1

I'm performing my first reverse on a Mach-O file binary through Ghidra. My problem is that Ghidra doesn't create symbol files of the dylib/frameworks that are loaded in the project. It is really problematic because I want to trace the calls through these libraries. (ARM64v8-a, iOS 13.6, image extracted with Cellebrite with checkra1n)

Here we can see there is no found functions below the import. All these external librairies are loaded in the project. (Some of them have been extracted from the dyld_shared_cache, therefore maybe some are not completely reconstructed. But others are intacts) enter image description here

If I try with a PE file, the function are detected and the symbol file is created under the config folder of Ghidra, but not with any dylib binaries :

enter image description here

I have found that Hopper succeeds to find references to these external binaries. (Free Version)

I could just find symbol files online, but until now I did not find a single one, moreover several librairies are relative to the application. (Any application of the analyzed iPhone 8 has the same problem, so I don't think it is related to the analyzed app)

Someone had this problem ?

Someone knows where to find symbol files for iOS ?

Thank you for reading.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.