The purpose of this project is to provide a cross platform library which can parse, modify and abstract ELF, PE and MachO formats.
Main features:
- Parsing:LIEF can parse ELF, PE, MachO, OAT, DEX, VDEX, ART and provides an user-friendly API to access to format internals.
- Modify:LIEF enables to modify some parts of these formats
- Abstract:Three formats have common features like sections, symbols, entry point... LIEF factors them.
- API:LIEF can be used in C++, Python, Rust and C
First, make sure to have an updated version of setuptools:
pip install setuptools --upgradeTo install the latestversion(release):
pip install liefTo install nightly build:
pip install [--user] --index-url https://lief.s3-website.fr-par.scw.cloud/latest lief==0.16.0.dev0- Nightly:
- v0.15.1:https://github.com/lief-project/LIEF/releases/tag/0.15.1
Here are guides to install or integrate LIEF:
importlief
# ELF
binary=lief.parse("/usr/bin/ls")
forsectioninbinary.sections:
print(section.name,section.virtual_address)
# PE
binary=lief.parse("C:\\Windows\\explorer.exe ")
ifrheader:=pe.rich_header:
print(rheader.key)
# Mach-O
binary=lief.parse("/usr/bin/ls")
forfixupinbinary.dyld_chained_fixups:
print(fixup)uselief::Binary;
uselief::pe::debug::Entries::CodeViewPDB;
ifletSome(Binary::PE(pe))=Binary::parse(path.as_str()){
forentryinpe.debug(){
ifletCodeViewPDB(pdb_view)= entry{
println!("{}",pdb_view.filename());
}
}
}#include<LIEF/LIEF.hpp>
intmain(intargc,char** argv) {
//ELF
if(std::unique_ptr<constLIEF::ELF::Binary> elf =LIEF::ELF::Parser::parse("/bin/ls")) {
for(constLIEF::ELF::Section& section: elf->sections()) {
std::cout << section->name() <<''<< section->virtual_address() <<'\n';
}
}
//PE
if(std::unique_ptr<constLIEF::PE::Binary> pe =LIEF::PE::Parser::parse("C:\\Windows\\explorer.exe")) {
if(constLIEF::PE::RichHeader* rheader: pe->rich_header()) {
std::cout << rheader->key() <<'\n';
}
}
//Mach-O
if(std::unique_ptr<LIEF::MachO::FatBinary> macho =LIEF::MachO::Parser::parse("/bin/ls")) {
for(constLIEF::MachO::DyldChainedFixups& fixup: macho->dyld_chained_fixups()) {
std::cout << fixup <<'\n';
}
}
return0;
}
#include<LIEF/LIEF.h>
intmain(intargc,char** argv) {
Elf_Binary_t* elf =elf_parse("/usr/bin/ls");
Elf_Section_t** sections = elf->sections;
for(size_ti =0;sections[i]!=NULL;++i) {
printf("%s\n",sections[i]->name);
}
elf_binary_destroy(elf);
return0;
}- Mail:contact at lief re
- Discord:LIEF
Romain Thomas (@rh0main) -Quarkslab
LIEF is provided under theApache 2.0 license.
@MISC{LIEF,
author="Romain Thomas",
title="LIEF - Library to Instrument Executable Formats",
howpublished="https://lief.quarkslab.com/",
month="apr",
year="2017"
}