I thinks this is a strange question, but now I prepare to hand-made a minimal Mach-O 64 binary, like the same problem on ELF (http://timelessname.com/elfbin/).
But currently I still sucks on how to debug my binary. otool does NOT show me the error, but I get the suck how to debug the binary. The following is the binary I make in hex view. In the current stage I've no idea how to continue. Any suggestion? or I should stop this stupid things...
0000000: cffa edfe 0700 0001 0300 0080 0200 0000 ................
0000010: 0900 0000 0002 0000 8500 0000 0000 0000 ................
0000020: 1900 0000 4800 0000 5f5f 5041 4745 5a45 ....H...__PAGEZE
0000030: 524f 0000 0000 0000 0000 0000 0000 0000 RO..............
0000040: 0000 0000 0100 0000 0000 0000 0000 0000 ................
0000050: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000060: 0000 0000 0000 0000 1900 0000 9800 0000 ................
0000070: 5f5f 5445 5854 0000 0000 0000 0000 0000 __TEXT..........
0000080: 0010 0000 0000 0000 0010 0000 0000 0000 ................
0000090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00000a0: 0700 0000 0500 0000 0100 0000 0000 0000 ................
00000b0: 5f5f 7465 7874 0000 0000 0000 0000 0000 __text..........
00000c0: 5f5f 5445 5854 0000 0000 0000 0000 0000 __TEXT..........
00000d0: 1010 0000 0000 0000 1000 0000 0000 0000 ................
00000e0: 2002 0000 0100 0000 0000 0000 0000 0000 ...............
00000f0: 0004 0080 0000 0000 0000 0000 0000 0000 ................
0000100: 1900 0000 4800 0000 5f5f 4c49 4e4b 4544 ....H...__LINKED
0000110: 4954 0000 0000 0000 0000 0000 0000 0000 IT..............
0000120: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000130: 0000 0000 0000 0000 0700 0000 0100 0000 ................
0000140: 0000 0000 0000 0000 2200 0080 3000 0000 ........"...0...
0000150: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000160: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000170: 0000 0000 0000 0000 0200 0000 1800 0000 ................
0000180: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000190: 0b00 0000 5000 0000 0000 0000 0000 0000 ....P...........
00001a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00001b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00001c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00001d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00001e0: 1b00 0000 1800 0000 506f 7765 7265 6420 ........Powered
00001f0: 6279 2063 6d6a 0000 2400 0000 1000 0000 by cmj..$.......
0000200: 000a 0a00 000a 0a00 2800 0080 1800 0000 ........(.......
0000210: 2002 0000 0000 0000 0000 0000 0000 0000 ...............
0000220: 48c7 c001 0000 0248 c7c7 0400 0000 0f05 H......H........
0000230: 0a .
[UPDATE] My environment is Mac OSX 10.10 which the online information does not workable in my case (e.g. https://gist.github.com/softboysxp/1084476)
You cannot go below the 4096 byte limit since Yosemite 10.10.5. It's Mach-O kernel checks are more restrictive now. Alternatively to dyld and
LC_MAIN
, you can go forLC_UNIXTHREAD
and obviously keeping yourLC_SEGMENT64
. Sections are not necessary, dropping them will make tracking the binary harder.Since El Capitan
PAGEZERO
with nonzero size is required for 64 bit executables. Here is a working HelloWorld example valid Sierra 10.12.2 compiled withNASM
orYASM
Now I've find the minimal Mach-O 64 binary with 4K size but now I still has some trouble when reduce the size of my binary:
So now I've to fill almost 3k \x00 in my binary, and I don't know how to reduce this binary anymore.