Skip to content

feat(handler): add dyld shared cache multi-file handler - #1493

Open
elektrischermoench wants to merge 1 commit into
onekey-sec:mainfrom
elektrischermoench:feat/handler-dyld-cache
Open

feat(handler): add dyld shared cache multi-file handler#1493
elektrischermoench wants to merge 1 commit into
onekey-sec:mainfrom
elektrischermoench:feat/handler-dyld-cache

Conversation

@elektrischermoench

Copy link
Copy Markdown
Contributor

Adds a directory handler for split dyld shared cache layouts (dyld_shared_cache_* glob). Groups the primary cache file with its .01, .atlas, .dylddata, .symbols and .dyldlinkedit siblings into a unified logical view for extraction.

@elektrischermoench
elektrischermoench force-pushed the feat/handler-dyld-cache branch 4 times, most recently from ef722ae to 82768c4 Compare April 20, 2026 21:38
@qkaiser
qkaiser self-requested a review April 21, 2026 09:41
@qkaiser qkaiser added enhancement New feature or request format:executable python Pull requests that update Python code format:vendor Custom vendor format labels Apr 21, 2026
@qkaiser qkaiser added this to the Big Apple milestone Apr 21, 2026
Comment thread python/unblob/handlers/archive/apple/dyld.py Outdated
Comment thread python/unblob/handlers/archive/apple/dyld.py Outdated
Comment thread python/unblob/handlers/archive/apple/dyld.py Outdated
Comment thread python/unblob/handlers/archive/apple/dyld.py Outdated
"creating unified dyld cache view", main=file.name, parts=len(siblings) + 1
)

return MultiFile(name=f"{base_name}.unified", paths=[file, *siblings])

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's the purpose of this handler really ? I don't see an extractor that does something with these files so I'm a bit confused.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is just a directory handler to collect the parts and mark them as a multi file the content can be extracted with other handlers if this is done.

@elektrischermoench
elektrischermoench force-pushed the feat/handler-dyld-cache branch 2 times, most recently from af88577 to 1c0d58d Compare July 1, 2026 21:39
Adds a directory handler for split dyld shared cache layouts
(dyld_shared_cache_* glob). Groups the primary cache file with its
.01, .atlas, .dylddata, .symbols and .dyldlinkedit siblings into a
unified logical view for extraction.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request format:executable format:vendor Custom vendor format python Pull requests that update Python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants