tessl/pypi-lief

Library to instrument executable formats including ELF, PE, Mach-O, and Android formats

—

Pending

Overview

Eval results

Files

Extended Features

Name: tessl/pypi-lief
Author: tessl

Advanced platform-specific features providing deep integration with Apple ecosystem technologies including Objective-C runtime metadata and macOS/iOS shared cache analysis.

Capabilities

Objective-C Metadata

Comprehensive Objective-C runtime metadata extraction for analyzing classes, methods, properties, and protocols in macOS and iOS binaries.

# Access through lief.objc module
import lief.objc as ObjC

class Metadata:
    classes: Iterator[Class]
    protocols: Iterator[Protocol]
    
    def get_class(self, name: str) -> Optional[Class]
    def get_protocol(self, name: str) -> Optional[Protocol]

class Class:
    name: str
    super_class: Optional[Class]
    methods: Iterator[Method]
    ivars: Iterator[IVar]
    properties: Iterator[Property]
    protocols: Iterator[Protocol]
    
class Method:
    name: str
    mangled_type: str
    address: int
    is_instance: bool
    
class Property:
    name: str
    attribute: str
    
class Protocol:
    name: str
    methods: Iterator[Method]
    properties: Iterator[Property]
    
class IVar:
    name: str
    type: str
    offset: int

Usage example:

import lief
import lief.objc as ObjC

# Parse Mach-O binary with Objective-C metadata
binary = lief.parse("/System/Library/Frameworks/Foundation.framework/Foundation")

if hasattr(binary, 'objc_metadata') and binary.objc_metadata:
    objc = binary.objc_metadata
    
    # List all Objective-C classes
    for cls in objc.classes:
        print(f"Class: {cls.name}")
        if cls.super_class:
            print(f"  Inherits from: {cls.super_class.name}")
        
        # List methods
        for method in cls.methods:
            print(f"  Method: {method.name} ({'instance' if method.is_instance else 'class'})")

Dyld Shared Cache

Support for analyzing macOS and iOS shared caches that contain multiple dynamic libraries optimized for system performance.

# Access through lief.dsc module  
import lief.dsc as DSC

class DyldSharedCache:
    architecture: str
    platform: PLATFORMS
    version: str
    
    def dylibs(self) -> Iterator[Dylib]
    def mapping_info(self) -> Iterator[MappingInfo]
    def find_lib_from_name(self, name: str) -> Optional[Dylib]
    def find_lib_from_path(self, path: str) -> Optional[Dylib]
    def has_subcaches(self) -> bool
    def subcaches(self) -> Iterator[SubCache]
    
class Dylib:
    path: str
    address: int
    modtime: int
    inode: int
    
    def get_binary(self) -> Optional[MachO.Binary]
    
class MappingInfo:
    address: int
    size: int
    file_offset: int
    max_protection: int
    init_protection: int
    
class SubCache:
    suffix: str
    uuid: bytes
    cache_type: CACHE_TYPE

Usage example:

import lief.dsc as DSC

# Parse shared cache
cache = DSC.load("/System/Library/dyld/dyld_shared_cache_arm64e")

if cache:
    print(f"Architecture: {cache.architecture}")
    print(f"Platform: {cache.platform}")
    
    # List all dylibs in cache
    for dylib in cache.dylibs():
        print(f"Dylib: {dylib.path}")
        
        # Extract individual binary
        binary = dylib.get_binary()
        if binary:
            print(f"  Entry point: 0x{binary.entrypoint:x}")
    
    # Find specific library
    foundation = cache.find_lib_from_name("Foundation")
    if foundation:
        print(f"Found Foundation at: 0x{foundation.address:x}")

Types

class PLATFORMS(enum.Enum):
    UNKNOWN = 0
    MACOS = 1
    IOS = 2
    TVOS = 3
    WATCHOS = 4
    BRIDGEOS = 5
    MACCATALYST = 6
    IOSSIMULATOR = 7
    TVOSSIMULATOR = 8
    WATCHOSSIMULATOR = 9
    
class CACHE_TYPE(enum.Enum):
    REGULAR = 0
    STUB_ISLAND = 1

Install with Tessl CLI