How to insert a LC_LOAD_DYLIB command into a Mach-O binary or join a static library to an existing binary (IOS)

This is the first time I am asking on stackoverflow and I am desperate.

My task is to load a dylib or join a static lib to an already existing executable for an IOS device.

I will be using the static void __attribute__((constructor)) initialize(void) to start the swizzling. This executable is for in house enterprise appstore so i do not need to go thru the apple appstore (since they will reject it).

The reason for this is to take an existing IPA from a customer and their signing keys and add a new functionality to their application without requiring a developer intervention.

There is one company doing that called nukona. You can watch the movie here:

I can tell you that i tried to put LSEnvironment inside the plist file with a DYLD_INSERT_LIBRARIES but it turns out LSEnvironment does not seem to have any effect in the sandbox of an IOS application.

I also tried install_name_tool for changing one of the dependencies and replacing it with my dylib (which has that dependecy as well). It crashes without information why.

Obviously, if i add the dylib to a test application in XCode and recompile it works perfectly which is a given. However, this is something i cannot ask, for example, an administrator of a company. Rebuilding may deter customers of using this lib.

Here is a related link i found on stack overflow but for osx and i need it for IOS. How to insert a LC_LOAD_DYLIB command into a Mach-O binary (OSX)

The only thing i can think off is to edit the binary load commands some how, but i am not sure how and how to do it taking into account the relocation tables etc...

Any alternative is welcome.

Thank you for your time.


I open-sourced optool which does exactly this (I haven't tested it on iOS but it should work. Open up an issue if you have problems)

Need Your Help

Change the least significant bit (LSB) in java


I am trying to change the LSB of a numerical value, say 50 which LSB is 0 because 50 % 2 is 0 (remainder operator) to a value of 1. Thus change the LSB from 0 to 1 in this case.