iOS16/macOS13 changed the dyld_shared_cache format again

Hello!

There were some minor-ish changes to the shared_cache in iOS16. There is a NEW stub-island variant. I believe you can detect this new version as a cacheType=2 (from the header)

As a nicety, they have added the sub_cache extension to the sub_cache_entry structure so you can know after parsing the “primary” cache file all of it’s sub_cache file names.

The /usr/lib/dyld binary has been moved into the cache and I believe they are re-using the accerlatorInfoAddr and accleratorInfoSize fields from the header to now be the dyldTextAddr and addr to the _dyld_start func.

The stubs have all been moved into sub_caches (no longer inside the dylibs themselves) these stub-subcaches can be identified by their size (~KBs), they will only contain a _TEXT mapping and after the header/mapping etc there will be no MachO headers it will just be stubs ASM. I’m not sure if the stub_island sub_caches come right after the subcache with the dylibs that need them yet so you might have to “map” all the islands in order for the branch-to-stub symbols to resolve.

If you have ANY other question please don’t hesitate to ask and I’ll dig into it with you.

[ryanmkurtz]

The new base dyld_shared_cache and kernelcache files should now be loadable into Ghidra.

You can also import individual dylib’s from Ghidra’s filesystem interface, but the same limitations that existed in iOS15 still apply (huge files, missing objc info, unfixed chained pointers, etc). Work still needs to be done in this area. These issues are independent of the new format so they should get their own tickets (such as #4175)

[blacktop]

LOL, I def should try to contribute to ghidra after all the good you have done for me and the RE world 😞 Maybe after I “finish” ipsw I have more time 😁 If you hit me up on Twitter I can share an IPSW url with you or you can wait, I think Apple will release “public” betas in 3 weeks?