PE

Parser

lief.PE.parse(*args, **kwargs)

Overloaded function.

  1. parse(filename: str) -> LIEF::PE::Binary

Parse the given binary and return a Binary object

  1. parse(raw: List[int], name: str = ‘’) -> LIEF::PE::Binary

Parse the given binary and return a Binary object

  1. parse(io: object, name: str = ‘’) -> LIEF::PE::Binary

Binary

class lief.PE.Binary(self: lief.PE.Binary, arg0: str, arg1: lief.PE.PE_TYPE) → None
class VA_TYPES(self: lief.Binary.VA_TYPES, value: int) → None

Members:

AUTO

VA

RVA

AUTO = <VA_TYPES.AUTO: 0>
RVA = <VA_TYPES.RVA: 1>
VA = <VA_TYPES.VA: 2>
property name
property abstract

Return the Binary object

Warning

Getting this property modifies the __class__ attribute so that the current binary looks like a Binary.

Use the concrete to get back to the original binary.

add_import_function(self: lief.PE.Binary, import_name: str, function_name: str)lief.PE.ImportEntry

Add a function to the given Import name

add_library(self: lief.PE.Binary, import_name: str)lief.PE.Import

Add an Import by name

add_relocation(self: lief.PE.Binary, relocation: lief.PE.Relocation)lief.PE.Relocation

Add a Relocation to the binary

add_section(self: lief.PE.Binary, section: lief.PE.Section, type: lief.PE.SECTION_TYPES = <SECTION_TYPES.UNKNOWN: 10>)lief.PE.Section

Add a Section to the binary.

authentihash(self: lief.PE.Binary, algorithm: lief.PE.ALGORITHMS) → bytes

Compute the authentihash according to the ALGORITHMS given in the first parameter

property authentihash_md5

Authentihash MD5 value

property authentihash_sha1

Authentihash SHA1 value

property authentihash_sha256

Authentihash SHA-256 value

property authentihash_sha512

Authentihash SHA-512 value

property concrete

Return either lief.ELF.Binary, lief.PE.Binary, lief.MachO.Binary object

property ctor_functions

Constructor functions that are called prior any other functions

property data_directories

Return an iterator on the DataDirectory

data_directory(self: lief.PE.Binary, type: lief.PE.DATA_DIRECTORY)lief.PE.DataDirectory

Return the DataDirectory object from the given DATA_DIRECTORY type

property debug

Return the Debug

property dos_header

Return DosHeader

property dos_stub

DOS stub content as a list of bytes

property entrypoint

Binary’s entrypoint

property exception_functions

Function found in the Exception directory

property exported_functions

Return binary’s exported Function

property format

File format EXE_FORMATS of the underlying binary.

property functions

All Function found in the binary

get_content_from_virtual_address(self: lief.Binary, virtual_address: int, size: int, va_type: lief.Binary.VA_TYPES = <VA_TYPES.AUTO: 0>) → List[int]

Return the content located at virtual address.

Virtual address is specified in the first argument and size to read (in bytes) in the second. If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default it is set to AUTO

get_export(self: lief.PE.Binary)lief.PE.Export

Return a Export object

get_function_address(self: lief.Binary, function_name: str) → int

Return the address of the given function name

get_import(self: lief.PE.Binary, import_name: str)lief.PE.Import

Returns the Import from the given name

get_section(self: lief.PE.Binary, section_name: str)lief.PE.Section

Return the Section object from the given name

get_symbol(self: lief.Binary, symbol_name: str) → LIEF::Symbol

Return the Symbol with the given name

property has_configuration

True if the current binary has LoadConfiguration

property has_debug

True if the current binary has a Debug object

property has_exceptions

True if the current binary has Exceptions

property has_exports

True if the current binary has a Export object

has_import(self: lief.PE.Binary, import_name: str) → bool

True if the binary import the given library name

property has_imports

True if the current binary import libraries (Import)

property has_nx

Check if the binary uses NX protection

property has_relocations

True if the current binary use Relocation

property has_resources

True if the current binary has a Resources object

property has_rich_header

True if the current binary has a RichHeader object

property has_signatures

True if the binary has signatures (Signature)

has_symbol(self: lief.Binary, symbol_name: str) → bool

Check if a Symbol with the given name exists

property has_tls

True if the current binary has a TLS object

property header

Return Header

hook_function(*args, **kwargs)

Overloaded function.

  1. hook_function(self: lief.PE.Binary, function_name: str, hook_address: int) -> None

Hook the given function name

Note

When using this function, the Builder should be configured as follow:

builder.build_imports(True).patch_imports(True)
  1. hook_function(self: lief.PE.Binary, library_name: str, function_name: str, hook_address: int) -> None

Hook the function name from the given library name

property imagebase

Default image base (i.e. if the ASLR is not enabled)

property imported_functions

Return binary’s imported Function (name)

property imports

Return an iterator on the Import libraries

property is_pie

Check if the binary is position independent

property is_reproducible_build

True if the binary was compiled with a reproducible build directive (Debug)

property libraries

Return binary’s imported libraries (name)

property load_configuration

Return the LoadConfiguration object

property name

Binary’s name

offset_to_virtual_address(self: lief.Binary, offset: int, slide: int = 0) → int

Convert an offset into a virtual address.

property optional_header

Return OptionalHeader

property overlay

Return the overlay content as a list of bytes

patch_address(*args, **kwargs)

Overloaded function.

  1. patch_address(self: lief.Binary, address: int, patch_value: List[int], va_type: lief.Binary.VA_TYPES = <VA_TYPES.AUTO: 0>) -> None

Virtual address is specified in the first argument and the content in the second (as a list of bytes). If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default it is set to AUTO

  1. patch_address(self: lief.Binary, address: int, patch_value: int, size: int = 8, va_type: lief.Binary.VA_TYPES = <VA_TYPES.AUTO: 0>) -> None

Virtual address is specified in the first argument, integer in the second and sizeof the integer in third one. If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default it is set to AUTO

predict_function_rva(self: lief.PE.Binary, library: str, function: str) → int

Try to predict the RVA of the given function name in the given import library name

property relocations

Return an iterator on the Relocation

remove(self: lief.PE.Binary, section: lief.PE.Section, clear: bool = False) → None

Remove the Section given in first parameter

remove_all_libraries(self: lief.PE.Binary) → None

Remove all imported libraries

remove_all_relocations(self: lief.PE.Binary) → None
remove_library(self: lief.PE.Binary, import_name: str) → None

Remove the Import from the given name

remove_section(self: lief.Binary, name: str, clear: bool = False) → None

Remove the section with the given name

property resources

Return the ResourceNode tree

property resources_manager

Return the ResourcesManager to manage resources

property rich_header

RichHeader object (if present)

rva_to_offset(self: lief.PE.Binary, rva_address: int) → int

Convert a relative virtual address to an offset

section_from_offset(self: lief.PE.Binary, offset: int)lief.PE.Section

Return the Section which contains the offset

section_from_rva(self: lief.PE.Binary, rva: int)lief.PE.Section

Return the Section which contains the relative virtual address

property sections

Return binary’s Section sections

property signatures

Return an iterator over the Signature objects

property sizeof_headers

Size of all PE headers

property symbols

Return binary’s Symbol

property tls

TLS object (if present)

va_to_offset(self: lief.PE.Binary, va_address: int) → int

Convert a absolute virtual address to an offset

verify_signature(*args, **kwargs)

Overloaded function.

  1. verify_signature(self: lief.PE.Binary, checks: lief.PE.Signature.VERIFICATION_CHECKS = <VERIFICATION_CHECKS.DEFAULT: 1>) -> lief.PE.Signature.VERIFICATION_FLAGS

    Verify the binary against the embedded signature(s) (if any) Firstly, it checks that the embedded signatures are correct (c.f. lief.PE.Signature.check()) and then it checks that the authentihash matches lief.PE.ContentInfo.digest

    One can tweak the verification process with the lief.PE.Signature.VERIFICATION_CHECKS flags

  2. verify_signature(self: lief.PE.Binary, signature: lief.PE.Signature, checks: lief.PE.Signature.VERIFICATION_CHECKS = <VERIFICATION_CHECKS.DEFAULT: 1>) -> lief.PE.Signature.VERIFICATION_FLAGS

    Verify the binary with the Signature object provided in the first parameter It can be used to verify a detached signature:

    detached = lief.PE.Signature.parse("sig.pkcs7")
    binary.verify_signature(detached)
    
property virtual_size

Binary size when mapped in memory.

This value should matches sizeof_image

write(self: lief.PE.Binary, output_path: str) → None

Build the binary and write the result to the given output

xref(self: lief.Binary, virtual_address: int) → List[int]

Return all virtual addresses that use the address given in parameter


Dos Header

class lief.PE.DosHeader(self: lief.PE.DosHeader) → None
property addressof_new_exeheader
property addressof_relocation_table
property checksum
property file_size_in_pages
property header_size_in_paragraphs
property initial_ip
property initial_relative_cs
property initial_relative_ss
property initial_sp
property magic
property maximum_extra_paragraphs
property minimum_extra_paragraphs
property numberof_relocation
property oem_id
property oem_info
property overlay_number
property used_bytes_in_the_last_page

class lief.PE.Header(self: lief.PE.Header) → None
add_characteristic(self: lief.PE.Header, characteristic: lief.PE.HEADER_CHARACTERISTICS) → None

Add the given HEADER_CHARACTERISTICS to the header

property characteristics

The HEADER_CHARACTERISTICS that indicate the attributes of the file.

property characteristics_list

Return the HEADER_CHARACTERISTICS as a list

has_characteristic(self: lief.PE.Header, characteristic: lief.PE.HEADER_CHARACTERISTICS) → bool

True if the header has the given HEADER_CHARACTERISTICS

property machine

Target MACHINE_TYPES

property numberof_sections

Number of sections in the binary

property numberof_symbols

The number of entries in the symbol table. This data can be used to locate the string table, which immediately follows the symbol table. This value should be zero for an image because COFF debugging information is deprecated.

property pointerto_symbol_table

The file offset of the COFF symbol table, or zero if no COFF symbol table is present.

This value should be zero for an image because COFF debugging information is deprecated.

remove_characteristic(self: lief.PE.Header, characteristic: lief.PE.HEADER_CHARACTERISTICS) → None

Remove the given HEADER_CHARACTERISTICS from the header

property signature

PE signature. Should be [80, 69, 0, 0] (PE\0\0)

property sizeof_optional_header

The size of the optional header, which is required for executable files

property time_date_stamps

The low 32 bits of the number of seconds since 00:00 January 1, 1970 that indicates when the file was created.


Optional Header

class lief.PE.OptionalHeader(self: lief.PE.OptionalHeader) → None
add(self: lief.PE.OptionalHeader, characteristic: lief.PE.DLL_CHARACTERISTICS) → None

Add the given DLL_CHARACTERISTICS

property addressof_entrypoint

The address of the entry point relative to the image base when the executable file is loaded into memory. For program images, this is the starting address. For device drivers, this is the address of the initialization function. An entry point is optional for DLLs. When no entry point is present, this field must be zero.

property baseof_code

The address that is relative to the image base of the beginning-of-code section when it is loaded into memory.

property baseof_data

The address that is relative to the image base of the beginning-of-data section when it is loaded into memory.

Warning

This value is not present for PE64

property checksum

The image file checksum. The algorithm for computing the checksum is incorporated into IMAGHELP.DLL. The following are checked for validation at load time: all drivers, any DLL loaded at boot time, and any DLL that is loaded into a critical Windows process.

property dll_characteristics

The DLL_CHARACTERISTICS characteristics

property dll_characteristics_lists

DLL_CHARACTERISTICS as a list

property file_alignment

The alignment factor (in bytes) that is used to align the raw data of sections in the image file. The value should be a power of 2 between 512 and 64 K, inclusive. The default is 512. If the section_alignment is less than the architecture’s page size, then file_alignment must match section_alignment.

has(self: lief.PE.OptionalHeader, characteristics: lief.PE.DLL_CHARACTERISTICS) → bool

True if the given DLL_CHARACTERISTICS is in the dll_characteristics

property imagebase

The preferred address of the first byte of image when loaded into memory. It must be a multiple of 64K. The default for DLLs is 0x10000000. The default for Windows CE EXEs is 0x00010000. The default for Windows NT, Windows 2000, Windows XP, Windows 95, Windows 98, and Windows Me is 0x00400000.

property loader_flags

Reserved, must be zero.

property magic

Magic value (PE_TYPE) that identify a PE32 from a PE64

property major_image_version

The major version number of the image.

property major_linker_version

The linker major version number

property major_operating_system_version

The major version number of the required operating system.

property major_subsystem_version

The major version number of the subsystem.

property minor_image_version

The minor version number of the image.

property minor_linker_version

The linker minor version number

property minor_operating_system_version

The minor version number of the required operating system.

property minor_subsystem_version

The minor version number of the subsystem

property numberof_rva_and_size

The number of DataDirectory entries in the remainder of the optional header. Each describes a location and size.

remove(self: lief.PE.OptionalHeader, characteristic: lief.PE.DLL_CHARACTERISTICS) → None

Remove the given DLL_CHARACTERISTICS

property section_alignment

The alignment (in bytes) of sections when they are loaded into memory. It must be greater than or equal to file_alignment. The default is the page size for the architecture.

property sizeof_code

The size of the code (text) section, or the sum of all code sections if there are multiple sections.

property sizeof_headers

The combined size of an MS-DOS stub, PE header, and section headers rounded up to a multiple of file_alignment.

property sizeof_heap_commit

The size of the local heap space to commit.

property sizeof_heap_reserve

The size of the local heap space to reserve. Only sizeof_heap_commit is committed; the rest is made available one page at a time until the reserve size is reached.

property sizeof_image

The size (in bytes) of the image, including all headers, as the image is loaded in memory. It must be a multiple of section_alignment and should match virtual_size.

property sizeof_initialized_data

The size of the initialized data section, or the sum of all such sections if there are multiple data sections.

property sizeof_stack_commit

The size of the stack to commit.

property sizeof_stack_reserve

The size of the stack to reserve. Only sizeof_stack_commit is committed; the rest is made available one page at a time until the reserve size is reached.

property sizeof_uninitialized_data

The size of the uninitialized data section (.bss), or the sum of all such sections if there are multiple .bss sections.

property subsystem

The SUBSYSTEM that is required to run this image. For more information, see “Windows Subsystem” later in this specification.

property win32_version_value

Reserved, must be zero.


Data Directory

class lief.PE.DataDirectory(self: lief.PE.DataDirectory) → None
property has_section

True if the current data directory is tied to a Section

property rva

Relative virtual address of the content associated with the current data directory

property section

Section associated with the current data directory

property size

Size in bytes of the content associated with the current data directory

property type

Type (DATA_DIRECTORY) of the current data directory


Section

class lief.PE.Section(*args, **kwargs)

Overloaded function.

  1. __init__(self: lief.PE.Section) -> None

  2. __init__(self: lief.PE.Section, content: List[int], name: str = ‘’, characteristics: int = 0) -> None

Constructor from content, name and characteristics

  1. __init__(self: lief.PE.Section, name: str) -> None

Constructor from name

property characteristics

The SECTION_CHARACTERISTICS that describe the characteristics of the section

property characteristics_lists

characteristics as a list

property content

Section’s content

property entropy

Section’s entropy

property fullname

Return the fullname of the section including the trailing bytes

has_characteristic(self: lief.PE.Section, characteristic: lief.PE.SECTION_CHARACTERISTICS) → bool

True if the a section has the given SECTION_CHARACTERISTICS

property name

Section’s name

property numberof_line_numbers

The number of line-number entries for the section. This value should be zero for an image because COFF debugging information is deprecated.

property numberof_relocations

The number of relocation entries for the section. This is set to zero for executable images.

property offset

Section’s offset

property padding

Section padding content as bytes

property pointerto_line_numbers

The file pointer to the beginning of line-number entries for the section. This is set to zero if there are no COFF line numbers. This value should be zero for an image because COFF debugging information is deprecated.

property pointerto_raw_data

Alias of offset

property pointerto_relocation

The file pointer to the beginning of relocation entries for the section. This is set to zero for executable images or if there are no relocations.

search(*args, **kwargs)

Overloaded function.

  1. search(self: lief.Section, number: int, pos: int = 0, size: int = 0) -> int

Look for integer within the current section

  1. search(self: lief.Section, str: str, pos: int = 0) -> int

Look for string within the current section

search_all(*args, **kwargs)

Overloaded function.

  1. search_all(self: lief.Section, number: int, size: int = 0) -> List[int]

Look for all integers within the current section

  1. search_all(self: lief.Section, str: str) -> List[int]

Look for all strings within the current section

property size

Section’s size

property sizeof_raw_data

Alias of size

property virtual_address

Section’s virtual address

property virtual_size

The total size of the section when loaded into memory. If this value is greater than sizeof_raw_data, the section is zero-padded.


Import

class lief.PE.Import(*args, **kwargs)

Overloaded function.

  1. __init__(self: lief.PE.Import) -> None

Default constructor with a library name

  1. __init__(self: lief.PE.Import, library_name: str) -> None

Constructor with a library name

add_entry(*args, **kwargs)

Overloaded function.

  1. add_entry(self: lief.PE.Import, entry: LIEF::PE::ImportEntry) -> LIEF::PE::ImportEntry

Add an ImportEntry (function) to the current import

  1. add_entry(self: lief.PE.Import, function_name: str) -> LIEF::PE::ImportEntry

Add an ImportEntry (function) to the current import

property directory

DataDirectory associated with the import table

property entries

Iterator to the imported ImportEntry (functions)

get_entry(self: lief.PE.Import, function_name: str) → LIEF::PE::ImportEntry

Return ImportEntry with the given name

get_function_rva_from_iat(self: lief.PE.Import, Return the relative virtual address of the given function within the *Import Address Table*function_name: str) → int
property iat_directory

DataDirectory associated with the IAT table

property import_address_table_rva

The RVA of the import address table. The contents of this table are identical to the contents of the import lookup table until the image is bound.

property import_lookup_table_rva

The RVA of the import lookup table. This table contains a name or ordinal for each import.

property name

Library name (e.g. kernel32.dll)


Import Entry

class lief.PE.ImportEntry(*args, **kwargs)

Overloaded function.

  1. __init__(self: lief.PE.ImportEntry) -> None

  2. __init__(self: lief.PE.ImportEntry, import_name: str) -> None

Constructor by name

  1. __init__(self: lief.PE.ImportEntry, data: int, name: str = ‘’) -> None

Constructor by data and optionally name

property data

Raw value

property hint

Index into the entries

property iat_address

Original address of the entry in the Import Address Table

property iat_value

Value of the current entry in the Import Address Table

property is_ordinal

True if ordinal is used

property name

Import name if not ordinal

property ordinal

Ordinal value (if any). See: is_ordinal

property size

Symbol’s size

property value

Symbol’s value


TLS

class lief.PE.TLS(self: lief.PE.TLS) → None

Default constructor

property addressof_callbacks

The pointer to an array of TLS callback functions. The array is null-terminated, so if no callback function is supported, this field points to 4 bytes set to zero

property addressof_index

The location to receive the TLS index, which the loader assigns. This location is in an ordinary data section, so it can be given a symbolic name that is accessible to the program.

property addressof_raw_data

Tuple (start address, end address) of the TLS template. The template is a block of data that is used to initialize TLS data. The system copies all of this data each time a thread is created, so it must not be corrupted. Note that these addresses are not RVA; it is addresses for which there should be a base relocation in the .reloc section.

property callbacks

List of the callbacks called before any other functions

property characteristics

The four bits [23:20] describe alignment info. Possible values are those defined as IMAGE_SCN_ALIGN_*, which are also used to describe alignment of section in object files. The other 28 bits are reserved for future use.

property data_template

The data template content

property directory

DataDirectory associated with the TLS object

property has_data_directory

True if there is a DataDirectory associated with the TLS object

property has_section

True if there is a Section associated with the TLS object

property section

Section associated with the TLS object

property sizeof_zero_fill

The size in bytes of the template, beyond the initialized data delimited by the lief.PE.TLS.addressof_raw_data fields. The total template size should be the same as the total size of TLS data in the image file. The zero fill is the amount of data that comes after the initialized nonzero data.


Symbol

class lief.PE.Symbol(self: lief.PE.Symbol) → None
property base_type
property complex_type
property has_section

True if symbols are located in a section

property name
property numberof_aux_symbols
property section
property section_number
property size

Symbol’s size

property storage_class
property type
property value

Symbol’s value


Relocation

class lief.PE.Relocation(self: lief.PE.Relocation) → None
add_entry(self: lief.PE.Relocation, new_entry: LIEF::PE::RelocationEntry) → LIEF::PE::RelocationEntry

Add a new RelocationEntry

property entries
property virtual_address

Relocation Entry

class lief.PE.RelocationEntry(self: lief.PE.RelocationEntry) → None
property address

Relocation’s address

property data

Raw data of the relocation:

  • The high 4 bits store the relocation type

  • The low 12 bits store the relocation offset (position)

property position

Offset - relative to virtual_address - where the relocation occurs

property size

Relocation’s size (in bits)

property type

Type of the relocation


Export

class lief.PE.Export(self: lief.PE.Export) → None
property entries
property export_flags
property major_version
property minor_version
property name
property ordinal_base
property timestamp

Export Entry

class lief.PE.ExportEntry(self: lief.PE.ExportEntry) → None
property address
property forward_information
class forward_information_t
property function
property library
property function_rva
property is_extern
property is_forwarded
property name
property ordinal
property size

Symbol’s size

property value

Symbol’s value


Signature

class lief.PE.Signature
class VERIFICATION_CHECKS(self: lief.PE.Signature.VERIFICATION_CHECKS, value: int) → None

Flags to tweak the verification process of the signature See lief.PE.Signature.check() and lief.PE.Binary.verify_signature()

Members:

DEFAULT : Default behavior that tries to follow the Microsoft verification process as close as possible

HASH_ONLY : Only check that lief.PE.Binary.authentihash() matches lief.PE.ContentInfo.digest regardless of the signature’s validity

LIFETIME_SIGNING : Same semantic as WTD_LIFETIME_SIGNING_FLAG <https://docs.microsoft.com/en-us/windows/win32/api/wintrust/ns-wintrust-wintrust_data#WTD_LIFETIME_SIGNING_FLAG>

SKIP_CERT_TIME : Skip the verification of the certificates time validities so that even though a certificate expired, it returns lief.PE.Signature.VERIFICATION_FLAGS.OK

DEFAULT = <VERIFICATION_CHECKS.DEFAULT: 1>
HASH_ONLY = <VERIFICATION_CHECKS.HASH_ONLY: 2>
LIFETIME_SIGNING = <VERIFICATION_CHECKS.LIFETIME_SIGNING: 4>
SKIP_CERT_TIME = <VERIFICATION_CHECKS.SKIP_CERT_TIME: 8>
property name
class VERIFICATION_FLAGS(self: lief.PE.Signature.VERIFICATION_FLAGS, value: int) → None

Members:

OK

INVALID_SIGNER

UNSUPPORTED_ALGORITHM

INCONSISTENT_DIGEST_ALGORITHM

CERT_NOT_FOUND

CORRUPTED_CONTENT_INFO

CORRUPTED_AUTH_DATA

MISSING_PKCS9_MESSAGE_DIGEST

BAD_DIGEST

BAD_SIGNATURE

NO_SIGNATURE

CERT_EXPIRED

CERT_FUTURE

BAD_DIGEST = <VERIFICATION_FLAGS.BAD_DIGEST: 128>
BAD_SIGNATURE = <VERIFICATION_FLAGS.BAD_SIGNATURE: 256>
CERT_EXPIRED = <VERIFICATION_FLAGS.CERT_EXPIRED: 1024>
CERT_FUTURE = <VERIFICATION_FLAGS.CERT_FUTURE: 2048>
CERT_NOT_FOUND = <VERIFICATION_FLAGS.CERT_NOT_FOUND: 8>
CORRUPTED_AUTH_DATA = <VERIFICATION_FLAGS.CORRUPTED_AUTH_DATA: 32>
CORRUPTED_CONTENT_INFO = <VERIFICATION_FLAGS.CORRUPTED_CONTENT_INFO: 16>
INCONSISTENT_DIGEST_ALGORITHM = <VERIFICATION_FLAGS.INCONSISTENT_DIGEST_ALGORITHM: 4>
INVALID_SIGNER = <VERIFICATION_FLAGS.INVALID_SIGNER: 1>
MISSING_PKCS9_MESSAGE_DIGEST = <VERIFICATION_FLAGS.MISSING_PKCS9_MESSAGE_DIGEST: 64>
NO_SIGNATURE = <VERIFICATION_FLAGS.NO_SIGNATURE: 512>
OK = <VERIFICATION_FLAGS.OK: 0>
UNSUPPORTED_ALGORITHM = <VERIFICATION_FLAGS.UNSUPPORTED_ALGORITHM: 2>
name()

__str__(*args, **kwargs) Overloaded function.

  1. __str__(self: lief.PE.Signature.VERIFICATION_FLAGS) -> str

  2. __str__(self: handle) -> str

property certificates

Return an iterator over x509 certificates

check(self: lief.PE.Signature, checks: lief.PE.Signature.VERIFICATION_CHECKS = <VERIFICATION_CHECKS.DEFAULT: 1>)lief.PE.Signature.VERIFICATION_FLAGS

Check the integrity of the signature and return a lief.PE.Signature.VERIFICATION_FLAGS

By default, it performs the following verifications:

  1. It must contain only one signer info (signers)

  2. lief.PE.Signature.digest_algorithm must match:

  3. The x509 certificate specified by lief.PE.SignerInfo.serial_number and lief.PE.SignerInfo.issuer must exist within lief.PE.Signature.certificates

  4. Given the x509 certificate, compare lief.PE.SignerInfo.encrypted_digest against either:

  5. If they are Authenticated attributes, check that a PKCS9_MESSAGE_DIGEST (lief.PE.PKCS9MessageDigest) attribute exists and that its value matches hash of ContentInfo

  6. Check the validity of the PKCS #9 counter signature if present

  7. If the signature doesn’t embed a signing-time in the counter signature, check the certificate validity. (See lief.PE.Signature.VERIFICATION_CHECKS.LIFETIME_SIGNING and lief.pe.Signature.VERIFICATION_CHECKS.SKIP_CERT_TIME)

See: lief.PE.Signature.VERIFICATION_CHECKS to tweak the behavior

property content_info

Return the ContentInfo

property digest_algorithm

Return the algorithm (ALGORITHMS) used to sign the content of ContentInfo

find_crt(self: lief.PE.Signature, serialno: List[int]) → LIEF::PE::x509

Find the x509 certificate according to its serial number

find_crt_issuer(*args, **kwargs)

Overloaded function.

  1. find_crt_issuer(self: lief.PE.Signature, issuer: str) -> LIEF::PE::x509

Find the x509 certificate according to its issuer

  1. find_crt_issuer(self: lief.PE.Signature, issuer: str, serialno: List[int]) -> LIEF::PE::x509

Find the x509 certificate according to its issuer AND its serial number

find_crt_subject(*args, **kwargs)

Overloaded function.

  1. find_crt_subject(self: lief.PE.Signature, subject: str) -> LIEF::PE::x509

Find the x509 certificate according to its subject

  1. find_crt_subject(self: lief.PE.Signature, subject: str, serialno: List[int]) -> LIEF::PE::x509

Find the x509 certificate according to its subject AND its serial number

static parse(*args, **kwargs)

Overloaded function.

  1. parse(path: str) -> object

Parse the DER PKCS #7 signature from the file path given in the first parameter

  1. parse(raw: List[int], skip_header: bool = False) -> object

Parse the raw (DER) PKCS #7 signature given in the first parameter

property raw_der

Return the raw original signature as a byte object

property signers

Return an iterator over the signers: SignerInfo

property version

Version of the signature. It should be 1


Signature Attribute

class lief.PE.Attribute

Interface over PKCS #7 attribute

property type

Concrete type (SIG_ATTRIBUTE_TYPES) of the attribute


Signature ContentType

class lief.PE.ContentType

Interface over the structure described by the OID 1.2.840.113549.1.9.3 (PKCS #9) The internal structure is described in the: RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0

ContentType ::= OBJECT IDENTIFIER
property oid

OID as described in RFC #2985 (string object)

property type

Concrete type (SIG_ATTRIBUTE_TYPES) of the attribute


Signature GenericType

class lief.PE.GenericType

Interface over an attribute whose the internal structure is not supported by LIEF

property oid

OID of the original attribute

property raw_content

Original DER blob of the attribute

property type

Concrete type (SIG_ATTRIBUTE_TYPES) of the attribute


Signature MsSpcNestedSignature

class lief.PE.MsSpcNestedSignature

Interface over the structure described by the OID 1.3.6.1.4.1.311.2.4.1

The internal structure is not documented but we can infer the following structure:

MsSpcNestedSignature ::= SET OF SignedData

With SignedData, the structure described in PKCS #7 RFC (See: lief.PE.Signature)

property signature

Underlying Signature object

property type

Concrete type (SIG_ATTRIBUTE_TYPES) of the attribute


Signature MsSpcStatementType

class lief.PE.MsSpcStatementType

Interface over the structure described by the OID 1.3.6.1.4.1.311.2.1.11

The internal structure is described in the official document: Windows Authenticode Portable Executable Signature Format

SpcStatementType ::= SEQUENCE of OBJECT IDENTIFIER
property oid

According to the documentation:

The SpcStatementType MUST contain one Object Identifier with either
the value ``1.3.6.1.4.1.311.2.1.21 (SPC_INDIVIDUAL_SP_KEY_PURPOSE_OBJID)`` or
``1.3.6.1.4.1.311.2.1.22 (SPC_COMMERCIAL_SP_KEY_PURPOSE_OBJID)``.
property type

Concrete type (SIG_ATTRIBUTE_TYPES) of the attribute


Signature PKCS9AtSequenceNumber

class lief.PE.PKCS9AtSequenceNumber

Interface over the structure described by the OID 1.2.840.113549.1.9.25.4 (PKCS #9)

The internal structure is described in the RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0

sequenceNumber ATTRIBUTE ::= {
  WITH SYNTAX SequenceNumber
  EQUALITY MATCHING RULE integerMat
  SINGLE VALUE TRUE
  ID pkcs-9-at-sequenceNumber
}

SequenceNumber ::= INTEGER (1..MAX)
property number

Number as described in the RFC

property type

Concrete type (SIG_ATTRIBUTE_TYPES) of the attribute


Signature PKCS9CounterSignature

class lief.PE.PKCS9CounterSignature

Interface over the structure described by the OID 1.2.840.113549.1.9.6 (PKCS #9)

The internal structure is described in the RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0

counterSignature ATTRIBUTE ::= {
  WITH SYNTAX SignerInfo
  ID pkcs-9-at-counterSignature
}
property signer

Return the SignerInfo as described in the RFC #2985

property type

Concrete type (SIG_ATTRIBUTE_TYPES) of the attribute


Signature PKCS9MessageDigest

class lief.PE.PKCS9MessageDigest

Interface over the structure described by the OID 1.2.840.113549.1.9.4 (PKCS #9)

The internal structure is described in the RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0

messageDigest ATTRIBUTE ::= {
  WITH SYNTAX MessageDigest
  EQUALITY MATCHING RULE octet
  SINGLE VALUE TRUE
  ID pkcs-9-at-messageDigest
}

MessageDigest ::= OCTET STRING
property digest

Message digeset as a blob of bytes as described in the RFC

property type

Concrete type (SIG_ATTRIBUTE_TYPES) of the attribute


Signature PKCS9SigningTime

class lief.PE.PKCS9SigningTime

Interface over the structure described by the OID 1.2.840.113549.1.9.5 (PKCS #9)

The internal structure is described in the RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0

signingTime ATTRIBUTE ::= {
        WITH SYNTAX SigningTime
        EQUALITY MATCHING RULE signingTimeMatch
        SINGLE VALUE TRUE
        ID pkcs-9-at-signingTime
}

SigningTime ::= Time -- imported from ISO/IEC 9594-8
property time

Time as a list [year, month, day, hour, min, sec]

property type

Concrete type (SIG_ATTRIBUTE_TYPES) of the attribute


Signature SpcSpOpusInfo

class lief.PE.SpcSpOpusInfo

Interface over the structure described by the OID 1.3.6.1.4.1.311.2.1.12 The internal structure is described in the official document: Windows Authenticode Portable Executable Signature Format

SpcSpOpusInfo ::= SEQUENCE {
    programName  [0] EXPLICIT SpcString OPTIONAL,
    moreInfo     [1] EXPLICIT SpcLink OPTIONAL
}
property more_info

Other information such as an URL

property program_name

Program description provided by the publisher

property type

Concrete type (SIG_ATTRIBUTE_TYPES) of the attribute


RsaInfo

class lief.PE.RsaInfo

Object representing a RSA key

property D

RSA private exponent (in bytes)

property E

RSA public exponent (in bytes)

property N

RSA public modulus (in bytes)

property P

First prime factor (in bytes)

property Q

Second prime factor (in bytes)

property has_private_key

True if it embeds a private key

property has_public_key

True if it embeds a public key

property key_size

Size of the public modulus in bits


x509

class lief.PE.x509

Interface over a x509 certificate

class KEY_TYPES(self: lief.PE.x509.KEY_TYPES, value: int) → None

Public key scheme used by the x509 certificate

Members:

NONE : Unknown scheme

RSA : RSA scheme

ECKEY : Elliptic-curve scheme

ECKEY_DH : Elliptic-curve Diffie-Hellman

ECDSA : Elliptic-curve Digital Signature Algorithm

RSA_ALT : RSA scheme with an alternative implementation for signing and decrypting

RSASSA_PSS : RSA Probabilistic signature scheme

ECDSA = <KEY_TYPES.ECDSA: 4>
ECKEY = <KEY_TYPES.ECKEY: 2>
ECKEY_DH = <KEY_TYPES.ECKEY_DH: 3>
NONE = <KEY_TYPES.NONE: 0>
RSA = <KEY_TYPES.RSA: 1>
RSASSA_PSS = <KEY_TYPES.RSASSA_PSS: 6>
RSA_ALT = <KEY_TYPES.RSA_ALT: 5>
property name
class KEY_USAGE(self: lief.PE.x509.KEY_USAGE, value: int) → None

Key usage as defined in RFC #5280 - section-4.2.1.3

Members:

DIGITAL_SIGNATURE : The key is used for digital signature

NON_REPUDIATION : The key is used for digital signature AND to protects against falsely denying some action

KEY_ENCIPHERMENT : The key is used for enciphering private or secret keys

DATA_ENCIPHERMENT : The key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher

KEY_AGREEMENT : The Key is used for key agreement. (e.g. with Diffie-Hellman)

KEY_CERT_SIGN : The key is used for verifying signatures on public key certificates

CRL_SIGN : The key is used for verifying signatures on certificate revocation lists

ENCIPHER_ONLY : In association with KEY_AGREEMENT (otherwise the meaning is undefined), the key is only used for enciphering data while performing key agreement

DECIPHER_ONLY : In association with KEY_AGREEMENT (otherwise the meaning is undefined), the key is only used for deciphering data while performing key agreement

CRL_SIGN = <KEY_USAGE.CRL_SIGN: 6>
DATA_ENCIPHERMENT = <KEY_USAGE.DATA_ENCIPHERMENT: 3>
DECIPHER_ONLY = <KEY_USAGE.DECIPHER_ONLY: 8>
DIGITAL_SIGNATURE = <KEY_USAGE.DIGITAL_SIGNATURE: 0>
ENCIPHER_ONLY = <KEY_USAGE.ENCIPHER_ONLY: 7>
KEY_AGREEMENT = <KEY_USAGE.KEY_AGREEMENT: 4>
KEY_CERT_SIGN = <KEY_USAGE.KEY_CERT_SIGN: 5>
KEY_ENCIPHERMENT = <KEY_USAGE.KEY_ENCIPHERMENT: 2>
NON_REPUDIATION = <KEY_USAGE.NON_REPUDIATION: 1>
property name
class VERIFICATION_FLAGS(self: lief.PE.x509.VERIFICATION_FLAGS, value: int) → None

Verification flags associated with verify

Members:

OK : The verification succeed

BADCERT_EXPIRED : The certificate validity has expired

BADCERT_REVOKED : The certificate has been revoked (is on a CRL)

BADCERT_CN_MISMATCH : The certificate Common Name (CN) does not match with the expected CN.

BADCERT_NOT_TRUSTED : The certificate is not correctly signed by the trusted CA.

BADCRL_NOT_TRUSTED : The CRL is not correctly signed by the trusted CA.

BADCRL_EXPIRED : The CRL is expired.

BADCERT_MISSING : Certificate was missing.

BADCERT_SKIP_VERIFY : Certificate verification was skipped.

BADCERT_OTHERNATURE : Other reason

BADCERT_FUTURE : The certificate validity starts in the future.

BADCRL_FUTURE : The CRL is from the future

BADCERT_KEY_USAGE : Usage does not match the keyUsage extension.

BADCERT_EXT_KEY_USAGE : Usage does not match the extendedKeyUsage extension.

BADCERT_NS_CERT_TYPE : Usage does not match the nsCertType extension.

BADCERT_BAD_MD : The certificate is signed with an unacceptable hash.

BADCERT_BAD_PK : The certificate is signed with an unacceptable PK alg (eg RSA vs ECDSA).

BADCERT_BAD_KEY : The certificate is signed with an unacceptable key (eg bad curve, RSA too short).

BADCRL_BAD_MD : The CRL is signed with an unacceptable hash.

BADCRL_BAD_PK : The CRL is signed with an unacceptable PK alg (eg RSA vs ECDSA).

BADCRL_BAD_KEY : The CRL is signed with an unacceptable key (eg bad curve, RSA too short).

BADCERT_BAD_KEY = <VERIFICATION_FLAGS.BADCERT_BAD_KEY: 65536>
BADCERT_BAD_MD = <VERIFICATION_FLAGS.BADCERT_BAD_MD: 16384>
BADCERT_BAD_PK = <VERIFICATION_FLAGS.BADCERT_BAD_PK: 32768>
BADCERT_CN_MISMATCH = <VERIFICATION_FLAGS.BADCERT_CN_MISMATCH: 4>
BADCERT_EXPIRED = <VERIFICATION_FLAGS.BADCERT_EXPIRED: 1>
BADCERT_EXT_KEY_USAGE = <VERIFICATION_FLAGS.BADCERT_EXT_KEY_USAGE: 4096>
BADCERT_FUTURE = <VERIFICATION_FLAGS.BADCERT_FUTURE: 512>
BADCERT_KEY_USAGE = <VERIFICATION_FLAGS.BADCERT_KEY_USAGE: 2048>
BADCERT_MISSING = <VERIFICATION_FLAGS.BADCERT_MISSING: 64>
BADCERT_NOT_TRUSTED = <VERIFICATION_FLAGS.BADCERT_NOT_TRUSTED: 8>
BADCERT_NS_CERT_TYPE = <VERIFICATION_FLAGS.BADCERT_NS_CERT_TYPE: 8192>
BADCERT_OTHERNATURE = <VERIFICATION_FLAGS.BADCERT_OTHERNATURE: 256>
BADCERT_REVOKED = <VERIFICATION_FLAGS.BADCERT_REVOKED: 2>
BADCERT_SKIP_VERIFY = <VERIFICATION_FLAGS.BADCERT_SKIP_VERIFY: 128>
BADCRL_BAD_KEY = <VERIFICATION_FLAGS.BADCRL_BAD_KEY: 524288>
BADCRL_BAD_MD = <VERIFICATION_FLAGS.BADCRL_BAD_MD: 131072>
BADCRL_BAD_PK = <VERIFICATION_FLAGS.BADCRL_BAD_PK: 262144>
BADCRL_EXPIRED = <VERIFICATION_FLAGS.BADCRL_EXPIRED: 32>
BADCRL_FUTURE = <VERIFICATION_FLAGS.BADCRL_FUTURE: 1024>
BADCRL_NOT_TRUSTED = <VERIFICATION_FLAGS.BADCRL_NOT_TRUSTED: 16>
OK = <VERIFICATION_FLAGS.OK: 0>
property name
property certificate_policies

Policy information terms as list of OID (see RFC #5280)

property ext_key_usage

Indicates one or more purposes for which the certified public key may be used (list of OID)

property is_ca
is_trusted_by(self: lief.PE.x509, ca_list: List[lief.PE.x509])lief.PE.x509.VERIFICATION_FLAGS

Verify this certificate against a list of root CA (list of x509 objects) It returns a set of flags defined by VERIFICATION_FLAGS

Example
signer = binary.signatures[0].signers[0]
microsoft_ca_bundle  lief.PE.x509.parse("bundle.pem")
print(signer.cert.is_trusted_by(microsoft_ca_bundle))
property issuer

Issuer of the certificate

property key_type

Return the underlying public-key scheme (KEY_TYPES)

property key_usage

Purpose of the key contained in the certificate (see KEY_USAGE)

static parse(*args, **kwargs)

Overloaded function.

  1. parse(path: str) -> List[lief.PE.x509]

Parse x509 certificate(s) from a file path given in the first parameter. It returns a list of x509 objects

  1. parse(raw: List[int]) -> List[lief.PE.x509]

Parse x509 certificate(s) from a raw blob given in the first parameter. It returns a list of x509 objects

property raw

The raw bytes associated with this x509 cert (DER encoded)

property rsa_info

If the underlying public-key scheme is RSA, return the RsaInfo associated with this certificate. Otherwise, return None

property serial_number

Unique id for certificate issued by a specific CA.

property signature

The signature of the certificate

property signature_algorithm

Signature algorithm (OID)

property subject

Subject of the certificate

property valid_from

Start time of certificate validity

property valid_to

End time of certificate validity

verify(self: lief.PE.x509, ca: lief.PE.x509)lief.PE.x509.VERIFICATION_FLAGS

Verify that this certificate has been used to trust the given x509 certificate

It returns a set of flags defined by VERIFICATION_FLAGS

Example
ca     = lief.PE.x509.parse("ca.crt")[0]
signer = lief.PE.x509.parse("signer.crt")[0]
print(ca.verify(signer))  # lief.PE.x509.VERIFICATION_FLAGS.OK
property version

X.509 version. (1=v1, 2=v2, 3=v3)


ContentInfo

class lief.PE.ContentInfo

ContentInfo as described in the RFC 2315

ContentInfo ::= SEQUENCE {
  contentType ContentType,
  content     [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL
}

ContentType ::= OBJECT IDENTIFIER

In the case of PE signature, ContentType must be set to SPC_INDIRECT_DATA_OBJID OID: 1.3.6.1.4.1.311.2.1.4 and content is defined by the structure: SpcIndirectDataContent

SpcIndirectDataContent ::= SEQUENCE {
 data          SpcAttributeTypeAndOptionalValue,
 messageDigest DigestInfo
}

SpcAttributeTypeAndOptionalValue ::= SEQUENCE {
 type  ObjectID,
 value [0] EXPLICIT ANY OPTIONAL
}

For PE signature, SpcAttributeTypeAndOptionalValue.type is set to SPC_PE_IMAGE_DATAOBJ (OID: 1.3.6.1.4.1.311.2.1.15) and the value is defined by SpcPeImageData

DigestInfo ::= SEQUENCE {
 digestAlgorithm  AlgorithmIdentifier,
 digest           OCTETSTRING
}

AlgorithmIdentifier ::= SEQUENCE {
 algorithm  ObjectID,
 parameters [0] EXPLICIT ANY OPTIONAL
}
property content_type

OID of the content type. This value should match SPC_INDIRECT_DATA_OBJID

property digest

The digest as bytes. It should match the binary authentihash()

property digest_algorithm

Algorithm (ALGORITHMS) used to hash the file. This value should match SignerInfo.digest_algorithm and Signature.digest_algorithm


SignerInfo

class lief.PE.SignerInfo

SignerInfo as described in the RFC 2315 #Section 9.2

SignerInfo ::= SEQUENCE {
 version                   Version,
 issuerAndSerialNumber     IssuerAndSerialNumber,
 digestAlgorithm           DigestAlgorithmIdentifier,
 authenticatedAttributes   [0] IMPLICIT Attributes OPTIONAL,
 digestEncryptionAlgorithm DigestEncryptionAlgorithmIdentifier,
 encryptedDigest           EncryptedDigest,
 unauthenticatedAttributes [1] IMPLICIT Attributes OPTIONAL
}

EncryptedDigest ::= OCTET STRING
property authenticated_attributes

Return an iterator over the authenticated attributes (Attribute)

property cert

x509 certificate used by this signer. If it can’t be found, it returns None

property digest_algorithm

Algorithm (ALGORITHMS) used to hash the file. This value should match ContentInfo.digest_algorithm and Signature.digest_algorithm

property encrypted_digest

Return the signature created by the signing certificate’s private key

property encryption_algorithm

Return algorithm (ALGORITHMS) used to encrypt the digest

get_attribute(self: lief.PE.SignerInfo, type: lief.PE.SIG_ATTRIBUTE_TYPES) → LIEF::PE::Attribute

Return the authenticated or un-authenticated attribute matching the given lief.PE.SIG_ATTRIBUTE_TYPES It returns the first entry that matches the given type. If it can’t be found, it returns None

get_auth_attribute(self: lief.PE.SignerInfo, type: lief.PE.SIG_ATTRIBUTE_TYPES) → LIEF::PE::Attribute

Return the authenticated attribute matching the given lief.PE.SIG_ATTRIBUTE_TYPES It returns the first entry that matches the given type. If it can’t be found, it returns None

get_unauth_attribute(self: lief.PE.SignerInfo, type: lief.PE.SIG_ATTRIBUTE_TYPES) → LIEF::PE::Attribute

Return the un-authenticated attribute matching the given lief.PE.SIG_ATTRIBUTE_TYPES It returns the first entry that matches the given type. If it can’t be found, it returns a nullptr

property issuer

The X509 issuer used to sign the signed-data (see: lief.PE.x509.issuer)

property serial_number

The X509 serial number used to sign the signed-data (see: lief.PE.x509.serial_number)

property unauthenticated_attributes

Return an iterator over the unauthenticated attributes (Attribute)

property version

Should be 1


Builder

class lief.PE.Builder(self: lief.PE.Builder, pe_binary: lief.PE.Binary) → None

Constructor that takes a Binary

build(self: lief.PE.Builder) → None

Perform the build process

build_dos_stub(self: lief.PE.Builder, enable: bool = True)lief.PE.Builder

Rebuild the DOS stub

build_imports(self: lief.PE.Builder, enable: bool = True)lief.PE.Builder

Rebuild the import table in another section

build_overlay(self: lief.PE.Builder, enable: bool = True)lief.PE.Builder

Rebuild the binary’s overlay

build_relocations(self: lief.PE.Builder, enable: bool = True)lief.PE.Builder

Rebuild the relocation table in another section

build_resources(self: lief.PE.Builder, enable: bool = True)lief.PE.Builder

Rebuid the resources in another section

build_tls(self: lief.PE.Builder, enable: bool = True)lief.PE.Builder

Rebuild TLS object in another section

get_build(self: lief.PE.Builder) → List[int]

Return the build result as a list of bytes

patch_imports(self: lief.PE.Builder, enable: bool = True)lief.PE.Builder

Patch the original import table in order to redirect functions to the new import table.

This setting should be used with build_imports set to True

write(self: lief.PE.Builder, output: str) → None

Write the build result into the output file


Resource Node

class lief.PE.ResourceNode
add_data_node(self: lief.PE.ResourceNode, resource_data: LIEF::PE::ResourceData)lief.PE.ResourceNode

Add a ResourceData to the current node

add_directory_node(self: lief.PE.ResourceNode, resource_directory: LIEF::PE::ResourceDirectory)lief.PE.ResourceNode

Add a ResourceDirectory to the current node

property childs

Node’s childs

delete_child(*args, **kwargs)

Overloaded function.

  1. delete_child(self: lief.PE.ResourceNode, node: lief.PE.ResourceNode) -> None

Delete the given ResourceNode from childs

  1. delete_child(self: lief.PE.ResourceNode, id: int) -> None

Delete the ResourceNode with the given id from childs

property depth

Current depth of the entry in the resource tree

property has_name

True if the current resource uses a name

property id

Integer that identifies the Type, Name, or Language ID entry.

property is_data

True if the current resource is a ResourceData

property is_directory

True if the current resource is a ResourceDirectory

property name

Resource name

sort_by_id(self: lief.PE.ResourceNode) → None

Sort resource childs by ID


Resource Directory

class lief.PE.ResourceDirectory(self: lief.PE.ResourceDirectory) → None

Default constructor

add_data_node(self: lief.PE.ResourceNode, resource_data: LIEF::PE::ResourceData)lief.PE.ResourceNode

Add a ResourceData to the current node

add_directory_node(self: lief.PE.ResourceNode, resource_directory: LIEF::PE::ResourceDirectory)lief.PE.ResourceNode

Add a ResourceDirectory to the current node

property characteristics

Resource flags. This field is reserved for future use. It is currently set to zero.

property childs

Node’s childs

delete_child(*args, **kwargs)

Overloaded function.

  1. delete_child(self: lief.PE.ResourceNode, node: lief.PE.ResourceNode) -> None

Delete the given ResourceNode from childs

  1. delete_child(self: lief.PE.ResourceNode, id: int) -> None

Delete the ResourceNode with the given id from childs

property depth

Current depth of the entry in the resource tree

property has_name

True if the current resource uses a name

property id

Integer that identifies the Type, Name, or Language ID entry.

property is_data

True if the current resource is a ResourceData

property is_directory

True if the current resource is a ResourceDirectory

property major_version

The major version number, set by the user.

property minor_version

The minor version number, set by the user.

property name

Resource name

property numberof_id_entries

The number of directory entries immediately following the Name entries that use numeric IDs for Type, Name, or Language entries.

property numberof_name_entries

The number of directory entries immediately following the table that use strings to identify Type, Name, or Language entries (depending on the level of the table

sort_by_id(self: lief.PE.ResourceNode) → None

Sort resource childs by ID

property time_date_stamp

The time that the resource data was created by the resource compiler.


Resource Data

class lief.PE.ResourceData(*args, **kwargs)

Overloaded function.

  1. __init__(self: lief.PE.ResourceData) -> None

Default constructor

  1. __init__(self: lief.PE.ResourceData, content: List[int], code_page: int) -> None

add_data_node(self: lief.PE.ResourceNode, resource_data: LIEF::PE::ResourceData)lief.PE.ResourceNode

Add a ResourceData to the current node

add_directory_node(self: lief.PE.ResourceNode, resource_directory: LIEF::PE::ResourceDirectory)lief.PE.ResourceNode

Add a ResourceDirectory to the current node

property childs

Node’s childs

property code_page

The code page that is used to decode code point values within the resource data. Typically, the code page would be the Unicode code page

property content

Resource content

delete_child(*args, **kwargs)

Overloaded function.

  1. delete_child(self: lief.PE.ResourceNode, node: lief.PE.ResourceNode) -> None

Delete the given ResourceNode from childs

  1. delete_child(self: lief.PE.ResourceNode, id: int) -> None

Delete the ResourceNode with the given id from childs

property depth

Current depth of the entry in the resource tree

property has_name

True if the current resource uses a name

property id

Integer that identifies the Type, Name, or Language ID entry.

property is_data

True if the current resource is a ResourceData

property is_directory

True if the current resource is a ResourceDirectory

property name

Resource name

property offset

Offset of the content within the resource

property reserved

Reserved value. Should be 0

sort_by_id(self: lief.PE.ResourceNode) → None

Sort resource childs by ID


Resources Manager

class lief.PE.ResourcesManager

The Resource Manager provides an enhanced API to manipulate the resource tree

property accelerator

Return list of ResourceAccelerator present in the resource

add_icon(self: lief.PE.ResourcesManager, icon: LIEF::PE::ResourceIcon) → None

Add an icon to the resources

change_icon(self: lief.PE.ResourcesManager, old_one: LIEF::PE::ResourceIcon, new_one: LIEF::PE::ResourceIcon) → None

Switch the given icons

property dialogs

Return the list of the ResourceDialog present in the resource

get_node_type(self: lief.PE.ResourcesManager, type: lief.PE.RESOURCE_TYPES) → LIEF::PE::ResourceNode

Return ResourceNode with the given RESOURCE_TYPES

property has_accelerator

True if resources contain ResourceAccelerator

property has_dialogs

true if resources contain ResourceDialog

property has_html

True if resources contain HTML resource

property has_icons

true if resources contain ResourceIcon

property has_manifest

True if resources contain Manifest element

property has_string_table

True if resources contain ResourceStringTable

has_type(self: lief.PE.ResourcesManager, type: lief.PE.RESOURCE_TYPES) → bool

True if the resource has the given RESOURCE_TYPES

property has_version

true if resources contain ResourceVersion

property html

HTML resource as the list of string

property icons

Return the list of the ResourceIcon present in the resource

property langs_available

Return list of RESOURCE_LANGS present in the resources

property manifest

Manifest as a string

property string_table

Return list of ResourceStringTable present in the resource

property sublangs_available

Return list of RESOURCE_SUBLANGS present in the resources

property types_available

Return list of RESOURCE_TYPES present in the resources

property version

Return the ResourceVersion


Resource Icon

class lief.PE.ResourceIcon(self: lief.PE.ResourceIcon, icon_path: str) → None

Constructor that takes a icon path as input

property bit_count

Bits per pixel

property color_count

Number of colors in image (0 if >=8bpp)

property height

Height in pixels of the image

property id

Id associated with the icon

property lang

Language (RESOURCE_LANGS) associated with the icon

property pixels
property planes

Color Planes

property reserved

Reserved (must be 0)

save(self: lief.PE.ResourceIcon, filepath: str) → None

Save the icon to the given filepath

property sublang

Sub language (RESOURCE_SUBLANGS) associated with the icon

property width

Width in pixels of the image


Resource Dialog

class lief.PE.ResourceDialog
property charset

The character set to be used

property cx

The width, in dialog box units, of the dialog box.

property cy

The height, in dialog box units, of the dialog box.

property dialogbox_style_list

Return list of DIALOG_BOX_STYLES associated with the style member

property extended_style

The extended windows styles (EXTENDED_WINDOW_STYLES)

property extended_style_list

Return list of EXTENDED_WINDOW_STYLES associated with the extended_style member

has_dialogbox_style(self: lief.PE.ResourceDialog, style: lief.PE.DIALOG_BOX_STYLES) → bool

Check if the style member has the given DIALOG_BOX_STYLES

has_extended_style(self: lief.PE.ResourceDialog, style: lief.PE.EXTENDED_WINDOW_STYLES) → bool

Check if the extended_style member has the given EXTENDED_WINDOW_STYLES

has_style(self: lief.PE.ResourceDialog, style: lief.PE.WINDOW_STYLES) → bool

Check if the style member has the given WINDOW_STYLES

property help_id

The help context identifier for the dialog box window

property is_extended

True if the dialog is an extended one

property items

Iterator on the controls (ResourceDialogItem) that define the Dialog (Button, Label…)

property lang

Primary RESOURCE_LANGS associated with the dialog

property point_size

The point size of the font to use for the text in the dialog box and its controls.

property signature

Indicates whether a template is an extended dialog box template:

  • 0xFFFF: Extended dialog box template

  • Other value: Standard dialog box template

property style

The style of the dialog box. This member can be a combination of WINDOW_STYLES and DIALOG_BOX_STYLES

property style_list

Return list of WINDOW_STYLES associated with the style member

property sub_lang

Secondary RESOURCE_SUBLANGS associated with the dialog

property title

The title of the dialog box

property typeface

The name of the typeface for the font

property version

The version number of the extended dialog box template. This member must be set to 1.

property weight

The weight of the font

property x

The x-coordinate, in dialog box units, of the upper-left corner of the dialog box.

property y

The y-coordinate, in dialog box units, of the upper-left corner of the dialog box.


Resource Dialog Item

class lief.PE.ResourceDialogItem
property cx

The width, in dialog box units, of the control

property cy

The height, in dialog box units, of the control

property extended_style

The extended styles for the window

property help_id

The help context identifier for the control

property id

The control identifier

property is_extended

True if the control is an extended one

property style

The style of the control. This member can be a combination of WINDOW_STYLES values and one or more of the control style values.

property title

Initial text of the control

property x

The x-coordinate, in dialog box units, of the upper-left corner of the control

property y

The y-coordinate, in dialog box units, of the upper-left corner of the control


Resource Version

class lief.PE.ResourceVersion

Modelization of the data associated with the RT_VERSION entry See: VS_VERSIONINFO

property fixed_file_info

ResourceFixedFileInfo associated with the version (if any).

This object describes various information about the application’s version

property has_fixed_file_info

True if the version contains a ResourceFixedFileInfo

property has_string_file_info

True if the version contains a ResourceStringFileInfo

property has_var_file_info

True if the version contains a ResourceVarFileInfo

property key

Signature of the structure. Must be VS_VERSION_INFO

remove_fixed_file_info(self: lief.PE.ResourceVersion) → None

Remove the ResourceFixedFileInfo from the version

remove_string_file_info(self: lief.PE.ResourceVersion) → None

Remove the ResourceStringFileInfo from the version

remove_var_file_info(self: lief.PE.ResourceVersion) → None

Remove the ResourceVarFileInfo from the version

property string_file_info

ResourceStringFileInfo associated with the version (if any)

This object describes various information about the application’s version. The underlying structure is basically a dictionary (key/value)

property type

The type of data in the version resource

  • 1 if it contains text data

  • 0 if it contains binary data

property var_file_info

ResourceVarFileInfo associated with the version (if any)

This object describes information about languages supported by the application


Resource Fixed File Info

class lief.PE.ResourceFixedFileInfo

Modelization of the VS_FIXEDFILEINFO

property file_date_LS

The least significant 32 bits of the file’s 64-bit binary creation date and time stamp

property file_date_MS

The most significant 32 bits of the file’s 64-bit binary creation date and time stamp

property file_flags

Contains a bitmask that specifies the Boolean attributes of the file (FIXED_VERSION_FILE_FLAGS)

property file_flags_mask

Contains a bitmask that specifies the valid bits in file_flags.

A bit is valid only if it was defined when the file was created.

property file_os

The operating system for which this file was designed (FIXED_VERSION_OS)

property file_subtype

The function of the file (FIXED_VERSION_FILE_SUB_TYPES)

property file_type

The general type of file (FIXED_VERSION_FILE_TYPES)

property file_version_LS

The least significant 32 bits of the file’s binary version number

This member is used with file_version_MS to form a 64-bits value used for numeric comparisons.

property file_version_MS

The most significant 32 bits of the file’s binary version number

This member is used with file_version_LS to form a 64-bits value used for numeric comparisons.

property product_version_LS

The least significant 32 bits of the product with which this file was distributed

This member is used with product_version_MS to form a 64-bits value used for numeric comparisons.

property product_version_MS

The most significant 32 bits of the product with which this file was distributed

This member is used with product_version_LS to form a 64-bits value used for numeric comparisons.

property signature

Contains the value 0xFEEF04BD

property struct_version

The binary version number of this structure.

  • The high-order word of this member contains the major version number.

  • The low-order word contains the minor version number


Resource Var File Info

class lief.PE.ResourceVarFileInfo

This object describes information about languages supported by the application

property key

Signature of the structure. Must be VarFileInfo

property translations

List of languages that the application supports

The least significant 16-bits must contain a Microsoft language identifier, and the most significant 16-bits must contain the CODE_PAGES Either most or least 16-bits can be zero, indicating that the file is language or code page independent.

property type

The type of data in the version resource

  • 1 if it contains text data

  • 0 if it contains binary data


Resource String File Info

class lief.PE.ResourceStringFileInfo

Modelization of the StringFileInfo structure

See: https://docs.microsoft.com/en-us/windows/win32/menurc/stringfileinfo

property key

Signature of the structure. Must be StringFileInfo

property langcode_items

List of the LangCodeItem items

Each key indicates the appropriate language and code page for displaying the key: value of items

property type

The type of data in the version resource

  • 1 if it contains text data

  • 0 if it contains binary data


Lang code item

class lief.PE.LangCodeItem

Class which modelize the childs of the ResourceStringFileInfo

See: https://docs.microsoft.com/en-us/windows/win32/menurc/stringtable

property code_page

CODE_PAGES for which items are defined

property items
property key

A 8-digit hexadecimal number stored as an Unicode string

  • The four most significant digits represent the language identifier.

  • The four least significant digits represent the code page for which the data is formatted.

See:
property lang

Lang (RESOURCE_LANGS) for which items are defined

property sublang

Sub-lang (RESOURCE_SUBLANGS) for which items are defined

property type

The type of data in the version resource

  • 1 if it contains text data

  • 0 if it contains binary data


Resource String Table

class lief.PE.ResourceStringTable
property length

The size of the string, not including length field itself.

property name

The variable-length Unicode string data, word-aligned.


Rich Header

class lief.PE.RichHeader(self: lief.PE.RichHeader) → None
add_entry(*args, **kwargs)

Overloaded function.

  1. add_entry(self: lief.PE.RichHeader, entry: LIEF::PE::RichEntry) -> None

Add a new RichEntry

  1. add_entry(self: lief.PE.RichHeader, id: int, build_id: int, count: int) -> None

Add a new RichEntry given its id, build_id, count

property entries

Return binary’s RichEntry within the header

property key

Key used to encode the header (xor operation)


Rich Entry

class lief.PE.RichEntry(*args, **kwargs)

Overloaded function.

  1. __init__(self: lief.PE.RichEntry) -> None

  2. __init__(self: lief.PE.RichEntry, id: int, build_id: int, count: int) -> None

Contructor from id, build_id and count

property build_id

Builder number of the tool (if any)

property count

Occurrence count

property id

Type of the entry


Debug

class lief.PE.Debug(self: lief.PE.Debug) → None
property addressof_rawdata

Address of the debug data relative to the image base

property characteristics

Reserved should be 0

property code_view

Return an object which subclass CodeView representing the code view

The subclassed object can be one of:

property has_code_view

Whether or not a code view is present

property has_pogo

Whether or not a pogo is present

property major_version

The major version number of the debug data format.

property minor_version

The minor version number of the debug data format.

property pogo

Return an object which subclass Pogo representing the pogo entry

property pointerto_rawdata

File offset of the debug data

property sizeof_data

Size of the debug data

property timestamp

The time and date that the debug data was created.

property type

The format (DEBUG_TYPES) of the debugging information


Code View

class lief.PE.CodeView
property cv_signature

Type of the code view (CODE_VIEW_SIGNATURES)


Code View PDB

class lief.PE.CodeViewPDB(self: lief.PE.CodeViewPDB) → None
property age
property cv_signature

Type of the code view (CODE_VIEW_SIGNATURES)

property filename
property signature

Code Integrity

class lief.PE.CodeIntegrity(self: lief.PE.CodeIntegrity) → None
property catalog

0xFFFF means not available

property catalog_offset
property flags

Flags to indicate if CI information is available, etc.

property reserved

Additional bitmask to be defined later


Pogo

class lief.PE.Pogo(self: lief.PE.Pogo) → None
property entries
property signature

Type of the pogo (POGO_SIGNATURES)


Pogo Entry

class lief.PE.PogoEntry(self: lief.PE.PogoEntry) → None
property name
property size
property start_rva

Load Configuration

class lief.PE.LoadConfiguration(self: lief.PE.LoadConfiguration) → None

Class modeling the default PE’s LoadConfiguration

It’s the base class for any future version of the structure

property characteristics

Characteristics of the structure.

property critical_section_default_timeout

The default timeout value to use for is process’s critical sections that are abandoned.

property csd_version

The service pack version identifier.

property decommit_free_block_threshold

Memory that must be freed before it is returned to the system, in bytes.

property decommit_total_free_threshold

Total amount of free memory, in bytes

property editlist

Reserved for use by the system.

property global_flags_clear

The global loader flags to clear for this process as the loader start the process.

property global_flags_set

The global loader flags to set for this process as the loader starts the process.

property lock_prefix_table

The VA of a list of addresses where the LOCK prefix is used so that they can be replaced with NOP on single processor machines.

property major_version

Major Version

property maximum_allocation_size

Maximum allocation size, in bytes.

property minor_version

Minor version

property process_affinity_mask

Setting this field to a non-zero value is equivalent to calling SetProcessAffinityMask with this value during process startup (.exe only)

property process_heap_flags

Process heap flags that correspond to the first argument of the HeapCreate function. These flags apply to the process heap that is created during process startup.

property reserved1

Must be zero.

A pointer to a cookie that is used by Visual C++ or GS implementation.

property timedatestamp

Date and time stamp value

property version

(SDK) Version of the structure. (WIN_VERSION)

property virtual_memory_threshold

Maximum virtual memory size, in bytes.

Load Configuration V0

class lief.PE.LoadConfigurationV0(self: lief.PE.LoadConfigurationV0) → None

Bases: lief.PE.LoadConfiguration

LoadConfiguration enhanced with SEH.

It is associated with the WIN_VERSION: SEH

property se_handler_count

The count of unique handlers in the table.

property se_handler_table

The VA of the sorted table of RVAs of each valid, unique SE handler in the image.

Load Configuration V1

class lief.PE.LoadConfigurationV1(self: lief.PE.LoadConfigurationV1) → None

Bases: lief.PE.LoadConfigurationV0

LoadConfigurationV0 enhanced with Control Flow Guard.

It is associated with the WIN_VERSION: WIN_8_1

property guard_cf_check_function_pointer

The VA where Control Flow Guard check-function pointer is stored.

property guard_cf_dispatch_function_pointer

The VA where Control Flow Guard dispatch-function pointer is stored.

property guard_cf_flags_list

Return list of GUARD_CF_FLAGS present in guard_flags

property guard_cf_function_count

The count of unique RVAs in the guard_cf_function_table

property guard_cf_function_table

The VA of the sorted table of RVAs of each Control Flow Guard function in the image.

property guard_flags

Control Flow Guard related flags.

has(self: lief.PE.LoadConfigurationV1, flag: lief.PE.GUARD_CF_FLAGS) → bool

Check if the given GUARD_CF_FLAGS is present in guard_flags

Load Configuration V2

class lief.PE.LoadConfigurationV2(self: lief.PE.LoadConfigurationV2) → None

Bases: lief.PE.LoadConfigurationV1

LoadConfigurationV1 enhanced with code integrity.

It is associated with the WIN_VERSION: WIN10_0_9879

property code_integrity

CodeIntegrity object

Load Configuration V3

class lief.PE.LoadConfigurationV3(self: lief.PE.LoadConfigurationV3) → None

Bases: lief.PE.LoadConfigurationV2

LoadConfigurationV2 with Control Flow Guard improved.

It is associated with the WIN_VERSION: WIN10_0_14286

property guard_address_taken_iat_entry_count

Number of entries in the guard_address_taken_iat_entry_table

property guard_address_taken_iat_entry_table

VA of a table associated with CFG’s IAT checks

property guard_long_jump_target_count

Number of entries in the guard_address_taken_iat_entry_table

property guard_long_jump_target_table

VA of a table associated with CFG’s long jump

Load Configuration V4

class lief.PE.LoadConfigurationV4(self: lief.PE.LoadConfigurationV4) → None

Bases: lief.PE.LoadConfigurationV3

LoadConfigurationV3 enhanced with:

  • Kind of dynamic relocations

  • Hybrid Metadata Pointer

It is associated with the WIN_VERSION: WIN10_0_14383

property dynamic_value_reloc_table

VA of pointing to a IMAGE_DYNAMIC_RELOCATION_TABLE

property hybrid_metadata_pointer

Load Configuration V5

class lief.PE.LoadConfigurationV5(self: lief.PE.LoadConfigurationV5) → None

Bases: lief.PE.LoadConfigurationV4

LoadConfigurationV4 enhanced with Return Flow Guard.

It is associated with the WIN_VERSION: WIN10_0_14901

property dynamic_value_reloctable_offset

Offset of dynamic relocation table relative to the relocation table

property dynamic_value_reloctable_section

The section index of the dynamic value relocation table

property guard_rf_failure_routine

VA of the failure routine

property guard_rf_failure_routine_function_pointer

VA of the failure routine fptr

property reserved2

Must be zero

Load Configuration V6

class lief.PE.LoadConfigurationV6(self: lief.PE.LoadConfigurationV6) → None

Bases: lief.PE.LoadConfigurationV5

LoadConfigurationV5 enhanced with Hotpatch and improved RFG.

It is associated with the WIN_VERSION: WIN10_0_15002

property guard_rf_verify_stackpointer_function_pointer

VA of the Function verifying the stack pointer

property hotpatch_table_offset

Offset to the hotpatch table

Load Configuration V7

class lief.PE.LoadConfigurationV7(self: lief.PE.LoadConfigurationV7) → None

Bases: lief.PE.LoadConfigurationV6

property addressof_unicode_string
property reserved3

Utilities

lief.PE.is_pe(*args, **kwargs)

Overloaded function.

  1. is_pe(file: str) -> bool

Check if the given file is a PE

  1. is_pe(raw: List[int]) -> bool

Check if the given raw data is a PE

lief.PE.get_type(*args, **kwargs)

Overloaded function.

  1. get_type(file: str) -> lief.PE.PE_TYPE

If the input file is a PE one, return the PE_TYPE

  1. get_type(raw: List[int]) -> lief.PE.PE_TYPE

If the input raw data represent a PE file, return the PE_TYPE

lief.PE.get_imphash(binary: lief.PE.Binary, mode: lief.PE.IMPHASH_MODE = <IMPHASH_MODE.DEFAULT: 0>) → str

Compute the hash of imported functions

Properties of the hash generated:

  • Order agnostic

  • Casse agnostic

  • Ordinal (in some extent) agnostic

If one needs the same output as Virus Total (i.e. pefile), you can use PEFILE as second parameter.

Warning

The algorithm used to compute the imphash value has some variations compared to Yara, pefile, VT implementation

class lief.PE.IMPHASH_MODE(self: lief.PE.IMPHASH_MODE, value: int) → None

Enum to define the behavior of get_imphash()

Members:

DEFAULT : Default implementation

LIEF : Same as DEFAULT

PEFILE : Use pefile algorithm

VT : Same as PEFILE since Virus Total is using pefile

DEFAULT = <IMPHASH_MODE.DEFAULT: 0>
LIEF = <IMPHASH_MODE.DEFAULT: 0>
PEFILE = <IMPHASH_MODE.PEFILE: 1>
VT = <IMPHASH_MODE.PEFILE: 1>
property name
lief.PE.resolve_ordinals(import: lief.PE.Import, strict: bool = False, use_std: bool = False)lief.PE.Import

Take an Import as entry and try to resolve its ordinal imports

The strict boolean parameter enables to throw a not_found exception if the ordinal can’t be resolved. Otherwise it skips the entry.


Enums

PE_TYPE

class lief.PE.PE_TYPE(self: lief.PE.PE_TYPE, value: int) → None

Members:

PE32

PE32_PLUS

PE32 = <PE_TYPE.PE32: 267>
PE32_PLUS = <PE_TYPE.PE32_PLUS: 523>
property name

MACHINE_TYPES

class lief.PE.MACHINE_TYPES(self: lief.PE.MACHINE_TYPES, value: int) → None

Members:

INVALID

UNKNOWN

AM33

AMD64

ARM

ARMNT

ARM64

EBC

I386

IA64

M32R

MIPS16

MIPSFPU

MIPSFPU16

POWERPC

POWERPCFP

R4000

SH3

SH3DSP

SH4

SH5

THUMB

WCEMIPSV2

AM33 = <MACHINE_TYPES.AM33: 467>
AMD64 = <MACHINE_TYPES.AMD64: 34404>
ARM = <MACHINE_TYPES.ARM: 448>
ARM64 = <MACHINE_TYPES.ARM64: 43620>
ARMNT = <MACHINE_TYPES.ARMNT: 452>
EBC = <MACHINE_TYPES.EBC: 3772>
I386 = <MACHINE_TYPES.I386: 332>
IA64 = <MACHINE_TYPES.IA64: 512>
INVALID = <MACHINE_TYPES.INVALID: 65535>
M32R = <MACHINE_TYPES.M32R: 36929>
MIPS16 = <MACHINE_TYPES.MIPS16: 614>
MIPSFPU = <MACHINE_TYPES.MIPSFPU: 870>
MIPSFPU16 = <MACHINE_TYPES.MIPSFPU16: 1126>
POWERPC = <MACHINE_TYPES.POWERPC: 496>
POWERPCFP = <MACHINE_TYPES.POWERPCFP: 497>
R4000 = <MACHINE_TYPES.R4000: 358>
SH3 = <MACHINE_TYPES.SH3: 418>
SH3DSP = <MACHINE_TYPES.SH3DSP: 419>
SH4 = <MACHINE_TYPES.SH4: 422>
SH5 = <MACHINE_TYPES.SH5: 424>
THUMB = <MACHINE_TYPES.THUMB: 450>
UNKNOWN = <MACHINE_TYPES.UNKNOWN: 0>
WCEMIPSV2 = <MACHINE_TYPES.WCEMIPSV2: 361>
property name

HEADER_CHARACTERISTICS

class lief.PE.HEADER_CHARACTERISTICS(self: lief.PE.HEADER_CHARACTERISTICS, value: int) → None

Members:

RELOCS_STRIPPED

EXECUTABLE_IMAGE

LINE_NUMS_STRIPPED

LOCAL_SYMS_STRIPPED

AGGRESSIVE_WS_TRIM

LARGE_ADDRESS_AWARE

BYTES_REVERSED_LO

CHARA_32BIT_MACHINE

DEBUG_STRIPPED

REMOVABLE_RUN_FROM_SWAP

NET_RUN_FROM_SWAP

SYSTEM

DLL

UP_SYSTEM_ONLY

BYTES_REVERSED_HI

AGGRESSIVE_WS_TRIM = <HEADER_CHARACTERISTICS.AGGRESSIVE_WS_TRIM: 16>
BYTES_REVERSED_HI = <HEADER_CHARACTERISTICS.BYTES_REVERSED_HI: 32768>
BYTES_REVERSED_LO = <HEADER_CHARACTERISTICS.BYTES_REVERSED_LO: 128>
CHARA_32BIT_MACHINE = <HEADER_CHARACTERISTICS.CHARA_32BIT_MACHINE: 256>
DEBUG_STRIPPED = <HEADER_CHARACTERISTICS.DEBUG_STRIPPED: 512>
DLL = <HEADER_CHARACTERISTICS.DLL: 8192>
EXECUTABLE_IMAGE = <HEADER_CHARACTERISTICS.EXECUTABLE_IMAGE: 2>
LARGE_ADDRESS_AWARE = <HEADER_CHARACTERISTICS.LARGE_ADDRESS_AWARE: 32>
LINE_NUMS_STRIPPED = <HEADER_CHARACTERISTICS.LINE_NUMS_STRIPPED: 4>
LOCAL_SYMS_STRIPPED = <HEADER_CHARACTERISTICS.LOCAL_SYMS_STRIPPED: 8>
NET_RUN_FROM_SWAP = <HEADER_CHARACTERISTICS.NET_RUN_FROM_SWAP: 2048>
RELOCS_STRIPPED = <HEADER_CHARACTERISTICS.RELOCS_STRIPPED: 1>
REMOVABLE_RUN_FROM_SWAP = <HEADER_CHARACTERISTICS.REMOVABLE_RUN_FROM_SWAP: 1024>
SYSTEM = <HEADER_CHARACTERISTICS.SYSTEM: 4096>
UP_SYSTEM_ONLY = <HEADER_CHARACTERISTICS.UP_SYSTEM_ONLY: 16384>
property name

SUBSYSTEM

class lief.PE.SUBSYSTEM(self: lief.PE.SUBSYSTEM, value: int) → None

Members:

UNKNOWN

NATIVE

WINDOWS_GUI

WINDOWS_CUI

OS2_CUI

POSIX_CUI

NATIVE_WINDOWS

WINDOWS_CE_GUI

EFI_APPLICATION

EFI_BOOT_SERVICE_DRIVER

EFI_RUNTIME_DRIVER

EFI_ROM

XBOX

WINDOWS_BOOT_APPLICATION

EFI_APPLICATION = <SUBSYSTEM.EFI_APPLICATION: 10>
EFI_BOOT_SERVICE_DRIVER = <SUBSYSTEM.EFI_BOOT_SERVICE_DRIVER: 11>
EFI_ROM = <SUBSYSTEM.EFI_ROM: 13>
EFI_RUNTIME_DRIVER = <SUBSYSTEM.EFI_RUNTIME_DRIVER: 12>
NATIVE = <SUBSYSTEM.NATIVE: 1>
NATIVE_WINDOWS = <SUBSYSTEM.NATIVE_WINDOWS: 8>
OS2_CUI = <SUBSYSTEM.OS2_CUI: 5>
POSIX_CUI = <SUBSYSTEM.POSIX_CUI: 7>
UNKNOWN = <SUBSYSTEM.UNKNOWN: 0>
WINDOWS_BOOT_APPLICATION = <SUBSYSTEM.WINDOWS_BOOT_APPLICATION: 16>
WINDOWS_CE_GUI = <SUBSYSTEM.WINDOWS_CE_GUI: 9>
WINDOWS_CUI = <SUBSYSTEM.WINDOWS_CUI: 3>
WINDOWS_GUI = <SUBSYSTEM.WINDOWS_GUI: 2>
XBOX = <SUBSYSTEM.XBOX: 14>
property name

DATA_DIRECTORY

class lief.PE.DATA_DIRECTORY(self: lief.PE.DATA_DIRECTORY, value: int) → None

Members:

EXPORT_TABLE

IMPORT_TABLE

RESOURCE_TABLE

EXCEPTION_TABLE

CERTIFICATE_TABLE

BASE_RELOCATION_TABLE

DEBUG

ARCHITECTURE

GLOBAL_PTR

TLS_TABLE

LOAD_CONFIG_TABLE

BOUND_IMPORT

IAT

DELAY_IMPORT_DESCRIPTOR

CLR_RUNTIME_HEADER

ARCHITECTURE = <DATA_DIRECTORY.ARCHITECTURE: 7>
BASE_RELOCATION_TABLE = <DATA_DIRECTORY.BASE_RELOCATION_TABLE: 5>
BOUND_IMPORT = <DATA_DIRECTORY.BOUND_IMPORT: 11>
CERTIFICATE_TABLE = <DATA_DIRECTORY.CERTIFICATE_TABLE: 4>
CLR_RUNTIME_HEADER = <DATA_DIRECTORY.CLR_RUNTIME_HEADER: 14>
DEBUG = <DATA_DIRECTORY.DEBUG: 6>
DELAY_IMPORT_DESCRIPTOR = <DATA_DIRECTORY.DELAY_IMPORT_DESCRIPTOR: 13>
EXCEPTION_TABLE = <DATA_DIRECTORY.EXCEPTION_TABLE: 3>
EXPORT_TABLE = <DATA_DIRECTORY.EXPORT_TABLE: 0>
GLOBAL_PTR = <DATA_DIRECTORY.GLOBAL_PTR: 8>
IAT = <DATA_DIRECTORY.IAT: 12>
IMPORT_TABLE = <DATA_DIRECTORY.IMPORT_TABLE: 1>
LOAD_CONFIG_TABLE = <DATA_DIRECTORY.LOAD_CONFIG_TABLE: 10>
RESOURCE_TABLE = <DATA_DIRECTORY.RESOURCE_TABLE: 2>
TLS_TABLE = <DATA_DIRECTORY.TLS_TABLE: 9>
property name

DLL_CHARACTERISTICS

class lief.PE.DLL_CHARACTERISTICS(self: lief.PE.DLL_CHARACTERISTICS, value: int) → None

Members:

HIGH_ENTROPY_VA

DYNAMIC_BASE

FORCE_INTEGRITY

NX_COMPAT

NO_ISOLATION

NO_SEH

NO_BIND

APPCONTAINER

WDM_DRIVER

GUARD_CF

TERMINAL_SERVER_AWARE

APPCONTAINER = <DLL_CHARACTERISTICS.APPCONTAINER: 4096>
DYNAMIC_BASE = <DLL_CHARACTERISTICS.DYNAMIC_BASE: 64>
FORCE_INTEGRITY = <DLL_CHARACTERISTICS.FORCE_INTEGRITY: 128>
GUARD_CF = <DLL_CHARACTERISTICS.GUARD_CF: 16384>
HIGH_ENTROPY_VA = <DLL_CHARACTERISTICS.HIGH_ENTROPY_VA: 32>
NO_BIND = <DLL_CHARACTERISTICS.NO_BIND: 2048>
NO_ISOLATION = <DLL_CHARACTERISTICS.NO_ISOLATION: 512>
NO_SEH = <DLL_CHARACTERISTICS.NO_SEH: 1024>
NX_COMPAT = <DLL_CHARACTERISTICS.NX_COMPAT: 256>
TERMINAL_SERVER_AWARE = <DLL_CHARACTERISTICS.TERMINAL_SERVER_AWARE: 32768>
WDM_DRIVER = <DLL_CHARACTERISTICS.WDM_DRIVER: 8192>
property name

SECTION_CHARACTERISTICS

class lief.PE.SECTION_CHARACTERISTICS(self: lief.PE.SECTION_CHARACTERISTICS, value: int) → None

Members:

TYPE_NO_PAD

CNT_CODE

CNT_INITIALIZED_DATA

CNT_UNINITIALIZED_DATA

LNK_OTHER

LNK_INFO

LNK_REMOVE

LNK_COMDAT

GPREL

MEM_PURGEABLE

MEM_16BIT

MEM_LOCKED

MEM_PRELOAD

ALIGN_1BYTES

ALIGN_2BYTES

ALIGN_4BYTES

ALIGN_8BYTES

ALIGN_16BYTES

ALIGN_32BYTES

ALIGN_64BYTES

ALIGN_128BYTES

ALIGN_256BYTES

ALIGN_512BYTES

ALIGN_1024BYTES

ALIGN_2048BYTES

ALIGN_4096BYTES

ALIGN_8192BYTES

LNK_NRELOC_OVFL

MEM_DISCARDABLE

MEM_NOT_CACHED

MEM_NOT_PAGED

MEM_SHARED

MEM_EXECUTE

MEM_READ

MEM_WRITE

ALIGN_1024BYTES = <SECTION_CHARACTERISTICS.ALIGN_1024BYTES: 11534336>
ALIGN_128BYTES = <SECTION_CHARACTERISTICS.ALIGN_128BYTES: 8388608>
ALIGN_16BYTES = <SECTION_CHARACTERISTICS.ALIGN_16BYTES: 5242880>
ALIGN_1BYTES = <SECTION_CHARACTERISTICS.ALIGN_1BYTES: 1048576>
ALIGN_2048BYTES = <SECTION_CHARACTERISTICS.ALIGN_2048BYTES: 12582912>
ALIGN_256BYTES = <SECTION_CHARACTERISTICS.ALIGN_256BYTES: 9437184>
ALIGN_2BYTES = <SECTION_CHARACTERISTICS.ALIGN_2BYTES: 2097152>
ALIGN_32BYTES = <SECTION_CHARACTERISTICS.ALIGN_32BYTES: 6291456>
ALIGN_4096BYTES = <SECTION_CHARACTERISTICS.ALIGN_4096BYTES: 13631488>
ALIGN_4BYTES = <SECTION_CHARACTERISTICS.ALIGN_4BYTES: 3145728>
ALIGN_512BYTES = <SECTION_CHARACTERISTICS.ALIGN_512BYTES: 10485760>
ALIGN_64BYTES = <SECTION_CHARACTERISTICS.ALIGN_64BYTES: 7340032>
ALIGN_8192BYTES = <SECTION_CHARACTERISTICS.ALIGN_8192BYTES: 14680064>
ALIGN_8BYTES = <SECTION_CHARACTERISTICS.ALIGN_8BYTES: 4194304>
CNT_CODE = <SECTION_CHARACTERISTICS.CNT_CODE: 32>
CNT_INITIALIZED_DATA = <SECTION_CHARACTERISTICS.CNT_INITIALIZED_DATA: 64>
CNT_UNINITIALIZED_DATA = <SECTION_CHARACTERISTICS.CNT_UNINITIALIZED_DATA: 128>
GPREL = <SECTION_CHARACTERISTICS.GPREL: 32768>
LNK_COMDAT = <SECTION_CHARACTERISTICS.LNK_COMDAT: 4096>
LNK_INFO = <SECTION_CHARACTERISTICS.LNK_INFO: 512>
LNK_NRELOC_OVFL = <SECTION_CHARACTERISTICS.LNK_NRELOC_OVFL: 16777216>
LNK_OTHER = <SECTION_CHARACTERISTICS.LNK_OTHER: 256>
LNK_REMOVE = <SECTION_CHARACTERISTICS.LNK_REMOVE: 2048>
MEM_16BIT = <SECTION_CHARACTERISTICS.MEM_16BIT: 131072>
MEM_DISCARDABLE = <SECTION_CHARACTERISTICS.MEM_DISCARDABLE: 33554432>
MEM_EXECUTE = <SECTION_CHARACTERISTICS.MEM_EXECUTE: 536870912>
MEM_LOCKED = <SECTION_CHARACTERISTICS.MEM_LOCKED: 262144>
MEM_NOT_CACHED = <SECTION_CHARACTERISTICS.MEM_NOT_CACHED: 67108864>
MEM_NOT_PAGED = <SECTION_CHARACTERISTICS.MEM_NOT_PAGED: 134217728>
MEM_PRELOAD = <SECTION_CHARACTERISTICS.MEM_PRELOAD: 524288>
MEM_PURGEABLE = <SECTION_CHARACTERISTICS.MEM_PURGEABLE: 65536>
MEM_READ = <SECTION_CHARACTERISTICS.MEM_READ: 1073741824>
MEM_SHARED = <SECTION_CHARACTERISTICS.MEM_SHARED: 268435456>
MEM_WRITE = <SECTION_CHARACTERISTICS.MEM_WRITE: 2147483648>
TYPE_NO_PAD = <SECTION_CHARACTERISTICS.TYPE_NO_PAD: 8>
property name

SECTION_TYPES

class lief.PE.SECTION_TYPES(self: lief.PE.SECTION_TYPES, value: int) → None

Members:

TEXT

TLS

IDATA

DATA

BSS

RESOURCE

RELOCATION

EXPORT

UNKNOWN

BSS = <SECTION_TYPES.BSS: 4>
DATA = <SECTION_TYPES.DATA: 3>
EXPORT = <SECTION_TYPES.EXPORT: 7>
IDATA = <SECTION_TYPES.IDATA: 2>
RELOCATION = <SECTION_TYPES.RELOCATION: 6>
RESOURCE = <SECTION_TYPES.RESOURCE: 5>
TEXT = <SECTION_TYPES.TEXT: 0>
TLS_ = <SECTION_TYPES.TLS_: 1>
UNKNOWN = <SECTION_TYPES.UNKNOWN: 10>
property name

SYMBOL_BASE_TYPES

class lief.PE.SYMBOL_BASE_TYPES(self: lief.PE.SYMBOL_BASE_TYPES, value: int) → None

Members:

NULL

VOID

CHAR

SHORT

INT

LONG

FLOAT

DOUBLE

STRUCT

UNION

ENUM

MOE

BYTE

WORD

UINT

DWORD

BYTE = <SYMBOL_BASE_TYPES.BYTE: 12>
CHAR = <SYMBOL_BASE_TYPES.CHAR: 2>
DOUBLE = <SYMBOL_BASE_TYPES.DOUBLE: 7>
DWORD = <SYMBOL_BASE_TYPES.DWORD: 15>
ENUM = <SYMBOL_BASE_TYPES.ENUM: 10>
FLOAT = <SYMBOL_BASE_TYPES.FLOAT: 6>
INT = <SYMBOL_BASE_TYPES.INT: 4>
LONG = <SYMBOL_BASE_TYPES.LONG: 5>
MOE = <SYMBOL_BASE_TYPES.MOE: 11>
NULL = <SYMBOL_BASE_TYPES.NULL: 0>
SHORT = <SYMBOL_BASE_TYPES.SHORT: 3>
STRUCT = <SYMBOL_BASE_TYPES.STRUCT: 8>
UINT = <SYMBOL_BASE_TYPES.UINT: 14>
UNION = <SYMBOL_BASE_TYPES.UNION: 9>
VOID = <SYMBOL_BASE_TYPES.VOID: 1>
WORD = <SYMBOL_BASE_TYPES.WORD: 13>
property name

SYMBOL_COMPLEX_TYPES

class lief.PE.SYMBOL_COMPLEX_TYPES(self: lief.PE.SYMBOL_COMPLEX_TYPES, value: int) → None

Members:

NULL

POINTER

FUNCTION

ARRAY

COMPLEX_TYPE_SHIFT

ARRAY = <SYMBOL_COMPLEX_TYPES.ARRAY: 3>
COMPLEX_TYPE_SHIFT = <SYMBOL_COMPLEX_TYPES.COMPLEX_TYPE_SHIFT: 4>
FUNCTION = <SYMBOL_COMPLEX_TYPES.FUNCTION: 2>
NULL = <SYMBOL_COMPLEX_TYPES.NULL: 0>
POINTER = <SYMBOL_COMPLEX_TYPES.POINTER: 1>
property name

SYMBOL_SECTION_NUMBER

class lief.PE.SYMBOL_SECTION_NUMBER(self: lief.PE.SYMBOL_SECTION_NUMBER, value: int) → None

Members:

DEBUG

ABSOLUTE

UNDEFINED

ABSOLUTE = <SYMBOL_SECTION_NUMBER.ABSOLUTE: -1>
DEBUG = <SYMBOL_SECTION_NUMBER.DEBUG: -2>
UNDEFINED = <SYMBOL_SECTION_NUMBER.UNDEFINED: 0>
property name

SYMBOL_STORAGE_CLASS

class lief.PE.SYMBOL_STORAGE_CLASS(self: lief.PE.SYMBOL_STORAGE_CLASS, value: int) → None

Members:

END_OF_FUNCTION

NULL

AUTOMATIC

EXTERNAL

STATIC

REGISTER

EXTERNAL_DEF

LABEL

UNDEFINED_LABEL

MEMBER_OF_STRUCT

UNION_TAG

TYPE_DEFINITION

UDEFINED_STATIC

ENUM_TAG

MEMBER_OF_ENUM

REGISTER_PARAM

BIT_FIELD

BLOCK

FUNCTION

END_OF_STRUCT

FILE

SECTION

WEAK_EXTERNAL

CLR_TOKEN

AUTOMATIC = <SYMBOL_STORAGE_CLASS.AUTOMATIC: 1>
BIT_FIELD = <SYMBOL_STORAGE_CLASS.BIT_FIELD: 18>
BLOCK = <SYMBOL_STORAGE_CLASS.BLOCK: 100>
CLR_TOKEN = <SYMBOL_STORAGE_CLASS.CLR_TOKEN: 107>
END_OF_FUNCTION = <SYMBOL_STORAGE_CLASS.END_OF_FUNCTION: -1>
END_OF_STRUCT = <SYMBOL_STORAGE_CLASS.END_OF_STRUCT: 102>
ENUM_TAG = <SYMBOL_STORAGE_CLASS.ENUM_TAG: 15>
EXTERNAL = <SYMBOL_STORAGE_CLASS.EXTERNAL: 2>
EXTERNAL_DEF = <SYMBOL_STORAGE_CLASS.EXTERNAL_DEF: 5>
FILE = <SYMBOL_STORAGE_CLASS.FILE: 103>
FUNCTION = <SYMBOL_STORAGE_CLASS.FUNCTION: 101>
LABEL = <SYMBOL_STORAGE_CLASS.LABEL: 6>
MEMBER_OF_ENUM = <SYMBOL_STORAGE_CLASS.MEMBER_OF_ENUM: 16>
MEMBER_OF_STRUCT = <SYMBOL_STORAGE_CLASS.MEMBER_OF_STRUCT: 8>
NULL = <SYMBOL_STORAGE_CLASS.NULL: 0>
REGISTER = <SYMBOL_STORAGE_CLASS.REGISTER: 4>
REGISTER_PARAM = <SYMBOL_STORAGE_CLASS.REGISTER_PARAM: 17>
SECTION = <SYMBOL_STORAGE_CLASS.SECTION: 104>
STATIC = <SYMBOL_STORAGE_CLASS.STATIC: 3>
TYPE_DEFINITION = <SYMBOL_STORAGE_CLASS.TYPE_DEFINITION: 13>
UDEFINED_STATIC = <SYMBOL_STORAGE_CLASS.UDEFINED_STATIC: 14>
UNDEFINED_LABEL = <SYMBOL_STORAGE_CLASS.UNDEFINED_LABEL: 7>
UNION_TAG = <SYMBOL_STORAGE_CLASS.UNION_TAG: 12>
WEAK_EXTERNAL = <SYMBOL_STORAGE_CLASS.WEAK_EXTERNAL: 105>
property name

RELOCATIONS_BASE_TYPES

class lief.PE.RELOCATIONS_BASE_TYPES(self: lief.PE.RELOCATIONS_BASE_TYPES, value: int) → None

Members:

ABSOLUTE

HIGH

LOW

HIGHLOW

HIGHADJ

MIPS_JMPADDR | ARM_MOV32A | ARM_MOV32 | RISCV_HI20

ARM_MOV32A

ARM_MOV32

RISCV_HI20

ARM_MOV32T

THUMB_MOV32

RISCV_LOW12I

RISCV_LOW12S

SECTION

REL | ARM_MOV32T | THUMB_MOV32 | RISCV_LOW12I

MIPS_JMPADDR16

IA64_IMM64

DIR64

HIGH3ADJ

ABSOLUTE = <RELOCATIONS_BASE_TYPES.ABSOLUTE: 0>
ARM_MOV32 = <RELOCATIONS_BASE_TYPES.MIPS_JMPADDR | ARM_MOV32A | ARM_MOV32 | RISCV_HI20: 5>
ARM_MOV32A = <RELOCATIONS_BASE_TYPES.MIPS_JMPADDR | ARM_MOV32A | ARM_MOV32 | RISCV_HI20: 5>
ARM_MOV32T = <RELOCATIONS_BASE_TYPES.ARM_MOV32T: 7>
DIR64 = <RELOCATIONS_BASE_TYPES.DIR64: 10>
HIGH = <RELOCATIONS_BASE_TYPES.HIGH: 1>
HIGH3ADJ = <RELOCATIONS_BASE_TYPES.HIGH3ADJ: 11>
HIGHADJ = <RELOCATIONS_BASE_TYPES.HIGHADJ: 4>
HIGHLOW = <RELOCATIONS_BASE_TYPES.HIGHLOW: 3>
IA64_IMM64 = <RELOCATIONS_BASE_TYPES.MIPS_JMPADDR16: 9>
LOW = <RELOCATIONS_BASE_TYPES.LOW: 2>
MIPS_JMPADDR16 = <RELOCATIONS_BASE_TYPES.MIPS_JMPADDR16: 9>
RISCV_HI20 = <RELOCATIONS_BASE_TYPES.MIPS_JMPADDR | ARM_MOV32A | ARM_MOV32 | RISCV_HI20: 5>
RISCV_LOW12I = <RELOCATIONS_BASE_TYPES.ARM_MOV32T: 7>
RISCV_LOW12S = <RELOCATIONS_BASE_TYPES.RISCV_LOW12S: 8>
SECTION = <RELOCATIONS_BASE_TYPES.SECTION: 6>
THUMB_MOV32 = <RELOCATIONS_BASE_TYPES.ARM_MOV32T: 7>
property name

DEBUG_TYPES

class lief.PE.DEBUG_TYPES(self: lief.PE.DEBUG_TYPES, value: int) → None

Members:

UNKNOWN

COFF

CODEVIEW

FPO

MISC

EXCEPTION

FIXUP

OMAP_TO_SRC

OMAP_FROM_SRC

BORLAND

CLSID

VC_FEATURE

POGO

ILTCG

MPX

REPRO

EX_DLLCHARACTERISTICS

BORLAND = <DEBUG_TYPES.BORLAND: 9>
CLSID = <DEBUG_TYPES.CLSID: 11>
CODEVIEW = <DEBUG_TYPES.CODEVIEW: 2>
COFF = <DEBUG_TYPES.COFF: 1>
EXCEPTION = <DEBUG_TYPES.EXCEPTION: 5>
EX_DLLCHARACTERISTICS = <DEBUG_TYPES.EX_DLLCHARACTERISTICS: 20>
FIXUP = <DEBUG_TYPES.FIXUP: 6>
FPO = <DEBUG_TYPES.FPO: 3>
ILTCG = <DEBUG_TYPES.ILTCG: 14>
MISC = <DEBUG_TYPES.MISC: 4>
MPX = <DEBUG_TYPES.MPX: 15>
OMAP_FROM_SRC = <DEBUG_TYPES.OMAP_FROM_SRC: 8>
OMAP_TO_SRC = <DEBUG_TYPES.OMAP_TO_SRC: 7>
POGO = <DEBUG_TYPES.POGO: 13>
REPRO = <DEBUG_TYPES.REPRO: 16>
UNKNOWN = <DEBUG_TYPES.UNKNOWN: 0>
VC_FEATURE = <DEBUG_TYPES.VC_FEATURE: 12>
property name

RESOURCE_TYPES

class lief.PE.RESOURCE_TYPES(self: lief.PE.RESOURCE_TYPES, value: int) → None

Members:

CURSOR

BITMAP

ICON

MENU

DIALOG

STRING

FONTDIR

FONT

ACCELERATOR

RCDATA

MESSAGETABLE

GROUP_CURSOR

GROUP_ICON

VERSION

DLGINCLUDE

PLUGPLAY

VXD

ANICURSOR

ANIICON

HTML

MANIFEST

ACCELERATOR = <RESOURCE_TYPES.ACCELERATOR: 9>
ANICURSOR = <RESOURCE_TYPES.ANICURSOR: 21>
ANIICON = <RESOURCE_TYPES.ANIICON: 22>
BITMAP = <RESOURCE_TYPES.BITMAP: 2>
CURSOR = <RESOURCE_TYPES.CURSOR: 1>
DIALOG = <RESOURCE_TYPES.DIALOG: 5>
DLGINCLUDE = <RESOURCE_TYPES.DLGINCLUDE: 17>
FONT = <RESOURCE_TYPES.FONT: 8>
FONTDIR = <RESOURCE_TYPES.FONTDIR: 7>
GROUP_CURSOR = <RESOURCE_TYPES.GROUP_CURSOR: 12>
GROUP_ICON = <RESOURCE_TYPES.GROUP_ICON: 14>
HTML = <RESOURCE_TYPES.HTML: 23>
ICON = <RESOURCE_TYPES.ICON: 3>
MANIFEST = <RESOURCE_TYPES.MANIFEST: 24>
MENU = <RESOURCE_TYPES.MENU: 4>
MESSAGETABLE = <RESOURCE_TYPES.MESSAGETABLE: 11>
PLUGPLAY = <RESOURCE_TYPES.PLUGPLAY: 19>
RCDATA = <RESOURCE_TYPES.RCDATA: 10>
STRING = <RESOURCE_TYPES.STRING: 6>
VERSION = <RESOURCE_TYPES.VERSION: 16>
VXD = <RESOURCE_TYPES.VXD: 20>
property name

RESOURCE_LANGS

class lief.PE.RESOURCE_LANGS(self: lief.PE.RESOURCE_LANGS, value: int) → None

Members:

NEUTRAL

INVARIANT

AFRIKAANS

ALBANIAN

ARABIC

ARMENIAN

ASSAMESE

AZERI

BASQUE

BELARUSIAN

BANGLA

BULGARIAN

CATALAN

CHINESE

CROATIAN

BOSNIAN

CZECH

DANISH

DIVEHI

DUTCH

ENGLISH

ESTONIAN

FAEROESE

FARSI

FINNISH

FRENCH

GALICIAN

GEORGIAN

GERMAN

GREEK

GUJARATI

HEBREW

HINDI

HUNGARIAN

ICELANDIC

INDONESIAN

ITALIAN

JAPANESE

KANNADA

KASHMIRI

KAZAK

KONKANI

KOREAN

KYRGYZ

LATVIAN

LITHUANIAN

MACEDONIAN

MALAY

MALAYALAM

MANIPURI

MARATHI

MONGOLIAN

NEPALI

NORWEGIAN

ORIYA

POLISH

PORTUGUESE

PUNJABI

ROMANIAN

RUSSIAN

SANSKRIT

SERBIAN

SINDHI

SLOVAK

SLOVENIAN

SPANISH

SWAHILI

SWEDISH

SYRIAC

TAMIL

TATAR

TELUGU

THAI

TURKISH

UKRAINIAN

URDU

UZBEK

VIETNAMESE

GAELIC

MALTESE

MAORI

RHAETO_ROMANCE

SAMI

SORBIAN

SUTU

TSONGA

TSWANA

VENDA

XHOSA

ZULU

ESPERANTO

WALON

CORNISH

WELSH

BRETON

INUKTITUT

IRISH

LOWER_SORBIAN

PULAR

QUECHUA

TAMAZIGHT

TIGRINYA

VALENCIAN

AFRIKAANS = <RESOURCE_LANGS.AFRIKAANS: 54>
ALBANIAN = <RESOURCE_LANGS.ALBANIAN: 28>
ARABIC = <RESOURCE_LANGS.ARABIC: 1>
ARMENIAN = <RESOURCE_LANGS.ARMENIAN: 43>
ASSAMESE = <RESOURCE_LANGS.ASSAMESE: 77>
AZERI = <RESOURCE_LANGS.AZERI: 44>
BANGLA = <RESOURCE_LANGS.BANGLA: 69>
BASQUE = <RESOURCE_LANGS.BASQUE: 45>
BELARUSIAN = <RESOURCE_LANGS.BELARUSIAN: 35>
BOSNIAN = <RESOURCE_LANGS.CROATIAN: 26>
BRETON = <RESOURCE_LANGS.BRETON: 147>
BULGARIAN = <RESOURCE_LANGS.BULGARIAN: 2>
CATALAN = <RESOURCE_LANGS.CATALAN: 3>
CHINESE = <RESOURCE_LANGS.CHINESE: 4>
CORNISH = <RESOURCE_LANGS.CORNISH: 145>
CROATIAN = <RESOURCE_LANGS.CROATIAN: 26>
CZECH = <RESOURCE_LANGS.CZECH: 5>
DANISH = <RESOURCE_LANGS.DANISH: 6>
DIVEHI = <RESOURCE_LANGS.DIVEHI: 101>
DUTCH = <RESOURCE_LANGS.DUTCH: 19>
ENGLISH = <RESOURCE_LANGS.ENGLISH: 9>
ESPERANTO = <RESOURCE_LANGS.ESPERANTO: 143>
ESTONIAN = <RESOURCE_LANGS.ESTONIAN: 37>
FAEROESE = <RESOURCE_LANGS.FAEROESE: 56>
FARSI = <RESOURCE_LANGS.FARSI: 41>
FINNISH = <RESOURCE_LANGS.FINNISH: 11>
FRENCH = <RESOURCE_LANGS.FRENCH: 12>
GAELIC = <RESOURCE_LANGS.GAELIC: 60>
GALICIAN = <RESOURCE_LANGS.GALICIAN: 86>
GEORGIAN = <RESOURCE_LANGS.GEORGIAN: 55>
GERMAN = <RESOURCE_LANGS.GERMAN: 7>
GREEK = <RESOURCE_LANGS.GREEK: 8>
GUJARATI = <RESOURCE_LANGS.GUJARATI: 71>
HEBREW = <RESOURCE_LANGS.HEBREW: 13>
HINDI = <RESOURCE_LANGS.HINDI: 57>
HUNGARIAN = <RESOURCE_LANGS.HUNGARIAN: 14>
ICELANDIC = <RESOURCE_LANGS.ICELANDIC: 15>
INDONESIAN = <RESOURCE_LANGS.INDONESIAN: 33>
INUKTITUT = <RESOURCE_LANGS.INUKTITUT: 93>
INVARIANT = <RESOURCE_LANGS.INVARIANT: 127>
IRISH = <RESOURCE_LANGS.GAELIC: 60>
ITALIAN = <RESOURCE_LANGS.ITALIAN: 16>
JAPANESE = <RESOURCE_LANGS.JAPANESE: 17>
KANNADA = <RESOURCE_LANGS.KANNADA: 75>
KASHMIRI = <RESOURCE_LANGS.KASHMIRI: 96>
KAZAK = <RESOURCE_LANGS.KAZAK: 63>
KONKANI = <RESOURCE_LANGS.KONKANI: 87>
KOREAN = <RESOURCE_LANGS.KOREAN: 18>
KYRGYZ = <RESOURCE_LANGS.KYRGYZ: 64>
LATVIAN = <RESOURCE_LANGS.LATVIAN: 38>
LITHUANIAN = <RESOURCE_LANGS.LITHUANIAN: 39>
LOWER_SORBIAN = <RESOURCE_LANGS.SORBIAN: 46>
MACEDONIAN = <RESOURCE_LANGS.MACEDONIAN: 47>
MALAY = <RESOURCE_LANGS.MALAY: 62>
MALAYALAM = <RESOURCE_LANGS.MALAYALAM: 76>
MALTESE = <RESOURCE_LANGS.MALTESE: 58>
MANIPURI = <RESOURCE_LANGS.MANIPURI: 88>
MAORI = <RESOURCE_LANGS.MAORI: 40>
MARATHI = <RESOURCE_LANGS.MARATHI: 78>
MONGOLIAN = <RESOURCE_LANGS.MONGOLIAN: 80>
NEPALI = <RESOURCE_LANGS.NEPALI: 97>
NEUTRAL = <RESOURCE_LANGS.NEUTRAL: 0>
NORWEGIAN = <RESOURCE_LANGS.NORWEGIAN: 20>
ORIYA = <RESOURCE_LANGS.ORIYA: 72>
POLISH = <RESOURCE_LANGS.POLISH: 21>
PORTUGUESE = <RESOURCE_LANGS.PORTUGUESE: 22>
PULAR = <RESOURCE_LANGS.PULAR: 103>
PUNJABI = <RESOURCE_LANGS.PUNJABI: 70>
QUECHUA = <RESOURCE_LANGS.QUECHUA: 107>
RHAETO_ROMANCE = <RESOURCE_LANGS.RHAETO_ROMANCE: 23>
ROMANIAN = <RESOURCE_LANGS.ROMANIAN: 24>
RUSSIAN = <RESOURCE_LANGS.RUSSIAN: 25>
SAMI = <RESOURCE_LANGS.SAMI: 59>
SANSKRIT = <RESOURCE_LANGS.SANSKRIT: 79>
SERBIAN = <RESOURCE_LANGS.CROATIAN: 26>
SINDHI = <RESOURCE_LANGS.SINDHI: 89>
SLOVAK = <RESOURCE_LANGS.SLOVAK: 27>
SLOVENIAN = <RESOURCE_LANGS.SLOVENIAN: 36>
SORBIAN = <RESOURCE_LANGS.SORBIAN: 46>
SPANISH = <RESOURCE_LANGS.SPANISH: 10>
SUTU = <RESOURCE_LANGS.SUTU: 48>
SWAHILI = <RESOURCE_LANGS.SWAHILI: 65>
SWEDISH = <RESOURCE_LANGS.SWEDISH: 29>
SYRIAC = <RESOURCE_LANGS.SYRIAC: 90>
TAMAZIGHT = <RESOURCE_LANGS.TAMAZIGHT: 95>
TAMIL = <RESOURCE_LANGS.TAMIL: 73>
TATAR = <RESOURCE_LANGS.TATAR: 68>
TELUGU = <RESOURCE_LANGS.TELUGU: 74>
THAI = <RESOURCE_LANGS.THAI: 30>
TIGRINYA = <RESOURCE_LANGS.TIGRINYA: 115>
TSONGA = <RESOURCE_LANGS.TSONGA: 49>
TSWANA = <RESOURCE_LANGS.TSWANA: 50>
TURKISH = <RESOURCE_LANGS.TURKISH: 31>
UKRAINIAN = <RESOURCE_LANGS.UKRAINIAN: 34>
URDU = <RESOURCE_LANGS.URDU: 32>
UZBEK = <RESOURCE_LANGS.UZBEK: 67>
VALENCIAN = <RESOURCE_LANGS.CATALAN: 3>
VENDA = <RESOURCE_LANGS.VENDA: 51>
VIETNAMESE = <RESOURCE_LANGS.VIETNAMESE: 42>
WALON = <RESOURCE_LANGS.WALON: 144>
WELSH = <RESOURCE_LANGS.WELSH: 146>
XHOSA = <RESOURCE_LANGS.XHOSA: 52>
ZULU = <RESOURCE_LANGS.ZULU: 53>
property name

RESOURCE_SUBLANGS

class lief.PE.RESOURCE_SUBLANGS(self: lief.PE.RESOURCE_SUBLANGS, value: int) → None

Members:

AFRIKAANS_SOUTH_AFRICA

ALBANIAN_ALBANIA

ALSATIAN_FRANCE

AMHARIC_ETHIOPIA

ARABIC_ALGERIA

ARABIC_BAHRAIN

ARABIC_EGYPT

ARABIC_IRAQ

ARABIC_JORDAN

ARABIC_KUWAIT

ARABIC_LEBANON

ARABIC_LIBYA

ARABIC_MOROCCO

ARABIC_OMAN

ARABIC_QATAR

ARABIC_SAUDI_ARABIA

ARABIC_SYRIA

ARABIC_TUNISIA

ARABIC_UAE

ARABIC_YEMEN

ARMENIAN_ARMENIA

ASSAMESE_INDIA

AZERI_CYRILLIC

AZERI_LATIN

BASHKIR_RUSSIA

BASQUE_BASQUE

BELARUSIAN_BELARUS

BANGLA_BANGLADESH

BANGLA_INDIA

BOSNIAN_BOSNIA_HERZEGOVINA_CYRILLIC

BOSNIAN_BOSNIA_HERZEGOVINA_LATIN

BRETON_FRANCE

BULGARIAN_BULGARIA

CATALAN_CATALAN

CHINESE_HONGKONG

CHINESE_MACAU

CHINESE_SIMPLIFIED

CHINESE_SINGAPORE

CHINESE_TRADITIONAL

CORSICAN_FRANCE

CROATIAN_BOSNIA_HERZEGOVINA_LATIN

CROATIAN_CROATIA

CUSTOM_DEFAULT

CUSTOM_UNSPECIFIED

CZECH_CZECH_REPUBLIC

DANISH_DENMARK

DARI_AFGHANISTAN

DEFAULT

DIVEHI_MALDIVES

DUTCH_BELGIAN

DUTCH

ENGLISH_AUS

ENGLISH_BELIZE

ENGLISH_CAN

ENGLISH_CARIBBEAN

ENGLISH_EIRE

ENGLISH_INDIA

ENGLISH_JAMAICA

ENGLISH_MALAYSIA

ENGLISH_NZ

ENGLISH_PHILIPPINES

ENGLISH_SINGAPORE

ENGLISH_SOUTH_AFRICA

ENGLISH_TRINIDAD

ENGLISH_UK

ENGLISH_US

ENGLISH_ZIMBABWE

ENGLISH_IRELAND

ESTONIAN_ESTONIA

FAEROESE_FAROE_ISLANDS

FILIPINO_PHILIPPINES

FINNISH_FINLAND

FRENCH_BELGIAN

FRENCH_CANADIAN

FRENCH_LUXEMBOURG

FRENCH_MONACO

FRENCH_SWISS

FRENCH

FRISIAN_NETHERLANDS

GALICIAN_GALICIAN

GEORGIAN_GEORGIA

GERMAN_AUSTRIAN

GERMAN_LIECHTENSTEIN

GERMAN_LUXEMBOURG

GERMAN_SWISS

GERMAN

GREEK_GREECE

GREENLANDIC_GREENLAND

GUJARATI_INDIA

HAUSA_NIGERIA_LATIN

HEBREW_ISRAEL

HINDI_INDIA

HUNGARIAN_HUNGARY

ICELANDIC_ICELAND

IGBO_NIGERIA

INDONESIAN_INDONESIA

INUKTITUT_CANADA_LATIN

INUKTITUT_CANADA

IRISH_IRELAND

ITALIAN_SWISS

ITALIAN

JAPANESE_JAPAN

KANNADA_INDIA

KASHMIRI_INDIA

KASHMIRI_SASIA

KAZAK_KAZAKHSTAN

KHMER_CAMBODIA

KICHE_GUATEMALA

KINYARWANDA_RWANDA

KONKANI_INDIA

KOREAN

KYRGYZ_KYRGYZSTAN

LAO_LAO

LATVIAN_LATVIA

LITHUANIAN_CLASSIC

LITHUANIAN

LOWER_SORBIAN_GERMANY

LUXEMBOURGISH_LUXEMBOURG

MACEDONIAN_MACEDONIA

MALAY_BRUNEI_DARUSSALAM

MALAY_MALAYSIA

MALAYALAM_INDIA

MALTESE_MALTA

MAORI_NEW_ZEALAND

MAPUDUNGUN_CHILE

MARATHI_INDIA

MOHAWK_MOHAWK

MONGOLIAN_CYRILLIC_MONGOLIA

MONGOLIAN_PRC

NEPALI_INDIA

NEPALI_NEPAL

NEUTRAL

NORWEGIAN_BOKMAL

NORWEGIAN_NYNORSK

OCCITAN_FRANCE

ORIYA_INDIA

PASHTO_AFGHANISTAN

PERSIAN_IRAN

POLISH_POLAND

PORTUGUESE_BRAZILIAN

PORTUGUESE

PUNJABI_INDIA

QUECHUA_BOLIVIA

QUECHUA_ECUADOR

QUECHUA_PERU

ROMANIAN_ROMANIA

ROMANSH_SWITZERLAND

RUSSIAN_RUSSIA

SAMI_INARI_FINLAND

SAMI_LULE_NORWAY

SAMI_LULE_SWEDEN

SAMI_NORTHERN_FINLAND

SAMI_NORTHERN_NORWAY

SAMI_NORTHERN_SWEDEN

SAMI_SKOLT_FINLAND

SAMI_SOUTHERN_NORWAY

SAMI_SOUTHERN_SWEDEN

SANSKRIT_INDIA

SERBIAN_BOSNIA_HERZEGOVINA_CYRILLIC

SERBIAN_BOSNIA_HERZEGOVINA_LATIN

SERBIAN_CROATIA

SERBIAN_CYRILLIC

SERBIAN_LATIN

SINDHI_AFGHANISTAN

SINDHI_INDIA

SINDHI_PAKISTAN

SINHALESE_SRI_LANKA

SLOVAK_SLOVAKIA

SLOVENIAN_SLOVENIA

SOTHO_NORTHERN_SOUTH_AFRICA

SPANISH_ARGENTINA

SPANISH_BOLIVIA

SPANISH_CHILE

SPANISH_COLOMBIA

SPANISH_COSTA_RICA

SPANISH_DOMINICAN_REPUBLIC

SPANISH_ECUADOR

SPANISH_EL_SALVADOR

SPANISH_GUATEMALA

SPANISH_HONDURAS

SPANISH_MEXICAN

SPANISH_MODERN

SPANISH_NICARAGUA

SPANISH_PANAMA

SPANISH_PARAGUAY

SPANISH_PERU

SPANISH_PUERTO_RICO

SPANISH_URUGUAY

SPANISH_US

SPANISH_VENEZUELA

SPANISH

SWAHILI_KENYA

SWEDISH_FINLAND

SWEDISH

SYRIAC_SYRIA

SYS_DEFAULT

TAJIK_TAJIKISTAN

TAMAZIGHT_ALGERIA_LATIN

TAMIL_INDIA

TATAR_RUSSIA

TELUGU_INDIA

THAI_THAILAND

TIBETAN_PRC

TIGRIGNA_ERITREA

TSWANA_SOUTH_AFRICA

TURKISH_TURKEY

TURKMEN_TURKMENISTAN

UI_CUSTOM_DEFAULT

UIGHUR_PRC

UKRAINIAN_UKRAINE

UPPER_SORBIAN_GERMANY

URDU_INDIA

URDU_PAKISTAN

UZBEK_CYRILLIC

UZBEK_LATIN

VIETNAMESE_VIETNAM

WELSH_UNITED_KINGDOM

WOLOF_SENEGAL

XHOSA_SOUTH_AFRICA

YAKUT_RUSSIA

YI_PRC

YORUBA_NIGERIA

ZULU_SOUTH_AFRICA

Out of range

PUNJABI_PAKISTAN

TSWANA_BOTSWANA

TAMIL_SRI_LANKA

TIGRINYA_ETHIOPIA

TIGRINYA_ERITREA

VALENCIAN_VALENCIA

AFRIKAANS_SOUTH_AFRICA = <RESOURCE_SUBLANGS.AFRIKAANS_SOUTH_AFRICA: 0>
ALBANIAN_ALBANIA = <RESOURCE_SUBLANGS.ALBANIAN_ALBANIA: 1>
ALSATIAN_FRANCE = <RESOURCE_SUBLANGS.ALSATIAN_FRANCE: 2>
AMHARIC_ETHIOPIA = <RESOURCE_SUBLANGS.AMHARIC_ETHIOPIA: 3>
ARABIC_ALGERIA = <RESOURCE_SUBLANGS.ARABIC_ALGERIA: 4>
ARABIC_BAHRAIN = <RESOURCE_SUBLANGS.ARABIC_BAHRAIN: 5>
ARABIC_EGYPT = <RESOURCE_SUBLANGS.ARABIC_EGYPT: 6>
ARABIC_IRAQ = <RESOURCE_SUBLANGS.ARABIC_IRAQ: 7>
ARABIC_JORDAN = <RESOURCE_SUBLANGS.ARABIC_JORDAN: 8>
ARABIC_KUWAIT = <RESOURCE_SUBLANGS.ARABIC_KUWAIT: 9>
ARABIC_LEBANON = <RESOURCE_SUBLANGS.ARABIC_LEBANON: 10>
ARABIC_LIBYA = <RESOURCE_SUBLANGS.ARABIC_LIBYA: 11>
ARABIC_MOROCCO = <RESOURCE_SUBLANGS.ARABIC_MOROCCO: 12>
ARABIC_OMAN = <RESOURCE_SUBLANGS.ARABIC_OMAN: 13>
ARABIC_QATAR = <RESOURCE_SUBLANGS.ARABIC_QATAR: 14>
ARABIC_SAUDI_ARABIA = <RESOURCE_SUBLANGS.ARABIC_SAUDI_ARABIA: 15>
ARABIC_SYRIA = <RESOURCE_SUBLANGS.ARABIC_SYRIA: 16>
ARABIC_TUNISIA = <RESOURCE_SUBLANGS.ARABIC_TUNISIA: 17>
ARABIC_UAE = <RESOURCE_SUBLANGS.ARABIC_UAE: 18>
ARABIC_YEMEN = <RESOURCE_SUBLANGS.ARABIC_YEMEN: 19>
ARMENIAN_ARMENIA = <RESOURCE_SUBLANGS.ARMENIAN_ARMENIA: 20>
ASSAMESE_INDIA = <RESOURCE_SUBLANGS.ASSAMESE_INDIA: 21>
AZERI_CYRILLIC = <RESOURCE_SUBLANGS.AZERI_CYRILLIC: 22>
AZERI_LATIN = <RESOURCE_SUBLANGS.AZERI_LATIN: 23>
BANGLA_BANGLADESH = <RESOURCE_SUBLANGS.BANGLA_BANGLADESH: 27>
BANGLA_INDIA = <RESOURCE_SUBLANGS.BANGLA_INDIA: 28>
BASHKIR_RUSSIA = <RESOURCE_SUBLANGS.BASHKIR_RUSSIA: 24>
BASQUE_BASQUE = <RESOURCE_SUBLANGS.BASQUE_BASQUE: 25>
BELARUSIAN_BELARUS = <RESOURCE_SUBLANGS.BELARUSIAN_BELARUS: 26>
BOSNIAN_BOSNIA_HERZEGOVINA_CYRILLIC = <RESOURCE_SUBLANGS.BOSNIAN_BOSNIA_HERZEGOVINA_CYRILLIC: 29>
BOSNIAN_BOSNIA_HERZEGOVINA_LATIN = <RESOURCE_SUBLANGS.BOSNIAN_BOSNIA_HERZEGOVINA_LATIN: 30>
BRETON_FRANCE = <RESOURCE_SUBLANGS.BRETON_FRANCE: 31>
BULGARIAN_BULGARIA = <RESOURCE_SUBLANGS.BULGARIAN_BULGARIA: 32>
CATALAN_CATALAN = <RESOURCE_SUBLANGS.CATALAN_CATALAN: 33>
CHINESE_HONGKONG = <RESOURCE_SUBLANGS.CHINESE_HONGKONG: 34>
CHINESE_MACAU = <RESOURCE_SUBLANGS.CHINESE_MACAU: 35>
CHINESE_SIMPLIFIED = <RESOURCE_SUBLANGS.CHINESE_SIMPLIFIED: 36>
CHINESE_SINGAPORE = <RESOURCE_SUBLANGS.CHINESE_SINGAPORE: 37>
CHINESE_TRADITIONAL = <RESOURCE_SUBLANGS.CHINESE_TRADITIONAL: 38>
CORSICAN_FRANCE = <RESOURCE_SUBLANGS.CORSICAN_FRANCE: 39>
CROATIAN_BOSNIA_HERZEGOVINA_LATIN = <RESOURCE_SUBLANGS.CROATIAN_BOSNIA_HERZEGOVINA_LATIN: 40>
CROATIAN_CROATIA = <RESOURCE_SUBLANGS.CROATIAN_CROATIA: 41>
CUSTOM_DEFAULT = <RESOURCE_SUBLANGS.CUSTOM_DEFAULT: 42>
CUSTOM_UNSPECIFIED = <RESOURCE_SUBLANGS.CUSTOM_UNSPECIFIED: 43>
CZECH_CZECH_REPUBLIC = <RESOURCE_SUBLANGS.CZECH_CZECH_REPUBLIC: 44>
DANISH_DENMARK = <RESOURCE_SUBLANGS.DANISH_DENMARK: 45>
DARI_AFGHANISTAN = <RESOURCE_SUBLANGS.DARI_AFGHANISTAN: 46>
DEFAULT = <RESOURCE_SUBLANGS.DEFAULT: 47>
DIVEHI_MALDIVES = <RESOURCE_SUBLANGS.DIVEHI_MALDIVES: 48>
DUTCH = <RESOURCE_SUBLANGS.DUTCH: 50>
DUTCH_BELGIAN = <RESOURCE_SUBLANGS.DUTCH_BELGIAN: 49>
ENGLISH_AUS = <RESOURCE_SUBLANGS.ENGLISH_AUS: 51>
ENGLISH_BELIZE = <RESOURCE_SUBLANGS.ENGLISH_BELIZE: 52>
ENGLISH_CAN = <RESOURCE_SUBLANGS.ENGLISH_CAN: 53>
ENGLISH_CARIBBEAN = <RESOURCE_SUBLANGS.ENGLISH_CARIBBEAN: 54>
ENGLISH_EIRE = <RESOURCE_SUBLANGS.ENGLISH_EIRE: 55>
ENGLISH_INDIA = <RESOURCE_SUBLANGS.ENGLISH_INDIA: 56>
ENGLISH_IRELAND = <RESOURCE_SUBLANGS.ENGLISH_IRELAND: 67>
ENGLISH_JAMAICA = <RESOURCE_SUBLANGS.ENGLISH_JAMAICA: 57>
ENGLISH_MALAYSIA = <RESOURCE_SUBLANGS.ENGLISH_MALAYSIA: 58>
ENGLISH_NZ = <RESOURCE_SUBLANGS.ENGLISH_NZ: 59>
ENGLISH_PHILIPPINES = <RESOURCE_SUBLANGS.ENGLISH_PHILIPPINES: 60>
ENGLISH_SINGAPORE = <RESOURCE_SUBLANGS.ENGLISH_SINGAPORE: 61>
ENGLISH_SOUTH_AFRICA = <RESOURCE_SUBLANGS.ENGLISH_SOUTH_AFRICA: 62>
ENGLISH_TRINIDAD = <RESOURCE_SUBLANGS.ENGLISH_TRINIDAD: 63>
ENGLISH_UK = <RESOURCE_SUBLANGS.ENGLISH_UK: 64>
ENGLISH_US = <RESOURCE_SUBLANGS.ENGLISH_US: 65>
ENGLISH_ZIMBABWE = <RESOURCE_SUBLANGS.ENGLISH_ZIMBABWE: 66>
ESTONIAN_ESTONIA = <RESOURCE_SUBLANGS.ESTONIAN_ESTONIA: 68>
FAEROESE_FAROE_ISLANDS = <RESOURCE_SUBLANGS.FAEROESE_FAROE_ISLANDS: 69>
FILIPINO_PHILIPPINES = <RESOURCE_SUBLANGS.FILIPINO_PHILIPPINES: 70>
FINNISH_FINLAND = <RESOURCE_SUBLANGS.FINNISH_FINLAND: 71>
FRENCH = <RESOURCE_SUBLANGS.FRENCH: 77>
FRENCH_BELGIAN = <RESOURCE_SUBLANGS.FRENCH_BELGIAN: 72>
FRENCH_CANADIAN = <RESOURCE_SUBLANGS.FRENCH_CANADIAN: 73>
FRENCH_LUXEMBOURG = <RESOURCE_SUBLANGS.FRENCH_LUXEMBOURG: 74>
FRENCH_MONACO = <RESOURCE_SUBLANGS.FRENCH_MONACO: 75>
FRENCH_SWISS = <RESOURCE_SUBLANGS.FRENCH_SWISS: 76>
FRISIAN_NETHERLANDS = <RESOURCE_SUBLANGS.FRISIAN_NETHERLANDS: 78>
GALICIAN_GALICIAN = <RESOURCE_SUBLANGS.GALICIAN_GALICIAN: 79>
GEORGIAN_GEORGIA = <RESOURCE_SUBLANGS.GEORGIAN_GEORGIA: 80>
GERMAN = <RESOURCE_SUBLANGS.GERMAN: 85>
GERMAN_AUSTRIAN = <RESOURCE_SUBLANGS.GERMAN_AUSTRIAN: 81>
GERMAN_LIECHTENSTEIN = <RESOURCE_SUBLANGS.GERMAN_LIECHTENSTEIN: 82>
GERMAN_LUXEMBOURG = <RESOURCE_SUBLANGS.GERMAN_LUXEMBOURG: 83>
GERMAN_SWISS = <RESOURCE_SUBLANGS.GERMAN_SWISS: 84>
GREEK_GREECE = <RESOURCE_SUBLANGS.GREEK_GREECE: 86>
GREENLANDIC_GREENLAND = <RESOURCE_SUBLANGS.GREENLANDIC_GREENLAND: 87>
GUJARATI_INDIA = <RESOURCE_SUBLANGS.GUJARATI_INDIA: 88>
HAUSA_NIGERIA_LATIN = <RESOURCE_SUBLANGS.HAUSA_NIGERIA_LATIN: 89>
HEBREW_ISRAEL = <RESOURCE_SUBLANGS.HEBREW_ISRAEL: 90>
HINDI_INDIA = <RESOURCE_SUBLANGS.HINDI_INDIA: 91>
HUNGARIAN_HUNGARY = <RESOURCE_SUBLANGS.HUNGARIAN_HUNGARY: 92>
ICELANDIC_ICELAND = <RESOURCE_SUBLANGS.ICELANDIC_ICELAND: 93>
IGBO_NIGERIA = <RESOURCE_SUBLANGS.IGBO_NIGERIA: 94>
INDONESIAN_INDONESIA = <RESOURCE_SUBLANGS.INDONESIAN_INDONESIA: 95>
INUKTITUT_CANADA = <RESOURCE_SUBLANGS.INUKTITUT_CANADA: 97>
INUKTITUT_CANADA_LATIN = <RESOURCE_SUBLANGS.INUKTITUT_CANADA_LATIN: 96>
IRISH_IRELAND = <RESOURCE_SUBLANGS.IRISH_IRELAND: 98>
ITALIAN = <RESOURCE_SUBLANGS.ITALIAN: 100>
ITALIAN_SWISS = <RESOURCE_SUBLANGS.ITALIAN_SWISS: 99>
JAPANESE_JAPAN = <RESOURCE_SUBLANGS.JAPANESE_JAPAN: 101>
KANNADA_INDIA = <RESOURCE_SUBLANGS.KANNADA_INDIA: 102>
KASHMIRI_INDIA = <RESOURCE_SUBLANGS.KASHMIRI_INDIA: 103>
KASHMIRI_SASIA = <RESOURCE_SUBLANGS.KASHMIRI_SASIA: 104>
KAZAK_KAZAKHSTAN = <RESOURCE_SUBLANGS.KAZAK_KAZAKHSTAN: 105>
KHMER_CAMBODIA = <RESOURCE_SUBLANGS.KHMER_CAMBODIA: 106>
KICHE_GUATEMALA = <RESOURCE_SUBLANGS.KICHE_GUATEMALA: 107>
KINYARWANDA_RWANDA = <RESOURCE_SUBLANGS.KINYARWANDA_RWANDA: 108>
KONKANI_INDIA = <RESOURCE_SUBLANGS.KONKANI_INDIA: 109>
KOREAN = <RESOURCE_SUBLANGS.KOREAN: 110>
KYRGYZ_KYRGYZSTAN = <RESOURCE_SUBLANGS.KYRGYZ_KYRGYZSTAN: 111>
LAO_LAO = <RESOURCE_SUBLANGS.LAO_LAO: 112>
LATVIAN_LATVIA = <RESOURCE_SUBLANGS.LATVIAN_LATVIA: 113>
LITHUANIAN = <RESOURCE_SUBLANGS.LITHUANIAN: 115>
LITHUANIAN_CLASSIC = <RESOURCE_SUBLANGS.LITHUANIAN_CLASSIC: 114>
LOWER_SORBIAN_GERMANY = <RESOURCE_SUBLANGS.LOWER_SORBIAN_GERMANY: 116>
LUXEMBOURGISH_LUXEMBOURG = <RESOURCE_SUBLANGS.LUXEMBOURGISH_LUXEMBOURG: 117>
MACEDONIAN_MACEDONIA = <RESOURCE_SUBLANGS.MACEDONIAN_MACEDONIA: 118>
MALAYALAM_INDIA = <RESOURCE_SUBLANGS.MALAYALAM_INDIA: 121>
MALAY_BRUNEI_DARUSSALAM = <RESOURCE_SUBLANGS.MALAY_BRUNEI_DARUSSALAM: 119>
MALAY_MALAYSIA = <RESOURCE_SUBLANGS.MALAY_MALAYSIA: 120>
MALTESE_MALTA = <RESOURCE_SUBLANGS.MALTESE_MALTA: 122>
MAORI_NEW_ZEALAND = <RESOURCE_SUBLANGS.MAORI_NEW_ZEALAND: 123>
MAPUDUNGUN_CHILE = <RESOURCE_SUBLANGS.MAPUDUNGUN_CHILE: 124>
MARATHI_INDIA = <RESOURCE_SUBLANGS.MARATHI_INDIA: 125>
MOHAWK_MOHAWK = <RESOURCE_SUBLANGS.MOHAWK_MOHAWK: 126>
MONGOLIAN_CYRILLIC_MONGOLIA = <RESOURCE_SUBLANGS.MONGOLIAN_CYRILLIC_MONGOLIA: 127>
MONGOLIAN_PRC = <RESOURCE_SUBLANGS.MONGOLIAN_PRC: 128>
NEPALI_INDIA = <RESOURCE_SUBLANGS.NEPALI_INDIA: 129>
NEPALI_NEPAL = <RESOURCE_SUBLANGS.NEPALI_NEPAL: 130>
NEUTRAL = <RESOURCE_SUBLANGS.NEUTRAL: 131>
NORWEGIAN_BOKMAL = <RESOURCE_SUBLANGS.NORWEGIAN_BOKMAL: 132>
NORWEGIAN_NYNORSK = <RESOURCE_SUBLANGS.NORWEGIAN_NYNORSK: 133>
OCCITAN_FRANCE = <RESOURCE_SUBLANGS.OCCITAN_FRANCE: 134>
ORIYA_INDIA = <RESOURCE_SUBLANGS.ORIYA_INDIA: 135>
PASHTO_AFGHANISTAN = <RESOURCE_SUBLANGS.PASHTO_AFGHANISTAN: 136>
PERSIAN_IRAN = <RESOURCE_SUBLANGS.PERSIAN_IRAN: 137>
POLISH_POLAND = <RESOURCE_SUBLANGS.POLISH_POLAND: 138>
PORTUGUESE = <RESOURCE_SUBLANGS.PORTUGUESE: 140>
PORTUGUESE_BRAZILIAN = <RESOURCE_SUBLANGS.PORTUGUESE_BRAZILIAN: 139>
PUNJABI_INDIA = <RESOURCE_SUBLANGS.PUNJABI_INDIA: 141>
PUNJABI_PAKISTAN = <RESOURCE_SUBLANGS.PUNJABI_PAKISTAN: 224>
QUECHUA_BOLIVIA = <RESOURCE_SUBLANGS.QUECHUA_BOLIVIA: 142>
QUECHUA_ECUADOR = <RESOURCE_SUBLANGS.QUECHUA_ECUADOR: 143>
QUECHUA_PERU = <RESOURCE_SUBLANGS.QUECHUA_PERU: 144>
ROMANIAN_ROMANIA = <RESOURCE_SUBLANGS.ROMANIAN_ROMANIA: 145>
ROMANSH_SWITZERLAND = <RESOURCE_SUBLANGS.ROMANSH_SWITZERLAND: 146>
RUSSIAN_RUSSIA = <RESOURCE_SUBLANGS.RUSSIAN_RUSSIA: 147>
SAMI_INARI_FINLAND = <RESOURCE_SUBLANGS.SAMI_INARI_FINLAND: 148>
SAMI_LULE_NORWAY = <RESOURCE_SUBLANGS.SAMI_LULE_NORWAY: 149>
SAMI_LULE_SWEDEN = <RESOURCE_SUBLANGS.SAMI_LULE_SWEDEN: 150>
SAMI_NORTHERN_FINLAND = <RESOURCE_SUBLANGS.SAMI_NORTHERN_FINLAND: 151>
SAMI_NORTHERN_NORWAY = <RESOURCE_SUBLANGS.SAMI_NORTHERN_NORWAY: 152>
SAMI_NORTHERN_SWEDEN = <RESOURCE_SUBLANGS.SAMI_NORTHERN_SWEDEN: 153>
SAMI_SKOLT_FINLAND = <RESOURCE_SUBLANGS.SAMI_SKOLT_FINLAND: 154>
SAMI_SOUTHERN_NORWAY = <RESOURCE_SUBLANGS.SAMI_SOUTHERN_NORWAY: 155>
SAMI_SOUTHERN_SWEDEN = <RESOURCE_SUBLANGS.SAMI_SOUTHERN_SWEDEN: 156>
SANSKRIT_INDIA = <RESOURCE_SUBLANGS.SANSKRIT_INDIA: 157>
SERBIAN_BOSNIA_HERZEGOVINA_CYRILLIC = <RESOURCE_SUBLANGS.SERBIAN_BOSNIA_HERZEGOVINA_CYRILLIC: 158>
SERBIAN_BOSNIA_HERZEGOVINA_LATIN = <RESOURCE_SUBLANGS.SERBIAN_BOSNIA_HERZEGOVINA_LATIN: 159>
SERBIAN_CROATIA = <RESOURCE_SUBLANGS.SERBIAN_CROATIA: 160>
SERBIAN_CYRILLIC = <RESOURCE_SUBLANGS.SERBIAN_CYRILLIC: 161>
SERBIAN_LATIN = <RESOURCE_SUBLANGS.SERBIAN_LATIN: 162>
SINDHI_AFGHANISTAN = <RESOURCE_SUBLANGS.SINDHI_AFGHANISTAN: 163>
SINDHI_INDIA = <RESOURCE_SUBLANGS.SINDHI_INDIA: 164>
SINDHI_PAKISTAN = <RESOURCE_SUBLANGS.SINDHI_PAKISTAN: 165>
SINHALESE_SRI_LANKA = <RESOURCE_SUBLANGS.SINHALESE_SRI_LANKA: 166>
SLOVAK_SLOVAKIA = <RESOURCE_SUBLANGS.SLOVAK_SLOVAKIA: 167>
SLOVENIAN_SLOVENIA = <RESOURCE_SUBLANGS.SLOVENIAN_SLOVENIA: 168>
SOTHO_NORTHERN_SOUTH_AFRICA = <RESOURCE_SUBLANGS.SOTHO_NORTHERN_SOUTH_AFRICA: 169>
SPANISH = <RESOURCE_SUBLANGS.SPANISH: 190>
SPANISH_ARGENTINA = <RESOURCE_SUBLANGS.SPANISH_ARGENTINA: 170>
SPANISH_BOLIVIA = <RESOURCE_SUBLANGS.SPANISH_BOLIVIA: 171>
SPANISH_CHILE = <RESOURCE_SUBLANGS.SPANISH_CHILE: 172>
SPANISH_COLOMBIA = <RESOURCE_SUBLANGS.SPANISH_COLOMBIA: 173>
SPANISH_COSTA_RICA = <RESOURCE_SUBLANGS.SPANISH_COSTA_RICA: 174>
SPANISH_DOMINICAN_REPUBLIC = <RESOURCE_SUBLANGS.SPANISH_DOMINICAN_REPUBLIC: 175>
SPANISH_ECUADOR = <RESOURCE_SUBLANGS.SPANISH_ECUADOR: 176>
SPANISH_EL_SALVADOR = <RESOURCE_SUBLANGS.SPANISH_EL_SALVADOR: 177>
SPANISH_GUATEMALA = <RESOURCE_SUBLANGS.SPANISH_GUATEMALA: 178>
SPANISH_HONDURAS = <RESOURCE_SUBLANGS.SPANISH_HONDURAS: 179>
SPANISH_MEXICAN = <RESOURCE_SUBLANGS.SPANISH_MEXICAN: 180>
SPANISH_MODERN = <RESOURCE_SUBLANGS.SPANISH_MODERN: 181>
SPANISH_NICARAGUA = <RESOURCE_SUBLANGS.SPANISH_NICARAGUA: 182>
SPANISH_PANAMA = <RESOURCE_SUBLANGS.SPANISH_PANAMA: 183>
SPANISH_PARAGUAY = <RESOURCE_SUBLANGS.SPANISH_PARAGUAY: 184>
SPANISH_PERU = <RESOURCE_SUBLANGS.SPANISH_PERU: 185>
SPANISH_PUERTO_RICO = <RESOURCE_SUBLANGS.SPANISH_PUERTO_RICO: 186>
SPANISH_URUGUAY = <RESOURCE_SUBLANGS.SPANISH_URUGUAY: 187>
SPANISH_US = <RESOURCE_SUBLANGS.SPANISH_US: 188>
SPANISH_VENEZUELA = <RESOURCE_SUBLANGS.SPANISH_VENEZUELA: 189>
SWAHILI_KENYA = <RESOURCE_SUBLANGS.SWAHILI_KENYA: 191>
SWEDISH = <RESOURCE_SUBLANGS.SWEDISH: 193>
SWEDISH_FINLAND = <RESOURCE_SUBLANGS.SWEDISH_FINLAND: 192>
SYRIAC_SYRIA = <RESOURCE_SUBLANGS.SYRIAC_SYRIA: 194>
SYS_DEFAULT = <RESOURCE_SUBLANGS.SYS_DEFAULT: 195>
TAJIK_TAJIKISTAN = <RESOURCE_SUBLANGS.TAJIK_TAJIKISTAN: 196>
TAMAZIGHT_ALGERIA_LATIN = <RESOURCE_SUBLANGS.TAMAZIGHT_ALGERIA_LATIN: 197>
TAMIL_INDIA = <RESOURCE_SUBLANGS.TAMIL_INDIA: 198>
TAMIL_SRI_LANKA = <RESOURCE_SUBLANGS.TAMIL_SRI_LANKA: 226>
TATAR_RUSSIA = <RESOURCE_SUBLANGS.TATAR_RUSSIA: 199>
TELUGU_INDIA = <RESOURCE_SUBLANGS.TELUGU_INDIA: 200>
THAI_THAILAND = <RESOURCE_SUBLANGS.THAI_THAILAND: 201>
TIBETAN_PRC = <RESOURCE_SUBLANGS.TIBETAN_PRC: 202>
TIGRIGNA_ERITREA = <RESOURCE_SUBLANGS.TIGRIGNA_ERITREA: 203>
TIGRINYA_ERITREA = <RESOURCE_SUBLANGS.TIGRINYA_ERITREA: 228>
TIGRINYA_ETHIOPIA = <RESOURCE_SUBLANGS.TIGRINYA_ETHIOPIA: 227>
TSWANA_BOTSWANA = <RESOURCE_SUBLANGS.TSWANA_BOTSWANA: 225>
TSWANA_SOUTH_AFRICA = <RESOURCE_SUBLANGS.TSWANA_SOUTH_AFRICA: 204>
TURKISH_TURKEY = <RESOURCE_SUBLANGS.TURKISH_TURKEY: 205>
TURKMEN_TURKMENISTAN = <RESOURCE_SUBLANGS.TURKMEN_TURKMENISTAN: 206>
UIGHUR_PRC = <RESOURCE_SUBLANGS.UIGHUR_PRC: 208>
UI_CUSTOM_DEFAULT = <RESOURCE_SUBLANGS.UI_CUSTOM_DEFAULT: 207>
UKRAINIAN_UKRAINE = <RESOURCE_SUBLANGS.UKRAINIAN_UKRAINE: 209>
UPPER_SORBIAN_GERMANY = <RESOURCE_SUBLANGS.UPPER_SORBIAN_GERMANY: 210>
URDU_INDIA = <RESOURCE_SUBLANGS.URDU_INDIA: 211>
URDU_PAKISTAN = <RESOURCE_SUBLANGS.URDU_PAKISTAN: 212>
UZBEK_CYRILLIC = <RESOURCE_SUBLANGS.UZBEK_CYRILLIC: 213>
UZBEK_LATIN = <RESOURCE_SUBLANGS.UZBEK_LATIN: 214>
VALENCIAN_VALENCIA = <RESOURCE_SUBLANGS.VALENCIAN_VALENCIA: 229>
VIETNAMESE_VIETNAM = <RESOURCE_SUBLANGS.VIETNAMESE_VIETNAM: 215>
WELSH_UNITED_KINGDOM = <RESOURCE_SUBLANGS.WELSH_UNITED_KINGDOM: 216>
WOLOF_SENEGAL = <RESOURCE_SUBLANGS.WOLOF_SENEGAL: 217>
XHOSA_SOUTH_AFRICA = <RESOURCE_SUBLANGS.XHOSA_SOUTH_AFRICA: 218>
YAKUT_RUSSIA = <RESOURCE_SUBLANGS.YAKUT_RUSSIA: 219>
YI_PRC = <RESOURCE_SUBLANGS.YI_PRC: 220>
YORUBA_NIGERIA = <RESOURCE_SUBLANGS.YORUBA_NIGERIA: 221>
ZULU_SOUTH_AFRICA = <RESOURCE_SUBLANGS.ZULU_SOUTH_AFRICA: 222>
property name

FIXED_VERSION_FILE_SUB_TYPES

class lief.PE.CODE_PAGES(self: lief.PE.CODE_PAGES, value: int) → None

Members:

IBM037

IBM437

IBM500

ASMO_708

DOS_720

IBM737

IBM775

IBM850

IBM852

IBM855

IBM857

IBM00858

IBM860

IBM861

DOS_862

IBM863

IBM864

IBM865

CP866

IBM869

IBM870

WINDOWS_874

CP875

SHIFT_JIS

GB2312

KS_C_5601_1987

BIG5

IBM1026

IBM01047

IBM01140

IBM01141

IBM01142

IBM01143

IBM01144

IBM01145

IBM01146

IBM01147

IBM01148

IBM01149

UTF_16

UNICODEFFFE

WINDOWS_1250

WINDOWS_1251

WINDOWS_1252

WINDOWS_1253

WINDOWS_1254

WINDOWS_1255

WINDOWS_1256

WINDOWS_1257

WINDOWS_1258

JOHAB

MACINTOSH

X_MAC_JAPANESE

X_MAC_CHINESETRAD

X_MAC_KOREAN

X_MAC_ARABIC

X_MAC_HEBREW

X_MAC_GREEK

X_MAC_CYRILLIC

X_MAC_CHINESESIMP

X_MAC_ROMANIAN

X_MAC_UKRAINIAN

X_MAC_THAI

X_MAC_CE

X_MAC_ICELANDIC

X_MAC_TURKISH

X_MAC_CROATIAN

UTF_32

UTF_32BE

X_CHINESE_CNS

X_CP20001

X_CHINESE_ETEN

X_CP20003

X_CP20004

X_CP20005

X_IA5

X_IA5_GERMAN

X_IA5_SWEDISH

X_IA5_NORWEGIAN

US_ASCII

X_CP20261

X_CP20269

IBM273

IBM277

IBM278

IBM280

IBM284

IBM285

IBM290

IBM297

IBM420

IBM423

IBM424

X_EBCDIC_KOREANEXTENDED

IBM_THAI

KOI8_R

IBM871

IBM880

IBM905

IBM00924

EUC_JP_JIS

X_CP20936

X_CP20949

CP1025

KOI8_U

ISO_8859_1

ISO_8859_2

ISO_8859_3

ISO_8859_4

ISO_8859_5

ISO_8859_6

ISO_8859_7

ISO_8859_8

ISO_8859_9

ISO_8859_13

ISO_8859_15

X_EUROPA

ISO_8859_8_I

ISO_2022_JP

CSISO2022JP

ISO_2022_JP_JIS

ISO_2022_KR

X_CP50227

EUC_JP

EUC_CN

EUC_KR

HZ_GB_2312

GB18030

X_ISCII_DE

X_ISCII_BE

X_ISCII_TA

X_ISCII_TE

X_ISCII_AS

X_ISCII_OR

X_ISCII_KA

X_ISCII_MA

X_ISCII_GU

X_ISCII_PA

UTF_7

UTF_8

ASMO_708 = <CODE_PAGES.ASMO_708: 708>
BIG5 = <CODE_PAGES.BIG5: 950>
CP1025 = <CODE_PAGES.CP1025: 21025>
CP866 = <CODE_PAGES.CP866: 866>
CP875 = <CODE_PAGES.CP875: 875>
CSISO2022JP = <CODE_PAGES.CSISO2022JP: 50221>
DOS_720 = <CODE_PAGES.DOS_720: 720>
DOS_862 = <CODE_PAGES.DOS_862: 862>
EUC_CN = <CODE_PAGES.EUC_CN: 51936>
EUC_JP = <CODE_PAGES.EUC_JP: 51932>
EUC_JP_JIS = <CODE_PAGES.EUC_JP_JIS: 20932>
EUC_KR = <CODE_PAGES.EUC_KR: 51949>
GB18030 = <CODE_PAGES.GB18030: 54936>
GB2312 = <CODE_PAGES.GB2312: 936>
HZ_GB_2312 = <CODE_PAGES.HZ_GB_2312: 52936>
IBM00858 = <CODE_PAGES.IBM00858: 858>
IBM00924 = <CODE_PAGES.IBM00924: 20924>
IBM01047 = <CODE_PAGES.IBM01047: 1047>
IBM01140 = <CODE_PAGES.IBM01140: 1140>
IBM01141 = <CODE_PAGES.IBM01141: 1141>
IBM01142 = <CODE_PAGES.IBM01142: 1142>
IBM01143 = <CODE_PAGES.IBM01143: 1143>
IBM01144 = <CODE_PAGES.IBM01144: 1144>
IBM01145 = <CODE_PAGES.IBM01145: 1145>
IBM01146 = <CODE_PAGES.IBM01146: 1146>
IBM01147 = <CODE_PAGES.IBM01147: 1147>
IBM01148 = <CODE_PAGES.IBM01148: 1148>
IBM01149 = <CODE_PAGES.IBM01149: 1149>
IBM037 = <CODE_PAGES.IBM037: 37>
IBM1026 = <CODE_PAGES.IBM1026: 1026>
IBM273 = <CODE_PAGES.IBM273: 20273>
IBM277 = <CODE_PAGES.IBM277: 20277>
IBM278 = <CODE_PAGES.IBM278: 20278>
IBM280 = <CODE_PAGES.IBM280: 20280>
IBM284 = <CODE_PAGES.IBM284: 20284>
IBM285 = <CODE_PAGES.IBM285: 20285>
IBM290 = <CODE_PAGES.IBM290: 20290>
IBM297 = <CODE_PAGES.IBM297: 20297>
IBM420 = <CODE_PAGES.IBM420: 20420>
IBM423 = <CODE_PAGES.IBM423: 20423>
IBM424 = <CODE_PAGES.IBM424: 20424>
IBM437 = <CODE_PAGES.IBM437: 437>
IBM500 = <CODE_PAGES.IBM500: 500>
IBM737 = <CODE_PAGES.IBM737: 737>
IBM775 = <CODE_PAGES.IBM775: 775>
IBM850 = <CODE_PAGES.IBM850: 850>
IBM852 = <CODE_PAGES.IBM852: 852>
IBM855 = <CODE_PAGES.IBM855: 855>
IBM857 = <CODE_PAGES.IBM857: 857>
IBM860 = <CODE_PAGES.IBM860: 860>
IBM861 = <CODE_PAGES.IBM861: 861>
IBM863 = <CODE_PAGES.IBM863: 863>
IBM864 = <CODE_PAGES.IBM864: 864>
IBM865 = <CODE_PAGES.IBM865: 865>
IBM869 = <CODE_PAGES.IBM869: 869>
IBM870 = <CODE_PAGES.IBM870: 870>
IBM871 = <CODE_PAGES.IBM871: 20871>
IBM880 = <CODE_PAGES.IBM880: 20880>
IBM905 = <CODE_PAGES.IBM905: 20905>
IBM_THAI = <CODE_PAGES.IBM_THAI: 20838>
ISO_2022_JP = <CODE_PAGES.ISO_2022_JP: 50220>
ISO_2022_JP_JIS = <CODE_PAGES.ISO_2022_JP_JIS: 50222>
ISO_2022_KR = <CODE_PAGES.ISO_2022_KR: 50225>
ISO_8859_1 = <CODE_PAGES.ISO_8859_1: 28591>
ISO_8859_13 = <CODE_PAGES.ISO_8859_13: 28603>
ISO_8859_15 = <CODE_PAGES.ISO_8859_15: 28605>
ISO_8859_2 = <CODE_PAGES.ISO_8859_2: 28592>
ISO_8859_3 = <CODE_PAGES.ISO_8859_3: 28593>
ISO_8859_4 = <CODE_PAGES.ISO_8859_4: 28594>
ISO_8859_5 = <CODE_PAGES.ISO_8859_5: 28595>
ISO_8859_6 = <CODE_PAGES.ISO_8859_6: 28596>
ISO_8859_7 = <CODE_PAGES.ISO_8859_7: 28597>
ISO_8859_8 = <CODE_PAGES.ISO_8859_8: 28598>
ISO_8859_8_I = <CODE_PAGES.ISO_8859_8_I: 38598>
ISO_8859_9 = <CODE_PAGES.ISO_8859_9: 28599>
JOHAB = <CODE_PAGES.JOHAB: 1361>
KOI8_R = <CODE_PAGES.KOI8_R: 20866>
KOI8_U = <CODE_PAGES.KOI8_U: 21866>
KS_C_5601_1987 = <CODE_PAGES.KS_C_5601_1987: 949>
MACINTOSH = <CODE_PAGES.MACINTOSH: 10000>
SHIFT_JIS = <CODE_PAGES.SHIFT_JIS: 932>
UNICODEFFFE = <CODE_PAGES.UNICODEFFFE: 1201>
US_ASCII = <CODE_PAGES.US_ASCII: 20127>
UTF_16 = <CODE_PAGES.UTF_16: 1200>
UTF_32 = <CODE_PAGES.UTF_32: 12000>
UTF_32BE = <CODE_PAGES.UTF_32BE: 12001>
UTF_7 = <CODE_PAGES.UTF_7: 65000>
UTF_8 = <CODE_PAGES.UTF_8: 65001>
WINDOWS_1250 = <CODE_PAGES.WINDOWS_1250: 1250>
WINDOWS_1251 = <CODE_PAGES.WINDOWS_1251: 1251>
WINDOWS_1252 = <CODE_PAGES.WINDOWS_1252: 1252>
WINDOWS_1253 = <CODE_PAGES.WINDOWS_1253: 1253>
WINDOWS_1254 = <CODE_PAGES.WINDOWS_1254: 1254>
WINDOWS_1255 = <CODE_PAGES.WINDOWS_1255: 1255>
WINDOWS_1256 = <CODE_PAGES.WINDOWS_1256: 1256>
WINDOWS_1257 = <CODE_PAGES.WINDOWS_1257: 1257>
WINDOWS_1258 = <CODE_PAGES.WINDOWS_1258: 1258>
WINDOWS_874 = <CODE_PAGES.WINDOWS_874: 874>
X_CHINESE_CNS = <CODE_PAGES.X_CHINESE_CNS: 20000>
X_CHINESE_ETEN = <CODE_PAGES.X_CHINESE_ETEN: 20002>
X_CP20001 = <CODE_PAGES.X_CP20001: 20001>
X_CP20003 = <CODE_PAGES.X_CP20003: 20003>
X_CP20004 = <CODE_PAGES.X_CP20004: 20004>
X_CP20005 = <CODE_PAGES.X_CP20005: 20005>
X_CP20261 = <CODE_PAGES.X_CP20261: 20261>
X_CP20269 = <CODE_PAGES.X_CP20269: 20269>
X_CP20936 = <CODE_PAGES.X_CP20936: 20936>
X_CP20949 = <CODE_PAGES.X_CP20949: 20949>
X_CP50227 = <CODE_PAGES.X_CP50227: 50227>
X_EBCDIC_KOREANEXTENDED = <CODE_PAGES.X_EBCDIC_KOREANEXTENDED: 20833>
X_EUROPA = <CODE_PAGES.X_EUROPA: 29001>
X_IA5 = <CODE_PAGES.X_IA5: 20105>
X_IA5_GERMAN = <CODE_PAGES.X_IA5_GERMAN: 20106>
X_IA5_NORWEGIAN = <CODE_PAGES.X_IA5_NORWEGIAN: 20108>
X_IA5_SWEDISH = <CODE_PAGES.X_IA5_SWEDISH: 20107>
X_ISCII_AS = <CODE_PAGES.X_ISCII_AS: 57006>
X_ISCII_BE = <CODE_PAGES.X_ISCII_BE: 57003>
X_ISCII_DE = <CODE_PAGES.X_ISCII_DE: 57002>
X_ISCII_GU = <CODE_PAGES.X_ISCII_GU: 57010>
X_ISCII_KA = <CODE_PAGES.X_ISCII_KA: 57008>
X_ISCII_MA = <CODE_PAGES.X_ISCII_MA: 57009>
X_ISCII_OR = <CODE_PAGES.X_ISCII_OR: 57007>
X_ISCII_PA = <CODE_PAGES.X_ISCII_PA: 57011>
X_ISCII_TA = <CODE_PAGES.X_ISCII_TA: 57004>
X_ISCII_TE = <CODE_PAGES.X_ISCII_TE: 57005>
X_MAC_ARABIC = <CODE_PAGES.X_MAC_ARABIC: 10004>
X_MAC_CE = <CODE_PAGES.X_MAC_CE: 10029>
X_MAC_CHINESESIMP = <CODE_PAGES.X_MAC_CHINESESIMP: 10008>
X_MAC_CHINESETRAD = <CODE_PAGES.X_MAC_CHINESETRAD: 10002>
X_MAC_CROATIAN = <CODE_PAGES.X_MAC_CROATIAN: 10082>
X_MAC_CYRILLIC = <CODE_PAGES.X_MAC_CYRILLIC: 10007>
X_MAC_GREEK = <CODE_PAGES.X_MAC_GREEK: 10006>
X_MAC_HEBREW = <CODE_PAGES.X_MAC_HEBREW: 10005>
X_MAC_ICELANDIC = <CODE_PAGES.X_MAC_ICELANDIC: 10079>
X_MAC_JAPANESE = <CODE_PAGES.X_MAC_JAPANESE: 10001>
X_MAC_KOREAN = <CODE_PAGES.X_MAC_KOREAN: 10003>
X_MAC_ROMANIAN = <CODE_PAGES.X_MAC_ROMANIAN: 10010>
X_MAC_THAI = <CODE_PAGES.X_MAC_THAI: 10021>
X_MAC_TURKISH = <CODE_PAGES.X_MAC_TURKISH: 10081>
X_MAC_UKRAINIAN = <CODE_PAGES.X_MAC_UKRAINIAN: 10017>
property name

WINDOW_STYLES

class lief.PE.WINDOW_STYLES(self: lief.PE.WINDOW_STYLES, value: int) → None

Members:

OVERLAPPED

POPUP

CHILD

MINIMIZE

VISIBLE

DISABLED

CLIPSIBLINGS

CLIPCHILDREN

MAXIMIZE

CAPTION

BORDER

DLGFRAME

VSCROLL

HSCROLL

SYSMENU

THICKFRAME

GROUP

TABSTOP

MINIMIZEBOX

MAXIMIZEBOX

BORDER = <WINDOW_STYLES.BORDER: 8388608>
CAPTION = <WINDOW_STYLES.CAPTION: 12582912>
CHILD = <WINDOW_STYLES.CHILD: 1073741824>
CLIPCHILDREN = <WINDOW_STYLES.CLIPCHILDREN: 33554432>
CLIPSIBLINGS = <WINDOW_STYLES.CLIPSIBLINGS: 67108864>
DISABLED = <WINDOW_STYLES.DISABLED: 134217728>
DLGFRAME = <WINDOW_STYLES.DLGFRAME: 4194304>
GROUP = <WINDOW_STYLES.GROUP: 131072>
HSCROLL = <WINDOW_STYLES.HSCROLL: 1048576>
MAXIMIZE = <WINDOW_STYLES.MAXIMIZE: 16777216>
MAXIMIZEBOX = <WINDOW_STYLES.TABSTOP: 65536>
MINIMIZE = <WINDOW_STYLES.MINIMIZE: 536870912>
MINIMIZEBOX = <WINDOW_STYLES.GROUP: 131072>
OVERLAPPED = <WINDOW_STYLES.OVERLAPPED: 0>
POPUP = <WINDOW_STYLES.POPUP: 2147483648>
SYSMENU = <WINDOW_STYLES.SYSMENU: 524288>
TABSTOP = <WINDOW_STYLES.TABSTOP: 65536>
THICKFRAME = <WINDOW_STYLES.THICKFRAME: 262144>
VISIBLE = <WINDOW_STYLES.VISIBLE: 268435456>
VSCROLL = <WINDOW_STYLES.VSCROLL: 2097152>
property name

EXTENDED_WINDOW_STYLES

class lief.PE.EXTENDED_WINDOW_STYLES(self: lief.PE.EXTENDED_WINDOW_STYLES, value: int) → None

Members:

DLGMODALFRAME

NOPARENTNOTIFY

TOPMOST

ACCEPTFILES

TRANSPARENT

MDICHILD

TOOLWINDOW

WINDOWEDGE

CLIENTEDGE

CONTEXTHELP

RIGHT

LEFT

RTLREADING

LTRREADING

LEFTSCROLLBAR

RIGHTSCROLLBAR

CONTROLPARENT

STATICEDGE

APPWINDOW

ACCEPTFILES = <EXTENDED_WINDOW_STYLES.ACCEPTFILES: 16>
APPWINDOW = <EXTENDED_WINDOW_STYLES.APPWINDOW: 262144>
CLIENTEDGE = <EXTENDED_WINDOW_STYLES.CLIENTEDGE: 512>
CONTEXTHELP = <EXTENDED_WINDOW_STYLES.CONTEXTHELP: 1024>
CONTROLPARENT = <EXTENDED_WINDOW_STYLES.CONTROLPARENT: 65536>
DLGMODALFRAME = <EXTENDED_WINDOW_STYLES.DLGMODALFRAME: 1>
LEFT = <EXTENDED_WINDOW_STYLES.LEFT: 0>
LEFTSCROLLBAR = <EXTENDED_WINDOW_STYLES.LEFTSCROLLBAR: 16384>
LTRREADING = <EXTENDED_WINDOW_STYLES.LEFT: 0>
MDICHILD = <EXTENDED_WINDOW_STYLES.MDICHILD: 64>
NOPARENTNOTIFY = <EXTENDED_WINDOW_STYLES.NOPARENTNOTIFY: 4>
RIGHT = <EXTENDED_WINDOW_STYLES.RIGHT: 4096>
RIGHTSCROLLBAR = <EXTENDED_WINDOW_STYLES.LEFT: 0>
RTLREADING = <EXTENDED_WINDOW_STYLES.RTLREADING: 8192>
STATICEDGE = <EXTENDED_WINDOW_STYLES.STATICEDGE: 131072>
TOOLWINDOW = <EXTENDED_WINDOW_STYLES.TOOLWINDOW: 128>
TOPMOST = <EXTENDED_WINDOW_STYLES.TOPMOST: 8>
TRANSPARENT = <EXTENDED_WINDOW_STYLES.TRANSPARENT: 32>
WINDOWEDGE = <EXTENDED_WINDOW_STYLES.WINDOWEDGE: 256>
property name

DIALOG_BOX_STYLES

class lief.PE.DIALOG_BOX_STYLES(self: lief.PE.DIALOG_BOX_STYLES, value: int) → None

Members:

ABSALIGN

SYSMODAL

LOCALEDIT

SETFONT

MODALFRAME

NOIDLEMSG

SETFOREGROUND

D3DLOOK

FIXEDSYS

NOFAILCREATE

CONTROL

CENTER

CENTERMOUSE

CONTEXTHELP

SHELLFONT

ABSALIGN = <DIALOG_BOX_STYLES.ABSALIGN: 1>
CENTER = <DIALOG_BOX_STYLES.CENTER: 2048>
CENTERMOUSE = <DIALOG_BOX_STYLES.CENTERMOUSE: 4096>
CONTEXTHELP = <DIALOG_BOX_STYLES.CONTEXTHELP: 8192>
CONTROL = <DIALOG_BOX_STYLES.CONTROL: 1024>
D3DLOOK = <DIALOG_BOX_STYLES.D3DLOOK: 4>
FIXEDSYS = <DIALOG_BOX_STYLES.FIXEDSYS: 8>
LOCALEDIT = <DIALOG_BOX_STYLES.LOCALEDIT: 32>
MODALFRAME = <DIALOG_BOX_STYLES.MODALFRAME: 128>
NOFAILCREATE = <DIALOG_BOX_STYLES.NOFAILCREATE: 16>
NOIDLEMSG = <DIALOG_BOX_STYLES.NOIDLEMSG: 256>
SETFONT = <DIALOG_BOX_STYLES.SETFONT: 64>
SETFOREGROUND = <DIALOG_BOX_STYLES.SETFOREGROUND: 512>
SHELLFONT = <DIALOG_BOX_STYLES.SHELLFONT: 72>
SYSMODAL = <DIALOG_BOX_STYLES.SYSMODAL: 2>
property name

FIXED_VERSION_OS

class lief.PE.FIXED_VERSION_OS(self: lief.PE.FIXED_VERSION_OS, value: int) → None

Members:

UNKNOWN

DOS

NT

WINDOWS16

WINDOWS32

OS216

OS232

PM16

PM32

DOS_WINDOWS16

DOS_WINDOWS32

NT_WINDOWS32

OS216_PM16

OS232_PM32

DOS = <FIXED_VERSION_OS.DOS: 65536>
DOS_WINDOWS16 = <FIXED_VERSION_OS.DOS_WINDOWS16: 65537>
DOS_WINDOWS32 = <FIXED_VERSION_OS.DOS_WINDOWS32: 65540>
NT = <FIXED_VERSION_OS.NT: 262144>
NT_WINDOWS32 = <FIXED_VERSION_OS.NT_WINDOWS32: 262148>
OS216 = <FIXED_VERSION_OS.OS216: 131072>
OS216_PM16 = <FIXED_VERSION_OS.OS216_PM16: 131074>
OS232 = <FIXED_VERSION_OS.OS232: 196608>
OS232_PM32 = <FIXED_VERSION_OS.OS232_PM32: 196611>
PM16 = <FIXED_VERSION_OS.PM16: 2>
PM32 = <FIXED_VERSION_OS.PM32: 3>
UNKNOWN = <FIXED_VERSION_OS.UNKNOWN: 0>
WINDOWS16 = <FIXED_VERSION_OS.WINDOWS16: 1>
WINDOWS32 = <FIXED_VERSION_OS.WINDOWS32: 4>
property name

FIXED_VERSION_FILE_FLAGS

class lief.PE.FIXED_VERSION_FILE_FLAGS(self: lief.PE.FIXED_VERSION_FILE_FLAGS, value: int) → None

Members:

DEBUG

INFOINFERRED

PATCHED

PRERELEASE

PRIVATEBUILD

SPECIALBUILD

DEBUG = <FIXED_VERSION_FILE_FLAGS.DEBUG: 1>
INFOINFERRED = <FIXED_VERSION_FILE_FLAGS.INFOINFERRED: 16>
PATCHED = <FIXED_VERSION_FILE_FLAGS.PATCHED: 4>
PRERELEASE = <FIXED_VERSION_FILE_FLAGS.PRERELEASE: 2>
PRIVATEBUILD = <FIXED_VERSION_FILE_FLAGS.PRIVATEBUILD: 8>
SPECIALBUILD = <FIXED_VERSION_FILE_FLAGS.SPECIALBUILD: 32>
property name

FIXED_VERSION_FILE_TYPES

class lief.PE.FIXED_VERSION_FILE_TYPES(self: lief.PE.FIXED_VERSION_FILE_TYPES, value: int) → None

Members:

APP

DLL

DRV

FONT

STATIC_LIB

UNKNOWN

VXD

APP = <FIXED_VERSION_FILE_TYPES.APP: 1>
DLL = <FIXED_VERSION_FILE_TYPES.DLL: 2>
DRV = <FIXED_VERSION_FILE_TYPES.DRV: 3>
FONT = <FIXED_VERSION_FILE_TYPES.FONT: 4>
STATIC_LIB = <FIXED_VERSION_FILE_TYPES.STATIC_LIB: 7>
UNKNOWN = <FIXED_VERSION_FILE_TYPES.UNKNOWN: 0>
VXD = <FIXED_VERSION_FILE_TYPES.VXD: 5>
property name

FIXED_VERSION_FILE_SUB_TYPES

class lief.PE.FIXED_VERSION_FILE_SUB_TYPES(self: lief.PE.FIXED_VERSION_FILE_SUB_TYPES, value: int) → None

Members:

DRV_COMM

DRV_DISPLAY

DRV_INSTALLABLE

DRV_KEYBOARD

DRV_LANGUAGE

DRV_MOUSE

DRV_NETWORK

DRV_PRINTER

DRV_SOUND

DRV_SYSTEM

DRV_VERSIONED_PRINTER

FONT_RASTER

FONT_TRUETYPE

FONT_VECTOR

UNKNOWN

DRV_COMM = <FIXED_VERSION_FILE_SUB_TYPES.DRV_COMM: 10>
DRV_DISPLAY = <FIXED_VERSION_FILE_SUB_TYPES.DRV_DISPLAY: 4>
DRV_INSTALLABLE = <FIXED_VERSION_FILE_SUB_TYPES.DRV_INSTALLABLE: 8>
DRV_KEYBOARD = <FIXED_VERSION_FILE_SUB_TYPES.DRV_KEYBOARD: 2>
DRV_LANGUAGE = <FIXED_VERSION_FILE_SUB_TYPES.DRV_LANGUAGE: 3>
DRV_MOUSE = <FIXED_VERSION_FILE_SUB_TYPES.DRV_MOUSE: 5>
DRV_NETWORK = <FIXED_VERSION_FILE_SUB_TYPES.DRV_NETWORK: 6>
DRV_PRINTER = <FIXED_VERSION_FILE_SUB_TYPES.DRV_PRINTER: 1>
DRV_SOUND = <FIXED_VERSION_FILE_SUB_TYPES.DRV_SOUND: 9>
DRV_SYSTEM = <FIXED_VERSION_FILE_SUB_TYPES.DRV_SYSTEM: 7>
DRV_VERSIONED_PRINTER = <FIXED_VERSION_FILE_SUB_TYPES.DRV_VERSIONED_PRINTER: 12>
FONT_RASTER = <FIXED_VERSION_FILE_SUB_TYPES.DRV_PRINTER: 1>
FONT_TRUETYPE = <FIXED_VERSION_FILE_SUB_TYPES.DRV_LANGUAGE: 3>
FONT_VECTOR = <FIXED_VERSION_FILE_SUB_TYPES.DRV_KEYBOARD: 2>
UNKNOWN = <FIXED_VERSION_FILE_SUB_TYPES.UNKNOWN: 0>
property name

WIN_VERSION

class lief.PE.WIN_VERSION(self: lief.PE.WIN_VERSION, value: int) → None

Members:

UNKNOWN

SEH

WIN_8_1

WIN10_0_9879

WIN10_0_14286

WIN10_0_14383

WIN10_0_14901

WIN10_0_15002

WIN10_0_16237

SEH = <WIN_VERSION.SEH: 1>
UNKNOWN = <WIN_VERSION.UNKNOWN: 0>
WIN10_0_14286 = <WIN_VERSION.WIN10_0_14286: 4>
WIN10_0_14383 = <WIN_VERSION.WIN10_0_14383: 5>
WIN10_0_14901 = <WIN_VERSION.WIN10_0_14901: 6>
WIN10_0_15002 = <WIN_VERSION.WIN10_0_15002: 7>
WIN10_0_16237 = <WIN_VERSION.WIN10_0_16237: 8>
WIN10_0_9879 = <WIN_VERSION.WIN10_0_9879: 3>
WIN_8_1 = <WIN_VERSION.WIN_8_1: 2>
property name

GUARD_CF_FLAGS

class lief.PE.GUARD_CF_FLAGS(self: lief.PE.GUARD_CF_FLAGS, value: int) → None

Members:

GCF_NONE

GCF_INSTRUMENTED

GCF_W_INSTRUMENTED

GCF_FUNCTION_TABLE_PRESENT

GCF_EXPORT_SUPPRESSION_INFO_PRESENT

GCF_ENABLE_EXPORT_SUPPRESSION

GCF_LONGJUMP_TABLE_PRESENT

GRF_INSTRUMENTED

GRF_ENABLE

GRF_STRICT

GCF_ENABLE_EXPORT_SUPPRESSION = <GUARD_CF_FLAGS.GCF_ENABLE_EXPORT_SUPPRESSION: 32768>
GCF_EXPORT_SUPPRESSION_INFO_PRESENT = <GUARD_CF_FLAGS.GCF_EXPORT_SUPPRESSION_INFO_PRESENT: 16384>
GCF_FUNCTION_TABLE_PRESENT = <GUARD_CF_FLAGS.GCF_FUNCTION_TABLE_PRESENT: 1024>
GCF_INSTRUMENTED = <GUARD_CF_FLAGS.GCF_INSTRUMENTED: 256>
GCF_LONGJUMP_TABLE_PRESENT = <GUARD_CF_FLAGS.GCF_LONGJUMP_TABLE_PRESENT: 65536>
GCF_NONE = <GUARD_CF_FLAGS.GCF_NONE: 0>
GCF_W_INSTRUMENTED = <GUARD_CF_FLAGS.GCF_W_INSTRUMENTED: 512>
GRF_ENABLE = <GUARD_CF_FLAGS.GRF_ENABLE: 262144>
GRF_INSTRUMENTED = <GUARD_CF_FLAGS.GRF_INSTRUMENTED: 131072>
GRF_STRICT = <GUARD_CF_FLAGS.GRF_STRICT: 524288>
property name

CODE_VIEW_SIGNATURES

class lief.PE.CODE_VIEW_SIGNATURES(self: lief.PE.CODE_VIEW_SIGNATURES, value: int) → None

Members:

UNKNOWN

PDB_70

PDB_20

CV_50

CV_41

CV_41 = <CODE_VIEW_SIGNATURES.CV_41: 959464014>
CV_50 = <CODE_VIEW_SIGNATURES.CV_50: 825311822>
PDB_20 = <CODE_VIEW_SIGNATURES.PDB_20: 808534606>
PDB_70 = <CODE_VIEW_SIGNATURES.PDB_70: 1396986706>
UNKNOWN = <CODE_VIEW_SIGNATURES.UNKNOWN: 0>
property name

POGO_SIGNATURES

class lief.PE.POGO_SIGNATURES(self: lief.PE.POGO_SIGNATURES, value: int) → None

Members:

UNKNOWN

LCTG

PGI

LCTG = <POGO_SIGNATURES.LCTG: 1280590663>
PGI = <POGO_SIGNATURES.PGI: 1346849024>
UNKNOWN = <POGO_SIGNATURES.UNKNOWN: 0>
property name

ALGORITHMS

class lief.PE.ALGORITHMS(self: lief.PE.ALGORITHMS, value: int) → None

Members:

UNKNOWN

SHA_512

SHA_384

SHA_256

SHA_1

MD5

MD4

MD2

RSA

EC

MD5_RSA

SHA1_DSA

SHA1_RSA

SHA_256_RSA

SHA_384_RSA

SHA_512_RSA

SHA1_ECDSA

SHA_256_ECDSA

SHA_384_ECDSA

SHA_512_ECDSA

EC = <ALGORITHMS.EC: 9>
MD2 = <ALGORITHMS.MD2: 7>
MD4 = <ALGORITHMS.MD4: 6>
MD5 = <ALGORITHMS.MD5: 5>
MD5_RSA = <ALGORITHMS.MD5_RSA: 10>
RSA = <ALGORITHMS.RSA: 8>
SHA1_DSA = <ALGORITHMS.SHA1_DSA: 11>
SHA1_ECDSA = <ALGORITHMS.SHA1_ECDSA: 16>
SHA1_RSA = <ALGORITHMS.SHA1_RSA: 12>
SHA_1 = <ALGORITHMS.SHA_1: 4>
SHA_256 = <ALGORITHMS.SHA_256: 3>
SHA_256_ECDSA = <ALGORITHMS.SHA_256_ECDSA: 17>
SHA_256_RSA = <ALGORITHMS.SHA_256_RSA: 13>
SHA_384 = <ALGORITHMS.SHA_384: 2>
SHA_384_ECDSA = <ALGORITHMS.SHA_384_ECDSA: 18>
SHA_384_RSA = <ALGORITHMS.SHA_384_RSA: 14>
SHA_512 = <ALGORITHMS.SHA_512: 1>
SHA_512_ECDSA = <ALGORITHMS.SHA_512_ECDSA: 19>
SHA_512_RSA = <ALGORITHMS.SHA_512_RSA: 15>
UNKNOWN = <ALGORITHMS.UNKNOWN: 0>
property name

SIG_ATTRIBUTE_TYPES

class lief.PE.SIG_ATTRIBUTE_TYPES(self: lief.PE.SIG_ATTRIBUTE_TYPES, value: int) → None

Members:

UNKNOWN

CONTENT_TYPE

GENERIC_TYPE

SPC_SP_OPUS_INFO

MS_COUNTER_SIGN

MS_SPC_NESTED_SIGN

MS_SPC_STATEMENT_TYPE

PKCS9_AT_SEQUENCE_NUMBER

PKCS9_COUNTER_SIGNATURE

PKCS9_MESSAGE_DIGEST

PKCS9_SIGNING_TIME

CONTENT_TYPE = <SIG_ATTRIBUTE_TYPES.CONTENT_TYPE: 1>
GENERIC_TYPE = <SIG_ATTRIBUTE_TYPES.GENERIC_TYPE: 2>
MS_COUNTER_SIGN = <SIG_ATTRIBUTE_TYPES.MS_COUNTER_SIGN: 4>
MS_SPC_NESTED_SIGN = <SIG_ATTRIBUTE_TYPES.MS_SPC_NESTED_SIGN: 5>
MS_SPC_STATEMENT_TYPE = <SIG_ATTRIBUTE_TYPES.MS_SPC_STATEMENT_TYPE: 6>
PKCS9_AT_SEQUENCE_NUMBER = <SIG_ATTRIBUTE_TYPES.PKCS9_AT_SEQUENCE_NUMBER: 7>
PKCS9_COUNTER_SIGNATURE = <SIG_ATTRIBUTE_TYPES.PKCS9_COUNTER_SIGNATURE: 8>
PKCS9_MESSAGE_DIGEST = <SIG_ATTRIBUTE_TYPES.PKCS9_MESSAGE_DIGEST: 9>
PKCS9_SIGNING_TIME = <SIG_ATTRIBUTE_TYPES.PKCS9_SIGNING_TIME: 10>
SPC_SP_OPUS_INFO = <SIG_ATTRIBUTE_TYPES.SPC_SP_OPUS_INFO: 3>
UNKNOWN = <SIG_ATTRIBUTE_TYPES.UNKNOWN: 0>
property name