As you may have already known, dyld_decache by kennyTM fails on arm64 caches. Since arm64 devices are more popular these days, what’s the alternative of dyld_decache on dyld_shared_cache_arm64? Luckily, there is an answer: dsc_extractor, an open-sourced tool from Apple.
Now follow me on patching and compiling dsc_extractor so that it can decache dyld_shared_cache_arm64 as dyld_decache used to do.
P.S. You may need to manually install wget with homebrew.
###Download and extract dsc_extractor
192:~ snakeninny$ cd ~ 192:~ snakeninny$ mkdir dsc_extractor 192:~ snakeninny$ cd dsc_extractor 192:dsc_extractor snakeninny$ wget http://opensource.apple.com/tarballs/dyld/dyld-210.2.3.tar.gz --2015-10-17 12:14:44-- http://opensource.apple.com/tarballs/dyld/dyld-210.2.3.tar.gz Resolving opensource.apple.com... 18.104.22.168 Connecting to opensource.apple.com|22.214.171.124|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 470411 (459K) [application/x-gzip] Saving to: 'dyld-210.2.3.tar.gz' dyld-210.2.3.tar.gz 100%[==================================================================>] 459.39K 230KB/s in 2.0s 2015-10-17 12:14:46 (230 KB/s) - 'dyld-210.2.3.tar.gz' saved [470411/470411] 192:dsc_extractor snakeninny$ tar xvf dyld-210.2.3.tar.gz x dyld-210.2.3/ x dyld-210.2.3/bin/ ...
192:dsc_extractor snakeninny$ cd dyld-210.2.3/launch-cache/ 192:launch-cache snakeninny$ touch dsc_extractor.patch
The above command creates an empty file named
~/dsc_extractor/dyld-210.2.3/launch-cache. Next copy the contents from here into
dsc_extractor.patch and save the file (Note that if you wget or curl the patch file, there’d be an extra newline character at the end of the file, you’d have to remove it manually). Let’s continue:
192:launch-cache snakeninny$ patch < dsc_extractor.patch patching file dsc_extractor.cpp Hunk #4 succeeded at 485 with fuzz 2.
P.S. MD5 of dsc_extractor.patch should be b54a2e2c9556003a91b04009e9986dba. If you don’t get it correct, download this copy dsc_extractor.patch (1.1 KB)
192:launch-cache snakeninny$ clang++ -o dsc_extractor dsc_extractor.cpp dsc_iterator.cpp In file included from dsc_extractor.cpp:51: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/../include/c++/v1/ext/hash_map:212:5: warning: Use of the header <ext/hash_map> is deprecated. Migrate to <unordered_map> [-W#warnings] # warning Use of the header <ext/hash_map> is deprecated. Migrate to <unordered_map> ^ 1 warning generated.
Now there’s a binary
~/dsc_extractor/dyld-210.2.3/launch-cache. Let’s test if it works.
/System/Library/Caches/com.apple.dyld/dyld_shared_cache_arm64from iOS to OSX using iFunBox.
/path/to/dsc_extractor /path/to/dyld_shared_cache_arm64 /path/to/decached/binaries/on OSX, the output is shown below:
0/969 1/969 2/969 3/969 4/969 5/969 6/969 ...
Done. Happy hacking iOS 9