Resolve iOS debug symbol 100x faster #3422

ChiChou · 2025-04-02T21:54:14Z

ChiChou
Apr 2, 2025

On iOS DebugSymbol.getFunctionByName() is quite slow upon first call (afterwards it's much faster), and we can not specify module name when there are symbols with same name across different frameworks.

For example, _SSL_CTX_set_keylog_callback can be found in both WebCore and libboringssl.dylib.

Module.enumerateSymbols is designed for debug symbols enumeration. It parses mach_header and nlist structure to enumerate symbols. However if the module is in dyld_shared_cache it does not work.

Before iOS 15, there are two fields in dsc header:

struct dyld_cache_header
{
	char		magic[16];				// e.g. "dyld_v0    i386"
        // ...
	uint64_t	localSymbolsOffset;		// file offset of where local symbols are stored
	uint64_t	localSymbolsSize;		// size of local symbols information
	uint8_t		uuid[16];				// unique value for each shared cache file
};

The symbols are aggregated in a location that does not relate to mach-o header.

From iOS 15, those information are moved to a seperated .symbols cache which is not mapped by default.

libdyld provides some private api for debug purposes:

https://github.com/apple-oss-distributions/dyld/blob/fba6732ffad1c798f31b2129eee4e073e6ae07dc/include/mach-o/dyld_introspection.h

They will do the work to parse dyld_shared_cache and map .symbols cache.

I don't know if it is a good idea to introduce those functions to frida-gum

So I converted them to frida js as a utility function

const libdyld = Module.load("/usr/lib/system/libdyld.dylib");

// extern void dyld_for_each_installed_shared_cache(void (^block)(dyld_shared_cache_t cache));
const dyld_for_each_installed_shared_cache = libdyld.findExportByName("dyld_for_each_installed_shared_cache");
const dyldForEachInstalledSharedCache = new NativeFunction(
    dyld_for_each_installed_shared_cache,
    "void",
    ["pointer"]
);

// extern void dyld_shared_cache_for_each_image(dyld_shared_cache_t cache, void (^block)(dyld_image_t image));
const dyld_shared_cache_for_each_image = libdyld.findExportByName("dyld_shared_cache_for_each_image");
const dyldSharedCacheForEachImage = new NativeFunction(
    dyld_shared_cache_for_each_image,
    "void",
    ["pointer", "pointer"]
);

// extern const char* dyld_image_get_installname(dyld_image_t image);
const dyld_image_get_installname = libdyld.findExportByName("dyld_image_get_installname");
const dyldImageGetInstallname = new NativeFunction(
    dyld_image_get_installname,
    "pointer",
    ["pointer"]
);

// extern bool dyld_image_local_nlist_content_4Symbolication(dyld_image_t image,
//     void (^contentReader)(const void* nlistStart, uint64_t nlistCount,
//                           const char* stringTable));
const dyld_image_local_nlist_content_4Symbolication = libdyld.findExportByName("dyld_image_local_nlist_content_4Symbolication");
const dyldImageLocalNlistContent4Symbolication = new NativeFunction(
    dyld_image_local_nlist_content_4Symbolication,
    "bool",
    ["pointer", "pointer"]
);

// struct nlist_64 {
//     union {
//         uint32_t n_strx;  /* index into the string table */
//     } n_un;
//     uint8_t n_type;       /* type flag, see below */
//     uint8_t n_sect;       /* section number or NO_SECT */
//     uint16_t n_desc;      /* see <mach-o/stab.h> */
//     uint64_t n_value;     /* value of this symbol (or stab offset) */
// };

const strcmp = new NativeFunction(Module.getExportByName(null, "strcmp"), "int", ["pointer", "pointer"]);

function findUnexportedSymbol(module, symbol) {
    let value = NULL;
    const symbolString = Memory.allocUtf8String(symbol);

    dyldForEachInstalledSharedCache(new ObjC.Block({
        retType: "void",
        argTypes: ["pointer"],
        implementation(cache) {
            let found = false;

            dyldSharedCacheForEachImage(cache, new ObjC.Block({
                retType: "void",
                argTypes: ["pointer"],
                implementation(image) {
                    if (found) return;

                    if (module !== null) {
                        const name = dyldImageGetInstallname(image).readUtf8String();
                        if (!name.endsWith('/' + module)) return;
                        found = true;
                    }

                    dyldImageLocalNlistContent4Symbolication(image, new ObjC.Block({
                        retType: "bool",
                        argTypes: ["pointer", "uint64", "pointer"],
                        implementation(nlistStart, nlistCount, stringTable) {
                            let nlist = nlistStart;
                            for (let i = uint64(0); i.compare(nlistCount) < 0; i = i.add(1), nlist = nlist.add(16)) {
                                const n_strx = nlist.readU32();
                                const n_value = nlist.add(8).readU64();
                                const symbolName = stringTable.add(n_strx);
                                if (strcmp(symbolName, symbolString) == 0) {
                                    value = new NativePointer(n_value);
                                    break;
                                }
                            }
                        }
                    }));
                }
            }));
        }
    }));

    return value;
}

function foo() {
    console.log(DebugSymbol.getFunctionByName("SSL_CTX_set_keylog_callback"));
}

function bar() {
    console.log(findUnexportedSymbol('libboringssl.dylib', "_SSL_CTX_set_keylog_callback"));
}

Here is the performance difference

$ frida -U -f com.apple.tv -l sym.js
     ____
    / _  |   Frida 16.5.6 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to iPad (id=bda58a8bc52c1187183bea0c318fb1fa2c87ce82)
Spawned `com.apple.tv`. Resuming main thread!                           
[iPad::com.apple.tv ]-> %time bar()
0x1b51feab0
Time: 84 ms.
[iPad::com.apple.tv ]-> %time foo()
0x1d38f2ab0
Time: 15084 ms.

Note that the results are different, because they resolve to two different functions that have same name respectively.

ChiChou · 2026-02-13T00:27:40Z

ChiChou
Feb 13, 2026
Author

Damn I just realized that the address from this approach is without slides. you need to add this slide to the pointer

function getSlide(module: string) {
  const {
    _dyld_image_count,
    _dyld_get_image_header,
    _dyld_get_image_vmaddr_slide,
  } = getDyldApi();

  const moduleInfo = Process.getModuleByName(module);
  for (let i = 0; i < _dyld_image_count(); i++) {
    // const name = _dyld_get_image_name(i).readUtf8String()!;
    const header = _dyld_get_image_header(i);
    if (moduleInfo.base.equals(header)) {
      const slide = _dyld_get_image_vmaddr_slide(i);
      return slide;
    }
  }

  throw new Error(`module ${module} not found in current process`);
}

0 replies

Navigation Menu

Repository navigation

Resolve iOS debug symbol 100x faster #3422

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Resolve iOS debug symbol 100x faster #3422

Uh oh!

Uh oh!

ChiChou Apr 2, 2025

Replies: 1 comment

Uh oh!

ChiChou Feb 13, 2026 Author

ChiChou
Apr 2, 2025

ChiChou
Feb 13, 2026
Author