I disassembled some OS X apps with Hopper and found that all of them contain a lot of zero bytes in a row. What is the use of that?
Is this some OS X ABI specific padding I came across here? What is its use?
1
-
2Padding of a disk or memory page? At what number do these runs of zeroes end?– JongwareNov 17, 2014 at 21:44
Add a comment
|
1 Answer
Memory is mapped in pages, so if you want data that isn't page-aligned in memory, there'll be a world of either random data (in the case that pages were mapped without zeroing enabled, possible on some platforms) or zeros. From the address I'd say that hopper has identified that your executable has sections that will load at a given address but that the remainder of the page will be zeros. If there is data after it but before the end of the page then it's a buffer, could be used for runtime decryption or anything else in fact.
-
To work it out, look at the virtual memory map for that region, then if it's an executable section look at the size of that section and the base address to see if it's just empty space. Regular compiler wont use that space but nothing to stop you. Nov 24, 2014 at 17:45