===[ Smallest ELF64 binary ]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Lately I was inspired by reading how to create the smallest ELF32 binary [ref1] and I wanted to learn how to do something similar but for ELF64 binary on x86-64 architecture. It is actually not that difficult if you have the specification [ref2],[ref3] and a good assembler (it is even easy to do it by hand, but it is needlessly error prone).

===[ How to construct ELF64 binary ]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

If we want to create a more or less general ELF64 binary, there are two mandatory ELF64 headers, we must use: 1. 'Elf64_Ehdr' which has all the basic metadata like magic, offsets, type, ... 2. One entry of 'Elf64_Phdr' which tells the kernel loader that binary should be loaded into memory as an executable. Both of them are described in [ref2],[ref3] and if we look at their size, we can calculate the total size: Elf64_Ehdr + Elf64_Phdr = 64 + 56 = 120 Basic size will be at least 120 bytes long. Now the question is if we need more bytes for our program, or if we can "recycle" part of the header and keep the size at 120 bytes? If we look at 'Elf64_Ehdr' there is padding [1] which takes up to 7 bytes. We can use this for our code. Padding is reserved and should be ignored ([ref2],[ref3]). Now that we have some space, we can create a small program. 7 bytes is not much, but it should be enough to cleanly terminate our binary. We can do this by syscall 'exit(2)'. This syscall (or its variant 'exit_group(2)') is called at the end of any correctly finished application. It takes only one argument and most importantly it will gracefully end the program without abnormal termination by kernel (SIGSEGV, SIGBUS, and so on). A big limitation is that we have only 7 bytes to work with [1], so we need to cut some corners, don't we? My working version was that I sacrificed an exit value. The problem was that the exit was not so graceful. It basically exited with a random exit value. The code looked like this: -----------------------------------[ code ]------------------------------------
B83C000000        mov eax,0x3c
0F05              syscall
------------------------------------------------------------------------------- We can see, that an opcode for 'mov' into 64-bit/32-bit register is rather big. 5 bytes to be precise and with 2 bytes from 'syscall' opcode it totals to 7 bytes, which is exactly the size of 'e_ident[EI_PAD]'. That is nice, but we can create an equivalent piece of code that is 1 byte smaller: -----------------------------------[ code ]------------------------------------
31C0              xor eax,eax
B03C              mov al,0x3c
0F05              syscall
------------------------------------------------------------------------------- One byte is not enough, but if we steal 1 byte from 'e_ident[EI_ABIVERSION]' which is also reserved/unused, we have 2 bytes and there is enough space for the opcodes which allow us to control the argument for 'exit(2)' (which is loaded from 'RDI' register). We have two nice possibilities: -----------------------------------[ code ]------------------------------------
31FF              xor edi,edi     ; rdi = 0
89C7              mov edi,eax     ; rdi = rax
------------------------------------------------------------------------------- In this particular example we are going to use 'mov edi,eax', because the exit value of 60 (0x3c) stands out more than zero.

===[ Full code ]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

(Real code starts at '_start' label and ends by 'syscall'.) ----------------------------[ smallest_elf64.asm ]-----------------------------
    org     0x0000000000400000
ehdr:                          ; Elf64_Ehdr
    db      0x7F, "ELF"        ;   e_ident[EI_MAG]
    db      2                  ;   e_ident[EI_CLASS]     = 64 bit ELF
    db      1                  ;   e_ident[EI_DATA]      = little endian
    db      1                  ;   e_ident[EI_VERSION]   = ELF version
    db      0                  ;   e_ident[EI_OSABI]     = SysV ABI
; Code:
    ;db      0                 ;   e_ident[EI_ABIVERSION] (undef in Linux)
    ;times   7                 ;   e_ident[EI_PAD]        <--  [1]
    ;mov     edi,  edi          ; RDI = 0         -> arg1 for exit
    xor     eax,  eax          ; RAX = 0
    mov     al,   0x3c         ; RAX = 0x3c = 60 -> 'exit()' syscall
    mov     edi,  eax          ; RDI = RAX = 60  -> arg1 for exit
; End of Code
    dw      2                  ;   e_type        = executable
    dw      0x3e               ;   e_machine     = x86-64
    dd      1                  ;   e_version     = ELF version
    dq      _start             ;   e_entry
    dq      phdr - $$          ;   e_phoff
    dq      0                  ;   e_shoff
    dd      0                  ;   e_flags
    dw      ehdr_size          ;   e_ehsize
    dw      phdr_size          ;   e_phentsize
    dw      1                  ;   e_phnum
    dw      0                  ;   e_shentsize
    dw      0                  ;   e_shnum
    dw      0                  ;   e_shstrndx
ehdr_size       equ     $ - ehdr
phdr:                              ; Elf64_Phdr
    dd      1                  ;   p_type     = PT_LOAD
    dd      0x05               ;   p_flags    = PF_X | PF_R = rx
    dq      0                  ;   p_offset
    dq      $$                 ;   p_vaddr
    dq      $$                 ;   p_paddr
    dq      file_size          ;   p_filesz
    dq      file_size          ;   p_memsz
    dq      0x200000           ;   p_align
phdr_size       equ     $ - phdr
file_size       equ     $ - $$
------------------------------------------------------------------------------- Time for the test: -----------------------------------[ code ]------------------------------------
$ nasm smallest_elf64.asm

$ ls -l ./smallest_elf64
-rwxr-xr-x 1 root root 120 2022-04-26 06:45:22 smallest_elf64*

$ strace ./smallest_elf64
execve("./smallest_elf64", ["./smallest_elf64"], 0x7ffdc97aad20 /* 44 vars */) = 0
exit(60)                                = ?
+++ exited with 60 +++

===[ Summary ]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The binary is theoretically 120 bytes long, but physically and logically it is always more than that. On disk it uses 'BLOCK-SIZE' space (in my case it is 4096 on ext4/xfs). And in memory it uses 'PAGE-SIZE' size (which is also 4096 bytes on x86-64).

===[ References ]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[ref1] https://www.muppetlabs.com/~breadbox/software/tiny/teensy.html [ref2] https://www.man7.org/linux/man-pages/man5/elf.5.html [ref3] https://refspecs.linuxbase.org/elf/elf.pdf