Is it safe to delete these 4 files in the folder called dyld

Question

The system storage seemed to take you a lot of space so I used this software which gives you a visual depiction of the size of files on your Mac (big files are big squares and so on) and turns out these 4 files in system have randomly inflated, it wasn't like this a few months ago. is it safe to delete these files they're in some folder called dyld. if not then what do I do to clear the system storage because I really need the space rn for some applications.

Answer 1

Is it safe to delete these 4 files in the folder called dyld (/System/Library/dyld/)?

Short answer

No, in Big Sur and later it's not safe to delete them (from the screenshot in your question, I see you are on macOS 11 Big Sur).

Long answer

In previous macOS versions, those files were located in /var/db/dyld/ instead of /System/Library/dyld/, and could be recreated with this command (see for example Trying to force update_dyld_shared_cache but having some errors):

sudo update_dyld_shared_cache -root / -force

but update_dyld_shared_cache is deprecated in macOS Big Sur and later (running the command has as only output This tool is deprecated.).

Moving the cache files to a different location isn't the only change in macOS Big Sur and later, the purpose of those files has changed, too: they no longer seem to be cache files in the sense that they store commonly used shared libraries (from man update_dyld_shared_cache):

When loading [an executable file], dyld will first check if is in the share cache, and if it is will use that pre-bound version instead of opening, mapping, and binding the original file. This results in significant performance improvements to launch time.

but they store most of the macOS libraries.

Let me expand on this: the contents of /var/db/dyld/ (Catalina and earlier macOS versions) and /System/Library/dyld/ (Big Sur and later) are essentially the same. They both store pairs of files: a text map file (with a .map extension) and a binary shared cache file (without extension), for example:

dyld_shared_cache_x86_64h.map
dyld_shared_cache_x86_64h

The text map file contains information about the shared cache file, and looks like this:

mapping  EX 1331MB 0x7FFF20000000 -> 0x7FFF73398000
mapping  RW  224MB 0x7FFF80000000 -> 0x7FFF8E0C6000
mapping  RO  432MB 0x7FFFC0000000 -> 0x7FFFDB0E0000


/Library/Apple/System/Library/Accounts/Notification/CloudBookmarksAccountsNotifier.bundle/Contents/MacOS/CloudBookmarksAccountsNotifier
                  __TEXT 0x7FFF20040000 -> 0x7FFF20042000
                  __DATA 0x7FFF81B6B108 -> 0x7FFF81B6B8F0
              __LINKEDIT 0x7FFFC05C0000 -> 0x7FFFD8A4A538

/System/Library/AccessibilityBundles/AXSpeechImplementation.bundle/Versions/A/AXSpeechImplementation
                  __TEXT 0x7FFF20042000 -> 0x7FFF20048000
                  __DATA 0x7FFF81B6B8F0 -> 0x7FFF81B6CF70
              __LINKEDIT 0x7FFFC05C0000 -> 0x7FFFD8A4A538

/System/Library/Accounts/Access/CloudKitAccessPlugin.bundle/Contents/MacOS/CloudKitAccessPlugin
                  __TEXT 0x7FFF20048000 -> 0x7FFF2004C000
                  __DATA 0x7FFF81B6CF70 -> 0x7FFF81B6D840
              __LINKEDIT 0x7FFFC05C0000 -> 0x7FFFD8A4A538
(...)

The format of the map file (which is unchanged in Big Sur) is pretty straighforward:

• It contains a 3-line header
• It contains several hundreds of entries, one for every file included in the shared cache file, that specify where relevant sections of the specified shared library can be found in the shared cache file

Prior to Big Sur, all shared libraries listed in the map file (that's 1809 in Catalina) were also located in the file system.

In Big Sur and later, most are not. In fact, in Big Sur 11.2.3, only 12 out of 1956 of the listed libraries can be found in the file system:

(for file in $(grep / /System/Library/dyld/dyld_shared_cache_x86_64.map); do ls $file; done) 2>&1 | grep "No such file or directory" | wc -l
1944
grep / /System/Library/dyld/dyld_shared_cache_x86_64.map | wc -l
1956

That's most probably the reason why the cache files were moved from /var/db/dyld to a SIP-protected folder, namely /System: to make it clear that you shouldn't mess around with them.

If you delete the shared cache files in /System/Library/dyld/, I'm afraid your system won't be able to boot or run.

Further reading

How to fix an extracted dyld from dyld_shared_cache_x86_64? Stack Exchange/Reverse Engineering question on extracting dylib files from the shared cache (mentions a utility named dyld_shared_cache_util from this open source project: dyld-shared-cache-big-sur)

https://www.exploit-database.net/?id=102279 Information about an exploit on how to get privilege escalation via update_dyld_shared_cache on macOS 10.14 Mojave.

https://blog.lse.epita.fr/2017/03/14/playing-with-mach-os-and-dyld.html#the-shared-cache Overview of the shared cache format on OS X 10.10 Yosemite

https://www.theiphonewiki.com/wiki/Dyld_shared_cache Shared cache differences between iOS and macOS prior to Big Sur

Answer 2

These are cached files that are created when your mac starts up, they are created again even if you delete it. as it is part of macos system files, it is recommended that you do not delete it.