Overloaded function.
parse(filename: str, config: lief._lief.ELF.ParserConfig = <lief._lief.ELF.ParserConfig object at 0x7c4d7a332eb0>) -> Optional[lief._lief.ELF.Binary]
Parse the ELF binary from the given file path and return a
lief.ELF.BinaryobjectThe second argument is an optional configuration (
ParserConfig) that can be used to define which part(s) of the ELF should be parsed or skipped.
parse(raw: list[int], config: lief._lief.ELF.ParserConfig = <lief._lief.ELF.ParserConfig object at 0x7c4d7a332ee0>) -> Optional[lief._lief.ELF.Binary]
Parse the ELF binary from the given list of bytes and return a
lief.ELF.BinaryobjectThe second argument is an optional configuration (
ParserConfig) that can be used to define which part(s) of the ELF should be parsed or skipped.
parse(obj: Union[io.IOBase | os.PathLike], config: lief._lief.ELF.ParserConfig = <lief._lief.ELF.ParserConfig object at 0x7c4d7a332f10>) -> Optional[lief._lief.ELF.Binary]
Parse the ELF binary from the given Python object and return a
lief.ELF.BinaryobjectThe second argument is an optional configuration (
ParserConfig) that can be used to define which part(s) of the ELF should be parsed or skipped.
This class is used to tweak the ELF Parser
The DYNSYM_COUNT_METHODS to use for counting the dynamic symbols
For weird binaries (e.g sectionless) you can choose the method for counting dynamic symbols (lief.ELF.DYNSYM_COUNT_METHODS). By default, the value is set to lief.ELF.DYNSYM_COUNT_METHODS.COUNT_AUTO
Whether dynamic symbols (those from .dynsym) should be parsed
Whether ELF notes information should be parsed
Whether the overlay data should be parsed
Whether relocations (including plt-like relocations) should be parsed.
Whether debug symbols (those from .symtab) should be parsed
Whether versioning symbols should be parsed
Class which represents an ELF binary
Return the abstract representation of the current binary (lief.Binary)
Overloaded function.
add(self, arg: lief._lief.ELF.DynamicEntry, /) -> lief._lief.ELF.DynamicEntry
dynamic_entry
add(self, section: lief._lief.ELF.Section, loaded: bool = True) -> lief._lief.ELF.Section
Add the given
Sectionto the binary.If the section does not aim at being loaded in memory, the
loadedparameter has to be set toFalse(default:True)
add(self, segment: lief._lief.ELF.Segment, base: int = 0) -> lief._lief.ELF.Segment
Add a new Segment in the binary
add(self, note: lief._lief.ELF.Note) -> lief._lief.ELF.Note
Add a new Note in the binary
Add a new dynamic relocation.
We consider a dynamic relocation as a relocation which is not plt-related.
Add a dynamic Symbol to the binary
The function also takes an optional lief.ELF.SymbolVersion
Create a symbol for the function at the given address and create an export
Add a library with the given name as dependency
Add relocation for object file (.o)
The first parameter is the section to add while the second parameter is the Section associated with the relocation.
If there is an error, this function returns a nullptr. Otherwise, it returns the relocation added.”,
Add a .plt.got relocation. This kind of relocation is usually associated with a PLT stub that aims at resolving the underlying symbol.
Add a static Symbol to the binary
The concrete representation of the binary. Basically, this property cast a lief.Binary into a lief.PE.Binary, lief.ELF.Binary or lief.MachO.Binary.
See also: lief.Binary.abstract
Constructor functions that are called prior to any other functions
List of the binary destructors (typically, the functions located in the .fini_array)
Return an iterator to DynamicEntry entries as a list
Return an iterator over dynamics Relocation
Return an iterator to dynamic Symbol
Binary’s entrypoint
Return the last offset used by the ELF binary according to both, the sections table and the segments table.
Overloaded function.
export_symbol(self, symbol: lief._lief.ELF.Symbol) -> lief._lief.ELF.Symbol
Export the given symbol and create an entry if it doesn’t exist
export_symbol(self, symbol_name: str, value: int = 0) -> lief._lief.ELF.Symbol
Export the symbol with the given name and create an entry if it doesn’t exist
Return the binary’s exported Function
Return dynamic Symbol which are exported
Overloaded function.
extend(self, segment: lief._lief.ELF.Segment, size: int) -> lief._lief.ELF.Segment
Extend the given given Segment by the given size
extend(self, segment: lief._lief.ELF.Section, size: int) -> lief._lief.ELF.Section
Extend the given given Section by the given size
File format (FORMATS) of the underlying binary.
List of the functions found the in the binary
Overloaded function.
get(self, tag: lief._lief.ELF.DYNAMIC_TAGS) -> lief._lief.ELF.DynamicEntry
Return the first binary’s
DynamicEntryfrom the givenDYNAMIC_TAGS.It returns None if the dynamic entry can’t be found.
get(self, type: lief._lief.ELF.SEGMENT_TYPES) -> lief._lief.ELF.Segment
Return the first binary’s
Segmentfrom the givenSEGMENT_TYPESIt returns None if the segment can’t be found.
get(self, type: lief._lief.ELF.Note.TYPE) -> lief._lief.ELF.Note
get(self, type: lief._lief.ELF.SECTION_TYPES) -> lief._lief.ELF.Section
Return the first binary’s
Sectionfrom the givenELF_SECTION_TYPESIt returns None if the section can’t be found.
Return the content located at the provided virtual address. The virtual address is specified in the first argument and size to read (in bytes) in the second.
If the underlying binary is a PE, one can specify if the virtual address is a RVA or a VA. By default, it is set to AUTO.
Get the dynamic symbol from the given name.
It returns None if it can’t be found.
Return the address of the given function name
Return the DynamicEntryLibrary with the given name
It returns None if the library can’t be found.
Overloaded function.
get_relocation(self, symbol_name: str) -> lief._lief.ELF.Relocation
Return the Relocation associated with the given symbol name
get_relocation(self, symbol: lief._lief.ELF.Symbol) -> lief._lief.ELF.Relocation
Return the Relocation associated with the given Symbol
get_relocation(self, address: int) -> lief._lief.ELF.Relocation
Return the Relocation associated with the given address
Return the Section with the given name
It returns None if the section can’t be found.
Get the static symbol from the given name.
It returns None if it can’t be found.
Return list of strings used in the current ELF file with a minimal size given in first parameter (Default: 5) It looks for strings in the .roadata section
Return the Symbol from the given name.
If the symbol can’t be found, it returns None.
Return the GnuHash object
Hash are used by the loader to speed up symbols resolution (GNU Version)
Overloaded function.
has(self, tag: lief._lief.ELF.DYNAMIC_TAGS) -> bool
Check if it exists a
DynamicEntrywith the givenDYNAMIC_TAGS
has(self, type: lief._lief.ELF.SEGMENT_TYPES) -> bool
Check if a Segment of type (SEGMENT_TYPES) exists
has(self, type: lief._lief.ELF.Note.TYPE) -> bool
Check if a Note of type (TYPE) exists
has(self, type: lief._lief.ELF.SECTION_TYPES) -> bool
Check if a Section of type (SECTION_TYPES) exists
Check if the symbol with the given name exists in the dynamic symbol table
Check if the binary uses a loader (also named linker or interpreter)
Check if the given library name exists in the current binary
True if the binary contains notes
Check if the binary has NX protection (non executable stack)
True if data are appended to the end of the binary
Check if a Section with the given name exists in the binary
Check if a Section that encompasses the given offset exists
Check if a Section that encompasses the given virtual address exists
Check if the symbol with the given name exists in the static symbol table
Return Header object
Return the program image base. (e.g. 0x400000)
Return the binary’s imported Function (name)
Return dynamic Symbol which are imported
ELF interpreter (loader) if any. (e.g. /lib64/ld-linux-x86-64.so.2)
Check if the binary has been compiled with -fpie -pie flags
To do so we check if there is a PT_INTERP segment and if the binary type is ET_DYN (Shared object)
Iterator over lief._lief.ELF.Symbol
Iterator over lief._lief.ELF.DynamicEntry
Iterator over lief._lief.ELF.Relocation
Iterator over lief._lief.ELF.Symbol
Iterator over lief._lief.ELF.Note
Iterator over lief._lief.ELF.Relocation
Iterator over lief._lief.ELF.Section
Iterator over lief._lief.ELF.Segment
Iterator over lief._lief.ELF.Symbol
Iterator over lief._lief.ELF.SymbolVersion
Iterator over lief._lief.ELF.SymbolVersionDefinition
Iterator over lief._lief.ELF.SymbolVersionRequirement
Return the last offset used in binary according to sections table
Return the last offset used in binary according to segments table
Return binary’s imported libraries (name)
Return the next virtual address available
Return an iterator over the Note entries
Return an iterator over object Relocation
Convert an offset into a virtual address.
Overlay data that are not a part of the ELF format
Overloaded function.
patch_address(self, address: int, patch_value: list[int], va_type: lief._lief.Binary.VA_TYPES = lief._lief.VA_TYPES.AUTO) -> None
patch_address(self, address: int, patch_value: int, size: int = 8, va_type: lief._lief.Binary.VA_TYPES = lief._lief.VA_TYPES.AUTO) -> None
Overloaded function.
patch_pltgot(self, symbol_name: str, address: int) -> None
Patch the imported symbol’s name with the address
patch_pltgot(self, symbol: lief._lief.ELF.Symbol, address: int) -> None
Patch the imported Symbol with the address
Apply the given permutation on the dynamic symbols table
Return an iterator over PLT/GOT Relocation
Force relocating the segments table in a specific way (see: PHDR_RELOC).
This function can be used to enforce a specific relocation of the segments table. Upon successful relocation, the function returns the offset of the relocated segments table. Otherwise, if the function fails, it returns 0
Return an iterator over all Relocation
Overloaded function.
remove(self, dynamic_entry: lief._lief.ELF.DynamicEntry) -> None
Remove the given DynamicEntry from the dynamic table
remove(self, tag: lief._lief.ELF.DYNAMIC_TAGS) -> None
Remove all the DynamicEntry with the given DYNAMIC_TAGS
remove(self, section: lief._lief.ELF.Section, clear: bool = False) -> None
Remove the given Section. The clear parameter specifies whether or not we must fill its content with 0 before removing
remove(self, note: lief._lief.ELF.Note) -> None
Remove the given Note
remove(self, type: lief._lief.ELF.Note.TYPE) -> None
Overloaded function.
remove_dynamic_symbol(self, arg: lief._lief.ELF.Symbol, /) -> None
Remove the given Symbol from the .dynsym section
remove_dynamic_symbol(self, arg: str, /) -> None
Remove the Symbol with the name given in parameter from the .dynsym section
Remove the given library
Remove the section with the given name
Remove the given Symbol from the .symtab section
Replace the Segment given in 2nd parameter with the Segment given in the first parameter and return the updated segment.
Warning
The original_segment is no longer valid after this function
Return the Section which encompasses the given offset. It returns None if a section can’t be found.
If skip_nobits is set (which is the case by default), this function won’t consider sections for which the type is SHT_NOBITS (like .bss, .tbss, ...)
Return the Section which encompasses the given virtual address. It returns None if a section can’t be found.
If skip_nobits is set (which is the case by default), this function won’t consider sections for which the type is SHT_NOBITS (like .bss, .tbss, ...)
Return an iterator over binary’s Section
Return the Segment which encompasses the given offset. It returns None if a segment can’t be found.
Return the Segment which encompasses the given virtual address. It returns None if a segment can’t be found.
Return an iterator to binary’s Segment
Return an iterator to static Symbol
Return list of strings used in the current ELF file. Basically this function looks for strings in the .roadata section
Strip the binary
Return an iterator over both static and dynamic Symbol
Return an iterator SymbolVersion
Return an iterator to SymbolVersionDefinition
Return an iterator to SymbolVersionRequirement
Return the SysvHash object
Hash are used by the loader to speed up symbols resolution (SYSV version)
Return the binary’s ELF_CLASS
True if GNU hash is used
True if SYSV hash is used
Convert the virtual address to a file offset
Return the size of the mapped binary
Overloaded function.
write(self, output: str) -> None
Rebuild the binary and write it in a file
write(self, output: str, config: lief._lief.ELF.Builder.config_t) -> None
Rebuild the binary with the given configuration and write it in a file
Return all virtual addresses that use the address given in parameter
Class which represents the ELF’s header. This is the ELF structure that starts an ELF file.
Return a list of ARM_EFLAGS present in processor_flag
Return the binary entry point
Return binary’s E_TYPE. This field determines if the binary is a executable, a library…
Return the size of the ELF header
This size should be 64 for an ELF64 binary and 52 for an ELF32.
Return a list of HEXAGON_EFLAGS present in processor_flag
Header’s identity.
Return the ABI version (integer).
Header’s ELF_CLASS.
Specify the data encoding (ELF_DATA)
Identifies the version of the ABI for which the object is prepared (OS_ABI).
Return header’s VERSION.
Return a list of LOONGARCH_EFLAGS present in processor_flag
Return the target architecture (ARCH)
Return a list of MIPS_EFLAGS present in processor_flag
Return the number of sections
Return the number of program headers (segments)
Return the VERSION
Return a list of PPC64_EFLAGS present in processor_flag
Processor-specific flags
Offset of program table (also known as segments table)
Return the size of a Segment header (lief.ELF.Segment)
This size should be 56 for a ELF64 binary and 32 for an ELF32.
Offset of section table
Return the size of a Section header (lief.ELF.Section)
This size should be 64 for a ELF64 binary and 40 for an ELF32.
Return the section index which contains sections’ names
Class which represents an ELF section.
Overloaded function.
__init__(self) -> None
Default constructor
__init__(self, name: str, type: lief._lief.ELF.SECTION_TYPES = lief._lief.ELF.SECTION_TYPES.PROGBITS) -> None
Constructor from a name and a section type
Add the given SECTION_FLAGS to the list of flags
Section alignment
Clear the content of the section with the given value
Section’s content
Section’s entropy
This property returns the size of an element in the case of a section that contains an array.
The .dynamic section contains an array of DynamicEntry. As the size of the raw C structure of this entry is 0x10 (sizeof(Elf64_Dyn)) in a ELF64, the entry_size, is set to this value.
Offset of the section’s content
Return the section’s flags as an integer
Return section’s flags as a list of SECTION_FLAGS
Return the fullname of the section including the trailing bytes
Overloaded function.
has(self, flag: lief._lief.ELF.SECTION_FLAGS) -> bool
Check if the given SECTION_FLAGS is present
has(self, segment: lief._lief.ELF.Segment) -> bool
Section information (this value depends on the section)
Iterator over lief._lief.ELF.Segment
Index to another section
Section’s name
Section’s file offset
Original size of the section’s data.
This value is used by the Builder to determine if it needs to be relocated to avoid an override of the data
Remove the given SECTION_FLAGS from the list of flags
Overloaded function.
search(self, number: int, pos: int = 0, size: int = 0) -> Optional[int]
Look for integer within the current section
search(self, str: str, pos: int = 0) -> Optional[int]
Look for string within the current section
search(self, bytes: bytes, pos: int = 0) -> Optional[int]
Look for the given bytes within the current section
Overloaded function.
search_all(self, number: int, size: int = 0) -> list[int]
Look for all integers within the current section
search_all(self, str: str) -> list[int]
Look for all strings within the current section
Return segment(s) associated with the given section
Section’s size
Return the SECTION_TYPES
Section’s virtual address
Class which represents the ELF segments
Add the given SEGMENT_FLAGS to the list of flags
The offset alignment of the segment
The raw data associated with this segment.
The file offset of the data associated with this segment
The flag permissions associated with this segment
Overloaded function.
has(self, flag: lief._lief.ELF.SEGMENT_FLAGS) -> bool
Check if the given SEGMENT_FLAGS is present
has(self, section: lief._lief.ELF.Section) -> bool
Check if the given Section is present in sections
has(self, section_name: str) -> bool
Iterator over lief._lief.ELF.Section
The physical address of the segment. This value is not really relevant on systems like Linux or Android. On the other hand, Qualcomm trustlets might use this value.
Usually this value matches virtual_address
The file size of the data associated with this segment
Remove the given SEGMENT_FLAGS from the list of flags
Iterator over the Section wrapped by this segment
Segment’s type: SEGMENT_TYPES
The virtual address of the segment.
Warning
The ELF format specifications require the following relationship:
The in-memory size of this segment.
Usually, if the .bss segment is wrapped by this segment then, virtual_size is larger than physical_size
Class which represents an entry in the dynamic table These entries are located in the .dynamic section or the PT_DYNAMIC segment
Overloaded function.
__init__(self) -> None
Default constructor
__init__(self, tag: lief._lief.ELF.DYNAMIC_TAGS, value: int) -> None
Constructor from a DYNAMIC_TAGS and value
Return the entry’s DYNAMIC_TAGS which represent the entry type
Return the entry’s value
The meaning of the value strongly depends on the tag. It can be an offset, an index, a flag, …
Class which represents a DT_NEEDED entry in the dynamic table.
This kind of entry is usually used to create library dependency.
Constructor from a library name
Library associated with this entry (e.g. libc.so.6)
Return the entry’s DYNAMIC_TAGS which represent the entry type
Return the entry’s value
The meaning of the value strongly depends on the tag. It can be an offset, an index, a flag, …
Class that represents a DT_RUNPATH wich is used by the loader to resolve libraries (DynamicEntryLibrary).
Overloaded function.
__init__(self, path: str = '') -> None
Constructor from a (run)path
__init__(self, paths: list[str]) -> None
Constructor from a list of paths
Append the given path
Insert a path at the given position
Runpath raw value
Paths as a list
Remove the given path
Runpath raw value
Return the entry’s DYNAMIC_TAGS which represent the entry type
Return the entry’s value
The meaning of the value strongly depends on the tag. It can be an offset, an index, a flag, …
Class which represents a DT_RPATH entry. This attribute is deprecated (cf. man ld) in favour of DT_RUNPATH (See DynamicRunPath)
Overloaded function.
__init__(self, path: str = '') -> None
Constructor from (r)path
__init__(self, paths: list[str]) -> None
Constructor from a list of paths
Append the given path
Insert a path at the given position
The actual rpath as a string
Paths as a list
Remove the given path
The actual rpath as a string
Return the entry’s DYNAMIC_TAGS which represent the entry type
Return the entry’s value
The meaning of the value strongly depends on the tag. It can be an offset, an index, a flag, …
Class that represent an Array in the dynamic table. This entry is associated with constructors: - DT_PREINIT_ARRAY - DT_INIT_ARRAY - DT_FINI_ARRAY
The underlying values are 64-bits integers to cover both: ELF32 and ELF64 binaries.
Constructor with DYNAMIC_TAGS and value
Append the given function
Return the array as a list of intergers
Insert the given function at pos
Remove the given function
Return the entry’s DYNAMIC_TAGS which represent the entry type
Return the entry’s value
The meaning of the value strongly depends on the tag. It can be an offset, an index, a flag, …
Constructor with DYNAMIC_TAGS and value
Overloaded function.
add(self, flag: lief._lief.ELF.DYNAMIC_FLAGS) -> None
Add the given DYNAMIC_FLAGS
add(self, flag: lief._lief.ELF.DYNAMIC_FLAGS_1) -> None
Add the given DYNAMIC_FLAGS_1
Return list of DYNAMIC_FLAGS or DYNAMIC_FLAGS_1 (integer)
Overloaded function.
has(self, flag: lief._lief.ELF.DYNAMIC_FLAGS) -> bool
Check if this entry contains the given DYNAMIC_FLAGS
has(self, flag: lief._lief.ELF.DYNAMIC_FLAGS_1) -> bool
Check if this entry contains the given DYNAMIC_FLAGS_1
Overloaded function.
remove(self, flag: lief._lief.ELF.DYNAMIC_FLAGS) -> None
Remove the given DYNAMIC_FLAGS
remove(self, flag: lief._lief.ELF.DYNAMIC_FLAGS_1) -> None
Remove the given DYNAMIC_FLAGS_1
Return the entry’s DYNAMIC_TAGS which represent the entry type
Return the entry’s value
The meaning of the value strongly depends on the tag. It can be an offset, an index, a flag, …
Class that represents an ELF relocation.
Additional value
Relocation’s address
True if this relocation has a lief.ELF.Section associated with.
This is usually the case for object files (.o)
Extra information like the symbol index
Purpose of the relocation (RELOCATION_PURPOSES).
This value provides the information about how the relocation is used (PLT/GOT resolution, .o file, …)
Section in which the relocation is applied or None if not relevant
Relocation’s size (in bits)
Symbol associated with the relocation or None if no symbol are associated with this relocation.
the symbol table Section which the relocation references
Relocation type. This value depends on the underlying architecture.
“Class which represents an ELF symbol”
A symbol’s binding determines the linkage visibility and behavior. See SYMBOL_BINDINGS
Symbol’s name demangled or an empty string if the demangling is not possible/failed
Whether the symbol is exported
Check if this symbols has a SymbolVersion
Whether the symbol is imported
This property specifies the symbol’s type and binding attributes
True if the symbol is a function
True if the symbol is a static visibility
True if the symbol is a variable
Symbol’s name
Alias for visibility
Return the section (Section) associated with this symbol if any. Otherwise, return None.
Section index associated with the symbol
Many symbols have associated sizes. For example, a data object’s size is the number of bytes contained in the object. This member holds 0 if the symbol has no size or an unknown size.
Return the SymbolVersion associated with this symbol
It returns None if no version is tied to this symbol.
The symbol’s type provides a general classification for the associated entity. See: SYMBOL_TYPES
This member has different menaing depending on the symbol’s type and the type of the ELF file (library, object, …)
In relocatable files, this property contains the alignment constraints of the symbol for which the section index is SHN_COMMON.
In relocatable files, can also contain a section’s offset for a defined symbol. That is, value is an offset from the beginning of the section associated with this symbol.
In executable and libraries, this property contains a virtual address.
Symbol SYMBOL_VISIBILITY. It’s basically an alias on other
Overloaded function.
__init__(self) -> None
Default constructor
__init__(self, arg: int, /) -> None
Constructor from value
Check if this symbols has a SymbolVersionAux
Return the SymbolVersionAux associated with this version or None if not present.
The value can be changed by assigning a SymbolVersionAuxRequirement which must already exist in the SymbolVersionRequirement. Once can use add_aux_requirement() to add a new SymbolVersionAuxRequirement.
Value associated with the symbol.
If the given SymbolVersion hasn’t Auxiliary version:
0 : The symbol is local
1 : The symbol is global
All other values are used for versions in the own object or in any of the dependencies. This is the version the symbol is tight to.
Class which represents an entry defined in DT_VERDEF or .gnu.version_d
Version information
Hash value of the symbol’s name (using ELF hash function)
Iterator over lief._lief.ELF.SymbolVersionAux
Numeric value used as an index in the :class`~.ELF.SymbolVersion` table
Version revision. Should be 1
This field should always have the value 1. It will be changed if the versioning implementation has to be changed in an incompatible way.
Class which represents an entry in the DT_VERNEED or .gnu.version_r table
Add an auxiliary version requirement to the existing entries
Auxiliary entries (iterator over SymbolVersionAuxRequirement)
Iterator over lief._lief.ELF.SymbolVersionAuxRequirement
Library’s name associated with this requirement (e.g. libc.so.6)
Version revision. Should be 1
Default constructor
Bitmask of flags
Hash value of the dependency name (use ELF hashing function)
Symbol’s name (e.g. GLIBC_2.2.5)
It returns the unique version index for the file which is used in the version symbol table. If the highest bit (bit 15) is set this is a hidden symbol which cannot be referenced from outside the object.
Class which provides a view over the GNU Hash implementation. Most of the fields are read-only since the values are re-computed by the lief.ELF.Builder.
Bloom filters
hash buckets
Overloaded function.
check(self, symbol_name: str) -> bool
Check if the symbol probably exists. If the returned value is false you can assume at 100% that the symbol with the given name doesn’t exists. If true you can’t do any assumption
check(self, hash_value: int) -> bool
Check if the symbol associated with the given probably exists. If the returned value is false you can assume at 100% that the symbol doesn’t exists. If true you can’t do any assumption
Check if the given hash pass the bloom filter
Check if the given hash pass the bucket filter
Hash values
Return the number of buckets
Shift count used in the bloom filter
Index of the first symbol in the dynamic symbols table which is accessible with the hash table
Class which represents the SYSV hash for the symbols resolution
References:
Buckets values
Chains values
Return the number of buckets
Return the number of chains (symbol table index)
Class which represents an ELF note.
The underlying integer value
Duplicate the current instance of this object
Return the description associated with the note
Return the name of the note also known as the owner.
Return the original NT_ value of the note.
This value should be interpreted according the the name of the note.
Size of the raw note
Return the LIEF type representation of the note.
The underlying integer value
Duplicate the current instance of this object
Return the description associated with the note
Return the name of the note also known as the owner.
Return the original NT_ value of the note.
This value should be interpreted according the the name of the note.
Size of the raw note
Return the LIEF type representation of the note.
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
Original target architecture.
Duplicate the current instance of this object
Return the description associated with the note
Overloaded function.
get(self, reg: lief._lief.ELF.CorePrStatus.Registers.X86) -> Optional[int]
Get the register value or non if it is not present
get(self, reg: lief._lief.ELF.CorePrStatus.Registers.X86_64) -> Optional[int]
Get the register value or non if it is not present
get(self, reg: lief._lief.ELF.CorePrStatus.Registers.ARM) -> Optional[int]
Get the register value or non if it is not present
get(self, reg: lief._lief.ELF.CorePrStatus.Registers.AARCH64) -> Optional[int]
Get the register value or non if it is not present
Return the name of the note also known as the owner.
Return the original NT_ value of the note.
This value should be interpreted according the the name of the note.
Return the program counter value (rip, pc, eip etc)
List of the register values. This list is guarantee to be as long as the number of registers defined in the Registers or empty if it can’t be resolved.
Thus, one can access a specific register through:
reg_vals: list[int] = note.register_values()
x20 = reg_vals[CorePrStatus.Registesr.AARCH64.X20.value]
The value of the register that holds the return value according to the calling convention.
Overloaded function.
set(self, reg: lief._lief.ELF.CorePrStatus.Registers.X86, value: int) -> lief._lief.ok_error_t
Change the register value
set(self, reg: lief._lief.ELF.CorePrStatus.Registers.X86_64, value: int) -> lief._lief.ok_error_t
Change the register value
set(self, reg: lief._lief.ELF.CorePrStatus.Registers.ARM, value: int) -> lief._lief.ok_error_t
Change the register value
set(self, reg: lief._lief.ELF.CorePrStatus.Registers.AARCH64, value: int) -> lief._lief.ok_error_t
Change the register value
Size of the raw note
Return the stack pointer value
Info associated with the signal
Return the LIEF type representation of the note.
The underlying integer value
Duplicate the current instance of this object
Return the description associated with the note
End address of mapped file
Offset (in core) of mapped file
Path of mapped file
Start address of mapped file
List of files mapped in core. (list of CoreFileEntry)
Overloaded function.
__init__(self) -> None
Default constructor
__init__(self, arg: lief._lief.ELF.CoreFile.files_t) -> None
Copy constructor
__init__(self, arg: Iterable[lief._lief.ELF.CoreFile.entry_t], /) -> None
Construct from an iterable object
Append arg to the end of the list.
Remove all items from list.
Extend self by appending elements from arg.
Insert object arg1 before index arg0.
Remove and return item at index (default last).
Return the name of the note also known as the owner.
Return the original NT_ value of the note.
This value should be interpreted according the the name of the note.
Size of the raw note
Return the LIEF type representation of the note.
The underlying integer value
Duplicate the current instance of this object
Return the description associated with the note
Return the name of the note also known as the owner.
Return the original NT_ value of the note.
This value should be interpreted according the the name of the note.
Signal code
If non-zero, an errno value associated with this signal
Signal number
Size of the raw note
Return the LIEF type representation of the note.
The underlying integer value
Duplicate the current instance of this object
Return the description associated with the note
Get the auxv value from the provided type. Return None if it is not present.
Return the name of the note also known as the owner.
Return the original NT_ value of the note.
This value should be interpreted according the the name of the note.
Overloaded function.
set(self, type: lief._lief.ELF.CoreAuxv.TYPE, value: int) -> bool
Change the value for the given type.
set(self, arg: dict[lief._lief.ELF.CoreAuxv.TYPE, int], /) -> bool
Replace all the values by the given dictionary.
Size of the raw note
Return the LIEF type representation of the note.
Return the auxiliary vector as a dictionary of TYPE / int
The underlying integer value
Duplicate the current instance of this object
Return the description associated with the note
Return the name of the note also known as the owner.
Android NDK build number
Android NDK version used to build the current binary
Return the original NT_ value of the note.
This value should be interpreted according the the name of the note.
Target SDK platform
Size of the raw note
Return the LIEF type representation of the note.
Class that wraps the NT_GNU_ABI_TAG note
The underlying integer value
The underlying integer value
Return the target ABI
Duplicate the current instance of this object
Return the description associated with the note
Return the name of the note also known as the owner.
Return the original NT_ value of the note.
This value should be interpreted according the the name of the note.
Size of the raw note
Return the LIEF type representation of the note.
Return the target version as (Major, Minor, Patch)
This object represents the NT_GNU_PROPERTY_TYPE_0 note.
This class wraps the different properties that can be used in a NT_GNU_PROPERTY_TYPE_0 note
The underlying integer value
The underlying integer value
Duplicate the current instance of this object
Return the description associated with the note
Find the property with the given type or return None
Return the name of the note also known as the owner.
Return the original NT_ value of the note.
This value should be interpreted according the the name of the note.
Return the properties as a list of Property
Size of the raw note
Return the LIEF type representation of the note.
This class represents a property which doesn’t have a concrete LIEF implementation.
The underlying integer value
The original raw type as an integer. This value might depends on the architecture and/or the file type.
This class represents the GNU_PROPERTY_AARCH64_FEATURE_1_AND note.
The underlying integer value
The underlying integer value
Return the list of the supported features.
This class provides an interface over the GNU_PROPERTY_NO_COPY_ON_PROTECTED property. This property indicates that the linker shouldn’t copy relocations against protected symbols.
The underlying integer value
This class provides an interface over the GNU_PROPERTY_STACK_SIZE property This property can be used by the loader to raise the stack limit.
The underlying integer value
This class interfaces the different GNU_PROPERTY_X86_FEATURE_* properties which includes:
GNU_PROPERTY_X86_FEATURE_1_AND
GNU_PROPERTY_X86_FEATURE_2_USED
GNU_PROPERTY_X86_FEATURE_2_NEEDED
The underlying integer value
The underlying integer value
The underlying integer value
This class interfaces the different GNU_PROPERTY_X86_ISA_* properties which includes:
GNU_PROPERTY_X86_ISA_1_USED
GNU_PROPERTY_X86_ISA_1_NEEDED
GNU_PROPERTY_X86_COMPAT_ISA_1_USED
GNU_PROPERTY_X86_COMPAT_ISA_1_NEEDED
GNU_PROPERTY_X86_COMPAT_2_ISA_1_USED
GNU_PROPERTY_X86_COMPAT_2_ISA_1_NEEDED
The underlying integer value
The underlying integer value
The underlying integer value
List of the ISA values in this property
Class which takes an lief.ELF.Binary object and reconstructs a valid binary
Constructor that takes a Binary
Perform the build of the provided ELF binary
Tweak the ELF builder with the provided config parameter
Interface to tweak the Builder
Rebuild the PT_DYNAMIC segment
Rebuild FINI_ARRAY
Force to relocate all the ELF structures that can be relocated (mostly for testing)
Rebuild INIT_ARRAY
Rebuild the PT_INTERP segment
Rebuild PT_NOTES segment(s)
Rebuild PREINIT_ARRAY
Rebuild .symtab section
Return the build result as a list of bytes
Write the build result into the output file
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value
The underlying integer value