dyld_cache_extract icon indicating copy to clipboard operation
dyld_cache_extract copied to clipboard

Published 20 hours ago • verified publisher icon macmade

iOS 10.2 support

Open malhal opened this issue 7 years ago • 3 comments

Opening dyld_shared_cache_armv7s from iOS 10.2 (copied using iExplorer) in the GUI and exporting NotesShared framework gave a 561.MB NotesShared file so obviously something has gone wrong.

malhal avatar Mar 06 '17 12:03 malhal

Yes, I'm aware of this kind of issue, but the extracted file should be fine, event if larger than expected.

This is because the __LINKEDIT segment is shared by all images in the shared cache, and placed at the very end of the cache file.

So one would need to reconstruct/relink the extracted MachO file, and adjust the offsets of the concerned segments to a new __LINKEDIT segment.
Pretty boring...

I unfortunately had no time for it, so I'm actually extracting all the data until the __LINKEDIT segment, thus producing a very large file...

Not a neat solution, I know, but this should work at least...

macmade avatar Mar 06 '17 19:03 macmade

Thanks for the explanation. The file has another issue that all methods appear as redacted, a possible solution is here that could be integrated.

malhal avatar Mar 07 '17 00:03 malhal

Yep, but not sure I'll have enough time to look at this right now...
Maybe wait for iOS 11... ; )

macmade avatar Mar 07 '17 22:03 macmade

Closing as the project is now obsolete.
Please take a look at https://github.com/macmade/dyld-cache-dump

macmade avatar Jun 12 '23 18:06 macmade