According to the macOS Big Sur 11 Beta Release Notes, "the system ships with a built-in dynamic linker cache of all system-provided libraries. As part of this change, copies of dynamic libraries are no longer present on the filesystem." If the libraries are no longer present on the filesystem, that makes it awfully hard to disassemble them! Fortunately, there are ways to extract the system libraries from the cache. One way is provided by Apple itself: the
dyld_shared_cache_util command-line tool. Unfortunately, this tool does not come installed with macOS Big Sur. However, the tool is open source, so we can build it ourselves. You can download the dyld project from Apple Open Source. The latest version is a little behind, at macOS 10.15.3, but that works fine for our purpose. The download contains a convenient Xcode project. Don't bother trying to build all targets in Xcode, just build the
dyld_shared_cache_util target. You'll need to make a number of modifications in order to build and run the target successfully. I'm assuming that you're building with Xcode 12 on Big Sur.
macosx.internal, which is only available to Apple engineers.
dyld_priv.h, delete references to
__API_UNAVAILABLEmacros. Xcode doesn't seem to understand those.
Closure.cpp, comment out the includes for
corecryptoheaders. Also comment out the
!TARGET_OS_DRIVERKITsection in the
Diagnostics.cpp, comment out the includes for
libc_private.h. Also comment out implementations of
Diagnosticsfunctions until that file compiles.
MachOLoaded.cpp, comment out the includes for the
corecryptoheaders. Also comment out the implementation of the
dyld_shared_cache_util.cpp, change the first argument of
pathBuffer. The dyld project also contains the
dsc_extractor.bundletarget, but that already comes installed on macOS Big Sur, so there's no need to build it.
After you've successfully built the
dyld_shared_cache_util tool, just run it with the shared cache:
% mkdir ~/Desktop/libraries % dyld_shared_cache_util -extract ~/Desktop/libraries /System/Library/dyld/dyld_shared_cache_x86_64
It may take a minute or two to finish. When it's finished, you'll have copies of all the system libraries on the your Desktop. Happy disassembling!