2023-07-26

Apple's documentation on the Mach-O format is outdated. To get relevant information you need to take a look at the <mach-o/loader.h> header, find relevant code on Github, and land on some blog posts by chance.

I was researching how constructors and destructors were stored in a shared library. Nowadays, in the Mach-O 64-bit format, shared libraries' constructors are stored in the __init_offsets section of the __TEXT segment.

But there wasn't any structure mentioning destructors. After passing my shared library on MachOView, I realized that clang added another constructor, __GLOBAL_init_65535. That constructor called __cxa_atexit twice.

__cxa_atexit is a function responsible for registering functions to be called when the library is unloaded.

After looking up the instructions and the calling conventions for arm64, I deducted that __GLOBAL_init_65535 registered _term1 and _term2 as callbacks.