CODEWITHSUNDEEP
mach-o
Bob5421
Bob5421

Reputation: 9113

How can i get mach-o executable entry point

I want to get the entry point address of a mach-o executable. I have read that otool (-l option) command is able to show us the mach-o entry point. I have tried but i do not see the entry point. I've tried both on 32 and 64 bits executable. If i print the address of main function, i see the 3 last digits are the same between 2 execution. But i see the other digits changing...

Upvotes: 3

Views: 2803

Answers (2)

user3064538
user3064538

Reputation:

otool calls it "entryoff", short for "entry offset" presumably. For example, I compiled curl on my M1 (i.e. ARM) Mac and ran this command:

$ otool -l src/curl | grep entry
  entryoff 83892

83892 is 0x147b4 in hexadecimal. Running

objdump -d --macho src/curl | less

and searching for "147b4", we find the _main function:

_main:
1000147b4:      ff 03 03 d1     sub     sp, sp, #192
1000147b8:      fd 7b 0b a9     stp     x29, x30, [sp, #176]
1000147bc:      fd c3 02 91     add     x29, sp, #176
1000147c0:      e8 03 01 aa     mov     x8, x1
[...]

Upvotes: 0

YeaTheMen
YeaTheMen

Reputation: 1083

Try Using "Hopper" application. This is very useful for displaying the Contents of a Mach-O executable and sections of its code. https://www.hopperapp.com

Upvotes: 0

Related Questions