Modern dyld metadata: exports and chained fixups
Modern Mach-O images may describe dynamic-loader work with newer link-edit payloads rather than relying only on older dyld opcode streams.
Two important load commands in current Apple headers are:
LC_DYLD_EXPORTS_TRIELC_DYLD_CHAINED_FIXUPS
Both are load commands that point to payloads in link-edit data.
Export tries
An export trie encodes exported symbols as a prefix tree. The representation reduces repeated string prefixes and can attach flags or additional information to terminal nodes.
The important analysis idea is not to memorize every byte immediately. First understand the relationship:
load command → link-edit payload → encoded export graph → exported symbol information
A parser should validate every node offset and variable-length integer before following it.
Chained fixups
Chained fixups encode locations that need rebasing or binding using chains associated with mapped pages/segments. This differs conceptually from treating every fixup as an independent relocation record.
The useful mental model is:
segment/page metadata → chain start → encoded pointer/fixup → next link in chain
Different pointer formats exist, so a parser must use the format identifier carried by the fixup metadata instead of assuming one pointer layout.
Old and new can coexist across the ecosystem
Do not write an analyzer that assumes every Mach-O uses chained fixups, and do not write one that assumes LC_DYLD_INFO_ONLY is universal.
The file tells you which representation it carries.
Analysis exercise
For three Mach-O samples from different toolchain generations:
- inventory all dyld-related load commands;
- record which export/fixup representation each file uses;
- compare the structural differences without assuming one file is “more correct.”