DyldCacheFileSystem exception: "hash has changed"

I’m trying to load a dyld_shared_cache from an arm64e macOS Monterey machine. Ghidra properly detects the file as a filesystem, and can browse through all the files. After trying to import the /System/Library/PrivateFrameworks/ScreenSharing.framework/ScreenSharing, Ghidra displays this error:

Failed to find provider for segment: __LINKEDIT
java.io.IOException: Failed to find provider for segment: __LINKEDIT
	at ghidra.file.formats.ios.dyldcache.DyldCacheDylibExtractor$PackedDylib.getSegmentProvider(DyldCacheDylibExtractor.java:313)
	at ghidra.file.formats.ios.dyldcache.DyldCacheDylibExtractor$PackedDylib.<init>(DyldCacheDylibExtractor.java:236)
	at ghidra.file.formats.ios.dyldcache.DyldCacheDylibExtractor.extractDylib(DyldCacheDylibExtractor.java:61)
	at ghidra.file.formats.ios.dyldcache.DyldCacheFileSystem.getByteProvider(DyldCacheFileSystem.java:64)
	at ghidra.formats.gfilesystem.FileSystemService.getByteProvider(FileSystemService.java:364)
	at ghidra.plugins.fsbrowser.FSBActionManager.ensureFileAccessable(FSBActionManager.java:941)
	at ghidra.plugins.fsbrowser.FSBActionManager.lambda$createImportAction$37(FSBActionManager.java:698)
	at docking.widgets.tree.GTree$1.run(GTree.java:1152)
	at ghidra.util.worker.AbstractWorker$JobCallback.process(AbstractWorker.java:133)
	at ghidra.util.worker.AbstractWorker$JobCallback.process(AbstractWorker.java:123)
	at generic.concurrent.ConcurrentQ$CallbackCallable.call(ConcurrentQ.java:658)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at generic.concurrent.FutureTaskMonitor.run(FutureTaskMonitor.java:76)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630)
	at java.base/java.lang.Thread.run(Thread.java:831)

---------------------------------------------------
Build Date: 2022-Apr-21 1210 EDT
Ghidra Version: 10.1.3
Java Home: /fasthome/antek/.sdkman/candidates/java/16.0.1.hs-adpt
JVM Version: AdoptOpenJDK 16.0.1
OS: Linux 5.16.12-arch1-1 amd64
Workstation: succubus

To Reproduce Steps to reproduce the behavior:

1. Open Ghidra
2. Click “new project” (non-shared)
3. Import the ARM64e dyld_shared_cache file from /System/Library/dyld/dyld_shared_cache_arm64e
4. Click ‘Filesystem’ in the ‘Container file detected’ dialog box
5. In the filesystem dialog, navigate to /System/Library/PrivateFrameworks/ScreenSharing.framework/ScreenSharing
6. Click right mouse button on it, select ‘import’
7. Error box appears

Expected behavior Ghidra should load the ScreenSharing file into the disassembler/decompiler.

Screenshots

Attachments

Environment (please complete the following information):

• OS: ArchLinux
• Java Version: 16.0.1-hs AdoptOpenJdk
• Ghidra Version: 10.1.3
• Ghidra Origin: Github

Additional info

The problem is when importing any file from the dyld shared cache, not just ScreenSharing (tried to load a few of them, and all of them have failed with the same error).

Unpacking the dyld_shared_cache with thirdparty tools and loading the ScreenSharing binary into Ghidra works OK.

[ryanmkurtz]

The fix for this will be in the upcoming 10.2 release, and is currently available in the master branch if you are able to produce your own build.

[ryanmkurtz]

Yea, it’s not obvious that the .1 file and friends have to be in the same directory.

Ok, I will focus on that hash error for this ticket.