Skip to content

Instantly share code, notes, and snippets.

@niw
Last active January 25, 2023 15:39
Show Gist options
  • Save niw/62d2de05b9aa4183ae78292344d0719f to your computer and use it in GitHub Desktop.
Save niw/62d2de05b9aa4183ae78292344d0719f to your computer and use it in GitHub Desktop.
How to extract dylib from shared cache

How to extract dylib from shared cache

To understand iOS behaviors, sometimes it’s important to disassemble iOS framework binaries.

Since recent iOS firmware, known as .ipsw file, contains non-encrypted root image, it’s easy to access these binaries. However, each framework binaries, dylib files, are placed in a shared cache file.

Thus, before disassembling it, we need to extract the one from the cache.

Build dsc_extractor

Apple provides dsc_extractor command line tool in their dyld open source project.

  1. Download CommonCrypt and dyld from Apple Opensource.
  2. Unpack these source files in flat.
  3. Prepare CommonCrypt private header in structure, such as
    $ mkdir -p include/CommonCrypt
    $ cd include/CommonCrypt
    $ ln -s ../../CommonCrypt-*/include/*.h .
    $ ln -s ../../CommonCrypt-*/include/Private*.h .
    
  4. Move to dyld-*/launch-cache.
  5. Patch dsc_extractor.cpp to have main.
    --- dsc_extractor.cpp.orig	2019-05-23 12:13:22.000000000 -0700
    +++ dsc_extractor.cpp	2019-05-23 12:13:36.000000000 -0700
    @@ -908,7 +908,7 @@
     }
    
    
    -#if 0
    +#if 1
     // test program
     #include <stdio.h>
     #include <stddef.h>
    
  6. Run clang++ to build.
    $ clang++ -std=c++17 -I../dyld3 -I../dyld3/shared-cache -I../../include -o dsc_extractor dsc_extractor.cpp dsc_iterator.cpp
    

Usage

Unzip .ipsw file, and locate /System/Library/Caches/com.apple.dyld/dyld_shread_cache_arm64.

Then use it with dsc_extractor to extract dylib files from the cache.

$ dsc_extractor <path/to/dyld_shread_cache_arm64> ./
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment