DOCSEARCHbyAlgolia
Submit Docs

LIEF Library Documentation

repository·main·Indexed 26 days ago

https://github.com/lief-project/lief

A cross-platform library to parse, modify, and abstract executable formats including ELF, PE, MachO, COFF, OAT, DEX, and VDEX. LIEF provides a unified API for manipulating binary internals across C++, Python, and Rust, and includes tools like LIEF-Patchelf and plugins for Binary Ninja.

Tokens
59.1K
Snippets
60
Records
576
Agent score
90%

What's inside LIEF

  4. Explore projects using LIEF

    main

    LIEF is used by various open-source projects across different domains such as static analysis, malware analysis, machine learning, and binary loading. Below is a list of notable projects that leverage LIEF:

    Static Analysis & Linting

    • BLint (Python): A binary linter for checking security properties and capabilities in executables.
    • checksec.py (Python): A tool to verify security properties of binaries enabled by compilers.
    • smda (Python): A recursive disassembler using LIEF as an ELF and PE loader.
    • conan-io/hooks (Python): A binary linter used within Conan hooks.

    Malware & Security Analysis

    • Mobile-Security-Framework-MobSF (Python): Automated mobile application (Android/iOS/Windows) pen-testing and malware analysis.
    • MISP (Python): Malware Information Sharing Platform and Threat Sharing.
    • Virus Disinfector KIT (Python): A tool for disinfecting PE files.
    • Ledger-Donjon/rainbow (Python): A trace generator based on Unicorn and LIEF as a loader.

    Binary Manipulation & Loading

    • shrinkwrap (Python): Embeds required dependencies into top-level executables (ELF).
    • sqlelf (Python): Explores ELF objects using SQL.
    • QBDL (Python/C++): A modular and portable way to dynamically load and link binaries.
    • ANBU (C++): Automatic New Binary Unpacker using the PIN DBI Framework.

    Machine Learning & Research

    • youarespecial (Python): Machine learning models for malware.
    • gym-malware (Python): Learning to bypass AV through machine learning.

    Other Tools

    • Maat (Python/C++): Symbolic Execution Framework based on Ghidra's sleigh.
    • Datalog Disassembly (C++): A fast disassembler using the Datalog (souffle) language.
    • lief-sys (Rust): Rust bindings for LIEF.
    • Wiggle (Python): An executable binary metadata search engine.

  5. Use the LIEF Runtime Memory interface

    main

    The LIEF Runtime Memory interface provides an API to allocate, inspect, and manipulate memory within the current process. Key capabilities include:

    • Mapping anonymous pages.
    • Changing memory protection levels.
    • Reading from or writing to any virtual address.

    When used in conjunction with lief-runtime-assemble, it enables lightweight JIT (Just-In-Time) code generation. It can also be paired with lief-runtime-disassemble to disassemble code directly from memory.

  6. Use the LIEF plugin for BinaryNinja

    main

    LIEF provides plugins for Binary Ninja to leverage its binary analysis capabilities within the Binary Ninja environment. For detailed documentation, installation instructions, and advanced usage, refer to the official LIEF documentation.

    https://lief.re/doc/latest/plugins/binaryninja/index.html

  8. Understand Mach-O Binary Structure

    main

    A basic (non-FAT) Mach-O binary consists of four main parts:

    1. Header: Accessible via lief.MachO.Binary.header.
    2. Load Commands Table: Can be iterated over using lief.MachO.Binary.load_commands. These commands define segments, shared libraries, and entry points.
    3. Padding/Free Space: Often used by macOS for signing (e.g., codesign adds LC_CODE_SIGNATURE or LC_DYLIB_CODE_SIGN_DRS here).
    4. Raw Data: Contains assembly code, rebase bytecode, signatures, etc.

    Modifying the binary often involves adding or replacing load commands (like lief.MachO.UUIDCommand or lief.MachO.CodeSignature) within the padding area or by shifting the raw data section to create space.

  9. Understand Android OAT and DEX formats

    main

    Android applications use several formats for code execution. Understanding the relationship between them is key for analysis:

    • DEX: Contains Dalvik bytecode. Usually found in APKs as classes.dex.
    • OAT/ODEX: These are ELF files that wrap the Android-specific OAT format. They contain optimized native code. While they often have .odex or .oat extensions, they can sometimes appear with a .dex extension.
    • VDEX: Introduced in Android Oreo (8.0.0). When dex2oat optimizes a DEX file, it produces a classes.odex (the ELF/OAT file with native code) and a classes.vdex file. The VDEX file contains a copy of the original DEX files and is not an ELF file.

    Warning: Do not rely on file extensions. A .dex file might actually be an OAT/ELF file. Use tools like file to verify the actual format.

  10. Understand LIEF Rust crate structure

    main

    LIEF's Rust bindings are organized into several crates:

    • lief: The high-level, idiomatic Rust API for end-users.
    • lief-ffi: The low-level FFI API based on cxx.
    • lief-build: A build-script helper used by lief-ffi to fetch pre-compiled artifacts and emit cargo link directives.
    • lief-ffigen: A standalone CLI used to generate the C++ side of the cxx bridge from #[cxx::bridge] modules in lief-ffi.