Building a custom Mach-O memory loader for macOS

In this blog we'll look at what it takes to construct an in-memory loader for Mach-O bundles within MacOS Ventura without using dyld. We'll walk through the lower-level details of what makes up a Mach-O file, how dyld processes load commands to map areas into memory, and how we can emulate this to avoid writing payloads to disk. I also recommend reading this post alongside the code publishedhereto fully understand the individual areas called out.

In keeping with Apple's migration to ARM architecture, this post will focus on the AARCH64 version of MacOS Ventura and XCode targeting macOS 12.0 and higher. With that said, let's dig in.

This is well beyond my pay grade, but I'm sure some of the more advanced macOS nerds among you will love this.