I suppose I’m just not good with this kind of things, e.g. maintaining a blog.
Anyways, this post is about something easy and fun. I was asked about a tiny hello-world mach-o and since it was actually at least a year from last time I’ve been playing with a mach-o file it felt like a very good excuse for playing with them once again.
First thing I did was to go over to www.osxbook.com. I was pretty sure Amit Singh would have wrote a tiny mach-o already, and that was the case.
Downloaded tiny.asm and started from this phrase “There are plenty of zeros lurking in there.”.
- LC_SEGMENT segnames must be padded to 16 bytes, we can actually use that space for storing few opcodes (there must be at least a null termination after segname)
- we can use registers from LC_UNIXTHREAD for storing initial values we might need in order to avoid using bigger opcodes
That’s all, and it gives us a 180 bytes valid/working hello-world mach-o, which is, pretty small.
I think it’s still possible to have even a smaller one, but it would probably be >=10.8 only.
You can grab sources here.
Or have a quick look here.
; yasm -f bin rev_mach-o.asm
; it’s tiny.asm from http://osxbook.com/blog/2009/03/15/crafting-a-tiny-mach-o-executable/
; with very few modifications in order to have both a valid and working hello-world mach-o
db 0xce, 0xfa, 0xed, 0xfe ; magic
dd 7 ; cputype (CPU_TYPE_X86)
dd 3 ; cpusubtype (CPU_SUBTYPE_I386_ALL)
dd 2 ; filetype (MH_EXECUTE)
dd 2 ; ncmds
dd _ep2 – _text ; cmdsize
dd 0 ; flags
dd 1 ; cmd (LC_SEGMENT)
dd 56 ; cmdsize | sizeof(segment_command) makes it valid
db “T” ; segname
db 0 ; segname padding
push msg_size ; this is part of segname padding
; – SYS_exit
dd 0x1000 ; vmaddr
dd 0x1000 ; vmsize
dd 0 ; fileoff
dd filesize ; filesize
dd 7 ; maxprot
dd 5 ; initprot
dd 0 ; nsects
dd 0 ; flags
dd 5 ; cmd (LC_UNIXTHREAD)
dd 80 ; cmdsize
dd 1 ; flavor (i386_THREAD_STATE)
dd 16 ; count (i386_THREAD_STATE_COUNT)
dd 4, 0, 1, 0, 0, 0, 0, 0 ; state
dd 0, 0, _ep, 0, 0, 0, 0, 0 ; state
mov eax, ecx
filesize equ $ – $$
msg db ‘Hello world’, 0ah
msg_size equ $ – msg
- Amit Singh for his tiny.asm
- Orlando for suggesting me that “__TEXT” segname is not really needed/enforced