Editing an ELF executable to reduce it's size - linux

Question

I'm trying to drop a C program down to a size < 1kb. I'm getting close, but I'm stuck on editing my ELF executable. My program, main.c looks like:
#include<unistd.h>
#include<sys/syscall.h>
void _start() {
const char msg [] = "Hello World!";
syscall(SYS_write, 0, msg, sizeof(msg)-1);
syscall(SYS_exit, 0);
}
I'm compiling it with
gcc -nostdlib -s -O3 -o main main.c /usr/lib/path/to/libc.a
Then I strip it. But If I did an objdump on it before stripping it I see
main: file format elf64-x86-64
SYMBOL TABLE:
0000000000400158 l d .note.gnu.build-id 0000000000000000 .note.gnu.build-id
0000000000400180 l d .text 0000000000000000 .text
0000000000400214 l d .eh_frame_hdr 0000000000000000 .eh_frame_hdr
0000000000400238 l d .eh_frame 0000000000000000 .eh_frame
0000000000601000 l d .tbss 0000000000000000 .tbss
0000000000000000 l d .comment 0000000000000000 .comment
0000000000000000 l df *ABS* 0000000000000000 main.c
0000000000000000 l df *ABS* 0000000000000000
00000000004001d0 g F .text 0000000000000026 syscall
0000000000000000 g .tbss 0000000000000004 errno
0000000000400203 g .text 0000000000000000 __syscall_error_1
0000000000400180 g F .text 0000000000000048 _start
0000000000000000 g .tbss 0000000000000004 __libc_errno
0000000000400200 g F .text 0000000000000013 __syscall_error
0000000000601000 g .eh_frame 0000000000000000 __bss_start
0000000000601000 g .eh_frame 0000000000000000 _edata
0000000000000000 *UND* 0000000000000000 _GLOBAL_OFFSET_TABLE_
0000000000601000 g .eh_frame 0000000000000000 _end
It seems like there's some stuff I can remove to manually reduce the size of the executable? note: I know this is not something I'd actually do, but I'm simply trying to remove any boilerplate existing.
What would I remove from the executable, main, to reduce it's size? And how could I do that?
side note: I've already read this and this article. No need to link them. I am purposely choosing to stay with C

Answer 1

Simple stuff
You can remove quite a few useless bits with:
-fno-asynchronous-unwind-tables -Qn;
using a custom linker script -rlinker_script.
I get a working binary of 992 bytes with this (after strip).
Linker script
Let's look at the sections (before stripping):
[Nr] Name Type Address Offset
Size EntSize Flags Link Info Align
[ 0] NULL 0000000000000000 00000000
0000000000000000 0000000000000000 0 0 0
[ 1] .note.gnu.build-i NOTE 0000000000400120 00000120
0000000000000024 0000000000000000 A 0 0 4
[ 2] .text PROGBITS 0000000000400150 00000150
0000000000000090 0000000000000000 AX 0 0 16
[ 3] .eh_frame PROGBITS 00000000004001e0 000001e0
0000000000000048 0000000000000000 A 0 0 8
[ 4] .tbss NOBITS 0000000000601000 00000228
0000000000000004 0000000000000000 WAT 0 0 4
[ 5] .shstrtab STRTAB 0000000000000000 000003e7
0000000000000044 0000000000000000 0 0 1
[ 6] .symtab SYMTAB 0000000000000000 00000228
0000000000000168 0000000000000018 7 6 8
[ 7] .strtab STRTAB 0000000000000000 00000390
0000000000000057 0000000000000000
From program header 5, everything is stripped but we gave two comparatively useless sections which are not stripped: .note.gnu.build-id and .eh_frame. The .eh_frame was disabled in the compiler but some .eh_frame is contributed from the static libc.
We can completely get rid of the .eh_frame and .note.gnu.build-id sections with a custom linker script (gcc -T linker_script).
First, we get the default linker script:
gcc test.c -Wl,--verbose
We remove those lines:
.eh_frame_hdr : { *(.eh_frame_hdr) *(.eh_frame_entry .eh_frame_entry.*) }
.eh_frame : ONLY_IF_RO { KEEP (*(.eh_frame)) *(.eh_frame.*) }
.note.gnu.build-id : { *(.note.gnu.build-id) }
and modify this line:
/DISCARD/ : { *(.note.GNU-stack) *(.gnu_debuglink) *(.gnu.lto_*) *(.note.gnu.build-id) *(.eh_frame_hdr) *(.eh_frame_entry .eh_frame_entry.*) *(.eh_frame) *(.eh_frame.*) }
I get 664 bytes using this.
Additional options
Other solutions for a reduced size:
optimize for size (-Os);
32 bit compilation (-m32).
With all of this, I get a binary with 760 bytes without the custom linker script and 488 bytes with the modified linker script.
Get rid of errno
There are quite few "useless" things remaining (such as errno handling and the TLS) that could be removed.
[Nr] Name Type Addr Off Size ES Flg Lk Inf Al
[ 0] NULL 00000000 000000 000000 00 0 0 0
[ 1] .text PROGBITS 080480a0 0000a0 00008e 00 AX 0 0 16
[ 2] .tbss NOBITS 08049130 000130 000004 00 WAT 0 0 4
[ 3] .shstrtab STRTAB 00000000 000257 000027 00 0 0 1
[ 4] .symtab SYMTAB 00000000 000130 0000d0 10 5 4 4
[ 5] .strtab STRTAB 00000000 000200 000057 00 0 0 1
(Everything beginning with section 3 is stripped.)
By writing our own syscall code we could get rid of errno handling. We would remove:
4 bytes of .symtab;
errno related instructions.
But doing this involves using (inline) assembly.