Loading...
dyld3/shared-cache/ImageProxy.cpp /dev/null dyld-551.3
--- /dev/null
+++ dyld/dyld-551.3/dyld3/shared-cache/ImageProxy.cpp
@@ -0,0 +1,2372 @@
+/*
+ * Copyright (c) 2017 Apple Inc. All rights reserved.
+ *
+ * @APPLE_LICENSE_HEADER_START@
+ *
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this
+ * file.
+ *
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ *
+ * @APPLE_LICENSE_HEADER_END@
+ */
+
+
+#include <string.h>
+#include <stdint.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <fcntl.h>
+#include <limits.h>
+#include <sys/errno.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/mman.h>
+#include <mach/mach_vm.h>
+#include <mach-o/dyld.h>
+#include <mach-o/dyld_priv.h>
+#include <uuid/uuid.h>
+#include <os/log.h>
+
+#include <string>
+#include <vector>
+#include <array>
+
+#include "ImageProxy.h"
+#include "FileUtils.h"
+#include "StringUtils.h"
+#include "MachOParser.h"
+#include "LaunchCacheFormat.h"
+#include "LaunchCacheWriter.h"
+#include "PathOverrides.h"
+#include "libdyldEntryVector.h"
+
+namespace dyld3 {
+
+typedef launch_cache::TargetSymbolValue   TargetSymbolValue;
+
+
+
+///////////////////////////  ImageProxy  ///////////////////////////
+
+ImageProxy::ImageProxy(const mach_header* mh, const BinaryImageData* imageData, uint32_t indexInGroup, bool dyldCacheIsRaw)
+ : _mh(mh), _sliceFileOffset(0), _modTime(0), _inode(0), _imageBinaryData(imageData), _runtimePath(launch_cache::Image(imageData).path()),
+   _groupNum(0), _indexInGroup(indexInGroup), _isSetUID(false), _dyldCacheIsRaw(dyldCacheIsRaw), _platformBinary(false), _overrideOf(ImageRef::weakImportMissing()),
+   _directDependentsSet(false), _deepDependentsSet(false), _initBeforesArraySet(false), _initBeforesComputed(false),
+   _invalid(launch_cache::Image(imageData).isInvalid()), _staticallyReferenced(false), _cwdMustBeThisDir(false)
+{
+}
+
+ImageProxy::ImageProxy(const DyldSharedCache::MappedMachO& mapping, uint32_t groupNum, uint32_t indexInGroup, bool dyldCacheIsRaw)
+ : _mh(mapping.mh), _sliceFileOffset(mapping.sliceFileOffset), _modTime(mapping.modTime), _inode(mapping.inode), _imageBinaryData(nullptr), _runtimePath(mapping.runtimePath),
+   _groupNum(groupNum), _indexInGroup(indexInGroup), _isSetUID(mapping.isSetUID), _dyldCacheIsRaw(dyldCacheIsRaw), _platformBinary(mapping.protectedBySIP),
+   _overrideOf(ImageRef::weakImportMissing()), _directDependentsSet(false), _deepDependentsSet(false), _initBeforesArraySet(false), _initBeforesComputed(false),
+   _invalid(false), _staticallyReferenced(false), _cwdMustBeThisDir(false)
+{
+}
+
+
+void ImageProxy::processRPaths(ImageProxyGroup& owningGroup)
+{
+    // parse LC_RPATH
+    __block std::unordered_set<std::string> rawRpaths;
+    MachOParser parser(_mh, _dyldCacheIsRaw);
+    parser.forEachRPath(^(const char* rpath, bool& stop) {
+        if ( rawRpaths.count(rpath) ) {
+            _diag.warning("duplicate LC_RPATH (%s) in %s", rpath, _runtimePath.c_str());
+            return;
+        }
+        rawRpaths.insert(rpath);
+        std::string thisRPath = rpath;
+        if ( startsWith(thisRPath, "@executable_path/") ) {
+            std::string mainPath = owningGroup.mainProgRuntimePath();
+            if ( mainPath.empty() && parser.isDynamicExecutable() ) {
+                mainPath = _runtimePath;
+            }
+            if ( !mainPath.empty() ) {
+                std::string newPath = mainPath.substr(0, mainPath.rfind('/')+1) + thisRPath.substr(17);
+                std::string normalizedPath = owningGroup.normalizedPath(newPath);
+                if ( fileExists(normalizedPath) )
+                    _rpaths.push_back(normalizedPath);
+                else
+                    _diag.warning("LC_RPATH to nowhere (%s) in %s", rpath, _runtimePath.c_str());
+                char resolvedMainPath[PATH_MAX];
+                if ( (realpath(mainPath.c_str(), resolvedMainPath) != nullptr) && (mainPath.c_str() != resolvedMainPath) ) {
+                    std::string realMainPath = resolvedMainPath;
+                    size_t lastSlashPos = realMainPath.rfind('/');
+                    std::string newRealPath = realMainPath.substr(0, lastSlashPos+1) + thisRPath.substr(17);
+                    if ( realMainPath != mainPath ) {
+                        for (const std::string& pre : owningGroup._buildTimePrefixes) {
+                            std::string aPath = owningGroup.normalizedPath(pre + newRealPath);
+                            if ( fileExists(aPath) ) {
+                                _rpaths.push_back(owningGroup.normalizedPath(newRealPath));
+                            }
+                        }
+                    }
+                }
+            }
+            else {
+                _diag.warning("LC_RPATH uses @executable_path in %s", _runtimePath.c_str());
+            }
+        }
+        else if ( thisRPath == "@executable_path" ) {
+            std::string mainPath = owningGroup.mainProgRuntimePath();
+            if ( mainPath.empty() && parser.isDynamicExecutable() ) {
+                mainPath = _runtimePath;
+            }
+            if ( !mainPath.empty() ) {
+                std::string newPath = mainPath.substr(0, mainPath.rfind('/')+1);
+                std::string normalizedPath = owningGroup.normalizedPath(newPath);
+                _rpaths.push_back(normalizedPath);
+            }
+            else {
+                _diag.warning("LC_RPATH uses @executable_path in %s", _runtimePath.c_str());
+            }
+        }
+        else if ( startsWith(thisRPath, "@loader_path/") ) {
+            size_t lastSlashPos = _runtimePath.rfind('/');
+            std::string newPath = _runtimePath.substr(0, lastSlashPos+1) + thisRPath.substr(13);
+            bool found = false;
+            for (const std::string& pre : owningGroup._buildTimePrefixes) {
+                std::string aPath = owningGroup.normalizedPath(pre + newPath);
+                if ( fileExists(aPath) ) {
+                    _rpaths.push_back(owningGroup.normalizedPath(newPath));
+                    found = true;
+                    break;
+                }
+            }
+            char resolvedPath[PATH_MAX];
+            if ( (realpath(_runtimePath.c_str(), resolvedPath) != nullptr) && (_runtimePath.c_str() != resolvedPath) ) {
+                std::string realRunPath = resolvedPath;
+                lastSlashPos = realRunPath.rfind('/');
+                std::string newRealPath = realRunPath.substr(0, lastSlashPos+1) + thisRPath.substr(13);
+                if ( newRealPath != newPath ) {
+                    for (const std::string& pre : owningGroup._buildTimePrefixes) {
+                        std::string aPath = owningGroup.normalizedPath(pre + newRealPath);
+                        if ( fileExists(aPath) ) {
+                            _rpaths.push_back(owningGroup.normalizedPath(newRealPath));
+                            found = true;
+                            break;
+                        }
+                    }
+                }
+            }
+            if ( !found ) {
+                // even though this path does not exist, we need to add it to must-be-missing paths
+                // in case it shows up at launch time
+                _rpaths.push_back(owningGroup.normalizedPath(newPath));
+                _diag.warning("LC_RPATH to nowhere (%s) in %s", rpath, _runtimePath.c_str());
+            }
+        }
+        else if ( thisRPath == "@loader_path" ) {
+            size_t lastSlashPos = _runtimePath.rfind('/');
+            std::string newPath = _runtimePath.substr(0, lastSlashPos+1);
+            std::string normalizedPath = owningGroup.normalizedPath(newPath);
+            _rpaths.push_back(normalizedPath);
+        }
+        else if ( rpath[0] == '@' ) {
+            _diag.warning("LC_RPATH with unknown @ variable (%s) in %s", rpath, _runtimePath.c_str());
+        }
+        else {
+            if ( rpath[0] == '/' )
+                _diag.warning("LC_RPATH is absolute path (%s) in %s", rpath, _runtimePath.c_str());
+            _rpaths.push_back(rpath);
+        }
+    });
+    //if ( !_rpaths.empty() ) {
+    //    fprintf(stderr, "for %s\n", _runtimePath.c_str());
+    //    for (const std::string& p : _rpaths)
+    //        fprintf(stderr, "   %s\n", p.c_str());
+    //}
+}
+
+void ImageProxy::addDependentsDeep(ImageProxyGroup& owningGroup, RPathChain* prev, bool staticallyReferenced)
+{
+    // mark binaries that are statically referenced and thus will never be unloaded
+    if ( staticallyReferenced )
+        _staticallyReferenced = true;
+
+    if ( _deepDependentsSet )
+        return;
+
+    // find all immediate dependents
+    addDependentsShallow(owningGroup, prev);
+    if ( _diag.hasError() ) {
+        _invalid = true;
+        return;
+    }
+
+    // recurse though each dependent
+    RPathChain rchain = { this, prev, _rpaths };
+    for (ImageProxy* proxy : _dependents) {
+        if ( proxy == nullptr )
+            continue; // skip over weak missing dependents
+        if ( !proxy->_directDependentsSet )
+            proxy->addDependentsDeep(owningGroup, &rchain, staticallyReferenced);
+        if ( proxy->invalid() )
+            _invalid = true;
+    }
+
+    _deepDependentsSet = true;
+}
+
+void ImageProxy::addDependentsShallow(ImageProxyGroup& owningGroup, RPathChain* prev)
+{
+    if ( _directDependentsSet )
+        return;
+
+    MachOParser thisParser(mh(), _dyldCacheIsRaw);
+    dyld3::Platform thisPlatform = thisParser.platform();
+
+    processRPaths(owningGroup);
+    __block RPathChain rchain = { this, prev, _rpaths };
+
+    thisParser.forEachDependentDylib(^(const char* loadPath, bool isWeak, bool isReExport, bool isUpward, uint32_t compatVersion, uint32_t curVersion, bool &stop) {
+        if ( (loadPath[0] != '/') && (loadPath[0] != '@') ) {
+            _diag.warning("load path is file system relative (%s) in %s", loadPath, runtimePath().c_str());
+        }
+        Diagnostics depDiag;
+        ImageProxy* dep = owningGroup.findImage(depDiag, loadPath, isWeak, &rchain);
+        if ( (dep == nullptr) || dep->invalid() ) {
+            if (isWeak) {
+                // weak link against a broken dylib, pretend dylib is not there
+                dep = nullptr;
+            } else {
+                if ( depDiag.warnings().empty() ) {
+                    if ( thisParser.header()->filetype == MH_EXECUTE )
+                        _diag.error("required dylib '%s' not found", loadPath);
+                    else
+                        _diag.error("required dylib '%s' not found, needed by '%s'", loadPath, runtimePath().c_str());
+                }
+                else {
+                    std::string allTries;
+                    for (const std::string& warn : depDiag.warnings()) {
+                        if ( allTries.empty() )
+                            allTries = warn;
+                        else
+                            allTries = allTries + ", " + warn;
+                    }
+                    _diag.error("required dylib '%s' not found, needed by '%s'.  Did try: %s", loadPath, runtimePath().c_str(), allTries.c_str());
+                }
+            }
+        }
+        else {
+            MachOParser depParser(dep->mh(), _dyldCacheIsRaw);
+            if ( _diag.noError() ) {
+                // verify found image has compatible version and matching platform
+                dyld3::Platform depPlatform = depParser.platform();
+                if ( depPlatform != thisPlatform ) {
+                    // simulator allows a few macOS libSystem dylibs
+                    if ( !inLibSystem() || !dep->inLibSystem() ) {
+                        _diag.error("found '%s' but it was built for different platform '%s' than required '%s'.  Needed by '%s'", dep->runtimePath().c_str(),
+                                    MachOParser::platformName(depPlatform).c_str(), MachOParser::platformName(thisPlatform).c_str(), runtimePath().c_str());
+                    }
+                }
+            }
+            if ( _diag.noError() ) {
+                // verify compat version
+                const char* installName;
+                uint32_t    foundCompatVers;
+                uint32_t    foundCurrentVers;
+                if ( depParser.header()->filetype != MH_DYLIB ) {
+                    _diag.error("found '%s' which is not a dylib.  Needed by '%s'", dep->runtimePath().c_str(), runtimePath().c_str());
+                }
+                else {
+                    depParser.getDylibInstallName(&installName, &foundCompatVers, &foundCurrentVers);
+                    if ( foundCompatVers < compatVersion ) {
+                        _diag.error("found '%s' which has compat version (%s) which is less than required (%s).  Needed by '%s'", dep->runtimePath().c_str(),
+                                    MachOParser::versionString(foundCompatVers).c_str(), MachOParser::versionString(compatVersion).c_str(), runtimePath().c_str());
+                    }
+                }
+            }
+        }
+        if ( _diag.hasError() ) {
+            stop = true;
+            _invalid = true;
+        }
+        _dependents.push_back(dep);
+        if ( isWeak )
+            _dependentsKind.push_back(launch_cache::Image::LinkKind::weak);
+        else if ( isReExport )
+            _dependentsKind.push_back(launch_cache::Image::LinkKind::reExport);
+        else if ( isUpward )
+            _dependentsKind.push_back(launch_cache::Image::LinkKind::upward);
+        else
+            _dependentsKind.push_back(launch_cache::Image::LinkKind::regular);
+    });
+    _directDependentsSet = true;
+}
+
+bool ImageProxy::inLibSystem() const
+{
+    return startsWith(runtimePath(), "/usr/lib/system/") || startsWith(runtimePath(), "/usr/lib/libSystem.");
+}
+
+void ImageProxy::forEachDependent(void (^handler)(ImageProxy* dep, LinkKind)) const
+{
+    for (int i=0; i < _dependents.size(); ++i) {
+        handler(_dependents[i], _dependentsKind[i]);
+    }
+}
+
+
+bool ImageProxy::findExportedSymbol(Diagnostics& diag, const char* symbolName, MachOParser::FoundSymbol& foundInfo) const
+{
+    MachOParser parser(_mh, _dyldCacheIsRaw);
+    return parser.findExportedSymbol(diag, symbolName, (void*)this, foundInfo, ^(uint32_t depIndex, const char* depLoadPath, void* extra, const mach_header** foundMH, void** foundExtra) {
+        ImageProxy* proxy    = (ImageProxy*)extra;
+        if ( depIndex < proxy->_dependents.size() ) {
+            ImageProxy* depProxy = proxy->_dependents[depIndex];
+            *foundMH    = depProxy->_mh;
+            *foundExtra = (void*)depProxy;
+            return true;
+        }
+        return false;
+    });
+}
+
+bool ImageProxy::InitOrderInfo::beforeHas(ImageRef ref)
+{
+    ImageRef clearRef = ref;
+    clearRef.clearKind();
+    return ( std::find(initBefore.begin(), initBefore.end(), clearRef) != initBefore.end() );
+}
+
+bool ImageProxy::InitOrderInfo::upwardHas(ImageProxy* proxy)
+{
+    return ( std::find(danglingUpward.begin(), danglingUpward.end(), proxy) != danglingUpward.end() );
+}
+
+void ImageProxy::InitOrderInfo::removeRedundantUpwards()
+{
+    danglingUpward.erase(std::remove_if(danglingUpward.begin(), danglingUpward.end(),
+                                        [&](ImageProxy* proxy) {
+                                            ImageRef ref(0, proxy->_groupNum, proxy->_indexInGroup);
+                                            return beforeHas(ref);
+                                        }), danglingUpward.end());
+}
+
+
+//
+// Every image has a list of "init-before" which means if that image was dlopen()ed
+// here is the exact list of images to initialize in the exact order.  This makes
+// the runtime easy.  It just walks the init-before list in order and runs each
+// initializer if it has not already been run.
+//
+// The init-before list for each image is calculated based on the init-before list
+// of each of its dependents.  It simply starts with the list of its first dependent,
+// then appends the list of the next, removing entries already in the list, etc.
+// Lastly if the current image has an initializer, it is appended to its init-before list.
+//
+// To handle cycles, when recursing to get a dependent's init-before list, any image
+// whose list is still being calculated (cycle), just returns its list so far.
+//
+// Explicit upward links are handled in two parts.  First, in the algorithm described above,
+// all upward links are ignored, which works fine as long as anything upward linked is
+// downward linked at some point.  If not, it is called a "dangling upward link". Since
+// nothing depends on those, they are added to the end of the final init-before list.
+//
+
+void ImageProxy::recursiveBuildInitBeforeInfo(ImageProxyGroup& owningGroup)
+{
+    if ( _initBeforesComputed )
+        return;
+    _initBeforesComputed = true; // break cycles
+
+    if ( _imageBinaryData != nullptr ) {
+        assert(_groupNum == 0);
+        // if this is proxy for something in dyld cache, get its list from cache
+        // and parse list into befores and upwards
+        launch_cache::Image image(_imageBinaryData);
+        image.forEachInitBefore(^(launch_cache::binary_format::ImageRef ref) {
+            if ( (LinkKind)ref.kind() == LinkKind::upward ) {
+                ImageProxyGroup* groupP = &owningGroup;
+                while (groupP->_groupNum != 0)
+                    groupP = groupP->_nextSearchGroup;
+                launch_cache::ImageGroup dyldCacheGroup(groupP->_basedOn);
+                launch_cache::Image      dyldCacheImage = dyldCacheGroup.image(ref.indexInGroup());
+                Diagnostics diag;
+                ImageProxy* p = groupP->findAbsoluteImage(diag, dyldCacheImage.path(), false, false);
+                if ( diag.noError() )
+                    _initBeforesInfo.danglingUpward.push_back(p);
+            }
+            else {
+                _initBeforesInfo.initBefore.push_back(ref);
+            }
+        });
+    }
+    else {
+        // calculate init-before list for this image by merging init-before's of all its dependent dylibs
+        unsigned depIndex = 0;
+        for (ImageProxy* depProxy : _dependents) {
+            if ( depProxy == nullptr ) {
+                assert(_dependentsKind[depIndex] == LinkKind::weak);
+            }
+            else {
+                if ( _dependentsKind[depIndex] == LinkKind::upward ) {
+                    // if this upward link is already in the list, we ignore it.  Otherwise add to front of list
+                    if ( _initBeforesInfo.upwardHas(depProxy) ) {
+                        // already in upward list, do nothing
+                    }
+                    else {
+                        ImageRef ref(0, depProxy->_groupNum, depProxy->_indexInGroup);
+                        if ( _initBeforesInfo.beforeHas(ref) ) {
+                            // already in before list, do nothing
+                        }
+                        else {
+                            // add to upward list
+                            _initBeforesInfo.danglingUpward.push_back(depProxy);
+                        }
+                    }
+                }
+                else {
+                    // compute init-befores of downward dependents
+                    depProxy->recursiveBuildInitBeforeInfo(owningGroup);
+                    // merge befores from this downward link into current befores list
+                    for (ImageRef depInit : depProxy->_initBeforesInfo.initBefore) {
+                        if ( !_initBeforesInfo.beforeHas(depInit) )
+                            _initBeforesInfo.initBefore.push_back(depInit);
+                    }
+                    // merge upwards from this downward link into current befores list
+                    for (ImageProxy* upProxy : depProxy->_initBeforesInfo.danglingUpward) {
+                        ImageRef ref(0, upProxy->_groupNum, upProxy->_indexInGroup);
+                        if ( _initBeforesInfo.beforeHas(ref) ) {
+                            // already in current initBefore list, so ignore this upward
+                        }
+                        else if ( _initBeforesInfo.upwardHas(upProxy) ) {
+                            // already in current danglingUpward list, so ignore this upward
+                        }
+                        else {
+                            // append to current danglingUpward list
+                            _initBeforesInfo.danglingUpward.push_back(upProxy);
+                        }
+                    }
+                }
+            }
+            ++depIndex;
+        }
+        // eliminate any upward links added to befores list by some other dependent
+        _initBeforesInfo.removeRedundantUpwards();
+
+        // if this images has initializer(s) (or +load), add it to list
+        MachOParser parser(_mh, _dyldCacheIsRaw);
+        Diagnostics diag;
+        if ( parser.hasInitializer(diag) || parser.hasPlusLoadMethod(diag) ) {
+            launch_cache::binary_format::ImageRef ref(0, _groupNum, _indexInGroup);
+            _initBeforesInfo.initBefore.push_back(ref);
+        }
+
+        //fprintf(stderr, "info for (%d, %d) %s\n",  _group, _index, _runtimePath.c_str());
+        //for (ImageRef ref : _initBeforesInfo.initBefore)
+        //     fprintf(stderr, "   ref = {%d, %d, %d}\n", ref.kind(), ref.group(), ref.index());
+        //for (ImageProxy* p : _initBeforesInfo.danglingUpward)
+        //     fprintf(stderr, "   up = %s\n", p->runtimePath().c_str());
+    }
+}
+
+void ImageProxy::convertInitBeforeInfoToArray(ImageProxyGroup& owningGroup)
+{
+    if ( _initBeforesInfo.danglingUpward.empty() ) {
+        _initBeforesArray = _initBeforesInfo.initBefore;
+    }
+    else {
+        for (ImageRef ref : _initBeforesInfo.initBefore)
+            _initBeforesArray.push_back(ref);
+        bool inLibSys = inLibSystem();
+        for (ImageProxy* proxy : _initBeforesInfo.danglingUpward) {
+            // ignore upward dependendencies between stuff within libSystem.dylib
+            if ( inLibSys && proxy->inLibSystem() )
+                continue;
+            proxy->getInitBeforeList(owningGroup);
+            for (ImageRef depInit : proxy->_initBeforesInfo.initBefore) {
+                if ( std::find(_initBeforesArray.begin(), _initBeforesArray.end(), depInit) == _initBeforesArray.end() )
+                    _initBeforesArray.push_back(depInit);
+            }
+            ImageRef ref(0, proxy->_groupNum, proxy->_indexInGroup);
+            if ( std::find(_initBeforesArray.begin(), _initBeforesArray.end(), ref) == _initBeforesArray.end() )
+                _initBeforesArray.push_back(ref);
+        }
+    }
+    //fprintf(stderr, "final init-before info for %s\n", _runtimePath.c_str());
+    //for (ImageRef ref : _initBeforesArray) {
+    //    fprintf(stderr, "   ref = {%d, %d, %d}\n", ref.linkKind, ref.group, ref.index);
+    //}
+}
+
+const std::vector<ImageRef>& ImageProxy::getInitBeforeList(ImageProxyGroup& owningGroup)
+{
+    if ( !_initBeforesArraySet ) {
+        _initBeforesArraySet = true; // break cycles
+        recursiveBuildInitBeforeInfo(owningGroup);
+        convertInitBeforeInfoToArray(owningGroup);
+    }
+    return _initBeforesArray;
+}
+
+ImageProxy::FixupInfo ImageProxy::buildFixups(Diagnostics& diag, uint64_t cacheUnslideBaseAddress, launch_cache::ImageGroupWriter& groupWriter) const
+{
+    __block ImageProxy::FixupInfo info;
+    MachOParser image(_mh, _dyldCacheIsRaw);
+
+    // add fixup for each rebase
+    __block bool rebaseError = false;
+    image.forEachRebase(diag, ^(uint32_t segIndex, uint64_t segOffset, uint8_t type, bool& stop) {
+        dyld3::launch_cache::ImageGroupWriter::FixupType fixupType = launch_cache::ImageGroupWriter::FixupType::rebase;
+        switch ( type ) {
+            case REBASE_TYPE_POINTER:
+                fixupType = launch_cache::ImageGroupWriter::FixupType::rebase;
+                break;
+            case REBASE_TYPE_TEXT_ABSOLUTE32:
+                fixupType = launch_cache::ImageGroupWriter::FixupType::rebaseText;
+                info.hasTextRelocs = true;
+                break;
+            case REBASE_TYPE_TEXT_PCREL32:
+                diag.error("pcrel text rebasing not supported");
+                stop = true;
+                rebaseError = true;
+                break;
+            default:
+                diag.error("unknown rebase type");
+                stop = true;
+                rebaseError = true;
+                break;
+        }
+        info.fixups.push_back({segIndex, segOffset, fixupType, TargetSymbolValue::makeInvalid()});
+        //fprintf(stderr, "rebase: segIndex=%d, segOffset=0x%0llX, type=%d\n", segIndex, segOffset, type);
+    });
+    if ( diag.hasError() )
+        return FixupInfo();
+
+    // add fixup for each bind
+    image.forEachBind(diag, ^(uint32_t segIndex, uint64_t segOffset, uint8_t type, int libOrdinal,
+                              uint64_t addend, const char* symbolName, bool weakImport, bool lazy, bool& stop) {
+        launch_cache::ImageGroupWriter::FixupType fixupType;
+        switch ( type ) {
+            case BIND_TYPE_POINTER:
+                if ( lazy )
+                    fixupType = launch_cache::ImageGroupWriter::FixupType::pointerLazyBind;
+                else
+                    fixupType = launch_cache::ImageGroupWriter::FixupType::pointerBind;
+                break;
+            case BIND_TYPE_TEXT_ABSOLUTE32:
+                fixupType = launch_cache::ImageGroupWriter::FixupType::bindText;
+                info.hasTextRelocs = true;
+                break;
+            case BIND_TYPE_TEXT_PCREL32:
+                fixupType = launch_cache::ImageGroupWriter::FixupType::bindTextRel;
+                info.hasTextRelocs = true;
+                break;
+            case BIND_TYPE_IMPORT_JMP_REL32:
+                fixupType = launch_cache::ImageGroupWriter::FixupType::bindImportJmpRel;
+                break;
+           default:
+                diag.error("malformed executable, unknown bind type (%d)", type);
+                stop = true;
+                return;
+        }
+        const ImageProxy*    depProxy    = nullptr;
+        bool                isWeakDylib = false;
+        if ( libOrdinal == BIND_SPECIAL_DYLIB_MAIN_EXECUTABLE ) {
+            // -bundle_loader symbols cannot be bound ahead of time, we must look them up at load time
+            uint32_t imagePathPoolOffset   =  groupWriter.addString("@main");
+            uint32_t imageSymbolPoolOffset =  groupWriter.addString(symbolName);
+            info.fixups.push_back({segIndex, segOffset, fixupType, TargetSymbolValue::makeDynamicGroupValue(imagePathPoolOffset, imageSymbolPoolOffset, weakImport)});
+            return;
+        }
+        else if ( libOrdinal == BIND_SPECIAL_DYLIB_FLAT_LOOKUP ) {
+            // -dynamic_lookup symbols cannot be bound ahead of time, we must look them up at load time
+            uint32_t imagePathPoolOffset   =  groupWriter.addString("@flat");
+            uint32_t imageSymbolPoolOffset =  groupWriter.addString(symbolName);
+            info.fixups.push_back({segIndex, segOffset, fixupType, TargetSymbolValue::makeDynamicGroupValue(imagePathPoolOffset, imageSymbolPoolOffset, weakImport)});
+            return;
+        }
+        else if ( libOrdinal == BIND_SPECIAL_DYLIB_SELF ) {
+            depProxy = this;
+        }
+        else if ( (libOrdinal >= 1) && (libOrdinal <= _dependents.size()) ) {
+            isWeakDylib = (_dependentsKind[libOrdinal-1] == LinkKind::weak);
+            depProxy    = _dependents[libOrdinal-1];
+        }
+        else {
+            diag.error("ordinal %d not supported", libOrdinal);
+            stop = true;
+            return;
+        }
+        if ( depProxy != nullptr ) {
+            MachOParser::FoundSymbol foundInfo;
+            if ( depProxy->findExportedSymbol(diag, symbolName, foundInfo) ) {
+                MachOParser implDylib(foundInfo.foundInDylib, _dyldCacheIsRaw);
+                switch ( foundInfo.kind ) {
+                    case MachOParser::FoundSymbol::Kind::headerOffset:
+                    case MachOParser::FoundSymbol::Kind::resolverOffset:
+                        if ( implDylib.inDyldCache() ) {
+                            uint32_t cacheOffset = (uint32_t)(implDylib.preferredLoadAddress() + foundInfo.value - cacheUnslideBaseAddress + addend);
+                            info.fixups.push_back({segIndex, segOffset, fixupType, TargetSymbolValue::makeSharedCacheOffset(cacheOffset)});
+                        }
+                        else {
+                            ImageProxy* foundProxy   = (ImageProxy*)(foundInfo.foundExtra);
+                            bool isIndirectGroupNum  = foundProxy->_groupNum >= 128;
+                            uint32_t groupNum        = isIndirectGroupNum ? groupWriter.addIndirectGroupNum(foundProxy->_groupNum) : foundProxy->_groupNum;
+                            info.fixups.push_back({segIndex, segOffset, fixupType, TargetSymbolValue::makeGroupValue(groupNum, foundProxy->_indexInGroup, foundInfo.value+addend, isIndirectGroupNum)});
+                        }
+                        break;
+                   case MachOParser::FoundSymbol::Kind::absolute:
+                        if (((((intptr_t)(foundInfo.value+addend)) << 2) >> 2) != (foundInfo.value+addend)) {
+                            diag.error("absolute value %lld not supported", foundInfo.value+addend);
+                            stop = true;
+                            return;
+                        }
+                        info.fixups.push_back({segIndex, segOffset, fixupType, TargetSymbolValue::makeAbsolute(foundInfo.value+addend)});
+                        break;
+                }
+            }
+            else {
+                if ( !weakImport ) {
+                    diag.error("symbol '%s' not found, expected in '%s'", symbolName, depProxy->runtimePath().c_str());
+                    stop = true;
+                }
+                // mark fixup needs to set fixup location to zero
+                info.fixups.push_back({segIndex, segOffset, fixupType, TargetSymbolValue::makeAbsolute(0)});
+            }
+        }
+        else {
+            if ( isWeakDylib ) {
+                // dylib not found and is weak, set pointers into it to zero
+                info.fixups.push_back({segIndex, segOffset, fixupType, TargetSymbolValue::makeAbsolute(0)});
+            }
+            else {
+                diag.error("dylib ordinal %d not found and not weak", libOrdinal);
+                stop = true;
+            }
+         }
+    });
+    if ( diag.hasError() )
+        return FixupInfo();
+
+    uint32_t weakDefPathPoolOffset = groupWriter.addString("@weak_def");
+    image.forEachWeakDef(diag, ^(bool strongDef, uint32_t segIndex, uint64_t segOffset, uint64_t addend, const char* symbolName, bool& stop) {
+        if ( strongDef )
+            return;
+        // find fixup for that location and change it to be a @weakdef dynamic target
+        bool altered = false;
+        for (FixUp& fixup : info.fixups) {
+            if ( (fixup.segOffset == segOffset) && (fixup.segIndex == segIndex) ) {
+                uint32_t symbolPoolOffset =  groupWriter.addString(symbolName);
+                fixup.type   = launch_cache::ImageGroupWriter::FixupType::pointerBind;
+                fixup.target = TargetSymbolValue::makeDynamicGroupValue(weakDefPathPoolOffset, symbolPoolOffset, false);
+                altered = true;
+            }
+        }
+        if ( !altered ) {
+            if ( image.isSlideable() ) {
+                fprintf(stderr, "weak def for %s can't find underlying rebase/bind in %s\n", symbolName, runtimePath().c_str());
+            }
+            else {
+                // no-pie executable does not have rebase for weak-def fixup, so add fixup
+                uint32_t symbolPoolOffset =  groupWriter.addString(symbolName);
+                info.fixups.push_back({segIndex, segOffset, launch_cache::ImageGroupWriter::FixupType::pointerBind, TargetSymbolValue::makeDynamicGroupValue(weakDefPathPoolOffset, symbolPoolOffset, false)} );
+            }
+        }
+
+    });
+
+    return info;
+}
+
+
+void ImageProxy::setOverrideOf(uint32_t groupNum, uint32_t indexInGroup)
+{
+    _overrideOf = ImageRef(0, groupNum, indexInGroup);
+}
+
+
+static bool alreadyInList(const std::vector<ImageProxy*>& imageList, ImageProxy* image)
+{
+    for (ImageProxy* proxy : imageList) {
+        if ( proxy == image )
+            return true;
+    }
+    return false;
+}
+
+void ImageProxy::addToFlatLookup(std::vector<ImageProxy*>& imageList)
+{
+    // add all images shallow
+    bool addedSomething = false;
+    for (ImageProxy* dep : _dependents) {
+        if ( dep == nullptr )
+            continue;
+        if ( !alreadyInList(imageList, dep) ) {
+            imageList.push_back(dep);
+            addedSomething = true;
+        }
+    }
+    // recurse
+    if ( addedSomething ) {
+        for (ImageProxy* dep : _dependents) {
+            if ( dep == nullptr )
+                continue;
+            dep->addToFlatLookup(imageList);
+        }
+    }
+}
+
+
+///////////////////////////  ImageProxyGroup  ///////////////////////////
+
+
+class StringPool
+{
+public:
+    uint32_t            add(const std::string& str);
+    size_t              size() const   { return _buffer.size(); }
+    const char*         buffer() const { return &_buffer[0]; }
+    void                align();
+private:
+    std::vector<char>                           _buffer;
+    std::unordered_map<std::string, uint32_t>   _existingEntries;
+};
+
+uint32_t StringPool::add(const std::string& str)
+{
+    auto pos = _existingEntries.find(str);
+    if ( pos != _existingEntries.end() )
+        return pos->second;
+    size_t len = str.size() + 1;
+    size_t offset = _buffer.size();
+    _buffer.insert(_buffer.end(), &str[0], &str[len]);
+    _existingEntries[str] = (uint32_t)offset;
+    assert(offset < 0xFFFF);
+    return (uint32_t)offset;
+}
+
+void StringPool::align()
+{
+    while ( (_buffer.size() % 4) != 0 )
+        _buffer.push_back('\0');
+}
+
+ImageProxyGroup::ImageProxyGroup(uint32_t groupNum, const DyldCacheParser& dyldCache, const launch_cache::binary_format::ImageGroup* basedOn,
+                                 ImageProxyGroup* next, const std::string& mainProgRuntimePath,
+                                 const std::vector<const BinaryImageGroupData*>& knownGroups,
+                                 const std::vector<std::string>& buildTimePrefixes,
+                                 const std::vector<std::string>& envVars,
+                                 bool stubsEliminated, bool dylibsExpectedOnDisk, bool inodesAreSameAsRuntime)
+    : _pathOverrides(envVars), _patchTable(nullptr), _basedOn(basedOn), _dyldCache(dyldCache), _nextSearchGroup(next), _groupNum(groupNum),
+      _stubEliminated(stubsEliminated), _dylibsExpectedOnDisk(dylibsExpectedOnDisk), _inodesAreSameAsRuntime(inodesAreSameAsRuntime),
+      _knownGroups(knownGroups), _buildTimePrefixes(buildTimePrefixes), _mainProgRuntimePath(mainProgRuntimePath), _platform(Platform::unknown)
+{
+    _archName = dyldCache.cacheHeader()->archName();
+    _platform = (Platform)(dyldCache.cacheHeader()->platform());
+}
+
+
+ImageProxyGroup::~ImageProxyGroup()
+{
+    for (DyldSharedCache::MappedMachO& mapping : _ownedMappings ) {
+        vm_deallocate(mach_task_self(), (vm_address_t)mapping.mh, mapping.length);
+    }
+    for (ImageProxy* proxy : _images) {
+        delete proxy;
+    }
+}
+
+
+std::string ImageProxyGroup::normalizedPath(const std::string& path)
+{
+    for (const std::string& prefix : _buildTimePrefixes) {
+        std::string fullPath = prefix + path;
+        if ( fileExists(fullPath) ) {
+            if ( (fullPath.find("/../") != std::string::npos) || (fullPath.find("//") != std::string::npos) || (fullPath.find("/./") != std::string::npos) ) {
+                char resolvedPath[PATH_MAX];
+                if ( realpath(fullPath.c_str(), resolvedPath) != nullptr ) {
+                    std::string resolvedUnPrefixed = &resolvedPath[prefix.size()];
+                    return resolvedUnPrefixed;
+                }
+            }
+            break;
+        }
+    }
+    return path;
+}
+
+
+ImageProxy* ImageProxyGroup::findImage(Diagnostics& diag, const std::string& runtimeLoadPath, bool canBeMissing, ImageProxy::RPathChain* rChain)
+{
+    __block ImageProxy* result = nullptr;
+    _pathOverrides.forEachPathVariant(runtimeLoadPath.c_str(), _platform, ^(const char* possiblePath, bool& stop) {
+        if ( startsWith(possiblePath, "@rpath/") ) {
+            std::string trailing = &possiblePath[6];
+            for (const ImageProxy::RPathChain* cur=rChain; cur != nullptr; cur = cur->prev) {
+                for (const std::string& rpath : cur->rpaths) {
+                    std::string aPath = rpath + trailing;
+                    result = findAbsoluteImage(diag, aPath, true, false);
+                    if ( result != nullptr ) {
+                        _pathToProxy[runtimeLoadPath] = result;
+                        stop = true;
+                        return;
+                    }
+                }
+            }
+            // if cannot be found via current stack of rpaths, check if already found
+            auto pos = _pathToProxy.find(possiblePath);
+            if ( pos != _pathToProxy.end() ) {
+                result = pos->second;
+                stop = true;
+                return;
+            }
+        }
+        else if ( startsWith(possiblePath, "@loader_path/") ) {
+            std::string loaderFile = rChain->inProxy->runtimePath();
+            size_t lastSlash = loaderFile.rfind('/');
+            if ( lastSlash != std::string::npos ) {
+                std::string loaderDir = loaderFile.substr(0, lastSlash);
+                std::string newPath = loaderDir + &possiblePath[12];
+                result = findAbsoluteImage(diag, newPath, canBeMissing, false);
+                if ( result != nullptr ) {
+                    _pathToProxy[runtimeLoadPath] = result;
+                    stop = true;
+                    return;
+                }
+            }
+        }
+        else if ( startsWith(possiblePath, "@executable_path/") ) {
+            for (const ImageProxy::RPathChain* cur=rChain; cur != nullptr; cur = cur->prev) {
+                if ( cur->inProxy->mh()->filetype == MH_EXECUTE ) {
+                    std::string mainProg = cur->inProxy->runtimePath();
+                    size_t lastSlash = mainProg.rfind('/');
+                    if ( lastSlash != std::string::npos ) {
+                        std::string mainDir = mainProg.substr(0, lastSlash);
+                        std::string newPath = mainDir + &possiblePath[16];
+                        result = findAbsoluteImage(diag, newPath, canBeMissing, false);
+                        if ( result != nullptr ) {
+                            _pathToProxy[runtimeLoadPath] = result;
+                            stop = true;
+                            return;
+                        }
+                    }
+                }
+            }
+        }
+        else {
+            // load command is full path to dylib
+            result = findAbsoluteImage(diag, possiblePath, canBeMissing, false);
+            if ( result != nullptr ) {
+                stop = true;
+                return;
+            }
+        }
+    });
+
+    // when building closure, check if an added dylib is an override for something in the cache
+    if ( (result != nullptr) && (_groupNum > 1) && !result->isProxyForCachedDylib() ) {
+        for (ImageProxyGroup* grp = this; grp != nullptr; grp = grp->_nextSearchGroup) {
+            if ( grp->_basedOn == nullptr )
+                continue;
+            uint32_t indexInGroup;
+            launch_cache::ImageGroup imageGroup(grp->_basedOn);
+            if ( imageGroup.findImageByPath(runtimeLoadPath.c_str(), indexInGroup) ) {
+                result->setOverrideOf(imageGroup.groupNum(), indexInGroup);
+                break;
+            }
+        }
+    }
+
+    return result;
+}
+
+
+bool ImageProxyGroup::builtImageStillValid(const launch_cache::Image& image)
+{
+    // only do checks when running on system
+    if ( _buildTimePrefixes.size() != 1 )
+        return true;
+    if ( _buildTimePrefixes.front().size() != 0 )
+        return true;
+    if ( _platform != MachOParser::currentPlatform() )
+        return true;
+
+    struct stat statBuf;
+    bool expectedOnDisk   = image.group().dylibsExpectedOnDisk();
+    bool overridableDylib = image.overridableDylib();
+    bool cachedDylib      = !image.isDiskImage();
+    bool fileFound        = ( ::stat(image.path(), &statBuf) == 0 );
+
+    if ( cachedDylib ) {
+        if ( expectedOnDisk ) {
+            if ( fileFound ) {
+                // macOS case: verify dylib file info matches what it was when cache was built
+                return ( (image.fileModTime() == statBuf.st_mtime) && (image.fileINode() == statBuf.st_ino) );
+            }
+            else {
+                // macOS case: dylib missing
+                return false;
+            }
+        }
+        else {
+            if ( fileFound ) {
+                if ( overridableDylib ) {
+                    // iOS case: internal install with dylib root
+                    return false;
+                }
+                else {
+                    // iOS case: customer install, ignore dylib on disk
+                    return true;
+                }
+            }
+            else {
+                // iOS case: cached dylib not on disk as expected
+                return true;
+            }
+        }
+    }
+    else {
+        if ( fileFound ) {
+            if ( image.validateUsingModTimeAndInode() ) {
+                // macOS case: verify dylib file info matches what it was when cache was built
+                return ( (image.fileModTime() == statBuf.st_mtime) && (image.fileINode() == statBuf.st_ino) );
+            }
+            else {
+                // FIXME: need to verify file cdhash
+                return true;
+            }
+        }
+        else {
+            // dylib not on disk as expected
+            return false;
+        }
+    }
+}
+
+ImageProxy* ImageProxyGroup::findAbsoluteImage(Diagnostics& diag, const std::string& runtimeLoadPath, bool canBeMissing, bool makeErrorMessage, bool pathIsAlreadyReal)
+{
+    auto pos = _pathToProxy.find(runtimeLoadPath);
+    if ( pos != _pathToProxy.end() )
+        return pos->second;
+
+    // see if this ImageProxyGroup is a proxy for an ImageGroup from the dyld shared cache
+    if ( _basedOn != nullptr ) {
+        uint32_t foundIndex;
+        launch_cache::ImageGroup imageGroup(_basedOn);
+        if ( imageGroup.findImageByPath(runtimeLoadPath.c_str(), foundIndex) ) {
+            launch_cache::Image image = imageGroup.image(foundIndex);
+            if ( builtImageStillValid(image) ) {
+                ImageProxy* proxy = nullptr;
+                if ( _groupNum == 0 ) {
+                    const mach_header* mh = (mach_header*)((uint8_t*)(_dyldCache.cacheHeader()) + image.cacheOffset());
+                    proxy = new ImageProxy(mh, image.binaryData(), foundIndex, _dyldCache.cacheIsMappedRaw());
+                }
+                else {
+                    DyldSharedCache::MappedMachO* mapping = addMappingIfValidMachO(diag, runtimeLoadPath);
+                    if ( mapping != nullptr ) {
+                        proxy = new ImageProxy(*mapping, _groupNum, foundIndex, false);
+                    }
+                }
+                if ( proxy != nullptr ) {
+                    _pathToProxy[runtimeLoadPath] = proxy;
+                    _images.push_back(proxy);
+                    if ( runtimeLoadPath != image.path() ) {
+                        // lookup path is an alias, add real path too
+                        _pathToProxy[image.path()] = proxy;
+                    }
+                    return proxy;
+                }
+            }
+        }
+    }
+
+    if ( _nextSearchGroup != nullptr ) {
+        ImageProxy* result = _nextSearchGroup->findAbsoluteImage(diag, runtimeLoadPath, true, false);
+        if ( result != nullptr )
+            return result;
+    }
+
+    // see if this is a symlink to a dylib
+    if ( !pathIsAlreadyReal ) {
+        for (const std::string& prefix : _buildTimePrefixes) {
+            std::string fullPath = prefix + runtimeLoadPath;
+            if ( endsWith(prefix, "/") )
+                fullPath = prefix.substr(0, prefix.size()-1) + runtimeLoadPath;
+            if ( fileExists(fullPath) ) {
+                std::string resolvedPath = realFilePath(fullPath);
+                if ( !resolvedPath.empty() && (resolvedPath!= fullPath) ) {
+                    std::string resolvedRuntimePath = resolvedPath.substr(prefix.size());
+                    ImageProxy* proxy = findAbsoluteImage(diag, resolvedRuntimePath, true, false, true);
+                    if ( proxy != nullptr )
+                        return proxy;
+                }
+            }
+        }
+    }
+
+    if ( (_groupNum >= 2) && (_basedOn == nullptr) ) {
+        if ( (runtimeLoadPath[0] != '/') && (runtimeLoadPath[0] != '@') ) {
+            for (ImageProxy* aProxy : _images) {
+                if ( endsWith(aProxy->runtimePath(), runtimeLoadPath) ) {
+                    aProxy->setCwdMustBeThisDir();
+                    return aProxy;
+                }
+            }
+        }
+
+        DyldSharedCache::MappedMachO* mapping = addMappingIfValidMachO(diag, runtimeLoadPath);
+        if ( mapping != nullptr ) {
+            ImageProxy* proxy = new ImageProxy(*mapping, _groupNum, (uint32_t)_images.size(), false);
+            _pathToProxy[runtimeLoadPath] = proxy;
+            _images.push_back(proxy);
+            return proxy;
+        }
+    }
+
+    if ( !canBeMissing && makeErrorMessage ) {
+        if ( diag.warnings().empty() ) {
+            if ( diag.hasError() ) {
+                std::string orgMsg = diag.errorMessage();
+                diag.error("'%s' %s", runtimeLoadPath.c_str(), orgMsg.c_str());
+            }
+            else {
+                diag.error("could not find '%s'", runtimeLoadPath.c_str());
+            }
+        }
+        else {
+            std::string allTries;
+            for (const std::string& warn : diag.warnings()) {
+                if ( allTries.empty() )
+                    allTries = warn;
+                else
+                    allTries = allTries + ", " + warn;
+            }
+            diag.clearWarnings();
+            diag.error("could not use '%s'. Did try: %s", runtimeLoadPath.c_str(), allTries.c_str());
+        }
+    }
+
+    // record locations not found so it can be verified they are still missing at runtime
+    _mustBeMissingFiles.insert(runtimeLoadPath);
+
+    return nullptr;
+}
+
+
+DyldSharedCache::MappedMachO* ImageProxyGroup::addMappingIfValidMachO(Diagnostics& diag, const std::string& runtimePath, bool ignoreMainExecutables)
+{
+    bool fileFound = false;
+    for (const std::string& prefix : _buildTimePrefixes) {
+        std::string fullPath = prefix + runtimePath;
+        struct stat statBuf;
+        if ( stat(fullPath.c_str(), &statBuf) != 0 )
+            continue;
+        fileFound = true;
+        // map whole file and determine if it is mach-o or a fat file
+        int fd = ::open(fullPath.c_str(), O_RDONLY);
+        if ( fd < 0 ) {
+            diag.warning("file not open()able '%s' errno=%d", fullPath.c_str(), errno);
+            continue;
+        }
+        size_t len = (size_t)statBuf.st_size;
+        size_t offset = 0;
+        const void* p = ::mmap(NULL, len, PROT_READ, MAP_PRIVATE, fd, 0);
+        if ( p != MAP_FAILED ) {
+            size_t sliceLen;
+            size_t sliceOffset;
+            bool missingSlice;
+            Diagnostics fatDiag;
+            if ( FatUtil::isFatFileWithSlice(fatDiag, p, len, _archName, sliceOffset, sliceLen, missingSlice) ) {
+                // unmap whole file
+                ::munmap((void*)p, len);
+                // remap just slice
+                p = ::mmap(NULL, sliceLen, PROT_READ, MAP_PRIVATE, fd, sliceOffset);
+                if ( p != MAP_FAILED ) {
+                    offset = sliceOffset;
+                    len    = sliceLen;
+                }
+            }
+            else if ( fatDiag.hasError() ) {
+                diag.warning("%s", fatDiag.errorMessage().c_str());
+            }
+            if ( (p != MAP_FAILED) && !missingSlice && MachOParser::isValidMachO(diag, _archName, _platform, p, len, fullPath, ignoreMainExecutables) ) {
+                bool issetuid = (statBuf.st_mode & (S_ISUID|S_ISGID));
+                bool sip = false; // FIXME
+                _ownedMappings.emplace_back(runtimePath, (mach_header*)p, len, issetuid, sip, offset, statBuf.st_mtime, statBuf.st_ino);
+                ::close(fd);
+                return &_ownedMappings.back();
+            }
+            else if (p != MAP_FAILED) {
+                ::munmap((void*)p, len);
+            }
+        }
+        ::close(fd);
+    }
+    if ( !fileFound )
+        diag.warning("file not found '%s'", runtimePath.c_str());
+
+    return nullptr;
+}
+
+static bool dontExamineDir(const std::string& dirPath)
+{
+    return endsWith(dirPath, ".app") || endsWith(dirPath, ".xctoolchain") || endsWith(dirPath, ".sdk") || endsWith(dirPath, ".platform");
+}
+
+void ImageProxyGroup::addExtraMachOsInBundle(const std::string& appDir)
+{
+    iterateDirectoryTree("", appDir, ^(const std::string& dirPath) { return dontExamineDir(dirPath); }, ^(const std::string& path, const struct stat& statBuf) {
+        // ignore files that don't have 'x' bit set (all runnable mach-o files do)
+        const bool hasXBit = ((statBuf.st_mode & S_IXOTH) == S_IXOTH);
+        if ( !hasXBit )
+            return;
+
+        // ignore files too small
+        if ( statBuf.st_size < 0x1000 )
+            return;
+
+        // if the file is mach-o, add to list
+        if ( _pathToProxy.find(path) == _pathToProxy.end() ) {
+            Diagnostics  machoDiag;
+            DyldSharedCache::MappedMachO* mapping = addMappingIfValidMachO(machoDiag, path, true);
+            if ( mapping != nullptr ) {
+                ImageProxy* proxy = new ImageProxy(*mapping, _groupNum, (uint32_t)_images.size(), false);
+                if ( proxy != nullptr ) {
+                    _pathToProxy[path] = proxy;
+                    _images.push_back(proxy);
+                }
+            }
+        }
+    });
+}
+
+// used when building dyld shared cache
+ImageProxyGroup* ImageProxyGroup::makeDyldCacheDylibsGroup(Diagnostics& diag, const DyldCacheParser& dyldCache,
+                                                           const std::vector<DyldSharedCache::MappedMachO>& cachedDylibs,
+                                                           const std::vector<std::string>& buildTimePrefixes,
+                                                           const PatchTable& patchTable, bool stubEliminated, bool dylibsExpectedOnDisk)
+{
+    std::vector<std::string> emptyEnvVars; // Note: this method only used when constructing dyld cache where envs are not used
+    std::vector<const BinaryImageGroupData*> noExistingGroups;
+    ImageProxyGroup* groupProxy = new ImageProxyGroup(0, dyldCache, nullptr, nullptr, "", noExistingGroups, buildTimePrefixes, emptyEnvVars, stubEliminated, dylibsExpectedOnDisk);
+    groupProxy->_patchTable = &patchTable;
+
+    // add every dylib in shared cache to _images
+    uint32_t indexInGroup = 0;
+    for (const DyldSharedCache::MappedMachO& mapping : cachedDylibs) {
+        ImageProxy* proxy = new ImageProxy(mapping, 0, indexInGroup++, true);
+        groupProxy->_images.push_back(proxy);
+        groupProxy->_pathToProxy[mapping.runtimePath] = proxy;
+    }
+
+    // verify libdyld is compatible
+    ImageRef libdyldEntryImageRef = ImageRef::makeEmptyImageRef();
+    uint32_t libdyldEntryOffset;
+    groupProxy->findLibdyldEntry(diag, libdyldEntryImageRef, libdyldEntryOffset);
+    if ( diag.hasError() ) {
+        delete groupProxy;
+        return nullptr;
+    }
+
+    // wire up dependents
+    bool hadError = false;
+    for (size_t i=0; i < groupProxy->_images.size(); ++i) {
+        // note: addDependentsShallow() can append to _images, so can't use regular iterator
+        ImageProxy* proxy = groupProxy->_images[i];
+        proxy->addDependentsShallow(*groupProxy);
+        if ( proxy->diagnostics().hasError() ) {
+            hadError = true;
+            diag.copy(proxy->diagnostics());
+            break;
+        }
+    }
+
+    if ( hadError ) {
+        delete groupProxy;
+        return nullptr;
+    }
+
+    return groupProxy;
+}
+
+
+// used when building dyld shared cache
+ImageProxyGroup* ImageProxyGroup::makeOtherOsGroup(Diagnostics& diag, const DyldCacheParser& dyldCache, ImageProxyGroup* cachedDylibsGroup,
+                                                   const std::vector<DyldSharedCache::MappedMachO>& otherDylibsAndBundles,
+                                                   bool inodesAreSameAsRuntime, const std::vector<std::string>& buildTimePrefixes)
+{
+    std::vector<std::string> emptyEnvVars; // Note: this method only used when constructing dyld cache where envs are not used
+    const BinaryImageGroupData* cachedDylibsGroupData = dyldCache.cachedDylibsGroup();
+    std::vector<const BinaryImageGroupData*> existingGroups = { cachedDylibsGroupData };
+    ImageProxyGroup          dyldCacheDylibProxyGroup(0, dyldCache, cachedDylibsGroupData, nullptr,           "", existingGroups, buildTimePrefixes, emptyEnvVars);
+    ImageProxyGroup* groupProxy = new ImageProxyGroup(1, dyldCache, nullptr,               cachedDylibsGroup, "", existingGroups, buildTimePrefixes, emptyEnvVars,
+                                                      false, true, inodesAreSameAsRuntime);
+
+    // add every dylib/bundle in "other: list to _images
+    uint32_t indexInGroup = 0;
+    for (const DyldSharedCache::MappedMachO& mapping : otherDylibsAndBundles) {
+        ImageProxy* proxy = new ImageProxy(mapping, 1, indexInGroup++, true);
+        groupProxy->_images.push_back(proxy);
+        groupProxy->_pathToProxy[mapping.runtimePath] = proxy;
+    }
+
+    // wire up dependents
+    for (size_t i=0; i < groupProxy->_images.size(); ++i) {
+        // note: addDependentsShallow() can append to _images, so can't use regular iterator
+        ImageProxy* proxy = groupProxy->_images[i];
+        // note: other-dylibs can only depend on dylibs in this group or group 0, so no need for deep dependents
+        proxy->addDependentsShallow(*groupProxy);
+        if ( proxy->diagnostics().hasError() ) {
+            diag.warning("adding dependents to %s: %s", proxy->runtimePath().c_str(), proxy->diagnostics().errorMessage().c_str());
+            proxy->markInvalid();
+        }
+    }
+    // propagate invalidness
+    __block bool somethingInvalid;
+    do {
+        somethingInvalid = false;
+        for (ImageProxy* proxy : groupProxy->_images) {
+            proxy->forEachDependent(^(ImageProxy* dep, LinkKind) {
+                if ( (dep != nullptr) && dep->invalid() && !proxy->invalid()) {
+                    proxy->markInvalid();
+                    somethingInvalid = true;
+                }
+            });
+        }
+    } while (somethingInvalid);
+
+    return groupProxy;
+}
+
+// used by closured for dlopen of unknown dylibs
+const BinaryImageGroupData* ImageProxyGroup::makeDlopenGroup(Diagnostics& diag, const DyldCacheParser& dyldCache, uint32_t groupNum,
+                                                             const std::vector<const BinaryImageGroupData*>& existingGroups,
+                                                             const std::string& imagePath, const std::vector<std::string>& envVars)
+{
+    const std::vector<std::string>& noBuildTimePrefixes = {""};
+    ImageProxyGroup dyldCacheDylibProxyGroup(0, dyldCache, existingGroups[0], nullptr,                   "",        existingGroups, noBuildTimePrefixes, envVars);
+    ImageProxyGroup dyldCacheOtherProxyGroup(1, dyldCache, nullptr,           &dyldCacheDylibProxyGroup, "",        existingGroups, noBuildTimePrefixes, envVars);
+    ImageProxyGroup dlopenGroupProxy(groupNum,  dyldCache, nullptr,           &dyldCacheOtherProxyGroup, imagePath, existingGroups, noBuildTimePrefixes, envVars, false, true, true);
+
+    DyldSharedCache::MappedMachO* topMapping = dlopenGroupProxy.addMappingIfValidMachO(diag, imagePath, true);
+    if ( topMapping == nullptr ) {
+        if ( diag.noError() ) {
+            const std::set<std::string>& warnings = diag.warnings();
+            if ( warnings.empty() )
+                diag.error("no loadable mach-o in %s", imagePath.c_str());
+            else
+                diag.error("%s", (*warnings.begin()).c_str());
+        }
+        return nullptr;
+    }
+
+    ImageProxy* topImageProxy = new ImageProxy(*topMapping, groupNum, 0, false);
+    if ( topImageProxy == nullptr ) {
+        diag.error("can't find slice matching dyld cache in %s", imagePath.c_str());
+        return nullptr;
+    }
+    dlopenGroupProxy._images.push_back(topImageProxy);
+    dlopenGroupProxy._pathToProxy[imagePath] = topImageProxy;
+
+    // add all dylibs needed by dylib and are not in dyld cache
+    topImageProxy->addDependentsDeep(dlopenGroupProxy, nullptr, false);
+    if ( topImageProxy->diagnostics().hasError() ) {
+        diag.copy(topImageProxy->diagnostics());
+        return nullptr;
+    }
+
+    const BinaryImageGroupData* result = dlopenGroupProxy.makeImageGroupBinary(diag);
+
+    return result;
+}
+
+
+// used when building dyld shared cache
+BinaryClosureData* ImageProxyGroup::makeClosure(Diagnostics& diag, const DyldCacheParser& dyldCache, ImageProxyGroup* cachedDylibsGroup,
+                                                ImageProxyGroup* otherOsDylibs, const DyldSharedCache::MappedMachO& mainProgMapping,
+                                                bool inodesAreSameAsRuntime, const std::vector<std::string>& buildTimePrefixes)
+{
+    // _basedOn can not be set until ImageGroup is built
+    if ( cachedDylibsGroup->_basedOn == nullptr ) {
+        cachedDylibsGroup->_basedOn = dyldCache.cachedDylibsGroup();
+    }
+    const BinaryImageGroupData* cachedDylibsGroupData = dyldCache.cachedDylibsGroup();
+    const BinaryImageGroupData* otherDylibsGroupData = dyldCache.otherDylibsGroup();
+    std::vector<const BinaryImageGroupData*> existingGroups = { cachedDylibsGroupData, otherDylibsGroupData };
+    std::vector<std::string> emptyEnvVars; // Note: this method only used when constructing dyld cache where envs are not used
+    ImageProxyGroup mainClosureGroupProxy(2, dyldCache, nullptr, otherOsDylibs, mainProgMapping.runtimePath, existingGroups, buildTimePrefixes,
+                                          emptyEnvVars, false, true, inodesAreSameAsRuntime);
+
+    ImageProxy* mainProxy = new ImageProxy(mainProgMapping, 2, 0, true);
+    if ( mainProxy == nullptr ) {
+        diag.error("can't find slice matching dyld cache in %s", mainProgMapping.runtimePath.c_str());
+        return nullptr;
+    }
+    mainClosureGroupProxy._images.push_back(mainProxy);
+    mainClosureGroupProxy._pathToProxy[mainProgMapping.runtimePath] = mainProxy;
+
+    return mainClosureGroupProxy.makeClosureBinary(diag, mainProxy, false);
+}
+
+
+bool ImageProxyGroup::addInsertedDylibs(Diagnostics& diag)
+{
+    __block bool success = true;
+    _pathOverrides.forEachInsertedDylib(^(const char* dylibPath) {
+        ImageProxy* insertProxy = findAbsoluteImage(diag, dylibPath, false, true);
+        if ( insertProxy == nullptr )
+            success = false;
+    });
+    return success;
+}
+
+static DyldCacheParser findDyldCache(Diagnostics& diag, const ClosureBuffer::CacheIdent& cacheIdent, task_t requestor, bool* dealloc)
+{
+    *dealloc = false;
+#if !defined(__MAC_OS_X_VERSION_MIN_REQUIRED) || (__MAC_OS_X_VERSION_MIN_REQUIRED >= 101300)
+    size_t currentCacheSize;
+    const DyldSharedCache* currentCache = (const DyldSharedCache*)_dyld_get_shared_cache_range(&currentCacheSize);
+    if ( currentCache != nullptr ) {
+        uuid_t currentCacheUUID;
+        currentCache->getUUID(currentCacheUUID);
+        if ( memcmp(currentCacheUUID, cacheIdent.cacheUUID, 16) == 0 ) 
+            return DyldCacheParser((const DyldSharedCache*)currentCache, false);
+    }
+#endif
+    if ( requestor == mach_task_self() ) {
+        // handle dyld_closure_util case where -cache_file option maps raw cache file into this process
+        const DyldSharedCache* altCache = (DyldSharedCache*)cacheIdent.cacheAddress;
+        uuid_t altCacheUUID;
+        altCache->getUUID(altCacheUUID);
+        if ( memcmp(altCacheUUID, cacheIdent.cacheUUID, 16) == 0 )
+            return DyldCacheParser(altCache, true); // only one cache can be mapped into process, so this must be raw
+        else
+            diag.error("dyld cache uuid has changed");
+    }
+#if BUILDING_CLOSURED
+    else {
+        // handle case where requestor to closured is running with a different dyld cache that closured
+        uint8_t cacheBuffer[4096];
+        mach_vm_size_t actualReadSize = sizeof(cacheBuffer);
+        kern_return_t r;
+        r = mach_vm_read_overwrite(requestor, cacheIdent.cacheAddress, sizeof(cacheBuffer), (vm_address_t)&cacheBuffer, &actualReadSize);
+        if ( r != KERN_SUCCESS ) {
+            diag.error("unable to read cache header from requesting process (addr=0x%llX), kern err=%d", cacheIdent.cacheAddress, r);
+            return DyldCacheParser(nullptr, false);
+        }
+        const dyld_cache_header* header = (dyld_cache_header*)cacheBuffer;
+        const dyld_cache_mapping_info* mappings = (dyld_cache_mapping_info*)(cacheBuffer + header->mappingOffset);
+        vm_address_t bufferAddress = 0;
+        r = vm_allocate(mach_task_self(), &bufferAddress, (long)cacheIdent.cacheMappedSize, VM_FLAGS_ANYWHERE);
+        if ( r != KERN_SUCCESS ) {
+            diag.error("unable to allocate space to copy custom dyld cache (size=0x%llX), kern err=%d", cacheIdent.cacheMappedSize, r);
+            return DyldCacheParser(nullptr, false);
+        }
+        uint64_t slide =  cacheIdent.cacheAddress - mappings[0].address;
+        for (int i=0; i < 3; ++i) {
+            mach_vm_address_t mappedAddress = bufferAddress + (mappings[i].address - mappings[0].address);
+            mach_vm_size_t    mappedSize    = mappings[i].size;
+            vm_prot_t         curProt       = VM_PROT_READ;
+            vm_prot_t         maxProt       = VM_PROT_READ;
+            r = mach_vm_remap(mach_task_self(), &mappedAddress, mappedSize, 0, VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE,
+                              requestor, mappings[i].address+slide, true, &curProt, &maxProt, VM_INHERIT_NONE);
+            if ( r != KERN_SUCCESS ) {
+                 diag.error("unable to mach_vm_remap region %d custom dyld cache (request addr=0x%llX, size=0x%llX), kern err=%d, localBuffer=0x%lX, localMapTarget=0x%llX",
+                           i, mappings[i].address+slide, mappedSize, r, (long)bufferAddress, mappedAddress);
+                 return DyldCacheParser(nullptr, false);
+            }
+            if ( curProt != VM_PROT_READ )
+                vm_protect(mach_task_self(), (long)mappedAddress, (long)mappedSize, false, VM_PROT_READ);
+       }
+       *dealloc = true;
+       return DyldCacheParser((DyldSharedCache*)bufferAddress, false);  // assumes cache in other process is mapped as three regions
+    }
+#endif
+    return DyldCacheParser(nullptr, false);
+}
+
+BinaryClosureData* ImageProxyGroup::makeClosure(Diagnostics& diag, const ClosureBuffer& buffer, task_t requestor, const std::vector<std::string>& buildTimePrefixes)
+{
+    // unpack buffer
+    bool deallocCacheCopy;
+    DyldCacheParser dyldCache = findDyldCache(diag, buffer.cacheIndent(), requestor, &deallocCacheCopy);
+    if ( diag.hasError() )
+        return nullptr;
+    const char* mainProg = buffer.targetPath();
+    std::vector<std::string> envVars;
+    int envCount = buffer.envVarCount();
+    const char* envVarCStrings[envCount];
+    buffer.copyImageGroups(envVarCStrings);
+    for (int i=0; i < envCount; ++i) {
+        envVars.push_back(envVarCStrings[i]);
+    }
+
+    // make ImageProxyGroups: 0, 1, 2
+    const BinaryImageGroupData* cachedDylibsGroupData = dyldCache.cachedDylibsGroup();
+    const BinaryImageGroupData* otherDylibsGroupData  = dyldCache.otherDylibsGroup();
+    std::vector<std::string> realBuildTimePrefixes;
+    for (const std::string& prefix : buildTimePrefixes)  {
+        char resolvedPath[PATH_MAX];
+        if ( realpath(prefix.c_str(), resolvedPath) != nullptr )
+            realBuildTimePrefixes.push_back(resolvedPath);
+        else
+            realBuildTimePrefixes.push_back(prefix);
+    }
+    std::vector<const BinaryImageGroupData*> existingGroups = { cachedDylibsGroupData, otherDylibsGroupData };
+    ImageProxyGroup dyldCacheDylibProxyGroup(0, dyldCache, cachedDylibsGroupData, nullptr,                   "",       existingGroups, realBuildTimePrefixes, envVars);
+    ImageProxyGroup dyldCacheOtherProxyGroup(1, dyldCache, otherDylibsGroupData,  &dyldCacheDylibProxyGroup, "",       existingGroups, realBuildTimePrefixes, envVars);
+    ImageProxyGroup mainClosureGroupProxy(   2, dyldCache, nullptr,               &dyldCacheOtherProxyGroup, mainProg, existingGroups, realBuildTimePrefixes, envVars, false, true, true);
+
+    // add any DYLD_INSERTED_LIBRARIES then main program into closure
+    BinaryClosureData* result = nullptr;
+    if ( mainClosureGroupProxy.addInsertedDylibs(diag) ) {
+        ImageProxy* proxy = mainClosureGroupProxy.findAbsoluteImage(diag, mainProg, false, true);
+        if ( proxy != nullptr ) {
+            // build closure
+            result = mainClosureGroupProxy.makeClosureBinary(diag, proxy, false);
+        }
+    }
+
+    // if client has a different cache, unmap our copy
+    if ( deallocCacheCopy )
+        vm_deallocate(mach_task_self(), (vm_address_t)dyldCache.cacheHeader(), (long)buffer.cacheIndent().cacheMappedSize);
+
+    return result;
+}
+
+ClosureBuffer closured_CreateImageGroup(const ClosureBuffer& input)
+{
+    Diagnostics diag;
+    const BinaryImageGroupData* newGroup = ImageProxyGroup::makeDlopenGroup(diag, input, mach_task_self(), {""});
+
+    if ( diag.noError() ) {
+        // on success return the ImageGroup binary in the ClosureBuffer
+        dyld3::ClosureBuffer result(newGroup);
+        free((void*)newGroup);
+        return result;
+    }
+    else {
+        // on failure return the error message in the ClosureBuffer
+        dyld3::ClosureBuffer err(diag.errorMessage().c_str());
+        return err;
+    }
+}
+
+const BinaryImageGroupData* ImageProxyGroup::makeDlopenGroup(Diagnostics& diag, const ClosureBuffer& buffer, task_t requestor, const std::vector<std::string>& buildTimePrefixes)
+{
+    // unpack buffer
+    bool deallocCacheCopy;
+    DyldCacheParser dyldCache = findDyldCache(diag, buffer.cacheIndent(), requestor, &deallocCacheCopy);
+    if ( diag.hasError() )
+        return nullptr;
+
+    const char* targetDylib = buffer.targetPath();
+    std::vector<std::string> envVars;
+    int envCount = buffer.envVarCount();
+    const char* envVarCStrings[envCount];
+    buffer.copyImageGroups(envVarCStrings);
+    for (int i=0; i < envCount; ++i) {
+        envVars.push_back(envVarCStrings[i]);
+    }
+    uint32_t groupCount = buffer.imageGroupCount() + 2;
+    const launch_cache::BinaryImageGroupData* groupDataPtrs[groupCount];
+    groupDataPtrs[0] = dyldCache.cachedDylibsGroup();
+    groupDataPtrs[1] = dyldCache.otherDylibsGroup();
+    buffer.copyImageGroups(&groupDataPtrs[2]);
+
+    // build an ImageProxyGroup for each existing group, and one for new group being constructed
+    std::vector<const launch_cache::BinaryImageGroupData*> existingGroups;
+    std::vector<std::unique_ptr<ImageProxyGroup>> proxies;
+    ImageProxyGroup* prevProxy = nullptr;
+    for (uint32_t i=0; i < groupCount; ++i) {
+        const launch_cache::BinaryImageGroupData* groupData = groupDataPtrs[i];
+        existingGroups.push_back(groupData);
+        launch_cache::ImageGroup group(groupData);
+        uint32_t groupNum = group.groupNum();
+        assert(groupNum == proxies.size());
+        proxies.emplace_back(new ImageProxyGroup(groupNum, dyldCache, groupData, prevProxy, "", existingGroups, buildTimePrefixes, envVars));
+        prevProxy = proxies.back().get();
+    }
+    ImageProxyGroup dlopenGroupProxy(groupCount, dyldCache, nullptr, prevProxy, targetDylib, existingGroups, buildTimePrefixes, envVars);
+
+    // find and mmap() top level dylib
+    DyldSharedCache::MappedMachO* topMapping = dlopenGroupProxy.addMappingIfValidMachO(diag, targetDylib, true);
+    if ( topMapping == nullptr ) {
+        std::string allWarnings;
+        for (const std::string& warn : diag.warnings()) {
+            if ( allWarnings.empty() )
+                allWarnings = warn;
+            else
+                allWarnings = allWarnings + ", " + warn;
+        }
+        diag.clearWarnings();
+        diag.error("%s", allWarnings.c_str());
+        if ( deallocCacheCopy )
+            vm_deallocate(mach_task_self(), (vm_address_t)dyldCache.cacheHeader(), (long)buffer.cacheIndent().cacheMappedSize);
+        return nullptr;
+    }
+
+    // make ImageProxy for top level dylib
+    ImageProxy* topImageProxy = new ImageProxy(*topMapping, groupCount, 0, false);
+    if ( topImageProxy == nullptr ) {
+        diag.error("can't find slice matching dyld cache in %s", targetDylib);
+        if ( deallocCacheCopy )
+            vm_deallocate(mach_task_self(), (vm_address_t)dyldCache.cacheHeader(), (long)buffer.cacheIndent().cacheMappedSize);
+        return nullptr;
+    }
+    dlopenGroupProxy._images.push_back(topImageProxy);
+    dlopenGroupProxy._pathToProxy[targetDylib] = topImageProxy;
+
+    // add all dylibs needed by dylib and are not in dyld cache
+    topImageProxy->addDependentsDeep(dlopenGroupProxy, nullptr, false);
+    if ( topImageProxy->diagnostics().hasError() ) {
+        diag.copy(topImageProxy->diagnostics());
+        if ( deallocCacheCopy )
+            vm_deallocate(mach_task_self(), (vm_address_t)dyldCache.cacheHeader(), (long)buffer.cacheIndent().cacheMappedSize);
+        return nullptr;
+    }
+
+    // construct ImageGroup from ImageProxies
+    const BinaryImageGroupData* result = dlopenGroupProxy.makeImageGroupBinary(diag);
+
+    // clean up
+    if ( deallocCacheCopy )
+        vm_deallocate(mach_task_self(), (vm_address_t)dyldCache.cacheHeader(), (long)buffer.cacheIndent().cacheMappedSize);
+
+    return result;
+}
+
+
+
+
+// Used by closured and dyld_closure_util
+BinaryClosureData* ImageProxyGroup::makeClosure(Diagnostics& diag, const DyldCacheParser& dyldCache,
+                                                const std::string& mainProg, bool includeDylibsInDir,
+                                                const std::vector<std::string>& buildTimePrefixes,
+                                                const std::vector<std::string>& envVars)
+{
+    const BinaryImageGroupData* cachedDylibsGroupData = dyldCache.cachedDylibsGroup();
+    const BinaryImageGroupData* otherDylibsGroupData  = dyldCache.otherDylibsGroup();
+    std::vector<std::string> realBuildTimePrefixes;
+    for (const std::string& prefix : buildTimePrefixes)  {
+        char resolvedPath[PATH_MAX];
+        if ( realpath(prefix.c_str(), resolvedPath) != nullptr )
+            realBuildTimePrefixes.push_back(resolvedPath);
+        else
+            realBuildTimePrefixes.push_back(prefix);
+    }
+    std::vector<const BinaryImageGroupData*> existingGroups = { cachedDylibsGroupData, otherDylibsGroupData };
+    ImageProxyGroup dyldCacheDylibProxyGroup(0, dyldCache, cachedDylibsGroupData, nullptr,                   "",       existingGroups, realBuildTimePrefixes, envVars);
+    ImageProxyGroup dyldCacheOtherProxyGroup(1, dyldCache, otherDylibsGroupData,  &dyldCacheDylibProxyGroup, "",       existingGroups, realBuildTimePrefixes, envVars);
+    ImageProxyGroup mainClosureGroupProxy(   2, dyldCache, nullptr,               &dyldCacheOtherProxyGroup, mainProg, existingGroups, realBuildTimePrefixes, envVars, false, true, true);
+
+    // add any DYLD_INSERTED_LIBRARIES into closure
+    if ( !mainClosureGroupProxy.addInsertedDylibs(diag) )
+        return nullptr;
+
+    ImageProxy* proxy = mainClosureGroupProxy.findAbsoluteImage(diag, mainProg, false, true);
+    if ( proxy == nullptr )
+        return nullptr;
+
+    return mainClosureGroupProxy.makeClosureBinary(diag, proxy, includeDylibsInDir);
+}
+
+const char* sSkipPrograms_macOS[] = {
+    "/Applications/iBooks.app/Contents/MacOS/iBooks",
+};
+
+const char* sSkipPrograms_embeddedOSes[] = {
+    "/sbin/launchd",
+    "/usr/local/sbin/launchd.debug",
+    "/usr/local/sbin/launchd.development"
+};
+
+BinaryClosureData* ImageProxyGroup::makeClosureBinary(Diagnostics& diag, ImageProxy* mainProgProxy, bool includeDylibsInDir)
+{
+    assert(mainProgProxy != nullptr);
+    assert(_images.size() >= 1);
+
+    // check black list
+    if ( _platform == Platform::macOS ) {
+        for (const char* skipProg : sSkipPrograms_macOS) {
+            if ( mainProgProxy->runtimePath() == skipProg ) {
+                diag.error("black listed program");
+                return nullptr;
+            }
+        }
+    } else {
+        for (const char* skipProg : sSkipPrograms_embeddedOSes) {
+            if ( mainProgProxy->runtimePath() == skipProg ) {
+                diag.error("black listed program");
+                return nullptr;
+            }
+        }
+    }
+
+    _mainExecutableIndex = (uint32_t)_images.size() - 1;
+    // add all dylibs needed by main excutable and are not in dyld cache
+    mainProgProxy->addDependentsDeep(*this, nullptr, true);
+    if ( mainProgProxy->diagnostics().hasError() ) {
+        diag.copy(mainProgProxy->diagnostics());
+        return nullptr;
+    }
+
+    // if main program is in .app bundle, look for other mach-o files to add to closure for use by dlopen
+    bool isAppMainExecutable = false;
+    std::string appDir;
+    std::string leafName = basePath(mainProgProxy->runtimePath());
+    size_t posAppX = mainProgProxy->runtimePath().rfind(std::string("/") + leafName + ".appex/");
+    size_t posApp  = mainProgProxy->runtimePath().rfind(std::string("/") + leafName + ".app/");
+    if (  posAppX != std::string::npos ) {
+        appDir = mainProgProxy->runtimePath().substr(0, posAppX+leafName.size()+7);
+        isAppMainExecutable = true;
+    }
+    else if ( posApp != std::string::npos ) {
+        appDir = mainProgProxy->runtimePath().substr(0, posApp+leafName.size()+5);
+        isAppMainExecutable = true;
+    }
+    if ( isAppMainExecutable ) {
+        addExtraMachOsInBundle(appDir);
+        for (size_t i=0; i < _images.size(); ++i) {
+            // note: addDependentsDeep() can append to _images, so can't use regular iterator
+            ImageProxy* aProxy = _images[i];
+            ImageProxy::RPathChain base = { aProxy, nullptr, mainProgProxy->rpaths() };
+            aProxy->addDependentsDeep(*this, &base, false);
+            if ( aProxy->diagnostics().hasError() ) {
+                aProxy->markInvalid();
+                diag.warning("%s could not be added to closure because %s", aProxy->runtimePath().c_str(), aProxy->diagnostics().errorMessage().c_str());
+            }
+        }
+    }
+    else if ( includeDylibsInDir ) {
+        size_t pos = mainProgProxy->runtimePath().rfind('/');
+        if ( pos != std::string::npos ) {
+            std::string mainDir = mainProgProxy->runtimePath().substr(0, pos);
+            addExtraMachOsInBundle(mainDir);
+            for (size_t i=0; i < _images.size(); ++i) {
+                // note: addDependentsDeep() can append to _images, so can't use regular iterator
+                ImageProxy* aProxy = _images[i];
+                aProxy->addDependentsDeep(*this, nullptr, false);
+            }
+        }
+    }
+
+    // add addition dependents of any inserted libraries
+    if ( _mainExecutableIndex != 0 ) {
+        for (uint32_t i=0; i < _mainExecutableIndex; ++i) {
+            _images[i]->addDependentsDeep(*this, nullptr, true);
+            if ( _images[i]->diagnostics().hasError() )
+                return nullptr;
+        }
+    }
+
+    // gather warnings from all statically dependent images
+    for (ImageProxy* proxy : _images) {
+        if ( !proxy->staticallyReferenced() && proxy->diagnostics().hasError() )
+            continue;
+        diag.copy(proxy->diagnostics());
+        if ( diag.hasError() ) {
+            return nullptr;
+        }
+    }
+
+    // get program entry
+    MachOParser mainExecutableParser(mainProgProxy->mh(), _dyldCache.cacheIsMappedRaw());
+    bool usesCRT;
+    uint32_t entryOffset;
+    mainExecutableParser.getEntry(entryOffset, usesCRT);
+
+    // build ImageGroupWriter
+    launch_cache::ImageGroupWriter groupWriter(_groupNum, mainExecutableParser.uses16KPages(), mainExecutableParser.is64(), _dylibsExpectedOnDisk, _inodesAreSameAsRuntime);
+    populateGroupWriter(diag, groupWriter);
+    if ( diag.hasError() )
+        return nullptr;
+
+    // pre-compute libSystem and libdyld into closure
+    ImageRef libdyldEntryImageRef = ImageRef::makeEmptyImageRef();
+    uint32_t libdyldEntryOffset;
+    findLibdyldEntry(diag, libdyldEntryImageRef, libdyldEntryOffset);
+    if ( diag.hasError() )
+        return nullptr;
+    ImageRef libSystemImageRef = ImageRef::makeEmptyImageRef();
+
+    findLibSystem(diag, mainExecutableParser.isSimulatorBinary(), libSystemImageRef);
+    if ( diag.hasError() )
+        return nullptr;
+
+    // build info about missing files and env vars
+    __block StringPool            stringPool;
+    __block std::vector<uint32_t> envVarOffsets;
+    std::vector<uint16_t>         missingFileComponentOffsets;
+    stringPool.add(" ");
+    for (const std::string& path : _mustBeMissingFiles) {
+        size_t start = 1;
+        size_t slashPos = path.find('/', start);
+        while (slashPos != std::string::npos) {
+            std::string component = path.substr(start, slashPos - start);
+            uint16_t offset = stringPool.add(component);
+            missingFileComponentOffsets.push_back(offset);
+            start = slashPos + 1;
+            slashPos = path.find('/', start);
+        }
+        std::string lastComponent = path.substr(start);
+        uint16_t offset = stringPool.add(lastComponent);
+        missingFileComponentOffsets.push_back(offset);
+        missingFileComponentOffsets.push_back(0);  // mark end of a path
+    }
+    missingFileComponentOffsets.push_back(0);  // mark end of all paths
+    if ( missingFileComponentOffsets.size() & 1 )
+        missingFileComponentOffsets.push_back(0);  // 4-byte align array
+    __block uint32_t envVarCount = 0;
+    _pathOverrides.forEachEnvVar(^(const char* envVar) {
+       envVarOffsets.push_back(stringPool.add(envVar));
+       ++envVarCount;
+    });
+
+    // 4-byte align string pool size
+    stringPool.align();
+
+    // malloc a buffer and fill in ImageGroup part
+    uint32_t groupSize             = groupWriter.size();
+    uint32_t missingFilesArraySize = (uint32_t)((missingFileComponentOffsets.size()*sizeof(uint16_t) + 3) & (-4));
+    uint32_t envVarsSize           = (uint32_t)(envVarOffsets.size()*sizeof(uint32_t));
+    uint32_t stringPoolSize        = (uint32_t)stringPool.size();
+    size_t allocSize = sizeof(launch_cache::binary_format::Closure)
+                     + groupSize
+                     + missingFilesArraySize
+                     + envVarsSize
+                     + stringPoolSize;
+    BinaryClosureData* clo = (BinaryClosureData*)malloc(allocSize);
+    groupWriter.finalizeTo(diag, _knownGroups, &clo->group);
+    launch_cache::ImageGroup cloGroup(&clo->group);
+    launch_cache::Image      mainImage(cloGroup.imageBinary(_mainExecutableIndex));
+
+    uint32_t maxImageLoadCount = groupWriter.maxLoadCount(diag, _knownGroups, &clo->group);
+
+    if ( mainImage.isInvalid() ) {
+        free((void*)clo);
+        diag.error("depends on invalid dylib");
+        return nullptr;
+    }
+
+    // fill in closure attributes
+    clo->magic                          = launch_cache::binary_format::Closure::magicV1;
+    clo->usesCRT                        = usesCRT;
+    clo->isRestricted                   = mainProgProxy->isSetUID() || mainExecutableParser.isRestricted();
+    clo->usesLibraryValidation          = mainExecutableParser.usesLibraryValidation();
+    clo->padding                        = 0;
+    clo->missingFileComponentsOffset    = offsetof(launch_cache::binary_format::Closure, group) + groupSize;
+    clo->dyldEnvVarsOffset              = clo->missingFileComponentsOffset + missingFilesArraySize;
+    clo->dyldEnvVarsCount               = envVarCount;
+    clo->stringPoolOffset               = clo->dyldEnvVarsOffset + envVarsSize;
+    clo->stringPoolSize                 = stringPoolSize;
+    clo->libSystemRef                   = libSystemImageRef;
+    clo->libDyldRef                     = libdyldEntryImageRef;
+    clo->libdyldVectorOffset            = libdyldEntryOffset;
+    clo->mainExecutableIndexInGroup     = _mainExecutableIndex;
+    clo->mainExecutableEntryOffset      = entryOffset;
+    clo->initialImageCount              = maxImageLoadCount;
+    _dyldCache.cacheHeader()->getUUID(clo->dyldCacheUUID);
+
+    if ( !mainExecutableParser.getCDHash(clo->mainExecutableCdHash) ) {
+        // if no code signature, fill in 16-bytes with UUID then 4 bytes of zero
+        bzero(clo->mainExecutableCdHash, 20);
+        mainExecutableParser.getUuid(clo->mainExecutableCdHash);
+    }
+    if ( missingFilesArraySize != 0 )
+        memcpy((uint8_t*)clo + clo->missingFileComponentsOffset, &missingFileComponentOffsets[0], missingFileComponentOffsets.size()*sizeof(uint16_t));
+    if ( envVarsSize != 0 )
+        memcpy((uint8_t*)clo + clo->dyldEnvVarsOffset, &envVarOffsets[0], envVarsSize);
+    if ( stringPool.size() != 0 )
+        memcpy((uint8_t*)clo + clo->stringPoolOffset, stringPool.buffer(), stringPool.size());
+
+    return clo;
+}
+
+const BinaryImageGroupData* ImageProxyGroup::makeImageGroupBinary(Diagnostics& diag, const char* const neverEliminateStubs[])
+{
+    const bool continueIfErrors = (_groupNum == 1);
+    bool uses16KPages = true;
+    bool is64 = true;
+    if ( !_images.empty() ) {
+        MachOParser firstParser(_images.front()->mh(), _dyldCache.cacheIsMappedRaw());
+        uses16KPages = firstParser.uses16KPages();
+        is64         = firstParser.is64();
+    }
+    launch_cache::ImageGroupWriter groupWriter(_groupNum, uses16KPages, is64, _dylibsExpectedOnDisk, _inodesAreSameAsRuntime);
+    populateGroupWriter(diag, groupWriter, neverEliminateStubs);
+    if ( diag.hasError() )
+        return nullptr;
+
+    // malloc a buffer and fill in ImageGroup part
+    BinaryImageGroupData* groupData = (BinaryImageGroupData*)malloc(groupWriter.size());
+    groupWriter.finalizeTo(diag, _knownGroups, groupData);
+
+    if ( !continueIfErrors && groupWriter.isInvalid(0) ) {
+        free((void*)groupData);
+        diag.error("depends on invalid dylib");
+        return nullptr;
+    }
+
+    return groupData;
+}
+
+
+void ImageProxyGroup::findLibdyldEntry(Diagnostics& diag, ImageRef& ref, uint32_t& vmOffsetInLibDyld)
+{
+    Diagnostics libDyldDiag;
+    ImageProxy* libDyldProxy = findImage(libDyldDiag, "/usr/lib/system/libdyld.dylib", false, nullptr);
+    if ( libDyldProxy == nullptr ) {
+        diag.error("can't find libdyld.dylib");
+        return;
+    }
+    ref = ImageRef(0, libDyldProxy->groupNum(), libDyldProxy->indexInGroup());
+
+    // find offset of "dyld3::entryVectorForDyld" in libdyld.dylib
+    Diagnostics entryDiag;
+    MachOParser::FoundSymbol dyldEntryInfo;
+    MachOParser libDyldParser(libDyldProxy->mh(), _dyldCache.cacheIsMappedRaw());
+    if ( !libDyldParser.findExportedSymbol(entryDiag, "__ZN5dyld318entryVectorForDyldE", nullptr, dyldEntryInfo, nullptr) ) {
+        diag.error("can't find dyld entry point into libdyld.dylib");
+        return;
+    }
+    vmOffsetInLibDyld = (uint32_t)dyldEntryInfo.value;
+    const LibDyldEntryVector* entry = (LibDyldEntryVector*)(libDyldParser.content(vmOffsetInLibDyld));
+    if ( entry == nullptr ) {
+        diag.error("dyld entry point at offset 0x%0X not found in libdyld.dylib", vmOffsetInLibDyld);
+        return;
+    }
+    if ( entry->vectorVersion != LibDyldEntryVector::kCurrentVectorVersion )
+        diag.error("libdyld.dylib vector version is incompatible with this dyld cache builder");
+    else if ( entry->binaryFormatVersion != launch_cache::binary_format::kFormatVersion )
+        diag.error("libdyld.dylib closures binary format version is incompatible with this dyld cache builder");
+}
+
+void ImageProxyGroup::findLibSystem(Diagnostics& diag, bool forSimulator, ImageRef& ref)
+{
+    Diagnostics libSysDiag;
+    ImageProxy* libSystemProxy = findImage(libSysDiag, forSimulator ? "/usr/lib/libSystem.dylib" : "/usr/lib/libSystem.B.dylib" , false, nullptr);
+    if ( libSystemProxy == nullptr ) {
+        diag.error("can't find libSystem.dylib");
+        return;
+    }
+    ref = ImageRef(0, libSystemProxy->groupNum(), libSystemProxy->indexInGroup());
+}
+
+
+std::vector<ImageProxy*> ImageProxyGroup::flatLookupOrder()
+{
+    std::vector<ImageProxy*> results;
+    // start with main executable and any inserted dylibs
+    for (uint32_t i=0; i <= _mainExecutableIndex; ++i)
+        results.push_back(_images[i]);
+
+    // recursive add dependents of main executable
+    _images[_mainExecutableIndex]->addToFlatLookup(results);
+
+    // recursive add dependents of any inserted dylibs
+    for (uint32_t i=0; i < _mainExecutableIndex; ++i)
+        _images[i]->addToFlatLookup(results);
+
+    return results;
+}
+
+void ImageProxyGroup::populateGroupWriter(Diagnostics& diag, launch_cache::ImageGroupWriter& groupWriter, const char* const neverEliminateStubs[])
+{
+    const bool buildingDylibsInCache = (_groupNum == 0);
+    const bool continueIfErrors      = (_groupNum == 1);
+
+    std::unordered_set<std::string>  neverStubEliminate;
+    if ( neverEliminateStubs != nullptr ) {
+        for (const char* const* nes=neverEliminateStubs; *nes != nullptr; ++nes)
+            neverStubEliminate.insert(*nes);
+    }
+    
+    // pass 1: add all images
+    const uint64_t cacheUnslideBaseAddress = _dyldCache.cacheHeader()->unslidLoadAddress();
+    const uint32_t imageCount = (uint32_t)_images.size();
+    groupWriter.setImageCount(imageCount);
+    for (uint32_t i=0; i < imageCount; ++i) {
+        MachOParser imageParser(_images[i]->mh(), _dyldCache.cacheIsMappedRaw());
+        assert((imageParser.inDyldCache() == buildingDylibsInCache) && "all images must be same type");
+        // add info for each image
+        groupWriter.setImagePath(i, _images[i]->runtimePath().c_str());
+        groupWriter.setImageIsBundle(i, (imageParser.fileType() == MH_BUNDLE));
+        bool hasObjC = imageParser.hasObjC();
+        groupWriter.setImageHasObjC(i, hasObjC);
+        bool isEncrypted = imageParser.isEncrypted();
+        groupWriter.setImageIsEncrypted(i, isEncrypted);
+        bool mayHavePlusLoad = false;
+        if ( hasObjC ) {
+            mayHavePlusLoad = isEncrypted || imageParser.hasPlusLoadMethod(diag);
+            groupWriter.setImageMayHavePlusLoads(i, mayHavePlusLoad);
+        }
+        groupWriter.setImageHasWeakDefs(i, imageParser.hasWeakDefs());
+        groupWriter.setImageMustBeThisDir(i, _images[i]->cwdMustBeThisDir());
+        groupWriter.setImageIsPlatformBinary(i, _images[i]->isPlatformBinary());
+        groupWriter.setImageOverridableDylib(i, !_stubEliminated || (neverStubEliminate.count(_images[i]->runtimePath()) != 0));
+        uuid_t uuid;
+        if ( imageParser.getUuid(uuid) )
+            groupWriter.setImageUUID(i, uuid);
+        if ( _inodesAreSameAsRuntime ) {
+            groupWriter.setImageFileMtimeAndInode(i, _images[i]->fileModTime(), _images[i]->fileInode());
+        }
+        else {
+            uint8_t cdHash[20];
+            if ( !imageParser.getCDHash(cdHash) )
+                bzero(cdHash, 20);
+            // if image is not code signed, cdHash filled with all zeros
+            groupWriter.setImageCdHash(i, cdHash);
+        }
+        if ( !buildingDylibsInCache ) {
+            groupWriter.setImageSliceOffset(i, _images[i]->sliceFileOffset());
+            uint32_t fairPlayTextOffset;
+            uint32_t fairPlaySize;
+            if ( imageParser.isFairPlayEncrypted(fairPlayTextOffset, fairPlaySize) )
+                groupWriter.setImageFairPlayRange(i, fairPlayTextOffset, fairPlaySize);
+            uint32_t codeSigOffset;
+            uint32_t codeSigSize;
+            if ( imageParser.hasCodeSignature(codeSigOffset, codeSigSize) )
+                groupWriter.setImageCodeSignatureLocation(i, codeSigOffset, codeSigSize);
+        }
+        groupWriter.setImageDependentsCount(i, imageParser.dependentDylibCount());
+        // add segments to image
+        groupWriter.setImageSegments(i, imageParser, cacheUnslideBaseAddress);
+        // add initializers to image
+        __block std::vector<uint32_t> initOffsets;
+        imageParser.forEachInitializer(diag, ^(uint32_t offset) {
+            initOffsets.push_back(offset);
+        });
+        groupWriter.setImageInitializerOffsets(i, initOffsets);
+        if ( diag.hasError() && !continueIfErrors ) {
+            return;
+        }
+        // add DOFs to image
+        __block std::vector<uint32_t> dofOffsets;
+        imageParser.forEachDOFSection(diag, ^(uint32_t offset) {
+            dofOffsets.push_back(offset);
+        });
+        groupWriter.setImageDOFOffsets(i, dofOffsets);
+        if ( diag.hasError() && !continueIfErrors ) {
+            return;
+        }
+        bool neverUnload = false;
+        if ( buildingDylibsInCache )
+            neverUnload = true;
+        if ( _images[i]->staticallyReferenced() )
+            neverUnload = true;
+        if ( imageParser.hasObjC() && (imageParser.fileType() == MH_DYLIB) )
+            neverUnload = true;
+        if ( imageParser.hasThreadLocalVariables() )
+            neverUnload = true;
+        if ( !dofOffsets.empty() )
+            neverUnload = true;
+        groupWriter.setImageNeverUnload(i, neverUnload);
+        if ( _images[i]->invalid() )
+            groupWriter.setImageInvalid(i);
+        // record if this is an override of an OS dylib
+        ImageRef stdRef = _images[i]->overrideOf();
+        if ( stdRef != ImageRef::weakImportMissing() ) {
+            ImageRef thisImageRef(0, _groupNum, i);
+            groupWriter.addImageIsOverride(stdRef, thisImageRef);
+        }
+
+        // add alias if runtimepath does not match installName
+        if ( imageParser.fileType() == MH_DYLIB ) {
+            const char* installName = imageParser.installName();
+            if ( installName[0] == '/' ) {
+                if ( _images[i]->runtimePath() != installName ) {
+                    // add install name as an alias
+                    groupWriter.addImageAliasPath(i, installName);
+                }
+            }
+            // IOKit.framework on embedded uses not flat bundle, but clients dlopen() it as if it were flat
+            if ( buildingDylibsInCache && (_platform != Platform::macOS) && (_images[i]->runtimePath() == "/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit") ) {
+                groupWriter.addImageAliasPath(i, "/System/Library/Frameworks/IOKit.framework/IOKit");
+            }
+        }
+    }
+
+    // pass 2: add all dependencies (now that we have indexes defined)
+    for (uint32_t i=0; (i < imageCount) && diag.noError(); ++i) {
+        // add dependents to image
+        __block uint32_t depIndex = 0;
+        _images[i]->forEachDependent(^(ImageProxy* dep, LinkKind kind) {
+            if ( dep == nullptr ) {
+                if ( kind == LinkKind::weak )
+                    groupWriter.setImageDependent(i, depIndex, launch_cache::binary_format::ImageRef::weakImportMissing());
+                else
+                    groupWriter.setImageInvalid(i);
+            }
+            else {
+                launch_cache::binary_format::ImageRef ref((uint8_t)kind, dep->groupNum(), dep->indexInGroup());
+                groupWriter.setImageDependent(i, depIndex, ref);
+            }
+            ++depIndex;
+        });
+    }
+
+    // pass 3: invalidate any images dependent on invalid images)
+    if ( continueIfErrors ) {
+        const launch_cache::binary_format::ImageRef missingRef = launch_cache::binary_format::ImageRef::weakImportMissing();
+        __block bool somethingInvalidated = false;
+        do {
+            somethingInvalidated = false;
+            for (uint32_t i=0; i < imageCount; ++i) {
+                if ( groupWriter.isInvalid(i) )
+                    continue;
+                uint32_t depCount = groupWriter.imageDependentsCount(i);
+                for (uint32_t depIndex=0; depIndex < depCount; ++depIndex) {
+                    launch_cache::binary_format::ImageRef ref = groupWriter.imageDependent(i, depIndex);
+                    if ( ref == missingRef )
+                        continue;
+                    if ( ref.groupNum() == _groupNum ) {
+                        if ( groupWriter.isInvalid(ref.indexInGroup()) ) {
+                            // this image depends on something invalid, so mark it invalid
+                            //fprintf(stderr, "warning: image %s depends on invalid %s\n", _images[i]->runtimePath().c_str(), _images[ref.index()]->runtimePath().c_str());
+                            groupWriter.setImageInvalid(i);
+                            somethingInvalidated = true;
+                            break;
+                        }
+                    }
+                }
+            }
+        } while (somethingInvalidated);
+    }
+
+    // pass 4: add fixups for each image, if needed
+    bool someBadFixups = false;
+    if ( !buildingDylibsInCache ) {
+        // compute fix ups for all images
+        __block std::vector<ImageProxy::FixupInfo> fixupInfos;
+        fixupInfos.resize(imageCount);
+        for (uint32_t imageIndex=0; imageIndex < imageCount; ++imageIndex) {
+            if ( groupWriter.isInvalid(imageIndex) )
+                continue;
+            Diagnostics fixupDiag;
+            fixupInfos[imageIndex] = _images[imageIndex]->buildFixups(fixupDiag, cacheUnslideBaseAddress, groupWriter);
+            if ( fixupDiag.hasError() ) {
+                // disable image in group
+                someBadFixups = true;
+                groupWriter.setImageInvalid(imageIndex);
+                if ( continueIfErrors ) {
+                    diag.warning("fixup problem in %s: %s", _images[imageIndex]->runtimePath().c_str(), fixupDiag.errorMessage().c_str());
+                    continue;
+                }
+                else {
+                    diag.error("fixup problem in %s: %s", _images[imageIndex]->runtimePath().c_str(), fixupDiag.errorMessage().c_str());
+                    return;
+                }
+            }
+        }
+        // if building closure, build patches to shared cache
+        if ( _groupNum == 2) {
+            std::unordered_set<ImageProxy*> staticImagesWithWeakDefs;
+            ImageProxyGroup* cacheGroup = _nextSearchGroup->_nextSearchGroup;
+            assert(cacheGroup->_basedOn != nullptr);
+            launch_cache::ImageGroup dyldCacheGroup(cacheGroup->_basedOn);
+            for (uint32_t imageIndex=0; imageIndex < imageCount; ++imageIndex) {
+                if ( groupWriter.isInvalid(imageIndex) )
+                    continue;
+                ImageProxy* thisProxy = _images[imageIndex];
+                // Only process interposing info on dylibs statically linked into closure
+                if ( !thisProxy->staticallyReferenced() )
+                    continue;
+                MachOParser imageParser(thisProxy->mh(), _dyldCache.cacheIsMappedRaw());
+                // if any images in closure interpose on something in dyld cache, record the cache patches needed
+                imageParser.forEachInterposingTuple(diag, ^(uint32_t segIndex, uint64_t replacementSegOffset, uint64_t replaceeSegOffset, uint64_t replacementContent, bool& tupleStop) {
+                    if ( _groupNum != 2 ) {
+                        groupWriter.setImageInvalid(imageIndex);
+                        return;
+                    }
+                    TargetSymbolValue interposeReplacee    = TargetSymbolValue::makeInvalid();
+                    TargetSymbolValue interposeReplacement = TargetSymbolValue::makeInvalid();
+                    for (const FixUp& fixup : fixupInfos[imageIndex].fixups) {
+                        if ( fixup.segIndex != segIndex )
+                            continue;
+                        if ( fixup.segOffset == replacementSegOffset ) {
+                            if ( fixup.type == launch_cache::ImageGroupWriter::FixupType::rebase ) {
+                                uint64_t offsetInImage = replacementContent - imageParser.preferredLoadAddress();
+                                interposeReplacement = TargetSymbolValue::makeGroupValue(2, imageIndex, offsetInImage, false);
+                            }
+                            else {
+                                diag.warning("bad interposing implementation in %s", _images[imageIndex]->runtimePath().c_str());
+                                return;
+                            }
+                        }
+                        else if ( fixup.segOffset ==  replaceeSegOffset ) {
+                            if ( fixup.type == launch_cache::ImageGroupWriter::FixupType::pointerBind ) {
+                                interposeReplacee = fixup.target;
+                            }
+                            else {
+                                diag.warning("bad interposing target in %s", _images[imageIndex]->runtimePath().c_str());
+                                return;
+                            }
+                        }
+                    }
+                    // scan through fixups of other images in closure looking to see what functions this entry references
+                    for (uint32_t otherIndex=0; otherIndex < imageCount; ++otherIndex) {
+                        if ( otherIndex == imageIndex )
+                            continue;
+                        for (FixUp& fixup : fixupInfos[otherIndex].fixups) {
+                            switch ( fixup.type ) {
+                                case launch_cache::ImageGroupWriter::FixupType::pointerBind:
+                                case launch_cache::ImageGroupWriter::FixupType::pointerLazyBind:
+                                    // alter fixup to use interposed function instead of requested
+                                    if ( fixup.target == interposeReplacee )
+                                        fixup.target = interposeReplacement;
+                                    break;
+                                case launch_cache::ImageGroupWriter::FixupType::rebase:
+                                case launch_cache::ImageGroupWriter::FixupType::rebaseText:
+                                case launch_cache::ImageGroupWriter::FixupType::ignore:
+                                case launch_cache::ImageGroupWriter::FixupType::bindText:
+                                case launch_cache::ImageGroupWriter::FixupType::bindTextRel:
+                                case launch_cache::ImageGroupWriter::FixupType::bindImportJmpRel:
+                                   break;
+                            }
+                        }
+                    }
+                    if ( interposeReplacee.isInvalid() || interposeReplacement.isInvalid() ) {
+                        diag.error("malformed interposing section in %s", _images[imageIndex]->runtimePath().c_str());
+                        tupleStop = true;
+                        return;
+                    }
+                    // record any overrides in shared cache that will need to be applied at launch time
+                    uint64_t offsetInCache;
+                    if ( interposeReplacee.isSharedCacheTarget(offsetInCache) ) {
+                        uint32_t patchTableIndex;
+                        if ( dyldCacheGroup.hasPatchTableIndex((uint32_t)offsetInCache, patchTableIndex) ) {
+                            uint32_t    replacementGroupNum;
+                            uint32_t    replacementIndexInGroup;
+                            uint64_t    replacementOffsetInImage;
+                            assert(interposeReplacement.isGroupImageTarget(replacementGroupNum, replacementIndexInGroup, replacementOffsetInImage));
+                            assert(replacementGroupNum == 2);
+                            assert(replacementIndexInGroup < (1 << 8));
+                            if ( replacementOffsetInImage >= 0xFFFFFFFFULL ) {
+                                diag.warning("bad interposing implementation in %s", _images[imageIndex]->runtimePath().c_str());
+                                return;
+                            }
+                            DyldCacheOverride cacheOverride;
+                            cacheOverride.patchTableIndex = patchTableIndex;
+                            cacheOverride.imageIndex      = replacementIndexInGroup;
+                            cacheOverride.imageOffset     = replacementOffsetInImage;
+                            _cacheOverrides.push_back(cacheOverride);
+                        }
+                    }
+                });
+                if ( diag.hasError() && !continueIfErrors ) {
+                    return;
+                }
+                // if any dylibs in the closure override a dyld cache dylib, then record the cache patches needed
+                ImageRef overrideOf = thisProxy->overrideOf();
+                if ( (overrideOf != ImageRef::makeEmptyImageRef()) && (overrideOf.groupNum() == 0) ) {
+                     //fprintf(stderr, "need to patch %s into cache\n", thisProxy->runtimePath().c_str());
+                    const launch_cache::Image imageInCache = dyldCacheGroup.image(overrideOf.indexInGroup());
+                    const mach_header* imageInCacheMH = (mach_header*)((char*)(_dyldCache.cacheHeader()) + imageInCache.cacheOffset());
+                    MachOParser inCacheParser(imageInCacheMH, _dyldCache.cacheIsMappedRaw());
+                    // walk all exported symbols in dylib in cache
+                    inCacheParser.forEachExportedSymbol(diag, ^(const char* symbolName, uint64_t imageOffset, bool isReExport, bool &stop) {
+                        if ( isReExport )
+                            return;
+                        uint32_t cacheOffsetOfSymbol = (uint32_t)(imageInCache.cacheOffset() + imageOffset);
+                        //fprintf(stderr, "  patch cache offset 0x%08X which is %s\n", cacheOffsetOfSymbol, symbolName);
+                        // for each exported symbol, see if it is in patch table (used by something else in cache)
+                        uint32_t patchTableIndex;
+                        if ( dyldCacheGroup.hasPatchTableIndex(cacheOffsetOfSymbol, patchTableIndex) ) {
+                            //fprintf(stderr, "  need patch cache offset 0x%08X\n", cacheOffsetOfSymbol);
+                            // lookup address of symbol in override dylib and add patch info
+                            MachOParser::FoundSymbol foundInfo;
+                            if ( imageParser.findExportedSymbol(diag, symbolName, nullptr, foundInfo, nullptr) ) {
+                                DyldCacheOverride cacheOverride;
+                                assert(patchTableIndex < (1 << 24));
+                                assert(thisProxy->indexInGroup() < (1 << 8));
+                                assert(foundInfo.value < (1ULL << 32));
+                                cacheOverride.patchTableIndex = patchTableIndex;
+                                cacheOverride.imageIndex      = thisProxy->indexInGroup();
+                                cacheOverride.imageOffset     = foundInfo.value;
+                                _cacheOverrides.push_back(cacheOverride);
+                            }
+                        }
+                    });
+                }
+                // save off all images in closure with weak defines
+                if ( thisProxy->mh()->flags & (MH_WEAK_DEFINES|MH_BINDS_TO_WEAK) ) {
+                    staticImagesWithWeakDefs.insert(thisProxy);
+                }
+            }
+            // if any dylibs in the closure override a weak symbol in a cached dylib, then record the cache patches needed
+            if ( !staticImagesWithWeakDefs.empty() ) {
+                // build list of all weak def symbol names
+                __block std::unordered_map<std::string, DyldCacheOverride> weakSymbols;
+                for (ImageProxy* proxy : staticImagesWithWeakDefs ) {
+                    MachOParser weakDefParser(proxy->mh(), _dyldCache.cacheIsMappedRaw());
+                    weakDefParser.forEachWeakDef(diag, ^(bool strongDef, uint32_t segIndex, uint64_t segOffset, uint64_t addend, const char* symbolName, bool& stop) {
+                        weakSymbols[symbolName] = { 0, 0, 0 };
+                    });
+                }
+                // do a flat namespace walk of all images
+                std::vector<ImageProxy*> flatSearchOrder = flatLookupOrder();
+                for (ImageProxy* proxy : flatSearchOrder) {
+                    // only look at images that participate in weak coalescing
+                    if ( (proxy->mh()->flags & (MH_WEAK_DEFINES|MH_BINDS_TO_WEAK)) == 0 )
+                        continue;
+                    // look only at images in closure
+                    if ( proxy->groupNum() == 2 ) {
+                        MachOParser weakDefParser(proxy->mh(), _dyldCache.cacheIsMappedRaw());
+                        // check if this closure image defines any of the not-yet found weak symbols
+                        for (auto& entry : weakSymbols ) {
+                            if ( entry.second.imageOffset != 0 )
+                                continue;
+                            Diagnostics weakDiag;
+                            MachOParser::FoundSymbol foundInfo;
+                            if ( weakDefParser.findExportedSymbol(weakDiag, entry.first.c_str(), nullptr, foundInfo, nullptr) ) {
+                                assert(proxy->indexInGroup() < (1 << 8));
+                                if ( foundInfo.value >= (1ULL << 32) ) {
+                                    diag.warning("bad weak symbol address in %s", proxy->runtimePath().c_str());
+                                    return;
+                                }
+                                entry.second.imageIndex  = proxy->indexInGroup();
+                                entry.second.imageOffset = foundInfo.value;
+                            }
+                        }
+                    }
+                }
+                for (ImageProxy* proxy : flatSearchOrder) {
+                    // only look at images that participate in weak coalescing
+                    if ( (proxy->mh()->flags & (MH_WEAK_DEFINES|MH_BINDS_TO_WEAK)) == 0 )
+                        continue;
+                    // look only at images in dyld cache
+                    if ( proxy->groupNum() == 0 ) {
+                        const launch_cache::Image imageInCache = dyldCacheGroup.image(proxy->indexInGroup());
+                        MachOParser inCacheParser(proxy->mh(), _dyldCache.cacheIsMappedRaw());
+                        Diagnostics cacheDiag;
+                        for (auto& entry : weakSymbols) {
+                            if ( entry.second.imageOffset == 0 )
+                                continue;
+                            Diagnostics weakDiag;
+                            MachOParser::FoundSymbol foundInfo;
+                            if ( inCacheParser.findExportedSymbol(weakDiag, entry.first.c_str(), nullptr, foundInfo, nullptr) ) {
+                                uint32_t cacheOffsetOfSymbol = (uint32_t)(imageInCache.cacheOffset() + foundInfo.value);
+                                // see if this symbol is in patch table (used by something else in cache)
+                                uint32_t patchTableIndex;
+                                if ( dyldCacheGroup.hasPatchTableIndex(cacheOffsetOfSymbol, patchTableIndex) ) {
+                                    //fprintf(stderr, "  need patch cache offset 0x%08X\n", cacheOffsetOfSymbol);
+                                    DyldCacheOverride cacheOverride;
+                                    cacheOverride.patchTableIndex = patchTableIndex;
+                                    cacheOverride.imageIndex      = entry.second.imageIndex;
+                                    cacheOverride.imageOffset     = entry.second.imageOffset;
+                                    _cacheOverrides.push_back(cacheOverride);
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        // record fixups for each image
+        for (uint32_t imageIndex=0; imageIndex < imageCount; ++imageIndex) {
+            groupWriter.setImageFixups(diag, imageIndex, fixupInfos[imageIndex].fixups, fixupInfos[imageIndex].hasTextRelocs);
+        }
+    }
+
+    // pass 5: invalidate any images dependent on invalid images)
+    if ( someBadFixups && continueIfErrors ) {
+        __block bool somethingInvalidated = false;
+        do {
+            somethingInvalidated = false;
+            for (uint32_t i=0; i < imageCount; ++i) {
+                if ( groupWriter.isInvalid(i) )
+                    continue;
+                uint32_t depCount = groupWriter.imageDependentsCount(i);
+                for (uint32_t depIndex=0; depIndex < depCount; ++depIndex) {
+                    launch_cache::binary_format::ImageRef ref = groupWriter.imageDependent(i, depIndex);
+                    if ( ref.groupNum() == _groupNum ) {
+                        if ( groupWriter.isInvalid(ref.indexInGroup()) ) {
+                            // this image depends on something invalid, so mark it invalid
+                            //fprintf(stderr, "warning: image %s depends on invalid %s\n", _images[i]->runtimePath().c_str(), _images[ref.index()]->runtimePath().c_str());
+                            groupWriter.setImageInvalid(i);
+                            somethingInvalidated = true;
+                            break;
+                        }
+                    }
+                }
+            }
+        } while (somethingInvalidated);
+    }
+
+    // pass 6: compute initializer lists for each image
+    const bool log = false;
+    for (uint32_t imageIndex=0; imageIndex < imageCount; ++imageIndex) {
+        if ( groupWriter.isInvalid(imageIndex) )
+            continue;
+
+        auto inits = _images[imageIndex]->getInitBeforeList(*this);
+        if ( log && buildingDylibsInCache ) {
+            fprintf(stderr, "%s\n   init list: ", _images[imageIndex]->runtimePath().c_str());
+            for (launch_cache::binary_format::ImageRef ref : inits) {
+                if ( ref.groupNum() == 0 ) {
+                    std::string dep = _images[ref.indexInGroup()]->runtimePath();
+                    size_t off = dep.rfind('/');
+                    fprintf(stderr, "%s, ", dep.substr(off+1).c_str());
+                }
+            }
+            fprintf(stderr, "\n");
+        }
+        groupWriter.setImageInitBefore(imageIndex, inits);
+    }
+
+    // pass 7: compute DOFs
+    for (uint32_t imageIndex=0; imageIndex < imageCount; ++imageIndex) {
+        if ( groupWriter.isInvalid(imageIndex) )
+            continue;
+
+        auto inits = _images[imageIndex]->getInitBeforeList(*this);
+        if ( log && buildingDylibsInCache ) {
+            fprintf(stderr, "%s\n   DOFs: ", _images[imageIndex]->runtimePath().c_str());
+            for (launch_cache::binary_format::ImageRef ref : inits) {
+                if ( ref.groupNum() == 0 ) {
+                    std::string dep = _images[ref.indexInGroup()]->runtimePath();
+                    size_t off = dep.rfind('/');
+                    fprintf(stderr, "%s, ", dep.substr(off+1).c_str());
+                }
+            }
+            fprintf(stderr, "\n");
+        }
+        groupWriter.setImageInitBefore(imageIndex, inits);
+    }
+
+    // pass 8: add patch table entries iff this is dyld cache ImageGroup
+    assert(buildingDylibsInCache == (_patchTable != nullptr));
+    if ( _patchTable != nullptr ) {
+        for (uint32_t i=0; i < imageCount; ++i) {
+            const auto pos = _patchTable->find(_images[i]->mh());
+            if ( pos != _patchTable->end() ) {
+                for (const auto& entry : pos->second ) {
+                    uint32_t defFunctionOffset = entry.first;
+                    groupWriter.setImagePatchLocations(i, defFunctionOffset, entry.second);
+                }
+            }
+        }
+    }
+
+    // if this is a main closure group with an interposing dylib, add cache overrides
+    if ( !_cacheOverrides.empty() ) {
+        groupWriter.setGroupCacheOverrides(_cacheOverrides);
+    }
+
+    // align string pool
+    groupWriter.alignStringPool();
+}
+
+
+
+} // namespace dyld3
+
+