mikeash.com pyblog/friday-qa-2012-11-30-lets-build-a-mach-o-executable.html comments

Rasmus - 2014-05-08 11:11:26

Thu, 08 May 2014 11:11:26 GMT

LC_SOURCE_VERSION is used, for example, used by CrashReporter in the "Version" field of crash reports for processes that lack an Info.plist (typically Unix commands like /bin/ls), so I guess it's the version of the source code used to build the binary.

Liu - 2012-12-21 22:16:20

Fri, 21 Dec 2012 22:16:20 GMT

nice one. I'm actually doing something similar, but only crafting a bare bone Mach-O binary. check it out: http://blog.softboysxp.com/post/38426183643/a-minimal-mach-o-x64-executable-for-os-x-mountain-lion

also an earlier version that doesn't even require dyld: http://blog.softboysxp.com/post/7688131432/a-minimal-mach-o-x64-executable-for-os-x

Gwynne Raskind - 2012-12-01 00:45:40

Sat, 01 Dec 2012 00:45:40 GMT

Oh, and dyldinfo and its source code.

Gwynne Raskind - 2012-12-01 00:41:46

Sat, 01 Dec 2012 00:41:46 GMT

SSteve: A whole list of sources. The Mach-O Reference from Apple's dev docs is one, I meant to link to it in the article but forget :(. I also made extremely heavy use of the mach-o/{nlist,loader,fat,stab}.h headers, otool, dsymutil, dwarfdump, unwinddump, hexdump, and the Hopper Disassembler. In short, I tore the binary Clang generated apart from every possible direction and stitched it back together one piece at a time :)

Gwynne Raskind - 2012-12-01 00:38:50

Sat, 01 Dec 2012 00:38:50 GMT

nevym: You're welcome :). I'm hoping to update the article, or post a part 2, with a fully working executable.

As for your nits, that was supposed to be "stdio.h" and "time.h", but Mike and I forgot to HTML-escape them. Your spelling correction is, of course, correct! I'm sure Mike will take care of both as soon as he reads the comment. Right, Mike? ;)

SSteve - 2012-12-01 00:37:44

Sat, 01 Dec 2012 00:37:44 GMT

What a huge, opaque, mass (or mess) of data! Where do you even go to find out all this stuff?

nevyn - 2012-11-30 22:41:35

Fri, 30 Nov 2012 22:41:35 GMT

Whew! That's an awesome amount of information, looking forward to returning to it for reference. Thanks!

(some nitpics: "#include and #include" -> "#include and #import" I assume; "or prefex tree" -> "or prefix tree")