Mach-O

/*
 * The 32-bit mach header appears at the very beginning of the object file for
 * 32-bit architectures.
 */
struct mach_header {
    uint32_t    magic;        /* mach magic number identifier */
    cpu_type_t    cputype;    /* cpu specifier */
    cpu_subtype_t    cpusubtype;    /* machine specifier */
    uint32_t    filetype;    /* type of file */
    uint32_t    ncmds;        /* number of load commands */
    uint32_t    sizeofcmds;    /* the size of all the load commands */
    uint32_t    flags;        /* flags */
};

/*
 * The 64-bit mach header appears at the very beginning of object files for
 * 64-bit architectures.
 */
struct mach_header_64 {
    uint32_t    magic;        /* mach magic number identifier */
    cpu_type_t    cputype;    /* cpu specifier */
    cpu_subtype_t    cpusubtype;    /* machine specifier */
    uint32_t    filetype;    /* type of file */
    uint32_t    ncmds;        /* number of load commands */
    uint32_t    sizeofcmds;    /* the size of all the load commands */
    uint32_t    flags;        /* flags */
    uint32_t    reserved;    /* reserved */
};

 *
 * Constants for the filetype field of the mach_header
 */
#define    MH_OBJECT    0x1        /* relocatable object file */
#define    MH_EXECUTE    0x2        /* demand paged executable file */
#define    MH_FVMLIB    0x3        /* fixed VM shared library file */
#define    MH_CORE        0x4        /* core file */
#define    MH_PRELOAD    0x5        /* preloaded executable file */
#define    MH_DYLIB    0x6        /* dynamically bound shared library */
#define    MH_DYLINKER    0x7        /* dynamic link editor */
#define    MH_BUNDLE    0x8        /* dynamically bound bundle file */
#define    MH_DYLIB_STUB    0x9        /* shared library stub for static */
                    /*  linking only, no section contents */
#define    MH_DSYM        0xa        /* companion file with only debug */
                    /*  sections */
#define    MH_KEXT_BUNDLE    0xb        /* x86_64 kexts */

/* Constants for the flags field of the mach_header */
#define    MH_NOUNDEFS    0x1        /* the object file has no undefined
                       references */
#define    MH_INCRLINK    0x2        /* the object file is the output of an
                       incremental link against a base file
                       and can't be link edited again */
#define MH_DYLDLINK    0x4        /* the object file is input for the
                       dynamic linker and can't be staticly
                       link edited again */
#define MH_BINDATLOAD    0x8        /* the object file's undefined
                       references are bound by the dynamic
                       linker when loaded. */
#define MH_PREBOUND    0x10        /* the file has its dynamic undefined
                       references prebound. */
#define MH_SPLIT_SEGS    0x20        /* the file has its read-only and
                       read-write segments split */
#define MH_LAZY_INIT    0x40        /* the shared library init routine is
                       to be run lazily via catching memory
                       faults to its writeable segments
                       (obsolete) */
#define MH_TWOLEVEL    0x80        /* the image is using two-level name
                       space bindings */
#define MH_FORCE_FLAT    0x100        /* the executable is forcing all images
                       to use flat name space bindings */
#define MH_NOMULTIDEFS    0x200        /* this umbrella guarantees no multiple
                       defintions of symbols in its
                       sub-images so the two-level namespace
                       hints can always be used. */
#define MH_NOFIXPREBINDING 0x400    /* do not have dyld notify the
                       prebinding agent about this
                       executable */
#define MH_PREBINDABLE  0x800           /* the binary is not prebound but can
                       have its prebinding redone. only used
                                           when MH_PREBOUND is not set. */
#define MH_ALLMODSBOUND 0x1000        /* indicates that this binary binds to
                                           all two-level namespace modules of
                       its dependent libraries. only used
                       when MH_PREBINDABLE and MH_TWOLEVEL
                       are both set. */ 
#define MH_SUBSECTIONS_VIA_SYMBOLS 0x2000/* safe to divide up the sections into
                        sub-sections via symbols for dead
                        code stripping */
#define MH_CANONICAL    0x4000        /* the binary has been canonicalized
                       via the unprebind operation */
#define MH_WEAK_DEFINES    0x8000        /* the final linked image contains
                       external weak symbols */
#define MH_BINDS_TO_WEAK 0x10000    /* the final linked image uses
                       weak symbols */

#define MH_ALLOW_STACK_EXECUTION 0x20000/* When this bit is set, all stacks 
                       in the task will be given stack
                       execution privilege.  Only used in
                       MH_EXECUTE filetypes. */
#define    MH_DEAD_STRIPPABLE_DYLIB 0x400000 /* Only for use on dylibs.  When
                         linking against a dylib that
                         has this bit set, the static linker
                         will automatically not create a
                         LC_LOAD_DYLIB load command to the
                         dylib if no symbols are being
                         referenced from the dylib. */
#define MH_ROOT_SAFE 0x40000           /* When this bit is set, the binary 
                      declares it is safe for use in
                      processes with uid zero */

#define MH_SETUID_SAFE 0x80000         /* When this bit is set, the binary 
                      declares it is safe for use in
                      processes when issetugid() is true */

#define MH_NO_REEXPORTED_DYLIBS 0x100000 /* When this bit is set on a dylib, 
                      the static linker does not need to
                      examine dependent dylibs to see
                      if any are re-exported */
#define    MH_PIE 0x200000            /* When this bit is set, the OS will
                       load the main executable at a
                       random address.  Only used in
                       MH_EXECUTE filetypes. */

struct load_command {
    uint32_t cmd;        /* type of load command */
    uint32_t cmdsize;    /* total size of command in bytes */
};

/System/Library/CoreServices/Finder.app/Contents/MacOS
➜  MacOS otool -lV Finder 
Finder:
Mach header
      magic cputype cpusubtype  caps    filetype ncmds sizeofcmds      flags
MH_MAGIC_64  X86_64        ALL LIB64     EXECUTE    80       9928   NOUNDEFS DYLDLINK TWOLEVEL BINDS_TO_WEAK PIE MH_HAS_TLV_DESCRIPTORS
Load command 0
      cmd LC_SEGMENT_64
  cmdsize 72
  segname __PAGEZERO
   vmaddr 0x0000000000000000
   vmsize 0x0000000100000000
  fileoff 0
 filesize 0
  maxprot ---
 initprot ---
   nsects 0
    flags (none)
Load command 1
      cmd LC_SEGMENT_64
  cmdsize 1112
  segname __TEXT
   vmaddr 0x0000000100000000
   vmsize 0x0000000000802000
  fileoff 0
 filesize 8396800
  maxprot rwx
 initprot r-x
   nsects 13
    flags PROTECTED_VERSION_1

➜  WeXin  xcrun dyldinfo -opcodes /bin/ls | more
rebase opcodes:
0x0000 REBASE_OPCODE_SET_TYPE_IMM(1)
0x0001 REBASE_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB(2, 0x00000038)
0x0003 REBASE_OPCODE_DO_REBASE_ULEB_TIMES(76)
0x0005 REBASE_OPCODE_ADD_ADDR_IMM_SCALED(0x10)
0x0006 REBASE_OPCODE_DO_REBASE_ULEB_TIMES_SKIPPING_ULEB(16, 16)
0x0009 REBASE_OPCODE_DO_REBASE_ADD_ADDR_ULEB(48)
0x000B REBASE_OPCODE_DO_REBASE_ULEB_TIMES_SKIPPING_ULEB(3, 16)
0x000E REBASE_OPCODE_DO_REBASE_ADD_ADDR_ULEB(64)
0x0010 REBASE_OPCODE_DO_REBASE_IMM_TIMES(1)
0x0011 REBASE_OPCODE_DONE()
binding opcodes:
0x0000 BIND_OPCODE_SET_DYLIB_ORDINAL_IMM(3)
0x0001 BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM(0x00, __DefaultRuneLocale)
0x0016 BIND_OPCODE_SET_TYPE_IMM(1)
0x0017 BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB(0x02, 0x00000010)
0x0019 BIND_OPCODE_DO_BIND()
0x001A BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM(0x00, ___stack_chk_guard)
0x002E BIND_OPCODE_DO_BIND()
0x002F BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM(0x00, ___stderrp)
0x003B BIND_OPCODE_DO_BIND()
0x003C BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM(0x00, ___stdoutp)
0x0048 BIND_OPCODE_DO_BIND()
0x0049 BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM(0x00, _optind)
0x0052 BIND_OPCODE_DO_BIND()
0x0053 BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM(0x00, dyld_stub_binder)
0x0065 BIND_OPCODE_ADD_ADDR_ULEB(0xFFFFFFC8)
:0x0009 REBASE_OPCODE_DO_REBASE_ADD_ADDR_ULEB(48)
0x000B REBASE_OPCODE_DO_REBASE_ULEB_TIMES_SKIPPING_ULEB(3, 16)
0x000E REBASE_OPCODE_DO_REBASE_ADD_ADDR_ULEB(64)
0x0010 REBASE_OPCODE_DO_REBASE_IMM_TIMES(1)
0x0011 REBASE_OPCODE_DONE()
binding opcodes:
0x0000 BIND_OPCODE_SET_DYLIB_ORDINAL_IMM(3)
0x0001 BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM(0x00, __DefaultRuneLocale)
0x0016 BIND_OPCODE_SET_TYPE_IMM(1)
0x0017 BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB(0x02, 0x00000010)
0x0019 BIND_OPCODE_DO_BIND()

➜  Desktop touch a.c
➜  Desktop cat a.c
➜  Desktop cat a.c

void main (int argc,char **argv) {
    printf("Saleve ,Munde!\n");
    printf("Value\n");
    exit(0);
}
➜  Desktop

➜  Debug xcrun dyldinfo -lazy_bind a
lazy binding information (from lazy_bind part of dyld info):
segment section          address    index  dylib            symbol
__DATA  __la_symbol_ptr  0x100001010 0x0000 libSystem        _exit
__DATA  __la_symbol_ptr  0x100001018 0x000C libobjc          _objc_autoreleasePoolPush
__DATA  __la_symbol_ptr  0x100001020 0x002C libSystem        _printf
➜  Debug

➜  Desktop nm a.out    
0000000100000000 T __mh_execute_header
                 U _exit
0000000100000f30 T _main
                 U _printf
                 U dyld_stub_binder
➜  Desktop

/// otool 对一个简单二进制文件的反汇编
➜  Debug otool -p _main -tV a
a:
(__TEXT,__text) section
_main:
0000000100000f10    pushq    %rbp
0000000100000f11    movq    %rsp, %rbp
0000000100000f14    subq    $0x20, %rsp
0000000100000f18    movl    $0x0, -0x4(%rbp)
0000000100000f1f    movl    %edi, -0x8(%rbp)
0000000100000f22    movq    %rsi, -0x10(%rbp)
0000000100000f26    callq    0x100000f5e ## symbol stub for: _objc_autoreleasePoolPush
0000000100000f2b    leaq    0x68(%rip), %rdi ## literal pool for: "Hellow dsf\n"
0000000100000f32    movq    %rax, -0x18(%rbp)
0000000100000f36    movb    $0x0, %al
0000000100000f38    callq    0x100000f64 ## symbol stub for: _printf
0000000100000f3d    leaq    0x62(%rip), %rdi ## literal pool for: "fdsfsfd\n"
0000000100000f44    movl    %eax, -0x1c(%rbp)
0000000100000f47    movb    $0x0, %al
0000000100000f49    callq    0x100000f64 ## symbol stub for: _printf
0000000100000f4e    xorl    %edi, %edi
0000000100000f50    movl    %eax, -0x20(%rbp)
0000000100000f53    callq    0x100000f58 ## symbol stub for: _exit
➜  Debug

➜  Debug otool -l -V a
Section
  sectname __stubs
   segname __TEXT
      addr 0x0000000100000f58
      size 0x0000000000000012
    offset 3928
     align 2^1 (2)
    reloff 0
    nreloc 0
      type S_SYMBOL_STUBS
attributes PURE_INSTRUCTIONS SOME_INSTRUCTIONS
 reserved1 0 (index into indirect symbol table)
 reserved2 6 (size of stubs)
Section
  sectname __stub_helper
   segname __TEXT
      addr 0x0000000100000f6c
      size 0x000000000000002e
    offset 3948
     align 2^2 (4)
    reloff 0
    nreloc 0
      type S_REGULAR
attributes PURE_INSTRUCTIONS SOME_INSTRUCTIONS
 reserved1 0
 reserved2 0
Section
➜  Debug

➜  Debug nm a | grep "U"
                 U _exit
                 U _objc_autoreleasePoolPush
                 U _printf
                 U dyld_stub_binder
➜  Debug nm a | wc -l  # 一共有多少符号
       6     在 arm 上有7个，还有一个__dyld_func_lookup
➜  Debug