A segment is a run of the file mapped into memory with one protection. A section is
a named part of a segment with one kind of content. LC_SEGMENT_64 and
LC_SEGMENT each describe one segment and, straight after it, the records
of its sections.
segment_command and segment_command_64
| 32-bit offset | 64-bit offset | Field | Meaning |
|---|---|---|---|
| 0 | 0 | cmd | 1 (LC_SEGMENT) or 0x19 (LC_SEGMENT_64). |
| 4 | 4 | cmdsize | Including the section records. |
| 8 | 8 | segname | 16 bytes: the segment’s name, padded with zeros. |
| 24 | 24 | vmaddr | Its address in memory (4 or 8 bytes). |
| 28 | 32 | vmsize | Its size in memory. Above filesize, the rest is zero-filled on demand. |
| 32 | 40 | fileoff | File offset of its data. |
| 36 | 48 | filesize | How many bytes come from the file. |
| 40 | 56 | maxprot | The maximum protection: 1 read, 2 write, 4 execute. |
| 44 | 60 | initprot | The protection it starts with. |
| 48 | 64 | nsects | How many section records follow. |
| 52 | 68 | flags | Flags. |
In an executable the first mapped segment is __TEXT, and it includes
the Mach header and load commands at file offset 0. __PAGEZERO reserves
the low addresses with no data at all. __LINKEDIT, last, holds the symbol
table and the other tables the load commands point at. In an object file there is
one segment, usually with no name, holding every section.
Segment flags: 1 SG_HIGHVM (the file data is at the high end of
the segment), 2 SG_FVMLIB, 4 SG_NORELOC, 8 SG_PROTECTED_VERSION_1 (the segment is
protected, apart from the first page if it starts at offset 0), and
0x10 SG_READ_ONLY (read-only once its fixups have been applied).
section and section_64
| 32-bit offset | 64-bit offset | Field | Meaning |
|---|---|---|---|
| 0 | 0 | sectname | 16 bytes: the section’s name. |
| 16 | 16 | segname | 16 bytes: the segment it goes in. |
| 32 | 32 | addr | Its address in memory. |
| 36 | 40 | size | Its size in bytes. |
| 40 | 48 | offset | File offset of its data. |
| 44 | 52 | align | Its alignment as a power of 2. |
| 48 | 56 | reloff | File offset of its relocation entries. |
| 52 | 60 | nreloc | Number of relocation entries. |
| 56 | 64 | flags | The section type (low byte) and attributes. |
| 60 | 68 | reserved1 | For pointer and stub sections, the first index in the indirect symbol table. |
| 64 | 72 | reserved2 | For a stubs section, the size of each stub. |
| – | 76 | reserved3 | 64-bit only. Reserved. |
A record is 68 bytes in a 32-bit file and 80 in a 64-bit one, where
addr and size are 8 bytes. In a dSYM file, sections outside
__DWARF keep their addresses and sizes but have file offset 0: their
contents are in the main binary.
Section types
| Value | Constant | Holds |
|---|---|---|
| 0 | S_REGULAR | Ordinary contents. |
| 1 | S_ZEROFILL | Zero-filled on demand; no file data. |
| 2 | S_CSTRING_LITERALS | Only zero-terminated strings. |
| 3 | S_4BYTE_LITERALS | 4-byte literals. |
| 4 | S_8BYTE_LITERALS | 8-byte literals. |
| 5 | S_LITERAL_POINTERS | Pointers to literals. |
| 6 | S_NON_LAZY_SYMBOL_POINTERS | Pointers filled before the code runs (__got). |
| 7 | S_LAZY_SYMBOL_POINTERS | Pointers filled on first use (__la_symbol_ptr). |
| 8 | S_SYMBOL_STUBS | Stubs that jump through a pointer; reserved2 is each stub’s size. |
| 9 | S_MOD_INIT_FUNC_POINTERS | Functions to run at load. |
| 10 | S_MOD_TERM_FUNC_POINTERS | Functions to run at exit. |
| 11 | S_COALESCED | Contents to be coalesced by the linker. |
| 12 | S_GB_ZEROFILL | Zero fill that can pass 4 GB. |
| 13 | S_INTERPOSING | Pairs of function pointers for interposing. |
| 14 | S_16BYTE_LITERALS | 16-byte literals. |
| 15 | S_DTRACE_DOF | DTrace object format data. |
| 16 | S_LAZY_DYLIB_SYMBOL_POINTERS | Lazy pointers to lazily loaded libraries. |
| 17 | S_THREAD_LOCAL_REGULAR | Initial values of thread-local variables. |
| 18 | S_THREAD_LOCAL_ZEROFILL | Zero-initialised thread-local variables. |
| 19 | S_THREAD_LOCAL_VARIABLES | TLV descriptors: thunk, key and offset (pointers). |
| 20 | S_THREAD_LOCAL_VARIABLE_POINTERS | Pointers to TLV descriptors. |
| 21 | S_THREAD_LOCAL_INIT_FUNCTION_POINTERS | Functions that initialise thread-local variables. |
| 22 | S_INIT_FUNC_OFFSETS | 32-bit offsets to initialisers, from the image base. |
Section attributes
| Bit | Constant | Meaning |
|---|---|---|
0x80000000 | S_ATTR_PURE_INSTRUCTIONS | Only machine instructions. |
0x40000000 | S_ATTR_NO_TOC | Coalesced symbols not to be in a ranlib table of contents. |
0x20000000 | S_ATTR_STRIP_STATIC_SYMS | Static symbols may be stripped. |
0x10000000 | S_ATTR_NO_DEAD_STRIP | Never dead strip. |
0x08000000 | S_ATTR_LIVE_SUPPORT | Live if it refers to live blocks. |
0x04000000 | S_ATTR_SELF_MODIFYING_CODE | i386 stubs written by dyld. |
0x02000000 | S_ATTR_DEBUG | Debug section (usually DWARF). |
0x00000400 | S_ATTR_SOME_INSTRUCTIONS | Some machine instructions. |
0x00000200 | S_ATTR_EXT_RELOC | Has external relocation entries. |
0x00000100 | S_ATTR_LOC_RELOC | Has local relocation entries. |
Common sections
| Name | Holds |
|---|---|
__TEXT,__text | The program’s code. |
__TEXT,__stubs, __auth_stubs | Stubs for imported functions. |
__TEXT,__stub_helper | Code for lazy binding. |
__TEXT,__cstring | C strings. |
__TEXT,__const | Constant data. |
__TEXT,__objc_methname, __objc_classname, __objc_methtype | Objective-C strings. |
__TEXT,__unwind_info | Compact unwind tables. |
__TEXT,__eh_frame | DWARF call frame information. |
__DATA,__data, __bss, __common | Variables. |
__DATA,__la_symbol_ptr | Lazy symbol pointers. |
__DATA_CONST,__got, __auth_got | Global offset table: pointers to imports. |
__DATA_CONST,__mod_init_func | C++ constructors to run at load. |
__DATA,__objc_* | Objective-C metadata. |
__LD,__compact_unwind | Compact unwind records, in object files. |
__DWARF,__debug_* | DWARF debugging data, in dSYM files and object files. |