1

I have encountered this twice recently where I am trying to list the external symbols for an iOS mach-o binary and none of the tools can provide any output. The following is an example of the output from jtool:

jtool -S BinaryName -arch arm64
             U 
             U 
             U 
             U 
             U 
             U 
             U 
             U 

This particular binary was a fat binary hence having to pass it the arch but I also tried thinning it and running the command on just the arm64. The previous binary I had encountered this was not a fat binary though. Unfortunately I can't actually share either of the binaries, which I appreciate makes it harder to answer, as they are from a client.

I thought I had a reasonable understanding of the mach-o format although very inexperienced reversing.

I don't know if this is a trick I'm not aware of, how are these symbols resolved at runtime if they can't be parsed by any of these tools? Is there a way to "undo" this and list the symbols normally without running the binary?

2
  • First of all, it's very hard to answer without seeing the binary. Second, it's possible that you didn't thinned the binary correctly, as someone suggested that only using xcode working. – Pi Pony Jun 23 at 15:40
  • Hi @PiPony. Yes I appreciate it is much more difficult without the binary. Unfortunately this was a client's app that I wasn't able to share, if I come across another instance that I can do though I will provide more details. Regarding your second point, I had tried with a number of different tools, on the fat and thinned binary, all of which gave the same results. – Jon Jul 1 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.