Which python library for parsing Linux ELF files?

Question

I want to be able to parse 32 and 64 bit ELF files - but not create or modify them (e.g. as discussed in this thread). The ELF binaries may possibly come from embedded Linux systems, that is, the library should not be irritated by MIPS, ARM and other non-x86 architectures.

What I have considered:

• pyelftools (my currently favored option)
• pylibelf
• pydevtools
• Also an option: using a C library and ctypes.

Do I have forgotten something? Which of the above options would you prefer?

For those who had some practical experience with pylibelf or pydeftools: These seem no longer updated (last commit: 2013 and 2012), are they mature enough?

Answer 1

Take a look at radare2. It can parse file formats (see here for an example of parsing the ELF header).

Radare2 supports multiple architectures and is being actively developed. On top of that it has bindings for a lot of languages, including Python of course. Read through the bindings source code to see it is pretty straightforward to script it.

HTH!

Answer 2

LIEF is a good choice for parsing ELF binaries. It's written in C++, but comes with proper Python bindings and is readily available via PyPi. Besides parsing ELF files it also supports Windows PE and MacOS binaries, reading and modifying and writing all of them, that is.

It's available since 2017 and is actively maintained (example).

LIEF is pretty light-weight and doesn't require many dependencies.