lief-project/LIEF

Health v2 · maintenance only

Adoption not part of the score

5549 stars · 746 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

LIEF is a cross-platform C++ library (with Python and Rust bindings) for parsing, inspecting, modifying, and writing executable file formats such as ELF, PE, Mach-O, COFF, and Android formats. It provides a unified object model over symbols, sections, and relocations, plus extended features like disassembly, assembly, DWARF/PDB debug info, and plugins for Ghidra and Binary Ninja.

Use cases

• parse and inspect ELF, PE, or Mach-O binaries programmatically
• modify an executable by adding sections or changing symbol names
• analyze malware samples in a scriptable way
• hook or patch binaries by rewriting imports or the PLT/GOT
• extract and manipulate Android DEX, OAT, VDEX, and ART files
• transform an ELF executable into a shared library
• verify PE Authenticode signatures
• disassemble or assemble AArch64, x86, RISC-V code

When to choose

• you need a scriptable, cross-format API for binary parsing and rewriting without a heavyweight RE suite
• you want Python, C++, or Rust bindings over ELF/PE/Mach-O internals
• you are building security tooling, malware analysis pipelines, or binary instrumentation
• you need format-aware builders that serialize valid modified binaries

When to avoid

• you only need a one-off static analysis view in a GUI like Ghidra or IDA
• you require the extended features (DWARF, PDB, Dyld shared cache, disassembler) under a fully open license, since LIEF Extended is gated
• you need decompilation or high-level control-flow recovery, which LIEF does not provide

Facets

library · maturity stable

parser reverse-engineering security sdk security reverse-engineering parsers developer-tools cross-platform python cpp rust cli elf pe mach-o binary-analysis malware-analysis executable-formats dex android disassembler assembler

Member repositories

For agents

markdown · JSON · MCP: product_card(name="lief-project/LIEF")