ghidra: macOS: Import File fails to locate and load linked system libraries from dyld cache

Describe the bug When importing a file Ghidra fails to locate and load libraries from the dyld cache.

To Reproduce Steps to reproduce the behavior:

Import /usr/bin/tmutil
Check option to load external libraries

Expected behavior Ghidra locates and loads external libraries that are part of the dyld cache.

Environment (please complete the following information):

OS: macOS 11.6.5
Ghidra Version: 10.1.2
Ghidra Origin: Homebrew cask

Additional context

----- Loading tmutil_x86_64 -----
Skipping segment: __PAGEZERO (tmutil_x86_64)
Searching for referenced library: /usr/lib/swift/libswiftXPC.dylib ...
Unable to find external library: /usr/lib/swift/libswiftXPC.dylib
Searching for referenced library: /usr/lib/swift/libswiftObjectiveC.dylib ...
Unable to find external library: /usr/lib/swift/libswiftObjectiveC.dylib
Searching for referenced library: /usr/lib/swift/libswiftAppKit.dylib ...
Unable to find external library: /usr/lib/swift/libswiftAppKit.dylib
Searching for referenced library: /usr/lib/swift/libswiftCloudKit.dylib ...
Unable to find external library: /usr/lib/swift/libswiftCloudKit.dylib
Searching for referenced library: /usr/lib/swift/libswiftCoreFoundation.dylib ...
Unable to find external library: /usr/lib/swift/libswiftCoreFoundation.dylib
Searching for referenced library: /usr/lib/swift/libswiftMetal.dylib ...
Unable to find external library: /usr/lib/swift/libswiftMetal.dylib
Searching for referenced library: /usr/lib/swift/libswiftCoreGraphics.dylib ...
Unable to find external library: /usr/lib/swift/libswiftCoreGraphics.dylib
Searching for referenced library: /usr/lib/swift/libswiftQuartzCore.dylib ...
Unable to find external library: /usr/lib/swift/libswiftQuartzCore.dylib
Searching for referenced library: /usr/lib/libSystem.B.dylib ...
Unable to find external library: /usr/lib/libSystem.B.dylib
Searching for referenced library: /System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration ...
Unable to find external library: /System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration
Searching for referenced library: /usr/lib/swift/libswiftCore.dylib ...
Unable to find external library: /usr/lib/swift/libswiftCore.dylib
Searching for referenced library: /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/DesktopServicesPriv ...
Unable to find external library: /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/DesktopServicesPriv
Searching for referenced library: /usr/lib/swift/libswiftCoreData.dylib ...
Unable to find external library: /usr/lib/swift/libswiftCoreData.dylib
Searching for referenced library: /usr/lib/libobjc.A.dylib ...
Unable to find external library: /usr/lib/libobjc.A.dylib
Searching for referenced library: /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices ...
Unable to find external library: /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices
Searching for referenced library: /usr/lib/swift/libswiftIOKit.dylib ...
Unable to find external library: /usr/lib/swift/libswiftIOKit.dylib
Searching for referenced library: /System/Library/PrivateFrameworks/NetAuth.framework/Versions/A/NetAuth ...
Unable to find external library: /System/Library/PrivateFrameworks/NetAuth.framework/Versions/A/NetAuth
Searching for referenced library: /usr/lib/swift/libswiftFoundation.dylib ...
Unable to find external library: /usr/lib/swift/libswiftFoundation.dylib
Searching for referenced library: /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation ...
Unable to find external library: /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
Searching for referenced library: /System/Library/PrivateFrameworks/TimeMachine.framework/Versions/A/TimeMachine ...
Unable to find external library: /System/Library/PrivateFrameworks/TimeMachine.framework/Versions/A/TimeMachine
Searching for referenced library: /System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation ...
Unable to find external library: /System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation
Searching for referenced library: /System/Library/Frameworks/Security.framework/Versions/A/Security ...
Unable to find external library: /System/Library/Frameworks/Security.framework/Versions/A/Security
Searching for referenced library: /System/Library/PrivateFrameworks/DiskImages.framework/Versions/A/DiskImages ...
Unable to find external library: /System/Library/PrivateFrameworks/DiskImages.framework/Versions/A/DiskImages
Searching for referenced library: /System/Library/Frameworks/ServiceManagement.framework/Versions/A/ServiceManagement ...
Unable to find external library: /System/Library/Frameworks/ServiceManagement.framework/Versions/A/ServiceManagement
Searching for referenced library: /usr/lib/swift/libswiftos.dylib ...
Unable to find external library: /usr/lib/swift/libswiftos.dylib
Searching for referenced library: /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation ...
Unable to find external library: /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
Searching for referenced library: /usr/lib/swift/libswiftDarwin.dylib ...
Unable to find external library: /usr/lib/swift/libswiftDarwin.dylib
Searching for referenced library: /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit ...
Unable to find external library: /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
Searching for referenced library: /usr/lib/swift/libswiftDispatch.dylib ...
Unable to find external library: /usr/lib/swift/libswiftDispatch.dylib
Searching for referenced library: /System/Library/PrivateFrameworks/SystemAdministration.framework/Versions/A/SystemAdministration ...
Unable to find external library: /System/Library/PrivateFrameworks/SystemAdministration.framework/Versions/A/SystemAdministration
Searching for referenced library: /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration ...
Unable to find external library: /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
Searching for referenced library: /usr/lib/swift/libswiftCoreLocation.dylib ...
Unable to find external library: /usr/lib/swift/libswiftCoreLocation.dylib
Searching for referenced library: /usr/lib/swift/libswiftCoreImage.dylib ...
Unable to find external library: /usr/lib/swift/libswiftCoreImage.dylib
Finished importing referenced libraries for: tmutil_x86_64
  [/System/Library/PrivateFrameworks/TimeMachine.framework/Versions/A/TimeMachine] -> not found
  [/System/Library/Frameworks/Security.framework/Versions/A/Security] -> not found
  [/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation] -> not found
  [/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation] -> not found
  [/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit] -> not found
  [/System/Library/PrivateFrameworks/DiskImages.framework/Versions/A/DiskImages] -> not found
  [/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration] -> not found
  [/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices] -> not found
  [/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/DesktopServicesPriv] -> not found
  [/System/Library/Frameworks/ServiceManagement.framework/Versions/A/ServiceManagement] -> not found
  [/System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation] -> not found
  [/System/Library/PrivateFrameworks/SystemAdministration.framework/Versions/A/SystemAdministration] -> not found
  [/System/Library/PrivateFrameworks/NetAuth.framework/Versions/A/NetAuth] -> not found
  [/System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration] -> not found
  [/usr/lib/libobjc.A.dylib] -> not found
  [/usr/lib/libSystem.B.dylib] -> not found
  [/usr/lib/swift/libswiftAppKit.dylib] -> not found
  [/usr/lib/swift/libswiftCloudKit.dylib] -> not found
  [/usr/lib/swift/libswiftCore.dylib] -> not found
  [/usr/lib/swift/libswiftCoreData.dylib] -> not found
  [/usr/lib/swift/libswiftCoreFoundation.dylib] -> not found
  [/usr/lib/swift/libswiftCoreGraphics.dylib] -> not found
  [/usr/lib/swift/libswiftCoreImage.dylib] -> not found
  [/usr/lib/swift/libswiftCoreLocation.dylib] -> not found
  [/usr/lib/swift/libswiftDarwin.dylib] -> not found
  [/usr/lib/swift/libswiftDispatch.dylib] -> not found
  [/usr/lib/swift/libswiftFoundation.dylib] -> not found
  [/usr/lib/swift/libswiftIOKit.dylib] -> not found
  [/usr/lib/swift/libswiftMetal.dylib] -> not found
  [/usr/lib/swift/libswiftObjectiveC.dylib] -> not found
  [/usr/lib/swift/libswiftQuartzCore.dylib] -> not found
  [/usr/lib/swift/libswiftXPC.dylib] -> not found
  [/usr/lib/swift/libswiftos.dylib] -> not found

https://github.com/NationalSecurityAgency/ghidra/issues/3345

About this issue

Original URL
State: closed
Created 2 years ago
Comments: 47

Commits related to this issue

GP-3909: When loading "System Libraries From Disk" on macOS, the dyld_shared_cache will be searched for in more default locations (#4162) — committed to NationalSecurityAgency/ghidra by ryanmkurtz 9 months ago
GP-3909: When loading "System Libraries From Disk" on macOS, the dyld_shared_cache will be searched for in even more default locations (#4162) — committed to NationalSecurityAgency/ghidra by ryanmkurtz 9 months ago
Merge remote-tracking branch 'origin/GP-3910_ryanmkurtz_library-logging' (#4162) — committed to NationalSecurityAgency/ghidra by ryanmkurtz 9 months ago

Most upvoted comments

@ryanmkurtz, you should probably also add the following paths for macOS 11 and 12:

paths.add("/System/Library/dyld/dyld_shared_cache_x86_64");
paths.add("/System/Library/dyld/dyld_shared_cache_x86_64h");

steven-michaud on Oct 4, 2023

@Kentzo I believe things like /usr/lib/libc++.1.dylib were not found in your case because you had the “Recursive Library Load Depth” loader option set to 1. If you increase it to 2 you should see that library get loaded.

ryanmkurtz on Oct 4, 2023

@Kentzo thanks, i’ll get the x86 one added. You should be able to add /System/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_x86_64 manually to Edit Paths to get it working.

ryanmkurtz on Oct 3, 2023

@Kentzo In Ghidra 10.3.3, libraries are looked up by just their name and not full path. You can confirm this by selecting the usr/lib directory within your extracted directory structure, rather than the root. You should see some libraries come in.

In the master branch and the upcoming 10.4 release, this has been fixed. You’ll be able to specify the root of your extracted directory, or the original dyld_shared_cache file with no need to extract. A lot of improvements have been made to our own extractor. I am also working on a feature that lets you add missing components from the dyld_shared_cache into your current program on demand. The idea there is you import your program and start REing it. Eventually you will come across a red missing reference to something in the cache. You right click on that reference, and perform a new Add To Program action. It will find the library/component being referenced in the cache and insert it into your program. This feature will not be ready for 10.4, but if you are interested I can let you know where to test it.

ryanmkurtz on Sep 23, 2023