Ghidra : iOS Application : Mach-O binary -> Symbol files of dylib or framework are not generated

Question

I'm performing my first reverse on a Mach-O file binary through Ghidra. My problem is that Ghidra doesn't create symbol files of the dylib/frameworks that are loaded in the project. It is really problematic because I want to trace the calls through these libraries. (ARM64v8-a, iOS 13.6, image extracted with Cellebrite with checkra1n)

Here we can see there is no found functions below the import. All these external librairies are loaded in the project. (Some of them have been extracted from the dyld_shared_cache, therefore maybe some are not completely reconstructed. But others are intacts)

If I try with a PE file, the function are detected and the symbol file is created under the config folder of Ghidra, but not with any dylib binaries :

I have found that Hopper succeeds to find references to these external binaries. (Free Version)

I could just find symbol files online, but until now I did not find a single one, moreover several librairies are relative to the application. (Any application of the analyzed iPhone 8 has the same problem, so I don't think it is related to the analyzed app)

Someone had this problem ?

Someone knows where to find symbol files for iOS ?

Thank you for reading.

Answer 1

It's very likely that Ghidra doesn't know how to read the symbols from the dyld_shared_cache. You can try to use a different tool like IDA PRO, Rizin or radare2 or Cutter, etc.

But, which binary are you trying to reverse? Do you know which functions do you want to trace? You can use the tool jtool, read more on jtool - Taking the O out of otool(1), and so much more there is a part where he shows how to get the functions using the tool