NSO is the main executable format.
It starts with the "NSO" header and mainly describes .text, .rodata, and .data segments (like a short-form of ELF program headers):
SegmentHeader
Offset | Size | Description |
---|---|---|
0x0 | 4 | file offset of data |
0x4 | 4 | memory offset loaded to |
0x8 | 4 | size of data copied to memory offset (i.e. size after decompression) |
0xC | 4 | alignment used on memory size / size of .bss in the case of .data segment |
.rodata-relative extent
Offset | Size | Description |
---|---|---|
0x0 | 4 | offset (relative to .rodata) |
0x4 | 4 | size of region |
NSO Header
Offset | Size | Description |
---|---|---|
0x0 | 4 | Magic "NSO0" |
0x4 | 4 | |
0x8 | 4 | |
0xC | 4 | Always 0x3f? |
0x10 | 0x10 * 3 | SegmentHeader for each segment |
0x40 | 0x20 | Value of "build id" from ELF's GNU .note section. Contains variable sized digest, up to 32bytes. |
0x60 | 0x4 * 3 | file size of each segment (i.e. LZ4-compressed size) |
0x6c | 0x24 | Padding |
0x90 | 8 | .rodata-relative extents of .dynstr |
0x98 | 8 | .rodata-relative extents of .dynsym |
0xA0 | 0x20 * 3 | SHA256 hashes over the decompressed sections using the above byte-sizes: .text, .rodata, and .data. |
0x100 | Compressed sections |