A CLI for extracting libraries from Apple's dyld shared cache file

Last update: Dec 18, 2022

Related tags

Overview

dyld-shared-cache-extractor

As of macOS Big Sur, instead of shipping the system libraries with macOS, Apple ships a generated cache of all built in dynamic libraries and excludes the originals. This tool allows you to extract these libraries from the cache for reverse engineering.

Usage

Extract the default shared cache to /tmp/libraries:

dyld-shared-cache-extractor /System/Library/dyld/dyld_shared_cache_arm64e /tmp/libraries

Installation

Homebrew:

brew install keith/formulae/dyld-shared-cache-extractor

Manually:

cmake -B build
cmake --build build
cmake --install build

More details

There are a few different ways you can interact with these shared caches.

Depending on what you're doing inspecting them in Hopper is the easiest option
For a bit more functionality you can build the dyld_shared_cache_util target from the latest dyld source dump, but this requires some modifications

The problem with the 2 options above is that they can lag behind format changes in the shared cache. This tool loads the private dsc_extractor.bundle from Xcode, meaning it should always be able to extract the shared cache files even from beta OS versions (potentially using a beta Xcode version).

This logic is based on the function at the bottom of dyld3/shared-cache/dsc_extractor.cpp from the dyld source dump.

You might also like...

Windows Package Manager CLI (aka winget)

Welcome to the Windows Package Manager Client (aka winget.exe) repository This repository contains the source code for the Windows Package Manager Cli

18.4k Dec 27, 2022

CLI to play a word-guessing game like Wordle

Lexeme What is this? Python program to play a word-guessing game like Wordle, but… More addictive because you can play it over and over and over, not

6 Oct 26, 2022

This is a simple CLI interface helper library for C.

LIBCCLI This is a very simple shell like interface for CLI activities. More will be added to this, but for now, this is the basic idea:

40 Sep 24, 2022

A CLI program that helps you find classes and plan pre-requisites. Written in C++ and Python.

CourseHelper A CLI program created to help you prepare for course registration. Note: At the moment, this project is built specifically for other UCLA

0 Dec 13, 2022

CLI for single-cell analyses

CLI for single-cell analyses This repository provides a no-frills command-line interface for single-cell RNA-seq data analysis from a Matrix Market fi

2 Jan 28, 2022

A CLI based solver for the popular word guessing game WORDLE

Project WAR WAR stands for Wordle Answer and Resolver About Wordle is a web-based word game developed by Welsh-born software engineer Josh Wardle, for

2 Feb 19, 2022

n³ The unorthodox terminal file manager

15.5k Jan 1, 2023

A Windows Shell Extension for the Pixar USD file format.

Activision USD Shell Extension A Windows Shell Extension for the Pixar USD file format. Windows Explorer Features Hydra Realtime Preview Thumbnails Co

319 Dec 28, 2022

Yori is a CMD replacement shell that supports backquotes, job control, and improves tab completion, file matching, aliases, command history, and more.

1.1k Dec 30, 2022

Comments

macOS Ventura VM shared cache location
I'm not sure if this is a permanent change or just a VM detail, but I noticed in my macOS Ventura VM that the shared cache location is actually:

/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/...

There is also:

/System/Volumes/Preboot/Cryptexes/OS/System/DriverKit/System/Library/dyld/

Which seems to have a smaller subset of libraries potentially used at boot?

Just filing this in case others are looking for this info
opened by keith 5
Update paths for Ventura

This just puts the Ventura paths front and center and adds a note about the old paths below.

Fixes https://github.com/keith/dyld-shared-cache-extractor/issues/4

opened by keith 0
Invalid cache magic in file at dyld_shared_cache_arm64

I got this log when run dyld-shared-cache-extractor /Users/andaji/Mine/XiaoMaGe/iOSFramesMachO/dyld_shared_cache_arm64 /Users/andaji/Mine/XiaoMaGe/iOSFramesMachO/aaa

My Mac version is 12.3.1 with Apple M1 chip and my XCode version is 13.4.1. The dyld_shared_cache_arm64 is load from a iPhone 7 and it iOS version is 12.0.1

opened by jiwenyi163 1
How to get actual objc headers from the dump this tool produces?

This may be a noob question but I'm lost on how to parse the dump into a human-readable format, specifically into objc header files. As the README suggested, I ran dyld-shared-cache-extractor /System/Library/dyld/dyld_shared_cache_arm64e /tmp/libraries and it works great - gives me an output for all the frameworks I was expecting.

However when opening the file inside the framework, it appears to be encrypted or obfuscated in some way - the actual headers aren't readable. Is there some method I can use to read them? TIA!

opened by tneotia 1