This commit is contained in:
Romain Thomas
2026-07-11 16:29:32 +02:00
parent 1f7c8f7dc3
commit c6416faefc
7 changed files with 4 additions and 45 deletions
+1 -1
View File
@@ -1,3 +1,3 @@
Authors:
Romain Thomas <[email protected]> - Quarkslab
Romain Thomas <[email protected]>
+3 -6
View File
@@ -4,13 +4,10 @@ Acknowledgements
LIEF makes use of the following open source projects:
- mbedTLS - https://tls.mbed.org/
- pybind11 - https://github.com/pybind/pybind11
- nanobind - https://github.com/wjakob/nanobind
- json - https://nlohmann.github.io/json/
- rang - https://agauniyal.github.io/rang/
- easyloggingpp - https://github.com/muflihun/easyloggingpp
- Catch - https://github.com/philsquared/Catch
- yamlcpp - https://github.com/jbeder/yaml-cpp
- filesystem - https://github.com/wjakob/filesystem
- spdlog - https://github.com/gabime/spdlog
- Catch2 - https://github.com/catchorg/Catch2
- utf8-cpp - https://sourceforge.net/projects/utfcpp/
- llvm - http://llvm.org/ - For the formats enums and structures
- virtualbox - https://www.virtualbox.org/ - For the PE 'LoadConfiguration' structures
-1
View File
@@ -1,4 +1,3 @@
if (LIEF_PRECOMPILED)
if (LIEF_PY_LIEF_EXT_SHARED)
find_package(LIEF REQUIRED COMPONENTS SHARED)
-10
View File
@@ -22,13 +22,3 @@ runtime = false
[lief.logging]
enabled = true
debug = false
#[lief.runtime]
#platform = 'linux'
#architecture = 'x86_64'
#[lief.cross-compilation]
#osx-arch = "arm64"
#[lief.third-party]
#spdlog = "/path/to/spdlog-install"
@@ -81,9 +81,6 @@ def test_parse_from_memory():
)
assert libc is not None
# The in-memory ELF parsing implementation is still a TODO on Linux, so
# these calls currently return None. Once implemented, this test should be
# strengthened.
libc.parse_from_memory()
libc.parse_from_memory(lief.ELF.ParserConfig.all)
-14
View File
@@ -85,20 +85,6 @@ def test_parse_from_memory(tmp_path: Path):
check_attributes(mem.dyld_chained_fixups, macho.dyld_chained_fixups)
check_attributes(mem.function_starts, macho.function_starts)
check_attributes(mem.rpaths, macho.rpaths)
# check_attributes(
# mem.relocations, macho.relocations, skip_list=["section", "segment"]
# )
# check_attributes(mem.bindings, macho.bindings, skip_list=["segment"])
# thread_vars_mem = mem.get_section("__thread_vars")
# thread_vars_file = macho.get_section("__thread_vars")
# if thread_vars_file is not None:
# assert thread_vars_mem is not None
# assert isinstance(thread_vars_mem, lief.MachO.ThreadLocalVariables)
# assert isinstance(thread_vars_file, lief.MachO.ThreadLocalVariables)
# check_attributes(thread_vars_mem.thunks, thread_vars_file.thunks)
output = tmp_path / f"mem_{library.name}"
mem.write(output)
-10
View File
@@ -14,8 +14,6 @@ def test_peb():
assert peb is not None
assert isinstance(peb, lief.runtime.windows.PEB)
# The loader data and the process parameters are always populated by the
# Windows loader.
assert peb.ldr != 0
assert peb.process_parameters != 0
@@ -33,11 +31,9 @@ def test_peb_entries():
assert peb is not None
entries = list(peb.entries)
# A process always has at least its main image and a few system DLLs loaded.
assert len(entries) > 1
assert all(isinstance(e, lief.runtime.windows.LdrDataTableEntry) for e in entries)
# The first entry of the load-order list is the main executable.
first = entries[0]
assert first is not None
assert first.dll_base != 0
@@ -46,7 +42,6 @@ def test_peb_entries():
assert first.full_dll_name.lower().endswith(first.base_dll_name.lower())
assert isinstance(first.entry_point, int)
# ntdll.dll is always loaded in a Windows process.
names = [e.base_dll_name.lower() for e in entries if e is not None]
assert "ntdll.dll" in names
@@ -59,7 +54,6 @@ def test_peb_entry_extended_fields():
first = next(iter(peb.entries), None)
assert first is not None
# Fields located before the Windows 8 loader rewrite are always available.
assert isinstance(first.flags, int)
assert isinstance(first.obsolete_load_count, int)
assert isinstance(first.tls_index, int)
@@ -70,8 +64,6 @@ def test_peb_entry_extended_fields():
version_t = lief.runtime.windows.Host.version_t
version = lief.runtime.windows.Host.version
# The dependency-graph fields only exist with the Windows 8+ layout, so they
# must be exposed exactly when the host is recent enough.
win8_fields = (
first.ddag_node,
first.load_context,
@@ -91,7 +83,6 @@ def test_peb_entry_extended_fields():
else:
assert all(v is None for v in win8_fields)
# Code-integrity fields appeared in Windows 10.
win10_fields = (first.signing_level, first.check_sum)
if version >= version_t(10, 0, 10240):
assert all(v is not None for v in win10_fields)
@@ -99,7 +90,6 @@ def test_peb_entry_extended_fields():
else:
assert all(v is None for v in win10_fields)
# Hot-patching fields appeared in Windows 11.
win11_fields = (first.active_patch_image_base, first.hot_patch_state)
if version >= version_t(10, 0, 22000):
assert all(v is not None for v in win11_fields)