search

arandomdev / DyldExtractor

Extract Binaries from Apple's Dyld Shared Cache
MIT License
404 stars 40 forks source link

iOS 14.3 Sharedcache does not work #13

Closed cfossace closed 3 years ago

cfossace commented 3 years ago

Describe the bug Using dyldsharedcache of iOS 14.3, from iPhone 11, unable to extract framework. Note, this is arm64e

The framework is unable to be extracted. The error message is as follows: $ python extractor.py -f SPFinder ./dyld_shared_cache_arm64e Extracting SPFinder 16:59:43:074 Structure.py [CRITICAL] : Structure.parse offset is negative Traceback (most recent call last): File "/iphone11-ios14.3/extractor.py", line 150, in <module> extractImage(dyldFile, dyldFile.images[targetImageData[0]], "binaries\\"+targetImageData[1]) File "/iphone11-ios14.3/extractor.py", line 74, in extractImage Converter.ObjCConverter(machoFile, dyld).convert() File "/iphone11-ios14.3/DyldExtractor/Converter/ObjCConvertor.py", line 70, in convert self.processSegments() File "/iphone11-ios14.3/DyldExtractor/Converter/ObjCConvertor.py", line 149, in processSegments self.processClassData(classObj.data) File "/iphone11-ios14.3/DyldExtractor/Converter/ObjCConvertor.py", line 225, in processClassData self.processMethodList(classData.baseMethods) File "/iphone11-ios14.3/DyldExtractor/Converter/ObjCConvertor.py", line 244, in processMethodList methList = ObjC.method_list_t.parse(self.dyldFile.file, methListOff, methListPtr) File "/iphone11-ios14.3/DyldExtractor/ObjC.py", line 177, in parse inst = super().parse(buffer, fileOffset, method_t, 0xffff0003, loadData=loadData) File "/iphone11-ios14.3/DyldExtractor/ObjC.py", line 95, in parse inst = super().parse(buffer, fileOffset, loadData=loadData) File "/iphone11-ios14.3/DyldExtractor/Structure.py", line 85, in parse buffer.seek(offset) OSError: [Errno 22] Invalid argument

To Reproduce

  1. iOS 14.3
  2. iPhone 11 12,1
  3. python extractor.py -f SPFinder ./dyld_shared_cache_arm64e (it seems like all of the frameworks are failing)

Additional context This is arm64e instead of arm64 maybe that means something

arandomdev commented 3 years ago

arm64e is really really broken. I know this isn't exactly a fix but can you try it with an arm64 cache?

cfossace commented 3 years ago

So, arm64 from an iPhone 7 on iOS 14.4 works. The problem is, I need to do this on the iPhone 11, so I need it to work for ARM64e lol

cfossace commented 3 years ago

jtool and jtool2 also do not work on this :(

arandomdev commented 3 years ago

I'm working on the 3rd rework of this tool that should do a better job on arm64e. Assuming that this will be used for disassembly, changes across devices shouldn't be too bad...

Also just to let you know, libraries extracted from this tool will not run on a device, they can only be used for reverse engineering.

cfossace commented 3 years ago

It seems like it affects extracting all shared libraries (dylibs) and frameworks. They seem to have different error messages too. Looking forward to the arm64e release :) Let me know if you need any more info or tests

arandomdev commented 3 years ago

Hey! Version 3 is out, let me know how it goes.