- Author
- Joe Savage
- Published
- 8 November 2014
- Kind
- Personal blog walkthrough, based on hands-on inspection of one binary
- Original
- www.reinterpretcast.com/hello-world-mach-o
- Subject
- Systems and hardware
- Themes
- Close to the machine, Getting good
What it is
Joe Savage wanted to learn how executables talk to the operating system. The post records what the author found in a Hello World binary. It gives an outline and does not explain every byte.
What it says
- The author compiled a two-line Hello World on macOS and inspected the 8548-byte output.
- The Mach-O header is the first 32 bytes, opening with the 0xfeedfacf magic value.
- The header says 16 load commands follow, totalling 1376 bytes.
- The __PAGEZERO segment catches NULL pointer dereferences and takes no space on disk.
- The kernel loads the program and dyld, which loads libSystem and binds symbols.
- Lazy symbols resolve on first use through stubs, and execution begins at LC_MAIN.
What evidence it gives
The post shows otool output for the header. It describes the load commands and sections. It includes a colour visualisation of the file bytes. Claims about the loading process lean on Apple documentation and open source code.
Interests and limits
The test used one Late 2013 MacBook running Yosemite and an x86_64 binary. The post does not test newer systems or other chip types. The author calls the account a brief outline. Many parts of dynamic linking go uncovered.