I'm analyzing load commands section of executable Mach-O file in iOS 9.3.3, Twitter app is used for ilustration.
# otool -hV Twitter
Twitter:
Mach header
magic cputype cpusubtype caps filetype ncmds sizeofcmds flags
MH_MAGIC_64 16777228 0 0x00 EXECUTE 49 4208 NOUNDEFS DYLDLINK TWOLEVEL PIE
I've read that every executable contains LC_UNIXTHREAD command which is responsible for starting the binary's main thread. However, there's no such command in examined file.
# otool -l Twitter | grep LC_
cmd LC_SEGMENT_64
cmd LC_SEGMENT_64
cmd LC_SEGMENT_64
cmd LC_SEGMENT_64
cmd LC_SYMTAB
cmd LC_DYSYMTAB
cmd LC_LOAD_DYLINKER
cmd LC_UUID
cmd LC_LOAD_DYLIB
cmd LC_LOAD_DYLIB
cmd LC_LOAD_DYLIB
[...repetition omitted...]
cmd LC_RPATH
cmd LC_RPATH
cmd LC_CODE_SIGNATURE
I cannot understand why it's not there. Does it have anything in common with the fact that this app runs with mobile user privileges or that it's proprietary app of the third party? I found this LC command e.g. for /bin/ls, but not for any of tested proprietary apps.