MachO¶

Parser¶

lief.MachO.parse(*args, **kwargs)¶

Overloaded function.

parse(filename: str, config: lief.MachO.ParserConfig = <lief.MachO.ParserConfig object at 0x7f4baa267bb0>) -> LIEF::MachO::FatBinary

Parse the given binary and return a FatBinary object

One can configure the parsing with the config parameter. See ParserConfig

parse(raw: List[int], name: str = ‘’, config: lief.MachO.ParserConfig = <lief.MachO.ParserConfig object at 0x7f4baa2449b0>) -> LIEF::MachO::FatBinary

Parse the given binary (from raw) and return a FatBinary objects

One can configure the parsing with the config parameter. See ParserConfig

parse(io: object, name: str = ‘’, config: lief.MachO.ParserConfig = <lief.MachO.ParserConfig object at 0x7f4baa244cb0>) -> LIEF::MachO::FatBinary

class lief.MachO.ParserConfig(self: lief.MachO.ParserConfig) → None¶

Configuration of MachO’s parser

deep = <lief.MachO.ParserConfig object>¶

property parse_dyldinfo_deeply¶: If set to True, parse deeply the DyldInfo structure. It includes Exports, Bindings and Rebases

quick = <lief.MachO.ParserConfig object>¶

fatbinary_1 = lief.MachO.parse("/usr/bin/ls", config=lief.MachO.ParserConfig.deep)
# or
fatbinary_2 = lief.MachO.parse("/usr/bin/ls", config=lief.MachO.ParserConfig.quick)

FatBinary¶

class lief.MachO.FatBinary¶

at(self: lief.MachO.FatBinary, index: int) → LIEF::MachO::Binary¶: Return the Binary at the given index

raw(self: lief.MachO.FatBinary) → List[int]¶: Build a Mach-O universal binary and return its bytes

property size¶: Number of Binary registred

write(self: lief.MachO.FatBinary, filename: str) → None¶: Build a Mach-O universal binary

Binary¶

class lief.MachO.Binary¶

class VA_TYPES(self: lief.Binary.VA_TYPES, arg0: int) → None¶

Members:

AUTO

VA

RVA

AUTO = VA_TYPES.AUTO¶

RVA = VA_TYPES.RVA¶

VA = VA_TYPES.VA¶

property name¶: (self: handle) -> str

property abstract¶: Return the Binary object

Warning

Getting this property modifies the __class__ attribute so that the current binary looks like a Binary.

Use the concrete to get back to the original binary.

add(*args, **kwargs)¶

Overloaded function.

add(self: lief.MachO.Binary, dylib_command: LIEF::MachO::DylibCommand) -> LIEF::MachO::LoadCommand

Add a new DylibCommand

add(self: lief.MachO.Binary, segment: LIEF::MachO::SegmentCommand) -> LIEF::MachO::LoadCommand

Add a new SegmentCommand

add(self: lief.MachO.Binary, load_command: LIEF::MachO::LoadCommand) -> LIEF::MachO::LoadCommand

Add a new LoadCommand

add(self: lief.MachO.Binary, load_command: LIEF::MachO::LoadCommand, index: int) -> LIEF::MachO::LoadCommand

Add a new LoadCommand at index

add_library(self: lief.MachO.Binary, library_name: str) → LIEF::MachO::LoadCommand¶: Add a new library dependency

add_section(*args, **kwargs)¶

Overloaded function.

add_section(self: lief.MachO.Binary, segment: LIEF::MachO::SegmentCommand, section: LIEF::MachO::Section) -> LIEF::MachO::Section

Add a new Section in the given SegmentCommand

add_section(self: lief.MachO.Binary, section: LIEF::MachO::Section) -> LIEF::MachO::Section

Add a new Section within the __TEXT segment

add_section(self: lief.MachO.Binary, section: LIEF::MachO::SegmentCommand, section: LIEF::MachO::Section) -> LIEF::MachO::Section

Add a new Section in the given SegmentCommand

property build_version¶: Return binary’s BuildVersion if any.

can_remove(self: lief.MachO.Binary, symbol: LIEF::MachO::Symbol) → bool¶: Check if the given symbol can be safely removed.

can_remove_symbol(self: lief.MachO.Binary, symbol_name: str) → bool¶: Check if the given symbol name can be safely removed.

property code_signature¶: Return binary’s CodeSignature if any.

property commands¶: Return binary’s Command

property concrete¶: Return either lief.ELF.Binary, lief.PE.Binary, lief.MachO.Binary object

property ctor_functions¶: Constructor functions that are called prior any other functions

property data_in_code¶: Return binary’s DataInCode if any.

property dyld_environment¶: Return binary’s DyldEnvironment if any.

property dyld_info¶: Return binary’s DyldInfo if any.

property dylinker¶: Return binary’s DylinkerCommand if any.

property dynamic_symbol_command¶: Return binary’s DynamicSymbolCommand if any.

property encryption_info¶: Return binary’s EncryptionInfo if any.

property entrypoint¶: Binary’s entrypoint

property exported_functions¶: Return binary’s exported Function

property exported_symbols¶: Return binary’s Symbol which are exported

extend(self: lief.MachO.Binary, load_command: LIEF::MachO::LoadCommand, size: int) → bool¶: Extend a LoadCommand by size

extend_segment(self: lief.MachO.Binary, segment_command: LIEF::MachO::SegmentCommand, size: int) → bool¶: Extend the content of the given SegmentCommand by size

property fat_offset¶: Return binary’s fat offset. 0 if not relevant.

property format¶: File format EXE_FORMATS of the underlying binary.

property function_starts¶: Return binary’s FunctionStarts if any.

property functions¶: Return list of all Function found

get(self: lief.MachO.Binary, type: lief.MachO.LOAD_COMMAND_TYPES) → LIEF::MachO::LoadCommand¶: Return the first LoadCommand having the given LOAD_COMMAND_TYPES

get_content_from_virtual_address(self: lief.Binary, virtual_address: int, size: int, va_type: lief.Binary.VA_TYPES = VA_TYPES.AUTO) → List[int]¶

Return the content located at virtual address.

Virtual address is specified in the first argument and size to read (in bytes) in the second. If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default it is set to AUTO

get_function_address(self: lief.Binary, function_name: str) → int¶: Return the address of the given function name

get_section(self: lief.MachO.Binary, name: str) → LIEF::MachO::Section¶: Return the section from the given name

get_segment(self: lief.MachO.Binary, name: str) → LIEF::MachO::SegmentCommand¶: Return the SegmentCommand from the given name

get_symbol(self: lief.MachO.Binary, name: str) → LIEF::MachO::Symbol¶: Return the Symbol from the given name

has(self: lief.MachO.Binary, type: lief.MachO.LOAD_COMMAND_TYPES) → bool¶: Check if the current binary has a LoadCommand with the given LOAD_COMMAND_TYPES

property has_build_version¶: True if the binary has a BuildVersion command

property has_code_signature¶: True if the binary is signed (i.e. has a CodeSignature command)

property has_data_in_code¶: True if the binary has a DataInCode command

property has_dyld_environment¶: True if the binary has a DyldEnvironment command

property has_dyld_info¶: True if the binary has a DyldInfo command.

property has_dylinker¶: True if the binary has a DylinkerCommand command.

property has_dynamic_symbol_command¶: True if the binary has a DynamicSymbolCommand command.

property has_encryption_info¶: True if the binary has a EncryptionInfo command

property has_entrypoint¶: True if the binary has an entrypoint. Basically for libraries it will return false

property has_function_starts¶: True if the binary has a FunctionStarts command.

property has_main_command¶: True if the binary has a MainCommand command.

property has_nx¶: Check if the binary uses NX protection

property has_rpath¶: True if the binary has a RPathCommand command.

has_section(self: lief.MachO.Binary, name: str) → bool¶: Check if a section with the given name exists

has_segment(self: lief.MachO.Binary, name: str) → bool¶: Check if a SegmentCommand with the given name exists

property has_segment_split_info¶: True if the binary has a SegmentSplitInfo command

property has_source_version¶: True if the binary has a SourceVersion command.

property has_sub_framework¶: True if the binary has a SubFramework command

has_symbol(self: lief.MachO.Binary, name: str) → bool¶: Check if a Symbol with the given name exists

property has_symbol_command¶: True if the binary has a SymbolCommand command.

property has_thread_command¶: True if the binary has a ThreadCommand command.

property has_uuid¶: True if the binary has a UUIDCommand command.

property has_version_min¶: True if the binary has a VersionMin command.

property header¶: Return binary’s Header

property imagebase¶: Return binary’s image base which is the base address where segments are mapped (without PIE). 0 if not relevant.

property imported_functions¶: Return binary’s imported Function (name)

property imported_symbols¶: Return binary’s Symbol which are imported

property is_pie¶: Check if the binary is position independent

is_valid_addr(self: lief.MachO.Binary, address: int) → bool¶: Check if the given address is comprise between the lowest virtual address and the biggest one

property libraries¶: Return binary’s DylibCommand

property main_command¶: Return binary’s MainCommand if any.

property name¶: Binary’s name

property off_ranges¶: Return the range of offsets as a tuple (off_start, off_end)

patch_address(*args, **kwargs)¶

Overloaded function.

patch_address(self: lief.Binary, address: int, patch_value: List[int], va_type: lief.Binary.VA_TYPES = VA_TYPES.AUTO) -> None

Virtual address is specified in the first argument and the content in the second (as a list of bytes). If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default it is set to AUTO

patch_address(self: lief.Binary, address: int, patch_value: int, size: int = 8, va_type: lief.Binary.VA_TYPES = VA_TYPES.AUTO) -> None

Virtual address is specified in the first argument, integer in the second and sizeof the integer in third one. If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default it is set to AUTO

property relocations¶: Return an iterator over binary’s Relocation

remove(*args, **kwargs)¶

Overloaded function.

remove(self: lief.MachO.Binary, load_command: LIEF::MachO::LoadCommand) -> bool

Remove a LoadCommand

remove(self: lief.MachO.Binary, type: lief.MachO.LOAD_COMMAND_TYPES) -> bool

Remove all LoadCommand having the given LOAD_COMMAND_TYPES

remove(self: lief.MachO.Binary, symbol: LIEF::MachO::Symbol) -> bool

Remove the given Symbol

remove_command(self: lief.MachO.Binary, index: int) → bool¶: Remove the LoadCommand at index

remove_section(self: lief.Binary, name: str, clear: bool = False) → None¶: Remove the section with the given name

remove_signature(self: lief.MachO.Binary) → bool¶: Remove the CodeSignature (if any)

remove_symbol(self: lief.MachO.Binary, name: str) → bool¶: Remove all symbol(s) with the given name

property rpath¶: Return binary’s RPathCommand if any.

section_from_offset(self: lief.MachO.Binary, arg0: int) → LIEF::MachO::Section¶: Return the Section which contains the offset

section_from_virtual_address(self: lief.MachO.Binary, arg0: int) → LIEF::MachO::Section¶: Return the Section which contains the virtual address

property sections¶: Return binary’s Section

segment_from_offset(self: lief.MachO.Binary, arg0: int) → LIEF::MachO::SegmentCommand¶: Return the SegmentCommand which contains the offset

segment_from_virtual_address(self: lief.MachO.Binary, arg0: int) → LIEF::MachO::SegmentCommand¶: Return the SegmentCommand which contains the virtual address

property segment_split_info¶: Return binary’s SegmentSplitInfo if any.

property segments¶: Return binary’s SegmentCommand

property source_version¶: Return binary’s SourceVersion if any.

property sub_framework¶: Return binary’s SubFramework if any.

property symbol_command¶: Return binary’s SymbolCommand if any.

property symbols¶: Return binary’s Symbol

property thread_command¶: Return binary’s ThreadCommand if any.

unexport(*args, **kwargs)¶

Overloaded function.

unexport(self: lief.MachO.Binary, name: str) -> bool

Remove the symbol from the export table

unexport(self: lief.MachO.Binary, symbol: LIEF::MachO::Symbol) -> bool

Remove the symbol from the export table

property unwind_functions¶: Return list of Function found in the __unwind_info section

property uuid¶: Return binary’s UUIDCommand if any.

property va_ranges¶: Return the range of virtual addresses as a tuple (va_start, va_end)

property version_min¶: Return binary’s VersionMin if any.

virtual_address_to_offset(self: lief.MachO.Binary, virtual_address: int) → int¶: Convert the virtual address to an offset in the binary

write(self: lief.MachO.Binary, output: str) → None¶: Rebuild the binary and write it in a file

xref(self: lief.Binary, Return all **virtual address** that *use* the ``address`` given in parametervirtual_address: int) → List[int]¶

Header¶

class lief.MachO.Header(self: lief.MachO.Header) → None¶

add(self: lief.MachO.Header, flag: lief.MachO.HEADER_FLAGS) → None¶: Add the given HEADER_FLAGS

property cpu_subtype¶: CPU subtype

property cpu_type¶: Target CPU ( CPU_TYPES)

property file_type¶: Binary’s type ( FILE_TYPES)

property flags¶: Binary’s flags ( HEADER_FLAGS)

property flags_list¶: HEADER_FLAGS as a list

has(self: lief.MachO.Header, flag: lief.MachO.HEADER_FLAGS) → bool¶: True if the given HEADER_FLAGS is in the flags

property magic¶

property nb_cmds¶: Number of LoadCommand

remove(self: lief.MachO.Header, flag: lief.MachO.HEADER_FLAGS) → None¶: Remove the given HEADER_FLAGS

property reserved¶

property sizeof_cmds¶: Size of all LoadCommand

Section¶

class lief.MachO.Section(*args, **kwargs)¶

Overloaded function.

__init__(self: lief.MachO.Section) -> None
__init__(self: lief.MachO.Section, section_name: str) -> None

Constructor with the section name

__init__(self: lief.MachO.Section, section_name: str, content: List[int]) -> None

Constructor with the section name and its content

add(self: lief.MachO.Section, flag: lief.MachO.SECTION_FLAGS) → None¶: Add the given SECTION_FLAGS

property alignment¶: Section’s alignment

property content¶: Section’s content

property entropy¶: Section’s entropy

property flags¶

property flags_list¶

has(self: lief.MachO.Section, flag: lief.MachO.SECTION_FLAGS) → bool¶: Check if the section has the given SECTION_FLAGS

property has_segment¶: True if the current section has a segment associated with

property name¶: Section’s name

property numberof_relocations¶

property offset¶: Section’s offset

property relocation_offset¶

property relocations¶: Iterator over Relocation (if any)

remove(self: lief.MachO.Section, flag: lief.MachO.SECTION_FLAGS) → None¶: Remove the given SECTION_FLAGS

property reserved1¶

property reserved2¶

property reserved3¶

search(*args, **kwargs)¶

Overloaded function.

search(self: lief.Section, number: int, pos: int = 0, size: int = 0) -> int

Look for integer within the current section

search(self: lief.Section, str: str, pos: int = 0) -> int

Look for string within the current section

search_all(*args, **kwargs)¶

Overloaded function.

search_all(self: lief.Section, number: int, size: int = 0) -> List[int]

Look for all integers within the current section

search_all(self: lief.Section, str: str) -> List[int]

Look for all strings within the current section

property segment¶: SegmentCommand segment associated with the section

property size¶: Section’s size

property type¶

property virtual_address¶: Section’s virtual address

SegmentCommand¶

class lief.MachO.SegmentCommand(*args, **kwargs)¶

Overloaded function.

__init__(self: lief.MachO.SegmentCommand) -> None
__init__(self: lief.MachO.SegmentCommand, arg0: str) -> None
__init__(self: lief.MachO.SegmentCommand, arg0: str, arg1: List[int]) -> None

add_section(self: lief.MachO.SegmentCommand, section: LIEF::MachO::Section) → LIEF::MachO::Section¶

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property content¶: Segment’s content

property data¶: Command’s data

property file_offset¶: Segment’s file offset

property file_size¶: Segment’s file size

property flags¶: Segment’s flags

has(self: lief.MachO.SegmentCommand, section: LIEF::MachO::Section) → bool¶: Check if the given Section belongs to the current segment

has_section(self: lief.MachO.SegmentCommand, section_name: str) → bool¶: Check if the given section name belongs to the current segment

property init_protection¶: Segment’s initial protection

property max_protection¶: Segment’s max protection

property name¶: Segment’s name

property numberof_sections¶: Number of sections in this segment

property relocations¶: Segment’s relocations

property sections¶: Segment’s sections

property size¶: Size of the command (should be greather than sizeof(load_command))

property virtual_address¶: Segment’s virtual address

property virtual_size¶: Segment’s virtual size

LoadCommand¶

class lief.MachO.LoadCommand(self: lief.MachO.LoadCommand) → None¶

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property size¶: Size of the command (should be greather than sizeof(load_command))

DylibCommand¶

class lief.MachO.DylibCommand¶

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property compatibility_version¶: Library’s compatibility version

property current_version¶: Library’s current version

property data¶: Command’s data

static id_dylib(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) → lief.MachO.DylibCommand ¶: Factory function to generate a ID_DYLIB library

static lazy_load_dylib(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) → lief.MachO.DylibCommand ¶: Factory function to generate a LAZY_LOAD_DYLIB library

static load_dylib(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) → lief.MachO.DylibCommand ¶: Factory function to generate a LOAD_DYLIB library

static load_upward_dylib(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) → lief.MachO.DylibCommand ¶: Factory function to generate a LOAD_UPWARD_DYLIB library

property name¶: Library’s name

static reexport_dylib(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) → lief.MachO.DylibCommand ¶: Factory function to generate a REEXPORT_DYLIB library

property size¶: Size of the command (should be greather than sizeof(load_command))

property timestamp¶: Library’s timestamp

static weak_lib(name: str, timestamp: int = 0, current_version: int = 0, compat_version: int = 0) → lief.MachO.DylibCommand ¶: Factory function to generate a LC_LOAD_WEAK_DYLIB library

DylinkerCommand¶

class lief.MachO.DylinkerCommand¶

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property name¶: Path to the loader used to load the binary

property size¶: Size of the command (should be greather than sizeof(load_command))

UUIDCommand¶

class lief.MachO.UUIDCommand¶

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property size¶: Size of the command (should be greather than sizeof(load_command))

property uuid¶: UUID as a list

MainCommand¶

class lief.MachO.MainCommand¶

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property entrypoint¶: Program entry point

property size¶: Size of the command (should be greather than sizeof(load_command))

property stack_size¶: Program stack_size

Symbol¶

class lief.MachO.Symbol(self: lief.MachO.Symbol) → None¶

property binding_info¶: BindingInfo associated with the symbol (if any)

property demangled_name¶: Symbol’s unmangled name

property description¶

property export_info¶: ExportInfo associated with the symbol (if any)

property has_binding_info¶: True if the symbol has an BindingInfo associated with

property has_export_info¶: True if the symbol has a ExportInfo associated with

property name¶: Symbol’s name

property numberof_sections¶

property origin¶: Return the SYMBOL_ORIGINS of this symbol

property size¶: Symbol’s size

property type¶

property value¶

Symbol Command¶

class lief.MachO.SymbolCommand(self: lief.MachO.SymbolCommand) → None¶

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property numberof_symbols¶: Number of symbols registered

property size¶: Size of the command (should be greather than sizeof(load_command))

property strings_offset¶: Offset from the start of the file to the string table

property strings_size¶: Size of the size string table

property symbol_offset¶: Offset from the start of the file to the n_list associated with the command

Dynamic Symbol Command¶

class lief.MachO.DynamicSymbolCommand¶

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property external_reference_symbol_offset¶

Byte offset from the start of the file to the external reference table data.

This field seems unused by recent Mach-O loader and should be set to 0

property external_relocation_offset¶

Byte offset from the start of the file to the module table data.

This field seems unused by recent Mach-O loader and should be set to 0

property idx_external_define_symbol¶: Index of the first symbol in the group of defined external symbols.

property idx_local_symbol¶: Index of the first symbol in the group of local symbols.

property idx_undefined_symbol¶: Index of the first symbol in the group of undefined external symbols.

property indirect_symbol_offset¶

Byte offset from the start of the file to the indirect symbol table data..

Indirect symbol table is used by the loader to speed-up symbol resolution during the lazy binding process

References:

dyld-519.2.1/src/ImageLoaderMachOCompressed.cpp

dyld-519.2.1/src/ImageLoaderMachOClassic.cpp

property local_relocation_offset¶

Byte offset from the start of the file to the local relocation table data.

This field seems unused by recent Mach-O loader and should be set to 0

property module_table_offset¶

Byte offset from the start of the file to the module table data.

This field seems unused by recent Mach-O loader and should be set to 0

property nb_external_define_symbols¶: Number of symbols in the group of defined external symbols.

property nb_external_reference_symbols¶

Number of entries in the external reference table

This field seems unused by recent Mach-O loader and should be set to 0

property nb_external_relocations¶

Number of entries in the external relocation table.

This field seems unused by recent Mach-O loader and should be set to 0

property nb_indirect_symbols¶: Number of entries in the indirect symbol table.

property nb_local_relocations¶

Number of entries in the local relocation table.

This field seems unused by recent Mach-O loader and should be set to 0

property nb_local_symbols¶: Number of symbols in the group of local symbols.

property nb_module_table¶

Number of entries in the module table..

This field seems unused by recent Mach-O loader and should be set to 0

property nb_toc¶

Number of entries in the table of contents

Should be set to 0 on recent Mach-O

property nb_undefined_symbols¶: Number of symbols in the group of undefined external symbols.

property size¶: Size of the command (should be greather than sizeof(load_command))

property toc_offset¶

Byte offset from the start of the file to the table of contents data

Table of content is used by legacy Mach-O loader and this field should be set to 0

Dyld Info¶

class lief.MachO.DyldInfo¶

property bind¶

Bind information as a tuple (offset, size)

Dyld binds an image during the loading process, if the image requires any pointers to be initialized to symbols in other images. The rebase information is a stream of byte sized opcodes whose symbolic names start with BIND_OPCODE_. Conceptually the bind information is a table of tuples: (seg-index, seg-offset, type, symbol-library-ordinal, symbol-name, addend) The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like for runs of pointers initialzed to the same value can be encoded in a few bytes.

See also

/usr/include/mach-o/loader.h

property bind_opcodes¶: Return Binding’s opcodes as list of bytes

property bindings¶: Return an iterator over Dyld’s BindingInfo

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property export_info¶

Export information as a tuple (offset, size)

The symbols exported by a dylib are encoded in a trie. This is a compact representation that factors out common prefixes. It also reduces LINKEDIT pages in RAM because it encodes all information (name, address, flags) in one small, contiguous range. The export area is a stream of nodes. The first node sequentially is the start node for the trie.

Nodes for a symbol start with a byte that is the length of the exported symbol information for the string so far. If there is no exported symbol, the byte is zero. If there is exported info, it follows the length byte. The exported info normally consists of a flags and offset both encoded in uleb128. The offset is location of the content named by the symbol. It is the offset from the mach_header for the image.

After the initial byte and optional exported symbol information is a byte of how many edges (0-255) that this node has leaving it, followed by each edge. Each edge is a zero terminated cstring of the addition chars in the symbol, followed by a uleb128 offset for the node that edge points to.

See also

/usr/include/mach-o/loader.h

property export_trie¶: Return Export’s trie as list of bytes

property exports¶: Return an iterator over Dyld’s ExportInfo

property lazy_bind¶

Lazy Bind information as a tuple (offset, size)

Some uses of external symbols do not need to be bound immediately. Instead they can be lazily bound on first use. The lazy_bind are contains a stream of BIND opcodes to bind all lazy symbols. Normal use is that dyld ignores the lazy_bind section when loading an image. Instead the static linker arranged for the lazy pointer to initially point to a helper function which pushes the offset into the lazy_bind area for the symbol needing to be bound, then jumps to dyld which simply adds the offset to lazy_bind_off to get the information on what to bind.

See also

/usr/include/mach-o/loader.h

property lazy_bind_opcodes¶: Return lazy binding’s opcodes as list of bytes

property rebase¶

Rebase information as a tuple (offset, size)

Dyld rebases an image whenever dyld loads it at an address different from its preferred address. The rebase information is a stream of byte sized opcodes whose symbolic names start with REBASE_OPCODE_. Conceptually the rebase information is a table of tuples: (seg-index, seg-offset, type) The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like “every n’th offset for m times” can be encoded in a few bytes.

See also

/usr/include/mach-o/loader.h

property rebase_opcodes¶: Return Rebase’s opcodes as list of bytes

set_bind_offset(self: lief.MachO.DyldInfo, offset: int) → None¶

set_bind_size(self: lief.MachO.DyldInfo, size: int) → None¶

set_export_offset(self: lief.MachO.DyldInfo, offset: int) → None¶

set_export_size(self: lief.MachO.DyldInfo, size: int) → None¶

set_lazy_bind_offset(self: lief.MachO.DyldInfo, offset: int) → None¶

set_lazy_bind_size(self: lief.MachO.DyldInfo, size: int) → None¶

set_rebase_offset(self: lief.MachO.DyldInfo, offset: int) → None¶

set_rebase_size(self: lief.MachO.DyldInfo, size: int) → None¶

set_weak_bind_offset(self: lief.MachO.DyldInfo, offset: int) → None¶

set_weak_bind_size(self: lief.MachO.DyldInfo, size: int) → None¶

property show_bind_opcodes¶: Return the bind opcodes in a humman-readable way

property show_export_trie¶: Return the export trie in a humman-readable way

property show_lazy_bind_opcodes¶: Return the weak bind opcodes in a humman-readable way

property show_rebases_opcodes¶: Return the rebase opcodes in a humman-readable way

property show_weak_bind_opcodes¶: Return the weak bind opcodes in a humman-readable way

property size¶: Size of the command (should be greather than sizeof(load_command))

property weak_bind¶

Weak Bind information as a tuple (offset, size)

Some C++ programs require dyld to unique symbols so that all images in the process use the same copy of some code/data. This step is done after binding. The content of the weak_bind info is an opcode stream like the bind_info. But it is sorted alphabetically by symbol name. This enable dyld to walk all images with weak binding information in order and look for collisions. If there are no collisions, dyld does no updating. That means that some fixups are also encoded in the bind_info. For instance, all calls to operator new are first bound to libstdc++.dylib using the information in bind_info. Then if some image overrides operator new that is detected when the weak_bind information is processed and the call to operator new is then rebound.

See also

/usr/include/mach-o/loader.h

property weak_bind_opcodes¶: Return Weak binding’s opcodes as list of bytes

Function starts¶

class lief.MachO.FunctionStarts¶

add_function(self: lief.MachO.FunctionStarts, address: int) → None¶: Add a new function

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property data_offset¶: Offset in the binary where start functions are located

property data_size¶: Size of the functions list in the binary

property functions¶

Addresses of every function entry point in the executable

This allows for functions to exist that have no entries in the symbol table.

Warning

The address is relative to the __TEXT segment

property size¶: Size of the command (should be greather than sizeof(load_command))

Source Version¶

class lief.MachO.SourceVersion¶

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property size¶: Size of the command (should be greather than sizeof(load_command))

property version¶: Version as a tuple of 5 integers

Version Min¶

class lief.MachO.VersionMin¶

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property sdk¶: SDK as a tuple of 3 integers

property size¶: Size of the command (should be greather than sizeof(load_command))

property version¶: Version as a tuple of 3 integers

Relocation¶

class lief.MachO.Relocation¶

property address¶

For OBJECT or (origin is RELOC_TABLE) this is an offset from the start of the Section to the item containing the address requiring relocation.

For EXECUTE / DYLIB or (origin is DYLDINFO) this is an virtual_address

property architecture¶: CPU_TYPES of the relocation

property has_section¶: True if the relocation has a Section associated with

property has_segment¶: True if the relocation has a SegmentCommand associated with

property has_symbol¶: True if the relocation has a Symbol associated with

property origin¶

RELOCATION_ORIGINS of the relocation

For OBJECT file it should be RELOC_TABLE for EXECUTE / DYLIB it should be DYLDINFO

property pc_relative¶

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

property section¶: Section associated with the relocation (if any)

property segment¶: SegmentCommand associated with the relocation (if any)

property size¶: Relocation’s size (in bits)

property symbol¶: Symbol associated with the relocation (if any)

property type¶

Type of the relocation according to the architecture and/or origin

If origin is RELOC_TABLE:

See:

X86_RELOCATION
X86_64_RELOCATION
PPC_RELOCATION
ARM_RELOCATION
ARM64_RELOCATION

If origin is DYLDINFO:

See:

REBASE_TYPES

Relocation Object¶

class lief.MachO.RelocationObject¶

property address¶

For OBJECT or (origin is RELOC_TABLE) this is an offset from the start of the Section to the item containing the address requiring relocation.

For EXECUTE / DYLIB or (origin is DYLDINFO) this is an virtual_address

property architecture¶: CPU_TYPES of the relocation

property has_section¶: True if the relocation has a Section associated with

property has_segment¶: True if the relocation has a SegmentCommand associated with

property has_symbol¶: True if the relocation has a Symbol associated with

property is_scattered¶: True if the relocation is a scattered one

property origin¶

RELOCATION_ORIGINS of the relocation

For OBJECT file it should be RELOC_TABLE for EXECUTE / DYLIB it should be DYLDINFO

property pc_relative¶

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

property section¶: Section associated with the relocation (if any)

property segment¶: SegmentCommand associated with the relocation (if any)

property size¶: Relocation’s size (in bits)

property symbol¶: Symbol associated with the relocation (if any)

property type¶

Type of the relocation according to the architecture and/or origin

If origin is RELOC_TABLE:

See:

X86_RELOCATION
X86_64_RELOCATION
PPC_RELOCATION
ARM_RELOCATION
ARM64_RELOCATION

If origin is DYLDINFO:

See:

REBASE_TYPES

property value¶

For scattered relocations, the address of the relocatable expression for the item in the file that needs to be updated if the address is changed.

For relocatable expressions with the difference of two section addresses, the address from which to subtract (in mathematical terms, the minuend) is contained in the first relocation entry and the address to subtract (the subtrahend) is contained in the second relocation entry.

Relocation Dyld¶

class lief.MachO.RelocationDyld¶

property address¶

For OBJECT or (origin is RELOC_TABLE) this is an offset from the start of the Section to the item containing the address requiring relocation.

For EXECUTE / DYLIB or (origin is DYLDINFO) this is an virtual_address

property architecture¶: CPU_TYPES of the relocation

property has_section¶: True if the relocation has a Section associated with

property has_segment¶: True if the relocation has a SegmentCommand associated with

property has_symbol¶: True if the relocation has a Symbol associated with

property origin¶

RELOCATION_ORIGINS of the relocation

For OBJECT file it should be RELOC_TABLE for EXECUTE / DYLIB it should be DYLDINFO

property pc_relative¶

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

property section¶: Section associated with the relocation (if any)

property segment¶: SegmentCommand associated with the relocation (if any)

property size¶: Relocation’s size (in bits)

property symbol¶: Symbol associated with the relocation (if any)

property type¶

Type of the relocation according to the architecture and/or origin

If origin is RELOC_TABLE:

See:

X86_RELOCATION
X86_64_RELOCATION
PPC_RELOCATION
ARM_RELOCATION
ARM64_RELOCATION

If origin is DYLDINFO:

See:

REBASE_TYPES

Binding Info¶

class lief.MachO.BindingInfo¶

property addend¶: Value added to the segment’s virtual address when binding

property address¶: Binding’s address

property binding_class¶: BINDING_CLASS of the binding

property binding_type¶: BIND_TYPES of the binding Most of the times it’s POINTER

property has_library¶: True if the binding info has a DylibCommand associated with

property has_segment¶: True if the binding info has a SegmentCommand associated with

property has_symbol¶: True if the binding info has a Symbol associated with

property library¶: DylibCommand associated with the binding (if any)

property library_ordinal¶

property segment¶: SegmentCommand associated with the binding (if any)

property symbol¶: Symbol associated with the binding (if any)

property weak_import¶

Export Info¶

class lief.MachO.ExportInfo¶

property address¶

property alias¶: Symbol alias if the current symbol is a re-exported one

property alias_library¶: If the current symbol has an alias, it returns the DylibCommand command associated with

property flags¶

property flags_list¶: Return flags as a list of EXPORT_SYMBOL_KINDS

has(self: lief.MachO.ExportInfo, Check if the flag :class:`~lief.MachO.EXPORT_SYMBOL_FLAGS` given in first parameter is presentflag: lief.MachO.EXPORT_SYMBOL_FLAGS) → bool¶

property has_symbol¶: True if the export info has a Symbol associated with

property kind¶: Type of the symbol associated with the export (EXPORT_SYMBOL_KINDS)

property node_offset¶

property symbol¶: Symbol associated with the export (if any)

Thread Command¶

class lief.MachO.ThreadCommand¶

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property count¶

property data¶: Command’s data

property flavor¶

property pc¶

property size¶: Size of the command (should be greather than sizeof(load_command))

property state¶

RPath Command¶

class lief.MachO.RPathCommand¶

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property path¶: @rpath path

property size¶: Size of the command (should be greather than sizeof(load_command))

Code Signature¶

class lief.MachO.CodeSignature¶

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property data_offset¶: Offset in the binary where signature starts

property data_size¶: Size of the raw signature

property size¶: Size of the command (should be greather than sizeof(load_command))

Data In Code¶

class lief.MachO.DataInCode¶

add(self: lief.MachO.DataInCode, entry: LIEF::MachO::DataCodeEntry) → lief.MachO.DataInCode ¶: Add an new DataCodeEntry

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property data_offset¶: Offset in the binary where signature starts

property data_size¶: Size of the raw signature

property entries¶: Iterator over DataCodeEntry

property size¶: Size of the command (should be greather than sizeof(load_command))

Data Code Entry¶

class lief.MachO.DataCodeEntry¶

class TYPES(self: lief.MachO.DataCodeEntry.TYPES, arg0: int) → None¶

Members:

UNKNOWN

DATA

JUMP_TABLE_8

JUMP_TABLE_16

JUMP_TABLE_32

ABS_JUMP_TABLE_32

ABS_JUMP_TABLE_32 = TYPES.ABS_JUMP_TABLE_32¶

DATA = TYPES.DATA¶

JUMP_TABLE_16 = TYPES.JUMP_TABLE_16¶

JUMP_TABLE_32 = TYPES.JUMP_TABLE_32¶

JUMP_TABLE_8 = TYPES.JUMP_TABLE_8¶

UNKNOWN = TYPES.UNKNOWN¶

property name¶: (self: handle) -> str

property length¶: Length of the data

property offset¶: Offset of the data

property type¶: Type of the entry (TYPES

Segment Split Info¶

class lief.MachO.SegmentSplitInfo¶

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property data_offset¶: Offset in the binary where data start

property data_size¶: Size of the raw data

property size¶: Size of the command (should be greather than sizeof(load_command))

Sub Framework¶

class lief.MachO.SubFramework¶

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property size¶: Size of the command (should be greather than sizeof(load_command))

property umbrella¶

Dyld Environment¶

class lief.MachO.DyldEnvironment¶

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property size¶: Size of the command (should be greather than sizeof(load_command))

property value¶: Environment variable as a string

Encryption Info¶

class lief.MachO.EncryptionInfo¶

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property crypt_id¶: Which enryption system, 0 means not-encrypted yet

property crypt_offset¶: File offset of encrypted range

property crypt_size¶: File size of encrypted range

property data¶: Command’s data

property size¶: Size of the command (should be greather than sizeof(load_command))

Build Version¶

class lief.MachO.BuildVersion¶

class PLATFORMS(self: lief.MachO.BuildVersion.PLATFORMS, arg0: int) → None¶

Members:

UNKNOWN

MACOS

IOS

TVOS

WATCHOS

IOS = PLATFORMS.IOS¶

MACOS = PLATFORMS.MACOS¶

TVOS = PLATFORMS.TVOS¶

UNKNOWN = PLATFORMS.UNKNOWN¶

WATCHOS = PLATFORMS.WATCHOS¶

property name¶: (self: handle) -> str

property command¶: Command type ( LOAD_COMMAND_TYPES)

property command_offset¶: Offset of the command within the Load Command Table

property data¶: Command’s data

property minos¶: Minimal OS version on which this binary was built to run

property platform¶: Target PLATFORMS

property sdk¶: SDK Version

property size¶: Size of the command (should be greather than sizeof(load_command))

property tools¶: List of BuildToolVersion used when while this binary

Build Tool Version¶

class lief.MachO.BuildToolVersion¶

class TOOLS(self: lief.MachO.BuildToolVersion.TOOLS, arg0: int) → None¶

Members:

UNKNOWN

CLANG

SWIFT

LD

CLANG = TOOLS.CLANG¶

LD = TOOLS.LD¶

SWIFT = TOOLS.SWIFT¶

UNKNOWN = TOOLS.UNKNOWN¶

property name¶: (self: handle) -> str

property tool¶: TOOLS type

property version¶: Version of the tool

Enums¶

CPU_TYPES¶

class lief.MachO.CPU_TYPES(self: lief.MachO.CPU_TYPES, arg0: int) → None¶

Members:

ANY

x86

I386

x86_64

MC98000

ARM

ARM64

SPARC

POWERPC

POWERPC64

ANY = CPU_TYPES.ANY¶

ARM = CPU_TYPES.ARM¶

ARM64 = CPU_TYPES.ARM64¶

I386 = CPU_TYPES.x86¶

MC98000 = CPU_TYPES.MC98000¶

POWERPC = CPU_TYPES.POWERPC¶

POWERPC64 = CPU_TYPES.POWERPC64¶

SPARC = CPU_TYPES.SPARC¶

property name¶: (self: handle) -> str

x86 = CPU_TYPES.x86¶

x86_64 = CPU_TYPES.x86_64¶

FILE_TYPES¶

class lief.MachO.FILE_TYPES(self: lief.MachO.FILE_TYPES, arg0: int) → None¶

Members:

OBJECT

EXECUTE

FVMLIB

CORE

PRELOAD

DYLIB

DYLINKER

BUNDLE

DYLIB_STUB

DSYM

KEXT_BUNDLE

BUNDLE = FILE_TYPES.BUNDLE¶

CORE = FILE_TYPES.CORE¶

DSYM = FILE_TYPES.DSYM¶

DYLIB = FILE_TYPES.DYLIB¶

DYLIB_STUB = FILE_TYPES.DYLIB_STUB¶

DYLINKER = FILE_TYPES.DYLINKER¶

EXECUTE = FILE_TYPES.EXECUTE¶

FVMLIB = FILE_TYPES.FVMLIB¶

KEXT_BUNDLE = FILE_TYPES.KEXT_BUNDLE¶

OBJECT = FILE_TYPES.OBJECT¶

PRELOAD = FILE_TYPES.PRELOAD¶

property name¶: (self: handle) -> str

HEADER_FLAGS¶

class lief.MachO.HEADER_FLAGS(self: lief.MachO.HEADER_FLAGS, arg0: int) → None¶

Members:

NOUNDEFS

INCRLINK

DYLDLINK

BINDATLOAD

PREBOUND

SPLIT_SEGS

LAZY_INIT

TWOLEVEL

FORCE_FLAT

NOMULTIDEFS

NOFIXPREBINDING

PREBINDABLE

ALLMODSBOUND

SUBSECTIONS_VIA_SYMBOLS

CANONICAL

WEAK_DEFINES

BINDS_TO_WEAK

ALLOW_STACK_EXECUTION

ROOT_SAFE

SETUID_SAFE

NO_REEXPORTED_DYLIBS

PIE

DEAD_STRIPPABLE_DYLIB

HAS_TLV_DESCRIPTORS

NO_HEAP_EXECUTION

APP_EXTENSION_SAFE

ALLMODSBOUND = HEADER_FLAGS.ALLMODSBOUND¶

ALLOW_STACK_EXECUTION = HEADER_FLAGS.ALLOW_STACK_EXECUTION¶

APP_EXTENSION_SAFE = HEADER_FLAGS.APP_EXTENSION_SAFE¶

BINDATLOAD = HEADER_FLAGS.BINDATLOAD¶

BINDS_TO_WEAK = HEADER_FLAGS.BINDS_TO_WEAK¶

CANONICAL = HEADER_FLAGS.CANONICAL¶

DEAD_STRIPPABLE_DYLIB = HEADER_FLAGS.DEAD_STRIPPABLE_DYLIB¶

DYLDLINK = HEADER_FLAGS.DYLDLINK¶

FORCE_FLAT = HEADER_FLAGS.FORCE_FLAT¶

HAS_TLV_DESCRIPTORS = HEADER_FLAGS.HAS_TLV_DESCRIPTORS¶

INCRLINK = HEADER_FLAGS.INCRLINK¶

LAZY_INIT = HEADER_FLAGS.LAZY_INIT¶

NOFIXPREBINDING = HEADER_FLAGS.NOFIXPREBINDING¶

NOMULTIDEFS = HEADER_FLAGS.NOMULTIDEFS¶

NOUNDEFS = HEADER_FLAGS.NOUNDEFS¶

NO_HEAP_EXECUTION = HEADER_FLAGS.NO_HEAP_EXECUTION¶

NO_REEXPORTED_DYLIBS = HEADER_FLAGS.NO_REEXPORTED_DYLIBS¶

PIE = HEADER_FLAGS.PIE¶

PREBINDABLE = HEADER_FLAGS.PREBINDABLE¶

PREBOUND = HEADER_FLAGS.PREBOUND¶

ROOT_SAFE = HEADER_FLAGS.ROOT_SAFE¶

SETUID_SAFE = HEADER_FLAGS.SETUID_SAFE¶

SPLIT_SEGS = HEADER_FLAGS.SPLIT_SEGS¶

SUBSECTIONS_VIA_SYMBOLS = HEADER_FLAGS.SUBSECTIONS_VIA_SYMBOLS¶

TWOLEVEL = HEADER_FLAGS.TWOLEVEL¶

WEAK_DEFINES = HEADER_FLAGS.WEAK_DEFINES¶

property name¶: (self: handle) -> str

LOAD_COMMAND_TYPES¶

class lief.MachO.LOAD_COMMAND_TYPES(self: lief.MachO.LOAD_COMMAND_TYPES, arg0: int) → None¶

Members:

SEGMENT

SYMTAB

SYMSEG

THREAD

UNIXTHREAD

LOADFVMLIB

IDFVMLIB

IDENT

FVMFILE

PREPAGE

DYSYMTAB

LOAD_DYLIB

ID_DYLIB

LOAD_DYLINKER

ID_DYLINKER

PREBOUND_DYLIB

ROUTINES

SUB_FRAMEWORK

SUB_UMBRELLA

SUB_CLIENT

SUB_LIBRARY

TWOLEVEL_HINTS

PREBIND_CKSUM

LOAD_WEAK_DYLIB

SEGMENT_64

ROUTINES_64

UUID

RPATH

CODE_SIGNATURE

SEGMENT_SPLIT_INFO

REEXPORT_DYLIB

LAZY_LOAD_DYLIB

ENCRYPTION_INFO

DYLD_INFO

DYLD_INFO_ONLY

LOAD_UPWARD_DYLIB

VERSION_MIN_MACOSX

VERSION_MIN_IPHONEOS

FUNCTION_STARTS

DYLD_ENVIRONMENT

MAIN

DATA_IN_CODE

SOURCE_VERSION

DYLIB_CODE_SIGN_DRS

ENCRYPTION_INFO_64

LINKER_OPTION

LINKER_OPTIMIZATION_HINT

VERSION_MIN_TVOS

VERSION_MIN_WATCHOS

NOTE

BUILD_VERSION

BUILD_VERSION = LOAD_COMMAND_TYPES.BUILD_VERSION¶

CODE_SIGNATURE = LOAD_COMMAND_TYPES.CODE_SIGNATURE¶

DATA_IN_CODE = LOAD_COMMAND_TYPES.DATA_IN_CODE¶

DYLD_ENVIRONMENT = LOAD_COMMAND_TYPES.DYLD_ENVIRONMENT¶

DYLD_INFO = LOAD_COMMAND_TYPES.DYLD_INFO¶

DYLD_INFO_ONLY = LOAD_COMMAND_TYPES.DYLD_INFO_ONLY¶

DYLIB_CODE_SIGN_DRS = LOAD_COMMAND_TYPES.DYLIB_CODE_SIGN_DRS¶

DYSYMTAB = LOAD_COMMAND_TYPES.DYSYMTAB¶

ENCRYPTION_INFO = LOAD_COMMAND_TYPES.ENCRYPTION_INFO¶

ENCRYPTION_INFO_64 = LOAD_COMMAND_TYPES.ENCRYPTION_INFO_64¶

FUNCTION_STARTS = LOAD_COMMAND_TYPES.FUNCTION_STARTS¶

FVMFILE = LOAD_COMMAND_TYPES.FVMFILE¶

IDENT = LOAD_COMMAND_TYPES.IDENT¶

IDFVMLIB = LOAD_COMMAND_TYPES.IDFVMLIB¶

ID_DYLIB = LOAD_COMMAND_TYPES.ID_DYLIB¶

ID_DYLINKER = LOAD_COMMAND_TYPES.ID_DYLINKER¶

LAZY_LOAD_DYLIB = LOAD_COMMAND_TYPES.LAZY_LOAD_DYLIB¶

LINKER_OPTIMIZATION_HINT = LOAD_COMMAND_TYPES.LINKER_OPTIMIZATION_HINT¶

LINKER_OPTION = LOAD_COMMAND_TYPES.LINKER_OPTION¶

LOADFVMLIB = LOAD_COMMAND_TYPES.LOADFVMLIB¶

LOAD_DYLIB = LOAD_COMMAND_TYPES.LOAD_DYLIB¶

LOAD_DYLINKER = LOAD_COMMAND_TYPES.LOAD_DYLINKER¶

LOAD_UPWARD_DYLIB = LOAD_COMMAND_TYPES.LOAD_UPWARD_DYLIB¶

LOAD_WEAK_DYLIB = LOAD_COMMAND_TYPES.LOAD_WEAK_DYLIB¶

MAIN = LOAD_COMMAND_TYPES.MAIN¶

NOTE = LOAD_COMMAND_TYPES.NOTE¶

PREBIND_CKSUM = LOAD_COMMAND_TYPES.PREBIND_CKSUM¶

PREBOUND_DYLIB = LOAD_COMMAND_TYPES.PREBOUND_DYLIB¶

PREPAGE = LOAD_COMMAND_TYPES.PREPAGE¶

REEXPORT_DYLIB = LOAD_COMMAND_TYPES.REEXPORT_DYLIB¶

ROUTINES = LOAD_COMMAND_TYPES.ROUTINES¶

ROUTINES_64 = LOAD_COMMAND_TYPES.ROUTINES_64¶

RPATH = LOAD_COMMAND_TYPES.RPATH¶

SEGMENT = LOAD_COMMAND_TYPES.SEGMENT¶

SEGMENT_64 = LOAD_COMMAND_TYPES.SEGMENT_64¶

SEGMENT_SPLIT_INFO = LOAD_COMMAND_TYPES.SEGMENT_SPLIT_INFO¶

SOURCE_VERSION = LOAD_COMMAND_TYPES.SOURCE_VERSION¶

SUB_CLIENT = LOAD_COMMAND_TYPES.SUB_CLIENT¶

SUB_FRAMEWORK = LOAD_COMMAND_TYPES.SUB_FRAMEWORK¶

SUB_LIBRARY = LOAD_COMMAND_TYPES.SUB_LIBRARY¶

SUB_UMBRELLA = LOAD_COMMAND_TYPES.SUB_UMBRELLA¶

SYMSEG = LOAD_COMMAND_TYPES.SYMSEG¶

SYMTAB = LOAD_COMMAND_TYPES.SYMTAB¶

THREAD = LOAD_COMMAND_TYPES.THREAD¶

TWOLEVEL_HINTS = LOAD_COMMAND_TYPES.TWOLEVEL_HINTS¶

UNIXTHREAD = LOAD_COMMAND_TYPES.UNIXTHREAD¶

UUID = LOAD_COMMAND_TYPES.UUID¶

VERSION_MIN_IPHONEOS = LOAD_COMMAND_TYPES.VERSION_MIN_IPHONEOS¶

VERSION_MIN_MACOSX = LOAD_COMMAND_TYPES.VERSION_MIN_MACOSX¶

VERSION_MIN_TVOS = LOAD_COMMAND_TYPES.VERSION_MIN_TVOS¶

VERSION_MIN_WATCHOS = LOAD_COMMAND_TYPES.VERSION_MIN_WATCHOS¶

property name¶: (self: handle) -> str

SECTION_TYPES¶

class lief.MachO.SECTION_TYPES(self: lief.MachO.SECTION_TYPES, arg0: int) → None¶

Members:

REGULAR

ZEROFILL

CSTRING_LITERALS

S_4BYTE_LITERALS

S_8BYTE_LITERALS

LITERAL_POINTERS

NON_LAZY_SYMBOL_POINTERS

LAZY_SYMBOL_POINTERS

SYMBOL_STUBS

MOD_INIT_FUNC_POINTERS

MOD_TERM_FUNC_POINTERS

COALESCED

GB_ZEROFILL

INTERPOSING

S_16BYTE_LITERALS

DTRACE_DOF

LAZY_DYLIB_SYMBOL_POINTERS

THREAD_LOCAL_REGULAR

THREAD_LOCAL_ZEROFILL

THREAD_LOCAL_VARIABLES

THREAD_LOCAL_VARIABLE_POINTERS

THREAD_LOCAL_INIT_FUNCTION_POINTERS

COALESCED = SECTION_TYPES.COALESCED¶

CSTRING_LITERALS = SECTION_TYPES.CSTRING_LITERALS¶

DTRACE_DOF = SECTION_TYPES.DTRACE_DOF¶

GB_ZEROFILL = SECTION_TYPES.GB_ZEROFILL¶

INTERPOSING = SECTION_TYPES.INTERPOSING¶

LAZY_DYLIB_SYMBOL_POINTERS = SECTION_TYPES.LAZY_DYLIB_SYMBOL_POINTERS¶

LAZY_SYMBOL_POINTERS = SECTION_TYPES.LAZY_SYMBOL_POINTERS¶

LITERAL_POINTERS = SECTION_TYPES.LITERAL_POINTERS¶

MOD_INIT_FUNC_POINTERS = SECTION_TYPES.MOD_INIT_FUNC_POINTERS¶

MOD_TERM_FUNC_POINTERS = SECTION_TYPES.MOD_TERM_FUNC_POINTERS¶

NON_LAZY_SYMBOL_POINTERS = SECTION_TYPES.NON_LAZY_SYMBOL_POINTERS¶

REGULAR = SECTION_TYPES.REGULAR¶

SYMBOL_STUBS = SECTION_TYPES.SYMBOL_STUBS¶

S_16BYTE_LITERALS = SECTION_TYPES.S_16BYTE_LITERALS¶

S_4BYTE_LITERALS = SECTION_TYPES.S_4BYTE_LITERALS¶

S_8BYTE_LITERALS = SECTION_TYPES.S_8BYTE_LITERALS¶

THREAD_LOCAL_INIT_FUNCTION_POINTERS = SECTION_TYPES.THREAD_LOCAL_INIT_FUNCTION_POINTERS¶

THREAD_LOCAL_REGULAR = SECTION_TYPES.THREAD_LOCAL_REGULAR¶

THREAD_LOCAL_VARIABLES = SECTION_TYPES.THREAD_LOCAL_VARIABLES¶

THREAD_LOCAL_VARIABLE_POINTERS = SECTION_TYPES.THREAD_LOCAL_VARIABLE_POINTERS¶

THREAD_LOCAL_ZEROFILL = SECTION_TYPES.THREAD_LOCAL_ZEROFILL¶

ZEROFILL = SECTION_TYPES.ZEROFILL¶

property name¶: (self: handle) -> str

MACHO_TYPES¶

class lief.MachO.MACHO_TYPES(self: lief.MachO.MACHO_TYPES, arg0: int) → None¶

Members:

MAGIC

CIGAM

MAGIC_64

CIGAM_64

FAT_MAGIC

FAT_CIGAM

CIGAM = MACHO_TYPES.CIGAM¶

CIGAM_64 = MACHO_TYPES.CIGAM_64¶

FAT_CIGAM = MACHO_TYPES.FAT_CIGAM¶

FAT_MAGIC = MACHO_TYPES.FAT_MAGIC¶

MAGIC = MACHO_TYPES.MAGIC¶

MAGIC_64 = MACHO_TYPES.MAGIC_64¶

property name¶: (self: handle) -> str

X86_RELOCATION¶

class lief.MachO.X86_RELOCATION(self: lief.MachO.X86_RELOCATION, arg0: int) → None¶

Members:

VANILLA

PAIR

SECTDIFF

PB_LA_PTR

LOCAL_SECTDIFF

TLV

LOCAL_SECTDIFF = X86_RELOCATION.LOCAL_SECTDIFF¶

PAIR = X86_RELOCATION.PAIR¶

PB_LA_PTR = X86_RELOCATION.PB_LA_PTR¶

SECTDIFF = X86_RELOCATION.SECTDIFF¶

TLV = X86_RELOCATION.TLV¶

VANILLA = X86_RELOCATION.VANILLA¶

property name¶: (self: handle) -> str

X86_64_RELOCATION¶

class lief.MachO.X86_64_RELOCATION(self: lief.MachO.X86_64_RELOCATION, arg0: int) → None¶

Members:

UNSIGNED

SIGNED

BRANCH

GOT_LOAD

GOT

SUBTRACTOR

SIGNED_1

SIGNED_2

SIGNED_4

TLV

BRANCH = X86_64_RELOCATION.BRANCH¶

GOT = X86_64_RELOCATION.GOT¶

GOT_LOAD = X86_64_RELOCATION.GOT_LOAD¶

SIGNED = X86_64_RELOCATION.SIGNED¶

SIGNED_1 = X86_64_RELOCATION.SIGNED_1¶

SIGNED_2 = X86_64_RELOCATION.SIGNED_2¶

SIGNED_4 = X86_64_RELOCATION.SIGNED_4¶

SUBTRACTOR = X86_64_RELOCATION.SUBTRACTOR¶

TLV = X86_64_RELOCATION.TLV¶

UNSIGNED = X86_64_RELOCATION.UNSIGNED¶

property name¶: (self: handle) -> str

PPC_RELOCATION¶

class lief.MachO.PPC_RELOCATION(self: lief.MachO.PPC_RELOCATION, arg0: int) → None¶

Members:

VANILLA

PAIR

BR14

BR24

HI16

LO16

HA16

LO14

SECTDIFF

PB_LA_PTR

HI16_SECTDIFF

LO16_SECTDIFF

HA16_SECTDIFF

JBSR

LO14_SECTDIFF

LOCAL_SECTDIFF

BR14 = PPC_RELOCATION.BR14¶

BR24 = PPC_RELOCATION.BR24¶

HA16 = PPC_RELOCATION.HA16¶

HA16_SECTDIFF = PPC_RELOCATION.HA16_SECTDIFF¶

HI16 = PPC_RELOCATION.HI16¶

HI16_SECTDIFF = PPC_RELOCATION.HI16_SECTDIFF¶

JBSR = PPC_RELOCATION.JBSR¶

LO14 = PPC_RELOCATION.LO14¶

LO14_SECTDIFF = PPC_RELOCATION.LO14_SECTDIFF¶

LO16 = PPC_RELOCATION.LO16¶

LO16_SECTDIFF = PPC_RELOCATION.LO16_SECTDIFF¶

LOCAL_SECTDIFF = PPC_RELOCATION.LOCAL_SECTDIFF¶

PAIR = PPC_RELOCATION.PAIR¶

PB_LA_PTR = PPC_RELOCATION.PB_LA_PTR¶

SECTDIFF = PPC_RELOCATION.SECTDIFF¶

VANILLA = PPC_RELOCATION.VANILLA¶

property name¶: (self: handle) -> str

ARM_RELOCATION¶

class lief.MachO.ARM_RELOCATION(self: lief.MachO.ARM_RELOCATION, arg0: int) → None¶

Members:

VANILLA

PAIR

SECTDIFF

LOCAL_SECTDIFF

PB_LA_PTR

BR24

RELOC_BR22

32BIT_BRANCH

HALF

HALF_SECTDIFF

32BIT_BRANCH = ARM_RELOCATION.32BIT_BRANCH¶

BR24 = ARM_RELOCATION.BR24¶

HALF = ARM_RELOCATION.HALF¶

HALF_SECTDIFF = ARM_RELOCATION.HALF_SECTDIFF¶

LOCAL_SECTDIFF = ARM_RELOCATION.LOCAL_SECTDIFF¶

PAIR = ARM_RELOCATION.PAIR¶

PB_LA_PTR = ARM_RELOCATION.PB_LA_PTR¶

RELOC_BR22 = ARM_RELOCATION.RELOC_BR22¶

SECTDIFF = ARM_RELOCATION.SECTDIFF¶

VANILLA = ARM_RELOCATION.VANILLA¶

property name¶: (self: handle) -> str

ARM64_RELOCATION¶

class lief.MachO.ARM64_RELOCATION(self: lief.MachO.ARM64_RELOCATION, arg0: int) → None¶

Members:

UNSIGNED

SUBTRACTOR

BRANCH26

PAGE21

PAGEOFF12

GOT_LOAD_PAGE21

GOT_LOAD_PAGEOFF12

POINTER_TO_GOT

TLVP_LOAD_PAGE21

TLVP_LOAD_PAGEOFF12

ADDEND

ADDEND = ARM64_RELOCATION.ADDEND¶

BRANCH26 = ARM64_RELOCATION.BRANCH26¶

GOT_LOAD_PAGE21 = ARM64_RELOCATION.GOT_LOAD_PAGE21¶

GOT_LOAD_PAGEOFF12 = ARM64_RELOCATION.GOT_LOAD_PAGEOFF12¶

PAGE21 = ARM64_RELOCATION.PAGE21¶

PAGEOFF12 = ARM64_RELOCATION.PAGEOFF12¶

POINTER_TO_GOT = ARM64_RELOCATION.POINTER_TO_GOT¶

SUBTRACTOR = ARM64_RELOCATION.SUBTRACTOR¶

TLVP_LOAD_PAGE21 = ARM64_RELOCATION.TLVP_LOAD_PAGE21¶

TLVP_LOAD_PAGEOFF12 = ARM64_RELOCATION.TLVP_LOAD_PAGEOFF12¶

UNSIGNED = ARM64_RELOCATION.UNSIGNED¶

property name¶: (self: handle) -> str

RELOCATION_ORIGINS¶

class lief.MachO.RELOCATION_ORIGINS(self: lief.MachO.RELOCATION_ORIGINS, arg0: int) → None¶

Members:

UNKNOWN

DYLDINFO

RELOC_TABLE

DYLDINFO = RELOCATION_ORIGINS.DYLDINFO¶

RELOC_TABLE = RELOCATION_ORIGINS.RELOC_TABLE¶

UNKNOWN = RELOCATION_ORIGINS.UNKNOWN¶

property name¶: (self: handle) -> str

REBASE_TYPES¶

class lief.MachO.REBASE_TYPES(self: lief.MachO.REBASE_TYPES, arg0: int) → None¶

Members:

POINTER

TEXT_ABSOLUTE32

TEXT_PCREL32

POINTER = REBASE_TYPES.POINTER¶

TEXT_ABSOLUTE32 = REBASE_TYPES.TEXT_ABSOLUTE32¶

TEXT_PCREL32 = REBASE_TYPES.TEXT_PCREL32¶

property name¶: (self: handle) -> str

BINDING_CLASS¶

class lief.MachO.BINDING_CLASS(self: lief.MachO.BINDING_CLASS, arg0: int) → None¶

Members:

WEAK

LAZY

STANDARD

LAZY = BINDING_CLASS.LAZY¶

STANDARD = BINDING_CLASS.STANDARD¶

WEAK = BINDING_CLASS.WEAK¶

property name¶: (self: handle) -> str

REBASE_OPCODES¶

class lief.MachO.REBASE_OPCODES(self: lief.MachO.REBASE_OPCODES, arg0: int) → None¶

Members:

DONE

SET_TYPE_IMM

SET_SEGMENT_AND_OFFSET_ULEB

ADD_ADDR_ULEB

ADD_ADDR_IMM_SCALED

DO_REBASE_IMM_TIMES

DO_REBASE_ULEB_TIMES

DO_REBASE_ADD_ADDR_ULEB

DO_REBASE_ULEB_TIMES_SKIPPING_ULEB

ADD_ADDR_IMM_SCALED = REBASE_OPCODES.ADD_ADDR_IMM_SCALED¶

ADD_ADDR_ULEB = REBASE_OPCODES.ADD_ADDR_ULEB¶

DONE = REBASE_OPCODES.DONE¶

DO_REBASE_ADD_ADDR_ULEB = REBASE_OPCODES.DO_REBASE_ADD_ADDR_ULEB¶

DO_REBASE_IMM_TIMES = REBASE_OPCODES.DO_REBASE_IMM_TIMES¶

DO_REBASE_ULEB_TIMES = REBASE_OPCODES.DO_REBASE_ULEB_TIMES¶

DO_REBASE_ULEB_TIMES_SKIPPING_ULEB = REBASE_OPCODES.DO_REBASE_ULEB_TIMES_SKIPPING_ULEB¶

SET_SEGMENT_AND_OFFSET_ULEB = REBASE_OPCODES.SET_SEGMENT_AND_OFFSET_ULEB¶

SET_TYPE_IMM = REBASE_OPCODES.SET_TYPE_IMM¶

property name¶: (self: handle) -> str

BIND_TYPES¶

class lief.MachO.BIND_TYPES(self: lief.MachO.BIND_TYPES, arg0: int) → None¶

Members:

POINTER

TEXT_ABSOLUTE32

TEXT_PCREL32

POINTER = BIND_TYPES.POINTER¶

TEXT_ABSOLUTE32 = BIND_TYPES.TEXT_ABSOLUTE32¶

TEXT_PCREL32 = BIND_TYPES.TEXT_PCREL32¶

property name¶: (self: handle) -> str

BIND_SPECIAL_DYLIB¶

class lief.MachO.BIND_SPECIAL_DYLIB(self: lief.MachO.BIND_SPECIAL_DYLIB, arg0: int) → None¶

Members:

SELF

MAIN_EXECUTABLE

FLAT_LOOKUP

FLAT_LOOKUP = BIND_SPECIAL_DYLIB.FLAT_LOOKUP¶

MAIN_EXECUTABLE = BIND_SPECIAL_DYLIB.MAIN_EXECUTABLE¶

SELF = BIND_SPECIAL_DYLIB.SELF¶

property name¶: (self: handle) -> str

BIND_OPCODES¶

class lief.MachO.BIND_OPCODES(self: lief.MachO.BIND_OPCODES, arg0: int) → None¶

Members:

DONE

SET_DYLIB_ORDINAL_IMM

SET_DYLIB_ORDINAL_ULEB

SET_DYLIB_SPECIAL_IMM

SET_SYMBOL_TRAILING_FLAGS_IMM

SET_TYPE_IMM

SET_ADDEND_SLEB

SET_SEGMENT_AND_OFFSET_ULEB

ADD_ADDR_ULEB

DO_BIND

DO_BIND_ADD_ADDR_ULEB

DO_BIND_ADD_ADDR_IMM_SCALED

DO_BIND_ULEB_TIMES_SKIPPING_ULEB

ADD_ADDR_ULEB = BIND_OPCODES.ADD_ADDR_ULEB¶

DONE = BIND_OPCODES.DONE¶

DO_BIND = BIND_OPCODES.DO_BIND¶

DO_BIND_ADD_ADDR_IMM_SCALED = BIND_OPCODES.DO_BIND_ADD_ADDR_IMM_SCALED¶

DO_BIND_ADD_ADDR_ULEB = BIND_OPCODES.DO_BIND_ADD_ADDR_ULEB¶

DO_BIND_ULEB_TIMES_SKIPPING_ULEB = BIND_OPCODES.DO_BIND_ULEB_TIMES_SKIPPING_ULEB¶

SET_ADDEND_SLEB = BIND_OPCODES.SET_ADDEND_SLEB¶

SET_DYLIB_ORDINAL_IMM = BIND_OPCODES.SET_DYLIB_ORDINAL_IMM¶

SET_DYLIB_ORDINAL_ULEB = BIND_OPCODES.SET_DYLIB_ORDINAL_ULEB¶

SET_DYLIB_SPECIAL_IMM = BIND_OPCODES.SET_DYLIB_SPECIAL_IMM¶

SET_SEGMENT_AND_OFFSET_ULEB = BIND_OPCODES.SET_SEGMENT_AND_OFFSET_ULEB¶

SET_SYMBOL_TRAILING_FLAGS_IMM = BIND_OPCODES.SET_SYMBOL_TRAILING_FLAGS_IMM¶

SET_TYPE_IMM = BIND_OPCODES.SET_TYPE_IMM¶

property name¶: (self: handle) -> str

EXPORT_SYMBOL_KINDS¶

class lief.MachO.EXPORT_SYMBOL_KINDS(self: lief.MachO.EXPORT_SYMBOL_KINDS, arg0: int) → None¶

Members:

REGULAR

THREAD_LOCAL

ABSOLUTE

ABSOLUTE = EXPORT_SYMBOL_KINDS.ABSOLUTE¶

REGULAR = EXPORT_SYMBOL_KINDS.REGULAR¶

THREAD_LOCAL = EXPORT_SYMBOL_KINDS.THREAD_LOCAL¶

property name¶: (self: handle) -> str

EXPORT_SYMBOL_FLAGS¶

class lief.MachO.EXPORT_SYMBOL_FLAGS(self: lief.MachO.EXPORT_SYMBOL_FLAGS, arg0: int) → None¶

Members:

WEAK_DEFINITION

REEXPORT

STUB_AND_RESOLVER

REEXPORT = EXPORT_SYMBOL_FLAGS.REEXPORT¶

STUB_AND_RESOLVER = EXPORT_SYMBOL_FLAGS.STUB_AND_RESOLVER¶

WEAK_DEFINITION = EXPORT_SYMBOL_FLAGS.WEAK_DEFINITION¶

property name¶: (self: handle) -> str

VM_PROTECTIONS¶

class lief.MachO.VM_PROTECTIONS(self: lief.MachO.VM_PROTECTIONS, arg0: int) → None¶

Members:

READ

WRITE

EXECUTE

EXECUTE = VM_PROTECTIONS.EXECUTE¶

READ = VM_PROTECTIONS.READ¶

WRITE = VM_PROTECTIONS.WRITE¶

property name¶: (self: handle) -> str

SYMBOL_ORIGINS¶

class lief.MachO.SYMBOL_ORIGINS(self: lief.MachO.SYMBOL_ORIGINS, arg0: int) → None¶

Members:

UNKNOWN

DYLD_EXPORT

LC_SYMTAB

DYLD_EXPORT = SYMBOL_ORIGINS.DYLD_EXPORT¶

LC_SYMTAB = SYMBOL_ORIGINS.LC_SYMTAB¶

UNKNOWN = SYMBOL_ORIGINS.UNKNOWN¶

property name¶: (self: handle) -> str

SECTION_FLAGS¶

class lief.MachO.SECTION_FLAGS(self: lief.MachO.SECTION_FLAGS, arg0: int) → None¶

Members:

PURE_INSTRUCTIONS

NO_TOC

STRIP_STATIC_SYMS

NO_DEAD_STRIP

LIVE_SUPPORT

SELF_MODIFYING_CODE

DEBUG

SOME_INSTRUCTIONS

EXT_RELOC

LOC_RELOC

DEBUG = SECTION_FLAGS.DEBUG¶

EXT_RELOC = SECTION_FLAGS.EXT_RELOC¶

LIVE_SUPPORT = SECTION_FLAGS.LIVE_SUPPORT¶

LOC_RELOC = SECTION_FLAGS.LOC_RELOC¶

NO_DEAD_STRIP = SECTION_FLAGS.NO_DEAD_STRIP¶

NO_TOC = SECTION_FLAGS.NO_TOC¶

PURE_INSTRUCTIONS = SECTION_FLAGS.PURE_INSTRUCTIONS¶

SELF_MODIFYING_CODE = SECTION_FLAGS.SELF_MODIFYING_CODE¶

SOME_INSTRUCTIONS = SECTION_FLAGS.SOME_INSTRUCTIONS¶

STRIP_STATIC_SYMS = SECTION_FLAGS.STRIP_STATIC_SYMS¶

property name¶: (self: handle) -> str