$ show foundryzero/llef
LLEf (LLDB Enhanced) is a Python-based LLDB plugin for low-level reverse engineering, vulnerability research, and exploit development. It provides enhanced debugger context (registers, stack, code, threads, trace) via an automatic stop hook and adds specialized commands: context, hexdump, pattern (cyclic pattern generation/search), checksec (ELF security mitigations), xinfo (memory mappings), dereference (pointer chain dereferencing), and scan (heap/memory scanning). It supports multiple architectures (x86_64, ARM, AArch64, i386, PowerPC) and includes experimental Go binary analysis: parsing the PCLNTAB and ModuleData structures to recover function names, types, and stack frames from stripped Go executables (versions 1.7–1.24). The plugin persists configuration via JSON files in the user's home directory. The codebase is structured with clear base classes for commands, settings, and architecture definitions, though it lacks automated tests and relies heavily on the LLDB Python API.
The LLM identified 5 files worth highlighting for reuse:
Implements a thread-safe singleton metaclass (Singleton) that can be used to enforce a single instance of any class. The pattern is clean, isolated, and reusable across projects that need a global state or configuration manager. It uses a lock to prevent race conditions and stores instances per class.
Generates and searches De Bruijn sequences for cyclic pattern creation and pattern offset calculation. The generator creates sequences of any length over a configurable alphabet (default alphanumeric). The search function finds the offset of a given sub-pattern. This implementation is self-contained, parameterized, and directly portable to other projects needing pattern-based offset detection.
Utility module for extracting and coloring disassembled instructions. It handles LLDB instruction objects, resolves operands, computes colors based on memory region types (code/stack/heap), and formats lines for terminal display. The logic for separating instruction text from operands and applying color is isolated and could be reused in any debugger or profiler UI that needs to highlight memory types.
Python representation of Go 'runtime' type metadata (rtype, slice, string, interface, map, channel, etc.) as extracted from a Go binary's runtime. It models the Go type structure with methods to resolve field offsets, nested types, and kind information. This module demonstrates deep understanding of Go's runtime internals and is reusable for any project that needs to introspect Go data from a core dump or debugger.
Base class for all LLEf commands, implementing common patterns for command creation: handling of arguments, user input (LLDB's SBCommandReturnObject), and automatic registration when the class is imported. It uses a classmethod `lldb_command` to define the command name and arguments, and the base class registers the command with LLDB's command interpreter. This abstraction isolates command boilerplate and can be reused as a template for building other LLDB plugins.