Finding Offsets of Local Symbols in Shared Libraries Programmatically on OS X

dyld, mach-o, macos, shared-libraries

Solution

Another possibility (what I ended up using) is Apple's private `CoreSymbolication` framework:

void *resolve_private(const char *symbol_owner, const char *symbol_to_resolve)
{
    task_t targetTask;
    int err = task_for_pid(mach_task_self(), getpid(), &targetTask);
    if (err) {
        fprintf(stderr, "couldn't get my Mach task\n");
        return NULL;
    }

    CSSymbolicatorRef targetSymbolicator;

    targetSymbolicator = CSSymbolicatorCreateWithTaskFlagsAndNotification(targetTask,
                                                                              kCSSymbolicatorTrackDyldActivity,
                                                                          ^(uint32_t     notification_type, CSNotificationData data) {
                                                                          });
    if(CSIsNull(targetSymbolicator)) {
        fprintf("CSSymbolicatorCreateWithTaskFlagsAndNotification failed\n");
        return NULL;
    }

    __block CSSymbolOwnerRef symbolOwner = kCSNull;
    CSSymbolicatorForeachSymbolOwnerWithNameAtTime(targetSymbolicator,
                                                   symbol_owner,
                                                   kCSNow,
                                                   ^(CSSymbolOwnerRef owner) {
                                                       symbolOwner = owner;
                                                   });
    if (CSIsNull(symbolOwner)) {
        CSRelease(targetSymbolicator);
        fprintf("CSSymbolicatorForeachSymbolOwnerWithNameAtTime failed\n");
        return NULL;
    }

    __block uintptr_t p = (uintptr_t)NULL;
    CSSymbolOwnerForeachSymbol(symbolOwner, ^(CSSymbolRef symbol) {
        const char *symbol_name = CSSymbolGetMangledName(symbol);
        if (0 == strcmp(symbol_name, symbol_to_resolve)) {
            p = CSSymbolGetRange(symbol).location;
        }
    });

    CSRelease(targetSymbolicator);
    if ((uintptr_t)NULL == p) {
        fprintf("symbol not found\n");
        return NULL;
    } else {
        return (void *)p;
    }
}

Problem

I need to find the offset of a local symbol in a shared library on OS X. Local symbol as in non-exported symbol. Therefore `dyld("symbol_name")` will not work. I can however use `nm` to find these offsets, for example ``` $ nm /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/DesktopServicesPriv | grep -e ChildSetLabel -e NodeVolumeEject 000000000006cccd T _NodeVolumeEject 000000000009dbd7 t __ChildSetLabel ``` There we see the exported (`T`) symbol `NodeVolumeEject` which's offset `0x6cccd` I can easily reveal using `dyld("NodeVolumeEject")`. `dyld()` will reveal the address in the current address space but I'm happy with either the offset in the shared library or the absolute address in the address space. Additionally, there's the local (`t`) symbol `_ChildSetLabel` which's offset (`0x9dbd7`) I cannot reveal using `dyld()`. I'd like to be able to do this resolution programmatically (without `gobjdump`, `nm`, `otool`, or any other external program). Is there an "easy" way to achieve that? The source code of the tools mentioned above contains the needed code but I wonder if there isn't something more straightforward. Domain: The solution has only to work on OS X 10.8 or better for x86_64 MachO binaries. Clarification: I would be happy to figure out the absolute offset in the current offset (which due to ASLR) is not static obviously. But I'm also happy to figure out the offset relative to the start of that library, which remains static (until recompile). The part from "address in the library" to "address in the address space" is quite easy: ``` off_t sym_offset_child_set_label = ANSWER_TO_THIS_QUESTION("_ChildSetLabel"); Dl_info info; void *abs_volume_eject = dlsym(RTLD_DEFAULT, "NodeVolumeEject"); void *abs_child_set_label = NULL; if (dladdr(abs_volume_eject, &info)) { abs_child_set_label = (void *)((char *)info.dli_fbase + sym_offset_child_set_label); /* abs_child_set_label now points to the function in question */ } ``` This is, as long as `_ChildSetLabel` and `NodeVolumeEject` are in the same shared library enough. Therefore, ASLR is not an issue here.

Original source