Skip to content

Instantly share code, notes, and snippets.

@typeswitch-dev
Last active April 11, 2024 01:12
Show Gist options
  • Save typeswitch-dev/e91bd993b9e25bbf7082ab3bb2d9b17e to your computer and use it in GitHub Desktop.
Save typeswitch-dev/e91bd993b9e25bbf7082ab3bb2d9b17e to your computer and use it in GitHub Desktop.
NASM source for a minimal self-modifying Mach-O executable
bits 64
org 0x1000
mach_header:
.magic dd 0xFEEDFACF ; MH_MAGIC_64
.cputype dd 0x01000007 ; CPU_ARCH_ABI64 | CPU_TYPE_I386
.cpusubtype dd 0x00000003 ; CPU_SUBTYPE_LIB64 | CPU_SUBTYPE_I386_ALL
.filetype dd 0x2 ; MH_EXECUTE
.ncmds dd 3
.sizeofcmds dd mach_cmds_end - mach_cmds_start
.flags: dd 0x1 ; MH_NOUNDEFS
dd 0 ; reserved
mach_cmds_start:
mach_cmd_segment_64_pagezero:
.cmd dd 0x19
.cmdsize dd .end - .cmd
.segname db "__PAGEZERO", 6 dup 0
.vmaddr dq 0
.vmsize dq mach_header
.fileoff dq 0
.filesize dq 0
.maxprot dd 0
.initprot dd 0
.nsects dd 0
.flags dd 0
.end:
mach_cmd_segment_64_text:
.cmd dd 0x19
.cmdsize dd .end - .cmd
.segname db "__TEXT", 10 dup 0
.vmaddr dq mach_header
.vmsize dq 0x1000000 ; (end_of_program - mach_header)
.fileoff dq 0
.filesize dq end_of_text - mach_header
.maxprot dd 0x7 ; RWX
.initprot dd 0x7 ; RWX
.nsects dd 0
.flags dd 0
.end:
mach_cmd_unixthread:
.cmd dd 0x5
.cmdsize dd .end - .cmd
.thrdstate dd 0x4
.exncount dd 42
.regs dq 16 dup 0
.rip dq _main
.rflags dq 0
.cs dq 0
.fs dq 0
.gs dq 0
.end:
mach_cmds_end:
_main:
mov dword [.scary], 0x00002ABF ; mov edi, 42
mov eax, 0x2000001 ; SYS_EXIT
.scary db 0,0,0,0,0
syscall
end_of_text:
align 0x1000
end_of_program:
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment