0

I've been attempting to dive into mediaserverd which runs on iOS. Pulling the binary and running otool -L on it reveals, unsurprisingly, that it's linked against /System/Library/Frameworks/CoreMedia.framework/CoreMedia. However, that directory on the phone doesn't have any file called CoreMedia. In fact, all it has are two .plist files and some text file called CodeResources.

Where is the actual Mach-O file for the CoreMedia framework?

2
  • Welcome to RE.SE. An iOS/MacOS "framework" is a directory. Code objects are expected to be found in a subdirectory named contents/macOS under the .framework directory (the parent of the one you are in)
    – Yotamz
    Mar 30 at 8:22
  • find /System/Library -type d -name contents yielded no results. Apr 1 at 14:49

1 Answer 1

0

Instead of keeping the builtin frameworks directly in the file system, iOS and macOS keep them bundled in a shared cache. You can find this cache on the phone at /System//Library/Caches/com.apple.dyld/dyld_shared_cache_arm64. After pulling the file to your computer, you can use a tool like dyld-shared-cache-extractor:

dyld-shared-cache-extractor dyld_shared_cache_arm64 .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.