But this segment is marked executable. I though this was a big no-no.

Symbol table:

  External symbols:
   0 _write, Section 0, Value 0x1010
    External, Undefined, no section
    Reference type: External non lazy,  Flags: 
   1 _exit, Section 0, Value 0x1016
    External, Undefined, no section
    Reference type: External non lazy,  Flags: 

  Indirect symbols:
   _write, type 0x1, sect 0, desc 0x0, val 0x1010
   _exit, type 0x1, sect 0, desc 0x0, val 0x1016    

Ok, so you currently want to direct the loader to update the symbol addresses in the __IMPORT.__nl_symbol_ptr section. Fine. My question is: how are you telling the loader that this is where it should fill in the address?

Do you expect the loader to rewrite the jmp instructions? If not, then you expect the loader to rewrite the _write2 and _exit2 qwords; how do you expect the loader to know where _write2 and _exit2 are (I called them this way here but they are generated by "sym.ptr" in your macros)?

The issues might be
- "LC_DYLD_INFO_ONLY" command is missing
- "__LINKEDIT" segment is malformed. (LC_DYLD_INFO_ONLY cmdn should actually point into this)

$ lldb ./demo
(lldb) target create "./demo"
Current executable set to './demo' (x86_64).
(lldb) run
Process 1002 launched: './demo' (x86_64)
warning: (x86_64) ./demo(0x0000000100000000) address 0x0000000100000000 maps to more than one section: demo.__TEXT and demo.__TEXT
warning: (x86_64) ./demo(0x0000000100000000) address 0x0000000100001000 maps to more than one section: demo.__DATA and demo.__DATA
warning: (x86_64) ./demo(0x0000000100000000) address 0x0000000100002000 maps to more than one section: demo.__IMPORT and demo.__IMPORT
Hello. This is linked.
Hello from thread 10
Hello from thread 9
Hello from thread 8
Hello from thread 7
Hello from thread 6
Hello from thread 5
Hello from thread 4
Hello from thread 3
Hello from thread 2
Hello from thread 1
Hello from thread 0
Process 1002 exited with status = 0 (0x00000000) 
(lldb) quit    

include 'x86/include/x64.inc'
use64

MachO.Settings.ProcessorType equ CPU_TYPE_X86_64
MachO.Settings.BaseAddress = 0x100000000; there is a no-write, no-read segment below this

include 'x86/macinc/macho.inc'
interpreter '/usr/lib/dyld'
uses '/usr/lib/libSystem.B.dylib' (1.0.0, 1225.0.0)
import exit,'_exit'
import pthread_create,'_pthread_create'
import pthread_mutex_init,'_pthread_mutex_init'
import pthread_mutex_destroy,'_pthread_mutex_destroy'
import pthread_mutex_lock,'_pthread_mutex_lock'
import pthread_mutex_unlock,'_pthread_mutex_unlock'
import pthread_join,'_pthread_join'
import printf,'_printf'
import write,'_write'


segment '__TEXT' readable executable

  section '__text' align 16

entry Start
Start:
        and     rsp, -16
        sub     rsp, 8*32

        mov     edi, 1
        lea     rsi, [sz_Hello]
        mov     edx, sz_Hello_end - sz_Hello
        call    write

        lea     rdi, [mutex]
        xor     esi, esi
        call    pthread_mutex_init

        mov     ebx, 10
.CreateNext:
        lea     rdi, [rsp+8*rbx]        ; thread handle
        xor     esi, esi
        mov     ecx, ebx                ; parameter to pass
        lea     rdx, [Thread_Routine]
        call    pthread_create
        sub     ebx, 1
        jns     .CreateNext

        mov     ebx, 10
.JoinNext:
        mov     rdi, qword[rsp+8*rbx]
        xor     esi, esi
        call    pthread_join
        sub     ebx, 1
        jns     .JoinNext

        lea     rdi, [mutex]
        call    pthread_mutex_destroy

        mov     rdi, rax
        call    exit
        int3

Thread_Routine:
        push    rbx
        mov     ebx, edi        ; parameter passed

        lea     rdi, [mutex]
        call    pthread_mutex_lock

        lea     rdi, [sz_ThreadHello]
        mov     esi, ebx
        call    printf

        lea     rdi, [mutex]
        call    pthread_mutex_unlock

        pop     rbx
        ret
         

section '__cstring' align 4

sz_Hello: db 'Hello. This is linked.', 10
sz_Hello_end:

sz_ThreadHello: db 'Hello from thread %d', 10
sz_ThreadHello_end:


segment '__DATA' readable writeable

  section '__data' align 16

mutex:  rb 48    

So, Thomasz, now I'm wondering why it didn't/doesn't work for you.

- in macros "macro interpreter? path" and "macro uses? lib&", you need an align 8 (not just align 4) at the end so that the size of the command is divisible by 8.

- make the first command that sets the zero address to no-read, no-write, and no-execute not not go all of the way to the base address. Im not sure why you would not want to use the addresses below the base address.

- In the case where you want to two symbols, each called "foo", but coming from different libraries, is the newer system required? or is it possible to do it with the older system?

- when using an imported symbol, it is more minimalistic to use it as "call [printf]" with printf being the location written by the loader. The current ones do "call printf; printf: jmp [_printf_]" and then _printf_ is the one written by the loader. This also means that the execute flag could be removed form the __IMPORT section, which might be the cause of errors from buggy loaders.

Killed: 9    

error: error: ::posix_spawnp ( pid => 16121, path = './lwan', file_actions = 0x7fff5fbde278, attr = 0x7fff5fbde288, argv = 0x7fc380c75660, envp = 0x7fc380c71ac0 ) err = Malformed Mach-o file (0x00000058)    

                if ~MachO.__TEXT & MachO.SEGNAME = '__TEXT'
                        MachO.__TEXT = 1
                        MachO.__stubs    

                if ~MachO.__TEXT & MachO.SEGNAME = '__TEXT'
                        MachO.__TEXT = 1
                        macro MachO.close_segment
                                MachO.__stubs
                                purge MachO.close_segment
                                MachO.close_segment