lief
Library to instrument executable formats
Decision gist · record as of 2026-08-14
Yes, if you need to parse or modify binary executables across multiple formats and platforms. LIEF is actively maintained, permissively licensed, has no known vulnerabilities, and offers a mature API. Medium install friction is the main caveat; verify your Python version meets the >=3.9 requirement before installing.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python >=3.9; verify your Python version before installing.
- Medium install friction: precompiled wheels available across macOS, Linux (manylinux, musllinux, multiple architectures), and Windows.
- Maintenance is active with a release 33 days old.
License · maintenance · safety
Apache License 2.0 (permissive) — Apache License 2.0 (permissive): you may use, modify, and distribute LIEF freely in commercial and private projects, provided you include a copy of the license and state material changes.
last release 2026-07-12 (33 days)
0 known vulnerabilities (OSV.dev, 2026-08-14) · 1,861,335 downloads/mo, #3,482 on PyPI
Alternatives
Verify before relying
pip install lief
import lief
elf = lief.ELF.parse("/bin/ls")
for section in elf.sections:
print(section.name, len(section.content))- Whether DWARF/PDB support and Objective-C metadata are included in the base package or require a separate Extended edition.
- Performance characteristics and memory overhead when parsing large binaries.
- Stability and completeness of modification features across all supported formats.
- Which Python versions beyond 3.9 are supported by available precompiled wheels.
What it is and what it does
LIEF is a cross-platform binary parsing and manipulation library that abstracts the complexity of ELF, PE, MachO, OAT, DEX, VDEX, and ART executable formats into a unified, user-friendly API. It lets you read binary structure internals—sections, symbols, imports, entry points—and modify certain parts of these formats programmatically. The library is written in C++ with bindings for Python, C, C++, and Rust, and is actively maintained.
You would use LIEF when you need to inspect or instrument compiled binaries without writing format-specific parsers, or when you're building reverse-engineering, security analysis, or binary instrumentation tools. It handles the low-level format details so you can focus on your analysis or transformation logic.
Use it for
- Inspect sections, symbols, and imports from ELF, PE, or MachO binaries for security audits or malware analysis.
- Modify binary metadata or sections to instrument executables for debugging or dynamic analysis.
- Parse mobile and Android formats (DEX, VDEX, OAT, ART) to analyze app structure and bytecode.
- Build reverse-engineering tools that need to work across multiple binary formats on different platforms.
- Extract and analyze debug information from compiled binaries for forensic or compatibility checks.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you need to parse or modify binary executables across multiple formats and platforms.
LIEF is actively maintained, permissively licensed, has no known vulnerabilities, and offers a mature API. Medium install friction is the main caveat; verify your Python version meets the >=3.9 requirement before installing.
Install
lief on PyPI
Before you install
Medium install friction: precompiled wheels available across macOS, Linux (manylinux, musllinux, multiple architectures), and Windows. Maintenance is active with a release 33 days old.
Requires Python >=3.9; verify your Python version before installing.
License in practice
Apache License 2.0 (permissive): you may use, modify, and distribute LIEF freely in commercial and private projects, provided you include a copy of the license and state material changes.
Quickstart
pip install lief
import lief
elf = lief.ELF.parse("/bin/ls")
for section in elf.sections:
print(section.name, len(section.content))Verify before relying
- Whether DWARF/PDB support and Objective-C metadata are included in the base package or require a separate Extended edition.
- Performance characteristics and memory overhead when parsing large binaries.
- Stability and completeness of modification features across all supported formats.
- Which Python versions beyond 3.9 are supported by available precompiled wheels.
Package facts
| License | Apache License 2.0 permissive |
| Python support | Supports the current Python release >=3.9 |
| Install friction | Medium. Platform-specific wheel |
| Runtime dependencies | None |
| Maintenance | Actively maintained 33 days since the last release |
| First released | |
| Downloads | 1,861,335 / month, #3,482 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 4 - BetaProgramming Language :: C++Programming Language :: Python :: 3Topic :: Software Development :: Libraries |
Evidence: lief-1.0.0-cp310-cp310-macosx_11_0_arm64.whl; lief-1.0.0-cp310-cp310-macosx_11_0_x86_64.whl; lief-1.0.0-cp310-cp310-manylinux_2_28_aarch64.whl; lief-1.0.0-cp310-cp310-manylinux_2_28_i686.whl; lief-1.0.0-cp310-cp310-manylinux_2_28_riscv64.whl; lief-1.0.0-cp310-cp310-manylinux_2_28_x86_64.whl; lief-1.0.0-cp310-cp310-musllinux_1_2_aarch64.whl; lief-1.0.0-cp310-cp310-musllinux_1_2_i686.whl; lief-1.0.0-cp310-cp310-musllinux_1_2_riscv64.whl; lief-1.0.0-cp310-cp310-musllinux_1_2_x86_64.whl; lief-1.0.0-cp310-cp310-win32.whl; lief-1.0.0-cp310-cp310-win_amd64.whl; lief-1.0.0-cp311-cp311-macosx_11_0_arm64.whl; lief-1.0.0-cp311-cp311-macosx_11_0_x86_64.whl; lief-1.0.0-cp311-cp311-manylinux_2_28_aarch64.whl; lief-1.0.0-cp311-cp311-manylinux_2_28_i686.whl; lief-1.0.0-cp311-cp311-manylinux_2_28_riscv64.whl; lief-1.0.0-cp311-cp311-manylinux_2_28_x86_64.whl; lief-1.0.0-cp311-cp311-musllinux_1_2_aarch64.whl; lief-1.0.0-cp311-cp311-musllinux_1_2_i686.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “elf pe macho parsing”
- liefLIEF parses, modifies, and abstracts binary executable formats (ELF,…
- malduckMalduck provides cryptographic, compression, and memory-analysis…
- cleCLE loads binary executables and shared libraries, resolves their…
Give your agent the search over MCP, or paste the wish link into any chat.
More Libraries packages
urllib3 is an HTTP client library that provides thread-safe connection pooling, SSL/TLS verification, multipart file uploads, request retries, compression support, and proxy handling for Python applications.
Requests is a Python HTTP library that simplifies sending HTTP/1.1 requests with automatic handling of headers, authentication, cookies, and response parsing.
Pluggy provides a plugin system that lets you define hook specifications and register implementations to be called in sequence, enabling extensible Python applications without tight coupling.
Install it if you're building an extensible application or framework.
Provides parsing, arithmetic, and recurrence rule computation for dates and times, with timezone support and iCalendar RFC compliance.
Install it if you need to parse flexible date strings, compute relative dates, handle timezones, or work with recurrence rules—it's the de facto choice for these tasks.
Six provides utility functions to write Python code that runs on both Python 2.7 and Python 3.3+, smoothing over language differences between the two versions.
pytest is a testing framework that lets you write test functions using plain assert statements and automatically discovers and runs them, with detailed failure reporting.
See also macholib · cle · pefile · binsize · pyelftools · viv-utils · patchelf · dnfile · malduck · pyxbe