lief

import lief import sys import os def analyze_binary(filepath): if not os.path.exists(filepath): print(f"Error: File not found at {filepath}") return binary = lief.parse(filepath) if binary is None: print(f"Could not parse {filepath} as an executable.") return print(f"\nAnalyzing: {filepath}") print(f" Format: {binary.format}") print(f" Entrypoint: {hex(binary.entrypoint)}") print(f" Number of sections: {len(binary.sections)}") # Example: Accessing ELF-specific features if binary.format == lief.Binary.FORMATS.ELF: elf_binary = binary.as_elf() if elf_binary and elf_binary.header: print(f" ELF Machine Type: {elf_binary.header.machine_type}") if elf_binary.dynamic_entries: print(f" Number of dynamic entries: {len(elf_binary.dynamic_entries)}") # Example: Accessing PE-specific features elif binary.format == lief.Binary.FORMATS.PE: pe_binary = binary.as_pe() if pe_binary and pe_binary.header: print(f" PE Machine Type: {pe_binary.header.machine_type}") if pe_binary.imports: print(f" Number of imported libraries: {len(pe_binary.imports)}") # Try to analyze common executables based on OS if sys.platform.startswith('linux'): analyze_binary('/bin/ls') elif sys.platform == 'win32': analyze_binary('C:\\Windows\\System32\\notepad.exe') elif sys.platform == 'darwin': analyze_binary('/bin/ls') # macOS also uses ELF/MachO, /bin/ls is a good example else: print("Unsupported OS for quickstart example.")