arandomdev / DyldExtractor

Extract Binaries from Apple's Dyld Shared Cache
MIT License
404 stars 40 forks source link

Is the tool support MacOS? #33

Closed lich4 closed 2 years ago

lich4 commented 2 years ago

Is the tool support MacOS? And will it support macos in the future? It show errors on my MacOS 11.6 when try to extract /System/Library/dyld/dyld_shared_cache_x86_64

Extracting /System/Library/PrivateFrameworks/DiskImages.framework/Versions/A/DiskImages 14:28:52:572 [ ERROR ] linkedit_optimizer.py:264 : Unable to get local symbol entries structure. 14:28:53: 55 [ WARNING ] stub_fixer.py:1156 : Unable to symbolize pointer at 0x7fff81a74520, with indirect entry index 0x242, with target function 0x0 14:28:53: 55 [ WARNING ] stub_fixer.py:1156 : Unable to symbolize pointer at 0x7fff81a745d8, with indirect entry index 0x259, with target function 0x61a7c588 14:28:53: 55 [ WARNING ] stub_fixer.py:1156 : Unable to symbolize pointer at 0x7fff81a745e0, with indirect entry index 0x25a, with target function 0x61a7c7b0 14:28:53: 55 [ WARNING ] stub_fixer.py:1156 : Unable to symbolize pointer at 0x7fff81a74638, with indirect entry index 0x265, with target function 0x61a86620 14:28:53: 58 [ WARNING ] stub_fixer.py:1233 : Unknown stub helper format at 0x7fff33001c9c 14:28:53: 58 [ WARNING ] stub_fixer.py:1233 : Unknown stub helper format at 0x7fff33001ca8 .................. 14:28:53: 72 [ WARNING ] stub_fixer.py:1233 : Unknown stub helper format at 0x7fff330032f8 14:28:53: 78 [ WARNING ] stub_fixer.py:1392 : Unknown stub format at 0x7fff33000ef8 14:28:53: 78 [ WARNING ] stub_fixer.py:1392 : Unknown stub format at 0x7fff33000efe ........... 14:28:53:115 [ WARNING ] stub_fixer.py:1392 : Unknown stub format at 0x7fff33001c7e 14:28:53:336 [ WARNING ] objc_fixer.py:638 : Class pointer at 0x7fff81a85678 points to class outside MachO file. 14:28:53:336 [ WARNING ] objc_fixer.py:650 : Category pointer at 0x7fff81a85680 points to category outside MachO file. 14:28:53:337 [ WARNING ] objc_fixer.py:650 : Category pointer at 0x7fff81a85688 points to category outside MachO file. 14:28:53:337 [ WARNING ] objc_fixer.py:662 : Protocol pointer at 0x7fff81a85690 points to protocol outside MachO file. 14:28:53:337 [ WARNING ] objc_fixer.py:662 : Protocol pointer at 0x7fff81a85698 points to protocol outside MachO file. 14:28:53:337 [ WARNING ] objc_fixer.py:662 : Protocol pointer at 0x7fff81a856a0 points to protocol outside MachO file. 14:28:53:337 [ WARNING ] objc_fixer.py:662 : Protocol pointer at 0x7fff81a856a8 points to protocol outside MachO file. 14:28:53:337 [ WARNING ] objc_fixer.py:662 : Protocol pointer at 0x7fff81a856b0 points to protocol outside MachO file. ObjC Fixer >> Processing Selector References :: [/] Traceback (most recent call last): File "/usr/local/bin/dyldex", line 273, in main() File "/usr/local/bin/dyldex", line 268, in main _extractImage(args.dyld_path, dyldCtx, imageMap[targetPaths[0]], outputPath) File "/usr/local/bin/dyldex", line 166, in _extractImage objc_fixer.fixObjC(extractionCtx) File "/usr/local/lib/python3.9/site-packages/DyldExtractor/converter/objc_fixer.py", line 1445, in fixObjC _ObjCFixer(extractionCtx).run() File "/usr/local/lib/python3.9/site-packages/DyldExtractor/converter/objc_fixer.py", line 447, in run self._processSections() File "/usr/local/lib/python3.9/site-packages/DyldExtractor/converter/objc_fixer.py", line 676, in _processSections struct.pack("<Q", newPtr) struct.error: required argument is not an integer

arandomdev commented 2 years ago

This tool does not support macOS caches and most likely never will, unfortunately. The main goal for this project was to extract from arm64 iOS caches.

DimitarNestorov commented 2 years ago

Found another tool that works with macOS caches: dyld-shared-cache-extractor However it doesn't seem to extract as much information as DyldExtractor when running against the same iOS 12.5.5 cache.

DyldExtractor dyld-shared-cache-extractor
image image
arandomdev commented 2 years ago

Yep, that tool actually uses a tool in dyld's source code. It only pulls out debug symbols for XCode.