Loading...
src/ImageLoaderMachOCompressed.cpp dyld-360.18 dyld-655.1.1
--- dyld/dyld-360.18/src/ImageLoaderMachOCompressed.cpp
+++ dyld/dyld-655.1.1/src/ImageLoaderMachOCompressed.cpp
@@ -40,9 +40,33 @@
 #include <mach-o/loader.h> 
 #include "ImageLoaderMachOCompressed.h"
 #include "mach-o/dyld_images.h"
+#include "Closure.h"
+#include "Array.h"
 
 #ifndef EXPORT_SYMBOL_FLAGS_KIND_ABSOLUTE
 	#define EXPORT_SYMBOL_FLAGS_KIND_ABSOLUTE			0x02
+#endif
+
+
+#ifndef BIND_OPCODE_THREADED
+#define BIND_OPCODE_THREADED    0xD0
+#endif
+
+#ifndef BIND_SUBOPCODE_THREADED_SET_BIND_ORDINAL_TABLE_SIZE_ULEB
+#define BIND_SUBOPCODE_THREADED_SET_BIND_ORDINAL_TABLE_SIZE_ULEB	0x00
+#endif
+
+#ifndef BIND_SUBOPCODE_THREADED_APPLY
+#define BIND_SUBOPCODE_THREADED_APPLY								0x01
+#endif
+
+
+#ifndef BIND_SPECIAL_DYLIB_WEAK_LOOKUP
+#define BIND_SPECIAL_DYLIB_WEAK_LOOKUP								-3
+#endif
+
+#ifndef CPU_SUBTYPE_ARM64_E
+	#define CPU_SUBTYPE_ARM64_E    2
 #endif
 
 // relocation_info.r_length field has value 3 for 64-bit executables and value 2 for 32-bit executables
@@ -62,45 +86,6 @@
 	struct macho_routines_command	: public routines_command  {};	
 #endif
 
-	
-static uintptr_t read_uleb128(const uint8_t*& p, const uint8_t* end)
-{
-	uint64_t result = 0;
-	int		 bit = 0;
-	do {
-		if (p == end)
-			dyld::throwf("malformed uleb128");
-
-		uint64_t slice = *p & 0x7f;
-
-		if (bit > 63)
-			dyld::throwf("uleb128 too big for uint64, bit=%d, result=0x%0llX", bit, result);
-		else {
-			result |= (slice << bit);
-			bit += 7;
-		}
-	} while (*p++ & 0x80);
-	return result;
-}
-
-
-static intptr_t read_sleb128(const uint8_t*& p, const uint8_t* end)
-{
-	int64_t result = 0;
-	int bit = 0;
-	uint8_t byte;
-	do {
-		if (p == end)
-			throw "malformed sleb128";
-		byte = *p++;
-		result |= (((int64_t)(byte & 0x7f)) << bit);
-		bit += 7;
-	} while (byte & 0x80);
-	// sign extend negative numbers
-	if ( (byte & 0x40) != 0 )
-		result |= (-1LL) << bit;
-	return result;
-}
 
 
 // create image for main executable
@@ -430,15 +415,14 @@
 void ImageLoaderMachOCompressed::throwBadRebaseAddress(uintptr_t address, uintptr_t segmentEndAddress, int segmentIndex, 
 										const uint8_t* startOpcodes, const uint8_t* endOpcodes, const uint8_t* pos)
 {
-	dyld::throwf("malformed rebase opcodes (%ld/%ld): address 0x%08lX is beyond end of segment %s (0x%08lX -> 0x%08lX)",
+	dyld::throwf("malformed rebase opcodes (%ld/%ld): address 0x%08lX is outside of segment %s (0x%08lX -> 0x%08lX)",
 		(intptr_t)(pos-startOpcodes), (intptr_t)(endOpcodes-startOpcodes), address, segName(segmentIndex), 
 		segActualLoadAddress(segmentIndex), segmentEndAddress); 
 }
 
-void ImageLoaderMachOCompressed::rebase(const LinkContext& context)
+void ImageLoaderMachOCompressed::rebase(const LinkContext& context, uintptr_t slide)
 {
 	CRSetCrashLogMessage2(this->getPath());
-	const uintptr_t slide = this->fSlide;
 	const uint8_t* const start = fLinkEditBase + fDyldInfo->rebase_off;
 	const uint8_t* const end = &start[fDyldInfo->rebase_size];
 	const uint8_t* p = start;
@@ -447,6 +431,7 @@
 		uint8_t type = 0;
 		int segmentIndex = 0;
 		uintptr_t address = segActualLoadAddress(0);
+		uintptr_t segmentStartAddress = segActualLoadAddress(0);
 		uintptr_t segmentEndAddress = segActualEndAddress(0);
 		uintptr_t count;
 		uintptr_t skip;
@@ -467,8 +452,16 @@
 					if ( segmentIndex >= fSegmentsCount )
 						dyld::throwf("REBASE_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is too large (0..%d)",
 								segmentIndex, fSegmentsCount-1);
-					address = segActualLoadAddress(segmentIndex) + read_uleb128(p, end);
+			#if TEXT_RELOC_SUPPORT
+					if ( !segWriteable(segmentIndex) && !segHasRebaseFixUps(segmentIndex) && !segHasBindFixUps(segmentIndex) )
+			#else
+					if ( !segWriteable(segmentIndex) )
+			#endif
+						dyld::throwf("REBASE_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is not a writable segment (%s)",
+								segmentIndex, segName(segmentIndex));
+					segmentStartAddress = segActualLoadAddress(segmentIndex);
 					segmentEndAddress = segActualEndAddress(segmentIndex);
+					address = segmentStartAddress + read_uleb128(p, end);
 					break;
 				case REBASE_OPCODE_ADD_ADDR_ULEB:
 					address += read_uleb128(p, end);
@@ -478,7 +471,7 @@
 					break;
 				case REBASE_OPCODE_DO_REBASE_IMM_TIMES:
 					for (int i=0; i < immediate; ++i) {
-						if ( address >= segmentEndAddress ) 
+						if ( (address < segmentStartAddress) || (address >= segmentEndAddress) )
 							throwBadRebaseAddress(address, segmentEndAddress, segmentIndex, start, end, p);
 						rebaseAt(context, address, slide, type);
 						address += sizeof(uintptr_t);
@@ -488,7 +481,7 @@
 				case REBASE_OPCODE_DO_REBASE_ULEB_TIMES:
 					count = read_uleb128(p, end);
 					for (uint32_t i=0; i < count; ++i) {
-						if ( address >= segmentEndAddress ) 
+						if ( (address < segmentStartAddress) || (address >= segmentEndAddress) )
 							throwBadRebaseAddress(address, segmentEndAddress, segmentIndex, start, end, p);
 						rebaseAt(context, address, slide, type);
 						address += sizeof(uintptr_t);
@@ -496,7 +489,7 @@
 					fgTotalRebaseFixups += count;
 					break;
 				case REBASE_OPCODE_DO_REBASE_ADD_ADDR_ULEB:
-					if ( address >= segmentEndAddress ) 
+					if ( (address < segmentStartAddress) || (address >= segmentEndAddress) )
 						throwBadRebaseAddress(address, segmentEndAddress, segmentIndex, start, end, p);
 					rebaseAt(context, address, slide, type);
 					address += read_uleb128(p, end) + sizeof(uintptr_t);
@@ -506,7 +499,7 @@
 					count = read_uleb128(p, end);
 					skip = read_uleb128(p, end);
 					for (uint32_t i=0; i < count; ++i) {
-						if ( address >= segmentEndAddress ) 
+						if ( (address < segmentStartAddress) || (address >= segmentEndAddress) )
 							throwBadRebaseAddress(address, segmentEndAddress, segmentIndex, start, end, p);
 						rebaseAt(context, address, slide, type);
 						address += skip + sizeof(uintptr_t);
@@ -514,7 +507,7 @@
 					fgTotalRebaseFixups += count;
 					break;
 				default:
-					dyld::throwf("bad rebase opcode %d", *p);
+					dyld::throwf("bad rebase opcode %d", *(p-1));
 			}
 		}
 	}
@@ -526,74 +519,7 @@
 	CRSetCrashLogMessage2(NULL);
 }
 
-//
-// This function is the hotspot of symbol lookup.  It was pulled out of findExportedSymbol()
-// to enable it to be re-written in assembler if needed.
-//
-const uint8_t* ImageLoaderMachOCompressed::trieWalk(const uint8_t* start, const uint8_t* end, const char* s)
-{
-	const uint8_t* p = start;
-	while ( p != NULL ) {
-		uintptr_t terminalSize = *p++;
-		if ( terminalSize > 127 ) {
-			// except for re-export-with-rename, all terminal sizes fit in one byte
-			--p;
-			terminalSize = read_uleb128(p, end);
-		}
-		if ( (*s == '\0') && (terminalSize != 0) ) {
-			//dyld::log("trieWalk(%p) returning %p\n", start, p);
-			return p;
-		}
-		const uint8_t* children = p + terminalSize;
-		//dyld::log("trieWalk(%p) sym=%s, terminalSize=%d, children=%p\n", start, s, terminalSize, children);
-		uint8_t childrenRemaining = *children++;
-		p = children;
-		uintptr_t nodeOffset = 0;
-		for (; childrenRemaining > 0; --childrenRemaining) {
-			const char* ss = s;
-			//dyld::log("trieWalk(%p) child str=%s\n", start, (char*)p);
-			bool wrongEdge = false;
-			// scan whole edge to get to next edge
-			// if edge is longer than target symbol name, don't read past end of symbol name
-			char c = *p;
-			while ( c != '\0' ) {
-				if ( !wrongEdge ) {
-					if ( c != *ss )
-						wrongEdge = true;
-					++ss;
-				}
-				++p;
-				c = *p;
-			}
-			if ( wrongEdge ) {
-				// advance to next child
-				++p; // skip over zero terminator
-				// skip over uleb128 until last byte is found
-				while ( (*p & 0x80) != 0 )
-					++p;
-				++p; // skil over last byte of uleb128
-			}
-			else {
- 				// the symbol so far matches this edge (child)
-				// so advance to the child's node
-				++p;
-				nodeOffset = read_uleb128(p, end);
-				s = ss;
-				//dyld::log("trieWalk() found matching edge advancing to node 0x%x\n", nodeOffset);
-				break;
-			}
-		}
-		if ( nodeOffset != 0 )
-			p = &start[nodeOffset];
-		else
-			p = NULL;
-	}
-	//dyld::log("trieWalk(%p) return NULL\n", start);
-	return NULL;
-}
-
-
-const ImageLoader::Symbol* ImageLoaderMachOCompressed::findExportedSymbol(const char* symbol, const ImageLoader** foundIn) const
+const ImageLoader::Symbol* ImageLoaderMachOCompressed::findShallowExportedSymbol(const char* symbol, const ImageLoader** foundIn) const
 {
 	//dyld::log("Compressed::findExportedSymbol(%s) in %s\n", symbol, this->getShortName());
 	if ( fDyldInfo->export_size == 0 )
@@ -618,7 +544,8 @@
 			if ( (ordinal > 0) && (ordinal <= libraryCount()) ) {
 				const ImageLoader* reexportedFrom = libImage((unsigned int)ordinal-1);
 				//dyld::log("Compressed::findExportedSymbol(), %s -> %s/%s\n", symbol, reexportedFrom->getShortName(), importedName);
-				return reexportedFrom->findExportedSymbol(importedName, true, foundIn);
+				const char* reExportLibPath = libPath((unsigned int)ordinal-1);
+				return reexportedFrom->findExportedSymbol(importedName, true, reExportLibPath, foundIn);
 			}
 			else {
 				//dyld::throwf("bad mach-o binary, library ordinal (%u) invalid (max %u) for re-exported symbol %s in %s",
@@ -741,7 +668,7 @@
 	// if a bundle is loaded privately the above will not find its exports
 	if ( this->isBundle() && this->hasHiddenExports() ) {
 		// look in self for needed symbol
-		sym = this->ImageLoaderMachO::findExportedSymbol(symbolName, false, foundIn);
+		sym = this->findShallowExportedSymbol(symbolName, foundIn);
 		if ( sym != NULL )
 			return (*foundIn)->getExportedSymbolAddress(sym, context, this, runResolver);
 	}
@@ -753,15 +680,104 @@
 }
 
 
-uintptr_t ImageLoaderMachOCompressed::resolveTwolevel(const LinkContext& context, const ImageLoader* targetImage, bool weak_import, 
-												const char* symbolName, bool runResolver, const ImageLoader** foundIn)
+#if USES_CHAINED_BINDS
+static void patchCacheUsesOf(const ImageLoader::LinkContext& context, const dyld3::closure::Image* overriddenImage,
+							 uint32_t cacheOffsetOfImpl, const char* symbolName, uintptr_t newImpl)
+{
+	uintptr_t cacheStart = (uintptr_t)context.dyldCache;
+	overriddenImage->forEachPatchableUseOfExport(cacheOffsetOfImpl, ^(dyld3::closure::Image::PatchableExport::PatchLocation patchLocation) {
+		uintptr_t* loc = (uintptr_t*)(cacheStart+patchLocation.cacheOffset);
+#if __has_feature(ptrauth_calls)
+		if ( patchLocation.authenticated ) {
+			 dyld3::MachOLoaded::ChainedFixupPointerOnDisk fixupInfo;
+			fixupInfo.authRebase.auth      = true;
+			fixupInfo.authRebase.addrDiv   = patchLocation.usesAddressDiversity;
+			fixupInfo.authRebase.diversity = patchLocation.discriminator;
+			fixupInfo.authRebase.key       = patchLocation.key;
+			uintptr_t newValue = fixupInfo.signPointer(loc, newImpl + patchLocation.getAddend());
+			if ( *loc != newValue ) {
+				*loc = newValue;
+				if ( context.verboseBind )
+					dyld::log("dyld: cache fixup: *%p = %p (JOP: diversity 0x%04X, addr-div=%d, key=%s) to %s\n",
+						  	loc, (void*)newValue, patchLocation.discriminator, patchLocation.usesAddressDiversity, patchLocation.keyName(), symbolName);
+			}
+			return;
+		}
+#endif
+		uintptr_t newValue =newImpl + patchLocation.getAddend();
+		if ( *loc != newValue ) {
+			*loc = newValue;
+			if ( context.verboseBind )
+				dyld::log("dyld: cache fixup: *%p = %p to %s\n", loc, (void*)newValue, symbolName);
+		}
+	});
+}
+#endif
+
+
+uintptr_t ImageLoaderMachOCompressed::resolveWeak(const LinkContext& context, const char* symbolName, bool weak_import,
+												  bool runResolver, const ImageLoader** foundIn)
+{
+	const Symbol* sym;
+#if USES_CHAINED_BINDS
+	__block uintptr_t foundOutsideCache  = 0;
+	__block uintptr_t lastFoundInCache = 0;
+	CoalesceNotifier notifier = ^(const Symbol* implSym, const ImageLoader* implIn, const mach_header* implMh) {
+		//dyld::log("notifier: found %s in %p %s\n", symbolName, implMh, implIn->getPath());
+		// This block is only called in dyld2 mode when a non-cached image is search for which weak-def implementation to use
+		// As a side effect of that search we notice any implementations outside and inside the cache,
+		// and use that to trigger patching the cache to use the implementation outside the cache.
+		uintptr_t implAddr = implIn->getExportedSymbolAddress(implSym, context, nullptr, false, symbolName);
+		if ( ((dyld3::MachOLoaded*)implMh)->inDyldCache() ) {
+			if ( foundOutsideCache != 0 ) {
+				// have an implementation in cache and and earlier one not in the cache, patch cache to use earlier one
+				lastFoundInCache = implAddr;
+				uint32_t imageIndex;
+				if ( context.dyldCache->findMachHeaderImageIndex(implMh, imageIndex) ) {
+					const dyld3::closure::Image* overriddenImage = context.dyldCache->cachedDylibsImageArray()->imageForNum(imageIndex+1);
+					uint32_t cacheOffsetOfImpl = (uint32_t)((uintptr_t)implAddr - (uintptr_t)context.dyldCache);
+					patchCacheUsesOf(context, overriddenImage, cacheOffsetOfImpl, symbolName, foundOutsideCache);
+				}
+			}
+		}
+		else {
+			// record first non-cache implementation
+			if ( foundOutsideCache == 0 )
+				foundOutsideCache = implAddr;
+		}
+	};
+#else
+	CoalesceNotifier notifier = nullptr;
+#endif
+	if ( context.coalescedExportFinder(symbolName, &sym, foundIn, notifier) ) {
+		if ( *foundIn != this )
+			context.addDynamicReference(this, const_cast<ImageLoader*>(*foundIn));
+		return (*foundIn)->getExportedSymbolAddress(sym, context, this, runResolver);
+	}
+	// if a bundle is loaded privately the above will not find its exports
+	if ( this->isBundle() && this->hasHiddenExports() ) {
+		// look in self for needed symbol
+		sym = this->findShallowExportedSymbol(symbolName, foundIn);
+		if ( sym != NULL )
+			return (*foundIn)->getExportedSymbolAddress(sym, context, this, runResolver);
+	}
+	if ( weak_import ) {
+		// definition can't be found anywhere, ok because it is weak, just return 0
+		return 0;
+	}
+	throwSymbolNotFound(context, symbolName, this->getPath(), "", "weak");
+}
+
+
+uintptr_t ImageLoaderMachOCompressed::resolveTwolevel(const LinkContext& context, const char* symbolName, const ImageLoader* definedInImage,
+													  const ImageLoader* requestorImage, unsigned requestorOrdinalOfDef, bool weak_import, bool runResolver,
+													  const ImageLoader** foundIn)
 {
 	// two level lookup
-	const Symbol* sym = targetImage->findExportedSymbol(symbolName, true, foundIn);
-	if ( sym != NULL ) {
-		return (*foundIn)->getExportedSymbolAddress(sym, context, this, runResolver);
-	}
-	
+	uintptr_t address;
+	if ( definedInImage->findExportedSymbolAddress(context, symbolName, requestorImage, requestorOrdinalOfDef, runResolver, foundIn, &address) )
+		return address;
+
 	if ( weak_import ) {
 		// definition can't be found anywhere, ok because it is weak, just return 0
 		return 0;
@@ -784,7 +800,7 @@
 		strcpy(versMismatch, msg);
 		::free((void*)msg);
 	}
-	throwSymbolNotFound(context, symbolName, this->getPath(), versMismatch, targetImage->getPath());
+	throwSymbolNotFound(context, symbolName, this->getPath(), versMismatch, definedInImage->getPath());
 }
 
 
@@ -809,6 +825,9 @@
 	if ( context.bindFlat || (libraryOrdinal == BIND_SPECIAL_DYLIB_FLAT_LOOKUP) ) {
 		symbolAddress = this->resolveFlat(context, symbolName, weak_import, runResolver, targetImage);
 	}
+	else if ( libraryOrdinal == BIND_SPECIAL_DYLIB_WEAK_LOOKUP ) {
+		symbolAddress = this->resolveWeak(context, symbolName, false, runResolver, targetImage);
+	}
 	else {
 		if ( libraryOrdinal == BIND_SPECIAL_DYLIB_MAIN_EXECUTABLE ) {
 			*targetImage = context.mainExecutable;
@@ -838,10 +857,10 @@
 			}
 		}
 		else {
-			symbolAddress = resolveTwolevel(context, *targetImage, weak_import, symbolName, runResolver, targetImage);
-		}
-	}
-	
+			symbolAddress = resolveTwolevel(context, symbolName, *targetImage, this, (unsigned)libraryOrdinal, weak_import, runResolver, targetImage);
+		}
+	}
+
 	// save off lookup results if client wants 
 	if ( last != NULL ) {
 		last->ordinal	= libraryOrdinal;
@@ -854,24 +873,31 @@
 	return symbolAddress;
 }
 
-uintptr_t ImageLoaderMachOCompressed::bindAt(const LinkContext& context, uintptr_t addr, uint8_t type, const char* symbolName, 
-								uint8_t symboFlags, intptr_t addend, long libraryOrdinal, const char* msg, 
-								LastLookup* last, bool runResolver)
+uintptr_t ImageLoaderMachOCompressed::bindAt(const LinkContext& context, ImageLoaderMachOCompressed* image,
+											 uintptr_t addr, uint8_t type, const char* symbolName,
+											 uint8_t symbolFlags, intptr_t addend, long libraryOrdinal,
+											 ExtraBindData *extraBindData,
+											 const char* msg, LastLookup* last, bool runResolver)
 {
 	const ImageLoader*	targetImage;
 	uintptr_t			symbolAddress;
 	
 	// resolve symbol
-	symbolAddress = this->resolve(context, symbolName, symboFlags, libraryOrdinal, &targetImage, last, runResolver);
+    if (type == BIND_TYPE_THREADED_REBASE) {
+        symbolAddress = 0;
+        targetImage = nullptr;
+    } else
+        symbolAddress = image->resolve(context, symbolName, symbolFlags, libraryOrdinal, &targetImage, last, runResolver);
 
 	// do actual update
-	return this->bindLocation(context, addr, symbolAddress, targetImage, type, symbolName, addend, msg);
-}
+	return image->bindLocation(context, image->imageBaseAddress(), addr, symbolAddress, type, symbolName, addend, image->getPath(), targetImage ? targetImage->getPath() : NULL, msg, extraBindData, image->fSlide);
+}
+
 
 void ImageLoaderMachOCompressed::throwBadBindingAddress(uintptr_t address, uintptr_t segmentEndAddress, int segmentIndex, 
 										const uint8_t* startOpcodes, const uint8_t* endOpcodes, const uint8_t* pos)
 {
-	dyld::throwf("malformed binding opcodes (%ld/%ld): address 0x%08lX is beyond end of segment %s (0x%08lX -> 0x%08lX)",
+	dyld::throwf("malformed binding opcodes (%ld/%ld): address 0x%08lX is outside segment %s (0x%08lX -> 0x%08lX)",
 		(intptr_t)(pos-startOpcodes), (intptr_t)(endOpcodes-startOpcodes), address, segName(segmentIndex), 
 		segActualLoadAddress(segmentIndex), segmentEndAddress); 
 }
@@ -885,17 +911,45 @@
 	// note: flat-namespace binaries need to have imports rebound (even if correctly prebound)
 	if ( this->usablePrebinding(context) ) {
 		// don't need to bind
+		// except weak which may now be inline with the regular binds
+		if (this->participatesInCoalescing()) {
+			// run through all binding opcodes
+			eachBind(context, ^(const LinkContext& ctx, ImageLoaderMachOCompressed* image,
+								uintptr_t addr, uint8_t type, const char* symbolName,
+								uint8_t symbolFlags, intptr_t addend, long libraryOrdinal,
+								ExtraBindData *extraBindData,
+								const char* msg, LastLookup* last, bool runResolver) {
+				if ( libraryOrdinal != BIND_SPECIAL_DYLIB_WEAK_LOOKUP )
+					return (uintptr_t)0;
+				return ImageLoaderMachOCompressed::bindAt(ctx, image, addr, type, symbolName, symbolFlags,
+														  addend, libraryOrdinal, extraBindData,
+														  msg, last, runResolver);
+			});
+		}
 	}
 	else {
-	
+		uint64_t t0 = mach_absolute_time();
+
 	#if TEXT_RELOC_SUPPORT
 		// if there are __TEXT fixups, temporarily make __TEXT writable
 		if ( fTextSegmentBinds ) 
 			this->makeTextSegmentWritable(context, true);
 	#endif
-	
+
+		uint32_t ignore;
+		bool bindingBecauseOfRoot = ( this->overridesCachedDylib(ignore) || this->inSharedCache() );
+		vmAccountingSetSuspended(context, bindingBecauseOfRoot);
+
 		// run through all binding opcodes
-		eachBind(context, &ImageLoaderMachOCompressed::bindAt);
+		eachBind(context, ^(const LinkContext& ctx, ImageLoaderMachOCompressed* image,
+							uintptr_t addr, uint8_t type, const char* symbolName,
+							uint8_t symbolFlags, intptr_t addend, long libraryOrdinal,
+							ExtraBindData *extraBindData,
+							const char* msg, LastLookup* last, bool runResolver) {
+			return ImageLoaderMachOCompressed::bindAt(ctx, image, addr, type, symbolName, symbolFlags,
+													  addend, libraryOrdinal, extraBindData,
+													  msg, last, runResolver);
+		});
 			
 	#if TEXT_RELOC_SUPPORT
 		// if there were __TEXT fixups, restore write protection
@@ -913,11 +967,31 @@
         // the stub may have been altered to point to a shared lazy pointer.
 		if ( fInSharedCache ) 
 			this->updateOptimizedLazyPointers(context);
-	
+
 		// tell kernel we are done with chunks of LINKEDIT
 		if ( !context.preFetchDisabled ) 
 			this->markFreeLINKEDIT(context);
-	}
+
+		uint64_t t1 = mach_absolute_time();
+		ImageLoader::fgTotalRebindCacheTime += (t1-t0);
+	}
+
+#if USES_CHAINED_BINDS
+	// See if this dylib overrides something in the dyld cache
+	uint32_t dyldCacheOverrideImageNum;
+	if ( context.dyldCache && overridesCachedDylib(dyldCacheOverrideImageNum) ) {
+		// need to patch all other places in cache that point to the overridden dylib, to point to this dylib instead
+		const dyld3::closure::Image* overriddenImage = context.dyldCache->cachedDylibsImageArray()->imageForNum(dyldCacheOverrideImageNum);
+		overriddenImage->forEachPatchableExport(^(uint32_t cacheOffsetOfImpl, const char* exportName) {
+			uintptr_t newImpl = 0;
+			const ImageLoader* foundIn;
+			if ( const ImageLoader::Symbol* sym = this->findShallowExportedSymbol(exportName, &foundIn) ) {
+				newImpl = foundIn->getExportedSymbolAddress(sym, context, this);
+			}
+			patchCacheUsesOf(context, overriddenImage, cacheOffsetOfImpl, exportName, newImpl);
+		});
+	}
+#endif
 	
 	// set up dyld entry points in image
 	// do last so flat main executables will have __dyld or __program_vars set up
@@ -928,22 +1002,196 @@
 
 void ImageLoaderMachOCompressed::doBindJustLazies(const LinkContext& context)
 {
-	eachLazyBind(context, &ImageLoaderMachOCompressed::bindAt);
-}
+	eachLazyBind(context, ^(const LinkContext& ctx, ImageLoaderMachOCompressed* image,
+							uintptr_t addr, uint8_t type, const char* symbolName,
+							uint8_t symbolFlags, intptr_t addend, long libraryOrdinal,
+							ExtraBindData *extraBindData,
+							const char* msg, LastLookup* last, bool runResolver) {
+		return ImageLoaderMachOCompressed::bindAt(ctx, image, addr, type, symbolName, symbolFlags,
+												  addend, libraryOrdinal, extraBindData,
+												  msg, last, runResolver);
+	});
+}
+
+void ImageLoaderMachOCompressed::registerInterposing(const LinkContext& context)
+{
+	// mach-o files advertise interposing by having a __DATA __interpose section
+	struct InterposeData { uintptr_t replacement; uintptr_t replacee; };
+	const uint32_t cmd_count = ((macho_header*)fMachOData)->ncmds;
+	const struct load_command* const cmds = (struct load_command*)&fMachOData[sizeof(macho_header)];
+	const struct load_command* cmd = cmds;
+	for (uint32_t i = 0; i < cmd_count; ++i) {
+		switch (cmd->cmd) {
+			case LC_SEGMENT_COMMAND:
+			{
+				const struct macho_segment_command* seg = (struct macho_segment_command*)cmd;
+				const struct macho_section* const sectionsStart = (struct macho_section*)((char*)seg + sizeof(struct macho_segment_command));
+				const struct macho_section* const sectionsEnd = &sectionsStart[seg->nsects];
+				for (const struct macho_section* sect=sectionsStart; sect < sectionsEnd; ++sect) {
+					if ( ((sect->flags & SECTION_TYPE) == S_INTERPOSING) || ((strcmp(sect->sectname, "__interpose") == 0) && (strcmp(seg->segname, "__DATA") == 0)) ) {
+						// <rdar://problem/23929217> Ensure section is within segment
+						if ( (sect->addr < seg->vmaddr) || (sect->addr+sect->size > seg->vmaddr+seg->vmsize) || (sect->addr+sect->size < sect->addr) )
+							dyld::throwf("interpose section has malformed address range for %s\n", this->getPath());
+						__block uintptr_t sectionStart = sect->addr + fSlide;
+						__block uintptr_t sectionEnd = sectionStart + sect->size;
+						const size_t count = sect->size / sizeof(InterposeData);
+						InterposeData interposeArray[count];
+						// Note, we memcpy here as rebases may have already been applied.
+						memcpy(&interposeArray[0], (void*)sectionStart, sect->size);
+						__block InterposeData *interposeArrayStart = &interposeArray[0];
+						eachBind(context, ^(const LinkContext& ctx, ImageLoaderMachOCompressed* image, uintptr_t addr, uint8_t type,
+											const char* symbolName, uint8_t symbolFlags, intptr_t addend, long libraryOrdinal,
+											ExtraBindData *extraBindData,
+											const char* msg, LastLookup* last, bool runResolver) {
+							if (addr >= sectionStart && addr < sectionEnd) {
+								if ( context.verboseInterposing ) {
+									dyld::log("dyld: interposing %s at 0x%lx in range 0x%lx..0x%lx\n",
+											  symbolName, addr, sectionStart, sectionEnd);
+								}
+								const ImageLoader*	targetImage;
+								uintptr_t			symbolAddress;
+
+								// resolve symbol
+								if (type == BIND_TYPE_THREADED_REBASE) {
+									symbolAddress = 0;
+									targetImage = nullptr;
+								} else
+									symbolAddress = image->resolve(ctx, symbolName, symbolFlags, libraryOrdinal, &targetImage, last, runResolver);
+
+								uintptr_t newValue = symbolAddress+addend;
+								uintptr_t index = (addr - sectionStart) / sizeof(uintptr_t);
+								switch (type) {
+									case BIND_TYPE_POINTER:
+										((uintptr_t*)interposeArrayStart)[index] = newValue;
+										break;
+									case BIND_TYPE_TEXT_ABSOLUTE32:
+										// unreachable!
+										abort();
+									case BIND_TYPE_TEXT_PCREL32:
+										// unreachable!
+										abort();
+									case BIND_TYPE_THREADED_BIND:
+										((uintptr_t*)interposeArrayStart)[index] = newValue;
+										break;
+									case BIND_TYPE_THREADED_REBASE: {
+										// Regular pointer which needs to fit in 51-bits of value.
+										// C++ RTTI uses the top bit, so we'll allow the whole top-byte
+										// and the signed-extended bottom 43-bits to be fit in to 51-bits.
+										uint64_t top8Bits = (*(uint64_t*)addr) & 0x0007F80000000000ULL;
+										uint64_t bottom43Bits = (*(uint64_t*)addr) & 0x000007FFFFFFFFFFULL;
+										uint64_t targetValue = ( top8Bits << 13 ) | (((intptr_t)(bottom43Bits << 21) >> 21) & 0x00FFFFFFFFFFFFFF);
+										newValue = (uintptr_t)(targetValue + fSlide);
+										((uintptr_t*)interposeArrayStart)[index] = newValue;
+										break;
+									}
+									default:
+										dyld::throwf("bad bind type %d", type);
+								}
+							}
+							return (uintptr_t)0;
+						});
+						for (size_t j=0; j < count; ++j) {
+							ImageLoader::InterposeTuple tuple;
+							tuple.replacement        = interposeArray[j].replacement;
+							tuple.neverImage        = this;
+							tuple.onlyImage            = NULL;
+							tuple.replacee            = interposeArray[j].replacee;
+							if ( context.verboseInterposing ) {
+								dyld::log("dyld: interposing index %d 0x%lx with 0x%lx\n",
+										  (unsigned)j, interposeArray[j].replacee, interposeArray[j].replacement);
+							}
+							// <rdar://problem/25686570> ignore interposing on a weak function that does not exist
+							if ( tuple.replacee == 0 )
+								continue;
+							// <rdar://problem/7937695> verify that replacement is in this image
+							if ( this->containsAddress((void*)tuple.replacement) ) {
+								// chain to any existing interpositions
+								for (std::vector<InterposeTuple>::iterator it=fgInterposingTuples.begin(); it != fgInterposingTuples.end(); it++) {
+									if ( it->replacee == tuple.replacee ) {
+										tuple.replacee = it->replacement;
+									}
+								}
+								ImageLoader::fgInterposingTuples.push_back(tuple);
+							}
+						}
+					}
+				}
+			}
+				break;
+		}
+		cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
+	}
+}
+
+bool ImageLoaderMachOCompressed::usesChainedFixups() const
+{
+#if __arm64e__
+	return ( machHeader()->cpusubtype == CPU_SUBTYPE_ARM64_E );
+#else
+	return false;
+#endif
+}
+
+struct ThreadedBindData {
+    ThreadedBindData(const char* symbolName, int64_t addend, long libraryOrdinal, uint8_t symbolFlags, uint8_t type)
+    : symbolName(symbolName), addend(addend), libraryOrdinal(libraryOrdinal), symbolFlags(symbolFlags), type(type) { }
+
+    std::tuple<const char*, int64_t, long, bool, uint8_t> pack() const {
+        return std::make_tuple(symbolName, addend, libraryOrdinal, symbolFlags, type);
+    }
+
+    const char* symbolName     = nullptr;
+    int64_t addend             = 0;
+    long libraryOrdinal        = 0;
+    uint8_t symbolFlags        = 0;
+    uint8_t type               = 0;
+};
 
 void ImageLoaderMachOCompressed::eachBind(const LinkContext& context, bind_handler handler)
 {
-	try {
+    try {
+        const dysymtab_command* dynSymbolTable = NULL;
+        const macho_nlist* symbolTable = NULL;
+        const char* symbolTableStrings = NULL;
+        uint32_t maxStringOffset = 0;
+
+        const uint32_t cmd_count = ((macho_header*)fMachOData)->ncmds;
+        const struct load_command* const cmds = (struct load_command*)&fMachOData[sizeof(macho_header)];
+        const struct load_command* cmd = cmds;
+        for (uint32_t i = 0; i < cmd_count; ++i) {
+            switch (cmd->cmd) {
+                case LC_SYMTAB:
+                {
+                    const struct symtab_command* symtab = (struct symtab_command*)cmd;
+                    symbolTableStrings = (const char*)&fLinkEditBase[symtab->stroff];
+                    maxStringOffset = symtab->strsize;
+                    symbolTable = (macho_nlist*)(&fLinkEditBase[symtab->symoff]);
+                }
+                    break;
+                case LC_DYSYMTAB:
+                    dynSymbolTable = (struct dysymtab_command*)cmd;
+                    break;
+            }
+            cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
+        }
+
 		uint8_t type = 0;
-		int segmentIndex = 0;
+		int segmentIndex = -1;
 		uintptr_t address = segActualLoadAddress(0);
+		uintptr_t segmentStartAddress = segActualLoadAddress(0);
 		uintptr_t segmentEndAddress = segActualEndAddress(0);
 		const char* symbolName = NULL;
 		uint8_t symboFlags = 0;
+		bool libraryOrdinalSet = false;
 		long libraryOrdinal = 0;
 		intptr_t addend = 0;
 		uintptr_t count;
 		uintptr_t skip;
+        uintptr_t segOffset = 0;
+
+		dyld3::OverflowSafeArray<ThreadedBindData> ordinalTable;
+        bool useThreadedRebaseBind = false;
+        ExtraBindData extraBindData;
 		LastLookup last = { 0, 0, NULL, 0, NULL };
 		const uint8_t* const start = fLinkEditBase + fDyldInfo->bind_off;
 		const uint8_t* const end = &start[fDyldInfo->bind_size];
@@ -959,9 +1207,11 @@
 					break;
 				case BIND_OPCODE_SET_DYLIB_ORDINAL_IMM:
 					libraryOrdinal = immediate;
+					libraryOrdinalSet = true;
 					break;
 				case BIND_OPCODE_SET_DYLIB_ORDINAL_ULEB:
 					libraryOrdinal = read_uleb128(p, end);
+					libraryOrdinalSet = true;
 					break;
 				case BIND_OPCODE_SET_DYLIB_SPECIAL_IMM:
 					// the special ordinals are negative numbers
@@ -971,6 +1221,7 @@
 						int8_t signExtended = BIND_OPCODE_MASK | immediate;
 						libraryOrdinal = signExtended;
 					}
+					libraryOrdinalSet = true;
 					break;
 				case BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM:
 					symbolName = (char*)p;
@@ -987,43 +1238,143 @@
 					break;
 				case BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB:
 					segmentIndex = immediate;
-					if ( segmentIndex >= fSegmentsCount )
-						dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is too large (0..%d)",
+					if ( (segmentIndex >= fSegmentsCount) || (segmentIndex < 0) )
+						dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is out of range (0..%d)",
 								segmentIndex, fSegmentsCount-1);
-					address = segActualLoadAddress(segmentIndex) + read_uleb128(p, end);
+			#if TEXT_RELOC_SUPPORT
+					if ( !segWriteable(segmentIndex) && !segHasRebaseFixUps(segmentIndex) && !segHasBindFixUps(segmentIndex) )
+			#else
+					if ( !segWriteable(segmentIndex) )
+			#endif
+						dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is not writable", segmentIndex);
+					segOffset = read_uleb128(p, end);
+					if ( segOffset > segSize(segmentIndex) )
+						dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has offset 0x%08lX beyond segment size (0x%08lX)", segOffset, segSize(segmentIndex));
+					segmentStartAddress = segActualLoadAddress(segmentIndex);
+					address = segmentStartAddress + segOffset;
 					segmentEndAddress = segActualEndAddress(segmentIndex);
 					break;
 				case BIND_OPCODE_ADD_ADDR_ULEB:
 					address += read_uleb128(p, end);
 					break;
 				case BIND_OPCODE_DO_BIND:
-					if ( address >= segmentEndAddress ) 
+                    if (!useThreadedRebaseBind) {
+                        if ( (address < segmentStartAddress) || (address >= segmentEndAddress) )
+                            throwBadBindingAddress(address, segmentEndAddress, segmentIndex, start, end, p);
+                        if ( symbolName  == NULL )
+                            dyld::throwf("BIND_OPCODE_DO_BIND missing preceding BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM");
+                        if ( segmentIndex == -1 )
+                            dyld::throwf("BIND_OPCODE_DO_BIND missing preceding BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB");
+                        if ( !libraryOrdinalSet )
+                            dyld::throwf("BIND_OPCODE_DO_BIND missing preceding BIND_OPCODE_SET_DYLIB_ORDINAL*");
+                        handler(context, this, address, type, symbolName, symboFlags, addend, libraryOrdinal,
+								&extraBindData, "", &last, false);
+                        address += sizeof(intptr_t);
+                    } else {
+                        ordinalTable.push_back(ThreadedBindData(symbolName, addend, libraryOrdinal, symboFlags, type));
+                    }
+					break;
+				case BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB:
+					if ( (address < segmentStartAddress) || (address >= segmentEndAddress) )
 						throwBadBindingAddress(address, segmentEndAddress, segmentIndex, start, end, p);
-					(this->*handler)(context, address, type, symbolName, symboFlags, addend, libraryOrdinal, "", &last, false);
-					address += sizeof(intptr_t);
-					break;
-				case BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB:
-					if ( address >= segmentEndAddress ) 
+					if ( symbolName  == NULL )
+						dyld::throwf("BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB missing preceding BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM");
+					if ( segmentIndex == -1 )
+						dyld::throwf("BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB missing preceding BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB");
+					if ( !libraryOrdinalSet )
+						dyld::throwf("BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB missing preceding BIND_OPCODE_SET_DYLIB_ORDINAL*");
+                    handler(context, this, address, type, symbolName, symboFlags, addend, libraryOrdinal,
+                                     &extraBindData, "", &last, false);
+					address += read_uleb128(p, end) + sizeof(intptr_t);
+					break;
+				case BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED:
+					if ( (address < segmentStartAddress) || (address >= segmentEndAddress) )
 						throwBadBindingAddress(address, segmentEndAddress, segmentIndex, start, end, p);
-					(this->*handler)(context, address, type, symbolName, symboFlags, addend, libraryOrdinal, "", &last, false);
-					address += read_uleb128(p, end) + sizeof(intptr_t);
-					break;
-				case BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED:
-					if ( address >= segmentEndAddress ) 
-						throwBadBindingAddress(address, segmentEndAddress, segmentIndex, start, end, p);
-					(this->*handler)(context, address, type, symbolName, symboFlags, addend, libraryOrdinal, "", &last, false);
+					if ( symbolName  == NULL )
+						dyld::throwf("BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED missing preceding BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM");
+					if ( segmentIndex == -1 )
+						dyld::throwf("BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED missing preceding BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB");
+					if ( !libraryOrdinalSet )
+						dyld::throwf("BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED missing preceding BIND_OPCODE_SET_DYLIB_ORDINAL*");
+                    handler(context, this, address, type, symbolName, symboFlags, addend, libraryOrdinal,
+                                     &extraBindData, "", &last, false);
 					address += immediate*sizeof(intptr_t) + sizeof(intptr_t);
 					break;
 				case BIND_OPCODE_DO_BIND_ULEB_TIMES_SKIPPING_ULEB:
+					if ( symbolName  == NULL )
+						dyld::throwf("BIND_OPCODE_DO_BIND_ULEB_TIMES_SKIPPING_ULEB missing preceding BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM");
+					if ( segmentIndex == -1 )
+						dyld::throwf("BIND_OPCODE_DO_BIND_ULEB_TIMES_SKIPPING_ULEB missing preceding BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB");
 					count = read_uleb128(p, end);
+					if ( !libraryOrdinalSet )
+						dyld::throwf("BIND_OPCODE_DO_BIND_ULEB_TIMES_SKIPPING_ULEB missing preceding BIND_OPCODE_SET_DYLIB_ORDINAL*");
 					skip = read_uleb128(p, end);
 					for (uint32_t i=0; i < count; ++i) {
-						if ( address >= segmentEndAddress ) 
+						if ( (address < segmentStartAddress) || (address >= segmentEndAddress) )
 							throwBadBindingAddress(address, segmentEndAddress, segmentIndex, start, end, p);
-						(this->*handler)(context, address, type, symbolName, symboFlags, addend, libraryOrdinal, "", &last, false);
+                        handler(context, this, address, type, symbolName, symboFlags, addend, libraryOrdinal,
+                                         &extraBindData, "", &last, false);
 						address += skip + sizeof(intptr_t);
 					}
-					break;
+                    break;
+                case BIND_OPCODE_THREADED:
+                    if (sizeof(intptr_t) != 8) {
+                        dyld::throwf("BIND_OPCODE_THREADED require 64-bit");
+                        return;
+                    }
+                    // Note the immediate is a sub opcode
+                    switch (immediate) {
+                        case BIND_SUBOPCODE_THREADED_SET_BIND_ORDINAL_TABLE_SIZE_ULEB:
+                            count = read_uleb128(p, end);
+                            ordinalTable.clear();
+                            // FIXME: ld64 wrote the wrong value here and we need to offset by 1 for now.
+                            ordinalTable.reserve(count + 1);
+                            useThreadedRebaseBind = true;
+                            break;
+                        case BIND_SUBOPCODE_THREADED_APPLY: {
+                            uint64_t delta = 0;
+                            do {
+                                address = segmentStartAddress + segOffset;
+                                uint64_t value = *(uint64_t*)address;
+
+
+                                bool isRebase = (value & (1ULL << 62)) == 0;
+                                if (isRebase) {
+                                    {
+                                        // Call the bind handler which knows about our bind type being set to rebase
+                                        handler(context, this, address, BIND_TYPE_THREADED_REBASE, nullptr, 0, 0, 0,
+                                                         nullptr, "", &last, false);
+                                    }
+                                } else {
+                                    // the ordinal is bits [0..15]
+                                    uint16_t ordinal = value & 0xFFFF;
+                                    if (ordinal >= ordinalTable.count()) {
+                                        dyld::throwf("bind ordinal is out of range\n");
+                                        return;
+                                    }
+                                    std::tie(symbolName, addend, libraryOrdinal, symboFlags, type) = ordinalTable[ordinal].pack();
+                                    if ( (address < segmentStartAddress) || (address >= segmentEndAddress) )
+                                        throwBadBindingAddress(address, segmentEndAddress, segmentIndex, start, end, p);
+                                    {
+                                        handler(context, this, address, BIND_TYPE_THREADED_BIND,
+                                                         symbolName, symboFlags, addend, libraryOrdinal,
+                                                         nullptr, "", &last, false);
+                                    }
+                                }
+
+                                // The delta is bits [51..61]
+                                // And bit 62 is to tell us if we are a rebase (0) or bind (1)
+                                value &= ~(1ULL << 62);
+                                delta = ( value & 0x3FF8000000000000 ) >> 51;
+                                segOffset += delta * sizeof(intptr_t);
+                            } while ( delta != 0 );
+                            break;
+                        }
+
+                        default:
+                            dyld::throwf("bad threaded bind subopcode 0x%02X", *p);
+                    }
+                    break;
 				default:
 					dyld::throwf("bad bind opcode %d in bind info", *p);
 			}
@@ -1040,9 +1391,11 @@
 {
 	try {
 		uint8_t type = BIND_TYPE_POINTER;
-		int segmentIndex = 0;
+		int segmentIndex = -1;
 		uintptr_t address = segActualLoadAddress(0);
+		uintptr_t segmentStartAddress = segActualLoadAddress(0);
 		uintptr_t segmentEndAddress = segActualEndAddress(0);
+		uintptr_t segOffset;
 		const char* symbolName = NULL;
 		uint8_t symboFlags = 0;
 		long libraryOrdinal = 0;
@@ -1089,19 +1442,30 @@
 					break;
 				case BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB:
 					segmentIndex = immediate;
-					if ( segmentIndex >= fSegmentsCount )
-						dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is too large (0..%d)",
+					if ( (segmentIndex >= fSegmentsCount) || (segmentIndex < 0) )
+						dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is out of range (0..%d)",
 								segmentIndex, fSegmentsCount-1);
-					address = segActualLoadAddress(segmentIndex) + read_uleb128(p, end);
+					if ( !segWriteable(segmentIndex) )
+						dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is not writable", segmentIndex);
+					segOffset = read_uleb128(p, end);
+					if ( segOffset > segSize(segmentIndex) )
+						dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has offset 0x%08lX beyond segment size (0x%08lX)", segOffset, segSize(segmentIndex));
+					segmentStartAddress = segActualLoadAddress(segmentIndex);
 					segmentEndAddress = segActualEndAddress(segmentIndex);
+					address = segmentStartAddress + segOffset;
 					break;
 				case BIND_OPCODE_ADD_ADDR_ULEB:
 					address += read_uleb128(p, end);
 					break;
 				case BIND_OPCODE_DO_BIND:
-					if ( address >= segmentEndAddress ) 
+					if ( segmentIndex == -1 )
+						dyld::throwf("BIND_OPCODE_DO_BIND missing preceding BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB");
+					if ( (address < segmentStartAddress) || (address >= segmentEndAddress) )
 						throwBadBindingAddress(address, segmentEndAddress, segmentIndex, start, end, p);
-					(this->*handler)(context, address, type, symbolName, symboFlags, addend, libraryOrdinal, "forced lazy ", NULL, false);
+					if ( symbolName  == NULL )
+						dyld::throwf("BIND_OPCODE_DO_BIND missing preceding BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM");
+                    handler(context, this, address, type, symbolName, symboFlags, addend, libraryOrdinal,
+                                     NULL, "forced lazy ", NULL, false);
 					address += sizeof(intptr_t);
 					break;
 				case BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB:
@@ -1180,7 +1544,8 @@
 							if ( !twoLevel || context.bindFlat ) 
 								libraryOrdinal = BIND_SPECIAL_DYLIB_FLAT_LOOKUP;
 							uintptr_t ptrToBind = (uintptr_t)lazyPointer;
-							uintptr_t symbolAddr = bindAt(context, ptrToBind, BIND_TYPE_POINTER, symbolName, 0, 0, libraryOrdinal, "lazy ", NULL);
+                            uintptr_t symbolAddr = bindAt(context, this, ptrToBind, BIND_TYPE_POINTER, symbolName, 0, 0, libraryOrdinal,
+                                                          NULL, "lazy ", NULL);
 							++fgTotalLazyBindFixups;
 							return symbolAddr;
 						}
@@ -1194,6 +1559,7 @@
 }
 
 
+
 uintptr_t ImageLoaderMachOCompressed::doBindFastLazySymbol(uint32_t lazyBindingInfoOffset, const LinkContext& context,
 															void (*lock)(), void (*unlock)())
 {
@@ -1209,73 +1575,27 @@
 	
 	const uint8_t* const start = fLinkEditBase + fDyldInfo->lazy_bind_off;
 	const uint8_t* const end = &start[fDyldInfo->lazy_bind_size];
-	if ( lazyBindingInfoOffset > fDyldInfo->lazy_bind_size ) {
-		dyld::throwf("fast lazy bind offset out of range (%u, max=%u) in image %s", 
-			lazyBindingInfoOffset, fDyldInfo->lazy_bind_size, this->getPath());
-	}
-
-	uint8_t type = BIND_TYPE_POINTER;
-	uintptr_t address = 0;
-	const char* symbolName = NULL;
-	uint8_t symboFlags = 0;
-	long libraryOrdinal = 0;
-	bool done = false;
-	uintptr_t result = 0;
-	const uint8_t* p = &start[lazyBindingInfoOffset];
-	while ( !done && (p < end) ) {
-		uint8_t immediate = *p & BIND_IMMEDIATE_MASK;
-		uint8_t opcode = *p & BIND_OPCODE_MASK;
-		++p;
-		switch (opcode) {
-			case BIND_OPCODE_DONE:
-				done = true;
-				break;
-			case BIND_OPCODE_SET_DYLIB_ORDINAL_IMM:
-				libraryOrdinal = immediate;
-				break;
-			case BIND_OPCODE_SET_DYLIB_ORDINAL_ULEB:
-				libraryOrdinal = read_uleb128(p, end);
-				break;
-			case BIND_OPCODE_SET_DYLIB_SPECIAL_IMM:
-				// the special ordinals are negative numbers
-				if ( immediate == 0 )
-					libraryOrdinal = 0;
-				else {
-					int8_t signExtended = BIND_OPCODE_MASK | immediate;
-					libraryOrdinal = signExtended;
-				}
-				break;
-			case BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM:
-				symbolName = (char*)p;
-				symboFlags = immediate;
-				while (*p != '\0')
-					++p;
-				++p;
-				break;
-			case BIND_OPCODE_SET_TYPE_IMM:
-				type = immediate;
-				break;
-			case BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB:
-				if ( immediate >= fSegmentsCount )
-					dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is too large (0..%d)", 
-							immediate, fSegmentsCount-1);
-				address = segActualLoadAddress(immediate) + read_uleb128(p, end);
-				break;
-			case BIND_OPCODE_DO_BIND:
-				
-			
-				result = this->bindAt(context, address, type, symbolName, 0, 0, libraryOrdinal, "lazy ", NULL, true);
-				break;
-			case BIND_OPCODE_SET_ADDEND_SLEB:
-			case BIND_OPCODE_ADD_ADDR_ULEB:
-			case BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB:
-			case BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED:
-			case BIND_OPCODE_DO_BIND_ULEB_TIMES_SKIPPING_ULEB:
-			default:
-				dyld::throwf("bad lazy bind opcode %d", *p);
-		}
-	}	
-	
+	uint8_t segIndex;
+	uintptr_t segOffset;
+	int libraryOrdinal;
+	const char* symbolName;
+	bool doneAfterBind;
+	uintptr_t result;
+	do {
+		if ( ! getLazyBindingInfo(lazyBindingInfoOffset, start, end, &segIndex, &segOffset, &libraryOrdinal, &symbolName, &doneAfterBind) )
+			dyld::throwf("bad lazy bind info");
+
+		if ( segIndex >= fSegmentsCount )
+			dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is too large (0..%d)", 
+							segIndex, fSegmentsCount-1);
+		if ( segOffset > segSize(segIndex) )
+			dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has offset 0x%08lX beyond segment size (0x%08lX)", segOffset, segSize(segIndex));
+		uintptr_t address = segActualLoadAddress(segIndex) + segOffset;
+        result = bindAt(context, this, address, BIND_TYPE_POINTER, symbolName, 0, 0, libraryOrdinal,
+                              NULL, "lazy ", NULL, true);
+		// <rdar://problem/24140465> Some old apps had multiple lazy symbols bound at once
+	} while (!doneAfterBind && !context.strictMachORequired);
+
 	if ( !this->usesTwoLevelNameSpace() ) {
 		// release dyld global lock
 		if ( unlock != NULL )
@@ -1284,7 +1604,7 @@
 	return result;
 }
 
-void ImageLoaderMachOCompressed::initializeCoalIterator(CoalIterator& it, unsigned int loadOrder)
+void ImageLoaderMachOCompressed::initializeCoalIterator(CoalIterator& it, unsigned int loadOrder, unsigned)
 {
 	it.image = this;
 	it.symbolName = " ";
@@ -1316,6 +1636,7 @@
 	const uint8_t* end = fLinkEditBase + fDyldInfo->weak_bind_off + this->fDyldInfo->weak_bind_size;
 	uintptr_t count;
 	uintptr_t skip;
+	uintptr_t segOffset;
 	while ( p < end ) {
 		uint8_t immediate = *p & BIND_IMMEDIATE_MASK;
 		uint8_t opcode = *p & BIND_OPCODE_MASK;
@@ -1345,7 +1666,21 @@
 				if ( immediate >= fSegmentsCount )
 					dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is too large (0..%d)",
 							immediate, fSegmentsCount-1);
-				it.address = segActualLoadAddress(immediate) + read_uleb128(p, end);
+		#if __arm__
+				// <rdar://problem/23138428> iOS app compatibility
+				if ( !segWriteable(immediate) && it.image->isPositionIndependentExecutable() )
+		#elif TEXT_RELOC_SUPPORT
+				// <rdar://problem/23479396&23590867> i386 OS X app compatibility
+				if ( !segWriteable(immediate) && !segHasRebaseFixUps(immediate) && !segHasBindFixUps(immediate)
+					&& (!it.image->isExecutable() || it.image->isPositionIndependentExecutable()) )
+		#else
+				if ( !segWriteable(immediate) )
+        #endif
+					dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB targets segment %s which is not writable", segName(immediate));
+				segOffset = read_uleb128(p, end);
+				if ( segOffset > segSize(immediate) )
+					dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has offset 0x%08lX beyond segment size (0x%08lX)", segOffset, segSize(immediate));
+				it.address = segActualLoadAddress(immediate) + segOffset;
 				break;
 			case BIND_OPCODE_ADD_ADDR_ULEB:
 				it.address += read_uleb128(p, end);
@@ -1381,7 +1716,7 @@
 {
 	//dyld::log("looking for %s in %s\n", it.symbolName, this->getPath());
 	const ImageLoader* foundIn = NULL;
-	const ImageLoader::Symbol* sym = this->findExportedSymbol(it.symbolName, &foundIn);
+	const ImageLoader::Symbol* sym = this->findShallowExportedSymbol(it.symbolName, &foundIn);
 	if ( sym != NULL ) {
 		//dyld::log("sym=%p, foundIn=%p\n", sym, foundIn);
 		return foundIn->getExportedSymbolAddress(sym, context, this);
@@ -1390,7 +1725,7 @@
 }
 
 
-void ImageLoaderMachOCompressed::updateUsesCoalIterator(CoalIterator& it, uintptr_t value, ImageLoader* targetImage, const LinkContext& context)
+void ImageLoaderMachOCompressed::updateUsesCoalIterator(CoalIterator& it, uintptr_t value, ImageLoader* targetImage, unsigned targetIndex, const LinkContext& context)
 {
 	// <rdar://problem/6570879> weak binding done too early with inserted libraries
 	if ( this->getState() < dyld_image_state_bound  )
@@ -1406,6 +1741,7 @@
 	intptr_t addend = it.addend;
 	uintptr_t count;
 	uintptr_t skip;
+	uintptr_t segOffset;
 	bool done = false;
 	bool boundSomething = false;
 	while ( !done && (p < end) ) {
@@ -1429,23 +1765,37 @@
 				if ( immediate >= fSegmentsCount )
 					dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has segment %d which is too large (0..%d)",
 							immediate, fSegmentsCount-1);
-				address = segActualLoadAddress(immediate) + read_uleb128(p, end);
+		#if __arm__
+				// <rdar://problem/23138428> iOS app compatibility
+				if ( !segWriteable(immediate) && it.image->isPositionIndependentExecutable() )
+		#elif TEXT_RELOC_SUPPORT
+				// <rdar://problem/23479396&23590867> i386 OS X app compatibility
+				if ( !segWriteable(immediate) && !segHasRebaseFixUps(immediate) && !segHasBindFixUps(immediate)
+					&& (!it.image->isExecutable() || it.image->isPositionIndependentExecutable()) )
+		#else
+				if ( !segWriteable(immediate) )
+        #endif
+					dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB targets segment %s which is not writable", segName(immediate));
+				segOffset = read_uleb128(p, end);
+				if ( segOffset > segSize(immediate) )
+					dyld::throwf("BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB has offset 0x%08lX beyond segment size (0x%08lX)", segOffset, segSize(immediate));
+				address = segActualLoadAddress(immediate) + segOffset;
 				break;
 			case BIND_OPCODE_ADD_ADDR_ULEB:
 				address += read_uleb128(p, end);
 				break;
 			case BIND_OPCODE_DO_BIND:
-				bindLocation(context, address, value, targetImage, type, symbolName, addend, "weak ");
+				bindLocation(context, this->imageBaseAddress(), address, value, type, symbolName, addend, this->getPath(), targetImage ? targetImage->getPath() : NULL, "weak ", NULL, fSlide);
 				boundSomething = true;
 				address += sizeof(intptr_t);
 				break;
 			case BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB:
-				bindLocation(context, address, value, targetImage, type, symbolName, addend, "weak ");
+				bindLocation(context, this->imageBaseAddress(), address, value, type, symbolName, addend, this->getPath(), targetImage ? targetImage->getPath() : NULL, "weak ", NULL, fSlide);
 				boundSomething = true;
 				address += read_uleb128(p, end) + sizeof(intptr_t);
 				break;
 			case BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED:
-				bindLocation(context, address, value, targetImage, type, symbolName, addend, "weak ");
+				bindLocation(context, this->imageBaseAddress(), address, value, type, symbolName, addend, this->getPath(), targetImage ? targetImage->getPath() : NULL, "weak ", NULL, fSlide);
 				boundSomething = true;
 				address += immediate*sizeof(intptr_t) + sizeof(intptr_t);
 				break;
@@ -1453,7 +1803,7 @@
 				count = read_uleb128(p, end);
 				skip = read_uleb128(p, end);
 				for (uint32_t i=0; i < count; ++i) {
-					bindLocation(context, address, value, targetImage, type, symbolName, addend, "weak ");
+					bindLocation(context, this->imageBaseAddress(), address, value, type, symbolName, addend, this->getPath(), targetImage ? targetImage->getPath() : NULL, "weak ", NULL, fSlide);
 					boundSomething = true;
 					address += skip + sizeof(intptr_t);
 				}
@@ -1467,15 +1817,19 @@
 		context.addDynamicReference(this, targetImage);
 }
 
-uintptr_t ImageLoaderMachOCompressed::interposeAt(const LinkContext& context, uintptr_t addr, uint8_t type, const char*, 
-												uint8_t, intptr_t, long, const char*, LastLookup*, bool runResolver)
+uintptr_t ImageLoaderMachOCompressed::interposeAt(const LinkContext& context, ImageLoaderMachOCompressed* image,
+												  uintptr_t addr, uint8_t type, const char*,
+                                                  uint8_t, intptr_t, long,
+                                                  ExtraBindData *extraBindData,
+                                                  const char*, LastLookup*, bool runResolver)
 {
 	if ( type == BIND_TYPE_POINTER ) {
 		uintptr_t* fixupLocation = (uintptr_t*)addr;
 		uintptr_t curValue = *fixupLocation;
-		uintptr_t newValue = interposedAddress(context, curValue, this);
-		if ( newValue != curValue)
+		uintptr_t newValue = interposedAddress(context, curValue, image);
+		if ( newValue != curValue) {
 			*fixupLocation = newValue;
+		}
 	}
 	return 0;
 }
@@ -1486,13 +1840,32 @@
 		dyld::log("dyld: interposing %lu tuples onto image: %s\n", fgInterposingTuples.size(), this->getPath());
 
 	// update prebound symbols
-	eachBind(context, &ImageLoaderMachOCompressed::interposeAt);
-	eachLazyBind(context, &ImageLoaderMachOCompressed::interposeAt);
-}
-
-
-uintptr_t ImageLoaderMachOCompressed::dynamicInterposeAt(const LinkContext& context, uintptr_t addr, uint8_t type, const char* symbolName, 
-												uint8_t, intptr_t, long, const char*, LastLookup*, bool runResolver)
+	eachBind(context, ^(const LinkContext& ctx, ImageLoaderMachOCompressed* image,
+						uintptr_t addr, uint8_t type, const char* symbolName,
+						uint8_t symbolFlags, intptr_t addend, long libraryOrdinal,
+						ExtraBindData *extraBindData,
+						const char* msg, LastLookup* last, bool runResolver) {
+		return ImageLoaderMachOCompressed::interposeAt(ctx, image, addr, type, symbolName, symbolFlags,
+													   addend, libraryOrdinal, extraBindData,
+													   msg, last, runResolver);
+	});
+	eachLazyBind(context, ^(const LinkContext& ctx, ImageLoaderMachOCompressed* image,
+							uintptr_t addr, uint8_t type, const char* symbolName,
+							uint8_t symbolFlags, intptr_t addend, long libraryOrdinal,
+							ExtraBindData *extraBindData,
+							const char* msg, LastLookup* last, bool runResolver) {
+		return ImageLoaderMachOCompressed::interposeAt(ctx, image, addr, type, symbolName, symbolFlags,
+													   addend, libraryOrdinal, extraBindData,
+													   msg, last, runResolver);
+	});
+}
+
+
+uintptr_t ImageLoaderMachOCompressed::dynamicInterposeAt(const LinkContext& context, ImageLoaderMachOCompressed* image,
+														 uintptr_t addr, uint8_t type, const char* symbolName,
+                                                         uint8_t, intptr_t, long,
+                                                         ExtraBindData *extraBindData,
+                                                         const char*, LastLookup*, bool runResolver)
 {
 	if ( type == BIND_TYPE_POINTER ) {
 		uintptr_t* fixupLocation = (uintptr_t*)addr;
@@ -1504,7 +1877,7 @@
 			if ( value == (uintptr_t)context.dynamicInterposeArray[i].replacee ) {
 				if ( context.verboseInterposing ) {
 					dyld::log("dyld: dynamic interposing: at %p replace %p with %p in %s\n", 
-						fixupLocation, context.dynamicInterposeArray[i].replacee, context.dynamicInterposeArray[i].replacement, this->getPath());
+						fixupLocation, context.dynamicInterposeArray[i].replacee, context.dynamicInterposeArray[i].replacement, image->getPath());
 				}
 				*fixupLocation = (uintptr_t)context.dynamicInterposeArray[i].replacement;
 			}
@@ -1519,82 +1892,29 @@
 		dyld::log("dyld: dynamic interposing %lu tuples onto image: %s\n", context.dynamicInterposeCount, this->getPath());
 
 	// update already bound references to symbols
-	eachBind(context, &ImageLoaderMachOCompressed::dynamicInterposeAt);
-	eachLazyBind(context, &ImageLoaderMachOCompressed::dynamicInterposeAt);
-}
-
+	eachBind(context, ^(const LinkContext& ctx, ImageLoaderMachOCompressed* image,
+						uintptr_t addr, uint8_t type, const char* symbolName,
+						uint8_t symbolFlags, intptr_t addend, long libraryOrdinal,
+						ExtraBindData *extraBindData,
+						const char* msg, LastLookup* last, bool runResolver) {
+		return ImageLoaderMachOCompressed::dynamicInterposeAt(ctx, image, addr, type, symbolName, symbolFlags,
+															  addend, libraryOrdinal, extraBindData,
+															  msg, last, runResolver);
+	});
+	eachLazyBind(context, ^(const LinkContext& ctx, ImageLoaderMachOCompressed* image,
+							uintptr_t addr, uint8_t type, const char* symbolName,
+							uint8_t symbolFlags, intptr_t addend, long libraryOrdinal,
+							ExtraBindData *extraBindData,
+							const char* msg, LastLookup* last, bool runResolver) {
+		return ImageLoaderMachOCompressed::dynamicInterposeAt(ctx, image, addr, type, symbolName, symbolFlags,
+															  addend, libraryOrdinal, extraBindData,
+															  msg, last, runResolver);
+	});
+}
 
 const char* ImageLoaderMachOCompressed::findClosestSymbol(const void* addr, const void** closestAddr) const
 {
-	// called by dladdr()
-	// only works with compressed LINKEDIT if classic symbol table is also present
-	const macho_nlist* symbolTable = NULL;
-	const char* symbolTableStrings = NULL;
-	const dysymtab_command* dynSymbolTable = NULL;
-	const uint32_t cmd_count = ((macho_header*)fMachOData)->ncmds;
-	const struct load_command* const cmds = (struct load_command*)&fMachOData[sizeof(macho_header)];
-	const struct load_command* cmd = cmds;
-	for (uint32_t i = 0; i < cmd_count; ++i) {
-		switch (cmd->cmd) {
-			case LC_SYMTAB:
-				{
-					const struct symtab_command* symtab = (struct symtab_command*)cmd;
-					symbolTableStrings = (const char*)&fLinkEditBase[symtab->stroff];
-					symbolTable = (macho_nlist*)(&fLinkEditBase[symtab->symoff]);
-				}
-				break;
-			case LC_DYSYMTAB:
-				dynSymbolTable = (struct dysymtab_command*)cmd;
-				break;
-		}
-		cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
-	}
-	// no symbol table => no lookup by address
-	if ( (symbolTable == NULL) || (dynSymbolTable == NULL) )
-		return NULL;
-
-	uintptr_t targetAddress = (uintptr_t)addr - fSlide;
-	const struct macho_nlist* bestSymbol = NULL;
-	// first walk all global symbols
-	const struct macho_nlist* const globalsStart = &symbolTable[dynSymbolTable->iextdefsym];
-	const struct macho_nlist* const globalsEnd= &globalsStart[dynSymbolTable->nextdefsym];
-	for (const struct macho_nlist* s = globalsStart; s < globalsEnd; ++s) {
- 		if ( (s->n_type & N_TYPE) == N_SECT ) {
-			if ( bestSymbol == NULL ) {
-				if ( s->n_value <= targetAddress )
-					bestSymbol = s;
-			}
-			else if ( (s->n_value <= targetAddress) && (bestSymbol->n_value < s->n_value) ) {
-				bestSymbol = s;
-			}
-		}
-	}
-	// next walk all local symbols
-	const struct macho_nlist* const localsStart = &symbolTable[dynSymbolTable->ilocalsym];
-	const struct macho_nlist* const localsEnd= &localsStart[dynSymbolTable->nlocalsym];
-	for (const struct macho_nlist* s = localsStart; s < localsEnd; ++s) {
- 		if ( ((s->n_type & N_TYPE) == N_SECT) && ((s->n_type & N_STAB) == 0) ) {
-			if ( bestSymbol == NULL ) {
-				if ( s->n_value <= targetAddress )
-					bestSymbol = s;
-			}
-			else if ( (s->n_value <= targetAddress) && (bestSymbol->n_value < s->n_value) ) {
-				bestSymbol = s;
-			}
-		}
-	}
-	if ( bestSymbol != NULL ) {
-#if __arm__
-		if (bestSymbol->n_desc & N_ARM_THUMB_DEF)
-			*closestAddr = (void*)((bestSymbol->n_value | 1) + fSlide);
-		else
-			*closestAddr = (void*)(bestSymbol->n_value + fSlide);
-#else
-		*closestAddr = (void*)(bestSymbol->n_value + fSlide);
-#endif
-		return &symbolTableStrings[bestSymbol->n_un.n_strx];
-	}
-	return NULL;
+	return ImageLoaderMachO::findClosestSymbol((mach_header*)fMachOData, addr, closestAddr);
 }
 
 
@@ -1647,9 +1967,8 @@
 void ImageLoaderMachOCompressed::updateOptimizedLazyPointers(const LinkContext& context)
 {
 #if __arm__ || __x86_64__
-	// find stubs and lazy pointer sections
+	// find stubs and indirect symbol table
 	const struct macho_section* stubsSection = NULL;
-	const struct macho_section* lazyPointerSection = NULL;
 	const dysymtab_command* dynSymbolTable = NULL;
 	const macho_header* mh = (macho_header*)fMachOData;
 	const uint32_t cmd_count = mh->ncmds;
@@ -1664,8 +1983,6 @@
 				const uint8_t type = sect->flags & SECTION_TYPE;
 				if ( type == S_SYMBOL_STUBS ) 
 					stubsSection = sect;
-				else if ( type == S_LAZY_SYMBOL_POINTERS ) 
-					lazyPointerSection = sect;
 			}
 		}
 		else if ( cmd->cmd == LC_DYSYMTAB ) {
@@ -1673,36 +1990,51 @@
 		}
 		cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
 	}
-	
-	// sanity check
 	if ( dynSymbolTable == NULL )
 		return;
-	if ( (stubsSection == NULL) || (lazyPointerSection == NULL) )
+	const uint32_t* const indirectTable = (uint32_t*)&fLinkEditBase[dynSymbolTable->indirectsymoff];
+	if ( stubsSection == NULL )
 		return;
-	const uint32_t stubsCount = stubsSection->size / stubsSection->reserved2;
-	const uint32_t lazyPointersCount = lazyPointerSection->size / sizeof(void*);
-	if ( stubsCount != lazyPointersCount )
-		return;
+	const uint32_t stubsSize = stubsSection->reserved2;
+	const uint32_t stubsCount = (uint32_t)(stubsSection->size / stubsSize);
 	const uint32_t stubsIndirectTableOffset = stubsSection->reserved1;
-	const uint32_t lazyPointersIndirectTableOffset = lazyPointerSection->reserved1;
 	if ( (stubsIndirectTableOffset+stubsCount) > dynSymbolTable->nindirectsyms )
 		return;
-	if ( (lazyPointersIndirectTableOffset+lazyPointersCount) > dynSymbolTable->nindirectsyms )
-		return;
-	
-	// walk stubs and lazy pointers
-	const uint32_t* const indirectTable = (uint32_t*)&fLinkEditBase[dynSymbolTable->indirectsymoff];
-	void** const lazyPointersStartAddr = (void**)(lazyPointerSection->addr + this->fSlide);
-	uint8_t* const stubsStartAddr = (uint8_t*)(stubsSection->addr + this->fSlide);
-	uint8_t* stub = stubsStartAddr;
-	void** lpa = lazyPointersStartAddr;
-	for(uint32_t i=0; i < stubsCount; ++i, stub += stubsSection->reserved2, ++lpa) {
-        // sanity check symbol index of stub and lazy pointer match
-		if ( indirectTable[stubsIndirectTableOffset+i] != indirectTable[lazyPointersIndirectTableOffset+i] ) 
-			continue;
-		this->updateAlternateLazyPointer(stub, lpa, context);
-	}
-	
+	uint8_t* const stubsAddr = (uint8_t*)(stubsSection->addr + this->fSlide);
+
+	// for each lazy pointer section
+	cmd = cmds;
+	for (uint32_t i = 0; i < cmd_count; ++i) {
+		if (cmd->cmd == LC_SEGMENT_COMMAND) {
+			const struct macho_segment_command* seg = (struct macho_segment_command*)cmd;
+			const struct macho_section* const sectionsStart = (struct macho_section*)((char*)seg + sizeof(struct macho_segment_command));
+			const struct macho_section* const sectionsEnd = &sectionsStart[seg->nsects];
+			for (const struct macho_section* lazyPointerSection=sectionsStart; lazyPointerSection < sectionsEnd; ++lazyPointerSection) {
+				const uint8_t type = lazyPointerSection->flags & SECTION_TYPE;
+				if ( type != S_LAZY_SYMBOL_POINTERS )
+					continue;
+				const uint32_t lazyPointersCount = (uint32_t)(lazyPointerSection->size / sizeof(void*));
+				const uint32_t lazyPointersIndirectTableOffset = lazyPointerSection->reserved1;
+				if ( (lazyPointersIndirectTableOffset+lazyPointersCount) > dynSymbolTable->nindirectsyms )
+					continue;
+				void** const lazyPointersAddr = (void**)(lazyPointerSection->addr + this->fSlide);
+				// for each lazy pointer
+				for(uint32_t lpIndex=0; lpIndex < lazyPointersCount; ++lpIndex) {
+					const uint32_t lpSymbolIndex = indirectTable[lazyPointersIndirectTableOffset+lpIndex];
+					// find matching stub and validate it uses this lazy pointer
+					for(uint32_t stubIndex=0; stubIndex < stubsCount; ++stubIndex) {
+						if ( indirectTable[stubsIndirectTableOffset+stubIndex] == lpSymbolIndex ) {
+							this->updateAlternateLazyPointer(stubsAddr+stubIndex*stubsSize, &lazyPointersAddr[lpIndex], context);
+							break;
+						}
+					}
+				}
+
+			}
+		}
+		cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
+	}
+
 #endif
 }