Blog •
Documentation •
About
# About
The purpose of this project is to provide a cross-platform library to parse,
modify and abstract ELF, PE and MachO formats.
**Main features**:
* **Parsing**: LIEF can parse [ELF](https://lief.re/doc/latest/formats/elf/index.html), [PE](https://lief.re/doc/latest/formats/pe/index.html), [MachO](https://lief.re/doc/latest/formats/macho/index.html), [COFF](https://lief.re/doc/latest/formats/coff/index.html), OAT, DEX, VDEX, ART and provides a user-friendly API to access their internals.
* **Modify**: LIEF can be used to modify some parts of these formats (adding a section, changing a symbol's name, ...)
* **Abstract**: Three formats have common features like sections, symbols, entry point... LIEF factors them.
* **API**: You can use LIEF via [C++](https://lief.re/doc/latest/doxygen/), Python, [Rust](https://lief-rs.s3.fr-par.scw.cloud/doc/latest/lief/index.html), and
[Node.js](https://github.com/Piebald-AI/node-lief) (unofficial, AI-generated)
**Extended features**:
* [**Runtime**](https://lief.re/doc/latest/runtime/intro.html)
* [**DWARF/PDB** Support](https://lief.re/doc/latest/extended/debug_info/index.html)
* [**Objective-C** Metadata](https://lief.re/doc/latest/extended/objc/index.html)
* [**Dyld Shared Cache**](https://lief.re/doc/latest/extended/dsc/index.html) with support for extracting Dylib
* [**Disassembler**](https://lief.re/doc/latest/extended/disassembler/index.html): AArch64, x86/x86-64, ARM, RISC-V, Mips, PowerPC, eBPF
* [**Assembler**](https://lief.re/doc/latest/extended/assembler/index.html): AArch64, x86/x86-64, RISC-V
**Plugins**:
* [**Ghidra**](https://lief.re/doc/latest/plugins/ghidra/index.html)
* [**BinaryNinja**](https://lief.re/doc/latest/plugins/binaryninja/index.html)
# Sponsors
# Content
- [About](#about)
- [Downloads / Install](#downloads--install)
- [Getting started](#getting-started)
- [Blog](https://lief.re/blog/)
- [Documentation](#documentation)
- [Rust](https://lief.re/doc/stable/rust/lief/)
- [Sphinx](https://lief.re/doc/latest/index.html)
- [Doxygen](https://lief.re/doc/latest/doxygen/index.html)
- Tutorials:
- [Parse and manipulate formats](https://lief.re/doc/latest/tutorials/01_play_with_formats.html)
- [Play with ELF symbols](https://lief.re/doc/latest/tutorials/03_elf_change_symbols.html)
- [PE Resources](https://lief.re/doc/latest/tutorials/07_pe_resource.html)
- [Transforming an ELF executable into a library](https://lief.re/doc/latest/tutorials/08_elf_bin2lib.html)
- [How to use frida on a non-rooted device](https://lief.re/doc/latest/tutorials/09_frida_lief.html)
- [Android formats](https://lief.re/doc/latest/tutorials/10_android_formats.html)
- [Mach-O modification](https://lief.re/doc/latest/tutorials/11_macho_modification.html)
- [ELF Coredump](https://lief.re/doc/latest/tutorials/12_elf_coredump.html)
- [PE Authenticode](https://lief.re/doc/latest/tutorials/13_pe_authenticode.html)
- [Contact](#contact)
- [About](#about-1)
- [Authors](#authors)
- [License](#license)
- [BibTeX](#bibtex)
## Downloads / Install
### C++
```cmake
find_package(LIEF REQUIRED)
target_link_libraries(my-project LIEF::LIEF)
```
### Rust
```toml
[package]
name = "my-awesome-project"
version = "0.0.1"
edition = "2024"
[dependencies]
lief = "1.0.0"
```
### Homebrew
```console
brew install lief
```
### Python
To install the latest **version** (release):
```console
pip install lief
```
To install nightly build:
```console
pip install [--user] --force-reinstall --index-url https://lief.s3-website.fr-par.scw.cloud/latest lief==2.0.0.dev0
```
### Packages
- LIEF Extended: https://extended.lief.re (GitHub OAuth)
- **Nightly**:
* SDK: https://lief.s3-website.fr-par.scw.cloud/latest/sdk
* Python Wheels: https://lief.s3-website.fr-par.scw.cloud/latest/lief
- **v1.0.0**: https://github.com/lief-project/LIEF/releases/tag/1.0.0
Here are guides to install or integrate LIEF:
* [Python](https://lief.re/doc/latest/installation.html#python)
* [Visual Studio](https://lief.re/doc/latest/installation.html#visual-studio-integration)
* [Xcode](https://lief.re/doc/latest/installation.html#xcode-integration)
* [CMake](https://lief.re/doc/latest/installation.html#cmake-integration)
## Getting started
### Python
```python
import lief
# ELF
binary = lief.parse("/usr/bin/ls")
for section in binary.sections:
print(section.name, section.virtual_address)
# PE
binary = lief.parse(r"C:\Windows\explorer.exe")
if (rheader := binary.rich_header) is not None:
print(rheader.key)
# Mach-O
binary = lief.parse("/usr/bin/ls")
if (fixups := binary.dyld_chained_fixups) is not None:
print(fixups)
```
### Rust
```rust
use lief::Binary;
use lief::pe::debug::Entries::CodeViewPDB;
if let Some(Binary::PE(pe)) = Binary::parse(path.as_str()) {
for entry in pe.debug() {
if let CodeViewPDB(pdb_view) = entry {
println!("{}", pdb_view.filename());
}
}
}
```
### C++
```cpp
#include
#include
int main(int argc, char** argv) {
// ELF
if (std::unique_ptr elf = LIEF::ELF::Parser::parse("/bin/ls")) {
for (const LIEF::ELF::Section& section : elf->sections()) {
std::cout << section.name() << ' ' << section.virtual_address() << '\n';
}
}
// PE
if (std::unique_ptr pe = LIEF::PE::Parser::parse("C:\\Windows\\explorer.exe")) {
if (const LIEF::PE::RichHeader* rheader = pe->rich_header()) {
std::cout << rheader->key() << '\n';
}
}
// Mach-O
if (std::unique_ptr macho = LIEF::MachO::Parser::parse("/bin/ls")) {
for (const LIEF::MachO::Binary& bin : *macho) {
if (const LIEF::MachO::DyldChainedFixups* fixups = bin.dyld_chained_fixups()) {
std::cout << *fixups << '\n';
}
}
}
return 0;
}
```
## Documentation
* [Main documentation](https://lief.re/doc/latest/index.html)
* [Doxygen](https://lief.re/doc/latest/doxygen/index.html)
* [Rust](https://lief.re/doc/stable/rust/lief/)
## Contact
* **Mail**: contact at lief re
* **Discord**: [LIEF](https://discord.gg/7hRFGWYedu)
## About
### Authors
Romain Thomas ([@rh0main](https://www.romainthomas.fr/)) - Formerly at [Quarkslab](https://www.quarkslab.com)
### License
[Apache 2.0](https://github.com/lief-project/LIEF/blob/1.0.0/LICENSE).
### BibTeX
```bibtex
@MISC {LIEF,
author = "Romain Thomas",
title = "LIEF - Library to Instrument Executable Formats",
howpublished = "https://lief.quarkslab.com/",
month = "apr",
year = "2017"
}
```