Abstract

Parser

lief.parse(*args, **kwargs)

Overloaded function.

  1. parse(filepath: str) -> lief.Binary

Parse the given binary and return a Binary object

  1. parse(raw: List[int], name: str=’’) -> lief.Binary

Parse the given binary and return a Binary object

  1. parse(io: object, name: str=’’) -> lief.Binary


Binary

class lief.Binary
class VA_TYPES(self: lief.Binary.VA_TYPES, arg0: int) → None
AUTO = VA_TYPES.AUTO
RVA = VA_TYPES.RVA
VA = VA_TYPES.VA
property abstract

Return the Binary object

Warning

Getting this property modifies the __class__ attribute so that the current binary looks like a Binary.

Use the concrete to get back to the original binary.

property concrete

Return either lief.ELF.Binary, lief.PE.Binary, lief.MachO.Binary object

property ctor_functions

Constructor functions that are called prior any other functions

property entrypoint

Binary’s entrypoint

property exported_functions

Return binary’s exported Function

property format

File format EXE_FORMATS of the underlying binary.

get_content_from_virtual_address(self: lief.Binary, virtual_address: int, size: int, va_type: lief.Binary.VA_TYPES=VA_TYPES.AUTO) → List[int]

Return the content located at virtual address.

Virtual address is specified in the first argument and size to read (in bytes) in the second. If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default it is set to AUTO

get_function_address(self: lief.Binary, function_name: str) → int

Return the address of the given function name

get_symbol(self: lief.Binary, symbol_name: str) → LIEF::Symbol

Return the Symbol with the given name

property has_nx

Check if the binary uses NX protection

has_symbol(self: lief.Binary, symbol_name: str) → bool

Check if a Symbol with the given name exists

property header

Binary’s header

property imported_functions

Return binary’s imported Function (name)

property is_pie

Check if the binary is position independent

property libraries

Return binary’s imported libraries (name)

property name

Binary’s name

patch_address(*args, **kwargs)

Overloaded function.

  1. patch_address(self: lief.Binary, address: int, patch_value: List[int], va_type: lief.Binary.VA_TYPES=VA_TYPES.AUTO) -> None

Virtual address is specified in the first argument and the content in the second (as a list of bytes). If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default it is set to AUTO

  1. patch_address(self: lief.Binary, address: int, patch_value: int, size: int=8, va_type: lief.Binary.VA_TYPES=VA_TYPES.AUTO) -> None

Virtual address is specified in the first argument, integer in the second and sizeof the integer in third one. If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default it is set to AUTO

property relocations

Return an iterator over abstract Relocation

remove_section(self: lief.Binary, name: str, clear: bool=False) → None

Remove the section with the given name

property sections

Return a list in read only of binary’s abstract Section

property symbols

Return a list in read only of binary’s abstract Symbol

xref(self: lief.Binary, Return all **virtual address** that *use* the ``address`` given in parametervirtual_address: int) → List[int]


Section

class lief.Section(*args, **kwargs)

Overloaded function.

  1. __init__(self: lief.Section) -> None

Default constructor

  1. __init__(self: lief.Section, name: str) -> None

Constructor from section name

property content

Section’s content

property entropy

Section’s entropy

property name

Section’s name

property offset

Section’s offset

search(*args, **kwargs)

Overloaded function.

  1. search(self: lief.Section, number: int, pos: int=0, size: int=0) -> int

Look for integer within the current section

  1. search(self: lief.Section, str: str, pos: int=0) -> int

Look for string within the current section

search_all(*args, **kwargs)

Overloaded function.

  1. search_all(self: lief.Section, number: int, size: int=0) -> List[int]

Look for all integers within the current section

  1. search_all(self: lief.Section, str: str) -> List[int]

Look for all strings within the current section

property size

Section’s size

property virtual_address

Section’s virtual address


Symbol

class lief.Symbol(self: lief.Symbol) → None
property name

Symbol’s name

property size

Symbol’s size

property value

Symbol’s value


Relocation

class lief.Relocation(*args, **kwargs)

Overloaded function.

  1. __init__(self: lief.Relocation) -> None

Default constructor

  1. __init__(self: lief.Relocation, address: int, size: int) -> None

Constructor from address and size

property address

Relocation’s address

property size

Relocation’s size (in bits)


Function

class lief.Function(*args, **kwargs)

Overloaded function.

  1. __init__(self: lief.Function) -> None

  2. __init__(self: lief.Function, arg0: str) -> None

  3. __init__(self: lief.Function, arg0: int) -> None

  4. __init__(self: lief.Function, arg0: str, arg1: int) -> None

class FLAGS(self: lief.Function.FLAGS, arg0: int) → None
CONSTRUCTOR = FLAGS.CONSTRUCTOR
DEBUG = FLAGS.DEBUG
DESTRUCTOR = FLAGS.DESTRUCTOR
EXPORTED = FLAGS.EXPORTED
IMPORTED = FLAGS.IMPORTED
property address

Symbol’s value

property name

Symbol’s name

property size

Symbol’s size

property value

Symbol’s value

Enums

Executable formats

class lief.EXE_FORMATS(self: lief.EXE_FORMATS, arg0: int) → None
ELF = EXE_FORMATS.ELF
MACHO = EXE_FORMATS.MACHO
PE = EXE_FORMATS.PE
UNKNOWN = EXE_FORMATS.UNKNOWN

Object types

class lief.OBJECT_TYPES(self: lief.OBJECT_TYPES, arg0: int) → None
EXECUTABLE = OBJECT_TYPES.EXECUTABLE
LIBRARY = OBJECT_TYPES.LIBRARY
NONE = OBJECT_TYPES.NONE
OBJECT = OBJECT_TYPES.OBJECT

Architectures

class lief.ARCHITECTURES(self: lief.ARCHITECTURES, arg0: int) → None
ARM = ARCHITECTURES.ARM
ARM64 = ARCHITECTURES.ARM64
INTEL = ARCHITECTURES.INTEL
MIPS = ARCHITECTURES.MIPS
NONE = ARCHITECTURES.NONE
PPC = ARCHITECTURES.PPC
SPARC = ARCHITECTURES.SPARC
SYSZ = ARCHITECTURES.SYSZ
X86 = ARCHITECTURES.X86
XCODE = ARCHITECTURES.XCODE

Modes

class lief.MODES(self: lief.MODES, arg0: int) → None
ARM = MODES.ARM
M16 = MODES.M16
M32 = MODES.M32
M64 = MODES.M64
MCLASS = MODES.MCLASS
MIPS3 = MODES.MIPS3
MIPS32 = MODES.MIPS32
MIPS32R6 = MODES.MIPS32R6
MIPS64 = MODES.MIPS64
MIPSGP64 = MODES.MIPSGP64
NONE = MODES.NONE
THUMB = MODES.THUMB
UNDEFINED = MODES.UNDEFINED
V7 = MODES.V7
V8 = MODES.V8
V9 = MODES.V9

Endianness

class lief.ENDIANNESS(self: lief.ENDIANNESS, arg0: int) → None
BIG = ENDIANNESS.BIG
LITTLE = ENDIANNESS.LITTLE
NONE = ENDIANNESS.NONE