Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Switch from objdump to dlopen on macOS BS to detect nested dependencies #2

Open
helje5 opened this issue Oct 3, 2020 · 3 comments
Open
Labels
enhancement New feature or request help wanted Extra attention is needed

Comments

@helje5
Copy link
Member

helje5 commented Oct 3, 2020

macOS BS has the "dyld shared cache" which breaks running objdump on the dependencies. E.g. this results in BS Safari not having any features detected.

$ otool -L /Applications/Safari.app/Contents/MacOS/Safari
/Applications/Safari.app/Contents/MacOS/Safari (architecture x86_64):
	/System/Library/PrivateFrameworks/Safari.framework/Versions/A/Safari (compatibility version 528.0.0, current version 610.2.6)
	/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1292.0.0)
/Applications/Safari.app/Contents/MacOS/Safari (architecture arm64e):
	/System/Library/PrivateFrameworks/Safari.framework/Versions/A/Safari (compatibility version 528.0.0, current version 610.2.6)
	/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1292.0.0)

W/ the "dyld shared cache", the /System/Library/PrivateFrameworks/Safari.framework doesn't actually exist on disk anymore (hence objdump can't analyse it).

Maybe we can use dlopen to load and open an executable and then somehow traverse the link list (w/o actually executing the binary)?

@helje5 helje5 added enhancement New feature or request help wanted Extra attention is needed labels Oct 3, 2020
@saagarjha
Copy link

Alternatively, you could dump the shared cache and save the link graph, as I expect this to only be a problem if an app links a system framework that transitively links AppKit.

Alternatively you can just launch the app, stop it, and see what's loaded into the process.

@helje5
Copy link
Member Author

helje5 commented Oct 5, 2020

Alternatively, you could dump the shared cache and save the link graph

How would I do this?

@saagarjha
Copy link

You can use something like https://github.com/saagarjha/dyld-shared-cache-big-sur to grab all the files and they read the dependencies from everything.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request help wanted Extra attention is needed
Projects
None yet
Development

No branches or pull requests

2 participants