Macos Dyld Analysis

macOS Dyld Analysis

A skill for analyzing macOS dynamic linker internals, debugging library loading, and understanding Mach-O binary structure.

What this skill does

This skill helps you:

• Understand how macOS loads and links executables via dyld
• Debug library loading with dyld environment variables
• Analyze Mach-O binary structure (stubs, GOT, lazy/non-lazy symbols)
• Identify potential security implications of dyld behavior
• Examine the apple[] argument vector and dyld internals

When to use this skill

Use this skill when you need to:

• Debug why a macOS binary isn't loading correctly
• Understand library injection mechanisms (DYLD_INSERT_LIBRARIES)
• Analyze Mach-O binary structure for security research
• Investigate privilege escalation vectors through dyld
• Examine how symbols are resolved (lazy vs non-lazy binding)
• Debug dyld behavior with environment variables
• Understand the apple[] argument vector in macOS

Core Concepts

Dyld Loading Flow

1. dyldbootstrap::start loads dyld and sets up stack canary
2. dyld::_main() runs configureProcessRestrictions() (restricts DYLD_* vars)
3. Maps dyld shared cache (prelinked system libraries)
4. Loads libraries in order:
   • DYLD_INSERT_LIBRARIES (if allowed)
   • Shared cached libraries
   • Imported libraries (recursively)
5. Runs library initializers (__attribute__((constructor)))
6. Executes binary entry point

Mach-O Stub Sections

Note: Modern dyld loads everything as non-lazy. auth_ prefixed sections use pointer authentication (PAC).

Key Environment Variables

Debug Variables

Behavior Variables

The apple[] Argument Vector

macOS main() receives 4 arguments instead of 3:

int main(int argc, char **argv, char **envp, char **apple)

The apple[] vector contains sensitive values like:

• executable_path - Path to the executable
• stack_guard - Stack canary value
• malloc_entropy - Memory allocator entropy
• executable_cdhash - Code directory hash
• executable_boothash - Boot hash
• ptr_munge - Pointer munging value

Warning: These values are sanitized before reaching main() to prevent data leaks.

Common Tasks

1. List Loaded Libraries

DYLD_PRINT_LIBRARIES=1 ./your_binary

2. Examine Segment Mappings

DYLD_PRINT_SEGMENTS=1 ./your_binary

3. Analyze Stub Sections

# List sections
objdump --section-headers ./binary

# Disassemble stubs
objdump -d --section=__stubs ./binary

4. Find All DYLD Environment Variables

strings /usr/lib/dyld | grep "^DYLD_" | sort -u

5. Debug Before main() Entry

lldb ./binary
(lldb) process launch -s
(lldb) mem read $sp
(lldb) x/55s <stack_address>

6. Examine dyld_all_image_infos

The dyld_all_image_infos structure (exported by dyld) contains:

• Version information
• Pointer to dyld_image_info array
• Image notifier callback
• Shared cache detachment status
• libSystem initializer status
• dyld's own Mach header pointer

Security Considerations

Privilege Escalation Risk

If dyld contains vulnerabilities, they can be exploited before any binary executes, including privileged ones. This is because:

• dyld runs before the target binary
• dyld has no dependencies (uses syscalls directly)
• dyld handles all library loading

Library Injection Restrictions

DYLD_INSERT_LIBRARIES is restricted on:

• System binaries
• Signed executables
• Processes with hardened runtime

Pointer Authentication (PAC)

On arm64e:

• auth_ prefixed sections use in-process encryption keys
• BLRA[A/B] verifies pointers before following
• RETA[A/B] replaces RET for authenticated returns
• __TEXT.__auth_stubs uses braa instead of bl

References

• OS Internals, Volume I: User Mode by Jonathan Levin
• dyld Source Code
• Mach-O Format Documentation

Scripts

See the scripts/ directory for helper tools:

• list_dyld_env_vars.sh - Extract all DYLD_* environment variables from dyld
• analyze_macho_sections.sh - List and analyze Mach-O sections
• debug_dyld_loading.sh - Quick debug script for dyld behavior