title: Editing an ELF executable to reduce it's size
body: <p>I'm trying to drop a C program down to a size &lt; 1kb. I'm getting close, but I'm stuck on editing my ELF executable. My program, <code>main.c</code> looks like:</p>
  
  <pre><code>#include&lt;unistd.h&gt;
  #include&lt;sys/syscall.h&gt;
  
  void _start() {
      const char msg [] = "Hello World!";
      syscall(SYS_write, 0, msg, sizeof(msg)-1);
      syscall(SYS_exit, 0);
  }
  </code></pre>
  
  <p>I'm compiling it with</p>
  
  <p><code>gcc -nostdlib -s -O3 -o main main.c /usr/lib/path/to/libc.a</code></p>
  
  <p>Then I <code>strip</code> it. But If I did an objdump on it before stripping it I see</p>
  
  <p>main:     file format elf64-x86-64</p>
  
  <pre><code>SYMBOL TABLE:
  0000000000400158 l    d  .note.gnu.build-id     0000000000000000 .note.gnu.build-id
  0000000000400180 l    d  .text  0000000000000000 .text
  0000000000400214 l    d  .eh_frame_hdr  0000000000000000 .eh_frame_hdr
  0000000000400238 l    d  .eh_frame      0000000000000000 .eh_frame
  0000000000601000 l    d  .tbss  0000000000000000 .tbss
  0000000000000000 l    d  .comment       0000000000000000 .comment
  0000000000000000 l    df *ABS*  0000000000000000 main.c
  0000000000000000 l    df *ABS*  0000000000000000
  00000000004001d0 g     F .text  0000000000000026 syscall
  0000000000000000 g       .tbss  0000000000000004 errno
  0000000000400203 g       .text  0000000000000000 __syscall_error_1
  0000000000400180 g     F .text  0000000000000048 _start
  0000000000000000 g       .tbss  0000000000000004 __libc_errno
  0000000000400200 g     F .text  0000000000000013 __syscall_error
  0000000000601000 g       .eh_frame      0000000000000000 __bss_start
  0000000000601000 g       .eh_frame      0000000000000000 _edata
  0000000000000000         *UND*  0000000000000000 _GLOBAL_OFFSET_TABLE_
  0000000000601000 g       .eh_frame      0000000000000000 _end
  </code></pre>
  
  <p>It seems like there's some stuff I can remove to manually reduce the size of the executable? <strong>note</strong>: I know this is not something I'd <em>actually</em> do, but I'm simply trying to remove any boilerplate existing. </p>
  
  <p>What would I remove from the executable, <code>main</code>, to reduce it's size? And how could I do that?</p>
  
  <p>side note: I've already read <a href="https://blogs.oracle.com/ksplice/entry/hello_from_a_libc_free" rel="nofollow">this</a> and <a href="http://www.muppetlabs.com/~breadbox/software/tiny/teensy.html" rel="nofollow">this</a> article. No need to link them. I am purposely choosing to stay with C</p>