Home
lief.MachO.
parse
(*args, **kwargs)¶Overloaded function.
parse(filename: str, config: lief.MachO.ParserConfig = <lief.MachO.ParserConfig object at 0x7f374f6ebb58>) -> LIEF::MachO::FatBinary
Parse the given binary and return a FatBinary
object
One can configure the parsing with the config
parameter. See ParserConfig
parse(raw: List[int], name: str = ‘’, config: lief.MachO.ParserConfig = <lief.MachO.ParserConfig object at 0x7f374f781730>) -> LIEF::MachO::FatBinary
Parse the given binary (from raw) and return a FatBinary
objects
One can configure the parsing with the config
parameter. See ParserConfig
parse(io: object, name: str = ‘’, config: lief.MachO.ParserConfig = <lief.MachO.ParserConfig object at 0x7f374f6ebb90>) -> LIEF::MachO::FatBinary
lief.MachO.
ParserConfig
(self: lief.MachO.ParserConfig) → None¶Configuration of MachO’s parser
deep
= <lief.MachO.ParserConfig object>¶parse_dyldinfo_deeply
¶If set to True
, parse deeply the DyldInfo
structure. It includes Exports, Bindings and Rebases
quick
= <lief.MachO.ParserConfig object>¶fatbinary_1 = lief.MachO.parse("/usr/bin/ls", config=lief.MachO.ParserConfig.deep)
# or
fatbinary_2 = lief.MachO.parse("/usr/bin/ls", config=lief.MachO.ParserConfig.quick)
lief.MachO.
FatBinary
¶at
(self: lief.MachO.FatBinary, index: int) → LIEF::MachO::Binary¶Return the Binary
at the given index
raw
(self: lief.MachO.FatBinary) → List[int]¶Build a Mach-O universal binary and return its bytes
write
(self: lief.MachO.FatBinary, filename: str) → None¶Build a Mach-O universal binary
lief.MachO.
Binary
¶VA_TYPES
(self: lief.Binary.VA_TYPES, value: int) → None¶Members:
AUTO
VA
RVA
AUTO
= <VA_TYPES.AUTO: 0>¶RVA
= <VA_TYPES.RVA: 1>¶VA
= <VA_TYPES.VA: 2>¶name
¶add
(*args, **kwargs)¶Overloaded function.
add(self: lief.MachO.Binary, dylib_command: LIEF::MachO::DylibCommand) -> LIEF::MachO::LoadCommand
Add a new DylibCommand
add(self: lief.MachO.Binary, segment: LIEF::MachO::SegmentCommand) -> LIEF::MachO::LoadCommand
Add a new SegmentCommand
add(self: lief.MachO.Binary, load_command: LIEF::MachO::LoadCommand) -> LIEF::MachO::LoadCommand
Add a new LoadCommand
add(self: lief.MachO.Binary, load_command: LIEF::MachO::LoadCommand, index: int) -> LIEF::MachO::LoadCommand
Add a new LoadCommand
at index
add_library
(self: lief.MachO.Binary, library_name: str) → LIEF::MachO::LoadCommand¶Add a new library dependency
add_section
(*args, **kwargs)¶Overloaded function.
add_section(self: lief.MachO.Binary, segment: LIEF::MachO::SegmentCommand, section: LIEF::MachO::Section) -> LIEF::MachO::Section
Add a new Section
in the given SegmentCommand
add_section(self: lief.MachO.Binary, section: LIEF::MachO::Section) -> LIEF::MachO::Section
Add a new Section
within the __TEXT
segment
add_section(self: lief.MachO.Binary, section: LIEF::MachO::SegmentCommand, section: LIEF::MachO::Section) -> LIEF::MachO::Section
Add a new Section
in the given SegmentCommand
build_version
¶Return binary’s BuildVersion
if any.
can_remove
(self: lief.MachO.Binary, symbol: LIEF::MachO::Symbol) → bool¶Check if the given symbol can be safely removed.
can_remove_symbol
(self: lief.MachO.Binary, symbol_name: str) → bool¶Check if the given symbol name can be safely removed.
code_signature
¶Return binary’s CodeSignature
if any.
code_signature_dir
¶Return binary’s CodeSignature
if any.
commands
¶Return binary’s Command
concrete
¶Return either lief.ELF.Binary
, lief.PE.Binary
, lief.MachO.Binary
object
ctor_functions
¶Constructor functions that are called prior any other functions
data_in_code
¶Return binary’s DataInCode
if any.
dyld_environment
¶Return binary’s DyldEnvironment
if any.
dylinker
¶Return binary’s DylinkerCommand
if any.
dynamic_symbol_command
¶Return binary’s DynamicSymbolCommand
if any.
encryption_info
¶Return binary’s EncryptionInfo
if any.
entrypoint
¶Binary’s entrypoint
extend
(self: lief.MachO.Binary, load_command: LIEF::MachO::LoadCommand, size: int) → bool¶Extend a LoadCommand
by size
extend_segment
(self: lief.MachO.Binary, segment_command: LIEF::MachO::SegmentCommand, size: int) → bool¶Extend the content of the given SegmentCommand
by size
fat_offset
¶Return binary’s fat offset. 0
if not relevant.
format
¶File format EXE_FORMATS
of the underlying binary.
function_starts
¶Return binary’s FunctionStarts
if any.
get
(self: lief.MachO.Binary, type: lief.MachO.LOAD_COMMAND_TYPES) → LIEF::MachO::LoadCommand¶Return the first LoadCommand
having the given LOAD_COMMAND_TYPES
get_content_from_virtual_address
(self: lief.Binary, virtual_address: int, size: int, va_type: lief.Binary.VA_TYPES = <VA_TYPES.AUTO: 0>) → List[int]¶Return the content located at virtual address.
Virtual address is specified in the first argument and size to read (in bytes) in the second. If the underlying binary is a PE, one can specify if the virtual address is a RVA
or a VA
. By default it is set to AUTO
get_function_address
(self: lief.Binary, function_name: str) → int¶Return the address of the given function name
get_section
(self: lief.MachO.Binary, name: str) → LIEF::MachO::Section¶Return the section from the given name
get_segment
(self: lief.MachO.Binary, name: str) → LIEF::MachO::SegmentCommand¶Return the SegmentCommand
from the given name
get_symbol
(self: lief.MachO.Binary, name: str) → LIEF::MachO::Symbol¶Return the Symbol
from the given name
has
(self: lief.MachO.Binary, type: lief.MachO.LOAD_COMMAND_TYPES) → bool¶Check if the current binary has a LoadCommand
with the given LOAD_COMMAND_TYPES
has_build_version
¶True
if the binary has a BuildVersion
command
has_code_signature
¶True
if the binary is signed (i.e. has a CodeSignature
command)
has_code_signature_dir
¶True
if the binary is signed (i.e. has a CodeSignature
command) with the command LC_DYLIB_CODE_SIGN_DRS
has_data_in_code
¶True
if the binary has a DataInCode
command
has_dyld_environment
¶True
if the binary has a DyldEnvironment
command
has_dylinker
¶True
if the binary has a DylinkerCommand
command.
has_dynamic_symbol_command
¶True
if the binary has a DynamicSymbolCommand
command.
has_encryption_info
¶True
if the binary has a EncryptionInfo
command
has_entrypoint
¶True
if the binary has an entrypoint. Basically for libraries it will return false
has_function_starts
¶True
if the binary has a FunctionStarts
command.
has_main_command
¶True
if the binary has a MainCommand
command.
has_nx
¶Check if the binary uses NX
protection
has_rpath
¶True
if the binary has a RPathCommand
command.
has_section
(self: lief.MachO.Binary, name: str) → bool¶Check if a section with the given name exists
has_segment
(self: lief.MachO.Binary, name: str) → bool¶Check if a SegmentCommand
with the given name exists
has_segment_split_info
¶True
if the binary has a SegmentSplitInfo
command
has_source_version
¶True
if the binary has a SourceVersion
command.
has_sub_framework
¶True
if the binary has a SubFramework
command
has_symbol
(self: lief.MachO.Binary, name: str) → bool¶Check if a Symbol
with the given name exists
has_symbol_command
¶True
if the binary has a SymbolCommand
command.
has_thread_command
¶True
if the binary has a ThreadCommand
command.
has_uuid
¶True
if the binary has a UUIDCommand
command.
has_version_min
¶True
if the binary has a VersionMin
command.
imagebase
¶Return binary’s image base
which is the base address where segments are mapped (without PIE). 0
if not relevant.
is_pie
¶Check if the binary is position independent
is_valid_addr
(self: lief.MachO.Binary, address: int) → bool¶Check if the given address is comprise between the lowest virtual address and the biggest one
libraries
¶Return binary’s DylibCommand
main_command
¶Return binary’s MainCommand
if any.
name
¶Binary’s name
off_ranges
¶Return the range of offsets as a tuple (off_start, off_end)
patch_address
(*args, **kwargs)¶Overloaded function.
patch_address(self: lief.Binary, address: int, patch_value: List[int], va_type: lief.Binary.VA_TYPES = <VA_TYPES.AUTO: 0>) -> None
Virtual address is specified in the first argument and the content in the second (as a list of bytes). If the underlying binary is a PE, one can specify if the virtual address is a RVA
or a VA
. By default it is set to AUTO
patch_address(self: lief.Binary, address: int, patch_value: int, size: int = 8, va_type: lief.Binary.VA_TYPES = <VA_TYPES.AUTO: 0>) -> None
Virtual address is specified in the first argument, integer in the second and sizeof the integer in third one. If the underlying binary is a PE, one can specify if the virtual address is a RVA
or a VA
. By default it is set to AUTO
relocations
¶Return an iterator over binary’s Relocation
remove
(*args, **kwargs)¶Overloaded function.
remove(self: lief.MachO.Binary, load_command: LIEF::MachO::LoadCommand) -> bool
Remove a LoadCommand
remove(self: lief.MachO.Binary, type: lief.MachO.LOAD_COMMAND_TYPES) -> bool
Remove all LoadCommand
having the given LOAD_COMMAND_TYPES
remove(self: lief.MachO.Binary, symbol: LIEF::MachO::Symbol) -> bool
Remove the given Symbol
remove_command
(self: lief.MachO.Binary, index: int) → bool¶Remove the LoadCommand
at index
remove_section
(self: lief.Binary, name: str, clear: bool = False) → None¶Remove the section with the given name
remove_signature
(self: lief.MachO.Binary) → bool¶Remove the CodeSignature
(if any)
remove_symbol
(self: lief.MachO.Binary, name: str) → bool¶Remove all symbol(s) with the given name
rpath
¶Return binary’s RPathCommand
if any.
section_from_offset
(self: lief.MachO.Binary, arg0: int) → LIEF::MachO::Section¶Return the Section
which contains the offset
section_from_virtual_address
(self: lief.MachO.Binary, arg0: int) → LIEF::MachO::Section¶Return the Section
which contains the virtual address
segment_from_offset
(self: lief.MachO.Binary, arg0: int) → LIEF::MachO::SegmentCommand¶Return the SegmentCommand
which contains the offset
segment_from_virtual_address
(self: lief.MachO.Binary, arg0: int) → LIEF::MachO::SegmentCommand¶Return the SegmentCommand
which contains the virtual address
segment_split_info
¶Return binary’s SegmentSplitInfo
if any.
segments
¶Return binary’s SegmentCommand
source_version
¶Return binary’s SourceVersion
if any.
sub_framework
¶Return binary’s SubFramework
if any.
symbol_command
¶Return binary’s SymbolCommand
if any.
thread_command
¶Return binary’s ThreadCommand
if any.
unexport
(*args, **kwargs)¶Overloaded function.
unexport(self: lief.MachO.Binary, name: str) -> bool
Remove the symbol from the export table
unexport(self: lief.MachO.Binary, symbol: LIEF::MachO::Symbol) -> bool
Remove the symbol from the export table
uuid
¶Return binary’s UUIDCommand
if any.
va_ranges
¶Return the range of virtual addresses as a tuple (va_start, va_end)
version_min
¶Return binary’s VersionMin
if any.
virtual_address_to_offset
(self: lief.MachO.Binary, virtual_address: int) → int¶Convert the virtual address to an offset in the binary
virtual_size
¶Binary’s memory size when mapped
write
(self: lief.MachO.Binary, output: str) → None¶Rebuild the binary and write it in a file
xref
(self: lief.Binary, virtual_address: int) → List[int]¶Return all virtual addresses that use the address
given in parameter
lief.MachO.
Header
(self: lief.MachO.Header) → None¶add
(self: lief.MachO.Header, flag: lief.MachO.HEADER_FLAGS) → None¶Add the given HEADER_FLAGS
cpu_subtype
¶CPU subtype
file_type
¶Binary’s type ( FILE_TYPES
)
flags
¶Binary’s flags ( HEADER_FLAGS
)
flags_list
¶HEADER_FLAGS
as a list
has
(self: lief.MachO.Header, flag: lief.MachO.HEADER_FLAGS) → bool¶True
if the given HEADER_FLAGS
is in the flags
magic
¶nb_cmds
¶Number of LoadCommand
remove
(self: lief.MachO.Header, flag: lief.MachO.HEADER_FLAGS) → None¶Remove the given HEADER_FLAGS
reserved
¶sizeof_cmds
¶Size of all LoadCommand
lief.MachO.
Section
(*args, **kwargs)¶Overloaded function.
__init__(self: lief.MachO.Section) -> None
__init__(self: lief.MachO.Section, section_name: str) -> None
Constructor with the section name
__init__(self: lief.MachO.Section, section_name: str, content: List[int]) -> None
Constructor with the section name and its content
add
(self: lief.MachO.Section, flag: lief.MachO.SECTION_FLAGS) → None¶Add the given SECTION_FLAGS
alignment
¶Section’s alignment
content
¶Section’s content
entropy
¶Section’s entropy
flags
¶flags_list
¶has
(self: lief.MachO.Section, flag: lief.MachO.SECTION_FLAGS) → bool¶Check if the section has the given SECTION_FLAGS
has_segment
¶True if the current section has a segment associated with
name
¶Section’s name
numberof_relocations
¶offset
¶Section’s offset
relocation_offset
¶relocations
¶Iterator over Relocation
(if any)
remove
(self: lief.MachO.Section, flag: lief.MachO.SECTION_FLAGS) → None¶Remove the given SECTION_FLAGS
reserved1
¶reserved2
¶reserved3
¶search
(*args, **kwargs)¶Overloaded function.
search(self: lief.Section, number: int, pos: int = 0, size: int = 0) -> int
Look for integer within the current section
search(self: lief.Section, str: str, pos: int = 0) -> int
Look for string within the current section
search_all
(*args, **kwargs)¶Overloaded function.
search_all(self: lief.Section, number: int, size: int = 0) -> List[int]
Look for all integers within the current section
search_all(self: lief.Section, str: str) -> List[int]
Look for all strings within the current section
segment
¶SegmentCommand
segment associated with the section
size
¶Section’s size
type
¶virtual_address
¶Section’s virtual address
lief.MachO.
SegmentCommand
(*args, **kwargs)¶Overloaded function.
__init__(self: lief.MachO.SegmentCommand) -> None
__init__(self: lief.MachO.SegmentCommand, arg0: str) -> None
__init__(self: lief.MachO.SegmentCommand, arg0: str, arg1: List[int]) -> None
add_section
(self: lief.MachO.SegmentCommand, section: LIEF::MachO::Section) → LIEF::MachO::Section¶command
¶Command type ( LOAD_COMMAND_TYPES
)
command_offset
¶Offset of the command within the Load Command Table
content
¶Segment’s content
data
¶Command’s data
file_offset
¶Segment’s file offset
file_size
¶Segment’s file size
flags
¶Segment’s flags
has
(self: lief.MachO.SegmentCommand, section: LIEF::MachO::Section) → bool¶Check if the given Section
belongs to the current segment
has_section
(self: lief.MachO.SegmentCommand, section_name: str) → bool¶Check if the given section name belongs to the current segment
init_protection
¶Segment’s initial protection
max_protection
¶Segment’s max protection
name
¶Segment’s name
numberof_sections
¶Number of sections in this segment
relocations
¶Segment’s relocations
sections
¶Segment’s sections
size
¶Size of the command (should be greather than sizeof(load_command)
)
virtual_address
¶Segment’s virtual address
virtual_size
¶Segment’s virtual size
lief.MachO.
LoadCommand
(self: lief.MachO.LoadCommand) → None¶command
¶Command type ( LOAD_COMMAND_TYPES
)
command_offset
¶Offset of the command within the Load Command Table
data
¶Command’s data
size
¶Size of the command (should be greather than sizeof(load_command)
)
lief.MachO.
DylibCommand
¶command
¶Command type ( LOAD_COMMAND_TYPES
)
command_offset
¶Offset of the command within the Load Command Table
compatibility_version
¶Library’s compatibility version
current_version
¶Library’s current version
data
¶Command’s data
id_dylib
(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) → lief.MachO.DylibCommand¶Factory function to generate a ID_DYLIB
library
lazy_load_dylib
(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) → lief.MachO.DylibCommand¶Factory function to generate a LAZY_LOAD_DYLIB
library
load_dylib
(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) → lief.MachO.DylibCommand¶Factory function to generate a LOAD_DYLIB
library
load_upward_dylib
(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) → lief.MachO.DylibCommand¶Factory function to generate a LOAD_UPWARD_DYLIB
library
name
¶Library’s name
reexport_dylib
(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) → lief.MachO.DylibCommand¶Factory function to generate a REEXPORT_DYLIB
library
size
¶Size of the command (should be greather than sizeof(load_command)
)
timestamp
¶Library’s timestamp
weak_lib
(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) → lief.MachO.DylibCommand¶Factory function to generate a LC_LOAD_WEAK_DYLIB
library
lief.MachO.
DylinkerCommand
¶command
¶Command type ( LOAD_COMMAND_TYPES
)
command_offset
¶Offset of the command within the Load Command Table
data
¶Command’s data
name
¶Path to the loader used to load the binary
size
¶Size of the command (should be greather than sizeof(load_command)
)
lief.MachO.
UUIDCommand
¶command
¶Command type ( LOAD_COMMAND_TYPES
)
command_offset
¶Offset of the command within the Load Command Table
data
¶Command’s data
size
¶Size of the command (should be greather than sizeof(load_command)
)
uuid
¶UUID as a list
lief.MachO.
MainCommand
¶command
¶Command type ( LOAD_COMMAND_TYPES
)
command_offset
¶Offset of the command within the Load Command Table
data
¶Command’s data
entrypoint
¶Program entry point
size
¶Size of the command (should be greather than sizeof(load_command)
)
stack_size
¶Program stack_size
lief.MachO.
Symbol
(self: lief.MachO.Symbol) → None¶binding_info
¶BindingInfo
associated with the symbol (if any)
demangled_name
¶Symbol’s unmangled name
description
¶export_info
¶ExportInfo
associated with the symbol (if any)
has_binding_info
¶True
if the symbol has an BindingInfo
associated with
has_export_info
¶True
if the symbol has a ExportInfo
associated with
name
¶Symbol’s name
numberof_sections
¶origin
¶Return the SYMBOL_ORIGINS
of this symbol
size
¶Symbol’s size
type
¶value
¶lief.MachO.
SymbolCommand
(self: lief.MachO.SymbolCommand) → None¶command
¶Command type ( LOAD_COMMAND_TYPES
)
command_offset
¶Offset of the command within the Load Command Table
data
¶Command’s data
numberof_symbols
¶Number of symbols registered
size
¶Size of the command (should be greather than sizeof(load_command)
)
strings_offset
¶Offset from the start of the file to the string table
strings_size
¶Size of the size string table
symbol_offset
¶Offset from the start of the file to the n_list associated with the command
lief.MachO.
DynamicSymbolCommand
¶command
¶Command type ( LOAD_COMMAND_TYPES
)
command_offset
¶Offset of the command within the Load Command Table
data
¶Command’s data
external_reference_symbol_offset
¶Byte offset from the start of the file to the external reference table data.
This field seems unused by recent Mach-O loader and should be set to 0
external_relocation_offset
¶Byte offset from the start of the file to the module table data.
This field seems unused by recent Mach-O loader and should be set to 0
idx_external_define_symbol
¶Index of the first symbol in the group of defined external symbols.
idx_local_symbol
¶Index of the first symbol in the group of local symbols.
idx_undefined_symbol
¶Index of the first symbol in the group of undefined external symbols.
indirect_symbol_offset
¶Byte offset from the start of the file to the indirect symbol table data..
Indirect symbol table is used by the loader to speed-up symbol resolution during the lazy binding process
References:
dyld-519.2.1/src/ImageLoaderMachOCompressed.cpp
dyld-519.2.1/src/ImageLoaderMachOClassic.cpp
local_relocation_offset
¶Byte offset from the start of the file to the local relocation table data.
This field seems unused by recent Mach-O loader and should be set to 0
module_table_offset
¶Byte offset from the start of the file to the module table data.
This field seems unused by recent Mach-O loader and should be set to 0
nb_external_define_symbols
¶Number of symbols in the group of defined external symbols.
nb_external_reference_symbols
¶Number of entries in the external reference table
This field seems unused by recent Mach-O loader and should be set to 0
nb_external_relocations
¶Number of entries in the external relocation table.
This field seems unused by recent Mach-O loader and should be set to 0
nb_indirect_symbols
¶Number of entries in the indirect symbol table.
nb_local_relocations
¶Number of entries in the local relocation table.
This field seems unused by recent Mach-O loader and should be set to 0
nb_local_symbols
¶Number of symbols in the group of local symbols.
nb_module_table
¶Number of entries in the module table..
This field seems unused by recent Mach-O loader and should be set to 0
nb_toc
¶Number of entries in the table of contents
Should be set to 0 on recent Mach-O
nb_undefined_symbols
¶Number of symbols in the group of undefined external symbols.
size
¶Size of the command (should be greather than sizeof(load_command)
)
toc_offset
¶Byte offset from the start of the file to the table of contents data
Table of content is used by legacy Mach-O loader and this field should be set to 0
lief.MachO.
DyldInfo
¶bind
¶Bind information as a tuple (offset, size)
Dyld binds an image during the loading process, if the image requires any pointers to be initialized to symbols in other images. The rebase information is a stream of byte sized opcodes whose symbolic names start with BIND_OPCODE_
. Conceptually the bind information is a table of tuples: (seg-index, seg-offset, type, symbol-library-ordinal, symbol-name, addend)
The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like for runs of pointers initialzed to the same value can be encoded in a few bytes.
See also
/usr/include/mach-o/loader.h
bind_opcodes
¶Return Binding’s opcodes as list
of bytes
bindings
¶Return an iterator over Dyld’s BindingInfo
command
¶Command type ( LOAD_COMMAND_TYPES
)
command_offset
¶Offset of the command within the Load Command Table
data
¶Command’s data
export_info
¶Export information as a tuple (offset, size)
The symbols exported by a dylib are encoded in a trie. This is a compact representation that factors out common prefixes. It also reduces LINKEDIT
pages in RAM because it encodes all information (name, address, flags) in one small, contiguous range. The export area is a stream of nodes. The first node sequentially is the start node for the trie.
Nodes for a symbol start with a byte that is the length of the exported symbol information for the string so far. If there is no exported symbol, the byte is zero. If there is exported info, it follows the length byte. The exported info normally consists of a flags and offset both encoded in uleb128. The offset is location of the content named by the symbol. It is the offset from the mach_header for the image.
After the initial byte and optional exported symbol information is a byte of how many edges (0-255) that this node has leaving it, followed by each edge. Each edge is a zero terminated cstring of the addition chars in the symbol, followed by a uleb128 offset for the node that edge points to.
See also
/usr/include/mach-o/loader.h
export_trie
¶Return Export’s trie as list
of bytes
exports
¶Return an iterator over Dyld’s ExportInfo
lazy_bind
¶Lazy Bind information as a tuple (offset, size)
Some uses of external symbols do not need to be bound immediately. Instead they can be lazily bound on first use. The lazy_bind are contains a stream of BIND opcodes to bind all lazy symbols. Normal use is that dyld ignores the lazy_bind section when loading an image. Instead the static linker arranged for the lazy pointer to initially point to a helper function which pushes the offset into the lazy_bind area for the symbol needing to be bound, then jumps to dyld which simply adds the offset to lazy_bind_off to get the information on what to bind.
See also
/usr/include/mach-o/loader.h
lazy_bind_opcodes
¶Return lazy binding’s opcodes as list
of bytes
rebase
¶Rebase information as a tuple (offset, size)
Dyld rebases an image whenever dyld loads it at an address different from its preferred address. The rebase information is a stream of byte sized opcodes whose symbolic names start with REBASE_OPCODE_
. Conceptually the rebase information is a table of tuples: (seg-index, seg-offset, type)
The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like “every n’th offset for m times” can be encoded in a few bytes.
See also
/usr/include/mach-o/loader.h
rebase_opcodes
¶Return Rebase’s opcodes as list
of bytes
set_bind_offset
(self: lief.MachO.DyldInfo, offset: int) → None¶set_bind_size
(self: lief.MachO.DyldInfo, size: int) → None¶set_export_offset
(self: lief.MachO.DyldInfo, offset: int) → None¶set_export_size
(self: lief.MachO.DyldInfo, size: int) → None¶set_lazy_bind_offset
(self: lief.MachO.DyldInfo, offset: int) → None¶set_lazy_bind_size
(self: lief.MachO.DyldInfo, size: int) → None¶set_rebase_offset
(self: lief.MachO.DyldInfo, offset: int) → None¶set_rebase_size
(self: lief.MachO.DyldInfo, size: int) → None¶set_weak_bind_offset
(self: lief.MachO.DyldInfo, offset: int) → None¶set_weak_bind_size
(self: lief.MachO.DyldInfo, size: int) → None¶show_bind_opcodes
¶Return the bind opcodes in a humman-readable way
show_export_trie
¶Return the export trie in a humman-readable way
show_lazy_bind_opcodes
¶Return the weak bind opcodes in a humman-readable way
show_rebases_opcodes
¶Return the rebase opcodes in a humman-readable way
show_weak_bind_opcodes
¶Return the weak bind opcodes in a humman-readable way
size
¶Size of the command (should be greather than sizeof(load_command)
)
weak_bind
¶Weak Bind information as a tuple (offset, size)
Some C++ programs require dyld to unique symbols so that all images in the process use the same copy of some code/data. This step is done after binding. The content of the weak_bind info is an opcode stream like the bind_info. But it is sorted alphabetically by symbol name. This enable dyld to walk all images with weak binding information in order and look for collisions. If there are no collisions, dyld does no updating. That means that some fixups are also encoded in the bind_info. For instance, all calls to operator new
are first bound to libstdc++.dylib
using the information in bind_info. Then if some image overrides operator new that is detected when the weak_bind information is processed and the call to operator new is then rebound.
See also
/usr/include/mach-o/loader.h
weak_bind_opcodes
¶Return Weak binding’s opcodes as list
of bytes
lief.MachO.
FunctionStarts
¶add_function
(self: lief.MachO.FunctionStarts, address: int) → None¶Add a new function
command
¶Command type ( LOAD_COMMAND_TYPES
)
command_offset
¶Offset of the command within the Load Command Table
data
¶Command’s data
data_offset
¶Offset in the binary where start functions are located
data_size
¶Size of the functions list in the binary
functions
¶Addresses of every function entry point in the executable
This allows for functions to exist that have no entries in the symbol table.
Warning
The address is relative to the __TEXT
segment
size
¶Size of the command (should be greather than sizeof(load_command)
)
lief.MachO.
SourceVersion
¶command
¶Command type ( LOAD_COMMAND_TYPES
)
command_offset
¶Offset of the command within the Load Command Table
data
¶Command’s data
size
¶Size of the command (should be greather than sizeof(load_command)
)
version
¶Version as a tuple of 5 integers
lief.MachO.
VersionMin
¶command
¶Command type ( LOAD_COMMAND_TYPES
)
command_offset
¶Offset of the command within the Load Command Table
data
¶Command’s data
sdk
¶SDK as a tuple of 3 integers
size
¶Size of the command (should be greather than sizeof(load_command)
)
version
¶Version as a tuple of 3 integers
lief.MachO.
Relocation
¶address
¶For OBJECT
or (origin
is RELOC_TABLE
) this is an offset from the start of the Section
to the item containing the address requiring relocation.
For EXECUTE
/ DYLIB
or (origin
is DYLDINFO
) this is an virtual_address
has_segment
¶True
if the relocation has a SegmentCommand
associated with
origin
¶RELOCATION_ORIGINS
of the relocation
For OBJECT
file it should be RELOC_TABLE
for EXECUTE
/ DYLIB
it should be DYLDINFO
pc_relative
¶Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.
For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.
segment
¶SegmentCommand
associated with the relocation (if any)
size
¶Relocation’s size (in bits)
type
¶Type of the relocation according to the architecture
and/or origin
If origin
is RELOC_TABLE
:
lief.MachO.
RelocationObject
¶address
¶For OBJECT
or (origin
is RELOC_TABLE
) this is an offset from the start of the Section
to the item containing the address requiring relocation.
For EXECUTE
/ DYLIB
or (origin
is DYLDINFO
) this is an virtual_address
has_segment
¶True
if the relocation has a SegmentCommand
associated with
is_scattered
¶True
if the relocation is a scattered one
origin
¶RELOCATION_ORIGINS
of the relocation
For OBJECT
file it should be RELOC_TABLE
for EXECUTE
/ DYLIB
it should be DYLDINFO
pc_relative
¶Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.
For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.
segment
¶SegmentCommand
associated with the relocation (if any)
size
¶Relocation’s size (in bits)
type
¶Type of the relocation according to the architecture
and/or origin
If origin
is RELOC_TABLE
:
value
¶For scattered relocations, the address of the relocatable expression for the item in the file that needs to be updated if the address is changed.
For relocatable expressions with the difference of two section addresses, the address from which to subtract (in mathematical terms, the minuend) is contained in the first relocation entry and the address to subtract (the subtrahend) is contained in the second relocation entry.
lief.MachO.
RelocationDyld
¶address
¶For OBJECT
or (origin
is RELOC_TABLE
) this is an offset from the start of the Section
to the item containing the address requiring relocation.
For EXECUTE
/ DYLIB
or (origin
is DYLDINFO
) this is an virtual_address
has_segment
¶True
if the relocation has a SegmentCommand
associated with
origin
¶RELOCATION_ORIGINS
of the relocation
For OBJECT
file it should be RELOC_TABLE
for EXECUTE
/ DYLIB
it should be DYLDINFO
pc_relative
¶Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.
For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.
segment
¶SegmentCommand
associated with the relocation (if any)
size
¶Relocation’s size (in bits)
type
¶Type of the relocation according to the architecture
and/or origin
If origin
is RELOC_TABLE
:
lief.MachO.
BindingInfo
¶addend
¶Value added to the segment’s virtual address when binding
address
¶Binding’s address
binding_class
¶BINDING_CLASS
of the binding
binding_type
¶BIND_TYPES
of the binding Most of the times it’s POINTER
has_library
¶True
if the binding info has a DylibCommand
associated with
has_segment
¶True
if the binding info has a SegmentCommand
associated with
library
¶DylibCommand
associated with the binding (if any)
library_ordinal
¶original_offset
¶Original relative offset of the binding opcodes
segment
¶SegmentCommand
associated with the binding (if any)
weak_import
¶lief.MachO.
ExportInfo
¶address
¶alias_library
¶If the current symbol has an alias, it returns the DylibCommand
command associated with
flags
¶flags_list
¶Return flags as a list of EXPORT_SYMBOL_KINDS
has
(self: lief.MachO.ExportInfo, Check if the flag :class:`~lief.MachO.EXPORT_SYMBOL_FLAGS` given in first parameter is presentflag: lief.MachO.EXPORT_SYMBOL_FLAGS) → bool¶kind
¶Type of the symbol associated with the export (EXPORT_SYMBOL_KINDS
)
node_offset
¶lief.MachO.
ThreadCommand
¶command
¶Command type ( LOAD_COMMAND_TYPES
)
command_offset
¶Offset of the command within the Load Command Table
count
¶data
¶Command’s data
flavor
¶pc
¶size
¶Size of the command (should be greather than sizeof(load_command)
)
state
¶lief.MachO.
RPathCommand
¶command
¶Command type ( LOAD_COMMAND_TYPES
)
command_offset
¶Offset of the command within the Load Command Table
data
¶Command’s data
path
¶@rpath path
size
¶Size of the command (should be greather than sizeof(load_command)
)
lief.MachO.
CodeSignature
¶command
¶Command type ( LOAD_COMMAND_TYPES
)
command_offset
¶Offset of the command within the Load Command Table
data
¶Command’s data
data_offset
¶Offset in the binary where signature starts
data_size
¶Size of the raw signature
size
¶Size of the command (should be greather than sizeof(load_command)
)
lief.MachO.
DataInCode
¶add
(self: lief.MachO.DataInCode, entry: LIEF::MachO::DataCodeEntry) → lief.MachO.DataInCode¶Add an new DataCodeEntry
command
¶Command type ( LOAD_COMMAND_TYPES
)
command_offset
¶Offset of the command within the Load Command Table
data
¶Command’s data
data_offset
¶Offset in the binary where signature starts
data_size
¶Size of the raw signature
entries
¶Iterator over DataCodeEntry
size
¶Size of the command (should be greather than sizeof(load_command)
)
lief.MachO.
DataCodeEntry
¶TYPES
(self: lief.MachO.DataCodeEntry.TYPES, value: int) → None¶Members:
UNKNOWN
DATA
JUMP_TABLE_8
JUMP_TABLE_16
JUMP_TABLE_32
ABS_JUMP_TABLE_32
ABS_JUMP_TABLE_32
= <TYPES.ABS_JUMP_TABLE_32: 5>¶DATA
= <TYPES.DATA: 1>¶JUMP_TABLE_16
= <TYPES.JUMP_TABLE_16: 3>¶JUMP_TABLE_32
= <TYPES.JUMP_TABLE_32: 4>¶JUMP_TABLE_8
= <TYPES.JUMP_TABLE_8: 2>¶UNKNOWN
= <TYPES.UNKNOWN: 0>¶name
¶length
¶Length of the data
offset
¶Offset of the data
lief.MachO.
SegmentSplitInfo
¶command
¶Command type ( LOAD_COMMAND_TYPES
)
command_offset
¶Offset of the command within the Load Command Table
data
¶Command’s data
data_offset
¶Offset in the binary where data start
data_size
¶Size of the raw data
size
¶Size of the command (should be greather than sizeof(load_command)
)
lief.MachO.
SubFramework
¶command
¶Command type ( LOAD_COMMAND_TYPES
)
command_offset
¶Offset of the command within the Load Command Table
data
¶Command’s data
size
¶Size of the command (should be greather than sizeof(load_command)
)
umbrella
¶lief.MachO.
DyldEnvironment
¶command
¶Command type ( LOAD_COMMAND_TYPES
)
command_offset
¶Offset of the command within the Load Command Table
data
¶Command’s data
size
¶Size of the command (should be greather than sizeof(load_command)
)
value
¶Environment variable as a string
lief.MachO.
EncryptionInfo
¶command
¶Command type ( LOAD_COMMAND_TYPES
)
command_offset
¶Offset of the command within the Load Command Table
crypt_id
¶Which enryption system, 0 means not-encrypted yet
crypt_offset
¶File offset of encrypted range
crypt_size
¶File size of encrypted range
data
¶Command’s data
size
¶Size of the command (should be greather than sizeof(load_command)
)
lief.MachO.
BuildVersion
¶PLATFORMS
(self: lief.MachO.BuildVersion.PLATFORMS, value: int) → None¶Members:
UNKNOWN
MACOS
IOS
TVOS
WATCHOS
IOS
= <PLATFORMS.IOS: 2>¶MACOS
= <PLATFORMS.MACOS: 1>¶TVOS
= <PLATFORMS.TVOS: 3>¶UNKNOWN
= <PLATFORMS.UNKNOWN: 0>¶WATCHOS
= <PLATFORMS.WATCHOS: 4>¶name
¶command
¶Command type ( LOAD_COMMAND_TYPES
)
command_offset
¶Offset of the command within the Load Command Table
data
¶Command’s data
minos
¶Minimal OS version on which this binary was built to run
sdk
¶SDK Version
size
¶Size of the command (should be greather than sizeof(load_command)
)
tools
¶List of BuildToolVersion
used when while this binary
lief.MachO.
BuildToolVersion
¶TOOLS
(self: lief.MachO.BuildToolVersion.TOOLS, value: int) → None¶Members:
UNKNOWN
CLANG
SWIFT
LD
CLANG
= <TOOLS.CLANG: 1>¶LD
= <TOOLS.LD: 3>¶SWIFT
= <TOOLS.SWIFT: 2>¶UNKNOWN
= <TOOLS.UNKNOWN: 0>¶name
¶tool
¶TOOLS
type
version
¶Version of the tool
lief.MachO.
CPU_TYPES
(self: lief.MachO.CPU_TYPES, value: int) → None¶Members:
ANY
x86
I386
x86_64
MC98000
ARM
ARM64
SPARC
POWERPC
POWERPC64
ANY
= <CPU_TYPES.ANY: -1>¶ARM
= <CPU_TYPES.ARM: 12>¶ARM64
= <CPU_TYPES.ARM64: 16777228>¶I386
= <CPU_TYPES.x86: 7>¶MC98000
= <CPU_TYPES.MC98000: 10>¶POWERPC
= <CPU_TYPES.POWERPC: 18>¶POWERPC64
= <CPU_TYPES.POWERPC64: 16777234>¶SPARC
= <CPU_TYPES.SPARC: 14>¶name
¶x86
= <CPU_TYPES.x86: 7>¶x86_64
= <CPU_TYPES.x86_64: 16777223>¶lief.MachO.
FILE_TYPES
(self: lief.MachO.FILE_TYPES, value: int) → None¶Members:
OBJECT
EXECUTE
FVMLIB
CORE
PRELOAD
DYLIB
DYLINKER
BUNDLE
DYLIB_STUB
DSYM
KEXT_BUNDLE
BUNDLE
= <FILE_TYPES.BUNDLE: 8>¶CORE
= <FILE_TYPES.CORE: 4>¶DSYM
= <FILE_TYPES.DSYM: 10>¶DYLIB
= <FILE_TYPES.DYLIB: 6>¶DYLIB_STUB
= <FILE_TYPES.DYLIB_STUB: 9>¶DYLINKER
= <FILE_TYPES.DYLINKER: 7>¶EXECUTE
= <FILE_TYPES.EXECUTE: 2>¶FVMLIB
= <FILE_TYPES.FVMLIB: 3>¶KEXT_BUNDLE
= <FILE_TYPES.KEXT_BUNDLE: 11>¶OBJECT
= <FILE_TYPES.OBJECT: 1>¶PRELOAD
= <FILE_TYPES.PRELOAD: 5>¶name
¶lief.MachO.
HEADER_FLAGS
(self: lief.MachO.HEADER_FLAGS, value: int) → None¶Members:
NOUNDEFS
INCRLINK
DYLDLINK
BINDATLOAD
PREBOUND
SPLIT_SEGS
LAZY_INIT
TWOLEVEL
FORCE_FLAT
NOMULTIDEFS
NOFIXPREBINDING
PREBINDABLE
ALLMODSBOUND
SUBSECTIONS_VIA_SYMBOLS
CANONICAL
WEAK_DEFINES
BINDS_TO_WEAK
ALLOW_STACK_EXECUTION
ROOT_SAFE
SETUID_SAFE
NO_REEXPORTED_DYLIBS
PIE
DEAD_STRIPPABLE_DYLIB
HAS_TLV_DESCRIPTORS
NO_HEAP_EXECUTION
APP_EXTENSION_SAFE
ALLMODSBOUND
= <HEADER_FLAGS.ALLMODSBOUND: 4096>¶ALLOW_STACK_EXECUTION
= <HEADER_FLAGS.ALLOW_STACK_EXECUTION: 131072>¶APP_EXTENSION_SAFE
= <HEADER_FLAGS.APP_EXTENSION_SAFE: 33554432>¶BINDATLOAD
= <HEADER_FLAGS.BINDATLOAD: 8>¶BINDS_TO_WEAK
= <HEADER_FLAGS.BINDS_TO_WEAK: 65536>¶CANONICAL
= <HEADER_FLAGS.CANONICAL: 16384>¶DEAD_STRIPPABLE_DYLIB
= <HEADER_FLAGS.DEAD_STRIPPABLE_DYLIB: 4194304>¶DYLDLINK
= <HEADER_FLAGS.DYLDLINK: 4>¶FORCE_FLAT
= <HEADER_FLAGS.FORCE_FLAT: 256>¶HAS_TLV_DESCRIPTORS
= <HEADER_FLAGS.HAS_TLV_DESCRIPTORS: 8388608>¶INCRLINK
= <HEADER_FLAGS.INCRLINK: 2>¶LAZY_INIT
= <HEADER_FLAGS.LAZY_INIT: 64>¶NOFIXPREBINDING
= <HEADER_FLAGS.NOFIXPREBINDING: 1024>¶NOMULTIDEFS
= <HEADER_FLAGS.NOMULTIDEFS: 512>¶NOUNDEFS
= <HEADER_FLAGS.NOUNDEFS: 1>¶NO_HEAP_EXECUTION
= <HEADER_FLAGS.NO_HEAP_EXECUTION: 16777216>¶NO_REEXPORTED_DYLIBS
= <HEADER_FLAGS.NO_REEXPORTED_DYLIBS: 1048576>¶PIE
= <HEADER_FLAGS.PIE: 2097152>¶PREBINDABLE
= <HEADER_FLAGS.PREBINDABLE: 2048>¶PREBOUND
= <HEADER_FLAGS.PREBOUND: 16>¶ROOT_SAFE
= <HEADER_FLAGS.ROOT_SAFE: 262144>¶SETUID_SAFE
= <HEADER_FLAGS.SETUID_SAFE: 524288>¶SPLIT_SEGS
= <HEADER_FLAGS.SPLIT_SEGS: 32>¶SUBSECTIONS_VIA_SYMBOLS
= <HEADER_FLAGS.SUBSECTIONS_VIA_SYMBOLS: 8192>¶TWOLEVEL
= <HEADER_FLAGS.TWOLEVEL: 128>¶WEAK_DEFINES
= <HEADER_FLAGS.WEAK_DEFINES: 32768>¶name
¶lief.MachO.
LOAD_COMMAND_TYPES
(self: lief.MachO.LOAD_COMMAND_TYPES, value: int) → None¶Members:
SEGMENT
SYMTAB
SYMSEG
THREAD
UNIXTHREAD
LOADFVMLIB
IDFVMLIB
IDENT
FVMFILE
PREPAGE
DYSYMTAB
LOAD_DYLIB
ID_DYLIB
LOAD_DYLINKER
ID_DYLINKER
PREBOUND_DYLIB
ROUTINES
SUB_FRAMEWORK
SUB_UMBRELLA
SUB_CLIENT
SUB_LIBRARY
TWOLEVEL_HINTS
PREBIND_CKSUM
LOAD_WEAK_DYLIB
SEGMENT_64
ROUTINES_64
UUID
RPATH
CODE_SIGNATURE
SEGMENT_SPLIT_INFO
REEXPORT_DYLIB
LAZY_LOAD_DYLIB
ENCRYPTION_INFO
DYLD_INFO
DYLD_INFO_ONLY
LOAD_UPWARD_DYLIB
VERSION_MIN_MACOSX
VERSION_MIN_IPHONEOS
FUNCTION_STARTS
DYLD_ENVIRONMENT
MAIN
DATA_IN_CODE
SOURCE_VERSION
DYLIB_CODE_SIGN_DRS
ENCRYPTION_INFO_64
LINKER_OPTION
LINKER_OPTIMIZATION_HINT
VERSION_MIN_TVOS
VERSION_MIN_WATCHOS
NOTE
BUILD_VERSION
BUILD_VERSION
= <LOAD_COMMAND_TYPES.BUILD_VERSION: 50>¶CODE_SIGNATURE
= <LOAD_COMMAND_TYPES.CODE_SIGNATURE: 29>¶DATA_IN_CODE
= <LOAD_COMMAND_TYPES.DATA_IN_CODE: 41>¶DYLD_ENVIRONMENT
= <LOAD_COMMAND_TYPES.DYLD_ENVIRONMENT: 39>¶DYLD_INFO
= <LOAD_COMMAND_TYPES.DYLD_INFO: 34>¶DYLD_INFO_ONLY
= <LOAD_COMMAND_TYPES.DYLD_INFO_ONLY: 2147483682>¶DYLIB_CODE_SIGN_DRS
= <LOAD_COMMAND_TYPES.DYLIB_CODE_SIGN_DRS: 43>¶DYSYMTAB
= <LOAD_COMMAND_TYPES.DYSYMTAB: 11>¶ENCRYPTION_INFO
= <LOAD_COMMAND_TYPES.ENCRYPTION_INFO: 33>¶ENCRYPTION_INFO_64
= <LOAD_COMMAND_TYPES.ENCRYPTION_INFO_64: 44>¶FUNCTION_STARTS
= <LOAD_COMMAND_TYPES.FUNCTION_STARTS: 38>¶FVMFILE
= <LOAD_COMMAND_TYPES.FVMFILE: 9>¶IDENT
= <LOAD_COMMAND_TYPES.IDENT: 8>¶IDFVMLIB
= <LOAD_COMMAND_TYPES.IDFVMLIB: 7>¶ID_DYLIB
= <LOAD_COMMAND_TYPES.ID_DYLIB: 13>¶ID_DYLINKER
= <LOAD_COMMAND_TYPES.ID_DYLINKER: 15>¶LAZY_LOAD_DYLIB
= <LOAD_COMMAND_TYPES.LAZY_LOAD_DYLIB: 32>¶LINKER_OPTIMIZATION_HINT
= <LOAD_COMMAND_TYPES.LINKER_OPTIMIZATION_HINT: 46>¶LINKER_OPTION
= <LOAD_COMMAND_TYPES.LINKER_OPTION: 45>¶LOADFVMLIB
= <LOAD_COMMAND_TYPES.LOADFVMLIB: 6>¶LOAD_DYLIB
= <LOAD_COMMAND_TYPES.LOAD_DYLIB: 12>¶LOAD_DYLINKER
= <LOAD_COMMAND_TYPES.LOAD_DYLINKER: 14>¶LOAD_UPWARD_DYLIB
= <LOAD_COMMAND_TYPES.LOAD_UPWARD_DYLIB: 2147483683>¶LOAD_WEAK_DYLIB
= <LOAD_COMMAND_TYPES.LOAD_WEAK_DYLIB: 2147483672>¶MAIN
= <LOAD_COMMAND_TYPES.MAIN: 2147483688>¶NOTE
= <LOAD_COMMAND_TYPES.NOTE: 49>¶PREBIND_CKSUM
= <LOAD_COMMAND_TYPES.PREBIND_CKSUM: 23>¶PREBOUND_DYLIB
= <LOAD_COMMAND_TYPES.PREBOUND_DYLIB: 16>¶PREPAGE
= <LOAD_COMMAND_TYPES.PREPAGE: 10>¶REEXPORT_DYLIB
= <LOAD_COMMAND_TYPES.REEXPORT_DYLIB: 2147483679>¶ROUTINES
= <LOAD_COMMAND_TYPES.ROUTINES: 17>¶ROUTINES_64
= <LOAD_COMMAND_TYPES.ROUTINES_64: 26>¶RPATH
= <LOAD_COMMAND_TYPES.RPATH: 2147483676>¶SEGMENT
= <LOAD_COMMAND_TYPES.SEGMENT: 1>¶SEGMENT_64
= <LOAD_COMMAND_TYPES.SEGMENT_64: 25>¶SEGMENT_SPLIT_INFO
= <LOAD_COMMAND_TYPES.SEGMENT_SPLIT_INFO: 30>¶SOURCE_VERSION
= <LOAD_COMMAND_TYPES.SOURCE_VERSION: 42>¶SUB_CLIENT
= <LOAD_COMMAND_TYPES.SUB_CLIENT: 20>¶SUB_FRAMEWORK
= <LOAD_COMMAND_TYPES.SUB_FRAMEWORK: 18>¶SUB_LIBRARY
= <LOAD_COMMAND_TYPES.SUB_LIBRARY: 21>¶SUB_UMBRELLA
= <LOAD_COMMAND_TYPES.SUB_UMBRELLA: 19>¶SYMSEG
= <LOAD_COMMAND_TYPES.SYMSEG: 3>¶SYMTAB
= <LOAD_COMMAND_TYPES.SYMTAB: 2>¶THREAD
= <LOAD_COMMAND_TYPES.THREAD: 4>¶TWOLEVEL_HINTS
= <LOAD_COMMAND_TYPES.TWOLEVEL_HINTS: 22>¶UNIXTHREAD
= <LOAD_COMMAND_TYPES.UNIXTHREAD: 5>¶UUID
= <LOAD_COMMAND_TYPES.UUID: 27>¶VERSION_MIN_IPHONEOS
= <LOAD_COMMAND_TYPES.VERSION_MIN_IPHONEOS: 37>¶VERSION_MIN_MACOSX
= <LOAD_COMMAND_TYPES.VERSION_MIN_MACOSX: 36>¶VERSION_MIN_TVOS
= <LOAD_COMMAND_TYPES.VERSION_MIN_TVOS: 47>¶VERSION_MIN_WATCHOS
= <LOAD_COMMAND_TYPES.VERSION_MIN_WATCHOS: 48>¶name
¶lief.MachO.
SECTION_TYPES
(self: lief.MachO.SECTION_TYPES, value: int) → None¶Members:
REGULAR
ZEROFILL
CSTRING_LITERALS
S_4BYTE_LITERALS
S_8BYTE_LITERALS
LITERAL_POINTERS
NON_LAZY_SYMBOL_POINTERS
LAZY_SYMBOL_POINTERS
SYMBOL_STUBS
MOD_INIT_FUNC_POINTERS
MOD_TERM_FUNC_POINTERS
COALESCED
GB_ZEROFILL
INTERPOSING
S_16BYTE_LITERALS
DTRACE_DOF
LAZY_DYLIB_SYMBOL_POINTERS
THREAD_LOCAL_REGULAR
THREAD_LOCAL_ZEROFILL
THREAD_LOCAL_VARIABLES
THREAD_LOCAL_VARIABLE_POINTERS
THREAD_LOCAL_INIT_FUNCTION_POINTERS
COALESCED
= <SECTION_TYPES.COALESCED: 11>¶CSTRING_LITERALS
= <SECTION_TYPES.CSTRING_LITERALS: 2>¶DTRACE_DOF
= <SECTION_TYPES.DTRACE_DOF: 15>¶GB_ZEROFILL
= <SECTION_TYPES.GB_ZEROFILL: 12>¶INTERPOSING
= <SECTION_TYPES.INTERPOSING: 13>¶LAZY_DYLIB_SYMBOL_POINTERS
= <SECTION_TYPES.LAZY_DYLIB_SYMBOL_POINTERS: 16>¶LAZY_SYMBOL_POINTERS
= <SECTION_TYPES.LAZY_SYMBOL_POINTERS: 7>¶LITERAL_POINTERS
= <SECTION_TYPES.LITERAL_POINTERS: 5>¶MOD_INIT_FUNC_POINTERS
= <SECTION_TYPES.MOD_INIT_FUNC_POINTERS: 9>¶MOD_TERM_FUNC_POINTERS
= <SECTION_TYPES.MOD_TERM_FUNC_POINTERS: 10>¶NON_LAZY_SYMBOL_POINTERS
= <SECTION_TYPES.NON_LAZY_SYMBOL_POINTERS: 6>¶REGULAR
= <SECTION_TYPES.REGULAR: 0>¶SYMBOL_STUBS
= <SECTION_TYPES.SYMBOL_STUBS: 8>¶S_16BYTE_LITERALS
= <SECTION_TYPES.S_16BYTE_LITERALS: 14>¶S_4BYTE_LITERALS
= <SECTION_TYPES.S_4BYTE_LITERALS: 3>¶S_8BYTE_LITERALS
= <SECTION_TYPES.S_8BYTE_LITERALS: 4>¶THREAD_LOCAL_INIT_FUNCTION_POINTERS
= <SECTION_TYPES.THREAD_LOCAL_INIT_FUNCTION_POINTERS: 21>¶THREAD_LOCAL_REGULAR
= <SECTION_TYPES.THREAD_LOCAL_REGULAR: 17>¶THREAD_LOCAL_VARIABLES
= <SECTION_TYPES.THREAD_LOCAL_VARIABLES: 19>¶THREAD_LOCAL_VARIABLE_POINTERS
= <SECTION_TYPES.THREAD_LOCAL_VARIABLE_POINTERS: 20>¶THREAD_LOCAL_ZEROFILL
= <SECTION_TYPES.THREAD_LOCAL_ZEROFILL: 18>¶ZEROFILL
= <SECTION_TYPES.ZEROFILL: 1>¶name
¶lief.MachO.
MACHO_TYPES
(self: lief.MachO.MACHO_TYPES, value: int) → None¶Members:
MAGIC
CIGAM
MAGIC_64
CIGAM_64
FAT_MAGIC
FAT_CIGAM
CIGAM
= <MACHO_TYPES.CIGAM: 3472551422>¶CIGAM_64
= <MACHO_TYPES.CIGAM_64: 3489328638>¶FAT_CIGAM
= <MACHO_TYPES.FAT_CIGAM: 3199925962>¶FAT_MAGIC
= <MACHO_TYPES.FAT_MAGIC: 3405691582>¶MAGIC
= <MACHO_TYPES.MAGIC: 4277009102>¶MAGIC_64
= <MACHO_TYPES.MAGIC_64: 4277009103>¶name
¶lief.MachO.
X86_RELOCATION
(self: lief.MachO.X86_RELOCATION, value: int) → None¶Members:
VANILLA
PAIR
SECTDIFF
PB_LA_PTR
LOCAL_SECTDIFF
TLV
LOCAL_SECTDIFF
= <X86_RELOCATION.LOCAL_SECTDIFF: 4>¶PAIR
= <X86_RELOCATION.PAIR: 1>¶PB_LA_PTR
= <X86_RELOCATION.PB_LA_PTR: 3>¶SECTDIFF
= <X86_RELOCATION.SECTDIFF: 2>¶TLV
= <X86_RELOCATION.TLV: 5>¶VANILLA
= <X86_RELOCATION.VANILLA: 0>¶name
¶lief.MachO.
X86_64_RELOCATION
(self: lief.MachO.X86_64_RELOCATION, value: int) → None¶Members:
UNSIGNED
SIGNED
BRANCH
GOT_LOAD
GOT
SUBTRACTOR
SIGNED_1
SIGNED_2
SIGNED_4
TLV
BRANCH
= <X86_64_RELOCATION.BRANCH: 2>¶GOT
= <X86_64_RELOCATION.GOT: 4>¶GOT_LOAD
= <X86_64_RELOCATION.GOT_LOAD: 3>¶SIGNED
= <X86_64_RELOCATION.SIGNED: 1>¶SIGNED_1
= <X86_64_RELOCATION.SIGNED_1: 6>¶SIGNED_2
= <X86_64_RELOCATION.SIGNED_2: 7>¶SIGNED_4
= <X86_64_RELOCATION.SIGNED_4: 8>¶SUBTRACTOR
= <X86_64_RELOCATION.SUBTRACTOR: 5>¶TLV
= <X86_64_RELOCATION.TLV: 9>¶UNSIGNED
= <X86_64_RELOCATION.UNSIGNED: 0>¶name
¶lief.MachO.
PPC_RELOCATION
(self: lief.MachO.PPC_RELOCATION, value: int) → None¶Members:
VANILLA
PAIR
BR14
BR24
HI16
LO16
HA16
LO14
SECTDIFF
PB_LA_PTR
HI16_SECTDIFF
LO16_SECTDIFF
HA16_SECTDIFF
JBSR
LO14_SECTDIFF
LOCAL_SECTDIFF
BR14
= <PPC_RELOCATION.BR14: 2>¶BR24
= <PPC_RELOCATION.BR24: 3>¶HA16
= <PPC_RELOCATION.HA16: 6>¶HA16_SECTDIFF
= <PPC_RELOCATION.HA16_SECTDIFF: 12>¶HI16
= <PPC_RELOCATION.HI16: 4>¶HI16_SECTDIFF
= <PPC_RELOCATION.HI16_SECTDIFF: 10>¶JBSR
= <PPC_RELOCATION.JBSR: 13>¶LO14
= <PPC_RELOCATION.LO14: 7>¶LO14_SECTDIFF
= <PPC_RELOCATION.LO14_SECTDIFF: 14>¶LO16
= <PPC_RELOCATION.LO16: 5>¶LO16_SECTDIFF
= <PPC_RELOCATION.LO16_SECTDIFF: 11>¶LOCAL_SECTDIFF
= <PPC_RELOCATION.LOCAL_SECTDIFF: 15>¶PAIR
= <PPC_RELOCATION.PAIR: 1>¶PB_LA_PTR
= <PPC_RELOCATION.PB_LA_PTR: 9>¶SECTDIFF
= <PPC_RELOCATION.SECTDIFF: 8>¶VANILLA
= <PPC_RELOCATION.VANILLA: 0>¶name
¶lief.MachO.
ARM_RELOCATION
(self: lief.MachO.ARM_RELOCATION, value: int) → None¶Members:
VANILLA
PAIR
SECTDIFF
LOCAL_SECTDIFF
PB_LA_PTR
BR24
RELOC_BR22
32BIT_BRANCH
HALF
HALF_SECTDIFF
32BIT_BRANCH
= <ARM_RELOCATION.32BIT_BRANCH: 7>¶BR24
= <ARM_RELOCATION.BR24: 5>¶HALF
= <ARM_RELOCATION.HALF: 8>¶HALF_SECTDIFF
= <ARM_RELOCATION.HALF_SECTDIFF: 9>¶LOCAL_SECTDIFF
= <ARM_RELOCATION.LOCAL_SECTDIFF: 3>¶PAIR
= <ARM_RELOCATION.PAIR: 1>¶PB_LA_PTR
= <ARM_RELOCATION.PB_LA_PTR: 4>¶RELOC_BR22
= <ARM_RELOCATION.RELOC_BR22: 6>¶SECTDIFF
= <ARM_RELOCATION.SECTDIFF: 2>¶VANILLA
= <ARM_RELOCATION.VANILLA: 0>¶name
¶lief.MachO.
ARM64_RELOCATION
(self: lief.MachO.ARM64_RELOCATION, value: int) → None¶Members:
UNSIGNED
SUBTRACTOR
BRANCH26
PAGE21
PAGEOFF12
GOT_LOAD_PAGE21
GOT_LOAD_PAGEOFF12
POINTER_TO_GOT
TLVP_LOAD_PAGE21
TLVP_LOAD_PAGEOFF12
ADDEND
ADDEND
= <ARM64_RELOCATION.ADDEND: 10>¶BRANCH26
= <ARM64_RELOCATION.BRANCH26: 2>¶GOT_LOAD_PAGE21
= <ARM64_RELOCATION.GOT_LOAD_PAGE21: 5>¶GOT_LOAD_PAGEOFF12
= <ARM64_RELOCATION.GOT_LOAD_PAGEOFF12: 6>¶PAGE21
= <ARM64_RELOCATION.PAGE21: 3>¶PAGEOFF12
= <ARM64_RELOCATION.PAGEOFF12: 4>¶POINTER_TO_GOT
= <ARM64_RELOCATION.POINTER_TO_GOT: 7>¶SUBTRACTOR
= <ARM64_RELOCATION.SUBTRACTOR: 1>¶TLVP_LOAD_PAGE21
= <ARM64_RELOCATION.TLVP_LOAD_PAGE21: 8>¶TLVP_LOAD_PAGEOFF12
= <ARM64_RELOCATION.TLVP_LOAD_PAGEOFF12: 9>¶UNSIGNED
= <ARM64_RELOCATION.UNSIGNED: 0>¶name
¶lief.MachO.
RELOCATION_ORIGINS
(self: lief.MachO.RELOCATION_ORIGINS, value: int) → None¶Members:
UNKNOWN
DYLDINFO
RELOC_TABLE
DYLDINFO
= <RELOCATION_ORIGINS.DYLDINFO: 1>¶RELOC_TABLE
= <RELOCATION_ORIGINS.RELOC_TABLE: 2>¶UNKNOWN
= <RELOCATION_ORIGINS.UNKNOWN: 0>¶name
¶lief.MachO.
REBASE_TYPES
(self: lief.MachO.REBASE_TYPES, value: int) → None¶Members:
POINTER
TEXT_ABSOLUTE32
TEXT_PCREL32
POINTER
= <REBASE_TYPES.POINTER: 1>¶TEXT_ABSOLUTE32
= <REBASE_TYPES.TEXT_ABSOLUTE32: 2>¶TEXT_PCREL32
= <REBASE_TYPES.TEXT_PCREL32: 3>¶name
¶lief.MachO.
BINDING_CLASS
(self: lief.MachO.BINDING_CLASS, value: int) → None¶Members:
WEAK
LAZY
STANDARD
LAZY
= <BINDING_CLASS.LAZY: 2>¶STANDARD
= <BINDING_CLASS.STANDARD: 3>¶WEAK
= <BINDING_CLASS.WEAK: 1>¶name
¶lief.MachO.
REBASE_OPCODES
(self: lief.MachO.REBASE_OPCODES, value: int) → None¶Members:
DONE
SET_TYPE_IMM
SET_SEGMENT_AND_OFFSET_ULEB
ADD_ADDR_ULEB
ADD_ADDR_IMM_SCALED
DO_REBASE_IMM_TIMES
DO_REBASE_ULEB_TIMES
DO_REBASE_ADD_ADDR_ULEB
DO_REBASE_ULEB_TIMES_SKIPPING_ULEB
ADD_ADDR_IMM_SCALED
= <REBASE_OPCODES.ADD_ADDR_IMM_SCALED: 64>¶ADD_ADDR_ULEB
= <REBASE_OPCODES.ADD_ADDR_ULEB: 48>¶DONE
= <REBASE_OPCODES.DONE: 0>¶DO_REBASE_ADD_ADDR_ULEB
= <REBASE_OPCODES.DO_REBASE_ADD_ADDR_ULEB: 112>¶DO_REBASE_IMM_TIMES
= <REBASE_OPCODES.DO_REBASE_IMM_TIMES: 80>¶DO_REBASE_ULEB_TIMES
= <REBASE_OPCODES.DO_REBASE_ULEB_TIMES: 96>¶DO_REBASE_ULEB_TIMES_SKIPPING_ULEB
= <REBASE_OPCODES.DO_REBASE_ULEB_TIMES_SKIPPING_ULEB: 128>¶SET_SEGMENT_AND_OFFSET_ULEB
= <REBASE_OPCODES.SET_SEGMENT_AND_OFFSET_ULEB: 32>¶SET_TYPE_IMM
= <REBASE_OPCODES.SET_TYPE_IMM: 16>¶name
¶lief.MachO.
BIND_TYPES
(self: lief.MachO.BIND_TYPES, value: int) → None¶Members:
POINTER
TEXT_ABSOLUTE32
TEXT_PCREL32
POINTER
= <BIND_TYPES.POINTER: 1>¶TEXT_ABSOLUTE32
= <BIND_TYPES.TEXT_ABSOLUTE32: 2>¶TEXT_PCREL32
= <BIND_TYPES.TEXT_PCREL32: 3>¶name
¶lief.MachO.
BIND_SPECIAL_DYLIB
(self: lief.MachO.BIND_SPECIAL_DYLIB, value: int) → None¶Members:
SELF
MAIN_EXECUTABLE
FLAT_LOOKUP
FLAT_LOOKUP
= <BIND_SPECIAL_DYLIB.FLAT_LOOKUP: -2>¶MAIN_EXECUTABLE
= <BIND_SPECIAL_DYLIB.MAIN_EXECUTABLE: -1>¶SELF
= <BIND_SPECIAL_DYLIB.SELF: 0>¶name
¶lief.MachO.
BIND_OPCODES
(self: lief.MachO.BIND_OPCODES, value: int) → None¶Members:
DONE
SET_DYLIB_ORDINAL_IMM
SET_DYLIB_ORDINAL_ULEB
SET_DYLIB_SPECIAL_IMM
SET_SYMBOL_TRAILING_FLAGS_IMM
SET_TYPE_IMM
SET_ADDEND_SLEB
SET_SEGMENT_AND_OFFSET_ULEB
ADD_ADDR_ULEB
DO_BIND
DO_BIND_ADD_ADDR_ULEB
DO_BIND_ADD_ADDR_IMM_SCALED
DO_BIND_ULEB_TIMES_SKIPPING_ULEB
ADD_ADDR_ULEB
= <BIND_OPCODES.ADD_ADDR_ULEB: 128>¶DONE
= <BIND_OPCODES.DONE: 0>¶DO_BIND
= <BIND_OPCODES.DO_BIND: 144>¶DO_BIND_ADD_ADDR_IMM_SCALED
= <BIND_OPCODES.DO_BIND_ADD_ADDR_IMM_SCALED: 176>¶DO_BIND_ADD_ADDR_ULEB
= <BIND_OPCODES.DO_BIND_ADD_ADDR_ULEB: 160>¶DO_BIND_ULEB_TIMES_SKIPPING_ULEB
= <BIND_OPCODES.DO_BIND_ULEB_TIMES_SKIPPING_ULEB: 192>¶SET_ADDEND_SLEB
= <BIND_OPCODES.SET_ADDEND_SLEB: 96>¶SET_DYLIB_ORDINAL_IMM
= <BIND_OPCODES.SET_DYLIB_ORDINAL_IMM: 16>¶SET_DYLIB_ORDINAL_ULEB
= <BIND_OPCODES.SET_DYLIB_ORDINAL_ULEB: 32>¶SET_DYLIB_SPECIAL_IMM
= <BIND_OPCODES.SET_DYLIB_SPECIAL_IMM: 48>¶SET_SEGMENT_AND_OFFSET_ULEB
= <BIND_OPCODES.SET_SEGMENT_AND_OFFSET_ULEB: 112>¶SET_SYMBOL_TRAILING_FLAGS_IMM
= <BIND_OPCODES.SET_SYMBOL_TRAILING_FLAGS_IMM: 64>¶SET_TYPE_IMM
= <BIND_OPCODES.SET_TYPE_IMM: 80>¶name
¶lief.MachO.
EXPORT_SYMBOL_KINDS
(self: lief.MachO.EXPORT_SYMBOL_KINDS, value: int) → None¶Members:
REGULAR
THREAD_LOCAL
ABSOLUTE
ABSOLUTE
= <EXPORT_SYMBOL_KINDS.ABSOLUTE: 2>¶REGULAR
= <EXPORT_SYMBOL_KINDS.REGULAR: 0>¶THREAD_LOCAL
= <EXPORT_SYMBOL_KINDS.THREAD_LOCAL: 1>¶name
¶lief.MachO.
EXPORT_SYMBOL_FLAGS
(self: lief.MachO.EXPORT_SYMBOL_FLAGS, value: int) → None¶Members:
WEAK_DEFINITION
REEXPORT
STUB_AND_RESOLVER
REEXPORT
= <EXPORT_SYMBOL_FLAGS.REEXPORT: 8>¶STUB_AND_RESOLVER
= <EXPORT_SYMBOL_FLAGS.STUB_AND_RESOLVER: 16>¶WEAK_DEFINITION
= <EXPORT_SYMBOL_FLAGS.WEAK_DEFINITION: 4>¶name
¶lief.MachO.
VM_PROTECTIONS
(self: lief.MachO.VM_PROTECTIONS, value: int) → None¶Members:
READ
WRITE
EXECUTE
EXECUTE
= <VM_PROTECTIONS.EXECUTE: 4>¶READ
= <VM_PROTECTIONS.READ: 1>¶WRITE
= <VM_PROTECTIONS.WRITE: 2>¶name
¶lief.MachO.
SYMBOL_ORIGINS
(self: lief.MachO.SYMBOL_ORIGINS, value: int) → None¶Members:
UNKNOWN
DYLD_EXPORT
LC_SYMTAB
DYLD_EXPORT
= <SYMBOL_ORIGINS.DYLD_EXPORT: 1>¶LC_SYMTAB
= <SYMBOL_ORIGINS.LC_SYMTAB: 2>¶UNKNOWN
= <SYMBOL_ORIGINS.UNKNOWN: 0>¶name
¶lief.MachO.
SECTION_FLAGS
(self: lief.MachO.SECTION_FLAGS, value: int) → None¶Members:
PURE_INSTRUCTIONS
NO_TOC
STRIP_STATIC_SYMS
NO_DEAD_STRIP
LIVE_SUPPORT
SELF_MODIFYING_CODE
DEBUG
SOME_INSTRUCTIONS
EXT_RELOC
LOC_RELOC
DEBUG
= <SECTION_FLAGS.DEBUG: 33554432>¶EXT_RELOC
= <SECTION_FLAGS.EXT_RELOC: 512>¶LIVE_SUPPORT
= <SECTION_FLAGS.LIVE_SUPPORT: 134217728>¶LOC_RELOC
= <SECTION_FLAGS.LOC_RELOC: 256>¶NO_DEAD_STRIP
= <SECTION_FLAGS.NO_DEAD_STRIP: 268435456>¶NO_TOC
= <SECTION_FLAGS.NO_TOC: 1073741824>¶PURE_INSTRUCTIONS
= <SECTION_FLAGS.PURE_INSTRUCTIONS: 2147483648>¶SELF_MODIFYING_CODE
= <SECTION_FLAGS.SELF_MODIFYING_CODE: 67108864>¶SOME_INSTRUCTIONS
= <SECTION_FLAGS.SOME_INSTRUCTIONS: 1024>¶STRIP_STATIC_SYMS
= <SECTION_FLAGS.STRIP_STATIC_SYMS: 536870912>¶name
¶