shdr (lief.ELF.Section)

This size should be 64 for an ELF64 binary and 40 for an ELF32.

property section_name_table_idx → int¶

Return the section index which contains sections’ names

Section¶

class lief.ELF.Section(self)¶

class lief.ELF.Section(self, name: str, type: lief._lief.ELF.Section.TYPE = TYPE.PROGBITS)

Bases: Section

Class which represents an ELF section.

Overloaded function.

1. __init__(self) -> None

Default constructor

2. __init__(self, name: str, type: lief._lief.ELF.Section.TYPE = TYPE.PROGBITS) -> None

Constructor from a name and a section type

class FLAGS(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Flag

ALLOC = 2¶

ARM_PURECODE = 22011707392¶

COMPRESSED = 2048¶

EXCLUDE = 2147483648¶

EXECINSTR = 4¶

GNU_RETAIN = 2097152¶

GROUP = 512¶

HEX_GPREL = 13153337344¶

INFO_LINK = 64¶

LINK_ORDER = 128¶

MERGE = 16¶

MIPS_ADDR = 18253611008¶

MIPS_GPREL = 17448304640¶

MIPS_LOCAL = 17246978048¶

MIPS_MERGE = 17716740096¶

MIPS_NAMES = 17213423616¶

MIPS_NODUPES = 17196646400¶

MIPS_NOSTRIP = 17314086912¶

MIPS_STRING = 19327352832¶

NONE = 0¶

OS_NONCONFORMING = 256¶

STRINGS = 32¶

TLS = 1024¶

WRITE = 1¶

X86_64_LARGE = 8858370048¶

XCORE_SHF_CP_SECTION = 4831838208¶

XCORE_SHF_DP_SECTION = 4563402752¶

from_value(arg: int) → lief.ELF.Section.FLAGS = <nanobind.nb_func object>¶

class TYPE(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Enum

ANDROID_REL = 1610612737¶

ANDROID_RELA = 1610612738¶

ANDROID_RELR = 1879047936¶

ARM_ATTRIBUTES = 6174015491¶

ARM_DEBUGOVERLAY = 6174015492¶

ARM_EXIDX = 6174015489¶

ARM_OVERLAYSECTION = 6174015493¶

ARM_PREEMPTMAP = 6174015490¶

DYNAMIC = 6¶

DYNSYM = 11¶

FINI_ARRAY = 15¶

GNU_ATTRIBUTES = 1879048181¶

GNU_HASH = 1879048182¶

GNU_VERDEF = 1879048189¶

GNU_VERNEED = 1879048190¶

GNU_VERSYM = 1879048191¶

GROUP = 17¶

HASH = 5¶

HEX_ORDERED = 10468982784¶

INIT_ARRAY = 14¶

LLVM_ADDRSIG = 1879002115¶

MIPS_ABIFLAGS = 14763950122¶

MIPS_OPTIONS = 14763950093¶

MIPS_REGINFO = 14763950086¶

NOBITS = 8¶

NOTE = 7¶

PREINIT_ARRAY = 16¶

PROGBITS = 1¶

REL = 9¶

RELA = 4¶

RELR = 19¶

RISCV_ATTRIBUTES = 19058917379¶

SHLIB = 10¶

SHT_NULL_ = 0¶

STRTAB = 3¶

SYMTAB = 2¶

SYMTAB_SHNDX = 18¶

X86_64_UNWIND = 10468982785¶

from_value(arg: int) → lief.ELF.Section.TYPE = <nanobind.nb_func object>¶

add(self, flag: lief.ELF.Section.FLAGS) → None¶

Add the given flag to the list of flags

property alignment → int¶

Section alignment

as_frame(self) → lief.ELF.Section¶

clear(self, value: int) → lief.ELF.Section¶

Clear the content of the section with the given value

property entry_size → int¶

This property returns the size of an element in the case of a section that contains an array.

Example:

The .dynamic section contains an array of DynamicEntry. As the size of the raw C structure of this entry is 0x10 (sizeof(Elf64_Dyn)) in a ELF64, the entry_size, is set to this value.

property file_offset → int¶

Offset of the section’s content

property flags → int¶

Return the section’s flags as an integer

property flags_list → list[lief.ELF.Section.FLAGS]¶

Return section’s flags as a list

has(*args) → bool¶

Overloaded function.

1. has(self, flag: lief._lief.ELF.Section.FLAGS) -> bool

Check if the given flag is present

2. has(self, segment: lief._lief.ELF.Segment) -> bool

Check if the given Segment is present in segments

property information → int¶

Section information (this value depends on the section)

property is_frame → bool¶

class it_segments¶

Bases: object

Iterator over lief._lief.ELF.Segment

property link → int¶

Index to another section

property original_size → int¶

Original size of the section’s data.

This value is used by the Builder to determine if it needs to be relocated to avoid an override of the data

remove(self, flag: lief.ELF.Section.FLAGS) → None¶

Remove the given flag from the list of flags

property segments → lief.ELF.Section.it_segments¶

Return segment(s) associated with the given section

property type → lief.ELF.Section.TYPE¶

Return the type of the section

Segment¶

class lief.ELF.Segment(self)¶

Bases: Object

Class which represents the ELF segments

class FLAGS(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Flag

NONE = 0¶

R = 4¶

W = 2¶

X = 1¶

from_value(arg: int) → lief.ELF.Segment.FLAGS = <nanobind.nb_func object>¶

class TYPE(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Enum

AARCH64_MEMTAG_MTE = 19058917378¶

ARM_ARCHEXT = 10468982784¶

ARM_EXIDX = 10468982785¶

DYNAMIC = 2¶

GNU_EH_FRAME = 1685382480¶

GNU_PROPERTY = 1685382483¶

GNU_RELRO = 1685382482¶

GNU_STACK = 1685382481¶

INTERP = 3¶

LOAD = 1¶

MIPS_ABIFLAGS = 27648851971¶

MIPS_OPTIONS = 27648851970¶

MIPS_REGINFO = 27648851968¶

MIPS_RTPROC = 27648851969¶

NOTE = 4¶

PHDR = 6¶

PT_NULL_ = 0¶

RISCV_ATTRIBUTES = 36238786563¶

SHLIB = 5¶

TLS = 7¶

from_value(arg: int) → lief.ELF.Segment.TYPE = <nanobind.nb_func object>¶

add(self, flag: lief.ELF.Segment.FLAGS) → None¶

Add the given flag to the list of flags

property alignment → int¶

The offset alignment of the segment

property content → memoryview¶

The raw data associated with this segment.

property file_offset → int¶

The file offset of the data associated with this segment

property flags → lief.ELF.Segment.FLAGS¶

The flag permissions associated with this segment

from_raw(arg: bytes) → lief.ELF.Segment | lief.lief_errors = <nanobind.nb_func object>¶

has(*args) → bool¶

Overloaded function.

1. has(self, flag: lief._lief.ELF.Segment.FLAGS) -> bool

Check if the given flag is present

2. has(self, section: lief._lief.ELF.Section) -> bool

Check if the given Section is present in sections

3. has(self, section_name: str) -> bool

Check if the given Section ‘s name is present in sections

class it_sections¶

Bases: object

Iterator over lief._lief.ELF.Section

property physical_address → int¶

The physical address of the segment. This value is not really relevant on systems like Linux or Android. On the other hand, Qualcomm trustlets might use this value.

Usually this value matches virtual_address

property physical_size → int¶

The file size of the data associated with this segment

remove(self, flag: lief.ELF.Segment.FLAGS) → None¶

Remove the given flag from the list of flags

property sections → lief.ELF.Segment.it_sections¶

Iterator over the Section wrapped by this segment

property type → lief.ELF.Segment.TYPE¶

Segment’s type

property virtual_address → int¶

The virtual address of the segment.

Warning

The ELF format specifications require the following relationship:

\[\text{virtual address} \equiv \text{file offset} \pmod{\text{page size}} \text{virtual address} \equiv \text{file offset} \pmod{\text{alignment}}\]

property virtual_size → int¶

The in-memory size of this segment.

Usually, if the .bss segment is wrapped by this segment then, virtual_size is larger than physical_size

Dynamic Entry¶

class lief.ELF.DynamicEntry(self)¶

class lief.ELF.DynamicEntry(self, tag: lief._lief.ELF.DynamicEntry.TAG, value: int)

Bases: Object

Class which represents an entry in the dynamic table These entries are located in the .dynamic section or the PT_DYNAMIC segment

Overloaded function.

1. __init__(self) -> None

Default constructor

2. __init__(self, tag: lief._lief.ELF.DynamicEntry.TAG, value: int) -> None

Constructor from a TAG and value

class TAG(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶

Bases: Enum

AARCH64_BTI_PLT = 10468982785¶

AARCH64_MEMTAG_GLOBALS = 10468982797¶

AARCH64_MEMTAG_GLOBALSSZ = 10468982799¶

AARCH64_MEMTAG_HEAP = 10468982795¶

AARCH64_MEMTAG_MODE = 10468982793¶

AARCH64_MEMTAG_STACK = 10468982796¶

AARCH64_PAC_PLT = 10468982787¶

AARCH64_VARIANT_PCS = 10468982789¶

ANDROID_REL = 1610612751¶

ANDROID_RELA = 1610612753¶

ANDROID_RELASZ = 1610612754¶

ANDROID_RELR = 1879040000¶

ANDROID_RELRCOUNT = 1879040005¶

ANDROID_RELRENT = 1879040003¶

ANDROID_RELRSZ = 1879040001¶

ANDROID_RELSZ = 1610612752¶

ANDROID_REL_OFFSET = 1610612749¶

ANDROID_REL_SIZE = 1610612750¶

BIND_NOW = 24¶

DEBUG_TAG = 21¶

FINI = 13¶

FINI_ARRAY = 26¶

FINI_ARRAYSZ = 28¶

FLAGS = 30¶

FLAGS_1 = 1879048187¶

GNU_HASH = 1879047925¶

HASH = 4¶

HEXAGON_PLT = 14763950082¶

HEXAGON_SYMSZ = 14763950080¶

HEXAGON_VER = 14763950081¶

INIT = 12¶

INIT_ARRAY = 25¶

INIT_ARRAYSZ = 27¶

JMPREL = 23¶

MIPS_AUX_DYNAMIC = 6174015537¶

MIPS_BASE_ADDRESS = 6174015494¶

MIPS_COMPACT_SIZE = 6174015535¶

MIPS_CONFLICT = 6174015496¶

MIPS_CONFLICTNO = 6174015499¶

MIPS_CXX_FLAGS = 6174015522¶

MIPS_DELTA_CLASS = 6174015511¶

MIPS_DELTA_CLASSSYM = 6174015520¶

MIPS_DELTA_CLASSSYM_NO = 6174015521¶

MIPS_DELTA_CLASS_NO = 6174015512¶

MIPS_DELTA_INSTANCE = 6174015513¶

MIPS_DELTA_INSTANCE_NO = 6174015514¶

MIPS_DELTA_RELOC = 6174015515¶

MIPS_DELTA_RELOC_NO = 6174015516¶

MIPS_DELTA_SYM = 6174015517¶

MIPS_DELTA_SYM_NO = 6174015518¶

MIPS_DYNSTR_ALIGN = 6174015531¶

MIPS_FLAGS = 6174015493¶

MIPS_GOTSYM = 6174015507¶

MIPS_GP_VALUE = 6174015536¶

MIPS_HIDDEN_GOTIDX = 6174015527¶

MIPS_HIPAGENO = 6174015508¶

MIPS_ICHECKSUM = 6174015491¶

MIPS_INTERFACE = 6174015530¶

MIPS_INTERFACE_SIZE = 6174015532¶

MIPS_IVERSION = 6174015492¶

MIPS_LIBLIST = 6174015497¶

MIPS_LIBLISTNO = 6174015504¶

MIPS_LOCALPAGE_GOTIDX = 6174015525¶

MIPS_LOCAL_GOTIDX = 6174015526¶

MIPS_LOCAL_GOTNO = 6174015498¶

MIPS_MSYM = 6174015495¶

MIPS_OPTIONS = 6174015529¶

MIPS_PERF_SUFFIX = 6174015534¶

MIPS_PIXIE_INIT = 6174015523¶

MIPS_PLTGOT = 6174015538¶

MIPS_PROTECTED_GOTIDX = 6174015528¶

MIPS_RLD_MAP = 6174015510¶

MIPS_RLD_MAP_REL = 6174015541¶

MIPS_RLD_TEXT_RESOLVE_ADDR = 6174015533¶

MIPS_RLD_VERSION = 6174015489¶

MIPS_RWPLT = 6174015540¶

MIPS_SYMBOL_LIB = 6174015524¶

MIPS_SYMTABNO = 6174015505¶

MIPS_TIME_STAMP = 6174015490¶

MIPS_UNREFEXTNO = 6174015506¶

MIPS_XHASH = 6174015542¶

NEEDED = 1¶

NULL = 0¶

PLTGOT = 3¶

PLTREL = 20¶

PLTRELSZ = 2¶

PPC64_GLINK = 23353884672¶

PPC64_OPT = 23353884675¶

PPC_GOT = 19058917376¶

PPC_OPT = 19058917377¶

PREINIT_ARRAY = 32¶

PREINIT_ARRAYSZ = 33¶

REL = 17¶

RELA = 7¶

RELACOUNT = 1879048185¶

RELAENT = 9¶

RELASZ = 8¶

RELCOUNT = 1879048186¶

RELENT = 19¶

RELR = 36¶

RELRENT = 37¶

RELRSZ = 35¶

RELSZ = 18¶

RISCV_VARIANT_CC = 27648851971¶

RPATH = 15¶

RUNPATH = 29¶

SONAME = 14¶

STRSZ = 10¶

STRTAB = 5¶

SYMBOLIC = 16¶

SYMENT = 11¶

SYMTAB = 6¶

SYMTAB_SHNDX = 34¶

TEXTREL = 22¶

UNKNOWN = 18446744073709551615¶

VERDEF = 1879048188¶

VERDEFNUM = 1879048189¶

VERNEED = 1879048190¶

VERNEEDNUM = 1879048191¶

VERSYM = 1879048176¶

X86_64_PLT = 31943819264¶

X86_64_PLTENT = 31943819267¶

X86_64_PLTSZ = 31943819265¶

from_value(arg: int) → lief.ELF.DynamicEntry.TAG = <nanobind.nb_func object>¶

property tag → lief.ELF.DynamicEntry.TAG¶

Return the entry’s TAG which represent the entry type

property value → int¶

Return the entry’s value

The meaning of the value strongly depends on the tag. It can be an offset, an index, a flag, …