node-lief

Node.js bindings for LIEF, a library to parse and manipulate ELF, PE, and Mach-O executables. We use it in production in tweakcc, and it's also used in community projects like claude-depester.

These bindings were largely generated by Claude, and have 97%+ coverage. Most of the APIs are currently used in tweakcc.

Installation

# npm
npm install node-lief

# yarn
yarn add node-lief

# pnpm
pnpm add node-lief

Usage

import LIEF from 'node-lief';

// Parse any binary (format is auto-detected)
const binary = LIEF.parse('/bin/ls');

console.log(binary.format);     // 'ELF' | 'PE' | 'MachO'
console.log(binary.entrypoint); // 0x1234n (bigint)
console.log(binary.isPie);      // true

// Iterate sections
for (const section of binary.sections()) {
  console.log(section.name, section.virtualAddress);
}

// Modify and write
binary.patchAddress(0x1000n, [0x90, 0x90, 0x90]);
binary.write('./patched');

Format-specific APIs

import LIEF from 'node-lief';

// Mach-O: Handle universal binaries and code signatures
const fat = LIEF.MachO.parse('./macho-binary');
const binary = fat.at(0) as LIEF.MachO.Binary;

if (binary.hasCodeSignature) {
  binary.removeSignature();
}

const segment = binary.getSegment('__TEXT');
const section = segment?.getSection('__text');
console.log(section?.content); // Buffer

// ELF: Access overlay data
const elf = LIEF.parse('./elf-binary') as LIEF.ELF.Binary;
if (elf.hasOverlay) {
  console.log(elf.overlay); // Buffer
}

// PE: Work with sections
const pe = LIEF.parse('./pe-binary') as LIEF.PE.Binary;
const peSection = pe.getSection('.text');
console.log(peSection?.virtualSize);

API

LIEF.parse(path: string) — Parse a binary and return a format-specific Binary object.

LIEF.MachO.parse(path: string) — Parse a Mach-O file, returning a FatBinary (handles universal binaries).

Binary properties and methods

| Property/Method | Description | |-----------------|-------------| | format | 'ELF' | 'PE' | 'MachO' | 'UNKNOWN' | | entrypoint | Entry point address (bigint) | | isPie | Position-independent executable | | hasNx | NX (non-executable stack) protection | | sections() | Array of sections | | symbols() | Array of symbols | | getSymbol(name) | Get symbol by name | | patchAddress(addr, bytes) | Patch bytes at address | | write(path) | Write binary to disk |

Format-specific APIs

| Format | Additional APIs | |--------|-----------------| | ELF | hasOverlay, overlay (Buffer) | | PE | optionalHeader, getSection(name), section.virtualSize | | MachO | header, hasCodeSignature, getSegment(name), removeSignature(), extendSegment() |

Logging

LIEF.logging.disable(); // Silence LIEF output
LIEF.logging.enable();

Supported platforms

| Platform | Architectures | |----------|---------------| | Linux | x64, arm64 | | macOS 13+ | x64, arm64 | | Windows | x64, arm64 |

License

Apache-2.0 © 2025-2026 Piebald LLC