iOS15 "dyld_shared_cache_arm64" is splited to many many pieces, can not extractor

[zhouxing5311]

iOS15 "dyld_shared_cache_arm64" is splited to many many pieces, can not extractor.

download the ipsw from https://ipsw.me/

[Keith Smiley]

So I debugged a bit here, it seems that the extra files with the number suffixes are actually all referenced when extracting the "main" file (dyld_shared_cache_arm64). You can see this by moving that primary file into an empty directory, and attempting to extract it:

% mkdir /tmp/foo && cd /tmp/foo
% cp path/to/just/the/main/file .
% dyld-shared-cache-extractor dyld_shared_cache_arm64e .
Error: stat failed for dyld shared cache at dyld_shared_cache_arm64e.1

So you shouldn't point the extractor to those files, just the primary file.

Also note that, unless you're trying to do something special with the ipsw, it's probably easier to extract from the cache created on your machine when you plug in a device running that version. For example mine are found in ~/Library/Developer/Xcode/iOS DeviceSupport/15.0 (19A346) arm64e/Symbols/System/Library/Caches/com.apple.dyld

If you're seeing some error extracting the primary file, please post it here

[zhouxing5311]

@keith thanks for reply. I try to use dyld-shared-cache-extractor dyld_shared_cache_arm64e test to extract the main file you said, but nothing output. So, seems like you must put the slices together, then you can extract the symbols. find the same issuse here arandomdev/DyldExtractor#15. Looks like it is complicated to put the slices together, you must get the 'offset info'.

what i tried to do is automatic check the iOS new version, and download the ipsw, then extract the Symbols. It can be used to symbolic the iOS crash file. we built a platform like Bugly. So, to symbolic the system crash stack info, you must have the corresponding 'Symbols' version to the crash device.

[Keith Smiley]

Do you have Xcode 13 selected globally? This tool does not parse the dyld shared cache itself, it uses a private library from Xcode to do that for us.

If I use Xcode 12 it does not work as you say:

(Caches/com.apple.dyld) % DEVELOPER_DIR=/Applications/Xcode-12.5.1.app /Users/ksmiley/dev/dyld-shared-cache-extractor/target/debug/dyld-shared-cache-extractor dyld_shared_cache_arm64e /tmp/blah
# no output

but with Xcode 13 this works perfectly for me with the ipsw from the developer portal:

(Caches/com.apple.dyld) % xcode-select -p
/Applications/Xcode-13.0.0-RC1.app/Contents/Developer
(Caches/com.apple.dyld) % xcodebuild -version
Xcode 13.0
Build version 13A233
(Caches/com.apple.dyld) % pwd
/Volumes/Sky19A346.D321D331D421D431OS/System/Library/Caches/com.apple.dyld
(Caches/com.apple.dyld) % /Users/ksmiley/dev/dyld-shared-cache-extractor/target/debug/dyld-shared-cache-extractor dyld_shared_cache_arm64e /tmp/blah
extracted 0/2361
extracted 1/2361
extracted 3/2361
extracted 4/2361
...

[zhouxing5311]

😂 looks like i must update my xcode to 13, my xcode version is 12.5 now, but my mbp is 11.2.3 can not install, at least 11.3. Thanks, i will try it.