From c5c430367f95bbcf2f23237e1047d43330e89d6f Mon Sep 17 00:00:00 2001 From: Sami Samhuri Date: Mon, 23 Jun 2014 21:43:45 -0700 Subject: [PATCH] =?UTF-8?q?escape=20segment=20names=20...=20Markdown!=20?= =?UTF-8?q?=F0=9F=98=A7?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../2010/01/basics-of-the-mach-o-file-format.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/public/posts/2010/01/basics-of-the-mach-o-file-format.md b/public/posts/2010/01/basics-of-the-mach-o-file-format.md index e74a904..7159ee7 100644 --- a/public/posts/2010/01/basics-of-the-mach-o-file-format.md +++ b/public/posts/2010/01/basics-of-the-mach-o-file-format.md @@ -34,7 +34,7 @@ Apple's Mach-O overview, which illustrates this quite nicely.

A very basic Mach object file consists of a header followed by single blob of machine code. That blob could be described by a single -section named __text, inside a single nameless segment. Here's a +section named \_\_text, inside a single nameless segment. Here's a diagram showing the layout of such a file:

@@ -77,7 +77,7 @@ is where in memory segments will ultimately end up.

Names are optional and can be arbitrary, but the convention is to name segments with uppercase letters preceded by two underscores, -e.g. __DATA or __TEXT

+e.g. \_\_DATA or \_\_TEXT

The code exposes some more details about segment commands, but should be easy enough to follow.

@@ -101,7 +101,7 @@ everything in memory the addresses inside our machine code will need to be updated.

By convention segments are named with lowercase letters preceded by -two underscores, e.g. __bss or __text

+two underscores, e.g. \_\_bss or \_\_text

Finally, the Ruby code describing section structs:

@@ -130,9 +130,9 @@ beasts.

If you want to see the actual data for a section otool provides a couple of ways to do this. The first is to use otool -d <segment> <section> for an arbitrary -section. To see the contents of a well-known section, such as __text -in the __TEXT segment, use otool -t /usr/bin/true. You can -also disassemble the __text section with +section. To see the contents of a well-known section, such as \_\_text +in the \_\_TEXT segment, use otool -t /usr/bin/true. You can +also disassemble the \_\_text section with otool -tv /usr/bin/true.

You'll get to know otool quite well if you work with Mach-O.

@@ -151,8 +151,8 @@ the next post we'll be there.

(You can almost do that with what we know now. If you create a Mach file with a Mach header (ncmds=1), a single unnamed -segment (nsects=1), and then a section named __text with a segment -name of __TEXT, and some x86 machine code as the section data, you +segment (nsects=1), and then a section named \_\_text with a segment +name of \_\_TEXT, and some x86 machine code as the section data, you would almost have a useful Mach object file.)

Until next time, happy hacking!