I'm analyzing load commands section of executable Mach-O file in iOS 9.3.3, Twitter app is used for ilustration.
# otool -hV Twitter Twitter: Mach header magic cputype cpusubtype caps filetype ncmds sizeofcmds flags MH_MAGIC_64 16777228 0 0x00 EXECUTE 49 4208 NOUNDEFS DYLDLINK TWOLEVEL PIE
I've read that every executable contains LC_UNIXTHREAD command which is responsible for starting the binary's main thread. However, there's no such command in examined file.
# otool -l Twitter | grep LC_ cmd LC_SEGMENT_64 cmd LC_SEGMENT_64 cmd LC_SEGMENT_64 cmd LC_SEGMENT_64 cmd LC_SYMTAB cmd LC_DYSYMTAB cmd LC_LOAD_DYLINKER cmd LC_UUID cmd LC_LOAD_DYLIB cmd LC_LOAD_DYLIB cmd LC_LOAD_DYLIB [...repetition omitted...] cmd LC_RPATH cmd LC_RPATH cmd LC_CODE_SIGNATURE
I cannot understand why it's not there. Does it have anything in common with the fact that this app runs with mobile user privileges or that it's proprietary app of the third party? I found this LC command e.g. for /bin/ls, but not for any of tested proprietary apps.