Loading...
src/ImageLoaderMachOClassic.cpp dyld-195.6 dyld-360.22
--- dyld/dyld-195.6/src/ImageLoaderMachOClassic.cpp
+++ dyld/dyld-360.22/src/ImageLoaderMachOClassic.cpp
@@ -44,9 +44,6 @@
 #include <libkern/OSAtomic.h>
 #include <libkern/OSCacheControl.h>
 
-#if __ppc__ || __ppc64__
-	#include <mach-o/ppc/reloc.h>
-#endif
 #if __x86_64__
 	#include <mach-o/x86_64/reloc.h>
 #endif
@@ -57,16 +54,8 @@
 #include "ImageLoaderMachOClassic.h"
 #include "mach-o/dyld_images.h"
 
-// optimize strcmp for ppc
-#if __ppc__
-	#include <ppc_intrinsics.h>
-#else
-	#define astrcmp(a,b) strcmp(a,b)
-#endif
-
-
 // in dyldStartup.s
-extern "C" void fast_stub_binding_helper_interface();
+extern "C" void stub_binding_helper_i386_old();
 
 
 #if __x86_64__
@@ -108,7 +97,8 @@
 	// for PIE record end of program, to know where to start loading dylibs
 	if ( slide != 0 )
 		fgNextPIEDylibAddress = (uintptr_t)image->getEnd();
-	
+
+	image->disableCoverageCheck();
 	image->instantiateFinish(context);
 	image->setMapped(context);
 
@@ -137,7 +127,7 @@
 }
 
 // create image by mapping in a mach-o file
-ImageLoaderMachOClassic* ImageLoaderMachOClassic::instantiateFromFile(const char* path, int fd, const uint8_t* fileData, 
+ImageLoaderMachOClassic* ImageLoaderMachOClassic::instantiateFromFile(const char* path, int fd, const uint8_t* fileData, size_t lenFileData,
 															uint64_t offsetInFat, uint64_t lenInFat, const struct stat& info, 
 															unsigned int segCount, unsigned int libCount, 
 															const struct linkedit_data_command* codeSigCmd, const LinkContext& context)
@@ -147,12 +137,12 @@
 		// record info about file  
 		image->setFileInfo(info.st_dev, info.st_ino, info.st_mtime);
 
-	#if CODESIGNING_SUPPORT
 		// if this image is code signed, let kernel validate signature before mapping any pages from image
-		if ( codeSigCmd != NULL )
-			image->loadCodeSignature(codeSigCmd, fd, offsetInFat);
-	#endif
+		image->loadCodeSignature(codeSigCmd, fd, offsetInFat, context);
 		
+		// Validate that first data we read with pread actually matches with code signature
+		image->validateFirstPages(codeSigCmd, fd, fileData, lenFileData, offsetInFat, context);
+
 		// mmap segments
 		image->mapSegmentsClassic(fd, offsetInFat, lenInFat, info.st_size, context);
 
@@ -163,11 +153,12 @@
 		const char* installName = image->getInstallPath();
 		if ( (installName != NULL) && (strcmp(installName, path) == 0) && (path[0] == '/') )
 			image->setPathUnowned(installName);
-		else if ( path[0] != '/' ) {
+		else if ( (path[0] != '/') || (strstr(path, "../") != NULL) ) {
+			// rdar://problem/10733082 Fix up @path based paths during introspection
 			// rdar://problem/5135363 turn relative paths into absolute paths so gdb, Symbolication can later find them
 			char realPath[MAXPATHLEN];
-			if ( realpath(path, realPath) != NULL )
-				image->setPath(realPath);
+			if ( fcntl(fd, F_GETPATH, realPath) == 0 ) 
+				image->setPaths(path, realPath);
 			else
 				image->setPath(path);
 		}
@@ -205,6 +196,7 @@
 		// remember this is from shared cache and cannot be unloaded
 		image->fInSharedCache = true;
 		image->setNeverUnload();
+		image->disableCoverageCheck();
 
 		// segments already mapped in cache
 		if ( context.verboseMapping ) {
@@ -243,6 +235,8 @@
 		// for compatibility, never unload dylibs loaded from memory
 		image->setNeverUnload();
 
+		image->disableCoverageCheck();
+
 		// bundle loads need path copied
 		if ( moduleName != NULL ) 
 			image->setPath(moduleName);
@@ -286,7 +280,7 @@
 void ImageLoaderMachOClassic::instantiateFinish(const LinkContext& context)
 {
 	// now that segments are mapped in, get real fMachOData, fLinkEditBase, and fSlide
-	this->parseLoadCmds();
+	this->parseLoadCmds(context);
 }
 
 ImageLoaderMachOClassic::~ImageLoaderMachOClassic()
@@ -365,11 +359,11 @@
 		end += fSymbolTable[fDynamicInfo->iextdefsym+fDynamicInfo->nextdefsym-1].n_un.n_strx;
 		
 	// round to whole pages
-	start = start & (-4096);
-	end = (end + 4095) & (-4096);
+	start = dyld_page_trunc(start);
+	end = dyld_page_round(end);
 	
 	// skip if there is only one page
-	if ( (end-start) > 4096 ) {
+	if ( (end-start) > dyld_page_size ) {
 		madvise((void*)start, end-start, MADV_WILLNEED);
 		fgTotalBytesPreFetched += (end-start);
 		if ( context.verboseMapping ) {
@@ -632,7 +626,7 @@
 			const char* lastSlash = strrchr(childInstallPath, '/');
 			if ( lastSlash != NULL ) {
 				const char* firstDot = strchr(lastSlash, '.');
-				int len;
+				size_t len;
 				if ( firstDot == NULL )
 					len = strlen(lastSlash);
 				else
@@ -729,33 +723,6 @@
 }
 
 
-#if __ppc__
-static inline void otherRelocsPPC(uintptr_t* locationToFix, uint8_t relocationType, uint16_t otherHalf, uintptr_t slide)
-{
-	// low 16 bits of 32-bit ppc instructions need fixing
-	struct ppcInstruction { uint16_t opcode; int16_t immediateValue; };
-	ppcInstruction* instruction = (ppcInstruction*)locationToFix;
-	//uint32_t before = *((uint32_t*)locationToFix);
-	switch ( relocationType )
-	{
-		case PPC_RELOC_LO16: 
-			instruction->immediateValue = ((otherHalf << 16) | instruction->immediateValue) + slide;
-			break;
-		case PPC_RELOC_HI16: 
-			instruction->immediateValue = ((((instruction->immediateValue << 16) | otherHalf) + slide) >> 16);
-			break;
-		case PPC_RELOC_HA16: 
-			int16_t signedOtherHalf = (int16_t)(otherHalf & 0xffff);
-			uint32_t temp = (instruction->immediateValue << 16) + signedOtherHalf + slide;
-			if ( (temp & 0x00008000) != 0 )
-				temp += 0x00008000;
-			instruction->immediateValue = temp >> 16;
-	}
-	//uint32_t after = *((uint32_t*)locationToFix);
-	//dyld::log("dyld: ppc fixup %0p type %d from 0x%08X to 0x%08X\n", locationToFix, relocationType, before, after);
-}
-#endif
-
 #if PREBOUND_IMAGE_SUPPORT
 void ImageLoaderMachOClassic::resetPreboundLazyPointers(const LinkContext& context)
 {
@@ -770,11 +737,6 @@
 			if (sreloc->r_length == RELOC_SIZE) {
 				uintptr_t* locationToFix = (uintptr_t*)(sreloc->r_address + relocBase);
 				switch(sreloc->r_type) {
-		#if __ppc__ 
-					case PPC_RELOC_PB_LA_PTR:
-						*locationToFix = sreloc->r_value + slide;
-						break;
-		#endif
 		#if __i386__
 					case GENERIC_RELOC_PB_LA_PTR:
 						*locationToFix = sreloc->r_value + slide;
@@ -809,6 +771,7 @@
 	const relocation_info* const relocsStart = (struct relocation_info*)(&fLinkEditBase[fDynamicInfo->locreloff]);
 	const relocation_info* const relocsEnd = &relocsStart[fDynamicInfo->nlocrel];
 	for (const relocation_info* reloc=relocsStart; reloc < relocsEnd; ++reloc) {
+		uintptr_t rebaseAddr;
 		try {
 	#if LINKEDIT_USAGE_DEBUG
 			noteAccessedLinkEditAddress(reloc);
@@ -823,7 +786,12 @@
 				throw "bad local relocation pc_rel";
 			if ( reloc->r_extern != 0 ) 
 				throw "extern relocation found with local relocations";
-			*((uintptr_t*)(reloc->r_address + relocBase)) += slide;
+			rebaseAddr = reloc->r_address + relocBase;
+			if ( ! this->containsAddress((void*)rebaseAddr) )
+				dyld::throwf("local reloc %p not in mapped image\n", (void*)rebaseAddr);
+			*((uintptr_t*)rebaseAddr) += slide;
+			if ( context.verboseRebase )
+				dyld::log("dyld: rebase: %s:*0x%08lX += 0x%08lX\n", this->getShortName(), rebaseAddr, slide);
 		#else	
 			if ( (reloc->r_address & R_SCATTERED) == 0 ) {
 				if ( reloc->r_symbolnum == R_ABS ) {
@@ -832,17 +800,13 @@
 				else if (reloc->r_length == RELOC_SIZE) {
 					switch(reloc->r_type) {
 						case GENERIC_RELOC_VANILLA:
-							*((uintptr_t*)(reloc->r_address + relocBase)) += slide;
+							rebaseAddr = reloc->r_address + relocBase;
+							if ( ! this->containsAddress((void*)rebaseAddr) )
+								dyld::throwf("local reloc %p not in mapped image\n", (void*)rebaseAddr);
+							*((uintptr_t*)rebaseAddr) += slide;
+							if ( context.verboseRebase )
+								dyld::log("dyld: rebase: %s:*0x%08lX += 0x%08lX\n", this->getShortName(), rebaseAddr, slide);
 							break;
-			#if __ppc__
-						case PPC_RELOC_HI16: 
-						case PPC_RELOC_LO16: 
-						case PPC_RELOC_HA16: 
-							// some tools leave object file relocations in linked images
-							otherRelocsPPC((uintptr_t*)(reloc->r_address + relocBase), reloc->r_type, reloc[1].r_address, slide);
-							++reloc; // these relocations come in pairs, skip next
-							break;
-			#endif
 						default:
 							throw "unknown local relocation type";
 					}
@@ -857,26 +821,13 @@
 					uintptr_t* locationToFix = (uintptr_t*)(sreloc->r_address + relocBase);
 					switch(sreloc->r_type) {
 						case GENERIC_RELOC_VANILLA:
+							if ( ! this->containsAddress((void*)locationToFix) ) 
+								dyld::throwf("local scattered reloc %p not in mapped image\n", locationToFix);
 							*locationToFix += slide;
+							if ( context.verboseRebase )
+								dyld::log("dyld: rebase: %s:*0x%08lX += 0x%08lX\n", this->getShortName(), (uintptr_t)locationToFix, slide);
 							break;
-			#if __ppc__
-						case PPC_RELOC_HI16: 
-						case PPC_RELOC_LO16: 
-						case PPC_RELOC_HA16: 
-							// Metrowerks compiler sometimes leaves object file relocations in linked images???
-							++reloc; // these relocations come in pairs, get next one
-							otherRelocsPPC(locationToFix, sreloc->r_type, reloc->r_address, slide);
-							break;
-						case PPC_RELOC_PB_LA_PTR:
-							// do nothing
-							break;
-			#elif __ppc64__
-						case PPC_RELOC_PB_LA_PTR:
-							// needed for compatibility with ppc64 binaries built with the first ld64
-							// which used PPC_RELOC_PB_LA_PTR relocs instead of GENERIC_RELOC_VANILLA for lazy pointers
-							*locationToFix += slide;
-							break;
-			#elif __i386__
+			#if __i386__
 						case GENERIC_RELOC_PB_LA_PTR:
 							// do nothing
 							break;
@@ -932,7 +883,7 @@
 		noteAccessedLinkEditAddress(pivot);
 		noteAccessedLinkEditAddress(pivotStr);
 #endif
-		int cmp = astrcmp(key, pivotStr);
+		int cmp = strcmp(key, pivotStr);
 		if ( cmp == 0 )
 			return pivot;
 		if ( cmp > 0 ) {
@@ -964,7 +915,7 @@
 		noteAccessedLinkEditAddress(pivot);
 		noteAccessedLinkEditAddress(pivotStr);
 #endif
-		int cmp = astrcmp(key, pivotStr);
+		int cmp = strcmp(key, pivotStr);
 		if ( cmp == 0 )
 			return pivot;
 		if ( cmp > 0 ) {
@@ -1006,7 +957,7 @@
 }
 
 
-uintptr_t ImageLoaderMachOClassic::exportedSymbolAddress(const LinkContext& context, const Symbol* symbol, bool runResolver) const
+uintptr_t ImageLoaderMachOClassic::exportedSymbolAddress(const LinkContext& context, const Symbol* symbol, const ImageLoader* requestor, bool runResolver) const
 {
 	const struct macho_nlist* sym = (macho_nlist*)symbol;
 	uintptr_t result = sym->n_value + fSlide;
@@ -1111,8 +1062,8 @@
 		}
 		const Symbol* sym;
 		if ( context.flatExportFinder(symbolName, &sym, foundIn) ) {
-			if ( (*foundIn != this) && !(*foundIn)->neverUnload() )
-					this->addDynamicReference(*foundIn);
+			if ( *foundIn != this )
+				context.addDynamicReference(this, const_cast<ImageLoader*>(*foundIn));
 			return (*foundIn)->getExportedSymbolAddress(sym, context, this);
 		}
 		// if a bundle is loaded privately the above will not find its exports
@@ -1127,15 +1078,15 @@
 			// if reference is weak_import, then it is ok, just return 0
 			return 0;
 		}
-		throwSymbolNotFound(context, symbolName, this->getPath(), "flat namespace");
+		throwSymbolNotFound(context, symbolName, this->getPath(), "", "flat namespace");
 	}
 	else {
 		// symbol requires searching images with coalesced symbols (not done during prebinding)
 		if ( !context.prebinding && !dontCoalesce && (symbolIsWeakReference(undefinedSymbol) || symbolIsWeakDefinition(undefinedSymbol)) ) {
 			const Symbol* sym;
 			if ( context.coalescedExportFinder(symbolName, &sym, foundIn) ) {
-				if ( (*foundIn != this) && !(*foundIn)->neverUnload() )
-					this->addDynamicReference(*foundIn);
+				if ( *foundIn != this )
+					context.addDynamicReference(this, const_cast<ImageLoader*>(*foundIn));
 				return (*foundIn)->getExportedSymbolAddress(sym, context, this);
 			}
 			//throwSymbolNotFound(context, symbolName, this->getPath(), "coalesced namespace");
@@ -1172,7 +1123,7 @@
 			if ( context.flatExportFinder(symbolName, &sym, foundIn) )
 				return (*foundIn)->getExportedSymbolAddress(sym, context, this);
 			
-			throwSymbolNotFound(context, symbolName, this->getPath(), "dynamic lookup");
+			throwSymbolNotFound(context, symbolName, this->getPath(), "", "dynamic lookup");
 		}
 		else if ( ord <= libraryCount() ) {
 			target = libImage(ord-1);
@@ -1206,7 +1157,7 @@
 		}
 		
 		// nowhere to be found
-		throwSymbolNotFound(context, symbolName, this->getPath(), target->getPath());
+		throwSymbolNotFound(context, symbolName, this->getPath(), "", target->getPath());
 	}
 }
 
@@ -1266,6 +1217,8 @@
 					{
 						const struct macho_nlist* undefinedSymbol = &fSymbolTable[reloc->r_symbolnum];
 						uintptr_t* location = ((uintptr_t*)(reloc->r_address + relocBase));
+						if ( ! this->containsAddress((void*)location) )
+							dyld::throwf("external reloc %p not in mapped image %s\n", (void*)location, this->getPath());
 						uintptr_t value = *location;
 						bool symbolAddrCached = true;
 					#if __i386__
@@ -1456,11 +1409,11 @@
 						const uint8_t type = sect->flags & SECTION_TYPE;
 						uint32_t symbolIndex = INDIRECT_SYMBOL_LOCAL;
 						if ( type == S_LAZY_SYMBOL_POINTERS ) {
-							const uint32_t pointerCount = sect->size / sizeof(uintptr_t);
+							const size_t pointerCount = sect->size / sizeof(uintptr_t);
 							uintptr_t* const symbolPointers = (uintptr_t*)(sect->addr + fSlide);
 							if ( (lazyPointer >= symbolPointers) && (lazyPointer < &symbolPointers[pointerCount]) ) {
 								const uint32_t indirectTableOffset = sect->reserved1;
-								const uint32_t lazyIndex = lazyPointer - symbolPointers;
+								const size_t lazyIndex = lazyPointer - symbolPointers;
 								symbolIndex = indirectTable[indirectTableOffset + lazyIndex];
 							}
 						}
@@ -1573,7 +1526,7 @@
 		symbol_index = toc[it.curIndex-1].symbol_index;
 	}
 	else {
-		symbol_index = fDynamicInfo->iextdefsym+it.curIndex-1;
+		symbol_index = fDynamicInfo->iextdefsym + (uint32_t)it.curIndex - 1;
 	}	
 	const struct macho_nlist* sym = &fSymbolTable[symbol_index];
 	//dyld::log("getAddressCoalIterator() => 0x%llX, %s symbol_index=%d, in %s\n", (uint64_t)(sym->n_value + fSlide), &fStrings[sym->n_un.n_strx], symbol_index, this->getPath());
@@ -1608,7 +1561,7 @@
 		symbol_index = toc[it.curIndex-1].symbol_index;
 	}
 	else {
-		symbol_index = fDynamicInfo->iextdefsym+it.curIndex-1;
+		symbol_index = fDynamicInfo->iextdefsym + (uint32_t)it.curIndex - 1;
 	}	
 
 	// if this image's copy of the symbol is not a weak definition nor a weak reference then nothing to coalesce here
@@ -1718,11 +1671,11 @@
 					case S_NON_LAZY_SYMBOL_POINTERS:
 					case S_LAZY_SYMBOL_POINTERS:
 					{
-						uint32_t elementCount = sect->size / elementSize;
+						size_t elementCount = sect->size / elementSize;
 						const uint32_t indirectTableOffset = sect->reserved1;
 						uint8_t* ptrToBind = (uint8_t*)(sect->addr + fSlide);
 						//dyld::log(" scanning section %s of %s starting at %p\n", sect->sectname, this->getShortName(), ptrToBind);
-						for (uint32_t j=0; j < elementCount; ++j, ptrToBind += elementSize) {
+						for (size_t j=0; j < elementCount; ++j, ptrToBind += elementSize) {
 							if ( indirectTable[indirectTableOffset + j] == symbol_index ) {
 								//dyld::log("  found symbol index match at %d/%d, ptrToBind=%p\n", j, elementCount, ptrToBind);
 								// update pointer
@@ -1737,8 +1690,9 @@
 		}
 		cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
 	}
-	if ( boundSomething && (targetImage != this) && !targetImage->neverUnload() )
-		this->addDynamicReference(targetImage);
+	if ( boundSomething && (targetImage != this) ) {
+		context.addDynamicReference(this, targetImage);
+	}
 	
 	// mark that this symbol has already been bound, so we don't try to bind again
 	it.type = 1;
@@ -1764,7 +1718,7 @@
 						bool isLazySymbol = false;
 						const uint8_t type = sect->flags & SECTION_TYPE;
 						uint32_t elementSize = sizeof(uintptr_t);
-						uint32_t elementCount = sect->size / elementSize;
+						size_t elementCount = sect->size / elementSize;
 						if ( type == S_NON_LAZY_SYMBOL_POINTERS ) {
 							if ( ! bindNonLazys )
 								continue;
@@ -1792,7 +1746,7 @@
 						}
 						const uint32_t indirectTableOffset = sect->reserved1;
 						uint8_t* ptrToBind = (uint8_t*)(sect->addr + fSlide);
-						for (uint32_t j=0; j < elementCount; ++j, ptrToBind += elementSize) {
+						for (size_t j=0; j < elementCount; ++j, ptrToBind += elementSize) {
 				#if LINKEDIT_USAGE_DEBUG
 							noteAccessedLinkEditAddress(&indirectTable[indirectTableOffset + j]);
 				#endif
@@ -1885,7 +1839,7 @@
 							const uint32_t* const indirectTable = (uint32_t*)&fLinkEditBase[fDynamicInfo->indirectsymoff];
 							uint8_t* start = (uint8_t*)(sect->addr + this->fSlide);
 							uint8_t* end = start + sect->size;
-							uintptr_t dyldHandler = (uintptr_t)&fast_stub_binding_helper_interface;
+							uintptr_t dyldHandler = (uintptr_t)&stub_binding_helper_i386_old;
 							uint32_t entryIndex = 0;
 							for (uint8_t* entry = start; entry < end; entry += 5, ++entryIndex) {
 								bool installLazyHandler = true;
@@ -2003,19 +1957,12 @@
 					for (const struct macho_section* sect=sectionsStart; sect < sectionsEnd; ++sect) {
 						const uint8_t type = sect->flags & SECTION_TYPE;
 						if ( (type == S_NON_LAZY_SYMBOL_POINTERS) || (type == S_LAZY_SYMBOL_POINTERS) ) {
-							const uint32_t pointerCount = sect->size / sizeof(uintptr_t);
+							const size_t pointerCount = sect->size / sizeof(uintptr_t);
 							uintptr_t* const symbolPointers = (uintptr_t*)(sect->addr + fSlide);
-							for (uint32_t pointerIndex=0; pointerIndex < pointerCount; ++pointerIndex) {
-								for (std::vector<InterposeTuple>::iterator it=fgInterposingTuples.begin(); it != fgInterposingTuples.end(); it++) {
-									// replace all references to 'replacee' with 'replacement'
-									if ( (symbolPointers[pointerIndex] == it->replacee) && (this != it->replacementImage) ) {
-										if ( context.verboseInterposing ) {
-											dyld::log("dyld: interposing: at %p replace 0x%lX with 0x%lX in %s\n", 
-												&symbolPointers[pointerIndex], it->replacee, it->replacement, this->getPath());
-										}
-										symbolPointers[pointerIndex] = it->replacement;
-									}
-								}
+							for (size_t pointerIndex=0; pointerIndex < pointerCount; ++pointerIndex) {
+								uintptr_t newValue = interposedAddress(context, symbolPointers[pointerIndex], this);
+								if ( newValue != symbolPointers[pointerIndex] )
+									symbolPointers[pointerIndex] = newValue;
 							}
 						}
 				#if __i386__
@@ -2028,16 +1975,10 @@
 								if ( entry[0] == 0xE9 ) { // 0xE9 == JMP 
 									uint32_t rel32 = *((uint32_t*)&entry[1]); // assume unaligned load of uint32_t is ok
 									uint32_t target = (uint32_t)&entry[5] + rel32;
-									for (std::vector<InterposeTuple>::iterator it=fgInterposingTuples.begin(); it != fgInterposingTuples.end(); it++) {
-										// replace all references to 'replacee' with 'replacement'
-										if ( (it->replacee == target) && (this != it->replacementImage) ) {
-											if ( context.verboseInterposing ) {
-												dyld::log("dyld: interposing: at %p replace JMP 0x%lX with JMP 0x%lX in %s\n", 
-													&entry[1], it->replacee, it->replacement, this->getPath());
-											}
-											uint32_t newRel32 = it->replacement - (uint32_t)&entry[5];
-											*((uint32_t*)&entry[1]) = newRel32; // assume unaligned store of uint32_t is ok
-										}
+									uint32_t newTarget = interposedAddress(context, target, this);
+									if ( newTarget != target ) {
+										uint32_t newRel32 = newTarget - (uint32_t)&entry[5];
+										*((uint32_t*)&entry[1]) = newRel32; // assume unaligned store of uint32_t is ok
 									}
 								}
 							}
@@ -2060,14 +2001,76 @@
 				case POINTER_RELOC:
 					{
 						uintptr_t* location = ((uintptr_t*)(reloc->r_address + relocBase));
-						for (std::vector<InterposeTuple>::iterator it=fgInterposingTuples.begin(); it != fgInterposingTuples.end(); it++) {
+						uintptr_t value = *location;
+						uintptr_t newValue = interposedAddress(context, value, this);
+						if ( newValue != value )
+							*location = newValue;
+					}
+					break;
+			}
+		}
+	}
+}
+
+void ImageLoaderMachOClassic::dynamicInterpose(const LinkContext& context) 
+{
+	if ( context.verboseInterposing )
+		dyld::log("dyld: dynamic interposing %lu tuples onto image: %s\n", context.dynamicInterposeCount, this->getPath());
+
+	// scan indirect symbols
+	const uint32_t cmd_count = ((macho_header*)fMachOData)->ncmds;
+	const struct load_command* const cmds = (struct load_command*)&fMachOData[sizeof(macho_header)];
+	const struct load_command* cmd = cmds;
+	for (uint32_t i = 0; i < cmd_count; ++i) {
+		switch (cmd->cmd) {
+			case LC_SEGMENT_COMMAND:
+				{
+					const struct macho_segment_command* seg = (struct macho_segment_command*)cmd;
+					const struct macho_section* const sectionsStart = (struct macho_section*)((char*)seg + sizeof(struct macho_segment_command));
+					const struct macho_section* const sectionsEnd = &sectionsStart[seg->nsects];
+					for (const struct macho_section* sect=sectionsStart; sect < sectionsEnd; ++sect) {
+						const uint8_t type = sect->flags & SECTION_TYPE;
+						if ( (type == S_NON_LAZY_SYMBOL_POINTERS) || (type == S_LAZY_SYMBOL_POINTERS) ) {
+							const size_t pointerCount = sect->size / sizeof(uintptr_t);
+							uintptr_t* const symbolPointers = (uintptr_t*)(sect->addr + fSlide);
+							for (size_t pointerIndex=0; pointerIndex < pointerCount; ++pointerIndex) {
+								for(size_t i=0; i < context.dynamicInterposeCount; ++i) {
+									// replace all references to 'replacee' with 'replacement'
+									if ( symbolPointers[pointerIndex] == (uintptr_t)context.dynamicInterposeArray[i].replacee ) {
+										if ( context.verboseInterposing ) {
+											dyld::log("dyld: dynamic interposing: at %p replace %p with %p in %s\n", 
+												&symbolPointers[pointerIndex], context.dynamicInterposeArray[i].replacee, context.dynamicInterposeArray[i].replacement, this->getPath());
+										}
+										symbolPointers[pointerIndex] = (uintptr_t)context.dynamicInterposeArray[i].replacement;
+									}
+								}
+							}
+						}
+					}
+				}
+				break;
+		}
+		cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
+	}
+	
+	// scan external relocations 
+	const uintptr_t relocBase = this->getRelocBase();
+	const relocation_info* const relocsStart = (struct relocation_info*)(&fLinkEditBase[fDynamicInfo->extreloff]);
+	const relocation_info* const relocsEnd = &relocsStart[fDynamicInfo->nextrel];
+	for (const relocation_info* reloc=relocsStart; reloc < relocsEnd; ++reloc) {
+		if (reloc->r_length == RELOC_SIZE) {
+			switch(reloc->r_type) {
+				case POINTER_RELOC:
+					{
+						uintptr_t* location = ((uintptr_t*)(reloc->r_address + relocBase));
+						for(size_t i=0; i < context.dynamicInterposeCount; ++i) {
 							// replace all references to 'replacee' with 'replacement'
-							if ( (*location == it->replacee) && (this != it->replacementImage) ) {
+							if ( *location == (uintptr_t)context.dynamicInterposeArray[i].replacee ) {
 								if ( context.verboseInterposing ) {
-									dyld::log("dyld: interposing: at %p replace 0x%lX with 0x%lX in %s\n", 
-										location, it->replacee, it->replacement, this->getPath());
+									dyld::log("dyld: dynamic interposing: at %p replace %p with %p in %s\n", 
+										location, context.dynamicInterposeArray[i].replacee, context.dynamicInterposeArray[i].replacement, this->getPath());
 								}
-								*location = it->replacement;
+								*location = (uintptr_t)context.dynamicInterposeArray[i].replacement;
 							}
 						}
 					}