Struct DyldCacheHeader

#[repr(C)]
pub struct DyldCacheHeader<E: Endian> {

    pub magic: [u8; 16],
    pub mapping_offset: U32<E>,
    pub mapping_count: U32<E>,
    pub images_offset_old: U32<E>,
    pub images_count_old: U32<E>,
    pub dyld_base_address: U64<E>,
    pub code_signature_offset: U64<E>,
    pub code_signature_size: U64<E>,
    pub slide_info_offset_unused: U64<E>,
    pub slide_info_size_unused: U64<E>,
    pub local_symbols_offset: U64<E>,
    pub local_symbols_size: U64<E>,
    pub uuid: [u8; 16],
    pub cache_type: U64<E>,
    pub branch_pools_offset: U32<E>,
    pub branch_pools_count: U32<E>,
    pub dyld_in_cache_mh: U64<E>,
    pub dyld_in_cache_entry: U64<E>,
    pub images_text_offset: U64<E>,
    pub images_text_count: U64<E>,
    pub patch_info_addr: U64<E>,
    pub patch_info_size: U64<E>,
    pub other_image_group_addr_unused: U64<E>,
    pub other_image_group_size_unused: U64<E>,
    pub prog_closures_addr: U64<E>,
    pub prog_closures_size: U64<E>,
    pub prog_closures_trie_addr: U64<E>,
    pub prog_closures_trie_size: U64<E>,
    pub platform: U32<E>,
    pub flags: U32<E>,
    pub shared_region_start: U64<E>,
    pub shared_region_size: U64<E>,
    pub max_slide: U64<E>,
    pub dylibs_image_array_addr: U64<E>,
    pub dylibs_image_array_size: U64<E>,
    pub dylibs_trie_addr: U64<E>,
    pub dylibs_trie_size: U64<E>,
    pub other_image_array_addr: U64<E>,
    pub other_image_array_size: U64<E>,
    pub other_trie_addr: U64<E>,
    pub other_trie_size: U64<E>,
    pub mapping_with_slide_offset: U32<E>,
    pub mapping_with_slide_count: U32<E>,
    pub dylibs_pbl_state_array_addr_unused: U64<E>,
    pub dylibs_pbl_set_addr: U64<E>,
    pub programs_pbl_set_pool_addr: U64<E>,
    pub programs_pbl_set_pool_size: U64<E>,
    pub program_trie_addr: U64<E>,
    pub os_version: U32<E>,
    pub alt_platform: U32<E>,
    pub alt_os_version: U32<E>,
    pub swift_opts_offset: U64<E>,
    pub swift_opts_size: U64<E>,
    pub sub_cache_array_offset: U32<E>,
    pub sub_cache_array_count: U32<E>,
    pub symbol_file_uuid: [u8; 16],
    pub rosetta_read_only_addr: U64<E>,
    pub rosetta_read_only_size: U64<E>,
    pub rosetta_read_write_addr: U64<E>,
    pub rosetta_read_write_size: U64<E>,
    pub images_offset: U32<E>,
    pub images_count: U32<E>,
    pub cache_sub_type: U32<E>,
    pub objc_opts_offset: U64<E>,
    pub objc_opts_size: U64<E>,
    pub cache_atlas_offset: U64<E>,
    pub cache_atlas_size: U64<E>,
    pub dynamic_data_offset: U64<E>,
    pub dynamic_data_max_size: U64<E>,
    /* private fields */
}

The dyld cache header. Corresponds to struct dyld_cache_header from dyld_cache_format.h. This header has grown over time. Only the fields up to and including dyld_base_address are guaranteed to be present. For all other fields, check the header size before accessing the field. The header size is stored in mapping_offset; the mappings start right after the theader.

Fields

magic: [u8; 16]

e.g. “dyld_v0 i386”

mapping_offset: U32<E>

file offset to first dyld_cache_mapping_info

mapping_count: U32<E>

number of dyld_cache_mapping_info entries

images_offset_old: U32<E>

UNUSED: moved to imagesOffset to prevent older dsc_extarctors from crashing

images_count_old: U32<E>

UNUSED: moved to imagesCount to prevent older dsc_extarctors from crashing

dyld_base_address: U64<E>

base address of dyld when cache was built

code_signature_offset: U64<E>

file offset of code signature blob

code_signature_size: U64<E>

size of code signature blob (zero means to end of file)

slide_info_offset_unused: U64<E>

unused. Used to be file offset of kernel slid info

slide_info_size_unused: U64<E>

unused. Used to be size of kernel slid info

local_symbols_offset: U64<E>

file offset of where local symbols are stored

local_symbols_size: U64<E>

size of local symbols information

uuid: [u8; 16]

unique value for each shared cache file

cache_type: U64<E>

0 for development, 1 for production, 2 for multi-cache

branch_pools_offset: U32<E>

file offset to table of uint64_t pool addresses

branch_pools_count: U32<E>

number of uint64_t entries

dyld_in_cache_mh: U64<E>

(unslid) address of mach_header of dyld in cache

dyld_in_cache_entry: U64<E>

(unslid) address of entry point (_dyld_start) of dyld in cache

images_text_offset: U64<E>

file offset to first dyld_cache_image_text_info

images_text_count: U64<E>

number of dyld_cache_image_text_info entries

patch_info_addr: U64<E>

(unslid) address of dyld_cache_patch_info

patch_info_size: U64<E>

Size of all of the patch information pointed to via the dyld_cache_patch_info

other_image_group_addr_unused: U64<E>

unused

other_image_group_size_unused: U64<E>

unused

prog_closures_addr: U64<E>

(unslid) address of list of program launch closures

prog_closures_size: U64<E>

size of list of program launch closures

prog_closures_trie_addr: U64<E>

(unslid) address of trie of indexes into program launch closures

prog_closures_trie_size: U64<E>

size of trie of indexes into program launch closures

platform: U32<E>

platform number (macOS=1, etc)

flags: U32<E>

shared_region_start: U64<E>

base load address of cache if not slid

shared_region_size: U64<E>

overall size required to map the cache and all subCaches, if any

max_slide: U64<E>

runtime slide of cache can be between zero and this value

dylibs_image_array_addr: U64<E>

(unslid) address of ImageArray for dylibs in this cache

dylibs_image_array_size: U64<E>

size of ImageArray for dylibs in this cache

dylibs_trie_addr: U64<E>

(unslid) address of trie of indexes of all cached dylibs

dylibs_trie_size: U64<E>

size of trie of cached dylib paths

other_image_array_addr: U64<E>

(unslid) address of ImageArray for dylibs and bundles with dlopen closures

other_image_array_size: U64<E>

size of ImageArray for dylibs and bundles with dlopen closures

other_trie_addr: U64<E>

(unslid) address of trie of indexes of all dylibs and bundles with dlopen closures

other_trie_size: U64<E>

size of trie of dylibs and bundles with dlopen closures

mapping_with_slide_offset: U32<E>

file offset to first dyld_cache_mapping_and_slide_info

mapping_with_slide_count: U32<E>

number of dyld_cache_mapping_and_slide_info entries

dylibs_pbl_state_array_addr_unused: U64<E>

unused

dylibs_pbl_set_addr: U64<E>

(unslid) address of PrebuiltLoaderSet of all cached dylibs

programs_pbl_set_pool_addr: U64<E>

(unslid) address of pool of PrebuiltLoaderSet for each program

programs_pbl_set_pool_size: U64<E>

size of pool of PrebuiltLoaderSet for each program

program_trie_addr: U64<E>

(unslid) address of trie mapping program path to PrebuiltLoaderSet

os_version: U32<E>

OS Version of dylibs in this cache for the main platform

alt_platform: U32<E>

e.g. iOSMac on macOS

alt_os_version: U32<E>

e.g. 14.0 for iOSMac

swift_opts_offset: U64<E>

VM offset from cache_header* to Swift optimizations header

swift_opts_size: U64<E>

size of Swift optimizations header

sub_cache_array_offset: U32<E>

file offset to first dyld_subcache_entry

sub_cache_array_count: U32<E>

number of subCache entries

symbol_file_uuid: [u8; 16]

unique value for the shared cache file containing unmapped local symbols

rosetta_read_only_addr: U64<E>

(unslid) address of the start of where Rosetta can add read-only/executable data

rosetta_read_only_size: U64<E>

maximum size of the Rosetta read-only/executable region

rosetta_read_write_addr: U64<E>

(unslid) address of the start of where Rosetta can add read-write data

rosetta_read_write_size: U64<E>

maximum size of the Rosetta read-write region

images_offset: U32<E>

file offset to first dyld_cache_image_info

images_count: U32<E>

number of dyld_cache_image_info entries

cache_sub_type: U32<E>

0 for development, 1 for production, when cacheType is multi-cache(2)

objc_opts_offset: U64<E>

VM offset from cache_header* to ObjC optimizations header

objc_opts_size: U64<E>

size of ObjC optimizations header

cache_atlas_offset: U64<E>

VM offset from cache_header* to embedded cache atlas for process introspection

cache_atlas_size: U64<E>

size of embedded cache atlas

dynamic_data_offset: U64<E>

VM offset from cache_header* to the location of dyld_cache_dynamic_data_header

dynamic_data_max_size: U64<E>

maximum size of space reserved from dynamic data

Implementations

impl<E: Endian> DyldCacheHeader<E>

pub fn parse<'data, R: ReadRef<'data>>(data: R) -> Result<&'data Self>

Read the dyld cache header.

pub fn parse_magic(&self) -> Result<(Architecture, E)>

Returns (arch, endian) based on the magic string.

pub fn mappings<'data, R: ReadRef<'data>>( &self, endian: E, data: R, ) -> Result<DyldCacheMappingSlice<'data, E>>

Return the mapping information table.

pub fn subcaches<'data, R: ReadRef<'data>>( &self, endian: E, data: R, ) -> Result<Option<DyldSubCacheSlice<'data, E>>>

Return the information about subcaches, if present.

Returns None for dyld caches produced before dyld-940 (macOS 12).

pub fn symbols_subcache_uuid(&self, endian: E) -> Option<[u8; 16]>

Return the UUID for the .symbols subcache, if present.

pub fn images<'data, R: ReadRef<'data>>( &self, endian: E, data: R, ) -> Result<&'data [DyldCacheImageInfo<E>]>

Return the image information table.

Trait Implementations

impl<E: Clone + Endian> Clone for DyldCacheHeader<E>

fn clone(&self) -> DyldCacheHeader<E>

Returns a duplicate of the value.

const fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<E: Debug + Endian> Debug for DyldCacheHeader<E>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<E: Copy + Endian> Copy for DyldCacheHeader<E>

impl<E: Endian> Pod for DyldCacheHeader<E>