Loading...
src/ImageLoaderMachOCompressed.cpp dyld-195.6 dyld-360.18
--- dyld/dyld-195.6/src/ImageLoaderMachOCompressed.cpp
+++ dyld/dyld-360.18/src/ImageLoaderMachOCompressed.cpp
@@ -23,21 +23,27 @@
  */
 
 
+#if __arm__ || __arm64__
+  #include <System/sys/mman.h>
+#else
+  #include <sys/mman.h>
+#endif
 #include <string.h>
 #include <fcntl.h>
 #include <errno.h>
 #include <sys/types.h>
 #include <sys/fcntl.h>
 #include <sys/stat.h> 
-#include <sys/mman.h>
 #include <sys/param.h>
 #include <mach/mach.h>
 #include <mach/thread_status.h>
 #include <mach-o/loader.h> 
-
 #include "ImageLoaderMachOCompressed.h"
 #include "mach-o/dyld_images.h"
 
+#ifndef EXPORT_SYMBOL_FLAGS_KIND_ABSOLUTE
+	#define EXPORT_SYMBOL_FLAGS_KIND_ABSOLUTE			0x02
+#endif
 
 // relocation_info.r_length field has value 3 for 64-bit executables and value 2 for 32-bit executables
 #if __LP64__
@@ -87,7 +93,7 @@
 		if (p == end)
 			throw "malformed sleb128";
 		byte = *p++;
-		result |= ((byte & 0x7f) << bit);
+		result |= (((int64_t)(byte & 0x7f)) << bit);
 		bit += 7;
 	} while (byte & 0x80);
 	// sign extend negative numbers
@@ -109,11 +115,11 @@
 	// for PIE record end of program, to know where to start loading dylibs
 	if ( slide != 0 )
 		fgNextPIEDylibAddress = (uintptr_t)image->getEnd();
-	
-	image->setNeverUnload();
+
+	image->disableCoverageCheck();
 	image->instantiateFinish(context);
 	image->setMapped(context);
-	
+
 	if ( context.verboseMapping ) {
 		dyld::log("dyld: Main executable mapped %s\n", path);
 		for(unsigned int i=0, e=image->segmentCount(); i < e; ++i) {
@@ -129,10 +135,12 @@
 }
 
 // create image by mapping in a mach-o file
-ImageLoaderMachOCompressed* ImageLoaderMachOCompressed::instantiateFromFile(const char* path, int fd, const uint8_t* fileData, 
+ImageLoaderMachOCompressed* ImageLoaderMachOCompressed::instantiateFromFile(const char* path, int fd, const uint8_t* fileData, size_t lenFileData,
 															uint64_t offsetInFat, uint64_t lenInFat, const struct stat& info, 
 															unsigned int segCount, unsigned int libCount, 
-															const struct linkedit_data_command* codeSigCmd, const LinkContext& context)
+															const struct linkedit_data_command* codeSigCmd, 
+															const struct encryption_info_command* encryptCmd, 
+															const LinkContext& context)
 {
 	ImageLoaderMachOCompressed* image = ImageLoaderMachOCompressed::instantiateStart((macho_header*)fileData, path, segCount, libCount);
 
@@ -140,14 +148,20 @@
 		// record info about file  
 		image->setFileInfo(info.st_dev, info.st_ino, info.st_mtime);
 
-	#if CODESIGNING_SUPPORT
 		// if this image is code signed, let kernel validate signature before mapping any pages from image
-		if ( codeSigCmd != NULL )
-			image->loadCodeSignature(codeSigCmd, fd, offsetInFat);
-	#endif
+		image->loadCodeSignature(codeSigCmd, fd, offsetInFat, context);
 		
+		// Validate that first data we read with pread actually matches with code signature
+		image->validateFirstPages(codeSigCmd, fd, fileData, lenFileData, offsetInFat, context);
+
 		// mmap segments
 		image->mapSegments(fd, offsetInFat, lenInFat, info.st_size, context);
+
+		// if framework is FairPlay encrypted, register with kernel
+		image->registerEncryption(encryptCmd, context);
+		
+		// probe to see if code signed correctly
+		image->crashIfInvalidCodeSignature();
 
 		// finish construction
 		image->instantiateFinish(context);
@@ -161,11 +175,12 @@
 		else if ( (installName != NULL) && (strcmp(path, "/usr/lib/libgcc_s.1.dylib") == 0) && (strcmp(installName, "/usr/lib/libSystem.B.dylib") == 0) )
 			image->setPathUnowned("/usr/lib/libSystem.B.dylib");
 #endif
-		else if ( path[0] != '/' ) {
+		else if ( (path[0] != '/') || (strstr(path, "../") != NULL) ) {
+			// rdar://problem/10733082 Fix up @rpath based paths during introspection
 			// rdar://problem/5135363 turn relative paths into absolute paths so gdb, Symbolication can later find them
 			char realPath[MAXPATHLEN];
-			if ( realpath(path, realPath) != NULL )
-				image->setPath(realPath);
+			if ( fcntl(fd, F_GETPATH, realPath) == 0 ) 
+				image->setPaths(path, realPath);
 			else
 				image->setPath(path);
 		}
@@ -204,9 +219,9 @@
 
 		// remember this is from shared cache and cannot be unloaded
 		image->fInSharedCache = true;
-		image->fGoodFirstSegment = true;
 		image->setNeverUnload();
 		image->setSlide(slide);
+		image->disableCoverageCheck();
 
 		// segments already mapped in cache
 		if ( context.verboseMapping ) {
@@ -245,6 +260,8 @@
 		// for compatibility, never unload dylibs loaded from memory
 		image->setNeverUnload();
 
+		image->disableCoverageCheck();
+
 		// bundle loads need path copied
 		if ( moduleName != NULL ) 
 			image->setPath(moduleName);
@@ -295,7 +312,7 @@
 void ImageLoaderMachOCompressed::instantiateFinish(const LinkContext& context)
 {
 	// now that segments are mapped in, get real fMachOData, fLinkEditBase, and fSlide
-	this->parseLoadCmds();
+	this->parseLoadCmds(context);
 }
 
 uint32_t* ImageLoaderMachOCompressed::segmentCommandOffsets() const
@@ -372,11 +389,11 @@
 		
 			
 	// round to whole pages
-	start = start & (-4096);
-	end = (end + 4095) & (-4096);
+	start = dyld_page_trunc(start);
+	end = dyld_page_round(end);
 
 	// do nothing if only one page of rebase/bind info
-	if ( (end-start) <= 4096 )
+	if ( (end-start) <= dyld_page_size )
 		return;
 	
 	// tell kernel about our access to these pages
@@ -393,6 +410,9 @@
 
 void ImageLoaderMachOCompressed::rebaseAt(const LinkContext& context, uintptr_t addr, uintptr_t slide, uint8_t type)
 {
+	if ( context.verboseRebase ) {
+		dyld::log("dyld: rebase: %s:*0x%08lX += 0x%08lX\n", this->getShortName(), (uintptr_t)addr, slide);
+	}
 	//dyld::log("0x%08lX type=%d\n", addr, type);
 	uintptr_t* locationToFix = (uintptr_t*)addr;
 	switch (type) {
@@ -428,8 +448,8 @@
 		int segmentIndex = 0;
 		uintptr_t address = segActualLoadAddress(0);
 		uintptr_t segmentEndAddress = segActualEndAddress(0);
-		uint32_t count;
-		uint32_t skip;
+		uintptr_t count;
+		uintptr_t skip;
 		bool done = false;
 		while ( !done && (p < end) ) {
 			uint8_t immediate = *p & REBASE_IMMEDIATE_MASK;
@@ -444,9 +464,9 @@
 					break;
 				case REBASE_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB:
 					segmentIndex = immediate;
-					if ( segmentIndex > fSegmentsCount )
-						dyld::throwf("REBASE_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is too large (%d)\n", 
-								segmentIndex, fSegmentsCount);
+					if ( segmentIndex >= fSegmentsCount )
+						dyld::throwf("REBASE_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is too large (0..%d)",
+								segmentIndex, fSegmentsCount-1);
 					address = segActualLoadAddress(segmentIndex) + read_uleb128(p, end);
 					segmentEndAddress = segActualEndAddress(segmentIndex);
 					break;
@@ -514,7 +534,7 @@
 {
 	const uint8_t* p = start;
 	while ( p != NULL ) {
-		uint32_t terminalSize = *p++;
+		uintptr_t terminalSize = *p++;
 		if ( terminalSize > 127 ) {
 			// except for re-export-with-rename, all terminal sizes fit in one byte
 			--p;
@@ -528,7 +548,7 @@
 		//dyld::log("trieWalk(%p) sym=%s, terminalSize=%d, children=%p\n", start, s, terminalSize, children);
 		uint8_t childrenRemaining = *children++;
 		p = children;
-		uint32_t nodeOffset = 0;
+		uintptr_t nodeOffset = 0;
 		for (; childrenRemaining > 0; --childrenRemaining) {
 			const char* ss = s;
 			//dyld::log("trieWalk(%p) child str=%s\n", start, (char*)p);
@@ -587,16 +607,16 @@
 	const uint8_t* foundNodeStart = this->trieWalk(start, end, symbol); 
 	if ( foundNodeStart != NULL ) {
 		const uint8_t* p = foundNodeStart;
-		const uint32_t flags = read_uleb128(p, end);
+		const uintptr_t flags = read_uleb128(p, end);
 		// found match, return pointer to terminal part of node
 		if ( flags & EXPORT_SYMBOL_FLAGS_REEXPORT ) {
 			// re-export from another dylib, lookup there
-			const uint32_t ordinal = read_uleb128(p, end);
+			const uintptr_t ordinal = read_uleb128(p, end);
 			const char* importedName = (char*)p;
 			if ( importedName[0] == '\0' )
 				importedName = symbol;
 			if ( (ordinal > 0) && (ordinal <= libraryCount()) ) {
-				const ImageLoader* reexportedFrom = libImage(ordinal-1);
+				const ImageLoader* reexportedFrom = libImage((unsigned int)ordinal-1);
 				//dyld::log("Compressed::findExportedSymbol(), %s -> %s/%s\n", symbol, reexportedFrom->getShortName(), importedName);
 				return reexportedFrom->findExportedSymbol(importedName, true, foundIn);
 			}
@@ -625,7 +645,7 @@
 }
 
 
-uintptr_t ImageLoaderMachOCompressed::exportedSymbolAddress(const LinkContext& context, const Symbol* symbol, bool runResolver) const
+uintptr_t ImageLoaderMachOCompressed::exportedSymbolAddress(const LinkContext& context, const Symbol* symbol, const ImageLoader* requestor, bool runResolver) const
 {
 	const uint8_t* exportNode = (uint8_t*)symbol;
 	const uint8_t* exportTrieStart = fLinkEditBase + fDyldInfo->export_off;
@@ -633,27 +653,36 @@
 	if ( (exportNode < exportTrieStart) || (exportNode > exportTrieEnd) )
 		throw "symbol is not in trie";
 	//dyld::log("exportedSymbolAddress(): node=%p, nodeOffset=0x%04X in %s\n", symbol, (int)((uint8_t*)symbol - exportTrieStart), this->getShortName());
-	uint32_t flags = read_uleb128(exportNode, exportTrieEnd);
-	if ( (flags & EXPORT_SYMBOL_FLAGS_KIND_MASK) == EXPORT_SYMBOL_FLAGS_KIND_REGULAR ) {
-		if ( runResolver && (flags & EXPORT_SYMBOL_FLAGS_STUB_AND_RESOLVER) ) {
-			// this node has a stub and resolver, run the resolver to get target address
-			read_uleb128(exportNode, exportTrieEnd); // skip over stub
-			typedef uintptr_t (*ResolverProc)(void);
-			ResolverProc resolver = (ResolverProc)(read_uleb128(exportNode, exportTrieEnd) + (uintptr_t)fMachOData);
-			uintptr_t result = (*resolver)();
-			if ( context.verboseBind )
-				dyld::log("dyld: resolver at %p returned 0x%08lX\n", resolver, result);
-			return result;
-		}
-		return read_uleb128(exportNode, exportTrieEnd) + (uintptr_t)fMachOData;
-	}
-	else if ( (flags & EXPORT_SYMBOL_FLAGS_KIND_MASK) == EXPORT_SYMBOL_FLAGS_KIND_THREAD_LOCAL ) {
-		if ( flags & EXPORT_SYMBOL_FLAGS_STUB_AND_RESOLVER )
-			dyld::throwf("unsupported exported symbol kind. flags=%d at node=%p", flags, symbol);
-		return read_uleb128(exportNode, exportTrieEnd) + (uintptr_t)fMachOData;
-	}
-	else
-		dyld::throwf("unsupported exported symbol kind. flags=%d at node=%p", flags, symbol);
+	uintptr_t flags = read_uleb128(exportNode, exportTrieEnd);
+	switch ( flags & EXPORT_SYMBOL_FLAGS_KIND_MASK ) {
+		case EXPORT_SYMBOL_FLAGS_KIND_REGULAR:
+			if ( runResolver && (flags & EXPORT_SYMBOL_FLAGS_STUB_AND_RESOLVER) ) {
+				// this node has a stub and resolver, run the resolver to get target address
+				uintptr_t stub = read_uleb128(exportNode, exportTrieEnd) + (uintptr_t)fMachOData; // skip over stub
+				// <rdar://problem/10657737> interposing dylibs have the stub address as their replacee
+				uintptr_t interposedStub = interposedAddress(context, stub, requestor);
+				if ( interposedStub != stub )
+					return interposedStub;
+				// stub was not interposed, so run resolver
+				typedef uintptr_t (*ResolverProc)(void);
+				ResolverProc resolver = (ResolverProc)(read_uleb128(exportNode, exportTrieEnd) + (uintptr_t)fMachOData);
+				uintptr_t result = (*resolver)();
+				if ( context.verboseBind )
+					dyld::log("dyld: resolver at %p returned 0x%08lX\n", resolver, result);
+				return result;
+			}
+			return read_uleb128(exportNode, exportTrieEnd) + (uintptr_t)fMachOData;
+		case EXPORT_SYMBOL_FLAGS_KIND_THREAD_LOCAL:
+			if ( flags & EXPORT_SYMBOL_FLAGS_STUB_AND_RESOLVER )
+				dyld::throwf("unsupported exported symbol kind. flags=%lu at node=%p", flags, symbol);
+			return read_uleb128(exportNode, exportTrieEnd) + (uintptr_t)fMachOData;
+		case EXPORT_SYMBOL_FLAGS_KIND_ABSOLUTE:
+			if ( flags & EXPORT_SYMBOL_FLAGS_STUB_AND_RESOLVER )
+				dyld::throwf("unsupported exported symbol kind. flags=%lu at node=%p", flags, symbol);
+			return read_uleb128(exportNode, exportTrieEnd);
+		default:
+			dyld::throwf("unsupported exported symbol kind. flags=%lu at node=%p", flags, symbol);
+	}
 }
 
 bool ImageLoaderMachOCompressed::exportedSymbolIsWeakDefintion(const Symbol* symbol) const
@@ -663,7 +692,7 @@
 	const uint8_t* exportTrieEnd = exportTrieStart + fDyldInfo->export_size;
 	if ( (exportNode < exportTrieStart) || (exportNode > exportTrieEnd) )
 		throw "symbol is not in trie";
-	uint32_t flags = read_uleb128(exportNode, exportTrieEnd);
+	uintptr_t flags = read_uleb128(exportNode, exportTrieEnd);
 	return ( flags & EXPORT_SYMBOL_FLAGS_WEAK_DEFINITION );
 }
 
@@ -705,8 +734,8 @@
 {
 	const Symbol* sym;
 	if ( context.flatExportFinder(symbolName, &sym, foundIn) ) {
-		if ( (*foundIn != this) && !(*foundIn)->neverUnload() )
-				this->addDynamicReference(*foundIn);
+		if ( *foundIn != this )
+			context.addDynamicReference(this, const_cast<ImageLoader*>(*foundIn));
 		return (*foundIn)->getExportedSymbolAddress(sym, context, this, runResolver);
 	}
 	// if a bundle is loaded privately the above will not find its exports
@@ -720,7 +749,7 @@
 		// definition can't be found anywhere, ok because it is weak, just return 0
 		return 0;
 	}
-	throwSymbolNotFound(context, symbolName, this->getPath(), "flat namespace");
+	throwSymbolNotFound(context, symbolName, this->getPath(), "", "flat namespace");
 }
 
 
@@ -738,13 +767,29 @@
 		return 0;
 	}
 
-	// nowhere to be found
-	throwSymbolNotFound(context, symbolName, this->getPath(), targetImage->getPath());
+	// nowhere to be found, check if maybe this image is too new for this OS
+	char versMismatch[256];
+	versMismatch[0] = '\0';
+	uint32_t imageMinOS = this->minOSVersion();
+	// dyld is always built for the current OS, so we can get the current OS version
+	// from the load command in dyld itself.
+	extern const mach_header __dso_handle;
+	uint32_t dyldMinOS = ImageLoaderMachO::minOSVersion(&__dso_handle);
+	if ( imageMinOS > dyldMinOS ) {
+#if __MAC_OS_X_VERSION_MIN_REQUIRED
+		const char* msg = dyld::mkstringf(" (which was built for Mac OS X %d.%d)", imageMinOS >> 16, (imageMinOS >> 8) & 0xFF);
+#else
+		const char* msg = dyld::mkstringf(" (which was built for iOS %d.%d)", imageMinOS >> 16, (imageMinOS >> 8) & 0xFF);
+#endif
+		strcpy(versMismatch, msg);
+		::free((void*)msg);
+	}
+	throwSymbolNotFound(context, symbolName, this->getPath(), versMismatch, targetImage->getPath());
 }
 
 
 uintptr_t ImageLoaderMachOCompressed::resolve(const LinkContext& context, const char* symbolName, 
-													uint8_t symboFlags, int libraryOrdinal, const ImageLoader** targetImage,
+													uint8_t symboFlags, long libraryOrdinal, const ImageLoader** targetImage,
 													LastLookup* last, bool runResolver)
 {
 	*targetImage = NULL;
@@ -772,14 +817,14 @@
 			*targetImage = this;
 		}
 		else if ( libraryOrdinal <= 0 ) {
-			dyld::throwf("bad mach-o binary, unknown special library ordinal (%u) too big for symbol %s in %s",
+			dyld::throwf("bad mach-o binary, unknown special library ordinal (%ld) too big for symbol %s in %s",
 				libraryOrdinal, symbolName, this->getPath());
 		}
 		else if ( (unsigned)libraryOrdinal <= libraryCount() ) {
-			*targetImage = libImage(libraryOrdinal-1);
+			*targetImage = libImage((unsigned int)libraryOrdinal-1);
 		}
 		else {
-			dyld::throwf("bad mach-o binary, library ordinal (%u) too big (max %u) for symbol %s in %s",
+			dyld::throwf("bad mach-o binary, library ordinal (%ld) too big (max %u) for symbol %s in %s",
 				libraryOrdinal, libraryCount(), symbolName, this->getPath());
 		}
 		if ( *targetImage == NULL ) {
@@ -788,7 +833,7 @@
 				symbolAddress = 0;
 			}
 			else {
-				dyld::throwf("can't resolve symbol %s in %s because dependent dylib #%d could not be loaded",
+				dyld::throwf("can't resolve symbol %s in %s because dependent dylib #%ld could not be loaded",
 					symbolName, this->getPath(), libraryOrdinal);
 			}
 		}
@@ -810,7 +855,7 @@
 }
 
 uintptr_t ImageLoaderMachOCompressed::bindAt(const LinkContext& context, uintptr_t addr, uint8_t type, const char* symbolName, 
-								uint8_t symboFlags, intptr_t addend, int libraryOrdinal, const char* msg, 
+								uint8_t symboFlags, intptr_t addend, long libraryOrdinal, const char* msg, 
 								LastLookup* last, bool runResolver)
 {
 	const ImageLoader*	targetImage;
@@ -895,10 +940,10 @@
 		uintptr_t segmentEndAddress = segActualEndAddress(0);
 		const char* symbolName = NULL;
 		uint8_t symboFlags = 0;
-		int libraryOrdinal = 0;
+		long libraryOrdinal = 0;
 		intptr_t addend = 0;
-		uint32_t count;
-		uint32_t skip;
+		uintptr_t count;
+		uintptr_t skip;
 		LastLookup last = { 0, 0, NULL, 0, NULL };
 		const uint8_t* const start = fLinkEditBase + fDyldInfo->bind_off;
 		const uint8_t* const end = &start[fDyldInfo->bind_size];
@@ -942,9 +987,9 @@
 					break;
 				case BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB:
 					segmentIndex = immediate;
-					if ( segmentIndex > fSegmentsCount )
-						dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is too large (%d)\n", 
-								segmentIndex, fSegmentsCount);
+					if ( segmentIndex >= fSegmentsCount )
+						dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is too large (0..%d)",
+								segmentIndex, fSegmentsCount-1);
 					address = segActualLoadAddress(segmentIndex) + read_uleb128(p, end);
 					segmentEndAddress = segActualEndAddress(segmentIndex);
 					break;
@@ -1000,7 +1045,7 @@
 		uintptr_t segmentEndAddress = segActualEndAddress(0);
 		const char* symbolName = NULL;
 		uint8_t symboFlags = 0;
-		int libraryOrdinal = 0;
+		long libraryOrdinal = 0;
 		intptr_t addend = 0;
 		const uint8_t* const start = fLinkEditBase + fDyldInfo->lazy_bind_off;
 		const uint8_t* const end = &start[fDyldInfo->lazy_bind_size];
@@ -1044,9 +1089,9 @@
 					break;
 				case BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB:
 					segmentIndex = immediate;
-					if ( segmentIndex > fSegmentsCount )
-						dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is too large (%d)\n", 
-								segmentIndex, fSegmentsCount);
+					if ( segmentIndex >= fSegmentsCount )
+						dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is too large (0..%d)",
+								segmentIndex, fSegmentsCount-1);
 					address = segActualLoadAddress(segmentIndex) + read_uleb128(p, end);
 					segmentEndAddress = segActualEndAddress(segmentIndex);
 					break;
@@ -1056,7 +1101,7 @@
 				case BIND_OPCODE_DO_BIND:
 					if ( address >= segmentEndAddress ) 
 						throwBadBindingAddress(address, segmentEndAddress, segmentIndex, start, end, p);
-					(this->*handler)(context, address, type, symbolName, symboFlags, addend, libraryOrdinal, "lazy forced", NULL, true);
+					(this->*handler)(context, address, type, symbolName, symboFlags, addend, libraryOrdinal, "forced lazy ", NULL, false);
 					address += sizeof(intptr_t);
 					break;
 				case BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB:
@@ -1120,11 +1165,11 @@
 						const uint8_t type = sect->flags & SECTION_TYPE;
 						uint32_t symbolIndex = INDIRECT_SYMBOL_LOCAL;
 						if ( type == S_LAZY_SYMBOL_POINTERS ) {
-							const uint32_t pointerCount = sect->size / sizeof(uintptr_t);
+							const size_t pointerCount = sect->size / sizeof(uintptr_t);
 							uintptr_t* const symbolPointers = (uintptr_t*)(sect->addr + fSlide);
 							if ( (lazyPointer >= symbolPointers) && (lazyPointer < &symbolPointers[pointerCount]) ) {
 								const uint32_t indirectTableOffset = sect->reserved1;
-								const uint32_t lazyIndex = lazyPointer - symbolPointers;
+								const size_t lazyIndex = lazyPointer - symbolPointers;
 								symbolIndex = indirectTable[indirectTableOffset + lazyIndex];
 							}
 						}
@@ -1173,7 +1218,7 @@
 	uintptr_t address = 0;
 	const char* symbolName = NULL;
 	uint8_t symboFlags = 0;
-	int libraryOrdinal = 0;
+	long libraryOrdinal = 0;
 	bool done = false;
 	uintptr_t result = 0;
 	const uint8_t* p = &start[lazyBindingInfoOffset];
@@ -1211,9 +1256,9 @@
 				type = immediate;
 				break;
 			case BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB:
-				if ( immediate > fSegmentsCount )
-					dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is too large (%d)\n", 
-							immediate, fSegmentsCount);
+				if ( immediate >= fSegmentsCount )
+					dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is too large (0..%d)", 
+							immediate, fSegmentsCount-1);
 				address = segActualLoadAddress(immediate) + read_uleb128(p, end);
 				break;
 			case BIND_OPCODE_DO_BIND:
@@ -1269,8 +1314,8 @@
 	const uint8_t* start = fLinkEditBase + fDyldInfo->weak_bind_off;
 	const uint8_t* p = start + it.curIndex;
 	const uint8_t* end = fLinkEditBase + fDyldInfo->weak_bind_off + this->fDyldInfo->weak_bind_size;
-	uint32_t count;
-	uint32_t skip;
+	uintptr_t count;
+	uintptr_t skip;
 	while ( p < end ) {
 		uint8_t immediate = *p & BIND_IMMEDIATE_MASK;
 		uint8_t opcode = *p & BIND_OPCODE_MASK;
@@ -1297,9 +1342,9 @@
 				it.addend = read_sleb128(p, end);
 				break;
 			case BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB:
-				if ( immediate > fSegmentsCount )
-					dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is too large (%d)\n", 
-							immediate, fSegmentsCount);
+				if ( immediate >= fSegmentsCount )
+					dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is too large (0..%d)",
+							immediate, fSegmentsCount-1);
 				it.address = segActualLoadAddress(immediate) + read_uleb128(p, end);
 				break;
 			case BIND_OPCODE_ADD_ADDR_ULEB:
@@ -1322,7 +1367,7 @@
 				}
 				break;
 			default:
-				dyld::throwf("bad weak bind opcode %d", *p);
+				dyld::throwf("bad weak bind opcode '%d' found after processing %d bytes in '%s'", *p, (int)(p-start), this->getPath());
 		}
 	}
 	/// hmmm, BIND_OPCODE_DONE is missing...
@@ -1359,8 +1404,8 @@
 	uintptr_t address = it.address;
 	const char* symbolName = it.symbolName;
 	intptr_t addend = it.addend;
-	uint32_t count;
-	uint32_t skip;
+	uintptr_t count;
+	uintptr_t skip;
 	bool done = false;
 	bool boundSomething = false;
 	while ( !done && (p < end) ) {
@@ -1381,9 +1426,9 @@
 				addend = read_sleb128(p, end);
 				break;
 			case BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB:
-				if ( immediate > fSegmentsCount )
-					dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is too large (%d)\n", 
-							immediate, fSegmentsCount);
+				if ( immediate >= fSegmentsCount )
+					dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is too large (0..%d)",
+							immediate, fSegmentsCount-1);
 				address = segActualLoadAddress(immediate) + read_uleb128(p, end);
 				break;
 			case BIND_OPCODE_ADD_ADDR_ULEB:
@@ -1416,42 +1461,67 @@
 			default:
 				dyld::throwf("bad bind opcode %d in weak binding info", *p);
 		}
-	}	
-	if ( boundSomething && (targetImage != this) && !targetImage->neverUnload() )
-		this->addDynamicReference(targetImage);
+	}
+	// C++ weak coalescing cannot be tracked by reference counting.  Error on side of never unloading.
+	if ( boundSomething && (targetImage != this) )
+		context.addDynamicReference(this, targetImage);
 }
 
 uintptr_t ImageLoaderMachOCompressed::interposeAt(const LinkContext& context, uintptr_t addr, uint8_t type, const char*, 
-												uint8_t, intptr_t, int, const char*, LastLookup*, bool runResolver)
+												uint8_t, intptr_t, long, const char*, LastLookup*, bool runResolver)
+{
+	if ( type == BIND_TYPE_POINTER ) {
+		uintptr_t* fixupLocation = (uintptr_t*)addr;
+		uintptr_t curValue = *fixupLocation;
+		uintptr_t newValue = interposedAddress(context, curValue, this);
+		if ( newValue != curValue)
+			*fixupLocation = newValue;
+	}
+	return 0;
+}
+
+void ImageLoaderMachOCompressed::doInterpose(const LinkContext& context)
+{
+	if ( context.verboseInterposing )
+		dyld::log("dyld: interposing %lu tuples onto image: %s\n", fgInterposingTuples.size(), this->getPath());
+
+	// update prebound symbols
+	eachBind(context, &ImageLoaderMachOCompressed::interposeAt);
+	eachLazyBind(context, &ImageLoaderMachOCompressed::interposeAt);
+}
+
+
+uintptr_t ImageLoaderMachOCompressed::dynamicInterposeAt(const LinkContext& context, uintptr_t addr, uint8_t type, const char* symbolName, 
+												uint8_t, intptr_t, long, const char*, LastLookup*, bool runResolver)
 {
 	if ( type == BIND_TYPE_POINTER ) {
 		uintptr_t* fixupLocation = (uintptr_t*)addr;
 		uintptr_t value = *fixupLocation;
-		for (std::vector<InterposeTuple>::iterator it=fgInterposingTuples.begin(); it != fgInterposingTuples.end(); it++) {
-			// replace all references to 'replacee' with 'replacement'
-			if ( (value == it->replacee) && (this != it->replacementImage) ) {
+		// don't apply interposing to table entries.
+		if ( (context.dynamicInterposeArray <= (void*)addr) && ((void*)addr < &context.dynamicInterposeArray[context.dynamicInterposeCount]) )
+			return 0;
+		for(size_t i=0; i < context.dynamicInterposeCount; ++i) {
+			if ( value == (uintptr_t)context.dynamicInterposeArray[i].replacee ) {
 				if ( context.verboseInterposing ) {
-					dyld::log("dyld: interposing: at %p replace 0x%lX with 0x%lX in %s\n", 
-						fixupLocation, it->replacee, it->replacement, this->getPath());
+					dyld::log("dyld: dynamic interposing: at %p replace %p with %p in %s\n", 
+						fixupLocation, context.dynamicInterposeArray[i].replacee, context.dynamicInterposeArray[i].replacement, this->getPath());
 				}
-				*fixupLocation = it->replacement;
+				*fixupLocation = (uintptr_t)context.dynamicInterposeArray[i].replacement;
 			}
 		}
 	}
 	return 0;
 }
 
-void ImageLoaderMachOCompressed::doInterpose(const LinkContext& context)
+void ImageLoaderMachOCompressed::dynamicInterpose(const LinkContext& context)
 {
 	if ( context.verboseInterposing )
-		dyld::log("dyld: interposing %lu tuples onto image: %s\n", fgInterposingTuples.size(), this->getPath());
-
-	// update prebound symbols
-	eachBind(context, &ImageLoaderMachOCompressed::interposeAt);
-	eachLazyBind(context, &ImageLoaderMachOCompressed::interposeAt);
-}
-
-
+		dyld::log("dyld: dynamic interposing %lu tuples onto image: %s\n", context.dynamicInterposeCount, this->getPath());
+
+	// update already bound references to symbols
+	eachBind(context, &ImageLoaderMachOCompressed::dynamicInterposeAt);
+	eachLazyBind(context, &ImageLoaderMachOCompressed::dynamicInterposeAt);
+}
 
 
 const char* ImageLoaderMachOCompressed::findClosestSymbol(const void* addr, const void** closestAddr) const
@@ -1537,7 +1607,7 @@
 
 
 #if __arm__ || __x86_64__
-void ImageLoaderMachOCompressed::updateAlternateLazyPointer(uint8_t* stub, void** originalLazyPointerAddr)
+void ImageLoaderMachOCompressed::updateAlternateLazyPointer(uint8_t* stub, void** originalLazyPointerAddr, const LinkContext& context)
 {
 #if __arm__ 
 	uint32_t* instructions = (uint32_t*)stub;
@@ -1557,8 +1627,17 @@
 
    // if stub does not use original lazy pointer (meaning it was optimized by update_dyld_shared_cache)
     if ( lazyPointerAddr != originalLazyPointerAddr ) {
+		// <rdar://problem/12928448> only de-optimization lazy pointers if they are part of shared cache not loaded (because overridden)
+		const ImageLoader* lazyPointerImage = context.findImageContainingAddress(lazyPointerAddr);
+		if ( lazyPointerImage != NULL )
+			return;
+		
         // copy newly re-bound lazy pointer value to shared lazy pointer
         *lazyPointerAddr = *originalLazyPointerAddr;
+		
+		if ( context.verboseBind )
+			dyld::log("dyld: alter bind: %s: *0x%08lX = 0x%08lX \n",
+					  this->getShortName(), (long)lazyPointerAddr, (long)*originalLazyPointerAddr);
     }
 }
 #endif
@@ -1621,10 +1700,39 @@
         // sanity check symbol index of stub and lazy pointer match
 		if ( indirectTable[stubsIndirectTableOffset+i] != indirectTable[lazyPointersIndirectTableOffset+i] ) 
 			continue;
-		this->updateAlternateLazyPointer(stub, lpa);
+		this->updateAlternateLazyPointer(stub, lpa, context);
 	}
 	
 #endif
 }
 
 
+void ImageLoaderMachOCompressed::registerEncryption(const encryption_info_command* encryptCmd, const LinkContext& context)
+{
+#if __arm__ || __arm64__
+	if ( encryptCmd == NULL )
+		return;
+	const mach_header* mh = NULL;
+	for(unsigned int i=0; i < fSegmentsCount; ++i) {
+		if ( (segFileOffset(i) == 0) && (segFileSize(i) != 0) ) {
+			mh = (mach_header*)segActualLoadAddress(i);
+			break;
+		}
+	}
+	void* start = ((uint8_t*)mh) + encryptCmd->cryptoff;
+	size_t len = encryptCmd->cryptsize;
+	uint32_t cputype = mh->cputype;
+	uint32_t cpusubtype = mh->cpusubtype;
+	uint32_t cryptid = encryptCmd->cryptid;
+	if (context.verboseMapping) {
+		 dyld::log("                      0x%08lX->0x%08lX configured for FairPlay decryption\n", (long)start, (long)start+len);
+	}
+	int result = mremap_encrypted(start, len, cryptid, cputype, cpusubtype);
+	if ( result != 0 ) {
+		dyld::throwf("mremap_encrypted() => %d, errno=%d for %s\n", result, errno, this->getPath());
+	}
+#endif
+}
+
+
+