FreedomCoder Information for free-minded geeks

strip binary executables in OSX

While doing some vulnerability research on some of the default OSX binary files, I run into the issue that a lot of the binaries are universal and contain i386, x86_64 and/or ppc.

For example, let us take the default installed app bash

So I wanted to debug an application in order to see where it was overflowing, but I only wanted to concentrate on the 32 bit architecture.  So I started wondering how could I force the application to run in 32 bit mode.  After some googleing and looking through the osx documentation. I found that there are a few commands just for that.

ARCH
This command will let you run an application on on one or more specific architectures.

For example if we want to run bash in 32bit:
$ arch -i386 /bin/bash

Now, what if we want to always use a binary in 386 mode. arch is not really helpful or what if we want another executable that only contained the i386 architecture code. Here is when lipo comes into play.

LIPO

This command will allow us to create a binary file containing only the desired architectures.
$ lipo -thin i386 /bin/bash -output /bin/bash.i386

Now if we we check the bash.i386 file it will only contain the 386 architecture binary information.

I guess this might be common knowledge to a lot of people, but It was really helpful for me and hopefully to anyone who was not yet aware of this two helpful commands.

Enjoy.