One of the solutions here can be to extract the code to a dylib; it will be loaded after the shared cache. I checked in a test project, and the dylib loaded at the 0x300000000 (12 GB) address.