macOS中libdyld.dylib位置及dlopen代码来源问询

问题背景 #

我在搭载M1芯片的macOS 12.5 Monterey系统中，尝试查找libdyld.dylib文件但未找到。根据lldb调试器的输出，该文件应位于/usr/lib/system/libdyld.dylib，但这个路径下并没有对应的物理文件。我知道dyld会从某处加载代码，但不清楚具体来源。

补充信息 #

查看/usr/lib/dyld（系统中无/System/Library/dyld文件）时发现，lldb调试进入库函数的代码，和反汇编/usr/lib/dyld中同一函数的代码不一致。以dlopen为例，lldb显示存在两个实现：

(lldbinit) image lookup -n dlopen
1 match found in /usr/lib/dyld:
        Address: dyld[0x0000000000025954] (dyld.__TEXT.__text + 149844)
        Summary: dyld`dyld4::APIs::dlopen(char const*, int)
1 match found in /usr/lib/system/libdyld.dylib:
        Address: libdyld.dylib[0x000000018033329c] (libdyld.dylib.__TEXT.__text + 1532)
        Summary: libdyld.dylib`dlopen

但调试进入dlopen函数时，实际进入的是/usr/lib/system/libdyld.dylib中的实现，而非/usr/lib/dyld中的：

(lldbinit) image lookup -v -a $pc
      Address: libdyld.dylib[0x000000018033329c] (libdyld.dylib.__TEXT.__text + 1532)
      Summary: libdyld.dylib`dlopen
       Module: file = "usr/lib/system/libdyld.dylib", arch = "arm64e"
       Symbol: id = {0x000001a3}, range = [0x0000000182f5b29c-0x0000000182f5b2d0), name="dlopen"

两者汇编代码也不同。lldb调试进入dlopen时的指令如下：

dlopen @ /usr/lib/system/libdyld.dylib:
->  0x182f5b29c (0x18033329c): e2 03 01 aa  mov     x2, x1
    0x182f5b2a0 (0x1803332a0): e1 03 00 aa  mov     x1, x0
    0x182f5b2a4 (0x1803332a4): 68 7b 2c b0  adrp    x8, 364397
    0x182f5b2a8 (0x1803332a8): 00 39 43 f9  ldr     x0, [x8, #0x670]
    0x182f5b2ac (0x1803332ac): 10 00 40 f9  ldr     x16, [x0]
    0x182f5b2b0 (0x1803332b0): f1 03 00 aa  mov     x17, x0
    0x182f5b2b4 (0x1803332b4): 51 7f ec f2  movk    x17, #0x63fa, lsl #48
    0x182f5b2b8 (0x1803332b8): 30 1a c1 da  autda   x16, x17
    0x182f5b2bc (0x1803332bc): 03 0e 47 f8  ldr     x3, [x16, #0x70]!
    0x182f5b2c0 (0x1803332c0): e4 03 10 aa  mov     x4, x16
    0x182f5b2c4 (0x1803332c4): f0 03 04 aa  mov     x16, x4
    0x182f5b2c8 (0x1803332c8): 30 e6 f7 f2  movk    x16, #0xbf31, lsl 

反汇编/usr/lib/dyld中的dlopen得到的指令如下（使用jtool2 -d /usr/lib/dyld | less）：

__ZN5dyld44APIs6dlopenEPKci:
25954   0xd503237f  PACIBSP
25958   0xa9bd57f6  STP         X22, X21, [SP, #-48]!
2595c   0xa9014ff4  STP         X20, X19, [SP, #16]
25960   0xa9027bfd  STP         X29, X30, [SP, #32]
25964   0x910083fd  ADD         X29, SP, #32
25968   0xaa0203f3  _MOV_R      X19, X2                 R19 = R2 (0x0)
2596c   0xaa0103f5  _MOV_R      X21, X1                 R21 = R1 (0x0)
25970   0xaa0003f6  _MOV_R      X22, X0                 R22 = R0 (0x0)
25974   0xaa1e03f4  _MOV_R      X20, X30                R20 = R30 (0x0)
25978   0xdac143f4  PACIA       X20, X31
2597c   0xf9400408  _LDR        X8, [X0, #8]            ...R8 = *(R0 + 8) = *0x8 = 0x780000002
25980   0xb9403508  _LDR        W8, [X8, #52]           ...R8 = *(R8 + 52) = *0x3c = 0x6000000000000
25984   0x7100091f  CMP         W8, #2
25988   0xfa400824  CCMP
2598c   0x540000e0  B.EQ        0x259a8
25990   0xaa1503e0  _MOV_R      X0, X21                 R0 = R21 (0x0)

疑问 #

目前仍不清楚该dlopen代码的来源是什么？

内容的提问来源于stack exchange，提问作者yehudahs