Overloaded function.
parse(filename: str, config: lief._lief.MachO.ParserConfig = <lief._lief.MachO.ParserConfig object at 0x7b08985685b0>) -> Optional[lief._lief.MachO.FatBinary]
Parse the given binary and return a
FatBinaryobjectOne can configure the parsing with the
configparameter. SeeParserConfig,
parse(raw: collections.abc.Sequence[int], config: lief._lief.MachO.ParserConfig = <lief._lief.MachO.ParserConfig object at 0x7b08985685d0>) -> Optional[lief._lief.MachO.FatBinary]
Parse the given binary (from raw bytes) and return a
FatBinaryobjectOne can configure the parsing with the
configparameter. SeeParserConfig
parse(obj: Union[io.IOBase | os.PathLike], config: lief._lief.MachO.ParserConfig = <lief._lief.MachO.ParserConfig object at 0x7b0898568610>) -> Optional[lief._lief.MachO.FatBinary]
Parse the given binary from the given input and return a
FatBinaryobjectOne can configure the parser with the
configparameter. SeeParserConfig
Bases: object
This class is used to tweak the MachO Parser (Parser)
When parsing Mach-O from memory, this option can be used to undo relocations and symbols bindings.
When activated, this option requires parse_dyld_bindings and parse_dyld_rebases to be enabled.
Whether the binary is coming/extracted from Dyld shared cache
If flag is set to true, Exports, Bindings and Rebases opcodes are parsed.
Warning
Enabling this flag can slow down the parsing
Parse the Dyld binding opcodes
Parse the Dyld export trie
Parse the Dyld rebase opcodes
fatbinary_1 = lief.MachO.parse("/usr/bin/ls", config=lief.MachO.ParserConfig.deep)
# or
fatbinary_2 = lief.MachO.parse("/usr/bin/ls", config=lief.MachO.ParserConfig.quick)
Bases: object
Class which represent a Mach-O (fat) binary This object is also used for representing Mach-O binaries that are NOT FAT
Return the Binary at the given index or None if it is not present
Bases: object
Iterator over lief._lief.MachO.Binary
Build a Mach-O universal binary and return its bytes
Build a Mach-O universal binary
Bases: Binary
Class which represents a MachO binary
Overloaded function.
add(self, dylib_command: lief._lief.MachO.DylibCommand) -> lief._lief.MachO.LoadCommand
Add a new DylibCommand
add(self, segment: lief._lief.MachO.SegmentCommand) -> lief._lief.MachO.LoadCommand
Add a new SegmentCommand
add(self, load_command: lief._lief.MachO.LoadCommand) -> lief._lief.MachO.LoadCommand
Add a new LoadCommand
add(self, load_command: lief._lief.MachO.LoadCommand, index: int) -> lief._lief.MachO.LoadCommand
Add a new LoadCommand at index
Add a new export in the binary
Add a new library dependency
Add a new a new symbol in the LC_SYMTAB
Overloaded function.
add_section(self, segment: lief._lief.MachO.SegmentCommand, section: lief._lief.MachO.Section) -> lief._lief.MachO.Section
Add a new Section in the given SegmentCommand
add_section(self, section: lief._lief.MachO.Section) -> lief._lief.MachO.Section
Add a new Section within the __TEXT segment
Return an iterator over the binding info which can come from either DyldInfo or DyldChainedFixups commands.
Return the binary’s BuildVersion if any, or None
Check if the given symbol can be safely removed.
Check if the given symbol name can be safely removed.
Return the binary’s CodeSignature if any, or None
Return the binary’s CodeSignatureDir if any, or None
Return an iterator over the binary’s Command
Return the binary’s DataInCode if any, or None
Return the binary’s DyldChainedFixups if any, or None
Return the binary’s DyldEnvironment if any, or None
Return the binary’s DyldExportsTrie if any, or None
Return the binary’s DyldInfo if any, or None
Return the binary’s DylinkerCommand if any, or None
Return the binary’s DynamicSymbolCommand if any, or None
Return the binary’s EncryptionInfo if any, or None
Return the binary’s Symbol which are exported
Extend a LoadCommand by size
Extend the content of the given SegmentCommand by size
Return binary’s fat offset. 0 if not relevant.
Name associated with the LC_FILESET_ENTRY binary
Return binary’s Filesets
Return the binary’s FunctionStarts if any, or None
Return list of all Function found
Return the first LoadCommand with the given TYPE or None if it is not present.
Overloaded function.
get_section(self, name: str) -> lief._lief.MachO.Section
Return the section from the given name or None if the section does not exist
get_section(self, segname: str, secname: str) -> lief._lief.MachO.Section
Return the section from the segment with the name given in the first parameter and with the section’s name provided in the second parameter. If the section cannot be found, it returns a nullptr
Return the SegmentCommand from the given name
Return the Symbol from the given name
Check if the current binary has a LoadCommand with the given TYPE
True if the binary has a BuildVersion command
True if the binary is signed (i.e. has a CodeSignature command)
True if the binary is signed (i.e. has a CodeSignatureDir command) with the command LC_DYLIB_CODE_SIGN_DRS
True if the binary has a DataInCode command
True if the binary has a DyldChainedFixups command
True if the binary has a DyldEnvironment command
True if the binary has a DyldExportsTrie command
True if the binary has a DylinkerCommand command.
True if the binary has a DynamicSymbolCommand command.
True if the binary has a EncryptionInfo command
True if the binary has an entrypoint.
Basically for libraries it will return false
Return True if the binary has filesets
True if the binary has a FunctionStarts command.
True if the binary embeds the Linker optimization hint command (LinkerOptHint)
True if the binary has a MainCommand command.
Return True if the heap is flagged as non-executable. False otherwise.
Return True if the stack is flagged as non-executable. False otherwise.
True if the binary has a RPathCommand command.
Check if a section with the given name exists
Check if a SegmentCommand with the given name exists
True if the binary has a SegmentSplitInfo command
True if the binary has a SourceVersion command.
True if the binary has a SubFramework command
True if the binary has a SymbolCommand command.
True if the binary has a ThreadCommand command.
True if the binary embeds the Two Level Hint command (TwoLevelHints)
True if the binary has a UUIDCommand command.
True if the binary has a VersionMin command.
Return binary’s Header
Return the binary’s imagebase which is the base address where segments are mapped (without the ASLR). 0 if not relevant.
Return the binary’s Symbol which are imported
True if this binary targets iOS
True if this binary targets macOS
Check if the given address is encompassed between the range of virtual addresses.
See: va_ranges
Bases: object
Iterator over lief._lief.MachO.LoadCommand
Bases: object
Iterator over lief._lief.MachO.Symbol
Bases: object
Iterator over lief._lief.MachO.DylibCommand
Bases: object
Iterator over lief._lief.MachO.Relocation
Bases: object
Iterator over lief._lief.MachO.RPathCommand
Bases: object
Iterator over lief._lief.MachO.Section
Bases: object
Iterator over lief._lief.MachO.SegmentCommand
Bases: object
Iterator over lief._lief.MachO.SubClient
Bases: object
Iterator over lief._lief.MachO.Symbol
Return an iterator over the binary’s DylibCommand
Return the binary’s LinkerOptHint if any, or None
Return the binary’s MainCommand if any, or None
Return Objective-C metadata info if present
Warning
This is only available with the extended version of LIEF.
Return the range of offsets as a tuple (off_start, off_end)
Return the binary’s page size
Return the platform for which this Mach-O has been compiled
Return an iterator over binary’s Relocation
Overloaded function.
remove(self, load_command: lief._lief.MachO.LoadCommand) -> bool
Remove a LoadCommand
remove(self, type: lief._lief.MachO.LoadCommand.TYPE) -> bool
Remove all the LoadCommand with the given TYPE
remove(self, symbol: lief._lief.MachO.Symbol) -> bool
Remove the given Symbol
Remove the LoadCommand at the given index
Overloaded function.
remove_section(self, name: str, clear: bool = False) -> None
Remove the section with the given name
remove_section(self, segname: str, secname: str, clear: bool = False) -> None
Remove the section from the segment with the name given in the first parameter and with the section’s name provided in the second parameter.
Remove the CodeSignature (if any)
Remove all symbol(s) with the given name
Return the binary’s Routine if any, or None
Return the binary’s RPathCommand if any, or None
Return an iterator over the binary’s RPathCommand
Return the Section which encompasses the offset
Return the Section which encompasses the virtual address
Return an iterator over the binary’s Section
Return the SegmentCommand which encompasses the offset
Return the SegmentCommand which encompasses the virtual address
Return the binary’s SegmentSplitInfo if any, or None
Return an iterator over the binary’s SegmentCommand
Shift the content located right after the Load commands table. This operation can be used to add a new command
Shift the position on the __LINKEDIT data by width
Return the binary’s SourceVersion if any, or None
Return the binary’s SubFramework if any, or None
Return an iterator over the binary’s SubClient
Check if the binary is supporting ARM64 pointer authentication (arm64e)
Return the binary’s SymbolCommand if any, or None
Return an iterator over the symbol stubs.
These stubs are involved when calling an imported function and are similar to the ELF’s plt/got mechanism.
There are located in sections like: __stubs,__auth_stubs,__symbol_stub,__picsymbolstub4
Return an iterator over the binary’s Symbol
Return the binary’s ThreadCommand if any, or None
Return the binary’s TwoLevelHints if any, or None
Remove the symbol from the export table
Return list of Function found in the __unwind_info section
Return the binary’s UUIDCommand if any, or None
Return the range of virtual addresses as a tuple (va_start, va_end)
Return the binary’s VersionMin if any, or None
Convert the virtual address to an offset in the binary
Binary’s memory size when mapped
Overloaded function.
write(self, output: str) -> None
Rebuild the binary and write its content in the file given in the first parameter
write(self, output: str, config: lief._lief.MachO.Builder.config_t) -> None
Rebuild the binary and write its content in the file given in the first parameter. The
configparameter can be used to tweak the building process.
Bases: Object
Class that represents the Mach-O header
Bases: Enum
Bases: Enum
Bases: Flag
Add the given FLAGS
Return the CPU subtype supported by the Mach-O binary. For ARM architectures, this value could represent the minimum version for which the Mach-O binary has been compiled for.
Target CPU
Binary’s type
Binary’s flags
FLAGS as a list
The Mach-O magic bytes. These bytes determine whether it is a 32 bits Mach-O, a 64 bits Mach-O files etc.
Number of LoadCommand
Remove the given FLAGS
According to the official documentation, a reserved value
Size of all LoadCommand
Bases: Section
Class that represents a Mach-O section
Overloaded function.
__init__(self) -> None
__init__(self, section_name: str) -> None
Constructor from a section’s name
__init__(self, section_name: str, content: collections.abc.Sequence[int]) -> None
Constructor from a section’s name and its content
Bases: Flag
Bases: Enum
Add the given SECTION_FLAGS
Section’s alignment as a power of 2
Section’s flags masked with SECTION_FLAGS_MASK (see: FLAGS)
Check if the section has the given SECTION_FLAGS
True if the current section has a segment associated with
Bases: object
Iterator over lief._lief.MachO.Relocation
Number of relocations associated with this section
Offset of the relocation table. This value should be 0 for executable and libraries as the relocations are managed by the lief.MachO.DyldInfo.rebase
Other the other hand, for object files (.o) this value should not be 0
Iterator over the Relocation (if any)
Remove the given SECTION_FLAGS
According to the official loader.h file, this value is reserved for offset or index
According to the official loader.h file, this value is reserved for offset or index
According to the official loader.h file, this value is reserved for offset or index
SegmentCommand associated with the section or None if not present
The segment name associated with the section
Type of the section. This value can help to determine the purpose of the section (c.f. TYPE)
Bases: LoadCommand
Class which represents a SEGMENT / SEGMENT_64 command
Bases: Enum
Bases: Enum
Segment’s content
Segment’s file offset
Segment’s file size
Segment’s flags
Get the Section with the given name
Check if the given Section belongs to the current segment
Check if the given section name belongs to the current segment
Relative index of the segment in the segment table
Segment’s initial protection
Bases: object
Iterator over lief._lief.MachO.Relocation
Bases: object
Iterator over lief._lief.MachO.Section
Segment’s max protection
Segment’s name
Number of sections in this segment
Segment’s relocations
Segment’s sections
Segment’s virtual address
Segment’s virtual size
Bases: Object
Based class for the Mach-O load commands
Bases: Enum
Command type
Offset of the command within the Load Command Table
Command’s data
Size of the command (should be greather than sizeof(load_command))
Bases: LoadCommand
Class which represents a library dependency
Library’s compatibility version
Library’s current version
Library’s name
Library’s timestamp
Bases: LoadCommand
Class that represents the Mach-O linker, also named loader Most of the time, name returns /usr/lib/dyld
Path to the loader/linker
Bases: LoadCommand
Class that represents the UUID command
UUID as a list
Bases: LoadCommand
Class that represent the LC_MAIN command. This kind of command can be used to determine the entrypoint of an executable
Offset of the main function relative to the __TEXT segment
The initial stack size (if not 0)
Bases: Symbol
Class that represents a Symbol in a Mach-O file.
A Mach-O symbol can come from:
The symbols command (LC_SYMTAB / SymbolCommand)
The Dyld Export trie
The Dyld Symbol bindings
Bases: Enum
Bases: Enum
Bases: Enum
BindingInfo associated with the symbol if any, or None
Category of the symbol according to the LC_DYSYMTAB command
Symbol’s unmangled name
Return information about the symbol
ExportInfo associated with the symbol if any, or None
True if the symbol has an BindingInfo associated with
True if the symbol has an ExportInfo associated with
True if the symbol is defined as an external symbol.
DylibCommand the library where the symbol is exposed
Library ordinal + 1 (0 means self)
It returns the number of sections in which this symbol can be found. If the symbol can’t be found in any section, it returns 0 (NO_SECT)
Return the ORIGIN of this symbol
Raw value of nlist_xx.n_type
Type as defined by nlist_xx.n_type & N_TYPE
Bases: LoadCommand
Class that represents the LC_SYMTAB command
Number of symbols registered
Offset from the start of the file to the string table
Size of the size string table
Offset from the start of the file to the n_list associated with the command
Bases: LoadCommand
Class that represents the LC_DYSYMTAB command. This command completes the LC_SYMTAB (SymbolCommand) to provide a better granularity over the symbols layout.
Byte offset from the start of the file to the external reference table data. This field seems unused by recent Mach-O loader and should be set to 0
Byte offset from the start of the file to the module table data. This field seems unused by recent Mach-O loader and should be set to 0
Index of the first symbol in the group of defined external symbols.
Index of the first symbol in the group of local symbols.
Index of the first symbol in the group of undefined external symbols.
Byte offset from the start of the file to the indirect symbol table data.
Indirect symbol table is used by the loader to speed-up symbol resolution during the lazy binding process
References:
dyld-519.2.1/src/ImageLoaderMachOCompressed.cpp
dyld-519.2.1/src/ImageLoaderMachOClassic.cpp
Iterator over the indirect symbols indexed by this command
Bases: object
Iterator over lief._lief.MachO.Symbol
Byte offset from the start of the file to the local relocation table data. This field seems unused by recent Mach-O loader and should be set to 0
Byte offset from the start of the file to the module table data. This field seems unused by recent Mach-O loader and should be set to 0
Number of symbols in the group of defined external symbols.
Number of entries in the external reference table. This field seems unused by recent Mach-O loader and should be set to 0.
Number of entries in the external relocation table. This field seems unused by recent Mach-O loader and should be set to 0
Number of entries in the indirect symbol table.
Number of entries in the local relocation table. This field seems unused by recent Mach-O loader and should be set to 0
Number of symbols in the group of local symbols.
Number of entries in the module table. This field seems unused by recent Mach-O loader and should be set to 0.
Number of entries in the table of contents Should be set to 0 on recent Mach-O
Number of symbols in the group of undefined external symbols.
Byte offset from the start of the file to the table of contents data. Table of content is used by legacy Mach-O loader and this field should be set to 0
Bases: LoadCommand
Class that represents the LC_DYLD_INFO and LC_DYLD_INFO_ONLY commands
Bases: Enum
Bases: Enum
Bases: Enum
Bind information as a tuple (offset, size)
Dyld binds an image during the loading process, if the image requires any pointers to be initialized to symbols in other images. The rebase information is a stream of byte sized opcodes for which symbolic names start with BIND_OPCODE_.
Conceptually the bind information is a table of tuples: (seg-index, seg-offset, type, symbol-library-ordinal, symbol-name, addend) The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like for runs of pointers initialzed to the same value can be encoded in a few bytes.
See also
/usr/include/mach-o/loader.h
Return the binding’s opcodes as list of bytes
Return an iterator over Dyld’s BindingInfo
Export information as a tuple (offset, size)
The symbols exported by a dylib are encoded in a trie. This is a compact representation that factors out common prefixes.
It also reduces LINKEDIT pages in RAM because it encodes all information (name, address, flags) in one small, contiguous range. The export area is a stream of nodes. The first node sequentially is the start node for the trie.
Nodes for a symbol start with a byte that is the length of the exported symbol information for the string so far. If there is no exported symbol, the byte is zero. If there is exported info, it follows the length byte. The exported info normally consists of a flags and offset both encoded in uleb128. The offset is location of the content named by the symbol. It is the offset from the mach_header for the image.
After the initial byte and optional exported symbol information is a byte of how many edges (0-255) that this node has leaving it, followed by each edge. Each edge is a zero terminated cstring of the addition chars in the symbol, followed by a uleb128 offset for the node that edge points to.
See also
/usr/include/mach-o/loader.h
Return Export’s trie as list of bytes
Return an iterator over Dyld’s ExportInfo
Bases: object
Iterator over lief._lief.MachO.DyldBindingInfo
Bases: object
Iterator over lief._lief.MachO.ExportInfo
Lazy Bind information as a tuple (offset, size)
Some uses of external symbols do not need to be bound immediately. Instead they can be lazily bound on first use. The lazy_bind are contains a stream of BIND opcodes to bind all lazy symbols. Normal use is that dyld ignores the lazy_bind section when loading an image. Instead the static linker arranged for the lazy pointer to initially point to a helper function which pushes the offset into the lazy_bind area for the symbol needing to be bound, then jumps to dyld which simply adds the offset to lazy_bind_off to get the information on what to bind.
See also
/usr/include/mach-o/loader.h
Return lazy binding’s opcodes as list of bytes
Rebase information as a tuple (offset, size)
Dyld rebases an image whenever dyld loads it at an address different from its preferred address. The rebase information is a stream of byte sized opcodes for which symbolic names start with REBASE_OPCODE_.
Conceptually the rebase information is a table of tuples: (seg-index, seg-offset, type)
The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like “every n’th offset for m times” can be encoded in a few bytes
See also
/usr/include/mach-o/loader.h
Return the rebase’s opcodes as list of bytes
Return the bind opcodes in a humman-readable way
Return the export trie in a humman-readable way
Return the weak bind opcodes in a humman-readable way
Return the rebase opcodes in a humman-readable way
Return the weak bind opcodes in a humman-readable way
Weak Bind information as a tuple (offset, size)
Some C++ programs require dyld to unique symbols so that all images in the process use the same copy of some code/data.
This step is done after binding. The content of the weak_bind info is an opcode stream like the bind_info. But it is sorted alphabetically by symbol name. This enables dyld to walk all images with weak binding information in order and look for collisions. If there are no collisions, dyld does no updating. That means that some fixups are also encoded in the bind_info. For instance, all calls to operator new are first bound to libstdc++.dylib using the information in bind_info. Then if some image overrides operator new that is detected when the weak_bind information is processed and the call to operator new is then rebound.
See also
/usr/include/mach-o/loader.h
Return Weak binding’s opcodes as list of bytes
Bases: LoadCommand
Class which represents the LC_FUNCTION_STARTS command
This command is an array of ULEB128 encoded values
Add a new function
The original content as a bytes stream
Offset in the binary where start functions are located
Size of the functions list in the binary
Addresses of every function entry point in the executable
This allows functions to exist for which there are no entries in the symbol table.
Warning
The address is relative to the __TEXT segment
Bases: LoadCommand
Class that represents the MachO SOURCE_VERSION This command is used to provide the version of the sources used to build the binary
Version as a tuple of 5 integers
Bases: LoadCommand
Class that wraps the LC_VERSION_MIN_MACOSX, LC_VERSION_MIN_IPHONEOS, … commands
SDK as a tuple of 3 integers
Version as a tuple of 3 integers
Bases: LoadCommand
Class that represents the LC_ROUTINE/LC_ROUTINE64 commands. Accodring to the Mach-O loader.h documentation:
> The routines command contains the address of the dynamic shared library > initialization routine and an index into the module table for the module > that defines the routine. Before any modules are used from the library the > dynamic linker fully binds the module that defines the initialization routine > and then calls it. This gets called before any module initialization > routines (used for C++ static constructors) in the library.
Address of initialization routine
Index into the module table that the init routine is defined in
Bases: Relocation
It extends the LIEF lief.Relocation abstract class and it is sub-classed by
Bases: Enum
For OBJECT or (origin is RELOC_TABLE) this is an offset from the start of the Section to the item containing the address requiring relocation.
For EXECUTE / DYLIB or (origin is DYLDINFO) this is a virtual_address.
CPU_TYPE of the relocation
True if the relocation has a SegmentCommand associated with
ORIGIN of the relocation
For OBJECT file it should be RELOC_TABLE
Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.
For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.
Section associated with the relocation if any, or None
SegmentCommand associated with the relocation if any, or None
Symbol associated with the relocation if any, or None
Type of the relocation according to the architecture and/or origin
If origin is RELOC_TABLE:
See:
If origin is DYLDINFO, the value is associated with REBASE_TYPE.
Bases: Relocation
Class that represents a relocation presents in the MachO object file (.o). Usually, this kind of relocation is found in the lief.MachO.Section.
True if the relocation is a scattered one
For scattered relocations, the address of the relocatable expression for the item in the file that needs to be updated if the address is changed.
For relocatable expressions with the difference of two section addresses, the address from which to subtract (in mathematical terms, the minuend) is contained in the first relocation entry and the address to subtract (the subtrahend) is contained in the second relocation entry.”,
Bases: Relocation
Class that represents a relocation found in the DyldInfo structure.
While this class does not have an associated structure in the Mach-O format specification, it provides a convenient interface for the lief.MachO.DyldInfo.rebase values
See also: RelocationObject
Bases: Relocation
Class that represents a rebase relocation found in the LC_DYLD_CHAINED_FIXUPS command.
This class extends lief.Relocation (and lief.MachO.Relocation) in which address is set to the absolute virtual address where the relocation must take place (e.g. 0x10000d270).
On the other hand, target contains the value that should be set at address if the imagebase is imagebase (e.g. 0x1000073a8).
If the Mach-O loader chooses another base address (like 0x7ff100000), it must set 0x10000d270 to 0x7ff1073a8.
(unscaled) next offset in the chain
Bases: Object
Class that provides an interface over an entry in DyldInfo structure
This class does not represent a structure that exists in the Mach-O format specifications but it provides a view of a binding operation that is performed by the Dyld binding bytecode (LC_DYLD_INFO) or the Dyld chained fixups (DYLD_CHAINED_FIXUPS)
See: ChainedBindingInfo, DyldBindingInfo
Value added to the segment’s virtual address when binding
Binding’s address
True if the binding info has a DylibCommand associated with
True if the binding info has a SegmentCommand associated with
DylibCommand associated with the binding if any, or None
SegmentCommand associated with the binding if any, or None
Symbol associated with the binding if any, or None
Bases: BindingInfo
This class represents a symbol binding operation associated with the LC_DYLD_INFO bytecode.
This class does not represent a structure that exists in the Mach-O format specifications but it provides a view on an entry of the Dyld binding opcodes.
See also: BindingInfo
Bases: Enum
Bases: Enum
BINDING_CLASS of the binding
BIND_TYPES of the binding.
Usually, it is POINTER.
Original relative offset of the binding opcodes
Bases: BindingInfo
This class represents a symbol binding operation associated with the LC_DYLD_CHAINED_FIXUPS command.
This class does not represent a structure that exists in the Mach-O format specifications but it provides a view on an entry.
See also: BindingInfo
DYLD_CHAINED_FORMAT of the import
Offset of the entry in the chained fixups
DYLD_CHAINED_PTR_FORMAT of the import
Bases: Object
Class that provides an interface over the Dyld export info
This class does not represent a structure that exists in the Mach-O format specification but provides a view on an entry of the Dyld export trie.
Bases: Flag
Bases: Enum
The address of the export
Symbol alias if the current symbol is re-exported
If the current symbol has an alias, it returns the DylibCommand command associated with
Return flags as a list of FLAGS
Check if the flag FLAGS given in first parameter is present
The export’s kind: regular, thread local, absolute, … (KIND)
Original offset in the export Trie
Symbol associated with the export if any, or None
Bases: LoadCommand
Class that represents the LC_THREAD / LC_UNIXTHREAD commands and that can be used to get the binary entrypoint when the LC_MAIN (MainCommand) is not present
Generally speaking, this command aims at defining the original state of the main thread which includes the registers’ values
The CPU architecture that is targeted by this ThreadCommand
Size of the thread state data with 32-bits alignment.
This value should match len(state)
Integer that defines a special flavor for the thread.
The meaning of this value depends on the architecture. The list of the values can be found in the XNU kernel files:
xnu/osfmk/mach/arm/thread_status.h for the ARM/AArch64 architectures
xnu/osfmk/mach/i386/thread_status.h for the x86/x86-64 architectures
Return the initial Program Counter regardless of the underlying architecture. This value, when non null, can be used to determine the binary’s entrypoint.
Underneath, it works by looking for the PC register value in the state data
The actual thread state as a vector of bytes. Depending on the architecture(), these data can be casted into x86_thread_state_t, x86_thread_state64_t, …
Bases: LoadCommand
@rpath path
Bases: LoadCommand
The raw signature as a bytes stream
Offset in the binary where the signature starts
Size of the raw signature
Bases: LoadCommand
Interface of the LC_DATA_IN_CODE command
This command is used to list slices of code sections that contain data. The slices information are stored as an array of DataCodeEntry
Add an new DataCodeEntry
The original content as a bytes stream
Start of the array of the DataCodeEntry entries
Whole size of the array (size = sizeof(DataCodeEntry) * nb_elements)
Iterator over DataCodeEntry
Bases: Object
Interface over an entry in the DataInCode command
Bases: Enum
Length of the data
Offset of the data
Type of the data (TYPES
Bases: LoadCommand
Class that represents the SEGMENT_SPLIT_INFO command
The original content as a bytes stream
Offset in the binary where the data start
Size of the raw data
Bases: LoadCommand
Class that represents the SubFramework command. Accodring to the Mach-O loader.h documentation:
> A dynamically linked shared library may be a subframework of an umbrella > framework. If so it will be linked with “-umbrella umbrella_name” where > Where “umbrella_name” is the name of the umbrella framework. A subframework > can only be linked against by its umbrella framework or other subframeworks > that are part of the same umbrella framework. Otherwise the static link > editor produces an error and states to link against the umbrella framework. > The name of the umbrella framework for subframeworks is recorded in the > following structure.
Name of the umbrella framework
Bases: LoadCommand
Class that represents the SubClient command. Accodring to the Mach-O loader.h documentation:
> For dynamically linked shared libraries that are subframework of an umbrella > framework they can allow clients other than the umbrella framework or other > subframeworks in the same umbrella framework. To do this the subframework > is built with “-allowable_client client_name” and an LC_SUB_CLIENT load > command is created for each -allowable_client flag. The client_name is > usually a framework name. It can also be a name used for bundles clients > where the bundle is built with “-client_name client_name”.
Name of the sub client
Bases: LoadCommand
Class that represents a LC_DYLD_ENVIRONMENT which is used by the Mach-O linker/loader to initialize an environment variable
Environment variable as a string
Bases: LoadCommand
Class that represents the LC_ENCRYPTION_INFO / LC_ENCRYPTION_INFO_64 commands
The encryption info is usually present in Mach-O executables that target iOS to encrypt some sections of the binary
The encryption system. 0 means no encrypted
File offset of encrypted range
File size of encrypted range
Bases: LoadCommand
Bases: Enum
Minimal OS version on which this binary was built to run
Target PLATFORMS
SDK Version
List of BuildToolVersion used when while this binary
Bases: Object
Class that represents a tool’s version that was involved in the build of the binary
Bases: Enum
TOOLS type
Version of the tool
Bases: LoadCommand
Class associated with the LC_FILESET_ENTRY commands
Return the Binary object associated with the entry
Original offset in the kernel cache
Name of the underlying MachO binary
Memory address where the MachO file should be mapped
Bases: LoadCommand
Class that represents the LC_DYLD_CHAINED_FIXUPS command
This command aims at providing rebase and binding information like the DyldInfo ‘s bytecode. Compared to the DyldInfo bytecode, these chained fixups are taking less space.
Iterator over the bindings ChainedBindingInfo associated with this command
Bases: object
Structure that mirrors the raw dyld_chained_starts_in_segment which aims at providing information about the chained rebase/bind fixups
The relocations provided by this structure can be accessed through relocations
for 32-bit OS, any value beyond this is not a pointer
Original offset of the structure, relative to starts_offset
How many pages are in the page_start array
Likely 0x1000 for x86/x86_64 architectures and 0x4000 for ARM64 architecture
Offset in the SegmentCommand of the first element of the chain.
How pointers are encoded
SegmentCommand in which the rebase/bind fixups take place
Offset of the segment’s data from the beginning of the file. (it should match file_offset)
sizeof(size) + sizeof(page_size) + ... + sizeof(pointer_format)
Iterator over the chained fixup metadata, chained_starts_in_segment
Offset of the LC_DYLD_CHAINED_FIXUPS chained payload. This offset should point in the __LINKEDIT segment
Size of the LC_DYLD_CHAINED_FIXUPS payload
Chained fixups version. The loader (as far of dyld v852.2) checks that this value is set to 0.
Number of imported symbol names
The format of the imports (ChainedBindingInfo)
Offset of imports table in chain data
Bases: object
Iterator over lief._lief.MachO.ChainedBindingInfo
Bases: object
Iterator over lief._lief.MachO.chained_starts_in_segment
Return the raw content of the command
offset of dyld_chained_starts_in_image in chain_data
The compression algorithm (if any) used to store the symbols 0 means uncompressed while 1 means zlib compressed.
As far of the version v852.2 of dyld loader, it only supports uncompressed format
Offset of symbol strings in chain data
Bases: LoadCommand
Class that represents the LC_DYLD_EXPORTS_TRIE command
In recent Mach-O binaries, this command replace the DyldInfo export trie buffer
The raw export trie
Offset of the trie in the binary. This offset should point in the __LINKEDIT
Raw size of the trie
Iterator over the ExportInfo associated with this trie.
Bases: object
Iterator over lief._lief.MachO.ExportInfo
Show the trie in a humman-readable way
Bases: LoadCommand
The raw signature as a bytes stream
Offset in the binary where the signature starts
Size of the raw signature
Bases: LoadCommand
Class which represents the LC_TWOLEVEL_HINTS command
The original content as a bytes stream
Bases: object
Bases: LoadCommand
Class which represents the LC_LINKER_OPTIMIZATION_HINT command
The raw payload
Offset in the binary where the payload starts
Size of the raw payload
Bases: LoadCommand
Generic class when the command is not recognized by LIEF
Bases: object
This class represents a stub entry in sections like __stubs,__auth_stubs.
It wraps assembly instructions which are used to access the got where the address of the symbol is resolved.
Example:
0000000236a3c1bc: ___memcpy_chk
adrp x17, #0x241513aa8
add x17, x17, #0x241513aa8
ldr x16, [x17]
braa x16, x17
The virtual address where the stub is located
The (raw) instructions of this entry as a memory view of bytes
The address resolved by this stub.
For instance, given this stub:
0x3eec: adrp x16, #4096
0x3ef0: ldr x16, [x16, #24]
0x3ef4: br x16
The function returns: 0x4018.
Warning
This function is only available with LIEF’s extended version
Bases: object
Bases: Enum
Bases: Enum
Bases: Enum
Bases: Enum
Bases: Enum
Bases: Enum