From 251761bb472818d9696a10ee60e48b161829a409 Mon Sep 17 00:00:00 2001
From: Objective-See Foundation <code@objective-see.com>
Date: Mon, 28 Apr 2025 14:42:20 -0700
Subject: [PATCH] improved handling of dylibs in dyld cache

---
 Filter.m                              | 16 ++++++++--------
 Items/Binary.h                        |  2 ++
 Items/Binary.m                        | 16 ++++++++--------
 remoteTaskService/remoteTaskService.m |  2 +-
 4 files changed, 19 insertions(+), 17 deletions(-)

diff --git a/Filter.m b/Filter.m
index b32af1c..2c016e9 100644
--- a/Filter.m
+++ b/Filter.m
@@ -499,9 +499,9 @@ bail:
     BOOL fulfills = NO;
     
     //handle '#apple'
-    // ->signed by apple
+    // ->signed by apple or in dyld cache
     if( (YES == [keyword isEqualToString:@"#apple"]) &&
-        ( (YES == [self isApple:binary]) ||
+        ( (YES == [self isApple:binary]) || (YES == binary.inCache) ||
           (YES == [binary.path isEqualToString:KERNEL_YOSEMITE]) ))
     {
         //happy
@@ -512,9 +512,9 @@ bail:
     }
     
     //handle '#nonapple'
-    // ->not signed by apple, and not kernel
+    // ->not signed by apple, and not in cache or not kernel
     else if( (YES == [keyword isEqualToString:@"#nonapple"]) &&
-             (YES != [self isApple:binary]) &&
+             (YES != [self isApple:binary]) && (YES != binary.inCache) &&
              (YES != [binary.path isEqualToString:KERNEL_YOSEMITE]) )
     {
         //happy
@@ -525,9 +525,9 @@ bail:
     }
     
     //handle '#signed'
-    // ->signed
+    // ->signed or in dyld cache
     else if( (YES == [keyword isEqualToString:@"#signed"]) &&
-             (YES == [self isSigned:binary]) )
+             ( (YES == [self isSigned:binary]) || (YES == binary.inCache) ) )
     {
         //happy
         fulfills = YES;
@@ -537,9 +537,9 @@ bail:
     }
     
     //handle '#unsigned'
-    // ->not signed
+    // ->not signed (and not in dyld cache)
     else if( (YES == [keyword isEqualToString:@"#unsigned"]) &&
-             (YES != [self isSigned:binary]) )
+             (YES != [self isSigned:binary]) && (!binary.inCache) )
     {
         //happy
         fulfills = YES;
diff --git a/Items/Binary.h b/Items/Binary.h
index 15937c6..6f9b51c 100644
--- a/Items/Binary.h
+++ b/Items/Binary.h
@@ -53,6 +53,8 @@
 //not found
 @property BOOL notFound;
 
+//in dyld cache
+@property BOOL inCache;
 
 /* VIRUS TOTAL INFO */
 
diff --git a/Items/Binary.m b/Items/Binary.m
index b74b50f..5e64008 100644
--- a/Items/Binary.m
+++ b/Items/Binary.m
@@ -50,17 +50,17 @@
         // ->either from bundle or just use system icon
         self.icon = [self getIcon];
         
-        //determine if its on disk
-        self.notFound = ![[NSFileManager defaultManager] fileExistsAtPath:self.path];
+        //is in dyld cache
+        self.inCache = isInSharedCache(self.path);
         
-        //though maybe its in the dyld shared cache
-        if( (YES == self.notFound) &&
-            (isInSharedCache(self.path)) )
+        //determine if its on disk
+        // though ignore files in dyld cache
+        if(YES != self.inCache)
         {
-            //unset
-            self.notFound = NO;
+            //set
+            self.notFound = ![[NSFileManager defaultManager] fileExistsAtPath:self.path];
         }
-    
+        
         //get attributes
         self.attributes = [[NSFileManager defaultManager] attributesOfItemAtPath:self.path error:nil];
     }
diff --git a/remoteTaskService/remoteTaskService.m b/remoteTaskService/remoteTaskService.m
index bf77efb..8435876 100644
--- a/remoteTaskService/remoteTaskService.m
+++ b/remoteTaskService/remoteTaskService.m
@@ -245,7 +245,7 @@ bail:
     
     //skip self
     // can't vmmap self :|
-    if(pid.intValue != getpid())
+    if(pid.intValue == getpid())
     {
         goto bail;
     }