These tables are reached through linkedit_data_commands: each is a file
offset and a size in __LINKEDIT.
Function starts
LC_FUNCTION_STARTS points at a stream of ULEB128 numbers: the address of
each function in __TEXT, as differences from the one before. The first
is the offset of the first function from the start of __TEXT. A zero, or
the end of the data, ends the list; the rest of the data is padding.
Unlike the symbol table it also covers static functions, so a stripped program still
shows where its functions begin. The explorer names a function without a symbol
sub_ and its address.
Data in code
LC_DATA_IN_CODE points at 8-byte records naming ranges of a code
section that are data rather than instructions, such as jump tables:
| Offset | Size | Field | Meaning |
|---|---|---|---|
| 0 | 4 | offset | Offset of the range from the Mach header. |
| 4 | 2 | length | Its length in bytes. |
| 6 | 2 | kind | 1 data, 2 8-bit jump table, 3 16-bit jump table, 4 32-bit jump table, 5 32-bit absolute jump table. |
The other tables
| Command | Holds | In the explorer |
|---|---|---|
| LC_SEGMENT_SPLIT_INFO | What is needed to move segments relative to each other in the dyld shared cache. | Listed as bytes |
| LC_DYLIB_CODE_SIGN_DRS | Designated requirements of linked libraries. | Listed as bytes |
| LC_LINKER_OPTIMIZATION_HINT | Hints that let the linker rewrite instruction pairs in object files. | Listed as bytes |
| LC_ATOM_INFO | Information about the file’s atoms. | Listed as bytes |
| LC_FUNCTION_VARIANTS, LC_FUNCTION_VARIANT_FIXUPS | Alternative implementations of a function, chosen at load time, and the fixups for them. | Listed as bytes |
| LC_LAZY_LOAD_DYLIB_INFO | Data for lazy-loaded libraries. | Listed as bytes |
Apple’s headers name these commands but do not document the layouts, so the explorer only shows where they are.