node-lief

Node.js bindings for LIEF, a library to parse and manipulate ELF, PE, and Mach-O executables.

Installation

# npm
npm install node-lief

# yarn
yarn add node-lief

# pnpm
pnpm add node-lief

Usage

import LIEF from 'node-lief';

// Parse any binary (format is auto-detected)
const binary = LIEF.parse('/bin/ls');

console.log(binary.format);     // 'ELF' | 'PE' | 'MachO'
console.log(binary.entrypoint); // 0x1234n (bigint)
console.log(binary.isPie);      // true

// Iterate sections
for (const section of binary.sections()) {
  console.log(section.name, section.virtualAddress);
}

// Modify and write
binary.patchAddress(0x1000n, [0x90, 0x90, 0x90]);
binary.write('./patched');

Format-specific APIs

import LIEF from 'node-lief';

// Mach-O: Handle universal binaries and code signatures
const fat = LIEF.MachO.parse('./macho-binary');
const binary = fat.at(0) as LIEF.MachO.Binary;

if (binary.hasCodeSignature) {
  binary.removeSignature();
}

const segment = binary.getSegment('__TEXT');
const section = segment?.getSection('__text');
console.log(section?.content); // Buffer

// ELF: Access overlay data
const elf = LIEF.parse('./elf-binary') as LIEF.ELF.Binary;
if (elf.hasOverlay) {
  console.log(elf.overlay); // Buffer
}

// PE: Work with sections
const pe = LIEF.parse('./pe-binary') as LIEF.PE.Binary;
const peSection = pe.getSection('.text');
console.log(peSection?.virtualSize);

API

LIEF.parse(path: string) — Parse a binary and return a format-specific Binary object.

LIEF.MachO.parse(path: string) — Parse a Mach-O file, returning a FatBinary (handles universal binaries).

Binary properties and methods

Property/Method	Description
format	'ELF' | 'PE' | 'MachO' | 'UNKNOWN'
entrypoint	Entry point address (bigint)
isPie	Position-independent executable
hasNx	NX (non-executable stack) protection
sections()	Array of sections
symbols()	Array of symbols
getSymbol(name)	Get symbol by name
patchAddress(addr, bytes)	Patch bytes at address
write(path)	Write binary to disk

Format-specific APIs

Format	Additional APIs
ELF	hasOverlay, overlay (Buffer)
PE	optionalHeader, getSection(name), section.virtualSize
MachO	header, hasCodeSignature, getSegment(name), removeSignature(), extendSegment()

Logging

LIEF.logging.disable(); // Silence LIEF output
LIEF.logging.enable();

Supported platforms

Platform	Architectures
Linux	x64, arm64
macOS 13+	x64, arm64
Windows	x64, arm64