About

The purpose of this project is to provide a cross platform library which can parse, modify and abstract ELF, PE and MachO formats.

Main features:

• Parsing: LIEF can parse ELF, PE, MachO, OAT, DEX, VDEX, ART and provides an user-friendly API to access to format internals.
• Modify: LIEF enables to modify some parts of these formats
• Abstract: Three formats have common features like sections, symbols, entry point... LIEF factors them.
• API: LIEF can be used in C, C++ and Python

Content

• About
• Download / Install
• Getting started
• Documentation
  • Sphinx
  • Doxygen
  • Tutorials:
    • Parse and manipulate formats
    • Create a PE from scratch
    • Play with ELF symbols
    • ELF Hooking
    • Infecting the plt/got
    • PE Hooking
    • PE Resources
    • Transforming an ELF executable into a library
    • How to use frida on a non-rooted device
    • Android formats
    • Mach-O modification
    • ELF Coredump
• Contact
• About
  • Authors
  • License
  • Bibtex

Downloads / Install

First make sur to have an updated version of setuptools:

pip install setuptools --upgrade

To install the latest version (release):

pip install lief

To install nightlty build:

pip install [--user] --index-url  https://lief-project.github.io/packages lief

Packages

Linux	Windows - x86	Windows - x86-64	OSX
SDK	SDK	SDK	SDK
Python

Linux	Windows	OSX	CentOS	Android	Documentation
SDK	SDK - x86 SDK - x86-64	SDK	SDK	SDK - x86-64 SDK - x86 SDK - ARM SDK - AARCH64	Sphinx + Doxygen
Python

Here one can find guides to install or integrate LIEF:

• Python
• VisualStudio
• XCode
• CMake

Getting started

Python

C++

C

Documentation

• Main documentation
• Tutorial
• API
• Doxygen

Contact

• Mail: lief at quarkslab com
• Gitter: lief-project

About

Authors

Romain Thomas (@rh0main) - Quarkslab

License

LIEF is provided under the Apache 2.0 license.

Bibtex

@MISC {LIEF,
  author       = "Romain Thomas",
  title        = "LIEF - Library to Instrument Executable Formats",
  howpublished = "https://lief.quarkslab.com/",
  month        = "April",
  year         = "2017",
}