DYLD — Do You Like Death? (VII)

Karol Mazurek
15 min readApr 8, 2024

The lifecycle of a Dynamic Loader from its creation to its termination.

This is the seventh article in the series about debugging Dyld-1122 and analyzing its source code. We will cover logging and dyldCache members of the ProcessConfig and understand how three environmental variables: DYLD_PRINT_TO_FILE,DYLD_SHARED_REGION & DYLD_SHARED_CACHE_DIR works.

Please note that this analysis may contain some errors as I am still learning and working on it alone. No one has checked it for mistakes. Please let me know in the comments or contact me through my social media if you find anything.

Let’s go!

WORKING MAP

As last time, we begin our journey by decompiling the Dyld using a Hopper.

hopper -e '/usr/lib/dyld'

We are in the dyld`start analysing the Memory Manager. In the fourth article, I introduced pseudo-code, which you can see below. Based on it, we finished creating the allocator and now, we will set up the ProcessConfig:

In the last episode, we started collecting ProcessConfig properties and finished after completing ProcessConfig::Security

--

--