Repolode
Submit
lief-project

lief-project/LIEF

A cross-platform C++ library with Python and Rust bindings to parse, modify and abstract ELF, PE, Mach-O and Android executable formats.

View on GitHubWebsite
Stars
5,638
Forks
759
Open issues
37
Last commit
4 hours ago

What is it?

LIEF is a library for parsing, modifying and abstracting executable file formats, including ELF, PE, Mach-O, COFF, and Android formats such as OAT, DEX, VDEX and ART. It exposes a structured API to inspect sections, symbols, headers and other internals, and allows some parts of a binary to be changed, such as adding a section or renaming a symbol. For formats that share concepts like sections, symbols and entry points, it provides a common abstraction layer.

The library is available through C++, Python and Rust bindings, and is installable via CMake, pip, Homebrew and Cargo. Extended features include a runtime module, DWARF and PDB debug information support, Objective-C metadata parsing, dyld shared cache extraction, and disassembler and assembler components for several architectures including AArch64, x86-64, ARM and RISC-V. Ghidra and Binary Ninja plugins are also provided.

Key features

  • 01Parses ELF, PE, Mach-O, COFF, OAT, DEX, VDEX and ART files through a user-friendly API.
  • 02Modifies parts of binaries, such as adding sections or changing symbol names.
  • 03Offers a common abstraction over sections, symbols and entry points across formats.
  • 04Provides C++, Python and Rust bindings.
  • 05Includes disassembler and assembler components for multiple architectures.
  • 06Supports DWARF and PDB debug information, and Objective-C metadata.

Use cases

  • Analyzing malware or suspicious binaries across Windows, Linux and macOS.
  • Writing scripts that inspect or patch executables in reverse engineering workflows.
  • Inspecting Android DEX, OAT or ART files as part of app analysis.
  • Building binary analysis tools that need a cross-platform parser.

Quick start

  1. 1

    Install the Python package from PyPI

    pip install lief
  2. 2

    Parse a binary and list its ELF sections

Things to know

  • Nightly builds and the 2.0 development version may introduce breaking changes.
  • Some extended features such as the LIEF Extended service require a GitHub OAuth login.

In collections

Reverse engineering toolsAndroid apps & phone tools

Topics

#binary-analysis#reverse-engineering#elf#pe#macho#executable-formats#malware-analysis#android#art#dex

FAQ

What is LIEF?
A cross-platform C++ library with Python and Rust bindings to parse, modify and abstract ELF, PE, Mach-O and Android executable formats. LIEF is a library for parsing, modifying and abstracting executable file formats, including ELF, PE, Mach-O, COFF, and Android formats such as OAT, DEX, VDEX and ART. It exposes a structured API to inspect sections, symbols, headers and other internals, and allows some parts of a binary to be changed, such as adding a section or renaming a symbol. For formats that share concepts like sections, symbols and entry points, it provides a common abstraction layer.
Is LIEF free to use? What license does it have?
LIEF is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is LIEF still maintained?
Actively maintained. The last commit to LIEF was on Nov 7, 2026.
What can I use LIEF for?
Analyzing malware or suspicious binaries across Windows, Linux and macOS. Writing scripts that inspect or patch executables in reverse engineering workflows. Inspecting Android DEX, OAT or ART files as part of app analysis. Building binary analysis tools that need a cross-platform parser.
How do I install LIEF?
Install the Python package from PyPI: pip install lief Parse a binary and list its ELF sections
Where can I get LIEF?
The source code and installation instructions are on GitHub: https://github.com/lief-project/LIEF

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects