Added `klookup` option for applying symbols (#3318)

* klookup * using lief to create a blank elf and add symbols to it * added lief in dependencies * doc * fixed add_symbol_file * changes to tuple * fix tests * fix compiler warnings * fix div by 0 issue * removed redundant bracket
2 months ago · 075580d59a
parent 13fdf21253
commit 075580d59a
9 changed files with 166 additions and 49 deletions
--- a/docs/commands/kernel/klookup.md
+++ b/docs/commands/kernel/klookup.md
@ -2,11 +2,13 @@
 # klookup

 ```text
-usage: klookup [-h] symbol
+usage: klookup [-h] [-a] [symbol]

 ```

 Lookup kernel symbols
+
+**Alias:** kallsyms
 ### Positional arguments

 |Positional Argument|Help|
@ -18,6 +20,7 @@ Lookup kernel symbols
 |Short|Long|Help|
 | :--- | :--- | :--- |
 |-h|--help|show this help message and exit|
+|-a|--apply|applies all the symbols that satisfy the filter|

 <!-- END OF AUTOGENERATED PART. Do not modify this line or the line below, they mark the end of the auto-generated part of the file. If you want to extend the documentation in a way which cannot easily be done by adding to the command help description, write below the following line. -->
 <!-- ------------\>8---- ----\>8---- ----\>8------------ -->
--- a/pwndbg/aglib/kernel/kallsyms.py
+++ b/pwndbg/aglib/kernel/kallsyms.py
@ -3,7 +3,7 @@ from __future__ import annotations
 from re import match
 from re import search
 from struct import unpack_from
-from typing import Dict
+from typing import List
 from typing import Tuple

 from pwnlib.util.packing import p16
@ -21,9 +21,9 @@ import pwndbg.search


@pwndbg.lib.cache.cache_until("start")
-def get() -> Dict[str, Tuple[int, str]]:
+def get() -> Tuple[Tuple[str, str, int], ...]:
    ks = Kallsyms()
-    return ks.kallsyms
+    return tuple(ks.kallsyms)


 class Kallsyms:
@ -42,7 +42,7 @@ class Kallsyms:
    """

    def __init__(self):
-        self.kallsyms: Dict[str, Tuple[int, str]] = {}
+        self.kallsyms: List[Tuple[str, str, int]] = []
        self.kbase = pwndbg.aglib.kernel.kbase()

        mapping = pwndbg.aglib.kernel.first_kernel_ro_page()
@ -82,7 +82,7 @@ class Kallsyms:
        self.kernel_addresses = self.get_kernel_addresses()
        self.parse_symbol_table()
        for sym_name, sym_addr, sym_type in pwndbg.aglib.kernel.kmod.all_modules_kallsyms():
-            self.kallsyms[sym_name] = (sym_addr, sym_type)
+            self.kallsyms.append((sym_name, sym_type, sym_addr))
        print(M.info(f"Found {len(self.kallsyms)} ksymbols"))

    def find_token_table(self) -> int:
@ -372,7 +372,9 @@ class Kallsyms:
            return kernel_addresses

        number_of_negative_items = len([offset for offset in kernel_addresses if offset < 0])
-        abs_percpu = number_of_negative_items / len(kernel_addresses) >= 0.5
+        abs_percpu = (len(kernel_addresses) == 0) or (
+            number_of_negative_items / len(kernel_addresses) >= 0.5
+        )

        for idx, offset in enumerate(kernel_addresses):
            if abs_percpu:
@ -406,7 +408,7 @@ class Kallsyms:
            symbol_names.append(symbol_name)

        for addr, name in zip(self.kernel_addresses, symbol_names):
-            self.kallsyms[name[1:]] = (addr, name[0])
+            self.kallsyms.append((name[1:], name[0], addr))

    def get_token_table(self):
        if not self.is_uncompressed:
--- a/pwndbg/commands/cymbol.py
+++ b/pwndbg/commands/cymbol.py
@ -24,6 +24,7 @@ from typing import Dict
 from typing import TypeVar

 import gdb
+import lief
 from typing_extensions import ParamSpec
 from typing_extensions import Protocol

@ -92,22 +93,7 @@ def OnlyWhenStructFileExists(func: _OnlyWhenStructFileExists) -> _OnlyWhenStruct
    return wrapper


-def generate_debug_symbols(
-    custom_structure_path: str, pwndbg_debug_symbols_output_file: str | None = None
-) -> str | None:
-    if not pwndbg_debug_symbols_output_file:
-        _, pwndbg_debug_symbols_output_file = tempfile.mkstemp(prefix="custom-", suffix=".dbg")
-
-    # -fno-eliminate-unused-debug-types is a handy gcc flag that lets us extract debug symbols from non-used defined structures.
-    gcc_extra_flags = [
-        custom_structure_path,
-        "-c",
-        "-g",
-        "-fno-eliminate-unused-debug-types",
-        "-o",
-        pwndbg_debug_symbols_output_file,
-    ]
-
+def compile_with_flags(gcc_extra_flags):
    if gcc_compiler_path != "":
        compiler_flags = [gcc_compiler_path]
    else:
@ -115,28 +101,70 @@ def generate_debug_symbols(
            compiler_flags = pwndbg.lib.zig.flags(pwndbg.aglib.arch)
        except ValueError as exception:
            print(message.error(exception))
-            return None
+            return False

    gcc_cmd = compiler_flags + gcc_extra_flags

    try:
        subprocess.run(gcc_cmd, check=True, text=True)
+        return True
    except subprocess.CalledProcessError as exception:
        print(message.error(exception))
        print(
            message.error(
-                "Failed to compile the .c file with custom structures. Please fix any compilation errors there may be."
+                f"Failed to compile {gcc_extra_flags[0]}. Please fix any compilation errors there may be."
            )
        )
-        return None
    except Exception as exception:
        print(message.error(exception))
        print(message.error("An error occured while generating the debug symbols."))
+    return False
+
+
+def generate_debug_symbols(
+    custom_structure_path: str, pwndbg_debug_symbols_output_file: str | None = None
+) -> str | None:
+    if not pwndbg_debug_symbols_output_file:
+        _, pwndbg_debug_symbols_output_file = tempfile.mkstemp(prefix="custom-", suffix=".dbg")
+
+    # -fno-eliminate-unused-debug-types is a handy gcc flag that lets us extract debug symbols from non-used defined structures.
+    gcc_extra_flags = [
+        custom_structure_path,
+        "-c",
+        "-g",
+        "-fno-eliminate-unused-debug-types",
+        "-o",
+        pwndbg_debug_symbols_output_file,
+    ]
+    if not compile_with_flags(gcc_extra_flags):
        return None

    return pwndbg_debug_symbols_output_file


+def create_blank_elf():
+    tmp = tempfile.NamedTemporaryFile(delete=False, suffix=".S")
+    tmp.write(b".global _start\n_start:\nnop")
+    tmp.flush()
+    _, output_path = tempfile.mkstemp(prefix="blank-", suffix=".dbg")
+
+    gcc_extra_flags = [
+        tmp.name,
+        "-nostdlib",
+        "--static",
+        "-o",
+        output_path,
+    ]
+    if not compile_with_flags(gcc_extra_flags):
+        return None
+
+    blank_elf = lief.ELF.parse(output_path)
+    for s in blank_elf.symbols:
+        blank_elf.remove_symtab_symbol(s)
+    blank_elf.write(output_path)
+    return output_path
+
+
 def add_custom_structure(custom_structure_name: str, force=False):
    pwndbg_custom_structure_path = os.path.join(pwndbg_cachedir, custom_structure_name) + ".c"

@ -251,7 +279,7 @@ def load_custom_structure(custom_structure_name: str, custom_structure_path: str
    pwndbg_debug_symbols_output_file = generate_debug_symbols(custom_structure_path)
    if not pwndbg_debug_symbols_output_file:
        return  # generate_debug_symbols prints on failures
-    gdb.execute(f"add-symbol-file {pwndbg_debug_symbols_output_file}", to_string=True)
+    pwndbg.dbg.selected_inferior().add_symbol_file(pwndbg_debug_symbols_output_file)
    loaded_symbols[custom_structure_name] = pwndbg_debug_symbols_output_file
    print(message.success("Symbols are loaded!"))

--- a/pwndbg/commands/klookup.py
+++ b/pwndbg/commands/klookup.py
@ -2,6 +2,8 @@ from __future__ import annotations

 import argparse

+import lief
+
 import pwndbg.aglib.kernel.kallsyms
 import pwndbg.commands
 from pwndbg.color import message
@ -9,28 +11,42 @@ from pwndbg.commands import CommandCategory

 parser = argparse.ArgumentParser(description="Lookup kernel symbols")

-parser.add_argument("symbol", type=str, help="Address or symbol name to lookup")
+parser.add_argument("symbol", type=str, nargs="?", help="Address or symbol name to lookup")
+parser.add_argument(
+    "-a", "--apply", action="store_true", help="applies all the symbols that satisfy the filter"
+)


-@pwndbg.commands.Command(parser, category=CommandCategory.KERNEL)
+@pwndbg.commands.Command(parser, aliases=["kallsyms"], category=CommandCategory.KERNEL)
@pwndbg.commands.OnlyWhenQemuKernel
@pwndbg.commands.OnlyWhenPagingEnabled
-def klookup(symbol: str) -> None:
+def klookup(symbol: str, apply: bool) -> None:
    ksyms = pwndbg.aglib.kernel.kallsyms.get()
+    syms = []
    try:
        symbol_addr = int(symbol, 0)
-        for ksym, v in ksyms.items():
-            if v[0] == symbol_addr:
-                print(message.success(f"{symbol_addr:#x} = {ksym}"))
-                return
-        print(message.error(f"No symbol found at {symbol_addr:#x}"))
-    except ValueError:
-        found = False
-        for ksym, v in ksyms.items():
-            if symbol not in ksym:
-                continue
-            found = True
-            addr = v[0]
-            print(message.success(f"{addr:#x} = {ksym}"))
-        if not found:
+        for sym in ksyms:
+            if sym[2] == symbol_addr:
+                syms.append(sym)
+        if len(syms) == 0:
+            print(message.error(f"No symbol found at {symbol_addr:#x}"))
+    except (ValueError, TypeError):
+        for sym in ksyms:
+            if symbol is None or symbol in sym[0]:
+                syms.append(sym)
+        if len(syms) == 0:
            print(message.error(f"No symbol found for {symbol}"))
+    for sym_name, sym_type, sym_addr in syms:
+        print(message.success(f"{sym_addr:#x} {sym_type} {sym_name}"))
+
+    if apply:
+        try:
+            path = pwndbg.commands.cymbol.create_blank_elf()
+            symelf = lief.ELF.parse(path)
+            for sym_name, sym_type, sym_addr in syms:
+                symelf.add_symtab_symbol(symelf.export_symbol(sym_name, sym_addr))
+            symelf.write(path)
+            pwndbg.dbg.selected_inferior().add_symbol_file(path)
+            print(message.success(f"Added {len(syms)} symbols"))
+        except Exception as e:
+            print(message.error(e))
--- a/pwndbg/dbg/init.py
+++ b/pwndbg/dbg/init.py
@ -632,7 +632,7 @@ class Process:
        """
        raise NotImplementedError()

-    def add_symbol_file(self, path, base):
+    def add_symbol_file(self, path, base=None):
        """
        Adds a symbol file at base
        """
--- a/pwndbg/dbg/gdb/init.py
+++ b/pwndbg/dbg/gdb/init.py
@ -977,7 +977,10 @@ class GDBProcess(pwndbg.dbg_mod.Process):
                break

    @override
-    def add_symbol_file(self, path, base):
+    def add_symbol_file(self, path, base=None):
+        if base is None:
+            gdb.execute(f"add-symbol-file {path}", to_string=True)
+            return
        gdb.execute(f"add-symbol-file {path} {base}")


--- a/pyproject.toml
+++ b/pyproject.toml
@ -14,6 +14,7 @@ dependencies = [
    "typing-extensions>=4.15.0,<5",
    "pycparser~=2.23",
    "pyelftools>=0.32,<0.33",
+    "lief>=0.17",
    "pygments>=2.19.2,<3",
    "psutil>=7.0.0,<8",
    # We install uv to the venv
--- a/tests/library/qemu_system/tests/test_gdblib_kernel.py
+++ b/tests/library/qemu_system/tests/test_gdblib_kernel.py
@ -71,4 +71,6 @@ def test_gdblib_kernel_kbase():
 )
 def test_gdblib_kernel_kallsyms():
    ks = pwndbg.aglib.kernel.kallsyms.get()
-    assert ks["commit_creds"][0] == pwndbg.aglib.symbol.lookup_symbol_addr("commit_creds")
+    for sym_name, _, sym_addr in ks:
+        if sym_name == "commit_creds":
+            assert sym_addr == pwndbg.aglib.symbol.lookup_symbol_addr("commit_creds")
--- a/uv.lock
+++ b/uv.lock
@ -1,5 +1,5 @@
 version = 1
-revision = 3
+revision = 2
 requires-python = ">=3.10, <4"
 resolution-markers = [
    "python_full_version >= '3.13'",
@ -757,6 +757,66 @@ version = "3.0.1"
 source = { registry = "https://pypi.org/simple" }
 sdist = { url = "https://files.pythonhosted.org/packages/5e/73/e01e4c5e11ad0494f4407a3f623ad4d87714909f50b17a06ed121034ff6e/jsmin-3.0.1.tar.gz", hash = "sha256:c0959a121ef94542e807a674142606f7e90214a2b3d1eb17300244bbb5cc2bfc", size = 13925, upload-time = "2022-01-16T20:35:59.13Z" }

+[[package]]
+name = "lief"
+version = "0.17.0"
+source = { registry = "https://pypi.org/simple" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/51/f5/b6a52b99cb492ade8dcecef1c05b89050c1a65000db6fc3bb959cf639b81/lief-0.17.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:2eba6a8d1b52ec98a4bb73b18b83c394f038ab86ebe59e02ae12b13c96b1bd7c", size = 2986684, upload-time = "2025-09-14T13:52:48.859Z" },
+    { url = "https://files.pythonhosted.org/packages/26/2d/f04799be5fa74c1235c5a59defe10f185f93c0c4241858eb0fc5db27d676/lief-0.17.0-cp310-cp310-macosx_11_0_x86_64.whl", hash = "sha256:7a4a0276861c86c191bfc9668f172de1fc0c7ffda13a212395a57432392c8638", size = 3096120, upload-time = "2025-09-14T13:52:50.809Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/d3/cfa7dc23a14dea234cd3dea55a6cc1b4bf8243b8834bf301a50a924008d3/lief-0.17.0-cp310-cp310-manylinux2014_aarch64.whl", hash = "sha256:35612f424d21612ca21a5b5b97fe42d1fc6928aa250c8bbf39e8eb7f83c67175", size = 3668150, upload-time = "2025-09-14T13:52:52.211Z" },
+    { url = "https://files.pythonhosted.org/packages/63/ae/0e2ace255cc9dbf8e2749a8f29e612b662150a76f6f67ab8657cc505e363/lief-0.17.0-cp310-cp310-manylinux_2_28_i686.whl", hash = "sha256:d5f3b87aef3817ba2ed226ff263bc37d85acc262d18367bc36839922e2866ced", size = 3494453, upload-time = "2025-09-14T13:52:54.139Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/8a/fcefbd11c3907565f66627b3444c7736c7f5ba9526b288a2eb992b2e7d1f/lief-0.17.0-cp310-cp310-manylinux_2_28_x86_64.whl", hash = "sha256:86334c239da1fe30acad7eb341d525c611b040017b8480bc7fddad8508a0a064", size = 3395449, upload-time = "2025-09-14T13:52:55.837Z" },
+    { url = "https://files.pythonhosted.org/packages/86/17/3006986b0115ec28a0f7d8f62859834ce837c3606e4362797758b5bd9774/lief-0.17.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:f3e918f80fcdc2d9e7d6b20805720db4a64abb5b797c620ff6c6e76d3ec4cf0a", size = 3588279, upload-time = "2025-09-14T13:52:58.191Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/e6/c21c6d9de1d8105902a325a1e7d60bf453d37f4855c3cb0376cbbd99485f/lief-0.17.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:2f661e0ff4d6ea8964ae079d46510c040bb0bfe24b760ed7ed93154d4ffa4f36", size = 3950069, upload-time = "2025-09-14T13:53:00.8Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/3b/1b48a8665a2048353d2221af53517d46d9559ac3be89a47363c351cd55b9/lief-0.17.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:1893c42e32c675ce6d304936605ab28bbd63642a87a89e196eaee9b092280e42", size = 3697437, upload-time = "2025-09-14T13:53:02.735Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/75/9522a27836afa3dfa2ab6043d08ce8d3c9fc84883f6757b6ad76fd6c1891/lief-0.17.0-cp310-cp310-win32.whl", hash = "sha256:838a1a837288088ad9cb548b5dac49b3290da72279f3f833bf6e712ccff36749", size = 3450215, upload-time = "2025-09-14T13:53:04.98Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/22/72dea207d63cd9ce1a3674545e6b4106efb9672db3b6f4624930f14e1575/lief-0.17.0-cp310-cp310-win_amd64.whl", hash = "sha256:c3829edaa0fe8487e58d1af7580cbfabd58f19f67edb45d6ae907ae9487aab9e", size = 3626378, upload-time = "2025-09-14T13:53:06.8Z" },
+    { url = "https://files.pythonhosted.org/packages/18/06/b239e134190e451829cc4f21381f8485028e109f97d72804a1735e59c7d6/lief-0.17.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:5634aaaf3381c409284229dd7b9987e847f96cda38d14a8861e979cfdf7c789f", size = 2994390, upload-time = "2025-09-14T13:53:08.519Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/98/724ce37834a03953f0d17d9b24faef1d2a5f351f738c395a776f460be4dd/lief-0.17.0-cp311-cp311-macosx_11_0_x86_64.whl", hash = "sha256:c491b40224bdc357c92f76179889c12ac3121b94f665e39827694b6665d0b656", size = 3096963, upload-time = "2025-09-14T13:53:11.004Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/13/78a1e581a577718cd20f503c53dc9a5ae860206439474ed16e9c83ba7f89/lief-0.17.0-cp311-cp311-manylinux2014_aarch64.whl", hash = "sha256:1c0737b38413d2e353bec2fb4928f2a3bd434fc69415d6a5d88a799fd2b193b7", size = 3665003, upload-time = "2025-09-14T13:53:13.29Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/bb/b9d50cb7bdee86e9e64b71e67d1ec689f3995fb856e0d91e5a18c7ee4913/lief-0.17.0-cp311-cp311-manylinux_2_28_i686.whl", hash = "sha256:9346d4916301e43c1d4ebb20cd90656ef52e30bfb0fbc181c247979b533da333", size = 3495028, upload-time = "2025-09-14T13:53:15.098Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/4a/44148bb287e40097e105834a5a763137ec0026af054473ceb29d3e7b1dd1/lief-0.17.0-cp311-cp311-manylinux_2_28_x86_64.whl", hash = "sha256:c0ca980c27339611ea496f3405dc33cb21db6c61ed590ca615f239a4ce8545dc", size = 3395561, upload-time = "2025-09-14T13:53:17.274Z" },
+    { url = "https://files.pythonhosted.org/packages/38/40/7e5685af93de0a1df82aaa5df9959614e0e13fd15964dd165e819fbfa302/lief-0.17.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:4ca2d4e1e1c24dd1806b50b181c596af98ac40486032f2b8ca82d15e5beb771e", size = 3587709, upload-time = "2025-09-14T13:53:18.933Z" },
+    { url = "https://files.pythonhosted.org/packages/14/94/44f966fbd5600258c442ca5185c8c82885fa53ac5672ec80dce682e33647/lief-0.17.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:56db6556f68d51202f9a64f89492de8bc559629ce5ee60f2d3b7e2af81c77a60", size = 3950393, upload-time = "2025-09-14T13:53:20.735Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/8c/dedaf745e43768fe278874131d8fc19db1ace71fde477de3d7e7f837f6dc/lief-0.17.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:fc0114040f3518fdc97a4fc8aa626131da39d63ca28a3d898fd93f475b2b584a", size = 3697629, upload-time = "2025-09-14T13:53:22.364Z" },
+    { url = "https://files.pythonhosted.org/packages/da/a1/411498116b5bfc1de5aa53de1ac2952498ebeac4a4fabcd5dccc298f179f/lief-0.17.0-cp311-cp311-win32.whl", hash = "sha256:d28c65782b91a3b65dc4337a29490b03cc8a2693eff2a9d41049b20e63608c12", size = 3450098, upload-time = "2025-09-14T13:53:24.544Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/ac/0fb2d86f16bd51af969cc47ccf5ba88eb7c04dd8d12f98bad55052b14ad4/lief-0.17.0-cp311-cp311-win_amd64.whl", hash = "sha256:b6680261786d3c27236a6334c441be81230bf2c425f28155b9dcf51aa87720f8", size = 3626784, upload-time = "2025-09-14T13:53:26.326Z" },
+    { url = "https://files.pythonhosted.org/packages/69/f5/36490c9d2ac0ecaf9cb9e66371ab600a81f4711f5e6284ab71a0bf542b5e/lief-0.17.0-cp311-cp311-win_arm64.whl", hash = "sha256:2a7c8045993470e21300ec590a9e64f02215e789f29c04b9c65ebdff68a45f22", size = 3469095, upload-time = "2025-09-14T13:53:27.975Z" },
+    { url = "https://files.pythonhosted.org/packages/43/3b/ddc5036a168498ac17dd052c3d2aeaa0e8ed0bd019a300cc5de7e6aafe39/lief-0.17.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:b3314afd2c8739b2891cae666cd4bb08e14aa0b4c5b08f012a09e82ff362bd36", size = 2993993, upload-time = "2025-09-14T13:53:29.558Z" },
+    { url = "https://files.pythonhosted.org/packages/fc/ab/9297a768ffbaa3c2b43280beb9dff55c843a3077bfd62d9acbb2fae7a726/lief-0.17.0-cp312-cp312-macosx_11_0_x86_64.whl", hash = "sha256:1bba12f5c20486d9f463bd999705c537a12976b9e3912388b232e8d12ae41c6c", size = 3106807, upload-time = "2025-09-14T13:53:31.728Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/58/3e77b42fcb2879a3b9f4f7a9f5a45dbb168024822b3b929b00dd8799da25/lief-0.17.0-cp312-cp312-manylinux2014_aarch64.whl", hash = "sha256:4899be50a745de11dd35de6b1bfbaac2afa4c62bf14153ffc7b6acb39abb9605", size = 3669191, upload-time = "2025-09-14T13:53:33.871Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/f6/2e059c50abc9b2071783642e317b9f89e666564820b7074c11591f94a8dd/lief-0.17.0-cp312-cp312-manylinux_2_28_i686.whl", hash = "sha256:35b18177821142c9b5ad657e7fbd7f82a9540246fec6ef3876cff9fe8086e4dc", size = 3501848, upload-time = "2025-09-14T13:53:35.465Z" },
+    { url = "https://files.pythonhosted.org/packages/fc/1f/2538e8a1be6e9481141a88b522fbf432538d521a82731a2bcccd3a6e69ba/lief-0.17.0-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:87ebee7d2fb130750c611a6d9eac614463eb58e82b54695f2c48a9aa3402cd56", size = 3404855, upload-time = "2025-09-14T13:53:37.167Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/c5/15c35a197deacadce33e089b2d5a9b61448d5485cd912ea8974c22efddec/lief-0.17.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:580c4f5370f569591f39a10c442a0d2333b895e457247c133e81020dfafd7e26", size = 3591241, upload-time = "2025-09-14T13:53:38.893Z" },
+    { url = "https://files.pythonhosted.org/packages/02/29/c97883c851b96b47c3ab2e434212efb08e091151772426f190a6e855a9a2/lief-0.17.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:36d7fcdcfb3136eb8dbaaa1b200026c7c16b78102ed402de54065a777016feb5", size = 3958250, upload-time = "2025-09-14T13:53:41.304Z" },
+    { url = "https://files.pythonhosted.org/packages/45/f8/51e646774e17ec39013d8233bca5f88d27df9adbbbe282956725c8f68003/lief-0.17.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:77a541669af2a4373e518961c1ead16695c6bfe942f95e0454439e52d50a4c25", size = 3705317, upload-time = "2025-09-14T13:53:43.07Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/f4/d44336d4566348ad2f157fe56605f612ef0e133de710da15f173707d72ae/lief-0.17.0-cp312-cp312-win32.whl", hash = "sha256:38e9b4d340158f2399dc00700899606c825dc9437809e8a69133496b6ee39db8", size = 3459468, upload-time = "2025-09-14T13:53:45.418Z" },
+    { url = "https://files.pythonhosted.org/packages/ac/45/2a28653d4bc46e4313741d35287046360f6ed4c8d223fea5f0c1f88f7bad/lief-0.17.0-cp312-cp312-win_amd64.whl", hash = "sha256:33820c66288d447772153c7c9cab356cbb693b5ea0f87bb49e682aa919e08830", size = 3637539, upload-time = "2025-09-14T13:53:46.979Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/f9/e19c9b2b196488282e1f4c0acf5d06e63617df6a01898c0dcdb7a5702dfd/lief-0.17.0-cp312-cp312-win_arm64.whl", hash = "sha256:7198558b3f1803e361a38fc26142d60f3d24b08d9b1811a046ced3ed0fa233b9", size = 3473084, upload-time = "2025-09-14T13:53:52.572Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/a7/a4e4bf099efc9d4a75bc3f34fc4bb7b206ca7e34109e43ff436cc5c9dc3f/lief-0.17.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:580f09dfa152d8a15f2cce6578f0a945b0e5ba6148de614857620b087c62fbdd", size = 3000794, upload-time = "2025-09-14T13:53:56.757Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/93/4c212e4aa295c7121a9d06c676c03ddd2886550293995b600b936176e575/lief-0.17.0-cp313-cp313-macosx_11_0_x86_64.whl", hash = "sha256:d97c08dbfbb8a380347ca45b1f3efcf56f0d54d149e12d1cf16ad40abe039afd", size = 3106935, upload-time = "2025-09-14T13:54:00.007Z" },
+    { url = "https://files.pythonhosted.org/packages/2d/89/2dbb0c44e528ced0f78b81798d9f7cfe477a310d04ef5b7d02602ab079e5/lief-0.17.0-cp313-cp313-manylinux2014_aarch64.whl", hash = "sha256:044e77a80e00bd242f358744ddb98f50ada5c0a50091016d66ae02f4a6baf694", size = 3674167, upload-time = "2025-09-14T13:54:02.907Z" },
+    { url = "https://files.pythonhosted.org/packages/61/1e/a672a45b2e25492696c9418004db60c227b2e767a9592d5b7ce9c3952d22/lief-0.17.0-cp313-cp313-manylinux_2_28_i686.whl", hash = "sha256:aea5b7f108e0ebef75fc3b081d6a72e9a7bd4bae5ac5b4d97fe001292fefec9d", size = 3501462, upload-time = "2025-09-14T13:54:05.75Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/3d/cbacfed7af263d4ba653b25c69e5bea58e2d9e8e53857bbce052bdbea25c/lief-0.17.0-cp313-cp313-manylinux_2_28_x86_64.whl", hash = "sha256:bcdcc52ee83bc2a16229d0df6595199576725db4555e35ac880852b7576534ed", size = 3404847, upload-time = "2025-09-14T13:54:07.831Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/3d/0823baeda5b63bd5a126c5bd15ebd8293a1cb108d79ae420dd64c948af95/lief-0.17.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:cd2d0e1960ee314c7930911b527228926f4ff2dcef3ca22a4b411cb7054f0d66", size = 3592209, upload-time = "2025-09-14T13:54:10.544Z" },
+    { url = "https://files.pythonhosted.org/packages/81/7f/8e3d7b0a93aadc83d6f9e743c75485a5a8333a85ea7be582b318b0da47fd/lief-0.17.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:f4d0e264368b54e54796e56b578681c3bd5eeef7c2d280acaaa918d896883aaf", size = 3958431, upload-time = "2025-09-14T13:54:12.412Z" },
+    { url = "https://files.pythonhosted.org/packages/25/08/338e8ee06948022a1b0cd7d2f194a096c818384e4b7cfc7807e7bd023769/lief-0.17.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:89506b0a4a262bf9cefaaaaa628c2ffbf0857b8d1056e6a9fca24748470a4485", size = 3705355, upload-time = "2025-09-14T13:54:15.034Z" },
+    { url = "https://files.pythonhosted.org/packages/29/8d/6001295abca3535099cfd328302129551678a8ce8deeda39e83a95b07762/lief-0.17.0-cp313-cp313-win32.whl", hash = "sha256:340155975e25ed68f39fb43b0023cb8571f3171da1b3e6fa7a40441c4e547208", size = 3459310, upload-time = "2025-09-14T13:54:17.975Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/ad/deb8f595f04610f9daa747784b278e12c3b0cc99cc46135db6ffb61cd651/lief-0.17.0-cp313-cp313-win_amd64.whl", hash = "sha256:467b25c857239271077c5ac9d97d8c1fb0282ce84096f2518ef03c244660ef10", size = 3637564, upload-time = "2025-09-14T13:54:19.713Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/33/84bf9a0b3e5eae0867cd5fc850e39e1bae25c6de1e851654eec5ef405342/lief-0.17.0-cp313-cp313-win_arm64.whl", hash = "sha256:112773fb27ba0ccf1abfd62e5e7e9ca8332d46990304c8286613e22c6ab0f5e4", size = 3472711, upload-time = "2025-09-14T13:54:21.829Z" },
+    { url = "https://files.pythonhosted.org/packages/fc/89/23d7f9df028fa599ea31f23b1142cef7f47e70b84845484e4fcfd393ffc2/lief-0.17.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:4c1e2774a68f8d78043a684675e700c978656efdfbceb5177e262e7b93aa2e41", size = 3000280, upload-time = "2025-09-14T13:54:23.312Z" },
+    { url = "https://files.pythonhosted.org/packages/39/7b/57a246db93cb5b196d233b343438217554c506a99111033762a3aa1e6d02/lief-0.17.0-cp314-cp314-macosx_11_0_x86_64.whl", hash = "sha256:630df2bc20c531ca5610db4a2ca393fab4699a6834ff6d7b937eb795d72592c7", size = 3108890, upload-time = "2025-09-14T13:54:24.933Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/8f/6727acff8c7d0c82b97044f245910150dcadd439cbff1ad82a78768633b2/lief-0.17.0-cp314-cp314-manylinux2014_aarch64.whl", hash = "sha256:7b5dc554f0ac995fe5d4e99e1f0387799446a9615830723d9810b4fd8da3c8ab", size = 3673757, upload-time = "2025-09-14T13:54:26.586Z" },
+    { url = "https://files.pythonhosted.org/packages/15/6f/a2de1c8d0c521a3c8e4b59acb23ef2c189c22679f825363d85b0200d7e33/lief-0.17.0-cp314-cp314-manylinux_2_28_i686.whl", hash = "sha256:ed0ffe35bb18c965476cc71a5329538d615ef2708dd0aec19f2c6d914f6d0db5", size = 3501676, upload-time = "2025-09-14T13:54:28.416Z" },
+    { url = "https://files.pythonhosted.org/packages/4e/60/c2d1699a198f3555eeaf456d1af5c984b5b41ea0ba5dc8ccfc72b1269142/lief-0.17.0-cp314-cp314-manylinux_2_28_x86_64.whl", hash = "sha256:f8a33db4573bedae481431fa31d608178af99b6f94e409b6b27c3f5b8067a6b7", size = 3406869, upload-time = "2025-09-14T13:54:29.95Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/76/a6688cd731b40e03e3d806be180c4b02083861b88610f9f6a60e1b9cd9d0/lief-0.17.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:b306e2c34baa7a1d5a061b828f88a5fc0d008992b76d972305c52529f17623e6", size = 3591215, upload-time = "2025-09-14T13:54:31.545Z" },
+    { url = "https://files.pythonhosted.org/packages/42/73/c9cbc2fc1076464a4c69441e28c95ea32bfde2297cc0d6449c84c4b0a5a0/lief-0.17.0-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:298dd958aa80f54073a2683d964b892e7156c171095a77eb8a16c8c9d05e3bde", size = 3958202, upload-time = "2025-09-14T13:54:33.049Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/19/9913f2045455ddedee409d74cf312503c0f37f3cf232cf0925dbc0e3ad7d/lief-0.17.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:de2d838238c4e578bf53627fe9290cdc2f537dcb19b37075e56fab538320b026", size = 3707263, upload-time = "2025-09-14T13:54:35.048Z" },
+    { url = "https://files.pythonhosted.org/packages/45/f4/8add3bf42623e8986bbf5733d4152ab7ded704a6b7f3fb694559a528ad77/lief-0.17.0-cp314-cp314-win32.whl", hash = "sha256:dc6567e75247bf3dd0db14b8b2b6d9423a3790244a9c6cbf38c7391344e56179", size = 3459612, upload-time = "2025-09-14T13:54:36.745Z" },
+    { url = "https://files.pythonhosted.org/packages/91/0a/fb51f64c1a34594a17af3c6e1d267a4a697ddc6f9fbb3c36b88b9b5d73a4/lief-0.17.0-cp314-cp314-win_amd64.whl", hash = "sha256:e543273dcd52dfe48f08a1a0f32eb2ee24601485cf82de7b7d54a1e56d8aa6c7", size = 3637781, upload-time = "2025-09-14T13:54:38.441Z" },
+]
+
 [[package]]
 name = "lldb-for-pwndbg"
 version = "20.1.8.post1"
@ -1380,6 +1440,7 @@ source = { editable = "." }
 dependencies = [
    { name = "capstone" },
    { name = "ipython" },
+    { name = "lief" },
    { name = "psutil" },
    { name = "pt" },
    { name = "pwntools" },
@ -1450,6 +1511,7 @@ requires-dist = [
    { name = "gdb-for-pwndbg", marker = "extra == 'gdb'", specifier = "==16.3.0.post1" },
    { name = "gnureadline", marker = "sys_platform != 'win32' and extra == 'lldb'", specifier = ">=8.2.13,<9" },
    { name = "ipython", specifier = ">=8.37.0,<9" },
+    { name = "lief", specifier = ">=0.17" },
    { name = "lldb-for-pwndbg", marker = "extra == 'lldb'", specifier = "==20.1.8.post1" },
    { name = "psutil", specifier = ">=7.0.0,<8" },
    { name = "pt", git = "https://github.com/martinradev/gdb-pt-dump?rev=50227bda0b6332e94027f811a15879588de6d5cb" },