dyldcache

Documentation

Overview

Package dyldcache reads Apple's dyld shared cache: the single large mapped image (split across a main file plus ".NN" subcache files) that macOS/iOS ship their system dylibs in instead of as standalone files on disk.

The reader is deliberately read-only and header-driven. It parses the cache header, the memory mappings, the subcache file list and the image (dylib) table, and exposes a virtual-address → bytes translation across every subcache file. That is enough to list the dylibs a cache contains and to locate an image's Mach-O header for further parsing, without reconstructing ("un-sharing") a standalone dylib — the expensive part exex does not need for browsing.

Field offsets follow include/mach-o/dyld_cache_format.h. The header has grown over many OS releases, so every field past the original core is read only when it lies within mappingOffset (the header's own length): older caches simply do not have the newer fields, and reading past mappingOffset would be garbage.

Index

• func HostCachePath(a string, exists func(string) bool) (string, bool)
• func IsCache(raw []byte) bool
• type Cache
  • func Open(path string) (*Cache, error)
  • func (c *Cache) BytesAt(addr uint64, n int) (data []byte, ok bool)
  • func (c *Cache) Close() error
  • func (c *Cache) ExtractImage(im Image) ([]byte, error)
  • func (c *Cache) FindImage(installPath string) (Image, bool)
  • func (c *Cache) SubCacheNames() []string
• type Image
• type Mapping

Functions

func HostCachePath

func HostCachePath(a string, exists func(string) bool) (string, bool)

HostCachePath locates the running system's dyld shared cache serving architecture a (a binfile/arch name like "arm64" or "amd64"; "" tries all).

func IsCache

func IsCache(raw []byte) bool

IsCache reports whether raw begins with the dyld shared cache magic.

Types

type Cache

type Cache struct {
	Arch     string // architecture from the magic, e.g. "arm64e"
	Mappings []Mapping
	Images   []Image
	// contains filtered or unexported fields
}

Cache is a parsed, read-only view of a dyld shared cache and its subcaches.

func Open

func Open(path string) (*Cache, error)

Open maps the shared cache at path and every subcache alongside it, then parses the header, mappings and image table. Close releases all mappings.

func (*Cache) BytesAt

func (c *Cache) BytesAt(addr uint64, n int) (data []byte, ok bool)

BytesAt returns up to n bytes starting at virtual address addr, resolving which subcache file backs it. ok is false when no mapping covers addr.

func (*Cache) Close

func (c *Cache) Close() error

Close releases every mapped cache file.

func (*Cache) ExtractImage

func (c *Cache) ExtractImage(im Image) ([]byte, error)

ExtractImage stitches the cache-resident dylib im into a standalone Mach-O image parseable by binfile.OpenBytes.

func (*Cache) FindImage

func (c *Cache) FindImage(installPath string) (Image, bool)

FindImage returns the cache image whose install path is installPath, falling back to a unique basename match (so "libSystem.B.dylib" finds "/usr/lib/libSystem.B.dylib").

func (*Cache) SubCacheNames

func (c *Cache) SubCacheNames() []string

SubCacheNames returns the file names of the main cache and every subcache, in File-index order.

type Image

type Image struct {
	Address uint64
	Path    string
}

Image is one dylib stored in the cache, named by its install path and located by the virtual address of its Mach-O header.

type Mapping

type Mapping struct {
	Address    uint64 // virtual address of the region's first byte
	Size       uint64 // region length in bytes
	FileOffset uint64 // byte offset of the region within File
	MaxProt    uint32
	InitProt   uint32
	File       int // index into Cache.files (0 = main cache file)
}

Mapping is one contiguous region of the shared cache: a run of virtual addresses backed by a byte range in file File.