lief

What it is and what it does

LIEF is a cross-platform binary parsing and manipulation library that abstracts the complexity of ELF, PE, MachO, OAT, DEX, VDEX, and ART executable formats into a unified, user-friendly API. It lets you read binary structure internals—sections, symbols, imports, entry points—and modify certain parts of these formats programmatically. The library is written in C++ with bindings for Python, C, C++, and Rust, and is actively maintained.

You would use LIEF when you need to inspect or instrument compiled binaries without writing format-specific parsers, or when you're building reverse-engineering, security analysis, or binary instrumentation tools. It handles the low-level format details so you can focus on your analysis or transformation logic.

Use it for:

• Inspect sections, symbols, and imports from ELF, PE, or MachO binaries for security audits or malware analysis.
• Modify binary metadata or sections to instrument executables for debugging or dynamic analysis.
• Parse mobile and Android formats (DEX, VDEX, OAT, ART) to analyze app structure and bytecode.
• Build reverse-engineering tools that need to work across multiple binary formats on different platforms.
• Extract and analyze debug information from compiled binaries for forensic or compatibility checks.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

LIEF parses, modifies, and abstracts binary executable formats (ELF, PE, MachO, OAT, DEX, VDEX, ART) across platforms, exposing a unified API to inspect and manipulate binary structure internals.

Yes, if you need to parse or modify binary executables across multiple formats and platforms. LIEF is actively maintained, permissively licensed, has no known vulnerabilities, and offers a mature API. Medium install friction is the main caveat; verify your Python version meets the >=3.9 requirement before installing.

Install

lief on PyPI

pip install lief

uv add lief

poetry add lief

Installing lief

Before you install

Medium install friction: precompiled wheels available across macOS, Linux (manylinux, musllinux, multiple architectures), and Windows. Maintenance is active with a release 33 days old.

License in practice

Apache License 2.0 (permissive): you may use, modify, and distribute LIEF freely in commercial and private projects, provided you include a copy of the license and state material changes.

Quickstart

pip install lief

import lief

elf = lief.ELF.parse("/bin/ls")
for section in elf.sections:
    print(section.name, len(section.content))

Requires Python >=3.9; verify your Python version before installing.

Verify before relying

• Whether DWARF/PDB support and Objective-C metadata are included in the base package or require a separate Extended edition.
• Performance characteristics and memory overhead when parsing large binaries.
• Stability and completeness of modification features across all supported formats.
• Which Python versions beyond 3.9 are supported by available precompiled wheels.

Package facts

Evidence: lief-1.0.0-cp310-cp310-macosx_11_0_arm64.whl; lief-1.0.0-cp310-cp310-macosx_11_0_x86_64.whl; lief-1.0.0-cp310-cp310-manylinux_2_28_aarch64.whl; lief-1.0.0-cp310-cp310-manylinux_2_28_i686.whl; lief-1.0.0-cp310-cp310-manylinux_2_28_riscv64.whl; lief-1.0.0-cp310-cp310-manylinux_2_28_x86_64.whl; lief-1.0.0-cp310-cp310-musllinux_1_2_aarch64.whl; lief-1.0.0-cp310-cp310-musllinux_1_2_i686.whl; lief-1.0.0-cp310-cp310-musllinux_1_2_riscv64.whl; lief-1.0.0-cp310-cp310-musllinux_1_2_x86_64.whl; lief-1.0.0-cp310-cp310-win32.whl; lief-1.0.0-cp310-cp310-win_amd64.whl; lief-1.0.0-cp311-cp311-macosx_11_0_arm64.whl; lief-1.0.0-cp311-cp311-macosx_11_0_x86_64.whl; lief-1.0.0-cp311-cp311-manylinux_2_28_aarch64.whl; lief-1.0.0-cp311-cp311-manylinux_2_28_i686.whl; lief-1.0.0-cp311-cp311-manylinux_2_28_riscv64.whl; lief-1.0.0-cp311-cp311-manylinux_2_28_x86_64.whl; lief-1.0.0-cp311-cp311-musllinux_1_2_aarch64.whl; lief-1.0.0-cp311-cp311-musllinux_1_2_i686.whl

Keywords: parser, elf, pe, macho, reverse-engineering

Tags

More Libraries packages