What is this assembly in the `__common` section doing?

Question

I have stumbled upon this:

public _oret
__common:0000000100018000 _oret:                             

__common:0000000100018000 sub     [rdi+4Fh], al
__common:0000000100018003 db      4Fh
__common:0000000100018003 and     [rdi+4Fh], r10b
__common:0000000100018008 push    rdx
__common:0000000100018009 and     [r8], rsp
__common:000000010001800C db      40h, 46h, 43h
__common:000000010001800C xor     r14d, [r14]
__common:0000000100018012 xor     eax, 0A20h

What is this doing exactly? My RAX points here, but I don't understand anything about what the purpose of this is.

Answer 1

it is easily discoverable if you look at the bytes in a dump window or hex editor

or if you don't have the bytes but only the disassembly in text form you can use some assembler like keystone to assemble it and dump
the bytes as printable characters

C:\>cat ge0snow.py
from keystone import *
import binascii

code = [
    "sub [rdi+4Fh], al",
    "db 04Fh",
    "and [rdi+4Fh], r10b",
    "push rdx",
    "and [r8], rsp",
    "db 040h",
    "db 046h",
    "db 043h",
    "xor r14d, [r14]",
    "xor eax, 0A20h",
]
ks = Ks(KS_ARCH_X86,KS_MODE_64)
for i in range(0,len(code),1):
    if( code[i][:2] == "db"):
        print (binascii.a2b_hex(code[i][4:6])),
    else:
        foo = ks.asm(code[i])
        for j in foo[0]:
            print chr(int(j)),


C:\>python ge0snow.py
( G O O D   W O R I !   @ F C E 3 6 5

Answer 2

The __common section seems to be typical from Mach-O format. It contains uninitialized external globals, similar to static variables.

In your case, it holds a constant string as blabb showed it. But, you should better display it as a string (and not as code).

See: Overview of the Mach-O Executable Format, from the Apple "Introduction to Code Size Performance Guidelines".