0

When I open an executable (a.out), I can see header info: enter image description here

But when I load an object file, headers and segments aren't loaded:

enter image description here

The entire header section is skipped. It goes directly to main (starts at 55 48...)

Here's hexdump of the .o file:

00000000  cf fa ed fe 07 00 00 01  03 00 00 00 01 00 00 00
00000010  04 00 00 00 50 02 00 00  00 20 00 00 00 00 00 00
00000020  19 00 00 00 d8 01 00 00  00 00 00 00 00 00 00 00
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
00000040  c0 00 00 00 00 00 00 00  70 02 00 00 00 00 00 00
00000050  c0 00 00 00 00 00 00 00  07 00 00 00 07 00 00 00
00000060  05 00 00 00 00 00 00 00  5f 5f 74 65 78 74 00 00
00000070  00 00 00 00 00 00 00 00  5f 5f 54 45 58 54 00 00
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
00000090  3b 00 00 00 00 00 00 00  70 02 00 00 04 00 00 00
000000a0  30 03 00 00 04 00 00 00  00 04 00 80 00 00 00 00
000000b0  00 00 00 00 00 00 00 00  5f 5f 64 61 74 61 00 00
000000c0  00 00 00 00 00 00 00 00  5f 5f 44 41 54 41 00 00
000000d0  00 00 00 00 00 00 00 00  3b 00 00 00 00 00 00 00
000000e0  04 00 00 00 00 00 00 00  ab 02 00 00 00 00 00 00
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
00000100  00 00 00 00 00 00 00 00  5f 5f 63 73 74 72 69 6e
00000110  67 00 00 00 00 00 00 00  5f 5f 54 45 58 54 00 00
00000120  00 00 00 00 00 00 00 00  3f 00 00 00 00 00 00 00
00000130  1f 00 00 00 00 00 00 00  af 02 00 00 00 00 00 00
00000140  00 00 00 00 00 00 00 00  02 00 00 00 00 00 00 00
00000150  00 00 00 00 00 00 00 00  5f 5f 63 6f 6d 70 61 63
00000160  74 5f 75 6e 77 69 6e 64  5f 5f 4c 44 00 00 00 00
00000170  00 00 00 00 00 00 00 00  60 00 00 00 00 00 00 00
00000180  20 00 00 00 00 00 00 00  d0 02 00 00 03 00 00 00
00000190  50 03 00 00 01 00 00 00  00 00 00 02 00 00 00 00
000001a0  00 00 00 00 00 00 00 00  5f 5f 65 68 5f 66 72 61
000001b0  6d 65 00 00 00 00 00 00  5f 5f 54 45 58 54 00 00
000001c0  00 00 00 00 00 00 00 00  80 00 00 00 00 00 00 00
000001d0  40 00 00 00 00 00 00 00  f0 02 00 00 03 00 00 00
000001e0  00 00 00 00 00 00 00 00  0b 00 00 68 00 00 00 00
000001f0  00 00 00 00 00 00 00 00  24 00 00 00 10 00 00 00
00000200  00 0d 0a 00 00 00 00 00  02 00 00 00 18 00 00 00
00000210  58 03 00 00 03 00 00 00  88 03 00 00 14 00 00 00
00000220  0b 00 00 00 50 00 00 00  00 00 00 00 00 00 00 00
00000230  00 00 00 00 02 00 00 00  02 00 00 00 01 00 00 00
00000240  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
*
00000270  55 48 89 e5 48 83 ec 10  48 8d 3d 30 00 00 00 c7
00000280  45 fc 00 00 00 00 b0 00  e8 00 00 00 00 48 8d 3d
00000290  2a 00 00 00 89 45 f8 b0  00 e8 00 00 00 00 31 c9
000002a0  89 45 f4 89 c8 48 83 c4  10 5d c3 4b 45 4b 00 68
000002b0  65 6c 6c 6f 20 66 72 6f  6d 20 6d 61 63 00 68 65
000002c0  6c 6c 6f 20 66 72 6f 6d  20 6d 61 63 32 00 00 00

Edit

The same thing happens when I open a Windows executable (a.exe), not a Mach-O. Why does IDA skip headers?

1 Answer 1

1

By default IDA skips "unimportant" parts which are unlikely to contain code. Mach-O is actually a sort of an exception in that the header is loaded by default (although collapsed).

Sometimes you can decide which parts to load by checking [x] Manual Load in the initial load dialog.

1
  • Thanks. So I checked Manual Load, and it asked about loading segment 0, and that's it. Still no header. When I load a Mach-O a.out file, there's a HEADER field in the "segments" view.
    – Alex
    Mar 6, 2019 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.