MachO

Parser

lief.MachO.parse(*args, **kwargs)

Overloaded function.

  1. parse(filename: str, config: lief.MachO.ParserConfig=<lief.MachO.ParserConfig object at 0x7f8ba37c8df8>) -> LIEF::MachO::FatBinary

Parse the given binary and return a FatBinary object

One can configure the parsing with the config parameter. See ParserConfig

  1. parse(raw: List[int], name: str=’’, config: lief.MachO.ParserConfig=<lief.MachO.ParserConfig object at 0x7f8ba37c8e30>) -> LIEF::MachO::FatBinary

Parse the given binary (from raw) and return a FatBinary objects

One can configure the parsing with the config parameter. See ParserConfig

  1. parse(io: object, name: str=’’, config: lief.MachO.ParserConfig=<lief.MachO.ParserConfig object at 0x7f8ba37c8e68>) -> LIEF::MachO::FatBinary

class lief.MachO.ParserConfig(self: lief.MachO.ParserConfig) → None

Configuration of MachO’s parser

deep = <lief.MachO.ParserConfig object>
property parse_dyldinfo_deeply

If set to True, parse deeply the DyldInfo structure. It includes Exports, Bindings and Rebases

quick = <lief.MachO.ParserConfig object>
fatbinary_1 = lief.MachO.parse("/usr/bin/ls", config=lief.MachO.ParserConfig.deep)
# or
fatbinary_2 = lief.MachO.parse("/usr/bin/ls", config=lief.MachO.ParserConfig.quick)

FatBinary

class lief.MachO.FatBinary
at(self: lief.MachO.FatBinary, index: int) → LIEF::MachO::Binary

Return the Binary at the given index

raw(self: lief.MachO.FatBinary) → List[int]

Build a Mach-O universal binary and return its bytes

property size

Number of Binary registred

write(self: lief.MachO.FatBinary, filename: str) → None

Build a Mach-O universal binary


Binary

class lief.MachO.Binary
class VA_TYPES(self: lief.Binary.VA_TYPES, arg0: int) → None
AUTO = VA_TYPES.AUTO
RVA = VA_TYPES.RVA
VA = VA_TYPES.VA
property abstract

Return the Binary object

Warning

Getting this property modifies the __class__ attribute so that the current binary looks like a Binary.

Use the concrete to get back to the original binary.

add(*args, **kwargs)

Overloaded function.

  1. add(self: lief.MachO.Binary, dylib_command: LIEF::MachO::DylibCommand) -> LIEF::MachO::LoadCommand

Add a new DylibCommand

  1. add(self: lief.MachO.Binary, segment: LIEF::MachO::SegmentCommand) -> LIEF::MachO::LoadCommand

Add a new SegmentCommand

  1. add(self: lief.MachO.Binary, load_command: LIEF::MachO::LoadCommand) -> LIEF::MachO::LoadCommand

Add a new LoadCommand

  1. add(self: lief.MachO.Binary, load_command: LIEF::MachO::LoadCommand, index: int) -> LIEF::MachO::LoadCommand

Add a new LoadCommand at index

add_library(self: lief.MachO.Binary, library_name: str) → LIEF::MachO::LoadCommand

Add a new library dependency

add_section(*args, **kwargs)

Overloaded function.

  1. add_section(self: lief.MachO.Binary, segment: LIEF::MachO::SegmentCommand, section: LIEF::MachO::Section) -> LIEF::MachO::Section

Add a new Section in the given SegmentCommand

  1. add_section(self: lief.MachO.Binary, section: LIEF::MachO::Section) -> LIEF::MachO::Section

Add a new Section within the __TEXT segment

  1. add_section(self: lief.MachO.Binary, section: LIEF::MachO::SegmentCommand, section: LIEF::MachO::Section) -> LIEF::MachO::Section

Add a new Section in the given SegmentCommand

property build_version

Return binary’s BuildVersion if any.

can_remove(self: lief.MachO.Binary, symbol: LIEF::MachO::Symbol) → bool

Check if the given symbol can be safely removed.

can_remove_symbol(self: lief.MachO.Binary, symbol_name: str) → bool

Check if the given symbol name can be safely removed.

property code_signature

Return binary’s CodeSignature if any.

property commands

Return binary’s Command

property concrete

Return either lief.ELF.Binary, lief.PE.Binary, lief.MachO.Binary object

property ctor_functions

Constructor functions that are called prior any other functions

property data_in_code

Return binary’s DataInCode if any.

property dyld_environment

Return binary’s DyldEnvironment if any.

property dyld_info

Return binary’s DyldInfo if any.

property dylinker

Return binary’s DylinkerCommand if any.

property dynamic_symbol_command

Return binary’s DynamicSymbolCommand if any.

property encryption_info

Return binary’s EncryptionInfo if any.

property entrypoint

Binary’s entrypoint

property exported_functions

Return binary’s exported Function

property exported_symbols

Return binary’s Symbol which are exported

extend(self: lief.MachO.Binary, load_command: LIEF::MachO::LoadCommand, size: int) → bool

Extend a LoadCommand by size

extend_segment(self: lief.MachO.Binary, segment_command: LIEF::MachO::SegmentCommand, size: int) → bool

Extend the content of the given SegmentCommand by size

property fat_offset

Return binary’s fat offset. 0 if not relevant.

property format

File format EXE_FORMATS of the underlying binary.

property function_starts

Return binary’s FunctionStarts if any.

property functions

Return list of all Function found

get(self: lief.MachO.Binary, type: lief.MachO.LOAD_COMMAND_TYPES) → LIEF::MachO::LoadCommand

Return the first LoadCommand having the given LOAD_COMMAND_TYPES

get_content_from_virtual_address(self: lief.Binary, virtual_address: int, size: int, va_type: lief.Binary.VA_TYPES=VA_TYPES.AUTO) → List[int]

Return the content located at virtual address.

Virtual address is specified in the first argument and size to read (in bytes) in the second. If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default it is set to AUTO

get_function_address(self: lief.Binary, function_name: str) → int

Return the address of the given function name

get_section(self: lief.MachO.Binary, name: str) → LIEF::MachO::Section

Return the section from the given name

get_segment(self: lief.MachO.Binary, name: str) → LIEF::MachO::SegmentCommand

Return the SegmentCommand from the given name

get_symbol(self: lief.MachO.Binary, name: str) → LIEF::MachO::Symbol

Return the Symbol from the given name

has(self: lief.MachO.Binary, type: lief.MachO.LOAD_COMMAND_TYPES) → bool

Check if the current binary has a LoadCommand with the given LOAD_COMMAND_TYPES

property has_build_version

True if the binary has a BuildVersion command

property has_code_signature

True if the binary is signed (i.e. has a CodeSignature command)

property has_data_in_code

True if the binary has a DataInCode command

property has_dyld_environment

True if the binary has a DyldEnvironment command

property has_dyld_info

True if the binary has a DyldInfo command.

property has_dylinker

True if the binary has a DylinkerCommand command.

property has_dynamic_symbol_command

True if the binary has a DynamicSymbolCommand command.

property has_encryption_info

True if the binary has a EncryptionInfo command

property has_entrypoint

True if the binary has an entrypoint. Basically for libraries it will return false

property has_function_starts

True if the binary has a FunctionStarts command.

property has_main_command

True if the binary has a MainCommand command.

property has_nx

Check if the binary uses NX protection

property has_rpath

True if the binary has a RPathCommand command.

has_section(self: lief.MachO.Binary, name: str) → bool

Check if a section with the given name exists

has_segment(self: lief.MachO.Binary, name: str) → bool

Check if a SegmentCommand with the given name exists

property has_segment_split_info

True if the binary has a SegmentSplitInfo command

property has_source_version

True if the binary has a SourceVersion command.

property has_sub_framework

True if the binary has a SubFramework command

has_symbol(self: lief.MachO.Binary, name: str) → bool

Check if a Symbol with the given name exists

property has_symbol_command

True if the binary has a SymbolCommand command.

property has_thread_command

True if the binary has a ThreadCommand command.

property has_uuid

True if the binary has a UUIDCommand command.

property has_version_min

True if the binary has a VersionMin command.

property header

Return binary’s Header

property imagebase

Return binary’s image base which is the base address where segments are mapped (without PIE). 0 if not relevant.

property imported_functions

Return binary’s imported Function (name)

property imported_symbols

Return binary’s Symbol which are imported

property is_pie

Check if the binary is position independent

is_valid_addr(self: lief.MachO.Binary, address: int) → bool

Check if the given address is comprise between the lowest virtual address and the biggest one

property libraries

Return binary’s DylibCommand

property main_command

Return binary’s MainCommand if any.

property name

Binary’s name

property off_ranges

Return the range of offsets as a tuple (off_start, off_end)

patch_address(*args, **kwargs)

Overloaded function.

  1. patch_address(self: lief.Binary, address: int, patch_value: List[int], va_type: lief.Binary.VA_TYPES=VA_TYPES.AUTO) -> None

Virtual address is specified in the first argument and the content in the second (as a list of bytes). If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default it is set to AUTO

  1. patch_address(self: lief.Binary, address: int, patch_value: int, size: int=8, va_type: lief.Binary.VA_TYPES=VA_TYPES.AUTO) -> None

Virtual address is specified in the first argument, integer in the second and sizeof the integer in third one. If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default it is set to AUTO

property relocations

Return an iterator over binary’s Relocation

remove(*args, **kwargs)

Overloaded function.

  1. remove(self: lief.MachO.Binary, load_command: LIEF::MachO::LoadCommand) -> bool

Remove a LoadCommand

  1. remove(self: lief.MachO.Binary, type: lief.MachO.LOAD_COMMAND_TYPES) -> bool

Remove all LoadCommand having the given LOAD_COMMAND_TYPES

  1. remove(self: lief.MachO.Binary, symbol: LIEF::MachO::Symbol) -> bool

Remove the given Symbol

remove_command(self: lief.MachO.Binary, index: int) → bool

Remove the LoadCommand at index

remove_section(self: lief.Binary, name: str, clear: bool=False) → None

Remove the section with the given name

remove_signature(self: lief.MachO.Binary) → bool

Remove the CodeSignature (if any)

remove_symbol(self: lief.MachO.Binary, name: str) → bool

Remove all symbol(s) with the given name

property rpath

Return binary’s RPathCommand if any.

section_from_offset(self: lief.MachO.Binary, arg0: int) → LIEF::MachO::Section

Return the Section which contains the offset

section_from_virtual_address(self: lief.MachO.Binary, arg0: int) → LIEF::MachO::Section

Return the Section which contains the virtual address

property sections

Return binary’s Section

segment_from_offset(self: lief.MachO.Binary, arg0: int) → LIEF::MachO::SegmentCommand

Return the SegmentCommand which contains the offset

segment_from_virtual_address(self: lief.MachO.Binary, arg0: int) → LIEF::MachO::SegmentCommand

Return the SegmentCommand which contains the virtual address

property segment_split_info

Return binary’s SegmentSplitInfo if any.

property segments

Return binary’s SegmentCommand

property source_version

Return binary’s SourceVersion if any.

property sub_framework

Return binary’s SubFramework if any.

property symbol_command

Return binary’s SymbolCommand if any.

property symbols

Return binary’s Symbol

property thread_command

Return binary’s ThreadCommand if any.

unexport(*args, **kwargs)

Overloaded function.

  1. unexport(self: lief.MachO.Binary, name: str) -> bool

Remove the symbol from the export table

  1. unexport(self: lief.MachO.Binary, symbol: LIEF::MachO::Symbol) -> bool

Remove the symbol from the export table

property unwind_functions

Return list of Function found in the __unwind_info section

property uuid

Return binary’s UUIDCommand if any.

property va_ranges

Return the range of virtual addresses as a tuple (va_start, va_end)

property version_min

Return binary’s VersionMin if any.

virtual_address_to_offset(self: lief.MachO.Binary, virtual_address: int) → int

Convert the virtual address to an offset in the binary

write(self: lief.MachO.Binary, output: str) → None

Rebuild the binary and write it in a file

xref(self: lief.Binary, Return all **virtual address** that *use* the ``address`` given in parametervirtual_address: int) → List[int]


Section

class lief.MachO.Section(*args, **kwargs)

Overloaded function.

  1. __init__(self: lief.MachO.Section) -> None

  2. __init__(self: lief.MachO.Section, section_name: str) -> None

Constructor with the section name

  1. __init__(self: lief.MachO.Section, section_name: str, content: List[int]) -> None

Constructor with the section name and its content

add(self: lief.MachO.Section, flag: lief.MachO.SECTION_FLAGS) → None

Add the given SECTION_FLAGS

property alignment

Section’s alignment

property content

Section’s content

property entropy

Section’s entropy

property flags
property flags_list
has(self: lief.MachO.Section, flag: lief.MachO.SECTION_FLAGS) → bool

Check if the section has the given SECTION_FLAGS

property has_segment

True if the current section has a segment associated with

property name

Section’s name

property numberof_relocations
property offset

Section’s offset

property relocation_offset
property relocations

Iterator over Relocation (if any)

remove(self: lief.MachO.Section, flag: lief.MachO.SECTION_FLAGS) → None

Remove the given SECTION_FLAGS

property reserved1
property reserved2
property reserved3
search(*args, **kwargs)

Overloaded function.

  1. search(self: lief.Section, number: int, pos: int=0, size: int=0) -> int

Look for integer within the current section

  1. search(self: lief.Section, str: str, pos: int=0) -> int

Look for string within the current section

search_all(*args, **kwargs)

Overloaded function.

  1. search_all(self: lief.Section, number: int, size: int=0) -> List[int]

Look for all integers within the current section

  1. search_all(self: lief.Section, str: str) -> List[int]

Look for all strings within the current section

property segment

SegmentCommand segment associated with the section

property size

Section’s size

property type
property virtual_address

Section’s virtual address


SegmentCommand

class lief.MachO.SegmentCommand(*args, **kwargs)

Overloaded function.

  1. __init__(self: lief.MachO.SegmentCommand) -> None

  2. __init__(self: lief.MachO.SegmentCommand, arg0: str) -> None

  3. __init__(self: lief.MachO.SegmentCommand, arg0: str, arg1: List[int]) -> None

add_section(self: lief.MachO.SegmentCommand, section: LIEF::MachO::Section) → LIEF::MachO::Section
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property content

Segment’s content

property data

Command’s data

property file_offset

Segment’s file offset

property file_size

Segment’s file size

property flags

Segment’s flags

has(self: lief.MachO.SegmentCommand, section: LIEF::MachO::Section) → bool

Check if the given Section belongs to the current segment

has_section(self: lief.MachO.SegmentCommand, section_name: str) → bool

Check if the given section name belongs to the current segment

property init_protection

Segment’s initial protection

property max_protection

Segment’s max protection

property name

Segment’s name

property numberof_sections

Number of sections in this segment

property relocations

Segment’s relocations

property sections

Segment’s sections

property size

Size of the command (should be greather than sizeof(load_command))

property virtual_address

Segment’s virtual address

property virtual_size

Segment’s virtual size


LoadCommand

class lief.MachO.LoadCommand(self: lief.MachO.LoadCommand) → None
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property size

Size of the command (should be greather than sizeof(load_command))


DylibCommand

class lief.MachO.DylibCommand
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property compatibility_version

Library’s compatibility version

property current_version

Library’s current version

property data

Command’s data

id_dylib(name: str, timestamp: int=0, current_version: int=0, compat_version: int=0) → lief.MachO.DylibCommand

Factory function to generate a ID_DYLIB library

lazy_load_dylib(name: str, timestamp: int=0, current_version: int=0, compat_version: int=0) → lief.MachO.DylibCommand

Factory function to generate a LAZY_LOAD_DYLIB library

load_dylib(name: str, timestamp: int=0, current_version: int=0, compat_version: int=0) → lief.MachO.DylibCommand

Factory function to generate a LOAD_DYLIB library

load_upward_dylib(name: str, timestamp: int=0, current_version: int=0, compat_version: int=0) → lief.MachO.DylibCommand

Factory function to generate a LOAD_UPWARD_DYLIB library

property name

Library’s name

reexport_dylib(name: str, timestamp: int=0, current_version: int=0, compat_version: int=0) → lief.MachO.DylibCommand

Factory function to generate a REEXPORT_DYLIB library

property size

Size of the command (should be greather than sizeof(load_command))

property timestamp

Library’s timestamp

weak_lib(name: str, timestamp: int=0, current_version: int=0, compat_version: int=0) → lief.MachO.DylibCommand

Factory function to generate a LC_LOAD_WEAK_DYLIB library


DylinkerCommand

class lief.MachO.DylinkerCommand
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property name

Path to the loader used to load the binary

property size

Size of the command (should be greather than sizeof(load_command))


UUIDCommand

class lief.MachO.UUIDCommand
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property size

Size of the command (should be greather than sizeof(load_command))

property uuid

UUID as a list


MainCommand

class lief.MachO.MainCommand
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property entrypoint

Program entry point

property size

Size of the command (should be greather than sizeof(load_command))

property stack_size

Program stack_size


Symbol

class lief.MachO.Symbol(self: lief.MachO.Symbol) → None
property binding_info

BindingInfo associated with the symbol (if any)

property demangled_name

Symbol’s unmangled name

property description
property export_info

ExportInfo associated with the symbol (if any)

property has_binding_info

True if the symbol has an BindingInfo associated with

property has_export_info

True if the symbol has a ExportInfo associated with

property name

Symbol’s name

property numberof_sections
property origin

Return the SYMBOL_ORIGINS of this symbol

property size

Symbol’s size

property type
property value

Symbol Command

class lief.MachO.SymbolCommand(self: lief.MachO.SymbolCommand) → None
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property numberof_symbols

Number of symbols registered

property size

Size of the command (should be greather than sizeof(load_command))

property strings_offset

Offset from the start of the file to the string table

property strings_size

Size of the size string table

property symbol_offset

Offset from the start of the file to the n_list associated with the command


Dynamic Symbol Command

class lief.MachO.DynamicSymbolCommand
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property external_reference_symbol_offset

Byte offset from the start of the file to the external reference table data.

This field seems unused by recent Mach-O loader and should be set to 0

property external_relocation_offset

Byte offset from the start of the file to the module table data.

This field seems unused by recent Mach-O loader and should be set to 0

property idx_external_define_symbol

Index of the first symbol in the group of defined external symbols.

property idx_local_symbol

Index of the first symbol in the group of local symbols.

property idx_undefined_symbol

Index of the first symbol in the group of undefined external symbols.

property indirect_symbol_offset

Byte offset from the start of the file to the indirect symbol table data..

Indirect symbol table is used by the loader to speed-up symbol resolution during the lazy binding process

References:

  • dyld-519.2.1/src/ImageLoaderMachOCompressed.cpp

  • dyld-519.2.1/src/ImageLoaderMachOClassic.cpp

property local_relocation_offset

Byte offset from the start of the file to the local relocation table data.

This field seems unused by recent Mach-O loader and should be set to 0

property module_table_offset

Byte offset from the start of the file to the module table data.

This field seems unused by recent Mach-O loader and should be set to 0

property nb_external_define_symbols

Number of symbols in the group of defined external symbols.

property nb_external_reference_symbols

Number of entries in the external reference table

This field seems unused by recent Mach-O loader and should be set to 0

property nb_external_relocations

Number of entries in the external relocation table.

This field seems unused by recent Mach-O loader and should be set to 0

property nb_indirect_symbols

Number of entries in the indirect symbol table.

property nb_local_relocations

Number of entries in the local relocation table.

This field seems unused by recent Mach-O loader and should be set to 0

property nb_local_symbols

Number of symbols in the group of local symbols.

property nb_module_table

Number of entries in the module table..

This field seems unused by recent Mach-O loader and should be set to 0

property nb_toc

Number of entries in the table of contents

Should be set to 0 on recent Mach-O

property nb_undefined_symbols

Number of symbols in the group of undefined external symbols.

property size

Size of the command (should be greather than sizeof(load_command))

property toc_offset

Byte offset from the start of the file to the table of contents data

Table of content is used by legacy Mach-O loader and this field should be set to 0


Dyld Info

class lief.MachO.DyldInfo
property bind

Bind information as a tuple (offset, size)

Dyld binds an image during the loading process, if the image requires any pointers to be initialized to symbols in other images. The rebase information is a stream of byte sized opcodes whose symbolic names start with BIND_OPCODE_. Conceptually the bind information is a table of tuples: (seg-index, seg-offset, type, symbol-library-ordinal, symbol-name, addend) The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like for runs of pointers initialzed to the same value can be encoded in a few bytes.

See also

/usr/include/mach-o/loader.h

property bind_opcodes

Return Binding’s opcodes as list of bytes

property bindings

Return an iterator over Dyld’s BindingInfo

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property export_info

Export information as a tuple (offset, size)

The symbols exported by a dylib are encoded in a trie. This is a compact representation that factors out common prefixes. It also reduces LINKEDIT pages in RAM because it encodes all information (name, address, flags) in one small, contiguous range. The export area is a stream of nodes. The first node sequentially is the start node for the trie.

Nodes for a symbol start with a byte that is the length of the exported symbol information for the string so far. If there is no exported symbol, the byte is zero. If there is exported info, it follows the length byte. The exported info normally consists of a flags and offset both encoded in uleb128. The offset is location of the content named by the symbol. It is the offset from the mach_header for the image.

After the initial byte and optional exported symbol information is a byte of how many edges (0-255) that this node has leaving it, followed by each edge. Each edge is a zero terminated cstring of the addition chars in the symbol, followed by a uleb128 offset for the node that edge points to.

See also

/usr/include/mach-o/loader.h

property export_trie

Return Export’s trie as list of bytes

property exports

Return an iterator over Dyld’s ExportInfo

property lazy_bind

Lazy Bind information as a tuple (offset, size)

Some uses of external symbols do not need to be bound immediately. Instead they can be lazily bound on first use. The lazy_bind are contains a stream of BIND opcodes to bind all lazy symbols. Normal use is that dyld ignores the lazy_bind section when loading an image. Instead the static linker arranged for the lazy pointer to initially point to a helper function which pushes the offset into the lazy_bind area for the symbol needing to be bound, then jumps to dyld which simply adds the offset to lazy_bind_off to get the information on what to bind.

See also

/usr/include/mach-o/loader.h

property lazy_bind_opcodes

Return lazy binding’s opcodes as list of bytes

property rebase

Rebase information as a tuple (offset, size)

Dyld rebases an image whenever dyld loads it at an address different from its preferred address. The rebase information is a stream of byte sized opcodes whose symbolic names start with REBASE_OPCODE_. Conceptually the rebase information is a table of tuples: (seg-index, seg-offset, type) The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like “every n’th offset for m times” can be encoded in a few bytes.

See also

/usr/include/mach-o/loader.h

property rebase_opcodes

Return Rebase’s opcodes as list of bytes

set_bind_offset(self: lief.MachO.DyldInfo, offset: int) → None
set_bind_size(self: lief.MachO.DyldInfo, size: int) → None
set_export_offset(self: lief.MachO.DyldInfo, offset: int) → None
set_export_size(self: lief.MachO.DyldInfo, size: int) → None
set_lazy_bind_offset(self: lief.MachO.DyldInfo, offset: int) → None
set_lazy_bind_size(self: lief.MachO.DyldInfo, size: int) → None
set_rebase_offset(self: lief.MachO.DyldInfo, offset: int) → None
set_rebase_size(self: lief.MachO.DyldInfo, size: int) → None
set_weak_bind_offset(self: lief.MachO.DyldInfo, offset: int) → None
set_weak_bind_size(self: lief.MachO.DyldInfo, size: int) → None
property show_bind_opcodes

Return the bind opcodes in a humman-readable way

property show_export_trie

Return the export trie in a humman-readable way

property show_lazy_bind_opcodes

Return the weak bind opcodes in a humman-readable way

property show_rebases_opcodes

Return the rebase opcodes in a humman-readable way

property show_weak_bind_opcodes

Return the weak bind opcodes in a humman-readable way

property size

Size of the command (should be greather than sizeof(load_command))

property weak_bind

Weak Bind information as a tuple (offset, size)

Some C++ programs require dyld to unique symbols so that all images in the process use the same copy of some code/data. This step is done after binding. The content of the weak_bind info is an opcode stream like the bind_info. But it is sorted alphabetically by symbol name. This enable dyld to walk all images with weak binding information in order and look for collisions. If there are no collisions, dyld does no updating. That means that some fixups are also encoded in the bind_info. For instance, all calls to operator new are first bound to libstdc++.dylib using the information in bind_info. Then if some image overrides operator new that is detected when the weak_bind information is processed and the call to operator new is then rebound.

See also

/usr/include/mach-o/loader.h

property weak_bind_opcodes

Return Weak binding’s opcodes as list of bytes


Function starts

class lief.MachO.FunctionStarts
add_function(self: lief.MachO.FunctionStarts, address: int) → None

Add a new function

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property data_offset

Offset in the binary where start functions are located

property data_size

Size of the functions list in the binary

property functions

Addresses of every function entry point in the executable

This allows for functions to exist that have no entries in the symbol table.

Warning

The address is relative to the __TEXT segment

property size

Size of the command (should be greather than sizeof(load_command))


Source Version

class lief.MachO.SourceVersion
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property size

Size of the command (should be greather than sizeof(load_command))

property version

Version as a tuple of 5 integers


Version Min

class lief.MachO.VersionMin
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property sdk

SDK as a tuple of 3 integers

property size

Size of the command (should be greather than sizeof(load_command))

property version

Version as a tuple of 3 integers


Relocation

class lief.MachO.Relocation
property address

For OBJECT or (origin is RELOC_TABLE) this is an offset from the start of the Section to the item containing the address requiring relocation.

For EXECUTE / DYLIB or (origin is DYLDINFO) this is an virtual_address

property architecture

CPU_TYPES of the relocation

property has_section

True if the relocation has a Section associated with

property has_segment

True if the relocation has a SegmentCommand associated with

property has_symbol

True if the relocation has a Symbol associated with

property origin

RELOCATION_ORIGINS of the relocation

For OBJECT file it should be RELOC_TABLE for EXECUTE / DYLIB it should be DYLDINFO

property pc_relative

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

property section

Section associated with the relocation (if any)

property segment

SegmentCommand associated with the relocation (if any)

property size

Relocation’s size (in bits)

property symbol

Symbol associated with the relocation (if any)

property type

Type of the relocation according to the architecture and/or origin

If origin is RELOC_TABLE:

See:

If origin is DYLDINFO:

See:

Relocation Object

class lief.MachO.RelocationObject
property address

For OBJECT or (origin is RELOC_TABLE) this is an offset from the start of the Section to the item containing the address requiring relocation.

For EXECUTE / DYLIB or (origin is DYLDINFO) this is an virtual_address

property architecture

CPU_TYPES of the relocation

property has_section

True if the relocation has a Section associated with

property has_segment

True if the relocation has a SegmentCommand associated with

property has_symbol

True if the relocation has a Symbol associated with

property is_scattered

True if the relocation is a scattered one

property origin

RELOCATION_ORIGINS of the relocation

For OBJECT file it should be RELOC_TABLE for EXECUTE / DYLIB it should be DYLDINFO

property pc_relative

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

property section

Section associated with the relocation (if any)

property segment

SegmentCommand associated with the relocation (if any)

property size

Relocation’s size (in bits)

property symbol

Symbol associated with the relocation (if any)

property type

Type of the relocation according to the architecture and/or origin

If origin is RELOC_TABLE:

See:

If origin is DYLDINFO:

See:
property value

For scattered relocations, the address of the relocatable expression for the item in the file that needs to be updated if the address is changed.

For relocatable expressions with the difference of two section addresses, the address from which to subtract (in mathematical terms, the minuend) is contained in the first relocation entry and the address to subtract (the subtrahend) is contained in the second relocation entry.


Relocation Dyld

class lief.MachO.RelocationDyld
property address

For OBJECT or (origin is RELOC_TABLE) this is an offset from the start of the Section to the item containing the address requiring relocation.

For EXECUTE / DYLIB or (origin is DYLDINFO) this is an virtual_address

property architecture

CPU_TYPES of the relocation

property has_section

True if the relocation has a Section associated with

property has_segment

True if the relocation has a SegmentCommand associated with

property has_symbol

True if the relocation has a Symbol associated with

property origin

RELOCATION_ORIGINS of the relocation

For OBJECT file it should be RELOC_TABLE for EXECUTE / DYLIB it should be DYLDINFO

property pc_relative

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

property section

Section associated with the relocation (if any)

property segment

SegmentCommand associated with the relocation (if any)

property size

Relocation’s size (in bits)

property symbol

Symbol associated with the relocation (if any)

property type

Type of the relocation according to the architecture and/or origin

If origin is RELOC_TABLE:

See:

If origin is DYLDINFO:

See:

Binding Info

class lief.MachO.BindingInfo
property addend

Value added to the segment’s virtual address when binding

property address

Binding’s address

property binding_class

BINDING_CLASS of the binding

property binding_type

BIND_TYPES of the binding Most of the times it’s POINTER

property has_library

True if the binding info has a DylibCommand associated with

property has_segment

True if the binding info has a SegmentCommand associated with

property has_symbol

True if the binding info has a Symbol associated with

property library

DylibCommand associated with the binding (if any)

property library_ordinal
property segment

SegmentCommand associated with the binding (if any)

property symbol

Symbol associated with the binding (if any)

property weak_import

Export Info

class lief.MachO.ExportInfo
property address
property alias

Symbol alias if the current symbol is a re-exported one

property alias_library

If the current symbol has an alias, it returns the DylibCommand command associated with

property flags
property flags_list

Return flags as a list of EXPORT_SYMBOL_KINDS

has(self: lief.MachO.ExportInfo, Check if the flag :class:`~lief.MachO.EXPORT_SYMBOL_FLAGS` given in first parameter is presentflag: lief.MachO.EXPORT_SYMBOL_FLAGS) → bool
property has_symbol

True if the export info has a Symbol associated with

property kind

Type of the symbol associated with the export (EXPORT_SYMBOL_KINDS)

property node_offset
property symbol

Symbol associated with the export (if any)


Thread Command

class lief.MachO.ThreadCommand
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property count
property data

Command’s data

property flavor
property pc
property size

Size of the command (should be greather than sizeof(load_command))

property state

RPath Command

class lief.MachO.RPathCommand
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property path

@rpath path

property size

Size of the command (should be greather than sizeof(load_command))


Code Signature

class lief.MachO.CodeSignature
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property data_offset

Offset in the binary where signature starts

property data_size

Size of the raw signature

property size

Size of the command (should be greather than sizeof(load_command))


Data In Code

class lief.MachO.DataInCode
add(self: lief.MachO.DataInCode, entry: LIEF::MachO::DataCodeEntry) → lief.MachO.DataInCode

Add an new DataCodeEntry

property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property data_offset

Offset in the binary where signature starts

property data_size

Size of the raw signature

property entries

Iterator over DataCodeEntry

property size

Size of the command (should be greather than sizeof(load_command))


Data Code Entry

class lief.MachO.DataCodeEntry
class TYPES(self: lief.MachO.DataCodeEntry.TYPES, arg0: int) → None
ABS_JUMP_TABLE_32 = TYPES.ABS_JUMP_TABLE_32
DATA = TYPES.DATA
JUMP_TABLE_16 = TYPES.JUMP_TABLE_16
JUMP_TABLE_32 = TYPES.JUMP_TABLE_32
JUMP_TABLE_8 = TYPES.JUMP_TABLE_8
UNKNOWN = TYPES.UNKNOWN
property length

Length of the data

property offset

Offset of the data

property type

Type of the entry (TYPES


Segment Split Info

class lief.MachO.SegmentSplitInfo
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property data_offset

Offset in the binary where data start

property data_size

Size of the raw data

property size

Size of the command (should be greather than sizeof(load_command))


Sub Framework

class lief.MachO.SubFramework
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property size

Size of the command (should be greather than sizeof(load_command))

property umbrella

Dyld Environment

class lief.MachO.DyldEnvironment
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property size

Size of the command (should be greather than sizeof(load_command))

property value

Environment variable as a string


Encryption Info

class lief.MachO.EncryptionInfo
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property crypt_id

Which enryption system, 0 means not-encrypted yet

property crypt_offset

File offset of encrypted range

property crypt_size

File size of encrypted range

property data

Command’s data

property size

Size of the command (should be greather than sizeof(load_command))


Build Version

class lief.MachO.BuildVersion
class PLATFORMS(self: lief.MachO.BuildVersion.PLATFORMS, arg0: int) → None
IOS = PLATFORMS.IOS
MACOS = PLATFORMS.MACOS
TVOS = PLATFORMS.TVOS
UNKNOWN = PLATFORMS.UNKNOWN
WATCHOS = PLATFORMS.WATCHOS
property command

Command type ( LOAD_COMMAND_TYPES)

property command_offset

Offset of the command within the Load Command Table

property data

Command’s data

property minos

Minimal OS version on which this binary was built to run

property platform

Target PLATFORMS

property sdk

SDK Version

property size

Size of the command (should be greather than sizeof(load_command))

property tools

List of BuildToolVersion used when while this binary


Build Tool Version

class lief.MachO.BuildToolVersion
class TOOLS(self: lief.MachO.BuildToolVersion.TOOLS, arg0: int) → None
CLANG = TOOLS.CLANG
LD = TOOLS.LD
SWIFT = TOOLS.SWIFT
UNKNOWN = TOOLS.UNKNOWN
property tool

TOOLS type

property version

Version of the tool


Enums

CPU_TYPES

class lief.MachO.CPU_TYPES(self: lief.MachO.CPU_TYPES, arg0: int) → None
ANY = CPU_TYPES.ANY
ARM = CPU_TYPES.ARM
ARM64 = CPU_TYPES.ARM64
MC98000 = CPU_TYPES.MC98000
POWERPC = CPU_TYPES.POWERPC
POWERPC64 = CPU_TYPES.POWERPC64
SPARC = CPU_TYPES.SPARC
x86 = CPU_TYPES.x86
x86_64 = CPU_TYPES.x86_64

FILE_TYPES

class lief.MachO.FILE_TYPES(self: lief.MachO.FILE_TYPES, arg0: int) → None
BUNDLE = FILE_TYPES.BUNDLE
CORE = FILE_TYPES.CORE
DSYM = FILE_TYPES.DSYM
DYLIB = FILE_TYPES.DYLIB
DYLIB_STUB = FILE_TYPES.DYLIB_STUB
DYLINKER = FILE_TYPES.DYLINKER
EXECUTE = FILE_TYPES.EXECUTE
FVMLIB = FILE_TYPES.FVMLIB
KEXT_BUNDLE = FILE_TYPES.KEXT_BUNDLE
OBJECT = FILE_TYPES.OBJECT
PRELOAD = FILE_TYPES.PRELOAD

HEADER_FLAGS

class lief.MachO.HEADER_FLAGS(self: lief.MachO.HEADER_FLAGS, arg0: int) → None
ALLMODSBOUND = HEADER_FLAGS.ALLMODSBOUND
ALLOW_STACK_EXECUTION = HEADER_FLAGS.ALLOW_STACK_EXECUTION
APP_EXTENSION_SAFE = HEADER_FLAGS.APP_EXTENSION_SAFE
BINDATLOAD = HEADER_FLAGS.BINDATLOAD
BINDS_TO_WEAK = HEADER_FLAGS.BINDS_TO_WEAK
CANONICAL = HEADER_FLAGS.CANONICAL
DEAD_STRIPPABLE_DYLIB = HEADER_FLAGS.DEAD_STRIPPABLE_DYLIB
FORCE_FLAT = HEADER_FLAGS.FORCE_FLAT
HAS_TLV_DESCRIPTORS = HEADER_FLAGS.HAS_TLV_DESCRIPTORS
LAZY_INIT = HEADER_FLAGS.LAZY_INIT
NOFIXPREBINDING = HEADER_FLAGS.NOFIXPREBINDING
NOMULTIDEFS = HEADER_FLAGS.NOMULTIDEFS
NOUNDEFS = HEADER_FLAGS.NOUNDEFS
NO_HEAP_EXECUTION = HEADER_FLAGS.NO_HEAP_EXECUTION
NO_REEXPORTED_DYLIBS = HEADER_FLAGS.NO_REEXPORTED_DYLIBS
PIE = HEADER_FLAGS.PIE
PREBINDABLE = HEADER_FLAGS.PREBINDABLE
PREBOUND = HEADER_FLAGS.PREBOUND
ROOT_SAFE = HEADER_FLAGS.ROOT_SAFE
SETUID_SAFE = HEADER_FLAGS.SETUID_SAFE
SPLIT_SEGS = HEADER_FLAGS.SPLIT_SEGS
SUBSECTIONS_VIA_SYMBOLS = HEADER_FLAGS.SUBSECTIONS_VIA_SYMBOLS
TWOLEVEL = HEADER_FLAGS.TWOLEVEL
WEAK_DEFINES = HEADER_FLAGS.WEAK_DEFINES

LOAD_COMMAND_TYPES

class lief.MachO.LOAD_COMMAND_TYPES(self: lief.MachO.LOAD_COMMAND_TYPES, arg0: int) → None
BUILD_VERSION = LOAD_COMMAND_TYPES.BUILD_VERSION
CODE_SIGNATURE = LOAD_COMMAND_TYPES.CODE_SIGNATURE
DATA_IN_CODE = LOAD_COMMAND_TYPES.DATA_IN_CODE
DYLD_ENVIRONMENT = LOAD_COMMAND_TYPES.DYLD_ENVIRONMENT
DYLD_INFO = LOAD_COMMAND_TYPES.DYLD_INFO
DYLD_INFO_ONLY = LOAD_COMMAND_TYPES.DYLD_INFO_ONLY
DYLIB_CODE_SIGN_DRS = LOAD_COMMAND_TYPES.DYLIB_CODE_SIGN_DRS
DYSYMTAB = LOAD_COMMAND_TYPES.DYSYMTAB
ENCRYPTION_INFO = LOAD_COMMAND_TYPES.ENCRYPTION_INFO
ENCRYPTION_INFO_64 = LOAD_COMMAND_TYPES.ENCRYPTION_INFO_64
FUNCTION_STARTS = LOAD_COMMAND_TYPES.FUNCTION_STARTS
FVMFILE = LOAD_COMMAND_TYPES.FVMFILE
IDENT = LOAD_COMMAND_TYPES.IDENT
IDFVMLIB = LOAD_COMMAND_TYPES.IDFVMLIB
ID_DYLIB = LOAD_COMMAND_TYPES.ID_DYLIB
ID_DYLINKER = LOAD_COMMAND_TYPES.ID_DYLINKER
LAZY_LOAD_DYLIB = LOAD_COMMAND_TYPES.LAZY_LOAD_DYLIB
LINKER_OPTIMIZATION_HINT = LOAD_COMMAND_TYPES.LINKER_OPTIMIZATION_HINT
LINKER_OPTION = LOAD_COMMAND_TYPES.LINKER_OPTION
LOADFVMLIB = LOAD_COMMAND_TYPES.LOADFVMLIB
LOAD_DYLIB = LOAD_COMMAND_TYPES.LOAD_DYLIB
LOAD_DYLINKER = LOAD_COMMAND_TYPES.LOAD_DYLINKER
LOAD_UPWARD_DYLIB = LOAD_COMMAND_TYPES.LOAD_UPWARD_DYLIB
LOAD_WEAK_DYLIB = LOAD_COMMAND_TYPES.LOAD_WEAK_DYLIB
MAIN = LOAD_COMMAND_TYPES.MAIN
NOTE = LOAD_COMMAND_TYPES.NOTE
PREBIND_CKSUM = LOAD_COMMAND_TYPES.PREBIND_CKSUM
PREBOUND_DYLIB = LOAD_COMMAND_TYPES.PREBOUND_DYLIB
PREPAGE = LOAD_COMMAND_TYPES.PREPAGE
REEXPORT_DYLIB = LOAD_COMMAND_TYPES.REEXPORT_DYLIB
ROUTINES = LOAD_COMMAND_TYPES.ROUTINES
ROUTINES_64 = LOAD_COMMAND_TYPES.ROUTINES_64
RPATH = LOAD_COMMAND_TYPES.RPATH
SEGMENT = LOAD_COMMAND_TYPES.SEGMENT
SEGMENT_64 = LOAD_COMMAND_TYPES.SEGMENT_64
SEGMENT_SPLIT_INFO = LOAD_COMMAND_TYPES.SEGMENT_SPLIT_INFO
SOURCE_VERSION = LOAD_COMMAND_TYPES.SOURCE_VERSION
SUB_CLIENT = LOAD_COMMAND_TYPES.SUB_CLIENT
SUB_FRAMEWORK = LOAD_COMMAND_TYPES.SUB_FRAMEWORK
SUB_LIBRARY = LOAD_COMMAND_TYPES.SUB_LIBRARY
SUB_UMBRELLA = LOAD_COMMAND_TYPES.SUB_UMBRELLA
SYMSEG = LOAD_COMMAND_TYPES.SYMSEG
SYMTAB = LOAD_COMMAND_TYPES.SYMTAB
THREAD = LOAD_COMMAND_TYPES.THREAD
TWOLEVEL_HINTS = LOAD_COMMAND_TYPES.TWOLEVEL_HINTS
UNIXTHREAD = LOAD_COMMAND_TYPES.UNIXTHREAD
UUID = LOAD_COMMAND_TYPES.UUID
VERSION_MIN_IPHONEOS = LOAD_COMMAND_TYPES.VERSION_MIN_IPHONEOS
VERSION_MIN_MACOSX = LOAD_COMMAND_TYPES.VERSION_MIN_MACOSX
VERSION_MIN_TVOS = LOAD_COMMAND_TYPES.VERSION_MIN_TVOS
VERSION_MIN_WATCHOS = LOAD_COMMAND_TYPES.VERSION_MIN_WATCHOS

SECTION_TYPES

class lief.MachO.SECTION_TYPES(self: lief.MachO.SECTION_TYPES, arg0: int) → None
COALESCED = SECTION_TYPES.COALESCED
CSTRING_LITERALS = SECTION_TYPES.CSTRING_LITERALS
DTRACE_DOF = SECTION_TYPES.DTRACE_DOF
GB_ZEROFILL = SECTION_TYPES.GB_ZEROFILL
INTERPOSING = SECTION_TYPES.INTERPOSING
LAZY_DYLIB_SYMBOL_POINTERS = SECTION_TYPES.LAZY_DYLIB_SYMBOL_POINTERS
LAZY_SYMBOL_POINTERS = SECTION_TYPES.LAZY_SYMBOL_POINTERS
LITERAL_POINTERS = SECTION_TYPES.LITERAL_POINTERS
MOD_INIT_FUNC_POINTERS = SECTION_TYPES.MOD_INIT_FUNC_POINTERS
MOD_TERM_FUNC_POINTERS = SECTION_TYPES.MOD_TERM_FUNC_POINTERS
NON_LAZY_SYMBOL_POINTERS = SECTION_TYPES.NON_LAZY_SYMBOL_POINTERS
REGULAR = SECTION_TYPES.REGULAR
SYMBOL_STUBS = SECTION_TYPES.SYMBOL_STUBS
S_16BYTE_LITERALS = SECTION_TYPES.S_16BYTE_LITERALS
S_4BYTE_LITERALS = SECTION_TYPES.S_4BYTE_LITERALS
S_8BYTE_LITERALS = SECTION_TYPES.S_8BYTE_LITERALS
THREAD_LOCAL_INIT_FUNCTION_POINTERS = SECTION_TYPES.THREAD_LOCAL_INIT_FUNCTION_POINTERS
THREAD_LOCAL_REGULAR = SECTION_TYPES.THREAD_LOCAL_REGULAR
THREAD_LOCAL_VARIABLES = SECTION_TYPES.THREAD_LOCAL_VARIABLES
THREAD_LOCAL_VARIABLE_POINTERS = SECTION_TYPES.THREAD_LOCAL_VARIABLE_POINTERS
THREAD_LOCAL_ZEROFILL = SECTION_TYPES.THREAD_LOCAL_ZEROFILL
ZEROFILL = SECTION_TYPES.ZEROFILL

MACHO_TYPES

class lief.MachO.MACHO_TYPES(self: lief.MachO.MACHO_TYPES, arg0: int) → None
CIGAM = MACHO_TYPES.CIGAM
CIGAM_64 = MACHO_TYPES.CIGAM_64
FAT_CIGAM = MACHO_TYPES.FAT_CIGAM
FAT_MAGIC = MACHO_TYPES.FAT_MAGIC
MAGIC = MACHO_TYPES.MAGIC
MAGIC_64 = MACHO_TYPES.MAGIC_64

X86_RELOCATION

class lief.MachO.X86_RELOCATION(self: lief.MachO.X86_RELOCATION, arg0: int) → None
LOCAL_SECTDIFF = X86_RELOCATION.LOCAL_SECTDIFF
PAIR = X86_RELOCATION.PAIR
PB_LA_PTR = X86_RELOCATION.PB_LA_PTR
SECTDIFF = X86_RELOCATION.SECTDIFF
TLV = X86_RELOCATION.TLV
VANILLA = X86_RELOCATION.VANILLA

X86_64_RELOCATION

class lief.MachO.X86_64_RELOCATION(self: lief.MachO.X86_64_RELOCATION, arg0: int) → None
BRANCH = X86_64_RELOCATION.BRANCH
GOT = X86_64_RELOCATION.GOT
GOT_LOAD = X86_64_RELOCATION.GOT_LOAD
SIGNED = X86_64_RELOCATION.SIGNED
SIGNED_1 = X86_64_RELOCATION.SIGNED_1
SIGNED_2 = X86_64_RELOCATION.SIGNED_2
SIGNED_4 = X86_64_RELOCATION.SIGNED_4
SUBTRACTOR = X86_64_RELOCATION.SUBTRACTOR
TLV = X86_64_RELOCATION.TLV
UNSIGNED = X86_64_RELOCATION.UNSIGNED

PPC_RELOCATION

class lief.MachO.PPC_RELOCATION(self: lief.MachO.PPC_RELOCATION, arg0: int) → None
BR14 = PPC_RELOCATION.BR14
BR24 = PPC_RELOCATION.BR24
HA16 = PPC_RELOCATION.HA16
HA16_SECTDIFF = PPC_RELOCATION.HA16_SECTDIFF
HI16 = PPC_RELOCATION.HI16
HI16_SECTDIFF = PPC_RELOCATION.HI16_SECTDIFF
JBSR = PPC_RELOCATION.JBSR
LO14 = PPC_RELOCATION.LO14
LO14_SECTDIFF = PPC_RELOCATION.LO14_SECTDIFF
LO16 = PPC_RELOCATION.LO16
LO16_SECTDIFF = PPC_RELOCATION.LO16_SECTDIFF
LOCAL_SECTDIFF = PPC_RELOCATION.LOCAL_SECTDIFF
PAIR = PPC_RELOCATION.PAIR
PB_LA_PTR = PPC_RELOCATION.PB_LA_PTR
SECTDIFF = PPC_RELOCATION.SECTDIFF
VANILLA = PPC_RELOCATION.VANILLA

ARM_RELOCATION

class lief.MachO.ARM_RELOCATION(self: lief.MachO.ARM_RELOCATION, arg0: int) → None
32BIT_BRANCH = ARM_RELOCATION.32BIT_BRANCH
BR24 = ARM_RELOCATION.BR24
HALF = ARM_RELOCATION.HALF
HALF_SECTDIFF = ARM_RELOCATION.HALF_SECTDIFF
LOCAL_SECTDIFF = ARM_RELOCATION.LOCAL_SECTDIFF
PAIR = ARM_RELOCATION.PAIR
PB_LA_PTR = ARM_RELOCATION.PB_LA_PTR
RELOC_BR22 = ARM_RELOCATION.RELOC_BR22
SECTDIFF = ARM_RELOCATION.SECTDIFF
VANILLA = ARM_RELOCATION.VANILLA

ARM64_RELOCATION

class lief.MachO.ARM64_RELOCATION(self: lief.MachO.ARM64_RELOCATION, arg0: int) → None
ADDEND = ARM64_RELOCATION.ADDEND
BRANCH26 = ARM64_RELOCATION.BRANCH26
GOT_LOAD_PAGE21 = ARM64_RELOCATION.GOT_LOAD_PAGE21
GOT_LOAD_PAGEOFF12 = ARM64_RELOCATION.GOT_LOAD_PAGEOFF12
PAGE21 = ARM64_RELOCATION.PAGE21
PAGEOFF12 = ARM64_RELOCATION.PAGEOFF12
POINTER_TO_GOT = ARM64_RELOCATION.POINTER_TO_GOT
SUBTRACTOR = ARM64_RELOCATION.SUBTRACTOR
TLVP_LOAD_PAGE21 = ARM64_RELOCATION.TLVP_LOAD_PAGE21
TLVP_LOAD_PAGEOFF12 = ARM64_RELOCATION.TLVP_LOAD_PAGEOFF12
UNSIGNED = ARM64_RELOCATION.UNSIGNED

RELOCATION_ORIGINS

class lief.MachO.RELOCATION_ORIGINS(self: lief.MachO.RELOCATION_ORIGINS, arg0: int) → None
DYLDINFO = RELOCATION_ORIGINS.DYLDINFO
RELOC_TABLE = RELOCATION_ORIGINS.RELOC_TABLE
UNKNOWN = RELOCATION_ORIGINS.UNKNOWN

REBASE_TYPES

class lief.MachO.REBASE_TYPES(self: lief.MachO.REBASE_TYPES, arg0: int) → None
POINTER = REBASE_TYPES.POINTER
TEXT_ABSOLUTE32 = REBASE_TYPES.TEXT_ABSOLUTE32
TEXT_PCREL32 = REBASE_TYPES.TEXT_PCREL32

BINDING_CLASS

class lief.MachO.BINDING_CLASS(self: lief.MachO.BINDING_CLASS, arg0: int) → None
LAZY = BINDING_CLASS.LAZY
STANDARD = BINDING_CLASS.STANDARD
WEAK = BINDING_CLASS.WEAK

REBASE_OPCODES

class lief.MachO.REBASE_OPCODES(self: lief.MachO.REBASE_OPCODES, arg0: int) → None
ADD_ADDR_IMM_SCALED = REBASE_OPCODES.ADD_ADDR_IMM_SCALED
ADD_ADDR_ULEB = REBASE_OPCODES.ADD_ADDR_ULEB
DONE = REBASE_OPCODES.DONE
DO_REBASE_ADD_ADDR_ULEB = REBASE_OPCODES.DO_REBASE_ADD_ADDR_ULEB
DO_REBASE_IMM_TIMES = REBASE_OPCODES.DO_REBASE_IMM_TIMES
DO_REBASE_ULEB_TIMES = REBASE_OPCODES.DO_REBASE_ULEB_TIMES
DO_REBASE_ULEB_TIMES_SKIPPING_ULEB = REBASE_OPCODES.DO_REBASE_ULEB_TIMES_SKIPPING_ULEB
SET_SEGMENT_AND_OFFSET_ULEB = REBASE_OPCODES.SET_SEGMENT_AND_OFFSET_ULEB
SET_TYPE_IMM = REBASE_OPCODES.SET_TYPE_IMM

BIND_TYPES

class lief.MachO.BIND_TYPES(self: lief.MachO.BIND_TYPES, arg0: int) → None
POINTER = BIND_TYPES.POINTER
TEXT_ABSOLUTE32 = BIND_TYPES.TEXT_ABSOLUTE32
TEXT_PCREL32 = BIND_TYPES.TEXT_PCREL32

BIND_SPECIAL_DYLIB

class lief.MachO.BIND_SPECIAL_DYLIB(self: lief.MachO.BIND_SPECIAL_DYLIB, arg0: int) → None
FLAT_LOOKUP = BIND_SPECIAL_DYLIB.FLAT_LOOKUP
MAIN_EXECUTABLE = BIND_SPECIAL_DYLIB.MAIN_EXECUTABLE
SELF = BIND_SPECIAL_DYLIB.SELF

BIND_OPCODES

class lief.MachO.BIND_OPCODES(self: lief.MachO.BIND_OPCODES, arg0: int) → None
ADD_ADDR_ULEB = BIND_OPCODES.ADD_ADDR_ULEB
DONE = BIND_OPCODES.DONE
DO_BIND = BIND_OPCODES.DO_BIND
DO_BIND_ADD_ADDR_IMM_SCALED = BIND_OPCODES.DO_BIND_ADD_ADDR_IMM_SCALED
DO_BIND_ADD_ADDR_ULEB = BIND_OPCODES.DO_BIND_ADD_ADDR_ULEB
DO_BIND_ULEB_TIMES_SKIPPING_ULEB = BIND_OPCODES.DO_BIND_ULEB_TIMES_SKIPPING_ULEB
SET_ADDEND_SLEB = BIND_OPCODES.SET_ADDEND_SLEB
SET_DYLIB_ORDINAL_IMM = BIND_OPCODES.SET_DYLIB_ORDINAL_IMM
SET_DYLIB_ORDINAL_ULEB = BIND_OPCODES.SET_DYLIB_ORDINAL_ULEB
SET_DYLIB_SPECIAL_IMM = BIND_OPCODES.SET_DYLIB_SPECIAL_IMM
SET_SEGMENT_AND_OFFSET_ULEB = BIND_OPCODES.SET_SEGMENT_AND_OFFSET_ULEB
SET_SYMBOL_TRAILING_FLAGS_IMM = BIND_OPCODES.SET_SYMBOL_TRAILING_FLAGS_IMM
SET_TYPE_IMM = BIND_OPCODES.SET_TYPE_IMM

EXPORT_SYMBOL_KINDS

class lief.MachO.EXPORT_SYMBOL_KINDS(self: lief.MachO.EXPORT_SYMBOL_KINDS, arg0: int) → None
ABSOLUTE = EXPORT_SYMBOL_KINDS.ABSOLUTE
REGULAR = EXPORT_SYMBOL_KINDS.REGULAR
THREAD_LOCAL = EXPORT_SYMBOL_KINDS.THREAD_LOCAL

EXPORT_SYMBOL_FLAGS

class lief.MachO.EXPORT_SYMBOL_FLAGS(self: lief.MachO.EXPORT_SYMBOL_FLAGS, arg0: int) → None
REEXPORT = EXPORT_SYMBOL_FLAGS.REEXPORT
STUB_AND_RESOLVER = EXPORT_SYMBOL_FLAGS.STUB_AND_RESOLVER
WEAK_DEFINITION = EXPORT_SYMBOL_FLAGS.WEAK_DEFINITION

VM_PROTECTIONS

class lief.MachO.VM_PROTECTIONS(self: lief.MachO.VM_PROTECTIONS, arg0: int) → None
EXECUTE = VM_PROTECTIONS.EXECUTE
READ = VM_PROTECTIONS.READ
WRITE = VM_PROTECTIONS.WRITE

SYMBOL_ORIGINS

class lief.MachO.SYMBOL_ORIGINS(self: lief.MachO.SYMBOL_ORIGINS, arg0: int) → None
DYLD_EXPORT = SYMBOL_ORIGINS.DYLD_EXPORT
LC_SYMTAB = SYMBOL_ORIGINS.LC_SYMTAB
UNKNOWN = SYMBOL_ORIGINS.UNKNOWN

SECTION_FLAGS

class lief.MachO.SECTION_FLAGS(self: lief.MachO.SECTION_FLAGS, arg0: int) → None
DEBUG = SECTION_FLAGS.DEBUG
EXT_RELOC = SECTION_FLAGS.EXT_RELOC
LIVE_SUPPORT = SECTION_FLAGS.LIVE_SUPPORT
LOC_RELOC = SECTION_FLAGS.LOC_RELOC
NO_DEAD_STRIP = SECTION_FLAGS.NO_DEAD_STRIP
NO_TOC = SECTION_FLAGS.NO_TOC
PURE_INSTRUCTIONS = SECTION_FLAGS.PURE_INSTRUCTIONS
SELF_MODIFYING_CODE = SECTION_FLAGS.SELF_MODIFYING_CODE
SOME_INSTRUCTIONS = SECTION_FLAGS.SOME_INSTRUCTIONS
STRIP_STATIC_SYMS = SECTION_FLAGS.STRIP_STATIC_SYMS