Search code examples
macosbinarydyldmach-o

Why is __LINKEDIT sometimes 0x1000 off?

Parsing an already-loaded Mach-O binary in memory...

Sometimes the string table, symbol table, etc, are where they should be, and sometimes they're 0x1000 off.

For example, I might run my program and baseOffset + cmd->symoff is accurate. Then I'll unit test and baseOffset + cmd->symoff + 0x1000 is accurate. baseOffset is always valid and pointing to a valid Mach header.

Solution

  • I figured it out by looking at dyld source code... It's not guarenteed to be 0x1000 off, however, the link edit offset is: baseImageOffset + linkedit.vmaddr - linkedit.fileoff. Most of the time this difference is 0, but sometimes it is not.

    This impacts LC_FUNCTION_STARTS (cmd->dataoff) and LC_SYMTAB (cmd->stroff and cmd->symoff)