LIEF | Romain Thoma

Share on facebook
Share on twitter
Share on linkedin
Share on reddit

Romain Thoma

The purpose of this project is to provide a cross platform library which can parse, modify and abstract ELF, PE and MachO formats.

Main features:

  • Parsing: LIEF can parse ELF, PE, MachO, OAT, DEX, VDEX, ART and provides an user-friendly API to access to format internals.
  • Modify: LIEF enables to modify some parts of these formats
  • Abstract: Three formats have common features like sections, symbols, entry point… LIEF factors them.
  • API: LIEF can be used in C, C++ and Python

Downloads / Install

First, make sure to have an updated version of setuptools:

pip install setuptools --upgrade

To install the latest version (release):

pip install lief

To install nightlty build:

pip install [--user] --index-url lief==0.12.0.dev0


Here are guides to install or integrate LIEF:

Getting started


import lief

binary = lief.parse("/usr/bin/ls")

# PE
binary = lief.parse("C:Windowsexplorer.exe")

# Mach-O
binary = lief.parse("/usr/bin/ls")


#include <LIEF/LIEF.hpp>

int main(int argc, char** argv) {
  // ELF
  try {
    std::unique_ptr<LIEF::ELF::Binary> elf = LIEF::ELF::Parser::parse("/bin/ls");
    std::cout << *elf << std::endl;
  } catch (const LIEF::exception& err) {
    std::cerr << err.what() << std::endl;

  // PE
  try {
    std::unique_ptr<LIEF::PE::Binary> pe = LIEF::PE::Parser::parse("C:Windowsexplorer.exe");
    std::cout << *pe << std::endl;
  } catch (const LIEF::exception& err) {
    std::cerr << err.what() << std::endl;

  // Mach-O
  try {
    std::unique_ptr<LIEF::MachO::FatBinary> macho = LIEF::MachO::Parser::parse("/bin/ls");
    std::cout << *macho << std::endl;
  } catch (const LIEF::exception& err) {
    std::cerr << err.what() << std::endl;

  return 0;

C (Limited API)

#include <LIEF/LIEF.h>

int main(int argc, char** argv) {
  Elf_Binary_t* elf = elf_parse("/usr/bin/ls");

  Elf_Section_t** sections = elf->sections;

  for (size_t i = 0; sections[i] != NULL; ++i) {
    printf("%sn", sections[i]->name);

  return 0;



About Authors

Romain Thomas – is a security engineer working on mobiles applications and obfuscated code. He developed LIEF during his internship at Quarkslab to provide a single library to parse and manipulate executable file formats (ELF, PE, Mach-O). Now he continues the development in his spare time.
He also contributed in the past to the Triton project to improve de-obfuscation based on symbolic execution (@rh0main) – Quarkslab


LIEF is provided under the Apache 2.0 license.


  author       = "Romain Thomas",
  title        = "LIEF - Library to Instrument Executable Formats",
  howpublished = "",
  month        = "April",
  year         = "2017",


 The article was originally published at:

Read more

Explore the site

More from the blog

Latest News