ionicons-v5-d 0.16.0 (441bb46)
Updated on 10/12/2024, 11:03:30.

Python

Parser

lief.PE.parse(*args) → lief.PE.Binary | None
lief.PE.parse(raw: collections.abc.Sequence[int], config: lief._lief.PE.ParserConfig = <lief._lief.PE.ParserConfig object at 0x7b0898682430>) → lief._lief.PE.Binary | None
lief.PE.parse(obj: Union[io.IOBase | os.PathLike], config: lief._lief.PE.ParserConfig = <lief._lief.PE.ParserConfig object at 0x7b0898682450>) → lief._lief.PE.Binary | None

Overloaded function.

  1. parse(filename: str, config: lief._lief.PE.ParserConfig = <lief._lief.PE.ParserConfig object at 0x7b0898682410>) -> Optional[lief._lief.PE.Binary]

Parse the PE binary from the given file path and return a Binary object

  1. parse(raw: collections.abc.Sequence[int], config: lief._lief.PE.ParserConfig = <lief._lief.PE.ParserConfig object at 0x7b0898682430>) -> Optional[lief._lief.PE.Binary]

Parse the PE binary from the given list of bytes and return a lief.PE.Binary object

  1. parse(obj: Union[io.IOBase | os.PathLike], config: lief._lief.PE.ParserConfig = <lief._lief.PE.ParserConfig object at 0x7b0898682450>) -> Optional[lief._lief.PE.Binary]

Parse the PE binary from the given parameter and return a lief.PE.Binary object

class lief.PE.ParserConfig(self)

Bases: object

This class is used to tweak the PE Parser (Parser)

all = <lief._lief.PE.ParserConfig object>
property parse_exports → bool

Parse PE Exports Directory

property parse_imports → bool

Parse PE Import Directory

property parse_reloc → bool

Parse PE relocations

property parse_rsrc → bool

Parse PE resources tree

property parse_signature → bool

Parse PE Authenticode signature

Binary

class lief.PE.Binary(self, type: lief._lief.PE.PE_TYPE)

Bases: Binary

Class which represents a PE binary which is the main interface to manage and modify a PE executable.

This object can be instantiated through lief.parse() or lief.PE.parse() while the constructor of this object can be used to craft a binary from scratch (see: 02 - Create a PE from scratch)

add_import_function(self, import_name: str, function_name: str) → lief.PE.ImportEntry

Add a function to the given Import name

add_library(self, import_name: str) → lief.PE.Import

Add an Import by name

add_relocation(self, relocation: lief.PE.Relocation) → lief.PE.Relocation

Add a Relocation to the binary

add_section(self, section: lief.PE.Section, type: lief.PE.SECTION_TYPES) → lief.PE.Section

Add a Section to the binary.

authentihash(self, algorithm: lief.PE.ALGORITHMS) → bytes

Compute the authentihash according to the ALGORITHMS given in the first parameter

property authentihash_md5 → bytes

Authentihash MD5 value

property authentihash_sha1 → bytes

Authentihash SHA1 value

property authentihash_sha256 → bytes

Authentihash SHA-256 value

property authentihash_sha512 → bytes

Authentihash SHA-512 value

property codeview_pdb → lief.PE.CodeViewPDB

Return the CodeViewPDB if present

compute_checksum(self) → int

Re-compute the value of checksum. If both values do not match, it could mean that the binary has been modified after the compilation.

This value is computed by LIEF for the current binary object.

property data_directories → lief.PE.Binary.it_data_directories

Return an iterator over the DataDirectory

data_directory(self, type: lief.PE.DataDirectory.TYPES) → lief.PE.DataDirectory

Return the DataDirectory object from the given TYPES type

property debug → lief.PE.Binary.it_debug

Return the Debug

property delay_imports → lief.PE.Binary.it_delay_imports

Return an iterator over the DelayImport

property dos_header → lief.PE.DosHeader

Return the DosHeader

property dos_stub → memoryview

DOS stub content as a list of bytes

property exception_functions → list[lief.Function]

Function found in the Exception directory

property functions → list[lief.Function]

All Function found in the binary

get_delay_import(self, import_name: str) → lief.PE.DelayImport

Return the DelayImport from the given name or None if not not found

get_export(self) → lief.PE.Export

Return the Export object

get_import(self, import_name: str) → lief.PE.Import

Return the Import from the given name or None if not not found

get_section(self, section_name: str) → lief.PE.Section

Return the Section object from the given name or None if not not found

property has_configuration → bool

True if the current binary has LoadConfiguration

property has_debug → bool

True if the current binary has a Debug object

has_delay_import(self, import_name: str) → bool

True if the binary imports the given library name

property has_delay_imports → bool

True if the current binary has delay imports (DelayImport)

property has_exceptions → bool

True if the current binary uses Exceptions

property has_exports → bool

True if the current binary has a Export object

has_import(self, import_name: str) → bool

True if the binary imports the given library name

property has_imports → bool

True if the current binary has imports (Import)

property has_relocations → bool

True if the current binary uses Relocation

property has_resources → bool

True if the current binary has a Resources object

property has_rich_header → bool

True if the current binary has a RichHeader object

property has_signatures → bool

True if the binary is signed with the PE authenticode (Signature)

property has_tls → bool

True if the current binary has a TLS object

property header → lief.PE.Header

Return the Header

property imports → lief.PE.Binary.it_imports

Return an iterator over the Import libraries

property is_reproducible_build → bool

True if the binary was compiled with a reproducible build directive (Debug)

class it_const_signatures

Bases: object

Iterator over lief._lief.PE.Signature

class it_data_directories

Bases: object

Iterator over lief._lief.PE.DataDirectory

class it_debug

Bases: object

Iterator over lief._lief.PE.Debug

class it_delay_imports

Bases: object

Iterator over lief._lief.PE.DelayImport

class it_imports

Bases: object

Iterator over lief._lief.PE.Import

class it_relocations

Bases: object

Iterator over lief._lief.PE.Relocation

class it_section

Bases: object

Iterator over lief._lief.PE.Section

class it_symbols

Bases: object

Iterator over lief._lief.PE.Symbol

property load_configuration → lief.PE.LoadConfiguration

Return the LoadConfiguration object or None if not present

property optional_header → lief.PE.OptionalHeader

Header that follows the header. It is named optional from the COFF specifications but it is mandatory in a PE file.

property overlay → memoryview

Return the overlay content as a list of bytes

property overlay_offset → int

Return the original overlay offset

predict_function_rva(self, library: str, function: str) → int

Try to predict the RVA of the given function name in the given import library name

property relocations → lief.PE.Binary.it_relocations

Return an iterator over the Relocation

remove(self, section: lief.PE.Section, clear: bool) → None

Remove the Section given in first parameter

remove_all_libraries(self) → None

Remove all imported libraries

remove_all_relocations(self) → None
remove_library(self, import_name: str) → None

Remove the Import from the given name

property resources → lief.PE.ResourceNode

Return the ResourceNode tree or None if not not present

property resources_manager → lief.PE.ResourcesManager | lief.lief_errors

Return the ResourcesManager to manage resources

property rich_header → lief.PE.RichHeader

RichHeader object (if present)

rva_to_offset(self, rva_address: int) → int

Convert a relative virtual address to an offset

The conversion is performed by looking for the section that encompasses the provided RVA.

section_from_offset(self, offset: int) → lief.PE.Section

Return the Section which encompasses the provided offset. It returns None if a section can’t be found.

section_from_rva(self, rva: int) → lief.PE.Section

Return the Section which encompasses the provided relative virtual address. If a section can’t be found, it returns None.

property sections → lief.PE.Binary.it_section

Return binary’s an iterator over the PE’s Section

property signatures → lief.PE.Binary.it_const_signatures

Return an iterator over the Signature objects

property sizeof_headers → int

Size of all the PE headers

property symbols → list[lief.PE.Symbol]

Return binary’s Symbol

property tls → lief.PE.TLS

TLS object (if present)

va_to_offset(self, va_address: int) → int

Convert an absolute virtual address into an offset

See: rva_to_offset()

verify_signature(*args) → lief.PE.Signature.VERIFICATION_FLAGS

Overloaded function.

  1. verify_signature(self, checks: lief._lief.PE.Signature.VERIFICATION_CHECKS = VERIFICATION_CHECKS.DEFAULT) -> lief._lief.PE.Signature.VERIFICATION_FLAGS

    Verify the binary against the embedded signature(s) (if any)

    First off, it checks that the embedded signatures are correct (c.f. lief.PE.Signature.check()) and then it checks that the authentihash matches lief.PE.ContentInfo.digest

    One can tweak the verification process with the lief.PE.Signature.VERIFICATION_CHECKS flags

    See also

    lief.PE.Signature.check()

  2. verify_signature(self, signature: lief._lief.PE.Signature, checks: lief._lief.PE.Signature.VERIFICATION_CHECKS = VERIFICATION_CHECKS.DEFAULT) -> lief._lief.PE.Signature.VERIFICATION_FLAGS

    Verify the binary with the Signature object provided in the first parameter It can be used to verify a detached signature:

    detached = lief.PE.Signature.parse("sig.pkcs7")
binary.verify_signature(detached)
property virtual_size → int

Return the binary’s virtual size.

This value should match sizeof_image

write(self, output_path: str) → None

Build the binary and write the result to the given output file

Dos Header

class lief.PE.DosHeader

Bases: Object

Class which represents the DosHeader, the first structure presents at the beginning of a PE file.

Most of the attributes of this structures are not relevant, except addressof_new_exeheader

property addressof_new_exeheader → int
property addressof_relocation_table → int
property checksum → int
copy(self) → lief.PE.DosHeader

Duplicate the current instance of this object

create(arg: lief.PE.PE_TYPE) → lief.PE.DosHeader = <nanobind.nb_func object>
property file_size_in_pages → int
property header_size_in_paragraphs → int
property initial_ip → int
property initial_relative_cs → int
property initial_relative_ss → int
property initial_sp → int
property magic → int
property maximum_extra_paragraphs → int
property minimum_extra_paragraphs → int
property numberof_relocation → int
property oem_id → int
property oem_info → int
property overlay_number → int
property used_bytes_in_last_page → int

Optional Header

class lief.PE.OptionalHeader

Bases: Object

Class which represents the PE OptionalHeader structure.

class DLL_CHARACTERISTICS(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: IntFlag

APPCONTAINER = 4096
DYNAMIC_BASE = 64
FORCE_INTEGRITY = 128
GUARD_CF = 16384
HIGH_ENTROPY_VA = 32
NO_BIND = 2048
NO_ISOLATION = 512
NO_SEH = 1024
NX_COMPAT = 256
TERMINAL_SERVER_AWARE = 32768
WDM_DRIVER = 8192
from_value(arg: int) → lief.PE.OptionalHeader.DLL_CHARACTERISTICS = <nanobind.nb_func object>
class SUBSYSTEM(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

EFI_APPLICATION = 10
EFI_BOOT_SERVICE_DRIVER = 11
EFI_ROM = 13
EFI_RUNTIME_DRIVER = 12
NATIVE = 1
NATIVE_WINDOWS = 8
OS2_CUI = 5
POSIX_CUI = 7
UNKNOWN = 0
WINDOWS_BOOT_APPLICATION = 16
WINDOWS_CE_GUI = 9
WINDOWS_CUI = 3
WINDOWS_GUI = 2
XBOX = 14
from_value(arg: int) → lief.PE.OptionalHeader.SUBSYSTEM = <nanobind.nb_func object>
add(self, characteristic: lief.PE.OptionalHeader.DLL_CHARACTERISTICS) → None

Add the given DLL_CHARACTERISTICS

property addressof_entrypoint → int

The address of the entry point relative to the image base when the executable file is loaded into memory. For program images, this is the starting address. For device drivers, this is the address of the initialization function.

An entry point is optional for DLLs. When no entry point is present, this field must be zero.

property baseof_code → int

Address relative to the imagebase where the binary’s code starts

property baseof_data → int

Address relative to the imagebase where the binary’s data starts.

Warning

This value is not present for PE64 files

property checksum → int

The image file checksum. The algorithm for computing the checksum is incorporated into IMAGHELP.DLL. The following are checked for validation at load time all drivers, any DLL loaded at boot time, and any DLL that is loaded into a critical Windows process.

copy(self) → lief.PE.OptionalHeader

Duplicate the current instance of this object

create(type: lief.PE.PE_TYPE) → lief.PE.OptionalHeader = <nanobind.nb_func object>
property dll_characteristics → int

Some characteristics (DLL_CHARACTERISTICS) of the underlying binary like the support of the PIE.

The prefix dll comes from the official PE specifications but these characteristics are also used for executables

property dll_characteristics_lists → list[lief.PE.OptionalHeader.DLL_CHARACTERISTICS]

dll_characteristics as a list of DLL_CHARACTERISTICS

property file_alignment → int

The alignment factor (in bytes) that is used to align the raw data of sections in the image file. The value should be a power of 2 between 512 and 64K, inclusive. The default value is 512. If the section_alignment is less than the architecture’s page size, then file_alignment must match section_alignment.

has(self, characteristics: lief.PE.OptionalHeader.DLL_CHARACTERISTICS) → bool

True if the given DLL_CHARACTERISTICS is in the dll_characteristics

property imagebase → int

The preferred base address when mapping the binary in memory

property loader_flags → int

According to the PE specifications, this value is reserved and should be 0.

property magic → lief.PE.PE_TYPE

Magic value (PE_TYPE) that identifies a PE32 from a PE64

property major_image_version → int

The major version number of the image.

property major_linker_version → int

The linker major version number

property major_operating_system_version → int

The major version number of the required operating system.

property major_subsystem_version → int

The major version number of the subsystem.

property minor_image_version → int

The minor version number of the image.

property minor_linker_version → int

The linker minor version number

property minor_operating_system_version → int

The minor version number of the required operating system.

property minor_subsystem_version → int

The minor version number of the subsystem

property numberof_rva_and_size → int

The number of DataDirectory that follow this header

remove(self, characteristic: lief.PE.OptionalHeader.DLL_CHARACTERISTICS) → None

Remove the given DLL_CHARACTERISTICS

property section_alignment → int

The alignment (in bytes) of sections when they are loaded into memory. It must be greater than or equal to file_alignment and the default is the page size for the architecture.

property sizeof_code → int

The size of the code .text section or the sum of all the sections that contain code (ie. Section with the flag CNT_CODE)

property sizeof_headers → int

The combined size of an MS-DOS stub, PE header, and section headers rounded up to a multiple of file_alignment.

property sizeof_heap_commit → int

The size of the local heap space to commit.

property sizeof_heap_reserve → int

The size of the local heap space to reserve.

Only sizeof_heap_commit is available one page at a time until the reserve size is reached.

property sizeof_image → int

The size (in bytes) of the image, including all headers, as the image is loaded in memory. It must be a multiple of section_alignment and should match virtual_size.

property sizeof_initialized_data → int

The size of the initialized data which are usually located in the .data section. If the initialized data are split across multiple sections, it is the sum of the sections.

The sections associated with the initialized data are usually identified with the flag CNT_INITIALIZED_DATA

property sizeof_stack_commit → int

The size of the stack to commit.

property sizeof_stack_reserve → int

The size of the stack to reserve.

Only sizeof_stack_commit is committed, the rest is made available one page at a time until the reserve size is reached.

property sizeof_uninitialized_data → int

The size of the uninitialized data which are usually located in the .bss section. If the uninitialized data are split across multiple sections, it is the sum of the sections.

The sections associated with the uninitialized data are usually identified with the flag CNT_UNINITIALIZED_DATA

property subsystem → lief.PE.OptionalHeader.SUBSYSTEM

Target subsystem (SUBSYSTEM) like Driver, XBox, Windows GUI, ..

property win32_version_value → int

Reserved, must be zero.

Data Directory

class lief.PE.DataDirectory(self)

Bases: Object

Class that represents a PE data directory entry

class TYPES(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

ARCHITECTURE = 7
BASE_RELOCATION_TABLE = 5
BOUND_IMPORT = 11
CERTIFICATE_TABLE = 4
CLR_RUNTIME_HEADER = 14
DEBUG_DIR = 6
DELAY_IMPORT_DESCRIPTOR = 13
EXCEPTION_TABLE = 3
EXPORT_TABLE = 0
GLOBAL_PTR = 8
IAT = 12
IMPORT_TABLE = 1
LOAD_CONFIG_TABLE = 10
RESERVED = 15
RESOURCE_TABLE = 2
TLS_TABLE = 9
UNKNOWN = 16
from_value(arg: int) → lief.PE.DataDirectory.TYPES = <nanobind.nb_func object>
copy(self) → lief.PE.DataDirectory

Duplicate the current instance of this object

property has_section → bool

True if the current data directory is tied to a Section

property rva → int

Relative virtual address of the content associated with the current data directory

property section → lief.PE.Section

Section associated with the current data directory or None if not linked

property size → int

Size in bytes of the content associated with the current data directory

property type → lief.PE.DataDirectory.TYPES

Type (TYPES) of the current data directory

Section

Inheritance diagram of lief._lief.PE.Section
class lief.PE.Section(self)
class lief.PE.Section(self, content: collections.abc.Sequence[int], name: str = '', characteristics: int = 0)
class lief.PE.Section(self, name: str)

Bases: Section

Class which represents a PE section.

It extends the base class lief.Section

Overloaded function.

  1. __init__(self) -> None

  2. __init__(self, content: collections.abc.Sequence[int], name: str = '', characteristics: int = 0) -> None

Constructor from content, name and characteristics

  1. __init__(self, name: str) -> None

Constructor from a name

class CHARACTERISTICS(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Flag

ALIGN_1024BYTES = 11534336
ALIGN_128BYTES = 8388608
ALIGN_16BYTES = 5242880
ALIGN_1BYTES = 1048576
ALIGN_2048BYTES = 12582912
ALIGN_256BYTES = 9437184
ALIGN_2BYTES = 2097152
ALIGN_32BYTES = 6291456
ALIGN_4096BYTES = 13631488
ALIGN_4BYTES = 3145728
ALIGN_512BYTES = 10485760
ALIGN_64BYTES = 7340032
ALIGN_8192BYTES = 14680064
ALIGN_8BYTES = 4194304
CNT_CODE = 32
CNT_INITIALIZED_DATA = 64
CNT_UNINITIALIZED_DATA = 128
GPREL = 32768
LNK_COMDAT = 4096
LNK_INFO = 512
LNK_NRELOC_OVFL = 16777216
LNK_OTHER = 256
LNK_REMOVE = 2048
MEM_16BIT = 131072
MEM_DISCARDABLE = 33554432
MEM_EXECUTE = 536870912
MEM_LOCKED = 262144
MEM_NOT_CACHED = 67108864
MEM_NOT_PAGED = 134217728
MEM_PRELOAD = 524288
MEM_PURGEABLE = 65536
MEM_READ = 1073741824
MEM_SHARED = 268435456
MEM_WRITE = 2147483648
TYPE_NO_PAD = 8
from_value(arg: int) → lief.PE.Section.CHARACTERISTICS = <nanobind.nb_func object>
property characteristics → int

The CHARACTERISTICS that describe the characteristics of the section

property characteristics_lists → list[lief.PE.Section.CHARACTERISTICS]

characteristics as a list

copy(self) → lief.PE.Section

Duplicate the current instance of this object

has_characteristic(self, characteristic: lief.PE.Section.CHARACTERISTICS) → bool

True if the section has the given CHARACTERISTICS

property numberof_line_numbers → int

The number of line-number entries for the section. This value should be zero for an image because COFF debugging information is deprecated.

See: pointerto_line_numbers

property numberof_relocations → int

The number of relocation entries for the section.

See: pointerto_relocation

property padding → bytes

Section padding content as bytes

property pointerto_line_numbers → int

The file pointer to the beginning of line-number entries for the section. This is set to zero if there are no COFF line numbers. This value should be zero for an image because COFF debugging information is deprecated and modern debug information relies on the PDB files.

property pointerto_raw_data → int

The offset of the section data in the PE file. Alias of offset

property pointerto_relocation → int

The file pointer to the beginning of the COFF relocation entries for the section. This is set to zero for executable images or if there are no relocations.

For modern PE binaries, this value is usually set to 0 as the relocations are managed by Relocation.

property sizeof_raw_data → int

Alias of size (size of the data in the section)

property virtual_size → int

The total size of the section when loaded into memory.

If this value is greater than sizeof_raw_data, the section is zero-padded.

Import

class lief.PE.Import(self)
class lief.PE.Import(self, library_name: str)

Bases: Object

Class that represents a PE import

Overloaded function.

  1. __init__(self) -> None

Default constructor

  1. __init__(self, library_name: str) -> None

Constructor from a library name

add_entry(*args) → lief.PE.ImportEntry

Add an ImportEntry (function) to the current import

property directory → lief.PE.DataDirectory

Return the DataDirectory associated with this import.

It should be the one at index lief.PE.DataDirectory.TYPES.IMPORT_TABLE. It can return None if the Import directory can’t be resolved.

property entries → lief.PE.Import.it_entries

Iterator over the ImportEntry (functions)

property forwarder_chain → int

The index of the first forwarder reference

get_entry(self, function_name: str) → lief.PE.ImportEntry

Return the ImportEntry with the given name or None if not found

get_function_rva_from_iat(self, function_name: str) → int | lief.lief_errors

Return the relative virtual address of the given function within the Import Address Table

property iat_directory → lief.PE.DataDirectory

Return the DataDirectory associated with the IAT table.

It should be the one at index lief.PE.DataDirectory.TYPES.IAT. It can return None if the IAT directory can’t be resolved.

property import_address_table_rva → int

The RVA of the import address table (IAT). The content of this table is identical to the content of the Import Lookup Table (ILT) until the image is bound.

Warning

This address could change when re-building the binary

property import_lookup_table_rva → int

The RVA of the import lookup table. This table contains the name or the ordinal for all the imports.

class it_entries

Bases: object

Iterator over lief._lief.PE.ImportEntry

property name → str | bytes

Library name (e.g. kernel32.dll)

property timedatestamp → int

The stamp that is set to zero until the image is bound.

After the image is bound, this field is set to the time/data stamp of the DLL

Import Entry

Inheritance diagram of lief._lief.PE.ImportEntry
class lief.PE.ImportEntry(self)
class lief.PE.ImportEntry(self, import_name: str)
class lief.PE.ImportEntry(self, data: int, name: str = '')
class lief.PE.ImportEntry(self, data: int, type: lief._lief.PE.PE_TYPE, name: str = '')
class lief.PE.ImportEntry(self, name: str, type: lief._lief.PE.PE_TYPE)

Bases: Symbol

Class that represents an entry (i.e. an import) in the import table (Import).

It extends the lief.Symbol generic class that provides the lief.Symbol.name and lief.Symbol.value

Overloaded function.

  1. __init__(self) -> None

  2. __init__(self, import_name: str) -> None

Constructor from a name

  1. __init__(self, data: int, name: str = '') -> None

Constructor from a data and an optionally name

  1. __init__(self, data: int, type: lief._lief.PE.PE_TYPE, name: str = '') -> None

Constructor from a data, a type and an optional name

  1. __init__(self, name: str, type: lief._lief.PE.PE_TYPE) -> None

Constructor from a name, and a type

copy(self) → lief.PE.ImportEntry

Duplicate the current instance of this object

property data → int

Raw value

property demangled_name → str

Demangled representation of the symbol or an empty string if it can’t be demangled.

property hint → int

Index into the lief.PE.Export.entries that is used to speed-up the symbol resolution

property iat_address → int

Original address of the entry in the Import Address Table

property iat_value → int

Value of the current entry in the Import Address Table. It should match the lookup table value.

property is_ordinal → bool

True if it is an import by ordinal

property name → str | bytes

Import name if not ordinal

property ordinal → int

Ordinal value (if any). See: is_ordinal

Delay Import

class lief.PE.DelayImport(self, library_name: str)

Bases: Object

Class that represents a PE delay import

Constructor from a library name

property attribute → int

Reserved and should be zero according to the PE specifications

property biat → int

RVA of the bound delay-load import address table or 0 if the table does not exist.

copy(self) → lief.PE.DelayImport

Duplicate the current instance of this object

property entries → lief.PE.DelayImport.it_entries

Iterator over the DelayImportEntry (functions)

property handle → int

The RVA of the module handle (in the .data section) It is used for storage by the routine that is supplied to manage delay-loading.

property iat → int

RVA of the delay-load import address table.

class it_entries

Bases: object

Iterator over lief._lief.PE.DelayImportEntry

property name → str | bytes

Library name (e.g. kernel32.dll)

property names_table → int

RVA of the delay-load import names table. The content of this table has the layout as the Import lookup table

property timestamp → int

The timestamp of the DLL to which this image has been bound.

property uiat → int

RVA of the unload delay-load import address table or 0 if the table does not exist.

According to the PE specifications, this table is an exact copy of the delay import address table that can be used to to restore the original IAT the case of unloading.

Delay Import Entry

Inheritance diagram of lief._lief.PE.DelayImportEntry
class lief.PE.DelayImportEntry(self)

Bases: Symbol

Class that represents an entry (i.e. a delay import) in the delay import table (DelayImport).

It extends the lief.Symbol generic class that provides the lief.Symbol.name and lief.Symbol.value

The meaning of lief.Symbol.value for this PE object is the address (as an RVA) in the IAT where the resolution should take place

copy(self) → lief.PE.DelayImportEntry

Duplicate the current instance of this object

property data → int

Raw value

property demangled_name → str

Demangled representation of the symbol or an empty string if it can’t be demangled.

property hint → int

Index into the lief.PE.Export.entries that is used to speed-up the symbol resolution

property iat_value → int

Value of the current entry in the delay-loaded import address table. See: iat

property is_ordinal → bool

True if it is an import by ordinal

property name → str | bytes

Delay import name if not ordinal

property ordinal → int

Ordinal value (if any). See: is_ordinal

TLS

class lief.PE.TLS(self)

Bases: Object

Class which represents the PE Thread Local Storage. This PE structure is also used to implement binary/library constructors.

Default constructor

property addressof_callbacks → int

Pointer to an array of TLS callback functions.

The array is null-terminated, so if there is no callback, this field points to 4 bytes set to zero.

See: callbacks

property addressof_index → int

The location to receive the TLS index assigned by the loader. This location should be located in a writable section like .data.

property addressof_raw_data → tuple[int, int]

Tuple (start address, end address) of the TLS template. The template is a block of data that is used to initialize TLS data. The system copies all of this data each time a thread is created, so it must not be corrupted.

Note

These addresses are not RVA. It is addresses for which there should be a base relocation in the .reloc section.

property callbacks → list[int]

List of the callback associated with the current TLS.

These functions are called before any other functions.

property characteristics → int

The four bits [23:20] describe alignment info. Possible values are those defined as IMAGE_SCN_ALIGN_*, which are also used to describe alignment of section in object files. The other 28 bits are reserved for future use.

copy(self) → lief.PE.TLS

Duplicate the current instance of this object

property data_template → memoryview

The initial content used to initialize TLS data.

property directory → lief.PE.DataDirectory

DataDirectory associated with the TLS object (or None if not linked)

property has_data_directory → bool

True if there is a DataDirectory associated with the TLS object

property has_section → bool

True if there is a Section associated with the TLS object

property section → lief.PE.Section

Section associated with the TLS object (or None if not linked)

property sizeof_zero_fill → int

Size in bytes of the zeros to be padded after the data specified by data_template.

Symbol

Inheritance diagram of lief._lief.PE.Symbol
class lief.PE.Symbol(self)

Bases: Symbol

property base_type → lief.PE.SYMBOL_BASE_TYPES
property complex_type → lief.PE.SYMBOL_COMPLEX_TYPES
property has_section → bool

True if symbols are located in a section

property name → str | bytes
property numberof_aux_symbols → int
property section → lief.PE.Section
property section_number → int
property storage_class → lief.PE.SYMBOL_STORAGE_CLASS
property type → int

Relocation

class lief.PE.Relocation(self)

Bases: Object

Class which represents the Base Relocation Block Usually, we find this structure in the .reloc section

add_entry(self, new_entry: lief.PE.RelocationEntry) → lief.PE.RelocationEntry

Add a new RelocationEntry

property block_size → int

The total number of bytes in the base relocation block. block_size = sizeof(BaseRelocationBlock) + nb_of_relocs * sizeof(uint16_t = RelocationEntry)

copy(self) → lief.PE.Relocation

Duplicate the current instance of this object

property entries → lief.PE.Relocation.it_entries

Iterator over the RelocationEntry

class it_entries

Bases: object

Iterator over lief._lief.PE.RelocationEntry

property virtual_address → int

The RVA for which the offset of the relocation entries (RelocationEntry) is added

Relocation Entry

Inheritance diagram of lief._lief.PE.RelocationEntry
class lief.PE.RelocationEntry(self)

Bases: Relocation

Class which represents an entry of the PE relocation table.

It extends the lief.Relocation object to provide an uniform API across the file formats.

class BASE_TYPES(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

ABS = 0
ARM_MOV32 = 263
ARM_MOV32A = 262
ARM_MOV32T = 520
DIR64 = 10
HIGH = 1
HIGH3ADJ = 11
HIGHADJ = 4
HIGHLOW = 3
IA64_IMM64 = 9
LOW = 2
MIPS_JMPADDR = 5
MIPS_JMPADDR16 = 777
REL = 7
RISCV_HI20 = 264
RISCV_LOW12I = 522
RISCV_LOW12S = 8
SECTION = 6
THUMB_MOV32 = 521
UNKNOWN = -1
from_value(arg: int) → lief.PE.RelocationEntry.BASE_TYPES = <nanobind.nb_func object>
property data → int

Raw data of the relocation:

  • The high 4 bits store the relocation type

  • The low 12 bits store the relocation offset (position)

property position → int

Offset - relative to virtual_address - where the relocation occurs

property type → lief.PE.RelocationEntry.BASE_TYPES

Type of the relocation

Export

class lief.PE.Export(self)

Bases: Object

Class which represents a PE Export

copy(self) → lief.PE.Export

Duplicate the current instance of this object

property entries → lief.PE.Export.it_entries

Iterator over the ExportEntry

property export_flags → int

According to the PE specifications this value is reserved and should be set to 0

class it_entries

Bases: object

Iterator over lief._lief.PE.ExportEntry

property major_version → int

The major version number (can be user-defined)

property minor_version → int

The minor version number (can be user-defined)

property name → str | bytes

The name of the library exported (e.g. KERNEL32.dll)

property ordinal_base → int

The starting number for the exports. Usually this value is set to 1

property timestamp → int

The time and date that the export data was created

Export Entry

Inheritance diagram of lief._lief.PE.ExportEntry
class lief.PE.ExportEntry(self)

Bases: Symbol

Class which represents a PE Export entry (cf. lief.PE.Export)

property address → int
property demangled_name → str

Demangled representation of the symbol or an empty string if it can’t be demangled.

property forward_information → lief.PE.ExportEntry.forward_information_t
class forward_information_t

Bases: object

property function → str
property library → str
property function_rva → int
property is_extern → bool
property is_forwarded → bool
property name → str | bytes
property ordinal → int

Signature

class lief.PE.Signature

Bases: Object

class VERIFICATION_CHECKS(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Flag

Flags to tweak the verification process of the signature See lief.PE.Signature.check() and lief.PE.Binary.verify_signature()

DEFAULT = 1
HASH_ONLY = 2
LIFETIME_SIGNING = 4
SKIP_CERT_TIME = 8
from_value(arg: int) → lief.PE.Signature.VERIFICATION_CHECKS = <nanobind.nb_func object>
class VERIFICATION_FLAGS(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Flag

BAD_DIGEST = 128
BAD_SIGNATURE = 256
CERT_EXPIRED = 1024
CERT_FUTURE = 2048
CERT_NOT_FOUND = 8
CORRUPTED_AUTH_DATA = 32
CORRUPTED_CONTENT_INFO = 16
INCONSISTENT_DIGEST_ALGORITHM = 4
INVALID_SIGNER = 1
MISSING_PKCS9_MESSAGE_DIGEST = 64
NO_SIGNATURE = 512
OK = 0
UNSUPPORTED_ALGORITHM = 2
from_value(arg: int) → lief.PE.Signature.VERIFICATION_FLAGS = <nanobind.nb_func object>
property certificates → lief.PE.Signature.it_const_crt

Return an iterator over x509 certificates

check(self, checks: lief.PE.Signature.VERIFICATION_CHECKS) → lief.PE.Signature.VERIFICATION_FLAGS

Check the integrity of the signature and return a lief.PE.Signature.VERIFICATION_FLAGS

By default, it performs the following verifications:

  1. It must contain only one signer info (signers)

  2. lief.PE.Signature.digest_algorithm must match:

  3. The x509 certificate specified by lief.PE.SignerInfo.serial_number and lief.PE.SignerInfo.issuer must exist within lief.PE.Signature.certificates

  4. Given the x509 certificate, compare lief.PE.SignerInfo.encrypted_digest against either:

  5. If they are Authenticated attributes, check that a PKCS9_MESSAGE_DIGEST (lief.PE.PKCS9MessageDigest) attribute exists and that its value matches hash of ContentInfo

  6. Check the validity of the PKCS #9 counter signature if present

  7. If the signature doesn’t embed a signing-time in the counter signature, check the certificate validity. (See lief.PE.Signature.VERIFICATION_CHECKS.LIFETIME_SIGNING and lief.pe.Signature.VERIFICATION_CHECKS.SKIP_CERT_TIME)

See: lief.PE.Signature.VERIFICATION_CHECKS to tweak the behavior

property content_info → lief.PE.ContentInfo

Return the ContentInfo

property digest_algorithm → lief.PE.ALGORITHMS

Return the algorithm (ALGORITHMS) used to sign the content of ContentInfo

find_crt(self, serialno: collections.abc.Sequence[int]) → lief.PE.x509

Find the x509 certificate according to its serial number

find_crt_issuer(*args) → lief.PE.x509

Overloaded function.

  1. find_crt_issuer(self, issuer: str) -> lief._lief.PE.x509

Find the x509 certificate according to its issuer

  1. find_crt_issuer(self, issuer: str, serialno: collections.abc.Sequence[int]) -> lief._lief.PE.x509

Find the x509 certificate according to its issuer AND its serial number

find_crt_subject(*args) → lief.PE.x509

Overloaded function.

  1. find_crt_subject(self, subject: str) -> lief._lief.PE.x509

Find the x509 certificate according to its subject

  1. find_crt_subject(self, subject: str, serialno: collections.abc.Sequence[int]) -> lief._lief.PE.x509

Find the x509 certificate according to its subject AND its serial number

class it_const_crt

Bases: object

Iterator over lief._lief.PE.x509

class it_const_signers_t

Bases: object

Iterator over lief._lief.PE.SignerInfo

parse(*args) → lief.PE.Signature | None = <nanobind.nb_func object>
property raw_der → memoryview

Return the raw original signature as a byte object

property signers → lief.PE.Signature.it_const_signers_t

Return an iterator over the signers (SignerInfo)

property version → int

Version of the signature. It should be 1

Signature Attribute

Inheritance diagram of lief._lief.PE.PKCS9MessageDigest, lief._lief.PE.PKCS9AtSequenceNumber, lief._lief.PE.MsCounterSign, lief._lief.PE.MsSpcStatementType, lief._lief.PE.SpcSpOpusInfo, lief._lief.PE.SigningCertificateV2, lief._lief.PE.PKCS9CounterSignature, lief._lief.PE.MsSpcNestedSignature, lief._lief.PE.MsManifestBinaryID, lief._lief.PE.ContentType, lief._lief.PE.SpcRelaxedPeMarkerCheck, lief._lief.PE.Attribute, lief._lief.PE.GenericType, lief._lief.PE.PKCS9SigningTime
class lief.PE.Attribute

Bases: Object

Interface over PKCS #7 attribute

class TYPE(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

CONTENT_TYPE = 1
GENERIC_TYPE = 2
MS_COUNTER_SIGN = 6
MS_PLATFORM_MANIFEST_BINARY_ID = 9
MS_SPC_NESTED_SIGN = 7
MS_SPC_STATEMENT_TYPE = 8
PKCS9_AT_SEQUENCE_NUMBER = 10
PKCS9_COUNTER_SIGNATURE = 11
PKCS9_MESSAGE_DIGEST = 12
PKCS9_SIGNING_TIME = 13
SIGNING_CERTIFICATE_V2 = 3
SPC_RELAXED_PE_MARKER_CHECK = 5
SPC_SP_OPUS_INFO = 4
UNKNOWN = 0
from_value(arg: int) → lief.PE.Attribute.TYPE = <nanobind.nb_func object>
property type → lief.PE.Attribute.TYPE

Concrete type of the attribute

Signature ContentType

Inheritance diagram of lief._lief.PE.ContentType
class lief.PE.ContentType

Bases: Attribute

Interface over the structure described by the OID 1.2.840.113549.1.9.3 (PKCS #9) The internal structure is described in the: RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0

ContentType ::= OBJECT IDENTIFIER
property oid → str

OID as described in RFC #2985 (string object)

Signature GenericType

Inheritance diagram of lief._lief.PE.GenericType
class lief.PE.GenericType

Bases: Attribute

Interface over an attribute for which the internal structure is not supported by LIEF

property oid → str

OID of the original attribute

property raw_content → memoryview

Original DER blob of the attribute

Signature MsSpcNestedSignature

Inheritance diagram of lief._lief.PE.MsSpcNestedSignature
class lief.PE.MsSpcNestedSignature

Bases: Attribute

Interface over the structure described by the OID 1.3.6.1.4.1.311.2.4.1

The internal structure is not documented but we can infer the following structure:

MsSpcNestedSignature ::= SET OF SignedData

With SignedData, the structure described in PKCS #7 RFC (See: lief.PE.Signature)

property signature → lief.PE.Signature

Underlying Signature object

Signature MsSpcStatementType

Inheritance diagram of lief._lief.PE.MsSpcStatementType
class lief.PE.MsSpcStatementType

Bases: Attribute

Interface over the structure described by the OID 1.3.6.1.4.1.311.2.1.11

The internal structure is described in the official document: Windows Authenticode Portable Executable Signature Format

SpcStatementType ::= SEQUENCE of OBJECT IDENTIFIER
property oid → str

According to the documentation:

The SpcStatementType MUST contain one Object Identifier with either
the value ``1.3.6.1.4.1.311.2.1.21 (SPC_INDIVIDUAL_SP_KEY_PURPOSE_OBJID)`` or
``1.3.6.1.4.1.311.2.1.22 (SPC_COMMERCIAL_SP_KEY_PURPOSE_OBJID)``.

Signature PKCS9AtSequenceNumber

Inheritance diagram of lief._lief.PE.PKCS9AtSequenceNumber
class lief.PE.PKCS9AtSequenceNumber

Bases: Attribute

Interface over the structure described by the OID 1.2.840.113549.1.9.25.4 (PKCS #9)

The internal structure is described in the RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0

sequenceNumber ATTRIBUTE ::= {
  WITH SYNTAX SequenceNumber
  EQUALITY MATCHING RULE integerMat
  SINGLE VALUE TRUE
  ID pkcs-9-at-sequenceNumber
}

SequenceNumber ::= INTEGER (1..MAX)
property number → int

Number as described in the RFC

Signature PKCS9CounterSignature

Inheritance diagram of lief._lief.PE.PKCS9CounterSignature
class lief.PE.PKCS9CounterSignature

Bases: Attribute

Interface over the structure described by the OID 1.2.840.113549.1.9.6 (PKCS #9)

The internal structure is described in the RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0

counterSignature ATTRIBUTE ::= {
  WITH SYNTAX SignerInfo
  ID pkcs-9-at-counterSignature
}
property signer → lief.PE.SignerInfo

Return the SignerInfo as described in the RFC #2985

Signature PKCS9MessageDigest

Inheritance diagram of lief._lief.PE.PKCS9MessageDigest
class lief.PE.PKCS9MessageDigest

Bases: Attribute

Interface over the structure described by the OID 1.2.840.113549.1.9.4 (PKCS #9)

The internal structure is described in the RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0

messageDigest ATTRIBUTE ::= {
  WITH SYNTAX MessageDigest
  EQUALITY MATCHING RULE octet
  SINGLE VALUE TRUE
  ID pkcs-9-at-messageDigest
}

MessageDigest ::= OCTET STRING
property digest → bytes

Message digeset as a blob of bytes as described in the RFC

Signature PKCS9SigningTime

Inheritance diagram of lief._lief.PE.PKCS9SigningTime
class lief.PE.PKCS9SigningTime

Bases: Attribute

Interface over the structure described by the OID 1.2.840.113549.1.9.5 (PKCS #9)

The internal structure is described in the RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0

signingTime ATTRIBUTE ::= {
        WITH SYNTAX SigningTime
        EQUALITY MATCHING RULE signingTimeMatch
        SINGLE VALUE TRUE
        ID pkcs-9-at-signingTime
}

SigningTime ::= Time -- imported from ISO/IEC 9594-8
property time → list[int]

Time as a list [year, month, day, hour, min, sec]

Signature SpcSpOpusInfo

Inheritance diagram of lief._lief.PE.SpcSpOpusInfo
class lief.PE.SpcSpOpusInfo

Bases: Attribute

Interface over the structure described by the OID 1.3.6.1.4.1.311.2.1.12 The internal structure is described in the official document: Windows Authenticode Portable Executable Signature Format

SpcSpOpusInfo ::= SEQUENCE {
    programName  [0] EXPLICIT SpcString OPTIONAL,
    moreInfo     [1] EXPLICIT SpcLink OPTIONAL
}
property more_info → str | bytes

Other information such as an URL

property program_name → str | bytes

Program description provided by the publisher

Signature SpcIndirectData

Inheritance diagram of lief._lief.PE.SpcIndirectData
class lief.PE.SpcIndirectData

Bases: Content

property digest → memoryview
property digest_algorithm → lief.PE.ALGORITHMS

Digest used to hash the file. This should match digest_algorithm

property file → str

GenericContent

Inheritance diagram of lief._lief.PE.GenericContent
class lief.PE.GenericContent

Bases: Content

RsaInfo

class lief.PE.RsaInfo

Bases: object

Object representing a RSA key

property D → bytes

RSA private exponent (in bytes)

property E → bytes

RSA public exponent (in bytes)

property N → bytes

RSA public modulus (in bytes)

property P → bytes

First prime factor (in bytes)

property Q → bytes

Second prime factor (in bytes)

property has_private_key → bool

True if it embeds a private key

property has_public_key → bool

True if it embeds a public key

property key_size → int

Size of the public modulus in bits

x509

class lief.PE.x509

Bases: Object

Interface over a x509 certificate

class KEY_TYPES(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

Public key scheme used by the x509 certificate

ECDSA = 4
ECKEY = 2
ECKEY_DH = 3
NONE = 0
RSA = 1
RSASSA_PSS = 6
RSA_ALT = 5
from_value(arg: int) → lief.PE.x509.KEY_TYPES = <nanobind.nb_func object>
class KEY_USAGE(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

Key usage as defined in RFC #5280 - section-4.2.1.3

CRL_SIGN = 6
DATA_ENCIPHERMENT = 3
DECIPHER_ONLY = 8
DIGITAL_SIGNATURE = 0
ENCIPHER_ONLY = 7
KEY_AGREEMENT = 4
KEY_CERT_SIGN = 5
KEY_ENCIPHERMENT = 2
NON_REPUDIATION = 1
from_value(arg: int) → lief.PE.x509.KEY_USAGE = <nanobind.nb_func object>
class VERIFICATION_FLAGS(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Flag

Verification flags associated with verify

BADCERT_BAD_KEY = 65536
BADCERT_BAD_MD = 16384
BADCERT_BAD_PK = 32768
BADCERT_CN_MISMATCH = 4
BADCERT_EXPIRED = 1
BADCERT_EXT_KEY_USAGE = 4096
BADCERT_FUTURE = 512
BADCERT_KEY_USAGE = 2048
BADCERT_MISSING = 64
BADCERT_NOT_TRUSTED = 8
BADCERT_NS_CERT_TYPE = 8192
BADCERT_OTHERNATURE = 256
BADCERT_REVOKED = 2
BADCERT_SKIP_VERIFY = 128
BADCRL_BAD_KEY = 524288
BADCRL_BAD_MD = 131072
BADCRL_BAD_PK = 262144
BADCRL_EXPIRED = 32
BADCRL_FUTURE = 1024
BADCRL_NOT_TRUSTED = 16
OK = 0
from_value(arg: int) → lief.PE.x509.VERIFICATION_FLAGS = <nanobind.nb_func object>
property certificate_policies → list[str]

Policy information terms as list of OID (see RFC #5280)

property ext_key_usage → list[str]

Indicates one or more purposes for which the certified public key may be used (list of OID)

property is_ca → bool
is_trusted_by(self, ca_list: collections.abc.Sequence[lief.PE.x509]) → lief.PE.x509.VERIFICATION_FLAGS

Verify this certificate against a list of root CA (list of x509 objects) It returns a set of flags defined by VERIFICATION_FLAGS

Example:
signer = binary.signatures[0].signers[0]
microsoft_ca_bundle = lief.PE.x509.parse("bundle.pem")
print(signer.cert.is_trusted_by(microsoft_ca_bundle))
property issuer → str | bytes

Issuer of the certificate

property key_type → lief.PE.x509.KEY_TYPES

Return the underlying public-key scheme (KEY_TYPES)

property key_usage → list[lief.PE.x509.KEY_USAGE]

Purpose of the key contained in the certificate (see KEY_USAGE)

parse(*args) → list[lief.PE.x509] = <nanobind.nb_func object>
property raw → bytes

The raw bytes associated with this x509 cert (DER encoded)

property rsa_info → lief.PE.RsaInfo | None

If the underlying public-key scheme is RSA, return the RsaInfo associated with this certificate. Otherwise, return None

property serial_number → bytes

Unique id for certificate issued by a specific CA.

property signature → bytes

The signature of the certificate

property signature_algorithm → str

Signature algorithm (OID)

property subject → str | bytes

Subject of the certificate

property valid_from → list[int]

Start time of certificate validity

property valid_to → list[int]

End time of certificate validity

verify(self, ca: lief.PE.x509) → lief.PE.x509.VERIFICATION_FLAGS

Verify that this certificate has been used to trust the given x509 certificate

It returns a set of flags defined by VERIFICATION_FLAGS

Example:
ca     = lief.PE.x509.parse("ca.crt")[0]
signer = lief.PE.x509.parse("signer.crt")[0]
print(ca.verify(signer))  # lief.PE.x509.VERIFICATION_FLAGS.OK
property version → int

X.509 version. (1=v1, 2=v2, 3=v3)

ContentInfo

Inheritance diagram of lief._lief.PE.PKCS9TSTInfo, lief._lief.PE.GenericContent, lief._lief.PE.SpcIndirectData
class lief.PE.ContentInfo

Bases: Object

ContentInfo as described in the RFC 2315

ContentInfo ::= SEQUENCE {
  contentType ContentType,
  content     [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL
}

ContentType ::= OBJECT IDENTIFIER

In the case of PE signature, ContentType must be set to SPC_INDIRECT_DATA_OBJID OID: 1.3.6.1.4.1.311.2.1.4 and content is defined by the structure: SpcIndirectDataContent

SpcIndirectDataContent ::= SEQUENCE {
 data          SpcAttributeTypeAndOptionalValue,
 messageDigest DigestInfo
}

SpcAttributeTypeAndOptionalValue ::= SEQUENCE {
 type  ObjectID,
 value [0] EXPLICIT ANY OPTIONAL
}

For PE signature, SpcAttributeTypeAndOptionalValue.type is set to SPC_PE_IMAGE_DATAOBJ (OID: 1.3.6.1.4.1.311.2.1.15) and the value is defined by SpcPeImageData

DigestInfo ::= SEQUENCE {
 digestAlgorithm  AlgorithmIdentifier,
 digest           OCTETSTRING
}

AlgorithmIdentifier ::= SEQUENCE {
 algorithm  ObjectID,
 parameters [0] EXPLICIT ANY OPTIONAL
}
class Content

Bases: Object

property content_type → str

OID of the content type. This value should match SPC_INDIRECT_DATA_OBJID

copy(self) → lief.PE.ContentInfo.Content | None

Duplicate the current instance of this object

property content_type → str

An alias for content_type

copy(self) → lief.PE.ContentInfo

Duplicate the current instance of this object

property digest → bytes

Return the digest (authentihash) if the underlying content type is SPC_INDIRECT_DATA_OBJID. Return empty bytes otherwise.

property digest_algorithm → lief.PE.ALGORITHMS

Return the hash algorithm used to generate the digest

property value → lief.PE.ContentInfo.Content

SignerInfo

class lief.PE.SignerInfo

Bases: Object

SignerInfo as described in the RFC 2315 #Section 9.2

SignerInfo ::= SEQUENCE {
 version                   Version,
 issuerAndSerialNumber     IssuerAndSerialNumber,
 digestAlgorithm           DigestAlgorithmIdentifier,
 authenticatedAttributes   [0] IMPLICIT Attributes OPTIONAL,
 digestEncryptionAlgorithm DigestEncryptionAlgorithmIdentifier,
 encryptedDigest           EncryptedDigest,
 unauthenticatedAttributes [1] IMPLICIT Attributes OPTIONAL
}

EncryptedDigest ::= OCTET STRING
property authenticated_attributes → lief.PE.SignerInfo.it_const_attributes_t

Return an iterator over the authenticated attributes (Attribute)

property cert → lief.PE.x509

x509 certificate used by this signer. If it can’t be found, it returns None

property digest_algorithm → lief.PE.ALGORITHMS

Algorithm (ALGORITHMS) used to hash the file. This value should match ContentInfo.digest_algorithm and Signature.digest_algorithm

property encrypted_digest → bytes

Return the signature created by the signing certificate’s private key

property encryption_algorithm → lief.PE.ALGORITHMS

Return algorithm (ALGORITHMS) used to encrypt the digest

get_attribute(self, type: lief.PE.Attribute.TYPE) → lief.PE.Attribute

Return the authenticated or un-authenticated attribute matching the given lief.PE.SIG_ATTRIBUTE_TYPES It returns the first entry that matches the given type. If it can’t be found, it returns None

get_auth_attribute(self, type: lief.PE.Attribute.TYPE) → lief.PE.Attribute

Return the authenticated attribute matching the given lief.PE.SIG_ATTRIBUTE_TYPES It returns the first entry that matches the given type. If it can’t be found, it returns None

get_unauth_attribute(self, type: lief.PE.Attribute.TYPE) → lief.PE.Attribute

Return the un-authenticated attribute matching the given lief.PE.SIG_ATTRIBUTE_TYPES It returns the first entry that matches the given type. If it can’t be found, it returns a nullptr

property issuer → str | bytes

The X509 issuer used to sign the signed-data (see: lief.PE.x509.issuer)

class it_const_attributes_t

Bases: object

Iterator over lief._lief.PE.Attribute

property serial_number → bytes

The X509 serial number used to sign the signed-data (see: lief.PE.x509.serial_number)

property unauthenticated_attributes → lief.PE.SignerInfo.it_const_attributes_t

Return an iterator over the unauthenticated attributes (Attribute)

property version → int

Should be 1

MsCounterSign

class lief.PE.MsCounterSign

Bases: Attribute

This class exposes the ms-counter-signature.

property certificates → lief.PE.MsCounterSign.it_const_crt

Return an iterator over x509 certificates

property content_info → lief.PE.ContentInfo
property digest_algorithm → lief.PE.ALGORITHMS
class it_const_crt

Bases: object

Iterator over lief._lief.PE.x509

class it_const_signers_t

Bases: object

Iterator over lief._lief.PE.SignerInfo

property signers → lief.PE.MsCounterSign.it_const_signers_t

Return an iterator over the signers (SignerInfo)

property version → int

PKCS9TSTInfo

class lief.PE.PKCS9TSTInfo

Bases: Content

Interface over the structure described by the OID 1.2.840.113549.1.9.16.1.4 (PKCS #9)

The internal structure is described in the RFC #3161

TSTInfo ::= SEQUENCE  {
 version        INTEGER  { v1(1) },
 policy         TSAPolicyId,
 messageImprint MessageImprint,
 serialNumber   INTEGER,
 genTime        GeneralizedTime,
 accuracy       Accuracy                OPTIONAL,
 ordering       BOOLEAN                 DEFAULT FALSE,
 nonce          INTEGER                 OPTIONAL,
 tsa            [0] GeneralName         OPTIONAL,
 extensions     [1] IMPLICIT Extensions OPTIONAL
}

TSAPolicyId    ::= OBJECT IDENTIFIER
MessageImprint ::= SEQUENCE {
  hashAlgorithm  AlgorithmIdentifier,
  hashedMessage  OCTET STRING
}

Accuracy ::= SEQUENCE {
  seconds        INTEGER           OPTIONAL,
  millis     [0] INTEGER  (1..999) OPTIONAL,
  micros     [1] INTEGER  (1..999) OPTIONAL
}

MsManifestBinaryID

class lief.PE.MsManifestBinaryID

Bases: Attribute

Interface over the structure described by the OID 1.3.6.1.4.1.311.10.3.28 (szOID_PLATFORM_MANIFEST_BINARY_ID)

The internal structure is not documented but we can infer the following structure:

szOID_PLATFORM_MANIFEST_BINARY_ID ::= SET OF BinaryID

BinaryID ::= UTF8STRING
property manifest_id → str

The manifest id

SpcRelaxedPeMarkerCheck

class lief.PE.SpcRelaxedPeMarkerCheck

Bases: Attribute

property value → int

SigningCertificateV2

class lief.PE.SigningCertificateV2

Bases: Attribute

SigningCertificateV2 ::= SEQUENCE {
  certs    SEQUENCE OF ESSCertIDv2,
  policies SEQUENCE OF PolicyInformation OPTIONAL
}

ESSCertIDv2 ::= SEQUENCE {
  hashAlgorithm AlgorithmIdentifier DEFAULT {algorithm id-sha256},
  certHash      OCTET STRING,
  issuerSerial  IssuerSerial OPTIONAL
}

IssuerSerial ::= SEQUENCE {
  issuer       GeneralNames,
  serialNumber CertificateSerialNumber
}

PolicyInformation ::= SEQUENCE {
  policyIdentifier   OBJECT IDENTIFIER,
  policyQualifiers   SEQUENCE SIZE (1..MAX) OF PolicyQualifierInfo OPTIONAL
}

Builder

class lief.PE.Builder(self, pe_binary: lief._lief.PE.Binary)

Bases: object

Class that is used to rebuild a raw PE binary from a PE::Binary object

Constructor that takes a Binary

build(self) → lief.ok_t | lief.lief_errors

Perform the build process

build_dos_stub(self, enable: bool) → lief.PE.Builder

Rebuild the DOS stub

build_imports(self, enable: bool) → lief.PE.Builder

Rebuild the import table into another section

build_overlay(self, enable: bool) → lief.PE.Builder

Rebuild the binary’s overlay

build_relocations(self, enable: bool) → lief.PE.Builder

Rebuild the relocation table in another section

build_resources(self, enable: bool) → lief.PE.Builder

Rebuid the resources in another section

build_tls(self, enable: bool) → lief.PE.Builder

Rebuild TLS object in another section

get_build(self) → list[int]

Return the build result as a list of bytes

patch_imports(self, enable: bool) → lief.PE.Builder

Patch the original import table in order to redirect functions to the new import table.

This setting should be used with build_imports set to True

write(self, output: str) → None

Write the build result into the output file

Resource Node

Inheritance diagram of lief._lief.PE.ResourceDirectory, lief._lief.PE.ResourceData, lief._lief.PE.ResourceNode
class lief.PE.ResourceNode

Bases: Object

Class which represents a Node in the resource tree. It is extended by lief.PE.ResourceData and lief.PE.ResourceNode

add_data_node(self, resource_data: lief.PE.ResourceData) → lief.PE.ResourceNode

Add a ResourceData to the current node

add_directory_node(self, resource_directory: lief.PE.ResourceDirectory) → lief.PE.ResourceNode

Add a ResourceDirectory to the current node

property childs → lief.PE.ResourceNode.it_childs

Node’s childs

copy(self) → lief.PE.ResourceNode | None

Duplicate the current instance of this object

delete_child(*args) → None

Overloaded function.

  1. delete_child(self, node: lief._lief.PE.ResourceNode) -> None

Delete the given ResourceNode from childs

  1. delete_child(self, id: int) -> None

Delete the ResourceNode with the given id from childs

property depth → int

Current depth of the entry in the resource tree

property has_name → bool

True if the current resource uses a name

property id → int

Integer that identifies the Type, Name, or Language ID entry.

property is_data → bool

True if the current resource is a ResourceData

property is_directory → bool

True if the current resource is a ResourceDirectory

class it_childs

Bases: object

Iterator over lief._lief.PE.ResourceNode

property name → str | bytes

Resource’s name

Resource Directory

Inheritance diagram of lief._lief.PE.ResourceDirectory
class lief.PE.ResourceDirectory(self)

Bases: ResourceNode

Default constructor

property characteristics → int

Resource characteristics. This field is reserved for future use. It is currently set to zero.

property major_version → int

The major version number, set by the user.

property minor_version → int

The minor version number, set by the user.

property numberof_id_entries → int

The number of directory entries immediately following the Name entries that use numeric IDs for Type, Name, or Language entries.

property numberof_name_entries → int

The number of directory entries immediately following the table that use strings to identify Type, Name, or Language entries (depending on the level of the table

property time_date_stamp → int

The time that the resource data was created by the resource compiler.

Resource Data

Inheritance diagram of lief._lief.PE.ResourceData
class lief.PE.ResourceData(self)
class lief.PE.ResourceData(self, content: collections.abc.Sequence[int], code_page: int)

Bases: ResourceNode

Class which represents a Data Node in the PE resources tree

Overloaded function.

  1. __init__(self) -> None

Default constructor

  1. __init__(self, content: collections.abc.Sequence[int], code_page: int) -> None

property code_page → int

Return the code page that is used to decode code point values within the resource data. Typically, the code page is the Unicode code page.

property content → memoryview

Resource content

property offset → int

Offset of the content within the resource

Warning

This value can change when re-building the resource table

property reserved → int

Reserved value. Should be 0

Resources Manager

class lief.PE.ResourcesManager(self, arg: lief._lief.PE.ResourceNode, /)

Bases: Object

The Resource Manager provides an enhanced API to manipulate the resource tree

class TYPE(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

ACCELERATOR = 9
ANICURSOR = 21
ANIICON = 22
BITMAP = 2
CURSOR = 1
DIALOG = 5
DLGINCLUDE = 17
FONT = 8
FONTDIR = 7
GROUP_CURSOR = 12
GROUP_ICON = 14
HTML = 23
ICON = 3
MANIFEST = 24
MENU = 4
MESSAGETABLE = 11
PLUGPLAY = 19
RCDATA = 10
STRING = 6
VERSION = 16
VXD = 20
from_value(arg: int) → lief.PE.ResourcesManager.TYPE = <nanobind.nb_func object>
property accelerator → lief.PE.ResourcesManager.it_const_accelerators

Return list of ResourceAccelerator present in the resource

add_icon(self, icon: lief.PE.ResourceIcon) → None

Add an icon to the resources

change_icon(self, old_one: lief.PE.ResourceIcon, new_one: lief.PE.ResourceIcon) → None

Switch the given icons

property dialogs → lief.PE.ResourcesManager.it_const_dialogs

Return the list of the ResourceDialog present in the resource

get_node_type(self, type: lief.PE.ResourcesManager.TYPE) → lief.PE.ResourceNode

Return ResourceNode with the given TYPE or None if not found.

property has_accelerator → bool

True if resources contain ResourceAccelerator

property has_dialogs → bool

true if the resources contain ResourceDialog

property has_html → bool

True if resources contain HTML resource

property has_icons → bool

true if the resources contain ResourceIcon

property has_manifest → bool

True if the resources contain a Manifest element

property has_string_table → bool

True if resources contain ResourceStringTable

has_type(self, type: lief.PE.ResourcesManager.TYPE) → bool

True if the resource has the given TYPE

property has_version → bool

true if the resources contain a ResourceVersion

property html → list[str]

HTML resource as the list of string

property icons → lief.PE.ResourcesManager.it_const_icons

Return the list of the ResourceIcon present in the resource

class it_const_accelerators

Bases: object

Iterator over lief._lief.PE.ResourceAccelerator

class it_const_dialogs

Bases: object

Iterator over lief._lief.PE.ResourceDialog

class it_const_icons

Bases: object

Iterator over lief._lief.PE.ResourceIcon

class it_const_strings_table

Bases: object

Iterator over lief._lief.PE.ResourceStringTable

property manifest → str | bytes

Manifest as a string

property string_table → lief.PE.ResourcesManager.it_const_strings_table

Return list of ResourceStringTable present in the resource

property types → list[lief.PE.ResourcesManager.TYPE]

Return list of TYPE present in the resources

property version → lief.PE.ResourceVersion | lief.lief_errors

Return the ResourceVersion

Resource Icon

class lief.PE.ResourceIcon

Bases: Object

property bit_count → int

Bits per pixel

property color_count → int

Number of colors in image (0 if >=8bpp)

property height → int

Height in pixels of the image

property id → int

Id associated with the icon

property lang → int

Language associated with the icon

property pixels → memoryview
property planes → int

Color Planes

property reserved → int

Reserved (must be 0)

save(self, filepath: str) → None

Save the icon to the given filepath

property sublang → int

Sublanguage associated with the icon

property width → int

Width in pixels of the image

Resource Dialog

class lief.PE.ResourceDialog

Bases: Object

Representation of a dialog box.

Windows allows two kinds of dialog box:

  • Simple one

  • Extended one

is_extended can be used to determine which one is implemented

property charset → int

The character set to be used

property cx → int

The width, in dialog box units, of the dialog box.

property cy → int

The height, in dialog box units, of the dialog box.

property dialogbox_style_list → set[lief.PE.DIALOG_BOX_STYLES]

Return list of DIALOG_BOX_STYLES associated with the style member

property extended_style → int

The extended windows styles (EXTENDED_WINDOW_STYLES)

property extended_style_list → set[lief.PE.DIALOG_BOX_STYLES]

Return list of EXTENDED_WINDOW_STYLES associated with the extended_style member

has_dialogbox_style(self, style: lief.PE.DIALOG_BOX_STYLES) → bool

Check if the style member has the given DIALOG_BOX_STYLES

has_extended_style(self, style: lief.PE.EXTENDED_WINDOW_STYLES) → bool

Check if the extended_style member has the given EXTENDED_WINDOW_STYLES

has_style(self, style: lief.PE.WINDOW_STYLES) → bool

Check if the style member has the given WINDOW_STYLES

property help_id → int

The help context identifier for the dialog box window

property is_extended → bool

True if the dialog is an extended one

class it_const_items

Bases: object

Iterator over lief._lief.PE.ResourceDialogItem

property items → lief.PE.ResourceDialog.it_const_items

Iterator over the controls (ResourceDialogItem) that defines the Dialog (Button, Label…)

property lang → int

Primary language associated with the dialog

property point_size → int

The point size of the font to use for the text in the dialog box and its controls.

property signature → int

Indicate whether a template is an extended dialog box template:

  • 0xFFFF: Extended dialog box template

  • Other value: Standard dialog box template

property style → int

The style of the dialog box. This member can be a combination of WINDOW_STYLES and DIALOG_BOX_STYLES

property style_list → set[lief.PE.WINDOW_STYLES]

Return list of WINDOW_STYLES associated with the style member

property sub_lang → int

Secondary language associated with the dialog

property title → str

The title of the dialog box

property typeface → str

The name of the typeface for the font

property version → int

The version number of the extended dialog box template. This member must be set to 1.

property weight → int

The weight of the font

property x → int

The x-coordinate, in dialog box units, of the upper-left corner of the dialog box.

property y → int

The y-coordinate, in dialog box units, of the upper-left corner of the dialog box.

Resource Dialog Item

class lief.PE.ResourceDialogItem

Bases: Object

This class represents an item in the lief.PE.ResourceDialog

property cx → int

The width, in dialog box units, of the control

property cy → int

The height, in dialog box units, of the control

property extended_style → int

The extended styles for the window

property help_id → int

The help context identifier for the control

property id → int

The control identifier

property is_extended → bool

True if the control is an extended one

property style → int

The style of the control. This member can be a combination of WINDOW_STYLES values and one or more of the control style values.

property title → str

Initial text of the control

property x → int

The x-coordinate, in dialog box units, of the upper-left corner of the control

property y → int

The y-coordinate, in dialog box units, of the upper-left corner of the control

Resource Version

class lief.PE.ResourceVersion

Bases: Object

Class that represents the data associated with the RT_VERSION entry

See: VS_VERSIONINFO

property fixed_file_info → lief.PE.ResourceFixedFileInfo

ResourceFixedFileInfo associated with the version (if any). This object describes various information about the application’s version.

If not present, this property is set to None

property has_fixed_file_info → bool

True if the version contains a ResourceFixedFileInfo

property has_string_file_info → bool

True if the version contains a ResourceStringFileInfo

property has_var_file_info → bool

True if the version contains a ResourceVarFileInfo

property key → str

Signature of the structure. Must be VS_VERSION_INFO

remove_fixed_file_info(self) → None

Remove the ResourceFixedFileInfo from the version

remove_string_file_info(self) → None

Remove the ResourceStringFileInfo from the version

remove_var_file_info(self) → None

Remove the ResourceVarFileInfo from the version

property string_file_info → lief.PE.ResourceStringFileInfo

ResourceStringFileInfo associated with the version (if any) This object describes various information about the application’s version. The underlying structure is basically a dictionary (key/value)

If the current ResourceVersion does not use ResourceStringFileInfo, it returns None.

property type → int

The type of data in the version resource * 1 if it contains text data * 0 if it contains binary data

property var_file_info → lief.PE.ResourceVarFileInfo

ResourceVarFileInfo associated with the version (if any) This object describes information about languages supported by the application.

If the current ResourceVersion does not use ResourceVarFileInfo, it returns None.

Resource Fixed File Info

class lief.PE.ResourceFixedFileInfo

Bases: Object

Representation of the VS_FIXEDFILEINFO structure

property file_date_LS → int

The least significant 32 bits of the file’s 64-bit binary creation date and time stamp

property file_date_MS → int

The most significant 32 bits of the file’s 64-bit binary creation date and time stamp

property file_flags → int

Contains a bitmask that specifies the Boolean attributes of the file (FIXED_VERSION_FILE_FLAGS)

property file_flags_mask → int

Contains a bitmask that specifies the valid bits in file_flags. A bit is valid only if it was defined when the file was created.

property file_os → lief.PE.FIXED_VERSION_OS

The operating system for which this file was designed (FIXED_VERSION_OS)

property file_subtype → lief.PE.FIXED_VERSION_FILE_SUB_TYPES

The function of the file (FIXED_VERSION_FILE_SUB_TYPES)

property file_type → lief.PE.FIXED_VERSION_FILE_TYPES

The general type of file (FIXED_VERSION_FILE_TYPES)

property file_version_LS → int

The least significant 32 bits of the file’s binary version number

This member is used with file_version_MS to form a 64-bits value used for numeric comparisons.

property file_version_MS → int

The most significant 32 bits of the file’s binary version number

This member is used with file_version_LS to form a 64-bits value used for numeric comparisons.

property product_version_LS → int

The least significant 32 bits of the product with which this file was distributed

This member is used with product_version_MS to form a 64-bits value used for numeric comparisons.

property product_version_MS → int

The most significant 32 bits of the product with which this file was distributed

This member is used with product_version_LS to form a 64-bits value used for numeric comparisons.

property signature → int

Must be set to 0xFEEF04BD

property struct_version → int

The binary version number of this structure.

  • The high-order word of this member contains the major version number.

  • The low-order word contains the minor version number

Resource Var File Info

class lief.PE.ResourceVarFileInfo

Bases: Object

This object describes information about languages supported by the application

property key → str

Signature of the structure. Must be VarFileInfo

property translations → list[int]

List of languages that the application supports

The least significant 16-bits must contain a Microsoft language identifier, and the most significant 16-bits must contain the CODE_PAGES Either most or least 16-bits can be zero, indicating that the file is language or code page independent.

property type → int

The type of data in the version resource

  • 1 if it contains text data

  • 0 if it contains binary data

Resource String File Info

class lief.PE.ResourceStringFileInfo

Bases: Object

Representation of the StringFileInfo structure

See: https://docs.microsoft.com/en-us/windows/win32/menurc/stringfileinfo

property key → str

Signature of the structure. Must be StringFileInfo

property langcode_items → list[lief.PE.LangCodeItem]

List of the LangCodeItem items

Each key indicates the appropriate language and code page for displaying the key: value of items

property type → int

The type of data in the version resource:

  • 1 if it contains text data

  • 0 if it contains binary data

Lang code item

class lief.PE.LangCodeItem

Bases: Object

Class which represents the childs of the ResourceStringFileInfo

See: https://docs.microsoft.com/en-us/windows/win32/menurc/stringtable

property code_page → lief.PE.CODE_PAGES

CODE_PAGES for which items are defined.

See: https://docs.microsoft.com/en-us/windows/win32/intl/code-page-identifiers

property items → dict
property key → str

A 8-digit hexadecimal number stored as an Unicode string

  • The four most significant digits represent the language identifier.

  • The four least significant digits represent the code page for which the data is formatted.

See:

property lang → int

Language for which items are defined

property sublang → int

Sublanguage for which items are defined

property type → int

The type of data in the version resource

  • 1 if it contains text data

  • 0 if it contains binary data

Resource String Table

class lief.PE.ResourceStringTable

Bases: Object

property length → int

The size of the string, not including length field itself.

property name → str

The variable-length Unicode string data, word-aligned.

Rich Header

class lief.PE.RichHeader(self)

Bases: Object

Class which represents the not-so-documented rich header

This structure is usually located at the end of the dos_stub and contains information about the build environment.

It is generated by the Microsoft linker link.exe and there are no options to disable or remove this information.

add_entry(*args) → None

Overloaded function.

  1. add_entry(self, entry: lief._lief.PE.RichEntry) -> None

Add a new RichEntry

  1. add_entry(self, id: int, build_id: int, count: int) -> None

Add a new RichEntry given its id, build_id, count

copy(self) → lief.PE.RichHeader

Duplicate the current instance of this object

property entries → lief.PE.RichHeader.it_entries

Return an iterator over the RichEntry within the header

hash(*args) → list[int]

Overloaded function.

  1. hash(self, algo: lief._lief.PE.ALGORITHMS) -> list[int]

    Compute the hash of the decoded rich header structure with the given hash ALGORITHMS

  2. hash(self, algo: lief._lief.PE.ALGORITHMS, xor_key: int) -> list[int]

    Compute the hash of the rich header structure encoded with the provided key and the given hash ALGORITHMS

class it_entries

Bases: object

Iterator over lief._lief.PE.RichEntry

property key → int

Key used to encode the header (xor operation)

raw(*args) → list[int]

Overloaded function.

  1. raw(self) -> list[int]

    The raw structure of the Rich header without xor-encoding.

    This function is equivalent as calling the other raw function with a xor_key set to 0

  2. raw(self, xor_key: int) -> list[int]

    Given this rich header, this function re-computes the raw bytes of the structure with the provided xor-key.

    You can access the decoded data’s structure with the xor_key set to 0

Rich Entry

class lief.PE.RichEntry(self)
class lief.PE.RichEntry(self, id: int, build_id: int, count: int)

Bases: Object

Class which represents an entry associated to the RichHeader

Overloaded function.

  1. __init__(self) -> None

  2. __init__(self, id: int, build_id: int, count: int) -> None

Contructor from id, build_id and count

property build_id → int

Builder number of the tool (if any)

copy(self) → lief.PE.RichEntry

Duplicate the current instance of this object

property count → int

Occurrence count

property id → int

Type of the entry

Debug

Inheritance diagram of lief._lief.PE.Repro, lief._lief.PE.Debug, lief._lief.PE.Pogo, lief._lief.PE.CodeViewPDB, lief._lief.PE.CodeView
class lief.PE.Debug(self)

Bases: Object

This class represents a generic entry in the debug data directory. For known types, this class is extended to provide a dedicated API (see: ! CodeCodeView)

class TYPES(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

The entry types

BORLAND = 9
CLSID = 11
CODEVIEW = 2
COFF = 1
EXCEPTION = 5
EX_DLLCHARACTERISTICS = 20
FIXUP = 6
FPO = 3
ILTCG = 14
MISC = 4
MPX = 15
OMAP_FROM_SRC = 8
OMAP_TO_SRC = 7
POGO = 13
REPRO = 16
RESERVED = 10
UNKNOWN = 0
VC_FEATURE = 12
from_value(arg: int) → lief.PE.Debug.TYPES = <nanobind.nb_func object>
property addressof_rawdata → int

Address of the debug data relative to the image base

property characteristics → int

Reserved should be 0

copy(self) → lief.PE.Debug | None

Duplicate the current instance of this object

property major_version → int

The major version number of the debug data format.

property minor_version → int

The minor version number of the debug data format.

property pointerto_rawdata → int

File offset of the debug data

property sizeof_data → int

Size of the debug data

property timestamp → int

The time and date when the debug data was created.

property type → lief.PE.Debug.TYPES

The format (TYPES) of the debugging information

Code View

Inheritance diagram of lief._lief.PE.CodeView, lief._lief.PE.CodeViewPDB
class lief.PE.CodeView(self)
class lief.PE.CodeView(self, arg: lief._lief.PE.CodeView.SIGNATURES, /)

Bases: Debug

class SIGNATURES(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

CV_41 = 959464014
CV_50 = 825311822
PDB_20 = 808534606
PDB_70 = 1396986706
UNKNOWN = 0
from_value(arg: int) → lief.PE.CodeView.SIGNATURES = <nanobind.nb_func object>
property cv_signature → lief.PE.CodeView.SIGNATURES

Type of the code view (SIGNATURES)

Code View PDB

Inheritance diagram of lief._lief.PE.CodeViewPDB
class lief.PE.CodeViewPDB(self)

Bases: CodeView

CodeView PDB specialization

property age → int

Age value to verify. The age does not necessarily correspond to any known time value, it is used to determine if a .pdb file is out of sync with a corresponding .exe file.

property filename → str | bytes

The path to the .pdb file

property guid → str

The GUID signature to verify against the .pdb file signature.

This attribute might be used to lookup remote PDB file on a symbol server

property parent → lief.PE.CodeView

Return a reference to the parent lief.PE.CodeView

property signature → list[int]

The 32-bit signature to verify against the .pdb file signature.

Code Integrity

class lief.PE.CodeIntegrity(self)

Bases: Object

property catalog → int

0xFFFF means not available

property catalog_offset → int
property flags → int

Flags to indicate if CI information is available, etc.

property reserved → int

Additional bitmask to be defined later

Pogo

Inheritance diagram of lief._lief.PE.Pogo
class lief.PE.Pogo(self)

Bases: Debug

class SIGNATURES(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

LCTG = 1280590663
PGI = 1346849024
UNKNOWN = 268435455
ZERO = 0
from_value(arg: int) → lief.PE.Pogo.SIGNATURES = <nanobind.nb_func object>
property entries → lief.PE.Pogo.it_entries
class it_entries

Bases: object

Iterator over lief._lief.PE.PogoEntry

property signature → lief.PE.Pogo.SIGNATURES

Type of the pogo (SIGNATURES)

Pogo Entry

class lief.PE.PogoEntry(self)

Bases: Object

copy(self) → lief.PE.PogoEntry

Duplicate the current instance of this object

property name → str | bytes
property size → int
property start_rva → int

Repro

Inheritance diagram of lief._lief.PE.Repro
class lief.PE.Repro

Bases: Debug

This class represents a reproducible build entry from the debug directory. (IMAGE_DEBUG_TYPE_REPRO). This entry is usually generated with the undocumented /Brepro linker flag.

See: https://nikhilism.com/post/2020/windows-deterministic-builds/

property hash → memoryview

The hash associated with the reproducible build

Load Configuration

class lief.PE.LoadConfiguration(self)

Bases: Object

Class that represents the default PE’s LoadConfiguration It’s the base class for any future versions of the structure

class VERSION(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

SEH = 1
UNKNOWN = 0
WIN_10_0_14286 = 4
WIN_10_0_14383 = 5
WIN_10_0_14901 = 6
WIN_10_0_15002 = 7
WIN_10_0_16237 = 8
WIN_10_0_18362 = 9
WIN_10_0_19534 = 10
WIN_10_0_9879 = 3
WIN_10_0_MSVC_2019 = 11
WIN_10_0_MSVC_2019_16 = 12
WIN_8_1 = 2
from_value(arg: int) → lief.PE.LoadConfiguration.VERSION = <nanobind.nb_func object>
property characteristics → int

Characteristics of the structure.

copy(self) → lief.PE.LoadConfiguration

Duplicate the current instance of this object

property critical_section_default_timeout → int

The default timeout value to use for is process’s critical sections that are abandoned.

property csd_version → int

The service pack version identifier.

property decommit_free_block_threshold → int

Memory that must be freed before it is returned to the system, in bytes.

property decommit_total_free_threshold → int

Total amount of free memory, in bytes

property dependent_load_flags → int

On recent the version of the structure, Microsoft renamed reserved1 to DependentLoadFlags. This is an alias for reserved1

property editlist → int

Reserved for use by the system.

property global_flags_clear → int

The global loader flags to clear for this process as the loader start the process.

property global_flags_set → int

The global loader flags to set for this process as the loader starts the process.

property lock_prefix_table → int

The VA of a list of addresses where the LOCK prefix is used so that they can be replaced with NOP on single processor machines.

property major_version → int

Major Version

property maximum_allocation_size → int

Maximum allocation size, in bytes.

property minor_version → int

Minor version

property process_affinity_mask → int

Setting this field to a non-zero value is equivalent to calling SetProcessAffinityMask with this value during process startup (.exe only)

property process_heap_flags → int

Process heap flags that correspond to the first argument of the HeapCreate function. These flags apply to the process heap that is created during process startup.

property reserved1 → int

Must be zero.

A pointer to a cookie that is used by Visual C++ or GS implementation.

property size → int

Size of the structure which is an alias for characteristics

property timedatestamp → int

Date and time stamp value

property version → lief.PE.LoadConfiguration.VERSION

(SDK) Version of the structure. (WIN_VERSION)

property virtual_memory_threshold → int

Maximum virtual memory size, in bytes.

Load Configuration V0

class lief.PE.LoadConfigurationV0(self)

Bases: LoadConfiguration

LoadConfiguration enhanced with SEH. It is associated with the WIN_VERSION: SEH

copy(self) → lief.PE.LoadConfigurationV0

Duplicate the current instance of this object

property se_handler_count → int

The count of unique handlers in the table.

property se_handler_table → int

The VA of the sorted table of RVAs of each valid, unique SE handler in the image.

Load Configuration V1

class lief.PE.LoadConfigurationV1(self)

Bases: LoadConfigurationV0

LoadConfigurationV0 enhanced with Control Flow Guard. It is associated with the WIN_VERSION set to WIN_8_1

class IMAGE_GUARD(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Flag

CFW_INSTRUMENTED = 512
CF_ENABLE_EXPORT_SUPPRESSION = 32768
CF_EXPORT_SUPPRESSION_INFO_PRESENT = 16384
CF_FUNCTION_TABLE_PRESENT = 1024
CF_INSTRUMENTED = 256
CF_LONGJUMP_TABLE_PRESENT = 65536
DELAYLOAD_IAT_IN_ITS_OWN_SECTION = 8192
EH_CONTINUATION_TABLE_PRESENT = 2097152
NONE = 0
PROTECT_DELAYLOAD_IAT = 4096
RETPOLINE_PRESENT = 1048576
RF_ENABLE = 262144
RF_INSTRUMENTED = 131072
RF_STRICT = 524288
from_value(arg: int) → lief.PE.LoadConfigurationV1.IMAGE_GUARD = <nanobind.nb_func object>
copy(self) → lief.PE.LoadConfigurationV1

Duplicate the current instance of this object

property guard_cf_check_function_pointer → int

The VA where Control Flow Guard check-function pointer is stored.

property guard_cf_dispatch_function_pointer → int

The VA where Control Flow Guard dispatch-function pointer is stored.

property guard_cf_flags_list → list[lief.PE.LoadConfigurationV1.IMAGE_GUARD]

Return list of GUARD_CF_FLAGS present in guard_flags

property guard_cf_function_count → int

The count of unique RVAs in the guard_cf_function_table

property guard_cf_function_table → int

The VA of the sorted table of RVAs of each Control Flow Guard function in the image.

property guard_flags → lief.PE.LoadConfigurationV1.IMAGE_GUARD

Control Flow Guard related flags.

has(self, flag: lief.PE.LoadConfigurationV1.IMAGE_GUARD) → bool

Check if the given GUARD_CF_FLAGS is present in guard_flags

Load Configuration V2

class lief.PE.LoadConfigurationV2(self)

Bases: LoadConfigurationV1

LoadConfigurationV1 enhanced with code integrity. It is associated with the WIN_VERSION set to WIN10_0_9879

property code_integrity → lief.PE.CodeIntegrity

CodeIntegrity object

copy(self) → lief.PE.LoadConfigurationV2

Duplicate the current instance of this object

Load Configuration V3

class lief.PE.LoadConfigurationV3(self)

Bases: LoadConfigurationV2

LoadConfigurationV2 with Control Flow Guard improved.

It is associated with the WIN_VERSION set to WIN10_0_14286

copy(self) → lief.PE.LoadConfigurationV3

Duplicate the current instance of this object

property guard_address_taken_iat_entry_count → int

Number of entries in the guard_address_taken_iat_entry_table

property guard_address_taken_iat_entry_table → int

VA of a table associated with CFG’s IAT checks

property guard_long_jump_target_count → int

Number of entries in the guard_address_taken_iat_entry_table

property guard_long_jump_target_table → int

VA of a table associated with CFG’s long jump

Load Configuration V4

class lief.PE.LoadConfigurationV4(self)

Bases: LoadConfigurationV3

LoadConfigurationV3 enhanced with:

  • Kind of dynamic relocations

  • Hybrid Metadata Pointer

It is associated with the WIN_VERSION set to WIN10_0_14383

copy(self) → lief.PE.LoadConfigurationV4

Duplicate the current instance of this object

property dynamic_value_reloc_table → int

VA of pointing to a IMAGE_DYNAMIC_RELOCATION_TABLE

property hybrid_metadata_pointer → int

Load Configuration V5

class lief.PE.LoadConfigurationV5(self)

Bases: LoadConfigurationV4

LoadConfigurationV4 enhanced nhanced with Return Flow Guard.

It is associated with the WIN_VERSION set to WIN10_0_14901

copy(self) → lief.PE.LoadConfigurationV5

Duplicate the current instance of this object

property dynamic_value_reloctable_offset → int

Offset of dynamic relocation table relative to the relocation table

property dynamic_value_reloctable_section → int

The section index of the dynamic value relocation table

property guard_rf_failure_routine → int

VA of the failure routine

property guard_rf_failure_routine_function_pointer → int

VA of the failure routine fptr

property reserved2 → int

Must be zero

Load Configuration V6

class lief.PE.LoadConfigurationV6(self)

Bases: LoadConfigurationV5

LoadConfigurationV5 enhanced with Hotpatch and improved RFG.

It is associated with the WIN_VERSION set to WIN10_0_15002

copy(self) → lief.PE.LoadConfigurationV6

Duplicate the current instance of this object

property guard_rf_verify_stackpointer_function_pointer → int

VA of the Function verifying the stack pointer

property hotpatch_table_offset → int

Offset to the hotpatch table

Load Configuration V7

class lief.PE.LoadConfigurationV7(self)

Bases: LoadConfigurationV6

property addressof_unicode_string → int
copy(self) → lief.PE.LoadConfigurationV7

Duplicate the current instance of this object

property reserved3 → int

Load Configuration V8

class lief.PE.LoadConfigurationV8(self)

Bases: LoadConfigurationV7

copy(self) → lief.PE.LoadConfigurationV8

Duplicate the current instance of this object

property volatile_metadata_pointer → int

Load Configuration V9

class lief.PE.LoadConfigurationV9(self)

Bases: LoadConfigurationV8

copy(self) → lief.PE.LoadConfigurationV9

Duplicate the current instance of this object

property guard_eh_continuation_count → int
property guard_eh_continuation_table → int

Load Configuration V10

class lief.PE.LoadConfigurationV10(self)

Bases: LoadConfigurationV9

copy(self) → lief.PE.LoadConfigurationV10

Duplicate the current instance of this object

property guard_xfg_check_function_pointer → int
property guard_xfg_dispatch_function_pointer → int
property guard_xfg_table_dispatch_function_pointer → int

Load Configuration V11

class lief.PE.LoadConfigurationV11(self)

Bases: LoadConfigurationV10

property cast_guard_os_determined_failure_mode → int
copy(self) → lief.PE.LoadConfigurationV11

Duplicate the current instance of this object

Utilities

lief.is_pe(*args) → bool
lief.is_pe(raw: collections.abc.Sequence[int]) → bool

Overloaded function.

  1. is_pe(file: str) -> bool

Check if the given file is a PE

  1. is_pe(raw: collections.abc.Sequence[int]) -> bool

Check if the given raw data is a PE

lief.PE.get_type(*args) → lief.PE.PE_TYPE | lief.lief_errors
lief.PE.get_type(raw: collections.abc.Sequence[int]) → lief._lief.PE.PE_TYPE | lief._lief.lief_errors

Overloaded function.

  1. get_type(file: str) -> Union[lief._lief.PE.PE_TYPE, lief._lief.lief_errors]

    If the input file is a a valid PE, return the PE_TYPE. Otherwise, return a lief.lief_errors.

  2. get_type(raw: collections.abc.Sequence[int]) -> Union[lief._lief.PE.PE_TYPE, lief._lief.lief_errors]

lief.PE.get_imphash(binary: lief.PE.Binary, mode: lief.PE.IMPHASH_MODE) → str

Compute the hash of imported functions

Properties of the hash generated:

  • Order agnostic

  • Casse agnostic

  • Ordinal (in some extent) agnostic

If one needs the same output as Virus Total (i.e. pefile), you can use PEFILE as second parameter.

Warning

The algorithm used to compute the imphash value has some variations compared to Yara, pefile, VT implementation

See also

https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html

class lief.PE.IMPHASH_MODE(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

Enum to define the behavior of get_imphash()

DEFAULT = 0
LIEF = 0
PEFILE = 1
VT = 1
lief.PE.resolve_ordinals(imp: lief.PE.Import, strict: bool, use_std: bool) → lief.PE.Import | lief.lief_errors

Take a Import as input and try to resolve its ordinal imports.

If the strict boolean parameter is set, a lief.lief_errors.not_found error is returned upon the first non-resolvable ordinal.

Enums

PE_TYPE

class lief.PE.PE_TYPE(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

PE32 = 267
PE32_PLUS = 523
from_value(arg: int) → lief.PE.PE_TYPE = <nanobind.nb_func object>

SECTION_TYPES

class lief.PE.SECTION_TYPES(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

BSS = 4
DATA = 3
EXPORT = 7
IDATA = 2
RELOCATION = 6
RESOURCE = 5
TEXT = 0
TLS_ = 1
UNKNOWN = 10
from_value(arg: int) → lief.PE.SECTION_TYPES = <nanobind.nb_func object>

SYMBOL_BASE_TYPES

class lief.PE.SYMBOL_BASE_TYPES(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

BYTE = 12
CHAR = 2
DOUBLE = 7
DWORD = 15
ENUM = 10
FLOAT = 6
INT = 4
LONG = 5
MOE = 11
NULL = 0
SHORT = 3
STRUCT = 8
UINT = 14
UNION = 9
VOID = 1
WORD = 13
from_value(arg: int) → lief.PE.SYMBOL_BASE_TYPES = <nanobind.nb_func object>

SYMBOL_COMPLEX_TYPES

class lief.PE.SYMBOL_COMPLEX_TYPES(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

ARRAY = 3
COMPLEX_TYPE_SHIFT = 4
FUNCTION = 2
NULL = 0
POINTER = 1
from_value(arg: int) → lief.PE.SYMBOL_COMPLEX_TYPES = <nanobind.nb_func object>

SYMBOL_SECTION_NUMBER

class lief.PE.SYMBOL_SECTION_NUMBER(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

ABSOLUTE = -1
DEBUG = -2
UNDEFINED = 0
from_value(arg: int) → lief.PE.SYMBOL_SECTION_NUMBER = <nanobind.nb_func object>

SYMBOL_STORAGE_CLASS

class lief.PE.SYMBOL_STORAGE_CLASS(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

AUTOMATIC = 1
BIT_FIELD = 18
BLOCK = 100
CLR_TOKEN = 107
END_OF_FUNCTION = -1
END_OF_STRUCT = 102
ENUM_TAG = 15
EXTERNAL = 2
EXTERNAL_DEF = 5
FILE = 103
FUNCTION = 101
LABEL = 6
MEMBER_OF_ENUM = 16
MEMBER_OF_STRUCT = 8
NULL = 0
REGISTER = 4
REGISTER_PARAM = 17
SECTION = 104
STATIC = 3
TYPE_DEFINITION = 13
UDEFINED_STATIC = 14
UNDEFINED_LABEL = 7
UNION_TAG = 12
WEAK_EXTERNAL = 105
from_value(arg: int) → lief.PE.SYMBOL_STORAGE_CLASS = <nanobind.nb_func object>

FIXED_VERSION_FILE_SUB_TYPES

class lief.PE.CODE_PAGES(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

ASMO_708 = 708
BIG5 = 950
CP1025 = 21025
CP866 = 866
CP875 = 875
CSISO2022JP = 50221
DOS_720 = 720
DOS_862 = 862
EUC_CN = 51936
EUC_JP = 51932
EUC_JP_JIS = 20932
EUC_KR = 51949
GB18030 = 54936
GB2312 = 936
HZ_GB_2312 = 52936
IBM00858 = 858
IBM00924 = 20924
IBM01047 = 1047
IBM01140 = 1140
IBM01141 = 1141
IBM01142 = 1142
IBM01143 = 1143
IBM01144 = 1144
IBM01145 = 1145
IBM01146 = 1146
IBM01147 = 1147
IBM01148 = 1148
IBM01149 = 1149
IBM037 = 37
IBM1026 = 1026
IBM273 = 20273
IBM277 = 20277
IBM278 = 20278
IBM280 = 20280
IBM284 = 20284
IBM285 = 20285
IBM290 = 20290
IBM297 = 20297
IBM420 = 20420
IBM423 = 20423
IBM424 = 20424
IBM437 = 437
IBM500 = 500
IBM737 = 737
IBM775 = 775
IBM850 = 850
IBM852 = 852
IBM855 = 855
IBM857 = 857
IBM860 = 860
IBM861 = 861
IBM863 = 863
IBM864 = 864
IBM865 = 865
IBM869 = 869
IBM870 = 870
IBM871 = 20871
IBM880 = 20880
IBM905 = 20905
IBM_THAI = 20838
ISO_2022_JP = 50220
ISO_2022_JP_JIS = 50222
ISO_2022_KR = 50225
ISO_8859_1 = 28591
ISO_8859_13 = 28603
ISO_8859_15 = 28605
ISO_8859_2 = 28592
ISO_8859_3 = 28593
ISO_8859_4 = 28594
ISO_8859_5 = 28595
ISO_8859_6 = 28596
ISO_8859_7 = 28597
ISO_8859_8 = 28598
ISO_8859_8_I = 38598
ISO_8859_9 = 28599
JOHAB = 1361
KOI8_R = 20866
KOI8_U = 21866
KS_C_5601_1987 = 949
MACINTOSH = 10000
SHIFT_JIS = 932
UNICODEFFFE = 1201
US_ASCII = 20127
UTF_16 = 1200
UTF_32 = 12000
UTF_32BE = 12001
UTF_7 = 65000
UTF_8 = 65001
WINDOWS_1250 = 1250
WINDOWS_1251 = 1251
WINDOWS_1252 = 1252
WINDOWS_1253 = 1253
WINDOWS_1254 = 1254
WINDOWS_1255 = 1255
WINDOWS_1256 = 1256
WINDOWS_1257 = 1257
WINDOWS_1258 = 1258
WINDOWS_874 = 874
X_CHINESE_CNS = 20000
X_CHINESE_ETEN = 20002
X_CP20001 = 20001
X_CP20003 = 20003
X_CP20004 = 20004
X_CP20005 = 20005
X_CP20261 = 20261
X_CP20269 = 20269
X_CP20936 = 20936
X_CP20949 = 20949
X_CP50227 = 50227
X_EBCDIC_KOREANEXTENDED = 20833
X_EUROPA = 29001
X_IA5 = 20105
X_IA5_GERMAN = 20106
X_IA5_NORWEGIAN = 20108
X_IA5_SWEDISH = 20107
X_ISCII_AS = 57006
X_ISCII_BE = 57003
X_ISCII_DE = 57002
X_ISCII_GU = 57010
X_ISCII_KA = 57008
X_ISCII_MA = 57009
X_ISCII_OR = 57007
X_ISCII_PA = 57011
X_ISCII_TA = 57004
X_ISCII_TE = 57005
X_MAC_ARABIC = 10004
X_MAC_CE = 10029
X_MAC_CHINESESIMP = 10008
X_MAC_CHINESETRAD = 10002
X_MAC_CROATIAN = 10082
X_MAC_CYRILLIC = 10007
X_MAC_GREEK = 10006
X_MAC_HEBREW = 10005
X_MAC_ICELANDIC = 10079
X_MAC_JAPANESE = 10001
X_MAC_KOREAN = 10003
X_MAC_ROMANIAN = 10010
X_MAC_THAI = 10021
X_MAC_TURKISH = 10081
X_MAC_UKRAINIAN = 10017
from_value(arg: int) → lief.PE.CODE_PAGES = <nanobind.nb_func object>

WINDOW_STYLES

class lief.PE.WINDOW_STYLES(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

BORDER = 8388608
CAPTION = 12582912
CHILD = 1073741824
CLIPCHILDREN = 33554432
CLIPSIBLINGS = 67108864
DISABLED = 134217728
DLGFRAME = 4194304
GROUP = 131072
HSCROLL = 1048576
MAXIMIZE = 16777216
MAXIMIZEBOX = 65536
MINIMIZE = 536870912
MINIMIZEBOX = 131072
OVERLAPPED = 0
POPUP = 2147483648
SYSMENU = 524288
TABSTOP = 65536
THICKFRAME = 262144
VISIBLE = 268435456
VSCROLL = 2097152
from_value(arg: int) → lief.PE.WINDOW_STYLES = <nanobind.nb_func object>

EXTENDED_WINDOW_STYLES

class lief.PE.EXTENDED_WINDOW_STYLES(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

ACCEPTFILES = 16
APPWINDOW = 262144
CLIENTEDGE = 512
CONTEXTHELP = 1024
CONTROLPARENT = 65536
DLGMODALFRAME = 1
LEFT = 0
LEFTSCROLLBAR = 16384
LTRREADING = 0
MDICHILD = 64
NOPARENTNOTIFY = 4
RIGHT = 4096
RIGHTSCROLLBAR = 0
RTLREADING = 8192
STATICEDGE = 131072
TOOLWINDOW = 128
TOPMOST = 8
TRANSPARENT = 32
WINDOWEDGE = 256
from_value(arg: int) → lief.PE.EXTENDED_WINDOW_STYLES = <nanobind.nb_func object>

DIALOG_BOX_STYLES

class lief.PE.DIALOG_BOX_STYLES(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

ABSALIGN = 1
CENTER = 2048
CENTERMOUSE = 4096
CONTEXTHELP = 8192
CONTROL = 1024
D3DLOOK = 4
FIXEDSYS = 8
LOCALEDIT = 32
MODALFRAME = 128
NOFAILCREATE = 16
NOIDLEMSG = 256
SETFONT = 64
SETFOREGROUND = 512
SHELLFONT = 72
SYSMODAL = 2
from_value(arg: int) → lief.PE.DIALOG_BOX_STYLES = <nanobind.nb_func object>

FIXED_VERSION_OS

class lief.PE.FIXED_VERSION_OS(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

DOS = 65536
DOS_WINDOWS16 = 65537
DOS_WINDOWS32 = 65540
NT = 262144
NT_WINDOWS32 = 262148
OS216 = 131072
OS216_PM16 = 131074
OS232 = 196608
OS232_PM32 = 196611
PM16 = 2
PM32 = 3
UNKNOWN = 0
WINDOWS16 = 1
WINDOWS32 = 4
from_value(arg: int) → lief.PE.FIXED_VERSION_OS = <nanobind.nb_func object>

FIXED_VERSION_FILE_FLAGS

class lief.PE.FIXED_VERSION_FILE_FLAGS(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

DEBUG = 1
INFOINFERRED = 16
PATCHED = 4
PRERELEASE = 2
PRIVATEBUILD = 8
SPECIALBUILD = 32
from_value(arg: int) → lief.PE.FIXED_VERSION_FILE_FLAGS = <nanobind.nb_func object>

FIXED_VERSION_FILE_TYPES

class lief.PE.FIXED_VERSION_FILE_TYPES(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

APP = 1
DLL = 2
DRV = 3
FONT = 4
STATIC_LIB = 7
UNKNOWN = 0
VXD = 5
from_value(arg: int) → lief.PE.FIXED_VERSION_FILE_TYPES = <nanobind.nb_func object>

RESOURCE_LANGS

class lief.PE.RESOURCE_LANGS(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

AFRIKAANS = 54
ALBANIAN = 28
ARABIC = 1
ARMENIAN = 43
ASSAMESE = 77
AZERI = 44
BANGLA = 69
BASQUE = 45
BELARUSIAN = 35
BOSNIAN = 26
BRETON = 147
BULGARIAN = 2
CATALAN = 3
CHINESE = 4
CORNISH = 145
CROATIAN = 26
CZECH = 5
DANISH = 6
DIVEHI = 101
DUTCH = 19
ENGLISH = 9
ESPERANTO = 143
ESTONIAN = 37
FAEROESE = 56
FARSI = 41
FINNISH = 11
FRENCH = 12
GAELIC = 60
GALICIAN = 86
GEORGIAN = 55
GERMAN = 7
GREEK = 8
GUJARATI = 71
HEBREW = 13
HINDI = 57
HUNGARIAN = 14
ICELANDIC = 15
INDONESIAN = 33
INUKTITUT = 93
INVARIANT = 127
IRISH = 60
ITALIAN = 16
JAPANESE = 17
KANNADA = 75
KASHMIRI = 96
KAZAK = 63
KONKANI = 87
KOREAN = 18
KYRGYZ = 64
LATVIAN = 38
LITHUANIAN = 39
LOWER_SORBIAN = 46
MACEDONIAN = 47
MALAY = 62
MALAYALAM = 76
MALTESE = 58
MANIPURI = 88
MAORI = 40
MARATHI = 78
MONGOLIAN = 80
NEPALI = 97
NEUTRAL = 0
NORWEGIAN = 20
ORIYA = 72
POLISH = 21
PORTUGUESE = 22
PULAR = 103
PUNJABI = 70
QUECHUA = 107
RHAETO_ROMANCE = 23
ROMANIAN = 24
RUSSIAN = 25
SAMI = 59
SANSKRIT = 79
SERBIAN = 26
SINDHI = 89
SLOVAK = 27
SLOVENIAN = 36
SORBIAN = 46
SPANISH = 10
SUTU = 48
SWAHILI = 65
SWEDISH = 29
SYRIAC = 90
TAMAZIGHT = 95
TAMIL = 73
TATAR = 68
TELUGU = 74
THAI = 30
TIGRINYA = 115
TSONGA = 49
TSWANA = 50
TURKISH = 31
UKRAINIAN = 34
URDU = 32
UZBEK = 67
VALENCIAN = 3
VENDA = 51
VIETNAMESE = 42
WALON = 144
WELSH = 146
XHOSA = 52
ZULU = 53
from_value(arg: int) → lief.PE.RESOURCE_LANGS = <nanobind.nb_func object>

FIXED_VERSION_FILE_SUB_TYPES

class lief.PE.FIXED_VERSION_FILE_SUB_TYPES(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

DRV_COMM = 10
DRV_DISPLAY = 4
DRV_INSTALLABLE = 8
DRV_KEYBOARD = 2
DRV_LANGUAGE = 3
DRV_MOUSE = 5
DRV_NETWORK = 6
DRV_PRINTER = 1
DRV_SOUND = 9
DRV_SYSTEM = 7
DRV_VERSIONED_PRINTER = 12
FONT_RASTER = 1
FONT_TRUETYPE = 3
FONT_VECTOR = 2
UNKNOWN = 0
from_value(arg: int) → lief.PE.FIXED_VERSION_FILE_SUB_TYPES = <nanobind.nb_func object>

ALGORITHMS

class lief.PE.ALGORITHMS(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

Bases: Enum

EC = 9
MD2 = 7
MD4 = 6
MD5 = 5
MD5_RSA = 10
RSA = 8
SHA1_DSA = 11
SHA1_ECDSA = 16
SHA1_RSA = 12
SHA_1 = 4
SHA_256 = 3
SHA_256_ECDSA = 17
SHA_256_RSA = 13
SHA_384 = 2
SHA_384_ECDSA = 18
SHA_384_RSA = 14
SHA_512 = 1
SHA_512_ECDSA = 19
SHA_512_RSA = 15
UNKNOWN = 0
from_value(arg: int) → lief.PE.ALGORITHMS = <nanobind.nb_func object>