0

I disassembled some OS X apps with Hopper and found that all of them contain a lot of zero bytes in a row. What is the use of that?

Is this some OS X ABI specific padding I came across here? What is its use?

enter image description here

1
  • 2
    Padding of a disk or memory page? At what number do these runs of zeroes end? – Jongware Nov 17 '14 at 21:44
1

Memory is mapped in pages, so if you want data that isn't page-aligned in memory, there'll be a world of either random data (in the case that pages were mapped without zeroing enabled, possible on some platforms) or zeros. From the address I'd say that hopper has identified that your executable has sections that will load at a given address but that the remainder of the page will be zeros. If there is data after it but before the end of the page then it's a buffer, could be used for runtime decryption or anything else in fact.

1
  • To work it out, look at the virtual memory map for that region, then if it's an executable section look at the size of that section and the base address to see if it's just empty space. Regular compiler wont use that space but nothing to stop you. – offbyseveral Nov 24 '14 at 17:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.