DyldExtractor: Unable to dlopen extracted images.

Describe the bug

DyldExtractor 1.0.8

Binary path: /System/Library/VideoDecoders/AVD.videodecoder

When dlopen()-ing it, this happens:

[Common.x:81] AVD handle 0 (dlopen(/System/Library/VideoDecoders/AVD.videodecoder, 2): no suitable image found.  Did find:
	/System/Library/VideoDecoders/AVD.videodecoder: malformed mach-o image: dyld weak bind info overlaps bind info
	/System/Library/VideoDecoders/AVD.videodecoder: malformed mach-o image: dyld weak bind info overlaps bind info)

To Reproduce

iOS version 14.6
DYLD target device and identifier https://ipsw.me/download/iPhone10,6/18F72

Additional context Add any other context about the problem here.

About this issue

Original URL
State: closed
Created 3 years ago
Comments: 17 (9 by maintainers)

Most upvoted comments

So, the main scope of the project is to help with reverse engineering. Generating a runnable image is a very hard goal.

For the error above, I found that the loader validates the dyld info in a specific order, which can be found here. I changed the order of the dyld info command with d5023c3 and was able to get pass the error.

Though the problems do not end here, DyldExtractor does not generate rebase info, which breaks PIE. And for newer caches and especially arm64e, critical information might be stripped from the cache (though I haven’t confirmed this).

And a while ago, when I tried creating runnable images, I ran into a weird issue where the loader would incorrectly read the LINKEDIT segment at a 0x1000 offset. I think this is because each segment is so far apart from each other, which I can’t reverse correctly because the cache does not contain the info to do so.

And despite my best efforts, there is a high chance that there are mistakes and errors when extracting images. Which would make it unreliable for tweaks.

I’ll keep this issue open as I really want this to work, but it’s unlikely that anything would be out soon.

arandomdev on Dec 19, 2021

So now that images are technically dlopen-able, I’m going to close this issue. Though there are still a lot of work that needs to be done.

arandomdev on Jan 9, 2022

So great news! I was able to extract AVD.videodecoder and successfully call AVDRegister. The changes are available on the beta branch.

I tried to look at your code so I could test more than one function, but I didn’t make it very far. though, in order to make it work, I had to set the environment variable DYLD_BIND_AT_LAUNCH=1, RTLD_LAZY and RTLD_NOW doesn’t seem to effect it.

Good luck!

arandomdev on Jan 7, 2022