Node Lief

node-lief

[](./badges/coverage.svg)

Node.js bindings for [LIEF](https://lief.re), a library to parse and manipulate ELF, PE, and Mach-O executables. We use it in production in [tweakcc](https://github.com/Piebald-AI/tweakcc), and it's also used in community projects like [claude-depester](https://github.com/ominiverdi/claude-depester).

These bindings were largely generated by Claude, and have 97%+ coverage. Most of the APIs are currently used in tweakcc.

Installation

# npm
npm install node-lief

# yarn
yarn add node-lief

# pnpm
pnpm add node-lief

Usage

import LIEF from 'node-lief';

// Parse any binary (format is auto-detected)
const binary = LIEF.parse('/bin/ls');

console.log(binary.format);     // 'ELF' | 'PE' | 'MachO'
console.log(binary.entrypoint); // 0x1234n (bigint)
console.log(binary.isPie);      // true

// Iterate sections
for (const section of binary.sections()) {
  console.log(section.name, section.virtualAddress);
}

// Modify and write
binary.patchAddress(0x1000n, [0x90, 0x90, 0x90]);
binary.write('./patched');

Format-specific APIs

import LIEF from 'node-lief';

// Mach-O: Handle universal binaries and code signatures
const fat = LIEF.MachO.parse('./macho-binary');
const binary = fat.at(0) as LIEF.MachO.Binary;

if (binary.hasCodeSignature) {
  binary.removeSignature();
}

const segment = binary.getSegment('__TEXT');
const section = segment?.getSection('__text');
console.log(section?.content); // Buffer

// ELF: Access overlay data
const elf = LIEF.parse('./elf-binary') as LIEF.ELF.Binary;
if (elf.hasOverlay) {
  console.log(elf.overlay); // Buffer
}

// PE: Work with sections
const pe = LIEF.parse('./pe-binary') as LIEF.PE.Binary;
const peSection = pe.getSection('.text');
console.log(peSection?.virtualSize);

API

**`LIEF.parse(path: string)`** — Parse a binary and return a format-specific `Binary` object.

**`LIEF.MachO.parse(path: str