Q:

Is the a good way to find server side of mach_msg?

I am disassembling a lot of iOS operation system code now (frameworks, system daemons). One of the common methods to do a system call is usage of mach_msg.
So, I can see on the client side, how mach_msg is constructed. Quite often I know a system daemon, which will handle this call. However, I am not sure how to find call handler in this daemon disassembled code.
Is there a good rule of thumb, how to find a handler?

A:

I found following (at least in one deamon)
a) mach_msg_server_once method is called and first parameter to it is callback method
b) Usually this callback method checks for msgh_id and looks up in dispatch table addresses of methods to dispatch call to.

