Last active
April 11, 2024 01:12
-
-
Save typeswitch-dev/e91bd993b9e25bbf7082ab3bb2d9b17e to your computer and use it in GitHub Desktop.
NASM source for a minimal self-modifying Mach-O executable
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bits 64 | |
org 0x1000 | |
mach_header: | |
.magic dd 0xFEEDFACF ; MH_MAGIC_64 | |
.cputype dd 0x01000007 ; CPU_ARCH_ABI64 | CPU_TYPE_I386 | |
.cpusubtype dd 0x00000003 ; CPU_SUBTYPE_LIB64 | CPU_SUBTYPE_I386_ALL | |
.filetype dd 0x2 ; MH_EXECUTE | |
.ncmds dd 3 | |
.sizeofcmds dd mach_cmds_end - mach_cmds_start | |
.flags: dd 0x1 ; MH_NOUNDEFS | |
dd 0 ; reserved | |
mach_cmds_start: | |
mach_cmd_segment_64_pagezero: | |
.cmd dd 0x19 | |
.cmdsize dd .end - .cmd | |
.segname db "__PAGEZERO", 6 dup 0 | |
.vmaddr dq 0 | |
.vmsize dq mach_header | |
.fileoff dq 0 | |
.filesize dq 0 | |
.maxprot dd 0 | |
.initprot dd 0 | |
.nsects dd 0 | |
.flags dd 0 | |
.end: | |
mach_cmd_segment_64_text: | |
.cmd dd 0x19 | |
.cmdsize dd .end - .cmd | |
.segname db "__TEXT", 10 dup 0 | |
.vmaddr dq mach_header | |
.vmsize dq 0x1000000 ; (end_of_program - mach_header) | |
.fileoff dq 0 | |
.filesize dq end_of_text - mach_header | |
.maxprot dd 0x7 ; RWX | |
.initprot dd 0x7 ; RWX | |
.nsects dd 0 | |
.flags dd 0 | |
.end: | |
mach_cmd_unixthread: | |
.cmd dd 0x5 | |
.cmdsize dd .end - .cmd | |
.thrdstate dd 0x4 | |
.exncount dd 42 | |
.regs dq 16 dup 0 | |
.rip dq _main | |
.rflags dq 0 | |
.cs dq 0 | |
.fs dq 0 | |
.gs dq 0 | |
.end: | |
mach_cmds_end: | |
_main: | |
mov dword [.scary], 0x00002ABF ; mov edi, 42 | |
mov eax, 0x2000001 ; SYS_EXIT | |
.scary db 0,0,0,0,0 | |
syscall | |
end_of_text: | |
align 0x1000 | |
end_of_program: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment